cpuguaranteed conditional in the code was flipped.

[util-vserver.git] / src / vsh.c

diff --git a/src/vsh.c b/src/vsh.c
index 1cb0522..c8f3417 100644 (file)
--- a/src/vsh.c
+++ b/src/vsh.c
@@ -37,6 +37,7 @@
 #include <sys/mount.h>
 #include <sys/types.h>
 #include <sys/stat.h>
+#include <sys/resource.h>
 #include <fcntl.h>
 #include <ctype.h>
 #include <stdarg.h>
@@ -204,19 +205,14 @@ static int sandbox_chroot(uid_t uid)
 
 struct resources {
        char *name;
-       int *limit;
+       unsigned long long *limit;
 };
 
 #define VSERVERCONF "/etc/vservers/"
-static void get_limits(char *context, int *cpu, int *mem, int *task) {
+static void get_limits(char *context, struct resources *list){
        FILE *fb;
        size_t len = strlen(VSERVERCONF) + strlen(context) + strlen(".conf") + NULLBYTE_SIZE;
        char *conf = (char *)malloc(len);       
-       struct resources list[] = 
-               {{"MEMLIMIT", mem},
-                {"CPULIMIT", cpu},
-                {"TASKLIMIT", task},
-                {0,0}};
        struct resources *r;
 
        sprintf(conf, "%s%s.conf", VSERVERCONF, context);
@@ -284,12 +280,23 @@ static int sandbox_processes(xid_t xid, char *context)
                exit(1);
        }
 #else
+       struct vc_rlimit limits;
        struct vc_ctx_caps caps;
        struct vc_ctx_flags flags;
-       int cpu = VC_LIM_KEEP;
-       int mem = VC_LIM_KEEP;
-       int task = VC_LIM_KEEP;
-       get_limits(context,&cpu, &mem, &task);
+
+       xid_t ctx;
+       unsigned long long cpu = VC_LIM_KEEP;
+       unsigned long long mem = VC_LIM_KEEP;
+       unsigned long long task = VC_LIM_KEEP;
+       unsigned long long cpuguaranteed = 0;
+       struct resources list[] = 
+               {{"MEMLIMIT", &mem},
+                {"CPULIMIT", &cpu},
+                {"CPUGUARANTEED", &cpuguaranteed},
+                {"TASKLIMIT", &task},
+                {0,0}};
+
+       get_limits(context,list);
        (void) (sandbox_chroot(xid));
 
        caps.ccaps = ~vc_get_insecureccaps();
@@ -300,46 +307,91 @@ static int sandbox_processes(xid_t xid, char *context)
        flags.flagword = VC_VXF_INFO_LOCK;
        flags.mask = VC_VXF_STATE_SETUP | VC_VXF_INFO_LOCK;
 
-       errno = 0;
-       if ((vc_ctx_create(xid) == VC_NOCTX) && (errno != EEXIST)) {
+       ctx = vc_ctx_create(xid);
+       if (ctx == VC_NOCTX && errno != EEXIST) {
                PERROR("vc_ctx_create(%d)", xid);
                exit(1);
        }
 
-       if (errno != EEXIST) {
-               struct vc_rlimit limits;
-               /* The context did not exist before, which requires that we set the various limit */
+       /* CPU    */
+       if (cpu != VC_LIM_KEEP) {
+               struct vc_set_sched sched = {
+                       .set_mask = 0
+               };
+
+               /* Need to distinguish between guarantee (hard) and
+                * best effort (share) from the vserver
+                * configuration.
+                */
+#define VC_VXF_SCHED_SHARE       0x00000800ull
+               flags.flagword |= VC_VXF_SCHED_HARD;
+               flags.mask |= VC_VXF_SCHED_HARD;
+               if (cpuguaranteed==0) {
+                       flags.flagword |= VC_VXF_SCHED_SHARE;
+                       flags.mask |= VC_VXF_SCHED_SHARE;
+               }
+
+               /* CPULIMIT value from /etc/vservers/xyz.conf */
+               sched.fill_rate = cpu;
+               sched.set_mask |= VC_VXSM_FILL_RATE;
 
-               /* CPU    */
-               /* not yet */
+               sched.interval  = 1000; /* Andy's default value */
+               sched.set_mask |= VC_VXSM_INTERVAL;
 
-               /* MEM    */
-               limits.min  = VC_LIM_KEEP;
-               limits.soft = VC_LIM_KEEP;
-               limits.hard = mem;
-               if (vc_set_rlimit(xid, 5, &limits)) {
+               /* set base token value for new contexts */
+               if (ctx != VC_NOCTX) {
+                       sched.tokens = 100; /* Andy's default value */
+                       sched.set_mask |= VC_VXSM_TOKENS;
                }
-       
-               /* TASK   */
-               limits.min  = VC_LIM_KEEP;
-               limits.soft = VC_LIM_KEEP;
-               limits.hard = task;
-               if (vc_set_rlimit(xid, 6, &limits)) {
-                       /* setting limit failed */
+
+               sched.tokens_min = 50; /* Andy's default value */
+               sched.tokens_max = 100; /* Andy's default value */
+               sched.set_mask |= VC_VXSM_TOKENS_MIN;
+               sched.set_mask |= VC_VXSM_TOKENS_MAX;
+
+               if (vc_set_sched(xid, &sched)==-1) {
+                       PERROR("vc_set_sched()");
+                       exit(1);
                }
        }
+
+       /* MEM    */
+       limits.min  = VC_LIM_KEEP;
+       limits.soft = VC_LIM_KEEP;
+       limits.hard = mem;
+       if (vc_set_rlimit(xid, RLIMIT_RSS, &limits)) {
+               PERROR("vc_set_rlimit(%d, %d, %d/%d/%d)",
+                      xid, RLIMIT_RSS, limits.min, limits.soft, limits.hard);
+               exit(1);
+       }
+       
+       /* TASK   */
+       limits.min  = VC_LIM_KEEP;
+       limits.soft = VC_LIM_KEEP;
+       limits.hard = task;
+       if (vc_set_rlimit(xid, RLIMIT_NPROC, &limits)) {
+               PERROR("vc_set_rlimit(%d, %d, %d/%d/%d)",
+                      xid, RLIMIT_NPROC, limits.min, limits.soft, limits.hard);
+               exit(1);
+       }
        
        if (vc_set_ccaps(xid, &caps) == -1) {
-               PERROR("vc_set_ccaps(%d, 0x%16ullx/0x%16ullx, 0x%16ullx/0x%16ullx)\n",
+               PERROR("vc_set_ccaps(%d, 0x%16ullx/0x%16ullx, 0x%16ullx/0x%16ullx)",
                       xid, caps.ccaps, caps.cmask, caps.bcaps, caps.bmask);
                exit(1);
        }
 
        if (vc_set_cflags(xid, &flags) == -1) {
-               PERROR("vc_set_cflags(%d, 0x%16llx/0x%16llx)\n",
+               PERROR("vc_set_cflags(%d, 0x%16llx/0x%16llx)",
                       xid, flags.flagword, flags.mask);
                exit(1);
        }
+
+       /* context already exists, migrate to it */
+       if (ctx == VC_NOCTX && vc_ctx_migrate(xid) == -1) {
+               PERROR("vc_ctx_migrate(%d)", xid);
+               exit(1);
+       }
 #endif
        return 0;
 }