开源软件构建与测试

_service:tar_scm:lxc.spec Changed

@@ -1,4 +1,4 @@
-%global _release 13
+%global _release 14
 %global enable_isulad 1
 
 Name:           lxc
@@ -24,10 +24,11 @@
 Patch0013:	0013-ensure-cpuset-cgroup-built-while-writing-cgroup.proc.patch
 Patch0014:	0014-fix-cpuset-cgroup-error.patch
 Patch0015:	0015-append-mntopt-to-mntdata-if-not-found-in-mount_opt.patch
+Patch0016:	0016-unfreeze-freezing-container-and-bugfix-for-files.lim.patch
 
-%if "%toolchain" == "clang"
-Patch0016:  0016-disable-thinLTO-for-building-with-clang-and-ld.bfd.patch
-%endif
+# %if "%toolchain" == "clang"
+# Patch0017:  0017-disable-thinLTO-for-building-with-clang-and-ld.bfd.patch
+# %endif
 
 BuildRequires:  systemd-units git libtool graphviz docbook2X doxygen chrpath
 BuildRequires:  pkgconfig(libseccomp)
@@ -91,10 +92,10 @@
 %ifarch riscv64
 export LDFLAGS="%{build_ldflags} -latomic -pthread"
 %endif
-%if 0%{?enable_isulad}
-meson setup -Disulad=true -Dtests=true -Dprefix=/usr build
+%if "%{?toolchain}" == "clang"
+meson setup -Disulad=%{?enable_isulad:True}%{!?enable_isulad:False} -Dtests=true -Dprefix=/usr build -Db_lto=false
 %else
-meson setup -Disulad=false -Dtests=true -Dprefix=/usr build
+meson setup -Disulad=%{?enable_isulad:True}%{!?enable_isulad:False} -Dtests=true -Dprefix=/usr build
 %endif
 meson compile -C build
 
@@ -215,12 +216,18 @@
 %endif
 
 %changelog
-* Mon Mar 11 2024 jchzhou <zhoujiacheng@iscas.ac.cn> - 5.0.2-13
+* Mon Mar 11 2024 jchzhou <zhoujiacheng@iscas.ac.cn> - 5.0.2-14
 - Type: bugfix
 - ID:NA
 - SUG:NA
 - DESC: add a patch to disable ThinLTO when building with clang & ld.bfd
 
+* Mon Feb 26 2024 jikai<jikai11@huawei.com> - 5.0.2-13
+- Type: bugfix
+- ID:NA
+- SUG:NA
+- DESC: unfreeze freezing container and bugfix for files.limit and syscontainer
+
 * Thu Feb 22 2024 jikai<jikai11@huawei.com> - 5.0.2-12
 - Type: bugfix
 - ID:NA

_service:tar_scm:0016-disable-thinLTO-for-building-with-clang-and-ld.bfd.patch Deleted

_service:tar_scm:0016-unfreeze-freezing-container-and-bugfix-for-files.lim.patch Added

@@ -0,0 +1,228 @@
+From 26e0dea1270556b08c37c20da9db229de664dbd1 Mon Sep 17 00:00:00 2001
+From: jikai <jikai11@huawei.com>
+Date: Fri, 23 Feb 2024 17:30:12 +0800
+Subject: PATCH unfreeze freezing container and bugfix for files.limit and
+ syscontainer
+
+1. container in the freezing state must be unfreeze
+https://gitee.com/src-openeuler/lxc/pulls/498
+
+2. bugfix for files.limit invalid
+should return false if failed to write cgroup.procs after max times,
+or will lead to files.limit invalid
+
+3. run oci-prestart hook before switch root
+In: https://gitee.com/src-openeuler/lxc/pulls/513, we move oci-prestart hook
+after sync_cgroup_limits, for sync_cgroup_limits will write a *:* rwm device rule
+which will lead the device rule we write in oci-prestart hook useless.
+However the modification move oci-prestart hook after change root.
+We restore the changes. Since setup_limits_legacy will do the a *:* rwm write,
+we only ensure that setup_limits_legacy executes before oci-prestart.
+
+Signed-off-by: jikai <jikai11@huawei.com>
+---
+ src/lxc/cgroups/cgfsng.c |  2 ++
+ src/lxc/conf.c           |  6 ++++
+ src/lxc/lxccontainer.c   |  7 +++++
+ src/lxc/start.c          | 61 +++++++++++++++++++++++++---------------
+ src/lxc/sync.c           |  6 ++--
+ src/lxc/sync.h           | 10 ++++---
+ 6 files changed, 62 insertions(+), 30 deletions(-)
+
+diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
+index 471c281..311bdf7 100644
+--- a/src/lxc/cgroups/cgfsng.c
++++ b/src/lxc/cgroups/cgfsng.c
+@@ -1889,6 +1889,8 @@ retry:
+ 				retry_count++;
+ 				goto retry;
+ 			}
++			SYSERROR("Failed to enter cgroup \"%s/cgroup.procs\"", h->path_con);
++			return false;
+ 		}
+ #else
+ 		ret = lxc_writeat(h->dfd_con, "cgroup.procs", pidstr, len);
+diff --git a/src/lxc/conf.c b/src/lxc/conf.c
+index 595e605..9e7f6a2 100644
+--- a/src/lxc/conf.c
++++ b/src/lxc/conf.c
+@@ -4900,6 +4900,12 @@ int lxc_setup(struct lxc_handler *handler)
+ 	if (ret < 0)
+ 		return log_error(-1, "Failed to setup \"/dev\" symlinks");
+ 
++#ifdef HAVE_ISULAD
++	/* Ask parent to run oci prestart hooks and wait for him to finish. */
++	if (!lxc_sync_barrier_parent(handler, START_SYNC_OCI_PRESTART_HOOK)) {
++		return log_error(-1, "Failed to sync parent to start host hook");
++	}
++#endif
+ 	ret = lxc_setup_rootfs_switch_root(&lxc_conf->rootfs);
+ 	if (ret < 0)
+ 		return log_error(-1, "Failed to pivot root into rootfs");
+diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
+index 5720cf7..318b7f5 100644
+--- a/src/lxc/lxccontainer.c
++++ b/src/lxc/lxccontainer.c
+@@ -560,7 +560,14 @@ static bool do_lxcapi_unfreeze(struct lxc_container *c)
+ 		return false;
+ 
+ 	s = lxc_getstate(c->name, c->config_path);
++#ifdef HAVE_ISULAD
++	// Prevent lxc from unexpectedly exiting when executing freeze,
++	// causing the container to be in the FREEZING state,
++	// making normal life cycle management impossible.
++	if (s == FROZEN || s == FREEZING) {
++#else
+ 	if (s == FROZEN) {
++#endif
+ 		ret = cgroup_unfreeze(c->name, c->config_path, -1);
+ 		if (ret == -ENOCGROUP2)
+ 			ret = lxc_unfreeze(c->lxc_conf, c->name, c->config_path);
+diff --git a/src/lxc/start.c b/src/lxc/start.c
+index 0a5cb26..2fea7b0 100644
+--- a/src/lxc/start.c
++++ b/src/lxc/start.c
+@@ -1643,11 +1643,6 @@ static int do_start(void *data)
+ 	}
+ 
+ #ifdef HAVE_ISULAD
+-	/* Ask father to run oci prestart hooks and wait for him to finish. */
+-	if (!lxc_sync_barrier_parent(handler, START_SYNC_OCI_PRESTART_HOOK)) {
+-		return log_error(-1, "Failed to sync parent to start host hook");
+-	}
+-
+ 	/* close pipes after sync fds */
+ 	/* isulad: dup2 pipe00 to container stdin, pipe11 to container stdout, pipe21 to container stderr */
+ 	if (handler->disable_pty) {
+@@ -2383,7 +2378,9 @@ static int lxc_spawn(struct lxc_handler *handler)
+ 		goto out_delete_net;
+ 	}
+ 
+-	if (!lxc_sync_wait_child(handler, START_SYNC_CGROUP_LIMITS))
++#ifdef HAVE_ISULAD
++	// OCI prestart hook should run before lxc_setup_rootfs_switch_root.
++	if (!lxc_sync_wait_child(handler, START_SYNC_OCI_PRESTART_HOOK))
+ 		goto out_delete_net;
+ 
+ 	/*
+@@ -2403,25 +2400,8 @@ static int lxc_spawn(struct lxc_handler *handler)
+ 	}
+ 	TRACE("Set up cgroup2 device controller limits");
+ 
+-	cgroup_ops->finalize(cgroup_ops);
+-	TRACE("Finished setting up cgroups");
+-
+-	/* Run any host-side start hooks */
+-	ret = run_lxc_hooks(name, "start-host", conf, NULL);
+-	if (ret < 0) {
+-		ERROR("Failed to run lxc.hook.start-host");
+-		goto out_delete_net;
+-	}
+-
+-	if (!lxc_sync_wake_child(handler, START_SYNC_FDS))
+-		goto out_delete_net;
+-
+-#ifdef HAVE_ISULAD
+ 	// OCI prestart hook should run after setup_limits_legacy.
+ 	// Otherwise 'syscontainer-hooks' write devices rule will be useless.
+-	if (!lxc_sync_wait_child(handler, START_SYNC_OCI_PRESTART_HOOK))
+-		goto out_delete_net;
+-
+ 	/* isulad: Run oci prestart hook at here */
+ 	ret = run_oci_hooks(name, "oci-prestart", conf, lxcpath);
+ 	if (ret < 0) {
+@@ -2442,6 +2422,41 @@ static int lxc_spawn(struct lxc_handler *handler)
+ 		goto out_delete_net;
+ #endif
+ 
++	if (!lxc_sync_wait_child(handler, START_SYNC_CGROUP_LIMITS))
++		goto out_delete_net;
++
++#ifndef HAVE_ISULAD
++	/*
++	 * With isolation the limiting devices cgroup was already setup, so
++	 * only setup devices here if we have no namespace directory.
++	 */
++	if (!handler->conf->cgroup_meta.namespace_dir &&
++	    !cgroup_ops->setup_limits_legacy(cgroup_ops, handler->conf, true)) {
++		ERROR("Failed to setup legacy device cgroup controller limits");
++		goto out_delete_net;
++	}
++	TRACE("Set up legacy device cgroup controller limits");
++
++	if (!cgroup_ops->devices_activate(cgroup_ops, handler)) {
++		ERROR("Failed to setup cgroup2 device controller limits");
++		goto out_delete_net;
++	}
++	TRACE("Set up cgroup2 device controller limits");
++#endif
++
++	cgroup_ops->finalize(cgroup_ops);
++	TRACE("Finished setting up cgroups");
++
++	/* Run any host-side start hooks */
++	ret = run_lxc_hooks(name, "start-host", conf, NULL);
++	if (ret < 0) {
++		ERROR("Failed to run lxc.hook.start-host");
++		goto out_delete_net;
++	}
++
++	if (!lxc_sync_wake_child(handler, START_SYNC_FDS))
++		goto out_delete_net;
++
+ 	if (handler->ns_unshare_flags & CLONE_NEWCGROUP) {
+ 		/* Now we're ready to preserve the cgroup namespace */
+ 		ret = lxc_try_preserve_namespace(handler, LXC_NS_CGROUP, "cgroup");
+diff --git a/src/lxc/sync.c b/src/lxc/sync.c
+index f156809..09d932b 100644
+--- a/src/lxc/sync.c
++++ b/src/lxc/sync.c
+@@ -66,16 +66,16 @@ static inline const char *start_sync_to_string(int state)
+ 		return "configure";
+ 	case START_SYNC_POST_CONFIGURE:
+ 		return "post-configure";
+-	case START_SYNC_CGROUP_LIMITS:
+-		return "cgroup-limits";
+ 	case START_SYNC_IDMAPPED_MOUNTS:
+ 		return "idmapped-mounts";
+-#ifdef HAVE_ISULAd
++#ifdef HAVE_ISULAD
+ 	case START_SYNC_OCI_PRESTART_HOOK:
+ 		return "oci-prestart-hook";
+ 	case START_SYNC_POST_OCI_PRESTART_HOOK:
+ 		return "post-oci-prestart-hook";
+ #endif
++	case START_SYNC_CGROUP_LIMITS:
++		return "cgroup-limits";
+ 	case START_SYNC_FDS:
+ 		return "fds";
+ 	case START_SYNC_READY_START:

_service:tar_scm:0017-disable-thinLTO-for-building-with-clang-and-ld.bfd.patch Added

_service Changed

Changes of Revision 2