From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id D0C6C8015B for ; Tue, 15 Sep 2026 17:24:45 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68FHNWxq006496; Tue, 15 Sep 2026 20:23:33 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68FHNWxq006496 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="Q3J/Bmot" Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68FHN4WH006425 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Tue, 15 Sep 2026 20:23:04 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68FHN4WH006425 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-486f9d150c3so1620025f8f.3 for ; Tue, 15 Sep 2026 10:23:04 -0700 (PDT) X-Gm-Message-State: AFuF++mHyjSjDpkQWWN6UHmK6M65FQHbQ0stONlka8RW+dh2G+OpXvfJ CTnJ3Tea08xI9mFHLvpSQMAX6iT1QH6D+o5fN6vlYn/bvzt98aWC0PfRP+yGdrxrJZw1AfjiSlw hEzkt0FZYkcBAr7XkKmqcLX8aVmRpzqeQUnDBQA4ZqiAwrrmDf5ND6g== X-Gm-Gg: AYBFou0qeJlPsTIVFX3EX/vTT9mRzIZYlUzuRjdcrLrZ7KOp81D1aGWe2a2kuz8YuYD wAHrLjIV6V107Dp+T6ZeyboiHetwgjEHEMhZrMfy1aUpyj1kx91nkZLFBecOACKwZJoSzV1p/zW vuYme2D9nnbDCAbCzcgoythN1/BROl6Uc4jaXMdzA3KDVjaNTlFcxUrYwryKi+x5lFqWrbYSf0f F05n7ySWzwDN5Uok/W6NXV41cNAtdHRduGtmNpM3+pysuyAZEcg3Sd+ypU/BGXrbQwbjdDgmd4W LWtUN1OVxtMCBjdWocEdmOVFgCL3FVeKuOml3yFEK3noMWtT5Cpa2hWIurTWhNrey5iqH9F835Z ZpLcOjdxlopRZFxhG9ERsFjPEnl5A/Q== X-Received: by 2002:a5d:5f88:0:b0:487:72f:fb42 with SMTP id ffacd0b85a97d-487072ffc70mr10178370f8f.14.1789492984417; Tue, 15 Sep 2026 10:23:04 -0700 (PDT) X-Received: by 2002:a5d:5f88:0:b0:487:72f:fb42 with SMTP id ffacd0b85a97d-487072ffc70mr10178302f8f.14.1789492983904; Tue, 15 Sep 2026 10:23:03 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1789492983; cv=none; d=google.com; s=arc-20260327; b=LJQ4DlgWEFr99vhqwms8yswfmwytcUCbr+vuQHF2BsGxk+IUTWaCFlWWY5tizc17zO IdQw7iQ6K0C9BTxpXii8OjgemNKaFURhz0LZZyNtJ9y3K+ykLph33jmjM55oFoievfmR OX7iJp2Zn4nDL/XB3PTLG4lQHHM1es6dIVQ6upC2wpRrbmWoZBynLA6TVaHHkh8MSOIk zMtr6Iz1xTqIHF89+KkW6E2HFoirxRxndaxg7Tf+e33OkkZ18+fwunsbhvXTB+irvLgc hws4OBq1vdix0eVwzp+sXX4DvSXaOCX3ZZjH3HNXS+/KbA2B4/SwNdJWwBsxqKIFctM6 rRXw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=KRszzhu9nJBzA3VvRFpCp3EQFCxBl8hUI0U9MNhu6xM=; fh=QQvtjDaAlLft5IR2jnjma4lVp8TaaKU12WD0fWdFifQ=; b=Wc7pp4sI7j5l3sr5irg7FcvMfaKRsHruyEM5dA2w+b5FjC1YDBcLdMBK+p5sAjRPEK WHJwy0tua8cYstf75Z2iwhWDhx6vKO6Nh73I1QCwjyZYVnurogYNLWji2DnP3fRcuSPP X//D6WGuIU/vx68ucn4VXzFCh7PwMWPh2f/sVxH7R3VTLZg7aKgKT6/KJvWnbLM4oyfV 0uAxP24coBU1KkmgDYgc93BgdVpLpa1cvc3HXgldBpxWIP0xM+HNcxrmVdPFl3S2d6NR a0FBjyJNZo5N4sQADF5vmsMc4Joq25Aakj1qpEjXGw0cFk1x7r1qQk3mBNgjqb4wZsCR WxEw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b="Q3J/Bmot"; spf=pass (google.com: domain of vladimir.riabchun@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=vladimir.riabchun@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-4870bf5338asi355837f8f.279.2026.09.15.10.23.03 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 15 Sep 2026 10:23:03 -0700 (PDT) Received-SPF: pass (google.com: domain of vladimir.riabchun@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b="Q3J/Bmot"; spf=pass (google.com: domain of vladimir.riabchun@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=vladimir.riabchun@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=KRszzhu9nJBzA3VvRFpCp3EQFCxBl8hUI0U9MNhu6xM=; b=Q3J/BmotqYxo r/+XXeTpnjUrPPpAFtSvtSfD3YXlvPS22hlgSauzWPFMRF52Yu0u2voE+AqcNdD3kcuGX6MI0ImCj 0pOzOO85rR9bVZqMbACvwAHW/1G6A9BDQn1oL1tz/bWupGwz42x0b0Vgjwcev8DYFmjItiaf+jeDL 3uXCyJGTJvNsDWS1N+c/t9EH9h4v2hHHZPlgz3FpkYjZvwAo+ovVY+TXU6IXpqi1a46Tqhv50YmLX zJDekpV6BhOb+Uj9IL0Zjfl2JG4QOg7jwk3eimDWw7ST6A21CWaMNny4MYGWiR/LRY/PPnA7ivL0z mDp4tbUJQzMLx1Yj7toOxg==; Received: from [130.117.225.5] (helo=dev012.aci.vzint.dev) by relay.virtuozzo.com with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1x6WpK-00GSrt-1c; Tue, 15 Sep 2026 19:22:53 +0200 From: Vladimir Riabchun To: devel@openvz.org Date: Tue, 15 Sep 2026 17:22:32 +0000 Message-ID: <1192cb6b90315be4aea86501a203310202147ee2.1789491989.git.vladimir.riabchun@virtuozzo.com> X-Mailer: git-send-email 2.47.1 In-Reply-To: References: MIME-Version: 1.0 X-OZ-Fwd: true Subject: [Devel] [PATCH VZ10 v9 4/8] ve: Move from global VE mounts limit to per-VE limit X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org This change unifies mount limit handling with other VE limits. This will simplify refactoring later and allow more precise limits control from one place. https://virtuozzo.atlassian.net/browse/VSTOR-135520 Feature: per-ve failcounters Signed-off-by: Vladimir Riabchun --- include/linux/ve.h | 9 +++-- kernel/ve/ve.c | 34 ++++++++++++++++++- kernel/ve/veowner.c | 19 ----------- tools/testing/selftests/ve/ve_ns_owner_test.c | 6 +++- 4 files changed, 45 insertions(+), 23 deletions(-) diff --git a/include/linux/ve.h b/include/linux/ve.h index 65c058c0f34d..fabc608e31f5 100644 --- a/include/linux/ve.h +++ b/include/linux/ve.h @@ -96,7 +96,13 @@ struct ve_struct { atomic_t nd_neigh_nr; unsigned long meminfo_val; + /* + * Operations with a big amount of mount points can require a lot of time. + * These operations take the global lock namespace_sem, so they can affect + * other containers. + */ atomic_t mnt_avail_nr; /* number of available VE mounts */ + int mnt_max_nr; #ifdef CONFIG_COREDUMP char core_pattern[CORENAME_MAX_SIZE]; @@ -143,8 +149,7 @@ extern int nr_ve; #define NETNS_MAX_NR_DEFAULT 256 /* number of net-namespaces per-VE */ #define NETIF_MAX_NR_DEFAULT 256 /* number of net-interfaces per-VE */ #define BPF_PROG_MAX_NR_DEFAULT 256 /* number of loaded BPF progs per-VE */ - -extern unsigned int sysctl_ve_mount_nr; +#define MNT_MAX_NR_DEFAULT 4096 /* number of mounts per-VE */ #ifdef CONFIG_VE static inline void ve_set_state(struct ve_struct *ve, int new_state) diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c index 58a0c4b8e36e..a33e55991e52 100644 --- a/kernel/ve/ve.c +++ b/kernel/ve/ve.c @@ -83,6 +83,7 @@ struct ve_struct ve0 = { .arp_neigh_nr = ATOMIC_INIT(0), .nd_neigh_nr = ATOMIC_INIT(0), .mnt_avail_nr = ATOMIC_INIT(INT_MAX), + .mnt_max_nr = INT_MAX, .meminfo_val = VE_MEMINFO_SYSTEM, #ifdef CONFIG_X86 .umh_running_helpers = ATOMIC_INIT(0), @@ -787,7 +788,8 @@ static struct cgroup_subsys_state *ve_create(struct cgroup_subsys_state *parent_ atomic_set(&ve->arp_neigh_nr, 0); atomic_set(&ve->nd_neigh_nr, 0); - atomic_set(&ve->mnt_avail_nr, sysctl_ve_mount_nr); + ve->mnt_max_nr = MNT_MAX_NR_DEFAULT; + atomic_set(&ve->mnt_avail_nr, MNT_MAX_NR_DEFAULT); #ifdef CONFIG_COREDUMP strcpy(ve->core_pattern, "core"); @@ -1068,6 +1070,30 @@ static s64 ve_mnt_avail_nr_read(struct cgroup_subsys_state *css, struct cftype * return atomic_read(&css_to_ve(css)->mnt_avail_nr); } +static u64 ve_mnt_max_nr_read(struct cgroup_subsys_state *css, struct cftype *cft) +{ + return css_to_ve(css)->mnt_max_nr; +} + +static int ve_mnt_max_nr_write(struct cgroup_subsys_state *css, struct cftype *cft, u64 val) +{ + struct ve_struct *ve = css_to_ve(css); + int delta; + + if (!ve_is_super(get_exec_env())) + return -EPERM; + + if (val > INT_MAX) + return -EOVERFLOW; + + down_write(&ve->op_sem); + delta = val - ve->mnt_max_nr; + ve->mnt_max_nr = val; + atomic_add(delta, &ve->mnt_avail_nr); + up_write(&ve->op_sem); + return 0; +} + static u64 ve_netif_max_nr_read(struct cgroup_subsys_state *css, struct cftype *cft) { return css_to_ve(css)->netif_max_nr; @@ -1630,6 +1656,12 @@ static struct cftype ve_cftypes[] = { .name = "mnt_avail_nr", .read_s64 = ve_mnt_avail_nr_read, }, + { + .name = "mnt_max_nr", + .flags = CFTYPE_NOT_ON_ROOT, + .read_u64 = ve_mnt_max_nr_read, + .write_u64 = ve_mnt_max_nr_write, + }, { .name = "netif_max_nr", .flags = CFTYPE_NOT_ON_ROOT, diff --git a/kernel/ve/veowner.c b/kernel/ve/veowner.c index 1e631baf0de9..c77735f8c035 100644 --- a/kernel/ve/veowner.c +++ b/kernel/ve/veowner.c @@ -48,26 +48,7 @@ static void prepare_proc(void) * ------------------------------------------------------------------------ */ -/* - * Operations with a big amount of mount points can require a lot of time. - * These operations take the global lock namespace_sem, so they can affect - * other containers. Let us allow no more than sysctl_ve_mount_nr mount - * points for a VE. - */ -unsigned int sysctl_ve_mount_nr = 4096; -static int ve_mount_nr_min = 0; -static int ve_mount_nr_max = INT_MAX; - static struct ctl_table vz_fs_table[] = { - { - .procname = "ve-mount-nr", - .data = &sysctl_ve_mount_nr, - .maxlen = sizeof(sysctl_ve_mount_nr), - .mode = 0644, - .proc_handler = proc_dointvec_minmax, - .extra1 = &ve_mount_nr_min, - .extra2 = &ve_mount_nr_max, - }, { .procname = "fsync-enable", .data = &ve0.fsync_enable, diff --git a/tools/testing/selftests/ve/ve_ns_owner_test.c b/tools/testing/selftests/ve/ve_ns_owner_test.c index c3fa7d7b7f9c..dcff4d54172d 100644 --- a/tools/testing/selftests/ve/ve_ns_owner_test.c +++ b/tools/testing/selftests/ve/ve_ns_owner_test.c @@ -50,7 +50,7 @@ * any spurious accounting against the parent ve would overflow it. */ #define VE_NETNS_MAX 3 -#define VE_MOUNTS_MAX 4096 +#define VE_MOUNTS_MAX 32 /* * Synchronisation across the clone() boundary: child does its setup, @@ -173,6 +173,10 @@ FIXTURE_SETUP(ve_ns_owner) snprintf(val, sizeof(val), "%d", VE_NETNS_MAX); ASSERT_EQ(write_file_at(self->cgv2_fd, path, val), 0); + snprintf(path, sizeof(path), "%d/ve.mnt_max_nr", self->ctid); + snprintf(val, sizeof(val), "%d", VE_MOUNTS_MAX); + ASSERT_EQ(write_file_at(self->cgv2_fd, path, val), 0); + /* * The new ve cgroup has not been entered by anything yet, so its * mnt_avail_nr counter should be VE_MOUNTS_MAX. Each test below -- 2.47.1 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel