From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 4551080069 for ; Fri, 28 Aug 2026 15:48:55 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 67SFlWxQ011198; Fri, 28 Aug 2026 18:47:33 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 67SFlWxQ011198 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="pNcLjkpk" Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 67SFlTFr011194 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Fri, 28 Aug 2026 18:47:30 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 67SFlTFr011194 Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2ce8a76df2dso20251075ad.2 for ; Fri, 28 Aug 2026 08:47:30 -0700 (PDT) X-Forwarded-Encrypted: i=3; AHgh+RqqN+hiNLqUuQziTt4jS6V/6///rnbQNGt5h1qNHHgBMkjogX6PvF74N4KHjagnjkRiZBHMqA==@openvz.org X-Gm-Message-State: AFuF++kwT7XIV1jrCOaPxSaVeSsGoImUWn2FLjaxM0aPc468vMCaXCLE zWOfxUGzUH/xBBfhW8/XGfZIKjrdEueQ3d4wo3iHTgZtRAiaBvIpitkylNNFKcxrHDg6Dk1b1Sm J+KIbVeoLyRemOlyzECiH4s7W752PW4gXBQK4FspiMsZD7grZtXZOpw== X-Gm-Gg: AR+sD10cUZoZ+c+h/5cDLHJ/sFlKyzD8XUhTNYbE06dTLQHlcmeAF73xrviE7Ji37Hw RD1qGPrtjT46iY6N4ZOmS21LLQtEYp/FK0wJdbqRrNuzodZRGDKYDIh7Yip3ZOgnquKRmkXW4MC mQwsmPFogW0vBlNc4Oh6w/9tXQ+AP2eCEGNVi3ljhrqAmZ7RtrRD+EZWGeuMjcBOjtBs+uduqVD 3Ta2Nu0QsTiD2ZXsI+QRJzD3+BlqATeUnAE0z2PolophP6qzZ3H71Y2FzXr8OIZi0xRNeYJnIzJ Qv2BoX8QbvtOnIxiJthXfg3mYY4MEm2W441x+7UgY9FabGwBl5XQNxJXiTH49vTeU0UM24uWxcB k7yH/OSYoP8QyQu6D7vmdHwPczY41VwXYX09EagTai0qdcvMzxRMxuC8eMwiykVrp436XXUulaI E5QssYkkGmtjUPd1tXwD5KWT1udw== X-Received: by 2002:a17:903:390f:b0:2d8:d4d1:313b with SMTP id d9443c01a7336-2d8d4d14bcdmr14350935ad.18.1787932048955; Fri, 28 Aug 2026 08:47:28 -0700 (PDT) X-Received: by 2002:a17:903:390f:b0:2d8:d4d1:313b with SMTP id d9443c01a7336-2d8d4d14bcdmr14349725ad.18.1787932048421; Fri, 28 Aug 2026 08:47:28 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1787932048; cv=pass; d=google.com; s=arc-20260327; b=hBxez+5Horh9NfhZJqJo0Oqo0dpMTYDBMZDFtOOnqw7AgYB20IIf0WsfH+jWYnf3qq 1Xgn8Ib9kzVxgqubrr50xStZyMrQlV/rB375Fqdsgw1ZfWmB8IfGWXnvWdUx46uH4dWa Bx5qzS+hNHkuBU3flN7OX+do3yf6Bw4I9tVgETox/3dq14VlIRWJuQjyufGL44suxpy6 NF8yxqBBp2CKOlctWKwEJMy9vgn6flJAX/TLqU0rlvB1SEiaTuZ/YdrdEk2a8pz2ZhgL q7RPVvZpDewpY611P5h50fr2cR1genAXlbXc8Y+D1JxLUXhuXdj2T3u7HEgWifWfesjs igbA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:content-transfer-encoding:in-reply-to:from :content-language:references:cc:to:subject:user-agent:date :message-id:dkim-signature; bh=d9TjB0TqX5j+qV9p3soe4E4TsxlktMGjVW1YGXXCEvY=; fh=lPxaIpnnOYUc6VfrcxE3S6APF+lKM9MEDrmx9bhq9wE=; b=IFGztWtNsi9XkEseNJe0OHaOOt0H5L9j8ay1OmyJjEF6cfQMsPmk7ZdC/kNzcb8gti RqfYfVjHp+GHATEly+8YYaW7JWj5uA7EHDzHtCGuWVQ1XOKAIbvZ/3MtWrme3xFrdlzy O55Z6NjfIpNsIY8t00cf1fIv/XlzKlvTGKh4eAT72NfkfJ6a4ec8O5fEQRbrJFmpm/lV GEotYnx9p4DbJBzBcDwqoqebw5692ReeAi7r5pO4onl/b31pnbuawxH3mXkPmn8VJm5B HnX+oKjsdIsylt7tbo1gAaUXnTnQZdJGjNfW89+k3USD6mobHTWfxUKcSf0IZ5pskG1F M9fQ==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector2 header.b=pNcLjkpk; arc=pass (i=1 spf=pass spfdomain=virtuozzo.com dkim=pass dkdomain=virtuozzo.com dmarc=pass fromdomain=virtuozzo.com); spf=pass (google.com: domain of ptikhomirov@virtuozzo.com designates 2a01:111:f403:c200::3 as permitted sender) smtp.mailfrom=ptikhomirov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from DU2PR03CU002.outbound.protection.outlook.com (mail-northeuropeazlp170110003.outbound.protection.outlook.com. [2a01:111:f403:c200::3]) by mx.google.com with ESMTPS id d9443c01a7336-2d75950d0e6si41067245ad.33.2026.08.28.08.47.27 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 28 Aug 2026 08:47:28 -0700 (PDT) Received-SPF: pass (google.com: domain of ptikhomirov@virtuozzo.com designates 2a01:111:f403:c200::3 as permitted sender) client-ip=2a01:111:f403:c200::3; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector2 header.b=pNcLjkpk; arc=pass (i=1 spf=pass spfdomain=virtuozzo.com dkim=pass dkdomain=virtuozzo.com dmarc=pass fromdomain=virtuozzo.com); spf=pass (google.com: domain of ptikhomirov@virtuozzo.com designates 2a01:111:f403:c200::3 as permitted sender) smtp.mailfrom=ptikhomirov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=cwrUxO/35sNbo6PB/LnXNMGKK95hrhjxe60LO98S66Fi46Z80rICFfXkp4iQtdB2CypZ93iHi9Hr1KBXMi/qzKBYjgoJ7y6hPXYwj/RGddzTiVDIZ4q8mu8F9Eg+NWK6NiCwvJWwek5qpq3lxAREGC8PeoNwEFbf+edAsQk/DizS3Ks3KghLy5smp5zAKOSlRRT9qVx+BU35Kd8XZo7OspkxIdgvfVPpZBwt9i0vR4vKZdgzgxWP12HNEJgNhhnwa7A9SLOtSECJdsD9RTe3fBMJzDYQiNSSt1Pg0emXmk7pQvs8RZxiIFw6MHSSYwYYnUrcglykrLRLYHPtJXkzYQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=d9TjB0TqX5j+qV9p3soe4E4TsxlktMGjVW1YGXXCEvY=; b=KbUGHrShe3BASmz89vdN5BwQPOoQH12unbA/YFVTpk+g92LKap3uZLan9P6g9GP+p02MgjBFf350y+K/cszksOAgJ7seZSmhHPmsyAcDFC5WZOPIMJttDuChF5wTXRbFlTeR4K0pA0lsdv7+WGwaacRHIzIpPjJM8InN3WP0U3BgjZX/TMSJHIYgIW0pEE02ZeE8dTM67+XW8ULI9VWplI7PfM7Wy5B9aSqPxsIOSFfrsKTwXzoCOYkMVHboMWDu70zprYzAHmG+EOggLplkmiX7WRGfVqN7QedT8PO7hcia32eAwgDZz1p1tE1yJoXsBe6/uCHSDwQKSkQk50CQ6g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=d9TjB0TqX5j+qV9p3soe4E4TsxlktMGjVW1YGXXCEvY=; b=pNcLjkpkqsxMaTu2yOB6tFYTZz7KCY6iUC/5QzwQOPhVHuPiosSwy4gpuEm7QYo8aCAoTl70TOQGQel+zW/bpWcaurBx/6tbJfB/W1ZqqKiOIVTFcCOkKruUsKUtvX9HyKZDm+ElxevRWthqv5Y691K81J+XySuvaFzr1GucpwLg5ZLkY0j0XvBEZgXSVcycNiq+tIJszQgAfocNtZHFBy/pFRSb2muOOGR+Vp02fZiHFpxLI7aYVgmFFwmuxzn+q1kQObrwDwpz3B0ujYSAgsfW/LMcsN9EDbciXdUr5J8BWm5ut468EI4aVG0m2GhpcFtB6ZMjm7QyT13rOhFLrQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from AM0PR08MB11804.eurprd08.prod.outlook.com (2603:10a6:20b:747::14) by PAXPR08MB7467.eurprd08.prod.outlook.com (2603:10a6:102:2b7::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.7; Fri, 28 Aug 2026 15:47:24 +0000 Received: from AM0PR08MB11804.eurprd08.prod.outlook.com ([fe80::bf46:f137:f6d2:5b3a]) by AM0PR08MB11804.eurprd08.prod.outlook.com ([fe80::bf46:f137:f6d2:5b3a%7]) with mapi id 15.21.0382.007; Fri, 28 Aug 2026 15:47:24 +0000 Message-ID: Date: Fri, 28 Aug 2026 17:47:23 +0200 User-Agent: Mozilla Thunderbird To: Konstantin Khorenko , devel@openvz.org References: <20260529144215.939517-1-ptikhomirov@virtuozzo.com> <20260529144215.939517-2-ptikhomirov@virtuozzo.com> <3ca2d5c2-3d7e-4694-ab65-d8b3fa8b6844@virtuozzo.com> <9f43be79-913a-4442-aa36-aa6059b02e4b@virtuozzo.com> Content-Language: en-US From: Pavel Tikhomirov In-Reply-To: <9f43be79-913a-4442-aa36-aa6059b02e4b@virtuozzo.com> X-ClientProxiedBy: BE1P281CA0032.DEUP281.PROD.OUTLOOK.COM (2603:10a6:b10:22::20) To AM0PR08MB11804.eurprd08.prod.outlook.com (2603:10a6:20b:747::14) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM0PR08MB11804:EE_|PAXPR08MB7467:EE_ X-MS-Office365-Filtering-Correlation-Id: 71573c81-c670-4e42-c83f-08df051ba77c X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|376014|1800799024|366016|23010399003|10070799003|10067099003|56012099006|5023799004|4143699003|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: vqrhyuVLBJuRLNC5/owX273g4cDEwu7FGPkCDxFvS/ERbj2UrJ0JzHViMQP5l/niIDs04/s8pPk6yZe6bzyz0U1osKcKg+DZeUQjfiX4glQgTjytd37IoJ43zvzcR1td59mKJV3bIk6bQ5Ozfm098zYweig9rlDuatomSDBGr360PC3o9jvRLixw/ZiY/kFaS/CdwW+5gfPp4RKfUlDY/CeJtr5YL2RsQE7CYFi3NZHu2l6hw0E6damkUcXHdE1a9uliO/c6GY2+Qb3WgL6OLZN7TRP9eC6KwZ0z8obfxWdrItUNfFs3y3SUt+wMdIs51IgJh7+JigE0LqpvdQln+GQZ5eM7MoeTEU6YEVHIygeGtfl/WaKr7TpJG8m93JHvA3f+qtvWh5jksl0QdcKhdNgNyopLEYrif/uePLT3QsErCMFwemjnsHjQE9eSfKmf65Af+OIqu0fvk7M/9FJVCl64jwHhXi2TdD4lEiCRMUL06EEc6NoG7VT8BgcHoVlolKF0PIQURqNM1d1y2vsTW5CNAkzz4K/F7Ulk/LNhbCxCY7Ix/JzpE/9yg+kHyYMmxjx0RBJCD7S4O+waU/CnlwGYfNNo9RiyQI3bewS1q1o3fVThrtJkCsURmPsl17UsgqyrcQCoO71bRTlV5gE14I/HQaNq8HXfVrylXWCi2YU= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR08MB11804.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(376014)(1800799024)(366016)(23010399003)(10070799003)(10067099003)(56012099006)(5023799004)(4143699003)(22082099003)(18002099003); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?UGlEWEpNQVFOOEhoMzd4UHFuWGRCSGNhbWt6ZldBR3pJTk85K1FNRk5mY2pp?= =?utf-8?B?QzRVRjdqaHNhRW5LNWZKNFh1RjFKN09NVEtERm9ycUhSZ1Q4K1pJTENCbGdP?= =?utf-8?B?bHpJRmJTWWNzTEM4UDc0WVIwTkQ0YXE1bzY4NzBSNmN6ZGdPZjhhNzI5UlhG?= =?utf-8?B?VUhkemxMMVBnSnhvRWhpdFlKM2ZQMTI1ejZmMjM2cGFWenpQRHVCUE12OC8x?= =?utf-8?B?cUhvTW5ndkU0SjJQbC9JNWFZWXJVRkFJZDlUd2ROM01xTlVPVWl3MExveHZ6?= =?utf-8?B?cVpnTkV2ZjJRUzUzYVE3TFVRYmtiNDl2K2xrMnRQdjFTOEdZUm5VMXFSbU50?= =?utf-8?B?dTZveWxtaElZOHZFeVdBd3dzbk1DK3hGSTQ2LzJDQ01kampqclR5N29EOXdu?= =?utf-8?B?b25ZU1Z1UUVDV2xTRFlxU0JOQlFRU0w0ZnZiN1V1QU5HT2NCNS83elQ1ODUv?= =?utf-8?B?Q3JBeC9zNlpjSDYyUnR1MW9Qdm91dG9BREkzcFhkejV2Wmd2VEpPenhIV0pP?= =?utf-8?B?ZFV4Q0RPS0NreU9teDdqd2wwbkRLemZpbGg0YlFsd1hwYit0cjkvcjRsdnk4?= =?utf-8?B?MjAwT0hlSk0rcldYcFZ6NnJYVFdubERvOHhaZmhTR2wrM2MxYmk2VStxUU90?= =?utf-8?B?WDZIUXJRNE9sRE5KVFlCbWMzMUZxREpYejdFbEUzdWw1Y1kvWmY0TUgvMGM5?= =?utf-8?B?ZElwaGFHUGhKL2E1czNrclpJeWJqTTZaZ0R3ODZaaFBaNFM1L3BVbEpNYWN0?= =?utf-8?B?MXM3MWxRY0poaW5yV3gyZm9vVmkrWjBPb3pHQWtubWtMVVo1c0lDS1owTExC?= =?utf-8?B?NDhMUDdMeGVrOEFNK2FMNVI1ZzJURllNR3FUbHBicnNCaCtxd0FoRU5YYndW?= =?utf-8?B?VTBCZ0hkSlk2elBNUUY4N2JLWnBud1o1VWhmMWxncFFVcEpiMytVZE5JTnlj?= =?utf-8?B?RGFFM25OeWVDeGszK2VrZVA5R2ZkUUNZTDE4WnFmZXRPa2pQQy9qSW9JL3Y4?= =?utf-8?B?MkdmcmJVWnJRaHJNUFoySzVWdDZUYkRjRllpUjBpUzlIOThxS0JmTFNrQ0xs?= =?utf-8?B?aXdPdEh3S2tmaVBDZkhMZDJMT3hQVUsyWnVuV25CL3prcGlxRTJvbk81QUx6?= =?utf-8?B?UmZ1LzlzTm9XdmRvZkpEUzhha05yYkVRZ3BHQzRTbnk0cFJBRVJkV04ya0xC?= =?utf-8?B?dXJTREdpdE1kbHR4Q0YrUE5EUGRHLzhOTHlrV3ltVzJtRU5NTFhWSVB1ZUdp?= =?utf-8?B?aFhhK2VZeElUUHZYRFpXa3hVYWo5TjhvREJmYTl2b0h0R3RPdEFoRXIwNGxQ?= =?utf-8?B?M3lBcURBaWI4R2lnMzZkbGlPTW9uUDNYOVpwKzFwVklkZDd6TWFNeG56QWh1?= =?utf-8?B?Y2hxR0paVEk1NS9BN0lIVUQySXBsZFNCc3hZZkNNc0FKY1J5R0g0bU9RTVNn?= =?utf-8?B?MFo5cmVKS0dBQ0tpOWoyLzFuTVZZN2N2cDlnRmhwd2VMR1AzdTk3ZVo1QWN1?= =?utf-8?B?L1BVbWNLOHFYL1A1OTJsVUJUWmhnNlhHZXcxcFRiaUdUZER5SURPam9UUkla?= =?utf-8?B?UUFMY0c1bXNUVXZid2FEczdreU5WREpIT2hmeTBHamNmNVRydlkxN1BpUk5O?= =?utf-8?B?YUhwdXJHOUd3UTRuZmhsaXpWd2dMY1NNNTc2MmkvdW9WM0RVRzJseWdIR3Mz?= =?utf-8?B?QjlCY1RUZmJRRUhTWnZjdkhpcy9BK0FjSkJRSTd0V3JYOHozdnh5SHJTU3Ux?= =?utf-8?B?ajUxS1ZZWjByNDV2K0R5bHFGZ0dNc1NqRUUyYzB6b0ZLcm1QQUtNRkxJVWR5?= =?utf-8?B?anFmVE9OWVY0Qi9HRmVVSkMzWFRlYW50T0IxaGlEYzYrWVVBV3N4aVRQbERm?= =?utf-8?B?K3pVV0JrUEFFSXl0MDQwQlgrc2RXS0FrcTlvaFlFSzM0N1FNUlNtVXNKTHEx?= =?utf-8?B?YytIZ0g1VHZXWkpqMzZxeWtNeDRDeTZjWlpFR3IxeW0wNU4yY1U5MERYM1Zz?= =?utf-8?B?YnlnQ3ZPbmZHTEsrVTM2YkJkQy9xRnVsZEpaSUR5dG9uTTVINy9YVU1NUGJI?= =?utf-8?B?R3dvcmFVOWlZYzgrNWJzRFRmSjJRSE5SUGd0SysvV0xqTjBnR09sSWcwT1d1?= =?utf-8?B?aDBCdXZlZCtIdFFmTkljdFFieHVaamdLZG5ON05mUnZzWWZ6aWFEazZ4VnJM?= =?utf-8?B?RVEwRW5xU0lYcFJnMERBVFNlaWxoSEVuNXNWOGQ5R1VqbjQ1aThkSVB5UzAy?= =?utf-8?B?Yk5pYndSNHpaSFNGZU9XYzV2WVJhdGlQaUU1bXlwekNtQnQyRG1vVHZvTk91?= =?utf-8?B?VXkzQkNkOHVvY1gxN3I1M3Q4SHUrcnY3YXNDem00WnNpVE5Vc1hic3VTSS9W?= =?utf-8?Q?Cf4v47+5hxi5JynPhtqvLtJjNxMCJV+GRQLUKfzbEZUQK?= X-MS-Exchange-AntiSpam-MessageData-1: DUUZ3aXEoNSe6KxE4KwyFDM5sLHE4I+YAmw= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 71573c81-c670-4e42-c83f-08df051ba77c X-MS-Exchange-CrossTenant-AuthSource: AM0PR08MB11804.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Aug 2026 15:47:24.2981 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 29Hu7zoeu6k+nT+TWdgKLuD8HX3p9NoDSCKs1dNcZPDCJSmE8obh1iRDXb+ssYzIlqhTNQsvZPzOLqwxklYjMqXZohLnB7Y33sM6ikaMMtE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAXPR08MB7467 X-OZ-Fwd: true Subject: Re: [Devel] [PATCH v2 VZ10 1/2] ve/bpf: Limit number of BPF programs loadable per-VE X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org I thought we've decided in slack that having failcounts is enough, so after "[PATCH VZ10 v7 7/9] ve: Introduce per-VE failcount" ads bpf_prog_failcount, warning is not really needed to be aware about lack of bpf programs. On 8/26/26 18:48, Konstantin Khorenko wrote: > a kind ping > > -- > Best regards, > > Konstantin Khorenko, > Virtuozzo Linux Kernel Team > > On 6/18/26 18:41, Konstantin Khorenko wrote: >> i will apply the patch, but i would appreciate in case you add some WARN_ONCE >> in case some CT hits the limit of available bpf programs. >> >> This will ease issue investigations + at some point might hints us that we need to increase the default, for example. >> >> -- >> Best regards, >> >> Konstantin Khorenko, >> Virtuozzo Linux Kernel Team >> >> On 5/29/26 16:42, Pavel Tikhomirov wrote: >>> Without a per-VE cap a single container could exhaust the system-wide >>> bpf JIT memory budget by loading excessive numbers of CGROUP_DEVICE >>> programs via the VE_FEATURE_BPF path. >>> >>> Add bpf_prog_avail_nr / bpf_prog_max_nr counters to ve_struct and >>> enforce them in bpf_prog_load() for non-bpf-capable callers loading >>> CGROUP_DEVICE programs. >>> >>> Lifetime note: A BPF program loadded in VE takes a reference to ve, when >>> container is stopped, all open fds to the BPF programm will be closed >>> and when container manager removes container cgroups the BPF program >>> will be released and thus releasing the reference to VE. >>> >>> Default max number note: It is somehow similar to ve.netif_max_nr, there >>> each docker container creates two veths, and I also observe that docker >>> container loads two bpf programs (one by dockerd, one by systemd). So >>> let's use the same number. >>> >>> https://virtuozzo.atlassian.net/browse/VSTOR-131947 >>> Signed-off-by: Pavel Tikhomirov >>> Feature: ve: allow BPF in Containers >>> >>> -- >>> v2: Also put load_ve definition under CONFIG_VE. >>> --- >>> include/linux/bpf.h | 8 ++++++++ >>> include/linux/ve.h | 4 ++++ >>> kernel/bpf/core.c | 8 ++++++++ >>> kernel/bpf/syscall.c | 37 +++++++++++++++++++++++++++++++++++++ >>> kernel/ve/ve.c | 5 +++++ >>> 5 files changed, 62 insertions(+) >>> >>> diff --git a/include/linux/bpf.h b/include/linux/bpf.h >>> index 80175c7a21c27..0212806d5efc2 100644 >>> --- a/include/linux/bpf.h >>> +++ b/include/linux/bpf.h >>> @@ -56,6 +56,7 @@ struct cgroup; >>> struct bpf_token; >>> struct user_namespace; >>> struct super_block; >>> +struct ve_struct; >>> struct inode; >>> >>> extern struct idr btf_idr; >>> @@ -1522,6 +1523,13 @@ struct bpf_prog_aux { >>> void *security; >>> #endif >>> struct bpf_token *token; >>> +#ifdef CONFIG_VE >>> + /* VE that loaded the program via VE_FEATURE_BPF path and against whose >>> + * bpf_prog_avail_nr counter the program is accounted. NULL for programs >>> + * loaded through the regular (non VE-restricted) path. >>> + */ >>> + struct ve_struct *owner_ve; >>> +#endif >>> struct bpf_prog_offload *offload; >>> struct btf *btf; >>> struct bpf_func_info *func_info; >>> diff --git a/include/linux/ve.h b/include/linux/ve.h >>> index 224acf012821f..88b4d531c466e 100644 >>> --- a/include/linux/ve.h >>> +++ b/include/linux/ve.h >>> @@ -76,6 +76,9 @@ struct ve_struct { >>> atomic_t netif_avail_nr; >>> int netif_max_nr; >>> >>> + atomic_t bpf_prog_avail_nr; >>> + int bpf_prog_max_nr; >>> + >>> atomic64_t _uevent_seqnum; >>> >>> int _randomize_va_space; >>> @@ -149,6 +152,7 @@ extern int nr_ve; >>> >>> #define NETNS_MAX_NR_DEFAULT 256 /* number of net-namespaces per-VE */ >>> #define NETIF_MAX_NR_DEFAULT 256 /* number of net-interfaces per-VE */ >>> +#define BPF_PROG_MAX_NR_DEFAULT 256 /* number of loaded BPF progs per-VE */ >>> >>> extern unsigned int sysctl_ve_mount_nr; >>> >>> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c >>> index 4de8774458aca..7aaf73180fcdc 100644 >>> --- a/kernel/bpf/core.c >>> +++ b/kernel/bpf/core.c >>> @@ -38,6 +38,7 @@ >>> #include >>> #include >>> #include >>> +#include >>> >>> #include >>> #include >>> @@ -2828,6 +2829,13 @@ void bpf_prog_free(struct bpf_prog *fp) >>> if (aux->dst_prog) >>> bpf_prog_put(aux->dst_prog); >>> bpf_token_put(aux->token); >>> +#ifdef CONFIG_VE >>> + if (aux->owner_ve) { >>> + atomic_inc(&aux->owner_ve->bpf_prog_avail_nr); >>> + put_ve(aux->owner_ve); >>> + aux->owner_ve = NULL; >>> + } >>> +#endif >>> INIT_WORK(&aux->work, bpf_prog_free_deferred); >>> schedule_work(&aux->work); >>> } >>> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c >>> index 0475a72c93c06..481ae62429097 100644 >>> --- a/kernel/bpf/syscall.c >>> +++ b/kernel/bpf/syscall.c >>> @@ -2663,6 +2663,9 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size) >>> struct bpf_prog *prog, *dst_prog = NULL; >>> struct btf *attach_btf = NULL; >>> struct bpf_token *token = NULL; >>> +#ifdef CONFIG_VE >>> + struct ve_struct *load_ve = NULL; >>> +#endif >>> bool bpf_cap; >>> int err; >>> char license[128]; >>> @@ -2744,6 +2747,22 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size) >>> if (is_perfmon_prog_type(type) && !bpf_token_capable(token, CAP_PERFMON)) >>> goto put_token; >>> >>> +#ifdef CONFIG_VE >>> + /* Restrict the number of BPF programs that can be loaded via the >>> + * VE-allowed path. Without this, a single container could exhaust >>> + * the system-wide bpf JIT memory budget by loading excessive >>> + * numbers of CGROUP_DEVICE programs. >>> + */ >>> + if (!bpf_cap && type == BPF_PROG_TYPE_CGROUP_DEVICE) { >>> + load_ve = get_exec_env(); >>> + if (atomic_dec_if_positive(&load_ve->bpf_prog_avail_nr) < 0) { >>> + load_ve = NULL; >>> + err = -ENOSPC; >>> + goto put_token; >>> + } >>> + } >>> +#endif >>> + >>> /* attach_prog_fd/attach_btf_obj_fd can specify fd of either bpf_prog >>> * or btf, we need to check which one it is >>> */ >>> @@ -2809,6 +2828,16 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size) >>> prog->aux->dev_bound = !!attr->prog_ifindex; >>> prog->aux->xdp_has_frags = attr->prog_flags & BPF_F_XDP_HAS_FRAGS; >>> >>> +#ifdef CONFIG_VE >>> + /* Hand the avail_nr slot reservation over to the prog. bpf_prog_free() >>> + * will release it via put_ve + counter increment. >>> + */ >>> + if (load_ve) { >>> + prog->aux->owner_ve = get_ve(load_ve); >>> + load_ve = NULL; >>> + } >>> +#endif >>> + >>> /* move token into prog->aux, reuse taken refcnt */ >>> prog->aux->token = token; >>> token = NULL; >>> @@ -2932,6 +2961,14 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size) >>> btf_put(prog->aux->attach_btf); >>> bpf_prog_free(prog); >>> put_token: >>> +#ifdef CONFIG_VE >>> + /* The load_ve is non-NULL only if we decremented bpf_prog_avail_nr >>> + * but did not hand the reservation off to the prog yet (i.e. failure >>> + * happened before bpf_prog_alloc()). Roll back the counter. >>> + */ >>> + if (load_ve) >>> + atomic_inc(&load_ve->bpf_prog_avail_nr); >>> +#endif >>> bpf_token_put(token); >>> return err; >>> } >>> diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c >>> index 198c82f010cc1..48da546117bb7 100644 >>> --- a/kernel/ve/ve.c >>> +++ b/kernel/ve/ve.c >>> @@ -76,6 +76,8 @@ struct ve_struct ve0 = { >>> .netns_max_nr = INT_MAX, >>> .netif_avail_nr = ATOMIC_INIT(INT_MAX), >>> .netif_max_nr = INT_MAX, >>> + .bpf_prog_avail_nr = ATOMIC_INIT(INT_MAX), >>> + .bpf_prog_max_nr = INT_MAX, >>> .fsync_enable = FSYNC_FILTERED, >>> ._randomize_va_space = >>> #ifdef CONFIG_COMPAT_BRK >>> @@ -983,6 +985,9 @@ static struct cgroup_subsys_state *ve_create(struct cgroup_subsys_state *parent_ >>> atomic_set(&ve->netif_avail_nr, NETIF_MAX_NR_DEFAULT); >>> ve->netif_max_nr = NETIF_MAX_NR_DEFAULT; >>> >>> + atomic_set(&ve->bpf_prog_avail_nr, BPF_PROG_MAX_NR_DEFAULT); >>> + ve->bpf_prog_max_nr = BPF_PROG_MAX_NR_DEFAULT; >>> + >>> err = ve_log_init(ve); >>> if (err) >>> goto err_log; >> > -- Best regards, Pavel Tikhomirov Senior Software Developer, Virtuozzo. _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel