linux - kernel/cgroup.c

5524 lines · 145.7 KiB

1	/*
2	* Generic process-grouping system.
3	*
4	* Based originally on the cpuset system, extracted by Paul Menage
5	* Copyright (C) 2006 Google, Inc
6	*
7	* Notifications support
8	* Copyright (C) 2009 Nokia Corporation
9	* Author: Kirill A. Shutemov
10	*
11	* Copyright notices from the original cpuset code:
12	* --------------------------------------------------
13	* Copyright (C) 2003 BULL SA.
14	* Copyright (C) 2004-2006 Silicon Graphics, Inc.
15	*
16	* Portions derived from Patrick Mochel's sysfs code.
17	* sysfs is Copyright (c) 2001-3 Patrick Mochel
18	*
19	* 2003-10-10 Written by Simon Derr.
20	* 2003-10-22 Updates by Stephen Hemminger.
21	* 2004 May-July Rework by Paul Jackson.
22	* ---------------------------------------------------
23	*
24	* This file is subject to the terms and conditions of the GNU General Public
25	* License. See the file COPYING in the main directory of the Linux
26	* distribution for more details.
27	*/
28
29	#include <linux/cgroup.h>
30	#include <linux/cred.h>
31	#include <linux/ctype.h>
32	#include <linux/errno.h>
33	#include <linux/fs.h>
34	#include <linux/init_task.h>
35	#include <linux/kernel.h>
36	#include <linux/list.h>
37	#include <linux/mm.h>
38	#include <linux/mutex.h>
39	#include <linux/mount.h>
40	#include <linux/pagemap.h>
41	#include <linux/proc_fs.h>
42	#include <linux/rcupdate.h>
43	#include <linux/sched.h>
44	#include <linux/backing-dev.h>
45	#include <linux/seq_file.h>
46	#include <linux/slab.h>
47	#include <linux/magic.h>
48	#include <linux/spinlock.h>
49	#include <linux/string.h>
50	#include <linux/sort.h>
51	#include <linux/kmod.h>
52	#include <linux/module.h>
53	#include <linux/delayacct.h>
54	#include <linux/cgroupstats.h>
55	#include <linux/hash.h>
56	#include <linux/namei.h>
57	#include <linux/pid_namespace.h>
58	#include <linux/idr.h>
59	#include <linux/vmalloc.h> /* TODO: replace with more sophisticated array */
60	#include <linux/eventfd.h>
61	#include <linux/poll.h>
62	#include <linux/flex_array.h> /* used in cgroup_attach_proc */
63	#include <linux/kthread.h>
64
65	#include <linux/atomic.h>
66
67	/* css deactivation bias, makes css->refcnt negative to deny new trygets */
68	#define CSS_DEACT_BIAS INT_MIN
69
70	/*
71	* cgroup_mutex is the master lock. Any modification to cgroup or its
72	* hierarchy must be performed while holding it.
73	*
74	* cgroup_root_mutex nests inside cgroup_mutex and should be held to modify
75	* cgroupfs_root of any cgroup hierarchy - subsys list, flags,
76	* release_agent_path and so on. Modifying requires both cgroup_mutex and
77	* cgroup_root_mutex. Readers can acquire either of the two. This is to
78	* break the following locking order cycle.
79	*
80	* A. cgroup_mutex -> cred_guard_mutex -> s_type->i_mutex_key -> namespace_sem
81	* B. namespace_sem -> cgroup_mutex
82	*
83	* B happens only through cgroup_show_options() and using cgroup_root_mutex
84	* breaks it.
85	*/
86	static DEFINE_MUTEX(cgroup_mutex);
87	static DEFINE_MUTEX(cgroup_root_mutex);
88
89	/*
90	* Generate an array of cgroup subsystem pointers. At boot time, this is
91	* populated up to CGROUP_BUILTIN_SUBSYS_COUNT, and modular subsystems are
92	* registered after that. The mutable section of this array is protected by
93	* cgroup_mutex.
94	*/
95	#define SUBSYS(_x) &_x ## _subsys,
96	static struct cgroup_subsys *subsys[CGROUP_SUBSYS_COUNT] = {
97	#include <linux/cgroup_subsys.h>
98	};
99
100	#define MAX_CGROUP_ROOT_NAMELEN 64
101
102	/*
103	* A cgroupfs_root represents the root of a cgroup hierarchy,
104	* and may be associated with a superblock to form an active
105	* hierarchy
106	*/
107	struct cgroupfs_root {
108	struct super_block *sb;
109
110	/*
111	* The bitmask of subsystems intended to be attached to this
112	* hierarchy
113	*/
114	unsigned long subsys_bits;
115
116	/* Unique id for this hierarchy. */
117	int hierarchy_id;
118
119	/* The bitmask of subsystems currently attached to this hierarchy */
120	unsigned long actual_subsys_bits;
121
122	/* A list running through the attached subsystems */
123	struct list_head subsys_list;
124
125	/* The root cgroup for this hierarchy */
126	struct cgroup top_cgroup;
127
128	/* Tracks how many cgroups are currently defined in hierarchy.*/
129	int number_of_cgroups;
130
131	/* A list running through the active hierarchies */
132	struct list_head root_list;
133
134	/* All cgroups on this root, cgroup_mutex protected */
135	struct list_head allcg_list;
136
137	/* Hierarchy-specific flags */
138	unsigned long flags;
139
140	/* The path to use for release notifications. */
141	char release_agent_path[PATH_MAX];
142
143	/* The name for this hierarchy - may be empty */
144	char name[MAX_CGROUP_ROOT_NAMELEN];
145	};
146
147	/*
148	* The "rootnode" hierarchy is the "dummy hierarchy", reserved for the
149	* subsystems that are otherwise unattached - it never has more than a
150	* single cgroup, and all tasks are part of that cgroup.
151	*/
152	static struct cgroupfs_root rootnode;
153
154	/*
155	* cgroupfs file entry, pointed to from leaf dentry->d_fsdata.
156	*/
157	struct cfent {
158	struct list_head node;
159	struct dentry *dentry;
160	struct cftype *type;
161	};
162
163	/*
164	* CSS ID -- ID per subsys's Cgroup Subsys State(CSS). used only when
165	* cgroup_subsys->use_id != 0.
166	*/
167	#define CSS_ID_MAX (65535)
168	struct css_id {
169	/*
170	* The css to which this ID points. This pointer is set to valid value
171	* after cgroup is populated. If cgroup is removed, this will be NULL.
172	* This pointer is expected to be RCU-safe because destroy()
173	* is called after synchronize_rcu(). But for safe use, css_is_removed()
174	* css_tryget() should be used for avoiding race.
175	*/
176	struct cgroup_subsys_state __rcu *css;
177	/*
178	* ID of this css.
179	*/
180	unsigned short id;
181	/*
182	* Depth in hierarchy which this ID belongs to.
183	*/
184	unsigned short depth;
185	/*
186	* ID is freed by RCU. (and lookup routine is RCU safe.)
187	*/
188	struct rcu_head rcu_head;
189	/*
190	* Hierarchy of CSS ID belongs to.
191	*/
192	unsigned short stack[0]; /* Array of Length (depth+1) */
193	};
194
195	/*
196	* cgroup_event represents events which userspace want to receive.
197	*/
198	struct cgroup_event {
199	/*
200	* Cgroup which the event belongs to.
201	*/
202	struct cgroup *cgrp;
203	/*
204	* Control file which the event associated.
205	*/
206	struct cftype *cft;
207	/*
208	* eventfd to signal userspace about the event.
209	*/
210	struct eventfd_ctx *eventfd;
211	/*
212	* Each of these stored in a list by the cgroup.
213	*/
214	struct list_head list;
215	/*
216	* All fields below needed to unregister event when
217	* userspace closes eventfd.
218	*/
219	poll_table pt;
220	wait_queue_head_t *wqh;
221	wait_queue_t wait;
222	struct work_struct remove;
223	};
224
225	/* The list of hierarchy roots */
226
227	static LIST_HEAD(roots);
228	static int root_count;
229
230	static DEFINE_IDA(hierarchy_ida);
231	static int next_hierarchy_id;
232	static DEFINE_SPINLOCK(hierarchy_id_lock);
233
234	/* dummytop is a shorthand for the dummy hierarchy's top cgroup */
235	#define dummytop (&rootnode.top_cgroup)
236
237	/* This flag indicates whether tasks in the fork and exit paths should
238	* check for fork/exit handlers to call. This avoids us having to do
239	* extra work in the fork/exit path if none of the subsystems need to
240	* be called.
241	*/
242	static int need_forkexit_callback __read_mostly;
243
244	#ifdef CONFIG_PROVE_LOCKING
245	int cgroup_lock_is_held(void)
246	{
247	return lockdep_is_held(&cgroup_mutex);
248	}
249	#else /* #ifdef CONFIG_PROVE_LOCKING */
250	int cgroup_lock_is_held(void)
251	{
252	return mutex_is_locked(&cgroup_mutex);
253	}
254	#endif /* #else #ifdef CONFIG_PROVE_LOCKING */
255
256	EXPORT_SYMBOL_GPL(cgroup_lock_is_held);
257
258	static int css_unbias_refcnt(int refcnt)
259	{
260	return refcnt >= 0 ? refcnt : refcnt - CSS_DEACT_BIAS;
261	}
262
263	/* the current nr of refs, always >= 0 whether @css is deactivated or not */
264	static int css_refcnt(struct cgroup_subsys_state *css)
265	{
266	int v = atomic_read(&css->refcnt);
267
268	return css_unbias_refcnt(v);
269	}
270
271	/* convenient tests for these bits */
272	inline int cgroup_is_removed(const struct cgroup *cgrp)
273	{
274	return test_bit(CGRP_REMOVED, &cgrp->flags);
275	}
276
277	/* bits in struct cgroupfs_root flags field */
278	enum {
279	ROOT_NOPREFIX, /* mounted subsystems have no named prefix */
280	};
281
282	static int cgroup_is_releasable(const struct cgroup *cgrp)
283	{
284	const int bits =
285	(1 << CGRP_RELEASABLE) \|
286	(1 << CGRP_NOTIFY_ON_RELEASE);
287	return (cgrp->flags & bits) == bits;
288	}
289
290	static int notify_on_release(const struct cgroup *cgrp)
291	{
292	return test_bit(CGRP_NOTIFY_ON_RELEASE, &cgrp->flags);
293	}
294
295	static int clone_children(const struct cgroup *cgrp)
296	{
297	return test_bit(CGRP_CLONE_CHILDREN, &cgrp->flags);
298	}
299
300	/*
301	* for_each_subsys() allows you to iterate on each subsystem attached to
302	* an active hierarchy
303	*/
304	#define for_each_subsys(_root, _ss) \
305	list_for_each_entry(_ss, &_root->subsys_list, sibling)
306
307	/* for_each_active_root() allows you to iterate across the active hierarchies */
308	#define for_each_active_root(_root) \
309	list_for_each_entry(_root, &roots, root_list)
310
311	static inline struct cgroup __d_cgrp(struct dentry dentry)
312	{
313	return dentry->d_fsdata;
314	}
315
316	static inline struct cfent __d_cfe(struct dentry dentry)
317	{
318	return dentry->d_fsdata;
319	}
320
321	static inline struct cftype __d_cft(struct dentry dentry)
322	{
323	return __d_cfe(dentry)->type;
324	}
325
326	/* the list of cgroups eligible for automatic release. Protected by
327	* release_list_lock */
328	static LIST_HEAD(release_list);
329	static DEFINE_RAW_SPINLOCK(release_list_lock);
330	static void cgroup_release_agent(struct work_struct *work);
331	static DECLARE_WORK(release_agent_work, cgroup_release_agent);
332	static void check_for_release(struct cgroup *cgrp);
333
334	/* Link structure for associating css_set objects with cgroups */
335	struct cg_cgroup_link {
336	/*
337	* List running through cg_cgroup_links associated with a
338	* cgroup, anchored on cgroup->css_sets
339	*/
340	struct list_head cgrp_link_list;
341	struct cgroup *cgrp;
342	/*
343	* List running through cg_cgroup_links pointing at a
344	* single css_set object, anchored on css_set->cg_links
345	*/
346	struct list_head cg_link_list;
347	struct css_set *cg;
348	};
349
350	/* The default css_set - used by init and its children prior to any
351	* hierarchies being mounted. It contains a pointer to the root state
352	* for each subsystem. Also used to anchor the list of css_sets. Not
353	* reference-counted, to improve performance when child cgroups
354	* haven't been created.
355	*/
356
357	static struct css_set init_css_set;
358	static struct cg_cgroup_link init_css_set_link;
359
360	static int cgroup_init_idr(struct cgroup_subsys *ss,
361	struct cgroup_subsys_state *css);
362
363	/* css_set_lock protects the list of css_set objects, and the
364	* chain of tasks off each css_set. Nests outside task->alloc_lock
365	* due to cgroup_iter_start() */
366	static DEFINE_RWLOCK(css_set_lock);
367	static int css_set_count;
368
369	/*
370	* hash table for cgroup groups. This improves the performance to find
371	* an existing css_set. This hash doesn't (currently) take into
372	* account cgroups in empty hierarchies.
373	*/
374	#define CSS_SET_HASH_BITS 7
375	#define CSS_SET_TABLE_SIZE (1 << CSS_SET_HASH_BITS)
376	static struct hlist_head css_set_table[CSS_SET_TABLE_SIZE];
377
378	static struct hlist_head css_set_hash(struct cgroup_subsys_state css[])
379	{
380	int i;
381	int index;
382	unsigned long tmp = 0UL;
383
384	for (i = 0; i < CGROUP_SUBSYS_COUNT; i++)
385	tmp += (unsigned long)css[i];
386	tmp = (tmp >> 16) ^ tmp;
387
388	index = hash_long(tmp, CSS_SET_HASH_BITS);
389
390	return &css_set_table[index];
391	}
392
393	/* We don't maintain the lists running through each css_set to its
394	* task until after the first call to cgroup_iter_start(). This
395	* reduces the fork()/exit() overhead for people who have cgroups
396	* compiled into their kernel but not actually in use */
397	static int use_task_css_set_links __read_mostly;
398
399	static void __put_css_set(struct css_set *cg, int taskexit)
400	{
401	struct cg_cgroup_link *link;
402	struct cg_cgroup_link *saved_link;
403	/*
404	* Ensure that the refcount doesn't hit zero while any readers
405	* can see it. Similar to atomic_dec_and_lock(), but for an
406	* rwlock
407	*/
408	if (atomic_add_unless(&cg->refcount, -1, 1))
409	return;
410	write_lock(&css_set_lock);
411	if (!atomic_dec_and_test(&cg->refcount)) {
412	write_unlock(&css_set_lock);
413	return;
414	}
415
416	/* This css_set is dead. unlink it and release cgroup refcounts */
417	hlist_del(&cg->hlist);
418	css_set_count--;
419
420	list_for_each_entry_safe(link, saved_link, &cg->cg_links,
421	cg_link_list) {
422	struct cgroup *cgrp = link->cgrp;
423	list_del(&link->cg_link_list);
424	list_del(&link->cgrp_link_list);
425	if (atomic_dec_and_test(&cgrp->count) &&
426	notify_on_release(cgrp)) {
427	if (taskexit)
428	set_bit(CGRP_RELEASABLE, &cgrp->flags);
429	check_for_release(cgrp);
430	}
431
432	kfree(link);
433	}
434
435	write_unlock(&css_set_lock);
436	kfree_rcu(cg, rcu_head);
437	}
438
439	/*
440	* refcounted get/put for css_set objects
441	*/
442	static inline void get_css_set(struct css_set *cg)
443	{
444	atomic_inc(&cg->refcount);
445	}
446
447	static inline void put_css_set(struct css_set *cg)
448	{
449	__put_css_set(cg, 0);
450	}
451
452	static inline void put_css_set_taskexit(struct css_set *cg)
453	{
454	__put_css_set(cg, 1);
455	}
456
457	/*
458	* compare_css_sets - helper function for find_existing_css_set().
459	* @cg: candidate css_set being tested
460	* @old_cg: existing css_set for a task
461	* @new_cgrp: cgroup that's being entered by the task
462	* @template: desired set of css pointers in css_set (pre-calculated)
463	*
464	* Returns true if "cg" matches "old_cg" except for the hierarchy
465	* which "new_cgrp" belongs to, for which it should match "new_cgrp".
466	*/
467	static bool compare_css_sets(struct css_set *cg,
468	struct css_set *old_cg,
469	struct cgroup *new_cgrp,
470	struct cgroup_subsys_state *template[])
471	{
472	struct list_head l1, l2;
473
474	if (memcmp(template, cg->subsys, sizeof(cg->subsys))) {
475	/* Not all subsystems matched */
476	return false;
477	}
478
479	/*
480	* Compare cgroup pointers in order to distinguish between
481	* different cgroups in heirarchies with no subsystems. We
482	* could get by with just this check alone (and skip the
483	* memcmp above) but on most setups the memcmp check will
484	* avoid the need for this more expensive check on almost all
485	* candidates.
486	*/
487
488	l1 = &cg->cg_links;
489	l2 = &old_cg->cg_links;
490	while (1) {
491	struct cg_cgroup_link cgl1, cgl2;
492	struct cgroup cg1, cg2;
493
494	l1 = l1->next;
495	l2 = l2->next;
496	/* See if we reached the end - both lists are equal length. */
497	if (l1 == &cg->cg_links) {
498	BUG_ON(l2 != &old_cg->cg_links);
499	break;
500	} else {
501	BUG_ON(l2 == &old_cg->cg_links);
502	}
503	/* Locate the cgroups associated with these links. */
504	cgl1 = list_entry(l1, struct cg_cgroup_link, cg_link_list);
505	cgl2 = list_entry(l2, struct cg_cgroup_link, cg_link_list);
506	cg1 = cgl1->cgrp;
507	cg2 = cgl2->cgrp;
508	/* Hierarchies should be linked in the same order. */
509	BUG_ON(cg1->root != cg2->root);
510
511	/*
512	* If this hierarchy is the hierarchy of the cgroup
513	* that's changing, then we need to check that this
514	* css_set points to the new cgroup; if it's any other
515	* hierarchy, then this css_set should point to the
516	* same cgroup as the old css_set.
517	*/
518	if (cg1->root == new_cgrp->root) {
519	if (cg1 != new_cgrp)
520	return false;
521	} else {
522	if (cg1 != cg2)
523	return false;
524	}
525	}
526	return true;
527	}
528
529	/*
530	* find_existing_css_set() is a helper for
531	* find_css_set(), and checks to see whether an existing
532	* css_set is suitable.
533	*
534	* oldcg: the cgroup group that we're using before the cgroup
535	* transition
536	*
537	* cgrp: the cgroup that we're moving into
538	*
539	* template: location in which to build the desired set of subsystem
540	* state objects for the new cgroup group
541	*/
542	static struct css_set *find_existing_css_set(
543	struct css_set *oldcg,
544	struct cgroup *cgrp,
545	struct cgroup_subsys_state *template[])
546	{
547	int i;
548	struct cgroupfs_root *root = cgrp->root;
549	struct hlist_head *hhead;
550	struct hlist_node *node;
551	struct css_set *cg;
552
553	/*
554	* Build the set of subsystem state objects that we want to see in the
555	* new css_set. while subsystems can change globally, the entries here
556	* won't change, so no need for locking.
557	*/
558	for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
559	if (root->subsys_bits & (1UL << i)) {
560	/* Subsystem is in this hierarchy. So we want
561	* the subsystem state from the new
562	* cgroup */
563	template[i] = cgrp->subsys[i];
564	} else {
565	/* Subsystem is not in this hierarchy, so we
566	* don't want to change the subsystem state */
567	template[i] = oldcg->subsys[i];
568	}
569	}
570
571	hhead = css_set_hash(template);
572	hlist_for_each_entry(cg, node, hhead, hlist) {
573	if (!compare_css_sets(cg, oldcg, cgrp, template))
574	continue;
575
576	/* This css_set matches what we need */
577	return cg;
578	}
579
580	/* No existing cgroup group matched */
581	return NULL;
582	}
583
584	static void free_cg_links(struct list_head *tmp)
585	{
586	struct cg_cgroup_link *link;
587	struct cg_cgroup_link *saved_link;
588
589	list_for_each_entry_safe(link, saved_link, tmp, cgrp_link_list) {
590	list_del(&link->cgrp_link_list);
591	kfree(link);
592	}
593	}
594
595	/*
596	* allocate_cg_links() allocates "count" cg_cgroup_link structures
597	* and chains them on tmp through their cgrp_link_list fields. Returns 0 on
598	* success or a negative error
599	*/
600	static int allocate_cg_links(int count, struct list_head *tmp)
601	{
602	struct cg_cgroup_link *link;
603	int i;
604	INIT_LIST_HEAD(tmp);
605	for (i = 0; i < count; i++) {
606	link = kmalloc(sizeof(*link), GFP_KERNEL);
607	if (!link) {
608	free_cg_links(tmp);
609	return -ENOMEM;
610	}
611	list_add(&link->cgrp_link_list, tmp);
612	}
613	return 0;
614	}
615
616	/**
617	* link_css_set - a helper function to link a css_set to a cgroup
618	* @tmp_cg_links: cg_cgroup_link objects allocated by allocate_cg_links()
619	* @cg: the css_set to be linked
620	* @cgrp: the destination cgroup
621	*/
622	static void link_css_set(struct list_head *tmp_cg_links,
623	struct css_set cg, struct cgroup cgrp)
624	{
625	struct cg_cgroup_link *link;
626
627	BUG_ON(list_empty(tmp_cg_links));
628	link = list_first_entry(tmp_cg_links, struct cg_cgroup_link,
629	cgrp_link_list);
630	link->cg = cg;
631	link->cgrp = cgrp;
632	atomic_inc(&cgrp->count);
633	list_move(&link->cgrp_link_list, &cgrp->css_sets);
634	/*
635	* Always add links to the tail of the list so that the list
636	* is sorted by order of hierarchy creation
637	*/
638	list_add_tail(&link->cg_link_list, &cg->cg_links);
639	}
640
641	/*
642	* find_css_set() takes an existing cgroup group and a
643	* cgroup object, and returns a css_set object that's
644	* equivalent to the old group, but with the given cgroup
645	* substituted into the appropriate hierarchy. Must be called with
646	* cgroup_mutex held
647	*/
648	static struct css_set *find_css_set(
649	struct css_set oldcg, struct cgroup cgrp)
650	{
651	struct css_set *res;
652	struct cgroup_subsys_state *template[CGROUP_SUBSYS_COUNT];
653
654	struct list_head tmp_cg_links;
655
656	struct hlist_head *hhead;
657	struct cg_cgroup_link *link;
658
659	/* First see if we already have a cgroup group that matches
660	* the desired set */
661	read_lock(&css_set_lock);
662	res = find_existing_css_set(oldcg, cgrp, template);
663	if (res)
664	get_css_set(res);
665	read_unlock(&css_set_lock);
666
667	if (res)
668	return res;
669
670	res = kmalloc(sizeof(*res), GFP_KERNEL);
671	if (!res)
672	return NULL;
673
674	/* Allocate all the cg_cgroup_link objects that we'll need */
675	if (allocate_cg_links(root_count, &tmp_cg_links) < 0) {
676	kfree(res);
677	return NULL;
678	}
679
680	atomic_set(&res->refcount, 1);
681	INIT_LIST_HEAD(&res->cg_links);
682	INIT_LIST_HEAD(&res->tasks);
683	INIT_HLIST_NODE(&res->hlist);
684
685	/* Copy the set of subsystem state objects generated in
686	* find_existing_css_set() */
687	memcpy(res->subsys, template, sizeof(res->subsys));
688
689	write_lock(&css_set_lock);
690	/* Add reference counts and links from the new css_set. */
691	list_for_each_entry(link, &oldcg->cg_links, cg_link_list) {
692	struct cgroup *c = link->cgrp;
693	if (c->root == cgrp->root)
694	c = cgrp;
695	link_css_set(&tmp_cg_links, res, c);
696	}
697
698	BUG_ON(!list_empty(&tmp_cg_links));
699
700	css_set_count++;
701
702	/* Add this cgroup group to the hash table */
703	hhead = css_set_hash(res->subsys);
704	hlist_add_head(&res->hlist, hhead);
705
706	write_unlock(&css_set_lock);
707
708	return res;
709	}
710
711	/*
712	* Return the cgroup for "task" from the given hierarchy. Must be
713	* called with cgroup_mutex held.
714	*/
715	static struct cgroup task_cgroup_from_root(struct task_struct task,
716	struct cgroupfs_root *root)
717	{
718	struct css_set *css;
719	struct cgroup *res = NULL;
720
721	BUG_ON(!mutex_is_locked(&cgroup_mutex));
722	read_lock(&css_set_lock);
723	/*
724	* No need to lock the task - since we hold cgroup_mutex the
725	* task can't change groups, so the only thing that can happen
726	* is that it exits and its css is set back to init_css_set.
727	*/
728	css = task->cgroups;
729	if (css == &init_css_set) {
730	res = &root->top_cgroup;
731	} else {
732	struct cg_cgroup_link *link;
733	list_for_each_entry(link, &css->cg_links, cg_link_list) {
734	struct cgroup *c = link->cgrp;
735	if (c->root == root) {
736	res = c;
737	break;
738	}
739	}
740	}
741	read_unlock(&css_set_lock);
742	BUG_ON(!res);
743	return res;
744	}
745
746	/*
747	* There is one global cgroup mutex. We also require taking
748	* task_lock() when dereferencing a task's cgroup subsys pointers.
749	* See "The task_lock() exception", at the end of this comment.
750	*
751	* A task must hold cgroup_mutex to modify cgroups.
752	*
753	* Any task can increment and decrement the count field without lock.
754	* So in general, code holding cgroup_mutex can't rely on the count
755	* field not changing. However, if the count goes to zero, then only
756	* cgroup_attach_task() can increment it again. Because a count of zero
757	* means that no tasks are currently attached, therefore there is no
758	* way a task attached to that cgroup can fork (the other way to
759	* increment the count). So code holding cgroup_mutex can safely
760	* assume that if the count is zero, it will stay zero. Similarly, if
761	* a task holds cgroup_mutex on a cgroup with zero count, it
762	* knows that the cgroup won't be removed, as cgroup_rmdir()
763	* needs that mutex.
764	*
765	* The fork and exit callbacks cgroup_fork() and cgroup_exit(), don't
766	* (usually) take cgroup_mutex. These are the two most performance
767	* critical pieces of code here. The exception occurs on cgroup_exit(),
768	* when a task in a notify_on_release cgroup exits. Then cgroup_mutex
769	* is taken, and if the cgroup count is zero, a usermode call made
770	* to the release agent with the name of the cgroup (path relative to
771	* the root of cgroup file system) as the argument.
772	*
773	* A cgroup can only be deleted if both its 'count' of using tasks
774	* is zero, and its list of 'children' cgroups is empty. Since all
775	* tasks in the system use _some_ cgroup, and since there is always at
776	* least one task in the system (init, pid == 1), therefore, top_cgroup
777	* always has either children cgroups and/or using tasks. So we don't
778	* need a special hack to ensure that top_cgroup cannot be deleted.
779	*
780	* The task_lock() exception
781	*
782	* The need for this exception arises from the action of
783	* cgroup_attach_task(), which overwrites one tasks cgroup pointer with
784	* another. It does so using cgroup_mutex, however there are
785	* several performance critical places that need to reference
786	* task->cgroup without the expense of grabbing a system global
787	* mutex. Therefore except as noted below, when dereferencing or, as
788	* in cgroup_attach_task(), modifying a task'ss cgroup pointer we use
789	* task_lock(), which acts on a spinlock (task->alloc_lock) already in
790	* the task_struct routinely used for such matters.
791	*
792	* P.S. One more locking exception. RCU is used to guard the
793	* update of a tasks cgroup pointer by cgroup_attach_task()
794	*/
795
796	/**
797	* cgroup_lock - lock out any changes to cgroup structures
798	*
799	*/
800	void cgroup_lock(void)
801	{
802	mutex_lock(&cgroup_mutex);
803	}
804	EXPORT_SYMBOL_GPL(cgroup_lock);
805
806	/**
807	* cgroup_unlock - release lock on cgroup changes
808	*
809	* Undo the lock taken in a previous cgroup_lock() call.
810	*/
811	void cgroup_unlock(void)
812	{
813	mutex_unlock(&cgroup_mutex);
814	}
815	EXPORT_SYMBOL_GPL(cgroup_unlock);
816
817	/*
818	* A couple of forward declarations required, due to cyclic reference loop:
819	* cgroup_mkdir -> cgroup_create -> cgroup_populate_dir ->
820	* cgroup_add_file -> cgroup_create_file -> cgroup_dir_inode_operations
821	* -> cgroup_mkdir.
822	*/
823
824	static int cgroup_mkdir(struct inode dir, struct dentry dentry, umode_t mode);
825	static struct dentry cgroup_lookup(struct inode , struct dentry , struct nameidata );
826	static int cgroup_rmdir(struct inode unused_dir, struct dentry dentry);
827	static int cgroup_populate_dir(struct cgroup *cgrp);
828	static const struct inode_operations cgroup_dir_inode_operations;
829	static const struct file_operations proc_cgroupstats_operations;
830
831	static struct backing_dev_info cgroup_backing_dev_info = {
832	.name = "cgroup",
833	.capabilities = BDI_CAP_NO_ACCT_AND_WRITEBACK,
834	};
835
836	static int alloc_css_id(struct cgroup_subsys *ss,
837	struct cgroup parent, struct cgroup child);
838
839	static struct inode cgroup_new_inode(umode_t mode, struct super_block sb)
840	{
841	struct inode *inode = new_inode(sb);
842
843	if (inode) {
844	inode->i_ino = get_next_ino();
845	inode->i_mode = mode;
846	inode->i_uid = current_fsuid();
847	inode->i_gid = current_fsgid();
848	inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
849	inode->i_mapping->backing_dev_info = &cgroup_backing_dev_info;
850	}
851	return inode;
852	}
853
854	/*
855	* Call subsys's pre_destroy handler.
856	* This is called before css refcnt check.
857	*/
858	static int cgroup_call_pre_destroy(struct cgroup *cgrp)
859	{
860	struct cgroup_subsys *ss;
861	int ret = 0;
862
863	for_each_subsys(cgrp->root, ss) {
864	if (!ss->pre_destroy)
865	continue;
866
867	ret = ss->pre_destroy(cgrp);
868	if (ret) {
869	/* ->pre_destroy() failure is being deprecated */
870	WARN_ON_ONCE(!ss->__DEPRECATED_clear_css_refs);
871	break;
872	}
873	}
874
875	return ret;
876	}
877
878	static void cgroup_diput(struct dentry dentry, struct inode inode)
879	{
880	/* is dentry a directory ? if so, kfree() associated cgroup */
881	if (S_ISDIR(inode->i_mode)) {
882	struct cgroup *cgrp = dentry->d_fsdata;
883	struct cgroup_subsys *ss;
884	BUG_ON(!(cgroup_is_removed(cgrp)));
885	/* It's possible for external users to be holding css
886	* reference counts on a cgroup; css_put() needs to
887	* be able to access the cgroup after decrementing
888	* the reference count in order to know if it needs to
889	* queue the cgroup to be handled by the release
890	* agent */
891	synchronize_rcu();
892
893	mutex_lock(&cgroup_mutex);
894	/*
895	* Release the subsystem state objects.
896	*/
897	for_each_subsys(cgrp->root, ss)
898	ss->destroy(cgrp);
899
900	cgrp->root->number_of_cgroups--;
901	mutex_unlock(&cgroup_mutex);
902
903	/*
904	* Drop the active superblock reference that we took when we
905	* created the cgroup
906	*/
907	deactivate_super(cgrp->root->sb);
908
909	/*
910	* if we're getting rid of the cgroup, refcount should ensure
911	* that there are no pidlists left.
912	*/
913	BUG_ON(!list_empty(&cgrp->pidlists));
914
915	kfree_rcu(cgrp, rcu_head);
916	} else {
917	struct cfent *cfe = __d_cfe(dentry);
918	struct cgroup *cgrp = dentry->d_parent->d_fsdata;
919
920	WARN_ONCE(!list_empty(&cfe->node) &&
921	cgrp != &cgrp->root->top_cgroup,
922	"cfe still linked for %s\n", cfe->type->name);
923	kfree(cfe);
924	}
925	iput(inode);
926	}
927
928	static int cgroup_delete(const struct dentry *d)
929	{
930	return 1;
931	}
932
933	static void remove_dir(struct dentry *d)
934	{
935	struct dentry *parent = dget(d->d_parent);
936
937	d_delete(d);
938	simple_rmdir(parent->d_inode, d);
939	dput(parent);
940	}
941
942	static int cgroup_rm_file(struct cgroup cgrp, const struct cftype cft)
943	{
944	struct cfent *cfe;
945
946	lockdep_assert_held(&cgrp->dentry->d_inode->i_mutex);
947	lockdep_assert_held(&cgroup_mutex);
948
949	list_for_each_entry(cfe, &cgrp->files, node) {
950	struct dentry *d = cfe->dentry;
951
952	if (cft && cfe->type != cft)
953	continue;
954
955	dget(d);
956	d_delete(d);
957	simple_unlink(d->d_inode, d);
958	list_del_init(&cfe->node);
959	dput(d);
960
961	return 0;
962	}
963	return -ENOENT;
964	}
965
966	static void cgroup_clear_directory(struct dentry *dir)
967	{
968	struct cgroup *cgrp = __d_cgrp(dir);
969
970	while (!list_empty(&cgrp->files))
971	cgroup_rm_file(cgrp, NULL);
972	}
973
974	/*
975	* NOTE : the dentry must have been dget()'ed
976	*/
977	static void cgroup_d_remove_dir(struct dentry *dentry)
978	{
979	struct dentry *parent;
980
981	cgroup_clear_directory(dentry);
982
983	parent = dentry->d_parent;
984	spin_lock(&parent->d_lock);
985	spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
986	list_del_init(&dentry->d_u.d_child);
987	spin_unlock(&dentry->d_lock);
988	spin_unlock(&parent->d_lock);
989	remove_dir(dentry);
990	}
991
992	/*
993	* A queue for waiters to do rmdir() cgroup. A tasks will sleep when
994	* cgroup->count == 0 && list_empty(&cgroup->children) && subsys has some
995	* reference to css->refcnt. In general, this refcnt is expected to goes down
996	* to zero, soon.
997	*
998	* CGRP_WAIT_ON_RMDIR flag is set under cgroup's inode->i_mutex;
999	*/
1000	static DECLARE_WAIT_QUEUE_HEAD(cgroup_rmdir_waitq);
1001
1002	static void cgroup_wakeup_rmdir_waiter(struct cgroup *cgrp)
1003	{
1004	if (unlikely(test_and_clear_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags)))
1005	wake_up_all(&cgroup_rmdir_waitq);
1006	}
1007
1008	void cgroup_exclude_rmdir(struct cgroup_subsys_state *css)
1009	{
1010	css_get(css);
1011	}
1012
1013	void cgroup_release_and_wakeup_rmdir(struct cgroup_subsys_state *css)
1014	{
1015	cgroup_wakeup_rmdir_waiter(css->cgroup);
1016	css_put(css);
1017	}
1018
1019	/*
1020	* Call with cgroup_mutex held. Drops reference counts on modules, including
1021	* any duplicate ones that parse_cgroupfs_options took. If this function
1022	* returns an error, no reference counts are touched.
1023	*/
1024	static int rebind_subsystems(struct cgroupfs_root *root,
1025	unsigned long final_bits)
1026	{
1027	unsigned long added_bits, removed_bits;
1028	struct cgroup *cgrp = &root->top_cgroup;
1029	int i;
1030
1031	BUG_ON(!mutex_is_locked(&cgroup_mutex));
1032	BUG_ON(!mutex_is_locked(&cgroup_root_mutex));
1033
1034	removed_bits = root->actual_subsys_bits & ~final_bits;
1035	added_bits = final_bits & ~root->actual_subsys_bits;
1036	/* Check that any added subsystems are currently free */
1037	for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
1038	unsigned long bit = 1UL << i;
1039	struct cgroup_subsys *ss = subsys[i];
1040	if (!(bit & added_bits))
1041	continue;
1042	/*
1043	* Nobody should tell us to do a subsys that doesn't exist:
1044	* parse_cgroupfs_options should catch that case and refcounts
1045	* ensure that subsystems won't disappear once selected.
1046	*/
1047	BUG_ON(ss == NULL);
1048	if (ss->root != &rootnode) {
1049	/* Subsystem isn't free */
1050	return -EBUSY;
1051	}
1052	}
1053
1054	/* Currently we don't handle adding/removing subsystems when
1055	* any child cgroups exist. This is theoretically supportable
1056	* but involves complex error handling, so it's being left until
1057	* later */
1058	if (root->number_of_cgroups > 1)
1059	return -EBUSY;
1060
1061	/* Process each subsystem */
1062	for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
1063	struct cgroup_subsys *ss = subsys[i];
1064	unsigned long bit = 1UL << i;
1065	if (bit & added_bits) {
1066	/* We're binding this subsystem to this hierarchy */
1067	BUG_ON(ss == NULL);
1068	BUG_ON(cgrp->subsys[i]);
1069	BUG_ON(!dummytop->subsys[i]);
1070	BUG_ON(dummytop->subsys[i]->cgroup != dummytop);
1071	mutex_lock(&ss->hierarchy_mutex);
1072	cgrp->subsys[i] = dummytop->subsys[i];
1073	cgrp->subsys[i]->cgroup = cgrp;
1074	list_move(&ss->sibling, &root->subsys_list);
1075	ss->root = root;
1076	if (ss->bind)
1077	ss->bind(cgrp);
1078	mutex_unlock(&ss->hierarchy_mutex);
1079	/* refcount was already taken, and we're keeping it */
1080	} else if (bit & removed_bits) {
1081	/* We're removing this subsystem */
1082	BUG_ON(ss == NULL);
1083	BUG_ON(cgrp->subsys[i] != dummytop->subsys[i]);
1084	BUG_ON(cgrp->subsys[i]->cgroup != cgrp);
1085	mutex_lock(&ss->hierarchy_mutex);
1086	if (ss->bind)
1087	ss->bind(dummytop);
1088	dummytop->subsys[i]->cgroup = dummytop;
1089	cgrp->subsys[i] = NULL;
1090	subsys[i]->root = &rootnode;
1091	list_move(&ss->sibling, &rootnode.subsys_list);
1092	mutex_unlock(&ss->hierarchy_mutex);
1093	/* subsystem is now free - drop reference on module */
1094	module_put(ss->module);
1095	} else if (bit & final_bits) {
1096	/* Subsystem state should already exist */
1097	BUG_ON(ss == NULL);
1098	BUG_ON(!cgrp->subsys[i]);
1099	/*
1100	* a refcount was taken, but we already had one, so
1101	* drop the extra reference.
1102	*/
1103	module_put(ss->module);
1104	#ifdef CONFIG_MODULE_UNLOAD
1105	BUG_ON(ss->module && !module_refcount(ss->module));
1106	#endif
1107	} else {
1108	/* Subsystem state shouldn't exist */
1109	BUG_ON(cgrp->subsys[i]);
1110	}
1111	}
1112	root->subsys_bits = root->actual_subsys_bits = final_bits;
1113	synchronize_rcu();
1114
1115	return 0;
1116	}
1117
1118	static int cgroup_show_options(struct seq_file seq, struct dentry dentry)
1119	{
1120	struct cgroupfs_root *root = dentry->d_sb->s_fs_info;
1121	struct cgroup_subsys *ss;
1122
1123	mutex_lock(&cgroup_root_mutex);
1124	for_each_subsys(root, ss)
1125	seq_printf(seq, ",%s", ss->name);
1126	if (test_bit(ROOT_NOPREFIX, &root->flags))
1127	seq_puts(seq, ",noprefix");
1128	if (strlen(root->release_agent_path))
1129	seq_printf(seq, ",release_agent=%s", root->release_agent_path);
1130	if (clone_children(&root->top_cgroup))
1131	seq_puts(seq, ",clone_children");
1132	if (strlen(root->name))
1133	seq_printf(seq, ",name=%s", root->name);
1134	mutex_unlock(&cgroup_root_mutex);
1135	return 0;
1136	}
1137
1138	struct cgroup_sb_opts {
1139	unsigned long subsys_bits;
1140	unsigned long flags;
1141	char *release_agent;
1142	bool clone_children;
1143	char *name;
1144	/* User explicitly requested empty subsystem */
1145	bool none;
1146
1147	struct cgroupfs_root *new_root;
1148
1149	};
1150
1151	/*
1152	* Convert a hierarchy specifier into a bitmask of subsystems and flags. Call
1153	* with cgroup_mutex held to protect the subsys[] array. This function takes
1154	* refcounts on subsystems to be used, unless it returns error, in which case
1155	* no refcounts are taken.
1156	*/
1157	static int parse_cgroupfs_options(char data, struct cgroup_sb_opts opts)
1158	{
1159	char token, o = data;
1160	bool all_ss = false, one_ss = false;
1161	unsigned long mask = (unsigned long)-1;
1162	int i;
1163	bool module_pin_failed = false;
1164
1165	BUG_ON(!mutex_is_locked(&cgroup_mutex));
1166
1167	#ifdef CONFIG_CPUSETS
1168	mask = ~(1UL << cpuset_subsys_id);
1169	#endif
1170
1171	memset(opts, 0, sizeof(*opts));
1172
1173	while ((token = strsep(&o, ",")) != NULL) {
1174	if (!*token)
1175	return -EINVAL;
1176	if (!strcmp(token, "none")) {
1177	/* Explicitly have no subsystems */
1178	opts->none = true;
1179	continue;
1180	}
1181	if (!strcmp(token, "all")) {
1182	/* Mutually exclusive option 'all' + subsystem name */
1183	if (one_ss)
1184	return -EINVAL;
1185	all_ss = true;
1186	continue;
1187	}
1188	if (!strcmp(token, "noprefix")) {
1189	set_bit(ROOT_NOPREFIX, &opts->flags);
1190	continue;
1191	}
1192	if (!strcmp(token, "clone_children")) {
1193	opts->clone_children = true;
1194	continue;
1195	}
1196	if (!strncmp(token, "release_agent=", 14)) {
1197	/* Specifying two release agents is forbidden */
1198	if (opts->release_agent)
1199	return -EINVAL;
1200	opts->release_agent =
1201	kstrndup(token + 14, PATH_MAX - 1, GFP_KERNEL);
1202	if (!opts->release_agent)
1203	return -ENOMEM;
1204	continue;
1205	}
1206	if (!strncmp(token, "name=", 5)) {
1207	const char *name = token + 5;
1208	/* Can't specify an empty name */
1209	if (!strlen(name))
1210	return -EINVAL;
1211	/* Must match [\w.-]+ */
1212	for (i = 0; i < strlen(name); i++) {
1213	char c = name[i];
1214	if (isalnum(c))
1215	continue;
1216	if ((c == '.') \|\| (c == '-') \|\| (c == '_'))
1217	continue;
1218	return -EINVAL;
1219	}
1220	/* Specifying two names is forbidden */
1221	if (opts->name)
1222	return -EINVAL;
1223	opts->name = kstrndup(name,
1224	MAX_CGROUP_ROOT_NAMELEN - 1,
1225	GFP_KERNEL);
1226	if (!opts->name)
1227	return -ENOMEM;
1228
1229	continue;
1230	}
1231
1232	for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
1233	struct cgroup_subsys *ss = subsys[i];
1234	if (ss == NULL)
1235	continue;
1236	if (strcmp(token, ss->name))
1237	continue;
1238	if (ss->disabled)
1239	continue;
1240
1241	/* Mutually exclusive option 'all' + subsystem name */
1242	if (all_ss)
1243	return -EINVAL;
1244	set_bit(i, &opts->subsys_bits);
1245	one_ss = true;
1246
1247	break;
1248	}
1249	if (i == CGROUP_SUBSYS_COUNT)
1250	return -ENOENT;
1251	}
1252
1253	/*
1254	* If the 'all' option was specified select all the subsystems,
1255	* otherwise if 'none', 'name=' and a subsystem name options
1256	* were not specified, let's default to 'all'
1257	*/
1258	if (all_ss \|\| (!one_ss && !opts->none && !opts->name)) {
1259	for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
1260	struct cgroup_subsys *ss = subsys[i];
1261	if (ss == NULL)
1262	continue;
1263	if (ss->disabled)
1264	continue;
1265	set_bit(i, &opts->subsys_bits);
1266	}
1267	}
1268
1269	/* Consistency checks */
1270
1271	/*
1272	* Option noprefix was introduced just for backward compatibility
1273	* with the old cpuset, so we allow noprefix only if mounting just
1274	* the cpuset subsystem.
1275	*/
1276	if (test_bit(ROOT_NOPREFIX, &opts->flags) &&
1277	(opts->subsys_bits & mask))
1278	return -EINVAL;
1279
1280
1281	/* Can't specify "none" and some subsystems */
1282	if (opts->subsys_bits && opts->none)
1283	return -EINVAL;
1284
1285	/*
1286	* We either have to specify by name or by subsystems. (So all
1287	* empty hierarchies must have a name).
1288	*/
1289	if (!opts->subsys_bits && !opts->name)
1290	return -EINVAL;
1291
1292	/*
1293	* Grab references on all the modules we'll need, so the subsystems
1294	* don't dance around before rebind_subsystems attaches them. This may
1295	* take duplicate reference counts on a subsystem that's already used,
1296	* but rebind_subsystems handles this case.
1297	*/
1298	for (i = CGROUP_BUILTIN_SUBSYS_COUNT; i < CGROUP_SUBSYS_COUNT; i++) {
1299	unsigned long bit = 1UL << i;
1300
1301	if (!(bit & opts->subsys_bits))
1302	continue;
1303	if (!try_module_get(subsys[i]->module)) {
1304	module_pin_failed = true;
1305	break;
1306	}
1307	}
1308	if (module_pin_failed) {
1309	/*
1310	* oops, one of the modules was going away. this means that we
1311	* raced with a module_delete call, and to the user this is
1312	* essentially a "subsystem doesn't exist" case.
1313	*/
1314	for (i--; i >= CGROUP_BUILTIN_SUBSYS_COUNT; i--) {
1315	/* drop refcounts only on the ones we took */
1316	unsigned long bit = 1UL << i;
1317
1318	if (!(bit & opts->subsys_bits))
1319	continue;
1320	module_put(subsys[i]->module);
1321	}
1322	return -ENOENT;
1323	}
1324
1325	return 0;
1326	}
1327
1328	static void drop_parsed_module_refcounts(unsigned long subsys_bits)
1329	{
1330	int i;
1331	for (i = CGROUP_BUILTIN_SUBSYS_COUNT; i < CGROUP_SUBSYS_COUNT; i++) {
1332	unsigned long bit = 1UL << i;
1333
1334	if (!(bit & subsys_bits))
1335	continue;
1336	module_put(subsys[i]->module);
1337	}
1338	}
1339
1340	static int cgroup_remount(struct super_block sb, int flags, char *data)
1341	{
1342	int ret = 0;
1343	struct cgroupfs_root *root = sb->s_fs_info;
1344	struct cgroup *cgrp = &root->top_cgroup;
1345	struct cgroup_sb_opts opts;
1346
1347	mutex_lock(&cgrp->dentry->d_inode->i_mutex);
1348	mutex_lock(&cgroup_mutex);
1349	mutex_lock(&cgroup_root_mutex);
1350
1351	/* See what subsystems are wanted */
1352	ret = parse_cgroupfs_options(data, &opts);
1353	if (ret)
1354	goto out_unlock;
1355
1356	/* See feature-removal-schedule.txt */
1357	if (opts.subsys_bits != root->actual_subsys_bits \|\| opts.release_agent)
1358	pr_warning("cgroup: option changes via remount are deprecated (pid=%d comm=%s)\n",
1359	task_tgid_nr(current), current->comm);
1360
1361	/* Don't allow flags or name to change at remount */
1362	if (opts.flags != root->flags \|\|
1363	(opts.name && strcmp(opts.name, root->name))) {
1364	ret = -EINVAL;
1365	drop_parsed_module_refcounts(opts.subsys_bits);
1366	goto out_unlock;
1367	}
1368
1369	ret = rebind_subsystems(root, opts.subsys_bits);
1370	if (ret) {
1371	drop_parsed_module_refcounts(opts.subsys_bits);
1372	goto out_unlock;
1373	}
1374
1375	/* clear out any existing files and repopulate subsystem files */
1376	cgroup_clear_directory(cgrp->dentry);
1377	cgroup_populate_dir(cgrp);
1378
1379	if (opts.release_agent)
1380	strcpy(root->release_agent_path, opts.release_agent);
1381	out_unlock:
1382	kfree(opts.release_agent);
1383	kfree(opts.name);
1384	mutex_unlock(&cgroup_root_mutex);
1385	mutex_unlock(&cgroup_mutex);
1386	mutex_unlock(&cgrp->dentry->d_inode->i_mutex);
1387	return ret;
1388	}
1389
1390	static const struct super_operations cgroup_ops = {
1391	.statfs = simple_statfs,
1392	.drop_inode = generic_delete_inode,
1393	.show_options = cgroup_show_options,
1394	.remount_fs = cgroup_remount,
1395	};
1396
1397	static void init_cgroup_housekeeping(struct cgroup *cgrp)
1398	{
1399	INIT_LIST_HEAD(&cgrp->sibling);
1400	INIT_LIST_HEAD(&cgrp->children);
1401	INIT_LIST_HEAD(&cgrp->files);
1402	INIT_LIST_HEAD(&cgrp->css_sets);
1403	INIT_LIST_HEAD(&cgrp->release_list);
1404	INIT_LIST_HEAD(&cgrp->pidlists);
1405	mutex_init(&cgrp->pidlist_mutex);
1406	INIT_LIST_HEAD(&cgrp->event_list);
1407	spin_lock_init(&cgrp->event_list_lock);
1408	}
1409
1410	static void init_cgroup_root(struct cgroupfs_root *root)
1411	{
1412	struct cgroup *cgrp = &root->top_cgroup;
1413
1414	INIT_LIST_HEAD(&root->subsys_list);
1415	INIT_LIST_HEAD(&root->root_list);
1416	INIT_LIST_HEAD(&root->allcg_list);
1417	root->number_of_cgroups = 1;
1418	cgrp->root = root;
1419	cgrp->top_cgroup = cgrp;
1420	list_add_tail(&cgrp->allcg_node, &root->allcg_list);
1421	init_cgroup_housekeeping(cgrp);
1422	}
1423
1424	static bool init_root_id(struct cgroupfs_root *root)
1425	{
1426	int ret = 0;
1427
1428	do {
1429	if (!ida_pre_get(&hierarchy_ida, GFP_KERNEL))
1430	return false;
1431	spin_lock(&hierarchy_id_lock);
1432	/* Try to allocate the next unused ID */
1433	ret = ida_get_new_above(&hierarchy_ida, next_hierarchy_id,
1434	&root->hierarchy_id);
1435	if (ret == -ENOSPC)
1436	/* Try again starting from 0 */
1437	ret = ida_get_new(&hierarchy_ida, &root->hierarchy_id);
1438	if (!ret) {
1439	next_hierarchy_id = root->hierarchy_id + 1;
1440	} else if (ret != -EAGAIN) {
1441	/* Can only get here if the 31-bit IDR is full ... */
1442	BUG_ON(ret);
1443	}
1444	spin_unlock(&hierarchy_id_lock);
1445	} while (ret);
1446	return true;
1447	}
1448
1449	static int cgroup_test_super(struct super_block sb, void data)
1450	{
1451	struct cgroup_sb_opts *opts = data;
1452	struct cgroupfs_root *root = sb->s_fs_info;
1453
1454	/* If we asked for a name then it must match */
1455	if (opts->name && strcmp(opts->name, root->name))
1456	return 0;
1457
1458	/*
1459	* If we asked for subsystems (or explicitly for no
1460	* subsystems) then they must match
1461	*/
1462	if ((opts->subsys_bits \|\| opts->none)
1463	&& (opts->subsys_bits != root->subsys_bits))
1464	return 0;
1465
1466	return 1;
1467	}
1468
1469	static struct cgroupfs_root cgroup_root_from_opts(struct cgroup_sb_opts opts)
1470	{
1471	struct cgroupfs_root *root;
1472
1473	if (!opts->subsys_bits && !opts->none)
1474	return NULL;
1475
1476	root = kzalloc(sizeof(*root), GFP_KERNEL);
1477	if (!root)
1478	return ERR_PTR(-ENOMEM);
1479
1480	if (!init_root_id(root)) {
1481	kfree(root);
1482	return ERR_PTR(-ENOMEM);
1483	}
1484	init_cgroup_root(root);
1485
1486	root->subsys_bits = opts->subsys_bits;
1487	root->flags = opts->flags;
1488	if (opts->release_agent)
1489	strcpy(root->release_agent_path, opts->release_agent);
1490	if (opts->name)
1491	strcpy(root->name, opts->name);
1492	if (opts->clone_children)
1493	set_bit(CGRP_CLONE_CHILDREN, &root->top_cgroup.flags);
1494	return root;
1495	}
1496
1497	static void cgroup_drop_root(struct cgroupfs_root *root)
1498	{
1499	if (!root)
1500	return;
1501
1502	BUG_ON(!root->hierarchy_id);
1503	spin_lock(&hierarchy_id_lock);
1504	ida_remove(&hierarchy_ida, root->hierarchy_id);
1505	spin_unlock(&hierarchy_id_lock);
1506	kfree(root);
1507	}
1508
1509	static int cgroup_set_super(struct super_block sb, void data)
1510	{
1511	int ret;
1512	struct cgroup_sb_opts *opts = data;
1513
1514	/* If we don't have a new root, we can't set up a new sb */
1515	if (!opts->new_root)
1516	return -EINVAL;
1517
1518	BUG_ON(!opts->subsys_bits && !opts->none);
1519
1520	ret = set_anon_super(sb, NULL);
1521	if (ret)
1522	return ret;
1523
1524	sb->s_fs_info = opts->new_root;
1525	opts->new_root->sb = sb;
1526
1527	sb->s_blocksize = PAGE_CACHE_SIZE;
1528	sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
1529	sb->s_magic = CGROUP_SUPER_MAGIC;
1530	sb->s_op = &cgroup_ops;
1531
1532	return 0;
1533	}
1534
1535	static int cgroup_get_rootdir(struct super_block *sb)
1536	{
1537	static const struct dentry_operations cgroup_dops = {
1538	.d_iput = cgroup_diput,
1539	.d_delete = cgroup_delete,
1540	};
1541
1542	struct inode *inode =
1543	cgroup_new_inode(S_IFDIR \| S_IRUGO \| S_IXUGO \| S_IWUSR, sb);
1544
1545	if (!inode)
1546	return -ENOMEM;
1547
1548	inode->i_fop = &simple_dir_operations;
1549	inode->i_op = &cgroup_dir_inode_operations;
1550	/* directories start off with i_nlink == 2 (for "." entry) */
1551	inc_nlink(inode);
1552	sb->s_root = d_make_root(inode);
1553	if (!sb->s_root)
1554	return -ENOMEM;
1555	/* for everything else we want ->d_op set */
1556	sb->s_d_op = &cgroup_dops;
1557	return 0;
1558	}
1559
1560	static struct dentry cgroup_mount(struct file_system_type fs_type,
1561	int flags, const char *unused_dev_name,
1562	void *data)
1563	{
1564	struct cgroup_sb_opts opts;
1565	struct cgroupfs_root *root;
1566	int ret = 0;
1567	struct super_block *sb;
1568	struct cgroupfs_root *new_root;
1569	struct inode *inode;
1570
1571	/* First find the desired set of subsystems */
1572	mutex_lock(&cgroup_mutex);
1573	ret = parse_cgroupfs_options(data, &opts);
1574	mutex_unlock(&cgroup_mutex);
1575	if (ret)
1576	goto out_err;
1577
1578	/*
1579	* Allocate a new cgroup root. We may not need it if we're
1580	* reusing an existing hierarchy.
1581	*/
1582	new_root = cgroup_root_from_opts(&opts);
1583	if (IS_ERR(new_root)) {
1584	ret = PTR_ERR(new_root);
1585	goto drop_modules;
1586	}
1587	opts.new_root = new_root;
1588
1589	/* Locate an existing or new sb for this hierarchy */
1590	sb = sget(fs_type, cgroup_test_super, cgroup_set_super, &opts);
1591	if (IS_ERR(sb)) {
1592	ret = PTR_ERR(sb);
1593	cgroup_drop_root(opts.new_root);
1594	goto drop_modules;
1595	}
1596
1597	root = sb->s_fs_info;
1598	BUG_ON(!root);
1599	if (root == opts.new_root) {
1600	/* We used the new root structure, so this is a new hierarchy */
1601	struct list_head tmp_cg_links;
1602	struct cgroup *root_cgrp = &root->top_cgroup;
1603	struct cgroupfs_root *existing_root;
1604	const struct cred *cred;
1605	int i;
1606
1607	BUG_ON(sb->s_root != NULL);
1608
1609	ret = cgroup_get_rootdir(sb);
1610	if (ret)
1611	goto drop_new_super;
1612	inode = sb->s_root->d_inode;
1613
1614	mutex_lock(&inode->i_mutex);
1615	mutex_lock(&cgroup_mutex);
1616	mutex_lock(&cgroup_root_mutex);
1617
1618	/* Check for name clashes with existing mounts */
1619	ret = -EBUSY;
1620	if (strlen(root->name))
1621	for_each_active_root(existing_root)
1622	if (!strcmp(existing_root->name, root->name))
1623	goto unlock_drop;
1624
1625	/*
1626	* We're accessing css_set_count without locking
1627	* css_set_lock here, but that's OK - it can only be
1628	* increased by someone holding cgroup_lock, and
1629	* that's us. The worst that can happen is that we
1630	* have some link structures left over
1631	*/
1632	ret = allocate_cg_links(css_set_count, &tmp_cg_links);
1633	if (ret)
1634	goto unlock_drop;
1635
1636	ret = rebind_subsystems(root, root->subsys_bits);
1637	if (ret == -EBUSY) {
1638	free_cg_links(&tmp_cg_links);
1639	goto unlock_drop;
1640	}
1641	/*
1642	* There must be no failure case after here, since rebinding
1643	* takes care of subsystems' refcounts, which are explicitly
1644	* dropped in the failure exit path.
1645	*/
1646
1647	/* EBUSY should be the only error here */
1648	BUG_ON(ret);
1649
1650	list_add(&root->root_list, &roots);
1651	root_count++;
1652
1653	sb->s_root->d_fsdata = root_cgrp;
1654	root->top_cgroup.dentry = sb->s_root;
1655
1656	/* Link the top cgroup in this hierarchy into all
1657	* the css_set objects */
1658	write_lock(&css_set_lock);
1659	for (i = 0; i < CSS_SET_TABLE_SIZE; i++) {
1660	struct hlist_head *hhead = &css_set_table[i];
1661	struct hlist_node *node;
1662	struct css_set *cg;
1663
1664	hlist_for_each_entry(cg, node, hhead, hlist)
1665	link_css_set(&tmp_cg_links, cg, root_cgrp);
1666	}
1667	write_unlock(&css_set_lock);
1668
1669	free_cg_links(&tmp_cg_links);
1670
1671	BUG_ON(!list_empty(&root_cgrp->sibling));
1672	BUG_ON(!list_empty(&root_cgrp->children));
1673	BUG_ON(root->number_of_cgroups != 1);
1674
1675	cred = override_creds(&init_cred);
1676	cgroup_populate_dir(root_cgrp);
1677	revert_creds(cred);
1678	mutex_unlock(&cgroup_root_mutex);
1679	mutex_unlock(&cgroup_mutex);
1680	mutex_unlock(&inode->i_mutex);
1681	} else {
1682	/*
1683	* We re-used an existing hierarchy - the new root (if
1684	* any) is not needed
1685	*/
1686	cgroup_drop_root(opts.new_root);
1687	/* no subsys rebinding, so refcounts don't change */
1688	drop_parsed_module_refcounts(opts.subsys_bits);
1689	}
1690
1691	kfree(opts.release_agent);
1692	kfree(opts.name);
1693	return dget(sb->s_root);
1694
1695	unlock_drop:
1696	mutex_unlock(&cgroup_root_mutex);
1697	mutex_unlock(&cgroup_mutex);
1698	mutex_unlock(&inode->i_mutex);
1699	drop_new_super:
1700	deactivate_locked_super(sb);
1701	drop_modules:
1702	drop_parsed_module_refcounts(opts.subsys_bits);
1703	out_err:
1704	kfree(opts.release_agent);
1705	kfree(opts.name);
1706	return ERR_PTR(ret);
1707	}
1708
1709	static void cgroup_kill_sb(struct super_block *sb) {
1710	struct cgroupfs_root *root = sb->s_fs_info;
1711	struct cgroup *cgrp = &root->top_cgroup;
1712	int ret;
1713	struct cg_cgroup_link *link;
1714	struct cg_cgroup_link *saved_link;
1715
1716	BUG_ON(!root);
1717
1718	BUG_ON(root->number_of_cgroups != 1);
1719	BUG_ON(!list_empty(&cgrp->children));
1720	BUG_ON(!list_empty(&cgrp->sibling));
1721
1722	mutex_lock(&cgroup_mutex);
1723	mutex_lock(&cgroup_root_mutex);
1724
1725	/* Rebind all subsystems back to the default hierarchy */
1726	ret = rebind_subsystems(root, 0);
1727	/* Shouldn't be able to fail ... */
1728	BUG_ON(ret);
1729
1730	/*
1731	* Release all the links from css_sets to this hierarchy's
1732	* root cgroup
1733	*/
1734	write_lock(&css_set_lock);
1735
1736	list_for_each_entry_safe(link, saved_link, &cgrp->css_sets,
1737	cgrp_link_list) {
1738	list_del(&link->cg_link_list);
1739	list_del(&link->cgrp_link_list);
1740	kfree(link);
1741	}
1742	write_unlock(&css_set_lock);
1743
1744	if (!list_empty(&root->root_list)) {
1745	list_del(&root->root_list);
1746	root_count--;
1747	}
1748
1749	mutex_unlock(&cgroup_root_mutex);
1750	mutex_unlock(&cgroup_mutex);
1751
1752	kill_litter_super(sb);
1753	cgroup_drop_root(root);
1754	}
1755
1756	static struct file_system_type cgroup_fs_type = {
1757	.name = "cgroup",
1758	.mount = cgroup_mount,
1759	.kill_sb = cgroup_kill_sb,
1760	};
1761
1762	static struct kobject *cgroup_kobj;
1763
1764	/**
1765	* cgroup_path - generate the path of a cgroup
1766	* @cgrp: the cgroup in question
1767	* @buf: the buffer to write the path into
1768	* @buflen: the length of the buffer
1769	*
1770	* Called with cgroup_mutex held or else with an RCU-protected cgroup
1771	* reference. Writes path of cgroup into buf. Returns 0 on success,
1772	* -errno on error.
1773	*/
1774	int cgroup_path(const struct cgroup cgrp, char buf, int buflen)
1775	{
1776	char *start;
1777	struct dentry *dentry = rcu_dereference_check(cgrp->dentry,
1778	cgroup_lock_is_held());
1779
1780	if (!dentry \|\| cgrp == dummytop) {
1781	/*
1782	* Inactive subsystems have no dentry for their root
1783	* cgroup
1784	*/
1785	strcpy(buf, "/");
1786	return 0;
1787	}
1788
1789	start = buf + buflen;
1790
1791	*--start = '\0';
1792	for (;;) {
1793	int len = dentry->d_name.len;
1794
1795	if ((start -= len) < buf)
1796	return -ENAMETOOLONG;
1797	memcpy(start, dentry->d_name.name, len);
1798	cgrp = cgrp->parent;
1799	if (!cgrp)
1800	break;
1801
1802	dentry = rcu_dereference_check(cgrp->dentry,
1803	cgroup_lock_is_held());
1804	if (!cgrp->parent)
1805	continue;
1806	if (--start < buf)
1807	return -ENAMETOOLONG;
1808	*start = '/';
1809	}
1810	memmove(buf, start, buf + buflen - start);
1811	return 0;
1812	}
1813	EXPORT_SYMBOL_GPL(cgroup_path);
1814
1815	/*
1816	* Control Group taskset
1817	*/
1818	struct task_and_cgroup {
1819	struct task_struct *task;
1820	struct cgroup *cgrp;
1821	struct css_set *cg;
1822	};
1823
1824	struct cgroup_taskset {
1825	struct task_and_cgroup single;
1826	struct flex_array *tc_array;
1827	int tc_array_len;
1828	int idx;
1829	struct cgroup *cur_cgrp;
1830	};
1831
1832	/**
1833	* cgroup_taskset_first - reset taskset and return the first task
1834	* @tset: taskset of interest
1835	*
1836	* @tset iteration is initialized and the first task is returned.
1837	*/
1838	struct task_struct cgroup_taskset_first(struct cgroup_taskset tset)
1839	{
1840	if (tset->tc_array) {
1841	tset->idx = 0;
1842	return cgroup_taskset_next(tset);
1843	} else {
1844	tset->cur_cgrp = tset->single.cgrp;
1845	return tset->single.task;
1846	}
1847	}
1848	EXPORT_SYMBOL_GPL(cgroup_taskset_first);
1849
1850	/**
1851	* cgroup_taskset_next - iterate to the next task in taskset
1852	* @tset: taskset of interest
1853	*
1854	* Return the next task in @tset. Iteration must have been initialized
1855	* with cgroup_taskset_first().
1856	*/
1857	struct task_struct cgroup_taskset_next(struct cgroup_taskset tset)
1858	{
1859	struct task_and_cgroup *tc;
1860
1861	if (!tset->tc_array \|\| tset->idx >= tset->tc_array_len)
1862	return NULL;
1863
1864	tc = flex_array_get(tset->tc_array, tset->idx++);
1865	tset->cur_cgrp = tc->cgrp;
1866	return tc->task;
1867	}
1868	EXPORT_SYMBOL_GPL(cgroup_taskset_next);
1869
1870	/**
1871	* cgroup_taskset_cur_cgroup - return the matching cgroup for the current task
1872	* @tset: taskset of interest
1873	*
1874	* Return the cgroup for the current (last returned) task of @tset. This
1875	* function must be preceded by either cgroup_taskset_first() or
1876	* cgroup_taskset_next().
1877	*/
1878	struct cgroup cgroup_taskset_cur_cgroup(struct cgroup_taskset tset)
1879	{
1880	return tset->cur_cgrp;
1881	}
1882	EXPORT_SYMBOL_GPL(cgroup_taskset_cur_cgroup);
1883
1884	/**
1885	* cgroup_taskset_size - return the number of tasks in taskset
1886	* @tset: taskset of interest
1887	*/
1888	int cgroup_taskset_size(struct cgroup_taskset *tset)
1889	{
1890	return tset->tc_array ? tset->tc_array_len : 1;
1891	}
1892	EXPORT_SYMBOL_GPL(cgroup_taskset_size);
1893
1894
1895	/*
1896	* cgroup_task_migrate - move a task from one cgroup to another.
1897	*
1898	* 'guarantee' is set if the caller promises that a new css_set for the task
1899	* will already exist. If not set, this function might sleep, and can fail with
1900	* -ENOMEM. Must be called with cgroup_mutex and threadgroup locked.
1901	*/
1902	static void cgroup_task_migrate(struct cgroup cgrp, struct cgroup oldcgrp,
1903	struct task_struct tsk, struct css_set newcg)
1904	{
1905	struct css_set *oldcg;
1906
1907	/*
1908	* We are synchronized through threadgroup_lock() against PF_EXITING
1909	* setting such that we can't race against cgroup_exit() changing the
1910	* css_set to init_css_set and dropping the old one.
1911	*/
1912	WARN_ON_ONCE(tsk->flags & PF_EXITING);
1913	oldcg = tsk->cgroups;
1914
1915	task_lock(tsk);
1916	rcu_assign_pointer(tsk->cgroups, newcg);
1917	task_unlock(tsk);
1918
1919	/* Update the css_set linked lists if we're using them */
1920	write_lock(&css_set_lock);
1921	if (!list_empty(&tsk->cg_list))
1922	list_move(&tsk->cg_list, &newcg->tasks);
1923	write_unlock(&css_set_lock);
1924
1925	/*
1926	* We just gained a reference on oldcg by taking it from the task. As
1927	* trading it for newcg is protected by cgroup_mutex, we're safe to drop
1928	* it here; it will be freed under RCU.
1929	*/
1930	put_css_set(oldcg);
1931
1932	set_bit(CGRP_RELEASABLE, &oldcgrp->flags);
1933	}
1934
1935	/**
1936	* cgroup_attach_task - attach task 'tsk' to cgroup 'cgrp'
1937	* @cgrp: the cgroup the task is attaching to
1938	* @tsk: the task to be attached
1939	*
1940	* Call with cgroup_mutex and threadgroup locked. May take task_lock of
1941	* @tsk during call.
1942	*/
1943	int cgroup_attach_task(struct cgroup cgrp, struct task_struct tsk)
1944	{
1945	int retval = 0;
1946	struct cgroup_subsys ss, failed_ss = NULL;
1947	struct cgroup *oldcgrp;
1948	struct cgroupfs_root *root = cgrp->root;
1949	struct cgroup_taskset tset = { };
1950	struct css_set *newcg;
1951
1952	/* @tsk either already exited or can't exit until the end */
1953	if (tsk->flags & PF_EXITING)
1954	return -ESRCH;
1955
1956	/* Nothing to do if the task is already in that cgroup */
1957	oldcgrp = task_cgroup_from_root(tsk, root);
1958	if (cgrp == oldcgrp)
1959	return 0;
1960
1961	tset.single.task = tsk;
1962	tset.single.cgrp = oldcgrp;
1963
1964	for_each_subsys(root, ss) {
1965	if (ss->can_attach) {
1966	retval = ss->can_attach(cgrp, &tset);
1967	if (retval) {
1968	/*
1969	* Remember on which subsystem the can_attach()
1970	* failed, so that we only call cancel_attach()
1971	* against the subsystems whose can_attach()
1972	* succeeded. (See below)
1973	*/
1974	failed_ss = ss;
1975	goto out;
1976	}
1977	}
1978	}
1979
1980	newcg = find_css_set(tsk->cgroups, cgrp);
1981	if (!newcg) {
1982	retval = -ENOMEM;
1983	goto out;
1984	}
1985
1986	cgroup_task_migrate(cgrp, oldcgrp, tsk, newcg);
1987
1988	for_each_subsys(root, ss) {
1989	if (ss->attach)
1990	ss->attach(cgrp, &tset);
1991	}
1992
1993	synchronize_rcu();
1994
1995	/*
1996	* wake up rmdir() waiter. the rmdir should fail since the cgroup
1997	* is no longer empty.
1998	*/
1999	cgroup_wakeup_rmdir_waiter(cgrp);
2000	out:
2001	if (retval) {
2002	for_each_subsys(root, ss) {
2003	if (ss == failed_ss)
2004	/*
2005	* This subsystem was the one that failed the
2006	* can_attach() check earlier, so we don't need
2007	* to call cancel_attach() against it or any
2008	* remaining subsystems.
2009	*/
2010	break;
2011	if (ss->cancel_attach)
2012	ss->cancel_attach(cgrp, &tset);
2013	}
2014	}
2015	return retval;
2016	}
2017
2018	/**
2019	* cgroup_attach_task_all - attach task 'tsk' to all cgroups of task 'from'
2020	* @from: attach to all cgroups of a given task
2021	* @tsk: the task to be attached
2022	*/
2023	int cgroup_attach_task_all(struct task_struct from, struct task_struct tsk)
2024	{
2025	struct cgroupfs_root *root;
2026	int retval = 0;
2027
2028	cgroup_lock();
2029	for_each_active_root(root) {
2030	struct cgroup *from_cg = task_cgroup_from_root(from, root);
2031
2032	retval = cgroup_attach_task(from_cg, tsk);
2033	if (retval)
2034	break;
2035	}
2036	cgroup_unlock();
2037
2038	return retval;
2039	}
2040	EXPORT_SYMBOL_GPL(cgroup_attach_task_all);
2041
2042	/**
2043	* cgroup_attach_proc - attach all threads in a threadgroup to a cgroup
2044	* @cgrp: the cgroup to attach to
2045	* @leader: the threadgroup leader task_struct of the group to be attached
2046	*
2047	* Call holding cgroup_mutex and the group_rwsem of the leader. Will take
2048	* task_lock of each thread in leader's threadgroup individually in turn.
2049	*/
2050	static int cgroup_attach_proc(struct cgroup cgrp, struct task_struct leader)
2051	{
2052	int retval, i, group_size;
2053	struct cgroup_subsys ss, failed_ss = NULL;
2054	/* guaranteed to be initialized later, but the compiler needs this */
2055	struct cgroupfs_root *root = cgrp->root;
2056	/* threadgroup list cursor and array */
2057	struct task_struct *tsk;
2058	struct task_and_cgroup *tc;
2059	struct flex_array *group;
2060	struct cgroup_taskset tset = { };
2061
2062	/*
2063	* step 0: in order to do expensive, possibly blocking operations for
2064	* every thread, we cannot iterate the thread group list, since it needs
2065	* rcu or tasklist locked. instead, build an array of all threads in the
2066	* group - group_rwsem prevents new threads from appearing, and if
2067	* threads exit, this will just be an over-estimate.
2068	*/
2069	group_size = get_nr_threads(leader);
2070	/* flex_array supports very large thread-groups better than kmalloc. */
2071	group = flex_array_alloc(sizeof(*tc), group_size, GFP_KERNEL);
2072	if (!group)
2073	return -ENOMEM;
2074	/* pre-allocate to guarantee space while iterating in rcu read-side. */
2075	retval = flex_array_prealloc(group, 0, group_size - 1, GFP_KERNEL);
2076	if (retval)
2077	goto out_free_group_list;
2078
2079	tsk = leader;
2080	i = 0;
2081	/*
2082	* Prevent freeing of tasks while we take a snapshot. Tasks that are
2083	* already PF_EXITING could be freed from underneath us unless we
2084	* take an rcu_read_lock.
2085	*/
2086	rcu_read_lock();
2087	do {
2088	struct task_and_cgroup ent;
2089
2090	/* @tsk either already exited or can't exit until the end */
2091	if (tsk->flags & PF_EXITING)
2092	continue;
2093
2094	/* as per above, nr_threads may decrease, but not increase. */
2095	BUG_ON(i >= group_size);
2096	ent.task = tsk;
2097	ent.cgrp = task_cgroup_from_root(tsk, root);
2098	/* nothing to do if this task is already in the cgroup */
2099	if (ent.cgrp == cgrp)
2100	continue;
2101	/*
2102	* saying GFP_ATOMIC has no effect here because we did prealloc
2103	* earlier, but it's good form to communicate our expectations.
2104	*/
2105	retval = flex_array_put(group, i, &ent, GFP_ATOMIC);
2106	BUG_ON(retval != 0);
2107	i++;
2108	} while_each_thread(leader, tsk);
2109	rcu_read_unlock();
2110	/* remember the number of threads in the array for later. */
2111	group_size = i;
2112	tset.tc_array = group;
2113	tset.tc_array_len = group_size;
2114
2115	/* methods shouldn't be called if no task is actually migrating */
2116	retval = 0;
2117	if (!group_size)
2118	goto out_free_group_list;
2119
2120	/*
2121	* step 1: check that we can legitimately attach to the cgroup.
2122	*/
2123	for_each_subsys(root, ss) {
2124	if (ss->can_attach) {
2125	retval = ss->can_attach(cgrp, &tset);
2126	if (retval) {
2127	failed_ss = ss;
2128	goto out_cancel_attach;
2129	}
2130	}
2131	}
2132
2133	/*
2134	* step 2: make sure css_sets exist for all threads to be migrated.
2135	* we use find_css_set, which allocates a new one if necessary.
2136	*/
2137	for (i = 0; i < group_size; i++) {
2138	tc = flex_array_get(group, i);
2139	tc->cg = find_css_set(tc->task->cgroups, cgrp);
2140	if (!tc->cg) {
2141	retval = -ENOMEM;
2142	goto out_put_css_set_refs;
2143	}
2144	}
2145
2146	/*
2147	* step 3: now that we're guaranteed success wrt the css_sets,
2148	* proceed to move all tasks to the new cgroup. There are no
2149	* failure cases after here, so this is the commit point.
2150	*/
2151	for (i = 0; i < group_size; i++) {
2152	tc = flex_array_get(group, i);
2153	cgroup_task_migrate(cgrp, tc->cgrp, tc->task, tc->cg);
2154	}
2155	/* nothing is sensitive to fork() after this point. */
2156
2157	/*
2158	* step 4: do subsystem attach callbacks.
2159	*/
2160	for_each_subsys(root, ss) {
2161	if (ss->attach)
2162	ss->attach(cgrp, &tset);
2163	}
2164
2165	/*
2166	* step 5: success! and cleanup
2167	*/
2168	synchronize_rcu();
2169	cgroup_wakeup_rmdir_waiter(cgrp);
2170	retval = 0;
2171	out_put_css_set_refs:
2172	if (retval) {
2173	for (i = 0; i < group_size; i++) {
2174	tc = flex_array_get(group, i);
2175	if (!tc->cg)
2176	break;
2177	put_css_set(tc->cg);
2178	}
2179	}
2180	out_cancel_attach:
2181	if (retval) {
2182	for_each_subsys(root, ss) {
2183	if (ss == failed_ss)
2184	break;
2185	if (ss->cancel_attach)
2186	ss->cancel_attach(cgrp, &tset);
2187	}
2188	}
2189	out_free_group_list:
2190	flex_array_free(group);
2191	return retval;
2192	}
2193
2194	/*
2195	* Find the task_struct of the task to attach by vpid and pass it along to the
2196	* function to attach either it or all tasks in its threadgroup. Will lock
2197	* cgroup_mutex and threadgroup; may take task_lock of task.
2198	*/
2199	static int attach_task_by_pid(struct cgroup *cgrp, u64 pid, bool threadgroup)
2200	{
2201	struct task_struct *tsk;
2202	const struct cred cred = current_cred(), tcred;
2203	int ret;
2204
2205	if (!cgroup_lock_live_group(cgrp))
2206	return -ENODEV;
2207
2208	retry_find_task:
2209	rcu_read_lock();
2210	if (pid) {
2211	tsk = find_task_by_vpid(pid);
2212	if (!tsk) {
2213	rcu_read_unlock();
2214	ret= -ESRCH;
2215	goto out_unlock_cgroup;
2216	}
2217	/*
2218	* even if we're attaching all tasks in the thread group, we
2219	* only need to check permissions on one of them.
2220	*/
2221	tcred = __task_cred(tsk);
2222	if (!uid_eq(cred->euid, GLOBAL_ROOT_UID) &&
2223	!uid_eq(cred->euid, tcred->uid) &&
2224	!uid_eq(cred->euid, tcred->suid)) {
2225	rcu_read_unlock();
2226	ret = -EACCES;
2227	goto out_unlock_cgroup;
2228	}
2229	} else
2230	tsk = current;
2231
2232	if (threadgroup)
2233	tsk = tsk->group_leader;
2234
2235	/*
2236	* Workqueue threads may acquire PF_THREAD_BOUND and become
2237	* trapped in a cpuset, or RT worker may be born in a cgroup
2238	* with no rt_runtime allocated. Just say no.
2239	*/
2240	if (tsk == kthreadd_task \|\| (tsk->flags & PF_THREAD_BOUND)) {
2241	ret = -EINVAL;
2242	rcu_read_unlock();
2243	goto out_unlock_cgroup;
2244	}
2245
2246	get_task_struct(tsk);
2247	rcu_read_unlock();
2248
2249	threadgroup_lock(tsk);
2250	if (threadgroup) {
2251	if (!thread_group_leader(tsk)) {
2252	/*
2253	* a race with de_thread from another thread's exec()
2254	* may strip us of our leadership, if this happens,
2255	* there is no choice but to throw this task away and
2256	* try again; this is
2257	* "double-double-toil-and-trouble-check locking".
2258	*/
2259	threadgroup_unlock(tsk);
2260	put_task_struct(tsk);
2261	goto retry_find_task;
2262	}
2263	ret = cgroup_attach_proc(cgrp, tsk);
2264	} else
2265	ret = cgroup_attach_task(cgrp, tsk);
2266	threadgroup_unlock(tsk);
2267
2268	put_task_struct(tsk);
2269	out_unlock_cgroup:
2270	cgroup_unlock();
2271	return ret;
2272	}
2273
2274	static int cgroup_tasks_write(struct cgroup cgrp, struct cftype cft, u64 pid)
2275	{
2276	return attach_task_by_pid(cgrp, pid, false);
2277	}
2278
2279	static int cgroup_procs_write(struct cgroup cgrp, struct cftype cft, u64 tgid)
2280	{
2281	return attach_task_by_pid(cgrp, tgid, true);
2282	}
2283
2284	/**
2285	* cgroup_lock_live_group - take cgroup_mutex and check that cgrp is alive.
2286	* @cgrp: the cgroup to be checked for liveness
2287	*
2288	* On success, returns true; the lock should be later released with
2289	* cgroup_unlock(). On failure returns false with no lock held.
2290	*/
2291	bool cgroup_lock_live_group(struct cgroup *cgrp)
2292	{
2293	mutex_lock(&cgroup_mutex);
2294	if (cgroup_is_removed(cgrp)) {
2295	mutex_unlock(&cgroup_mutex);
2296	return false;
2297	}
2298	return true;
2299	}
2300	EXPORT_SYMBOL_GPL(cgroup_lock_live_group);
2301
2302	static int cgroup_release_agent_write(struct cgroup cgrp, struct cftype cft,
2303	const char *buffer)
2304	{
2305	BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);
2306	if (strlen(buffer) >= PATH_MAX)
2307	return -EINVAL;
2308	if (!cgroup_lock_live_group(cgrp))
2309	return -ENODEV;
2310	mutex_lock(&cgroup_root_mutex);
2311	strcpy(cgrp->root->release_agent_path, buffer);
2312	mutex_unlock(&cgroup_root_mutex);
2313	cgroup_unlock();
2314	return 0;
2315	}
2316
2317	static int cgroup_release_agent_show(struct cgroup cgrp, struct cftype cft,
2318	struct seq_file *seq)
2319	{
2320	if (!cgroup_lock_live_group(cgrp))
2321	return -ENODEV;
2322	seq_puts(seq, cgrp->root->release_agent_path);
2323	seq_putc(seq, '\n');
2324	cgroup_unlock();
2325	return 0;
2326	}
2327
2328	/* A buffer size big enough for numbers or short strings */
2329	#define CGROUP_LOCAL_BUFFER_SIZE 64
2330
2331	static ssize_t cgroup_write_X64(struct cgroup cgrp, struct cftype cft,
2332	struct file *file,
2333	const char __user *userbuf,
2334	size_t nbytes, loff_t *unused_ppos)
2335	{
2336	char buffer[CGROUP_LOCAL_BUFFER_SIZE];
2337	int retval = 0;
2338	char *end;
2339
2340	if (!nbytes)
2341	return -EINVAL;
2342	if (nbytes >= sizeof(buffer))
2343	return -E2BIG;
2344	if (copy_from_user(buffer, userbuf, nbytes))
2345	return -EFAULT;
2346
2347	buffer[nbytes] = 0; /* nul-terminate */
2348	if (cft->write_u64) {
2349	u64 val = simple_strtoull(strstrip(buffer), &end, 0);
2350	if (*end)
2351	return -EINVAL;
2352	retval = cft->write_u64(cgrp, cft, val);
2353	} else {
2354	s64 val = simple_strtoll(strstrip(buffer), &end, 0);
2355	if (*end)
2356	return -EINVAL;
2357	retval = cft->write_s64(cgrp, cft, val);
2358	}
2359	if (!retval)
2360	retval = nbytes;
2361	return retval;
2362	}
2363
2364	static ssize_t cgroup_write_string(struct cgroup cgrp, struct cftype cft,
2365	struct file *file,
2366	const char __user *userbuf,
2367	size_t nbytes, loff_t *unused_ppos)
2368	{
2369	char local_buffer[CGROUP_LOCAL_BUFFER_SIZE];
2370	int retval = 0;
2371	size_t max_bytes = cft->max_write_len;
2372	char *buffer = local_buffer;
2373
2374	if (!max_bytes)
2375	max_bytes = sizeof(local_buffer) - 1;
2376	if (nbytes >= max_bytes)
2377	return -E2BIG;
2378	/* Allocate a dynamic buffer if we need one */
2379	if (nbytes >= sizeof(local_buffer)) {
2380	buffer = kmalloc(nbytes + 1, GFP_KERNEL);
2381	if (buffer == NULL)
2382	return -ENOMEM;
2383	}
2384	if (nbytes && copy_from_user(buffer, userbuf, nbytes)) {
2385	retval = -EFAULT;
2386	goto out;
2387	}
2388
2389	buffer[nbytes] = 0; /* nul-terminate */
2390	retval = cft->write_string(cgrp, cft, strstrip(buffer));
2391	if (!retval)
2392	retval = nbytes;
2393	out:
2394	if (buffer != local_buffer)
2395	kfree(buffer);
2396	return retval;
2397	}
2398
2399	static ssize_t cgroup_file_write(struct file file, const char __user buf,
2400	size_t nbytes, loff_t *ppos)
2401	{
2402	struct cftype *cft = __d_cft(file->f_dentry);
2403	struct cgroup *cgrp = __d_cgrp(file->f_dentry->d_parent);
2404
2405	if (cgroup_is_removed(cgrp))
2406	return -ENODEV;
2407	if (cft->write)
2408	return cft->write(cgrp, cft, file, buf, nbytes, ppos);
2409	if (cft->write_u64 \|\| cft->write_s64)
2410	return cgroup_write_X64(cgrp, cft, file, buf, nbytes, ppos);
2411	if (cft->write_string)
2412	return cgroup_write_string(cgrp, cft, file, buf, nbytes, ppos);
2413	if (cft->trigger) {
2414	int ret = cft->trigger(cgrp, (unsigned int)cft->private);
2415	return ret ? ret : nbytes;
2416	}
2417	return -EINVAL;
2418	}
2419
2420	static ssize_t cgroup_read_u64(struct cgroup cgrp, struct cftype cft,
2421	struct file *file,
2422	char __user *buf, size_t nbytes,
2423	loff_t *ppos)
2424	{
2425	char tmp[CGROUP_LOCAL_BUFFER_SIZE];
2426	u64 val = cft->read_u64(cgrp, cft);
2427	int len = sprintf(tmp, "%llu\n", (unsigned long long) val);
2428
2429	return simple_read_from_buffer(buf, nbytes, ppos, tmp, len);
2430	}
2431
2432	static ssize_t cgroup_read_s64(struct cgroup cgrp, struct cftype cft,
2433	struct file *file,
2434	char __user *buf, size_t nbytes,
2435	loff_t *ppos)
2436	{
2437	char tmp[CGROUP_LOCAL_BUFFER_SIZE];
2438	s64 val = cft->read_s64(cgrp, cft);
2439	int len = sprintf(tmp, "%lld\n", (long long) val);
2440
2441	return simple_read_from_buffer(buf, nbytes, ppos, tmp, len);
2442	}
2443
2444	static ssize_t cgroup_file_read(struct file file, char __user buf,
2445	size_t nbytes, loff_t *ppos)
2446	{
2447	struct cftype *cft = __d_cft(file->f_dentry);
2448	struct cgroup *cgrp = __d_cgrp(file->f_dentry->d_parent);
2449
2450	if (cgroup_is_removed(cgrp))
2451	return -ENODEV;
2452
2453	if (cft->read)
2454	return cft->read(cgrp, cft, file, buf, nbytes, ppos);
2455	if (cft->read_u64)
2456	return cgroup_read_u64(cgrp, cft, file, buf, nbytes, ppos);
2457	if (cft->read_s64)
2458	return cgroup_read_s64(cgrp, cft, file, buf, nbytes, ppos);
2459	return -EINVAL;
2460	}
2461
2462	/*
2463	* seqfile ops/methods for returning structured data. Currently just
2464	* supports string->u64 maps, but can be extended in future.
2465	*/
2466
2467	struct cgroup_seqfile_state {
2468	struct cftype *cft;
2469	struct cgroup *cgroup;
2470	};
2471
2472	static int cgroup_map_add(struct cgroup_map_cb cb, const char key, u64 value)
2473	{
2474	struct seq_file *sf = cb->state;
2475	return seq_printf(sf, "%s %llu\n", key, (unsigned long long)value);
2476	}
2477
2478	static int cgroup_seqfile_show(struct seq_file m, void arg)
2479	{
2480	struct cgroup_seqfile_state *state = m->private;
2481	struct cftype *cft = state->cft;
2482	if (cft->read_map) {
2483	struct cgroup_map_cb cb = {
2484	.fill = cgroup_map_add,
2485	.state = m,
2486	};
2487	return cft->read_map(state->cgroup, cft, &cb);
2488	}
2489	return cft->read_seq_string(state->cgroup, cft, m);
2490	}
2491
2492	static int cgroup_seqfile_release(struct inode inode, struct file file)
2493	{
2494	struct seq_file *seq = file->private_data;
2495	kfree(seq->private);
2496	return single_release(inode, file);
2497	}
2498
2499	static const struct file_operations cgroup_seqfile_operations = {
2500	.read = seq_read,
2501	.write = cgroup_file_write,
2502	.llseek = seq_lseek,
2503	.release = cgroup_seqfile_release,
2504	};
2505
2506	static int cgroup_file_open(struct inode inode, struct file file)
2507	{
2508	int err;
2509	struct cftype *cft;
2510
2511	err = generic_file_open(inode, file);
2512	if (err)
2513	return err;
2514	cft = __d_cft(file->f_dentry);
2515
2516	if (cft->read_map \|\| cft->read_seq_string) {
2517	struct cgroup_seqfile_state *state =
2518	kzalloc(sizeof(*state), GFP_USER);
2519	if (!state)
2520	return -ENOMEM;
2521	state->cft = cft;
2522	state->cgroup = __d_cgrp(file->f_dentry->d_parent);
2523	file->f_op = &cgroup_seqfile_operations;
2524	err = single_open(file, cgroup_seqfile_show, state);
2525	if (err < 0)
2526	kfree(state);
2527	} else if (cft->open)
2528	err = cft->open(inode, file);
2529	else
2530	err = 0;
2531
2532	return err;
2533	}
2534
2535	static int cgroup_file_release(struct inode inode, struct file file)
2536	{
2537	struct cftype *cft = __d_cft(file->f_dentry);
2538	if (cft->release)
2539	return cft->release(inode, file);
2540	return 0;
2541	}
2542
2543	/*
2544	* cgroup_rename - Only allow simple rename of directories in place.
2545	*/
2546	static int cgroup_rename(struct inode old_dir, struct dentry old_dentry,
2547	struct inode new_dir, struct dentry new_dentry)
2548	{
2549	if (!S_ISDIR(old_dentry->d_inode->i_mode))
2550	return -ENOTDIR;
2551	if (new_dentry->d_inode)
2552	return -EEXIST;
2553	if (old_dir != new_dir)
2554	return -EIO;
2555	return simple_rename(old_dir, old_dentry, new_dir, new_dentry);
2556	}
2557
2558	static const struct file_operations cgroup_file_operations = {
2559	.read = cgroup_file_read,
2560	.write = cgroup_file_write,
2561	.llseek = generic_file_llseek,
2562	.open = cgroup_file_open,
2563	.release = cgroup_file_release,
2564	};
2565
2566	static const struct inode_operations cgroup_dir_inode_operations = {
2567	.lookup = cgroup_lookup,
2568	.mkdir = cgroup_mkdir,
2569	.rmdir = cgroup_rmdir,
2570	.rename = cgroup_rename,
2571	};
2572
2573	static struct dentry cgroup_lookup(struct inode dir, struct dentry dentry, struct nameidata nd)
2574	{
2575	if (dentry->d_name.len > NAME_MAX)
2576	return ERR_PTR(-ENAMETOOLONG);
2577	d_add(dentry, NULL);
2578	return NULL;
2579	}
2580
2581	/*
2582	* Check if a file is a control file
2583	*/
2584	static inline struct cftype __file_cft(struct file file)
2585	{
2586	if (file->f_dentry->d_inode->i_fop != &cgroup_file_operations)
2587	return ERR_PTR(-EINVAL);
2588	return __d_cft(file->f_dentry);
2589	}
2590
2591	static int cgroup_create_file(struct dentry *dentry, umode_t mode,
2592	struct super_block *sb)
2593	{
2594	struct inode *inode;
2595
2596	if (!dentry)
2597	return -ENOENT;
2598	if (dentry->d_inode)
2599	return -EEXIST;
2600
2601	inode = cgroup_new_inode(mode, sb);
2602	if (!inode)
2603	return -ENOMEM;
2604
2605	if (S_ISDIR(mode)) {
2606	inode->i_op = &cgroup_dir_inode_operations;
2607	inode->i_fop = &simple_dir_operations;
2608
2609	/* start off with i_nlink == 2 (for "." entry) */
2610	inc_nlink(inode);
2611
2612	/* start with the directory inode held, so that we can
2613	* populate it without racing with another mkdir */
2614	mutex_lock_nested(&inode->i_mutex, I_MUTEX_CHILD);
2615	} else if (S_ISREG(mode)) {
2616	inode->i_size = 0;
2617	inode->i_fop = &cgroup_file_operations;
2618	}
2619	d_instantiate(dentry, inode);
2620	dget(dentry); /* Extra count - pin the dentry in core */
2621	return 0;
2622	}
2623
2624	/*
2625	* cgroup_create_dir - create a directory for an object.
2626	* @cgrp: the cgroup we create the directory for. It must have a valid
2627	* ->parent field. And we are going to fill its ->dentry field.
2628	* @dentry: dentry of the new cgroup
2629	* @mode: mode to set on new directory.
2630	*/
2631	static int cgroup_create_dir(struct cgroup cgrp, struct dentry dentry,
2632	umode_t mode)
2633	{
2634	struct dentry *parent;
2635	int error = 0;
2636
2637	parent = cgrp->parent->dentry;
2638	error = cgroup_create_file(dentry, S_IFDIR \| mode, cgrp->root->sb);
2639	if (!error) {
2640	dentry->d_fsdata = cgrp;
2641	inc_nlink(parent->d_inode);
2642	rcu_assign_pointer(cgrp->dentry, dentry);
2643	dget(dentry);
2644	}
2645	dput(dentry);
2646
2647	return error;
2648	}
2649
2650	/**
2651	* cgroup_file_mode - deduce file mode of a control file
2652	* @cft: the control file in question
2653	*
2654	* returns cft->mode if ->mode is not 0
2655	* returns S_IRUGO\|S_IWUSR if it has both a read and a write handler
2656	* returns S_IRUGO if it has only a read handler
2657	* returns S_IWUSR if it has only a write hander
2658	*/
2659	static umode_t cgroup_file_mode(const struct cftype *cft)
2660	{
2661	umode_t mode = 0;
2662
2663	if (cft->mode)
2664	return cft->mode;
2665
2666	if (cft->read \|\| cft->read_u64 \|\| cft->read_s64 \|\|
2667	cft->read_map \|\| cft->read_seq_string)
2668	mode \|= S_IRUGO;
2669
2670	if (cft->write \|\| cft->write_u64 \|\| cft->write_s64 \|\|
2671	cft->write_string \|\| cft->trigger)
2672	mode \|= S_IWUSR;
2673
2674	return mode;
2675	}
2676
2677	static int cgroup_add_file(struct cgroup cgrp, struct cgroup_subsys subsys,
2678	const struct cftype *cft)
2679	{
2680	struct dentry *dir = cgrp->dentry;
2681	struct cgroup *parent = __d_cgrp(dir);
2682	struct dentry *dentry;
2683	struct cfent *cfe;
2684	int error;
2685	umode_t mode;
2686	char name[MAX_CGROUP_TYPE_NAMELEN + MAX_CFTYPE_NAME + 2] = { 0 };
2687
2688	/* does @cft->flags tell us to skip creation on @cgrp? */
2689	if ((cft->flags & CFTYPE_NOT_ON_ROOT) && !cgrp->parent)
2690	return 0;
2691	if ((cft->flags & CFTYPE_ONLY_ON_ROOT) && cgrp->parent)
2692	return 0;
2693
2694	if (subsys && !test_bit(ROOT_NOPREFIX, &cgrp->root->flags)) {
2695	strcpy(name, subsys->name);
2696	strcat(name, ".");
2697	}
2698	strcat(name, cft->name);
2699
2700	BUG_ON(!mutex_is_locked(&dir->d_inode->i_mutex));
2701
2702	cfe = kzalloc(sizeof(*cfe), GFP_KERNEL);
2703	if (!cfe)
2704	return -ENOMEM;
2705
2706	dentry = lookup_one_len(name, dir, strlen(name));
2707	if (IS_ERR(dentry)) {
2708	error = PTR_ERR(dentry);
2709	goto out;
2710	}
2711
2712	mode = cgroup_file_mode(cft);
2713	error = cgroup_create_file(dentry, mode \| S_IFREG, cgrp->root->sb);
2714	if (!error) {
2715	cfe->type = (void *)cft;
2716	cfe->dentry = dentry;
2717	dentry->d_fsdata = cfe;
2718	list_add_tail(&cfe->node, &parent->files);
2719	cfe = NULL;
2720	}
2721	dput(dentry);
2722	out:
2723	kfree(cfe);
2724	return error;
2725	}
2726
2727	static int cgroup_addrm_files(struct cgroup cgrp, struct cgroup_subsys subsys,
2728	const struct cftype cfts[], bool is_add)
2729	{
2730	const struct cftype *cft;
2731	int err, ret = 0;
2732
2733	for (cft = cfts; cft->name[0] != '\0'; cft++) {
2734	if (is_add)
2735	err = cgroup_add_file(cgrp, subsys, cft);
2736	else
2737	err = cgroup_rm_file(cgrp, cft);
2738	if (err) {
2739	pr_warning("cgroup_addrm_files: failed to %s %s, err=%d\n",
2740	is_add ? "add" : "remove", cft->name, err);
2741	ret = err;
2742	}
2743	}
2744	return ret;
2745	}
2746
2747	static DEFINE_MUTEX(cgroup_cft_mutex);
2748
2749	static void cgroup_cfts_prepare(void)
2750	__acquires(&cgroup_cft_mutex) __acquires(&cgroup_mutex)
2751	{
2752	/*
2753	* Thanks to the entanglement with vfs inode locking, we can't walk
2754	* the existing cgroups under cgroup_mutex and create files.
2755	* Instead, we increment reference on all cgroups and build list of
2756	* them using @cgrp->cft_q_node. Grab cgroup_cft_mutex to ensure
2757	* exclusive access to the field.
2758	*/
2759	mutex_lock(&cgroup_cft_mutex);
2760	mutex_lock(&cgroup_mutex);
2761	}
2762
2763	static void cgroup_cfts_commit(struct cgroup_subsys *ss,
2764	const struct cftype *cfts, bool is_add)
2765	__releases(&cgroup_mutex) __releases(&cgroup_cft_mutex)
2766	{
2767	LIST_HEAD(pending);
2768	struct cgroup cgrp, n;
2769
2770	/* %NULL @cfts indicates abort and don't bother if @ss isn't attached */
2771	if (cfts && ss->root != &rootnode) {
2772	list_for_each_entry(cgrp, &ss->root->allcg_list, allcg_node) {
2773	dget(cgrp->dentry);
2774	list_add_tail(&cgrp->cft_q_node, &pending);
2775	}
2776	}
2777
2778	mutex_unlock(&cgroup_mutex);
2779
2780	/*
2781	* All new cgroups will see @cfts update on @ss->cftsets. Add/rm
2782	* files for all cgroups which were created before.
2783	*/
2784	list_for_each_entry_safe(cgrp, n, &pending, cft_q_node) {
2785	struct inode *inode = cgrp->dentry->d_inode;
2786
2787	mutex_lock(&inode->i_mutex);
2788	mutex_lock(&cgroup_mutex);
2789	if (!cgroup_is_removed(cgrp))
2790	cgroup_addrm_files(cgrp, ss, cfts, is_add);
2791	mutex_unlock(&cgroup_mutex);
2792	mutex_unlock(&inode->i_mutex);
2793
2794	list_del_init(&cgrp->cft_q_node);
2795	dput(cgrp->dentry);
2796	}
2797
2798	mutex_unlock(&cgroup_cft_mutex);
2799	}
2800
2801	/**
2802	* cgroup_add_cftypes - add an array of cftypes to a subsystem
2803	* @ss: target cgroup subsystem
2804	* @cfts: zero-length name terminated array of cftypes
2805	*
2806	* Register @cfts to @ss. Files described by @cfts are created for all
2807	* existing cgroups to which @ss is attached and all future cgroups will
2808	* have them too. This function can be called anytime whether @ss is
2809	* attached or not.
2810	*
2811	* Returns 0 on successful registration, -errno on failure. Note that this
2812	* function currently returns 0 as long as @cfts registration is successful
2813	* even if some file creation attempts on existing cgroups fail.
2814	*/
2815	int cgroup_add_cftypes(struct cgroup_subsys ss, const struct cftype cfts)
2816	{
2817	struct cftype_set *set;
2818
2819	set = kzalloc(sizeof(*set), GFP_KERNEL);
2820	if (!set)
2821	return -ENOMEM;
2822
2823	cgroup_cfts_prepare();
2824	set->cfts = cfts;
2825	list_add_tail(&set->node, &ss->cftsets);
2826	cgroup_cfts_commit(ss, cfts, true);
2827
2828	return 0;
2829	}
2830	EXPORT_SYMBOL_GPL(cgroup_add_cftypes);
2831
2832	/**
2833	* cgroup_rm_cftypes - remove an array of cftypes from a subsystem
2834	* @ss: target cgroup subsystem
2835	* @cfts: zero-length name terminated array of cftypes
2836	*
2837	* Unregister @cfts from @ss. Files described by @cfts are removed from
2838	* all existing cgroups to which @ss is attached and all future cgroups
2839	* won't have them either. This function can be called anytime whether @ss
2840	* is attached or not.
2841	*
2842	* Returns 0 on successful unregistration, -ENOENT if @cfts is not
2843	* registered with @ss.
2844	*/
2845	int cgroup_rm_cftypes(struct cgroup_subsys ss, const struct cftype cfts)
2846	{
2847	struct cftype_set *set;
2848
2849	cgroup_cfts_prepare();
2850
2851	list_for_each_entry(set, &ss->cftsets, node) {
2852	if (set->cfts == cfts) {
2853	list_del_init(&set->node);
2854	cgroup_cfts_commit(ss, cfts, false);
2855	return 0;
2856	}
2857	}
2858
2859	cgroup_cfts_commit(ss, NULL, false);
2860	return -ENOENT;
2861	}
2862
2863	/**
2864	* cgroup_task_count - count the number of tasks in a cgroup.
2865	* @cgrp: the cgroup in question
2866	*
2867	* Return the number of tasks in the cgroup.
2868	*/
2869	int cgroup_task_count(const struct cgroup *cgrp)
2870	{
2871	int count = 0;
2872	struct cg_cgroup_link *link;
2873
2874	read_lock(&css_set_lock);
2875	list_for_each_entry(link, &cgrp->css_sets, cgrp_link_list) {
2876	count += atomic_read(&link->cg->refcount);
2877	}
2878	read_unlock(&css_set_lock);
2879	return count;
2880	}
2881
2882	/*
2883	* Advance a list_head iterator. The iterator should be positioned at
2884	* the start of a css_set
2885	*/
2886	static void cgroup_advance_iter(struct cgroup *cgrp,
2887	struct cgroup_iter *it)
2888	{
2889	struct list_head *l = it->cg_link;
2890	struct cg_cgroup_link *link;
2891	struct css_set *cg;
2892
2893	/* Advance to the next non-empty css_set */
2894	do {
2895	l = l->next;
2896	if (l == &cgrp->css_sets) {
2897	it->cg_link = NULL;
2898	return;
2899	}
2900	link = list_entry(l, struct cg_cgroup_link, cgrp_link_list);
2901	cg = link->cg;
2902	} while (list_empty(&cg->tasks));
2903	it->cg_link = l;
2904	it->task = cg->tasks.next;
2905	}
2906
2907	/*
2908	* To reduce the fork() overhead for systems that are not actually
2909	* using their cgroups capability, we don't maintain the lists running
2910	* through each css_set to its tasks until we see the list actually
2911	* used - in other words after the first call to cgroup_iter_start().
2912	*/
2913	static void cgroup_enable_task_cg_lists(void)
2914	{
2915	struct task_struct p, g;
2916	write_lock(&css_set_lock);
2917	use_task_css_set_links = 1;
2918	/*
2919	* We need tasklist_lock because RCU is not safe against
2920	* while_each_thread(). Besides, a forking task that has passed
2921	* cgroup_post_fork() without seeing use_task_css_set_links = 1
2922	* is not guaranteed to have its child immediately visible in the
2923	* tasklist if we walk through it with RCU.
2924	*/
2925	read_lock(&tasklist_lock);
2926	do_each_thread(g, p) {
2927	task_lock(p);
2928	/*
2929	* We should check if the process is exiting, otherwise
2930	* it will race with cgroup_exit() in that the list
2931	* entry won't be deleted though the process has exited.
2932	*/
2933	if (!(p->flags & PF_EXITING) && list_empty(&p->cg_list))
2934	list_add(&p->cg_list, &p->cgroups->tasks);
2935	task_unlock(p);
2936	} while_each_thread(g, p);
2937	read_unlock(&tasklist_lock);
2938	write_unlock(&css_set_lock);
2939	}
2940
2941	void cgroup_iter_start(struct cgroup cgrp, struct cgroup_iter it)
2942	__acquires(css_set_lock)
2943	{
2944	/*
2945	* The first time anyone tries to iterate across a cgroup,
2946	* we need to enable the list linking each css_set to its
2947	* tasks, and fix up all existing tasks.
2948	*/
2949	if (!use_task_css_set_links)
2950	cgroup_enable_task_cg_lists();
2951
2952	read_lock(&css_set_lock);
2953	it->cg_link = &cgrp->css_sets;
2954	cgroup_advance_iter(cgrp, it);
2955	}
2956
2957	struct task_struct cgroup_iter_next(struct cgroup cgrp,
2958	struct cgroup_iter *it)
2959	{
2960	struct task_struct *res;
2961	struct list_head *l = it->task;
2962	struct cg_cgroup_link *link;
2963
2964	/* If the iterator cg is NULL, we have no tasks */
2965	if (!it->cg_link)
2966	return NULL;
2967	res = list_entry(l, struct task_struct, cg_list);
2968	/* Advance iterator to find next entry */
2969	l = l->next;
2970	link = list_entry(it->cg_link, struct cg_cgroup_link, cgrp_link_list);
2971	if (l == &link->cg->tasks) {
2972	/* We reached the end of this task list - move on to
2973	* the next cg_cgroup_link */
2974	cgroup_advance_iter(cgrp, it);
2975	} else {
2976	it->task = l;
2977	}
2978	return res;
2979	}
2980
2981	void cgroup_iter_end(struct cgroup cgrp, struct cgroup_iter it)
2982	__releases(css_set_lock)
2983	{
2984	read_unlock(&css_set_lock);
2985	}
2986
2987	static inline int started_after_time(struct task_struct *t1,
2988	struct timespec *time,
2989	struct task_struct *t2)
2990	{
2991	int start_diff = timespec_compare(&t1->start_time, time);
2992	if (start_diff > 0) {
2993	return 1;
2994	} else if (start_diff < 0) {
2995	return 0;
2996	} else {
2997	/*
2998	* Arbitrarily, if two processes started at the same
2999	* time, we'll say that the lower pointer value
3000	* started first. Note that t2 may have exited by now
3001	* so this may not be a valid pointer any longer, but
3002	* that's fine - it still serves to distinguish
3003	* between two tasks started (effectively) simultaneously.
3004	*/
3005	return t1 > t2;
3006	}
3007	}
3008
3009	/*
3010	* This function is a callback from heap_insert() and is used to order
3011	* the heap.
3012	* In this case we order the heap in descending task start time.
3013	*/
3014	static inline int started_after(void p1, void p2)
3015	{
3016	struct task_struct *t1 = p1;
3017	struct task_struct *t2 = p2;
3018	return started_after_time(t1, &t2->start_time, t2);
3019	}
3020
3021	/**
3022	* cgroup_scan_tasks - iterate though all the tasks in a cgroup
3023	* @scan: struct cgroup_scanner containing arguments for the scan
3024	*
3025	* Arguments include pointers to callback functions test_task() and
3026	* process_task().
3027	* Iterate through all the tasks in a cgroup, calling test_task() for each,
3028	* and if it returns true, call process_task() for it also.
3029	* The test_task pointer may be NULL, meaning always true (select all tasks).
3030	* Effectively duplicates cgroup_iter_{start,next,end}()
3031	* but does not lock css_set_lock for the call to process_task().
3032	* The struct cgroup_scanner may be embedded in any structure of the caller's
3033	* creation.
3034	* It is guaranteed that process_task() will act on every task that
3035	* is a member of the cgroup for the duration of this call. This
3036	* function may or may not call process_task() for tasks that exit
3037	* or move to a different cgroup during the call, or are forked or
3038	* move into the cgroup during the call.
3039	*
3040	* Note that test_task() may be called with locks held, and may in some
3041	* situations be called multiple times for the same task, so it should
3042	* be cheap.
3043	* If the heap pointer in the struct cgroup_scanner is non-NULL, a heap has been
3044	* pre-allocated and will be used for heap operations (and its "gt" member will
3045	* be overwritten), else a temporary heap will be used (allocation of which
3046	* may cause this function to fail).
3047	*/
3048	int cgroup_scan_tasks(struct cgroup_scanner *scan)
3049	{
3050	int retval, i;
3051	struct cgroup_iter it;
3052	struct task_struct p, dropped;
3053	/* Never dereference latest_task, since it's not refcounted */
3054	struct task_struct *latest_task = NULL;
3055	struct ptr_heap tmp_heap;
3056	struct ptr_heap *heap;
3057	struct timespec latest_time = { 0, 0 };
3058
3059	if (scan->heap) {
3060	/* The caller supplied our heap and pre-allocated its memory */
3061	heap = scan->heap;
3062	heap->gt = &started_after;
3063	} else {
3064	/* We need to allocate our own heap memory */
3065	heap = &tmp_heap;
3066	retval = heap_init(heap, PAGE_SIZE, GFP_KERNEL, &started_after);
3067	if (retval)
3068	/* cannot allocate the heap */
3069	return retval;
3070	}
3071
3072	again:
3073	/*
3074	* Scan tasks in the cgroup, using the scanner's "test_task" callback
3075	* to determine which are of interest, and using the scanner's
3076	* "process_task" callback to process any of them that need an update.
3077	* Since we don't want to hold any locks during the task updates,
3078	* gather tasks to be processed in a heap structure.
3079	* The heap is sorted by descending task start time.
3080	* If the statically-sized heap fills up, we overflow tasks that
3081	* started later, and in future iterations only consider tasks that
3082	* started after the latest task in the previous pass. This
3083	* guarantees forward progress and that we don't miss any tasks.
3084	*/
3085	heap->size = 0;
3086	cgroup_iter_start(scan->cg, &it);
3087	while ((p = cgroup_iter_next(scan->cg, &it))) {
3088	/*
3089	* Only affect tasks that qualify per the caller's callback,
3090	* if he provided one
3091	*/
3092	if (scan->test_task && !scan->test_task(p, scan))
3093	continue;
3094	/*
3095	* Only process tasks that started after the last task
3096	* we processed
3097	*/
3098	if (!started_after_time(p, &latest_time, latest_task))
3099	continue;
3100	dropped = heap_insert(heap, p);
3101	if (dropped == NULL) {
3102	/*
3103	* The new task was inserted; the heap wasn't
3104	* previously full
3105	*/
3106	get_task_struct(p);
3107	} else if (dropped != p) {
3108	/*
3109	* The new task was inserted, and pushed out a
3110	* different task
3111	*/
3112	get_task_struct(p);
3113	put_task_struct(dropped);
3114	}
3115	/*
3116	* Else the new task was newer than anything already in
3117	* the heap and wasn't inserted
3118	*/
3119	}
3120	cgroup_iter_end(scan->cg, &it);
3121
3122	if (heap->size) {
3123	for (i = 0; i < heap->size; i++) {
3124	struct task_struct *q = heap->ptrs[i];
3125	if (i == 0) {
3126	latest_time = q->start_time;
3127	latest_task = q;
3128	}
3129	/* Process the task per the caller's callback */
3130	scan->process_task(q, scan);
3131	put_task_struct(q);
3132	}
3133	/*
3134	* If we had to process any tasks at all, scan again
3135	* in case some of them were in the middle of forking
3136	* children that didn't get processed.
3137	* Not the most efficient way to do it, but it avoids
3138	* having to take callback_mutex in the fork path
3139	*/
3140	goto again;
3141	}
3142	if (heap == &tmp_heap)
3143	heap_free(&tmp_heap);
3144	return 0;
3145	}
3146
3147	/*
3148	* Stuff for reading the 'tasks'/'procs' files.
3149	*
3150	* Reading this file can return large amounts of data if a cgroup has
3151	* lots of attached tasks. So it may need several calls to read(),
3152	* but we cannot guarantee that the information we produce is correct
3153	* unless we produce it entirely atomically.
3154	*
3155	*/
3156
3157	/* which pidlist file are we talking about? */
3158	enum cgroup_filetype {
3159	CGROUP_FILE_PROCS,
3160	CGROUP_FILE_TASKS,
3161	};
3162
3163	/*
3164	* A pidlist is a list of pids that virtually represents the contents of one
3165	* of the cgroup files ("procs" or "tasks"). We keep a list of such pidlists,
3166	* a pair (one each for procs, tasks) for each pid namespace that's relevant
3167	* to the cgroup.
3168	*/
3169	struct cgroup_pidlist {
3170	/*
3171	* used to find which pidlist is wanted. doesn't change as long as
3172	* this particular list stays in the list.
3173	*/
3174	struct { enum cgroup_filetype type; struct pid_namespace *ns; } key;
3175	/* array of xids */
3176	pid_t *list;
3177	/* how many elements the above list has */
3178	int length;
3179	/* how many files are using the current array */
3180	int use_count;
3181	/* each of these stored in a list by its cgroup */
3182	struct list_head links;
3183	/* pointer to the cgroup we belong to, for list removal purposes */
3184	struct cgroup *owner;
3185	/* protects the other fields */
3186	struct rw_semaphore mutex;
3187	};
3188
3189	/*
3190	* The following two functions "fix" the issue where there are more pids
3191	* than kmalloc will give memory for; in such cases, we use vmalloc/vfree.
3192	* TODO: replace with a kernel-wide solution to this problem
3193	*/
3194	#define PIDLIST_TOO_LARGE(c) ((c) * sizeof(pid_t) > (PAGE_SIZE * 2))
3195	static void *pidlist_allocate(int count)
3196	{
3197	if (PIDLIST_TOO_LARGE(count))
3198	return vmalloc(count * sizeof(pid_t));
3199	else
3200	return kmalloc(count * sizeof(pid_t), GFP_KERNEL);
3201	}
3202	static void pidlist_free(void *p)
3203	{
3204	if (is_vmalloc_addr(p))
3205	vfree(p);
3206	else
3207	kfree(p);
3208	}
3209	static void pidlist_resize(void p, int newcount)
3210	{
3211	void *newlist;
3212	/* note: if new alloc fails, old p will still be valid either way */
3213	if (is_vmalloc_addr(p)) {
3214	newlist = vmalloc(newcount * sizeof(pid_t));
3215	if (!newlist)
3216	return NULL;
3217	memcpy(newlist, p, newcount * sizeof(pid_t));
3218	vfree(p);
3219	} else {
3220	newlist = krealloc(p, newcount * sizeof(pid_t), GFP_KERNEL);
3221	}
3222	return newlist;
3223	}
3224
3225	/*
3226	* pidlist_uniq - given a kmalloc()ed list, strip out all duplicate entries
3227	* If the new stripped list is sufficiently smaller and there's enough memory
3228	* to allocate a new buffer, will let go of the unneeded memory. Returns the
3229	* number of unique elements.
3230	*/
3231	/* is the size difference enough that we should re-allocate the array? */
3232	#define PIDLIST_REALLOC_DIFFERENCE(old, new) ((old) - PAGE_SIZE >= (new))
3233	static int pidlist_uniq(pid_t **p, int length)
3234	{
3235	int src, dest = 1;
3236	pid_t list = p;
3237	pid_t *newlist;
3238
3239	/*
3240	* we presume the 0th element is unique, so i starts at 1. trivial
3241	* edge cases first; no work needs to be done for either
3242	*/
3243	if (length == 0 \|\| length == 1)
3244	return length;
3245	/* src and dest walk down the list; dest counts unique elements */
3246	for (src = 1; src < length; src++) {
3247	/* find next unique element */
3248	while (list[src] == list[src-1]) {
3249	src++;
3250	if (src == length)
3251	goto after;
3252	}
3253	/* dest always points to where the next unique element goes */
3254	list[dest] = list[src];
3255	dest++;
3256	}
3257	after:
3258	/*
3259	* if the length difference is large enough, we want to allocate a
3260	* smaller buffer to save memory. if this fails due to out of memory,
3261	* we'll just stay with what we've got.
3262	*/
3263	if (PIDLIST_REALLOC_DIFFERENCE(length, dest)) {
3264	newlist = pidlist_resize(list, dest);
3265	if (newlist)
3266	*p = newlist;
3267	}
3268	return dest;
3269	}
3270
3271	static int cmppid(const void a, const void b)
3272	{
3273	return (pid_t )a - (pid_t )b;
3274	}
3275
3276	/*
3277	* find the appropriate pidlist for our purpose (given procs vs tasks)
3278	* returns with the lock on that pidlist already held, and takes care
3279	* of the use count, or returns NULL with no locks held if we're out of
3280	* memory.
3281	*/
3282	static struct cgroup_pidlist cgroup_pidlist_find(struct cgroup cgrp,
3283	enum cgroup_filetype type)
3284	{
3285	struct cgroup_pidlist *l;
3286	/* don't need task_nsproxy() if we're looking at ourself */
3287	struct pid_namespace *ns = current->nsproxy->pid_ns;
3288
3289	/*
3290	* We can't drop the pidlist_mutex before taking the l->mutex in case
3291	* the last ref-holder is trying to remove l from the list at the same
3292	* time. Holding the pidlist_mutex precludes somebody taking whichever
3293	* list we find out from under us - compare release_pid_array().
3294	*/
3295	mutex_lock(&cgrp->pidlist_mutex);
3296	list_for_each_entry(l, &cgrp->pidlists, links) {
3297	if (l->key.type == type && l->key.ns == ns) {
3298	/* make sure l doesn't vanish out from under us */
3299	down_write(&l->mutex);
3300	mutex_unlock(&cgrp->pidlist_mutex);
3301	return l;
3302	}
3303	}
3304	/* entry not found; create a new one */
3305	l = kmalloc(sizeof(struct cgroup_pidlist), GFP_KERNEL);
3306	if (!l) {
3307	mutex_unlock(&cgrp->pidlist_mutex);
3308	return l;
3309	}
3310	init_rwsem(&l->mutex);
3311	down_write(&l->mutex);
3312	l->key.type = type;
3313	l->key.ns = get_pid_ns(ns);
3314	l->use_count = 0; /* don't increment here */
3315	l->list = NULL;
3316	l->owner = cgrp;
3317	list_add(&l->links, &cgrp->pidlists);
3318	mutex_unlock(&cgrp->pidlist_mutex);
3319	return l;
3320	}
3321
3322	/*
3323	* Load a cgroup's pidarray with either procs' tgids or tasks' pids
3324	*/
3325	static int pidlist_array_load(struct cgroup *cgrp, enum cgroup_filetype type,
3326	struct cgroup_pidlist **lp)
3327	{
3328	pid_t *array;
3329	int length;
3330	int pid, n = 0; /* used for populating the array */
3331	struct cgroup_iter it;
3332	struct task_struct *tsk;
3333	struct cgroup_pidlist *l;
3334
3335	/*
3336	* If cgroup gets more users after we read count, we won't have
3337	* enough space - tough. This race is indistinguishable to the
3338	* caller from the case that the additional cgroup users didn't
3339	* show up until sometime later on.
3340	*/
3341	length = cgroup_task_count(cgrp);
3342	array = pidlist_allocate(length);
3343	if (!array)
3344	return -ENOMEM;
3345	/* now, populate the array */
3346	cgroup_iter_start(cgrp, &it);
3347	while ((tsk = cgroup_iter_next(cgrp, &it))) {
3348	if (unlikely(n == length))
3349	break;
3350	/* get tgid or pid for procs or tasks file respectively */
3351	if (type == CGROUP_FILE_PROCS)
3352	pid = task_tgid_vnr(tsk);
3353	else
3354	pid = task_pid_vnr(tsk);
3355	if (pid > 0) /* make sure to only use valid results */
3356	array[n++] = pid;
3357	}
3358	cgroup_iter_end(cgrp, &it);
3359	length = n;
3360	/* now sort & (if procs) strip out duplicates */
3361	sort(array, length, sizeof(pid_t), cmppid, NULL);
3362	if (type == CGROUP_FILE_PROCS)
3363	length = pidlist_uniq(&array, length);
3364	l = cgroup_pidlist_find(cgrp, type);
3365	if (!l) {
3366	pidlist_free(array);
3367	return -ENOMEM;
3368	}
3369	/* store array, freeing old if necessary - lock already held */
3370	pidlist_free(l->list);
3371	l->list = array;
3372	l->length = length;
3373	l->use_count++;
3374	up_write(&l->mutex);
3375	*lp = l;
3376	return 0;
3377	}
3378
3379	/**
3380	* cgroupstats_build - build and fill cgroupstats
3381	* @stats: cgroupstats to fill information into
3382	* @dentry: A dentry entry belonging to the cgroup for which stats have
3383	* been requested.
3384	*
3385	* Build and fill cgroupstats so that taskstats can export it to user
3386	* space.
3387	*/
3388	int cgroupstats_build(struct cgroupstats stats, struct dentry dentry)
3389	{
3390	int ret = -EINVAL;
3391	struct cgroup *cgrp;
3392	struct cgroup_iter it;
3393	struct task_struct *tsk;
3394
3395	/*
3396	* Validate dentry by checking the superblock operations,
3397	* and make sure it's a directory.
3398	*/
3399	if (dentry->d_sb->s_op != &cgroup_ops \|\|
3400	!S_ISDIR(dentry->d_inode->i_mode))
3401	goto err;
3402
3403	ret = 0;
3404	cgrp = dentry->d_fsdata;
3405
3406	cgroup_iter_start(cgrp, &it);
3407	while ((tsk = cgroup_iter_next(cgrp, &it))) {
3408	switch (tsk->state) {
3409	case TASK_RUNNING:
3410	stats->nr_running++;
3411	break;
3412	case TASK_INTERRUPTIBLE:
3413	stats->nr_sleeping++;
3414	break;
3415	case TASK_UNINTERRUPTIBLE:
3416	stats->nr_uninterruptible++;
3417	break;
3418	case TASK_STOPPED:
3419	stats->nr_stopped++;
3420	break;
3421	default:
3422	if (delayacct_is_task_waiting_on_io(tsk))
3423	stats->nr_io_wait++;
3424	break;
3425	}
3426	}
3427	cgroup_iter_end(cgrp, &it);
3428
3429	err:
3430	return ret;
3431	}
3432
3433
3434	/*
3435	* seq_file methods for the tasks/procs files. The seq_file position is the
3436	* next pid to display; the seq_file iterator is a pointer to the pid
3437	* in the cgroup->l->list array.
3438	*/
3439
3440	static void cgroup_pidlist_start(struct seq_file s, loff_t *pos)
3441	{
3442	/*
3443	* Initially we receive a position value that corresponds to
3444	* one more than the last pid shown (or 0 on the first call or
3445	* after a seek to the start). Use a binary-search to find the
3446	* next pid to display, if any
3447	*/
3448	struct cgroup_pidlist *l = s->private;
3449	int index = 0, pid = *pos;
3450	int *iter;
3451
3452	down_read(&l->mutex);
3453	if (pid) {
3454	int end = l->length;
3455
3456	while (index < end) {
3457	int mid = (index + end) / 2;
3458	if (l->list[mid] == pid) {
3459	index = mid;
3460	break;
3461	} else if (l->list[mid] <= pid)
3462	index = mid + 1;
3463	else
3464	end = mid;
3465	}
3466	}
3467	/* If we're off the end of the array, we're done */
3468	if (index >= l->length)
3469	return NULL;
3470	/* Update the abstract position to be the actual pid that we found */
3471	iter = l->list + index;
3472	pos = iter;
3473	return iter;
3474	}
3475
3476	static void cgroup_pidlist_stop(struct seq_file s, void v)
3477	{
3478	struct cgroup_pidlist *l = s->private;
3479	up_read(&l->mutex);
3480	}
3481
3482	static void cgroup_pidlist_next(struct seq_file s, void v, loff_t pos)
3483	{
3484	struct cgroup_pidlist *l = s->private;
3485	pid_t *p = v;
3486	pid_t *end = l->list + l->length;
3487	/*
3488	* Advance to the next pid in the array. If this goes off the
3489	* end, we're done
3490	*/
3491	p++;
3492	if (p >= end) {
3493	return NULL;
3494	} else {
3495	pos = p;
3496	return p;
3497	}
3498	}
3499
3500	static int cgroup_pidlist_show(struct seq_file s, void v)
3501	{
3502	return seq_printf(s, "%d\n", (int )v);
3503	}
3504
3505	/*
3506	* seq_operations functions for iterating on pidlists through seq_file -
3507	* independent of whether it's tasks or procs
3508	*/
3509	static const struct seq_operations cgroup_pidlist_seq_operations = {
3510	.start = cgroup_pidlist_start,
3511	.stop = cgroup_pidlist_stop,
3512	.next = cgroup_pidlist_next,
3513	.show = cgroup_pidlist_show,
3514	};
3515
3516	static void cgroup_release_pid_array(struct cgroup_pidlist *l)
3517	{
3518	/*
3519	* the case where we're the last user of this particular pidlist will
3520	* have us remove it from the cgroup's list, which entails taking the
3521	* mutex. since in pidlist_find the pidlist->lock depends on cgroup->
3522	* pidlist_mutex, we have to take pidlist_mutex first.
3523	*/
3524	mutex_lock(&l->owner->pidlist_mutex);
3525	down_write(&l->mutex);
3526	BUG_ON(!l->use_count);
3527	if (!--l->use_count) {
3528	/* we're the last user if refcount is 0; remove and free */
3529	list_del(&l->links);
3530	mutex_unlock(&l->owner->pidlist_mutex);
3531	pidlist_free(l->list);
3532	put_pid_ns(l->key.ns);
3533	up_write(&l->mutex);
3534	kfree(l);
3535	return;
3536	}
3537	mutex_unlock(&l->owner->pidlist_mutex);
3538	up_write(&l->mutex);
3539	}
3540
3541	static int cgroup_pidlist_release(struct inode inode, struct file file)
3542	{
3543	struct cgroup_pidlist *l;
3544	if (!(file->f_mode & FMODE_READ))
3545	return 0;
3546	/*
3547	* the seq_file will only be initialized if the file was opened for
3548	* reading; hence we check if it's not null only in that case.
3549	*/
3550	l = ((struct seq_file *)file->private_data)->private;
3551	cgroup_release_pid_array(l);
3552	return seq_release(inode, file);
3553	}
3554
3555	static const struct file_operations cgroup_pidlist_operations = {
3556	.read = seq_read,
3557	.llseek = seq_lseek,
3558	.write = cgroup_file_write,
3559	.release = cgroup_pidlist_release,
3560	};
3561
3562	/*
3563	* The following functions handle opens on a file that displays a pidlist
3564	* (tasks or procs). Prepare an array of the process/thread IDs of whoever's
3565	* in the cgroup.
3566	*/
3567	/* helper function for the two below it */
3568	static int cgroup_pidlist_open(struct file *file, enum cgroup_filetype type)
3569	{
3570	struct cgroup *cgrp = __d_cgrp(file->f_dentry->d_parent);
3571	struct cgroup_pidlist *l;
3572	int retval;
3573
3574	/* Nothing to do for write-only files */
3575	if (!(file->f_mode & FMODE_READ))
3576	return 0;
3577
3578	/* have the array populated */
3579	retval = pidlist_array_load(cgrp, type, &l);
3580	if (retval)
3581	return retval;
3582	/* configure file information */
3583	file->f_op = &cgroup_pidlist_operations;
3584
3585	retval = seq_open(file, &cgroup_pidlist_seq_operations);
3586	if (retval) {
3587	cgroup_release_pid_array(l);
3588	return retval;
3589	}
3590	((struct seq_file *)file->private_data)->private = l;
3591	return 0;
3592	}
3593	static int cgroup_tasks_open(struct inode unused, struct file file)
3594	{
3595	return cgroup_pidlist_open(file, CGROUP_FILE_TASKS);
3596	}
3597	static int cgroup_procs_open(struct inode unused, struct file file)
3598	{
3599	return cgroup_pidlist_open(file, CGROUP_FILE_PROCS);
3600	}
3601
3602	static u64 cgroup_read_notify_on_release(struct cgroup *cgrp,
3603	struct cftype *cft)
3604	{
3605	return notify_on_release(cgrp);
3606	}
3607
3608	static int cgroup_write_notify_on_release(struct cgroup *cgrp,
3609	struct cftype *cft,
3610	u64 val)
3611	{
3612	clear_bit(CGRP_RELEASABLE, &cgrp->flags);
3613	if (val)
3614	set_bit(CGRP_NOTIFY_ON_RELEASE, &cgrp->flags);
3615	else
3616	clear_bit(CGRP_NOTIFY_ON_RELEASE, &cgrp->flags);
3617	return 0;
3618	}
3619
3620	/*
3621	* Unregister event and free resources.
3622	*
3623	* Gets called from workqueue.
3624	*/
3625	static void cgroup_event_remove(struct work_struct *work)
3626	{
3627	struct cgroup_event *event = container_of(work, struct cgroup_event,
3628	remove);
3629	struct cgroup *cgrp = event->cgrp;
3630
3631	event->cft->unregister_event(cgrp, event->cft, event->eventfd);
3632
3633	eventfd_ctx_put(event->eventfd);
3634	kfree(event);
3635	dput(cgrp->dentry);
3636	}
3637
3638	/*
3639	* Gets called on POLLHUP on eventfd when user closes it.
3640	*
3641	* Called with wqh->lock held and interrupts disabled.
3642	*/
3643	static int cgroup_event_wake(wait_queue_t *wait, unsigned mode,
3644	int sync, void *key)
3645	{
3646	struct cgroup_event *event = container_of(wait,
3647	struct cgroup_event, wait);
3648	struct cgroup *cgrp = event->cgrp;
3649	unsigned long flags = (unsigned long)key;
3650
3651	if (flags & POLLHUP) {
3652	__remove_wait_queue(event->wqh, &event->wait);
3653	spin_lock(&cgrp->event_list_lock);
3654	list_del(&event->list);
3655	spin_unlock(&cgrp->event_list_lock);
3656	/*
3657	* We are in atomic context, but cgroup_event_remove() may
3658	* sleep, so we have to call it in workqueue.
3659	*/
3660	schedule_work(&event->remove);
3661	}
3662
3663	return 0;
3664	}
3665
3666	static void cgroup_event_ptable_queue_proc(struct file *file,
3667	wait_queue_head_t wqh, poll_table pt)
3668	{
3669	struct cgroup_event *event = container_of(pt,
3670	struct cgroup_event, pt);
3671
3672	event->wqh = wqh;
3673	add_wait_queue(wqh, &event->wait);
3674	}
3675
3676	/*
3677	* Parse input and register new cgroup event handler.
3678	*
3679	* Input must be in format '<event_fd> <control_fd> <args>'.
3680	* Interpretation of args is defined by control file implementation.
3681	*/
3682	static int cgroup_write_event_control(struct cgroup cgrp, struct cftype cft,
3683	const char *buffer)
3684	{
3685	struct cgroup_event *event = NULL;
3686	unsigned int efd, cfd;
3687	struct file *efile = NULL;
3688	struct file *cfile = NULL;
3689	char *endp;
3690	int ret;
3691
3692	efd = simple_strtoul(buffer, &endp, 10);
3693	if (*endp != ' ')
3694	return -EINVAL;
3695	buffer = endp + 1;
3696
3697	cfd = simple_strtoul(buffer, &endp, 10);
3698	if ((endp != ' ') && (endp != '\0'))
3699	return -EINVAL;
3700	buffer = endp + 1;
3701
3702	event = kzalloc(sizeof(*event), GFP_KERNEL);
3703	if (!event)
3704	return -ENOMEM;
3705	event->cgrp = cgrp;
3706	INIT_LIST_HEAD(&event->list);
3707	init_poll_funcptr(&event->pt, cgroup_event_ptable_queue_proc);
3708	init_waitqueue_func_entry(&event->wait, cgroup_event_wake);
3709	INIT_WORK(&event->remove, cgroup_event_remove);
3710
3711	efile = eventfd_fget(efd);
3712	if (IS_ERR(efile)) {
3713	ret = PTR_ERR(efile);
3714	goto fail;
3715	}
3716
3717	event->eventfd = eventfd_ctx_fileget(efile);
3718	if (IS_ERR(event->eventfd)) {
3719	ret = PTR_ERR(event->eventfd);
3720	goto fail;
3721	}
3722
3723	cfile = fget(cfd);
3724	if (!cfile) {
3725	ret = -EBADF;
3726	goto fail;
3727	}
3728
3729	/* the process need read permission on control file */
3730	/* AV: shouldn't we check that it's been opened for read instead? */
3731	ret = inode_permission(cfile->f_path.dentry->d_inode, MAY_READ);
3732	if (ret < 0)
3733	goto fail;
3734
3735	event->cft = __file_cft(cfile);
3736	if (IS_ERR(event->cft)) {
3737	ret = PTR_ERR(event->cft);
3738	goto fail;
3739	}
3740
3741	if (!event->cft->register_event \|\| !event->cft->unregister_event) {
3742	ret = -EINVAL;
3743	goto fail;
3744	}
3745
3746	ret = event->cft->register_event(cgrp, event->cft,
3747	event->eventfd, buffer);
3748	if (ret)
3749	goto fail;
3750
3751	if (efile->f_op->poll(efile, &event->pt) & POLLHUP) {
3752	event->cft->unregister_event(cgrp, event->cft, event->eventfd);
3753	ret = 0;
3754	goto fail;
3755	}
3756
3757	/*
3758	* Events should be removed after rmdir of cgroup directory, but before
3759	* destroying subsystem state objects. Let's take reference to cgroup
3760	* directory dentry to do that.
3761	*/
3762	dget(cgrp->dentry);
3763
3764	spin_lock(&cgrp->event_list_lock);
3765	list_add(&event->list, &cgrp->event_list);
3766	spin_unlock(&cgrp->event_list_lock);
3767
3768	fput(cfile);
3769	fput(efile);
3770
3771	return 0;
3772
3773	fail:
3774	if (cfile)
3775	fput(cfile);
3776
3777	if (event && event->eventfd && !IS_ERR(event->eventfd))
3778	eventfd_ctx_put(event->eventfd);
3779
3780	if (!IS_ERR_OR_NULL(efile))
3781	fput(efile);
3782
3783	kfree(event);
3784
3785	return ret;
3786	}
3787
3788	static u64 cgroup_clone_children_read(struct cgroup *cgrp,
3789	struct cftype *cft)
3790	{
3791	return clone_children(cgrp);
3792	}
3793
3794	static int cgroup_clone_children_write(struct cgroup *cgrp,
3795	struct cftype *cft,
3796	u64 val)
3797	{
3798	if (val)
3799	set_bit(CGRP_CLONE_CHILDREN, &cgrp->flags);
3800	else
3801	clear_bit(CGRP_CLONE_CHILDREN, &cgrp->flags);
3802	return 0;
3803	}
3804
3805	/*
3806	* for the common functions, 'private' gives the type of file
3807	*/
3808	/* for hysterical raisins, we can't put this on the older files */
3809	#define CGROUP_FILE_GENERIC_PREFIX "cgroup."
3810	static struct cftype files[] = {
3811	{
3812	.name = "tasks",
3813	.open = cgroup_tasks_open,
3814	.write_u64 = cgroup_tasks_write,
3815	.release = cgroup_pidlist_release,
3816	.mode = S_IRUGO \| S_IWUSR,
3817	},
3818	{
3819	.name = CGROUP_FILE_GENERIC_PREFIX "procs",
3820	.open = cgroup_procs_open,
3821	.write_u64 = cgroup_procs_write,
3822	.release = cgroup_pidlist_release,
3823	.mode = S_IRUGO \| S_IWUSR,
3824	},
3825	{
3826	.name = "notify_on_release",
3827	.read_u64 = cgroup_read_notify_on_release,
3828	.write_u64 = cgroup_write_notify_on_release,
3829	},
3830	{
3831	.name = CGROUP_FILE_GENERIC_PREFIX "event_control",
3832	.write_string = cgroup_write_event_control,
3833	.mode = S_IWUGO,
3834	},
3835	{
3836	.name = "cgroup.clone_children",
3837	.read_u64 = cgroup_clone_children_read,
3838	.write_u64 = cgroup_clone_children_write,
3839	},
3840	{
3841	.name = "release_agent",
3842	.flags = CFTYPE_ONLY_ON_ROOT,
3843	.read_seq_string = cgroup_release_agent_show,
3844	.write_string = cgroup_release_agent_write,
3845	.max_write_len = PATH_MAX,
3846	},
3847	{ } /* terminate */
3848	};
3849
3850	static int cgroup_populate_dir(struct cgroup *cgrp)
3851	{
3852	int err;
3853	struct cgroup_subsys *ss;
3854
3855	err = cgroup_addrm_files(cgrp, NULL, files, true);
3856	if (err < 0)
3857	return err;
3858
3859	/* process cftsets of each subsystem */
3860	for_each_subsys(cgrp->root, ss) {
3861	struct cftype_set *set;
3862
3863	list_for_each_entry(set, &ss->cftsets, node)
3864	cgroup_addrm_files(cgrp, ss, set->cfts, true);
3865	}
3866
3867	/* This cgroup is ready now */
3868	for_each_subsys(cgrp->root, ss) {
3869	struct cgroup_subsys_state *css = cgrp->subsys[ss->subsys_id];
3870	/*
3871	* Update id->css pointer and make this css visible from
3872	* CSS ID functions. This pointer will be dereferened
3873	* from RCU-read-side without locks.
3874	*/
3875	if (css->id)
3876	rcu_assign_pointer(css->id->css, css);
3877	}
3878
3879	return 0;
3880	}
3881
3882	static void css_dput_fn(struct work_struct *work)
3883	{
3884	struct cgroup_subsys_state *css =
3885	container_of(work, struct cgroup_subsys_state, dput_work);
3886	struct dentry *dentry = css->cgroup->dentry;
3887	struct super_block *sb = dentry->d_sb;
3888
3889	atomic_inc(&sb->s_active);
3890	dput(dentry);
3891	deactivate_super(sb);
3892	}
3893
3894	static void init_cgroup_css(struct cgroup_subsys_state *css,
3895	struct cgroup_subsys *ss,
3896	struct cgroup *cgrp)
3897	{
3898	css->cgroup = cgrp;
3899	atomic_set(&css->refcnt, 1);
3900	css->flags = 0;
3901	css->id = NULL;
3902	if (cgrp == dummytop)
3903	set_bit(CSS_ROOT, &css->flags);
3904	BUG_ON(cgrp->subsys[ss->subsys_id]);
3905	cgrp->subsys[ss->subsys_id] = css;
3906
3907	/*
3908	* If !clear_css_refs, css holds an extra ref to @cgrp->dentry
3909	* which is put on the last css_put(). dput() requires process
3910	* context, which css_put() may be called without. @css->dput_work
3911	* will be used to invoke dput() asynchronously from css_put().
3912	*/
3913	INIT_WORK(&css->dput_work, css_dput_fn);
3914	if (ss->__DEPRECATED_clear_css_refs)
3915	set_bit(CSS_CLEAR_CSS_REFS, &css->flags);
3916	}
3917
3918	static void cgroup_lock_hierarchy(struct cgroupfs_root *root)
3919	{
3920	/* We need to take each hierarchy_mutex in a consistent order */
3921	int i;
3922
3923	/*
3924	* No worry about a race with rebind_subsystems that might mess up the
3925	* locking order, since both parties are under cgroup_mutex.
3926	*/
3927	for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
3928	struct cgroup_subsys *ss = subsys[i];
3929	if (ss == NULL)
3930	continue;
3931	if (ss->root == root)
3932	mutex_lock(&ss->hierarchy_mutex);
3933	}
3934	}
3935
3936	static void cgroup_unlock_hierarchy(struct cgroupfs_root *root)
3937	{
3938	int i;
3939
3940	for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
3941	struct cgroup_subsys *ss = subsys[i];
3942	if (ss == NULL)
3943	continue;
3944	if (ss->root == root)
3945	mutex_unlock(&ss->hierarchy_mutex);
3946	}
3947	}
3948
3949	/*
3950	* cgroup_create - create a cgroup
3951	* @parent: cgroup that will be parent of the new cgroup
3952	* @dentry: dentry of the new cgroup
3953	* @mode: mode to set on new inode
3954	*
3955	* Must be called with the mutex on the parent inode held
3956	*/
3957	static long cgroup_create(struct cgroup parent, struct dentry dentry,
3958	umode_t mode)
3959	{
3960	struct cgroup *cgrp;
3961	struct cgroupfs_root *root = parent->root;
3962	int err = 0;
3963	struct cgroup_subsys *ss;
3964	struct super_block *sb = root->sb;
3965
3966	cgrp = kzalloc(sizeof(*cgrp), GFP_KERNEL);
3967	if (!cgrp)
3968	return -ENOMEM;
3969
3970	/* Grab a reference on the superblock so the hierarchy doesn't
3971	* get deleted on unmount if there are child cgroups. This
3972	* can be done outside cgroup_mutex, since the sb can't
3973	* disappear while someone has an open control file on the
3974	* fs */
3975	atomic_inc(&sb->s_active);
3976
3977	mutex_lock(&cgroup_mutex);
3978
3979	init_cgroup_housekeeping(cgrp);
3980
3981	cgrp->parent = parent;
3982	cgrp->root = parent->root;
3983	cgrp->top_cgroup = parent->top_cgroup;
3984
3985	if (notify_on_release(parent))
3986	set_bit(CGRP_NOTIFY_ON_RELEASE, &cgrp->flags);
3987
3988	if (clone_children(parent))
3989	set_bit(CGRP_CLONE_CHILDREN, &cgrp->flags);
3990
3991	for_each_subsys(root, ss) {
3992	struct cgroup_subsys_state *css = ss->create(cgrp);
3993
3994	if (IS_ERR(css)) {
3995	err = PTR_ERR(css);
3996	goto err_destroy;
3997	}
3998	init_cgroup_css(css, ss, cgrp);
3999	if (ss->use_id) {
4000	err = alloc_css_id(ss, parent, cgrp);
4001	if (err)
4002	goto err_destroy;
4003	}
4004	/* At error, ->destroy() callback has to free assigned ID. */
4005	if (clone_children(parent) && ss->post_clone)
4006	ss->post_clone(cgrp);
4007	}
4008
4009	cgroup_lock_hierarchy(root);
4010	list_add(&cgrp->sibling, &cgrp->parent->children);
4011	cgroup_unlock_hierarchy(root);
4012	root->number_of_cgroups++;
4013
4014	err = cgroup_create_dir(cgrp, dentry, mode);
4015	if (err < 0)
4016	goto err_remove;
4017
4018	/* If !clear_css_refs, each css holds a ref to the cgroup's dentry */
4019	for_each_subsys(root, ss)
4020	if (!ss->__DEPRECATED_clear_css_refs)
4021	dget(dentry);
4022
4023	/* The cgroup directory was pre-locked for us */
4024	BUG_ON(!mutex_is_locked(&cgrp->dentry->d_inode->i_mutex));
4025
4026	list_add_tail(&cgrp->allcg_node, &root->allcg_list);
4027
4028	err = cgroup_populate_dir(cgrp);
4029	/* If err < 0, we have a half-filled directory - oh well ;) */
4030
4031	mutex_unlock(&cgroup_mutex);
4032	mutex_unlock(&cgrp->dentry->d_inode->i_mutex);
4033
4034	return 0;
4035
4036	err_remove:
4037
4038	cgroup_lock_hierarchy(root);
4039	list_del(&cgrp->sibling);
4040	cgroup_unlock_hierarchy(root);
4041	root->number_of_cgroups--;
4042
4043	err_destroy:
4044
4045	for_each_subsys(root, ss) {
4046	if (cgrp->subsys[ss->subsys_id])
4047	ss->destroy(cgrp);
4048	}
4049
4050	mutex_unlock(&cgroup_mutex);
4051
4052	/* Release the reference count that we took on the superblock */
4053	deactivate_super(sb);
4054
4055	kfree(cgrp);
4056	return err;
4057	}
4058
4059	static int cgroup_mkdir(struct inode dir, struct dentry dentry, umode_t mode)
4060	{
4061	struct cgroup *c_parent = dentry->d_parent->d_fsdata;
4062
4063	/* the vfs holds inode->i_mutex already */
4064	return cgroup_create(c_parent, dentry, mode \| S_IFDIR);
4065	}
4066
4067	/*
4068	* Check the reference count on each subsystem. Since we already
4069	* established that there are no tasks in the cgroup, if the css refcount
4070	* is also 1, then there should be no outstanding references, so the
4071	* subsystem is safe to destroy. We scan across all subsystems rather than
4072	* using the per-hierarchy linked list of mounted subsystems since we can
4073	* be called via check_for_release() with no synchronization other than
4074	* RCU, and the subsystem linked list isn't RCU-safe.
4075	*/
4076	static int cgroup_has_css_refs(struct cgroup *cgrp)
4077	{
4078	int i;
4079
4080	/*
4081	* We won't need to lock the subsys array, because the subsystems
4082	* we're concerned about aren't going anywhere since our cgroup root
4083	* has a reference on them.
4084	*/
4085	for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
4086	struct cgroup_subsys *ss = subsys[i];
4087	struct cgroup_subsys_state *css;
4088
4089	/* Skip subsystems not present or not in this hierarchy */
4090	if (ss == NULL \|\| ss->root != cgrp->root)
4091	continue;
4092
4093	css = cgrp->subsys[ss->subsys_id];
4094	/*
4095	* When called from check_for_release() it's possible
4096	* that by this point the cgroup has been removed
4097	* and the css deleted. But a false-positive doesn't
4098	* matter, since it can only happen if the cgroup
4099	* has been deleted and hence no longer needs the
4100	* release agent to be called anyway.
4101	*/
4102	if (css && css_refcnt(css) > 1)
4103	return 1;
4104	}
4105	return 0;
4106	}
4107
4108	/*
4109	* Atomically mark all (or else none) of the cgroup's CSS objects as
4110	* CSS_REMOVED. Return true on success, or false if the cgroup has
4111	* busy subsystems. Call with cgroup_mutex held
4112	*
4113	* Depending on whether a subsys has __DEPRECATED_clear_css_refs set or
4114	* not, cgroup removal behaves differently.
4115	*
4116	* If clear is set, css refcnt for the subsystem should be zero before
4117	* cgroup removal can be committed. This is implemented by
4118	* CGRP_WAIT_ON_RMDIR and retry logic around ->pre_destroy(), which may be
4119	* called multiple times until all css refcnts reach zero and is allowed to
4120	* veto removal on any invocation. This behavior is deprecated and will be
4121	* removed as soon as the existing user (memcg) is updated.
4122	*
4123	* If clear is not set, each css holds an extra reference to the cgroup's
4124	* dentry and cgroup removal proceeds regardless of css refs.
4125	* ->pre_destroy() will be called at least once and is not allowed to fail.
4126	* On the last put of each css, whenever that may be, the extra dentry ref
4127	* is put so that dentry destruction happens only after all css's are
4128	* released.
4129	*/
4130	static int cgroup_clear_css_refs(struct cgroup *cgrp)
4131	{
4132	struct cgroup_subsys *ss;
4133	unsigned long flags;
4134	bool failed = false;
4135
4136	local_irq_save(flags);
4137
4138	/*
4139	* Block new css_tryget() by deactivating refcnt. If all refcnts
4140	* for subsystems w/ clear_css_refs set were 1 at the moment of
4141	* deactivation, we succeeded.
4142	*/
4143	for_each_subsys(cgrp->root, ss) {
4144	struct cgroup_subsys_state *css = cgrp->subsys[ss->subsys_id];
4145
4146	WARN_ON(atomic_read(&css->refcnt) < 0);
4147	atomic_add(CSS_DEACT_BIAS, &css->refcnt);
4148
4149	if (ss->__DEPRECATED_clear_css_refs)
4150	failed \|= css_refcnt(css) != 1;
4151	}
4152
4153	/*
4154	* If succeeded, set REMOVED and put all the base refs; otherwise,
4155	* restore refcnts to positive values. Either way, all in-progress
4156	* css_tryget() will be released.
4157	*/
4158	for_each_subsys(cgrp->root, ss) {
4159	struct cgroup_subsys_state *css = cgrp->subsys[ss->subsys_id];
4160
4161	if (!failed) {
4162	set_bit(CSS_REMOVED, &css->flags);
4163	css_put(css);
4164	} else {
4165	atomic_sub(CSS_DEACT_BIAS, &css->refcnt);
4166	}
4167	}
4168
4169	local_irq_restore(flags);
4170	return !failed;
4171	}
4172
4173	static int cgroup_rmdir(struct inode unused_dir, struct dentry dentry)
4174	{
4175	struct cgroup *cgrp = dentry->d_fsdata;
4176	struct dentry *d;
4177	struct cgroup *parent;
4178	DEFINE_WAIT(wait);
4179	struct cgroup_event event, tmp;
4180	int ret;
4181
4182	/* the vfs holds both inode->i_mutex already */
4183	again:
4184	mutex_lock(&cgroup_mutex);
4185	if (atomic_read(&cgrp->count) != 0) {
4186	mutex_unlock(&cgroup_mutex);
4187	return -EBUSY;
4188	}
4189	if (!list_empty(&cgrp->children)) {
4190	mutex_unlock(&cgroup_mutex);
4191	return -EBUSY;
4192	}
4193	mutex_unlock(&cgroup_mutex);
4194
4195	/*
4196	* In general, subsystem has no css->refcnt after pre_destroy(). But
4197	* in racy cases, subsystem may have to get css->refcnt after
4198	* pre_destroy() and it makes rmdir return with -EBUSY. This sometimes
4199	* make rmdir return -EBUSY too often. To avoid that, we use waitqueue
4200	* for cgroup's rmdir. CGRP_WAIT_ON_RMDIR is for synchronizing rmdir
4201	* and subsystem's reference count handling. Please see css_get/put
4202	* and css_tryget() and cgroup_wakeup_rmdir_waiter() implementation.
4203	*/
4204	set_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags);
4205
4206	/*
4207	* Call pre_destroy handlers of subsys. Notify subsystems
4208	* that rmdir() request comes.
4209	*/
4210	ret = cgroup_call_pre_destroy(cgrp);
4211	if (ret) {
4212	clear_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags);
4213	return ret;
4214	}
4215
4216	mutex_lock(&cgroup_mutex);
4217	parent = cgrp->parent;
4218	if (atomic_read(&cgrp->count) \|\| !list_empty(&cgrp->children)) {
4219	clear_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags);
4220	mutex_unlock(&cgroup_mutex);
4221	return -EBUSY;
4222	}
4223	prepare_to_wait(&cgroup_rmdir_waitq, &wait, TASK_INTERRUPTIBLE);
4224	if (!cgroup_clear_css_refs(cgrp)) {
4225	mutex_unlock(&cgroup_mutex);
4226	/*
4227	* Because someone may call cgroup_wakeup_rmdir_waiter() before
4228	* prepare_to_wait(), we need to check this flag.
4229	*/
4230	if (test_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags))
4231	schedule();
4232	finish_wait(&cgroup_rmdir_waitq, &wait);
4233	clear_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags);
4234	if (signal_pending(current))
4235	return -EINTR;
4236	goto again;
4237	}
4238	/* NO css_tryget() can success after here. */
4239	finish_wait(&cgroup_rmdir_waitq, &wait);
4240	clear_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags);
4241
4242	raw_spin_lock(&release_list_lock);
4243	set_bit(CGRP_REMOVED, &cgrp->flags);
4244	if (!list_empty(&cgrp->release_list))
4245	list_del_init(&cgrp->release_list);
4246	raw_spin_unlock(&release_list_lock);
4247
4248	cgroup_lock_hierarchy(cgrp->root);
4249	/* delete this cgroup from parent->children */
4250	list_del_init(&cgrp->sibling);
4251	cgroup_unlock_hierarchy(cgrp->root);
4252
4253	list_del_init(&cgrp->allcg_node);
4254
4255	d = dget(cgrp->dentry);
4256
4257	cgroup_d_remove_dir(d);
4258	dput(d);
4259
4260	set_bit(CGRP_RELEASABLE, &parent->flags);
4261	check_for_release(parent);
4262
4263	/*
4264	* Unregister events and notify userspace.
4265	* Notify userspace about cgroup removing only after rmdir of cgroup
4266	* directory to avoid race between userspace and kernelspace
4267	*/
4268	spin_lock(&cgrp->event_list_lock);
4269	list_for_each_entry_safe(event, tmp, &cgrp->event_list, list) {
4270	list_del(&event->list);
4271	remove_wait_queue(event->wqh, &event->wait);
4272	eventfd_signal(event->eventfd, 1);
4273	schedule_work(&event->remove);
4274	}
4275	spin_unlock(&cgrp->event_list_lock);
4276
4277	mutex_unlock(&cgroup_mutex);
4278	return 0;
4279	}
4280
4281	static void __init_or_module cgroup_init_cftsets(struct cgroup_subsys *ss)
4282	{
4283	INIT_LIST_HEAD(&ss->cftsets);
4284
4285	/*
4286	* base_cftset is embedded in subsys itself, no need to worry about
4287	* deregistration.
4288	*/
4289	if (ss->base_cftypes) {
4290	ss->base_cftset.cfts = ss->base_cftypes;
4291	list_add_tail(&ss->base_cftset.node, &ss->cftsets);
4292	}
4293	}
4294
4295	static void __init cgroup_init_subsys(struct cgroup_subsys *ss)
4296	{
4297	struct cgroup_subsys_state *css;
4298
4299	printk(KERN_INFO "Initializing cgroup subsys %s\n", ss->name);
4300
4301	/* init base cftset */
4302	cgroup_init_cftsets(ss);
4303
4304	/* Create the top cgroup state for this subsystem */
4305	list_add(&ss->sibling, &rootnode.subsys_list);
4306	ss->root = &rootnode;
4307	css = ss->create(dummytop);
4308	/* We don't handle early failures gracefully */
4309	BUG_ON(IS_ERR(css));
4310	init_cgroup_css(css, ss, dummytop);
4311
4312	/* Update the init_css_set to contain a subsys
4313	* pointer to this state - since the subsystem is
4314	* newly registered, all tasks and hence the
4315	* init_css_set is in the subsystem's top cgroup. */
4316	init_css_set.subsys[ss->subsys_id] = dummytop->subsys[ss->subsys_id];
4317
4318	need_forkexit_callback \|= ss->fork \|\| ss->exit;
4319
4320	/* At system boot, before all subsystems have been
4321	* registered, no tasks have been forked, so we don't
4322	* need to invoke fork callbacks here. */
4323	BUG_ON(!list_empty(&init_task.tasks));
4324
4325	mutex_init(&ss->hierarchy_mutex);
4326	lockdep_set_class(&ss->hierarchy_mutex, &ss->subsys_key);
4327	ss->active = 1;
4328
4329	/* this function shouldn't be used with modular subsystems, since they
4330	* need to register a subsys_id, among other things */
4331	BUG_ON(ss->module);
4332	}
4333
4334	/**
4335	* cgroup_load_subsys: load and register a modular subsystem at runtime
4336	* @ss: the subsystem to load
4337	*
4338	* This function should be called in a modular subsystem's initcall. If the
4339	* subsystem is built as a module, it will be assigned a new subsys_id and set
4340	* up for use. If the subsystem is built-in anyway, work is delegated to the
4341	* simpler cgroup_init_subsys.
4342	*/
4343	int __init_or_module cgroup_load_subsys(struct cgroup_subsys *ss)
4344	{
4345	int i;
4346	struct cgroup_subsys_state *css;
4347
4348	/* check name and function validity */
4349	if (ss->name == NULL \|\| strlen(ss->name) > MAX_CGROUP_TYPE_NAMELEN \|\|
4350	ss->create == NULL \|\| ss->destroy == NULL)
4351	return -EINVAL;
4352
4353	/*
4354	* we don't support callbacks in modular subsystems. this check is
4355	* before the ss->module check for consistency; a subsystem that could
4356	* be a module should still have no callbacks even if the user isn't
4357	* compiling it as one.
4358	*/
4359	if (ss->fork \|\| ss->exit)
4360	return -EINVAL;
4361
4362	/*
4363	* an optionally modular subsystem is built-in: we want to do nothing,
4364	* since cgroup_init_subsys will have already taken care of it.
4365	*/
4366	if (ss->module == NULL) {
4367	/* a few sanity checks */
4368	BUG_ON(ss->subsys_id >= CGROUP_BUILTIN_SUBSYS_COUNT);
4369	BUG_ON(subsys[ss->subsys_id] != ss);
4370	return 0;
4371	}
4372
4373	/* init base cftset */
4374	cgroup_init_cftsets(ss);
4375
4376	/*
4377	* need to register a subsys id before anything else - for example,
4378	* init_cgroup_css needs it.
4379	*/
4380	mutex_lock(&cgroup_mutex);
4381	/* find the first empty slot in the array */
4382	for (i = CGROUP_BUILTIN_SUBSYS_COUNT; i < CGROUP_SUBSYS_COUNT; i++) {
4383	if (subsys[i] == NULL)
4384	break;
4385	}
4386	if (i == CGROUP_SUBSYS_COUNT) {
4387	/* maximum number of subsystems already registered! */
4388	mutex_unlock(&cgroup_mutex);
4389	return -EBUSY;
4390	}
4391	/* assign ourselves the subsys_id */
4392	ss->subsys_id = i;
4393	subsys[i] = ss;
4394
4395	/*
4396	* no ss->create seems to need anything important in the ss struct, so
4397	* this can happen first (i.e. before the rootnode attachment).
4398	*/
4399	css = ss->create(dummytop);
4400	if (IS_ERR(css)) {
4401	/* failure case - need to deassign the subsys[] slot. */
4402	subsys[i] = NULL;
4403	mutex_unlock(&cgroup_mutex);
4404	return PTR_ERR(css);
4405	}
4406
4407	list_add(&ss->sibling, &rootnode.subsys_list);
4408	ss->root = &rootnode;
4409
4410	/* our new subsystem will be attached to the dummy hierarchy. */
4411	init_cgroup_css(css, ss, dummytop);
4412	/* init_idr must be after init_cgroup_css because it sets css->id. */
4413	if (ss->use_id) {
4414	int ret = cgroup_init_idr(ss, css);
4415	if (ret) {
4416	dummytop->subsys[ss->subsys_id] = NULL;
4417	ss->destroy(dummytop);
4418	subsys[i] = NULL;
4419	mutex_unlock(&cgroup_mutex);
4420	return ret;
4421	}
4422	}
4423
4424	/*
4425	* Now we need to entangle the css into the existing css_sets. unlike
4426	* in cgroup_init_subsys, there are now multiple css_sets, so each one
4427	* will need a new pointer to it; done by iterating the css_set_table.
4428	* furthermore, modifying the existing css_sets will corrupt the hash
4429	* table state, so each changed css_set will need its hash recomputed.
4430	* this is all done under the css_set_lock.
4431	*/
4432	write_lock(&css_set_lock);
4433	for (i = 0; i < CSS_SET_TABLE_SIZE; i++) {
4434	struct css_set *cg;
4435	struct hlist_node node, tmp;
4436	struct hlist_head bucket = &css_set_table[i], new_bucket;
4437
4438	hlist_for_each_entry_safe(cg, node, tmp, bucket, hlist) {
4439	/* skip entries that we already rehashed */
4440	if (cg->subsys[ss->subsys_id])
4441	continue;
4442	/* remove existing entry */
4443	hlist_del(&cg->hlist);
4444	/* set new value */
4445	cg->subsys[ss->subsys_id] = css;
4446	/* recompute hash and restore entry */
4447	new_bucket = css_set_hash(cg->subsys);
4448	hlist_add_head(&cg->hlist, new_bucket);
4449	}
4450	}
4451	write_unlock(&css_set_lock);
4452
4453	mutex_init(&ss->hierarchy_mutex);
4454	lockdep_set_class(&ss->hierarchy_mutex, &ss->subsys_key);
4455	ss->active = 1;
4456
4457	/* success! */
4458	mutex_unlock(&cgroup_mutex);
4459	return 0;
4460	}
4461	EXPORT_SYMBOL_GPL(cgroup_load_subsys);
4462
4463	/**
4464	* cgroup_unload_subsys: unload a modular subsystem
4465	* @ss: the subsystem to unload
4466	*
4467	* This function should be called in a modular subsystem's exitcall. When this
4468	* function is invoked, the refcount on the subsystem's module will be 0, so
4469	* the subsystem will not be attached to any hierarchy.
4470	*/
4471	void cgroup_unload_subsys(struct cgroup_subsys *ss)
4472	{
4473	struct cg_cgroup_link *link;
4474	struct hlist_head *hhead;
4475
4476	BUG_ON(ss->module == NULL);
4477
4478	/*
4479	* we shouldn't be called if the subsystem is in use, and the use of
4480	* try_module_get in parse_cgroupfs_options should ensure that it
4481	* doesn't start being used while we're killing it off.
4482	*/
4483	BUG_ON(ss->root != &rootnode);
4484
4485	mutex_lock(&cgroup_mutex);
4486	/* deassign the subsys_id */
4487	BUG_ON(ss->subsys_id < CGROUP_BUILTIN_SUBSYS_COUNT);
4488	subsys[ss->subsys_id] = NULL;
4489
4490	/* remove subsystem from rootnode's list of subsystems */
4491	list_del_init(&ss->sibling);
4492
4493	/*
4494	* disentangle the css from all css_sets attached to the dummytop. as
4495	* in loading, we need to pay our respects to the hashtable gods.
4496	*/
4497	write_lock(&css_set_lock);
4498	list_for_each_entry(link, &dummytop->css_sets, cgrp_link_list) {
4499	struct css_set *cg = link->cg;
4500
4501	hlist_del(&cg->hlist);
4502	BUG_ON(!cg->subsys[ss->subsys_id]);
4503	cg->subsys[ss->subsys_id] = NULL;
4504	hhead = css_set_hash(cg->subsys);
4505	hlist_add_head(&cg->hlist, hhead);
4506	}
4507	write_unlock(&css_set_lock);
4508
4509	/*
4510	* remove subsystem's css from the dummytop and free it - need to free
4511	* before marking as null because ss->destroy needs the cgrp->subsys
4512	* pointer to find their state. note that this also takes care of
4513	* freeing the css_id.
4514	*/
4515	ss->destroy(dummytop);
4516	dummytop->subsys[ss->subsys_id] = NULL;
4517
4518	mutex_unlock(&cgroup_mutex);
4519	}
4520	EXPORT_SYMBOL_GPL(cgroup_unload_subsys);
4521
4522	/**
4523	* cgroup_init_early - cgroup initialization at system boot
4524	*
4525	* Initialize cgroups at system boot, and initialize any
4526	* subsystems that request early init.
4527	*/
4528	int __init cgroup_init_early(void)
4529	{
4530	int i;
4531	atomic_set(&init_css_set.refcount, 1);
4532	INIT_LIST_HEAD(&init_css_set.cg_links);
4533	INIT_LIST_HEAD(&init_css_set.tasks);
4534	INIT_HLIST_NODE(&init_css_set.hlist);
4535	css_set_count = 1;
4536	init_cgroup_root(&rootnode);
4537	root_count = 1;
4538	init_task.cgroups = &init_css_set;
4539
4540	init_css_set_link.cg = &init_css_set;
4541	init_css_set_link.cgrp = dummytop;
4542	list_add(&init_css_set_link.cgrp_link_list,
4543	&rootnode.top_cgroup.css_sets);
4544	list_add(&init_css_set_link.cg_link_list,
4545	&init_css_set.cg_links);
4546
4547	for (i = 0; i < CSS_SET_TABLE_SIZE; i++)
4548	INIT_HLIST_HEAD(&css_set_table[i]);
4549
4550	/* at bootup time, we don't worry about modular subsystems */
4551	for (i = 0; i < CGROUP_BUILTIN_SUBSYS_COUNT; i++) {
4552	struct cgroup_subsys *ss = subsys[i];
4553
4554	BUG_ON(!ss->name);
4555	BUG_ON(strlen(ss->name) > MAX_CGROUP_TYPE_NAMELEN);
4556	BUG_ON(!ss->create);
4557	BUG_ON(!ss->destroy);
4558	if (ss->subsys_id != i) {
4559	printk(KERN_ERR "cgroup: Subsys %s id == %d\n",
4560	ss->name, ss->subsys_id);
4561	BUG();
4562	}
4563
4564	if (ss->early_init)
4565	cgroup_init_subsys(ss);
4566	}
4567	return 0;
4568	}
4569
4570	/**
4571	* cgroup_init - cgroup initialization
4572	*
4573	* Register cgroup filesystem and /proc file, and initialize
4574	* any subsystems that didn't request early init.
4575	*/
4576	int __init cgroup_init(void)
4577	{
4578	int err;
4579	int i;
4580	struct hlist_head *hhead;
4581
4582	err = bdi_init(&cgroup_backing_dev_info);
4583	if (err)
4584	return err;
4585
4586	/* at bootup time, we don't worry about modular subsystems */
4587	for (i = 0; i < CGROUP_BUILTIN_SUBSYS_COUNT; i++) {
4588	struct cgroup_subsys *ss = subsys[i];
4589	if (!ss->early_init)
4590	cgroup_init_subsys(ss);
4591	if (ss->use_id)
4592	cgroup_init_idr(ss, init_css_set.subsys[ss->subsys_id]);
4593	}
4594
4595	/* Add init_css_set to the hash table */
4596	hhead = css_set_hash(init_css_set.subsys);
4597	hlist_add_head(&init_css_set.hlist, hhead);
4598	BUG_ON(!init_root_id(&rootnode));
4599
4600	cgroup_kobj = kobject_create_and_add("cgroup", fs_kobj);
4601	if (!cgroup_kobj) {
4602	err = -ENOMEM;
4603	goto out;
4604	}
4605
4606	err = register_filesystem(&cgroup_fs_type);
4607	if (err < 0) {
4608	kobject_put(cgroup_kobj);
4609	goto out;
4610	}
4611
4612	proc_create("cgroups", 0, NULL, &proc_cgroupstats_operations);
4613
4614	out:
4615	if (err)
4616	bdi_destroy(&cgroup_backing_dev_info);
4617
4618	return err;
4619	}
4620
4621	/*
4622	* proc_cgroup_show()
4623	* - Print task's cgroup paths into seq_file, one line for each hierarchy
4624	* - Used for /proc/<pid>/cgroup.
4625	* - No need to task_lock(tsk) on this tsk->cgroup reference, as it
4626	* doesn't really matter if tsk->cgroup changes after we read it,
4627	* and we take cgroup_mutex, keeping cgroup_attach_task() from changing it
4628	* anyway. No need to check that tsk->cgroup != NULL, thanks to
4629	* the_top_cgroup_hack in cgroup_exit(), which sets an exiting tasks
4630	* cgroup to top_cgroup.
4631	*/
4632
4633	/* TODO: Use a proper seq_file iterator */
4634	static int proc_cgroup_show(struct seq_file m, void v)
4635	{
4636	struct pid *pid;
4637	struct task_struct *tsk;
4638	char *buf;
4639	int retval;
4640	struct cgroupfs_root *root;
4641
4642	retval = -ENOMEM;
4643	buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
4644	if (!buf)
4645	goto out;
4646
4647	retval = -ESRCH;
4648	pid = m->private;
4649	tsk = get_pid_task(pid, PIDTYPE_PID);
4650	if (!tsk)
4651	goto out_free;
4652
4653	retval = 0;
4654
4655	mutex_lock(&cgroup_mutex);
4656
4657	for_each_active_root(root) {
4658	struct cgroup_subsys *ss;
4659	struct cgroup *cgrp;
4660	int count = 0;
4661
4662	seq_printf(m, "%d:", root->hierarchy_id);
4663	for_each_subsys(root, ss)
4664	seq_printf(m, "%s%s", count++ ? "," : "", ss->name);
4665	if (strlen(root->name))
4666	seq_printf(m, "%sname=%s", count ? "," : "",
4667	root->name);
4668	seq_putc(m, ':');
4669	cgrp = task_cgroup_from_root(tsk, root);
4670	retval = cgroup_path(cgrp, buf, PAGE_SIZE);
4671	if (retval < 0)
4672	goto out_unlock;
4673	seq_puts(m, buf);
4674	seq_putc(m, '\n');
4675	}
4676
4677	out_unlock:
4678	mutex_unlock(&cgroup_mutex);
4679	put_task_struct(tsk);
4680	out_free:
4681	kfree(buf);
4682	out:
4683	return retval;
4684	}
4685
4686	static int cgroup_open(struct inode inode, struct file file)
4687	{
4688	struct pid *pid = PROC_I(inode)->pid;
4689	return single_open(file, proc_cgroup_show, pid);
4690	}
4691
4692	const struct file_operations proc_cgroup_operations = {
4693	.open = cgroup_open,
4694	.read = seq_read,
4695	.llseek = seq_lseek,
4696	.release = single_release,
4697	};
4698
4699	/* Display information about each subsystem and each hierarchy */
4700	static int proc_cgroupstats_show(struct seq_file m, void v)
4701	{
4702	int i;
4703
4704	seq_puts(m, "#subsys_name\thierarchy\tnum_cgroups\tenabled\n");
4705	/*
4706	* ideally we don't want subsystems moving around while we do this.
4707	* cgroup_mutex is also necessary to guarantee an atomic snapshot of
4708	* subsys/hierarchy state.
4709	*/
4710	mutex_lock(&cgroup_mutex);
4711	for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
4712	struct cgroup_subsys *ss = subsys[i];
4713	if (ss == NULL)
4714	continue;
4715	seq_printf(m, "%s\t%d\t%d\t%d\n",
4716	ss->name, ss->root->hierarchy_id,
4717	ss->root->number_of_cgroups, !ss->disabled);
4718	}
4719	mutex_unlock(&cgroup_mutex);
4720	return 0;
4721	}
4722
4723	static int cgroupstats_open(struct inode inode, struct file file)
4724	{
4725	return single_open(file, proc_cgroupstats_show, NULL);
4726	}
4727
4728	static const struct file_operations proc_cgroupstats_operations = {
4729	.open = cgroupstats_open,
4730	.read = seq_read,
4731	.llseek = seq_lseek,
4732	.release = single_release,
4733	};
4734
4735	/**
4736	* cgroup_fork - attach newly forked task to its parents cgroup.
4737	* @child: pointer to task_struct of forking parent process.
4738	*
4739	* Description: A task inherits its parent's cgroup at fork().
4740	*
4741	* A pointer to the shared css_set was automatically copied in
4742	* fork.c by dup_task_struct(). However, we ignore that copy, since
4743	* it was not made under the protection of RCU, cgroup_mutex or
4744	* threadgroup_change_begin(), so it might no longer be a valid
4745	* cgroup pointer. cgroup_attach_task() might have already changed
4746	* current->cgroups, allowing the previously referenced cgroup
4747	* group to be removed and freed.
4748	*
4749	* Outside the pointer validity we also need to process the css_set
4750	* inheritance between threadgoup_change_begin() and
4751	* threadgoup_change_end(), this way there is no leak in any process
4752	* wide migration performed by cgroup_attach_proc() that could otherwise
4753	* miss a thread because it is too early or too late in the fork stage.
4754	*
4755	* At the point that cgroup_fork() is called, 'current' is the parent
4756	* task, and the passed argument 'child' points to the child task.
4757	*/
4758	void cgroup_fork(struct task_struct *child)
4759	{
4760	/*
4761	* We don't need to task_lock() current because current->cgroups
4762	* can't be changed concurrently here. The parent obviously hasn't
4763	* exited and called cgroup_exit(), and we are synchronized against
4764	* cgroup migration through threadgroup_change_begin().
4765	*/
4766	child->cgroups = current->cgroups;
4767	get_css_set(child->cgroups);
4768	INIT_LIST_HEAD(&child->cg_list);
4769	}
4770
4771	/**
4772	* cgroup_fork_callbacks - run fork callbacks
4773	* @child: the new task
4774	*
4775	* Called on a new task very soon before adding it to the
4776	* tasklist. No need to take any locks since no-one can
4777	* be operating on this task.
4778	*/
4779	void cgroup_fork_callbacks(struct task_struct *child)
4780	{
4781	if (need_forkexit_callback) {
4782	int i;
4783	/*
4784	* forkexit callbacks are only supported for builtin
4785	* subsystems, and the builtin section of the subsys array is
4786	* immutable, so we don't need to lock the subsys array here.
4787	*/
4788	for (i = 0; i < CGROUP_BUILTIN_SUBSYS_COUNT; i++) {
4789	struct cgroup_subsys *ss = subsys[i];
4790	if (ss->fork)
4791	ss->fork(child);
4792	}
4793	}
4794	}
4795
4796	/**
4797	* cgroup_post_fork - called on a new task after adding it to the task list
4798	* @child: the task in question
4799	*
4800	* Adds the task to the list running through its css_set if necessary.
4801	* Has to be after the task is visible on the task list in case we race
4802	* with the first call to cgroup_iter_start() - to guarantee that the
4803	* new task ends up on its list.
4804	*/
4805	void cgroup_post_fork(struct task_struct *child)
4806	{
4807	/*
4808	* use_task_css_set_links is set to 1 before we walk the tasklist
4809	* under the tasklist_lock and we read it here after we added the child
4810	* to the tasklist under the tasklist_lock as well. If the child wasn't
4811	* yet in the tasklist when we walked through it from
4812	* cgroup_enable_task_cg_lists(), then use_task_css_set_links value
4813	* should be visible now due to the paired locking and barriers implied
4814	* by LOCK/UNLOCK: it is written before the tasklist_lock unlock
4815	* in cgroup_enable_task_cg_lists() and read here after the tasklist_lock
4816	* lock on fork.
4817	*/
4818	if (use_task_css_set_links) {
4819	write_lock(&css_set_lock);
4820	if (list_empty(&child->cg_list)) {
4821	/*
4822	* It's safe to use child->cgroups without task_lock()
4823	* here because we are protected through
4824	* threadgroup_change_begin() against concurrent
4825	* css_set change in cgroup_task_migrate(). Also
4826	* the task can't exit at that point until
4827	* wake_up_new_task() is called, so we are protected
4828	* against cgroup_exit() setting child->cgroup to
4829	* init_css_set.
4830	*/
4831	list_add(&child->cg_list, &child->cgroups->tasks);
4832	}
4833	write_unlock(&css_set_lock);
4834	}
4835	}
4836	/**
4837	* cgroup_exit - detach cgroup from exiting task
4838	* @tsk: pointer to task_struct of exiting process
4839	* @run_callback: run exit callbacks?
4840	*
4841	* Description: Detach cgroup from @tsk and release it.
4842	*
4843	* Note that cgroups marked notify_on_release force every task in
4844	* them to take the global cgroup_mutex mutex when exiting.
4845	* This could impact scaling on very large systems. Be reluctant to
4846	* use notify_on_release cgroups where very high task exit scaling
4847	* is required on large systems.
4848	*
4849	* the_top_cgroup_hack:
4850	*
4851	* Set the exiting tasks cgroup to the root cgroup (top_cgroup).
4852	*
4853	* We call cgroup_exit() while the task is still competent to
4854	* handle notify_on_release(), then leave the task attached to the
4855	* root cgroup in each hierarchy for the remainder of its exit.
4856	*
4857	* To do this properly, we would increment the reference count on
4858	* top_cgroup, and near the very end of the kernel/exit.c do_exit()
4859	* code we would add a second cgroup function call, to drop that
4860	* reference. This would just create an unnecessary hot spot on
4861	* the top_cgroup reference count, to no avail.
4862	*
4863	* Normally, holding a reference to a cgroup without bumping its
4864	* count is unsafe. The cgroup could go away, or someone could
4865	* attach us to a different cgroup, decrementing the count on
4866	* the first cgroup that we never incremented. But in this case,
4867	* top_cgroup isn't going away, and either task has PF_EXITING set,
4868	* which wards off any cgroup_attach_task() attempts, or task is a failed
4869	* fork, never visible to cgroup_attach_task.
4870	*/
4871	void cgroup_exit(struct task_struct *tsk, int run_callbacks)
4872	{
4873	struct css_set *cg;
4874	int i;
4875
4876	/*
4877	* Unlink from the css_set task list if necessary.
4878	* Optimistically check cg_list before taking
4879	* css_set_lock
4880	*/
4881	if (!list_empty(&tsk->cg_list)) {
4882	write_lock(&css_set_lock);
4883	if (!list_empty(&tsk->cg_list))
4884	list_del_init(&tsk->cg_list);
4885	write_unlock(&css_set_lock);
4886	}
4887
4888	/* Reassign the task to the init_css_set. */
4889	task_lock(tsk);
4890	cg = tsk->cgroups;
4891	tsk->cgroups = &init_css_set;
4892
4893	if (run_callbacks && need_forkexit_callback) {
4894	/*
4895	* modular subsystems can't use callbacks, so no need to lock
4896	* the subsys array
4897	*/
4898	for (i = 0; i < CGROUP_BUILTIN_SUBSYS_COUNT; i++) {
4899	struct cgroup_subsys *ss = subsys[i];
4900	if (ss->exit) {
4901	struct cgroup *old_cgrp =
4902	rcu_dereference_raw(cg->subsys[i])->cgroup;
4903	struct cgroup *cgrp = task_cgroup(tsk, i);
4904	ss->exit(cgrp, old_cgrp, tsk);
4905	}
4906	}
4907	}
4908	task_unlock(tsk);
4909
4910	if (cg)
4911	put_css_set_taskexit(cg);
4912	}
4913
4914	/**
4915	* cgroup_is_descendant - see if @cgrp is a descendant of @task's cgrp
4916	* @cgrp: the cgroup in question
4917	* @task: the task in question
4918	*
4919	* See if @cgrp is a descendant of @task's cgroup in the appropriate
4920	* hierarchy.
4921	*
4922	* If we are sending in dummytop, then presumably we are creating
4923	* the top cgroup in the subsystem.
4924	*
4925	* Called only by the ns (nsproxy) cgroup.
4926	*/
4927	int cgroup_is_descendant(const struct cgroup cgrp, struct task_struct task)
4928	{
4929	int ret;
4930	struct cgroup *target;
4931
4932	if (cgrp == dummytop)
4933	return 1;
4934
4935	target = task_cgroup_from_root(task, cgrp->root);
4936	while (cgrp != target && cgrp!= cgrp->top_cgroup)
4937	cgrp = cgrp->parent;
4938	ret = (cgrp == target);
4939	return ret;
4940	}
4941
4942	static void check_for_release(struct cgroup *cgrp)
4943	{
4944	/* All of these checks rely on RCU to keep the cgroup
4945	* structure alive */
4946	if (cgroup_is_releasable(cgrp) && !atomic_read(&cgrp->count)
4947	&& list_empty(&cgrp->children) && !cgroup_has_css_refs(cgrp)) {
4948	/* Control Group is currently removeable. If it's not
4949	* already queued for a userspace notification, queue
4950	* it now */
4951	int need_schedule_work = 0;
4952	raw_spin_lock(&release_list_lock);
4953	if (!cgroup_is_removed(cgrp) &&
4954	list_empty(&cgrp->release_list)) {
4955	list_add(&cgrp->release_list, &release_list);
4956	need_schedule_work = 1;
4957	}
4958	raw_spin_unlock(&release_list_lock);
4959	if (need_schedule_work)
4960	schedule_work(&release_agent_work);
4961	}
4962	}
4963
4964	/* Caller must verify that the css is not for root cgroup */
4965	bool __css_tryget(struct cgroup_subsys_state *css)
4966	{
4967	do {
4968	int v = css_refcnt(css);
4969
4970	if (atomic_cmpxchg(&css->refcnt, v, v + 1) == v)
4971	return true;
4972	cpu_relax();
4973	} while (!test_bit(CSS_REMOVED, &css->flags));
4974
4975	return false;
4976	}
4977	EXPORT_SYMBOL_GPL(__css_tryget);
4978
4979	/* Caller must verify that the css is not for root cgroup */
4980	void __css_put(struct cgroup_subsys_state *css)
4981	{
4982	struct cgroup *cgrp = css->cgroup;
4983	int v;
4984
4985	rcu_read_lock();
4986	v = css_unbias_refcnt(atomic_dec_return(&css->refcnt));
4987
4988	switch (v) {
4989	case 1:
4990	if (notify_on_release(cgrp)) {
4991	set_bit(CGRP_RELEASABLE, &cgrp->flags);
4992	check_for_release(cgrp);
4993	}
4994	cgroup_wakeup_rmdir_waiter(cgrp);
4995	break;
4996	case 0:
4997	if (!test_bit(CSS_CLEAR_CSS_REFS, &css->flags))
4998	schedule_work(&css->dput_work);
4999	break;
5000	}
5001	rcu_read_unlock();
5002	}
5003	EXPORT_SYMBOL_GPL(__css_put);
5004
5005	/*
5006	* Notify userspace when a cgroup is released, by running the
5007	* configured release agent with the name of the cgroup (path
5008	* relative to the root of cgroup file system) as the argument.
5009	*
5010	* Most likely, this user command will try to rmdir this cgroup.
5011	*
5012	* This races with the possibility that some other task will be
5013	* attached to this cgroup before it is removed, or that some other
5014	* user task will 'mkdir' a child cgroup of this cgroup. That's ok.
5015	* The presumed 'rmdir' will fail quietly if this cgroup is no longer
5016	* unused, and this cgroup will be reprieved from its death sentence,
5017	* to continue to serve a useful existence. Next time it's released,
5018	* we will get notified again, if it still has 'notify_on_release' set.
5019	*
5020	* The final arg to call_usermodehelper() is UMH_WAIT_EXEC, which
5021	* means only wait until the task is successfully execve()'d. The
5022	* separate release agent task is forked by call_usermodehelper(),
5023	* then control in this thread returns here, without waiting for the
5024	* release agent task. We don't bother to wait because the caller of
5025	* this routine has no use for the exit status of the release agent
5026	* task, so no sense holding our caller up for that.
5027	*/
5028	static void cgroup_release_agent(struct work_struct *work)
5029	{
5030	BUG_ON(work != &release_agent_work);
5031	mutex_lock(&cgroup_mutex);
5032	raw_spin_lock(&release_list_lock);
5033	while (!list_empty(&release_list)) {
5034	char argv[3], envp[3];
5035	int i;
5036	char pathbuf = NULL, agentbuf = NULL;
5037	struct cgroup *cgrp = list_entry(release_list.next,
5038	struct cgroup,
5039	release_list);
5040	list_del_init(&cgrp->release_list);
5041	raw_spin_unlock(&release_list_lock);
5042	pathbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
5043	if (!pathbuf)
5044	goto continue_free;
5045	if (cgroup_path(cgrp, pathbuf, PAGE_SIZE) < 0)
5046	goto continue_free;
5047	agentbuf = kstrdup(cgrp->root->release_agent_path, GFP_KERNEL);
5048	if (!agentbuf)
5049	goto continue_free;
5050
5051	i = 0;
5052	argv[i++] = agentbuf;
5053	argv[i++] = pathbuf;
5054	argv[i] = NULL;
5055
5056	i = 0;
5057	/* minimal command environment */
5058	envp[i++] = "HOME=/";
5059	envp[i++] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
5060	envp[i] = NULL;
5061
5062	/* Drop the lock while we invoke the usermode helper,
5063	* since the exec could involve hitting disk and hence
5064	* be a slow process */
5065	mutex_unlock(&cgroup_mutex);
5066	call_usermodehelper(argv[0], argv, envp, UMH_WAIT_EXEC);
5067	mutex_lock(&cgroup_mutex);
5068	continue_free:
5069	kfree(pathbuf);
5070	kfree(agentbuf);
5071	raw_spin_lock(&release_list_lock);
5072	}
5073	raw_spin_unlock(&release_list_lock);
5074	mutex_unlock(&cgroup_mutex);
5075	}
5076
5077	static int __init cgroup_disable(char *str)
5078	{
5079	int i;
5080	char *token;
5081
5082	while ((token = strsep(&str, ",")) != NULL) {
5083	if (!*token)
5084	continue;
5085	/*
5086	* cgroup_disable, being at boot time, can't know about module
5087	* subsystems, so we don't worry about them.
5088	*/
5089	for (i = 0; i < CGROUP_BUILTIN_SUBSYS_COUNT; i++) {
5090	struct cgroup_subsys *ss = subsys[i];
5091
5092	if (!strcmp(token, ss->name)) {
5093	ss->disabled = 1;
5094	printk(KERN_INFO "Disabling %s control group"
5095	" subsystem\n", ss->name);
5096	break;
5097	}
5098	}
5099	}
5100	return 1;
5101	}
5102	__setup("cgroup_disable=", cgroup_disable);
5103
5104	/*
5105	* Functons for CSS ID.
5106	*/
5107
5108	/*
5109	*To get ID other than 0, this should be called when !cgroup_is_removed().
5110	*/
5111	unsigned short css_id(struct cgroup_subsys_state *css)
5112	{
5113	struct css_id *cssid;
5114
5115	/*
5116	* This css_id() can return correct value when somone has refcnt
5117	* on this or this is under rcu_read_lock(). Once css->id is allocated,
5118	* it's unchanged until freed.
5119	*/
5120	cssid = rcu_dereference_check(css->id, css_refcnt(css));
5121
5122	if (cssid)
5123	return cssid->id;
5124	return 0;
5125	}
5126	EXPORT_SYMBOL_GPL(css_id);
5127
5128	unsigned short css_depth(struct cgroup_subsys_state *css)
5129	{
5130	struct css_id *cssid;
5131
5132	cssid = rcu_dereference_check(css->id, css_refcnt(css));
5133
5134	if (cssid)
5135	return cssid->depth;
5136	return 0;
5137	}
5138	EXPORT_SYMBOL_GPL(css_depth);
5139
5140	/**
5141	* css_is_ancestor - test "root" css is an ancestor of "child"
5142	* @child: the css to be tested.
5143	* @root: the css supporsed to be an ancestor of the child.
5144	*
5145	* Returns true if "root" is an ancestor of "child" in its hierarchy. Because
5146	* this function reads css->id, the caller must hold rcu_read_lock().
5147	* But, considering usual usage, the csses should be valid objects after test.
5148	* Assuming that the caller will do some action to the child if this returns
5149	* returns true, the caller must take "child";s reference count.
5150	* If "child" is valid object and this returns true, "root" is valid, too.
5151	*/
5152
5153	bool css_is_ancestor(struct cgroup_subsys_state *child,
5154	const struct cgroup_subsys_state *root)
5155	{
5156	struct css_id *child_id;
5157	struct css_id *root_id;
5158
5159	child_id = rcu_dereference(child->id);
5160	if (!child_id)
5161	return false;
5162	root_id = rcu_dereference(root->id);
5163	if (!root_id)
5164	return false;
5165	if (child_id->depth < root_id->depth)
5166	return false;
5167	if (child_id->stack[root_id->depth] != root_id->id)
5168	return false;
5169	return true;
5170	}
5171
5172	void free_css_id(struct cgroup_subsys ss, struct cgroup_subsys_state css)
5173	{
5174	struct css_id *id = css->id;
5175	/* When this is called before css_id initialization, id can be NULL */
5176	if (!id)
5177	return;
5178
5179	BUG_ON(!ss->use_id);
5180
5181	rcu_assign_pointer(id->css, NULL);
5182	rcu_assign_pointer(css->id, NULL);
5183	spin_lock(&ss->id_lock);
5184	idr_remove(&ss->idr, id->id);
5185	spin_unlock(&ss->id_lock);
5186	kfree_rcu(id, rcu_head);
5187	}
5188	EXPORT_SYMBOL_GPL(free_css_id);
5189
5190	/*
5191	* This is called by init or create(). Then, calls to this function are
5192	* always serialized (By cgroup_mutex() at create()).
5193	*/
5194
5195	static struct css_id get_new_cssid(struct cgroup_subsys ss, int depth)
5196	{
5197	struct css_id *newid;
5198	int myid, error, size;
5199
5200	BUG_ON(!ss->use_id);
5201
5202	size = sizeof(newid) + sizeof(unsigned short) (depth + 1);
5203	newid = kzalloc(size, GFP_KERNEL);
5204	if (!newid)
5205	return ERR_PTR(-ENOMEM);
5206	/* get id */
5207	if (unlikely(!idr_pre_get(&ss->idr, GFP_KERNEL))) {
5208	error = -ENOMEM;
5209	goto err_out;
5210	}
5211	spin_lock(&ss->id_lock);
5212	/* Don't use 0. allocates an ID of 1-65535 */
5213	error = idr_get_new_above(&ss->idr, newid, 1, &myid);
5214	spin_unlock(&ss->id_lock);
5215
5216	/* Returns error when there are no free spaces for new ID.*/
5217	if (error) {
5218	error = -ENOSPC;
5219	goto err_out;
5220	}
5221	if (myid > CSS_ID_MAX)
5222	goto remove_idr;
5223
5224	newid->id = myid;
5225	newid->depth = depth;
5226	return newid;
5227	remove_idr:
5228	error = -ENOSPC;
5229	spin_lock(&ss->id_lock);
5230	idr_remove(&ss->idr, myid);
5231	spin_unlock(&ss->id_lock);
5232	err_out:
5233	kfree(newid);
5234	return ERR_PTR(error);
5235
5236	}
5237
5238	static int __init_or_module cgroup_init_idr(struct cgroup_subsys *ss,
5239	struct cgroup_subsys_state *rootcss)
5240	{
5241	struct css_id *newid;
5242
5243	spin_lock_init(&ss->id_lock);
5244	idr_init(&ss->idr);
5245
5246	newid = get_new_cssid(ss, 0);
5247	if (IS_ERR(newid))
5248	return PTR_ERR(newid);
5249
5250	newid->stack[0] = newid->id;
5251	newid->css = rootcss;
5252	rootcss->id = newid;
5253	return 0;
5254	}
5255
5256	static int alloc_css_id(struct cgroup_subsys ss, struct cgroup parent,
5257	struct cgroup *child)
5258	{
5259	int subsys_id, i, depth = 0;
5260	struct cgroup_subsys_state parent_css, child_css;
5261	struct css_id child_id, parent_id;
5262
5263	subsys_id = ss->subsys_id;
5264	parent_css = parent->subsys[subsys_id];
5265	child_css = child->subsys[subsys_id];
5266	parent_id = parent_css->id;
5267	depth = parent_id->depth + 1;
5268
5269	child_id = get_new_cssid(ss, depth);
5270	if (IS_ERR(child_id))
5271	return PTR_ERR(child_id);
5272
5273	for (i = 0; i < depth; i++)
5274	child_id->stack[i] = parent_id->stack[i];
5275	child_id->stack[depth] = child_id->id;
5276	/*
5277	* child_id->css pointer will be set after this cgroup is available
5278	* see cgroup_populate_dir()
5279	*/
5280	rcu_assign_pointer(child_css->id, child_id);
5281
5282	return 0;
5283	}
5284
5285	/**
5286	* css_lookup - lookup css by id
5287	* @ss: cgroup subsys to be looked into.
5288	* @id: the id
5289	*
5290	* Returns pointer to cgroup_subsys_state if there is valid one with id.
5291	* NULL if not. Should be called under rcu_read_lock()
5292	*/
5293	struct cgroup_subsys_state css_lookup(struct cgroup_subsys ss, int id)
5294	{
5295	struct css_id *cssid = NULL;
5296
5297	BUG_ON(!ss->use_id);
5298	cssid = idr_find(&ss->idr, id);
5299
5300	if (unlikely(!cssid))
5301	return NULL;
5302
5303	return rcu_dereference(cssid->css);
5304	}
5305	EXPORT_SYMBOL_GPL(css_lookup);
5306
5307	/**
5308	* css_get_next - lookup next cgroup under specified hierarchy.
5309	* @ss: pointer to subsystem
5310	* @id: current position of iteration.
5311	* @root: pointer to css. search tree under this.
5312	* @foundid: position of found object.
5313	*
5314	* Search next css under the specified hierarchy of rootid. Calling under
5315	* rcu_read_lock() is necessary. Returns NULL if it reaches the end.
5316	*/
5317	struct cgroup_subsys_state *
5318	css_get_next(struct cgroup_subsys *ss, int id,
5319	struct cgroup_subsys_state root, int foundid)
5320	{
5321	struct cgroup_subsys_state *ret = NULL;
5322	struct css_id *tmp;
5323	int tmpid;
5324	int rootid = css_id(root);
5325	int depth = css_depth(root);
5326
5327	if (!rootid)
5328	return NULL;
5329
5330	BUG_ON(!ss->use_id);
5331	WARN_ON_ONCE(!rcu_read_lock_held());
5332
5333	/* fill start point for scan */
5334	tmpid = id;
5335	while (1) {
5336	/*
5337	* scan next entry from bitmap(tree), tmpid is updated after
5338	* idr_get_next().
5339	*/
5340	tmp = idr_get_next(&ss->idr, &tmpid);
5341	if (!tmp)
5342	break;
5343	if (tmp->depth >= depth && tmp->stack[depth] == rootid) {
5344	ret = rcu_dereference(tmp->css);
5345	if (ret) {
5346	*foundid = tmpid;
5347	break;
5348	}
5349	}
5350	/* continue to scan from next id */
5351	tmpid = tmpid + 1;
5352	}
5353	return ret;
5354	}
5355
5356	/*
5357	* get corresponding css from file open on cgroupfs directory
5358	*/
5359	struct cgroup_subsys_state cgroup_css_from_dir(struct file f, int id)
5360	{
5361	struct cgroup *cgrp;
5362	struct inode *inode;
5363	struct cgroup_subsys_state *css;
5364
5365	inode = f->f_dentry->d_inode;
5366	/* check in cgroup filesystem dir */
5367	if (inode->i_op != &cgroup_dir_inode_operations)
5368	return ERR_PTR(-EBADF);
5369
5370	if (id < 0 \|\| id >= CGROUP_SUBSYS_COUNT)
5371	return ERR_PTR(-EINVAL);
5372
5373	/* get cgroup */
5374	cgrp = __d_cgrp(f->f_dentry);
5375	css = cgrp->subsys[id];
5376	return css ? css : ERR_PTR(-ENOENT);
5377	}
5378
5379	#ifdef CONFIG_CGROUP_DEBUG
5380	static struct cgroup_subsys_state debug_create(struct cgroup cont)
5381	{
5382	struct cgroup_subsys_state css = kzalloc(sizeof(css), GFP_KERNEL);
5383
5384	if (!css)
5385	return ERR_PTR(-ENOMEM);
5386
5387	return css;
5388	}
5389
5390	static void debug_destroy(struct cgroup *cont)
5391	{
5392	kfree(cont->subsys[debug_subsys_id]);
5393	}
5394
5395	static u64 cgroup_refcount_read(struct cgroup cont, struct cftype cft)
5396	{
5397	return atomic_read(&cont->count);
5398	}
5399
5400	static u64 debug_taskcount_read(struct cgroup cont, struct cftype cft)
5401	{
5402	return cgroup_task_count(cont);
5403	}
5404
5405	static u64 current_css_set_read(struct cgroup cont, struct cftype cft)
5406	{
5407	return (u64)(unsigned long)current->cgroups;
5408	}
5409
5410	static u64 current_css_set_refcount_read(struct cgroup *cont,
5411	struct cftype *cft)
5412	{
5413	u64 count;
5414
5415	rcu_read_lock();
5416	count = atomic_read(&current->cgroups->refcount);
5417	rcu_read_unlock();
5418	return count;
5419	}
5420
5421	static int current_css_set_cg_links_read(struct cgroup *cont,
5422	struct cftype *cft,
5423	struct seq_file *seq)
5424	{
5425	struct cg_cgroup_link *link;
5426	struct css_set *cg;
5427
5428	read_lock(&css_set_lock);
5429	rcu_read_lock();
5430	cg = rcu_dereference(current->cgroups);
5431	list_for_each_entry(link, &cg->cg_links, cg_link_list) {
5432	struct cgroup *c = link->cgrp;
5433	const char *name;
5434
5435	if (c->dentry)
5436	name = c->dentry->d_name.name;
5437	else
5438	name = "?";
5439	seq_printf(seq, "Root %d group %s\n",
5440	c->root->hierarchy_id, name);
5441	}
5442	rcu_read_unlock();
5443	read_unlock(&css_set_lock);
5444	return 0;
5445	}
5446
5447	#define MAX_TASKS_SHOWN_PER_CSS 25
5448	static int cgroup_css_links_read(struct cgroup *cont,
5449	struct cftype *cft,
5450	struct seq_file *seq)
5451	{
5452	struct cg_cgroup_link *link;
5453
5454	read_lock(&css_set_lock);
5455	list_for_each_entry(link, &cont->css_sets, cgrp_link_list) {
5456	struct css_set *cg = link->cg;
5457	struct task_struct *task;
5458	int count = 0;
5459	seq_printf(seq, "css_set %p\n", cg);
5460	list_for_each_entry(task, &cg->tasks, cg_list) {
5461	if (count++ > MAX_TASKS_SHOWN_PER_CSS) {
5462	seq_puts(seq, " ...\n");
5463	break;
5464	} else {
5465	seq_printf(seq, " task %d\n",
5466	task_pid_vnr(task));
5467	}
5468	}
5469	}
5470	read_unlock(&css_set_lock);
5471	return 0;
5472	}
5473
5474	static u64 releasable_read(struct cgroup cgrp, struct cftype cft)
5475	{
5476	return test_bit(CGRP_RELEASABLE, &cgrp->flags);
5477	}
5478
5479	static struct cftype debug_files[] = {
5480	{
5481	.name = "cgroup_refcount",
5482	.read_u64 = cgroup_refcount_read,
5483	},
5484	{
5485	.name = "taskcount",
5486	.read_u64 = debug_taskcount_read,
5487	},
5488
5489	{
5490	.name = "current_css_set",
5491	.read_u64 = current_css_set_read,
5492	},
5493
5494	{
5495	.name = "current_css_set_refcount",
5496	.read_u64 = current_css_set_refcount_read,
5497	},
5498
5499	{
5500	.name = "current_css_set_cg_links",
5501	.read_seq_string = current_css_set_cg_links_read,
5502	},
5503
5504	{
5505	.name = "cgroup_css_links",
5506	.read_seq_string = cgroup_css_links_read,
5507	},
5508
5509	{
5510	.name = "releasable",
5511	.read_u64 = releasable_read,
5512	},
5513
5514	{ } /* terminate */
5515	};
5516
5517	struct cgroup_subsys debug_subsys = {
5518	.name = "debug",
5519	.create = debug_create,
5520	.destroy = debug_destroy,
5521	.subsys_id = debug_subsys_id,
5522	.base_cftypes = debug_files,
5523	};
5524	#endif /* CONFIG_CGROUP_DEBUG */