[PATCH v6 00/19] Control group support

[Demi Marie Obenour <demiobenour@gmail.com>]

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
Changes in v6:
- Simplify command-line argument parsing.
- Place SPDX-FileCopyrightText before SPDX-License-Identifier, except in
  patches that already have Reviewed-by tags.
- Clean up cgroup-setup.
- Make openat2_simple() take an enum instead of a flags argument.
- Use recursive function to remove directories.  The standard library
  remove_dir_all() function is recursive, and the complexity of being
  more robust than the standard library is not worth it here.  Spectrum
  does not allow code running as non-root to create cgroups, so there is
  no security concern.
- Link to v5: https://spectrum-os.org/lists/archives/spectrum-devel/20260731-cgroups-v5-0-b325bac9d34f@gmail.com

Changes in v5:
- Rename open_subtree_raw() to open_beneath().
- Use consistent file modes.
- Avoid using O_NOFOLLOW when RESOLVE_NO_SYMLINKS is also used.
- Drop tracking of specific cgroup paths (at the cost of worse error messages).
- Have functions take &dyn AsFd where that makes sense.
- Drop exclusive vs shared lock tracking.
- Remove vm-service-run wrapper script.
- Use explicit cgroup names in VM service run and finish scripts.
- Use sed to write to cgroup.subtree_control in the root cgroup,
  avoiding a special case in cgroup-setup.
- Avoid mutating the Cgroup struct when creating child cgroups.
- Avoid mutating the Cgroup struct when purging cgroups.
- Improve documentation.
- Drop cgroup-s6-finish and call cgroup-purge directly.
- Remove support for operating on . or / in cgroup-setup.
- Fix comments.
- Link to v4: https://spectrum-os.org/lists/archives/spectrum-devel/20260721-cgroups-v4-0-46b2e5fff7b6@gmail.com

Changes in v4:
- Implement proper locking to make concurrent operations safe.
- Purge VMM cgroup in vmm service finish script.
- Delete /run/vsock/${VM}/vsock before running Cloud Hypervisor.
- Massively refactor cgroup-setup tool.
- Link to v3: https://spectrum-os.org/lists/archives/spectrum-devel/20260711-cgroups-v3-1-5cba61a20cba@gmail.com

Changes in v3:
- Remove the implicit .service suffix on leaf control groups.
- Make cgroup-setup acts as an s6 finish script when called as "finish".
- Put the VMMs in the same cgroups as the per-VM services.
- Add common helper script for the per-VM services.
- Significantly refactor the Rust code.
- Link to v2: https://spectrum-os.org/lists/archives/spectrum-devel/20260620-cgroups-v2-1-ccae224b6c85@gmail.com

Changes in v2:
- Omit resource control support.  It was completely broken, and the way
  Spectrum run scripts work means that it is better to setup resource
  controls just before the execve() into the final service process.
  This will be done by a separate tool.
- Link to v1: https://spectrum-os.org/lists/archives/spectrum-devel/20260620-cgroups-v1-1-0e5abf35101b@gmail.com

---
Demi Marie Obenour (19):
      host/rootfs: Mount filesystems before s6-rc-init
      tools: Add control group manager
      Documentation: Mention control groups
      Mount cgroup2 filesystem at /sys/fs/cgroup
      host/rootfs: Enable controllers in non-root cgroups
      host/rootfs: Add comments where cgroups are intentionally not used
      host/rootfs: serial-getty-generator: Use cgroups
      host/rootfs: systemd-udevd: Run in cgroup
      host/rootfs: weston: Run in cgroup
      host/rootfs: Set up parent cgroup for all per-VM services
      host/rootfs: Create per-VM cgroup for all of the VM's services
      host/rootfs: run-vmm: Create per-VM cgroup
      host/rootfs: run-appimage: Purge the per-VM cgroup
      host/rootfs: run-flatpak: Purge the per-VM cgroup
      host/rootfs: dbus: Run in cgroup
      host/rootfs: vhost-user-fs: Run in cgroup
      host/rootfs: vhost-user-gpu: Run in cgroup
      host/rootfs: xdg-desktop-portal-spectrum-host: Run in cgroup
      host/rootfs: spectrum-router: Run in cgroup

 .codespellrc                                       |   2 +-
 Documentation/doc/development/control-groups.adoc  |  95 ++++++++
 host/rootfs/default.nix                            |   6 +-
 host/rootfs/file-list.mk                           |  10 +
 host/rootfs/image/etc/fstab                        |   1 +
 host/rootfs/image/etc/init                         |  14 +-
 .../s6-linux-init/run-image/service/getty-tty2/run |   1 +
 .../s6-linux-init/run-image/service/getty-tty3/run |   1 +
 .../s6-linux-init/run-image/service/getty-tty4/run |   1 +
 .../run-image/service/root-terminal/run            |   1 +
 .../run-image/service/s6-linux-init-shutdownd/run  |   1 +
 .../run-image/service/s6-svscan-log/run            |   1 +
 .../service/serial-getty-generator/finish          |   5 +
 .../run-image/service/serial-getty-generator/run   |   4 +-
 .../run-image/service/serial-getty/run             |   1 +
 .../run-image/service/serial-getty/template/run    |   1 +
 .../run-image/service/vm-services/run              |   3 +
 .../vm-services/template/data/service/dbus/finish  |   5 +
 .../vm-services/template/data/service/dbus/run     |   2 +
 .../template/data/service/spectrum-router/finish   |   5 +
 .../template/data/service/spectrum-router/run      |   2 +
 .../template/data/service/vhost-user-fs/finish     |   5 +
 .../template/data/service/vhost-user-fs/run        |   5 +-
 .../template/data/service/vhost-user-gpu/finish    |   5 +
 .../template/data/service/vhost-user-gpu/run       |   2 +
 .../xdg-desktop-portal-spectrum-host/finish        |   5 +
 .../service/xdg-desktop-portal-spectrum-host/run   |   2 +
 .../run-image/service/vm-services/template/finish  |   5 +
 .../run-image/service/vm-services/template/run     |   4 +
 .../run-image/service/vmm/template/finish          |   5 +
 .../rootfs/image/etc/s6-linux-init/scripts/rc.init |   7 -
 host/rootfs/image/etc/s6-rc/systemd-udevd/finish   |   5 +
 host/rootfs/image/etc/s6-rc/systemd-udevd/run      |   5 +-
 host/rootfs/image/etc/s6-rc/weston/finish          |   5 +
 host/rootfs/image/etc/s6-rc/weston/run             |   2 +
 host/rootfs/image/usr/bin/run-appimage             |   7 +-
 host/rootfs/image/usr/bin/run-flatpak              |   7 +-
 host/rootfs/image/usr/bin/run-vmm                  |   4 +
 host/rootfs/image/usr/bin/vm-stop                  |   5 +-
 pkgs/default.nix                                   |   1 +
 tools/cgroup-setup/Cargo.lock                      |  67 +++++
 tools/cgroup-setup/Cargo.lock.license              |   2 +
 tools/cgroup-setup/Cargo.toml                      |  10 +
 tools/cgroup-setup/default.nix                     |  22 ++
 tools/cgroup-setup/src/cgroup.rs                   | 269 +++++++++++++++++++++
 tools/cgroup-setup/src/main.rs                     | 167 +++++++++++++
 46 files changed, 765 insertions(+), 20 deletions(-)
---
base-commit: a7762d6f54b40560dd5255ce902e6e6a5d980fe9
change-id: 20260528-cgroups-d609e270e649

-- 
Sincerely,
Demi Marie Obenour (she/her/hers)