)]}' { "log": [ { "commit": "c1b42f79d157aa900be5cbb0c1023f1479962aa7", "tree": "e77242477ecd08a768cd63ba73c6ae1b711a0773", "parents": [ "175f09d38ecf97bd1fdff4b600fda031c4a8439a" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Aug 23 14:59:00 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Aug 23 14:59:00 2024 -0400" }, "message": "[docs] Add public docs for Cgroups v2.\n\nCurrently there is no official documentation outlining the changes\nwe have been making to support Cgroups v2.\n\nWe add a main document outlining how Mesos interacts with Cgroups v2,\nand update some documents on the changes that were made, such as\nthe device isolator document.\n\nReview: https://reviews.apache.org/r/75191/\n" }, { "commit": "175f09d38ecf97bd1fdff4b600fda031c4a8439a", "tree": "05a4aab3e9307daeabd0fad5f71e4ec21d2f25e8", "parents": [ "59d82a75aa9f7b8f41cd26ca95147b26ccaf3e5f" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Aug 23 12:50:10 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Aug 23 12:50:10 2024 -0400" }, "message": "[gpu] Let NvidiaGpuIsolatorProcess support nesting.\n\nThe NvidiaGpuIsolatorProcess currently still does not declare itself\nto support nesting because nested containers were not supported for\nthe cgroups2 isolator.\n\nNested container support was added for cgroups2 isolator in:\nhttps://reviews.apache.org/r/75177/\n\nAs such we will declare NvidiaGpuIsolatorProcess to be good for nesting.\n\nReview: https://reviews.apache.org/r/75190/\n" }, { "commit": "59d82a75aa9f7b8f41cd26ca95147b26ccaf3e5f", "tree": "c1d48c3091bfa4eebfd407e402b205e39c031cfe", "parents": [ "d2334cd7a03467a80f791c30ebd0430563af5cb1" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Aug 23 12:49:24 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Aug 23 12:49:24 2024 -0400" }, "message": "[cgroups2] Remove completed todos.\n\nThe Todos mention recovery support for the device manager, and to use\nthe device manager recover in the device controller process.\n\nWe have added checkpointing and recovery support in:\nhttps://reviews.apache.org/r/75145\n\nWe also only use the device manager recovery in the cgroups2 isolator\ninstead of in the device controller, as implemented in:\nhttps://reviews.apache.org/r/75149/\n\nAs such, these todos are considered completed, and can be removed.\n\nReview: https://reviews.apache.org/r/75189/\n" }, { "commit": "d2334cd7a03467a80f791c30ebd0430563af5cb1", "tree": "fedf3c555c99517e2b8598af78758b21178f0b27", "parents": [ "5ced8784963034364fab2ebb83ed10c46f15b258" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Thu Aug 22 19:14:57 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Aug 22 19:14:57 2024 -0400" }, "message": "[io] Fix warnings during compilation.\n\nCurrently we have a warning that occurs on compilation about comparison\nbetween unsigned long and long. We update the tests to suppress this\nwarning.\n\nReview: https://reviews.apache.org/r/75187/\n" }, { "commit": "5ced8784963034364fab2ebb83ed10c46f15b258", "tree": "84e8ac2dd241754a98623907118f571cb77fda24", "parents": [ "9d187ce7f2fa7f3aa7416d541e3741aeb03951ba" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Thu Aug 22 16:20:07 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Aug 22 16:21:56 2024 -0400" }, "message": "[cgroups2] Use OomListener in MemoryControllerProcess.\n\nThe MemoryControllerProcess needs an OomListener to ensure that it does\nnot need to listen for oom events by polling, which causes race\nconditions with the oom killer.\n\nWe spawn an OomListener in the MemoryControllerProcess and use it\nto listen for oom events in any cgroup via oomListen().\n\nReview: https://reviews.apache.org/r/75185/\n" }, { "commit": "9d187ce7f2fa7f3aa7416d541e3741aeb03951ba", "tree": "bcfc0c128b16ba7988accb4cc6a6ddf1521509e7", "parents": [ "f91140d959fd9b92913c78a1c6329095d53fe0e5" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Thu Aug 22 16:02:11 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Aug 22 16:19:23 2024 -0400" }, "message": "[cgroups2] Introduce an OomListener.\n\nWe add an OomListener process to allow users to listen for oom events\nin a cgroup or any of its descendants.\n\nIf the OomListener is terminated, any remaining unsatisfied futures will\nbe failed.\n\nIf the listened cgroup or any of its descendants encounters an oom\nevent, then the returned future from listen() will become ready, and\naction can be taken upon the oom event via future onReady handlers.\n\nThe caller can also discard a returned future to stop listening for\nevents.\n\nReview: https://reviews.apache.org/r/75184/\n" }, { "commit": "f91140d959fd9b92913c78a1c6329095d53fe0e5", "tree": "981c22a0d5f0ffa5073acf9ac5ddfef517d2b244", "parents": [ "23703fbb3d9deac3d50a74b67afac2b002d8fd37" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Thu Aug 22 13:38:52 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Aug 22 13:38:52 2024 -0400" }, "message": "[build] Fix cmake build / tidybot.\n\nThe cmake build and therefore tidybot are failing because they cannot\nfind the device manager protobuf files, we will run protobuf for\ndevice_manager/state.proto to generate the files.\n\nReview: https://reviews.apache.org/r/75186/\n" }, { "commit": "23703fbb3d9deac3d50a74b67afac2b002d8fd37", "tree": "03b88dedcc6beec7a2b2d4c9547971e1c8538458", "parents": [ "8ff65defebebb885dec2f0162dfa3d2a17334309" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Tue Aug 20 18:02:22 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Tue Aug 20 19:02:36 2024 -0400" }, "message": "[libprocess] Add io::Watcher for fs notifications.\n\nAdds basic watcher class for filesystem watch notifications. We\ncurrently only support Linux with inotify.\n\nWe currently support inotify events for writing, deleting, and renaming\na file. We do not support watching directories.\n\nReview: https://reviews.apache.org/r/75182/\n" }, { "commit": "8ff65defebebb885dec2f0162dfa3d2a17334309", "tree": "86f8362f11572b2bf6fbdfcdf3336c488843b910", "parents": [ "36e89c7bbb217c62603f1a3fe496f8fd91849ce0" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Aug 16 18:07:42 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Aug 16 18:24:32 2024 -0400" }, "message": "[cgroups2] cgroups2::destroy retry rmdir on EBUSY.\n\nCurrently we only wait until a cgroup\u0027s pids (retrieved from\ncgroup.procs) is empty. However even if a cgroup\u0027s pids are empty the\nrmdir call on it may still return EBUSY, causing us to fail the destroy\noperation. We want to retry the rmdir operation even on EBUSY for up to\n5 seconds to ensure that we are able to delete the cgroup.\n\nThis approach is similar to how crun is destroying its cgroups.\nsee:\n\nhttps://github.com/containers/crun/blob/10b3038c1398b7db20b1826f94e9d4cb444e9568/src/libcrun/cgroup-utils.c#L471\n\nReview: https://reviews.apache.org/r/75181/\n" }, { "commit": "36e89c7bbb217c62603f1a3fe496f8fd91849ce0", "tree": "63dafc1b02d90e941d498f1fea1e18ddb6abde99", "parents": [ "c575673d64979bd4483bb9c589a875dba00e2caa" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Aug 16 14:09:55 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Aug 16 14:10:34 2024 -0400" }, "message": "[cgroups2] Enable support for nested containers in the isolator.\n\nWe enable support for nested containers on systems with cgroups v2 with\nthis patch. This means that nested containers will now have their\ncgroups created for them, and that the cgroups2 isolator functions will\nbe called for nested containers.\n\nReview: https://reviews.apache.org/r/75177/\n" }, { "commit": "c575673d64979bd4483bb9c589a875dba00e2caa", "tree": "a983ab385e3cbd3b0c857a247fcd2e4e58413686", "parents": [ "2117d780291102b247b338f80a07c9b41b930f50" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Aug 16 13:57:58 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Aug 16 14:08:48 2024 -0400" }, "message": "[cgroups2] Perform chown of cgroup if necessary.\n\nIn cgroups1, we chown for nested cgroups so that they can create deeper\nlayers of cgroups. We want to replicate this behavior in cgroups2.\n\nReview: https://reviews.apache.org/r/75178/\n" }, { "commit": "2117d780291102b247b338f80a07c9b41b930f50", "tree": "3d9e70f0612c5cef142faccb7d7022130349ab00", "parents": [ "241bc6df2ab61dbbffa0ae6c2a0c0de85a778bf4" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Aug 16 13:56:17 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Aug 16 13:56:17 2024 -0400" }, "message": "[cgroups2] Handle unknown containers in watch().\n\nIn cgroups1, we returned a pending future for containers that shared\ncgroups with their parents.\n\nIn cgroups2, since we always create cgroups for our containers, we no\nlonger need to consider this special case. So we only return failure\nif there is an unknown container.\n\nReview: https://reviews.apache.org/r/75176/\n" }, { "commit": "241bc6df2ab61dbbffa0ae6c2a0c0de85a778bf4", "tree": "408a5dae8539ed75863b5c61c457c716964ebd00", "parents": [ "077ee99da7cd35b44e5926637238a4c681f2d516" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Thu Aug 15 18:33:22 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Aug 15 18:37:29 2024 -0400" }, "message": "[cgroups2] Make isolator status() return parent status for containers w/ !isolate.\n\nIn cgroups1, if a container is sharing cgroups with its parents, we will\nreturn the parent\u0027s status.\n\nIn cgroups2, we want to mimic this behavior even though we always create\ncgroups for our containers. Since we do not do anything with our\ncontainer\u0027s cgroup if isolate \u003d\u003d false.\n\nReview: https://reviews.apache.org/r/75175/\n" }, { "commit": "077ee99da7cd35b44e5926637238a4c681f2d516", "tree": "632b2cef6b9a123d70df16282efb7bf629088411", "parents": [ "648d003a44243dc39519a83c917f89927d2c162b" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Thu Aug 15 18:29:51 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Aug 15 18:31:16 2024 -0400" }, "message": "[cgroups2] Make isolator update() fail for containers that don\u0027t need isolation.\n\nIn cgroups1, we returned an error when we see that the container is\nsharing cgroups, as it would have no cgroups for update() to take.\n\nIn cgroups2 we will mimick this behavior for containers that do not\nwish to have their own resource constraints, as we do not expect to call\nupdate() on those containers.\n\nReview: https://reviews.apache.org/r/75174/\n" }, { "commit": "648d003a44243dc39519a83c917f89927d2c162b", "tree": "c33955f8521655b678ccfc4aba802b9f2d61f673", "parents": [ "65d246fe82093fdf393d4379917872a9d839fc9c" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Thu Aug 15 18:25:06 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Aug 15 18:26:43 2024 -0400" }, "message": "[cgroups2] Only call isolate() on controllers of containers with isolate \u003d\u003d true.\n\nIn cgroups1, when handling nested containers that share cgroups, we\nskip isolate calls for them. We want to replicate this behavior in\ncgroups2.\n\nReview: https://reviews.apache.org/r/75173/\n" }, { "commit": "65d246fe82093fdf393d4379917872a9d839fc9c", "tree": "7bf489fef76dfa3f6b23d488bcf17f8fe8c7972d", "parents": [ "721ce9060c9c7943799a034ae4428c2fa51ffea1" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Thu Aug 15 18:22:15 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Aug 15 18:22:15 2024 -0400" }, "message": "[cgroups2] Do DEBUG container check after creating cgroup for it.\n\nSince we create cgroups for all containers, we will create the DEBUG\ncontainer. We expect the DEBUG containers to not have its own resource\ncontraints, so we will return __prepare early before reaching the\nCHECK.\n\nReview: https://reviews.apache.org/r/75172/\n" }, { "commit": "721ce9060c9c7943799a034ae4428c2fa51ffea1", "tree": "01b4851429801674e7f3980b7d2cfffa86b117ad", "parents": [ "7a5040fb77ffdc2c3aadcc36f5337fd274519470" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Thu Aug 15 18:08:48 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Aug 15 18:11:22 2024 -0400" }, "message": "[cgroups2] Separate responsibility for creating cgroup and assigning pids.\n\nIn cgroups2, the current linux launcher does not create cgroups nor does\nit move the pids into the container\u0027s leaf cgroup during fork().\n\nWhen we launch a container, we first prepare it via the isolators,\nthen the launcher will call fork to, among other things, move the pid\ninto its appropriate cgroup. Once the fork is over, isolate() is called\non the isolators.\n\nAs such, we will remove the cgroups2 isolator\u0027s current behavior of\nassigning pids into leaf cgroups as it is already done by the linux\nlauncher.\n\nReview: https://reviews.apache.org/r/75170/\n" }, { "commit": "7a5040fb77ffdc2c3aadcc36f5337fd274519470", "tree": "b43db52ebb2eba612742b0e78347916aebd5e8ea", "parents": [ "4e556e6c7060098ec2b0710406bcd8df24d676f6" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Thu Aug 15 17:59:34 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Aug 15 18:05:18 2024 -0400" }, "message": "[cgroups2] Enforce use of linux launcher with cg2 isolator.\n\nCurrently we are not checking that the cgroups isolator is being used\nwith the linux launcher. We need to ensure that if the linux launcher\nis being used, the cgroups isolator is also being used so that the\ncgroups for the containers can be made inside the isolator\u0027s prepare().\n\nReview: https://reviews.apache.org/r/75171/\n" }, { "commit": "4e556e6c7060098ec2b0710406bcd8df24d676f6", "tree": "f55a9da8335ece0cd696a9357755e5979e20f482", "parents": [ "7918b06c11302f6c614ade51d4b327580588ac71" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Wed Aug 14 19:53:16 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Aug 14 19:53:16 2024 -0400" }, "message": "[cgroups2] Add isolate field for nested containers.\n\nCurrently we do not support nested containers. We need to let nested\ncontainers pick whether they want their own resource constraints based\non the LinuxInfo::share_cgroups field in the API.\n\nIn cgroups v1, we didn\u0027t need to track an additional field for this,\nbecause the isolator does not store nested containers within its `infos`\nmap.\n\nIn cgroups v2, we will *always* create cgroups for nested containers,\nand LinuxInfo::share_cgroups instead specifies whether these cgroups\nwill have resource isolation applied to them. (LinuxInfo::share_cgroups\nneeds to be renamed accordingly).\n\nIn later patches, we will use this to skip the update and isolate\ncalls on the controllers if isolate \u003d\u003d false.\n\nReview: https://reviews.apache.org/r/75167/\n" }, { "commit": "7918b06c11302f6c614ade51d4b327580588ac71", "tree": "dca5dd0eebe7884ad7ed9af579413a56ea09be77", "parents": [ "49ab7d382f4b3d694093f255217dc2783fe73cb7" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Tue Aug 13 17:32:06 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Tue Aug 13 17:39:00 2024 -0400" }, "message": "[cgroups2] Enable controller in parent cgroups during prepare().\n\nTo support nested containers with nested cgroups, we need to enable\ncontrollers in cgroup.subtree_control file for the appropriate nested\ncgroup.\n\nTo do so, we need to ensure that the parents have the the requested\ncontroller in their cgroup.subtree_control file so that the nested\ncgroup can have the controller written into subtree_control as well.\nOtherwise we will get a \u0027no such file or directory\u0027 error.\n\nReview: https://reviews.apache.org/r/75166/\n" }, { "commit": "49ab7d382f4b3d694093f255217dc2783fe73cb7", "tree": "42a78fac641e209ceb6fd684a9d8955e644ceeec", "parents": [ "8d9048a4c27aad4e343d7d49d2539e6dec895e68" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Mon Aug 12 17:39:51 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Mon Aug 12 17:45:14 2024 -0400" }, "message": "[cgroups2] Recover device manager with cgroups2 isolator.\n\nThis patch lets us call the device manager\u0027s recovery function after\nthe containers from recovery_state have been successfully recovered.\nAllowing us to begin recovering the cgroup device access state for each\nrecovered non-orphan container.\n\nReview: https://reviews.apache.org/r/75149/\n" }, { "commit": "8d9048a4c27aad4e343d7d49d2539e6dec895e68", "tree": "7d9513b46651e6b481cfcae07f1d70f6ad7fa2a6", "parents": [ "67fbd1436838dcbb77e64a2c5423c33e8ea00ccb" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Mon Aug 12 17:04:09 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Mon Aug 12 17:36:15 2024 -0400" }, "message": "[cgroups2] Add device manager recovery support.\n\nWe currently do not have any method of recovering the device access\nstates when the cgroups2 isolator is atempting to recover containers.\n\nWe add a recovery state here that makes use of the protobuf checkpoint\nfiles to ensure that the previous device accesses of cgroups can be\nrestored. It will be used by the cgroups2 isolator.\n\nReview: https://reviews.apache.org/r/75145/\n" }, { "commit": "67fbd1436838dcbb77e64a2c5423c33e8ea00ccb", "tree": "72332623d5610c0f0513984817703b0df2fbb818", "parents": [ "76e235c815b097bc5260b368a11152b0f1c19fdf" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Mon Aug 12 16:56:11 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Mon Aug 12 17:01:51 2024 -0400" }, "message": "[cgroups2] Fix ROOT_CGROUPS_AutoLoadSubsystems test.\n\nCurrently, the ROOT_CGROUPS_AutoLoadSubsystems test is failing because\nit is checking for hierarchies for subsystems enabled under\n\u0027cgroups/all\u0027. In cgroups2 we cannot perform this check because of the\nunified hierarchy.\n\nHence we skip this hierarchy check and instead check that all available\ncgroups2 controllers are enabled by reading cgroup.controllers and\ncgroup.subtree_control.\n\nReview: https://reviews.apache.org/r/75163/\n" }, { "commit": "76e235c815b097bc5260b368a11152b0f1c19fdf", "tree": "b43a05c12607681309788645b1eb6323f82a8e82", "parents": [ "b9db5c4e66434d8f01d9d5cbfb24ef7a3aa29c80" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Mon Aug 12 16:51:20 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Mon Aug 12 16:54:45 2024 -0400" }, "message": "[cgroups2] Create memory controller using cgroups/all flag.\n\nCurrently, we cannot use the cgroups/all flag to its corresponding\ncontrollers in cgroups2.\n\nThe flag causes us to grabs all the values in the cgroup.controllers\nfile. But we should instead just add all the creators when we see\ncgroups/all, as many controllers are no longer present in\ncgroup.controllers in cgroups v2.\n\nThis fix incidentally fixes the\nROOT_CGROUPS_AgentRecoveryWithNewCgroupSubsystems test as it was unable\nto create the memory controller using cgroups/all flag.\n\nReview: https://reviews.apache.org/r/75162/\n" }, { "commit": "b9db5c4e66434d8f01d9d5cbfb24ef7a3aa29c80", "tree": "6a44d212849e7f1ed16f10ef8ea292da35f97ed3", "parents": [ "77488693688eab16941c6807af02dafdac25dbcc" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Aug 09 18:06:23 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Aug 09 18:06:23 2024 -0400" }, "message": "[cgroups2] Fix ROOT_CGROUPS_MemoryForward for cgroups2.\n\nThe ROOT_CGROUPS_MemoryForward test is currently failing because it is\nlooking for the memory hierarchy, which no longer exists in cgroups2 due\nto the new unified hierarchy.\n\nWe skip this hierarchy check if we detect cgroups2 is mounted on the\nsystem.\n\nReview: https://reviews.apache.org/r/75161/\n" }, { "commit": "77488693688eab16941c6807af02dafdac25dbcc", "tree": "a0c1414341ec97b3113ef41d245c947060444fec", "parents": [ "2d22c120f3585c993d03182f19c56c31ccb8318d" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Aug 09 18:04:09 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Aug 09 18:05:06 2024 -0400" }, "message": "[cgroups2] Register core controller in container info.\n\nCurrently the core controller is skipped over during prepare(),\nand it is not added to the container\u0027s registered controlelrs.\n\nWe need to register the core controller so that its functions can be\ncalled by the isolator.\n\nReview: https://reviews.apache.org/r/75159/\n" }, { "commit": "2d22c120f3585c993d03182f19c56c31ccb8318d", "tree": "5d816fdc7a97f734ceca85a0708e76329639fbb2", "parents": [ "5c7c87cfbf334eb380f03e19b1daee620649ec37" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Aug 09 18:02:11 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Aug 09 18:02:11 2024 -0400" }, "message": "[cgroups2] Collect process \u0026 thread from leaf groups.\n\nCurrently, our core controller usage() function try to read the cgroup\nfiles in the argument cgroup. However, in our design for cgroups v2,\nprocesses and threads live in the leaf child of a cgroup. Hence the\nusage collection will not find the actual processes and threads for a\ncgroup if it\u0027s not already specified as a leaf group.\n\nThis patch adds a check to see if the argument cgroup is a leaf cgroup,\nand will search for processes and threads in the leaf cgroup instead.\n\nReview: https://reviews.apache.org/r/75158/\n" }, { "commit": "5c7c87cfbf334eb380f03e19b1daee620649ec37", "tree": "dc55bfcf75a9941052509414a6f97f8fe59e60cb", "parents": [ "87e377e0e6b04441bfe9108e9a06e0f7e3608887" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Aug 09 18:01:09 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Aug 09 18:01:09 2024 -0400" }, "message": "[paths] Simplify paths::cgroups2::containerId() logic.\n\nCurrently we are tokenizing the cgroup argument when we could be\ndirectly operating on the string using our strings utility helpers\ninstead.\n\nThis patch replaces the tokenizing logic to using the strings library.\n\nReview: https://reviews.apache.org/r/75160/\n" }, { "commit": "87e377e0e6b04441bfe9108e9a06e0f7e3608887", "tree": "c8f0a9e5d9ad3b082014d5b6ec1070cd5922bc30", "parents": [ "9ffed5ee93f8b5467635a830461914791609c38e" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Aug 09 13:55:42 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Aug 09 13:59:00 2024 -0400" }, "message": "[cgroups2] Prevent containerId from prepending cgroup root during recovery.\n\nCurrently, CgroupsIsolatorTest.ROOT_CGROUPS_PERF_PerfForward fails\nduring recovery because it cannot create the directory for the recovered\ncontainer. This happens because the original containerId, when\nrecovered, includes the cgroup root. The function that converts a cgroup\nto a containerId does not ignore the cgroup root, even though we do not\nexpect it to be included.\n\nTo fix this, we will remove the first token of the cgroup if it matches\nthe cgroup root. This will prevent attaching an extraneous cgroup root\nto the containerId when parsing it from a cgroup.\n\nReview: https://reviews.apache.org/r/75156/\n" }, { "commit": "9ffed5ee93f8b5467635a830461914791609c38e", "tree": "3317aca7fd554d847519dd5120a014780763951e", "parents": [ "bcb4a30501e9e459a8b9952a659bd95a9ed0273c" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Aug 09 13:20:48 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Aug 09 13:20:48 2024 -0400" }, "message": "[build] Fix compilation error from cherry picks.\n\nMinor fix to allow current builds to progress again.\n\nReview: https://reviews.apache.org/r/75157/\n" }, { "commit": "bcb4a30501e9e459a8b9952a659bd95a9ed0273c", "tree": "11417eccd1791ff773feb8f84eb388393c3e2b1b", "parents": [ "a127cb42e70f8be06afe997fce6307ac74aa71bc" ], "author": { "name": "Jason Zhou", "email": "jasonzhou@twitter.com", "time": "Thu Aug 08 13:27:57 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Aug 08 18:29:17 2024 -0400" }, "message": "[pids] Introduce the PidsControllerProcess\n\nIntroduces the PidsControllerProcess.\nHosts correctly configured for cgroups v2 and provide cgroups/pids\nin the isolation flag and pids in the agent_subsystems flag\nwill use this controller.\n\nReview: https://reviews.apache.org/r/75154\n" }, { "commit": "a127cb42e70f8be06afe997fce6307ac74aa71bc", "tree": "1a5231a2f3dad081fd1e2351aabf71c5af4986de", "parents": [ "22f63e4fde7f670c09f3d97c4233ef8ce7b90024" ], "author": { "name": "Jason Zhou", "email": "jasonzhou@twitter.com", "time": "Thu Aug 08 13:14:22 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Aug 08 18:28:43 2024 -0400" }, "message": "[cpuset] Introduce the CpusetControllerProcess\n\nHosts correctly configured for cgroups v2 and provide cgroups/cpuset\nin the isolation flag and cpuset in the agent_subsystems flag\nwill use this controller.\n\nReview: https://reviews.apache.org/r/75153\n" }, { "commit": "22f63e4fde7f670c09f3d97c4233ef8ce7b90024", "tree": "1af935cd156a5d11982ac76a0ef29843d15a97cc", "parents": [ "bff44aeecefee54795dfa3fcfe61cb7b929655fd" ], "author": { "name": "Jason Zhou", "email": "jasonzhou@twitter.com", "time": "Mon Jul 22 11:11:25 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Aug 08 18:28:32 2024 -0400" }, "message": "[hugetlb] Introduce the HugeTLBControllerProcess\n\nIntroduces the `HugeTLBControllerProcess`.\nHosts correctly configured for cgroups v2 and provide `cgroups/hugetlb`\nin the `isolation` flag and `hugetlb` in the `agent_subsystems` flag\nwill use this controller.\n\nReview: https://reviews.apache.org/r/75152\n" }, { "commit": "bff44aeecefee54795dfa3fcfe61cb7b929655fd", "tree": "27b54a1eee6cc4be099838b352ba00a95d58f956", "parents": [ "0d484a2e46d98a271e6db7e4d291284c381176f1" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Thu Aug 08 18:01:33 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Aug 08 18:01:33 2024 -0400" }, "message": "[cgroups2] Introduce the IoControllerProcess\n\nIntroduces the IoControllerProcess.\n\nThis replaces the blkio controller from cgroups v1.\nWe currently only use it to helps us work with the cgroups/all isolation flag.\n\nReview: https://reviews.apache.org/r/75155/\n" }, { "commit": "0d484a2e46d98a271e6db7e4d291284c381176f1", "tree": "50d39589489d1eb41110d39c13fbda156497f2d5", "parents": [ "b6e2e0bff1098088cdc5daf79a6c9baeb6312dfc" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Thu Aug 08 12:53:43 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Aug 08 12:54:53 2024 -0400" }, "message": "[device manager] Add args to customize commit_device_access_changes behavior.\n\nCurrently, commit_device_access_changes always checkpoints the\ndevice manager state **and** configures the bpf programs for the cgroup\nbased on its device access state.\n\nWe add an argument to commit_device_access_changes for the caller to\ndetermine whether they want the state to be checkpointed along with\nattaching the ebpf program.\n\nReview: https://reviews.apache.org/r/75148/\n" }, { "commit": "b6e2e0bff1098088cdc5daf79a6c9baeb6312dfc", "tree": "b5f20cb2024b5b9791467a139480b5258c44eef6", "parents": [ "043c6aa8c76c997354a6a46cb0823db6dcbde91e" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Wed Aug 07 14:44:12 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Aug 07 14:46:15 2024 -0400" }, "message": "[device manager] Checkpoint state on device manager state change.\n\nCurrently we do not checkpoint the device access state of each cgroup\nwhen the configure or reconfigure is called. Meaning that we have\nno way of recovering a cgroup\u0027s device access state.\n\nWe will checkpoint state of the device manager whenever its state\nis being changed to ensure that we can recover the most recent state\nwhen necessary.\n\nReview: https://reviews.apache.org/r/75143/\n" }, { "commit": "043c6aa8c76c997354a6a46cb0823db6dcbde91e", "tree": "715d2cf2e1f5801bb6121f41bf8e84f2d37de288", "parents": [ "9dedc69119a668343c60e1429f50716a8e27879b" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Wed Aug 07 14:40:41 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Aug 07 14:41:44 2024 -0400" }, "message": "[device manager] Add device state file path helper.\n\nCurrently we do not have a place to keep the checkpoint file for the\ndevice manager.\n\nThis patch adds a path helper that gives us a file that lets us\ncheckpoint the device manager state.\n\nReview: https://reviews.apache.org/r/75142/\n" }, { "commit": "9dedc69119a668343c60e1429f50716a8e27879b", "tree": "1b4a4b2a95be3ea38077cdd02cd15a91806e2f3f", "parents": [ "fd0dc978542cdd7c976fee564e635e55d0f175fb" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Tue Aug 06 17:23:16 2024 -0700" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Tue Aug 06 17:23:16 2024 -0700" }, "message": "[device manager] Add protobuf for cgroup state checkpointing.\n\nCurrently the device manager has no means of recovering its state\nafter an agent restarts. This patch aims to add a protobuf definition\nto let the device manager have a checkpoint file that it can use to\nrecover each cgroup\u0027s device access state.\n\nReview: https://reviews.apache.org/r/75141/\n" }, { "commit": "fd0dc978542cdd7c976fee564e635e55d0f175fb", "tree": "fc214bce71679b9a8d544f961116c49787fafb45", "parents": [ "2c0f1bc917b47316266ef81e77c9ceb0f0539280" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Sat Aug 03 11:38:20 2024 -0700" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Sat Aug 03 12:40:10 2024 -0700" }, "message": "[cgroups2] Support DeviceManager in GPU isolator.\n\nCurrently, the GPU isolator assumes we are only using cgroups v1, and\nmakes use of the cgroups::devices::allow and deny functions to control\nGPU access.\n\nIn Cgroups2, we need to attach ebpf programs for the specific cgroups,\nwhich is done for us in the DeviceManager. Hence, we need to use the\nDeviceManager in the GPU isolator depending on whether cgroups v1 or v2\nis currently mounted.\n\nReview: https://reviews.apache.org/r/75074/\n" }, { "commit": "2c0f1bc917b47316266ef81e77c9ceb0f0539280", "tree": "4d9cc60a330c9fd5279dfb655aeec6f04077c02f", "parents": [ "067e14e8218acc1b95652b0452663e0c36c11043" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Aug 02 10:09:44 2024 -0700" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Aug 02 10:26:19 2024 -0700" }, "message": "[device manager] Add wildcard conversion helper.\n\nWe currently have a wildcard conversion helper but it was only\navailable for use inside the device manager test file.\n\nThis change pulls out the helper and makes it available as a static\nfunction for use outside just tests.\n\nReview: https://reviews.apache.org/r/75137/\n" }, { "commit": "067e14e8218acc1b95652b0452663e0c36c11043", "tree": "d226b9c884154606bef59cc37a407aac3c6ad93d", "parents": [ "e16fcd93734906bde8bc0847b271f3bd70165668" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Thu Aug 01 14:11:45 2024 -0700" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Aug 01 14:14:14 2024 -0700" }, "message": "[device manager] Let non-wildcards entries check device access.\n\nCurrently, we only allow normal Entry instances for checking whether a\ndevice access would be allowed for a cgroup.\n\nWe want to also allow NonWildcardEntry instances to do this as well.\n\nReview: https://reviews.apache.org/r/75135/\n" }, { "commit": "e16fcd93734906bde8bc0847b271f3bd70165668", "tree": "39f48d3fc4053b899a970944231053fa6c390bec", "parents": [ "5bed66c009a5b3c5670e3b7a5c0adae87b58417a" ], "author": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jul 31 16:59:50 2024 -0700" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jul 31 16:59:50 2024 -0700" }, "message": "[cgroups2] Silence incorrect compiler error in the tests.\n" }, { "commit": "5bed66c009a5b3c5670e3b7a5c0adae87b58417a", "tree": "bc674a47c34f41f092aa1f1e17c89c37050c3af6", "parents": [ "2f545b11253800c33fa4d1fde073227deb772f89" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Wed Jul 31 15:53:15 2024 -0700" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jul 31 15:53:15 2024 -0700" }, "message": "[cgroups2] Skip enabling of devices controller.\n\nSimilar to the `perf_event` controller, the `devices` controller cannot\nbe written into cgroup.subtree_control file, so we skip the call to\ncgroups2::controllers::enable for the device controller. Otherwise\nwe will run into an \"Invalid argument\" error from cgroups.\n\nReview: https://reviews.apache.org/r/75130/\n" }, { "commit": "2f545b11253800c33fa4d1fde073227deb772f89", "tree": "0657739c404c7566c22f6156d1f3eb4606f3dfef", "parents": [ "8038681524f9b0efaacf77e09e7933ea7ca999ee" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Wed Jul 31 15:51:32 2024 -0700" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jul 31 15:51:32 2024 -0700" }, "message": "[cgroups2] create device controller in Cgroups2Isolator.\n\nDeviceController needs to be created in Cgroups2Isolator with the\nDeviceManager so that the default whitelist can be properly configured.\n\nReview: https://reviews.apache.org/r/75121/\n" }, { "commit": "8038681524f9b0efaacf77e09e7933ea7ca999ee", "tree": "ea1981a006aa785b06fa9182d3ebff3b384be2f3", "parents": [ "b8936677f99ab10e4210f9b72c8a6be228aa43c5" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Wed Jul 31 15:27:47 2024 -0700" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jul 31 15:48:28 2024 -0700" }, "message": "[cgroups2] Introduces the DeviceControllerProcess.\n\nIntroduces a device controller that supports cgroups v2 and is available\nin the Cgroups2IsolatorProcess. Device access control is made through\nthe DeviceManager.\n\nReview: https://reviews.apache.org/r/75098/\n" }, { "commit": "b8936677f99ab10e4210f9b72c8a6be228aa43c5", "tree": "5b4f8059886d0f06ea5ea697fee1277e85526ae8", "parents": [ "d5ab9a20b1b39ef74bed0468ee54ea2cd20ee24c" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Wed Jul 31 15:19:06 2024 -0700" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jul 31 15:25:03 2024 -0700" }, "message": "[cgroups2] Pass device manager to controllers \u0026 cgroups2 isolator.\n\nPasses the device manager to the cgroups2 isolator on containerizer\nstartup, and sets up the ability for the manager to be passed to the\ndevice controller and GPU isolator.\n\nReview: https://reviews.apache.org/r/75016/\n" }, { "commit": "d5ab9a20b1b39ef74bed0468ee54ea2cd20ee24c", "tree": "57ce7b53ae5398eabdaba06f19212db15a98aad1", "parents": [ "60283f0a27edfb54c2d1c39aee20a3fabbc88ae5" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Wed Jul 31 15:15:34 2024 -0700" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jul 31 15:18:19 2024 -0700" }, "message": "[devices] Add ability to remove cgroup from DeviceManager state.\n\nWhen destroy() is called on a container, its cgroup and its children\nwill be cleaned up. We need to remove the cgroup from the device manager\nstate when this happens to ensure that the state is accurate.\n\nReview: https://reviews.apache.org/r/75120/\n" }, { "commit": "60283f0a27edfb54c2d1c39aee20a3fabbc88ae5", "tree": "d305203207ff85f758f00812e8abc107d0708300", "parents": [ "3aab3999d0d6a8da8fc23d2b5827e7d5986d9b1b" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Wed Jul 31 13:04:38 2024 -0700" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jul 31 13:05:36 2024 -0700" }, "message": "[reviewbot] Fix reviewbot build error.\n\nCurrently, reviewbot is failing from a \u0027control reaches end of non-void\nfunction\u0027 error due to a switch case inside a lambda in the device\nmanager code. We use an UNREACHABLE macro to stop this error.\n\nReview: https://reviews.apache.org/r/75128/\n" }, { "commit": "3aab3999d0d6a8da8fc23d2b5827e7d5986d9b1b", "tree": "cce8563a6de21afa5161762cad46f8872ab7ec00", "parents": [ "e29cf7bb9f26ceec418c1880c6fa73c352bc5fcb" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Jul 26 22:39:41 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jul 26 22:39:41 2024 -0400" }, "message": "[style] Add newlines for readability.\n" }, { "commit": "e29cf7bb9f26ceec418c1880c6fa73c352bc5fcb", "tree": "90f6294638454cdea6e6bd0883849af150725e3b", "parents": [ "13000010e07bf6e2cad5c04cf58546f18bb66e3a" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Jul 26 22:38:33 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jul 26 22:38:33 2024 -0400" }, "message": "[devices] Fix DeviceManager tests.\n\nChanges when merging previous changes caused some DeviceManager\ntestcases to fail.\n\nThis patch updates the tests to pass it.\n\nReview: https://reviews.apache.org/r/75117/\n" }, { "commit": "13000010e07bf6e2cad5c04cf58546f18bb66e3a", "tree": "df9653ccc013f9d77b7716c78f7099d52a0a5f76", "parents": [ "fc25362836f7b3c922bdb13497dbbcbaeea10c20" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Jul 26 18:19:25 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jul 26 18:28:35 2024 -0400" }, "message": "[devices] Add CgroupDeviceAccess::create helper which checks normalization.\n\nCurrently, CgroupDeviceAccess instances can be directly constructed\nwithout verifying that its allow and deny lists are normalized.\n\nTo codify our normalization constraints, CgroupDeviceAccess can now only\nbe created with a create() helper.\n\nReview: https://reviews.apache.org/r/75116/\n" }, { "commit": "fc25362836f7b3c922bdb13497dbbcbaeea10c20", "tree": "d1e583b8acb2a8068dc14e42533be56ae3e5232e", "parents": [ "e9bab29626da4de1293eaa1c916b9b15a89c94ff" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Jul 26 17:28:57 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jul 26 17:31:47 2024 -0400" }, "message": "[devices] Enforce normalization for DeviceManager configure \u0026 reconfigure.\n\nCurrently in the configure() and reconfigure() functions in device\nmanager, we do not ensure that the device access state at the end of the\nfunction call is normalized. So we incorporate normalized() and\nnormalize() calls to ensure that the allow and deny lists are always\nnormalized at the end of a configure() or reconfigure() call.\n\nReview: https://reviews.apache.org/r/75115/\n" }, { "commit": "e9bab29626da4de1293eaa1c916b9b15a89c94ff", "tree": "43df04d2afd03b296f6df6ffc23b7322efe7c2ae", "parents": [ "2458d2f9d367f4b4b6a7a79da24bf45ca6f7ebcb" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Jul 26 17:24:17 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jul 26 17:28:33 2024 -0400" }, "message": "[cgroups2] Enforce normalization in configure.\n\nWe currently do not enforce normalized allow and deny in configure.\nHowever, to ensure that we can generate an ebpf program that behaves\ncorrectly, we have to ensure that allow and deny are normalized.\n\nThis patch adds a validation check to ensure that the allow and deny are\nnormalized before attempting to generate the ebpf program.\n\nReview: https://reviews.apache.org/r/75114/\n" }, { "commit": "2458d2f9d367f4b4b6a7a79da24bf45ca6f7ebcb", "tree": "deff454d5a5c73935e23180323eaf7e42bfbeb66", "parents": [ "2241e64caf7ecd735d9a8aaabf02c3f5f3a35ab8" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Jul 26 17:17:31 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jul 26 17:21:46 2024 -0400" }, "message": "[cgroups2] Helper to check device access.\n\nA device access is granted if it is encompassed by an allow entry and\ndoes not have access overlaps with any deny entry.\n\nThe current process of manually checking if a device access would be\ngranted given a state is tedious and leads to worse readability.\n\nA new helper function is added to check if an entry would be granted\naccess in a CgroupDeviceAccess instance, and requires the state to be\nnormalized.\n\nReview: https://reviews.apache.org/r/75113/\n" }, { "commit": "2241e64caf7ecd735d9a8aaabf02c3f5f3a35ab8", "tree": "165198448287e20ae7fe6dbc761e28d7a7d636c6", "parents": [ "c4f2890afafc747462189d76c5ff2bd7bb5e5018" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Jul 26 16:53:34 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jul 26 17:16:07 2024 -0400" }, "message": "[cgroups2] Add helper to normalize allow/deny list.\n\nThis patch adds a public helper function to abstract away the logic used\nto make a list comply with the \u0027normalized\u0027 requirements.\n\nAs a reminder, an allow or deny list is \u0027normalized\u0027 iff everything below\nare true:\n\n1. No Entry has empty accesses specified.\n2. No two entries on the same list can have the same selector (type,\n major \u0026 minor numbers).\n3. No two entries on the same list can be encompassed by the other\n entry (see Entry::encompasses).\n\nReview: https://reviews.apache.org/r/75104/\n" }, { "commit": "c4f2890afafc747462189d76c5ff2bd7bb5e5018", "tree": "2f9d95eefc6e58a36705aab734d7aac8bb93c9e6", "parents": [ "907aab5645830aac6f164b903da5945a7191ec29" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Jul 26 16:41:50 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jul 26 16:52:34 2024 -0400" }, "message": "[cgroups2] Helper to check device entry normalization.\n\nCurrently we assume that a device state is normalized before using it\nfor generating ebpf files. However, we have not been enforcing these\nconstraints.\n\nWe add a helper to check if a device state is normalized so that we can\nenforce these constraints.\n\nAn allow or deny list is \u0027normalized\u0027 iff everything below are true:\n\n1. No Entry has empty accesses specified.\n2. No two entries on the same list can have the same selector (type,\n major \u0026 minor numbers).\n3. No two entries on the same list can be encompassed by the other\n entry (see Entry::encompasses).\n\nReview: https://reviews.apache.org/r/75099/\n" }, { "commit": "907aab5645830aac6f164b903da5945a7191ec29", "tree": "137efac31fe79f992dfeb19c8a374e59eb614741", "parents": [ "4b96eaaacf211b4a23fd508ae3968a96c1a0f68e" ], "author": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jul 26 16:41:27 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jul 26 16:41:27 2024 -0400" }, "message": "Revert \"[cgroups2] Add allow / deny list normalization validation.\"\n\nThis reverts commit 45d290aeff6912c8e6a4b1a7358c4e9772c447b4.\n" }, { "commit": "4b96eaaacf211b4a23fd508ae3968a96c1a0f68e", "tree": "56f50e50a452ef071b66c0cc23c7ffd4d210740b", "parents": [ "fd17efe3402fc859efc63d3cd32658d1ec61a015" ], "author": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jul 26 16:41:23 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jul 26 16:41:23 2024 -0400" }, "message": "Revert \"[cgroups2] Clarify device documentation.\"\n\nThis reverts commit fd17efe3402fc859efc63d3cd32658d1ec61a015.\n" }, { "commit": "fd17efe3402fc859efc63d3cd32658d1ec61a015", "tree": "4774efeb99b0af868b70f15b7cfc1d7db4f9cc6e", "parents": [ "45d290aeff6912c8e6a4b1a7358c4e9772c447b4" ], "author": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jul 26 16:34:34 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jul 26 16:34:34 2024 -0400" }, "message": "[cgroups2] Clarify device documentation.\n" }, { "commit": "45d290aeff6912c8e6a4b1a7358c4e9772c447b4", "tree": "56f50e50a452ef071b66c0cc23c7ffd4d210740b", "parents": [ "acb5a8a50cc285146726ce5518fd42499e373f87" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Jul 26 01:45:30 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jul 26 01:45:30 2024 -0400" }, "message": "[cgroups2] Add allow / deny list normalization validation.\n\nCurrently we assume that a device state is normalized before using it\nfor generating ebpf files. However, we have not been enforcing these\nconstraints on the device access state.\n\nWe enforce some basic validation on cgroups2::configure on the state\nto ensure that we are able to generate a correct ebpf program. If the\nlists are not normalized, we generate incorrect programs!\n\nAn allow or deny list is \u0027normalized\u0027 iff everything below are true:\n\n 1. No entries have empty accesses specified.\n 2. No two entries on the same list can have the same selector\n (type, major \u0026 minor numbers).\n 3. No two entries on the same list can be encompassed by the other\n entry. See Entry::encompassed.\n\nThis patch adds helpers to check if a device state is normalized,\nand will only allow users to create new CgroupDeviceAccess instances\nusing a helper that checks that the allow and deny lists are normalized.\n\nA new helper function is added to check if an entry would be granted\naccess, and requires the state to be normalized.\n\nReview: https://reviews.apache.org/r/75099/\n" }, { "commit": "acb5a8a50cc285146726ce5518fd42499e373f87", "tree": "137efac31fe79f992dfeb19c8a374e59eb614741", "parents": [ "40e531522edc76d6d47b71760ea72c46a0aeb2d5" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Thu Jul 25 19:52:55 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Jul 25 19:58:33 2024 -0400" }, "message": "[ebpf] Correct ebpf deny block behavior.\n\nCurrently, the deny block matches a device access iff all accesses\nmatch on the deny block. For example, a rw access would not match the\ndeny block even if the deny block had w access specified.\n\nWe would expect that the deny block should deny all accesses if the\ntype, major, and minor number matches, and if any of the device accesses\noverlap with what\u0027s specified in the deny block.\n\nReview: https://reviews.apache.org/r/75109/\n" }, { "commit": "40e531522edc76d6d47b71760ea72c46a0aeb2d5", "tree": "59e3306fb1e3b3d9b8f09642a06ebabe740c2dd3", "parents": [ "fbb120740e05b4dc45b3873f3bca9f8632a53e6b" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Wed Jul 24 16:10:49 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jul 24 16:13:29 2024 -0400" }, "message": "[cgroups] Add Device::Selector::encompasses.\n\nCurrently, we have to check via Selector\u0027s member variables if the\ndevices represented by one Selector encompasses those represented by\nanother.\n\nWe add a helper function to simplify the logic which differ depending on\nwhether one Selector encompasses the other.\n\nReview: https://reviews.apache.org/r/75106/\n" }, { "commit": "fbb120740e05b4dc45b3873f3bca9f8632a53e6b", "tree": "673843670180bee0c9dce72511bc422be7880818", "parents": [ "682f6a743acb9cde4063e8e2d8d200c8531a21b3" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Wed Jul 24 16:08:31 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jul 24 16:09:58 2024 -0400" }, "message": "[cgroups] Add helper to find overlapping device access.\n\nCurrently, we have to directly compare member variables to see if one\nAccess object would overlap that of another, which isn\u0027t very clear\nto people that would be reading the code.\n\nWe add a helper to abstract away the logic to see if the accesses\nspecified in one Access instance would overlap with that of another.\n\nReview: https://reviews.apache.org/r/75107/\n" }, { "commit": "682f6a743acb9cde4063e8e2d8d200c8531a21b3", "tree": "57b84738da1ac75c43df0060ff2bf74d67ec80d2", "parents": [ "9d3541c1b3668d15ddee18a03fa8be15c9812550" ], "author": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jul 24 00:33:55 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jul 24 00:33:55 2024 -0400" }, "message": "[cgroups2] Fix unsafe Process usage in DeviceManager.\n\nCalls to the DeviceManager wrapper were directly accessing the\nstate of DeviceManagerProcess. This patch uses the dispatch mechanism\ninstead, and adjusts the tests accordingly.\n" }, { "commit": "9d3541c1b3668d15ddee18a03fa8be15c9812550", "tree": "fdcf016e0dffa3b51e3b2d983c831caee310415b", "parents": [ "78454b2217dadea5ec85fc79d240e1bdf6705b0c" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Tue Jul 23 23:57:00 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jul 24 00:08:36 2024 -0400" }, "message": "[cgroups2] Add ebpf program attachment to the DeviceManager.\n\nCurrently, the device manager only keeps track of the state in memory,\nand does not commit the changes by attaching an ebpf file to the\ncorresponding cgroup. We will now generate and attach the ebpf file\nwhen configure and reconfigure are called.\n\nReview: https://reviews.apache.org/r/75102/\n" }, { "commit": "78454b2217dadea5ec85fc79d240e1bdf6705b0c", "tree": "c58c011a4524fcb3826e30a5561f8ae95d1691d2", "parents": [ "991fb042e763f21dd3f695ed2ed5814b8a2a5190" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Mon Jul 22 23:19:00 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Tue Jul 23 00:46:47 2024 -0400" }, "message": "[cgroups2] Introduce a device manager.\n\nThis change introduces the DeviceManager to help facilitate device\naccess management in cgroups2 via ebpf program file changes. This\ncentralization is needed since we no longer have control files to\nleverage as persistence for agent recovery, so we a component that\nkeeps track of allow/deny device access information and re-configures\nthe ebpf program for the cgroup.\n\nDevice requests can be made to the manager by calling `configure` or\n`reconfigure`. Note that `configure` should only be used when setting\nup a cgroup\u0027s device access, i.e. it has not requested any device to\nbe allowed/denied before.\n\nIn addition, `reconfigure` cannot be used to add deny entries\ncontaining wildcards.\n\nThis manager will be made available to all controllers under the\ncgroups2 isolator, and the GPU isolator.\n\nReview: https://reviews.apache.org/r/75006/\n" }, { "commit": "991fb042e763f21dd3f695ed2ed5814b8a2a5190", "tree": "ba6914152de8fdb7e849f91940a4910e78977e27", "parents": [ "7f9311f78ce364797fe0df23fc2c635eed001a31" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Jul 19 16:26:20 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jul 19 16:38:03 2024 -0400" }, "message": "[cgroups] Add helper functions for device Entry.\n\nCurrently, the Entry class does not have readable helper functions for\ndetermining whether the device accesses represented by one Entry would\nbe a subset of that of another. In addition, we want more readable ways\nto determine if a device has wildcards present and if it has any\naccesses specified.\n\nThese additions will streamline the logic in the DeviceManager\nDeviceManager, which will heavily utilize the Entry class, improving\ncode readability.\n\nReview: https://reviews.apache.org/r/75096/\n" }, { "commit": "7f9311f78ce364797fe0df23fc2c635eed001a31", "tree": "87896d4238eec08c660d99f5e3092719779a8bad", "parents": [ "f0d4028468a5038cb508820a6479d6205c368a79" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Wed Jul 17 01:34:25 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jul 17 01:34:25 2024 -0400" }, "message": "[build] Use clang-14 for non ubuntu 16.04 targets in docker-build.sh.\n\nAs we migrate to ubuntu 22.04, clang-10 is no longer available via\napt-get install. As such, we will move to clang-14, which should allow\nus to run the docker-build.sh file with OS equal to ubuntu:22.04.\nThis should allow coverity bot to compile and return to normal.\n\nReview: https://reviews.apache.org/r/75091/\n" }, { "commit": "f0d4028468a5038cb508820a6479d6205c368a79", "tree": "b2f8994c792f97351968d1b8fd5175bb67852871", "parents": [ "70d9da223a204dc89431aa7b26db7beeb53a9f3c" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Mon Jul 15 18:05:38 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Mon Jul 15 18:06:54 2024 -0400" }, "message": "[jenkins] Create dockerfile compatible with 22.04 build.\n\nFor review #75080, we made use of replace_bpf_fd and BPF_F_REPLACE\nwhich were added in kernel 5.6. Our current ubuntu 20.04 base image\nuses kernel 5.4.\n\nAs such we will be upgrading the ubuntu version used in Jenkins to\n22.04, whose base image uses kernel 5.15, so that we can make mesos\non the updated pipeline, enabling reviewbot, tidybot, and coverity.\n\nReview: https://reviews.apache.org/r/75088/\n" }, { "commit": "70d9da223a204dc89431aa7b26db7beeb53a9f3c", "tree": "59e2f20e7a19575337b6adc5da61e4114c9a22be", "parents": [ "d630e8c3ec2ab7575c6cd4b21665e73588ccd52b" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Mon Jul 15 18:02:54 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Mon Jul 15 18:04:58 2024 -0400" }, "message": "[veth] Provide the ability to set veth peer link MAC address on creation.\n\nThis addresses the previous todo where we want to set the MAC address\nof the peer link when we are creating a veth pair so that we can avoid\nthe race condition we are racing against udev to see who will set the\nMAC address of the interface last.\n\nSee: https://reviews.apache.org/r/75087/\nSee: https://issues.apache.org/jira/browse/MESOS-10243\n\nReview: https://reviews.apache.org/r/75090/\n" }, { "commit": "d630e8c3ec2ab7575c6cd4b21665e73588ccd52b", "tree": "a4448c34378d522f7b31460a44de727095d92136", "parents": [ "25f35402a3a45e4499ee24c1938ad7f73290ec7f" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Mon Jul 15 13:24:46 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Mon Jul 15 13:25:30 2024 -0400" }, "message": "[ssl_tests] Correct ubuntu version on comment.\n\nThis commit is part of our effort to upgrade jenkins ubuntu version to\n22.04.\n\nReview: https://reviews.apache.org/r/75089/\n" }, { "commit": "25f35402a3a45e4499ee24c1938ad7f73290ec7f", "tree": "6a2cf4964914363700c2d45fd7c0e90828fd57ad", "parents": [ "d0db6654094821cfb7520720041b30abef974d5b" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Mon Jul 15 13:06:54 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Mon Jul 15 13:21:31 2024 -0400" }, "message": "[veth] Avoid udev race condtion on systems with systemd version \u003e 242.\n\nIn systems with systemd version above 242, there is a potential data\nrace where udev will try to update the MAC address of the device at the\nsame time as us if the systemd\u0027s MacAddressPolicy is set to \u0027persistent\u0027.\n\nTo prevent udev from trying to set the veth device\u0027s MAC address by\nitself, we must set the device MAC address on creation so that\naddr_assign_type will be set to NET_ADDR_SET, which prevents udev from\nattempting to change the MAC address of the veth device.\n\nSee: https://github.com/torvalds/linux/commit/2afb9b533423a9b97f84181e773cf9361d98fed6\nSee: https://lore.kernel.org/netdev/CAHXsExy8LKzocBdBzss_vjOpc_TQmyzM87KC192HpmuhMcqasg@mail.gmail.com/T/\nSee: https://issues.apache.org/jira/browse/MESOS-10243\n\nReview: https://reviews.apache.org/r/75086/\n" }, { "commit": "d0db6654094821cfb7520720041b30abef974d5b", "tree": "bbfd82b976f9be0ec403e6cd54b7a6e4b8781dab", "parents": [ "3990bf745ba95f8f9a9bafc9c3a983f191b4c12d" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Mon Jul 15 13:02:55 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Mon Jul 15 13:02:55 2024 -0400" }, "message": "[veth] Add todo to set mac address on create for peer link.\n\nDue to a systemd-induced race-condition related to the MacAddressPolicy\nbeing set to \u0027persistent\u0027 on versions \u003e\u003d 242, we will have to set the\npeer link MAC address of the peer link (eth0) when we create the eth0\npeer link so that the udev will not try to overwrite it when it is\nnotified that this device was created, which would lead to a race\ncondition here where us and udev are racing to see who is the last one\nto write our MAC address to eth0.\n\nsee: https://issues.apache.org/jira/browse/MESOS-10243\n\nReview: https://reviews.apache.org/r/75087/\n" }, { "commit": "3990bf745ba95f8f9a9bafc9c3a983f191b4c12d", "tree": "465139992a8a54d50e0628699788d8923f2eb380", "parents": [ "5791b35e497f51ddbf037db925389bf08c83e81c" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Sun Jul 14 21:02:52 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Sun Jul 14 21:41:15 2024 -0400" }, "message": "[ebpf] Implement atomic replacement of cgroup device programs.\n\nCurrently, if we try to attach device ebpf files to the same cgroup\nmultiple times, they will all be attached, and they will all be run\nwhen a device requests access. This conflicts with our design to have\none ebpf file per cgroup that represents all the files they want to\nallow or deny, where that file is updated when the cgroup adds or\nremoves a device. So we add a patch to atomically replace any existing\nebpf file already attached to our target cgroup using our new ebpf file.\n\nReview: https://reviews.apache.org/r/75080/\n" }, { "commit": "5791b35e497f51ddbf037db925389bf08c83e81c", "tree": "bf9c9d407ad5ad6fa56f70889bc9edb41b6b66e4", "parents": [ "25029f0095774f654293d13c3f0fb2b6e21cea16" ], "author": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Jul 11 15:56:32 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Jul 11 15:56:32 2024 -0400" }, "message": "[cgroups2] Remove accidental tabs.\n" }, { "commit": "25029f0095774f654293d13c3f0fb2b6e21cea16", "tree": "2158ee687a636945f6bceccc18c75af563df3a2e", "parents": [ "4fb4788ee9f47d4b7146de1384d49c7a2b15b246" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Thu Jul 11 15:08:34 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Jul 11 15:08:34 2024 -0400" }, "message": "[cgroups2] Make cgroups2::path take both absolute and relative paths.\n\nCurrently, cgroups2::path assumes the path in the argument is relative.\nWe want the function to be able to distinguish between absolute and\nrelative paths, where we only prepend the mounting point on the\nrelative path.\n\nReview: https://reviews.apache.org/r/75081/\n" }, { "commit": "4fb4788ee9f47d4b7146de1384d49c7a2b15b246", "tree": "b73abb540ff5053463327b25d494a1808b3a2d1d", "parents": [ "7fcd3c9a5d19dc1d0223a168c128c3d6b19e02e5" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Thu Jul 11 15:01:43 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Jul 11 15:05:57 2024 -0400" }, "message": "[ebpf] Add helper function for getting bpf fd by program id.\n\nIntroduces a helper function to help abstract away the logic for\ngetting bpf program file descriptor by its program id.\n\nReview: https://reviews.apache.org/r/75083/\n" }, { "commit": "7fcd3c9a5d19dc1d0223a168c128c3d6b19e02e5", "tree": "3faf0c3c5954bb6b0b545ec632bc55af4fbdfe7f", "parents": [ "f91700d71987203c2dd9f0917ad53be0eb39a655" ], "author": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jul 10 16:23:52 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jul 10 16:23:52 2024 -0400" }, "message": "Minor edits missed in r/75026.\n" }, { "commit": "f91700d71987203c2dd9f0917ad53be0eb39a655", "tree": "e1d1bceff4de124d934a64a97e650e48048ac017", "parents": [ "8cf287778371c13ee7e88fa428424b3c0fbc7ff0" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Wed Jul 10 15:37:50 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jul 10 16:18:55 2024 -0400" }, "message": "[cgroups2] Fix allow deny semantics for device access.\n\nCurrently, the EBPF program we generate has the behavior where the deny\nlist has no effect, as we will allow device access iff the device\nmatched with an allow entry.\n\nInstead we want to grant access to a device iff it is in a cgroup\u0027s\nallow list *and not in its deny list.*\n\nThis means that we need to change our existing logic, which exits on the\nfirst match. It is not our desired behavior because the current EBPF\nprogram construction logic puts the allow-device checks before the\ndeny-device checks, meaning that if a device is on both allow and deny\nlists for a cgroup, it will be granted access.\n\nThis change revamps the EBPF program construction to now check both the\nallow and deny list of a cgroup before determining whether access may be\ngranted. Specifically, if a device is matched with an entry inside the\nallow list, we will also be checking if it matches with any entry on\nthe deny list, and deny the device\u0027s access if that is the case.\n\nWe also avoid generating specific parts of the EBPF program code to\navoid creating unreachable code, explanations with a diagram are\nattached above the cgroups2::devices::DeviceProgram::build function.\n\nReview: https://reviews.apache.org/r/75026/\n" }, { "commit": "8cf287778371c13ee7e88fa428424b3c0fbc7ff0", "tree": "bacd5fa27ce683609e5b9d7b01306348e070ec66", "parents": [ "afb84f8cac8ad6d9e4c3b2a02af053b5f12ba071" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Tue Jul 02 23:53:11 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Tue Jul 02 23:53:11 2024 -0400" }, "message": "[ssl] Remove TLS 1.0 and 1.1 tests.\n\nCurrently the SSLProtocolTest with TLS v1.0 and v1.1 do not pass because\nthose versions were disabled in ubuntu 20.04, see:\n\nhttps://discourse.ubuntu.com/t/spec-tls-1-0-and-1-1-are-disabled-by-default/41868\nhttps://github.com/SoftEtherVPN/SoftEtherVPN/issues/1358#issuecomment-851427905\n\nReview: https://reviews.apache.org/r/75075/\n" }, { "commit": "afb84f8cac8ad6d9e4c3b2a02af053b5f12ba071", "tree": "06b2c0f7ebe2bb7a1fd978615cbebc1d1e42200d", "parents": [ "abc38a685d9a7ffb1196e1c0d6b58eff296702af" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Tue Jul 02 17:57:11 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Tue Jul 02 17:57:11 2024 -0400" }, "message": "[build] Fix libevent-enabled cmake builds on ubuntu 20.04.\n\nOur current libevent-enabled cmake builds cannot complete on jenkins as it\ngets the \u0027incomplete definition of type \u0027struct bio_st\u0027\u0027 error.\n\nThis is because the upgrade to ubuntu 20.04 also upgraded our openSSL\nversion from 1.0.2 to 1.1.1, which breaks compatibility with libevent 2.1.5\nthat was previously used.\n\nA compatibility patch for openSSL 1.1+ was released with libevent 2.1.7, but\nthe closest tarball that includes a CMakeLists.txt file is 2.1.9, which is\nwhat we will upgrade to.\n\nWith the new libevent library, builds are able to complete using cmake and\nwith libevents enabled. But it still sees the test failures we see on other\nbuilds (such as autotools) and operating system (CentOS 7).\n\nWe also need to link libevent_pthread and libevent_openssl with libprocess,\notherwise we will get errors like:\n\n```\nld: 3rdparty/libprocess/src/libprocess.so: undefined reference to bufferevent_openssl_get_ssl\n```\n\nReview: https://reviews.apache.org/r/75070/\n" }, { "commit": "abc38a685d9a7ffb1196e1c0d6b58eff296702af", "tree": "b13ae774c09163c9e4fc2b13461e8e428118ba04", "parents": [ "c3d0d710cbbd4e0b716425b4d8b136f3ce728b96" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Tue Jul 02 17:55:05 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Tue Jul 02 17:55:05 2024 -0400" }, "message": "[build] Fix docker-build.sh failing to compile with distcheck.\n\nReview: https://reviews.apache.org/r/75066/\n" }, { "commit": "c3d0d710cbbd4e0b716425b4d8b136f3ce728b96", "tree": "d9d8047c4e0714e2f030bcc7b2bd14859c886f73", "parents": [ "64aba8a83821d2ea9b7bccd2d7b2dfa9ba6a3635" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Tue Jul 02 16:02:40 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Tue Jul 02 16:02:40 2024 -0400" }, "message": "[build] Use ubuntu:20.04 for verify-reviews.py.\n\nMoving to ubuntu 20.04 so so that we can get the ebpf header files for\nour build.\n\nReview: https://reviews.apache.org/r/75063/\n" }, { "commit": "64aba8a83821d2ea9b7bccd2d7b2dfa9ba6a3635", "tree": "2cb683a04ad98e9deb5898b49c4b14a387ebb0da", "parents": [ "b6750fe619f3b573e7e00a361117091da0fbc6de" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Tue Jul 02 15:59:17 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Tue Jul 02 15:59:17 2024 -0400" }, "message": "[build] Fix make distcheck for ubuntu 20.04.\n\nFixes the makefiles for ubuntu 20.04 so that make distcheck works properly with\nits protobuf dependencies generated as part of make distcheck.\n\nThe reason that a change was needed in the makefile is because the upgrade from\nubuntu 16.04 to 20.04 also caused the automake version to be updated when\ndependencies were being installed during docker build.\n\nThe change in the automake version created slight changes in the generated\nmakefile. Speficically, the distcheck on the new automake-generated makefile now\ndepends on `BUILT_SOURCES` which causes an error as the CSI protobuf files are\nnot ready when distcheck is called. So we add the csi build stamps to\n`BUILT_SOURCES` to ensure that the protobuf files will be ready when distcheck\u0027s\ndependencies are made.\n\nThe additional chmod change for java is because for some reason when distcheck\nattempts to build the mesos-1.12.0.jar from its created distribution, some\nfolders are missing write permissions, causing the build to terminate.\n\nReview: https://reviews.apache.org/r/75062/\n" }, { "commit": "b6750fe619f3b573e7e00a361117091da0fbc6de", "tree": "99e226bd6fba8c892e278f549207287a52cdfe3c", "parents": [ "8b202bbebdc89429ad82c6983aa1c514eb1b8d95" ], "author": { "name": "Andreas Peters", "email": "ap@aventer.biz", "time": "Mon May 27 22:33:32 2024 +0200" }, "committer": { "name": "bmahler", "email": "benjamin.mahler@gmail.com", "time": "Wed Jun 26 13:02:55 2024 -0400" }, "message": "CHANGE: add default network if no net options was set.\n" }, { "commit": "8b202bbebdc89429ad82c6983aa1c514eb1b8d95", "tree": "911a4b6b4da0da5fc11815344490f352f0b301f5", "parents": [ "fe2f38f2eae0f8be21507ab298935d53d93a07da" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Thu Jun 20 00:25:18 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Jun 20 00:59:25 2024 -0400" }, "message": "[port mapping isolator] Work around apparent MAC address kernel bug.\n\nIt seems that there are scenarios where, when using the port mapping isolator,\nmesos containers sometimes cannot communicate with the mesos agent as the MAC\naddress of the veth interface is set incorrectly, leading to dropped packets\nby the kernel. This was discovered with the use of tcpdump (which reveals that\nthe kernel marks the packets as destined for another host), and the latter of\nwhich reveals that the kernel is indeed dropping the packets due to this. We\nthen found that when we set the mac address on the veth interface, it sometimes\ndoes not \"stick\" despite ioctl returning successfully.\n\nObserved scenarios with incorrectly assigned MAC addresses:\n\n1. After setting the mac address: ioctl returns the correct MAC address, but\n net::mac returns an incorrect MAC address (different from the original!)\n2. After setting the mac address: both ioctl and net::mac return the same MAC\n address, but are both wrong (and different from the original one!)\n3. After setting the mac address: there are no cases where ioctl or net::mac\n come back with the same MAC address as before we set the address.\n4. Before we set the mac address: there is a possibility that ioctl and\n net::mac results disagree with each other!\n5. There is a possibility that the MAC address we set ends up overwritten by\n a garbage value after setMAC has already completed and checked that the\n mac address was set correctly. Since this error happens after this\n function has finished, we cannot log nor detect it in setMAC because we\n have not yet studied at what point this occurs.\n\nNotes:\n\n1. We have observed this behavior only on CentOS 9 systems at the moment,\n CentOS 7 systems under various kernels do not seem to have the issue\n (which is quite strange if this was purely a kernel bug).\n2. We have tried kernels 5.15.147, 5.15.160, 5.15.161, all of these have\n this issue on CentOS 9.\n\nThis patch adds a workaround for this bug, which is to check that the MAC\naddress is set correctly after the ioctl call, and retry the address setting\nif necessary. In our testing, this workaround appears to workaround scenarios\n(1), (2), (3), and (4) above, but it does not address scenario (5).\n\nSee MESOS-10243 for additional details, follow-ups.\n\nReview: https://reviews.apache.org/r/75057/\n" }, { "commit": "fe2f38f2eae0f8be21507ab298935d53d93a07da", "tree": "99d3eb92c4aba0494917514f506e99bfc40d5194", "parents": [ "fd38b0b351b4e95135d6208f58c81902dbd9ce7f" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Wed Jun 19 13:47:36 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jun 19 13:52:48 2024 -0400" }, "message": "Support constructing net::MAC objects from sockaddr.sa_data.\n\nWhen using ioctl, we get a char[14] sa_data array from sockaddr that holds the\ninformation necessary to construct a net::MAC object, this patch adds support\nfor using the sa_data field to directly create a net::MAC object.\n\nReview: https://reviews.apache.org/r/75058/\n" }, { "commit": "fd38b0b351b4e95135d6208f58c81902dbd9ce7f", "tree": "72e998414dd49dec962897b58dc09ab04552e00d", "parents": [ "82bff25ef26559e36b9bfa26fade96a53a492f79" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Tue Jun 18 16:29:32 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Tue Jun 18 16:29:32 2024 -0400" }, "message": "[routing] Change link::setMAC to return Try\u003cNothing\u003e.\n\nWe have noticed that our code does not treat the setMAC bool return value\ndifferently based on whether it returns true or false. As such, we are\nchanging the return type to return Nothing so that we either return Error\nor Nothing, rather than Error or True or False.\n\nAs a consequence of this we are also removing the special case of returning\nFalse but not Error when we get ENODEV from ioctl.\n\nReview: https://reviews.apache.org/r/75056/\n" }, { "commit": "82bff25ef26559e36b9bfa26fade96a53a492f79", "tree": "92652f5297d7767d4515ec883d9669094315ff05", "parents": [ "1990f11dacebc32930d31ec794897f019bc31723" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Wed Jun 12 11:11:09 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Wed Jun 12 11:11:09 2024 -0400" }, "message": "[route] Use nl_addr_iszero helper when checking for destination IP network.\n\nPreviously, when grabbing the destination, we would filter out the default\naddress at 0.0.0.0/0 by checking that the destination pointer is pointing\nat an empty struct.\n\nOn newer Linux, it seems to be possible that the destination pointer can\nbe pointing at a valid struct that corresponds to 0.0.0.0/0. To ensure\nthat we are able accurately filter out the default route, we switch to the\nlibnl function nl_addr_iszero to determine if the nl_addr struct corresponds\nto 0.0.0.0/0.\n\nWe also apply this change to other areas where nl_addr_get_len is used to\nensure that non-empty nl_addr with only zeroes are accounted for.\n\nReview: https://reviews.apache.org/r/75046/\n" }, { "commit": "1990f11dacebc32930d31ec794897f019bc31723", "tree": "15f8e6a5be51445293c2d214988c6ee611d0bb63", "parents": [ "8dd469b5336073763654a281fe852118d131be4b" ], "author": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Tue Jun 11 01:28:38 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Tue Jun 11 01:28:38 2024 -0400" }, "message": "[cgroups2] Fix a compilation error on CentOS 7 due to move operations.\n" }, { "commit": "8dd469b5336073763654a281fe852118d131be4b", "tree": "510190308389397fcd16e839e1a1f69804e0daf5", "parents": [ "b0d8d3056ec2f2bc87786d712492c502ec8ee755" ], "author": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Tue Jun 11 00:44:51 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Tue Jun 11 00:44:51 2024 -0400" }, "message": "[cgroups2] Fix multi-line comment compilation warning.\n\nThis fixes a compilation warning due to the comment line ending with\na backslash character.\n" }, { "commit": "b0d8d3056ec2f2bc87786d712492c502ec8ee755", "tree": "1df8b70582269aba673f661403f17dcf4a8f5196", "parents": [ "2c9c8180fb342690110c918944de0fe7ed3f69c7" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Mon Jun 10 18:54:49 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Mon Jun 10 18:54:49 2024 -0400" }, "message": "[port_mapping] Fix SmallEgressLimit test.\n\nThe test was previously failing as it was timing the echo rather\nthan ncat. This fix measures the time that ncat takes so that the\nelapsed time does not display as 0s and fail the test.\n\nReview: https://reviews.apache.org/r/75044/\n" }, { "commit": "2c9c8180fb342690110c918944de0fe7ed3f69c7", "tree": "c75509c33f872c05f01698c7bb41466328887e1e", "parents": [ "741790f03f8a95b80b70f2785d93f6da2b7ae535" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Mon Jun 10 18:53:36 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Mon Jun 10 18:53:36 2024 -0400" }, "message": "[cgroups2] Fix control reaches end of non-void function.\n\nThis change moves the UNREACHABLE macro out of the switch case\nto fix the \"control reaches end of non-void function\" error in\nthe lambda function for addDevice.\n\nReview: https://reviews.apache.org/r/75043/\n" }, { "commit": "741790f03f8a95b80b70f2785d93f6da2b7ae535", "tree": "bcbf89025b214cd8500d02b83f90c912271afd2b", "parents": [ "06e17bd9a222902c54643d5bcfdf74f539b94d91" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Mon Jun 10 12:59:36 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Mon Jun 10 12:59:36 2024 -0400" }, "message": "[port-mapping] Fix typo port_mapping.cpp.\n\nReview: https://reviews.apache.org/r/75042/\n" }, { "commit": "06e17bd9a222902c54643d5bcfdf74f539b94d91", "tree": "a62cfd3d4fea91e6cea25fcdac6c64a311e80b65", "parents": [ "4e6375bc071a33821d2fdc15c0d2d5a0b555676e" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Jun 07 16:56:07 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jun 07 16:56:07 2024 -0400" }, "message": "[port-mapping] cat back ip_local_port_range after updating ephemeral ports.\n\nThis ensures that the update was successful and that the port range is what\nwe expect.\n\nReview: https://reviews.apache.org/r/75038/\n" }, { "commit": "4e6375bc071a33821d2fdc15c0d2d5a0b555676e", "tree": "91b939803fd0de85c4ff5d4b70eae16d65dff156", "parents": [ "193dd64580e5e9337ed20218d6a1db4fe5dbac31" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Jun 07 14:34:32 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jun 07 14:34:32 2024 -0400" }, "message": "[mesos-build] Remove setting of environment variable in dockerfiles.\n\nSetting an environment variable as PYTHON_VERSION caused an unexpected\nbehavior in jenkins as the configure.ac script checked for that exact\nenvironment variable.\n\nPYTHON_VERSION has been renamed and set as an ARG in the dockerfile\nso that it will not persist after the build.\n\nReview: https://reviews.apache.org/r/75036/\n" }, { "commit": "193dd64580e5e9337ed20218d6a1db4fe5dbac31", "tree": "21dfbcda29e8ee3f3006fc6637759d5b2b552c3f", "parents": [ "ac8765c8a807fc2710d22ed7c7671f16c4ea2a25" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Jun 07 14:34:05 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jun 07 14:34:05 2024 -0400" }, "message": "[mesos-build] Add /SRC/.git as safe directory for tidybot.\n\nThis change allows us to bypass the git directory warnings for tidybot.\nAs part of this change we will have to rebuild the tidybot image and\npush it to dockerhub.\n\nReview: https://reviews.apache.org/r/75037/\n" }, { "commit": "ac8765c8a807fc2710d22ed7c7671f16c4ea2a25", "tree": "153bb9e42305b6cb1624c84a78143f73e3b64415", "parents": [ "93a268dc9783750bbd68561dce089b73871663f6" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Fri Jun 07 11:20:04 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Fri Jun 07 11:20:04 2024 -0400" }, "message": "[mesos-build] Address dependency issues in centos-7 / ubuntu-20.04.\n\nIn CentOS 7, the linux/amd64 base image is missing ebpf fields such as\nBPF_PROG_TYPE_CGROUP_DEVICE, which prevents jenkins from building mesos\nnow that the ENABLE_CGROUPS_V2 macro has been removed as\n/usr/include/linux/bpf.h is missing the fields required by ebpf.h.\n\nWe installed dependencies from kernel-ml so that we can have newer\nheaderfiles in /usr/include/linux, which should help us compile the\nmesos code in jenkins.\n\nFor ubuntu, there is a dependency on installing jdk-11 instead of\nthe old jdk-8 which is preventing some builds which pull the ubuntu\nimage to build.\n\nAs part of this change, both the CentOS 7 and ubuntu:20.04 will\nneed to be rebuilt and uploaded to dockerhub for jenkins.\n\nReview: https://reviews.apache.org/r/75035/\n" }, { "commit": "93a268dc9783750bbd68561dce089b73871663f6", "tree": "a9ce7963a64b61d774b4415b1687bcc652fb15fe", "parents": [ "f0a8a4522c12129e9f3d3ecf7d84dfc709541be3" ], "author": { "name": "Jason Zhou", "email": "jasonzhou460@gmail.com", "time": "Thu Jun 06 20:41:24 2024 -0400" }, "committer": { "name": "Benjamin Mahler", "email": "bmahler@apache.org", "time": "Thu Jun 06 20:41:24 2024 -0400" }, "message": "[mesos-build] Install openjdk 11 on ubuntu 20.04.\n\nInstall openjdk 11 on ubuntu 20.04. Our reviewbot is running into issues\nwhere their java 11 installation is missing javac and configure.ac cannot\nrun properly, this fixes that issue.\n\nReview: https://reviews.apache.org/r/75032/\n" }, { "commit": "f0a8a4522c12129e9f3d3ecf7d84dfc709541be3", "tree": "940e81687a9c2344f918d92486c2a456dabb472a", "parents": [ "ca025fbd8136247f6a125d8f938a4642c69ce756" ], "author": { "name": "bmahler", "email": "bmahler@apache.org", "time": "Wed Jun 05 20:09:28 2024 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 05 20:09:28 2024 -0400" }, "message": "Add push instructions to mesos-tidy." } ], "next": "ca025fbd8136247f6a125d8f938a4642c69ce756" }