[CRIU] [PATCH] scripts: Add ACT_PRE_RESUME stage

[Cyrill Gorcunov]

On Tue, Jan 10, 2017 at 04:27:23PM +0300, Pavel Emelyanov wrote:
> On 01/10/2017 04:18 PM, Cyrill Gorcunov wrote:
> > On Tue, Jan 10, 2017 at 03:51:10PM +0300, Pavel Emelyanov wrote:
> >> On 01/09/2017 05:44 PM, Cyrill Gorcunov wrote:
> >>> The "post-sigreturn" action is when all tasks are restored
> >>> but not yet restarted sitting in frozen/seized state, right
> >>> after final rt-sigreturn call passed.
> >>>
> >>> In vz7 this step is needed to tune up beancounters/cgroups
> >>> params from the script, in vanilla criu it useful as well.
> >>
> >> We have POST_RESTORE hook. If it happens too early (why?) let's
> >> move it into proper place?
> > 
> > It happens early for vz7 case: we're inside veX and continue
> > manipulating with resources which can lead up to problems
> > with beancounters and memory limits. I suspect LXC and friends
> > won't hit this problem for now. We could move POST_RESTORE
> > hook to trigger later but this will break API I think, we simply
> > can't be sure that someone already is using this hook in this
> > particular place.
> > 
> > What about naming it as pre-resume?
> 
> Can you describe what exactly happens between POST_RESTORE and PRE_RESUME?

 - depopulate_roots_yard (opening new files)
 - network_unlock_internal (running iptables)
 - attach_to_tasks (parsing procfs output: open files, allocating new memory)
 - catch_tasks (same as attach_to_tasks)
 - finalize_restore (allocate new memory)

Note we've to do resume inside veX due to kernel specifics (as you
know we have a number of ve_is_super calls inside kernel to
virtualize devtmpfs, sysfs and etc), thus all this actions should
run with unlimited resources of container, and then the limits
must be set back but before the tasks are kicked to run, so
pre-resume look like be a perfect candidate.

In vz7's criu we move criu main process on ve0/node and then in
this new hook setup beancounters limits back.

Otherwise there might be a situation where restore fail because
not enough resources left inside container since criu takes some
resources for own use.