✏️ Editing: pylve_wrapper.py Read Only

# Copyright © Cloud Linux GmbH & Co. KG, Cloud Linux Software, Inc 2010-2026
# All Rights Reserved
#
# Licensed under CLOUD LINUX LICENSE AGREEMENT
# http://cloudlinux.com/docs/LICENSE.TXT

"""pylve C-binding wrapper and related types.

This module wraps the pylve C extension (PyLve, PyLveError) and lives
outside lveapi deliberately: websiteisolation.* is imported by lveapi at
the top level, so any websiteisolation sub-module that needs PyLve or
PyLveError must not import from lveapi — that would form a cycle.
Placing these types here breaks the cycle; lveapi re-exports them for
backward compatibility.
"""

import contextlib
import errno
import time

from clcommon.clproc import ProcLve
from clcommon.clfunc import uid_max

try:
    import pylve as _pylve_module
except ImportError:
    _pylve_module = None

UID_MAX = uid_max()
# kernel devs say that lve_id type is uint32_t
# so max id should be 0xFFFF_FFFF, in fact we have this:
MAX_LVE_ID = 0x7FFFFFFF - 1

class PyLveError(Exception):
    pass

class PyLve:
    """
    Wrapper for generate traceback with pretty descriptions
    """
    @staticmethod
    def _code_is_error(code):
        return isinstance(code, int) and code != -errno.ENOSYS and code != 0

def _arg_to_str(self, arg_var):
        if isinstance(arg_var, self._pylve.liblve_settings):  # for pretty print liblve_settings object
            liblve_settings_attr = ', '.join(
                [f"{attr}={getattr(arg_var, attr)}" for attr in dir(arg_var) if not attr.startswith('_')]
            )
            arg_var_str = f'<liblve_settings object {liblve_settings_attr}>'
        else:
            arg_var_str = str(arg_var)
        return arg_var_str

def _wrapped_fun(self, call, *args, **kwargs):
        msg_template = kwargs.pop('err_msg', self.default_msg_template)
        ignore_error = kwargs.pop('ignore_error', self.ignore_error)
        code = call(*args, **kwargs)
        is_error = self._code_is_error(code)
        if is_error and self._retry:  # wait and try again run function
            time.sleep(self._retry_time)
            code = call(*args, **kwargs)
            is_error = self._code_is_error(code)

format_args = {
            'code': code,
            'fun_name': call.__name__,
            'module': call.__module__,
            'args_': ', '.join(list(map(self._arg_to_str, args)) +
                               [f"{k}={self._arg_to_str(v)}" for k, v in kwargs.items()])
        }
        if self.debug >= 1:
            print(self.debug_msg_template.format(**format_args))
        if self.debug >= 2:
            self.traceback.print_stack()
        if not ignore_error and is_error:
            msg = msg_template.format(**format_args)
            raise PyLveError(msg)
        return code

def _wrap_code(self, call):
        def fun(*args, **kwargs):
            return self._wrapped_fun(call, *args, **kwargs)
        return fun

def __init__(self, pylve=_pylve_module, retry=True, retry_tyme=0.1, debug=0):
        self.debug = debug
        if self.debug >= 2:
            self.traceback = __import__('traceback')
        self.default_msg_template = 'Error code {code}; {module}.{fun_name}({args_})'
        self.debug_msg_template = "DEBUG [lvectl]: call {module}.{fun_name}({args_}) with code {code}"
        self.ignore_error = False
        self._pylve = pylve
        self._retry = retry
        self._proc = ProcLve()
        self._retry_time = retry_tyme
        self.api_version = self._pylve.lve_get_api_version()

self.initialize = self._pylve.initialize
        self.lve_start = self._wrap_code(self._pylve.lve_start)
        self.liblve_settings = self._pylve.liblve_settings
        self.lve_create = self._wrap_code(self._pylve.lve_create)
        self.lve_destroy = self._wrap_code(self._pylve.lve_destroy)
        self.lve_info = self._pylve.lve_info
        self.lve_set_default = self._wrap_code(self._pylve.lve_set_default)
        self.lve_setup = self._wrap_code(self._pylve.lve_setup)
        self.lve_enter_pid = self._wrap_code(self._pylve.lve_enter_pid)
        self.lve_enter_pid_flags = self._wrap_code(self._pylve.lve_enter_pid_flags)
        self.lve_leave_pid = self._wrap_code(self._pylve.lve_leave_pid)
        if hasattr(pylve, 'lve_lvp_create'):
            self.lve_lvp_create = self._wrap_code(self._pylve.lve_lvp_create)
            self.lve_lvp_destroy = self._wrap_code(self._pylve.lve_lvp_destroy)
            self.lve_lvp_map = self._wrap_code(self._pylve.lve_lvp_map)
            self.lve_lvp_move = self._wrap_code(self._pylve.lve_lvp_move)

# mocked functions. Not implement in pylve
            self.lve_lvp_setup = self._wrap_code(self.lve_lvp_setup)
        if hasattr(pylve, 'lve_lvp_create2'):
            self.lve_lvp_create2 = self._wrap_code(self._pylve.lve_lvp_create2)

def resellers_supported(self):
        """
        Check in pylve binding reseller limits supported
        """
        return hasattr(self._pylve, 'lve_lvp_create')

def domains_supported(self):
        """
        Check if per-domain limits via hierarchical LVP (lve_lvp_create2) are
        supported by both the installed library and the running kernel module.

liblve and lve-kmod may be at different versions when one is updated
        without rebooting.  lve_lvp_create2 requires kernel module API >= 1.7.
        After pylve.initialize(), lve_kapi_ver() returns the API version that
        kapi_init() negotiated with the running kernel.
        """
        if not hasattr(self._pylve, 'lve_lvp_create2'):
            return False

kapi_major, kapi_minor = self._pylve.lve_kapi_ver()
        return (kapi_major, kapi_minor) >= (1, 7)

def lve_exists(self, lve_id):
        """
        Check if lve exists in kernel
        :rtype: bool
        """
        try:
            self.lve_info(lve_id)
            return True
        except OSError:
            return False

# TODO: remove this wrapper when kernel logic is ready
    # upd: kernel logic is still not ready yet (KMODLVE-79)
    def lve_lvp_setup(self, lvp_id, settings):  # pylint: disable=method-hidden
        """
        Wrapper for lve_lvp_setup.
        When a LVP's limits change (reseller or domain-isolated user),
        we must iterate over child LVEs, temporarily reduce any that
        exceed the new parent limit, set the LVP, then restore the
        original child limits.

This is needed because the kernel does not update child LVE
        limits when the parent LVP limit changes (KMODLVE-79) and
        rejects the call when any child exceeds the new parent limit.

:param int lvp_id: top level container ID, 0 by default;
        :param settings: liblve_settings instance.
        :return: 0 or errno value
        """
        # is it real situation when lvp_id is 0?
        if lvp_id == 0:
            return self._pylve.lve_lvp_setup(lvp_id, settings)
        # Phase 1: reduce child LVEs that exceed the new parent limit.
        # Track which children were reduced so phase 3 knows which ones
        # need forced cgroup invalidation (CLOS-4027).
        real_lve_settings: dict = {}
        reduced_children: set = set()
        for lve_id in self._proc.lve_id_list(lvp_id):
            # save real settings to restore them later
            try:
                real_settings = self.lve_info(lve_id)
                real_lve_settings[lve_id] = real_settings

# ls_cpu == 0 means unlimited — treat as larger than any
                # finite limit so that domain LVEs with unconfigured CPU
                # are reduced before the kernel call, same as user LVEs
                # under a reseller LVP (CLOS-4024).
                child_cpu = real_settings.ls_cpu or float('inf')
                if child_cpu > settings.ls_cpu:
                    temp_settings = self.lve_info(lve_id)
                    temp_settings.ls_cpu = min(child_cpu, settings.ls_cpu)
                    self.lve_setup(lve_id, temp_settings)
                    reduced_children.add(lve_id)
            except OSError:
                # lve was destroyed, ignore that
                pass

# Phase 2: set new parent (reseller / user-LVP) limits.
        _lve_lvp_setup = self._wrap_code(self._pylve.lve_lvp_setup)
        result = _lve_lvp_setup(lvp_id, settings, ignore_error=True)

# Phase 3: restore original child limits.
        #
        # CLOS-4027: children NOT reduced in phase 1 may have stale CPU
        # cgroup values from a previous parent-lower cycle.  The kernel's
        # lve_resources_setup() skips the cgroup write when lve_limits
        # already matches the requested value, so the restore alone is a
        # no-op for these children.  We force a write by first setting
        # their CPU to a different value (the new parent limit), which
        # updates lve_limits and makes the subsequent restore trigger
        # the actual cgroup write with the correct min(parent, child).
        for lve_id in self._proc.lve_id_list(lvp_id):
            if lve_id in real_lve_settings:
                real = real_lve_settings[lve_id]
                if lve_id not in reduced_children:
                    self._invalidate_child_cpu(lve_id, real, settings)
                self.lve_setup(lve_id, real)
            else:
                # some lve was created during operations above
                # nothing bad, but we can do nothing with that
                # until we have no lock's for this method
                self.lve_setup(lve_id, self.lve_info(lve_id))

return result

def _invalidate_child_cpu(self, lve_id, real, parent_settings):
        """Force the kernel to re-apply a child's CPU cgroup value.

Sets CPU to a value different from the child's current lve_limits
        so that the subsequent lve_setup with the real value is not
        treated as a no-op by lve_resources_setup().
        """
        bump = self.lve_info(lve_id)
        if real.ls_cpu != parent_settings.ls_cpu:
            bump.ls_cpu = parent_settings.ls_cpu
        else:
            bump.ls_cpu = max(1, parent_settings.ls_cpu - 1)
        self.lve_setup(lve_id, bump)

def get_available_lve_id(self, start=UID_MAX, stop=MAX_LVE_ID):
        """
        Iter over lves and find available one.
        :param int start: value to start search from; UID_MAX by default
        :param int stop: max value when we will stop search
        :return int: lve_id
        """
        for lve_id in range(start + 1, stop):
            try:
                self.lve_info(lve_id)
            except OSError:
                return lve_id
        raise PyLveError(f"Unable to find free lve in range ({start}, {stop})")

@contextlib.contextmanager
    def context_ignore_error(self, ignore_error):
        self.ignore_error, saved_ignore_error = ignore_error, self.ignore_error
        try:
            yield
        finally:
            self.ignore_error = saved_ignore_error