Merge pull request #161 from Tim-Zhang/release-0.5.0

release: v0.5.0

.cargo/config.toml

@@ -0,0 +1,2 @@
+[target.x86_64-unknown-linux-gnu]
+runner = 'sudo -E'

.clippy.toml

@@ -0,0 +1 @@
+upper-case-acronyms-aggressive = true

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,17 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: 'bug, needs-review'
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/enhancement-request.md

@@ -0,0 +1,20 @@
+---
+name: Enhancement request
+about: Suggest an improvement to an existing feature
+title: ''
+labels: enhancement, needs-review
+assignees: ''
+
+---
+
+**Which feature do you think can be improved?**
+
+Specify the feature you think could be made better.
+
+**How can it be improved?**
+
+Describe how specifically you think it could be improved.
+
+**Additional Information**
+
+Anything else to add?

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: 'feature, needs-review'
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/workflows/PR-wip-checks.yaml

@@ -0,0 +1,21 @@
+name: Pull request WIP checks
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - edited
+      - labeled
+      - unlabeled
+
+jobs:
+  pr_wip_check:
+    runs-on: ubuntu-latest
+    name: WIP Check
+    steps:
+    - name: WIP Check
+      uses: tim-actions/wip-check@1c2a1ca6c110026b3e2297bb2ef39e1747b5a755
+      with:
+        labels: '["do-not-merge", "wip", "rfc"]'
+        keywords: '["WIP", "wip", "RFC", "rfc", "dnm", "DNM", "do-not-merge"]'

.github/workflows/bvt.yaml

@@ -0,0 +1,38 @@
+name: BVT
+on: [pull_request]
+env:
+  RUST_VERSION: 1.85.1
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - run: rustup install ${{ env.RUST_VERSION }} && rustup default ${{ env.RUST_VERSION }}
+      - run: make debug
+
+  fmt:
+    name: Format Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - run: rustup install ${{ env.RUST_VERSION }} && rustup default ${{ env.RUST_VERSION }}
+      - run: rustup component add rustfmt
+      - run: make fmt
+  clippy:
+    name: Clippy Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - run: rustup install ${{ env.RUST_VERSION }} && rustup default ${{ env.RUST_VERSION }}
+      - run: rustup component add clippy
+      - run: make clippy
+  test:
+    name: Run Unit Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - run: rustup install ${{ env.RUST_VERSION }} && rustup default ${{ env.RUST_VERSION }}
+      - run: make test
+
+

.github/workflows/commit-message-check.yaml

@@ -0,0 +1,53 @@
+name: Commit Message Check
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+
+env:
+  error_msg: |+
+    See the document below for help on formatting commits for the project.
+
+    https://github.com/kata-containers/community/blob/master/CONTRIBUTING.md#patch-forma
+
+jobs:
+  commit-message-check:
+    runs-on: ubuntu-latest
+    name: Commit Message Check
+    steps:
+    - name: Get PR Commits
+      id: 'get-pr-commits'
+      uses: tim-actions/get-pr-commits@v1.0.0
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: DCO Check
+      uses: tim-actions/dco@2fd0504dc0d27b33f542867c300c60840c6dcb20
+      with:
+        commits: ${{ steps.get-pr-commits.outputs.commits }}
+
+    - name: Commit Body Missing Check
+      if: ${{ success() || failure() }}
+      uses: tim-actions/commit-body-check@v1.0.2
+      with:
+        commits: ${{ steps.get-pr-commits.outputs.commits }}
+
+    - name: Check Subject Line Length
+      if: ${{ success() || failure() }}
+      uses: tim-actions/commit-message-checker-with-regex@v0.3.1
+      with:
+        commits: ${{ steps.get-pr-commits.outputs.commits }}
+        pattern: '^.{0,75}(\n.*)*$'
+        error: 'Subject too long (max 75)'
+        post_error: ${{ env.error_msg }}
+
+    - name: Check Body Line Length
+      if: ${{ success() || failure() }}
+      uses: tim-actions/commit-message-checker-with-regex@v0.3.1
+      with:
+        commits: ${{ steps.get-pr-commits.outputs.commits }}
+        pattern: '^.+(\n([a-zA-Z].{0,149}|[^a-zA-Z\n].*|Signed-off-by:.*|))+$'
+        error: 'Body line too long (max 72)'
+        post_error: ${{ env.error_msg }}

.gitignore

@@ -8,7 +8,3 @@ Cargo.lock
 
 # These are backup files generated by rustfmt
 **/*.rs.bk
-
-/target
-**/*.rs.bk
-Cargo.lock

.travis.yml

@@ -1,11 +0,0 @@
-language: rust
-rust:
-  - stable
-  - beta
-  - nightly
-matrix:
-  allow_failures:
-    - rust: nightly
-  fast_finish: true
-script:
-  - cargo build --verbose --all

Cargo.toml

@@ -1,15 +1,31 @@
 [package]
-name = "cgroups"
+name = "cgroups-rs"
 description = "Native Rust crate for managing control groups on Linux"
-repository = "https://github.com/levex/cgroups-rs"
+repository = "https://github.com/kata-containers/cgroups-rs"
 keywords = ["linux", "cgroup", "containers", "isolation"]
 categories = ["os", "api-bindings", "os::unix-apis"]
 license = "MIT OR Apache-2.0"
-version = "0.0.2"
-authors = ["Levente Kurusa <lkurusa@acm.org>"]
+version = "0.5.0"
+authors = ["The Kata Containers community <kata-dev@lists.katacontainers.io>", "Levente Kurusa <lkurusa@acm.org>", "Sam Wilson <tecywiz121@hotmail.com>"]
+edition = "2018"
+homepage = "https://github.com/kata-containers/cgroups-rs"
+readme = "README.md"
 
 [dependencies]
+log = "0.4"
+nix = { version = "0.25.0", default-features = false, features = ["event", "fs", "process"] }
+libc = "0.2"
+serde = { version = "1.0", features = ["derive"], optional = true }
+thiserror = "1"
+oci-spec = { version = "0.8.1", optional = true }
+zbus = "5.8"
+bit-vec = "0.6"
 
 [dev-dependencies]
-nix = "0.11.0"
-libc = "0.2.43"
+libc = "0.2.76"
+rand = "0.8"
+nix = "0.25"
+
+[features]
+default = []
+oci = ["oci-spec"]

Makefile

@@ -0,0 +1,65 @@
+all: debug fmt test
+
+#
+# Build
+#
+
+.PHONY: debug
+debug:
+	RUSTFLAGS="--deny warnings" cargo build
+
+.PHONY: release
+release:
+	cargo build --release
+
+.PHONY: build
+build: debug
+
+#
+# Tests and linters
+#
+
+# Tests that manipulate cgroups should run in sequence, so that
+# `--test-threads=1` is used.
+test: test-systemd test-fs-manager test-systemd-manager
+	cargo test --all-features -- --color always \
+	  --nocapture \
+	  --skip systemd::dbus::client::tests \
+	  --skip manager::fs::tests \
+	  --skip manager::systemd::tests
+
+.PHONY: test-systemd
+# Tests that manipulate cgroups should run in sequence, so that
+# `--test-threads=1` is used.
+test-systemd:
+	cargo test --package cgroups-rs --lib \
+	    -- systemd::dbus::client::tests \
+	    --color always --nocapture \
+		--test-threads=1
+
+.PHONY: test-fs-manager
+# See test-systemd
+test-fs-manager:
+	cargo test --all-features --package cgroups-rs \
+		--lib -- manager::fs::tests \
+		--color always --nocapture --test-threads=1
+
+.PHONY: test-systemd-manager
+# See test-systemd
+test-systemd-manager:
+	cargo test --all-features --package cgroups-rs \
+	  --lib -- manager::systemd::tests \
+	  --color always --nocapture --test-threads=1
+
+.PHONY: check
+check: fmt clippy
+
+
+.PHONY: fmt
+fmt:
+	cargo fmt --all -- --check
+
+.PHONY: clippy
+clippy:
+	cargo clippy --all-targets --all-features -- -D warnings
+

README.md

@@ -1,25 +1,47 @@
-# cgroups-rs ![Build](https://travis-ci.org/levex/cgroups-rs.svg?branch=master)
+# cgroups-rs ![Build](https://travis-ci.org/kata-containers/cgroups-rs.svg?branch=master)
 Native Rust library for managing control groups under Linux
 
-# Example
+Both v1 and v2 of cgroups are supported.
 
-## Create a control group, and limit the pid resource
+# Examples
+
+## Create a control group using the builder pattern
 
 ``` rust
-// Acquire a handle for the V1 cgroup hierarchy.
-let hier = ::hierarchies::V1::new();
-// Create a control group named "example" in the hierarchy.
-let cg = Cgroup::new(&hier, String::from("example"), 0);
-{
-    // Get a handle to the pids controller of the control group.
-    let pids: &PidController = cg.controller_of().expect("No pids controller in V1 hierarchy!");
-    // Set the maximum amount of processes in the cgroup.
-    pids.set_pid_max(PidMax::Value(10));
-    // Check that this has had the desired effect by reading the value back from the kernel.
-    assert_eq!(pids.get_pid_max(), Some(PidMax::Value(10)));
-}
-// Once done, delete the control group (and its associated controllers).
+
+
+use cgroups_rs::*;
+use cgroups_rs::cgroup_builder::*;
+
+// Acquire a handle for the cgroup hierarchy.
+let hier = cgroups_rs::hierarchies::auto();
+
+// Use the builder pattern (see the documentation to create the control group)
+//
+// This creates a control group named "example" in the V1 hierarchy.
+    let cg: Cgroup = CgroupBuilder::new("example")
+        .cpu()
+        .shares(85)
+        .done()
+        .build(hier);
+
+// Now `cg` is a control group that gets 85% of the CPU time in relative to
+// other control groups.
+
+// Get a handle to the CPU controller.
+let cpus: &cgroups_rs::cpu::CpuController = cg.controller_of().unwrap();
+cpus.add_task(&CgroupPid::from(1234u64));
+
+// [...]
+
+// Finally, clean up and delete the control group.
 cg.delete();
+
+// Note that `Cgroup` does not implement `Drop` and therefore when the
+// structure is dropped, the Cgroup will stay around. This is because, later
+// you can then re-create the `Cgroup` using `load()`. We aren't too set on
+// this behavior, so it might change in the feature. Rest assured, it will be a
+// major version change.
 ```
 
 # Disclaimer
@@ -27,7 +49,7 @@ cg.delete();
 This crate is licensed under:
 
 - MIT License (see LICENSE-MIT); or
-- Apache 2.0 LIcense (see LICENSE-Apache-2.0),
+- Apache 2.0 License (see LICENSE-Apache-2.0),
 
 at your option.
 

src/blkio.rs

@@ -1,342 +0,0 @@
-//! This module contains the implementation of the `blkio` cgroup subsystem.
-//! 
-//! See the Kernel's documentation for more information about this subsystem, found at:
-//!  [Documentation/cgroup-v1/blkio-controller.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/blkio-controller.txt)
-use std::path::PathBuf;
-use std::io::{Read, Write};
-use std::fs::File;
-
-use {CgroupError, BlkIoResources, Controllers, Controller, Resources, ControllIdentifier, Subsystem};
-use CgroupError::*;
-
-/// A controller that allows controlling the `blkio` subsystem of a Cgroup.
-///
-/// In essence, using the `blkio` controller one can limit and throttle the tasks' usage of block
-/// devices in the control group.
-#[derive(Debug, Clone)]
-pub struct BlkIoController {
-    base: PathBuf,
-    path: PathBuf,
-}
-
-/// Current state and statistics about how throttled are the block devices when accessed from the
-/// controller's control group.
-#[derive(Debug)]
-pub struct BlkIoThrottle {
-    /// Total amount of bytes transferred to and from the block devices.
-    pub io_service_bytes: String,
-    /// Same as `io_service_bytes`, but contains all descendant control groups.
-    pub io_service_bytes_recursive: String,
-    /// The number of I/O operations performed on the devices as seen by the throttling policy.
-    pub io_serviced: String,
-    /// Same as `io_serviced`, but contains all descendant control groups.
-    pub io_serviced_recursive: String,
-    /// The upper limit of bytes per second rate of read operation on the block devices by the
-    /// control group's tasks.
-    pub read_bps_device: String,
-    /// The upper limit of I/O operation per second, when said operation is a read operation.
-    pub read_iops_device: String,
-    /// The upper limit of bytes per second rate of write operation on the block devices by the
-    /// control group's tasks.
-    pub write_bps_device: String,
-    /// The upper limit of I/O operation per second, when said operation is a write operation.
-    pub write_iops_device: String,
-}
-
-/// Statistics and state of the block devices.
-#[derive(Debug)]
-pub struct BlkIo {
-    /// The number of BIOS requests merged into I/O requests by the control group's tasks.
-    pub io_merged: String,
-    /// Same as `io_merged`, but contains all descendant control groups.
-    pub io_merged_recursive: String,
-    /// The number of requests queued for I/O operations by the tasks of the control group.
-    pub io_queued: String,
-    /// Same as `io_queued`, but contains all descendant control groups.
-    pub io_queued_recursive: String,
-    /// The number of bytes transferred from and to the block device (as seen by the CFQ I/O
-    /// scheduler).
-    pub io_service_bytes: String,
-    /// Same as `io_service_bytes`, but contains all descendant control groups.
-    pub io_service_bytes_recursive: String,
-    /// The number of I/O operations (as seen by the CFQ I/O scheduler) between the devices and the
-    /// control group's tasks.
-    pub io_serviced: String,
-    /// Same as `io_serviced`, but contains all descendant control groups.
-    pub io_serviced_recursive: String,
-    /// The total time spent between dispatch and request completion for I/O requests (as seen by
-    /// the CFQ I/O scheduler) by the control group's tasks.
-    pub io_service_time: String,
-    /// Same as `io_service_time`, but contains all descendant control groups.
-    pub io_service_time_recursive: String,
-    /// Total amount of time spent waiting for a free slot in the CFQ I/O scheduler's queue.
-    pub io_wait_time: String,
-    /// Same as `io_wait_time`, but contains all descendant control groups.
-    pub io_wait_time_recursive: String,
-    /// How much weight do the control group's tasks have when competing against the descendant
-    /// control group's tasks.
-    pub leaf_weight: u64,
-    /// Same as `leaf_weight`, but per-block-device.
-    pub leaf_weight_device: String,
-    /// Total number of sectors transferred between the block devices and the control group's
-    /// tasks.
-    pub sectors: String,
-    /// Same as `sectors`, but contains all descendant control groups.
-    pub sectors_recursive: String,
-    /// Similar statistics, but as seen by the throttle policy.
-    pub throttle: BlkIoThrottle,
-    /// The time the control group had access to the I/O devices.
-    pub time: String,
-    /// Same as `time`, but contains all descendant control groups.
-    pub time_recursive: String,
-    /// The weight of this control group.
-    pub weight: u64,
-    /// Same as `weight`, but per-block-device.
-    pub weight_device: String,
-}
-
-impl Controller for BlkIoController {
-    fn control_type(self: &Self) -> Controllers { Controllers::BlkIo }
-    fn get_path<'a>(self: &'a Self) -> &'a PathBuf { &self.path }
-    fn get_path_mut<'a>(self: &'a mut Self) -> &'a mut PathBuf { &mut self.path }
-    fn get_base<'a>(self: &'a Self) -> &'a PathBuf { &self.base }
-
-    fn apply(self: &Self, res: &Resources) {
-        /* get the resources that apply to this controller */
-        let res: &BlkIoResources = &res.blkio;
-
-        if res.update_values {
-            let _ = self.set_weight(res.weight as u64);
-            let _ = self.set_leaf_weight(res.leaf_weight as u64);
-
-            for dev in &res.weight_device {
-                let _ = self.set_weight_for_device(format!("{}:{} {}",
-                                dev.major, dev.minor, dev.weight));
-            }
-
-            for dev in &res.throttle_read_bps_device {
-                let _ = self.throttle_read_bps_for_device(dev.major, dev.minor, dev.rate);
-            }
-
-            for dev in &res.throttle_write_bps_device {
-                let _ = self.throttle_write_bps_for_device(dev.major, dev.minor, dev.rate);
-            }
-
-            for dev in &res.throttle_read_iops_device {
-                let _ = self.throttle_read_iops_for_device(dev.major, dev.minor, dev.rate);
-            }
-
-            for dev in &res.throttle_write_iops_device {
-                let _ = self.throttle_write_iops_for_device(dev.major, dev.minor, dev.rate);
-            }
-        }
-    }
-}
-
-impl ControllIdentifier for BlkIoController {
-    fn controller_type() -> Controllers {
-        Controllers::BlkIo
-    }
-}
-
-impl<'a> From<&'a Subsystem> for &'a BlkIoController {
-    fn from(sub: &'a Subsystem) -> &'a BlkIoController {
-        unsafe {
-            match sub {
-                Subsystem::BlkIo(c) => c,
-                _ => {
-                    assert_eq!(1, 0);
-                    ::std::mem::uninitialized()
-                },
-            }
-        }
-    }
-}
-
-fn read_string_from(mut file: File) -> Result<String, CgroupError> {
-    let mut string = String::new();
-    match file.read_to_string(&mut string) {
-        Ok(_) => Ok(string.trim().to_string()),
-        Err(e) => Err(CgroupError::ReadError(e)),
-    }
-}
-
-fn read_u64_from(mut file: File) -> Result<u64, CgroupError> {
-    let mut string = String::new();
-    match file.read_to_string(&mut string) {
-        Ok(_) => string.trim().parse().map_err(|_| ParseError),
-        Err(e) => Err(CgroupError::ReadError(e)),
-    }
-}
-
-impl BlkIoController {
-    /// Constructs a new `BlkIoController` with `oroot` serving as the root of the control group.
-    pub fn new(oroot: PathBuf) -> Self {
-        let mut root = oroot;
-        root.push(Self::controller_type().to_string());
-        Self {
-            base: root.clone(),
-            path: root,
-        }
-    }
-
-    /// Gathers statistics about and reports the state of the block devices used by the control
-    /// group's tasks.
-    pub fn blkio(self: &Self) -> BlkIo {
-        BlkIo {
-            io_merged: self.open_path("blkio.io_merged", false).and_then(|file| {
-                read_string_from(file)
-            }).unwrap_or("".to_string()),
-            io_merged_recursive: self.open_path("blkio.io_merged_recursive", false).and_then(|file| {
-                read_string_from(file)
-            }).unwrap_or("".to_string()),
-            io_queued: self.open_path("blkio.io_queued", false).and_then(|file| {
-                read_string_from(file)
-            }).unwrap_or("".to_string()),
-            io_queued_recursive: self.open_path("blkio.io_queued_recursive", false).and_then(|file| {
-                read_string_from(file)
-            }).unwrap_or("".to_string()),
-            io_service_bytes: self.open_path("blkio.io_service_bytes", false).and_then(|file| {
-                read_string_from(file)
-            }).unwrap_or("".to_string()),
-            io_service_bytes_recursive: self.open_path("blkio.io_service_bytes_recursive", false).and_then(|file| {
-                read_string_from(file)
-            }).unwrap_or("".to_string()),
-            io_serviced: self.open_path("blkio.io_serviced", false).and_then(|file| {
-                read_string_from(file)
-            }).unwrap_or("".to_string()),
-            io_serviced_recursive: self.open_path("blkio.io_serviced_recursive", false).and_then(|file| {
-                read_string_from(file)
-            }).unwrap_or("".to_string()),
-            io_service_time: self.open_path("blkio.io_service_time", false).and_then(|file| {
-                read_string_from(file)
-            }).unwrap_or("".to_string()),
-            io_service_time_recursive: self.open_path("blkio.io_service_time_recursive", false).and_then(|file| {
-                read_string_from(file)
-            }).unwrap_or("".to_string()),
-            io_wait_time: self.open_path("blkio.io_wait_time", false).and_then(|file| {
-                read_string_from(file)
-            }).unwrap_or("".to_string()),
-            io_wait_time_recursive: self.open_path("blkio.io_wait_time_recursive", false).and_then(|file| {
-                read_string_from(file)
-            }).unwrap_or("".to_string()),
-            leaf_weight: self.open_path("blkio.leaf_weight", false).and_then(|file| {
-                read_u64_from(file)
-            }).unwrap_or(0u64),
-            leaf_weight_device: self.open_path("blkio.leaf_weight_device", false).and_then(|file| {
-                read_string_from(file)
-            }).unwrap_or("".to_string()),
-            sectors: self.open_path("blkio.sectors", false).and_then(|file| {
-                read_string_from(file)
-            }).unwrap_or("".to_string()),
-            sectors_recursive: self.open_path("blkio.sectors_recursive", false).and_then(|file| {
-                read_string_from(file)
-            }).unwrap_or("".to_string()),
-            throttle: BlkIoThrottle {
-                io_service_bytes: self.open_path("blkio.throttle.io_service_bytes", false).and_then(|file| {
-                    read_string_from(file)
-                }).unwrap_or("".to_string()),
-                io_service_bytes_recursive: self.open_path("blkio.throttle.io_service_bytes_recursive", false).and_then(|file| {
-                    read_string_from(file)
-                }).unwrap_or("".to_string()),
-                io_serviced: self.open_path("blkio.throttle.io_serviced", false).and_then(|file| {
-                    read_string_from(file)
-                }).unwrap_or("".to_string()),
-                io_serviced_recursive: self.open_path("blkio.throttle.io_serviced_recursive", false).and_then(|file| {
-                    read_string_from(file)
-                }).unwrap_or("".to_string()),
-                read_bps_device: self.open_path("blkio.throttle.read_bps_device", false).and_then(|file| {
-                    read_string_from(file)
-                }).unwrap_or("".to_string()),
-                read_iops_device: self.open_path("blkio.throttle.read_iops_device", false).and_then(|file| {
-                    read_string_from(file)
-                }).unwrap_or("".to_string()),
-                write_bps_device: self.open_path("blkio.throttle.write_bps_device", false).and_then(|file| {
-                    read_string_from(file)
-                }).unwrap_or("".to_string()),
-                write_iops_device: self.open_path("blkio.throttle.write_iops_device", false).and_then(|file| {
-                    read_string_from(file)
-                }).unwrap_or("".to_string()),
-            },
-            time: self.open_path("blkio.time", false).and_then(|file| {
-                read_string_from(file)
-            }).unwrap_or("".to_string()),
-            time_recursive: self.open_path("blkio.time_recursive", false).and_then(|file| {
-                read_string_from(file)
-            }).unwrap_or("".to_string()),
-            weight: self.open_path("blkio.weight", false).and_then(|file| {
-                read_u64_from(file)
-            }).unwrap_or(0u64),
-            weight_device: self.open_path("blkio.weight_device", false).and_then(|file| {
-                read_string_from(file)
-            }).unwrap_or("".to_string()),
-        }
-    }
-
-    /// Set the leaf weight on the control group's tasks, i.e., how are they weighted against the
-    /// descendant control groups' tasks.
-    pub fn set_leaf_weight(self: &Self, w: u64) -> Result<(), CgroupError> {
-        self.open_path("blkio.leaf_weight", true).and_then(|mut file| {
-            file.write_all(w.to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Same as `set_leaf_weight()`, but settable per each block device.
-    pub fn set_leaf_weight_for_device(self: &Self, d: String) -> Result<(), CgroupError> {
-        self.open_path("blkio.leaf_weight_device", true).and_then(|mut file| {
-            file.write_all(d.as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Reset the statistics the kernel has gathered so far and start fresh.
-    pub fn reset_stats(self: &Self) -> Result<(), CgroupError> {
-        self.open_path("blkio.leaf_weight_device", true).and_then(|mut file| {
-            file.write_all("1".to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Throttle the bytes per second rate of read operation affecting the block device
-    /// `major:minor` to `bps`.
-    pub fn throttle_read_bps_for_device(self: &Self, major: u64, minor: u64, bps: u64) -> Result<(), CgroupError> {
-        self.open_path("blkio.throttle.read_bps_device", true).and_then(|mut file| {
-            file.write_all(format!("{}:{} {}", major, minor, bps).to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Throttle the I/O operations per second rate of read operation affecting the block device
-    /// `major:minor` to `bps`.
-    pub fn throttle_read_iops_for_device(self: &Self, major: u64, minor: u64, iops: u64) -> Result<(), CgroupError> {
-        self.open_path("blkio.throttle.read_iops_device", true).and_then(|mut file| {
-            file.write_all(format!("{}:{} {}", major, minor, iops).to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-    /// Throttle the bytes per second rate of write operation affecting the block device
-    /// `major:minor` to `bps`.
-    pub fn throttle_write_bps_for_device(self: &Self, major: u64, minor: u64, bps: u64) -> Result<(), CgroupError> {
-        self.open_path("blkio.throttle.write_bps_device", true).and_then(|mut file| {
-            file.write_all(format!("{}:{} {}", major, minor, bps).to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Throttle the I/O operations per second rate of write operation affecting the block device
-    /// `major:minor` to `bps`.
-    pub fn throttle_write_iops_for_device(self: &Self, major: u64, minor: u64, iops: u64) -> Result<(), CgroupError> {
-        self.open_path("blkio.throttle.write_iops_device", true).and_then(|mut file| {
-            file.write_all(format!("{}:{} {}", major, minor, iops).to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Set the weight of the control group's tasks.
-    pub fn set_weight(self: &Self, w: u64) -> Result<(), CgroupError> {
-        self.open_path("blkio.leaf_weight", true).and_then(|mut file| {
-            file.write_all(w.to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Same as `set_weight()`, but settable per each block device.
-    pub fn set_weight_for_device(self: &Self, d: String) -> Result<(), CgroupError> {
-        self.open_path("blkio.weight_device", true).and_then(|mut file| {
-            file.write_all(d.as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-}

src/cgroup.rs

@@ -1,159 +0,0 @@
-//! This module handles cgroup operations. Start here!
-
-use {CgroupError, CgroupPid, Resources, ControllIdentifier, Controller, Hierarchy, Subsystem};
-
-use std::convert::From;
-
-
-/// A control group is the central structure to this crate.
-///
-///
-/// # What are control groups?
-///
-/// Lifting over from the Linux kernel sources: 
-///
-/// > Control Groups provide a mechanism for aggregating/partitioning sets of
-/// > tasks, and all their future children, into hierarchical groups with
-/// > specialized behaviour.
-///
-/// This crate is an attempt at providing a Rust-native way of managing these cgroups.
-pub struct Cgroup<'b> {
-    /// The list of subsystems that control this cgroup
-    subsystems: Vec<Subsystem>,
-
-    /// The hierarchy.
-    hier: &'b Hierarchy,
-}
-
-impl<'b> Cgroup<'b> {
-
-    /// Create this control group.
-    fn create(self: &Self) {
-        for subsystem in &self.subsystems {
-            subsystem.to_controller().create();
-        }
-    }
-
-    /// Create a new control group in the hierarchy `hier`, with name `path`.
-    ///
-    /// Returns a handle to the control group that can be used to manipulate it.
-    ///
-    /// Note that if the handle goes out of scope and is dropped, the control group is _not_
-    /// destroyed.
-    pub fn new(hier: &Hierarchy, path: String) -> Cgroup {
-        let cg = Cgroup::load(hier, path);
-        cg.create();
-        cg
-    }
-
-    /// Create a handle for a control group in the hierarchy `hier`, with name `path`.
-    ///
-    /// Returns a handle to the control group (that possibly does not exist until `create()` has
-    /// been called on the cgroup.
-    ///
-    /// Note that if the handle goes out of scope and is dropped, the control group is _not_
-    /// destroyed.
-    pub fn load(hier: &Hierarchy, path: String) -> Cgroup {
-        let mut subsystems = hier.subsystems();
-        if path != ""  {
-            subsystems = subsystems.into_iter().map(|x| x.enter(&path)).collect::<Vec<_>>();
-        }
-
-        let cg = Cgroup {
-            subsystems: subsystems,
-            hier: hier,
-        };
-
-        cg
-    }
-
-    /// The list of subsystems that this control group supports.
-    pub fn subsystems(self: &Self) -> &Vec<Subsystem> {
-        &self.subsystems
-    }
-
-    /// Deletes the control group.
-    ///
-    /// Note that this function makes no effort in cleaning up the descendant and the underlying
-    /// system call will fail if there are any descendants. Thus, one should check whether it was
-    /// actually removed, and remove the descendants first if not. In the future, this behavior
-    /// will change.
-    pub fn delete(self: Self) {
-        self.subsystems.into_iter().for_each(|sub| {
-            match sub {
-                Subsystem::Pid(pidc) => pidc.delete(),
-                Subsystem::Mem(c) => c.delete(),
-                Subsystem::CpuSet(c) => c.delete(),
-                Subsystem::CpuAcct(c) => c.delete(),
-                Subsystem::Cpu(c) => c.delete(),
-                Subsystem::Devices(c) => c.delete(),
-                Subsystem::Freezer(c) => c.delete(),
-                Subsystem::NetCls(c) => c.delete(),
-                Subsystem::BlkIo(c) => c.delete(),
-                Subsystem::PerfEvent(c) => c.delete(),
-                Subsystem::NetPrio(c) => c.delete(),
-                Subsystem::HugeTlb(c) => c.delete(),
-                Subsystem::Rdma(c) => c.delete(),
-            }
-        });
-    }
-
-    /// Apply a set of resource limits to the control group.
-    pub fn apply(self: &Self, res: &Resources) {
-        for subsystem in &self.subsystems {
-            subsystem.to_controller().apply(res);
-        }
-    }
-
-    /// Retrieve a container based on type inference.
-    ///
-    /// ## Example:
-    ///
-    /// ```text
-    /// let pids: &PidController = control_group.controller_of()
-    ///                             .expect("No pids controller attached!");
-    /// let cpu: &CpuController = control_group.controller_of()
-    ///                             .expect("No cpu controller attached!");
-    /// ```
-    pub fn controller_of<'a, T>(self: &'a Self) -> Option<&'a T>
-        where &'a T: From<&'a Subsystem>,
-                  T: Controller + ControllIdentifier,
-    {
-        for i in &self.subsystems {
-            if i.to_controller().control_type() == T::controller_type() {
-                /*
-                 * N.B.:
-                 * https://play.rust-lang.org/?gist=978b2846bacebdaa00be62374f4f4334&version=stable&mode=debug&edition=2015
-                 */
-                return Some(i.into());
-            }
-        }
-        None
-    }
-
-    /// Removes a task from the control group.
-    ///
-    /// Note that this means that the task will be moved back to the root control group in the
-    /// hierarchy and any rules applied to that control group will _still_ apply to the task.
-    pub fn remove_task(self: &Self, pid: CgroupPid) {
-        let _ = self.hier.root_control_group().add_task(pid);
-    }
-
-    /// Attach a task to the control group.
-    pub fn add_task(self: &Self, pid: CgroupPid) -> Result<(), CgroupError> {
-        self.subsystems().iter().try_for_each(|sub| sub.to_controller().add_task(&pid))
-    }
-
-    /// Returns an Iterator that can be used to iterate over the tasks that are currently in the
-    /// control group.
-    pub fn tasks(self: &Self) -> Vec<CgroupPid> {
-        /* Collect the tasks from all subsystems */
-        let mut v = self.subsystems().iter()
-            .map(|x| x.to_controller().tasks())
-            .fold(vec![], |mut acc, mut x| { acc.append(&mut x); acc });
-        v.sort();
-        v.dedup();
-        v
-    }
-
-}

src/cpu.rs

@@ -1,123 +0,0 @@
-//! This module contains the implementation of the `cpu` cgroup subsystem.
-//! 
-//! See the Kernel's documentation for more information about this subsystem, found at:
-//!  [Documentation/scheduler/sched-design-CFS.txt](https://www.kernel.org/doc/Documentation/scheduler/sched-design-CFS.txt)
-//!  paragraph 7 ("GROUP SCHEDULER EXTENSIONS TO CFS").
-use std::path::PathBuf;
-use std::io::{Read, Write};
-
-use {CgroupError, CpuResources, Controllers, Controller, Resources, ControllIdentifier, Subsystem};
-
-/// A controller that allows controlling the `cpu` subsystem of a Cgroup.
-/// 
-/// In essence, it allows gathering information about how much the tasks inside the control group
-/// are using the CPU and creating rules that limit their usage. Note that this crate does not yet
-/// support managing realtime tasks.
-#[derive(Debug, Clone)]
-pub struct CpuController{
-    base: PathBuf,
-    path: PathBuf,
-}
-
-/// The current state of the control group and its processes.
-#[derive(Debug)]
-pub struct Cpu {
-    /// Reports CPU time statistics.
-    ///
-    /// Corresponds the `cpu.stat` file in `cpu` control group.
-    pub stat: String,
-}
-
-impl Controller for CpuController {
-    fn control_type(self: &Self) -> Controllers { Controllers::Cpu}
-    fn get_path<'a>(self: &'a Self) -> &'a PathBuf { &self.path }
-    fn get_path_mut<'a>(self: &'a mut Self) -> &'a mut PathBuf { &mut self.path }
-    fn get_base<'a>(self: &'a Self) -> &'a PathBuf { &self.base }
-
-    fn apply(self: &Self, res: &Resources) {
-        /* get the resources that apply to this controller */
-        let res: &CpuResources = &res.cpu;
-
-        if res.update_values {
-            /* apply pid_max */
-            let _ = self.set_shares(res.shares);
-            let _ = self.set_cfs_period(res.period);
-            let _ = self.set_cfs_quota(res.quota as u64);
-            /* TODO: rt properties (CONFIG_RT_GROUP_SCHED) are not yet supported */
-        }
-    }
-}
-
-impl ControllIdentifier for CpuController {
-    fn controller_type() -> Controllers {
-        Controllers::Cpu
-    }
-}
-
-impl<'a> From<&'a Subsystem> for &'a CpuController {
-    fn from(sub: &'a Subsystem) -> &'a CpuController {
-        unsafe {
-            match sub {
-                Subsystem::Cpu(c) => c,
-                _ => {
-                    assert_eq!(1, 0);
-                    ::std::mem::uninitialized()
-                },
-            }
-        }
-    }
-}
-
-impl CpuController {
-    /// Contructs a new `CpuController` with `oroot` serving as the root of the control group.
-    pub fn new(oroot: PathBuf) -> Self {
-        let mut root = oroot;
-        root.push(Self::controller_type().to_string());
-        Self {
-            base: root.clone(),
-            path: root,
-        }
-    }
-
-    /// Returns CPU time statistics based on the processes in the control group.
-    pub fn cpu(self: &Self) -> Cpu {
-        Cpu {
-            stat: self.open_path("cpu.stat", false).and_then(|mut file| {
-                let mut s = String::new();
-                let res = file.read_to_string(&mut s);
-                match res {
-                    Ok(_) => Ok(s),
-                    Err(e) => Err(CgroupError::ReadError(e)),
-                }
-            }).unwrap_or("".to_string()),
-        }
-    }
-
-    /// Configures the CPU bandwidth (in relative relation to other control groups and this control
-    /// group's parent).
-    /// 
-    /// For example, setting control group `A`'s `shares` to `100`, and control group `B`'s
-    /// `shares` to `200` ensures that control group `B` receives twice as much as CPU bandwidth.
-    /// (Assuming both `A` and `B` are of the same parent)
-    pub fn set_shares(self: &Self, shares: u64) -> Result<(), CgroupError> {
-        self.open_path("cpu.shares", true).and_then(|mut file| {
-            file.write_all(shares.to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Specify a period (when using the CFS scheduler) of time in microseconds for how often this
-    /// control group's access to the CPU should be reallocated.
-    pub fn set_cfs_period(self: &Self, us: u64) -> Result<(), CgroupError> {
-        self.open_path("cpu.cfs_period_us", true).and_then(|mut file| {
-            file.write_all(us.to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Specify a quota (when using the CFS scheduler) of time in microseconds for which all tasks
-    /// in this control group can run during one period (see: `set_cfs_period()`).
-    pub fn set_cfs_quota(self: &Self, us: u64) -> Result<(), CgroupError> {
-        self.open_path("cpu.cfs_quota_us", true).and_then(|mut file| {
-            file.write_all(us.to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-}

src/cpuacct.rs

@@ -1,145 +0,0 @@
-//! This module contains the implementation of the `cpuacct` cgroup subsystem.
-//! 
-//! See the Kernel's documentation for more information about this subsystem, found at:
-//!  [Documentation/cgroup-v1/cpuacct.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/cpuacct.txt)
-use std::path::PathBuf;
-use std::io::{Read, Write};
-use std::fs::File;
-
-use {CgroupError, Controllers, Resources, Subsystem, ControllIdentifier, Controller};
-
-/// A controller that allows controlling the `cpuacct` subsystem of a Cgroup.
-///
-/// In essence, this control group provides accounting (hence the name `cpuacct`) for CPU usage of
-/// the tasks in the control group.
-#[derive(Debug, Clone)]
-pub struct CpuAcctController {
-    base: PathBuf,
-    path: PathBuf,
-}
-
-/// Represents the statistics retrieved from the control group.
-pub struct CpuAcct {
-    /// Divides the time used by the tasks into `user` time and `system` time.
-    pub stat: String,
-    /// Total CPU time (in nanoseconds) spent by the tasks.
-    pub usage: u64,
-    /// Total CPU time (in nanoseconds) spent by the tasks, broken down by CPU and by whether the
-    /// time spent is `user` time or `system` time.
-    ///
-    /// An example is as follows:
-    /// ```text
-    /// cpu user system
-    /// 0 8348363768 0
-    /// 1 8324369100 0
-    /// 2 8598185449 0
-    /// 3 8648262473 0
-    /// ```
-    pub usage_all: String,
-    /// CPU time (in nanoseconds) spent by the tasks, broken down by each CPU.
-    /// Times spent in each CPU are separated by a space.
-    pub usage_percpu: String,
-    /// As for `usage_percpu`, but the `system` time spent.
-    pub usage_percpu_sys: String,
-    /// As for `usage_percpu`, but the `user` time spent.
-    pub usage_percpu_user: String,
-    /// CPU time (in nanoseconds) spent by the tasks that counted for `system` time.
-    pub usage_sys: u64,
-    /// CPU time (in nanoseconds) spent by the tasks that counted for `user` time.
-    pub usage_user: u64,
-}
-
-impl Controller for CpuAcctController {
-    fn control_type(self: &Self) -> Controllers { Controllers::CpuAcct }
-    fn get_path<'a>(self: &'a Self) -> &'a PathBuf { &self.path }
-    fn get_path_mut<'a>(self: &'a mut Self) -> &'a mut PathBuf { &mut self.path }
-    fn get_base<'a>(self: &'a Self) -> &'a PathBuf { &self.base }
-
-    fn apply(self: &Self, _res: &Resources) {
-    }
-}
-
-impl ControllIdentifier for CpuAcctController {
-    fn controller_type() -> Controllers {
-        Controllers::CpuAcct
-    }
-}
-
-impl<'a> From<&'a Subsystem> for &'a CpuAcctController {
-    fn from(sub: &'a Subsystem) -> &'a CpuAcctController {
-        unsafe {
-            match sub {
-                Subsystem::CpuAcct(c) => c,
-                _ => {
-                    assert_eq!(1, 0);
-                    ::std::mem::uninitialized()
-                },
-            }
-        }
-    }
-}
-
-fn read_u64_from(mut file: File) -> Result<u64, CgroupError> {
-    let mut string = String::new();
-    let res = file.read_to_string(&mut string);
-    match res {
-        Ok(_) => match string.trim().parse() {
-            Ok(e) => Ok(e),
-            Err(_) => Err(CgroupError::ParseError),
-        },
-        Err(e) => Err(CgroupError::ReadError(e)),
-    }
-}
-
-fn read_string_from(mut file: File) -> Result<String, CgroupError> {
-    let mut string = String::new();
-    match file.read_to_string(&mut string) {
-        Ok(_) => Ok(string.trim().to_string()),
-        Err(e) => Err(CgroupError::ReadError(e)),
-    }
-}
-
-impl CpuAcctController {
-
-    /// Contructs a new `CpuAcctController` with `oroot` serving as the root of the control group.
-    pub fn new(oroot: PathBuf) -> Self {
-        let mut root = oroot;
-        root.push(Self::controller_type().to_string());
-        Self {
-            base: root.clone(),
-            path: root,
-        }
-    }
-
-    /// Gathers the statistics that are available in the control group into a `CpuAcct` structure.
-    pub fn cpuacct(self: &Self) -> CpuAcct {
-        CpuAcct {
-            stat: self.open_path("cpuacct.stat", false)
-                    .and_then(|file| read_string_from(file)).unwrap_or("".to_string()),
-            usage: self.open_path("cpuacct.usage", false)
-                    .and_then(|file| read_u64_from(file))
-                    .unwrap_or(0),
-            usage_all: self.open_path("cpuacct.usage_all", false)
-                    .and_then(|file| read_string_from(file)).unwrap_or("".to_string()),
-            usage_percpu: self.open_path("cpuacct.usage_percpu", false)
-                    .and_then(|file| read_string_from(file)).unwrap_or("".to_string()),
-            usage_percpu_sys: self.open_path("cpuacct.usage_percpu_sys", false)
-                    .and_then(|file| read_string_from(file)).unwrap_or("".to_string()),
-            usage_percpu_user: self.open_path("cpuacct.usage_percpu_user", false)
-                    .and_then(|file| read_string_from(file)).unwrap_or("".to_string()),
-            usage_sys: self.open_path("cpuacct.usage_sys", false)
-                    .and_then(|file| read_u64_from(file))
-                    .unwrap_or(0),
-            usage_user: self.open_path("cpuacct.usage_user", false)
-                    .and_then(|file| read_u64_from(file))
-                    .unwrap_or(0),
-        }
-    }
-
-    /// Reset the statistics the kernel has gathered about the control group.
-    pub fn reset(self: &Self) -> Result<(), CgroupError> {
-        self.open_path("cpuacct.usage", true).and_then(|mut file| {
-            file.write_all(b"0").map_err(CgroupError::WriteError)
-        })
-    }
-}

src/cpuset.rs

@@ -1,330 +0,0 @@
-//! This module contains the implementation of the `cpuset` cgroup subsystem.
-//! 
-//! See the Kernel's documentation for more information about this subsystem, found at:
-//!  [Documentation/cgroup-v1/cpusets.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/cpusets.txt)
-use std::path::PathBuf;
-use std::io::{Read, Write};
-use std::fs::File;
-
-use {CgroupError, CpuResources, Resources, Controller, ControllIdentifier, Subsystem, Controllers};
-use CgroupError::*;
-
-/// A controller that allows controlling the `cpuset` subsystem of a Cgroup.
-/// 
-/// In essence, this controller is responsible for restricting the tasks in the control group to a
-/// set of CPUs and/or memory nodes.
-#[derive(Debug, Clone)]
-pub struct CpuSetController {
-    base: PathBuf,
-    path: PathBuf,
-}
-
-/// The current state of the `cpuset` controller for this control group.
-pub struct CpuSet {
-    /// If true, no other control groups can share the CPUs listed in the `cpus` field.
-    pub cpu_exclusive: bool,
-    /// The list of CPUs the tasks of the control group can run on. This is a comma-separated list
-    /// with dashes between numbers representing ranges.
-    pub cpus: String,
-    /// The list of CPUs that the tasks can effectively run on. This removes the list of CPUs that
-    /// the parent (and all of its parents) cannot run on from the `cpus` field of this control
-    /// group.
-    pub effective_cpus: String,
-    /// The list of memory nodes that the tasks can effectively use. This removes the list of nodes that
-    /// the parent (and all of its parents) cannot use from the `mems` field of this control
-    /// group.
-    pub effective_mems: String,
-    /// If true, no other control groups can share the memory nodes listed in the `mems` field.
-    pub mem_exclusive: bool,
-    /// If true, the control group is 'hardwalled'. Kernel memory allocations (except for a few
-    /// minor exceptions) are made from the memory nodes designated in the `mems` field.
-    pub mem_hardwall: bool,
-    /// If true, whenever `mems` is changed via `set_mems()`, the memory stored on the previous
-    /// nodes are migrated to the new nodes selected by the new `mems`.
-    pub memory_migrate: bool,
-    /// Running average of the memory pressured faced by the tasks in the control group.
-    pub memory_pressure: u64,
-    /// This field is only at the root control group and controls whether the kernel will compute
-    /// the memory pressure for control groups or not.
-    pub memory_pressure_enabled: Option<bool>,
-    /// If true, filesystem buffers are spread across evenly between the nodes specified in `mems`.
-    pub memory_spread_page: bool, 
-    /// If true, kernel slab caches for file I/O are spread across evenly between the nodes
-    /// specified in `mems`.
-    pub memory_spread_slab: bool, 
-    /// The list of memory nodes the tasks of the control group can use. This is a comma-separated list
-    /// with dashes between numbers representing ranges.
-    pub mems: String,
-    /// If true, the kernel will attempt to rebalance the load between the CPUs specified in the
-    /// `cpus` field of this control group.
-    pub sched_load_balance: bool,
-    /// Represents how much work the kernel should do to rebalance this cpuset.
-    ///
-    /// | `sched_load_balance` | Effect |
-    /// | -------------------- | ------ |
-    /// |          -1          | Use the system default value |
-    /// |           0          | Only balance loads periodically |
-    /// |           1          | Immediately balance the load across tasks on the same core |
-    /// |           2          | Immediately balance the load across cores in the same CPU package |
-    /// |           4          | Immediately balance the load across CPUs on the same node |
-    /// |           5          | Immediately balance the load between CPUs even if the system is NUMA |
-    /// |           6          | Immediately balance the load between all CPUs |
-    pub sched_relax_domain_level: u64,
-
-}
-
-impl Controller for CpuSetController {
-    fn control_type(self: &Self) -> Controllers { Controllers::CpuSet }
-    fn get_path<'a>(self: &'a Self) -> &'a PathBuf { &self.path }
-    fn get_path_mut<'a>(self: &'a mut Self) -> &'a mut PathBuf { &mut self.path }
-    fn get_base<'a>(self: &'a Self) -> &'a PathBuf { &self.base }
-
-    fn apply(self: &Self, res: &Resources) {
-        /* get the resources that apply to this controller */
-        let res: &CpuResources = &res.cpu;
-
-        if res.update_values {
-            /* apply pid_max */
-            let _ = self.set_cpus(&res.cpus);
-            let _ = self.set_mems(&res.mems);
-        }
-    }
-}
-
-impl ControllIdentifier for CpuSetController {
-    fn controller_type() -> Controllers {
-        Controllers::CpuSet
-    }
-}
-
-impl<'a> From<&'a Subsystem> for &'a CpuSetController {
-    fn from(sub: &'a Subsystem) -> &'a CpuSetController {
-        unsafe {
-            match sub {
-                Subsystem::CpuSet(c) => c,
-                _ => {
-                    assert_eq!(1, 0);
-                    ::std::mem::uninitialized()
-                },
-            }
-        }
-    }
-}
-
-fn read_string_from(mut file: File) -> Result<String, CgroupError> {
-    let mut string = String::new();
-    match file.read_to_string(&mut string) {
-        Ok(_) => Ok(string.trim().to_string()),
-        Err(e) => Err(CgroupError::ReadError(e)),
-    }
-}
-
-fn read_u64_from(mut file: File) -> Result<u64, CgroupError> {
-    let mut string = String::new();
-    match file.read_to_string(&mut string) {
-        Ok(_) => string.trim().parse().map_err(|_| ParseError),
-        Err(e) => Err(CgroupError::ReadError(e)),
-    }
-}
-
-impl CpuSetController {
-    /// Contructs a new `CpuSetController` with `oroot` serving as the root of the control group.
-    pub fn new(oroot: PathBuf) -> Self {
-        let mut root = oroot;
-        root.push(Self::controller_type().to_string());
-        Self {
-            base: root.clone(),
-            path: root,
-        }
-    }
-
-    /// Returns the statistics gathered by the kernel for this control group. See the struct for
-    /// more information on what information this entails.
-    pub fn cpuset(self: &Self) -> CpuSet {
-        CpuSet {
-            cpu_exclusive: {
-                self.open_path("cpuset.cpu_exclusive", false).and_then(|file| {
-                    read_u64_from(file)
-                }).map(|x| x == 1).unwrap_or(false)
-            },
-            cpus: {
-                self.open_path("cpuset.cpus", false).and_then(read_string_from).unwrap_or("".to_string())
-            },
-            effective_cpus: {
-                self.open_path("cpuset.effective_cpus", false).and_then(read_string_from).unwrap_or("".to_string())
-            },
-            effective_mems: {
-                self.open_path("cpuset.effective_mems", false).and_then(read_string_from).unwrap_or("".to_string())
-            },
-            mem_exclusive: {
-                self.open_path("cpuset.mem_exclusive", false).and_then(read_u64_from)
-                    .map(|x| x == 1).unwrap_or(false)
-            },
-            mem_hardwall: {
-                self.open_path("cpuset.mem_hardwall", false).and_then(read_u64_from)
-                    .map(|x| x == 1).unwrap_or(false)
-            },
-            memory_migrate: {
-                self.open_path("cpuset.memory_migrate", false).and_then(read_u64_from)
-                    .map(|x| x == 1).unwrap_or(false)
-            },
-            memory_pressure: {
-                self.open_path("cpuset.memory_pressure", false).and_then(read_u64_from).unwrap_or(0)
-            },
-            memory_pressure_enabled: {
-                self.open_path("cpuset.memory_pressure_enabled", false).and_then(read_u64_from)
-                    .map(|x| x == 1).ok()
-            },
-            memory_spread_page: {
-                self.open_path("cpuset.memory_spread_page", false).and_then(read_u64_from)
-                    .map(|x| x == 1).unwrap_or(false)
-            },
-            memory_spread_slab: {
-                self.open_path("cpuset.memory_spread_slab", false).and_then(read_u64_from)
-                    .map(|x| x == 1).unwrap_or(false)
-            },
-            mems: {
-                self.open_path("cpuset.mems", false).and_then(read_string_from).unwrap_or("".to_string())
-            },
-            sched_load_balance: {
-                self.open_path("cpuset.sched_load_balance", false).and_then(read_u64_from)
-                    .map(|x| x == 1).unwrap_or(false)
-            },
-            sched_relax_domain_level: {
-                self.open_path("cpuset.sched_relax_domain_level", false).and_then(read_u64_from)
-                    .unwrap_or(0)
-            },
-        }
-    }
-
-    /// Control whether the CPUs selected via `set_cpus()` should be exclusive to this control
-    /// group or not.
-    pub fn set_cpu_exclusive(self: &Self, b: bool) -> Result<(), CgroupError> {
-        self.open_path("cpuset.cpu_exclusive", true).and_then(|mut file| {
-            if b {
-                file.write_all(b"1").map_err(CgroupError::WriteError)
-            } else {
-                file.write_all(b"0").map_err(CgroupError::WriteError)
-            }
-        })
-    }
-
-    /// Control whether the memory nodes selected via `set_memss()` should be exclusive to this control
-    /// group or not.
-    pub fn set_mem_exclusive(self: &Self, b: bool) -> Result<(), CgroupError> {
-        self.open_path("cpuset.mem_exclusive", true).and_then(|mut file| {
-            if b {
-                file.write_all(b"1").map_err(CgroupError::WriteError)
-            } else {
-                file.write_all(b"0").map_err(CgroupError::WriteError)
-            }
-        })
-    }
-
-    /// Set the CPUs that the tasks in this control group can run on.
-    ///
-    /// Syntax is a comma separated list of CPUs, with an additional extension that ranges can
-    /// be represented via dashes.
-    pub fn set_cpus(self: &Self, cpus: &String) -> Result<(), CgroupError> {
-        self.open_path("cpuset.cpus", true).and_then(|mut file| {
-            file.write_all(cpus.as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Set the memory nodes that the tasks in this control group can use.
-    ///
-    /// Syntax is the same as with `set_cpus()`.
-    pub fn set_mems(self: &Self, mems: &String) -> Result<(), CgroupError> {
-        self.open_path("cpuset.mems", true).and_then(|mut file| {
-            file.write_all(mems.as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Controls whether the control group should be "hardwalled", i.e., whether kernel allocations
-    /// should exclusively use the memory nodes set via `set_mems()`.
-    ///
-    /// Note that some kernel allocations, most notably those that are made in interrupt handlers
-    /// may disregard this.
-    pub fn set_hardwall(self: &Self, b: bool) -> Result<(), CgroupError> {
-        self.open_path("cpuset.mem_hardwall", true).and_then(|mut file| {
-            if b {
-                file.write_all(b"1").map_err(CgroupError::WriteError)
-            } else {
-                file.write_all(b"0").map_err(CgroupError::WriteError)
-            }
-        })
-    }
-
-    /// Controls whether the kernel should attempt to rebalance the load between the CPUs specified in the
-    /// `cpus` field of this control group.
-    pub fn set_load_balancing(self: &Self, b: bool) -> Result<(), CgroupError> {
-        self.open_path("cpuset.sched_load_balance", true).and_then(|mut file| {
-            if b {
-                file.write_all(b"1").map_err(CgroupError::WriteError)
-            } else {
-                file.write_all(b"0").map_err(CgroupError::WriteError)
-            }
-        })
-    }
-
-    /// Contorl how much effort the kernel should invest in rebalacing the control group.
-    ///
-    /// See @CpuSet 's similar field for more information.
-    pub fn set_rebalance_relax_domain_level(self: &Self, i: i64) -> Result<(), CgroupError> {
-        self.open_path("cpuset.sched_relax_domain_level", true).and_then(|mut file| {
-            file.write_all(i.to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Control whether when using `set_mems()` the existing memory used by the tasks should be
-    /// migrated over to the now-selected nodes.
-    pub fn set_memory_migration(self: &Self, b: bool) -> Result<(), CgroupError> {
-        self.open_path("cpuset.memory_migrate", true).and_then(|mut file| {
-            if b {
-                file.write_all(b"1").map_err(CgroupError::WriteError)
-            } else {
-                file.write_all(b"0").map_err(CgroupError::WriteError)
-            }
-        })
-    }
-
-    /// Control whether filesystem buffers should be evenly split across the nodes selected via
-    /// `set_mems()`.
-    pub fn set_memory_spread_page(self: &Self, b: bool) -> Result<(), CgroupError> {
-        self.open_path("cpuset.memory_spread_page", true).and_then(|mut file| {
-            if b {
-                file.write_all(b"1").map_err(CgroupError::WriteError)
-            } else {
-                file.write_all(b"0").map_err(CgroupError::WriteError)
-            }
-        })
-    }
-
-    /// Control whether the kernel's slab cache for file I/O should be evenly split across the
-    /// nodes selected via `set_mems()`.
-    pub fn set_memory_spread_slab(self: &Self, b: bool) -> Result<(), CgroupError> {
-        self.open_path("cpuset.memory_spread_slab", true).and_then(|mut file| {
-            if b {
-                file.write_all(b"1").map_err(CgroupError::WriteError)
-            } else {
-                file.write_all(b"0").map_err(CgroupError::WriteError)
-            }
-        })
-    }
-
-    /// Control whether the kernel should collect information to calculate memory pressure for
-    /// control groups.
-    ///
-    /// Note: This is a no-operation if the control group referred by `self` is not the root
-    /// control group.
-    pub fn set_enable_memory_pressure(self: &Self, b: bool) -> Result<(), CgroupError> {
-        /* XXX: this file should only be present in the root cpuset cg */
-        self.open_path("cpuset.memory_pressure_enabled", true).and_then(|mut file| {
-            if b {
-                file.write_all(b"1").map_err(CgroupError::WriteError)
-            } else {
-                file.write_all(b"0").map_err(CgroupError::WriteError)
-            }
-        })
-    }
-}

src/devices.rs

@@ -1,116 +0,0 @@
-//! This module contains the implementation of the `devices` cgroup subsystem.
-//! 
-//! See the Kernel's documentation for more information about this subsystem, found at:
-//!  [Documentation/cgroup-v1/devices.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/devices.txt)
-use std::path::PathBuf;
-use std::io::{Read, Write};
-
-use {CgroupError, DeviceResources, Controllers, Controller, Resources, ControllIdentifier, Subsystem};
-
-/// A controller that allows controlling the `devices` subsystem of a Cgroup.
-///
-/// In essence, using the devices controller, it is possible to allow or disallow sets of devices to
-/// be used by the control group's tasks.
-#[derive(Debug, Clone)]
-pub struct DevicesController{
-    base: PathBuf,
-    path: PathBuf,
-}
-
-impl Controller for DevicesController {
-    fn control_type(self: &Self) -> Controllers { Controllers::Devices }
-    fn get_path<'a>(self: &'a Self) -> &'a PathBuf { &self.path }
-    fn get_path_mut<'a>(self: &'a mut Self) -> &'a mut PathBuf { &mut self.path }
-    fn get_base<'a>(self: &'a Self) -> &'a PathBuf { &self.base }
-
-    fn apply(self: &Self, res: &Resources) {
-        /* get the resources that apply to this controller */
-        let res: &DeviceResources = &res.devices;
-
-        if res.update_values {
-            for i in &res.devices {
-                let wstr = format!("{} {}:{} {}",
-                                   i.devtype, i.major, i.minor, i.access);
-                if i.allow {
-                    let _ = self.allow_device(&wstr);
-                } else {
-                    let _ = self.deny_device(&wstr);
-                }
-            }
-        }
-    }
-}
-
-impl ControllIdentifier for DevicesController {
-    fn controller_type() -> Controllers {
-        Controllers::Devices
-    }
-}
-
-impl<'a> From<&'a Subsystem> for &'a DevicesController {
-    fn from(sub: &'a Subsystem) -> &'a DevicesController {
-        unsafe {
-            match sub {
-                Subsystem::Devices(c) => c,
-                _ => {
-                    assert_eq!(1, 0);
-                    ::std::mem::uninitialized()
-                },
-            }
-        }
-    }
-}
-
-impl DevicesController {
-    /// Constructs a new `DevicesController` with `oroot` serving as the root of the control group.
-    pub fn new(oroot: PathBuf) -> Self {
-        let mut root = oroot;
-        root.push(Self::controller_type().to_string());
-        Self {
-            base: root.clone(),
-            path: root,
-        }
-    }
-
-    /// Allow a (possibly, set of) device(s) to be used by the tasks in the control group.
-    ///
-    /// The format of `dev` is rather simple:
-    /// `$type $major:$minor $rwm`
-    /// where `$rwm` is a combination of the characters `r`, `w`, `m`, each standing for read,
-    /// write, mknod permissions.
-    ///
-    /// Note that `dev` can be "regex"-like: both `$major` and `$minor` can be `*` which implies
-    /// that their value does not matter.
-    pub fn allow_device(self: &Self, dev: &String) -> Result<(), CgroupError> {
-        self.open_path("devices.allow", true).and_then(|mut file| {
-            file.write_all(dev.as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Deny the control group's tasks access to the devices covered by `dev`.
-    ///
-    /// The format of `dev` is rather simple:
-    /// `$type $major:$minor $rwm`
-    /// where `$rwm` is a combination of the characters `r`, `w`, `m`, each standing for read,
-    /// write, mknod permissions.
-    ///
-    /// Note that `dev` can be "regex"-like: both `$major` and `$minor` can be `*` which implies
-    /// that their value does not matter.
-    pub fn deny_device(self: &Self, dev: &String) -> Result<(), CgroupError> {
-        self.open_path("devices.deny", true).and_then(|mut file| {
-            file.write_all(dev.as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Get the current list of allowed devices.
-    pub fn allowed_devices(self: &Self) -> Result<String, CgroupError> {
-        self.open_path("devices.list", false).and_then(|mut file| {
-            let mut s = String::new();
-            let res = file.read_to_string(&mut s);
-            match res {
-                Ok(_) => Ok(s),
-                Err(e) => Err(CgroupError::ReadError(e)),
-            }
-        })
-    }
-}

src/freezer.rs

@@ -1,105 +0,0 @@
-//! This module contains the implementation of the `freezer` cgroup subsystem.
-//! 
-//! See the Kernel's documentation for more information about this subsystem, found at:
-//!  [Documentation/cgroup-v1/freezer-subsystem.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/freezer-subsystem.txt)
-use std::path::PathBuf;
-use std::io::{Read, Write};
-
-use {CgroupError, Controllers, Controller, Resources, ControllIdentifier, Subsystem};
-
-/// A controller that allows controlling the `freezer` subsystem of a Cgroup.
-///
-/// In essence, this subsystem allows the user to freeze and thaw (== "un-freeze") the processes in
-/// the control group. This is done _transparently_ so that neither the parent, nor the children of
-/// the processes can observe the freeze.
-///
-/// Note that if the control group is currently in the `Frozen` or `Freezing` state, then no
-/// processes can be added to it.
-#[derive(Debug, Clone)]
-pub struct FreezerController{
-    base: PathBuf,
-    path: PathBuf,
-}
-
-/// The current state of the control group
-pub enum FreezerState {
-    /// The processes in the control group are _not_ frozen.
-    Thawed,
-    /// The processes in the control group are in the processes of being frozen.
-    Freezing,
-    /// The processes in the control group are frozen.
-    Frozen,
-}
-
-impl Controller for FreezerController {
-    fn control_type(self: &Self) -> Controllers { Controllers::Freezer }
-    fn get_path<'a>(self: &'a Self) -> &'a PathBuf { &self.path }
-    fn get_path_mut<'a>(self: &'a mut Self) -> &'a mut PathBuf { &mut self.path }
-    fn get_base<'a>(self: &'a Self) -> &'a PathBuf { &self.base }
-
-    fn apply(self: &Self, _res: &Resources) {
-    }
-}
-
-impl ControllIdentifier for FreezerController {
-    fn controller_type() -> Controllers {
-        Controllers::Freezer
-    }
-}
-
-impl<'a> From<&'a Subsystem> for &'a FreezerController {
-    fn from(sub: &'a Subsystem) -> &'a FreezerController {
-        unsafe {
-            match sub {
-                Subsystem::Freezer(c) => c,
-                _ => {
-                    assert_eq!(1, 0);
-                    ::std::mem::uninitialized()
-                },
-            }
-        }
-    }
-}
-
-impl FreezerController {
-    /// Contructs a new `FreezerController` with `oroot` serving as the root of the control group.
-    pub fn new(oroot: PathBuf) -> Self {
-        let mut root = oroot;
-        root.push(Self::controller_type().to_string());
-        Self {
-            base: root.clone(),
-            path: root,
-        }
-    }
-
-    /// Freezes the processes in the control group.
-    pub fn freeze(self: &Self) -> Result<(), CgroupError> {
-        self.open_path("freezer.state", true).and_then(|mut file| {
-            file.write_all("FROZEN".to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Thaws, that is, unfreezes the processes in the control group.
-    pub fn thaw(self: &Self) -> Result<(), CgroupError> {
-        self.open_path("freezer.state", true).and_then(|mut file| {
-            file.write_all("THAWED".to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Retrieve the state of processes in the control group.
-    pub fn state(self: &Self) -> Result<FreezerState, CgroupError> {
-        self.open_path("freezer.state", false).and_then(|mut file| {
-            let mut s = String::new();
-            let res = file.read_to_string(&mut s);
-            match res {
-                Ok(_) => match s.as_ref() {
-                    "FROZEN" => Ok(FreezerState::Frozen),
-                    "THAWED" => Ok(FreezerState::Thawed),
-                    "FREEZING" => Ok(FreezerState::Freezing),
-                    _ => Err(CgroupError::ParseError),
-                },
-                Err(e) => Err(CgroupError::ReadError(e)),
-            }
-        })
-    }
-}

src/fs/blkio.rs

@@ -0,0 +1,975 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020 And Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! This module contains the implementation of the `blkio` cgroup subsystem.
+//!
+//! See the Kernel's documentation for more information about this subsystem, found at:
+//!  [Documentation/cgroup-v1/blkio-controller.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/blkio-controller.txt)
+use std::io::Write;
+use std::path::PathBuf;
+
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
+
+use crate::fs::{read_string_from, read_u64_from};
+use crate::fs::{
+    BlkIoResources, ControllIdentifier, ControllerInternal, Controllers, CustomizedAttribute,
+    Resources, Subsystem,
+};
+
+/// A controller that allows controlling the `blkio` subsystem of a Cgroup.
+///
+/// In essence, using the `blkio` controller one can limit and throttle the tasks' usage of block
+/// devices in the control group.
+#[derive(Debug, Clone)]
+pub struct BlkIoController {
+    base: PathBuf,
+    path: PathBuf,
+    v2: bool,
+}
+
+#[derive(Eq, PartialEq, Debug)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+/// Per-device information
+pub struct BlkIoData {
+    /// The major number of the device.
+    pub major: i16,
+    /// The minor number of the device.
+    pub minor: i16,
+    /// The data that is associated with the device.
+    pub data: u64,
+}
+
+#[derive(Eq, PartialEq, Debug, Default)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+/// Per-device activity from the control group.
+pub struct IoService {
+    /// The major number of the device.
+    pub major: i16,
+    /// The minor number of the device.
+    pub minor: i16,
+    /// How many items were read from the device.
+    pub read: u64,
+    /// How many items were written to the device.
+    pub write: u64,
+    /// How many items were synchronously transferred.
+    pub sync: u64,
+    /// How many items were asynchronously transferred.
+    pub r#async: u64,
+    /// How many items were discarded.
+    pub discard: u64,
+    /// Total number of items transferred.
+    pub total: u64,
+}
+
+#[derive(Eq, PartialEq, Debug)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+/// Per-device activity from the control group.
+/// Only for cgroup v2
+pub struct IoStat {
+    /// The major number of the device.
+    pub major: i16,
+    /// The minor number of the device.
+    pub minor: i16,
+    /// How many bytes were read from the device.
+    pub rbytes: u64,
+    /// How many bytes were written to the device.
+    pub wbytes: u64,
+    /// How many iops were read from the device.
+    pub rios: u64,
+    /// How many iops were written to the device.
+    pub wios: u64,
+    /// How many discard bytes were read from the device.
+    pub dbytes: u64,
+    /// How many discard iops were written to the device.
+    pub dios: u64,
+}
+
+fn parse_io_service(s: String) -> Result<Vec<IoService>> {
+    let mut io_services = Vec::<IoService>::new();
+    let mut io_service = IoService::default();
+
+    let lines = s
+        .lines()
+        .filter(|x| x.split_whitespace().count() == 3)
+        .map(|x| {
+            let mut spl = x.split_whitespace();
+            (
+                spl.next().unwrap(),
+                spl.next().unwrap(),
+                spl.next().unwrap(),
+            )
+        })
+        .map(|(a, b, c)| {
+            let mut spl = a.split(':');
+            (
+                spl.next().unwrap().parse::<i16>(),
+                spl.next().unwrap().parse::<i16>(),
+                b,
+                c,
+            )
+        })
+        .collect::<Vec<_>>();
+
+    for (major_num, minor_num, op, val) in lines.iter() {
+        let major = *major_num.as_ref().map_err(|_| Error::new(ParseError))?;
+        let minor = *minor_num.as_ref().map_err(|_| Error::new(ParseError))?;
+
+        if (major != io_service.major || minor != io_service.minor) && io_service.major != 0 {
+            // new block device
+            io_services.push(io_service);
+            io_service = IoService::default();
+        }
+
+        io_service.major = major;
+        io_service.minor = minor;
+
+        let val = val.parse::<u64>().map_err(|_| Error::new(ParseError))?;
+
+        match *op {
+            "Read" => io_service.read = val,
+            "Write" => io_service.write = val,
+            "Sync" => io_service.sync = val,
+            "Async" => io_service.r#async = val,
+            "Discard" => io_service.discard = val,
+            "Total" => io_service.total = val,
+            _ => {}
+        }
+    }
+
+    if io_service.major != 0 {
+        io_services.push(io_service);
+    }
+
+    Ok(io_services)
+}
+
+fn get_value(s: &str) -> String {
+    let arr = s.split(':').collect::<Vec<&str>>();
+    if arr.len() != 2 {
+        return "0".to_string();
+    }
+    arr[1].to_string()
+}
+
+fn parse_io_stat(s: String) -> Vec<IoStat> {
+    // line:
+    // 8:0 rbytes=180224 wbytes=0 rios=3 wios=0 dbytes=0 dios=0
+    s.lines()
+        .filter(|x| x.split_whitespace().count() == 7)
+        .map(|x| {
+            let arr = x.split_whitespace().collect::<Vec<&str>>();
+            let device = arr[0].split(':').collect::<Vec<&str>>();
+            let (major, minor) = (device[0], device[1]);
+
+            IoStat {
+                major: major.parse::<i16>().unwrap(),
+                minor: minor.parse::<i16>().unwrap(),
+                rbytes: get_value(arr[1]).parse::<u64>().unwrap(),
+                wbytes: get_value(arr[2]).parse::<u64>().unwrap(),
+                rios: get_value(arr[3]).parse::<u64>().unwrap(),
+                wios: get_value(arr[4]).parse::<u64>().unwrap(),
+                dbytes: get_value(arr[5]).parse::<u64>().unwrap(),
+                dios: get_value(arr[6]).parse::<u64>().unwrap(),
+            }
+        })
+        .collect::<Vec<IoStat>>()
+}
+
+fn parse_io_service_total(s: String) -> Result<u64> {
+    s.lines()
+        .find_map(|line| {
+            let mut parts = line.split_whitespace();
+            match (parts.next(), parts.next(), parts.next()) {
+                (Some("Total"), Some(val), None) => val.parse::<u64>().ok(),
+                _ => None,
+            }
+        })
+        .ok_or_else(|| Error::new(ParseError))
+}
+
+fn parse_blkio_data(s: String) -> Result<Vec<BlkIoData>> {
+    let r = s
+        .chars()
+        .map(|x| if x == ':' { ' ' } else { x })
+        .collect::<String>();
+
+    let r = r
+        .lines()
+        .flat_map(|x| x.split_whitespace())
+        .collect::<Vec<_>>();
+
+    let r = r.chunks(3).collect::<Vec<_>>();
+
+    let mut res = Vec::new();
+
+    let err = r.iter().try_for_each(|x| match x {
+        [major, minor, data] => {
+            res.push(BlkIoData {
+                major: major.parse::<i16>().unwrap(),
+                minor: minor.parse::<i16>().unwrap(),
+                data: data.parse::<u64>().unwrap(),
+            });
+            Ok(())
+        }
+        _ => Err(Error::new(ParseError)),
+    });
+
+    if err.is_err() {
+        Err(Error::new(ParseError))
+    } else {
+        Ok(res)
+    }
+}
+
+/// Current state and statistics about how throttled are the block devices when accessed from the
+/// controller's control group.
+#[derive(Default, Debug)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct BlkIoThrottle {
+    /// Statistics about the bytes transferred between the block devices by the tasks in this
+    /// control group.
+    pub io_service_bytes: Vec<IoService>,
+    /// Total amount of bytes transferred to and from the block devices.
+    pub io_service_bytes_total: u64,
+    /// Same as `io_service_bytes`, but contains all descendant control groups.
+    pub io_service_bytes_recursive: Vec<IoService>,
+    /// Total amount of bytes transferred to and from the block devices, including all descendant
+    /// control groups.
+    pub io_service_bytes_recursive_total: u64,
+    /// The number of I/O operations performed on the devices as seen by the throttling policy.
+    pub io_serviced: Vec<IoService>,
+    /// The total number of I/O operations performed on the devices as seen by the throttling
+    /// policy.
+    pub io_serviced_total: u64,
+    /// Same as `io_serviced`, but contains all descendant control groups.
+    pub io_serviced_recursive: Vec<IoService>,
+    /// Same as `io_serviced`, but contains all descendant control groups and contains only the
+    /// total amount.
+    pub io_serviced_recursive_total: u64,
+    /// The upper limit of bytes per second rate of read operation on the block devices by the
+    /// control group's tasks.
+    pub read_bps_device: Vec<BlkIoData>,
+    /// The upper limit of I/O operation per second, when said operation is a read operation.
+    pub read_iops_device: Vec<BlkIoData>,
+    /// The upper limit of bytes per second rate of write operation on the block devices by the
+    /// control group's tasks.
+    pub write_bps_device: Vec<BlkIoData>,
+    /// The upper limit of I/O operation per second, when said operation is a write operation.
+    pub write_iops_device: Vec<BlkIoData>,
+}
+
+/// Statistics and state of the block devices.
+#[derive(Default, Debug)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct BlkIo {
+    /// The number of BIOS requests merged into I/O requests by the control group's tasks.
+    pub io_merged: Vec<IoService>,
+    /// Same as `io_merged`, but only reports the total number.
+    pub io_merged_total: u64,
+    /// Same as `io_merged`, but contains all descendant control groups.
+    pub io_merged_recursive: Vec<IoService>,
+    /// Same as `io_merged_recursive`, but only reports the total number.
+    pub io_merged_recursive_total: u64,
+    /// The number of requests queued for I/O operations by the tasks of the control group.
+    pub io_queued: Vec<IoService>,
+    /// Same as `io_queued`, but only reports the total number.
+    pub io_queued_total: u64,
+    /// Same as `io_queued`, but contains all descendant control groups.
+    pub io_queued_recursive: Vec<IoService>,
+    /// Same as `io_queued_recursive`, but contains all descendant control groups.
+    pub io_queued_recursive_total: u64,
+    /// The number of bytes transferred from and to the block device (as seen by the CFQ I/O scheduler).
+    pub io_service_bytes: Vec<IoService>,
+    /// Same as `io_service_bytes`, but contains all descendant control groups.
+    pub io_service_bytes_total: u64,
+    /// Same as `io_service_bytes`, but contains all descendant control groups.
+    pub io_service_bytes_recursive: Vec<IoService>,
+    /// Total amount of bytes transferred between the tasks and block devices, including the
+    /// descendant control groups' numbers.
+    pub io_service_bytes_recursive_total: u64,
+    /// The number of I/O operations (as seen by the CFQ I/O scheduler) between the devices and the
+    /// control group's tasks.
+    pub io_serviced: Vec<IoService>,
+    /// The total number of I/O operations performed on the devices as seen by the throttling
+    /// policy.
+    pub io_serviced_total: u64,
+    /// Same as `io_serviced`, but contains all descendant control groups.
+    pub io_serviced_recursive: Vec<IoService>,
+    /// Same as `io_serviced`, but contains all descendant control groups and contains only the
+    /// total amount.
+    pub io_serviced_recursive_total: u64,
+    /// The total time spent between dispatch and request completion for I/O requests (as seen by
+    /// the CFQ I/O scheduler) by the control group's tasks.
+    pub io_service_time: Vec<IoService>,
+    /// Same as `io_service_time`, but contains all descendant control groups and contains only the
+    /// total amount.
+    pub io_service_time_total: u64,
+    /// Same as `io_service_time`, but contains all descendant control groups.
+    pub io_service_time_recursive: Vec<IoService>,
+    /// Same as `io_service_time_recursive`, but contains all descendant control groups and only
+    /// the total amount.
+    pub io_service_time_recursive_total: u64,
+    /// Total amount of time spent waiting for a free slot in the CFQ I/O scheduler's queue.
+    pub io_wait_time: Vec<IoService>,
+    /// Same as `io_wait_time`, but only reports the total amount.
+    pub io_wait_time_total: u64,
+    /// Same as `io_wait_time`, but contains all descendant control groups.
+    pub io_wait_time_recursive: Vec<IoService>,
+    /// Same as `io_wait_time_recursive`, but only reports the total amount.
+    pub io_wait_time_recursive_total: u64,
+    /// How much weight do the control group's tasks have when competing against the descendant
+    /// control group's tasks.
+    pub leaf_weight: u64,
+    /// Same as `leaf_weight`, but per-block-device.
+    pub leaf_weight_device: Vec<BlkIoData>,
+    /// Total number of sectors transferred between the block devices and the control group's
+    /// tasks.
+    pub sectors: Vec<BlkIoData>,
+    /// Same as `sectors`, but contains all descendant control groups.
+    pub sectors_recursive: Vec<BlkIoData>,
+    /// Similar statistics, but as seen by the throttle policy.
+    pub throttle: BlkIoThrottle,
+    /// The time the control group had access to the I/O devices.
+    pub time: Vec<BlkIoData>,
+    /// Same as `time`, but contains all descendant control groups.
+    pub time_recursive: Vec<BlkIoData>,
+    /// The weight of this control group.
+    pub weight: u64,
+    /// Same as `weight`, but per-block-device.
+    pub weight_device: Vec<BlkIoData>,
+
+    /// IoStat for cgroup v2
+    pub io_stat: Vec<IoStat>,
+}
+
+impl ControllerInternal for BlkIoController {
+    fn control_type(&self) -> Controllers {
+        Controllers::BlkIo
+    }
+    fn get_path(&self) -> &PathBuf {
+        &self.path
+    }
+    fn get_path_mut(&mut self) -> &mut PathBuf {
+        &mut self.path
+    }
+    fn get_base(&self) -> &PathBuf {
+        &self.base
+    }
+
+    fn is_v2(&self) -> bool {
+        self.v2
+    }
+
+    fn apply(&self, res: &Resources) -> Result<()> {
+        // get the resources that apply to this controller
+        let res: &BlkIoResources = &res.blkio;
+
+        if let Some(weight) = res.weight {
+            let _ = self.set_weight(weight as u64);
+        }
+        if let Some(leaf_weight) = res.leaf_weight {
+            let _ = self.set_leaf_weight(leaf_weight as u64);
+        }
+
+        for dev in &res.weight_device {
+            if let Some(weight) = dev.weight {
+                let _ = self.set_weight_for_device(dev.major, dev.minor, weight as u64);
+            }
+            if let Some(leaf_weight) = dev.leaf_weight {
+                let _ = self.set_leaf_weight_for_device(dev.major, dev.minor, leaf_weight as u64);
+            }
+        }
+
+        for dev in &res.throttle_read_bps_device {
+            let _ = self.throttle_read_bps_for_device(dev.major, dev.minor, dev.rate);
+        }
+
+        for dev in &res.throttle_write_bps_device {
+            let _ = self.throttle_write_bps_for_device(dev.major, dev.minor, dev.rate);
+        }
+
+        for dev in &res.throttle_read_iops_device {
+            let _ = self.throttle_read_iops_for_device(dev.major, dev.minor, dev.rate);
+        }
+
+        for dev in &res.throttle_write_iops_device {
+            let _ = self.throttle_write_iops_for_device(dev.major, dev.minor, dev.rate);
+        }
+
+        res.attrs.iter().for_each(|(k, v)| {
+            let _ = self.set(k, v);
+        });
+
+        Ok(())
+    }
+}
+
+impl ControllIdentifier for BlkIoController {
+    fn controller_type() -> Controllers {
+        Controllers::BlkIo
+    }
+}
+
+impl<'a> From<&'a Subsystem> for &'a BlkIoController {
+    fn from(sub: &'a Subsystem) -> &'a BlkIoController {
+        unsafe {
+            match sub {
+                Subsystem::BlkIo(c) => c,
+                _ => {
+                    assert_eq!(1, 0);
+                    let v = std::mem::MaybeUninit::uninit();
+                    v.assume_init()
+                }
+            }
+        }
+    }
+}
+
+impl BlkIoController {
+    /// Constructs a new `BlkIoController` with `root` serving as the root of the control group.
+    pub fn new(point: PathBuf, root: PathBuf, v2: bool) -> Self {
+        Self {
+            base: root,
+            path: point,
+            v2,
+        }
+    }
+
+    fn blkio_v2(&self) -> BlkIo {
+        BlkIo {
+            io_stat: self
+                .open_path("io.stat", false)
+                .and_then(read_string_from)
+                .map(parse_io_stat)
+                .unwrap_or_default(),
+            ..Default::default()
+        }
+    }
+
+    /// Gathers statistics about and reports the state of the block devices used by the control
+    /// group's tasks.
+    pub fn blkio(&self) -> BlkIo {
+        if self.v2 {
+            return self.blkio_v2();
+        }
+        BlkIo {
+            io_merged: self
+                .open_path("blkio.io_merged", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service)
+                .unwrap_or_default(),
+            io_merged_total: self
+                .open_path("blkio.io_merged", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service_total)
+                .unwrap_or_default(),
+            io_merged_recursive: self
+                .open_path("blkio.io_merged_recursive", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service)
+                .unwrap_or_default(),
+            io_merged_recursive_total: self
+                .open_path("blkio.io_merged_recursive", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service_total)
+                .unwrap_or_default(),
+            io_queued: self
+                .open_path("blkio.io_queued", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service)
+                .unwrap_or_default(),
+            io_queued_total: self
+                .open_path("blkio.io_queued", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service_total)
+                .unwrap_or_default(),
+            io_queued_recursive: self
+                .open_path("blkio.io_queued_recursive", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service)
+                .unwrap_or_default(),
+            io_queued_recursive_total: self
+                .open_path("blkio.io_queued_recursive", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service_total)
+                .unwrap_or_default(),
+            io_service_bytes: self
+                .open_path("blkio.io_service_bytes", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service)
+                .unwrap_or_default(),
+            io_service_bytes_total: self
+                .open_path("blkio.io_service_bytes", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service_total)
+                .unwrap_or_default(),
+            io_service_bytes_recursive: self
+                .open_path("blkio.io_service_bytes_recursive", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service)
+                .unwrap_or_default(),
+            io_service_bytes_recursive_total: self
+                .open_path("blkio.io_service_bytes_recursive", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service_total)
+                .unwrap_or_default(),
+            io_serviced: self
+                .open_path("blkio.io_serviced", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service)
+                .unwrap_or_default(),
+            io_serviced_total: self
+                .open_path("blkio.io_serviced", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service_total)
+                .unwrap_or_default(),
+            io_serviced_recursive: self
+                .open_path("blkio.io_serviced_recursive", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service)
+                .unwrap_or_default(),
+            io_serviced_recursive_total: self
+                .open_path("blkio.io_serviced_recursive", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service_total)
+                .unwrap_or_default(),
+            io_service_time: self
+                .open_path("blkio.io_service_time", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service)
+                .unwrap_or_default(),
+            io_service_time_total: self
+                .open_path("blkio.io_service_time", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service_total)
+                .unwrap_or_default(),
+            io_service_time_recursive: self
+                .open_path("blkio.io_service_time_recursive", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service)
+                .unwrap_or_default(),
+            io_service_time_recursive_total: self
+                .open_path("blkio.io_service_time_recursive", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service_total)
+                .unwrap_or_default(),
+            io_wait_time: self
+                .open_path("blkio.io_wait_time", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service)
+                .unwrap_or_default(),
+            io_wait_time_total: self
+                .open_path("blkio.io_wait_time", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service_total)
+                .unwrap_or_default(),
+            io_wait_time_recursive: self
+                .open_path("blkio.io_wait_time_recursive", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service)
+                .unwrap_or_default(),
+            io_wait_time_recursive_total: self
+                .open_path("blkio.io_wait_time_recursive", false)
+                .and_then(read_string_from)
+                .and_then(parse_io_service_total)
+                .unwrap_or_default(),
+            leaf_weight: self
+                .open_path("blkio.leaf_weight", false)
+                .and_then(read_u64_from)
+                .unwrap_or(0u64),
+            leaf_weight_device: self
+                .open_path("blkio.leaf_weight_device", false)
+                .and_then(read_string_from)
+                .and_then(parse_blkio_data)
+                .unwrap_or_default(),
+            sectors: self
+                .open_path("blkio.sectors", false)
+                .and_then(read_string_from)
+                .and_then(parse_blkio_data)
+                .unwrap_or_default(),
+            sectors_recursive: self
+                .open_path("blkio.sectors_recursive", false)
+                .and_then(read_string_from)
+                .and_then(parse_blkio_data)
+                .unwrap_or_default(),
+            throttle: BlkIoThrottle {
+                io_service_bytes: self
+                    .open_path("blkio.throttle.io_service_bytes", false)
+                    .and_then(read_string_from)
+                    .and_then(parse_io_service)
+                    .unwrap_or_default(),
+                io_service_bytes_total: self
+                    .open_path("blkio.throttle.io_service_bytes", false)
+                    .and_then(read_string_from)
+                    .and_then(parse_io_service_total)
+                    .unwrap_or_default(),
+                io_service_bytes_recursive: self
+                    .open_path("blkio.throttle.io_service_bytes_recursive", false)
+                    .and_then(read_string_from)
+                    .and_then(parse_io_service)
+                    .unwrap_or_default(),
+                io_service_bytes_recursive_total: self
+                    .open_path("blkio.throttle.io_service_bytes_recursive", false)
+                    .and_then(read_string_from)
+                    .and_then(parse_io_service_total)
+                    .unwrap_or_default(),
+                io_serviced: self
+                    .open_path("blkio.throttle.io_serviced", false)
+                    .and_then(read_string_from)
+                    .and_then(parse_io_service)
+                    .unwrap_or_default(),
+                io_serviced_total: self
+                    .open_path("blkio.throttle.io_serviced", false)
+                    .and_then(read_string_from)
+                    .and_then(parse_io_service_total)
+                    .unwrap_or_default(),
+                io_serviced_recursive: self
+                    .open_path("blkio.throttle.io_serviced_recursive", false)
+                    .and_then(read_string_from)
+                    .and_then(parse_io_service)
+                    .unwrap_or_default(),
+                io_serviced_recursive_total: self
+                    .open_path("blkio.throttle.io_serviced_recursive", false)
+                    .and_then(read_string_from)
+                    .and_then(parse_io_service_total)
+                    .unwrap_or_default(),
+                read_bps_device: self
+                    .open_path("blkio.throttle.read_bps_device", false)
+                    .and_then(read_string_from)
+                    .and_then(parse_blkio_data)
+                    .unwrap_or_default(),
+                read_iops_device: self
+                    .open_path("blkio.throttle.read_iops_device", false)
+                    .and_then(read_string_from)
+                    .and_then(parse_blkio_data)
+                    .unwrap_or_default(),
+                write_bps_device: self
+                    .open_path("blkio.throttle.write_bps_device", false)
+                    .and_then(read_string_from)
+                    .and_then(parse_blkio_data)
+                    .unwrap_or_default(),
+                write_iops_device: self
+                    .open_path("blkio.throttle.write_iops_device", false)
+                    .and_then(read_string_from)
+                    .and_then(parse_blkio_data)
+                    .unwrap_or_default(),
+            },
+            time: self
+                .open_path("blkio.time", false)
+                .and_then(read_string_from)
+                .and_then(parse_blkio_data)
+                .unwrap_or_default(),
+            time_recursive: self
+                .open_path("blkio.time_recursive", false)
+                .and_then(read_string_from)
+                .and_then(parse_blkio_data)
+                .unwrap_or_default(),
+            weight: self
+                .open_path("blkio.weight", false)
+                .and_then(read_u64_from)
+                .unwrap_or(0u64),
+            weight_device: self
+                .open_path("blkio.weight_device", false)
+                .and_then(read_string_from)
+                .and_then(parse_blkio_data)
+                .unwrap_or_default(),
+            io_stat: Vec::new(),
+        }
+    }
+
+    /// Set the leaf weight on the control group's tasks, i.e., how are they weighted against the
+    /// descendant control groups' tasks.
+    pub fn set_leaf_weight(&self, w: u64) -> Result<()> {
+        self.open_path("blkio.leaf_weight", true)
+            .and_then(|mut file| {
+                file.write_all(w.to_string().as_ref()).map_err(|e| {
+                    Error::with_cause(
+                        WriteFailed("blkio.leaf_weight".to_string(), w.to_string()),
+                        e,
+                    )
+                })
+            })
+    }
+
+    /// Same as `set_leaf_weight()`, but settable per each block device.
+    pub fn set_leaf_weight_for_device(&self, major: u64, minor: u64, weight: u64) -> Result<()> {
+        self.open_path("blkio.leaf_weight_device", true)
+            .and_then(|mut file| {
+                file.write_all(format!("{}:{} {}", major, minor, weight).as_ref())
+                    .map_err(|e| {
+                        Error::with_cause(
+                            WriteFailed(
+                                "blkio.leaf_weight_device".to_string(),
+                                format!("{}:{} {}", major, minor, weight),
+                            ),
+                            e,
+                        )
+                    })
+            })
+    }
+
+    /// Reset the statistics the kernel has gathered so far and start fresh.
+    pub fn reset_stats(&self) -> Result<()> {
+        self.open_path("blkio.reset_stats", true)
+            .and_then(|mut file| {
+                file.write_all("1".to_string().as_ref()).map_err(|e| {
+                    Error::with_cause(
+                        WriteFailed("blkio.reset_stats".to_string(), "1".to_string()),
+                        e,
+                    )
+                })
+            })
+    }
+
+    /// Throttle the bytes per second rate of read operation affecting the block device
+    /// `major:minor` to `bps`.
+    pub fn throttle_read_bps_for_device(&self, major: u64, minor: u64, bps: u64) -> Result<()> {
+        let mut file_name = "blkio.throttle.read_bps_device";
+        let mut content = format!("{}:{} {}", major, minor, bps);
+        if self.v2 {
+            file_name = "io.max";
+            content = format!("{}:{} rbps={}", major, minor, bps);
+        }
+        self.open_path(file_name, true).and_then(|mut file| {
+            file.write_all(content.as_ref()).map_err(|e| {
+                Error::with_cause(WriteFailed(file_name.to_string(), content.to_string()), e)
+            })
+        })
+    }
+
+    /// Throttle the I/O operations per second rate of read operation affecting the block device
+    /// `major:minor` to `bps`.
+    pub fn throttle_read_iops_for_device(&self, major: u64, minor: u64, iops: u64) -> Result<()> {
+        let mut file_name = "blkio.throttle.read_iops_device";
+        let mut content = format!("{}:{} {}", major, minor, iops);
+        if self.v2 {
+            file_name = "io.max";
+            content = format!("{}:{} riops={}", major, minor, iops);
+        }
+        self.open_path(file_name, true).and_then(|mut file| {
+            file.write_all(content.as_ref()).map_err(|e| {
+                Error::with_cause(WriteFailed(file_name.to_string(), content.to_string()), e)
+            })
+        })
+    }
+    /// Throttle the bytes per second rate of write operation affecting the block device
+    /// `major:minor` to `bps`.
+    pub fn throttle_write_bps_for_device(&self, major: u64, minor: u64, bps: u64) -> Result<()> {
+        let mut file_name = "blkio.throttle.write_bps_device";
+        let mut content = format!("{}:{} {}", major, minor, bps);
+        if self.v2 {
+            file_name = "io.max";
+            content = format!("{}:{} wbps={}", major, minor, bps);
+        }
+        self.open_path(file_name, true).and_then(|mut file| {
+            file.write_all(content.as_ref()).map_err(|e| {
+                Error::with_cause(WriteFailed(file_name.to_string(), content.to_string()), e)
+            })
+        })
+    }
+
+    /// Throttle the I/O operations per second rate of write operation affecting the block device
+    /// `major:minor` to `bps`.
+    pub fn throttle_write_iops_for_device(&self, major: u64, minor: u64, iops: u64) -> Result<()> {
+        let mut file_name = "blkio.throttle.write_iops_device";
+        let mut content = format!("{}:{} {}", major, minor, iops);
+        if self.v2 {
+            file_name = "io.max";
+            content = format!("{}:{} wiops={}", major, minor, iops);
+        }
+        self.open_path(file_name, true).and_then(|mut file| {
+            file.write_all(content.as_ref()).map_err(|e| {
+                Error::with_cause(WriteFailed(file_name.to_string(), content.to_string()), e)
+            })
+        })
+    }
+
+    /// Set the weight of the control group's tasks.
+    pub fn set_weight(&self, w: u64) -> Result<()> {
+        // Attation: may not find in high kernel version.
+        let mut file_name = "blkio.weight";
+        if self.v2 {
+            file_name = "io.bfq.weight";
+        }
+        self.open_path(file_name, true).and_then(|mut file| {
+            file.write_all(w.to_string().as_ref()).map_err(|e| {
+                Error::with_cause(WriteFailed(file_name.to_string(), w.to_string()), e)
+            })
+        })
+    }
+
+    /// Same as `set_weight()`, but settable per each block device.
+    pub fn set_weight_for_device(&self, major: u64, minor: u64, weight: u64) -> Result<()> {
+        let mut file_name = "blkio.weight_device";
+        if self.v2 {
+            // Attation: there is no weight for device in runc
+            // https://github.com/opencontainers/runc/blob/46be7b612e2533c494e6a251111de46d8e286ed5/libcontainer/cgroups/fs2/io.go#L30
+            // may depends on IO schedulers https://wiki.ubuntu.com/Kernel/Reference/IOSchedulers
+            file_name = "io.bfq.weight";
+        }
+        self.open_path(file_name, true).and_then(|mut file| {
+            file.write_all(format!("{}:{} {}", major, minor, weight).as_ref())
+                .map_err(|e| {
+                    Error::with_cause(
+                        WriteFailed(
+                            file_name.to_string(),
+                            format!("{}:{} {}", major, minor, weight),
+                        ),
+                        e,
+                    )
+                })
+        })
+    }
+}
+
+impl CustomizedAttribute for BlkIoController {}
+#[cfg(test)]
+mod test {
+    use crate::fs::blkio::{parse_blkio_data, BlkIoData};
+    use crate::fs::blkio::{parse_io_service, parse_io_service_total, IoService};
+    use crate::fs::error::*;
+
+    static TEST_VALUE: &str = "\
+8:32 Read 4280320
+8:32 Write 0
+8:32 Sync 4280320
+8:32 Async 0
+8:32 Discard 1
+8:32 Total 4280320
+8:48 Read 5705479168
+8:48 Write 56096055296
+8:48 Sync 11213923328
+8:48 Async 50587611136
+8:48 Total 61801534464
+8:16 Read 10059776
+8:16 Write 0
+8:16 Sync 10059776
+8:16 Async 0
+8:16 Total 10059776
+8:0 Read 7192576
+8:0 Write 0
+8:0 Sync 7192576
+8:0 Async 0
+8:0 Total 7192576
+Total 61823067136
+ ";
+
+    static TEST_BLKIO_DATA: &str = "\
+8:48 454480833999
+8:32 228392923193
+8:16 772456885
+8:0 559583764
+ ";
+
+    #[test]
+    fn test_parse_io_service_total() {
+        let ok = parse_io_service_total(TEST_VALUE.to_string()).unwrap();
+        assert_eq!(ok, 61823067136);
+    }
+
+    #[test]
+    fn test_parse_io_service() {
+        let ok = parse_io_service(TEST_VALUE.to_string()).unwrap();
+        assert_eq!(
+            ok,
+            vec![
+                IoService {
+                    major: 8,
+                    minor: 32,
+                    read: 4280320,
+                    write: 0,
+                    sync: 4280320,
+                    r#async: 0,
+                    discard: 1,
+                    total: 4280320,
+                },
+                IoService {
+                    major: 8,
+                    minor: 48,
+                    read: 5705479168,
+                    write: 56096055296,
+                    sync: 11213923328,
+                    r#async: 50587611136,
+                    discard: 0,
+                    total: 61801534464,
+                },
+                IoService {
+                    major: 8,
+                    minor: 16,
+                    read: 10059776,
+                    write: 0,
+                    sync: 10059776,
+                    r#async: 0,
+                    discard: 0,
+                    total: 10059776,
+                },
+                IoService {
+                    major: 8,
+                    minor: 0,
+                    read: 7192576,
+                    write: 0,
+                    sync: 7192576,
+                    r#async: 0,
+                    discard: 0,
+                    total: 7192576,
+                }
+            ]
+        );
+
+        let invalid_values = vec![
+            "\
+8:32 Read 4280320
+8:32 Write a
+8:32 Async 1
+",
+            "\
+8:32 Read 4280320
+b:32 Write 1
+8:32 Async 1
+",
+            "\
+8:32 Read 4280320
+8:32 Write 1
+8:c Async 1
+",
+        ];
+
+        for value in invalid_values {
+            let err = parse_io_service(value.to_string()).unwrap_err();
+            assert_eq!(err.kind(), &ErrorKind::ParseError,);
+        }
+    }
+
+    #[test]
+    fn test_parse_blkio_data() {
+        assert_eq!(
+            parse_blkio_data(TEST_BLKIO_DATA.to_string()).unwrap(),
+            vec![
+                BlkIoData {
+                    major: 8,
+                    minor: 48,
+                    data: 454480833999,
+                },
+                BlkIoData {
+                    major: 8,
+                    minor: 32,
+                    data: 228392923193,
+                },
+                BlkIoData {
+                    major: 8,
+                    minor: 16,
+                    data: 772456885,
+                },
+                BlkIoData {
+                    major: 8,
+                    minor: 0,
+                    data: 559583764,
+                }
+            ]
+        );
+    }
+}

src/fs/cgroup.rs

@@ -0,0 +1,636 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! This module handles cgroup operations. Start here!
+
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
+
+use crate::fs::hierarchies::V1;
+use crate::fs::{CgroupPid, ControllIdentifier, Controller, Hierarchy, Resources, Subsystem};
+
+use std::collections::HashMap;
+use std::convert::From;
+use std::fs;
+use std::path::{Path, PathBuf};
+
+pub const CGROUP_MODE_DOMAIN: &str = "domain";
+pub const CGROUP_MODE_DOMAIN_THREADED: &str = "domain threaded";
+pub const CGROUP_MODE_DOMAIN_INVALID: &str = "domain invalid";
+pub const CGROUP_MODE_THREADED: &str = "threaded";
+
+/// A control group is the central structure to this crate.
+///
+///
+/// # What are control groups?
+///
+/// Lifting over from the Linux kernel sources:
+///
+/// > Control Groups provide a mechanism for aggregating/partitioning sets of
+/// > tasks, and all their future children, into hierarchical groups with
+/// > specialized behaviour.
+///
+/// This crate is an attempt at providing a Rust-native way of managing these cgroups.
+#[derive(Debug)]
+pub struct Cgroup {
+    /// The list of subsystems that control this cgroup
+    subsystems: Vec<Subsystem>,
+
+    /// The hierarchy.
+    hier: Box<dyn Hierarchy>,
+    path: String,
+
+    /// List of controllers specifically enabled in the control group.
+    specified_controllers: Option<Vec<String>>,
+}
+
+impl Clone for Cgroup {
+    fn clone(&self) -> Self {
+        Cgroup {
+            subsystems: self.subsystems.clone(),
+            hier: crate::fs::hierarchies::auto(),
+            path: self.path.clone(),
+            specified_controllers: None,
+        }
+    }
+}
+
+impl Default for Cgroup {
+    fn default() -> Self {
+        Cgroup {
+            subsystems: Vec::new(),
+            hier: crate::fs::hierarchies::auto(),
+            path: "".to_string(),
+            specified_controllers: None,
+        }
+    }
+}
+
+impl Cgroup {
+    pub fn v2(&self) -> bool {
+        self.hier.v2()
+    }
+
+    /// Return the path the cgroup is located at.
+    pub fn path(&self) -> &str {
+        &self.path
+    }
+
+    /// Create this control group.
+    pub fn create(&self) -> Result<()> {
+        if self.hier.v2() {
+            create_v2_cgroup(self.hier.root(), &self.path, &self.specified_controllers)
+        } else {
+            self.subsystems
+                .iter()
+                .try_for_each(|subsystem| subsystem.to_controller().create())?;
+            Ok(())
+        }
+    }
+
+    /// Create a new control group in the hierarchy `hier`, with name `path`.
+    ///
+    /// Returns a handle to the control group that can be used to manipulate it.
+    pub fn new<P: AsRef<Path>>(hier: Box<dyn Hierarchy>, path: P) -> Result<Cgroup> {
+        let cg = Cgroup::load(hier, path);
+        cg.create()?;
+        Ok(cg)
+    }
+
+    /// Create a new control group in the hierarchy `hier`, with name `path`.
+    ///
+    /// Returns a handle to the control group that can be used to manipulate it.
+    pub fn new_with_specified_controllers<P: AsRef<Path>>(
+        hier: Box<dyn Hierarchy>,
+        path: P,
+        specified_controllers: Option<Vec<String>>,
+    ) -> Result<Cgroup> {
+        let cg = if let Some(sc) = specified_controllers {
+            Cgroup::load_with_specified_controllers(hier, path, sc)
+        } else {
+            Cgroup::load(hier, path)
+        };
+        cg.create()?;
+        Ok(cg)
+    }
+
+    /// Create a new control group in the hierarchy `hier`, with name `path` and `relative_paths`
+    ///
+    /// Returns a handle to the control group that can be used to manipulate it.
+    ///
+    /// Note that this method is only meaningful for cgroup v1, call it is equivalent to call `new` in the v2 mode.
+    pub fn new_with_relative_paths<P: AsRef<Path>>(
+        hier: Box<dyn Hierarchy>,
+        path: P,
+        relative_paths: HashMap<String, String>,
+    ) -> Result<Cgroup> {
+        let cg = Cgroup::load_with_relative_paths(hier, path, relative_paths);
+        cg.create()?;
+        Ok(cg)
+    }
+
+    /// Create a handle for a control group in the hierarchy `hier`, with name `path`.
+    ///
+    /// Returns a handle to the control group (that possibly does not exist until `create()` has
+    /// been called on the cgroup.
+    pub fn load<P: AsRef<Path>>(hier: Box<dyn Hierarchy>, path: P) -> Cgroup {
+        let path = path.as_ref();
+        let mut subsystems = hier.subsystems();
+        if path.as_os_str() != "" {
+            subsystems = subsystems
+                .into_iter()
+                .map(|x| x.enter(path))
+                .collect::<Vec<_>>();
+        }
+
+        Cgroup {
+            path: path.to_str().unwrap().to_string(),
+            subsystems,
+            hier,
+            specified_controllers: None,
+        }
+    }
+
+    /// Create a handle for a specified control group in the hierarchy `hier`, with name `path`.
+    ///
+    /// Returns a handle to the control group (that possibly does not exist until `create()` has
+    /// been called on the cgroup.
+    pub fn load_with_specified_controllers<P: AsRef<Path>>(
+        hier: Box<dyn Hierarchy>,
+        path: P,
+        specified_controllers: Vec<String>,
+    ) -> Cgroup {
+        let path = path.as_ref();
+        let mut subsystems = hier.subsystems();
+        if path.as_os_str() != "" {
+            subsystems = subsystems
+                .into_iter()
+                .filter(|x| specified_controllers.contains(&x.controller_name()))
+                .map(|x| x.enter(path))
+                .collect::<Vec<_>>();
+        }
+
+        Cgroup {
+            path: path.to_str().unwrap().to_string(),
+            subsystems,
+            hier,
+            specified_controllers: Some(specified_controllers),
+        }
+    }
+
+    /// Create a handle for a control group in the hierarchy `hier`, with name `path` and `relative_paths`
+    ///
+    /// Returns a handle to the control group (that possibly does not exist until `create()` has
+    /// been called on the cgroup.
+    ///
+    /// Note that this method is only meaningful for cgroup v1, call it is equivalent to call `load` in the v2 mode
+    pub fn load_with_relative_paths<P: AsRef<Path>>(
+        hier: Box<dyn Hierarchy>,
+        path: P,
+        relative_paths: HashMap<String, String>,
+    ) -> Cgroup {
+        // relative_paths only valid for cgroup v1
+        if hier.v2() {
+            return Self::load(hier, path);
+        }
+
+        let path = path.as_ref();
+        let mut subsystems = hier.subsystems();
+        if path.as_os_str() != "" {
+            subsystems = subsystems
+                .into_iter()
+                .map(|x| {
+                    let cn = x.controller_name();
+                    if relative_paths.contains_key(&cn) {
+                        let rp = relative_paths.get(&cn).unwrap();
+                        let valid_path = rp.trim_start_matches('/').to_string();
+                        let mut p = PathBuf::from(valid_path);
+                        p.push(path);
+                        x.enter(p.as_ref())
+                    } else {
+                        x.enter(path)
+                    }
+                })
+                .collect::<Vec<_>>();
+        }
+
+        Cgroup {
+            subsystems,
+            hier,
+            path: path.to_str().unwrap().to_string(),
+            specified_controllers: None,
+        }
+    }
+
+    /// The list of subsystems that this control group supports.
+    pub fn subsystems(&self) -> &Vec<Subsystem> {
+        &self.subsystems
+    }
+
+    /// Deletes the control group.
+    ///
+    /// Note that this function makes no effort in cleaning up the descendant and the underlying
+    /// system call will fail if there are any descendants. Thus, one should check whether it was
+    /// actually removed, and remove the descendants first if not. In the future, this behavior
+    /// will change.
+    pub fn delete(&self) -> Result<()> {
+        if self.v2() {
+            if !self.path.is_empty() {
+                let mut p = self.hier.root();
+                p.push(self.path.clone());
+                return fs::remove_dir(p).map_err(|e| Error::with_cause(RemoveFailed, e));
+            }
+            return Ok(());
+        }
+
+        self.subsystems.iter().try_for_each(|sub| match sub {
+            Subsystem::Pid(pidc) => pidc.delete(),
+            Subsystem::Mem(c) => c.delete(),
+            Subsystem::CpuSet(c) => c.delete(),
+            Subsystem::CpuAcct(c) => c.delete(),
+            Subsystem::Cpu(c) => c.delete(),
+            Subsystem::Devices(c) => c.delete(),
+            Subsystem::Freezer(c) => c.delete(),
+            Subsystem::NetCls(c) => c.delete(),
+            Subsystem::BlkIo(c) => c.delete(),
+            Subsystem::PerfEvent(c) => c.delete(),
+            Subsystem::NetPrio(c) => c.delete(),
+            Subsystem::HugeTlb(c) => c.delete(),
+            Subsystem::Rdma(c) => c.delete(),
+            Subsystem::Systemd(c) => c.delete(),
+        })
+    }
+
+    /// Apply a set of resource limits to the control group.
+    pub fn apply(&self, res: &Resources) -> Result<()> {
+        self.subsystems
+            .iter()
+            .try_fold((), |_, e| e.to_controller().apply(res))
+    }
+
+    /// Retrieve a container based on type inference.
+    ///
+    /// ## Example:
+    ///
+    /// ```text
+    /// let pids: &PidController = control_group.controller_of()
+    ///                             .expect("No pids controller attached!");
+    /// let cpu: &CpuController = control_group.controller_of()
+    ///                             .expect("No cpu controller attached!");
+    /// ```
+    pub fn controller_of<'a, T>(&'a self) -> Option<&'a T>
+    where
+        &'a T: From<&'a Subsystem>,
+        T: Controller + ControllIdentifier,
+    {
+        for i in &self.subsystems {
+            if i.to_controller().control_type() == T::controller_type() {
+                // N.B.:
+                // https://play.rust-lang.org/?gist=978b2846bacebdaa00be62374f4f4334&version=stable&mode=debug&edition=2015
+                return Some(i.into());
+            }
+        }
+        None
+    }
+
+    /// Removes tasks from the control group by thread group id.
+    ///
+    /// Note that this means that the task will be moved back to the root control group in the
+    /// hierarchy and any rules applied to that control group will _still_ apply to the proc.
+    pub fn remove_task_by_tgid(&self, tgid: CgroupPid) -> Result<()> {
+        self.hier.root_control_group().add_task_by_tgid(tgid)
+    }
+
+    /// Removes a task from the control group.
+    ///
+    /// Note that this means that the task will be moved back to the root control group in the
+    /// hierarchy and any rules applied to that control group will _still_ apply to the task.
+    pub fn remove_task(&self, tid: CgroupPid) -> Result<()> {
+        self.hier.root_control_group().add_task(tid)
+    }
+
+    /// Moves tasks to the parent control group by thread group id.
+    pub fn move_task_to_parent_by_tgid(&self, tgid: CgroupPid) -> Result<()> {
+        self.hier
+            .parent_control_group(&self.path)
+            .add_task_by_tgid(tgid)
+    }
+
+    /// Moves a task to the parent control group.
+    pub fn move_task_to_parent(&self, tid: CgroupPid) -> Result<()> {
+        self.hier.parent_control_group(&self.path).add_task(tid)
+    }
+
+    /// Return a handle to the parent control group in the hierarchy.
+    pub fn parent_control_group(&self) -> Cgroup {
+        self.hier.parent_control_group(&self.path)
+    }
+
+    /// Kill every process in the control group. Only supported for v2 cgroups and on
+    /// kernels 5.14+. This will fail with InvalidOperation if the 'cgroup.kill' file does
+    /// not exist.
+    pub fn kill(&self) -> Result<()> {
+        if !self.v2() {
+            return Err(Error::new(CgroupVersion));
+        }
+
+        let val = "1";
+        let file_name = "cgroup.kill";
+        let p = self.hier.root().join(self.path.clone()).join(file_name);
+
+        // If cgroup.kill doesn't exist they're not on 5.14+ so lets
+        // surface some error the caller can check against.
+        if !p.exists() {
+            return Err(Error::new(InvalidOperation));
+        }
+
+        fs::write(p, val)
+            .map_err(|e| Error::with_cause(WriteFailed(file_name.to_string(), val.to_string()), e))
+    }
+
+    /// Attach a task to the control group.
+    pub fn add_task(&self, tid: CgroupPid) -> Result<()> {
+        if self.v2() {
+            let subsystems = self.subsystems();
+            if !subsystems.is_empty() {
+                let c = subsystems[0].to_controller();
+                let cgroup_type = self.get_cgroup_type()?;
+                // In cgroup v2, writing to the cgroup.threads file is only supported in thread mode.
+                if cgroup_type == *CGROUP_MODE_DOMAIN_THREADED
+                    || cgroup_type == *CGROUP_MODE_THREADED
+                {
+                    // It is used to move the threads of a process into a cgroup in thread mode.
+                    c.add_task(&tid)
+                } else {
+                    // When the cgroup type is domain or domain invalid,
+                    // cgroup.threads cannot be written.
+                    Err(Error::new(CgroupMode))
+                }
+            } else {
+                Err(Error::new(SubsystemsEmpty))
+            }
+        } else {
+            self.subsystems()
+                .iter()
+                .try_for_each(|sub| sub.to_controller().add_task(&tid))
+        }
+    }
+
+    /// Attach tasks to the control group by thread group id.
+    pub fn add_task_by_tgid(&self, tgid: CgroupPid) -> Result<()> {
+        if self.v2() {
+            let subsystems = self.subsystems();
+            if !subsystems.is_empty() {
+                let c = subsystems[0].to_controller();
+                // It is used to move a thread of the process to a cgroup,
+                // and other threads of the process will also move together.
+                c.add_task_by_tgid(&tgid)
+            } else {
+                Err(Error::new(SubsystemsEmpty))
+            }
+        } else {
+            self.subsystems()
+                .iter()
+                .try_for_each(|sub| sub.to_controller().add_task_by_tgid(&tgid))
+        }
+    }
+
+    /// set cgroup.type
+    pub fn set_cgroup_type(&self, cgroup_type: &str) -> Result<()> {
+        if self.v2() {
+            let subsystems = self.subsystems();
+            if !subsystems.is_empty() {
+                let c = subsystems[0].to_controller();
+                c.set_cgroup_type(cgroup_type)
+            } else {
+                Err(Error::new(SubsystemsEmpty))
+            }
+        } else {
+            Err(Error::new(CgroupVersion))
+        }
+    }
+
+    /// get cgroup.type
+    pub fn get_cgroup_type(&self) -> Result<String> {
+        if self.v2() {
+            let subsystems = self.subsystems();
+            if !subsystems.is_empty() {
+                let c = subsystems[0].to_controller();
+                let cgroup_type = c.get_cgroup_type()?;
+                Ok(cgroup_type)
+            } else {
+                Err(Error::new(SubsystemsEmpty))
+            }
+        } else {
+            Err(Error::new(CgroupVersion))
+        }
+    }
+
+    /// Set notify_on_release to the control group.
+    pub fn set_notify_on_release(&self, enable: bool) -> Result<()> {
+        self.subsystems()
+            .iter()
+            .try_for_each(|sub| sub.to_controller().set_notify_on_release(enable))
+    }
+
+    /// Set release_agent
+    pub fn set_release_agent(&self, path: &str) -> Result<()> {
+        self.hier
+            .root_control_group()
+            .subsystems()
+            .iter()
+            .try_for_each(|sub| sub.to_controller().set_release_agent(path))
+    }
+
+    /// Returns an Iterator that can be used to iterate over the procs that are currently in the
+    /// control group.
+    pub fn procs(&self) -> Vec<CgroupPid> {
+        // Collect the procs from all subsystems
+        let mut v = if self.v2() {
+            let subsystems = self.subsystems();
+            if !subsystems.is_empty() {
+                let c = subsystems[0].to_controller();
+                c.procs()
+            } else {
+                vec![]
+            }
+        } else {
+            self.subsystems()
+                .iter()
+                .map(|x| x.to_controller().procs())
+                .fold(vec![], |mut acc, mut x| {
+                    acc.append(&mut x);
+                    acc
+                })
+        };
+
+        v.sort();
+        v.dedup();
+        v
+    }
+
+    /// Returns an Iterator that can be used to iterate over the tasks that are currently in the
+    /// control group.
+    pub fn tasks(&self) -> Vec<CgroupPid> {
+        // Collect the tasks from all subsystems
+        let mut v = if self.v2() {
+            let subsystems = self.subsystems();
+            if !subsystems.is_empty() {
+                let c = subsystems[0].to_controller();
+                c.tasks()
+            } else {
+                vec![]
+            }
+        } else {
+            self.subsystems()
+                .iter()
+                .map(|x| x.to_controller().tasks())
+                .fold(vec![], |mut acc, mut x| {
+                    acc.append(&mut x);
+                    acc
+                })
+        };
+
+        v.sort();
+        v.dedup();
+        v
+    }
+
+    /// Checks if the cgroup exists.
+    ///
+    /// Returns true if at least one subsystem exists.
+    pub fn exists(&self) -> bool {
+        self.subsystems().iter().any(|e| e.to_controller().exists())
+    }
+}
+
+pub const UNIFIED_MOUNTPOINT: &str = "/sys/fs/cgroup";
+
+fn enable_controllers(controllers: &[String], path: &Path) {
+    let f = path.join("cgroup.subtree_control");
+    for c in controllers {
+        let body = format!("+{}", c);
+        let _rest = fs::write(f.as_path(), body.as_bytes());
+    }
+}
+
+fn supported_controllers() -> Vec<String> {
+    let p = format!("{}/{}", UNIFIED_MOUNTPOINT, "cgroup.controllers");
+    let ret = fs::read_to_string(p.as_str());
+    ret.unwrap_or_default()
+        .split(' ')
+        .map(|x| x.trim().to_string())
+        .collect::<Vec<String>>()
+}
+
+fn create_v2_cgroup(
+    root: PathBuf,
+    path: &str,
+    specified_controllers: &Option<Vec<String>>,
+) -> Result<()> {
+    // controler list ["memory", "cpu"]
+    let controllers = if let Some(s_controllers) = specified_controllers.clone() {
+        if verify_supported_controllers(s_controllers.as_ref()) {
+            s_controllers
+        } else {
+            return Err(Error::new(ErrorKind::SpecifiedControllers));
+        }
+    } else {
+        supported_controllers()
+    };
+
+    let mut fp = root;
+
+    // enable for root
+    enable_controllers(&controllers, &fp);
+
+    // path: "a/b/c"
+    let elements = path.split('/').collect::<Vec<&str>>();
+    let last_index = elements.len() - 1;
+    for (i, ele) in elements.iter().enumerate() {
+        // ROOT/a
+        fp.push(ele);
+        // create dir, need not check if is a file or directory
+        if !fp.exists() {
+            if let Err(e) = std::fs::create_dir(fp.clone()) {
+                return Err(Error::with_cause(ErrorKind::FsError, e));
+            }
+        }
+
+        if i < last_index {
+            // enable controllers for substree
+            enable_controllers(&controllers, &fp);
+        }
+    }
+
+    Ok(())
+}
+
+pub fn verify_supported_controllers(controllers: &[String]) -> bool {
+    let sc = supported_controllers();
+    for controller in controllers.iter() {
+        if !sc.contains(controller) {
+            return false;
+        }
+    }
+    true
+}
+
+pub fn get_cgroups_relative_paths() -> Result<HashMap<String, String>> {
+    let path = "/proc/self/cgroup".to_string();
+    get_cgroups_relative_paths_by_path(path)
+}
+
+pub fn get_cgroups_relative_paths_by_pid(pid: u32) -> Result<HashMap<String, String>> {
+    let path = format!("/proc/{}/cgroup", pid);
+    get_cgroups_relative_paths_by_path(path)
+}
+
+fn get_cgroup_destination(mut mount_root: String, pidpath: String) -> String {
+    if mount_root == "/" {
+        mount_root = String::from("");
+    }
+    pidpath.trim_start_matches(&mount_root).to_string()
+}
+
+pub fn existing_path(paths: HashMap<String, String>) -> Result<HashMap<String, String>> {
+    let mount_roots_v1 = V1::new();
+    let mut mount_roots_subsystems_map = HashMap::new();
+
+    for s in mount_roots_v1.subsystems().iter() {
+        let controller_name = s.controller_name();
+        let path_from_cgroup = paths
+            .get(&controller_name)
+            .ok_or(Error::new(Common(format!(
+                "controller {} found in mountinfo, but not found in cgroup.",
+                controller_name
+            ))))?;
+        let path_from_mountinfo = s.to_controller().base().to_string_lossy().to_string();
+
+        let des_path = get_cgroup_destination(path_from_mountinfo, path_from_cgroup.to_owned());
+        mount_roots_subsystems_map.insert(controller_name, des_path);
+    }
+    Ok(mount_roots_subsystems_map)
+}
+
+fn get_cgroups_relative_paths_by_path(path: String) -> Result<HashMap<String, String>> {
+    let mut m = HashMap::new();
+    let content =
+        fs::read_to_string(path.clone()).map_err(|e| Error::with_cause(ReadFailed(path), e))?;
+    // cgroup path may have ":" , likes
+    // "2:cpu,cpuacct:/system.slice/containerd.service/test.slice:cri-containerd:96b37a2edf84351487f42039e137427f1812f678850675fac214caf597ee5e4a"
+    for line in content.lines() {
+        if let Some((first_value_part, remaining_path)) =
+            line.split_once(':').unwrap_or_default().1.split_once(':')
+        {
+            let keys: Vec<&str> = first_value_part.split(',').collect();
+            keys.iter().for_each(|key| {
+                m.insert(key.to_string(), remaining_path.to_string());
+            });
+        }
+    }
+    Ok(m)
+}

src/fs/cgroup_builder.rs

@@ -0,0 +1,405 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! This module allows the user to create a control group using the Builder pattern.
+//! # Example
+//!
+//! The following example demonstrates how the control group builder looks like.  The user
+//! specifies the name of the control group (here: "hello") and the hierarchy it belongs to (here:
+//! a V1 hierarchy). Next, the user selects a subsystem by calling functions like `memory()`,
+//! `cpu()` and `devices()`. The user can then add restrictions and details via subsystem-specific
+//! calls. To finalize a subsystem, the user may call `done()`. Finally, if the control group build
+//! is done and all requirements/restrictions have been specified, the control group can be created
+//! by a call to `build()`.
+//!
+//! ```rust,no_run
+//! # use cgroups_rs::fs::*;
+//! # use cgroups_rs::fs::devices::*;
+//! # use cgroups_rs::fs::cgroup_builder::*;
+//! let h = cgroups_rs::fs::hierarchies::auto();
+//! let cgroup: Cgroup = CgroupBuilder::new("hello")
+//!      .memory()
+//!          .kernel_memory_limit(1024 * 1024)
+//!          .memory_hard_limit(1024 * 1024)
+//!          .done()
+//!      .cpu()
+//!          .shares(100)
+//!          .done()
+//!      .devices()
+//!          .device(1000, 10, DeviceType::Block, true,
+//!             vec![DevicePermissions::Read,
+//!                  DevicePermissions::Write,
+//!                  DevicePermissions::MkNod])
+//!          .device(6, 1, DeviceType::Char, false, vec![])
+//!          .done()
+//!      .network()
+//!          .class_id(1337)
+//!          .priority("eth0".to_string(), 100)
+//!          .priority("wl0".to_string(), 200)
+//!          .done()
+//!      .hugepages()
+//!          .limit("2M".to_string(), 0)
+//!          .limit("4M".to_string(), 4 * 1024 * 1024 * 100)
+//!          .limit("2G".to_string(), 2 * 1024 * 1024 * 1024)
+//!          .done()
+//!      .blkio()
+//!          .weight(123)
+//!          .leaf_weight(99)
+//!          .weight_device(6, 1, Some(100), Some(55))
+//!          .weight_device(6, 1, Some(100), Some(55))
+//!          .throttle_iops()
+//!              .read(6, 1, 10)
+//!              .write(11, 1, 100)
+//!          .throttle_bps()
+//!              .read(6, 1, 10)
+//!              .write(11, 1, 100)
+//!          .done()
+//!      .build(h).unwrap();
+//! ```
+
+use crate::fs::{
+    BlkIoDeviceResource, BlkIoDeviceThrottleResource, Cgroup, DeviceResource, Error, Hierarchy,
+    HugePageResource, MaxValue, NetworkPriority, Resources,
+};
+
+macro_rules! gen_setter {
+    ($res:ident, $cont:ident, $func:ident, $name:ident, $ty:ty) => {
+        /// See the similarly named function in the respective controller.
+        pub fn $name(mut self, $name: $ty) -> Self {
+            self.cgroup.resources.$res.$name = Some($name);
+            self
+        }
+    };
+}
+
+/// A control group builder instance
+pub struct CgroupBuilder {
+    name: String,
+    /// Internal, unsupported field: use the associated builders instead.
+    resources: Resources,
+    /// List of controllers specifically enabled in the control group.
+    specified_controllers: Option<Vec<String>>,
+}
+
+impl CgroupBuilder {
+    /// Start building a control group with the supplied hierarchy and name pair.
+    ///
+    /// Note that this does not actually create the control group until `build()` is called.
+    pub fn new(name: &str) -> CgroupBuilder {
+        CgroupBuilder {
+            name: name.to_owned(),
+            resources: Resources::default(),
+            specified_controllers: None,
+        }
+    }
+
+    /// Builds the memory resources of the control group.
+    pub fn memory(self) -> MemoryResourceBuilder {
+        MemoryResourceBuilder { cgroup: self }
+    }
+
+    /// Builds the pid resources of the control group.
+    pub fn pid(self) -> PidResourceBuilder {
+        PidResourceBuilder { cgroup: self }
+    }
+
+    /// Builds the cpu resources of the control group.
+    pub fn cpu(self) -> CpuResourceBuilder {
+        CpuResourceBuilder { cgroup: self }
+    }
+
+    /// Builds the devices resources of the control group, disallowing or
+    /// allowing access to certain devices in the system.
+    pub fn devices(self) -> DeviceResourceBuilder {
+        DeviceResourceBuilder { cgroup: self }
+    }
+
+    /// Builds the network resources of the control group, setting class id, or
+    /// various priorities on networking interfaces.
+    pub fn network(self) -> NetworkResourceBuilder {
+        NetworkResourceBuilder { cgroup: self }
+    }
+
+    /// Builds the hugepage/hugetlb resources available to the control group.
+    pub fn hugepages(self) -> HugepagesResourceBuilder {
+        HugepagesResourceBuilder { cgroup: self }
+    }
+
+    /// Builds the block I/O resources available for the control group.
+    pub fn blkio(self) -> BlkIoResourcesBuilder {
+        BlkIoResourcesBuilder {
+            cgroup: self,
+            throttling_iops: false,
+        }
+    }
+
+    /// Finalize the control group, consuming the builder and creating the control group.
+    pub fn build(self, hier: Box<dyn Hierarchy>) -> Result<Cgroup, Error> {
+        if let Some(controllers) = self.specified_controllers {
+            let cg = Cgroup::new_with_specified_controllers(hier, self.name, Some(controllers))?;
+            cg.apply(&self.resources)?;
+            Ok(cg)
+        } else {
+            let cg = Cgroup::new(hier, self.name)?;
+            cg.apply(&self.resources)?;
+            Ok(cg)
+        }
+    }
+
+    /// Specifically enable some controllers in the control group.
+    pub fn set_specified_controllers(mut self, specified_controllers: Vec<String>) -> Self {
+        self.specified_controllers = Some(specified_controllers);
+        self
+    }
+}
+
+/// A builder that configures the memory controller of a control group.
+pub struct MemoryResourceBuilder {
+    cgroup: CgroupBuilder,
+}
+
+impl MemoryResourceBuilder {
+    gen_setter!(
+        memory,
+        MemController,
+        set_kmem_limit,
+        kernel_memory_limit,
+        i64
+    );
+    gen_setter!(memory, MemController, set_limit, memory_hard_limit, i64);
+    gen_setter!(
+        memory,
+        MemController,
+        set_soft_limit,
+        memory_soft_limit,
+        i64
+    );
+    gen_setter!(
+        memory,
+        MemController,
+        set_tcp_limit,
+        kernel_tcp_memory_limit,
+        i64
+    );
+    gen_setter!(
+        memory,
+        MemController,
+        set_memswap_limit,
+        memory_swap_limit,
+        i64
+    );
+    gen_setter!(memory, MemController, set_swappiness, swappiness, u64);
+
+    /// Finish the construction of the memory resources of a control group.
+    pub fn done(self) -> CgroupBuilder {
+        self.cgroup
+    }
+}
+
+/// A builder that configures the pid controller of a control group.
+pub struct PidResourceBuilder {
+    cgroup: CgroupBuilder,
+}
+
+impl PidResourceBuilder {
+    gen_setter!(
+        pid,
+        PidController,
+        set_pid_max,
+        maximum_number_of_processes,
+        MaxValue
+    );
+
+    /// Finish the construction of the pid resources of a control group.
+    pub fn done(self) -> CgroupBuilder {
+        self.cgroup
+    }
+}
+
+/// A builder that configures the cpuset & cpu controllers of a control group.
+pub struct CpuResourceBuilder {
+    cgroup: CgroupBuilder,
+}
+
+impl CpuResourceBuilder {
+    gen_setter!(cpu, CpuSetController, set_cpus, cpus, String);
+    gen_setter!(cpu, CpuSetController, set_mems, mems, String);
+    gen_setter!(cpu, CpuController, set_shares, shares, u64);
+    gen_setter!(cpu, CpuController, set_cfs_quota, quota, i64);
+    gen_setter!(cpu, CpuController, set_cfs_period, period, u64);
+    gen_setter!(cpu, CpuController, set_rt_runtime, realtime_runtime, i64);
+    gen_setter!(cpu, CpuController, set_rt_period, realtime_period, u64);
+
+    /// Finish the construction of the cpu resources of a control group.
+    pub fn done(self) -> CgroupBuilder {
+        self.cgroup
+    }
+}
+
+/// A builder that configures the devices controller of a control group.
+pub struct DeviceResourceBuilder {
+    cgroup: CgroupBuilder,
+}
+
+impl DeviceResourceBuilder {
+    /// Restrict (or allow) a device to the tasks inside the control group.
+    pub fn device(
+        mut self,
+        major: i64,
+        minor: i64,
+        devtype: crate::fs::devices::DeviceType,
+        allow: bool,
+        access: Vec<crate::fs::devices::DevicePermissions>,
+    ) -> DeviceResourceBuilder {
+        self.cgroup.resources.devices.devices.push(DeviceResource {
+            allow,
+            devtype,
+            major,
+            minor,
+            access,
+        });
+        self
+    }
+
+    /// Finish the construction of the devices resources of a control group.
+    pub fn done(self) -> CgroupBuilder {
+        self.cgroup
+    }
+}
+
+/// A builder that configures the net_cls & net_prio controllers of a control group.
+pub struct NetworkResourceBuilder {
+    cgroup: CgroupBuilder,
+}
+
+impl NetworkResourceBuilder {
+    gen_setter!(network, NetclsController, set_class, class_id, u64);
+
+    /// Set the priority of the tasks when operating on a networking device defined by `name` to be
+    /// `priority`.
+    pub fn priority(mut self, name: String, priority: u64) -> NetworkResourceBuilder {
+        self.cgroup
+            .resources
+            .network
+            .priorities
+            .push(NetworkPriority { name, priority });
+        self
+    }
+
+    /// Finish the construction of the network resources of a control group.
+    pub fn done(self) -> CgroupBuilder {
+        self.cgroup
+    }
+}
+
+/// A builder that configures the hugepages controller of a control group.
+pub struct HugepagesResourceBuilder {
+    cgroup: CgroupBuilder,
+}
+
+impl HugepagesResourceBuilder {
+    /// Limit the usage of certain hugepages (determined by `size`) to be at most `limit` bytes.
+    pub fn limit(mut self, size: String, limit: u64) -> HugepagesResourceBuilder {
+        self.cgroup
+            .resources
+            .hugepages
+            .limits
+            .push(HugePageResource { size, limit });
+        self
+    }
+
+    /// Finish the construction of the network resources of a control group.
+    pub fn done(self) -> CgroupBuilder {
+        self.cgroup
+    }
+}
+
+/// A builder that configures the blkio controller of a control group.
+pub struct BlkIoResourcesBuilder {
+    cgroup: CgroupBuilder,
+    throttling_iops: bool,
+}
+
+impl BlkIoResourcesBuilder {
+    gen_setter!(blkio, BlkIoController, set_weight, weight, u16);
+    gen_setter!(blkio, BlkIoController, set_leaf_weight, leaf_weight, u16);
+
+    /// Set the weight of a certain device.
+    pub fn weight_device(
+        mut self,
+        major: u64,
+        minor: u64,
+        weight: Option<u16>,
+        leaf_weight: Option<u16>,
+    ) -> BlkIoResourcesBuilder {
+        self.cgroup
+            .resources
+            .blkio
+            .weight_device
+            .push(BlkIoDeviceResource {
+                major,
+                minor,
+                weight,
+                leaf_weight,
+            });
+        self
+    }
+
+    /// Start configuring the I/O operations per second metric.
+    pub fn throttle_iops(mut self) -> BlkIoResourcesBuilder {
+        self.throttling_iops = true;
+        self
+    }
+
+    /// Start configuring the bytes per second metric.
+    pub fn throttle_bps(mut self) -> BlkIoResourcesBuilder {
+        self.throttling_iops = false;
+        self
+    }
+
+    /// Limit the read rate of the current metric for a certain device.
+    pub fn read(mut self, major: u64, minor: u64, rate: u64) -> BlkIoResourcesBuilder {
+        let throttle = BlkIoDeviceThrottleResource { major, minor, rate };
+        if self.throttling_iops {
+            self.cgroup
+                .resources
+                .blkio
+                .throttle_read_iops_device
+                .push(throttle);
+        } else {
+            self.cgroup
+                .resources
+                .blkio
+                .throttle_read_bps_device
+                .push(throttle);
+        }
+        self
+    }
+
+    /// Limit the write rate of the current metric for a certain device.
+    pub fn write(mut self, major: u64, minor: u64, rate: u64) -> BlkIoResourcesBuilder {
+        let throttle = BlkIoDeviceThrottleResource { major, minor, rate };
+        if self.throttling_iops {
+            self.cgroup
+                .resources
+                .blkio
+                .throttle_write_iops_device
+                .push(throttle);
+        } else {
+            self.cgroup
+                .resources
+                .blkio
+                .throttle_write_bps_device
+                .push(throttle);
+        }
+        self
+    }
+
+    /// Finish the construction of the blkio resources of a control group.
+    pub fn done(self) -> CgroupBuilder {
+        self.cgroup
+    }
+}

src/fs/cpu.rs

@@ -0,0 +1,320 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! This module contains the implementation of the `cpu` cgroup subsystem.
+//!
+//! See the Kernel's documentation for more information about this subsystem, found at:
+//!  [Documentation/scheduler/sched-design-CFS.txt](https://www.kernel.org/doc/Documentation/scheduler/sched-design-CFS.txt)
+//!  paragraph 7 ("GROUP SCHEDULER EXTENSIONS TO CFS").
+use std::fs::File;
+use std::io::{Read, Write};
+use std::path::PathBuf;
+
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
+use crate::fs::{parse_max_value, read_i64_from, read_u64_from};
+
+use crate::fs::{
+    ControllIdentifier, ControllerInternal, Controllers, CpuResources, CustomizedAttribute,
+    MaxValue, Resources, Subsystem,
+};
+
+/// A controller that allows controlling the `cpu` subsystem of a Cgroup.
+///
+/// In essence, it allows gathering information about how much the tasks inside the control group
+/// are using the CPU and creating rules that limit their usage. Note that this crate does not yet
+/// support managing realtime tasks.
+#[derive(Debug, Clone)]
+pub struct CpuController {
+    base: PathBuf,
+    path: PathBuf,
+    v2: bool,
+}
+
+/// The current state of the control group and its processes.
+#[derive(Debug)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct Cpu {
+    /// Reports CPU time statistics.
+    ///
+    /// Corresponds the `cpu.stat` file in `cpu` control group.
+    pub stat: String,
+}
+
+/// The current state of the control group and its processes.
+#[derive(Debug)]
+struct CfsQuotaAndPeriod {
+    quota: MaxValue,
+    period: u64,
+}
+
+impl ControllerInternal for CpuController {
+    fn control_type(&self) -> Controllers {
+        Controllers::Cpu
+    }
+
+    fn get_path(&self) -> &PathBuf {
+        &self.path
+    }
+    fn get_path_mut(&mut self) -> &mut PathBuf {
+        &mut self.path
+    }
+
+    fn get_base(&self) -> &PathBuf {
+        &self.base
+    }
+
+    fn is_v2(&self) -> bool {
+        self.v2
+    }
+
+    fn apply(&self, res: &Resources) -> Result<()> {
+        // get the resources that apply to this controller
+        let res: &CpuResources = &res.cpu;
+
+        update_and_test!(self, set_shares, res.shares, shares);
+        update_and_test!(self, set_cfs_period, res.period, cfs_period);
+        update_and_test!(self, set_cfs_quota, res.quota, cfs_quota);
+
+        res.attrs.iter().for_each(|(k, v)| {
+            let _ = self.set(k, v);
+        });
+
+        // TODO: rt properties (CONFIG_RT_GROUP_SCHED) are not yet supported
+
+        Ok(())
+    }
+}
+
+impl ControllIdentifier for CpuController {
+    fn controller_type() -> Controllers {
+        Controllers::Cpu
+    }
+}
+
+impl<'a> From<&'a Subsystem> for &'a CpuController {
+    fn from(sub: &'a Subsystem) -> &'a CpuController {
+        unsafe {
+            match sub {
+                Subsystem::Cpu(c) => c,
+                _ => {
+                    assert_eq!(1, 0);
+                    let v = std::mem::MaybeUninit::uninit();
+                    v.assume_init()
+                }
+            }
+        }
+    }
+}
+
+impl CpuController {
+    /// Contructs a new `CpuController` with `root` serving as the root of the control group.
+    pub fn new(point: PathBuf, root: PathBuf, v2: bool) -> Self {
+        Self {
+            base: root,
+            path: point,
+            v2,
+        }
+    }
+
+    /// Returns CPU time statistics based on the processes in the control group.
+    pub fn cpu(&self) -> Cpu {
+        Cpu {
+            stat: self
+                .open_path("cpu.stat", false)
+                .and_then(|mut file| {
+                    let mut s = String::new();
+                    let res = file.read_to_string(&mut s);
+                    match res {
+                        Ok(_) => Ok(s),
+                        Err(e) => Err(Error::with_cause(ReadFailed("cpu.stat".to_string()), e)),
+                    }
+                })
+                .unwrap_or_default(),
+        }
+    }
+
+    /// Configures the CPU bandwidth (in relative relation to other control groups and this control
+    /// group's parent).
+    ///
+    /// For example, setting control group `A`'s `shares` to `100`, and control group `B`'s
+    /// `shares` to `200` ensures that control group `B` receives twice as much as CPU bandwidth.
+    /// (Assuming both `A` and `B` are of the same parent)
+    pub fn set_shares(&self, shares: u64) -> Result<()> {
+        let mut file_name = "cpu.shares";
+        if self.v2 {
+            file_name = "cpu.weight";
+        }
+        // NOTE: .CpuShares is not used here. Conversion is the caller's responsibility.
+        self.open_path(file_name, true).and_then(|mut file| {
+            file.write_all(shares.to_string().as_ref()).map_err(|e| {
+                Error::with_cause(WriteFailed(file_name.to_string(), shares.to_string()), e)
+            })
+        })
+    }
+
+    /// Retrieve the CPU bandwidth that this control group (relative to other control groups and
+    /// this control group's parent) can use.
+    pub fn shares(&self) -> Result<u64> {
+        let mut file = "cpu.shares";
+        if self.v2 {
+            file = "cpu.weight";
+        }
+        self.open_path(file, false).and_then(read_u64_from)
+    }
+
+    /// Specify a period (when using the CFS scheduler) of time in microseconds for how often this
+    /// control group's access to the CPU should be reallocated.
+    pub fn set_cfs_period(&self, us: u64) -> Result<()> {
+        if self.v2 {
+            return self.set_cfs_quota_and_period(None, Some(us));
+        }
+        self.open_path("cpu.cfs_period_us", true)
+            .and_then(|mut file| {
+                file.write_all(us.to_string().as_ref()).map_err(|e| {
+                    Error::with_cause(
+                        WriteFailed("cpu.cfs_period_us".to_string(), us.to_string()),
+                        e,
+                    )
+                })
+            })
+    }
+
+    /// Retrieve the period of time of how often this cgroup's access to the CPU should be
+    /// reallocated in microseconds.
+    pub fn cfs_period(&self) -> Result<u64> {
+        if self.v2 {
+            let current_value = self
+                .open_path("cpu.max", false)
+                .and_then(parse_cfs_quota_and_period)?;
+            return Ok(current_value.period);
+        }
+        self.open_path("cpu.cfs_period_us", false)
+            .and_then(read_u64_from)
+    }
+
+    /// Specify a quota (when using the CFS scheduler) of time in microseconds for which all tasks
+    /// in this control group can run during one period (see: `set_cfs_period()`).
+    pub fn set_cfs_quota(&self, us: i64) -> Result<()> {
+        if self.v2 {
+            return self.set_cfs_quota_and_period(Some(us), None);
+        }
+        self.open_path("cpu.cfs_quota_us", true)
+            .and_then(|mut file| {
+                file.write_all(us.to_string().as_ref()).map_err(|e| {
+                    Error::with_cause(
+                        WriteFailed("cpu.cfs_quota_us".to_string(), us.to_string()),
+                        e,
+                    )
+                })
+            })
+    }
+
+    /// Retrieve the quota of time for which all tasks in this cgroup can run during one period, in
+    /// microseconds.
+    pub fn cfs_quota(&self) -> Result<i64> {
+        if self.v2 {
+            let current_value = self
+                .open_path("cpu.max", false)
+                .and_then(parse_cfs_quota_and_period)?;
+            return Ok(current_value.quota.to_i64());
+        }
+
+        self.open_path("cpu.cfs_quota_us", false)
+            .and_then(read_i64_from)
+    }
+
+    pub fn set_cfs_quota_and_period(&self, quota: Option<i64>, period: Option<u64>) -> Result<()> {
+        if !self.v2 {
+            if let Some(q) = quota {
+                self.set_cfs_quota(q)?;
+            }
+            if let Some(p) = period {
+                self.set_cfs_period(p)?;
+            }
+            return Ok(());
+        }
+
+        // https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2.html
+
+        // cpu.max
+        // A read-write two value file which exists on non-root cgroups. The default is “max 100000”.
+        // The maximum bandwidth limit. It’s in the following format:
+        // $MAX $PERIOD
+        // which indicates that the group may consume upto $MAX in each $PERIOD duration.
+        // “max” for $MAX indicates no limit. If only one number is written, $MAX is updated.
+
+        let current_value = self
+            .open_path("cpu.max", false)
+            .and_then(parse_cfs_quota_and_period)?;
+
+        let new_quota = if let Some(q) = quota {
+            if q > 0 {
+                q.to_string()
+            } else {
+                "max".to_string()
+            }
+        } else {
+            current_value.quota.to_string()
+        };
+
+        let new_period = if let Some(p) = period {
+            p.to_string()
+        } else {
+            current_value.period.to_string()
+        };
+
+        let line = format!("{} {}", new_quota, new_period);
+        self.open_path("cpu.max", true).and_then(|mut file| {
+            file.write_all(line.as_ref())
+                .map_err(|e| Error::with_cause(WriteFailed("cpu.max".to_string(), line), e))
+        })
+    }
+
+    pub fn set_rt_runtime(&self, us: i64) -> Result<()> {
+        self.open_path("cpu.rt_runtime_us", true)
+            .and_then(|mut file| {
+                file.write_all(us.to_string().as_ref()).map_err(|e| {
+                    Error::with_cause(
+                        WriteFailed("cpu.rt_runtime_us".to_string(), us.to_string()),
+                        e,
+                    )
+                })
+            })
+    }
+
+    pub fn set_rt_period_us(&self, us: u64) -> Result<()> {
+        self.open_path("cpu.rt_period_us", true)
+            .and_then(|mut file| {
+                file.write_all(us.to_string().as_ref()).map_err(|e| {
+                    Error::with_cause(
+                        WriteFailed("cpu.rt_period_us".to_string(), us.to_string()),
+                        e,
+                    )
+                })
+            })
+    }
+}
+
+impl CustomizedAttribute for CpuController {}
+
+fn parse_cfs_quota_and_period(mut file: File) -> Result<CfsQuotaAndPeriod> {
+    let mut content = String::new();
+    file.read_to_string(&mut content)
+        .map_err(|e| Error::with_cause(ReadFailed("cpu.max".to_string()), e))?;
+
+    let fields = content.trim().split(' ').collect::<Vec<&str>>();
+    if fields.len() != 2 {
+        return Err(Error::from_string(format!("invaild format: {}", content)));
+    }
+
+    let quota = parse_max_value(fields[0])?;
+    let period = fields[1]
+        .parse::<u64>()
+        .map_err(|e| Error::with_cause(ParseError, e))?;
+
+    Ok(CfsQuotaAndPeriod { quota, period })
+}

src/fs/cpuacct.rs

@@ -0,0 +1,156 @@
+// Copyright (c) 2018 Levente Kurusa
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! This module contains the implementation of the `cpuacct` cgroup subsystem.
+//!
+//! See the Kernel's documentation for more information about this subsystem, found at:
+//!  [Documentation/cgroup-v1/cpuacct.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/cpuacct.txt)
+use std::io::Write;
+use std::path::PathBuf;
+
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
+
+use crate::fs::{read_string_from, read_u64_from};
+use crate::fs::{ControllIdentifier, ControllerInternal, Controllers, Resources, Subsystem};
+
+/// A controller that allows controlling the `cpuacct` subsystem of a Cgroup.
+///
+/// In essence, this control group provides accounting (hence the name `cpuacct`) for CPU usage of
+/// the tasks in the control group.
+#[derive(Debug, Clone)]
+pub struct CpuAcctController {
+    base: PathBuf,
+    path: PathBuf,
+}
+
+/// Represents the statistics retrieved from the control group.
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct CpuAcct {
+    /// Divides the time used by the tasks into `user` time and `system` time.
+    pub stat: String,
+    /// Total CPU time (in nanoseconds) spent by the tasks.
+    pub usage: u64,
+    /// Total CPU time (in nanoseconds) spent by the tasks, broken down by CPU and by whether the
+    /// time spent is `user` time or `system` time.
+    ///
+    /// An example is as follows:
+    /// ```text
+    /// cpu user system
+    /// 0 8348363768 0
+    /// 1 8324369100 0
+    /// 2 8598185449 0
+    /// 3 8648262473 0
+    /// ```
+    pub usage_all: String,
+    /// CPU time (in nanoseconds) spent by the tasks, broken down by each CPU.
+    /// Times spent in each CPU are separated by a space.
+    pub usage_percpu: String,
+    /// As for `usage_percpu`, but the `system` time spent.
+    pub usage_percpu_sys: String,
+    /// As for `usage_percpu`, but the `user` time spent.
+    pub usage_percpu_user: String,
+    /// CPU time (in nanoseconds) spent by the tasks that counted for `system` time.
+    pub usage_sys: u64,
+    /// CPU time (in nanoseconds) spent by the tasks that counted for `user` time.
+    pub usage_user: u64,
+}
+
+impl ControllerInternal for CpuAcctController {
+    fn control_type(&self) -> Controllers {
+        Controllers::CpuAcct
+    }
+    fn get_path(&self) -> &PathBuf {
+        &self.path
+    }
+    fn get_path_mut(&mut self) -> &mut PathBuf {
+        &mut self.path
+    }
+    fn get_base(&self) -> &PathBuf {
+        &self.base
+    }
+
+    fn apply(&self, _res: &Resources) -> Result<()> {
+        Ok(())
+    }
+}
+
+impl ControllIdentifier for CpuAcctController {
+    fn controller_type() -> Controllers {
+        Controllers::CpuAcct
+    }
+}
+
+impl<'a> From<&'a Subsystem> for &'a CpuAcctController {
+    fn from(sub: &'a Subsystem) -> &'a CpuAcctController {
+        unsafe {
+            match sub {
+                Subsystem::CpuAcct(c) => c,
+                _ => {
+                    assert_eq!(1, 0);
+                    let v = std::mem::MaybeUninit::uninit();
+                    v.assume_init()
+                }
+            }
+        }
+    }
+}
+
+impl CpuAcctController {
+    /// Contructs a new `CpuAcctController` with `root` serving as the root of the control group.
+    pub fn new(point: PathBuf, root: PathBuf) -> Self {
+        Self {
+            base: root,
+            path: point,
+        }
+    }
+
+    /// Gathers the statistics that are available in the control group into a `CpuAcct` structure.
+    pub fn cpuacct(&self) -> CpuAcct {
+        CpuAcct {
+            stat: self
+                .open_path("cpuacct.stat", false)
+                .and_then(read_string_from)
+                .unwrap_or_default(),
+            usage: self
+                .open_path("cpuacct.usage", false)
+                .and_then(read_u64_from)
+                .unwrap_or(0),
+            usage_all: self
+                .open_path("cpuacct.usage_all", false)
+                .and_then(read_string_from)
+                .unwrap_or_default(),
+            usage_percpu: self
+                .open_path("cpuacct.usage_percpu", false)
+                .and_then(read_string_from)
+                .unwrap_or_default(),
+            usage_percpu_sys: self
+                .open_path("cpuacct.usage_percpu_sys", false)
+                .and_then(read_string_from)
+                .unwrap_or_default(),
+            usage_percpu_user: self
+                .open_path("cpuacct.usage_percpu_user", false)
+                .and_then(read_string_from)
+                .unwrap_or_default(),
+            usage_sys: self
+                .open_path("cpuacct.usage_sys", false)
+                .and_then(read_u64_from)
+                .unwrap_or(0),
+            usage_user: self
+                .open_path("cpuacct.usage_user", false)
+                .and_then(read_u64_from)
+                .unwrap_or(0),
+        }
+    }
+
+    /// Reset the statistics the kernel has gathered about the control group.
+    pub fn reset(&self) -> Result<()> {
+        self.open_path("cpuacct.usage", true).and_then(|mut file| {
+            file.write_all(b"0").map_err(|e| {
+                Error::with_cause(WriteFailed("cpuacct.usage".to_string(), "0".to_string()), e)
+            })
+        })
+    }
+}

src/fs/cpuset.rs

@@ -0,0 +1,621 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! This module contains the implementation of the `cpuset` cgroup subsystem.
+//!
+//! See the Kernel's documentation for more information about this subsystem, found at:
+//!  [Documentation/cgroup-v1/cpusets.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/cpusets.txt)
+
+use log::*;
+use std::io::Write;
+use std::path::PathBuf;
+
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
+
+use crate::fs::{read_string_from, read_u64_from};
+use crate::fs::{
+    ControllIdentifier, ControllerInternal, Controllers, CpuResources, Resources, Subsystem,
+};
+
+/// A controller that allows controlling the `cpuset` subsystem of a Cgroup.
+///
+/// In essence, this controller is responsible for restricting the tasks in the control group to a
+/// set of CPUs and/or memory nodes.
+#[derive(Debug, Clone)]
+pub struct CpuSetController {
+    base: PathBuf,
+    path: PathBuf,
+    v2: bool,
+}
+
+/// The current state of the `cpuset` controller for this control group.
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct CpuSet {
+    /// If true, no other control groups can share the CPUs listed in the `cpus` field.
+    pub cpu_exclusive: bool,
+    /// The list of CPUs the tasks of the control group can run on.
+    ///
+    /// This is a vector of `(start, end)` tuples, where each tuple is a range of CPUs where the
+    /// control group is allowed to run on. Both sides of the range are inclusive.
+    pub cpus: Vec<(u64, u64)>,
+    /// The list of CPUs that the tasks can effectively run on. This removes the list of CPUs that
+    /// the parent (and all of its parents) cannot run on from the `cpus` field of this control
+    /// group.
+    pub effective_cpus: Vec<(u64, u64)>,
+    /// The list of memory nodes that the tasks can effectively use. This removes the list of nodes that
+    /// the parent (and all of its parents) cannot use from the `mems` field of this control
+    /// group.
+    pub effective_mems: Vec<(u64, u64)>,
+    /// If true, no other control groups can share the memory nodes listed in the `mems` field.
+    pub mem_exclusive: bool,
+    /// If true, the control group is 'hardwalled'. Kernel memory allocations (except for a few
+    /// minor exceptions) are made from the memory nodes designated in the `mems` field.
+    pub mem_hardwall: bool,
+    /// If true, whenever `mems` is changed via `set_mems()`, the memory stored on the previous
+    /// nodes are migrated to the new nodes selected by the new `mems`.
+    pub memory_migrate: bool,
+    /// Running average of the memory pressured faced by the tasks in the control group.
+    pub memory_pressure: u64,
+    /// This field is only at the root control group and controls whether the kernel will compute
+    /// the memory pressure for control groups or not.
+    pub memory_pressure_enabled: Option<bool>,
+    /// If true, filesystem buffers are spread across evenly between the nodes specified in `mems`.
+    pub memory_spread_page: bool,
+    /// If true, kernel slab caches for file I/O are spread across evenly between the nodes
+    /// specified in `mems`.
+    pub memory_spread_slab: bool,
+    /// The list of memory nodes the tasks of the control group can use.
+    ///
+    /// The format is the same as the `cpus`, `effective_cpus` and `effective_mems` fields.
+    pub mems: Vec<(u64, u64)>,
+    /// If true, the kernel will attempt to rebalance the load between the CPUs specified in the
+    /// `cpus` field of this control group.
+    pub sched_load_balance: bool,
+    /// Represents how much work the kernel should do to rebalance this cpuset.
+    ///
+    /// | `sched_load_balance` | Effect |
+    /// | -------------------- | ------ |
+    /// |          -1          | Use the system default value |
+    /// |           0          | Only balance loads periodically |
+    /// |           1          | Immediately balance the load across tasks on the same core |
+    /// |           2          | Immediately balance the load across cores in the same CPU package |
+    /// |           4          | Immediately balance the load across CPUs on the same node |
+    /// |           5          | Immediately balance the load between CPUs even if the system is NUMA |
+    /// |           6          | Immediately balance the load between all CPUs |
+    pub sched_relax_domain_level: u64,
+}
+
+impl ControllerInternal for CpuSetController {
+    fn control_type(&self) -> Controllers {
+        Controllers::CpuSet
+    }
+    fn get_path(&self) -> &PathBuf {
+        &self.path
+    }
+    fn get_path_mut(&mut self) -> &mut PathBuf {
+        &mut self.path
+    }
+    fn get_base(&self) -> &PathBuf {
+        &self.base
+    }
+
+    fn is_v2(&self) -> bool {
+        self.v2
+    }
+
+    fn apply(&self, res: &Resources) -> Result<()> {
+        // get the resources that apply to this controller
+        let res: &CpuResources = &res.cpu;
+
+        update!(self, set_cpus, res.cpus.as_ref());
+        update!(self, set_mems, res.mems.as_ref());
+
+        Ok(())
+    }
+
+    fn post_create(&self) {
+        if self.is_v2() {
+            return;
+        }
+        let current = self.get_path();
+
+        if current != self.get_base() {
+            match copy_from_parent(current.to_str().unwrap(), "cpuset.cpus") {
+                Ok(_) => (),
+                Err(err) => error!("error create_dir for cpuset.cpus {:?}", err),
+            }
+            match copy_from_parent(current.to_str().unwrap(), "cpuset.mems") {
+                Ok(_) => (),
+                Err(err) => error!("error create_dir for cpuset.mems {:?}", err),
+            }
+        }
+    }
+}
+
+fn find_no_empty_parent(from: &str, file: &str) -> Result<(String, Vec<PathBuf>)> {
+    let mut current_path = ::std::path::Path::new(from).to_path_buf();
+    let mut v = vec![];
+
+    loop {
+        let current_value =
+            match ::std::fs::read_to_string(current_path.clone().join(file).to_str().unwrap()) {
+                Ok(cpus) => String::from(cpus.trim()),
+                Err(e) => {
+                    return Err(Error::with_cause(
+                        ReadFailed(current_path.display().to_string()),
+                        e,
+                    ))
+                }
+            };
+
+        if !current_value.is_empty() {
+            return Ok((current_value, v));
+        }
+        v.push(current_path.clone());
+
+        let parent = match current_path.parent() {
+            Some(p) => p,
+            None => return Ok(("".to_string(), v)),
+        };
+
+        // next loop, find parent
+        current_path = parent.to_path_buf();
+    }
+}
+
+/// copy_from_parent copy the cpuset.cpus and cpuset.mems from the parent
+/// directory to the current directory if the file's contents are 0
+fn copy_from_parent(current: &str, file: &str) -> Result<()> {
+    // find not empty cpus/memes from current directory.
+    let (value, parents) = find_no_empty_parent(current, file)?;
+
+    if value.is_empty() || parents.is_empty() {
+        return Ok(());
+    }
+
+    for p in parents.iter().rev() {
+        let mut pb = p.clone();
+        pb.push(file);
+        match ::std::fs::write(pb.to_str().unwrap(), value.as_bytes()) {
+            Ok(_) => (),
+            Err(e) => {
+                return Err(Error::with_cause(
+                    WriteFailed(pb.display().to_string(), pb.display().to_string()),
+                    e,
+                ))
+            }
+        }
+    }
+
+    Ok(())
+}
+
+impl ControllIdentifier for CpuSetController {
+    fn controller_type() -> Controllers {
+        Controllers::CpuSet
+    }
+}
+
+impl<'a> From<&'a Subsystem> for &'a CpuSetController {
+    fn from(sub: &'a Subsystem) -> &'a CpuSetController {
+        unsafe {
+            match sub {
+                Subsystem::CpuSet(c) => c,
+                _ => {
+                    assert_eq!(1, 0);
+                    let v = std::mem::MaybeUninit::uninit();
+                    v.assume_init()
+                }
+            }
+        }
+    }
+}
+
+/// Parse a string like "1,2,4-5,8" into a list of (start, end) tuples.
+fn parse_range(s: String) -> Result<Vec<(u64, u64)>> {
+    let mut fin = Vec::new();
+
+    if s.is_empty() {
+        return Ok(fin);
+    }
+
+    // first split by commas
+    let comma_split = s.split(',');
+
+    for sp in comma_split {
+        if sp.contains('-') {
+            // this is a true range
+            let dash_split = sp.split('-').collect::<Vec<_>>();
+            if dash_split.len() != 2 {
+                return Err(Error::new(ParseError));
+            }
+            let first = dash_split[0].parse::<u64>();
+            let second = dash_split[1].parse::<u64>();
+            if first.is_err() || second.is_err() {
+                return Err(Error::new(ParseError));
+            }
+            fin.push((first.unwrap(), second.unwrap()));
+        } else {
+            // this is just a single number
+            let num = sp.parse::<u64>();
+            if num.is_err() {
+                return Err(Error::new(ParseError));
+            }
+            fin.push((num.clone().unwrap(), num.clone().unwrap()));
+        }
+    }
+
+    Ok(fin)
+}
+
+impl CpuSetController {
+    /// Contructs a new `CpuSetController` with `root` serving as the root of the control group.
+    pub fn new(point: PathBuf, root: PathBuf, v2: bool) -> Self {
+        Self {
+            base: root,
+            path: point,
+            v2,
+        }
+    }
+
+    /// Returns the statistics gathered by the kernel for this control group. See the struct for
+    /// more information on what information this entails.
+    pub fn cpuset(&self) -> CpuSet {
+        CpuSet {
+            cpu_exclusive: {
+                self.open_path("cpuset.cpu_exclusive", false)
+                    .and_then(read_u64_from)
+                    .map(|x| x == 1)
+                    .unwrap_or(false)
+            },
+            cpus: {
+                self.open_path("cpuset.cpus", false)
+                    .and_then(read_string_from)
+                    .and_then(parse_range)
+                    .unwrap_or_default()
+            },
+            effective_cpus: {
+                self.open_path("cpuset.effective_cpus", false)
+                    .and_then(read_string_from)
+                    .and_then(parse_range)
+                    .unwrap_or_default()
+            },
+            effective_mems: {
+                self.open_path("cpuset.effective_mems", false)
+                    .and_then(read_string_from)
+                    .and_then(parse_range)
+                    .unwrap_or_default()
+            },
+            mem_exclusive: {
+                self.open_path("cpuset.mem_exclusive", false)
+                    .and_then(read_u64_from)
+                    .map(|x| x == 1)
+                    .unwrap_or(false)
+            },
+            mem_hardwall: {
+                self.open_path("cpuset.mem_hardwall", false)
+                    .and_then(read_u64_from)
+                    .map(|x| x == 1)
+                    .unwrap_or(false)
+            },
+            memory_migrate: {
+                self.open_path("cpuset.memory_migrate", false)
+                    .and_then(read_u64_from)
+                    .map(|x| x == 1)
+                    .unwrap_or(false)
+            },
+            memory_pressure: {
+                self.open_path("cpuset.memory_pressure", false)
+                    .and_then(read_u64_from)
+                    .unwrap_or(0)
+            },
+            memory_pressure_enabled: {
+                self.open_path("cpuset.memory_pressure_enabled", false)
+                    .and_then(read_u64_from)
+                    .map(|x| x == 1)
+                    .ok()
+            },
+            memory_spread_page: {
+                self.open_path("cpuset.memory_spread_page", false)
+                    .and_then(read_u64_from)
+                    .map(|x| x == 1)
+                    .unwrap_or(false)
+            },
+            memory_spread_slab: {
+                self.open_path("cpuset.memory_spread_slab", false)
+                    .and_then(read_u64_from)
+                    .map(|x| x == 1)
+                    .unwrap_or(false)
+            },
+            mems: {
+                self.open_path("cpuset.mems", false)
+                    .and_then(read_string_from)
+                    .and_then(parse_range)
+                    .unwrap_or_default()
+            },
+            sched_load_balance: {
+                self.open_path("cpuset.sched_load_balance", false)
+                    .and_then(read_u64_from)
+                    .map(|x| x == 1)
+                    .unwrap_or(false)
+            },
+            sched_relax_domain_level: {
+                self.open_path("cpuset.sched_relax_domain_level", false)
+                    .and_then(read_u64_from)
+                    .unwrap_or(0)
+            },
+        }
+    }
+
+    /// Control whether the CPUs selected via `set_cpus()` should be exclusive to this control
+    /// group or not.
+    pub fn set_cpu_exclusive(&self, b: bool) -> Result<()> {
+        self.open_path("cpuset.cpu_exclusive", true)
+            .and_then(|mut file| {
+                if b {
+                    file.write_all(b"1").map_err(|e| {
+                        Error::with_cause(
+                            WriteFailed("cpuset.cpu_exclusive".to_string(), "1".to_string()),
+                            e,
+                        )
+                    })
+                } else {
+                    file.write_all(b"0").map_err(|e| {
+                        Error::with_cause(
+                            WriteFailed("cpuset.cpu_exclusive".to_string(), "0".to_string()),
+                            e,
+                        )
+                    })
+                }
+            })
+    }
+
+    /// Control whether the memory nodes selected via `set_memss()` should be exclusive to this control
+    /// group or not.
+    pub fn set_mem_exclusive(&self, b: bool) -> Result<()> {
+        self.open_path("cpuset.mem_exclusive", true)
+            .and_then(|mut file| {
+                if b {
+                    file.write_all(b"1").map_err(|e| {
+                        Error::with_cause(
+                            WriteFailed("cpuset.mem_exclusive".to_string(), "1".to_string()),
+                            e,
+                        )
+                    })
+                } else {
+                    file.write_all(b"0").map_err(|e| {
+                        Error::with_cause(
+                            WriteFailed("cpuset.mem_exclusive".to_string(), "0".to_string()),
+                            e,
+                        )
+                    })
+                }
+            })
+    }
+
+    /// Set the CPUs that the tasks in this control group can run on.
+    ///
+    /// Syntax is a comma separated list of CPUs, with an additional extension that ranges can
+    /// be represented via dashes.
+    pub fn set_cpus(&self, cpus: &str) -> Result<()> {
+        self.open_path("cpuset.cpus", true).and_then(|mut file| {
+            file.write_all(cpus.as_ref()).map_err(|e| {
+                Error::with_cause(WriteFailed("cpuset.cpus".to_string(), cpus.to_string()), e)
+            })
+        })
+    }
+
+    /// Set the memory nodes that the tasks in this control group can use.
+    ///
+    /// Syntax is the same as with `set_cpus()`.
+    pub fn set_mems(&self, mems: &str) -> Result<()> {
+        self.open_path("cpuset.mems", true).and_then(|mut file| {
+            file.write_all(mems.as_ref()).map_err(|e| {
+                Error::with_cause(WriteFailed("cpuset.mems".to_string(), mems.to_string()), e)
+            })
+        })
+    }
+
+    /// Controls whether the control group should be "hardwalled", i.e., whether kernel allocations
+    /// should exclusively use the memory nodes set via `set_mems()`.
+    ///
+    /// Note that some kernel allocations, most notably those that are made in interrupt handlers
+    /// may disregard this.
+    pub fn set_hardwall(&self, b: bool) -> Result<()> {
+        self.open_path("cpuset.mem_hardwall", true)
+            .and_then(|mut file| {
+                if b {
+                    file.write_all(b"1").map_err(|e| {
+                        Error::with_cause(
+                            WriteFailed("cpuset.mem_hardwall".to_string(), "1".to_string()),
+                            e,
+                        )
+                    })
+                } else {
+                    file.write_all(b"0").map_err(|e| {
+                        Error::with_cause(
+                            WriteFailed("cpuset.mem_hardwall".to_string(), "0".to_string()),
+                            e,
+                        )
+                    })
+                }
+            })
+    }
+
+    /// Controls whether the kernel should attempt to rebalance the load between the CPUs specified in the
+    /// `cpus` field of this control group.
+    pub fn set_load_balancing(&self, b: bool) -> Result<()> {
+        self.open_path("cpuset.sched_load_balance", true)
+            .and_then(|mut file| {
+                if b {
+                    file.write_all(b"1").map_err(|e| {
+                        Error::with_cause(
+                            WriteFailed("cpuset.sched_load_balance".to_string(), "1".to_string()),
+                            e,
+                        )
+                    })
+                } else {
+                    file.write_all(b"0").map_err(|e| {
+                        Error::with_cause(
+                            WriteFailed("cpuset.sched_load_balance".to_string(), "0".to_string()),
+                            e,
+                        )
+                    })
+                }
+            })
+    }
+
+    /// Contorl how much effort the kernel should invest in rebalacing the control group.
+    ///
+    /// See @CpuSet 's similar field for more information.
+    pub fn set_rebalance_relax_domain_level(&self, i: i64) -> Result<()> {
+        self.open_path("cpuset.sched_relax_domain_level", true)
+            .and_then(|mut file| {
+                file.write_all(i.to_string().as_ref()).map_err(|e| {
+                    Error::with_cause(
+                        WriteFailed("cpuset.sched_relax_domain_level".to_string(), i.to_string()),
+                        e,
+                    )
+                })
+            })
+    }
+
+    /// Control whether when using `set_mems()` the existing memory used by the tasks should be
+    /// migrated over to the now-selected nodes.
+    pub fn set_memory_migration(&self, b: bool) -> Result<()> {
+        self.open_path("cpuset.memory_migrate", true)
+            .and_then(|mut file| {
+                if b {
+                    file.write_all(b"1").map_err(|e| {
+                        Error::with_cause(
+                            WriteFailed("cpuset.memory_migrate".to_string(), "1".to_string()),
+                            e,
+                        )
+                    })
+                } else {
+                    file.write_all(b"0").map_err(|e| {
+                        Error::with_cause(
+                            WriteFailed("cpuset.memory_migrate".to_string(), "0".to_string()),
+                            e,
+                        )
+                    })
+                }
+            })
+    }
+
+    /// Control whether filesystem buffers should be evenly split across the nodes selected via
+    /// `set_mems()`.
+    pub fn set_memory_spread_page(&self, b: bool) -> Result<()> {
+        self.open_path("cpuset.memory_spread_page", true)
+            .and_then(|mut file| {
+                if b {
+                    file.write_all(b"1").map_err(|e| {
+                        Error::with_cause(
+                            WriteFailed("cpuset.memory_spread_page".to_string(), "1".to_string()),
+                            e,
+                        )
+                    })
+                } else {
+                    file.write_all(b"0").map_err(|e| {
+                        Error::with_cause(
+                            WriteFailed("cpuset.memory_spread_page".to_string(), "0".to_string()),
+                            e,
+                        )
+                    })
+                }
+            })
+    }
+
+    /// Control whether the kernel's slab cache for file I/O should be evenly split across the
+    /// nodes selected via `set_mems()`.
+    pub fn set_memory_spread_slab(&self, b: bool) -> Result<()> {
+        self.open_path("cpuset.memory_spread_slab", true)
+            .and_then(|mut file| {
+                if b {
+                    file.write_all(b"1").map_err(|e| {
+                        Error::with_cause(
+                            WriteFailed("cpuset.memory_spread_slab".to_string(), "1".to_string()),
+                            e,
+                        )
+                    })
+                } else {
+                    file.write_all(b"0").map_err(|e| {
+                        Error::with_cause(
+                            WriteFailed("cpuset.memory_spread_slab".to_string(), "0".to_string()),
+                            e,
+                        )
+                    })
+                }
+            })
+    }
+
+    /// Control whether the kernel should collect information to calculate memory pressure for
+    /// control groups.
+    ///
+    /// Note: This will fail with `InvalidOperation` if the current congrol group is not the root
+    /// control group.
+    pub fn set_enable_memory_pressure(&self, b: bool) -> Result<()> {
+        if !self.path_exists("cpuset.memory_pressure_enabled") {
+            return Err(Error::new(InvalidOperation));
+        }
+        self.open_path("cpuset.memory_pressure_enabled", true)
+            .and_then(|mut file| {
+                if b {
+                    file.write_all(b"1").map_err(|e| {
+                        Error::with_cause(
+                            WriteFailed(
+                                "cpuset.memory_pressure_enabled".to_string(),
+                                "1".to_string(),
+                            ),
+                            e,
+                        )
+                    })
+                } else {
+                    file.write_all(b"0").map_err(|e| {
+                        Error::with_cause(
+                            WriteFailed(
+                                "cpuset.memory_pressure_enabled".to_string(),
+                                "0".to_string(),
+                            ),
+                            e,
+                        )
+                    })
+                }
+            })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::fs::cpuset;
+    #[test]
+    fn test_parse_range() {
+        let test_cases = vec![
+            "1,2,4-6,9".to_string(),
+            "".to_string(),
+            "1".to_string(),
+            "1-111".to_string(),
+            "1,2,3,4".to_string(),
+            "1-5,6-7,8-9".to_string(),
+        ];
+        let expecteds = [
+            vec![(1, 1), (2, 2), (4, 6), (9, 9)],
+            vec![],
+            vec![(1, 1)],
+            vec![(1, 111)],
+            vec![(1, 1), (2, 2), (3, 3), (4, 4)],
+            vec![(1, 5), (6, 7), (8, 9)],
+        ];
+
+        for (i, case) in test_cases.into_iter().enumerate() {
+            let range = cpuset::parse_range(case.clone());
+            println!("{:?} => {:?}", case, range);
+            assert!(range.is_ok());
+            assert_eq!(range.unwrap(), expecteds[i]);
+        }
+    }
+}

src/fs/devices.rs

@@ -0,0 +1,342 @@
+// Copyright (c) 2018 Levente Kurusa
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! This module contains the implementation of the `devices` cgroup subsystem.
+//!
+//! See the Kernel's documentation for more information about this subsystem, found at:
+//!  [Documentation/cgroup-v1/devices.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/devices.txt)
+use std::io::{Read, Write};
+use std::path::PathBuf;
+
+use log::*;
+
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
+
+use crate::fs::{
+    ControllIdentifier, ControllerInternal, Controllers, DeviceResource, DeviceResources,
+    Resources, Subsystem,
+};
+
+/// A controller that allows controlling the `devices` subsystem of a Cgroup.
+///
+/// In essence, using the devices controller, it is possible to allow or disallow sets of devices to
+/// be used by the control group's tasks.
+#[derive(Debug, Clone)]
+pub struct DevicesController {
+    base: PathBuf,
+    path: PathBuf,
+}
+
+/// An enum holding the different types of devices that can be manipulated using this controller.
+#[derive(Debug, Copy, Clone, PartialEq, Eq)]
+#[cfg_attr(
+    feature = "serde",
+    derive(serde::Serialize, serde::Deserialize),
+    serde(rename_all = "snake_case")
+)]
+pub enum DeviceType {
+    /// The rule applies to all devices.
+    All,
+    /// The rule only applies to character devices.
+    Char,
+    /// The rule only applies to block devices.
+    Block,
+}
+
+#[allow(clippy::derivable_impls)]
+impl Default for DeviceType {
+    fn default() -> Self {
+        DeviceType::All
+    }
+}
+
+impl DeviceType {
+    /// Convert a DeviceType into the character that the kernel recognizes.
+    #[allow(clippy::should_implement_trait, clippy::wrong_self_convention)]
+    pub fn to_char(&self) -> char {
+        match self {
+            DeviceType::All => 'a',
+            DeviceType::Char => 'c',
+            DeviceType::Block => 'b',
+        }
+    }
+
+    /// Convert the kenrel's representation into the DeviceType type.
+    pub fn from_char(c: Option<char>) -> Option<DeviceType> {
+        match c {
+            Some('a') => Some(DeviceType::All),
+            Some('c') => Some(DeviceType::Char),
+            Some('b') => Some(DeviceType::Block),
+            _ => None,
+        }
+    }
+}
+
+/// An enum with the permissions that can be allowed/denied to the control group.
+#[derive(Debug, Copy, Clone, PartialEq, Eq)]
+#[cfg_attr(
+    feature = "serde",
+    derive(serde::Serialize, serde::Deserialize),
+    serde(rename_all = "snake_case")
+)]
+pub enum DevicePermissions {
+    /// Permission to read from the device.
+    Read,
+    /// Permission to write to the device.
+    Write,
+    /// Permission to execute the `mknod(2)` system call with the device's major and minor numbers.
+    /// That is, the permission to create a special file that refers to the device node.
+    MkNod,
+}
+
+impl DevicePermissions {
+    /// Convert a DevicePermissions into the character that the kernel recognizes.
+    #[allow(clippy::should_implement_trait, clippy::wrong_self_convention)]
+    pub fn to_char(&self) -> char {
+        match self {
+            DevicePermissions::Read => 'r',
+            DevicePermissions::Write => 'w',
+            DevicePermissions::MkNod => 'm',
+        }
+    }
+
+    /// Convert a char to a DevicePermission if there is such a mapping.
+    pub fn from_char(c: char) -> Option<DevicePermissions> {
+        match c {
+            'r' => Some(DevicePermissions::Read),
+            'w' => Some(DevicePermissions::Write),
+            'm' => Some(DevicePermissions::MkNod),
+            _ => None,
+        }
+    }
+
+    /// Checks whether the string is a valid descriptor of DevicePermissions.
+    pub fn is_valid(s: &str) -> bool {
+        if s.is_empty() {
+            return false;
+        }
+        for i in s.chars() {
+            if i != 'r' && i != 'w' && i != 'm' {
+                return false;
+            }
+        }
+        true
+    }
+
+    /// Returns a Vec will all the permissions that a device can have.
+    pub fn all() -> Vec<DevicePermissions> {
+        vec![
+            DevicePermissions::Read,
+            DevicePermissions::Write,
+            DevicePermissions::MkNod,
+        ]
+    }
+
+    /// Convert a string into DevicePermissions.
+    #[allow(clippy::should_implement_trait)]
+    pub fn from_str(s: &str) -> Result<Vec<DevicePermissions>> {
+        let mut v = Vec::new();
+        if s.is_empty() {
+            return Ok(v);
+        }
+        for e in s.chars() {
+            let perm = DevicePermissions::from_char(e).ok_or_else(|| Error::new(ParseError))?;
+            v.push(perm);
+        }
+
+        Ok(v)
+    }
+}
+
+impl ControllerInternal for DevicesController {
+    fn control_type(&self) -> Controllers {
+        Controllers::Devices
+    }
+    fn get_path(&self) -> &PathBuf {
+        &self.path
+    }
+    fn get_path_mut(&mut self) -> &mut PathBuf {
+        &mut self.path
+    }
+    fn get_base(&self) -> &PathBuf {
+        &self.base
+    }
+
+    fn apply(&self, res: &Resources) -> Result<()> {
+        // get the resources that apply to this controller
+        let res: &DeviceResources = &res.devices;
+
+        for i in &res.devices {
+            if i.allow {
+                self.allow_device(i.devtype, i.major, i.minor, &i.access)?;
+            } else {
+                self.deny_device(i.devtype, i.major, i.minor, &i.access)?;
+            }
+        }
+
+        Ok(())
+    }
+}
+
+impl ControllIdentifier for DevicesController {
+    fn controller_type() -> Controllers {
+        Controllers::Devices
+    }
+}
+
+impl<'a> From<&'a Subsystem> for &'a DevicesController {
+    fn from(sub: &'a Subsystem) -> &'a DevicesController {
+        unsafe {
+            match sub {
+                Subsystem::Devices(c) => c,
+                _ => {
+                    assert_eq!(1, 0);
+                    let v = std::mem::MaybeUninit::uninit();
+                    v.assume_init()
+                }
+            }
+        }
+    }
+}
+
+impl DevicesController {
+    /// Constructs a new `DevicesController` with `root` serving as the root of the control group.
+    pub fn new(point: PathBuf, root: PathBuf) -> Self {
+        Self {
+            base: root,
+            path: point,
+        }
+    }
+
+    /// Allow a (possibly, set of) device(s) to be used by the tasks in the control group.
+    ///
+    /// When `-1` is passed as `major` or `minor`, the kernel interprets that value as "any",
+    /// meaning that it will match any device.
+    pub fn allow_device(
+        &self,
+        devtype: DeviceType,
+        major: i64,
+        minor: i64,
+        perm: &[DevicePermissions],
+    ) -> Result<()> {
+        let perms = perm
+            .iter()
+            .map(DevicePermissions::to_char)
+            .collect::<String>();
+        let minor = if minor == -1 {
+            "*".to_string()
+        } else {
+            format!("{}", minor)
+        };
+        let major = if major == -1 {
+            "*".to_string()
+        } else {
+            format!("{}", major)
+        };
+        let final_str = format!("{} {}:{} {}", devtype.to_char(), major, minor, perms);
+        self.open_path("devices.allow", true).and_then(|mut file| {
+            file.write_all(final_str.as_ref()).map_err(|e| {
+                Error::with_cause(
+                    WriteFailed(
+                        self.get_path().join("devices.allow").display().to_string(),
+                        final_str,
+                    ),
+                    e,
+                )
+            })
+        })
+    }
+
+    /// Deny the control group's tasks access to the devices covered by `dev`.
+    ///
+    /// When `-1` is passed as `major` or `minor`, the kernel interprets that value as "any",
+    /// meaning that it will match any device.
+    pub fn deny_device(
+        &self,
+        devtype: DeviceType,
+        major: i64,
+        minor: i64,
+        perm: &[DevicePermissions],
+    ) -> Result<()> {
+        let perms = perm
+            .iter()
+            .map(DevicePermissions::to_char)
+            .collect::<String>();
+        let minor = if minor == -1 {
+            "*".to_string()
+        } else {
+            format!("{}", minor)
+        };
+        let major = if major == -1 {
+            "*".to_string()
+        } else {
+            format!("{}", major)
+        };
+        let final_str = format!("{} {}:{} {}", devtype.to_char(), major, minor, perms);
+        self.open_path("devices.deny", true).and_then(|mut file| {
+            file.write_all(final_str.as_ref()).map_err(|e| {
+                Error::with_cause(
+                    WriteFailed(
+                        self.get_path().join("devices.deny").display().to_string(),
+                        final_str,
+                    ),
+                    e,
+                )
+            })
+        })
+    }
+
+    /// Get the current list of allowed devices.
+    pub fn allowed_devices(&self) -> Result<Vec<DeviceResource>> {
+        self.open_path("devices.list", false).and_then(|mut file| {
+            let mut s = String::new();
+            let res = file.read_to_string(&mut s);
+            match res {
+                Ok(_) => s
+                    .lines()
+                    .map(|line| parse_device_line(line, true))
+                    .collect(),
+                Err(e) => Err(Error::with_cause(ReadFailed("devices.list".to_string()), e)),
+            }
+        })
+    }
+}
+
+fn parse_device_number(s: &str) -> Result<i64> {
+    if s == "*" {
+        Ok(-1)
+    } else {
+        s.parse::<i64>().map_err(|_| Error::new(ParseError))
+    }
+}
+
+fn parse_device_line(line: &str, allow: bool) -> Result<DeviceResource> {
+    let parts: Vec<&str> = line.split([' ', ':']).collect();
+    if parts.len() != 4 {
+        error!("allowed_devices: invalid line format: {:?}", line);
+        return Err(Error::new(ParseError));
+    }
+
+    let devtype = DeviceType::from_char(parts[0].chars().next()).ok_or_else(|| {
+        error!("allowed_devices: invalid device type: {:?}", parts[0]);
+        Error::new(ParseError)
+    })?;
+    let major = parse_device_number(parts[1]).inspect_err(|_| {
+        error!("allowed_devices: invalid major number: {:?}", parts[1]);
+    })?;
+    let minor = parse_device_number(parts[2]).inspect_err(|_| {
+        error!("allowed_devices: invalid minor number: {:?}", parts[2]);
+    })?;
+    let access = DevicePermissions::from_str(parts[3])?;
+
+    Ok(DeviceResource {
+        allow,
+        devtype,
+        major,
+        minor,
+        access,
+    })
+}

src/fs/error.rs

@@ -0,0 +1,127 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use std::error::Error as StdError;
+use std::fmt;
+
+/// The different types of errors that can occur while manipulating control groups.
+#[derive(thiserror::Error, Debug, Eq, PartialEq)]
+pub enum ErrorKind {
+    #[error("fs error")]
+    FsError,
+
+    #[error("common error: {0}")]
+    Common(String),
+
+    /// An error occured while writing to a control group file.
+    #[error("unable to write to a control group file {0}, value {1}")]
+    WriteFailed(String, String),
+
+    /// An error occured while trying to read from a control group file.
+    #[error("unable to read a control group file {0}")]
+    ReadFailed(String),
+
+    /// An error occured while trying to remove a control group.
+    #[error("unable to remove a control group")]
+    RemoveFailed,
+
+    /// An error occured while trying to parse a value from a control group file.
+    ///
+    /// In the future, there will be some information attached to this field.
+    #[error("unable to parse control group file")]
+    ParseError,
+
+    /// You tried to do something invalid.
+    ///
+    /// This could be because you tried to set a value in a control group that is not a root
+    /// control group. Or, when using unified hierarchy, you tried to add a task in a leaf node.
+    #[error("the requested operation is invalid")]
+    InvalidOperation,
+
+    /// The path of the control group was invalid.
+    ///
+    /// This could be caused by trying to escape the control group filesystem via a string of "..".
+    /// This crate checks against this and operations will fail with this error.
+    #[error("the given path is invalid")]
+    InvalidPath,
+
+    #[error("invalid bytes size")]
+    InvalidBytesSize,
+
+    /// The specified controller is not in the list of supported controllers.
+    #[error("specified controller is not in the list of supported controllers")]
+    SpecifiedControllers,
+
+    /// Using method in wrong cgroup version.
+    #[error("using method in wrong cgroup version")]
+    CgroupVersion,
+
+    /// Using method in wrong cgroup mode.
+    #[error("using method in wrong cgroup mode.")]
+    CgroupMode,
+
+    /// Subsystems is empty.
+    #[error("subsystems is empty")]
+    SubsystemsEmpty,
+
+    /// An unknown error has occured.
+    #[error("an unknown error")]
+    Other,
+}
+
+#[derive(Debug)]
+pub struct Error {
+    kind: ErrorKind,
+    cause: Option<Box<dyn StdError + Send + Sync>>,
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        if let Some(cause) = &self.cause {
+            write!(f, "{} caused by: {:?}", &self.kind, cause)
+        } else {
+            write!(f, "{}", &self.kind)
+        }
+    }
+}
+
+impl StdError for Error {
+    fn source(&self) -> Option<&(dyn StdError + 'static)> {
+        #[allow(clippy::manual_map)]
+        match self.cause {
+            Some(ref x) => Some(&**x),
+            None => None,
+        }
+    }
+}
+
+impl Error {
+    pub(crate) fn from_string(s: String) -> Self {
+        Self {
+            kind: ErrorKind::Common(s),
+            cause: None,
+        }
+    }
+    pub(crate) fn new(kind: ErrorKind) -> Self {
+        Self { kind, cause: None }
+    }
+
+    pub(crate) fn with_cause<E>(kind: ErrorKind, cause: E) -> Self
+    where
+        E: 'static + Send + Sync + StdError,
+    {
+        Self {
+            kind,
+            cause: Some(Box::new(cause)),
+        }
+    }
+
+    pub fn kind(&self) -> &ErrorKind {
+        &self.kind
+    }
+}
+
+pub type Result<T> = ::std::result::Result<T, Error>;

src/fs/events.rs

@@ -0,0 +1,92 @@
+// Copyright (c) 2020 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use eventfd::{eventfd, EfdFlags};
+use nix::sys::eventfd;
+use std::fs::{self, File};
+use std::io::Read;
+use std::os::unix::io::{AsRawFd, FromRawFd};
+use std::path::Path;
+use std::sync::mpsc::{self, Receiver};
+use std::thread;
+
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
+
+// notify_on_oom returns channel on which you can expect event about OOM,
+// if process died without OOM this channel will be closed.
+pub fn notify_on_oom_v2(key: &str, dir: &Path) -> Result<Receiver<String>> {
+    register_memory_event(key, dir, "memory.oom_control", "")
+}
+
+// notify_on_oom returns channel on which you can expect event about OOM,
+// if process died without OOM this channel will be closed.
+pub fn notify_on_oom_v1(key: &str, dir: &Path) -> Result<Receiver<String>> {
+    register_memory_event(key, dir, "memory.oom_control", "")
+}
+
+// level is one of "low", "medium", or "critical"
+pub fn notify_memory_pressure(key: &str, dir: &Path, level: &str) -> Result<Receiver<String>> {
+    if level != "low" && level != "medium" && level != "critical" {
+        return Err(Error::from_string(format!(
+            "invalid pressure level {}",
+            level
+        )));
+    }
+
+    register_memory_event(key, dir, "memory.pressure_level", level)
+}
+
+fn register_memory_event(
+    key: &str,
+    cg_dir: &Path,
+    event_name: &str,
+    arg: &str,
+) -> Result<Receiver<String>> {
+    let path = cg_dir.join(event_name);
+    let event_file = File::open(path.clone())
+        .map_err(|e| Error::with_cause(ReadFailed(path.display().to_string()), e))?;
+
+    let eventfd = eventfd(0, EfdFlags::EFD_CLOEXEC)
+        .map_err(|e| Error::with_cause(ReadFailed("eventfd".to_string()), e))?;
+
+    let event_control_path = cg_dir.join("cgroup.event_control");
+    let data = if arg.is_empty() {
+        format!("{} {}", eventfd, event_file.as_raw_fd())
+    } else {
+        format!("{} {} {}", eventfd, event_file.as_raw_fd(), arg)
+    };
+
+    // write to file and set mode to 0700(FIXME)
+    fs::write(&event_control_path, data.clone()).map_err(|e| {
+        Error::with_cause(
+            WriteFailed(event_control_path.display().to_string(), data),
+            e,
+        )
+    })?;
+
+    let mut eventfd_file = unsafe { File::from_raw_fd(eventfd) };
+
+    let (sender, receiver) = mpsc::channel();
+    let key = key.to_string();
+
+    thread::spawn(move || {
+        loop {
+            let mut buf = [0; 8];
+            if eventfd_file.read(&mut buf).is_err() {
+                return;
+            }
+
+            // When a cgroup is destroyed, an event is sent to eventfd.
+            // So if the control path is gone, return instead of notifying.
+            if !Path::new(&event_control_path).exists() {
+                return;
+            }
+            sender.send(key.clone()).unwrap();
+        }
+    });
+
+    Ok(receiver)
+}

src/fs/freezer.rs

@@ -0,0 +1,134 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! This module contains the implementation of the `freezer` cgroup subsystem.
+//!
+//! See the Kernel's documentation for more information about this subsystem, found at:
+//!  [Documentation/cgroup-v1/freezer-subsystem.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/freezer-subsystem.txt)
+use std::io::{Read, Write};
+use std::path::PathBuf;
+
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
+use crate::fs::{ControllIdentifier, ControllerInternal, Controllers, Resources, Subsystem};
+use crate::FreezerState;
+
+/// A controller that allows controlling the `freezer` subsystem of a Cgroup.
+///
+/// In essence, this subsystem allows the user to freeze and thaw (== "un-freeze") the processes in
+/// the control group. This is done _transparently_ so that neither the parent, nor the children of
+/// the processes can observe the freeze.
+///
+/// Note that if the control group is currently in the `Frozen` or `Freezing` state, then no
+/// processes can be added to it.
+#[derive(Debug, Clone)]
+pub struct FreezerController {
+    base: PathBuf,
+    path: PathBuf,
+    v2: bool,
+}
+
+impl ControllerInternal for FreezerController {
+    fn control_type(&self) -> Controllers {
+        Controllers::Freezer
+    }
+    fn get_path(&self) -> &PathBuf {
+        &self.path
+    }
+    fn get_path_mut(&mut self) -> &mut PathBuf {
+        &mut self.path
+    }
+    fn get_base(&self) -> &PathBuf {
+        &self.base
+    }
+
+    fn apply(&self, _res: &Resources) -> Result<()> {
+        Ok(())
+    }
+}
+
+impl ControllIdentifier for FreezerController {
+    fn controller_type() -> Controllers {
+        Controllers::Freezer
+    }
+}
+
+impl<'a> From<&'a Subsystem> for &'a FreezerController {
+    fn from(sub: &'a Subsystem) -> &'a FreezerController {
+        unsafe {
+            match sub {
+                Subsystem::Freezer(c) => c,
+                _ => {
+                    assert_eq!(1, 0);
+                    let v = std::mem::MaybeUninit::uninit();
+                    v.assume_init()
+                }
+            }
+        }
+    }
+}
+
+impl FreezerController {
+    /// Contructs a new `FreezerController` with `root` serving as the root of the control group.
+    pub fn new(point: PathBuf, root: PathBuf, v2: bool) -> Self {
+        Self {
+            base: root,
+            path: point,
+            v2,
+        }
+    }
+    /// Freezes the processes in the control group.
+    pub fn freeze(&self) -> Result<()> {
+        let mut file_name = "freezer.state";
+        let mut content = "FROZEN".to_string();
+        if self.v2 {
+            file_name = "cgroup.freeze";
+            content = "1".to_string();
+        }
+
+        self.open_path(file_name, true).and_then(|mut file| {
+            file.write_all(content.as_ref())
+                .map_err(|e| Error::with_cause(WriteFailed(file_name.to_string(), content), e))
+        })
+    }
+
+    /// Thaws, that is, unfreezes the processes in the control group.
+    pub fn thaw(&self) -> Result<()> {
+        let mut file_name = "freezer.state";
+        let mut content = "THAWED".to_string();
+        if self.v2 {
+            file_name = "cgroup.freeze";
+            content = "0".to_string();
+        }
+        self.open_path(file_name, true).and_then(|mut file| {
+            file.write_all(content.as_ref())
+                .map_err(|e| Error::with_cause(WriteFailed(file_name.to_string(), content), e))
+        })
+    }
+
+    /// Retrieve the state of processes in the control group.
+    pub fn state(&self) -> Result<FreezerState> {
+        let mut file_name = "freezer.state";
+        if self.v2 {
+            file_name = "cgroup.freeze";
+        }
+        self.open_path(file_name, false).and_then(|mut file| {
+            let mut s = String::new();
+            let res = file.read_to_string(&mut s);
+            match res {
+                Ok(_) => match s.trim() {
+                    "FROZEN" => Ok(FreezerState::Frozen),
+                    "THAWED" => Ok(FreezerState::Thawed),
+                    "1" => Ok(FreezerState::Frozen),
+                    "0" => Ok(FreezerState::Thawed),
+                    "FREEZING" => Ok(FreezerState::Freezing),
+                    _ => Err(Error::new(ParseError)),
+                },
+                Err(e) => Err(Error::with_cause(ReadFailed(file_name.to_string()), e)),
+            }
+        })
+    }
+}

src/fs/hierarchies.rs

@@ -0,0 +1,392 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! This module represents the various control group hierarchies the Linux kernel supports.
+
+use std::fs;
+use std::fs::File;
+use std::io::{BufRead, BufReader};
+use std::path::{Path, PathBuf};
+
+use crate::fs::blkio::BlkIoController;
+use crate::fs::cpu::CpuController;
+use crate::fs::cpuacct::CpuAcctController;
+use crate::fs::cpuset::CpuSetController;
+use crate::fs::devices::DevicesController;
+use crate::fs::freezer::FreezerController;
+use crate::fs::hugetlb::HugeTlbController;
+use crate::fs::memory::MemController;
+use crate::fs::net_cls::NetClsController;
+use crate::fs::net_prio::NetPrioController;
+use crate::fs::perf_event::PerfEventController;
+use crate::fs::pid::PidController;
+use crate::fs::rdma::RdmaController;
+use crate::fs::systemd::SystemdController;
+use crate::fs::{Controllers, Hierarchy, Subsystem};
+
+use crate::fs::cgroup::Cgroup;
+
+/// Process mounts information.
+///
+/// See `proc(5)` for format details.
+#[derive(Debug, PartialEq, Eq, Hash, Clone)]
+pub struct Mountinfo {
+    /// Mount root directory of the file system.
+    pub mount_root: PathBuf,
+    /// Mount pathname relative to the process's root.
+    pub mount_point: PathBuf,
+    /// Filesystem type (main type with optional sub-type).
+    pub fs_type: (String, Option<String>),
+    /// Superblock options.
+    pub super_opts: Vec<String>,
+}
+
+pub(crate) fn parse_mountinfo_for_line(line: &str) -> Option<Mountinfo> {
+    let s_values: Vec<_> = line.split(" - ").collect();
+    if s_values.len() != 2 {
+        return None;
+    }
+
+    let s0_values: Vec<_> = s_values[0].trim().split(' ').collect();
+    let s1_values: Vec<_> = s_values[1].trim().split(' ').collect();
+    if s0_values.len() < 6 || s1_values.len() < 3 {
+        return None;
+    }
+    let mount_point = PathBuf::from(s0_values[4]);
+    let mount_root = PathBuf::from(s0_values[3]);
+    let fs_type_values: Vec<_> = s1_values[0].trim().split('.').collect();
+    let fs_type = match fs_type_values.len() {
+        1 => (fs_type_values[0].to_string(), None),
+        2 => (
+            fs_type_values[0].to_string(),
+            Some(fs_type_values[1].to_string()),
+        ),
+        _ => return None,
+    };
+
+    let super_opts: Vec<String> = s1_values[2].trim().split(',').map(String::from).collect();
+    Some(Mountinfo {
+        mount_root,
+        mount_point,
+        fs_type,
+        super_opts,
+    })
+}
+
+/// Parses the provided mountinfo file.
+fn mountinfo_file(file: &mut File) -> Vec<Mountinfo> {
+    let mut r = Vec::new();
+    for line in BufReader::new(file).lines() {
+        match line {
+            Ok(line) => {
+                if let Some(mi) = parse_mountinfo_for_line(&line) {
+                    if mi.fs_type.0 == "cgroup" {
+                        r.push(mi);
+                    }
+                }
+            }
+            Err(_) => break,
+        }
+    }
+    r
+}
+
+/// Returns mounts information for the current process.
+pub fn mountinfo_self() -> Vec<Mountinfo> {
+    match File::open("/proc/self/mountinfo") {
+        Ok(mut file) => mountinfo_file(&mut file),
+        Err(_) => vec![],
+    }
+}
+
+/// The standard, original cgroup implementation. Often referred to as "cgroupv1".
+#[derive(Debug, Clone)]
+pub struct V1 {
+    mountinfo: Vec<Mountinfo>,
+}
+
+#[derive(Debug, Clone)]
+pub struct V2 {
+    root: String,
+}
+
+impl Hierarchy for V1 {
+    fn v2(&self) -> bool {
+        false
+    }
+
+    fn subsystems(&self) -> Vec<Subsystem> {
+        let mut subs = vec![];
+
+        // The cgroup writeback feature requires cooperation between memcgs and blkcgs
+        // To avoid exceptions, we should add_task for blkcg before memcg(push BlkIo before Mem)
+        // For more Information: https://www.alibabacloud.com/help/doc-detail/155509.htm
+        if let Some((point, root)) = self.get_mount_point(Controllers::BlkIo) {
+            subs.push(Subsystem::BlkIo(BlkIoController::new(point, root, false)));
+        }
+        if let Some((point, root)) = self.get_mount_point(Controllers::Mem) {
+            subs.push(Subsystem::Mem(MemController::new(point, root, false)));
+        }
+        if let Some((point, root)) = self.get_mount_point(Controllers::Pids) {
+            subs.push(Subsystem::Pid(PidController::new(point, root, false)));
+        }
+        if let Some((point, root)) = self.get_mount_point(Controllers::CpuSet) {
+            subs.push(Subsystem::CpuSet(CpuSetController::new(point, root, false)));
+        }
+        if let Some((point, root)) = self.get_mount_point(Controllers::CpuAcct) {
+            subs.push(Subsystem::CpuAcct(CpuAcctController::new(point, root)));
+        }
+        if let Some((point, root)) = self.get_mount_point(Controllers::Cpu) {
+            subs.push(Subsystem::Cpu(CpuController::new(point, root, false)));
+        }
+        if let Some((point, root)) = self.get_mount_point(Controllers::Devices) {
+            subs.push(Subsystem::Devices(DevicesController::new(point, root)));
+        }
+        if let Some((point, root)) = self.get_mount_point(Controllers::Freezer) {
+            subs.push(Subsystem::Freezer(FreezerController::new(
+                point, root, false,
+            )));
+        }
+        if let Some((point, root)) = self.get_mount_point(Controllers::NetCls) {
+            subs.push(Subsystem::NetCls(NetClsController::new(point, root)));
+        }
+        if let Some((point, root)) = self.get_mount_point(Controllers::PerfEvent) {
+            subs.push(Subsystem::PerfEvent(PerfEventController::new(point, root)));
+        }
+        if let Some((point, root)) = self.get_mount_point(Controllers::NetPrio) {
+            subs.push(Subsystem::NetPrio(NetPrioController::new(point, root)));
+        }
+        if let Some((point, root)) = self.get_mount_point(Controllers::HugeTlb) {
+            subs.push(Subsystem::HugeTlb(HugeTlbController::new(
+                point, root, false,
+            )));
+        }
+        if let Some((point, root)) = self.get_mount_point(Controllers::Rdma) {
+            subs.push(Subsystem::Rdma(RdmaController::new(point, root)));
+        }
+        if let Some((point, root)) = self.get_mount_point(Controllers::Systemd) {
+            subs.push(Subsystem::Systemd(SystemdController::new(
+                point, root, false,
+            )));
+        }
+
+        subs
+    }
+
+    fn root_control_group(&self) -> Cgroup {
+        Cgroup::load(auto(), "")
+    }
+
+    fn parent_control_group(&self, path: &str) -> Cgroup {
+        let path = Path::new(path);
+        let parent_path = path.parent().unwrap().to_string_lossy().to_string();
+        Cgroup::load(auto(), parent_path)
+    }
+
+    fn root(&self) -> PathBuf {
+        self.mountinfo
+            .iter()
+            .find_map(|m| {
+                if m.fs_type.0 == "cgroup" {
+                    return Some(m.mount_point.parent().unwrap());
+                }
+                None
+            })
+            .unwrap()
+            .to_path_buf()
+    }
+}
+
+impl Hierarchy for V2 {
+    fn v2(&self) -> bool {
+        true
+    }
+
+    fn subsystems(&self) -> Vec<Subsystem> {
+        let p = format!("{}/{}", UNIFIED_MOUNTPOINT, "cgroup.controllers");
+        let ret = fs::read_to_string(p.as_str());
+        if ret.is_err() {
+            return vec![];
+        }
+
+        let mut subs = vec![];
+
+        let controllers = ret.unwrap().trim().to_string();
+        let mut controller_list: Vec<&str> = controllers.split(' ').collect();
+
+        // The freezer functionality is present in V2, but not as a controller,
+        // but apparently as a core functionality. FreezerController supports
+        // that, but we must explicitly fake the controller here.
+        controller_list.push("freezer");
+
+        for s in controller_list {
+            match s {
+                "cpu" => {
+                    subs.push(Subsystem::Cpu(CpuController::new(
+                        self.root(),
+                        PathBuf::from(""),
+                        true,
+                    )));
+                }
+                "io" => {
+                    subs.push(Subsystem::BlkIo(BlkIoController::new(
+                        self.root(),
+                        PathBuf::from(""),
+                        true,
+                    )));
+                }
+                "cpuset" => {
+                    subs.push(Subsystem::CpuSet(CpuSetController::new(
+                        self.root(),
+                        PathBuf::from(""),
+                        true,
+                    )));
+                }
+                "memory" => {
+                    subs.push(Subsystem::Mem(MemController::new(
+                        self.root(),
+                        PathBuf::from(""),
+                        true,
+                    )));
+                }
+                "pids" => {
+                    subs.push(Subsystem::Pid(PidController::new(
+                        self.root(),
+                        PathBuf::from(""),
+                        true,
+                    )));
+                }
+                "freezer" => {
+                    subs.push(Subsystem::Freezer(FreezerController::new(
+                        self.root(),
+                        PathBuf::from(""),
+                        true,
+                    )));
+                }
+                "hugetlb" => {
+                    subs.push(Subsystem::HugeTlb(HugeTlbController::new(
+                        self.root(),
+                        PathBuf::from(""),
+                        true,
+                    )));
+                }
+                _ => {}
+            }
+        }
+
+        subs
+    }
+
+    fn root_control_group(&self) -> Cgroup {
+        Cgroup::load(auto(), "")
+    }
+
+    fn parent_control_group(&self, path: &str) -> Cgroup {
+        let path = Path::new(path);
+        let parent_path = path.parent().unwrap().to_string_lossy().to_string();
+        Cgroup::load(auto(), parent_path)
+    }
+
+    fn root(&self) -> PathBuf {
+        PathBuf::from(self.root.clone())
+    }
+}
+
+impl V1 {
+    /// Finds where control groups are mounted to and returns a hierarchy in which control groups
+    /// can be created.
+    pub fn new() -> V1 {
+        V1 {
+            mountinfo: mountinfo_self(),
+        }
+    }
+
+    pub fn get_mount_point(&self, controller: Controllers) -> Option<(PathBuf, PathBuf)> {
+        self.mountinfo.iter().find_map(|m| {
+            if m.fs_type.0 == "cgroup" && m.super_opts.contains(&controller.to_string()) {
+                return Some((m.mount_point.to_owned(), m.mount_root.to_owned()));
+            }
+            None
+        })
+    }
+}
+
+impl Default for V1 {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl V2 {
+    /// Finds where control groups are mounted to and returns a hierarchy in which control groups
+    /// can be created.
+    pub fn new() -> V2 {
+        V2 {
+            root: String::from(UNIFIED_MOUNTPOINT),
+        }
+    }
+}
+
+impl Default for V2 {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+pub const UNIFIED_MOUNTPOINT: &str = "/sys/fs/cgroup";
+
+pub fn is_cgroup2_unified_mode() -> bool {
+    use nix::sys::statfs;
+
+    let path = std::path::Path::new(UNIFIED_MOUNTPOINT);
+    let fs_stat = match statfs::statfs(path) {
+        Ok(fs_stat) => fs_stat,
+        Err(_) => return false,
+    };
+
+    fs_stat.filesystem_type() == statfs::CGROUP2_SUPER_MAGIC
+}
+
+pub fn auto() -> Box<dyn Hierarchy> {
+    if is_cgroup2_unified_mode() {
+        Box::new(V2::new())
+    } else {
+        Box::new(V1::new())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_parse_mount() {
+        let mountinfo = vec![
+            ("29 26 0:26 / /sys/fs/cgroup/cpuset,cpu,cpuacct rw,nosuid,nodev,noexec,relatime shared:10 - cgroup cgroup rw,cpuset,cpu,cpuacct",
+             Mountinfo{mount_root: PathBuf::from("/"), mount_point: PathBuf::from("/sys/fs/cgroup/cpuset,cpu,cpuacct"), fs_type: ("cgroup".to_string(), None), super_opts: vec![
+                "rw".to_string(),
+                "cpuset".to_string(),
+                "cpu".to_string(),
+                "cpuacct".to_string(),
+             ]}),
+            ("121 1731 0:42 / /shm rw,nosuid,nodev,noexec,relatime shared:68 master:66 - tmpfs shm rw,size=65536k",
+             Mountinfo{mount_root: PathBuf::from("/"), mount_point: PathBuf::from("/shm"), fs_type: ("tmpfs".to_string(), None), super_opts: vec![
+                "rw".to_string(),
+                "size=65536k".to_string(),
+             ]}),
+            ("121 1731 0:42 / /shm rw,nosuid,nodev,noexec,relatime shared:68 master:66 - tmpfs.123 shm rw,size=65536k",
+             Mountinfo{mount_root: PathBuf::from("/"), mount_point: PathBuf::from("/shm"), fs_type: ("tmpfs".to_string(), Some("123".to_string())), super_opts: vec![
+                "rw".to_string(),
+                "size=65536k".to_string(),
+             ]}),
+        ];
+
+        for mi in mountinfo {
+            let info = parse_mountinfo_for_line(mi.0).unwrap();
+            assert_eq!(info, mi.1)
+        }
+    }
+}

src/fs/hugetlb.rs

@@ -0,0 +1,372 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! This module contains the implementation of the `hugetlb` cgroup subsystem.
+//!
+//! See the Kernel's documentation for more information about this subsystem, found at:
+//!  [Documentation/cgroup-v1/hugetlb.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/hugetlb.txt)
+use log::warn;
+use std::io::Write;
+use std::path::PathBuf;
+
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
+use crate::fs::{flat_keyed_to_vec, read_u64_from};
+
+use crate::fs::{
+    ControllIdentifier, ControllerInternal, Controllers, HugePageResources, Resources, Subsystem,
+};
+
+/// A controller that allows controlling the `hugetlb` subsystem of a Cgroup.
+///
+/// In essence, using this controller it is possible to limit the use of hugepages in the tasks of
+/// the control group.
+#[derive(Debug, Clone)]
+pub struct HugeTlbController {
+    base: PathBuf,
+    path: PathBuf,
+    sizes: Vec<String>,
+    v2: bool,
+}
+
+impl ControllerInternal for HugeTlbController {
+    fn control_type(&self) -> Controllers {
+        Controllers::HugeTlb
+    }
+    fn get_path(&self) -> &PathBuf {
+        &self.path
+    }
+    fn get_path_mut(&mut self) -> &mut PathBuf {
+        &mut self.path
+    }
+    fn get_base(&self) -> &PathBuf {
+        &self.base
+    }
+
+    fn is_v2(&self) -> bool {
+        self.v2
+    }
+
+    fn apply(&self, res: &Resources) -> Result<()> {
+        // get the resources that apply to this controller
+        let res: &HugePageResources = &res.hugepages;
+
+        for i in &res.limits {
+            let _ = self.set_limit_in_bytes(&i.size, i.limit);
+            if self.limit_in_bytes(&i.size)? != i.limit {
+                return Err(Error::new(Other));
+            }
+        }
+
+        Ok(())
+    }
+}
+
+impl ControllIdentifier for HugeTlbController {
+    fn controller_type() -> Controllers {
+        Controllers::HugeTlb
+    }
+}
+
+impl<'a> From<&'a Subsystem> for &'a HugeTlbController {
+    fn from(sub: &'a Subsystem) -> &'a HugeTlbController {
+        unsafe {
+            match sub {
+                Subsystem::HugeTlb(c) => c,
+                _ => {
+                    assert_eq!(1, 0);
+                    let v = std::mem::MaybeUninit::uninit();
+                    v.assume_init()
+                }
+            }
+        }
+    }
+}
+
+impl HugeTlbController {
+    /// Constructs a new `HugeTlbController` with `root` serving as the root of the control group.
+    pub fn new(point: PathBuf, root: PathBuf, v2: bool) -> Self {
+        let sizes = get_hugepage_sizes();
+        Self {
+            base: root,
+            path: point,
+            sizes,
+            v2,
+        }
+    }
+
+    /// Whether the system supports `hugetlb_size` hugepages.
+    pub fn size_supported(&self, hugetlb_size: &str) -> bool {
+        for s in &self.sizes {
+            if s == hugetlb_size {
+                return true;
+            }
+        }
+        false
+    }
+
+    pub fn get_sizes(&self) -> Vec<String> {
+        self.sizes.clone()
+    }
+
+    fn failcnt_v2(&self, hugetlb_size: &str) -> Result<u64> {
+        self.open_path(&format!("hugetlb.{}.events", hugetlb_size), false)
+            .and_then(flat_keyed_to_vec)
+            .and_then(|x| {
+                if x.is_empty() {
+                    return Err(Error::from_string(format!(
+                        "get empty from hugetlb.{}.events",
+                        hugetlb_size
+                    )));
+                }
+                Ok(x[0].1 as u64)
+            })
+    }
+
+    /// Check how many times has the limit of `hugetlb_size` hugepages been hit.
+    pub fn failcnt(&self, hugetlb_size: &str) -> Result<u64> {
+        if self.v2 {
+            return self.failcnt_v2(hugetlb_size);
+        }
+        self.open_path(&format!("hugetlb.{}.failcnt", hugetlb_size), false)
+            .and_then(read_u64_from)
+    }
+
+    /// Get the limit (in bytes) of how much memory can be backed by hugepages of a certain size
+    /// (`hugetlb_size`).
+    pub fn limit_in_bytes(&self, hugetlb_size: &str) -> Result<u64> {
+        let mut file_name = format!("hugetlb.{}.limit_in_bytes", hugetlb_size);
+        if self.v2 {
+            file_name = format!("hugetlb.{}.max", hugetlb_size);
+        }
+        self.open_path(&file_name, false).and_then(read_u64_from)
+    }
+
+    /// Get the current usage of memory that is backed by hugepages of a certain size
+    /// (`hugetlb_size`).
+    pub fn usage_in_bytes(&self, hugetlb_size: &str) -> Result<u64> {
+        let mut file = format!("hugetlb.{}.usage_in_bytes", hugetlb_size);
+        if self.v2 {
+            file = format!("hugetlb.{}.current", hugetlb_size);
+        }
+        self.open_path(&file, false).and_then(read_u64_from)
+    }
+
+    /// Get the maximum observed usage of memory that is backed by hugepages of a certain size
+    /// (`hugetlb_size`).
+    pub fn max_usage_in_bytes(&self, hugetlb_size: &str) -> Result<u64> {
+        self.open_path(
+            &format!("hugetlb.{}.max_usage_in_bytes", hugetlb_size),
+            false,
+        )
+        .and_then(read_u64_from)
+    }
+
+    /// Set the limit (in bytes) of how much memory can be backed by hugepages of a certain size
+    /// (`hugetlb_size`).
+    pub fn set_limit_in_bytes(&self, hugetlb_size: &str, limit: u64) -> Result<()> {
+        let mut file_name = format!("hugetlb.{}.limit_in_bytes", hugetlb_size);
+        if self.v2 {
+            file_name = format!("hugetlb.{}.max", hugetlb_size);
+        }
+        self.open_path(&file_name, true).and_then(|mut file| {
+            file.write_all(limit.to_string().as_ref()).map_err(|e| {
+                Error::with_cause(WriteFailed(file_name.to_string(), limit.to_string()), e)
+            })
+        })
+    }
+}
+
+pub const HUGEPAGESIZE_DIR: &str = "/sys/kernel/mm/hugepages";
+use std::collections::HashMap;
+use std::fs;
+
+fn get_hugepage_sizes() -> Vec<String> {
+    let dirs = fs::read_dir(HUGEPAGESIZE_DIR);
+    if dirs.is_err() {
+        return Vec::new();
+    }
+
+    dirs.unwrap()
+        .filter_map(|e| {
+            let entry = e.map_err(|e| warn!("readdir error: {:?}", e)).ok()?;
+            let name = entry.file_name().into_string().unwrap();
+            let parts: Vec<&str> = name.split('-').collect();
+            if parts.len() != 2 {
+                return None;
+            }
+            let bmap = get_binary_size_map();
+            let size = parse_size(parts[1], &bmap)
+                .map_err(|e| warn!("parse_size error: {:?}", e))
+                .ok()?;
+            let dabbrs = get_decimal_abbrs();
+
+            Some(custom_size(size as f64, 1024.0, &dabbrs))
+        })
+        .collect()
+}
+
+pub const KB: u128 = 1000;
+pub const MB: u128 = 1000 * KB;
+pub const GB: u128 = 1000 * MB;
+pub const TB: u128 = 1000 * GB;
+pub const PB: u128 = 1000 * TB;
+
+#[allow(non_upper_case_globals)]
+pub const KiB: u128 = 1024;
+#[allow(non_upper_case_globals)]
+pub const MiB: u128 = 1024 * KiB;
+#[allow(non_upper_case_globals)]
+pub const GiB: u128 = 1024 * MiB;
+#[allow(non_upper_case_globals)]
+pub const TiB: u128 = 1024 * GiB;
+#[allow(non_upper_case_globals)]
+pub const PiB: u128 = 1024 * TiB;
+
+pub fn get_binary_size_map() -> HashMap<String, u128> {
+    let mut m = HashMap::new();
+    m.insert("k".to_string(), KiB);
+    m.insert("m".to_string(), MiB);
+    m.insert("g".to_string(), GiB);
+    m.insert("t".to_string(), TiB);
+    m.insert("p".to_string(), PiB);
+    m
+}
+
+pub fn get_decimal_size_map() -> HashMap<String, u128> {
+    let mut m = HashMap::new();
+    m.insert("k".to_string(), KB);
+    m.insert("m".to_string(), MB);
+    m.insert("g".to_string(), GB);
+    m.insert("t".to_string(), TB);
+    m.insert("p".to_string(), PB);
+    m
+}
+
+pub fn get_decimal_abbrs() -> Vec<String> {
+    let m = vec![
+        "B".to_string(),
+        "KB".to_string(),
+        "MB".to_string(),
+        "GB".to_string(),
+        "TB".to_string(),
+        "PB".to_string(),
+        "EB".to_string(),
+        "ZB".to_string(),
+        "YB".to_string(),
+    ];
+    m
+}
+
+fn parse_size(s: &str, m: &HashMap<String, u128>) -> Result<u128> {
+    // Remove leading/trailing whitespace.
+    let s = s.trim();
+
+    // Remove an optional trailing 'b' or 'B'
+    let s = if let Some(stripped) = s.strip_suffix('b').or_else(|| s.strip_suffix('B')) {
+        stripped
+    } else {
+        s
+    };
+
+    // Ensure that the string is not empty after stripping.
+    if s.is_empty() {
+        return Err(Error::new(InvalidBytesSize));
+    }
+
+    // The last character should be the multiplier letter.
+    let last_char = s.chars().last().unwrap();
+    if !"kKmMgGtTpP".contains(last_char) {
+        return Err(Error::new(InvalidBytesSize));
+    }
+
+    // The numeric part is everything before the multiplier letter.
+    let num_part = &s[..s.len() - last_char.len_utf8()];
+    if num_part.trim().is_empty() {
+        return Err(Error::new(InvalidBytesSize));
+    }
+
+    // Parse the numeric part into a u128.
+    let number: u128 = num_part
+        .trim()
+        .parse()
+        .map_err(|_| Error::new(InvalidBytesSize))?;
+
+    // Look up the multiplier in the provided HashMap.
+    let multiplier_key = last_char.to_string();
+    let multiplier = m
+        .get(&multiplier_key)
+        .ok_or_else(|| Error::new(InvalidBytesSize))?;
+
+    Ok(number * multiplier)
+}
+
+fn custom_size(mut size: f64, base: f64, m: &[String]) -> String {
+    let mut i = 0;
+    while size >= base && i < m.len() - 1 {
+        size /= base;
+        i += 1;
+    }
+
+    format!("{}{}", size, m[i].as_str())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_binary_size_valid() {
+        let m = get_binary_size_map();
+        // Valid inputs must include a multiplier letter.
+        assert_eq!(parse_size("1k", &m).unwrap(), KiB);
+        assert_eq!(parse_size("2m", &m).unwrap(), 2 * MiB);
+        assert_eq!(parse_size("3g", &m).unwrap(), 3 * GiB);
+        assert_eq!(parse_size("4t", &m).unwrap(), 4 * TiB);
+        assert_eq!(parse_size("5p", &m).unwrap(), 5 * PiB);
+    }
+
+    #[test]
+    fn test_decimal_size_valid() {
+        let m = get_decimal_size_map();
+        assert_eq!(parse_size("1k", &m).unwrap(), KB);
+        assert_eq!(parse_size("2m", &m).unwrap(), 2 * MB);
+        assert_eq!(parse_size("3g", &m).unwrap(), 3 * GB);
+        assert_eq!(parse_size("4t", &m).unwrap(), 4 * TB);
+        assert_eq!(parse_size("5p", &m).unwrap(), 5 * PB);
+    }
+
+    #[test]
+    fn test_trailing_b_suffix() {
+        let m = get_binary_size_map();
+        // Trailing 'b' or 'B' should be accepted.
+        assert_eq!(parse_size("1kb", &m).unwrap(), KiB);
+        assert_eq!(parse_size("2mB", &m).unwrap(), 2 * MiB);
+    }
+
+    #[test]
+    fn test_invalid_inputs() {
+        let m = get_binary_size_map();
+        // Missing multiplier letter results in error.
+        assert!(parse_size("1", &m).is_err());
+        // Invalid multiplier letter.
+        assert!(parse_size("10x", &m).is_err());
+        // Non-numeric input.
+        assert!(parse_size("abc", &m).is_err());
+        // Only multiplier letter with no number.
+        assert!(parse_size("k", &m).is_err());
+        // Number with an invalid trailing character.
+        assert!(parse_size("123z", &m).is_err());
+    }
+
+    #[test]
+    fn test_uppercase_multiplier_fails() {
+        let m = get_binary_size_map();
+        // Although the regex matches uppercase letters, the provided map only contains lowercase keys.
+        // Therefore, "1K" does not match any key and should produce an error.
+        assert!(parse_size("1K", &m).is_err());
+    }
+}

src/fs/mod.rs

@@ -0,0 +1,995 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+#![allow(clippy::unnecessary_unwrap)]
+
+use std::collections::HashMap;
+use std::fmt;
+use std::fs::{self, File};
+use std::io::{BufRead, BufReader, Read, Write};
+use std::path::{Path, PathBuf};
+use std::str::FromStr;
+
+macro_rules! update_and_test {
+    ($self: ident, $set_func:ident, $value:expr, $get_func:ident) => {
+        if let Some(v) = $value {
+            $self.$set_func(v)?;
+            if $self.$get_func()? != v {
+                return Err(Error::new(Other));
+            }
+        }
+    };
+}
+
+macro_rules! update {
+    ($self: ident, $set_func:ident, $value:expr) => {
+        if let Some(v) = $value {
+            let _ = $self.$set_func(v);
+        }
+    };
+}
+
+pub mod blkio;
+pub mod cgroup;
+pub mod cgroup_builder;
+pub mod cpu;
+pub mod cpuacct;
+pub mod cpuset;
+pub mod devices;
+pub mod error;
+pub mod events;
+pub mod freezer;
+pub mod hierarchies;
+pub mod hugetlb;
+pub mod memory;
+pub mod net_cls;
+pub mod net_prio;
+pub mod perf_event;
+pub mod pid;
+pub mod rdma;
+pub mod systemd;
+
+use crate::fs::blkio::BlkIoController;
+use crate::fs::cpu::CpuController;
+use crate::fs::cpuacct::CpuAcctController;
+use crate::fs::cpuset::CpuSetController;
+use crate::fs::devices::DevicesController;
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
+use crate::fs::freezer::FreezerController;
+use crate::fs::hugetlb::HugeTlbController;
+use crate::fs::memory::MemController;
+use crate::fs::net_cls::NetClsController;
+use crate::fs::net_prio::NetPrioController;
+use crate::fs::perf_event::PerfEventController;
+use crate::fs::pid::PidController;
+use crate::fs::rdma::RdmaController;
+use crate::fs::systemd::SystemdController;
+
+#[doc(inline)]
+pub use crate::fs::cgroup::Cgroup;
+
+/// Contains all the subsystems that are available in this crate.
+#[derive(Debug, Clone)]
+pub enum Subsystem {
+    /// Controller for the `Pid` subsystem, see `PidController` for more information.
+    Pid(PidController),
+    /// Controller for the `Mem` subsystem, see `MemController` for more information.
+    Mem(MemController),
+    /// Controller for the `CpuSet subsystem, see `CpuSetController` for more information.
+    CpuSet(CpuSetController),
+    /// Controller for the `CpuAcct` subsystem, see `CpuAcctController` for more information.
+    CpuAcct(CpuAcctController),
+    /// Controller for the `Cpu` subsystem, see `CpuController` for more information.
+    Cpu(CpuController),
+    /// Controller for the `Devices` subsystem, see `DevicesController` for more information.
+    Devices(DevicesController),
+    /// Controller for the `Freezer` subsystem, see `FreezerController` for more information.
+    Freezer(FreezerController),
+    /// Controller for the `NetCls` subsystem, see `NetClsController` for more information.
+    NetCls(NetClsController),
+    /// Controller for the `BlkIo` subsystem, see `BlkIoController` for more information.
+    BlkIo(BlkIoController),
+    /// Controller for the `PerfEvent` subsystem, see `PerfEventController` for more information.
+    PerfEvent(PerfEventController),
+    /// Controller for the `NetPrio` subsystem, see `NetPrioController` for more information.
+    NetPrio(NetPrioController),
+    /// Controller for the `HugeTlb` subsystem, see `HugeTlbController` for more information.
+    HugeTlb(HugeTlbController),
+    /// Controller for the `Rdma` subsystem, see `RdmaController` for more information.
+    Rdma(RdmaController),
+    /// Controller for the `Systemd` subsystem, see `SystemdController` for more information.
+    Systemd(SystemdController),
+}
+
+#[doc(hidden)]
+#[derive(Eq, PartialEq, Debug, Clone)]
+pub enum Controllers {
+    Pids,
+    Mem,
+    CpuSet,
+    CpuAcct,
+    Cpu,
+    Devices,
+    Freezer,
+    NetCls,
+    BlkIo,
+    PerfEvent,
+    NetPrio,
+    HugeTlb,
+    Rdma,
+    Systemd,
+}
+
+impl fmt::Display for Controllers {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Controllers::Pids => write!(f, "pids"),
+            Controllers::Mem => write!(f, "memory"),
+            Controllers::CpuSet => write!(f, "cpuset"),
+            Controllers::CpuAcct => write!(f, "cpuacct"),
+            Controllers::Cpu => write!(f, "cpu"),
+            Controllers::Devices => write!(f, "devices"),
+            Controllers::Freezer => write!(f, "freezer"),
+            Controllers::NetCls => write!(f, "net_cls"),
+            Controllers::BlkIo => write!(f, "blkio"),
+            Controllers::PerfEvent => write!(f, "perf_event"),
+            Controllers::NetPrio => write!(f, "net_prio"),
+            Controllers::HugeTlb => write!(f, "hugetlb"),
+            Controllers::Rdma => write!(f, "rdma"),
+            Controllers::Systemd => write!(f, "name=systemd"),
+        }
+    }
+}
+
+mod sealed {
+    use super::*;
+
+    pub trait ControllerInternal {
+        fn apply(&self, res: &Resources) -> Result<()>;
+
+        // meta stuff
+        fn control_type(&self) -> Controllers;
+        fn get_path(&self) -> &PathBuf;
+        fn get_path_mut(&mut self) -> &mut PathBuf;
+        fn get_base(&self) -> &PathBuf;
+
+        /// Hooks running after controller crated, if have
+        fn post_create(&self) {}
+
+        fn is_v2(&self) -> bool {
+            false
+        }
+
+        fn open_path(&self, p: &str, w: bool) -> Result<File> {
+            let mut path = self.get_path().clone();
+            path.push(p);
+
+            if w {
+                match File::create(&path) {
+                    Err(e) => Err(Error::with_cause(
+                        ErrorKind::WriteFailed(
+                            path.display().to_string(),
+                            "[CREATE FILE]".to_string(),
+                        ),
+                        e,
+                    )),
+                    Ok(file) => Ok(file),
+                }
+            } else {
+                match File::open(&path) {
+                    Err(e) => Err(Error::with_cause(
+                        ErrorKind::ReadFailed(path.display().to_string()),
+                        e,
+                    )),
+                    Ok(file) => Ok(file),
+                }
+            }
+        }
+
+        fn get_max_value(&self, f: &str) -> Result<MaxValue> {
+            self.open_path(f, false).and_then(|mut file| {
+                let mut string = String::new();
+                let res = file.read_to_string(&mut string);
+                match res {
+                    Ok(_) => parse_max_value(&string),
+                    Err(e) => Err(Error::with_cause(ReadFailed(f.to_string()), e)),
+                }
+            })
+        }
+
+        #[doc(hidden)]
+        fn path_exists(&self, p: &str) -> bool {
+            std::path::Path::new(p).exists()
+        }
+    }
+
+    pub trait CustomizedAttribute: ControllerInternal {
+        fn set(&self, key: &str, value: &str) -> Result<()> {
+            self.open_path(key, true).and_then(|mut file| {
+                file.write_all(value.as_ref()).map_err(|e| {
+                    Error::with_cause(WriteFailed(key.to_string(), value.to_string()), e)
+                })
+            })
+        }
+
+        #[allow(dead_code)]
+        fn get(&self, key: &str) -> Result<String> {
+            self.open_path(key, false).and_then(|mut file: File| {
+                let mut string = String::new();
+                match file.read_to_string(&mut string) {
+                    Ok(_) => Ok(string.trim().to_owned()),
+                    Err(e) => Err(Error::with_cause(ReadFailed(key.to_string()), e)),
+                }
+            })
+        }
+    }
+}
+
+pub(crate) use crate::fs::sealed::{ControllerInternal, CustomizedAttribute};
+use crate::CgroupPid;
+
+/// A Controller is a subsystem attached to the control group.
+///
+/// Implementors are able to control certain aspects of a control group.
+pub trait Controller {
+    #[doc(hidden)]
+    fn control_type(&self) -> Controllers;
+
+    /// The file system path to the controller.
+    fn path(&self) -> &Path;
+
+    /// Root path of the file system to the controller.
+    fn base(&self) -> &Path;
+
+    /// Apply a set of resources to the Controller, invoking its internal functions to pass the
+    /// kernel the information.
+    fn apply(&self, res: &Resources) -> Result<()>;
+
+    /// Create this controller
+    fn create(&self) -> Result<()>;
+
+    /// Does this controller already exist?
+    fn exists(&self) -> bool;
+
+    /// Set notify_on_release
+    fn set_notify_on_release(&self, enable: bool) -> Result<()>;
+
+    /// Set release_agent
+    fn set_release_agent(&self, path: &str) -> Result<()>;
+
+    /// Delete the controller.
+    fn delete(&self) -> Result<()>;
+
+    /// Attach a task to this controller.
+    fn add_task(&self, pid: &CgroupPid) -> Result<()>;
+
+    /// Attach a task to this controller.
+    fn add_task_by_tgid(&self, pid: &CgroupPid) -> Result<()>;
+
+    /// set cgroup type.
+    fn set_cgroup_type(&self, cgroup_type: &str) -> Result<()>;
+
+    /// get cgroup type.
+    fn get_cgroup_type(&self) -> Result<String>;
+
+    /// Get the list of tasks that this controller has.
+    fn tasks(&self) -> Vec<CgroupPid>;
+
+    /// Get the list of procs that this controller has.
+    fn procs(&self) -> Vec<CgroupPid>;
+
+    fn v2(&self) -> bool;
+}
+
+impl<T> Controller for T
+where
+    T: ControllerInternal,
+{
+    fn control_type(&self) -> Controllers {
+        ControllerInternal::control_type(self)
+    }
+
+    fn path(&self) -> &Path {
+        self.get_path()
+    }
+
+    fn base(&self) -> &Path {
+        self.get_base()
+    }
+
+    /// Apply a set of resources to the Controller, invoking its internal functions to pass the
+    /// kernel the information.
+    fn apply(&self, res: &Resources) -> Result<()> {
+        ControllerInternal::apply(self, res)
+    }
+
+    /// Create this controller
+    fn create(&self) -> Result<()> {
+        std::fs::create_dir_all(self.get_path())
+            .map_err(|err| Error::with_cause(ErrorKind::FsError, err))?;
+        self.post_create();
+        Ok(())
+    }
+
+    /// Set notify_on_release
+    fn set_notify_on_release(&self, enable: bool) -> Result<()> {
+        if self.is_v2() {
+            return Err(Error::new(ErrorKind::CgroupVersion));
+        }
+        self.open_path("notify_on_release", true)
+            .and_then(|mut file| {
+                write!(file, "{}", enable as i32).map_err(|e| {
+                    Error::with_cause(
+                        ErrorKind::WriteFailed("notify_on_release".to_string(), enable.to_string()),
+                        e,
+                    )
+                })
+            })
+    }
+
+    /// Set release_agent
+    fn set_release_agent(&self, path: &str) -> Result<()> {
+        if self.is_v2() {
+            return Err(Error::new(ErrorKind::CgroupVersion));
+        }
+        self.open_path("release_agent", true).and_then(|mut file| {
+            file.write_all(path.as_bytes()).map_err(|e| {
+                Error::with_cause(
+                    ErrorKind::WriteFailed("release_agent".to_string(), path.to_string()),
+                    e,
+                )
+            })
+        })
+    }
+    /// Does this controller already exist?
+    fn exists(&self) -> bool {
+        self.get_path().exists()
+    }
+
+    /// Delete the controller.
+    fn delete(&self) -> Result<()> {
+        if !self.get_path().exists() {
+            return Ok(());
+        }
+
+        // Compatible with runC for remove dir operation
+        // https://github.com/opencontainers/runc/blob/main/libcontainer/cgroups/utils.go#L272
+        //
+        // We trying to remove all paths five times with increasing delay between tries.
+        // If after all there are not removed cgroups - appropriate error will be
+        // returned.
+        let mut delay = std::time::Duration::from_millis(10);
+        let cgroup_path = self.get_path();
+        for _i in 0..4 {
+            if let Ok(()) = remove_dir(cgroup_path) {
+                return Ok(());
+            }
+            std::thread::sleep(delay);
+            delay *= 2;
+        }
+
+        remove_dir(cgroup_path)
+    }
+
+    /// Attach a task to this controller.
+    fn add_task(&self, pid: &CgroupPid) -> Result<()> {
+        let mut file_name = "tasks";
+        if self.is_v2() {
+            file_name = "cgroup.threads";
+        }
+        self.open_path(file_name, true).and_then(|mut file| {
+            file.write_all(pid.pid.to_string().as_ref()).map_err(|e| {
+                Error::with_cause(
+                    ErrorKind::WriteFailed(file_name.to_string(), pid.pid.to_string()),
+                    e,
+                )
+            })
+        })
+    }
+
+    /// Attach a task to this controller by thread group id.
+    fn add_task_by_tgid(&self, pid: &CgroupPid) -> Result<()> {
+        let file_name = "cgroup.procs";
+        self.open_path(file_name, true).and_then(|mut file| {
+            file.write_all(pid.pid.to_string().as_ref()).map_err(|e| {
+                Error::with_cause(
+                    ErrorKind::WriteFailed(file_name.to_string(), pid.pid.to_string()),
+                    e,
+                )
+            })
+        })
+    }
+
+    /// Get the list of procs that this controller has.
+    fn procs(&self) -> Vec<CgroupPid> {
+        let file_name = "cgroup.procs";
+        self.open_path(file_name, false)
+            .map(|file| {
+                let bf = BufReader::new(file);
+                let mut v = Vec::new();
+                for line in bf.lines() {
+                    match line {
+                        Ok(line) => {
+                            let n = line.trim().parse().unwrap_or(0u64);
+                            v.push(n);
+                        }
+                        Err(_) => break,
+                    }
+                }
+                v.into_iter().map(CgroupPid::from).collect()
+            })
+            .unwrap_or_default()
+    }
+
+    /// Get the list of tasks that this controller has.
+    fn tasks(&self) -> Vec<CgroupPid> {
+        let mut file_name = "tasks";
+        if self.is_v2() {
+            file_name = "cgroup.threads";
+        }
+        self.open_path(file_name, false)
+            .map(|file| {
+                let bf = BufReader::new(file);
+                let mut v = Vec::new();
+                for line in bf.lines() {
+                    match line {
+                        Ok(line) => {
+                            let n = line.trim().parse().unwrap_or(0u64);
+                            v.push(n);
+                        }
+                        Err(_) => break,
+                    }
+                }
+                v.into_iter().map(CgroupPid::from).collect()
+            })
+            .unwrap_or_default()
+    }
+
+    /// set cgroup.type
+    fn set_cgroup_type(&self, cgroup_type: &str) -> Result<()> {
+        if !self.is_v2() {
+            return Err(Error::new(ErrorKind::CgroupVersion));
+        }
+        let file_name = "cgroup.type";
+        self.open_path(file_name, true).and_then(|mut file| {
+            file.write_all(cgroup_type.as_bytes()).map_err(|e| {
+                Error::with_cause(
+                    ErrorKind::WriteFailed(file_name.to_string(), cgroup_type.to_string()),
+                    e,
+                )
+            })
+        })
+    }
+
+    /// get cgroup.type
+    fn get_cgroup_type(&self) -> Result<String> {
+        if !self.is_v2() {
+            return Err(Error::new(ErrorKind::CgroupVersion));
+        }
+        let file_name = "cgroup.type";
+        self.open_path(file_name, false).and_then(|mut file: File| {
+            let mut string = String::new();
+            match file.read_to_string(&mut string) {
+                Ok(_) => Ok(string.trim().to_owned()),
+                Err(e) => Err(Error::with_cause(
+                    ErrorKind::ReadFailed(file_name.to_string()),
+                    e,
+                )),
+            }
+        })
+    }
+
+    fn v2(&self) -> bool {
+        self.is_v2()
+    }
+}
+
+// remove_dir aims to remove cgroup path. It does so recursively,
+// by removing any subdirectories (sub-cgroups) first.
+fn remove_dir(dir: &Path) -> Result<()> {
+    // try the fast path first.
+    if fs::remove_dir(dir).is_ok() {
+        return Ok(());
+    }
+
+    if dir.exists() && dir.is_dir() {
+        for entry in fs::read_dir(dir)
+            .map_err(|e| Error::with_cause(ReadFailed(dir.display().to_string()), e))?
+        {
+            let entry =
+                entry.map_err(|e| Error::with_cause(ReadFailed(dir.display().to_string()), e))?;
+            let path = entry.path();
+            if path.is_dir() {
+                remove_dir(&path)?;
+            }
+        }
+        fs::remove_dir(dir).map_err(|e| Error::with_cause(RemoveFailed, e))?;
+    }
+
+    Ok(())
+}
+
+#[doc(hidden)]
+pub trait ControllIdentifier {
+    fn controller_type() -> Controllers;
+}
+
+/// Control group hierarchy (right now, only V1 is supported, but in the future Unified will be
+/// implemented as well).
+pub trait Hierarchy: std::fmt::Debug + Send + Sync {
+    /// Returns what subsystems are supported by the hierarchy.
+    fn subsystems(&self) -> Vec<Subsystem>;
+
+    /// Returns the root directory of the hierarchy.
+    fn root(&self) -> PathBuf;
+
+    /// Return a handle to the root control group in the hierarchy.
+    fn root_control_group(&self) -> Cgroup;
+
+    /// Return a handle to the parent control group in the hierarchy.
+    fn parent_control_group(&self, path: &str) -> Cgroup;
+
+    fn v2(&self) -> bool;
+}
+
+/// Resource limits for the memory subsystem.
+#[derive(Debug, Clone, Eq, PartialEq, Default)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct MemoryResources {
+    /// How much memory (in bytes) can the kernel consume.
+    pub kernel_memory_limit: Option<i64>,
+    /// Upper limit of memory usage of the control group's tasks.
+    pub memory_hard_limit: Option<i64>,
+    /// How much memory the tasks in the control group can use when the system is under memory
+    /// pressure.
+    pub memory_soft_limit: Option<i64>,
+    /// How much of the kernel's memory (in bytes) can be used for TCP-related buffers.
+    pub kernel_tcp_memory_limit: Option<i64>,
+    /// How much memory and swap together can the tasks in the control group use.
+    pub memory_swap_limit: Option<i64>,
+    /// Controls the tendency of the kernel to swap out parts of the address space of the tasks to
+    /// disk. Lower value implies less likely.
+    ///
+    /// Note, however, that a value of zero does not mean the process is never swapped out. Use the
+    /// traditional `mlock(2)` system call for that purpose.
+    pub swappiness: Option<u64>,
+    /// Customized key-value attributes
+    ///
+    /// # Usage:
+    /// ```
+    /// let resource = &mut cgroups_rs::fs::Resources::default();
+    /// resource.memory.attrs.insert("memory.numa_balancing".to_string(), "true".to_string());
+    /// // apply here
+    /// ```
+    pub attrs: HashMap<String, String>,
+}
+
+/// Resources limits on the number of processes.
+#[derive(Debug, Clone, Eq, PartialEq, Default)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct PidResources {
+    /// The maximum number of processes that can exist in the control group.
+    ///
+    /// Note that attaching processes to the control group will still succeed _even_ if the limit
+    /// would be violated, however forks/clones inside the control group will have with `EAGAIN` if
+    /// they would violate the limit set here.
+    pub maximum_number_of_processes: Option<MaxValue>,
+}
+
+/// Resources limits about how the tasks can use the CPU.
+#[derive(Debug, Clone, Eq, PartialEq, Default)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct CpuResources {
+    // cpuset
+    /// A comma-separated list of CPU IDs where the task in the control group can run. Dashes
+    /// between numbers indicate ranges.
+    pub cpus: Option<String>,
+    /// Same syntax as the `cpus` field of this structure, but applies to memory nodes instead of
+    /// processors.
+    pub mems: Option<String>,
+    // cpu
+    /// Weight of how much of the total CPU time should this control group get. Note that this is
+    /// hierarchical, so this is weighted against the siblings of this control group.
+    pub shares: Option<u64>,
+    /// In one `period`, how much can the tasks run in microseconds.
+    pub quota: Option<i64>,
+    /// Period of time in microseconds.
+    pub period: Option<u64>,
+    /// This is currently a no-operation.
+    pub realtime_runtime: Option<i64>,
+    /// This is currently a no-operation.
+    pub realtime_period: Option<u64>,
+    /// Customized key-value attributes
+    /// # Usage:
+    /// ```
+    /// let resource = &mut cgroups_rs::fs::Resources::default();
+    /// resource.cpu.attrs.insert("cpu.cfs_init_buffer_us".to_string(), "10".to_string());
+    /// // apply here
+    /// ```
+    pub attrs: HashMap<String, String>,
+}
+
+/// A device resource that can be allowed or denied access to.
+#[derive(Debug, Clone, Eq, PartialEq, Default)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct DeviceResource {
+    /// If true, access to the device is allowed, otherwise it's denied.
+    pub allow: bool,
+    /// `'c'` for character device, `'b'` for block device; or `'a'` for all devices.
+    pub devtype: crate::fs::devices::DeviceType,
+    /// The major number of the device.
+    pub major: i64,
+    /// The minor number of the device.
+    pub minor: i64,
+    /// Sequence of `'r'`, `'w'` or `'m'`, each denoting read, write or mknod permissions.
+    pub access: Vec<crate::fs::devices::DevicePermissions>,
+}
+
+/// Limit the usage of devices for the control group's tasks.
+#[derive(Debug, Clone, Eq, PartialEq, Default)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct DeviceResources {
+    /// For each device in the list, the limits in the structure are applied.
+    pub devices: Vec<DeviceResource>,
+}
+
+/// Assigned priority for a network device.
+#[derive(Debug, Clone, Eq, PartialEq, Default)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct NetworkPriority {
+    /// The name (as visible in `ifconfig`) of the interface.
+    pub name: String,
+    /// Assigned priority.
+    pub priority: u64,
+}
+
+/// Collections of limits and tags that can be imposed on packets emitted by the tasks in the
+/// control group.
+#[derive(Debug, Clone, Eq, PartialEq, Default)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct NetworkResources {
+    /// The networking class identifier to attach to the packets.
+    ///
+    /// This can then later be used in iptables and such to have special rules.
+    pub class_id: Option<u64>,
+    /// Priority of the egress traffic for each interface.
+    pub priorities: Vec<NetworkPriority>,
+}
+
+/// A hugepage type and its consumption limit for the control group.
+#[derive(Debug, Clone, Eq, PartialEq, Default)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct HugePageResource {
+    /// The size of the hugepage, i.e. `2MB`, `1GB`, etc.
+    pub size: String,
+    /// The amount of bytes (of memory consumed by the tasks) that are allowed to be backed by
+    /// hugepages.
+    pub limit: u64,
+}
+
+/// Provides the ability to set consumption limit on each type of hugepages.
+#[derive(Debug, Clone, Eq, PartialEq, Default)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct HugePageResources {
+    /// Set a limit of consumption for each hugepages type.
+    pub limits: Vec<HugePageResource>,
+}
+
+/// Weight for a particular block device.
+#[derive(Debug, Clone, Eq, PartialEq, Default)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct BlkIoDeviceResource {
+    /// The major number of the device.
+    pub major: u64,
+    /// The minor number of the device.
+    pub minor: u64,
+    /// The weight of the device against the descendant nodes.
+    pub weight: Option<u16>,
+    /// The weight of the device against the sibling nodes.
+    pub leaf_weight: Option<u16>,
+}
+
+/// Provides the ability to throttle a device (both byte/sec, and IO op/s)
+#[derive(Debug, Clone, Eq, PartialEq, Default)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct BlkIoDeviceThrottleResource {
+    /// The major number of the device.
+    pub major: u64,
+    /// The minor number of the device.
+    pub minor: u64,
+    /// The rate.
+    pub rate: u64,
+}
+
+/// General block I/O resource limits.
+#[derive(Debug, Clone, Eq, PartialEq, Default)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct BlkIoResources {
+    /// The weight of the control group against descendant nodes.
+    pub weight: Option<u16>,
+    /// The weight of the control group against sibling nodes.
+    pub leaf_weight: Option<u16>,
+    /// For each device, a separate weight (both normal and leaf) can be provided.
+    pub weight_device: Vec<BlkIoDeviceResource>,
+    /// Throttled read bytes/second can be provided for each device.
+    pub throttle_read_bps_device: Vec<BlkIoDeviceThrottleResource>,
+    /// Throttled read IO operations per second can be provided for each device.
+    pub throttle_read_iops_device: Vec<BlkIoDeviceThrottleResource>,
+    /// Throttled written bytes/second can be provided for each device.
+    pub throttle_write_bps_device: Vec<BlkIoDeviceThrottleResource>,
+    /// Throttled write IO operations per second can be provided for each device.
+    pub throttle_write_iops_device: Vec<BlkIoDeviceThrottleResource>,
+
+    /// Customized key-value attributes
+    /// # Usage:
+    /// ```
+    /// let resource = &mut cgroups_rs::fs::Resources::default();
+    /// resource.blkio.attrs.insert("io.cost.weight".to_string(), "10".to_string());
+    /// // apply here
+    /// ```
+    pub attrs: HashMap<String, String>,
+}
+
+/// The resource limits and constraints that will be set on the control group.
+#[derive(Debug, Clone, Eq, PartialEq, Default)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct Resources {
+    /// Memory usage related limits.
+    pub memory: MemoryResources,
+    /// Process identifier related limits.
+    pub pid: PidResources,
+    /// CPU related limits.
+    pub cpu: CpuResources,
+    /// Device related limits.
+    pub devices: DeviceResources,
+    /// Network related tags and limits.
+    pub network: NetworkResources,
+    /// Hugepages consumption related limits.
+    pub hugepages: HugePageResources,
+    /// Block device I/O related limits.
+    pub blkio: BlkIoResources,
+}
+
+impl Subsystem {
+    fn enter(self, path: &Path) -> Self {
+        match self {
+            Subsystem::Pid(mut cont) => Subsystem::Pid({
+                cont.get_path_mut().push(path);
+                cont
+            }),
+            Subsystem::Mem(mut cont) => Subsystem::Mem({
+                cont.get_path_mut().push(path);
+                cont
+            }),
+            Subsystem::CpuSet(mut cont) => Subsystem::CpuSet({
+                cont.get_path_mut().push(path);
+                cont
+            }),
+            Subsystem::CpuAcct(mut cont) => Subsystem::CpuAcct({
+                cont.get_path_mut().push(path);
+                cont
+            }),
+            Subsystem::Cpu(mut cont) => Subsystem::Cpu({
+                cont.get_path_mut().push(path);
+                cont
+            }),
+            Subsystem::Devices(mut cont) => Subsystem::Devices({
+                cont.get_path_mut().push(path);
+                cont
+            }),
+            Subsystem::Freezer(mut cont) => Subsystem::Freezer({
+                cont.get_path_mut().push(path);
+                cont
+            }),
+            Subsystem::NetCls(mut cont) => Subsystem::NetCls({
+                cont.get_path_mut().push(path);
+                cont
+            }),
+            Subsystem::BlkIo(mut cont) => Subsystem::BlkIo({
+                cont.get_path_mut().push(path);
+                cont
+            }),
+            Subsystem::PerfEvent(mut cont) => Subsystem::PerfEvent({
+                cont.get_path_mut().push(path);
+                cont
+            }),
+            Subsystem::NetPrio(mut cont) => Subsystem::NetPrio({
+                cont.get_path_mut().push(path);
+                cont
+            }),
+            Subsystem::HugeTlb(mut cont) => Subsystem::HugeTlb({
+                cont.get_path_mut().push(path);
+                cont
+            }),
+            Subsystem::Rdma(mut cont) => Subsystem::Rdma({
+                cont.get_path_mut().push(path);
+                cont
+            }),
+            Subsystem::Systemd(mut cont) => Subsystem::Systemd({
+                cont.get_path_mut().push(path);
+                cont
+            }),
+        }
+    }
+
+    pub fn to_controller(&self) -> &dyn Controller {
+        match self {
+            Subsystem::Pid(cont) => cont,
+            Subsystem::Mem(cont) => cont,
+            Subsystem::CpuSet(cont) => cont,
+            Subsystem::CpuAcct(cont) => cont,
+            Subsystem::Cpu(cont) => cont,
+            Subsystem::Devices(cont) => cont,
+            Subsystem::Freezer(cont) => cont,
+            Subsystem::NetCls(cont) => cont,
+            Subsystem::BlkIo(cont) => cont,
+            Subsystem::PerfEvent(cont) => cont,
+            Subsystem::NetPrio(cont) => cont,
+            Subsystem::HugeTlb(cont) => cont,
+            Subsystem::Rdma(cont) => cont,
+            Subsystem::Systemd(cont) => cont,
+        }
+    }
+
+    pub fn controller_name(&self) -> String {
+        self.to_controller().control_type().to_string()
+    }
+}
+
+/// The values for `memory.hight` or `pids.max`
+#[derive(Eq, PartialEq, Copy, Clone, Debug)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub enum MaxValue {
+    /// This value is returned when the text is `"max"`.
+    Max,
+    /// When the value is a numerical value, they are returned via this enum field.
+    Value(i64),
+}
+
+#[allow(clippy::derivable_impls)]
+impl Default for MaxValue {
+    fn default() -> Self {
+        MaxValue::Max
+    }
+}
+
+impl MaxValue {
+    #[allow(clippy::should_implement_trait, clippy::wrong_self_convention)]
+    fn to_i64(&self) -> i64 {
+        match self {
+            MaxValue::Max => -1,
+            MaxValue::Value(num) => *num,
+        }
+    }
+}
+
+impl fmt::Display for MaxValue {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            MaxValue::Max => write!(f, "max"),
+            MaxValue::Value(num) => write!(f, "{}", num),
+        }
+    }
+}
+
+pub fn parse_max_value(s: &str) -> Result<MaxValue> {
+    if s.trim() == "max" {
+        return Ok(MaxValue::Max);
+    }
+    match s.trim().parse() {
+        Ok(val) => Ok(MaxValue::Value(val)),
+        Err(e) => Err(Error::with_cause(ParseError, e)),
+    }
+}
+
+// Flat keyed
+//  KEY0 VAL0\n
+//  KEY1 VAL1\n
+pub fn flat_keyed_to_vec(mut file: File) -> Result<Vec<(String, i64)>> {
+    let mut content = String::new();
+    file.read_to_string(&mut content)
+        .map_err(|e| Error::with_cause(ReadFailed("FIXME: read_string_from".to_string()), e))?;
+
+    let mut v = Vec::new();
+    for line in content.lines() {
+        let parts: Vec<&str> = line.split(' ').collect();
+        if parts.len() == 2 {
+            if let Ok(i) = parts[1].parse::<i64>() {
+                v.push((parts[0].to_string(), i));
+            }
+        }
+    }
+    Ok(v)
+}
+
+// Flat keyed
+//  KEY0 VAL0\n
+//  KEY1 VAL1\n
+pub fn flat_keyed_to_hashmap(mut file: File) -> Result<HashMap<String, i64>> {
+    let mut content = String::new();
+    file.read_to_string(&mut content)
+        .map_err(|e| Error::with_cause(ReadFailed("FIXME: read_string_from".to_string()), e))?;
+
+    let mut h = HashMap::new();
+    for line in content.lines() {
+        let parts: Vec<&str> = line.split(' ').collect();
+        if parts.len() == 2 {
+            if let Ok(i) = parts[1].parse::<i64>() {
+                h.insert(parts[0].to_string(), i);
+            }
+        }
+    }
+    Ok(h)
+}
+
+// Nested keyed
+//  KEY0 SUB_KEY0=VAL00 SUB_KEY1=VAL01...
+//  KEY1 SUB_KEY0=VAL10 SUB_KEY1=VAL11...
+pub fn nested_keyed_to_hashmap(mut file: File) -> Result<HashMap<String, HashMap<String, i64>>> {
+    let mut content = String::new();
+    file.read_to_string(&mut content)
+        .map_err(|e| Error::with_cause(ReadFailed("FIXME: read_string_from".to_string()), e))?;
+
+    let mut h = HashMap::new();
+    for line in content.lines() {
+        let parts: Vec<&str> = line.split(' ').collect();
+        if parts.is_empty() {
+            continue;
+        }
+        let mut th = HashMap::new();
+        for item in parts[1..].iter() {
+            let fields: Vec<&str> = item.split('=').collect();
+            if fields.len() == 2 {
+                if let Ok(i) = fields[1].parse::<i64>() {
+                    th.insert(fields[0].to_string(), i);
+                }
+            }
+        }
+        h.insert(parts[0].to_string(), th);
+    }
+
+    Ok(h)
+}
+
+fn read_from<T>(mut file: File) -> Result<T>
+where
+    T: FromStr,
+    <T as FromStr>::Err: 'static + Send + Sync + std::error::Error,
+{
+    let mut string = String::new();
+    match file.read_to_string(&mut string) {
+        Ok(_) => string
+            .trim()
+            .parse::<T>()
+            .map_err(|e| Error::with_cause(ParseError, e)),
+        Err(e) => Err(Error::with_cause(
+            ReadFailed("FIXME: can't get path in fn read_from".to_string()),
+            e,
+        )),
+    }
+}
+
+fn read_string_from(mut file: File) -> Result<String> {
+    let mut string = String::new();
+    match file.read_to_string(&mut string) {
+        Ok(_) => Ok(string.trim().to_string()),
+        Err(e) => Err(Error::with_cause(
+            ReadFailed("FIXME: can't get path in fn read_string_from".to_string()),
+            e,
+        )),
+    }
+}
+
+/// read and parse an u64 data
+fn read_u64_from(file: File) -> Result<u64> {
+    read_from::<u64>(file)
+}
+
+/// read and parse an i64 data
+fn read_i64_from(file: File) -> Result<i64> {
+    read_from::<i64>(file)
+}

src/fs/net_cls.rs

@@ -0,0 +1,102 @@
+// Copyright (c) 2018 Levente Kurusa
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! This module contains the implementation of the `net_cls` cgroup subsystem.
+//!
+//! See the Kernel's documentation for more information about this subsystem, found at:
+//!  [Documentation/cgroup-v1/net_cls.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/net_cls.txt)
+use std::io::Write;
+use std::path::PathBuf;
+
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
+
+use crate::fs::read_u64_from;
+use crate::fs::{
+    ControllIdentifier, ControllerInternal, Controllers, NetworkResources, Resources, Subsystem,
+};
+
+/// A controller that allows controlling the `net_cls` subsystem of a Cgroup.
+///
+/// In esssence, using the `net_cls` controller, one can attach a custom class to the network
+/// packets emitted by the control group's tasks. This can then later be used in iptables to have
+/// custom firewall rules, QoS, etc.
+#[derive(Debug, Clone)]
+pub struct NetClsController {
+    base: PathBuf,
+    path: PathBuf,
+}
+
+impl ControllerInternal for NetClsController {
+    fn control_type(&self) -> Controllers {
+        Controllers::NetCls
+    }
+    fn get_path(&self) -> &PathBuf {
+        &self.path
+    }
+    fn get_path_mut(&mut self) -> &mut PathBuf {
+        &mut self.path
+    }
+    fn get_base(&self) -> &PathBuf {
+        &self.base
+    }
+
+    fn apply(&self, res: &Resources) -> Result<()> {
+        // get the resources that apply to this controller
+        let res: &NetworkResources = &res.network;
+
+        update_and_test!(self, set_class, res.class_id, get_class);
+
+        Ok(())
+    }
+}
+
+impl ControllIdentifier for NetClsController {
+    fn controller_type() -> Controllers {
+        Controllers::NetCls
+    }
+}
+
+impl<'a> From<&'a Subsystem> for &'a NetClsController {
+    fn from(sub: &'a Subsystem) -> &'a NetClsController {
+        unsafe {
+            match sub {
+                Subsystem::NetCls(c) => c,
+                _ => {
+                    assert_eq!(1, 0);
+                    let v = std::mem::MaybeUninit::uninit();
+                    v.assume_init()
+                }
+            }
+        }
+    }
+}
+
+impl NetClsController {
+    /// Constructs a new `NetClsController` with `root` serving as the root of the control group.
+    pub fn new(point: PathBuf, root: PathBuf) -> Self {
+        Self {
+            base: root,
+            path: point,
+        }
+    }
+
+    /// Set the network class id of the outgoing packets of the control group's tasks.
+    pub fn set_class(&self, class: u64) -> Result<()> {
+        self.open_path("net_cls.classid", true)
+            .and_then(|mut file| {
+                let s = format!("{:#08X}", class);
+                file.write_all(s.as_ref()).map_err(|e| {
+                    Error::with_cause(WriteFailed("net_cls.classid".to_string(), s), e)
+                })
+            })
+    }
+
+    /// Get the network class id of the outgoing packets of the control group's tasks.
+    pub fn get_class(&self) -> Result<u64> {
+        self.open_path("net_cls.classid", false)
+            .and_then(read_u64_from)
+    }
+}

src/fs/net_prio.rs

@@ -0,0 +1,136 @@
+// Copyright (c) 2018 Levente Kurusa
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! This module contains the implementation of the `net_prio` cgroup subsystem.
+//!
+//! See the Kernel's documentation for more information about this subsystem, found at:
+//!  [Documentation/cgroup-v1/net_prio.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/net_prio.txt)
+use std::collections::HashMap;
+use std::io::{BufRead, BufReader, Write};
+use std::path::PathBuf;
+
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
+
+use crate::fs::read_u64_from;
+use crate::fs::{
+    ControllIdentifier, ControllerInternal, Controllers, NetworkResources, Resources, Subsystem,
+};
+
+/// A controller that allows controlling the `net_prio` subsystem of a Cgroup.
+///
+/// In essence, using `net_prio` one can set the priority of the packets emitted from the control
+/// group's tasks. This can then be used to have QoS restrictions on certain control groups and
+/// thus, prioritizing certain tasks.
+#[derive(Debug, Clone)]
+pub struct NetPrioController {
+    base: PathBuf,
+    path: PathBuf,
+}
+
+impl ControllerInternal for NetPrioController {
+    fn control_type(&self) -> Controllers {
+        Controllers::NetPrio
+    }
+    fn get_path(&self) -> &PathBuf {
+        &self.path
+    }
+    fn get_path_mut(&mut self) -> &mut PathBuf {
+        &mut self.path
+    }
+    fn get_base(&self) -> &PathBuf {
+        &self.base
+    }
+
+    fn apply(&self, res: &Resources) -> Result<()> {
+        // get the resources that apply to this controller
+        let res: &NetworkResources = &res.network;
+
+        for i in &res.priorities {
+            let _ = self.set_if_prio(&i.name, i.priority);
+        }
+
+        Ok(())
+    }
+}
+
+impl ControllIdentifier for NetPrioController {
+    fn controller_type() -> Controllers {
+        Controllers::NetPrio
+    }
+}
+
+impl<'a> From<&'a Subsystem> for &'a NetPrioController {
+    fn from(sub: &'a Subsystem) -> &'a NetPrioController {
+        unsafe {
+            match sub {
+                Subsystem::NetPrio(c) => c,
+                _ => {
+                    assert_eq!(1, 0);
+                    let v = std::mem::MaybeUninit::uninit();
+                    v.assume_init()
+                }
+            }
+        }
+    }
+}
+
+impl NetPrioController {
+    /// Constructs a new `NetPrioController` with `root` serving as the root of the control group.
+    pub fn new(point: PathBuf, root: PathBuf) -> Self {
+        Self {
+            base: root,
+            path: point,
+        }
+    }
+
+    /// Retrieves the current priority of the emitted packets.
+    pub fn prio_idx(&self) -> u64 {
+        self.open_path("net_prio.prioidx", false)
+            .and_then(read_u64_from)
+            .unwrap_or(0)
+    }
+
+    /// A map of priorities for each network interface.
+    pub fn ifpriomap(&self) -> Result<HashMap<String, u64>> {
+        self.open_path("net_prio.ifpriomap", false)
+            .and_then(|file| {
+                let bf = BufReader::new(file);
+                bf.lines()
+                    .map(|line| {
+                        let line = line.map_err(|_| Error::new(ParseError))?;
+                        let mut parts = line.split_whitespace();
+
+                        let ifname = parts.next().ok_or(Error::new(ParseError))?;
+                        let ifprio_str = parts.next().ok_or(Error::new(ParseError))?;
+
+                        let ifprio = ifprio_str
+                            .trim()
+                            .parse()
+                            .map_err(|e| Error::with_cause(ParseError, e))?;
+
+                        Ok((ifname.to_string(), ifprio))
+                    })
+                    .collect::<Result<HashMap<String, _>>>()
+            })
+    }
+
+    /// Set the priority of the network traffic on `eif` to be `prio`.
+    pub fn set_if_prio(&self, eif: &str, prio: u64) -> Result<()> {
+        self.open_path("net_prio.ifpriomap", true)
+            .and_then(|mut file| {
+                file.write_all(format!("{} {}", eif, prio).as_ref())
+                    .map_err(|e| {
+                        Error::with_cause(
+                            WriteFailed(
+                                "net_prio.ifpriomap".to_string(),
+                                format!("{} {}", eif, prio),
+                            ),
+                            e,
+                        )
+                    })
+            })
+    }
+}

src/fs/perf_event.rs

@@ -1,10 +1,17 @@
+// Copyright (c) 2018 Levente Kurusa
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
 //! This module contains the implementation of the `perf_event` cgroup subsystem.
-//! 
+//!
 //! See the Kernel's documentation for more information about this subsystem, found at:
 //!  [tools/perf/Documentation/perf-record.txt](https://raw.githubusercontent.com/torvalds/linux/master/tools/perf/Documentation/perf-record.txt)
 use std::path::PathBuf;
 
-use {Controllers, Controller, Resources, ControllIdentifier, Subsystem};
+use crate::fs::error::*;
+
+use crate::fs::{ControllIdentifier, ControllerInternal, Controllers, Resources, Subsystem};
 
 /// A controller that allows controlling the `perf_event` subsystem of a Cgroup.
 ///
@@ -16,13 +23,22 @@ pub struct PerfEventController {
     path: PathBuf,
 }
 
-impl Controller for PerfEventController {
-    fn control_type(self: &Self) -> Controllers { Controllers::PerfEvent }
-    fn get_path<'a>(self: &'a Self) -> &'a PathBuf { &self.path }
-    fn get_path_mut<'a>(self: &'a mut Self) -> &'a mut PathBuf { &mut self.path }
-    fn get_base<'a>(self: &'a Self) -> &'a PathBuf { &self.base }
+impl ControllerInternal for PerfEventController {
+    fn control_type(&self) -> Controllers {
+        Controllers::PerfEvent
+    }
+    fn get_path(&self) -> &PathBuf {
+        &self.path
+    }
+    fn get_path_mut(&mut self) -> &mut PathBuf {
+        &mut self.path
+    }
+    fn get_base(&self) -> &PathBuf {
+        &self.base
+    }
 
-    fn apply(self: &Self, _res: &Resources) {
+    fn apply(&self, _res: &Resources) -> Result<()> {
+        Ok(())
     }
 }
 
@@ -39,21 +55,20 @@ impl<'a> From<&'a Subsystem> for &'a PerfEventController {
                 Subsystem::PerfEvent(c) => c,
                 _ => {
                     assert_eq!(1, 0);
-                    ::std::mem::uninitialized()
-                },
+                    let v = std::mem::MaybeUninit::uninit();
+                    v.assume_init()
+                }
             }
         }
     }
 }
 
 impl PerfEventController {
-    /// Constructs a new `PerfEventController` with `oroot` serving as the root of the control group.
-    pub fn new(oroot: PathBuf) -> Self {
-        let mut root = oroot;
-        root.push(Self::controller_type().to_string());
+    /// Constructs a new `PerfEventController` with `root` serving as the root of the control group.
+    pub fn new(point: PathBuf, root: PathBuf) -> Self {
         Self {
-            base: root.clone(),
-            path: root,
+            base: root,
+            path: point,
         }
     }
 }

src/fs/pid.rs

@@ -0,0 +1,155 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! This module contains the implementation of the `pids` cgroup subsystem.
+//!
+//! See the Kernel's documentation for more information about this subsystem, found at:
+//!  [Documentation/cgroups-v1/pids.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/pids.txt)
+use std::io::{Read, Write};
+use std::path::PathBuf;
+
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
+
+use crate::fs::read_u64_from;
+use crate::fs::{
+    parse_max_value, ControllIdentifier, ControllerInternal, Controllers, MaxValue, PidResources,
+    Resources, Subsystem,
+};
+
+/// A controller that allows controlling the `pids` subsystem of a Cgroup.
+#[derive(Debug, Clone)]
+pub struct PidController {
+    base: PathBuf,
+    path: PathBuf,
+    v2: bool,
+}
+
+impl ControllerInternal for PidController {
+    fn control_type(&self) -> Controllers {
+        Controllers::Pids
+    }
+    fn get_path(&self) -> &PathBuf {
+        &self.path
+    }
+    fn get_path_mut(&mut self) -> &mut PathBuf {
+        &mut self.path
+    }
+    fn get_base(&self) -> &PathBuf {
+        &self.base
+    }
+
+    fn is_v2(&self) -> bool {
+        self.v2
+    }
+
+    fn apply(&self, res: &Resources) -> Result<()> {
+        // get the resources that apply to this controller
+        let pidres: &PidResources = &res.pid;
+
+        // apply pid_max
+        update_and_test!(
+            self,
+            set_pid_max,
+            pidres.maximum_number_of_processes,
+            get_pid_max
+        );
+
+        Ok(())
+    }
+}
+
+// impl<'a> ControllIdentifier for &'a PidController {
+//     fn controller_type() -> Controllers {
+//         Controllers::Pids
+//     }
+// }
+
+impl ControllIdentifier for PidController {
+    fn controller_type() -> Controllers {
+        Controllers::Pids
+    }
+}
+
+impl<'a> From<&'a Subsystem> for &'a PidController {
+    fn from(sub: &'a Subsystem) -> &'a PidController {
+        unsafe {
+            match sub {
+                Subsystem::Pid(c) => c,
+                _ => {
+                    assert_eq!(1, 0);
+                    let v = std::mem::MaybeUninit::uninit();
+                    v.assume_init()
+                }
+            }
+        }
+    }
+}
+
+impl PidController {
+    /// Constructors a new `PidController` instance, with `root` serving as the controller's root
+    /// directory.
+    pub fn new(point: PathBuf, root: PathBuf, v2: bool) -> Self {
+        Self {
+            base: root,
+            path: point,
+            v2,
+        }
+    }
+
+    /// The number of times `fork` failed because the limit was hit.
+    pub fn get_pid_events(&self) -> Result<u64> {
+        self.open_path("pids.events", false).and_then(|mut file| {
+            let mut string = String::new();
+            match file.read_to_string(&mut string) {
+                Ok(_) => match string.split_whitespace().nth(1) {
+                    Some(elem) => match elem.parse() {
+                        Ok(val) => Ok(val),
+                        Err(e) => Err(Error::with_cause(ParseError, e)),
+                    },
+                    None => Err(Error::new(ParseError)),
+                },
+                Err(e) => Err(Error::with_cause(ReadFailed("pids.events".to_string()), e)),
+            }
+        })
+    }
+
+    /// The number of processes currently.
+    pub fn get_pid_current(&self) -> Result<u64> {
+        self.open_path("pids.current", false)
+            .and_then(read_u64_from)
+    }
+
+    /// The maximum number of processes that can exist at one time in the control group.
+    pub fn get_pid_max(&self) -> Result<MaxValue> {
+        self.open_path("pids.max", false).and_then(|mut file| {
+            let mut string = String::new();
+            let res = file.read_to_string(&mut string);
+            match res {
+                Ok(_) => parse_max_value(&string),
+                Err(e) => Err(Error::with_cause(ReadFailed("pids.max".to_string()), e)),
+            }
+        })
+    }
+
+    /// Set the maximum number of processes that can exist in this control group.
+    ///
+    /// Note that if `get_pid_current()` returns a higher number than what you
+    /// are about to set (`max_pid`), then no processess will be killed. Additonally, attaching
+    /// extra processes to a control group disregards the limit.
+    pub fn set_pid_max(&self, max_pid: MaxValue) -> Result<()> {
+        self.open_path("pids.max", true).and_then(|mut file| {
+            let string_to_write = max_pid.to_string();
+            match file.write_all(string_to_write.as_ref()) {
+                Ok(_) => Ok(()),
+                Err(e) => Err(Error::with_cause(
+                    WriteFailed("pids.max".to_string(), format!("{:?}", max_pid)),
+                    e,
+                )),
+            }
+        })
+    }
+}

src/fs/rdma.rs

@@ -0,0 +1,97 @@
+// Copyright (c) 2018 Levente Kurusa
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! This module contains the implementation of the `rdma` cgroup subsystem.
+//!
+//! See the Kernel's documentation for more information about this subsystem, found at:
+//!  [Documentation/cgroup-v1/rdma.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/rdma.txt)
+use std::io::Write;
+use std::path::PathBuf;
+
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
+
+use crate::fs::read_string_from;
+use crate::fs::{ControllIdentifier, ControllerInternal, Controllers, Resources, Subsystem};
+
+/// A controller that allows controlling the `rdma` subsystem of a Cgroup.
+///
+/// In essence, using this controller one can limit the RDMA/IB specific resources that the tasks
+/// in the control group can use.
+#[derive(Debug, Clone)]
+pub struct RdmaController {
+    base: PathBuf,
+    path: PathBuf,
+}
+
+impl ControllerInternal for RdmaController {
+    fn control_type(&self) -> Controllers {
+        Controllers::Rdma
+    }
+    fn get_path(&self) -> &PathBuf {
+        &self.path
+    }
+    fn get_path_mut(&mut self) -> &mut PathBuf {
+        &mut self.path
+    }
+    fn get_base(&self) -> &PathBuf {
+        &self.base
+    }
+
+    fn apply(&self, _res: &Resources) -> Result<()> {
+        Ok(())
+    }
+}
+
+impl ControllIdentifier for RdmaController {
+    fn controller_type() -> Controllers {
+        Controllers::Rdma
+    }
+}
+
+impl<'a> From<&'a Subsystem> for &'a RdmaController {
+    fn from(sub: &'a Subsystem) -> &'a RdmaController {
+        unsafe {
+            match sub {
+                Subsystem::Rdma(c) => c,
+                _ => {
+                    assert_eq!(1, 0);
+                    let v = std::mem::MaybeUninit::uninit();
+                    v.assume_init()
+                }
+            }
+        }
+    }
+}
+
+impl RdmaController {
+    /// Constructs a new `RdmaController` with `root` serving as the root of the control group.
+    pub fn new(point: PathBuf, root: PathBuf) -> Self {
+        Self {
+            base: root,
+            path: point,
+        }
+    }
+
+    /// Returns the current usage of RDMA/IB specific resources.
+    pub fn current(&self) -> Result<String> {
+        self.open_path("rdma.current", false)
+            .and_then(read_string_from)
+    }
+
+    /// Returns the max usage of RDMA/IB specific resources.
+    pub fn max(&self) -> Result<String> {
+        self.open_path("rdma.max", false).and_then(read_string_from)
+    }
+
+    /// Set a maximum usage for each RDMA/IB resource.
+    pub fn set_max(&self, max: &str) -> Result<()> {
+        self.open_path("rdma.max", true).and_then(|mut file| {
+            file.write_all(max.as_ref()).map_err(|e| {
+                Error::with_cause(WriteFailed("rdma.max".to_string(), max.to_string()), e)
+            })
+        })
+    }
+}

src/fs/systemd.rs

@@ -0,0 +1,72 @@
+// Copyright (c) 2020 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! This module contains the implementation of the `systemd` cgroup subsystem.
+//!
+use std::path::PathBuf;
+
+use crate::fs::error::*;
+
+use crate::fs::{ControllIdentifier, ControllerInternal, Controllers, Resources, Subsystem};
+
+/// A controller that allows controlling the `systemd` subsystem of a Cgroup.
+///
+#[derive(Debug, Clone)]
+pub struct SystemdController {
+    base: PathBuf,
+    path: PathBuf,
+    _v2: bool,
+}
+
+impl ControllerInternal for SystemdController {
+    fn control_type(&self) -> Controllers {
+        Controllers::Systemd
+    }
+    fn get_path(&self) -> &PathBuf {
+        &self.path
+    }
+    fn get_path_mut(&mut self) -> &mut PathBuf {
+        &mut self.path
+    }
+    fn get_base(&self) -> &PathBuf {
+        &self.base
+    }
+
+    fn apply(&self, _res: &Resources) -> Result<()> {
+        Ok(())
+    }
+}
+
+impl ControllIdentifier for SystemdController {
+    fn controller_type() -> Controllers {
+        Controllers::Systemd
+    }
+}
+
+impl<'a> From<&'a Subsystem> for &'a SystemdController {
+    fn from(sub: &'a Subsystem) -> &'a SystemdController {
+        unsafe {
+            match sub {
+                Subsystem::Systemd(c) => c,
+                _ => {
+                    assert_eq!(1, 0);
+                    let v = std::mem::MaybeUninit::uninit();
+                    v.assume_init()
+                }
+            }
+        }
+    }
+}
+
+impl SystemdController {
+    /// Constructs a new `SystemdController` with `root` serving as the root of the control group.
+    pub fn new(point: PathBuf, root: PathBuf, v2: bool) -> Self {
+        Self {
+            base: root,
+            path: point,
+            _v2: v2,
+        }
+    }
+}

src/hierarchies.rs

@@ -1,137 +0,0 @@
-//! This module represents the various control group hierarchies the Linux kernel supports.
-//!
-//! Currently, we only support the cgroupv1 hierarchy, but in the future we will add support for
-//! the Unified Hierarchy.
-
-use std::io::BufRead;
-use std::io::BufReader;
-use std::fs::File;
-use std::path::{Path, PathBuf};
-
-use {Controllers, Hierarchy, Subsystem};
-use ::pid::PidController;
-use ::memory::MemController;
-use ::cpuset::CpuSetController;
-use ::cpuacct::CpuAcctController;
-use ::cpu::CpuController;
-use ::freezer::FreezerController;
-use ::devices::DevicesController;
-use ::net_cls::NetClsController;
-use ::blkio::BlkIoController;
-use ::perf_event::PerfEventController;
-use ::net_prio::NetPrioController;
-use ::hugetlb::HugeTlbController;
-use ::rdma::RdmaController;
-
-use ::cgroup::Cgroup;
-
-
-/// The standard, original cgroup implementation. Often referred to as "cgroupv1".
-pub struct V1 {
-    mount_point: String,
-}
-
-impl Hierarchy for V1 {
-    fn subsystems(self: &Self) -> Vec<Subsystem> {
-        let mut subs = vec![];
-        if self.check_support(Controllers::Pids) {
-            subs.push(Subsystem::Pid(PidController::new(self.root())));
-        }
-        if self.check_support(Controllers::Mem) {
-            subs.push(Subsystem::Mem(MemController::new(self.root())));
-        }
-        if self.check_support(Controllers::CpuSet) {
-            subs.push(Subsystem::CpuSet(CpuSetController::new(self.root())));
-        }
-        if self.check_support(Controllers::CpuAcct) {
-            subs.push(Subsystem::CpuAcct(CpuAcctController::new(self.root())));
-        }
-        if self.check_support(Controllers::Cpu) {
-            subs.push(Subsystem::Cpu(CpuController::new(self.root())));
-        }
-        if self.check_support(Controllers::Devices) {
-            subs.push(Subsystem::Devices(DevicesController::new(self.root())));
-        }
-        if self.check_support(Controllers::Freezer) {
-            subs.push(Subsystem::Freezer(FreezerController::new(self.root())));
-        }
-        if self.check_support(Controllers::NetCls) {
-            subs.push(Subsystem::NetCls(NetClsController::new(self.root())));
-        }
-        if self.check_support(Controllers::BlkIo) {
-            subs.push(Subsystem::BlkIo(BlkIoController::new(self.root())));
-        }
-        if self.check_support(Controllers::PerfEvent) {
-            subs.push(Subsystem::PerfEvent(PerfEventController::new(self.root())));
-        }
-        if self.check_support(Controllers::NetPrio) {
-            subs.push(Subsystem::NetPrio(NetPrioController::new(self.root())));
-        }
-        if self.check_support(Controllers::HugeTlb) {
-            subs.push(Subsystem::HugeTlb(HugeTlbController::new(self.root())));
-        }
-        if self.check_support(Controllers::Rdma) {
-            subs.push(Subsystem::Rdma(RdmaController::new(self.root())));
-        }
-
-        subs
-    }
-
-    fn root_control_group(self: &Self) -> Cgroup {
-        Cgroup::load(self, "".to_string())
-    }
-
-    fn check_support(self: &Self, sub: Controllers) -> bool {
-        let root = self.root().read_dir().unwrap();
-        for entry in root {
-            if let Ok(entry) = entry {
-                if entry.file_name().into_string().unwrap() == sub.to_string() {
-                    return true;
-                }
-            }
-        }
-        return false;
-    }
-
-    fn root(self: &Self) -> PathBuf {
-        PathBuf::from(self.mount_point.clone())
-    }
-}
-
-impl V1 {
-    /// Finds where control groups are mounted to and returns a hierarchy in which control groups
-    /// can be created.
-    pub fn new() -> Self {
-        let mount_point = find_v1_mount().unwrap();
-        V1 {
-            mount_point: mount_point,
-        }
-    }
-}
-
-fn find_v1_mount() -> Option<String> {
-    /* Open mountinfo so we can get a parseable mount list */
-    let mountinfo_path = Path::new("/proc/self/mountinfo");
-
-    /* If /proc isn't mounted, or something else happens, then bail out */
-    if mountinfo_path.exists() == false {
-        return None;
-    }
-
-    let mountinfo_file = File::open(mountinfo_path).unwrap();
-    let mountinfo_reader = BufReader::new(&mountinfo_file);
-    for _line in mountinfo_reader.lines() {
-        let line = _line.unwrap();
-        let mut fields = line.split_whitespace();
-        let index = line.find(" - ").unwrap();
-        let mut more_fields = line[index + 3..].split_whitespace().collect::<Vec<_>>();
-        let fstype = more_fields[0];
-        if fstype == "tmpfs" && more_fields[2].contains("ro") {
-            let cgroups_mount = fields.nth(4).unwrap();
-            println!("found cgroups at {:?}", cgroups_mount);
-            return Some(cgroups_mount.to_string());
-        }
-    }
-
-    None
-}

src/hugetlb.rs

@@ -1,121 +0,0 @@
-//! This module contains the implementation of the `hugetlb` cgroup subsystem.
-//! 
-//! See the Kernel's documentation for more information about this subsystem, found at:
-//!  [Documentation/cgroup-v1/hugetlb.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/hugetlb.txt)
-use std::path::PathBuf;
-use std::fs::File;
-use std::io::{Write, Read};
-
-use {CgroupError, HugePageResources, Controllers, Controller, Resources, ControllIdentifier, Subsystem};
-use CgroupError::*;
-
-
-/// A controller that allows controlling the `hugetlb` subsystem of a Cgroup.
-///
-/// In essence, using this controller it is possible to limit the use of hugepages in the tasks of
-/// the control group.
-#[derive(Debug, Clone)]
-pub struct HugeTlbController {
-    base: PathBuf,
-    path: PathBuf,
-}
-
-impl Controller for HugeTlbController {
-    fn control_type(self: &Self) -> Controllers { Controllers::HugeTlb }
-    fn get_path<'a>(self: &'a Self) -> &'a PathBuf { &self.path }
-    fn get_path_mut<'a>(self: &'a mut Self) -> &'a mut PathBuf { &mut self.path }
-    fn get_base<'a>(self: &'a Self) -> &'a PathBuf { &self.base }
-
-    fn apply(self: &Self, res: &Resources) {
-        /* get the resources that apply to this controller */
-        let res: &HugePageResources = &res.hugepages;
-
-        if res.update_values {
-            for i in &res.limits {
-                let _ = self.set_limit_in_bytes(&i.size, i.limit);
-            }
-        }
-    }
-}
-
-impl ControllIdentifier for HugeTlbController {
-    fn controller_type() -> Controllers {
-        Controllers::HugeTlb
-    }
-}
-
-impl<'a> From<&'a Subsystem> for &'a HugeTlbController {
-    fn from(sub: &'a Subsystem) -> &'a HugeTlbController {
-        unsafe {
-            match sub {
-                Subsystem::HugeTlb(c) => c,
-                _ => {
-                    assert_eq!(1, 0);
-                    ::std::mem::uninitialized()
-                },
-            }
-        }
-    }
-}
-
-fn read_u64_from(mut file: File) -> Result<u64, CgroupError> {
-    let mut string = String::new();
-    match file.read_to_string(&mut string) {
-        Ok(_) => string.trim().parse().map_err(|_| ParseError),
-        Err(e) => Err(CgroupError::ReadError(e)),
-    }
-}
-
-impl HugeTlbController {
-    /// Constructs a new `HugeTlbController` with `oroot` serving as the root of the control group.
-    pub fn new(oroot: PathBuf) -> Self {
-        let mut root = oroot;
-        root.push(Self::controller_type().to_string());
-        Self {
-            base: root.clone(),
-            path: root,
-        }
-    }
-
-    /// Whether the system supports `hugetlb_size` hugepages.
-    pub fn size_supported(self: &Self, _hugetlb_size: String) -> bool {
-        /* TODO */
-        true
-    }
-
-    /// Check how many times has the limit of `hugetlb_size` hugepages been hit.
-    pub fn failcnt(self: &Self, hugetlb_size: &String) -> Result<u64, CgroupError> {
-        self.open_path(&format!("hugetlb.{}.failcnt", hugetlb_size), false)
-            .and_then(read_u64_from)
-    }
-
-    /// Get the limit (in bytes) of how much memory can be backed by hugepages of a certain size
-    /// (`hugetlb_size`).
-    pub fn limit_in_bytes(self: &Self, hugetlb_size: &String) -> Result<u64, CgroupError> {
-        self.open_path(&format!("hugetlb.{}.limit_in_bytes", hugetlb_size), false)
-            .and_then(read_u64_from)
-    }
-
-    /// Get the current usage of memory that is backed by hugepages of a certain size
-    /// (`hugetlb_size`).
-    pub fn usage_in_bytes(self: &Self, hugetlb_size: &String) -> Result<u64, CgroupError> {
-        self.open_path(&format!("hugetlb.{}.usage_in_bytes", hugetlb_size), false)
-            .and_then(read_u64_from)
-    }
-
-    /// Get the maximum observed usage of memory that is backed by hugepages of a certain size
-    /// (`hugetlb_size`).
-    pub fn max_usage_in_bytes(self: &Self, hugetlb_size: &String) -> Result<u64, CgroupError> {
-        self.open_path(&format!("hugetlb.{}.max_usage_in_bytes", hugetlb_size), false)
-            .and_then(read_u64_from)
-    }
-
-    /// Set the limit (in bytes) of how much memory can be backed by hugepages of a certain size
-    /// (`hugetlb_size`).
-    pub fn set_limit_in_bytes(self: &Self, hugetlb_size: &String, limit: u64) -> Result<(), CgroupError> {
-        self.open_path(&format!("hugetlb.{}.limit_in_bytes", hugetlb_size), false)
-            .and_then(|mut file| {
-                file.write_all(limit.to_string().as_ref()).map_err(CgroupError::WriteError)
-            })
-    }
-}

src/lib.rs

@@ -1,441 +1,37 @@
-use std::path::PathBuf;
-use std::fs::File;
-use std::io::{BufRead, BufReader, Write};
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020-2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
 
-pub mod hierarchies;
-pub mod pid;
-pub mod memory;
-pub mod cpuset;
-pub mod cpuacct;
-pub mod cpu;
-pub mod devices;
-pub mod cgroup;
-pub mod freezer;
-pub mod net_cls;
-pub mod blkio;
-pub mod perf_event;
-pub mod net_prio;
-pub mod hugetlb;
-pub mod rdma;
+pub mod fs;
+#[cfg(feature = "oci")]
+pub mod manager;
+#[cfg(feature = "oci")]
+pub use manager::{FsManager, Manager, SystemdManager};
+pub mod stats;
+pub use stats::CgroupStats;
+pub mod systemd;
 
-use pid::PidController;
-use memory::MemController;
-use cpuset::CpuSetController;
-use cpuacct::CpuAcctController;
-use cpu::CpuController;
-use freezer::FreezerController;
-use devices::DevicesController;
-use net_cls::NetClsController;
-use blkio::BlkIoController;
-use perf_event::PerfEventController;
-use net_prio::NetPrioController;
-use hugetlb::HugeTlbController;
-use rdma::RdmaController;
+/// The maximum value for CPU shares in cgroups v1
+pub const CPU_SHARES_V1_MAX: u64 = 262144;
+/// The maximum value for CPU weight in cgroups v2
+pub const CPU_WEIGHT_V2_MAX: u64 = 10000;
 
-pub use cgroup::Cgroup;
-
-/// Contains all the subsystems that are available in this crate.
-#[derive(Debug)]
-pub enum Subsystem {
-    /// Controller for the `Pid` subsystem, see `PidController` for more information.
-    Pid(PidController),
-    /// Controller for the `Mem` subsystem, see `MemController` for more information.
-    Mem(MemController),
-    /// Controller for the `CpuSet subsystem, see `CpuSetController` for more information.
-    CpuSet(CpuSetController),
-    /// Controller for the `CpuAcct` subsystem, see `CpuAcctController` for more information.
-    CpuAcct(CpuAcctController),
-    /// Controller for the `Cpu` subsystem, see `CpuController` for more information.
-    Cpu(CpuController),
-    /// Controller for the `Devices` subsystem, see `DevicesController` for more information.
-    Devices(DevicesController),
-    /// Controller for the `Freezer` subsystem, see `FreezerController` for more information.
-    Freezer(FreezerController),
-    /// Controller for the `NetCls` subsystem, see `NetClsController` for more information.
-    NetCls(NetClsController),
-    /// Controller for the `BlkIo` subsystem, see `BlkIoController` for more information.
-    BlkIo(BlkIoController),
-    /// Controller for the `PerfEvent` subsystem, see `PerfEventController` for more information.
-    PerfEvent(PerfEventController),
-    /// Controller for the `NetPrio` subsystem, see `NetPrioController` for more information.
-    NetPrio(NetPrioController),
-    /// Controller for the `HugeTlb` subsystem, see `HugeTlbController` for more information.
-    HugeTlb(HugeTlbController),
-    /// Controller for the `Rdma` subsystem, see `RdmaController` for more information.
-    Rdma(RdmaController),
-}
-
-/// The different types of errors that can occur while manipulating control groups.
-#[derive(Debug)]
-pub enum CgroupError {
-    /// An error occured while writing to a control group file.
-    WriteError(std::io::Error),
-    /// An error occured while trying to read from a control group file.
-    ReadError(std::io::Error),
-    /// An error occured while trying to parse a value from a control group file.
-    ///
-    /// In the future, there will be some information attached to this field.
-    ParseError,
-    /// You tried to do something invalid.
-    ///
-    /// This could be because you tried to set a value in a control group that is not a root
-    /// control group. Or, when using unified hierarchy, you tried to add a task in a leaf node.
-    InvalidOperation,
-    /// The path of the control group was invalid.
-    ///
-    /// This could be caused by trying to escape the control group filesystem via a string of "..".
-    /// This crate checks against this and operations will fail with this error.
-    InvalidPath,
-}
-
-#[doc(hidden)]
-#[derive(Eq, PartialEq, Debug)]
-pub enum Controllers {
-    Pids,
-    Mem,
-    CpuSet,
-    CpuAcct,
-    Cpu,
-    Devices,
-    Freezer,
-    NetCls,
-    BlkIo,
-    PerfEvent,
-    NetPrio,
-    HugeTlb,
-    Rdma,
-}
-
-impl Controllers {
-    pub fn to_string(self: &Self) -> String {
-        match self {
-            Controllers::Pids => return "pids".to_string(),
-            Controllers::Mem => return "memory".to_string(),
-            Controllers::CpuSet => return "cpuset".to_string(),
-            Controllers::CpuAcct => return "cpuacct".to_string(),
-            Controllers::Cpu => return "cpu".to_string(),
-            Controllers::Devices => return "devices".to_string(),
-            Controllers::Freezer => return "freezer".to_string(),
-            Controllers::NetCls => return "net_cls".to_string(),
-            Controllers::BlkIo => return "blkio".to_string(),
-            Controllers::PerfEvent => return "perf_event".to_string(),
-            Controllers::NetPrio => return "net_prio".to_string(),
-            Controllers::HugeTlb => return "hugetlb".to_string(),
-            Controllers::Rdma => return "rdma".to_string(),
-        }
-    }
-}
-
-/// A Controller is a subsystem attached to the control group.
-///
-/// Implementors are able to control certain aspects of a control group.
-pub trait Controller {
-    /// Apply a set of resources to the Controller, invoking its internal functions to pass the
-    /// kernel the information.
-    fn apply(self: &Self, res: &Resources);
-
-    /* meta stuff */
-    #[doc(hidden)]
-    fn control_type(self: &Self) -> Controllers;
-    #[doc(hidden)]
-    fn get_path<'a>(self: &'a Self) -> &'a PathBuf;
-    #[doc(hidden)]
-    fn get_path_mut<'a>(self: &'a mut Self) -> &'a mut PathBuf;
-    #[doc(hidden)]
-    fn get_base<'a>(self: &'a Self) -> &'a PathBuf;
-
-    #[doc(hidden)]
-    fn verify_path(self: &Self) -> bool {
-        self.get_path().starts_with(self.get_base())
-    }
-
-    /// Create this controller
-    fn create(self: &Self) {
-        if self.verify_path() {
-            match ::std::fs::create_dir(self.get_path()) {
-                Ok(_) => (),
-                Err(e) => println!("error create_dir {:?}", e),
-            }
-        }
-    }
-
-    /// Does this controller already exist?
-    fn exists(self: &Self) -> bool {
-        self.get_path().exists()
-    }
-
-    /// Delete the controller.
-    fn delete(self: &Self) {
-        if self.get_path().exists() {
-            let _ = ::std::fs::remove_dir(self.get_path());
-        }
-    }
-
-    #[doc(hidden)]
-    fn open_path(self: &Self, p: &str, w: bool) -> Result<File, CgroupError> {
-        let mut path = self.get_path().clone();
-        path.push(p);
-
-        if !self.verify_path() {
-            return Err(CgroupError::InvalidPath);
-        }
-
-        if w {
-            match File::create(&path) {
-                Err(e) => return Err(CgroupError::WriteError(e)),
-                Ok(file) => return Ok(file),
-            }
-        } else {
-            match File::open(&path) {
-                Err(e) => return Err(CgroupError::ReadError(e)),
-                Ok(file) => return Ok(file),
-            }
-        }
-    }
-
-    /// Attach a task to this controller.
-    fn add_task(self: &Self, pid: &CgroupPid) -> Result<(), CgroupError> {
-        self.open_path("tasks", true).and_then(|mut file| {
-            file.write_all(pid.pid.to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Get the list of tasks that this controller has.
-    fn tasks(self: &Self) -> Vec<CgroupPid> {
-        self.open_path("tasks", false).and_then(|file| {
-            let bf = BufReader::new(file);
-            let mut v = Vec::new();
-            for line in bf.lines() {
-                if let Ok(line) = line {
-                    let n = line.trim().parse().unwrap_or(0u64);
-                    v.push(n);
-                }
-            }
-            Ok(v.into_iter().map(CgroupPid::from).collect())
-        }).unwrap_or(vec![])
-    }
-}
-
-#[doc(hidden)]
-pub trait ControllIdentifier {
-    fn controller_type() -> Controllers;
-}
-
-/// Control group hierarchy (right now, only V1 is supported, but in the future Unified will be
-/// implemented as well).
-pub trait Hierarchy {
-    /// Returns what subsystems are supported by the hierarchy.
-    fn subsystems(self: &Self) -> Vec<Subsystem>;
-
-    /// Returns the root directory of the hierarchy.
-    fn root(self: &Self) -> PathBuf;
-
-    /// Return a handle to the root control group in the hierarchy.
-    fn root_control_group(self: &Self) -> Cgroup;
-
-    /// Checks whether a certain subsystem is supported in the hierarchy.
-    ///
-    /// This is an internal function and should not be used.
-    #[doc(hidden)]
-    fn check_support(self: &Self, sub: Controllers) -> bool;
-}
-
-/// Resource limits for the memory subsystem.
-#[derive(Debug, Clone, Eq, PartialEq, Default)]
-pub struct MemoryResources {
-    /// Whether values should be applied to the controller.
-    pub update_values: bool,
-    /// How much memory (in bytes) can the kernel consume.
-    pub kernel_memory_limit: u64,
-    /// Upper limit of memory usage of the control group's tasks.
-    pub memory_hard_limit: u64,
-    /// How much memory the tasks in the control group can use when the system is under memory
-    /// pressure.
-    pub memory_soft_limit: u64,
-    /// How much of the kernel's memory (in bytes) can be used for TCP-related buffers.
-    pub kernel_tcp_memory_limit: u64,
-    /// How much memory and swap together can the tasks in the control group use.
-    pub memory_swap_limit: u64,
-    /// Controls the tendency of the kernel to swap out parts of the address space of the tasks to
-    /// disk. Lower value implies less likely.
-    ///
-    /// Note, however, that a value of zero does not mean the process is never swapped out. Use the
-    /// traditional `mlock(2)` system call for that purpose.
-    pub swappiness: u64,
-}
-
-/// Resources limits on the number of processes.
-#[derive(Debug, Clone, Eq, PartialEq, Default)]
-pub struct PidResources {
-    /// Whether values should be applied to the controller.
-    pub update_values: bool,
-    /// The maximum number of processes that can exist in the control group.
-    ///
-    /// Note that attaching processes to the control group will still succeed _even_ if the limit
-    /// would be violated, however forks/clones inside the control group will have with `EAGAIN` if
-    /// they would violate the limit set here.
-    pub maximum_number_of_processes: pid::PidMax,
-}
-
-/// Resources limits about how the tasks can use the CPU.
-#[derive(Debug, Clone, Eq, PartialEq, Default)]
-pub struct CpuResources {
-    /// Whether values should be applied to the controller.
-    pub update_values: bool,
-    /* cpuset */
-    /// A comma-separated list of CPU IDs where the task in the control group can run. Dashes
-    /// between numbers indicate ranges.
-    pub cpus: String,
-    /// Same syntax as the `cpus` field of this structure, but applies to memory nodes instead of
-    /// processors.
-    pub mems: String,
-    /* cpu */
-    /// Weight of how much of the total CPU time should this control group get. Note that this is
-    /// hierarchical, so this is weighted against the siblings of this control group.
-    pub shares: u64,
-    /// In one `period`, how much can the tasks run in nanoseconds.
-    pub quota: i64,
-    /// Period of time in nanoseconds.
-    pub period: u64,
-    /// This is currently a no-operation.
-    pub realtime_runtime: i64,
-    /// This is currently a no-operation.
-    pub realtime_period: u64,
-}
-
-/// A device resource that can be allowed or denied access to.
-#[derive(Debug, Clone, Eq, PartialEq, Default)]
-pub struct DeviceResource {
-    /// If true, access to the device is allowed, otherwise it's denied.
-    pub allow: bool,
-    /// `'c'` for character device, `'b'` for block device; or `'a'` for all devices.
-    pub devtype: String,
-    /// The major number of the device.
-    pub major: u64,
-    /// The minor number of the device.
-    pub minor: u64,
-    /// Sequence of `'r'`, `'w'` or `'m'`, each denoting read, write or mknod permissions.
-    pub access: String,
-}
-
-/// Limit the usage of devices for the control group's tasks.
-#[derive(Debug, Clone, Eq, PartialEq, Default)]
-pub struct DeviceResources {
-    /// Whether values should be applied to the controller.
-    pub update_values: bool,
-    /// For each device in the list, the limits in the structure are applied.
-    pub devices: Vec<DeviceResource>,
-}
-
-/// Assigned priority for a network device.
-#[derive(Debug, Clone, Eq, PartialEq, Default)]
-pub struct NetworkPriority {
-    /// The name (as visible in `ifconfig`) of the interface.
-    pub name: String,
-    /// Assigned priority.
-    pub priority: u64,
-}
-
-/// Collections of limits and tags that can be imposed on packets emitted by the tasks in the
-/// control group.
-#[derive(Debug, Clone, Eq, PartialEq, Default)]
-pub struct NetworkResources {
-    /// Whether values should be applied to the controller.
-    pub update_values: bool,
-    /// The networking class identifier to attach to the packets.
-    ///
-    /// This can then later be used in iptables and such to have special rules.
-    pub class_id: u64,
-    /// Priority of the egress traffic for each interface.
-    pub priorities: Vec<NetworkPriority>,
-}
-
-/// A hugepage type and its consumption limit for the control group.
-#[derive(Debug, Clone, Eq, PartialEq, Default)]
-pub struct HugePageResource {
-    /// The size of the hugepage, i.e. `2MB`, `1GB`, etc.
-    pub size: String,
-    /// The amount of bytes (of memory consumed by the tasks) that are allowed to be backed by
-    /// hugepages.
-    pub limit: u64,
-}
-
-/// Provides the ability to set consumption limit on each type of hugepages.
-#[derive(Debug, Clone, Eq, PartialEq, Default)]
-pub struct HugePageResources {
-    /// Whether values should be applied to the controller.
-    pub update_values: bool,
-    /// Set a limit of consumption for each hugepages type.
-    pub limits: Vec<HugePageResource>,
-}
-
-/// Weight for a particular block device.
-#[derive(Debug, Clone, Eq, PartialEq, Default)]
-pub struct BlkIoDeviceResource {
-    /// The major number of the device.
-    pub major: u64,
-    /// The minor number of the device.
-    pub minor: u64,
-    /// The weight of the device against the descendant nodes.
-    pub weight: u16,
-    /// The weight of the device against the sibling nodes.
-    pub leaf_weight: u16,
-}
-
-/// Provides the ability to throttle a device (both byte/sec, and IO op/s)
-#[derive(Debug, Clone, Eq, PartialEq, Default)]
-pub struct BlkIoDeviceThrottleResource {
-    /// The major number of the device.
-    pub major: u64,
-    /// The minor number of the device.
-    pub minor: u64,
-    /// The rate.
-    pub rate: u64,
-}
-
-/// General block I/O resource limits.
-#[derive(Debug, Clone, Eq, PartialEq, Default)]
-pub struct BlkIoResources {
-    /// Whether values should be applied to the controller.
-    pub update_values: bool,
-    /// The weight of the control group against descendant nodes.
-    pub weight: u16,
-    /// The weight of the control group against sibling nodes.
-    pub leaf_weight: u16,
-    /// For each device, a separate weight (both normal and leaf) can be provided.
-    pub weight_device: Vec<BlkIoDeviceResource>,
-    /// Throttled read bytes/second can be provided for each device.
-    pub throttle_read_bps_device: Vec<BlkIoDeviceThrottleResource>,
-    /// Throttled read IO operations per second can be provided for each device.
-    pub throttle_read_iops_device: Vec<BlkIoDeviceThrottleResource>,
-    /// Throttled written bytes/second can be provided for each device.
-    pub throttle_write_bps_device: Vec<BlkIoDeviceThrottleResource>,
-    /// Throttled write IO operations per second can be provided for each device.
-    pub throttle_write_iops_device: Vec<BlkIoDeviceThrottleResource>,
-}
-
-/// The resource limits and constraints that will be set on the control group.
-#[derive(Debug, Clone, Eq, PartialEq, Default)]
-pub struct Resources {
-    /// Memory usage related limits.
-    pub memory: MemoryResources,
-    /// Process identifier related limits.
-    pub pid: PidResources,
-    /// CPU related limits.
-    pub cpu: CpuResources,
-    /// Device related limits.
-    pub devices: DeviceResources,
-    /// Network related tags and limits.
-    pub network: NetworkResources,
-    /// Hugepages consumption related limits.
-    pub hugepages: HugePageResources,
-    /// Block device I/O related limits.
-    pub blkio: BlkIoResources,
+/// The current state of the control group
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub enum FreezerState {
+    /// The processes in the control group are _not_ frozen.
+    Thawed,
+    /// The processes in the control group are in the processes of being frozen.
+    Freezing,
+    /// The processes in the control group are frozen.
+    Frozen,
 }
 
 /// A structure representing a `pid`. Currently implementations exist for `u64` and
 /// `std::process::Child`.
-#[derive(Debug, PartialEq, Eq, PartialOrd, Ord)]
+#[derive(Debug, PartialEq, Eq, PartialOrd, Ord, Clone, Copy)]
 pub struct CgroupPid {
     /// The process identifier
     pub pid: u64,
@@ -443,107 +39,44 @@ pub struct CgroupPid {
 
 impl From<u64> for CgroupPid {
     fn from(u: u64) -> CgroupPid {
-        CgroupPid {
-            pid: u,
-        }
+        CgroupPid { pid: u }
     }
 }
 
-impl<'a> From<&'a std::process::Child> for CgroupPid {
+impl From<&std::process::Child> for CgroupPid {
     fn from(u: &std::process::Child) -> CgroupPid {
-        CgroupPid {
-            pid: u.id() as u64,
-        }
+        CgroupPid { pid: u.id() as u64 }
     }
 }
 
+#[cfg(test)]
+pub mod tests {
+    use std::fs;
+    use std::process::{Child, Command, Stdio};
 
-impl Subsystem {
-    fn enter(self: Self, path: &String) -> Self {
-        match self {
-            Subsystem::Pid(cont) => Subsystem::Pid({
-                let mut c = cont.clone();
-                c.get_path_mut().push(path);
-                c
-            }),
-            Subsystem::Mem(cont) => Subsystem::Mem({
-                let mut c = cont.clone();
-                c.get_path_mut().push(path);
-                c
-            }),
-            Subsystem::CpuSet(cont) => Subsystem::CpuSet({
-                let mut c = cont.clone();
-                c.get_path_mut().push(path);
-                c
-            }),
-            Subsystem::CpuAcct(cont) => Subsystem::CpuAcct({
-                let mut c = cont.clone();
-                c.get_path_mut().push(path);
-                c
-            }),
-            Subsystem::Cpu(cont) => Subsystem::Cpu({
-                let mut c = cont.clone();
-                c.get_path_mut().push(path);
-                c
-            }),
-            Subsystem::Devices(cont) => Subsystem::Devices({
-                let mut c = cont.clone();
-                c.get_path_mut().push(path);
-                c
-            }),
-            Subsystem::Freezer(cont) => Subsystem::Freezer({
-                let mut c = cont.clone();
-                c.get_path_mut().push(path);
-                c
-            }),
-            Subsystem::NetCls(cont) => Subsystem::NetCls({
-                let mut c = cont.clone();
-                c.get_path_mut().push(path);
-                c
-            }),
-            Subsystem::BlkIo(cont) => Subsystem::BlkIo({
-                let mut c = cont.clone();
-                c.get_path_mut().push(path);
-                c
-            }),
-            Subsystem::PerfEvent(cont) => Subsystem::PerfEvent({
-                let mut c = cont.clone();
-                c.get_path_mut().push(path);
-                c
-            }),
-            Subsystem::NetPrio(cont) => Subsystem::NetPrio({
-                let mut c = cont.clone();
-                c.get_path_mut().push(path);
-                c
-            }),
-            Subsystem::HugeTlb(cont) => Subsystem::HugeTlb({
-                let mut c = cont.clone();
-                c.get_path_mut().push(path);
-                c
-            }),
-            Subsystem::Rdma(cont) => Subsystem::Rdma({
-                let mut c = cont.clone();
-                c.get_path_mut().push(path);
-                c
-            }),
-        }
+    /// Start a mock subprocess that will sleep forever
+    pub fn spawn_sleep_inf() -> Child {
+        let child = Command::new("sleep")
+            .arg("infinity")
+            .spawn()
+            .expect("Failed to start mock subprocess");
+        child
     }
 
-    fn to_controller(self: &Self) -> &dyn Controller {
-        match self {
-            Subsystem::Pid(cont) => cont,
-            Subsystem::Mem(cont) => cont,
-            Subsystem::CpuSet(cont) => cont,
-            Subsystem::CpuAcct(cont) => cont,
-            Subsystem::Cpu(cont) => cont,
-            Subsystem::Devices(cont) => cont,
-            Subsystem::Freezer(cont) => cont,
-            Subsystem::NetCls(cont) => cont,
-            Subsystem::BlkIo(cont) => cont,
-            Subsystem::PerfEvent(cont) => cont,
-            Subsystem::NetPrio(cont) => cont,
-            Subsystem::HugeTlb(cont) => cont,
-            Subsystem::Rdma(cont) => cont,
+    pub fn spawn_yes() -> Child {
+        let devnull = fs::File::create("/dev/null").expect("cannot open /dev/null");
+        let child = Command::new("yes")
+            .stdout(Stdio::from(devnull))
+            .spawn()
+            .expect("Failed to start mock subprocess");
+        child
+    }
+
+    pub fn systemd_version() -> Option<String> {
+        let output = Command::new("systemd").arg("--version").output().ok()?; // Return None if command execution fails
+        if !output.status.success() {
+            return None;
         }
+        Some(String::from_utf8_lossy(&output.stdout).to_string())
     }
 }

src/manager/conv.rs

@@ -0,0 +1,113 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use crate::manager::error::{Error, Result};
+use crate::{CPU_SHARES_V1_MAX, CPU_WEIGHT_V2_MAX};
+
+// Converts CPU shares, used by cgroup v1, to CPU weight, used by cgroup
+// v2.
+//
+// Cgroup v1 CPU shares has a range of [2^1...2^18], i.e. [2...262144],
+// and the default value is 1024.
+//
+// Cgroup v2 CPU weight has a range of [10^0...10^4], i.e. [1...10000],
+// and the default value is 100.
+pub(crate) fn cpu_shares_to_cgroup_v2(shares: u64) -> u64 {
+    if shares == 0 {
+        return 0;
+    }
+    if shares <= 2 {
+        return 1;
+    }
+    if shares >= CPU_SHARES_V1_MAX {
+        return CPU_WEIGHT_V2_MAX;
+    }
+
+    (((shares - 2) * 9999) / 262142) + 1
+}
+
+// ConvertMemorySwapToCgroupV2Value converts MemorySwap value from OCI spec
+// for use by cgroup v2 drivers. A conversion is needed since
+// Resources.MemorySwap is defined as memory+swap combined, while in cgroup
+// v2 swap is a separate value.
+pub(crate) fn memory_swap_to_cgroup_v2(memswap_limit: i64, mem_limit: i64) -> Result<i64> {
+    // For compatibility with cgroup1 controller, set swap to unlimited in
+    // case the memory is set to unlimited, and swap is not explicitly set,
+    // treating the request as "set both memory and swap to unlimited".
+    if mem_limit == -1 && memswap_limit == 0 {
+        return Ok(-1);
+    }
+
+    // -1 is "max", 0 is "unset", so treat as is
+    if memswap_limit == -1 || memswap_limit == 0 {
+        return Ok(memswap_limit);
+    }
+
+    // Unlimited memory, so treat swap as is.
+    if mem_limit == -1 {
+        return Ok(memswap_limit);
+    }
+
+    // Unset or unknown memory, can't calculate swap.
+    if mem_limit == 0 {
+        return Err(Error::InvalidLinuxResource);
+    }
+
+    // Does not make sense to subtract a negative value.
+    if mem_limit < 0 {
+        return Err(Error::InvalidLinuxResource);
+    }
+
+    // Sanity check.
+    if memswap_limit < mem_limit {
+        return Err(Error::InvalidLinuxResource);
+    }
+
+    Ok(memswap_limit - mem_limit)
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::manager::conv::*;
+
+    #[test]
+    fn test_cpu_shares_to_cgroup_v2() {
+        assert_eq!(cpu_shares_to_cgroup_v2(0), 0);
+        assert_eq!(cpu_shares_to_cgroup_v2(1), 1);
+        assert_eq!(cpu_shares_to_cgroup_v2(2), 1);
+        assert_eq!(cpu_shares_to_cgroup_v2(100), 4);
+        assert_eq!(
+            cpu_shares_to_cgroup_v2(CPU_SHARES_V1_MAX),
+            CPU_WEIGHT_V2_MAX
+        );
+        assert_eq!(
+            cpu_shares_to_cgroup_v2(CPU_SHARES_V1_MAX - 1),
+            CPU_WEIGHT_V2_MAX - 1
+        );
+        assert_eq!(cpu_shares_to_cgroup_v2(u64::MAX), CPU_WEIGHT_V2_MAX);
+    }
+
+    #[test]
+    fn test_memory_swap_to_cgroup_v2() {
+        // memory no limit and swap is 0, treat it as no limit
+        assert_eq!(memory_swap_to_cgroup_v2(0, -1).unwrap(), -1);
+        // -1 is "max", 0 is "unset", so treat as is
+        assert_eq!(memory_swap_to_cgroup_v2(-1, 0).unwrap(), -1);
+        assert_eq!(memory_swap_to_cgroup_v2(0, 0).unwrap(), 0);
+
+        // Now swap cannot be 0 or -1
+
+        // Unlimited memory, so treat swap as is.
+        assert_eq!(memory_swap_to_cgroup_v2(100, -1).unwrap(), 100);
+        // Unset or unknown memory, can't calculate swap.
+        assert!(memory_swap_to_cgroup_v2(100, 0).is_err());
+        // Does not make sense to subtract a negative value.
+        assert!(memory_swap_to_cgroup_v2(100, -2).is_err());
+        // Swap + mem < mem
+        assert!(memory_swap_to_cgroup_v2(50, 100).is_err());
+        // Real swap
+        assert_eq!(memory_swap_to_cgroup_v2(200, 100).unwrap(), 100);
+    }
+}

src/manager/error.rs

@@ -0,0 +1,28 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use crate::fs::error::Error as CgroupfsError;
+use crate::systemd::dbus::error::Error as SystemdDbusError;
+use crate::systemd::error::Error as SystemdCgroupError;
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+#[derive(thiserror::Error, Debug)]
+pub enum Error {
+    #[error("invalid argument")]
+    InvalidArgument,
+
+    #[error("invalid linux resource")]
+    InvalidLinuxResource,
+
+    #[error("cgroupfs error: {0}")]
+    Cgroupfs(#[from] CgroupfsError),
+
+    #[error("systemd cgroup error: {0}")]
+    SystemdCgroup(#[from] SystemdCgroupError),
+
+    #[error("systemd dbus error: {0}")]
+    SystemdDbus(#[from] SystemdDbusError),
+}

src/manager/mod.rs

@@ -0,0 +1,113 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+mod error;
+use std::collections::HashMap;
+
+pub use error::{Error, Result};
+mod fs;
+pub use fs::FsManager;
+mod systemd;
+pub use systemd::SystemdManager;
+mod conv;
+
+use oci_spec::runtime::LinuxResources;
+
+use crate::systemd::SLICE_SUFFIX;
+use crate::{CgroupPid, CgroupStats, FreezerState};
+
+/// Check if the cgroups path is a systemd cgroup.
+pub fn is_systemd_cgroup(cgroups_path: &str) -> bool {
+    let parts: Vec<&str> = cgroups_path.split(':').collect();
+    parts.len() == 3 && parts[0].ends_with(SLICE_SUFFIX)
+}
+
+/// Manage cgroups designed for OCI containers.
+pub trait Manager: Send + Sync {
+    /// Add a process specified by its tgid.
+    fn add_proc(&mut self, tgid: CgroupPid) -> Result<()>;
+
+    /// Add a thread specified by its pid.
+    fn add_thread(&mut self, pid: CgroupPid) -> Result<()>;
+
+    /// Get the list of pids joint to the cgroups.
+    fn pids(&self) -> Result<Vec<CgroupPid>>;
+
+    /// Set the freezer cgroup to the specified state.
+    fn freeze(&self, state: FreezerState) -> Result<()>;
+
+    /// Remove the cgroups.
+    fn destroy(&mut self) -> Result<()>;
+
+    /// Set the resources to the cgroups.
+    fn set(&mut self, resources: &LinuxResources) -> Result<()>;
+
+    /// Get the cgroup path.
+    ///
+    /// # Arguments
+    ///
+    /// - `subsystem`: cgroup subsystem, for cgroup v1 the value should not
+    ///   be empty, while for cgroup v2 the only valid value is `None`.
+    fn cgroup_path(&self, subsystem: Option<&str>) -> Result<String>;
+
+    /// Enable CPUs, topdown from root in cgroup hierarchy, this would be
+    /// useful for CPU hotplug in the guest.
+    ///
+    /// The caller should update cgroup resources manually, in particular
+    /// cpuset, after this, in order to use the new CPUs (or avoid using
+    /// offline CPUs).
+    ///
+    /// # Arguments
+    ///
+    /// - `cpus`: online CPUs in the same format with `cat
+    ///   /sys/devices/system/cpu/online`, e.g. "0-3,6-7".
+    fn enable_cpus_topdown(&self, cpus: &str) -> Result<()>;
+
+    /// Get cgroup stats.
+    fn stats(&self) -> CgroupStats;
+
+    /// Get the mappings of subsystems to their relative path. The full
+    /// path would be something like "{mountpoint}/{relative_path}". The
+    /// mappings of mountpoints see "mounts()".
+    fn paths(&self) -> &HashMap<String, String>;
+
+    /// Get the mappings of subsystems to their mountpoints. The full
+    /// path would be something like "{mountpoint}/{relative_path}". The
+    /// mappings of relative paths see "paths()".
+    fn mounts(&self) -> &HashMap<String, String>;
+
+    /// Indicate whether the cgroup manager is using systemd.
+    fn systemd(&self) -> bool;
+
+    /// Indicate whether the cgroup manager is using cgroup v2.
+    fn v2(&self) -> bool;
+}
+
+#[cfg(test)]
+mod tests {
+    pub const MEMORY_512M: i64 = 512 * 1024 * 1024; // 512 MiB
+    pub const MEMORY_1G: i64 = 1024 * 1024 * 1024; // 1 GiB
+    pub const MEMORY_2G: i64 = 2 * 1024 * 1024 * 1024; // 2 GiB
+
+    #[macro_export]
+    macro_rules! skip_if_cgroups_v1 {
+        () => {
+            if !$crate::fs::hierarchies::is_cgroup2_unified_mode() {
+                eprintln!("Skipping test in cgroups v1 mode");
+                return;
+            }
+        };
+    }
+
+    #[macro_export]
+    macro_rules! skip_if_cgroups_v2 {
+        () => {
+            if $crate::fs::hierarchies::is_cgroup2_unified_mode() {
+                eprintln!("Skipping test in cgroups v2 mode");
+                return;
+            }
+        };
+    }
+}

src/manager/systemd.rs

@@ -0,0 +1,570 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use std::collections::HashMap;
+
+use oci_spec::runtime::{LinuxCpu, LinuxMemory, LinuxPids, LinuxResources};
+use zbus::zvariant::Value as ZbusValue;
+
+use crate::manager::conv;
+use crate::manager::error::{Error, Result};
+use crate::manager::fs::{join_path, FsManager};
+use crate::systemd::props::PropertiesBuilder;
+use crate::systemd::utils::expand_slice;
+use crate::systemd::{
+    cpu, cpuset, memory, pids, Property, SystemdClient, DEFAULT_SLICE, SCOPE_SUFFIX, SLICE_SUFFIX,
+    TIMEOUT_STOP_USEC,
+};
+use crate::{CgroupPid, CgroupStats, FreezerState, Manager};
+
+/// Default kernel value for cpu quota period is 100000 us (100 ms), same
+/// for v1 [1] and v2 [2].
+///
+/// 1: https://www.kernel.org/doc/html/latest/scheduler/sched-bwc.html
+/// 2: https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2.html
+const DEFAULT_CPU_QUOTA_PERIOD: u64 = 100_000; // 100ms
+
+pub struct SystemdManager<'a> {
+    /// The name of slice
+    slice: String,
+    /// The name of unit
+    unit: String,
+    /// Systemd client
+    systemd_client: SystemdClient<'a>,
+    /// Cgroupfs manager
+    fs_manager: FsManager,
+}
+
+impl SystemdManager<'_> {
+    fn parse_slice_and_unit(path: &str) -> Result<(String, String)> {
+        let parts: Vec<&str> = path.split(':').collect();
+        if parts.len() != 3 {
+            return Err(Error::InvalidArgument);
+        }
+
+        let slice = if parts[0].is_empty() {
+            DEFAULT_SLICE.to_string()
+        } else {
+            parts[0].to_string()
+        };
+
+        let unit = new_unit_name(parts[1], parts[2]);
+
+        Ok((slice, unit))
+    }
+
+    /// Create a new `SystemdManager` from a cgroup path.
+    ///
+    /// # Arguments
+    ///
+    /// * `path` - A string slice that holds the cgroup path in the format
+    ///   "parent:scope_prefix:name".
+    pub fn new(path: &str) -> Result<Self> {
+        let (slice, unit) = Self::parse_slice_and_unit(path)?;
+        let props = PropertiesBuilder::default_cgroup(&slice, &unit).build();
+        let slice_base = expand_slice(&slice)?;
+
+        let fs_base = join_path(&slice_base, &unit);
+        let fs_manager = FsManager::new(&fs_base)?;
+
+        let cgroup = SystemdClient::new(&unit, props)?;
+
+        Ok(Self {
+            slice,
+            unit,
+            fs_manager,
+            systemd_client: cgroup,
+        })
+    }
+}
+
+impl SystemdManager<'_> {
+    /// Get the slice name.
+    pub fn slice(&self) -> &str {
+        &self.slice
+    }
+
+    /// Get the unit name.
+    pub fn unit(&self) -> &str {
+        &self.unit
+    }
+
+    fn set_cpuset(&self, props: &mut Vec<Property>, linux_cpu: &LinuxCpu) -> Result<()> {
+        if let Some(cpus) = linux_cpu.cpus().as_ref() {
+            let (id, value) = cpuset::cpus(cpus)?;
+            props.push((id, value.into()));
+        }
+
+        if let Some(mems) = linux_cpu.mems().as_ref() {
+            let (id, value) = cpuset::mems(mems)?;
+            props.push((id, value.into()));
+        }
+
+        Ok(())
+    }
+
+    fn set_cpu(&self, props: &mut Vec<Property>, linux_cpu: &LinuxCpu) -> Result<()> {
+        if let Some(shares) = linux_cpu.shares() {
+            let shares = if self.v2() {
+                conv::cpu_shares_to_cgroup_v2(shares)
+            } else {
+                shares
+            };
+            let (id, value) = cpu::shares(shares, self.v2())?;
+            props.push((id, value.into()));
+        }
+
+        let period = linux_cpu.period().unwrap_or(0);
+        let quota = linux_cpu.quota().unwrap_or(0);
+
+        if period != 0 {
+            let (id, value) = cpu::period(period)?;
+            props.push((id, value.into()));
+        }
+
+        if period != 0 || quota != 0 {
+            // Corresponds to USEC_INFINITY in systemd
+            let mut quota_systemd = u64::MAX;
+            let mut period = period;
+            if quota > 0 {
+                if period == 0 {
+                    period = DEFAULT_CPU_QUOTA_PERIOD;
+                }
+                // systemd converts CPUQuotaPerSecUSec (microseconds per
+                // CPU second) to CPUQuota (integer percentage of CPU)
+                // internally. This means that if a fractional percent of
+                // CPU is indicated by Resources.CpuQuota, we need to round
+                // up to the nearest 10ms (1% of a second) such that child
+                // cgroups can set the cpu.cfs_quota_us they expect.
+                quota_systemd = ((quota as u64) * s_to_us(1)) / period;
+                if quota_systemd % ms_to_us(10) != 0 {
+                    quota_systemd = (quota_systemd / ms_to_us(10) + 1) * ms_to_us(10);
+                }
+            }
+            let (id, value) = cpu::quota(quota_systemd)?;
+            props.push((id, value.into()));
+        }
+
+        Ok(())
+    }
+
+    fn set_memory(&self, props: &mut Vec<Property>, linux_memory: &LinuxMemory) -> Result<()> {
+        let v2 = self.v2();
+
+        let mem_limit = linux_memory.limit().unwrap_or(0);
+        if mem_limit != 0 {
+            let (id, value) = memory::limit(mem_limit, v2)?;
+            props.push((id, value.into()));
+        }
+
+        let reservation = linux_memory.reservation().unwrap_or(0);
+        if reservation != 0 && v2 {
+            let (id, value) = memory::low(reservation, v2)?;
+            props.push((id, value.into()));
+        }
+
+        let memswap_limit = linux_memory.swap().unwrap_or(0);
+        if memswap_limit != 0 && v2 {
+            let memswap_limit = conv::memory_swap_to_cgroup_v2(memswap_limit, mem_limit)?;
+            let (id, value) = memory::swap(memswap_limit, v2)?;
+            props.push((id, value.into()));
+        }
+
+        Ok(())
+    }
+
+    fn set_pids(&self, props: &mut Vec<Property>, linux_pids: &LinuxPids) -> Result<()> {
+        let limit = linux_pids.limit();
+        if limit == -1 || limit > 0 {
+            let (id, value) = pids::max(limit)?;
+            props.push((id, value.into()));
+        }
+
+        Ok(())
+    }
+
+    /// The systemd sends SIGTERM to processes in the unit on stop. Once a
+    /// timeout occurs, SIGKILL will be sent to the processes.
+    ///
+    /// The item could be retrieved by:
+    ///
+    /// ```bash
+    /// $ systemctl show <unit> -p TimeoutStopUSec
+    /// ```
+    pub fn set_term_timeout(&mut self, timeout_in_sec: u64) -> Result<()> {
+        let timeout_in_usec = timeout_in_sec * 1_000_000;
+        let prop = (TIMEOUT_STOP_USEC, ZbusValue::U64(timeout_in_usec));
+        self.systemd_client.set_properties(&[prop])?;
+        Ok(())
+    }
+}
+
+impl Manager for SystemdManager<'_> {
+    fn add_proc(&mut self, pid: CgroupPid) -> Result<()> {
+        if !self.systemd_client.exists() {
+            self.systemd_client.set_pid_prop(pid)?;
+            self.systemd_client.start()?;
+            // The fs_manager was created in load mode, which doesn't create
+            // the cgroups. So we create them here.
+            self.fs_manager.create_cgroups()?;
+            return Ok(());
+        }
+
+        let subcgroup = self.fs_manager.subcgroup();
+        self.systemd_client.add_process(pid, subcgroup)?;
+
+        Ok(())
+    }
+
+    /// `add_thread()` is the same as `add_proc()`, as systemd doesn't
+    /// expose an API to add a thread directly. As a result, the whole
+    /// threads belonging to one process will be added to this cgroup.
+    fn add_thread(&mut self, pid: CgroupPid) -> Result<()> {
+        self.add_proc(pid)
+    }
+
+    fn cgroup_path(&self, subsystem: Option<&str>) -> Result<String> {
+        self.fs_manager.cgroup_path(subsystem)
+    }
+
+    /// Destroy the cgroup and stop the transient unit.
+    ///
+    /// Please note that if the current manager is in the cgroup, the
+    /// manager will be killed with SIGTERM signal. If you do not intend
+    /// that, please ignore the signal and do cleanup things immediately.
+    /// Systemd will forcibly terminate the process with SIGKILL after a
+    /// while.
+    fn destroy(&mut self) -> Result<()> {
+        self.systemd_client.stop()?;
+        Ok(())
+    }
+
+    fn enable_cpus_topdown(&self, cpus: &str) -> Result<()> {
+        self.fs_manager.enable_cpus_topdown(cpus)
+    }
+
+    fn freeze(&self, state: FreezerState) -> Result<()> {
+        match state {
+            FreezerState::Thawed => self.systemd_client.thaw()?,
+            FreezerState::Frozen => self.systemd_client.freeze()?,
+            FreezerState::Freezing => return Err(Error::InvalidArgument),
+        }
+
+        Ok(())
+    }
+
+    fn pids(&self) -> Result<Vec<CgroupPid>> {
+        self.fs_manager.pids()
+    }
+
+    fn set(&mut self, resources: &LinuxResources) -> Result<()> {
+        let mut props = vec![];
+
+        if let Some(linux_cpu) = resources.cpu() {
+            self.set_cpuset(&mut props, linux_cpu)?;
+            self.set_cpu(&mut props, linux_cpu)?;
+        }
+
+        if let Some(linux_memory) = resources.memory() {
+            self.set_memory(&mut props, linux_memory)?;
+        }
+
+        if let Some(linux_pids) = resources.pids() {
+            self.set_pids(&mut props, linux_pids)?;
+        }
+
+        self.systemd_client.set_properties(&props)?;
+
+        Ok(())
+    }
+
+    fn stats(&self) -> CgroupStats {
+        self.fs_manager.stats()
+    }
+
+    fn paths(&self) -> &HashMap<String, String> {
+        self.fs_manager.paths()
+    }
+
+    fn mounts(&self) -> &HashMap<String, String> {
+        self.fs_manager.mounts()
+    }
+
+    fn systemd(&self) -> bool {
+        true
+    }
+
+    fn v2(&self) -> bool {
+        self.fs_manager.v2()
+    }
+}
+
+fn new_unit_name(scope_prefix: &str, name: &str) -> String {
+    // By default, we create a scope unless the user explicitly asks
+    // for a slice.
+    if !name.ends_with(SLICE_SUFFIX) {
+        if scope_prefix.is_empty() {
+            // {name}.scope
+            return format!("{}{}", name, SCOPE_SUFFIX);
+        }
+        // {scope_prefix}-{name}.scope
+        return format!("{}-{}{}", scope_prefix, name, SCOPE_SUFFIX);
+    }
+
+    name.to_string()
+}
+
+#[inline]
+/// Convert milliseconds to microseconds.
+fn ms_to_us(ms: u64) -> u64 {
+    ms * 1_000
+}
+
+#[inline]
+/// Convert seconds to microseconds.
+fn s_to_us(s: u64) -> u64 {
+    s * 1_000_000
+}
+
+#[cfg(test)]
+mod tests {
+    //! Tests for the `SystemdManager` implementation of the `Manager`
+    //! trait.
+    //!
+    //! Don't run tests in parallel, use `--test-threads=1`!
+    //!
+
+    use std::path::Path;
+    use std::thread::sleep;
+    use std::time::Duration;
+
+    use oci_spec::runtime::{LinuxCpuBuilder, LinuxMemoryBuilder, LinuxResourcesBuilder};
+    use rand::distributions::Alphanumeric;
+    use rand::Rng;
+
+    use crate::fs::cpu::CpuController;
+    use crate::fs::memory::MemController;
+    use crate::fs::{ControllIdentifier, Controller, Subsystem};
+    use crate::manager::systemd::*;
+    use crate::manager::tests::{MEMORY_1G, MEMORY_2G, MEMORY_512M};
+    use crate::tests::spawn_sleep_inf;
+    use crate::{skip_if_cgroups_v1, skip_if_cgroups_v2, skip_if_no_systemd};
+
+    fn new_cgroups_path() -> (String, String, String) {
+        let rand_string: String = rand::thread_rng()
+            .sample_iter(&Alphanumeric)
+            .take(5)
+            .map(char::from)
+            .collect();
+        (
+            "cgroupsrs-test.slice".to_string(),
+            "cri".to_string(),
+            format!("pod{}", rand_string),
+        )
+    }
+
+    fn new_systemd_manager<'a>() -> SystemdManager<'a> {
+        let (slice, scope_prefix, name) = new_cgroups_path();
+        SystemdManager::new(&format!("{}:{}:{}", slice, scope_prefix, name)).unwrap()
+    }
+
+    fn run_set_resources_failed(resources: LinuxResources) {
+        let mut child = spawn_sleep_inf();
+        let mut manager = new_systemd_manager();
+        manager
+            .add_proc(CgroupPid {
+                pid: child.id() as u64,
+            })
+            .unwrap();
+        assert!(manager.set(&resources).is_err());
+        manager.destroy().unwrap();
+        child.wait().unwrap();
+    }
+
+    fn run_set_resources<F>(linux_resources: LinuxResources, test_fn: F)
+    where
+        F: FnOnce(&mut SystemdManager),
+    {
+        let mut manager = new_systemd_manager();
+        let mut child = spawn_sleep_inf();
+
+        manager
+            .add_proc(CgroupPid {
+                pid: child.id() as u64,
+            })
+            .unwrap();
+        manager.set(&linux_resources).unwrap();
+
+        test_fn(&mut manager);
+
+        manager.destroy().unwrap();
+        child.wait().unwrap();
+    }
+
+    #[test]
+    fn test_new_unit_name() {
+        assert_eq!(new_unit_name("test", "unit"), "test-unit.scope");
+        assert_eq!(new_unit_name("test", "unit.slice"), "unit.slice");
+        assert_eq!(new_unit_name("", "unit"), "unit.scope");
+        assert_eq!(new_unit_name("", "unit.slice"), "unit.slice");
+        assert_eq!(new_unit_name("prefix", "unit"), "prefix-unit.scope");
+    }
+
+    #[test]
+    fn test_slice_and_unit() {
+        skip_if_no_systemd!();
+
+        let (slice, scope_prefix, name) = new_cgroups_path();
+        let manager = SystemdManager::new(&format!("{}:{}:{}", slice, scope_prefix, name)).unwrap();
+
+        assert_eq!(manager.slice(), "cgroupsrs-test.slice");
+        assert_eq!(manager.unit(), format!("{scope_prefix}-{name}.scope"));
+    }
+
+    #[test]
+    fn test_destory() {
+        skip_if_no_systemd!();
+
+        let (slice, scope_prefix, name) = new_cgroups_path();
+        let mut manager =
+            SystemdManager::new(&format!("{}:{}:{}", slice, scope_prefix, name)).unwrap();
+
+        let cgroup_path = manager.cgroup_path(Some("memory")).unwrap();
+        // Before starting the unit, no cgroup should exist.
+        assert!(!Path::new(&cgroup_path).exists());
+
+        let mut child = spawn_sleep_inf();
+        manager
+            .add_proc(CgroupPid {
+                pid: child.id() as u64,
+            })
+            .unwrap();
+
+        // Now cgroup should exist.
+        assert!(Path::new(&cgroup_path).exists());
+
+        manager.destroy().unwrap();
+
+        // This process should be killed.
+        child.wait().unwrap();
+
+        // No cgroup should exist after destroy, retry 5 times at 1-second
+        // intervals.
+        for _ in 0..5 {
+            if !Path::new(&cgroup_path).exists() {
+                break;
+            }
+            sleep(Duration::from_secs(1));
+        }
+        assert!(!Path::new(&cgroup_path).exists());
+        // Unit should be stopped.
+        assert!(!manager.systemd_client.exists());
+    }
+
+    fn controller<'a, T>(fs_manager: &'a FsManager) -> &'a T
+    where
+        &'a T: From<&'a Subsystem>,
+        T: Controller + ControllIdentifier,
+    {
+        let controller: &T = fs_manager.cgroup().controller_of().unwrap();
+
+        controller
+    }
+
+    #[test]
+    fn test_set_cpu() {
+        skip_if_no_systemd!();
+
+        // 1024 shares, every 100ms allows to use 1 CPU
+        let linux_cpu = LinuxCpuBuilder::default()
+            .shares(1024u64)
+            .quota(100000i64)
+            .period(100000u64)
+            .quota(100000i64)
+            .build()
+            .unwrap();
+
+        let linux_resources = LinuxResourcesBuilder::default()
+            .cpu(linux_cpu)
+            .build()
+            .unwrap();
+
+        run_set_resources(linux_resources, |manager| {
+            let controller: &CpuController = controller(&manager.fs_manager);
+            let shares = controller.shares().unwrap();
+            let period = controller.cfs_period().unwrap();
+            let quota = controller.cfs_quota().unwrap();
+
+            if manager.v2() {
+                assert_eq!(shares, conv::cpu_shares_to_cgroup_v2(1024));
+            } else {
+                assert_eq!(shares, 1024);
+            }
+
+            assert_eq!(period, 100000);
+            assert_eq!(quota, 100000);
+        })
+    }
+
+    #[test]
+    fn test_set_memory_v2() {
+        skip_if_no_systemd!();
+        skip_if_cgroups_v1!();
+
+        // Expected failure: swap < limit
+        let linux_memory = LinuxMemoryBuilder::default()
+            .limit(MEMORY_1G)
+            .swap(MEMORY_512M)
+            .build()
+            .unwrap();
+        let linux_resources = LinuxResourcesBuilder::default()
+            .memory(linux_memory)
+            .build()
+            .unwrap();
+        run_set_resources_failed(linux_resources);
+
+        // Expected success
+        let linux_memory = LinuxMemoryBuilder::default()
+            .limit(MEMORY_512M)
+            .swap(MEMORY_1G)
+            .reservation(MEMORY_2G)
+            .build()
+            .unwrap();
+        let linux_resources = LinuxResourcesBuilder::default()
+            .memory(linux_memory)
+            .build()
+            .unwrap();
+        run_set_resources(linux_resources, |manager| {
+            let controller: &MemController = controller(&manager.fs_manager);
+            let memory_stat = controller.memory_stat();
+            let memory_swap_stat = controller.memswap();
+
+            assert_eq!(memory_stat.limit_in_bytes, MEMORY_512M);
+            assert_eq!(memory_swap_stat.limit_in_bytes, MEMORY_512M);
+            assert_eq!(memory_stat.soft_limit_in_bytes, MEMORY_2G);
+        });
+    }
+
+    #[test]
+    fn test_set_memory_v1() {
+        skip_if_no_systemd!();
+        skip_if_cgroups_v2!();
+
+        // Expected success
+        let linux_memory = LinuxMemoryBuilder::default()
+            .limit(MEMORY_512M)
+            .build()
+            .unwrap();
+        let linux_resources = LinuxResourcesBuilder::default()
+            .memory(linux_memory)
+            .build()
+            .unwrap();
+        run_set_resources(linux_resources, |manager| {
+            let controller: &MemController = controller(&manager.fs_manager);
+            let memory_stat = controller.memory_stat();
+            assert_eq!(memory_stat.limit_in_bytes, MEMORY_512M);
+        });
+    }
+}

src/memory.rs

@@ -1,316 +0,0 @@
-//! This module contains the implementation of the `memory` cgroup subsystem.
-//! 
-//! See the Kernel's documentation for more information about this subsystem, found at:
-//!  [Documentation/cgroup-v1/memory.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/memory.txt)
-use std::path::PathBuf;
-use std::io::{Write, Read};
-use std::fs::File;
-
-use {CgroupError, Resources, MemoryResources, Controller, Controllers, Subsystem, ControllIdentifier};
-use CgroupError::*;
-
-/// A controller that allows controlling the `memory` subsystem of a Cgroup.
-///
-/// In essence, using the memory controller, the user can gather statistics about the memory usage
-/// of the tasks in the control group. Additonally, one can also set powerful limits on their
-/// memory usage.
-#[derive(Debug, Clone)]
-pub struct MemController{
-    base: PathBuf,
-    path: PathBuf,
-}
-
-/// Contains statistics about the current usage of memory and swap (together, not seperately) by
-/// the control group's tasks.
-#[derive(Debug)]
-pub struct MemSwap {
-    /// How many times the limit has been hit.
-    pub fail_cnt: u64,
-    /// Memory and swap usage limit in bytes.
-    pub limit_in_bytes: u64,
-    /// Current usage of memory and swap in bytes.
-    pub usage_in_bytes: u64,
-    /// The maximum observed usage of memory and swap in bytes.
-    pub max_usage_in_bytes: u64,
-}
-
-/// State of and statistics gathered by the kernel about the memory usage of the control group's
-/// tasks.
-#[derive(Debug)]
-pub struct Memory {
-    /// How many times the limit has been hit.
-    pub fail_cnt: u64,
-    /// The limit in bytes of the memory usage of the control group's tasks.
-    pub limit_in_bytes: u64,
-    /// The current usage of memory by the control group's tasks.
-    pub usage_in_bytes: u64,
-    /// The maximum observed usage of memory by the control group's tasks.
-    pub max_usage_in_bytes: u64,
-    /// Whether moving charges at immigrate is allowed.
-    pub move_charge_at_immigrate: u64,
-    /* TODO: parse this */
-    /// Contains various statistics about the NUMA locality of the control group's tasks.
-    ///
-    /// The format of this field (as lifted from the kernel sources):
-    /// ```text
-    /// total=<total pages> N0=<node 0 pages> N1=<node 1 pages> ...
-    /// file=<total file pages> N0=<node 0 pages> N1=<node 1 pages> ...
-    /// anon=<total anon pages> N0=<node 0 pages> N1=<node 1 pages> ...
-    /// unevictable=<total anon pages> N0=<node 0 pages> N1=<node 1 pages> ...
-    /// hierarchical_<counter>=<counter pages> N0=<node 0 pages> N1=<node 1 pages> ...
-    /// ```
-    pub numa_stat: String,
-    /// If this equals "1", then the OOM killer is enabled for this control group (this is the
-    /// default setting).
-    pub oom_control: String,
-    /// Allows setting a limit to memory usage which is enforced when the system (note, _not_ the
-    /// control group) detects memory pressure.
-    pub soft_limit_in_bytes: u64,
-    /* TODO: parse this */
-    /// Contains a wide array of statistics about the memory usage of the tasks in the control
-    /// group.
-    pub stat: String,
-    /// Set the tendency of the kernel to swap out parts of the address space consumed by the
-    /// control group's tasks.
-    ///
-    /// Note that setting this to zero does *not* prevent swapping, use `mlock(2)` for that
-    /// purpose.
-    pub swappiness: u64,
-    /// If set, then under OOM conditions, the kernel will try to reclaim memory from the children
-    /// of the offending process too. By default, this is not allowed.
-    pub use_hierarchy: u64,
-}
-
-/// The current state of and gathered statistics about the kernel's memory usage for TCP-related
-/// data structures.
-#[derive(Debug)]
-pub struct Tcp {
-    /// How many times the limit has been hit.
-    pub fail_cnt: u64,
-    /// The limit in bytes of the memory usage of the kernel's TCP buffers by control group's
-    /// tasks.
-    pub limit_in_bytes: u64,
-    /// The current memory used by the kernel's TCP buffers related to these tasks.
-    pub usage_in_bytes: u64,
-    /// The observed maximum usage of memory by the kernel's TCP buffers (that originated from
-    /// these tasks).
-    pub max_usage_in_bytes: u64,
-}
-
-/// Gathered statistics and the current state of limitation of the kernel's memory usage. Note that
-/// this is per-cgroup, so the kernel can of course use more memory, but it will fail operations by
-/// these tasks if it would think that the limits here would be violated. It's important to note
-/// that interrupts in particular might not be able to enforce these limits.
-#[derive(Debug)]
-pub struct Kmem {
-    /// How many times the limit has been hit.
-    pub fail_cnt: u64,
-    /// The limit in bytes of the kernel memory used by the control group's tasks.
-    pub limit_in_bytes: u64,
-    /// The current usage of kernel memory used by the control group's tasks, in bytes.
-    pub usage_in_bytes: u64,
-    /// The maximum observed usage of kernel memory used by the control group's tasks, in bytes.
-    pub max_usage_in_bytes: u64,
-    /// Contains information about the memory usage of the kernel's caches, per control group.
-    pub slabinfo: String,
-}
-
-impl Controller for MemController {
-    fn control_type(self: &Self) -> Controllers { Controllers::Mem }
-    fn get_path<'a>(self: &'a Self) -> &'a PathBuf { &self.path }
-    fn get_path_mut<'a>(self: &'a mut Self) -> &'a mut PathBuf { &mut self.path }
-    fn get_base<'a>(self: &'a Self) -> &'a PathBuf { &self.base }
-
-    fn apply(self: &Self, res: &Resources) {
-        /* get the resources that apply to this controller */
-        let memres: &MemoryResources = &res.memory;
-
-        if memres.update_values {
-            let _ = self.set_limit(memres.memory_hard_limit);
-            let _ = self.set_soft_limit(memres.memory_soft_limit);
-            let _ = self.set_kmem_limit(memres.kernel_memory_limit);
-            let _ = self.set_memswap_limit(memres.memory_swap_limit);
-            let _ = self.set_tcp_limit(memres.kernel_tcp_memory_limit);
-            let _ = self.set_swappiness(memres.swappiness);
-        }
-    }
-}
-
-impl MemController {
-    /// Contructs a new `MemController` with `oroot` serving as the root of the control group.
-    pub fn new(oroot: PathBuf) -> Self {
-        let mut root = oroot;
-        root.push(Self::controller_type().to_string());
-        Self {
-            base: root.clone(),
-            path: root,
-        }
-    }
-
-    /// Gathers overall statistics (and the current state of) about the memory usage of the control
-    /// group's tasks.
-    ///
-    /// See the individual fields for more explanation, and as always, remember to consult the
-    /// kernel Documentation and/or sources.
-    pub fn memory_stat(self: &Self) -> Memory {
-        Memory {
-            fail_cnt: self.open_path("memory.failcnt", false)
-                            .and_then(read_u64_from).unwrap_or(0),
-            limit_in_bytes: self.open_path("memory.limit_in_bytes", false)
-                            .and_then(read_u64_from).unwrap_or(0),
-            usage_in_bytes: self.open_path("memory.usage_in_bytes", false)
-                            .and_then(read_u64_from).unwrap_or(0),
-            max_usage_in_bytes: self.open_path("memory.max_usage_in_bytes", false)
-                            .and_then(read_u64_from).unwrap_or(0),
-            move_charge_at_immigrate: self.open_path("memory.move_charge_at_immigrate", false)
-                            .and_then(read_u64_from).unwrap_or(0),
-            numa_stat: self.open_path("memory.numa_stat", false)
-                            .and_then(read_string_from).unwrap_or("".to_string()),
-            oom_control: self.open_path("memory.oom_control", false)
-                            .and_then(read_string_from).unwrap_or("".to_string()),
-            soft_limit_in_bytes: self.open_path("memory.soft_limit_in_bytes", false)
-                            .and_then(read_u64_from)
-                            .unwrap_or(0),
-            stat: self.open_path("memory.stat", false)
-                            .and_then(read_string_from).unwrap_or("".to_string()),
-            swappiness: self.open_path("memory.swappiness", false)
-                            .and_then(read_u64_from)
-                            .unwrap_or(0),
-            use_hierarchy: self.open_path("memory.use_hierarchy", false)
-                            .and_then(read_u64_from)
-                            .unwrap_or(0)
-        }
-    }
-
-    /// Gathers information about the kernel memory usage of the control group's tasks.
-    pub fn kmem_stat(self: &Self) -> Kmem {
-        Kmem {
-            fail_cnt: self.open_path("memory.kmem.failcnt", false)
-                            .and_then(read_u64_from).unwrap_or(0),
-            limit_in_bytes: self.open_path("memory.kmem.limit_in_bytes", false)
-                            .and_then(read_u64_from).unwrap_or(0),
-            usage_in_bytes: self.open_path("memory.kmem.usage_in_bytes", false)
-                            .and_then(read_u64_from).unwrap_or(0),
-            max_usage_in_bytes: self.open_path("memory.kmem.max_usage_in_bytes", false)
-                            .and_then(read_u64_from).unwrap_or(0),
-            slabinfo: self.open_path("memory.kmem.slabinfo", false)
-                            .and_then(read_string_from).unwrap_or("".to_string()),
-        }
-    }
-
-    /// Gathers information about the control group's kernel memory usage where said memory is
-    /// TCP-related.
-    pub fn kmem_tcp_stat(self: &Self) -> Tcp {
-        Tcp {
-            fail_cnt: self.open_path("memory.kmem.tcp.failcnt", false)
-                            .and_then(read_u64_from).unwrap_or(0),
-            limit_in_bytes: self.open_path("memory.kmem.tcp.limit_in_bytes", false)
-                            .and_then(read_u64_from).unwrap_or(0),
-            usage_in_bytes: self.open_path("memory.kmem.tcp.usage_in_bytes", false)
-                            .and_then(read_u64_from).unwrap_or(0),
-            max_usage_in_bytes: self.open_path("memory.kmem.tcp.max_usage_in_bytes", false)
-                            .and_then(read_u64_from).unwrap_or(0),
-        }
-    }
-
-    /// Gathers information about the memory usage of the control group including the swap usage
-    /// (if any).
-    pub fn memswap(self: &Self) -> MemSwap {
-        MemSwap {
-            fail_cnt: self.open_path("memory.memsw.failcnt", false)
-                            .and_then(read_u64_from).unwrap_or(0),
-            limit_in_bytes: self.open_path("memory.memsw.limit_in_bytes", false)
-                            .and_then(read_u64_from).unwrap_or(0),
-            usage_in_bytes: self.open_path("memory.memsw.usage_in_bytes", false)
-                            .and_then(read_u64_from).unwrap_or(0),
-            max_usage_in_bytes: self.open_path("memory.memsw.max_usage_in_bytes", false)
-                            .and_then(read_u64_from).unwrap_or(0),
-        }
-    }
-
-    /// Set the memory usage limit of the control group, in bytes.
-    pub fn set_limit(self: &Self, limit: u64) -> Result<(), CgroupError> {
-        self.open_path("memory.limit_in_bytes", true).and_then(|mut file| {
-            file.write_all(limit.to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Set the kernel memory limit of the control group, in bytes.
-    pub fn set_kmem_limit(self: &Self, limit: u64) -> Result<(), CgroupError> {
-        self.open_path("memory.kmem.limit_in_bytes", true).and_then(|mut file| {
-            file.write_all(limit.to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Set the memory+swap limit of the control group, in bytes.
-    pub fn set_memswap_limit(self: &Self, limit: u64) -> Result<(), CgroupError> {
-        self.open_path("memory.memsw.limit_in_bytes", true).and_then(|mut file| {
-            file.write_all(limit.to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Set how much kernel memory can be used for TCP-related buffers by the control group.
-    pub fn set_tcp_limit(self: &Self, limit: u64) -> Result<(), CgroupError> {
-        self.open_path("memory.kmem.tcp.limit_in_bytes", true).and_then(|mut file| {
-            file.write_all(limit.to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-
-    /// Set the soft limit of the control group, in bytes.
-    ///
-    /// This limit is enforced when the system is nearing OOM conditions. Contrast this with the
-    /// hard limit, which is _always_ enforced.
-    pub fn set_soft_limit(self: &Self, limit: u64) -> Result<(), CgroupError> {
-        self.open_path("memory.soft_limit_in_bytes", true).and_then(|mut file| {
-            file.write_all(limit.to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-
-    /// Set how likely the kernel is to swap out parts of the address space used by the control
-    /// group.
-    ///
-    /// Note that a value of zero does not imply that the process will not be swapped out.
-    pub fn set_swappiness(self: &Self, swp: u64) -> Result<(), CgroupError> {
-        self.open_path("memory.swappiness", true).and_then(|mut file| {
-            file.write_all(swp.to_string().as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-}
-
-impl ControllIdentifier for MemController {
-    fn controller_type() -> Controllers {
-        Controllers::Mem
-    }
-}
-
-impl<'a> From<&'a Subsystem> for &'a MemController {
-    fn from(sub: &'a Subsystem) -> &'a MemController {
-        unsafe {
-            match sub {
-                Subsystem::Mem(c) => c,
-                _ => {
-                    assert_eq!(1, 0);
-                    ::std::mem::uninitialized()
-                },
-            }
-        }
-    }
-}
-
-fn read_u64_from(mut file: File) -> Result<u64, CgroupError> {
-    let mut string = String::new();
-    match file.read_to_string(&mut string) {
-        Ok(_) => string.trim().parse().map_err(|_| ParseError),
-        Err(e) => Err(CgroupError::ReadError(e)),
-    }
-}
-
-fn read_string_from(mut file: File) -> Result<String, CgroupError> {
-    let mut string = String::new();
-    match file.read_to_string(&mut string) {
-        Ok(_) => Ok(string.trim().to_string()),
-        Err(e) => Err(CgroupError::ReadError(e)),
-    }
-}

src/net_cls.rs

@@ -1,92 +0,0 @@
-//! This module contains the implementation of the `net_cls` cgroup subsystem.
-//! 
-//! See the Kernel's documentation for more information about this subsystem, found at:
-//!  [Documentation/cgroup-v1/net_cls.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/net_cls.txt)
-use std::path::PathBuf;
-use std::io::{Read, Write};
-use std::fs::File;
-
-use {CgroupError, NetworkResources, Controllers, Controller, Resources, ControllIdentifier, Subsystem};
-use CgroupError::*;
-
-/// A controller that allows controlling the `net_cls` subsystem of a Cgroup.
-///
-/// In esssence, using the `net_cls` controller, one can attach a custom class to the network
-/// packets emitted by the control group's tasks. This can then later be used in iptables to have
-/// custom firewall rules, QoS, etc.
-#[derive(Debug, Clone)]
-pub struct NetClsController {
-    base: PathBuf,
-    path: PathBuf,
-}
-
-impl Controller for NetClsController {
-    fn control_type(self: &Self) -> Controllers { Controllers::NetCls }
-    fn get_path<'a>(self: &'a Self) -> &'a PathBuf { &self.path }
-    fn get_path_mut<'a>(self: &'a mut Self) -> &'a mut PathBuf { &mut self.path }
-    fn get_base<'a>(self: &'a Self) -> &'a PathBuf { &self.base }
-
-    fn apply(self: &Self, res: &Resources) {
-        /* get the resources that apply to this controller */
-        let res: &NetworkResources = &res.network;
-
-        if res.update_values {
-            let _ = self.set_class(res.class_id);
-        }
-    }
-}
-
-impl ControllIdentifier for NetClsController {
-    fn controller_type() -> Controllers {
-        Controllers::NetCls
-    }
-}
-
-impl<'a> From<&'a Subsystem> for &'a NetClsController {
-    fn from(sub: &'a Subsystem) -> &'a NetClsController {
-        unsafe {
-            match sub {
-                Subsystem::NetCls(c) => c,
-                _ => {
-                    assert_eq!(1, 0);
-                    ::std::mem::uninitialized()
-                },
-            }
-        }
-    }
-}
-
-fn read_u64_from(mut file: File) -> Result<u64, CgroupError> {
-    let mut string = String::new();
-    match file.read_to_string(&mut string) {
-        Ok(_) => string.trim().parse().map_err(|_| ParseError),
-        Err(e) => Err(CgroupError::ReadError(e)),
-    }
-}
-
-impl NetClsController {
-    /// Constructs a new `NetClsController` with `oroot` serving as the root of the control group.
-    pub fn new(oroot: PathBuf) -> Self {
-        let mut root = oroot;
-        root.push(Self::controller_type().to_string());
-        Self {
-            base: root.clone(),
-            path: root,
-        }
-    }
-    
-    /// Set the network class id of the outgoing packets of the control group's tasks.
-    pub fn set_class(self: &Self, class: u64) -> Result<(), CgroupError> {
-        self.open_path("net_cls.classid", true).and_then(|mut file| {
-            let s = format!("{:#08X}", class);
-            file.write_all(s.as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-
-    /// Get the network class id of the outgoing packets of the control group's tasks.
-    pub fn get_class(self: &Self) -> Result<u64, CgroupError> {
-        self.open_path("net_cls.classid", false).and_then(|file| {
-            read_u64_from(file)
-        })
-    }
-}

src/net_prio.rs

@@ -1,124 +0,0 @@
-//! This module contains the implementation of the `net_prio` cgroup subsystem.
-//! 
-//! See the Kernel's documentation for more information about this subsystem, found at:
-//!  [Documentation/cgroup-v1/net_prio.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/net_prio.txt)
-use std::path::PathBuf;
-use std::io::{BufReader, BufRead, Write, Read};
-use std::fs::File;
-use std::collections::HashMap;
-
-use {CgroupError, NetworkResources, Controllers, Controller, Resources, ControllIdentifier, Subsystem};
-use CgroupError::*;
-
-/// A controller that allows controlling the `net_prio` subsystem of a Cgroup.
-///
-/// In essence, using `net_prio` one can set the priority of the packets emitted from the control
-/// group's tasks. This can then be used to have QoS restrictions on certain control groups and
-/// thus, prioritizing certain tasks.
-#[derive(Debug, Clone)]
-pub struct NetPrioController {
-    base: PathBuf,
-    path: PathBuf,
-}
-
-impl Controller for NetPrioController {
-    fn control_type(self: &Self) -> Controllers { Controllers::NetPrio }
-    fn get_path<'a>(self: &'a Self) -> &'a PathBuf { &self.path }
-    fn get_path_mut<'a>(self: &'a mut Self) -> &'a mut PathBuf { &mut self.path }
-    fn get_base<'a>(self: &'a Self) -> &'a PathBuf { &self.base }
-
-    fn apply(self: &Self, res: &Resources) {
-        /* get the resources that apply to this controller */
-        let res: &NetworkResources = &res.network;
-
-        if res.update_values {
-            for i in &res.priorities {
-                let _ = self.set_if_prio(&i.name, i.priority);
-            }
-        }
-    }
-}
-
-impl ControllIdentifier for NetPrioController {
-    fn controller_type() -> Controllers {
-        Controllers::NetPrio
-    }
-}
-
-impl<'a> From<&'a Subsystem> for &'a NetPrioController {
-    fn from(sub: &'a Subsystem) -> &'a NetPrioController {
-        unsafe {
-            match sub {
-                Subsystem::NetPrio(c) => c,
-                _ => {
-                    assert_eq!(1, 0);
-                    ::std::mem::uninitialized()
-                },
-            }
-        }
-    }
-}
-
-fn read_u64_from(mut file: File) -> Result<u64, CgroupError> {
-    let mut string = String::new();
-    match file.read_to_string(&mut string) {
-        Ok(_) => string.trim().parse().map_err(|_| ParseError),
-        Err(e) => Err(CgroupError::ReadError(e)),
-    }
-}
-
-impl NetPrioController {
-    /// Constructs a new `NetPrioController` with `oroot` serving as the root of the control group.
-    pub fn new(oroot: PathBuf) -> Self {
-        let mut root = oroot;
-        root.push(Self::controller_type().to_string());
-        Self {
-            base: root.clone(),
-            path: root,
-        }
-    }
-
-    /// Retrieves the current priority of the emitted packets.
-    pub fn prio_idx(self: &Self) -> u64 {
-        self.open_path("net_prio.prioidx", false)
-            .and_then(read_u64_from)
-            .unwrap_or(0)
-    }
-
-    /// A map of priorities for each network interface.
-    pub fn ifpriomap(self: &Self) -> Result<HashMap<String, u64>, CgroupError> {
-        self.open_path("net_prio.ifpriomap", false) .and_then(|file| {
-            let bf = BufReader::new(file);
-            bf.lines().fold(Ok(HashMap::new()), |acc, line| {
-                if acc.is_err() {
-                    acc
-                } else {
-                    let mut acc = acc.unwrap();
-                    let l = line.unwrap();
-                    let mut sp = l.split_whitespace();
-                    let ifname = sp.nth(0);
-                    let ifprio = sp.nth(1);
-                    if ifname.is_none() || ifprio.is_none() {
-                        Err(CgroupError::ParseError)
-                    } else {
-                        let ifname = ifname.unwrap();
-                        let ifprio = ifprio.unwrap().trim().parse();
-                        if ifprio.is_err() {
-                            Err(CgroupError::ParseError)
-                        } else {
-                            acc.insert(ifname.to_string(), ifprio.unwrap());
-                            Ok(acc)
-                        }
-                    }
-                }
-            })
-        })
-    }
-
-    /// Set the priority of the network traffic on `eif` to be `prio`.
-    pub fn set_if_prio(self: &Self, eif: &String, prio: u64) -> Result<(), CgroupError> {
-        self.open_path("net_prio.ifpriomap", true).and_then(|mut file| {
-            file.write_all(format!("{} {}", eif, prio).as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-}

src/pid.rs

@@ -1,158 +0,0 @@
-//! This module contains the implementation of the `pids` cgroup subsystem.
-//! 
-//! See the Kernel's documentation for more information about this subsystem, found at:
-//!  [Documentation/cgroups-v1/pids.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/pids.txt)
-use std::path::PathBuf;
-use std::io::{Write, Read};
-use std::fs::File;
-
-use {CgroupError, Resources, PidResources, Controller, ControllIdentifier, Subsystem, Controllers};
-use CgroupError::*;
-
-/// A controller that allows controlling the `pids` subsystem of a Cgroup.
-#[derive(Debug, Clone)]
-pub struct PidController {
-    base: PathBuf,
-    path: PathBuf,
-}
-
-/// The values found in the `pids.max` file in a Cgroup's `pids` subsystem.
-#[derive(Eq, PartialEq, Copy, Clone, Debug)]
-pub enum PidMax {
-    /// This value is returned when the text found `pids.max` is `"max"`.
-    Max,
-    /// When the value in `pids.max` is a numerical value, they are returned via this enum field.
-    Value(i64),
-}
-
-impl Default for PidMax {
-    /// By default, (as per the kernel) `pids.max` should contain `"max"`.
-    fn default() -> Self {
-        PidMax::Max
-    }
-}
-
-impl Controller for PidController {
-    fn control_type(self: &Self) -> Controllers { Controllers::Pids }
-    fn get_path<'a>(self: &'a Self) -> &'a PathBuf { &self.path }
-    fn get_path_mut<'a>(self: &'a mut Self) -> &'a mut PathBuf { &mut self.path }
-    fn get_base<'a>(self: &'a Self) -> &'a PathBuf { &self.base }
-
-    fn apply(self: &Self, res: &Resources) {
-        /* get the resources that apply to this controller */
-        let pidres: &PidResources = &res.pid;
-
-        if pidres.update_values {
-            /* apply pid_max */
-            let _ = self.set_pid_max(pidres.maximum_number_of_processes);
-        }
-    }
-}
-
-/*impl<'a> ControllIdentifier for &'a PidController {
-    fn controller_type() -> Controllers {
-        Controllers::Pids
-    }
-}*/
-
-impl ControllIdentifier for PidController {
-    fn controller_type() -> Controllers {
-        Controllers::Pids
-    }
-}
-
-impl<'a> From<&'a Subsystem> for &'a PidController {
-    fn from(sub: &'a Subsystem) -> &'a PidController {
-        unsafe {
-            match sub {
-                Subsystem::Pid(c) => c,
-                _ => {
-                    assert_eq!(1, 0);
-                    ::std::mem::uninitialized()
-                },
-            }
-        }
-    }
-}
-
-fn read_u64_from(mut file: File) -> Result<u64, CgroupError> {
-    let mut string = String::new();
-    match file.read_to_string(&mut string) {
-        Ok(_) => string.trim().parse().map_err(|_| ParseError),
-        Err(e) => Err(CgroupError::ReadError(e)),
-    }
-}
-
-impl PidController {
-    /// Constructors a new `PidController` instance, with `oroot` serving as the controller's root
-    /// directory.
-    pub fn new(oroot: PathBuf) -> Self {
-        let mut root = oroot;
-        root.push(Self::controller_type().to_string());
-        Self {
-            base: root.clone(),
-            path: root,
-        }
-    }
-
-    /// The number of times `fork` failed because the limit was hit.
-    pub fn get_pid_events(self: &Self) -> Result<u64, CgroupError> {
-        self.open_path("pids.events", false).and_then(|mut file| {
-            let mut string = String::new();
-            match file.read_to_string(&mut string) {
-                Ok(_) => {
-                    match string.split_whitespace().nth(1) {
-                        Some(elem) => match elem.parse() {
-                            Ok(val) => Ok(val),
-                            Err(_) => Err(CgroupError::ParseError),
-                        },
-                        None => Err(CgroupError::ParseError),
-                    }
-                },
-                Err(e) => Err(CgroupError::ReadError(e)),
-            }
-        })
-    }
-
-    /// The number of processes currently.
-    pub fn get_pid_current(self: &Self) -> Result<u64, CgroupError> {
-        self.open_path("pids.current", false).and_then(read_u64_from)
-    }
-
-    /// The maximum number of processes that can exist at one time in the control group.
-    pub fn get_pid_max(self: &Self) -> Result<PidMax, CgroupError> {
-        self.open_path("pids.max", false).and_then(|mut file| {
-            let mut string = String::new();
-            let res = file.read_to_string(&mut string);
-            match res {
-                Ok(_) => if string.trim() == "max" {
-                    Ok(PidMax::Max)
-                } else {
-                    match string.trim().parse() {
-                        Ok(val) => Ok(PidMax::Value(val)),
-                        Err(_) => Err(CgroupError::ParseError),
-                    }
-                },
-                Err(e) => Err(CgroupError::ReadError(e)),
-            }
-        })
-    }
-
-    /// Set the maximum number of processes that can exist in this control group.
-    ///
-    /// Note that if `get_pid_current()` returns a higher number than what you
-    /// are about to set (`max_pid`), then no processess will be killed. Additonally, attaching
-    /// extra processes to a control group disregards the limit.
-    pub fn set_pid_max(self: &Self, max_pid: PidMax) -> Result<(), CgroupError> {
-        self.open_path("pids.max", true).and_then(|mut file| {
-            let string_to_write = match max_pid {
-                PidMax::Max => "max".to_string(),
-                PidMax::Value(num) => num.to_string(),
-            };
-            match file.write_all(string_to_write.as_ref()) {
-                Ok(_) => Ok(()),
-                Err(e) => Err(CgroupError::WriteError(e)),
-            }
-        })
-    }
-}

src/rdma.rs

@@ -1,82 +0,0 @@
-//! This module contains the implementation of the `rdma` cgroup subsystem.
-//! 
-//! See the Kernel's documentation for more information about this subsystem, found at:
-//!  [Documentation/cgroup-v1/rdma.txt](https://www.kernel.org/doc/Documentation/cgroup-v1/rdma.txt)
-use std::path::PathBuf;
-use std::io::{Write, Read};
-use std::fs::File;
-
-use {CgroupError, Controllers, Controller, Resources, ControllIdentifier, Subsystem};
-
-/// A controller that allows controlling the `rdma` subsystem of a Cgroup.
-///
-/// In essence, using this controller one can limit the RDMA/IB specific resources that the tasks
-/// in the control group can use.
-#[derive(Debug, Clone)]
-pub struct RdmaController {
-    base: PathBuf,
-    path: PathBuf,
-}
-
-impl Controller for RdmaController {
-    fn control_type(self: &Self) -> Controllers { Controllers::Rdma }
-    fn get_path<'a>(self: &'a Self) -> &'a PathBuf { &self.path }
-    fn get_path_mut<'a>(self: &'a mut Self) -> &'a mut PathBuf { &mut self.path }
-    fn get_base<'a>(self: &'a Self) -> &'a PathBuf { &self.base }
-
-    fn apply(self: &Self, _res: &Resources) {
-    }
-}
-
-impl ControllIdentifier for RdmaController {
-    fn controller_type() -> Controllers {
-        Controllers::Rdma
-    }
-}
-
-impl<'a> From<&'a Subsystem> for &'a RdmaController {
-    fn from(sub: &'a Subsystem) -> &'a RdmaController {
-        unsafe {
-            match sub {
-                Subsystem::Rdma(c) => c,
-                _ => {
-                    assert_eq!(1, 0);
-                    ::std::mem::uninitialized()
-                },
-            }
-        }
-    }
-}
-
-fn read_string_from(mut file: File) -> Result<String, CgroupError> {
-    let mut string = String::new();
-    match file.read_to_string(&mut string) {
-        Ok(_) => Ok(string.trim().to_string()),
-        Err(e) => Err(CgroupError::ReadError(e)),
-    }
-}
-
-impl RdmaController {
-    /// Constructs a new `RdmaController` with `oroot` serving as the root of the control group.
-    pub fn new(oroot: PathBuf) -> Self {
-        let mut root = oroot;
-        root.push(Self::controller_type().to_string());
-        Self {
-            base: root.clone(),
-            path: root,
-        }
-    }
-
-    /// Returns the current usage of RDMA/IB specific resources.
-    pub fn current(self: &Self) -> Result<String, CgroupError> {
-        self.open_path("rdma.current", false)
-            .and_then(read_string_from)
-    }
-
-    /// Set a maximum usage for each RDMA/IB resource.
-    pub fn set_max(self: &Self, max: &String) -> Result<(), CgroupError> {
-        self.open_path("rdma.max", true).and_then(|mut file| {
-            file.write_all(max.as_ref()).map_err(CgroupError::WriteError)
-        })
-    }
-}

src/stats.rs

@@ -0,0 +1,156 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use std::collections::HashMap;
+
+#[derive(Debug, Default)]
+pub struct CgroupStats {
+    pub cpu: CpuCgroupStats,
+    pub memory: MemoryCgroupStats,
+    pub pids: PidsCgroupStats,
+    pub blkio: BlkioCgroupStats,
+    pub hugetlb: HugeTlbCgroupStats,
+}
+
+#[derive(Debug, Default)]
+pub struct CpuCgroupStats {
+    pub cpu_acct: Option<CpuAcctStats>,
+    pub cpu_throttling: Option<CpuThrottlingStats>,
+}
+
+#[derive(Debug, Default)]
+pub struct CpuAcctStats {
+    /// Usage in userspace, read from `cpuacct.stat` from the line starting
+    /// with `user`. Set 0 if no data.
+    pub user_usage: u64,
+    /// Usage in kernelspace, read from `cpuacct.stat` from the line
+    /// starting with `system`. Set 0 if no data.
+    pub system_usage: u64,
+    /// Total usage, read from `cpuacct.usage`. Set 0 if no data.
+    pub total_usage: u64,
+    /// Per-CPU usage, read from `cpuacct.usage_percpu`.
+    pub usage_percpu: Vec<u64>,
+}
+
+#[derive(Debug, Default)]
+pub struct CpuThrottlingStats {
+    /// Periods, read from `cpu.stat` from the line starting with
+    /// `nr_periods`. Set 0 if no data.
+    pub periods: u64,
+    /// Throttled periods, read from `cpu.stat` from the line starting with
+    /// `nr_throttled`. Set 0 if no data.
+    pub throttled_periods: u64,
+    /// Throttled time, read from `cpu.stat` from the line starting with
+    /// `throttled_time`. Set 0 if no data.
+    pub throttled_time: u64,
+}
+
+#[derive(Debug, Default)]
+pub struct MemoryCgroupStats {
+    pub memory: Option<MemoryStats>,
+    pub memory_swap: Option<MemoryStats>,
+    pub kernel_memory: Option<MemoryStats>,
+
+    /// Use hierarchy, read from `memory.use_hierarchy` in cgroups v1. Only
+    /// available in cgroups v1.
+    pub use_hierarchy: bool,
+
+    // The following data is read from `memory.stat`, see also
+    // `crate::fs::memory::MemoryStat::stat`.
+    pub cache: u64,
+    pub rss: u64,
+    pub rss_huge: u64,
+    pub shmem: u64,
+    pub mapped_file: u64,
+    pub dirty: u64,
+    pub writeback: u64,
+    pub swap: u64,
+    pub pgpgin: u64,
+    pub pgpgout: u64,
+    pub pgfault: u64,
+    pub pgmajfault: u64,
+    pub inactive_anon: u64,
+    pub active_anon: u64,
+    pub inactive_file: u64,
+    pub active_file: u64,
+    pub unevictable: u64,
+    pub hierarchical_memory_limit: i64,
+    pub hierarchical_memsw_limit: i64,
+    pub total_cache: u64,
+    pub total_rss: u64,
+    pub total_rss_huge: u64,
+    pub total_shmem: u64,
+    pub total_mapped_file: u64,
+    pub total_dirty: u64,
+    pub total_writeback: u64,
+    pub total_swap: u64,
+    pub total_pgpgin: u64,
+    pub total_pgpgout: u64,
+    pub total_pgfault: u64,
+    pub total_pgmajfault: u64,
+    pub total_inactive_anon: u64,
+    pub total_active_anon: u64,
+    pub total_inactive_file: u64,
+    pub total_active_file: u64,
+    pub total_unevictable: u64,
+}
+
+#[derive(Debug, Default)]
+pub struct MemoryStats {
+    /// Memory [swap] usage, read from `memory[.memsw].usage_in_bytes` in
+    /// cgroups v1 and `memory[.swap].current` in cgroups v2.
+    pub usage: u64,
+    /// Maximum memory [swap] usage observed by cgroups, read from
+    /// `memory[.memsw].max_usage_in_bytes` in cgroups v1 and
+    /// `memory[.swap].peak` in cgroups v2.
+    pub max_usage: u64,
+    /// Memory [swap] limit, read from `memory[.memsw].limit_in_bytes` in
+    /// cgroups v1 and `memory[.swap].max` in cgroups v2.
+    pub limit: i64,
+    /// Failure count, read from `memory[.memsw].failcnt`. Only available in
+    /// cgroups v1.
+    pub fail_cnt: u64,
+}
+
+#[derive(Debug, Default)]
+pub struct PidsCgroupStats {
+    /// Current number of processes in the cgroup, read from `pids.current`.
+    pub current: u64,
+    /// Maximum number of processes in the cgroup, read from `pids.limit`.
+    pub limit: i64,
+}
+
+#[derive(Debug, Default)]
+pub struct BlkioCgroupStats {
+    pub io_service_bytes_recursive: Vec<BlkioStat>,
+    pub io_serviced_recursive: Vec<BlkioStat>,
+    pub io_queued_recursive: Vec<BlkioStat>,
+    pub io_service_time_recursive: Vec<BlkioStat>,
+    pub io_wait_time_recursive: Vec<BlkioStat>,
+    pub io_merged_recursive: Vec<BlkioStat>,
+    pub io_time_recursive: Vec<BlkioStat>,
+    pub sectors_recursive: Vec<BlkioStat>,
+}
+
+#[derive(Debug, Default)]
+pub struct BlkioStat {
+    pub major: u64,
+    pub minor: u64,
+    pub op: String,
+    pub value: u64,
+}
+
+/// A structure representing the statistics of the `hugetlb` subsystem of a
+/// Cgroup. The key is the huge page size, and the value is the statistics
+/// for that size.
+pub type HugeTlbCgroupStats = HashMap<String, HugeTlbStat>;
+
+#[derive(Debug, Default)]
+pub struct HugeTlbStat {
+    pub usage: u64,
+    pub max_usage: u64,
+    pub fail_cnt: u64,
+}

src/systemd/consts.rs

@@ -0,0 +1,68 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+/// Who enum: all
+pub const WHO_ENUM_ALL: &str = "all";
+
+/// Unit mode: replace
+pub const UNIT_MODE_REPLACE: &str = "replace";
+
+/// No such unit error
+pub const NO_SUCH_UNIT: &str = "org.freedesktop.systemd1.NoSuchUnit";
+
+/// Default description for transient units.
+pub const DEFAULT_DESCRIPTION: &str = "cgroups-rs transient unit";
+
+/// Turn on CPU usage accounting for this unit.
+pub const CPU_ACCOUNTING: &str = "CPUAccounting";
+/// This setting controls the memory controller in the unified hierarchy.
+/// Added in version 208.
+pub const MEMORY_ACCOUNTING: &str = "MemoryAccounting";
+/// This setting controls the pids controller in the unified hierarchy.
+pub const TASKS_ACCOUNTING: &str = "TasksAccounting";
+/// This setting controls the io controller in the unified hierarchy.
+/// Added in version 230.
+pub const IO_ACCOUNTING: &str = "IOAccounting";
+/// This setting controls the block IO controller in the legacy hierarchy.
+/// Deprecated in version 252.
+pub const BLOCK_IO_ACCOUNTING: &str = "BlockIOAccounting";
+/// Description of the unit.
+pub const DESCRIPTION: &str = "Description";
+/// PIDs
+pub const PIDS: &str = "PIDs";
+/// Default dependencies for this unit.
+pub const DEFAULT_DEPENDENCIES: &str = "DefaultDependencies";
+/// Wants, expressing a weak dependency on other units.
+pub const WANTS: &str = "Wants";
+/// Slice, used to assign a unit to a specific slice.
+pub const SLICE: &str = "Slice";
+/// Turns on delegation of further resource control partitioning to
+/// processes of the unit.
+pub const DELEGATE: &str = "Delegate";
+/// Timeout for stopping the unit in microseconds.
+pub const TIMEOUT_STOP_USEC: &str = "TimeoutStopUSec";
+
+/// CPU shares in the legacy hierarchy.
+pub const CPU_SHARES: &str = "CPUShares";
+/// CPU shares in the unified hierarchy.
+pub const CPU_WEIGHT: &str = "CPUWeight";
+/// CPU quota period us.
+pub const CPU_QUOTA_PERIOD_US: &str = "CPUQuotaPeriodUSec";
+/// CPU quota us
+pub const CPU_QUOTA_PER_SEC_US: &str = "CPUQuotaPerSecUSec";
+/// Allowed CPUs
+pub const ALLOWED_CPUS: &str = "AllowedCPUs";
+/// Allowed memory nodes
+pub const ALLOWED_MEMORY_NODES: &str = "AllowedMemoryNodes";
+/// Memory limit in the legacy hierarchy.
+pub const MEMORY_LIMIT: &str = "MemoryLimit";
+/// Memory limit in the unified hierarchy.
+pub const MEMORY_MAX: &str = "MemoryMax";
+/// Memory low
+pub const MEMORY_LOW: &str = "MemoryLow";
+/// Memory swap max
+pub const MEMORY_SWAP_MAX: &str = "MemorySwapMax";
+/// Tasks max
+pub const TASKS_MAX: &str = "TasksMax";

src/systemd/cpu.rs

@@ -0,0 +1,29 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use crate::systemd::error::Result;
+use crate::systemd::{CPU_QUOTA_PERIOD_US, CPU_QUOTA_PER_SEC_US, CPU_SHARES, CPU_WEIGHT};
+
+/// Returns the property for CPU shares.
+///
+/// Please note that if the shares is obtained from OCI runtime spec, it
+/// MUST be converted, see [1] and `convert_shares_to_v2()`.
+///
+/// 1: https://github.com/containers/crun/blob/main/crun.1.md#cgroup-v2
+pub fn shares(shares: u64, v2: bool) -> Result<(&'static str, u64)> {
+    let id = if v2 { CPU_WEIGHT } else { CPU_SHARES };
+
+    Ok((id, shares))
+}
+
+/// Returns the property for CPU period.
+pub fn period(period: u64) -> Result<(&'static str, u64)> {
+    Ok((CPU_QUOTA_PERIOD_US, period))
+}
+
+/// Return the property for CPU quota.
+pub fn quota(quota: u64) -> Result<(&'static str, u64)> {
+    Ok((CPU_QUOTA_PER_SEC_US, quota))
+}

src/systemd/cpuset.rs

@@ -0,0 +1,96 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use bit_vec::BitVec;
+
+use crate::systemd::error::{Error, Result};
+use crate::systemd::{ALLOWED_CPUS, ALLOWED_MEMORY_NODES};
+
+const BYTE_IN_BITS: usize = 8;
+
+/// Returns the property for cpuset CPUs.
+pub fn cpus(cpus: &str) -> Result<(&'static str, Vec<u8>)> {
+    let mask = convert_list_to_mask(cpus)?;
+    Ok((ALLOWED_CPUS, mask))
+}
+
+/// Returns the property for cpuset memory nodes.
+pub fn mems(mems: &str) -> Result<(&'static str, Vec<u8>)> {
+    let mask = convert_list_to_mask(mems)?;
+    Ok((ALLOWED_MEMORY_NODES, mask))
+}
+
+/// Convert cpuset cpus/mems from the string in comma-separated list format
+/// to bitmask restored in `Vec<u8>`, see [1].
+///
+/// 1: https://man7.org/linux/man-pages/man7/cpuset.7.html
+///
+/// # Arguments
+///
+/// * `list` - A string slice that holds the list of CPUs in the format
+///   "0-3,5,7".
+fn convert_list_to_mask(list: &str) -> Result<Vec<u8>> {
+    let mut bit_vec = BitVec::from_elem(8, false);
+
+    let local_idx =
+        |index: usize| -> usize { index / BYTE_IN_BITS * BYTE_IN_BITS + 7 - index % BYTE_IN_BITS };
+
+    for part1 in list.split(',') {
+        let range: Vec<&str> = part1.split('-').collect();
+        match range.len() {
+            // x-
+            1 => {
+                let left: usize = range[0].parse().map_err(|_| Error::InvalidArgument)?;
+
+                while left >= bit_vec.len() {
+                    bit_vec.grow(BYTE_IN_BITS, false);
+                }
+                bit_vec.set(local_idx(left), true);
+            }
+            // x-y
+            2 => {
+                let left: usize = range[0].parse().map_err(|_| Error::InvalidArgument)?;
+                let right: usize = range[1].parse().map_err(|_| Error::InvalidArgument)?;
+
+                while right >= bit_vec.len() {
+                    bit_vec.grow(BYTE_IN_BITS, false);
+                }
+
+                for index in left..=right {
+                    bit_vec.set(local_idx(index), true);
+                }
+            }
+            _ => {
+                return Err(Error::InvalidArgument);
+            }
+        }
+    }
+
+    let mut mask = bit_vec.to_bytes();
+    mask.reverse();
+
+    Ok(mask)
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::systemd::cpuset::convert_list_to_mask;
+
+    #[test]
+    fn test_convert_list_to_mask() {
+        let mask = convert_list_to_mask("2-4").unwrap();
+        assert_eq!(vec![0b00011100_u8], mask);
+
+        let mask = convert_list_to_mask("1,7").unwrap();
+        assert_eq!(vec![0b10000010_u8], mask);
+
+        let mask = convert_list_to_mask("0-4,9").unwrap();
+        assert_eq!(vec![0b00000010_u8, 0b00011111_u8], mask);
+
+        assert!(convert_list_to_mask("1-3-4").is_err());
+
+        assert!(convert_list_to_mask("1-3,,").is_err());
+    }
+}

src/systemd/dbus/README.md

@@ -0,0 +1,17 @@
+# Systemd Dbus
+
+How to generate `xxx_proxy.rs` files
+
+```shell
+# install zbus-xmlgen if not
+$ cargo install zbus-xmlgen
+# generate interface in XML format
+$ busctl introspect --xml-interface \
+    org.freedesktop.systemd1 \
+    /org/freedesktop/systemd1 \
+    org.freedesktop.systemd1.Manager > /tmp/systemd1-manager.xml
+# generate Rust code from XML
+$ zbus-xmlgen file /tmp/systemd1-manager.xml \
+    --output src/systemd/dbus/systemd_manager_proxy.rs
+$ rm -rf /tmp/systemd1-manager.xml
+```

src/systemd/dbus/client.rs

@@ -0,0 +1,544 @@
+// Copyright 2021-2023 Kata Contributors
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use zbus::zvariant::Value;
+use zbus::{Error as ZbusError, Result as ZbusResult};
+
+use crate::systemd::dbus::error::{Error, Result};
+use crate::systemd::dbus::proxy::systemd_manager_proxy;
+use crate::systemd::{Property, NO_SUCH_UNIT, PIDS, UNIT_MODE_REPLACE};
+use crate::CgroupPid;
+
+pub struct SystemdClient<'a> {
+    /// The name of the systemd unit (slice or scope)
+    unit: String,
+    props: Vec<Property<'a>>,
+}
+
+impl<'a> SystemdClient<'a> {
+    pub fn new(unit: &str, props: Vec<Property<'a>>) -> Result<Self> {
+        Ok(Self {
+            unit: unit.to_string(),
+            props,
+        })
+    }
+}
+
+impl SystemdClient<'_> {
+    /// Set the pid to the PIDs property of the unit.
+    ///
+    /// Append a process ID to the PIDs property of the unit. If not
+    /// exists, one property will be created.
+    pub fn set_pid_prop(&mut self, pid: CgroupPid) -> Result<()> {
+        if self.exists() {
+            return Ok(());
+        }
+
+        for prop in self.props.iter_mut() {
+            if prop.0 == PIDS {
+                // If PIDS is already set, we append the new pid to the existing list.
+                if let Value::Array(arr) = &mut prop.1 {
+                    arr.append(pid.pid.into())
+                        .map_err(|_| Error::InvalidProperties)?;
+                    return Ok(());
+                }
+                // Invalid type of PIDs
+                return Err(Error::InvalidProperties);
+            }
+        }
+        // If PIDS is not set, we create a new property.
+        self.props
+            .push((PIDS, Value::Array(vec![pid.pid as u32].into())));
+        Ok(())
+    }
+
+    /// Start a slice or a scope unit controlled and supervised by systemd.
+    ///
+    /// For more information, see:
+    /// https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html
+    /// https://www.freedesktop.org/software/systemd/man/latest/systemd.slice.html
+    /// https://www.freedesktop.org/software/systemd/man/latest/systemd.scope.html
+    pub fn start(&self) -> Result<()> {
+        // PIDs property must be present
+        if !self.props.iter().any(|(k, _)| k == &PIDS) {
+            return Err(Error::InvalidProperties);
+        }
+
+        let sys_proxy = systemd_manager_proxy()?;
+
+        let props_borrowed: Vec<(&str, &zbus::zvariant::Value)> =
+            self.props.iter().map(|(k, v)| (*k, v)).collect();
+        let props_borrowed: Vec<&(&str, &Value)> = props_borrowed.iter().collect();
+
+        sys_proxy.start_transient_unit(&self.unit, UNIT_MODE_REPLACE, &props_borrowed, &[])?;
+
+        Ok(())
+    }
+
+    /// Stop the current transient unit, the processes will be killed on
+    /// unit stop, see [1].
+    ///
+    /// 1. https://www.freedesktop.org/software/systemd/man/latest/systemd.kill.html#KillMode=
+    pub fn stop(&self) -> Result<()> {
+        let sys_proxy = systemd_manager_proxy()?;
+
+        let ret = sys_proxy.stop_unit(&self.unit, UNIT_MODE_REPLACE);
+        ignore_no_such_unit(ret)?;
+
+        // If we stop the unit and it still exists, it may be in a failed
+        // state, so we will try to reset it.
+        if self.exists() {
+            let ret = sys_proxy.reset_failed_unit(&self.unit);
+            ignore_no_such_unit(ret)?;
+        }
+
+        Ok(())
+    }
+
+    /// Set properties for the unit through dbus `SetUnitProperties`.
+    pub fn set_properties(&mut self, properties: &[Property<'static>]) -> Result<()> {
+        for prop in properties {
+            let new = prop.1.try_clone().map_err(|_| Error::InvalidProperties)?;
+            // Try to update the value first, if fails, append it.
+            if let Some(existing) = self.props.iter_mut().find(|p| p.0 == prop.0) {
+                existing.1 = new;
+            } else {
+                self.props.push((prop.0, new));
+            }
+        }
+
+        // The unit must exist before setting properties.
+        if !self.exists() {
+            return Ok(());
+        }
+
+        let sys_proxy = systemd_manager_proxy()?;
+
+        let props_borrowed: Vec<(&str, &Value)> = properties.iter().map(|(k, v)| (*k, v)).collect();
+        let props_borrowed: Vec<&(&str, &Value)> = props_borrowed.iter().collect();
+
+        sys_proxy.set_unit_properties(&self.unit, true, &props_borrowed)?;
+
+        Ok(())
+    }
+
+    /// Freeze the unit through dbus `FreezeUnit`.
+    pub fn freeze(&self) -> Result<()> {
+        let sys_proxy = systemd_manager_proxy()?;
+
+        sys_proxy.freeze_unit(&self.unit)?;
+
+        Ok(())
+    }
+
+    /// Thaw the frozen unit through dbus `ThawUnit`.
+    pub fn thaw(&self) -> Result<()> {
+        let sys_proxy = systemd_manager_proxy()?;
+
+        sys_proxy.thaw_unit(&self.unit)?;
+
+        Ok(())
+    }
+
+    /// Check if the unit exists.
+    pub fn exists(&self) -> bool {
+        let sys_proxy = match systemd_manager_proxy() {
+            Ok(proxy) => proxy,
+            _ => return false,
+        };
+
+        sys_proxy
+            .get_unit(&self.unit)
+            .map(|_| true)
+            .unwrap_or_default()
+    }
+
+    /// Add a process (tgid) to the unit through dbus
+    /// `AttachProcessesToUnit`.
+    pub fn add_process(&self, pid: CgroupPid, subcgroup: &str) -> Result<()> {
+        let sys_proxy = systemd_manager_proxy()?;
+
+        sys_proxy.attach_processes_to_unit(&self.unit, subcgroup, &[pid.pid as u32])?;
+
+        Ok(())
+    }
+}
+
+fn ignore_no_such_unit<T>(result: ZbusResult<T>) -> ZbusResult<bool> {
+    if let Err(ZbusError::MethodError(err_name, _, _)) = &result {
+        if err_name.as_str() == NO_SUCH_UNIT {
+            return Ok(true);
+        }
+    }
+    result.map(|_| false)
+}
+
+#[cfg(test)]
+pub mod tests {
+    //! Unit tests for the SystemdClient
+    //!
+    //! Not sure why the tests are going to fail if we run them in
+    //! parallel. Everything goes smoothly in serial.
+    //!
+    //! $ cargo test --package cgroups-rs --lib \
+    //!   -- systemd::dbus::client::tests \
+    //!   --show-output --test-threads=1
+
+    use std::fs;
+    use std::path::Path;
+    use std::process::Command;
+    use std::thread::sleep;
+    use std::time::Duration;
+
+    use rand::distributions::Alphanumeric;
+    use rand::Rng;
+
+    use crate::fs::hierarchies;
+    use crate::systemd::dbus::client::*;
+    use crate::systemd::props::PropertiesBuilder;
+    use crate::systemd::utils::expand_slice;
+    use crate::systemd::{DEFAULT_DESCRIPTION, DESCRIPTION, PIDS};
+    use crate::tests::{spawn_sleep_inf, spawn_yes};
+
+    const TEST_SLICE: &str = "cgroupsrs-test.slice";
+
+    fn test_unit() -> String {
+        let rand_string: String = rand::thread_rng()
+            .sample_iter(&Alphanumeric)
+            .take(5)
+            .map(char::from)
+            .collect();
+        format!("cri-pod{}.scope", rand_string)
+    }
+
+    #[macro_export]
+    macro_rules! skip_if_no_systemd {
+        () => {
+            if $crate::tests::systemd_version().is_none() {
+                eprintln!("Test skipped, no systemd?");
+                return;
+            }
+        };
+    }
+
+    fn systemd_show(unit: &str) -> String {
+        let output = Command::new("systemctl")
+            .arg("show")
+            .arg(unit)
+            .output()
+            .expect("Failed to execute systemctl show command");
+        String::from_utf8_lossy(&output.stdout).to_string()
+    }
+
+    fn start_default_cgroup(pid: CgroupPid, unit: &'_ str) -> SystemdClient<'_> {
+        let mut props = PropertiesBuilder::default_cgroup(TEST_SLICE, unit).build();
+        props.push((PIDS, Value::Array(vec![pid.pid as u32].into())));
+        let cgroup = SystemdClient::new(unit, props).unwrap();
+        // Stop the unit if it exists.
+        cgroup.stop().unwrap();
+
+        // Write the current process to the cgroup.
+        cgroup.start().unwrap();
+        cgroup.add_process(pid, "/").unwrap();
+        cgroup
+    }
+
+    fn stop_cgroup(cgroup: &SystemdClient) {
+        cgroup.stop().unwrap();
+    }
+
+    #[test]
+    fn test_start() {
+        skip_if_no_systemd!();
+
+        let v2 = hierarchies::is_cgroup2_unified_mode();
+        let unit = test_unit();
+        let mut child = spawn_sleep_inf();
+        let cgroup = start_default_cgroup(CgroupPid::from(child.id() as u64), &unit);
+
+        let base = expand_slice(TEST_SLICE).unwrap();
+
+        // Check if the cgroup exists in the filesystem
+        let full_base = if v2 {
+            format!("/sys/fs/cgroup/{}", base)
+        } else {
+            format!("/sys/fs/cgroup/memory/{}", base)
+        };
+        assert!(
+            Path::new(&full_base).exists(),
+            "Cgroup base path does not exist: {}",
+            full_base
+        );
+
+        // PIDs
+        let cgroup_procs_path = format!("{}/{}/cgroup.procs", full_base, &unit);
+        for i in 0..5 {
+            let content = fs::read_to_string(&cgroup_procs_path);
+            if let Ok(content) = &content {
+                if content.contains(&child.id().to_string()) {
+                    break;
+                }
+            }
+            // Retry attempts exhausted, resulting in failure
+            if i == 4 {
+                let content = content.as_ref().unwrap();
+                assert!(
+                    content.contains(&child.id().to_string()),
+                    "Cgroup procs does not contain the child process ID"
+                );
+            }
+            // Wait 500ms before next retrying
+            sleep(Duration::from_millis(500));
+        }
+
+        // Check the unit from "systemctl show <unit>"
+        let output = systemd_show(&cgroup.unit);
+
+        // Slice
+        assert!(
+            output
+                .lines()
+                .any(|line| line == format!("Slice={}", TEST_SLICE)),
+            "Slice not found"
+        );
+        // Delegate
+        assert!(
+            output.lines().any(|line| line == "Delegate=yes"),
+            "Delegate not set"
+        );
+        // DelegateControllers
+        // controllers: cpu cpuacct cpuset io blkio memory devices pids
+        let controllers = output
+            .lines()
+            .find(|line| line.starts_with("DelegateControllers="))
+            .map(|line| line.trim_start_matches("DelegateControllers="))
+            .unwrap();
+        let controllers = controllers.split(' ').collect::<Vec<&str>>();
+        assert!(
+            controllers.contains(&"cpu"),
+            "DelegateControllers cpu not set"
+        );
+        assert!(
+            controllers.contains(&"cpuset"),
+            "DelegateControllers cpuset not set"
+        );
+        if v2 {
+            assert!(
+                controllers.contains(&"io"),
+                "DelegateControllers io not set"
+            );
+        } else {
+            assert!(
+                controllers.contains(&"blkio"),
+                "DelegateControllers blkio not set"
+            );
+        }
+        assert!(
+            controllers.contains(&"memory"),
+            "DelegateControllers memory not set"
+        );
+        assert!(
+            controllers.contains(&"pids"),
+            "DelegateControllers pids not set"
+        );
+
+        // CPUAccounting
+        assert!(
+            output.lines().any(|line| line == "CPUAccounting=yes"),
+            "CPUAccounting not set"
+        );
+        // IOAccounting for v2, and BlockIOAccounting for v1
+        if v2 {
+            assert!(
+                output.lines().any(|line| line == "IOAccounting=yes"),
+                "IOAccounting not set"
+            );
+        } else {
+            assert!(
+                output.lines().any(|line| line == "BlockIOAccounting=yes"),
+                "BlockIOAccounting not set"
+            );
+        }
+        // MemoryAccounting
+        assert!(
+            output.lines().any(|line| line == "MemoryAccounting=yes"),
+            "MemoryAccounting not set"
+        );
+        // TasksAccounting
+        assert!(
+            output.lines().any(|line| line == "TasksAccounting=yes"),
+            "TasksAccounting not set"
+        );
+        // ActiveState
+        assert!(
+            output.lines().any(|line| line == "ActiveState=active"),
+            "Unit is not active"
+        );
+
+        stop_cgroup(&cgroup);
+        child.wait().unwrap();
+    }
+
+    #[test]
+    fn test_stop() {
+        skip_if_no_systemd!();
+
+        let unit = test_unit();
+        let mut child = spawn_sleep_inf();
+        let cgroup = start_default_cgroup(CgroupPid::from(child.id() as u64), &unit);
+
+        // Check ActiveState: expected to be "active"
+        let output = systemd_show(&cgroup.unit);
+        assert!(
+            output.lines().any(|line| line == "ActiveState=active"),
+            "Unit is not active"
+        );
+
+        stop_cgroup(&cgroup);
+
+        // Check ActiveState: expected to be "inactive"
+        let output = systemd_show(&cgroup.unit);
+        assert!(
+            output.lines().any(|line| line == "ActiveState=inactive"),
+            "Unit is not inactive"
+        );
+
+        child.wait().unwrap();
+    }
+
+    #[test]
+    fn test_set_properties() {
+        skip_if_no_systemd!();
+
+        let unit = test_unit();
+        let mut child = spawn_sleep_inf();
+        let mut cgroup = start_default_cgroup(CgroupPid::from(child.id() as u64), &unit);
+
+        let output = systemd_show(&cgroup.unit);
+        assert!(
+            output.lines().any(|line| line
+                == format!(
+                    "Description={} {}:{}",
+                    DEFAULT_DESCRIPTION, TEST_SLICE, unit
+                )),
+            "Initial description not set correctly"
+        );
+
+        let properties = [(
+            DESCRIPTION,
+            Value::Str("kata-container1 description".into()),
+        )];
+        cgroup.set_properties(&properties).unwrap();
+        assert!(cgroup.props.iter().any(|(k, v)| {
+            k == &DESCRIPTION && v == &Value::Str("kata-container1 description".into())
+        }));
+
+        let output = systemd_show(&cgroup.unit);
+        assert!(
+            output
+                .lines()
+                .any(|line| line == "Description=kata-container1 description"),
+            "Updated description not set correctly"
+        );
+
+        stop_cgroup(&cgroup);
+        child.wait().unwrap();
+    }
+
+    #[test]
+    fn test_freeze_and_thaw() {
+        skip_if_no_systemd!();
+
+        let unit = test_unit();
+        let mut child = spawn_yes();
+        let cgroup = start_default_cgroup(CgroupPid::from(child.id() as u64), &unit);
+
+        // Freeze the unit
+        cgroup.freeze().unwrap();
+
+        let pid = child.id() as u64;
+
+        let stat_path = format!("/proc/{}/stat", pid);
+        let content = fs::read_to_string(&stat_path).unwrap();
+        // The process state is the third field, e.g.:
+        // 1234 (bash) S 1233 ...
+        //             ^
+        let mut content_iter = content.split_whitespace();
+        assert_eq!(
+            content_iter.nth(2).unwrap(),
+            "S",
+            "Process should be in 'S' (sleeping) state after freezing"
+        );
+
+        // Thaw the unit
+        cgroup.thaw().unwrap();
+
+        // No more S now
+        let content = fs::read_to_string(&stat_path).unwrap();
+        let mut content_iter = content.split_whitespace();
+        assert_ne!(
+            content_iter.nth(2).unwrap(),
+            "S",
+            "Process should not be in 'S' (sleeping) state after thawing"
+        );
+
+        stop_cgroup(&cgroup);
+        child.wait().unwrap();
+    }
+
+    #[test]
+    fn test_exists() {
+        skip_if_no_systemd!();
+
+        let unit = test_unit();
+        let mut child = spawn_sleep_inf();
+        let cgroup = start_default_cgroup(CgroupPid::from(child.id() as u64), &unit);
+
+        assert!(cgroup.exists(), "Cgroup should exist after starting");
+
+        stop_cgroup(&cgroup);
+        child.wait().unwrap();
+    }
+
+    #[test]
+    fn test_add_process() {
+        skip_if_no_systemd!();
+
+        let unit = test_unit();
+        let mut child = spawn_sleep_inf();
+        let cgroup = start_default_cgroup(CgroupPid::from(child.id() as u64), &unit);
+
+        let mut child1 = spawn_sleep_inf();
+        let pid1 = CgroupPid::from(child1.id() as u64);
+        cgroup.add_process(pid1, "/").unwrap();
+
+        let cgroup_procs_path = format!(
+            "/sys/fs/cgroup/{}/{}/cgroup.procs",
+            expand_slice(TEST_SLICE).unwrap(),
+            unit
+        );
+        for i in 0..5 {
+            let content = fs::read_to_string(&cgroup_procs_path);
+            if let Ok(content) = content {
+                assert!(
+                    content.contains(&child1.id().to_string()),
+                    "Cgroup procs does not contain the child1 process ID"
+                );
+                break;
+            }
+            // Retry attempts exhausted, resulting in failure
+            if i == 4 {
+                content.unwrap();
+            }
+            // Wait 500ms before next retrying
+            sleep(Duration::from_millis(500));
+        }
+
+        stop_cgroup(&cgroup);
+        child.wait().unwrap();
+        child1.wait().unwrap();
+    }
+}

src/systemd/dbus/error.rs

@@ -0,0 +1,15 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("invalid properties")]
+    InvalidProperties,
+
+    #[error("dbus error: {0}")]
+    Dbus(#[from] zbus::Error),
+}

src/systemd/dbus/mod.rs

@@ -0,0 +1,18 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020-2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! Systemd D-Bus interface for managing cgroups and units.
+//!
+//! References:
+//! https://www.freedesktop.org/software/systemd/man/latest/org.freedesktop.systemd1.html
+//! https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html
+//! https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html
+
+mod client;
+pub mod error;
+mod systemd_manager_proxy;
+pub use client::SystemdClient;
+mod proxy;

src/systemd/dbus/proxy.rs

@@ -0,0 +1,16 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use zbus::blocking::Connection;
+use zbus::Result;
+
+use crate::systemd::dbus::systemd_manager_proxy::ManagerProxyBlocking as SystemManager;
+
+pub(crate) fn systemd_manager_proxy<'a>() -> Result<SystemManager<'a>> {
+    let connection = Connection::system()?;
+    let proxy = SystemManager::new(&connection)?;
+
+    Ok(proxy)
+}

src/systemd/error.rs

@@ -0,0 +1,15 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("invalid argument")]
+    InvalidArgument,
+
+    #[error("resource not supported by cgroups v1")]
+    CgroupsV1NotSupported,
+}

src/systemd/memory.rs

@@ -0,0 +1,32 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use crate::systemd::error::{Error, Result};
+use crate::systemd::{MEMORY_LIMIT, MEMORY_LOW, MEMORY_MAX, MEMORY_SWAP_MAX};
+
+/// Returns the property for memory limit.
+pub fn limit(limit: i64, v2: bool) -> Result<(&'static str, u64)> {
+    let id = if v2 { MEMORY_MAX } else { MEMORY_LIMIT };
+
+    Ok((id, limit as u64))
+}
+
+/// Returns the property for memory limit.
+pub fn low(low: i64, v2: bool) -> Result<(&'static str, u64)> {
+    if !v2 {
+        return Err(Error::CgroupsV1NotSupported);
+    }
+
+    Ok((MEMORY_LOW, low as u64))
+}
+
+/// Returns the property for memory swap.
+pub fn swap(swap: i64, v2: bool) -> Result<(&'static str, u64)> {
+    if !v2 {
+        return Err(Error::CgroupsV1NotSupported);
+    }
+
+    Ok((MEMORY_SWAP_MAX, swap as u64))
+}

src/systemd/mod.rs

@@ -0,0 +1,22 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+pub mod cpu;
+pub mod cpuset;
+pub mod dbus;
+pub use dbus::SystemdClient;
+mod consts;
+pub use consts::*;
+pub mod error;
+pub mod memory;
+pub mod pids;
+pub mod props;
+pub use props::Property;
+pub mod utils;
+
+pub const DEFAULT_SLICE: &str = "system.slice";
+
+pub const SLICE_SUFFIX: &str = ".slice";
+pub const SCOPE_SUFFIX: &str = ".scope";

src/systemd/pids.rs

@@ -0,0 +1,11 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use crate::systemd::error::Result;
+use crate::systemd::TASKS_MAX;
+
+pub fn max(max: i64) -> Result<(&'static str, u64)> {
+    Ok((TASKS_MAX, max as u64))
+}

src/systemd/props.rs

@@ -0,0 +1,170 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use zbus::zvariant::Value as ZbusValue;
+
+use crate::fs::hierarchies;
+use crate::systemd::utils::is_slice_unit;
+use crate::systemd::{
+    BLOCK_IO_ACCOUNTING, CPU_ACCOUNTING, DEFAULT_DEPENDENCIES, DEFAULT_DESCRIPTION, DELEGATE,
+    DESCRIPTION, IO_ACCOUNTING, MEMORY_ACCOUNTING, PIDS, SLICE, TASKS_ACCOUNTING,
+    TIMEOUT_STOP_USEC, WANTS,
+};
+
+pub type Property<'a> = (&'a str, ZbusValue<'a>);
+
+#[derive(Debug, Clone, Default)]
+pub struct PropertiesBuilder {
+    cpu_accounting: Option<bool>,
+    // MemoryAccount is for cgroup v2 as documented in dbus. However,
+    // "github.com/opencontainer/runc" uses it for all. Shall we follow the
+    // same way?
+    memory_accounting: Option<bool>,
+    task_accounting: Option<bool>,
+    // Use IO_ACCOUNTING for cgroup v2 and BLOCK_IO_ACCOUNTING for cgroup v1.
+    io_accounting: Option<bool>,
+    default_dependencies: Option<bool>,
+    description: Option<String>,
+    wants: Option<String>,
+    slice: Option<String>,
+    delegate: Option<bool>,
+    pids: Option<Vec<u32>>,
+    timeout_stop_usec: Option<u64>,
+}
+
+impl PropertiesBuilder {
+    pub fn default_cgroup(slice: &str, unit: &str) -> Self {
+        let mut builder = Self::default()
+            .cpu_accounting(true)
+            .memory_accounting(true)
+            .task_accounting(true)
+            .io_accounting(true)
+            .default_dependencies(false)
+            .description(format!("{} {}:{}", DEFAULT_DESCRIPTION, slice, unit));
+
+        if is_slice_unit(unit) {
+            // If we create a slice, the parent is defined via a Wants=.
+            builder = builder.wants(slice.to_string());
+        } else {
+            // Otherwise it's a scope, which we put into a Slice=.
+            builder = builder.slice(slice.to_string());
+            // Assume scopes always support delegation (supported since systemd v218).
+            builder = builder.delegate(true);
+        }
+
+        builder
+    }
+
+    pub fn cpu_accounting(mut self, enabled: bool) -> Self {
+        self.cpu_accounting = Some(enabled);
+        self
+    }
+
+    pub fn memory_accounting(mut self, enabled: bool) -> Self {
+        self.memory_accounting = Some(enabled);
+        self
+    }
+
+    pub fn task_accounting(mut self, enabled: bool) -> Self {
+        self.task_accounting = Some(enabled);
+        self
+    }
+
+    pub fn io_accounting(mut self, enabled: bool) -> Self {
+        self.io_accounting = Some(enabled);
+        self
+    }
+
+    pub fn default_dependencies(mut self, enabled: bool) -> Self {
+        self.default_dependencies = Some(enabled);
+        self
+    }
+
+    pub fn description(mut self, desc: String) -> Self {
+        self.description = Some(desc);
+        self
+    }
+
+    pub fn wants(mut self, wants: String) -> Self {
+        self.wants = Some(wants);
+        self
+    }
+
+    pub fn slice(mut self, slice: String) -> Self {
+        self.slice = Some(slice);
+        self
+    }
+
+    pub fn delegate(mut self, enabled: bool) -> Self {
+        self.delegate = Some(enabled);
+        self
+    }
+
+    pub fn pids(mut self, pids: Vec<u32>) -> Self {
+        self.pids = Some(pids);
+        self
+    }
+
+    pub fn timeout_stop_usec(mut self, timeout: u64) -> Self {
+        self.timeout_stop_usec = Some(timeout);
+        self
+    }
+
+    pub fn build(self) -> Vec<Property<'static>> {
+        let mut props = vec![];
+
+        if let Some(cpu_accounting) = self.cpu_accounting {
+            props.push((CPU_ACCOUNTING, ZbusValue::Bool(cpu_accounting)));
+        }
+
+        if let Some(memory_accounting) = self.memory_accounting {
+            props.push((MEMORY_ACCOUNTING, ZbusValue::Bool(memory_accounting)));
+        }
+
+        if let Some(task_accounting) = self.task_accounting {
+            props.push((TASKS_ACCOUNTING, ZbusValue::Bool(task_accounting)));
+        }
+
+        if let Some(io_accounting) = self.io_accounting {
+            if hierarchies::is_cgroup2_unified_mode() {
+                props.push((IO_ACCOUNTING, ZbusValue::Bool(io_accounting)));
+            } else {
+                props.push((BLOCK_IO_ACCOUNTING, ZbusValue::Bool(io_accounting)));
+            }
+        }
+
+        if let Some(default_dependencies) = self.default_dependencies {
+            props.push((DEFAULT_DEPENDENCIES, ZbusValue::Bool(default_dependencies)));
+        }
+
+        if let Some(description) = self.description {
+            props.push((DESCRIPTION, ZbusValue::Str(description.into())));
+        } else {
+            props.push((DESCRIPTION, ZbusValue::Str(DEFAULT_DESCRIPTION.into())));
+        }
+
+        if let Some(wants) = self.wants {
+            props.push((WANTS, ZbusValue::Str(wants.into())));
+        }
+
+        if let Some(slice) = self.slice {
+            props.push((SLICE, ZbusValue::Str(slice.into())));
+        }
+
+        if let Some(delegate) = self.delegate {
+            props.push((DELEGATE, ZbusValue::Bool(delegate)));
+        }
+
+        if let Some(pids) = self.pids {
+            props.push((PIDS, ZbusValue::Array(pids.into())));
+        }
+
+        if let Some(timeout) = self.timeout_stop_usec {
+            props.push((TIMEOUT_STOP_USEC, ZbusValue::U64(timeout)));
+        }
+
+        props
+    }
+}

src/systemd/utils.rs

@@ -0,0 +1,101 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use crate::systemd::error::{Error, Result};
+use crate::systemd::{SCOPE_SUFFIX, SLICE_SUFFIX};
+
+/// Check if a systemd unit name is a slice unit.
+pub fn is_slice_unit(name: &str) -> bool {
+    name.ends_with(SLICE_SUFFIX)
+}
+
+/// Check if a systemd unit name is a scope unit.
+pub fn is_scope_unit(name: &str) -> bool {
+    name.ends_with(SCOPE_SUFFIX)
+}
+
+/// Expand a slice name to a full path in the filesystem.
+///
+/// # Arguments
+///
+/// * `slice` - A string slice that holds the slice name in the format
+///   "xxx-yyy-zzz.slice".
+///
+/// # Returns
+///
+/// A string that represents the full path of the slice in the filesystem.
+/// In the above case, the value would be
+/// "xxx.slice/xxx-yyy.slice/xxx-yyy-zzz.slice".
+pub fn expand_slice(slice: &str) -> Result<String> {
+    // Name has to end with ".slice", but can't be just ".slice".
+    if !slice.ends_with(SLICE_SUFFIX) || slice.len() < SLICE_SUFFIX.len() {
+        return Err(Error::InvalidArgument);
+    }
+
+    // Path-separators are not allowed.
+    if slice.contains('/') {
+        return Err(Error::InvalidArgument);
+    }
+
+    let name = slice.trim_end_matches(SLICE_SUFFIX);
+
+    // If input was -.slice, we should just return root now
+    if name == "-" {
+        return Ok("".to_string());
+    }
+
+    let mut slice_path = String::new();
+    let mut prefix = String::new();
+    for sub_slice in name.split('-') {
+        if sub_slice.is_empty() {
+            return Err(Error::InvalidArgument);
+        }
+
+        slice_path = format!("{}/{}{}{}", slice_path, prefix, sub_slice, SLICE_SUFFIX);
+        prefix = format!("{}{}-", prefix, sub_slice);
+    }
+
+    // We need a relative path, so remove the first slash.
+    slice_path.remove(0);
+
+    Ok(slice_path)
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::systemd::utils::*;
+
+    #[test]
+    fn test_is_slice_unit() {
+        assert!(is_slice_unit("test.slice"));
+        assert!(!is_slice_unit("test.scope"));
+    }
+
+    #[test]
+    fn test_is_scope_unit() {
+        assert!(is_scope_unit("test.scope"));
+        assert!(!is_scope_unit("test.slice"));
+    }
+
+    #[test]
+    fn test_expand_slice() {
+        assert_eq!(expand_slice("test.slice").unwrap(), "test.slice");
+        assert_eq!(
+            expand_slice("test-1.slice").unwrap(),
+            "test.slice/test-1.slice"
+        );
+        assert_eq!(
+            expand_slice("test-1-test-2.slice").unwrap(),
+            "test.slice/test-1.slice/test-1-test.slice/test-1-test-2.slice"
+        );
+        assert_eq!(
+            expand_slice("slice-slice.slice").unwrap(),
+            "slice.slice/slice-slice.slice"
+        );
+        assert_eq!(expand_slice("-.slice").unwrap(), "");
+        assert!(expand_slice("invalid/slice").is_err());
+        assert!(expand_slice("invalid-slice").is_err());
+    }
+}

tests/builder.rs

@@ -0,0 +1,169 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020 And Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! Some simple tests covering the builder pattern for control groups.
+use cgroups_rs::fs::blkio::*;
+use cgroups_rs::fs::cgroup_builder::*;
+use cgroups_rs::fs::cpu::*;
+use cgroups_rs::fs::devices::*;
+use cgroups_rs::fs::hugetlb::*;
+use cgroups_rs::fs::memory::*;
+use cgroups_rs::fs::net_cls::*;
+use cgroups_rs::fs::pid::*;
+use cgroups_rs::fs::*;
+
+#[test]
+pub fn test_cpu_res_build() {
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg: Cgroup = CgroupBuilder::new("test_cpu_res_build")
+        .cpu()
+        .shares(85)
+        .done()
+        .build(h)
+        .unwrap();
+
+    {
+        let cpu: &CpuController = cg.controller_of().unwrap();
+        assert!(cpu.shares().is_ok());
+        assert_eq!(cpu.shares().unwrap(), 85);
+    }
+
+    cg.delete().unwrap();
+}
+
+#[test]
+pub fn test_memory_res_build() {
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg: Cgroup = CgroupBuilder::new("test_memory_res_build")
+        .memory()
+        .kernel_memory_limit(128 * 1024 * 1024)
+        .swappiness(70)
+        .memory_hard_limit(1024 * 1024 * 1024)
+        .done()
+        .build(h)
+        .unwrap();
+
+    {
+        let c: &MemController = cg.controller_of().unwrap();
+        if !c.v2() {
+            // Note: we don't tests the value of c.kmem_stat().limit_in_bytes because on Linux
+            // kernel >= 5.16 setting this value is unsupported.
+            assert_eq!(c.memory_stat().swappiness, 70);
+        }
+        assert_eq!(c.memory_stat().limit_in_bytes, 1024 * 1024 * 1024);
+    }
+
+    cg.delete().unwrap();
+}
+
+#[test]
+pub fn test_pid_res_build() {
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg: Cgroup = CgroupBuilder::new("test_pid_res_build")
+        .pid()
+        .maximum_number_of_processes(MaxValue::Value(123))
+        .done()
+        .build(h)
+        .unwrap();
+
+    {
+        let c: &PidController = cg.controller_of().unwrap();
+        assert!(c.get_pid_max().is_ok());
+        assert_eq!(c.get_pid_max().unwrap(), MaxValue::Value(123));
+    }
+
+    cg.delete().unwrap();
+}
+
+#[test]
+#[ignore] // ignore this test for now, not sure why my kernel doesn't like it
+pub fn test_devices_res_build() {
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg: Cgroup = CgroupBuilder::new("test_devices_res_build")
+        .devices()
+        .device(1, 6, DeviceType::Char, true, vec![DevicePermissions::Read])
+        .done()
+        .build(h)
+        .unwrap();
+
+    {
+        let c: &DevicesController = cg.controller_of().unwrap();
+        assert!(c.allowed_devices().is_ok());
+        assert_eq!(
+            c.allowed_devices().unwrap(),
+            vec![DeviceResource {
+                allow: true,
+                devtype: DeviceType::Char,
+                major: 1,
+                minor: 6,
+                access: vec![DevicePermissions::Read],
+            }]
+        );
+    }
+    cg.delete().unwrap();
+}
+
+#[test]
+pub fn test_network_res_build() {
+    let h = cgroups_rs::fs::hierarchies::auto();
+    if h.v2() {
+        // FIXME add cases for v2
+        return;
+    }
+    let cg: Cgroup = CgroupBuilder::new("test_network_res_build")
+        .network()
+        .class_id(1337)
+        .done()
+        .build(h)
+        .unwrap();
+
+    {
+        let c: &NetClsController = cg.controller_of().unwrap();
+        assert!(c.get_class().is_ok());
+        assert_eq!(c.get_class().unwrap(), 1337);
+    }
+    cg.delete().unwrap();
+}
+
+#[test]
+pub fn test_hugepages_res_build() {
+    let h = cgroups_rs::fs::hierarchies::auto();
+    if h.v2() {
+        // FIXME add cases for v2
+        return;
+    }
+    let cg: Cgroup = CgroupBuilder::new("test_hugepages_res_build")
+        .hugepages()
+        .limit("2MB".to_string(), 4 * 2 * 1024 * 1024)
+        .done()
+        .build(h)
+        .unwrap();
+
+    {
+        let c: &HugeTlbController = cg.controller_of().unwrap();
+        assert!(c.limit_in_bytes("2MB").is_ok());
+        assert_eq!(c.limit_in_bytes("2MB").unwrap(), 4 * 2 * 1024 * 1024);
+    }
+    cg.delete().unwrap();
+}
+
+#[test]
+#[ignore] // high version kernel not support `blkio.weight`
+pub fn test_blkio_res_build() {
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg: Cgroup = CgroupBuilder::new("test_blkio_res_build")
+        .blkio()
+        .weight(100)
+        .done()
+        .build(h)
+        .unwrap();
+
+    {
+        let c: &BlkIoController = cg.controller_of().unwrap();
+        assert_eq!(c.blkio().weight, 100);
+    }
+    cg.delete().unwrap();
+}

tests/cgroup.rs

@@ -1,29 +1,275 @@
-//! Simple unit tests about the control groups system.
-extern crate cgroups;
-use cgroups::{Cgroup, CgroupPid};
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020 And Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
 
-extern crate nix;
-extern crate libc;
+//! Simple unit tests about the control groups system.
+use std::process::Command;
+use std::thread::sleep;
+use std::time::Duration;
+
+use cgroups_rs::fs::cgroup::{
+    CGROUP_MODE_DOMAIN, CGROUP_MODE_DOMAIN_INVALID, CGROUP_MODE_DOMAIN_THREADED,
+    CGROUP_MODE_THREADED,
+};
+use cgroups_rs::fs::memory::MemController;
+use cgroups_rs::fs::Controller;
+use cgroups_rs::fs::{Cgroup, Subsystem};
+use cgroups_rs::CgroupPid;
 
 #[test]
-fn test_tasks_iterator() {
-    let hier = cgroups::hierarchies::V1::new();
+fn test_procs_iterator_cgroup() {
+    let h = cgroups_rs::fs::hierarchies::auto();
     let pid = libc::pid_t::from(nix::unistd::getpid()) as u64;
-    let cg = Cgroup::new(&hier, String::from("test_tasks_iterator"));
+    let cg = Cgroup::new(h, String::from("test_procs_iterator_cgroup")).unwrap();
     {
         // Add a task to the control group.
-        cg.add_task(CgroupPid::from(pid));
+        cg.add_task_by_tgid(CgroupPid::from(pid)).unwrap();
+
+        let mut procs = cg.procs().into_iter();
+        // Verify that the task is indeed in the xcontrol group
+        assert_eq!(procs.next(), Some(CgroupPid::from(pid)));
+        assert_eq!(procs.next(), None);
+
+        // Now, try removing it.
+        cg.remove_task_by_tgid(CgroupPid::from(pid)).unwrap();
+        procs = cg.procs().into_iter();
+
+        // Verify that it was indeed removed.
+        assert_eq!(procs.next(), None);
+    }
+    cg.delete().unwrap();
+}
+
+#[test]
+fn test_tasks_iterator_cgroup_v1() {
+    if cgroups_rs::fs::hierarchies::is_cgroup2_unified_mode() {
+        return;
+    }
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let pid = libc::pid_t::from(nix::unistd::getpid()) as u64;
+    let cg = Cgroup::new(h, String::from("test_tasks_iterator_cgroup_v1")).unwrap();
+    {
+        // Add a task to the control group.
+        cg.add_task(CgroupPid::from(pid)).unwrap();
+
         let mut tasks = cg.tasks().into_iter();
-        // Verify that the task is indeed in the control group
+        // Verify that the task is indeed in the xcontrol group
         assert_eq!(tasks.next(), Some(CgroupPid::from(pid)));
         assert_eq!(tasks.next(), None);
-        
+
         // Now, try removing it.
-        cg.remove_task(CgroupPid::from(pid));
+        cg.remove_task(CgroupPid::from(pid)).unwrap();
         tasks = cg.tasks().into_iter();
 
         // Verify that it was indeed removed.
         assert_eq!(tasks.next(), None);
     }
-    cg.delete();
+    cg.delete().unwrap();
+}
+
+#[test]
+fn test_tasks_iterator_cgroup_threaded_mode() {
+    if !cgroups_rs::fs::hierarchies::is_cgroup2_unified_mode() {
+        return;
+    }
+    let pid = libc::pid_t::from(nix::unistd::getpid()) as u64;
+    let cg = Cgroup::new(
+        cgroups_rs::fs::hierarchies::auto(),
+        String::from("test_tasks_iterator_cgroup_threaded_mode"),
+    )
+    .unwrap();
+    let cg_threaded_sub1 = Cgroup::new_with_specified_controllers(
+        cgroups_rs::fs::hierarchies::auto(),
+        String::from("test_tasks_iterator_cgroup_threaded_mode/threaded_sub1"),
+        Some(vec![String::from("cpuset"), String::from("cpu")]),
+    )
+    .unwrap();
+    let cg_threaded_sub2 = Cgroup::new_with_specified_controllers(
+        cgroups_rs::fs::hierarchies::auto(),
+        String::from("test_tasks_iterator_cgroup_threaded_mode/threaded_sub2"),
+        Some(vec![String::from("cpuset"), String::from("cpu")]),
+    )
+    .unwrap();
+    {
+        // Verify that cgroup type of the control group is domain mode.
+        assert_eq!(cg.get_cgroup_type().unwrap(), CGROUP_MODE_DOMAIN);
+
+        // Set cgroup type of the sub-control group is thread mode.
+        cg_threaded_sub1
+            .set_cgroup_type(CGROUP_MODE_THREADED)
+            .unwrap();
+        // Verify that cgroup type of the sub-control group is thread mode.
+        assert_eq!(
+            cg_threaded_sub1.get_cgroup_type().unwrap(),
+            CGROUP_MODE_THREADED
+        );
+        // Verify that the cgroup type of the sub-control group that does
+        // not set the cgroup type is domain invalid mode.
+        assert_eq!(
+            cg_threaded_sub2.get_cgroup_type().unwrap(),
+            CGROUP_MODE_DOMAIN_INVALID
+        );
+        // Verify whether the cgroup type of the parent control group of
+        // the control group whose cgroup type is set to thread mode is
+        // domain thread mode.
+        assert_eq!(cg.get_cgroup_type().unwrap(), CGROUP_MODE_DOMAIN_THREADED);
+
+        // Set cgroup type of the sub-control group is thread mode.
+        cg_threaded_sub2
+            .set_cgroup_type(CGROUP_MODE_THREADED)
+            .unwrap();
+        // Verify that cgroup type of the sub-control group is thread mode.
+        assert_eq!(
+            cg_threaded_sub2.get_cgroup_type().unwrap(),
+            CGROUP_MODE_THREADED
+        );
+
+        // Add a proc to the control group.
+        cg.add_task_by_tgid(CgroupPid::from(pid)).unwrap();
+
+        let mut procs = cg.procs().into_iter();
+        // Verify that the task is indeed in the x control group
+        assert_eq!(procs.next(), Some(CgroupPid::from(pid)));
+        assert_eq!(procs.next(), None);
+
+        // Add a task to the sub control group.
+        cg_threaded_sub1.add_task(CgroupPid::from(pid)).unwrap();
+
+        let mut tasks = cg_threaded_sub1.tasks().into_iter();
+        // Verify that the task is indeed in the xcontrol group
+        assert_eq!(tasks.next(), Some(CgroupPid::from(pid)));
+        assert_eq!(tasks.next(), None);
+
+        // Now, try move it to parent.
+        cg_threaded_sub1
+            .move_task_to_parent(CgroupPid::from(pid))
+            .unwrap();
+        tasks = cg_threaded_sub1.tasks().into_iter();
+
+        // Verify that it was indeed removed.
+        assert_eq!(tasks.next(), None);
+
+        // Now, try removing it.
+        cg.remove_task_by_tgid(CgroupPid::from(pid)).unwrap();
+        procs = cg.procs().into_iter();
+
+        // Verify that it was indeed removed.
+        assert_eq!(procs.next(), None);
+    }
+    cg_threaded_sub1.delete().unwrap();
+    cg_threaded_sub2.delete().unwrap();
+    cg.delete().unwrap();
+}
+
+#[test]
+fn test_kill_cgroup() {
+    if !cgroups_rs::fs::hierarchies::is_cgroup2_unified_mode() {
+        return;
+    }
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg = Cgroup::new(h, String::from("test_kill_cgroup")).unwrap();
+    {
+        // Spawn a proc, don't want to getpid(2) here.
+        let mut child = Command::new("sleep").arg("infinity").spawn().unwrap();
+        cg.add_task_by_tgid(CgroupPid::from(child.id() as u64))
+            .unwrap();
+
+        let cg_procs = cg.procs();
+        assert_eq!(cg_procs.len(), 1_usize);
+
+        // Now kill and wait on the proc.
+        cg.kill().unwrap();
+
+        let mut tries = 0;
+        let status: Option<std::process::ExitStatus> = loop {
+            match child.try_wait() {
+                Ok(Some(status)) => {
+                    break Some(status);
+                }
+                Ok(None) => {
+                    if tries > 3 {
+                        break None;
+                    }
+                    sleep(Duration::from_millis(100));
+                    tries += 1;
+                }
+                Err(e) => {
+                    child.kill().unwrap();
+                    panic!("error attempting to wait: {}", e);
+                }
+            }
+        };
+        assert!(status.is_some());
+    }
+    cg.delete().unwrap();
+}
+
+#[test]
+fn test_cgroup_with_relative_paths() {
+    if cgroups_rs::fs::hierarchies::is_cgroup2_unified_mode() {
+        return;
+    }
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cgroup_root = h.root();
+    let cgroup_name = "test_cgroup_with_relative_paths";
+
+    let cg = Cgroup::load(h, String::from(cgroup_name));
+    {
+        let subsystems = cg.subsystems();
+        subsystems.iter().for_each(|sub| match sub {
+            Subsystem::Pid(c) => {
+                let cgroup_path = c.path().to_str().unwrap();
+                let relative_path = "/pids/";
+                // cgroup_path = cgroup_root + relative_path + cgroup_name
+                assert_eq!(
+                    cgroup_path,
+                    format!(
+                        "{}{}{}",
+                        cgroup_root.to_str().unwrap(),
+                        relative_path,
+                        cgroup_name
+                    )
+                );
+            }
+            Subsystem::Mem(c) => {
+                let cgroup_path = c.path().to_str().unwrap();
+                // cgroup_path = cgroup_root + relative_path + cgroup_name
+                assert_eq!(
+                    cgroup_path,
+                    format!("{}/memory/{}", cgroup_root.to_str().unwrap(), cgroup_name)
+                );
+            }
+            _ => {}
+        });
+    }
+    cg.delete().unwrap();
+}
+
+#[test]
+fn test_cgroup_v2() {
+    if !cgroups_rs::fs::hierarchies::is_cgroup2_unified_mode() {
+        return;
+    }
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg = Cgroup::new(h, String::from("test_v2")).unwrap();
+
+    let mem_controller: &MemController = cg.controller_of().unwrap();
+    let (mem, swp, rev) = (4 * 1024 * 1000, 2 * 1024 * 1000, 1024 * 1000);
+
+    mem_controller.set_limit(mem).unwrap();
+    mem_controller.set_memswap_limit(swp).unwrap();
+    mem_controller.set_soft_limit(rev).unwrap();
+
+    let memory_stat = mem_controller.memory_stat();
+    println!("memory_stat {:?}", memory_stat);
+    assert_eq!(mem, memory_stat.limit_in_bytes);
+    assert_eq!(rev, memory_stat.soft_limit_in_bytes);
+
+    let memswap = mem_controller.memswap();
+    println!("memswap {:?}", memswap);
+    assert_eq!(swp, memswap.limit_in_bytes);
+
+    cg.delete().unwrap();
 }

tests/cpu.rs

@@ -0,0 +1,61 @@
+// Copyright (c) 2020 And Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! Simple unit tests about the CPU control groups system.
+use cgroups_rs::fs::cpu::CpuController;
+use cgroups_rs::fs::Cgroup;
+
+#[test]
+fn test_cfs_quota_and_periods() {
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg = Cgroup::new(h, String::from("test_cfs_quota_and_periods")).unwrap();
+
+    let cpu_controller: &CpuController = cg.controller_of().unwrap();
+
+    let current_quota = cpu_controller.cfs_quota().unwrap();
+    let current_peroid = cpu_controller.cfs_period().unwrap();
+
+    // verify default value
+    // The default is “max 100000”.
+    assert_eq!(-1, current_quota);
+    assert_eq!(100000, current_peroid);
+
+    // case 1 set quota
+    let _ = cpu_controller.set_cfs_quota(2000);
+
+    let current_quota = cpu_controller.cfs_quota().unwrap();
+    let current_peroid = cpu_controller.cfs_period().unwrap();
+    assert_eq!(2000, current_quota);
+    assert_eq!(100000, current_peroid);
+
+    // case 2 set period
+    cpu_controller.set_cfs_period(1000000).unwrap();
+    let current_quota = cpu_controller.cfs_quota().unwrap();
+    let current_peroid = cpu_controller.cfs_period().unwrap();
+    assert_eq!(2000, current_quota);
+    assert_eq!(1000000, current_peroid);
+
+    // case 3 set both quota and period
+    cpu_controller
+        .set_cfs_quota_and_period(Some(5000), Some(100000))
+        .unwrap();
+
+    let current_quota = cpu_controller.cfs_quota().unwrap();
+    let current_peroid = cpu_controller.cfs_period().unwrap();
+    assert_eq!(5000, current_quota);
+    assert_eq!(100000, current_peroid);
+
+    // case 4 set both quota and period, set quota to -1
+    cpu_controller
+        .set_cfs_quota_and_period(Some(-1), None)
+        .unwrap();
+
+    let current_quota = cpu_controller.cfs_quota().unwrap();
+    let current_peroid = cpu_controller.cfs_period().unwrap();
+    assert_eq!(-1, current_quota);
+    assert_eq!(100000, current_peroid);
+
+    cg.delete().unwrap();
+}

tests/cpuset.rs

@@ -0,0 +1,92 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020 And Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+use std::fs;
+
+use cgroups_rs::fs::cpuset::CpuSetController;
+use cgroups_rs::fs::error::ErrorKind;
+use cgroups_rs::fs::Cgroup;
+use cgroups_rs::CgroupPid;
+
+#[test]
+fn test_cpuset_memory_pressure_root_cg() {
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg = Cgroup::new(h, String::from("test_cpuset_memory_pressure_root_cg")).unwrap();
+    {
+        let cpuset: &CpuSetController = cg.controller_of().unwrap();
+
+        // This is not a root control group, so it should fail via InvalidOperation.
+        let res = cpuset.set_enable_memory_pressure(true);
+        assert_eq!(res.unwrap_err().kind(), &ErrorKind::InvalidOperation);
+    }
+    cg.delete().unwrap();
+}
+
+#[test]
+fn test_cpuset_set_cpus() {
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg = Cgroup::new(h, String::from("test_cpuset_set_cpus")).unwrap();
+    {
+        let cpuset: &CpuSetController = cg.controller_of().unwrap();
+
+        let set = cpuset.cpuset();
+        if cg.v2() {
+            assert_eq!(0, set.cpus.len());
+        } else {
+            // for cgroup v1, cpuset is copied from parent.
+            assert!(!set.cpus.is_empty());
+        }
+
+        // 0
+        let r = cpuset.set_cpus("0");
+        assert!(r.is_ok());
+
+        let set = cpuset.cpuset();
+        assert_eq!(1, set.cpus.len());
+        assert_eq!((0, 0), set.cpus[0]);
+
+        // all cpus in system
+        let cpus = fs::read_to_string("/sys/fs/cgroup/cpuset.cpus.effective").unwrap_or_default();
+        let cpus = cpus.trim();
+        if !cpus.is_empty() {
+            let r = cpuset.set_cpus(cpus);
+            assert!(r.is_ok());
+            let set = cpuset.cpuset();
+            assert_eq!(1, set.cpus.len());
+            assert_eq!(format!("{}-{}", set.cpus[0].0, set.cpus[0].1), cpus);
+        }
+    }
+    cg.delete().unwrap();
+}
+
+#[test]
+fn test_cpuset_set_cpus_add_task() {
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg = Cgroup::new(h, String::from("test_cpuset_set_cpus_add_task/sub-dir")).unwrap();
+
+    let cpuset: &CpuSetController = cg.controller_of().unwrap();
+    let set = cpuset.cpuset();
+    if cg.v2() {
+        assert_eq!(0, set.cpus.len());
+    } else {
+        // for cgroup v1, cpuset is copied from parent.
+        assert!(!set.cpus.is_empty());
+    }
+
+    // Add a task to the control group.
+    let pid_i = libc::pid_t::from(nix::unistd::getpid()) as u64;
+    let _ = cg.add_task_by_tgid(CgroupPid::from(pid_i));
+    let tasks = cg.tasks();
+    assert!(!tasks.is_empty());
+    println!("tasks after added: {:?}", tasks);
+
+    // remove task
+    cg.remove_task_by_tgid(CgroupPid::from(pid_i)).unwrap();
+    let tasks = cg.tasks();
+    println!("tasks after deleted: {:?}", tasks);
+    assert_eq!(0, tasks.len());
+
+    cg.delete().unwrap();
+}

tests/devices.rs

@@ -0,0 +1,73 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020 And Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! Integration tests about the devices subsystem
+
+use cgroups_rs::fs::devices::{DevicePermissions, DeviceType, DevicesController};
+use cgroups_rs::fs::{Cgroup, DeviceResource};
+
+#[test]
+fn test_devices_parsing() {
+    // now only v2
+    if cgroups_rs::fs::hierarchies::is_cgroup2_unified_mode() {
+        return;
+    }
+
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg = Cgroup::new(h, String::from("test_devices_parsing")).unwrap();
+    {
+        let devices: &DevicesController = cg.controller_of().unwrap();
+
+        // Deny access to all devices first
+        devices
+            .deny_device(
+                DeviceType::All,
+                -1,
+                -1,
+                &[
+                    DevicePermissions::Read,
+                    DevicePermissions::Write,
+                    DevicePermissions::MkNod,
+                ],
+            )
+            .unwrap();
+        // Acquire the list of allowed devices after we denied all
+        let allowed_devices = devices.allowed_devices();
+        // Verify that there are no devices that we can access.
+        assert!(allowed_devices.is_ok());
+        assert_eq!(allowed_devices.unwrap(), Vec::new());
+
+        // Now add mknod access to /dev/null device
+        devices
+            .allow_device(DeviceType::Char, 1, 3, &[DevicePermissions::MkNod])
+            .unwrap();
+        let allowed_devices = devices.allowed_devices();
+        assert!(allowed_devices.is_ok());
+        let allowed_devices = allowed_devices.unwrap();
+        assert_eq!(allowed_devices.len(), 1);
+        assert_eq!(
+            allowed_devices[0],
+            DeviceResource {
+                allow: true,
+                devtype: DeviceType::Char,
+                major: 1,
+                minor: 3,
+                access: vec![DevicePermissions::MkNod],
+            }
+        );
+
+        // Now deny, this device explicitly.
+        devices
+            .deny_device(DeviceType::Char, 1, 3, &DevicePermissions::all())
+            .unwrap();
+        // Finally, check that.
+        let allowed_devices = devices.allowed_devices();
+        // Verify that there are no devices that we can access.
+        assert!(allowed_devices.is_ok());
+        assert_eq!(allowed_devices.unwrap(), Vec::new());
+    }
+    cg.delete().unwrap();
+}

tests/hugetlb.rs

@@ -0,0 +1,44 @@
+// Copyright (c) 2020 And Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! Integration tests about the hugetlb subsystem
+use cgroups_rs::fs::error::*;
+use cgroups_rs::fs::hugetlb::{self, HugeTlbController};
+use cgroups_rs::fs::Cgroup;
+use std::fs;
+
+#[test]
+fn test_hugetlb_sizes() {
+    // now only v2
+    if cgroups_rs::fs::hierarchies::is_cgroup2_unified_mode() {
+        return;
+    }
+
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg = Cgroup::new(h, String::from("test_hugetlb_sizes")).unwrap();
+    {
+        let hugetlb_controller: &HugeTlbController = cg.controller_of().unwrap();
+        let _ = hugetlb_controller.get_sizes();
+
+        // test sizes count
+        let sizes = hugetlb_controller.get_sizes();
+        let sizes_count = fs::read_dir(hugetlb::HUGEPAGESIZE_DIR).unwrap().count();
+        assert_eq!(sizes.len(), sizes_count);
+
+        for size in sizes {
+            let supported = hugetlb_controller.size_supported(&size);
+            assert!(supported);
+            assert_no_error(hugetlb_controller.failcnt(&size));
+            assert_no_error(hugetlb_controller.limit_in_bytes(&size));
+            assert_no_error(hugetlb_controller.usage_in_bytes(&size));
+            assert_no_error(hugetlb_controller.max_usage_in_bytes(&size));
+        }
+    }
+    cg.delete().unwrap();
+}
+
+fn assert_no_error(r: Result<u64>) {
+    assert!(r.is_ok())
+}

tests/memory.rs

@@ -0,0 +1,105 @@
+// Copyright (c) 2020 And Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! Integration tests about the hugetlb subsystem
+use cgroups_rs::fs::memory::{MemController, SetMemory};
+use cgroups_rs::fs::{Cgroup, Controller, MaxValue};
+
+#[test]
+fn test_disable_oom_killer() {
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg = Cgroup::new(h, String::from("test_disable_oom_killer")).unwrap();
+    {
+        let mem_controller: &MemController = cg.controller_of().unwrap();
+
+        // before disable
+        let m = mem_controller.memory_stat();
+        assert!(!m.oom_control.oom_kill_disable);
+
+        // now only v1
+        if !mem_controller.v2() {
+            // disable oom killer
+            let r = mem_controller.disable_oom_killer();
+            assert!(r.is_ok());
+
+            // after disable
+            let m = mem_controller.memory_stat();
+            assert!(m.oom_control.oom_kill_disable);
+        }
+    }
+    cg.delete().unwrap();
+}
+
+#[test]
+fn set_kmem_limit_v1() {
+    let h = cgroups_rs::fs::hierarchies::auto();
+    if h.v2() {
+        return;
+    }
+
+    let cg = Cgroup::new(h, String::from("set_kmem_limit_v1")).unwrap();
+    {
+        let mem_controller: &MemController = cg.controller_of().unwrap();
+        mem_controller.set_kmem_limit(1).unwrap();
+    }
+    cg.delete().unwrap();
+}
+
+#[test]
+fn set_mem_v2() {
+    let h = cgroups_rs::fs::hierarchies::auto();
+    if !h.v2() {
+        return;
+    }
+
+    let cg = Cgroup::new(h, String::from("set_mem_v2")).unwrap();
+    {
+        let mem_controller: &MemController = cg.controller_of().unwrap();
+
+        // before disable
+        let m = mem_controller.get_mem().unwrap();
+        // case 1: get default value
+        assert_eq!(m.low, Some(MaxValue::Value(0)));
+        assert_eq!(m.min, Some(MaxValue::Value(0)));
+        assert_eq!(m.high, Some(MaxValue::Max));
+        assert_eq!(m.max, Some(MaxValue::Max));
+
+        // case 2: set parts
+        let m = SetMemory {
+            low: Some(MaxValue::Value(1024 * 1024 * 2)),
+            high: Some(MaxValue::Value(1024 * 1024 * 1024 * 2)),
+            min: Some(MaxValue::Value(1024 * 1024 * 3)),
+            max: None,
+        };
+        let r = mem_controller.set_mem(m);
+        assert!(r.is_ok());
+
+        let m = mem_controller.get_mem().unwrap();
+        // get
+        assert_eq!(m.low, Some(MaxValue::Value(1024 * 1024 * 2)));
+        assert_eq!(m.min, Some(MaxValue::Value(1024 * 1024 * 3)));
+        assert_eq!(m.high, Some(MaxValue::Value(1024 * 1024 * 1024 * 2)));
+        assert_eq!(m.max, Some(MaxValue::Max));
+
+        // case 3: set parts
+        let m = SetMemory {
+            max: Some(MaxValue::Value(1024 * 1024 * 1024 * 2)),
+            min: Some(MaxValue::Value(1024 * 1024 * 4)),
+            high: Some(MaxValue::Max),
+            low: None,
+        };
+        let r = mem_controller.set_mem(m);
+        assert!(r.is_ok());
+
+        let m = mem_controller.get_mem().unwrap();
+        // get
+        assert_eq!(m.low, Some(MaxValue::Value(1024 * 1024 * 2)));
+        assert_eq!(m.min, Some(MaxValue::Value(1024 * 1024 * 4)));
+        assert_eq!(m.max, Some(MaxValue::Value(1024 * 1024 * 1024 * 2)));
+        assert_eq!(m.high, Some(MaxValue::Max));
+    }
+
+    cg.delete().unwrap();
+}

tests/pids.rs

@@ -1,70 +1,74 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020 And Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
 //! Integration tests about the pids subsystem
-extern crate cgroups;
-use cgroups::{CgroupError, CgroupPid, Cgroup, Resources, PidResources};
-use cgroups::pid::{PidController, PidMax};
-use cgroups::Controller;
-
-extern crate nix;
-use nix::unistd::{Pid, fork, ForkResult};
-use nix::sys::wait::{waitpid, WaitStatus};
-
-extern crate libc;
+use cgroups_rs::fs::pid::PidController;
+use cgroups_rs::fs::{Cgroup, Controller, MaxValue};
 use libc::pid_t;
-
-use std::thread;
+use nix::sys::wait::{waitpid, WaitStatus};
+use nix::unistd::{fork, ForkResult};
 
 #[test]
 fn create_and_delete_cgroup() {
-    let hier = cgroups::hierarchies::V1::new();
-    let cg = Cgroup::new(&hier, String::from("create_and_delete_cgroup"));
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg = Cgroup::new(h, String::from("create_and_delete_cgroup")).unwrap();
     {
         let pidcontroller: &PidController = cg.controller_of().unwrap();
-        pidcontroller.set_pid_max(PidMax::Value(1337));
-        assert_eq!(pidcontroller.get_pid_max(), Some(PidMax::Value(1337)));
+        pidcontroller.set_pid_max(MaxValue::Value(1337)).unwrap();
+        let max = pidcontroller.get_pid_max();
+        assert!(max.is_ok());
+        assert_eq!(max.unwrap(), MaxValue::Value(1337));
     }
-    cg.delete();
+    cg.delete().unwrap();
 }
 
 #[test]
 fn test_pids_current_is_zero() {
-    let hier = cgroups::hierarchies::V1::new();
-    let cg = Cgroup::new(&hier, String::from("test_pids_current_is_zero"));
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg = Cgroup::new(h, String::from("test_pids_current_is_zero")).unwrap();
     {
         let pidcontroller: &PidController = cg.controller_of().unwrap();
-        assert_eq!(pidcontroller.get_pid_current(), 0);
+        let current = pidcontroller.get_pid_current();
+        assert_eq!(current.unwrap(), 0);
     }
-    cg.delete();
+    cg.delete().unwrap();
 }
 
 #[test]
 fn test_pids_events_is_zero() {
-    let hier = cgroups::hierarchies::V1::new();
-    let cg = Cgroup::new(&hier, String::from("test_pids_events_is_zero"));
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg = Cgroup::new(h, String::from("test_pids_events_is_zero")).unwrap();
     {
         let pidcontroller: &PidController = cg.controller_of().unwrap();
-        assert_eq!(pidcontroller.get_pid_events(), 0);
+        let events = pidcontroller.get_pid_events();
+        assert!(events.is_ok());
+        assert_eq!(events.unwrap(), 0);
     }
-    cg.delete();
+    cg.delete().unwrap();
 }
 
 #[test]
 fn test_pid_events_is_not_zero() {
-    let hier = cgroups::hierarchies::V1::new();
-    let cg = Cgroup::new(&hier, String::from("test_pid_events_is_not_zero"));
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg = Cgroup::new(h, String::from("test_pid_events_is_not_zero")).unwrap();
     {
         let pids: &PidController = cg.controller_of().unwrap();
         let before = pids.get_pid_events();
+        let before = before.unwrap();
 
-        match fork() {
+        match unsafe { fork() } {
             Ok(ForkResult::Parent { child, .. }) => {
                 // move the process into the control group
-                pids.add_task(&(pid_t::from(child) as u64).into());
+                let _ = pids.add_task_by_tgid(&(pid_t::from(child) as u64).into());
 
                 println!("added task to cg: {:?}", child);
 
                 // Set limit to one
-                pids.set_pid_max(PidMax::Value(1));
-                println!("err = {:?}", pids.get_pid_max());
+                let _ = pids.set_pid_max(MaxValue::Value(1));
+                println!("current pid.max = {:?}", pids.get_pid_max());
 
                 // wait on the child
                 let res = waitpid(child, None);
@@ -75,21 +79,22 @@ fn test_pid_events_is_not_zero() {
                 }
 
                 // Check pids.events
-                assert_eq!(pids.get_pid_events(), before + 1);
-            },
-            Ok(ForkResult::Child) => {
-                loop {
-                    if pids.get_pid_max() == Some(PidMax::Value(1)) {
-                        if let Err(_) = fork() {
-                            unsafe { libc::exit(0) };
-                        } else {
-                            unsafe { libc::exit(1) };
-                        }
+                let events = pids.get_pid_events();
+                assert!(events.is_ok());
+                assert_eq!(events.unwrap(), before + 1);
+            }
+            Ok(ForkResult::Child) => loop {
+                let pids_max = pids.get_pid_max();
+                if pids_max.is_ok() && pids_max.unwrap() == MaxValue::Value(1) {
+                    if unsafe { fork() }.is_err() {
+                        unsafe { libc::exit(0) };
+                    } else {
+                        unsafe { libc::exit(1) };
                     }
                 }
             },
             Err(_) => panic!("failed to fork"),
         }
     }
-    cg.delete();
+    cg.delete().unwrap();
 }

tests/resources.rs

@@ -1,26 +1,31 @@
-//! Integration test about setting resources using `apply()`
-extern crate cgroups;
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020 And Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
 
-use cgroups::{Cgroup, Resources, PidResources};
-use cgroups::pid::{PidController, PidMax};
+//! Integration test about setting resources using `apply()`
+use cgroups_rs::fs::pid::PidController;
+use cgroups_rs::fs::{Cgroup, MaxValue, PidResources, Resources};
 
 #[test]
 fn pid_resources() {
-    let hier = cgroups::hierarchies::V1::new();
-    let cg = Cgroup::new(&hier, String::from("pid_resources"));
+    let h = cgroups_rs::fs::hierarchies::auto();
+    let cg = Cgroup::new(h, String::from("pid_resources")).unwrap();
     {
         let res = Resources {
             pid: PidResources {
-                update_values: true,
-                maximum_number_of_processes: PidMax::Value(512),
+                maximum_number_of_processes: Some(MaxValue::Value(512)),
             },
             ..Default::default()
         };
-        cg.apply(&res);
+        cg.apply(&res).unwrap();
 
-        /* verify */
+        // verify
         let pidcontroller: &PidController = cg.controller_of().unwrap();
-        assert_eq!(pidcontroller.get_pid_max(), Some(PidMax::Value(512)));
+        let pid_max = pidcontroller.get_pid_max();
+        assert!(pid_max.is_ok());
+        assert_eq!(pid_max.unwrap(), MaxValue::Value(512));
     }
-    cg.delete();
+    cg.delete().unwrap();
 }

tools/create_cgroup.sh

@@ -1,4 +1,9 @@
 #!/bin/sh
+#
+# Copyright (c) 2018 Levente Kurusa
+#
+# SPDX-License-Identifier: Apache-2.0 or MIT
+#
 
 CONTROL_GROUPS=`cargo test -- --list 2>/dev/null | egrep 'test$' | egrep -v '^src' | cut -d':' -f1`
 

tools/delete_cgroup.sh

@@ -1,4 +1,9 @@
 #!/bin/sh
+#
+# Copyright (c) 2018 Levente Kurusa
+#
+# SPDX-License-Identifier: Apache-2.0 or MIT
+#
 
 CONTROL_GROUPS=`cargo test -- --list 2>/dev/null | egrep 'test$' | egrep -v '^src' | cut -d':' -f1`