core: add support for the "pids" cgroup controller

This adds support for the new "pids" cgroup controller of 4.3 kernels.
It allows accounting the number of tasks in a cgroup and enforcing
limits on it.

This adds two new setting TasksAccounting= and TasksMax= to each unit,
as well as a gloabl option DefaultTasksAccounting=.

This also updated "cgtop" to optionally make use of the new
kernel-provided accounting.

systemctl has been updated to show the number of tasks for each service
if it is available.

This patch also adds correct support for undoing memory limits for units
using a MemoryLimit=infinity syntax. We do the same for TasksMax= now
and hence keep things in sync here.

3 files changed, 119 insertions, 43 deletions

diff --git a/man/systemd-cgtop.xml b/man/systemd-cgtop.xml
index 0e0ea3ba7a..859c1a2865 100644
--- a/man/systemd-cgtop.xml
+++ b/man/systemd-cgtop.xml
@@ -114,7 +114,7 @@
         <term><option>-t</option></term>
         <term><option>--order=tasks</option></term>
 
-        <listitem><para>Order by number of processes in control group.</para></listitem>
+        <listitem><para>Order by number of tasks/processes in the control group.</para></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -170,25 +170,48 @@
       </varlistentry>
 
       <varlistentry>
+        <term><option>-P</option></term>
+
+        <listitem><para>Count only userspace processes instead of all
+        tasks. By default all tasks are counted: each kernel thread
+        and each userspace thread individually. With this setting
+        kernel threads are excluded from the counting and each
+        userspace process only counts as one, regardless how many
+        threads it consists of. This setting may also be toggled at
+        runtime by pressing the <keycap>P</keycap> key. This option
+        may not be combined with
+        <option>-k</option>.</para></listitem>
+      </varlistentry>
+
+      <varlistentry>
         <term><option>-k</option></term>
 
-        <listitem><para>Include kernel threads when counting tasks in
-        control groups. By default, kernel threads are not included in
-        the count. This setting may also be toggled at runtime by
-        pressing the <keycap>k</keycap> key.</para></listitem>
+        <listitem><para>Count only userspace processes and kernel
+        threads instead of all tasks. By default all tasks are
+        counted: each kernel thread and each userspace thread
+        individually. With this setting kernel threads are included in
+        the counting and each userspace process only counts as on one,
+        regardless how many threads it consists of. This setting may
+        also be toggled at runtime by pressing the <keycap>k</keycap>
+        key. This option may not be combined with
+        <option>-P</option>.</para></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><option>--recursive=</option></term>
 
-        <listitem><para>Controls whether the number of tasks shown for
-        a control group shall include all tasks that are contained in
-        any of the child control groups as well. Takes a boolean
-        argument, defaults to <literal>yes</literal>. If enabled the
-        tasks in child control groups are included, if disabled only
-        the tasks in the control group itself are counted. This
-        setting may also be toggled at runtime by pressing the
-        <keycap>r</keycap> key.</para></listitem>
+        <listitem><para>Controls whether the number of processes shown
+        for a control group shall include all processes that are
+        contained in any of the child control groups as well. Takes a
+        boolean argument, defaults to <literal>yes</literal>. If
+        enabled the processes in child control groups are included, if
+        disabled only the processes in the control group itself are
+        counted. This setting may also be toggled at runtime by
+        pressing the <keycap>r</keycap> key. Note that this setting
+        only applies to process counting, i.e. when the
+        <option>-P</option> or <option>-k</option> options are
+        used. It has not effect if all tasks are counted, in which
+        case the counting is always recursive.</para></listitem>
       </varlistentry>
 
       <varlistentry>
@@ -287,22 +310,34 @@
       </varlistentry>
 
       <varlistentry>
+        <term><keycap>P</keycap></term>
+
+        <listitem><para>Toggle between counting all tasks, or only
+        userspace processes. This setting may also be controlled using
+        the <option>-P</option> command line switch (see
+        above).</para></listitem>
+      </varlistentry>
+
+      <varlistentry>
         <term><keycap>k</keycap></term>
 
-        <listitem><para>Toggle between including or excluding kernel
-        threads in control group task counts. This setting may also be
-        controlled using the <option>-k</option> command line
-        switch.</para></listitem>
+        <listitem><para>Toggle between counting all tasks, or only
+        userspace processes and kernel threads. This setting may also
+        be controlled using the <option>-k</option> command line
+        switch (see above).</para></listitem>
       </varlistentry>
 
       <varlistentry>
         <term><keycap>r</keycap></term>
 
         <listitem><para>Toggle between recursively including or
-        excluding tasks in child control groups in control group task
-        counts. This setting may also be controlled using the
-        <option>--recursive=</option> command line
-        switch.</para></listitem>
+        excluding processes in child control groups in control group
+        process counts. This setting may also be controlled using the
+        <option>--recursive=</option> command line switch. This key is
+        not available of all tasks are counted, it is only available
+        if processes are counted, as enabled with the
+        <keycap>P</keycap> or <keycap>k</keycap>
+        keys.</para></listitem>
       </varlistentry>
 
     </variablelist>
diff --git a/man/systemd-system.conf.xml b/man/systemd-system.conf.xml
index c06accd791..a4ba0959ea 100644
--- a/man/systemd-system.conf.xml
+++ b/man/systemd-system.conf.xml
@@ -51,14 +51,14 @@
   </refnamediv>
 
   <refsynopsisdiv>
-    <para><filename>/etc/systemd/system.conf</filename></para>
-    <para><filename>/etc/systemd/system.conf.d/*.conf</filename></para>
-    <para><filename>/run/systemd/system.conf.d/*.conf</filename></para>
-    <para><filename>/usr/lib/systemd/system.conf.d/*.conf</filename></para>
-    <para><filename>/etc/systemd/user.conf</filename></para>
-    <para><filename>/etc/systemd/user.conf.d/*.conf</filename></para>
-    <para><filename>/run/systemd/user.conf.d/*.conf</filename></para>
-    <para><filename>/usr/lib/systemd/user.conf.d/*.conf</filename></para>
+    <para><filename>/etc/systemd/system.conf</filename>,
+    <filename>/etc/systemd/system.conf.d/*.conf</filename>,
+    <filename>/run/systemd/system.conf.d/*.conf</filename>,
+    <filename>/usr/lib/systemd/system.conf.d/*.conf</filename></para>
+    <para><filename>/etc/systemd/user.conf</filename>,
+    <filename>/etc/systemd/user.conf.d/*.conf</filename>,
+    <filename>/run/systemd/user.conf.d/*.conf</filename>,
+    <filename>/usr/lib/systemd/user.conf.d/*.conf</filename></para>
   </refsynopsisdiv>
 
   <refsect1>
@@ -305,12 +305,14 @@
         <term><varname>DefaultCPUAccounting=</varname></term>
         <term><varname>DefaultBlockIOAccounting=</varname></term>
         <term><varname>DefaultMemoryAccounting=</varname></term>
+        <term><varname>DefaultTasksAccounting=</varname></term>
 
         <listitem><para>Configure the default resource accounting
         settings, as configured per-unit by
         <varname>CPUAccounting=</varname>,
-        <varname>BlockIOAccounting=</varname> and
-        <varname>MemoryAccounting=</varname>. See
+        <varname>BlockIOAccounting=</varname>,
+        <varname>MemoryAccounting=</varname> and
+        <varname>TasksAccounting=</varname>. See
         <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
         for details on the per-unit settings.</para></listitem>
       </varlistentry>
diff --git a/man/systemd.resource-control.xml b/man/systemd.resource-control.xml
index 8f4e7a3f16..6b9329bbee 100644
--- a/man/systemd.resource-control.xml
+++ b/man/systemd.resource-control.xml
@@ -103,10 +103,10 @@
         <listitem>
           <para>Turn on CPU usage accounting for this unit. Takes a
           boolean argument. Note that turning on CPU accounting for
-          one unit might also implicitly turn it on for all units
+          one unit will also implicitly turn it on for all units
           contained in the same slice and for all its parent slices
           and the units contained therein. The system default for this
-          setting maybe controlled with
+          setting may be controlled with
           <varname>DefaultCPUAccounting=</varname> in
           <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
         </listitem>
@@ -134,7 +134,7 @@
           prioritizing specific services at boot-up differently than
           during normal runtime.</para>
 
-          <para>Those options imply
+          <para>These options imply
           <literal>CPUAccounting=true</literal>.</para>
         </listitem>
       </varlistentry>
@@ -168,9 +168,10 @@
         <listitem>
           <para>Turn on process and kernel memory accounting for this
           unit. Takes a boolean argument. Note that turning on memory
-          accounting for one unit might also implicitly turn it on for
-          all its parent slices. The system default for this setting
-          maybe controlled with
+          accounting for one unit will also implicitly turn it on for
+          all units contained in the same slice and for all its parent
+          slices and the units contained therein. The system default
+          for this setting may be controlled with
           <varname>DefaultMemoryAccounting=</varname> in
           <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
         </listitem>
@@ -186,10 +187,11 @@
           memory size in bytes. If the value is suffixed with K, M, G
           or T, the specified memory size is parsed as Kilobytes,
           Megabytes, Gigabytes, or Terabytes (with the base 1024),
-          respectively. This controls the
-          <literal>memory.limit_in_bytes</literal> control group
-          attribute. For details about this control group attribute,
-          see <ulink
+          respectively. If assigned the special value
+          <literal>infinity</literal> no memory limit is applied. This
+          controls the <literal>memory.limit_in_bytes</literal>
+          control group attribute. For details about this control
+          group attribute, see <ulink
           url="https://www.kernel.org/doc/Documentation/cgroups/memory.txt">memory.txt</ulink>.</para>
 
           <para>Implies <literal>MemoryAccounting=true</literal>.</para>
@@ -197,15 +199,52 @@
       </varlistentry>
 
       <varlistentry>
+        <term><varname>TasksAccounting=</varname></term>
+
+        <listitem>
+          <para>Turn on task accounting for this unit. Takes a
+          boolean argument. If enabled, the system manager will keep
+          track of the number of tasks in the unit. The number of
+          tasks accounted this way includes both kernel threads and
+          userspace processes, with each thread counting
+          individually. Note that turning on tasks accounting for one
+          unit will also implicitly turn it on for all units contained
+          in the same slice and for all its parent slices and the
+          units contained therein. The system default for this setting
+          may be controlled with
+          <varname>DefaultTasksAccounting=</varname> in
+          <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><varname>TasksMax=<replaceable>N</replaceable></varname></term>
+
+        <listitem>
+          <para>Specify the maximum number of tasks that may be
+          created in the unit. This ensures that the number of tasks
+          accounted for the unit (see above) stays below a specific
+          limit. If assigned the special value
+          <literal>infinity</literal> no tasks limit is applied. This
+          controls the <literal>pids.max</literal> control group
+          attribute. For details about this control group attribute,
+          see <ulink
+          url="https://www.kernel.org/doc/Documentation/cgroups/pids.txt">pids.txt</ulink>.</para>
+
+          <para>Implies <literal>TasksAccounting=true</literal>.</para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
         <term><varname>BlockIOAccounting=</varname></term>
 
         <listitem>
           <para>Turn on Block IO accounting for this unit. Takes a
           boolean argument. Note that turning on block IO accounting
-          for one unit might also implicitly turn it on for all units
+          for one unit will also implicitly turn it on for all units
           contained in the same slice and all for its parent slices
           and the units contained therein. The system default for this
-          setting maybe controlled with
+          setting may be controlled with
           <varname>DefaultBlockIOAccounting=</varname> in
           <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
         </listitem>