Understanding Linux cgroups: Mechanism, Data Structures, and Core Logic

Cgroup is a Linux kernel mechanism for controlling system resources. It groups processes and defines specific access permissions for a class of resources. Each subsystem (e.g., freezer, CPU, memory, IO) represents a type of resource.

To enable the freezer subsystem, run the command: mount cgroup none /dev/freezer freezer This mounts the subsystem at /dev/freezer. You can then create directories under this mount point (e.g., top, background) to represent groups of threads with distinct resource policies. Adding a process to a group is done by writing its PID to the group's cgroup.procs file, for example: echo 1199 > /dev/freezer/top/cgroup.procs Freezing or thawing all threads in a group is controlled via the freezer.state node:

echo FROZEN > /dev/freezer/top/freezer.state

echo THAW > /dev/freezer/top/freezer.state

The cgroup subsystem is described by the cgroup_subsys structure, while each directory is represented by a cgroup structure. The hierarchical relationship between directories is captured by the cgroup_subsys_state structure, which contains pointers to parent, sibling, and child nodes.

Threads and cgroup directories have a many‑to‑many relationship. The kernel uses the css_set structure to represent a set of threads that belong to the same cgroup across different subsystems, and the cgrp_cset_link structure links a css_set to a specific cgroup. This allows a thread to be part of multiple subsystems simultaneously.

When a subsystem is mounted, all threads initially belong to the root cgroup of that subsystem. Assigning a task to a target cgroup involves writing the task’s PID to the cgroup.procs node, which triggers the cgroup_procs_write function and ultimately the cgroup_attach_task logic.

Manipulating cgroup attributes, such as freezing or thawing a group, is performed via subsystem‑specific nodes (e.g., freezer.state) that invoke functions like freezer_write and freezer_change_state. The freezer_change_state function iterates over the target cgroup and its descendants, applying the desired state through freeze_cgroup or unfreeze_cgroup.

In addition to the freezer subsystem, cgroups also provide mechanisms for IO scheduling (blkio), CPU set allocation (cpuset), CPU time distribution (cpu), memory limits (memory), and network bandwidth control (cls_net). The source code for these subsystems can be examined in the Linux kernel repository.