CA-393417: Drop device controller of cgroup v1 and fix USB passthrough for XS9

[liulinC]

The approach work for both XS8 and XS9

• 4357061 for xs9
• 4357062 for xs8

Date:   Fri Jul 4 15:40:00 2025 +0800

    CA-393417: Bind mount /proc/<pid> into chroot
    
    From strace/gdb, XS9 qemu requires /proc/self/fd/<fd> to work well
    This is due to systemd/libudev update.
    
    Just bind mount /proc/self/ to the chroot to permit qemu access
    
    ```
    1047 openat(AT_FDCWD, "/proc/self/fd/46", O_RDONLY|O_NOCTTY|O_CLOEXEC|O_PATH) = -1 ENOENT (No such file or directory)
    1048 openat(AT_FDCWD, "/proc/", O_RDONLY|O_NOCTTY|O_CLOEXEC|O_PATH) = -1 ENOENT (No such file or directory)
    
        ../sysdeps/unix/sysv/linux/fstatfs64.c:30
        out>, dir_fd=<optimized out>) at ../src/basic/stat-util.c:566
        magic_value=1650812274) at ../src/basic/stat-util.c:369
        fd=<optimized out>) at ../src/basic/stat-util.h:66
        verify=<optimized out>) at
    ../src/libsystemd/sd-device/sd-device.c:221
        (ret=0x7ffc67ebba20, syspath=0x7ffc67ebb950
    "/sys/bus/usb/devices/usb1", strict=true)
        at ../src/libsystemd/sd-device/sd-device.c:271
        (syspath=0x7ffc67ebb950 "/sys/bus/usb/devices/usb1",
    ret=0x7ffc67ebba20)
        at ../src/libsystemd/sd-device/sd-device.c:280
    ```
    
    Signed-off-by: Lin Liu <[email protected]>

commit fc5f98b80badd2c9bb952b9a6ee7d7367bcb4f70
Author: Lin Liu <[email protected]>
Date:   Tue Jul 1 15:56:18 2025 +0800

    CA-393417: Drop device controller of cgroup v1
    
    For deprivileged qemu, following ops are performed
    - bind mount /dev/ to qemu chroot, so qemu can access it
    - cgroup controller deny all devices, except the target usb device
    
    However, new XS updated to cgroup v2 and the devices controller
    available anymore.
    
    Instead of bind mount all /dev folder, only the permitted usb
    devices are created into the chroot. Thus, the cgroup controller
    is no longer necessary.
    
    Besides, there are following updates accordingly
    - qemu pid is no longer necessary as command line args, as cgroup
    is dropped.
    - save and restore system /etc/ devices file ownership is no longer
    necessary. New file is cloned into chroot instead of bind mount system
    device file, so only need to set ownership of chroot file directly
    ```

[changlei-li]

Seems you need add a new blank line at the end of the file to pass CI.

[liulinC]

Seems you need add a new blank line at the end of the file to pass CI.

The CI failed due to coverage rate 😞 , Fixed now.

[psafont]

I'm surprised all the dance around /dev was needed before, since the vastly simpler approach seems to work

[liulinC]

I'm surprised all the dance around /dev was needed before, since the vastly simpler approach seems to work

Yes, this is because previously, whole /dev is mounted into chroot, and then control which device qemu process can access by cgroup(device controller), thus, it needs to

• set/unset the devices qemu can access by cgroup
• set/restore the mounted device owner.

Now we mount the target device (USB) into chroot only, thus we can drop above ops.