October 2017 - Devel - libvirt List Archives

[libvirt] [PATCH] AppArmor: add rules needed with additional mediation features brought by Linux 4.14.
by intrigeri 19 Nov '17

19 Nov '17

--- examples/apparmor/libvirt-qemu | 2 ++ examples/apparmor/usr.sbin.libvirtd | 9 +++++++++ 2 files changed, 11 insertions(+) diff --git a/examples/apparmor/libvirt-qemu b/examples/apparmor/libvirt-qemu index b341e31f42..5994a35042 100644 --- a/examples/apparmor/libvirt-qemu +++ b/examples/apparmor/libvirt-qemu @@ -16,6 +16,8 @@ network inet stream, network inet6 stream, + signal (receive) set=("term") peer=/usr/sbin/libvirtd, + /dev/net/tun rw, /dev/kvm rw, /dev/ptmx rw, diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd index 819068ffc3..17b5ee38ff 100644 --- a/examples/apparmor/usr.sbin.libvirtd +++ b/examples/apparmor/usr.sbin.libvirtd @@ -30,6 +30,8 @@ # Needed for vfio capability sys_resource, + mount, + network inet stream, network inet dgram, network inet6 stream, @@ -37,11 +39,18 @@ network packet dgram, network packet raw, + network netlink raw, + network unix dgram, + network unix stream, + ptrace (trace) peer=unconfined, ptrace (trace) peer=/usr/sbin/libvirtd, ptrace (trace) peer=/usr/sbin/dnsmasq, ptrace (trace) peer=libvirt-*, + signal (send) set=("hup") peer=/usr/sbin/dnsmasq, + signal (send) set=("term") peer=libvirt-*, + # Very lenient profile for libvirtd since we want to first focus on confining # the guests. Guests will have a very restricted profile. / r, -- 2.15.0.rc2

5 16

[libvirt] [PATCH] numa: avoid failure in nodememstats on non-NUMA systems
by Viktor Mihajlovski 10 Nov '17

10 Nov '17

libvirt reports a fake NUMA topology in virConnectGetCapabilities even if built without numactl support. The fake NUMA topology consists of a single cell representing the host's cpu and memory resources. Currently this is the case for ARM and s390[x] RPM builds. A client iterating over NUMA cells obtained via virConnectGetCapabilities and invoking virNodeGetMemoryStats on them will see an internal failure "NUMA isn't available on this host". An example for such a client is VDSM. Since the intention seems to be that libvirt always reports at least a single cell it is necessary to return "fake" node memory statistics matching the previously reported fake cell in case NUMA isn't supported on the system. Signed-off-by: Viktor Mihajlovski <mihajlov(a)linux.vnet.ibm.com> --- src/util/virhostmem.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/util/virhostmem.c b/src/util/virhostmem.c index a9ba278..fa04a37 100644 --- a/src/util/virhostmem.c +++ b/src/util/virhostmem.c @@ -267,6 +267,14 @@ virHostMemGetStats(int cellNum ATTRIBUTE_UNUSED, FILE *meminfo; int max_node; + /* + * Even if built without numactl, libvirt claims + * to have a one-cells NUMA topology. In such a + * case return the statistics for the entire host. + */ + if (!virNumaIsAvailable() && cellNum == 0) + cellNum = VIR_NODE_MEMORY_STATS_ALL_CELLS; + if (cellNum == VIR_NODE_MEMORY_STATS_ALL_CELLS) { if (VIR_STRDUP(meminfo_path, MEMINFO_PATH) < 0) return -1; -- 1.9.1

3 4

[libvirt] [PATCH v3 0/5] nwfilter common object adjustments
by John Ferlan 08 Nov '17

08 Nov '17

v2: https://www.redhat.com/archives/libvir-list/2017-July/msg00673.html (and a few pings along the way) Don't think much survived from v2 - this is a fresh start anyway. Perhaps old patch 2 the same, but beyond that a different approach to remove recursive read/write locks and replace with using rwlock read/write where the write's are in very tight confines. I've run the changes through avocado with success. There were some really strange deadlocks along the way - even causing libvirtd to go defunct. There's a lot of strange ways to use/access the nwfilters. John Ferlan (5): nwfilter: Add update locking to Initialization nwfilter: Remove unnecessary UUID comparison bypass nwfilter: Convert _virNWFilterObj to use virObjectRWLockable nwfilter: Convert _virNWFilterObjList to use virObjectRWLockable nwfilter: Remove need for nwfilterDriverLock in some API's src/conf/virnwfilterobj.c | 555 +++++++++++++++++++++++---------- src/conf/virnwfilterobj.h | 11 +- src/libvirt_private.syms | 3 +- src/nwfilter/nwfilter_driver.c | 77 +++-- src/nwfilter/nwfilter_gentech_driver.c | 11 +- 5 files changed, 433 insertions(+), 224 deletions(-) -- 2.13.6

1 6

[libvirt] [PATCH 0/4] Couple more hotplug cleanups
by John Ferlan 08 Nov '17

08 Nov '17

Patches speak for themselves - they also resolve a couple of new Coverity whines. John Ferlan (4): conf,qemu: Check for NULL addrs in virDomainUSBAddressRelease conf,qemu: Check for NULL addrs in virDomainUSBAddressEnsure qemu: Remove unnecessary virtio disk detach info.alias check qemu: Remove unnecessary controller detach info.alias check src/conf/domain_addr.c | 5 ++++- src/conf/domain_addr.h | 4 ++-- src/qemu/qemu_domain_address.c | 7 ++----- src/qemu/qemu_hotplug.c | 43 ++++++++++++++---------------------------- 4 files changed, 22 insertions(+), 37 deletions(-) -- 2.13.6

2 7

Re: [libvirt] [PATCH 0/7] x86: Rework KVM-defaults compat code, enable kvm_pv_unhalt by default
by Eduardo Habkost 08 Nov '17

08 Nov '17

(CCing libvir-list) On Mon, Oct 09, 2017 at 05:47:44PM +0200, Paolo Bonzini wrote: > On 09/10/2017 17:15, Waiman Long wrote: > > On 10/09/2017 09:39 AM, Paolo Bonzini wrote: > >> On 06/10/2017 23:52, Eduardo Habkost wrote: > >>> This series enables kvm_pv_unhalt by default on pc-*-2.11 and > >>> newer. > >> > >> I've discussed PV spinlocks with some folks at Microsoft for a few weeks > >> now, and I'm not 100% sure about enabling kvm_pv_unhalt by default. > >> It's probably a good idea overall, but it does come with some caveats. > >> > >> The problem is that there were two different implementations of fair > >> spinlocks in Linux, ticket spinlocks and queued spinlocks. When > >> kvm_pv_unhalt is disabled, ticket spinlocks sucked badly indeed; queued > >> spinlocks however simply revert to unfair spinlocks, which loses the > >> fairness but has the best performance. See virt_spin_lock in > >> arch/x86/include/asm/qspinlock.h. > >> > >> Now, fair spinlocks are only really needed for large NUMA machines. > >> With a single NUMA node, for example, test-and-set spinlocks work well > >> enough; there's not _much_ need for fairness in practice, and the > >> paravirtualization does introduce some overhead. > >> > >> Therefore, the best performance would be achieved with kvm_pv_unhalt > >> disabled on small VMs, and enabled on large VMs spanning multiple host > >> NUMA nodes. > >> > >> Waiman, Davidlohr, do you have an opinion on this as well? > > > > I agree. Using unfair lock in a small VM is good for performance. The > > only problem I see is how do we define what is small. Now, even a > > machine with a single socket can have up to 28 cores, 56 threads. If a > > VM has up to 56 vCPUs, we may still want pvqspinlock to be used. > > Yes. Another possibility is to enable it when there is >1 NUMA node in > the guest. We generally don't do this kind of magic but higher layers > (oVirt/OpenStack) do. Can't the guest make this decision, instead of the host? > > It also depends on how worse performance is with PV qspinlocks, > especially since now there's also vcpu_is_preempted that has to be > thrown in the mix. A lot more testing is needed. > This is an interesting case for "-cpu host"/host-passthrough: usage of "-cpu host" has an implicit assumption that no feature will decrease performance just because we told the guest that it is available. Can't the guest choose the most reasonable option based on the information we provide to it, instead of having to hide information from the guest to get better performance? > > Is the kvm_pv_unhalt flag a global one for all VMs within a machine? Or > > can it be different for each VM? We may want to have this flag > > dynamically determined depending on the configuration of the VM. > > It's per-VM, so that's easy. -- Eduardo

3 8

[libvirt] Libvirt config converter can't handle file not ending with new line
by Wei Liu 07 Nov '17

07 Nov '17

Hi Jim I discover a problem when using xen_xl converter. When the file in question doesn't end with a new line, I get the following error: error: configuration file syntax error: memory conf:53: expecting a value After digging a bit (but haven't read libvirt code), it appears that the file didn't end with a new line. I have worked around this, but I think this is an issue that should be fixed. Thanks, Wei.

3 4

[libvirt] [PATCH v2 00/15] vbox: Improve handling of storage devices
by Dawid Zamirski 07 Nov '17

07 Nov '17

From: Dawid Zamirski <dzrudy(a)gmail.com> v1: https://www.redhat.com/archives/libvir-list/2017-October/msg00381.html Changes since v1: * split out the original patches into smaller ones, with each bugfix or cleanup task is in its own isolated and compilable patch * make sure switch statements are type casted and all cases are handled * fixed implementation of partial VM cleanup code and isolated into separate patch (patch #3) * squashed doc and rng updates into a single patch (#9), updated doc wording as suggested * addressed other minor issues (add debug statements, code formatting, better comments, commit message spelling etc) Dawid Zamirski (15): vbox: Update ATTRIBUTE_UNUSED usage vbox: Close media when undefining domains vbox: Cleanup partially-defined VM on failure vbox: vboxAttachDrives now relies on address info vbox: Cleanup vboxAttachDrives implementation vbox: Errors in vboxAttachDrives are now critical vbox: Support empty removable drives. vbox: Add more IStorageController API mappings domain: Allow 'model' attribute for ide controller vbox: Process <controller> element in domain XML vbox: Add vboxDumpStorageControllers vbox: Correctly generate drive name in dumpxml vbox: Cleanup vboxDumpDisks implementation vbox: Process empty removable disks in dumpxml vbox: Generate disk address element in dumpxml docs/formatdomain.html.in | 4 + docs/schemas/domaincommon.rng | 18 +- src/conf/domain_conf.c | 9 + src/conf/domain_conf.h | 9 + src/libvirt_private.syms | 2 + src/vbox/vbox_common.c | 1422 +++++++++++++++++++++++++---------------- src/vbox/vbox_common.h | 21 + src/vbox/vbox_tmpl.c | 93 ++- src/vbox/vbox_uniformed_api.h | 3 + 9 files changed, 983 insertions(+), 598 deletions(-) -- 2.14.2

2 36

[libvirt] [PATCH REPOST 0/8] Privatize _virStoragePoolObj and _virStorageVolDefList (Batch #3)
by John Ferlan 07 Nov '17

07 Nov '17

Since the original series (19 patches): https://www.redhat.com/archives/libvir-list/2017-September/msg00594.html didn't garner any attention, I'm going with smaller patch piles to make forward progress. This is the last half of the storage backends plus one missed merge (because I broke things up <sigh>) John Ferlan (8): storage: Use virStoragePoolObjGetDef accessor for iSCSI backend storage: Use virStoragePoolObjGetDef accessor for MPATH backend storage: Use virStoragePoolObjGetDef accessor for RBD backend storage: Use virStoragePoolObjGetDef accessor for SCSI backend storage: Use virStoragePoolObjGetDef accessor for VSTORAGE backend storage: Use virStoragePoolObjGetDef accessor for ZFS backend storage: Use virStoragePoolObjGetDef accessor for new driver events storage: Privatize virStoragePoolObj and virStorageVolDefList src/conf/storage_conf.h | 4 --- src/conf/virstorageobj.c | 20 +++++++++++ src/conf/virstorageobj.h | 15 -------- src/storage/storage_backend_iscsi.c | 41 ++++++++++++---------- src/storage/storage_backend_mpath.c | 8 +++-- src/storage/storage_backend_rbd.c | 64 ++++++++++++++++++---------------- src/storage/storage_backend_scsi.c | 30 +++++++++------- src/storage/storage_backend_vstorage.c | 31 ++++++++-------- src/storage/storage_backend_zfs.c | 39 ++++++++++++--------- src/storage/storage_driver.c | 8 ++--- 10 files changed, 144 insertions(+), 116 deletions(-) -- 2.13.6

2 11

[libvirt] [PATCH v2] vz: allow to start vz driver without host cache info
by Mikhail Feoktistov 07 Nov '17

07 Nov '17

Show warning message instead of fail operation. It happens if kernel or cpu doesn't support reporting cpu cache info. In case of Virtuozzo file "id" doesn't exist. --- src/vz/vz_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/vz/vz_driver.c b/src/vz/vz_driver.c index 6f4aee3..eb97e54 100644 --- a/src/vz/vz_driver.c +++ b/src/vz/vz_driver.c @@ -119,7 +119,7 @@ vzBuildCapabilities(void) goto error; if (virCapabilitiesInitCaches(caps) < 0) - goto error; + VIR_WARN("Failed to get host CPU cache info"); verify(ARRAY_CARDINALITY(archs) == ARRAY_CARDINALITY(emulators)); -- 1.8.3.1

2 5

[libvirt] [RFC] docs: Discourage usage of cache mode=passthrough
by Eduardo Habkost 06 Nov '17

06 Nov '17

Cache mode=passthrough can result in a broken cache topology if the domain topology is not exactly the same as the host topology. Warn about that in the documentation. Bug report for reference: https://bugzilla.redhat.com/show_bug.cgi?id=1184125 Signed-off-by: Eduardo Habkost <ehabkost(a)redhat.com> --- docs/formatdomain.html.in | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 57ec2ff34..9c21892f3 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -1478,7 +1478,9 @@ <dt><code>passthrough</code></dt> <dd>The real CPU cache data reported by the host CPU will be - passed through to the virtual CPU.</dd> + passed through to the virtual CPU. Using this mode is not + recommended unless the domain CPU and NUMA topology is exactly + the same as the host CPU and NUMA topology.</dd> <dt><code>disable</code></dt> <dd>The virtual CPU will report no CPU cache of the specified -- 2.13.5

3 8