- Devel - libvirt List Archives

[libvirt] [PATCH] remote: Make Upper limit on list of memory parameters to 64
by Nitesh Konkar 16 Mar '17

16 Mar '17

'virsh perf domain' errors out as the number of perf events now exceeds the previous memory parameter limit of 16. The fix is to set it to 64, as the upper limit on list of perf events, is also set to the same. Signed-off-by: Nitesh Konkar <nitkon12(a)linux.vnet.ibm.com> --- src/remote/remote_protocol.x | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index abe63af..fd6f3af 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -101,7 +101,7 @@ const REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX = 16; const REMOTE_DOMAIN_BLKIO_PARAMETERS_MAX = 16; /* Upper limit on list of memory parameters. */ -const REMOTE_DOMAIN_MEMORY_PARAMETERS_MAX = 16; +const REMOTE_DOMAIN_MEMORY_PARAMETERS_MAX = 64; /* Upper limit on list of blockio tuning parameters. */ const REMOTE_DOMAIN_BLOCK_IO_TUNE_PARAMETERS_MAX = 32; -- 1.9.3

2 1

[libvirt] [PATCH] Increase default file handle limits for daemons
by Daniel P. Berrange 16 Mar '17

16 Mar '17

Linux still defaults to a 1024 open file handle limit. This causes scalability problems for libvirtd / virtlockd / virtlogd on large hosts which might want > 1024 guest to be running. In fact if each guest needs > 1 FD, we can't even get to 500 guests. This is not good enough when we see machines with 100's of physical cores and TBs of RAM. In comparison to other memory requirements of libvirtd & related daemons, the resource usage associated with open file handles is essentially line noise. It is thus reasonable to increase the limits unconditionally for all installs. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- daemon/libvirtd.service.in | 7 +++++-- src/locking/virtlockd.service.in | 4 ++++ src/logging/virtlogd.service.in | 5 +++++ 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/daemon/libvirtd.service.in b/daemon/libvirtd.service.in index c72dde5..22fc156 100644 --- a/daemon/libvirtd.service.in +++ b/daemon/libvirtd.service.in @@ -24,8 +24,11 @@ ExecStart=@sbindir@/libvirtd $LIBVIRTD_ARGS ExecReload=/bin/kill -HUP $MAINPID KillMode=process Restart=on-failure -# Override the maximum number of opened files -#LimitNOFILE=2048 +# At least 1 FD per guest, often 2 (eg qemu monitor + qemu agent). +# If we want to support 2048 guests, we'll typically need 4096 FDs +# If changing this, also consider virtlogd.service & virtlockd.service +# limits which are also related to number of guests +LimitNOFILE=8192 [Install] WantedBy=multi-user.target diff --git a/src/locking/virtlockd.service.in b/src/locking/virtlockd.service.in index 69b568f..c369591 100644 --- a/src/locking/virtlockd.service.in +++ b/src/locking/virtlockd.service.in @@ -13,6 +13,10 @@ ExecReload=/bin/kill -USR1 $MAINPID # cause the machine to be fenced (rebooted), so make # sure we discourage OOM killer OOMScoreAdjust=-900 +# Needs to allow for max guests * average disks per guest +# libvirtd.service written to expect 4096 guests, so if we +# allow for 4 disks per guest, we get: +LimitNOFILE=16384 [Install] Also=virtlockd.socket diff --git a/src/logging/virtlogd.service.in b/src/logging/virtlogd.service.in index 09e0740..be039c6 100644 --- a/src/logging/virtlogd.service.in +++ b/src/logging/virtlogd.service.in @@ -13,6 +13,11 @@ ExecReload=/bin/kill -USR1 $MAINPID # cause the machine to be fenced (rebooted), so make # sure we discourage OOM killer OOMScoreAdjust=-900 +# Need to have at least one file open per guest (eg QEMU +# stdio log), but might be more (eg serial console logs) +# libvirtd.service written to expect 2048 guests, so if we +# guess at 2 log files per guest here (stdio + 1 serial): +LimitNOFILE=8192 [Install] Also=virtlogd.socket -- 2.9.3

3 3

[libvirt] [PATCH] libxl: fix typo in debug message
by Guido Günther 16 Mar '17

16 Mar '17

--- src/libxl/libxl_migration.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libxl/libxl_migration.c b/src/libxl/libxl_migration.c index fb833d1a3..6b5b981f1 100644 --- a/src/libxl/libxl_migration.c +++ b/src/libxl/libxl_migration.c @@ -325,7 +325,7 @@ libxlMigrateReceive(virNetSocketPtr sock, goto fail; } VIR_DEBUG("Accepted migration connection." - " Spawing thread to process migration data"); + " Spawning thread to process migration data"); recvfd = virNetSocketDupFD(client_sock, true); virObjectUnref(client_sock); -- 2.11.0

2 2

[libvirt] [PATCH 0/2] Adaptive timeout for connecting to qemu monitor
by Michal Privoznik 16 Mar '17

16 Mar '17

I am not able to test this properly (my host has "just" 32GiB of RAM), but I've patched qemu to insert some delay into its init process and it worked just fine. Michal Privoznik (2): virTimeBackOffWait: Avoid long periods of sleep qemu: Adaptive timeout for connecting to monitor src/qemu/qemu_capabilities.c | 2 +- src/qemu/qemu_monitor.c | 36 +++++++++++++++++++++++++++++++----- src/qemu/qemu_monitor.h | 1 + src/qemu/qemu_process.c | 8 ++++++++ src/util/virtime.c | 14 ++++++++++++-- tests/qemumonitortestutils.c | 1 + 6 files changed, 54 insertions(+), 8 deletions(-) -- 2.11.0

4 13

[libvirt] [PATCH] Short circuit SASL auth when no mechanisms are available
by Daniel P. Berrange 16 Mar '17

16 Mar '17

If the SASL config does not have any mechanisms we currently just report an empty list to the client which will then fail to identify a usable mechanism. This is a server config error, so we should fail immediately on the server side. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/rpc/virnetsaslcontext.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/rpc/virnetsaslcontext.c b/src/rpc/virnetsaslcontext.c index 37a5da2..c4492ec 100644 --- a/src/rpc/virnetsaslcontext.c +++ b/src/rpc/virnetsaslcontext.c @@ -390,6 +390,12 @@ char *virNetSASLSessionListMechanisms(virNetSASLSessionPtr sasl) err, sasl_errdetail(sasl->conn)); goto cleanup; } + VIR_DEBUG("SASL mechanism list is '%s'", mechlist); + if (STREQ(mechlist, "")) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("no SASL mechanisms are available")); + goto cleanup; + } ignore_value(VIR_STRDUP(ret, mechlist)); cleanup: -- 2.9.3

2 1

[libvirt] [PATCH] Sanity check explicit TLS file paths
by Daniel P. Berrange 16 Mar '17

16 Mar '17

When providing explicit x509 cert/key paths in libvirtd.conf, the user must provide all three. If one or more is missed, this leads to obscure errors at runtime when negotiating the TLS session Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- daemon/libvirtd.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index 9b98f33..40aa2b6 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -544,6 +544,22 @@ daemonSetupNetworking(virNetServerPtr srv, if (config->ca_file || config->cert_file || config->key_file) { + if (!config->ca_file) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + "No CA certificate path set to match server key/cert"); + goto cleanup; + } + if (!config->cert_file) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + "No server certificate path set to match server key"); + goto cleanup; + } + if (!config->key_file) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + "No server key path set to match server cert"); + goto cleanup; + } + VIR_DEBUG("Using CA='%s' cert='%s' key='%s'", config->ca_file, config->cert_file, config->key_file); if (!(ctxt = virNetTLSContextNewServer(config->ca_file, config->crl_file, config->cert_file, -- 2.9.3

2 1

[libvirt] [PATCH 0/2] Fix nodedev error message and test driver logic
by John Ferlan 16 Mar '17

16 Mar '17

The first patch is related to review comments from my Converge Storage Pool vHBA logic Patch1 w/r/t a weak error message The second patch is pulled from Patch17 of that series and is just an adjustment in the storage pool create xml logic Neither of these require news.xml updates... John Ferlan (2): conf: Alter error message for vHBA creation using parent wwnn/wwpn test: Don't assume a configFile exists for Storage Pool tests src/conf/node_device_conf.c | 17 +++++++++++++---- src/test/test_driver.c | 6 ++++++ 2 files changed, 19 insertions(+), 4 deletions(-) -- 2.9.3

2 4

[libvirt] [PATCH v3 00/18] Converge Storage Pool vHBA logic with Node Device
by John Ferlan 16 Mar '17

16 Mar '17

v2: http://www.redhat.com/archives/libvir-list/2017-March/msg00161.html Changes since v2: - Pushed the former patch1 after a slight adjustment replace a spurrious lost line - [NEW] Patch 1 - Fixes an existing bug - details in patch - [UPD] Patch 2 - Split out what Jano noted about new checks into it's own - [UPD] Patch 3->14 - Rework the former patch2 to split out the step by step details it took to get to patch2. - [No Change] Patch 15-18 -> Patch15->16 ACKed in v1, but I just left these in the order I had -> Patch17->18 Unchanged - same comment as v2 (copied so as to not force someone would go back to v2): Even though there is concern over usage of API's in this manner (e.g. calling virNodeDeviceLookupSCSIHostByWWN as well as virNodeDeviceCreateXML) - the "purpose" of the exercise is a means to have the StoragePool code use the same algorithms as the node device code instead of what could be a potentially long slow journey through the sysfs file system. The key piece being the replication of the API's that find the parent in the node device object list. I suppose it would be possible to add even more API's to get that answer, but I'm not sure it'd be worthwhile at this point. As for the concern about deadlock - I understand it, but since the whole purpose of the API is to essentially utilize the nodedev create algorithm there'd be no reason for nodedev to call it. If it doesn't get ACK'd - that's OK - I can hold onto it and reconsider some other means at some point in time in the future (probably distant future too). John Ferlan (18): conf: Ensure both parent_wwnn/parent_wwpn provided conf: Add missing validate for fchost search fields conf: Split out storage pool source adapter helpers conf: Rework parsing in virStoragePoolDefParseSourceAdapter conf: Introduce storage_adapter_conf conf: Rename API's in storage_adapter_conf conf: Extract FCHost adapter type processing into their own helpers conf: Extract SCSI adapter type processing into their own helpers conf: Split up virStoragePoolSourceAdapter conf: Rework storage_adapter_conf to use adapter specific typedefs conf: Rework storage_conf to use adapter specific typedefs storage: Rework getAdapterName to use adapter specific typedefs storage: Rework createVport and deleteVport conf: Convert virStoragePoolSourceAdapter to virStorageAdapter util: Rename virFileWaitForDevices conf: Move/rename createVport and deleteVport util: Alter virNodeDevice{Create|Delete}Vport to use nodedev APIs tests: Add more storage pool vHBA tests po/POTFILES.in | 1 + src/Makefile.am | 1 + src/conf/node_device_conf.c | 332 ++++++++++++++++++++++++++++++++ src/conf/node_device_conf.h | 9 + src/conf/storage_adapter_conf.c | 330 ++++++++++++++++++++++++++++++++ src/conf/storage_adapter_conf.h | 84 ++++++++ src/conf/storage_conf.c | 348 ++++++++-------------------------- src/conf/storage_conf.h | 36 +--- src/libvirt_private.syms | 13 +- src/node_device/node_device_driver.c | 2 +- src/phyp/phyp_driver.c | 3 +- src/storage/storage_backend_disk.c | 6 +- src/storage/storage_backend_iscsi.c | 2 +- src/storage/storage_backend_logical.c | 4 +- src/storage/storage_backend_mpath.c | 2 +- src/storage/storage_backend_scsi.c | 267 +++++--------------------- src/storage/storage_util.c | 2 +- src/test/test_driver.c | 11 +- src/util/virfile.h | 2 - src/util/virutil.c | 4 +- src/util/virutil.h | 2 + tests/fchosttest.c | 47 +++++ 22 files changed, 968 insertions(+), 540 deletions(-) create mode 100644 src/conf/storage_adapter_conf.c create mode 100644 src/conf/storage_adapter_conf.h -- 2.9.3

3 61

[libvirt] [PATCH v3 00/17] Introduce NVDIMM support
by Michal Privoznik 16 Mar '17

16 Mar '17

NVDIMMs are new type of ultra fast storage that's plugged into DIMM slot and can hold the stored info throughout reboots. After all, NV stands for non-volatile. In virtualization world, this has an awesome advantage - less VM_EXITs on 'disk' IO. https://nvdimm.wiki.kernel.org/ How to test this feature? $ > /tmp/nvdimm $ truncate --size 512M /tmp/nvdimm $ virsh edit $mydom <memory model='nvdimm' access='shared'> <source> <path>/tmp/nvdimm</path> </source> <target> <size unit='MiB'>512</size> <node>0</node> <label> <size unit='KiB'>128</size> </label> </target> <address type='dimm' slot='0'/> </memory> $ virsh start $mydom $ ssh $mydom "echo \"Hello world\" > /dev/pmem0" $ hexdump -C /tmp/nvdimm 00000000 48 65 6c 6c 6f 20 77 6f 72 6c 64 0a 00 00 00 00 |Hello world.....| 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 20000000 diff to v2: - John's review points worked in - Couple of more patches to clean up qemuBuildMemoryBackendStr Michal Privoznik (17): qemuBuildMemoryBackendStr: Don't overwrite @force qemuBuildMemoryBackendStr: Check for @memAccess properly qemuBuildMemoryBackendStr: Pass virDomainMemoryDefPtr qemuBuildMemoryBackendStr: Reorder args and update comment Introduce NVDIMM memory model qemu: Introduce QEMU_CAPS_DEVICE_NVDIMM qemu: Implement NVDIMM conf: Introduce @access to <memory/> qemu: Implement @access for <memory/> banks qemu: Introduce label-size for NVDIMMs security_dac: Label host side of NVDIMM security_selinux: Label host side of NVDIMM security: Introduce internal APIs for memdev labelling secdrivers: Implement memdev relabel APIs qemu_hotplug: Relabel memdev qemu: Allow nvdimm in devices CGroups qemu: Namespaces for NVDIMM docs/formatdomain.html.in | 83 ++++++++-- docs/schemas/domaincommon.rng | 47 ++++-- src/conf/domain_conf.c | 146 +++++++++++++---- src/conf/domain_conf.h | 5 + src/libvirt_private.syms | 2 + src/qemu/qemu_alias.c | 10 +- src/qemu/qemu_capabilities.c | 9 ++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_cgroup.c | 49 ++++++ src/qemu/qemu_cgroup.h | 4 + src/qemu/qemu_command.c | 172 +++++++++++++-------- src/qemu/qemu_command.h | 15 +- src/qemu/qemu_domain.c | 113 +++++++++++++- src/qemu/qemu_domain.h | 8 + src/qemu/qemu_hotplug.c | 40 ++++- src/qemu/qemu_security.c | 56 +++++++ src/qemu/qemu_security.h | 8 + src/security/security_dac.c | 76 +++++++++ src/security/security_driver.h | 9 ++ src/security/security_manager.c | 56 +++++++ src/security/security_manager.h | 7 + src/security/security_nop.c | 19 +++ src/security/security_selinux.c | 69 +++++++++ src/security/security_stack.c | 38 +++++ .../qemuxml2argv-memory-hotplug-nvdimm-access.args | 26 ++++ .../qemuxml2argv-memory-hotplug-nvdimm-access.xml | 56 +++++++ .../qemuxml2argv-memory-hotplug-nvdimm-label.args | 26 ++++ .../qemuxml2argv-memory-hotplug-nvdimm-label.xml | 59 +++++++ .../qemuxml2argv-memory-hotplug-nvdimm.args | 26 ++++ .../qemuxml2argv-memory-hotplug-nvdimm.xml | 56 +++++++ tests/qemuxml2argvtest.c | 8 +- ...qemuxml2xmlout-memory-hotplug-nvdimm-access.xml | 1 + .../qemuxml2xmlout-memory-hotplug-nvdimm-label.xml | 1 + .../qemuxml2xmlout-memory-hotplug-nvdimm.xml | 1 + tests/qemuxml2xmltest.c | 3 + 35 files changed, 1164 insertions(+), 141 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-memory-hotplug-nvdimm-access.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-memory-hotplug-nvdimm-access.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-memory-hotplug-nvdimm-label.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-memory-hotplug-nvdimm-label.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-memory-hotplug-nvdimm.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-memory-hotplug-nvdimm.xml create mode 120000 tests/qemuxml2xmloutdata/qemuxml2xmlout-memory-hotplug-nvdimm-access.xml create mode 120000 tests/qemuxml2xmloutdata/qemuxml2xmlout-memory-hotplug-nvdimm-label.xml create mode 120000 tests/qemuxml2xmloutdata/qemuxml2xmlout-memory-hotplug-nvdimm.xml -- 2.11.0

2 36

[libvirt] libvirt and dmesg
by Michel Pierre-Jacques 15 Mar '17

15 Mar '17

Hi all, il try to find the way to obtain the same use as in the lxc config file lxc.kmsg=0 how to do that, with the xml of a lxc domain, i make lot of try without success . is there another way to deny access to the dmesg for a libvirt lxc domain ? --- Kogitae AE Infogérance Linux / Administrateur Système le Domaine Picard 21-23 rue de la cornée 70800 Anjeux -------------------------- Tel : +33 (0)3 68 33 53 64 IRC : http://kogitae.fr/irc ------------------------------------ 9h-12h & 14h-18h / Lundi au Vendredi Sur RDV en dehors

2 2