This function can be used to retrieve the current locked memory limit for a process, so that the setting can be later restored. Add a configure check for getrlimit(), which we now use. --- configure.ac | 2 +- src/libvirt_private.syms | 1 + src/util/virprocess.c | 45 +++++++++++++++++++++++++++++++++++++++++++++ src/util/virprocess.h | 2 ++ 4 files changed, 49 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index 98cf210..25fdfe2 100644 --- a/configure.ac +++ b/configure.ac @@ -279,7 +279,7 @@ AC_CHECK_SIZEOF([long]) dnl Availability of various common functions (non-fatal if missing), dnl and various less common threadsafe functions AC_CHECK_FUNCS_ONCE([cfmakeraw fallocate geteuid getgid getgrnam_r \ - getmntent_r getpwuid_r getuid kill mmap newlocale posix_fallocate \ + getmntent_r getpwuid_r getrlimit getuid kill mmap newlocale posix_fallocate \ posix_memalign prlimit regexec sched_getaffinity setgroups setns \ setrlimit symlink sysctlbyname getifaddrs sched_setscheduler]) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 55822ae..0b5ddc1 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -2040,6 +2040,7 @@ virPortAllocatorSetUsed; virProcessAbort; virProcessExitWithStatus; virProcessGetAffinity; +virProcessGetMaxMemLock; virProcessGetNamespaces; virProcessGetPids; virProcessGetStartTime; diff --git a/src/util/virprocess.c b/src/util/virprocess.c index 9b38834..277b3bc 100644 --- a/src/util/virprocess.c +++ b/src/util/virprocess.c @@ -788,6 +788,51 @@ virProcessSetMaxMemLock(pid_t pid ATTRIBUTE_UNUSED, unsigned long long bytes) } #endif /* ! (HAVE_SETRLIMIT && defined(RLIMIT_MEMLOCK)) */ +#if HAVE_GETRLIMIT && defined(RLIMIT_MEMLOCK) +int +virProcessGetMaxMemLock(pid_t pid, + unsigned long long *bytes) +{ + struct rlimit rlim; + + if (!bytes) + return 0; + + if (pid == 0) { + if (getrlimit(RLIMIT_MEMLOCK, &rlim) < 0) { + virReportSystemError(errno, + "%s", + _("cannot get locked memory limit")); + return -1; + } + } else { + if (virProcessPrLimit(pid, RLIMIT_MEMLOCK, NULL, &rlim) < 0) { + virReportSystemError(errno, + _("cannot get locked memory limit " + "of process %lld"), + (long long int) pid); + return -1; + } + } + + /* virProcessSetMaxMemLock() sets both rlim_cur and rlim_max to the + * same value, so we can retrieve just rlim_max here */ + *bytes = rlim.rlim_max; + + return 0; +} +#else /* ! (HAVE_GETRLIMIT && defined(RLIMIT_MEMLOCK)) */ +int +virProcessGetMaxMemLock(pid_t pid ATTRIBUTE_UNUSED, + unsigned long long *bytes) +{ + if (!bytes) + return 0; + + virReportSystemError(ENOSYS, "%s", _("Not supported on this platform")); + return -1; +} +#endif /* ! (HAVE_GETRLIMIT && defined(RLIMIT_MEMLOCK)) */ #if HAVE_SETRLIMIT && defined(RLIMIT_NPROC) int diff --git a/src/util/virprocess.h b/src/util/virprocess.h index 1768009..a7a1fe9 100644 --- a/src/util/virprocess.h +++ b/src/util/virprocess.h @@ -76,6 +76,8 @@ int virProcessSetMaxMemLock(pid_t pid, unsigned long long bytes); int virProcessSetMaxProcesses(pid_t pid, unsigned int procs); int virProcessSetMaxFiles(pid_t pid, unsigned int files); +int virProcessGetMaxMemLock(pid_t pid, unsigned long long *bytes); + /* Callback to run code within the mount namespace tied to the given * pid. This function must use only async-signal-safe functions, as * it gets run after a fork of a multi-threaded process. The return -- 2.5.0

Replace all uses of the qemuDomainRequiresMlock/virProcessSetMaxMemLock combination with the equivalent qemuDomainAdjustMaxMemLock() call. --- src/qemu/qemu_hotplug.c | 40 +++++++++++++--------------------------- 1 file changed, 13 insertions(+), 27 deletions(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index a88c2f2..8d69647 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1282,17 +1282,14 @@ qemuDomainAttachHostPCIDevice(virQEMUDriverPtr driver, } /* Temporarily add the hostdev to the domain definition. This is needed - * because qemuDomainRequiresMlock() and qemuDomainGetMlockLimitBytes() - * require the hostdev to be already part of the domain definition, but - * other functions like qemuAssignDeviceHostdevAlias() used below expect - * it *not* to be there. A better way to handle this would be nice */ + * because qemuDomainAdjustMaxMemLock() requires the hostdev to be already + * part of the domain definition, but other functions like + * qemuAssignDeviceHostdevAlias() used below expect it *not* to be there. + * A better way to handle this would be nice */ vm->def->hostdevs[vm->def->nhostdevs++] = hostdev; - if (qemuDomainRequiresMlock(vm->def)) { - if (virProcessSetMaxMemLock(vm->pid, - qemuDomainGetMlockLimitBytes(vm->def)) < 0) { - vm->def->hostdevs[--(vm->def->nhostdevs)] = NULL; - goto error; - } + if (qemuDomainAdjustMaxMemLock(vm) < 0) { + vm->def->hostdevs[--(vm->def->nhostdevs)] = NULL; + goto error; } vm->def->hostdevs[--(vm->def->nhostdevs)] = NULL; @@ -1778,7 +1775,6 @@ qemuDomainAttachMemory(virQEMUDriverPtr driver, virJSONValuePtr props = NULL; virObjectEventPtr event; bool fix_balloon = false; - bool mlock = false; int id; int ret = -1; @@ -1810,12 +1806,7 @@ qemuDomainAttachMemory(virQEMUDriverPtr driver, goto cleanup; } - mlock = qemuDomainRequiresMlock(vm->def); - - if (mlock && - virProcessSetMaxMemLock(vm->pid, - qemuDomainGetMlockLimitBytes(vm->def)) < 0) { - mlock = false; + if (qemuDomainAdjustMaxMemLock(vm) < 0) { virJSONValueFree(props); goto removedef; } @@ -1876,13 +1867,10 @@ qemuDomainAttachMemory(virQEMUDriverPtr driver, mem = NULL; /* reset the mlock limit */ - if (mlock) { - virErrorPtr err = virSaveLastError(); - ignore_value(virProcessSetMaxMemLock(vm->pid, - qemuDomainGetMlockLimitBytes(vm->def))); - virSetError(err); - virFreeError(err); - } + virErrorPtr err = virSaveLastError(); + ignore_value(qemuDomainAdjustMaxMemLock(vm)); + virSetError(err); + virFreeError(err); goto audit; } @@ -2976,9 +2964,7 @@ qemuDomainRemoveMemoryDevice(virQEMUDriverPtr driver, virDomainMemoryDefFree(mem); /* decrease the mlock limit after memory unplug if necessary */ - if (qemuDomainRequiresMlock(vm->def)) - ignore_value(virProcessSetMaxMemLock(vm->pid, - qemuDomainGetMlockLimitBytes(vm->def))); + ignore_value(qemuDomainAdjustMaxMemLock(vm)); return 0; } -- 2.5.0

When the function changes the memory lock limit for the first time, it will retrieve the current value and store it inside the virDomainObj for the domain. When the function is called again, if memory locking is no longer needed, it will be able to restore the memory locking limit to its original value. --- src/conf/domain_conf.h | 3 +++ src/qemu/qemu_domain.c | 21 +++++++++++++++++++-- 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index cec681a..952d3cc 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -2420,6 +2420,9 @@ struct _virDomainObj { void (*privateDataFreeFunc)(void *); int taint; + + unsigned long long original_memlock; /* Original RLIMIT_MEMLOCK, zero if no + * restore will be required later */ }; typedef bool (*virDomainObjListACLFilter)(virConnectPtr conn, diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 4b796ab..1e1e57f 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -4125,7 +4125,10 @@ qemuDomainRequiresMlock(virDomainDefPtr def) * Adjust the memory locking limit for the QEMU process associated to @vm, in * order to comply with VFIO or architecture requirements. * - * The limit will not be changed unless doing so is needed. + * The limit will not be changed unless doing so is needed; the first time + * the limit is changed, the original (default) limit is stored in @vm and + * that value will be restored if qemuDomainAdjustMaxMemLock() is called once + * memory locking is no longer required. * * Returns: 0 on success, <0 on failure */ @@ -4135,8 +4138,22 @@ qemuDomainAdjustMaxMemLock(virDomainObjPtr vm) unsigned long long bytes = 0; int ret = -1; - if (qemuDomainRequiresMlock(vm->def)) + if (qemuDomainRequiresMlock(vm->def)) { + /* If this is the first time adjusting the limit, save the current + * value so that we can restore it once memory locking is no longer + * required. Failing to obtain the current limit is not a critical + * failure, it just means we'll be unable to lower it later */ + if (!vm->original_memlock) { + if (virProcessGetMaxMemLock(vm->pid, &(vm->original_memlock)) < 0) + vm->original_memlock = 0; + } bytes = qemuDomainGetMlockLimitBytes(vm->def); + } else { + /* Once memory locking is no longer required, we can restore the + * original, usually very low, limit */ + bytes = vm->original_memlock; + vm->original_memlock = 0; + } /* Trying to set the memory locking limit to zero is a no-op */ if (virProcessSetMaxMemLock(vm->pid, bytes) < 0) -- 2.5.0