Re: [libvirt-users] RLIMIT_MEMLOCK in container environment

(Adding Alex Williamson to Cc so he can correct any mistakes) On 8/22/19 4:39 PM, Ihar Hrachyshka wrote: So you're making an educated guess, which is essentially what libvirt is doing (based on advice from other people with better information than us, but still a guess). What I understand from an IRC conversation with Alex just now is that increasing RLIMIT_MEMLOCK isn't done just to prevent any of the pages being swapped out. It's done because "all GPAs (Guest Physical Addresses) that could potentially be DMA targets need to have fixed mappings through the iommu, therefore all need to be allocated and mappings fixed [...] setting rlimit allows us to perform all the necessary pins within the user's locked memory limit". So even if swap is disabled, it still needs to be done (either by libvirt, or by someone else who has the necessary privileges and control over the libvirtd process). The Alex I'm referring to is the Alex I just Cc'ed. He is the VFIO maintainer. Well, after talking to Alex, I think that since a) libvirt only attempts to increase the limit after determining that it isn't already high enough, and b) if it isn't high enough and we can't increase it, then qemu is going to fail anyway, that c) we can't just fail gracefully and continue. So *somebody* needs to increase the limit, and if you want libvirt to be unprivileged, that means it needs to be you doing the increase. And since the amount that libvirt increases it is just some number based on oral folklore (and not on a specific value we learn by querying somewhere), I don't think it's worthwhile figuring out some way for libvirt to report it via an official API - that would end up just being this: "Hey, you know that number that you guys are just making a guess about based on some advice someone gave you once? Yeah, send me *that* number so I can claim to be basing my actions on real science instead of slightly educated voodoo! K THX BYE!" :-)