Commit Graph

31441 Commits

Author SHA1 Message Date
Pavel Hrdina
b79d858518 vircgroup: add support for hybrid configuration
This enables to use both cgroup v1 and v2 at the same time together
with libvirt.  It is supported by kernel and there is valid use-case,
not all controllers are implemented in cgroup v2 so there might be
configurations where administrator would enable these missing
controllers in cgroup v1.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
a77f532691 vircgroup: register cgroup v2 backend
All mandatory callbacks are implemented for cgroup v2 backend so we
can register it now.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
4d1d5c92bd vircgroup: introduce virCgroupV2GetCpuacctStat
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
567fcbdca5 vircgroup: introduce virCgroupV2GetCpuacctUsage
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
5a4d90ae6a vircgroup: introduce virCgroupV2SupportsCpuBW
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
8e2c887ffa vircgroup: introduce virCgroupV2(Set|Get)CpuCfsQuota
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
8324224572 vircgroup: introduce virCgroupV2(Set|Get)CpuCfsPeriod
In order to set CPU cfs period using cgroup v2 'cpu.max' interface
we need to load the current value of CPU cfs quota first because
format of 'cpu.max' interface is '$quota $period' and in order to
change 'period' we need to write 'quota' as well.  Writing only one
number changes only 'quota'.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
b8ca5afc22 vircgroup: introduce virCgroupV2(Set|Get)CpuShares
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
3f728c720b vircgroup: introduce virCgroupV2GetMemSwapUsage
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
df63fd1f8f vircgroup: introduce virCgroupV2(Set|Get)MemSwapHardLimit
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
94db4bf86e vircgroup: introduce virCgroupV2(Set|Get)MemorySoftLimit
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
2aa5385c58 vircgroup: introduce virCgroupV2(Set|Get)MemoryHardLimit
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
495f60edcb vircgroup: introduce virCgroupV2GetMemoryUsage
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
d080c00166 vircgroup: introduce virCgroupV2GetMemoryStat
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
63bd23a6ad vircgroup: introduce virCgroupV2SetMemory
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
91756fb64a vircgroup: introduce virCgroupV2(Set|Get)BlkioDeviceWriteBps
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
353ce9453e vircgroup: introduce virCgroupV2(Set|Get)BlkioDeviceReadBps
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
438587033b vircgroup: introduce virCgroupV2(Set|Get)BlkioDeviceWriteIops
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
862f630825 vircgroup: introduce virCgroupV2(Set|Get)BlkioDeviceReadIops
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
568f746eaf vircgroup: introduce virCgroupV2(Set|Get)BlkioDeviceWeight
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
93fa369df5 vircgroup: introduce virCgroupV2GetBlkioIoDeviceServiced
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
709260add9 vircgroup: introduce virCgroupV2GetBlkioIoServiced
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
11bb7f1561 vircgroup: introduce virCgroupV2(Set|Get)BlkioWeight
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
525ac6885b vircgroup: introduce virCgroupV2SetOwner
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
cda8ed0646 vircgroup: introduce virCgroupV2BindMount
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
38411bb831 vircgroup: introduce virCgroupV2HasEmptyTasks
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
48572f8825 vircgroup: introduce virCgroupV2AddTask
In cgroups v2 we need to handle threads and processes differently.
If you need to move a process you need to write its pid into
cgrou.procs file and it will move the process with all its threads
as well.  The whole process will be moved if you use tid of any thread.

In order to move only threads at first we need to create threaded group
and after that we can write the relevant thread tids into cgroup.threads
file.  Threads can be moved only into cgroups that are children of
cgroup of its process.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
4fe4847438 vircgroup: introduce virCgroupV2Remove
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
89f52abd07 vircgroup: introduce virCgroupV2MakeGroup
When creating cgroup hierarchy we need to enable controllers in the
parent cgroup in order to be usable.  That means writing "+{controller}"
into cgroup.subtree_control file.  We can enable only controllers that
are enabled for parent cgroup, that means we need to do that for the
whole cgroup tree.

Cgroups for threads needs to be handled differently in cgroup v2.  There
are two types of controllers:

    - domain controllers: these cannot be enabled for threads
    - threaded controllers: these can be enabled for threads

In addition there are multiple types of cgroups:

    - domain: normal cgroup
    - domain threaded: a domain cgroup that serves as root for threaded
                       cgroups
    - domain invalid: invalid cgroup, can be changed into threaded, this
                      is the default state if you create subgroup inside
                      domain threaded group or threaded group
    - threaded: threaded cgroup which can have domain threaded or
                threaded as parent group

In order to create threaded cgroup it's sufficient to write "threaded"
into cgroup.type file, it will automatically make parent cgroup
"domain threaded" if it was only "domain".  In case the parent cgroup
is already "domain threaded" or "threaded" it will modify only the type
of current cgroup.  After that we can enable threaded controllers.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
0542640a9c vircgroup: introduce virCgroupV2PathOfController
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
171c700cd8 vircgroup: introduce virCgroupV2GetAnyController
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
c8f08a5346 vircgroup: introduce virCgroupV2HasController
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
e1bb7fffe2 vircgroup: introduce virCgroupV2DetectControllers
Cgroup v2 has only single mount point for all controllers.  The list
of controllers is stored in cgroup.controllers file, name of controllers
are separated by space.

In cgroup v2 there is no cpuacct controller, the cpu.stat file always
exists with usage stats.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
f7394dcf01 vircgroup: introduce virCgroupV2StealPlacement
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
9aa8226d86 vircgroup: introduce virCgroupV2ValidatePlacement
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
1efcf202e7 vircgroup: introduce virCgroupV2DetectPlacement
If the placement was copied from parent or set to absolute path
there is nothing to do, otherwise set the placement based on
process placement from /proc/self/cgroup or /proc/{pid}/cgroup.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
50f61a46fc vircgroup: introduce virCgroupV2DetectMounts
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
7a86201dd6 vircgroup: introduce virCgroupV2CopyPlacement
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
38a3fb5647 vircgroup: introduce virCgroupV2CopyMounts
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
3a365ef697 vircgroup: introduce virCgroupV2ValidateMachineGroup
When reconnecting to a domain we are validating the cgroup name.
In case of cgroup v2 we need to validate only the new format for host
without systemd '{machinename}.libvirt-{drivername}' or scope name
generated by systemd.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
034ef217d7 vircgroup: introduce virCgroupV2Available
We cannot detect only mount points to figure out whether cgroup v2
is available because systemd uses cgroup v2 for process tracking and
all controllers are mounted as cgroup v1 controllers.

To make sure that this is no the situation we need to check
'cgroup.controllers' file if it's not empty to make sure that cgroup
v2 is not mounted only for process tracking.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Pavel Hrdina
b4ddf5ae62 util: introduce cgroup v2 files
Place cgroup v2 backend type before cgroup v1 to make it obvious
that cgroup v2 is preferred implementation.

Following patches will introduce support for hybrid configuration
which will allow us to use both at the same time, but we should
prefer cgroup v2 regardless.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2018-10-05 15:53:29 +02:00
Daniel P. Berrangé
87f71398fe rpm: disable some features on riscv64
numctl, numad and zfs-fuse are not available on riscv64 targets

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-10-05 13:59:31 +01:00
Ján Tomko
e7730d196b qemu: fix comment in qemuSecurityChownCallback
s/chmod/chown/

Signed-off-by: Ján Tomko <jtomko@redhat.com>
2018-10-04 10:01:08 +02:00
Ján Tomko
8ba65c4d95 qemu: fix up permissions for pre-created UNIX sockets
My commit d6b8838 fixed the uid:gid for the pre-created UNIX sockets
but did not account for the different umask of libvirtd and QEMU.
Since commit 0e1a1a8c we set umask to '0002' for the QEMU process.
Manually tune-up the permissions to match what we would have gotten
if QEMU had created the socket.

https://bugzilla.redhat.com/show_bug.cgi?id=1633389

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
2018-10-03 16:26:08 +02:00
Michal Privoznik
478da65fb4 virFileIsSharedFSType: Check for fuse.glusterfs too
https://bugzilla.redhat.com/show_bug.cgi?id=1632711

GlusterFS is typically safe when it comes to migration. It's a
network FS after all. However, it can be mounted via FUSE driver
they provide. If that is the case we fail to identify it and
think migration is not safe and require VIR_MIGRATE_UNSAFE flag.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
2018-10-03 13:50:19 +02:00
Jiri Denemark
5cae1f47c4 cpu_map: Use and install Icelake model definitions
In commit v4.7.0-168-g993d85ae5e I introduced two Icelake CPU models,
but failed to actually include them in the CPU map index.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2018-10-03 13:00:54 +02:00
Ján Tomko
d6b8838dd8 security: dac: also label listen UNIX sockets
We switched to opening mode='bind' sockets ourselves:
commit 30fb2276d8
    qemu: support passing pre-opened UNIX socket listen FD
in v4.5.0-rc1~251

Then fixed qemuBuildChrChardevStr to change libvirtd's label
while creating the socket:
commit b0c6300fc4
    qemu: ensure FDs passed to QEMU for chardevs have correct SELinux labels
v4.5.0-rc1~52

Also add labeling of these sockets to the DAC driver.
Instead of duplicating the logic which decides whether libvirt should
pre-create the socket, assume an existing path meaning that it was created
by libvirt.

https://bugzilla.redhat.com/show_bug.cgi?id=1633389

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2018-10-02 12:44:44 +02:00
Marc Hartmayer
9f81dc1081 qemu: Introduce qemuDomainUpdateQEMUCaps()
This function updates the used QEMU capabilities of @vm by querying
the QEMU capabilities cache.

Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2018-10-01 18:35:47 -04:00
Marc Hartmayer
a4c12a5096 qemu: Use VIR_STEAL_PTR macro
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Bjoern Walk <bwalk@linux.ibm.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Stefan Zimmermann <stzi@linux.ibm.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2018-10-01 18:35:32 -04:00