September 2012 - Devel - libvirt List Archives

[libvirt] [PATCH v3] Fix dnsmasq/radvd on bridges not being able to be bound to IPv6 address on "recent" kernels
by Benjamin Cama 28 Sep '12

28 Sep '12

Hi, I hit this problem recently when trying to create a bridge with an IPv6 address on a 3.2 kernel: dnsmasq (and, further, radvd) would not bind to the given address, waiting 20s and then giving up with -EADDRNOTAVAIL (resp. exiting immediately with "error parsing or activating the config file", without libvirt noticing it, BTW). This can be reproduced with (I think) any kernel >= 2.6.39 and the following XML (to be used with "virsh net-create"): <network> <name>test-bridge</name> <bridge name='testbr0' /> <ip family='ipv6' address='fd00::1' prefix='64'> </ip> </network> (it happens even when you have an IPv4, too) The problem is that since commit [1] (which, ironically, was made to “help IPv6 autoconfiguration”) the linux bridge code makes bridges behave like “real” devices regarding carrier detection. This makes the bridges created by libvirt, which are started without any up devices, stay with the NO-CARRIER flag set, and thus prevents DAD (Duplicate address detection) from happening, thus letting the IPv6 address flagged as “tentative”. Such addresses cannot be bound to (see RFC 2462), so dnsmasq fails binding to it (for radvd, it detects that "interface XXX is not RUNNING", thus that "interface XXX does not exist, ignoring the interface" (sic)). It seems that this behavior was enhanced somehow with commit [2] by avoiding setting NO-CARRIER on empty bridges, but I couldn't reproduce this behavior on my kernel. Anyway, with the “dummy tap to set MAC address” trick, this wouldn't work. To fix this, the idea is to get the bridge's attached device to be up so that DAD can happen (deactivating DAD altogether is not a good idea, I think). Currently, libvirt creates a dummy TAP device to set the MAC address of the bridge, keeping it down. But even if we set this device up, it is not RUNNING as soon as the tap file descriptor attached to it is closed, thus still preventing DAD. So, we must modify the API a bit, so that we can get the fd, keep the tap device persistent, run the daemons, and close it after DAD has taken place. After that, the bridge will be flagged NO-CARRIER again, but the daemons will be running, even if not happy about the device's state (but we don't really care about the bridge's daemons doing anything when no up interface is connected to it). Other solutions that I envisioned were: * Keeping the *-nic interface up: this would waste an fd for each bridge during all its life. May be acceptable, I don't really know. * Stop using the dummy tap trick, and set the MAC address directly on the bridge: it is possible since quite some time it seems, even if then there is the problem of the bridge not being RUNNING when empty, contrary to what [2] says, so this will need fixing (and this fix only happened in 3.1, so it wouldn't work for 2.6.39) * Using the --interface option of dnsmasq, but I saw somewhere that it's not used by libvirt for backward compatibility. I am not sure this would solve this problem, though, as I don't know how dnsmasq binds itself to it with this option. This is why this patch does what's described earlier. This patch also makes radvd start even if the interface is “missing” (i.e. it is not RUNNING), as it daemonizes before binding to it, and thus sometimes does it after the interface has been brought down by us (by closing the tap fd), and then originally stops. This also makes it stop yelling about it in the logs when the interface is down at a later time. [1] http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commit;h=1fa… [2] http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commit;h=b64… --- diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index 6e260f7..8d6abd3 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -65,6 +65,7 @@ #include "virnetdevtap.h" #include "virnetdevvportprofile.h" #include "virdbus.h" +#include "virfile.h" #define NETWORK_PID_DIR LOCALSTATEDIR "/run/libvirt/network" #define NETWORK_STATE_DIR LOCALSTATEDIR "/lib/libvirt/network" @@ -987,12 +988,15 @@ networkRadvdConfContents(virNetworkObjPtr network, char **configstr) *configstr = NULL; - /* create radvd config file appropriate for this network */ + /* create radvd config file appropriate for this network; + * IgnoreIfMissing allows radvd to start even when the bridge is down + */ virBufferAsprintf(&configbuf, "interface %s\n" "{\n" " AdvSendAdvert on;\n" " AdvManagedFlag off;\n" " AdvOtherConfigFlag off;\n" + " IgnoreIfMissing on;\n" "\n", network->def->bridge); @@ -2061,6 +2065,7 @@ networkStartNetworkVirtual(struct network_driver *driver, virErrorPtr save_err = NULL; virNetworkIpDefPtr ipdef; char *macTapIfName = NULL; + int tapfd = -1; /* Check to see if any network IP collides with an existing route */ if (networkCheckRouteCollision(network) < 0) @@ -2082,10 +2087,13 @@ networkStartNetworkVirtual(struct network_driver *driver, virReportOOMError(); goto err0; } + /* Keep tun fd open and interface up to allow for IPv6 DAD to happen */ if (virNetDevTapCreateInBridgePort(network->def->bridge, &macTapIfName, &network->def->mac, - NULL, NULL, NULL, NULL, - VIR_NETDEV_TAP_CREATE_USE_MAC_FOR_BRIDGE) < 0) { + NULL, &tapfd, NULL, NULL, + VIR_NETDEV_TAP_CREATE_USE_MAC_FOR_BRIDGE + |VIR_NETDEV_TAP_CREATE_IFUP + |VIR_NETDEV_TAP_CREATE_PERSIST) < 0) { VIR_FREE(macTapIfName); goto err0; } @@ -2149,6 +2157,15 @@ networkStartNetworkVirtual(struct network_driver *driver, if (v6present && networkStartRadvd(network) < 0) goto err4; + /* DAD has happened (dnsmasq waits for it), dnsmasq is now bound to the + * bridge's IPv6 address, so we can now set the dummy tun down. + */ + if (tapfd >= 0) { + if (virNetDevSetOnline(macTapIfName, false) < 0) + goto err4; + VIR_FORCE_CLOSE(tapfd); + } + if (virNetDevBandwidthSet(network->def->bridge, network->def->bandwidth) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, _("cannot set bandwidth limits on %s"), @@ -2187,6 +2204,8 @@ networkStartNetworkVirtual(struct network_driver *driver, save_err = virSaveLastError(); if (macTapIfName) { + if (tapfd >= 0) + VIR_FORCE_CLOSE(tapfd); ignore_value(virNetDevTapDelete(macTapIfName)); VIR_FREE(macTapIfName); } diff --git a/src/uml/uml_conf.c b/src/uml/uml_conf.c index a317bcc..765c5c2 100644 --- a/src/uml/uml_conf.c +++ b/src/uml/uml_conf.c @@ -142,7 +142,8 @@ umlConnectTapDevice(virConnectPtr conn, vm->uuid, NULL, virDomainNetGetActualVirtPortProfile(net), virDomainNetGetActualVlan(net), - VIR_NETDEV_TAP_CREATE_IFUP) < 0) { + VIR_NETDEV_TAP_CREATE_IFUP + |VIR_NETDEV_TAP_CREATE_PERSIST) < 0) { if (template_ifname) VIR_FREE(net->ifname); goto error; diff --git a/src/util/virnetdevtap.c b/src/util/virnetdevtap.c index 9f2dca1..0eadd6c 100644 --- a/src/util/virnetdevtap.c +++ b/src/util/virnetdevtap.c @@ -112,18 +112,20 @@ virNetDevProbeVnetHdr(int tapfd) * * VIR_NETDEV_TAP_CREATE_VNET_HDR * - Enable IFF_VNET_HDR on the tap device + * VIR_NETDEV_TAP_CREATE_PERSIST + * - The device will persist after the file descriptor is closed * * Creates a tap interface. - * If the @tapfd parameter is supplied, the open tap device file - * descriptor will be returned, otherwise the TAP device will be made - * persistent and closed. The caller must use virNetDevTapDelete to - * remove a persistent TAP devices when it is no longer needed. + * If the @tapfd parameter is supplied, the open tap device file descriptor + * will be returned, otherwise the TAP device will be closed. The caller must + * use virNetDevTapDelete to remove a persistent TAP device when it is no + * longer needed. * * Returns 0 in case of success or -1 on failure. */ int virNetDevTapCreate(char **ifname, int *tapfd, - unsigned int flags ATTRIBUTE_UNUSED) + unsigned int flags) { int fd; struct ifreq ifr; @@ -160,7 +162,7 @@ int virNetDevTapCreate(char **ifname, goto cleanup; } - if (!tapfd && + if ((flags & VIR_NETDEV_TAP_CREATE_PERSIST) && (errno = ioctl(fd, TUNSETPERSIST, 1))) { virReportSystemError(errno, _("Unable to set tap device %s to persistent"), @@ -261,14 +263,16 @@ int virNetDevTapDelete(const char *ifname ATTRIBUTE_UNUSED) * - Enable IFF_VNET_HDR on the tap device * VIR_NETDEV_TAP_CREATE_USE_MAC_FOR_BRIDGE * - Set this interface's MAC as the bridge's MAC address + * VIR_NETDEV_TAP_CREATE_PERSIST + * - The device will persist after the file descriptor is closed * * This function creates a new tap device on a bridge. @ifname can be either * a fixed name or a name template with '%d' for dynamic name allocation. * in either case the final name for the bridge will be stored in @ifname. - * If the @tapfd parameter is supplied, the open tap device file - * descriptor will be returned, otherwise the TAP device will be made - * persistent and closed. The caller must use virNetDevTapDelete to remove - * a persistent TAP devices when it is no longer needed. + * If the @tapfd parameter is supplied, the open tap device file descriptor + * will be returned, otherwise the TAP device will be closed. The caller must + * use virNetDevTapDelete to remove a persistent TAP device when it is no + * longer needed. * * Returns 0 in case of success or -1 on failure */ diff --git a/src/util/virnetdevtap.h b/src/util/virnetdevtap.h index fa6a647..980db61 100644 --- a/src/util/virnetdevtap.h +++ b/src/util/virnetdevtap.h @@ -43,6 +43,8 @@ typedef enum { VIR_NETDEV_TAP_CREATE_VNET_HDR = 1 << 1, /* Set this interface's MAC as the bridge's MAC address */ VIR_NETDEV_TAP_CREATE_USE_MAC_FOR_BRIDGE = 1 << 2, + /* The device will persist after the file descriptor is closed */ + VIR_NETDEV_TAP_CREATE_PERSIST = 1 << 3, } virNetDevTapCreateFlags; int virNetDevTapCreateInBridgePort(const char *brname, -- Benjamin Cama <benjamin.cama(a)telecom-bretagne.eu>

2 2

[libvirt] [PATCH] Move most of qemuProcessKill into virProcessKillPainfully
by Daniel P. Berrange 28 Sep '12

28 Sep '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> In the cgroups APIs we have a virCgroupKillPainfully function which does the loop sending SIGTERM, then SIGKILL and waiting for the process to exit. There is similar functionality for simple processes in qemuProcessKill, but it is tangled with the QEMU code. Untangle it to provide a virProcessKillPainfuly function --- src/libvirt_private.syms | 1 + src/qemu/qemu_driver.c | 8 ++--- src/qemu/qemu_process.c | 79 ++++++++---------------------------------------- src/util/virprocess.c | 57 ++++++++++++++++++++++++++++++++++ src/util/virprocess.h | 2 ++ 5 files changed, 76 insertions(+), 71 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 4635a4d..dab607a 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1708,6 +1708,7 @@ virPidFileDeletePath; # virprocess.h virProcessAbort; virProcessKill; +virProcessKillPainfully; virProcessTranslateStatus; virProcessWait; diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 7ac53ac..22fef7a 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -2006,13 +2006,11 @@ qemuDomainDestroyFlags(virDomainPtr dom, * it now means the job will be released */ if (flags & VIR_DOMAIN_DESTROY_GRACEFUL) { - if (qemuProcessKill(driver, vm, 0) < 0) { - virReportError(VIR_ERR_OPERATION_FAILED, "%s", - _("failed to kill qemu process with SIGTERM")); + if (qemuProcessKill(driver, vm, 0) < 0) goto cleanup; - } } else { - ignore_value(qemuProcessKill(driver, vm, VIR_QEMU_PROCESS_KILL_FORCE)); + if (qemuProcessKill(driver, vm, VIR_QEMU_PROCESS_KILL_FORCE) < 0) + goto cleanup; } /* We need to prevent monitor EOF callback from doing our work (and sending diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 3cd30af..70b72af 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -3877,9 +3877,7 @@ int qemuProcessKill(struct qemud_driver *driver, virDomainObjPtr vm, unsigned int flags) { - int i, ret = -1; - const char *signame = "TERM"; - bool driver_unlocked = false; + int ret; VIR_DEBUG("vm=%s pid=%d flags=%x", vm->def->name, vm->pid, flags); @@ -3891,78 +3889,27 @@ qemuProcessKill(struct qemud_driver *driver, } } - /* This loop sends SIGTERM (or SIGKILL if flags has - * VIR_QEMU_PROCESS_KILL_FORCE and VIR_QEMU_PROCESS_KILL_NOWAIT), - * then waits a few iterations (10 seconds) to see if it dies. If - * the qemu process still hasn't exited, and - * VIR_QEMU_PROCESS_KILL_FORCE is requested, a SIGKILL will then - * be sent, and qemuProcessKill will wait up to 5 seconds more for - * the process to exit before returning. Note that the FORCE mode - * could result in lost data in the guest, so it should only be - * used if the guest is hung and can't be destroyed in any other - * manner. - */ - for (i = 0 ; i < 75; i++) { - int signum; - if (i == 0) { - if ((flags & VIR_QEMU_PROCESS_KILL_FORCE) && - (flags & VIR_QEMU_PROCESS_KILL_NOWAIT)) { - signum = SIGKILL; /* kill it immediately */ - signame="KILL"; - } else { - signum = SIGTERM; /* kindly suggest it should exit */ - } - } else if ((i == 50) & (flags & VIR_QEMU_PROCESS_KILL_FORCE)) { - VIR_WARN("Timed out waiting after SIG%s to process %d, " - "sending SIGKILL", signame, vm->pid); - signum = SIGKILL; /* kill it after a grace period */ - signame="KILL"; - } else { - signum = 0; /* Just check for existence */ - } - - if (virProcessKill(vm->pid, signum) < 0) { - if (errno != ESRCH) { - char ebuf[1024]; - VIR_WARN("Failed to terminate process %d with SIG%s: %s", - vm->pid, signame, - virStrerror(errno, ebuf, sizeof(ebuf))); - goto cleanup; - } - ret = 0; - goto cleanup; /* process is dead */ - } + if ((flags & VIR_QEMU_PROCESS_KILL_NOWAIT)) { + virProcessKill(vm->pid, + (flags & VIR_QEMU_PROCESS_KILL_FORCE) ? + SIGKILL : SIGTERM); + return 0; + } - if (i == 0 && (flags & VIR_QEMU_PROCESS_KILL_NOWAIT)) { - ret = 0; - goto cleanup; - } + if (driver) + qemuDriverUnlock(driver); - if (driver && !driver_unlocked) { - /* THREADS.txt says we can't hold the driver lock while sleeping */ - qemuDriverUnlock(driver); - driver_unlocked = true; - } + ret = virProcessKillPainfully(vm->pid, + !!(flags & VIR_QEMU_PROCESS_KILL_FORCE)); - usleep(200 * 1000); - } - VIR_WARN("Timed out waiting after SIG%s to process %d", signame, vm->pid); -cleanup: - if (driver_unlocked) { - /* We had unlocked the driver, so re-lock it. THREADS.txt says - * we can't have the domain locked when locking the driver, so - * we must first unlock the domain. BUT, before we can unlock - * the domain, we need to add a ref to it in case there aren't - * any active jobs (analysis of all callers didn't reveal such - * a case, but there are too many to maintain certainty, so we - * will do this as a precaution). - */ + if (driver) { virObjectRef(vm); virDomainObjUnlock(vm); qemuDriverLock(driver); virDomainObjLock(vm); virObjectUnref(vm); } + return ret; } diff --git a/src/util/virprocess.c b/src/util/virprocess.c index 958f5f7..c70aa58 100644 --- a/src/util/virprocess.c +++ b/src/util/virprocess.c @@ -235,3 +235,60 @@ int virProcessKill(pid_t pid, int sig) return kill(pid, sig); #endif } + + +/* + * Try to kill the process and verify it has exited + * + * Returns 0 if it was killed gracefully, 1 if it + * was killed forcably, -1 if it is still alive, + * or another error occurred. + */ +int +virProcessKillPainfully(pid_t pid, bool force) +{ + int i, ret = -1; + const char *signame = "TERM"; + + VIR_DEBUG("vpid=%d force=%d", pid, force); + + /* This loop sends SIGTERM, then waits a few iterations (10 seconds) + * to see if it dies. If the process still hasn't exited, and + * @force is requested, a SIGKILL will be sent, and this will + * wait upto 5 seconds more for the process to exit before + * returning. + * + * Note that setting @force could result in dataloss for the process. + */ + for (i = 0 ; i < 75; i++) { + int signum; + if (i == 0) { + signum = SIGTERM; /* kindly suggest it should exit */ + } else if ((i == 50) & force) { + VIR_DEBUG("Timed out waiting after SIGTERM to process %d, " + "sending SIGKILL", pid); + signum = SIGKILL; /* kill it after a grace period */ + signame = "KILL"; + } else { + signum = 0; /* Just check for existence */ + } + + if (virProcessKill(pid, signum) < 0) { + if (errno != ESRCH) { + virReportSystemError(errno, + _("Failed to terminate process %d with SIG%s"), + pid, signame); + goto cleanup; + } + ret = signum == SIGTERM ? 0 : 1; + goto cleanup; /* process is dead */ + } + + usleep(200 * 1000); + } + + VIR_DEBUG("Timed out waiting after SIGKILL to process %d", pid); + +cleanup: + return ret; +} diff --git a/src/util/virprocess.h b/src/util/virprocess.h index 048a73c..d537d92 100644 --- a/src/util/virprocess.h +++ b/src/util/virprocess.h @@ -38,5 +38,7 @@ virProcessWait(pid_t pid, int *exitstatus) int virProcessKill(pid_t pid, int sig); +int virProcessKillPainfully(pid_t pid, bool force); + #endif /* __VIR_PROCESS_H__ */ -- 1.7.11.2

3 5

[libvirt] [PATCH 0/3] non-shared migration without target disk images
by liguang 27 Sep '12

27 Sep '12

by now, if you want a non-shared migration, you have to create same files at target as source side, which seems intorlerable! this issue was reported by Reinier Schoof http://www.redhat.com/archives/libvir-list/2011-December/msg00451.html These patches try to let migrate --copy-storage-* work without pre-exist disk image files at target side. we may also hope qemu to aware of this issue hooks/qemu | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ src/Makefile.am | 3 ++ src/util/hooks.c | 2 +- 3 files changed, 59 insertions(+), 1 deletions(-)

1 3

Re: [libvirt] Coverity automatic detection
by Alex Jia 27 Sep '12

27 Sep '12

The Coverity results were too big for the list filters; So compress and reattach them as an attachment. -- Regards, Alex ----- Original Message ----- From: "Alex Jia" <ajia(a)redhat.com> To: "libvir" <libvir-list(a)redhat.com> Cc: "Alex Jia" <ajia(a)redhat.com> Sent: Thursday, September 27, 2012 2:02:38 PM Subject: [libvirt] Coverity automatic detection This email is automatically generated. The test result is based on the following git commit: 371ddc9 Support Xen sysctl version 9 in Xen 4.2 Analysis summary report: ------------------------ Files analyzed : 340 Total LoC input to cov-analyze : 392401 Functions analyzed : 9785 Paths analyzed : 1186824 Time taken by Coverity analysis : 00:24:37 Defect occurrences found : 296 Total 5 ATOMICITY 53 BAD_SIZEOF 14 CHECKED_RETURN 1 CONSTANT_EXPRESSION_RESULT 6 DEADCODE 14 FORWARD_NULL 2 LOCK 7 NEGATIVE_RETURNS 1 NO_EFFECT 5 NULL_RETURNS 2 OVERRUN_STATIC 121 RESOURCE_LEAK 1 RETURN_LOCAL 16 REVERSE_INULL 3 SECURE_TEMP 2 SIZEOF_MISMATCH 1 STRING_NULL 1 STRING_OVERFLOW 4 TAINTED_SCALAR 2 TAINTED_STRING 21 TOCTOU 8 UNINIT 1 UNREACHABLE 5 UNUSED_VALUE Exceeded path limit of 5000 paths in 0.58% of functions (normally up to 5% of functions encounter this limitation) For details, please see attachment. Regards, Alex

1 0

[libvirt] [PATCH] ARMHF: Fixed Parser for /proc/cpuinfo needs to be adapted for your architecture
by Chuck Short 27 Sep '12

27 Sep '12

Minimal CPU "parser" for armhf to avoid compile time warning. Signed-off-by: Chuck Short <chuck.short(a)canonical.com> --- src/nodeinfo.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/src/nodeinfo.c b/src/nodeinfo.c index 84a5d66..358fa3b 100644 --- a/src/nodeinfo.c +++ b/src/nodeinfo.c @@ -397,6 +397,27 @@ int linuxNodeInfoCPUPopulate(FILE *cpuinfo, * and parsed in next iteration, because it is not in expected * format and thus lead to error. */ } +# elif defined(__arm__) + char *buf = line; + if (STRPREFIX(buf, "BogoMIPS")) { + char *p; + unsigned int ui; + + buf += 8; + while (*buf && c_isspace(*buf)) + buf++; + + if (*buf != ':' || !buf[1]) { + nodeReportError(VIR_ERR_INTERNAL_ERROR, + "%s", _("parsing cpu MHz from cpuinfo")); + goto cleanup; + } + + if (virStrToLong_ui(buf+1, &p, 10, &ui) == 0 + /* Accept trailing fractional part. */ + && (*p == '\0' || *p == '.' || c_isspace(*p))) + nodeinfo->mhz = ui; + } # elif defined(__s390__) || \ defined(__s390x__) /* s390x has no realistic value for CPU speed, -- 1.7.10.4

2 1

[libvirt] [java PATCH] maint: correct name for license file
by Eric Blake 27 Sep '12

27 Sep '12

* LICENCE: Move to LICENSE. * libvirt-java.spec.in: Reflect the rename. --- Pushing under the trivial rule. LICENCE => LICENSE | 0 libvirt-java.spec.in | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename LICENCE => LICENSE (100%) diff --git a/LICENCE b/LICENSE similarity index 100% rename from LICENCE rename to LICENSE diff --git a/libvirt-java.spec.in b/libvirt-java.spec.in index 4fd74fc..13044c0 100644 --- a/libvirt-java.spec.in +++ b/libvirt-java.spec.in @@ -72,7 +72,7 @@ rm -rf %{buildroot} %files %defattr(-,root,root) -%doc AUTHORS LICENCE NEWS README INSTALL +%doc AUTHORS LICENSE NEWS README INSTALL %{_javadir}/*.jar %files devel -- 1.7.11.4

1 0

[libvirt] [PATCH] Fix compilation of legacy xen driver with Xen 4.2
by Jim Fehlig 27 Sep '12

27 Sep '12

In Xen 4.2, xs.h is deprecated in favor of xenstore.h. xs.h now contains #warning xs.h is deprecated use xenstore.h instead #include <xenstore.h> which fails compilation when warnings are treated as errors. Introduce a configure-time check for xenstore.h and if found, use it instead of xs.h. --- configure.ac | 2 ++ src/xen/block_stats.c | 6 +++++- src/xen/xs_internal.c | 6 +++++- 3 files changed, 12 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index 38d94d4..ae26de7 100644 --- a/configure.ac +++ b/configure.ac @@ -768,6 +768,8 @@ if test "$with_xen" != "no" ; then fi if test "$with_xen" != "no" ; then + dnl In Xen 4.2, xs.h is deprecated in favor of xenstore.h. + AC_CHECK_HEADERS([xenstore.h]) AC_CHECK_HEADERS([xen/xen.h xen/version.h xen/dom0_ops.h],,[ if test "$with_xen" = "yes"; then fail=1 diff --git a/src/xen/block_stats.c b/src/xen/block_stats.c index f3b756a..5ab1ce4 100644 --- a/src/xen/block_stats.c +++ b/src/xen/block_stats.c @@ -32,7 +32,11 @@ # include <unistd.h> # include <regex.h> -# include <xs.h> +# if HAVE_XENSTORE_H +# include <xenstore.h> +# else +# include <xs.h> +# endif # include "virterror_internal.h" # include "datatypes.h" diff --git a/src/xen/xs_internal.c b/src/xen/xs_internal.c index 12efa0c..a91d409 100644 --- a/src/xen/xs_internal.c +++ b/src/xen/xs_internal.c @@ -35,7 +35,11 @@ #include <xen/dom0_ops.h> #include <xen/version.h> -#include <xs.h> +#if HAVE_XENSTORE_H +# include <xenstore.h> +#else +# include <xs.h> +#endif #include "virterror_internal.h" #include "datatypes.h" -- 1.7.10.4

2 2

[libvirt] [PATCH] Temporarily shutoff CPUSET cgroup in libvirt.
by Tang Chen 27 Sep '12

27 Sep '12

When a cpu or memory is offlined and onlined again, cgroup will not recover any corresponding values. This is a problem in kernel. Do not use CPUSET cgroup to limit threads using cpu and memory until the problem is fixed in kernel. Signed-off-by: Tang Chen <tangchen(a)cn.fujitsu.com> --- src/qemu/qemu.conf | 5 ++++- src/qemu/qemu_conf.c | 7 ++++++- src/util/cgroup.c | 3 +-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index 18105ca..6bf7290 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -211,7 +211,10 @@ # can be mounted in different locations. libvirt will detect # where they are located. # -#cgroup_controllers = [ "cpu", "devices", "memory", "blkio", "cpuset", "cpuacct" ] +# When a cpu or memory is offlined and onlined again, cgroup will not +# recover any corresponding values. This is a problem in kernel. +# So DO NOT use cpuset cgroup until this problem is fixed in kernel. +#cgroup_controllers = [ "cpu", "devices", "memory", "blkio", "cpuacct" ] # This is the basic set of devices allowed / required by # all virtual machines. diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 91a56f1..80b0787 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -397,12 +397,17 @@ int qemudLoadDriverConfig(struct qemud_driver *driver, driver->cgroupControllers |= (1 << ctl); } } else { + /* + * When a cpu or memory is offlined and onlined again, cgroup will not + * recover any corresponding values. This is a problem in kernel. + * Do not use CPUSET cgroup to limit threads using cpu and memory until + * the problem is fixed in kernel. + */ driver->cgroupControllers = (1 << VIR_CGROUP_CONTROLLER_CPU) | (1 << VIR_CGROUP_CONTROLLER_DEVICES) | (1 << VIR_CGROUP_CONTROLLER_MEMORY) | (1 << VIR_CGROUP_CONTROLLER_BLKIO) | - (1 << VIR_CGROUP_CONTROLLER_CPUSET) | (1 << VIR_CGROUP_CONTROLLER_CPUACCT); } for (i = 0 ; i < VIR_CGROUP_CONTROLLER_LAST ; i++) { diff --git a/src/util/cgroup.c b/src/util/cgroup.c index 5dc0764..cd7d3fe 100644 --- a/src/util/cgroup.c +++ b/src/util/cgroup.c @@ -543,8 +543,7 @@ static int virCgroupMakeGroup(virCgroupPtr parent, virCgroupPtr group, /* We need to control cpu bandwidth for each vcpu now */ if ((flags & VIR_CGROUP_VCPU) && (i != VIR_CGROUP_CONTROLLER_CPU && - i != VIR_CGROUP_CONTROLLER_CPUACCT && - i != VIR_CGROUP_CONTROLLER_CPUSET)) { + i != VIR_CGROUP_CONTROLLER_CPUACCT)) { /* treat it as unmounted and we can use virCgroupAddTask */ VIR_FREE(group->controllers[i].mountPoint); continue; -- 1.7.10.1

3 4

[libvirt] [PATCH] Network: LXC generic ethernet interface
by Takayuki Usui 27 Sep '12

27 Sep '12

The patch adds generic ethernet type to LXC, that allows you to make an arbitrary virtual network interface and associate it to an LXC domain. That does not, however, provide a means to execute a script, that is still available only for QEMU. 1. Create a virtual ethernet device pair # ip link add type veth (e.g. veth0 and veth1 by default) 2. Define a LXC domain and associate it to one end of the pair [...] <interface type='ethernet'> <target dev='veth1'/> </interface> 3. Do whatever you like, for example, add another end of the pair to a bridge (e.g. br0) # brctr addif br0 veth0 # ip link set dev veth0 up 4. Start a LXC domain. The interface shows up as eth0 in the domain. Signed-off-by: Takayuki Usui <takayuki(a)midokura.jp> --- src/lxc/lxc_process.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 49 insertions(+), 1 deletion(-) diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c index 84128d1..0b86241 100644 --- a/src/lxc/lxc_process.c +++ b/src/lxc/lxc_process.c @@ -419,6 +419,46 @@ cleanup: } +static int lxcSetupInterfaceEthernet(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainDefPtr def ATTRIBUTE_UNUSED, + virDomainNetDefPtr net, + unsigned int *nveths, + char ***veths) +{ + int ret = -1; + char *containerVeth = NULL; + + if (net->ifname == 0 || strlen(net->ifname) == 0) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Ethernet target device is required")); + goto cleanup; + } + + if (VIR_ALLOC_N(containerVeth, strlen(net->ifname) + 1) < 0) { + virReportOOMError(); + goto cleanup; + } + if (VIR_REALLOC_N(*veths, (*nveths)+1) < 0) { + virReportOOMError(); + VIR_FREE(containerVeth); + goto cleanup; + } + if (virStrcpy(containerVeth, net->ifname, + strlen(net->ifname) + 1) == NULL) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Ethernet target device name is too long")); + VIR_FREE(containerVeth); + goto cleanup; + } + (*veths)[(*nveths)] = containerVeth; + (*nveths)++; + + ret = 0; + +cleanup: + return ret; +} + /** * virLXCProcessSetupInterfaces: * @conn: pointer to connection @@ -522,8 +562,16 @@ static int virLXCProcessSetupInterfaces(virConnectPtr conn, goto cleanup; break; - case VIR_DOMAIN_NET_TYPE_USER: case VIR_DOMAIN_NET_TYPE_ETHERNET: + if (lxcSetupInterfaceEthernet(conn, + def, + def->nets[i], + nveths, + veths) < 0) + goto cleanup; + break; + + case VIR_DOMAIN_NET_TYPE_USER: case VIR_DOMAIN_NET_TYPE_SERVER: case VIR_DOMAIN_NET_TYPE_CLIENT: case VIR_DOMAIN_NET_TYPE_MCAST: -- 1.7.9.5

2 1

[libvirt] [PATCH] Fix dnsmasq/radvd on bridges not being able to be bound to IPv6 address on "recent" kernels
by Benjamin Cama 27 Sep '12

27 Sep '12

Hi, I hit this problem recently when trying to create a bridge with an IPv6 address on a 3.2 kernel: dnsmasq (and, further, radvd) would not bind to the given address (resp. interface), waiting 20s and then giving up with -EADDRNOTAVAIL (resp. exiting immediately with "error parsing or activating the config file", without libvirt noticing it, BTW). This can be reproduced with (I think) any kernel >= 2.6.39 and the following XML (to be used with "virsh net-create"): <network> <name>test-bridge</name> <bridge name='testbr0' /> <ip family='ipv6' address='fd00::1' prefix='64'> </ip> </network> (it happens even when you have an IPv4, too) The problem is that since commit [1] (which, ironically, was made to “help IPv6 autoconfiguration”) the linux bridge code makes bridges behave like “real” devices regarding carrier detection. This makes the bridges created by libvirt, which are started without any up devices, stay with the NO-CARRIER flag set, and thus prevents DAD (Duplicate address detection) from happening, thus letting the IPv6 address flagged as “tentative”. Such addresses cannot be bound to (see RFC 2462), so dnsmasq fails binding to it (for radvd, it detects that "interface XXX is not RUNNING", thus that "interface XXX does not exist, ignoring the interface" (sic)). It seems that this behavior was enhanced somehow with commit [2] by avoiding setting NO-CARRIER on empty bridges, but I couldn't reproduce this behavior on my kernel. Anyway, with the “dummy tap to set MAC address” trick, this wouldn't work. To fix this, the idea is to get the bridge's attached device to be up so that DAD can happen (deactivating DAD altogether is not a good idea, I think). Currently, libvirt creates a dummy TAP device to set the MAC address of the bridge, keeping it down. But even if we set this device up, it is not RUNNING as soon as the tap file descriptor attached to it is closed, thus still preventing DAD. So, we must modify the API a bit, so that we can get the fd, keep the tap device persistent, run the daemons, and close it after DAD has taken place. After that, the bridge will be flagged NO-CARRIER again, but the daemons will be running, even if not happy about the device's state (but we don't really care about the bridge's daemons doing anything when no up interface is connected to it). Other solutions that I envisioned were: * Keeping the *-nic interface up: this would waste an fd for each bridge during all its life. May be acceptable, I don't really know. * Stop using the dummy tap trick, and set the MAC address directly on the bridge: it is possible since quite some time it seems, even if then there is the problem of the bridge not being RUNNING when empty, contrary to what [2] says, so this will need fixing (and this fix only happened in 3.1, so it wouldn't work for 2.6.39) * Using the --interface option of dnsmasq, but I saw somewhere that it's not used by libvirt for backward compatibility. I am not sure this would solve this problem, though, as I don't know how dnsmasq binds itself to it with this option. This is why this patch does what's described earlier. I see radvd yelling quite often in the logs when the interface is NO-CARRIER, but it's ok, it keeps running. Still, this patch is not exactly correct, as radvd get daemonized “too soon” most of the time (i.e. when not debugging libvirtd…) and probes the bridge once it has been set down (even if started before setting it down), thus failing as before (and libvirt lets it be like that: this would need some more checking, maybe). One /may/ introduce some delay between networkStartRadvd() and setting the dummy tap down to solve it, but it seemed too hackish to me. But I couldn't come with a better solution. I would welcome suggestions here. BTW, I removed the “up” argument from virNetDevTapCreateInBridgePort() and virNetDevTapCreate() as all TAP devices are created up now, and I fixed a function name in the docstring. [1] http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commit;h=1fa… [2] http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commit;h=b64… --- src/network/bridge_driver.c | 15 ++++++++++++++- src/qemu/qemu_command.c | 2 +- src/uml/uml_conf.c | 2 +- src/util/virnetdevtap.c | 29 +++++++++++++++++------------ src/util/virnetdevtap.h | 7 ++++--- 5 files changed, 37 insertions(+), 18 deletions(-) diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index 63338a2..a13efe6 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -62,6 +62,7 @@ #include "virnetdev.h" #include "virnetdevbridge.h" #include "virnetdevtap.h" +#include "virfile.h" #define NETWORK_PID_DIR LOCALSTATEDIR "/run/libvirt/network" #define NETWORK_STATE_DIR LOCALSTATEDIR "/lib/libvirt/network" @@ -1693,6 +1694,7 @@ networkStartNetworkVirtual(struct network_driver *driver, virErrorPtr save_err = NULL; virNetworkIpDefPtr ipdef; char *macTapIfName = NULL; + int tapfd = -1; /* Check to see if any network IP collides with an existing route */ if (networkCheckRouteCollision(network) < 0) @@ -1714,8 +1716,9 @@ networkStartNetworkVirtual(struct network_driver *driver, virReportOOMError(); goto err0; } + /* Keep tun fd open and interface up to allow for IPv6 DAD to happen */ if (virNetDevTapCreateInBridgePort(network->def->bridge, - &macTapIfName, network->def->mac, 0, false, NULL) < 0) { + &macTapIfName, network->def->mac, 0, &tapfd, true) < 0) { VIR_FREE(macTapIfName); goto err0; } @@ -1775,6 +1778,16 @@ networkStartNetworkVirtual(struct network_driver *driver, if (v6present && networkStartRadvd(network) < 0) goto err4; + /* DAD has happened (dnsmasq waits for it), dnsmasq is now bound to the + * bridge's IPv6 address, and radvd to the interface, so we can now set the + * dummy tun down. + */ + if (tapfd >= 0) { + if (virNetDevSetOnline(macTapIfName, false) < 0) + goto err4; + VIR_FORCE_CLOSE(tapfd); + } + if (virNetDevBandwidthSet(network->def->bridge, network->def->bandwidth) < 0) { networkReportError(VIR_ERR_INTERNAL_ERROR, _("cannot set bandwidth limits on %s"), diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 22dc871..08457e7 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -247,7 +247,7 @@ qemuNetworkIfaceConnect(virDomainDefPtr def, memcpy(tapmac, net->mac, VIR_MAC_BUFLEN); tapmac[0] = 0xFE; /* Discourage bridge from using TAP dev MAC */ err = virNetDevTapCreateInBridgePort(brname, &net->ifname, tapmac, - vnet_hdr, true, &tapfd); + vnet_hdr, &tapfd, false); virDomainAuditNetDevice(def, net, "/dev/net/tun", tapfd >= 0); if (err < 0) { if (template_ifname) diff --git a/src/uml/uml_conf.c b/src/uml/uml_conf.c index b878622..bd838a6 100644 --- a/src/uml/uml_conf.c +++ b/src/uml/uml_conf.c @@ -141,7 +141,7 @@ umlConnectTapDevice(virConnectPtr conn, memcpy(tapmac, net->mac, VIR_MAC_BUFLEN); tapmac[0] = 0xFE; /* Discourage bridge from using TAP dev MAC */ if (virNetDevTapCreateInBridgePort(bridge, &net->ifname, tapmac, - 0, true, NULL) < 0) { + 0, NULL, true) < 0) { if (template_ifname) VIR_FREE(net->ifname); goto error; diff --git a/src/util/virnetdevtap.c b/src/util/virnetdevtap.c index 2ed53c6..3e2c2cc 100644 --- a/src/util/virnetdevtap.c +++ b/src/util/virnetdevtap.c @@ -109,18 +109,21 @@ virNetDevProbeVnetHdr(int tapfd) * @ifname: the interface name * @vnet_hr: whether to try enabling IFF_VNET_HDR * @tapfd: file descriptor return value for the new tap device + * @persist: if the device persists after the file descriptor is closed * * Creates a tap interface. * If the @tapfd parameter is supplied, the open tap device file - * descriptor will be returned, otherwise the TAP device will be made - * persistent and closed. The caller must use brDeleteTap to remove - * a persistent TAP devices when it is no longer needed. + * descriptor will be returned, otherwise the TAP device will be closed. The + * TAP device will persist after closing the file descriptor if @persist is + * true. The caller must use virNetDevTapDelete to remove a persistent TAP + * devices when it is no longer needed. * * Returns 0 in case of success or an errno code in case of failure. */ int virNetDevTapCreate(char **ifname, int vnet_hdr ATTRIBUTE_UNUSED, - int *tapfd) + int *tapfd, + bool persist) { int fd; struct ifreq ifr; @@ -156,7 +159,7 @@ int virNetDevTapCreate(char **ifname, goto cleanup; } - if (!tapfd && + if (persist && (errno = ioctl(fd, TUNSETPERSIST, 1))) { virReportSystemError(errno, _("Unable to set tap device %s to persistent"), @@ -249,14 +252,16 @@ int virNetDevTapDelete(const char *ifname ATTRIBUTE_UNUSED) * @macaddr: desired MAC address (VIR_MAC_BUFLEN long) * @vnet_hdr: whether to try enabling IFF_VNET_HDR * @tapfd: file descriptor return value for the new tap device + * @persist: if the device persists after the file descriptor is closed * * This function creates a new tap device on a bridge. @ifname can be either * a fixed name or a name template with '%d' for dynamic name allocation. * in either case the final name for the bridge will be stored in @ifname. * If the @tapfd parameter is supplied, the open tap device file - * descriptor will be returned, otherwise the TAP device will be made - * persistent and closed. The caller must use brDeleteTap to remove - * a persistent TAP devices when it is no longer needed. + * descriptor will be returned, otherwise the TAP device will be closed. The + * TAP device will persist after closing the file descriptor if @persist is + * true. The caller must use virNetDevTapDelete to remove a persistent TAP + * devices when it is no longer needed. * * Returns 0 in case of success or -1 on failure */ @@ -264,10 +269,10 @@ int virNetDevTapCreateInBridgePort(const char *brname, char **ifname, const unsigned char *macaddr, int vnet_hdr, - bool up, - int *tapfd) + int *tapfd, + bool persist) { - if (virNetDevTapCreate(ifname, vnet_hdr, tapfd) < 0) + if (virNetDevTapCreate(ifname, vnet_hdr, tapfd, persist) < 0) return -1; /* We need to set the interface MAC before adding it @@ -289,7 +294,7 @@ int virNetDevTapCreateInBridgePort(const char *brname, if (virNetDevBridgeAddPort(brname, *ifname) < 0) goto error; - if (virNetDevSetOnline(*ifname, up) < 0) + if (virNetDevSetOnline(*ifname, true) < 0) goto error; return 0; diff --git a/src/util/virnetdevtap.h b/src/util/virnetdevtap.h index fb35ac5..6aff641 100644 --- a/src/util/virnetdevtap.h +++ b/src/util/virnetdevtap.h @@ -27,7 +27,8 @@ int virNetDevTapCreate(char **ifname, int vnet_hdr, - int *tapfd) + int *tapfd, + bool persist) ATTRIBUTE_NONNULL(1) ATTRIBUTE_RETURN_CHECK; int virNetDevTapDelete(const char *ifname) @@ -37,8 +38,8 @@ int virNetDevTapCreateInBridgePort(const char *brname, char **ifname, const unsigned char *macaddr, int vnet_hdr, - bool up, - int *tapfd) + int *tapfd, + bool persist) ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3) ATTRIBUTE_RETURN_CHECK; -- Benjamin Cama <benjamin.cama(a)telecom-bretagne.eu>

4 19