October 2010 - Devel - libvirt List Archives

[libvirt] [PATCH] Improve error reporting in test suites
by Daniel P. Berrange 14 Oct '10

14 Oct '10

Before running each test case clear the thread local error indicator. After running each test case, dispatch any error that was reported * tests/testutils.c: Fix error reporting in test suites --- tests/testutils.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/tests/testutils.c b/tests/testutils.c index 8171f10..70e7538 100644 --- a/tests/testutils.c +++ b/tests/testutils.c @@ -124,8 +124,12 @@ virtTestRun(const char *title, int nloops, int (*body)(const void *data), const if (ts) GETTIMEOFDAY(&before); + virResetLastError(); if ((ret = body(data)) != 0) break; + virErrorPtr err = virGetLastError(); + if (err) + virDispatchError(NULL); if (ts) { GETTIMEOFDAY(&after); ts[i] = DIFF_MSEC(&after, &before); -- 1.7.2.3

2 3

[libvirt] [PATCH v3] Added new attribute mount_security to filesystem element
by Harsh Prateek Bora 14 Oct '10

14 Oct '10

This patch introduces new attribute to filesystem element to support customizable security for mount type. Valid mount_security are: passthrough and mapped. Usage: <filesystem type='mount' mount_security='passthrough'> <source dir='/export/to/guest'/> <target dir='mount_tag'/> </filesystem> Here is the detailed explanation on these security models: Security model: mapped ---------------------- Fileserver intercepts and maps all the file object create requests. Files on the fileserver will be created with Fileserver's user credentials and the client-user's credentials are stored in extended attributes. During getattr() server extracts the client-user's credentials from extended attributes and sends to the client. This adds a great deal of security in the cloud environments where the guest's(client) user space is kept completely isolated from host's user space. Security model : passthrough ---------------------------- In this security model, Fileserver passes down all requests to the underlying filesystem. File system objects on the fileserver will be created with client-user's credentials. This is done by setting setuid()/setgid() during creation or chmod/chown after file creation. At the end of create protocol request, files on the fileserver will be owned by cleint-user's uid/gid. This model mimic's current NFSv3 level of security. Note: This patch is based on Daniel's patch to support 9pfs. It shall be applied after applying Daniel's patch to support 9pfs. v3: - QEMU cmdline still uses security_model, changes done by mistake reverted. Signed-off-by: Harsh Prateek Bora <harsh(a)linux.vnet.ibm.com> --- docs/schemas/domain.rng | 6 ++++++ src/conf/domain_conf.c | 29 +++++++++++++++++++++++++++-- src/conf/domain_conf.h | 10 ++++++++++ src/qemu/qemu_conf.c | 9 +++++++-- 4 files changed, 50 insertions(+), 4 deletions(-) diff --git a/docs/schemas/domain.rng b/docs/schemas/domain.rng index ccb8cf3..36eec63 100644 --- a/docs/schemas/domain.rng +++ b/docs/schemas/domain.rng @@ -761,6 +761,12 @@ </choice> <optional> <ref name="address"/> + <attribute name="mount_security"> + <choice> + <value>passthrough</value> + <value>mapped</value> + </choice> + </attribute> </optional> </element> </define> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index e05d5d7..ece6937 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -161,6 +161,11 @@ VIR_ENUM_IMPL(virDomainFS, VIR_DOMAIN_FS_TYPE_LAST, "file", "template") +VIR_ENUM_IMPL(virDomainFSMountSecurity, VIR_DOMAIN_FS_SECURITY_LAST, + "passthrough", + "mapped") + + VIR_ENUM_IMPL(virDomainNet, VIR_DOMAIN_NET_TYPE_LAST, "user", "ethernet", @@ -1847,6 +1852,7 @@ virDomainFSDefParseXML(xmlNodePtr node, char *type = NULL; char *source = NULL; char *target = NULL; + char *mount_security = NULL; if (VIR_ALLOC(def) < 0) { virReportOOMError(); @@ -1864,6 +1870,17 @@ virDomainFSDefParseXML(xmlNodePtr node, def->type = VIR_DOMAIN_FS_TYPE_MOUNT; } + mount_security = virXMLPropString(node, "mount_security"); + if (mount_security) { + if ((def->mount_security = virDomainFSMountSecurityTypeFromString(mount_security)) < 0) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("unknown mount security '%s'"), mount_security); + goto error; + } + } else { + def->mount_security = VIR_DOMAIN_FS_SECURITY_PASSTHROUGH; + } + cur = node->children; while (cur != NULL) { if (cur->type == XML_ELEMENT_NODE) { @@ -5602,6 +5619,7 @@ virDomainFSDefFormat(virBufferPtr buf, int flags) { const char *type = virDomainFSTypeToString(def->type); + const char *mount_sec = virDomainFSMountSecurityTypeToString(def->mount_security); if (!type) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, @@ -5609,9 +5627,16 @@ virDomainFSDefFormat(virBufferPtr buf, return -1; } + if (!mount_sec) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("unexpected mount security %d"), def->mount_security); + return -1; + } + + virBufferVSprintf(buf, - " <filesystem type='%s'>\n", - type); + " <filesystem type='%s' mount_security='%s'>\n", + type, mount_sec); if (def->src) { switch (def->type) { diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 7195c04..3463942 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -236,10 +236,19 @@ enum virDomainFSType { VIR_DOMAIN_FS_TYPE_LAST }; +/* Filesystem mount security model */ +enum virDomainFSMountSecurity { + VIR_DOMAIN_FS_SECURITY_PASSTHROUGH, + VIR_DOMAIN_FS_SECURITY_MAPPED, + + VIR_DOMAIN_FS_SECURITY_LAST +}; + typedef struct _virDomainFSDef virDomainFSDef; typedef virDomainFSDef *virDomainFSDefPtr; struct _virDomainFSDef { int type; + int mount_security; char *src; char *dst; unsigned int readonly : 1; @@ -1167,6 +1176,7 @@ VIR_ENUM_DECL(virDomainDiskErrorPolicy) VIR_ENUM_DECL(virDomainController) VIR_ENUM_DECL(virDomainControllerModel) VIR_ENUM_DECL(virDomainFS) +VIR_ENUM_DECL(virDomainFSMountSecurity) VIR_ENUM_DECL(virDomainNet) VIR_ENUM_DECL(virDomainChrDevice) VIR_ENUM_DECL(virDomainChrChannelTarget) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 18a302a..53ebe5a 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -2014,6 +2014,7 @@ qemuAssignDeviceAliases(virDomainDefPtr def, unsigned long long qemuCmdFlags) if (virAsprintf(&def->fss[i]->info.alias, "fs%d", i) < 0) goto no_memory; } + for (i = 0; i < def->nsounds ; i++) { if (virAsprintf(&def->sounds[i]->info.alias, "sound%d", i) < 0) goto no_memory; @@ -2783,11 +2784,15 @@ char *qemuBuildFSStr(virDomainFSDefPtr fs, if (fs->type != VIR_DOMAIN_FS_TYPE_MOUNT) { qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("can only passthrough directories")); + _("only supports mount filesystem type")); goto error; } - virBufferAddLit(&opt, "local,security_model=passthrough"); + virBufferAddLit(&opt, "local"); + if (fs->mount_security == VIR_DOMAIN_FS_SECURITY_PASSTHROUGH) + virBufferAddLit(&opt, ",security_model=passthrough"); + else if (fs->mount_security == VIR_DOMAIN_FS_SECURITY_MAPPED) + virBufferAddLit(&opt, ",security_model=mapped"); virBufferVSprintf(&opt, ",id=%s%s", QEMU_FSDEV_HOST_PREFIX, fs->info.alias); virBufferVSprintf(&opt, ",path=%s", fs->src); -- 1.7.1.1

5 5

[libvirt] [PATCH] cpu: Fix vendor for recent CPU models
by Jiri Denemark 14 Oct '10

14 Oct '10

Recent CPU models were specified using invalid vendor element <vendor>NAME</vendor>, which was silently ignored due to a bug in the code which was parsing it. --- src/cpu/cpu_map.xml | 12 ++++++------ src/cpu/cpu_x86.c | 11 +++++++++-- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/src/cpu/cpu_map.xml b/src/cpu/cpu_map.xml index edbb21c..75c6522 100644 --- a/src/cpu/cpu_map.xml +++ b/src/cpu/cpu_map.xml @@ -355,7 +355,7 @@ </model> <model name='Conroe'> - <vendor>Intel</vendor> + <vendor name='Intel'/> <feature name='sse2'/> <feature name='sse'/> <feature name='fxsr'/> @@ -386,7 +386,7 @@ </model> <model name='Penryn'> - <vendor>Intel</vendor> + <vendor name='Intel'/> <feature name='sse2'/> <feature name='sse'/> <feature name='fxsr'/> @@ -419,7 +419,7 @@ </model> <model name='Nehalem'> - <vendor>Intel</vendor> + <vendor name='Intel'/> <feature name='sse2'/> <feature name='sse'/> <feature name='fxsr'/> @@ -454,7 +454,7 @@ </model> <model name='Opteron_G1'> - <vendor>AMD</vendor> + <vendor name='AMD'/> <feature name='sse2'/> <feature name='sse'/> <feature name='fxsr'/> @@ -483,7 +483,7 @@ </model> <model name='Opteron_G2'> - <vendor>AMD</vendor> + <vendor name='AMD'/> <feature name='sse2'/> <feature name='sse'/> <feature name='fxsr'/> @@ -516,7 +516,7 @@ </model> <model name='Opteron_G3'> - <vendor>AMD</vendor> + <vendor name='AMD'/> <feature name='sse2'/> <feature name='sse'/> <feature name='fxsr'/> diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c index 1937901..26a5c3f 100644 --- a/src/cpu/cpu_x86.c +++ b/src/cpu/cpu_x86.c @@ -1015,8 +1015,15 @@ x86ModelLoad(xmlXPathContextPtr ctxt, sizeof(*model->cpuid) * model->ncpuid); } - vendor = virXPathString("string(./vendor/@name)", ctxt); - if (vendor) { + if (virXPathBoolean("boolean(./vendor)", ctxt)) { + vendor = virXPathString("string(./vendor/@name)", ctxt); + if (!vendor) { + virCPUReportError(VIR_ERR_INTERNAL_ERROR, + _("Invalid vendor element in CPU model %s"), + model->name); + goto ignore; + } + if (!(model->vendor = x86VendorFind(map, vendor))) { virCPUReportError(VIR_ERR_INTERNAL_ERROR, _("Unknown vendor %s referenced by CPU model %s"), -- 1.7.3.1

2 2

[libvirt] [PATCH] cpu: Use vendor in baseline CPU only if all hosts use it
by Jiri Denemark 14 Oct '10

14 Oct '10

When only some host CPUs given to cpuBaseline contain <vendor> element, baseline CPU should not contain it. Otherwise the result would not be compatible with the host CPUs without vendor. CPU vendors are still taken into account when computing baseline CPU, it's just removed from the result. --- src/cpu/cpu_x86.c | 16 ++++++++++++---- 1 files changed, 12 insertions(+), 4 deletions(-) diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c index 26a5c3f..c6ab871 100644 --- a/src/cpu/cpu_x86.c +++ b/src/cpu/cpu_x86.c @@ -1621,6 +1621,7 @@ x86Baseline(virCPUDefPtr *cpus, unsigned int i; const struct x86_vendor *vendor = NULL; struct x86_model *model = NULL; + bool outputVendor = true; if (!(map = x86LoadMap())) goto error; @@ -1634,8 +1635,9 @@ x86Baseline(virCPUDefPtr *cpus, cpu->type = VIR_CPU_TYPE_GUEST; cpu->match = VIR_CPU_MATCH_EXACT; - if (cpus[0]->vendor && - !(vendor = x86VendorFind(map, cpus[0]->vendor))) { + if (!cpus[0]->vendor) + outputVendor = false; + else if (!(vendor = x86VendorFind(map, cpus[0]->vendor))) { virCPUReportError(VIR_ERR_OPERATION_FAILED, _("Unknown CPU vendor %s"), cpus[0]->vendor); goto error; @@ -1657,8 +1659,11 @@ x86Baseline(virCPUDefPtr *cpus, if (cpus[i]->vendor) vn = cpus[i]->vendor; - else if (model->vendor) - vn = model->vendor->name; + else { + outputVendor = false; + if (model->vendor) + vn = model->vendor->name; + } if (vn) { if (!vendor) { @@ -1694,6 +1699,9 @@ x86Baseline(virCPUDefPtr *cpus, if (x86Decode(cpu, data, models, nmodels, NULL) < 0) goto error; + if (!outputVendor) + VIR_FREE(cpu->vendor); + VIR_FREE(cpu->arch); cleanup: -- 1.7.3.1

2 2

[libvirt] [PATCH 0/2] tests: Make debuging 'make check' failures easier
by Jiri Denemark 14 Oct '10

14 Oct '10

Jiri Denemark (2): tests: Do not override LIBVIRT_DEBUG variable tests: Honor LIBVIRT_{DEBUG,LOG_*} variables tests/Makefile.am | 1 - tests/testutils.c | 1 + 2 files changed, 1 insertions(+), 1 deletions(-) -- 1.7.3.1

2 4

[libvirt] [PATCH] test: silence nwfilter test
by Stefan Berger 14 Oct '10

14 Oct '10

This patch silences the nwfilter test case. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- tests/nwfilterxml2xmltest.c | 120 +++++++++++++++++++++++++++----------------- 1 file changed, 75 insertions(+), 45 deletions(-) Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -4,6 +4,7 @@ #include <stdlib.h> #include <unistd.h> #include <string.h> +#include <stdbool.h> #include <sys/types.h> #include <fcntl.h> @@ -22,7 +23,9 @@ static char *abs_srcdir; #define MAX_FILE 4096 -static int testCompareXMLToXMLFiles(const char *inxml, const char *outxml) { +static int testCompareXMLToXMLFiles(const char *inxml, + const char *outxml, + bool expect_warning) { char inXmlData[MAX_FILE]; char *inXmlPtr = &(inXmlData[0]); char outXmlData[MAX_FILE]; @@ -30,6 +33,7 @@ static int testCompareXMLToXMLFiles(cons char *actual = NULL; int ret = -1; virNWFilterDefPtr dev = NULL; + char *log; if (virtTestLoadFile(inxml, &inXmlPtr, MAX_FILE) < 0) goto fail; @@ -39,6 +43,20 @@ static int testCompareXMLToXMLFiles(cons if (!(dev = virNWFilterDefParseString(NULL, inXmlData))) goto fail; + if ((log = virtTestLogContentAndReset()) == NULL) + goto fail; + + if ((*log != '\0') != expect_warning) { + free(log); + goto fail; + } + free(log); + + if (expect_warning) { + /* need to suppress the errors */ + virResetLastError(); + } + if (!(actual = virNWFilterDefFormat(dev))) goto fail; @@ -55,14 +73,20 @@ static int testCompareXMLToXMLFiles(cons return ret; } +typedef struct test_parms { + const char *name; + bool expect_warning; +} test_parms; + static int testCompareXMLToXMLHelper(const void *data) { + const test_parms *tp = data; char inxml[PATH_MAX]; char outxml[PATH_MAX]; snprintf(inxml, PATH_MAX, "%s/nwfilterxml2xmlin/%s.xml", - abs_srcdir, (const char*)data); + abs_srcdir, tp->name); snprintf(outxml, PATH_MAX, "%s/nwfilterxml2xmlout/%s.xml", - abs_srcdir, (const char*)data); - return testCompareXMLToXMLFiles(inxml, outxml); + abs_srcdir, tp->name); + return testCompareXMLToXMLFiles(inxml, outxml, !!tp->expect_warning); } @@ -83,51 +107,57 @@ mymain(int argc, char **argv) if (!abs_srcdir) abs_srcdir = getcwd(cwd, sizeof(cwd)); -#define DO_TEST(name) \ - if (virtTestRun("NWFilter XML-2-XML " name, \ - 1, testCompareXMLToXMLHelper, (name)) < 0) \ - ret = -1 - - DO_TEST("mac-test"); - DO_TEST("arp-test"); - DO_TEST("rarp-test"); - DO_TEST("ip-test"); - DO_TEST("ipv6-test"); - - DO_TEST("tcp-test"); - DO_TEST("udp-test"); - DO_TEST("icmp-test"); - DO_TEST("igmp-test"); - DO_TEST("sctp-test"); - DO_TEST("udplite-test"); - DO_TEST("esp-test"); - DO_TEST("ah-test"); - DO_TEST("all-test"); - - DO_TEST("tcp-ipv6-test"); - DO_TEST("udp-ipv6-test"); - DO_TEST("icmpv6-test"); - DO_TEST("sctp-ipv6-test"); - DO_TEST("udplite-ipv6-test"); - DO_TEST("esp-ipv6-test"); - DO_TEST("ah-ipv6-test"); - DO_TEST("all-ipv6-test"); - - DO_TEST("ref-test"); - DO_TEST("ref-rule-test"); - DO_TEST("ipt-no-macspoof-test"); - DO_TEST("icmp-direction-test"); - DO_TEST("icmp-direction2-test"); - DO_TEST("icmp-direction3-test"); +#define DO_TEST(NAME, EXPECT_WARN) \ + do { \ + test_parms tp = { \ + .name = NAME, \ + .expect_warning = EXPECT_WARN, \ + }; \ + if (virtTestRun("NWFilter XML-2-XML " NAME, \ + 1, testCompareXMLToXMLHelper, (&tp)) < 0) \ + ret = -1; \ + } while (0) + + DO_TEST("mac-test", true); + DO_TEST("arp-test", true); + DO_TEST("rarp-test", true); + DO_TEST("ip-test", true); + DO_TEST("ipv6-test", true); + + DO_TEST("tcp-test", true); + DO_TEST("udp-test", true); + DO_TEST("icmp-test", true); + DO_TEST("igmp-test", false); + DO_TEST("sctp-test", true); + DO_TEST("udplite-test", false); + DO_TEST("esp-test", false); + DO_TEST("ah-test", false); + DO_TEST("all-test", false); + + DO_TEST("tcp-ipv6-test", true); + DO_TEST("udp-ipv6-test", true); + DO_TEST("icmpv6-test", true); + DO_TEST("sctp-ipv6-test", true); + DO_TEST("udplite-ipv6-test", true); + DO_TEST("esp-ipv6-test", true); + DO_TEST("ah-ipv6-test", true); + DO_TEST("all-ipv6-test", true); + + DO_TEST("ref-test", false); + DO_TEST("ref-rule-test", false); + DO_TEST("ipt-no-macspoof-test", false); + DO_TEST("icmp-direction-test", false); + DO_TEST("icmp-direction2-test", false); + DO_TEST("icmp-direction3-test", false); - DO_TEST("conntrack-test"); + DO_TEST("conntrack-test", false); - DO_TEST("hex-data-test"); + DO_TEST("hex-data-test", true); - DO_TEST("comment-test"); + DO_TEST("comment-test", true); - DO_TEST("example-1"); - DO_TEST("example-2"); + DO_TEST("example-1", false); + DO_TEST("example-2", false); return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); }

2 2

[libvirt] [PATCH] nwfilter: cut off connections after changing filters
by Stefan Berger 14 Oct '10

14 Oct '10

The following filter transition from a filter allowing incoming TCP connections <rule action='accept' direction='in' priority='401'> <tcp/> </rule> <rule action='accept' direction='out' priority='500'> <tcp/> </rule> to one that does not allow them <rule action='drop' direction='in' priority='401'> <tcp/> </rule> <rule action='accept' direction='out' priority='500'> <tcp/> </rule> did previously not cut off existing (ssh) connections but only prevented newly initiated ones. The attached patch allows to cut off existing connections as well, thus enforcing what the filter is showing. I had only tested with a configuration where the physical interface is connected to the bridge where the filters are applied. This patch now also solves a filtering problem where the physical interface is not connected to the bridge, but the bridge is given an IP address and the host routes between bridge and physical interface. Here the filters drop non-allowed traffic on the outgoing side on the host. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -1100,6 +1100,19 @@ err_exit: return 1; } + +static void +iptablesEnforceDirection(int directionIn, + virNWFilterRuleDefPtr rule, + virBufferPtr buf) +{ + if (rule->tt != VIR_NWFILTER_RULE_DIRECTION_INOUT) + virBufferVSprintf(buf, " -m conntrack --ctdir %s", + (directionIn) ? "Original" + : "Reply"); +} + + /* * _iptablesCreateRuleInstance: * @chainPrefix : The prefix to put in front of the name of the chain @@ -1494,6 +1507,10 @@ _iptablesCreateRuleInstance(int directio if (match && !skipMatch) virBufferVSprintf(&buf, " %s", match); + if (defMatch && match != NULL) + iptablesEnforceDirection(directionIn, + rule, + &buf); virBufferVSprintf(&buf, " -j %s" CMD_DEF_POST CMD_SEPARATOR

2 1

[libvirt] [PATCH] Fix Xen SEXPR generation to properly quote strings containing ()
by Daniel P. Berrange 13 Oct '10

13 Oct '10

* src/xen/sexpr.c: Ensure () are escaped in sexpr2string * tests/sexpr2xmldata/sexpr2xml-boot-grub.sexpr, tests/sexpr2xmldata/sexpr2xml-boot-grub.xml, tests/xml2sexprdata/xml2sexpr-boot-grub.sexpr, tests/xml2sexprdata/xml2sexpr-boot-grub.xml: Data files to check escaping * tests/sexpr2xmltest.c, tests/xml2sexprtest.c: Add boot-grub escaping test case --- src/xen/sexpr.c | 4 ++- tests/sexpr2xmldata/sexpr2xml-boot-grub.sexpr | 1 + tests/sexpr2xmldata/sexpr2xml-boot-grub.xml | 26 +++++++++++++++++++++++++ tests/sexpr2xmltest.c | 2 + tests/xml2sexprdata/xml2sexpr-boot-grub.sexpr | 1 + tests/xml2sexprdata/xml2sexpr-boot-grub.xml | 21 ++++++++++++++++++++ tests/xml2sexprtest.c | 2 + 7 files changed, 56 insertions(+), 1 deletions(-) create mode 100644 tests/sexpr2xmldata/sexpr2xml-boot-grub.sexpr create mode 100644 tests/sexpr2xmldata/sexpr2xml-boot-grub.xml create mode 100644 tests/xml2sexprdata/xml2sexpr-boot-grub.sexpr create mode 100644 tests/xml2sexprdata/xml2sexpr-boot-grub.xml diff --git a/src/xen/sexpr.c b/src/xen/sexpr.c index 2184060..330280e 100644 --- a/src/xen/sexpr.c +++ b/src/xen/sexpr.c @@ -244,7 +244,9 @@ sexpr2string(const struct sexpr * sexpr, char *buffer, size_t n_buffer) ret += tmp; break; case SEXPR_VALUE: - if (strchr(sexpr->u.value, ' ')) + if (strchr(sexpr->u.value, ' ') || + strchr(sexpr->u.value, ')') || + strchr(sexpr->u.value, '(')) tmp = snprintf(buffer + ret, n_buffer - ret, "'%s'", sexpr->u.value); else diff --git a/tests/sexpr2xmldata/sexpr2xml-boot-grub.sexpr b/tests/sexpr2xmldata/sexpr2xml-boot-grub.sexpr new file mode 100644 index 0000000..f42fc32 --- /dev/null +++ b/tests/sexpr2xmldata/sexpr2xml-boot-grub.sexpr @@ -0,0 +1 @@ +(domain (domid 6)(name 'pvtest')(memory 420)(maxmem 420)(vcpus 2)(uuid '596a5d2171f48fb2e068e2386a5c413e')(on_poweroff 'destroy')(on_reboot 'destroy')(on_crash 'destroy')(image (linux (kernel '/usr/lib/xen/boot/pv-grub-x86_64.gz')(args '(hd0,0)/grub/menu.lst')))(device (vbd (dev 'xvda')(uname 'phy:/dev/MainVG/GuestVG')(mode 'w')))) diff --git a/tests/sexpr2xmldata/sexpr2xml-boot-grub.xml b/tests/sexpr2xmldata/sexpr2xml-boot-grub.xml new file mode 100644 index 0000000..9221bdd --- /dev/null +++ b/tests/sexpr2xmldata/sexpr2xml-boot-grub.xml @@ -0,0 +1,26 @@ +<domain type='xen' id='6'> + <name>pvtest</name> + <uuid>596a5d21-71f4-8fb2-e068-e2386a5c413e</uuid> + <memory>430080</memory> + <currentMemory>430080</currentMemory> + <vcpu>2</vcpu> + <os> + <type>linux</type> + <kernel>/usr/lib/xen/boot/pv-grub-x86_64.gz</kernel> + <cmdline>(hd0,0)/grub/menu.lst</cmdline> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>destroy</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='block' device='disk'> + <driver name='phy'/> + <source dev='/dev/MainVG/GuestVG'/> + <target dev='xvda' bus='xen'/> + </disk> + <console type='pty'> + <target type='xen' port='0'/> + </console> + </devices> +</domain> diff --git a/tests/sexpr2xmltest.c b/tests/sexpr2xmltest.c index 8c75c52..d62b44f 100644 --- a/tests/sexpr2xmltest.c +++ b/tests/sexpr2xmltest.c @@ -172,6 +172,8 @@ mymain(int argc, char **argv) DO_TEST("fv-net-ioemu", "fv-net-ioemu", 1); DO_TEST("fv-net-netfront", "fv-net-netfront", 1); + DO_TEST("boot-grub", "boot-grub", 1); + virCapabilitiesFree(caps); return(ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); diff --git a/tests/xml2sexprdata/xml2sexpr-boot-grub.sexpr b/tests/xml2sexprdata/xml2sexpr-boot-grub.sexpr new file mode 100644 index 0000000..a9d14df --- /dev/null +++ b/tests/xml2sexprdata/xml2sexpr-boot-grub.sexpr @@ -0,0 +1 @@ +(vm (name 'pvtest')(memory 420)(maxmem 420)(vcpus 2)(uuid '596a5d21-71f4-8fb2-e068-e2386a5c413e')(on_poweroff 'destroy')(on_reboot 'destroy')(on_crash 'destroy')(image (linux (kernel '/usr/lib/xen/boot/pv-grub-x86_64.gz')(args (hd0,0)/grub/menu.lst)))(device (vbd (dev 'xvda')(uname 'phy:/dev/MainVG/GuestLV')(mode 'w')))) \ No newline at end of file diff --git a/tests/xml2sexprdata/xml2sexpr-boot-grub.xml b/tests/xml2sexprdata/xml2sexpr-boot-grub.xml new file mode 100644 index 0000000..b9b1c9f --- /dev/null +++ b/tests/xml2sexprdata/xml2sexpr-boot-grub.xml @@ -0,0 +1,21 @@ +<domain type='xen' id='15'> + <name>pvtest</name> + <uuid>596a5d2171f48fb2e068e2386a5c413e</uuid> + <os> + <type>linux</type> + <kernel>/usr/lib/xen/boot/pv-grub-x86_64.gz</kernel> + <cmdline>(hd0,0)/grub/menu.lst</cmdline> + </os> + <memory>430080</memory> + <vcpu>2</vcpu> + <on_poweroff>destroy</on_poweroff> + <on_reboot>destroy</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='block' device='disk'> + <source dev='/dev/MainVG/GuestLV'/> + <target dev='xvda'/> + </disk> + <console tty='/dev/pts/4'/> + </devices> +</domain> diff --git a/tests/xml2sexprtest.c b/tests/xml2sexprtest.c index 49b7574..77cf760 100644 --- a/tests/xml2sexprtest.c +++ b/tests/xml2sexprtest.c @@ -161,6 +161,8 @@ mymain(int argc, char **argv) DO_TEST("fv-net-ioemu", "fv-net-ioemu", "fvtest", 1); DO_TEST("fv-net-netfront", "fv-net-netfront", "fvtest", 1); + DO_TEST("boot-grub", "boot-grub", "fvtest", 1); + virCapabilitiesFree(caps); return(ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); -- 1.7.2.3

2 3

[libvirt] [PATCH] Fix several minor problems introduced by the memtune series
by Matthias Bolte 13 Oct '10

13 Oct '10

Add proper documentation to the new VIR_DOMAIN_MEMORY_* macros in libvirt.h.in to placate apibuild.py. Mark args as unused in for libvirt_virDomain{Get,Set}MemoryParameters in the Python bindings and add both to the libvirtMethods array. Update remote_protocol-structs to placate make syntax-check. Undo unintended modifications in vboxDomainGetInfo. Update the function table of the VirtualBox and XenAPI drivers. --- include/libvirt/libvirt.h.in | 28 ++++++++++++++++++++++++++++ python/libvirt-override.c | 6 ++++-- src/remote_protocol-structs | 35 +++++++++++++++++++++++++++++++++++ src/vbox/vbox_tmpl.c | 6 ++++-- src/xenapi/xenapi_driver.c | 2 ++ 5 files changed, 73 insertions(+), 4 deletions(-) diff --git a/include/libvirt/libvirt.h.in b/include/libvirt/libvirt.h.in index e244eac..ca8e6fa 100644 --- a/include/libvirt/libvirt.h.in +++ b/include/libvirt/libvirt.h.in @@ -695,9 +695,37 @@ typedef enum { */ #define VIR_DOMAIN_MEMORY_FIELD_LENGTH 80 + +/** + * VIR_DOMAIN_MEMORY_HARD_LIMIT: + * + * Macro for the well-known tunable hard_limit. + */ + #define VIR_DOMAIN_MEMORY_HARD_LIMIT "hard_limit" + +/** + * VIR_DOMAIN_MEMORY_SOFT_LIMIT: + * + * Macro for the well-known tunable soft_limit. + */ + #define VIR_DOMAIN_MEMORY_SOFT_LIMIT "soft_limit" + +/** + * VIR_DOMAIN_MEMORY_MIN_GUARANTEE: + * + * Macro for the well-known tunable min_guarantee. + */ + #define VIR_DOMAIN_MEMORY_MIN_GUARANTEE "min_guarantee" + +/** + * VIR_DOMAIN_SWAP_HARD_LIMIT: + * + * Macro for the well-known tunable swap_hard_limit. + */ + #define VIR_DOMAIN_SWAP_HARD_LIMIT "swap_hard_limit" /** diff --git a/python/libvirt-override.c b/python/libvirt-override.c index c43ab15..4a03d72 100644 --- a/python/libvirt-override.c +++ b/python/libvirt-override.c @@ -374,14 +374,14 @@ libvirt_virDomainSetSchedulerParameters(PyObject *self ATTRIBUTE_UNUSED, /* FIXME: This is a place holder for the implementation. */ static PyObject * libvirt_virDomainSetMemoryParameters(PyObject *self ATTRIBUTE_UNUSED, - PyObject *args) { + PyObject *args ATTRIBUTE_UNUSED) { return VIR_PY_INT_FAIL; } /* FIXME: This is a place holder for the implementation. */ static PyObject * libvirt_virDomainGetMemoryParameters(PyObject *self ATTRIBUTE_UNUSED, - PyObject *args) { + PyObject *args ATTRIBUTE_UNUSED) { return VIR_PY_INT_FAIL; } @@ -3532,6 +3532,8 @@ static PyMethodDef libvirtMethods[] = { {(char *) "virDomainGetSchedulerType", libvirt_virDomainGetSchedulerType, METH_VARARGS, NULL}, {(char *) "virDomainGetSchedulerParameters", libvirt_virDomainGetSchedulerParameters, METH_VARARGS, NULL}, {(char *) "virDomainSetSchedulerParameters", libvirt_virDomainSetSchedulerParameters, METH_VARARGS, NULL}, + {(char *) "virDomainSetMemoryParameters", libvirt_virDomainSetMemoryParameters, METH_VARARGS, NULL}, + {(char *) "virDomainGetMemoryParameters", libvirt_virDomainGetMemoryParameters, METH_VARARGS, NULL}, {(char *) "virDomainGetVcpus", libvirt_virDomainGetVcpus, METH_VARARGS, NULL}, {(char *) "virDomainPinVcpu", libvirt_virDomainPinVcpu, METH_VARARGS, NULL}, {(char *) "virConnectListStoragePools", libvirt_virConnectListStoragePools, METH_VARARGS, NULL}, diff --git a/src/remote_protocol-structs b/src/remote_protocol-structs index a5fc6aa..838423e 100644 --- a/src/remote_protocol-structs +++ b/src/remote_protocol-structs @@ -70,6 +70,21 @@ struct remote_sched_param { remote_nonnull_string field; remote_sched_param_value value; }; +struct remote_memory_param_value { + int type; + union { + int i; + u_int ui; + int64_t l; + uint64_t ul; + double d; + int b; + } remote_memory_param_value_u; +}; +struct remote_memory_param { + remote_nonnull_string field; + remote_memory_param_value value; +}; struct remote_open_args { remote_string name; int flags; @@ -151,6 +166,26 @@ struct remote_domain_set_scheduler_parameters_args { remote_sched_param * params_val; } params; }; +struct remote_domain_set_memory_parameters_args { + remote_nonnull_domain dom; + struct { + u_int params_len; + remote_memory_param * params_val; + } params; + u_int flags; +}; +struct remote_domain_get_memory_parameters_args { + remote_nonnull_domain dom; + int nparams; + u_int flags; +}; +struct remote_domain_get_memory_parameters_ret { + struct { + u_int params_len; + remote_memory_param * params_val; + } params; + int nparams; +}; struct remote_domain_block_stats_args { remote_nonnull_domain dom; remote_nonnull_string path; diff --git a/src/vbox/vbox_tmpl.c b/src/vbox/vbox_tmpl.c index 65bfd9e..7e7d8e4 100644 --- a/src/vbox/vbox_tmpl.c +++ b/src/vbox/vbox_tmpl.c @@ -1734,8 +1734,8 @@ static int vboxDomainGetInfo(virDomainPtr dom, virDomainInfoPtr info) { info->cpuTime = 0; info->nrVirtCpu = CPUCount; - info->mem.cur_balloon = memorySize * 1024; - info->mem.max_balloon = maxMemorySize * 1024; + info->memory = memorySize * 1024; + info->maxMem = maxMemorySize * 1024; switch(state) { case MachineState_Running: info->state = VIR_DOMAIN_RUNNING; @@ -8344,6 +8344,8 @@ virDriver NAME(Driver) = { vboxDomainRevertToSnapshot, /* domainRevertToSnapshot */ vboxDomainSnapshotDelete, /* domainSnapshotDelete */ NULL, /* qemuDomainMonitorCommand */ + NULL, /* domainSetMemoryParameters */ + NULL, /* domainGetMemoryParameters */ }; virNetworkDriver NAME(NetworkDriver) = { diff --git a/src/xenapi/xenapi_driver.c b/src/xenapi/xenapi_driver.c index ad5b5d8..e62a139 100644 --- a/src/xenapi/xenapi_driver.c +++ b/src/xenapi/xenapi_driver.c @@ -1821,6 +1821,8 @@ static virDriver xenapiDriver = { NULL, /* domainRevertToSnapshot */ NULL, /* domainSnapshotDelete */ NULL, /* qemuDomainMonitorCommand */ + NULL, /* domainSetMemoryParameters */ + NULL, /* domainGetMemoryParameters */ }; /** -- 1.7.0.4

3 5

[libvirt] [PATCH] Enable support for nested SVM (v4)
by Daniel P. Berrange 13 Oct '10

13 Oct '10

This enables support for nested SVM using the regular CPU model/features block. If the CPU model or features include 'svm', then the '-enable-nesting' flag will be added to the QEMU command line. Latest out of tree patches for nested 'vmx', no longer require the '-enable-nesting' flag. They instead just look at the cpu features. Several of the models already include svm support, but QEMU was just masking out the svm bit silently. So this will enable SVM on such models In v4: changed bool to int to allow error code propagation * src/qemu/qemu_conf.h: flag for -enable-nesting * src/qemu/qemu_conf.c: Use -enable-nesting if VMX or SVM are in the CPUID * src/cpu/cpu.h, src/cpu/cpu.c: API to check for a named feature * src/cpu/cpu_x86.c: x86 impl of feature check * src/libvirt_private.syms: Add cpuHasFeature * src/qemuhelptest.c: Add nesting flag where required --- src/cpu/cpu.c | 24 ++++++++++++++++++++++++ src/cpu/cpu.h | 11 +++++++++++ src/cpu/cpu_x86.c | 30 ++++++++++++++++++++++++++++++ src/libvirt_private.syms | 1 + src/qemu/qemu_conf.c | 24 ++++++++++++++++++++++-- src/qemu/qemu_conf.h | 1 + tests/qemuhelptest.c | 12 ++++++++---- 7 files changed, 97 insertions(+), 6 deletions(-) diff --git a/src/cpu/cpu.c b/src/cpu/cpu.c index def6974..62db3fe 100644 --- a/src/cpu/cpu.c +++ b/src/cpu/cpu.c @@ -424,3 +424,27 @@ cpuUpdate(virCPUDefPtr guest, return driver->update(guest, host); } + +int +cpuHasFeature(const char *arch, + const union cpuData *data, + const char *feature) +{ + struct cpuArchDriver *driver; + + VIR_DEBUG("arch=%s, data=%p, feature=%s", + arch, data, feature); + + if ((driver = cpuGetSubDriver(arch)) == NULL) + return -1; + + if (driver->hasFeature == NULL) { + virCPUReportError(VIR_ERR_NO_SUPPORT, + _("cannot check guest CPU data for %s architecture"), + arch); + return -1; + } + + return driver->hasFeature(data, feature); +} + diff --git a/src/cpu/cpu.h b/src/cpu/cpu.h index a745917..76d0e8e 100644 --- a/src/cpu/cpu.h +++ b/src/cpu/cpu.h @@ -82,6 +82,10 @@ typedef int (*cpuArchUpdate) (virCPUDefPtr guest, const virCPUDefPtr host); +typedef int +(*cpuArchHasFeature) (const union cpuData *data, + const char *feature); + struct cpuArchDriver { const char *name; @@ -95,6 +99,7 @@ struct cpuArchDriver { cpuArchGuestData guestData; cpuArchBaseline baseline; cpuArchUpdate update; + cpuArchHasFeature hasFeature; }; @@ -151,4 +156,10 @@ extern int cpuUpdate (virCPUDefPtr guest, const virCPUDefPtr host); +extern int +cpuHasFeature(const char *arch, + const union cpuData *data, + const char *feature); + + #endif /* __VIR_CPU_H__ */ diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c index 1937901..813b499 100644 --- a/src/cpu/cpu_x86.c +++ b/src/cpu/cpu_x86.c @@ -1754,6 +1754,35 @@ cleanup: return ret; } +static int x86HasFeature(const union cpuData *data, + const char *name) +{ + struct x86_map *map; + struct x86_feature *feature; + int ret = -1; + int i; + + if (!(map = x86LoadMap())) + return -1; + + if (!(feature = x86FeatureFind(map, name))) + goto cleanup; + + for (i = 0 ; i < feature->ncpuid ; i++) { + struct cpuX86cpuid *cpuid; + + cpuid = x86DataCpuid(data, feature->cpuid[i].function); + if (cpuid && x86cpuidMatchMasked(cpuid, feature->cpuid + i)) { + ret = 1; + goto cleanup; + } + } + ret = 0; + +cleanup: + x86MapFree(map); + return ret; +} struct cpuArchDriver cpuDriverX86 = { .name = "x86", @@ -1771,4 +1800,5 @@ struct cpuArchDriver cpuDriverX86 = { .guestData = x86GuestData, .baseline = x86Baseline, .update = x86Update, + .hasFeature = x86HasFeature, }; diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 1d8ea95..966289b 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -96,6 +96,7 @@ cpuEncode; cpuGuestData; cpuNodeData; cpuUpdate; +cpuHasFeature; # cpu_conf.h diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 16145b0..de14f92 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -1211,6 +1211,8 @@ static unsigned long long qemudComputeCmdFlags(const char *help, flags |= QEMUD_CMD_FLAG_NO_KVM_PIT; if (strstr(help, "-tdf")) flags |= QEMUD_CMD_FLAG_TDF; + if (strstr(help, "-enable-nesting")) + flags |= QEMUD_CMD_FLAG_NESTING; if (strstr(help, ",menu=on")) flags |= QEMUD_CMD_FLAG_BOOT_MENU; if (strstr(help, "-fsdev")) @@ -3577,7 +3579,8 @@ qemuBuildCpuArgStr(const struct qemud_driver *driver, const char *emulator, unsigned long long qemuCmdFlags, const struct utsname *ut, - char **opt) + char **opt, + bool *hasHwVirt) { const virCPUDefPtr host = driver->caps->host.cpu; virCPUDefPtr guest = NULL; @@ -3588,6 +3591,8 @@ qemuBuildCpuArgStr(const struct qemud_driver *driver, virBuffer buf = VIR_BUFFER_INITIALIZER; int i; + *hasHwVirt = false; + if (def->cpu && def->cpu->model) { if (qemudProbeCPUModels(emulator, qemuCmdFlags, ut->machine, &ncpus, &cpus) < 0) @@ -3603,6 +3608,7 @@ qemuBuildCpuArgStr(const struct qemud_driver *driver, if (ncpus > 0 && host) { virCPUCompareResult cmp; const char *preferred; + int hasSVM; cmp = cpuGuestData(host, def->cpu, &data); switch (cmp) { @@ -3629,6 +3635,14 @@ qemuBuildCpuArgStr(const struct qemud_driver *driver, if (cpuDecode(guest, data, cpus, ncpus, preferred) < 0) goto cleanup; + /* Only 'svm' requires --enable-nesting. The nested + * 'vmx' patches now simply hook off the CPU features + */ + hasSVM = cpuHasFeature(guest->arch, data, "svm"); + if (hasSVM < 0) + goto cleanup; + *hasHwVirt = hasSVM > 0 ? true : false; + virBufferVSprintf(&buf, "%s", guest->model); for (i = 0; i < guest->nfeatures; i++) { char sign; @@ -3755,6 +3769,7 @@ int qemudBuildCommandLine(virConnectPtr conn, char *cpu; char *smp; int last_good_net = -1; + bool hasHwVirt = false; uname_normalize(&ut); @@ -3948,13 +3963,18 @@ int qemudBuildCommandLine(virConnectPtr conn, ADD_ARG_LIT(def->os.machine); } - if (qemuBuildCpuArgStr(driver, def, emulator, qemuCmdFlags, &ut, &cpu) < 0) + if (qemuBuildCpuArgStr(driver, def, emulator, qemuCmdFlags, + &ut, &cpu, &hasHwVirt) < 0) goto error; if (cpu) { ADD_ARG_LIT("-cpu"); ADD_ARG_LIT(cpu); VIR_FREE(cpu); + + if ((qemuCmdFlags & QEMUD_CMD_FLAG_NESTING) && + hasHwVirt) + ADD_ARG_LIT("-enable-nesting"); } if (disableKQEMU) diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index fbd89de..d2e6857 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -94,6 +94,7 @@ enum qemud_cmd_flags { QEMUD_CMD_FLAG_BOOT_MENU = (1LL << 38), /* -boot menu=on support */ QEMUD_CMD_FLAG_ENABLE_KQEMU = (1LL << 39), /* -enable-kqemu flag */ QEMUD_CMD_FLAG_FSDEV = (1LL << 40), /* -fstype filesystem passthrough */ + QEMUD_CMD_FLAG_NESTING = (1LL << 41), /* -enable-nesting (SVM/VMX) */ }; /* Main driver state */ diff --git a/tests/qemuhelptest.c b/tests/qemuhelptest.c index 56a49fd..d072cb0 100644 --- a/tests/qemuhelptest.c +++ b/tests/qemuhelptest.c @@ -171,7 +171,8 @@ mymain(int argc, char **argv) QEMUD_CMD_FLAG_RTC_TD_HACK | QEMUD_CMD_FLAG_NO_HPET | QEMUD_CMD_FLAG_NO_KVM_PIT | - QEMUD_CMD_FLAG_TDF, + QEMUD_CMD_FLAG_TDF | + QEMUD_CMD_FLAG_NESTING, 10005, 1, 0); DO_TEST("kvm-86", QEMUD_CMD_FLAG_VNC_COLON | @@ -194,7 +195,8 @@ mymain(int argc, char **argv) QEMUD_CMD_FLAG_RTC_TD_HACK | QEMUD_CMD_FLAG_NO_HPET | QEMUD_CMD_FLAG_NO_KVM_PIT | - QEMUD_CMD_FLAG_TDF, + QEMUD_CMD_FLAG_TDF | + QEMUD_CMD_FLAG_NESTING, 10050, 1, 0); DO_TEST("qemu-kvm-0.11.0-rc2", QEMUD_CMD_FLAG_VNC_COLON | @@ -221,7 +223,8 @@ mymain(int argc, char **argv) QEMUD_CMD_FLAG_NO_HPET | QEMUD_CMD_FLAG_NO_KVM_PIT | QEMUD_CMD_FLAG_TDF | - QEMUD_CMD_FLAG_BOOT_MENU, + QEMUD_CMD_FLAG_BOOT_MENU | + QEMUD_CMD_FLAG_NESTING, 10092, 1, 0); DO_TEST("qemu-0.12.1", QEMUD_CMD_FLAG_VNC_COLON | @@ -277,7 +280,8 @@ mymain(int argc, char **argv) QEMUD_CMD_FLAG_NO_HPET | QEMUD_CMD_FLAG_NO_KVM_PIT | QEMUD_CMD_FLAG_TDF | - QEMUD_CMD_FLAG_BOOT_MENU, + QEMUD_CMD_FLAG_BOOT_MENU | + QEMUD_CMD_FLAG_NESTING, 12003, 1, 0); return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; -- 1.7.2.3

3 2