June 2010 - Devel - libvirt List Archives

[libvirt] inability to open local read-only connection
by Tavares, John 20 Aug '10

20 Aug '10

I have been experimenting with using libvirt (0.3.3) on a variety of systems (RHEL, CentOS and Oracle VM). I have run into an issue when I try to open a local read-only connection to the hypervisor that is failing only on Oracle VM server release 2.2.0. I have created a root owned setuid executable that is effectively running as root, but even so, still cannot open the local read-only connection of the hypervisor. It only works if I run it directly as root. This is not an option. I do not understand why it works as is on my RHEL and CentOS machines, but not my Oracle machine. It would seem as thought it is not checking if the effective uid is root, just the uid. Has anyone run into a similar issue or have any suggestions of what I might try to fix this issue or can tell me that this is a defect that needs (is) fixed?? Thanks.

4 23

[libvirt] Libvirt synchronous hooks
by Radek Hladik 05 Aug '10

05 Aug '10

I am trying Libvirt synchronous hooks and I would like to ask a question. I would like to use the machine start (qemu+kvm) hook to set up the storage for the machine. I already mentioned my setup in this mailing list but for now it is only important that VM storage is a md raid constructed from iSCSI disks. The VM's config is using simple file device: <disk type='file' device='disk'> <driver name='qemu' type=''/> <source file='/dev/disk/by-id/md-uuid-e464a51e:f61e98b4:bfe78010:bc810f04'/> <target dev='vda' bus='virtio'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> </disk> Stopping the array from stop hook works perfectly however it seems that on the startup the storage is checked before the hook is executed. At least I do get errors that the storage file (/dev/disk/by-id/md-uuid-....) does not exist and my hook is not called. I would say that I am hooking on wrong places that I should hook on storage startup/shutdown but as far as I know there are no hooks for storage drivers. Are there any plans in this area? Or is there any other way how to do it that I do not see? Radek

3 2

[libvirt] Segfault in virDomainObjListSearchName when listing domains (qemu backend)
by Guido Winkelmann 15 Jul '10

15 Jul '10

Hi, I'm seeing a crash in libvirt when trying to list all domains using virsh. Here's the backtrace: ===================== Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fffeebfd710 (LWP 1691)] 0x00007ffff7411746 in __strcmp_sse42 () from /lib64/libc.so.6 Missing separate debuginfos, use: debuginfo-install openssl-1.0.0a-1.fc12.x86_64 (gdb) bt #0 0x00007ffff7411746 in __strcmp_sse42 () from /lib64/libc.so.6 #1 0x00007ffff7ac9d79 in virDomainObjListSearchName (payload=0x73fdd0, name=<value optimized out>, data=0x7fffdc0008c0) at conf/domain_conf.c:367 #2 0x00007ffff7ab476e in virHashSearch (table=0x6f9c30, iter=0x7ffff7ac9d50 <virDomainObjListSearchName>, data=0x7fffdc0008c0) at util/hash.c:582 #3 0x00007ffff7ac9d33 in virDomainFindByName (doms=<value optimized out>, name=0x7fffdc0008c0 "basiccentos54image") at conf/domain_conf.c:377 #4 0x00000000004430f6 in qemudDomainLookupByName (conn=0x7fffe8000a80, name=0x7fffdc0008c0 "basiccentos54image") at qemu/qemu_driver.c:4166 #5 0x00007ffff7af95cd in virDomainLookupByName (conn=0x7fffe8000a80, name=0x7fffdc0008c0 "basiccentos54image") at libvirt.c:2169 #6 0x0000000000423e64 in remoteDispatchDomainLookupByName (server=<value optimized out>, client=<value optimized out>, conn=0x7fffe8000a80, hdr=<value optimized out>, rerr=0x7fffeebfcc70, args=<value optimized out>, ret=0x7fffeebfcbc0) at remote.c:2030 #7 0x0000000000426a91 in remoteDispatchClientCall (server=<value optimized out>, client=0x7ffff0001300, msg=0x7ffff0041570) at dispatch.c:506 #8 0x0000000000426e43 in remoteDispatchClientRequest (server=0x6e3cd0, client=0x7ffff0001300, msg=0x7ffff0041570) at dispatch.c:388 #9 0x0000000000417ed8 in qemudWorker (data=0x7ffff0000908) at libvirtd.c:1568 #10 0x00007ffff7878a3a in start_thread () from /lib64/libpthread.so.0 #11 0x00007ffff73d377d in clone () from /lib64/libc.so.6 #12 0x0000000000000000 in ?? () (gdb) ===================== This is with the newest version from git, pulled about 30 minutes ago. This happens when I try to start up one of the defined domains using either libvirt or virsh and then try to list all the defined domains in virsh using list --all. The attempt to start one of the domains already fails with the following output: ===================== virsh # start testserver-a error: Failed to start domain testserver-a error: internal error process exited while connecting to monitor: 17:21:14.760: debug : virCgroupNew:542 : New group /libvirt/qemu/testserver-a 17:21:14.760: debug : virCgroupDetect:232 : Detected mount/mapping 0:cpu at /mnt/cgroups/cpu in /sysdefault 17:21:14.760: debug : virCgroupDetect:232 : Detected mount/mapping 1:cpuacct at /mnt/cgroups/cpuacct in /sysdefault 17:21:14.760: debug : virCgroupDetect:232 : Detected mount/mapping 3:memory at /mnt/cgroups/memory in /sysdefault 17:21:14.760: debug : virCgroupDetect:232 : Detected mount/mapping 4:devices at /mnt/cgroups/devices in /sysdefault 17:21:14.760: debug : virCgroupMakeGroup:484 : Make group /libvirt/qemu/testserver-a 17:21:14.760: debug : virCgroupMakeGroup:496 : Make controller /mnt/cgroups/cpu/sysdefault/libvirt/qemu/testserver-a/ 17:21:14.760: debug : virCgroupMakeGroup:496 : Make controller /mnt/cgroups/cpuacct/sysdefault/libvirt/qemu/testserver-a/ 17:21:14.760: debug : virCgroupMakeGroup:496 : Make controller /mnt/cgroups/memory/sysdefault/libvirt/qemu/testserver-a/ ===================== This happens with all the domains I have currently defined. Calling list --all before that produces no problems. Calling list --all after that always produces said crash. qemu is qemu-kvm 0.12.4, built from sources. The host system is a Fedora 12 install. Guido

2 12

[libvirt] FYI: a short guide to libvirt & network filtering iptables/ebtables use
by Daniel P. Berrange 10 Jul '10

10 Jul '10

I just wrote this to assist some Red Hat folks understanding what libvirt does with iptables, and thought it is useful info for the whole libvirt community. When I have time I'll adjust this content so that it can fit into the website in relevant pages/places. Firewall / network filtering in libvirt ======================================= There are three pieces of libvirt functionality which do network filtering of some type. At a high level they are: - The virtual network driver. This provides a isolated bridge device (ie no physical NICs enslaved). Guest TAP devices are attached to this bridge. Guests can talk to each other & the host, and optionally the wider world. - The QEMU driver MAC filtering This provides a generic filtering of MAC addresses to prevent the guest spoofing its MAC address. This is mostly obsoleted by the next item, so won't be discussed further. - The network filter driver This provides fully configurable, arbitrary network filtering of traffic on guest NICs. Generic rulesets are defined at the host level to control traffic in some manner. Rules sets are then associated with individual NICs of a guest. While not as expressive as directly using iptables/ebtables, this can still do nearly everything you would want to on a guest NIC filter. The virtual network driver ========================== The typical configuration for guests is to use bridging of the physical NIC on the host to connect the guest directly to the LAN. In RHEL6 there is also the possibility of using macvtap/sr-iov and VEPA connectivity. None of this stuff plays nicely with wireless NICs, since they will typically silently drop any traffic with a MAC address that doesn't match that of the physical NIC. Thus the virtual network driver in libvirt was invented. This takes the form of an isolated bridge device (ie one with no physical NICs enslaved). The TAP devices associated with the guest NICs are attached to the bridge device. This immediately allows guests on a single host to talk to each other and to the host OS (modulo host IPtables rules). libvirt then uses iptables to control what further connectivity is available. There are three configurations possible for a virtual network at time of writing - isolated: all off-node traffic is completely blocked - nat: outbound traffic to the LAN is allowed, but MASQUERADED - forward: outbound traffic to the LAN is allowed The latter 'forward' case requires the virtual network be on a separate sub-net from the main LAN, and that the LAN admin has configured routing for this subnet. In the future we intend to add support for IP subnetting and/or proxy-arp. This allows for the virtual network to use the same subnet as the main LAN & should avoid need for the LAN admin to configure special routing. Libvirt will optionally also provide DHCP services to the virtual network using DNSMASQ. In all cases, we need to allow DNS/DHCP queries to the host OS. Since we can't predict whether the host firewall setup is already allowing this, we insert 4 rules into the head of the INPUT chain target prot opt in out source destination ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67 Note we have restricted our rules to just the bridge associated with the virutal network, to avoid opening undesirable holes in the host firewall wrt the LAN/WAN. The next rules depend on the type of connectivity allowed, and go in the main FORWARD chain: type=isolated ------------- Allow traffic between guests. Deny inbound. Deny outbound. target prot opt in out source destination ACCEPT all -- virbr1 virbr1 0.0.0.0/0 0.0.0.0/0 REJECT all -- * virbr1 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- virbr1 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable type=nat -------- Allow inbound related to an established connection. Allow outbound, but only from our expected subnet. Allow traffic between guests. Deny all other inbound. Deny all other outbound. target prot opt in out source destination ACCEPT all -- * virbr0 0.0.0.0/0 192.168.122.0/24 state RELATED,ESTABLISHED ACCEPT all -- virbr0 * 192.168.122.0/24 0.0.0.0/0 ACCEPT all -- virbr0 virbr0 0.0.0.0/0 0.0.0.0/0 REJECT all -- * virbr0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- virbr0 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable type=routed ----------- Allow inbound, but only to our expected subnet. Allow outbound, but only from our expected subnet. Allow traffic between guests. Deny all other inbound. Deny all other outbound. target prot opt in out source destination ACCEPT all -- * virbr2 0.0.0.0/0 192.168.124.0/24 ACCEPT all -- virbr2 * 192.168.124.0/24 0.0.0.0/0 ACCEPT all -- virbr2 virbr2 0.0.0.0/0 0.0.0.0/0 REJECT all -- * virbr2 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- virbr2 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable Finally, with type=nat, there is also an entry in the POSTROUTING chain to apply masquerading target prot opt in out source destination MASQUERADE all -- * * 192.168.122.0/24 !192.168.122.0/24 The network filter driver ========================= This driver provides a fully configurable network filtering capability that leverages ebtables, iptables and ip6tables. This was written by the libvirt guys at IBM and although its XML schema is defined by libvirt, the conceptual model is closely aligned with the DMTF CIM schema for network filtering http://www.dmtf.org/standards/cim/cim_schema_v2230/CIM_Network.pdf The filters are managed in libvirt as a top level, standalone object. This allows the filters to then be referenced by any libvirt object that requires their functionality, instead tieing them only to use by guest NICs. In the current implementation, filters can be associated with individual guest NICs via the libvirt domain XML format. In the future we might allow filters to be associated with the virtual network objects. Further we're expecting to define a new 'virtual switch' object to remove the complexity of configuring bridge/sriov/vepa networking modes. This make also end up making use of network filters. There are a new set of virsh commands for managing network filters virsh nwfilter-define define or update a network filter from an XML file virsh nwfilter-undefine undefine a network filter virsh nwfilter-dumpxml network filter information in XML virsh nwfilter-list list network filters virsh nwfilter-edit edit XML configuration for a network filter There are equivalently named C APIs for each of these commands. As with all objects libvirt manages, network filters are configured using an XML format. At a high level the format looks like this: <filter name='no-spamming' chain='XXXX'> <uuid>d217f2d7-5a04-0e01-8b98-ec2743436b74</uuid> <rule ...> .... </rule> <filterref filter='XXXX'/> </filter> Every filter has a name and UUID which serve as unique identifiers. A filter can have zero-or-more <rule> elements which are used to actually define network controls. Filters can be arranged into a DAG, so zero-or-more <filterref/> elements are also allowed. Cycles in the graph are not allowed. The <rule> element is where all the interesting stuff happens. It has three attributes, an action, a traffic direction and an optional priority. eg <rule action='drop' direction='out' priority='500'> Within the rule there are a wide variety of elements allowed, which do protocol specific matching. Supported protocols currently include 'mac', 'arp', 'rarp', 'ip', 'ipv6', 'tcp/ip', 'icmp/ip', 'igmp/ip', 'udp/ip', 'udplite/ip' 'esp/ip', 'ah/ip', 'sctp/ip', 'tcp/ipv6', 'icmp/ipv6', 'igmp/ipv6', 'udp/ipv6', 'udplite/ipv6', 'esp/ipv6', 'ah/ipv6', 'sctp/ipv6'. Each protocol defines what is valid inside the <rule> element, the general pattern though is <protocol match='yes|no' attribute1='value1' attribute2='value2'/> so, eg a TCP protocol, matching ports 0-1023 would be expressed as: <tcp match='yes' srcportstart='0' srcportend='1023'/> Attributes can included references to variables defined by the object using the rule. So the guest XML format allows each NIC to have a MAC address and IP address defined. These are made available to filters via the variables $IP and $MAC. So to define a filter the prevents IP address spoofing we can simply match on source IP address != $IP <filter name='no-ip-spoofing' chain='ipv4'> <rule action='drop' direction='out'> <ip match='no' srcipaddr='$IP' /> </rule> </filter> I'm not going to go into details on all the other protocol matches you can do, because it'll take far too much space. You can read about the options here http://libvirt.org/formatnwfilter.html#nwfelemsRulesProto Out of the box in RHEL6/Fedora rawhide, libvirt ships with a set of default useful rules # virsh nwfilter-list UUID Name ---------------------------------------------------------------- 15b1ab2b-b1ac-1be2-ed49-2042caba4abb allow-arp 6c51a466-8d14-6d11-46b0-68b1a883d00f allow-dhcp 7517ad6c-bd90-37c8-26c9-4eabcb69848d allow-dhcp-server 3d38b406-7cf0-8335-f5ff-4b9add35f288 allow-incoming-ipv4 5ff06320-9228-2899-3db0-e32554933415 allow-ipv4 db0b1767-d62b-269b-ea96-0cc8b451144e clean-traffic f88f1932-debf-4aa1-9fbe-f10d3aa4bc95 no-arp-spoofing 772f112d-52e4-700c-0250-e178a3d91a7a no-ip-multicast 7ee20370-8106-765d-f7ff-8a60d5aaf30b no-ip-spoofing d5d3c490-c2eb-68b1-24fc-3ee362fc8af3 no-mac-broadcast fb57c546-76dc-a372-513f-e8179011b48a no-mac-spoofing dba10ea7-446d-76de-346f-335bd99c1d05 no-other-l2-traffic f5c78134-9da4-0c60-a9f0-fb37bc21ac1f no-other-rarp-traffic 7637e405-4ccf-42ac-5b41-14f8d03d8cf3 qemu-announce-self 9aed52e7-f0f3-343e-fe5c-7dcb27b594e5 qemu-announce-self-rarp Most of these are just building blocks. The interesting one here is 'clean-traffic'. This pulls together all the building blocks into one filter that you can then associate with a guest NIC. This stops the most common bad things a guest might try, IP spoofing, arp spoofing and MAC spoofing. To look at the rules for any of these just do virsh nwfilter-dumpxml FILTERNAME|UUID They are all stored in /etc/libvirt/nwfilter, but don't edit files there directly. Use 'virsh nwfilter-define' to update them. This ensures the guests have their iptables/ebtables rules recreated. To associate the clean-trafffic filter with a guest, edit the guest XML config and change the <interface> element to include a <filterref> and also specify the whitelisted <ip addres/> the guest is allowed to use <interface type='bridge'> <mac address='52:54:00:56:44:32'/> <source bridge='br1'/> <ip address='10.33.8.131'/> <target dev='vnet0'/> <model type='virtio'/> <filterref filter='clean-traffic'/> </interface> If no <ip address> is included, the network filter driver will activate its 'learning mode'. This uses libpcap to snoop on network traffic the guest sends and attempts to identify the first IP address it uses. It then locks traffic to this address. Obviously this isn't entirely secure, but it does offer some protection against the guest being trojaned once up & running. In the future we intend to enhance the learning mode so that it looks for DHCPOFFERS from a trusted DHCP server and only allows the offered IP address to be used. Now, how is all this implemented... The network filter driver uses a combination of ebtables, iptables and ip6tables, depending on which protocols are referenced in a filter. The out of the box 'clean-traffic' filter rules only require use of ebtables. If you want to do matching at tcp/udp/etc protocols (eg to add a new filter 'no-email-spamming' to block port 25), then iptables will also be used. The driver attempts to keep its rules separate from those that the host admin might already have configured. So the first thing it does with ebtables, is to add two hooks in POSTROUTING & PREROUTING chains, to redirect traffic to custom chains. These hooks match on the TAP device name of the guest NIC, so they should not interact badly with any administrator defined rules Bridge chain: PREROUTING, entries: 1, policy: ACCEPT -i vnet0 -j libvirt-I-vnet0 Bridge chain: POSTROUTING, entries: 1, policy: ACCEPT -o vnet0 -j libvirt-O-vnet0 To keep things managable & easy to follow, the driver will then create further sub-chains for each protocol then it needs to match against: Bridge chain: libvirt-I-vnet0, entries: 5, policy: ACCEPT -p IPv4 -j I-vnet0-ipv4 -p ARP -j I-vnet0-arp -p 0x8035 -j I-vnet0-rarp -p 0x835 -j ACCEPT -j DROP Bridge chain: libvirt-O-vnet0, entries: 4, policy: ACCEPT -p IPv4 -j O-vnet0-ipv4 -p ARP -j O-vnet0-arp -p 0x8035 -j O-vnet0-rarp -j DROP Finally, come the actual implementation of the filters. These example is showing the 'clean-traffic' filter implementation. I'm not going to explain what this is doing now :-) Bridge chain: I-vnet0-ipv4, entries: 2, policy: ACCEPT -s ! 52:54:0:56:44:32 -j DROP -p IPv4 --ip-src ! 10.33.8.131 -j DROP Bridge chain: O-vnet0-ipv4, entries: 1, policy: ACCEPT -j ACCEPT Bridge chain: I-vnet0-arp, entries: 6, policy: ACCEPT -s ! 52:54:0:56:44:32 -j DROP -p ARP --arp-mac-src ! 52:54:0:56:44:32 -j DROP -p ARP --arp-ip-src ! 10.33.8.131 -j DROP -p ARP --arp-op Request -j ACCEPT -p ARP --arp-op Reply -j ACCEPT -j DROP Bridge chain: O-vnet0-arp, entries: 5, policy: ACCEPT -p ARP --arp-op Reply --arp-mac-dst ! 52:54:0:56:44:32 -j DROP -p ARP --arp-ip-dst ! 10.33.8.131 -j DROP -p ARP --arp-op Request -j ACCEPT -p ARP --arp-op Reply -j ACCEPT -j DROP Bridge chain: I-vnet0-rarp, entries: 2, policy: ACCEPT -p 0x8035 -s 52:54:0:56:44:32 -d Broadcast --arp-op Request_Reverse --arp-ip-src 0.0.0.0 --arp-ip-dst 0.0.0.0 --arp-mac-src 52:54:0:56:44:32 --arp-mac-dst 52:54:0:56:44:32 -j ACCEPT -j DROP Bridge chain: O-vnet0-rarp, entries: 2, policy: ACCEPT -p 0x8035 -d Broadcast --arp-op Request_Reverse --arp-ip-src 0.0.0.0 --arp-ip-dst 0.0.0.0 --arp-mac-src 52:54:0:56:44:32 --arp-mac-dst 52:54:0:56:44:32 -j ACCEPT -j DROP NB, we would have liked to include the prefix 'libvirt-' in all of our chain names, but unfortunately the kernel limits names to a very short maximum length. So only the first two custom chains can include that prefix. The others just include the TAP device name + protocol name. If I define a new filter 'no-spamming' and then add this to the 'clean-traffic' filter, I can illustrate how iptables usage works. # cat > /root/spamming.xml <<EOF <filter name='no-spamming' chain='root'> <uuid>d217f2d7-5a04-0e01-8b98-ec2743436b74</uuid> <rule action='drop' direction='out' priority='500'> <tcp dstportstart='25' dstportend='25'/> </rule> </filter> EOF # virsh nwfilter-define /root/spamming.xml # virsh nwfilter-edit clean-traffic ...add <filterref filter='no-spamming'/> All active guests immediately have their iptables/ebtables rules rebuilt. The network filter driver deals with iptables in a very similar way. First it separates out its rules from those the admin may have defined, by adding a couple of hooks into the INPUT/FORWARD chains Chain INPUT (policy ACCEPT 13M packets, 21G bytes) target prot opt in out source destination libvirt-host-in all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT 5532K packets, 3010M bytes) target prot opt in out source destination libvirt-in all -- * * 0.0.0.0/0 0.0.0.0/0 libvirt-out all -- * * 0.0.0.0/0 0.0.0.0/0 libvirt-in-post all -- * * 0.0.0.0/0 0.0.0.0/0 These custom chains, then do matching based on the TAP device name, so they won't open holes in the admin defined matches for the LAN/WAN (if any). Chain libvirt-host-in (1 references) target prot opt in out source destination HI-vnet0 all -- * * 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 Chain libvirt-in (1 references) target prot opt in out source destination FI-vnet0 all -- * * 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 Chain libvirt-in-post (1 references) target prot opt in out source destination ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 Chain libvirt-out (1 references) target prot opt in out source destination FO-vnet0 all -- * * 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Finally, we can see the interesting bit which is the actual implementation of my filter to block port 25 access: Chain FI-vnet0 (1 references) target prot opt in out source destination DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 Chain FO-vnet0 (1 references) target prot opt in out source destination DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:25 Chain HI-vnet0 (1 references) target prot opt in out source destination DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 One thing in looking at this that you may notice is that if there are many guests all using the same filters, we will be duplicating the iptables rules over & over for each guest. This is merely a limitation of the current rules engine implementation. At the libvirt object modelling level you can clearly see we've designed the model so that filter rules are define in one place, and indirectly referenced by guests. Thus it should be possible to change the impl in the future so that we can share the actual iptables/ebtables rules for each guest to create a more scalable system. The stuff in current libvirt is more or less the very first working impl we've had of this stuff, so there's not been much optimization work yet. Also notice that at the XML level we don't expose the fact that we are using iptables or ebtables at all. The rule definition is done in terms of network protocols. Thus if we ever find a need, we could plug in an alternative implementation that calls out to a different firewall implementation instead of ebtables/iptables (providing that impl was suitably expressive of course) Finally, in terms of problems we have in deployment. The biggest problem is that if the admin does 'service iptables restart' all our work gets blown away. We've experimented with using lokkit to record our custom rules in a persistent config file, but that caused different problem. Admins who were not using lokkit for their config found that all their own rules got blown away. So we threw away our lokkit code. Instead we document that if you run 'service iptables restart', you need to send SIGHUP to libvirt to make it recreate its rules. Finally a reminder, that the main documentation we have on this is online at http://libvirt.org/formatnwfilter.html Regards, Daniel -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://deltacloud.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

6 9

[libvirt] [PATCHv2 1/2] virsh: add new --details option to pool-list
by Justin Clift 09 Jul '10

09 Jul '10

This patch adds a new --details option to the virsh pool-list command, making its output more useful to people who use virsh for significant lengths of time. Addresses BZ # 605543 https://bugzilla.redhat.com/show_bug.cgi?id=605543 --- Output from the new option (hopefully this doesn't wrap): virsh # pool-list Name State Autostart ----------------------------------------- default active yes image_dir active yes virsh # pool-list --all Name State Autostart ----------------------------------------- default active yes image_dir active yes tmp inactive no virsh # pool-list --details Name State Autostart Persistent Capacity Allocation Available -------------------------------------------------------------------------------------- default running yes yes 1.79 TB 1.47 TB 326.02 GB image_dir running yes yes 1.79 TB 1.47 TB 326.02 GB virsh # pool-list --all --details Name State Autostart Persistent Capacity Allocation Available -------------------------------------------------------------------------------------- default running yes yes 1.79 TB 1.47 TB 326.02 GB image_dir running yes yes 1.79 TB 1.47 TB 326.02 GB tmp inactive no yes - - - virsh # Much more practical than running pool-info individually on each pool. tools/virsh.c | 130 ++++++++++++++++++++++++++++++++++++++++++++++++------ tools/virsh.pod | 6 ++- 2 files changed, 119 insertions(+), 17 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index d8d2220..afa84e6 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -4882,14 +4882,17 @@ static const vshCmdInfo info_pool_list[] = { static const vshCmdOptDef opts_pool_list[] = { {"inactive", VSH_OT_BOOL, 0, N_("list inactive pools")}, {"all", VSH_OT_BOOL, 0, N_("list inactive & active pools")}, + {"details", VSH_OT_BOOL, 0, N_("display extended details for pools")}, {NULL, 0, 0, NULL} }; static int cmdPoolList(vshControl *ctl, const vshCmd *cmd ATTRIBUTE_UNUSED) { + virStoragePoolInfo info; int inactive = vshCommandOptBool(cmd, "inactive"); int all = vshCommandOptBool(cmd, "all"); + int details = vshCommandOptBool(cmd, "details"); int active = !inactive || all ? 1 : 0; int maxactive = 0, maxinactive = 0, i; char **activeNames = NULL, **inactiveNames = NULL; @@ -4937,36 +4940,114 @@ cmdPoolList(vshControl *ctl, const vshCmd *cmd ATTRIBUTE_UNUSED) qsort(&inactiveNames[0], maxinactive, sizeof(char*), namesorter); } } - vshPrintExtra(ctl, "%-20s %-10s %-10s\n", _("Name"), _("State"), _("Autostart")); - vshPrintExtra(ctl, "-----------------------------------------\n"); + + /* Display the appropriate heading */ + if (details) { + vshPrintExtra(ctl, "%-20s %-10s %-10s %-11s %-9s %-11s %-10s\n", + _("Name"), _("State"), _("Autostart"), _("Persistent"), + _("Capacity"), _("Allocation"), _("Available")); + vshPrintExtra(ctl, + "--------------------------------------------------------------------------------------\n"); + } else { + vshPrintExtra(ctl, "%-20s %-10s %-10s\n", _("Name"), _("State"), + _("Autostart")); + vshPrintExtra(ctl, "-----------------------------------------\n"); + } for (i = 0; i < maxactive; i++) { - virStoragePoolPtr pool = virStoragePoolLookupByName(ctl->conn, activeNames[i]); - const char *autostartStr; - int autostart = 0; + const char *autostartStr, *persistentStr, *stateStr = NULL; + int autostart = 0, persistent = 0; /* this kind of work with pools is not atomic operation */ + virStoragePoolPtr pool = virStoragePoolLookupByName(ctl->conn, activeNames[i]); if (!pool) { VIR_FREE(activeNames[i]); continue; } + /* Retrieve the pool autostart status */ if (virStoragePoolGetAutostart(pool, &autostart) < 0) autostartStr = _("no autostart"); else autostartStr = autostart ? _("yes") : _("no"); - vshPrint(ctl, "%-20s %-10s %-10s\n", - virStoragePoolGetName(pool), - _("active"), - autostartStr); + /* If requested, collect the extended information for this pool */ + if (details) { + if (virStoragePoolGetInfo(pool, &info) != 0) { + vshError(ctl, "%s", _("Could not retrieve pool information")); + VIR_FREE(activeNames[i]); + continue; + } + + /* Decide which state string to display */ + switch (info.state) { + case VIR_STORAGE_POOL_INACTIVE: + stateStr = _("inactive"); + break; + case VIR_STORAGE_POOL_BUILDING: + stateStr = _("building"); + break; + case VIR_STORAGE_POOL_RUNNING: + stateStr = _("running"); + break; + case VIR_STORAGE_POOL_DEGRADED: + stateStr = _("degraded"); + break; + case VIR_STORAGE_POOL_INACCESSIBLE: + stateStr = _("inaccessible"); + break; + } + + /* Check if the pool is persistent or not */ + persistent = virStoragePoolIsPersistent(pool); + vshDebug(ctl, 5, "Persistent flag value: %d\n", persistent); + if (persistent < 0) + persistentStr = _("unknown"); + else + persistentStr = persistent ? _("yes") : _("no"); + + /* Display all information for this pool */ + vshPrint(ctl, "%-20s %-10s %-10s %-11s", + virStoragePoolGetName(pool), + stateStr, + autostartStr, + persistentStr); + + /* Display the capacity related quantities */ + if (info.state == VIR_STORAGE_POOL_RUNNING || + info.state == VIR_STORAGE_POOL_DEGRADED) { + double val; + const char *unit; + virBuffer infoBufStr = VIR_BUFFER_INITIALIZER; + + val = prettyCapacity(info.capacity, &unit); + virBufferVSprintf(&infoBufStr, "%.2lf %s", val, unit); + vshPrint(ctl, " %-9s", virBufferContentAndReset(&infoBufStr)); + + val = prettyCapacity(info.allocation, &unit); + virBufferVSprintf(&infoBufStr, "%.2lf %s", val, unit); + vshPrint(ctl, " %-11s", virBufferContentAndReset(&infoBufStr)); + + val = prettyCapacity(info.available, &unit); + virBufferVSprintf(&infoBufStr, "%.2lf %s", val, unit); + vshPrint(ctl, " %-10s\n", virBufferContentAndReset(&infoBufStr)); + } else + vshPrint(ctl, " %-9s %-11s %-10s\n", "-", "-", "-"); + } else { + /* Display basic information pool information */ + vshPrint(ctl, "%-20s %-10s %-10s\n", + virStoragePoolGetName(pool), + _("active"), + autostartStr); + } + virStoragePoolFree(pool); VIR_FREE(activeNames[i]); } for (i = 0; i < maxinactive; i++) { virStoragePoolPtr pool = virStoragePoolLookupByName(ctl->conn, inactiveNames[i]); - const char *autostartStr; - int autostart = 0; + const char *autostartStr, *persistentStr; + int autostart = 0, persistent = 0; /* this kind of work with pools is not atomic operation */ if (!pool) { @@ -4979,10 +5060,29 @@ cmdPoolList(vshControl *ctl, const vshCmd *cmd ATTRIBUTE_UNUSED) else autostartStr = autostart ? _("yes") : _("no"); - vshPrint(ctl, "%-20s %-10s %-10s\n", - inactiveNames[i], - _("inactive"), - autostartStr); + if (details) { + /* Check if the pool is persistent or not */ + persistent = virStoragePoolIsPersistent(pool); + vshDebug(ctl, 5, "Persistent flag value: %d\n", persistent); + if (persistent < 0) + persistentStr = _("unknown"); + else + persistentStr = persistent ? _("yes") : _("no"); + + /* Display detailed pool information */ + vshPrint(ctl, "%-20s %-10s %-10s %-11s %-9s %-11s %-10s\n", + inactiveNames[i], + _("inactive"), + autostartStr, + persistentStr, + "-", "-", "-"); + } else { + /* Display basic pool information */ + vshPrint(ctl, "%-20s %-10s %-10s\n", + inactiveNames[i], + _("inactive"), + autostartStr); + } virStoragePoolFree(pool); VIR_FREE(inactiveNames[i]); diff --git a/tools/virsh.pod b/tools/virsh.pod index b1917ee..cec07e3 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -732,11 +732,13 @@ variables, and defaults to C<vi>. Returns basic information about the I<pool> object. -=item B<pool-list> optional I<--inactive> I<--all> +=item B<pool-list> optional I<--inactive> I<--all> I<--details> List pool objects known to libvirt. By default, only pools in use by active domains are listed; I<--inactive> lists just the inactive -pools, and I<--all> lists all pools. +pools, and I<--all> lists all pools. The I<--details> option instructs +virsh to additionally display pool persistence and capacity related +information where available. =item B<pool-name> I<uuid> -- 1.7.0.1

7 41

[libvirt] [PATCH v2] vbox: Let configure detect/set the XPCOMC directory
by Matthias Bolte 03 Jul '10

03 Jul '10

This allows the user to give an explicit path to configure ./configure --with-vbox=/path/to/virtualbox instead of having the VirtualBox driver probe a set of possible paths at runtime. If no explicit path is specified then configure probes the set of "known" paths. https://bugzilla.redhat.com/show_bug.cgi?id=609185 --- v2: - address Eric's comments - wrap AC_HELP_STRING at 80 columns - replace the if/else with a for loop, much nicer, indeed :) - use AC_DEFINE_UNQUOTED instead of AC_SUBST to define VBOX_XPCOMC_DIR configure.ac | 60 +++++++++++++++++++++++++++++++++++++++++++- src/vbox/vbox_XPCOMCGlue.c | 22 ++-------------- 2 files changed, 62 insertions(+), 20 deletions(-) diff --git a/configure.ac b/configure.ac index 691ef69..cab01c2 100644 --- a/configure.ac +++ b/configure.ac @@ -232,7 +232,9 @@ AC_ARG_WITH([phyp], AC_ARG_WITH([xenapi], AC_HELP_STRING([--with-xenapi], [add XenAPI support @<:@default=check@:>@]),[],[with_xenapi=check]) AC_ARG_WITH([vbox], - AC_HELP_STRING([--with-vbox], [add VirtualBox support @<:@default=yes@:>@]),[],[with_vbox=yes]) + AC_HELP_STRING([--with-vbox=@<:@PFX@:>@], + [VirtualBox XPCOMC location @<:@default=check@:>@]),[], + [with_vbox=check]) AC_ARG_WITH([lxc], AC_HELP_STRING([--with-lxc], [add Linux Container support @<:@default=check@:>@]),[],[with_lxc=check]) AC_ARG_WITH([one], @@ -315,6 +317,62 @@ if test "$with_openvz" = "yes"; then fi AM_CONDITIONAL([WITH_OPENVZ], [test "$with_openvz" = "yes"]) + +dnl +dnl check for VirtualBox XPCOMC location +dnl + +vbox_xpcomc_dir= + +if test "x$with_vbox" = "xyes" || test "x$with_vbox" = "xcheck"; then + AC_MSG_CHECKING([for VirtualBox XPCOMC location]) + + for vbox in \ + /usr/lib/virtualbox/VBoxXPCOMC.so \ + /usr/lib/VirtualBox/VBoxXPCOMC.so \ + /opt/virtualbox/VBoxXPCOMC.so \ + /opt/VirtualBox/VBoxXPCOMC.so \ + /opt/virtualbox/i386/VBoxXPCOMC.so \ + /opt/VirtualBox/i386/VBoxXPCOMC.so \ + /opt/virtualbox/amd64/VBoxXPCOMC.so \ + /opt/VirtualBox/amd64/VBoxXPCOMC.so \ + /usr/local/lib/virtualbox/VBoxXPCOMC.so \ + /usr/local/lib/VirtualBox/VBoxXPCOMC.so \ + /Application/VirtualBox.app/Contents/MacOS/VBoxXPCOMC.dylib \ + ; do + if test -f "$vbox"; then + vbox_xpcomc_dir=`AS_DIRNAME(["$vbox"])` + break + fi + done + + if test -n "$vbox_xpcomc_dir"; then + AC_MSG_RESULT([$vbox_xpcomc_dir]) + with_vbox=yes + else + if test "x$with_vbox" = "xcheck"; then + AC_MSG_RESULT([not found, disabling VirtualBox driver]) + with_vbox=no + else + AC_MSG_RESULT([not found]) + AC_MSG_ERROR([VirtualBox XPCOMC is required for the VirtualBox driver]) + fi + fi +else + if test "x$with_vbox" != "xno"; then + if test -f ${with_vbox}/VBoxXPCOMC.so || \ + test -f ${with_vbox}/VBoxXPCOMC.dylib; then + vbox_xpcomc_dir=$with_vbox + with_vbox=yes + else + AC_MSG_ERROR([$with_vbox does not contain VirtualBox XPCOMC]) + fi + fi +fi + +AC_DEFINE_UNQUOTED([VBOX_XPCOMC_DIR], ["$vbox_xpcomc_dir"], + [Location of directory containing VirtualBox XPCOMC library]) + if test "x$with_vbox" = "xyes"; then AC_SEARCH_LIBS([dlopen], [dl], [], [AC_MSG_ERROR([Unable to find dlopen()])]) case $ac_cv_search_dlopen in diff --git a/src/vbox/vbox_XPCOMCGlue.c b/src/vbox/vbox_XPCOMCGlue.c index 0987c1b..fcae0cb 100644 --- a/src/vbox/vbox_XPCOMCGlue.c +++ b/src/vbox/vbox_XPCOMCGlue.c @@ -192,28 +192,12 @@ int VBoxCGlueInit(void) return tryLoadOne(pszHome, 0); /* - * Try the known standard locations. + * Try the configured location. */ g_szVBoxErrMsg[0] = '\0'; -#if defined(__gnu__linux__) || defined(__linux__) - if (tryLoadOne("/opt/VirtualBox", 1) == 0) - return 0; - if (tryLoadOne("/usr/lib/virtualbox", 1) == 0) - return 0; -#elif defined(__sun__) - if (tryLoadOne("/opt/VirtualBox/amd64", 1) == 0) - return 0; - if (tryLoadOne("/opt/VirtualBox/i386", 1) == 0) - return 0; -#elif defined(__APPLE__) - if (tryLoadOne("/Application/VirtualBox.app/Contents/MacOS", 1) == 0) - return 0; -#elif defined(__FreeBSD__) - if (tryLoadOne("/usr/local/lib/virtualbox", 1) == 0) + + if (tryLoadOne(VBOX_XPCOMC_DIR, 1) == 0) return 0; -#else -# error "port me" -#endif /* * Finally try the dynamic linker search path. -- 1.7.0.4

2 2

[libvirt] [PATCHv2 2/2] virsh: add new --details option to vol-list
by Justin Clift 02 Jul '10

02 Jul '10

This patch adds a new --details option to the virsh vol-list command, making its output more useful to people who use virsh for significant lengths of time. Addresses BZ # 605543 https://bugzilla.redhat.com/show_bug.cgi?id=605543 --- This new version of the patch uses the existing virsh output format when the --details option isn't given, maintaining backwards compatibility for existing scripts. When the new --details option is given though, the additional info is displayed and all columns are sized to their widest string. Output from the new option (hopefully this doesn't wrap): virsh # vol-list default Name Path ----------------------------------------- CentOS-5.5-x86_64-bin-DVD-1of2.iso /var/lib/libvirt/images/CentOS-5.5-x86_64-bin-DVD-1of2.iso CentOS-5.5-x86_64-bin-DVD-2of2.iso /var/lib/libvirt/images/CentOS-5.5-x86_64-bin-DVD-2of2.iso virsh # vol-list default --details Name Path Type Capacity Allocation --------------------------------------------------------------------------------------------------------------------------- CentOS-5.5-x86_64-bin-DVD-1of2.iso /var/lib/libvirt/images/CentOS-5.5-x86_64-bin-DVD-1of2.iso file 4.09 GB 4.10 GB CentOS-5.5-x86_64-bin-DVD-2of2.iso /var/lib/libvirt/images/CentOS-5.5-x86_64-bin-DVD-2of2.iso file 412.33 MB 412.74 MB virsh # vol-list tmp Name Path ----------------------------------------- disk1.img /tmp/images/disk1.img disk2.img /tmp/images/disk2.img disk3.img /tmp/images/disk3.img disk4.img /tmp/images/disk4.img disk5.img /tmp/images/disk5.img disk6.img /tmp/images/disk6.img virsh # vol-list tmp --details Name Path Type Capacity Allocation ------------------------------------------------------------ disk1.img /tmp/images/disk1.img file 20.00 GB 136.00 KB disk2.img /tmp/images/disk2.img file 20.00 GB 136.00 KB disk3.img /tmp/images/disk3.img file 20.00 GB 136.00 KB disk4.img /tmp/images/disk4.img file 20.00 GB 136.00 KB disk5.img /tmp/images/disk5.img file 20.00 GB 136.00 KB disk6.img /tmp/images/disk6.img file 20.00 GB 136.00 KB virsh # Much nicer to use when pools have a bunch of luns in them. :) tools/virsh.c | 225 ++++++++++++++++++++++++++++++++++++++++++++++++------ tools/virsh.pod | 4 +- 2 files changed, 203 insertions(+), 26 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index 7261d19..2a9c353 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -6075,67 +6075,242 @@ static const vshCmdInfo info_vol_list[] = { static const vshCmdOptDef opts_vol_list[] = { {"pool", VSH_OT_DATA, VSH_OFLAG_REQ, N_("pool name or uuid")}, + {"details", VSH_OT_BOOL, 0, N_("display extended details for volumes")}, {NULL, 0, 0, NULL} }; static int cmdVolList(vshControl *ctl, const vshCmd *cmd ATTRIBUTE_UNUSED) { + virStorageVolInfo volumeInfo; virStoragePoolPtr pool; - int maxactive = 0, i; + int details = vshCommandOptBool(cmd, "details"); + int maxAlloc = 0, maxCap = 0, maxName = 0; + int maxPath = 0, maxType = 0; + int numVolumes = 0, i; + int stringLength = 0; + double val; + const char *unit; char **activeNames = NULL; + struct volInfoText { + char *allocation; + char *capacity; + char *path; + char *type; + }; + struct volInfoText **volInfoTexts; + /* Check the connection to libvirtd daemon is still working */ if (!vshConnectionUsability(ctl, ctl->conn, TRUE)) return FALSE; + /* Look up the pool information given to us by the user */ if (!(pool = vshCommandOptPool(ctl, cmd, "pool", NULL))) return FALSE; - maxactive = virStoragePoolNumOfVolumes(pool); - if (maxactive < 0) { + /* Determine the number of volumes in the pool */ + numVolumes = virStoragePoolNumOfVolumes(pool); + if (numVolumes < 0) { virStoragePoolFree(pool); vshError(ctl, "%s", _("Failed to list active vols")); return FALSE; } - if (maxactive) { - activeNames = vshMalloc(ctl, sizeof(char *) * maxactive); - if ((maxactive = virStoragePoolListVolumes(pool, activeNames, - maxactive)) < 0) { + /* Retrieve the list of volume names in the pool */ + if (numVolumes) { + activeNames = vshMalloc(ctl, sizeof(char *) * numVolumes); + if ((numVolumes = virStoragePoolListVolumes(pool, activeNames, + numVolumes)) < 0) { vshError(ctl, "%s", _("Failed to list active vols")); VIR_FREE(activeNames); virStoragePoolFree(pool); return FALSE; } - qsort(&activeNames[0], maxactive, sizeof(char *), namesorter); + /* Sort the volume names */ + qsort(&activeNames[0], numVolumes, sizeof(char *), namesorter); } - vshPrintExtra(ctl, "%-20s %-40s\n", _("Name"), _("Path")); - vshPrintExtra(ctl, "-----------------------------------------\n"); - for (i = 0; i < maxactive; i++) { - virStorageVolPtr vol = virStorageVolLookupByName(pool, activeNames[i]); - char *path; + /* Set aside memory for volume information pointers */ + volInfoTexts = vshMalloc(ctl, sizeof(struct volInfoText *) * numVolumes); - /* this kind of work with vols is not atomic operation */ - if (!vol) { - VIR_FREE(activeNames[i]); - continue; + /* Collect the rest of the volume information for display */ + for (i = 0; i < numVolumes; i++) { + /* Retrieve volume info */ + virStorageVolPtr vol = virStorageVolLookupByName(pool, + activeNames[i]); + + /* Allocate memory for one row of volume info */ + volInfoTexts[i] = vshMalloc(ctl, sizeof(struct volInfoText)); + + /* Retrieve the volume path */ + if ((volInfoTexts[i]->path = virStorageVolGetPath(vol)) == NULL) { + /* Something went wrong retrieving a volume path, cope with it */ + volInfoTexts[i]->path = vshStrdup(ctl, _("unknown")); } - if ((path = virStorageVolGetPath(vol)) == NULL) { - virStorageVolFree(vol); - continue; + /* Retrieve volume type and sizing information */ + if (virStorageVolGetInfo(vol, &volumeInfo) != 0) { + /* Something went wrong retrieving volume info, cope with it */ + volInfoTexts[i]->allocation = vshStrdup(ctl, _("unknown")); + volInfoTexts[i]->capacity = vshStrdup(ctl, _("unknown")); + volInfoTexts[i]->type = vshStrdup(ctl, _("unknown")); + } else { + /* Convert the returned volume info into output strings */ + virBuffer bufStr = VIR_BUFFER_INITIALIZER; + + /* Volume type */ + if (volumeInfo.type == VIR_STORAGE_VOL_FILE) + volInfoTexts[i]->type = vshStrdup(ctl, _("file")); + else + volInfoTexts[i]->type = vshStrdup(ctl, _("block")); + + // The capacity value to output + val = prettyCapacity(volumeInfo.capacity, &unit); + virBufferVSprintf(&bufStr, "%.2lf %s", val, unit); + volInfoTexts[i]->capacity = + vshStrdup(ctl, virBufferContentAndReset(&bufStr)); + + // The allocation value to output + val = prettyCapacity(volumeInfo.allocation, &unit); + virBufferVSprintf(&bufStr, "%.2lf %s", val, unit); + volInfoTexts[i]->allocation = + vshStrdup(ctl, virBufferContentAndReset(&bufStr)); } + /** Remember the longest output size of each string, ** + ** so we can use a printf style output format template ** + ** later on for both the header and volume info rows **/ + + /* Keep the length of name string if longest so far */ + stringLength = strlen(activeNames[i]); + if (stringLength > maxName) + maxName = stringLength; - vshPrint(ctl, "%-20s %-40s\n", - virStorageVolGetName(vol), - path); - VIR_FREE(path); + /* Keep the length of path string if longest so far */ + stringLength = strlen(volInfoTexts[i]->path); + if (stringLength > maxPath) + maxPath = stringLength; + + /* Keep the length of type string if longest so far */ + stringLength = strlen(volInfoTexts[i]->type); + if (stringLength > maxType) + maxType = stringLength; + + /* Keep the length of capacity string if longest so far */ + stringLength = strlen(volInfoTexts[i]->capacity); + if (stringLength > maxCap) + maxCap = stringLength; + + /* Keep the length of allocation string if longest so far */ + stringLength = strlen(volInfoTexts[i]->allocation); + if (stringLength > maxAlloc) + maxAlloc = stringLength; + + /* Cleanup memory allocation */ virStorageVolFree(vol); - VIR_FREE(activeNames[i]); } + + /** If the --details option wasn't selected, we output the volume ** + ** info using the fixed string format from previous versions to ** + ** maintain backward compatibility. **/ + + /* Output basic info then return if --details option not selected */ + if (!details) { + /* The old output format */ + vshPrintExtra(ctl, "%-20s %-40s\n", _("Name"), _("Path")); + vshPrintExtra(ctl, "-----------------------------------------\n"); + for (i = 0; i < numVolumes; i++) { + vshPrint(ctl, "%-20s %-40s\n", activeNames[i], + volInfoTexts[i]->path); + + /* Cleanup the memory for this volume row */ + VIR_FREE(volInfoTexts[i]->path); + VIR_FREE(volInfoTexts[i]->type); + VIR_FREE(volInfoTexts[i]->capacity); + VIR_FREE(volInfoTexts[i]->allocation); + VIR_FREE(volInfoTexts[i]); + } + + /* Cleanup remaining memory and return */ + VIR_FREE(volInfoTexts); + VIR_FREE(activeNames); + virStoragePoolFree(pool); + return TRUE; + } + + /** We only get here if the --details option was selected. ** + ** Column now resize to the longest string to be output. **/ + + /* Determine the length of the header strings. These must be + * calculated because we may be outputing a translated heading + */ + /* Use the length of name header string if it's longest */ + stringLength = strlen(_("Name")); + if (stringLength > maxName) + maxName = stringLength; + + /* Use the length of path header string if it's longest */ + stringLength = strlen(_("Path")); + if (stringLength > maxPath) + maxPath = stringLength; + + /* Use the length of type header string if it's longest */ + stringLength = strlen(_("Type")); + if (stringLength > maxType) + maxType = stringLength; + + /* Use the length of capacity header string if it's longest */ + stringLength = strlen(_("Capacity")); + if (stringLength > maxCap) + maxCap = stringLength; + + /* Use the length of allocation header string if it's longest */ + stringLength = strlen(_("Allocation")); + if (stringLength > maxAlloc) + maxAlloc = stringLength; + + /* Display the string lengths for debugging */ + vshDebug(ctl, 5, "Longest name string = %d chars\n", maxName); + vshDebug(ctl, 5, "Longest path string = %d chars\n", maxPath); + vshDebug(ctl, 5, "Longest type string = %d chars\n", maxType); + vshDebug(ctl, 5, "Longest capacity string = %d chars\n", maxCap); + vshDebug(ctl, 5, "Longest allocation string = %d chars\n", maxAlloc); + + /* Create the output template */ + char *outputStr; + virBuffer bufStr = VIR_BUFFER_INITIALIZER; + virBufferVSprintf(&bufStr, "%%-%us %%-%us %%-%us %%-%us %%-%us\n", + maxName, maxPath, maxType, maxCap, maxAlloc); + outputStr = virBufferContentAndReset(&bufStr); + + /* Display the header */ + vshPrint(ctl, outputStr, _("Name"), _("Path"), _("Type"), + ("Capacity"), _("Allocation")); + for (i = maxName + maxPath + maxType + maxCap + maxAlloc + 8; i > 0; i--) + vshPrintExtra(ctl, "-"); + vshPrintExtra(ctl, "\n"); + + /* Display the volume info rows */ + for (i = 0; i < numVolumes; i++) { + vshPrint(ctl, outputStr, + activeNames[i], + volInfoTexts[i]->path, + volInfoTexts[i]->type, + volInfoTexts[i]->capacity, + volInfoTexts[i]->allocation); + + /* Cleanup the memory for this volume row */ + VIR_FREE(volInfoTexts[i]->path); + VIR_FREE(volInfoTexts[i]->type); + VIR_FREE(volInfoTexts[i]->capacity); + VIR_FREE(volInfoTexts[i]->allocation); + VIR_FREE(volInfoTexts[i]); + } + + /* Cleanup remaining memory */ + VIR_FREE(outputStr); + VIR_FREE(volInfoTexts); VIR_FREE(activeNames); virStoragePoolFree(pool); return TRUE; diff --git a/tools/virsh.pod b/tools/virsh.pod index 7c75edc..a217cba 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -839,10 +839,12 @@ Returns basic information about the given storage volume. I<--pool> I<pool-or-uuid> is the name or UUID of the storage pool the volume is in. I<vol-name-or-key-or-path> is the name or key or path of the volume to return information for. -=item B<vol-list> I<--pool> I<pool-or-uuid> +=item B<vol-list> [optional I<--pool>] I<pool-or-uuid> optional I<--details> Return the list of volumes in the given storage pool. I<--pool> I<pool-or-uuid> is the name or UUID of the storage pool. +The I<--details> option instructs virsh to additionally display volume +type and capacity related information where available. =item B<vol-pool> [optional I<--uuid>] I<vol-key-or-path> -- 1.7.0.1

2 6

[libvirt] [PATCH] util: virExec: Dispatch all errors raised after fork
by Cole Robinson 02 Jul '10

02 Jul '10

Any error message raised after the process has forked needs to be followed by virDispatchError, otherwise we have no chance of ever seeing it. This was selectively done for hook functions in the past, but really applies to all post-fork errors. Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- src/util/util.c | 26 ++++++++++++++------------ 1 files changed, 14 insertions(+), 12 deletions(-) diff --git a/src/util/util.c b/src/util/util.c index d058113..5f2bff5 100644 --- a/src/util/util.c +++ b/src/util/util.c @@ -283,7 +283,8 @@ static int virClearCapabilities(void) capng_clear(CAPNG_SELECT_BOTH); if ((ret = capng_apply(CAPNG_SELECT_BOTH)) < 0) { - VIR_ERROR(_("cannot clear process capabilities %d"), ret); + virUtilError(VIR_ERR_INTERNAL_ERROR, + _("cannot clear process capabilities %d"), ret); return -1; } @@ -559,7 +560,7 @@ __virExec(const char *const*argv, /* The fork was sucessful, but after that there was an error * in the child (which was already logged). */ - _exit(1); + goto fork_error; } openmax = sysconf (_SC_OPEN_MAX); @@ -575,19 +576,19 @@ __virExec(const char *const*argv, if (dup2(infd >= 0 ? infd : null, STDIN_FILENO) < 0) { virReportSystemError(errno, "%s", _("failed to setup stdin file handle")); - _exit(1); + goto fork_error; } if (childout > 0 && dup2(childout, STDOUT_FILENO) < 0) { virReportSystemError(errno, "%s", _("failed to setup stdout file handle")); - _exit(1); + goto fork_error; } if (childerr > 0 && dup2(childerr, STDERR_FILENO) < 0) { virReportSystemError(errno, "%s", _("failed to setup stderr file handle")); - _exit(1); + goto fork_error; } if (infd > 0) @@ -605,20 +606,20 @@ __virExec(const char *const*argv, if (setsid() < 0) { virReportSystemError(errno, "%s", _("cannot become session leader")); - _exit(1); + goto fork_error; } if (chdir("/") < 0) { virReportSystemError(errno, "%s", _("cannot change to root directory: %s")); - _exit(1); + goto fork_error; } pid = fork(); if (pid < 0) { virReportSystemError(errno, "%s", _("cannot fork child process")); - _exit(1); + goto fork_error; } if (pid > 0) { @@ -629,7 +630,7 @@ __virExec(const char *const*argv, virReportSystemError(errno, _("could not write pidfile %s for %d"), pidfile, pid); - _exit(1); + goto fork_error; } _exit(0); } @@ -638,15 +639,14 @@ __virExec(const char *const*argv, if (hook) if ((hook)(data) != 0) { VIR_DEBUG0("Hook function failed."); - virDispatchError(NULL); - _exit(1); + goto fork_error; } /* The steps above may need todo something privileged, so * we delay clearing capabilities until the last minute */ if ((flags & VIR_EXEC_CLEAR_CAPS) && virClearCapabilities() < 0) - _exit(1); + goto fork_error; if (envp) execve(argv[0], (char **) argv, (char**)envp); @@ -657,6 +657,8 @@ __virExec(const char *const*argv, _("cannot execute binary %s"), argv[0]); + fork_error: + virDispatchError(NULL); _exit(1); cleanup: -- 1.6.6.1

2 2

[libvirt] [PATCH] qemu: Improve some qemu.conf error reporting
by Cole Robinson 02 Jul '10

02 Jul '10

Log some info if we can't find a config file. Make parse failures fatal, and actually raise an error message. Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- src/qemu/qemu_conf.c | 13 +++++++++---- 1 files changed, 9 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index ce42bd6..e2f7b31 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -133,16 +133,21 @@ int qemudLoadDriverConfig(struct qemud_driver *driver, /* Just check the file is readable before opening it, otherwise * libvirt emits an error. */ - if (access (filename, R_OK) == -1) return 0; + if (access (filename, R_OK) == -1) { + VIR_INFO("Could not read qemu config file %s", filename); + return 0; + } conf = virConfReadFile (filename, 0); - if (!conf) return 0; + if (!conf) { + return -1; + } #define CHECK_TYPE(name,typ) if (p && p->type != (typ)) { \ qemuReportError(VIR_ERR_INTERNAL_ERROR, \ - "remoteReadConfigFile: %s: %s: expected type " #typ, \ - filename, (name)); \ + "%s: %s: %s: expected type " #typ, \ + __func__, filename, (name)); \ virConfFree(conf); \ return -1; \ } -- 1.6.6.1

4 5

[libvirt] [PATCH] udev: Parse PCI devices even if libpciaccess fails
by Cole Robinson 02 Jul '10

02 Jul '10

We only use libpciaccess for resolving device product/vendor. If initializing the library fails (say if using qemu:///session), don't warn so loudly, and carry on as usual. Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- src/node_device/node_device_udev.c | 9 ++++++--- 1 files changed, 6 insertions(+), 3 deletions(-) diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c index 73217c5..f872483 100644 --- a/src/node_device/node_device_udev.c +++ b/src/node_device/node_device_udev.c @@ -363,12 +363,15 @@ static int udevTranslatePCIIds(unsigned int vendor, char **vendor_string, char **product_string) { - int ret = -1; + int ret = -1, pciret; struct pci_id_match m; const char *vendor_name = NULL, *device_name = NULL; - if (pci_system_init() != 0) { - VIR_ERROR0(_("Failed to initialize libpciaccess")); + if ((pciret = pci_system_init()) != 0) { + char ebuf[1024]; + VIR_INFO("Failed to initialize libpciaccess: %s", + virStrerror(pciret, ebuf, sizeof ebuf)); + ret = 0; goto out; } -- 1.6.6.1

2 3