December 2013 - Devel - libvirt List Archives

[libvirt] [PATCH] Read PCI class from sysfs class file instead of config space.
by Thadeu Lima de Souza Cascardo 08 Jan '14

08 Jan '14

When determining if a device is behind a PCI bridge, the PCI device class is checked by reading the config space. However, there are some devices which have the wrong class on the config space, but the class is initialized by Linux correctly as a PCI BRIDGE. This class can be read by the sysfs file '/sys/bus/pci/devices/xxxx:xx:xx.x/class'. One example of such bridge is IBM PCI Bridge 1014:03b9, which is identified as a Host Bridge when reading the config space. Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)linux.vnet.ibm.com> --- The new test cases succeed with this patch. The second test fails without the changes to src/util/virpci.c. --- src/util/virpci.c | 41 +++++++++++++++++++++++++++-- tests/virpcimock.c | 33 ++++++++++++++++++++++++ tests/virpcitest.c | 34 ++++++++++++++++++++++++ tests/virpcitestdata/0001:00:00.0.config | Bin 0 -> 4096 bytes tests/virpcitestdata/0001:01:00.0.config | Bin 0 -> 4096 bytes tests/virpcitestdata/0001:01:00.1.config | Bin 0 -> 4096 bytes tests/virpcitestdata/0005:80:00.0.config | Bin 0 -> 4096 bytes tests/virpcitestdata/0005:90:01.0.config | Bin 0 -> 256 bytes tests/virpcitestdata/0005:90:01.1.config | Bin 0 -> 256 bytes tests/virpcitestdata/0005:90:01.2.config | Bin 0 -> 256 bytes 10 files changed, 105 insertions(+), 3 deletions(-) create mode 100644 tests/virpcitestdata/0001:00:00.0.config create mode 100644 tests/virpcitestdata/0001:01:00.0.config create mode 100644 tests/virpcitestdata/0001:01:00.1.config create mode 100644 tests/virpcitestdata/0005:80:00.0.config create mode 100644 tests/virpcitestdata/0005:90:01.0.config create mode 100644 tests/virpcitestdata/0005:90:01.1.config create mode 100644 tests/virpcitestdata/0005:90:01.2.config diff --git a/src/util/virpci.c b/src/util/virpci.c index 8ec642f..8c10a93 100644 --- a/src/util/virpci.c +++ b/src/util/virpci.c @@ -344,6 +344,37 @@ virPCIDeviceRead32(virPCIDevicePtr dev, int cfgfd, unsigned int pos) } static int +virPCIDeviceReadClass(virPCIDevicePtr dev, uint16_t *device_class) +{ + char *path = NULL; + char *id_str; + int ret = 0; + unsigned int value; + + if (virPCIFile(&path, dev->name, "class") < 0) + return -1; + + /* class string is '0xNNNNNN\n' ... i.e. 9 bytes */ + if (virFileReadAll(path, 9, &id_str) < 0) { + VIR_FREE(path); + return -1; + } + + VIR_FREE(path); + + id_str[8] = '\0'; + ret = virStrToLong_ui(id_str, NULL, 16, &value); + if (ret == 0) + *device_class = (value >> 8) & 0xFFFF; + else + VIR_WARN("Unusual value in " PCI_SYSFS "devices/%s/class: %s", + dev->name, id_str); + + VIR_FREE(id_str); + return ret; +} + +static int virPCIDeviceWrite(virPCIDevicePtr dev, int cfgfd, unsigned int pos, @@ -645,8 +676,8 @@ virPCIDeviceIsParent(virPCIDevicePtr dev, virPCIDevicePtr check, void *data) return 0; /* Is it a bridge? */ - device_class = virPCIDeviceRead16(check, fd, PCI_CLASS_DEVICE); - if (device_class != PCI_CLASS_BRIDGE_PCI) + ret = virPCIDeviceReadClass(check, &device_class); + if (ret == -1 || device_class != PCI_CLASS_BRIDGE_PCI) goto cleanup; /* Is it a plane? */ @@ -2110,6 +2141,7 @@ virPCIDeviceDownstreamLacksACS(virPCIDevicePtr dev) unsigned int pos; int fd; int ret = 0; + uint16_t device_class; if ((fd = virPCIDeviceConfigOpen(dev, true)) < 0) return -1; @@ -2119,8 +2151,11 @@ virPCIDeviceDownstreamLacksACS(virPCIDevicePtr dev) goto cleanup; } + if (virPCIDeviceReadClass(dev, &device_class)) + goto cleanup; + pos = dev->pcie_cap_pos; - if (!pos || virPCIDeviceRead16(dev, fd, PCI_CLASS_DEVICE) != PCI_CLASS_BRIDGE_PCI) + if (!pos || device_class != PCI_CLASS_BRIDGE_PCI) goto cleanup; flags = virPCIDeviceRead16(dev, fd, pos + PCI_EXP_FLAGS); diff --git a/tests/virpcimock.c b/tests/virpcimock.c index a5cef46..49759b0 100644 --- a/tests/virpcimock.c +++ b/tests/virpcimock.c @@ -29,6 +29,7 @@ # include <fcntl.h> # include <sys/stat.h> # include <stdarg.h> +# include <dirent.h> # include "viralloc.h" # include "virstring.h" # include "virfile.h" @@ -42,6 +43,7 @@ static int (*real__xstat)(int ver, const char *path, struct stat *sb); static char *(*realcanonicalize_file_name)(const char *path); static int (*realopen)(const char *path, int flags, ...); static int (*realclose)(int fd); +static DIR * (*realopendir)(const char *name); /* Don't make static, since it causes problems with clang * when passed as an arg to virAsprintf() @@ -112,6 +114,7 @@ struct pciDevice { char *id; int vendor; int device; + int class; struct pciDriver *driver; /* Driver attached. NULL if attached to no driver */ }; @@ -351,6 +354,10 @@ pci_device_new_from_stub(const struct pciDevice *data) ABORT("@tmp overflow"); make_file(devpath, "device", tmp, -1); + if (snprintf(tmp, sizeof(tmp), "0x%.4x", dev->class) < 0) + ABORT("@tmp overflow"); + make_file(devpath, "class", tmp, -1); + if (pci_device_autobind(dev) < 0) ABORT("Unable to bind: %s", data->id); @@ -747,6 +754,7 @@ init_syms(void) LOAD_SYM(canonicalize_file_name); LOAD_SYM(open); LOAD_SYM(close); + LOAD_SYM(opendir); } static void @@ -776,6 +784,13 @@ init_env(void) MAKE_PCI_DEVICE("0000:00:01.0", 0x8086, 0x0044); MAKE_PCI_DEVICE("0000:00:02.0", 0x8086, 0x0046); MAKE_PCI_DEVICE("0000:00:03.0", 0x8086, 0x0048); + MAKE_PCI_DEVICE("0001:00:00.0", 0x1014, 0x03b9, .class = 0x060400); + MAKE_PCI_DEVICE("0001:01:00.0", 0x8086, 0x105e); + MAKE_PCI_DEVICE("0001:01:00.1", 0x8086, 0x105e); + MAKE_PCI_DEVICE("0005:80:00.0", 0x10b5, 0x8112, .class = 0x060400); + MAKE_PCI_DEVICE("0005:90:01.0", 0x1033, 0x0035); + MAKE_PCI_DEVICE("0005:90:01.1", 0x1033, 0x0035); + MAKE_PCI_DEVICE("0005:90:01.2", 0x1033, 0x00e0); } @@ -934,6 +949,24 @@ open(const char *path, int flags, ...) return ret; } +DIR * +opendir(const char *path) +{ + DIR *ret; + char *newpath = NULL; + + init_syms(); + + if (STRPREFIX(path, PCI_SYSFS_PREFIX) && + getrealpath(&newpath, path) < 0) + return NULL; + + ret = realopendir(newpath ? newpath : path); + + VIR_FREE(newpath); + return ret; +} + int close(int fd) { diff --git a/tests/virpcitest.c b/tests/virpcitest.c index 5fe6d49..82a173a 100644 --- a/tests/virpcitest.c +++ b/tests/virpcitest.c @@ -183,6 +183,31 @@ cleanup: return ret; } +struct testPCIDevData { + unsigned int domain; + unsigned int bus; + unsigned int slot; + unsigned int function; +}; + +static int +testVirPCIDeviceIsAssignable(const void *opaque) +{ + const struct testPCIDevData *data = opaque; + int ret = -1; + virPCIDevicePtr dev; + + if (!(dev = virPCIDeviceNew(data->domain, data->bus, data->slot, data->function))) + goto cleanup; + + if (virPCIDeviceIsAssignable(dev, true)) + ret = 0; + + virPCIDeviceFree(dev); +cleanup: + return ret; +} + # define FAKESYSFSDIRTEMPLATE abs_builddir "/fakesysfsdir-XXXXXX" static int @@ -209,10 +234,19 @@ mymain(void) ret = -1; \ } while (0) +# define DO_TEST_PCI(fnc, domain, bus, slot, function) \ + do { \ + struct testPCIDevData data = { domain, bus, slot, function }; \ + if (virtTestRun(#fnc, fnc, &data) < 0) \ + ret = -1; \ + } while (0) + DO_TEST(testVirPCIDeviceNew); DO_TEST(testVirPCIDeviceDetach); DO_TEST(testVirPCIDeviceReset); DO_TEST(testVirPCIDeviceReattach); + DO_TEST_PCI(testVirPCIDeviceIsAssignable, 5, 0x90, 1, 0); + DO_TEST_PCI(testVirPCIDeviceIsAssignable, 1, 1, 0, 0); if (getenv("LIBVIRT_SKIP_CLEANUP") == NULL) virFileDeleteTree(fakesysfsdir); diff --git a/tests/virpcitestdata/0001:00:00.0.config b/tests/virpcitestdata/0001:00:00.0.config new file mode 100644 index 0000000000000000000000000000000000000000..808d48993cfc0f41223fcb5f49deffc594f136b7 GIT binary patch literal 4096 zcmeH@I}XAy5Jca`5~RZg60MJb!~ys;a0<jx5^hCDNy!mt=t)n(8Yfir2x&(4YG(bB z{ig90wibyn0^=hytn<`78f&|D=zEvd5U8+Sxa1hw*nI*%I6fEDtkd58IUH=(-@Ei& z`ONZ@#r(MD|GagrnWu5_32tAW*RPg6sv;l)A|L`HAOa#F0wN#+A|L`H@J9q*PZkdc literal 0 HcmV?d00001 diff --git a/tests/virpcitestdata/0001:01:00.0.config b/tests/virpcitestdata/0001:01:00.0.config new file mode 100644 index 0000000000000000000000000000000000000000..f63aacbea08fc83b345e1ee404756145e7d349a5 GIT binary patch literal 4096 zcmZo`h!bFD5MW?qU|>>UXkY*WAi>nY$iN6<qW}>B2WF7K379CR5||9#X~qjmCm0kM z6j>iMK<#Fl0AdIL{c(^7NNY$jIHrJ{?<fFO0H%Qc6alFM0YL>exUYeN42%s7Ec~1x z877=QWd`bav)TXue_{D2AeEzFGz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!n I24e^S0CUn1m;e9( literal 0 HcmV?d00001 diff --git a/tests/virpcitestdata/0001:01:00.1.config b/tests/virpcitestdata/0001:01:00.1.config new file mode 100644 index 0000000000000000000000000000000000000000..db9e3876a528266bb5a6e9651d7cd18b45b7d71f GIT binary patch literal 4096 zcmZo`h!bFD5MW?qU|>>UXkcJqU;z?r4T=nmKsG865pZAziJX85Gr<@GPcvRnI>Dg8 zpvd~50qPj02_PQ`0R3^02S{s3F*v4xobM<ARRE?K85l)Csz5+cfer3!pdbTd0|N^` zCrE|~GcZ8HK)?*t@n*CC|Np}BPaq<r<Y)+thQMeDjE2By2#kinXb6mkz-S1JhQMeD NjE2By2n@au000k05W)Ze literal 0 HcmV?d00001 diff --git a/tests/virpcitestdata/0005:80:00.0.config b/tests/virpcitestdata/0005:80:00.0.config new file mode 100644 index 0000000000000000000000000000000000000000..cc4f94a849ed3d0a47f5b47331aaecdea88765c3 GIT binary patch literal 4096 zcmdlgAk@gtAi%JSfrX8Mfsp|Q8YawV_`sl`#L)Di>BE1RD1>%^ae>Mi1DK*fTmcO} zuqbOn1DJ*p0t|%^rUDm(pbry}Ey&Qo0}^ro5pYlpXVI6zg5+oV+Kg)3K=~il6$8f` z_5Z+y{a~<pH2w!eEDW3*M&p0r!hSH=JR1LlAr=PC4WsctaA7|fY#xpO!4L}r=Z4Yv IADFNQ0PH*z9smFU literal 0 HcmV?d00001 diff --git a/tests/virpcitestdata/0005:90:01.0.config b/tests/virpcitestdata/0005:90:01.0.config new file mode 100644 index 0000000000000000000000000000000000000000..a60599bd342d3ebcdc7b8367ca36ad337f602fde GIT binary patch literal 256 zcmXpOFlAt45MXi^VCG@qXkY+>CJ=!Q7z5RUfCHEW5{!&mj0{Y5Fz#TaS&cX3;ByxM DCDjDB literal 0 HcmV?d00001 diff --git a/tests/virpcitestdata/0005:90:01.1.config b/tests/virpcitestdata/0005:90:01.1.config new file mode 100644 index 0000000000000000000000000000000000000000..beee76534041a7020c08ae9ac03d9a349c6ea12e GIT binary patch literal 256 ycmXpOFlAt45MXi^VCG@qU|?VnU}yr8Sb;H6EeJS(Ng%<*sKv;@R0rb@MH&E<&;s)S literal 0 HcmV?d00001 diff --git a/tests/virpcitestdata/0005:90:01.2.config b/tests/virpcitestdata/0005:90:01.2.config new file mode 100644 index 0000000000000000000000000000000000000000..cfd72e4d7165bff2751ecbdc570ce7f1e0646226 GIT binary patch literal 256 zcmXpOc)-BMAi%_;z|6zo!oa|wz|aIFu>xbDS`csmlR$!5K#7rosSd`)Mk^@TV-u#E T7_0Gy9FS#<5E~CbC<F-rZiWW} literal 0 HcmV?d00001 -- 1.7.1

3 4

[libvirt] [PATCH] Fix bridge configuration when OUTPUT policy is DROP on the host
by Lénaïc Huard 08 Jan '14

08 Jan '14

When the host is configured with very restrictive firewall (default policy is DROP for all chains, including OUTPUT), the bridge driver for Linux adds netfilter entries to allow DHCP and DNS requests to go from the VM to the dnsmasq of the host. The issue that this commit fixes is the fact that a DROP policy on the OUTPUT chain blocks the DHCP replies from the host’s dnsmasq to the VM. As DHCP replies are sent in UDP, they are not caught by any --ctstate ESTABLISHED rule and so, need to be explicitly allowed. Signed-off-by: Lénaïc Huard <lenaic(a)lhuard.fr.eu.org> --- src/libvirt_private.syms | 2 ++ src/network/bridge_driver_linux.c | 35 +++++++++++++--------- src/util/viriptables.c | 61 +++++++++++++++++++++++++++++++++++++++ src/util/viriptables.h | 7 +++++ 4 files changed, 92 insertions(+), 13 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 2dbb8f8..c26ce29 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1290,6 +1290,7 @@ iptablesAddForwardRejectOut; iptablesAddOutputFixUdpChecksum; iptablesAddTcpInput; iptablesAddUdpInput; +iptablesAddUdpOutput; iptablesRemoveDontMasquerade; iptablesRemoveForwardAllowCross; iptablesRemoveForwardAllowIn; @@ -1301,6 +1302,7 @@ iptablesRemoveForwardRejectOut; iptablesRemoveOutputFixUdpChecksum; iptablesRemoveTcpInput; iptablesRemoveUdpInput; +iptablesRemoveUdpOutput; # util/virjson.h diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_linux.c index 066779a..dcdd033 100644 --- a/src/network/bridge_driver_linux.c +++ b/src/network/bridge_driver_linux.c @@ -564,6 +564,13 @@ int networkAddGeneralFirewallRules(virNetworkObjPtr network) goto err2; } + if (iptablesAddUdpOutput(AF_INET, network->def->bridge, 68) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add iptables rule to allow DHCP replies to '%s'"), + network->def->bridge); + goto err3; + } + /* If we are doing local DHCP service on this network, attempt to * add a rule that will fixup the checksum of DHCP response * packets back to the guests (but report failure without @@ -582,14 +589,14 @@ int networkAddGeneralFirewallRules(virNetworkObjPtr network) virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow DNS requests from '%s'"), network->def->bridge); - goto err3; + goto err4; } if (iptablesAddUdpInput(AF_INET, network->def->bridge, 53) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow DNS requests from '%s'"), network->def->bridge); - goto err4; + goto err5; } /* allow TFTP requests through to dnsmasq if necessary */ @@ -598,7 +605,7 @@ int networkAddGeneralFirewallRules(virNetworkObjPtr network) virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow TFTP requests from '%s'"), network->def->bridge); - goto err5; + goto err6; } /* Catch all rules to block forwarding to/from bridges */ @@ -607,14 +614,14 @@ int networkAddGeneralFirewallRules(virNetworkObjPtr network) virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to block outbound traffic from '%s'"), network->def->bridge); - goto err6; + goto err7; } if (iptablesAddForwardRejectIn(AF_INET, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to block inbound traffic to '%s'"), network->def->bridge); - goto err7; + goto err8; } /* Allow traffic between guests on the same bridge */ @@ -622,31 +629,33 @@ int networkAddGeneralFirewallRules(virNetworkObjPtr network) virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow cross bridge traffic on '%s'"), network->def->bridge); - goto err8; + goto err9; } /* add IPv6 general rules, if needed */ if (networkAddGeneralIp6tablesRules(network) < 0) { - goto err9; + goto err10; } return 0; /* unwind in reverse order from the point of failure */ -err9: +err10: iptablesRemoveForwardAllowCross(AF_INET, network->def->bridge); -err8: +err9: iptablesRemoveForwardRejectIn(AF_INET, network->def->bridge); -err7: +err8: iptablesRemoveForwardRejectOut(AF_INET, network->def->bridge); -err6: +err7: if (ipv4def && ipv4def->tftproot) { iptablesRemoveUdpInput(AF_INET, network->def->bridge, 69); } -err5: +err6: iptablesRemoveUdpInput(AF_INET, network->def->bridge, 53); -err4: +err5: iptablesRemoveTcpInput(AF_INET, network->def->bridge, 53); +err4: + iptablesRemoveUdpOutput(AF_INET, network->def->bridge, 68); err3: iptablesRemoveUdpInput(AF_INET, network->def->bridge, 67); err2: diff --git a/src/util/viriptables.c b/src/util/viriptables.c index a1711bb..9b78d86 100644 --- a/src/util/viriptables.c +++ b/src/util/viriptables.c @@ -184,6 +184,28 @@ iptablesInput(int family, NULL); } +static int +iptablesOutput(int family, + const char *iface, + int port, + int action, + int tcp) +{ + char portstr[32]; + + snprintf(portstr, sizeof(portstr), "%d", port); + portstr[sizeof(portstr) - 1] = '\0'; + + return iptablesAddRemoveRule("filter", "OUTPUT", + family, + action, + "--out-interface", iface, + "--protocol", tcp ? "tcp" : "udp", + "--destination-port", portstr, + "--jump", "ACCEPT", + NULL); +} + /** * iptablesAddTcpInput: * @ctx: pointer to the IP table context @@ -262,6 +284,45 @@ iptablesRemoveUdpInput(int family, return iptablesInput(family, iface, port, REMOVE, 0); } +/** + * iptablesAddUdpOutput: + * @ctx: pointer to the IP table context + * @iface: the interface name + * @port: the UDP port to add + * + * Add an output to the IP table allowing access to the given @port from + * the given @iface interface for UDP packets + * + * Returns 0 in case of success or an error code in case of error + */ + +int +iptablesAddUdpOutput(int family, + const char *iface, + int port) +{ + return iptablesOutput(family, iface, port, ADD, 0); +} + +/** + * iptablesRemoveUdpOutput: + * @ctx: pointer to the IP table context + * @iface: the interface name + * @port: the UDP port to remove + * + * Removes an output from the IP table, hence forbidding access to the given + * @port from the given @iface interface for UDP packets + * + * Returns 0 in case of success or an error code in case of error + */ +int +iptablesRemoveUdpOutput(int family, + const char *iface, + int port) +{ + return iptablesOutput(family, iface, port, REMOVE, 0); +} + static char *iptablesFormatNetwork(virSocketAddr *netaddr, unsigned int prefix) diff --git a/src/util/viriptables.h b/src/util/viriptables.h index 6dfb992..2f9a212 100644 --- a/src/util/viriptables.h +++ b/src/util/viriptables.h @@ -40,6 +40,13 @@ int iptablesRemoveUdpInput (int family, const char *iface, int port); +int iptablesAddUdpOutput (int family, + const char *iface, + int port); +int iptablesRemoveUdpOutput (int family, + const char *iface, + int port); + int iptablesAddForwardAllowOut (virSocketAddr *netaddr, unsigned int prefix, const char *iface, -- 1.8.5.1

2 1

[libvirt] [PATCH] lxcDomainShutdownFlags: Cleanup @flags usage
by Michal Privoznik 07 Jan '14

07 Jan '14

Currently, the @flags usage is a bit unclear at first sight to say the least. There's no need for such unclear code especially when we can borrow the working code from qemuDomainShutdownFlags(). In addition, this fixes one bug too. If user requested both VIR_DOMAIN_SHUTDOWN_INITCTL and VIR_DOMAIN_SHUTDOWN_SIGNAL at the same time, he is basically saying: 'Use the force Luke! If initctl fails try sending a signal.' But with the current code we don't do that. If initctl fails for some reason (e.g. inability to write to /dev/initctl) we don't try sending any signal but fail immediately. To make things worse, making a domain shutdown with bare _SIGNAL was working by blind chance of a @rc variable being placed at correct place on the stack so its initial value was zero. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/lxc/lxc_driver.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index c499182..a563b70 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -2594,7 +2594,8 @@ lxcDomainShutdownFlags(virDomainPtr dom, virDomainObjPtr vm; char *vroot = NULL; int ret = -1; - int rc; + int rc = 0; + bool useInitctl = false, initctlRequested, signalRequested; virCheckFlags(VIR_DOMAIN_SHUTDOWN_INITCTL | VIR_DOMAIN_SHUTDOWN_SIGNAL, -1); @@ -2623,25 +2624,24 @@ lxcDomainShutdownFlags(virDomainPtr dom, (unsigned long long)priv->initpid) < 0) goto cleanup; - if (flags == 0 || - (flags & VIR_DOMAIN_SHUTDOWN_INITCTL)) { - if ((rc = virInitctlSetRunLevel(VIR_INITCTL_RUNLEVEL_POWEROFF, - vroot)) < 0) { + initctlRequested = flags & VIR_DOMAIN_SHUTDOWN_INITCTL; + signalRequested = flags & VIR_DOMAIN_SHUTDOWN_SIGNAL; + + if (initctlRequested || !flags) + useInitctl = true; + + if (useInitctl) { + rc = virInitctlSetRunLevel(VIR_INITCTL_RUNLEVEL_POWEROFF, vroot); + if (rc < 0 && !signalRequested) goto cleanup; - } - if (rc == 0 && flags != 0 && - ((flags & ~VIR_DOMAIN_SHUTDOWN_INITCTL) == 0)) { + if (rc == 0 && !signalRequested) { virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", _("Container does not provide an initctl pipe")); goto cleanup; } - } else { - rc = 0; } - if (rc == 0 && - (flags == 0 || - (flags & VIR_DOMAIN_SHUTDOWN_SIGNAL))) { + if (rc == 0 && !useInitctl) { if (kill(priv->initpid, SIGTERM) < 0 && errno != ESRCH) { virReportSystemError(errno, -- 1.8.5.1

3 4

[libvirt] Setting devid for emulated NICs (Xen 4.3.1 / libvirt 1.2.0) using libxl driver
by Stefan Bader 07 Jan '14

07 Jan '14

Using virt-manager "hypervisor default" type: <interface type='bridge'> <mac address='00:16:3e:5e:09:9d'/> <source bridge='br0'/> <script path='vif-bridge'/> </interface> This causes the qemu call to have "-net none" which removes PXE boot abilities. A linux kernel has network through the xen pv-driver. Changing in virt-manager to "e1000" type: <interface type='bridge'> <mac address='00:16:3e:5e:09:9d'/> <source bridge='br0'/> <script path='vif-bridge'/> <model type='e1000'/> </interface> This currently (Xen 4.3.1 + libvirt 1.2.0) fails and the qemu arguments in the log look suspicious: -device e1000,id=nic-1,netdev=net-1,mac=00:16:3e:5e:09:9d -netdev type=tap,id=net-1,ifname=vif1.-1-emu,script=no,downscript=no Looking through git I found ba64b97134a6129a48684f22f31be92c3b6eef96 libxl: Allow libxl to set NIC devid which removes a line that sets the devid of new NICs. I assume the comment says (sorry I always seem to get confused reading it) that devid should be auto-set by the libxl library provided by Xen. But I could not find where that would be done. Even the xl command implementation sets it explicitly. libxl_device_nic_init sets it to -1 which would explain the wrong qemu arguments above. For testing I re-added the following after the libxlMakeNic call: --- libvirt-1.2.0.orig/src/libxl/libxl_conf.c 2013-12-11 17:04:17.000000000 +0 +++ libvirt-1.2.0/src/libxl/libxl_conf.c 2013-12-16 19:08:46.830016646 +0 @@ -907,6 +907,8 @@ libxlMakeNicList(virDomainDefPtr def, l for (i = 0; i < nnics; i++) { if (libxlMakeNic(l_nics[i], &x_nics[i])) goto error; + if (x_nics[i].devid < 0) + x_nics[i].devid = i; } d_config->nics = x_nics; And with that I get a working PXE boot when I set the device type in the config. (Side note that I think not using a type defaults to rtl8139 in the old xend driver. Maybe this should be the same for the xl driver). I am not sure how the right fix for it should look like as I am unsure which part was supposed to set the devid. Just right now it does not seem to be done. -Stefan

3 17

[libvirt] [PATCH libvirt-java] spec: Only install unversioned jar file
by Cole Robinson 07 Jan '14

07 Jan '14

As intended by Fedora's java packaging guidelines: https://bugzilla.redhat.com/show_bug.cgi?id=1022139 --- libvirt-java.spec.in | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/libvirt-java.spec.in b/libvirt-java.spec.in index b5f1bf8..137af83 100644 --- a/libvirt-java.spec.in +++ b/libvirt-java.spec.in @@ -59,8 +59,7 @@ ant build jar docs rm -fr %{buildroot} install -d -m0755 %{buildroot}%{_javadir} install -d -m0755 %{buildroot}%{_javadocdir}/%{name}-%{version} -cp target/%{prefix}-%{version}.jar %{buildroot}%{_javadir} -%{__ln_s} %{_javadir}/%{prefix}-%{version}.jar %{buildroot}%{_javadir}/%{prefix}.jar +cp target/%{prefix}-%{version}.jar %{buildroot}%{_javadir}/%{prefix}.jar cp -r target/javadoc/* %{buildroot}%{_javadocdir}/%{name}-%{version} %{__ln_s} %{_javadocdir}/%{name}-%{version} %{buildroot}%{_javadocdir}/%{name} -- 1.8.4.2

2 2

[libvirt] [PATCH] Support transient attribute on vmware disks
by Wout Mertens 05 Jan '14

05 Jan '14

From: Wout Mertens <Wout.Mertens(a)gmail.com> vmx/vmx.c ignores the transient attribute on the disk xml format. This patch adds a 1-1 relationship between it and [disk].mode = "independent-nonpersistent". The other modes are ignored as before. It works in my testing. https://bugzilla.redhat.com/show_bug.cgi?id=1044023 --- src/vmx/vmx.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/src/vmx/vmx.c b/src/vmx/vmx.c index 48487f8..4282390 100644 --- a/src/vmx/vmx.c +++ b/src/vmx/vmx.c @@ -1954,6 +1954,7 @@ virVMXParseDisk(virVMXContext *ctx, virDomainXMLOptionPtr xmlopt, virConfPtr con * busType = VIR_DOMAIN_DISK_BUS_FDC * controllerOrBus = [0] * unit = [0..1] + * */ int result = -1; @@ -1980,6 +1981,9 @@ virVMXParseDisk(virVMXContext *ctx, virDomainXMLOptionPtr xmlopt, virConfPtr con char writeThrough_name[32] = ""; bool writeThrough = false; + char mode_name[32] = ""; + char *mode = NULL; + if (def == NULL || *def != NULL) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid argument")); return -1; @@ -2093,6 +2097,7 @@ virVMXParseDisk(virVMXContext *ctx, virDomainXMLOptionPtr xmlopt, virConfPtr con VMX_BUILD_NAME(fileType); VMX_BUILD_NAME(fileName); VMX_BUILD_NAME(writeThrough); + VMX_BUILD_NAME(mode); /* vmx:present */ if (virVMXGetConfigBoolean(conf, present_name, &present, false, true) < 0) { @@ -2121,6 +2126,11 @@ virVMXParseDisk(virVMXContext *ctx, virDomainXMLOptionPtr xmlopt, virConfPtr con goto cleanup; } + /* vmx:mode -> def:transient */ + if (virVMXGetConfigString(conf, mode_name, &mode, true) < 0) { + goto cleanup; + } + if (clientDevice) { /* * Just ignore devices in client mode, because I have no clue how to @@ -2172,6 +2182,7 @@ virVMXParseDisk(virVMXContext *ctx, virDomainXMLOptionPtr xmlopt, virConfPtr con (*def)->src = ctx->parseFileName(fileName, ctx->opaque); (*def)->cachemode = writeThrough ? VIR_DOMAIN_DISK_CACHE_WRITETHRU : VIR_DOMAIN_DISK_CACHE_DEFAULT; + (*def)->transient = STRCASEEQ(mode, "independent-nonpersistent") ? true: false; if ((*def)->src == NULL) { goto cleanup; @@ -3497,7 +3508,11 @@ virVMXFormatDisk(virVMXContext *ctx, virDomainDiskDefPtr def, return -1; } } - + + if (def->transient) { + virBufferAsprintf(buffer, "%s%d:%d.mode = \"independent-nonpersistent\"\n", + busType, controllerOrBus, unit); + } return 0; } -- 1.8.2.3

2 10

[libvirt] [PATCH python] define __GNUC_PREREQ macro before using it
by Doug Goldstein 03 Jan '14

03 Jan '14

We brought over use of the __GNUC_PREREQ macro from libvirt but didn't bring over the definition of it. This brings over the macro from libvirt sources. --- libvirt-utils.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/libvirt-utils.h b/libvirt-utils.h index f55be7b..add7553 100644 --- a/libvirt-utils.h +++ b/libvirt-utils.h @@ -65,6 +65,15 @@ # endif # ifdef __GNUC__ + +# ifndef __GNUC_PREREQ +# if defined __GNUC__ && defined __GNUC_MINOR__ +# define __GNUC_PREREQ(maj, min) \ + ((__GNUC__ << 16) + __GNUC_MINOR__ >= ((maj) << 16) + (min)) +# else +# define __GNUC_PREREQ(maj,min) 0 +# endif + /** * ATTRIBUTE_UNUSED: * -- 1.8.3.2

3 4

[libvirt] Add patches to allow users to join running containers.
by dwalsh＠redhat.com 03 Jan '14

03 Jan '14

[PATCH 1/2] Add virGetUserDirectoryByUID to retrieve users homedir [PATCH 2/2] virt-login-shell joins users into lxc container. This patch implements most of the changes suggested by Dan Berrange and Eric Blake. Some replies to suggested changes. Removed mingw-libvirt.spec.in changes since virt lxc probably can not be supported in Windows. Not sure if I need to make changes so my code will not build on that platform. Did not make the changes to install virt-login-shell as 4755 automatically. I guess I want a more firm, make that change request... I did not make a helper function to parse a list of strings out of conf file. The getuid and getgid calls return the user that executed the program, when the app is setuid geteuid and getegid return "0". I believe getuid and getgid are correct. Added virt-login-shell --help, not sure what --program would do? The program is hard coded to LXC because there is no way that I know of for a ZZ process to join a running qemu instance. I have heard back from one security review from Miloslav Trmac, who had similar comments as Eric.

4 11

[libvirt] [PATCHv4 0/5] Handling of undefine and redefine snapshots with VirtualBox 4.2
by Manuel VIVES 03 Jan '14

03 Jan '14

Hi, This is a serie of patches in order to support undefining and redefining snapshots with VirtualBox 4.2. The serie of patches is rather big, and adds among other things some utility functions unrelated to VirtualBox in patches 1 & 2. The code review could be done in several parts: e.g. patches 1 & 2 separately to validate the utility functions. The VirtualBox API provides only high level operations to manipulate snapshots, so it not possible to support flags like VIR_DOMAIN_SNAPSHOT_CREATE_REDEFINE and VIR_DOMAIN_SNAPSHOT_DELETE_METADATA_ONLY with only API calls. Following an IRC talk with Eric Blake, the decision was taken to emulate these behaviours by manipulating directly the .vbox XML files. The first two patches are some util methods for handling uuid and strings that will be used after. The third patch brings more details in the snapshot XML returned by libvirt. We will need those modifications in order to redefine the snapshots. The fourth patch brings the support of the VIR_DOMAIN_SNAPSHOT_CREATE_REDEFINE and VIR_DOMAIN_SNAPSHOT_CREATE_CURRENT flags in virDomainSnapshotCreateXML. The fifth and last patch brings the support of the VIR_DOMAIN_SNAPSHOT_DELETE_METADATA_ONLY flag in virDomainSnapshotDelete. The patches are only tested with Virtualbox 4.2 but the code is compliant with Virtualbox 4.3 API. Regards, Manuel VIVES V4: * The code is compliant with Virtualbox 4.3 API * Some minor modifications in order to satisfy "make syntax-check" V3: * Use of STREQ_NULLABLE instead of STREQ in one case * Fix the method for finding uuids according to Ján Tomko review V2: * Fix a licence problem with the method for string replacement Manuel VIVES (5): viruuid.h/c: Util method for finding uuid patterns in some strings virstring.h/c: Util method for making some find and replace in strings vbox_tmpl.c: Better XML description for snapshots vbox_tmpl.c: Patch for redefining snapshots vbox_tmpl.c: Add methods for undefining snapshots po/POTFILES.in | 1 + src/conf/domain_conf.c | 2 +- src/libvirt_private.syms | 2 + src/util/virstring.c | 48 ++ src/util/virstring.h | 2 + src/util/viruuid.c | 81 ++ src/util/viruuid.h | 1 + src/vbox/vbox_tmpl.c | 1854 +++++++++++++++++++++++++++++++++++++++++++--- 8 files changed, 1879 insertions(+), 112 deletions(-) -- 1.7.10.4

3 17

[libvirt] [PATCH] event: don't overwrite registration error message
by Eric Blake 02 Jan '14

02 Jan '14

Prior to this patch, an attempt to register an event without an event loop started results in the vague: libvirt: Remote Driver error : adding cb to list Now it gives the much nicer: libvirt: error : internal error: could not initialize domain event timer This also avoids hiding other reasonable error messages, such as attempts to register a duplicate callback or OOM errors. Also, document the event loop usage requirement, since that was how I ran into the issue. * src/remote/remote_driver.c (remoteConnectNetworkEventRegisterAny) (remoteConnectDomainEventRegister) (remoteConnectDomainEventRegisterAny): Preserve more detailed error. * src/libvirt.c (virConnectDomainEventRegister) (virConnectDomainEventRegisterAny) (virConnectNetworkEventRegisterAny): Document event loop requirement. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- src/libvirt.c | 24 +++++++++++++++--------- src/remote/remote_driver.c | 12 +++--------- 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/src/libvirt.c b/src/libvirt.c index 90773bb..f8b11b3 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -14829,11 +14829,13 @@ error: * @freecb: optional function to deallocate opaque when not used anymore * * Adds a callback to receive notifications of domain lifecycle events - * occurring on a connection + * occurring on a connection. This function requires that an event loop + * has been previously registered with virEventRegisterImpl() or + * virEventRegisterDefaultImpl(). * * Use of this method is no longer recommended. Instead applications * should try virConnectDomainEventRegisterAny() which has a more flexible - * API contract + * API contract. * * The virDomainPtr object handle passed into the callback upon delivery * of an event is only valid for the duration of execution of the callback. @@ -14842,7 +14844,7 @@ error: * The reference can be released once the object is no longer required * by calling virDomainFree. * - * Returns 0 on success, -1 on failure + * Returns 0 on success, -1 on failure. */ int virConnectDomainEventRegister(virConnectPtr conn, @@ -17541,10 +17543,12 @@ error: * @freecb: optional function to deallocate opaque when not used anymore * * Adds a callback to receive notifications of arbitrary domain events - * occurring on a domain. + * occurring on a domain. This function requires that an event loop + * has been previously registered with virEventRegisterImpl() or + * virEventRegisterDefaultImpl(). * * If @dom is NULL, then events will be monitored for any domain. If @dom - * is non-NULL, then only the specific domain will be monitored + * is non-NULL, then only the specific domain will be monitored. * * Most types of event have a callback providing a custom set of parameters * for the event. When registering an event, it is thus necessary to use @@ -17562,7 +17566,7 @@ error: * for the callback. To unregister a callback, this callback ID should * be passed to the virConnectDomainEventDeregisterAny() method. * - * Returns a callback identifier on success, -1 on failure + * Returns a callback identifier on success, -1 on failure. */ int virConnectDomainEventRegisterAny(virConnectPtr conn, @@ -17657,10 +17661,12 @@ error: * @freecb: optional function to deallocate opaque when not used anymore * * Adds a callback to receive notifications of arbitrary network events - * occurring on a network. + * occurring on a network. This function requires that an event loop + * has been previously registered with virEventRegisterImpl() or + * virEventRegisterDefaultImpl(). * * If @net is NULL, then events will be monitored for any network. If @net - * is non-NULL, then only the specific network will be monitored + * is non-NULL, then only the specific network will be monitored. * * Most types of event have a callback providing a custom set of parameters * for the event. When registering an event, it is thus necessary to use @@ -17678,7 +17684,7 @@ error: * for the callback. To unregister a callback, this callback ID should * be passed to the virConnectNetworkEventDeregisterAny() method. * - * Returns a callback identifier on success, -1 on failure + * Returns a callback identifier on success, -1 on failure. */ int virConnectNetworkEventRegisterAny(virConnectPtr conn, diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index be282d6..11785e2 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -2932,10 +2932,8 @@ remoteConnectNetworkEventRegisterAny(virConnectPtr conn, net, eventID, VIR_OBJECT_EVENT_CALLBACK(callback), opaque, freecb, - &callbackID)) < 0) { - virReportError(VIR_ERR_RPC, "%s", _("adding cb to list")); + &callbackID)) < 0) goto done; - } /* If this is the first callback for this eventID, we need to enable * events on the server */ @@ -4424,10 +4422,8 @@ static int remoteConnectDomainEventRegister(virConnectPtr conn, remoteDriverLock(priv); if ((count = virDomainEventStateRegister(conn, priv->domainEventState, - callback, opaque, freecb)) < 0) { - virReportError(VIR_ERR_RPC, "%s", _("adding cb to list")); + callback, opaque, freecb)) < 0) goto done; - } if (count == 1) { /* Tell the server when we are the first callback deregistering */ @@ -5234,10 +5230,8 @@ static int remoteConnectDomainEventRegisterAny(virConnectPtr conn, priv->domainEventState, dom, eventID, callback, opaque, freecb, - &callbackID)) < 0) { - virReportError(VIR_ERR_RPC, "%s", _("adding cb to list")); + &callbackID)) < 0) goto done; - } /* If this is the first callback for this eventID, we need to enable * events on the server */ -- 1.8.4.2

2 3