July 2015 - Devel - libvirt List Archives

[libvirt] mass create vm errors
by Vasiliy Tolstov 04 Aug '15

04 Aug '15

Hi again =). I have another problem then testing libvirt with massive vm start: 2015-07-18 08:25:21.687+0000: 36893: error : qemuMonitorIO:750 : internal error: early end of file from monitor: possible problem: 2015-07-18T08:25:21.586487Z qemu-system-x86_64: -vnc [::]:4,password: Failed to start VNC server: Failed to bind socket: Address already in use As i understand, when libvirt try to detect free port for vnc it fails, because another process already binds to it. How can i avoid this errors? Does it fixed in never libvirt releases? libvirt 1.216 qemu 2.4.0-rc0 -- Vasiliy Tolstov, e-mail: v.tolstov(a)selfip.ru

2 3

[libvirt] [PATCH 0/2] Adjustments for configuring volume lun device
by John Ferlan 04 Aug '15

04 Aug '15

Resolve a couple of issues regarding failures seen configuring a disk to be a type='volume' device='lun'. The doc patch just indicates that using an NPIV storage/source pool is a valid option. The second patch allows for a "clearer" error message to be reported. John Ferlan (2): docs: Add Fibre Channel NPIV supported option for volume lun config conf: Allow error reporting in virDomainDiskSourceIsBlockType docs/formatdomain.html.in | 6 ++++-- src/conf/domain_conf.c | 21 ++++++++++++++++++--- src/conf/domain_conf.h | 2 +- src/lxc/lxc_cgroup.c | 2 +- src/lxc/lxc_driver.c | 6 ++---- src/qemu/qemu_command.c | 5 +---- src/qemu/qemu_conf.c | 6 +++--- 7 files changed, 30 insertions(+), 18 deletions(-) -- 2.1.0

2 6

[libvirt] [PATCH v2 0/3] Disable floppy disk for PowerPC VMs
by Kothapally Madhu Pavan 04 Aug '15

04 Aug '15

This is an attempt to fix: Libvirt BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1180486 Libvirt currently assumes ISA_based floppy disks to be available across all architectures and machine types. However, PowerPC Book 3S compatible ('ie pseries) virtual machines do not support Floppy disks. This patch series prevents libvirt from launching ppc64[le] -based 'pseries' VMs with floppy devices. This version of patch attempts to fulfill the coments of Andrea Bolognani and Jan Tomko on previous version of patch. --- Kothapally Madhu Pavan (3): Caps: Disable floppy disk for PowerPC VM Avoid starting a PowerPC VM with floppy disk test: Introduce test case to disallow floppy disk on pseries src/qemu/qemu_capabilities.c | 15 +++++-- src/qemu/qemu_command.c | 8 ++++ .../qemuxml2argv-disk-floppy-pseries.args | 6 +++ .../qemuxml2argv-disk-floppy-pseries.xml | 41 ++++++++++++++++++++ tests/qemuxml2argvtest.c | 1 5 files changed, 67 insertions(+), 4 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-floppy-pseries.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-floppy-pseries.xml -- Kothapally Madhu Pavan

3 6

[libvirt] [PATCH 00/13] Move generic virsh data to a separate module vsh
by Erik Skultety 04 Aug '15

04 Aug '15

The idea behind this is that in order to introduce virt-admin client (and later some commands/APIs), there are lots of methods in virsh that can be easily reused by other potential clients like command and command argument passing or error reporting. !!! IMPORTANT !!! These patches cannot be compiled separately, the series is split more or less logically into chunks only to be more readable by the reviewer. I started this at least 4 times from scratch and still haven't found a way that splitting virsh could be done with several independent applicable commits, rather than having one massive commit in the end. Erik Skultety (13): tools: Introduce new client generic module vsh vsh: Remove client specific data, only generic data are kept tools: apply s/vshX/virshX to all virsh specific data virsh: remove generic data, only client specific are kept virsh: Rename client specific methods in virsh.h vsh: vshControl now includes client private data and client specific progname vsh: Make use of introduced private data vsh: Introduce client hooks vsh: Make use of newly introduced client side hooks vsh: Introduce new global initializer vsh: Make separated generic methods public virsh: Introduce connection handler tools: Update makefile to include 'vsh' sources as well cfg.mk | 2 +- po/POTFILES.in | 3 +- tools/Makefile.am | 4 + tools/virsh-console.c | 13 +- tools/virsh-console.h | 8 +- tools/virsh-domain-monitor.c | 201 ++-- tools/virsh-domain-monitor.h | 4 +- tools/virsh-domain.c | 532 +++++---- tools/virsh-domain.h | 14 +- tools/virsh-edit.c | 8 +- tools/virsh-host.c | 131 ++- tools/virsh-interface.c | 80 +- tools/virsh-interface.h | 12 +- tools/virsh-network.c | 72 +- tools/virsh-network.h | 10 +- tools/virsh-nodedev.c | 37 +- tools/virsh-nwfilter.c | 33 +- tools/virsh-nwfilter.h | 10 +- tools/virsh-pool.c | 104 +- tools/virsh-pool.h | 10 +- tools/virsh-secret.c | 27 +- tools/virsh-snapshot.c | 75 +- tools/virsh-volume.c | 103 +- tools/virsh-volume.h | 14 +- tools/virsh.c | 2673 ++++-------------------------------------- tools/virsh.h | 481 +------- tools/vsh.c | 2332 ++++++++++++++++++++++++++++++++++++ tools/vsh.h | 489 ++++++++ 28 files changed, 3906 insertions(+), 3576 deletions(-) create mode 100644 tools/vsh.c create mode 100644 tools/vsh.h -- 1.9.3

3 20

[libvirt] libvirt 1.2.17 fails
by Jason Helfman 03 Aug '15

03 Aug '15

Hello All, I am getting build failures on the latest build, and it is currently blocking my commit of the update. Looks like xhtml, is a new build requirement. I added it to the list of dependencies, however it is failing to build within our build cluster. http://meatwad.mouf.net/rubick/poudriere/data/93i386-jgh/2015-07-27_15h41m2… (also attached for historical purposes) I am able to get this to build locally, but trying to distinguish what is different compared with a clean system. Here is the listing of files contained in the xhtml package: xhtml-1.0.20020801_4: /usr/local/share/xml/dtd/xhtml/catalog.xml /usr/local/share/xml/dtd/xhtml/xhtml-dcl.soc /usr/local/share/xml/dtd/xhtml/xhtml-lat1.ent /usr/local/share/xml/dtd/xhtml/xhtml-special.ent /usr/local/share/xml/dtd/xhtml/xhtml-symbol.ent /usr/local/share/xml/dtd/xhtml/xhtml.soc /usr/local/share/xml/dtd/xhtml/xhtml1-frameset.dtd /usr/local/share/xml/dtd/xhtml/xhtml1-strict.dtd /usr/local/share/xml/dtd/xhtml/xhtml1-transitional.dtd /usr/local/share/xml/dtd/xhtml/xhtml1.dcl Thanks in advance! Jason -- Jason Helfman | FreeBSD Committer jgh(a)FreeBSD.org | http://people.freebsd.org/~jgh | The Power to Serve

2 3

[libvirt] [PATCH v11 0/5] nodeinfo: Add support for subcores
by Andrea Bolognani 03 Aug '15

03 Aug '15

Only patch 1/5 has been updated, all the other patches are the same as v8: 2/5 https://www.redhat.com/archives/libvir-list/2015-July/msg01045.html 3/5 https://www.redhat.com/archives/libvir-list/2015-July/msg01048.html 4/5 https://www.redhat.com/archives/libvir-list/2015-July/msg01049.html 5/5 https://www.redhat.com/archives/libvir-list/2015-July/msg01050.html I'm including the full history below. Cheers. Changes in v11: * don't declare variables only used inside a code block guarded by #ifdef outside of said code block * use virBitmapNextSetBit() instead of going through all possible index values and calling virBitmapIsBitSet() for each one Changes in v10: * don't attempt to close a file that wasn't opened * report a detailed error to help with diagnosis Changes in v9: * take into account the fact that kvm might not be loaded or even installed Changes in v8: * shortened test names so that make dist doesn't stop working again Changes in v7: * rebased on top of master now that the series this one builds on have been merged Changes in v6: * updated to work on top of [PATCH v2 00/10] nodeinfo: Various cleanups Changes in v5: * streamlined the logic used to decide whether the subcore configuration is valid and moved it to a separate function * split the tests into separate commits for easier review and to hopefully avoid having trouble with the list due to the message size Changes in v4: * removed a printf() statement * fixed typo in a commit message Changes in v3: * the function to get the number of threads per subcore has been moved to the from virarch.c, which deals with architecture names only and is therefore not the right place to read host configuration, to nodeinfo.c where the rest of this stuff lives * said function has also been given a shorter name * the "valid subcore mode" boolean has been removed: threads_per_subcore will be a positive number if subcores should be taken into account, and if that's not the case (x86 host, tainted configuration) it will simply be zero, so now the code needs to keep track of a single variable instead of two * the test case has been renamed to be more descriptive * the test data has been cleaned up by removing all cpu/cpu*/node* links, which prevented 'make dist' from working due to recursive linking Andrea Bolognani (3): tests: Add subcores1 nodeinfo test tests: Add subcores2 nodeinfo test tests: Add subcores3 nodeinfo test Shivaprasad G Bhat (2): nodeinfo: Fix output on PPC64 KVM hosts tests: Prepare for subcore tests src/libvirt_private.syms | 1 + src/nodeinfo.c | 153 ++++++++++++++++++++- src/nodeinfo.h | 1 + tests/Makefile.am | 6 + [...] tests/nodeinfomock.c | 35 +++++ tests/nodeinfotest.c | 8 +- 1348 files changed, 2134 insertions(+), 6 deletions(-) [...] create mode 100644 tests/nodeinfomock.c -- 2.4.3

2 3

[libvirt] [PATCH] qemu: Remove double unlock for domains
by Martin Kletzander 03 Aug '15

03 Aug '15

The virDomainObjListRemove() function unlocks a domain that it's given due to legacy code. And because of that code, which should be refactored, that last virObjectUnlock() cannot be just removed. So instead, lock it right back for qemu for now. All calls to qemuDomainRemoveInactive() are followed by code that unlocks the domain again, plus the domain should be locked during qemuDomainObjEndJob(), so the right place to lock it is right after virDomainObjListRemove(). The only place where this would cause a problem is the autodestroy callback, so we need to get another reference there and uref+unlock it afterwards. Luckily, returning NULL from that function doesn't mean an error, and only means that it doesn't need to be unlocked anymore. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- src/qemu/qemu_domain.c | 7 +++++++ src/qemu/qemu_process.c | 7 ++++--- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 8b050a043995..d6d723112638 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -2593,6 +2593,13 @@ qemuDomainRemoveInactive(virQEMUDriverPtr driver, virObjectRef(vm); virDomainObjListRemove(driver->domains, vm); + /* + * virDomainObjListRemove() leaves the domain unlocked so it can + * be unref'd for other drivers that depend on that, but we still + * need to reset a job and we have a reference from the API that + * called this function. So we need to lock it back. + */ + virObjectLock(vm); virObjectUnref(cfg); if (haveJob) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 1c0c734c3811..df38dacdca92 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -5696,6 +5696,8 @@ qemuProcessAutoDestroy(virDomainObjPtr dom, VIR_DEBUG("vm=%s, conn=%p", dom->def->name, conn); + virObjectRef(dom); + if (priv->job.asyncJob) { VIR_DEBUG("vm=%s has long-term job active, cancelling", dom->def->name); @@ -5718,15 +5720,14 @@ qemuProcessAutoDestroy(virDomainObjPtr dom, qemuDomainObjEndJob(driver, dom); - if (!dom->persistent) { + if (!dom->persistent) qemuDomainRemoveInactive(driver, dom); - dom = NULL; - } if (event) qemuDomainEventQueue(driver, event); cleanup: + virDomainObjEndAPI(&dom); return dom; } -- 2.4.5

2 5

[libvirt] [PATCH 0/2] qemu: Improve memory alignment handling and fix upcoming powerpc
by Peter Krempa 03 Aug '15

03 Aug '15

Peter Krempa (2): qemu: Make memory alignment helper more universal qemu: ppc64: Align memory sizes to 256MiB src/qemu/qemu_domain.c | 33 ++++++++++++++++------ src/qemu/qemu_domain.h | 3 +- src/qemu/qemu_hotplug.c | 4 +-- .../qemuxml2argv-pseries-cpu-compat.args | 2 +- 4 files changed, 30 insertions(+), 12 deletions(-) -- 2.4.5

2 5

[libvirt] ambiguous ret of qemuDomainDetachVirtioDiskDevice
by zhang bo 03 Aug '15

03 Aug '15

static int qemuDomainDetachVirtioDiskDevice(virQEMUDriverPtr driver, virDomainObjPtr vm, virDomainDiskDefPtr detach) { ....... rc = qemuDomainWaitForDeviceRemoval(vm); if (rc == 0 || rc == 1) ret = qemuDomainRemoveDiskDevice(driver, vm, detach); else ret = 0; /*the return value of 2 is dismissed here, which refers to ETIMEOUT.*/ ........ } ------------------------------------ If it timeouts when qemu tries to del the device, the return value would be modified from 2 to 0 in function qemuDomainDetachVirtioDiskDevice(), which means that, the users would be misleaded that the device has been deleted, however, the device maybe probably failed to be detached after timeout and still in use. That is to say, the function qemuDomainDetachVirtioDiskDevice()'s return value is ambiguous when it's 0, maybe successful, or timeout. Will it be better to pass ETIMEOUT to user? or any other advises? for example, let users themselves dumpxml the guest to check whether the device has been actually detached or not? -- Oscar oscar.zhangbo(a)huawei.com

2 4

[libvirt] [PATCH] lxc: Add option to inherit namespace from a name container or a pid or a netns
by ik.nitk 03 Aug '15

03 Aug '15

lxc / docker containers gives option to inherit the namespaces. Example lxc-start has option [ --share-[net|ipc|uts] name|pid ] where --share-net name|pid means Inherit a network namespace from a name container or a pid. This patch tries to add the similar option to libvirt lxc. So to inherit namespace from name container c2. add this into xml. <lxc:namespace> <sharenet type='name' value='c2'/> </lxc:namespace> And to inherit namespace from a pid. add this into xml. <lxc:namespace> <sharenet type='pid' value='10245'/> </lxc:namespace> And to inherit namespace from a netns. add this into xml. <lxc:namespace> <sharenet type='netns' value='red'/> </lxc:namespace> Similar options for ipc/uts. <shareipc /> , <shareuts /> The reasong lxc xml namespace is added because this feature is very specific to lxc. Therfore wanted to keep it seperated from actual libvirt xml domain. So the final vrish xml file would look like <domain type='lxc' xmlns:lxc='http://libvirt.org/schemas/domain/lxc/1.0'> <name>cn-03</name> <memory>327680</memory> <os> <type>exe</type> <init>/sbin/init</init> </os> <lxc:namespace> <sharenet type='netns' value='red'/> </lxc:namespace> <vcpu>1</vcpu> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> <devices> <emulator>/usr/lib/libvirt/libvirt_lxc</emulator> <filesystem type='mount'> <source dir='/var/lib/lxc/u1/rootfs'/> <target dir='/'/> </filesystem> <console type='pty'/> </devices> </domain> -imran --- src/Makefile.am | 5 +- src/lxc/lxc_conf.c | 2 +- src/lxc/lxc_conf.h | 23 +++++ src/lxc/lxc_container.c | 191 ++++++++++++++++++++++++++++++++++-- src/lxc/lxc_domain.c | 254 +++++++++++++++++++++++++++++++++++++++++++++++- src/lxc/lxc_domain.h | 1 + 6 files changed, 463 insertions(+), 13 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index 579421d..1a78fde 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1293,7 +1293,8 @@ libvirt_driver_lxc_impl_la_CFLAGS = \ -I$(srcdir)/access \ -I$(srcdir)/conf \ $(AM_CFLAGS) -libvirt_driver_lxc_impl_la_LIBADD = $(CAPNG_LIBS) $(LIBNL_LIBS) $(FUSE_LIBS) +libvirt_driver_lxc_impl_la_LIBADD = $(CAPNG_LIBS) $(LIBNL_LIBS) $(LIBXML_LIBS) $(FUSE_LIBS) +libvirt_driver_lxc_impl_la_LDFLAGS = libvirt-lxc.la if WITH_BLKID libvirt_driver_lxc_impl_la_CFLAGS += $(BLKID_CFLAGS) libvirt_driver_lxc_impl_la_LIBADD += $(BLKID_LIBS) @@ -2652,6 +2653,8 @@ libvirt_lxc_LDADD = \ libvirt-net-rpc.la \ libvirt_security_manager.la \ libvirt_conf.la \ + libvirt.la \ + libvirt-lxc.la \ libvirt_util.la \ ../gnulib/lib/libgnu.la if WITH_DTRACE_PROBES diff --git a/src/lxc/lxc_conf.c b/src/lxc/lxc_conf.c index c393cb5..96a0f47 100644 --- a/src/lxc/lxc_conf.c +++ b/src/lxc/lxc_conf.c @@ -213,7 +213,7 @@ lxcDomainXMLConfInit(void) { return virDomainXMLOptionNew(&virLXCDriverDomainDefParserConfig, &virLXCDriverPrivateDataCallbacks, - NULL); + &virLXCDriverDomainXMLNamespace); } diff --git a/src/lxc/lxc_conf.h b/src/lxc/lxc_conf.h index 8340b1f..59002e5 100644 --- a/src/lxc/lxc_conf.h +++ b/src/lxc/lxc_conf.h @@ -67,6 +67,29 @@ struct _virLXCDriverConfig { bool securityRequireConfined; }; + +typedef enum { + VIR_DOMAIN_NAMESPACE_SHARENET = 0, + VIR_DOMAIN_NAMESPACE_SHAREIPC, + VIR_DOMAIN_NAMESPACE_SHAREUTS, + VIR_DOMAIN_NAMESPACE_LAST, +} virDomainNamespace; + +struct ns_info { + const char *proc_name; + int clone_flag; +}; + +extern const struct ns_info ns_info[VIR_DOMAIN_NAMESPACE_LAST]; + +typedef struct _lxcDomainDef lxcDomainDef; +typedef lxcDomainDef *lxcDomainDefPtr; +struct _lxcDomainDef { + int ns_inherit_fd[VIR_DOMAIN_NAMESPACE_LAST]; + char *ns_type[VIR_DOMAIN_NAMESPACE_LAST]; + char *ns_val[VIR_DOMAIN_NAMESPACE_LAST]; +}; + struct _virLXCDriver { virMutex lock; diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 9a9ae5c..a9a7ba0 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -25,8 +25,8 @@ */ #include <config.h> - #include <fcntl.h> +#include <sched.h> #include <limits.h> #include <stdlib.h> #include <stdio.h> @@ -38,7 +38,6 @@ #include <mntent.h> #include <sys/reboot.h> #include <linux/reboot.h> - /* Yes, we want linux private one, for _syscall2() macro */ #include <linux/unistd.h> @@ -99,6 +98,50 @@ VIR_LOG_INIT("lxc.lxc_container"); typedef char lxc_message_t; #define LXC_CONTINUE_MSG 'c' +#ifdef __linux__ +/* + * Workaround older glibc. While kernel may support the setns + * syscall, the glibc wrapper might not exist. If that's the + * case, use our own. + */ +# ifndef __NR_setns +# if defined(__x86_64__) +# define __NR_setns 308 +# elif defined(__i386__) +# define __NR_setns 346 +# elif defined(__arm__) +# define __NR_setns 375 +# elif defined(__aarch64__) +# define __NR_setns 375 +# elif defined(__powerpc__) +# define __NR_setns 350 +# elif defined(__s390__) +# define __NR_setns 339 +# endif +# endif + +# ifndef HAVE_SETNS +# if defined(__NR_setns) +# include <sys/syscall.h> + +static inline int setns(int fd, int nstype) +{ + return syscall(__NR_setns, fd, nstype); +} +# else /* !__NR_setns */ +# error Please determine the syscall number for setns on your architecture +# endif +# endif +#else /* !__linux__ */ +static inline int setns(int fd ATTRIBUTE_UNUSED, int nstype ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENOSYS, "%s", + _("Namespaces are not supported on this platform.")); + return -1; +} +#endif + + typedef struct __lxc_child_argv lxc_child_argv_t; struct __lxc_child_argv { virDomainDefPtr config; @@ -2233,7 +2276,6 @@ static int lxcContainerChild(void *data) vmDef->os.init); goto cleanup; } - /* rename and enable interfaces */ if (lxcContainerRenameAndEnableInterfaces(vmDef, argv->nveths, @@ -2321,6 +2363,99 @@ virArch lxcContainerGetAlt32bitArch(virArch arch) return VIR_ARCH_NONE; } +/* Used only for containers,same as the one defined in + * domain_conf.c. But used locally + */ +static const struct ns_info ns_info_local[VIR_DOMAIN_NAMESPACE_LAST] = { + [VIR_DOMAIN_NAMESPACE_SHARENET] = {"net", CLONE_NEWNET}, + [VIR_DOMAIN_NAMESPACE_SHAREIPC] = {"ipc", CLONE_NEWIPC}, + [VIR_DOMAIN_NAMESPACE_SHAREUTS] = {"uts", CLONE_NEWUTS} +}; + + +static void close_ns(int ns_fd[VIR_DOMAIN_NAMESPACE_LAST]) +{ + int i; + for (i = 0; i < VIR_DOMAIN_NAMESPACE_LAST; i++) { + if (ns_fd[i] > -1) { + if (VIR_CLOSE(ns_fd[i]) < 0) + virReportSystemError(errno, "%s", _("failed to close file")); + ns_fd[i] = -1; + } + } +} + + +/** + * lxcPreserve_ns: + * @ns_fd: array to store current namespace + * @clone_flags: namespaces that need to be preserved + */ +static int lxcPreserve_ns(int ns_fd[VIR_DOMAIN_NAMESPACE_LAST], int clone_flags) +{ + int i, saved_errno; + char *path = NULL; + + for (i = 0; i < VIR_DOMAIN_NAMESPACE_LAST; i++) + ns_fd[i] = -1; + + if (access("/proc/self/ns", X_OK)) { + virReportSystemError(errno, "%s", + _("Kernel does not support attach; preserve_ns ignored")); + return 0; + } + + for (i = 0; i < VIR_DOMAIN_NAMESPACE_LAST; i++) { + if ((clone_flags & ns_info_local[i].clone_flag) == 0) + continue; + if (virAsprintf(&path, "/proc/self/ns/%s", + ns_info_local[i].proc_name) < 0) + goto error; + ns_fd[i] = open(path, O_RDONLY | O_CLOEXEC); + if (ns_fd[i] < 0) + goto error; + } + VIR_FREE(path); + return 0; + error: + saved_errno = errno; + close_ns(ns_fd); + errno = saved_errno; + VIR_FREE(path); + virReportSystemError(errno, _("failed to open '%s'"), path); + return -1; +} + +/** + * lxcAttach_ns: + * @ns_fd: array of namespaces to attach + */ +static int lxcAttach_ns(const int ns_fd[VIR_DOMAIN_NAMESPACE_LAST]) +{ + int i; + + for (i = 0; i < VIR_DOMAIN_NAMESPACE_LAST; i++) { + if (ns_fd[i] < 0) + continue; + VIR_DEBUG("Setting into namespace\n"); + + /* We get EINVAL if new NS is same as the current + * NS, or if the fd namespace doesn't match the + * type passed to setns()'s second param. Since we + * pass 0, we know the EINVAL is harmless + */ + if (setns(ns_fd[i], 0) < 0 && + errno != EINVAL) + goto error; + } + return 0; + + error: + virReportSystemError(errno, _("failed to set namespace '%s'") + , ns_info_local[i].proc_name); + return -1; +} + /** * lxcContainerStart: @@ -2346,9 +2481,12 @@ int lxcContainerStart(virDomainDefPtr def, char **ttyPaths) { pid_t pid; - int cflags; + int cflags, i; int stacksize = getpagesize() * 4; char *stack, *stacktop; + int saved_ns_fd[VIR_DOMAIN_NAMESPACE_LAST]; + int preserve_mask = 0; + lxcDomainDefPtr lxcDef; lxc_child_argv_t args = { .config = def, .securityDriver = securityDriver, @@ -2368,7 +2506,14 @@ int lxcContainerStart(virDomainDefPtr def, stacktop = stack + stacksize; - cflags = CLONE_NEWPID|CLONE_NEWNS|CLONE_NEWUTS|CLONE_NEWIPC|SIGCHLD; + lxcDef = def->namespaceData; + for (i = 0; i < VIR_DOMAIN_NAMESPACE_LAST; i++) + if (lxcDef && lxcDef->ns_inherit_fd[i] != -1) + preserve_mask |= ns_info_local[i].clone_flag; + + + + cflags = CLONE_NEWPID|CLONE_NEWNS|SIGCHLD; if (userns_required(def)) { if (userns_supported()) { @@ -2381,10 +2526,36 @@ int lxcContainerStart(virDomainDefPtr def, return -1; } } + if (!lxcDef || (lxcDef && lxcDef->ns_inherit_fd[VIR_DOMAIN_NAMESPACE_SHARENET] == -1)) { + if (lxcNeedNetworkNamespace(def)) { + VIR_DEBUG("Enable network namespaces"); + cflags |= CLONE_NEWNET; + } + } else { + VIR_DEBUG("Inheriting a net namespace"); + } - if (lxcNeedNetworkNamespace(def)) { - VIR_DEBUG("Enable network namespaces"); - cflags |= CLONE_NEWNET; + if (!lxcDef || (lxcDef && lxcDef->ns_inherit_fd[VIR_DOMAIN_NAMESPACE_SHAREIPC] == -1)) { + cflags |= CLONE_NEWIPC; + } else { + VIR_DEBUG("Inheriting an IPC namespace"); + } + + if (!lxcDef || (lxcDef && lxcDef->ns_inherit_fd[VIR_DOMAIN_NAMESPACE_SHAREUTS] == -1)) { + cflags |= CLONE_NEWUTS; + } else { + VIR_DEBUG("Inheriting a UTS namespace"); + } + + if (lxcDef && lxcPreserve_ns(saved_ns_fd, preserve_mask) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, "%s", + _("failed to preserve the namespace")); + return -1; + } + if (lxcDef && lxcAttach_ns(lxcDef->ns_inherit_fd) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, "%s", + _("failed to attach the namespace")); + return -1; } VIR_DEBUG("Cloning container init process"); @@ -2397,6 +2568,10 @@ int lxcContainerStart(virDomainDefPtr def, _("Failed to run clone container")); return -1; } + if (lxcDef && lxcAttach_ns(saved_ns_fd)) { + virReportError(VIR_ERR_SYSTEM_ERROR, "%s", + _("failed to restore saved namespaces")); + } return pid; } diff --git a/src/lxc/lxc_domain.c b/src/lxc/lxc_domain.c index c2180cb..6e4a19a 100644 --- a/src/lxc/lxc_domain.c +++ b/src/lxc/lxc_domain.c @@ -20,14 +20,18 @@ */ #include <config.h> - #include "lxc_domain.h" - #include "viralloc.h" #include "virlog.h" #include "virerror.h" +#include <fcntl.h> +#include <libxml/xpathInternals.h> +#include "virstring.h" +#include "virutil.h" +#include "virfile.h" #define VIR_FROM_THIS VIR_FROM_LXC +#define LXC_NAMESPACE_HREF "http://libvirt.org/schemas/domain/lxc/1.0" VIR_LOG_INIT("lxc.lxc_domain"); @@ -41,6 +45,251 @@ static void *virLXCDomainObjPrivateAlloc(void) return priv; } + +static int open_ns(const char *nnsname_pid, const char *ns_proc_name) +{ + int fd = -1; + virDomainPtr dom = NULL; + virConnectPtr conn = NULL; + pid_t pid; + int nfdlist; + int *fdlist; + char *path = NULL; + char *eptr; + pid = strtol(nnsname_pid, &eptr, 10); + if (*eptr != '\0' || pid < 1) { + /* check if the domain is running, then set the namespaces + * to that container + */ + size_t i = 0; + const char *ns[] = { "user", "ipc", "uts", "net", "pid", "mnt" }; + conn = virConnectOpen("lxc:///"); + if (!conn) + goto cleanup; + dom = virDomainLookupByName(conn, nnsname_pid); + if (!dom) + goto cleanup; + if ((nfdlist = virDomainLxcOpenNamespace(dom, &fdlist, 0)) < 0) + goto cleanup; + /* Internally above function calls virProcessGetNamespaces + * function which opens ns + * in the order { "user", "ipc", "uts", "net", "pid", "mnt" } + */ + for (i = 0; i < ARRAY_CARDINALITY(ns); i++) { + if (STREQ(ns[i], ns_proc_name)) { + fd = fdlist[i]; + break; + } + } + if (nfdlist > 0) + VIR_FREE(fdlist); + } else { + if (virAsprintf(&path, "/proc/%d/ns/%s", pid, ns_proc_name) < 0) + goto cleanup; + fd = open(path, O_RDONLY); + } +cleanup: + if (dom) + virDomainFree(dom); + VIR_FREE(path); + (fd < 0)? VIR_ERROR( + _("failed to open ns %s"), nnsname_pid): + VIR_DEBUG("OPENED NAMESPACE : fd %d\n", fd); + return fd; +} + + +/* Used only for containers */ +const struct ns_info ns_info[VIR_DOMAIN_NAMESPACE_LAST] = { + [VIR_DOMAIN_NAMESPACE_SHARENET] = {"net", CLONE_NEWNET}, + [VIR_DOMAIN_NAMESPACE_SHAREIPC] = {"ipc", CLONE_NEWIPC}, + [VIR_DOMAIN_NAMESPACE_SHAREUTS] = {"uts", CLONE_NEWUTS} +}; + +VIR_ENUM_DECL(virDomainNamespace) +VIR_ENUM_IMPL(virDomainNamespace, VIR_DOMAIN_NAMESPACE_LAST, + N_("sharenet"), + N_("shareipc"), + N_("shareuts")) + +static void +lxcDomainDefNamespaceFree(void *nsdata) +{ + int j; + lxcDomainDefPtr lxcDef = nsdata; + for (j = 0; j < VIR_DOMAIN_NAMESPACE_LAST; j++) { + if (lxcDef->ns_inherit_fd[j] > 0) { + VIR_FREE(lxcDef->ns_type); + VIR_FREE(lxcDef->ns_val); +#if 0 + if (VIR_CLOSE(lxcDef->ns_inherit_fd[j]) < 0) + virReportSystemError(errno, "%s", _("failed to close file")); +#endif + } + } + VIR_FREE(nsdata); +} + +static int +lxcDomainDefNamespaceParse(xmlDocPtr xml ATTRIBUTE_UNUSED, + xmlNodePtr root ATTRIBUTE_UNUSED, + xmlXPathContextPtr ctxt, + void **data) +{ + lxcDomainDefPtr lxcDef = NULL; + xmlNodePtr *nodes = NULL; + bool uses_lxc_ns = false; + xmlNodePtr node; + int feature; + int n; + char *tmp = NULL; + size_t i; + pid_t fd = -1; + + if (xmlXPathRegisterNs(ctxt, BAD_CAST "lxc", BAD_CAST LXC_NAMESPACE_HREF) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Failed to register xml namespace '%s'"), + LXC_NAMESPACE_HREF); + return -1; + } + + if (VIR_ALLOC(lxcDef) < 0) + return -1; + + /* Init ns_herit_fd for namespaces */ + for (i = 0; i < VIR_DOMAIN_NAMESPACE_LAST; i++) { + lxcDef->ns_inherit_fd[i] = -1; + lxcDef->ns_type[i] = NULL; + lxcDef->ns_val[i] = NULL; + } + + node = ctxt->node; + if ((n = virXPathNodeSet("./lxc:namespace/*", ctxt, &nodes)) < 0) + goto error; + uses_lxc_ns |= n > 0; + + for (i = 0; i < n; i++) { + feature = + virDomainNamespaceTypeFromString((const char *) nodes[i]->name); + if (feature < 0) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("unsupported Namespace feature: %s"), + nodes[i]->name); + goto error; + } + + ctxt->node = nodes[i]; + + switch ((virDomainNamespace) feature) { + case VIR_DOMAIN_NAMESPACE_SHARENET: + case VIR_DOMAIN_NAMESPACE_SHAREIPC: + case VIR_DOMAIN_NAMESPACE_SHAREUTS: + { + tmp = virXMLPropString(nodes[i], "type"); + if (tmp == NULL) { + virReportError(VIR_ERR_INTERNAL_ERROR, + "%s", _("No lxc environment type specified")); + goto error; + } + /* save the tmp so that its needed while writing to xml */ + lxcDef->ns_type[feature] = tmp; + tmp = virXMLPropString(nodes[i], "value"); + if (tmp == NULL) { + virReportError(VIR_ERR_INTERNAL_ERROR, + "%s", _("No lxc environment type specified")); + goto error; + } + lxcDef->ns_val[feature] = tmp; + /*netns option is only for VIR_DOMAIN_NAMESPACE_SHARENET*/ + if (STREQ("netns", lxcDef->ns_type[VIR_DOMAIN_NAMESPACE_SHARENET])) { + char *path = NULL; + if (virAsprintf(&path, "/var/run/netns/%s", tmp) < 0) + goto error; + fd = open(path, O_RDONLY); + VIR_FREE(path); + } else { + fd = open_ns(tmp, ns_info[feature].proc_name); + if (fd < 0) { + virReportError(VIR_ERR_XML_ERROR, + _("unable to open %s namespace for " + "namespace feature '%s'"), tmp, + nodes[i]->name); + goto error; + } + } + lxcDef->ns_inherit_fd[feature] = fd; + } + break; + case VIR_DOMAIN_NAMESPACE_LAST: + break; + } + } + VIR_FREE(nodes); + ctxt->node = node; + if (uses_lxc_ns) + *data = lxcDef; + else + VIR_FREE(lxcDef); + return 0; + error: + VIR_FREE(nodes); + lxcDomainDefNamespaceFree(lxcDef); + return -1; +} + + +static int +lxcDomainDefNamespaceFormatXML(virBufferPtr buf, + void *nsdata) +{ + lxcDomainDefPtr lxcDef = nsdata; + size_t j; + + if (!lxcDef) + return 0; + + virBufferAddLit(buf, "<lxc:namespace>\n"); + virBufferAdjustIndent(buf, 2); + + for (j = 0; j < VIR_DOMAIN_NAMESPACE_LAST; j++) { + switch ((virDomainNamespace) j) { + case VIR_DOMAIN_NAMESPACE_SHAREIPC: + case VIR_DOMAIN_NAMESPACE_SHAREUTS: + case VIR_DOMAIN_NAMESPACE_SHARENET: + { + if (lxcDef->ns_inherit_fd[j] > 0) { + virBufferAsprintf(buf, "<%s type='%s' value='%s'/>\n", + virDomainNamespaceTypeToString(j), + lxcDef->ns_type[j], + lxcDef->ns_val[j]); + } + } + break; + case VIR_DOMAIN_NAMESPACE_LAST: + break; + } + } + + virBufferAdjustIndent(buf, -2); + virBufferAddLit(buf, "</lxc:namespace>\n"); + return 0; +} + +static const char * +lxcDomainDefNamespaceHref(void) +{ + return "xmlns:lxc='" LXC_NAMESPACE_HREF "'"; +} + + +virDomainXMLNamespace virLXCDriverDomainXMLNamespace = { + .parse = lxcDomainDefNamespaceParse, + .free = lxcDomainDefNamespaceFree, + .format = lxcDomainDefNamespaceFormatXML, + .href = lxcDomainDefNamespaceHref, +}; + + static void virLXCDomainObjPrivateFree(void *data) { virLXCDomainObjPrivatePtr priv = data; @@ -73,7 +322,6 @@ static int virLXCDomainObjPrivateXMLParse(xmlXPathContextPtr ctxt, void *data) } else { priv->initpid = thepid; } - return 0; } diff --git a/src/lxc/lxc_domain.h b/src/lxc/lxc_domain.h index 751aece..25df999 100644 --- a/src/lxc/lxc_domain.h +++ b/src/lxc/lxc_domain.h @@ -41,6 +41,7 @@ struct _virLXCDomainObjPrivate { virCgroupPtr cgroup; }; +extern virDomainXMLNamespace virLXCDriverDomainXMLNamespace; extern virDomainXMLPrivateDataCallbacks virLXCDriverPrivateDataCallbacks; extern virDomainDefParserConfig virLXCDriverDomainDefParserConfig; -- 1.9.1

4 8