- Devel - libvirt List Archives

[libvirt] LXC: Helper function for checking ownership of dir when userns enabled
by Chen Hanxiao 09 Aug '13

09 Aug '13

From: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> If we enable userns, the ownership of dir we provided for containers should match the uid/gid in idmap. Currently, the debug log is very implicit or misleading sometimes. This patch will help clarify this for us when using debug log or virsh. Signed-off-by: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> --- src/lxc/lxc_container.c | 45 +++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 45 insertions(+), 0 deletions(-) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index b910b10..ce17466 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -1815,6 +1815,48 @@ lxcNeedNetworkNamespace(virDomainDefPtr def) return false; } +/* + * Helper function for helping check + * whether we have enough privilege + * to operate the source dir when userns enabled + * @vmDef: pointer to vm definition structure + * Returns 0 on success or -1 in case of error + */ +static int +lxcContainerUsernsSrcOwnershipCheck(virDomainDefPtr vmDef) +{ + struct stat buf; + int i; + uid_t uid; + gid_t gid; + + for(i=0; i < vmDef->nfss; i++) { + VIR_DEBUG("dst is %s, src is %s", + vmDef->fss[i]->dst, + vmDef->fss[i]->src); + + uid = vmDef->idmap.uidmap[0].target; + gid = vmDef->idmap.gidmap[0].target; + + if (lstat(vmDef->fss[i]->src, &buf) < 0) { + virReportSystemError(errno, _("Cannot access '%s'"), + vmDef->fss[i]->src); + return -1; + } else if(uid != buf.st_uid || gid != buf.st_gid) { + VIR_DEBUG("In userns uid is %d, gid is %d\n", + uid, gid); + errno = EINVAL; + + virReportSystemError(errno, + "[userns] Src dir \"%s\" does not belong to uid/gid:%d/%d", + vmDef->fss[i]->src, uid, gid); + return -1; + } + } + + return 0; +} + /** * lxcContainerStart: * @def: pointer to virtual machine structure @@ -1866,6 +1908,9 @@ int lxcContainerStart(virDomainDefPtr def, if (userns_supported()) { VIR_DEBUG("Enable user namespace"); cflags |= CLONE_NEWUSER; + if(lxcContainerUsernsSrcOwnershipCheck(def) < 0) { + return -1; + } } else { virReportSystemError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("Kernel doesn't support user namespace")); -- 1.7.1

2 2

[libvirt] [PATCH] Add a man page for virtlockd daemon
by Daniel P. Berrange 09 Aug '13

09 Aug '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> Create a virtlockd.pod.in file containing the man page content for virtlockd. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- .gitignore | 2 + libvirt.spec.in | 1 + src/Makefile.am | 24 ++++++- src/locking/virtlockd.pod.in | 158 +++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 184 insertions(+), 1 deletion(-) create mode 100644 src/locking/virtlockd.pod.in diff --git a/.gitignore b/.gitignore index ae9de0b..26bd829 100644 --- a/.gitignore +++ b/.gitignore @@ -144,6 +144,8 @@ /src/util/virkeymaps.h /src/virt-aa-helper /src/virtlockd +/src/virtlockd.8 +/src/virtlockd.8.in /src/virtlockd.init /tests/*.log /tests/*.pid diff --git a/libvirt.spec.in b/libvirt.spec.in index 79c5a2c..a95b783 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1872,6 +1872,7 @@ fi %attr(0755, root, root) %{_sbindir}/virtlockd %{_mandir}/man8/libvirtd.8* +%{_mandir}/man8/virtlockd.8* %if %{with_driver_modules} %if %{with_network} diff --git a/src/Makefile.am b/src/Makefile.am index 277f749..d351539 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -2019,9 +2019,31 @@ virtlockd.init: locking/virtlockd.init.in $(top_builddir)/config.status chmod a+x $@-t && \ mv $@-t $@ +POD2MAN = pod2man -c "Virtualization Support" \ + -r "$(PACKAGE)-$(VERSION)" -s 8 +$(srcdir)/virtlockd.8.in: locking/virtlockd.pod.in $(top_srcdir)/configure.ac + $(AM_V_GEN)$(POD2MAN) --name VIRTLOCKD $< $@ \ + && if grep 'POD ERROR' $@ ; then rm $@; exit 1; fi + +virtlockd.8: $(srcdir)/virtlockd.8.in + $(AM_V_GEN)sed \ + -e 's|[@]sysconfdir[@]|$(sysconfdir)|g' \ + -e 's|[@]localstatedir[@]|$(localstatedir)|g' \ + < $< > $@-t && \ + mv $@-t $@ + +man8_MANS = virtlockd.8 + +MAINTAINERCLEANFILES += $(srcdir)/virtlockd.8.in + +EXTRA_DIST += \ + locking/virtlockd.service.in \ + locking/virtlockd.socket.in \ + locking/virtlockd.pod.in \ + virtlockd.8.in \ + $(NULL) -EXTRA_DIST += locking/virtlockd.service.in locking/virtlockd.socket.in if WITH_LIBVIRTD if LIBVIRT_INIT_SCRIPT_SYSTEMD diff --git a/src/locking/virtlockd.pod.in b/src/locking/virtlockd.pod.in new file mode 100644 index 0000000..2621d2c --- /dev/null +++ b/src/locking/virtlockd.pod.in @@ -0,0 +1,158 @@ +=head1 NAME + +virtlockd - libvirt lock management daemon + +=head1 SYNOPSIS + +B<virtlockd> [ -dv ] [ -f config_file ] [ -p pid_file ] + +B<virtlockd> --version + +=head1 DESCRIPTION + +The B<virtlockd> program is a server side daemon component of the libvirt +virtualization management system that is used to manage locks held against +virtual machine resources, such as their disks. + +This daemon is not used directly by libvirt client applications, rather it +is called on their behalf by B<libvirtd>. By maintaining the locks in a +standalone daemon, the main libvirtd daemon can be restarted without risk +of loosing locks. The B<virtlockd> daemon has the ability to re-exec() +itself upon receiving SIGUSR1, to allow live upgrades without downtime. + +The virtlockd daemon listens for requests on a local Unix domain socket. + +=head1 OPTIONS + +=over + +=item B<-d, --daemon> + +Run as a daemon & write PID file. + +=item B<-f, --config> I<FILE> + +Use this configuration file, overriding the default value. + +=item B<-p, --pid-file> I<FILE> + +Use this name for the PID file, overriding the default value. + +=item B<-v, --verbose> + +Enable output of verbose messages. + +=item B< --version> + +Display version information then exit. + +=back + +=head1 SIGNALS + +On receipt of B<SIGUSR1> virtlockd will re-exec() its binary, while +maintaining all current locks and clients. This allows for live +upgrades of the virtlockd service. + +=head1 FILES + +=head2 When run as B<root>. + +=over + +=item F<SYSCONFDIR/virtlockd.conf> + +The default configuration file used by virtlockd, unless overridden on the +command line using the B<-f>|B<--config> option. + +=item F<LOCALSTATEDIR/run/libvirt/virtlockd-sock> + +The sockets libvirtd will use. + +=item F<LOCALSTATEDIR/run/virtlockd.pid> + +The PID file to use, unless overridden by the B<-p>|B<--pid-file> option. + +=back + +=head2 When run as B<non-root>. + +=over + +=item F<$XDG_CONFIG_HOME/virtlockd.conf> + +The default configuration file used by libvirtd, unless overridden on the +command line using the B<-f>|B<--config> option. + +=item F<$XDG_RUNTIME_DIR/libvirt/virtlockd-sock> + +The socket libvirtd will use. + +=item F<$XDG_RUNTIME_DIR/libvirt/virtlockd.pid> + +The PID file to use, unless overridden by the B<-p>|B<--pid-file> option. + +=item If $XDG_CONFIG_HOME is not set in your environment, libvirtd will use F<$HOME/.config> + +=item If $XDG_RUNTIME_DIR is not set in your environment, libvirtd will use F<$HOME/.cache> + +=back + +=head1 EXAMPLES + +To retrieve the version of virtlockd: + + # virtlockd --version + virtlockd (libvirt) 1.1.1 + # + +To start virtlockd, instructing it to daemonize and create a PID file: + + # virtlockd -d + # ls -la LOCALSTATEDIR/run/virtlockd.pid + -rw-r--r-- 1 root root 6 Jul 9 02:40 LOCALSTATEDIR/run/virtlockd.pid + # + +=head1 BUGS + +Please report all bugs you discover. This should be done via either: + +=over + +=item a) the mailing list + +L<http://libvirt.org/contact.html> + +=item or, + +B<> + +=item b) the bug tracker + +L<http://libvirt.org/bugs.html> + +=item Alternatively, you may report bugs to your software distributor / vendor. + +=back + +=head1 AUTHORS + +Please refer to the AUTHORS file distributed with libvirt. + +=head1 COPYRIGHT + +Copyright (C) 2006-2013 Red Hat, Inc., and the authors listed in the +libvirt AUTHORS file. + +=head1 LICENSE + +virtlockd is distributed under the terms of the GNU LGPL v2.1+. +This is free software; see the source for copying conditions. There +is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR +PURPOSE + +=head1 SEE ALSO + +L<libvirtd(8)>, L<http://www.libvirt.org/> + +=cut -- 1.8.3.1

2 1

[libvirt] [PATCH] tests: work with older dbus
by Eric Blake 09 Aug '13

09 Aug '13

On RHEL 5, with dbus 1.1.2, compilation failed with: virsystemdmock.c: In function 'dbus_connection_send_with_reply_and_block': virsystemdmock.c:68: warning: implicit declaration of function 'dbus_message_set_serial' Fix this by instead bypassing all attempts to use a dbus serial. * tests/virsystemdmock.c (dbus_message_set_reply_serial): Add new override. (dbus_connection_send_with_reply_and_block): No longer bother with the serial. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- I'm tempted to push this under the build-breaker rule, but it is still pending a review of this patch also for RHEL 5: https://www.redhat.com/archives/libvir-list/2013-August/msg00313.html tests/virsystemdmock.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/tests/virsystemdmock.c b/tests/virsystemdmock.c index b6c3695..ded52d2 100644 --- a/tests/virsystemdmock.c +++ b/tests/virsystemdmock.c @@ -58,6 +58,12 @@ dbus_bool_t dbus_connection_set_watch_functions(DBusConnection *connection ATTRI return 1; } +dbus_bool_t dbus_message_set_reply_serial(DBusMessage *message ATTRIBUTE_UNUSED, + dbus_uint32_t serial ATTRIBUTE_UNUSED) +{ + return 1; +} + DBusMessage *dbus_connection_send_with_reply_and_block(DBusConnection *connection ATTRIBUTE_UNUSED, DBusMessage *message, int timeout_milliseconds ATTRIBUTE_UNUSED, @@ -65,8 +71,6 @@ DBusMessage *dbus_connection_send_with_reply_and_block(DBusConnection *connectio { DBusMessage *reply = NULL; - dbus_message_set_serial(message, 7); - if (getenv("FAIL_BAD_SERVICE")) reply = dbus_message_new_error(message, "org.freedesktop.systemd.badthing", -- 1.8.3.1

2 2

[libvirt] [PATCH] build: fix compilation of virt-login-shell.c
by Jim Fehlig 09 Aug '13

09 Aug '13

virt-login-shell.c was failing to compile with CC virt_login_shell-virt-login-shell.o virt-login-shell.c: In function 'main': virt-login-shell.c:205:5: error: implicit declaration of function 'setlocale' [-Werror=implicit-function-declaration] virt-login-shell.c:205:5: error: nested extern declaration of 'setlocale' [-Werror=nested-externs] virt-login-shell.c:205:20: error: 'LC_ALL' undeclared (first use in this function) --- I'm a little surprised that others are not seeing this problem, so a bit nervious committing without an ACK. tools/virt-login-shell.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/virt-login-shell.c b/tools/virt-login-shell.c index ffbc713..b8f1a28 100644 --- a/tools/virt-login-shell.c +++ b/tools/virt-login-shell.c @@ -27,6 +27,7 @@ #include <errno.h> #include <stdlib.h> #include <fnmatch.h> +#include <locale.h> #include "internal.h" #include "virerror.h" -- 1.8.1.4

3 3

[libvirt] [PATCH 0/4] Fix handling of CA certificate chains
by Daniel P. Berrange 08 Aug '13

08 Aug '13

This series fixes the CA certificate validation so that it correctly works when a client and server cert are both signed by intermediate CAs, sharing a common ancestor CA.

4 9

[libvirt] [PATCH] configure: fix formatting of missing pkg-config modules error
by Giuseppe Scrivano 08 Aug '13

08 Aug '13

It adds an empty space after the package version. Previously the error message looked like: "You must install the dbus-1 >= 1.0.0pkg-config module to compile libvirt" Signed-off-by: Giuseppe Scrivano <gscrivan(a)redhat.com> --- m4/virt-lib.m4 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/m4/virt-lib.m4 b/m4/virt-lib.m4 index 778cd40..70400a1 100644 --- a/m4/virt-lib.m4 +++ b/m4/virt-lib.m4 @@ -336,7 +336,7 @@ AC_DEFUN([LIBVIRT_CHECK_PKG],[ fi if test $fail = 1; then - AC_MSG_ERROR([You must install the ]pc_name[ >= ]pc_version[pkg-config module to compile libvirt]) + AC_MSG_ERROR([You must install the ]pc_name[ >= ]pc_version[ pkg-config module to compile libvirt]) fi if test "x$with_var" = "xyes" ; then -- 1.8.3.1

3 2

[libvirt] [PATCH] maint: the compiler is not always named gcc
by Eric Blake 08 Aug '13

08 Aug '13

https://bugzilla.redhat.com/show_bug.cgi?id=994589 complained that even when using a cross-compiler not named 'gcc', the configure output confusingly referred to gcc. * m4/virt-compile-warnings.m4 (LIBVIRT_COMPILE_WARNINGS): Use a more generic statement in configure output. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the trivial rule. m4/virt-compile-warnings.m4 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/m4/virt-compile-warnings.m4 b/m4/virt-compile-warnings.m4 index 8731b70..6bf797f 100644 --- a/m4/virt-compile-warnings.m4 +++ b/m4/virt-compile-warnings.m4 @@ -62,7 +62,7 @@ AC_DEFUN([LIBVIRT_COMPILE_WARNINGS],[ # gcc 4.2 treats attribute(format) as an implicit attribute(nonnull), # which triggers spurious warnings for our usage - AC_CACHE_CHECK([whether gcc -Wformat allows NULL strings], + AC_CACHE_CHECK([whether the C compiler's -Wformat allows NULL strings], [lv_cv_gcc_wformat_null_works], [ save_CFLAGS=$CFLAGS CFLAGS='-Wunknown-pragmas -Werror -Wformat' @@ -101,7 +101,7 @@ AC_DEFUN([LIBVIRT_COMPILE_WARNINGS],[ dnl Check whether strchr(s, char variable) causes a bogus compile dnl warning, which is the case with GCC < 4.6 on some glibc - AC_CACHE_CHECK([whether GCC -Wlogical-op gives bogus warnings], + AC_CACHE_CHECK([whether the C compiler's -Wlogical-op gives bogus warnings], [lv_cv_gcc_wlogical_op_broken], [ save_CFLAGS="$CFLAGS" CFLAGS="-O2 -Wlogical-op -Werror" -- 1.8.3.1

2 1

[libvirt] [PATCH] Add support for detecting PPC little endian arches
by Daniel P. Berrange 08 Aug '13

08 Aug '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> The recent patch series proposing the addition of PPC little endian arch support to Linux defines new arch names 'ppcle' and 'ppc64le': https://lists.ozlabs.org/pipermail/linuxppc-dev/2013-August/109908.html This just makes libvirt know about these arch names, so it doesn't immediately trip up if it seems these new names from uname. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/util/virarch.c | 7 +++++-- src/util/virarch.h | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/src/util/virarch.c b/src/util/virarch.c index 81558e5..815ad29 100644 --- a/src/util/virarch.c +++ b/src/util/virarch.c @@ -55,18 +55,21 @@ static const struct virArchData { { "parisc", 32, VIR_ARCH_BIG_ENDIAN }, { "parisc64", 64, VIR_ARCH_BIG_ENDIAN }, { "ppc", 32, VIR_ARCH_BIG_ENDIAN }, + { "ppcle", 32, VIR_ARCH_LITTLE_ENDIAN }, { "ppc64", 64, VIR_ARCH_BIG_ENDIAN }, - { "ppcemb", 32, VIR_ARCH_BIG_ENDIAN }, + { "ppc64le", 64, VIR_ARCH_LITTLE_ENDIAN }, + { "ppcemb", 32, VIR_ARCH_BIG_ENDIAN }, { "s390", 32, VIR_ARCH_BIG_ENDIAN }, { "s390x", 64, VIR_ARCH_BIG_ENDIAN }, { "sh4", 32, VIR_ARCH_LITTLE_ENDIAN }, + { "sh4eb", 64, VIR_ARCH_BIG_ENDIAN }, { "sparc", 32, VIR_ARCH_BIG_ENDIAN }, - { "sparc64", 64, VIR_ARCH_BIG_ENDIAN }, { "unicore32", 32, VIR_ARCH_LITTLE_ENDIAN }, { "x86_64", 64, VIR_ARCH_LITTLE_ENDIAN }, + { "xtensa", 32, VIR_ARCH_LITTLE_ENDIAN }, { "xtensaeb", 32, VIR_ARCH_BIG_ENDIAN }, }; diff --git a/src/util/virarch.h b/src/util/virarch.h index 0d8ae25..c64012d 100644 --- a/src/util/virarch.h +++ b/src/util/virarch.h @@ -47,18 +47,21 @@ typedef enum { VIR_ARCH_PARISC, /* PA-Risc 32 BE http://en.wikipedia.org/wiki/PA-RISC */ VIR_ARCH_PARISC64, /* PA-Risc 64 BE http://en.wikipedia.org/wiki/PA-RISC */ VIR_ARCH_PPC, /* PowerPC 32 BE http://en.wikipedia.org/wiki/PowerPC */ + VIR_ARCH_PPCLE, /* PowerPC 32 LE http://en.wikipedia.org/wiki/PowerPC */ VIR_ARCH_PPC64, /* PowerPC 64 BE http://en.wikipedia.org/wiki/PowerPC */ - VIR_ARCH_PPCEMB, /* PowerPC 32 BE http://en.wikipedia.org/wiki/PowerPC */ + VIR_ARCH_PPC64LE, /* PowerPC 64 LE http://en.wikipedia.org/wiki/PowerPC */ + VIR_ARCH_PPCEMB, /* PowerPC 32 BE http://en.wikipedia.org/wiki/PowerPC */ VIR_ARCH_S390, /* S390 32 BE http://en.wikipedia.org/wiki/S390 */ VIR_ARCH_S390X, /* S390 64 BE http://en.wikipedia.org/wiki/S390x */ VIR_ARCH_SH4, /* SuperH4 32 LE http://en.wikipedia.org/wiki/SuperH */ + VIR_ARCH_SH4EB, /* SuperH4 32 BE http://en.wikipedia.org/wiki/SuperH */ VIR_ARCH_SPARC, /* Sparc 32 BE http://en.wikipedia.org/wiki/Sparc */ - VIR_ARCH_SPARC64, /* Sparc 64 BE http://en.wikipedia.org/wiki/Sparc */ VIR_ARCH_UNICORE32, /* UniCore 32 LE http://en.wikipedia.org/wiki/Unicore*/ VIR_ARCH_X86_64, /* x86 64 LE http://en.wikipedia.org/wiki/X86 */ + VIR_ARCH_XTENSA, /* XTensa 32 LE http://en.wikipedia.org/wiki/Xtensa#Processor_Cores */ VIR_ARCH_XTENSAEB, /* XTensa 32 BE http://en.wikipedia.org/wiki/Xtensa#Processor_Cores */ -- 1.8.3.1

3 2

Re: [libvirt] [PATCH 2/2] qemu: Support setting the 'removable' flag for USB disks
by intrigeri 08 Aug '13

08 Aug '13

Hi, > Add an attribute named 'removable' to the 'target' element of disks, > which controls the removable flag. For instance, on a Linux guest it > controls the value of /sys/block/$dev/removable. This option is only > valid for USB disks (i.e. bus='usb'), and its default value is 'off', > which is the same behaviour as before. For what it's worth, I have been successfully using this patchset in production since March, in its various incarnations. More specifically, I have been running libvirt 1.1.0 + the latest patches proposed on July 25th since they were submitted, have been heavily using emulated USB devices, and I have not experienced any issue. My reading of the situation is that the patches submitter has improved his patches months ago after receiving initial feedback, and since then the only activity I have seen was him porting his patches to the latest libvirt code and re-submitting. What is missing to get these patches merged, then? (Apart of porting them to the latest version again, of course :) Regards, -- intrigeri | GnuPG key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc | OTR fingerprint @ https://gaffer.ptitcanardnoir.org/intrigeri/otr.asc

2 1

[libvirt] With different libvirt version, lxc-enter-namespace return Different Execution results.
by hzguanqiang＠corp.netease.com 08 Aug '13

08 Aug '13

Hi Alex, I noticed you did lots of work about lxc-enter-namespace function. There is one thing really confusing me and I really want to consult with you about it. When I execute lxc-enter-namespace to get disk space info for lxc container under different libvirt version, It return different execution results. Details are as following: Under libvirt of version 1.0.2 with unbuntu host OS: # disk space info of Host ubuntu@lxc-gq:~$ df -hl Filesystem Size Used Avail Use% Mounted on /dev/loop7 20G 16G 3.2G 84% / udev 2.0G 12K 2.0G 1% /dev tmpfs 791M 300K 791M 1% /run none 5.0M 4.0K 5.0M 1% /run/lock none 2.0G 0 2.0G 0% /run/shm tmpfs 2.0G 0 2.0G 0% /sys/fs/cgroup /dev/nbd5 93M 1.6M 87M 2% /home/ubuntu/test ubuntu@lxc-gq:~$ vir version Compiled against library: libvirt 1.0.2 Using library: libvirt 1.0.2 Using API: LXC 1.0.2 Running hypervisor: LXC 3.8.0 ubuntu@lxc-gq:~$ vir list Id Name State ---------------------------------------------------- 3241 instance-0000004b running # disk space info of instance ubuntu@lxc-gq:~$ vir lxc-enter-namespace 3241 /bin/df -hl Filesystem Size Used Avail Use% Mounted on /dev/nbd1 1.4G 956M 329M 75% / devfs 64K 8.0K 56K 13% /dev tmpfs 64K 0 64K 0% /sys/fs/cgroup none 396M 12M 384M 3% /run none 5.0M 0 5.0M 0% /run/lock none 2.0G 0 2.0G 0% /run/shm Then I logged into the lxc container : ubuntu@lxc-gq:~$ ssh -i id_rsa_lxc ubuntu(a)10.0.0.4 Welcome to Ubuntu 12.04.2 LTS (GNU/Linux 3.8.0-25-generic x86_64) * Documentation: https://help.ubuntu.com/ System information disabled due to load higher than 2.0 Get cloud support with Ubuntu Advantage Cloud Guest: http://www.ubuntu.com/business/services/cloud Use Juju to deploy your cloud instances and workloads: https://juju.ubuntu.com/#cloud-precise 0 packages can be updated. 0 updates are security updates. Last login: Thu Aug 8 07:30:04 2013 from 10.0.0.1 To run a command as administrator (user "root"), use "sudo <command>". See "man sudo_root" for details. ubuntu@lxc3:~$ df -hl Filesystem Size Used Avail Use% Mounted on /dev/nbd1 1.4G 956M 328M 75% / devfs 64K 8.0K 56K 13% /dev tmpfs 64K 0 64K 0% /sys/fs/cgroup none 396M 12M 384M 3% /run none 5.0M 0 5.0M 0% /run/lock none 2.0G 0 2.0G 0% /run/shm From above, We can see under libvirt version 1.0.2, through lxc-enter-namespace, disk space info can be obtained and it's the same as info got from lxc inside. But when I did the same thing under libvirt of version 1.1.0 with debian host OS, the execution result changed: #disk info of host hzguanqiang@debian:~$ df -hl Filesystem Size Used Avail Use% Mounted on rootfs 4.0G 1.6G 2.2G 42% / udev 10M 0 10M 0% /dev tmpfs 4.8G 468K 4.8G 1% /run /dev/disk/by-uuid/12bb656b-4f80-4386-aa07-4bf90a3111b4 4.0G 1.6G 2.2G 42% / tmpfs 5.0M 4.0K 5.0M 1% /run/lock tmpfs 9.9G 0 9.9G 0% /run/shm /dev/sda8 428G 112G 313G 27% /home /dev/sda6 7.9G 159M 7.8G 2% /tmp /dev/sda5 16G 2.7G 14G 17% /var cgroup_root 24G 0 24G 0% /sys/fs/cgroup /dev/nbd5 1.4G 851M 466M 65% /home/openstack/stack/data/nova/instances/eed45ccb-3707-4815-9ae4-c7a2f56adb64/rootfs hzguanqiang@debian:~$ vir version Compiled against library: libvirt 1.1.0 Using library: libvirt 1.1.0 Using API: LXC 1.1.0 Running hypervisor: LXC 3.2.46 hzguanqiang@debian:~$ vir list Id Name State ---------------------------------------------------- 6096 instance-00000037 running 27981 instance-00000038 running 30846 instance-0000001a running hzguanqiang@debian:~$ vir lxc-enter-namespace instance-00000037 /bin/df -hl libvirt: error : argument unsupported: Security model cannot be entered hzguanqiang@debian:~$ vir lxc-enter-namespace instance-00000037 --noseclabel /bin/df -hl Filesystem Size Used Avail Use% Mounted on rootfs 4.0G 1.6G 2.2G 42% / udev 10M 0 10M 0% /dev tmpfs 4.8G 468K 4.8G 1% /run /dev/disk/by-uuid/12bb656b-4f80-4386-aa07-4bf90a3111b4 4.0G 1.6G 2.2G 42% / tmpfs 5.0M 4.0K 5.0M 1% /run/lock tmpfs 9.9G 0 9.9G 0% /run/shm /dev/sda8 428G 112G 313G 27% /home /dev/sda6 7.9G 159M 7.8G 2% /tmp /dev/sda5 16G 2.7G 14G 17% /var cgroup_root 24G 0 24G 0% /sys/fs/cgroup /dev/nbd5 1.4G 851M 466M 65% /home/openstack/stack/data/nova/instances/eed45ccb-3707-4815-9ae4-c7a2f56adb64/rootfs Then I logged into the lxc container : hzguanqiang@debian:~$ ssh -i id_rsa ubuntu(a)10.160.70.2 Welcome to Ubuntu 12.04.2 LTS (GNU/Linux 3.2.46-openstack-amd64 x86_64) * Documentation: https://help.ubuntu.com/ System information as of Wed Aug 7 10:49:35 UTC 2013 System load: 0.62 Processes: 31 Usage of /: 20.9% of 19.69GB Users logged in: 1 Memory usage: 51% IP address for eth0: 10.160.70.2 Swap usage: 0% Graph this data and manage this system at https://landscape.canonical.com/ Get cloud support with Ubuntu Advantage Cloud Guest: http://www.ubuntu.com/business/services/cloud Use Juju to deploy your cloud instances and workloads: https://juju.ubuntu.com/#cloud-precise Last login: Wed Aug 7 10:49:35 2013 from 10.160.70.3 ubuntu@lxc1:~$ df -hl Filesystem Size Used Avail Use% Mounted on /dev/loop2 20G 11G 8.3G 57% / devfs 64K 8.0K 56K 13% /dev tmpfs 64K 0 64K 0% /sys/fs/cgroup none 4.8G 6.4M 4.8G 1% /run none 5.0M 0 5.0M 0% /run/lock none 24G 0 24G 0% /run/shm From above, We can see under libvirt version 1.1.0, disk space info of lxc container gotten through lxc-enter-namespace are different from info got from lxc inside, but the same as host. Why does this happen? Is there a bug or anything? Thanks -------------------------------------------------------------------------------- ------------------ Best regards! GuanQiang

3 5

[libvirt] [PATCH] Record the where the auto-generated data comes from
by Daniel P. Berrange 08 Aug '13

08 Aug '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> The gendispatch.pl script puts comments at the top of files it creates, saying that it auto-generated them. Also include the name of the source data file which it reads when doing the auto-generation. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/rpc/gendispatch.pl | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/rpc/gendispatch.pl b/src/rpc/gendispatch.pl index ac0c7ab..ceb1ad8 100755 --- a/src/rpc/gendispatch.pl +++ b/src/rpc/gendispatch.pl @@ -348,19 +348,19 @@ sub hyper_to_long if ($mode eq "aclsym") { print <<__EOF__; -# Automatically generated by gendispatch.pl. +# Automatically generated from $protocol by gendispatch.pl. # Do not edit this file. Any changes you make will be lost. __EOF__ } elsif ($mode eq "aclapi") { print <<__EOF__;  __EOF__ } else { print <<__EOF__; -/* Automatically generated by gendispatch.pl. +/* Automatically generated from $protocol by gendispatch.pl. * Do not edit this file. Any changes you make will be lost. */ __EOF__ -- 1.8.1.4

2 1

[libvirt] [PATCH] qemu: Allow hotplug of multiple SCSI devices
by Viktor Mihajlovski 08 Aug '13

08 Aug '13

From: Eric Farman <farman(a)linux.vnet.ibm.com> Hotplugging a single SCSI device works, but adding additional ones result in an error from QEMU: [root@gpok197 ~]# virsh attach-device guest01 blah.xml Device attached successfully [root@gpok197 ~]# virsh attach-device guest01 blah2.xml error: Failed to attach device from blah2.xml error: internal error unable to execute QEMU command 'device_add': Duplicate ID 'hostdev0' for device The hostdev ID that is created is always set to zero, regardless of the contents of the XML. Changing the index in the hotplug case to a negative one so the next available index is used. Signed-off-by: Eric Farman <farman(a)linux.vnet.ibm.com> Reviewed-by: Viktor Mihajlovski <mihajlov(a)linux.vnet.ibm.com> --- src/qemu/qemu_hotplug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 7a6946e..c9748d9 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1362,7 +1362,7 @@ qemuDomainAttachHostScsiDevice(virQEMUDriverPtr driver, return -1; } - if (qemuAssignDeviceHostdevAlias(vm->def, hostdev, 0) < 0) + if (qemuAssignDeviceHostdevAlias(vm->def, hostdev, -1) < 0) goto cleanup; if (!(drvstr = qemuBuildSCSIHostdevDrvStr(hostdev, priv->qemuCaps, -- 1.7.9.5

2 1

[libvirt] [PATCH] Add info about access control checks into API reference
by Daniel P. Berrange 08 Aug '13

08 Aug '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> So that app developers / admins know what access control checks are performed for each API, this patch extends the API docs generator to include details of the ACLs for each. The gendispatch.pl script is extended so that it generates a simple XML describing ACL rules, eg. <aclinfo> ... <api name='virConnectNumOfDomains'> <check object='connect' perm='search_domains'/> <filter object='domain' perm='getattr'/> </api> <api name='virDomainAttachDeviceFlags'> <check object='domain' perm='write'/> <check object='domain' perm='save' flags='!VIR_DOMAIN_AFFECT_CONFIG|VIR_DOMAIN_AFFECT_LIVE'/> <check object='domain' perm='save' flags='VIR_DOMAIN_AFFECT_CONFIG'/> </api> ... </aclinfo> The newapi.xsl template loads the XML files containing the ACL rules and generates a short block of HTML for each API describing the parameter checks and return value filters (if any). Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- docs/libvirt.css | 14 +++++++++++ docs/newapi.xsl | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++ src/Makefile.am | 22 ++++++++++++++-- src/rpc/gendispatch.pl | 59 ++++++++++++++++++++++++++++++++++++++++--- 4 files changed, 157 insertions(+), 6 deletions(-) diff --git a/docs/libvirt.css b/docs/libvirt.css index 8a00d12..ed67b2f 100644 --- a/docs/libvirt.css +++ b/docs/libvirt.css @@ -477,3 +477,17 @@ dl.variablelist > dt { dl.variablelist > dt:after { content: ": "; } + +table.acl { + margin: 1em; + border-spacing: 0px; + border: 1px solid #ccc; +} + +table.acl tr, table.acl td { + padding: 0.3em; +} + +table.acl thead { + background: #ddd; +} diff --git a/docs/newapi.xsl b/docs/newapi.xsl index d5b210e..58f12eb 100644 --- a/docs/newapi.xsl +++ b/docs/newapi.xsl @@ -29,6 +29,69 @@ <xsl:variable name="htmldir">html</xsl:variable> <xsl:variable name="href_base">../</xsl:variable> + <xsl:variable name="acls"> + <xsl:copy-of select="document('../src/libvirt_access.xml')/aclinfo/api"/> + </xsl:variable> + <xsl:variable name="qemuacls"> + <xsl:copy-of select="document('../src/libvirt_access_qemu.xml')/aclinfo/api"/> + </xsl:variable> + <xsl:variable name="lxcacls"> + <xsl:copy-of select="document('../src/libvirt_access_lxc.xml')/aclinfo/api"/> + </xsl:variable> + + <xsl:template name="aclinfo"> + <xsl:param name="api"/> + + <xsl:if test="count(exsl:node-set($acls)/api[@name=$api]/check) > 0"> + <h5>Access control parameter checks</h5> + <table class="acl"> + <thead> + <tr> + <th>Object</th> + <th>Permission</th> + <th>Condition</th> + </tr> + </thead> + <xsl:apply-templates select="exsl:node-set($acls)/api[@name=$api]/check" mode="acl"/> + </table> + </xsl:if> + <xsl:if test="count(exsl:node-set($acls)/api[@name=$api]/filter) > 0"> + <h5>Access control return value filters</h5> + <table class="acl"> + <thead> + <tr> + <th>Object</th> + <th>Permission</th> + </tr> + </thead> + <xsl:apply-templates select="exsl:node-set($acls)/api[@name=$api]/filter" mode="acl"/> + </table> + </xsl:if> + </xsl:template> + + <xsl:template match="check" mode="acl"> + <tr> + <td><xsl:value-of select="@object"/></td> + <td><xsl:value-of select="@perm"/></td> + <xsl:choose> + <xsl:when test="@flags"> + <td><xsl:value-of select="@flags"/></td> + </xsl:when> + <xsl:otherwise> + <td>-</td> + </xsl:otherwise> + </xsl:choose> + </tr> + </xsl:template> + + <xsl:template match="filter" mode="acl"> + <tr> + <td><xsl:value-of select="@object"/></td> + <td><xsl:value-of select="@perm"/></td> + </tr> + </xsl:template> + + <xsl:template name="navbar"> <xsl:variable name="previous" select="preceding-sibling::file[1]"/> <xsl:variable name="next" select="following-sibling::file[1]"/> @@ -553,6 +616,11 @@ </xsl:if> </dl> </xsl:if> + <div class="acl"> + <xsl:call-template name="aclinfo"> + <xsl:with-param name="api" select="$name"/> + </xsl:call-template> + </div> </xsl:template> <xsl:template match="exports" mode="toc"> diff --git a/src/Makefile.am b/src/Makefile.am index ac66ecf..277f749 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -830,6 +830,11 @@ ACCESS_DRIVER_SYM_FILES = \ libvirt_access_qemu.syms \ libvirt_access_lxc.syms +ACCESS_DRIVER_API_FILES = \ + libvirt_access.xml \ + libvirt_access_qemu.xml \ + libvirt_access_lxc.xml + ACCESS_DRIVER_SOURCES = \ access/viraccessperm.h access/viraccessperm.c \ access/viraccessmanager.h access/viraccessmanager.c \ @@ -1496,8 +1501,8 @@ EXTRA_DIST += $(ACCESS_DRIVER_POLKIT_SOURCES) endif -BUILT_SOURCES += $(ACCESS_DRIVER_GENERATED) -CLEANFILES += $(ACCESS_DRIVER_GENERATED) +BUILT_SOURCES += $(ACCESS_DRIVER_GENERATED) $(ACCESS_DRIVER_API_FILES) +CLEANFILES += $(ACCESS_DRIVER_GENERATED) $(ACCESS_DRIVER_API_FILES) libvirt_access.syms: $(srcdir)/rpc/gendispatch.pl \ $(REMOTE_PROTOCOL) Makefile.am @@ -1512,6 +1517,19 @@ libvirt_access_lxc.syms: $(srcdir)/rpc/gendispatch.pl \ $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclsym \ lxc LXC $(LXC_PROTOCOL) > $@ +libvirt_access.xml: $(srcdir)/rpc/gendispatch.pl \ + $(REMOTE_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclapi \ + remote REMOTE $(REMOTE_PROTOCOL) > $@ +libvirt_access_qemu.xml: $(srcdir)/rpc/gendispatch.pl \ + $(QEMU_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclapi \ + qemu QEMU $(QEMU_PROTOCOL) > $@ +libvirt_access_lxc.xml: $(srcdir)/rpc/gendispatch.pl \ + $(LXC_PROTOCOL) Makefile.am + $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclapi \ + lxc LXC $(LXC_PROTOCOL) > $@ + $(srcdir)/access/viraccessapicheck.h: $(srcdir)/rpc/gendispatch.pl \ $(REMOTE_PROTOCOL) Makefile.am $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclheader \ diff --git a/src/rpc/gendispatch.pl b/src/rpc/gendispatch.pl index 8f41771..ac0c7ab 100755 --- a/src/rpc/gendispatch.pl +++ b/src/rpc/gendispatch.pl @@ -41,8 +41,8 @@ my $res = GetOptions("mode=s" => \$mode); die "cannot parse command line options" unless $res; die "unknown mode '$mode', expecting 'client', 'server', " . - "'aclheader', 'aclbody', 'aclsym' or 'debug'" - unless $mode =~ /^(client|server|aclheader|aclbody|aclsym|debug)$/; + "'aclheader', 'aclbody', 'aclsym', 'aclapi' or 'debug'" + unless $mode =~ /^(client|server|aclheader|aclbody|aclsym|aclapi|debug)$/; my $structprefix = shift or die "missing struct prefix argument"; my $procprefix = shift or die "missing procedure prefix argument"; @@ -351,6 +351,13 @@ if ($mode eq "aclsym") { # Automatically generated by gendispatch.pl. # Do not edit this file. Any changes you make will be lost. __EOF__ +} elsif ($mode eq "aclapi") { + print <<__EOF__; + +__EOF__ } else { print <<__EOF__; /* Automatically generated by gendispatch.pl. @@ -1641,7 +1648,8 @@ elsif ($mode eq "client") { } } elsif ($mode eq "aclheader" || $mode eq "aclbody" || - $mode eq "aclsym") { + $mode eq "aclsym" || + $mode eq "aclapi") { my %generate = map { $_ => 1 } @autogen; my @keys = keys %calls; @@ -1667,6 +1675,7 @@ elsif ($mode eq "client") { foreach my $hdr (@headers) { print "#include \"$hdr\"\n"; } + print "\n"; } elsif ($mode eq "aclbody") { my $header = shift; print "#include <config.h>\n"; @@ -1676,8 +1685,12 @@ elsif ($mode eq "client") { print "#include \"virerror.h\"\n"; print "\n"; print "#define VIR_FROM_THIS VIR_FROM_ACCESS\n"; + print "\n"; + } elsif ($mode eq "aclapi") { + print "<aclinfo>\n"; + } else { + print "\n"; } - print "\n"; foreach (@keys) { my $call = $calls{$_}; @@ -1699,6 +1712,8 @@ elsif ($mode eq "client") { print $apiname . "CheckACL;\n"; } print $apiname . "EnsureACL;\n"; + } elsif ($mode eq "aclapi") { + &generate_aclapi($call); } else { &generate_acl($call, $call->{acl}, "Ensure"); if (defined $call->{aclfilter}) { @@ -1835,5 +1850,41 @@ elsif ($mode eq "client") { print "}\n\n"; } } + + sub generate_aclapi { + my $call = shift; + + my $apiname = "vir" . $call->{ProcName}; + if ($structprefix eq "qemu") { + $apiname =~ s/virDomain/virDomainQemu/; + } elsif ($structprefix eq "lxc") { + $apiname =~ s/virDomain/virDomainLxc/; + } + + print " <api name='$apiname'>\n"; + + my $acl = $call->{acl}; + foreach (@{$acl}) { + my @bits = split /:/; + print " <check object='$bits[0]' perm='$bits[1]'"; + if (defined $bits[2]) { + print " flags='$bits[2]'"; + } + print "/>\n"; + } + + my $aclfilter = $call->{aclfilter}; + foreach (@{$aclfilter}) { + my @bits = split /:/; + print " <filter object='$bits[0]' perm='$bits[1]'/>\n"; + } + + print " </api>\n"; + } + + } + + if ($mode eq "aclapi") { + print "</aclinfo>\n"; } } -- 1.8.1.4

2 3

[libvirt] [sandbox][PATCH v3] Fix delete of running container
by Wayne Sun 08 Aug '13

08 Aug '13

Delete running container is not supprted and will report an error. Related to bug: https://bugzilla.redhat.com/show_bug.cgi?id=994495 v1: Fix stop function and delete running container. v2: Delete running container is not allowed, spawn virsh to get domain status. v3: Using exist libvirt connection to get dom status. Signed-off-by: Wayne Sun <gsun(a)redhat.com> --- bin/virt-sandbox-service | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-) diff --git a/bin/virt-sandbox-service b/bin/virt-sandbox-service index 550d46c..03873c9 100755 --- a/bin/virt-sandbox-service +++ b/bin/virt-sandbox-service @@ -254,11 +254,11 @@ class Container: def delete(self): self.connect() - # Stop service if it is running - try: - self.stop() - except: - pass + self.conn.fetch_domains(None) + dom = self.conn.find_domain_by_name(self.name) + info = dom.get_info() + if info.state == LibvirtGObject.DomainState.RUNNING: + raise ValueError([_("Cannot delete running container")]) # Not sure we should remove content if os.path.exists(self.dest): -- 1.7.1

3 3

[libvirt] virDomainCreateWithFlags error
by Wangpan 08 Aug '13

08 Aug '13

Hi all, I'm using 'libvirt 1.1.1-1 amd64' undef debian wheezy, I found that the return code is 139 when I run command: $ sudo virsh start df1c4670-18eb-4520-b5d8-aa8a492eb876 --paused; echo $? 139 but the return code is OK(0) when run command: $ sudo virsh start df1c4670-18eb-4520-b5d8-aa8a492eb876; echo $? I found there is an error in libvirtd.log: 2013-08-08 05:40:23.983+0000: 16626: error : virNetSocketReadWire:1377 : End of file while reading data: Input/output error I found this issue by using openstack nova folsom, if I create an VM by nova, it will use dom.createWithFlags(0) to create the VM, but then the nova-compute process exited when this function is called, then I changed the createWithFlags(0) to create(), everything become OK. I also tried the function under python, and the python process exited, too. but the dom.create() method is OK, so I think this is a problem about libvirt. I want to know is this a reported bug? libvirt and kvm hypervisor version: Compiled against library: libvirt 1.1.1 Using library: libvirt 1.1.1 Using API: QEMU 1.1.1 Running hypervisor: QEMU 1.1.2 Thanks 2012-08-16 Wangpan

2 3

[libvirt] [sandbox][PATCH v2] Fix delete of running container
by Wayne Sun 08 Aug '13

08 Aug '13

Delete running container is not supprted and will report an error. Related to bug: https://bugzilla.redhat.com/show_bug.cgi?id=994495 Signed-off-by: Wayne Sun <gsun(a)redhat.com> --- bin/virt-sandbox-service | 15 ++++++++++----- 1 files changed, 10 insertions(+), 5 deletions(-) diff --git a/bin/virt-sandbox-service b/bin/virt-sandbox-service index 550d46c..c07c33b 100755 --- a/bin/virt-sandbox-service +++ b/bin/virt-sandbox-service @@ -254,11 +254,16 @@ class Container: def delete(self): self.connect() - # Stop service if it is running - try: - self.stop() - except: - pass + # Check container is running or not + cmd = "/usr/bin/virsh -c %s list | sed '1d;2d;$d' | awk -F' '\ + '{ print $2}'" % self.uri + p = Popen(cmd, shell=True, stdout=PIPE, stderr=PIPE) + out, err = p.communicate() + if p.returncode and p.returncode != 0: + raise OSError(_("Failed to list running domain")) + + if self.name in out.splitlines(): + raise ValueError([_("Delete running container is not supported")]) # Not sure we should remove content if os.path.exists(self.dest): -- 1.7.1

2 2

[libvirt] [PATCH] cgroup: refactor macros usage
by Roman Bogorodskiy 08 Aug '13

08 Aug '13

util/vircgroup.c uses a lot of macros to detect if cgroup is supported by the system or not. These macros are pretty smart and allow to keep code compact, however the downside of that is that it's getting harder to navigate through the cgroup code. So re-organise macros in a more simple fashion, i.e. just explicitly provide functional and stub implementation for every public function. --- src/util/vircgroup.c | 984 +++++++++++++++++++++++++++++++++------------------ 1 file changed, 648 insertions(+), 336 deletions(-) diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c index cfb4b3f..45db658 100644 --- a/src/util/vircgroup.c +++ b/src/util/vircgroup.c @@ -61,6 +61,13 @@ VIR_ENUM_IMPL(virCgroupController, VIR_CGROUP_CONTROLLER_LAST, "freezer", "blkio", "net_cls", "perf_event", "name=systemd"); +#if defined(__linux__) && defined(HAVE_MNTENT_H) && defined(HAVE_GETMNTENT_R) \ + && defined(_DIRENT_HAVE_D_TYPE) && defined(major) && defined(minor) +# define VIR_CGROUP_SUPPORTED +#endif + +#if defined(VIR_CGROUP_SUPPORTED) + typedef enum { VIR_CGROUP_NONE = 0, /* create subdir under each cgroup if possible. */ VIR_CGROUP_MEM_HIERACHY = 1 << 0, /* call virCgroupSetMemoryUseHierarchy @@ -72,7 +79,6 @@ typedef enum { bool virCgroupAvailable(void) { bool ret = false; -#ifdef HAVE_GETMNTENT_R FILE *mounts = NULL; struct mntent entry; char buf[CGROUP_MAX_VAL]; @@ -91,11 +97,9 @@ bool virCgroupAvailable(void) } VIR_FORCE_FCLOSE(mounts); -#endif return ret; } -#if defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R static int virCgroupPartitionEscape(char **path); @@ -169,16 +173,6 @@ virCgroupValidateMachineGroup(virCgroupPtr group, VIR_FREE(scopename); return valid; } -#else -static bool -virCgroupValidateMachineGroup(virCgroupPtr group ATTRIBUTE_UNUSED, - const char *name ATTRIBUTE_UNUSED, - const char *drivername ATTRIBUTE_UNUSED, - bool stripEmulatorSuffix ATTRIBUTE_UNUSED) -{ - return true; -} -#endif /** * virCgroupFree: @@ -220,7 +214,6 @@ bool virCgroupHasController(virCgroupPtr cgroup, int controller) return cgroup->controllers[controller].mountPoint != NULL; } -#if defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R static int virCgroupCopyMounts(virCgroupPtr group, virCgroupPtr parent) { @@ -339,7 +332,6 @@ error: return -1; } - static int virCgroupCopyPlacement(virCgroupPtr group, const char *path, virCgroupPtr parent) @@ -374,7 +366,6 @@ static int virCgroupCopyPlacement(virCgroupPtr group, return 0; } - /* * virCgroupDetectPlacement: * @group: the group to process @@ -599,8 +590,6 @@ static int virCgroupDetect(virCgroupPtr group, return 0; } -#endif - int virCgroupPathOfController(virCgroupPtr group, int controller, @@ -651,7 +640,6 @@ int virCgroupPathOfController(virCgroupPtr group, return 0; } - static int virCgroupSetValueStr(virCgroupPtr group, int controller, const char *key, @@ -727,8 +715,6 @@ static int virCgroupSetValueU64(virCgroupPtr group, return ret; } - - static int virCgroupSetValueI64(virCgroupPtr group, int controller, const char *key, @@ -797,8 +783,6 @@ cleanup: return ret; } - -#if defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R static int virCgroupCpuSetInherit(virCgroupPtr parent, virCgroupPtr group) { size_t i; @@ -993,9 +977,7 @@ error: return -1; } -#endif -#if defined _DIRENT_HAVE_D_TYPE int virCgroupRemoveRecursively(char *grppath) { DIR *grpdir; @@ -1044,14 +1026,6 @@ int virCgroupRemoveRecursively(char *grppath) return rc; } -#else -int virCgroupRemoveRecursively(char *grppath ATTRIBUTE_UNUSED) -{ - virReportSystemError(ENXIO, "%s", - _("Control groups not supported on this platform")); - return -1; -} -#endif /** * virCgroupRemove: @@ -1101,7 +1075,6 @@ int virCgroupRemove(virCgroupPtr group) return rc; } - /** * virCgroupAddTask: * @@ -1252,8 +1225,6 @@ cleanup: return ret; } - -#if defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R static int virCgroupPartitionNeedsEscaping(const char *path) { FILE *fp = NULL; @@ -1445,18 +1416,6 @@ cleanup: VIR_FREE(newpath); return ret; } -#else -int virCgroupNewPartition(const char *path ATTRIBUTE_UNUSED, - bool create ATTRIBUTE_UNUSED, - int controllers ATTRIBUTE_UNUSED, - virCgroupPtr *group ATTRIBUTE_UNUSED) -{ - virReportSystemError(ENXIO, "%s", - _("Control groups not supported on this platform")); - return -1; -} -#endif - /** * virCgroupNewSelf: @@ -1484,7 +1443,6 @@ int virCgroupNewSelf(virCgroupPtr *group) * * Returns 0 on success, or -1 on error */ -#if defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R int virCgroupNewDomainPartition(virCgroupPtr partition, const char *driver, const char *name, @@ -1526,18 +1484,6 @@ cleanup: VIR_FREE(grpname); return ret; } -#else -int virCgroupNewDomainPartition(virCgroupPtr partition ATTRIBUTE_UNUSED, - const char *driver ATTRIBUTE_UNUSED, - const char *name ATTRIBUTE_UNUSED, - bool create ATTRIBUTE_UNUSED, - virCgroupPtr *group ATTRIBUTE_UNUSED) -{ - virReportSystemError(ENXIO, "%s", - _("Control groups not supported on this platform")); - return -1; -} -#endif /** * virCgroupNewVcpu: @@ -1549,7 +1495,6 @@ int virCgroupNewDomainPartition(virCgroupPtr partition ATTRIBUTE_UNUSED, * * Returns 0 on success, or -1 on error */ -#if defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R int virCgroupNewVcpu(virCgroupPtr domain, int vcpuid, bool create, @@ -1580,17 +1525,6 @@ cleanup: VIR_FREE(name); return ret; } -#else -int virCgroupNewVcpu(virCgroupPtr domain ATTRIBUTE_UNUSED, - int vcpuid ATTRIBUTE_UNUSED, - bool create ATTRIBUTE_UNUSED, - virCgroupPtr *group ATTRIBUTE_UNUSED) -{ - virReportSystemError(ENXIO, "%s", - _("Control groups not supported on this platform")); - return -1; -} -#endif /** * virCgroupNewEmulator: @@ -1601,7 +1535,6 @@ int virCgroupNewVcpu(virCgroupPtr domain ATTRIBUTE_UNUSED, * * Returns: 0 on success or -1 on error */ -#if defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R int virCgroupNewEmulator(virCgroupPtr domain, bool create, virCgroupPtr *group) @@ -1626,36 +1559,13 @@ int virCgroupNewEmulator(virCgroupPtr domain, cleanup: return ret; } -#else -int virCgroupNewEmulator(virCgroupPtr domain ATTRIBUTE_UNUSED, - bool create ATTRIBUTE_UNUSED, - virCgroupPtr *group ATTRIBUTE_UNUSED) -{ - virReportSystemError(ENXIO, "%s", - _("Control groups not supported on this platform")); - return -1; -} -#endif - - -#if defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R int virCgroupNewDetect(pid_t pid, int controllers, virCgroupPtr *group) { return virCgroupNew(pid, "", NULL, controllers, group); } -#else -int virCgroupNewDetect(pid_t pid ATTRIBUTE_UNUSED, - int controllers ATTRIBUTE_UNUSED, - virCgroupPtr *group ATTRIBUTE_UNUSED) -{ - virReportSystemError(ENXIO, "%s", - _("Control groups not supported on this platform")); - return -1; -} -#endif /* * Returns 0 on success (but @group may be NULL), -1 on fatal error @@ -1941,7 +1851,6 @@ int virCgroupGetBlkioWeight(virCgroupPtr group, unsigned int *weight) * * Returns: 0 on success, -1 on error */ -#if defined(major) && defined(minor) int virCgroupSetBlkioDeviceWeight(virCgroupPtr group, const char *path, unsigned int weight) @@ -1982,17 +1891,6 @@ int virCgroupSetBlkioDeviceWeight(virCgroupPtr group, VIR_FREE(str); return ret; } -#else -int -virCgroupSetBlkioDeviceWeight(virCgroupPtr group ATTRIBUTE_UNUSED, - const char *path ATTRIBUTE_UNUSED, - unsigned int weight ATTRIBUTE_UNUSED) -{ - virReportSystemError(ENOSYS, "%s", - _("Control groups not supported on this platform")); - return -1; -} -#endif /** * virCgroupSetMemory: @@ -2364,7 +2262,6 @@ cleanup: * Returns: 0 on success, 1 if path exists but is not a device, or * -1 on error */ -#if defined(major) && defined(minor) int virCgroupAllowDevicePath(virCgroupPtr group, const char *path, int perms) { struct stat sb; @@ -2385,17 +2282,6 @@ int virCgroupAllowDevicePath(virCgroupPtr group, const char *path, int perms) minor(sb.st_rdev), perms); } -#else -int virCgroupAllowDevicePath(virCgroupPtr group ATTRIBUTE_UNUSED, - const char *path ATTRIBUTE_UNUSED, - int perms ATTRIBUTE_UNUSED) -{ - virReportSystemError(ENOSYS, "%s", - _("Control groups not supported on this platform")); - return -1; -} -#endif - /** * virCgroupDenyDevice: @@ -2468,7 +2354,6 @@ cleanup: return ret; } -#if defined(major) && defined(minor) int virCgroupDenyDevicePath(virCgroupPtr group, const char *path, int perms) { struct stat sb; @@ -2489,16 +2374,6 @@ int virCgroupDenyDevicePath(virCgroupPtr group, const char *path, int perms) minor(sb.st_rdev), perms); } -#else -int virCgroupDenyDevicePath(virCgroupPtr group ATTRIBUTE_UNUSED, - const char *path ATTRIBUTE_UNUSED, - int perms ATTRIBUTE_UNUSED) -{ - virReportSystemError(ENOSYS, "%s", - _("Control groups not supported on this platform")); - return -1; -} -#endif int virCgroupSetCpuShares(virCgroupPtr group, unsigned long long shares) { @@ -2609,63 +2484,6 @@ int virCgroupGetCpuacctPercpuUsage(virCgroupPtr group, char **usage) "cpuacct.usage_percpu", usage); } -#ifdef _SC_CLK_TCK -int virCgroupGetCpuacctStat(virCgroupPtr group, unsigned long long *user, - unsigned long long *sys) -{ - char *str; - char *p; - int ret = -1; - static double scale = -1.0; - - if (virCgroupGetValueStr(group, VIR_CGROUP_CONTROLLER_CPUACCT, - "cpuacct.stat", &str) < 0) - return -1; - - if (!(p = STRSKIP(str, "user ")) || - virStrToLong_ull(p, &p, 10, user) < 0) { - virReportError(VIR_ERR_INTERNAL_ERROR, - _("Cannot parse user stat '%s'"), - p); - goto cleanup; - } - if (!(p = STRSKIP(p, "\nsystem ")) || - virStrToLong_ull(p, NULL, 10, sys) < 0) { - virReportError(VIR_ERR_INTERNAL_ERROR, - _("Cannot parse sys stat '%s'"), - p); - goto cleanup; - } - /* times reported are in system ticks (generally 100 Hz), but that - * rate can theoretically vary between machines. Scale things - * into approximate nanoseconds. */ - if (scale < 0) { - long ticks_per_sec = sysconf(_SC_CLK_TCK); - if (ticks_per_sec == -1) { - virReportSystemError(errno, "%s", - _("Cannot determine system clock HZ")); - goto cleanup; - } - scale = 1000000000.0 / ticks_per_sec; - } - *user *= scale; - *sys *= scale; - - ret = 0; -cleanup: - VIR_FREE(str); - return ret; -} -#else -int virCgroupGetCpuacctStat(virCgroupPtr group ATTRIBUTE_UNUSED, - unsigned long long *user ATTRIBUTE_UNUSED, - unsigned long long *sys ATTRIBUTE_UNUSED) -{ - virReportSystemError(ENOSYS, "%s", - _("Control groups not supported on this platform")); - return -1; -} -#endif int virCgroupSetFreezerState(virCgroupPtr group, const char *state) { @@ -2681,53 +2499,614 @@ int virCgroupGetFreezerState(virCgroupPtr group, char **state) "freezer.state", state); } +static char *virCgroupIdentifyRoot(virCgroupPtr group) +{ + char *ret = NULL; + size_t i; -#if defined HAVE_KILL && defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R -/* - * Returns 1 if some PIDs are killed, 0 if none are killed, or -1 on error - */ -static int virCgroupKillInternal(virCgroupPtr group, int signum, virHashTablePtr pids) + for (i = 0; i < VIR_CGROUP_CONTROLLER_LAST; i++) { + char *tmp; + if (!group->controllers[i].mountPoint) + continue; + if (!(tmp = strrchr(group->controllers[i].mountPoint, '/'))) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Could not find directory separator in %s"), + group->controllers[i].mountPoint); + return NULL; + } + + if (VIR_STRNDUP(ret, group->controllers[i].mountPoint, + tmp - group->controllers[i].mountPoint) < 0) + return NULL; + return ret; + } + + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Could not find any mounted controllers")); + return NULL; +} + + +int virCgroupIsolateMount(virCgroupPtr group, const char *oldroot, + const char *mountopts) { int ret = -1; - bool killedAny = false; - char *keypath = NULL; - bool done = false; - FILE *fp = NULL; - VIR_DEBUG("group=%p path=%s signum=%d pids=%p", - group, group->path, signum, pids); + size_t i; + char *opts = NULL; + char *root = NULL; - if (virCgroupPathOfController(group, -1, "tasks", &keypath) < 0) + if (!(root = virCgroupIdentifyRoot(group))) return -1; - /* PIDs may be forking as we kill them, so loop - * until there are no new PIDs found - */ - while (!done) { - done = true; - if (!(fp = fopen(keypath, "r"))) { - if (errno == ENOENT) { - VIR_DEBUG("No file %s, assuming done", keypath); - killedAny = false; - goto done; - } - - virReportSystemError(errno, - _("Failed to read %s"), - keypath); - goto cleanup; - } else { - while (!feof(fp)) { - unsigned long pid_value; - if (fscanf(fp, "%lu", &pid_value) != 1) { - if (feof(fp)) - break; - virReportSystemError(errno, - _("Failed to read %s"), - keypath); - goto cleanup; - } - if (virHashLookup(pids, (void*)pid_value)) - continue; + VIR_DEBUG("Mounting cgroups at '%s'", root); + + if (virFileMakePath(root) < 0) { + virReportSystemError(errno, + _("Unable to create directory %s"), + root); + goto cleanup; + } + + if (virAsprintf(&opts, + "mode=755,size=65536%s", mountopts) < 0) + goto cleanup; + + if (mount("tmpfs", root, "tmpfs", MS_NOSUID|MS_NODEV|MS_NOEXEC, opts) < 0) { + virReportSystemError(errno, + _("Failed to mount %s on %s type %s"), + "tmpfs", root, "tmpfs"); + goto cleanup; + } + + for (i = 0; i < VIR_CGROUP_CONTROLLER_LAST; i++) { + if (!group->controllers[i].mountPoint) + continue; + + if (!virFileExists(group->controllers[i].mountPoint)) { + char *src; + if (virAsprintf(&src, "%s%s%s", + oldroot, + group->controllers[i].mountPoint, + group->controllers[i].placement) < 0) + goto cleanup; + + VIR_DEBUG("Create mount point '%s'", group->controllers[i].mountPoint); + if (virFileMakePath(group->controllers[i].mountPoint) < 0) { + virReportSystemError(errno, + _("Unable to create directory %s"), + group->controllers[i].mountPoint); + VIR_FREE(src); + goto cleanup; + } + + if (mount(src, group->controllers[i].mountPoint, NULL, MS_BIND, NULL) < 0) { + virReportSystemError(errno, + _("Failed to bind cgroup '%s' on '%s'"), + src, group->controllers[i].mountPoint); + VIR_FREE(src); + goto cleanup; + } + + VIR_FREE(src); + } + + if (group->controllers[i].linkPoint) { + VIR_DEBUG("Link mount point '%s' to '%s'", + group->controllers[i].mountPoint, + group->controllers[i].linkPoint); + if (symlink(group->controllers[i].mountPoint, + group->controllers[i].linkPoint) < 0) { + virReportSystemError(errno, + _("Unable to symlink directory %s to %s"), + group->controllers[i].mountPoint, + group->controllers[i].linkPoint); + return -1; + } + } + } + ret = 0; + +cleanup: + VIR_FREE(root); + VIR_FREE(opts); + return ret; +} + +#else /* !(VIR_CGROUP_SUPPORTED) */ +bool virCgroupAvailable(void) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return false; +} + +void virCgroupFree(virCgroupPtr *group ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); +} + +int virCgroupNewSelf(virCgroupPtr *group ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupNewDetectMachine(const char *name ATTRIBUTE_UNUSED, + const char *drivername ATTRIBUTE_UNUSED, + pid_t pid ATTRIBUTE_UNUSED, + const char *partition ATTRIBUTE_UNUSED, + int controllers ATTRIBUTE_UNUSED, + virCgroupPtr *group ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupSetMemoryHardLimit(virCgroupPtr group ATTRIBUTE_UNUSED, + unsigned long long kb ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupGetMemoryHardLimit(virCgroupPtr group ATTRIBUTE_UNUSED, + unsigned long long *kb ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupSetMemorySoftLimit(virCgroupPtr group ATTRIBUTE_UNUSED, + unsigned long long kb ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupGetMemorySoftLimit(virCgroupPtr group ATTRIBUTE_UNUSED, + unsigned long long *kb ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupSetMemSwapHardLimit(virCgroupPtr group ATTRIBUTE_UNUSED, + unsigned long long kb ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupGetMemSwapHardLimit(virCgroupPtr group ATTRIBUTE_UNUSED, + unsigned long long *kb ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupGetMemSwapUsage(virCgroupPtr group ATTRIBUTE_UNUSED, + unsigned long long *kb ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupGetMemoryUsage(virCgroupPtr group ATTRIBUTE_UNUSED, + unsigned long *kb ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupSetMemory(virCgroupPtr group ATTRIBUTE_UNUSED, + unsigned long long kb ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupSetCpusetMems(virCgroupPtr group ATTRIBUTE_UNUSED, + const char *mems ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupGetCpusetMems(virCgroupPtr group ATTRIBUTE_UNUSED, + char **mems ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupSetCpusetCpus(virCgroupPtr group ATTRIBUTE_UNUSED, + const char *cpus ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupGetCpusetCpus(virCgroupPtr group ATTRIBUTE_UNUSED, + char **cpus ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupDenyAllDevices(virCgroupPtr group ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupDenyDeviceMajor(virCgroupPtr group ATTRIBUTE_UNUSED, + char type ATTRIBUTE_UNUSED, + int major ATTRIBUTE_UNUSED, + int perms ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupDenyDevice(virCgroupPtr group ATTRIBUTE_UNUSED, + char type ATTRIBUTE_UNUSED, + int major ATTRIBUTE_UNUSED, + int minor ATTRIBUTE_UNUSED, + int perms ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupSetCpuCfsPeriod(virCgroupPtr group ATTRIBUTE_UNUSED, + unsigned long long cfs_period ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupGetCpuCfsPeriod(virCgroupPtr group ATTRIBUTE_UNUSED, + unsigned long long *cfs_period ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupSetCpuCfsQuota(virCgroupPtr group ATTRIBUTE_UNUSED, + long long cfs_quota ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupGetCpuCfsQuota(virCgroupPtr group ATTRIBUTE_UNUSED, + long long *cfs_quota ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupSetCpuShares(virCgroupPtr group ATTRIBUTE_UNUSED, + unsigned long long shares ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupGetCpuShares(virCgroupPtr group ATTRIBUTE_UNUSED, + unsigned long long *shares ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupGetCpuacctPercpuUsage(virCgroupPtr group ATTRIBUTE_UNUSED, + char **usage ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupGetCpuacctUsage(virCgroupPtr group ATTRIBUTE_UNUSED, + unsigned long long *usage ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupSetBlkioWeight(virCgroupPtr group ATTRIBUTE_UNUSED, + unsigned int weight ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupAllowDevice(virCgroupPtr group ATTRIBUTE_UNUSED, + char type ATTRIBUTE_UNUSED, + int major ATTRIBUTE_UNUSED, + int minor ATTRIBUTE_UNUSED, + int perms ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupAllowDeviceMajor(virCgroupPtr group ATTRIBUTE_UNUSED, + char type ATTRIBUTE_UNUSED, + int major ATTRIBUTE_UNUSED, + int perms ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupAddTask(virCgroupPtr group ATTRIBUTE_UNUSED, + pid_t pid ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupMoveTask(virCgroupPtr src_group ATTRIBUTE_UNUSED, + virCgroupPtr dest_group ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupAddTaskController(virCgroupPtr group ATTRIBUTE_UNUSED, + pid_t pid ATTRIBUTE_UNUSED, + int controller ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupGetBlkioWeight(virCgroupPtr group ATTRIBUTE_UNUSED, + unsigned int *weight ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupNewMachine(const char *name ATTRIBUTE_UNUSED, + const char *drivername ATTRIBUTE_UNUSED, + bool privileged ATTRIBUTE_UNUSED, + const unsigned char *uuid ATTRIBUTE_UNUSED, + const char *rootdir ATTRIBUTE_UNUSED, + pid_t pidleader ATTRIBUTE_UNUSED, + bool isContainer ATTRIBUTE_UNUSED, + const char *partition ATTRIBUTE_UNUSED, + int controllers ATTRIBUTE_UNUSED, + virCgroupPtr *group ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +bool virCgroupNewIgnoreError(void) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return false; +} + +int virCgroupRemove(virCgroupPtr group ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupRemoveRecursively(char *grppath ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupNewPartition(const char *path ATTRIBUTE_UNUSED, + bool create ATTRIBUTE_UNUSED, + int controllers ATTRIBUTE_UNUSED, + virCgroupPtr *group ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupNewDomainPartition(virCgroupPtr partition ATTRIBUTE_UNUSED, + const char *driver ATTRIBUTE_UNUSED, + const char *name ATTRIBUTE_UNUSED, + bool create ATTRIBUTE_UNUSED, + virCgroupPtr *group ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupNewVcpu(virCgroupPtr domain ATTRIBUTE_UNUSED, + int vcpuid ATTRIBUTE_UNUSED, + bool create ATTRIBUTE_UNUSED, + virCgroupPtr *group ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupNewEmulator(virCgroupPtr domain ATTRIBUTE_UNUSED, + bool create ATTRIBUTE_UNUSED, + virCgroupPtr *group ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupNewDetect(pid_t pid ATTRIBUTE_UNUSED, + int controllers ATTRIBUTE_UNUSED, + virCgroupPtr *group ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENXIO, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int +virCgroupSetBlkioDeviceWeight(virCgroupPtr group ATTRIBUTE_UNUSED, + const char *path ATTRIBUTE_UNUSED, + unsigned int weight ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENOSYS, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupAllowDevicePath(virCgroupPtr group ATTRIBUTE_UNUSED, + const char *path ATTRIBUTE_UNUSED, + int perms ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENOSYS, "%s", + _("Control groups not supported on this platform")); + return -1; +} +int virCgroupDenyDevicePath(virCgroupPtr group ATTRIBUTE_UNUSED, + const char *path ATTRIBUTE_UNUSED, + int perms ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENOSYS, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupPathOfController(virCgroupPtr group ATTRIBUTE_UNUSED, + int controller ATTRIBUTE_UNUSED, + const char *key ATTRIBUTE_UNUSED, + char **path ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENOSYS, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +bool virCgroupHasController(virCgroupPtr cgroup ATTRIBUTE_UNUSED, + int controller ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENOSYS, "%s", + _("Control groups not supported on this platform")); + return -1; + +} + +int virCgroupSetFreezerState(virCgroupPtr group ATTRIBUTE_UNUSED, + const char *state ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENOSYS, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupGetFreezerState(virCgroupPtr group ATTRIBUTE_UNUSED, + char **state ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENOSYS, "%s", + _("Control groups not supported on this platform")); + return -1; +} + +int virCgroupIsolateMount(virCgroupPtr group ATTRIBUTE_UNUSED, + const char *oldroot ATTRIBUTE_UNUSED, + const char *mountopts ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENOSYS, "%s", + _("Control groups not supported on this platform")); + return -1; +} +#endif /* VIR_CGROUP_SUPPORTED */ + +#if defined(VIR_CGROUP_SUPPORTED) && defined(HAVE_KILL) +/* + * Returns 1 if some PIDs are killed, 0 if none are killed, or -1 on error + */ +static int virCgroupKillInternal(virCgroupPtr group, int signum, virHashTablePtr pids) +{ + int ret = -1; + bool killedAny = false; + char *keypath = NULL; + bool done = false; + FILE *fp = NULL; + VIR_DEBUG("group=%p path=%s signum=%d pids=%p", + group, group->path, signum, pids); + + if (virCgroupPathOfController(group, -1, "tasks", &keypath) < 0) + return -1; + + /* PIDs may be forking as we kill them, so loop + * until there are no new PIDs found + */ + while (!done) { + done = true; + if (!(fp = fopen(keypath, "r"))) { + if (errno == ENOENT) { + VIR_DEBUG("No file %s, assuming done", keypath); + killedAny = false; + goto done; + } + + virReportSystemError(errno, + _("Failed to read %s"), + keypath); + goto cleanup; + } else { + while (!feof(fp)) { + unsigned long pid_value; + if (fscanf(fp, "%lu", &pid_value) != 1) { + if (feof(fp)) + break; + virReportSystemError(errno, + _("Failed to read %s"), + keypath); + goto cleanup; + } + if (virHashLookup(pids, (void*)pid_value)) + continue; VIR_DEBUG("pid=%lu", pid_value); /* Cgroups is a Linux concept, so this cast is safe. */ @@ -2800,7 +3179,6 @@ int virCgroupKill(virCgroupPtr group, int signum) return ret; } - static int virCgroupKillRecursiveInternal(virCgroupPtr group, int signum, virHashTablePtr pids, bool dormdir) { int ret = -1; @@ -2911,7 +3289,7 @@ int virCgroupKillPainfully(virCgroupPtr group) return ret; } -#else /* !(HAVE_KILL, HAVE_MNTENT_H, HAVE_GETMNTENT_R) */ +#else /* !(VIR_CGROUP_SUPPORTED, HAVE_KILL) */ int virCgroupKill(virCgroupPtr group ATTRIBUTE_UNUSED, int signum ATTRIBUTE_UNUSED) { @@ -2933,128 +3311,62 @@ int virCgroupKillPainfully(virCgroupPtr group ATTRIBUTE_UNUSED) _("Control groups not supported on this platform")); return -1; } -#endif /* HAVE_KILL, HAVE_MNTENT_H, HAVE_GETMNTENT_R */ - -#ifdef __linux__ -static char *virCgroupIdentifyRoot(virCgroupPtr group) -{ - char *ret = NULL; - size_t i; - - for (i = 0; i < VIR_CGROUP_CONTROLLER_LAST; i++) { - char *tmp; - if (!group->controllers[i].mountPoint) - continue; - if (!(tmp = strrchr(group->controllers[i].mountPoint, '/'))) { - virReportError(VIR_ERR_INTERNAL_ERROR, - _("Could not find directory separator in %s"), - group->controllers[i].mountPoint); - return NULL; - } - - if (VIR_STRNDUP(ret, group->controllers[i].mountPoint, - tmp - group->controllers[i].mountPoint) < 0) - return NULL; - return ret; - } - - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("Could not find any mounted controllers")); - return NULL; -} - +#endif /* VIR_CGROUP_SUPPORTED, HAVE_KILL */ -int virCgroupIsolateMount(virCgroupPtr group, const char *oldroot, - const char *mountopts) +#if defined(VIR_CGROUP_SUPPORTED) && defined(_SC_CLK_TCK) +int virCgroupGetCpuacctStat(virCgroupPtr group, unsigned long long *user, + unsigned long long *sys) { + char *str; + char *p; int ret = -1; - size_t i; - char *opts = NULL; - char *root = NULL; + static double scale = -1.0; - if (!(root = virCgroupIdentifyRoot(group))) + if (virCgroupGetValueStr(group, VIR_CGROUP_CONTROLLER_CPUACCT, + "cpuacct.stat", &str) < 0) return -1; - VIR_DEBUG("Mounting cgroups at '%s'", root); - - if (virFileMakePath(root) < 0) { - virReportSystemError(errno, - _("Unable to create directory %s"), - root); + if (!(p = STRSKIP(str, "user ")) || + virStrToLong_ull(p, &p, 10, user) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Cannot parse user stat '%s'"), + p); goto cleanup; } - - if (virAsprintf(&opts, - "mode=755,size=65536%s", mountopts) < 0) - goto cleanup; - - if (mount("tmpfs", root, "tmpfs", MS_NOSUID|MS_NODEV|MS_NOEXEC, opts) < 0) { - virReportSystemError(errno, - _("Failed to mount %s on %s type %s"), - "tmpfs", root, "tmpfs"); + if (!(p = STRSKIP(p, "\nsystem ")) || + virStrToLong_ull(p, NULL, 10, sys) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Cannot parse sys stat '%s'"), + p); goto cleanup; } - - for (i = 0; i < VIR_CGROUP_CONTROLLER_LAST; i++) { - if (!group->controllers[i].mountPoint) - continue; - - if (!virFileExists(group->controllers[i].mountPoint)) { - char *src; - if (virAsprintf(&src, "%s%s%s", - oldroot, - group->controllers[i].mountPoint, - group->controllers[i].placement) < 0) - goto cleanup; - - VIR_DEBUG("Create mount point '%s'", group->controllers[i].mountPoint); - if (virFileMakePath(group->controllers[i].mountPoint) < 0) { - virReportSystemError(errno, - _("Unable to create directory %s"), - group->controllers[i].mountPoint); - VIR_FREE(src); - goto cleanup; - } - - if (mount(src, group->controllers[i].mountPoint, NULL, MS_BIND, NULL) < 0) { - virReportSystemError(errno, - _("Failed to bind cgroup '%s' on '%s'"), - src, group->controllers[i].mountPoint); - VIR_FREE(src); - goto cleanup; - } - - VIR_FREE(src); - } - - if (group->controllers[i].linkPoint) { - VIR_DEBUG("Link mount point '%s' to '%s'", - group->controllers[i].mountPoint, - group->controllers[i].linkPoint); - if (symlink(group->controllers[i].mountPoint, - group->controllers[i].linkPoint) < 0) { - virReportSystemError(errno, - _("Unable to symlink directory %s to %s"), - group->controllers[i].mountPoint, - group->controllers[i].linkPoint); - return -1; - } + /* times reported are in system ticks (generally 100 Hz), but that + * rate can theoretically vary between machines. Scale things + * into approximate nanoseconds. */ + if (scale < 0) { + long ticks_per_sec = sysconf(_SC_CLK_TCK); + if (ticks_per_sec == -1) { + virReportSystemError(errno, "%s", + _("Cannot determine system clock HZ")); + goto cleanup; } + scale = 1000000000.0 / ticks_per_sec; } - ret = 0; + *user *= scale; + *sys *= scale; + ret = 0; cleanup: - VIR_FREE(root); - VIR_FREE(opts); + VIR_FREE(str); return ret; } -#else /* __linux__ */ -int virCgroupIsolateMount(virCgroupPtr group ATTRIBUTE_UNUSED, - const char *oldroot ATTRIBUTE_UNUSED, - const char *mountopts ATTRIBUTE_UNUSED) +#else +int virCgroupGetCpuacctStat(virCgroupPtr group ATTRIBUTE_UNUSED, + unsigned long long *user ATTRIBUTE_UNUSED, + unsigned long long *sys ATTRIBUTE_UNUSED) { virReportSystemError(ENOSYS, "%s", _("Control groups not supported on this platform")); return -1; } -#endif /* __linux__ */ +#endif -- 1.8.1.4

2 2

[libvirt] [libvirt-sandbox][PATCH v2] Update man page about virt-sandbox-service
by Zhe Peng 08 Aug '13

08 Aug '13

Add upgrade and remove start,stop,list --- bin/virt-sandbox-service.pod | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/bin/virt-sandbox-service.pod b/bin/virt-sandbox-service.pod index 32caad9..7752145 100644 --- a/bin/virt-sandbox-service.pod +++ b/bin/virt-sandbox-service.pod @@ -4,7 +4,7 @@ virt-sandbox-service - Secure container tool =head1 SYNOPSIS - {create,clone,connect,delete,execute,list,reload,start,stop} + {create,clone,connect,delete,execute,reload,upgrade} commands: @@ -20,6 +20,8 @@ virt-sandbox-service - Secure container tool reload Reload a running sandbox container + upgrade Upgrade an existing sandbox container + =head1 DESCRIPTION virt-sandbox-service is used to provision secure sandboxed system services. @@ -52,7 +54,7 @@ supported currently). =head1 SEE ALSO -C<libvirt(8)>, C<selinux(8)>, C<systemd(8)>, C<virt-sandbox(1)>, C<virt-sandbox-service-create(1)>, C<virt-sandbox-service-clone(1)>, C<virt-sandbox-service-connect(1)>, C<virt-sandbox-service-delete(1)>, C<virt-sandbox-service-execute(1)>, C<virt-sandbox-service-reload(1)> +C<libvirt(8)>, C<selinux(8)>, C<systemd(8)>, C<virt-sandbox(1)>, C<virt-sandbox-service-create(1)>, C<virt-sandbox-service-clone(1)>, C<virt-sandbox-service-connect(1)>, C<virt-sandbox-service-delete(1)>, C<virt-sandbox-service-execute(1)>, C<virt-sandbox-service-reload(1)>, C<virt-sandbox-service-upgrade(1)> =head1 FILES -- 1.7.7.6

2 1

[libvirt] [libvirt-sandbox][PATCH] Update man page about virt-sandbox-service
by Zhe Peng 08 Aug '13

08 Aug '13

Add upgrade and remove start,stop,list --- bin/virt-sandbox-service.pod | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/bin/virt-sandbox-service.pod b/bin/virt-sandbox-service.pod index 32caad9..e8ab55e 100644 --- a/bin/virt-sandbox-service.pod +++ b/bin/virt-sandbox-service.pod @@ -4,7 +4,7 @@ virt-sandbox-service - Secure container tool =head1 SYNOPSIS - {create,clone,connect,delete,execute,list,reload,start,stop} + {create,clone,connect,delete,execute,reload,upgrade} commands: @@ -20,6 +20,8 @@ virt-sandbox-service - Secure container tool reload Reload a running sandbox container + upgrade Upgrade an existing Secure container + =head1 DESCRIPTION virt-sandbox-service is used to provision secure sandboxed system services. @@ -52,7 +54,7 @@ supported currently). =head1 SEE ALSO -C<libvirt(8)>, C<selinux(8)>, C<systemd(8)>, C<virt-sandbox(1)>, C<virt-sandbox-service-create(1)>, C<virt-sandbox-service-clone(1)>, C<virt-sandbox-service-connect(1)>, C<virt-sandbox-service-delete(1)>, C<virt-sandbox-service-execute(1)>, C<virt-sandbox-service-reload(1)> +C<libvirt(8)>, C<selinux(8)>, C<systemd(8)>, C<virt-sandbox(1)>, C<virt-sandbox-service-create(1)>, C<virt-sandbox-service-clone(1)>, C<virt-sandbox-service-connect(1)>, C<virt-sandbox-service-delete(1)>, C<virt-sandbox-service-execute(1)>, C<virt-sandbox-service-reload(1)>, C<virt-sandbox-service-upgrade(1)> =head1 FILES -- 1.7.7.6

2 1

[libvirt] rhel 5 'make check' failure
by Eric Blake 08 Aug '13

08 Aug '13

I ran out of time to investigate today, in case someone wants to beat me to a fix: > virsystemdmock.c: In function 'dbus_connection_send_with_reply_and_block': > virsystemdmod.c:68: warning: implicit declaration of function 'dbus_message_set_serial' this failure occurred on RHEL 5; dbus-devel-1.1.2-20.el5. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

1 0

[libvirt] [PATCHv2] build: fix configure detection of if_bridge.h on RHEL 6, try 2
by Eric Blake 08 Aug '13

08 Aug '13

This is a second attempt at fixing the problem first attempted in commit 2df8d99; basically undoing the fact that it was reverted in commit 43cee32f, plus fixing one more issue: the code in configure.ac has to EXACTLY match virnetdevbridge.c with regards to declaring in6 types before using if_bridge.h. The rest of this commit message borrows from the original: A fresh checkout on a RHEL 6 machine with these packages: kernel-headers-2.6.32-405.el6.x86_64 glibc-2.12-1.128.el6.x86_64 failed to configure with this message: checking for linux/if_bridge.h... no configure: error: You must install kernel-headers in order to compile libvirt with QEMU or LXC support Digging in config.log, we see that the problem is identical to what we fixed earlier in commit d12c2811: configure:98831: checking for linux/if_bridge.h configure:98853: gcc -std=gnu99 -c -g -O2 conftest.c >&5 In file included from /usr/include/linux/if_bridge.h:17, from conftest.c:559: /usr/include/linux/in6.h:31: error: redefinition of 'struct in6_addr' /usr/include/linux/in6.h:48: error: redefinition of 'struct sockaddr_in6' /usr/include/linux/in6.h:56: error: redefinition of 'struct ipv6_mreq' configure:98860: $? = 1 I had not hit it earlier because I was using incremental builds, where config.cache had shielded me from the kernel-headers breakage. * configure.ac (if_bridge.h): Avoid conflicting type definitions. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Although this fixes a build-breaker, this time I'm awaiting review since my first attempt caused grief on Fedora. configure.ac | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index a155790..e5dd67b 100644 --- a/configure.ac +++ b/configure.ac @@ -997,7 +997,15 @@ if test "$with_linux" = "yes"; then if test "$with_qemu" = "yes" || test "$with_lxc" = "yes" ; then AC_CHECK_HEADERS([linux/param.h linux/sockios.h linux/if_bridge.h linux/if_tun.h],, [AC_MSG_ERROR([You must install kernel-headers in order to compile libvirt with QEMU or LXC support])], - [[#include <netinet/in.h> + [[/* The kernel folks broke their headers when used with particular + * glibc versions; although the structs are ABI compatible, the + * C type system doesn't like struct redefinitions. We work around + * the problem here in the same manner as in virnetdevbridge.c. */ + #include <netinet/in.h> + #define in6_addr in6_addr_ + #define sockaddr_in6 sockaddr_in6_ + #define ipv6_mreq ipv6_mreq_ + #include <linux/in6.h> ]]) fi fi -- 1.8.3.1

1 1

[libvirt] Patch for BUG ID 994657
by Schmaus, John M. (John) 07 Aug '13

07 Aug '13

Hi All, Here is the change I made to address the SIGSEGV we were seeing in libvirtd when attempting to create a new VM via virt-install: - We call virDomainDefFree after xenDaemonCreateXML returns to xenUnifiedDomainCreateXML. - xenUnifiedDomainCreateXML passes def to virGetDomain after XenDaemonCreateXML returns and before it calls virGetDomain. - xenUnifiedDomainCreateXML calls virDomainDefFree(def) when it's done with def, so no need to free inside xenUnifiedDomainCreateXML. ------------------------ patch ------------------------- --- /tmp/xend_internal.c 2013-08-07 12:03:03.000000000 -0600 +++ src/xen/xend_internal.c 2013-08-07 08:51:49.000000000 -0600 @@ -2171,7 +2171,9 @@ if (xenDaemonDomainResume(conn, def) < 0) goto error; - virDomainDefFree(def); + // We call this a little later and still want to use def, so + // don't free it just yet. + //virDomainDefFree(def); return 0;

2 1

[libvirt] [PATCH] build: fix configure detection of if_bridge.h on RHEL 6
by Eric Blake 07 Aug '13

07 Aug '13

A fresh checkout on a RHEL 6 machine with these packages: kernel-headers-2.6.32-405.el6.x86_64 glibc-2.12-1.128.el6.x86_64 failed to configure with this message: checking for linux/if_bridge.h... no configure: error: You must install kernel-headers in order to compile libvirt with QEMU or LXC support Digging in config.log, we see that the problem is identical to what we fixed earlier in commit d12c2811: configure:98831: checking for linux/if_bridge.h configure:98853: gcc -std=gnu99 -c -g -O2 conftest.c >&5 In file included from /usr/include/linux/if_bridge.h:17, from conftest.c:559: /usr/include/linux/in6.h:31: error: redefinition of 'struct in6_addr' /usr/include/linux/in6.h:48: error: redefinition of 'struct sockaddr_in6' /usr/include/linux/in6.h:56: error: redefinition of 'struct ipv6_mreq' configure:98860: $? = 1 I had not hit it earlier because I was using incremental builds, where config.cache had shielded me from the kernel-headers breakage. * configure.ac (if_bridge.h): Avoid conflicting type definitions. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule, and backporting to v1.1.1-maint configure.ac | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index 944a870..02f3e4a 100644 --- a/configure.ac +++ b/configure.ac @@ -999,7 +999,14 @@ if test "$with_linux" = "yes"; then if test "$with_qemu" = "yes" || test "$with_lxc" = "yes" ; then AC_CHECK_HEADERS([linux/param.h linux/sockios.h linux/if_bridge.h linux/if_tun.h],, [AC_MSG_ERROR([You must install kernel-headers in order to compile libvirt with QEMU or LXC support])], - [[#include <netinet/in.h> + [[/* The kernel folks broke their headers when used with particular + * glibc versions; although the structs are ABI compatible, the + * C type system doesn't like struct redefinitions. We work around + * the problem here in the same manner as in virnetdevbridge.c. */ + #include <netinet/in.h> + #define in6_addr in6_addr_ + #define sockaddr_in6 sockaddr_in6_ + #define ipv6_mreq ipv6_mreq_ ]]) fi fi -- 1.8.3.1

2 3

[libvirt] [PATCH] virthread: include config.h in the header file
by Paul Moore 07 Aug '13

07 Aug '13

The virthread.h header file includes platform specific header files that help define the thread implementation, see code snippet below. # ifdef WIN32 # include "virthreadwin32.h" # elif defined HAVE_PTHREAD_MUTEXATTR_INIT # include "virthreadpthread.h" # else # error "Either pthreads or Win32 threads are required" # endif Unfortunately, virthread.h does not include config.h so every source file which includes virthread.h must also include config.h, regardless of if the source file directly needs definitions in config.h. This patch adds config.h to virthread.h in an effort to help simplify things. Signed-off-by: Paul Moore <pmoore(a)redhat.com> --- src/util/virthread.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/util/virthread.h b/src/util/virthread.h index 84d3bdc..091cdd0 100644 --- a/src/util/virthread.h +++ b/src/util/virthread.h @@ -22,6 +22,8 @@ #ifndef __THREADS_H_ # define __THREADS_H_ +#include <config.h> + # include "internal.h" # include "virerror.h"

2 2

[libvirt] [PATCH v2 0/3] Add tests for network update XML parsing
by Ján Tomko 07 Aug '13

07 Aug '13

v1: https://www.redhat.com/archives/libvir-list/2013-July/msg01971.html v2: remove the spaces from other elements instead of adding one Ján Tomko (3): Remove the space before the slash in network XML Reverse logic allowing partial DHCP host XML Test network XML update src/conf/network_conf.h | 9 + src/conf/network_conf.c | 47 +-- src/libvirt_private.syms | 1 + src/network/default.xml | 4 +- src/test/test_driver.c | 4 +- tests/Makefile.am | 9 +- tests/networkxml2xmltest.c | 3 + tests/networkxml2xmlupdatetest.c | 372 +++++++++++++++++++++ tests/networkxml2confdata/dhcp6-nat-network.xml | 20 +- tests/networkxml2confdata/dhcp6-network.xml | 14 +- .../dhcp6host-routed-network.xml | 16 +- tests/networkxml2confdata/isolated-network.xml | 4 +- .../networkxml2confdata/nat-network-dns-hosts.xml | 2 +- .../nat-network-dns-srv-record-minimal.xml | 10 +- .../nat-network-dns-srv-record.xml | 10 +- .../nat-network-dns-txt-record.xml | 10 +- tests/networkxml2confdata/nat-network.xml | 8 +- tests/networkxml2confdata/netboot-network.xml | 8 +- .../networkxml2confdata/netboot-proxy-network.xml | 6 +- tests/networkxml2confdata/routed-network.xml | 2 +- tests/networkxml2xmlin/bandwidth-network.xml | 4 +- .../networkxml2xmlin/dhcp6host-routed-network.xml | 16 +- tests/networkxml2xmlin/empty-allow-ipv6.xml | 2 +- tests/networkxml2xmlin/isolated-network.xml | 4 +- tests/networkxml2xmlin/nat-network-dns-hosts.xml | 2 +- .../nat-network-dns-srv-record-minimal.xml | 10 +- .../nat-network-dns-srv-record.xml | 10 +- .../nat-network-dns-srv-records.xml | 27 ++ .../nat-network-dns-txt-record.xml | 10 +- tests/networkxml2xmlin/nat-network.xml | 8 +- tests/networkxml2xmlin/netboot-network.xml | 6 +- tests/networkxml2xmlin/netboot-proxy-network.xml | 4 +- tests/networkxml2xmlin/routed-network.xml | 2 +- tests/networkxml2xmlout/bandwidth-network.xml | 4 +- .../networkxml2xmlout/dhcp6host-routed-network.xml | 16 +- tests/networkxml2xmlout/empty-allow-ipv6.xml | 2 +- tests/networkxml2xmlout/host-bridge-net.xml | 2 +- tests/networkxml2xmlout/isolated-network.xml | 4 +- tests/networkxml2xmlout/nat-network-dns-hosts.xml | 2 +- .../nat-network-dns-srv-record-minimal.xml | 10 +- .../nat-network-dns-srv-record.xml | 10 +- .../nat-network-dns-srv-records.xml | 27 ++ .../nat-network-dns-txt-record.xml | 10 +- tests/networkxml2xmlout/nat-network.xml | 8 +- tests/networkxml2xmlout/netboot-network.xml | 8 +- tests/networkxml2xmlout/netboot-proxy-network.xml | 6 +- tests/networkxml2xmlout/routed-network.xml | 2 +- .../networkxml2xmlupdatein/dhcp-range-existing.xml | 1 + tests/networkxml2xmlupdatein/dhcp-range.xml | 1 + .../dns-host-gateway-incomplete.xml | 3 + tests/networkxml2xmlupdatein/dns-host-pudding.xml | 3 + .../dns-txt-record-example.xml | 1 + .../dns-txt-record-snowman.xml | 1 + tests/networkxml2xmlupdatein/host-existing.xml | 1 + tests/networkxml2xmlupdatein/host-incomplete.xml | 1 + .../networkxml2xmlupdatein/host-new-incomplete.xml | 1 + tests/networkxml2xmlupdatein/host-new.xml | 1 + tests/networkxml2xmlupdatein/host-updated.xml | 1 + tests/networkxml2xmlupdatein/interface-eth1.xml | 1 + tests/networkxml2xmlupdatein/interface-eth47.xml | 1 + .../networkxml2xmlupdatein/portgroup-alice-new.xml | 10 + tests/networkxml2xmlupdatein/portgroup-alison.xml | 11 + tests/networkxml2xmlupdatein/srv-record-donkey.xml | 1 + .../networkxml2xmlupdatein/srv-record-invalid.xml | 1 + .../networkxml2xmlupdatein/srv-record-protocol.xml | 1 + .../networkxml2xmlupdatein/srv-record-service.xml | 1 + tests/networkxml2xmlupdatein/srv-record.xml | 1 + .../networkxml2xmlupdatein/unparsable-dns-host.xml | 1 + .../dhcp6host-routed-network-another-range.xml | 27 ++ .../dhcp6host-routed-network-range.xml | 27 ++ .../nat-network-dns-more-hosts.xml | 19 ++ .../nat-network-dns-srv-record.xml | 26 ++ .../nat-network-dns-srv-records.xml | 27 ++ .../nat-network-dns-txt-none.xml | 23 ++ .../nat-network-dns-txt-records.xml | 27 ++ .../nat-network-forward-ifaces.xml | 27 ++ .../nat-network-host-updated.xml | 23 ++ .../networkxml2xmlupdateout/nat-network-hosts.xml | 24 ++ .../nat-network-no-forward-ifaces.xml | 24 ++ .../nat-network-no-hosts.xml | 10 + .../nat-network-no-range.xml | 22 ++ .../nat-network-one-host.xml | 22 ++ tests/networkxml2xmlupdateout/nat-network.xml | 23 ++ .../openvswitch-net-modified.xml | 33 ++ .../openvswitch-net-more-portgroups.xml | 44 +++ .../openvswitch-net-without-alice.xml | 23 ++ 86 files changed, 1100 insertions(+), 170 deletions(-) create mode 100644 tests/networkxml2xmlupdatetest.c create mode 100644 tests/networkxml2xmlin/nat-network-dns-srv-records.xml create mode 100644 tests/networkxml2xmlout/nat-network-dns-srv-records.xml create mode 100644 tests/networkxml2xmlupdatein/dhcp-range-existing.xml create mode 100644 tests/networkxml2xmlupdatein/dhcp-range.xml create mode 100644 tests/networkxml2xmlupdatein/dns-host-gateway-incomplete.xml create mode 100644 tests/networkxml2xmlupdatein/dns-host-pudding.xml create mode 100644 tests/networkxml2xmlupdatein/dns-txt-record-example.xml create mode 100644 tests/networkxml2xmlupdatein/dns-txt-record-snowman.xml create mode 100644 tests/networkxml2xmlupdatein/host-existing.xml create mode 100644 tests/networkxml2xmlupdatein/host-incomplete.xml create mode 100644 tests/networkxml2xmlupdatein/host-new-incomplete.xml create mode 100644 tests/networkxml2xmlupdatein/host-new.xml create mode 100644 tests/networkxml2xmlupdatein/host-updated.xml create mode 100644 tests/networkxml2xmlupdatein/interface-eth1.xml create mode 100644 tests/networkxml2xmlupdatein/interface-eth47.xml create mode 100644 tests/networkxml2xmlupdatein/portgroup-alice-new.xml create mode 100644 tests/networkxml2xmlupdatein/portgroup-alison.xml create mode 100644 tests/networkxml2xmlupdatein/srv-record-donkey.xml create mode 100644 tests/networkxml2xmlupdatein/srv-record-invalid.xml create mode 100644 tests/networkxml2xmlupdatein/srv-record-protocol.xml create mode 100644 tests/networkxml2xmlupdatein/srv-record-service.xml create mode 100644 tests/networkxml2xmlupdatein/srv-record.xml create mode 100644 tests/networkxml2xmlupdatein/unparsable-dns-host.xml create mode 100644 tests/networkxml2xmlupdateout/dhcp6host-routed-network-another-range.xml create mode 100644 tests/networkxml2xmlupdateout/dhcp6host-routed-network-range.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-dns-more-hosts.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-dns-srv-record.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-dns-srv-records.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-dns-txt-none.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-dns-txt-records.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-forward-ifaces.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-host-updated.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-hosts.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-no-forward-ifaces.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-no-hosts.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-no-range.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-one-host.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network.xml create mode 100644 tests/networkxml2xmlupdateout/openvswitch-net-modified.xml create mode 100644 tests/networkxml2xmlupdateout/openvswitch-net-more-portgroups.xml create mode 100644 tests/networkxml2xmlupdateout/openvswitch-net-without-alice.xml -- 1.8.1.5

1 4

[libvirt] [PATCH 0/3] Add tests for network update XML parsing
by Ján Tomko 07 Aug '13

07 Aug '13

Ján Tomko (3): Add space before the slash in dns srv entries Reverse logic allowing partial DHCP host XML Test network XML update src/conf/network_conf.h | 9 + src/libvirt_private.syms | 1 + src/conf/network_conf.c | 25 +- tests/Makefile.am | 9 +- tests/networkxml2xmltest.c | 3 + tests/networkxml2xmlupdatetest.c | 372 +++++++++++++++++++++ .../nat-network-dns-srv-records.xml | 27 ++ .../nat-network-dns-srv-records.xml | 27 ++ .../networkxml2xmlupdatein/dhcp-range-existing.xml | 1 + tests/networkxml2xmlupdatein/dhcp-range.xml | 1 + .../dns-host-gateway-incomplete.xml | 3 + tests/networkxml2xmlupdatein/dns-host-pudding.xml | 3 + .../dns-txt-record-example.xml | 1 + .../dns-txt-record-snowman.xml | 1 + tests/networkxml2xmlupdatein/host-existing.xml | 1 + tests/networkxml2xmlupdatein/host-incomplete.xml | 1 + .../networkxml2xmlupdatein/host-new-incomplete.xml | 1 + tests/networkxml2xmlupdatein/host-new.xml | 1 + tests/networkxml2xmlupdatein/host-updated.xml | 1 + tests/networkxml2xmlupdatein/interface-eth1.xml | 1 + tests/networkxml2xmlupdatein/interface-eth47.xml | 1 + .../networkxml2xmlupdatein/portgroup-alice-new.xml | 10 + tests/networkxml2xmlupdatein/portgroup-alison.xml | 11 + tests/networkxml2xmlupdatein/srv-record-donkey.xml | 1 + .../networkxml2xmlupdatein/srv-record-invalid.xml | 1 + .../networkxml2xmlupdatein/srv-record-protocol.xml | 1 + .../networkxml2xmlupdatein/srv-record-service.xml | 1 + tests/networkxml2xmlupdatein/srv-record.xml | 1 + .../networkxml2xmlupdatein/unparsable-dns-host.xml | 1 + .../dhcp6host-routed-network-another-range.xml | 27 ++ .../dhcp6host-routed-network-range.xml | 27 ++ .../nat-network-dns-more-hosts.xml | 19 ++ .../nat-network-dns-srv-record.xml | 26 ++ .../nat-network-dns-srv-records.xml | 27 ++ .../nat-network-dns-txt-none.xml | 23 ++ .../nat-network-dns-txt-records.xml | 27 ++ .../nat-network-forward-ifaces.xml | 27 ++ .../nat-network-host-updated.xml | 23 ++ .../networkxml2xmlupdateout/nat-network-hosts.xml | 24 ++ .../nat-network-no-forward-ifaces.xml | 24 ++ .../nat-network-no-hosts.xml | 10 + .../nat-network-no-range.xml | 22 ++ .../nat-network-one-host.xml | 22 ++ tests/networkxml2xmlupdateout/nat-network.xml | 23 ++ .../openvswitch-net-modified.xml | 33 ++ .../openvswitch-net-more-portgroups.xml | 44 +++ .../openvswitch-net-without-alice.xml | 23 ++ 47 files changed, 949 insertions(+), 19 deletions(-) create mode 100644 tests/networkxml2xmlupdatetest.c create mode 100644 tests/networkxml2xmlin/nat-network-dns-srv-records.xml create mode 100644 tests/networkxml2xmlout/nat-network-dns-srv-records.xml create mode 100644 tests/networkxml2xmlupdatein/dhcp-range-existing.xml create mode 100644 tests/networkxml2xmlupdatein/dhcp-range.xml create mode 100644 tests/networkxml2xmlupdatein/dns-host-gateway-incomplete.xml create mode 100644 tests/networkxml2xmlupdatein/dns-host-pudding.xml create mode 100644 tests/networkxml2xmlupdatein/dns-txt-record-example.xml create mode 100644 tests/networkxml2xmlupdatein/dns-txt-record-snowman.xml create mode 100644 tests/networkxml2xmlupdatein/host-existing.xml create mode 100644 tests/networkxml2xmlupdatein/host-incomplete.xml create mode 100644 tests/networkxml2xmlupdatein/host-new-incomplete.xml create mode 100644 tests/networkxml2xmlupdatein/host-new.xml create mode 100644 tests/networkxml2xmlupdatein/host-updated.xml create mode 100644 tests/networkxml2xmlupdatein/interface-eth1.xml create mode 100644 tests/networkxml2xmlupdatein/interface-eth47.xml create mode 100644 tests/networkxml2xmlupdatein/portgroup-alice-new.xml create mode 100644 tests/networkxml2xmlupdatein/portgroup-alison.xml create mode 100644 tests/networkxml2xmlupdatein/srv-record-donkey.xml create mode 100644 tests/networkxml2xmlupdatein/srv-record-invalid.xml create mode 100644 tests/networkxml2xmlupdatein/srv-record-protocol.xml create mode 100644 tests/networkxml2xmlupdatein/srv-record-service.xml create mode 100644 tests/networkxml2xmlupdatein/srv-record.xml create mode 100644 tests/networkxml2xmlupdatein/unparsable-dns-host.xml create mode 100644 tests/networkxml2xmlupdateout/dhcp6host-routed-network-another-range.xml create mode 100644 tests/networkxml2xmlupdateout/dhcp6host-routed-network-range.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-dns-more-hosts.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-dns-srv-record.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-dns-srv-records.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-dns-txt-none.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-dns-txt-records.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-forward-ifaces.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-host-updated.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-hosts.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-no-forward-ifaces.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-no-hosts.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-no-range.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-one-host.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network.xml create mode 100644 tests/networkxml2xmlupdateout/openvswitch-net-modified.xml create mode 100644 tests/networkxml2xmlupdateout/openvswitch-net-more-portgroups.xml create mode 100644 tests/networkxml2xmlupdateout/openvswitch-net-without-alice.xml -- 1.8.1.5

4 7

[libvirt] [sandbox][PATCH] Fix delete of running containers
by Wayne Sun 07 Aug '13

07 Aug '13

The stop function is removed since 0.5.0, update delete function using virsh destroy to stop container. Signed-off-by: Wayne Sun <gsun(a)redhat.com> --- bin/virt-sandbox-service | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/bin/virt-sandbox-service b/bin/virt-sandbox-service index 550d46c..926d1d5 100755 --- a/bin/virt-sandbox-service +++ b/bin/virt-sandbox-service @@ -254,9 +254,11 @@ class Container: def delete(self): self.connect() - # Stop service if it is running + # Stop container if it is running try: - self.stop() + p = Popen(["/usr/bin/virsh", "-c", self.uri, "destroy", self.name], + stdout=PIPE, stderr=PIPE) + p.communicate() except: pass -- 1.7.1

2 2

[libvirt] [PATCH v5 0/2] add startupPolicy support for harddisks
by Guannan Ren 07 Aug '13

07 Aug '13

These patches are based on code https://www.redhat.com/archives/libvir-list/2013-July/msg01741.html The set of patches is trying to add 'startupPolicy' support for guest hard disks. For the 'optional' policy, there is a little difference from CDROM and Floppy which only drop its source path, for disks, if missing, the checking function will drop their definitions, because qemu doesn't allow missing source path for hard disk. migration is not supported yet. Guannan Ren(2) [PATCH v5 1/2] conf: add startupPolicy attribute for harddisk [PATCH v5 2/2] qemu: support to drop disk with 'optional' startupPolicy docs/formatdomain.html.in | 8 ++++++-- docs/schemas/domaincommon.rng | 6 ++++++ include/libvirt/libvirt.h.in | 1 + src/conf/domain_conf.c | 31 +++++++++++++++++++++++-------- src/qemu/qemu_domain.c | 77 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++---------------- 5 files changed, 97 insertions(+), 26 deletions(-)

2 8

[libvirt] [PATCH v2] nwfilter: Use -m conntrack rather than -m state
by Stefan Berger 07 Aug '13

07 Aug '13

Since iptables version 1.4.16 '-m state --state NEW' is converted to '-m conntrack --ctstate NEW'. Therefore, when encountering this or later versions of iptables use '-m conntrack --ctstate'. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- v1->v2: - Fixed a logic bug and adjusted version comparison to use '>=' rather than '>' --- src/nwfilter/nwfilter_ebiptables_driver.c | 50 +++++++++++++++++++++++++++++- 1 file changed, 49 insertions(+), 1 deletion(-) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -188,6 +188,9 @@ static const char ebiptables_script_set_ static const char *m_state_out_str = "-m state --state NEW,ESTABLISHED"; static const char *m_state_in_str = "-m state --state ESTABLISHED"; +static const char *m_state_out_str_new = "-m conntrack --ctstate NEW,ESTABLISHED"; +static const char *m_state_in_str_new = "-m conntrack --ctstate ESTABLISHED"; + static const char *m_physdev_in_str = "-m physdev " PHYSDEV_IN; static const char *m_physdev_out_str = "-m physdev " PHYSDEV_OUT; static const char *m_physdev_out_old_str = "-m physdev " PHYSDEV_OUT_OLD; @@ -4353,6 +4356,49 @@ ebiptablesDriverProbeCtdir(void) iptables_ctdir_corrected = CTDIR_STATUS_OLD; } +static void +ebiptablesDriverProbeStateMatch(void) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + char *cmdout = NULL, *version; + unsigned long thisversion; + + NWFILTER_SET_IPTABLES_SHELLVAR(&buf); + + virBufferAsprintf(&buf, + "$IPT --version"); + + if (ebiptablesExecCLI(&buf, NULL, &cmdout) < 0) { + VIR_ERROR(_("Testing of iptables command failed: %s"), + cmdout); + return; + } + + /* + * we expect output in the format + * iptables v1.4.16 + */ + if (!(version = strchr(cmdout, 'v')) || + virParseVersionString(version + 1, &thisversion, true) < 0) { + VIR_ERROR(_("Could not determine iptables version from string %s"), + cmdout); + goto cleanup; + } + + /* + * since version 1.4.16 '-m state --state ...' will be converted to + * '-m conntrack --ctstate ...' + */ + if (thisversion >= 1 * 1000000 + 4 * 1000 + 16) { + m_state_out_str = m_state_out_str_new; + m_state_in_str = m_state_in_str_new; + } + +cleanup: + VIR_FREE(cmdout); + return; +} + static int ebiptablesDriverInit(bool privileged) { @@ -4390,8 +4436,10 @@ ebiptablesDriverInit(bool privileged) return -ENOTSUP; } - if (iptables_cmd_path) + if (iptables_cmd_path) { ebiptablesDriverProbeCtdir(); + ebiptablesDriverProbeStateMatch(); + } ebiptables_driver.flags = TECHDRV_FLAG_INITIALIZED;

2 2

[libvirt] [PATCH] nwfilter: Use -m conntrack rather than -m state
by Stefan Berger 07 Aug '13

07 Aug '13

Since iptables version 1.4.16 '-m state --state NEW' is converted to '-m conntrack --ctstate NEW'. Therefore, when encountering this or later versions of iptables use '-m conntrack --ctstate'. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 50 +++++++++++++++++++++++++++++- 1 file changed, 49 insertions(+), 1 deletion(-) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -188,6 +188,9 @@ static const char ebiptables_script_set_ static const char *m_state_out_str = "-m state --state NEW,ESTABLISHED"; static const char *m_state_in_str = "-m state --state ESTABLISHED"; +static const char *m_state_out_str_new = "-m conntrack --ctstate NEW,ESTABLISHED"; +static const char *m_state_in_str_new = "-m conntrack --ctstate ESTABLISHED"; + static const char *m_physdev_in_str = "-m physdev " PHYSDEV_IN; static const char *m_physdev_out_str = "-m physdev " PHYSDEV_OUT; static const char *m_physdev_out_old_str = "-m physdev " PHYSDEV_OUT_OLD; @@ -4353,6 +4356,49 @@ ebiptablesDriverProbeCtdir(void) iptables_ctdir_corrected = CTDIR_STATUS_OLD; } +static void +ebiptablesDriverProbeStateMatch(void) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + char *cmdout = NULL, *version; + unsigned long thisversion; + + NWFILTER_SET_IPTABLES_SHELLVAR(&buf); + + virBufferAsprintf(&buf, + "$IPT --version"); + + if (ebiptablesExecCLI(&buf, NULL, &cmdout) < 0) { + VIR_ERROR(_("Testing of iptables command failed: %s"), + cmdout); + return; + } + + /* + * we expect output in the format + * iptables v1.4.16 + */ + if (!(version = strchr(cmdout, 'v')) && + virParseVersionString(version + 1, &thisversion, true) < 0) { + VIR_ERROR(_("Could not determine iptables version from string %s"), + cmdout); + goto cleanup; + } + + /* + * since version 1.4.16 '-m state --state ...' will be converted to + * '-m conntrack --ctstate ...' + */ + if (thisversion > 1 * 1000000 + 4 * 1000 + 16) { + m_state_out_str = m_state_out_str_new; + m_state_in_str = m_state_in_str_new; + } + +cleanup: + VIR_FREE(cmdout); + return; +} + static int ebiptablesDriverInit(bool privileged) { @@ -4390,8 +4436,10 @@ ebiptablesDriverInit(bool privileged) return -ENOTSUP; } - if (iptables_cmd_path) + if (iptables_cmd_path) { ebiptablesDriverProbeCtdir(); + ebiptablesDriverProbeStateMatch(); + } ebiptables_driver.flags = TECHDRV_FLAG_INITIALIZED;

2 5

[libvirt] [TCK][PATCH v2] nwfilter: convert ctstate to state
by Stefan Berger 06 Aug '13

06 Aug '13

iptables version 1.4.16 and later automatically convert -m state --state ... to -m conntrack --ctstate ... In the test cases we will then only see 'ctstate' and convert that back to the older 'state'. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- scripts/nwfilter/nwfilter2vmtest.sh | 5 +++++ 1 file changed, 5 insertions(+) Index: libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh =================================================================== --- libvirt-tck.orig/scripts/nwfilter/nwfilter2vmtest.sh +++ libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh @@ -181,6 +181,11 @@ checkExpectedOutput() { sed -i "s/ctdir _REPLY/ctdir REPLY/" ${tmpfile} fi + #iptables >= v1.4.16 converts -m state --state ... to + #-m conntrack --ctstate ... We now change ctstate back to + #state + sed -i "s/ctstate/state/" ${tmpfile} + diff -w ${tmpfile} ${tmpfile2} >/dev/null if [ $? -ne 0 ]; then

2 2

[libvirt] [PATCH] virGetGroupList: always include the primary group
by Guido Günther 06 Aug '13

06 Aug '13

The change from initgroups to virGetGroupList/setgroups in cab36cfe71ba83b71e536ba5c98e596f02b697b0 dropped the primary group from processes group list iff the passed in group to virGetGroupList differs from the user's primary group. So always include the primary group to bring back the old behaviour. Debian has the kvm group as primary group but uses libvirt-qemu:libvirt-qemu as user:group to run the kvm process so without this change the /dev/kvm is inaccesible. --- src/util/virutil.c | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-) diff --git a/src/util/virutil.c b/src/util/virutil.c index 3abcd53..12e1467 100644 --- a/src/util/virutil.c +++ b/src/util/virutil.c @@ -983,29 +983,41 @@ virGetGroupID(const char *group, gid_t *gid) } -/* Compute the list of supplementary groups associated with @uid, and - * including @gid in the list (unless it is -1), storing a malloc'd - * result into @list. Return the size of the list on success, or -1 - * on failure with error reported and errno set. May not be called - * between fork and exec. */ +/* Compute the list of primary and supplementary groups associated + * with @uid, and including @gid in the list (unless it is -1), + * storing a malloc'd result into @list. Return the size of the list + * on success, or -1 on failure with error reported and errno set. May + * not be called between fork and exec. */ int virGetGroupList(uid_t uid, gid_t gid, gid_t **list) { int ret = -1; char *user = NULL; + gid_t primary; *list = NULL; if (uid == (uid_t)-1) return 0; - if (virGetUserEnt(uid, &user, - gid == (gid_t)-1 ? &gid : NULL, NULL) < 0) + if (virGetUserEnt(uid, &user, &primary, NULL) < 0) return -1; - ret = mgetgroups(user, gid, list); - if (ret < 0) + ret = mgetgroups(user, primary, list); + if (ret < 0) { virReportSystemError(errno, _("cannot get group list for '%s'"), user); + goto cleanup; + } + + if (gid != (gid_t)-1) { + if (VIR_REALLOC_N(*list, ++ret) < 0) { + VIR_FREE(*list); + goto cleanup; + } + (*list)[ret-1] = gid; + } + +cleanup: VIR_FREE(user); return ret; } -- 1.8.3.2

2 4

[libvirt] [PATCHv3 0/2] RESEND - remaining 2 q35 patches
by Laine Stump 06 Aug '13

06 Aug '13

Just to make it easier to keep straight what has been pushed, I'm resending the last two patches that still need an ACK. Doug had reviewed 1/2, but didn't ACK because he wanted to get more opinions on whether it's better to a) have a special case that doesn't specify any id for the primary sata controller (relying on qemu to imply the proper controller) or b) have a special case that uses "ide.0" for the primary sata controller (which we've been told will work by qemu people). There was a 3rd patch that we've decided not to patch, waiting for a qemu fix to be pushed instead - the patch that changed all i82801b11-bridge controllers into pci-bridge controllers to work around a qemu bug. Laine Stump (2): qemu: enable using implicit sata controller in q35 machines qemu: improve error reporting during PCI address validation src/qemu/qemu_command.c | 247 +++++++++++++++--------- tests/qemuxml2argvdata/qemuxml2argv-q35.args | 2 + tests/qemuxml2argvdata/qemuxml2argv-q35.xml | 5 + tests/qemuxml2argvtest.c | 2 +- tests/qemuxml2xmloutdata/qemuxml2xmlout-q35.xml | 5 + 5 files changed, 171 insertions(+), 90 deletions(-) -- 1.7.11.7

3 8

[libvirt] [PATCH] xen: Use internal interfaces in xenDomainUsedCpus
by Stefan Bader 06 Aug '13

06 Aug '13

Based on Daniel's feedback I did a split for public/private functions for those that cause the lockup when getting XML. Maybe not complete but at least seems to allow basic usage again (through virt-manager). -Stefan --- >From f406c6891fb92a45dc5d5a4d794c5d667965d096 Mon Sep 17 00:00:00 2001 From: Stefan Bader <stefan.bader(a)canonical.com> Date: Mon, 15 Jul 2013 16:03:58 +0200 Subject: [PATCH] xen: Use internal interfaces in xenDomainUsedCpus Since commit 95e18efd most public interfaces (xenUnified...) obtain a virDomainDefPtr via xenGetDomainDefFor...() which take the unified lock. This is already taken before calling xenDomainUsedCpus(), so we get a deadlock for active guests. Avoid this by splitting up xenUnifiedDomainGetVcpusFlags() and xenUnifiedDomainGetVcpus() into public and private function calls (which get the virDomainDefPtr passed) and use those in xenDomainUsedCpus(). xenDomainUsedCpus ... nb_vcpu = xenUnifiedDomainGetMaxVcpus(dom); return xenUnifiedDomainGetVcpusFlags(...) ... if (!(def = xenGetDomainDefForDom(dom))) return xenGetDomainDefForUUID(dom->conn, dom->uuid); ... ret = xenHypervisorLookupDomainByUUID(conn, uuid); ... xenUnifiedLock(priv); name = xenStoreDomainGetName(conn, id); xenUnifiedUnlock(priv); ... if ((ncpus = xenUnifiedDomainGetVcpus(dom, cpuinfo, nb_vcpu, ... if (!(def = xenGetDomainDefForDom(dom))) [again like above] Signed-off-by: Stefan Bader <stefan.bader(a)canonical.com> --- src/xen/xen_driver.c | 94 +++++++++++++++++++++++++++++++++----------------- src/xen/xen_driver.h | 2 +- 2 files changed, 64 insertions(+), 32 deletions(-) diff --git a/src/xen/xen_driver.c b/src/xen/xen_driver.c index 39334b7..9ae728e 100644 --- a/src/xen/xen_driver.c +++ b/src/xen/xen_driver.c @@ -73,12 +73,14 @@ static int xenUnifiedNodeGetInfo(virConnectPtr conn, virNodeInfoPtr info); + static int -xenUnifiedDomainGetMaxVcpus(virDomainPtr dom); +__xenUnifiedDomainGetVcpusFlags(virDomainPtr dom, virDomainDefPtr def, + unsigned int flags); static int -xenUnifiedDomainGetVcpus(virDomainPtr dom, - virVcpuInfoPtr info, int maxinfo, - unsigned char *cpumaps, int maplen); +__xenUnifiedDomainGetVcpus(virDomainPtr dom, virDomainDefPtr def, + virVcpuInfoPtr info, int maxinfo, + unsigned char *cpumaps, int maplen); static bool is_privileged = false; @@ -173,6 +175,7 @@ xenNumaInit(virConnectPtr conn) { /** * xenDomainUsedCpus: * @dom: the domain + * @def: the domain definition * * Analyze which set of CPUs are used by the domain and * return a string providing the ranges. @@ -181,7 +184,7 @@ xenNumaInit(virConnectPtr conn) { * NULL if the domain uses all CPU or in case of error. */ char * -xenDomainUsedCpus(virDomainPtr dom) +xenDomainUsedCpus(virDomainPtr dom, virDomainDefPtr def) { char *res = NULL; int ncpus; @@ -202,9 +205,14 @@ xenDomainUsedCpus(virDomainPtr dom) if (priv->nbNodeCpus <= 0) return NULL; - nb_vcpu = xenUnifiedDomainGetMaxVcpus(dom); + nb_vcpu = __xenUnifiedDomainGetVcpusFlags(dom, def, + (VIR_DOMAIN_VCPU_LIVE | + VIR_DOMAIN_VCPU_MAXIMUM)); if (nb_vcpu <= 0) return NULL; + /* FIXME: To be consistent this should map to an internal interface, too. + * Currently it actually does map straight to xenDaemonNodeGetInfo(). + */ if (xenUnifiedNodeGetInfo(dom->conn, &nodeinfo) < 0) return NULL; @@ -217,8 +225,8 @@ xenDomainUsedCpus(virDomainPtr dom) VIR_ALLOC_N(cpumap, nb_vcpu * cpumaplen) < 0) goto done; - if ((ncpus = xenUnifiedDomainGetVcpus(dom, cpuinfo, nb_vcpu, - cpumap, cpumaplen)) >= 0) { + if ((ncpus = __xenUnifiedDomainGetVcpus(dom, def, cpuinfo, nb_vcpu, + cpumap, cpumaplen)) >= 0) { for (n = 0; n < ncpus; n++) { for (m = 0; m < priv->nbNodeCpus; m++) { bool used; @@ -1410,54 +1418,57 @@ cleanup: } static int -xenUnifiedDomainGetVcpus(virDomainPtr dom, - virVcpuInfoPtr info, int maxinfo, - unsigned char *cpumaps, int maplen) +__xenUnifiedDomainGetVcpus(virDomainPtr dom, virDomainDefPtr def, + virVcpuInfoPtr info, int maxinfo, + unsigned char *cpumaps, int maplen) { xenUnifiedPrivatePtr priv = dom->conn->privateData; - virDomainDefPtr def = NULL; int ret = -1; - if (!(def = xenGetDomainDefForDom(dom))) - goto cleanup; - - if (virDomainGetVcpusEnsureACL(dom->conn, def) < 0) - goto cleanup; - if (dom->id < 0) { if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Cannot get VCPUs of inactive domain")); - goto cleanup; } else { - ret = xenDaemonDomainGetVcpus(dom->conn, def, info, maxinfo, cpumaps, maplen); + ret = xenDaemonDomainGetVcpus(dom->conn, def, info, maxinfo, + cpumaps, maplen); } } else { - ret = xenHypervisorGetVcpus(dom->conn, def, info, maxinfo, cpumaps, maplen); + ret = xenHypervisorGetVcpus(dom->conn, def, info, maxinfo, cpumaps, + maplen); } -cleanup: - virDomainDefFree(def); return ret; } static int -xenUnifiedDomainGetVcpusFlags(virDomainPtr dom, unsigned int flags) +xenUnifiedDomainGetVcpus(virDomainPtr dom, + virVcpuInfoPtr info, int maxinfo, + unsigned char *cpumaps, int maplen) { - xenUnifiedPrivatePtr priv = dom->conn->privateData; virDomainDefPtr def = NULL; int ret = -1; - virCheckFlags(VIR_DOMAIN_VCPU_LIVE | - VIR_DOMAIN_VCPU_CONFIG | - VIR_DOMAIN_VCPU_MAXIMUM, -1); - if (!(def = xenGetDomainDefForDom(dom))) goto cleanup; - if (virDomainGetVcpusFlagsEnsureACL(dom->conn, def) < 0) + if (virDomainGetVcpusEnsureACL(dom->conn, def) < 0) goto cleanup; + ret = __xenUnifiedDomainGetVcpus(dom, def, info, maxinfo, cpumaps, maplen); + +cleanup: + virDomainDefFree(def); + return ret; +} + +static int +__xenUnifiedDomainGetVcpusFlags(virDomainPtr dom, virDomainDefPtr def, + unsigned int flags) +{ + xenUnifiedPrivatePtr priv = dom->conn->privateData; + int ret = -1; + if (dom->id < 0) { if (priv->xendConfigVersion < XEND_CONFIG_VERSION_3_0_4) ret = xenXMDomainGetVcpusFlags(dom->conn, def, flags); @@ -1470,6 +1481,27 @@ xenUnifiedDomainGetVcpusFlags(virDomainPtr dom, unsigned int flags) ret = xenDaemonDomainGetVcpusFlags(dom->conn, def, flags); } + return ret; +} + +static int +xenUnifiedDomainGetVcpusFlags(virDomainPtr dom, unsigned int flags) +{ + virDomainDefPtr def = NULL; + int ret = -1; + + virCheckFlags(VIR_DOMAIN_VCPU_LIVE | + VIR_DOMAIN_VCPU_CONFIG | + VIR_DOMAIN_VCPU_MAXIMUM, -1); + + if (!(def = xenGetDomainDefForDom(dom))) + goto cleanup; + + if (virDomainGetVcpusFlagsEnsureACL(dom->conn, def) < 0) + goto cleanup; + + ret = __xenUnifiedDomainGetVcpusFlags(dom, def, flags); + cleanup: virDomainDefFree(def); return ret; @@ -1501,7 +1533,7 @@ xenUnifiedDomainGetXMLDesc(virDomainPtr dom, unsigned int flags) } else { char *cpus; xenUnifiedLock(priv); - cpus = xenDomainUsedCpus(dom); + cpus = xenDomainUsedCpus(dom, def); xenUnifiedUnlock(priv); def = xenDaemonDomainGetXMLDesc(dom->conn, minidef, cpus); VIR_FREE(cpus); diff --git a/src/xen/xen_driver.h b/src/xen/xen_driver.h index 3c7a8cd..a363161 100644 --- a/src/xen/xen_driver.h +++ b/src/xen/xen_driver.h @@ -187,7 +187,7 @@ struct _xenUnifiedPrivate { typedef struct _xenUnifiedPrivate *xenUnifiedPrivatePtr; -char *xenDomainUsedCpus(virDomainPtr dom); +char *xenDomainUsedCpus(virDomainPtr dom, virDomainDefPtr def); virDomainXMLOptionPtr xenDomainXMLConfInit(void); -- 1.7.9.5

2 4

[libvirt] [TCK][PATCH] nwfilter: convert ctstate to state
by Stefan Berger 06 Aug '13

06 Aug '13

iptables version 1.4.16 and later automatically convert -m state --state ... to -m conntrack --ctstate ... In the test cases we will then only see 'ctstate' and convert that back to the older 'state' before comparing actual against expected output. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- scripts/nwfilter/nwfilter2vmtest.sh | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) Index: libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh =================================================================== --- libvirt-tck.orig/scripts/nwfilter/nwfilter2vmtest.sh +++ libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh @@ -32,6 +32,9 @@ FLAG_FORCE_CLEAN="$((1<<5))" # netfilter at some point. We probe for it. IPTABLES_CTRDIR_CORRECTED=0 +# starting with iptables v1.4.16 -m state becomes -m ctstate +IPTABLES_USE_CTSTATE=0 + failctr=0 passctr=0 attachfailctr=0 @@ -114,6 +117,16 @@ probeIptablesCtdir() { fi } +probeIptablesCtstate() { + rev=$(iptables --version | \ + sed -n 's/.*v$[[:digit:]].$/\1/p' | + gawk -F. '{print $1 * 1000000 + $2 * 1000 + $3 }') + # 1.4.16 or later uses ctstate + if [ $rev -ge 1004016 ]; then + IPTABLES_USE_CTSTATE=1 + fi +} + checkExpectedOutput() { xmlfile="$1" fwallfile="$2" @@ -181,6 +194,11 @@ checkExpectedOutput() { sed -i "s/ctdir _REPLY/ctdir REPLY/" ${tmpfile} fi + if [ $IPTABLES_USE_CTSTATE -ne 0 ]; then + #change ctstate tback o state + sed -i "s/ctstate/state/" ${tmpfile} + fi + diff -w ${tmpfile} ${tmpfile2} >/dev/null if [ $? -ne 0 ]; then @@ -574,6 +592,7 @@ main() { exit 1; else probeIptablesCtdir + probeIptablesCtstate fi if [ $(($flags & $FLAG_TAP_TEST)) -ne 0 ]; then

2 2

[libvirt] : [Bug 993411] Compilation fails on lxc/lxc_monitor_protocol.c 31: undefined reference to xdr_uinit64_t
by Gerald Palmer 06 Aug '13

06 Aug '13

suggested patch for compilation issue. --- lxc_monitor_protocol.h 2013-08-05 20:22:23.963000000 +0000 +++ libvirt-1.1.1/src/lxc/lxc_monitor_protocol.h 2013-08-05 20:22:46.226000000 +0000 @@ -5,6 +5,8 @@ #ifndef _LXC_MONITOR_PROTOCOL_H_RPCGEN #define _LXC_MONITOR_PROTOCOL_H_RPCGEN +# define xdr_uint64_t xdr_u_int64_t + #include <rpc/rpc.h> -----Original Message----- From: bugzilla(a)redhat.com [mailto:bugzilla@redhat.com] Sent: Monday, August 05, 2013 4:15 PM To: Gerald Palmer Subject: [Bug 993411] Compilation fails on lxc/lxc_monitor_protocol.c 31: undefined reference to xdr_uinit64_t https://bugzilla.redhat.com/show_bug.cgi?id=993411 Eric Blake <eblake(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |eblake(a)redhat.com, | |gpalmer(a)lganet.com Flags| |needinfo?(gpalmer(a)lganet.co | |m) --- Comment #1 from Eric Blake <eblake(a)redhat.com> --- Can you please post this patch upstream at libvir-list(a)redhat.com for discussion? -- You are receiving this mail because: You are on the CC list for the bug. You reported the bug.

3 3

[libvirt] [PATCH] qemu_migration: Don't error on tunelled migration with --copy-storage
by Michal Privoznik 06 Aug '13

06 Aug '13

https://bugzilla.redhat.com/show_bug.cgi?id=979477 Since 1.0.3 we are using the new way to copy non shared storage during migration (the NBD way). However, whether the new or old way is used is not controllable by user but unconditionally turned on if both sides of migration support it. Moreover, the implementation is not complete: the combination for VIR_MIGRATE_TUNNELLED flag is missing (as we need to open new port on the destination) in which case we just error out. This is deadly combination: not letting users choose their destiny and erroring out. We should not do that but VIR_WARN and turn the NBD off instead. --- Probably worth backporting to v1.0.3+ maint branches too. src/qemu/qemu_migration.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 3dedfe8..b905459 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -1994,16 +1994,15 @@ static char if (flags & (VIR_MIGRATE_NON_SHARED_DISK | VIR_MIGRATE_NON_SHARED_INC) && virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_NBD_SERVER)) { /* TODO support NBD for TUNNELLED migration */ if (flags & VIR_MIGRATE_TUNNELLED) { - virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s", - _("NBD in tunnelled migration is currently not supported")); - goto cleanup; + VIR_WARN("NBD in tunnelled migration is currently not supported"); + } else { + cookieFlags |= QEMU_MIGRATION_COOKIE_NBD; + priv->nbdPort = 0; } - cookieFlags |= QEMU_MIGRATION_COOKIE_NBD; - priv->nbdPort = 0; } if (!(mig = qemuMigrationEatCookie(driver, vm, NULL, 0, 0))) goto cleanup; -- 1.8.1.5

3 2

[libvirt] virsh [attach-detach]-device question
by Scott Sullivan 06 Aug '13

06 Aug '13

I have noticed a behavior I am hoping someone can help me understand. Consider the following scenario: 1.) Start a test dummy qemu-kvm instance with no OS via virsh named "no_os". 2.) Attach a device to it; [root@host ~]# virsh attach-device no_os /root/hotplug_device_b.xml Device attached successfully [root@host ~]# 3.) Now detach the same device; [root@host ~]# virsh detach-device no_os /root/hotplug_device_b.xml Device detached successfully [root@host ~]# 4.) Now re-attach the same device; [root@host ~]# virsh attach-device no_os /root/hotplug_device_b.xml error: Failed to attach device from /root/hotplug_device_b.xml error: internal error unable to execute QEMU command 'device_add': Duplicate ID 'virtio-disk1' for device [root@host ~]# Is this expected behavior? If so, why does my detach-device call in step 3 appear to not free the device, leading to the duplicate ID error in step 4? Libvirt XML's used: /root/hotplug_device_b.xml: <disk type='block' device='disk'> <driver name='qemu' cache='none'/> <source dev="/dev/syseng/hotplug_test_b"/> <target dev="vdb" bus="virtio"/> </disk> I started the "no_os" instance with this: <domain type="kvm"> <name>no_os</name> <uuid>E605BE96-6BC9-11E2-976C-EDA8DB8AEF42</uuid> <memory>524288</memory> <currentMemory>524288</currentMemory> <vcpu>1</vcpu> <os> <type arch="x86_64" machine="pc-1.1">hvm</type> <boot dev="hd"/> </os> <features> <acpi/> <apic/> <pae/> </features> <clock offset="utc"/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>restart</on_crash> <devices> <emulator>/opt/kvm-stack-1/libexec/qemu-kvm-wrapper</emulator> <disk type="block" device="disk"> <driver name="qemu" cache="none"/> <source dev="/dev/LVM/no_os"/> <target dev="vda" bus="virtio"/> </disk> <disk type="file" device="cdrom"> <target dev="hdc" bus="ide"/> <readonly/> </disk> <serial type="pty"> <target port="0"/> </serial> <console type="pty"> <target port="0"/> </console> <input type="mouse" bus="ps2"/> <graphics type="vnc" port="-1" autoport="yes" keymap="en-us"/> <interface type="bridge"> <mac address="52:54:00:87:14:3d"/> <source bridge="virbr0"/> <target dev="no_os_0"/> <model type="virtio"/> </interface></devices> </domain>

1 1

[libvirt] [PATCH] build: fix missing max_queued_clients in augeas test file for libvirtd.conf
by Laine Stump 05 Aug '13

05 Aug '13

Broken in commit 1199edb1d4e3ebbc691bd32d3519a3b662225420 --- Pushed under build-breaker rule. daemon/test_libvirtd.aug.in | 1 + 1 file changed, 1 insertion(+) diff --git a/daemon/test_libvirtd.aug.in b/daemon/test_libvirtd.aug.in index 4e3b878..a7e8515 100644 --- a/daemon/test_libvirtd.aug.in +++ b/daemon/test_libvirtd.aug.in @@ -35,6 +35,7 @@ module Test_libvirtd = { "2" = "fred(a)EXAMPLE.COM" } } { "max_clients" = "20" } + { "max_queued_clients" = "1000" } { "min_workers" = "5" } { "max_workers" = "20" } { "prio_workers" = "5" } -- 1.7.11.7

1 0

[libvirt] [PATCHv2 0/7] Q35 support part 2 - RESEND with a few small changes
by Laine Stump 05 Aug '13

05 Aug '13

This obsoletes patches 3/7-10/7 of the previous posting of Q35 part 2. The first 3 patches had been ACKed so I pushed those, so patch 1/7 of this series was 3/7 of the v1. Most of the changes to patches 1-4 are small nits that I neglected to keep track of (e.g. fixing make check when run as each patch is applied, and changing the commandline args slightly as I figured out issues once I could actually start up and run a domain. The issue with pci.0 vs. pcie.0 has been fixed in this new series. As indicated in my latest response to the previous series, with the 3 new additional patches everything seems to work. A default USB controller is still not added for Q35 machines domains. domains that are created now will continue to be compatible once we decide what type of default USB controller to add though (if we do decide to do that). At this point I am declaring the Q35 support in libvirt "usable". Until some tweaks are made to virt-manager, it won't be possible to create a new q35 domain with virt-manager though. Laine Stump (7): qemu: enable auto-allocate of all PCI addresses qemu: add pcie-root controller qemu: add dmi-to-pci-bridge controller qemu: fix handling of default/implicit devices for q35 qemu: properly set/use device alias for pci controllers qemu: use standard pci-bridge in place of i82801b11-bridge qemu: enable using implicit sata controller in q35 machines docs/formatdomain.html.in | 43 +- docs/schemas/domaincommon.rng | 2 + src/conf/domain_conf.c | 11 +- src/conf/domain_conf.h | 2 + src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 517 +++++++++++++++++---- src/qemu/qemu_command.h | 32 +- src/qemu/qemu_domain.c | 36 +- src/qemu/qemu_hotplug.c | 6 +- tests/qemuxml2argvdata/qemuxml2argv-pcie-root.args | 5 + tests/qemuxml2argvdata/qemuxml2argv-pcie-root.xml | 20 + tests/qemuxml2argvdata/qemuxml2argv-q35.args | 8 + tests/qemuxml2argvdata/qemuxml2argv-q35.xml | 30 ++ tests/qemuxml2argvtest.c | 10 + .../qemuxml2xmlout-pcie-root.xml | 23 + tests/qemuxml2xmloutdata/qemuxml2xmlout-q35.xml | 31 ++ tests/qemuxml2xmltest.c | 2 + 18 files changed, 675 insertions(+), 106 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-pcie-root.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-pcie-root.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-q35.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-q35.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-pcie-root.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-q35.xml -- 1.7.11.7

3 22

[libvirt] [PATCH 0/7] Q35 support part 2
by Laine Stump 05 Aug '13

05 Aug '13

This series adds everything needed to create and start a Q35 machine from libvirt, with a couple of small exceptions: 1) Although the implicit pcie-root controller on q35 machinetypes is referred to as "pcie.0" by qemu, the code as it stands now still puts "pci.0" on the commandline, which means it's still unusable. I'm working on a patch to fix that right now. 2) The q35 machinetype doesn't create a default usb controller as the other machinetypes do. The reason for that is explained in Patch 7/7. I think we probably *should* have a default usb controller added for q35 (just to make creating a new machine config easier), but it probably should be a usb2 "trifecta" of controllers, rather than an old-fashioned usb1 piix3 controller. With (1) fixed, this should be enough functionality that people can start testing q35 guests via libvirt. Laine Stump (7): conf: add default USB controller in qemu post-parse callback qemu: rename some functions in qemu_command.c qemu: eliminate almost-duplicate code in qemu_command.c qemu: enable auto-allocate of all PCI addresses qemu: add pcie-root controller qemu: add dmi-to-pci-bridge controller qemu: fix handling of default/implicit devices for q35 docs/formatdomain.html.in | 43 +- docs/schemas/domaincommon.rng | 2 + src/conf/domain_conf.c | 17 +- src/conf/domain_conf.h | 2 + src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 619 +++++++++++++++------ src/qemu/qemu_command.h | 14 +- src/qemu/qemu_domain.c | 48 +- tests/qemuxml2argvdata/qemuxml2argv-pcie-root.args | 5 + tests/qemuxml2argvdata/qemuxml2argv-pcie-root.xml | 20 + tests/qemuxml2argvdata/qemuxml2argv-q35.args | 6 + tests/qemuxml2argvdata/qemuxml2argv-q35.xml | 25 + tests/qemuxml2argvtest.c | 10 + .../qemuxml2xmlout-pcie-root.xml | 23 + tests/qemuxml2xmloutdata/qemuxml2xmlout-q35.xml | 26 + tests/qemuxml2xmltest.c | 2 + 17 files changed, 673 insertions(+), 192 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-pcie-root.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-pcie-root.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-q35.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-q35.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-pcie-root.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-q35.xml -- 1.7.11.7

4 35

Re: [libvirt] [Qemu-devel] default slot used for vga device on q35 machines
by Laine Stump 05 Aug '13

05 Aug '13

On 08/02/2013 02:49 AM, Gerd Hoffmann wrote: > Hi, > >> qemu-kvm -M q35 -nodefaults -nodefconfig -qmp unix:/tmp/qemu,server >> -vnc :15 -vga std -usb >> >> Then ran "query-pci" in the qmp monitor and found that the vga device is >> put at slot 1 instead of slot 2. >> >> My questions: >> >> 1) Is this difference intentional, or a bug? > The vga simply goes into the first free slot. That happens to be #2 > with i440fx and #1 with q35. It sounds like it's a safe bet to assume that -vga will put the device on slot 2 for pc machinetypes and slot 1 for q35, no matter what other devices there are, since -vga is always initialized first. Correct? Do you see any chance that might change in the future? (e.g. due to some other new device that needs to be initialized even before vga) > >> 2) If it's intentional, will the device always be at slot 1 (and trigger >> an error if something else is also placed at slot 1), or is it just >> picking the first unused slot? (that would *not* be good, because we >> must be able to predict what device is in which slot and prevent them >> from changing from run to run). > The vga is the very first (pci) device being created (when selecting via > -vga), so it gets the slots mentioned above no matter what, even though > simply picking the first unused slot. > >> 3) Does the qxl multihead support really require that the device be at >> slot 2 (as stated in the above bugzilla commend)? Or is that just a >> misunderstanding/overstatement? > It's not required at all. The problem is that on older qemu versions > (pre-memory-api basically) it was impossible to create functional vga > devices via -device due to an initialization order issue. Which implies > you have to use -vga instead, which in turn implies the vga ends up in > slot #2. On i440fx, but q35 didn't exist yet back then ;) Are you saying that it's still required to use -vga instead of -device qxl-vga for pc machinetype? Or that it was needed at one time, but that is no longer the case? If the latter, is there a reliable way to make the decision whether or not we need to use -vga?

3 2

Re: [libvirt] [libvirt-users] Please remove pm-utils dep from libvirt-clients
by Daniel P. Berrange 05 Aug '13

05 Aug '13

On Sat, Aug 03, 2013 at 03:41:35PM +0100, Richard Hughes wrote: > Hi, > > I'm going to be retiring pm-utils from Fedora soon; it's completely > dead upstream and it not needed anymore by upower or anything else. > Nothing other than libvirt-clients depends on it, so when I tried to > remove this from rawhide I noticed this commit: > > commit 7069f75cb8dad58715f723fd542e4ff69dbff51b > Author: Daniel Veillard <veillard(a)redhat.com> > Date: Thu Dec 8 17:03:16 2011 +0800 > > update to libvirt-0.9.8 > > added: > > +# Needed for probing the power management features of the host. > +Requires: pm-utils > > Is this true? You really don't want to be parsing pm-is-supported, it > often doesn't work and isn't used by anything else any more. Would it > be possible to port away from pm-is-supported if you're actually using > it, and drop the dep for F20 please? Any questions please CC me as I'm > not subscribed. What is the replacement ? We need to be able to query whether each of suspend, hibernate, or suspend-hybrid are supported on a host, and then report that upto the mgmt app using libvirt. Daniel

3 8

[libvirt] [PATCH] Fix build w/o cgroups
by Roman Bogorodskiy 03 Aug '13

03 Aug '13

Build without cgroups support started to fail again recently. Do the following to fix it: - Add missing 'partition' arg that was added to the virCgroupValidateMachineGroup() but forgotten for the stub of the same function - Add stubs for virCgroupMakeGroup() and virCgroupNew() --- src/util/vircgroup.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c index cfb4b3f..4cc7687 100644 --- a/src/util/vircgroup.c +++ b/src/util/vircgroup.c @@ -174,6 +174,7 @@ static bool virCgroupValidateMachineGroup(virCgroupPtr group ATTRIBUTE_UNUSED, const char *name ATTRIBUTE_UNUSED, const char *drivername ATTRIBUTE_UNUSED, + const char *partition ATTRIBUTE_UNUSED, bool stripEmulatorSuffix ATTRIBUTE_UNUSED) { return true; @@ -993,6 +994,23 @@ error: return -1; } +#else +static int virCgroupMakeGroup(virCgroupPtr parent ATTRIBUTE_UNUSED, + virCgroupPtr group ATTRIBUTE_UNUSED, + bool create ATTRIBUTE_UNUSED, + unsigned int flags ATTRIBUTE_UNUSED) +{ + return -1; +} + +static int virCgroupNew(pid_t pid ATTRIBUTE_UNUSED, + const char *path ATTRIBUTE_UNUSED, + virCgroupPtr parent ATTRIBUTE_UNUSED, + int controllers ATTRIBUTE_UNUSED, + virCgroupPtr *group ATTRIBUTE_UNUSED) +{ + return -1; +} #endif #if defined _DIRENT_HAVE_D_TYPE -- 1.7.11.5

2 3

[libvirt] [PATCH 0/9] qemu: Support qemu-system-arm vexpress-a9
by Cole Robinson 03 Aug '13

03 Aug '13

This series adds the bits needed to kick of a qemu-system-arm -machine vexpress-a9 guest. Patches 1 and 8 are isolated bug fixes Patches 2-5 and 7 are mostly about fixing CLI generation. Unfortunately qemu ARM boards don't quite work like x86 where we can mix and match devices, so -device is out of the picture, and the boards depend on old CLI infrastrucure like -net nic and -serial. Patch 6 adds disk bus=sd, which is often the only way to specify storage for ARM boards. Patch 9 adds virtio-mmio address support, which enables virtio for vexpress-a9. Cole Robinson (9): qemu_command: Drop incorrect ATTRIBUTE_UNUSED annotation domain_conf: Set QEMU ARM default USB model to 'none' domain_conf: Don't add default memballoon device on ARM qemu: Fix adding specifying char devs for ARM qemu: Don't try to allocate PCI addresses for ARM domain_conf: Add disk bus=sd, wire it up for qemu qemu: Fix networking for ARM guests qemu: Only setup vhost if virtType == "kvm" qemu: Support virtio-mmio transport for virtio on ARM docs/formatdomain.html.in | 3 +- docs/schemas/domaincommon.rng | 20 ++++ src/conf/domain_conf.c | 72 +++++++++--- src/conf/domain_conf.h | 2 + src/qemu/qemu_capabilities.c | 22 ++++ src/qemu/qemu_capabilities.h | 5 + src/qemu/qemu_command.c | 126 +++++++++++++++++---- src/qemu/qemu_domain.c | 20 +++- src/qemu/qemu_process.c | 37 +++--- .../qemuxml2argv-arm-vexpressa9-basic.args | 1 + .../qemuxml2argv-arm-vexpressa9-basic.xml | 34 ++++++ .../qemuxml2argv-arm-vexpressa9-nodevs.args | 1 + .../qemuxml2argv-arm-vexpressa9-nodevs.xml | 26 +++++ .../qemuxml2argv-arm-vexpressa9-virtio.args | 1 + .../qemuxml2argv-arm-vexpressa9-virtio.xml | 45 ++++++++ tests/qemuxml2argvtest.c | 10 ++ tests/testutilsqemu.c | 32 ++++++ 17 files changed, 397 insertions(+), 60 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-arm-vexpressa9-basic.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-arm-vexpressa9-basic.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-arm-vexpressa9-nodevs.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-arm-vexpressa9-nodevs.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-arm-vexpressa9-virtio.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-arm-vexpressa9-virtio.xml -- 1.8.3.1

4 22

[libvirt] infinite loop while restarting libvirt after LXC creation
by Michael R. Hines 03 Aug '13

03 Aug '13

Hi, I'm using OpenStack grizzly on Ubuntu 12.04 to create LXC containers. After successful container creation and a subsequent reboot of the hypervisor, libvirt gets stuck in an infinite loop, spinning at 100% Here's the backtrace: (gdb) thread 12 [Switching to thread 12 (Thread 0x7fffee46f700 (LWP 7052))] #0 0x00007ffff7617de1 in virDomainDefMaybeAddController (def=0x7fffe8033b30, type=2, idx=73405, model=-1) at conf/domain_conf.c:10570 warning: Source file is more recent than executable. 10570 for (i = 0; i < def->ncontrollers; i++) { (gdb) bt #0 0x00007ffff7617de1 in virDomainDefMaybeAddController (def=0x7fffe8033b30, type=2, idx=73405, model=-1) at conf/domain_conf.c:10570 #1 0x00007ffff76180ab in virDomainDefAddDiskControllersForType (def=0x7fffe8033b30, controllerType=2, diskBus=<optimized out>) at conf/domain_conf.c:13653 #2 0x00007ffff761a11d in virDomainDefAddImplicitControllers (def=0x7fffe8033b30) at conf/domain_conf.c:13747 #3 0x00007ffff7623a29 in virDomainDefParseXML (xml=0x7fffe8034500, root=0x7fffe802fc60, ctxt=<optimized out>, caps=0x7fffe8030f20, xmlopt=0x7fffe8031a60, expectedVirtTypes=<optimized out>, flags=2) at conf/domain_conf.c:12375 #4 0x00007ffff76299a0 in virDomainDefParseNode (xml=0x7fffe8034500, root=0x7fffe802fc60, caps=0x7fffe8030f20, xmlopt=0x7fffe8031a60, expectedVirtTypes=16, flags=2) at conf/domain_conf.c:12562 #5 0x00007ffff7629b19 in virDomainDefParse (xmlStr=<optimized out>, filename=<optimized out>, caps=0x7fffe8030f20, xmlopt=0x7fffe8031a60, expectedVirtTypes=16, flags=2) at conf/domain_conf.c:12504 #6 0x00007ffff762a489 in virDomainObjListLoadConfig (opaque=0x0, notify=0, expectedVirtTypes=16, name=0x7fffe80fb543 "instance-00000017", autostartDir=0x7fffe8033280 "/etc/libvirt/lxc/autostart", configDir=0x7fffe8033b10 "/etc/libvirt/lxc", xmlopt=0x7fffe8031a60, caps=0x7fffe8030f20, doms=0x7fffe80fac40) at conf/domain_conf.c:17027 #7 virDomainObjListLoadAllConfigs (doms=0x7fffe80fac40, configDir=<optimized out>, autostartDir=0x7fffe8033280 "/etc/libvirt/lxc/autostart", liveStatus=<optimized out>, caps=0x7fffe8030f20, xmlopt=0x7fffe8031a60, expectedVirtTypes=16, notify=0, opaque=0x0) at conf/domain_conf.c:17155 #8 0x00007fffef1def58 in lxcStateInitialize (privileged=<optimized out>, callback=<optimized out>, opaque=<optimized out>) at lxc/lxc_driver.c:1449 #9 lxcStateInitialize (privileged=<optimized out>, callback=<optimized out>, opaque=<optimized out>) at lxc/lxc_driver.c:1361 #10 0x00007ffff766df12 in virStateInitialize (privileged=true, callback=0x555555568110 <daemonInhibitCallback>, opaque=0x5555557cc8e0) at libvirt.c:832 #11 0x00005555555681c0 in daemonRunStateInit (opaque=<optimized out>) at libvirtd.c:902 #12 0x00007ffff75f0ae6 in virThreadHelper (data=<optimized out>) at util/virthreadpthread.c:161 #13 0x00007ffff733ee9a in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0 #14 0x00007ffff706bccd in clone () from /lib/x86_64-linux-gnu/libc.so.6 #15 0x0000000000000000 in ?? () (gdb) next

1 1

[libvirt] Patch set to add virt-sandbox -s inherit and fixes for man pages.
by Daniel J Walsh 02 Aug '13

02 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 for some reason my git-sendmail keeps failing. [sandbox PATCH 1/3] Add virt-sandbox -s inherit, to execute the [sandbox PATCH 2/3] Add comment about LIBVIRT_DEFAULT_URI to [sandbox PATCH 3/3] virt-sandbox-service.pod did not mention upgrade -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlH7zjAACgkQrlYvE4MpobPBIQCgvOYtY0ccFTUNBNA4tWWQs02t tYwAn15nXX9WhTyG0Piw4QVYwide9/RZ =g+dS -----END PGP SIGNATURE-----

2 2

[libvirt] [PATCHv2] build: fix qemuagenttest build with -O0 in fedora 19.
by Jincheng Miao 02 Aug '13

02 Aug '13

Someone may need to build libvirt with -O0. When building libvirt with -O0 flag in fedora 19, it will fail to generate qemuagenttest, a link error occurs like: ./.libs/libqemumonitortestutils.a(qemumonitortestutils.o): In function `qemuMonitorTestFree': libvirt/tests/qemumonitortestutils.c:346: undefined reference to `qemuMonitorClose' ./.libs/libqemumonitortestutils.a(qemumonitortestutils.o): In function `qemuMonitorTestNew': libvirt/tests/qemumonitortestutils.c:870: undefined reference to `qemuMonitorOpen' collect2: error: ld returned 1 exit status So put the libvirt driver impl libraries after libqemumonitortestutils.a, make lazy link happy. --- tests/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/Makefile.am b/tests/Makefile.am index 9c578fa..b36922e 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -424,7 +424,7 @@ qemuagenttest_SOURCES = \ testutils.c testutils.h \ testutilsqemu.c testutilsqemu.h \ $(NULL) -qemuagenttest_LDADD = $(qemu_LDADDS) libqemumonitortestutils.la +qemuagenttest_LDADD = libqemumonitortestutils.la $(qemu_LDADDS) qemuhotplugtest_SOURCES = \ qemuhotplugtest.c \ -- 1.8.3.1

2 4

[libvirt] [PATCH] spec: Explicitly claim ownership of channel subdir
by Jiri Denemark 02 Aug '13

02 Aug '13

As both /var/lib/libvirt/qemu and /var/lib/libvirt/qemu/channel/target are owned by us, the intermediate /var/lib/libvirt/qemu/channel should be owned by us too. --- libvirt.spec.in | 1 + 1 file changed, 1 insertion(+) diff --git a/libvirt.spec.in b/libvirt.spec.in index c457fda..79c5a2c 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1800,6 +1800,7 @@ fi %if %{with_qemu} %ghost %dir %attr(0700, root, root) %{_localstatedir}/run/libvirt/qemu/ %dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/ +%dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/channel/ %dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/channel/target/ %dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/cache/libvirt/qemu/ %endif -- 1.8.3.2

2 2

Re: [libvirt] [Qemu-devel] KVM call agenda for 2013-08-06
by Eduardo Habkost 02 Aug '13

02 Aug '13

On Tue, Jul 23, 2013 at 06:31:45PM +0200, Juan Quintela wrote: > > Hi > > Please, send any topic that you are interested in covering. * libvirt requirements for: * Checking which CPU features are exposed/required by each CPU model + machine-type * Checking which CPU features are available on a given host (considering QEMU + kernel + host CPU capabilities) I hope Jiri and Daniel can join the call. -- Eduardo

1 0

[libvirt] [PATCH] Remove reference to python/tests from RPM %doc
by Daniel P. Berrange 02 Aug '13

02 Aug '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> The python/tests files were recently deleted, but a reference was left in the RPM %doc entry Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- libvirt.spec.in | 1 - 1 file changed, 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index fce7f91..c457fda 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -2089,7 +2089,6 @@ fi %{_libdir}/python*/site-packages/libvirt_qemu.py* %{_libdir}/python*/site-packages/libvirt_lxc.py* %{_libdir}/python*/site-packages/libvirtmod* -%doc python/tests/*.py %doc examples/python %doc examples/domain-events/events-python %endif -- 1.8.1.4

3 2

[libvirt] [PATCH] Fix crashing upgrading from older libvirts with running guests
by Daniel P. Berrange 02 Aug '13

02 Aug '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> If upgrading from a libvirt that is older than 1.0.5, we can not assume that vm->def->resource is non-NULL. This bogus assumption caused libvirtd to crash Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/lxc/lxc_process.c | 8 ++++++-- src/qemu/qemu_cgroup.c | 4 +++- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c index 0a28305..4835bd5 100644 --- a/src/lxc/lxc_process.c +++ b/src/lxc/lxc_process.c @@ -1204,7 +1204,9 @@ int virLXCProcessStart(virConnectPtr conn, } if (virCgroupNewDetectMachine(vm->def->name, "lxc", vm->pid, - vm->def->resource->partition, + vm->def->resource ? + vm->def->resource->partition : + NULL, -1, &priv->cgroup) < 0) goto error; @@ -1413,7 +1415,9 @@ virLXCProcessReconnectDomain(virDomainObjPtr vm, goto error; if (virCgroupNewDetectMachine(vm->def->name, "lxc", vm->pid, - vm->def->resource->partition, + vm->def->resource ? + vm->def->resource->partition : + NULL, -1, &priv->cgroup) < 0) goto error; diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c index 787ddeb..dc949db 100644 --- a/src/qemu/qemu_cgroup.c +++ b/src/qemu/qemu_cgroup.c @@ -707,7 +707,9 @@ qemuConnectCgroup(virQEMUDriverPtr driver, if (virCgroupNewDetectMachine(vm->def->name, "qemu", vm->pid, - vm->def->resource->partition, + vm->def->resource ? + vm->def->resource->partition : + NULL, cfg->cgroupControllers, &priv->cgroup) < 0) goto cleanup; -- 1.8.1.4

2 1

[libvirt] [PATCH] Avoid crash if NULL is passed for filename/funcname in logging
by Daniel P. Berrange 02 Aug '13

02 Aug '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> The journald code would crash if a NULL was passed for the filename / funcname in the logging code. This shouldn't happen in general, but it is better to be save, since there have been bugs triggering this. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/util/virlog.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/util/virlog.c b/src/util/virlog.c index d1fb0b3..047a131 100644 --- a/src/util/virlog.c +++ b/src/util/virlog.c @@ -1181,9 +1181,11 @@ virLogOutputToJournald(virLogSource source, journalAddInt(&state, "PRIORITY", priority); journalAddString(&state, "LIBVIRT_SOURCE", virLogSourceTypeToString(source)); - journalAddString(&state, "CODE_FILE", filename); + if (filename) + journalAddString(&state, "CODE_FILE", filename); journalAddInt(&state, "CODE_LINE", linenr); - journalAddString(&state, "CODE_FUNC", funcname); + if (funcname) + journalAddString(&state, "CODE_FUNC", funcname); memset(&sa, 0, sizeof(sa)); sa.sun_family = AF_UNIX; -- 1.8.1.4

3 2

[libvirt] [PATCH] Ensure LXC/QEMU APIs set the filename for errors
by Daniel P. Berrange 02 Aug '13

02 Aug '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> The virLibConnError macros in libvirt-lxc.c and libvirt-qemu.c were passing NULL for the filename. This causes a crash if the logging code is configured to use journald. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/libvirt-lxc.c | 6 +++--- src/libvirt-qemu.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/libvirt-lxc.c b/src/libvirt-lxc.c index da69dce..c8cdcea 100644 --- a/src/libvirt-lxc.c +++ b/src/libvirt-lxc.c @@ -35,12 +35,12 @@ #define VIR_FROM_THIS VIR_FROM_NONE -#define virLibConnError(conn, error, info) \ - virReportErrorHelper(VIR_FROM_NONE, error, NULL, __FUNCTION__, \ +#define virLibConnError(conn, error, info) \ + virReportErrorHelper(VIR_FROM_NONE, error, __FILE__, __FUNCTION__, \ __LINE__, info) #define virLibDomainError(domain, error, info) \ - virReportErrorHelper(VIR_FROM_DOM, error, NULL, __FUNCTION__, \ + virReportErrorHelper(VIR_FROM_DOM, error, __FILE__, __FUNCTION__, \ __LINE__, info) /** diff --git a/src/libvirt-qemu.c b/src/libvirt-qemu.c index 2a1432b..83fb3b3 100644 --- a/src/libvirt-qemu.c +++ b/src/libvirt-qemu.c @@ -29,12 +29,12 @@ #define VIR_FROM_THIS VIR_FROM_NONE -#define virLibConnError(conn, error, info) \ - virReportErrorHelper(VIR_FROM_NONE, error, NULL, __FUNCTION__, \ +#define virLibConnError(conn, error, info) \ + virReportErrorHelper(VIR_FROM_NONE, error, __FILE__, __FUNCTION__, \ __LINE__, info) #define virLibDomainError(domain, error, info) \ - virReportErrorHelper(VIR_FROM_DOM, error, NULL, __FUNCTION__, \ + virReportErrorHelper(VIR_FROM_DOM, error, __FILE__, __FUNCTION__, \ __LINE__, info) /** -- 1.8.1.4

2 1

[libvirt] [PATCH 0/3] Fix coverity issues introduced by qemuagenttest and the refactor
by Peter Krempa 02 Aug '13

02 Aug '13

Fix the issues reported by John and also add yet another test subcase. Peter Krempa (3): qemuagenttest: Fix checking of shutdown mode qemuagenttest: Check invalid response in shutdown test qemumonitortestutils: Don't skip va_end() on error path tests/qemuagenttest.c | 32 +++++++++++++++++++++++++++++++- tests/qemumonitortestutils.c | 2 +- 2 files changed, 32 insertions(+), 2 deletions(-) -- 1.8.3.2

3 12

Re: [libvirt] [Qemu-devel] pvpanic device should not be automatically included as an internal device
by Eric Blake 02 Aug '13

02 Aug '13

On 08/01/2013 08:18 AM, Gerd Hoffmann wrote: > On 08/01/13 15:08, Marcel Apfelbaum wrote: >> Hi, >> >> The problem with pvpanic being an internal device is that VMs running >> operating systems without a driver for this device will have problems >> when qemu will be upgraded (from qemu without this pvpanic). >> >> The outcome may be, for example: in Windows(let's say XP) the Device manager >> will open a "new device" wizard and the device will appear as an unrecognized device. > > Only happens when also changing the machine type on upgrade as it is > turned off on old machine types. > > But, yes, pvpanic will show up as "Unknown device" without driver and > with the funky yellow exclamation mark in device manager in windows > guests. Newer windows versions don't kick the "new device" wizard. But > still I have my doubts that it is a good idea to add it unconditionally ... Automatic devices with no command line argument have proven to be a nightmare for libvirt as well. Although the just-released libvirt 1.1.1 now supports the <on_crash> element for controlling the command line parameters of qemu related to how qemu will behave when the pvpanic device is triggered, I would also welcome having the ability to control whether the guest even has a pvpanic device exposed, just as we can control whether a guest has a memballoon device exposed. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

5 6

[libvirt] Intel nested virt with libvirt
by Vasiliy Tolstov 02 Aug '13

02 Aug '13

Hello. I'm try to create L1 and L2 virt machines, but when I connect via libvirt to L2 virt-manager says that L2 does not contain KVM. Where I can find complete instructions and does it possible with Intel CPU?

1 0

[libvirt] [PATCH] Fix test case qemuagenttest compilation.
by Jincheng Miao 02 Aug '13

02 Aug '13

When compiling qemuagenttest, a link error occurs like: ./.libs/libqemumonitortestutils.a(qemumonitortestutils.o): In function `qemuMonitorTestFree': libvirt/tests/qemumonitortestutils.c:346: undefined reference to `qemuMonitorClose' ./.libs/libqemumonitortestutils.a(qemumonitortestutils.o): In function `qemuMonitorTestNew': libvirt/tests/qemumonitortestutils.c:870: undefined reference to `qemuMonitorOpen' collect2: error: ld returned 1 exit status And I checked this error, it caused by the position of libqemumonitortestutils.a in gcc arguments. If libqemumonitortestutils.a before libvirt_driver_qemu_impl.a and libvirt_driver_network_impl.a, the compilation passed. Otherwise, failed. I think this should be a gcc's bug, but nevermind, just fix it in libvirt. --- tests/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/Makefile.am b/tests/Makefile.am index 9c578fa..b36922e 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -424,7 +424,7 @@ qemuagenttest_SOURCES = \ testutils.c testutils.h \ testutilsqemu.c testutilsqemu.h \ $(NULL) -qemuagenttest_LDADD = $(qemu_LDADDS) libqemumonitortestutils.la +qemuagenttest_LDADD = libqemumonitortestutils.la $(qemu_LDADDS) qemuhotplugtest_SOURCES = \ qemuhotplugtest.c \ -- 1.8.3.1

3 8

[libvirt] libvirt lxc fail to start when --with-dbus=no
by Gao feng 02 Aug '13

02 Aug '13

2013-08-02 02:14:24.044+0000: 22126: error : virDBusGetSystemBus:1194 : internal error: DBus support not compiled into this binary int virSystemdCreateMachine(const char *name, const char *drivername, bool privileged, const unsigned char *uuid, const char *rootdir, pid_t pidleader, bool iscontainer, const char *partition) { int ret = -1; DBusConnection *conn; char *machinename = NULL; char *creatorname = NULL; char *username = NULL; char *slicename = NULL; if (!(conn = virDBusGetSystemBus())) return -1; Thanks!

1 0

[libvirt] ANNOUNCE: libvirt 0.10.2.7 maintenance release
by Cole Robinson 02 Aug '13

02 Aug '13

libvirt 0.10.2.7 maintenance release is now available. This is libvirt 0.10.2 with additional bugfixes that have accumulated upstream since the initial release. This release can be downloaded at: http://libvirt.org/sources/stable_updates/libvirt-0.10.2.7.tar.gz Changes in this version: * udev: fix crash in libudev logging * security: fix deadlock with prefork * security_dac: compute supplemental groups before fork * security: framework for driver PreFork handler * Fix potential deadlock across fork() in QEMU driver * util: make virSetUIDGID async-signal-safe * util: add virGetGroupList * util: improve user lookup helper * storage: return -1 when fs pool can't be mounted * Fix invalid read in virCgroupGetValueStr * virsh: edit: don't leak XML string on reedit or redefine For info about past maintenance releases, see: http://wiki.libvirt.org/page/Maintenance_Releases Thanks, Cole

1 0

[libvirt] ANNOUNCE: libvirt 1.0.5.5 maintenance release
by Cole Robinson 02 Aug '13

02 Aug '13

libvirt 1.0.5.5 maintenance release is now available. This is libvirt 1.0.5 with additional bugfixes that have accumulated upstream since the initial release. This release can be downloaded at: http://libvirt.org/sources/stable_updates/libvirt-1.0.5.5.tar.gz Changes in this version: * Set the number of elements 0 in virNetwork*Clear * Don't check validity of missing attributes in DNS SRV XML * cgroup: reuse buffer for getline * rbd: Do not free the secret if it is not set * caps: use -device for primary video when qemu >=1.6 * examples: fix mingw build vs. printf * build: fix virutil build on mingw * build: work around mingw header pollution * build: configure must not affect tarball contents * build: avoid build failure without gnutls * Fix build with clang * maint: update to latest gnulib * maint: update to latest gnulib * build: honor autogen.sh --no-git * maint: update to latest gnulib * FreeBSD: disable buggy -fstack-protector-all * build: update to latest gnulib, for syntax-check * maint: update to latest gnulib * lxc: correctly backport /dev/tty fix * security: fix deadlock with prefork * security_dac: compute supplemental groups before fork * security: framework for driver PreFork handler * util: make virSetUIDGID async-signal-safe * util: add virGetGroupList * util: improve user lookup helper For info about past maintenance releases, see: http://wiki.libvirt.org/page/Maintenance_Releases Thanks, Cole

1 0

[libvirt] [PATCH v2] bridge driver: extract platform specifics
by Roman Bogorodskiy 01 Aug '13

01 Aug '13

* Move platform specific things (e.g. firewalling and route collision checks) into bridge_driver_platform * Create two platform specific implementations: - bridge_driver_linux: Linux implementation using iptables, it's actually the code moved from bridge_driver.c - bridge_driver_nop: dumb implementation that does nothing --- src/network/bridge_driver_platform.h | 79 ++++ src/network/bridge_driver.c | 708 +-------------------------------- src/network/bridge_driver_linux.c | 709 ++++++++++++++++++++++++++++++++++ src/network/bridge_driver_nop.c | 78 ++++ src/network/bridge_driver_platform.c | 32 ++ po/POTFILES.in | 1 + src/Makefile.am | 5 +- 7 files changed, 903 insertions(+), 709 deletions(-) create mode 100644 src/network/bridge_driver_platform.h create mode 100644 src/network/bridge_driver_linux.c create mode 100644 src/network/bridge_driver_nop.c create mode 100644 src/network/bridge_driver_platform.c diff --git a/src/network/bridge_driver_platform.h b/src/network/bridge_driver_platform.h new file mode 100644 index 0000000..289ab79 --- /dev/null +++ b/src/network/bridge_driver_platform.h @@ -0,0 +1,79 @@ +/* + * bridge_driver.h: platform specific routines for bridge driver + * + * Copyright (C) 2006-2013 Red Hat, Inc. + * Copyright (C) 2006 Daniel P. Berrange + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + * + * Author: Daniel P. Berrange <berrange(a)redhat.com> + */ + +#ifndef __VIR_BRIDGE_DRIVER_PLATFORM_H__ +# define __VIR_BRIDGE_DRIVER_PLATFORM_H__ + +# include "internal.h" +# include "virlog.h" +# include "virthread.h" +# include "virdnsmasq.h" +# include "network_conf.h" + +/* Main driver state */ +struct _virNetworkDriverState { + virMutex lock; + + virNetworkObjList networks; + + char *networkConfigDir; + char *networkAutostartDir; + char *stateDir; + char *pidDir; + char *dnsmasqStateDir; + char *radvdStateDir; + dnsmasqCapsPtr dnsmasqCaps; +}; + +typedef struct _virNetworkDriverState virNetworkDriverState; +typedef virNetworkDriverState *virNetworkDriverStatePtr; + +int networkCheckRouteCollision(virNetworkObjPtr network); + +int networkAddMasqueradingFirewallRules(virNetworkObjPtr network, + virNetworkIpDefPtr ipdef); + +void networkRemoveMasqueradingFirewallRules(virNetworkObjPtr network, + virNetworkIpDefPtr ipdef); + +int networkAddRoutingFirewallRules(virNetworkObjPtr network, + virNetworkIpDefPtr ipdef); + +void networkRemoveRoutingFirewallRules(virNetworkObjPtr network, + virNetworkIpDefPtr ipdef); + +int networkAddGeneralFirewallRules(virNetworkObjPtr network); + +void networkRemoveGeneralFirewallRules(virNetworkObjPtr network); + +int networkAddIpSpecificFirewallRules(virNetworkObjPtr network, + virNetworkIpDefPtr ipdef); + +void networkRemoveIpSpecificFirewallRules(virNetworkObjPtr network, + virNetworkIpDefPtr ipdef); + +int networkAddFirewallRules(virNetworkObjPtr network); + +void networkRemoveFirewallRules(virNetworkObjPtr network); + +#endif /* __VIR_BRIDGE_DRIVER_PLATFORM_H__ */ diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index 0bb57ea..a1b0dd5 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -45,6 +45,7 @@ #include "virerror.h" #include "datatypes.h" #include "bridge_driver.h" +#include "bridge_driver_platform.h" #include "network_conf.h" #include "device_conf.h" #include "driver.h" @@ -69,24 +70,6 @@ #define VIR_FROM_THIS VIR_FROM_NETWORK -/* Main driver state */ -struct _virNetworkDriverState { - virMutex lock; - - virNetworkObjList networks; - - char *networkConfigDir; - char *networkAutostartDir; - char *stateDir; - char *pidDir; - char *dnsmasqStateDir; - char *radvdStateDir; - dnsmasqCapsPtr dnsmasqCaps; -}; - -typedef struct _virNetworkDriverState virNetworkDriverState; -typedef virNetworkDriverState *virNetworkDriverStatePtr; - static void networkDriverLock(virNetworkDriverStatePtr driver) { virMutexLock(&driver->lock); @@ -1507,597 +1490,6 @@ networkRefreshDaemons(virNetworkDriverStatePtr driver) } } -static int -networkAddMasqueradingFirewallRules(virNetworkObjPtr network, - virNetworkIpDefPtr ipdef) -{ - int prefix = virNetworkIpDefPrefix(ipdef); - const char *forwardIf = virNetworkDefForwardIf(network->def, 0); - - if (prefix < 0) { - virReportError(VIR_ERR_INTERNAL_ERROR, - _("Invalid prefix or netmask for '%s'"), - network->def->bridge); - goto masqerr1; - } - - /* allow forwarding packets from the bridge interface */ - if (iptablesAddForwardAllowOut(&ipdef->address, - prefix, - network->def->bridge, - forwardIf) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add iptables rule to allow forwarding from '%s'"), - network->def->bridge); - goto masqerr1; - } - - /* allow forwarding packets to the bridge interface if they are - * part of an existing connection - */ - if (iptablesAddForwardAllowRelatedIn(&ipdef->address, - prefix, - network->def->bridge, - forwardIf) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add iptables rule to allow forwarding to '%s'"), - network->def->bridge); - goto masqerr2; - } - - /* - * Enable masquerading. - * - * We need to end up with 3 rules in the table in this order - * - * 1. protocol=tcp with sport mapping restriction - * 2. protocol=udp with sport mapping restriction - * 3. generic any protocol - * - * The sport mappings are required, because default IPtables - * MASQUERADE maintain port numbers unchanged where possible. - * - * NFS can be configured to only "trust" port numbers < 1023. - * - * Guests using NAT thus need to be prevented from having port - * numbers < 1023, otherwise they can bypass the NFS "security" - * check on the source port number. - * - * Since we use '--insert' to add rules to the header of the - * chain, we actually need to add them in the reverse of the - * order just mentioned ! - */ - - /* First the generic masquerade rule for other protocols */ - if (iptablesAddForwardMasquerade(&ipdef->address, - prefix, - forwardIf, - &network->def->forward.addr, - &network->def->forward.port, - NULL) < 0) { - if (forwardIf) - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add iptables rule to enable masquerading to %s"), - forwardIf); - else - virReportError(VIR_ERR_SYSTEM_ERROR, "%s", - _("failed to add iptables rule to enable masquerading")); - goto masqerr3; - } - - /* UDP with a source port restriction */ - if (iptablesAddForwardMasquerade(&ipdef->address, - prefix, - forwardIf, - &network->def->forward.addr, - &network->def->forward.port, - "udp") < 0) { - if (forwardIf) - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add iptables rule to enable UDP masquerading to %s"), - forwardIf); - else - virReportError(VIR_ERR_SYSTEM_ERROR, "%s", - _("failed to add iptables rule to enable UDP masquerading")); - goto masqerr4; - } - - /* TCP with a source port restriction */ - if (iptablesAddForwardMasquerade(&ipdef->address, - prefix, - forwardIf, - &network->def->forward.addr, - &network->def->forward.port, - "tcp") < 0) { - if (forwardIf) - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add iptables rule to enable TCP masquerading to %s"), - forwardIf); - else - virReportError(VIR_ERR_SYSTEM_ERROR, "%s", - _("failed to add iptables rule to enable TCP masquerading")); - goto masqerr5; - } - - return 0; - - masqerr5: - iptablesRemoveForwardMasquerade(&ipdef->address, - prefix, - forwardIf, - &network->def->forward.addr, - &network->def->forward.port, - "udp"); - masqerr4: - iptablesRemoveForwardMasquerade(&ipdef->address, - prefix, - forwardIf, - &network->def->forward.addr, - &network->def->forward.port, - NULL); - masqerr3: - iptablesRemoveForwardAllowRelatedIn(&ipdef->address, - prefix, - network->def->bridge, - forwardIf); - masqerr2: - iptablesRemoveForwardAllowOut(&ipdef->address, - prefix, - network->def->bridge, - forwardIf); - masqerr1: - return -1; -} - -static void -networkRemoveMasqueradingFirewallRules(virNetworkObjPtr network, - virNetworkIpDefPtr ipdef) -{ - int prefix = virNetworkIpDefPrefix(ipdef); - const char *forwardIf = virNetworkDefForwardIf(network->def, 0); - - if (prefix >= 0) { - iptablesRemoveForwardMasquerade(&ipdef->address, - prefix, - forwardIf, - &network->def->forward.addr, - &network->def->forward.port, - "tcp"); - iptablesRemoveForwardMasquerade(&ipdef->address, - prefix, - forwardIf, - &network->def->forward.addr, - &network->def->forward.port, - "udp"); - iptablesRemoveForwardMasquerade(&ipdef->address, - prefix, - forwardIf, - &network->def->forward.addr, - &network->def->forward.port, - NULL); - - iptablesRemoveForwardAllowRelatedIn(&ipdef->address, - prefix, - network->def->bridge, - forwardIf); - iptablesRemoveForwardAllowOut(&ipdef->address, - prefix, - network->def->bridge, - forwardIf); - } -} - -static int -networkAddRoutingFirewallRules(virNetworkObjPtr network, - virNetworkIpDefPtr ipdef) -{ - int prefix = virNetworkIpDefPrefix(ipdef); - const char *forwardIf = virNetworkDefForwardIf(network->def, 0); - - if (prefix < 0) { - virReportError(VIR_ERR_INTERNAL_ERROR, - _("Invalid prefix or netmask for '%s'"), - network->def->bridge); - goto routeerr1; - } - - /* allow routing packets from the bridge interface */ - if (iptablesAddForwardAllowOut(&ipdef->address, - prefix, - network->def->bridge, - forwardIf) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add iptables rule to allow routing from '%s'"), - network->def->bridge); - goto routeerr1; - } - - /* allow routing packets to the bridge interface */ - if (iptablesAddForwardAllowIn(&ipdef->address, - prefix, - network->def->bridge, - forwardIf) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add iptables rule to allow routing to '%s'"), - network->def->bridge); - goto routeerr2; - } - - return 0; - -routeerr2: - iptablesRemoveForwardAllowOut(&ipdef->address, - prefix, - network->def->bridge, - forwardIf); -routeerr1: - return -1; -} - -static void -networkRemoveRoutingFirewallRules(virNetworkObjPtr network, - virNetworkIpDefPtr ipdef) -{ - int prefix = virNetworkIpDefPrefix(ipdef); - const char *forwardIf = virNetworkDefForwardIf(network->def, 0); - - if (prefix >= 0) { - iptablesRemoveForwardAllowIn(&ipdef->address, - prefix, - network->def->bridge, - forwardIf); - - iptablesRemoveForwardAllowOut(&ipdef->address, - prefix, - network->def->bridge, - forwardIf); - } -} - -/* Add all once/network rules required for IPv6. - * If no IPv6 addresses are defined and <network ipv6='yes'> is - * specified, then allow IPv6 commuinications between virtual systems. - * If any IPv6 addresses are defined, then add the rules for regular operation. - */ -static int -networkAddGeneralIp6tablesRules(virNetworkObjPtr network) -{ - - if (!virNetworkDefGetIpByIndex(network->def, AF_INET6, 0) && - !network->def->ipv6nogw) { - return 0; - } - - /* Catch all rules to block forwarding to/from bridges */ - - if (iptablesAddForwardRejectOut(AF_INET6, network->def->bridge) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add ip6tables rule to block outbound traffic from '%s'"), - network->def->bridge); - goto err1; - } - - if (iptablesAddForwardRejectIn(AF_INET6, network->def->bridge) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add ip6tables rule to block inbound traffic to '%s'"), - network->def->bridge); - goto err2; - } - - /* Allow traffic between guests on the same bridge */ - if (iptablesAddForwardAllowCross(AF_INET6, network->def->bridge) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add ip6tables rule to allow cross bridge traffic on '%s'"), - network->def->bridge); - goto err3; - } - - /* if no IPv6 addresses are defined, we are done. */ - if (!virNetworkDefGetIpByIndex(network->def, AF_INET6, 0)) - return 0; - - /* allow DNS over IPv6 */ - if (iptablesAddTcpInput(AF_INET6, network->def->bridge, 53) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add ip6tables rule to allow DNS requests from '%s'"), - network->def->bridge); - goto err4; - } - - if (iptablesAddUdpInput(AF_INET6, network->def->bridge, 53) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add ip6tables rule to allow DNS requests from '%s'"), - network->def->bridge); - goto err5; - } - - if (iptablesAddUdpInput(AF_INET6, network->def->bridge, 547) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add ip6tables rule to allow DHCP6 requests from '%s'"), - network->def->bridge); - goto err6; - } - - return 0; - - /* unwind in reverse order from the point of failure */ -err6: - iptablesRemoveUdpInput(AF_INET6, network->def->bridge, 53); -err5: - iptablesRemoveTcpInput(AF_INET6, network->def->bridge, 53); -err4: - iptablesRemoveForwardAllowCross(AF_INET6, network->def->bridge); -err3: - iptablesRemoveForwardRejectIn(AF_INET6, network->def->bridge); -err2: - iptablesRemoveForwardRejectOut(AF_INET6, network->def->bridge); -err1: - return -1; -} - -static void -networkRemoveGeneralIp6tablesRules(virNetworkObjPtr network) -{ - if (!virNetworkDefGetIpByIndex(network->def, AF_INET6, 0) && - !network->def->ipv6nogw) { - return; - } - if (virNetworkDefGetIpByIndex(network->def, AF_INET6, 0)) { - iptablesRemoveUdpInput(AF_INET6, network->def->bridge, 547); - iptablesRemoveUdpInput(AF_INET6, network->def->bridge, 53); - iptablesRemoveTcpInput(AF_INET6, network->def->bridge, 53); - } - - /* the following rules are there if no IPv6 address has been defined - * but network->def->ipv6nogw == true - */ - iptablesRemoveForwardAllowCross(AF_INET6, network->def->bridge); - iptablesRemoveForwardRejectIn(AF_INET6, network->def->bridge); - iptablesRemoveForwardRejectOut(AF_INET6, network->def->bridge); -} - -static int -networkAddGeneralFirewallRules(virNetworkObjPtr network) -{ - size_t i; - virNetworkIpDefPtr ipv4def; - - /* First look for first IPv4 address that has dhcp or tftpboot defined. */ - /* We support dhcp config on 1 IPv4 interface only. */ - for (i = 0; - (ipv4def = virNetworkDefGetIpByIndex(network->def, AF_INET, i)); - i++) { - if (ipv4def->nranges || ipv4def->nhosts || ipv4def->tftproot) - break; - } - - /* allow DHCP requests through to dnsmasq */ - - if (iptablesAddTcpInput(AF_INET, network->def->bridge, 67) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add iptables rule to allow DHCP requests from '%s'"), - network->def->bridge); - goto err1; - } - - if (iptablesAddUdpInput(AF_INET, network->def->bridge, 67) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add iptables rule to allow DHCP requests from '%s'"), - network->def->bridge); - goto err2; - } - - /* If we are doing local DHCP service on this network, attempt to - * add a rule that will fixup the checksum of DHCP response - * packets back to the guests (but report failure without - * aborting, since not all iptables implementations support it). - */ - - if (ipv4def && (ipv4def->nranges || ipv4def->nhosts) && - (iptablesAddOutputFixUdpChecksum(network->def->bridge, 68) < 0)) { - VIR_WARN("Could not add rule to fixup DHCP response checksums " - "on network '%s'.", network->def->name); - VIR_WARN("May need to update iptables package & kernel to support CHECKSUM rule."); - } - - /* allow DNS requests through to dnsmasq */ - if (iptablesAddTcpInput(AF_INET, network->def->bridge, 53) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add iptables rule to allow DNS requests from '%s'"), - network->def->bridge); - goto err3; - } - - if (iptablesAddUdpInput(AF_INET, network->def->bridge, 53) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add iptables rule to allow DNS requests from '%s'"), - network->def->bridge); - goto err4; - } - - /* allow TFTP requests through to dnsmasq if necessary */ - if (ipv4def && ipv4def->tftproot && - iptablesAddUdpInput(AF_INET, network->def->bridge, 69) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add iptables rule to allow TFTP requests from '%s'"), - network->def->bridge); - goto err5; - } - - /* Catch all rules to block forwarding to/from bridges */ - - if (iptablesAddForwardRejectOut(AF_INET, network->def->bridge) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add iptables rule to block outbound traffic from '%s'"), - network->def->bridge); - goto err6; - } - - if (iptablesAddForwardRejectIn(AF_INET, network->def->bridge) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add iptables rule to block inbound traffic to '%s'"), - network->def->bridge); - goto err7; - } - - /* Allow traffic between guests on the same bridge */ - if (iptablesAddForwardAllowCross(AF_INET, network->def->bridge) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("failed to add iptables rule to allow cross bridge traffic on '%s'"), - network->def->bridge); - goto err8; - } - - /* add IPv6 general rules, if needed */ - if (networkAddGeneralIp6tablesRules(network) < 0) { - goto err9; - } - - return 0; - - /* unwind in reverse order from the point of failure */ -err9: - iptablesRemoveForwardAllowCross(AF_INET, network->def->bridge); -err8: - iptablesRemoveForwardRejectIn(AF_INET, network->def->bridge); -err7: - iptablesRemoveForwardRejectOut(AF_INET, network->def->bridge); -err6: - if (ipv4def && ipv4def->tftproot) { - iptablesRemoveUdpInput(AF_INET, network->def->bridge, 69); - } -err5: - iptablesRemoveUdpInput(AF_INET, network->def->bridge, 53); -err4: - iptablesRemoveTcpInput(AF_INET, network->def->bridge, 53); -err3: - iptablesRemoveUdpInput(AF_INET, network->def->bridge, 67); -err2: - iptablesRemoveTcpInput(AF_INET, network->def->bridge, 67); -err1: - return -1; -} - -static void -networkRemoveGeneralFirewallRules(virNetworkObjPtr network) -{ - size_t i; - virNetworkIpDefPtr ipv4def; - - networkRemoveGeneralIp6tablesRules(network); - - for (i = 0; - (ipv4def = virNetworkDefGetIpByIndex(network->def, AF_INET, i)); - i++) { - if (ipv4def->nranges || ipv4def->nhosts || ipv4def->tftproot) - break; - } - - iptablesRemoveForwardAllowCross(AF_INET, network->def->bridge); - iptablesRemoveForwardRejectIn(AF_INET, network->def->bridge); - iptablesRemoveForwardRejectOut(AF_INET, network->def->bridge); - if (ipv4def && ipv4def->tftproot) { - iptablesRemoveUdpInput(AF_INET, network->def->bridge, 69); - } - iptablesRemoveUdpInput(AF_INET, network->def->bridge, 53); - iptablesRemoveTcpInput(AF_INET, network->def->bridge, 53); - if (ipv4def && (ipv4def->nranges || ipv4def->nhosts)) { - iptablesRemoveOutputFixUdpChecksum(network->def->bridge, 68); - } - iptablesRemoveUdpInput(AF_INET, network->def->bridge, 67); - iptablesRemoveTcpInput(AF_INET, network->def->bridge, 67); -} - -static int -networkAddIpSpecificFirewallRules(virNetworkObjPtr network, - virNetworkIpDefPtr ipdef) -{ - /* NB: in the case of IPv6, routing rules are added when the - * forward mode is NAT. This is because IPv6 has no NAT. - */ - - if (network->def->forward.type == VIR_NETWORK_FORWARD_NAT) { - if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET)) - return networkAddMasqueradingFirewallRules(network, ipdef); - else if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET6)) - return networkAddRoutingFirewallRules(network, ipdef); - } else if (network->def->forward.type == VIR_NETWORK_FORWARD_ROUTE) { - return networkAddRoutingFirewallRules(network, ipdef); - } - return 0; -} - -static void -networkRemoveIpSpecificFirewallRules(virNetworkObjPtr network, - virNetworkIpDefPtr ipdef) -{ - if (network->def->forward.type == VIR_NETWORK_FORWARD_NAT) { - if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET)) - networkRemoveMasqueradingFirewallRules(network, ipdef); - else if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET6)) - networkRemoveRoutingFirewallRules(network, ipdef); - } else if (network->def->forward.type == VIR_NETWORK_FORWARD_ROUTE) { - networkRemoveRoutingFirewallRules(network, ipdef); - } -} - -/* Add all rules for all ip addresses (and general rules) on a network */ -static int -networkAddFirewallRules(virNetworkObjPtr network) -{ - size_t i, j; - virNetworkIpDefPtr ipdef; - virErrorPtr orig_error; - - /* Add "once per network" rules */ - if (networkAddGeneralFirewallRules(network) < 0) - return -1; - - for (i = 0; - (ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, i)); - i++) { - /* Add address-specific iptables rules */ - if (networkAddIpSpecificFirewallRules(network, ipdef) < 0) { - goto err; - } - } - return 0; - -err: - /* store the previous error message before attempting removal of rules */ - orig_error = virSaveLastError(); - - /* The final failed call to networkAddIpSpecificFirewallRules will - * have removed any rules it created, but we need to remove those - * added for previous IP addresses. - */ - for (j = 0; j < i; j++) { - if ((ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, j))) - networkRemoveIpSpecificFirewallRules(network, ipdef); - } - networkRemoveGeneralFirewallRules(network); - - /* return the original error */ - virSetError(orig_error); - virFreeError(orig_error); - return -1; -} - -/* Remove all rules for all ip addresses (and general rules) on a network */ -static void -networkRemoveFirewallRules(virNetworkObjPtr network) -{ - size_t i; - virNetworkIpDefPtr ipdef; - - for (i = 0; - (ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, i)); - i++) { - networkRemoveIpSpecificFirewallRules(network, ipdef); - } - networkRemoveGeneralFirewallRules(network); -} - static void networkReloadFirewallRules(virNetworkDriverStatePtr driver) { @@ -2206,104 +1598,6 @@ cleanup: return ret; } -#define PROC_NET_ROUTE "/proc/net/route" - -/* XXX: This function can be a lot more exhaustive, there are certainly - * other scenarios where we can ruin host network connectivity. - * XXX: Using a proper library is preferred over parsing /proc - */ -static int -networkCheckRouteCollision(virNetworkObjPtr network) -{ - int ret = 0, len; - char *cur, *buf = NULL; - /* allow for up to 100000 routes (each line is 128 bytes) */ - enum {MAX_ROUTE_SIZE = 128*100000}; - - /* Read whole routing table into memory */ - if ((len = virFileReadAll(PROC_NET_ROUTE, MAX_ROUTE_SIZE, &buf)) < 0) - goto out; - - /* Dropping the last character shouldn't hurt */ - if (len > 0) - buf[len-1] = '\0'; - - VIR_DEBUG("%s output:\n%s", PROC_NET_ROUTE, buf); - - if (!STRPREFIX(buf, "Iface")) - goto out; - - /* First line is just headings, skip it */ - cur = strchr(buf, '\n'); - if (cur) - cur++; - - while (cur) { - char iface[17], dest[128], mask[128]; - unsigned int addr_val, mask_val; - virNetworkIpDefPtr ipdef; - int num; - size_t i; - - /* NUL-terminate the line, so sscanf doesn't go beyond a newline. */ - char *nl = strchr(cur, '\n'); - if (nl) { - *nl++ = '\0'; - } - - num = sscanf(cur, "%16s %127s %*s %*s %*s %*s %*s %127s", - iface, dest, mask); - cur = nl; - - if (num != 3) { - VIR_DEBUG("Failed to parse %s", PROC_NET_ROUTE); - continue; - } - - if (virStrToLong_ui(dest, NULL, 16, &addr_val) < 0) { - VIR_DEBUG("Failed to convert network address %s to uint", dest); - continue; - } - - if (virStrToLong_ui(mask, NULL, 16, &mask_val) < 0) { - VIR_DEBUG("Failed to convert network mask %s to uint", mask); - continue; - } - - addr_val &= mask_val; - - for (i = 0; - (ipdef = virNetworkDefGetIpByIndex(network->def, AF_INET, i)); - i++) { - - unsigned int net_dest; - virSocketAddr netmask; - - if (virNetworkIpDefNetmask(ipdef, &netmask) < 0) { - VIR_WARN("Failed to get netmask of '%s'", - network->def->bridge); - continue; - } - - net_dest = (ipdef->address.data.inet4.sin_addr.s_addr & - netmask.data.inet4.sin_addr.s_addr); - - if ((net_dest == addr_val) && - (netmask.data.inet4.sin_addr.s_addr == mask_val)) { - virReportError(VIR_ERR_INTERNAL_ERROR, - _("Network is already in use by interface %s"), - iface); - ret = -1; - goto out; - } - } - } - -out: - VIR_FREE(buf); - return ret; -} - /* add an IP address to a bridge */ static int networkAddAddrToBridge(virNetworkObjPtr network, diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_linux.c new file mode 100644 index 0000000..80430a8 --- /dev/null +++ b/src/network/bridge_driver_linux.c @@ -0,0 +1,709 @@ +/* + * bridge_driver_linux.c: Linux implementation of bridge driver + * + * Copyright (C) 2006-2013 Red Hat, Inc. + * Copyright (C) 2006 Daniel P. Berrange + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + * + * Author: Daniel P. Berrange <berrange(a)redhat.com> + */ + +#include <config.h> + +#include "viralloc.h" +#include "virfile.h" +#include "viriptables.h" +#include "virstring.h" + +#define VIR_FROM_THIS VIR_FROM_NONE + +#define PROC_NET_ROUTE "/proc/net/route" + +/* XXX: This function can be a lot more exhaustive, there are certainly + * other scenarios where we can ruin host network connectivity. + * XXX: Using a proper library is preferred over parsing /proc + */ +int networkCheckRouteCollision(virNetworkObjPtr network) +{ + int ret = 0, len; + char *cur, *buf = NULL; + /* allow for up to 100000 routes (each line is 128 bytes) */ + enum {MAX_ROUTE_SIZE = 128*100000}; + + /* Read whole routing table into memory */ + if ((len = virFileReadAll(PROC_NET_ROUTE, MAX_ROUTE_SIZE, &buf)) < 0) + goto out; + + /* Dropping the last character shouldn't hurt */ + if (len > 0) + buf[len-1] = '\0'; + + VIR_DEBUG("%s output:\n%s", PROC_NET_ROUTE, buf); + + if (!STRPREFIX(buf, "Iface")) + goto out; + + /* First line is just headings, skip it */ + cur = strchr(buf, '\n'); + if (cur) + cur++; + + while (cur) { + char iface[17], dest[128], mask[128]; + unsigned int addr_val, mask_val; + virNetworkIpDefPtr ipdef; + int num; + size_t i; + + /* NUL-terminate the line, so sscanf doesn't go beyond a newline. */ + char *nl = strchr(cur, '\n'); + if (nl) { + *nl++ = '\0'; + } + + num = sscanf(cur, "%16s %127s %*s %*s %*s %*s %*s %127s", + iface, dest, mask); + cur = nl; + + if (num != 3) { + VIR_DEBUG("Failed to parse %s", PROC_NET_ROUTE); + continue; + } + + if (virStrToLong_ui(dest, NULL, 16, &addr_val) < 0) { + VIR_DEBUG("Failed to convert network address %s to uint", dest); + continue; + } + + if (virStrToLong_ui(mask, NULL, 16, &mask_val) < 0) { + VIR_DEBUG("Failed to convert network mask %s to uint", mask); + continue; + } + + addr_val &= mask_val; + + for (i = 0; + (ipdef = virNetworkDefGetIpByIndex(network->def, AF_INET, i)); + i++) { + + unsigned int net_dest; + virSocketAddr netmask; + + if (virNetworkIpDefNetmask(ipdef, &netmask) < 0) { + VIR_WARN("Failed to get netmask of '%s'", + network->def->bridge); + continue; + } + + net_dest = (ipdef->address.data.inet4.sin_addr.s_addr & + netmask.data.inet4.sin_addr.s_addr); + + if ((net_dest == addr_val) && + (netmask.data.inet4.sin_addr.s_addr == mask_val)) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Network is already in use by interface %s"), + iface); + ret = -1; + goto out; + } + } + } + +out: + VIR_FREE(buf); + return ret; +} + +int networkAddMasqueradingFirewallRules(virNetworkObjPtr network, + virNetworkIpDefPtr ipdef) +{ + int prefix = virNetworkIpDefPrefix(ipdef); + const char *forwardIf = virNetworkDefForwardIf(network->def, 0); + + if (prefix < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Invalid prefix or netmask for '%s'"), + network->def->bridge); + goto masqerr1; + } + + /* allow forwarding packets from the bridge interface */ + if (iptablesAddForwardAllowOut(&ipdef->address, + prefix, + network->def->bridge, + forwardIf) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add iptables rule to allow forwarding from '%s'"), + network->def->bridge); + goto masqerr1; + } + + /* allow forwarding packets to the bridge interface if they are + * part of an existing connection + */ + if (iptablesAddForwardAllowRelatedIn(&ipdef->address, + prefix, + network->def->bridge, + forwardIf) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add iptables rule to allow forwarding to '%s'"), + network->def->bridge); + goto masqerr2; + } + + /* + * Enable masquerading. + * + * We need to end up with 3 rules in the table in this order + * + * 1. protocol=tcp with sport mapping restriction + * 2. protocol=udp with sport mapping restriction + * 3. generic any protocol + * + * The sport mappings are required, because default IPtables + * MASQUERADE maintain port numbers unchanged where possible. + * + * NFS can be configured to only "trust" port numbers < 1023. + * + * Guests using NAT thus need to be prevented from having port + * numbers < 1023, otherwise they can bypass the NFS "security" + * check on the source port number. + * + * Since we use '--insert' to add rules to the header of the + * chain, we actually need to add them in the reverse of the + * order just mentioned ! + */ + + /* First the generic masquerade rule for other protocols */ + if (iptablesAddForwardMasquerade(&ipdef->address, + prefix, + forwardIf, + &network->def->forward.addr, + &network->def->forward.port, + NULL) < 0) { + if (forwardIf) + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add iptables rule to enable masquerading to %s"), + forwardIf); + else + virReportError(VIR_ERR_SYSTEM_ERROR, "%s", + _("failed to add iptables rule to enable masquerading")); + goto masqerr3; + } + + /* UDP with a source port restriction */ + if (iptablesAddForwardMasquerade(&ipdef->address, + prefix, + forwardIf, + &network->def->forward.addr, + &network->def->forward.port, + "udp") < 0) { + if (forwardIf) + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add iptables rule to enable UDP masquerading to %s"), + forwardIf); + else + virReportError(VIR_ERR_SYSTEM_ERROR, "%s", + _("failed to add iptables rule to enable UDP masquerading")); + goto masqerr4; + } + + /* TCP with a source port restriction */ + if (iptablesAddForwardMasquerade(&ipdef->address, + prefix, + forwardIf, + &network->def->forward.addr, + &network->def->forward.port, + "tcp") < 0) { + if (forwardIf) + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add iptables rule to enable TCP masquerading to %s"), + forwardIf); + else + virReportError(VIR_ERR_SYSTEM_ERROR, "%s", + _("failed to add iptables rule to enable TCP masquerading")); + goto masqerr5; + } + + return 0; + + masqerr5: + iptablesRemoveForwardMasquerade(&ipdef->address, + prefix, + forwardIf, + &network->def->forward.addr, + &network->def->forward.port, + "udp"); + masqerr4: + iptablesRemoveForwardMasquerade(&ipdef->address, + prefix, + forwardIf, + &network->def->forward.addr, + &network->def->forward.port, + NULL); + masqerr3: + iptablesRemoveForwardAllowRelatedIn(&ipdef->address, + prefix, + network->def->bridge, + forwardIf); + masqerr2: + iptablesRemoveForwardAllowOut(&ipdef->address, + prefix, + network->def->bridge, + forwardIf); + masqerr1: + return -1; +} + +void networkRemoveMasqueradingFirewallRules(virNetworkObjPtr network, + virNetworkIpDefPtr ipdef) +{ + int prefix = virNetworkIpDefPrefix(ipdef); + const char *forwardIf = virNetworkDefForwardIf(network->def, 0); + + if (prefix >= 0) { + iptablesRemoveForwardMasquerade(&ipdef->address, + prefix, + forwardIf, + &network->def->forward.addr, + &network->def->forward.port, + "tcp"); + iptablesRemoveForwardMasquerade(&ipdef->address, + prefix, + forwardIf, + &network->def->forward.addr, + &network->def->forward.port, + "udp"); + iptablesRemoveForwardMasquerade(&ipdef->address, + prefix, + forwardIf, + &network->def->forward.addr, + &network->def->forward.port, + NULL); + + iptablesRemoveForwardAllowRelatedIn(&ipdef->address, + prefix, + network->def->bridge, + forwardIf); + iptablesRemoveForwardAllowOut(&ipdef->address, + prefix, + network->def->bridge, + forwardIf); + } +} + +int networkAddRoutingFirewallRules(virNetworkObjPtr network, + virNetworkIpDefPtr ipdef) +{ + int prefix = virNetworkIpDefPrefix(ipdef); + const char *forwardIf = virNetworkDefForwardIf(network->def, 0); + + if (prefix < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Invalid prefix or netmask for '%s'"), + network->def->bridge); + goto routeerr1; + } + + /* allow routing packets from the bridge interface */ + if (iptablesAddForwardAllowOut(&ipdef->address, + prefix, + network->def->bridge, + forwardIf) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add iptables rule to allow routing from '%s'"), + network->def->bridge); + goto routeerr1; + } + + /* allow routing packets to the bridge interface */ + if (iptablesAddForwardAllowIn(&ipdef->address, + prefix, + network->def->bridge, + forwardIf) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add iptables rule to allow routing to '%s'"), + network->def->bridge); + goto routeerr2; + } + + return 0; + +routeerr2: + iptablesRemoveForwardAllowOut(&ipdef->address, + prefix, + network->def->bridge, + forwardIf); +routeerr1: + return -1; +} + +void networkRemoveRoutingFirewallRules(virNetworkObjPtr network, + virNetworkIpDefPtr ipdef) +{ + int prefix = virNetworkIpDefPrefix(ipdef); + const char *forwardIf = virNetworkDefForwardIf(network->def, 0); + + if (prefix >= 0) { + iptablesRemoveForwardAllowIn(&ipdef->address, + prefix, + network->def->bridge, + forwardIf); + + iptablesRemoveForwardAllowOut(&ipdef->address, + prefix, + network->def->bridge, + forwardIf); + } +} + +/* Add all once/network rules required for IPv6. + * If no IPv6 addresses are defined and <network ipv6='yes'> is + * specified, then allow IPv6 commuinications between virtual systems. + * If any IPv6 addresses are defined, then add the rules for regular operation. + */ +static int +networkAddGeneralIp6tablesRules(virNetworkObjPtr network) +{ + + if (!virNetworkDefGetIpByIndex(network->def, AF_INET6, 0) && + !network->def->ipv6nogw) { + return 0; + } + + /* Catch all rules to block forwarding to/from bridges */ + + if (iptablesAddForwardRejectOut(AF_INET6, network->def->bridge) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add ip6tables rule to block outbound traffic from '%s'"), + network->def->bridge); + goto err1; + } + + if (iptablesAddForwardRejectIn(AF_INET6, network->def->bridge) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add ip6tables rule to block inbound traffic to '%s'"), + network->def->bridge); + goto err2; + } + + /* Allow traffic between guests on the same bridge */ + if (iptablesAddForwardAllowCross(AF_INET6, network->def->bridge) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add ip6tables rule to allow cross bridge traffic on '%s'"), + network->def->bridge); + goto err3; + } + + /* if no IPv6 addresses are defined, we are done. */ + if (!virNetworkDefGetIpByIndex(network->def, AF_INET6, 0)) + return 0; + + /* allow DNS over IPv6 */ + if (iptablesAddTcpInput(AF_INET6, network->def->bridge, 53) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add ip6tables rule to allow DNS requests from '%s'"), + network->def->bridge); + goto err4; + } + + if (iptablesAddUdpInput(AF_INET6, network->def->bridge, 53) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add ip6tables rule to allow DNS requests from '%s'"), + network->def->bridge); + goto err5; + } + + if (iptablesAddUdpInput(AF_INET6, network->def->bridge, 547) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add ip6tables rule to allow DHCP6 requests from '%s'"), + network->def->bridge); + goto err6; + } + + return 0; + + /* unwind in reverse order from the point of failure */ +err6: + iptablesRemoveUdpInput(AF_INET6, network->def->bridge, 53); +err5: + iptablesRemoveTcpInput(AF_INET6, network->def->bridge, 53); +err4: + iptablesRemoveForwardAllowCross(AF_INET6, network->def->bridge); +err3: + iptablesRemoveForwardRejectIn(AF_INET6, network->def->bridge); +err2: + iptablesRemoveForwardRejectOut(AF_INET6, network->def->bridge); +err1: + return -1; +} + +static void +networkRemoveGeneralIp6tablesRules(virNetworkObjPtr network) +{ + if (!virNetworkDefGetIpByIndex(network->def, AF_INET6, 0) && + !network->def->ipv6nogw) { + return; + } + if (virNetworkDefGetIpByIndex(network->def, AF_INET6, 0)) { + iptablesRemoveUdpInput(AF_INET6, network->def->bridge, 547); + iptablesRemoveUdpInput(AF_INET6, network->def->bridge, 53); + iptablesRemoveTcpInput(AF_INET6, network->def->bridge, 53); + } + + /* the following rules are there if no IPv6 address has been defined + * but network->def->ipv6nogw == true + */ + iptablesRemoveForwardAllowCross(AF_INET6, network->def->bridge); + iptablesRemoveForwardRejectIn(AF_INET6, network->def->bridge); + iptablesRemoveForwardRejectOut(AF_INET6, network->def->bridge); +} + +int networkAddGeneralFirewallRules(virNetworkObjPtr network) +{ + size_t i; + virNetworkIpDefPtr ipv4def; + + /* First look for first IPv4 address that has dhcp or tftpboot defined. */ + /* We support dhcp config on 1 IPv4 interface only. */ + for (i = 0; + (ipv4def = virNetworkDefGetIpByIndex(network->def, AF_INET, i)); + i++) { + if (ipv4def->nranges || ipv4def->nhosts || ipv4def->tftproot) + break; + } + + /* allow DHCP requests through to dnsmasq */ + + if (iptablesAddTcpInput(AF_INET, network->def->bridge, 67) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add iptables rule to allow DHCP requests from '%s'"), + network->def->bridge); + goto err1; + } + + if (iptablesAddUdpInput(AF_INET, network->def->bridge, 67) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add iptables rule to allow DHCP requests from '%s'"), + network->def->bridge); + goto err2; + } + + /* If we are doing local DHCP service on this network, attempt to + * add a rule that will fixup the checksum of DHCP response + * packets back to the guests (but report failure without + * aborting, since not all iptables implementations support it). + */ + + if (ipv4def && (ipv4def->nranges || ipv4def->nhosts) && + (iptablesAddOutputFixUdpChecksum(network->def->bridge, 68) < 0)) { + VIR_WARN("Could not add rule to fixup DHCP response checksums " + "on network '%s'.", network->def->name); + VIR_WARN("May need to update iptables package & kernel to support CHECKSUM rule."); + } + + /* allow DNS requests through to dnsmasq */ + if (iptablesAddTcpInput(AF_INET, network->def->bridge, 53) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add iptables rule to allow DNS requests from '%s'"), + network->def->bridge); + goto err3; + } + + if (iptablesAddUdpInput(AF_INET, network->def->bridge, 53) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add iptables rule to allow DNS requests from '%s'"), + network->def->bridge); + goto err4; + } + + /* allow TFTP requests through to dnsmasq if necessary */ + if (ipv4def && ipv4def->tftproot && + iptablesAddUdpInput(AF_INET, network->def->bridge, 69) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add iptables rule to allow TFTP requests from '%s'"), + network->def->bridge); + goto err5; + } + + /* Catch all rules to block forwarding to/from bridges */ + + if (iptablesAddForwardRejectOut(AF_INET, network->def->bridge) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add iptables rule to block outbound traffic from '%s'"), + network->def->bridge); + goto err6; + } + + if (iptablesAddForwardRejectIn(AF_INET, network->def->bridge) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add iptables rule to block inbound traffic to '%s'"), + network->def->bridge); + goto err7; + } + + /* Allow traffic between guests on the same bridge */ + if (iptablesAddForwardAllowCross(AF_INET, network->def->bridge) < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("failed to add iptables rule to allow cross bridge traffic on '%s'"), + network->def->bridge); + goto err8; + } + + /* add IPv6 general rules, if needed */ + if (networkAddGeneralIp6tablesRules(network) < 0) { + goto err9; + } + + return 0; + + /* unwind in reverse order from the point of failure */ +err9: + iptablesRemoveForwardAllowCross(AF_INET, network->def->bridge); +err8: + iptablesRemoveForwardRejectIn(AF_INET, network->def->bridge); +err7: + iptablesRemoveForwardRejectOut(AF_INET, network->def->bridge); +err6: + if (ipv4def && ipv4def->tftproot) { + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 69); + } +err5: + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 53); +err4: + iptablesRemoveTcpInput(AF_INET, network->def->bridge, 53); +err3: + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 67); +err2: + iptablesRemoveTcpInput(AF_INET, network->def->bridge, 67); +err1: + return -1; +} + +void networkRemoveGeneralFirewallRules(virNetworkObjPtr network) +{ + size_t i; + virNetworkIpDefPtr ipv4def; + + networkRemoveGeneralIp6tablesRules(network); + + for (i = 0; + (ipv4def = virNetworkDefGetIpByIndex(network->def, AF_INET, i)); + i++) { + if (ipv4def->nranges || ipv4def->nhosts || ipv4def->tftproot) + break; + } + + iptablesRemoveForwardAllowCross(AF_INET, network->def->bridge); + iptablesRemoveForwardRejectIn(AF_INET, network->def->bridge); + iptablesRemoveForwardRejectOut(AF_INET, network->def->bridge); + if (ipv4def && ipv4def->tftproot) { + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 69); + } + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 53); + iptablesRemoveTcpInput(AF_INET, network->def->bridge, 53); + if (ipv4def && (ipv4def->nranges || ipv4def->nhosts)) { + iptablesRemoveOutputFixUdpChecksum(network->def->bridge, 68); + } + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 67); + iptablesRemoveTcpInput(AF_INET, network->def->bridge, 67); +} + +int networkAddIpSpecificFirewallRules(virNetworkObjPtr network, + virNetworkIpDefPtr ipdef) +{ + /* NB: in the case of IPv6, routing rules are added when the + * forward mode is NAT. This is because IPv6 has no NAT. + */ + + if (network->def->forward.type == VIR_NETWORK_FORWARD_NAT) { + if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET)) + return networkAddMasqueradingFirewallRules(network, ipdef); + else if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET6)) + return networkAddRoutingFirewallRules(network, ipdef); + } else if (network->def->forward.type == VIR_NETWORK_FORWARD_ROUTE) { + return networkAddRoutingFirewallRules(network, ipdef); + } + return 0; +} + +void networkRemoveIpSpecificFirewallRules(virNetworkObjPtr network, + virNetworkIpDefPtr ipdef) +{ + if (network->def->forward.type == VIR_NETWORK_FORWARD_NAT) { + if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET)) + networkRemoveMasqueradingFirewallRules(network, ipdef); + else if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET6)) + networkRemoveRoutingFirewallRules(network, ipdef); + } else if (network->def->forward.type == VIR_NETWORK_FORWARD_ROUTE) { + networkRemoveRoutingFirewallRules(network, ipdef); + } +} + +/* Add all rules for all ip addresses (and general rules) on a network */ +int networkAddFirewallRules(virNetworkObjPtr network) +{ + size_t i, j; + virNetworkIpDefPtr ipdef; + virErrorPtr orig_error; + + /* Add "once per network" rules */ + if (networkAddGeneralFirewallRules(network) < 0) + return -1; + + for (i = 0; + (ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, i)); + i++) { + /* Add address-specific iptables rules */ + if (networkAddIpSpecificFirewallRules(network, ipdef) < 0) { + goto err; + } + } + return 0; + +err: + /* store the previous error message before attempting removal of rules */ + orig_error = virSaveLastError(); + + /* The final failed call to networkAddIpSpecificFirewallRules will + * have removed any rules it created, but we need to remove those + * added for previous IP addresses. + */ + for (j = 0; j < i; j++) { + if ((ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, j))) + networkRemoveIpSpecificFirewallRules(network, ipdef); + } + networkRemoveGeneralFirewallRules(network); + + /* return the original error */ + virSetError(orig_error); + virFreeError(orig_error); + return -1; +} + +/* Remove all rules for all ip addresses (and general rules) on a network */ +void networkRemoveFirewallRules(virNetworkObjPtr network) +{ + size_t i; + virNetworkIpDefPtr ipdef; + + for (i = 0; + (ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, i)); + i++) { + networkRemoveIpSpecificFirewallRules(network, ipdef); + } + networkRemoveGeneralFirewallRules(network); +} diff --git a/src/network/bridge_driver_nop.c b/src/network/bridge_driver_nop.c new file mode 100644 index 0000000..f983402 --- /dev/null +++ b/src/network/bridge_driver_nop.c @@ -0,0 +1,78 @@ +/* + * Copyright (C) 2006-2013 Red Hat, Inc. + * Copyright (C) 2006 Daniel P. Berrange + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + * + * Author: Daniel P. Berrange <berrange(a)redhat.com> + */ + +#include <config.h> + +int networkCheckRouteCollision(virNetworkObjPtr network) +{ + return 0; +} + +int networkAddMasqueradingFirewallRules(virNetworkObjPtr network ATTRIBUTE_UNUSED, + virNetworkIpDefPtr ipdef ATTRIBUTE_UNUSED) +{ + return 0; +} + +void networkRemoveMasqueradingFirewallRules(virNetworkObjPtr network ATTRIBUTE_UNUSED, + virNetworkIpDefPtr ipdef ATTRIBUTE_UNUSED) +{ +} + +int networkAddRoutingFirewallRules(virNetworkObjPtr network ATTRIBUTE_UNUSED, + virNetworkIpDefPtr ipdef ATTRIBUTE_UNUSED) +{ + return 0; +} + +void networkRemoveRoutingFirewallRules(virNetworkObjPtr network ATTRIBUTE_UNUSED, + virNetworkIpDefPtr ipdef ATTRIBUTE_UNUSED) +{ +} + +int networkAddGeneralFirewallRules(virNetworkObjPtr network ATTRIBUTE_UNUSED) +{ + return 0; +} + +void networkRemoveGeneralFirewallRules(virNetworkObjPtr network ATTRIBUTE_UNUSED) +{ +} + +int networkAddIpSpecificFirewallRules(virNetworkObjPtr network ATTRIBUTE_UNUSED, + virNetworkIpDefPtr ipdef ATTRIBUTE_UNUSED) +{ + return 0; +} + +void networkRemoveIpSpecificFirewallRules(virNetworkObjPtr network ATTRIBUTE_UNUSED, + virNetworkIpDefPtr ipdef ATTRIBUTE_UNUSED) +{ +} + +int networkAddFirewallRules(virNetworkObjPtr network ATTRIBUTE_UNUSED) +{ + return 0; +} + +void networkRemoveFirewallRules(virNetworkObjPtr network ATTRIBUTE_UNUSED) +{ +} diff --git a/src/network/bridge_driver_platform.c b/src/network/bridge_driver_platform.c new file mode 100644 index 0000000..1d2fc02 --- /dev/null +++ b/src/network/bridge_driver_platform.c @@ -0,0 +1,32 @@ +/* + * bridge_driver_platform.c: platform specific part of bridge driver + * + * Copyright (C) 2006-2013 Red Hat, Inc. + * Copyright (C) 2006 Daniel P. Berrange + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + * + * Author: Daniel P. Berrange <berrange(a)redhat.com> + */ + +#include <config.h> + +#include "bridge_driver_platform.h" + +#if defined(__linux__) +# include "bridge_driver_linux.c" +#else +# include "bridge_driver_nop.c" +#endif diff --git a/po/POTFILES.in b/po/POTFILES.in index 1fd84af..24b32db 100644 --- a/po/POTFILES.in +++ b/po/POTFILES.in @@ -70,6 +70,7 @@ src/lxc/lxc_process.c src/libxl/libxl_driver.c src/libxl/libxl_conf.c src/network/bridge_driver.c +src/network/bridge_driver_linux.c src/node_device/node_device_driver.c src/node_device/node_device_hal.c src/node_device/node_device_linux_sysfs.c diff --git a/src/Makefile.am b/src/Makefile.am index 84372cb..80309fa 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -725,8 +725,9 @@ PARALLELS_DRIVER_SOURCES = \ parallels/parallels_storage.c \ parallels/parallels_network.c -NETWORK_DRIVER_SOURCES = \ - network/bridge_driver.h network/bridge_driver.c +NETWORK_DRIVER_SOURCES = \ + network/bridge_driver.h network/bridge_driver.c \ + network/bridge_driver_platform.h network/bridge_driver_platform.c INTERFACE_DRIVER_SOURCES = -- 1.7.9.5

2 2

[libvirt] [PATCH 0/2] Coverity/Valgrind issues
by John Ferlan 01 Aug '13

01 Aug '13

One new Coverity defect was discovered from existing code in this mornings run. Also recent changes seem to have adjusted tests and provoked valgrind to find/display potential leaks. That path had already been vetted previously in a shorter stack trace - just adjust the trace to allow inclusion of more traces. John Ferlan (2): tests: Coverity found new NULL_RETURNS valgrind: Adjust filter for _dl_allocate_tls tests/.valgrind.supp | 6 ++++-- tests/jsontest.c | 8 +++++++- 2 files changed, 11 insertions(+), 3 deletions(-) -- 1.8.1.4

2 5

[libvirt] Libvirt not getting connected to ESX server
by varun bhatnagar 01 Aug '13

01 Aug '13

Hi, I was trying to connect to ESX server using libvirt's virsh console but I am getting the following error: *virsh# connect esx://172.16.73.14* *Enter username for 172.16.73.14 [root]: root* *Enter root's password for 172.16.73.14:* *error: Failed to connect to the hypervisor* *error: internal error curl_easy_perform() returned an error: Peer certificate cannot be authenticated with known CA certificates (60) : SSL certificate problem, verify that the CA cert is OK. Details:* *error: 14090086:SSL routine:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed.* * * Can anyone please help me out with this one and tell me how to resolve this error? Regards, Varun

1 0

[libvirt] [PATCH 00/20] tests: add qemu agent test
by Peter Krempa 01 Aug '13

01 Aug '13

As promised earlier I'm sending a unit test for guest agent interaction. This series contains a few refactors and additions of monitor test utils and then add tests for all agent interaction functions. The refactors done in this series will allow to do a more thorough testing on the json monitor too. The small drawback of this test suite is a 6 second run time introduced to test timeout of a guest agent command. The test may be removed in case it's too much. Peter Krempa (20): conf: Export virDomainChrSourceDefClear() qemu_agent: Output newline at the end of the sync JSON message qemu_agent: Move updater function for VCPU hotplug into qemu_agent.c qemu_agent: Remove obvious comments qemumonitortestutils: Use consistent header style and line spacing qemumonitortestutils: Use VIR_DELETE_ELEMENT and VIR_APPEND_ELEMENT qemumonitortestutils: remove multiline function calls qemumonitortestutils: Don't crash on non fully initialized test qemumonitortestutils: Split up creation of the test to allow reuse qemumonitortestutils: Refactor the test helpers to allow reuse qemumonitortestutils: Split lines on \n instead of \r\n qemumonitortestutils: Add instrumentation for guest agent testing qemumonitortestutils: Improve error reporting from mock qemu monitor qemumonitortestutils: Add the ability to check arguments of commands tests: Add qemuagenttest qemuagenttest: Test the filesystem trimming qemuagenttest: Add testing of agent suspend modes qemuagenttest: Introduce testing of shutdown commands qemuagenttest: Test arbitrary qemu commands and timeouting of commands qemuagenttest: Add tests for CPU plug functions and helpers .gitignore | 1 + src/conf/domain_conf.c | 2 +- src/conf/domain_conf.h | 2 + src/libvirt_private.syms | 1 + src/qemu/qemu_agent.c | 73 ++++- src/qemu/qemu_agent.h | 3 + src/qemu/qemu_driver.c | 64 +--- tests/Makefile.am | 11 +- tests/qemuagenttest.c | 580 ++++++++++++++++++++++++++++++++++++ tests/qemumonitortestutils.c | 684 +++++++++++++++++++++++++++++++++---------- tests/qemumonitortestutils.h | 39 ++- 11 files changed, 1231 insertions(+), 229 deletions(-) create mode 100644 tests/qemuagenttest.c -- 1.8.3.2

4 52

[libvirt] [PATCH 0/2] add VIR_TEST_EXPENSIVE for faster 'make check' by default
by Eric Blake 01 Aug '13

01 Aug '13

Based on discussion of Peter's recent test additions, and whether we should sleep waiting for a timeout by default. I did _not_ wire up the use of VIR_TEST_EXPENSIVE as a way to bypass Peter's sleep test, although I can help with that as needed (although in Peter's case, it may be simpler to just getenv("VIR_TEST_EXPENSIVE") inside the C code, instead of trying to hack tests/Makefile.am to be conditional). Tested with 'make distcheck' in both in-tree and VPATH builds (which also the configure defaults when unpacking a tarball), and in setups where I explicitly used --enable-gnulib-tests or --disable-gnulib-tests, vs. running 'make check VIR_TEST_EXPENSIVE=1'; in all cases, the gnulib tests were skipped only when expected. Patch 1/2 is something I noticed on the side (basically side work from my first approach to compile out the directory at configure time, but that approach failed 'make check'); patch 2/2 can be applied independently, and this is only a series because both patches touch configure. I realized (only now that I am sending this patch) that my patch is one-way: you can turn on expensive tests (either at configure time or at runtime) but can't turn them off. Automake was able to have 'make V=0' and 'make V=1' override configure defaults in both directions by using nested make expansion, so if it is deemed necessary, I could respin to try that approach instead of the approach I used here, where an explicit VIR_TEST_EXPENSIVE=0 would then disable the tests regardless of the choice made during configure. On the other hand, having only a one-way road for turning on tests, with no counterpart for turning them off, seems adequate. I'm also open to bikeshedding, such as whether the configure options should be named --enable-expensive-tests instead of --enable-gnulib-tests, on the grounds that we might want to make tests/Makefile.am conditional after all. Eric Blake (2): maint: use modern autoconf idioms build: add configure option to disable gnulib tests HACKING | 9 ++++++++ autobuild.sh | 3 +++ bootstrap.conf | 3 ++- configure.ac | 60 ++++++++++++++++++++++++++++++++---------------- docs/hacking.html.in | 13 +++++++++++ gnulib/tests/Makefile.am | 13 ++++++++++- libvirt.spec.in | 1 + mingw-libvirt.spec.in | 4 ++-- 8 files changed, 82 insertions(+), 24 deletions(-) -- 1.8.3.1

2 6

[libvirt] ANNOUNCE: libvirt-sandbox "Sahara Desert" release 0.5.0
by Daniel P. Berrange 01 Aug '13

01 Aug '13

I pleased to announce the a new public release of libvirt-sandbox, version 0.5.0, is now available for download ftp://libvirt.org/libvirt/sandbox/ The packages are GPG signed with Key fingerprint: DAF3 A6FD B26B 6291 2D0E 8E3F BE86 EBB4 1510 4FDF (4096R) The libvirt-sandbox package provides an API layer on top of libvirt-gobject which facilitates the cration of application sandboxes using virtualization technology. An application sandbox is a virtual machine or container that runs a single application binary, directly from the host OS filesystem. In other words there is no separate guest operating system install to build or manager. At this point in time libvirt-sandbox can create sandboxes using either LXC or KVM, and should in theory be extendable to any libvirt driver. This release has focused entirely on improving the virt-sandbox-service tool This release focused on major feature development. Changed in this release: - Switch to use persistent libvirt configuration files for service sandboxes - Store service configs in /etc/libvirt-sandbox/services/$NAME/ instead of /etc/libvirt-sandbox/services/$NAME.sandbox to allow storage of multiple files per sandbox - Add a new 'virt-sandbox-service upgrade NAME' command, to be run by admin for all existing service sandboxes to upgrade their configuration to be compatible with the new release - Remove start, stop, list commands from virt-sandbox-service, with recomendation to use start, destroy & list commands in virsh instead. - Remove duplicate -u option in man page - Update man page examples - Stop generating a UNIT_sandbox.target unit, instead letting the sandbox unit tie into multi-user.target as normal - Remove unimplemented APIs for graphical sandboxes, to be re-added at a later date when actually functional - Add padding to public structs, to facilitate preservation of public ABI compatibility in future - Add note about default libvirt URIs in man page - Fix cloning of sandboxes Thanks to everyone who contributed to this release Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|

1 0

[libvirt] [PATCHv2 0/5] Handling of undefine and redefine snapshots with VirtualBox 4.2
by Manuel VIVES 01 Aug '13

01 Aug '13

Hi, This is a serie of patches in order to support undefining and redefining snapshots with VirtualBox 4.2. The serie of patches is rather big, and adds among other things some utility functions unrelated to VirtualBox in patches 1 & 2. The code review could be done in several parts: e.g. patches 1 & 2 separately to validate the utility functions. This 2nd version brings a different function for string replacement, because of the license problem with the first one. The VirtualBox API provides only high level operations to manipulate snapshots, so it not possible to support flags like VIR_DOMAIN_SNAPSHOT_CREATE_REDEFINE and VIR_DOMAIN_SNAPSHOT_DELETE_METADATA_ONLY with only API calls. Following an IRC talk with Eric Blake, the decision was taken to emulate these behaviours by manipulating directly the .vbox XML files. The first two patches are some util methods for handling uuid and strings that will be used after. The third patch brings more details in the snapshot XML returned by libvirt. We will need those modifications in order to redefine the snapshots. The fourth patch brings the support of the VIR_DOMAIN_SNAPSHOT_CREATE_REDEFINE and VIR_DOMAIN_SNAPSHOT_CREATE_CURRENT flags in virDomainSnapshotCreateXML. The fifth and last patch brings the support of the VIR_DOMAIN_SNAPSHOT_DELETE_METADATA_ONLY flag in virDomainSnapshotDelete. The patches are only for Virtualbox 4.2 Regards, Manuel VIVES Manuel VIVES (5): viruuid.h/c: Util method for finding uuid patterns in some strings virstring.h/c: Util method for making some find and replace in strings vbox_tmpl.c: Better XML description for snapshots vbox_tmpl.c: Patch for redefining snapshots vbox_tmpl.c: Add methods for undefining snapshots src/conf/domain_conf.c | 20 +- src/libvirt_private.syms | 2 + src/util/virstring.c | 48 ++ src/util/virstring.h | 2 + src/util/viruuid.c | 79 ++ src/util/viruuid.h | 1 + src/vbox/vbox_tmpl.c | 1842 +++++++++++++++++++++++++++++++++++++++++++--- 7 files changed, 1873 insertions(+), 121 deletions(-) -- 1.7.10.4

1 5

Re: [libvirt] [PATCH] Fix test case qemuagenttest compilation.
by Jincheng Miao 01 Aug '13

01 Aug '13

Sorry about uploading a large attachment. And the build log link is: https://app.box.com/s/gbjihylb3gvvh89xbn5m ----- Original Message ----- From: "Jincheng Miao" <jmiao(a)redhat.com> To: "Eric Blake" <eblake(a)redhat.com> Cc: libvir-list(a)redhat.com Sent: Thursday, August 1, 2013 4:03:29 PM Subject: Re: [libvirt] [PATCH] Fix test case qemuagenttest compilation. hi Eric, Bad luck, I test qemuagenttest build in rhel7.0, no error like this. Maybe it is a good new to libvirt. And the gcc version is: # rpm -q gcc libtool gcc-4.8.0-2.el7.x86_64 libtool-2.4.2-14.el7.x86_64 And its compile cmdline likes: gcc -std=gnu99 -Dabs_builddir=\"/root/software/libvirt/tests\" -I/usr/include/libxml2 -I/usr/include/p11-kit-1 -DGCRYPT_NO_DEPRECATED -W -Waddress -Waggressive-loop-optimizations -Wall -Warray-bounds -Wattributes -Wbad-function-cast -Wbuiltin-macro-redefined -Wcast-align -Wchar-subscripts -Wclobbered -Wcomment -Wcomments -Wcoverage-mismatch -Wcpp -Wdeprecated-declarations -Wdisabled-optimization -Wdiv-by-zero -Wdouble-promotion -Wempty-body -Wendif-labels -Wextra -Wformat-contains-nul -Wformat-extra-args -Wformat-security -Wformat-y2k -Wformat-zero-length -Wfree-nonheap-object -Wignored-qualifiers -Wimplicit -Wimplicit-function-declaration -Wimplicit-int -Winit-self -Winline -Wint-to-pointer-cast -Winvalid-memory-model -Winvalid-pch -Wjump-misses-init -Wlogical-op -Wmain -Wmaybe-uninitialized -Wmissing-braces -Wmissing-declarations -Wmissing-field-initializers -Wmissing-include-dirs -Wmissing-parameter-type -Wmissing-prototypes -Wmudflap -Wmultichar -Wnarrowing -Wnested-externs -Wnonnull -Wnormalized=nfc -Wold-style-declaration -Wold-style-definition -Woverflow -Woverride-init -Wpacked-bitfield-compat -Wparentheses -Wpointer-arith -Wpointer-sign -Wpointer-to-int-cast -Wpragmas -Wreturn-local-addr -Wreturn-type -Wsequence-point -Wshadow -Wsizeof-pointer-memaccess -Wstrict-aliasing -Wstrict-prototypes -Wsuggest-attribute=const -Wsuggest-attribute=format -Wsuggest-attribute=noreturn -Wsuggest-attribute=pure -Wswitch -Wsync-nand -Wtrampolines -Wtrigraphs -Wtype-limits -Wuninitialized -Wunknown-pragmas -Wunused -Wunused-but-set-parameter -Wunused-but-set-variable -Wunused-function -Wunused-label -Wunused-local-typedefs -Wunused-parameter -Wunused-result -Wunused-value -Wunused-variable -Wvarargs -Wvariadic-macros -Wvector-operation-performance -Wvolatile-register-var -Wwrite-strings -Wno-sign-compare -Wjump-misses-init -Wno-format-nonliteral -Wframe-larger-than=4096 -fstack-protector-all --param=ssp-buffer-size=4 -Wno-unused-command-line-argument -fexceptions -fasynchronous-unwind-tables -fdiagnostics-show-option -funit-at-a-time -fipa-pure-const -Wno-suggest-attribute=pure -Wno-suggest-attribute=const -Werror -g2 -O0 -o .libs/qemuagenttest qemuagenttest.o testutils.o testutilsqemu.o ../src/libvirt_qemu_probes.o ../src/libvirt_probes.o -g2 -O0 ../src/.libs/libvirt_driver_qemu_impl.a ../src/.libs/libvirt_driver_network_impl.a ../src/.libs/libvirt.so -L/lib64 -lcap-ng -lyajl -lnl-route-3 -lnl-3 -laudit -ldevmapper -lxml2 -lnuma -lavahi-common -lavahi-client -ldbus-1 -lgnutls -lgcrypt -lsasl2 -lssh2 -lcurl -lselinux ../gnulib/lib/.libs/libgnu.a -lpthread -lutil ./.libs/libqemumonitortestutils.a -ldl -Wl,-rpath -Wl,/root/software/libvirt-inst/lib But error in my fedora 19, the cmdline likes: gcc -std=gnu99 -Dabs_builddir=\"/home/ryan/libvirt/tests\" -I/usr/include/libxml2 -W -Waddress -Waggressive-loop-optimizations -Wall -Warray-bounds -Wattributes -Wbad-function-cast -Wbuiltin-macro-redefined -Wcast-align -Wchar-subscripts -Wclobbered -Wcomment -Wcomments -Wcoverage-mismatch -Wcpp -Wdeprecated-declarations -Wdisabled-optimization -Wdiv-by-zero -Wdouble-promotion -Wempty-body -Wendif-labels -Wextra -Wformat-contains-nul -Wformat-extra-args -Wformat-security -Wformat-y2k -Wformat-zero-length -Wfree-nonheap-object -Wignored-qualifiers -Wimplicit -Wimplicit-function-declaration -Wimplicit-int -Winit-self -Winline -Wint-to-pointer-cast -Winvalid-memory-model -Winvalid-pch -Wjump-misses-init -Wlogical-op -Wmain -Wmaybe-uninitialized -Wmissing-braces -Wmissing-declarations -Wmissing-field-initializers -Wmissing-include-dirs -Wmissing-parameter-type -Wmissing-prototypes -Wmudflap -Wmultichar -Wnarrowing -Wnested-externs -Wnonnull -Wnormalized=nfc -Wold-style-declaration -Wold-style-definition -Woverflow -Woverride-init -Wpacked-bitfield-compat -Wparentheses -Wpointer-arith -Wpointer-sign -Wpointer-to-int-cast -Wpragmas -Wreturn-local-addr -Wreturn-type -Wsequence-point -Wshadow -Wsizeof-pointer-memaccess -Wstrict-aliasing -Wstrict-prototypes -Wsuggest-attribute=const -Wsuggest-attribute=format -Wsuggest-attribute=noreturn -Wsuggest-attribute=pure -Wswitch -Wsync-nand -Wtrampolines -Wtrigraphs -Wtype-limits -Wuninitialized -Wunknown-pragmas -Wunused -Wunused-but-set-parameter -Wunused-but-set-variable -Wunused-function -Wunused-label -Wunused-local-typedefs -Wunused-parameter -Wunused-result -Wunused-value -Wunused-variable -Wvarargs -Wvariadic-macros -Wvector-operation-performance -Wvolatile-register-var -Wwrite-strings -Wno-sign-compare -Wjump-misses-init -Wno-format-nonliteral -Wframe-larger-than=4096 -fstack-protector-all --param=ssp-buffer-size=4 -Wno-unused-command-line-argument -fexceptions -fasynchronous-unwind-tables -fdiagnostics-show-option -funit-at-a-time -fipa-pure-const -Wno-suggest-attribute=pure -Wno-suggest-attribute=const -Werror -g2 -O0 -o .libs/qemuagenttest qemuagenttest.o testutils.o testutilsqemu.o ../src/.libs/libvirt_driver_qemu_impl.a ../src/.libs/libvirt_driver_network_impl.a ../src/.libs/libvirt.so -lnl -ldevmapper -lxml2 -lselinux ../gnulib/lib/.libs/libgnu.a -lpthread -lutil ./.libs/libqemumonitortestutils.a -ldl -Wl,-rpath -Wl,/root/software/libvirt-inst/lib And the attachment is the build log in my fedora 19. So why cause this? ----- Original Message ----- From: "Jincheng Miao" <jmiao(a)redhat.com> To: "Eric Blake" <eblake(a)redhat.com> Cc: libvir-list(a)redhat.com Sent: Thursday, August 1, 2013 11:50:18 AM Subject: Re: [libvirt] [PATCH] Fix test case qemuagenttest compilation. On 08/01/2013 05:48 AM, Eric Blake wrote: >> When compiling qemuagenttest, a link error occurs like: >> ./.libs/libqemumonitortestutils.a(qemumonitortestutils.o): In function `qemuMonitorTestFree': >> libvirt/tests/qemumonitortestutils.c:346: undefined reference to `qemuMonitorClose' >> ./.libs/libqemumonitortestutils.a(qemumonitortestutils.o): In function `qemuMonitorTestNew': >> libvirt/tests/qemumonitortestutils.c:870: undefined reference to `qemuMonitorOpen' >> collect2: error: ld returned 1 exit status > > What platform was this on? Some distros are set up to be tolerant of > lazy resolution, which masks issues like this (hence, I'm _not_ seeing > this error on Fedora). Actually I am using fedora 19 too. And the toolchain is: gcc-4.8.1-1.fc19.x86_64 libtool-2.4.2-16.fc19.x86_64 >> >> And I checked this error, it caused by the position of >> libqemumonitortestutils.a in gcc arguments. >> >> If libqemumonitortestutils.a before libvirt_driver_qemu_impl.a >> and libvirt_driver_network_impl.a, the compilation passed. >> Otherwise, failed. >> >> I think this should be a gcc's bug, but nevermind, >> just fix it in libvirt. > > No, it's not a bug in gcc, but an actual bug in libvirt. If you can't > rely on lazy resolution (such as on platforms like mingw, except that > mingw doesn't build qemumonitortestutils in the first place), then > libraries MUST be listed in the order in which later libraries satisfy > symbols used by earlier libraries. How do I check whether I am relying on lazy link? > > ACK, although I'd like to touch up your commit message (and in > particular mention the platform where this matters) before pushing. > > -- libvir-list mailing list libvir-list(a)redhat.com https://www.redhat.com/mailman/listinfo/libvir-list

1 0

[libvirt] [PATCH v2 0/3] ensure diskchain is not broken on guest bootup
by Guannan Ren 01 Aug '13

01 Aug '13

v1->v2: Add a helper function qemuDiskChainCheckBroken to check diskchain after invoking qemuDomainDetermineDiskChain() This patchset try to check whether the diskchain is broken or not when domain boot up. If dischain is broken, report like: virsh start rhel6qcow2 error: Failed to start domain rhel6qcow2 error: invalid argument: Backing file '/var/lib/libvirt/images/thirddisk' of \ image '/var/lib/libvirt/images/thirddisk.snap3' is missing. For storage pool, it still can list volumes out even if their diskchain is broken Guannan Ren(3) qemu: refactor qemuDomainCheckDiskPresence for only disk presence check qemu: add helper functions for diskchain checking qemu: check presence of each disk and its backing file as well src/libvirt_private.syms | 1 + src/qemu/qemu_domain.c | 133 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++----------------------------- src/qemu/qemu_domain.h | 3 ++ src/qemu/qemu_process.c | 6 ---- src/util/virstoragefile.c | 47 +++++++++++++++++++++++++++++++ src/util/virstoragefile.h | 2 ++ 6 files changed, 141 insertions(+), 51 deletions(-)

2 14

[libvirt] [PATCH] Configuring systemd to restart libvirt on abort
by Mooli Tayer 01 Aug '13

01 Aug '13

From: Mooli Tayer <mtayer(a)redhat.com> This will create a respawn behaviour in case libvirt process exits due to an uncaught signal not specified as a clean exit status. see http://www.freedesktop.org/software/systemd/man/systemd.service.html --- daemon/libvirtd.service.in | 1 + 1 file changed, 1 insertion(+) diff --git a/daemon/libvirtd.service.in b/daemon/libvirtd.service.in index aa5913b..b3c0849 100644 --- a/daemon/libvirtd.service.in +++ b/daemon/libvirtd.service.in @@ -15,6 +15,7 @@ EnvironmentFile=-/etc/sysconfig/libvirtd ExecStart=@sbindir@/libvirtd $LIBVIRTD_ARGS ExecReload=/bin/kill -HUP $MAINPID KillMode=process +Restart=on-abort # Override the maximum number of opened files #LimitNOFILE=2048 -- 1.8.3.1

5 6

[libvirt] [PATCH] xen: Avoid double free of virDomainDef in xenDaemonCreateXML
by Stefan Bader 01 Aug '13

01 Aug '13

Beside dumpxml still being broken with the xen driver (hint [1] ;) ) there is also a quite annoying problem of creating new definitions now failing. Using virt-manager this even disrupts the connection to the host and the guest is not created persistent although it does come up. -Stefan [1] https://www.redhat.com/archives/libvir-list/2013-July/msg01183.html >From 0e90fac9004996a6517ce1bd4d7b9c6ebef6c45c Mon Sep 17 00:00:00 2001 From: Stefan Bader <stefan.bader(a)canonical.com> Date: Tue, 30 Jul 2013 20:48:33 +0200 Subject: [PATCH] xen: Avoid double free of virDomainDef in xenDaemonCreateXML The virDomainDef is allocated by the caller and also used after calling to xenDaemonCreateXML. So it must not get freed by the callee. Signed-off-by: Stefan Bader <stefan.bader(a)canonical.com> --- src/xen/xend_internal.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/xen/xend_internal.c b/src/xen/xend_internal.c index 9d61fca..1ce36e6 100644 --- a/src/xen/xend_internal.c +++ b/src/xen/xend_internal.c @@ -2171,7 +2171,6 @@ xenDaemonCreateXML(virConnectPtr conn, virDomainDefPtr def) if (xenDaemonDomainResume(conn, def) < 0) goto error; - virDomainDefFree(def); return 0; error: -- 1.8.1.2

2 1

[libvirt] [PATCH] Don't mark parentIndex with ATTRIBUTE_UNUSED
by Ján Tomko 31 Jul '13

31 Jul '13

parentIndex is used in virNetworkDefUpdateIPDHCPRange --- Pushed as trivial. src/conf/network_conf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c index b903df9..e3998f3 100644 --- a/src/conf/network_conf.c +++ b/src/conf/network_conf.c @@ -3416,15 +3416,15 @@ cleanup: virNetworkDHCPHostDefClear(&host); return ret; } static int virNetworkDefUpdateIPDHCPRange(virNetworkDefPtr def, unsigned int command, - int parentIndex ATTRIBUTE_UNUSED, + int parentIndex, xmlXPathContextPtr ctxt, /* virNetworkUpdateFlags */ unsigned int fflags ATTRIBUTE_UNUSED) { size_t i; int ret = -1; virNetworkIpDefPtr ipdef = virNetworkIpDefByIndex(def, parentIndex); -- 1.8.1.5

1 0

[libvirt] [PATCH] Remove VIR_DOMAIN_SHUTDOWN_CRASHED from public API
by Daniel P. Berrange 31 Jul '13

31 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> The VIR_DOMAIN_SHUTDOWN_CRASHED state constant does not appear to be used in the QEMU code anyway. It also doesn't make much (any) sense, since the 'shutdown' state is a transient state between 'running' and 'shutoff' which is only used by the Xen driver. It was added in commit 14e7e0ae8db9843aea80245a3d9e6cf5f2ef720d which post-dates v1.1.0, so is safe to remove before 1.1.1 Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- include/libvirt/libvirt.h.in | 1 - src/conf/domain_conf.c | 3 +-- tools/virsh-domain-monitor.c | 2 -- 3 files changed, 1 insertion(+), 5 deletions(-) diff --git a/include/libvirt/libvirt.h.in b/include/libvirt/libvirt.h.in index c0eb25b..4eae7bf 100644 --- a/include/libvirt/libvirt.h.in +++ b/include/libvirt/libvirt.h.in @@ -191,7 +191,6 @@ typedef enum { typedef enum { VIR_DOMAIN_SHUTDOWN_UNKNOWN = 0, /* the reason is unknown */ VIR_DOMAIN_SHUTDOWN_USER = 1, /* shutting down on user request */ - VIR_DOMAIN_SHUTDOWN_CRASHED = 2, /* domain crashed */ #ifdef VIR_ENUM_SENTINELS VIR_DOMAIN_SHUTDOWN_LAST diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index a86be8c..783df96 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -667,8 +667,7 @@ VIR_ENUM_IMPL(virDomainPausedReason, VIR_DOMAIN_PAUSED_LAST, VIR_ENUM_IMPL(virDomainShutdownReason, VIR_DOMAIN_SHUTDOWN_LAST, "unknown", - "user", - "crashed") + "user") VIR_ENUM_IMPL(virDomainShutoffReason, VIR_DOMAIN_SHUTOFF_LAST, "unknown", diff --git a/tools/virsh-domain-monitor.c b/tools/virsh-domain-monitor.c index 773f96d..98fe7fe 100644 --- a/tools/virsh-domain-monitor.c +++ b/tools/virsh-domain-monitor.c @@ -240,8 +240,6 @@ vshDomainStateReasonToString(int state, int reason) switch ((virDomainShutdownReason) reason) { case VIR_DOMAIN_SHUTDOWN_USER: return N_("user"); - case VIR_DOMAIN_SHUTDOWN_CRASHED: - return N_("crashed"); case VIR_DOMAIN_SHUTDOWN_UNKNOWN: case VIR_DOMAIN_SHUTDOWN_LAST: ; -- 1.8.1.4

4 3

[libvirt] [PATCH] Rename VIR_DOMAIN_PAUSED_GUEST_PANICKED to VIR_DOMAIN_PAUSED_CRASHED
by Daniel P. Berrange 31 Jul '13

31 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> The VIR_DOMAIN_PAUSED_GUEST_PANICKED constant is badly named, leaking the QEMU event name. Elsewhere in the API we use 'CRASHED' rather than 'PANICKED', and the addition of 'GUEST' is redundant since all events are guest related. Thus rename it to VIR_DOMAIN_PAUSED_CRASHED, which matches with VIR_DOMAIN_RUNNING_CRASHED and VIR_DOMAIN_EVENT_CRASHED. It was added in commit 14e7e0ae8db9843aea80245a3d9e6cf5f2ef720d which post-dates v1.1.0, so is safe to rename before 1.1.1 Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- include/libvirt/libvirt.h.in | 2 +- src/qemu/qemu_monitor.c | 2 +- src/qemu/qemu_process.c | 2 +- tools/virsh-domain-monitor.c | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/include/libvirt/libvirt.h.in b/include/libvirt/libvirt.h.in index 4eae7bf..7bd3559 100644 --- a/include/libvirt/libvirt.h.in +++ b/include/libvirt/libvirt.h.in @@ -181,7 +181,7 @@ typedef enum { VIR_DOMAIN_PAUSED_FROM_SNAPSHOT = 7, /* paused after restoring from snapshot */ VIR_DOMAIN_PAUSED_SHUTTING_DOWN = 8, /* paused during shutdown process */ VIR_DOMAIN_PAUSED_SNAPSHOT = 9, /* paused while creating a snapshot */ - VIR_DOMAIN_PAUSED_GUEST_PANICKED = 10, /* paused due to a guest panicked event */ + VIR_DOMAIN_PAUSED_CRASHED = 10, /* paused due to a guest crash */ #ifdef VIR_ENUM_SENTINELS VIR_DOMAIN_PAUSED_LAST diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index 0b73411..5b2fb04 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -3335,7 +3335,7 @@ int qemuMonitorVMStatusToPausedReason(const char *status) return VIR_DOMAIN_PAUSED_WATCHDOG; case QEMU_MONITOR_VM_STATUS_GUEST_PANICKED: - return VIR_DOMAIN_PAUSED_GUEST_PANICKED; + return VIR_DOMAIN_PAUSED_CRASHED; /* unreachable from this point on */ case QEMU_MONITOR_VM_STATUS_LAST: diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index e8e459e..d631a6f 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -2724,7 +2724,7 @@ qemuProcessUpdateState(virQEMUDriverPtr driver, virDomainObjPtr vm) newState = VIR_DOMAIN_SHUTDOWN; newReason = VIR_DOMAIN_SHUTDOWN_UNKNOWN; ignore_value(VIR_STRDUP_QUIET(msg, "shutdown")); - } else if (reason == VIR_DOMAIN_PAUSED_GUEST_PANICKED) { + } else if (reason == VIR_DOMAIN_PAUSED_CRASHED) { newState = VIR_DOMAIN_CRASHED; newReason = VIR_DOMAIN_CRASHED_PANICKED; ignore_value(VIR_STRDUP_QUIET(msg, "crashed")); diff --git a/tools/virsh-domain-monitor.c b/tools/virsh-domain-monitor.c index 98fe7fe..b29b82a 100644 --- a/tools/virsh-domain-monitor.c +++ b/tools/virsh-domain-monitor.c @@ -228,8 +228,8 @@ vshDomainStateReasonToString(int state, int reason) return N_("shutting down"); case VIR_DOMAIN_PAUSED_SNAPSHOT: return N_("creating snapshot"); - case VIR_DOMAIN_PAUSED_GUEST_PANICKED: - return N_("guest panicked"); + case VIR_DOMAIN_PAUSED_CRASHED: + return N_("crashed"); case VIR_DOMAIN_PAUSED_UNKNOWN: case VIR_DOMAIN_PAUSED_LAST: ; -- 1.8.1.4

3 2

[libvirt] [PATCH V5] add console support in libxl
by Bamvor Jian Zhang 31 Jul '13

31 Jul '13

this patch introduce the console api in libxl driver for both pv and hvm guest. and import and update the libxlMakeChrdevStr function which was deleted in commit dfa1e1dd. Signed-off-by: Bamvor Jian Zhang <bjzhang(a)suse.com> --- Changes since V4: 1), using proper error instead of VIR_ERR_INTERNAL_ERROR. 2), treat safe as unsupported flags in libxl openConsole api. 3), some format and minor logic changes. Changes since V3: implicity forbit dev_name pass to libxl driver due to only one console supported by libxl. Changes since V2: 1), forbid parallel configure because libxl do not support it 2), only support one serial on libxl driver. 3), also remove console code in libxl driver, AFAICS serial is enough for connecting to libxl console. Changes since V1: 1), add virDomainOpenConsoleEnsureACL 3), remove virReportOOMErrorFull when virAsprintf fail. 4), change size_t for non-nagetive number in libxlDomainOpenConsole size_t i; size_t num = 0; 5), fix for make check (1), replace virAsprintf with VIR_STRDUP in two places (2), delete space. src/libxl/libxl_conf.c | 104 +++++++++++++++++++++++++++++++++++++++++++++++ src/libxl/libxl_conf.h | 3 ++ src/libxl/libxl_driver.c | 93 ++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 200 insertions(+) diff --git a/src/libxl/libxl_conf.c b/src/libxl/libxl_conf.c index 5273a26..827dfdd 100644 --- a/src/libxl/libxl_conf.c +++ b/src/libxl/libxl_conf.c @@ -331,6 +331,92 @@ error: } static int +libxlMakeChrdevStr(virDomainChrDefPtr def, char **buf) +{ + virDomainChrSourceDef srcdef = def->source; + const char *type = virDomainChrTypeToString(srcdef.type); + + if (!type) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + "%s", _("unknown chrdev type")); + return -1; + } + + switch (srcdef.type) { + case VIR_DOMAIN_CHR_TYPE_NULL: + case VIR_DOMAIN_CHR_TYPE_STDIO: + case VIR_DOMAIN_CHR_TYPE_VC: + case VIR_DOMAIN_CHR_TYPE_PTY: + if (VIR_STRDUP(*buf, type) < 0) + return -1; + break; + + case VIR_DOMAIN_CHR_TYPE_FILE: + case VIR_DOMAIN_CHR_TYPE_PIPE: + if (virAsprintf(buf, "%s:%s", type, srcdef.data.file.path) < 0) + return -1; + break; + + case VIR_DOMAIN_CHR_TYPE_DEV: + if (VIR_STRDUP(*buf, srcdef.data.file.path) < 0) + return -1; + break; + + case VIR_DOMAIN_CHR_TYPE_UDP: { + const char *connectHost = srcdef.data.udp.connectHost; + const char *bindHost = srcdef.data.udp.bindHost; + const char *bindService = srcdef.data.udp.bindService; + + if (connectHost == NULL) + connectHost = ""; + if (bindHost == NULL) + bindHost = ""; + if (bindService == NULL) + bindService = "0"; + + if (virAsprintf(buf, "udp:%s:%s@%s:%s", + connectHost, + srcdef.data.udp.connectService, + bindHost, + bindService) < 0) + return -1; + break; + } + + case VIR_DOMAIN_CHR_TYPE_TCP: { + const char *prefix; + + if (srcdef.data.tcp.protocol == VIR_DOMAIN_CHR_TCP_PROTOCOL_TELNET) + prefix = "telnet"; + else + prefix = "tcp"; + + if (virAsprintf(buf, "%s:%s:%s%s", + prefix, + srcdef.data.tcp.host, + srcdef.data.tcp.service, + srcdef.data.tcp.listen ? ",server,nowait" : "") < 0) + return -1; + break; + } + + case VIR_DOMAIN_CHR_TYPE_UNIX: + if (virAsprintf(buf, "unix:%s%s", + srcdef.data.nix.path, + srcdef.data.nix.listen ? ",server,nowait" : "") < 0) + return -1; + break; + + default: + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("unsupported chardev '%s'"), type); + return -1; + } + + return 0; +} + +static int libxlMakeDomBuildInfo(virDomainObjPtr vm, libxl_domain_config *d_config) { virDomainDefPtr def = vm->def; @@ -411,6 +497,24 @@ libxlMakeDomBuildInfo(virDomainObjPtr vm, libxl_domain_config *d_config) if (VIR_STRDUP(b_info->u.hvm.boot, bootorder) < 0) goto error; + if (def->nserials) { + if (def->nserials > 1) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + "%s", + _("Only one serial device is supported by libxl")); + goto error; + } + if (libxlMakeChrdevStr(def->serials[0], &b_info->u.hvm.serial) < 0) + goto error; + } + + if (def->nparallels) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + "%s", + _("Parallel devices are not supported by libxl")); + goto error; + } + /* * The following comment and calculation were taken directly from * libxenlight's internal function libxl_get_required_shadow_memory(): diff --git a/src/libxl/libxl_conf.h b/src/libxl/libxl_conf.h index 942cdd5..aa57710 100644 --- a/src/libxl/libxl_conf.h +++ b/src/libxl/libxl_conf.h @@ -34,6 +34,7 @@ # include "configmake.h" # include "virportallocator.h" # include "virobject.h" +# include "virchrdev.h" # define LIBXL_VNC_PORT_MIN 5900 @@ -94,6 +95,8 @@ struct _libxlDomainObjPrivate { /* per domain libxl ctx */ libxl_ctx *ctx; + /* console */ + virChrdevsPtr devs; libxl_evgen_domain_death *deathW; /* list of libxl timeout registrations */ diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index 98b1985..0d42062 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -417,6 +417,9 @@ libxlDomainObjPrivateAlloc(void) libxl_osevent_register_hooks(priv->ctx, &libxl_event_callbacks, priv); + if (!(priv->devs = virChrdevAlloc())) + return NULL; + return priv; } @@ -428,6 +431,7 @@ libxlDomainObjPrivateDispose(void *obj) if (priv->deathW) libxl_evdisable_domain_death(priv->ctx, priv->deathW); + virChrdevFree(priv->devs); libxl_ctx_free(priv->ctx); } @@ -4493,6 +4497,94 @@ cleanup: return ret; } + +static int +libxlDomainOpenConsole(virDomainPtr dom, + const char *dev_name, + virStreamPtr st, + unsigned int flags) +{ + libxlDriverPrivatePtr driver = dom->conn->privateData; + virDomainObjPtr vm = NULL; + int ret = -1; + virDomainChrDefPtr chr = NULL; + libxlDomainObjPrivatePtr priv; + char *console = NULL; + + virCheckFlags(VIR_DOMAIN_CONSOLE_FORCE, -1); + + if (dev_name) { + /* XXX support device aliases in future */ + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Named device aliases are not supported")); + goto cleanup; + } + + libxlDriverLock(driver); + vm = virDomainObjListFindByUUID(driver->domains, dom->uuid); + libxlDriverUnlock(driver); + if (!vm) { + char uuidstr[VIR_UUID_STRING_BUFLEN]; + virUUIDFormat(dom->uuid, uuidstr); + virReportError(VIR_ERR_NO_DOMAIN, + _("No domain with matching uuid '%s'"), uuidstr); + goto cleanup; + } + + if (virDomainOpenConsoleEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + + if (!virDomainObjIsActive(vm)) { + virReportError(VIR_ERR_OPERATION_INVALID, + "%s", _("domain is not running")); + goto cleanup; + } + + priv = vm->privateData; + + if (vm->def->nserials) + chr = vm->def->serials[0]; + + if (!chr) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("cannot find character device %s"), + NULLSTR(dev_name)); + goto cleanup; + } + + if (chr->source.type != VIR_DOMAIN_CHR_TYPE_PTY) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("character device %s is not using a PTY"), + NULLSTR(dev_name)); + goto cleanup; + } + + ret = libxl_primary_console_get_tty(priv->ctx, vm->def->id, &console); + if (ret) + goto cleanup; + + if (VIR_STRDUP(chr->source.data.file.path, console) < 0) + goto cleanup; + + /* handle mutually exclusive access to console devices */ + ret = virChrdevOpen(priv->devs, + &chr->source, + st, + (flags & VIR_DOMAIN_CONSOLE_FORCE) != 0); + + if (ret == 1) { + virReportError(VIR_ERR_OPERATION_FAILED, "%s", + _("Active console session exists for this domain")); + ret = -1; + } + +cleanup: + VIR_FREE(console); + if (vm) + virObjectUnlock(vm); + return ret; +} + static int libxlDomainSetSchedulerParameters(virDomainPtr dom, virTypedParameterPtr params, int nparams) @@ -4875,6 +4967,7 @@ static virDriver libxlDriver = { .domainManagedSave = libxlDomainManagedSave, /* 0.9.2 */ .domainHasManagedSaveImage = libxlDomainHasManagedSaveImage, /* 0.9.2 */ .domainManagedSaveRemove = libxlDomainManagedSaveRemove, /* 0.9.2 */ + .domainOpenConsole = libxlDomainOpenConsole, /* 1.1.2 */ .domainIsActive = libxlDomainIsActive, /* 0.9.0 */ .domainIsPersistent = libxlDomainIsPersistent, /* 0.9.0 */ .domainIsUpdated = libxlDomainIsUpdated, /* 0.9.0 */ -- 1.8.1.4

2 2

[libvirt] [PATCH] maint: fix typo for SENTINEL
by Eric Blake 30 Jul '13

30 Jul '13

* src/openvz/openvz_driver.c: Use correct spelling. * src/vmware/vmware_conf.c: Likewise. * src/vmware/vmware_conf.h: Likewise. * src/vmware/vmware_driver.c: Likewise. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the trivial rule. src/openvz/openvz_driver.c | 24 ++++++++++++------------ src/vmware/vmware_conf.c | 4 ++-- src/vmware/vmware_conf.h | 2 +- src/vmware/vmware_driver.c | 18 +++++++++--------- 4 files changed, 24 insertions(+), 24 deletions(-) diff --git a/src/openvz/openvz_driver.c b/src/openvz/openvz_driver.c index de4e4ff..d268647 100644 --- a/src/openvz/openvz_driver.c +++ b/src/openvz/openvz_driver.c @@ -564,12 +564,12 @@ cleanup: * key value. This lets us declare the argv on the * stack and just splice in the domain name after */ -#define PROGRAM_SENTINAL ((char *)0x1) +#define PROGRAM_SENTINEL ((char *)0x1) static void openvzSetProgramSentinal(const char **prog, const char *key) { const char **tmp = prog; while (tmp && *tmp) { - if (*tmp == PROGRAM_SENTINAL) { + if (*tmp == PROGRAM_SENTINEL) { *tmp = key; break; } @@ -580,7 +580,7 @@ static void openvzSetProgramSentinal(const char **prog, const char *key) static int openvzDomainSuspend(virDomainPtr dom) { struct openvz_driver *driver = dom->conn->privateData; virDomainObjPtr vm; - const char *prog[] = {VZCTL, "--quiet", "chkpnt", PROGRAM_SENTINAL, "--suspend", NULL}; + const char *prog[] = {VZCTL, "--quiet", "chkpnt", PROGRAM_SENTINEL, "--suspend", NULL}; int ret = -1; openvzDriverLock(driver); @@ -618,7 +618,7 @@ cleanup: static int openvzDomainResume(virDomainPtr dom) { struct openvz_driver *driver = dom->conn->privateData; virDomainObjPtr vm; - const char *prog[] = {VZCTL, "--quiet", "chkpnt", PROGRAM_SENTINAL, "--resume", NULL}; + const char *prog[] = {VZCTL, "--quiet", "chkpnt", PROGRAM_SENTINEL, "--resume", NULL}; int ret = -1; openvzDriverLock(driver); @@ -658,7 +658,7 @@ openvzDomainShutdownFlags(virDomainPtr dom, unsigned int flags) { struct openvz_driver *driver = dom->conn->privateData; virDomainObjPtr vm; - const char *prog[] = {VZCTL, "--quiet", "stop", PROGRAM_SENTINAL, NULL}; + const char *prog[] = {VZCTL, "--quiet", "stop", PROGRAM_SENTINEL, NULL}; int ret = -1; int status; @@ -721,7 +721,7 @@ static int openvzDomainReboot(virDomainPtr dom, { struct openvz_driver *driver = dom->conn->privateData; virDomainObjPtr vm; - const char *prog[] = {VZCTL, "--quiet", "restart", PROGRAM_SENTINAL, NULL}; + const char *prog[] = {VZCTL, "--quiet", "restart", PROGRAM_SENTINEL, NULL}; int ret = -1; int status; @@ -1041,7 +1041,7 @@ openvzDomainCreateXML(virConnectPtr conn, const char *xml, virDomainDefPtr vmdef = NULL; virDomainObjPtr vm = NULL; virDomainPtr dom = NULL; - const char *progstart[] = {VZCTL, "--quiet", "start", PROGRAM_SENTINAL, NULL}; + const char *progstart[] = {VZCTL, "--quiet", "start", PROGRAM_SENTINEL, NULL}; virCheckFlags(0, NULL); @@ -1126,7 +1126,7 @@ openvzDomainCreateWithFlags(virDomainPtr dom, unsigned int flags) { struct openvz_driver *driver = dom->conn->privateData; virDomainObjPtr vm; - const char *prog[] = {VZCTL, "--quiet", "start", PROGRAM_SENTINAL, NULL }; + const char *prog[] = {VZCTL, "--quiet", "start", PROGRAM_SENTINEL, NULL }; int ret = -1; int status; @@ -1180,7 +1180,7 @@ openvzDomainUndefineFlags(virDomainPtr dom, { struct openvz_driver *driver = dom->conn->privateData; virDomainObjPtr vm; - const char *prog[] = { VZCTL, "--quiet", "destroy", PROGRAM_SENTINAL, NULL }; + const char *prog[] = { VZCTL, "--quiet", "destroy", PROGRAM_SENTINEL, NULL }; int ret = -1; int status; @@ -1228,7 +1228,7 @@ openvzDomainSetAutostart(virDomainPtr dom, int autostart) { struct openvz_driver *driver = dom->conn->privateData; virDomainObjPtr vm; - const char *prog[] = { VZCTL, "--quiet", "set", PROGRAM_SENTINAL, + const char *prog[] = { VZCTL, "--quiet", "set", PROGRAM_SENTINEL, "--onboot", autostart ? "yes" : "no", "--save", NULL }; int ret = -1; @@ -1326,7 +1326,7 @@ static int openvzDomainSetVcpusInternal(virDomainObjPtr vm, unsigned int nvcpus) { char str_vcpus[32]; - const char *prog[] = { VZCTL, "--quiet", "set", PROGRAM_SENTINAL, + const char *prog[] = { VZCTL, "--quiet", "set", PROGRAM_SENTINEL, "--cpus", str_vcpus, "--save", NULL }; unsigned int pcpus; pcpus = openvzGetNodeCPUs(); @@ -1685,7 +1685,7 @@ openvzDomainSetMemoryInternal(virDomainObjPtr vm, unsigned long long mem) { char str_mem[16]; - const char *prog[] = { VZCTL, "--quiet", "set", PROGRAM_SENTINAL, + const char *prog[] = { VZCTL, "--quiet", "set", PROGRAM_SENTINEL, "--kmemsize", str_mem, "--save", NULL }; diff --git a/src/vmware/vmware_conf.c b/src/vmware/vmware_conf.c index 23da92d..e00c66c 100644 --- a/src/vmware/vmware_conf.c +++ b/src/vmware/vmware_conf.c @@ -205,7 +205,7 @@ vmwareSetSentinal(const char **prog, const char *key) const char **tmp = prog; while (tmp && *tmp) { - if (*tmp == PROGRAM_SENTINAL) { + if (*tmp == PROGRAM_SENTINEL) { *tmp = key; break; } @@ -392,7 +392,7 @@ int vmwareMoveFile(char *srcFile, char *dstFile) { const char *cmdmv[] = - { "mv", PROGRAM_SENTINAL, PROGRAM_SENTINAL, NULL }; + { "mv", PROGRAM_SENTINEL, PROGRAM_SENTINEL, NULL }; if (!virFileExists(srcFile)) { virReportError(VIR_ERR_INTERNAL_ERROR, _("file %s does not exist"), diff --git a/src/vmware/vmware_conf.h b/src/vmware/vmware_conf.h index cb11aca..6666eaf 100644 --- a/src/vmware/vmware_conf.h +++ b/src/vmware/vmware_conf.h @@ -28,7 +28,7 @@ # include "virthread.h" # define VIR_FROM_THIS VIR_FROM_VMWARE -# define PROGRAM_SENTINAL ((char *)0x1) +# define PROGRAM_SENTINEL ((char *)0x1) # define TYPE_PLAYER 0 # define TYPE_WORKSTATION 1 diff --git a/src/vmware/vmware_driver.c b/src/vmware/vmware_driver.c index 988552f..74591d6 100644 --- a/src/vmware/vmware_driver.c +++ b/src/vmware/vmware_driver.c @@ -252,8 +252,8 @@ vmwareStopVM(struct vmware_driver *driver, virDomainShutoffReason reason) { const char *cmd[] = { - VMRUN, "-T", PROGRAM_SENTINAL, "stop", - PROGRAM_SENTINAL, "soft", NULL + VMRUN, "-T", PROGRAM_SENTINEL, "stop", + PROGRAM_SENTINEL, "soft", NULL }; vmwareSetSentinal(cmd, vmw_types[driver->type]); @@ -273,8 +273,8 @@ static int vmwareStartVM(struct vmware_driver *driver, virDomainObjPtr vm) { const char *cmd[] = { - VMRUN, "-T", PROGRAM_SENTINAL, "start", - PROGRAM_SENTINAL, PROGRAM_SENTINAL, NULL + VMRUN, "-T", PROGRAM_SENTINEL, "start", + PROGRAM_SENTINEL, PROGRAM_SENTINEL, NULL }; const char *vmxPath = ((vmwareDomainPtr) vm->privateData)->vmxPath; @@ -446,8 +446,8 @@ vmwareDomainSuspend(virDomainPtr dom) virDomainObjPtr vm; const char *cmd[] = { - VMRUN, "-T", PROGRAM_SENTINAL, "pause", - PROGRAM_SENTINAL, NULL + VMRUN, "-T", PROGRAM_SENTINEL, "pause", + PROGRAM_SENTINEL, NULL }; int ret = -1; @@ -495,7 +495,7 @@ vmwareDomainResume(virDomainPtr dom) virDomainObjPtr vm; const char *cmd[] = { - VMRUN, "-T", PROGRAM_SENTINAL, "unpause", PROGRAM_SENTINAL, + VMRUN, "-T", PROGRAM_SENTINEL, "unpause", PROGRAM_SENTINEL, NULL }; int ret = -1; @@ -544,8 +544,8 @@ vmwareDomainReboot(virDomainPtr dom, unsigned int flags) const char * vmxPath = NULL; virDomainObjPtr vm; const char *cmd[] = { - VMRUN, "-T", PROGRAM_SENTINAL, - "reset", PROGRAM_SENTINAL, "soft", NULL + VMRUN, "-T", PROGRAM_SENTINEL, + "reset", PROGRAM_SENTINEL, "soft", NULL }; int ret = -1; -- 1.8.3.1

2 1

[libvirt] [PATCH] spec: Use --enable-werror on RHEL
by Jiri Denemark 30 Jul '13

30 Jul '13

As RHEL provides a stable tool chain, we don't have to worry about frequent changes in reported compiler warnings (which prevents us from enabling -Werror unconditionally). --- libvirt.spec.in | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/libvirt.spec.in b/libvirt.spec.in index e74f774..6d6203b 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -352,6 +352,14 @@ %endif +# RHEL releases provide stable tool chains and so it is safe to turn +# compiler warning into errors without being worried about frequent +# changes in reported warnings +%if 0%{?rhel} + %define enable_werror --enable-werror +%endif + + Summary: Library providing a simple virtualization API Name: libvirt Version: @VERSION@ @@ -1386,6 +1394,7 @@ of recent versions of Linux (and other OSes). %{with_packager_version} \ --with-qemu-user=%{qemu_user} \ --with-qemu-group=%{qemu_group} \ + %{?enable_werror} \ %{init_scripts} make %{?_smp_mflags} gzip -9 ChangeLog -- 1.8.3.2

2 2

[libvirt] [PATCH] spec: RHEL-7 does not have sanlock on i686
by Jiri Denemark 30 Jul '13

30 Jul '13

--- libvirt.spec.in | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 6236c08..e74f774 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -245,11 +245,16 @@ %if 0%{?fedora} >= 16 %define with_sanlock 0%{!?_without_sanlock:%{server_drivers}} %endif -%if 0%{?rhel} >= 6 +%if 0%{?rhel} == 6 %ifarch %{ix86} x86_64 %define with_sanlock 0%{!?_without_sanlock:%{server_drivers}} %endif %endif +%if 0%{?rhel} >= 7 + %ifarch x86_64 + %define with_sanlock 0%{!?_without_sanlock:%{server_drivers}} + %endif +%endif # Enable libssh2 transport for new enough distros %if 0%{?fedora} >= 17 -- 1.8.3.2

2 2

[libvirt] [PATCH] spec: Disable libssh2 support for RHEL
by Jiri Denemark 30 Jul '13

30 Jul '13

From: Peter Krempa <pkrempa(a)redhat.com> https://bugzilla.redhat.com/show_bug.cgi?id=905513 Libssh2 isn't reliable enough to support the libvirt transport using it. The problems include mishandling of "known_hosts" files that may confuse users. --- libvirt.spec.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index a3a831f..6236c08 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -252,7 +252,7 @@ %endif # Enable libssh2 transport for new enough distros -%if 0%{?fedora} >= 17 || 0%{?rhel} >= 6 +%if 0%{?fedora} >= 17 %define with_libssh2 0%{!?_without_libssh2:1} %endif -- 1.8.3.2

2 2

[libvirt] [PATCH] tests: Put a mock library at the start of LD_PRELOAD
by Jiri Denemark 30 Jul '13

30 Jul '13

This fixes vircgrouptest when run in a sandbox which already overrides open() and others. --- tests/testutils.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tests/testutils.h b/tests/testutils.h index 27af5da..8583747 100644 --- a/tests/testutils.h +++ b/tests/testutils.h @@ -87,8 +87,9 @@ int virtTestMain(int argc, perror(lib); \ return EXIT_FAILURE; \ } \ - if (virAsprintf(&newenv, "%s%s%s", preload ? preload : "", \ - preload ? ":" : "", lib) < 0) { \ + if (!preload) { \ + newenv = (char *) lib; \ + } else if (virAsprintf(&newenv, "%s:%s", lib, preload) < 0) { \ perror("virAsprintf"); \ return EXIT_FAILURE; \ } \ -- 1.8.3.2

2 2

[libvirt] [PATCH] spec: Don't mix commands with macro definitions
by Jiri Denemark 30 Jul '13

30 Jul '13

%build section should first define all required macros and then run commands. Interleaving them makes it harder to spot what commands are run. --- libvirt.spec.in | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 6d6203b..0fdba54 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1333,10 +1333,6 @@ of recent versions of Linux (and other OSes). %define init_scripts --with-init_script=redhat %endif -%if 0%{?enable_autotools} - autoreconf -if -%endif - %if %{with_selinux} %if 0%{?fedora} >= 17 || 0%{?rhel} >= 7 %define with_selinux_mount --with-selinux-mount="/sys/fs/selinux" @@ -1345,6 +1341,11 @@ of recent versions of Linux (and other OSes). %endif %endif + +%if 0%{?enable_autotools} + autoreconf -if +%endif + %configure %{?_without_xen} \ %{?_without_qemu} \ %{?_without_openvz} \ -- 1.8.3.2

2 2

[libvirt] 3rd pass at virt-login-shell for joining an LXC Container
by dwalsh＠redhat.com 30 Jul '13

30 Jul '13

All comments applied except for comments below. Also additional cleanup of error handling. > You'll need to call virGetUserDirectory() before any fork(), since it > calls code which is not async-signal safe. The reason I did this is I needed to call it after the shell setuid, if I call it earlier it sees the UID=0 and gives me /root. I added a new interface char *virGetUserDirectoryByUID(uid_t uid); Since the original interface does not take a UID. > Hmm, looking at this again, I'm wondering you need to fork() > at all. In virsh we do the double-fork dance, because virsh > is an interactive shell & we don't want to affect other parts > of virsh. > This login shell though is different - its only job is to run > inside the namespace. So can't the main process just enter > the namespace directly ? I think you still need to do the second fork to make sure the /bin/sh PID gets put in the container. Otherwise you will have a process running within the container without a local PID. [PATCH] virt-login-shell joins users into lxc container.

4 10

[libvirt] [PATCH] Configuring systemd to restart libvirt on abort
by Mooli Tayer 30 Jul '13

30 Jul '13

----- Original Message ----- > On Mon, Jul 29, 2013 at 05:36:21PM +0300, Mooli Tayer wrote: > > From: Mooli Tayer <mtayer(a)redhat.com> > > > > This will create a respawn behaviour in case libvirt > > process exits due to an uncaught signal not specified > > as a clean exit status. > > see http://www.freedesktop.org/software/systemd/man/systemd.service.html > > --- > > daemon/libvirtd.service.in | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/daemon/libvirtd.service.in b/daemon/libvirtd.service.in > > index aa5913b..b3c0849 100644 > > --- a/daemon/libvirtd.service.in > > +++ b/daemon/libvirtd.service.in > > @@ -15,6 +15,7 @@ EnvironmentFile=-/etc/sysconfig/libvirtd > > ExecStart=@sbindir@/libvirtd $LIBVIRTD_ARGS > > ExecReload=/bin/kill -HUP $MAINPID > > KillMode=process > > +Restart=on-abort > > # Override the maximum number of opened files > > #LimitNOFILE=2048 > > I'm wondering whether 'on-abort' is the best choice or if > 'on-failure' or 'always' are better. The systemd.service > man page says > > [quote] > Takes one of no, on-success, on-failure, > on-abort, or always. If set to no (the > default) the service will not be restarted. If > set to on-success it will be restarted only > when the service process exits cleanly. In > this context, a clean exit means an exit code > of 0, or one of the signals SIGHUP, SIGINT, > SIGTERM, or SIGPIPE, and additionally, exit > statuses and signals specified in > SuccessExitStatus=. If set to on-failure the > service will be restarted when the process > exits with an nonzero exit code, is terminated > by a signal (including on core dump), when an > operation (such as service reload) times out, > and when the configured watchdog timeout is > triggered. If set to on-abort the service will > be restarted only if the service process exits > due to an uncaught signal not specified as a > clean exit status. If set to always the > service will be restarted regardless whether > it exited cleanly or not, got terminated > abnormally by a signal or hit a timeout. > [/quote] > > I tend towards saying 'on-failure' here. I agree. we defiantly want restart in the 'on-failure' cases. > > Daniel > -- > |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| > |: http://libvirt.org -o- http://virt-manager.org :| > |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| > |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :| > > -- > libvir-list mailing list > libvir-list(a)redhat.com > https://www.redhat.com/mailman/listinfo/libvir-list >

3 3

[libvirt] [PATCH] Support apparmor in RPM spec
by Daniel P. Berrange 30 Jul '13

30 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> If libapparmor-devel happens to be installed when building the RPM, it will failed due to unlisted virt-aa-helper in %files. Add support for apparmor in the spec, so that we can explicitly turn it on/off, defaulting to off in all distros. This causes --without-apparmor to be given to configure, preventing the build failures if the user happens to have libapparmor-devel present. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- libvirt.spec.in | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/libvirt.spec.in b/libvirt.spec.in index a3a831f..6212b3c 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -100,6 +100,9 @@ %define with_numactl 0%{!?_without_numactl:%{server_drivers}} %define with_selinux 0%{!?_without_selinux:%{server_drivers}} +# Just hardcode to off, since few people ever have apparmor RPMs installed +%define with_apparmor 0%{!?_without_apparmor:0} + # A few optional bits off by default, we enable later %define with_polkit 0%{!?_without_polkit:0} %define with_capng 0%{!?_without_capng:0} @@ -472,6 +475,9 @@ BuildRequires: avahi-devel %if %{with_selinux} BuildRequires: libselinux-devel %endif +%if %{with_apparmor} +BuildRequires: libapparmor-devel +%endif %if %{with_network} BuildRequires: dnsmasq >= 2.41 BuildRequires: iptables @@ -1268,6 +1274,10 @@ of recent versions of Linux (and other OSes). %define _without_selinux --without-selinux %endif +%if ! %{with_apparmor} + %define _without_apparmor --without-apparmor +%endif + %if ! %{with_hal} %define _without_hal --without-hal %endif @@ -1367,6 +1377,7 @@ of recent versions of Linux (and other OSes). %{?_without_netcf} \ %{?_without_selinux} \ %{?_with_selinux_mount} \ + %{?_without_apparmor} \ %{?_without_hal} \ %{?_without_udev} \ %{?_without_yajl} \ @@ -1835,6 +1846,11 @@ fi %endif %attr(0755, root, root) %{_libexecdir}/libvirt_iohelper + + %if %{with_apparmor} +%attr(0755, root, root) %{_libexecdir}/virt-aa-helper + %endif + %attr(0755, root, root) %{_sbindir}/libvirtd %attr(0755, root, root) %{_sbindir}/virtlockd -- 1.8.3.1

2 2

[libvirt] [PATCH] Fix minor typos in messages and docs
by Yuri Chornoivan 30 Jul '13

30 Jul '13

2 1

[libvirt] [PATCH] Delete obsolete / unused python test files
by Daniel P. Berrange 30 Jul '13

30 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> The python/tests directory contains a number of so called "tests" for the python API. These are all hardcoded to look for Xen and cannot be run in any automated fashion, and no one is ever manually running them. Given that they don't meaningully contribute to the test coverage, delete them. For some reason these tests were also copied into the filesystem as part of 'make install'. The change to the RPM in commit 3347a4203278ec93d7b0ceb88b5ed10e4f14765c caused a build failure, since it removed the code which deleted these installed tests. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- configure.ac | 2 +- python/Makefile.am | 2 - python/tests/Makefile.am | 52 ----------------- python/tests/basic.py | 31 ---------- python/tests/create.py | 146 ----------------------------------------------- python/tests/error.py | 42 -------------- python/tests/node.py | 34 ----------- python/tests/uuid.py | 41 ------------- 8 files changed, 1 insertion(+), 349 deletions(-) delete mode 100644 python/tests/Makefile.am delete mode 100755 python/tests/basic.py delete mode 100755 python/tests/create.py delete mode 100755 python/tests/error.py delete mode 100755 python/tests/node.py delete mode 100755 python/tests/uuid.py diff --git a/configure.ac b/configure.ac index 35a5d76..084d864 100644 --- a/configure.ac +++ b/configure.ac @@ -2447,7 +2447,7 @@ AC_OUTPUT(Makefile src/Makefile include/Makefile docs/Makefile \ libvirt.pc libvirt.spec mingw-libvirt.spec \ po/Makefile.in \ include/libvirt/Makefile include/libvirt/libvirt.h \ - python/Makefile python/tests/Makefile \ + python/Makefile \ daemon/Makefile \ tools/Makefile \ tests/Makefile \ diff --git a/python/Makefile.am b/python/Makefile.am index 7eb42c6..925e1f4 100644 --- a/python/Makefile.am +++ b/python/Makefile.am @@ -16,8 +16,6 @@ ## License along with this library. If not, see ## <http://www.gnu.org/licenses/>. -SUBDIRS= . tests - INCLUDES = \ $(PYTHON_INCLUDES) \ -I$(top_builddir)/gnulib/lib \ diff --git a/python/tests/Makefile.am b/python/tests/Makefile.am deleted file mode 100644 index 0fd3c78..0000000 --- a/python/tests/Makefile.am +++ /dev/null @@ -1,52 +0,0 @@ -## Copyright (C) 2005-2011, 2013 Red Hat, Inc. -## -## This library is free software; you can redistribute it and/or -## modify it under the terms of the GNU Lesser General Public -## License as published by the Free Software Foundation; either -## version 2.1 of the License, or (at your option) any later version. -## -## This library is distributed in the hope that it will be useful, -## but WITHOUT ANY WARRANTY; without even the implied warranty of -## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -## Lesser General Public License for more details. -## -## You should have received a copy of the GNU Lesser General Public -## License along with this library. If not, see -## <http://www.gnu.org/licenses/>. - -EXAMPLE_DIR = $(datadir)/doc/libvirt-python-$(VERSION)/examples - -PYTESTS= \ - basic.py \ - create.py \ - uuid.py \ - error.py \ - node.py - -EXTRA_DIST = $(PYTESTS) - -if WITH_PYTHON -tests: $(PYTESTS) - @echo "## running Python regression tests" - -@(PYTHONPATH="..:../.libs:../src/.libs:$(srcdir)/../src:$$PYTHONPATH";\ - export PYTHONPATH; \ - LD_LIBRARY_PATH="$(top_builddir)/src/.libs:$$LD_LIBRARY_PATH" ; \ - export LD_LIBRARY_PATH; \ - for test in $(PYTESTS) ; \ - do log=`$(PYTHON) $(srcdir)/$$test` ; \ - if [ "`echo $$log | grep OK`" = "" ] ; then \ - echo "-- $$test" ; echo "$$log" ; fi ; done) -else -tests: -endif - -clean: - rm -f *.pyc core - -install-data-local: - $(mkinstalldirs) $(DESTDIR)$(EXAMPLE_DIR) - -(for test in $(PYTESTS); \ - do $(INSTALL) -m 0644 $(srcdir)/$$test $(DESTDIR)$(EXAMPLE_DIR) ; done) - -uninstall-local: - for test in $(PYTESTS); do rm -f $(DESTDIR)$(EXAMPLE_DIR)/$$test; done diff --git a/python/tests/basic.py b/python/tests/basic.py deleted file mode 100755 index c6dec81..0000000 --- a/python/tests/basic.py +++ /dev/null @@ -1,31 +0,0 @@ -#!/usr/bin/python -u -import libvirt -import sys -import os - -if not os.access("/proc/xen", os.R_OK): - print 'System is not running a Xen kernel' - sys.exit(1) - -conn = libvirt.openReadOnly(None) -if conn == None: - print 'Failed to open connection to the hypervisor' - sys.exit(1) - -# print conn - -try: - dom0 = conn.lookupByName("Domain-0") -except: - print 'Failed to find the main domain' - sys.exit(1) - -# print dom0 - -print "Domain 0: id %d running %s" % (dom0.ID(), dom0.OSType()) -print dom0.info() -del dom0 -del conn -print "OK" - -sys.exit(0) diff --git a/python/tests/create.py b/python/tests/create.py deleted file mode 100755 index 815ccc4..0000000 --- a/python/tests/create.py +++ /dev/null @@ -1,146 +0,0 @@ -#!/usr/bin/python -u -import libvirt -import sys -import os -import time - -if not os.access("/proc/xen", os.R_OK): - print 'System is not running a Xen kernel' - sys.exit(1) - -# -# Try to provide default OS images paths here, of course non standard -# -osroots = [ - "/u/fc4-2.img", - "/u/fc4.img", - "/xen/fc4.img", -] - -okay = 1 - -osroot = None -for root in osroots: - if os.access(root, os.R_OK): - osroot = root - break - -if osroot == None: - print "Could not find a guest OS root, edit to add the path in osroots" - sys.exit(1) - -kernel=open("/proc/version").read().split() -kernelOv = kernel[2] - -if kernelOv.find('hypervisor'): - kernelU = "/boot/vmlinuz-" + kernelOv.replace('hypervisor', 'guest') - initrdU = "/boot/initrd-" + kernelOv.replace('hypervisor', 'guest') + ".img" -elif kernelOv.find('xen0'): - kernelU = "/boot/vmlinuz-" + kernelOv.replace('xen0', 'xenU') - initrdU = "/boot/initrd-" + kernelOv.replace('xen0', 'xenU') + ".img" - -if not os.access(kernelU, os.R_OK): - print "Did not find the guest kernel %s" % (kernelU) - sys.exit(1) - -kernelU = "<kernel>" + kernelU + "</kernel>" - -if not os.access(initrdU, os.R_OK): - print "Did not find the guest initrd %s" % (initrdU) - initrdU = "" -else: - initrdU = "<initrd>" + initrdU + "</initrd>" - - -conn = libvirt.open(None) -if conn == None: - print 'Failed to open connection to the hypervisor' - sys.exit(1) - -xmldesc="""<domain type='xen'> - <name>test</name> - <os> - <type>linux</type> -""" + kernelU + initrdU + """ - <cmdline> root=/dev/sda1 ro selinux=0 3</cmdline> - </os> - <memory>131072</memory> - <vcpu>1</vcpu> - <devices> - <disk type='file'> - <source file='%s'/> - <target dev='sda1'/> - </disk> - <interface type='bridge'> - <source bridge='xenbr0'/> - <mac address='aa:00:00:00:00:12'/> - <script path='/etc/xen/scripts/vif-bridge'/> - </interface> - </devices> -</domain> -""" % (osroot) - -dom = conn.createLinux(xmldesc, 0) -if dom == None: - print 'Failed to create a test domain' - sys.exit(1) - -# print dom - -print "Domain: id %d running %s" % (dom.ID(), dom.OSType()) - -print "Suspending test domain for 5 seconds" -if dom.suspend() != 0: - print 'Failed to suspend domain test' - dom.destroy() - del dom - del conn - sys.exit(1) - -infos = dom.info() -time.sleep(5) -infos2 = dom.info() -if infos[4] != infos2[4]: - print 'Suspended domain test got CPU cycles' - okay = 0 - -print "resuming test domain for 10 seconds" -if dom.resume() != 0: - print 'Failed to resume domain test' - dom.destroy() - del dom - del conn - sys.exit(1) - -time.sleep(10) -print "shutdown of test domain" - -if dom.shutdown() != 0: - okay = 0 - print 'Failed to shutdown domain test' - -i = 0 -while i < 30: - time.sleep(1) - i = i + 1 - try: - t = dom.info()[4] - except: - okay = 0 - t = -1 - break - - if t == 0: - break - -if t != 0: - print 'Shutdown failed destroying domain test' - okay = 0 - dom.destroy() - -del dom -del conn -if okay == 1: - print "OK" - -sys.exit(0) diff --git a/python/tests/error.py b/python/tests/error.py deleted file mode 100755 index 295f9a7..0000000 --- a/python/tests/error.py +++ /dev/null @@ -1,42 +0,0 @@ -#!/usr/bin/python -u -# -# Tests global error handlers at the python level. -# -import libvirt -import sys -import os - -errno = None - -def handler(ctxt, err): - global errno - - #print "handler(%s, %s)" % (ctxt, err) - errno = err - -libvirt.registerErrorHandler(handler, 'context') - -conn = libvirt.openReadOnly(None) -if conn == None: - print 'Failed to open connection to the hypervisor' - sys.exit(1) - -try: - dom0 = conn.lookupByName("Does_not_exist") - print 'strange found a Does_not_exist domain' - sys.exit(1) -except: - pass - -del conn - -if errno == None: - print 'failed to get an error' -elif errno[0] == libvirt.VIR_ERR_NO_CONNECT or \ - errno[0] == libvirt.VIR_ERR_INVALID_DOMAIN or \ - errno[0] == libvirt.VIR_ERR_GET_FAILED: - print "OK" -else: - print 'got unexpected error:', errno - -sys.exit(0) diff --git a/python/tests/node.py b/python/tests/node.py deleted file mode 100755 index f199fc3..0000000 --- a/python/tests/node.py +++ /dev/null @@ -1,34 +0,0 @@ -#!/usr/bin/python -u -import libvirt -import sys -import os - -if not os.access("/proc/xen", os.R_OK): - print 'System is not running a Xen kernel' - sys.exit(1) - -conn = libvirt.openReadOnly(None) -if conn == None: - print 'Failed to open connection to the hypervisor' - sys.exit(1) - -try: - (model, memory, cpus, mhz, nodes, socket, cores, threads) = conn.getInfo() -except: - print 'Failed to extract the current node information' - sys.exit(1) - -print "Xen running on %d %s processors at %d MHz, %d MBytes of memory" % ( - cpus, model, mhz, memory) - -if cpus > nodes * socket * cores * threads: - print "Erroneous CPU information" - sys.exit(1) - -if cpus < nodes * socket * cores * threads: - print "Strange, running in degrated mode, some CPU are not available" - -del conn -print "OK" - -sys.exit(0) diff --git a/python/tests/uuid.py b/python/tests/uuid.py deleted file mode 100755 index db48e80..0000000 --- a/python/tests/uuid.py +++ /dev/null @@ -1,41 +0,0 @@ -#!/usr/bin/python -u -import libvirt -import sys -import os - -if not os.access("/proc/xen", os.R_OK): - print 'System is not running a Xen kernel' - sys.exit(1) - -conn = libvirt.openReadOnly(None) -if conn == None: - print 'Failed to open connection to the hypervisor' - sys.exit(1) - -ids = conn.listDomainsID() -if ids == None or len(ids) == 0: - print 'Failed to list running domains' - sys.exit(1) - -id = ids[-1] - -try: - dom = conn.lookupByID(id) -except: - print 'Failed to find the domain %d' - sys.exit(1) - -name0 = dom.name() -uuid = dom.UUID() -print "Using domain %s" % (name0) -try: - dom2 = conn.lookupByUUID(uuid) -except: - print 'Failed to lookup domain %d based on its UUID' - sys.exit(1) -if dom2.name() != name0: - print 'lookup of %s based on UUID brings a different domain %s' % ( - name0, dom2.name()) - -print "OK" -sys.exit(0) -- 1.8.3.1

3 2

[libvirt] Release of libvirt-1.1.1
by Daniel Veillard 30 Jul '13

30 Jul '13

As planned the release is out, tagged in git and available at the usual place: ftp://libvirt.org/libvirt/ This is a rather large release, including around 380 commits (time to take some vacations !) with a large set of bug fixes, including 3 CVE security ones, and large improvements over the code base. The localization got updates for no less then 18 languages too, with 8 of them being nearly 100% complete ! Features: - Adding device removal or deletion events (Jiri Denemark) - Introduce new domain create APIs to pass pre-opened FDs to LXC (Daniel P. Berrange) - Add interface versions for Xen 4.3 (Stefan Bader) - Add new public API virDomainSetMemoryStatsPeriod (John Ferlan) - Various LXC improvements (Daniel P. Berrange and Gao feng) Security: - security: fix deadlock with prefork (Eric Blake) - CVE-2013-4153 qemu: Fix double free of returned JSON array in qemuAgentGetVCPUs() (Peter Krempa) - CVE-2013-4154 qemu: Prevent crash of libvirtd without guest agent configuration (Alex Jia) - CVE-2013-2230 Fix crash when multiple event callbacks were registered (Ján Tomko) Documentation: - formatdomain.html.in: Document implementation limitation of QoS (Michal Privoznik) - formatdomain.html.in: Correctly use <code/> in #elementQoS (Michal Privoznik) - Fix copy-paste-error in virNodeGetMemoryStats (Philipp Hahn) - virsh: Mention --driver in man page for nodedev-detach (Peter Krempa) - maint: tweak use of <a> in HACKING (Eric Blake) - maint: fix typo in qemu error message (Eric Blake) - daemon: Fix command example in libvirtd.sasl (Cole Robinson) - Put virt-sanlock-cleanup into section 8 (Guido Günther) - Document hypervisor drivers that support certain timer models (Peter Krempa) Portability: - build: fix shunloadtest breakage (Eric Blake) - examples: fix mingw build vs. printf (Eric Blake) - build: skip systemd mock on non-Linux (Eric Blake) - Fix dbus message reading code on big endian hosts (Daniel P. Berrange) - build: fix another virdbus issue on mingw (Eric Blake) - build: fix virutil build on mingw (Eric Blake) - build: fix virthread build on mingw (Eric Blake) - build: fix virdbus build on mingw (Eric Blake) - build: fix vircgroup build on mingw (Eric Blake) - Conditionalize build of virCgroupValidateMachineGroup (Daniel P. Berrange) - build: fix VPATH 'make check' (Eric Blake) - cpu: Fix one compile error for PPC. (Li Zhang) - virdbustest: Don't pass number of arguments as long long (Guido Günther) - Fix virCgroupAvailable() w/o HAVE_GETMNTENT_R defined (Roman Bogorodskiy) - Fix link_addr detection (Roman Bogorodskiy) - build: work around broken kernel headers (Eric Blake) - dbus: work with older dbus (Eric Blake) - Use AC_LINK_IFELSE (Guido Günther) - Check for link_addr more thoroughly (Guido Günther) - Fix bridge routines detection on kFreeBSD (Roman Bogorodskiy) - Fix build with clang (Ján Tomko) - build: don't ship access syms files in tarball (Eric Blake) - build: work around mingw header pollution (Eric Blake) - build: avoid build failure without gnutls (Eric Blake) Bug Fixes: - Fix probing of legacy Xen driver to not leave URI set (Daniel P. Berrange) - caps: use -device for primary video when qemu >=1.6 (Guannan Ren) - Resolve Coverity complaint in storagevolxml2argvtest (Ján Tomko) - Don't check validity of missing attributes in DNS SRV XML (Ján Tomko) - Set the number of elements 0 in virNetwork*Clear (Ján Tomko) - conf:Fix a copy paste error (Alex Jia) - virLXCMonitorClose: Unlock domain while closing monitor (Michal Privoznik) - libxl: Correctly initialize vcpu bitmap (Stefan Bader) - Add new virAuth symbols to private.syms (Ján Tomko) - Use qemuOpenFile in qemu_driver.c (Martin Kletzander) - Make qemuOpenFile aware of per-VM DAC seclabel. (Martin Kletzander) - domain_event: Resolve memory leak found by Valgrind (John Ferlan) - lxc: Resolve Coverity warning (John Ferlan) - qemu: Take error path if acquiring of job fails in qemuDomainSaveInternal (Peter Krempa) - build: fix make rpm failure (Laine Stump) - virsh: fix change-media bug on disk block type (Guannan Ren) - tests: Free test at the end of GetDeviceAliases JSON test (Jiri Denemark) - vmware: Fix bogus CPU arch copy (Jiri Denemark) - qemu: Shorten SCSI hostdev alias to avoid QEMU failure (Viktor Mihajlovski) - Add virtio-scsi to fallback models of scsi controller (Martin Kletzander) - qemuhotplugtest: Resolve some memleaks (Michal Privoznik) - qemuDomainDetachChrDevice: Don't leak @charAlias (Michal Privoznik) - Fix impl of virDomainCreateWithFlags remote client helper (Daniel P. Berrange) - cgroup: reuse buffer for getline (Ján Tomko) - Create directory for lease files if it's missing (Guido Günther) - rbd: Do not free the secret if it is not set (Wido den Hollander) - Make logical pools independent on target path (Martin Kletzander) - qemu: add macvlan delete to qemuDomainAttachNetDevice cleanup (Matthew Rosato) - qemuBuildChrDeviceCommandLine: Don't leak devstr (Michal Privoznik) - conf: reject pci-root controllers with non-zero indexes (Ján Tomko) - nodeinfo: Don't fail on non-contiguous NUMA topologies (hejia hejia) - util: make virSetUIDGID async-signal-safe (Eric Blake) - qemu_hostdev: Resolve Coverity issue (John Ferlan) - storage_backend: Resolve Coverity issue (John Ferlan) - virsh-nodedev: Resolve Coverity issues (John Ferlan) - virsh-interface: Resolve Coverity issues (John Ferlan) - virsh-domain-monitor: Resolve Coverity issues (John Ferlan) - testutils: Resolve Coverity issues (John Ferlan) - hellolibvirt: Resolve Coverity issues (John Ferlan) - storage: return -1 when fs pool can't be mounted (Ján Tomko) - qemu: fix double free in qemuMigrationPrepareDirect (Ján Tomko) - Properly detect VMDK with internal version 2 (Martin Kletzander) - Resolve Coverity complaints in tests/securityselinuxlabeltest.c (John Ferlan) - Paused domain should remain paused after migration (Jiri Denemark) - conf: don't check hyperv spinlock retries if disabled (Ján Tomko) - Fix NULL dereference caused by ACL filtering of domains (Jiri Denemark) - Unlock the storage volume object after looking it up (Ján Tomko) - libxl: fix deadlock in libxlReconnectDomain (Marek Marczykowski-Górecki) - LXC: fix memory leak when userns configuration is incorrect (Gao feng) - virNetDevBandwidthUnplug: Don't leak @cmd (Michal Privoznik) - virCgroupNewPartition: Don't leak @newpath (Michal Privoznik) - qemuNodeDeviceDetachFlags: Avoid use of uninitialized variables (Michal Privoznik) - qemu: fix return value of qemuDomainBlockPivot on errors (Ján Tomko) Improvements: - tests: consistently use virFilePrintf (Eric Blake) - Rename VIR_DOMAIN_PAUSED_GUEST_PANICKED to VIR_DOMAIN_PAUSED_CRASHED (Daniel P. Berrange) - Remove VIR_DOMAIN_SHUTDOWN_CRASHED from public API (Daniel P. Berrange) - spec: Cat test-suite.log if make check fails (Jiri Denemark) - build: avoid uninitialized use warning (Eric Blake) - Set default partition in libvirtd instead of libvirt_lxc (Daniel P. Berrange) - virStateDriver - Separate AutoStart from Initialize (John Ferlan) - Separate out StateAutoStart from StateInitialize (John Ferlan) - Remove redundant free in virNetworkDNSHostDefParseXML (Ján Tomko) - Remove double space in error messages (Ján Tomko) - Fix virsh snapshot-list error reporting (Jim Fehlig) - Skip detecting placement if controller is disabled (Daniel P. Berrange) - Add 'controllers' arg to virCgroupNewDetect (Daniel P. Berrange) - Fix detection of 'emulator' cgroup (Daniel P. Berrange) - Make virCgroupIsValidMachine static (Daniel P. Berrange) - Introduce a more convenient virCgroupNewDetectMachine (Daniel P. Berrange) - Add inputpool to storagevolxml2argvtest (Ján Tomko) - Move volume XMLs out of storagevolxml2argvdata (Ján Tomko) - Move pool XML out of storagevolxml2argvdata (Ján Tomko) - Use separate macros for failure/success in vol-to-argv test (Ján Tomko) - tests: PCI controller checks (Ján Tomko) - Don't overwrite errors in qemuTranslateDiskSourcePool (Ján Tomko) - Protection against doing bad stuff to the root group (Daniel P. Berrange) - Convert LXC driver to use virCgroupNewMachine (Daniel P. Berrange) - Convert QEMU driver to use virCgroupNewMachine (Daniel P. Berrange) - New cgroups API for atomically creating machine cgroups (Daniel P. Berrange) - Add a colon after 'internal error' (Ján Tomko) - Expose ownership ID parsing (Martin Kletzander) - qemu: set/validate slot/connection type when assigning slots for PCI devices (Laine Stump) - qemu: make QEMU_PCI_ADDRESS_(SLOT|FUNCTION)_LAST less misleading (Laine Stump) - qemu: only check for PIIX3-specific device addrs on pc-* machinetypes (Laine Stump) - qemu: turn qemuDomainPCIAddressBus into a struct (Laine Stump) - valgrind.supp: Add more valgrind suppression paths (John Ferlan) - Create + setup cgroups atomically for LXC process (Daniel P. Berrange) - Create + setup cgroups atomically for QEMU process (Daniel P. Berrange) - Remove obsolete cgroups creation apis (Daniel P. Berrange) - Auto-detect existing cgroup placement (Daniel P. Berrange) - Add API for checking if a cgroup is valid for a domain (Daniel P. Berrange) - Add a virCgroupNewDetect API for finding cgroup placement (Daniel P. Berrange) - Add logic for handling systemd-machined non-existance (Daniel P. Berrange) - Fix handling of DBus errors emitted by the bus itself (Daniel P. Berrange) - storage: Add connection for autostart storage pool (John Ferlan) - Adjust 'ceph' authentication secret usage for rbd pool. (John Ferlan) - storage: Support "chap" authentication for iscsi pool (John Ferlan) - qemu_common: Create qemuBuildVolumeString() to process storage pool (John Ferlan) - qemu: Create a common qemuGetSecretString (John Ferlan) - qemu: Add source pool auth info to virDomainDiskDef for iSCSI (John Ferlan) - bridge driver: use more general function names (Roman Bogorodskiy) - Add virDBusMessage(Encode,Decode) stubs (Roman Bogorodskiy) - qemu: Translate the volume type disk source before cgroup setting (Osier Yang) - conf: Ignore the volume type disk if its mode is "direct" (Osier Yang) - qemu: Translate the iscsi pool/volume disk source (John Ferlan) - conf: Introduce virDomainDiskSourceIsBlockType (John Ferlan) - conf: Introduce new XML tag "mode" for disk source (John Ferlan) - storage_iscsi: Reflect the default target port (John Ferlan) - bridge driver: s/network_driver/virNetworkDriverState/ (Roman Bogorodskiy) - Convert remainder of cgroups code to report errors (Daniel P. Berrange) - Convert the virCgroupKill* APIs to report errors (Daniel P. Berrange) - Report full errors from virCgroupNew* (Daniel P. Berrange) - Add helpers for dealing with system errors (Daniel P. Berrange) - Add API for calling systemd-machined's DBus API (Daniel P. Berrange) - Introduce virDBusCallMethod & virDBusMessageRead methods (Daniel P. Berrange) - cpu: Let explicit features override model features (Jiri Denemark) - cpu: Store arch in virCPUData (Jiri Denemark) - Replace union cpuData with virCPUData (Jiri Denemark) - cpu_x86: Use x86-specific CPU data structure (Jiri Denemark) - LXC: Set default driver for image backed filesystems (Daniel P. Berrange) - LXC: Fix some error reporting in filesystem setup (Daniel P. Berrange) - qemu: Unplug devices that disappeared when libvirtd was down (Jiri Denemark) - qemu: Introduce qemuMonitorGetDeviceAliases (Jiri Denemark) - conf: Make error reporting in virDomainDefFindDevice optional (Jiri Denemark) - util: Non-existent string array does not contain any string (Jiri Denemark) - Change s/i/iv/ in test code to avoid syntax-check (Daniel P. Berrange) - Allow test cases to be run selectively (Daniel P. Berrange) - maint: update to latest gnulib (Eric Blake) - autogen: Handle case when libvirt's submodule (Michal Privoznik) - security_dac: compute supplemental groups before fork (Eric Blake) - security: framework for driver PreFork handler (Eric Blake) - qemu: Emit VIR_DOMAIN_EVENT_ID_DEVICE_REMOVED events (Jiri Denemark) - qemu: Remove devices only after DEVICE_DELETED event (Jiri Denemark) - qemu: Add support for DEVICE_DELETED event (Jiri Denemark) - Add virDomainDefFindDevice for looking up a device by its alias (Jiri Denemark) - Clarify virDomainDetachDeviceFlags documentation (Jiri Denemark) - examples: Handle VIR_DOMAIN_EVENT_ID_DEVICE_REMOVED event (Jiri Denemark) - Add VIR_DOMAIN_EVENT_ID_DEVICE_REMOVED event (Jiri Denemark) - qemu: Separate char device removal into a standalone function (Jiri Denemark) - qemu: Set cpuset.cpus for domain process (Osier Yang) - caps: Add helpers to convert NUMA nodes to corresponding CPUs (Peter Krempa) - Introduce lxcDomObjFromDomain (Michal Privoznik) - Remove lxcDriverLock from almost everywhere (Michal Privoznik) - lxc: Make activeUsbHostdevs use locks (Michal Privoznik) - Stop accessing driver->caps directly in LXC driver (Michal Privoznik) - lxc: switch to virCloseCallbacks API (Michal Privoznik) - Introduce annotations for virLXCDriverPtr fields (Michal Privoznik) - lxc: Use atomic ops for driver->nactive (Michal Privoznik) - Introduce a virLXCDriverConfigPtr object (Michal Privoznik) - virLXCDriver: Drop unused @cgroup (Michal Privoznik) - qemu: Move close callbacks handling into util/virclosecallbacks.c (Michal Privoznik) - virAsprintf: correctly check return value (Ján Tomko) - Merge virCommandPreserveFD / virCommandTransferFD (Daniel P. Berrange) - Enable FD passing when starting guests with virsh (Daniel P. Berrange) - LXC: Wire up the virDomainCreate{XML}WithFiles methods (Daniel P. Berrange) - Introduce remote protocol support for virDomainCreate{XML}WithFiles (Daniel P. Berrange) - maint: Make ctags work out of the box (Jiri Denemark) - esx: Support for disk-only and quiescing snapshots. (Geoff Hickey) - libxl: implement virDomainGetNumaParameters (Dario Faggioli) - libxl: advertise the support for VIR_TYPED_PARAM_STRING (Dario Faggioli) - lxc_container: Don't call virGetGroupList during exec (Michal Privoznik) - qemuDomainGetSchedulerType: Prefer qemuDomObjFromDomain (Michal Privoznik) - virSecurityManagerGenLabel: Skip seclabels without model (Michal Privoznik) - lxcCapsInit: Allocate primary security driver unconditionally (Michal Privoznik) - qemu: Separate host device removal into a standalone function (Jiri Denemark) - qemu: Separate net device removal into a standalone function (Jiri Denemark) - qemu: Separate controller removal into a standalone function (Jiri Denemark) - qemu: Separate disk device removal into a standalone function (Jiri Denemark) - qemu: Add qemuDomainReleaseDeviceAddress to remove any address (Jiri Denemark) - build: avoid compiler warning on shadowed name (Eric Blake) - LXC: Change the owner of live attached host devices (Gao feng) - LXC: Change the owner of host devices to the root of container (Gao feng) - LXC: Create host devices for container on host side (Gao feng) - LXC: Change the owner of live attached disk device (Gao feng) - LXC: Move virLXCControllerChown to lxc_container.c (Gao feng) - LXC: controller: change the owner of disk to the root of container (Gao feng) - LXC: Setup disks for container on host side (Gao feng) - Allow balloon driver collection to be adjusted dynamically (John Ferlan) - Implement the virDomainSetMemoryStatsPeriod for QEMU driver (John Ferlan) - Specify remote protocol for virDomainSetMemoryStatsPeriod (John Ferlan) - Add capability to fetch balloon stats (John Ferlan) - Determine whether to start balloon memory stats gathering. (John Ferlan) - Add 'period' for Memballoon statistics gathering capability (John Ferlan) - qemuhotplugtest: Introduce test for chardev hotplug (Michal Privoznik) - qemu: Implement chardev hotplug on live level (Michal Privoznik) - qemu: Implement chardev hotplug on config level (Michal Privoznik) - domain_conf: Auto fill chardev port (Michal Privoznik) - cpu: Allow fine tuning of "host-model" cpu (Peter Krempa) - cpu: Clean up code style (Peter Krempa) - cpu: Add virCPUDefUpdateFeature() (Peter Krempa) - conf: Clean up error reporting in cpu definition parsing (Peter Krempa) - storage_conf: Merge AuthChap and AuthCephx into AuthSecret (John Ferlan) - storage_conf: Move username processing into common function (John Ferlan) - storage_pool: Rework chap XML to mimic ceph (John Ferlan) - storage_conf: Move auth processing into virStoragePoolDefParseAuth (John Ferlan) - storage_conf: Introduce virStoragePoolAuthSecretPtr (John Ferlan) - storage_conf: Adjust virStoragePoolAuthType enum (John Ferlan) - Add qemuMonitorJSONSetObjectProperty() method for QMP qom-set command (John Ferlan) - Add qemuMonitorJSONGetObjectProperty() method for QMP qom-get command (John Ferlan) - Add qemuMonitorJSONGetObjectListPaths() method for QMP qom-list command (John Ferlan) - pci: make virPCIDeviceReset more autonomous (Laine Stump) - pci: reorder static functions (Laine Stump) - python: return dictionary without value in case of no blockjob (Guannan Ren) - Change domain controller index type to unsigned (Jincheng Miao) - Add a couple of debug statements to LXC driver (Daniel P. Berrange) - qemu: Introduce qemuBuildChrDeviceStr (Michal Privoznik) - qemu_command: Honour chardev alias assignment with a function (Michal Privoznik) - qemu_monitor: Introduce qemuMonitorDetachCharDev (Michal Privoznik) - qemu_monitor: Introduce qemuMonitorAttachCharDev (Michal Privoznik) - qemu_monitor_json: Move InetSocketAddress build to a separate function (Michal Privoznik) - domain_conf: Introduce chardev hotplug helpers (Michal Privoznik) - remote: Improve libssh2 password authentication (Peter Krempa) - libssh2: Improve password based authentication (Peter Krempa) - virAuth: Don't require virConnectPtr to retrieve authentication creds (Peter Krempa) - util: add virGetGroupList (Eric Blake) - util: improve user lookup helper (Eric Blake) - maint: update to latest gnulib (Eric Blake) - qemu: Fix hot (un-)plug error codes and messages (Michal Privoznik) - conf: Rework virDomainDeviceDefParse (Michal Privoznik) - conf: Extend device types handled by virDomainDeviceDefParse (Michal Privoznik) - LXC: remove some incorrect setting ATTRIBUTE_UNUSED (Gao feng) - qemu: Slightly increase memory limit (Jiri Denemark) - util: add rebase fix that was accidentally omitted from previous patch (Laine Stump) - util: use VIR_(APPEND|DELETE)_ELEMENT for pci/usb device lists (Laine Stump) - Prevent use of 'int' data type & 'ii', 'jj', 'kk' var names for loops (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in examples/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in python/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/cpu/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/hyperv/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/interface/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/network/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/libxl/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/locking/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/lxc/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/node_device/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/nwfilter/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/openvz/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/parallels/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/phyp/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/qemu files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/remote/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/rpc/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/secret/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/security files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/test/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/uml/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/vbox/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/storage/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/{esx,vmx,vmware} files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/{xen,xenapi,xenxs} files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in tools/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in tests/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/util/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in src/conf/ files (Daniel P. Berrange) - Convert 'int i' to 'size_t i' in daemon/ files (Daniel P. Berrange) - Adapt to VIR_ALLOC and virAsprintf in tools/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in tests/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/xenxs/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/xenapi/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/xen/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/vmx/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/vmware/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/vbox/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/util/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/uml/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/test/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/storage/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/security/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/secret/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/rpc/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/remote/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/qemu/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/phyp/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/parallels/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/openvz/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/nwfilter/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/network/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/node_device/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/lxc/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/locking/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/libxl/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/interface/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/hyperv/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/esx/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/cpu/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/conf/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in src/access/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in daemon/* (Michal Privoznik) - Adapt to VIR_ALLOC and virAsprintf in docs/ (Michal Privoznik) - Introduce OOM reporting to virAsprintf (Michal Privoznik) - viralloc: Report OOM error on failure (Michal Privoznik) - build: honor autogen.sh --no-git (Eric Blake) - LXC: hostdev: create parent directory for hostdev (Gao feng) - LXC: hostdev: introduce lxcContainerSetupHostdevCapsMakePath (Gao feng) - LXC: Create /dev/tty within a container (Richard Weinberger) - scsi: Fix construction of sysfs device path (Viktor Mihajlovski) - selinux: Always generate imagelabel (Peter Krempa) - selinux: Cleanup coding style (Peter Krempa) - qemu: Set RLIMIT_MEMLOCK when memoryBacking/locked is used (Jiri Denemark) - qemu: Use qemuDomainMemoryLimit when computing memory for VFIO (Jiri Denemark) - qemu: Move memory limit computation to a reusable function (Jiri Denemark) - Don't spam logs with "port 0 must be in range" errors (Jiri Denemark) - qemu: Release correct websocket port (Jiri Denemark) - conf: virDomainObjListRemoveLocked function (Marek Marczykowski-Górecki) - maint: update to latest gnulib (Eric Blake) - Extend the ACL test case to validate filter rule checks (Daniel P. Berrange) - Add access control filtering of interface objects (Daniel P. Berrange) - Add access control filtering of nwfilter objects (Daniel P. Berrange) - Add access control filtering of secret objects (Daniel P. Berrange) - Add access control filtering of storage objects (Daniel P. Berrange) - Add access control filtering of node device objects (Daniel P. Berrange) - Add access control filtering of network objects (Daniel P. Berrange) - Change signature of ACL filter functions (Daniel P. Berrange) - Add access control filtering of domain objects (Daniel P. Berrange) - qemu: Allow seamless migration for domains with multiple graphics (Martin Kletzander) - qemu: Don't miss errors when changing graphics passwords (Martin Kletzander) - LXC: blkio: allow to setup weight_device (Gao feng) - qemu: Implement 'oncrash' coredump events when guest panicked (Chen Fan) - qemu: Implement 'oncrash' events when guest panicked (Chen Fan) - qemu: expose qemuProcessShutdownOrReboot() (Chen Fan) - qemu: refactor processWatchdogEvent (Chen Fan) - libvirt: Define domain crash event types (Chen Fan) - Add some misc debugging to LXC startup (Daniel P. Berrange) - Ignore failure to mount SELinux filesystem in container (Daniel P. Berrange) - LXC: fuse: Change files owner to the root user of container (Gao feng) - LXC: controller: change the owner of /dev/pts and ptmx to the root of container (Gao feng) - LXC: controller: change the owner of devices created on host (Gao feng) - LXC: controller: change the owner of /dev to the root user of container (Gao feng) - LXC: controller: change the owner of tty devices to the root user of container (Gao feng) - LXC: Creating devices for container on host side (Gao feng) - LXC: introduce virLXCControllerSetupUserns and lxcContainerSetID (Gao feng) - LXC: sort the uidmap/gidmap of domain (Gao feng) - LXC: enable user namespace only when user set the uidmap (Gao feng) - LXC: Introduce New XML element for user namespace (Gao feng) - qemu: Improve info message and remove a variable in qemuDomainManagedSave (Peter Krempa) - libxl: implement per NUMA node free memory reporting (Dario Faggioli) - build: configure must not affect tarball contents (Eric Blake) - Drop iptablesContext (Roman Bogorodskiy) - qemu: indentation fix (Ján Tomko) - qemu: Implement CPUs check against machine type's cpu-max (Michal Novotny) Cleanups: - python: Drop TODO (Cole Robinson) - maint: split long lines in Makefiles (Eric Blake) - tests: split long lines (Eric Blake) - qemu: Cleanup coding style nits in qemu_cgroup.c (Peter Krempa) So thanks everybody for the contributions to this large release, be it with bug reports code, ideas, documentation or localizations ! Enjoy ! Daniel -- Daniel Veillard | Open Source and Standards, Red Hat veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] [v1.0.5-maint PATCH] lxc: correctly backport /dev/tty fix
by Eric Blake 30 Jul '13

30 Jul '13

https://bugzilla.redhat.com/show_bug.cgi?id=982317 maint-only patch; reported by Geert Jansen Commit 17cdc298 tried to backport upstream 90a0c6d, but in resolving conflicts, failed to account that upstream commit e1d32bb refactored code to leave off a leading /dev. * src/lxc/lxc_container.c (lxcContainerPopulateDevices): Use correct device name. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- src/lxc/lxc_container.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 8497c10..972486b 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -839,7 +839,7 @@ static int lxcContainerPopulateDevices(char **ttyPaths, size_t nttyPaths) { LXC_DEV_MAJ_MEMORY, LXC_DEV_MIN_FULL, 0666, "/dev/full" }, { LXC_DEV_MAJ_MEMORY, LXC_DEV_MIN_RANDOM, 0666, "/dev/random" }, { LXC_DEV_MAJ_MEMORY, LXC_DEV_MIN_URANDOM, 0666, "/dev/urandom" }, - { LXC_DEV_MAJ_TTY, LXC_DEV_MIN_TTY, 0666, "/tty" }, + { LXC_DEV_MAJ_TTY, LXC_DEV_MIN_TTY, 0666, "/dev/tty" }, }; const struct { const char *src; -- 1.8.3.1

2 2

[libvirt] Linking fails on FreeBSD
by Roman Bogorodskiy 29 Jul '13

29 Jul '13

Hi, Linking fails on FreeBSD: CCLD libvirt.la /usr/bin/ld: ./.libs/libvirt_util.a(libvirt_util_la-vircgroup.o): relocation R_X86_64_PC32 against `virCgroupPartitionEscape' can not be used when making a shared object; recompile with -fPIC /usr/bin/ld: final link failed: Bad value Following the suggestion and re-compiling with -fPIC doesn't help. Anybody has an idea how to fix that? Roman Bogorodskiy

5 21

[libvirt] ANNOUNCE: Perl binding Sys-Virt release 1.1.0
by Daniel P. Berrange 29 Jul '13

29 Jul '13

I am pleased to announce that release 1.1.0 of Sys-Virt, the libvirt Perl API binding is now available for download: http://search.cpan.org/CPAN/authors/id/D/DA/DANBERR/Sys-Virt-1.1.0.tar.gz Changed in this release: - Add support for v3 of migration APIs - Add all new constants in libvirt 1.1.0 - Fix handling of sparse typed parameters - Fix misc typos in docs Further information, including online API documentation & previous release archives, is available from the CPAN home page http://search.cpan.org/dist/Sys-Virt/ Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|

1 0

[libvirt] [PATCH v2] Fix dbus message reading code on big endian hosts
by Daniel P. Berrange 29 Jul '13

29 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> The way we were casting small (<32bit) integers was broken on big endian hosts, causing stack smashing. This was detected in the test suite either by test failures due to incorrect results, or by libc/gcc abort'ing with its stack canary triggered. In v2: - Added missing change to virdbus.c Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/util/virdbus.c | 6 +++--- tests/virdbustest.c | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/util/virdbus.c b/src/util/virdbus.c index 4ce6c46..33f3379 100644 --- a/src/util/virdbus.c +++ b/src/util/virdbus.c @@ -738,7 +738,7 @@ virDBusMessageIterDecode(DBusMessageIter *rootiter, switch (*t) { case DBUS_TYPE_BYTE: - GET_NEXT_VAL(unsigned char, int, "%d"); + GET_NEXT_VAL(unsigned char, unsigned char, "%d"); break; case DBUS_TYPE_BOOLEAN: @@ -746,11 +746,11 @@ virDBusMessageIterDecode(DBusMessageIter *rootiter, break; case DBUS_TYPE_INT16: - GET_NEXT_VAL(dbus_int16_t, int, "%d"); + GET_NEXT_VAL(dbus_int16_t, short, "%d"); break; case DBUS_TYPE_UINT16: - GET_NEXT_VAL(dbus_uint16_t, unsigned int, "%d"); + GET_NEXT_VAL(dbus_uint16_t, short unsigned, "%d"); break; case DBUS_TYPE_INT32: diff --git a/tests/virdbustest.c b/tests/virdbustest.c index fb241ee..61de937 100644 --- a/tests/virdbustest.c +++ b/tests/virdbustest.c @@ -54,8 +54,8 @@ static int testMessageSimple(const void *args ATTRIBUTE_UNUSED) int ret = -1; unsigned char in_byte = 200, out_byte = 0; int in_bool = true, out_bool = false; - int in_int16 = 12000, out_int16 = 0; - unsigned int in_uint16 = 32000, out_uint16 = 0; + short in_int16 = 0xfefe, out_int16 = 0; + unsigned short in_uint16 = 32000, out_uint16 = 0; int in_int32 = 100000000, out_int32 = 0; unsigned int in_uint32 = 200000000, out_uint32 = 0; long long in_int64 = 1000000000000, out_int64 = 0; @@ -232,8 +232,8 @@ static int testMessageStruct(const void *args ATTRIBUTE_UNUSED) int ret = -1; unsigned char in_byte = 200, out_byte = 0; int in_bool = true, out_bool = false; - int in_int16 = 12000, out_int16 = 0; - unsigned int in_uint16 = 32000, out_uint16 = 0; + short in_int16 = 12000, out_int16 = 0; + unsigned short in_uint16 = 32000, out_uint16 = 0; int in_int32 = 100000000, out_int32 = 0; unsigned int in_uint32 = 200000000, out_uint32 = 0; long long in_int64 = 1000000000000, out_int64 = 0; -- 1.8.1.4

3 4

[libvirt] [PATCH] Fix dbus message reading code on big endian hosts
by Daniel P. Berrange 29 Jul '13

29 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> The way we were casting small (<32bit) integers was broken on big endian hosts, causing stack smashing. This was detected in the test suite either by test failures due to incorrect results, or by libc/gcc abort'ing with its stack canary triggered. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- tests/virdbustest.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/virdbustest.c b/tests/virdbustest.c index fb241ee..61de937 100644 --- a/tests/virdbustest.c +++ b/tests/virdbustest.c @@ -54,8 +54,8 @@ static int testMessageSimple(const void *args ATTRIBUTE_UNUSED) int ret = -1; unsigned char in_byte = 200, out_byte = 0; int in_bool = true, out_bool = false; - int in_int16 = 12000, out_int16 = 0; - unsigned int in_uint16 = 32000, out_uint16 = 0; + short in_int16 = 0xfefe, out_int16 = 0; + unsigned short in_uint16 = 32000, out_uint16 = 0; int in_int32 = 100000000, out_int32 = 0; unsigned int in_uint32 = 200000000, out_uint32 = 0; long long in_int64 = 1000000000000, out_int64 = 0; @@ -232,8 +232,8 @@ static int testMessageStruct(const void *args ATTRIBUTE_UNUSED) int ret = -1; unsigned char in_byte = 200, out_byte = 0; int in_bool = true, out_bool = false; - int in_int16 = 12000, out_int16 = 0; - unsigned int in_uint16 = 32000, out_uint16 = 0; + short in_int16 = 12000, out_int16 = 0; + unsigned short in_uint16 = 32000, out_uint16 = 0; int in_int32 = 100000000, out_int32 = 0; unsigned int in_uint32 = 200000000, out_uint32 = 0; long long in_int64 = 1000000000000, out_int64 = 0; -- 1.8.1.4

1 1

[libvirt] [PATCH] spec: Cat test-suite.log if make check fails
by Jiri Denemark 29 Jul '13

29 Jul '13

Current automake enables parallel test by default, which means test details are only logged in test-suite.log and not printed to stderr. This patch makes test failures directly visible in RPM build logs even when parallel tests are turned on. --- libvirt.spec.in | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 81101e8..a3a831f 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1482,7 +1482,11 @@ do printf '#!/bin/sh\nexit 0\n' > $i chmod +x $i done -make check +if ! make check VIR_TEST_DEBUG=1 +then + cat test-suite.log || true + exit 1 +fi %if %{with_libvirtd} %pre daemon -- 1.8.3.2

2 2

[libvirt] [PATCHv2] build: avoid -lgcrypt with newer gnutls
by Eric Blake 29 Jul '13

29 Jul '13

https://bugzilla.redhat.com/show_bug.cgi?id=951637 Newer gnutls uses nettle, rather than gcrypt, which is a lot nicer regarding initialization. Yet we were unconditionally initializing gcrypt even when gnutls wouldn't be using it, and having two crypto libraries linked into libvirt.so is pointless. Assume that the switch to gnutls 3.0 is a reliable witness, when pkg-config is present; otherwise be pessimistic and use gcrypt. * configure.ac (WITH_GNUTLS): Probe whether to add -lgcrypt, and define a witness WITH_GNUTLS_GCRYPT. * src/libvirt.c (virTLSMutexInit, virTLSMutexDestroy) (virTLSMutexLock, virTLSMutexUnlock, virTLSThreadImpl) (virGlobalInit): Honor the witness. * libvirt.spec.in (BuildRequires): Make gcrypt usage conditional, no longer needed in Fedora 19. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- v2: use second pkg-config invocation rather than ldd to determine whether gnutls uses gcrypt configure.ac | 27 +++++++++++++++++++-------- libvirt.spec.in | 2 ++ src/libvirt.c | 10 ++++++---- 3 files changed, 27 insertions(+), 12 deletions(-) diff --git a/configure.ac b/configure.ac index cc9942a..eb56b63 100644 --- a/configure.ac +++ b/configure.ac @@ -1076,12 +1076,19 @@ if test "x$with_gnutls" != "xno"; then LIBS="$LIBS $GNUTLS_LIBS" GNUTLS_FOUND=no + GNUTLS_GCRYPT=no if test -x "$PKG_CONFIG" ; then + dnl double probe, since we know that gnutls 3.0 switched to nettle instead of + dnl gcrypt PKG_CHECK_MODULES(GNUTLS, gnutls >= $GNUTLS_REQUIRED, - [GNUTLS_FOUND=yes], [GNUTLS_FOUND=no]) + [GNUTLS_FOUND=yes + PKG_CHECK_MODULES([GNUTLS], [gnutls >= 3.0], [], [GNUTLS_GCRYPT=yes])], + [GNUTLS_FOUND=no]) fi if test "$GNUTLS_FOUND" = "no"; then + dnl pkg-config couldn't help us, assume gcrypt is necessary fail=0 + GNUTLS_GCRYPT=yes AC_CHECK_HEADER([gnutls/gnutls.h], [], [fail=1]) AC_CHECK_LIB([gnutls], [gnutls_handshake],[], [fail=1], [-lgcrypt]) @@ -1098,13 +1105,17 @@ if test "x$with_gnutls" != "xno"; then AC_MSG_ERROR([You must install the GnuTLS library in order to compile and run libvirt]) fi else - dnl Not all versions of gnutls include -lgcrypt, and so we add - dnl it explicitly for the calls to gcry_control/check_version - GNUTLS_LIBS="$GNUTLS_LIBS -lgcrypt" - - dnl We're not using gcrypt deprecated features so define - dnl GCRYPT_NO_DEPRECATED to avoid deprecated warnings - GNUTLS_CFLAGS="$GNUTLS_CFLAGS -DGCRYPT_NO_DEPRECATED" + dnl If gnutls linked against -lgcrypt, then we must initialize gcrypt + dnl prior to using gnutls. Newer versions of gnutls use -lnettle, in + dnl which case we don't want to drag in gcrypt ourselves. + if test "$GNUTLS_GCRYPT" = yes; then + GNUTLS_LIBS="$GNUTLS_LIBS -lgcrypt" + dnl We're not using gcrypt deprecated features so define + dnl GCRYPT_NO_DEPRECATED to avoid deprecated warnings + GNUTLS_CFLAGS="$GNUTLS_CFLAGS -DGCRYPT_NO_DEPRECATED" + AC_DEFINE_UNQUOTED([WITH_GNUTLS_GCRYPT], 1, + [set to 1 if it is known or assumed that GNUTLS uses gcrypt]) + fi dnl gnutls 3.x moved some declarations to a new header AC_CHECK_HEADERS([gnutls/crypto.h], [], [], [[ diff --git a/libvirt.spec.in b/libvirt.spec.in index e0e0004..4320281 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -422,7 +422,9 @@ BuildRequires: readline-devel BuildRequires: ncurses-devel BuildRequires: gettext BuildRequires: libtasn1-devel +%if (0%{?rhel} && 0%{?rhel} < 7) || (0%{?fedora} && 0%{?fedora} < 19) BuildRequires: libgcrypt-devel +%endif BuildRequires: gnutls-devel BuildRequires: libattr-devel %if %{with_libvirtd} diff --git a/src/libvirt.c b/src/libvirt.c index 8157488..66e8248 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -55,7 +55,9 @@ #include "intprops.h" #include "virconf.h" #if WITH_GNUTLS -# include <gcrypt.h> +# if WITH_GNUTLS_GCRYPT +# include <gcrypt.h> +# endif # include "rpc/virnettlscontext.h" #endif #include "vircommand.h" @@ -270,7 +272,7 @@ winsock_init(void) #endif -#ifdef WITH_GNUTLS +#ifdef WITH_GNUTLS_GCRYPT static int virTLSMutexInit(void **priv) { virMutexPtr lock = NULL; @@ -323,7 +325,7 @@ static struct gcry_thread_cbs virTLSThreadImpl = { virTLSMutexUnlock, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL }; -#endif +#endif /* WITH_GNUTLS_GCRYPT */ /* Helper macros to implement VIR_DOMAIN_DEBUG using just C99. This * assumes you pass fewer than 15 arguments to VIR_DOMAIN_DEBUG, but @@ -407,7 +409,7 @@ virGlobalInit(void) virErrorInitialize() < 0) goto error; -#ifdef WITH_GNUTLS +#ifdef WITH_GNUTLS_GCRYPT /* * This sequence of API calls it copied exactly from * gnutls 2.12.23 source lib/gcrypt/init.c, with -- 1.8.3.1

3 6

[libvirt] [PATCH 1/1] cpu: Fix one compile error for PPC.
by Li Zhang 29 Jul '13

29 Jul '13

From: Li Zhang <zhlcindy(a)linux.vnet.ibm.com> CPU data structure is refined, which causes one compile error for PPC. Signed-off-by: Li Zhang <zhlcindy(a)linux.vnet.ibm.com> --- src/cpu/cpu_powerpc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/cpu/cpu_powerpc.c b/src/cpu/cpu_powerpc.c index 62437d3..55a4153 100644 --- a/src/cpu/cpu_powerpc.c +++ b/src/cpu/cpu_powerpc.c @@ -354,15 +354,15 @@ ppcDataFree(virCPUDataPtr data) static virCPUDataPtr ppcNodeData(void) { - virCPUDataPtr data; + virCPUDataPtr cpuData; - if (VIR_ALLOC(data) < 0) + if (VIR_ALLOC(cpuData) < 0) return NULL; asm("mfpvr %0" - : "=r" (data->ppc.pvr)); + : "=r" (cpuData->data.ppc.pvr)); - return data; + return cpuData; } #endif -- 1.8.1.4

3 5

[libvirt] Use flock() instead of fcntl()
by David Weber 29 Jul '13

29 Jul '13

Hi, we are interested in using virtlockd on an OCFS2 shared filesystem. We are now facing the problem that virtlockd uses fcntl() locks which aren't supported by OCFS2 with the o2cb cluster stack and we want to avoid using indirect leases. OCFS2 instead supports flock() which is quite similar to fcntl(). I attached a patch which makes libvirt use flock() *instead* of fcntl() and it seems to work. NFS on the contrast only supports fcntl() so it should be configurable which lock type to use. I'm not very experienced with locking, so would such a patch be acceptable or do you see possible problems with it? Cheers, David >From b823a9a9bd60a870d64341c4273c42d4eeba8d9b Mon Sep 17 00:00:00 2001 From: David Weber <wb(a)munzinger.de> Date: Thu, 25 Jul 2013 08:20:20 +0000 Subject: [PATCH] Use flock() instead of fcntl() --- src/util/virfile.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util/virfile.c b/src/util/virfile.c index 8f0eec3..e243c26 100644 --- a/src/util/virfile.c +++ b/src/util/virfile.c int virFileLock(int fd, bool shared, off_t start, off_t len) .l_len = len, }; - if (fcntl(fd, F_SETLK, &fl) < 0) + if (flock(fd, LOCK_EX | LOCK_NB) < 0) return -errno; return 0; int virFileUnlock(int fd, off_t start, off_t len) .l_len = len, }; - if (fcntl(fd, F_SETLK, &fl) < 0) + if (flock(fd, LOCK_UN) < 0) return -errno; return 0; -- 1.8.1.5

3 10

[libvirt] [PATCH] build: fix VPATH 'make check'
by Eric Blake 29 Jul '13

29 Jul '13

A VPATH build 'make check' was failing with: GEN check-driverimpls Can't open ../../src/../../src/lxc/lxc_monitor_protocol.h: No such file or directory at ../../src/check-driverimpls.pl line 29, <> line 27153. Can't open ../../src/../../src/lxc/lxc_monitor_protocol.c: No such file or directory at ../../src/check-driverimpls.pl line 29, <> line 27153. ... GEN check-aclrules cannot read ../../src/../../src/remote/remote_protocol.x at ../../src/check-aclrules.pl line 128. because $(srcdir) was being prepended to file names that already included it. * src/Makefile.am (check-driverimpls): Don't add srcdir twice. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule. src/Makefile.am | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index 84372cb..62e427e 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -499,11 +499,13 @@ STATEFUL_DRIVER_SOURCE_FILES = \ check-driverimpls: $(AM_V_GEN)$(PERL) $(srcdir)/check-driverimpls.pl \ $(filter /%,$(DRIVER_SOURCE_FILES)) \ - $(addprefix $(srcdir)/,$(filter-out /%,$(DRIVER_SOURCE_FILES))) + $(filter $(srcdir)/%,$(DRIVER_SOURCE_FILES)) \ + $(addprefix $(srcdir)/,$(filter-out $(srcdir)/%, \ + $(filter-out /%,$(DRIVER_SOURCE_FILES)))) check-aclrules: $(AM_V_GEN)$(PERL) $(srcdir)/check-aclrules.pl \ - $(addprefix $(srcdir)/,$(filter-out /%,$(REMOTE_PROTOCOL))) \ + $(REMOTE_PROTOCOL) \ $(addprefix $(srcdir)/,$(filter-out /%,$(STATEFUL_DRIVER_SOURCE_FILES))) EXTRA_DIST += check-driverimpls.pl check-aclrules.pl -- 1.8.3.1

1 0

[libvirt] [PATCH] python: Drop TODO
by Cole Robinson 29 Jul '13

29 Jul '13

File hasn't been really touched for 7 years. And with recent rawhide changes it contributed to an RPM build failure. Let's drop it. This also removes installation of a libvirt-python doc dir, so drop handling of it from the RPM spec. --- libvirt.spec.in | 7 ------- python/Makefile.am | 7 ------- python/TODO | 6 ------ 3 files changed, 20 deletions(-) delete mode 100644 python/TODO diff --git a/libvirt.spec.in b/libvirt.spec.in index e0e0004..81101e8 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1440,12 +1440,6 @@ rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/libvirtd_lxc.aug rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_lxc.aug %endif -%if ! %{with_python} -rm -rf $RPM_BUILD_ROOT%{_datadir}/doc/libvirt-python-%{version} -%else -rm -rf $RPM_BUILD_ROOT%{_datadir}/doc/libvirt-python-%{version}/examples -%endif - %if ! %{with_qemu} rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu.conf rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/libvirtd.qemu @@ -2060,7 +2054,6 @@ fi %{_libdir}/python*/site-packages/libvirt_lxc.py* %{_libdir}/python*/site-packages/libvirtmod* %doc python/tests/*.py -%doc python/TODO %doc examples/python %doc examples/domain-events/events-python %endif diff --git a/python/Makefile.am b/python/Makefile.am index 9e957d1..7eb42c6 100644 --- a/python/Makefile.am +++ b/python/Makefile.am @@ -31,10 +31,6 @@ INCLUDES = \ AM_CFLAGS = $(WARN_CFLAGS) -DOCS_DIR = $(datadir)/doc/libvirt-python-$(VERSION) - -DOCS = ${srcdir}/TODO - CLASSES_EXTRA = \ libvirt-override-virConnect.py \ libvirt-override-virDomain.py \ @@ -152,9 +148,6 @@ install-data-local: $(INSTALL) -m 0644 libvirt.py $(DESTDIR)$(pyexecdir) $(INSTALL) -m 0644 libvirt_lxc.py $(DESTDIR)$(pyexecdir) $(INSTALL) -m 0644 libvirt_qemu.py $(DESTDIR)$(pyexecdir) - $(mkinstalldirs) $(DESTDIR)$(DOCS_DIR) - @(for doc in $(DOCS) ; \ - do $(INSTALL) -m 0644 $$doc $(DESTDIR)$(DOCS_DIR) ; done) uninstall-local: rm -f $(DESTDIR)$(pyexecdir)/libvirt.py diff --git a/python/TODO b/python/TODO deleted file mode 100644 index 4627482..0000000 --- a/python/TODO +++ /dev/null @@ -1,6 +0,0 @@ -- Need to complete, add custom wrapper function for those - which could not be handled fully automatically -- Check the names generated, iD is bad, fix the name generation routine -- add examples, web page and python based test suite - -Daniel Veillard -- 1.8.3.1

2 2

[libvirt] [PATCH 0/3] qemu: libvirt RDMA live migration support
by mrhines＠linux.vnet.ibm.com 29 Jul '13

29 Jul '13

From: "Michael R. Hines" <mrhines(a)us.ibm.com> QEMU has in tree now planned for 1.6 support for RDMA-based live migration. Changes to libvirt: 1. QEMU has a new 'setup' phase in their state machine. 2. Expose the 'x-rdma' migration protocol URI. 3. Expose the 'x-rdma-pin-all' capability for pre-registration of memory. Michael R. Hines (3): qemu: handle new 'setup' migration state qemu: RDMA migration support using 'x-rdma' URI qemu: memory pre-pinning support for RDMA migration include/libvirt/libvirt.h.in | 3 + src/qemu/qemu_capabilities.c | 7 +++ src/qemu/qemu_capabilities.h | 4 ++ src/qemu/qemu_command.c | 8 +++ src/qemu/qemu_migration.c | 131 ++++++++++++++++++++++++++++++++++++------ src/qemu/qemu_migration.h | 3 +- src/qemu/qemu_monitor.c | 7 ++- src/qemu/qemu_monitor.h | 13 +++++ src/qemu/qemu_monitor_json.c | 18 ++++++ tools/virsh-domain.c | 7 +++ 10 files changed, 178 insertions(+), 23 deletions(-) -- 1.7.10.4

5 15