- Devel - libvirt List Archives

[libvirt] [PATCH] domain controller index check
by jmiao＠redhat.com 09 Jul '13

09 Jul '13

From: Jincheng Miao <jmiao(a)redhat.com> The index of the controller should not be less than zero. So use virStrToLong_ui() to check the controller index in virDomainControllerDefParseXML(). --- src/conf/domain_conf.c | 2 +- src/conf/domain_conf.h | 2 +- src/qemu/qemu_command.c | 2 +- src/vmx/vmx.c | 3 +-- 4 files changed, 4 insertions(+), 5 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 402e6e9..2831edf 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -5593,7 +5593,7 @@ virDomainControllerDefParseXML(xmlNodePtr node, idx = virXMLPropString(node, "index"); if (idx) { - if (virStrToLong_i(idx, NULL, 10, &def->idx) < 0) { + if (virStrToLong_ui(idx, NULL, 10, &def->idx) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, _("Cannot parse controller index %s"), idx); goto error; diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index da83eb6..7897b4b 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -790,7 +790,7 @@ struct _virDomainVirtioSerialOpts { /* Stores the virtual disk controller configuration */ struct _virDomainControllerDef { int type; - int idx; + unsigned int idx; int model; /* -1 == undef */ unsigned int queues; union { diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 46db28a..7fd1cbf 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -1585,7 +1585,7 @@ qemuDomainAssignPCIAddresses(virDomainDefPtr def, for (i = 0; i < def->ncontrollers; i++) { if (def->controllers[i]->type == VIR_DOMAIN_CONTROLLER_TYPE_PCI) { - if (def->controllers[i]->idx > max_idx) + if ((int)def->controllers[i]->idx > max_idx) max_idx = def->controllers[i]->idx; } } diff --git a/src/vmx/vmx.c b/src/vmx/vmx.c index 5464d13..deddfaa 100644 --- a/src/vmx/vmx.c +++ b/src/vmx/vmx.c @@ -1664,8 +1664,7 @@ virVMXParseConfig(virVMXContext *ctx, for (controller = 0; controller < def->ncontrollers; ++controller) { if (def->controllers[controller]->type == VIR_DOMAIN_CONTROLLER_TYPE_SCSI) { - if (def->controllers[controller]->idx < 0 || - def->controllers[controller]->idx > 3) { + if (def->controllers[controller]->idx > 3) { virReportError(VIR_ERR_INTERNAL_ERROR, _("SCSI controller index %d out of [0..3] range"), def->controllers[controller]->idx); -- 1.7.1

3 2

[libvirt] [PATCH] scsi: Fix construction of sysfs device path
by Viktor Mihajlovski 09 Jul '13

09 Jul '13

The device bus value was used instead of the device target when building the sysfs device path. Trivial. Signed-off-by: Viktor Mihajlovski <mihajlov(a)linux.vnet.ibm.com> --- Should probably go into the 1.0.6 maintenance branch as well. src/util/virscsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/virscsi.c b/src/util/virscsi.c index 4870307..726121b 100644 --- a/src/util/virscsi.c +++ b/src/util/virscsi.c @@ -218,7 +218,7 @@ virSCSIDeviceNew(const char *adapter, goto cleanup; if (virAsprintf(&dev->name, "%d:%d:%d:%d", dev->adapter, - dev->bus, dev->bus, dev->unit) < 0 || + dev->bus, dev->target, dev->unit) < 0 || virAsprintf(&dev->sg_path, "/dev/%s", sg) < 0) { virReportOOMError(); goto cleanup; -- 1.7.9.5

2 1

[libvirt] [ANNOUNCE] libvirt-glib 0.1.7 release
by Daniel P. Berrange 08 Jul '13

08 Jul '13

I am pleased to announce that a new release of the libvirt-glib package, version 0.1.7, is now available from ftp://libvirt.org/libvirt/glib/ The packages are GPG signed with Key fingerprint: DAF3 A6FD B26B 6291 2D0E 8E3F BE86 EBB4 1510 4FDF (4096R) Changes in this release: - Fix memory leaks in domain memory setters - Add APIs for configuration sdl/rdp/desktop graphics modes - Add getter APIs for domain channel devices - Add getter APIs for storage pools - Add API for getting/setting virt type - Add getter APIs for storage pool schema - Add base framework for i18n of error messages - Fix annotation of gvir_init_object - Add getter/setter APIs for disk driver format - Add APIs for domain snapshot schema - Add APIs to access domain chardev source - Add API to access domain device aliases libvirt-glib comprises three distinct libraries: - libvirt-glib - Integrate with the GLib event loop and error handling - libvirt-gconfig - Representation of libvirt XML documents as GObjects - libvirt-gobject - Mapping of libvirt APIs into the GObject type system NB: While libvirt aims to be API/ABI stable forever, with libvirt-glib we are not yet guaranteeing that libvirt-glib libraries are API/ABI permanently stable. As of the 0.0.8 release, we have tentatively frozen the API/ABI with the intent of being longterm stable hereafter, but there is still a small chance we might find flaws requiring an API/ABI change. The likelihood of this is low, however, and we will strive to avoid it. Follow up comments about libvirt-glib should be directed to the regular libvir-list(a)redhat.com development list. Thanks to all the people involved in contributing to this release. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|

1 0

[libvirt] [PATCHv2 0/2] selinux: Always label FD's passed to qemu
by Peter Krempa 08 Jul '13

08 Jul '13

This second version just always creates the imagelabel field that will be used to label the passed FDs appropriately and always even if relabeling is not requested. The rest of the code paths are still relabeled only if relabeling is enabled. Peter Krempa (2): selinux: Cleanup coding style selinux: Always generate imagelabel src/security/security_selinux.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) -- 1.8.2.1

2 6

[libvirt] RFC: Introduce API to query IP addresses for given domain
by Nehal J. Wani 08 Jul '13

08 Jul '13

Hello, fellow developers! I am a GSoC candidate this year working for libvirt.org. My project is "Introduce API to query IP addresses for given domain". The discussion regarding this feature had started here: http://www.mail-archive.com/libvir-list@redhat.com/msg51857.html and then Michal had sent a patch too (refer: http://www.mail-archive.com/libvir-list@redhat.com/msg57141.html) But it was not pushed upstream due to lack of extensibility. So far I've come up with an API and I want to get your opinion before I start writing the rest so I don't follow the wrong direction. Following are the valid commands: domifaddr <domain-name> domifaddr <domain-name> <interface-name> domifaddr <domain-name> <interface-name> <method> domifaddr <domain-name> <method> methods: (i) Querying qemu-guest-agent (ii) Getting info from dnsmasq.leases file (iii) Using the nwfilter to snoop the traffic If no method is mentioned, qemu-guest-agent will be used. Previous attempts by Michal had used structs and xml. Structs bring in restrictions and xml has to be parsed. Hence I am not planning to continue with either of these. As a start, I would like to know your comments about my API which queries the qemu-guest-agent and returns the results in virTypedParameter **params. Format(JSON) in which the qemu guest agent returns info: [{"name":"lo", "ip-addresses": [{"ip-address-type":"ipv4","ip-address":"127.0.0.1","prefix":8}, {"ip-address-type":"ipv6","ip-address":"::1","prefix":128}], "hardware-address":"00:00:00:00:00:00"}, {"name":"eth0", "ip-addresses": [{"ip-address-type":"ipv4","ip-address":"192.168.122.42","prefix":24}, {"ip-address-type":"ipv6","ip-address":"fe80::5054:ff:fe09:d240","prefix":64}], "hardware-address":"52:54:00:09:d2:40"}] //Possible 1-D Structure (A little hassle to maintain) params[0] = {"iface-count",int,2} params[1] = {"iface-name",string,"lo"} params[2] = {"iface-hwaddr",string,"00:00:00:00:00:00"} params[3] = {"iface-addr-count",int,2} params[4] = {"iface-addr-type",string,"ipv4"} params[5] = {"iface-addr",string,"127.0.0.1"} params[6] = {"iface-addr-prefix",int,8} params[7] = {"iface-addr-type",string,"ipv6"} params[8] = {"iface-addr",string,"::1"} params[9] = {"iface-addr-prefix",int,128} .... .... .... //2D Structure: (Not very hasslefree, but easier to maintain as one interface per row) params[0] = {"iface-name",string,"lo"}{"iface-hwaddr",string,"00:00:00:00:00:00"}{"iface-addr-type",string,"ipv4"}{"iface-addr",string,"127.0.0.1"}{"iface-addr-prefix",int,8}{"iface-addr-type",string,"ipv6"}{"iface-addr",string,"::1"}{"iface-addr-prefix",int,128} params[1] = {"iface-name",string,"eth0"}{"iface-hwaddr",string,"52:54:00:09:d2:40"}{"iface-addr-type",string,"ipv4"}{"iface-addr",string,"192.168.122.42"}{"iface-addr-prefix",int,8}{"iface-addr-type",string,"ipv6"}{"iface-addr",string,"fe80::5054:ff:fe09:d240"}{"iface-addr-prefix",int,64} Function definitions that I intend to use are: static int remoteDispatchDomainInterfacesAddresses( virNetServerPtr server ATTRIBUTE_UNUSED, virNetServerClientPtr client, virNetMessagePtr msg ATTRIBUTE_UNUSED, virNetMessageErrorPtr rerr, remote_domain_interfaces_addresses_args *args, remote_domain_interfaces_addresses_ret *ret) int virDomainInterfacesAddresses (virDomainPtr dom, virTypedParameterPtr *params, int *nparams, unsigned int flags); typedef int (*virDrvDomainInterfacesAddresses) (virDomainPtr dom, virTypedParameterPtr *params, int *nparams, unsigned int flags); int virDomainInterfacesAddresses (virDomainPtr dom, virTypedParameterPtr *params, int *nparams, unsigned int flags) int qemuAgentGetInterfaces(qemuAgentPtr mon, virTypedParameterPtr *params, int *nparams) int qemuAgentGetInterfaces(qemuAgentPtr mon, virTypedParameterPtr *params, int *nparams); static int qemuDomainInterfacesAddresses(virDomainPtr dom, virTypedParameterPtr *params, int *nparams, unsigned int flags) static int remoteDomainInterfacesAddresses(virDomainPtr dom, virTypedParameterPtr *params, int *nparams, unsigned int flags) static bool cmdDomIfAddr(vshControl *ctl, const vshCmd *cmd) Also, It will be helpful to know whether we want the client to first query for the number of parameters and then send the request or have the server side allocate appropriate memory and return the result once in for all. In the latter case, I'll be using something of the kind virTypedParameterPtr ***params. Thanking You, Nehal J. Wani UG2, BTech CS+MS(CL) IIIT-Hyderabad http://commanlinewani.blogspot.com

4 8

[libvirt] [libvirt-1.0.5]deadlock in child process after call function backtrace, any suggestions is appreciate!
by Caizhifeng 08 Jul '13

08 Jul '13

Hi ALL, In order to catch the calltrace of deadlock in libvirtd, I modified the function virMutexLock as follows: struct virMutex { pthread_mutex_t lock; void *trace[TRACE_SIZE]; //added for test int ntrace; //added for test }; void virMutexLock(virMutexPtr m) { struct timespec ts; if (0 == clock_gettime(CLOCK_REALTIME, &ts)) { ts.tv_sec += LOCK_TIMEOUT; if (pthread_mutex_timedlock(&m->lock, &ts) == ETIMEDOUT) { if (m->ntrace > 0) virLogBacktrace(m->ntrace, m->trace); pthread_mutex_lock(&m->lock); } m->ntrace = backtrace(m->trace, TRACE_SIZE); //record the call trace information. } else { pthread_mutex_lock(&m->lock); } } The original is : void virMutexLock(virMutexPtr m){ pthread_mutex_lock(&m->lock); } But, unfortunatly, sometimes, deadlock happened in child process after virFork, the father libvirtd process' pid is 2987, and the child libvirtd process id is 29509, which is forked in order to run a shell script. root@cvk143:~# ps -ef | grep libvirtd root 2987 1 52 08:36 ? 00:40:38 /usr/sbin/libvirtd -d root 29509 2987 0 09:38 ? 00:00:00 /usr/sbin/libvirtd -d root@cvk143:~# the child process's call trace is as follow: (gdb) bt #0 0x00007f4d5e7fd89c in __lll_lock_wait () from /lib/x86_64-linux-gnu/libpthread.so.0 #1 0x00007f4d5e7f9080 in _L_lock_903 () from /lib/x86_64-linux-gnu/libpthread.so.0 #2 0x00007f4d5e7f8f19 in pthread_mutex_lock () from /lib/x86_64-linux-gnu/libpthread.so.0 #3 0x00007f4d5e5607db in dl_iterate_phdr () from /lib/x86_64-linux-gnu/libc.so.6 #4 0x00007f4d5c3c88b6 in _Unwind_Find_FDE () from /lib/x86_64-linux-gnu/libgcc_s.so.1 #5 0x00007f4d5c3c5d70 in ?? () from /lib/x86_64-linux-gnu/libgcc_s.so.1 #6 0x00007f4d5c3c6490 in ?? () from /lib/x86_64-linux-gnu/libgcc_s.so.1 #7 0x00007f4d5c3c6d3e in _Unwind_Backtrace () from /lib/x86_64-linux-gnu/libgcc_s.so.1 #8 0x00007f4d5e53b1c8 in backtrace () from /lib/x86_64-linux-gnu/libc.so.6 #9 0x00007f4d5f6f8c92 in virMutexLock (m=0x7f4d5fadedc0) at util/virthreadpthread.c:128 #10 0x00007f4d5f6d0a3d in virLogLock () at util/virlog.c:152 #11 0x00007f4d5f6d0f66 in virLogReset () at util/virlog.c:311 #12 0x00007f4d5f6b3139 in virFork (pid=0x7f4d5a1a4310) at util/vircommand.c:281 #13 0x00007f4d5f6b3b06 in virExec (cmd=0x7f4d2000a6f0) at util/vircommand.c:493 #14 0x00007f4d5f6b8a34 in virCommandRunAsync (cmd=0x7f4d2000a6f0, pid=0x0) at util/vircommand.c:2340 #15 0x00007f4d5f6b815c in virCommandRun (cmd=0x7f4d2000a6f0, exitstatus=0x7f4d5a1a4728) at util/vircommand.c:2191 #16 0x00007f4d5f6b4bdd in virRun (argv=0x7f4d5a1a4730, status=0x7f4d5a1a4728) at util/vircommand.c:776 #17 0x00007f4d60231006 in virStorageNFSPoolCheckSub (hostName=0x7f4d50011630 "192.168.0.6", hostDir=0x7f4d50014560 "/vms/isos") at storage/storage_backend.c:165 #18 0x00007f4d602312fa in virStoragePoolCheckFirst (pool=0x7f4d5000dcc0) at storage/storage_backend.c:255 #19 0x00007f4d602383af in virStorageBackendFileSystemRefresh (conn=0x7f4d3c0010a0, pool=0x7f4d5000dcc0) at storage/storage_backend_fs.c:887 #20 0x00007f4d6022c458 in storagePoolRefresh (obj=0x7f4d200012e0, flags=0) at storage/storage_driver.c:1705 #21 0x00007f4d5f7ac445 in virStoragePoolRefresh (pool=0x7f4d200012e0, flags=0) at libvirt.c:12936 #22 0x00007f4d6015c62f in remoteDispatchStoragePoolRefresh (server=0x7f4d60bb4ec0, client=0x7f4d60bbc380, msg=0x7f4d60bbcae0, rerr=0x7f4d5a1a4af0, args=0x7f4d2000f0b0) at remote_dispatch.h:12867 #23 0x00007f4d6015c527 in remoteDispatchStoragePoolRefreshHelper (server=0x7f4d60bb4ec0, client=0x7f4d60bbc380, msg=0x7f4d60bbcae0, rerr=0x7f4d5a1a4af0, args=0x7f4d2000f0b0, ret=0x7f4d200144f0) at remote_dispatch.h:12845 #24 0x00007f4d5f7fe7d5 in virNetServerProgramDispatchCall (prog=0x7f4d60bbfc90, server=0x7f4d60bb4ec0, client=0x7f4d60bbc380, msg=0x7f4d60bbcae0) at rpc/virnetserverprogram.c:439 #25 0x00007f4d5f7fe34e in virNetServerProgramDispatch (prog=0x7f4d60bbfc90, server=0x7f4d60bb4ec0, client=0x7f4d60bbc380, msg=0x7f4d60bbcae0) at rpc/virnetserverprogram.c:305 #26 0x00007f4d5f7f72ea in virNetServerProcessMsg (srv=0x7f4d60bb4ec0, client=0x7f4d60bbc380, prog=0x7f4d60bbfc90, msg=0x7f4d60bbcae0) at rpc/virnetserver.c:162 #27 0x00007f4d5f7f73cd in virNetServerHandleJob (jobOpaque=0x7f4d60bbdbf0, opaque=0x7f4d60bb4ec0) at rpc/virnetserver.c:183 #28 0x00007f4d5f6f9602 in virThreadPoolWorker (opaque=0x7f4d60b9aa40) at util/virthreadpool.c:144 #29 0x00007f4d5f6f8fd6 in virThreadHelper (data=0x7f4d60b9a9b0) at util/virthreadpthread.c:212 #30 0x00007f4d5e7f6e9a in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0 #31 0x00007f4d5e5244bd in clone () from /lib/x86_64-linux-gnu/libc.so.6 #32 0x0000000000000000 in ?? () (gdb) .............. I googled and found the similar deadlock call trace,which can be found in this link: code.google.com/p/gperftools/issues/detail?id=66 , but it is not a situation in libvirtd. ...... Labels: -Priority-Medium Priority-Low Jan 22, 2013 #32 DarkAge...(a)gmail.com Please note the glibc unwinder also uses dl_iterate_phdr, and takes several locks during backtrace generation in _Unwind_Find_FDE. #0 0x00007ffff7bc6e80 in pthread_mutex_lock () from /lib/x86_64-linux-gnu/libpthread.so.0 #1 0x00007ffff7212fdb in dl_iterate_phdr () from /lib/x86_64-linux-gnu/libc.so.6 #2 0x00007ffff6be28b6 in _Unwind_Find_FDE () from /lib/libgcc_s.so.1 #3 0x00007ffff6bdfd70 in ?? () from /lib/libgcc_s.so.1 #4 0x00007ffff6be0d7d in _Unwind_Backtrace () from /lib/libgcc_s.so.1 #5 0x00007ffff71ed9c8 in backtrace () from /lib/x86_64-linux-gnu/libc.so.6 #6 0x000000000040fdb5 in glibc_backtrace (error=<synthetic pointer>, buffer=0x7fffffffdd10, size=<optimized out>, ucontext=<optimized out>) ...... Is there anyone ever encouter the similar problem? Would be great if someone can help me on this. Thank you very much. ------------------------------------------------------------------------------------------------------------------------------------- 本邮件及其附件含有杭州华三通信技术有限公司的保密信息，仅限于发送给上面地址中列出的个人或群组。禁止任何其他人以任何形式使用（包括但不限于全部或部分地泄露、复制、或散发）本邮件中的信息。如果您错收了本邮件，请您立即电话或邮件通知发件人并删除本邮件！ This e-mail and its attachments contain confidential information from H3C, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient(s) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!

3 2

[libvirt] attach-device error: XML error: unknown device type
by Chris Evich 08 Jul '13

08 Jul '13

Hi, On Fedora 18 (libvirt 0.10.2.6-1) I'm trying to add a new serial device to a KVM VM with: virsh attach-device foobar /tmp/serial.xml and I keep getting: error: Failed to attach device from /tmp/serial.xml error: XML error: unknown device type with serial.xml: <serial type='file'> <source path='/tmp/serialfile'/> <target port='1'/> </serial> Though I tried it w/o the <target> tag, with and without the --config flag, and with and without the guest running. Assuming it's similar, I tried and was successful in adding this device via virt-manager, though it complains if the VM is running (which is fine). What am I doing wrong with the virsh attach-device command or XML? Thanks in advance. -- Chris Evich, RHCA, RHCE, RHCDS, RHCSS Quality Assurance Engineer e-mail: cevich + `@' + redhat.com o: 1-888-RED-HAT1 x44214

5 11

[libvirt] [PATCH v1 00/37] Remove virReportOOMError from almost everywhere
by Michal Privoznik 08 Jul '13

08 Jul '13

Make VIR_ALLOC, virAsprintf and friend to report OOM error and subsequently adapt the code. Patches available at: git://gitorious.org/~zippy2/libvirt/michal-staging.git branch oom1 Michal Privoznik (37): viralloc: Report OOM error on failure Introduce OOM reporting to virAsprintf Adapt to VIR_ALLOC and virAsprintf in docs/ Adapt to VIR_ALLOC and virAsprintf in daemon/* Adapt to VIR_ALLOC and virAsprintf in src/access/* Adapt to VIR_ALLOC and virAsprintf in src/conf/* Adapt to VIR_ALLOC and virAsprintf in src/cpu/* Adapt to VIR_ALLOC and virAsprintf in src/esx/* Adapt to VIR_ALLOC and virAsprintf in src/hyperv/* Adapt to VIR_ALLOC and virAsprintf in src/interface/* Adapt to VIR_ALLOC and virAsprintf in src/libxl/* Adapt to VIR_ALLOC and virAsprintf in src/locking/* Adapt to VIR_ALLOC and virAsprintf in src/lxc/* Adapt to VIR_ALLOC and virAsprintf in src/node_device/* Adapt to VIR_ALLOC and virAsprintf in src/network/* Adapt to VIR_ALLOC and virAsprintf in src/nwfilter/* Adapt to VIR_ALLOC and virAsprintf in src/openvz/* Adapt to VIR_ALLOC and virAsprintf in src/parallels/* Adapt to VIR_ALLOC and virAsprintf in src/phyp/* Adapt to VIR_ALLOC and virAsprintf in src/qemu/* Adapt to VIR_ALLOC and virAsprintf in src/remote/* Adapt to VIR_ALLOC and virAsprintf in src/rpc/* Adapt to VIR_ALLOC and virAsprintf in src/secret/* Adapt to VIR_ALLOC and virAsprintf in src/security/* Adapt to VIR_ALLOC and virAsprintf in src/storage/* Adapt to VIR_ALLOC and virAsprintf in src/test/* Adapt to VIR_ALLOC and virAsprintf in src/uml/* Adapt to VIR_ALLOC and virAsprintf in src/util/* Adapt to VIR_ALLOC and virAsprintf in src/vbox/* Adapt to VIR_ALLOC and virAsprintf in src/vmware/* Adapt to VIR_ALLOC and virAsprintf in src/vmx/* Adapt to VIR_ALLOC and virAsprintf in src/xen/* Adapt to VIR_ALLOC and virAsprintf in src/xenapi/* Adapt to VIR_ALLOC and virAsprintf in src/xenxs/* Adapt to VIR_ALLOC and virAsprintf in src/* Adapt to VIR_ALLOC and virAsprintf in tests/* Adapt to VIR_ALLOC and virAsprintf in tools/* HACKING | 20 +- cfg.mk | 2 +- daemon/libvirtd-config.c | 12 +- daemon/libvirtd.c | 24 +- daemon/remote.c | 234 +++++--------------- daemon/stream.c | 4 +- docs/hacking.html.in | 20 +- po/POTFILES.in | 1 + python/libvirt-override.c | 102 ++++----- src/access/viraccessdriverpolkit.c | 4 +- src/access/viraccessdriverstack.c | 4 +- src/access/viraccessmanager.c | 4 +- src/conf/cpu_conf.c | 34 +-- src/conf/domain_audit.c | 36 +-- src/conf/domain_conf.c | 337 +++++++++------------------- src/conf/domain_event.c | 30 +-- src/conf/interface_conf.c | 35 +-- src/conf/netdev_bandwidth_conf.c | 12 +- src/conf/netdev_vlan_conf.c | 4 +- src/conf/netdev_vport_profile_conf.c | 4 +- src/conf/network_conf.c | 120 +++------- src/conf/node_device_conf.c | 29 +-- src/conf/nwfilter_conf.c | 33 +-- src/conf/nwfilter_ipaddrmap.c | 8 +- src/conf/nwfilter_params.c | 35 +-- src/conf/secret_conf.c | 4 +- src/conf/snapshot_conf.c | 47 ++-- src/conf/storage_conf.c | 38 +--- src/conf/storage_encryption_conf.c | 12 +- src/conf/virchrdev.c | 12 +- src/cpu/cpu.c | 4 +- src/cpu/cpu_arm.c | 6 +- src/cpu/cpu_generic.c | 12 +- src/cpu/cpu_powerpc.c | 20 +- src/cpu/cpu_s390.c | 4 +- src/cpu/cpu_x86.c | 86 +++----- src/driver.c | 4 +- src/esx/esx_driver.c | 62 ++---- src/esx/esx_network_driver.c | 16 +- src/esx/esx_storage_backend_iscsi.c | 4 +- src/esx/esx_storage_backend_vmfs.c | 78 ++----- src/esx/esx_util.c | 4 +- src/esx/esx_vi.c | 50 ++--- src/esx/esx_vi.h | 3 +- src/esx/esx_vi_types.c | 3 +- src/fdstream.c | 4 +- src/hyperv/hyperv_driver.c | 21 +- src/hyperv/hyperv_util.c | 4 +- src/hyperv/hyperv_wmi.c | 8 +- src/interface/interface_backend_netcf.c | 19 +- src/interface/interface_backend_udev.c | 33 +-- src/libvirt.c | 21 +- src/libvirt_private.syms | 4 +- src/libxl/libxl_conf.c | 18 +- src/libxl/libxl_driver.c | 46 +--- src/locking/lock_daemon.c | 33 +-- src/locking/lock_daemon_config.c | 8 +- src/locking/lock_driver_lockd.c | 23 +- src/locking/lock_driver_sanlock.c | 28 +-- src/locking/lock_manager.c | 16 +- src/lxc/lxc_cgroup.c | 4 +- src/lxc/lxc_conf.c | 5 +- src/lxc/lxc_container.c | 77 ++----- src/lxc/lxc_controller.c | 50 +---- src/lxc/lxc_driver.c | 92 ++------ src/lxc/lxc_fuse.c | 12 +- src/lxc/lxc_monitor.c | 4 +- src/lxc/lxc_process.c | 32 +-- src/network/bridge_driver.c | 138 ++++-------- src/node_device/node_device_driver.c | 4 +- src/node_device/node_device_udev.c | 18 +- src/nodeinfo.c | 58 ++--- src/nwfilter/nwfilter_dhcpsnoop.c | 29 +-- src/nwfilter/nwfilter_driver.c | 13 +- src/nwfilter/nwfilter_ebiptables_driver.c | 46 ++-- src/nwfilter/nwfilter_gentech_driver.c | 24 +- src/nwfilter/nwfilter_learnipaddr.c | 12 +- src/openvz/openvz_conf.c | 42 ++-- src/openvz/openvz_driver.c | 10 +- src/parallels/parallels_driver.c | 65 ++---- src/parallels/parallels_network.c | 24 +- src/parallels/parallels_storage.c | 50 ++--- src/parallels/parallels_utils.c | 4 +- src/phyp/phyp_driver.c | 95 ++------ src/qemu/qemu_agent.c | 42 ++-- src/qemu/qemu_capabilities.c | 69 ++---- src/qemu/qemu_cgroup.c | 4 +- src/qemu/qemu_command.c | 355 ++++++++++-------------------- src/qemu/qemu_conf.c | 88 +++----- src/qemu/qemu_domain.c | 50 ++--- src/qemu/qemu_driver.c | 124 +++-------- src/qemu/qemu_hotplug.c | 84 ++----- src/qemu/qemu_migration.c | 94 +++----- src/qemu/qemu_monitor.c | 33 +-- src/qemu/qemu_monitor_json.c | 118 +++------- src/qemu/qemu_monitor_text.c | 233 +++++--------------- src/qemu/qemu_process.c | 70 ++---- src/remote/remote_driver.c | 107 +++------ src/rpc/gendispatch.pl | 8 +- src/rpc/virnetclient.c | 26 +-- src/rpc/virnetclientprogram.c | 12 +- src/rpc/virnetclientstream.c | 4 +- src/rpc/virnetmessage.c | 24 +- src/rpc/virnetserver.c | 23 +- src/rpc/virnetserverclient.c | 19 +- src/rpc/virnetservermdns.c | 20 +- src/rpc/virnetserverprogram.c | 8 +- src/rpc/virnetserverservice.c | 12 +- src/rpc/virnetsocket.c | 8 +- src/rpc/virnetsshsession.c | 21 +- src/rpc/virnettlscontext.c | 26 +-- src/secret/secret_driver.c | 49 +---- src/security/security_apparmor.c | 25 +-- src/security/security_dac.c | 12 +- src/security/security_manager.c | 12 +- src/security/security_selinux.c | 45 ++-- src/security/security_stack.c | 8 +- src/storage/storage_backend.c | 35 +-- src/storage/storage_backend_disk.c | 17 +- src/storage/storage_backend_fs.c | 31 +-- src/storage/storage_backend_iscsi.c | 27 +-- src/storage/storage_backend_logical.c | 48 +--- src/storage/storage_backend_mpath.c | 20 +- src/storage/storage_backend_rbd.c | 18 +- src/storage/storage_backend_scsi.c | 21 +- src/storage/storage_backend_sheepdog.c | 4 +- src/storage/storage_driver.c | 23 +- src/test/test_driver.c | 91 +++----- src/uml/uml_conf.c | 28 +-- src/uml/uml_driver.c | 36 +-- src/util/iohelper.c | 4 +- src/util/viralloc.c | 165 ++++++++++++-- src/util/viralloc.h | 213 ++++++++++++++---- src/util/virauth.c | 6 +- src/util/virauthconfig.c | 16 +- src/util/virbuffer.c | 8 +- src/util/vircgroup.c | 13 +- src/util/vircommand.c | 13 +- src/util/virconf.c | 10 +- src/util/virdnsmasq.c | 53 ++--- src/util/virerror.c | 6 +- src/util/vireventpoll.c | 4 +- src/util/virfile.c | 34 +-- src/util/virhash.c | 11 +- src/util/viridentity.c | 4 +- src/util/virinitctl.c | 4 +- src/util/viriptables.c | 11 +- src/util/virkeyfile.c | 4 +- src/util/virlockspace.c | 37 +--- src/util/virlog.c | 2 +- src/util/virnetdev.c | 45 +--- src/util/virnetdevbandwidth.c | 21 +- src/util/virnetdevbridge.c | 8 +- src/util/virnetdevmacvlan.c | 6 +- src/util/virnetdevopenvswitch.c | 18 +- src/util/virnetdevtap.c | 8 +- src/util/virnetdevveth.c | 8 +- src/util/virnetdevvlan.c | 4 +- src/util/virnetdevvportprofile.c | 4 +- src/util/virnetlink.c | 8 +- src/util/virobject.c | 8 +- src/util/virpci.c | 96 ++------ src/util/virportallocator.c | 1 - src/util/virprocess.c | 17 +- src/util/virrandom.c | 9 +- src/util/virscsi.c | 28 +-- src/util/virsexpr.c | 4 +- src/util/virsocketaddr.c | 6 +- src/util/virstoragefile.c | 32 +-- src/util/virstring.c | 44 ++-- src/util/virstring.h | 67 +++++- src/util/virsysinfo.c | 22 +- src/util/virthreadpool.c | 21 +- src/util/virthreadpthread.c | 2 +- src/util/virtime.c | 8 +- src/util/virtpm.c | 4 +- src/util/virtypedparam.c | 68 ++---- src/util/viruri.c | 12 +- src/util/virusb.c | 13 +- src/util/virutil.c | 107 +++------ src/util/virxml.c | 1 - src/vbox/vbox_MSCOMGlue.c | 8 +- src/vbox/vbox_XPCOMCGlue.c | 4 +- src/vbox/vbox_tmpl.c | 126 +++-------- src/vmware/vmware_conf.c | 33 +-- src/vmware/vmware_driver.c | 4 +- src/vmx/vmx.c | 92 ++------ src/xen/block_stats.c | 8 +- src/xen/xen_driver.c | 42 +--- src/xen/xen_hypervisor.c | 17 +- src/xen/xen_inotify.c | 4 +- src/xen/xend_internal.c | 38 +--- src/xen/xm_internal.c | 24 +- src/xen/xs_internal.c | 24 +- src/xenapi/xenapi_driver.c | 29 +-- src/xenapi/xenapi_utils.c | 11 +- src/xenxs/xen_sxpr.c | 112 ++++------ src/xenxs/xen_xm.c | 204 ++++++++--------- tests/commandhelper.c | 1 + tests/commandtest.c | 8 +- tests/domainsnapshotxml2xmltest.c | 2 + tests/fchosttest.c | 2 + tests/interfacexml2xmltest.c | 2 + tests/libvirtdconftest.c | 4 +- tests/lxcxml2xmltest.c | 2 + tests/networkxml2conftest.c | 2 + tests/networkxml2xmltest.c | 2 + tests/nodedevxml2xmltest.c | 2 + tests/nodeinfotest.c | 2 + tests/nwfilterxml2xmltest.c | 2 + tests/qemuargv2xmltest.c | 2 + tests/qemuhelptest.c | 2 + tests/qemumonitortestutils.c | 17 +- tests/qemuxml2xmltest.c | 2 + tests/securityselinuxlabeltest.c | 21 +- tests/securityselinuxtest.c | 8 +- tests/sexpr2xmltest.c | 2 + tests/storagepoolxml2xmltest.c | 2 + tests/storagevolxml2argvtest.c | 2 + tests/storagevolxml2xmltest.c | 2 + tests/sysinfotest.c | 2 + tests/test_conf.c | 2 +- tests/virbuftest.c | 2 + tests/virhashtest.c | 2 + tests/virnetmessagetest.c | 20 +- tests/virshtest.c | 2 + tests/virstoragetest.c | 5 +- tests/xencapstest.c | 2 + tests/xmconfigtest.c | 2 + tests/xml2sexprtest.c | 2 + tools/console.c | 6 +- tools/virsh-domain-monitor.c | 4 +- tools/virsh-domain.c | 28 +-- tools/virsh.c | 1 - tools/virt-host-validate-common.c | 2 + 235 files changed, 2373 insertions(+), 4941 deletions(-) -- 1.8.1.5

5 77

[libvirt] [PATCH] Resolve Coverity complaints in tests/securityselinuxlabeltest.c
by John Ferlan 08 Jul '13

08 Jul '13

Two complaints of RESOURCE_FREE due to going to cleanup prior to a VIR_FREE(line). Two complaints of FORWARD_NULL due to 'tmp' being accessed after a strchr() without first checking if the return was NULL. While looking at the code it seems that 'line' need only be allocated once as the while loop will keep reading into line until eof causing an unreported leak since line was never VIR_FREE()'d at the bottom of the loop. --- tests/securityselinuxlabeltest.c | 30 +++++++++++++++++++----------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/tests/securityselinuxlabeltest.c b/tests/securityselinuxlabeltest.c index 5ae4f57..d2ba49b 100644 --- a/tests/securityselinuxlabeltest.c +++ b/tests/securityselinuxlabeltest.c @@ -79,6 +79,7 @@ testSELinuxLoadFileList(const char *testname, int ret = -1; char *path = NULL; FILE *fp = NULL; + char *line = NULL; *files = NULL; *nfiles = 0; @@ -93,37 +94,43 @@ testSELinuxLoadFileList(const char *testname, goto cleanup; } + if (VIR_ALLOC_N(line, 1024) < 0) { + virReportOOMError(); + goto cleanup; + } + while (!feof(fp)) { - char *line; - char *file, *context; - if (VIR_ALLOC_N(line, 1024) < 0) { - virReportOOMError(); - goto cleanup; - } + char *file, *context, *tmp; if (!fgets(line, 1024, fp)) { if (!feof(fp)) goto cleanup; break; } - char *tmp = strchr(line, ';'); + tmp = strchr(line, ';'); + if (!tmp) { + virReportError(VIR_ERR_INTERNAL_ERROR, + "unexpected format for line '%s'", + line); + goto cleanup; + } *tmp = '\0'; tmp++; - if (virAsprintf(&file, "%s/securityselinuxlabeldata%s", abs_builddir, line) < 0) { - VIR_FREE(line); + if (virAsprintf(&file, "%s/securityselinuxlabeldata%s", + abs_builddir, line) < 0) { virReportOOMError(); goto cleanup; } if (*tmp != '\0' && *tmp != '\n') { if (VIR_STRDUP(context, tmp) < 0) { - VIR_FREE(line); VIR_FREE(file); goto cleanup; } tmp = strchr(context, '\n'); - *tmp = '\0'; + if (tmp) + *tmp = '\0'; } else { context = NULL; } @@ -142,6 +149,7 @@ testSELinuxLoadFileList(const char *testname, cleanup: VIR_FORCE_FCLOSE(fp); VIR_FREE(path); + VIR_FREE(line); return ret; } -- 1.8.1.4

2 2

[libvirt] [PATCH 0/3] qemu: Make setting memory limits consistent
by Jiri Denemark 08 Jul '13

08 Jul '13

We need to set memory limits in several cases: - when setting hard_limit in memory cgroup - when starting a domain with a VFIO PCI device attached - when hotplugging a VFIO PCI device - when memoryBacking/locked is used This series makes use of a shared code to compute the limits in all of those cases. Jiri Denemark (3): qemu: Move memory limit computation to a reusable function qemu: Use qemuDomainMemoryLimit when computing memory for VFIO qemu: Set RLIMIT_MEMLOCK when memoryBacking/locked is used src/qemu/qemu_cgroup.c | 21 ++------------------- src/qemu/qemu_command.c | 18 ++++++++---------- src/qemu/qemu_domain.c | 45 +++++++++++++++++++++++++++++++++++++++++++++ src/qemu/qemu_domain.h | 2 ++ src/qemu/qemu_hotplug.c | 18 ++++++++---------- 5 files changed, 65 insertions(+), 39 deletions(-) -- 1.8.2.1

4 12

[libvirt] [PATCH] Don't spam logs with "port 0 must be in range" errors
by Jiri Denemark 08 Jul '13

08 Jul '13

Whenever virPortAllocatorRelease is called with port == 0, it complains that the port is not in an allowed range, which is expectable as the port was never allocated. Let's make virPortAllocatorRelease ignore 0 ports in a similar way free() ignores NULL pointers. --- src/qemu/qemu_migration.c | 4 ++-- src/qemu/qemu_process.c | 27 +++++++++++---------------- src/util/virportallocator.c | 4 ++++ 3 files changed, 17 insertions(+), 18 deletions(-) diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 6b488ca..a6b7acb 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -1159,7 +1159,7 @@ qemuMigrationStartNBDServer(virQEMUDriverPtr driver, cleanup: VIR_FREE(diskAlias); - if ((ret < 0) && port) + if (ret < 0) virPortAllocatorRelease(driver->remotePorts, port); return ret; } @@ -2448,7 +2448,7 @@ cleanup: virObjectUnlock(vm); else qemuDomainRemoveInactive(driver, vm); - if (ret < 0 && priv->nbdPort) { + if (ret < 0) { virPortAllocatorRelease(driver->remotePorts, priv->nbdPort); priv->nbdPort = 0; } diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 114e885..f8c652f 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -3368,8 +3368,7 @@ qemuProcessSPICEAllocatePorts(virQEMUDriverPtr driver, return 0; error: - if (port) - virPortAllocatorRelease(driver->remotePorts, port); + virPortAllocatorRelease(driver->remotePorts, port); return -1; } @@ -4093,10 +4092,8 @@ void qemuProcessStop(virQEMUDriverPtr driver, } } - if (priv->nbdPort) { - virPortAllocatorRelease(driver->remotePorts, priv->nbdPort); - priv->nbdPort = 0; - } + virPortAllocatorRelease(driver->remotePorts, priv->nbdPort); + priv->nbdPort = 0; if (priv->agent) { qemuAgentClose(priv->agent); @@ -4217,20 +4214,18 @@ retry: virDomainGraphicsDefPtr graphics = vm->def->graphics[i]; if (graphics->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC) { if (graphics->data.vnc.autoport) { - ignore_value(virPortAllocatorRelease(driver->remotePorts, - graphics->data.vnc.port)); - } - if (graphics->data.vnc.websocket) { - ignore_value(virPortAllocatorRelease(driver->webSocketPorts, - graphics->data.vnc.websocket)); + virPortAllocatorRelease(driver->remotePorts, + graphics->data.vnc.port); } + virPortAllocatorRelease(driver->webSocketPorts, + graphics->data.vnc.websocket); } if (graphics->type == VIR_DOMAIN_GRAPHICS_TYPE_SPICE && graphics->data.spice.autoport) { - ignore_value(virPortAllocatorRelease(driver->remotePorts, - graphics->data.spice.port)); - ignore_value(virPortAllocatorRelease(driver->remotePorts, - graphics->data.spice.tlsPort)); + virPortAllocatorRelease(driver->remotePorts, + graphics->data.spice.port); + virPortAllocatorRelease(driver->remotePorts, + graphics->data.spice.tlsPort); } } diff --git a/src/util/virportallocator.c b/src/util/virportallocator.c index c7be10f..0757966 100644 --- a/src/util/virportallocator.c +++ b/src/util/virportallocator.c @@ -166,6 +166,10 @@ int virPortAllocatorRelease(virPortAllocatorPtr pa, unsigned short port) { int ret = -1; + + if (!port) + return 0; + virObjectLock(pa); if (port < pa->start || -- 1.8.2.1

3 3

[libvirt] [PATCH] qemu: Release correct websocket port
by Jiri Denemark 08 Jul '13

08 Jul '13

--- src/qemu/qemu_process.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index df0ac72..114e885 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -4222,7 +4222,7 @@ retry: } if (graphics->data.vnc.websocket) { ignore_value(virPortAllocatorRelease(driver->webSocketPorts, - graphics->data.vnc.port)); + graphics->data.vnc.websocket)); } } if (graphics->type == VIR_DOMAIN_GRAPHICS_TYPE_SPICE && -- 1.8.2.1

2 2

[libvirt] [PATCH] Paused domain should remain paused after migration
by Jiri Denemark 08 Jul '13

08 Jul '13

https://bugzilla.redhat.com/show_bug.cgi?id=981139 If a domain is paused before migration starts, we need to tell that to the destination libvirtd to prevent it from resuming the domain at the end of migration. This regression was introduced by commit 5379bb0. --- src/libvirt.c | 22 +++++++++++++--------- src/qemu/qemu_migration.c | 9 ++++++--- 2 files changed, 19 insertions(+), 12 deletions(-) diff --git a/src/libvirt.c b/src/libvirt.c index bc1694a..8e19c64 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -4563,16 +4563,17 @@ virDomainMigrateVersion1(virDomainPtr domain, char *cookie = NULL; int cookielen = 0, ret; virDomainInfo info; - unsigned int destflags = flags & ~VIR_MIGRATE_ABORT_ON_ERROR; + unsigned int destflags; VIR_DOMAIN_DEBUG(domain, "dconn=%p, flags=%lx, dname=%s, uri=%s, bandwidth=%lu", dconn, flags, NULLSTR(dname), NULLSTR(uri), bandwidth); ret = virDomainGetInfo(domain, &info); - if (ret == 0 && info.state == VIR_DOMAIN_PAUSED) { + if (ret == 0 && info.state == VIR_DOMAIN_PAUSED) flags |= VIR_MIGRATE_PAUSED; - } + + destflags = flags & ~VIR_MIGRATE_ABORT_ON_ERROR; /* Prepare the migration. * @@ -4659,7 +4660,7 @@ virDomainMigrateVersion2(virDomainPtr domain, virErrorPtr orig_err = NULL; unsigned int getxml_flags = 0; int cancelled; - unsigned int destflags = flags & ~VIR_MIGRATE_ABORT_ON_ERROR; + unsigned long destflags; VIR_DOMAIN_DEBUG(domain, "dconn=%p, flags=%lx, dname=%s, uri=%s, bandwidth=%lu", @@ -4699,11 +4700,12 @@ virDomainMigrateVersion2(virDomainPtr domain, return NULL; ret = virDomainGetInfo(domain, &info); - if (ret == 0 && info.state == VIR_DOMAIN_PAUSED) { + if (ret == 0 && info.state == VIR_DOMAIN_PAUSED) flags |= VIR_MIGRATE_PAUSED; - } - VIR_DEBUG("Prepare2 %p flags=%lx", dconn, flags); + destflags = flags & ~VIR_MIGRATE_ABORT_ON_ERROR; + + VIR_DEBUG("Prepare2 %p flags=%lx", dconn, destflags); ret = dconn->driver->domainMigratePrepare2 (dconn, &cookie, &cookielen, uri, &uri_out, destflags, dname, bandwidth, dom_xml); @@ -4811,7 +4813,7 @@ virDomainMigrateVersion3Full(virDomainPtr domain, int cancelled = 1; unsigned long protection = 0; bool notify_source = true; - unsigned int destflags = flags & ~VIR_MIGRATE_ABORT_ON_ERROR; + unsigned int destflags; int state; virTypedParameterPtr tmp; @@ -4870,7 +4872,9 @@ virDomainMigrateVersion3Full(virDomainPtr domain, if (ret == 0 && state == VIR_DOMAIN_PAUSED) flags |= VIR_MIGRATE_PAUSED; - VIR_DEBUG("Prepare3 %p flags=%x", dconn, flags); + destflags = flags & ~VIR_MIGRATE_ABORT_ON_ERROR; + + VIR_DEBUG("Prepare3 %p flags=%x", dconn, destflags); cookiein = cookieout; cookieinlen = cookieoutlen; cookieout = NULL; diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 49e9e65..6b488ca 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -3503,7 +3503,7 @@ static int doPeer2PeerMigrate2(virQEMUDriverPtr driver, virErrorPtr orig_err = NULL; bool cancelled; virStreamPtr st = NULL; - unsigned int destflags = flags & ~VIR_MIGRATE_ABORT_ON_ERROR; + unsigned long destflags; VIR_DEBUG("driver=%p, sconn=%p, dconn=%p, vm=%p, dconnuri=%s, " "flags=%lx, dname=%s, resource=%lu", @@ -3522,6 +3522,8 @@ static int doPeer2PeerMigrate2(virQEMUDriverPtr driver, if (virDomainObjGetState(vm, NULL) == VIR_DOMAIN_PAUSED) flags |= VIR_MIGRATE_PAUSED; + destflags = flags & ~VIR_MIGRATE_ABORT_ON_ERROR; + VIR_DEBUG("Prepare2 %p", dconn); if (flags & VIR_MIGRATE_TUNNELLED) { /* @@ -3651,8 +3653,7 @@ doPeer2PeerMigrate3(virQEMUDriverPtr driver, virErrorPtr orig_err = NULL; bool cancelled = true; virStreamPtr st = NULL; - unsigned int destflags = flags & ~VIR_MIGRATE_ABORT_ON_ERROR; - + unsigned long destflags; virTypedParameterPtr params = NULL; int nparams = 0; int maxparams = 0; @@ -3705,6 +3706,8 @@ doPeer2PeerMigrate3(virQEMUDriverPtr driver, if (virDomainObjGetState(vm, NULL) == VIR_DOMAIN_PAUSED) flags |= VIR_MIGRATE_PAUSED; + destflags = flags & ~VIR_MIGRATE_ABORT_ON_ERROR; + VIR_DEBUG("Prepare3 %p", dconn); cookiein = cookieout; cookieinlen = cookieoutlen; -- 1.8.2.1

2 2

[libvirt] [PATCH] add checking index for pci-bridge controller
by Jincheng Miao 08 Jul '13

08 Jul '13

hi all, There is a bug here https://bugzilla.redhat.com/show_bug.cgi?id=981261 about controller configuration. For the pci-bridge controller, if index less than zero, there is no alert for it, and libvirt will pass this value to qemu-kvm. But qemu-kvm will report the argument error, like: "qemu-kvm: -device pci-bridge,chassis_nr=-1,id=pci.-1,bus=pci.0,addr=0x9: Parameter 'chassis_nr' expects uint8_t" So libvirt should check the arguments of controller. Here is my patch for pci-bridge： --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -5693,6 +5693,14 @@ virDomainControllerDefParseXML(xmlNodePtr node, "have an address")); goto error; } + case VIR_DOMAIN_CONTROLLER_MODEL_PCI_BRIDGE: + if (def->idx < 0) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("pci-bridge controller index invalid, should not " + "less than zero")); + goto error; + } + } And I also see qemuBuildControllerDevStr() in qemu_command.c case VIR_DOMAIN_CONTROLLER_MODEL_PCI_BRIDGE: if (def->idx == 0) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("PCI bridge index should be > 0")); goto error; } virBufferAsprintf(&buf, "pci-bridge,chassis_nr=%d,id=pci.%d", def->idx, def->idx); And if I modify it to "def->idx > 0", testsuite will fail. So why only check "def->idx == 0" ? Thanks and regards Jincheng Miao

2 2

[libvirt] [PATCH] usb: Correct test for virUSBDeviceListSteal
by Gonglei (Arei) 05 Jul '13

05 Jul '13

In the for loop, the if condition is always true, and will execute memmove. But it will cause the list->devs[i+1] overflow while i equals list->count-1. Signed-off-by: Gonglei <arei.gonglei(a)huawei.com> --- src/util/virusb.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/util/virusb.c b/src/util/virusb.c index d34e44f..30d0b12 100644 --- a/src/util/virusb.c +++ b/src/util/virusb.c @@ -497,7 +497,7 @@ virUSBDeviceListSteal(virUSBDeviceListPtr list, ret = list->devs[i]; - if (i != list->count--) + if (i != --list->count) memmove(&list->devs[i], &list->devs[i+1], sizeof(*list->devs) * (list->count - i)); -- 1.7.3.1 Best Regards, -Gonglei

2 3

[libvirt] [PATCH glib] Fix name of gvir_config_domain_chardev_source_pty_set_path
by Daniel P. Berrange 05 Jul '13

05 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> The method gvir_config_domain_chardev_source_pty_set_path was accidentally called gvir_config_domain_source_pty_set_path. This naming flaw in turn caused the introspection data to be incorrectly generated, putting a 'source_pty_set_path' method on the GVirConfigDomain object. --- libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.c | 4 ++-- libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.h | 4 ++-- libvirt-gconfig/libvirt-gconfig.sym | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.c b/libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.c index 278515c..d24385e 100644 --- a/libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.c +++ b/libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.c @@ -82,8 +82,8 @@ GVirConfigDomainChardevSourcePty *gvir_config_domain_chardev_source_pty_new_from return GVIR_CONFIG_DOMAIN_CHARDEV_SOURCE_PTY(object); } -void gvir_config_domain_source_pty_set_path(GVirConfigDomainChardevSourcePty *pty, - const char *path) +void gvir_config_domain_chardev_source_pty_set_path(GVirConfigDomainChardevSourcePty *pty, + const char *path) { g_return_if_fail(GVIR_CONFIG_IS_DOMAIN_CHARDEV_SOURCE_PTY(pty)); diff --git a/libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.h b/libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.h index 4e350e0..96e05bc 100644 --- a/libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.h +++ b/libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.h @@ -62,8 +62,8 @@ GType gvir_config_domain_chardev_source_pty_get_type(void); GVirConfigDomainChardevSourcePty *gvir_config_domain_chardev_source_pty_new(void); GVirConfigDomainChardevSourcePty *gvir_config_domain_chardev_source_pty_new_from_xml(const gchar *xml, GError **error); -void gvir_config_domain_source_pty_set_path(GVirConfigDomainChardevSourcePty *pty, - const char *path); +void gvir_config_domain_chardev_source_pty_set_path(GVirConfigDomainChardevSourcePty *pty, + const char *path); G_END_DECLS diff --git a/libvirt-gconfig/libvirt-gconfig.sym b/libvirt-gconfig/libvirt-gconfig.sym index ccddd88..f8c7cdd 100644 --- a/libvirt-gconfig/libvirt-gconfig.sym +++ b/libvirt-gconfig/libvirt-gconfig.sym @@ -66,7 +66,7 @@ LIBVIRT_GCONFIG_0.0.8 { gvir_config_domain_chardev_source_pty_get_type; gvir_config_domain_chardev_source_pty_new; gvir_config_domain_chardev_source_pty_new_from_xml; - gvir_config_domain_source_pty_set_path; + gvir_config_domain_chardev_source_pty_set_path; gvir_config_domain_chardev_source_spicevmc_get_type; gvir_config_domain_chardev_source_spicevmc_new; -- 1.8.2.1

2 1

[libvirt] libvirt & virtio_net - host.freeze@reset.domain
by poma 05 Jul '13

05 Jul '13

Hello people, libvirtd (libvirt) 1.0.5.2 virsh 1.0.5.2 virt-manager 0.10.0 Host: Linux localhost 3.9.8-300.fc19.x86_64 #1 SMP Thu Jun 27 19:24:23 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux Guest1: Linux localhost 3.9.8-300.fc19.i686.PAE #1 SMP Thu Jun 27 19:29:30 UTC 2013 i686 (none) Guest2: Linux localhost 3.9.8-300.fc19.x86_64 #1 SMP Thu Jun 27 19:24:23 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux Virtual NIC - source & model: macvtap/NAT/bridge & virtio(virtio_net) Host freeze at "virsh reset <domain>" or "virt-manager - Force Reset" Need kernel.sysrq or power reset. poma

2 3

[libvirt] virsh live migration w/o shared storage fails with error as vm is not running
by chandrashekar shastri 05 Jul '13

05 Jul '13

Hi All, We are testing the upstream KVM with : Kernel, Qemu, Libvirt, Virt-Manager is built from the source (git). kernel version : 3.9.0+ qemu version : QEMU emulator version 1.5.0 libvirt version : 1.0.5 virt-install : 0.600.3 I have followed the below steps to test the "Live migration w/o shared storage" feature : 1. Created the qemu-img create -f qcow2 vm.qcow2 12G on the destination host which is same as the source. 2. Started the guest on the source 3. Started the vncdisplay to monitor the guest 4. Initiated the migration "virsh migrate --live rhel64-64 qemu+ssh://9.126.89.202/system --verbose --copy-storage-all" 5. It started the copying the storage from souce to destination (conitinously monitored it was growing) 6. Guest on the destination was paused and was running on the source 7. At some point the VM on the source shutdown and got an error on the vnc display as " Viewport: write: Broken pipe (32)" and the VM on the destination was undefined. Below is the libvirt debug log, please let me with your comments. Debug log: -------------- When the copy operation started: 2013-06-12 14:49:43.640+0000: 1696: info : libvirt version: 1.0.5 2013-06-12 14:49:43.640+0000: 1696: debug : virGlobalInit:439 : register drivers 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterDriver:769 : driver=0x7f2a6a5cd6a0 name=Test 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterDriver:781 : registering Test as driver 0 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterNetworkDriver:616 : registering Test as network driver 0 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterInterfaceDriver:643 : registering Test as interface driver 0 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterStorageDriver:670 : registering Test as storage driver 0 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterNodeDeviceDriver:697 : registering Test as device driver 0 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterSecretDriver:724 : registering Test as secret driver 0 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterNWFilterDriver:751 : registering Test as network filter driver 0 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterDriver:769 : driver=0x7f2a6a5ced60 name=OPENVZ 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterDriver:781 : registering OPENVZ as driver 1 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterDriver:769 : driver=0x7f2a6a5cf340 name=VMWARE 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterDriver:781 : registering VMWARE as driver 2 2013-06-12 14:49:43.640+0000: 1696: debug : vboxRegister:131 : VBoxCGlueInit failed, using dummy driver 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterDriver:769 : driver=0x7f2a6a5cf920 name=VBOX 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterDriver:781 : registering VBOX as driver 3 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterNetworkDriver:616 : registering VBOX as network driver 1 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterStorageDriver:670 : registering VBOX as storage driver 1 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterDriver:769 : driver=0x7f2a6a5d3080 name=ESX 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterDriver:781 : registering ESX as driver 4 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterInterfaceDriver:643 : registering ESX as interface driver 1 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterNetworkDriver:616 : registering ESX as network driver 2 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterStorageDriver:670 : registering ESX as storage driver 2 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterNodeDeviceDriver:697 : registering ESX as device driver 1 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterSecretDriver:724 : registering ESX as secret driver 1 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterNWFilterDriver:751 : registering ESX as network filter driver 1 2013-06-12 14:49:43.640+0000: 1696: debug : parallelsRegister:2448 : Can't find prlctl command in the PATH env 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterDriver:769 : driver=0x7f2a6a5ce0a0 name=remote 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterDriver:781 : registering remote as driver 5 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterNetworkDriver:616 : registering remote as network driver 3 2013-06-12 14:49:43.640+0000: 1696: debug : virRegisterInterfaceDriver:643 : registering remote as interface driver 2 2013-06-12 14:49:43.641+0000: 1696: debug : virRegisterStorageDriver:670 : registering remote as storage driver 3 2013-06-12 14:49:43.641+0000: 1696: debug : virRegisterNodeDeviceDriver:697 : registering remote as device driver 2 2013-06-12 14:49:43.641+0000: 1696: debug : virRegisterSecretDriver:724 : registering remote as secret driver 2 2013-06-12 14:49:43.641+0000: 1696: debug : virRegisterNWFilterDriver:751 : registering remote as network filter driver 2 2013-06-12 14:49:43.641+0000: 1696: debug : virEventRegisterDefaultImpl:230 : registering default event implementation 2013-06-12 14:49:43.641+0000: 1696: debug : virEventPollAddHandle:111 : Used 0 handle slots, adding at least 10 more 2013-06-12 14:49:43.641+0000: 1696: debug : virEventPollInterruptLocked:712 : Skip interrupt, 0 0 2013-06-12 14:49:43.641+0000: 1696: debug : virEventPollAddHandle:136 : EVENT_POLL_ADD_HANDLE: watch=1 fd=5 events=1 cb=0x7f2a6a0c3070 opaque=(nil) ff=(nil) 2013-06-12 14:49:43.641+0000: 1696: debug : virEventRegisterImpl:203 : addHandle=0x7f2a6a0c3e50 updateHandle=0x7f2a6a0c3cd0 removeHandle=0x7f2a6a0c3550 addTimeout=0x7f2a6a0c36e0 updateTimeout=0x7f2a6a0c38f0 removeTimeout=0x7f2a6a0c3ac0 2013-06-12 14:49:43.641+0000: 1696: debug : virConnectOpenAuth:1452 : name=(null), auth=0x7f2a6a5cd600, flags=0 2013-06-12 14:49:43.641+0000: 1696: debug : virObjectNew:201 : OBJECT_NEW: obj=0x7f2a6b625450 classname=virConnect 2013-06-12 14:49:43.641+0000: 1696: debug : virObjectNew:201 : OBJECT_NEW: obj=0x7f2a6b625130 classname=virConnectCloseCallbackData 2013-06-12 14:49:43.641+0000: 1697: debug : virEventRunDefaultImpl:270 : running default event implementation 2013-06-12 14:49:43.641+0000: 1697: debug : virEventPollCleanupTimeouts:516 : Cleanup 0 2013-06-12 14:49:43.641+0000: 1696: debug : virConnectGetConfigFile:993 : Loading config file '/usr/local/etc/libvirt/libvirt.conf' 2013-06-12 14:49:43.641+0000: 1697: debug : virEventPollCleanupTimeouts:552 : Found 0 out of 0 timeout slots used, releasing 0 2013-06-12 14:49:43.641+0000: 1696: debug : virConfReadFile:767 : filename=/usr/local/etc/libvirt/libvirt.conf 2013-06-12 14:49:43.641+0000: 1697: debug : virEventPollCleanupHandles:564 : Cleanup 1 2013-06-12 14:49:43.641+0000: 1697: debug : virEventPollMakePollFDs:393 : Prepare n=0 w=1, f=5 e=1 d=0 2013-06-12 14:49:43.641+0000: 1696: debug : virFileClose:73 : Closed fd 7 2013-06-12 14:49:43.641+0000: 1697: debug : virEventPollCalculateTimeout:332 : Calculate expiry of 0 timers 2013-06-12 14:49:43.641+0000: 1697: debug : virEventPollCalculateTimeout:361 : Timeout at 0 due in -1 ms 2013-06-12 14:49:43.641+0000: 1696: debug : do_open:1171 : no name, allowing driver auto-select 2013-06-12 14:49:43.641+0000: 1696: debug : do_open:1213 : trying driver 0 (Test) ... 2013-06-12 14:49:43.641+0000: 1697: debug : virEventPollRunOnce:629 : EVENT_POLL_RUN: nhandles=1 timeout=-1 2013-06-12 14:49:43.641+0000: 1696: debug : do_open:1219 : driver 0 Test returned DECLINED 2013-06-12 14:49:43.641+0000: 1696: debug : do_open:1213 : trying driver 1 (OPENVZ) ... 2013-06-12 14:49:43.641+0000: 1696: debug : do_open:1219 : driver 1 OPENVZ returned DECLINED 2013-06-12 14:49:43.641+0000: 1696: debug : do_open:1213 : trying driver 2 (VMWARE) ... 2013-06-12 14:49:43.641+0000: 1696: debug : do_open:1219 : driver 2 VMWARE returned DECLINED 2013-06-12 14:49:43.641+0000: 1696: debug : do_open:1213 : trying driver 3 (VBOX) ... 2013-06-12 14:49:43.641+0000: 1696: debug : do_open:1219 : driver 3 VBOX returned DECLINED 2013-06-12 14:49:43.641+0000: 1696: debug : do_open:1213 : trying driver 4 (ESX) ... 2013-06-12 14:49:43.641+0000: 1696: debug : do_open:1219 : driver 4 ESX returned DECLINED 2013-06-12 14:49:43.641+0000: 1696: debug : do_open:1213 : trying driver 5 (remote) ... 2013-06-12 14:49:43.641+0000: 1696: debug : remoteConnectOpen:985 : Auto-probe remote URI 2013-06-12 14:49:43.641+0000: 1696: debug : doRemoteOpen:594 : proceeding with name = 2013-06-12 14:49:43.641+0000: 1696: debug : doRemoteOpen:603 : Connecting with transport 1 2013-06-12 14:49:43.641+0000: 1696: debug : doRemoteOpen:688 : Proceeding with sockname /usr/local/var/run/libvirt/libvirt-sock 2013-06-12 14:49:43.642+0000: 1696: debug : virNetSocketNew:155 : localAddr=0x7fffcba10510 remoteAddr=0x7fffcba105a0 fd=7 errfd=-1 pid=0 2013-06-12 14:49:43.642+0000: 1696: debug : virObjectNew:201 : OBJECT_NEW: obj=0x7f2a6b6282e0 classname=virNetSocket 2013-06-12 14:49:43.642+0000: 1696: debug : virNetSocketNew:205 : RPC_SOCKET_NEW: sock=0x7f2a6b6282e0 fd=7 errfd=-1 pid=0 localAddr=127.0.0.1;0, remoteAddr=127.0.0.1;0 2013-06-12 14:49:43.642+0000: 1696: debug : virObjectNew:201 : OBJECT_NEW: obj=0x7f2a6b628590 classname=virNetClient 2013-06-12 14:49:43.642+0000: 1696: debug : virNetClientNew:326 : RPC_CLIENT_NEW: client=0x7f2a6b628590 sock=0x7f2a6b6282e0 2013-06-12 14:49:43.642+0000: 1696: debug : virObjectRef:295 : OBJECT_REF: obj=0x7f2a6b628590 2013-06-12 14:49:43.642+0000: 1696: debug : virObjectRef:295 : OBJECT_REF: obj=0x7f2a6b6282e0 2013-06-12 14:49:43.642+0000: 1696: debug : virEventPollInterruptLocked:716 : Interrupting 2013-06-12 14:49:43.642+0000: 1696: debug : virEventPollAddHandle:136 : EVENT_POLL_ADD_HANDLE: watch=2 fd=7 events=1 cb=0x7f2a6a1db2e0 opaque=0x7f2a6b6282e0 ff=0x7f2a6a1db3a0 2013-06-12 14:49:43.642+0000: 1696: debug : virKeepAliveNew:196 : client=0x7f2a6b628590, interval=-1, count=0 2013-06-12 14:49:43.642+0000: 1696: debug : virObjectNew:201 : OBJECT_NEW: obj=0x7f2a6b628880 classname=virKeepAlive 2013-06-12 14:49:43.642+0000: 1696: debug : virKeepAliveNew:215 : RPC_KEEPALIVE_NEW: ka=0x7f2a6b628880 client=0x7f2a6b628590 2013-06-12 14:49:43.642+0000: 1696: debug : virObjectRef:295 : OBJECT_REF: obj=0x7f2a6b628590 2013-06-12 14:49:43.642+0000: 1696: debug : virObjectRef:295 : OBJECT_REF: obj=0x7f2a6b625130 2013-06-12 14:49:43.642+0000: 1696: debug : virObjectNew:201 : OBJECT_NEW: obj=0x7f2a6b6287a0 classname=virNetClientProgram 2013-06-12 14:49:43.642+0000: 1696: debug : virObjectNew:201 : OBJECT_NEW: obj=0x7f2a6b6284b0 classname=virNetClientProgram 2013-06-12 14:49:43.642+0000: 1696: debug : virObjectNew:201 : OBJECT_NEW: obj=0x7f2a6b6280b0 classname=virNetClientProgram 2013-06-12 14:49:43.642+0000: 1696: debug : virObjectRef:295 : OBJECT_REF: obj=0x7f2a6b6287a0 2013-06-12 14:49:43.642+0000: 1696: debug : virObjectRef:295 : OBJECT_REF: obj=0x7f2a6b6284b0 2013-06-12 14:49:43.642+0000: 1696: debug : virObjectRef:295 : OBJECT_REF: obj=0x7f2a6b6280b0 2013-06-12 14:49:43.642+0000: 1696: debug : doRemoteOpen:798 : Trying authentication 2013-06-12 14:49:43.642+0000: 1696: debug : virNetMessageNew:45 : msg=0x7f2a6b628db0 tracked=0 2013-06-12 14:49:43.642+0000: 1696: debug : virNetMessageEncodePayload:382 : Encode length as 28 2013-06-12 14:49:43.642+0000: 1696: debug : virNetClientSendInternal:1961 : RPC_CLIENT_MSG_TX_QUEUE: client=0x7f2a6b628590 len=28 prog=536903814 vers=1 proc=66 type=0 status=0 serial=0 2013-06-12 14:49:43.642+0000: 1696: debug : virNetClientCallNew:1914 : New call 0x7f2a6b624f30: msg=0x7f2a6b628db0, expectReply=1, nonBlock=0 2013-06-12 14:49:43.642+0000: 1696: debug : virNetClientIO:1721 : Outgoing message prog=536903814 version=1 serial=0 proc=66 type=0 length=28 dispatch=(nil) 2013-06-12 14:49:43.642+0000: 1696: debug : virNetClientIO:1780 : We have the buck head=0x7f2a6b624f30 call=0x7f2a6b624f30 2013-06-12 14:49:43.642+0000: 1696: debug : virEventPollUpdateHandle:147 : EVENT_POLL_UPDATE_HANDLE: watch=2 events=0 2013-06-12 14:49:43.642+0000: 1696: debug : virEventPollInterruptLocked:716 : Interrupting 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollRunOnce:640 : Poll got 1 event(s) 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollDispatchTimeouts:425 : Dispatch 0 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollDispatchHandles:470 : Dispatch 1 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollDispatchHandles:484 : i=0 w=1 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollDispatchHandles:498 : EVENT_POLL_DISPATCH_HANDLE: watch=1 events=1 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollCleanupTimeouts:516 : Cleanup 0 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollCleanupTimeouts:552 : Found 0 out of 0 timeout slots used, releasing 0 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollCleanupHandles:564 : Cleanup 2 2013-06-12 14:49:43.642+0000: 1697: debug : virEventRunDefaultImpl:270 : running default event implementation 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollCleanupTimeouts:516 : Cleanup 0 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollCleanupTimeouts:552 : Found 0 out of 0 timeout slots used, releasing 0 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollCleanupHandles:564 : Cleanup 2 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollMakePollFDs:393 : Prepare n=0 w=1, f=5 e=1 d=0 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollMakePollFDs:393 : Prepare n=1 w=2, f=7 e=0 d=0 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollCalculateTimeout:332 : Calculate expiry of 0 timers 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollCalculateTimeout:361 : Timeout at 0 due in -1 ms 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollRunOnce:629 : EVENT_POLL_RUN: nhandles=1 timeout=-1 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollRunOnce:640 : Poll got 1 event(s) 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollDispatchTimeouts:425 : Dispatch 0 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollDispatchHandles:470 : Dispatch 1 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollDispatchHandles:484 : i=0 w=1 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollDispatchHandles:498 : EVENT_POLL_DISPATCH_HANDLE: watch=1 events=1 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollCleanupTimeouts:516 : Cleanup 0 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollCleanupTimeouts:552 : Found 0 out of 0 timeout slots used, releasing 0 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollCleanupHandles:564 : Cleanup 2 2013-06-12 14:49:43.642+0000: 1697: debug : virEventRunDefaultImpl:270 : running default event implementation 2013-06-12 14:49:43.642+0000: 1697: debug : virEventPollCleanupTimeouts:516 : Cleanup 0 When the copy operation was stopped: 2013-06-12 14:59:33.443+0000: 1696: debug : virNetClientMarkClose:634 : client=0x7f2a6b628590, reason=3 2013-06-12 14:59:33.443+0000: 1696: debug : virEventPollRemoveHandle:180 : EVENT_POLL_REMOVE_HANDLE: watch=2 2013-06-12 14:59:33.443+0000: 1696: debug : virEventPollRemoveHandle:193 : mark delete 1 7 2013-06-12 14:59:33.443+0000: 1696: debug : virEventPollInterruptLocked:716 : Interrupting 2013-06-12 14:59:33.443+0000: 1696: debug : virNetClientIOEventLoopPassTheBuck:1427 : Giving up the buck (nil) 2013-06-12 14:59:33.443+0000: 1696: debug : virNetClientIOEventLoopPassTheBuck:1441 : No thread to pass the buck to 2013-06-12 14:59:33.443+0000: 1696: debug : virNetClientCloseLocked:647 : client=0x7f2a6b628590, sock=0x7f2a6b6282e0, reason=3 2013-06-12 14:59:33.443+0000: 1696: debug : virObjectUnref:258 : OBJECT_UNREF: obj=0x7f2a6b6282e0 2013-06-12 14:59:33.443+0000: 1696: debug : virObjectRef:295 : OBJECT_REF: obj=0x7f2a6b628590 2013-06-12 14:59:33.443+0000: 1696: debug : virKeepAliveStop:307 : RPC_KEEPALIVE_STOP: ka=0x7f2a6b628880 client=0x7f2a6b628590 2013-06-12 14:59:33.443+0000: 1696: debug : virObjectUnref:258 : OBJECT_UNREF: obj=0x7f2a6b628880 2013-06-12 14:59:33.443+0000: 1696: debug : virObjectUnref:260 : OBJECT_DISPOSE: obj=0x7f2a6b628880 2013-06-12 14:59:33.443+0000: 1697: debug : virEventPollRunOnce:640 : Poll got 1 event(s) 2013-06-12 14:59:33.443+0000: 1697: debug : virEventPollDispatchTimeouts:425 : Dispatch 0 2013-06-12 14:59:33.443+0000: 1697: debug : virEventPollDispatchHandles:470 : Dispatch 1 2013-06-12 14:59:33.443+0000: 1697: debug : virEventPollDispatchHandles:484 : i=0 w=1 2013-06-12 14:59:33.443+0000: 1697: debug : virEventPollDispatchHandles:498 : EVENT_POLL_DISPATCH_HANDLE: watch=1 events=1 2013-06-12 14:59:33.443+0000: 1697: debug : virEventPollCleanupTimeouts:516 : Cleanup 0 2013-06-12 14:59:33.443+0000: 1697: debug : virEventPollCleanupTimeouts:552 : Found 0 out of 0 timeout slots used, releasing 0 2013-06-12 14:59:33.443+0000: 1697: debug : virEventPollCleanupHandles:564 : Cleanup 2 2013-06-12 14:59:33.443+0000: 1697: debug : virEventPollCleanupHandles:577 : EVENT_POLL_PURGE_HANDLE: watch=2 2013-06-12 14:59:33.443+0000: 1697: debug : virObjectUnref:258 : OBJECT_UNREF: obj=0x7f2a6b628590 2013-06-12 14:59:33.443+0000: 1697: debug : virObjectUnref:258 : OBJECT_UNREF: obj=0x7f2a6b6282e0 2013-06-12 14:59:33.443+0000: 1697: debug : virObjectUnref:260 : OBJECT_DISPOSE: obj=0x7f2a6b6282e0 2013-06-12 14:59:33.443+0000: 1697: debug : virNetSocketDispose:1004 : RPC_SOCKET_DISPOSE: sock=0x7f2a6b6282e0 2013-06-12 14:59:33.443+0000: 1697: debug : virEventPollRemoveHandle:180 : EVENT_POLL_REMOVE_HANDLE: watch=2 2013-06-12 14:59:33.443+0000: 1697: debug : virFileClose:73 : Closed fd 7 2013-06-12 14:59:33.459+0000: 1696: debug : virKeepAliveDispose:227 : RPC_KEEPALIVE_DISPOSE: ka=0x7f2a6b628880 2013-06-12 14:59:33.459+0000: 1696: debug : virObjectUnref:258 : OBJECT_UNREF: obj=0x7f2a6b628590 2013-06-12 14:59:33.459+0000: 1696: debug : virObjectUnref:258 : OBJECT_UNREF: obj=0x7f2a6b628590 2013-06-12 14:59:33.459+0000: 1696: debug : virObjectUnref:258 : OBJECT_UNREF: obj=0x7f2a6b628590 2013-06-12 14:59:33.459+0000: 1696: debug : virObjectUnref:260 : OBJECT_DISPOSE: obj=0x7f2a6b628590 2013-06-12 14:59:33.459+0000: 1696: debug : virNetClientDispose:600 : RPC_CLIENT_DISPOSE: client=0x7f2a6b628590 2013-06-12 14:59:33.459+0000: 1696: debug : virObjectUnref:258 : OBJECT_UNREF: obj=0x7f2a6b625130 2013-06-12 14:59:33.459+0000: 1696: debug : virObjectUnref:258 : OBJECT_UNREF: obj=0x7f2a6b6287a0 2013-06-12 14:59:33.459+0000: 1696: debug : virObjectUnref:258 : OBJECT_UNREF: obj=0x7f2a6b6284b0 2013-06-12 14:59:33.459+0000: 1696: debug : virObjectUnref:258 : OBJECT_UNREF: obj=0x7f2a6b6280b0 2013-06-12 14:59:33.459+0000: 1696: debug : virFileClose:73 : Closed fd 9 2013-06-12 14:59:33.459+0000: 1697: debug : virEventRunDefaultImpl:270 : running default event implementation 2013-06-12 14:59:33.459+0000: 1696: debug : virFileClose:73 : Closed fd 8 2013-06-12 14:59:33.459+0000: 1697: debug : virEventPollCleanupTimeouts:516 : Cleanup 0 2013-06-12 14:59:33.459+0000: 1696: debug : virNetMessageClear:56 : msg=0x7f2a6b6285f8 nfds=0 2013-06-12 14:59:33.459+0000: 1697: debug : virEventPollCleanupTimeouts:552 : Found 0 out of 0 timeout slots used, releasing 0 2013-06-12 14:59:33.459+0000: 1696: debug : virObjectUnref:258 : OBJECT_UNREF: obj=0x7f2a6b6287a0 2013-06-12 14:59:33.459+0000: 1697: debug : virEventPollCleanupHandles:564 : Cleanup 1 2013-06-12 14:59:33.459+0000: 1696: debug : virObjectUnref:260 : OBJECT_DISPOSE: obj=0x7f2a6b6287a0 2013-06-12 14:59:33.459+0000: 1697: debug : virEventPollMakePollFDs:393 : Prepare n=0 w=1, f=5 e=1 d=0 2013-06-12 14:59:33.459+0000: 1696: debug : virObjectUnref:258 : OBJECT_UNREF: obj=0x7f2a6b6284b0 2013-06-12 14:59:33.459+0000: 1697: debug : virEventPollCalculateTimeout:332 : Calculate expiry of 0 timers 2013-06-12 14:59:33.459+0000: 1696: debug : virObjectUnref:260 : OBJECT_DISPOSE: obj=0x7f2a6b6284b0 2013-06-12 14:59:33.459+0000: 1697: debug : virEventPollCalculateTimeout:361 : Timeout at 0 due in -1 ms 2013-06-12 14:59:33.459+0000: 1696: debug : virObjectUnref:258 : OBJECT_UNREF: obj=0x7f2a6b6280b0 2013-06-12 14:59:33.459+0000: 1697: debug : virEventPollRunOnce:629 : EVENT_POLL_RUN: nhandles=1 timeout=-1 2013-06-12 14:59:33.459+0000: 1696: debug : virObjectUnref:260 : OBJECT_DISPOSE: obj=0x7f2a6b6280b0 2013-06-12 14:59:33.459+0000: 1697: debug : virEventPollRunOnce:640 : Poll got 1 event(s) 2013-06-12 14:59:33.459+0000: 1697: debug : virEventPollDispatchTimeouts:425 : Dispatch 0 2013-06-12 14:59:33.459+0000: 1696: debug : virObjectUnref:258 : OBJECT_UNREF: obj=0x7f2a6b625130 2013-06-12 14:59:33.459+0000: 1697: debug : virEventPollDispatchHandles:470 : Dispatch 1 2013-06-12 14:59:33.459+0000: 1696: debug : virObjectUnref:260 : OBJECT_DISPOSE: obj=0x7f2a6b625130 2013-06-12 14:59:33.459+0000: 1697: debug : virEventPollDispatchHandles:484 : i=0 w=1 2013-06-12 14:59:33.459+0000: 1697: debug : virEventPollDispatchHandles:498 : EVENT_POLL_DISPATCH_HANDLE: watch=1 events=1 2013-06-12 14:59:33.459+0000: 1697: debug : virEventPollCleanupTimeouts:516 : Cleanup 0 2013-06-12 14:59:33.459+0000: 1697: debug : virEventPollCleanupTimeouts:552 : Found 0 out of 0 timeout slots used, releasing 0 2013-06-12 14:59:33.459+0000: 1697: debug : virEventPollCleanupHandles:564 : Cleanup 1 2013-06-12 14:59:33.459+0000: 1696: debug : virEventPollAddTimeout:225 : Used 0 timeout slots, adding at least 10 more 2013-06-12 14:59:33.563+0000: 1696: debug : virEventPollInterruptLocked:712 : Skip interrupt, 0 139819907258112 2013-06-12 14:59:33.563+0000: 1696: debug : virEventPollAddTimeout:248 : EVENT_POLL_ADD_TIMEOUT: timer=1 frequency=0 cb=0x7f2a6a8198f0 opaque=(nil) ff=(nil) 2013-06-12 14:59:33.563+0000: 1696: debug : virEventPollRemoveTimeout:300 : EVENT_POLL_REMOVE_TIMEOUT: timer=1 2013-06-12 14:59:33.563+0000: 1696: debug : virEventPollInterruptLocked:712 : Skip interrupt, 0 139819907258112 Thanks, Chandrashekar `

3 6

[libvirt] [PATCH 0/4] libxl: implement some chuncks of the NUMA interface
by Dario Faggioli 04 Jul '13

04 Jul '13

Hi Jim, Everyone, First patch series, so maybe a small introduction is required: I'm Dario and I work for Citrix on improving the NUMA support of Xen. This patch series implements some of the missing bits and pieces, in the libxl driver, regarding obtaining per-host and per-domain NUMA related information. It's not the full libvirt NUMA interface, since we don't have all we would need for that in Xen yet (we will in the next version, 4.4), but it's certainly better than having nothing! :-) Basically, I'm enhancing capability reporting, to cover NUMA topology (patch 01), and I'm implementing nodeGetCellsFreeMemory (patch 02) and virDomainGetNumaParameters (patch 04) for the libxl driver. This last one requires at least Xen 4.3, so I put the implementation within the proper #ifdef-ery. What I'm really not sure about is patch 03, which is something I need if I want patch 04 to function properly. Basically it is about advertising that the libxl driver supports VIR_TYPED_PARAM_STRING. I looked at how that is done in the qemu driver, but I'm not entirely sure I completely understood the logic behind it, so, please, tell me if I missed or misinterpreted anything! In particular, should I have added more of those "flags &= ~VIR_TYPED_PARAM_STRING_OKAY;" statements, as it happens in the qemu driver? If yes, in which functions? Finally, allow me to say that it was a while that I wanted start hacking a bit on libvirt. I'm really glad I've eventually been able to do so, and I definitely plan to continue (with particular focus on NUMA related stuff). Comments are of course more than welcome. :-) Thanks and Regards, Dario --- Dario Faggioli (4): libxl: implement NUMA capabilities reporting libxl: implement per NUMA node free memory reporting libxl: advertise the support for VIR_TYPED_PARAM_STRING libxl: implement virDomainGetNumaParameters src/libxl/libxl_conf.c | 128 +++++++++++++++++++++++++++++- src/libxl/libxl_driver.c | 199 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 326 insertions(+), 1 deletion(-) -- <<This happens because I choose it to happen!>> (Raistlin Majere) ----------------------------------------------------------------- Dario Faggioli, Ph.D, http://about.me/dario.faggioli Senior Software Engineer, Citrix Systems R&D Ltd., Cambridge (UK)

3 18

[libvirt] [PATCH] conf: don't check hyperv spinlock retries if disabled
by Ján Tomko 04 Jul '13

04 Jul '13

<hyperv> <spinlocks state='off'/> </hyperv> results in: error: XML error: missing HyperV spinlock retry count Don't require retries when state is off and use virXPathUInt instead of virXPathString to simplify parsing. https://bugzilla.redhat.com/show_bug.cgi?id=784836#c19 --- docs/schemas/domaincommon.rng | 8 ++++-- src/conf/domain_conf.c | 32 +++++++++------------- .../qemuxml2argvdata/qemuxml2argv-hyperv-off.args | 4 +++ tests/qemuxml2argvdata/qemuxml2argv-hyperv-off.xml | 29 ++++++++++++++++++++ tests/qemuxml2argvtest.c | 1 + tests/qemuxml2xmltest.c | 1 + 6 files changed, 53 insertions(+), 22 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-hyperv-off.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-hyperv-off.xml diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index 6fe1f96..c135530 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -4054,9 +4054,11 @@ <optional> <element name="spinlocks"> <ref name="hypervtristate"/> - <attribute name="retries"> - <data type="integer"/> - </attribute> + <optional> + <attribute name="retries"> + <data type="unsignedInt"/> + </attribute> + </optional> </element> </optional> </interleave> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index f80b690..402e6e9 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -11211,27 +11211,21 @@ virDomainDefParseXML(xmlDocPtr xml, } VIR_FREE(tmp); - if (!(tmp = virXPathString("string(./@retries)", ctxt))) { - virReportError(VIR_ERR_XML_ERROR, "%s", - _("missing HyperV spinlock retry count")); - goto error; - } - - if (virStrToLong_ui(tmp, NULL, 0, - &def->hyperv_spinlocks) < 0) { - virReportError(VIR_ERR_XML_ERROR, "%s", - _("Cannot parse HyperV spinlock retry " - "count")); - goto error; - } + if (value == VIR_DOMAIN_FEATURE_STATE_ON) { + if (virXPathUInt("string(./@retries)", ctxt, + &def->hyperv_spinlocks) < 0) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("invalid HyperV spinlock retry count")); + goto error; + } - if (def->hyperv_spinlocks < 0xFFF) { - virReportError(VIR_ERR_XML_ERROR, "%s", - _("HyperV spinlock retry count must be " - "at least 4095")); - goto error; + if (def->hyperv_spinlocks < 0xFFF) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("HyperV spinlock retry count must be " + "at least 4095")); + goto error; + } } - VIR_FREE(tmp); def->hyperv_features[feature] = value; break; diff --git a/tests/qemuxml2argvdata/qemuxml2argv-hyperv-off.args b/tests/qemuxml2argvdata/qemuxml2argv-hyperv-off.args new file mode 100644 index 0000000..23d9ecc --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-hyperv-off.args @@ -0,0 +1,4 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test /usr/bin/qemu \ +-S -M pc -cpu qemu32 -m 214 -smp 6 -nographic \ +-monitor unix:/tmp/test-monitor,server,nowait \ +-boot n -usb -net none -serial none -parallel none diff --git a/tests/qemuxml2argvdata/qemuxml2argv-hyperv-off.xml b/tests/qemuxml2argvdata/qemuxml2argv-hyperv-off.xml new file mode 100644 index 0000000..4ec16d5 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-hyperv-off.xml @@ -0,0 +1,29 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>6</vcpu> + <os> + <type arch='i686' machine='pc'>hvm</type> + <boot dev='network'/> + </os> + <features> + <acpi/> + <hyperv> + <relaxed state='off'/> + <vapic state='off'/> + <spinlocks state='off'/> + </hyperv> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu</emulator> + <controller type='usb' index='0'/> + <controller type='pci' index='0' model='pci-root'/> + <memballoon model='virtio'/> + </devices> +</domain> diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 2c7fd01..d0d9cad 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -438,6 +438,7 @@ mymain(void) DO_TEST("kvmclock+eoi-disabled", QEMU_CAPS_ENABLE_KVM); DO_TEST("hyperv", NONE); + DO_TEST("hyperv-off", NONE); DO_TEST("hugepages", QEMU_CAPS_MEM_PATH); DO_TEST("nosharepages", QEMU_CAPS_MACHINE_OPT, QEMU_CAPS_MEM_MERGE); diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c index 65e9591..f8daff9 100644 --- a/tests/qemuxml2xmltest.c +++ b/tests/qemuxml2xmltest.c @@ -156,6 +156,7 @@ mymain(void) DO_TEST("eoi-enabled"); DO_TEST("hyperv"); + DO_TEST("hyperv-off"); DO_TEST("hugepages"); DO_TEST("nosharepages"); -- 1.8.1.5

2 2

[libvirt] [PATCH] Fix NULL dereference caused by ACL filtering of domains
by Jiri Denemark 04 Jul '13

04 Jul '13

Caused by 763973607ddace04562da1a1e545ab6692d5175f. --- src/libxl/libxl_driver.c | 3 ++- src/qemu/qemu_driver.c | 6 ++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index 1bae3d6..ededbbc 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -3221,7 +3221,8 @@ libxlConnectNumOfDefinedDomains(virConnectPtr conn) libxlDriverLock(driver); n = virDomainObjListNumOfDomains(driver->domains, false, - virConnectNumOfDefinedDomainsCheckACL, NULL); + virConnectNumOfDefinedDomainsCheckACL, + conn); libxlDriverUnlock(driver); return n; diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 94cebe8..1b9ba41 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5887,7 +5887,8 @@ static int qemuConnectListDefinedDomains(virConnectPtr conn, goto cleanup; ret = virDomainObjListGetInactiveNames(driver->domains, names, nnames, - virConnectListDefinedDomainsCheckACL, NULL); + virConnectListDefinedDomainsCheckACL, + conn); cleanup: return ret; @@ -5901,7 +5902,8 @@ static int qemuConnectNumOfDefinedDomains(virConnectPtr conn) { goto cleanup; ret = virDomainObjListNumOfDomains(driver->domains, false, - virConnectNumOfDefinedDomainsCheckACL, NULL); + virConnectNumOfDefinedDomainsCheckACL, + conn); cleanup: return ret; -- 1.8.2.1

2 2

[libvirt] [PATCH] Unlock the storage volume object after looking it up
by Ján Tomko 04 Jul '13

04 Jul '13

Introduced by c930410. https://bugzilla.redhat.com/show_bug.cgi?id=980676 --- src/storage/storage_driver.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/storage/storage_driver.c b/src/storage/storage_driver.c index 02f7b69..d15b3d4 100644 --- a/src/storage/storage_driver.c +++ b/src/storage/storage_driver.c @@ -1380,15 +1380,16 @@ storageVolLookupByKey(virConnectPtr conn, virStorageVolDefFindByKey(driver->pools.objs[i], key); if (vol) { - if (virStorageVolLookupByKeyEnsureACL(conn, driver->pools.objs[i]->def, vol) < 0) + if (virStorageVolLookupByKeyEnsureACL(conn, driver->pools.objs[i]->def, vol) < 0) { + virStoragePoolObjUnlock(driver->pools.objs[i]); goto cleanup; + } ret = virGetStorageVol(conn, driver->pools.objs[i]->def->name, vol->name, vol->key, NULL, NULL); - goto cleanup; } } virStoragePoolObjUnlock(driver->pools.objs[i]); @@ -1440,15 +1441,16 @@ storageVolLookupByPath(virConnectPtr conn, VIR_FREE(stable_path); if (vol) { - if (virStorageVolLookupByPathEnsureACL(conn, driver->pools.objs[i]->def, vol) < 0) + if (virStorageVolLookupByPathEnsureACL(conn, driver->pools.objs[i]->def, vol) < 0) { + virStoragePoolObjUnlock(driver->pools.objs[i]); goto cleanup; + } ret = virGetStorageVol(conn, driver->pools.objs[i]->def->name, vol->name, vol->key, NULL, NULL); - goto cleanup; } } virStoragePoolObjUnlock(driver->pools.objs[i]); -- 1.8.1.5

2 2

[libvirt] [PATCH] Fix build with clang
by Ján Tomko 04 Jul '13

04 Jul '13

Partially revert cdd703f's revert of c163410, as linking with clang with --param=ssp-buffer-size=4 still fails with: "argument unused during compilation". --- This is technically a build-breaker fix, but I haven't pushed it yet, to prevent reverting a revert of a revert. m4/virt-compile-warnings.m4 | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/m4/virt-compile-warnings.m4 b/m4/virt-compile-warnings.m4 index c6794b7..8731b70 100644 --- a/m4/virt-compile-warnings.m4 +++ b/m4/virt-compile-warnings.m4 @@ -185,6 +185,13 @@ AC_DEFUN([LIBVIRT_COMPILE_WARNINGS],[ dnl gl_WARN_ADD([-fstack-protector]) gl_WARN_ADD([-fstack-protector-all]) gl_WARN_ADD([--param=ssp-buffer-size=4]) + dnl Even though it supports it, clang complains about + dnl use of --param=ssp-buffer-size=4 unless used with + dnl the -c arg. It doesn't like it when used with args + dnl that just link together .o files. Unfortunately + dnl we can't avoid that with automake, so we must turn + dnl off the following clang specific warning + gl_WARN_ADD([-Wno-unused-command-line-argument]) ;; *-*-freebsd*) dnl FreeBSD ships old gcc 4.2.1 which doesn't handle -- 1.8.1.5

2 2

[libvirt] best way to provide disk storage for vm without shared storage system
by Vasiliy Tolstov 04 Jul '13

04 Jul '13

Hello. I'm very happy with libvirt and qemu, that great software! (after some playing i want to create golang bindings to libvirt).. Now i provide ext4 fs for qcow2 images (raid1 with two sata disks). Now i don't need live migration (but may need it in feature). What is the best way to provide disks to vm in case of performance, ability to create backups (i don't want lvm snapshots)? As i search from google more speed can take physical storage - lvm. But may be QED or FVD can provide near lvm performance to me? -- Vasiliy Tolstov, e-mail: v.tolstov(a)selfip.ru jabber: vase(a)selfip.ru

2 1

[libvirt] qemu64 - not valid cpu with 'Intel Westmere Family'
by Sandro Bonazzola 04 Jul '13

04 Jul '13

Hi, I'm trying to run latest vdsm master on RHEL-6.4. I've built the rpms against livirt-1.10 I'm creating a VM using cpu family = 'Intel Westmere Family' <cpu match="exact"> <model>qemu64</model> <feature name="svm" policy="disable"/> </cpu> Thread-40::DEBUG::2013-07-03 15:47:47,150::libvirtconnection::136::vds::(wrapper) Unknown libvirterror: ecode: 1 edom: 31 level: 2 message: internal error Cannot find suitable CPU model for given data Thread-40::DEBUG::2013-07-03 15:47:47,150::vm::2003::vm.Vm::(_startUnderlyingVm) vmId=`9deae1fb-e0c5-4362-8f3c-657f39893b8b`::_ongoingCreations released Thread-40::ERROR::2013-07-03 15:47:47,150::vm::2029::vm.Vm::(_startUnderlyingVm) vmId=`9deae1fb-e0c5-4362-8f3c-657f39893b8b`::The vm start process failed Traceback (most recent call last): File "/usr/share/vdsm/vm.py", line 1989, in _startUnderlyingVm self._run() File "/usr/share/vdsm/vm.py", line 2862, in _run self._connection.createXML(domxml, flags), File "/usr/lib64/python2.6/site-packages/vdsm/libvirtconnection.py", line 112, in wrapper ret = f(*args, **kwargs) File "/usr/lib64/python2.6/site-packages/libvirt.py", line 2848, in createXML if ret is None:raise libvirtError('virDomainCreateXML() failed', conn=self) libvirtError: internal error Cannot find suitable CPU model for given data Is it required a more updated qemu? Is it a vdsm or a livirt bug? libvirt-1.1.0-1.el6.x86_64 libvirt-client-1.1.0-1.el6.x86_64 libvirt-daemon-1.1.0-1.el6.x86_64 libvirt-daemon-config-network-1.1.0-1.el6.x86_64 libvirt-daemon-config-nwfilter-1.1.0-1.el6.x86_64 libvirt-daemon-driver-interface-1.1.0-1.el6.x86_64 libvirt-daemon-driver-lxc-1.1.0-1.el6.x86_64 libvirt-daemon-driver-network-1.1.0-1.el6.x86_64 libvirt-daemon-driver-nodedev-1.1.0-1.el6.x86_64 libvirt-daemon-driver-nwfilter-1.1.0-1.el6.x86_64 libvirt-daemon-driver-qemu-1.1.0-1.el6.x86_64 libvirt-daemon-driver-secret-1.1.0-1.el6.x86_64 libvirt-daemon-driver-storage-1.1.0-1.el6.x86_64 libvirt-daemon-kvm-1.1.0-1.el6.x86_64 libvirt-daemon-lxc-1.1.0-1.el6.x86_64 libvirt-debuginfo-1.1.0-1.el6.x86_64 libvirt-devel-1.1.0-1.el6.x86_64 libvirt-docs-1.1.0-1.el6.x86_64 libvirt-lock-sanlock-1.1.0-1.el6.x86_64 libvirt-python-1.1.0-1.el6.x86_64 qemu-img-0.12.1.2-2.355.el6_4.5.x86_64 qemu-kvm-0.12.1.2-2.355.el6_4.5.x86_64 vdsm-4.11.0-84.gitc4e3dd0.el6.x86_64 vdsm-cli-4.11.0-84.gitc4e3dd0.el6.noarch vdsm-gluster-4.11.0-84.gitc4e3dd0.el6.noarch vdsm-python-4.11.0-84.gitc4e3dd0.el6.x86_64 vdsm-python-cpopen-4.11.0-84.gitc4e3dd0.el6.x86_64 vdsm-xmlrpc-4.11.0-84.gitc4e3dd0.el6.noarch -- Sandro Bonazzola Better technology. Faster innovation. Powered by community collaboration. See how it works at redhat.com

2 3

[libvirt] [PATCH v2] A bunch of extensions to libxl driver
by Marek Marczykowski-Górecki 04 Jul '13

04 Jul '13

This are some additional features to libxl driver. Some of them require change in domain config structures/syntax. Details described with each patch. There are two bugfix patches for deadlock during daemon startup. Changes since v1: - dropped 'script' disk parameter patches - updated 'script' interface parameter handling - dropped PCI passthrough patches - duplicates Chunyan's work - dropped RFC: libxl: special 'stubdom-dm' emulator to use qemu in stub domain - rebased on 1.0.6+ - VIR_STRDUP - other changes described in individual patches - new patches: libxl: initialize device structures libxl: support paused domain restore in virDomainRestoreFlags libxl: support domain config modification in virDomainRestoreFlags libxl: support network device attach/detach libxl: pass ipaddr to libxl toolstack libxl: implement lifecycle actions from domain libxl: add tablet/mouse input device support

2 34

[libvirt] [PATCH 0/2] avoid getpwuid_r deadlock
by Eric Blake 03 Jul '13

03 Jul '13

https://bugzilla.redhat.com/show_bug.cgi?id=964358 Posting now to get reviews started. I'd especially like to get feedback that it doesn't break LXC, and that it works with root-squash NFS when using qemu:qemu instead of root:root in /etc/libvirt/qemu.conf. I hope to do more testing myself, and also see if I can try writing an LD_PRELOAD shim as part of 'make check' to make it easier to test that the right system calls are made during the sequence. Eric Blake (2): util: add virGetGroupList util: make virSetUIDGID async-signal-safe configure.ac | 7 +-- src/libvirt_private.syms | 1 + src/security/security_dac.c | 16 ++++-- src/util/vircommand.c | 10 +++- src/util/virfile.c | 30 +++++++++-- src/util/virutil.c | 123 ++++++++++++++++++++++++++++++-------------- src/util/virutil.h | 7 ++- 7 files changed, 142 insertions(+), 52 deletions(-) -- 1.8.1.4

2 6

[libvirt] libvirt compliation from git source fails with "gnulib/tests/Makefile.in' not found" error
by chandrashekar shastri 03 Jul '13

03 Jul '13

Hi, I am compiling the libvirt from source and I am getting the following error: Don't forget to - "include gnulib.mk" from within "gnulib/lib/Makefile.am", - "include gnulib.mk" from within "gnulib/tests/Makefile.am", - mention "-I gnulib/m4" in ACLOCAL_AMFLAGS in Makefile.am, - mention "gnulib/m4/gnulib-cache.m4" in EXTRA_DIST in Makefile.am, - invoke gl_EARLY in ./configure.ac, right after AC_PROG_CC, - invoke gl_INIT in ./configure.ac. running: AUTOPOINT=true LIBTOOLIZE=true autoreconf --verbose --install --force -I gnulib/m4 --no-recursive autoreconf: Entering directory `.' autoreconf: running: true --force autoreconf: running: aclocal -I m4 --force -I m4 -I gnulib/m4 autoreconf: configure.ac: tracing autoreconf: running: true --copy --force autoreconf: running: /usr/bin/autoconf --include=gnulib/m4 --force autoreconf: running: /usr/bin/autoheader --include=gnulib/m4 --force autoreconf: running: automake --add-missing --copy --force-missing configure.ac:2424: required file `gnulib/lib/Makefile.in' not found configure.ac:2424: required file `gnulib/tests/Makefile.in' not found autoreconf: automake failed with exit status: 1 Libvirtd (libvirt) 1.0.5 we didn't any isssues. Please let us know if we are missing something. Thanks, Chandrashekar

2 3

[libvirt] Libvirt : Bootstrap fails for local gnulib
by chandrashekar shastri 03 Jul '13

03 Jul '13

Hi All, The Libvirt compliation fails to bootstarp for local gnulib. We do not have outbound access for the test machines. So, we ll pull the gnulib from and copy to the test machines. When we run ./bootstrap --no-git --gnulib-srcdir=/path/to/local, below is the error: ./bootstrap: Bootstrapping from checked-out libvirt sources... ./bootstrap: consider installing git-merge-changelog from gnulib ./bootstrap: getting gnulib files... fatal: Needed a single revision Unable to find current revision in submodule path '.gnulib' If we run autogen.sh it tries to pull from git though the $GNULIB_SRCDIR is exported with the local gnulib. ./autogen.sh '--no-git' I am going to run ./configure with no arguments - if you wish to pass any to it, please specify them on the ./autogen.sh command line. running bootstrap --no-git... ./bootstrap: Bootstrapping from checked-out libvirt sources... ./bootstrap: consider installing git-merge-changelog from gnulib ./bootstrap: getting gnulib files... fatal: Unable to look up git.sv.gnu.org (port 9418) (Name or service not known) Unable to fetch in submodule path '.gnulib' Failed to bootstrap, please investigate. Please provide us the workaround for the same. Thanks, Chandrashekar

2 2

[libvirt] [PATCH] maint: update to latest gnulib
by Eric Blake 03 Jul '13

03 Jul '13

The latest mingw headers on Fedora 19 fail to build with gnulib without an update. Meanwhile, now that upstream gnulib has better handling of -W probing for clang, we can drop some of our own solutions in favor of upstream; thus this reverts commit c1634100, "Correctly detect warning flags with clang". * .gnulib: Update to latest, for mingw and clang. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule. * .gnulib a363f4e...f40e61e (41): > update from texinfo > ignore-value: port to gcc -pedantic > extern-inline: port to gcc -std=c89 > doc: document extern-inline > doc: chatter less > fflush, fseeko: port to musl cross-compiles > msvc-inval: port to mingw-w64 > getcwd-lgpl: port to Tru64 > autoupdate > tests: port large-fd POSIX spawn tests to OS X > autoupdate > tests/nap.h: use an adaptive delay to avoid ctime update issues > sig2str: port to C++ > docs: mention cygwin shortcoming in <sys/un.h> > vasnprintf: silence mingw compiler warning > c-ctype, regex, verify: port to gcc -std=c90 -pedantic > regex: adapt to locking regime instead of depending on pthread > getgroups: document portability issues > test-lchown, test-chown: also skip test if lchown/chown fails with EPERM > regex: fix dfa race in multithreaded uses > malloca: port to compilers that reject size-zero arrays > parse-datetime, tests: don't use "string" + int > argmatch: port to C++ > argp: typo fix > autoupdate > manywarnings: update for GCC 4.8.0 > spawn-tests, sys_socket-tests, sys_wait-tests: port to clang > getaddrinfo-tests: port --enable-gcc-warnings to clang > thread: port --enable-gcc-warnings to clang > stdio: use __REDIRECT for fwrite, fwrite_unlocked > stdio: port --enable-gcc-warnings to clang > sig2str: port --enable-gcc-warnings to clang > obstack: port --enable-gcc-warnings to clang > memchr2: port --enable-gcc-warnings to clang > mbsstr: port --enable-gcc-warnings to clang > malloca: port --enable-gcc-warnings to clang > inttostr: port --enable-gcc-warnings to clang > warnings: port to clang > quotearg: do not read beyond end of buffer > lock: work around pthread recursive mutexes bug in Mac OS X 10.6 > mkdir-p: remove assumptions about umask and mode .gnulib | 2 +- m4/virt-compile-warnings.m4 | 22 ---------------------- 2 files changed, 1 insertion(+), 23 deletions(-) diff --git a/.gnulib b/.gnulib index a363f4e..f40e61e 160000 --- a/.gnulib +++ b/.gnulib @@ -1 +1 @@ -Subproject commit a363f4ed4a0e69187c97686ac44502c49c7f4b3d +Subproject commit f40e61ea0c4940b027aade7dd48948aa93f133a4 diff --git a/m4/virt-compile-warnings.m4 b/m4/virt-compile-warnings.m4 index ce4e244..c6794b7 100644 --- a/m4/virt-compile-warnings.m4 +++ b/m4/virt-compile-warnings.m4 @@ -60,18 +60,6 @@ AC_DEFUN([LIBVIRT_COMPILE_WARNINGS],[ # gcc 4.4.6 complains this is C++ only; gcc 4.7.0 implies this from -Wall dontwarn="$dontwarn -Wenum-compare" - # clang rather horribly ignores unknown warning flags by - # default. Thus to get gl_WARN_ADD to reliably detect - # flags, we need to set '-Werror -Wunknown-warning-option' - # in CFLAGS while probing support - WARN_CFLAGS= - orig_CFLAGS="$CFLAGS" - gl_WARN_ADD([-Wunknown-warning-option]) - if test -n "$WARN_CFLAGS" ; then - WARN_CFLAGS= - CFLAGS="-Werror -Wunknown-warning-option $CFLAGS" - fi - # gcc 4.2 treats attribute(format) as an implicit attribute(nonnull), # which triggers spurious warnings for our usage AC_CACHE_CHECK([whether gcc -Wformat allows NULL strings], @@ -197,13 +185,6 @@ AC_DEFUN([LIBVIRT_COMPILE_WARNINGS],[ dnl gl_WARN_ADD([-fstack-protector]) gl_WARN_ADD([-fstack-protector-all]) gl_WARN_ADD([--param=ssp-buffer-size=4]) - dnl Even though it supports it, clang complains about - dnl use of --param=ssp-buffer-size=4 unless used with - dnl the -c arg. It doesn't like it when used with args - dnl that just link together .o files. Unfortunately - dnl we can't avoid that with automake, so we must turn - dnl off the following clang specific warning - gl_WARN_ADD([-Wno-unused-command-line-argument]) ;; *-*-freebsd*) dnl FreeBSD ships old gcc 4.2.1 which doesn't handle @@ -244,7 +225,4 @@ AC_DEFUN([LIBVIRT_COMPILE_WARNINGS],[ AC_DEFINE_UNQUOTED([BROKEN_GCC_WLOGICALOP], 1, [Define to 1 if gcc -Wlogical-op reports false positives on strchr]) fi - - # Remove stuff we set for clang - CFLAGS="$orig_CFLAGS" ]) -- 1.8.1.4

1 0

[libvirt] [PATCH glib] Add API to access device alias names
by Daniel P. Berrange 03 Jul '13

03 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> Add gvir_config_domain_device_get_alias to read the <alias name="foo"/> XML in each device. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- libvirt-gconfig/libvirt-gconfig-domain-device.c | 9 +++++++++ libvirt-gconfig/libvirt-gconfig-domain-device.h | 2 ++ libvirt-gconfig/libvirt-gconfig.sym | 2 ++ 3 files changed, 13 insertions(+) diff --git a/libvirt-gconfig/libvirt-gconfig-domain-device.c b/libvirt-gconfig/libvirt-gconfig-domain-device.c index 81e8765..7c97a0f 100644 --- a/libvirt-gconfig/libvirt-gconfig-domain-device.c +++ b/libvirt-gconfig/libvirt-gconfig-domain-device.c @@ -109,3 +109,12 @@ unimplemented: g_debug("Parsing of '%s' device nodes is unimplemented", tree->name); return NULL; } + + +const gchar *gvir_config_domain_device_get_alias(GVirConfigDomainDevice *dev) +{ + g_return_val_if_fail(GVIR_CONFIG_IS_DOMAIN_DEVICE(dev), NULL); + + return gvir_config_object_get_attribute(GVIR_CONFIG_OBJECT(dev), + "alias", "name"); +} diff --git a/libvirt-gconfig/libvirt-gconfig-domain-device.h b/libvirt-gconfig/libvirt-gconfig-domain-device.h index de4c3f7..2344ebe 100644 --- a/libvirt-gconfig/libvirt-gconfig-domain-device.h +++ b/libvirt-gconfig/libvirt-gconfig-domain-device.h @@ -59,6 +59,8 @@ struct _GVirConfigDomainDeviceClass GType gvir_config_domain_device_get_type(void); +const gchar *gvir_config_domain_device_get_alias(GVirConfigDomainDevice *dev); + G_END_DECLS #endif /* __LIBVIRT_GCONFIG_DOMAIN_DEVICE_H__ */ diff --git a/libvirt-gconfig/libvirt-gconfig.sym b/libvirt-gconfig/libvirt-gconfig.sym index 2847570..32f57d9 100644 --- a/libvirt-gconfig/libvirt-gconfig.sym +++ b/libvirt-gconfig/libvirt-gconfig.sym @@ -560,6 +560,8 @@ LIBVIRT_GCONFIG_0.1.7 { gvir_config_domain_chardev_source_pty_get_path; gvir_config_domain_chardev_get_source; + + gvir_config_domain_device_get_alias; } LIBVIRT_GCONFIG_0.1.6; # .... define new API here using predicted next version number .... -- 1.8.2.1

2 1

[libvirt] [PATCH glib] Add APIs to access chardev source information
by Daniel P. Berrange 03 Jul '13

03 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> Enable apps to determine the current source path of a chardev with a pty based source. --- .../libvirt-gconfig-domain-chardev-source-pty.c | 23 +++++++++++++++++++++ .../libvirt-gconfig-domain-chardev-source-pty.h | 2 ++ .../libvirt-gconfig-domain-chardev-source.c | 21 +++++++++++++++++++ libvirt-gconfig/libvirt-gconfig-domain-chardev.c | 24 ++++++++++++++++++++++ libvirt-gconfig/libvirt-gconfig-domain-chardev.h | 3 +++ libvirt-gconfig/libvirt-gconfig-object-private.h | 2 ++ libvirt-gconfig/libvirt-gconfig-object.c | 8 ++++++++ libvirt-gconfig/libvirt-gconfig.sym | 3 +++ 8 files changed, 86 insertions(+) diff --git a/libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.c b/libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.c index d24385e..a965417 100644 --- a/libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.c +++ b/libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.c @@ -24,6 +24,7 @@ #include "libvirt-gconfig/libvirt-gconfig.h" #include "libvirt-gconfig/libvirt-gconfig-private.h" +#include "libvirt-gconfig/libvirt-gconfig-domain-chardev-source-private.h" #define GVIR_CONFIG_DOMAIN_CHARDEV_SOURCE_PTY_GET_PRIVATE(obj) \ (G_TYPE_INSTANCE_GET_PRIVATE((obj), GVIR_CONFIG_TYPE_DOMAIN_CHARDEV_SOURCE_PTY, GVirConfigDomainChardevSourcePtyPrivate)) @@ -82,6 +83,19 @@ GVirConfigDomainChardevSourcePty *gvir_config_domain_chardev_source_pty_new_from return GVIR_CONFIG_DOMAIN_CHARDEV_SOURCE_PTY(object); } +GVirConfigDomainChardevSource * +gvir_config_domain_chardev_source_pty_new_from_tree(GVirConfigXmlDoc *doc, + xmlNodePtr tree) +{ + GVirConfigObject *object; + + object = gvir_config_object_new_from_tree(GVIR_CONFIG_TYPE_DOMAIN_CHARDEV_SOURCE_PTY, + doc, NULL, tree); + + return GVIR_CONFIG_DOMAIN_CHARDEV_SOURCE(object); +} + + void gvir_config_domain_chardev_source_pty_set_path(GVirConfigDomainChardevSourcePty *pty, const char *path) { @@ -92,3 +106,12 @@ void gvir_config_domain_chardev_source_pty_set_path(GVirConfigDomainChardevSourc "path", path); } + + +const gchar * gvir_config_domain_chardev_source_pty_get_path(GVirConfigDomainChardevSourcePty *pty) +{ + g_return_val_if_fail(GVIR_CONFIG_IS_DOMAIN_CHARDEV_SOURCE_PTY(pty), NULL); + + return gvir_config_object_get_attribute(GVIR_CONFIG_OBJECT(pty), + "source", "path"); +} diff --git a/libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.h b/libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.h index 96e05bc..fab3811 100644 --- a/libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.h +++ b/libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.h @@ -65,6 +65,8 @@ GVirConfigDomainChardevSourcePty *gvir_config_domain_chardev_source_pty_new_from void gvir_config_domain_chardev_source_pty_set_path(GVirConfigDomainChardevSourcePty *pty, const char *path); +const gchar * gvir_config_domain_chardev_source_pty_get_path(GVirConfigDomainChardevSourcePty *pty); + G_END_DECLS #endif /* __LIBVIRT_GCONFIG_DOMAIN_CHARDEV_SOURCE_PTY_H__ */ diff --git a/libvirt-gconfig/libvirt-gconfig-domain-chardev-source.c b/libvirt-gconfig/libvirt-gconfig-domain-chardev-source.c index c34a3c8..bbb4c75 100644 --- a/libvirt-gconfig/libvirt-gconfig-domain-chardev-source.c +++ b/libvirt-gconfig/libvirt-gconfig-domain-chardev-source.c @@ -23,6 +23,8 @@ #include <config.h> #include "libvirt-gconfig/libvirt-gconfig.h" +#include "libvirt-gconfig/libvirt-gconfig-private.h" +#include "libvirt-gconfig/libvirt-gconfig-domain-chardev-source-private.h" #define GVIR_CONFIG_DOMAIN_CHARDEV_SOURCE_GET_PRIVATE(obj) \ (G_TYPE_INSTANCE_GET_PRIVATE((obj), GVIR_CONFIG_TYPE_DOMAIN_CHARDEV_SOURCE, GVirConfigDomainChardevSourcePrivate)) @@ -47,3 +49,22 @@ static void gvir_config_domain_chardev_source_init(GVirConfigDomainChardevSource source->priv = GVIR_CONFIG_DOMAIN_CHARDEV_SOURCE_GET_PRIVATE(source); } + +G_GNUC_INTERNAL GVirConfigDomainChardevSource * +gvir_config_domain_chardev_source_new_from_tree(GVirConfigXmlDoc *doc, + xmlNodePtr tree) +{ + const gchar *type; + + g_return_val_if_fail(GVIR_CONFIG_IS_XML_DOC(doc), NULL); + g_return_val_if_fail(tree != NULL, NULL); + g_return_val_if_fail(tree->name != NULL, NULL); + + type = gvir_config_xml_get_attribute_content(tree, "type"); + + if (g_str_equal(type, "pty")) + return gvir_config_domain_chardev_source_pty_new_from_tree(doc, tree); + + g_debug("Unknown chardev source type: %s", type); + return NULL; +} diff --git a/libvirt-gconfig/libvirt-gconfig-domain-chardev.c b/libvirt-gconfig/libvirt-gconfig-domain-chardev.c index e20e597..bdb97dd 100644 --- a/libvirt-gconfig/libvirt-gconfig-domain-chardev.c +++ b/libvirt-gconfig/libvirt-gconfig-domain-chardev.c @@ -24,6 +24,7 @@ #include "libvirt-gconfig/libvirt-gconfig.h" #include "libvirt-gconfig/libvirt-gconfig-private.h" +#include "libvirt-gconfig/libvirt-gconfig-domain-chardev-source-private.h" #define GVIR_CONFIG_DOMAIN_CHARDEV_GET_PRIVATE(obj) \ (G_TYPE_INSTANCE_GET_PRIVATE((obj), GVIR_CONFIG_TYPE_DOMAIN_CHARDEV, GVirConfigDomainChardevPrivate)) @@ -86,3 +87,26 @@ void gvir_config_domain_chardev_set_source(GVirConfigDomainChardev *chardev, prepend_prop(chardev_node, new_attr); } } + + +/** + * gvir_config_domain_chardev_get_source: + * @chardev: a #GVirConfigDomainChardev + * + * Gets the source for the chardev + * + * Returns: (transfer full): the chardev source + */ +GVirConfigDomainChardevSource * +gvir_config_domain_chardev_get_source(GVirConfigDomainChardev *chardev) +{ + GVirConfigXmlDoc *doc; + xmlNodePtr tree; + + doc = gvir_config_object_get_xml_doc(GVIR_CONFIG_OBJECT(chardev)); + tree = gvir_config_object_get_xml_node(GVIR_CONFIG_OBJECT(chardev)); + + return gvir_config_domain_chardev_source_new_from_tree(doc, + tree); +} + diff --git a/libvirt-gconfig/libvirt-gconfig-domain-chardev.h b/libvirt-gconfig/libvirt-gconfig-domain-chardev.h index 23a2f43..7fdccc3 100644 --- a/libvirt-gconfig/libvirt-gconfig-domain-chardev.h +++ b/libvirt-gconfig/libvirt-gconfig-domain-chardev.h @@ -63,6 +63,9 @@ GType gvir_config_domain_chardev_get_type(void); void gvir_config_domain_chardev_set_source(GVirConfigDomainChardev *chardev, GVirConfigDomainChardevSource *source); +GVirConfigDomainChardevSource * +gvir_config_domain_chardev_get_source(GVirConfigDomainChardev *chardev); + G_END_DECLS #endif /* __LIBVIRT_GCONFIG_DOMAIN_CHARDEV_H__ */ diff --git a/libvirt-gconfig/libvirt-gconfig-object-private.h b/libvirt-gconfig/libvirt-gconfig-object-private.h index 9baac66..2ec358b 100644 --- a/libvirt-gconfig/libvirt-gconfig-object-private.h +++ b/libvirt-gconfig/libvirt-gconfig-object-private.h @@ -30,6 +30,8 @@ GVirConfigObject *gvir_config_object_new_from_tree(GType type, GVirConfigXmlDoc *doc, const char *schema, xmlNodePtr tree); + +GVirConfigXmlDoc *gvir_config_object_get_xml_doc(GVirConfigObject *config); xmlNodePtr gvir_config_object_get_xml_node(GVirConfigObject *config); const char *gvir_config_object_get_node_content(GVirConfigObject *object, const char *node_name); diff --git a/libvirt-gconfig/libvirt-gconfig-object.c b/libvirt-gconfig/libvirt-gconfig-object.c index 9e3b5f2..8971a5b 100644 --- a/libvirt-gconfig/libvirt-gconfig-object.c +++ b/libvirt-gconfig/libvirt-gconfig-object.c @@ -274,6 +274,14 @@ const gchar *gvir_config_object_get_schema(GVirConfigObject *config) return config->priv->schema; } + +G_GNUC_INTERNAL GVirConfigXmlDoc * +gvir_config_object_get_xml_doc(GVirConfigObject *config) +{ + return config->priv->doc; +} + + /* FIXME: will we always have one xmlNode per GConfig object? */ /* FIXME: need to return the right node from subclasses */ /* NB: the xmlNodePtr must not be freed by the caller */ diff --git a/libvirt-gconfig/libvirt-gconfig.sym b/libvirt-gconfig/libvirt-gconfig.sym index f8c7cdd..2847570 100644 --- a/libvirt-gconfig/libvirt-gconfig.sym +++ b/libvirt-gconfig/libvirt-gconfig.sym @@ -557,6 +557,9 @@ LIBVIRT_GCONFIG_0.1.7 { gvir_config_storage_pool_target_get_path; gvir_config_storage_pool_target_get_permissions; + + gvir_config_domain_chardev_source_pty_get_path; + gvir_config_domain_chardev_get_source; } LIBVIRT_GCONFIG_0.1.6; # .... define new API here using predicted next version number .... -- 1.8.2.1

2 1

[libvirt] [PATCH] Put virt-sanlock-cleanup into section 8
by Guido Günther 03 Jul '13

03 Jul '13

as indicates by the filename. --- tools/Makefile.am | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/Makefile.am b/tools/Makefile.am index 1dac7c1..644a86d 100644 --- a/tools/Makefile.am +++ b/tools/Makefile.am @@ -99,7 +99,8 @@ virt-sanlock-cleanup: virt-sanlock-cleanup.in Makefile || (rm $@ && exit 1) && chmod +x $@ virt-sanlock-cleanup.8: virt-sanlock-cleanup.in $(top_srcdir)/configure.ac - $(AM_V_GEN)$(POD2MAN) --name VIRT-SANLOCK-CLEANUP $< $(srcdir)/$@ \ + $(AM_V_GEN)$(POD2MAN) --name VIRT-SANLOCK-CLEANUP --section=8 \ + $< $(srcdir)/$@ \ && if grep 'POD ERROR' $(srcdir)/$@ ; then \ rm $(srcdir)/$@; exit 1; fi -- 1.8.3.1

3 5

[libvirt] [PATCH 0/2] Finish dual graphics support
by Martin Kletzander 03 Jul '13

03 Jul '13

We added support for dula <graphics>, but there were places in the code which still needed to be adapted. Two tiny patches seem to fix it all. Tested, works fine. Martin Kletzander (2): qemu: Don't miss errors when changing graphics passwords qemu: Allow seamless migration for domains with multiple graphics src/qemu/qemu_migration.c | 29 ++++++++++++++++++----------- src/qemu/qemu_process.c | 6 +++--- 2 files changed, 21 insertions(+), 14 deletions(-) -- 1.8.2.1

3 6

[libvirt] How to get the host network stats
by Zhang, Yijing 03 Jul '13

03 Jul '13

Hello there, I want to find how to get the host's network stats by using libvirt. I found one from PHP API reference which is called libvirt_domain_interface_stats, I'm guessing it's for guest since it's 'domain'. However, I'm not really sure. Looking forward to hear the answers from you guys. Thank you, Tracey

3 2

[libvirt] [PATCH v3 00/12] Add user namespace support for libvirt lxc
by Gao feng 03 Jul '13

03 Jul '13

This patchset try to add userns support for libvirt lxc. Since userns is nearly completed in linux-3.9, the old kernel doesn't support userns, I add some New XML elements to let people decide if enable userns.The userns is enabled only when user configure the XML. The format of user namespace related XML file like below: <idmap> <uid start='0' target='1000' count='10'> <gid start='0' target='1000' count='10'> </idmap> it means the user in container (which uid:gid is 0:0) will be mapped to the user in host (uid:gid is 1000:1000), count is used to form an u/gid range: The users in container which uid in [start, start + count -1] will be mapped. You can have multiple lines to map differnet id ranges, caution, you must make sure the root user of container has been mapped. This patchset also does the below jobs. 1, Because the uninit userns has no right to create devices, we should create devices for container on host. 2, Changes the owner of fuse and tty device. Change from v2: 1, Mount tmpfs on /stateDir/domain.dev 2, Create devices under /stateDir/doamin.dev/ 3, Mount Move the /.oldroot/stateDir/doamin.dev/ on the /dev/ of container 4, Enhance the configuration, disallow the semi configuration Gao feng (12): LXC: Introduce New XML element for user namespace LXC: enable user namespace only when user set the uidmap LXC: sort the uidmap/gidmap of domain LXC: introduce virLXCControllerSetupUserns and lxcContainerSetID LXC: Creating devices for container on host side LXC: Move creating /dev/ptmx to virLXCControllerSetupDevPTS LXC: fuse: Change files owner to the root user of container LXC: controller: change the owner of tty devices to the root user of container LXC: controller: change the owner of /dev to the root user of container LXC: controller: change the owner of devices created on host LXC: controller: change the owner of /dev/pts and ptmx to the root of container LXC: introduce virLXCControllerChown docs/formatdomain.html.in | 23 ++++ docs/schemas/domaincommon.rng | 31 +++++ src/conf/domain_conf.c | 115 ++++++++++++++++++ src/conf/domain_conf.h | 22 ++++ src/lxc/lxc_container.c | 183 ++++++++++++++-------------- src/lxc/lxc_controller.c | 271 +++++++++++++++++++++++++++++++++++++++++- src/lxc/lxc_fuse.c | 6 + 7 files changed, 557 insertions(+), 94 deletions(-) -- 1.8.1.4

6 49

[libvirt] [PATCH] LXC: blkio: allow to setup weight_device
by Gao feng 03 Jul '13

03 Jul '13

libivrt lxc can only set generic weight for container, This patch allows user to setup per device blkio weigh for container. Signed-off-by: Gao feng <gaofeng(a)cn.fujitsu.com> --- src/lxc/lxc_cgroup.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/src/lxc/lxc_cgroup.c b/src/lxc/lxc_cgroup.c index 5c8acb3..4443b83 100644 --- a/src/lxc/lxc_cgroup.c +++ b/src/lxc/lxc_cgroup.c @@ -123,21 +123,35 @@ cleanup: static int virLXCCgroupSetupBlkioTune(virDomainDefPtr def, virCgroupPtr cgroup) { - int ret = -1; + int i, rc; if (def->blkio.weight) { - int rc = virCgroupSetBlkioWeight(cgroup, def->blkio.weight); + rc = virCgroupSetBlkioWeight(cgroup, def->blkio.weight); if (rc != 0) { virReportSystemError(-rc, _("Unable to set Blkio weight for domain %s"), def->name); - goto cleanup; + return -1; } } - ret = 0; -cleanup: - return ret; + if (def->blkio.ndevices) { + for (i = 0; i < def->blkio.ndevices; i++) { + virBlkioDeviceWeightPtr dw = &def->blkio.devices[i]; + if (!dw->weight) + continue; + rc = virCgroupSetBlkioDeviceWeight(cgroup, dw->path, dw->weight); + if (rc != 0) { + virReportSystemError(-rc, + _("Unable to set io device weight " + "for domain %s"), + def->name); + return -1; + } + } + } + + return 0; } -- 1.8.1.4

2 1

[libvirt] Memory access API
by Marek Marczykowski-Górecki 03 Jul '13

03 Jul '13

Hi, Is there any zero-copy VM memory access API in libvirt? I see only virDomainMemoryPeek function, which copy some memory from VM and do not permit VM memory modifications. What I'm looking for is xen xc_map_foreign_pages or xc_gnttab_map_domain_grant_refs equivalent/wrapper. IOW map memory pages to dom0 address space, without copy. I know that not every hypervisor supports it, but it is useful to build a high-performance communication channel on top of it. -- Best Regards, Marek Marczykowski-Górecki Invisible Things Lab

2 1

[libvirt] [PATCH 0/8] Filtering of object lists via ACLs
by Daniel P. Berrange 03 Jul '13

03 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> The current ACL checks validate access to the object being passed in to the API calls. There are a few APIs (all the virConnectList* / virConnectNum* ones) which are used to get lists of objects in the first place. Currently you could find out that there is a VM called "foo", but you can't then do virDomainLookupByName since the ACL check may block it. This series introduces filtering in the object list APIs, so you can't even see the existance of an object called "foo", if you don't have permission over it. This is not yet filtering the legacy Xen driver. Daniel P. Berrange (8): Add access control filtering of domain objects Add access control filtering of network objects Add access control filtering of node device objects Add access control filtering of storage objects Add access control filtering of secret objects Add access control filtering of nwfilter objects Add access control filtering of interface objects Extend the ACL test case to validate filter rule checks src/Makefile.am | 1 + src/check-aclrules.pl | 97 ++++++++++++ src/conf/domain_conf.c | 91 +++++++---- src/conf/domain_conf.h | 17 ++- src/conf/interface_conf.h | 3 + src/conf/network_conf.c | 12 +- src/conf/network_conf.h | 13 +- src/conf/node_device_conf.c | 12 +- src/conf/node_device_conf.h | 12 +- src/conf/storage_conf.c | 12 +- src/conf/storage_conf.h | 11 +- src/interface/interface_backend_netcf.c | 262 +++++++++++++++++++++++++++----- src/interface/interface_backend_udev.c | 56 +++++-- src/libvirt_private.syms | 6 +- src/libxl/libxl_driver.c | 15 +- src/lxc/lxc_driver.c | 15 +- src/network/bridge_driver.c | 44 +++--- src/node_device/node_device_driver.c | 28 ++-- src/nwfilter/nwfilter_driver.c | 39 +++-- src/openvz/openvz_driver.c | 7 +- src/parallels/parallels_driver.c | 14 +- src/parallels/parallels_network.c | 2 +- src/qemu/qemu_driver.c | 24 +-- src/rpc/gendispatch.pl | 42 +++-- src/secret/secret_driver.c | 14 +- src/storage/storage_driver.c | 62 +++++--- src/test/test_driver.c | 18 ++- src/uml/uml_driver.c | 15 +- src/vmware/vmware_driver.c | 12 +- 29 files changed, 716 insertions(+), 240 deletions(-) -- 1.8.1.4

2 19

[libvirt] Hostdev: USB passthrough, about hostport support
by Gonglei (Arei) 03 Jul '13

03 Jul '13

Hi, the Qemu upstream has a hostport property which allows to specify the host usb devices to pass through by bus number and physical port. Will the libvirt have a plan to support this? Thanks! The Qemu's patch: http://git.qemu.org/?p=qemu-stable-1.4.git;a=commitdiff;h=9056a2972a9e93519… Best Regards! -Gonglei

1 0

[libvirt] [PATCH 1/2] virCgroupNewPartition: Don't leak @newpath
by Michal Privoznik 03 Jul '13

03 Jul '13

The @newpath variable is allocated in virCgroupSetPartitionSuffix(). But it's newer freed. --- src/util/vircgroup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c index ae71859..e0b25ed 100644 --- a/src/util/vircgroup.c +++ b/src/util/vircgroup.c @@ -1249,7 +1249,7 @@ int virCgroupNewPartition(const char *path, int rc; char *parentPath = NULL; virCgroupPtr parent = NULL; - char *newpath; + char *newpath = NULL; VIR_DEBUG("path=%s create=%d controllers=%x", path, create, controllers); @@ -1295,6 +1295,7 @@ cleanup: virCgroupFree(group); virCgroupFree(&parent); VIR_FREE(parentPath); + VIR_FREE(newpath); return rc; } #else -- 1.8.1.5

2 4

[libvirt] [libvirt-perl][PATCH] Add missing bracket to Sys::Virt::Domain man page
by Ján Tomko 03 Jul '13

03 Jul '13

https://bugzilla.redhat.com/show_bug.cgi?id=954254 --- Pushed as trivial. lib/Sys/Virt/Domain.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/Sys/Virt/Domain.pm b/lib/Sys/Virt/Domain.pm index 053f127..3630cf0 100644 --- a/lib/Sys/Virt/Domain.pm +++ b/lib/Sys/Virt/Domain.pm @@ -540,7 +540,7 @@ Update the configuration of an existing device. The new configuration is given by C<$xml>. The optional <$flags> parameter defaults to 0 but can accept one of the device hotplug flags described later. -=item $data = $dom->block_peek($path, $offset, $size[, $flags) +=item $data = $dom->block_peek($path, $offset, $size[, $flags]) Peek into the guest disk C<$path>, at byte C<$offset> capturing C<$size> bytes of data. The returned scalar may contain embedded -- 1.8.1.5

1 0

[libvirt] [PATCH] doc: blkio: add some notification
by Gao feng 03 Jul '13

03 Jul '13

If the I/O elevator of disk is not cfq, the setting of blkio.weight is ineffective. And the setting up blkio.weight_device will fail. Add notification for this situation. Signed-off-by: Gao feng <gaofeng(a)cn.fujitsu.com> --- docs/formatdomain.html.in | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 47d91ab..8d048be 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -740,7 +740,8 @@ <dd> The optional <code>blkiotune</code> element provides the ability to tune Blkio cgroup tunable parameters for the domain. If this is omitted, it defaults to the OS provided - defaults. <span class="since">Since 0.8.8</span></dd> + defaults. Notice: blkiotune is effective only when the I/O elevator + of disk is cfq. <span class="since">Since 0.8.8</span></dd> <dt><code>weight</code></dt> <dd> The optional <code>weight</code> element is the overall I/O weight of the guest. The value should be in the range [100, @@ -761,7 +762,8 @@ mandatory sub-elements, <code>path</code> describing the absolute path of the device, and <code>weight</code> giving the relative weight of that device, in the range [100, - 1000]. <span class="since">Since 0.9.8</span></dd> + 1000]. The setting up device.weight will fail if the I/O elevator + of this disk device is not cfq. <span class="since">Since 0.9.8</span></dd> </dl> -- 1.8.1.4

2 2

[libvirt] [PATCH] Crash of libvirtd by unprivileged user in virConnectListAllInterfaces
by Eric Blake 03 Jul '13

03 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> On Thu, Jun 27, 2013 at 03:56:42PM +0100, Daniel P. Berrange wrote: > Hi Security Team, > > I've discovered a way for an unprivileged user with a readonly connection > to libvirtd, to crash the daemon. Ok, the final patch for this is issue will be the simpler variant that Eric suggested The embargo can be considered to be lifted on Monday July 1st, at 0900 UTC The following is the GIT change that DV or myself will apply to libvirt GIT master immediately before the 1.1.0 release: >From 177b4165c531a4b3ba7f6ab6aa41dca9ceb0b8cf Mon Sep 17 00:00:00 2001 From: "Daniel P. Berrange" <berrange(a)redhat.com> Date: Fri, 28 Jun 2013 10:48:37 +0100 Subject: [PATCH] CVE-2013-2218: Fix crash listing network interfaces with filters The virConnectListAllInterfaces method has a double-free of the 'struct netcf_if' object when any of the filtering flags cause an interface to be skipped over. For example when running the command 'virsh iface-list --inactive' This is a regression introduced in release 1.0.6 by commit 7ac2c4fe624f30f2c8270116513fa2ddab07631f Author: Guannan Ren <gren(a)redhat.com> Date: Tue May 21 21:29:38 2013 +0800 interface: list all interfaces with flags == 0 Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- Posting as a courtesy FYI for anyone reading this list but who does not have access to the security list and doesn't want to crawl through git. This commit has been included in 1.1.0 and has been applied to all affected stable branches (just v1.0.6-maint). The rule in determining that a CVE was necessary is the "escalation of privilege" test - any time a read-only client can cause a denial-of-service against a more-privileged read-write client (by crashing libvirtd), there is an escalation. src/interface/interface_backend_netcf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/interface/interface_backend_netcf.c b/src/interface/interface_backend_netcf.c index a995816..9aa673d 100644 --- a/src/interface/interface_backend_netcf.c +++ b/src/interface/interface_backend_netcf.c @@ -412,6 +412,7 @@ netcfConnectListAllInterfaces(virConnectPtr conn, (MATCH(VIR_CONNECT_LIST_INTERFACES_INACTIVE) && (status & NETCF_IFACE_INACTIVE)))) { ncf_if_free(iface); + iface = NULL; continue; } -- 1.8.1.4

2 1

[libvirt] Bug 980449 - resource leak about event
by Wangyufei (A) 03 Jul '13

03 Jul '13

Hi All, I have filed the following bug for Libvirt event issue : Bug 980449<https://bugzilla.redhat.com/show_bug.cgi?id=980449> - resource leak about event Thanks, WangYufei

1 0

[libvirt] [PATCH v6 0/5] libvirt supports Guest Panicked
by Chen Fan 02 Jul '13

02 Jul '13

Changes: v5-v6: Refactor the patches, and fix the incorrect indentation and name. v4-v5: 1. fix the incorrect indentation and explanation (of some reasons). v3-v4: 1. Supports the dumpcore options of the oncrash element in the XML. 2. Move the previous code to processWatchdogEvent(). v2-v3: 1. split into 3 patches v1-v2: 1. fix the incorrect domain state: paused -> crashed, when crash the guest while libvirt isn't running, then restart libvirtd. Chen Fan (5): libvirt: Define domain crash event types qemu: Refactor the processwatchdogEvent code that can make the driver workpool more generalized qemu: Need to use qemuProcessShutdownOrReboot(), so we defined it at qemu_process.h qemu: Implement 'oncrash' events when guest panicked qemu: Implement 'oncrash' coredump events when guest panicked examples/domain-events/events-c/event-test.c | 10 ++ include/libvirt/libvirt.h.in | 16 ++ src/conf/domain_conf.c | 12 +- src/qemu/qemu_domain.h | 11 +- src/qemu/qemu_driver.c | 222 ++++++++++++++++++++++++--- src/qemu/qemu_monitor.c | 14 +- src/qemu/qemu_monitor.h | 4 + src/qemu/qemu_monitor_json.c | 7 + src/qemu/qemu_process.c | 60 +++++++- src/qemu/qemu_process.h | 3 + tools/virsh-domain-monitor.c | 8 + 11 files changed, 328 insertions(+), 39 deletions(-) -- 1.8.1.4

5 14

[libvirt] [PATCHv2] build: don't ship access syms files in tarball
by Eric Blake 02 Jul '13

02 Jul '13

On a mingw VPATH build (such as done by ./autobuild.sh), the tarball created by 'make dist' was including generated files. The VPATH rules were then seeing that the tarball files were up-to-date, and not regenerating files locally, leading to this failure: GEN libvirt.syms cat: libvirt_access.syms: No such file or directory cat: libvirt_access_qemu.syms: No such file or directory cat: libvirt_access_lxc.syms: No such file or directory make: *** [libvirt.syms] Error 1 We already have a category for generated sym files, which are intentionally not part of the tarball; stick the access sym files in that category. Rearrange the declarations a bit to make it harder to repeat the problem in the future, and drop assignments that are now redundant (GENERATED_SYM_FILES are already listed as BUILT_FILES, so we don't have to repeat that for ACCESS_DRIVER_SYM_FILES). * src/Makefile.am (USED_SYM_FILES): Don't include generated files. (GENERATED_SYM_FILES): Access syms files are generated. (libvirt.syms): Include access syms files here. (ACCESS_DRIVER_SYMFILES): Rename... (ACCESS_DRIVER_SYM_FILES): ...for consistency. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- v1 discussion was here: https://www.redhat.com/archives/libvir-list/2013-July/msg00054.html Pushing under the build-breaker rule; now that I'm more confident at why the build was failing, and also pushing to v1.1.0-maint. src/Makefile.am | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index 285334b..15a2840 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -815,7 +815,7 @@ ACCESS_DRIVER_GENERATED = \ $(srcdir)/access/viraccessapichecklxc.h \ $(srcdir)/access/viraccessapichecklxc.c -ACCESS_DRIVER_SYMFILES = \ +ACCESS_DRIVER_SYM_FILES = \ libvirt_access.syms \ libvirt_access_qemu.syms \ libvirt_access_lxc.syms @@ -927,8 +927,14 @@ libvirt_driver_la_CFLAGS = \ libvirt_driver_la_LIBADD = \ $(GNUTLS_LIBS) $(CURL_LIBS) $(DLOPEN_LIBS) +# All .syms files should be placed in exactly one of these three lists, +# depending on whether they are stored in git and/or used in the build. SYM_FILES = $(USED_SYM_FILES) USED_SYM_FILES = $(srcdir)/libvirt_private.syms +GENERATED_SYM_FILES = \ + $(ACCESS_DRIVER_SYM_FILES) \ + libvirt.syms libvirt.def libvirt_qemu.def libvirt_lxc.def \ + $(NULL) if WITH_TEST noinst_LTLIBRARIES += libvirt_driver_test.la @@ -1474,9 +1480,8 @@ EXTRA_DIST += $(ACCESS_DRIVER_POLKIT_SOURCES) endif -USED_SYM_FILES += $(ACCESS_DRIVER_SYMFILES) -BUILT_SOURCES += $(ACCESS_DRIVER_GENERATED) $(ACCESS_DRIVER_SYMFILES) -CLEANFILES += $(ACCESS_DRIVER_GENERATED) $(ACCESS_DRIVER_SYMFILES) +BUILT_SOURCES += $(ACCESS_DRIVER_GENERATED) +CLEANFILES += $(ACCESS_DRIVER_GENERATED) libvirt_access.syms: $(srcdir)/rpc/gendispatch.pl \ $(REMOTE_PROTOCOL) Makefile.am @@ -1713,12 +1718,9 @@ EXTRA_DIST += \ $(SYM_FILES) \ $(NULL) -GENERATED_SYM_FILES = \ - libvirt.syms libvirt.def libvirt_qemu.def libvirt_lxc.def - BUILT_SOURCES += $(GENERATED_SYM_FILES) -libvirt.syms: libvirt_public.syms $(USED_SYM_FILES) \ +libvirt.syms: libvirt_public.syms $(USED_SYM_FILES) $(ACCESS_DRIVER_SYM_FILES) \ $(top_builddir)/config.status $(AM_V_GEN)rm -f $@-tmp $@ ; \ printf '# WARNING: generated from the following:\n# $^\n\n' >$@-tmp && \ @@ -1726,7 +1728,7 @@ libvirt.syms: libvirt_public.syms $(USED_SYM_FILES) \ printf '\n\n# Private symbols\n\n' >>$@-tmp && \ printf 'LIBVIRT_PRIVATE_$(VERSION) {\n\n' >>$@-tmp && \ printf 'global:\n\n' >>$@-tmp && \ - cat $(USED_SYM_FILES) >>$@-tmp && \ + cat $(USED_SYM_FILES) $(ACCESS_DRIVER_SYM_FILES) >>$@-tmp && \ printf '\n\nlocal:\n*;\n\n};' >>$@-tmp && \ chmod a-w $@-tmp && \ mv $@-tmp libvirt.syms -- 1.8.1.4

1 0

[libvirt] [PATCH] build: avoid build failure without polkit
by Eric Blake 02 Jul '13

02 Jul '13

rpmbuild of mingw-libvirt.spec failed with: GEN libvirt.syms GEN libvirt_qemu.def cat: libvirt_access.syms: No such file or directory cat: libvirt_access_qemu.syms: No such file or directory cat: libvirt_access_lxc.syms: No such file or directory I traced this to unconditionally trying to use the ACL .syms files, even when polkit isn't in use. build: avoid build failure without polkit * src/Makefile.am (USED_SYM_FILES): Mark access driver symbols according to use. --- Even though this fixes a build-breaker (./autobuild.sh), I'm reluctant to push this without review. In particular, I'm worried that I may need a v2 that further conditionalizes whether libvirt_access_qemu.syms is sometimes omitted based on rpm arguments, even if libvirt_access.syms is present. src/Makefile.am | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/Makefile.am b/src/Makefile.am index 4cf999d..042bcba 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1469,12 +1469,13 @@ $(ACCESS_DRIVER_POLKIT_POLICY): $(srcdir)/access/viraccessperm.h \ CLEANFILES += $(ACCESS_DRIVER_POLKIT_POLICY) BUILT_SOURCES += $(ACCESS_DRIVER_POLKIT_POLICY) +USED_SYM_FILES += $(ACCESS_DRIVER_SYMFILES) else EXTRA_DIST += $(ACCESS_DRIVER_POLKIT_SOURCES) +SYM_FILES += $(ACCESS_DRIVER_SYMFILES) endif -USED_SYM_FILES += $(ACCESS_DRIVER_SYMFILES) BUILT_SOURCES += $(ACCESS_DRIVER_GENERATED) $(ACCESS_DRIVER_SYMFILES) CLEANFILES += $(ACCESS_DRIVER_GENERATED) $(ACCESS_DRIVER_SYMFILES) -- 1.8.1.4

2 5

[libvirt] [PATCH] qemu: Restored original console alias
by Michal Privoznik 02 Jul '13

02 Jul '13

Because of some crazy backward compatibility, console device is in some cases just an alias to a serial device. This means, in the process of generating XML description of a domain, all the interesting info is taken from corresponding serial device, if that's the case. Including the device alias. That means, we produce: <console type='pty' tty='/dev/pts/20'> ... <alias name='serial0'/> </console> (notice the assigned alias) Maybe this is okay, maybe its wrong either. Anyway, later, when libvirtd restarts, and we parse the state XML file, we read the wrong alias back. Hence, the internal representation is different to the state it was in prior the libvirtd restart. --- src/qemu/qemu_domain.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 8d79066..96d88ec 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -804,6 +804,34 @@ qemuDomainDeviceDefPostParse(virDomainDeviceDefPtr dev, dev->data.chr->source.data.nix.listen = true; } + /* For some really crazy back compat in virDomainDefFormatInternal we must + * restore the original console alias. For hvm domains, we are formatting + * a dummy console device (based on a serial device which it refers to) + * instead of the original one. That means the device aliases in memory + * and in the formatted XML are not in sync. While in memory we still have + * 'consoleN', in the formatted XML we have 'serialN'. */ + if (dev->type == VIR_DOMAIN_DEVICE_CHR && + dev->data.chr->deviceType == VIR_DOMAIN_CHR_DEVICE_TYPE_CONSOLE && + dev->data.chr->targetType == VIR_DOMAIN_CHR_CONSOLE_TARGET_TYPE_SERIAL && + STREQ(def->os.type, "hvm")) { + int id; + char *alias = dev->data.chr->info.alias; + const char *serial_alias = "serial"; + + if (alias && STRPREFIX(alias, serial_alias)) { + alias += strlen(serial_alias); + + if (virStrToLong_i(alias, NULL, 10, &id) < 0) + goto cleanup; + + VIR_FREE(dev->data.chr->info.alias); + if (virAsprintf(&dev->data.chr->info.alias, "console%d", id) < 0) { + virReportOOMError(); + goto cleanup; + } + } + } + ret = 0; cleanup: -- 1.8.1.5

2 2

[libvirt] [PATCH] domain_conf: Include the correct console alias
by Michal Privoznik 02 Jul '13

02 Jul '13

For some crazy backward compatibility, a console can by just an alias to a serial device. This is detected in the XML formating function which takes the values to format from corresponding serial device. Including the device alias. This results in wrong alias being written into the XML definition: <console type='pty' tty='/dev/pts/5'> ... <alias name='serial0'/> </console> While holding the correct alias still in the memory, it doesn't matter. However, it starts to matter as soon as libvirtd is restarted and the (incorrect) alias is read from status file. --- src/conf/domain_conf.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 011de71..61de836 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -16417,6 +16417,7 @@ virDomainDefFormatInternal(virDomainDefPtr def, memcpy(&console, def->serials[n], sizeof(console)); console.deviceType = VIR_DOMAIN_CHR_DEVICE_TYPE_CONSOLE; console.targetType = VIR_DOMAIN_CHR_CONSOLE_TARGET_TYPE_SERIAL; + memcpy(&console.info, &def->consoles[n]->info, sizeof(console.info)); } else { memcpy(&console, def->consoles[n], sizeof(console)); } @@ -16427,11 +16428,20 @@ virDomainDefFormatInternal(virDomainDefPtr def, def->nconsoles == 0 && def->nserials > 0) { virDomainChrDef console; + char *alias = NULL; memcpy(&console, def->serials[n], sizeof(console)); console.deviceType = VIR_DOMAIN_CHR_DEVICE_TYPE_CONSOLE; console.targetType = VIR_DOMAIN_CHR_CONSOLE_TARGET_TYPE_SERIAL; - if (virDomainChrDefFormat(buf, &console, flags) < 0) + if (console.info.alias) { + if (VIR_STRDUP(alias, "console0") < 0) + goto error; + console.info.alias = alias; + } + if (virDomainChrDefFormat(buf, &console, flags) < 0) { + VIR_FREE(alias); goto error; + } + VIR_FREE(alias); } for (n = 0; n < def->nchannels; n++) -- 1.8.1.5

2 7

[libvirt] [PATCH] build: work around mingw header pollution
by Eric Blake 02 Jul '13

02 Jul '13

On Fedora 18, when cross-compiling to mingw with the mingw*-dbus packages installed, compilation fails with: CC libvirt_net_rpc_server_la-virnetserver.lo In file included from /usr/i686-w64-mingw32/sys-root/mingw/include/dbus-1.0/dbus/dbus-connection.h:32:0, from /usr/i686-w64-mingw32/sys-root/mingw/include/dbus-1.0/dbus/dbus-bus.h:30, from /usr/i686-w64-mingw32/sys-root/mingw/include/dbus-1.0/dbus/dbus.h:31, from ../../src/util/virdbus.h:26, from ../../src/rpc/virnetserver.c:39: /usr/i686-w64-mingw32/sys-root/mingw/include/dbus-1.0/dbus/dbus-message.h:74:58: error: expected ';', ',' or ')' before 'struct' I have reported this as a bug against two packages: - mingw-headers, for polluting the namespace https://bugzilla.redhat.com/show_bug.cgi?id=980270 - dbus, for not dealing with the pollution https://bugzilla.redhat.com/show_bug.cgi?id=980278 At least dbus has agreed that a future version of dbus headers will do s/interface/iface/, regardless of what happens in mingw. But it is also easy to workaround in libvirt in the meantime, without having to wait for either mingw or dbus to upgrade. * src/util/virdbus.h (includes): Undo mingw's pollution so that dbus doesn't fail. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule. src/util/virdbus.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/util/virdbus.h b/src/util/virdbus.h index a51dba7..302d40d 100644 --- a/src/util/virdbus.h +++ b/src/util/virdbus.h @@ -1,7 +1,7 @@ /* * virdbus.h: helper for using DBus * - * Copyright (C) 2012 Red Hat, Inc. + * Copyright (C) 2012, 2013 Red Hat, Inc. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -23,6 +23,7 @@ # define __VIR_DBUS_H__ # ifdef WITH_DBUS +# undef interface /* Work around namespace pollution in mingw's rpc.h */ # include <dbus/dbus.h> # else # define DBusConnection void -- 1.8.1.4

1 0

[libvirt] [PATCH] qemuNodeDeviceDetachFlags: Avoid use of uninitialized variables
by Michal Privoznik 02 Jul '13

02 Jul '13

After abf75aea24 the compiler screams: qemu/qemu_driver.c: In function 'qemuNodeDeviceDetachFlags': qemu/qemu_driver.c:10693:9: error: 'domain' may be used uninitialized in this function [-Werror=maybe-uninitialized] pci = virPCIDeviceNew(domain, bus, slot, function); ^ qemu/qemu_driver.c:10693:9: error: 'bus' may be used uninitialized in this function [-Werror=maybe-uninitialized] qemu/qemu_driver.c:10693:9: error: 'slot' may be used uninitialized in this function [-Werror=maybe-uninitialized] qemu/qemu_driver.c:10693:9: error: 'function' may be used uninitialized in this function [-Werror=maybe-uninitialized] Since the other functions qemuNodeDeviceReAttach and qemuNodeDeviceReset looks exactly the same, I've initialized the variables there as well. However, I am still wondering why those functions don't matter to gcc while the first one does. --- Pushed as build breaker. src/qemu/qemu_driver.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 6a9135a..4856f37 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -10669,7 +10669,7 @@ qemuNodeDeviceDetachFlags(virNodeDevicePtr dev, { virQEMUDriverPtr driver = dev->conn->privateData; virPCIDevicePtr pci = NULL; - unsigned domain, bus, slot, function; + unsigned domain = 0, bus = 0, slot = 0, function = 0; int ret = -1; virNodeDeviceDefPtr def = NULL; char *xml = NULL; @@ -10737,7 +10737,7 @@ qemuNodeDeviceReAttach(virNodeDevicePtr dev) virQEMUDriverPtr driver = dev->conn->privateData; virPCIDevicePtr pci = NULL; virPCIDevicePtr other; - unsigned domain, bus, slot, function; + unsigned domain = 0, bus = 0, slot = 0, function = 0; int ret = -1; virNodeDeviceDefPtr def = NULL; char *xml = NULL; @@ -10799,7 +10799,7 @@ qemuNodeDeviceReset(virNodeDevicePtr dev) { virQEMUDriverPtr driver = dev->conn->privateData; virPCIDevicePtr pci; - unsigned domain, bus, slot, function; + unsigned domain = 0, bus = 0, slot = 0, function = 0; int ret = -1; virNodeDeviceDefPtr def = NULL; char *xml = NULL; -- 1.8.1.5

1 0

[libvirt] [PATCH 0/4] Fix image labeling when saving a guest
by Peter Krempa 02 Jul '13

02 Jul '13

This series cleans up a few places related to selinux labels and fixes issues with selinux when saving a machine with static selinux label and relabeling turned off. Peter Krempa (4): qemu: Improve info message and remove a variable in qemuDomainManagedSave conf: refactor virSecurityLabelDefParseXML security: Introduce method for labeling file descriptors of created files qemu: Always label newly created file on migration (save/managedsave) src/conf/domain_conf.c | 72 ++++++++++++++++++----------------------- src/libvirt_private.syms | 1 + src/qemu/qemu_driver.c | 7 ++-- src/qemu/qemu_migration.c | 4 +-- src/security/security_dac.c | 9 ++++++ src/security/security_driver.h | 4 +++ src/security/security_manager.c | 16 +++++++++ src/security/security_manager.h | 3 ++ src/security/security_nop.c | 1 + src/security/security_selinux.c | 21 ++++++++++++ src/security/security_stack.c | 19 +++++++++++ 11 files changed, 111 insertions(+), 46 deletions(-) -- 1.8.2.1

2 10

[libvirt] [PATCH] Add some misc debugging to LXC startup
by Daniel P. Berrange 02 Jul '13

02 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> Add some debug logging of LXC wait/continue messages and uid/gid map update code. --- src/lxc/lxc_container.c | 4 ++++ src/lxc/lxc_controller.c | 2 ++ 2 files changed, 6 insertions(+) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index b37300b..282c726 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -294,6 +294,7 @@ int lxcContainerSendContinue(int control) lxc_message_t msg = LXC_CONTINUE_MSG; int writeCount = 0; + VIR_DEBUG("Send continue on fd %d", control); writeCount = safewrite(control, &msg, sizeof(msg)); if (writeCount != sizeof(msg)) { goto error_out; @@ -319,7 +320,9 @@ int lxcContainerWaitForContinue(int control) lxc_message_t msg; int readLen; + VIR_DEBUG("Wait continue on fd %d", control); readLen = saferead(control, &msg, sizeof(msg)); + VIR_DEBUG("Got continue on fd %d %d", control, readLen); if (readLen != sizeof(msg)) { if (readLen >= 0) errno = EIO; @@ -348,6 +351,7 @@ static int lxcContainerSetID(virDomainDefPtr def) * for this container. And user namespace is only enabled * when nuidmap&ngidmap is not zero */ + VIR_DEBUG("Set UID/GID to 0/0"); if (def->idmap.nuidmap && virSetUIDGID(0, 0) < 0) { virReportSystemError(errno, "%s", _("setuid or setgid failed")); diff --git a/src/lxc/lxc_controller.c b/src/lxc/lxc_controller.c index 4c825aa..88601f1 100644 --- a/src/lxc/lxc_controller.c +++ b/src/lxc/lxc_controller.c @@ -1158,6 +1158,8 @@ virLXCControllerSetupUsernsMap(virDomainIdMapEntryPtr map, if (virBufferError(&map_value)) goto no_memory; + VIR_DEBUG("Set '%s' to '%s'", path, virBufferCurrentContent(&map_value)); + if (virFileWriteStr(path, virBufferCurrentContent(&map_value), 0) < 0) { virReportSystemError(errno, _("unable write to %s"), path); goto cleanup; -- 1.8.1.4

3 2

[libvirt] [PATCH v4 00/10] Add user namespace support for libvirt lxc
by Gao feng 02 Jul '13

02 Jul '13

This patchset try to add userns support for libvirt lxc. Since userns is nearly completed in linux-3.9, the old kernel doesn't support userns, I add some New XML elements to let people decide if enable userns.The userns is enabled only when user configure the XML. The format of user namespace related XML file like below: <idmap> <uid start='0' target='1000' count='10'> <gid start='0' target='1000' count='10'> </idmap> it means the user in container (which uid:gid is 0:0) will be mapped to the user in host (uid:gid is 1000:1000), count is used to form an u/gid range: The users in container which uid in [start, start + count -1] will be mapped. You can have multiple lines to map differnet id ranges, caution, you must make sure the root user of container has been mapped. This patchset also does the below jobs. 1, Because the uninit userns has no right to create devices, we should create devices for container on host. 2, Changes the owner of fuse and tty device. Change from v3: 1, fix some bugs that Daniel pointed out 2, reorder the patchset,introduce virLXCControllerChown first. 3, rebase Change from v2: 1, Mount tmpfs on /stateDir/domain.dev 2, Create devices under /stateDir/doamin.dev/ 3, Mount Move the /.oldroot/stateDir/doamin.dev/ on the /dev/ of container 4, Enhance the configuration, disallow the semi configuration Gao feng (10): LXC: Introduce New XML element for user namespace LXC: enable user namespace only when user set the uidmap LXC: sort the uidmap/gidmap of domain LXC: introduce virLXCControllerSetupUserns and lxcContainerSetID LXC: Creating devices for container on host side LXC: controller: change the owner of tty devices to the root user of container LXC: controller: change the owner of /dev to the root user of container LXC: controller: change the owner of devices created on host LXC: controller: change the owner of /dev/pts and ptmx to the root of container LXC: fuse: Change files owner to the root user of container docs/formatdomain.html.in | 23 +++++ docs/schemas/domaincommon.rng | 31 ++++++ src/conf/domain_conf.c | 115 +++++++++++++++++++++ src/conf/domain_conf.h | 22 ++++ src/lxc/lxc_container.c | 173 +++++++++++++++++-------------- src/lxc/lxc_controller.c | 235 ++++++++++++++++++++++++++++++++++++++++-- src/lxc/lxc_fuse.c | 4 + 7 files changed, 516 insertions(+), 87 deletions(-) -- 1.8.1.4

2 25

[libvirt] [PATCH] Ignore failure to mount SELinux filesystem in container
by Daniel P. Berrange 02 Jul '13

02 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> User namespaces will deny the ability to mount the SELinux filesystem. This is harmless for libvirt's LXC needs, so the error can be ignored. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/lxc/lxc_container.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index d9734b5..b37300b 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -741,6 +741,12 @@ static int lxcContainerMountBasicFS(void) VIR_DEBUG("Mount %s on %s type=%s flags=%x, opts=%s", srcpath, mnts[i].dst, mnts[i].type, mnts[i].mflags, mnts[i].opts); if (mount(srcpath, mnts[i].dst, mnts[i].type, mnts[i].mflags, mnts[i].opts) < 0) { +#if WITH_SELINUX + if (STREQ(mnts[i].src, SELINUX_MOUNT) && + (errno == EINVAL || errno == EPERM)) + continue; +#endif + virReportSystemError(errno, _("Failed to mount %s on %s type %s flags=%x opts=%s"), srcpath, mnts[i].dst, NULLSTR(mnts[i].type), -- 1.8.1.4

2 1

[libvirt] [PATCH] qemu: don't use deprecated -no-kvm-pit-reinjection
by Ján Tomko 02 Jul '13

02 Jul '13

Since qemu-kvm 1.1 [1] '-no-kvm-pit-reinjection' has been deprecated in favor of '-global kvm-pit.lost_tick_policy=discard' In upstream qemu since 1.3 [2]. https://bugzilla.redhat.com/show_bug.cgi?id=978719 [1] http://git.kernel.org/cgit/virt/kvm/qemu-kvm.git/commit/?id=4e4fa39 [2] http://git.qemu.org/?p=qemu.git;a=commitdiff;h=c21fb4f --- src/qemu/qemu_capabilities.c | 12 ++++++++++-- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 5 ++++- 3 files changed, 15 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 969b001..c6df463 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -233,6 +233,7 @@ VIR_ENUM_IMPL(virQEMUCaps, QEMU_CAPS_LAST, "mlock", "vnc-share-policy", /* 150 */ + "kvm-pit-property", ); struct _virQEMUCaps { @@ -2468,13 +2469,12 @@ virQEMUCapsInitArchQMPBasic(virQEMUCapsPtr qemuCaps, /* * Currently only x86_64 and i686 support PCI-multibus, - * -no-acpi and -no-kvm-pit-reinjection. + * -no-acpi */ if (qemuCaps->arch == VIR_ARCH_X86_64 || qemuCaps->arch == VIR_ARCH_I686) { virQEMUCapsSet(qemuCaps, QEMU_CAPS_PCI_MULTIBUS); virQEMUCapsSet(qemuCaps, QEMU_CAPS_NO_ACPI); - virQEMUCapsSet(qemuCaps, QEMU_CAPS_NO_KVM_PIT); } ret = 0; @@ -2640,6 +2640,14 @@ virQEMUCapsInitQMP(virQEMUCapsPtr qemuCaps, if (virQEMUCapsProbeQMPCommandLine(qemuCaps, mon) < 0) goto cleanup; + /* -global kvm-pit.lost_tick_policy=discard */ + if ((qemuCaps->arch == VIR_ARCH_X86_64 || + qemuCaps->arch == VIR_ARCH_I686) && + (qemuCaps->version >= 1003000 || + virQEMUCapsGet(qemuCaps, QEMU_CAPS_KVM))) { + virQEMUCapsSet(qemuCaps, QEMU_CAPS_KVM_PIT_PROPERTY); + } + ret = 0; cleanup: diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 7088747..c64f648 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -189,6 +189,7 @@ enum virQEMUCapsFlags { QEMU_CAPS_DRIVE_DISCARD = 148, /* -drive discard=off(ignore)|on(unmap) */ QEMU_CAPS_MLOCK = 149, /* -realtime mlock=on|off */ QEMU_CAPS_VNC_SHARE_POLICY = 150, /* set display sharing policy */ + QEMU_CAPS_KVM_PIT_PROPERTY = 151, /* -global kvm-pit.lost_tick_policy */ QEMU_CAPS_LAST, /* this must always be the last item */ }; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index ba93233..a678666 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -7024,7 +7024,10 @@ qemuBuildCommandLine(virConnectPtr conn, case VIR_DOMAIN_TIMER_TICKPOLICY_DELAY: /* delay is the default if we don't have kernel (-no-kvm-pit), otherwise, the default is catchup. */ - if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_NO_KVM_PIT)) + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_KVM_PIT_PROPERTY)) + virCommandAddArgList(cmd, "-global", + "kvm-pit.lost_tick_policy=discard", NULL); + else if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_NO_KVM_PIT)) virCommandAddArg(cmd, "-no-kvm-pit-reinjection"); break; case VIR_DOMAIN_TIMER_TICKPOLICY_CATCHUP: -- 1.8.1.5

2 2

[libvirt] [PATCHv2] docs: Document hypervisor drivers that support certain timer models
by Peter Krempa 02 Jul '13

02 Jul '13

Not every timer model is supported with each hypervisor. Explicitly mention the driver supporting each timer model. --- Notes: Version 2: - corrected the support of HPET (xen, libxl, qemu) and KVMCLOCK (just qemu) timers docs/formatdomain.html.in | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index cc4c5ea..47d91ab 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -1310,8 +1310,10 @@ <dt><code>name</code></dt> <dd> The <code>name</code> attribute selects which timer is - being modified, and can be one of "platform", "hpet", - "kvmclock", "pit", "rtc", or "tsc". + being modified, and can be one of + "platform" (currently unsupported), + "hpet" (libxl, xen, qemu), "kvmclock" (qemu), + "pit" (qemu), "rtc" (qemu), or "tsc" (libxl). </dd> <dt><code>track</code></dt> <dd> -- 1.8.2.1

2 2

[libvirt] [PATCH 0/2] BlockPivot issues
by Ján Tomko 02 Jul '13

02 Jul '13

https://bugzilla.redhat.com/show_bug.cgi?id=977678 Ján Tomko (2): qemu: fix return value of qemuDomainBlockPivot on errors blockjob: make PIVOT and ASYNC flags mutually exclusive src/qemu/qemu_driver.c | 15 +++++++++++---- tools/virsh-domain.c | 9 ++++++--- 2 files changed, 17 insertions(+), 7 deletions(-) -- 1.8.1.5

3 8

[libvirt] Biweekly upstream qemu-kvm test report - July 1st, 2013
by chandrashekar shastri 02 Jul '13

02 Jul '13

Adding Libvirt list. Thanks, Shastri -------- Original Message -------- Subject: Biweekly upstream qemu-kvm test report - July 1st, 2013 Date: Mon, 01 Jul 2013 19:45:32 +0530 From: chandrashekar shastri <cshastri(a)linux.vnet.ibm.com> To: qemu-devel(a)nongnu.org, ltc-kvm(a)lists.linux.ibm.com, virt-test-devel(a)redhat.com Hi, Please find the status of the upstream testing: Kernel : 3.10.0-rc5+ Qemu : 1.5.50 Libvirt : 1.0.6 Total number of bugs filed : 6 Bugs filed in this week : 5 Qemu Bugs in Launchpad : 1) 1192499 - virsh migration copy-storage-all fails with "Unable to read from monitor: Connection reset by peer" 2) 1192847 - NMI watchdog fails to increment the NMI counter in /proc/interrupts 3) 1195170 - cpu hot-add doesn't work with upstream qemu 1.5.50 Libvirt Bugs Redhat Bugzilla: 1) 979260 - cpu hot-add doesn't work with upstream libvirt 1.0.6 + qemu 1.5.50 2) 979360 - Libvirt fails to Bootstrap fails for local gnulib with 1.0. Features tested in this week: 1. NMI Watchdog 2. Live Migration (with and without shared Storage) 3. CPU hotplug 4. QMP with latest qemu Features that will be taken up in the next cycle: 1. Chardev hotplug 2. VirtIO-scsi 3. Virt Guest Suspend Hibernate Thanks, Shastri

1 0

[libvirt] [PATCH] build: configure must not affect tarball contents
by Eric Blake 02 Jul '13

02 Jul '13

On mingw, configure sets the name of the lxc symfile to libvirt_lxc.defs rather than libvirt_lxc.syms. But tarballs must be arch-independent, regardless of the configure options used for the tree where we ran 'make dist'. This led to the following failure in autobuild.sh: CCLD libvirt-lxc.la CCLD libvirt-qemu.la /usr/lib64/gcc/i686-w64-mingw32/4.7.2/../../../../i686-w64-mingw32/bin/ld: cannot find libvirt_lxc.def: No such file or directory collect2: error: ld returned 1 exit status make[3]: *** [libvirt-lxc.la] Error 1 make[3]: *** Waiting for unfinished jobs.... We were already doing the right thing with libvirt_qemu.syms. * src/Makefile.am (EXTRA_DIST): Don't ship a built file which depends on configure for its final name. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule. src/Makefile.am | 1 - 1 file changed, 1 deletion(-) diff --git a/src/Makefile.am b/src/Makefile.am index 042bcba..1a64855 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1861,7 +1861,6 @@ libvirt_lxc_la_LDFLAGS = \ $(NULL) libvirt_lxc_la_CFLAGS = $(AM_CFLAGS) libvirt_lxc_la_LIBADD = libvirt.la $(CYGWIN_EXTRA_LIBADD) -EXTRA_DIST += $(LIBVIRT_LXC_SYMBOL_FILE) lockdriverdir = $(libdir)/libvirt/lock-driver lockdriver_LTLIBRARIES = -- 1.8.1.4

1 0

[libvirt] [PATCH] build: avoid build failure without gnutls
by Eric Blake 01 Jul '13

01 Jul '13

Found while trying to cross-compile to mingw: CC libvirt_driver_remote_la-remote_driver.lo ../../src/remote/remote_driver.c: In function 'doRemoteOpen': ../../src/remote/remote_driver.c:487:23: error: variable 'verify' set but not used [-Werror=unused-but-set-variable] * src/remote/remote_driver.c (doRemoteOpen): Also ignore 'verify'. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule. I also had a report that libvirt fails to compile for mingw on Fedora 19; it looks like a gnulib submodule update will fix part of that issue, so I'm working on that now... https://lists.fedoraproject.org/pipermail/mingw/2013-June/007006.html http://git.savannah.gnu.org/gitweb/?p=gnulib.git;a=commit;h=86725346 src/remote/remote_driver.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 7a0c1f6..7f3e833 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -609,6 +609,7 @@ doRemoteOpen(virConnectPtr conn, priv->is_secure = 1; #else (void)sanity; + (void)verify; virReportError(VIR_ERR_INVALID_ARG, "%s", _("GNUTLS support not available in this build")); goto failed; -- 1.8.1.4

1 0

[libvirt] [PATCH] Drop iptablesContext
by Roman Bogorodskiy 01 Jul '13

01 Jul '13

iptablesContext holds only 4 pairs of iptables (table, chain) and there's no need to pass it around. This is a first step towards separating bridge_driver.c in platform-specific parts. --- src/libvirt_private.syms | 2 - src/network/bridge_driver.c | 253 +++++++++++++++++-------------------------- src/util/viriptables.c | 257 +++++++++++--------------------------------- src/util/viriptables.h | 65 ++++------- 4 files changed, 183 insertions(+), 394 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 795e011..062c7fb 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1417,8 +1417,6 @@ iptablesAddForwardRejectOut; iptablesAddOutputFixUdpChecksum; iptablesAddTcpInput; iptablesAddUdpInput; -iptablesContextFree; -iptablesContextNew; iptablesRemoveForwardAllowCross; iptablesRemoveForwardAllowIn; iptablesRemoveForwardAllowOut; diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index 2cf49bb..062ec85 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -75,7 +75,6 @@ struct network_driver { virNetworkObjList networks; - iptablesContext *iptables; char *networkConfigDir; char *networkAutostartDir; char *stateDir; @@ -106,8 +105,7 @@ static int networkShutdownNetwork(struct network_driver *driver, static int networkStartNetworkVirtual(struct network_driver *driver, virNetworkObjPtr network); -static int networkShutdownNetworkVirtual(struct network_driver *driver, - virNetworkObjPtr network); +static int networkShutdownNetworkVirtual(virNetworkObjPtr network); static int networkStartNetworkExternal(struct network_driver *driver, virNetworkObjPtr network); @@ -420,10 +418,6 @@ networkStateInitialize(bool privileged, } } - if (!(driverState->iptables = iptablesContextNew())) { - goto out_of_memory; - } - /* if this fails now, it will be retried later with dnsmasqCapsRefresh() */ driverState->dnsmasqCaps = dnsmasqCapsNewFromBinary(DNSMASQ); @@ -531,9 +525,6 @@ networkStateCleanup(void) { VIR_FREE(driverState->dnsmasqStateDir); VIR_FREE(driverState->radvdStateDir); - if (driverState->iptables) - iptablesContextFree(driverState->iptables); - virObjectUnref(driverState->dnsmasqCaps); networkDriverUnlock(driverState); @@ -1544,8 +1535,7 @@ networkRefreshDaemons(struct network_driver *driver) } static int -networkAddMasqueradingIptablesRules(struct network_driver *driver, - virNetworkObjPtr network, +networkAddMasqueradingIptablesRules(virNetworkObjPtr network, virNetworkIpDefPtr ipdef) { int prefix = virNetworkIpDefPrefix(ipdef); @@ -1559,8 +1549,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, } /* allow forwarding packets from the bridge interface */ - if (iptablesAddForwardAllowOut(driver->iptables, - &ipdef->address, + if (iptablesAddForwardAllowOut(&ipdef->address, prefix, network->def->bridge, forwardIf) < 0) { @@ -1573,8 +1562,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, /* allow forwarding packets to the bridge interface if they are * part of an existing connection */ - if (iptablesAddForwardAllowRelatedIn(driver->iptables, - &ipdef->address, + if (iptablesAddForwardAllowRelatedIn(&ipdef->address, prefix, network->def->bridge, forwardIf) < 0) { @@ -1608,8 +1596,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, */ /* First the generic masquerade rule for other protocols */ - if (iptablesAddForwardMasquerade(driver->iptables, - &ipdef->address, + if (iptablesAddForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, @@ -1626,8 +1613,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, } /* UDP with a source port restriction */ - if (iptablesAddForwardMasquerade(driver->iptables, - &ipdef->address, + if (iptablesAddForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, @@ -1644,8 +1630,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, } /* TCP with a source port restriction */ - if (iptablesAddForwardMasquerade(driver->iptables, - &ipdef->address, + if (iptablesAddForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, @@ -1664,30 +1649,26 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, return 0; masqerr5: - iptablesRemoveForwardMasquerade(driver->iptables, - &ipdef->address, + iptablesRemoveForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, &network->def->forward.port, "udp"); masqerr4: - iptablesRemoveForwardMasquerade(driver->iptables, - &ipdef->address, + iptablesRemoveForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, &network->def->forward.port, NULL); masqerr3: - iptablesRemoveForwardAllowRelatedIn(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowRelatedIn(&ipdef->address, prefix, network->def->bridge, forwardIf); masqerr2: - iptablesRemoveForwardAllowOut(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowOut(&ipdef->address, prefix, network->def->bridge, forwardIf); @@ -1696,43 +1677,37 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, } static void -networkRemoveMasqueradingIptablesRules(struct network_driver *driver, - virNetworkObjPtr network, +networkRemoveMasqueradingIptablesRules(virNetworkObjPtr network, virNetworkIpDefPtr ipdef) { int prefix = virNetworkIpDefPrefix(ipdef); const char *forwardIf = virNetworkDefForwardIf(network->def, 0); if (prefix >= 0) { - iptablesRemoveForwardMasquerade(driver->iptables, - &ipdef->address, + iptablesRemoveForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, &network->def->forward.port, "tcp"); - iptablesRemoveForwardMasquerade(driver->iptables, - &ipdef->address, + iptablesRemoveForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, &network->def->forward.port, "udp"); - iptablesRemoveForwardMasquerade(driver->iptables, - &ipdef->address, + iptablesRemoveForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, &network->def->forward.port, NULL); - iptablesRemoveForwardAllowRelatedIn(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowRelatedIn(&ipdef->address, prefix, network->def->bridge, forwardIf); - iptablesRemoveForwardAllowOut(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowOut(&ipdef->address, prefix, network->def->bridge, forwardIf); @@ -1740,8 +1715,7 @@ networkRemoveMasqueradingIptablesRules(struct network_driver *driver, } static int -networkAddRoutingIptablesRules(struct network_driver *driver, - virNetworkObjPtr network, +networkAddRoutingIptablesRules(virNetworkObjPtr network, virNetworkIpDefPtr ipdef) { int prefix = virNetworkIpDefPrefix(ipdef); @@ -1755,8 +1729,7 @@ networkAddRoutingIptablesRules(struct network_driver *driver, } /* allow routing packets from the bridge interface */ - if (iptablesAddForwardAllowOut(driver->iptables, - &ipdef->address, + if (iptablesAddForwardAllowOut(&ipdef->address, prefix, network->def->bridge, forwardIf) < 0) { @@ -1767,8 +1740,7 @@ networkAddRoutingIptablesRules(struct network_driver *driver, } /* allow routing packets to the bridge interface */ - if (iptablesAddForwardAllowIn(driver->iptables, - &ipdef->address, + if (iptablesAddForwardAllowIn(&ipdef->address, prefix, network->def->bridge, forwardIf) < 0) { @@ -1781,8 +1753,7 @@ networkAddRoutingIptablesRules(struct network_driver *driver, return 0; routeerr2: - iptablesRemoveForwardAllowOut(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowOut(&ipdef->address, prefix, network->def->bridge, forwardIf); @@ -1791,22 +1762,19 @@ routeerr1: } static void -networkRemoveRoutingIptablesRules(struct network_driver *driver, - virNetworkObjPtr network, +networkRemoveRoutingIptablesRules(virNetworkObjPtr network, virNetworkIpDefPtr ipdef) { int prefix = virNetworkIpDefPrefix(ipdef); const char *forwardIf = virNetworkDefForwardIf(network->def, 0); if (prefix >= 0) { - iptablesRemoveForwardAllowIn(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowIn(&ipdef->address, prefix, network->def->bridge, forwardIf); - iptablesRemoveForwardAllowOut(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowOut(&ipdef->address, prefix, network->def->bridge, forwardIf); @@ -1819,8 +1787,7 @@ networkRemoveRoutingIptablesRules(struct network_driver *driver, * If any IPv6 addresses are defined, then add the rules for regular operation. */ static int -networkAddGeneralIp6tablesRules(struct network_driver *driver, - virNetworkObjPtr network) +networkAddGeneralIp6tablesRules(virNetworkObjPtr network) { if (!virNetworkDefGetIpByIndex(network->def, AF_INET6, 0) && @@ -1830,16 +1797,14 @@ networkAddGeneralIp6tablesRules(struct network_driver *driver, /* Catch all rules to block forwarding to/from bridges */ - if (iptablesAddForwardRejectOut(driver->iptables, AF_INET6, - network->def->bridge) < 0) { + if (iptablesAddForwardRejectOut(AF_INET6, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add ip6tables rule to block outbound traffic from '%s'"), network->def->bridge); goto err1; } - if (iptablesAddForwardRejectIn(driver->iptables, AF_INET6, - network->def->bridge) < 0) { + if (iptablesAddForwardRejectIn(AF_INET6, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add ip6tables rule to block inbound traffic to '%s'"), network->def->bridge); @@ -1847,8 +1812,7 @@ networkAddGeneralIp6tablesRules(struct network_driver *driver, } /* Allow traffic between guests on the same bridge */ - if (iptablesAddForwardAllowCross(driver->iptables, AF_INET6, - network->def->bridge) < 0) { + if (iptablesAddForwardAllowCross(AF_INET6, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add ip6tables rule to allow cross bridge traffic on '%s'"), network->def->bridge); @@ -1860,24 +1824,21 @@ networkAddGeneralIp6tablesRules(struct network_driver *driver, return 0; /* allow DNS over IPv6 */ - if (iptablesAddTcpInput(driver->iptables, AF_INET6, - network->def->bridge, 53) < 0) { + if (iptablesAddTcpInput(AF_INET6, network->def->bridge, 53) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add ip6tables rule to allow DNS requests from '%s'"), network->def->bridge); goto err4; } - if (iptablesAddUdpInput(driver->iptables, AF_INET6, - network->def->bridge, 53) < 0) { + if (iptablesAddUdpInput(AF_INET6, network->def->bridge, 53) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add ip6tables rule to allow DNS requests from '%s'"), network->def->bridge); goto err5; } - if (iptablesAddUdpInput(driver->iptables, AF_INET6, - network->def->bridge, 547) < 0) { + if (iptablesAddUdpInput(AF_INET6, network->def->bridge, 547) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add ip6tables rule to allow DHCP6 requests from '%s'"), network->def->bridge); @@ -1888,44 +1849,42 @@ networkAddGeneralIp6tablesRules(struct network_driver *driver, /* unwind in reverse order from the point of failure */ err6: - iptablesRemoveUdpInput(driver->iptables, AF_INET6, network->def->bridge, 53); + iptablesRemoveUdpInput(AF_INET6, network->def->bridge, 53); err5: - iptablesRemoveTcpInput(driver->iptables, AF_INET6, network->def->bridge, 53); + iptablesRemoveTcpInput(AF_INET6, network->def->bridge, 53); err4: - iptablesRemoveForwardAllowCross(driver->iptables, AF_INET6, network->def->bridge); + iptablesRemoveForwardAllowCross(AF_INET6, network->def->bridge); err3: - iptablesRemoveForwardRejectIn(driver->iptables, AF_INET6, network->def->bridge); + iptablesRemoveForwardRejectIn(AF_INET6, network->def->bridge); err2: - iptablesRemoveForwardRejectOut(driver->iptables, AF_INET6, network->def->bridge); + iptablesRemoveForwardRejectOut(AF_INET6, network->def->bridge); err1: return -1; } static void -networkRemoveGeneralIp6tablesRules(struct network_driver *driver, - virNetworkObjPtr network) +networkRemoveGeneralIp6tablesRules(virNetworkObjPtr network) { if (!virNetworkDefGetIpByIndex(network->def, AF_INET6, 0) && !network->def->ipv6nogw) { return; } if (virNetworkDefGetIpByIndex(network->def, AF_INET6, 0)) { - iptablesRemoveUdpInput(driver->iptables, AF_INET6, network->def->bridge, 547); - iptablesRemoveUdpInput(driver->iptables, AF_INET6, network->def->bridge, 53); - iptablesRemoveTcpInput(driver->iptables, AF_INET6, network->def->bridge, 53); + iptablesRemoveUdpInput(AF_INET6, network->def->bridge, 547); + iptablesRemoveUdpInput(AF_INET6, network->def->bridge, 53); + iptablesRemoveTcpInput(AF_INET6, network->def->bridge, 53); } /* the following rules are there if no IPv6 address has been defined * but network->def->ipv6nogw == true */ - iptablesRemoveForwardAllowCross(driver->iptables, AF_INET6, network->def->bridge); - iptablesRemoveForwardRejectIn(driver->iptables, AF_INET6, network->def->bridge); - iptablesRemoveForwardRejectOut(driver->iptables, AF_INET6, network->def->bridge); + iptablesRemoveForwardAllowCross(AF_INET6, network->def->bridge); + iptablesRemoveForwardRejectIn(AF_INET6, network->def->bridge); + iptablesRemoveForwardRejectOut(AF_INET6, network->def->bridge); } static int -networkAddGeneralIptablesRules(struct network_driver *driver, - virNetworkObjPtr network) +networkAddGeneralIptablesRules(virNetworkObjPtr network) { int ii; virNetworkIpDefPtr ipv4def; @@ -1941,16 +1900,14 @@ networkAddGeneralIptablesRules(struct network_driver *driver, /* allow DHCP requests through to dnsmasq */ - if (iptablesAddTcpInput(driver->iptables, AF_INET, - network->def->bridge, 67) < 0) { + if (iptablesAddTcpInput(AF_INET, network->def->bridge, 67) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow DHCP requests from '%s'"), network->def->bridge); goto err1; } - if (iptablesAddUdpInput(driver->iptables, AF_INET, - network->def->bridge, 67) < 0) { + if (iptablesAddUdpInput(AF_INET, network->def->bridge, 67) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow DHCP requests from '%s'"), network->def->bridge); @@ -1964,24 +1921,21 @@ networkAddGeneralIptablesRules(struct network_driver *driver, */ if (ipv4def && (ipv4def->nranges || ipv4def->nhosts) && - (iptablesAddOutputFixUdpChecksum(driver->iptables, - network->def->bridge, 68) < 0)) { + (iptablesAddOutputFixUdpChecksum(network->def->bridge, 68) < 0)) { VIR_WARN("Could not add rule to fixup DHCP response checksums " "on network '%s'.", network->def->name); VIR_WARN("May need to update iptables package & kernel to support CHECKSUM rule."); } /* allow DNS requests through to dnsmasq */ - if (iptablesAddTcpInput(driver->iptables, AF_INET, - network->def->bridge, 53) < 0) { + if (iptablesAddTcpInput(AF_INET, network->def->bridge, 53) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow DNS requests from '%s'"), network->def->bridge); goto err3; } - if (iptablesAddUdpInput(driver->iptables, AF_INET, - network->def->bridge, 53) < 0) { + if (iptablesAddUdpInput(AF_INET, network->def->bridge, 53) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow DNS requests from '%s'"), network->def->bridge); @@ -1990,8 +1944,7 @@ networkAddGeneralIptablesRules(struct network_driver *driver, /* allow TFTP requests through to dnsmasq if necessary */ if (ipv4def && ipv4def->tftproot && - iptablesAddUdpInput(driver->iptables, AF_INET, - network->def->bridge, 69) < 0) { + iptablesAddUdpInput(AF_INET, network->def->bridge, 69) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow TFTP requests from '%s'"), network->def->bridge); @@ -2000,16 +1953,14 @@ networkAddGeneralIptablesRules(struct network_driver *driver, /* Catch all rules to block forwarding to/from bridges */ - if (iptablesAddForwardRejectOut(driver->iptables, AF_INET, - network->def->bridge) < 0) { + if (iptablesAddForwardRejectOut(AF_INET, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to block outbound traffic from '%s'"), network->def->bridge); goto err6; } - if (iptablesAddForwardRejectIn(driver->iptables, AF_INET, - network->def->bridge) < 0) { + if (iptablesAddForwardRejectIn(AF_INET, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to block inbound traffic to '%s'"), network->def->bridge); @@ -2017,8 +1968,7 @@ networkAddGeneralIptablesRules(struct network_driver *driver, } /* Allow traffic between guests on the same bridge */ - if (iptablesAddForwardAllowCross(driver->iptables, AF_INET, - network->def->bridge) < 0) { + if (iptablesAddForwardAllowCross(AF_INET, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow cross bridge traffic on '%s'"), network->def->bridge); @@ -2026,7 +1976,7 @@ networkAddGeneralIptablesRules(struct network_driver *driver, } /* add IPv6 general rules, if needed */ - if (networkAddGeneralIp6tablesRules(driver, network) < 0) { + if (networkAddGeneralIp6tablesRules(network) < 0) { goto err9; } @@ -2034,35 +1984,34 @@ networkAddGeneralIptablesRules(struct network_driver *driver, /* unwind in reverse order from the point of failure */ err9: - iptablesRemoveForwardAllowCross(driver->iptables, AF_INET, network->def->bridge); + iptablesRemoveForwardAllowCross(AF_INET, network->def->bridge); err8: - iptablesRemoveForwardRejectIn(driver->iptables, AF_INET, network->def->bridge); + iptablesRemoveForwardRejectIn(AF_INET, network->def->bridge); err7: - iptablesRemoveForwardRejectOut(driver->iptables, AF_INET, network->def->bridge); + iptablesRemoveForwardRejectOut(AF_INET, network->def->bridge); err6: if (ipv4def && ipv4def->tftproot) { - iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 69); + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 69); } err5: - iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 53); + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 53); err4: - iptablesRemoveTcpInput(driver->iptables, AF_INET, network->def->bridge, 53); + iptablesRemoveTcpInput(AF_INET, network->def->bridge, 53); err3: - iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 67); + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 67); err2: - iptablesRemoveTcpInput(driver->iptables, AF_INET, network->def->bridge, 67); + iptablesRemoveTcpInput(AF_INET, network->def->bridge, 67); err1: return -1; } static void -networkRemoveGeneralIptablesRules(struct network_driver *driver, - virNetworkObjPtr network) +networkRemoveGeneralIptablesRules(virNetworkObjPtr network) { int ii; virNetworkIpDefPtr ipv4def; - networkRemoveGeneralIp6tablesRules(driver, network); + networkRemoveGeneralIp6tablesRules(network); for (ii = 0; (ipv4def = virNetworkDefGetIpByIndex(network->def, AF_INET, ii)); @@ -2071,25 +2020,23 @@ networkRemoveGeneralIptablesRules(struct network_driver *driver, break; } - iptablesRemoveForwardAllowCross(driver->iptables, AF_INET, network->def->bridge); - iptablesRemoveForwardRejectIn(driver->iptables, AF_INET, network->def->bridge); - iptablesRemoveForwardRejectOut(driver->iptables, AF_INET, network->def->bridge); + iptablesRemoveForwardAllowCross(AF_INET, network->def->bridge); + iptablesRemoveForwardRejectIn(AF_INET, network->def->bridge); + iptablesRemoveForwardRejectOut(AF_INET, network->def->bridge); if (ipv4def && ipv4def->tftproot) { - iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 69); + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 69); } - iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 53); - iptablesRemoveTcpInput(driver->iptables, AF_INET, network->def->bridge, 53); + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 53); + iptablesRemoveTcpInput(AF_INET, network->def->bridge, 53); if (ipv4def && (ipv4def->nranges || ipv4def->nhosts)) { - iptablesRemoveOutputFixUdpChecksum(driver->iptables, - network->def->bridge, 68); + iptablesRemoveOutputFixUdpChecksum(network->def->bridge, 68); } - iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 67); - iptablesRemoveTcpInput(driver->iptables, AF_INET, network->def->bridge, 67); + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 67); + iptablesRemoveTcpInput(AF_INET, network->def->bridge, 67); } static int -networkAddIpSpecificIptablesRules(struct network_driver *driver, - virNetworkObjPtr network, +networkAddIpSpecificIptablesRules(virNetworkObjPtr network, virNetworkIpDefPtr ipdef) { /* NB: in the case of IPv6, routing rules are added when the @@ -2098,48 +2045,46 @@ networkAddIpSpecificIptablesRules(struct network_driver *driver, if (network->def->forward.type == VIR_NETWORK_FORWARD_NAT) { if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET)) - return networkAddMasqueradingIptablesRules(driver, network, ipdef); + return networkAddMasqueradingIptablesRules(network, ipdef); else if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET6)) - return networkAddRoutingIptablesRules(driver, network, ipdef); + return networkAddRoutingIptablesRules(network, ipdef); } else if (network->def->forward.type == VIR_NETWORK_FORWARD_ROUTE) { - return networkAddRoutingIptablesRules(driver, network, ipdef); + return networkAddRoutingIptablesRules(network, ipdef); } return 0; } static void -networkRemoveIpSpecificIptablesRules(struct network_driver *driver, - virNetworkObjPtr network, +networkRemoveIpSpecificIptablesRules(virNetworkObjPtr network, virNetworkIpDefPtr ipdef) { if (network->def->forward.type == VIR_NETWORK_FORWARD_NAT) { if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET)) - networkRemoveMasqueradingIptablesRules(driver, network, ipdef); + networkRemoveMasqueradingIptablesRules(network, ipdef); else if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET6)) - networkRemoveRoutingIptablesRules(driver, network, ipdef); + networkRemoveRoutingIptablesRules(network, ipdef); } else if (network->def->forward.type == VIR_NETWORK_FORWARD_ROUTE) { - networkRemoveRoutingIptablesRules(driver, network, ipdef); + networkRemoveRoutingIptablesRules(network, ipdef); } } /* Add all rules for all ip addresses (and general rules) on a network */ static int -networkAddIptablesRules(struct network_driver *driver, - virNetworkObjPtr network) +networkAddIptablesRules(virNetworkObjPtr network) { int ii; virNetworkIpDefPtr ipdef; virErrorPtr orig_error; /* Add "once per network" rules */ - if (networkAddGeneralIptablesRules(driver, network) < 0) + if (networkAddGeneralIptablesRules(network) < 0) return -1; for (ii = 0; (ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, ii)); ii++) { /* Add address-specific iptables rules */ - if (networkAddIpSpecificIptablesRules(driver, network, ipdef) < 0) { + if (networkAddIpSpecificIptablesRules(network, ipdef) < 0) { goto err; } } @@ -2155,9 +2100,9 @@ err: */ while ((--ii >= 0) && (ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, ii))) { - networkRemoveIpSpecificIptablesRules(driver, network, ipdef); + networkRemoveIpSpecificIptablesRules(network, ipdef); } - networkRemoveGeneralIptablesRules(driver, network); + networkRemoveGeneralIptablesRules(network); /* return the original error */ virSetError(orig_error); @@ -2167,8 +2112,7 @@ err: /* Remove all rules for all ip addresses (and general rules) on a network */ static void -networkRemoveIptablesRules(struct network_driver *driver, - virNetworkObjPtr network) +networkRemoveIptablesRules(virNetworkObjPtr network) { int ii; virNetworkIpDefPtr ipdef; @@ -2176,9 +2120,9 @@ networkRemoveIptablesRules(struct network_driver *driver, for (ii = 0; (ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, ii)); ii++) { - networkRemoveIpSpecificIptablesRules(driver, network, ipdef); + networkRemoveIpSpecificIptablesRules(network, ipdef); } - networkRemoveGeneralIptablesRules(driver, network); + networkRemoveGeneralIptablesRules(network); } static void @@ -2199,8 +2143,8 @@ networkReloadIptablesRules(struct network_driver *driver) /* Only the three L3 network types that are configured by libvirt * need to have iptables rules reloaded. */ - networkRemoveIptablesRules(driver, network); - if (networkAddIptablesRules(driver, network) < 0) { + networkRemoveIptablesRules(network); + if (networkAddIptablesRules(network) < 0) { /* failed to add but already logged */ } } @@ -2526,7 +2470,7 @@ networkStartNetworkVirtual(struct network_driver *driver, goto err1; /* Add "once per network" rules */ - if (networkAddIptablesRules(driver, network) < 0) + if (networkAddIptablesRules(network) < 0) goto err1; for (ii = 0; @@ -2619,7 +2563,7 @@ networkStartNetworkVirtual(struct network_driver *driver, err2: if (!save_err) save_err = virSaveLastError(); - networkRemoveIptablesRules(driver, network); + networkRemoveIptablesRules(network); err1: if (!save_err) @@ -2644,8 +2588,7 @@ networkStartNetworkVirtual(struct network_driver *driver, return -1; } -static int networkShutdownNetworkVirtual(struct network_driver *driver, - virNetworkObjPtr network) +static int networkShutdownNetworkVirtual(virNetworkObjPtr network) { virNetDevBandwidthClear(network->def->bridge); @@ -2677,7 +2620,7 @@ static int networkShutdownNetworkVirtual(struct network_driver *driver, ignore_value(virNetDevSetOnline(network->def->bridge, 0)); - networkRemoveIptablesRules(driver, network); + networkRemoveIptablesRules(network); ignore_value(virNetDevBridgeDelete(network->def->bridge)); @@ -2802,7 +2745,7 @@ static int networkShutdownNetwork(struct network_driver *driver, case VIR_NETWORK_FORWARD_NONE: case VIR_NETWORK_FORWARD_NAT: case VIR_NETWORK_FORWARD_ROUTE: - ret = networkShutdownNetworkVirtual(driver, network); + ret = networkShutdownNetworkVirtual(network); break; case VIR_NETWORK_FORWARD_BRIDGE: @@ -3490,8 +3433,8 @@ networkUpdate(virNetworkPtr net, network->def->forward.type == VIR_NETWORK_FORWARD_NAT || network->def->forward.type == VIR_NETWORK_FORWARD_ROUTE)) { /* these could affect the iptables rules */ - networkRemoveIptablesRules(driver, network); - if (networkAddIptablesRules(driver, network) < 0) + networkRemoveIptablesRules(network); + if (networkAddIptablesRules(network) < 0) goto cleanup; } diff --git a/src/util/viriptables.c b/src/util/viriptables.c index 16fbe9c..63a8031 100644 --- a/src/util/viriptables.c +++ b/src/util/viriptables.c @@ -88,52 +88,8 @@ enum { REMOVE }; -typedef struct -{ - char *table; - char *chain; -} iptRules; - -struct _iptablesContext -{ - iptRules *input_filter; - iptRules *forward_filter; - iptRules *nat_postrouting; - iptRules *mangle_postrouting; -}; - -static void -iptRulesFree(iptRules *rules) -{ - VIR_FREE(rules->table); - VIR_FREE(rules->chain); - VIR_FREE(rules); -} - -static iptRules * -iptRulesNew(const char *table, - const char *chain) -{ - iptRules *rules; - - if (VIR_ALLOC(rules) < 0) - return NULL; - - if (VIR_STRDUP(rules->table, table) < 0) - goto error; - - if (VIR_STRDUP(rules->chain, chain) < 0) - goto error; - - return rules; - - error: - iptRulesFree(rules); - return NULL; -} - static virCommandPtr -iptablesCommandNew(iptRules *rules, int family, int action) +iptablesCommandNew(const char *table, const char *chain, int family, int action) { virCommandPtr cmd = NULL; #if HAVE_FIREWALLD @@ -150,9 +106,9 @@ iptablesCommandNew(iptRules *rules, int family, int action) ? IP6TABLES_PATH : IPTABLES_PATH); } - virCommandAddArgList(cmd, "--table", rules->table, + virCommandAddArgList(cmd, "--table", table, action == ADD ? "--insert" : "--delete", - rules->chain, NULL); + chain, NULL); return cmd; } @@ -166,14 +122,14 @@ iptablesCommandRunAndFree(virCommandPtr cmd) } static int ATTRIBUTE_SENTINEL -iptablesAddRemoveRule(iptRules *rules, int family, int action, +iptablesAddRemoveRule(const char *table, const char *chain, int family, int action, const char *arg, ...) { va_list args; virCommandPtr cmd = NULL; const char *s; - cmd = iptablesCommandNew(rules, family, action); + cmd = iptablesCommandNew(table, chain, family, action); virCommandAddArg(cmd, arg); va_start(args, arg); @@ -184,63 +140,8 @@ iptablesAddRemoveRule(iptRules *rules, int family, int action, return iptablesCommandRunAndFree(cmd); } -/** - * iptablesContextNew: - * - * Create a new IPtable context - * - * Returns a pointer to the new structure or NULL in case of error - */ -iptablesContext * -iptablesContextNew(void) -{ - iptablesContext *ctx; - - if (VIR_ALLOC(ctx) < 0) - return NULL; - - if (!(ctx->input_filter = iptRulesNew("filter", "INPUT"))) - goto error; - - if (!(ctx->forward_filter = iptRulesNew("filter", "FORWARD"))) - goto error; - - if (!(ctx->nat_postrouting = iptRulesNew("nat", "POSTROUTING"))) - goto error; - - if (!(ctx->mangle_postrouting = iptRulesNew("mangle", "POSTROUTING"))) - goto error; - - return ctx; - - error: - iptablesContextFree(ctx); - return NULL; -} - -/** - * iptablesContextFree: - * @ctx: pointer to the IP table context - * - * Free the resources associated with an IP table context - */ -void -iptablesContextFree(iptablesContext *ctx) -{ - if (ctx->input_filter) - iptRulesFree(ctx->input_filter); - if (ctx->forward_filter) - iptRulesFree(ctx->forward_filter); - if (ctx->nat_postrouting) - iptRulesFree(ctx->nat_postrouting); - if (ctx->mangle_postrouting) - iptRulesFree(ctx->mangle_postrouting); - VIR_FREE(ctx); -} - static int -iptablesInput(iptablesContext *ctx, - int family, +iptablesInput(int family, const char *iface, int port, int action, @@ -251,7 +152,7 @@ iptablesInput(iptablesContext *ctx, snprintf(portstr, sizeof(portstr), "%d", port); portstr[sizeof(portstr) - 1] = '\0'; - return iptablesAddRemoveRule(ctx->input_filter, + return iptablesAddRemoveRule("filter", "INPUT", family, action, "--in-interface", iface, @@ -274,12 +175,11 @@ iptablesInput(iptablesContext *ctx, */ int -iptablesAddTcpInput(iptablesContext *ctx, - int family, +iptablesAddTcpInput(int family, const char *iface, int port) { - return iptablesInput(ctx, family, iface, port, ADD, 1); + return iptablesInput(family, iface, port, ADD, 1); } /** @@ -294,12 +194,11 @@ iptablesAddTcpInput(iptablesContext *ctx, * Returns 0 in case of success or an error code in case of error */ int -iptablesRemoveTcpInput(iptablesContext *ctx, - int family, +iptablesRemoveTcpInput(int family, const char *iface, int port) { - return iptablesInput(ctx, family, iface, port, REMOVE, 1); + return iptablesInput(family, iface, port, REMOVE, 1); } /** @@ -315,12 +214,11 @@ iptablesRemoveTcpInput(iptablesContext *ctx, */ int -iptablesAddUdpInput(iptablesContext *ctx, - int family, +iptablesAddUdpInput(int family, const char *iface, int port) { - return iptablesInput(ctx, family, iface, port, ADD, 0); + return iptablesInput(family, iface, port, ADD, 0); } /** @@ -335,12 +233,11 @@ iptablesAddUdpInput(iptablesContext *ctx, * Returns 0 in case of success or an error code in case of error */ int -iptablesRemoveUdpInput(iptablesContext *ctx, - int family, +iptablesRemoveUdpInput(int family, const char *iface, int port) { - return iptablesInput(ctx, family, iface, port, REMOVE, 0); + return iptablesInput(family, iface, port, REMOVE, 0); } @@ -381,8 +278,7 @@ static char *iptablesFormatNetwork(virSocketAddr *netaddr, * to proceed to WAN */ static int -iptablesForwardAllowOut(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesForwardAllowOut(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev, @@ -395,7 +291,7 @@ iptablesForwardAllowOut(iptablesContext *ctx, if (!(networkstr = iptablesFormatNetwork(netaddr, prefix))) return -1; - cmd = iptablesCommandNew(ctx->forward_filter, + cmd = iptablesCommandNew("filter", "FORWARD", VIR_SOCKET_ADDR_FAMILY(netaddr), action); virCommandAddArgList(cmd, @@ -426,13 +322,12 @@ iptablesForwardAllowOut(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardAllowOut(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesAddForwardAllowOut(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev) { - return iptablesForwardAllowOut(ctx, netaddr, prefix, iface, physdev, ADD); + return iptablesForwardAllowOut(netaddr, prefix, iface, physdev, ADD); } /** @@ -449,13 +344,12 @@ iptablesAddForwardAllowOut(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardAllowOut(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesRemoveForwardAllowOut(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev) { - return iptablesForwardAllowOut(ctx, netaddr, prefix, iface, physdev, REMOVE); + return iptablesForwardAllowOut(netaddr, prefix, iface, physdev, REMOVE); } @@ -463,8 +357,7 @@ iptablesRemoveForwardAllowOut(iptablesContext *ctx, * and associated with an existing connection */ static int -iptablesForwardAllowRelatedIn(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesForwardAllowRelatedIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev, @@ -477,7 +370,7 @@ iptablesForwardAllowRelatedIn(iptablesContext *ctx, return -1; if (physdev && physdev[0]) { - ret = iptablesAddRemoveRule(ctx->forward_filter, + ret = iptablesAddRemoveRule("filter", "FORWARD", VIR_SOCKET_ADDR_FAMILY(netaddr), action, "--destination", networkstr, @@ -488,7 +381,7 @@ iptablesForwardAllowRelatedIn(iptablesContext *ctx, "--jump", "ACCEPT", NULL); } else { - ret = iptablesAddRemoveRule(ctx->forward_filter, + ret = iptablesAddRemoveRule("filter", "FORWARD", VIR_SOCKET_ADDR_FAMILY(netaddr), action, "--destination", networkstr, @@ -516,13 +409,12 @@ iptablesForwardAllowRelatedIn(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardAllowRelatedIn(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesAddForwardAllowRelatedIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev) { - return iptablesForwardAllowRelatedIn(ctx, netaddr, prefix, iface, physdev, ADD); + return iptablesForwardAllowRelatedIn(netaddr, prefix, iface, physdev, ADD); } /** @@ -539,20 +431,18 @@ iptablesAddForwardAllowRelatedIn(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardAllowRelatedIn(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesRemoveForwardAllowRelatedIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev) { - return iptablesForwardAllowRelatedIn(ctx, netaddr, prefix, iface, physdev, REMOVE); + return iptablesForwardAllowRelatedIn(netaddr, prefix, iface, physdev, REMOVE); } /* Allow all traffic destined to the bridge, with a valid network address */ static int -iptablesForwardAllowIn(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesForwardAllowIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev, @@ -565,7 +455,7 @@ iptablesForwardAllowIn(iptablesContext *ctx, return -1; if (physdev && physdev[0]) { - ret = iptablesAddRemoveRule(ctx->forward_filter, + ret = iptablesAddRemoveRule("filter", "FORWARD", VIR_SOCKET_ADDR_FAMILY(netaddr), action, "--destination", networkstr, @@ -574,7 +464,7 @@ iptablesForwardAllowIn(iptablesContext *ctx, "--jump", "ACCEPT", NULL); } else { - ret = iptablesAddRemoveRule(ctx->forward_filter, + ret = iptablesAddRemoveRule("filter", "FORWARD", VIR_SOCKET_ADDR_FAMILY(netaddr), action, "--destination", networkstr, @@ -600,13 +490,12 @@ iptablesForwardAllowIn(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardAllowIn(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesAddForwardAllowIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev) { - return iptablesForwardAllowIn(ctx, netaddr, prefix, iface, physdev, ADD); + return iptablesForwardAllowIn(netaddr, prefix, iface, physdev, ADD); } /** @@ -623,13 +512,12 @@ iptablesAddForwardAllowIn(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardAllowIn(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesRemoveForwardAllowIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev) { - return iptablesForwardAllowIn(ctx, netaddr, prefix, iface, physdev, REMOVE); + return iptablesForwardAllowIn(netaddr, prefix, iface, physdev, REMOVE); } @@ -637,12 +525,11 @@ iptablesRemoveForwardAllowIn(iptablesContext *ctx, * with a valid network address */ static int -iptablesForwardAllowCross(iptablesContext *ctx, - int family, +iptablesForwardAllowCross(int family, const char *iface, int action) { - return iptablesAddRemoveRule(ctx->forward_filter, + return iptablesAddRemoveRule("filter", "FORWARD", family, action, "--in-interface", iface, @@ -663,11 +550,10 @@ iptablesForwardAllowCross(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardAllowCross(iptablesContext *ctx, - int family, +iptablesAddForwardAllowCross(int family, const char *iface) { - return iptablesForwardAllowCross(ctx, family, iface, ADD); + return iptablesForwardAllowCross(family, iface, ADD); } /** @@ -682,11 +568,10 @@ iptablesAddForwardAllowCross(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardAllowCross(iptablesContext *ctx, - int family, +iptablesRemoveForwardAllowCross(int family, const char *iface) { - return iptablesForwardAllowCross(ctx, family, iface, REMOVE); + return iptablesForwardAllowCross(family, iface, REMOVE); } @@ -694,12 +579,11 @@ iptablesRemoveForwardAllowCross(iptablesContext *ctx, * ie the bridge is the in interface */ static int -iptablesForwardRejectOut(iptablesContext *ctx, - int family, +iptablesForwardRejectOut(int family, const char *iface, int action) { - return iptablesAddRemoveRule(ctx->forward_filter, + return iptablesAddRemoveRule("filter", "FORWARD", family, action, "--in-interface", iface, @@ -718,11 +602,10 @@ iptablesForwardRejectOut(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardRejectOut(iptablesContext *ctx, - int family, +iptablesAddForwardRejectOut(int family, const char *iface) { - return iptablesForwardRejectOut(ctx, family, iface, ADD); + return iptablesForwardRejectOut(family, iface, ADD); } /** @@ -736,11 +619,10 @@ iptablesAddForwardRejectOut(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardRejectOut(iptablesContext *ctx, - int family, +iptablesRemoveForwardRejectOut(int family, const char *iface) { - return iptablesForwardRejectOut(ctx, family, iface, REMOVE); + return iptablesForwardRejectOut(family, iface, REMOVE); } @@ -750,12 +632,11 @@ iptablesRemoveForwardRejectOut(iptablesContext *ctx, * ie the bridge is the out interface */ static int -iptablesForwardRejectIn(iptablesContext *ctx, - int family, +iptablesForwardRejectIn(int family, const char *iface, int action) { - return iptablesAddRemoveRule(ctx->forward_filter, + return iptablesAddRemoveRule("filter", "FORWARD", family, action, "--out-interface", iface, @@ -774,11 +655,10 @@ iptablesForwardRejectIn(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardRejectIn(iptablesContext *ctx, - int family, +iptablesAddForwardRejectIn(int family, const char *iface) { - return iptablesForwardRejectIn(ctx, family, iface, ADD); + return iptablesForwardRejectIn(family, iface, ADD); } /** @@ -792,11 +672,10 @@ iptablesAddForwardRejectIn(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardRejectIn(iptablesContext *ctx, - int family, +iptablesRemoveForwardRejectIn(int family, const char *iface) { - return iptablesForwardRejectIn(ctx, family, iface, REMOVE); + return iptablesForwardRejectIn(family, iface, REMOVE); } @@ -804,8 +683,7 @@ iptablesRemoveForwardRejectIn(iptablesContext *ctx, * with the bridge */ static int -iptablesForwardMasquerade(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesForwardMasquerade(virSocketAddr *netaddr, unsigned int prefix, const char *physdev, virSocketAddrRangePtr addr, @@ -841,7 +719,7 @@ iptablesForwardMasquerade(iptablesContext *ctx, } } - cmd = iptablesCommandNew(ctx->nat_postrouting, AF_INET, action); + cmd = iptablesCommandNew("nat", "POSTROUTING", AF_INET, action); virCommandAddArgList(cmd, "--source", networkstr, NULL); if (protocol && protocol[0]) @@ -922,15 +800,14 @@ cleanup: * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardMasquerade(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesAddForwardMasquerade(virSocketAddr *netaddr, unsigned int prefix, const char *physdev, virSocketAddrRangePtr addr, virPortRangePtr port, const char *protocol) { - return iptablesForwardMasquerade(ctx, netaddr, prefix, physdev, addr, port, + return iptablesForwardMasquerade(netaddr, prefix, physdev, addr, port, protocol, ADD); } @@ -948,22 +825,20 @@ iptablesAddForwardMasquerade(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardMasquerade(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesRemoveForwardMasquerade(virSocketAddr *netaddr, unsigned int prefix, const char *physdev, virSocketAddrRangePtr addr, virPortRangePtr port, const char *protocol) { - return iptablesForwardMasquerade(ctx, netaddr, prefix, physdev, addr, port, + return iptablesForwardMasquerade(netaddr, prefix, physdev, addr, port, protocol, REMOVE); } static int -iptablesOutputFixUdpChecksum(iptablesContext *ctx, - const char *iface, +iptablesOutputFixUdpChecksum(const char *iface, int port, int action) { @@ -972,7 +847,7 @@ iptablesOutputFixUdpChecksum(iptablesContext *ctx, snprintf(portstr, sizeof(portstr), "%d", port); portstr[sizeof(portstr) - 1] = '\0'; - return iptablesAddRemoveRule(ctx->mangle_postrouting, + return iptablesAddRemoveRule("mangle", "POSTROUTING", AF_INET, action, "--out-interface", iface, @@ -998,11 +873,10 @@ iptablesOutputFixUdpChecksum(iptablesContext *ctx, */ int -iptablesAddOutputFixUdpChecksum(iptablesContext *ctx, - const char *iface, +iptablesAddOutputFixUdpChecksum(const char *iface, int port) { - return iptablesOutputFixUdpChecksum(ctx, iface, port, ADD); + return iptablesOutputFixUdpChecksum(iface, port, ADD); } /** @@ -1019,9 +893,8 @@ iptablesAddOutputFixUdpChecksum(iptablesContext *ctx, * return an error, which should be ignored) */ int -iptablesRemoveOutputFixUdpChecksum(iptablesContext *ctx, - const char *iface, +iptablesRemoveOutputFixUdpChecksum(const char *iface, int port) { - return iptablesOutputFixUdpChecksum(ctx, iface, port, REMOVE); + return iptablesOutputFixUdpChecksum(iface, port, REMOVE); } diff --git a/src/util/viriptables.h b/src/util/viriptables.h index b7ce59b..447f4a8 100644 --- a/src/util/viriptables.h +++ b/src/util/viriptables.h @@ -26,102 +26,77 @@ # include "virsocketaddr.h" -typedef struct _iptablesContext iptablesContext; - -iptablesContext *iptablesContextNew (void); -void iptablesContextFree (iptablesContext *ctx); - -int iptablesAddTcpInput (iptablesContext *ctx, - int family, +int iptablesAddTcpInput (int family, const char *iface, int port); -int iptablesRemoveTcpInput (iptablesContext *ctx, - int family, +int iptablesRemoveTcpInput (int family, const char *iface, int port); -int iptablesAddUdpInput (iptablesContext *ctx, - int family, +int iptablesAddUdpInput (int family, const char *iface, int port); -int iptablesRemoveUdpInput (iptablesContext *ctx, - int family, +int iptablesRemoveUdpInput (int family, const char *iface, int port); -int iptablesAddForwardAllowOut (iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesAddForwardAllowOut (virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev); -int iptablesRemoveForwardAllowOut (iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesRemoveForwardAllowOut (virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev); -int iptablesAddForwardAllowRelatedIn(iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesAddForwardAllowRelatedIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev); -int iptablesRemoveForwardAllowRelatedIn(iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesRemoveForwardAllowRelatedIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev); -int iptablesAddForwardAllowIn (iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesAddForwardAllowIn (virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev); -int iptablesRemoveForwardAllowIn (iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesRemoveForwardAllowIn (virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev); -int iptablesAddForwardAllowCross (iptablesContext *ctx, - int family, +int iptablesAddForwardAllowCross (int family, const char *iface); -int iptablesRemoveForwardAllowCross (iptablesContext *ctx, - int family, +int iptablesRemoveForwardAllowCross (int family, const char *iface); -int iptablesAddForwardRejectOut (iptablesContext *ctx, - int family, +int iptablesAddForwardRejectOut (int family, const char *iface); -int iptablesRemoveForwardRejectOut (iptablesContext *ctx, - int family, +int iptablesRemoveForwardRejectOut (int family, const char *iface); -int iptablesAddForwardRejectIn (iptablesContext *ctx, - int family, +int iptablesAddForwardRejectIn (int family, const char *iface); -int iptablesRemoveForwardRejectIn (iptablesContext *ctx, - int family, +int iptablesRemoveForwardRejectIn (int family, const char *iface); -int iptablesAddForwardMasquerade (iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesAddForwardMasquerade (virSocketAddr *netaddr, unsigned int prefix, const char *physdev, virSocketAddrRangePtr addr, virPortRangePtr port, const char *protocol); -int iptablesRemoveForwardMasquerade (iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesRemoveForwardMasquerade (virSocketAddr *netaddr, unsigned int prefix, const char *physdev, virSocketAddrRangePtr addr, virPortRangePtr port, const char *protocol); -int iptablesAddOutputFixUdpChecksum (iptablesContext *ctx, - const char *iface, +int iptablesAddOutputFixUdpChecksum (const char *iface, int port); -int iptablesRemoveOutputFixUdpChecksum (iptablesContext *ctx, - const char *iface, +int iptablesRemoveOutputFixUdpChecksum (const char *iface, int port); #endif /* __QEMUD_IPTABLES_H__ */ -- 1.8.1.4

3 3

[libvirt] [PATCH] qemu: indentation fix
by Ján Tomko 01 Jul '13

01 Jul '13

--- Pushed as trivial. src/qemu/qemu_command.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 4d70004..ba93233 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -7003,7 +7003,7 @@ qemuBuildCommandLine(virConnectPtr conn, virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("unsupported rtc tickpolicy '%s'"), virDomainTimerTickpolicyTypeToString(def->clock.timers[i]->tickpolicy)); - goto error; + goto error; } } else if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_RTC) && (def->clock.timers[i]->tickpolicy -- 1.8.1.5

1 0

[libvirt] Release of libvirt-1.1.0
by Daniel Veillard 01 Jul '13

01 Jul '13

As planned I released libvirt-1.1.0 a couple of hours ago after a couple more patches and a fix for CVE-2013-2218 were applied. It should be available on the server along with the rpms: ftp://libvirt.org/libvirt/ The biggest feature leading to the bump in medium release number is the adition of ACL for individual access control of each API, until now there was only two classes of access read-only and read write, this feature is a big enhancement we have been thinking about for years! This version includes a relatively smaller amount of patches though, around 200, with a balanced set of bug fixes and enhancements, plus the fix for CVE-2013-2218 which is afftecting 1.0.6 release. Features: - Extensible migration APIs (Jiri Denemark) - Fine grained ACL support for the API (Daniel P. Berrange) - various improvements in the Xen driver (Jim Fehlig and Marek Marczykowski-Górecki) - improve networking support on BSD (Roman Bogorodskiy) - agent based vCPU hotplug support (Peter Krempa) Security: - CVE-2013-2218: Fix crash listing network interfaces with filters (Daniel P. Berrange) Documentation: - Document security reporting & handling process (Daniel P. Berrange) - Fix reference to #elementsUSB (Philipp Hahn) - Fix sample TPM XML (Stefan Berger) - correct and update network vlan example (Laine Stump) - add spaces to formatstorage.html (Ján Tomko) Portability: - spec: require xen-devel for libxl driver (Eric Blake) - Conditionalize use of IF_MAXUNIT in virnetdevtap.c (Daniel P. Berrange) - Replace use of 'in_addr_t' with 'struct in_addr' (Daniel P. Berrange) - build: Fix VPATH build for access/* (Viktor Mihajlovski) - util: fix build error on non-Linux systems (Laine Stump) - conf: Swap order of AddImplicitControllers and DomainDefPostParse (Viktor Mihajlovski) - S390: Testcase for console default target type (virtio) (Viktor Mihajlovski) - Fix units in virNetDevBridgeSetSTPDelay on BSD (Roman Bogorodskiy) - build: Fix check-aclrules in VPATH build (Jiri Denemark) - build: Fix build with -Werror (Jim Fehlig) - use net/if.h instead of linux/if.h (Roman Bogorodskiy) - build: fix build without posix_fallocate (Eric Blake) - spec: Explicitly require libgcrypt-devel (Jiri Denemark) Bug Fixes: - pci: initialize virtual_functions array pointer to avoid segfault (Laine Stump) - node device driver: update driver name during dumpxml (Laine Stump) - Resolve valgrind errors for nodedev cap parsing (John Ferlan) - Resolve valgrind error in remoteConfigGetStringList() (John Ferlan) - Resolve valgrind error in virStorageBackendCreateQemuImgCmd() (John Ferlan) - Resolve valgrind error in virNetDevVlanParse() (John Ferlan) - Fix vPort management: FC vHBA creation (Dennis Chen) - bridge: don't crash on bandwidth unplug with no bandwidth (Ján Tomko) - Plug leak in virCgroupMoveTask (Ján Tomko) - Fix invalid read in virCgroupGetValueStr (Ján Tomko) - qemu: fix infinite loop in OOM error path (Laine Stump) - pci: fix dangling pointer in qemuDomainReAttachHostdevDevices (Laine Stump) - pci: eliminate leak in OOM condition (Laine Stump) - util: fix bug found by Coverity (Laine Stump) - Fix possible NULL dereference during migration (Jiri Denemark) - virsh: edit: don't leak XML string on reedit or redefine (Ján Tomko) - qemu: don't reset PCI devices being assigned with VFIO (Laine Stump) - pci: eliminate memory leak in virPCIDeviceReattach (Laine Stump) - qemu: check if block I/O limits fit into long long (Ján Tomko) - network: increase max number of routes (Laine Stump) - lxc: Resolve issue with GetScheduler APIs for non running domain (John Ferlan) - qemu: Resolve issue with GetScheduler APIs for non running domain (John Ferlan) - qemu: Avoid leaking uri in qemuMigrationPrepareDirect (Jiri Denemark) - udev: fix crash in libudev logging (Ján Tomko) - remote: Fix client crash when URI path is empty when using ssh (Peter Krempa) - remote: Forbid default "/session" connections when using ssh transport (Peter Krempa) - nodedev: fix vport detection for FC HBA (Ján Tomko) - qemu: Fix memory leak in Prepare phase (Jiri Denemark) - virSocketAddrIsWildcard: Use IN6_IS_ADDR_UNSPECIFIED correctly (Michal Privoznik) - Fix ordering of file open in virProcessGetNamespaces (Richard Weinberger) - qemuDomainGetVcpusFlags: Initialize ncpuinfo (Michal Privoznik) - virtlockd: fix socket path (Ján Tomko) - nwfilter: grab driver lock earlier during init (bz96649) (Stefan Berger) - Fix a invalid usage of virDomainNetDef in OpenVZ driver (Alvaro Polo) - use virBitmapFree instead of VIR_FREE for cpumask (Ján Tomko) - usb: don't spoil decimal addresses (Martin Kletzander) Improvements: - Allow RO connections to interface udev backend (Doug Goldstein) - virsh: Add parenthesis into virsh nodedev-detach help (xuzhang) - nodedev: add iommuGroup to node device object (Laine Stump) - pci: new iommu_group functions (Laine Stump) - network: allow <vlan> in type='hostdev' networks (Laine Stump) - test: include qemuhotplugtest data files in source rpm (Laine Stump) - pci: virPCIDeviceListAddCopy API (Laine Stump) - pci: update stubDriver name in virPCIDeviceBindToStub (Laine Stump) - pci: eliminate repetitive path constructions in virPCIDeviceBindToStub (Laine Stump) - pci: rename virPCIParseDeviceAddress and make it public (Laine Stump) - pci: rename virPCIDeviceGetVFIOGroupDev to virPCIDeviceGetIOMMUGroupDev (Laine Stump) - pci: eliminate unused driver arg from virPCIDeviceDetach (Laine Stump) - tests: Introduce qemuhotplugtest (Michal Privoznik) - qemu: Implement support for VIR_MIGRATE_PARAM_GRAPHICS_URI (Jiri Denemark) - Implement extensible migration APIs in qemu driver (Jiri Denemark) - qemu: Move internals of Confirm phase to qemu_migration.c (Jiri Denemark) - qemu: Move common parts of Prepare phase to qemu_migration.c (Jiri Denemark) - qemu: Move internals of Begin phase to qemu_migration.c (Jiri Denemark) - Use 1.1.0 everywhere in the documentation (Ján Tomko) - Add polkit policy for API checks to rpm spec (Daniel Veillard) - Configure native vlan modes on Open vSwitch ports (james robson) - Introduce VIR_MIGRATE_PARAM_GRAPHICS_URI parameter (Jiri Denemark) - virsh: Use extensible migration APIs (Jiri Denemark) - python: Add bindings for extensible migration APIs (Jiri Denemark) - Adapt virDomainMigratePeer2Peer for extensible migration APIs (Jiri Denemark) - Adapt virDomainMigrateVersion3 for extensible migration APIs (Jiri Denemark) - Implement extensible migration APIs in remote driver (Jiri Denemark) - New internal migration APIs with extensible parameters (Jiri Denemark) - Introduce migration parameters (Jiri Denemark) - Introduce virTypedParamsCopy internal API (Jiri Denemark) - Log input type parameters in API entry points (Jiri Denemark) - Introduce VIR_TYPED_PARAMS_DEBUG macro for dumping typed params (Jiri Denemark) - Introduce virTypedParamsReplaceString internal API (Jiri Denemark) - Introduce virTypedParamsCheck internal API (Jiri Denemark) - util: Emit proper error code in virTypedParamsValidate (Jiri Denemark) - Rename virTypedParameterArrayValidate as virTypedParamsValidate (Jiri Denemark) - pci: make virPCIDeviceDetach consistent in behavior (Laine Stump) - pci: new utility functions (Laine Stump) - pci: change stubDriver from const char* to char* (Laine Stump) - syntax: virPCIDeviceFree is also a NOP for NULL args (Laine Stump) - libxl: support qdisk backend (Jim Fehlig) - libxl: Fix disk format error message (Jim Fehlig) - Add validation that all APIs contain ACL checks (Daniel P. Berrange) - Set process ID in system identity (Daniel P. Berrange) - Add ACL checks into the secrets driver (Daniel P. Berrange) - Add ACL checks into the nwfilter driver (Daniel P. Berrange) - Add ACL checks into the node device driver (Daniel P. Berrange) - Add ACL checks into the interface driver (Daniel P. Berrange) - Add ACL checks into the network driver (Daniel P. Berrange) - Add ACL checks into the storage driver (Daniel P. Berrange) - Add ACL checks into the libxl driver (Daniel P. Berrange) - Add ACL checks into the Xen driver (Daniel P. Berrange) - Add ACL checks into the UML driver (Daniel P. Berrange) - Add ACL checks into the LXC driver (Daniel P. Berrange) - Add ACL checks into the QEMU driver (Daniel P. Berrange) - Auto-generate helpers for checking access control rules (Daniel P. Berrange) - Add ACL annotations to all RPC messages (Daniel P. Berrange) - Setup default access control manager in libvirtd (Daniel P. Berrange) - Set conn->driver before running driver connectOpen method (Daniel P. Berrange) - Define basic internal API for access control (Daniel P. Berrange) - netdev: accept NULL in virNetDevSetupControl (Ján Tomko) - xen: Implement virConnectGetSysinfo (Jim Fehlig) - libxl: Implement virConnectGetSysinfo (Jim Fehlig) - libxl: Allow libxl to set NIC devid (Jim Fehlig) - storage: add support for creating qcow2 images with extensions (Ján Tomko) - conf: add features to volume target XML (Ján Tomko) - util: add support for qcow2v3 image detection (Ján Tomko) - qemu: add hv_vapic and hv_spinlocks support (Ján Tomko) - conf: add vapic and spinlocks to hyperv features (Ján Tomko) - BSD: implement bridge add/remove port and set STP (Roman Bogorodskiy) - BSD: implement virNetDevBridgeCreate() and virNetDevBridgeDelete() (Roman Bogorodskiy) - conf: Requires either uuid or usage of secret (Osier Yang) - qemu: Make probing for commands declarative (Jiri Denemark) - qemu: Make probing for events declarative (Jiri Denemark) - libxl: support paused domain restore in virDomainRestoreFlags (Marek Marczykowski-Górecki) - qemuDomainChangeGraphics: Check listen address change by listen type (Michal Privoznik) - libxl: initialize device structures (Marek Marczykowski-Górecki) - libxl: populate xenstore memory entries at startup, handle dom0_mem (Marek Marczykowski-Górecki) - conf: split out snapshot disk XML formatting (Ján Tomko) - storage: rework qemu-img command line generation (Ján Tomko) - util: switch virBufferTrim to void (Ján Tomko) - migration: Don't propagate VIR_MIGRATE_ABORT_ON_ERROR (Peter Krempa) - migration: Make erroring out on I/O error controllable by flag (Peter Krempa) - qemu_migration: Move waiting for SPICE migration (Michal Privoznik) - spec: Enable KVM support on ARM (Cole Robinson) - virsh: Support SCSI_GENERIC cap flag for nodedev-list (Osier Yang) - nodedev: Support SCSI_GENERIC cap flag for listAllNodeDevices (Osier Yang) - nodedev_hal: Enumerate scsi generic device (Osier Yang) - nodedev_udev: Enumerate scsi generic device (Osier Yang) - qemu: set QEMU_CAPS_DEVICE_VIDEO_PRIMARY cap flag in QMP detection (Guannan Ren) - nodedev_udev: changes missed by commit 1aa0ba3cef (Osier Yang) - nodedev_udev: Refactor udevGetDeviceType (Osier Yang) - nodedev: Expose sysfs path of device (Osier Yang) - Move virGetUserEnt() to where its needed (Doug Goldstein) - BSD: implement virNetDevTapCreate() and virNetDevTapDelete() (Roman Bogorodskiy) - Make virNetDevSetupControl() public. (Roman Bogorodskiy) - LXC: s/chroot/chdir in lxcContainerPivotRoot() (Richard Weinberger) - Implement dispose method for libxlDomainObjPrivate (Frediano Ziglio) - libxl: allow only 'ethernet' and 'bridge' interfaces, allow script there (Marek Marczykowski-Górecki) - qemu: allow restore with non-migratable XML input (Ján Tomko) - libxl: set bootloader for PV domains if not specified (Jim Fehlig) - libxl: Report connect type as Xen (Jim Fehlig) - schema: simplify RNG pattern, remove superfluous <optional> (Claudio Bley) - libvirt_private.syms: add virProcessGetStartTime (Ján Tomko) - qemu: Forbid migration of machines with I/O errors (Peter Krempa) - qemu: Cancel migration if guest encoutners I/O error while migrating (Peter Krempa) - qemu_migrate: Dispose listen address if set from config (Michal Privoznik) - selinux: assume 's0' if the range is empty (Ján Tomko) - storage: fix description of versionOffset (Martin Kletzander) - spec: Drop Requires: vbox (Cole Robinson) - Prefer VIR_STRDUP over virAsprintf(&dst, "%s", str) (Michal Privoznik) - qemu: Implement new QMP command for cpu hotplug (Peter Krempa) - qemu: Implement support for VIR_DOMAIN_VCPU_AGENT in qemuDomainSetVcpusFlags (Peter Krempa) - qemu: Implement request of vCPU state using the guest agent (Peter Krempa) - API: Introduce VIR_DOMAIN_VCPU_AGENT, for agent based CPU hot(un)plug (Peter Krempa) - qemu_agent: Introduce helpers for agent based CPU hot(un)plug (Peter Krempa) - qemu: Use bool instead of int in qemuMonitorSetCPU APIs (Peter Krempa) - virsh-domain-monitor: Remove ATTRIBUTE_UNUSED from a argument (Peter Krempa) - Add support for VirtualBox 4.2 APIs (ryan woodsmall) - qemuDomainMigrateGraphicsRelocate: Use then new virSocketAddrIsWildcard (Michal Privoznik) - virsocket: Introduce virSocketAddrIsWildcard (Michal Privoznik) - iscsi: pass hostnames to iscsiadm instead of resolving them (Ján Tomko) - qemu: Report the offset from host UTC for RTC_CHANGE event (Osier Yang) - qemu: simplify CPU command line parsing (Ján Tomko) - qemu: change two-state int parameters to bool (Ján Tomko) - nwfilter: change two-state int parameters to bool (Ján Tomko) - Remove redundant two-state integers (Ján Tomko) - Replace two-state local integers with bool (Ján Tomko) - storage: Avoid unnecessary ternary operators and refactor the code (Peter Krempa) - openvz: Fix code coverage issue in OpenVZ driver (Alvaro Polo) - qemu: Reformat listen address prior to checking (Michal Privoznik) - Ensure non-root can read /proc/meminfo file in LXC containers (Daniel P. Berrange) - storage: Provide better error message if metadata pre-alloc is unsupported (Peter Krempa) - storage: Clean up function header and reflow error message (Peter Krempa) - storagevolxml2argvtest: Report better error messages on test failure (Peter Krempa) - maint: don't use config.h in .h files (Eric Blake) - qemu: Abstract code for the cpu controller setting into a helper (Osier Yang) - storage: Forbid to shrink the vol's capacity if no --shrink is specified (Osier Yang) - storage: Support preallocate the new capacity for vol-resize (Osier Yang) - snapshot: remove mutually exclusive memory and disk-only duplicate check (Guannan Ren) - virsh: Allow attach-disk to specify disk wwn (Osier Yang) - tests: fix typo in securityselinuxtest (Ján Tomko) - virsh: Obey pool-or-uuid spec when creating volumes (Jiri Denemark) - libvirt-qemu: Dispatch errors from virDomainQemuAgentCommand() (Peter Krempa) - qemu: Properly report guest agent errors on command passthrough (Peter Krempa) - virsh-domain: Report errors and don't deref NULL in qemu-agent-command (Peter Krempa) - RPC: Support up to 16384 cpus on the host and 4096 in the guest (Peter Krempa) - virsh iface-bridge: Ignore delay if stp is turned off (Jiri Denemark) - Fix warning about using an uninitialized next_unit value (Jiri Denemark) - virsh-domain: Add --live, --config, --current logic to cmdAttachInterface (Peter Krempa) - virsh-domain: Add --live, --config, --current logic to cmdAttachDisk (Peter Krempa) - virsh-domain: Add --live, --config, --current logic to cmdAttachDevice (Peter Krempa) Cleanups: - Get rid of useless VIR_STORAGE_FILE_FEATURE_NONE (Ján Tomko) - configure: Remove unused brctl check (Cole Robinson) - storage_backend: Drop unused code (Cole Robinson) - Remove legacy code for single-instance devpts filesystem (Daniel P. Berrange) Thanks everybody for your contributions to this release, with ideas, reports, patches, documentation or localizations ! Daniel -- Daniel Veillard | Open Source and Standards, Red Hat veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

2 1

[libvirt] [PATCH v2 0/5]Atomic API to delete snapshot object
by Guannan Ren 01 Jul '13

01 Jul '13

v1: https://www.redhat.com/archives/libvir-list/2013-June/msg00573.html v1->v2: Remove VIR_DOMAIN_SNAPSHOT_DELETE_CURRENT flag (name == NULL) means deleting current snapshot object Rebase work Add a new snapshot API to delete snapshot object atomically int virDomainSnapshotDeleteByName(virDomainPtr domain, const char *name, unsigned int flags); The existing virDomainSnapshotDelete API accepts the snapshot object being deleted as an argument that would be not API atomic. Guannan Ren(5) [PATCH v2 1/5] snapshot: define new API virDomainSnapshotDeleteByName [PATCH v2 2/5] auto generate RPC calls for remoteDomainSnapshotDeleteByName [PATCH v2 3/5] qemu: implement SnapshotDeleteByName [PATCH v2 4/5] python: make auto-generated function name nicer [PATCH v2 5/5] virsh: use virDomainSnapshotDeleteByName in virsh include/libvirt/libvirt.h.in | 4 ++++ python/generator.py | 3 +++ src/driver.h | 6 ++++++ src/libvirt.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ src/libvirt_public.syms | 5 +++++ src/qemu/qemu_driver.c | 103 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++---------------------- src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 14 +++++++++++++- src/remote_protocol-structs | 6 ++++++ tools/virsh-snapshot.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++++++++++---------- 10 files changed, 245 insertions(+), 33 deletions(-)

2 8

[libvirt] [PATCH v5] qemu: Implement CPUs check against machine type's cpu-max
by Michal Novotny 01 Jul '13

01 Jul '13

Implement check whether (maximum) vCPUs doesn't exceed machine type's cpu-max settings. Differences between v4 and v5 (this one): - Changed type to unsigned int - Renamed variable to maxCpus to match previous naming - When machines types are parsed from command line set maxCpus = 0 to don't show Differences between v3 and v4: - Rebased to latest libvirt version - Capability XML output extended by maxCpus field - Extended caps-qemu-kvm.xml test by maxCpus for one of test emulators On older versions of QEMU the check is disabled. Signed-off-by: Michal Novotny <minovotn(a)redhat.com> --- docs/schemas/capability.rng | 5 ++++ src/conf/capabilities.c | 4 +++ src/conf/capabilities.h | 1 + src/qemu/qemu_capabilities.c | 40 +++++++++++++++++++++++++++- src/qemu/qemu_capabilities.h | 3 ++- src/qemu/qemu_monitor.h | 1 + src/qemu/qemu_monitor_json.c | 6 +++++ src/qemu/qemu_process.c | 21 +++++++++++++++ tests/capabilityschemadata/caps-qemu-kvm.xml | 16 +++++------ 9 files changed, 87 insertions(+), 10 deletions(-) diff --git a/docs/schemas/capability.rng b/docs/schemas/capability.rng index 106ca73..65c7c72 100644 --- a/docs/schemas/capability.rng +++ b/docs/schemas/capability.rng @@ -290,6 +290,11 @@ <text/> </attribute> </optional> + <optional> + <attribute name='maxCpus'> + <ref name='unsignedInt'/> + </attribute> + </optional> <text/> </element> </define> diff --git a/src/conf/capabilities.c b/src/conf/capabilities.c index da92c78..5aeb2ab 100644 --- a/src/conf/capabilities.c +++ b/src/conf/capabilities.c @@ -853,6 +853,8 @@ virCapabilitiesFormatXML(virCapsPtr caps) virBufferAddLit(&xml, " <machine"); if (machine->canonical) virBufferAsprintf(&xml, " canonical='%s'", machine->canonical); + if (machine->maxCpus > 0) + virBufferAsprintf(&xml, " maxCpus='%d'", machine->maxCpus); virBufferAsprintf(&xml, ">%s</machine>\n", machine->name); } @@ -871,6 +873,8 @@ virCapabilitiesFormatXML(virCapsPtr caps) virBufferAddLit(&xml, " <machine"); if (machine->canonical) virBufferAsprintf(&xml, " canonical='%s'", machine->canonical); + if (machine->maxCpus > 0) + virBufferAsprintf(&xml, " maxCpus='%d'", machine->maxCpus); virBufferAsprintf(&xml, ">%s</machine>\n", machine->name); } virBufferAddLit(&xml, " </domain>\n"); diff --git a/src/conf/capabilities.h b/src/conf/capabilities.h index abcf6de..6c7efde 100644 --- a/src/conf/capabilities.h +++ b/src/conf/capabilities.h @@ -46,6 +46,7 @@ typedef virCapsGuestMachine *virCapsGuestMachinePtr; struct _virCapsGuestMachine { char *name; char *canonical; + unsigned int maxCpus; }; typedef struct _virCapsGuestDomainInfo virCapsGuestDomainInfo; diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index c4e076a..969b001 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -256,6 +256,7 @@ struct _virQEMUCaps { size_t nmachineTypes; char **machineTypes; char **machineAliases; + unsigned int *machineMaxCpus; }; struct _virQEMUCapsCache { @@ -335,6 +336,7 @@ virQEMUCapsSetDefaultMachine(virQEMUCapsPtr qemuCaps, { char *name = qemuCaps->machineTypes[defIdx]; char *alias = qemuCaps->machineAliases[defIdx]; + unsigned int maxCpus = qemuCaps->machineMaxCpus[defIdx]; memmove(qemuCaps->machineTypes + 1, qemuCaps->machineTypes, @@ -342,8 +344,12 @@ virQEMUCapsSetDefaultMachine(virQEMUCapsPtr qemuCaps, memmove(qemuCaps->machineAliases + 1, qemuCaps->machineAliases, sizeof(qemuCaps->machineAliases[0]) * defIdx); + memmove(qemuCaps->machineMaxCpus + 1, + qemuCaps->machineMaxCpus, + sizeof(qemuCaps->machineMaxCpus[0]) * defIdx); qemuCaps->machineTypes[0] = name; qemuCaps->machineAliases[0] = alias; + qemuCaps->machineMaxCpus[0] = maxCpus; } /* Format is: @@ -390,7 +396,8 @@ virQEMUCapsParseMachineTypesStr(const char *output, } if (VIR_REALLOC_N(qemuCaps->machineTypes, qemuCaps->nmachineTypes + 1) < 0 || - VIR_REALLOC_N(qemuCaps->machineAliases, qemuCaps->nmachineTypes + 1) < 0) { + VIR_REALLOC_N(qemuCaps->machineAliases, qemuCaps->nmachineTypes + 1) < 0 || + VIR_REALLOC_N(qemuCaps->machineMaxCpus, qemuCaps->nmachineTypes + 1) < 0) { VIR_FREE(name); VIR_FREE(canonical); virReportOOMError(); @@ -404,6 +411,8 @@ virQEMUCapsParseMachineTypesStr(const char *output, qemuCaps->machineTypes[qemuCaps->nmachineTypes-1] = name; qemuCaps->machineAliases[qemuCaps->nmachineTypes-1] = NULL; } + /* When parsing from command line we don't have information about maxCpus */ + qemuCaps->machineMaxCpus[qemuCaps->nmachineTypes-1] = 0; } while ((p = next)); @@ -1764,11 +1773,14 @@ virQEMUCapsPtr virQEMUCapsNewCopy(virQEMUCapsPtr qemuCaps) goto no_memory; if (VIR_ALLOC_N(ret->machineAliases, qemuCaps->nmachineTypes) < 0) goto no_memory; + if (VIR_ALLOC_N(ret->machineMaxCpus, qemuCaps->nmachineTypes) < 0) + goto no_memory; ret->nmachineTypes = qemuCaps->nmachineTypes; for (i = 0; i < qemuCaps->nmachineTypes; i++) { if (VIR_STRDUP(ret->machineTypes[i], qemuCaps->machineTypes[i]) < 0 || VIR_STRDUP(ret->machineAliases[i], qemuCaps->machineAliases[i]) < 0) goto error; + ret->machineMaxCpus[i] = qemuCaps->machineMaxCpus[i]; } return ret; @@ -1792,6 +1804,7 @@ void virQEMUCapsDispose(void *obj) } VIR_FREE(qemuCaps->machineTypes); VIR_FREE(qemuCaps->machineAliases); + VIR_FREE(qemuCaps->machineMaxCpus); for (i = 0; i < qemuCaps->ncpuDefinitions; i++) { VIR_FREE(qemuCaps->cpuDefinitions[i]); @@ -1932,6 +1945,7 @@ int virQEMUCapsGetMachineTypesCaps(virQEMUCapsPtr qemuCaps, if (VIR_STRDUP(mach->name, qemuCaps->machineTypes[i]) < 0) goto error; } + mach->maxCpus = qemuCaps->machineMaxCpus[i]; (*machines)[i] = mach; } @@ -1966,6 +1980,25 @@ const char *virQEMUCapsGetCanonicalMachine(virQEMUCapsPtr qemuCaps, } +int virQEMUCapsGetMachineMaxCpus(virQEMUCapsPtr qemuCaps, + const char *name) +{ + size_t i; + + if (!name) + return 0; + + for (i = 0; i < qemuCaps->nmachineTypes; i++) { + if (!qemuCaps->machineMaxCpus[i]) + continue; + if (STREQ(qemuCaps->machineTypes[i], name)) + return qemuCaps->machineMaxCpus[i]; + } + + return 0; +} + + static int virQEMUCapsProbeQMPCommands(virQEMUCapsPtr qemuCaps, qemuMonitorPtr mon) @@ -2083,6 +2116,10 @@ virQEMUCapsProbeQMPMachineTypes(virQEMUCapsPtr qemuCaps, virReportOOMError(); goto cleanup; } + if (VIR_ALLOC_N(qemuCaps->machineMaxCpus, nmachines) < 0) { + virReportOOMError(); + goto cleanup; + } for (i = 0; i < nmachines; i++) { if (VIR_STRDUP(qemuCaps->machineAliases[i], machines[i]->alias) < 0 || @@ -2090,6 +2127,7 @@ virQEMUCapsProbeQMPMachineTypes(virQEMUCapsPtr qemuCaps, goto cleanup; if (machines[i]->isDefault) defIdx = i; + qemuCaps->machineMaxCpus[i] = machines[i]->maxCpus; } qemuCaps->nmachineTypes = nmachines; diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 64a4b1d..7088747 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -234,7 +234,8 @@ size_t virQEMUCapsGetMachineTypes(virQEMUCapsPtr qemuCaps, char ***names); const char *virQEMUCapsGetCanonicalMachine(virQEMUCapsPtr qemuCaps, const char *name); - +int virQEMUCapsGetMachineMaxCpus(virQEMUCapsPtr qemuCaps, + const char *name); int virQEMUCapsGetMachineTypesCaps(virQEMUCapsPtr qemuCaps, size_t *nmachines, virCapsGuestMachinePtr **machines); diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h index 3d9afa3..86ef635 100644 --- a/src/qemu/qemu_monitor.h +++ b/src/qemu/qemu_monitor.h @@ -654,6 +654,7 @@ struct _qemuMonitorMachineInfo { char *name; bool isDefault; char *alias; + unsigned int maxCpus; }; int qemuMonitorGetMachines(qemuMonitorPtr mon, diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index 88a0dc9..c0d7960 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -4042,6 +4042,12 @@ int qemuMonitorJSONGetMachines(qemuMonitorPtr mon, if (VIR_STRDUP(info->alias, tmp) < 0) goto cleanup; } + if (virJSONValueObjectHasKey(child, "cpu-max") && + virJSONValueObjectGetNumberUint(child, "cpu-max", &info->maxCpus) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("query-machines reply has malformed 'cpu-max' data")); + goto cleanup; + } } ret = n; diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 5a0f18b..ac5ffcf 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -3330,6 +3330,24 @@ error: } +static bool +qemuValidateCpuMax(virDomainDefPtr def, virQEMUCapsPtr qemuCaps) +{ + unsigned int maxCpus; + + maxCpus = virQEMUCapsGetMachineMaxCpus(qemuCaps, def->os.machine); + if (!maxCpus) + return true; + + if (def->maxvcpus > maxCpus) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + "%s", _("Maximum CPUs greater than specified machine type limit")); + return false; + } + + return true; +} + int qemuProcessStart(virConnectPtr conn, virQEMUDriverPtr driver, virDomainObjPtr vm, @@ -3519,6 +3537,9 @@ int qemuProcessStart(virConnectPtr conn, vm->def->emulator))) goto cleanup; + if (!qemuValidateCpuMax(vm->def, priv->qemuCaps)) + goto cleanup; + if (qemuAssignDeviceAliases(vm->def, priv->qemuCaps) < 0) goto cleanup; diff --git a/tests/capabilityschemadata/caps-qemu-kvm.xml b/tests/capabilityschemadata/caps-qemu-kvm.xml index 36c4b49..1fbc22b 100644 --- a/tests/capabilityschemadata/caps-qemu-kvm.xml +++ b/tests/capabilityschemadata/caps-qemu-kvm.xml @@ -33,18 +33,18 @@ <arch name='i686'> <wordsize>32</wordsize> <emulator>/usr/bin/qemu</emulator> - <machine>pc-0.11</machine> - <machine canonical='pc-0.11'>pc</machine> - <machine>pc-0.10</machine> - <machine>isapc</machine> + <machine maxCpus='255'>pc-0.11</machine> + <machine canonical='pc-0.11' maxCpus='255'>pc</machine> + <machine maxCpus='255'>pc-0.10</machine> + <machine maxCpus='1'>isapc</machine> <domain type='qemu'> </domain> <domain type='kvm'> <emulator>/usr/bin/qemu-kvm</emulator> - <machine>pc-0.11</machine> - <machine canonical='pc-0.11'>pc</machine> - <machine>pc-0.10</machine> - <machine>isapc</machine> + <machine maxCpus='255'>pc-0.11</machine> + <machine canonical='pc-0.11' maxCpus='255'>pc</machine> + <machine maxCpus='255'>pc-0.10</machine> + <machine maxCpus='1'>isapc</machine> </domain> </arch> <features> -- 1.7.11.7

2 3

[libvirt] [RFC PATCH 1/2] LXC: Drop capabilities only if we're not within a user namespace
by Richard Weinberger 01 Jul '13

01 Jul '13

Dropping capabilities within a user namespace makes no sense because any uid 0 process will regain all caps upon execve(). Signed-off-by: Richard Weinberger <richard(a)nod.at> --- src/lxc/lxc_container.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 958e20d..4f00420 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -1896,6 +1896,15 @@ static int lxcContainerDropCapabilities(bool keepReboot ATTRIBUTE_UNUSED) return 0; } +static int userns_supported(void) +{ + return lxcContainerAvailable(LXC_CONTAINER_FEATURE_USER) == 0; +} + +static int userns_required(virDomainDefPtr def) +{ + return def->idmap.uidmap && def->idmap.gidmap; +} /** * lxcContainerChild: @@ -1992,7 +2001,7 @@ static int lxcContainerChild(void *data) } /* drop a set of root capabilities */ - if (lxcContainerDropCapabilities(!!hasReboot) < 0) + if (!userns_required(vmDef) && lxcContainerDropCapabilities(!!hasReboot) < 0) goto cleanup; if (lxcContainerSendContinue(argv->handshakefd) < 0) { @@ -2025,16 +2034,6 @@ cleanup: return ret; } -static int userns_supported(void) -{ - return lxcContainerAvailable(LXC_CONTAINER_FEATURE_USER) == 0; -} - -static int userns_required(virDomainDefPtr def) -{ - return def->idmap.uidmap && def->idmap.gidmap; -} - virArch lxcContainerGetAlt32bitArch(virArch arch) { /* Any Linux 64bit arch which has a 32bit -- 1.8.1.4

3 27

[libvirt] [PATCH] Document security reporting & handling process
by Daniel P. Berrange 01 Jul '13

01 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> Historically security issues in libvirt have been primarily triaged & fixed by the Red Hat libvirt members & Red Hat security team, who then usually notify other vendors via appropriate channels. There have been a number of times when vendors have not been properly notified ahead of announcement. It has also disadvantaged community members who have to backport fixes to releases for which there are no current libvirt stable branches. To address this, we want to make the libvirt security process entirely community focused / driven. To this end I have setup a new email address "libvirt-security(a)redhat.com" for end users to report bugs which have (possible) security implications. This email addr is backed by an invitation only, private archive, mailing list. The intent is for the list membership to comprise a subset of the libvirt core team, along with any vendor security team engineers who wish to participate in a responsible disclosure process for libvirt. Members of the list will be responsible for analysing the problem to determine if a security issue exists and then issue fixes for all current official stable branches & git master. I am proposing the following libvirt core team people as members of the security team / list (all cc'd): Daniel Berrange (Red Hat) Eric Blake (Red Hat) Jiri Denemar (Red Hat) Daniel Veillard (Red Hat) Jim Fehlig (SUSE) Doug Goldstein (Gentoo) Guido Günther (Debian) We don't have anyone from Ubuntu on the libvirt core team. Serge Hallyn is the most frequent submitter of patches from Ubuntu in recent history, so I'd like to invite him to join. Alternatively, Serge, feel free to suggest someone else to represent Ubuntu's interests. If any other vendors/distros have security people who are responsible for dealing with libvirt security issues, and want to join to get early disclosure of issues, they can suggest people. Existing security team members will vet / approve such requests to ensure they are genuine. Anyone on the team / list will be **required** to honour any embargo period agreed between members for non-public issues that are reported. The aim will be to have a maximum 2 week embargo period in the common case, extendable to 1 month if there is sufficient justification made. If anyone feels they are unable to follow such an embargo process for whatever reason, please decline membership of the security list/team. The patch which follows puts up some docs on the website about all of this.... Document how to report security bugs and the process that will be used for addressing them. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- docs/bugs.html.in | 12 +++++ docs/contact.html.in | 12 +++++ docs/securityprocess.html.in | 113 +++++++++++++++++++++++++++++++++++++++++++ docs/sitemap.html.in | 4 ++ 4 files changed, 141 insertions(+) create mode 100644 docs/securityprocess.html.in diff --git a/docs/bugs.html.in b/docs/bugs.html.in index 3d79b32..71e43e4 100644 --- a/docs/bugs.html.in +++ b/docs/bugs.html.in @@ -7,6 +7,18 @@ <ul id="toc"></ul> + <h2><a name="security">Security Issues</a></h2> + + <p> + If you think that an issue with libvirt may have security + implications, <strong>please do not</strong> publically + report it in the bug tracker, mailing lists, or irc. Libvirt + has <a href="securityprocess.html">a dedicated process for handling (potential) security issues</a> + that should be used instead. So if your issue has security + implications, ignore the rest of this page and follow the + <a href="securityprocess.html">security process</a> instead. + </p> + <h2><a name="bugzilla">Bug Tracking</a></h2> <p> diff --git a/docs/contact.html.in b/docs/contact.html.in index e34de67..51cc775 100644 --- a/docs/contact.html.in +++ b/docs/contact.html.in @@ -6,6 +6,18 @@ <ul id="toc"></ul> + <h2><a name="security">Security Issues</a></h2> + + <p> + If you think that an issue with libvirt may have security + implications, <strong>please do not</strong> publically + report it in the bug tracker, mailing lists, or irc. Libvirt + has <a href="securityprocess.html">a dedicated process for handling (potential) security issues</a> + that should be used instead. So if your issue has security + implications, ignore the rest of this page and follow the + <a href="securityprocess.html">security process</a> instead. + </p> + <h2><a name="email">Mailing lists</a></h2> <p> diff --git a/docs/securityprocess.html.in b/docs/securityprocess.html.in new file mode 100644 index 0000000..c29ae80 --- /dev/null +++ b/docs/securityprocess.html.in @@ -0,0 +1,113 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> +<html xmlns="http://www.w3.org/1999/xhtml"> + <body> + + <h1>Security Process</h1> + + <ul id="toc"></ul> + + <p> + The libvirt project believes in responsible disclosure of + security problems, to allow vendors time to prepare and + distribute patches for problems ahead of their publication. + This page describes how the process works and how to report + potential security issues. + </p> + + <h2><a name="reporting">Reporting security issues</a></h2> + + <p> + In the event that a bug in libvirt is found which is + believed to have (potential) security implications there + is a dedicated contact to which a bug report / notification + should be directed. Send an email with as many details of + the problem as possible (ideally with steps to reproduce) + to the following email address: + </p> + + <pre> +<a href="mailto:libvirt-security@redhat.com">libvirt-security(a)redhat.com</a></pre> + + <p> + NB. while this email address is backed by a mailing list, it + is invitation only and moderated for non-members. As such you + will receive an auto-reply indicating the report is held for + moderation. Postings by non-members will be approved by a + moderator and the reporter copied on any replies. + </p> + + <h2><a name="seclist">Security team</a></h2> + + <p> + The libvirt security team is made up of a subset of the libvirt + core development team which covers the various distro maintainers + of libvirt, along with nominated security engineers representing + the various vendors who distribute libvirt. The team is responsible + for analysing incoming reports from users to identify whether a + security problem exists and its severity. It then works to produce + a fix for all official stable branches of libvirt and co-ordinate + embargo dates between vendors to allow simultaneous release of the + fix by all affected parties. + </p> + + <p> + If you are a security representative of a vendor distributing + libvirt and would like to join the security team, send an email + to the afore-mentioned security address. Typically an existing + member of the security team will have to vouch for your credentials + before membership is approved. All members of the security team + are <strong>required to respect the embargo policy</strong> + described below. + </p> + + <h2><a name="embargo">Publication embargo policy</a></h2> + + <p> + The libvirt security team operates a policy of + <a href="http://en.wikipedia.org/wiki/Responsible_disclosure">responsible disclosure</a>. + As such any security issue reported, that is not already publically disclosed + elswhere, will have an embargo date assigned. Members of the security team agree + not to publically disclose any details of the security issue until the embargo + date expires. + </p> + + <p> + The general aim of the team is to have embargo dates which + are two weeks or less in duration. If a problem is identified + with a proposed patch for a security issue, requiring further + investigation and bug fixing, the embargo clock may be restarted. + In exceptional circumstances longer initial embargos may be + negotiated by mutual agreement between members of the security + team and other relevant parties to the problem. Any such extended + embargoes will aim to be at most one month in duration. + </p> + + + <h2><a name="cve">CVE allocation</a></h2> + + <p> + The libvirt security team will associate each security issue with + a CVE number. The CVE numbers will usually be allocated by one of + the vendor security engineers on the security team. + </p> + + <h2><a name="branches">Branch fixing policy</a></h2> + + <p> + The libvirt community maintains one or more stable release branches + at any given point in time. The security team will aim to publish + fixes for GIT master (which will become the next major release) and + each currently maintained stable release branch. The distro maintainers + will be responsible for backporting the officially published fixes to + other release branches where applicable. + </p> + + <h2><a name="notification">Notification of issues</a></h2> + + <p> + When an embargo expires, security issues will be announced on both + the libvirt development and announcement <a href="http://libvirt.org/contact.html#email">mailing lists</a>. + </p> + </body> +</html> diff --git a/docs/sitemap.html.in b/docs/sitemap.html.in index cb7cc5b..fd10caf 100644 --- a/docs/sitemap.html.in +++ b/docs/sitemap.html.in @@ -349,6 +349,10 @@ <span>How and where to report bugs and request features</span> <ul> <li> + <a href="securityprocess.html">Security Process</a> + <span>Security bug reporting and resolution process</span> + </li> + <li> <a href="todo.html">Todo list</a> <span>Main feature request list</span> </li> -- 1.8.1.4

6 8

[libvirt] [PATCH] node device driver: update driver name during dumpxml
by Laine Stump 01 Jul '13

01 Jul '13

This fixes: https://bugzilla.redhat.com/show_bug.cgi?id=979290 https://bugzilla.redhat.com/show_bug.cgi?id=979330 The node device driver was written with the assumption that udev would use a "change" event to notify libvirt of any change to device status (including the name of the driver it was bound to). It turns out this is not the case (see Comment 4 of BZ 979290). That means that a dumpxml for a device would always show whatever driver happened to be bound at the time libvirt was started (when the node device cache was built). There was already code in the driver (for the benefit of the HAL backend) that updated the driver name from sysfs each time a device's info was retrieved from the cache. This patch just enables that manual update for the udev backend as well. --- src/node_device/node_device_driver.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/src/node_device/node_device_driver.c b/src/node_device/node_device_driver.c index 67e90a1..8e6911a 100644 --- a/src/node_device/node_device_driver.c +++ b/src/node_device/node_device_driver.c @@ -60,10 +60,15 @@ static int update_caps(virNodeDeviceObjPtr dev) } -#if defined (__linux__) && defined (WITH_HAL) -/* Under libudev changes to the driver name should be picked up as - * "change" events, so we don't call update driver name unless we're - * using the HAL backend. */ +#if defined (__linux__) && ( defined (WITH_HAL) || defined(WITH_UDEV)) +/* NB: It was previously believed that changes in driver name were + * relayed to libvirt as "change" events by udev, and the udev event + * notification is setup to recognize such events and effectively + * recreate the device entry in the cache. However, neither the kernel + * nor udev sends such an event, so it is necessary to manually update + * the driver name for a device each time its entry is used, both for + * udev *and* HAL backends. + */ static int update_driver_name(virNodeDeviceObjPtr dev) { char *driver_link = NULL; -- 1.7.11.7

2 2

[libvirt] [PATCH] pci: initialize virtual_functions array pointer to avoid segfault
by Laine Stump 01 Jul '13

01 Jul '13

This fixes https://bugzilla.redhat.com/show_bug.cgi?id=971325 The problem was that if virPCIGetVirtualFunctions was given the name of a non-existent interface, it would return to its caller without initializing the pointer to the array of virtual functions to NULL, and the caller (virNetDevGetVirtualFunctions) would try to VIR_FREE() the invalid pointer. The final error message before the crash would be: virPCIGetVirtualFunctions:2088 : Failed to open dir '/sys/class/net/eth2/device': No such file or directory In this patch I move the initialization in virPCIGetVirtualFunctions() to the begining of the function, and also do an explicit initialization in virNetDevGetVirtualFunctions, just in case someone in the future adds code into that function prior to the call to virPCIGetVirtualFunctions. --- src/util/virnetdev.c | 3 +++ src/util/virpci.c | 5 +++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/src/util/virnetdev.c b/src/util/virnetdev.c index ebe20d0..5e8dffb 100644 --- a/src/util/virnetdev.c +++ b/src/util/virnetdev.c @@ -1100,6 +1100,9 @@ virNetDevGetVirtualFunctions(const char *pfname, char *pci_sysfs_device_link = NULL; char *pciConfigAddr = NULL; + *virt_fns = NULL; + *n_vfname = 0; + if (virNetDevSysfsFile(&pf_sysfs_device_link, pfname, "device") < 0) return ret; diff --git a/src/util/virpci.c b/src/util/virpci.c index 2acab1a..15de3f9 100644 --- a/src/util/virpci.c +++ b/src/util/virpci.c @@ -2449,6 +2449,9 @@ virPCIGetVirtualFunctions(const char *sysfs_path, VIR_DEBUG("Attempting to get SR IOV virtual functions for device" "with sysfs path '%s'", sysfs_path); + *virtual_functions = NULL; + *num_virtual_functions = 0; + dir = opendir(sysfs_path); if (dir == NULL) { memset(errbuf, '\0', sizeof(errbuf)); @@ -2458,8 +2461,6 @@ virPCIGetVirtualFunctions(const char *sysfs_path, return ret; } - *virtual_functions = NULL; - *num_virtual_functions = 0; while ((entry = readdir(dir))) { if (STRPREFIX(entry->d_name, "virtfn")) { virPCIDeviceAddress *config_addr = NULL; -- 1.7.11.7

2 2

[libvirt] [PATCH] spec: require xen-devel for libxl driver
by Eric Blake 29 Jun '13

29 Jun '13

When using 'rpmbuild --define "_without_xen"', but on a new enough Fedora where %{with_libxl} still gets set to 1 by default, the build dependencies were incomplete, which could result in 'make rpm' failing because ./configure failed to build the libxl driver. * libvirt.spec.in (BuildRequires): Fix xen-devel condition. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule. I found this on a machine with 'xen-devel' uninstalled, while running ./autobuild.sh; it took me a while to find the root cause, since autobuild.sh uses 'rpmbuild --nodeps' and therefore failed to tell me which packages I did not have installed. libvirt.spec.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index f40b614..aee61fa 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -412,7 +412,7 @@ BuildRequires: python-devel %if %{with_systemd} BuildRequires: systemd-units %endif -%if %{with_xen} +%if %{with_xen} || %{with_libxl} BuildRequires: xen-devel %endif BuildRequires: libxml2-devel -- 1.8.1.4

1 0

[libvirt] [PATCH 0/4] Resolve some recent Valgrind errors
by John Ferlan 29 Jun '13

29 Jun '13

Ran Valgrind today and found, investigated, and resolved the errors seen. John Ferlan (4): Resolve valgrind error in virNetDevVlanParse() Resolve valgrind error in virStorageBackendCreateQemuImgCmd() Resolve valgrind error in remoteConfigGetStringList() Resolve valgrind errors for nodedev cap parsing daemon/libvirtd-config.c | 6 ++++++ src/conf/netdev_vlan_conf.c | 24 +++++++++++++----------- src/conf/node_device_conf.c | 3 +++ src/storage/storage_backend.c | 4 +++- 4 files changed, 25 insertions(+), 12 deletions(-) -- 1.8.1.4

2 9

[libvirt] [PATCH] doc: Fix reference to #elementsUSB
by Philipp Hahn 28 Jun '13

28 Jun '13

aae0fc2a922b3e31dae7648c547fca2ac2587625 removed the #elementsUSB anchor but did not update the links to point to the new section #elementsHostDev. Signed-off-by: Philipp Hahn <hahn(a)univention.de> --- docs/formatdomain.html.in | 2 +- docs/formatnode.html.in | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index d651816..cc4c5ea 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -146,7 +146,7 @@ configure in the desired way, which is why per-device boot elements (see <a href="#elementsDisks">disks</a>, <a href="#elementsNICS">network interfaces</a>, and - <a href="#elementsUSB">USB and PCI devices</a> sections below) were + <a href="#elementsHostDev">USB and PCI devices</a> sections below) were introduced and they are the preferred way providing full control over booting order. The <code>boot</code> element and per-device boot elements are mutually exclusive. <span class="since">Since 0.1.3, diff --git a/docs/formatnode.html.in b/docs/formatnode.html.in index ad05a70..5f57a5a 100644 --- a/docs/formatnode.html.in +++ b/docs/formatnode.html.in @@ -13,7 +13,7 @@ prefix <code>virNodeDevice</code>, which deal with management of host devices that can be handed to guests via passthrough as <hostdev> elements - in <a href="formatdomain.html#elementsUSB">the domain XML</a>. + in <a href="formatdomain.html#elementsHostDev">the domain XML</a>. These devices are represented as a hierarchy, where a device on a bus has a parent of the bus controller device; the root of the hierarchy is the node named "computer". -- 1.7.10.4

2 1

[libvirt] Entering freeze for libvirt-1.1.0
by Daniel Veillard 28 Jun '13

28 Jun '13

Since Dan pushed the fine grained ACL control patches, this release really ought to be 1.1.0, I just tagged it in git and pushed tarball and rpms to the server: ftp://libvirt.org/libvirt/ I know that Laine has still a patch set to push, now it seems they all got ACK'ed so better get them in for rc2, which I will probably push on thursday. Then if everything looks fine we can have the final release on Monday. I gave it my usual user test, on Fedora, seems to work fine from my limited perspective. I just had to push the attached patch as a build breaker otherwise make rpm would wail because the polkit API definitions would not be packaged. Probably worth a double checking by Dan for correctness. Thanks in advance for feedback on the candidate release, Daniel -- Daniel Veillard | Open Source and Standards, Red Hat veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

6 9

[libvirt] Bug 979411 - virsh migration copy-storage-all fails with "Unable to read from monitor: Connection reset by peer"
by chandrashekar shastri 28 Jun '13

28 Jun '13

Hi, I have filed a bug for virsh migration copy-storage-all: Bug 979411 - virsh migration copy-storage-all fails with "Unable to read from monitor: Connection reset by peer" Earlier I had filed this bug in launched: Bug #1192499 : virsh migration copy-storage-all fails with "Unable to read from monitor: Connection reset by peer" Thanks, Chandrashekar Shastri

1 0

[libvirt] [PATCH] add support for libssh2 password from auth file
by David Maciejak 28 Jun '13

28 Jun '13

Hi, I was discussing with Daniel about the best way to pass the ssh password when using such kind of uri: 'xen+libssh2:// root(a)192.168.0.10?sshauth=password' As it seems passing the password in the uri is not a good option, maybe we can grab it from auth conf ? it seems it's not the case as now (tell me if i am wrong). So enclosed a patch to add this feature. As you can see in virnetclient.c there is no virAuthGetPassword call, so the authfile is never used. The patch enclosed is modifying the function prototype to add virConnectPtr parameter (so remote_driver.c virNetClientNewLibSSH2 call has to be updated too and the corresponding .h too). Once we have access to virConnectPtr, as you will see in the patch we can check if authMethods is set to 'password' and grab the password from auth file by calling virAuthGetPassword. regards, david

4 11

[libvirt] [PATCH] Replace use of 'in_addr_t' with 'struct in_addr'
by Daniel P. Berrange 28 Jun '13

28 Jun '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> The 'in_addr_t' typedef is not present in Mingw64 headers. Instead we can use the more portable 'struct in_addr' and then access its 's_addr' field. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/util/virsocketaddr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util/virsocketaddr.c b/src/util/virsocketaddr.c index 2666574..80b5c0b 100644 --- a/src/util/virsocketaddr.c +++ b/src/util/virsocketaddr.c @@ -235,10 +235,10 @@ virSocketAddrIsPrivate(const virSocketAddrPtr addr) bool virSocketAddrIsWildcard(const virSocketAddrPtr addr) { - in_addr_t tmp = INADDR_ANY; + struct in_addr tmp = { .s_addr = INADDR_ANY }; switch (addr->data.stor.ss_family) { case AF_INET: - return memcmp(&addr->data.inet4.sin_addr.s_addr, &tmp, + return memcmp(&addr->data.inet4.sin_addr.s_addr, &tmp.s_addr, sizeof(addr->data.inet4.sin_addr.s_addr)) == 0; case AF_INET6: return IN6_IS_ADDR_UNSPECIFIED(&addr->data.inet6.sin6_addr); -- 1.8.2.1

2 1

[libvirt] [PATCH] Allow RO connections to interface udev backend
by Doug Goldstein 28 Jun '13

28 Jun '13

The udev based interface backend did not allow querying data over a read-only connection which is different than how the netcf backend operates. This brings the behavior inline with the default, netcf backend. --- src/interface/interface_backend_udev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c index 68e1e2f..95034bf 100644 --- a/src/interface/interface_backend_udev.c +++ b/src/interface/interface_backend_udev.c @@ -139,7 +139,7 @@ udevInterfaceOpen(virConnectPtr conn, { struct udev_iface_driver *driverState = NULL; - virCheckFlags(0, VIR_DRV_OPEN_ERROR); + virCheckFlags(VIR_CONNECT_RO, VIR_DRV_OPEN_ERROR); if (VIR_ALLOC(driverState) < 0) { virReportOOMError(); -- 1.8.1.5

3 3

[libvirt] [PATCHv2 0/2] Swap order of AddImplicitControllers and DomainDefPostParse
by Viktor Mihajlovski 28 Jun '13

28 Jun '13

Implicit controllers may be dependent on device definitions altered in a post-parse callback. E.g., if a console device is defined without the target type, the type will be set in QEMU's callback. In the case of s390, this is virtio, which requires an implicit virtio-serial controller. By moving the implicit controller definition after the post-parse procssing this can be fixed. As Martin pointed out, implicit controllers should not need post-parsing, so the rearranging should not hurt. Probably this is only affecting the S390 virtio console anyway. V2 Changes: - Promoted from RFC to Patch Series - Added an qemuxml2xml testcase highlighting the issue: applying the first patch only will fail make check as the implicit controller is missing. Viktor Mihajlovski (2): S390: Testcase for console default target type (virtio) conf: Swap order of AddImplicitControllers and DomainDefPostParse src/conf/domain_conf.c | 8 +++---- .../qemuxml2argv-s390-defaultconsole.xml | 20 ++++++++++++++++ .../qemuxml2xmlout-balloon-device-auto.xml | 2 +- .../qemuxml2xmlout-channel-virtio-auto.xml | 2 +- .../qemuxml2xmlout-console-virtio.xml | 2 +- .../qemuxml2xmlout-disk-scsi-device-auto.xml | 2 +- .../qemuxml2xmlout-s390-defaultconsole.xml | 24 ++++++++++++++++++++ tests/qemuxml2xmltest.c | 2 ++ 8 files changed, 54 insertions(+), 8 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-s390-defaultconsole.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-s390-defaultconsole.xml -- 1.7.9.5

4 6

[libvirt] [PATCH] build: Fix VPATH build for access/*
by Viktor Mihajlovski 28 Jun '13

28 Jun '13

VPATH build failed for the generated access driver files. Signed-off-by: Viktor Mihajlovski <mihajlov(a)linux.vnet.ibm.com> --- src/Makefile.am | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index e6b1927..4cf999d 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -808,9 +808,12 @@ SECURITY_DRIVER_APPARMOR_SOURCES = \ security/security_apparmor.h security/security_apparmor.c ACCESS_DRIVER_GENERATED = \ - access/viraccessapicheck.h access/viraccessapicheck.c \ - access/viraccessapicheckqemu.h access/viraccessapicheckqemu.c \ - access/viraccessapichecklxc.h access/viraccessapichecklxc.c + $(srcdir)/access/viraccessapicheck.h \ + $(srcdir)/access/viraccessapicheck.c \ + $(srcdir)/access/viraccessapicheckqemu.h \ + $(srcdir)/access/viraccessapicheckqemu.c \ + $(srcdir)/access/viraccessapichecklxc.h \ + $(srcdir)/access/viraccessapichecklxc.c ACCESS_DRIVER_SYMFILES = \ libvirt_access.syms \ @@ -828,7 +831,7 @@ ACCESS_DRIVER_POLKIT_SOURCES = \ access/viraccessdriverpolkit.h access/viraccessdriverpolkit.c ACCESS_DRIVER_POLKIT_POLICY = \ - access/org.libvirt.api.policy + $(srcdir)/access/org.libvirt.api.policy NODE_DEVICE_DRIVER_SOURCES = \ @@ -1488,29 +1491,29 @@ libvirt_access_lxc.syms: $(srcdir)/rpc/gendispatch.pl \ $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclsym \ lxc LXC $(LXC_PROTOCOL) > $@ -access/viraccessapicheck.h: $(srcdir)/rpc/gendispatch.pl \ +$(srcdir)/access/viraccessapicheck.h: $(srcdir)/rpc/gendispatch.pl \ $(REMOTE_PROTOCOL) Makefile.am $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclheader \ remote REMOTE $(REMOTE_PROTOCOL) > $@ -access/viraccessapicheck.c: $(srcdir)/rpc/gendispatch.pl \ +$(srcdir)/access/viraccessapicheck.c: $(srcdir)/rpc/gendispatch.pl \ $(REMOTE_PROTOCOL) Makefile.am $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclbody \ remote REMOTE $(REMOTE_PROTOCOL) access/viraccessapicheck.h > $@ -access/viraccessapicheckqemu.h: $(srcdir)/rpc/gendispatch.pl \ +$(srcdir)/access/viraccessapicheckqemu.h: $(srcdir)/rpc/gendispatch.pl \ $(QEMU_PROTOCOL) Makefile.am $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclheader \ qemu QEMU $(QEMU_PROTOCOL) > $@ -access/viraccessapicheckqemu.c: $(srcdir)/rpc/gendispatch.pl \ +$(srcdir)/access/viraccessapicheckqemu.c: $(srcdir)/rpc/gendispatch.pl \ $(QEMU_PROTOCOL) Makefile.am $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclbody \ qemu QEMU $(QEMU_PROTOCOL) access/viraccessapicheckqemu.h > $@ -access/viraccessapichecklxc.h: $(srcdir)/rpc/gendispatch.pl \ +$(srcdir)/access/viraccessapichecklxc.h: $(srcdir)/rpc/gendispatch.pl \ $(LXC_PROTOCOL) Makefile.am $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclheader \ lxc LXC $(LXC_PROTOCOL) > $@ -access/viraccessapichecklxc.c: $(srcdir)/rpc/gendispatch.pl \ +$(srcdir)/access/viraccessapichecklxc.c: $(srcdir)/rpc/gendispatch.pl \ $(LXC_PROTOCOL) Makefile.am $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclbody \ lxc LXC $(LXC_PROTOCOL) access/viraccessapichecklxc.h > $@ -- 1.7.9.5

2 2

[libvirt] [PATCH]Fix vPort Manage of FC vHBA creation
by Dennis Chen 28 Jun '13

28 Jun '13

When create a virtual FC HBA with virsh/libvirt API, an error message will be returned:"error: Node device not found", also the 'nodedev-dumpxml' shows wrong information of wwpn & wwnn for the new created device. Signed-off-by:xschen@tnsoft.com.cn --- src/util/virutil.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util/virutil.c b/src/util/virutil.c index 6fa0212e..569d035 100644 --- a/src/util/virutil.c +++ b/src/util/virutil.c @@ -1792,8 +1792,8 @@ virManageVport(const int parent_host, if (virAsprintf(&vport_name, "%s:%s", - wwnn, - wwpn) < 0) { + wwpn, + wwnn) < 0) { virReportOOMError(); goto cleanup; }

3 5

[libvirt] Bug 979260 - cpu hot-add doesn't work with upstream libvirt 1.0.6 + qemu 1.5.50
by chandrashekar shastri 28 Jun '13

28 Jun '13

Hi All, I have filed the following bug for CPU hot-add issue: Bug 979260 - cpu hot-add doesn't work with upstream libvirt 1.0.6 + qemu 1.5.50 Thanks, Chandrashekar

2 2

[libvirt] [PATCH v2] Make logical pools independent on target path
by Martin Kletzander 28 Jun '13

28 Jun '13

When using logical pools, we had to trust the target->path provided. This parameter, however, can be completely ommited and we can get the correct path using 'lvdisplay' command. In order not to omit the target.path completely, we rather default it to '/dev/<source.name>' which is used to check the pool anyway. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=952973 Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- Notes: v2: - don't drop target.path, but fix it instead to '/dev/<source.name>' Thanks to the change from v1, we can now safely drop all the hunks from logical backend and even the dependency on lvdisplay command. There might be some systems where the path is different and the part of this patch using lvdisplay command would make most of them work. However, checkPool() still depends on '/dev/<source.name>' and I haven't found any other way how to fix that, so feel free to ACK just the {conf,docs,tests}/ part in case you think that we shouldn't try to support anything else than '/dev/<source.name>'. configure.ac | 4 + docs/schemas/storagepool.rng | 13 ++- src/conf/storage_conf.c | 19 +++-- src/storage/storage_backend_logical.c | 95 +++++++++++++--------- src/storage/storage_driver.c | 2 +- tests/storagepoolxml2xmlin/pool-logical-create.xml | 2 +- tests/storagepoolxml2xmlin/pool-logical-nopath.xml | 18 ++++ .../storagepoolxml2xmlout/pool-logical-nopath.xml | 19 +++++ tests/storagepoolxml2xmltest.c | 1 + 9 files changed, 125 insertions(+), 48 deletions(-) create mode 100644 tests/storagepoolxml2xmlin/pool-logical-nopath.xml create mode 100644 tests/storagepoolxml2xmlout/pool-logical-nopath.xml diff --git a/configure.ac b/configure.ac index ef246a6..221b6cb 100644 --- a/configure.ac +++ b/configure.ac @@ -1601,6 +1601,7 @@ if test "$with_storage_lvm" = "yes" || test "$with_storage_lvm" = "check"; then AC_PATH_PROG([PVS], [pvs], [], [$PATH:/sbin:/usr/sbin]) AC_PATH_PROG([VGS], [vgs], [], [$PATH:/sbin:/usr/sbin]) AC_PATH_PROG([LVS], [lvs], [], [$PATH:/sbin:/usr/sbin]) + AC_PATH_PROG([LVDISPLAY], [lvdisplay], [], [$PATH:/sbin:/usr/sbin]) if test "$with_storage_lvm" = "yes" ; then if test -z "$PVCREATE" ; then AC_MSG_ERROR([We need pvcreate for LVM storage driver]) ; fi @@ -1615,6 +1616,7 @@ if test "$with_storage_lvm" = "yes" || test "$with_storage_lvm" = "check"; then if test -z "$PVS" ; then AC_MSG_ERROR([We need pvs for LVM storage driver]) ; fi if test -z "$VGS" ; then AC_MSG_ERROR([We need vgs for LVM storage driver]) ; fi if test -z "$LVS" ; then AC_MSG_ERROR([We need lvs for LVM storage driver]) ; fi + if test -z "$LVDISPLAY" ; then AC_MSG_ERROR([We need lvdisplay for LVM storage driver]) ; fi else if test -z "$PVCREATE" ; then with_storage_lvm=no ; fi if test -z "$VGCREATE" ; then with_storage_lvm=no ; fi @@ -1628,6 +1630,7 @@ if test "$with_storage_lvm" = "yes" || test "$with_storage_lvm" = "check"; then if test -z "$PVS" ; then with_storage_lvm=no ; fi if test -z "$VGS" ; then with_storage_lvm=no ; fi if test -z "$LVS" ; then with_storage_lvm=no ; fi + if test -z "$LVDISPLAY" ; then with_storage_lvm=no ; fi if test "$with_storage_lvm" = "check" ; then with_storage_lvm=yes ; fi fi @@ -1646,6 +1649,7 @@ if test "$with_storage_lvm" = "yes" || test "$with_storage_lvm" = "check"; then AC_DEFINE_UNQUOTED([PVS],["$PVS"],[Location of pvs program]) AC_DEFINE_UNQUOTED([VGS],["$VGS"],[Location of vgs program]) AC_DEFINE_UNQUOTED([LVS],["$LVS"],[Location of lvs program]) + AC_DEFINE_UNQUOTED([LVDISPLAY],["$LVDISPLAY"],[Location of lvdisplay program]) fi fi AM_CONDITIONAL([WITH_STORAGE_LVM], [test "$with_storage_lvm" = "yes"]) diff --git a/docs/schemas/storagepool.rng b/docs/schemas/storagepool.rng index 3c2158a..1b3f4bc 100644 --- a/docs/schemas/storagepool.rng +++ b/docs/schemas/storagepool.rng @@ -62,7 +62,7 @@ <ref name='commonmetadata'/> <ref name='sizing'/> <ref name='sourcelogical'/> - <ref name='target'/> + <ref name='targetlogical'/> </define> <define name='pooldisk'> @@ -207,6 +207,17 @@ </element> </define> + <define name='targetlogical'> + <element name='target'> + <optional> + <element name='path'> + <ref name='absFilePath'/> + </element> + </optional> + <ref name='permissions'/> + </element> + </define> + <define name='sourceinfohost'> <oneOrMore> <element name='host'> diff --git a/src/conf/storage_conf.c b/src/conf/storage_conf.c index 288e265..7ffe58c 100644 --- a/src/conf/storage_conf.c +++ b/src/conf/storage_conf.c @@ -1,7 +1,7 @@ /* * storage_conf.c: config handling for storage driver * - * Copyright (C) 2006-2012 Red Hat, Inc. + * Copyright (C) 2006-2013 Red Hat, Inc. * Copyright (C) 2006-2008 Daniel P. Berrange * * This library is free software; you can redistribute it and/or @@ -959,15 +959,22 @@ virStoragePoolDefParseXML(xmlXPathContextPtr ctxt) /* When we are working with a virtual disk we can skip the target * path and permissions */ if (!(options->flags & VIR_STORAGE_POOL_SOURCE_NETWORK)) { - if (!(target_path = virXPathString("string(./target/path)", ctxt))) { - virReportError(VIR_ERR_XML_ERROR, "%s", - _("missing storage pool target path")); - goto error; + if (ret->type == VIR_STORAGE_POOL_LOGICAL) { + if (virAsprintf(&target_path, "/dev/%s", ret->source.name) < 0) { + virReportOOMError(); + goto error; + } + } else { + target_path = virXPathString("string(./target/path)", ctxt); + if (!target_path) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("missing storage pool target path")); + goto error; + } } ret->target.path = virFileSanitizePath(target_path); if (!ret->target.path) goto error; - if (virStorageDefParsePerms(ctxt, &ret->target.perms, "./target/permissions", DEFAULT_POOL_PERM_MODE) < 0) diff --git a/src/storage/storage_backend_logical.c b/src/storage/storage_backend_logical.c index 944aa0e..471f8d9 100644 --- a/src/storage/storage_backend_logical.c +++ b/src/storage/storage_backend_logical.c @@ -45,6 +45,37 @@ #define PV_BLANK_SECTOR_SIZE 512 +static char * +virStorageBackendGetVolPath(const char *poolname, const char *volname) +{ + char *start = NULL; + char *lvpath = NULL; + char *output = NULL; + + virCommandPtr cmd = virCommandNewArgList(LVDISPLAY, + "--columns", + "--options", "lv_path", + "--noheadings", + "--unbuffered", + NULL); + + virCommandAddArgFormat(cmd, "%s/%s", poolname, volname); + virCommandSetOutputBuffer(cmd, &output); + + if (virCommandRun(cmd, NULL) < 0 || + !(start = strchr(output, '/'))) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Cannot get LV path")); + goto cleanup; + } + + ignore_value(VIR_STRDUP(lvpath, start)); + + cleanup: + VIR_FREE(output); + virCommandFree(cmd); + return lvpath; +} + static int virStorageBackendLogicalSetActive(virStoragePoolObjPtr pool, int on) @@ -116,11 +147,8 @@ virStorageBackendLogicalMakeVol(virStoragePoolObjPtr pool, } if (vol->target.path == NULL) { - if (virAsprintf(&vol->target.path, "%s/%s", - pool->def->target.path, vol->name) < 0) { - virReportOOMError(); + if (VIR_STRDUP(vol->target.path, groups[10]) < 0) goto cleanup; - } } /* Skips the backingStore of lv created with "--virtualsize", @@ -130,12 +158,11 @@ virStorageBackendLogicalMakeVol(virStoragePoolObjPtr pool, * (lvs outputs "[$lvname_vorigin] for field "origin" if the * lv is created with "--virtualsize"). */ - if (groups[1] && !STREQ(groups[1], "") && (groups[1][0] != '[')) { - if (virAsprintf(&vol->backingStore.path, "%s/%s", - pool->def->target.path, groups[1]) < 0) { - virReportOOMError(); + if (groups[1] && STRNEQ(groups[1], "") && (groups[1][0] != '[')) { + vol->backingStore.path = virStorageBackendGetVolPath(pool->def->source.name, + groups[1]); + if (!vol->backingStore.path) goto cleanup; - } vol->backingStore.format = VIR_STORAGE_POOL_LOGICAL_LVM2; } @@ -277,21 +304,21 @@ virStorageBackendLogicalFindLVs(virStoragePoolObjPtr pool, virStorageVolDefPtr vol) { /* - * # lvs --separator , --noheadings --units b --unbuffered --nosuffix --options \ - * "lv_name,origin,uuid,devices,seg_size,vg_extent_size,size,lv_attr" VGNAME + * # lvs --separator '#' --noheadings --units b --unbuffered --nosuffix --options \ + * "lv_name,origin,uuid,devices,seg_size,vg_extent_size,size,lv_attr,lv_path" VGNAME * - * RootLV,,06UgP5-2rhb-w3Bo-3mdR-WeoL-pytO-SAa2ky,/dev/hda2(0),5234491392,33554432,5234491392,-wi-ao - * SwapLV,,oHviCK-8Ik0-paqS-V20c-nkhY-Bm1e-zgzU0M,/dev/hda2(156),1040187392,33554432,1040187392,-wi-ao - * Test2,,3pg3he-mQsA-5Sui-h0i6-HNmc-Cz7W-QSndcR,/dev/hda2(219),1073741824,33554432,1073741824,owi-a- - * Test3,,UB5hFw-kmlm-LSoX-EI1t-ioVd-h7GL-M0W8Ht,/dev/hda2(251),2181038080,33554432,2181038080,-wi-a- - * Test3,Test2,UB5hFw-kmlm-LSoX-EI1t-ioVd-h7GL-M0W8Ht,/dev/hda2(187),1040187392,33554432,1040187392,swi-a- + * RootLV##06UgP5-2rhb-w3Bo-3mdR-WeoL-pytO-SAa2ky#/dev/hda2(0)#5234491392#33554432#5234491392#-wi-ao#/dev/VGNAME/RootLV + * SwapLV##oHviCK-8Ik0-paqS-V20c-nkhY-Bm1e-zgzU0M#/dev/hda2(156)#1040187392#33554432#1040187392#-wi-ao#/dev/VGNAME/SwapLV + * Test2##3pg3he-mQsA-5Sui-h0i6-HNmc-Cz7W-QSndcR#/dev/hda2(219)#1073741824#33554432#1073741824#owi-a-#/dev/VGNAME/Test2 + * Test3##UB5hFw-kmlm-LSoX-EI1t-ioVd-h7GL-M0W8Ht#/dev/hda2(251)#2181038080#33554432#2181038080#-wi-a-#/dev/VGNAME/Test3 + * Test3#Test2#UB5hFw-kmlm-LSoX-EI1t-ioVd-h7GL-M0W8Ht#/dev/hda2(187)#1040187392#33554432#1040187392#swi-a-#/dev/VGNAME/Test3 * * Pull out name, origin, & uuid, device, device extent start #, * segment size, extent size, size, attrs * * NB can be multiple rows per volume if they have many extents * - * NB lvs from some distros (e.g. SLES10 SP2) outputs trailing "," on each line + * NB lvs from some distros (e.g. SLES10 SP2) outputs trailing separator on each line * * NB Encrypted logical volumes can print ':' in their name, so it is * not a suitable separator (rhbz 470693). @@ -299,7 +326,7 @@ virStorageBackendLogicalFindLVs(virStoragePoolObjPtr pool, * striped, so "," is not a suitable separator either (rhbz 727474). */ const char *regexes[] = { - "^\\s*(\\S+)#(\\S*)#(\\S+)#(\\S+)#(\\S+)#([0-9]+)#(\\S+)#([0-9]+)#([0-9]+)#(\\S+)#?\\s*$" + "^\\s*(\\S+)#(\\S*)#(\\S+)#(\\S+)#(\\S+)#([0-9]+)#(\\S+)#([0-9]+)#([0-9]+)#(\\S+)#(\\S+)#?\\s*$" }; int vars[] = { 10 @@ -314,7 +341,7 @@ virStorageBackendLogicalFindLVs(virStoragePoolObjPtr pool, "--unbuffered", "--nosuffix", "--options", - "lv_name,origin,uuid,devices,segtype,stripes,seg_size,vg_extent_size,size,lv_attr", + "lv_name,origin,uuid,devices,segtype,stripes,seg_size,vg_extent_size,size,lv_attr,lv_path", pool->def->source.name, NULL); if (virStorageBackendRunProgRegex(pool, @@ -470,18 +497,7 @@ virStorageBackendLogicalCheckPool(virConnectPtr conn ATTRIBUTE_UNUSED, virStoragePoolObjPtr pool, bool *isActive) { - char *path; - - *isActive = false; - if (virAsprintf(&path, "/dev/%s", pool->def->source.name) < 0) { - virReportOOMError(); - return -1; - } - - if (access(path, F_OK) == 0) - *isActive = true; - - VIR_FREE(path); + *isActive = (access(pool->def->target.path, F_OK) == 0); return 0; } @@ -702,6 +718,7 @@ virStorageBackendLogicalCreateVol(virConnectPtr conn, int fd = -1; virCommandPtr cmd = NULL; virErrorPtr err; + bool created = false; if (vol->target.encryption != NULL) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, @@ -717,13 +734,6 @@ virStorageBackendLogicalCreateVol(virConnectPtr conn, VIR_FREE(vol->target.path); } - if (virAsprintf(&vol->target.path, "%s/%s", - pool->def->target.path, - vol->name) == -1) { - virReportOOMError(); - return -1; - } - cmd = virCommandNewArgList(LVCREATE, "--name", vol->name, NULL); @@ -742,9 +752,15 @@ virStorageBackendLogicalCreateVol(virConnectPtr conn, if (virCommandRun(cmd, NULL) < 0) goto error; + created = true; virCommandFree(cmd); cmd = NULL; + vol->target.path = virStorageBackendGetVolPath(pool->def->source.name, + vol->name); + if (!vol->target.path) + goto error; + if ((fd = virStorageBackendVolOpen(vol->target.path)) < 0) goto error; @@ -784,7 +800,8 @@ virStorageBackendLogicalCreateVol(virConnectPtr conn, error: err = virSaveLastError(); VIR_FORCE_CLOSE(fd); - virStorageBackendLogicalDeleteVol(conn, pool, vol, 0); + if (created) + virStorageBackendLogicalDeleteVol(conn, pool, vol, 0); virCommandFree(cmd); virSetError(err); virFreeError(err); diff --git a/src/storage/storage_driver.c b/src/storage/storage_driver.c index cc8eaa9..891097f 100644 --- a/src/storage/storage_driver.c +++ b/src/storage/storage_driver.c @@ -1,7 +1,7 @@ /* * storage_driver.c: core driver for storage APIs * - * Copyright (C) 2006-2012 Red Hat, Inc. + * Copyright (C) 2006-2013 Red Hat, Inc. * Copyright (C) 2006-2008 Daniel P. Berrange * * This library is free software; you can redistribute it and/or diff --git a/tests/storagepoolxml2xmlin/pool-logical-create.xml b/tests/storagepoolxml2xmlin/pool-logical-create.xml index 4c67089..fd551e0 100644 --- a/tests/storagepoolxml2xmlin/pool-logical-create.xml +++ b/tests/storagepoolxml2xmlin/pool-logical-create.xml @@ -10,7 +10,7 @@ <device path="/dev/sdb3"/> </source> <target> - <path>/dev/HostVG</path> + <path>/invalid/nonexistent/path</path> <permissions> <mode>0700</mode> <owner>0</owner> diff --git a/tests/storagepoolxml2xmlin/pool-logical-nopath.xml b/tests/storagepoolxml2xmlin/pool-logical-nopath.xml new file mode 100644 index 0000000..307e2ab --- /dev/null +++ b/tests/storagepoolxml2xmlin/pool-logical-nopath.xml @@ -0,0 +1,18 @@ +<pool type='logical'> + <name>HostVG</name> + <uuid>1c13165a-d0f4-3aee-b447-30fb38789091</uuid> + <capacity>99891544064</capacity> + <allocation>99220455424</allocation> + <available>671088640</available> + <source> + <name>HostVG</name> + <format type='lvm2'/> + </source> + <target> + <permissions> + <mode>0700</mode> + <owner>0</owner> + <group>0</group> + </permissions> + </target> +</pool> diff --git a/tests/storagepoolxml2xmlout/pool-logical-nopath.xml b/tests/storagepoolxml2xmlout/pool-logical-nopath.xml new file mode 100644 index 0000000..07860ef --- /dev/null +++ b/tests/storagepoolxml2xmlout/pool-logical-nopath.xml @@ -0,0 +1,19 @@ +<pool type='logical'> + <name>HostVG</name> + <uuid>1c13165a-d0f4-3aee-b447-30fb38789091</uuid> + <capacity unit='bytes'>0</capacity> + <allocation unit='bytes'>0</allocation> + <available unit='bytes'>0</available> + <source> + <name>HostVG</name> + <format type='lvm2'/> + </source> + <target> + <path>/dev/HostVG</path> + <permissions> + <mode>0700</mode> + <owner>0</owner> + <group>0</group> + </permissions> + </target> +</pool> diff --git a/tests/storagepoolxml2xmltest.c b/tests/storagepoolxml2xmltest.c index 0376e63..3becdcf 100644 --- a/tests/storagepoolxml2xmltest.c +++ b/tests/storagepoolxml2xmltest.c @@ -85,6 +85,7 @@ mymain(void) DO_TEST("pool-dir"); DO_TEST("pool-fs"); DO_TEST("pool-logical"); + DO_TEST("pool-logical-nopath"); DO_TEST("pool-logical-create"); DO_TEST("pool-disk"); DO_TEST("pool-iscsi"); -- 1.8.2.1

1 0

[libvirt] Design of virDomainSnapshotExport/Import
by Xu Wang 28 Jun '13

28 Jun '13

Applications based on libvirt such as OpenStack need some public APIs about export/import of external snapshot during daily backup, snapshot recovery or system migration. virDomainSnapshotDiskExport, virDomainSnapshotVmstateExport and virDomainSnapshotImport are designed to satisfy such requirement. @flags: virDomainSnapshotExportImportFlags include, DATA_FULL: all data snapshot DATA_DELTA: delta data only /** * virDomainSnapshotDiskExport * @domain: the domain object to be exported snapshot * @id: top Overlays which to be exported * @base_id: RootBase of snapshot to be exported * @disk: block device of domain * @export_path: path of snapshots export * @flags: bitwise-OR of virDomainSnapshotExportImportFlags * * Import snapshot disk data to the pointed path. * * If @flags includes DATA_FULL, full backup snapshot will be exported. * * If @flags includes DATA_DELTA, incremental backup snapshot will be * exported. * * DATA_FULL and DATA_DELTA should not appear at the same time * * Returns 0 on success, or -1 on error */ int virDomainSnapshotDiskExport(virDomain *domain, virSnapshotId *id, virSnapshotId *base_id, virDevice *disk, char *export_path, unsigned int flags) Usage: export external snapshot disk file from virtual machine to the target path. /** * virDomainSnapshotVmstateExport * @domain: the domain object to be exported snapshot * @id: top Overlays which to be exported * @export_path: path of snapshots export * @flags: not used yet, so callers should always pass 0 * * Import snapshot vmstate data to the pointed path. * * If @flags includes DATA_FULL, full backup snapshot will be exported. * * If @flags includes DATA_DELTA, incremental backup snapshot will be * exported. * * DATA_FULL and DATA_DELTA should not appear at the same time * * Returns 0 on success, or -1 on error */ int virDomainSnapshotVmstateExport(virDomain *domain, virSnapshotId *id, char *export_path, unsigned int flags) Usage: dump vmstate file of snapshot and copy it to the target path. /** * virDomainSnapshotImport * @domain: the domain object to be exported snapshot * @xmlDesc: string containing an XML description of the domain * @flags: bitwise-OR of virDomainSnapshotExportImportFlags * * Import snapshot data to the pointed path. * * If @flags includes DATA_FULL, full backup snapshot will be exported. * * If @flags includes DATA_DELTA, incremental backup snapshot will be * exported. * * DATA_FULL and DATA_DELTA should not appear at the same time * * Returns 0 on success, or -1 on error */ int virDomainSnapshotImport(virDomain *domain, const char *xmlDesc, unsigned int flags) Usage: import .xml file of external snapshot and use it for recovering a virtual machine. Usecase: If users want to finish daily backup&recovery work by above APIs, the process should be, 1. call virDomainSnapshotDiskExport() to export pointed snapshot disk files to the traget path. ------------------- --------------------- | host A | | host B | | --------------- | | ----------------- | | | dom1 | | snapshot disk files | | backup folder | | | | base.img----------------------------------->base.img | | | | snap1.qcow2-------------------------------->snap1.qcow2 | | | | snap2.qcow2-------------------------------->snap2.qcow2 | | | --------------- | | ----------------- | ------------------- --------------------- virDomainSnapshotDiskSnapshot() 2. call virDomainSnapshotVmstateExport() to export vmstate data file to the target path. --------------- --------------------- | host A | | host B | | ----------- | | ----------------- | | | dom1 | | vmstate data files | | backup folder | | | | dumpxml-------------------------------->vmstate.xml | | | ----------- | | ----------------- | --------------- --------------------- virDomainSnapshotVmstateSnapshot() 3. when some error occured, or guest copy/migration, users copy snapshot disk files from host B to the target host and edit <source file> field of <disk> tag. Then users call virDomainSnapshotImport to recovery domain to the snapshot. a. copy snapshot disk files to the target host: ------------------------------- --------------------- | host A | snapshot | host B | | --------------------------- | disk | ----------------- | | | /var/lib/libvirt/images | | files | | backup folder | | | | base.img<-----------------------------------base.img | | | | snap1.qcow2<--------------------------------snap1.qcow2 | | | | snap2.qcow2<--------------------------------snap2.qcow2 | | | --------------------------- | | ----------------- | ------------------------------- --------------------- snapshot disk files transfer b. import vmstate data to recovery snapshot: --------------------- ------------------- | host B | | host A | | ----------------- | | --------------- | vmstate data | | backup folder | | | | dom1<-------------------------------vmstate.xml | | | | base.img | | | ----------------- | | | snap1.qcow2 | | --------------------- | | snap2.qcow2 | | | --------------- | ------------------- virDomainSnapshotImport()

1 0

[libvirt] [PATCH] util: fix build error on non-Linux systems
by Laine Stump 28 Jun '13

28 Jun '13

Building on FreeBSD had this linker error: /work/a/ports/devel/libvirt/work/libvirt-1.1.0/src/.libs/libvirt.so: undefined reference to `virPCIDeviceAddressParse' This was caused by the new use of virPCIDeviceAddressParse in a portion of virpci.c that wasn't linux-only (in commit 72c029d8). The problem was that virPCIDeviceAddressParse had originally been defined inside #ifdef _linux (because it was only used by another function that was inside the same ifdef). The solution is to move it out to the part of virpci.c that is compiled on all platforms. (Because the portion that was "moved" was 40-50 lines, but only moved up by 15 lines, the diff for the patch is less than non-informative - rather than showing that part that I moved, it shows the bit that was previously before the moved part, and now sits *after* it.) --- Pushed under the build-breaker rule. I actually hadn't noticed that some of the functions in virpci.c were Linux-only. It looks like this was done because those functions use the Linux sysfs to get information about the devices. However, much of the rest of virpci.c does the same thing, so we should probably revisit which of the functions in that file are compiled only on Linux and which are compile for everyone. src/util/virpci.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/src/util/virpci.c b/src/util/virpci.c index 0ed29e7..7d83bdb 100644 --- a/src/util/virpci.c +++ b/src/util/virpci.c @@ -2261,21 +2261,6 @@ int virPCIDeviceIsAssignable(virPCIDevicePtr dev, return 1; } -#ifdef __linux__ - -/* - * returns true if equal - */ -static bool -virPCIDeviceAddressIsEqual(virPCIDeviceAddressPtr bdf1, - virPCIDeviceAddressPtr bdf2) -{ - return ((bdf1->domain == bdf2->domain) && - (bdf1->bus == bdf2->bus) && - (bdf1->slot == bdf2->slot) && - (bdf1->function == bdf2->function)); -} - static int logStrToLong_ui(char const *s, char **end_ptr, @@ -2327,6 +2312,21 @@ out: return ret; } +#ifdef __linux__ + +/* + * returns true if equal + */ +static bool +virPCIDeviceAddressIsEqual(virPCIDeviceAddressPtr bdf1, + virPCIDeviceAddressPtr bdf2) +{ + return ((bdf1->domain == bdf2->domain) && + (bdf1->bus == bdf2->bus) && + (bdf1->slot == bdf2->slot) && + (bdf1->function == bdf2->function)); +} + static int virPCIGetDeviceAddressFromSysfsLink(const char *device_link, virPCIDeviceAddressPtr *bdf) -- 1.7.11.7

1 0

[libvirt] Restore original security labels
by Michal Privoznik 27 Jun '13

27 Jun '13

Dear list, it's been a while since I've tried to get the patches in [1]. However, it turned out that we need completely different approach. Now I'd like to revisit that decision. The problem is: libvirt sets various security labels (DAC, selinux) in order for a file to be readable by a qemu process. However, it doesn't record the original labels, so in process of tearing the domain down, we restore "defaults" (in case of DAC we set root:root instead of john:doe). Moreover, if a file is to be shared among multiple domains we can't restore the label as it would make it inaccessible for other qemu processes. My implementation dealt with this problem using XATTRs: one to store the original label, the other one as a reference counter. For each labeling the counter is increased. For each attempt to restore the label the counter is decreased. The original label is restored iff the counter is zero. However, this approach doesn't work well with two libvirtd instances fighting over a file. But one can argue that this is something for cluster. The question is - do we want to reimplement cluster in libvirt? I think my approach seems like reasonable trade-off. So what's your opinion on this? Michal 1: http://www.redhat.com/archives/libvir-list/2013-March/msg01289.html

2 1

[libvirt] [PATCH] add symbol ")" in virsh nodedev-detach help
by xuzhang 27 Jun '13

27 Jun '13

--- tools/virsh-nodedev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/virsh-nodedev.c b/tools/virsh-nodedev.c index da93b8e..49546a2 100644 --- a/tools/virsh-nodedev.c +++ b/tools/virsh-nodedev.c @@ -605,7 +605,7 @@ static const vshCmdOptDef opts_node_device_detach[] = { }, {.name = "driver", .type = VSH_OT_STRING, - .help = N_("pci device assignment backend driver (e.g. 'vfio' or 'kvm'") + .help = N_("pci device assignment backend driver (e.g. 'vfio' or 'kvm'")) }, {.name = NULL} }; -- 1.7.11.7

2 1

[libvirt] [PATCH] Make logical pools independent on target path
by Martin Kletzander 27 Jun '13

27 Jun '13

When using logical pools, we had to trust the target->pth provided. This parameter, however, can be completely ommited and we can get the correct path using 'lvdisplay' command. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=952973 Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- Notes: I'm not sure we can drop the target.path from the XML (see tests), so another variant is to keep it there the same way it was defined by user/mgmt app. If that's desired, mentioning it with an ack is enough for me to know I should drop the conf/storage_conf.c hunk as well as the hunks patching tests. configure.ac | 4 ++ src/conf/storage_conf.c | 19 +++--- src/storage/storage_backend_logical.c | 79 +++++++++++++++------- tests/storagepoolxml2xmlin/pool-logical-create.xml | 1 - tests/storagepoolxml2xmlin/pool-logical.xml | 1 - .../storagepoolxml2xmlout/pool-logical-create.xml | 1 - tests/storagepoolxml2xmlout/pool-logical.xml | 1 - 7 files changed, 67 insertions(+), 39 deletions(-) diff --git a/configure.ac b/configure.ac index 5d1bc6b..753139d 100644 --- a/configure.ac +++ b/configure.ac @@ -1603,6 +1603,7 @@ if test "$with_storage_lvm" = "yes" || test "$with_storage_lvm" = "check"; then AC_PATH_PROG([PVS], [pvs], [], [$PATH:/sbin:/usr/sbin]) AC_PATH_PROG([VGS], [vgs], [], [$PATH:/sbin:/usr/sbin]) AC_PATH_PROG([LVS], [lvs], [], [$PATH:/sbin:/usr/sbin]) + AC_PATH_PROG([LVDISPLAY], [lvdisplay], [], [$PATH:/sbin:/usr/sbin]) if test "$with_storage_lvm" = "yes" ; then if test -z "$PVCREATE" ; then AC_MSG_ERROR([We need pvcreate for LVM storage driver]) ; fi @@ -1617,6 +1618,7 @@ if test "$with_storage_lvm" = "yes" || test "$with_storage_lvm" = "check"; then if test -z "$PVS" ; then AC_MSG_ERROR([We need pvs for LVM storage driver]) ; fi if test -z "$VGS" ; then AC_MSG_ERROR([We need vgs for LVM storage driver]) ; fi if test -z "$LVS" ; then AC_MSG_ERROR([We need lvs for LVM storage driver]) ; fi + if test -z "$LVDISPLAY" ; then AC_MSG_ERROR([We need lvdisplay for LVM storage driver]) ; fi else if test -z "$PVCREATE" ; then with_storage_lvm=no ; fi if test -z "$VGCREATE" ; then with_storage_lvm=no ; fi @@ -1630,6 +1632,7 @@ if test "$with_storage_lvm" = "yes" || test "$with_storage_lvm" = "check"; then if test -z "$PVS" ; then with_storage_lvm=no ; fi if test -z "$VGS" ; then with_storage_lvm=no ; fi if test -z "$LVS" ; then with_storage_lvm=no ; fi + if test -z "$LVDISPLAY" ; then with_storage_lvm=no ; fi if test "$with_storage_lvm" = "check" ; then with_storage_lvm=yes ; fi fi @@ -1648,6 +1651,7 @@ if test "$with_storage_lvm" = "yes" || test "$with_storage_lvm" = "check"; then AC_DEFINE_UNQUOTED([PVS],["$PVS"],[Location of pvs program]) AC_DEFINE_UNQUOTED([VGS],["$VGS"],[Location of vgs program]) AC_DEFINE_UNQUOTED([LVS],["$LVS"],[Location of lvs program]) + AC_DEFINE_UNQUOTED([LVDISPLAY],["$LVDISPLAY"],[Location of lvdisplay program]) fi fi AM_CONDITIONAL([WITH_STORAGE_LVM], [test "$with_storage_lvm" = "yes"]) diff --git a/src/conf/storage_conf.c b/src/conf/storage_conf.c index cc3d3d9..948e190 100644 --- a/src/conf/storage_conf.c +++ b/src/conf/storage_conf.c @@ -1,7 +1,7 @@ /* * storage_conf.c: config handling for storage driver * - * Copyright (C) 2006-2012 Red Hat, Inc. + * Copyright (C) 2006-2013 Red Hat, Inc. * Copyright (C) 2006-2008 Daniel P. Berrange * * This library is free software; you can redistribute it and/or @@ -947,15 +947,16 @@ virStoragePoolDefParseXML(xmlXPathContextPtr ctxt) /* When we are working with a virtual disk we can skip the target * path and permissions */ if (!(options->flags & VIR_STORAGE_POOL_SOURCE_NETWORK)) { - if (!(target_path = virXPathString("string(./target/path)", ctxt))) { - virReportError(VIR_ERR_XML_ERROR, "%s", - _("missing storage pool target path")); - goto error; + if (ret->type != VIR_STORAGE_POOL_LOGICAL) { + if (!(target_path = virXPathString("string(./target/path)", ctxt))) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("missing storage pool target path")); + goto error; + } + ret->target.path = virFileSanitizePath(target_path); + if (!ret->target.path) + goto error; } - ret->target.path = virFileSanitizePath(target_path); - if (!ret->target.path) - goto error; - if (virStorageDefParsePerms(ctxt, &ret->target.perms, "./target/permissions", DEFAULT_POOL_PERM_MODE) < 0) diff --git a/src/storage/storage_backend_logical.c b/src/storage/storage_backend_logical.c index 944aa0e..66a4e42 100644 --- a/src/storage/storage_backend_logical.c +++ b/src/storage/storage_backend_logical.c @@ -45,6 +45,37 @@ #define PV_BLANK_SECTOR_SIZE 512 +static char * +virStorageBackendGetVolPath(const char *poolname, const char *volname) +{ + char *start = NULL; + char *lvpath = NULL; + char *output = NULL; + + virCommandPtr cmd = virCommandNewArgList(LVDISPLAY, + "--columns", + "--options", "lv_path", + "--noheadings", + "--unbuffered", + NULL); + + virCommandAddArgFormat(cmd, "%s/%s", poolname, volname); + virCommandSetOutputBuffer(cmd, &output); + + if (virCommandRun(cmd, NULL) < 0 || + !(start = strchr(output, '/'))) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Cannot get LV path")); + goto cleanup; + } + + ignore_value(VIR_STRDUP(lvpath, start)); + + cleanup: + VIR_FREE(output); + virCommandFree(cmd); + return lvpath; +} + static int virStorageBackendLogicalSetActive(virStoragePoolObjPtr pool, int on) @@ -116,11 +147,8 @@ virStorageBackendLogicalMakeVol(virStoragePoolObjPtr pool, } if (vol->target.path == NULL) { - if (virAsprintf(&vol->target.path, "%s/%s", - pool->def->target.path, vol->name) < 0) { - virReportOOMError(); + if (VIR_STRDUP(vol->target.path, groups[9]) < 0) goto cleanup; - } } /* Skips the backingStore of lv created with "--virtualsize", @@ -130,12 +158,11 @@ virStorageBackendLogicalMakeVol(virStoragePoolObjPtr pool, * (lvs outputs "[$lvname_vorigin] for field "origin" if the * lv is created with "--virtualsize"). */ - if (groups[1] && !STREQ(groups[1], "") && (groups[1][0] != '[')) { - if (virAsprintf(&vol->backingStore.path, "%s/%s", - pool->def->target.path, groups[1]) < 0) { - virReportOOMError(); + if (groups[1] && STRNEQ(groups[1], "") && (groups[1][0] != '[')) { + vol->backingStore.path = virStorageBackendGetVolPath(pool->def->source.name, + groups[1]); + if (!vol->backingStore.path) goto cleanup; - } vol->backingStore.format = VIR_STORAGE_POOL_LOGICAL_LVM2; } @@ -277,21 +304,20 @@ virStorageBackendLogicalFindLVs(virStoragePoolObjPtr pool, virStorageVolDefPtr vol) { /* - * # lvs --separator , --noheadings --units b --unbuffered --nosuffix --options \ - * "lv_name,origin,uuid,devices,seg_size,vg_extent_size,size,lv_attr" VGNAME + * # lvs --separator '#' --noheadings --units b --unbuffered --nosuffix --options "lv_name,origin,uuid,devices,seg_size,vg_extent_size,size,lv_path" VGNAME * - * RootLV,,06UgP5-2rhb-w3Bo-3mdR-WeoL-pytO-SAa2ky,/dev/hda2(0),5234491392,33554432,5234491392,-wi-ao - * SwapLV,,oHviCK-8Ik0-paqS-V20c-nkhY-Bm1e-zgzU0M,/dev/hda2(156),1040187392,33554432,1040187392,-wi-ao - * Test2,,3pg3he-mQsA-5Sui-h0i6-HNmc-Cz7W-QSndcR,/dev/hda2(219),1073741824,33554432,1073741824,owi-a- - * Test3,,UB5hFw-kmlm-LSoX-EI1t-ioVd-h7GL-M0W8Ht,/dev/hda2(251),2181038080,33554432,2181038080,-wi-a- - * Test3,Test2,UB5hFw-kmlm-LSoX-EI1t-ioVd-h7GL-M0W8Ht,/dev/hda2(187),1040187392,33554432,1040187392,swi-a- + * RootLV##06UgP5-2rhb-w3Bo-3mdR-WeoL-pytO-SAa2ky#/dev/hda2(0)#5234491392#33554432#5234491392#/dev/VGNAME/RootLV + * SwapLV##oHviCK-8Ik0-paqS-V20c-nkhY-Bm1e-zgzU0M#/dev/hda2(156)#1040187392#33554432#1040187392#/dev/VGNAME/SwapLV + * Test2##3pg3he-mQsA-5Sui-h0i6-HNmc-Cz7W-QSndcR#/dev/hda2(219)#1073741824#33554432#1073741824#/dev/VGNAME/Test2 + * Test3##UB5hFw-kmlm-LSoX-EI1t-ioVd-h7GL-M0W8Ht#/dev/hda2(251)#2181038080#33554432#2181038080#/dev/VGNAME/Test3 + * Test3#Test2#UB5hFw-kmlm-LSoX-EI1t-ioVd-h7GL-M0W8Ht#/dev/hda2(187)#1040187392#33554432#1040187392#/dev/VGNAME/Test3 * * Pull out name, origin, & uuid, device, device extent start #, * segment size, extent size, size, attrs * * NB can be multiple rows per volume if they have many extents * - * NB lvs from some distros (e.g. SLES10 SP2) outputs trailing "," on each line + * NB lvs from some distros (e.g. SLES10 SP2) outputs trailing separator on each line * * NB Encrypted logical volumes can print ':' in their name, so it is * not a suitable separator (rhbz 470693). @@ -314,7 +340,7 @@ virStorageBackendLogicalFindLVs(virStoragePoolObjPtr pool, "--unbuffered", "--nosuffix", "--options", - "lv_name,origin,uuid,devices,segtype,stripes,seg_size,vg_extent_size,size,lv_attr", + "lv_name,origin,uuid,devices,segtype,stripes,seg_size,vg_extent_size,size,lv_path", pool->def->source.name, NULL); if (virStorageBackendRunProgRegex(pool, @@ -702,6 +728,7 @@ virStorageBackendLogicalCreateVol(virConnectPtr conn, int fd = -1; virCommandPtr cmd = NULL; virErrorPtr err; + bool created = false; if (vol->target.encryption != NULL) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, @@ -717,13 +744,6 @@ virStorageBackendLogicalCreateVol(virConnectPtr conn, VIR_FREE(vol->target.path); } - if (virAsprintf(&vol->target.path, "%s/%s", - pool->def->target.path, - vol->name) == -1) { - virReportOOMError(); - return -1; - } - cmd = virCommandNewArgList(LVCREATE, "--name", vol->name, NULL); @@ -742,9 +762,15 @@ virStorageBackendLogicalCreateVol(virConnectPtr conn, if (virCommandRun(cmd, NULL) < 0) goto error; + created = true; virCommandFree(cmd); cmd = NULL; + vol->target.path = virStorageBackendGetVolPath(pool->def->source.name, + vol->name); + if (!vol->target.path) + goto error; + if ((fd = virStorageBackendVolOpen(vol->target.path)) < 0) goto error; @@ -784,7 +810,8 @@ virStorageBackendLogicalCreateVol(virConnectPtr conn, error: err = virSaveLastError(); VIR_FORCE_CLOSE(fd); - virStorageBackendLogicalDeleteVol(conn, pool, vol, 0); + if (created) + virStorageBackendLogicalDeleteVol(conn, pool, vol, 0); virCommandFree(cmd); virSetError(err); virFreeError(err); diff --git a/tests/storagepoolxml2xmlin/pool-logical-create.xml b/tests/storagepoolxml2xmlin/pool-logical-create.xml index 4c67089..e1bb4db 100644 --- a/tests/storagepoolxml2xmlin/pool-logical-create.xml +++ b/tests/storagepoolxml2xmlin/pool-logical-create.xml @@ -10,7 +10,6 @@ <device path="/dev/sdb3"/> </source> <target> - <path>/dev/HostVG</path> <permissions> <mode>0700</mode> <owner>0</owner> diff --git a/tests/storagepoolxml2xmlin/pool-logical.xml b/tests/storagepoolxml2xmlin/pool-logical.xml index c4bfa07..307e2ab 100644 --- a/tests/storagepoolxml2xmlin/pool-logical.xml +++ b/tests/storagepoolxml2xmlin/pool-logical.xml @@ -9,7 +9,6 @@ <format type='lvm2'/> </source> <target> - <path>/dev/HostVG</path> <permissions> <mode>0700</mode> <owner>0</owner> diff --git a/tests/storagepoolxml2xmlout/pool-logical-create.xml b/tests/storagepoolxml2xmlout/pool-logical-create.xml index 7413f1c..fbce90e 100644 --- a/tests/storagepoolxml2xmlout/pool-logical-create.xml +++ b/tests/storagepoolxml2xmlout/pool-logical-create.xml @@ -12,7 +12,6 @@ <format type='lvm2'/> </source> <target> - <path>/dev/HostVG</path> <permissions> <mode>0700</mode> <owner>0</owner> diff --git a/tests/storagepoolxml2xmlout/pool-logical.xml b/tests/storagepoolxml2xmlout/pool-logical.xml index 07860ef..7fad0d8 100644 --- a/tests/storagepoolxml2xmlout/pool-logical.xml +++ b/tests/storagepoolxml2xmlout/pool-logical.xml @@ -9,7 +9,6 @@ <format type='lvm2'/> </source> <target> - <path>/dev/HostVG</path> <permissions> <mode>0700</mode> <owner>0</owner> -- 1.8.2.1

2 2

[libvirt] [PATCH] add symbol ")" in virsh nodedev-detach help
by xuzhang 27 Jun '13

27 Jun '13

--- tools/virsh-nodedev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/virsh-nodedev.c b/tools/virsh-nodedev.c index da93b8e..49546a2 100644 --- a/tools/virsh-nodedev.c +++ b/tools/virsh-nodedev.c @@ -605,7 +605,7 @@ static const vshCmdOptDef opts_node_device_detach[] = { }, {.name = "driver", .type = VSH_OT_STRING, - .help = N_("pci device assignment backend driver (e.g. 'vfio' or 'kvm'") + .help = N_("pci device assignment backend driver (e.g. 'vfio' or 'kvm'")) }, {.name = NULL} }; -- 1.7.11.7

1 0

[libvirt] [PATCH 0/2] Fix a pair of network-related crashes
by Ján Tomko 27 Jun '13

27 Jun '13

Ján Tomko (2): netdev: accept NULL in virNetDevSetupControl bridge: don't crash on bandwidth unplug with no bandwidth src/network/bridge_driver.c | 5 +++++ src/util/virnetdev.c | 14 ++++++++------ 2 files changed, 13 insertions(+), 6 deletions(-) -- 1.8.1.5

3 11

[libvirt] [PATCH 0/5]New atomic API to delete snapshot object
by Guannan Ren 27 Jun '13

27 Jun '13

Add a new snapshot API to delete snapshot object atomically int virDomainSnapshotDeleteByName(virDomainPtr domain, const char *name, unsigned int flags); The existing virDomainSnapshotDelete API accepts the snapshot object being deleted as an argument that would be not API atomic. Guannan Ren(5) [PATCH 1/5] snapshot: define new API virDomainSnapshotDeleteByName [PATCH 2/5] snapshot: auto generate RPC calls for remoteDomainSnapshotDeleteByName [PATCH 3/5] qemu: implement SnapshotDeleteByName [PATCH 4/5] python: make auto-generated function name nicer [PATCH 5/5] virsh: use virDomainSnapshotDeleteByName in virsh include/libvirt/libvirt.h.in | 5 +++++ python/generator.py | 3 +++ src/driver.h | 6 ++++++ src/libvirt.c | 73 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ src/libvirt_public.syms | 5 +++++ src/qemu/qemu_driver.c | 102 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++------------------ src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 13 +++++++++++- src/remote_protocol-structs | 7 +++++++ tools/virsh-snapshot.c | 64 ++++++++++++++++++++++++++++++++++++++++++++++++---------- 10 files changed, 249 insertions(+), 30 deletions(-)

2 7

[libvirt] virsh can create vHBA, but returen error msg "Node device not found"
by Dennis Chen 27 Jun '13

27 Jun '13

Hi, I am using the libvirt 1.0.6 with the patch applied: http://libvirt.org/git/?p=libvirt.git;a=commitdiff;h=371c155 The problem I encountered is, with virsh comand 'nodedev-create /home/kvm/vHBA.xml', the vHBA can be generated as expected on the host, but error msg will show in the virsh shell: libvirt: Node Device Driver error : Node device not found I try to find the reason with gdb, and found that the 'nodedev-create' command will call virNetClientIOEventLoop() function of the remote driver, in this function, code will wait on: repoll: ret = poll(fds, ARRAY_CARDINALITY(fds), timeout); after about 50s, poll() returns, but the replied msg->header.status=VIR_NET_ERROR. I am not familiar with the rpc call in the remote driver, does anybody here can give some clues? BRs, Dennis

1 0

[libvirt] [PATCH] docs: Document hypervisor drivers that support certain timer models
by Peter Krempa 26 Jun '13

26 Jun '13

Not every timer model is supported with each hypervisor. Explicitly mention the driver supporting each timer model. --- docs/formatdomain.html.in | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 77126a5..d77bf3f 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -1310,8 +1310,10 @@ <dt><code>name</code></dt> <dd> The <code>name</code> attribute selects which timer is - being modified, and can be one of "platform", "hpet", - "kvmclock", "pit", "rtc", or "tsc". + being modified, and can be one of + "platform" (currently unsupported), + "hpet" (libxl, qemu), "kvmclock" (xen, libxl, qemu), + "pit" (qemu), "rtc" (qemu), or "tsc" (libxl). </dd> <dt><code>track</code></dt> <dd> -- 1.8.2.1

3 3

[libvirt] [PATCHv3] pci: new iommu_group functions
by Laine Stump 26 Jun '13

26 Jun '13

Any device which belongs to an "IOMMU group" (used by vfio) will have links to all devices of its group listed in /sys/bus/pci/$device/iommu_group/devices; /sys/bus/pci/$device/iommu_group is actually a link to /sys/kernel/iommu_groups/$n, where $n is the group number (there will be a corresponding device node at /dev/vfio/$n once the devices are bound to the vfio-pci driver) The following functions are added: virPCIDeviceGetIOMMUGroupList Gets a virPCIDeviceList with one virPCIDeviceList for each device in the same IOMMU group as the provided virPCIDevice (a copy of the original device object is included in the list. virPCIDeviceAddressIOMMUGroupIterate Calls the function @actor once for each device in the group that contains the given virPCIDeviceAddress. virPCIDeviceAddressGetIOMMUGroupAddresses Fills in a virPCIDeviceAddressPtr * with an array of virPCIDeviceAddress, one for each device in the iommu group of the provided virPCIDeviceAddress (including a copy of the original). virPCIDeviceAddressGetIOMMUGroupNum Returns the group number as an int (a valid group number will always be 0 or greater). If there is no iommu_group link in the device's directory (usually indicating that vfio isn't loaded), -2 will be returned. On any real error, -1 will be returned. --- changes from v2: 1) rename functions for consistency 2) set errno=0 prior to each call to readdir, and check for non-zero errno at the end. 3) remove some braces. Everything else in the series of 12 was ACKed, and all but this and the patch that adds the <iommuGroup> element to the nodedev-dumpxml output have been pushed. src/libvirt_private.syms | 4 + src/util/virpci.c | 223 +++++++++++++++++++++++++++++++++++++++++++++++ src/util/virpci.h | 15 +++- 3 files changed, 239 insertions(+), 3 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 795e011..f08ac64 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1693,13 +1693,17 @@ virObjectUnref; # util/virpci.h +virPCIDeviceAddressGetIOMMUGroupAddresses; +virPCIDeviceAddressGetIOMMUGroupNum; virPCIDeviceAddressGetSysfsFile; +virPCIDeviceAddressIOMMUGroupIterate; virPCIDeviceAddressParse; virPCIDeviceCopy; virPCIDeviceDetach; virPCIDeviceFileIterate; virPCIDeviceFree; virPCIDeviceGetIOMMUGroupDev; +virPCIDeviceGetIOMMUGroupList; virPCIDeviceGetManaged; virPCIDeviceGetName; virPCIDeviceGetRemoveSlot; diff --git a/src/util/virpci.c b/src/util/virpci.c index 32a5493..520dbb8 100644 --- a/src/util/virpci.c +++ b/src/util/virpci.c @@ -1876,6 +1876,229 @@ cleanup: return ret; } + +/* virPCIDeviceAddressIOMMUGroupIterate: + * Call @actor for all devices in the same iommu_group as orig + * (including orig itself) Even if there is no iommu_group for the + * device, call @actor once for orig. + */ +int +virPCIDeviceAddressIOMMUGroupIterate(virPCIDeviceAddressPtr orig, + virPCIDeviceAddressActor actor, + void *opaque) +{ + char *groupPath = NULL; + DIR *groupDir = NULL; + int ret = -1; + struct dirent *ent; + + if (virAsprintf(&groupPath, + PCI_SYSFS "devices/%04x:%02x:%02x.%x/iommu_group/devices", + orig->domain, orig->bus, orig->slot, orig->function) < 0) { + virReportOOMError(); + goto cleanup; + } + + if (!(groupDir = opendir(groupPath))) { + /* just process the original device, nothing more */ + ret = (actor)(orig, opaque); + goto cleanup; + } + + while ((errno = 0, ent = readdir(groupDir)) != NULL) { + virPCIDeviceAddress newDev; + + if (ent->d_name[0] == '.') + continue; + + if (virPCIDeviceAddressParse(ent->d_name, &newDev) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Found invalid device link '%s' in '%s'"), + ent->d_name, groupPath); + goto cleanup; + } + + if ((actor)(&newDev, opaque) < 0) + goto cleanup; + } + if (errno != 0) { + virReportSystemError(errno, + _("Failed to read directory entry for %s"), + groupPath); + goto cleanup; + } + + ret = 0; + +cleanup: + VIR_FREE(groupPath); + if (groupDir) + closedir(groupDir); + return ret; +} + + +static int +virPCIDeviceGetIOMMUGroupAddOne(virPCIDeviceAddressPtr newDevAddr, void *opaque) +{ + int ret = -1; + virPCIDeviceListPtr groupList = opaque; + virPCIDevicePtr newDev; + + if (!(newDev = virPCIDeviceNew(newDevAddr->domain, newDevAddr->bus, + newDevAddr->slot, newDevAddr->function))) + goto cleanup; + + if (virPCIDeviceListAdd(groupList, newDev) < 0) + goto cleanup; + + newDev = NULL; /* it's now on the list */ + ret = 0; +cleanup: + virPCIDeviceFree(newDev); + return ret; +} + + +/* + * virPCIDeviceGetIOMMUGroupList - return a virPCIDeviceList containing + * all of the devices in the same iommu_group as @dev. + * + * Return the new list, or NULL on failure + */ +virPCIDeviceListPtr +virPCIDeviceGetIOMMUGroupList(virPCIDevicePtr dev) +{ + virPCIDeviceListPtr groupList = virPCIDeviceListNew(); + virPCIDeviceAddress devAddr = { dev->domain, dev->bus, + dev->slot, dev->function }; + + if (!groupList) + goto error; + + if (virPCIDeviceAddressIOMMUGroupIterate(&devAddr, + virPCIDeviceGetIOMMUGroupAddOne, + groupList) < 0) + goto error; + + return groupList; + +error: + virObjectUnref(groupList); + return NULL; +} + + +typedef struct { + virPCIDeviceAddressPtr **iommuGroupDevices; + size_t *nIommuGroupDevices; +} virPCIDeviceAddressList; +typedef virPCIDeviceAddressList *virPCIDeviceAddressListPtr; + +static int +virPCIGetIOMMUGroupAddressesAddOne(virPCIDeviceAddressPtr newDevAddr, void *opaque) +{ + int ret = -1; + virPCIDeviceAddressListPtr addrList = opaque; + virPCIDeviceAddressPtr copyAddr; + + /* make a copy to insert onto the list */ + if (VIR_ALLOC(copyAddr) < 0) + goto cleanup; + + *copyAddr = *newDevAddr; + + if (VIR_APPEND_ELEMENT(*addrList->iommuGroupDevices, + *addrList->nIommuGroupDevices, copyAddr) < 0) { + virReportOOMError(); + goto cleanup; + } + + ret = 0; +cleanup: + VIR_FREE(copyAddr); + return ret; +} + + +/* + * virPCIGetIOMMUGroupAddresses - return a virPCIDeviceList containing + * all of the devices in the same iommu_group as @dev. + * + * Return the new list, or NULL on failure + */ +int +virPCIDeviceAddressGetIOMMUGroupAddresses(virPCIDeviceAddressPtr devAddr, + virPCIDeviceAddressPtr **iommuGroupDevices, + size_t *nIommuGroupDevices) +{ + int ret = -1; + virPCIDeviceAddressList addrList = { iommuGroupDevices, + nIommuGroupDevices }; + + if (virPCIDeviceAddressIOMMUGroupIterate(devAddr, + virPCIGetIOMMUGroupAddressesAddOne, + &addrList) < 0) + goto cleanup; + + ret = 0; +cleanup: + return ret; +} + + +/* virPCIGetIOMMUGroupNum - return the group number of this PCI + * device's iommu_group, or -2 if there is no iommu_group for the + * device (or -1 if there was any other error) + */ +int +virPCIDeviceAddressGetIOMMUGroupNum(virPCIDeviceAddressPtr addr) +{ + char *devName = NULL; + char *devPath = NULL; + char *groupPath = NULL; + const char *groupNumStr; + unsigned int groupNum; + int ret = -1; + + if (virAsprintf(&devName, "%.4x:%.2x:%.2x.%.1x", addr->domain, + addr->bus, addr->slot, addr->function) < 0) { + virReportOOMError(); + goto cleanup; + } + + if (virPCIFile(&devPath, devName, "iommu_group") < 0) + goto cleanup; + if (virFileIsLink(devPath) != 1) { + ret = -2; + goto cleanup; + } + if (virFileResolveLink(devPath, &groupPath) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Unable to resolve device %s iommu_group symlink %s"), + devName, devPath); + goto cleanup; + } + + groupNumStr = last_component(groupPath); + if (virStrToLong_ui(groupNumStr, NULL, 10, &groupNum) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("device %s iommu_group symlink %s has " + "invalid group number %s"), + devName, groupPath, groupNumStr); + ret = -1; + goto cleanup; + } + + ret = groupNum; +cleanup: + VIR_FREE(devName); + VIR_FREE(devPath); + VIR_FREE(groupPath); + return ret; +} + + /* virPCIDeviceGetIOMMUGroupDev - return the name of the device used * to control this PCI device's group (e.g. "/dev/vfio/15") */ diff --git a/src/util/virpci.h b/src/util/virpci.h index b56b89b..0aa6fee 100644 --- a/src/util/virpci.h +++ b/src/util/virpci.h @@ -113,12 +113,21 @@ int virPCIDeviceListFindIndex(virPCIDeviceListPtr list, */ typedef int (*virPCIDeviceFileActor)(virPCIDevicePtr dev, const char *path, void *opaque); - int virPCIDeviceFileIterate(virPCIDevicePtr dev, virPCIDeviceFileActor actor, void *opaque); -char * -virPCIDeviceGetIOMMUGroupDev(virPCIDevicePtr dev); + +typedef int (*virPCIDeviceAddressActor)(virPCIDeviceAddress *addr, + void *opaque); +int virPCIDeviceAddressIOMMUGroupIterate(virPCIDeviceAddressPtr orig, + virPCIDeviceAddressActor actor, + void *opaque); +virPCIDeviceListPtr virPCIDeviceGetIOMMUGroupList(virPCIDevicePtr dev); +int virPCIDeviceAddressGetIOMMUGroupAddresses(virPCIDeviceAddressPtr devAddr, + virPCIDeviceAddressPtr **iommuGroupDevices, + size_t *nIommuGroupDevices); +int virPCIDeviceAddressGetIOMMUGroupNum(virPCIDeviceAddressPtr dev); +char *virPCIDeviceGetIOMMUGroupDev(virPCIDevicePtr dev); int virPCIDeviceIsAssignable(virPCIDevicePtr dev, int strict_acs_check); -- 1.7.11.7

2 1

[libvirt] RFC: Improving unit test coverage
by Daniel P. Berrange 26 Jun '13

26 Jun '13

Over the many years that libvirt has been in existance, we have developed a huge number of features, and rate of change in the codebase shows no sign of slowing down. Unfortunately the rate of regressions and/or new bugs also shows no sign of decreasing. As libvirt is used ever more widely, poor quality releases are having an increasingly serious negative impact on the impressions of libvirt by downstream consumers. In addition the introduction of the new access control facilities will have the unfortunate side-effect of increasing the severity of many bugs. Historically a read-write connection to libvirtd could be considered to be equivalent to root, so a bug affecting an authenticated user would not be considered a privilege escalation, merely denial-of-service. With the introduction of access control, a read-write connection to libvirtd may have substantially fewer privileges than root. The result is that many (arguably all) crasher bugs in libvirtd which were previously considered mere denial of service issues, and not worthy of security alerts, will now be classed as potential privilege escalation flaws. It is clear that the current rate of defects in libvirt code is no longer tenable / acceptable. There are a number of test suites which are targetting libvirt, but this document will focus on the unit testing framework, rather than the integration test harnesses. The rationale for this is - Unit tests are run by all developers daily via 'make check' - Unit tests gate the release process - Unit tests are run every time any RPM is built - Unit tests do not have an dependancy on external system infrastructure / setup - Unit tests are directly synchronized with the code commits since they're in the same GIT repo Unit testing techniques ======================= One of the challenges of unit testing is how to isolate the test suite from the broader environment of the machine being used for development. For example, the test suite must not rely on information located in the filesystem outside the source treee (eg it must not touch /proc or /sys). In addition it must be careful not to negatively impact anything running on the developers' machine (eg it must not spawn libvirtd in a way which would clash with existing running libvirtd) There is no silver bullet to achieve isolation of the test suite from the host OS environment. Instead a variety of different techniques must be applied depending on the scenario to be addressed. Code structure -------------- First, and foremost, code structure has an enourmous impact on the ability to unit test code. Ensuring there are clear boundaries & interfaces between different areas of cdoe is key to allowing pieces to be unit tested in isolation from each other. For example, testing of the QEMU command line generator, can only be achieved because this code for converting from XML to ARGV has been isolated from the code which actually starts up the QEMU process. While some areas of libvirt code are very well modularized, others are not. When writing new unit tests it is not at all unexpected to have to re-factor existing code to further modularize it. Such refactoring is usually good for overall readability of the code, as well as facilitating testing. Intermediate data forms ----------------------- As hinted at above, a key idea when refactoring code to make it more amenable to testing is to introduce an intermediate data form. For example, when generating the QEMU command line arguments from an XML document, the virCommandPtr object serves as the intermediate data form. Instead of having the API which builds the command line, directly execute the QEMU binary, it spits out a virCommandPtr object as an intermediate data form. The contents of this object can then be validated against pre-defined expected command lines. As a counter-example, the network filter code is very hard to unit test as it is currently designed because it does not have any intermediate data form. The methods which process the network filter configuration build up command lines and then directly execute them as they go. There is no way to extract the command line data, without them being executed. To enable unit testing it is neccessary to refactor the network filter code to introduce a clear intermediate data form which can represent the commands that will be executed. Static analysis --------------- While the elephant in the room is Coverity, there is a large amount of static analysis that can be done directly in the libvirt source tree. Indeed all of the 'syntax-check' rules are considered to be static analysis. While these rules all focus on style issues, there is no reason why this should be the case. What makes static analysis tools like Coverity so hard to write is the problem of understanding the semantics of C code. Fortunately, when doing static analysis of a specific project (like libvirt), there is often no need to solve the general case. If there are certain style patterns used in a project, these can make it possible to write project specific analysis rules with little more than a few regular expressions or other simple scripting statements. For example, the two style checks 'src/check-drivername.pl' 'src/check-driverimpls.pl' enforce a consistent naming convention on each internal driver method. With this naming pattern enforced, it is now possible to write a script which validates that every driver method includes a call to the correct access control hook. This is project-specific static analysis that could not be done with Coverity. For more advanced problems it is possible to make use of a framework such as CIL to perform static analysis. CIL is an OCaml project which can parse most C code providing an in-memory representation of its structure. Then it has a number of modules to perform data flow analysis on the code. Combined with knowledge of project coding patterns this tool allows the creation of scripts to validate mutex lock acquisition ordering rules, or correct error reporting on all error exit paths. Monkey patching / Duck Punching ------------------------------- One of the pain-points with a project such as libvirt is finding a way to test parts of the code which rely on external system state, such as /proc, or /sys filesystem data. It is not always possible to refactor the code to test it in isolation from the system services. In such cases, the technique of monkey patching or duck punching (better known from the world of scripting languages) can in fact be used from C. The idea behind the technique is to replace the APIs / objects that are used by the test suite, with set of "mock" objects or API implementations which simulate their operation, without relying on external state. The trick to applying this technique in the C world with native code, is to rely on the use of the dynamic linkers' library preload facility, via the LD_PRELOAD. Any symbol exported by a library listed in the LD_PRELOAD env variable, will override symbols with the same name in the library that the test suite is actually linked to. So, for example, if the preloaded library exports an 'open' symbol, this will replace the 'open' symbol exported by the standard C library. To use this technique it is neccessary to first understand what interfaces need to be replaced. If attempting to test some code which uses files in some location under /sys/, one might change the implementation of 'open', so that when passed a filename starting with '/sys', it will re-write the path to point to a location under the test suite directory. This technique is used in the vircgrouptest.c / vircgroupmock.c files to allow comprehensive testing of libvirt's cgroup management code, without actually ever touching the cgroup filesystem. It is also used by the securityselinuxtest.c / securityselinuxhelper.c files to stub out the sys calls which write SELinux attributes. Fuzz testing ------------ This refers to the technique of taking an API or interface and giving it some data which has some intentionale inaccuracies or edge cases. For example, a API accepting a 'const char *str' might be given a NULL string, or a zero length string, or a string containing non-printable control characters. An API accepting an 'int' might be tested with various boundary conditions such as -1, 0, -MAX_INT, +MAX_INT. In the case of an XML document, one technique would be to incrementally remove attributes and/or elements to see if the parser will ever crash on a NULL pointer (it should either succeed or return a error, never crash). Or alternatively change the values in various attributes as one would with parameters passed to an API. If an attribute appears to be a number, then replace it with a string. If an attribute appears to be an enum, replace it with some bogus value. Try zero length strings for various attributes, or again try non-printable control characters. In the case of an RPC protocol, the idea would be to make (intelligent) changes to packets in an attempt to trick the server into accepting bad data, or even crashing. It is not practical to test all possible wierd data sets, so the trick with fuzz testing is to try to intelligently tailor the data to the interface being tested. eg if a string parameter represents a file path, there's no point just randomly changing characters in the path, since that'll just generate loads of other valid file paths. Instead it is neccessary to make some more planned changes like removing the leading '/' to produce a relative path, inserting a number of '../../../' dirs to trick the application into writing to the incorrect location, and things of that nature. For any moderately complex parser, intelligently designed fuzz testing is likely to identify a wide range of bugs. Error testing ------------- Validating correct operation is great, but there is plenty of code which lives in error handling code paths, which will never be exercised this way. Since they are seldom run, and by their nature deal with unexpected data or events, the error paths are often a good source of bugs. The fuzz testing technique is one very effective way of exercising error handling paths, but should not be considered the only possible one. The monkey patching techniques can also be applied to the task of error checking. Alternatively the code structure may facilitate the injection of error conditions in a well defined manner. For example, all libvirt memory allocation goes via a wrapper API, instead of to malloc() directly. It is possible to tell the wrapper API to fail specific allocation attempts. By running the test suite repeatedly, failing a different memory allocation each time, it is possible to exhaustively test error handling of the tested code. Areas requiring testing ======================= The best way to identify areas lacking code coverage is to simply pick a random libvirt source code file. The odds are that it has insufficient testing. The more optimistic way is to look at the code coverage reports. Run 'autogen.sh' with the --enable-test-coverage arg. Then build it and run 'make check'. Once the tests have completed, then run 'make cov' to generate an HTML code coverage report. Some known areas needing work are: Cgroups setup for QEMU ---------------------- For a given QEMU guest XML configuration there is a well defined set of cgroups parameters that are expected to be set. The vircgroupmock.c file demonstrates how to monkey patch the cgroups filesystem, allowing unit tests to be written. The vircgroupmock.c helper could be reused to create a test suite for validating the operation of the qemu_cgroups.c APIs. Cgroups setup for LXC ---------------------- The same as the QEMU test, but for the lxc_cgroups.c file. SELinux security driver labelling --------------------------------- For a given XML configuration, there is a well defined set of file labels that the SELinux security driver must apply to the filesystem on VM startup. The securityselinuxhelper.c file demonstrates how to monkey patch the SELinux library file labelling APIs from unit tests. Currently the securityselinuxlabeltest.c test suite does checks for labels set on disks and serial devices. There are many other aspects of domain XML that imply labelling. In particular PCI/USB host devices & kernel/initrd boot images. It is also neccessary to deal with backing files for qcow2 format disks. Audit messages -------------- Upon QEMU or LXC guest startup a number of audit records must be logged detailing various pieces of metadata about the guest. By monkey patching the audit_log_user_message() and audit_open() library APIs with an LD_PRELOAD library, it would be possible to perform unit testsing of the domain_audit.c APIs to ensure that correct audit records are logged for various different guest configurations. Network filter -------------- As described earlier, the network filter code is really badly designed from the point of view of unit testing. It needs to be refactored to have an intermediate data form that represents the list of iptables/ebtables rules that are expected for a given XML configuration. Currently it generates shell scripts containing iptables commands, optionally re-directing via the 'firewall-cmd' program for integration with firewalld. Refactoring to unit test this offers a prime opportunity to remove the use of shell entirely The core observation of the nwfilter code is that it consists of lists of commands to be run to create ebtables/iptables rules. Periodically there are commands which are able to rollback the state changes made by earlier commands when an error occurs. The idea for the intermediate data form would thus be to introduce the concept of a "script" object, as a higher level interface than that offered by virCommandPtr. A script would comprise one or more sets of command lines for making changes. At various points it would be possible to add a checkpoint marker, together with one or more sets of command lines that would be execute when errors occur which require rollback. The network filter code would thus output "script" objects whose command sets could be validated by a unit test suite. These script objects can then be translated into virCommandPtr objects for actual execution by separate code. Or even translated into DBus API calls for direct communication with firewalld, bypassing the inefficient firewall-cmd program. The unit test would consist of XML data files with network filter configuration rules, alongside expected script command lines, similar to how the qemu xml -> argv test works. virsh testing ------------- The virsh command has rarely had any serious direct testing of its own. Its code is mostly exercised indirectly by test suites doing testing of QEMU or other drivers. Libvirt has a hypervisor driver that is explicit targetted to testing tools like virsh - the "test" driver. This is a 100% in-memory driver that stubs out all the libvirt APIs with semi-serious semantics. It is used to do automated testing of large parts of virt-install and virt-manager. It can be used to get near 100% testing coverage of the virsh command from within unit tests. Since it is all in-memory there is no scope for it to be affected the host system state. libvirtd testing ---------------- Testing libvirtd is a tricky proposition, because merely starting the daemon will have an effect on host OS state, particularly if any resources are set to autostart. It can also clash with any libvirtd process the developer is already running. The test driver is able to be run inside libvirtd. If it were possible to disable all the other hypervisor drivers in libvirtd, the test driver could be used to execise the RPC dispatch code in libvirtd in a safe contained manner. This could be particularly good for doing scalability testing of libvirtd when large numbers of objects. eg since the test driver doesn't actually run anything, it is possible to start many 1000's of "test" guests with the only memory overhead being that of the parsed XML configuration. This would allow the test suite to identify & validate limits in the RPC protocol or inefficiencies in libvirtd. lock driver client ------------------ The virtlockd client code recently had a bug where it generated invalid RPC packets in response to certain operations. It is not desirable to have the unit tests actually run the full virtlockd daemon, just to validate the client code. It would, however, be possible to have a unit test which provided a fake virtlockd UNIX domain socket for the client to connect to. It would blindly read any data off the socket & validate it against pre-defined RPC packets. This approach is already used with some success in the QEMU JSON monitor test suite. QEMU disk snapshots ------------------- The QEMU snapshot code is some of the most complex code in the QEMU driver. As such it would be desirable to get test coverage of it. The easiest way todo this would be via the libvirt TCK integration test harness. There is, however, value in refactoring some of the code to allow its testing in a unit test environment. One approach would be for the test suite to directly invoke methods in the qemu driver dispatch table. This would require refactoring the qemuStateInitialize code though, to make it possible to setup the basic QEMU driver global state. More desirable would be to refactor the snapshot code so that it was more detached from the public driver APIs. For example if some of it could be isolated in a qemu_snapshot.c file, this may make it practical to unit test some of it. Techniques from the qemumonitorjsontest.c file could be used to stub out the monitor APIs that the snapshot code requires in order to operate. QEMU driver startup ------------------- An important aspect of the QEMU driver is that it is able to reconnect to existing domains when it starts up. It would be desirable to unit test this functionality to validate the sequence of operations done when reconnecting to a guest. Again this would require some refactoring of the qemuStateInitialize method to allow its execution in a test suite. It would also likely require the techniques for stubing the QEMU monitor APIs. XML parser/formatter reliability -------------------------------- While we have good testing of valid XML documents, there have been a number of cases where invalid XML documents have caused crashes or other bad behaviour. It is not reasonable to add test cases for every possible invalid XML document. Instead we need to adopt a fuzzing approach, where we take valid XML documents and then make incremental changes to them & then ensure that the code does not crash. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|

2 1

[libvirt] [PATCH v4] qemu: Implement CPUs check against machine type's cpu-max
by Michal Novotny 26 Jun '13

26 Jun '13

Implement check whether (maximum) vCPUs doesn't exceed machine type's cpu-max settings. Differences between v3 and v4 (this one): - Rebased to latest libvirt version - Capability XML output extended by maxCpus field - Extended caps-qemu-kvm.xml test by maxCpus for one of test emulators On older versions of QEMU the check is disabled. Signed-off-by: Michal Novotny <minovotn(a)redhat.com> --- docs/schemas/capability.rng | 5 ++++ src/conf/capabilities.c | 4 +++ src/conf/capabilities.h | 1 + src/qemu/qemu_capabilities.c | 41 +++++++++++++++++++++++++++- src/qemu/qemu_capabilities.h | 3 +- src/qemu/qemu_monitor.h | 1 + src/qemu/qemu_monitor_json.c | 6 ++++ src/qemu/qemu_process.c | 27 ++++++++++++++++++ tests/capabilityschemadata/caps-qemu-kvm.xml | 16 +++++------ 9 files changed, 94 insertions(+), 10 deletions(-) diff --git a/docs/schemas/capability.rng b/docs/schemas/capability.rng index 106ca73..65c7c72 100644 --- a/docs/schemas/capability.rng +++ b/docs/schemas/capability.rng @@ -290,6 +290,11 @@ <text/> </attribute> </optional> + <optional> + <attribute name='maxCpus'> + <ref name='unsignedInt'/> + </attribute> + </optional> <text/> </element> </define> diff --git a/src/conf/capabilities.c b/src/conf/capabilities.c index da92c78..5aeb2ab 100644 --- a/src/conf/capabilities.c +++ b/src/conf/capabilities.c @@ -853,6 +853,8 @@ virCapabilitiesFormatXML(virCapsPtr caps) virBufferAddLit(&xml, " <machine"); if (machine->canonical) virBufferAsprintf(&xml, " canonical='%s'", machine->canonical); + if (machine->maxCpus > 0) + virBufferAsprintf(&xml, " maxCpus='%d'", machine->maxCpus); virBufferAsprintf(&xml, ">%s</machine>\n", machine->name); } @@ -871,6 +873,8 @@ virCapabilitiesFormatXML(virCapsPtr caps) virBufferAddLit(&xml, " <machine"); if (machine->canonical) virBufferAsprintf(&xml, " canonical='%s'", machine->canonical); + if (machine->maxCpus > 0) + virBufferAsprintf(&xml, " maxCpus='%d'", machine->maxCpus); virBufferAsprintf(&xml, ">%s</machine>\n", machine->name); } virBufferAddLit(&xml, " </domain>\n"); diff --git a/src/conf/capabilities.h b/src/conf/capabilities.h index abcf6de..22b6fb6 100644 --- a/src/conf/capabilities.h +++ b/src/conf/capabilities.h @@ -46,6 +46,7 @@ typedef virCapsGuestMachine *virCapsGuestMachinePtr; struct _virCapsGuestMachine { char *name; char *canonical; + int maxCpus; }; typedef struct _virCapsGuestDomainInfo virCapsGuestDomainInfo; diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index c4e076a..89f41b8 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -256,6 +256,7 @@ struct _virQEMUCaps { size_t nmachineTypes; char **machineTypes; char **machineAliases; + int *machineMaxCpus; }; struct _virQEMUCapsCache { @@ -335,6 +336,7 @@ virQEMUCapsSetDefaultMachine(virQEMUCapsPtr qemuCaps, { char *name = qemuCaps->machineTypes[defIdx]; char *alias = qemuCaps->machineAliases[defIdx]; + int cpu_max = qemuCaps->machineMaxCpus[defIdx]; memmove(qemuCaps->machineTypes + 1, qemuCaps->machineTypes, @@ -342,8 +344,12 @@ virQEMUCapsSetDefaultMachine(virQEMUCapsPtr qemuCaps, memmove(qemuCaps->machineAliases + 1, qemuCaps->machineAliases, sizeof(qemuCaps->machineAliases[0]) * defIdx); + memmove(qemuCaps->machineMaxCpus + 1, + qemuCaps->machineMaxCpus, + sizeof(qemuCaps->machineMaxCpus[0]) * defIdx); qemuCaps->machineTypes[0] = name; qemuCaps->machineAliases[0] = alias; + qemuCaps->machineMaxCpus[0] = cpu_max; } /* Format is: @@ -390,7 +396,8 @@ virQEMUCapsParseMachineTypesStr(const char *output, } if (VIR_REALLOC_N(qemuCaps->machineTypes, qemuCaps->nmachineTypes + 1) < 0 || - VIR_REALLOC_N(qemuCaps->machineAliases, qemuCaps->nmachineTypes + 1) < 0) { + VIR_REALLOC_N(qemuCaps->machineAliases, qemuCaps->nmachineTypes + 1) < 0 || + VIR_REALLOC_N(qemuCaps->machineMaxCpus, qemuCaps->nmachineTypes + 1) < 0) { VIR_FREE(name); VIR_FREE(canonical); virReportOOMError(); @@ -404,6 +411,8 @@ virQEMUCapsParseMachineTypesStr(const char *output, qemuCaps->machineTypes[qemuCaps->nmachineTypes-1] = name; qemuCaps->machineAliases[qemuCaps->nmachineTypes-1] = NULL; } + /* Value 0 means "unknown" as it's not exposed by QEMU binary */ + qemuCaps->machineMaxCpus[qemuCaps->nmachineTypes-1] = 0; } while ((p = next)); @@ -1764,11 +1773,14 @@ virQEMUCapsPtr virQEMUCapsNewCopy(virQEMUCapsPtr qemuCaps) goto no_memory; if (VIR_ALLOC_N(ret->machineAliases, qemuCaps->nmachineTypes) < 0) goto no_memory; + if (VIR_ALLOC_N(ret->machineMaxCpus, qemuCaps->nmachineTypes) < 0) + goto no_memory; ret->nmachineTypes = qemuCaps->nmachineTypes; for (i = 0; i < qemuCaps->nmachineTypes; i++) { if (VIR_STRDUP(ret->machineTypes[i], qemuCaps->machineTypes[i]) < 0 || VIR_STRDUP(ret->machineAliases[i], qemuCaps->machineAliases[i]) < 0) goto error; + ret->machineMaxCpus[i] = qemuCaps->machineMaxCpus[i]; } return ret; @@ -1789,9 +1801,11 @@ void virQEMUCapsDispose(void *obj) for (i = 0; i < qemuCaps->nmachineTypes; i++) { VIR_FREE(qemuCaps->machineTypes[i]); VIR_FREE(qemuCaps->machineAliases[i]); + qemuCaps->machineMaxCpus[i] = -1; } VIR_FREE(qemuCaps->machineTypes); VIR_FREE(qemuCaps->machineAliases); + VIR_FREE(qemuCaps->machineMaxCpus); for (i = 0; i < qemuCaps->ncpuDefinitions; i++) { VIR_FREE(qemuCaps->cpuDefinitions[i]); @@ -1932,6 +1946,7 @@ int virQEMUCapsGetMachineTypesCaps(virQEMUCapsPtr qemuCaps, if (VIR_STRDUP(mach->name, qemuCaps->machineTypes[i]) < 0) goto error; } + mach->maxCpus = qemuCaps->machineMaxCpus[i]; (*machines)[i] = mach; } @@ -1966,6 +1981,25 @@ const char *virQEMUCapsGetCanonicalMachine(virQEMUCapsPtr qemuCaps, } +int virQEMUCapsGetMachineMaxCpus(virQEMUCapsPtr qemuCaps, + const char *name) +{ + size_t i; + + if (!name) + return 0; + + for (i = 0; i < qemuCaps->nmachineTypes; i++) { + if (!qemuCaps->machineMaxCpus[i]) + continue; + if (STREQ(qemuCaps->machineTypes[i], name)) + return qemuCaps->machineMaxCpus[i]; + } + + return 0; +} + + static int virQEMUCapsProbeQMPCommands(virQEMUCapsPtr qemuCaps, qemuMonitorPtr mon) @@ -2083,6 +2117,10 @@ virQEMUCapsProbeQMPMachineTypes(virQEMUCapsPtr qemuCaps, virReportOOMError(); goto cleanup; } + if (VIR_ALLOC_N(qemuCaps->machineMaxCpus, nmachines) < 0) { + virReportOOMError(); + goto cleanup; + } for (i = 0; i < nmachines; i++) { if (VIR_STRDUP(qemuCaps->machineAliases[i], machines[i]->alias) < 0 || @@ -2090,6 +2128,7 @@ virQEMUCapsProbeQMPMachineTypes(virQEMUCapsPtr qemuCaps, goto cleanup; if (machines[i]->isDefault) defIdx = i; + qemuCaps->machineMaxCpus[i] = machines[i]->cpu_max; } qemuCaps->nmachineTypes = nmachines; diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 64a4b1d..7088747 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -234,7 +234,8 @@ size_t virQEMUCapsGetMachineTypes(virQEMUCapsPtr qemuCaps, char ***names); const char *virQEMUCapsGetCanonicalMachine(virQEMUCapsPtr qemuCaps, const char *name); - +int virQEMUCapsGetMachineMaxCpus(virQEMUCapsPtr qemuCaps, + const char *name); int virQEMUCapsGetMachineTypesCaps(virQEMUCapsPtr qemuCaps, size_t *nmachines, virCapsGuestMachinePtr **machines); diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h index 3d9afa3..06ae4c5 100644 --- a/src/qemu/qemu_monitor.h +++ b/src/qemu/qemu_monitor.h @@ -654,6 +654,7 @@ struct _qemuMonitorMachineInfo { char *name; bool isDefault; char *alias; + int cpu_max; }; int qemuMonitorGetMachines(qemuMonitorPtr mon, diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index 88a0dc9..1362acf 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -4042,6 +4042,12 @@ int qemuMonitorJSONGetMachines(qemuMonitorPtr mon, if (VIR_STRDUP(info->alias, tmp) < 0) goto cleanup; } + if (virJSONValueObjectHasKey(child, "cpu-max") && + virJSONValueObjectGetNumberInt(child, "cpu-max", &info->cpu_max) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("query-machines reply has malformed 'cpu-max' data")); + goto cleanup; + } } ret = n; diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 5a0f18b..3146ce2 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -3330,6 +3330,30 @@ error: } +static bool +qemuValidateCpuMax(virDomainDefPtr def, virQEMUCapsPtr qemuCaps) +{ + int cpu_max; + + cpu_max = virQEMUCapsGetMachineMaxCpus(qemuCaps, def->os.machine); + if (!cpu_max) + return true; + + if (def->vcpus > cpu_max) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + "%s", _("CPUs greater than specified machine type limit")); + return false; + } + + if (def->maxvcpus > cpu_max) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + "%s", _("Maximum CPUs greater than specified machine type limit")); + return false; + } + + return true; +} + int qemuProcessStart(virConnectPtr conn, virQEMUDriverPtr driver, virDomainObjPtr vm, @@ -3519,6 +3543,9 @@ int qemuProcessStart(virConnectPtr conn, vm->def->emulator))) goto cleanup; + if (!qemuValidateCpuMax(vm->def, priv->qemuCaps)) + goto cleanup; + if (qemuAssignDeviceAliases(vm->def, priv->qemuCaps) < 0) goto cleanup; diff --git a/tests/capabilityschemadata/caps-qemu-kvm.xml b/tests/capabilityschemadata/caps-qemu-kvm.xml index 36c4b49..1fbc22b 100644 --- a/tests/capabilityschemadata/caps-qemu-kvm.xml +++ b/tests/capabilityschemadata/caps-qemu-kvm.xml @@ -33,18 +33,18 @@ <arch name='i686'> <wordsize>32</wordsize> <emulator>/usr/bin/qemu</emulator> - <machine>pc-0.11</machine> - <machine canonical='pc-0.11'>pc</machine> - <machine>pc-0.10</machine> - <machine>isapc</machine> + <machine maxCpus='255'>pc-0.11</machine> + <machine canonical='pc-0.11' maxCpus='255'>pc</machine> + <machine maxCpus='255'>pc-0.10</machine> + <machine maxCpus='1'>isapc</machine> <domain type='qemu'> </domain> <domain type='kvm'> <emulator>/usr/bin/qemu-kvm</emulator> - <machine>pc-0.11</machine> - <machine canonical='pc-0.11'>pc</machine> - <machine>pc-0.10</machine> - <machine>isapc</machine> + <machine maxCpus='255'>pc-0.11</machine> + <machine canonical='pc-0.11' maxCpus='255'>pc</machine> + <machine maxCpus='255'>pc-0.10</machine> + <machine maxCpus='1'>isapc</machine> </domain> </arch> <features> -- 1.7.11.7

2 5

[libvirt] [PATCH] Plug leak in virCgroupMoveTask
by Ján Tomko 26 Jun '13

26 Jun '13

We only break out of the while loop if *content is an empty string. However the buffer has been allocated to BUFSIZ + 1 (8193 in my case), but it gets overwritten in the next for iteration. Move VIR_FREE right before we overwrite it to avoid the leak. ==5777== 16,386 bytes in 2 blocks are definitely lost in loss record 1,022 of 1,027 ==5777== by 0x5296E28: virReallocN (viralloc.c:184) ==5777== by 0x52B0C66: virFileReadLimFD (virfile.c:1137) ==5777== by 0x52B0E1A: virFileReadAll (virfile.c:1199) ==5777== by 0x529B092: virCgroupGetValueStr (vircgroup.c:534) ==5777== by 0x529AF64: virCgroupMoveTask (vircgroup.c:1079) Introduced by 83e4c77. https://bugzilla.redhat.com/show_bug.cgi?id=978352 --- src/util/vircgroup.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c index 0484c71..5e75355 100644 --- a/src/util/vircgroup.c +++ b/src/util/vircgroup.c @@ -1076,6 +1076,7 @@ int virCgroupMoveTask(virCgroupPtr src_group, virCgroupPtr dest_group) * aware that it needs to move. Therefore, we must iterate * until content is empty. */ while (1) { + VIR_FREE(content); rc = virCgroupGetValueStr(src_group, i, "tasks", &content); if (rc != 0) return rc; @@ -1085,8 +1086,6 @@ int virCgroupMoveTask(virCgroupPtr src_group, virCgroupPtr dest_group) rc = virCgroupAddTaskStrController(dest_group, content, i); if (rc != 0) goto cleanup; - - VIR_FREE(content); } } -- 1.8.1.5

2 2

[libvirt] [PATCH] Fix invalid read in virCgroupGetValueStr
by Ján Tomko 26 Jun '13

26 Jun '13

Don't check for '\n' at the end of file if zero bytes were read. Found by valgrind: ==404== Invalid read of size 1 ==404== at 0x529B09F: virCgroupGetValueStr (vircgroup.c:540) ==404== by 0x529AF64: virCgroupMoveTask (vircgroup.c:1079) ==404== by 0x1EB475: qemuSetupCgroupForEmulator (qemu_cgroup.c:1061) ==404== by 0x1D9489: qemuProcessStart (qemu_process.c:3801) ==404== by 0x18557E: qemuDomainObjStart (qemu_driver.c:5787) ==404== by 0x190FA4: qemuDomainCreateWithFlags (qemu_driver.c:5839) Introduced by 0d0b409. https://bugzilla.redhat.com/show_bug.cgi?id=978356 --- src/util/vircgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c index 0484c71..a0ee3f7 100644 --- a/src/util/vircgroup.c +++ b/src/util/vircgroup.c @@ -537,7 +537,7 @@ static int virCgroupGetValueStr(virCgroupPtr group, VIR_DEBUG("Failed to read %s: %m\n", keypath); } else { /* Terminated with '\n' has sometimes harmful effects to the caller */ - if ((*value)[rc - 1] == '\n') + if (rc > 0 && (*value)[rc - 1] == '\n') (*value)[rc - 1] = '\0'; rc = 0; -- 1.8.1.5

2 2

[libvirt] [PATCH] [docs] Fix sample TPM XML
by Stefan Berger 26 Jun '13

26 Jun '13

Fix an error in the sample TPM XML. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- docs/formatdomain.html.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: libvirt-acl/docs/formatdomain.html.in =================================================================== --- libvirt-acl.orig/docs/formatdomain.html.in +++ libvirt-acl/docs/formatdomain.html.in @@ -4735,7 +4735,7 @@ qemu-kvm -net nic,model=? /dev/null <devices> <tpm model='tpm-tis'> <backend type='passthrough'> - <backend path='/dev/tpm0'/> + <device path='/dev/tpm0'/> </backend> </tpm> </devices>

2 3