- Devel - libvirt List Archives

[libvirt] [PATCH] conf: fix virDomainLeaseIndex cannot work when both parameter have lockspaces present
by Luyao Huang 15 Dec '14

15 Dec '14

https://bugzilla.redhat.com/show_bug.cgi?id=1174096 When both parameter have lockspaces present, virDomainLeaseIndex will always -1 even there is a lease the same with the one we check. I think we shouldn't do 'continue' when the two lockspaces are the same. Signed-off-by: Luyao Huang <lhuang(a)redhat.com> --- src/conf/domain_conf.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 5cf0b1a..f36affc 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -11667,13 +11667,14 @@ int virDomainLeaseIndex(virDomainDefPtr def, for (i = 0; i < def->nleases; i++) { vlease = def->leases[i]; - /* Either both must have lockspaces present which match.. */ - if (vlease->lockspace && lease->lockspace && - STRNEQ(vlease->lockspace, lease->lockspace)) - continue; + /* Either both must have lockspaces present which match.. */ + if (vlease->lockspace && lease->lockspace) { + if (STRNEQ(vlease->lockspace, lease->lockspace)) + continue; /* ...or neither must have a lockspace present */ - if (vlease->lockspace || lease->lockspace) + } else if (vlease->lockspace || lease->lockspace) continue; + if (STREQ(vlease->key, lease->key)) return i; } -- 1.8.3.1

2 2

[libvirt] [PATCH] xenconfig: fix boot device parsing
by Wei Liu 15 Dec '14

15 Dec '14

The original code always checked *boot which was in effect boot[0]. It should use boot[i]. Signed-off-by: Wei Liu <wei.liu2(a)citrix.com> --- src/xenconfig/xen_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/xenconfig/xen_common.c b/src/xenconfig/xen_common.c index 7f4ec89..48431a7 100644 --- a/src/xenconfig/xen_common.c +++ b/src/xenconfig/xen_common.c @@ -1071,7 +1071,7 @@ xenParseOS(virConfPtr conf, virDomainDefPtr def) return -1; for (i = 0; i < VIR_DOMAIN_BOOT_LAST && boot[i]; i++) { - switch (*boot) { + switch (boot[i]) { case 'a': def->os.bootDevs[i] = VIR_DOMAIN_BOOT_FLOPPY; break; -- 1.7.10.4

3 2

[libvirt] [PATCH] conf: fix crash when match a network iscsi hostdev with a host iscsi hostdev
by Luyao Huang 15 Dec '14

15 Dec '14

https://bugzilla.redhat.com/show_bug.cgi?id=1174053 When we use attach-device to coldplug a network iscsi hostdev, libvirt will check if there is already a device in XML. But if the 'b' is a host iscsi hostdev and 'a' is a network iscsi hostdev , libvirtd will crash in virDomainHostdevMatchSubsysSCSIiSCSI, because 'b' doesn't have a hostname. Add a check in virDomainHostdevMatchSubsys, if the a's protocol and b's protocol is not the same. backtrace like this: 0 0x00007f850d6bc307 in virDomainHostdevMatchSubsysSCSIiSCSI at conf/domain_conf.c:10889 1 virDomainHostdevMatchSubsys at conf/domain_conf.c:10911 2 virDomainHostdevMatch at conf/domain_conf.c:10973 3 virDomainHostdevFind at conf/domain_conf.c:10998 4 0x00007f84f6a10560 in qemuDomainAttachDeviceConfig at qemu/qemu_driver.c:7223 5 qemuDomainAttachDeviceFlags at qemu/qemu_driver.c:7554 Signed-off-by: Luyao Huang <lhuang(a)redhat.com> --- src/conf/domain_conf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 5cf0b1a..eb63c93 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -11184,7 +11184,9 @@ static int virDomainHostdevMatchSubsys(virDomainHostdevDefPtr a, virDomainHostdevDefPtr b) { - if (a->source.subsys.type != b->source.subsys.type) + if (a->source.subsys.type != b->source.subsys.type || + (a->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI && + a->source.subsys.u.scsi.protocol != b->source.subsys.u.scsi.protocol)) return 0; switch (a->source.subsys.type) { -- 1.8.3.1

2 2

[libvirt] [PATCH 01/10] parallels: support NULL virDomainVideoAccelDefPtr
by Dmitry Guryanov 15 Dec '14

15 Dec '14

I support if virDomainVideoAccelDefPtr is NULL it means default values for video acceleration. So we don't need to report error. --- src/parallels/parallels_sdk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/parallels/parallels_sdk.c b/src/parallels/parallels_sdk.c index 0b05bc1..0980f50 100644 --- a/src/parallels/parallels_sdk.c +++ b/src/parallels/parallels_sdk.c @@ -2029,7 +2029,7 @@ static int prlsdkCheckVideoUnsupportedParams(virDomainDefPtr def) return -1; } - if (v->accel == NULL || v->accel->support2d || v->accel->support3d) { + if (v->accel != NULL && (v->accel->support2d || v->accel->support3d)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("Parallels Cloud Server doesn't support " "setting video acceleration parameters.")); -- 2.1.0

1 11

[libvirt] [PATCH] fix typo in sanlock driver s/VIR_CONF_UONG/VIR_CONF_ULONG/
by Daniel P. Berrange 15 Dec '14

15 Dec '14

fix typo introduced in previous commit Pushed as build-breaker fix --- src/locking/lock_driver_sanlock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/locking/lock_driver_sanlock.c b/src/locking/lock_driver_sanlock.c index b24e910..60f305c 100644 --- a/src/locking/lock_driver_sanlock.c +++ b/src/locking/lock_driver_sanlock.c @@ -141,7 +141,7 @@ static int virLockManagerSanlockLoadConfig(const char *configFile) } p = virConfGetValue(conf, "host_id"); - CHECK_TYPE("host_id", VIR_CONF_UONG); + CHECK_TYPE("host_id", VIR_CONF_ULONG); if (p) driver->hostID = p->l; p = virConfGetValue(conf, "require_lease_for_disks"); -- 2.1.0

1 0

[libvirt] [PATCH 0/3] Fix starting/stopping of netdevs when starting/stopping CPUs
by Laine Stump 15 Dec '14

15 Dec '14

The first two patches provide a cleaner, more complete fix to a fix that was recently pushed for https://bugzilla.redhat.com/show_bug.cgi?id=1081461 While the original patch does fix the symptoms in the report, applying these two additional patches handle some situations that weren't addressed by the original. Patch 3 fixes a similar problem with tap devices when the newly added macTableManager='libvirt' is used. It should make migration of guests with this new type of network connection work properly with no loss of network connectivity (including once post-copy migration is working). Laine Stump (3): qemu: always call qemuInterfaceStartDevices() when starting CPUs qemu: add a qemuInterfaceStopDevices(), called when guest CPUs stop qemu: add/remove bridge fdb entries as guest CPUs are started/stopped src/qemu/qemu_command.c | 10 ++---- src/qemu/qemu_hotplug.c | 8 +++++ src/qemu/qemu_interface.c | 92 +++++++++++++++++++++++++++++++++++++++++++++++ src/qemu/qemu_interface.h | 2 ++ src/qemu/qemu_process.c | 7 ++-- 5 files changed, 109 insertions(+), 10 deletions(-) -- 1.9.3

3 6

[libvirt] libseccomp and KVM
by Raymond Durand 14 Dec '14

14 Dec '14

How is libseccomp used/enabled/configured with KVM/QEMU Hypervisor? Does it need a system call profiling per VMs? Regards,

4 8

[libvirt] [PATCHv2] lxc: give RW access to /proc/sys/net/ipv[46] to containers
by Cédric Bosdonnat 13 Dec '14

13 Dec '14

Some programs want to change some values for the network interfaces configuration in /proc/sys/net/ipv[46] folders. Giving RW access on them allows wicked to work on openSUSE 13.2+. In order to mount those folders RW but keep the rest of /proc/sys RO, we add temporary mounts for these folders before bind-mounting /proc/sys. Those mounts will be skipped if the container doesn't have its own network namespace. It may happen that one of the temporary mounts in /proc/ filesystem isn't available due to a missing kernel feature. We need not to fail in that case. --- Diffs to v1: * Only mount the /proc/sys/net/ipv[46] if the container has its own netns * Don't test for the existence of files in /proc before mounting them: they may not be ready when checking. Instead try to mount them and skip them if the source doesn't exist. * Use existing lxcNeedNetworkNamespace to tell lxcContainerMountBasicFS if we have our own netns: at least we now have the proper value. src/lxc/lxc_container.c | 153 ++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 121 insertions(+), 32 deletions(-) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 3b08b86..140d54f 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -800,15 +800,21 @@ typedef struct { int mflags; bool skipUserNS; bool skipUnmounted; + bool skipNoPrivNet; + bool temporary; } virLXCBasicMountInfo; static const virLXCBasicMountInfo lxcBasicMounts[] = { - { "proc", "/proc", "proc", MS_NOSUID|MS_NOEXEC|MS_NODEV, false, false }, - { "/proc/sys", "/proc/sys", NULL, MS_BIND|MS_RDONLY, false, false }, - { "sysfs", "/sys", "sysfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, false, false }, - { "securityfs", "/sys/kernel/security", "securityfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, true, true }, + { "proc", "/proc", "proc", MS_NOSUID|MS_NOEXEC|MS_NODEV, false, false, false, false }, + { "/proc/sys/net/ipv4", "TMP1", NULL, MS_BIND, false, false, true, true }, + { "/proc/sys/net/ipv6", "TMP2", NULL, MS_BIND, false, false, true, true }, + { "/proc/sys", "/proc/sys", NULL, MS_BIND|MS_RDONLY, false, false, false, false }, + { "TMP1", "/proc/sys/net/ipv4", NULL, MS_BIND, false, false, true, false }, + { "TMP2", "/proc/sys/net/ipv6", NULL, MS_BIND, false, false, true, false }, + { "sysfs", "/sys", "sysfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, false, false, false, false }, + { "securityfs", "/sys/kernel/security", "securityfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, true, true, false, false }, #if WITH_SELINUX - { SELINUX_MOUNT, SELINUX_MOUNT, "selinuxfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, true, true }, + { SELINUX_MOUNT, SELINUX_MOUNT, "selinuxfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, true, true, false, false }, #endif }; @@ -885,14 +891,23 @@ static int lxcContainerSetReadOnly(void) static int lxcContainerMountBasicFS(bool userns_enabled, bool netns_disabled) { - size_t i; + size_t i, j; int rc = -1; char* mnt_src = NULL; + char* mnt_dst = NULL; int mnt_mflags; + char **tmpkeys = NULL; + char **tmppaths = NULL; + size_t nmounts = ARRAY_CARDINALITY(lxcBasicMounts); VIR_DEBUG("Mounting basic filesystems"); - for (i = 0; i < ARRAY_CARDINALITY(lxcBasicMounts); i++) { + if (VIR_ALLOC_N(tmpkeys, nmounts) < 0 || + VIR_ALLOC_N(tmppaths, nmounts) < 0) { + goto cleanup; + } + + for (i = 0; i < nmounts; i++) { bool bindOverReadonly; virLXCBasicMountInfo const *mnt = &lxcBasicMounts[i]; @@ -906,11 +921,41 @@ static int lxcContainerMountBasicFS(bool userns_enabled, goto cleanup; mnt_mflags = MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY|MS_BIND; } else { - if (VIR_STRDUP(mnt_src, mnt->src) < 0) + bool foundKey = false; + /* Look for potential temporary folder match */ + for (j = 0; j < i; j++) { + if (STREQ_NULLABLE(mnt->src, tmpkeys[j])) { + /* We found the key without path: skip */ + foundKey = true; + if (tmppaths[j] && VIR_STRDUP(mnt_src, tmppaths[j]) < 0) + goto cleanup; + break; + } + } + if (foundKey && !mnt_src) + continue; + if (!mnt_src && VIR_STRDUP(mnt_src, mnt->src) < 0) goto cleanup; mnt_mflags = mnt->mflags; } + if (mnt->temporary) { + char tmppath[] = "/tmp/mount-XXXXXX"; + if (mkdtemp(tmppath) == NULL) { + virReportSystemError(errno, + _("Failed to create temporary folder %s"), + tmppath); + } + if (VIR_STRDUP(tmppaths[i], tmppath) < 0 || + VIR_STRDUP(tmpkeys[i], mnt->dst) < 0 || + VIR_STRDUP(mnt_dst, tmppath) < 0) { + goto cleanup; + } + } else { + if (VIR_STRDUP(mnt_dst, mnt->dst) < 0) + goto cleanup; + } + VIR_DEBUG("Processing %s -> %s", mnt_src, mnt->dst); @@ -930,6 +975,7 @@ static int lxcContainerMountBasicFS(bool userns_enabled, VIR_DEBUG("Skipping '%s' which isn't mounted in host", mnt->dst); VIR_FREE(mnt_src); + VIR_FREE(mnt_dst); continue; } } @@ -937,13 +983,21 @@ static int lxcContainerMountBasicFS(bool userns_enabled, if (mnt->skipUserNS && userns_enabled) { VIR_DEBUG("Skipping due to user ns enablement"); VIR_FREE(mnt_src); + VIR_FREE(mnt_dst); + continue; + } + + if (mnt->skipNoPrivNet && netns_disabled) { + VIR_DEBUG("Skipping due to absence of network namespace"); + VIR_FREE(mnt_src); + VIR_FREE(mnt_dst); continue; } - if (virFileMakePath(mnt->dst) < 0) { + if (virFileMakePath(mnt_dst) < 0) { virReportSystemError(errno, _("Failed to mkdir %s"), - mnt_src); + mnt_dst); goto cleanup; } @@ -957,32 +1011,67 @@ static int lxcContainerMountBasicFS(bool userns_enabled, bindOverReadonly = !!(mnt_mflags & MS_RDONLY); VIR_DEBUG("Mount %s on %s type=%s flags=%x", - mnt_src, mnt->dst, mnt->type, mnt_mflags & ~MS_RDONLY); - if (mount(mnt_src, mnt->dst, mnt->type, mnt_mflags & ~MS_RDONLY, NULL) < 0) { + mnt_src, mnt_dst, mnt->type, mnt_mflags & ~MS_RDONLY); + if (mount(mnt_src, mnt_dst, mnt->type, mnt_mflags & ~MS_RDONLY, NULL) < 0) { + /* Don't shout if some folder doesn't exist in /proc since they + * can be depending on an unloaded kernel module. */ + if (errno == ENOENT && STRPREFIX(mnt_src, "/proc/")) { + VIR_DEBUG("Skipped: %s doesn't exist", mnt_src); + /* Cleanup the temporary path */ + if (virFileDeleteTree(tmppaths[i]) < 0) + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Failed to remove temporary folder %s"), + tmppaths[i]); + VIR_FREE(tmppaths[i]); + + VIR_FREE(mnt_src); + VIR_FREE(mnt_dst); + continue; + } virReportSystemError(errno, _("Failed to mount %s on %s type %s flags=%x"), - mnt_src, mnt->dst, NULLSTR(mnt->type), + mnt_src, mnt_dst, NULLSTR(mnt->type), mnt_mflags & ~MS_RDONLY); goto cleanup; } if (bindOverReadonly && - mount(mnt_src, mnt->dst, NULL, + mount(mnt_src, mnt_dst, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL) < 0) { virReportSystemError(errno, _("Failed to re-mount %s on %s flags=%x"), - mnt_src, mnt->dst, + mnt_src, mnt_dst, MS_BIND|MS_REMOUNT|MS_RDONLY); goto cleanup; } VIR_FREE(mnt_src); + VIR_FREE(mnt_dst); } rc = 0; cleanup: + /* Cleanup temporary mounts */ + for (i = 0; i < nmounts; i++) { + virLXCBasicMountInfo const *mnt = &lxcBasicMounts[i]; + if (mnt->temporary && tmppaths[i]) { + if (umount(tmppaths[i]) < 0) { + virReportSystemError(errno, + _("Failed to un-mount temporary %s"), + tmppaths[i]); + } + if (virFileDeleteTree(tmppaths[i]) < 0) + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Failed to remove temporary folder %s"), + tmppaths[i]); + } + } + + virStringFreeList(tmpkeys); + virStringFreeList(tmppaths); VIR_FREE(mnt_src); + VIR_FREE(mnt_dst); VIR_DEBUG("rc=%d", rc); return rc; } @@ -1696,6 +1785,22 @@ static int lxcContainerUnmountForSharedRoot(const char *stateDir, return ret; } +static bool +lxcNeedNetworkNamespace(virDomainDefPtr def) +{ + size_t i; + if (def->nets != NULL) + return true; + if (def->features[VIR_DOMAIN_FEATURE_PRIVNET] == VIR_TRISTATE_SWITCH_ON) + return true; + for (i = 0; i < def->nhostdevs; i++) { + if (def->hostdevs[i]->mode == VIR_DOMAIN_HOSTDEV_MODE_CAPABILITIES && + def->hostdevs[i]->source.caps.type == VIR_DOMAIN_HOSTDEV_CAPS_TYPE_NET) + return true; + } + return false; +} + /* Got a FS mapped to /, we're going the pivot_root * approach to do a better-chroot-than-chroot @@ -1741,7 +1846,7 @@ static int lxcContainerSetupPivotRoot(virDomainDefPtr vmDef, /* Mounts the core /proc, /sys, etc filesystems */ if (lxcContainerMountBasicFS(vmDef->idmap.nuidmap, - !vmDef->nnets) < 0) + !lxcNeedNetworkNamespace(vmDef)) < 0) goto cleanup; /* Ensure entire root filesystem (except /.oldroot) is readonly */ @@ -2240,22 +2345,6 @@ virArch lxcContainerGetAlt32bitArch(virArch arch) } -static bool -lxcNeedNetworkNamespace(virDomainDefPtr def) -{ - size_t i; - if (def->nets != NULL) - return true; - if (def->features[VIR_DOMAIN_FEATURE_PRIVNET] == VIR_TRISTATE_SWITCH_ON) - return true; - for (i = 0; i < def->nhostdevs; i++) { - if (def->hostdevs[i]->mode == VIR_DOMAIN_HOSTDEV_MODE_CAPABILITIES && - def->hostdevs[i]->source.caps.type == VIR_DOMAIN_HOSTDEV_CAPS_TYPE_NET) - return true; - } - return false; -} - /** * lxcContainerStart: * @def: pointer to virtual machine structure -- 2.1.2

4 4

[libvirt] Release of libvirt-1.2.11
by Daniel Veillard 13 Dec '14

13 Dec '14

It's out ! Tagged in git and signed tarballs and rpms are available from the usual place: ftp://libvirt.org/libvirt/ I also tagged and pushed a libvirt-python release too, to be found at: ftp://libvirt.org/libvirt/python/ Overall this includes around 350 commits, 2 are security fixes, and this also includes a couple of new generic features. There is of course a number of improvement on various drivers, notably parallels, drvbhyve, linux containers, xen migration, and kvm. This also pack an impressive amount of bug fixes (nearly 100), so I would really suggest to update when possible. Features: - Implement public API for virDomainGetFSInfo (Tomoki Sekiyama) - qemu: Add define for the new throttle options (Matthias Gatto) Security: - CVE-2014-8131: Fix possible deadlock and segfault in qemuConnectGetAllDomainStats() (Martin Kletzander) - CVE-2014-7823: dumpxml: security hole with migratable flag (Eric Blake) Documentation: - virsh.pod: Fix typo (John Ferlan) - Fix typo in path for storage pool (John Ferlan) - Fix missing curly braces (Hao Liu) - Fix simple typo s/ a API/ an API/ (Martin Kletzander) - getstats: improve documentation (Eric Blake) - Use gender-neutral pronoun in hacking.html.in (Christophe Fergeau) - network: fix some trivial typos in docs/formatnetwork.html (Chen Fan) - virsh.pod: Fix the pool-define-as and pool-create-as description (John Ferlan) - Fix a couple of typos on the storage pool html (John Ferlan) - storage: fix rbd pool indentation (Cole Robinson) - Create html documentation even if XHTML1 DTD is not available to validate (Ian Campbell) - More html/docs changes from libvirt.h.in split (John Ferlan) - conf: fix a comment typo in virDomainVideoDefaultRAM (Wang Rui) - Correct invalid hyperlinks (Martin Kletzander) - Fix missing slashes in XML examples (Luyao Huang) - fix simple typo in TPM paragraph (Martin Kletzander) - tests: fix documentation for mocking methods (Martin Kletzander) - virsh: document block.n.allocation stat (Eric Blake) - storage_driver: fix a comment typo (Chen Hanxiao) - domain: Move docs for storage hosts under the <source> element (Peter Krempa) - virsh: sync domdisplay help and manual (Martin Kletzander) - fix a typo in formatdomain.html (Chen Fan) - Remove references to unused libvirt-libvirt.html (Nehal J Wani) - Document NVRAM behavior on transient domains (Michal Privoznik) - Adjust contributor guidelines about curly brackets (Martin Kletzander) - Fix API docs for header file re-organization (Daniel P. Berrange) - fix mismatched ACL attribute name (Luyao Huang) - Add documentation for compat mode. (Prerna Saxena) - examples: add systemtap script to ease lock debugging (Martin Kletzander) Portability: - Fix build on mingw (Ján Tomko) - define NTF_{SELF,MASTER} if undefined (Guido Günther) - build: fix mingw printing of pid (Eric Blake) - build: fix unused variable in mingw (Eric Blake) - libxl: Allow libxl to find pygrub binary. (Ian Campbell) - build: fix build when not using dbus (Eric Blake) - build: avoid 32-bit failure on older gcc (Eric Blake) - build: fix build with older dbus headers (Eric Blake) - maint: use portable shell (Eric Blake) - qemuxml2argvtest: Run some test only on Linux (Michal Privoznik) Bug Fixes: - Avoid getting '-1:-1' in devices cgroup list (Cédric Bosdonnat) - conf: goto error when value of max_sectors is too large (Luyao Huang) - Ignore CPU features without a model for host-passthrough (Ján Tomko) - Do not format CPU features without a model (Ján Tomko) - qemu: bulk stats: Fix logic in monitor handling (Francesco Romani) - dac: Add a new func to get DAC label of a running process (Luyao Huang) - viriscsi: Need to sendtargets on Initiator IQN (John Ferlan) - storage: Check stderr when matching parted output (Hao Liu) - security: Manage SELinux labels on shared/readonly hostdev's (John Ferlan) - tests: Fix sharable typo (John Ferlan) - conf: forbid negative number in address(like controller, bus, slot...) (Luyao Huang) - qemu: migration: Unlock vm on failed ACL check in protocol v2 APIs (Peter Krempa) - network: don't allow multiple dhcp sections (Kyle DeFrancia) - getstats: avoid memory leak on OOM (Eric Blake) - util: check for an illegal character in a XML namespace prefix (Erik Skultety) - qemu: snapshot: Forbid internal snapshot with passthrough devices (Shanzhi Yu) - networkValidate: Disallow bandwidth in portgroups too (Michal Privoznik) - qemu: process: Avoid uninitialized use two vars when reconnecting to vm (Peter Krempa) - Fix handling of whitespae in preprocessor macros for API generator (Daniel P. Berrange) - tests: Fix misplaced parenthesis in qemumonitorjsontest (Martin Kletzander) - qemu: Fix virsh freeze when blockcopy storage file is removed (Erik Skultety) - cpu: fix possible crash in getModels (Pavel Hrdina) - leaseshelper: Skip entries missing expiry time on INIT action (Peter Krempa) - storage: fix crash caused by no check return before set close (Luyao Huang) - virsh: vol-upload disallow negative offset (Shanzhi Yu) - parallels: fix compilation of parallels_storage.c (Dmitry Guryanov) - Generate a MAC when loading a config instead of package update (Ján Tomko) - Silently ignore MAC in NetworkLoadConfig (Ján Tomko) - nwfilter: fix crash when adding non-existing nwfilter (Pavel Hrdina) - Fix race condition in qemuGetProcessInfo (Eduardo Costa) - libxl: Resolve Coverity CHECKED_RETURN (John Ferlan) - domain_conf: Resolve Coverity CHECKED_RETURN (John Ferlan) - virhook: Resolve Coverity NULL_RETURNS (John Ferlan) - hotplug: Resolve Coverity FORWARD_NULL (John Ferlan) - storage: Add mixed fc_host/scsi_host duplicate adapter source checks (John Ferlan) - conf: Add device-related code for panic devices (Martin Kletzander) - conf: Add device-related code for TPM devices (Martin Kletzander) - qemu: fix block{commit,copy} abort handling (Erik Skultety) - qemu: Don't track quiesced state of FSs (Michal Privoznik) - Fix usage of virReportSystemError (Jiri Denemark) - network: Fix upgrade from libvirt older than 1.2.4 (Jiri Denemark) - Resolve build breaker (John Ferlan) - lxc: don't unmount subtree if it contains the source of the mount (Cédric Bosdonnat) - virt-aa-helper wasn't running virErrorInitialize (Cédric Bosdonnat) - storage: qemu: Fix security labelling of new image chain elements (Peter Krempa) - storage: Add thread to refresh for createVport (John Ferlan) - storage: Fix issue finding LU's when block doesn't exist (John Ferlan) - rpc: do not fail if the pid of the connecting process is not set (Giuseppe Scrivano) - util: don't log failure when older iptables lacks -w (Eric Blake) - qemu: Really fix crash in tunnelled migration (Jiri Denemark) - virsh: Fix msg: blockjob is aborted from another client (Erik Skultety) - qemu: Fix crash in tunnelled migration (Jiri Denemark) - vbox: fix a bug in _machineStateInactive (Yohan BELLEGUIC) - qemu: Resolve Coverity UNINIT (John Ferlan) - qemu: Fix get blkiodevtune for a disk that has been hot unplugged (Luyao Huang) - Re-add use of locking with iptables/ip6tables/ebtables (Daniel P. Berrange) - qemu: Don't try to parse -help for new QEMU (Jiri Denemark) - qemu: Always set migration capabilities (Jiri Denemark) - lxc: fix setmem effect on a running LXC machine (Erik Skultety) - nwfilter: fix deadlock caused updating network device and nwfilter (Pavel Hrdina) - qemuPrepareNVRAM: Save domain conf only if domain's persistent (Michal Privoznik) - storage: Introduce 'managed' for the fchost parent (John Ferlan) - storage: Ensure fc_host parent matches wwnn/wwpn (John Ferlan) - storage: Check for valid fc_host parent at startup (John Ferlan) - qemu: Resolve Coverity DEADCODE. (Matthias Gatto) - qemu: Fix copy_paste_error in qemuBuildDriveStr. (Matthias Gatto) - Do not crash on gluster snapshots with no host name (Ján Tomko) - Fix virDomainChrEquals for spicevmc (Ján Tomko) - qemu: fix domain startup failing with 'strict' mode in numatune (Wang Rui) - lxc: don't setup cpuset.mems if memory mode in numatune is not 'strict' (Wang Rui) - qemu: don't setup cpuset.mems if memory mode in numatune is not 'strict' (Wang Rui) - Fix invalid log, misused option types and a typo (Hao Liu) - phyp: Fix NULL dereference in phypConnectOpen (Martin Kletzander) - nodeinfo: report error when failure in nodeSetMemoryParameters (Jincheng Miao) - virnuma: add nodeset NULL check in virNumaSetupMemoryPolicy (Chen Fan) - Fix build-time pkg-config files in VPATH (Jiri Denemark) - qemu: Update fsfreeze status on domain state transitions (Michal Privoznik) - network: fix call virNetworkEventLifecycleNew when networkStartNetwork fail (Luyao Huang) - numa: fix assumption in virNumaNodeIsAvailable() (Martin Kletzander) - Free job statistics from the migration cookie (Ján Tomko) - virsh: Fix types for option bandwidth in block* (Hao Liu) - qemuDomainUpdateDeviceConfig: Allow startupPolicy update (Michal Privoznik) - remote: Fix memory leak in remoteConnectGetAllDomainStats (Peter Krempa) - Require at least one console for LXC domain (Ján Tomko) - Do not probe for power mgmt capabilities in lxc emulator (Ján Tomko) - util: fix releasing pidfile in cleanup (Martin Kletzander) - qemu: stop NBD server after successful migration (Weiwei Li) - qemu: avoid rare race when undefining domain (Martin Kletzander) - qemu: make sure capability probing process can start (Martin Kletzander) - vbox: don't register NULL driver (Martin Kletzander) - qemu: make advice from numad available when building commandline (Martin Kletzander) Improvements: - network: Bring netdevs online later (Matthew Rosato) - lxc: give RW access to /proc/sys/net/ipv[46] to containers (Cédric Bosdonnat) - conf: Ignore device address for guestfwd channel (Martin Kletzander) - maint: clean up the unused variable 'caps' in src/qemu/qemu_*.c (Wang Rui) - parallels: report proper error in Create/Destroy/Suspend e.t.c. (Dmitry Guryanov) - parallels: fix getJobResultHelper (Dmitry Guryanov) - parallels: return PRL_RESULT from waitJob and getJobResult (Dmitry Guryanov) - parallels: implement domainUndefine and domainUndefineFlags (Dmitry Guryanov) - parallels: add cdroms support (Dmitry Guryanov) - parallels: Add domainCreateWithFlags() function. (Alexander Burluka) - parallels: added function virDomainIsActive() (Alexander Burluka) - parallels: refactor parallelsDomainDefineXML (Dmitry Guryanov) - parallels: create VMs and containers with sdk (Dmitry Guryanov) - parallels: rewrite parallelsApplyConfig with SDK (Dmitry Guryanov) - parallels: reimplement functions, which change domain state (Dmitry Guryanov) - parallels: handle events from parallels server (Alexander Burluka) - parallels: move parallelsDomNotFoundError to parallels_utils.h (Dmitry Guryanov) - parallels: get domain info with SDK (Alexander Burluka) - parallels: move IS_CT macro to parallels_utils.h (Dmitry Guryanov) - build: Move check for XML::XPath into bootstrap (Martin Kletzander) - maint: update to latest gnulib (Eric Blake) - lxc: always use virDomainNetGetActualBridgeName to get interface's bridge (Laine Stump) - qemu: always use virDomainNetGetActualBridgeName to get interface's bridge (Laine Stump) - qemu: setup tap devices for macTableManager='libvirt' (Laine Stump) - network: setup bridge devices for macTableManager='libvirt' (Laine Stump) - network: store network macTableManager setting in NetDef actual object (Laine Stump) - network: save bridge name in ActualNetDef when actualType==network too (Laine Stump) - conf: new network bridge device attribute macTableManager (Laine Stump) - util: functions to manage bridge fdb (forwarding database) (Laine Stump) - util: new functions for setting bridge and bridge port attributes (Laine Stump) - getstats: add block.n.path stat (Eric Blake) - getstats: start giving offline block stats (Eric Blake) - rpc: Report proper close reason (Martin Kletzander) - virsh: Don't reconnect after the command when disconnected (Martin Kletzander) - storage: Fix printing/casting of uid_t/gid_t (Peter Krempa) - virsh: Add adapter options for pool-{create|define}-as (John Ferlan) - virsh: Add auth options for pool-{create|define}-as (John Ferlan) - Report original error when QMP probing fails with new QEMU (Daniel P. Berrange) - storage: backend: Log uid/gid when initializing storage file backend (Peter Krempa) - qemu: process: Refactor reconnecting to qemu processes (Peter Krempa) - drvbhyve: Automatically tear down guest domains on shutdown (Conrad Meyer) - qemu: driver: Reload snapshots and managedsaves prior to reconnecting (Peter Krempa) - leaseshelper: Fix incorrect alignment of a switch case (Peter Krempa) - network: dnsmasq: Don't format lease file path (Peter Krempa) - leaseshelper: Refactor control flow (Peter Krempa) - leaseshelper: improvements to support all events (Nehal J Wani) - cpu-driver: Fix the cross driver function call (Daniel Hansel) - qemu_migration: Precreate missing storage (Michal Privoznik) - qemu_migration: Send disk sizes to the other side (Michal Privoznik) - qemuMonitorJSONBlockStatsUpdateCapacity: Don't skip disks (Michal Privoznik) - storage: Introduce storagePoolLookupByTargetPath (Michal Privoznik) - Replace virDomainSnapshotFree with virObjectUnref (John Ferlan) - Replace virInterfaceFree with virObjectUnref (John Ferlan) - Replace virNWFilterFree with virObjectUnref (John Ferlan) - Replace virSecretFree with virObjectUnref (John Ferlan) - Replace virStreamFree with virObjectUnref (John Ferlan) - Replace virStoragePoolFree with virObjectUnref (John Ferlan) - Replace virStorageVolFree with virObjectUnref (John Ferlan) - Replace virNodeDeviceFree with virObjectUnref (John Ferlan) - Replace virNetworkFree with virObjectUnref (John Ferlan) - Replace virDomainFree with virObjectUnref (John Ferlan) - rpc: Replace virXXXFree with virObjectUnref (John Ferlan) - libvirt.c: Move virDomainGetFSInfo to libvirt-domain.c (Michal Privoznik) - conf: replace call to virNetworkFree() with virObjectUnref() (Laine Stump) - build, docs: Let make see the dependencies for html/*.html (Martin Kletzander) - storage: Move and rename getVhbaSCSIHostParent (John Ferlan) - conf: Don't redefine virDomainTPMDefPtr (Martin Kletzander) - qemu: Make pid available for security managers in qemuProcessAttach (Luyao Huang) - qemu: set jobinfo type to FAILED if job is failed in qemuMigrationRun (Wang Rui) - qemu: set jobinfo type to CANCELLED if migration is cancelled in all conditions (Wang Rui) - util: Avoid calling closedir(NULL) (Jiri Denemark) - dbus: fix arrays of bools (Eric Blake) - qemu: add the missing jobinfo type in qemuDomainGetJobInfo (Wang Rui) - lxc: be more patient while resolving symlinks (Cédric Bosdonnat) - virt-aa-helper: /etc/libvirt-sandbox/services isn't restricted (Cédric Bosdonnat) - qemu-command: introduce new vgamem attribute for QXL video device (Pavel Hrdina) - qemu-command: use vram attribute for all video devices (Pavel Hrdina) - caps: introduce new QEMU capability for vgamem_mb device property (Pavel Hrdina) - QXL: fix setting ram and vram values for QEMU QXL device (Pavel Hrdina) - video: cleanup usage of vram attribute and update documentation (Pavel Hrdina) - internal: add macro to round value to the next closest power of 2 (Pavel Hrdina) - virsh: expose virDomainGetFSInfo (Tomoki Sekiyama) - qemu: add test for qemuAgentGetFSInfo (Tomoki Sekiyama) - qemu: Implement the qemu driver for virDomainGetFSInfo (Tomoki Sekiyama) - remote: Implement the remote protocol for virDomainGetFSInfo (Tomoki Sekiyama) - qemu: Emit the guest agent lifecycle event (Peter Krempa) - examples: Add support for the guest agent lifecycle event (Peter Krempa) - event: Add guest agent lifecycle event (Peter Krempa) - spec: Automatically apply all patches with git (Jiri Denemark) - qemu: process: Refresh virtio channel guest state when connecting to mon (Peter Krempa) - qemu: chardev: Extract more information about character devices (Peter Krempa) - libxl: destroy domain in migration finish phase on failure (Jim Fehlig) - libxl: start domain paused on migration dst (Jim Fehlig) - libxl: acquire job in migration finish phase (Jim Fehlig) - libxl: Receive migration data in a thread (Jim Fehlig) - storage: rbd: Implement support for passing config file option (Peter Krempa) - storage: rbd: qemu: Add support for specifying internal RBD snapshots (Peter Krempa) - storage: Allow parsing of RBD backing strings when building backing chain (Peter Krempa) - util: storagefile: Split out parsing of NBD string into a separate func (Peter Krempa) - util: split out qemuParseRBDString into a common helper (Peter Krempa) - tests: Reflow the expected output from RBD disk test (Peter Krempa) - qemu: Refactor qemuBuildNetworkDriveURI to take a virStorageSourcePtr (Peter Krempa) - util: storage: Copy hosts of a storage file only if they exist (Peter Krempa) - util: storage: Add notice for extension of struct virStorageSource (Peter Krempa) - util: buffer: Clarify scope of the escape operation in virBufferEscape (Peter Krempa) - test: virstoragetest: Add testing of network disk details (Peter Krempa) - qemu: Add handling for VSERPORT_CHANGE event (Peter Krempa) - conf: Add channel state for virtio channels to the XML (Peter Krempa) - qemu: monitor: Rename and improve qemuMonitorGetPtyPaths (Peter Krempa) - test: xml2xml: Print full filenames if xml2xml test fails (Peter Krempa) - conf: Annotate source enums for character device struct members (Peter Krempa) - qemu: process: report useful error if alias formatting fails (Peter Krempa) - qemu: Drop OVMF whitelist (Michal Privoznik) - qemu: Support OVMF on armv7l aarch64 guests (Michal Privoznik) - maint: forbid 'int foo = true' (Eric Blake) - virdbus: don't force users to pass int for bool values (Eric Blake) - storage: wrap storage_driver.c to 80 columns (Chen Hanxiao) - network: Add network bandwidth support to ethernet interfaces (Anirban Chakraborty) - qemu: Add tests for new blkdeviotune arguments (John Ferlan) - qemu: Add checks for blkdeviotune 'size_iops_sec' and adjust error (John Ferlan) - bracket-spacing: Add syntax-check for unnecessary curly brackets (Martin Kletzander) - bracket-spacing-check: Print out more specific error message (Martin Kletzander) - bracket-spacing: Remove pointless cycles (Martin Kletzander) - bracket-spacing: Don't modify current line (Martin Kletzander) - Remove unnecessary curly brackets in tests/ (Martin Kletzander) - Remove unnecessary curly brackets in tools/ (Martin Kletzander) - Remove unnecessary curly brackets in rest of src/ (Martin Kletzander) - Remove unnecessary curly brackets in rest of src/[o-u]*/ (Martin Kletzander) - Remove unnecessary curly brackets in rest of src/[a-n]*/ (Martin Kletzander) - Remove unnecessary curly brackets in src/vbox/ (Martin Kletzander) - Remove unnecessary curly brackets in src/util/ (Martin Kletzander) - Remove unnecessary curly brackets in src/test/test_driver.c (Martin Kletzander) - Remove unnecessary curly brackets in src/storage/ (Martin Kletzander) - Remove unnecessary curly brackets in src/qemu/ (Martin Kletzander) - Remove unnecessary curly brackets in src/node_device/ (Martin Kletzander) - Remove unnecessary curly brackets in src/hyperv/ (Martin Kletzander) - Remove unnecessary curly brackets in src/conf/ (Martin Kletzander) - Remove unnecessary curly brackets in src/vmx/vmx.c (Martin Kletzander) - Remove unnecessary curly brackets in rest of src/esx/ (Martin Kletzander) - Remove unnecessary curly brackets in src/esx/esx_driver.c (Martin Kletzander) - Remove unnecessary curly brackets in daemon/ and examples/ (Martin Kletzander) - virsh: Convert EDIT_NOT_CHANGED macro to do-while block. (Martin Kletzander) - virt-aa-helper: Trick invalid syntax-check (Martin Kletzander) - virsh: Error out if VSH_OT_STRING option has VSH_OFLAG_REQ flag (Martin Kletzander) - virsh: Enforce proper ordering of options (Martin Kletzander) - virsh: Reorder some options (Martin Kletzander) - drvbhyve: Use boot-order for grub-bhyve boot device (Conrad Meyer) - drvbhyve: Clean-up some used ATTRIBUTE_UNUSEDs. (Conrad Meyer) - storage: Introduce virStoragePoolSaveConfig (John Ferlan) - storage: Don't use a stack copy of the adapter (John Ferlan) - bhyvexml2argv: Add test for grub console support (Conrad Meyer) - bhyve: Add console support for grub-bhyve bootloader (Conrad Meyer) - bhyve: Probe grub-bhyve for --cons-dev capability (Conrad Meyer) - bhyvexml2argv: Add tests for domain-configured bootloader, args (Conrad Meyer) - domaincommon.rng: Add 'bootloader' to os=hvm schema for Bhyve (Conrad Meyer) - bhyvexml2argv: Add loader argv tests. (Conrad Meyer) - bhyve: Support /domain/bootloader configuration for non-FreeBSD guests. (Conrad Meyer) - Display nicer error message for unsupported chardev hotplug (Ján Tomko) - virsh: Add bps_max and friends to virsh (Matthias Gatto) - qemu: Add bps_max and friends to qemu command generation (Matthias Gatto) - qemu: Add bps_max and friends QMP suport (Matthias Gatto) - qemu: Add bps_max and friends qemu driver (Matthias Gatto) - qemu: Add Qemu capability for bps_max and friends (Matthias Gatto) - qemu: Modify the structure _virDomainBlockIoTuneInfo. (Matthias Gatto) - cpu_conf: Allow specification of 'units' for @memory on numa nodes. (Prerna Saxena) - conf: Expose virDomainParseMemory for use outside domain_conf (Prerna Saxena) - esx: Simplify VI (vSphere) API and VMware product version handling (Matthias Bolte) - domain_conf: Use virDomainParseMemory more widely (Michal Privoznik) - Transform VIR_ERROR into VIR_WARN in detect_scsi_host_caps (Cédric Bosdonnat) - vbox: Remove useless condition branches (Martin Kletzander) - Remove use of networkPrivateData from netcf driver (Daniel P. Berrange) - Remove use of networkPrivateData from network driver (Daniel P. Berrange) - Remove use of storagePrivateData from storage driver (Daniel P. Berrange) - Update Test driver to always use privateData (Daniel P. Berrange) - Update Parallels driver to always use privateData (Daniel P. Berrange) - Remove abuse of networkPrivateData in phyp driver (Daniel P. Berrange) - Move phyp internal info out of the header file (Daniel P. Berrange) - Update Hyper-V driver to always use privateData (Daniel P. Berrange) - Update ESX driver to always use privateData (Daniel P. Berrange) - Update remote driver to always use privateData (Daniel P. Berrange) - Clean up remote driver connection open code (Daniel P. Berrange) - Test: Add a testcase for PowerPC compat mode cpu specification. (Prerna Saxena) - PowerPC:Improve PVR handling to fall back to cpu generation. (Prerna Saxena) - PowerPC : Add support for launching VM in 'compat' mode. (Prerna Saxena) - Cpu: Add support for Power LE Architecture. (Prerna Saxena) - gitignore: use wildcard for configure's temporary files (Martin Kletzander) - virnetdevbandwidth: Include virutil.h (Michal Privoznik) - qemu: Allow use of iothreads for virtio ccw disk definitions (Boris Fiuczynski) - qemu: Correct disk type checking logic for iothreads (Boris Fiuczynski) - virsh: fix net-dhcp-leases no output in quiet mode (Luyao Huang) - numa: split util/ and conf/ and support non-contiguous nodesets (Martin Kletzander) - add temporary compilation files into .gitignore (Martin Kletzander) - Iface: disallow network tuning in session mode globally (Erik Skultety) - qemu: revert patch - bandwidth tuning in session mode (Erik Skultety) - private.syms: Export virDomainNumatuneSpecifiedMaxNode (Michal Privoznik) - virnuma: Add some more comments (Michal Privoznik) - Memory: Use consistent type for all memory elements. (Prerna Saxena) - virnuma: use virNumaNodesetIsAvailable checking nodeset in virNumaSetupMemoryPolicy (Chen Fan) - numatune: add check for numatune nodeset range (Chen Fan) - bitmap: add virBitmapLastSetBit for finding the last bit position of bitmap (Chen Fan) - virsh: don't list unknown domains (Martin Kletzander) - lxc: improve error message for invalid blkiotune settings (Martin Kletzander) - qemu: improve error message for invalid blkiotune settings (Martin Kletzander) - util: Introduce virPidFileForceCleanupPath (Martin Kletzander) Cleanup: - Remove left over debug in hvsupport.pl script (Daniel P. Berrange) Thanks everybody for your contributions for this release, be it with reports, patches, dicussions, documentation fixes, etc. ! Daniel -- Daniel Veillard | Open Source and Standards, Red Hat veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] exec-shield and KVM
by Raymond Durand 12 Dec '14

12 Dec '14

Is exec-shield protection on the KVM host relevant for VM memory protection? Regards,

2 1