- Devel - libvirt List Archives

[libvirt] [PATCH v7 0/6] file descriptor passing using fd sets
by Corey Bryant 09 Aug '12

09 Aug '12

libvirt's sVirt security driver provides SELinux MAC isolation for Qemu guest processes and their corresponding image files. In other words, sVirt uses SELinux to prevent a QEMU process from opening files that do not belong to it. sVirt provides this support by labeling guests and resources with security labels that are stored in file system extended attributes. Some file systems, such as NFS, do not support the extended attribute security namespace, and therefore cannot support sVirt isolation. A solution to this problem is to provide fd passing support, where libvirt opens files and passes file descriptors to QEMU. This, along with SELinux policy to prevent QEMU from opening files, can provide image file isolation for NFS files stored on the same NFS mount. This patch series adds the add-fd, remove-fd, and query-fdsets QMP monitor commands, which allow file descriptors to be passed via SCM_RIGHTS, and assigned to specified fd sets. This allows fd sets to be created per file with fds having, for example, different access rights. When QEMU needs to reopen a file with different access rights, it can search for a matching fd in the fd set. Fd sets also allow for easy tracking of fds per file, helping to prevent fd leaks. Support is also added to the block layer to allow QEMU to dup an fd from an fdset when the filename is of the /dev/fdset/nnn format, where nnn is the fd set ID. No new SELinux policy is required to prevent open of NFS files (files with type nfs_t). The virt_use_nfs boolean type simply needs to be set to false, and open will be prevented (and dup will be allowed). For example: # setsebool virt_use_nfs 0 # getsebool virt_use_nfs virt_use_nfs --> off Corey Bryant (6): qemu-char: Add MSG_CMSG_CLOEXEC flag to recvmsg qapi: Introduce add-fd, remove-fd, query-fdsets monitor: Clean up fd sets on monitor disconnect block: Convert open calls to qemu_open block: Convert close calls to qemu_close block: Enable qemu_open/close to work with fd sets block/raw-posix.c | 42 ++++----- block/raw-win32.c | 6 +- block/vdi.c | 5 +- block/vmdk.c | 25 +++-- block/vpc.c | 4 +- block/vvfat.c | 16 ++-- cutils.c | 5 + monitor.c | 273 +++++++++++++++++++++++++++++++++++++++++++++++++++++ monitor.h | 5 + osdep.c | 117 +++++++++++++++++++++++ qapi-schema.json | 110 +++++++++++++++++++++ qemu-char.c | 12 ++- qemu-common.h | 2 + qemu-tool.c | 20 ++++ qerror.c | 4 + qerror.h | 3 + qmp-commands.hx | 131 +++++++++++++++++++++++++ savevm.c | 4 +- 18 files changed, 730 insertions(+), 54 deletions(-) -- 1.7.10.4

6 28

[libvirt] [libvirt-glib] Fix small typo in error message ('downlaod')
by Christophe Fergeau 09 Aug '12

09 Aug '12

--- Pushed under the trivial rule. libvirt-gobject/libvirt-gobject-storage-vol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt-gobject/libvirt-gobject-storage-vol.c b/libvirt-gobject/libvirt-gobject-storage-vol.c index 99ccbab..9256445 100644 --- a/libvirt-gobject/libvirt-gobject-storage-vol.c +++ b/libvirt-gobject/libvirt-gobject-storage-vol.c @@ -384,7 +384,7 @@ gboolean gvir_storage_vol_download(GVirStorageVol *vol, gvir_set_error_literal(err, GVIR_STORAGE_VOL_ERROR, 0, - "Unable to downlaod volume storage"); + "Unable to download volume storage"); goto cleanup; } -- 1.7.11.2

1 0

[libvirt] [PATCH] qemu: Refactor parsing of block device IO tuning parameters.
by Peter Krempa 09 Aug '12

09 Aug '12

This patch refactors the JSON parsing function that extracts the block IO tuning parameters from qemu's output. The most impacting change concerns the error message that is returned if the reply from qemu does not contain the needed data. The data for IO parameter tuning were added in qemu 1.1 and the previous error message was confusing. This patch also breaks long lines and extracts a multiple time used code pattern to a macro. --- Old error message looks like: # virsh blkdeviotune asdf hda error: Unable to get block I/O throttle parameters error: internal error cannot read total_bytes_sec and the new: # virsh blkdeviotune asdf hda error: Unable to get block I/O throttle parameters error: internal error block_io_throttle field 'total_bytes_sec' missing in qemu's output src/qemu/qemu_monitor_json.c | 66 ++++++++++++++++------------------------- 1 files changed, 26 insertions(+), 40 deletions(-) diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index dd6536f..3ede88d 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -3648,6 +3648,16 @@ int qemuMonitorJSONOpenGraphics(qemuMonitorPtr mon, } +#define GET_THROTTLE_STATS(FIELD, STORE) \ + if (virJSONValueObjectGetNumberUlong(inserted, \ + FIELD, \ + &reply->STORE) < 0) { \ + virReportError(VIR_ERR_INTERNAL_ERROR, \ + _("block_io_throttle field '%s' missing " \ + "in qemu's output"), \ + #STORE); \ + goto cleanup; \ + } static int qemuMonitorJSONBlockIoThrottleInfo(virJSONValuePtr result, const char *device, @@ -3656,7 +3666,7 @@ qemuMonitorJSONBlockIoThrottleInfo(virJSONValuePtr result, virJSONValuePtr io_throttle; int ret = -1; int i; - int found = 0; + bool found = false; io_throttle = virJSONValueObjectGet(result, "return"); @@ -3673,13 +3683,15 @@ qemuMonitorJSONBlockIoThrottleInfo(virJSONValuePtr result, if (!temp_dev || temp_dev->type != VIR_JSON_TYPE_OBJECT) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("block_io_throttle device entry was not in expected format")); + _("block_io_throttle device entry " + "was not in expected format")); goto cleanup; } - if ((current_dev = virJSONValueObjectGetString(temp_dev, "device")) == NULL) { + if (!(current_dev = virJSONValueObjectGetString(temp_dev, "device"))) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("block_io_throttle device entry was not in expected format")); + _("block_io_throttle device entry " + "was not in expected format")); goto cleanup; } @@ -3689,49 +3701,22 @@ qemuMonitorJSONBlockIoThrottleInfo(virJSONValuePtr result, if (STREQ(current_dev, device)) continue; - found = 1; + found = true; if ((inserted = virJSONValueObjectGet(temp_dev, "inserted")) == NULL || inserted->type != VIR_JSON_TYPE_OBJECT) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("block_io_throttle inserted entry was not in expected format")); + _("block_io_throttle inserted entry " + "was not in expected format")); goto cleanup; } - if (virJSONValueObjectGetNumberUlong(inserted, "bps", &reply->total_bytes_sec) < 0) { - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("cannot read total_bytes_sec")); - goto cleanup; - } + GET_THROTTLE_STATS("bps", total_bytes_sec); + GET_THROTTLE_STATS("bps_rd", read_bytes_sec); + GET_THROTTLE_STATS("bps_wr", write_bytes_sec); + GET_THROTTLE_STATS("iops", total_iops_sec); + GET_THROTTLE_STATS("iops_rd", read_iops_sec); + GET_THROTTLE_STATS("iops_wr", write_iops_sec); - if (virJSONValueObjectGetNumberUlong(inserted, "bps_rd", &reply->read_bytes_sec) < 0) { - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("cannot read read_bytes_sec")); - goto cleanup; - } - - if (virJSONValueObjectGetNumberUlong(inserted, "bps_wr", &reply->write_bytes_sec) < 0) { - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("cannot read write_bytes_sec")); - goto cleanup; - } - - if (virJSONValueObjectGetNumberUlong(inserted, "iops", &reply->total_iops_sec) < 0) { - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("cannot read total_iops_sec")); - goto cleanup; - } - - if (virJSONValueObjectGetNumberUlong(inserted, "iops_rd", &reply->read_iops_sec) < 0) { - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("cannot read read_iops_sec")); - goto cleanup; - } - - if (virJSONValueObjectGetNumberUlong(inserted, "iops_wr", &reply->write_iops_sec) < 0) { - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("cannot read write_iops_sec")); - goto cleanup; - } break; } @@ -3746,6 +3731,7 @@ qemuMonitorJSONBlockIoThrottleInfo(virJSONValuePtr result, cleanup: return ret; } +#undef GET_THROTTLE_STATS int qemuMonitorJSONSetBlockIoThrottle(qemuMonitorPtr mon, const char *device, -- 1.7.8.6

3 5

[libvirt] [PATCH][TCK] Add new case for domain suspend/resume
by Kyla Zhang 09 Aug '12

09 Aug '12

This case tests the domain suspend and resume, and domain info checking include state, control and os type. --- scripts/domain/140-transient-suspend-resume.t | 91 +++++++++++++++++++++++++ 1 files changed, 91 insertions(+), 0 deletions(-) create mode 100644 scripts/domain/140-transient-suspend-resume.t diff --git a/scripts/domain/140-transient-suspend-resume.t b/scripts/domain/140-transient-suspend-resume.t new file mode 100644 index 0000000..a1c6f91 --- /dev/null +++ b/scripts/domain/140-transient-suspend-resume.t @@ -0,0 +1,91 @@ +# -*- perl -*- +# +# Copyright (C) 2012 Red Hat, Inc. +# Copyright (C) 2012 Kyla Zhang <weizhan(a)redhat.com> +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +domain/130-transient-suspend-resume.t - Transient domain suspend/resume + +=head1 DESCRIPTION + +The test case validates that it is possible to pause and resume transient +domain without error. + +=cut + +use strict; +use warnings; + +use Test::More tests => 14; + +use Sys::Virt::TCK; +use Test::Exception; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { $tck->cleanup if $tck; } + +# Create a new transient domain and check status +my $xml = $tck->generic_domain("tck")->as_xml; + +diag "Creating a new transient domain"; +my $dom; +ok_domain(sub { $dom = $conn->create_domain($xml) }, "created transient domain object"); + +diag "Get domain os type"; +my $os_type = xpath($dom, "string(/domain/os/type)"); +is($dom->get_os_type(), $os_type, "domain os type is $os_type"); + +diag "Check domain state and reason"; +my($state, $reason)=$dom->get_state(); +is($state, Sys::Virt::Domain::STATE_RUNNING, "domain state is running"); +is($reason, Sys::Virt::Domain::STATE_RUNNING_BOOTED, "domain is running after being booted"); + +diag "Get domain control info"; +is($dom->get_control_info->{state}, Sys::Virt::Domain::CONTROL_OK, "domain control info is ok"); + +# Do suspend/resume and check status +diag "Suspend domain"; +lives_ok(sub { $dom->suspend() }, "domain has been suspended"); + +diag "Get domain state and reason"; +($state, $reason)=$dom->get_state(); +is($state, Sys::Virt::Domain::STATE_PAUSED, "domain state is paused"); +is($reason, Sys::Virt::Domain::STATE_PAUSED_USER, "domain is paused at admin request"); + +diag "Get domain control info"; +is($dom->get_control_info->{state}, Sys::Virt::Domain::CONTROL_OK, "domain control info is ok"); + +diag "Resume domain"; +lives_ok( sub { $dom->resume() }, "domain has been resumed"); + +diag "Get domain state and reason"; +($state, $reason)=$dom->get_state(); +is($state, Sys::Virt::Domain::STATE_RUNNING, "domain state is running"); +is($reason, Sys::Virt::Domain::STATE_RUNNING_UNPAUSED, "domain is running after a resume"); + +diag "Get domain control info"; +is($dom->get_control_info->{state}, Sys::Virt::Domain::CONTROL_OK, "domain control info is ok"); + +# Destroy domain +diag "Destroying the transient domain"; +$dom->destroy; + +diag "Checking that transient domain has gone away"; +ok_error(sub { $conn->get_domain_by_name("tck") }, "NO_DOMAIN error raised from missing domain", + Sys::Virt::Error::ERR_NO_DOMAIN); + +# end -- 1.7.1

1 0

[libvirt] [PATCH 0/5] Add LibSSH2 transport
by Peter Krempa 09 Aug '12

09 Aug '12

This patchset adds LibSSH2 transport implementation for libvirt's virNetSocket object and other needed places to enable connections using the native library instead of spawning the ssh client and communicating using pipes. This patchset lacks addition of documentation (I'll do that later, but I'd like to get the code sorted out) but otherwise should be fully functional. The commit message to the last patch describes the configuration variables used to set parameters of the transport. The setting is done using uri arguments. Thanks in advance for reviews and comments :) Peter Peter Krempa (5): remote: Clean up coding style and refactor remote connection opening libssh2_transport: add main libssh2 transport implementation libssh2_transport: add ssh context support to virNetSocket libssh2_transport: Add libssh2 session support to net client code libssh2_transport: Use libssh2 driver code in remote driver configure.ac | 40 +- include/libvirt/virterror.h | 2 + po/POTFILES.in | 1 + src/Makefile.am | 9 + src/libvirt_private.syms | 1 + src/remote/remote_driver.c | 339 ++++++----- src/rpc/virnetclient.c | 120 ++++- src/rpc/virnetclient.h | 14 +- src/rpc/virnetlibsshcontext.c | 1444 +++++++++++++++++++++++++++++++++++++++++ src/rpc/virnetlibsshcontext.h | 83 +++ src/rpc/virnetsocket.c | 178 +++++- src/rpc/virnetsocket.h | 13 + src/util/virterror.c | 8 +- 13 files changed, 2092 insertions(+), 160 deletions(-) create mode 100644 src/rpc/virnetlibsshcontext.c create mode 100644 src/rpc/virnetlibsshcontext.h -- 1.7.8.6

2 9

[libvirt] libvirt sgefaults upon ctrl-c
by Stefan Berger 09 Aug '12

09 Aug '12

Hi, libvirt segfaults for me when run in the foreground and pressing ctrl-c. A bisect of the code lead me to this commit commit 7c1119e3bbd483c52ae4cdfebe23dd179ad28124 Author: Daniel P. Berrange <berrange(a)redhat.com> Date: Tue Aug 7 12:02:06 2012 +0100 Stefan

3 5

[libvirt] [PATCH 2/5] add qemuAgentCommand()
by MATSUDA, Daiki 09 Aug '12

09 Aug '12

Add qemuAgentCommand() for general qemu agent command. include/libvirt/libvirt-qemu.h | 5 +++++ src/qemu/qemu_agent.c | 38 ++++++++++++++++++++++++++++++++++++++ src/qemu/qemu_agent.h | 5 +++++ 3 files changed, 48 insertions(+) diff --git a/include/libvirt/libvirt-qemu.h b/include/libvirt/libvirt-qemu.h index a37f897..ffc5ae5 100644 --- a/include/libvirt/libvirt-qemu.h +++ b/include/libvirt/libvirt-qemu.h @@ -44,6 +44,11 @@ virDomainPtr virDomainQemuAttach(virConnectPtr domain, unsigned int pid_value, unsigned int flags); +typedef enum { + VIR_DOMAIN_QEMU_AGENT_COMMAND_BLOCK = -1, + VIR_DOMAIN_QEMU_AGENT_COMMAND_NOWAIT = 0, +} virDomainQemuAgentCommandTimeoutFlags; + # ifdef __cplusplus } # endif diff --git a/src/qemu/qemu_agent.c b/src/qemu/qemu_agent.c index 7699042..1cfcafc 100644 --- a/src/qemu/qemu_agent.c +++ b/src/qemu/qemu_agent.c @@ -1401,3 +1401,41 @@ qemuAgentSuspend(qemuAgentPtr mon, virJSONValueFree(reply); return ret; } + +int qemuAgentQemuAgentCommand(qemuAgentPtr mon, + const char *cmd_str, + char **result, + int timeout) +{ + int ret = -1; + int seconds; + virJSONValuePtr cmd; + virJSONValuePtr reply = NULL; + + cmd = virJSONValueFromString(cmd_str); + if (!cmd) + return ret; + + if (result == NULL) { + seconds = 0; + } else if (timeout == VIR_DOMAIN_QEMU_AGENT_COMMAND_BLOCK) { + seconds = 5; + } else { + seconds = timeout; + } + +repeat: + ret = qemuAgentCommand(mon, cmd, &reply, timeout); + + if (ret == 0) { + ret = qemuAgentCheckError(cmd, reply); + *result = virJSONValueToString(reply); + } else { + if (timeout == VIR_DOMAIN_QEMU_AGENT_COMMAND_BLOCK) goto repeat; + *result = NULL; + } + + virJSONValueFree(cmd); + virJSONValueFree(reply); + return ret; +} diff --git a/src/qemu/qemu_agent.h b/src/qemu/qemu_agent.h index 2fdebb2..fc19c2f 100644 --- a/src/qemu/qemu_agent.h +++ b/src/qemu/qemu_agent.h @@ -77,4 +77,9 @@ int qemuAgentFSThaw(qemuAgentPtr mon); int qemuAgentSuspend(qemuAgentPtr mon, unsigned int target); + +int qemuAgentQemuAgentCommand(qemuAgentPtr mon, + const char *cmd, + char **result, + int timeout); #endif /* __QEMU_AGENT_H__ */

2 2

[libvirt] Channel with virtio problem
by norazah aziz 09 Aug '12

09 Aug '12

I have configured the kvm and edit the xml as below, however there are an error when I want to run the guest. The error as follows: virsh create libvirt.xml error: Failed to create domain from libvirt-test.xml error: XML description for unknown target type for character device: virtio is not well formed or invalid Please help me to solve this problem. ############################################################ <domain type='kvm'> <name>i-5E36098H</name> <os> <type>hvm</type> <kernel>/opt/eucalyptus-data/suria/i-5E36098H/kernel</kernel> <initrd>/opt/eucalyptus-data/suria/i-5E36098H/ramdisk</initrd> <cmdline>root=LABEL=root console=ttyS0</cmdline> </os> <features> <acpi/> </features> <memory>13107200</memory> <vcpu>1</vcpu> <devices> <emulator>/usr/bin/kvm</emulator> <disk type='file'> <source file='/opt/eucalyptus-data/suria/i-5E36098H/disk'/> <target dev='vda' bus='virtio'/> </disk> <interface type='network'> <source network='default'/> <mac address='d0:0d:45:D2:08:01'/> <model type='virtio'/> </interface> <controller type='ide' index='0'/> <controller type='virtio-serial' index='0' ports='16' vectors='4'/> <controller type='virtio-serial' index='1'> <address type='pci' domain='0x0000' bus='0x00' slot='0x0a' function='0x0'/> </controller> <parallel type='pty'> <source path='/dev/pts/2'/> <target port='0'/> </parallel> <serial type='pty'> <source path='/dev/pts/3'/>  <target type='virtio' port='0'/> </serial> <console type='pty'> <source path='/dev/pts/4'/> <target type='virtio' port='0'/> </console> <channel type='pty'> <source mode='bind' path='/var/lib/libvirt/qemu/va-i5E36098H-virtio.sock'/> <target type='virtio' name='org.qemu.guest_agent.0'/> <address type='virtio-serial' controller='0' bus='0' port='0'/> </channel> <graphics type='vnc' port='-1' autoport='yes' keymap='en-us'/> </devices> ########################################################################

2 2

[libvirt] [PATCH] Allow rbd backing stores
by Peter Feiner 08 Aug '12

08 Aug '12

Prevents libvirt from treating RBD backing stores as files. Without this patch, creating a domain with a qcow2 overlay on an RBD would fail. This patch essentially extends 9c7c4a4fc533598e59e9a0038ec783e61a38e664, which allows nbd backing stores, to allow rbd backing stores. diff --git a/src/util/storage_file.c b/src/util/storage_file.c index f38aa8e..101518a 100644 --- a/src/util/storage_file.c +++ b/src/util/storage_file.c @@ -589,8 +589,8 @@ virStorageFileMatchesVersion(int format, static bool virBackingStoreIsFile(const char *backing) { - /* Backing store is a network block device */ - if (STRPREFIX(backing, "nbd:")) + /* Backing store is a network block device or Rados block device */ + if (STRPREFIX(backing, "nbd:") || STRPREFIX(backing, "rbd:")) return false; return true; }

2 1

[libvirt] [PATCH] Fix errno check, prevent spurious errors under heavy load
by Peter Feiner 08 Aug '12

08 Aug '12

>From man poll(2), poll does not set errno=EAGAIN, however it does set errno=EINTR. Have libvirt retry on the appropriate errno. Under heavy load, a program of mine kept getting libvirt errors 'poll on socket failed: Interrupted system call'. The signals were SIGCHLD from processes forked by threads unrelated to those using libvirt. diff --git a/src/rpc/virnetclient.c b/src/rpc/virnetclient.c index 2530ffa..f2a6922 100644 --- a/src/rpc/virnetclient.c +++ b/src/rpc/virnetclient.c @@ -1374,7 +1374,7 @@ static int virNetClientIOEventLoop(virNetClientPtr client, repoll: ret = poll(fds, ARRAY_CARDINALITY(fds), timeout); - if (ret < 0 && errno == EAGAIN) + if (ret < 0 && errno == EINTR) goto repoll; ignore_value(pthread_sigmask(SIG_SETMASK, &oldmask, NULL));

2 1