- Devel - libvirt List Archives

[libvirt] [PATCH] maint: fix improper use of 'an'
by Eric Blake 04 Dec '11

04 Dec '11

https://bugzilla.redhat.com/show_bug.cgi?id=648855 mentioned a misuse of 'an' where 'a' is proper; that has since been fixed, but a search found other problems (some were a spelling error for 'and', while most were fixed by 'a'). * daemon/stream.c: Fix grammar. * src/conf/domain_conf.c: Likewise. * src/conf/domain_event.c: Likewise. * src/esx/esx_driver.c: Likewise. * src/esx/esx_vi.c: Likewise. * src/rpc/virnetclient.c: Likewise. * src/rpc/virnetserverprogram.c: Likewise. * src/storage/storage_backend_fs.c: Likewise. * src/util/conf.c: Likewise. * src/util/dnsmasq.c: Likewise. * src/util/iptables.c: Likewise. * src/xen/xen_hypervisor.c: Likewise. * src/xen/xend_internal.c: Likewise. * src/xen/xs_internal.c: Likewise. * tools/virsh.c: Likewise. --- Pushing under the trivial rule. daemon/stream.c | 4 ++-- src/conf/domain_conf.c | 2 +- src/conf/domain_event.c | 2 +- src/esx/esx_driver.c | 2 +- src/esx/esx_vi.c | 2 +- src/rpc/virnetclient.c | 2 +- src/rpc/virnetserverprogram.c | 2 +- src/storage/storage_backend_fs.c | 2 +- src/util/conf.c | 6 +++--- src/util/dnsmasq.c | 4 ++-- src/util/iptables.c | 4 ++-- src/xen/xen_hypervisor.c | 32 ++++++++++++++++---------------- src/xen/xend_internal.c | 2 +- src/xen/xs_internal.c | 2 +- tools/virsh.c | 2 +- 15 files changed, 35 insertions(+), 35 deletions(-) diff --git a/daemon/stream.c b/daemon/stream.c index 50f8fd4..bb66f75 100644 --- a/daemon/stream.c +++ b/daemon/stream.c @@ -1,7 +1,7 @@ /* * stream.c: APIs for managing client streams * - * Copyright (C) 2009 Red Hat, Inc. + * Copyright (C) 2009, 2011 Red Hat, Inc. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -556,7 +556,7 @@ daemonStreamHandleWriteData(virNetServerClientPtr client, /* - * Process an finish handshake from the client. + * Process a finish handshake from the client. * * Returns a VIR_NET_OK confirmation if successful, or a VIR_NET_ERROR * if there was a stream error diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 75f21dc..75e51a0 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -4555,7 +4555,7 @@ error: } -/* Parse the XML definition for an hub device */ +/* Parse the XML definition for a hub device */ static virDomainHubDefPtr virDomainHubDefParseXML(xmlNodePtr node, unsigned int flags) { diff --git a/src/conf/domain_event.c b/src/conf/domain_event.c index a04b9d0..614ab97 100644 --- a/src/conf/domain_event.c +++ b/src/conf/domain_event.c @@ -1070,7 +1070,7 @@ virDomainEventQueuePop(virDomainEventQueuePtr evtQueue) * @evtQueue: the dom event queue * @event: the event to add * - * Internal function to push onto the back of an virDomainEventQueue + * Internal function to push onto the back of a virDomainEventQueue * * Returns: 0 on success, -1 on failure */ diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c index f8b3c7a..1e424eb 100644 --- a/src/esx/esx_driver.c +++ b/src/esx/esx_driver.c @@ -267,7 +267,7 @@ esxParseVMXFileName(const char *fileName, void *opaque) /* - * This function does the inverse of esxParseVMXFileName. It takes an file name + * This function does the inverse of esxParseVMXFileName. It takes a file name * in datastore path format or in absolute format and converts it to a file * name that can be used in a .vmx file. * diff --git a/src/esx/esx_vi.c b/src/esx/esx_vi.c index 80f337b..99f25f8 100644 --- a/src/esx/esx_vi.c +++ b/src/esx/esx_vi.c @@ -1800,7 +1800,7 @@ esxVI_EnsureSession(esxVI_Context *ctx) if (ctx->hasSessionIsActive) { /* * Use SessionIsActive to check if there is an active session for this - * connection an re-login in there isn't. + * connection and re-login in there isn't. */ if (esxVI_SessionIsActive(ctx, ctx->session->key, ctx->session->userName, &active) < 0) { diff --git a/src/rpc/virnetclient.c b/src/rpc/virnetclient.c index ec06f45..7f9a332 100644 --- a/src/rpc/virnetclient.c +++ b/src/rpc/virnetclient.c @@ -1701,7 +1701,7 @@ static int virNetClientSendInternal(virNetClientPtr client, if (expectReply && nonBlock) { virNetError(VIR_ERR_INTERNAL_ERROR, "%s", - _("Attempt to send an non-blocking message with a synchronous reply")); + _("Attempt to send a non-blocking message with a synchronous reply")); return -1; } diff --git a/src/rpc/virnetserverprogram.c b/src/rpc/virnetserverprogram.c index bbd2d65..d2ede6b 100644 --- a/src/rpc/virnetserverprogram.c +++ b/src/rpc/virnetserverprogram.c @@ -340,7 +340,7 @@ cleanup: * @client: the unlocked client object * @msg: the complete incoming method call, with header already decoded * - * This method is used to dispatch an message representing an + * This method is used to dispatch a message representing an * incoming method call from a client. It decodes the payload * to obtain method call arguments, invokves the method and * then sends a reply packet with the return values diff --git a/src/storage/storage_backend_fs.c b/src/storage/storage_backend_fs.c index b5acd20..d8dc29c 100644 --- a/src/storage/storage_backend_fs.c +++ b/src/storage/storage_backend_fs.c @@ -880,7 +880,7 @@ virStorageBackendFileSystemRefresh(virConnectPtr conn ATTRIBUTE_UNUSED, VIR_STORAGE_VOL_OPEN_DEFAULT) < 0) { /* The backing file is currently unavailable, the capacity, * allocation, owner, group and mode are unknown. Just log the - * error an continue. + * error and continue. * Unfortunately virStorageBackendProbeTarget() might already * have logged a similar message for the same problem, but only * if AUTO format detection was used. */ diff --git a/src/util/conf.c b/src/util/conf.c index c8dcc7f..502dafb 100644 --- a/src/util/conf.c +++ b/src/util/conf.c @@ -698,7 +698,7 @@ virConfParseStatement(virConfParserCtxtPtr ctxt) * Parse the subset of the Python language needed to handle simple * Xen configuration files. * - * Returns an handle to lookup settings or NULL if it failed to + * Returns a handle to lookup settings or NULL if it failed to * read or parse the file, use virConfFree() to free the data. */ static virConfPtr @@ -745,7 +745,7 @@ error: * * Reads a configuration file. * - * Returns an handle to lookup settings or NULL if it failed to + * Returns a handle to lookup settings or NULL if it failed to * read or parse the file, use virConfFree() to free the data. */ virConfPtr @@ -780,7 +780,7 @@ virConfReadFile(const char *filename, unsigned int flags) * Reads a configuration file loaded in memory. The string can be * zero terminated in which case @len can be 0 * - * Returns an handle to lookup settings or NULL if it failed to + * Returns a handle to lookup settings or NULL if it failed to * parse the content, use virConfFree() to free the data. */ virConfPtr diff --git a/src/util/dnsmasq.c b/src/util/dnsmasq.c index b5f90a6..dcb7195 100644 --- a/src/util/dnsmasq.c +++ b/src/util/dnsmasq.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2007-2010 Red Hat, Inc. + * Copyright (C) 2007-2011 Red Hat, Inc. * Copyright (C) 2010 Satoru SATOH <satoru.satoh(a)gmail.com> * * This library is free software; you can redistribute it and/or @@ -461,7 +461,7 @@ dnsmasqContextNew(const char *network_name, * dnsmasqContextFree: * @ctx: pointer to the dnsmasq context * - * Free the resources associated with an dnsmasq context + * Free the resources associated with a dnsmasq context */ void dnsmasqContextFree(dnsmasqContext *ctx) diff --git a/src/util/iptables.c b/src/util/iptables.c index 452d717..3023900 100644 --- a/src/util/iptables.c +++ b/src/util/iptables.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2007-2010 Red Hat, Inc. + * Copyright (C) 2007-2011 Red Hat, Inc. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -891,7 +891,7 @@ iptablesOutputFixUdpChecksum(iptablesContext *ctx, * @iface: the interface name * @port: the UDP port to match * - * Add an rule to the mangle table's POSTROUTING chain that fixes up the + * Add a rule to the mangle table's POSTROUTING chain that fixes up the * checksum of packets with the given destination @port. * the given @iface interface for TCP packets. * diff --git a/src/xen/xen_hypervisor.c b/src/xen/xen_hypervisor.c index 6c71b65..941686f 100644 --- a/src/xen/xen_hypervisor.c +++ b/src/xen/xen_hypervisor.c @@ -556,7 +556,7 @@ typedef struct xen_v0_domainop xen_v0_domainop; #define XEN_V2_OP_UNPAUSEDOMAIN 4 /* - * The information for an setmaxmem system hypercall + * The information for a setmaxmem system hypercall */ #define XEN_V0_OP_SETMAXMEM 28 #define XEN_V1_OP_SETMAXMEM 28 @@ -580,7 +580,7 @@ struct xen_v2d5_setmaxmem { typedef struct xen_v2d5_setmaxmem xen_v2d5_setmaxmem; /* - * The information for an setmaxvcpu system hypercall + * The information for a setmaxvcpu system hypercall */ #define XEN_V0_OP_SETMAXVCPU 41 #define XEN_V1_OP_SETMAXVCPU 41 @@ -599,7 +599,7 @@ struct xen_v2_setmaxvcpu { typedef struct xen_v2_setmaxvcpu xen_v2_setmaxvcpu; /* - * The information for an setvcpumap system hypercall + * The information for a setvcpumap system hypercall * Note that between 1 and 2 the limitation to 64 physical CPU was lifted * hence the difference in structures */ @@ -647,7 +647,7 @@ struct xen_v2d5_setvcpumap { typedef struct xen_v2d5_setvcpumap xen_v2d5_setvcpumap; /* - * The information for an vcpuinfo system hypercall + * The information for a vcpuinfo system hypercall */ #define XEN_V0_OP_GETVCPUINFO 43 #define XEN_V1_OP_GETVCPUINFO 43 @@ -866,8 +866,8 @@ virXenErrorFunc(virErrorNumber error, const char *func, const char *info, * @handle: the handle to the Xen hypervisor * @op: pointer to the hypervisor operation structure * - * Do an hypervisor operation though the old interface, - * this leads to an hypervisor call through ioctl. + * Do a hypervisor operation though the old interface, + * this leads to a hypervisor call through ioctl. * * Returns 0 in case of success and -1 in case of error. */ @@ -908,7 +908,7 @@ xenHypervisorDoV0Op(int handle, xen_op_v0 * op) * @handle: the handle to the Xen hypervisor * @op: pointer to the hypervisor operation structure * - * Do an hypervisor v1 operation, this leads to an hypervisor call through + * Do a hypervisor v1 operation, this leads to a hypervisor call through * ioctl. * * Returns 0 in case of success and -1 in case of error. @@ -951,7 +951,7 @@ xenHypervisorDoV1Op(int handle, xen_op_v1* op) * @handle: the handle to the Xen hypervisor * @op: pointer to the hypervisor operation structure * - * Do an hypervisor v2 system operation, this leads to an hypervisor + * Do a hypervisor v2 system operation, this leads to a hypervisor * call through ioctl. * * Returns 0 in case of success and -1 in case of error. @@ -994,7 +994,7 @@ xenHypervisorDoV2Sys(int handle, xen_op_v2_sys* op) * @handle: the handle to the Xen hypervisor * @op: pointer to the hypervisor domain operation structure * - * Do an hypervisor v2 domain operation, this leads to an hypervisor + * Do a hypervisor v2 domain operation, this leads to a hypervisor * call through ioctl. * * Returns 0 in case of success and -1 in case of error. @@ -3155,7 +3155,7 @@ xenHypervisorGetMaxMemory(virDomainPtr domain) * @id: the domain ID * @info: the place where information should be stored * - * Do an hypervisor call to get the related set of domain information. + * Do a hypervisor call to get the related set of domain information. * * Returns 0 in case of success, -1 in case of error. */ @@ -3238,7 +3238,7 @@ xenHypervisorGetDomInfo(virConnectPtr conn, int id, virDomainInfoPtr info) * @domain: pointer to the domain block * @info: the place where information should be stored * - * Do an hypervisor call to get the related set of domain information. + * Do a hypervisor call to get the related set of domain information. * * Returns 0 in case of success, -1 in case of error. */ @@ -3382,7 +3382,7 @@ xenHypervisorNodeGetCellsFreeMemory(virConnectPtr conn, unsigned long long *free * xenHypervisorPauseDomain: * @domain: pointer to the domain block * - * Do an hypervisor call to pause the given domain + * Do a hypervisor call to pause the given domain * * Returns 0 in case of success, -1 in case of error. */ @@ -3409,7 +3409,7 @@ xenHypervisorPauseDomain(virDomainPtr domain) * xenHypervisorResumeDomain: * @domain: pointer to the domain block * - * Do an hypervisor call to resume the given domain + * Do a hypervisor call to resume the given domain * * Returns 0 in case of success, -1 in case of error. */ @@ -3437,7 +3437,7 @@ xenHypervisorResumeDomain(virDomainPtr domain) * @domain: pointer to the domain block * @flags: an OR'ed set of virDomainDestroyFlagsValues * - * Do an hypervisor call to destroy the given domain + * Do a hypervisor call to destroy the given domain * * Calling this function with no @flags set (equal to zero) * is equivalent to calling xenHypervisorDestroyDomain. @@ -3471,7 +3471,7 @@ xenHypervisorDestroyDomainFlags(virDomainPtr domain, * @domain: pointer to the domain block * @memory: the max memory size in kilobytes. * - * Do an hypervisor call to change the maximum amount of memory used + * Do a hypervisor call to change the maximum amount of memory used * * Returns 0 in case of success, -1 in case of error. */ @@ -3563,7 +3563,7 @@ xenHypervisorPinVcpu(virDomainPtr domain, unsigned int vcpu, * @domain: pointer to domain object, or NULL for Domain0 * @info: pointer to an array of virVcpuInfo structures (OUT) * @maxinfo: number of structures in info array - * @cpumaps: pointer to an bit map of real CPUs for all vcpus of this domain (in 8-bit bytes) (OUT) + * @cpumaps: pointer to a bit map of real CPUs for all vcpus of this domain (in 8-bit bytes) (OUT) * If cpumaps is NULL, then no cpumap information is returned by the API. * It's assumed there is <maxinfo> cpumap in cpumaps array. * The memory allocated to cpumaps must be (maxinfo * maplen) bytes diff --git a/src/xen/xend_internal.c b/src/xen/xend_internal.c index 16165fe..0c0b6cb 100644 --- a/src/xen/xend_internal.c +++ b/src/xen/xend_internal.c @@ -2369,7 +2369,7 @@ xenDaemonDomainGetVcpusFlags(virDomainPtr domain, unsigned int flags) * @domain: pointer to domain object, or NULL for Domain0 * @info: pointer to an array of virVcpuInfo structures (OUT) * @maxinfo: number of structures in info array - * @cpumaps: pointer to an bit map of real CPUs for all vcpus of this domain (in 8-bit bytes) (OUT) + * @cpumaps: pointer to a bit map of real CPUs for all vcpus of this domain (in 8-bit bytes) (OUT) * If cpumaps is NULL, then no cpumap information is returned by the API. * It's assumed there is <maxinfo> cpumap in cpumaps array. * The memory allocated to cpumaps must be (maxinfo * maplen) bytes diff --git a/src/xen/xs_internal.c b/src/xen/xs_internal.c index 21018fd..a28e6cc 100644 --- a/src/xen/xs_internal.c +++ b/src/xen/xs_internal.c @@ -355,7 +355,7 @@ xenStoreClose(virConnectPtr conn) * @domain: pointer to the domain block * @info: the place where information should be stored * - * Do an hypervisor call to get the related set of domain information. + * Do a hypervisor call to get the related set of domain information. * * Returns 0 in case of success, -1 in case of error. */ diff --git a/tools/virsh.c b/tools/virsh.c index be4df58..d02be5c 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -13233,7 +13233,7 @@ cmdCPUBaseline(vshControl *ctl, const vshCmd *cmd) if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) return false; - /* add an separate container around the xml */ + /* add a separate container around the xml */ virBufferStrcat(&buf, "<container>", buffer, "</container>", NULL); if (virBufferError(&buf)) goto no_memory; -- 1.7.7.3

1 0

[libvirt] [PATCH 0/2] patch pings
by Eric Blake 04 Dec '11

04 Dec '11

These are random patches in my tree that I've previously posted with no review, but which I think are useful for inclusion in 0.9.8. Eric Blake (2): command: handle empty buffer argument correctly build: require more tools from maintainers bootstrap.conf | 15 +++++++++++++++ src/util/command.c | 13 ++++++++++++- tests/commanddata/test9.log | 4 +++- tests/commandtest.c | 13 ++++++++++++- 4 files changed, 42 insertions(+), 3 deletions(-) -- 1.7.7.3

2 6

[libvirt] [PATCH] build: fix build at -O2 on rawhide
by Eric Blake 02 Dec '11

02 Dec '11

I had previously tested commit 059d746 with -O intentionally omitted from my CFLAGS; but that means that I missed out on this warning from gcc 4.6.2 when optimizations are enabled: util/buf.c: In function 'virBufferGetIndent': util/buf.c:86:1: error: function might be candidate for attribute 'pure' [-Werror=suggest-attribute=pure] While it is probably a good idea to add the attributes and silence this warning, it's also invasive; 'make -k' found more than 75 such complaints. And it doesn't help that gcc 4.6.2 is still buggy (coreutils reported a case where gcc 4.6.2 incorrectly suggested marking a function pure that incremented a global variable; fixed in gcc 4.7). So the best fix for now is to disable the warning. It also doesn't help that I stumbled across another problem - gcc documents that -Wsuggest-attribute=pure only warns if you use -O, or if you use -fipa-pure-const. But in practice, when I omitted -O but added -fipa-pure-const, the warnings are fickle - I got warnings for simple compilation that disappeared when I also added -fPIC. And the way libtool compiles things is with -fPIC first, then without -fPIC but with errors sent to /dev/null - which meant that without disabling -Wsuggest-attribute=pure, I got a compile error with no message. :( See http://debbugs.gnu.org/cgi/bugreport.cgi?bug=10197 * m4/virt-compile-warnings.m4 (LIBVIRT_COMPILE_WARNINGS): Silence -Wsuggest-attribute warnings for now. --- Pushing under the build-breaker rule. m4/virt-compile-warnings.m4 | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) diff --git a/m4/virt-compile-warnings.m4 b/m4/virt-compile-warnings.m4 index 213b3db..34a89c9 100644 --- a/m4/virt-compile-warnings.m4 +++ b/m4/virt-compile-warnings.m4 @@ -116,2 +116,2 @@ AC_DEFUN([LIBVIRT_COMPILE_WARNINGS],[ gl_WARN_ADD([-fdiagnostics-show-option]) gl_WARN_ADD([-funit-at-a-time]) + # Need -fipa-pure-const in order to make -Wsuggest-attribute=pure + # fire even without -O. + gl_WARN_ADD([-fipa-pure-const]) + # We should eventually enable this, but right now there are at + # least 75 functions triggering warnings. + gl_WARN_ADD([-Wno-suggest-attribute=pure]) + gl_WARN_ADD([-Wno-suggest-attribute=const]) + if test "$enable_compile_warnings" = "error" then gl_WARN_ADD([-Werror]) -- 1.7.7.3

1 0

[libvirt] [PATCH 1/1] apparmor: allow tunnelled migrations.
by Serge Hallyn 02 Dec '11

02 Dec '11

The pathname for the pipe for tunnelled migration is unresolvable. The libvirt apparmor driver therefore refuses access, causing migration to fail. If we can't resolve the path, the worst that can happen is that we should have given permission to the file but didn't. Otherwise (especially since this is a /proc/$$/fd/N file) the file is already open and libvirt won't be refused access by apparmor anyway. Also adjust virt-aa-helper to allow access to the *.tunnelmigrate.dest.name files. Changelog: Dec 2: per jdstrand comment, also change the Error to a VIR_WARN. For more information, see https://launchpad.net/bugs/869553. Signed-off-by: Serge Hallyn <serge.hallyn(a)canonical.com> --- src/security/security_apparmor.c | 6 +++--- src/security/virt-aa-helper.c | 4 ++++ 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index 299dcc6..5e68da8 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -791,9 +791,9 @@ AppArmorSetImageFDLabel(virSecurityManagerPtr mgr, } if (virFileResolveLink(proc, &fd_path) < 0) { - virSecurityReportError(VIR_ERR_INTERNAL_ERROR, - "%s", _("could not find path for descriptor")); - return rc; + /* it's a deleted file, presumably. Ignore? */ + VIR_WARN("could not find path for descriptor %s, skipping", proc); + return 0; } return reload_profile(mgr, vm, fd_path, true); diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 14399cc..4561bb9 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1220,6 +1220,10 @@ main(int argc, char **argv) LOCALSTATEDIR, ctl->def->name); virBufferAsprintf(&buf, " \"/run/libvirt/**/%s.pid\" rwk,\n", ctl->def->name); + virBufferAsprintf(&buf, " \"%s/run/libvirt/**/*.tunnelmigrate.dest.%s\" rw,\n", + LOCALSTATEDIR, ctl->def->name); + virBufferAsprintf(&buf, " \"/run/libvirt/**/*.tunnelmigrate.dest.%s\" rw,\n", + ctl->def->name); if (ctl->files) virBufferAdd(&buf, ctl->files, -1); } -- 1.7.5.4

3 2

[libvirt] [PATCH] [TCK] nwfilter:Follow changes to clean-traffic filter
by Stefan Berger 02 Dec '11

02 Dec '11

Follow the changes to the clean-traffic filter to pass the nwfilter tests. --- scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat | 33 +++++++---------- 1 file changed, 15 insertions(+), 18 deletions(-) Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat =================================================================== --- libvirt-tck.orig/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat @@ -3,34 +3,31 @@ #ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" -o vnet0 -j libvirt-O-vnet0 #ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" --p IPv4 -j I-vnet0-ipv4 --p ARP -j I-vnet0-arp +-j I-vnet0-mac +-p IPv4 -j I-vnet0-ipv4-ip +-p IPv4 -j ACCEPT +-p ARP -j I-vnet0-arp-mac +-p ARP -j I-vnet0-arp-ip +-p ARP -j ACCEPT -p 0x8035 -j I-vnet0-rarp -p 0x835 -j ACCEPT -j DROP #ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" -p IPv4 -j O-vnet0-ipv4 --p ARP -j O-vnet0-arp +-p ARP -j ACCEPT -p 0x8035 -j O-vnet0-rarp -j DROP -#ebtables -t nat -L I-vnet0-ipv4 | grep -v "^Bridge" | grep -v "^$" --s ! 52:54:0:9f:33:da -j DROP --p IPv4 --ip-src ! 10.1.1.1 -j DROP +#ebtables -t nat -L I-vnet0-ipv4-ip | grep -v "^Bridge" | grep -v "^$" +-p IPv4 --ip-src 0.0.0.0 --ip-proto udp --ip-sport 68 -j ACCEPT +-p IPv4 --ip-src 10.1.1.1 -j RETURN +-j DROP #ebtables -t nat -L O-vnet0-ipv4 | grep -v "^Bridge" | grep -v "^$" -j ACCEPT -#ebtables -t nat -L I-vnet0-arp | grep -v "^Bridge" | grep -v "^$" --s ! 52:54:0:9f:33:da -j DROP --p ARP --arp-mac-src ! 52:54:0:9f:33:da -j DROP --p ARP --arp-ip-src ! 10.1.1.1 -j DROP --p ARP --arp-op Request -j ACCEPT --p ARP --arp-op Reply -j ACCEPT +#ebtables -t nat -L I-vnet0-arp-mac | grep -v "^Bridge" | grep -v "^$" +-p ARP --arp-mac-src 52:54:0:9f:33:da -j RETURN -j DROP -#ebtables -t nat -L O-vnet0-arp | grep -v "^Bridge" | grep -v "^$" --p ARP --arp-gratuitous -j ACCEPT --p ARP --arp-op Reply --arp-mac-dst ! 52:54:0:9f:33:da -j DROP --p ARP --arp-ip-dst ! 10.1.1.1 -j DROP --p ARP --arp-op Request -j ACCEPT --p ARP --arp-op Reply -j ACCEPT +#ebtables -t nat -L I-vnet0-arp-ip | grep -v "^Bridge" | grep -v "^$" +-p ARP --arp-ip-src 10.1.1.1 -j RETURN -j DROP #ip6tables -L FI-vnet0 -n Chain FI-vnet0 (1 references)

2 2

[libvirt] [PATCH] client: Check if other thread claims it has the buck before claiming it.
by Peter Krempa 02 Dec '11

02 Dec '11

Originaly, the code checked if another client is the queue and infered ownership of the buck from that. Commit fa9595003d043df9f2efe95521c008 added a separate variable to track the buck. That caused, that a new call might enter claiming it has the buck, while another thread was signalled to take the buck. This ends in two threads claiming they hold the buck and entering poll(). This happens due to a race on waking up threads on the client lock mutex. This caused multi-threaded clients to hang, most prominently visible and reproducible on python based clients, like virt-manager. This patch causes threads, that have been signalled to take the buck to re-check if buck is held by another thread. --- src/rpc/virnetclient.c | 9 ++++++++- 1 files changed, 8 insertions(+), 1 deletions(-) diff --git a/src/rpc/virnetclient.c b/src/rpc/virnetclient.c index 5165c8d..07d8a60 100644 --- a/src/rpc/virnetclient.c +++ b/src/rpc/virnetclient.c @@ -1545,6 +1545,7 @@ static int virNetClientIO(virNetClientPtr client, virNetClientCallQueue(&client->waitDispatch, thiscall); /* Check to see if another thread is dispatching */ +recheck: if (client->haveTheBuck) { char ignore = 1; @@ -1592,7 +1593,13 @@ static int virNetClientIO(virNetClientPtr client, goto cleanup; } - /* Grr, someone passed the buck onto us ... */ + /* Grr, someone might have passed the buck onto us ... */ + + /* We need to re-check if the buck has been passed to this thread + * as this thread might have been signalled to wake up, but the another + * call might acquire the lock before this thread manages to wake up. + * This could cause that two threads claim they have the buck */ + goto recheck; } VIR_DEBUG("We have the buck %p %p", client->waitDispatch, thiscall); -- 1.7.3.4

2 2

[libvirt] [RFC v3 PATCH 0/5] PowerPC : Extend libvirt for the PowerPC-KVM platform
by Prerna Saxena 02 Dec '11

02 Dec '11

Recent development in KVM for 64-bit Power ISA Book3S machines, allows users to run multiple KVM guest instances on POWER7 and PPC970 processor based systems. Also qemu-system-ppc64 has been enhanced to support a new machine type "pseries" suitable for Power Book3S machines. This addition effectively brings the KVM+qemu combination to run multiple guest instances on a Power Book3S machine. Libvirt continues to be the key interface to configure and manage the KVM guest instances on x86. This patch set is an effort to enable libvirt to support KVM guest configuration and management on Power Book3S machines. Based on community discussion around the earlier version, this patch series augments the present 'kvm' driver to support PowerPC-KVM based guests.Since some of the supported devices vary between architectures, libvirt must be capable of choosing supported device backends and defaults for each architecture in qemu. To check if qemu supports a certain feature, libvirt at present parses the -help string which is generated by running the qemu binary with the '-h' argument. This approach is gated by QEMU's inherent limitation. When generating the list of allowed options with the '-h' flags, qemu today blindly lists all options defined for any architecture/platform instead of doing any arch-specific checking. This tricks libvirt into assuming a much bigger set of host capabilities than is actually available. Ideally, it would be good to have qemu specify a list of devices for a given architecture and platform which libvirt can parse to understand supported capabilities for that guest. As a part of this patchset, there is an attempt to cleanly bifurcate libvirt code and to remove x86-specific assumptions from generic qemu commandline code. Series Description: ------------------- This patch series consists of 5 patches : Patch 1/5 : Use sysfs to gather host topology in place of /proc/cpuinfo. Patch 2/5 : Add PowerPC CPU Driver Patch 3/5 : Add support for qemu-system-ppc64 Patch 4/5 : Clean up x86-specific assumptions from generic qemu code. Patch 5/5 : Add address family "spapr-vio" Changelog: --------- ** v1->v2 : * Patches 1,2,3 unchanged ; The hacks in Patch 4 of v1 replaced by a new patch to neatly select arch-specific features. ** v2->v3 : * Patches 1,2,3 have minor cleanups ; Patch 4 no longer has an arch-specific handler routine. It is now replaced by a much simpler patch that merely removes x86/pc-specific assumptions from libvirt. ** v3->v4 : * Patches 1,2,3,4 unchanged ; patch 5 is a new addition from Michael Ellerman that adds a new device-tree based addressing mechanism for the 'pseries' guest. -- Prerna Saxena Linux Technology Centre, IBM Systems and Technology Lab, Bangalore, India

5 24

[libvirt] [RFC v4 PATCH 0/5] PowerPC : Extend libvirt to use PowerPC-KVM platform
by Prerna Saxena 02 Dec '11

02 Dec '11

Libvirt continues to be the key interface to configure and manage the KVM guest instances on x86. This patch set is an effort to enable libvirt to support KVM guest configuration and management on Power Book3S machines. Based on community discussion around the earlier version, this patch series augments the present 'kvm' driver to support PowerPC-KVM based guests. With the CPU driver for PowerPC already merged, this patch series adds on clean-ups, and some test cases as suggested. This series mostly focuses on cleanup and addition of testcases for base- powerpc patches. The patches for enabling spapr-vio based addressing would be sent out shortly, with the right domain schema additions. Series description: ------------------- Patch 1/5 : Use sysfs to decipher cpu topology information. Patch 2/5 : Modify the tests/nodeinfotest.c to use sysfs in addition to proc/cpuinfo. Patch 3/5 : Add support for ppc64 qemu Patch 4/5 : Clean up qemuBuildCommandLine to remove x86-specific assumptions. Patch 5/5 : Add ppc64 specific definitions to domain.rng Changelog: ---------- ** v1->v2 : * Patches 1,2,3 unchanged ; The hacks in Patch 4 of v1 replaced by a new patch to neatly select arch-specific features. ** v2->v3 : * Patches 1,2,3 have minor cleanups ; Patch 4 no longer has an arch-specific handler routine. It is now replaced by a much simpler patch that merely removes x86/pc-specific assumptions from libvirt. Patch 5 is a new addition from Michael Ellerman that adds a new device-tree based addressing mechanism for the 'pseries' guest. ** v3->v4 : * Patch 1 has minor cleanups, Patch 2 is a new addition that introduces test cases for patch 1. Patch 3,4 also have minor cleanups Patch 5 is a new addition, it contains ppc64 specific definitions to domain.rng -- Prerna Saxena Linux Technology Centre, IBM Systems and Technology Lab, Bangalore, India

3 13

[libvirt] [PATCH] nwfilter: Update of filters to handle multiple IP addresses
by Stefan Berger 02 Dec '11

02 Dec '11

With fragments borrowed from David Steven's previous submission and some further modifications: A set of modifications to existing filters to handle multiple IP addresses (and MAC addresses) per interface. Also: - enable DHCP traffic from VM to any DHCP server - will require an update to a libvirt-tck data file Signed-off-by: David L Stevens <dlstevens(a)us.ibm.com> Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- examples/xml/nwfilter/Makefile.am | 2 + examples/xml/nwfilter/clean-traffic.xml | 12 +++++++- examples/xml/nwfilter/no-arp-ip-spoofing.xml | 9 ++++++ examples/xml/nwfilter/no-arp-mac-spoofing.xml | 7 ++++ examples/xml/nwfilter/no-arp-spoofing.xml | 38 ++------------------------ examples/xml/nwfilter/no-ip-spoofing.xml | 17 ++++++++--- examples/xml/nwfilter/no-mac-spoofing.xml | 11 +++++-- 7 files changed, 52 insertions(+), 44 deletions(-) Index: libvirt-acl/examples/xml/nwfilter/Makefile.am =================================================================== --- libvirt-acl.orig/examples/xml/nwfilter/Makefile.am +++ libvirt-acl/examples/xml/nwfilter/Makefile.am @@ -9,6 +9,8 @@ FILTERS = \ allow-ipv4.xml \ clean-traffic.xml \ no-arp-spoofing.xml \ + no-arp-ip-spoofing.xml \ + no-arp-mac-spoofing.xml \ no-ip-multicast.xml \ no-ip-spoofing.xml \ no-mac-broadcast.xml \ Index: libvirt-acl/examples/xml/nwfilter/no-arp-ip-spoofing.xml =================================================================== --- /dev/null +++ libvirt-acl/examples/xml/nwfilter/no-arp-ip-spoofing.xml @@ -0,0 +1,9 @@ +<filter name='no-arp-ip-spoofing' chain='arp-ip' priority='-510'> +  +  + <rule action='return' direction='out' priority='400' > + <arp match='yes' arpsrcipaddr='$IP' /> + </rule> +  + <rule action='drop' direction='out' priority='1000' /> +</filter> Index: libvirt-acl/examples/xml/nwfilter/no-arp-mac-spoofing.xml =================================================================== --- /dev/null +++ libvirt-acl/examples/xml/nwfilter/no-arp-mac-spoofing.xml @@ -0,0 +1,7 @@ +<filter name='no-arp-mac-spoofing' chain='arp-mac' priority='-520'> + <rule action='return' direction='out' priority='350' > + <arp match='yes' arpsrcmacaddr='$MAC'/> + </rule> +  + <rule action='drop' direction='out' priority='1000' /> +</filter> Index: libvirt-acl/examples/xml/nwfilter/clean-traffic.xml =================================================================== --- libvirt-acl.orig/examples/xml/nwfilter/clean-traffic.xml +++ libvirt-acl/examples/xml/nwfilter/clean-traffic.xml @@ -1,4 +1,4 @@ -<filter name='clean-traffic'> +<filter name='clean-traffic' chain='root'>  @@ -6,11 +6,21 @@  <filterref filter='no-ip-spoofing'/> + + <rule direction='out' action='accept' priority='-650'> + <mac protocolid='ipv4'/> + </rule> + <filterref filter='allow-incoming-ipv4'/>  <filterref filter='no-arp-spoofing'/> +  + <rule action='accept' direction='inout' priority='-500'> + <mac protocolid='arp'/> + </rule> +  <filterref filter='no-other-l2-traffic'/> Index: libvirt-acl/examples/xml/nwfilter/no-mac-spoofing.xml =================================================================== --- libvirt-acl.orig/examples/xml/nwfilter/no-mac-spoofing.xml +++ libvirt-acl/examples/xml/nwfilter/no-mac-spoofing.xml @@ -1,5 +1,10 @@ -<filter name='no-mac-spoofing' chain='ipv4'> - <rule action='drop' direction='out' priority='10'> - <mac match='no' srcmacaddr='$MAC' /> +<filter name='no-mac-spoofing' chain='mac' priority='-800'> +  + <rule direction='out' action='return'> + <mac srcmacaddr='$MAC'/> + </rule> +  + <rule direction='out' action='drop'> + <mac/> </rule> </filter> Index: libvirt-acl/examples/xml/nwfilter/no-arp-spoofing.xml =================================================================== --- libvirt-acl.orig/examples/xml/nwfilter/no-arp-spoofing.xml +++ libvirt-acl/examples/xml/nwfilter/no-arp-spoofing.xml @@ -1,36 +1,4 @@ -<filter name='no-arp-spoofing' chain='arp'> - <uuid>f88f1932-debf-4aa1-9fbe-f10d3aa4bc95</uuid> - <rule action='drop' direction='out' priority='300' > - <mac match='no' srcmacaddr='$MAC'/> - </rule> - -  -  - <rule action='drop' direction='out' priority='350' > - <arp match='no' arpsrcmacaddr='$MAC'/> - </rule> - <rule action='drop' direction='out' priority='400' > - <arp match='no' arpsrcipaddr='$IP' /> - </rule> -  - <rule action='accept' direction='in' priority='425'> - <arp gratuitous='true'/> - </rule> -  - <rule action='drop' direction='in' priority='450' > - <arp match='no' arpdstmacaddr='$MAC'/> - <arp opcode='reply'/> - </rule> - <rule action='drop' direction='in' priority='500' > - <arp match='no' arpdstipaddr='$IP' /> - </rule> -  - <rule action='accept' direction='inout' priority='600' > - <arp opcode='request'/> - </rule> - <rule action='accept' direction='inout' priority='650' > - <arp opcode='reply'/> - </rule> -  - <rule action='drop' direction='inout' priority='1000' /> +<filter name='no-arp-spoofing' chain='root'> + <filterref filter='no-arp-mac-spoofing'/> + <filterref filter='no-arp-ip-spoofing'/> </filter> Index: libvirt-acl/examples/xml/nwfilter/no-ip-spoofing.xml =================================================================== --- libvirt-acl.orig/examples/xml/nwfilter/no-ip-spoofing.xml +++ libvirt-acl/examples/xml/nwfilter/no-ip-spoofing.xml @@ -1,7 +1,14 @@ -<filter name='no-ip-spoofing' chain='ipv4'> +<filter name='no-ip-spoofing' chain='ipv4-ip' priority='-710'> +  + <rule action='accept' direction='out' priority='100'> + <ip srcipaddr='0.0.0.0' protocol='udp' srcportstart='68' srcportend='68'/> + </rule> -  - <rule action='drop' direction='out'> - <ip match='no' srcipaddr='$IP' /> - </rule> +  + <rule direction='out' action='return' priority='500'> + <ip srcipaddr='$IP'/> + </rule> + +  + <rule direction='out' action='drop' priority='1000'/> </filter>

2 3

[libvirt] [PATCH] virsh: translate net-info help
by Eric Blake 02 Dec '11

02 Dec '11

Reported by kato.tomoyuki(a)jp.fujitsu.com at https://bugzilla.redhat.com/show_bug.cgi?id=749564 * tools/virsh.c (info_network_info): Mark string for translation. --- Pushing under the trivial rule. tools/virsh.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index ff9cc42..be4df58 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -6650,7 +6650,7 @@ cmdNetworkDumpXML(vshControl *ctl, const vshCmd *cmd) */ static const vshCmdInfo info_network_info[] = { {"help", N_("network information")}, - {"desc", "Returns basic information about the network"}, + {"desc", N_("Returns basic information about the network")}, {NULL, NULL} }; -- 1.7.7.3

1 0