- Devel - libvirt List Archives

[libvirt] flaky network on clients/guests machines - please help!
by Horten 19 Jul '10

19 Jul '10

I've set up a redhat ( Linux 2.6.18-194.8.1.el5 #1 SMP Wed Jun 23 10:52:51 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux) box and two virtual hosts (clients/guests). The network on the host is fine, however the clients network is extremely flaky....Sometimes it connects into and out of the client, but sometimes it gives me all sorts of timeout, no route, etc messages....I've tried everything I can think of, turning on dnsmasq, nscd, and adding options single-request in resolv.conf, but nothing seems to work. The client machines are running the same os as the host....Please see below results of running strace on ssh to another machine....(I can ssh to this other machine from the host and from any other machine and at times from the clients)...Any help will be greatly appreciated..... [root@testbedwww ~]# strace ssh phys.lsu.edu execve("/usr/bin/ssh", ["ssh", "phys.lsu.edu"], [/* 22 vars */]) = 0 brk(0) = 0x2acb61bee000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acb46ece000 uname({sys="Linux", node="testbedwww.phys.lsu.edu", ...}) = 0 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=100036, ...}) = 0 mmap(NULL, 100036, PROT_READ, MAP_PRIVATE, 3, 0) = 0x2acb46ecf000 close(3) = 0 open("/usr/lib64/libfipscheck.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\n`\2344\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=8904, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acb46ee8000 mmap(NULL, 2102008, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb470cf000 mprotect(0x2acb470d1000, 2093056, PROT_NONE) = 0 mmap(0x2acb472d0000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0x2acb472d0000 close(3) = 0 open("/lib64/libcrypto.so.6", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\200\232\345\2404\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=1366272, ...}) = 0 mmap(NULL, 3475344, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb472d1000 mprotect(0x2acb473fe000, 2093056, PROT_NONE) = 0 mmap(0x2acb475fd000, 135168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x12c000) = 0x2acb475fd000 mmap(0x2acb4761e000, 14224, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x2acb4761e000 close(3) = 0 open("/lib64/libutil.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\200\16\300\2514\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=18152, ...}) = 0 mmap(NULL, 2105616, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb47622000 mprotect(0x2acb47624000, 2093056, PROT_NONE) = 0 mmap(0x2acb47823000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0x2acb47823000 close(3) = 0 open("/usr/lib64/libz.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\37 \2354\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=85928, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acb47825000 mmap(NULL, 2178920, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb47826000 mprotect(0x2acb4783a000, 2093056, PROT_NONE) = 0 mmap(0x2acb47a39000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x13000) = 0x2acb47a39000 close(3) = 0 open("/lib64/libnsl.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240@ \2374\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=114352, ...}) = 0 mmap(NULL, 2194096, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb47a3a000 mprotect(0x2acb47a4f000, 2093056, PROT_NONE) = 0 mmap(0x2acb47c4e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14000) = 0x2acb47c4e000 mmap(0x2acb47c50000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x2acb47c50000 close(3) = 0 open("/lib64/libcrypt.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\t\300\2544\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=48600, ...}) = 0 mmap(NULL, 2322880, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb47c52000 mprotect(0x2acb47c5b000, 2093056, PROT_NONE) = 0 mmap(0x2acb47e5a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x8000) = 0x2acb47e5a000 mmap(0x2acb47e5c000, 184768, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x2acb47e5c000 close(3) = 0 open("/lib64/libresolv.so.2", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\2402`\2414\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=92736, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acb47e8a000 mmap(NULL, 2181864, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb47e8b000 mprotect(0x2acb47e9c000, 2097152, PROT_NONE) = 0 mmap(0x2acb4809c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x11000) = 0x2acb4809c000 mmap(0x2acb4809e000, 6888, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x2acb4809e000 close(3) = 0 open("/usr/lib64/libgssapi_krb5.so.2", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\222\240\2454\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=190976, ...}) = 0 mmap(NULL, 2283888, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb480a0000 mprotect(0x2acb480cc000, 2097152, PROT_NONE) = 0 mmap(0x2acb482cc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2c000) = 0x2acb482cc000 close(3) = 0 open("/usr/lib64/libkrb5.so.3", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\221!\2424\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=613896, ...}) = 0 mmap(NULL, 2706624, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb482ce000 mprotect(0x2acb4835f000, 2097152, PROT_NONE) = 0 mmap(0x2acb4855f000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x91000) = 0x2acb4855f000 close(3) = 0 open("/usr/lib64/libk5crypto.so.3", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260V\340\2454\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=153624, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acb48563000 mmap(NULL, 2247432, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb48564000 mprotect(0x2acb48588000, 2093056, PROT_NONE) = 0 mmap(0x2acb48787000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x23000) = 0x2acb48787000 close(3) = 0 open("/lib64/libcom_err.so.2", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\n\240\2414\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=10000, ...}) = 0 mmap(NULL, 2103048, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb48789000 mprotect(0x2acb4878b000, 2093056, PROT_NONE) = 0 mmap(0x2acb4898a000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0x2acb4898a000 close(3) = 0 open("/usr/lib64/libnss3.so", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260\203\301\2574\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=1230520, ...}) = 0 mmap(NULL, 3329096, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb4898b000 mprotect(0x2acb48ab1000, 2093056, PROT_NONE) = 0 mmap(0x2acb48cb0000, 28672, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x125000) = 0x2acb48cb0000 mmap(0x2acb48cb7000, 3144, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x2acb48cb7000 close(3) = 0 open("/lib64/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\332!\2344\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=1717800, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acb48cb8000 mmap(NULL, 3498328, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb48cb9000 mprotect(0x2acb48e07000, 2093056, PROT_NONE) = 0 mmap(0x2acb49006000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14d000) = 0x2acb49006000 mmap(0x2acb4900b000, 16728, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x2acb4900b000 close(3) = 0 open("/usr/lib64/libplc4.so", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\23\0\2604\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=18024, ...}) = 0 mmap(NULL, 2110936, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb49010000 mprotect(0x2acb49014000, 2093056, PROT_NONE) = 0 mmap(0x2acb49213000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x2acb49213000 close(3) = 0 open("/lib64/libdl.so.2", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\240\2344\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=23360, ...}) = 0 mmap(NULL, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb49214000 mprotect(0x2acb49216000, 2097152, PROT_NONE) = 0 mmap(0x2acb49416000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x2acb49416000 close(3) = 0 open("/usr/lib64/libkrb5support.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\200\"\240\2434\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=35728, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acb49418000 mmap(NULL, 2128592, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb49419000 mprotect(0x2acb49421000, 2093056, PROT_NONE) = 0 mmap(0x2acb49620000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7000) = 0x2acb49620000 close(3) = 0 open("/lib64/libkeyutils.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\v \2434\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=9728, ...}) = 0 mmap(NULL, 2102672, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb49621000 mprotect(0x2acb49623000, 2093056, PROT_NONE) = 0 mmap(0x2acb49822000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0x2acb49822000 close(3) = 0 open("/usr/lib64/libnssutil3.so", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\203@\2574\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=122184, ...}) = 0 mmap(NULL, 2216376, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb49823000 mprotect(0x2acb4983c000, 2093056, PROT_NONE) = 0 mmap(0x2acb49a3b000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x18000) = 0x2acb49a3b000 mmap(0x2acb49a40000, 440, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x2acb49a40000 close(3) = 0 open("/usr/lib64/libplds4.so", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\0\2574\0\0\0"..., 832) = 832 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acb49a41000 fstat(3, {st_mode=S_IFREG|0755, st_size=13800, ...}) = 0 mmap(NULL, 2106736, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb49a42000 mprotect(0x2acb49a45000, 2093056, PROT_NONE) = 0 mmap(0x2acb49c44000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x2acb49c44000 close(3) = 0 open("/usr/lib64/libnspr4.so", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0000\317\200\2574\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=233144, ...}) = 0 mmap(NULL, 2336608, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb49c45000 mprotect(0x2acb49c7b000, 2097152, PROT_NONE) = 0 mmap(0x2acb49e7b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x36000) = 0x2acb49e7b000 mmap(0x2acb49e7d000, 10080, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x2acb49e7d000 close(3) = 0 open("/lib64/libpthread.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240W\340\2344\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=145824, ...}) = 0 mmap(NULL, 2204528, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb49e80000 mprotect(0x2acb49e96000, 2093056, PROT_NONE) = 0 mmap(0x2acb4a095000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x15000) = 0x2acb4a095000 mmap(0x2acb4a097000, 13168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x2acb4a097000 close(3) = 0 open("/lib64/libselinux.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`E\340\2354\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=95464, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acb4a09b000 mmap(NULL, 2192784, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb4a09c000 mprotect(0x2acb4a0b1000, 2097152, PROT_NONE) = 0 mmap(0x2acb4a2b1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x15000) = 0x2acb4a2b1000 mmap(0x2acb4a2b3000, 1424, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x2acb4a2b3000 close(3) = 0 open("/lib64/libsepol.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@=\240\2354\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=247496, ...}) = 0 mmap(NULL, 2383168, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb4a2b4000 mprotect(0x2acb4a2ef000, 2097152, PROT_NONE) = 0 mmap(0x2acb4a4ef000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3b000) = 0x2acb4a4ef000 mmap(0x2acb4a4f0000, 40256, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x2acb4a4f0000 close(3) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acb4a4fa000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acb4a4fb000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acb4a4fc000 arch_prctl(ARCH_SET_FS, 0x2acb4a4fbd00) = 0 mprotect(0x2acb4a095000, 4096, PROT_READ) = 0 mprotect(0x2acb49416000, 4096, PROT_READ) = 0 mprotect(0x2acb49006000, 16384, PROT_READ) = 0 mprotect(0x2acb4809c000, 4096, PROT_READ) = 0 mprotect(0x2acb47e5a000, 4096, PROT_READ) = 0 mprotect(0x2acb47c4e000, 4096, PROT_READ) = 0 mprotect(0x2acb47823000, 4096, PROT_READ) = 0 mprotect(0x2acb470cd000, 4096, PROT_READ) = 0 munmap(0x2acb46ecf000, 100036) = 0 set_tid_address(0x2acb4a4fbd90) = 3475 set_robust_list(0x2acb4a4fbda0, 0x18) = 0 futex(0x7fff3317641c, FUTEX_WAKE_PRIVATE, 1) = 0 rt_sigaction(SIGRTMIN, {0x2acb49e85380, [], SA_RESTORER|SA_SIGINFO, 0x2acb49e8eb10}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {0x2acb49e852b0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x2acb49e8eb10}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM_INFINITY}) = 0 access("/etc/selinux/", F_OK) = 0 brk(0) = 0x2acb61bee000 brk(0x2acb61c0f000) = 0x2acb61c0f000 open("/etc/selinux/config", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=448, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acb46ecf000 read(3, "# This file controls the state o"..., 4096) = 448 read(3, "", 4096) = 0 close(3) = 0 munmap(0x2acb46ecf000, 4096) = 0 open("/proc/mounts", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acb46ecf000 read(3, "rootfs / rootfs rw 0 0\n/dev/root"..., 4096) = 577 close(3) = 0 munmap(0x2acb46ecf000, 4096) = 0 open("/selinux/mls", O_RDONLY) = 3 read(3, "1", 19) = 1 close(3) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 3 connect(3, {sa_family=AF_FILE, path="/var/run/setrans/.setrans-unix"...}, 110) = 0 sendmsg(3, {msg_name(0)=NULL, msg_iov(5)=[{"\1\0\0\0", 4}, {"\1\0\0\0", 4}, {"\1\0\0\0", 4}, {"\0", 1}, {"\0", 1}], msg_controllen=0, msg_flags=0}, MSG_NOSIGNAL) = 14 readv(3, [{"\1\0\0\0", 4}, {"\1\0\0\0", 4}, {"\0\0\0\0", 4}], 3) = 12 readv(3, [{"\0", 1}], 1) = 1 close(3) = 0 open("/dev/null", O_RDWR) = 3 close(3) = 0 open("/proc/sys/crypto/fips_enabled", O_RDONLY) = 3 read(3, "0\n", 2) = 2 close(3) = 0 getuid() = 0 geteuid() = 0 setresuid(-1, 0, -1) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 3 fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 connect(3, {sa_family=AF_FILE, path="/var/run/nscd/socket"...}, 110) = 0 sendto(3, "\2\0\0\0\v\0\0\0\7\0\0\0passwd\0", 19, MSG_NOSIGNAL, NULL, 0) = 19 poll([{fd=3, events=POLLIN|POLLERR|POLLHUP}], 1, 5000) = 1 ([{fd=3, revents=POLLIN|POLLHUP}]) recvmsg(3, {msg_name(0)=NULL, msg_iov(2)=[{"passwd\0", 7}, {"\270O\3\0\0\0\0\0", 8}], msg_controllen=24, {cmsg_len=20, cmsg_level=SOL_SOCKET, cmsg_type=SCM_RIGHTS, {4}}, msg_flags=0}, 0) = 15 mmap(NULL, 217016, PROT_READ, MAP_SHARED, 4, 0) = 0x2acb46ee9000 close(4) = 0 close(3) = 0 umask(022) = 022 ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 open("/root/.ssh/config", O_RDONLY) = -1 ENOENT (No such file or directory) open("/etc/ssh/ssh_config", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=1827, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acb46f1e000 read(3, "#\t$OpenBSD: ssh_config,v 1.21 20"..., 4096) = 1827 read(3, "", 4096) = 0 close(3) = 0 munmap(0x2acb46f1e000, 4096) = 0 open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 3 fstat(3, {st_mode=S_IFCHR|0444, st_rdev=makedev(1, 9), ...}) = 0 poll([{fd=3, events=POLLIN}], 1, 10) = 1 ([{fd=3, revents=POLLIN}]) read(3, "^\266\301\227\n!\340\267\216\317\327\204\231\247\357\224\10Q\332\227PjE5\310\6\246\273\371\225\332f"..., 48) = 48 close(3) = 0 getuid() = 0 open("/etc/nsswitch.conf", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=1696, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acb46f1e000 read(3, "#\n# /etc/nsswitch.conf\n#\n# An ex"..., 4096) = 1696 read(3, "", 4096) = 0 close(3) = 0 munmap(0x2acb46f1e000, 4096) = 0 open("/etc/ld.so.cache", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=100036, ...}) = 0 mmap(NULL, 100036, PROT_READ, MAP_PRIVATE, 3, 0) = 0x2acb46f1e000 close(3) = 0 open("/lib64/libnss_files.so.2", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\37\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=53880, ...}) = 0 mmap(NULL, 2139432, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2acb4a4fd000 mprotect(0x2acb4a507000, 2093056, PROT_NONE) = 0 mmap(0x2acb4a706000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x9000) = 0x2acb4a706000 close(3) = 0 mprotect(0x2acb4a706000, 4096, PROT_READ) = 0 munmap(0x2acb46f1e000, 100036) = 0 open("/etc/services", O_RDONLY) = 3 fcntl(3, F_GETFD) = 0 fcntl(3, F_SETFD, FD_CLOEXEC) = 0 fstat(3, {st_mode=S_IFREG|0644, st_size=362031, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2acb46f1e000 read(3, "# /etc/services:\n# $Id: services"..., 4096) = 4096 close(3) = 0 munmap(0x2acb46f1e000, 4096) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 3 fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 connect(3, {sa_family=AF_FILE, path="/var/run/nscd/socket"...}, 110) = 0 sendto(3, "\2\0\0\0\r\0\0\0\6\0\0\0hosts\0", 18, MSG_NOSIGNAL, NULL, 0) = 18 poll([{fd=3, events=POLLIN|POLLERR|POLLHUP}], 1, 5000) = 1 ([{fd=3, revents=POLLIN|POLLHUP}]) recvmsg(3, {msg_name(0)=NULL, msg_iov(2)=[{"hosts\0", 6}, {"\270O\3\0\0\0\0\0", 8}], msg_controllen=24, {cmsg_len=20, cmsg_level=SOL_SOCKET, cmsg_type=SCM_RIGHTS, {4}}, msg_flags=0}, 0) = 14 mmap(NULL, 217016, PROT_READ, MAP_SHARED, 4, 0) = 0x2acb46f1e000 close(4) = 0 close(3) = 0 socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 3 connect(3, {sa_family=AF_INET, sin_port=htons(22), sin_addr=inet_addr("130.39.13.67")}, 16) = -1 EHOSTUNREACH (No route to host) close(3) = 0 write(2, "ssh: connect to host phys.lsu.ed"..., 61ssh: connect to host phys.lsu.edu port 22: No route to host ) = 61 exit_group(255) = ? [root@testbedwww ~]#

1 0

[libvirt] Memory
by Jaromír Červenka 17 Jul '10

17 Jul '10

Hello, Could anybody explain me a little bit what is the difference between <currentMemory> and <maxMemory>. I use qemu-kvm hypervisor*. *When I have 1024MB maxMemory and 512MB of currentMemory, I can see just 512MB in guest os (free -m).* *Is it ok? Does it have something to do with ballooning technique? What happened if guest will needs more memory than 512MB? Thank you for answers :) Kind regards, Jaromír Červenka Official openSUSE community member Web: http://www.cervajz.com/ Jabber: cervajz(a)cervajz.com MSN: jara.cervenka(a)seznam.cz Tel.: +420 607 592 687 Alt. e-mails: jaromir.cervenka(a)opensuse.org, jaromir.cervenka(a)speel.cz

2 3

[libvirt] [PATCH] libvirtd: add man page for libvirtd
by Justin Clift 17 Jul '10

17 Jul '10

From: Justin Clift <justin(a)salasaga.org> Gracious thanks to Chris Lalancette for helping knock the description section into shape. This addresses BZ #595350 https://bugzilla.redhat.com/show_bug.cgi?id=595350 --- daemon/Makefile.am | 40 +++++++++++- daemon/libvirtd.pod.in | 168 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 207 insertions(+), 1 deletions(-) create mode 100644 daemon/libvirtd.pod.in diff --git a/daemon/Makefile.am b/daemon/Makefile.am index df34ef1..332e895 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -32,9 +32,12 @@ EXTRA_DIST = \ THREADING.txt \ libvirt-guests.init.in \ libvirt-guests.sysconf \ + libvirtd.pod.in \ $(AVAHI_SOURCES) \ $(DAEMON_SOURCES) +man_MANS = libvirtd.8 + BUILT_SOURCES = if WITH_LIBVIRTD @@ -50,6 +53,41 @@ augeas_DATA = libvirtd.aug augeastestsdir = $(datadir)/augeas/lenses/tests augeastests_DATA = test_libvirtd.aug +POD2MAN = pod2man -c "Virtualization Support" -r "$(PACKAGE)-$(VERSION)" -s 8 + +if WITH_REMOTE +libvirtd.pod: libvirtd.pod.in + sed \ + -e 's![@]sysconfdir[@]!$(sysconfdir)!g' \ + -e 's![@]localstatedir[@]!$(localstatedir)!g' \ + -e 's![@]tls_line1[@]!=item F<$(sysconfdir)/pki/CA/cacert.pem>!g' \ + -e 's![@]tls_line2[@]!The TLS B<Certificate Authority> certificate libvirtd will use.!g' \ + -e 's![@]tls_line3[@]!=item F<$(sysconfdir)/pki/libvirt/servercert.pem>!g' \ + -e 's![@]tls_line4[@]!The TLS B<Server> certificate libvirtd will use.!g' \ + -e 's![@]tls_line5[@]!=item F<$(sysconfdir)/pki/libvirt/private/serverkey.pem>!g' \ + -e 's![@]tls_line6[@]!The TLS B<Server> private key libvirtd will use.!g' \ + -e 's![@]remote_pid_file[@]!$(REMOTE_PID_FILE)!g' \ + < $< > $@-t + mv $@-t $@ +else +libvirtd.pod: libvirtd.pod.in + sed \ + -e 's![@]sysconfdir[@]!$(sysconfdir)!g' \ + -e 's![@]localstatedir[@]!$(localstatedir)!g' \ + -e 's![@]tls_line1[@]!!g' \ + -e 's![@]tls_line2[@]!!g' \ + -e 's![@]tls_line3[@]!!g' \ + -e 's![@]tls_line4[@]!!g' \ + -e 's![@]tls_line5[@]!!g' \ + -e 's![@]tls_line6[@]!!g' \ + -e 's![@]remote_pid_file[@]!$(REMOTE_PID_FILE)!g' \ + < $< > $@-t + mv $@-t $@ +endif + +libvirtd.8: libvirtd.pod + $(AM_V_GEN)$(POD2MAN) $< $@ + libvirtd_SOURCES = $(DAEMON_SOURCES) #-D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_POSIX_C_SOURCE=199506L @@ -285,5 +323,5 @@ uninstall-data-sasl: endif -CLEANFILES = $(BUILT_SOURCES) +CLEANFILES = $(BUILT_SOURCES) $(man1_MANS) CLEANFILES += *.cov *.gcov .libs/*.gcda .libs/*.gcno *.gcno *.gcda diff --git a/daemon/libvirtd.pod.in b/daemon/libvirtd.pod.in new file mode 100644 index 0000000..33437c9 --- /dev/null +++ b/daemon/libvirtd.pod.in @@ -0,0 +1,168 @@ +=head1 NAME + +libvirtd - libvirtd management daemon + +=head1 SYNOPSIS + +B<libvirtd> [ -dlv ] [ -f config_file ] [ -p pid_file ] [ -t timeout_seconds ] + +B<libvirtd> --version + +=head1 DESCRIPTION + +The B<libvirtd> program is the server side daemon component of the libvirt +virtualization management system. + +This daemon runs on host servers and performs required management tasks for +virtualized guests. This includes activities such as starting, stopping +and migrating guests between host servers, configuring and manipulating +networking, and managing storage for use by guests. + +The libvirt client libraries and utilities connect to this daemon to issue +tasks and collect information about the configuration and resources of the host +system and guests. + +By default, the libvirtd daemon listens for requests on a local Unix domain +socket. Using the B<-l>|B<--listen> command line option, the libvirtd daemon +can be instructed to additionally listen on a TCP/IP socket. The TCP/IP socket +to use is defined in the libvirtd configuration file. + +Restarting libvirtd does not impact running guests. Guests continue to operate +and will be picked up automatically if their XML configuration has been +defined. Any guests whose XML configuration has not been defined will be lost +from the configuration. + +=head1 OPTIONS + +=over + +=item B<-d, --daemon> + +Run as a daemon & write PID file. + +=item B<-f, --config> I<FILE> + +Use this configuration file, overriding the default value. + +=item B<-l, --listen> + +Listen for TCP/IP connections. + +=item B<-p, --pid-file> I<FILE> + +Use this name for the PID file, overriding the default value. + +=item B<-t, --timeout> I<SECONDS> + +Exit after timeout period (in seconds) expires. + +=item B<-v, --verbose> + +Enable output of verbose messages. + +=item B< --version> + +Display version information then exit. + +=back + +=head1 SIGNALS + +On receipt of B<SIGHUP> libvirtd will reload its configuration. + +=head1 FILES + +=over + +=item F<@sysconfdir@/libvirtd.conf> + +The default configuration file used by libvirtd, unless overridden on the +command line using the B<-f>|B<--config> option. + +=item F<@localstatedir@/run/libvirt/libvirt-sock> + +=item F<@localstatedir@/run/libvirt/libvirt-sock-ro> + +The sockets libvirtd will use when B<run as root>. + +=item F<$HOME/.libvirt/libvirt-sock> + +The socket libvirtd will use when run as a B<non-root> user. + +@tls_line1@ + +@tls_line2@ + +@tls_line3@ + +@tls_line4@ + +@tls_line5@ + +@tls_line6@ + +=item F<@remote_pid_file@> + +The PID file to use, unless overridden by the B<-p>|B<--pid-file> option. + +=back + +=head1 EXAMPLES + +To retrieve the version of libvirtd: + + # libvirtd --version + libvirtd (libvirt) 0.8.2 + # + +To start libvirtd, instructing it to daemonize and create a PID file: + + # libvirtd -d + # ls -la @remote_pid_file@ + -rw-r--r-- 1 root root 6 Jul 9 02:40 @remote_pid_file@ + # + +=head1 BUGS + +Please report all bugs you discover. This should be done via either: + +=over + +=item a) the mailing list + +L<http://libvirt.org/contact.html> + +=item or, + +B<> + +=item b) the bug tracker + +L<http://libvirt.org/bugs.html> + +=item Alternatively, you may report bugs to your software distributor / vendor. + +=back + +=head1 AUTHORS + + Andrew Puch <apuch @ redhat.com> + Daniel Veillard <veillard @ redhat.com> + +=head1 COPYRIGHT + +Copyright (C) 2010 Red Hat, Inc. + +=head1 LICENSE + +libvirtd is distributed under the terms of the GNU LGPL v2.1+. +This is free software; see the source for copying conditions. There +is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR +PURPOSE + +=head1 SEE ALSO + +L<virsh(1)>, L<virt-install(1)>, L<virt-xml-validate(1)>, L<virt-top(1)>, +L<virt-mem(1)>, L<virt-df(1)>, L<http://www.libvirt.org/> + +=cut -- 1.7.1

4 17

[libvirt] FYI; pushed trivial patch
by Chris Lalancette 16 Jul '10

16 Jul '10

I've pushed the attached trivial patch to fix the compile on i686. -- Chris Lalancette

1 0

[libvirt] [PATCH] docs: remove all generated doc files when a clean target is used
by Justin Clift 16 Jul '10

16 Jul '10

Properly removes all of the generated .html and .xml files in the docs area with make clean and make maintainer-clean. Otherwise they're just left there and get in the way when working on docs. --- docs/Makefile.am | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/Makefile.am b/docs/Makefile.am index a6a6d07..463a466 100644 --- a/docs/Makefile.am +++ b/docs/Makefile.am @@ -150,10 +150,10 @@ $(python_generated_files): $(srcdir)/apibuild.py \ check-local: all clean-local: - rm -f *~ *.bak *.hierarchy *.signals *-unused.txt *.html + rm -f *~ *.bak *.hierarchy *.signals *-unused.txt *.html html/index.html \ + $(devhelphtml) $(python_generated_files) maintainer-clean-local: clean-local - rm -rf libvirt-api.xml libvirt-refs.xml rebuild: api all -- 1.7.1.1

1 0

[libvirt] [RFC] Slides for FISL presentation
by Eduardo Otubo 16 Jul '10

16 Jul '10

Hello all, This is the first draft for my presentation at FISL. I would like you to take a look and give your opinions. Any comment is always welcome :-) Thank you! https://docs.google.com/leaf?id=0B67FxRV5aa7_YWI4YzQ2MWQtZWQwYi00NjE0LWEyZD… ps.: I didn't know where to put the file, I hosted at google docs and made it public. You all should be able to download it. Any issues, please let me know. Thanks again. -- Eduardo Otubo Software Engineer Linux Technology Center IBM Systems & Technology Group Mobile: +55 19 8135 0885 eotubo(a)linux.vnet.ibm.com

2 2

[libvirt] where is "virsh pool-stop"?
by Harald Dunkel 16 Jul '10

16 Jul '10

Hi folks, Suggestion: "virsh pool-destroy" sounds highly destructive. There is a "pool-start" command, so how about "pool-stop"? Similar commands could be introduced for the other *-start commands. This would make using virsh _much_ easier. In Unix world "start" and "stop" belong together, "start" and "destroy" don't. Regards Harri

5 4

[libvirt] Segfault in virDomainObjListSearchName when listing domains (qemu backend)
by Guido Winkelmann 16 Jul '10

16 Jul '10

Hi, I'm seeing a crash in libvirt when trying to list all domains using virsh. Here's the backtrace: ===================== Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fffeebfd710 (LWP 1691)] 0x00007ffff7411746 in __strcmp_sse42 () from /lib64/libc.so.6 Missing separate debuginfos, use: debuginfo-install openssl-1.0.0a-1.fc12.x86_64 (gdb) bt #0 0x00007ffff7411746 in __strcmp_sse42 () from /lib64/libc.so.6 #1 0x00007ffff7ac9d79 in virDomainObjListSearchName (payload=0x73fdd0, name=<value optimized out>, data=0x7fffdc0008c0) at conf/domain_conf.c:367 #2 0x00007ffff7ab476e in virHashSearch (table=0x6f9c30, iter=0x7ffff7ac9d50 <virDomainObjListSearchName>, data=0x7fffdc0008c0) at util/hash.c:582 #3 0x00007ffff7ac9d33 in virDomainFindByName (doms=<value optimized out>, name=0x7fffdc0008c0 "basiccentos54image") at conf/domain_conf.c:377 #4 0x00000000004430f6 in qemudDomainLookupByName (conn=0x7fffe8000a80, name=0x7fffdc0008c0 "basiccentos54image") at qemu/qemu_driver.c:4166 #5 0x00007ffff7af95cd in virDomainLookupByName (conn=0x7fffe8000a80, name=0x7fffdc0008c0 "basiccentos54image") at libvirt.c:2169 #6 0x0000000000423e64 in remoteDispatchDomainLookupByName (server=<value optimized out>, client=<value optimized out>, conn=0x7fffe8000a80, hdr=<value optimized out>, rerr=0x7fffeebfcc70, args=<value optimized out>, ret=0x7fffeebfcbc0) at remote.c:2030 #7 0x0000000000426a91 in remoteDispatchClientCall (server=<value optimized out>, client=0x7ffff0001300, msg=0x7ffff0041570) at dispatch.c:506 #8 0x0000000000426e43 in remoteDispatchClientRequest (server=0x6e3cd0, client=0x7ffff0001300, msg=0x7ffff0041570) at dispatch.c:388 #9 0x0000000000417ed8 in qemudWorker (data=0x7ffff0000908) at libvirtd.c:1568 #10 0x00007ffff7878a3a in start_thread () from /lib64/libpthread.so.0 #11 0x00007ffff73d377d in clone () from /lib64/libc.so.6 #12 0x0000000000000000 in ?? () (gdb) ===================== This is with the newest version from git, pulled about 30 minutes ago. This happens when I try to start up one of the defined domains using either libvirt or virsh and then try to list all the defined domains in virsh using list --all. The attempt to start one of the domains already fails with the following output: ===================== virsh # start testserver-a error: Failed to start domain testserver-a error: internal error process exited while connecting to monitor: 17:21:14.760: debug : virCgroupNew:542 : New group /libvirt/qemu/testserver-a 17:21:14.760: debug : virCgroupDetect:232 : Detected mount/mapping 0:cpu at /mnt/cgroups/cpu in /sysdefault 17:21:14.760: debug : virCgroupDetect:232 : Detected mount/mapping 1:cpuacct at /mnt/cgroups/cpuacct in /sysdefault 17:21:14.760: debug : virCgroupDetect:232 : Detected mount/mapping 3:memory at /mnt/cgroups/memory in /sysdefault 17:21:14.760: debug : virCgroupDetect:232 : Detected mount/mapping 4:devices at /mnt/cgroups/devices in /sysdefault 17:21:14.760: debug : virCgroupMakeGroup:484 : Make group /libvirt/qemu/testserver-a 17:21:14.760: debug : virCgroupMakeGroup:496 : Make controller /mnt/cgroups/cpu/sysdefault/libvirt/qemu/testserver-a/ 17:21:14.760: debug : virCgroupMakeGroup:496 : Make controller /mnt/cgroups/cpuacct/sysdefault/libvirt/qemu/testserver-a/ 17:21:14.760: debug : virCgroupMakeGroup:496 : Make controller /mnt/cgroups/memory/sysdefault/libvirt/qemu/testserver-a/ ===================== This happens with all the domains I have currently defined. Calling list --all before that produces no problems. Calling list --all after that always produces said crash. qemu is qemu-kvm 0.12.4, built from sources. The host system is a Fedora 12 install. Guido

2 12

[libvirt] [PATCH 00/11] CVE: Multiple flaws in disk handling
by Daniel P. Berrange 16 Jul '10

16 Jul '10

This patch series attempts to fix 3 security flaws in the handling of virtual disk formats. This is just another occurrance of the problem previously identified in Xen https://www.redhat.com/security/data/cve/CVE-2008-2004.html In essence, if a guest is configured with a disk, hda, backed in the host by a plain file, then admin in the guest OS can run 'qemu-img -f qcow2 /dev/hda' to write a qcow2 header into the disk. If the host OS ever probes the backing file to identify its format, then it will see it as a qcow2 file now, instead of the expected raw. In QEMU this problem is addressed in two ways - When configuring a guest with -drive, always set format=raw|qcow2|etc Libvirt will always set this when <driver type='raw|qcow2|etc'> is set for a disk. - When creating a qcow2 guest, always set an explicit backing store format with -o backing_store_format=raw|qcow2|etc or -F raw|qcow2|etc. Libvirt will always set this when a <format type='raw|qcow2'/> is set for a volume backing store Despite having support for these QEMU features to prevent probing, there are flaws in the way libvirt handles disks in various places. - In the security drivers (SELinux, CGroups, DAC) when labelling files on the host, instead of looking at the <driver type='raw|qcow2'/> in the XML to identify the disk format, libvirt probes the file for magic data. Thus even if the app has taken the care to set an explicit format, for all disks, libvirt can be tricked into setting security labels on files that it shouldn't. If the guest OS somehow manages to break out and compromise QEMU it can take advantage of this labelling flaw to access files it shouldn't. - In the security drivers (SELinux, CGroups, DAC) when labelling the backing store for files on the host, instead of looking at embedded backing store format in the master disk image, libvirt probes magic data. Thus even if the app has taken the care to set an explicit format, for all disk backing stores, libvirt can be tricked into setting security labels on files that it shouldn't. If the guest OS somehow manages to break out and compromise QEMU it can take advantage of this labelling flaw to access files it shouldn't. - In the storage driver that creates qcow2 files, the backing store format is only set explicitly if the kvm-img binary is found. Any users with just a qemu-img binary will not have the backing store format set, even if qemu-img supports this capability. As a general matter of policy, libvirt does not mandate use of the <driver type='raw|qcow2'/> tag in the XML for disks, and if omitted will allow QEMU to probe disk formats. This is a weak default policy. If no explicit driver is set, libvirt should presume raw, since that is the only safe option. It should require a host level configuration option for the QEMU driver, to allow probing to be used. This patch series addresses all three of the security flaws, and also changes the default QEMU driver policy to disable all disk format probing out of the box. This latter change will break some existing deployments, so it is possible to turn it off in qemu.conf. The changes required significant re-factoring of the util/storage_file.c code and centralizes all processing of disk backing stores to minimise the risk of mistakes. There are also 5 additional test cases to the TCK, 3 to verify the security flaws, and 2 to verify that libvirtd is configured to disallow disk format probing. The file based storage pool needs to report the format of every volume in the pool. There is no way todo this other than to probe the volume metadata. Unfortunately if an application like virt-manager directly copies the <format> from the storage volume XML, straight into the <driver type=> of the guest disk, all our work to avoid the security problems is potentially null & void. NB, this is only a problem if re-using a pre-existing storage volume. If creating a new storage vol when provisioning a guest / hotplugging a disk, virt-manager can trust the storage volume format. I think we need to advise applications that when picking a pre-existing storage volume from a pool, they must not trust the volume format, and must confirm with the user whether to use the probed format, or force to raw The CVEs are https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2237 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2238 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2239 In addition, this patch series fixes the problem of mutually recursive backing stores which would cause an infinite loop in libvirtd. Regards, Daniel

2 22

[libvirt] [PATCH 0/2] Explicitly manage balloon devices
by Daniel P. Berrange 16 Jul '10

16 Jul '10

The balloon device is not present in the XML currently. This means we can't track custom PCI addresses for it. This means we can't provide a way for apps to get the same PCI address ordering as found with older QEMU

1 2