- Devel - libvirt List Archives

[libvirt] [PATCH V1 0/3] nwfilter: fixes for broadcasted DHCP reply messages
by Stefan Berger 31 Aug '12

31 Aug '12

The following set of patches fixes an issue I found today while using the DHCP snooping code with VMs running in a different infrastructure. Essentially the problem that occurs is that the DHCP server there sends replies to the broadcast MAC address while the code assumed all DHCP reply packets to be sent to the VM's MAC address. Stefan

2 8

[libvirt] [PATCH] doc: update option force to subcommand change-media
by Guannan Ren 31 Aug '12

31 Aug '12

BZ: https://bugzilla.redhat.com/show_bug.cgi?id=837761 --- tools/virsh-domain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c index dbcaa25..10361cd 100644 --- a/tools/virsh-domain.c +++ b/tools/virsh-domain.c @@ -8236,7 +8236,7 @@ static const vshCmdOptDef opts_change_media[] = { "depends on implementation of hypervisor driver")}, {"live", VSH_OT_BOOL, 0, N_("alter live configuration of running domain")}, {"config", VSH_OT_BOOL, 0, N_("alter persistent configuration, effect observed on next boot")}, - {"force", VSH_OT_BOOL, 0, N_("force media insertion")}, + {"force", VSH_OT_BOOL, 0, N_("force media operation")}, {NULL, 0, 0, NULL} }; -- 1.7.11.4

2 3

[libvirt] [PATCH 1/3] cgroup: read more data from cgroup cpuacct.usage_percpu
by Guannan Ren 31 Aug '12

31 Aug '12

On NUMA machine, the length of string got from file cpuacct.usage_percpu is quite large, so expand the limit of 1024 bytes. errors like: Failed to read file \ '/cgroup/cpuacct/libvirt/qemu/rhel6q/cpuacct.usage_percpu': \ Value too large for defined data type --- src/util/cgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/cgroup.c b/src/util/cgroup.c index 8541c7f..5dc0764 100644 --- a/src/util/cgroup.c +++ b/src/util/cgroup.c @@ -360,7 +360,7 @@ static int virCgroupGetValueStr(virCgroupPtr group, VIR_DEBUG("Get value %s", keypath); - rc = virFileReadAll(keypath, 1024, value); + rc = virFileReadAll(keypath, 1024*1024, value); if (rc < 0) { rc = -errno; VIR_DEBUG("Failed to read %s: %m\n", keypath); -- 1.7.11.4

3 8

[libvirt] [PATCH V3] implement offline migration
by liguang 31 Aug '12

31 Aug '12

Signed-off-by: liguang <lig.fnst(a)cn.fujitsu.com> --- daemon/remote.c | 46 +++++++++++++++++++++++++++ docs/hvsupport.pl | 2 + include/libvirt/libvirt.h.in | 6 +++ python/generator.py | 1 + src/driver.h | 5 +++ src/libvirt.c | 22 +++++++++++++ src/libvirt_public.syms | 1 + src/remote/remote_driver.c | 70 ++++++++++++++++++++++++++++++++++++++++++ src/remote/remote_protocol.x | 10 +++++- tools/virsh-domain.c | 69 +++++++++++++++++++++++++++++++++++++++++ 10 files changed, 231 insertions(+), 1 deletions(-) diff --git a/daemon/remote.c b/daemon/remote.c index 24928f4..c47a580 100644 --- a/daemon/remote.c +++ b/daemon/remote.c @@ -21,6 +21,9 @@ */ #include <config.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <fcntl.h> #include "virterror_internal.h" @@ -48,6 +51,7 @@ #include "virdbus.h" #include "remote_protocol.h" #include "qemu_protocol.h" +#include "fdstream.h" #define VIR_FROM_THIS VIR_FROM_RPC @@ -1768,6 +1772,48 @@ no_memory: goto cleanup; } +static int remoteDispatchDomainMigrateOffline( + virNetServerPtr server ATTRIBUTE_UNUSED, + virNetServerClientPtr client, + virNetMessagePtr msg ATTRIBUTE_UNUSED, + virNetMessageErrorPtr rerr, + remote_domain_migrate_offline_args *args, + remote_domain_migrate_offline_ret *ret ATTRIBUTE_UNUSED) +{ + int rv = -1; + virStreamPtr st = NULL; + daemonClientStreamPtr stream = NULL; + daemonClientPrivatePtr priv = + virNetServerClientGetPrivateData(client); + + if (!priv->conn) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("connection not open")); + goto cleanup; + } + + st = virStreamNew(priv->conn, VIR_STREAM_NONBLOCK); + + if (!(stream = daemonCreateClientStream(client, st, remoteProgram, &msg->header))) + goto cleanup; + + if (virFDStreamCreateFile(st, + args->name, + 0, 0, + O_WRONLY, 0) < 0) + goto cleanup; + + + if (daemonAddClientStream(client, stream, false) < 0) + goto cleanup; + + rv = 0; + +cleanup: + if (rv < 0) + virNetMessageSaveError(rerr); + return rv; +} + static int remoteDispatchDomainMigratePrepare(virNetServerPtr server ATTRIBUTE_UNUSED, virNetServerClientPtr client ATTRIBUTE_UNUSED, diff --git a/docs/hvsupport.pl b/docs/hvsupport.pl index 4871739..47fc505 100755 --- a/docs/hvsupport.pl +++ b/docs/hvsupport.pl @@ -128,6 +128,8 @@ $apis{virDomainMigratePrepareTunnel3} = "0.9.2"; $apis{virDomainMigratePerform3} = "0.9.2"; $apis{virDomainMigrateFinish3} = "0.9.2"; $apis{virDomainMigrateConfirm3} = "0.9.2"; +$apis{virDomainMigrateOffline} = "0.10.1"; + diff --git a/include/libvirt/libvirt.h.in b/include/libvirt/libvirt.h.in index cfe5047..7c9cf3c 100644 --- a/include/libvirt/libvirt.h.in +++ b/include/libvirt/libvirt.h.in @@ -995,6 +995,7 @@ typedef enum { * whole migration process; this will be used automatically * when supported */ VIR_MIGRATE_UNSAFE = (1 << 9), /* force migration even if it is considered unsafe */ + VIR_MIGRATE_OFFLINE = (1 << 10), /* offline migration */ } virDomainMigrateFlags; /* Domain migration. */ @@ -1030,6 +1031,11 @@ int virDomainMigrateGetMaxSpeed(virDomainPtr domain, unsigned long *bandwidth, unsigned int flags); +int +virDomainMigrateOffline(virConnectPtr dconn, + char *file); + + /** * VIR_NODEINFO_MAXCPUS: * @nodeinfo: virNodeInfo instance diff --git a/python/generator.py b/python/generator.py index 7beb361..a1b1203 100755 --- a/python/generator.py +++ b/python/generator.py @@ -427,6 +427,7 @@ skip_impl = ( 'virDomainGetDiskErrors', 'virConnectUnregisterCloseCallback', 'virConnectRegisterCloseCallback', + 'virDomainMigrateOffline', ) qemu_skip_impl = ( diff --git a/src/driver.h b/src/driver.h index e88ab28..9041005 100644 --- a/src/driver.h +++ b/src/driver.h @@ -881,6 +881,10 @@ typedef char * int type, const char *uri, unsigned int flags); +typedef int + (*virDrvDomainMigrateOffline)(virConnectPtr dconn, + const char *file); + /** * _virDriver: @@ -1068,6 +1072,7 @@ struct _virDriver { virDrvDomainGetDiskErrors domainGetDiskErrors; virDrvDomainSetMetadata domainSetMetadata; virDrvDomainGetMetadata domainGetMetadata; + virDrvDomainMigrateOffline domainMigrateOffline; }; typedef int diff --git a/src/libvirt.c b/src/libvirt.c index b034ed6..2878384 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -5001,6 +5001,28 @@ virDomainMigratePeer2Peer (virDomainPtr domain, } } +/** + * virDomainMigrateOffline: + * @dconn: target connection handler + * @file: the file to push to target + * + * to handle offline migration + * Returns -1 if error, else 0 + */ +int +virDomainMigrateOffline(virConnectPtr dconn, + char *file) +{ + VIR_DEBUG("dconn=%p, file=%s", dconn, NULLSTR(file)); + + if (!VIR_IS_CONNECT (dconn)) { + virLibConnError(VIR_ERR_INVALID_CONN, __FUNCTION__); + virDispatchError(NULL); + return -1; + } + + return dconn->driver->domainMigrateOffline(dconn, file); +} /* * In normal migration, the libvirt client co-ordinates communication diff --git a/src/libvirt_public.syms b/src/libvirt_public.syms index 92ae95a..e6a7de7 100644 --- a/src/libvirt_public.syms +++ b/src/libvirt_public.syms @@ -550,6 +550,7 @@ LIBVIRT_0.10.0 { virConnectRegisterCloseCallback; virConnectUnregisterCloseCallback; virDomainGetSecurityLabelList; + virDomainMigrateOffline; virDomainPinEmulator; virDomainGetEmulatorPinInfo; } LIBVIRT_0.9.13; diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index cf1f079..0952783 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -22,8 +22,12 @@ */ #include <config.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <fcntl.h> #include <unistd.h> +#include <stdio.h> #include <assert.h> #include "virnetclient.h" @@ -5247,6 +5251,71 @@ done: return rv; } +static int +doRemoteReadFile(virStreamPtr st ATTRIBUTE_UNUSED, + char *buf, size_t nbytes, void *opaque) +{ + int *fd = opaque; + + return read(*fd, buf, nbytes); +} + +static int +remoteDomainMigrateOffline(virConnectPtr dconn, + const char *name) +{ + int rv = -1, fd = -1; + virStreamPtr st = virStreamNew(dconn, 0); + remote_domain_migrate_offline_args args; + remote_domain_migrate_offline_ret ret; + struct private_data *priv = dconn->privateData; + virNetClientStreamPtr netst = NULL; + + remoteDriverLock(priv); + + args.name = (char *)name; + memset(&ret, 0, sizeof(ret)); + + if (!(netst = virNetClientStreamNew(priv->remoteProgram, REMOTE_PROC_DOMAIN_MIGRATE_OFFLINE, priv->counter))) + goto done; + if (virNetClientAddStream(priv->client, netst) < 0) { + virObjectUnref(netst); + goto done; + } + st->driver = &remoteStreamDrv; + st->privateData = netst; + + if ((fd = open(name, O_RDONLY)) < 0) + goto done; + if (fd == -1) + goto done; + + if (call (dconn, priv, 0, REMOTE_PROC_DOMAIN_MIGRATE_OFFLINE, + (xdrproc_t) xdr_remote_domain_migrate_offline_args, (char *) &args, + (xdrproc_t) xdr_remote_domain_migrate_offline_ret, (char *) &ret) == -1) { + virNetClientRemoveStream(priv->client, netst); + virObjectUnref(netst); + st->driver = NULL; + st->privateData = NULL; + goto done; + } + + remoteDriverUnlock(priv); + + if (virStreamSendAll(st, doRemoteReadFile, &fd) < 0) + goto done; + if (virStreamFinish(st) < 0) + goto done; + if (VIR_CLOSE(fd) < 0) + goto done; + + rv = 0; + +done: + return rv; +} + + static void remoteDomainEventQueue(struct private_data *priv, virDomainEventPtr event) { @@ -5491,6 +5560,7 @@ static virDriver remote_driver = { .domainEventDeregister = remoteDomainEventDeregister, /* 0.5.0 */ .domainMigratePrepare2 = remoteDomainMigratePrepare2, /* 0.5.0 */ .domainMigrateFinish2 = remoteDomainMigrateFinish2, /* 0.5.0 */ + .domainMigrateOffline = remoteDomainMigrateOffline, /* 0.10.1 */ .nodeDeviceDettach = remoteNodeDeviceDettach, /* 0.6.1 */ .nodeDeviceReAttach = remoteNodeDeviceReAttach, /* 0.6.1 */ .nodeDeviceReset = remoteNodeDeviceReset, /* 0.6.1 */ diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index 085d5d9..c845737 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -2558,6 +2558,13 @@ struct remote_connect_list_all_domains_ret { unsigned int ret; }; +struct remote_domain_migrate_offline_args { + remote_nonnull_string name; +}; + +struct remote_domain_migrate_offline_ret { + int retval; +}; /*----- Protocol. -----*/ @@ -2888,7 +2895,8 @@ enum remote_procedure { REMOTE_PROC_DOMAIN_GET_HOSTNAME = 277, /* autogen autogen */ REMOTE_PROC_DOMAIN_GET_SECURITY_LABEL_LIST = 278, /* skipgen skipgen priority:high */ REMOTE_PROC_DOMAIN_PIN_EMULATOR = 279, /* skipgen skipgen */ - REMOTE_PROC_DOMAIN_GET_EMULATOR_PIN_INFO = 280 /* skipgen skipgen */ + REMOTE_PROC_DOMAIN_GET_EMULATOR_PIN_INFO = 280, /* skipgen skipgen */ + REMOTE_PROC_DOMAIN_MIGRATE_OFFLINE = 281 /* skipgen skipgen priority:low*/ /* * Notice how the entries are grouped in sets of 10 ? diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c index dbcaa25..70f7694 100644 --- a/tools/virsh-domain.c +++ b/tools/virsh-domain.c @@ -6698,9 +6698,66 @@ static const vshCmdOptDef opts_migrate[] = { {"dname", VSH_OT_DATA, 0, N_("rename to new name during migration (if supported)")}, {"timeout", VSH_OT_INT, 0, N_("force guest to suspend if live migration exceeds timeout (in seconds)")}, {"xml", VSH_OT_STRING, 0, N_("filename containing updated XML for the target")}, + {"offline", VSH_OT_BOOL, 0, N_("migration when there's no domain active")}, {NULL, 0, 0, NULL} }; +static int +push_file(char dst[] ATTRIBUTE_UNUSED, char *file, virConnectPtr dconn) +{ + int ret = -1; + + ret = virDomainMigrateOffline(dconn, file); + + return ret; +} + +static void +vshMigrateOffline(vshControl *ctl, char *file, char dst[]) +{ + xmlDocPtr xml = NULL; + xmlXPathContextPtr ctxt = NULL; + xmlNodePtr *disks = NULL; + virConnectPtr dconn = NULL; + int i = 0, ret = 0; + char *src[] = {NULL}; + + if (!vshConnectionUsability(ctl, ctl->conn)) + return; + + xml = virXMLParseFileCtxt(file, &ctxt); + if (!xml) { + vshError(NULL, "%s", _("Fail to get domain information from")); + goto cleanup; + } + + ret = virXPathNodeSet("./devices/disk", ctxt, &disks); + if (ret < 0) { + vshError(NULL, "%s", _("Fail to get disk node")); + goto cleanup; + } + + dconn = virConnectOpen(dst); + if (!dconn) + goto cleanup; + vshPrint(ctl, "pushing %s to %s\n", file, dst); + if (push_file(dst, file, dconn) < 0) + goto cleanup; + for (i = 0 ; i < ret ; i++) { + ctxt->node = disks[i]; + src[i] = virXPathString("string(./source/@file" + "|./source/@dir" + "|./source/@name)", ctxt); + vshPrint(ctl, "pushing %s to %s\n", src[i], dst); + if (push_file(dst, src[i], dconn) < 0) + break; + } + +cleanup: + xmlXPathFreeContext(ctxt); + xmlFreeDoc(xml); +} + static void doMigrate(void *opaque) { @@ -6767,12 +6824,24 @@ doMigrate(void *opaque) if (vshCommandOptBool(cmd, "unsafe")) flags |= VIR_MIGRATE_UNSAFE; + if (vshCommandOptBool(cmd, "offline")) { + flags |= VIR_MIGRATE_OFFLINE; + if (xmlfile == NULL) + vshError(ctl, _("please specify xmlfile for offline migration")); + } + if (xmlfile && virFileReadAll(xmlfile, 8192, &xml) < 0) { vshError(ctl, _("file '%s' doesn't exist"), xmlfile); goto out; } + if (flags & VIR_MIGRATE_OFFLINE) { + vshMigrateOffline(ctl, (char *)xmlfile, (char *)desturi); + goto out; + } + + if ((flags & VIR_MIGRATE_PEER2PEER) || vshCommandOptBool(cmd, "direct")) { /* For peer2peer migration or direct migration we only expect one URI -- 1.7.2.5

3 6

[libvirt] [PATCH] docs: Fix typo in CPU tuning
by Jiri Denemark 31 Aug '12

31 Aug '12

--- docs/formatdomain.html.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index be8489a..bb842f9 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -385,7 +385,7 @@ <vcpupin vcpu="1" cpuset="0,1"/> <vcpupin vcpu="2" cpuset="2,3"/> <vcpupin vcpu="3" cpuset="0,4"/> - <emulatorpin cpuset="1-3"/%gt; + <emulatorpin cpuset="1-3"/> <shares>2048</shares> <period>1000000</period> <quota>-1</quota> -- 1.7.12

3 3

[libvirt] [PATCH] doc: Fix emulator pinning example in formatdomain.html
by Peter Krempa 31 Aug '12

31 Aug '12

Add correct closing tags. --- Pushing under trivial rule. --- docs/formatdomain.html.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index be8489a..fbdf36b 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -389,8 +389,8 @@ <shares>2048</shares> <period>1000000</period> <quota>-1</quota> - <emulator_period>1000000</period> - <emulator_quota>-1</quota> + <emulator_period>1000000</emulator_period> + <emulator_quota>-1</emulator_quota> </cputune> ... </domain> -- 1.7.12

1 0

[libvirt] [PATCH v2] conf: Fix parsing of seclabels without model
by Marcelo Cerri 31 Aug '12

31 Aug '12

With this patch libvirt tries to assign a model to a single seclabel when model is missing. Libvirt will look up at host's capabilities and assign the first model to seclabel. This patch fixes: 1. The problem with existing guests that have a seclabel defined in its XML. 2. A XML parse error when a guest is restored. Signed-off-by: Marcelo Cerri <mhcerri(a)linux.vnet.ibm.com> --- src/conf/domain_conf.c | 64 +++++++++++++++++++++++++++++--------------------- 1 file changed, 37 insertions(+), 27 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 224aec5..42c3900 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -3102,22 +3102,10 @@ virSecurityLabelDefParseXML(xmlXPathContextPtr ctxt, def->baselabel = p; } - /* Only parse model, if static labelling, or a base - * label is set, or doing active XML - */ - if (def->type == VIR_DOMAIN_SECLABEL_STATIC || - def->baselabel || - (!(flags & VIR_DOMAIN_XML_INACTIVE) && - def->type != VIR_DOMAIN_SECLABEL_NONE)) { - - p = virXPathStringLimit("string(./@model)", - VIR_SECURITY_MODEL_BUFLEN-1, ctxt); - if (p == NULL && def->type != VIR_DOMAIN_SECLABEL_NONE) { - virReportError(VIR_ERR_XML_ERROR, - "%s", _("missing security model")); - } - def->model = p; - } + /* Always parse model */ + p = virXPathStringLimit("string(./@model)", + VIR_SECURITY_MODEL_BUFLEN-1, ctxt); + def->model = p; return def; @@ -3129,10 +3117,12 @@ error: static int virSecurityLabelDefsParseXML(virDomainDefPtr def, xmlXPathContextPtr ctxt, + virCapsPtr caps, unsigned int flags) { int i = 0, n; xmlNodePtr *list = NULL, saved_node; + virCapsHostPtr host = &caps->host; /* Check args and save context */ if (def == NULL || ctxt == NULL) @@ -3159,18 +3149,38 @@ virSecurityLabelDefsParseXML(virDomainDefPtr def, ctxt->node = saved_node; VIR_FREE(list); - /* Checking missing model information - * when there is more than one seclabel */ - if (n > 1) { - for(; n; n--) { - if (def->seclabels[n - 1]->model == NULL) { - virReportError(VIR_ERR_XML_ERROR, "%s", - _("missing security model " - "when using multiple labels")); - goto error; - } + /* libvirt versions prior to 0.10.0 support just a single seclabel element + * in guest's XML and model attribute can be suppressed if type is none or + * type is dynamic, baselabel is not defined and INACTIVE flag is set. + * + * To avoid compatibility issues, for this specific case the first model + * defined in host's capabilities is used as model for the seclabel. + */ + if (def->nseclabels == 1 && + def->seclabels[0]->model == NULL && + def->seclabels[0]->type != VIR_DOMAIN_SECLABEL_STATIC && + def->seclabels[0]->baselabel == NULL && + (flags & VIR_DOMAIN_XML_INACTIVE) && + host->nsecModels > 0) { + + /* Copy model from host. */ + def->seclabels[0]->model = strdup(host->secModels[0].model); + if (def->seclabels[0]->model == NULL) { + virReportOOMError(); + goto error; } } + + /* Checking missing model information */ + for(; n; n--) { + if (def->seclabels[n - 1]->model == NULL) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("missing security model " + "when using multiple labels")); + goto error; + } + } + return 0; error: @@ -8166,7 +8176,7 @@ static virDomainDefPtr virDomainDefParseXML(virCapsPtr caps, /* analysis of security label, done early even though we format it * late, so devices can refer to this for defaults */ - if (virSecurityLabelDefsParseXML(def, ctxt, flags) == -1) + if (virSecurityLabelDefsParseXML(def, ctxt, caps, flags) == -1) goto error; /* Extract domain memory */ -- 1.7.12

3 2

[libvirt] [PATCH] Fix xen driver following changes to make it stateful
by Jim Fehlig 31 Aug '12

31 Aug '12

Recent work to improve support for loadable driver modules introduced a regression in the xen driver. The legacy xen driver is now a stateful, libvirtd driver but was not being registered when building without driver modules. A slight behavior change was also noted in the xen drivers when built as driver modules. Previously, explicitly specifying a connection URI was not necessary, but now Compiled against library: libvirt 0.10.0 Using library: libvirt 0.10.0 Using API: QEMU 0.10.0 error: failed to get the hypervisor version error: internal error Cannot find suitable emulator for x86_64 The xen drivers need to be registered before the qemu driver since the qemu driver will return success with a null connection URI. This ordering is safe since the xen drivers will decline when not running the xen kernel. --- daemon/Makefile.am | 4 ++++ daemon/libvirtd.c | 18 ++++++++++++------ 2 files changed, 16 insertions(+), 6 deletions(-) diff --git a/daemon/Makefile.am b/daemon/Makefile.am index b00fc13..b45349c 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -131,6 +131,10 @@ if WITH_LXC libvirtd_LDADD += ../src/libvirt_driver_lxc.la endif +if WITH_XEN + libvirtd_LDADD += ../src/libvirt_driver_xen.la +endif + if WITH_LIBXL libvirtd_LDADD += ../src/libvirt_driver_libxl.la endif diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index 352d4fe..6973df6 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -66,6 +66,9 @@ # ifdef WITH_LXC # include "lxc/lxc_driver.h" # endif +# ifdef WITH_XEN +# include "xen/xen_driver.h" +# endif # ifdef WITH_LIBXL # include "libxl/libxl_driver.h" # endif @@ -382,6 +385,12 @@ static void daemonInitialize(void) # ifdef WITH_NETCF virDriverLoadModule("interface"); # endif +# ifdef WITH_XEN + virDriverLoadModule("xen"); +# endif +# ifdef WITH_LIBXL + virDriverLoadModule("libxl"); +# endif # ifdef WITH_QEMU virDriverLoadModule("qemu"); # endif @@ -391,12 +400,6 @@ static void daemonInitialize(void) # ifdef WITH_UML virDriverLoadModule("uml"); # endif -# ifdef WITH_XEN - virDriverLoadModule("xen"); -# endif -# ifdef WITH_LIBXL - virDriverLoadModule("libxl"); -# endif #else # ifdef WITH_NETWORK networkRegister(); @@ -416,6 +419,9 @@ static void daemonInitialize(void) # ifdef WITH_NWFILTER nwfilterRegister(); # endif +# ifdef WITH_XEN + xenRegister(); +# endif # ifdef WITH_LIBXL libxlRegister(); # endif -- 1.7.9.2

2 2

[libvirt] [PATCH] format: suppress auto-generated DAC labels
by Marcelo Cerri 31 Aug '12

31 Aug '12

To avoid backward compatibility issues, this patch suppresses auto-generated DAC labels from XML. This change affects commands such as dumpxml and save. Signed-off-by: Marcelo Cerri <mhcerri(a)linux.vnet.ibm.com> --- src/conf/domain_conf.c | 13 ++++++++++++- src/conf/domain_conf.h | 1 + 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 42c3900..516821f 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -11231,6 +11231,12 @@ virSecurityLabelDefFormat(virBufferPtr buf, virSecurityLabelDefPtr def) if (def->type == VIR_DOMAIN_SECLABEL_DEFAULT) return; + /* To avoid backward compatibility issues, suppress DAC labels that are + * automatically generated. + */ + if (STREQ_NULLABLE(def->model, "dac") && def->implicit) + return; + virBufferAsprintf(buf, "<seclabel type='%s'", sectype); @@ -14982,6 +14988,7 @@ virSecurityLabelDefPtr virDomainDefGetSecurityLabelDef(virDomainDefPtr def, const char *model) { int i; + virSecurityLabelDefPtr seclabel = NULL; if (def == NULL || model == NULL) return NULL; @@ -14993,7 +15000,11 @@ virDomainDefGetSecurityLabelDef(virDomainDefPtr def, const char *model) return def->seclabels[i]; } - return virDomainDefAddSecurityLabelDef(def, model); + seclabel = virDomainDefAddSecurityLabelDef(def, model); + if (seclabel) + seclabel->implicit = true; + + return seclabel; } virSecurityDeviceLabelDefPtr diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 9ee57e1..3791e50 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -295,6 +295,7 @@ struct _virSecurityLabelDef { char *baselabel; /* base name of label string */ int type; /* virDomainSeclabelType */ bool norelabel; + bool implicit; /* true if seclabel is auto-added */ }; -- 1.7.12

1 0

[libvirt] [PATCH v1 1/8] New functions for virBitmap
by Hu Tao 31 Aug '12

31 Aug '12

In many places we store bitmap info in a chunk of data (pointed to by a char *), and have redundant codes to set/unset bits. This patch extends virBitmap, and convert those codes to use virBitmap in subsquent patches. --- .gitignore | 1 + src/libvirt_private.syms | 10 ++ src/util/bitmap.c | 391 +++++++++++++++++++++++++++++++++++++++++++++- src/util/bitmap.h | 23 +++ tests/Makefile.am | 8 +- tests/virbitmaptest.c | 134 ++++++++++++++++ 6 files changed, 562 insertions(+), 5 deletions(-) create mode 100644 tests/virbitmaptest.c diff --git a/.gitignore b/.gitignore index 5041ddf..9aaa1f5 100644 --- a/.gitignore +++ b/.gitignore @@ -155,6 +155,7 @@ /tests/storagebackendsheepdogtest /tests/utiltest /tests/viratomictest +/tests/virbitmaptest /tests/virauthconfigtest /tests/virbuftest /tests/virdrivermoduletest diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 27eb43e..9c27218 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -7,11 +7,21 @@ # bitmap.h virBitmapAlloc; +virBitmapAllocFromData; +virBitmapClearAll; virBitmapClearBit; +virBitmapCmp; +virBitmapCopy; +virBitmapFormat; virBitmapFree; virBitmapGetBit; +virBitmapIsAllSet; +virBitmapParse; +virBitmapSetAll; virBitmapSetBit; +virBitmapSize; virBitmapString; +virBitmapToData; # buf.h diff --git a/src/util/bitmap.c b/src/util/bitmap.c index 53a8a38..2e668c6 100644 --- a/src/util/bitmap.c +++ b/src/util/bitmap.c @@ -33,15 +33,17 @@ #include "bitmap.h" #include "memory.h" #include "buf.h" +#include "util.h" +#include "c-ctype.h" struct _virBitmap { size_t size; - unsigned long *map; + unsigned char *map; }; -#define VIR_BITMAP_BITS_PER_UNIT ((int) sizeof(unsigned long) * CHAR_BIT) +#define VIR_BITMAP_BITS_PER_UNIT ((int) sizeof(unsigned char) * CHAR_BIT) #define VIR_BITMAP_UNIT_OFFSET(b) ((b) / VIR_BITMAP_BITS_PER_UNIT) #define VIR_BITMAP_BIT_OFFSET(b) ((b) % VIR_BITMAP_BITS_PER_UNIT) #define VIR_BITMAP_BIT(b) (1UL << VIR_BITMAP_BIT_OFFSET(b)) @@ -129,6 +131,12 @@ int virBitmapClearBit(virBitmapPtr bitmap, size_t b) return 0; } +/* Helper function. caller must ensure b < bitmap->size */ +static bool bitmapIsset(virBitmapPtr bitmap, size_t b) +{ + return !!(bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] & VIR_BITMAP_BIT(b)); +} + /** * virBitmapGetBit: * @bitmap: Pointer to bitmap @@ -145,7 +153,7 @@ int virBitmapGetBit(virBitmapPtr bitmap, size_t b, bool *result) if (bitmap->size <= b) return -1; - *result = !!(bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] & VIR_BITMAP_BIT(b)); + *result = bitmapIsset(bitmap, b); return 0; } @@ -168,7 +176,7 @@ char *virBitmapString(virBitmapPtr bitmap) VIR_BITMAP_BITS_PER_UNIT; while (sz--) { - virBufferAsprintf(&buf, "%0*lx", + virBufferAsprintf(&buf, "%0*hx", VIR_BITMAP_BITS_PER_UNIT / 4, bitmap->map[sz]); } @@ -180,3 +188,378 @@ char *virBitmapString(virBitmapPtr bitmap) return virBufferContentAndReset(&buf); } + +/** + * virBitmapFormat: + * @bitmap: the bitmap + * + * This function is the counterpart of virBitmapParse. This function creates + * a human-readable string representing the bits in bitmap. + * + * See virBitmapParse for the format of @str. + * + * Returns the string on success or NULL otherwise. Caller should call + * VIR_FREE to free the string. + */ +char *virBitmapFormat(virBitmapPtr bitmap) +{ + virBuffer buf =VIR_BUFFER_INITIALIZER; + int first = -1; + int start, cur; + int ret; + bool isset; + + if (!bitmap) + return NULL; + + cur = 0; + start = -1; + while (cur < bitmap->size) { + ret = virBitmapGetBit(bitmap, cur, &isset); + if (ret != 0) + goto error; + else if (isset) { + if (start == -1) + start = cur; + } else if (start != -1) { + if (!first) + virBufferAddLit(&buf, ","); + else + first = 0; + if (cur == start + 1) + virBufferAsprintf(&buf, "%d", start); + else + virBufferAsprintf(&buf, "%d-%d", start, cur - 1); + start = -1; + } + cur++; + } + + if (start != -1) { + if (!first) + virBufferAddLit(&buf, ","); + if (cur == start + 1) + virBufferAsprintf(&buf, "%d", start); + else + virBufferAsprintf(&buf, "%d-%d", start, cur - 1); + } + + if (virBufferError(&buf)) { +error: + virBufferFreeAndReset(&buf); + return NULL; + } + + return virBufferContentAndReset(&buf); +} + +/** + * virBitmapParse: + * @str: points to a string representing a human-readable bitmap + * @bitmap: a bitmap created from @str + * @bitmapSize: the upper limit of num of bits in created bitmap + * + * This function is the counterpart of virBitmapFormat. This function creates + * a bitmap, in which bits are set according to the content of @str. + * + * @str is a comma separated string of fields N, which means a number of bit + * to set, and ^N, which means to unset the bit, and N-M for ranges of bits + * to set. + * + * Returns the number of bits set in @bitmap, or -1 in case of error. + */ + +int virBitmapParse(const char *str, + char sep, + virBitmapPtr *bitmap, + size_t bitmapSize) +{ + int ret = 0; + int neg = 0; + const char *cur; + char *tmp; + int i, start, last; + + if (!str) + return -1; + + cur = str; + virSkipSpaces(&cur); + + if (*cur == 0) + return -1; + + *bitmap = virBitmapAlloc(bitmapSize); + if (!*bitmap) + return -1; + + while (*cur != 0 && *cur != sep) { + /* + * 3 constructs are allowed: + * - N : a single CPU number + * - N-M : a range of CPU numbers with N < M + * - ^N : remove a single CPU number from the current set + */ + if (*cur == '^') { + cur++; + neg = 1; + } + + if (!c_isdigit(*cur)) + goto parse_error; + + if (virStrToLong_i(cur, &tmp, 10, &start) < 0) + goto parse_error; + if (start < 0) + goto parse_error; + + cur = tmp; + + virSkipSpaces(&cur); + + if (*cur == ',' || *cur == 0 || *cur == sep) { + if (neg) { + if (bitmapIsset(*bitmap, start)) { + ignore_value(virBitmapClearBit(*bitmap, start)); + ret--; + } + } else { + if (!bitmapIsset(*bitmap, start)) { + ignore_value(virBitmapSetBit(*bitmap, start)); + ret++; + } + } + } else if (*cur == '-') { + if (neg) + goto parse_error; + + cur++; + virSkipSpaces(&cur); + + if (virStrToLong_i(cur, &tmp, 10, &last) < 0) + goto parse_error; + if (last < start) + goto parse_error; + + cur = tmp; + + for (i = start; i <= last; i++) { + if (!bitmapIsset(*bitmap, i)) { + ignore_value(virBitmapSetBit(*bitmap, i)); + ret++; + } + } + + virSkipSpaces(&cur); + } + + if (*cur == ',') { + cur++; + virSkipSpaces(&cur); + neg = 0; + } else if(*cur == 0 || *cur == sep) { + break; + } else { + goto parse_error; + } + } + + return ret; + +parse_error: + virBitmapFree(*bitmap); + *bitmap = NULL; + return -1; +} + +/** + * virBitmapCopy: + * @src: the source bitmap. + * + * Makes a copy of bitmap @src. + * + * returns the copied bitmap on success, or NULL otherwise. Caller + * should call virBitmapFree to free the returned bitmap. + */ +virBitmapPtr virBitmapCopy(virBitmapPtr src) +{ + virBitmapPtr dst; + size_t sz; + + sz = (src->size + VIR_BITMAP_BITS_PER_UNIT - 1) / + VIR_BITMAP_BITS_PER_UNIT; + + if (VIR_ALLOC(dst) < 0) + return NULL; + + if (VIR_ALLOC_N(dst->map, sz) < 0) { + VIR_FREE(dst); + return NULL; + } + + memcpy(dst->map, src->map, sz); + dst->size = src->size; + + return dst; +} + +/** + * virBitmapAllocFromData: + * @data: the data + * @len: len of @data in byte + * + * Allocate a bitmap from a chunk of data containing bits + * information + * + * Returns a pointer to the allocated bitmap or NULL if + * memory cannot be allocated. + */ +virBitmapPtr virBitmapAllocFromData(void *data, int len) +{ + virBitmapPtr bitmap; + + bitmap = virBitmapAlloc(len * CHAR_BIT); + if (!bitmap) + return NULL; + + memcpy(bitmap->map, data, len); + + return bitmap; +} + +/** + * virBitmapToData: + * @data: the data + * @len: len of @data in byte + * + * Convert a bitmap to a chunk of data containing bits information. + * Data consists of sequential bytes, with lower bytes containing + * lower bits. + * + * Returns 0 on success, -1 otherwise. + */ +int virBitmapToData(virBitmapPtr bitmap, char **data, int *dataLen) +{ + size_t sz; + + sz = (bitmap->size + VIR_BITMAP_BITS_PER_UNIT - 1) / + VIR_BITMAP_BITS_PER_UNIT; + + if (VIR_ALLOC_N(*data, sz) < 0) + return -1; + + memcpy(*data, bitmap->map, sz); + *dataLen = sz; + + return 0; +} + +/** + * virBitmapCmp: + * @b1: bitmap 1 + * @b2: bitmap 2 + * + * Compares two bitmaps. Returns true if two bitmaps have exactly + * the same set of bits set, otherwise false. + */ +bool virBitmapCmp(virBitmapPtr b1, virBitmapPtr b2) +{ + virBitmapPtr b; + size_t sz1, sz2, sz; + int i; + + sz1 = (b1->size + VIR_BITMAP_BITS_PER_UNIT - 1) / + VIR_BITMAP_BITS_PER_UNIT; + sz2 = (b2->size + VIR_BITMAP_BITS_PER_UNIT - 1) / + VIR_BITMAP_BITS_PER_UNIT; + + sz = sz1 < sz2 ? sz1 : sz2; + + for (i = 0; i < sz; i++) { + if (b1->map[i] != b2->map[i]) + return false; + } + + b = sz1 > sz ? b1 : b2; + sz = sz1 > sz ? sz1 : sz2; + for (; i < sz; i++) { + if (b->map[i]) + return false; + } + + return true; +} + +size_t virBitmapSize(virBitmapPtr bitmap) +{ + return bitmap->size; +} + +/** + * virBitmapSetAll: + * @bitmap: the bitmap + * + * set all bits in @bitmap. + */ +void virBitmapSetAll(virBitmapPtr bitmap) +{ + int i; + size_t sz; + + sz = (bitmap->size + VIR_BITMAP_BITS_PER_UNIT - 1) / + VIR_BITMAP_BITS_PER_UNIT; + + for (i = 0; i < sz; i++) + bitmap->map[i] = -1; +} + +/** + * virBitmapClearAll: + * @bitmap: the bitmap + * + * clear all bits in @bitmap. + */ +void virBitmapClearAll(virBitmapPtr bitmap) +{ + int i; + size_t sz; + + sz = (bitmap->size + VIR_BITMAP_BITS_PER_UNIT - 1) / + VIR_BITMAP_BITS_PER_UNIT; + + for (i = 0; i < sz; i++) + bitmap->map[i] = 0; +} + +/** + * virBitmapIsAllSet: + * @bitmap: the bitmap to check + * + * check if all bits in @bitmap are set. + */ +bool virBitmapIsAllSet(virBitmapPtr bitmap) +{ + int i; + int unusedBits; + size_t sz, tmp; + + sz = (bitmap->size + VIR_BITMAP_BITS_PER_UNIT - 1) / + VIR_BITMAP_BITS_PER_UNIT; + unusedBits = sz * VIR_BITMAP_BITS_PER_UNIT - bitmap->size; + + tmp = sz; + if (unusedBits > 0) + tmp = sz - 1; + + for (i = 0; i < tmp; i++) + if (bitmap->map[i] != (unsigned char)-1) + return false; + + if (unusedBits > 0) { + if ((bitmap->map[sz - 1] & ((1 << (VIR_BITMAP_BITS_PER_UNIT - unusedBits + 1)) - 1)) + != ((1 << (VIR_BITMAP_BITS_PER_UNIT - unusedBits + 1)) - 1)) + return false; + } + + return true; +} diff --git a/src/util/bitmap.h b/src/util/bitmap.h index c3e6222..4823604 100644 --- a/src/util/bitmap.h +++ b/src/util/bitmap.h @@ -62,4 +62,27 @@ int virBitmapGetBit(virBitmapPtr bitmap, size_t b, bool *result) char *virBitmapString(virBitmapPtr bitmap) ATTRIBUTE_NONNULL(1) ATTRIBUTE_RETURN_CHECK; +char *virBitmapFormat(virBitmapPtr bitmap); + +int virBitmapParse(const char *str, + char sep, + virBitmapPtr *bitmap, + size_t bitmapSize); + +virBitmapPtr virBitmapCopy(virBitmapPtr src); + +virBitmapPtr virBitmapAllocFromData(void *data, int len); + +int virBitmapToData(virBitmapPtr bitmap, char **data, int *dataLen); + +bool virBitmapCmp(virBitmapPtr b1, virBitmapPtr b2); + +size_t virBitmapSize(virBitmapPtr bitmap); + +void virBitmapSetAll(virBitmapPtr bitmap); + +void virBitmapClearAll(virBitmapPtr bitmap); + +bool virBitmapIsAllSet(virBitmapPtr bitmap); + #endif diff --git a/tests/Makefile.am b/tests/Makefile.am index 8cf8015..ec436df 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -92,7 +92,8 @@ test_programs = virshtest sockettest \ viratomictest \ utiltest virnettlscontexttest shunloadtest \ virtimetest viruritest virkeyfiletest \ - virauthconfigtest + virauthconfigtest \ + virbitmaptest if WITH_SECDRIVER_SELINUX test_programs += securityselinuxtest @@ -562,6 +563,10 @@ viratomictest_SOURCES = \ viratomictest.c testutils.h testutils.c viratomictest_LDADD = $(LDADDS) +virbitmaptest_SOURCES = \ + virbitmaptest.c testutils.h testutils.c +virbitmaptest_LDADD = $(LDADDS) + jsontest_SOURCES = \ jsontest.c testutils.h testutils.c jsontest_LDADD = $(LDADDS) @@ -592,6 +597,7 @@ shunloadtest_SOURCES = \ shunloadtest_LDADD = $(LIB_PTHREAD) shunloadtest_DEPENDENCIES = libshunload.la + if WITH_CIL CILOPTFLAGS = CILOPTINCS = diff --git a/tests/virbitmaptest.c b/tests/virbitmaptest.c new file mode 100644 index 0000000..c688618 --- /dev/null +++ b/tests/virbitmaptest.c @@ -0,0 +1,134 @@ +/* + * Copyright (C) 2012 Fujitsu. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; If not, see + * <http://www.gnu.org/licenses/>. + * + */ + +#include <config.h> + +#include <time.h> +#include <sched.h> + +#include "testutils.h" + +#include "bitmap.h" + +static int test1(const void *data ATTRIBUTE_UNUSED) +{ + virBitmapPtr bitmap; + int size; + int bit; + bool result; + + size = 1024; + bit = 100; + bitmap = virBitmapAlloc(size); + if (virBitmapSetBit(bitmap, bit) < 0) + return -1; + + if (virBitmapGetBit(bitmap, bit, &result) < 0) + return -1; + + if (!result) + return -1; + + if (virBitmapGetBit(bitmap, bit + 1, &result) < 0) + return -1; + + if (result) + return -1; + + return 0; +} + +bool testBit(virBitmapPtr bitmap, unsigned int start, unsigned int end) +{ + int i; + bool result; + + for (i = start; i <= end; i++) { + if (virBitmapGetBit(bitmap, i, &result) < 0) + return 0; + if (!result) + return 0; + } + + return 1; +} + +static int test2(const void *data ATTRIBUTE_UNUSED) +{ + const char *bitsString1 = "1-32,50,88-99,1021-1023"; + char *bitsString2 = NULL; + virBitmapPtr bitmap = NULL; + int ret = -1; + int size = 1024; + + if (virBitmapParse(bitsString1, 0, &bitmap, size) < 0) + goto error; + + if (!testBit(bitmap, 1, 32)) + goto error; + if (!testBit(bitmap, 50, 50)) + goto error; + if (!testBit(bitmap, 88, 99)) + goto error; + if (!testBit(bitmap, 1021, 1023)) + goto error; + + if (testBit(bitmap, 0, 0)) + goto error; + if (testBit(bitmap, 33,49)) + goto error; + if (testBit(bitmap, 51,87)) + goto error; + if (testBit(bitmap, 100,1020)) + goto error; + + bitsString2 = virBitmapFormat(bitmap); + if (strcmp(bitsString1, bitsString2)) + goto error; + + virBitmapSetAll(bitmap); + if (!testBit(bitmap, 0, size - 1)) + goto error; + + virBitmapClearAll(bitmap); + if (testBit(bitmap, 0, size - 1)) + goto error; + + ret = 0; + +error: + virBitmapFree(bitmap); + VIR_FREE(bitsString2); + return ret; +} + +static int +mymain(void) +{ + int ret = 0; + + if (virtTestRun("test1", 1, test1, NULL) < 0) + ret = -1; + if (virtTestRun("test2", 1, test2, NULL) < 0) + ret = -1; + + return ret; +} + +VIRT_TEST_MAIN(mymain) -- 1.7.10.2

2 13

[libvirt] [PATCH] conf: Fix parsing of seclabels without model
by Marcelo Cerri 31 Aug '12

31 Aug '12

With this patch libvirt tries to assign a model to seclabels when model is missing. Libvirt will look up at host's capabilities and assign a model in order to each seclabel that doesn't have a model assigned. This patch fixes: 1. The problem with existing guests that have a seclabel defined in its XML. 2. A XML parse error when a guest is restored. Signed-off-by: Marcelo Cerri <mhcerri(a)linux.vnet.ibm.com> --- src/conf/domain_conf.c | 56 ++++++++++++++++++++++++++------------------------ 1 file changed, 29 insertions(+), 27 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 224aec5..5316b59 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -3102,22 +3102,10 @@ virSecurityLabelDefParseXML(xmlXPathContextPtr ctxt, def->baselabel = p; } - /* Only parse model, if static labelling, or a base - * label is set, or doing active XML - */ - if (def->type == VIR_DOMAIN_SECLABEL_STATIC || - def->baselabel || - (!(flags & VIR_DOMAIN_XML_INACTIVE) && - def->type != VIR_DOMAIN_SECLABEL_NONE)) { - - p = virXPathStringLimit("string(./@model)", - VIR_SECURITY_MODEL_BUFLEN-1, ctxt); - if (p == NULL && def->type != VIR_DOMAIN_SECLABEL_NONE) { - virReportError(VIR_ERR_XML_ERROR, - "%s", _("missing security model")); - } - def->model = p; - } + /* Always parse model */ + p = virXPathStringLimit("string(./@model)", + VIR_SECURITY_MODEL_BUFLEN-1, ctxt); + def->model = p; return def; @@ -3129,10 +3117,12 @@ error: static int virSecurityLabelDefsParseXML(virDomainDefPtr def, xmlXPathContextPtr ctxt, + virCapsPtr caps, unsigned int flags) { - int i = 0, n; + int i, j, n; xmlNodePtr *list = NULL, saved_node; + virCapsHostPtr host = &caps->host; /* Check args and save context */ if (def == NULL || ctxt == NULL) @@ -3159,14 +3149,26 @@ virSecurityLabelDefsParseXML(virDomainDefPtr def, ctxt->node = saved_node; VIR_FREE(list); - /* Checking missing model information - * when there is more than one seclabel */ - if (n > 1) { - for(; n; n--) { - if (def->seclabels[n - 1]->model == NULL) { + /* Check missing model information */ + for (i = j = 0; i < n; i++) { + /* If model is missing, try to assign it based on driver's + * capabilities. + */ + if (def->seclabels[i]->model == NULL) { + /* Check if there's any host's security model that wasn't + * assigned yet. + */ + if (j >= host->nsecModels) { virReportError(VIR_ERR_XML_ERROR, "%s", - _("missing security model " - "when using multiple labels")); + _("missing security model and " + "it can't be assigned based on " + "host's capabilities")); + goto error; + } + /* Copy model from host. */ + def->seclabels[i]->model = strdup(host->secModels[j++].model); + if (def->seclabels[i]->model == NULL) { + virReportOOMError(); goto error; } } @@ -3175,8 +3177,8 @@ virSecurityLabelDefsParseXML(virDomainDefPtr def, error: ctxt->node = saved_node; - for (; i > 0; i--) { - virSecurityLabelDefFree(def->seclabels[i - 1]); + for (i = 0; i < n; i++) { + virSecurityLabelDefFree(def->seclabels[i]); } VIR_FREE(def->seclabels); def->nseclabels = 0; @@ -8166,7 +8168,7 @@ static virDomainDefPtr virDomainDefParseXML(virCapsPtr caps, /* analysis of security label, done early even though we format it * late, so devices can refer to this for defaults */ - if (virSecurityLabelDefsParseXML(def, ctxt, flags) == -1) + if (virSecurityLabelDefsParseXML(def, ctxt, caps, flags) == -1) goto error; /* Extract domain memory */ -- 1.7.12

3 13

[libvirt] [PATCH] Fix issue of PF brought down if VF is 8021.Qbh and pci passthrough
by Nishank Trivedi 31 Aug '12

31 Aug '12

If a 8021.Qbh network device supports SRIOV and its VF is being used in pci passthrough mode, when the guest is shutdown or destroyed, the PF inteface is also brought down. qemuDomainHostdevNetConfigRestore() finds out the PF for provided hostdev (which is VF) and passes it to virNetDevPortProfileDisassociate() as linkdev. Later, linkdev gets passed to virNetDevSetOnline() where the interface is brought down by clearing IFF_UP flag. Bringing down a PF, when only VF is being brought down is not expected behavior. This patch adds a check so that virNetDevSetOnline() is called only for PF and not if device is a VF. Signed-off-by: Nishank Trivedi <nistrive(a)cisco.com> --- src/util/virnetdevvportprofile.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/util/virnetdevvportprofile.c b/src/util/virnetdevvportprofile.c index 5213378..e231fca 100644 --- a/src/util/virnetdevvportprofile.c +++ b/src/util/virnetdevvportprofile.c @@ -1235,7 +1235,8 @@ virNetDevVPortProfileDisassociate(const char *macvtap_ifname, /* avoid disassociating twice */ if (vmOp == VIR_NETDEV_VPORT_PROFILE_OP_MIGRATE_IN_FINISH) break; - ignore_value(virNetDevSetOnline(linkdev, false)); + if (vf < 0) + ignore_value(virNetDevSetOnline(linkdev, false)); rc = virNetDevVPortProfileOp8021Qbh(linkdev, macvtap_macaddr, vf, virtPort, NULL, VIR_NETDEV_VPORT_PROFILE_LINK_OP_DISASSOCIATE); -- 1.7.11.4

3 2

[libvirt] [PATCH 1/1] Fix adding ports to OVS bridges without VLAN tags
by Kyle Mestery 31 Aug '12

31 Aug '12

The introduction of the new VLAN code, along with the fix from 5e465df6be8bcb00f0b4bff831e91f4042fae272, caused the addition of OVS ports to fail with the following message: ovs-vsctl: 00002|vsctl|ERR|: missing column name This fix takes into account the VLAN arguments are optional, and correctly sets up the command line to run the "ovs-vsctl" command to add ports to the OVS bridge. Signed-off-by: Kyle Mestery <kmestery(a)cisco.com> --- src/util/virnetdevopenvswitch.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/src/util/virnetdevopenvswitch.c b/src/util/virnetdevopenvswitch.c index 00271a0..fcf6d91 100644 --- a/src/util/virnetdevopenvswitch.c +++ b/src/util/virnetdevopenvswitch.c @@ -104,9 +104,15 @@ int virNetDevOpenvswitchAddPort(const char *brname, const char *ifname, } cmd = virCommandNew(OVSVSCTL); + + virCommandAddArgList(cmd, "--", "--may-exist", "add-port", + brname, ifname, NULL); + + if (virBufferCurrentContent(&buf) != "") + virCommandAddArgList(cmd, virBufferCurrentContent(&buf), NULL); + if (ovsport->profileID[0] == '\0') { - virCommandAddArgList(cmd, "--", "--may-exist", "add-port", - brname, ifname, virBufferCurrentContent(&buf), + virCommandAddArgList(cmd, "--", "set", "Interface", ifname, attachedmac_ex_id, "--", "set", "Interface", ifname, ifaceid_ex_id, "--", "set", "Interface", ifname, vmid_ex_id, @@ -114,8 +120,7 @@ int virNetDevOpenvswitchAddPort(const char *brname, const char *ifname, "external-ids:iface-status=active", NULL); } else { - virCommandAddArgList(cmd, "--", "--may-exist", "add-port", - brname, ifname, virBufferCurrentContent(&buf), + virCommandAddArgList(cmd, "--", "set", "Interface", ifname, attachedmac_ex_id, "--", "set", "Interface", ifname, ifaceid_ex_id, "--", "set", "Interface", ifname, vmid_ex_id, -- 1.7.11.4

3 3

[libvirt] [PATCH] Fix legacy xen driver when building without modules
by Jim Fehlig 31 Aug '12

31 Aug '12

When building without driver modules, I've noticed that the legacy xen driver no longer works. The attached patch fixes it, but I'm not sure if this is the correct fix. I need to do some more testing with and without modules, but wanted to raise this on the list for comments/suggestions. Thanks, Jim

2 4

[libvirt] [PATCH] nwfilter: fix loop generating too many rules
by Stefan Berger 30 Aug '12

30 Aug '12

The loop processing the trusted DHCP server generated one too many rules and added one final rules that accepted responses from all DHCP servers. Below patch fixes this. --- src/nwfilter/nwfilter_ebiptables_driver.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -3374,10 +3374,10 @@ ebtablesApplyDHCPOnlyRules(const char *i VIR_FREE(srcIPParam); - if (idx == num_dhcpsrvrs) - break; - idx++; + + if (idx >= num_dhcpsrvrs) + break; } virBufferAsprintf(&buf,

2 1

[libvirt] [PATCH] qemu: Clean up security driver initialisation and config file
by Peter Krempa 30 Aug '12

30 Aug '12

Commit d0c0e79ac646462aaa815f81ad324a0d3ef12954 left behind some dead code. (hasDAC can't be efectively set to true, because virSecurityManagerNew fails to load the "dac" driver) Also the configuration file for qemu driver still contains reference to the DAC driver that can't be enabled manualy. --- src/qemu/qemu.conf | 4 +++- src/qemu/qemu_driver.c | 16 ++++------------ 2 files changed, 7 insertions(+), 13 deletions(-) diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index fb22b7c..d3175fa 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -162,7 +162,9 @@ # driver at the same time, for this use a list of names separated by # comma and delimited by square brackets. For example: # -# security_driver = [ "selinux", "dac" ] +# security_driver = [ "selinux", "apparmor" ] +# +# Note: The DAC security driver is always enabled. # #security_driver = "selinux" diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 5d9f8c9..482a910 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -251,14 +251,10 @@ qemuSecurityInit(struct qemud_driver *driver) char **names; virSecurityManagerPtr mgr = NULL; virSecurityManagerPtr stack = NULL; - bool hasDAC = false; if (driver->securityDriverNames) { names = driver->securityDriverNames; while (names && *names) { - if (STREQ("dac", *names)) - hasDAC = true; - if (!(mgr = virSecurityManagerNew(*names, QEMU_DRIVER_NAME, driver->allowDiskFormatProbing, @@ -287,7 +283,7 @@ qemuSecurityInit(struct qemud_driver *driver) mgr = NULL; } - if (!hasDAC && driver->privileged) { + if (driver->privileged) { if (!(mgr = virSecurityManagerNewDAC(QEMU_DRIVER_NAME, driver->user, driver->group, @@ -296,13 +292,9 @@ qemuSecurityInit(struct qemud_driver *driver) driver->securityRequireConfined, driver->dynamicOwnership))) goto error; - if (!stack) { - if (!(stack = virSecurityManagerNewStack(mgr))) - goto error; - } else { - if (virSecurityManagerStackAddNested(stack, mgr) < 0) - goto error; - } + /* the stack is always initialized here */ + if (virSecurityManagerStackAddNested(stack, mgr) < 0) + goto error; mgr = NULL; } -- 1.7.12

2 3

[libvirt] [PATCH 0/2] Fix segfault and infinite loop when doing VCPU pinning
by Peter Krempa 30 Aug '12

30 Aug '12

See patch comments for details. Peter Krempa (2): qemu: Fix possible infinite loop and segfault on error path. vcpupin: Fix returning of arrays from virDomainVcpuPinAdd src/conf/domain_conf.c | 22 +++++++++++++--------- src/conf/domain_conf.h | 2 +- src/libxl/libxl_driver.c | 2 +- src/qemu/qemu_driver.c | 6 +++--- src/xen/xend_internal.c | 2 +- 5 files changed, 19 insertions(+), 15 deletions(-) -- 1.7.12

2 6

[libvirt] [PATCH] security: Re-apply commit ce53382ba28179d3a504b29b4f888b6e130d53f0
by Peter Krempa 30 Aug '12

30 Aug '12

Recent changes in the security driver discarded changes that fixed labeling un-confined guests. --- src/security/security_manager.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/security/security_manager.c b/src/security/security_manager.c index 367f7ad..07f5a9b 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -340,10 +340,12 @@ int virSecurityManagerGenLabel(virSecurityManagerPtr mgr, } if (seclabel->type == VIR_DOMAIN_SECLABEL_DEFAULT) { - if (sec_managers[i]->defaultConfined) + if (sec_managers[i]->defaultConfined) { seclabel->type = VIR_DOMAIN_SECLABEL_DYNAMIC; - else + } else { seclabel->type = VIR_DOMAIN_SECLABEL_NONE; + seclabel->norelabel = true; + } } if ((seclabel->type == VIR_DOMAIN_SECLABEL_NONE) && -- 1.7.12

2 2

[libvirt] [PATCH 0/2] Revert to blocking behavior of qemuAgentCommand
by Jiri Denemark 30 Aug '12

30 Aug '12

Commit 05447e3af44ec153314ff97cd611330d9b4b5730 made changes to qemuAgentCommand so that an arbitrary timeout can be passed to it. However, it did so partially in a very confusing way and partially in a totally wrong way. Jiri Denemark (2): qemu: Remove redundant parameter from qemuAgentSend qemu: Revert to blocking behavior of qemuAgentCommand src/qemu/qemu_agent.c | 46 ++++++++++++++++++++++++---------------------- 1 file changed, 24 insertions(+), 22 deletions(-) -- 1.7.12

3 6

[libvirt] [PATCH] Fix a crash when using Open vSwitch virtual ports
by Kyle Mestery 30 Aug '12

30 Aug '12

Fixup buffer usage when handling VLANs. Also fix the logic used to determine if the virNetDevVlanPtr is valid or not. Fixes crashes in the latest code when using Open vSwitch virtualports. Signed-off-by: Kyle Mestery <kmestery(a)cisco.com> --- src/util/virnetdevopenvswitch.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/src/util/virnetdevopenvswitch.c b/src/util/virnetdevopenvswitch.c index b903ae4..cdbc5ef 100644 --- a/src/util/virnetdevopenvswitch.c +++ b/src/util/virnetdevopenvswitch.c @@ -59,7 +59,7 @@ int virNetDevOpenvswitchAddPort(const char *brname, const char *ifname, char *ifaceid_ex_id = NULL; char *profile_ex_id = NULL; char *vmid_ex_id = NULL; - virBufferPtr buf; + virBuffer buf = VIR_BUFFER_INITIALIZER; virMacAddrFormat(macaddr, macaddrstr); virUUIDFormat(ovsport->interfaceID, ifuuidstr); @@ -79,13 +79,12 @@ int virNetDevOpenvswitchAddPort(const char *brname, const char *ifname, ovsport->profileID) < 0) goto out_of_memory; } - if (virtVlan) { - if (VIR_ALLOC(buf) < 0) - goto out_of_memory; + + if (virtVlan && virtVlan->nTags > 0) { /* Trunk port first */ - if (virtVlan->trunk) { - virBufferAddLit(buf, "trunk="); + if (virtVlan->trunk == true) { + virBufferAddLit(&buf, "trunk="); /* * Trunk ports have at least one VLAN. Do the first one @@ -93,21 +92,21 @@ int virNetDevOpenvswitchAddPort(const char *brname, const char *ifname, * start of the for loop if there are more than one VLANs * on this trunk port. */ - virBufferAsprintf(buf, "%d", virtVlan->tag[i]); + virBufferAsprintf(&buf, "%d", virtVlan->tag[i]); for (i = 1; i < virtVlan->nTags; i++) { - virBufferAddLit(buf, ","); - virBufferAsprintf(buf, "%d", virtVlan->tag[i]); + virBufferAddLit(&buf, ","); + virBufferAsprintf(&buf, "%d", virtVlan->tag[i]); } } else if (virtVlan->nTags) { - virBufferAsprintf(buf, "tag=%d", virtVlan->tag[0]); + virBufferAsprintf(&buf, "tag=%d", virtVlan->tag[0]); } } cmd = virCommandNew(OVSVSCTL); if (ovsport->profileID[0] == '\0') { virCommandAddArgList(cmd, "--", "--may-exist", "add-port", - brname, ifname, virBufferContentAndReset(buf), + brname, ifname, virBufferCurrentContent(&buf), "--", "set", "Interface", ifname, attachedmac_ex_id, "--", "set", "Interface", ifname, ifaceid_ex_id, "--", "set", "Interface", ifname, vmid_ex_id, @@ -116,7 +115,7 @@ int virNetDevOpenvswitchAddPort(const char *brname, const char *ifname, NULL); } else { virCommandAddArgList(cmd, "--", "--may-exist", "add-port", - brname, ifname, virBufferContentAndReset(buf), + brname, ifname, virBufferCurrentContent(&buf), "--", "set", "Interface", ifname, attachedmac_ex_id, "--", "set", "Interface", ifname, ifaceid_ex_id, "--", "set", "Interface", ifname, vmid_ex_id, @@ -135,7 +134,8 @@ int virNetDevOpenvswitchAddPort(const char *brname, const char *ifname, ret = 0; cleanup: - VIR_FREE(buf); + if (virBufferUse(&buf) > 0) + virBufferFreeAndReset(&buf); VIR_FREE(attachedmac_ex_id); VIR_FREE(ifaceid_ex_id); VIR_FREE(vmid_ex_id); -- 1.7.11.4

6 9

[libvirt] [PATCHv2] network: get vlan info for Open vSwitch interfaces from proper source
by Laine Stump 30 Aug '12

30 Aug '12

This bug was revealed by the crash described in https://bugzilla.redhat.com/show_bug.cgi?id=852383 The vlan info pointer sent to virNetDevOpenvswitchAddPort should never be non-NULL unless there is at least one tag. The factthat such a vlan info pointer was receveid pointed out that a caller was passing the wrong pointer. Instead of sending &net->vlan, the result of virDomainNetGetActualVlan(net) should be sent - that function will look for vlan info in net->data.network.actual->vlan, and in cany case return NULL instead of a pointer if the vlan info it finds has no tags. Aside from causing the crash, sending a hardcoded &net->vlan has the effect of ignoring vlan info from a <network> or <portgroup> config. --- Difference from V1: fix vlan arg in lcx_process.c too. src/lxc/lxc_process.c | 2 +- src/qemu/qemu_command.c | 2 +- src/uml/uml_conf.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c index cdbf14b..bcd59cb 100644 --- a/src/lxc/lxc_process.c +++ b/src/lxc/lxc_process.c @@ -325,7 +325,7 @@ static int virLXCProcessSetupInterfaceBridged(virConnectPtr conn, if (vport && vport->virtPortType == VIR_NETDEV_VPORT_PROFILE_OPENVSWITCH) ret = virNetDevOpenvswitchAddPort(brname, parentVeth, &net->mac, - vm->uuid, vport, &net->vlan); + vm->uuid, vport, virDomainNetGetActualVlan(net)); else ret = virNetDevBridgeAddPort(brname, parentVeth); if (ret < 0) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 8c32a4d..25f2451 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -258,7 +258,7 @@ qemuNetworkIfaceConnect(virDomainDefPtr def, err = virNetDevTapCreateInBridgePort(brname, &net->ifname, &net->mac, def->uuid, &tapfd, virDomainNetGetActualVirtPortProfile(net), - &net->vlan, + virDomainNetGetActualVlan(net), tap_create_flags); virDomainAuditNetDevice(def, net, "/dev/net/tun", tapfd >= 0); if (err < 0) { diff --git a/src/uml/uml_conf.c b/src/uml/uml_conf.c index 5461b42..410f3e2 100644 --- a/src/uml/uml_conf.c +++ b/src/uml/uml_conf.c @@ -141,7 +141,7 @@ umlConnectTapDevice(virConnectPtr conn, if (virNetDevTapCreateInBridgePort(bridge, &net->ifname, &net->mac, vm->uuid, NULL, virDomainNetGetActualVirtPortProfile(net), - &net->vlan, + virDomainNetGetActualVlan(net), VIR_NETDEV_TAP_CREATE_IFUP) < 0) { if (template_ifname) VIR_FREE(net->ifname); -- 1.7.11.4

2 1

[libvirt] [PATCH] network: get vlan info for Open vSwitch interfaces from proper source
by Laine Stump 30 Aug '12

30 Aug '12

This bug was revealed by the crash described in https://bugzilla.redhat.com/show_bug.cgi?id=852383 The vlan info pointer sent to virNetDevOpenvswitchAddPort should never be non-NULL unless there is at least one tag. The factthat such a vlan info pointer was receveid pointed out that a caller was passing the wrong pointer. Instead of sending &net->vlan, the result of virDomainNetGetActualVlan(net) should be sent - that function will look for vlan info in net->data.network.actual->vlan, and in cany case return NULL instead of a pointer if the vlan info it finds has no tags. Aside from causing the crash, sending a hardcoded &net->vlan has the effect of ignoring vlan info from a <network> or <portgroup> config. --- Since I'm not online in a regular fashion for the next few days (too bad I wasn't online in the 12 hours or so *before* the 0.10.0 release instead of after :-/), I would appreciate if whoever ACKs this could push it. Thanks! src/qemu/qemu_command.c | 2 +- src/uml/uml_conf.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 8c32a4d..25f2451 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -258,7 +258,7 @@ qemuNetworkIfaceConnect(virDomainDefPtr def, err = virNetDevTapCreateInBridgePort(brname, &net->ifname, &net->mac, def->uuid, &tapfd, virDomainNetGetActualVirtPortProfile(net), - &net->vlan, + virDomainNetGetActualVlan(net), tap_create_flags); virDomainAuditNetDevice(def, net, "/dev/net/tun", tapfd >= 0); if (err < 0) { diff --git a/src/uml/uml_conf.c b/src/uml/uml_conf.c index 5461b42..410f3e2 100644 --- a/src/uml/uml_conf.c +++ b/src/uml/uml_conf.c @@ -141,7 +141,7 @@ umlConnectTapDevice(virConnectPtr conn, if (virNetDevTapCreateInBridgePort(bridge, &net->ifname, &net->mac, vm->uuid, NULL, virDomainNetGetActualVirtPortProfile(net), - &net->vlan, + virDomainNetGetActualVlan(net), VIR_NETDEV_TAP_CREATE_IFUP) < 0) { if (template_ifname) VIR_FREE(net->ifname); -- 1.7.11.4

3 4

[libvirt] Release of libvirt-0.10.0
by Daniel Veillard 30 Aug '12

30 Aug '12

As planned, I tagged the release this morning and pushed the builds at the usual place: ftp://libvirt.org/libvirt/ This is a huge release, with close to 550 commits, which is normal considering the time since the 0.9.13 release, close to two month instead of one. I think it's better to go back to monthly releases schedule for now, and I would rather have the next one soon than late so expect to enter a freeze for 0.10.1 about 3 weeks from now. So quite a lot of features in that version including the Parallel driver. But there is a very large set of commits which are code improvements and refactoring which don't show up as features but are fairly large ! Features: - agent: add qemuAgentArbitraryCommand() for general qemu agent command (MATSUDA Daiki) - Introduce virDomainPinEmulator and virDomainGetEmulatorPinInfo functions. (Tang Chen) - network: use firewalld instead of iptables, when available (Thomas Woerner) - network: make network driver vlan-aware (Laine Stump) - esx: Implement network driver (Matthias Bolte) - driver for parallels hypervisor (Dmitry Guryanov) - Various LXC improvements (Daniel P. Berrange) - Add virDomainGetHostname (Guido Günther) Documentation: - CPU allocation and pinning clarification (Martin Kletzander) - libssh2_transport: Add docs to remote.html (Peter Krempa) - Fix some typos in messages, docs and comments. (Yuri Chornoivan) - fix blockpull/blockcopy bandwidth Mbps -> MiB/s (Stefan Hajnoczi) - qemu: modify 3 error messages (Martin Kletzander) - Enhance documentation of log_filters (Jiri Denemark) - Update libvirtd --help output to match code (Doug Goldstein) - Update paths in man page to reflect libvirtd code (Doug Goldstein) - Fix man page file paths to real paths (Doug Goldstein) - Update documentation for CPU quota/period support for LXC (Sukadev Bhattiprolu) - docs/virsh: various minor fixes (Martin Kletzander) - autogenerate search.php (Martin Kletzander) - fix 404 page when fetched from different location (Martin Kletzander) - Add method to print warnings in docBuilder class (Peter Krempa) - maint: avoid regression on copyright listings (Eric Blake) - maint: Use consistent copyright. (Osier Yang) - add more description on libvirtd option timeout (Guannan Ren) - virsh man page - domain-id consistency (Jan Tomko) - Fixup manpage names and copyright dates (Laine Stump) - conf: Fix typo in virDomainHostdevSubsys comment (Jiri Denemark) - maint: spelling correction in AUTHORS (Eric Blake) - virsh: Clarify that memtune parameters may be rounded in the man page (Jan Tomko) - Fix time keeping example for the guest clock (Doug Goldstein) - Desert the FSF address in copyright (Osier Yang) - Improve patch submission guidelines (Michal Privoznik) - Clarify direct migration (Jiri Denemark) - added description of the vendor_id attribute (Hendrik Schwartke) - virsh: Clarify documentation for virsh dompmsuspend command (Peter Krempa) Portability: - Don't require gawk for a simple print expression (Guido Günther) - Portability fixes for non-linux or old linux platforms (Daniel Veillard) - build: define 'inline' iff HAVE_LIBNL1 (Michal Privoznik) - build: work with older libnl1 headers (Eric Blake) - specfile: require libnl3 for Fedora >= 18 and RHEL >= 7 (Laine Stump) - build: add LIBNL_CFLAGS to build of libvirt_lxc (Laine Stump) - Fix a missing build requirement on dbus-devel (Daniel Veillard) - Fix parameter list in virNetlinkEvent{Add,Remove}Client Win32 stubs (Daniel P. Berrange) - build: avoid $(builddir) in Makefile (Eric Blake) - build: network requires location of dbus headers (Eric Blake) - atomic: mark header functions static (Eric Blake) - build: work with glibc that lacks CPU_COUNT (Eric Blake) - build: work with older RHEL 5 kernel (Eric Blake) - build: silence stupid gcc warning on STREQ_NULLABLE (Eric Blake) - Fix parsing of uid/gid on Mingw32 (Daniel P. Berrange) - build: fix build with autoconf 2.59 (Eric Blake) - Fix build of virsh on Win32 by moving SA_SIGINFO stub (Daniel P. Berrange) - Make Win32 stub of vshAskReedit non-static (Daniel P. Berrange) - Fix WIN32 conditional for disabling console command (Daniel P. Berrange) - build: avoid warnings on older gcc (Eric Blake) - Fix virJSONValueToString prototype for Mingw32 (Daniel P. Berrange) - random: link with -lm when needed (Eric Blake) - build: fix link error with appArmor (Eric Blake) - virsh.c: Fix compiler warning (Cole Robinson) - Avoid clash of base64 symbols (Daniel P. Berrange) - build: fix build without HAVE_CAPNG (Eric Blake) - Fix libnl CFLAGS/LIBS inclusion (Doug Goldstein) - build: fix compilation without struct ifreq (Eric Blake) - configure: rbd doesn't need -lcrypto (Cole Robinson) - build: fix typo that breaks non-Linux builds (Eric Blake) BugFixes: - nwfilter: Don't try to acquire DBus context when DBus is disabled (Peter Krempa) - util: Prevent libvirtd crash (Alex Jia) - security_dac: Don't return uninitialised uid and gid for image labels (Peter Krempa) - security_dac: Don't return uninitialised value when parsing seclabels (Peter Krempa) - security_dac: Avoid segfault when no label is requested (Peter Krempa) - util: Fix error message when getpwuid_r fails to find the user (Peter Krempa) - conf: Fix the problem which cause libvirtd to crash (Osier Yang) - qemu: Fix define logic (Michal Privoznik) - qemu_agent: Switch to virReportSystemError() on system error (Michal Privoznik) - conf: prevent NULL pointer access in virSecurityLabelDefsParseXML (Ján Tomko) - rpc: fix segmentation fault caused by null client-sock (Guannan Ren) - qemu: fix regression with spice tls port allocation (Martin Kletzander) - qemu: fix regression with pinning (Martin Kletzander) - virsh: fix missing return value (Alex Jia) - xen-xs: fix uuid of renamed domain (Philipp Hahn) - openvz: check the exitstatus of vzlist (Laine Stump) - network: fix virtual network bridge delay setting (Laine Stump) - qemu: forbid suspend if already pmsuspended (Michal Privoznik) - fix check of vcpuid in virDomainVcpuPinDefParseXML (Hu Tao) - util: eliminate erroneous VIR_WARNs in (eb|ip)tables.c (Laine Stump) - dnsmasq: avoid forwarding queries without a domain (Gene Czarcinski) - virsh: don't print error info when snapshot xml is not changed (Guannan Ren) - Fix typo in Makefile.am s/LDFOAGS/LDFLAGS/ (Daniel P. Berrange) - client: Change default location of known_hosts file for libssh2 layer (Peter Krempa) - command: avoid double close in virExecWithHook (Ján Tomko) - Fix regression generating image context (Daniel P. Berrange) - selinux: Fix incorrect object label generation. (Viktor Mihajlovski) - conf: log error when encountering multiple filterrefs in interface (Laine Stump) - openvz: unlock virDomainObj objects in openvzOpen (Dmitry Guryanov) - util: typos in fallback code fo virDoubleToStr (Martin Kletzander) - Fix timebomb in LIBVIRT_VERSION_INFO calculation (Daniel P. Berrange) - json: fix interface locale dependency (Martin Kletzander) - virsh: say save-image-edit failed only when it does (Ján Tomko) - sanlock: don't unlink lockspace if registration fails (Asad Saeed) - build: Distribute check-symfile.pl (Cole Robinson) - Release only specific sanlock resource (Frido Roose) - build: fix binary location in stap files --with-driver-modules (Laine Stump) - nwfilter: fix crash during filter define when lxc driver failed startup (Laine Stump) - nwfilter: remove target table before renaming it (Stefan Berger) - qemu: Fix debug message in p2p migration (Jiri Denemark) - Fix errno check, prevent spurious errors under heavy load (Peter Feiner) - rpc: fix a virObject typo error in struct _virNetServer (Guannan Ren) - Set LIBVIRT_AUTOSTART=0 when running test suites (Daniel P. Berrange) - qemu: Set reasonable RSS limit on domain startup (Michal Privoznik) - conf: Remove console stream callback only when freeing console helper (Peter Krempa) - client: Free message when freeing client (Peter Krempa) - build: fix "make rpm" (Laine Stump) - Fix typo s/AM_CLFAGS/AM_CFLAGS/ in sanlock link (Daniel P. Berrange) - virsh: console: Avoid using stream after being freed. (Peter Krempa) - remote: Fill snapshot argument in remoteDomainSnapshotListAllChildren (Peter Krempa) - qemu: Fix typo in qemuDomainModifyDeviceFlags (Michal Privoznik) - build: commit to 0.10.0 release naming (Eric Blake) - build: Link security driver into daemon (Jiri Denemark) - Fix rpm build failures (Daniel Veillard) - Add missing parallels_utils.h to Makefile.am (Daniel Veillard) - qemu: syntax fix (Marc-André Lureau) - qemu: fix use after free (Eric Blake) - build: distribute virsh related source files (Guannan Ren) - daemon: Fix crash in virTypedParameterArrayClear (Jiri Denemark) - conf: Remove callback from stream when freeing entries in console hash (Peter Krempa) - Process all pending I/O for a RPC client before checking EOF (Daniel P. Berrange) - libvirt-guests: systemd host shutdown does not work (Gerd v. Egidy) - virsh: Fix error resetting on fallback paths (Peter Krempa) - virsh: Check for existence of storage before undefining the domain (Peter Krempa) - util: Fix typoes on return value and comments (Guannan Ren) - fixed SegFault in virauth (Martin Kletzander) - virsh: fixed domdisplay command (Martin Kletzander) - building: fix deps error when some drivers are not built (Wen Congyang) - ESX: Fix ESX_VI__TEMPLATE__DYNAMIC_DEEP_COPY (Ata E Husain Bohra) - tests: avoid seclabeltest crash (Eric Blake) - Only enforce check for YAJL when starting a VM (Daniel P. Berrange) - Make the 'lxc_driver' global variable non-static (Gao feng) - Reset the 'quit' flag in virNetServerRun (Daniel P. Berrange) - Don't autostart domains when reloading config (Daniel P. Berrange) - esx: Fix esxVI_String_Deserialize (Matthias Bolte) - nodeinfo: deal with offline cpus in a node (Eric Blake) - lxcContainerMountCGroups also mounts a tmpfs that needs to be labeled. (Dan Walsh) - remote: Fix locking in stream APIs (Jiri Denemark) - qemu: Do not fail virConnectCompareCPU if host CPU is not known (Jiri Denemark) - qemu: Fix probing for guest capabilities (Jiri Denemark) - fix failure when building with --disable-debug (Hu Tao) - virsh: remove unnecessary sleep for nodecpustats --percent (Viktor Mihajlovski) - Fix daemon auto-spawning (Christophe Fergeau) - Fix directory removal in filesystem storage driver (Sascha Peilicke) - storage: Default pool permission mode to 0755 (Osier Yang) - Fix shutdown of LXC controller (Daniel P. Berrange) - openvz: Handle domain obj hash map errors (Guido Günther) - Fix /domain/features setting in qemuParseCommandLine (Christophe Fergeau) - systemd: start libvirtd after network (Jim Fehlig) - util: Use current uid and gid if they are passed as -1 for virDirCreate (Osier Yang) - virsh: Ensure the parents of the readline history path exists (Osier Yang) - Fix a string format bug in qemu_cgroup.c (tangchen) - storage_backend_fs: Allocate entry for host before accessing it (Peter Krempa) - storage_backend_fs: Don't free a part of a structure on error (Peter Krempa) - Only ummount /proc, /sys, /dev if the root source is '/' (Daniel P. Berrange) - Fix one test regression on auth Ceph support (Daniel Veillard) - Avoid build shared source files again for libvirt_lxc (Daniel P. Berrange) - qemu: Always set auth_supported for Ceph disks. (Wido den Hollander) - virsh: Fix ordering of arguments when calling vshCalloc. (Peter Krempa) - remote: Fill remote parameters in remoteDomainListAllSnapshots() (Peter Krempa) - qemu: Mark domains as having managed state image only on managed save (Peter Krempa) - fix key error for qemuMonitorGetBlockStatsInfo (lvroyce) Improvements: - Introduce new VIR_ERR_AGENT_UNRESPONSIVE error code (Michal Privoznik) - qemu: Switch to unified func name (Michal Privoznik) - snapshot: rename an enum (Eric Blake) - snapshot: split snapshot conf code into own file (Eric Blake) - snapshot: make virDomainSnapshotObjList opaque (Eric Blake) - conf: Don't always require security/@model (Michal Privoznik) - security: Add DAC to security_drivers (Michal Privoznik) - nwfilter: don't log error if firewalld is disabled, improve diagnostics (Laine Stump) - qemu-agent: available in 0.10.0 (Eric Blake) - agent: add qemu-agent-command to virsh (MATSUDA Daiki) - agent: add python module support (MATSUDA Daiki) - agent: add remote driver support (MATSUDA Daiki) - agent: add qemu driver support (MATSUDA Daiki) - agent: add virDrvDomainQemuAgentCommand prototype for drivers. (MATSUDA Daiki) - agent : add @seconds variable to qemuAgentSend(). (MATSUDA Daiki) - Add uevent netlink service. (Tang Chen) - Introduce virNetlinkEventServiceStopAll() to stop all netlink services. (Tang Chen) - Improve netlink to support all protocol. (Tang Chen) - libssh2_session: Add support for creating known_hosts file (Peter Krempa) - qemu: support of emulator_period and emulator_quota's modification (Wen Congyang) - new interface to control emulator_period/emulator_quota (Hu Tao) - qemu: introduce period/quota tuning for emulator (Hu Tao) - limit cpu bandwidth only for vcpus (Hu Tao) - new command emulatorpin (Hu Tao) - Add a new function vshPrintPinInfo. (Hu Tao) - remote: introduce emulator pinning RPCs (Tang Chen) - qemu: support emulator pinning (Hu Tao) - Introduce virDomainEmulatorPinAdd and virDomainEmulatorPinDel functions (Tang Chen) - Add qemuProcessSetEmulatorAffinites and set emulator threads affinities (Tang Chen) - qemu: synchronize emulatorpin info to cgroup (Tang Chen) - Support emulatorpin xml parse. (Tang Chen) - Change virDomainVcpuPinDefParseXML to support parsing emulatorpin (Hu Tao) - Enable cpuset cgroup and synchronous vcpupin info to cgroup. (Hu Tao) - updates of some vcpupin related functions (Hu Tao) - refactor virDomainVcpuPinAdd() (Hu Tao) - add function bitmapFromBytemap() to convert bytemap to bitmap (Hu Tao) - create a new cgroup and move all emulator threads to the new cgroup (Wen Congyang) - Introduce the function virCgroupMoveTask (Hu Tao) - Introduce the function virCgroupForEmulator (Wen Congyang) - output status information during guest shutdown again (Gerd v. Egidy) - qemu: Disk Geometry Override Support (J.B. Joret) - Support for Disk Geometry Override (J.B. Joret) - nwfilter: provide basic support for firewalld (Stefan Berger) - sanlock: Provide better error if lockspace directory is missing (Jiri Denemark) - daemon: Autodetect lock driver directory (Jiri Denemark) - build: split driver_storage into convenience library (Eric Blake) - libssh2_transport: Use libssh2 driver code in remote driver (Peter Krempa) - libssh2_transport: Add libssh2 session support to net client code (Peter Krempa) - libssh2_transport: add ssh context support to virNetSocket (Peter Krempa) - libssh2_transport: add main libssh2 transport implementation (Peter Krempa) - Add test case for SELinux label generation (Daniel P. Berrange) - Honour current sensitivity and category ranges in SELinux label generation (Daniel P. Berrange) - qemu: configurable remote display port boundaries (Martin Kletzander) - qemu: Unify port-wise SPICE and VNC behavior (Martin Kletzander) - virsh: split out virsh-volume.c (Eric Blake) - virsh: split out virsh-snapshot.c (Eric Blake) - virsh: split out virsh-secret.c (Eric Blake) - virsh: split out virsh-pool.c (Eric Blake) - virsh: split out virsh-nwfilter.c (Eric Blake) - virsh: split out virsh-nodedev.c (Eric Blake) - virsh: split out virsh-network.c (Eric Blake) - virsh: split out virsh-interface.c (Eric Blake) - virsh: declare more common functions (Eric Blake) - virsh: split out virsh-host.c (Eric Blake) - virsh: split out virsh-domain-monitor.c (Eric Blake) - Update the remote API (Marcelo Cerri) - Support for multiple default security drivers in QEMU config (Marcelo Cerri) - Update security layer to handle many security labels (Marcelo Cerri) - Multiple security drivers in XML data (Marcelo Cerri) - Internal refactory of data structures (Marcelo Cerri) - virsh: use common namespacing (Eric Blake) - Add support for creating sockets & RPC servers from a pre-opened fd (Daniel P. Berrange) - Refactor impl of the virNetServerClientNew method (Daniel P. Berrange) - Refactor the way new clients are registered with the server (Daniel P. Berrange) - virsh: split out virsh-domain.c (Eric Blake) - virsh: split out virsh.h (Eric Blake) - virsh: move vshWatchJob earlier (Eric Blake) - qemu: support netdevs from <forward mode='hostdev'> networks (Shradha Shah) - network: support <forward mode='hostdev'> in network driver (Shradha Shah) - conf: add function virDevicePCIAddressEqual (Shradha Shah) - network: return netdev name or pci addr of the VF in actualDevice (Shradha Shah) - conf: parser/formatter/rng for <forward mode='hostdev'> (Shradha Shah) - network: helper function to create interface pool from PF (Shradha Shah) - conf: move DevicePCIAddress functions to separate file (Shradha Shah) - conf: Fix ABI stability check for spicevmc channel (Jiri Denemark) - network: add support for setting VLANs on Open vSwitch ports (Kyle Mestery) - qemu: Set swap_hard_limit before hard_limit (Osier Yang) - build: ship stamp files (Eric Blake) - qemu: support setting vlan tag for <interface type='hostdev'> (Laine Stump) - util: properly save/restore original vlan tag for VFs (Laine Stump) - qemu: Ensure the cpuset is formatted as expected before passing to cgroup (Osier Yang) - conf: add <vlan> element to network and domain interface elements (Laine Stump) - util: add virNetDevVlanType (Laine Stump) - schema: fix some problems in network/interface schemas (Laine Stump) - util: include memory.h even if WITH_VIRTUALPORT isn't defined (Laine Stump) - Replace unset REMOTE_PID_FILE with proper value (Doug Goldstein) - Refactor RPC client private data setup (Daniel P. Berrange) - Add further debugging lines to domain lock manager (Daniel P. Berrange) - Allow sync IO and keepalives to be skipped in RPC client setup (Daniel P. Berrange) - Change interaction when accepting new RPC client connections (Daniel P. Berrange) - Add APIs for virThreadPoolPtr to query some config params (Daniel P. Berrange) - Allow control over JSON string pretty printing (Daniel P. Berrange) - Change function signature for creating new lock manager instances (Daniel P. Berrange) - parallels: add domain configuration example (Dmitry Guryanov) - parallels: cleanup parallelsOpen and fix error message (Dmitry Guryanov) - parallels: change URI to parallels:///system (Dmitry Guryanov) - virsh: Add helper to avoid the strcase check for virsh-*.c (Osier Yang) - network: add connections counter to networks (Laine Stump) - network: change cleanup: to success/cleanup/error: in network*() functions (Laine Stump) - conf: output forward device connections count in network XML (Laine Stump) - conf: rename interface "usageCount" to "connections" (Laine Stump) - conf: use a unique data type for PF array in virDomainNetDef (Laine Stump) - network: merge relevant virtualports rather than choosing one (Laine Stump) - conf: support partially-specified <virtualport> in parser and formatter (Laine Stump) - conf: simplify Buffer Indentation in virDomainNetDefFormat (Laine Stump) - conf: make error returns from virDomainActualNetDefFormat consistent (Laine Stump) - conf: move virtPortProfile out of unions in virDomainNetDef (Laine Stump) - util: utility functions for virNetDevVPortProfile (Laine Stump) - util: add openvswitch case to virNetDevVPortProfileEqual (Laine Stump) - util: eliminate union in virNetDevVPortProfile (Laine Stump) - util: make return value of virUUIDFormat and virMacAddrFormat useful (Laine Stump) - Pull code which finds a free MCS label out into its own method (Daniel P. Berrange) - Honour current user and role in SELinux label generation (Daniel P. Berrange) - Fix error reporting in virSecuritySELinuxGenNewContext (Daniel P. Berrange) - Use VIR_ERR_CONFIG_UNSUPPORTED if requested security driver is disabled (Daniel P. Berrange) - Add missing domain_conf.h include in security_manager.h (Daniel P. Berrange) - Add virRandom() API to generate numbers with non-power-of-2 limit (Daniel P. Berrange) - virsh: make 'help' command ignore spurious options (Cole Robinson) - virsh: Convert '<cmd> --help' to 'help <cmd>' (Cole Robinson) - virterror: Add error message for unsupported operations. (Peter Krempa) - build: fix PROBE() usage of intptr_t (Eric Blake) - esx: Remove redundant checks for esxVI_LookupHostSystemProperties result (Matthias Bolte) - esx: Fix dynamic deep copy (Matthias Bolte) - esx: Implement interface driver (Matthias Bolte) - Add APIs for obtaining the unique ID of LVM & SCSI volumes (Daniel P. Berrange) - examples: Update strings for event details (Jiri Denemark) - qemu: Migrate at unlimited speed by default (Jiri Denemark) - qemu: Refactor parsing of block device IO tuning parameters. (Peter Krempa) - remote: Clean up coding style and refactor remote connection opening (Peter Krempa) - Allow rbd backing stores (Peter Feiner) - qemu: add two qemu caps for lsi and virtio-scsi SCSI controllers (Guannan Ren) - qemu: add capabilities flags related to scsi controller (Guannan Ren) - util: include stderr in log message when an external command fails (Laine Stump) - Turn virNetClient* into virObject instances (Daniel P. Berrange) - Turn virNetServer* into virObject instances (Daniel P. Berrange) - Turn virSocket into a virObject (Daniel P. Berrange) - Turn virKeepAlive into a virObject (Daniel P. Berrange) - Turn virNetSASLContext and virNetSASLSession into virObject instances (Daniel P. Berrange) - Turn virNetTLSContext and virNetTLSSession into virObject instances (Daniel P. Berrange) - Turn qemuAgentPtr and qemuMonitorPtr into virObjectPtr instances (Daniel P. Berrange) - Turn virDomainObjPtr into a virObjectPtr (Daniel P. Berrange) - Convert public datatypes to inherit from virObject (Daniel P. Berrange) - Add a generic reference counted virObject type (Daniel P. Berrange) - apparmor: QEMU bridge helper policy updates (Richa Marwaha) - Add -netdev bridge support (Richa Marwaha) - Add -netdev bridge capabilities (Richa Marwaha) - virrandom: make virRandomInitialize an automatic one-shot (Eric Blake) - virsh: Use vshPrint instead of printf (Osier Yang) - xen-xm: Generate UUID if not specified (Jim Fehlig) - ESX: Add "Byte" datatype (Ata E Husain Bohra) - parallels: translate error message (Eric Blake) - Export virUUIDIsValid to libvirt internal code (Daniel P. Berrange) - qemu: Allow to attach/detach controller device persistently (Osier Yang) - Added timestamps to storage volumes (Hendrik Schwartke) - Update xml schemas according to libvirt source (Ján Tomko) - build: add stubs so mdns code can be unconditionally compiled (Eric Blake) - virsh: Switch to close callback (Michal Privoznik) - daemon: Portable auto-detection of driver module directory (Jiri Denemark) - build: Rename security manager library (Jiri Denemark) - build: Link security manager into libvirt.so (Jiri Denemark) - Rewrite virAtomic APIs using GLib's atomic ops code (Daniel P. Berrange) - Remove manual one-shot global initializers (Daniel P. Berrange) - qemu: Add support for "none" USB controller (Peter Krempa) - domain_conf: Add helpers to verify if device configuration is valid (Peter Krempa) - domain_conf: Add USB controler model "none" (Peter Krempa) - storage: netfs and iscsi need option srcSpec for resource discovery (Guannan Ren) - maint: consolidate AUTHOR listings for Gerd von Egidy (Gerd v. Egidy) - parallels: implement VM creation (Dmitry Guryanov) - parallels: add storage driver (Dmitry Guryanov) - parallels: implement virDomainDefineXML operation for existing domains (Dmitry Guryanov) - parallels: add support of VNC remote display (Dmitry Guryanov) - parallels: get info about serial ports (Dmitry Guryanov) - parallels: implement functions for domain life cycle management (Dmitry Guryanov) - parallels: add functions to list domains and get info (Dmitry Guryanov) - add function virCommandNewVAList (Dmitry Guryanov) - parallels: add driver skeleton (Dmitry Guryanov) - Only perform symbol check against libvirt.so (Daniel P. Berrange) - Don't link nwfilter or secrets driver to libvirt.so (Daniel P. Berrange) - Remove bogus libvirt_network.syms file (Daniel P. Berrange) - build: Don't export xenLinuxDomainBlockStats symbol (Jiri Denemark) - Improve error message in LXC startup with network is not active (Daniel P. Berrange) - Remove tabs from all perl files & enforce this (Daniel P. Berrange) - Add handling for reboots of LXC containers (Daniel P. Berrange) - Allow CAP_SYS_REBOOT on new enough kernels (Daniel P. Berrange) - Run an RPC protocol over the LXC controller monitor (Daniel P. Berrange) - Make RPC code generator a little more flexible (Daniel P. Berrange) - Move LXC monitor code out into separate file (Daniel P. Berrange) - Convert the LXC driver to use virNetClient (Daniel P. Berrange) - Replace use of lxcError with virReportError (Daniel P. Berrange) - Rename lxc_driver_t to virLXCDriver (Daniel P. Berrange) - Rename all APIs in lxc_domain.c to have a virLXCDomain prefix (Daniel P. Berrange) - Rename all APIs in lxc_process.c to have a virLXCProcess prefix (Daniel P. Berrange) - Extend events demo to show close callbacks in use (Daniel P. Berrange) - Update remote driver to support the connection close callbacks (Daniel P. Berrange) - Add callback to virNetClient to be invoked on connection close (Daniel P. Berrange) - Ensure client is marked for close in all error paths (Daniel P. Berrange) - Add public API to register a callback to be invoked on connection close (Daniel P. Berrange) - esx: Improve error reporting for unknown VI types (Matthias Bolte) - security: Skip labeling resources when seclabel defaults to none (Jiri Denemark) - lib: Revert removing of Summary and Description fields in headers (Peter Krempa) - Add a test case that checks there are no bogus entries in .syms (Daniel P. Berrange) - virsh: Refactor error clearing on graceful fallback paths (Peter Krempa) - maint: don't permit format strings without % (Eric Blake) - maint: avoid empty regex in syntax checker (Eric Blake) - virsh: check if specified debug level is in range (Ján Tomko) - build: update to latest gnulib, for secure tarball (Eric Blake) - util: set minimum value of nodesuspend duration to 60 seconds (Guannan Ren) - virsh: Move command group definition into its own file (Osier Yang) - virsh: Split cmds in node device group from virsh.c (Osier Yang) - virsh: Split cmds in host group from virsh.c (Osier Yang) - virsh: Split cmds to manage domain snapshot from virsh.c (Osier Yang) - virsh: Split cmds to manage secret from virsh.c (Osier Yang) - virsh: Split cmds to manage network filter from virsh.c (Osier Yang) - virsh: Split cmds to manage host interface from virsh.c (Osier Yang) - virsh: Split cmds to manage network from virsh.c (Osier Yang) - virsh: Split cmds of storage pool group from virsh.c (Osier Yang) - virsh: Split cmds of storage volume group from virsh.c (Osier Yang) - virsh: Split cmds of domain group from virsh.c (Osier Yang) - virsh: Split cmds for domain monitoring from virsh.c (Osier Yang) - virsh: Move definition of cmds and cmd groups right at the top of main (Osier Yang) - daemon: Fix the wrong macro name (Osier Yang) - More advanced auto-detection of driver module directory (Daniel P. Berrange) - adding handling EINTR to poll to make it more robust (Royce Lv) - build: regenerate .png files (Eric Blake) - Make ESX & Hyper-V code generator safe with parallel builds (Daniel P. Berrange) - tests: Add support for catching domain XML parsing errors (Peter Krempa) - maint: Clean up coding style and fix error message spelling (Peter Krempa) - Fix test failure when no IPv6 is avail (Doug Goldstein) - vmx: handle shared folders parsing (Jean-Baptiste Rouault) - vmx: handle shared folders formatting (Jean-Baptiste Rouault) - openvz: Implement domainGetHostname (Guido Günther) - openvz: Add openvzVEGetStringParam (Guido Günther) - remote: Provide RPC call for domainGetHostname (Guido Günther) - virsh: Add domhostname (Guido Günther) - Report 'errno' in int1 field of virErrorPtr (Daniel P. Berrange) - Use a hash table for storing MCS labels (Daniel P. Berrange) - Fix error handling when adding MCS labels (Daniel P. Berrange) - Use standard naming prefix for SELinux driver function names (Daniel P. Berrange) - Disable NWFilter driver completely when unprivileged (Daniel P. Berrange) - Replace use of custom macros with virReportError in the Xen drivers (Daniel P. Berrange) - Make sure xenHypervisorInit correctly reports errors (Daniel P. Berrange) - Ensure failure to talk to Xen hypervisor is fatal when privileged (Daniel P. Berrange) - Using virOnce for global initialization (Daniel P. Berrange) - Replace use of VMX_ERROR with virReportError (Daniel P. Berrange) - Replace use of virNetError with virReportError (Daniel P. Berrange) - Replace use of virConfError with virReportError (Daniel P. Berrange) - Replace use of nodeReportError with virReportError (Daniel P. Berrange) - Replace use of virSecurityReportError with virReportError (Daniel P. Berrange) - Replace use of PHYP_ERROR with virReportError (Daniel P. Berrange) - Replace use of HYPERV_ERROR with virReportError (Daniel P. Berrange) - Replace use of ESX_ERROR & ESX_VI_ERROR with virReportError (Daniel P. Berrange) - Replace use of virLockError with virReportError (Daniel P. Berrange) - Replace use of libxlError with virReportError (Daniel P. Berrange) - Add missing "%s" format string to constant error messages in lock manager (Jiri Denemark) - Add missing "%s" format string to constant error messages in libxl driver (Jiri Denemark) - Replace use of streamsReportError with virReportError (Daniel P. Berrange) - Replace use of remoteError with virReportError (Daniel P. Berrange) - Replace use of XENXS_ERROR with virReportError (Daniel P. Berrange) - Replace use of openvzError with virReportError (Daniel P. Berrange) - Fix Xen driver to have sensible error messages (Daniel P. Berrange) - Move LXC process management code into separate file (Daniel P. Berrange) - Move cgroup setup code out of lxc_controller.c (Daniel P. Berrange) - Move LXC domain private data into separate file (Daniel P. Berrange) - Replace use of vmwareError with virReportError (Daniel P. Berrange) - Replace use of virCPUReportError with virReportError (Daniel P. Berrange) - Replace use of testError with virReportError (Daniel P. Berrange) - Replace use of vboxError with virReportError (Daniel P. Berrange) - Replace use of xenapiError with virReportError (Daniel P. Berrange) - Replace use of qemuReportError with virReportError (Daniel P. Berrange) - qemu: Add missing "%s" before translation macros (Peter Krempa) - Replace use of umlReportError with virReportError (Daniel P. Berrange) - Add lots of internal symbols to libvirt_private.syms (Daniel P. Berrange) - If in delay close mode for an RPC client, don't read further data (Daniel P. Berrange) - Add missing deps on driver modules in libvirt RPM (Daniel P. Berrange) - Replace use of networkReportError with virReportError (Daniel P. Berrange) - maint: add mailmap entry for Dan Walsh (Eric Blake) - esx: Extend esxVI_CURL_Download for partial downloads (Matthias Bolte) - Replace use of interfaceReportError with virReportError (Daniel P. Berrange) - Replace use of virNWFilterReportError with virReportError (Daniel P. Berrange)i Add missing "%s" with constant string error message in nwfilter_dhcpsnoop.c (Daniel P. Berrange) - Add a sheepdog backend for the storage driver (Sebastian Wiedenroth) - Mount all tmpfs filesystems with correct SELinux label (Daniel J Walsh) - Replace use of virNodeDeviceReportError with virReportError (Daniel P. Berrange) - Replace use of virSecretReportError with virReportError (Daniel P. Berrange) - Replace use of virStorageReportError with virReportError (Daniel P. Berrange) - Add missing "%s" format to const error message in RBD storage driver (Daniel P. Berrange) - Convert all files in src/conf/ to use virReportError() (Daniel P. Berrange) - Add missing _(...) around 2 error messages in test driver (Daniel P. Berrange) - Fix parameter passed with VIR_ERR_INVALID_ARG in sanlock driver (Daniel P. Berrange) - Convert all files in src/rpc/ to use virReportError() (Daniel P. Berrange) - Convert (nearly) all files in src/util/ to use virReportError() (Daniel P. Berrange) - Fix bogus cast to (int) in virNetServerMDNSTimeoutNew (Daniel P. Berrange) - Add missing "%s" with constant string error message in stats_linux.c (Daniel P. Berrange) - Remove newline from end of error message in virnodesuspend.c (Daniel P. Berrange) - Add _(...) around two error messages in src/util/ (Daniel P. Berrange) - Introduce virReportError macro for general error reporting (Daniel P. Berrange) - xenapi: Convert to virMacAddr (Jiri Denemark) - nwfilter: Convert to virMacAddrPtr not virMacAddrPtr* (Michal Privoznik) - nwfilter: Convert to virMacAddrPtr completely (Michal Privoznik) - Convert 'raw MAC address' usages to use virMacAddr (Stefan Berger) - Wire up handling for QMP's BALLOON_EVENT (Daniel P. Berrange) - Define public API for receiving guest memory balloon events (Daniel P. Berrange) - ARMHF: CPU Support for armhf. (Chuck Short) - Support creation of sparse LVM volumes (Daniel P. Berrange) - Remove all use of virRun in storage code (Daniel P. Berrange) - test: Add test case for nodeinfotest if host machine doesn't have NUMA (Peter Krempa) - test: Add new test case for nodeinfotest (Peter Krempa) - nodeinfo: Fix gathering of nodeinfo data structure (Peter Krempa) - nodeinfo_test: Enhance test data before changing nodeinfo gathering (Peter Krempa) - S390: Adding testcases for s390 (Viktor Mihajlovski) - S390: Domain Schema for s390-virtio machines. (Viktor Mihajlovski) - S390: Add support for virtio-s390 devices. (Viktor Mihajlovski) - qemu: Change tests to use (modified) qemuDomainAssignAddresses (Viktor Mihajlovski) - qemu: Extended qemuDomainAssignAddresses to be callable from everywhere. (Viktor Mihajlovski) - build: detect all improper uses of _("%s") (Eric Blake) - maint: update preferred contributor name (Eric Blake) - storage_conf: Break long line and polish coding style (Peter Krempa) - esx: Wrap libcurl multi handle (Matthias Bolte) - Switch to using virNetServer APIs for monitor socket (Daniel P. Berrange) - Move loop device setup code into virfile.{c,h} (Daniel P. Berrange) - Move cgroup objects into virLXCControllerPtr (Daniel P. Berrange) - Move monitor into virLXCControllerPtr (Daniel P. Berrange) - Move /dev/pts setup out of virLXCControllerRun (Daniel P. Berrange) - Move security manager into virLXCControllerPtr object (Daniel P. Berrange) - Move loop device FDs into virLXCControllerPtr object (Daniel P. Berrange) - Move daemon handshake FD into virLXCControllerPtr (Daniel P. Berrange) - Make console handling part of virLXCControllerPtr (Daniel P. Berrange) - Store the init PID in the virLXCController object (Daniel P. Berrange) - Move veth device management into virLXCControllerPtr object (Daniel P. Berrange) - Introduce a virLXCControllerPtr object to hold LXC controller state (Daniel P. Berrange) - Allow RPC server to run single threaded (Daniel P. Berrange) - Add a opaque parameter to the RPC client init callback (Daniel P. Berrange) - vmware: detect when a domain was shut down from the inside (Jean-Baptiste Rouault) - Added the attribute vendor_id to the cpu model (Hendrik Schwartke) - qemu: add rbd to whitelist of migration-safe formats (Josh Durgin) Cleanups: - atomic: fix whitespace in previous patch (Eric Blake) - virsh: drop unused headers (Eric Blake) - maint: prohibit translations in testsuite (Eric Blake) - Fix syntax-check failures wrt virsh (Daniel P. Berrange) - virsh: kill some double underscores (Eric Blake) - Fix the indentions of libvirt.h.in (Osier Yang) - build: fix syntax check during 'make distcheck' (Eric Blake) - Move some SASL symbols into libvirt_sasl.syms (Daniel P. Berrange) - Remove unused qemuProcessAutoDestroyRun decl from header (Daniel P. Berrange) - maint: drop a leftover comment line (Eric Blake) - Destroy virdomainlist.[ch] (Osier Yang) - qemu:rename qemuCheckScsiControllerModel function (Guannan Ren) - Don't check the 'connect' command in virsh-all test (Daniel P. Berrange) - build: drop conditional use of mdns code (Eric Blake) - Remove unused uuidstr variable from datatypes.c (Daniel P. Berrange) - Fix indentions (Osier Yang) - gitignore: Reorder alphabetically (Michal Privoznik) - spec: Remove extra () with return statement (Jiri Denemark) - conf: Remove dead code from virConsoleOpen() (Peter Krempa) - python: Don't generate bodies for close callback functions (Peter Krempa) - maint: regenerate bootstrap (Eric Blake) - Remove accidentally commited virNetClientSetEOFNotify symbol (Daniel P. Berrange) - Remove two non-existant NWFilter driver symbols from .syms (Daniel P. Berrange) - tests: reduce length of nodeinfodata test names (Eric Blake) - rpc: remove trailing whitespace character in error string (Guannan Ren) - po: avoid spurious double spaces in messages (Eric Blake) - virsh: remove extra space between function name and opening brace (Guido Günther) - maint: revert gnulib update, until fixed automake is in more distros (Eric Blake) - maint: use full author name for previous commit (Eric Blake) That's a long list, a very long list, so thanks everybody for the huge work, be it with patches, bug reports, documentation fixes, etc. ! Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

4 6

[libvirt] [PATCH] Fix configuration of QEMU security drivers
by Daniel P. Berrange 30 Aug '12

30 Aug '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> If no 'security_driver' config option was set, then the code just loaded the 'dac' security driver. This is a regression on previous behaviour, where we would probe for a possible security driver. ie default to SELinux if available. This changes things so that it 'security_driver' is not set, we once again do probing. For simplicity we also always create the stack driver, even if there is only one driver active. The desired semantics are: - security_driver not set -> probe for selinux/apparmour/nop -> auto-add DAC driver - security_driver set to a string -> add that one driver -> auto-add DAC driver - security_driver set to a list -> add all drivers in list -> auto-add DAC driver It is not allowed, or possible to specify 'dac' in the security_driver config param, since that is always enabled. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/qemu/qemu_driver.c | 135 +++++++++++++--------------------------- src/security/security_manager.c | 8 ++- src/security/security_stack.c | 38 ++++------- src/security/security_stack.h | 8 --- 4 files changed, 61 insertions(+), 128 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 9a25253..374349a 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -249,119 +249,70 @@ static int qemuSecurityInit(struct qemud_driver *driver) { char **names; - char *primary = NULL; virSecurityManagerPtr mgr = NULL; - virSecurityManagerPtr nested = NULL; virSecurityManagerPtr stack = NULL; bool hasDAC = false; - /* set the name of the primary security driver */ - if (driver->securityDriverNames) - primary = driver->securityDriverNames[0]; - - /* add primary security driver */ - if ((primary == NULL && driver->privileged) || - STREQ_NULLABLE(primary, "dac")) { - if (!driver->privileged) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("DAC security driver usable only when " - "running privileged (as root)")); - goto error; - } - - mgr = virSecurityManagerNewDAC(QEMU_DRIVER_NAME, - driver->user, - driver->group, - driver->allowDiskFormatProbing, - driver->securityDefaultConfined, - driver->securityRequireConfined, - driver->dynamicOwnership); - hasDAC = true; - } else { - mgr = virSecurityManagerNew(primary, - QEMU_DRIVER_NAME, - driver->allowDiskFormatProbing, - driver->securityDefaultConfined, - driver->securityRequireConfined); - } - - if (!mgr) - goto error; - - /* We need a stack to group the security drivers if: - * - additional drivers are provived in configuration - * - the primary driver isn't DAC and we are running privileged - */ - if ((driver->privileged && !hasDAC) || - (driver->securityDriverNames && driver->securityDriverNames[1])) { - if (!(stack = virSecurityManagerNewStack(mgr))) - goto error; - mgr = stack; - } - - /* Loop through additional driver names and add them as nested */ if (driver->securityDriverNames) { - names = driver->securityDriverNames + 1; + names = driver->securityDriverNames; while (names && *names) { - if (STREQ("dac", *names)) { - /* A DAC driver has specific parameters */ - if (!driver->privileged) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("DAC security driver usable only when " - "running privileged (as root)")); - goto error; - } - - nested = virSecurityManagerNewDAC(QEMU_DRIVER_NAME, - driver->user, - driver->group, - driver->allowDiskFormatProbing, - driver->securityDefaultConfined, - driver->securityRequireConfined, - driver->dynamicOwnership); + if (STREQ("dac", *names)) hasDAC = true; - } else { - nested = virSecurityManagerNew(*names, - QEMU_DRIVER_NAME, - driver->allowDiskFormatProbing, - driver->securityDefaultConfined, - driver->securityRequireConfined); - } - - if (!nested) - goto error; - if (virSecurityManagerStackAddNested(stack, nested)) + if (!(mgr = virSecurityManagerNew(*names, + QEMU_DRIVER_NAME, + driver->allowDiskFormatProbing, + driver->securityDefaultConfined, + driver->securityRequireConfined))) goto error; - - nested = NULL; + if (!stack) { + if (!(stack = virSecurityManagerNewStack(mgr))) + goto error; + } else { + if (virSecurityManagerStackAddNested(stack, mgr) < 0) + goto error; + } + mgr = NULL; names++; } - } - - if (driver->privileged && !hasDAC) { - if (!(nested = virSecurityManagerNewDAC(QEMU_DRIVER_NAME, - driver->user, - driver->group, - driver->allowDiskFormatProbing, - driver->securityDefaultConfined, - driver->securityRequireConfined, - driver->dynamicOwnership))) + } else { + if (!(mgr = virSecurityManagerNew(NULL, + QEMU_DRIVER_NAME, + driver->allowDiskFormatProbing, + driver->securityDefaultConfined, + driver->securityRequireConfined))) goto error; - - if (virSecurityManagerStackAddNested(stack, nested)) + if (!(stack = virSecurityManagerNewStack(mgr))) goto error; + mgr = NULL; + } - nested = NULL; + if (!hasDAC && driver->privileged) { + if (!(mgr = virSecurityManagerNewDAC(QEMU_DRIVER_NAME, + driver->user, + driver->group, + driver->allowDiskFormatProbing, + driver->securityDefaultConfined, + driver->securityRequireConfined, + driver->dynamicOwnership))) + goto error; + if (!stack) { + if (!(stack = virSecurityManagerNewStack(mgr))) + goto error; + } else { + if (virSecurityManagerStackAddNested(stack, mgr) < 0) + goto error; + } + mgr = NULL; } - driver->securityManager = mgr; + driver->securityManager = stack; return 0; error: VIR_ERROR(_("Failed to initialize security drivers")); + virSecurityManagerFree(stack); virSecurityManagerFree(mgr); - virSecurityManagerFree(nested); return -1; } diff --git a/src/security/security_manager.c b/src/security/security_manager.c index 0e106d5..367f7ad 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -49,6 +49,12 @@ static virSecurityManagerPtr virSecurityManagerNewDriver(virSecurityDriverPtr dr { virSecurityManagerPtr mgr; + VIR_DEBUG("drv=%p (%s) virtDriver=%s allowDiskFormatProbing=%d " + "defaultConfined=%d requireConfined=%d", + drv, drv->name, virtDriver, + allowDiskFormatProbing, defaultConfined, + requireConfined); + if (VIR_ALLOC_VAR(mgr, char, drv->privateDataLen) < 0) { virReportOOMError(); return NULL; @@ -80,7 +86,7 @@ virSecurityManagerPtr virSecurityManagerNewStack(virSecurityManagerPtr primary) if (!mgr) return NULL; - virSecurityStackAddPrimary(mgr, primary); + virSecurityStackAddNested(mgr, primary); return mgr; } diff --git a/src/security/security_stack.c b/src/security/security_stack.c index 7dcd626..0eb7e76 100644 --- a/src/security/security_stack.c +++ b/src/security/security_stack.c @@ -38,35 +38,31 @@ struct _virSecurityStackItem { }; struct _virSecurityStackData { - virSecurityManagerPtr primary; virSecurityStackItemPtr itemsHead; }; int -virSecurityStackAddPrimary(virSecurityManagerPtr mgr, - virSecurityManagerPtr primary) -{ - virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); - if (virSecurityStackAddNested(mgr, primary) < 0) - return -1; - priv->primary = primary; - return 0; -} - -int virSecurityStackAddNested(virSecurityManagerPtr mgr, virSecurityManagerPtr nested) { virSecurityStackItemPtr item = NULL; virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + virSecurityStackItemPtr tmp; + + tmp = priv->itemsHead; + while (tmp && tmp->next) + tmp = tmp->next; if (VIR_ALLOC(item) < 0) { virReportOOMError(); return -1; } item->securityManager = nested; - item->next = priv->itemsHead; - priv->itemsHead = item; + if (tmp) + tmp->next = item; + else + priv->itemsHead = item; + return 0; } @@ -74,19 +70,7 @@ virSecurityManagerPtr virSecurityStackGetPrimary(virSecurityManagerPtr mgr) { virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); - return (priv->primary) ? priv->primary : priv->itemsHead->securityManager; -} - -void virSecurityStackSetPrimary(virSecurityManagerPtr mgr, - virSecurityManagerPtr primary) -{ - virSecurityStackAddPrimary(mgr, primary); -} - -void virSecurityStackSetSecondary(virSecurityManagerPtr mgr, - virSecurityManagerPtr secondary) -{ - virSecurityStackAddNested(mgr, secondary); + return priv->itemsHead->securityManager; } static virSecurityDriverStatus diff --git a/src/security/security_stack.h b/src/security/security_stack.h index 6898c03..5bb3be7 100644 --- a/src/security/security_stack.h +++ b/src/security/security_stack.h @@ -27,19 +27,11 @@ extern virSecurityDriver virSecurityDriverStack; int -virSecurityStackAddPrimary(virSecurityManagerPtr mgr, - virSecurityManagerPtr primary); -int virSecurityStackAddNested(virSecurityManagerPtr mgr, virSecurityManagerPtr nested); virSecurityManagerPtr virSecurityStackGetPrimary(virSecurityManagerPtr mgr); -void virSecurityStackSetPrimary(virSecurityManagerPtr mgr, - virSecurityManagerPtr primary); -void virSecurityStackSetSecondary(virSecurityManagerPtr mgr, - virSecurityManagerPtr secondary); - virSecurityManagerPtr* virSecurityStackGetNested(virSecurityManagerPtr mgr); -- 1.7.11.2

3 3

[libvirt] [PATCH] qemu: Sort the numa params only when it requires to affect the live config
by Osier Yang 30 Aug '12

30 Aug '12

As the next boot doesn't have to worry about the previous numa params setting (there is no). --- src/qemu/qemu_driver.c | 52 ++++++++++++++++++++++++----------------------- 1 files changed, 27 insertions(+), 25 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 955744a..bc7de9f 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -7204,32 +7204,34 @@ qemuDomainSetMemoryParameters(virDomainPtr dom, goto cleanup; } - /* Get current swap hard limit */ - rc = virCgroupGetMemSwapHardLimit(group, &val); - if (rc != 0) { - virReportSystemError(-rc, "%s", - _("unable to get swap hard limit")); - goto cleanup; - } + if (flags & VIR_DOMAIN_AFFECT_LIVE) { + /* Get current swap hard limit */ + rc = virCgroupGetMemSwapHardLimit(group, &val); + if (rc != 0) { + virReportSystemError(-rc, "%s", + _("unable to get swap hard limit")); + goto cleanup; + } - /* Swap hard_limit and swap_hard_limit to ensure the setting - * could succeed if both of them are provided. - */ - if (swap_hard_limit && hard_limit) { - virTypedParameter param; - - if (swap_hard_limit->value.ul > val) { - if (hard_limit_index < swap_hard_limit_index) { - param = params[hard_limit_index]; - params[hard_limit_index] = params[swap_hard_limit_index]; - params[swap_hard_limit_index] = param; - } - } else { - if (hard_limit_index > swap_hard_limit_index) { - param = params[hard_limit_index]; - params[hard_limit_index] = params[swap_hard_limit_index]; - params[swap_hard_limit_index] = param; - } + /* Swap hard_limit and swap_hard_limit to ensure the setting + * could succeed if both of them are provided. + */ + if (swap_hard_limit && hard_limit) { + virTypedParameter param; + + if (swap_hard_limit->value.ul > val) { + if (hard_limit_index < swap_hard_limit_index) { + param = params[hard_limit_index]; + params[hard_limit_index] = params[swap_hard_limit_index]; + params[swap_hard_limit_index] = param; + } + } else { + if (hard_limit_index > swap_hard_limit_index) { + param = params[hard_limit_index]; + params[hard_limit_index] = params[swap_hard_limit_index]; + params[swap_hard_limit_index] = param; + } + } } } -- 1.7.7.3

2 3