- Devel - libvirt List Archives

[libvirt] [PATCH v5 0/6] file descriptor passing using fd sets
by Corey Bryant 07 Aug '12

07 Aug '12

libvirt's sVirt security driver provides SELinux MAC isolation for Qemu guest processes and their corresponding image files. In other words, sVirt uses SELinux to prevent a QEMU process from opening files that do not belong to it. sVirt provides this support by labeling guests and resources with security labels that are stored in file system extended attributes. Some file systems, such as NFS, do not support the extended attribute security namespace, and therefore cannot support sVirt isolation. A solution to this problem is to provide fd passing support, where libvirt opens files and passes file descriptors to QEMU. This, along with SELinux policy to prevent QEMU from opening files, can provide image file isolation for NFS files stored on the same NFS mount. This patch series adds the add-fd, remove-fd, and query-fdsets QMP monitor commands, which allow file descriptors to be passed via SCM_RIGHTS, and assigned to specified fd sets. This allows fd sets to be created per file with fds having, for example, different access rights. When QEMU needs to reopen a file with different access rights, it can search for a matching fd in the fd set. Fd sets also allow for easy tracking of fds per file, helping to prevent fd leaks. Support is also added to the block layer to allow QEMU to dup an fd from an fdset when the filename is of the /dev/fdset/nnn format, where nnn is the fd set ID. No new SELinux policy is required to prevent open of NFS files (files with type nfs_t). The virt_use_nfs boolean type simply needs to be set to false, and open will be prevented (and dup will be allowed). For example: # setsebool virt_use_nfs 0 # getsebool virt_use_nfs virt_use_nfs --> off Corey Bryant (6): qemu-char: Add MSG_CMSG_CLOEXEC flag to recvmsg qapi: Introduce add-fd, remove-fd, query-fdsets monitor: Clean up fd sets on monitor disconnect block: Convert open calls to qemu_open block: Convert close calls to qemu_close block: Enable qemu_open/close to work with fd sets block/raw-posix.c | 42 ++++----- block/raw-win32.c | 6 +- block/vdi.c | 5 +- block/vmdk.c | 25 +++--- block/vpc.c | 4 +- block/vvfat.c | 16 ++-- cutils.c | 5 ++ monitor.c | 244 ++++++++++++++++++++++++++++++++++++++++++++++++++++- monitor.h | 4 + osdep.c | 141 +++++++++++++++++++++++++++++++ qapi-schema.json | 97 +++++++++++++++++++++ qemu-char.c | 10 ++- qemu-common.h | 2 + qemu-tool.c | 12 +++ qmp-commands.hx | 121 ++++++++++++++++++++++++++ savevm.c | 4 +- 16 files changed, 684 insertions(+), 54 deletions(-) -- 1.7.10.4

3 35

[libvirt] [PATCH] Add support for firewalld (new version)
by Thomas Woerner 07 Aug '12

07 Aug '12

* bridge_driver, nwfilter_driver: new dbus filters to get FirewallD1.Reloaded signal and DBus.NameOwnerChanged on org.fedoraproject.FirewallD1 * iptables, ebtables, nwfilter_ebiptables_driver: use firewall-cmd direct passthrough interface * spec file changed as requested --- configure.ac | 8 ++++++ libvirt.spec.in | 11 ++++++++ src/Makefile.am | 8 +++--- src/network/bridge_driver.c | 46 +++++++++++++++++++++++++++++++ src/nwfilter/nwfilter_driver.c | 46 +++++++++++++++++++++++++++++++ src/nwfilter/nwfilter_ebiptables_driver.c | 32 +++++++++++++++++++++ src/util/ebtables.c | 35 +++++++++++++++++++++++ src/util/iptables.c | 21 ++++++++++++-- 8 files changed, 201 insertions(+), 6 deletions(-) diff --git a/configure.ac b/configure.ac index 8a04d91..7142450 100644 --- a/configure.ac +++ b/configure.ac @@ -1282,6 +1282,14 @@ AM_CONDITIONAL([HAVE_POLKIT1], [test "x$with_polkit1" = "xyes"]) AC_SUBST([POLKIT_CFLAGS]) AC_SUBST([POLKIT_LIBS]) +dnl firewalld +AC_ARG_WITH([firewalld], + AC_HELP_STRING([--with-firewalld], [enable firewalld support])) +if test "x$with_firewalld" = "xyes" ; then + AC_DEFINE_UNQUOTED([HAVE_FIREWALLD], [1], [whether firewalld support is enabled]) +fi +AM_CONDITIONAL([HAVE_FIREWALLD], [test "x$with_firewalld" = "xyes"]) + dnl Avahi library AC_ARG_WITH([avahi], AC_HELP_STRING([--with-avahi], [use avahi to advertise remote daemon @<:@default=check@:>@]), diff --git a/libvirt.spec.in b/libvirt.spec.in index 67b955a..ea2fd88 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -106,6 +106,7 @@ %define with_sanlock 0%{!?_without_sanlock:0} %define with_systemd 0%{!?_without_systemd:0} %define with_numad 0%{!?_without_numad:0} +%define with_firewalld 0%{!?_without_firewalld:0} # Non-server/HV driver defaults which are always enabled %define with_python 0%{!?_without_python:1} @@ -146,6 +147,11 @@ %define with_systemd 1 %endif +# Fedora 18 / RHEL-7 are first where firewalld support is enabled +%if 0%{?fedora} >= 17 || 0%{?rhel} >= 7 +%define with_firewalld 1 +%endif + # RHEL-5 has restricted QEMU to x86_64 only and is too old for LXC %if 0%{?rhel} == 5 %define with_qemu_tcg 0 @@ -1182,6 +1188,10 @@ of recent versions of Linux (and other OSes). %define _without_driver_modules --without-driver-modules %endif +%if %{with_firewalld} +%define _with_firewalld --with-firewalld +%endif + %define when %(date +"%%F-%%T") %define where %(hostname) %define who %{?packager}%{!?packager:Unknown} @@ -1240,6 +1250,7 @@ autoreconf -if %{?_without_audit} \ %{?_without_dtrace} \ %{?_without_driver_modules} \ + %{?_with_firewalld} \ %{with_packager} \ %{with_packager_version} \ --with-qemu-user=%{qemu_user} \ diff --git a/src/Makefile.am b/src/Makefile.am index 6ed4a41..f3f4731 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -989,7 +989,7 @@ libvirt_driver_network_la_SOURCES = libvirt_driver_network_la_LIBADD = libvirt_driver_network_impl.la if WITH_DRIVER_MODULES mod_LTLIBRARIES += libvirt_driver_network.la -libvirt_driver_network_la_LIBADD += ../gnulib/lib/libgnu.la $(LIBNL_LIBS) +libvirt_driver_network_la_LIBADD += ../gnulib/lib/libgnu.la $(LIBNL_LIBS) $(DBUS_LIBS) libvirt_driver_network_la_LDFLAGS = -module -avoid-version $(AM_LDFLAGS) else noinst_LTLIBRARIES += libvirt_driver_network.la @@ -999,7 +999,7 @@ endif libvirt_driver_network_impl_la_CFLAGS = \ $(LIBNL_CFLAGS) \ - -I$(top_srcdir)/src/conf $(AM_CFLAGS) + -I$(top_srcdir)/src/conf $(AM_CFLAGS) $(DBUS_CFLAGS) libvirt_driver_network_impl_la_SOURCES = $(NETWORK_DRIVER_SOURCES) endif EXTRA_DIST += network/default.xml @@ -1149,9 +1149,9 @@ noinst_LTLIBRARIES += libvirt_driver_nwfilter.la #libvirt_la_BUILT_LIBADD += libvirt_driver_nwfilter.la endif libvirt_driver_nwfilter_la_CFLAGS = $(LIBPCAP_CFLAGS) \ - -I$(top_srcdir)/src/conf $(LIBNL_CFLAGS) $(AM_CFLAGS) + -I$(top_srcdir)/src/conf $(LIBNL_CFLAGS) $(AM_CFLAGS) $(DBUS_CFLAGS) libvirt_driver_nwfilter_la_LDFLAGS = $(LD_AMFLAGS) -libvirt_driver_nwfilter_la_LIBADD = $(LIBPCAP_LIBS) $(LIBNL_LIBS) +libvirt_driver_nwfilter_la_LIBADD = $(LIBPCAP_LIBS) $(LIBNL_LIBS) $(DBUS_LIBS) if WITH_DRIVER_MODULES libvirt_driver_nwfilter_la_LIBADD += ../gnulib/lib/libgnu.la libvirt_driver_nwfilter_la_LDFLAGS += -module -avoid-version diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index a5046f1..86b178e 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -61,6 +61,7 @@ #include "virnetdev.h" #include "virnetdevbridge.h" #include "virnetdevtap.h" +#include "virdbus.h" #define NETWORK_PID_DIR LOCALSTATEDIR "/run/libvirt/network" #define NETWORK_STATE_DIR LOCALSTATEDIR "/lib/libvirt/network" @@ -248,6 +249,24 @@ networkAutostartConfigs(struct network_driver *driver) { } } +#if HAVE_FIREWALLD +static DBusHandlerResult +firewalld_dbus_filter_bridge(DBusConnection *connection ATTRIBUTE_UNUSED, DBusMessage *message, void *user_data) { + struct network_driver *_driverState = user_data; + + if (dbus_message_is_signal(message, DBUS_INTERFACE_DBUS, + "NameOwnerChanged") || + dbus_message_is_signal(message, "org.fedoraproject.FirewallD1", + "Reloaded")) + { + VIR_DEBUG("Reload in bridge_driver because of firewalld."); + networkReloadIptablesRules(_driverState); + } + + return DBUS_HANDLER_RESULT_NOT_YET_HANDLED; +} +#endif + /** * networkStartup: * @@ -256,6 +275,9 @@ networkAutostartConfigs(struct network_driver *driver) { static int networkStartup(int privileged) { char *base = NULL; +#ifdef HAVE_FIREWALLD + DBusConnection *sysbus = NULL; +#endif if (VIR_ALLOC(driverState) < 0) goto error; @@ -322,6 +344,30 @@ networkStartup(int privileged) { networkDriverUnlock(driverState); +#ifdef HAVE_FIREWALLD + if (!(sysbus = virDBusGetSystemBus())) { + virErrorPtr err = virGetLastError(); + VIR_WARN("DBus not available, disabling firewalld support in bridge_driver: %s", err->message); + } else { + /* add matches for + * NameOwnerChanged on org.freedesktop.DBus for firewalld start/stop + * Reloaded on org.fedoraproject.FirewallD1 for firewalld reload + */ + dbus_bus_add_match(sysbus, + "type='signal'" + ",interface='"DBUS_INTERFACE_DBUS"'" + ",member='NameOwnerChanged'" + ",arg0='org.fedoraproject.FirewallD1'", + NULL); + dbus_bus_add_match(sysbus, + "type='signal'" + ",interface='org.fedoraproject.FirewallD1'" + ",member='Reloaded'", + NULL); + dbus_connection_add_filter(sysbus, firewalld_dbus_filter_bridge, driverState, NULL); + } +#endif + return 0; out_of_memory: diff --git a/src/nwfilter/nwfilter_driver.c b/src/nwfilter/nwfilter_driver.c index 4fa73f8..09db599 100644 --- a/src/nwfilter/nwfilter_driver.c +++ b/src/nwfilter/nwfilter_driver.c @@ -27,6 +27,9 @@ #include <config.h> +#include "virdbus.h" +#include "logging.h" + #include "internal.h" #include "virterror_internal.h" @@ -49,6 +52,8 @@ static virNWFilterDriverStatePtr driverState; static int nwfilterDriverShutdown(void); +static int nwfilterDriverReload(void); + static void nwfilterDriverLock(virNWFilterDriverStatePtr driver) { virMutexLock(&driver->lock); @@ -58,6 +63,21 @@ static void nwfilterDriverUnlock(virNWFilterDriverStatePtr driver) virMutexUnlock(&driver->lock); } +#if HAVE_FIREWALLD +static DBusHandlerResult +firewalld_dbus_filter_nwfilter(DBusConnection *connection ATTRIBUTE_UNUSED, DBusMessage *message, void *user_data ATTRIBUTE_UNUSED) { + if (dbus_message_is_signal(message, DBUS_INTERFACE_DBUS, + "NameOwnerChanged") || + dbus_message_is_signal(message, "org.fedoraproject.FirewallD1", + "Reloaded")) + { + VIR_DEBUG("Reload in nwfilter_driver because of firewalld."); + nwfilterDriverReload(); + } + + return DBUS_HANDLER_RESULT_NOT_YET_HANDLED; +} +#endif /** * virNWFilterStartup: @@ -68,6 +88,32 @@ static int nwfilterDriverStartup(int privileged) { char *base = NULL; +#ifdef HAVE_FIREWALLD + DBusConnection *sysbus = NULL; + + if (!(sysbus = virDBusGetSystemBus())) { + virErrorPtr err = virGetLastError(); + VIR_WARN("DBus not available, disabling firewalld support in nwfilter_driver: %s", err->message); + } else { + /* add matches for + * NameOwnerChanged on org.freedesktop.DBus for firewalld start/stop + * Reloaded on org.fedoraproject.FirewallD1 for firewalld reload + */ + dbus_bus_add_match(sysbus, + "type='signal'" + ",interface='"DBUS_INTERFACE_DBUS"'" + ",member='NameOwnerChanged'" + ",arg0='org.fedoraproject.FirewallD1'", + NULL); + dbus_bus_add_match(sysbus, + "type='signal'" + ",interface='org.fedoraproject.FirewallD1'" + ",member='Reloaded'", + NULL); + dbus_connection_add_filter(sysbus, firewalld_dbus_filter_nwfilter, NULL, NULL); + } +#endif + if (!privileged) return 0; diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 6d6bc3b..6f3133f 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -4127,6 +4127,7 @@ ebiptablesDriverInit(bool privileged) { virBuffer buf = VIR_BUFFER_INITIALIZER; char *errmsg = NULL; + char *firewall_cmd_path = NULL; if (!privileged) return 0; @@ -4137,6 +4138,35 @@ ebiptablesDriverInit(bool privileged) gawk_cmd_path = virFindFileInPath("gawk"); grep_cmd_path = virFindFileInPath("grep"); + firewall_cmd_path = virFindFileInPath("firewall-cmd"); + if (firewall_cmd_path) { + virBufferAsprintf(&buf, "IPT=%s\n", firewall_cmd_path); + /* basic probing */ + virBufferAsprintf(&buf, + CMD_DEF("$IPT --state") CMD_SEPARATOR + CMD_EXEC + "%s", + CMD_STOPONERR(1)); + + if (ebiptablesExecCLI(&buf, NULL, NULL) >= 0) { + VIR_DEBUG("Using firewall-cmd in nwfilter_ebiptables_driver."); + ebtables_cmd_path = NULL; + iptables_cmd_path = NULL; + ip6tables_cmd_path = NULL; + ignore_value(virAsprintf(&ebtables_cmd_path, "%s --direct --passthrough eb", firewall_cmd_path)); + ignore_value(virAsprintf(&iptables_cmd_path, "%s --direct --passthrough ipv4", firewall_cmd_path)); + ignore_value(virAsprintf(&ip6tables_cmd_path, "%s --direct --passthrough ipv6", firewall_cmd_path)); + if (!ebtables_cmd_path || !iptables_cmd_path || !ip6tables_cmd_path) { + virReportOOMError(); + return -1; + } + + } + VIR_FREE(firewall_cmd_path); + } + if (ebtables_cmd_path == NULL || iptables_cmd_path == NULL || + ip6tables_cmd_path == NULL) { + ebtables_cmd_path = virFindFileInPath("ebtables"); if (ebtables_cmd_path) { NWFILTER_SET_EBTABLES_SHELLVAR(&buf); @@ -4194,6 +4224,8 @@ ebiptablesDriverInit(bool privileged) VIR_WARN("Could not find 'ip6tables' executable"); } + } + /* ip(6)tables support needs gawk & grep, ebtables doesn't */ if ((iptables_cmd_path != NULL || ip6tables_cmd_path != NULL) && (!grep_cmd_path || !gawk_cmd_path)) { diff --git a/src/util/ebtables.c b/src/util/ebtables.c index ca056b1..6f4d151 100644 --- a/src/util/ebtables.c +++ b/src/util/ebtables.c @@ -176,11 +176,34 @@ ebtablesAddRemoveRule(ebtRules *rules, int action, const char *arg, ...) const char *s; int n, command_idx; +#if HAVE_FIREWALLD + int ret; + char *firewall_cmd_path = NULL; + virCommandPtr cmd = NULL; + + firewall_cmd_path = virFindFileInPath("firewall-cmd"); + if (firewall_cmd_path) { + cmd = virCommandNew(firewall_cmd_path); + virCommandAddArgList(cmd, "--state", NULL); + ret = virCommandRun(cmd, NULL); + if (ret != 0) { + VIR_FREE(firewall_cmd_path); + firewall_cmd_path = NULL; + } + virCommandFree(cmd); + } +#endif + n = 1 + /* /sbin/ebtables */ 2 + /* --table foo */ 2 + /* --insert bar */ 1; /* arg */ +#if HAVE_FIREWALLD + if (firewall_cmd_path) + n += 3; /* --direct --passthrough eb */ +#endif + va_start(args, arg); while (va_arg(args, const char *)) n++; @@ -192,6 +215,18 @@ ebtablesAddRemoveRule(ebtRules *rules, int action, const char *arg, ...) n = 0; +#if HAVE_FIREWALLD + if (firewall_cmd_path) { + if (!(argv[n++] = strdup(firewall_cmd_path))) + goto error; + if (!(argv[n++] = strdup("--direct"))) + goto error; + if (!(argv[n++] = strdup("--passthrough"))) + goto error; + if (!(argv[n++] = strdup("eb"))) + goto error; + } else +#endif if (!(argv[n++] = strdup(EBTABLES_PATH))) goto error; diff --git a/src/util/iptables.c b/src/util/iptables.c index b23aca9..7bad39d 100644 --- a/src/util/iptables.c +++ b/src/util/iptables.c @@ -101,9 +101,26 @@ iptablesAddRemoveRule(iptRules *rules, int family, int action, { va_list args; int ret; - virCommandPtr cmd; + virCommandPtr cmd = NULL; const char *s; - + char *firewall_cmd_path = NULL; + +#if HAVE_FIREWALLD + firewall_cmd_path = virFindFileInPath("firewall-cmd"); + if (firewall_cmd_path) { + cmd = virCommandNew(firewall_cmd_path); + virCommandAddArgList(cmd, "--state", NULL); + ret = virCommandRun(cmd, NULL); + if (ret == 0) { + cmd = virCommandNew(firewall_cmd_path); + virCommandAddArgList(cmd, "--direct", "--passthrough", + (family == AF_INET6) ? "ipv6" : "ipv4", NULL); + } else + cmd = NULL; + VIR_FREE(firewall_cmd_path); + } + if (!cmd) +#endif cmd = virCommandNew((family == AF_INET6) ? IP6TABLES_PATH : IPTABLES_PATH); -- 1.7.11.2

1 0

[libvirt] [PATCH] Set LIBVIRT_AUTOSTART=0 when running test suites
by Daniel P. Berrange 07 Aug '12

07 Aug '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> Occassionally some test cases will (accidentally) try to spawn libvirtd. Set the LIBVIRT_AUTOSTART=0 environment variable to ensure the remote driver never tries autostart. --- tests/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/Makefile.am b/tests/Makefile.am index 2fdaace..60d322d 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -244,6 +244,7 @@ TESTS_ENVIRONMENT = \ PATH="$(path_add)$(PATH_SEPARATOR)$$PATH" \ SHELL="$(SHELL)" \ LIBVIRT_DRIVER_DIR="$(abs_top_builddir)/src/.libs" \ + LIBVIRT_AUTOSTART=0 \ LC_ALL=C \ $(VG) -- 1.7.10.4

2 1

[libvirt] [PATCH] Don't check the 'connect' command in virsh-all test
by Daniel P. Berrange 07 Aug '12

07 Aug '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> The 'virsh-all' test case will invoke each virsh command with no args. With the 'connect' command this causes virsh to try to connect to the default URI, which in turn tries to spawn libvirtd. This is not something we want todo in the test suite, so skip the 'connect' command. --- tests/virsh-all | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/virsh-all b/tests/virsh-all index 2650b86..d4e2633 100755 --- a/tests/virsh-all +++ b/tests/virsh-all @@ -25,7 +25,7 @@ fail=0 test_url=test:///default -$abs_top_builddir/tools/virsh -c $test_url help > cmds || framework_failure +$abs_top_builddir/tools/virsh -c $test_url help | grep -v connect > cmds || framework_failure cmds=$(sed -n 's/^ $[^ ][^ ]*$ .*/\1/p' cmds) || framework_failure test -n "$cmds" || framework_failure -- 1.7.10.4

2 1

[libvirt] on special migration(domain defined, not started yet)
by liguang 07 Aug '12

07 Aug '12

Hi, All If a VM domain defined, but not started yet, and I want to migrate it to another server, so that It can be started at there, what's should i do? or is it rational? seems libvirt migration process haven't consider this condition, e.g. virsh migrate --p2p --tunnelled dom1 qemu+ssh://1.1.1.1/system will fail @ qemuMigrationPerformJob where it call virDomainObjIsActive to see if domain is active, but now domain is inactive, so fail. Thanks!

2 4

[libvirt] [test-API][PATCH] Delete the unused util param
by Wayne Sun 07 Aug '12

07 Aug '12

The util is undefined and cause case run fail, it's with no use and should be deleted. Signed-off-by: Wayne Sun <gsun(a)redhat.com> --- repos/interface/create.py | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/repos/interface/create.py b/repos/interface/create.py index 50d92d2..f5ef308 100644 --- a/repos/interface/create.py +++ b/repos/interface/create.py @@ -25,7 +25,7 @@ def display_current_interface(conn): logger.debug("current defined host interface list: %s " \ % conn.listDefinedInterfaces()) -def check_create_interface(ifacename, util): +def check_create_interface(ifacename): """Check creating interface result, it will can ping itself if create interface is successful. """ @@ -67,7 +67,7 @@ def create(params): ifaceobj.create(0) logger.info("create host interface %s" % ifacename) display_current_interface(conn) - if check_create_interface(ifacename, util): + if check_create_interface(ifacename): logger.info("create host interface %s is successful" % ifacename) else: logger.error("fail to check create interface") -- 1.7.1

2 1

[libvirt] [PATCH 0/2] Add lsi and virtio-scsi qemu caps
by Guannan Ren 07 Aug '12

07 Aug '12

On qemu-kvm-0.15.1, it supports only lsi scsi controller model. On qemu-kvm-0.12.1.2, it supports only virtio-scsi-pci scsi model On qemu 1.1.50, it supports both. So, instead of using the lsilogic model by default, the patch tries to check which model the current QEMU supports, then choose it, lsi has the priority. If a scsi model is given in XML explicitly, we try to check if the underlying QEMU supports it or not, raise an error on checking failure. Guannan Ren(2) (1/2)qemu: add two qemu caps for lsi and virtio-scsi SCSI controllers (2/2)test: add lsi and virtio-scsi qemu caps in testcases. src/qemu/qemu_capabilities.c | 7 --- src/qemu/qemu_capabilities.h | 2 - src/qemu/qemu_command.c | 88 +++++++++++------------------------------ src/qemu/qemu_command.h | 3 +- tests/qemuhelptest.c | 10 +--- tests/qemuxml2argvtest.c | 16 +++----- 6 files changed, 34 insertions(+), 92 deletions(-)

2 4

[libvirt] [PATCH v3 00/10] Introduce a virObject module for reference counting
by Daniel P. Berrange 07 Aug '12

07 Aug '12

A followup to: https://www.redhat.com/archives/libvir-list/2012-July/msg01733.html New in v3: - Introduce virObjectFreeCallback - Remove bogus ATTRIBUTE_NONNULL annotations - Add virObjectUnref/FreeCallback to useless-if-before-free checks - Other misc issues pointed out - Merged patches already ACKd

2 26

[libvirt] [PATCH] Add APIs for obtaining the unique ID of LVM & SCSI volumes
by Daniel P. Berrange 07 Aug '12

07 Aug '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> Both LVM volumes and SCSI LUNs have a globally unique identifier associated with them. It is useful to be able to query this identifier to then perform disk locking, rather than try to figure out a stable pathname. --- src/util/storage_file.c | 93 +++++++++++++++++++++++++++++++++++++++++++++++++ src/util/storage_file.h | 3 ++ 2 files changed, 96 insertions(+) diff --git a/src/util/storage_file.c b/src/util/storage_file.c index f38aa8e..56fd322 100644 --- a/src/util/storage_file.c +++ b/src/util/storage_file.c @@ -24,6 +24,7 @@ #include <config.h> #include "storage_file.h" +#include <command.h> #include <sys/stat.h> #include <unistd.h> #include <fcntl.h> @@ -38,6 +39,7 @@ #include "virterror_internal.h" #include "logging.h" #include "virfile.h" +#include "c-ctype.h" #define VIR_FROM_THIS VIR_FROM_STORAGE @@ -1073,3 +1075,94 @@ int virStorageFileIsClusterFS(const char *path) VIR_STORAGE_FILE_SHFS_GFS2 | VIR_STORAGE_FILE_SHFS_OCFS); } + +#ifdef LVS +const char *virStorageFileGetLVMKey(const char *path) +{ + /* + * # lvs --noheadings --unbuffered --nosuffix --options "uuid" LVNAME + * 06UgP5-2rhb-w3Bo-3mdR-WeoL-pytO-SAa2ky + */ + char *key = NULL; + virCommandPtr cmd = virCommandNewArgList( + LVS, + "--noheadings", "--unbuffered", "--nosuffix", + "--options", "uuid", path, + NULL + ); + + /* Run the program and capture its output */ + virCommandSetOutputBuffer(cmd, &key); + if (virCommandRun(cmd, NULL) < 0) + goto cleanup; + + if (key) { + char *nl; + char *tmp = key; + + /* Find first non-space character */ + while (*tmp && c_isspace(*tmp)) { + tmp++; + } + /* Kill leading spaces */ + if (tmp != key) + memmove(key, tmp, strlen(tmp)+1); + + /* Kill trailing newline */ + if ((nl = strchr(key, '\n'))) + *nl = '\0'; + } + + if (key && STREQ(key, "")) + VIR_FREE(key); + +cleanup: + virCommandFree(cmd); + + return key; +} +#else +const char *virStorageFileGetLVMKey(const char *path) +{ + virReportSystemError(ENOSYS, _("Unable to get LVM key for %s"), path); + return NULL; +} +#endif + +#ifdef HAVE_UDEV +const char *virStorageFileGetSCSIKey(const char *path) +{ + char *key = NULL; + virCommandPtr cmd = virCommandNewArgList( + "/lib/udev/scsi_id", + "--replace-whitespace", + "--whitelisted", + "--device", path, + NULL + ); + + /* Run the program and capture its output */ + virCommandSetOutputBuffer(cmd, &key); + if (virCommandRun(cmd, NULL) < 0) + goto cleanup; + + if (key && STRNEQ(key, "")) { + char *nl = strchr(key, '\n'); + if (nl) + *nl = '\0'; + } else { + VIR_FREE(key); + } + +cleanup: + virCommandFree(cmd); + + return key; +} +#else +const char *virStorageFileGetSCSIKey(const char *path) +{ + virReportSystemError(ENOSYS, _("Unable to get SCSI key for %s"), path); + return NULL; +} +#endif diff --git a/src/util/storage_file.h b/src/util/storage_file.h index 1fbe08e..99a5e36 100644 --- a/src/util/storage_file.h +++ b/src/util/storage_file.h @@ -86,4 +86,7 @@ int virStorageFileIsClusterFS(const char *path); int virStorageFileIsSharedFSType(const char *path, int fstypes); +const char *virStorageFileGetLVMKey(const char *path); +const char *virStorageFileGetSCSIKey(const char *path); + #endif /* __VIR_STORAGE_FILE_H__ */ -- 1.7.11.2

3 5

[libvirt] Memory Ballooning for VM Issue
by xuanmao_001 07 Aug '12

07 Aug '12

Hi, I have some problems with qemu ballooning. I saw the qemu docs. I found the qemu monitor command "balloon" that can request VM to change its memory allocation to value(in MB). it requested qemu command line with "-balloon virtio", then I start qemu into monitor mode with memory 512MB. first show balloon information. (qemu) info balloon (qemu)balloon: actual=512 the command above if like this, I think the balloon device worked fine. (qemu) balloon 400 there was no error when I executed this command. but when I executed "info balloon", the result was still 512. Is there something wrong? please give me some ideas. thanks. qemu-kvm version: 1.0.1 linux kernel version: 3.1.6 xuanmao_001

1 0

[libvirt] [PATCH] qemu_agent: support guest-info command
by MATSUDA, Daiki 06 Aug '12

06 Aug '12

Currently, libvirt qemu agent supports some QEMU Guest Agent's commands or use them. But they are not adapted to communication test to the Domain OS. So, QEMU Guest Agent provide 'guest-info' command to display its version and their commands. And I wrote the codes for supporting it. virsh # guest-agent-info RHEL62_32 Version: 1.1.0 Commands: guest-network-get-interfaces guest-suspend-hybrid guest-suspend-ram guest-suspend-disk guest-fsfreeze-thaw guest-fsfreeze-freeze guest-fsfreeze-status guest-file-flush guest-file-seek guest-file-write guest-file-read guest-file-close guest-file-open guest-shutdown guest-info guest-ping guest-sync guest-sync-delimited I am sorry that attached patch is against libvirt-0.9.13-rc1, because my network environment can not access via git and header code is not built with the problem gnulib... Regards MATSUDA Daiki

4 16

[libvirt] [Patch v3 0/3] Add QEMU network helper support
by rmarwah＠linux.vnet.ibm.com 06 Aug '12

06 Aug '12

From: Richa Marwaha <rmarwah(a)linux.vnet.ibm.com> QEMU has a new feature which allows QEMU to execute under an unprivileged user ID and still be able to add a tap device to a Linux network bridge. Below is the link to the QEMU patches for the bridge helper feature: http://lists.gnu.org/archive/html/qemu-devel/2012-01/msg03562.html The existing libvirt tap network device support for adding a tap device to a bridge (-netdev tap) works only when connected to a libvirtd instance running as the privileged system account 'root'. When connected to a libvirtd instance running as an unprivileged user (ie. using the session URI) creation of the tap device fails as follows: error: Failed to start domain F14_64 error: Unable to create tap device vnet%d: Operation not permitted With this support, creating a tap device in the above scenario will be possible. Additionally, hot attaching a tap device to a bridge while running when connected to a libvirtd instance running as an unprivileged user will be possible. Richa Marwaha (3): Add -netdev bridge capabilities Add -netdev bridge support apparmor: QEMU bridge helper policy updates AUTHORS | 1 + examples/apparmor/libvirt-qemu | 21 ++++++++++++++- src/qemu/qemu_capabilities.c | 13 ++++++--- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 57 +++++++++++++++++++++++++++++---------- src/qemu/qemu_command.h | 2 + src/qemu/qemu_hotplug.c | 31 ++++++++++++++------- tests/qemuhelptest.c | 3 +- 8 files changed, 98 insertions(+), 31 deletions(-)

4 10

[libvirt] [PATCH] Fix save/restore with USB controller in XML.
by Ján Tomko 06 Aug '12

06 Aug '12

USB controller gets put on the first place in XML, but the default one is added at the end of the controllers array. Sorting them before checking ABI compatibility solves this. The default USB controller also doesn't get a PCI address assigned, making virDomainDeviceInfoCheckABIStability fail. --- src/conf/domain_conf.c | 55 +++++++++++++++++++++++++++++++++++++++++++++-- 1 files changed, 52 insertions(+), 3 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 58603a3..c98802a 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -9765,8 +9765,10 @@ static bool virDomainControllerDefCheckABIStability(virDomainControllerDefPtr sr } } - if (!virDomainDeviceInfoCheckABIStability(&src->info, &dst->info)) - goto cleanup; + /* don't check device info for the default USB controller */ + if (!(src->type == VIR_DOMAIN_CONTROLLER_TYPE_USB && src->idx == 0 && src->model == -1)) + if (!virDomainDeviceInfoCheckABIStability(&src->info, &dst->info)) + goto cleanup; identical = true; @@ -10180,6 +10182,27 @@ cleanup: return identical; } +static int virDomainControllerCmp(const void *ctrl1, + const void *ctrl2) +{ + virDomainControllerDefPtr c1 = *(virDomainControllerDefPtr*) ctrl1; + virDomainControllerDefPtr c2 = *(virDomainControllerDefPtr*) ctrl2; + + if (c1->type < c2->type) + return -1; + if (c1->type > c2->type) + return 1; + if (c1->idx < c2->idx) + return -1; + if (c1->idx > c2->idx) + return 1; + if (c1->model < c1->model) + return -1; + if (c1->model > c2->model) + return 1; + return 0; +} + /* This compares two configurations and looks for any differences * which will affect the guest ABI. This is primarily to allow @@ -10191,6 +10214,9 @@ bool virDomainDefCheckABIStability(virDomainDefPtr src, bool identical = false; int i; + virDomainControllerDefPtr *scontrollers = NULL; + virDomainControllerDefPtr *dcontrollers = NULL; + if (src->virtType != dst->virtType) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain virt type %s does not match source %s"), @@ -10312,10 +10338,33 @@ bool virDomainDefCheckABIStability(virDomainDefPtr src, goto cleanup; } + /* sort the controllers before comparison */ + if (VIR_ALLOC_N(scontrollers, src->ncontrollers) < 0) { + virReportOOMError(); + goto cleanup; + } + + memcpy(scontrollers, src->controllers, src->ncontrollers*sizeof(src->controllers[0])); + qsort(scontrollers, src->ncontrollers, sizeof(virDomainControllerDefPtr), + virDomainControllerCmp); + + + if (VIR_ALLOC_N(dcontrollers, dst->ncontrollers) < 0) { + virReportOOMError(); + goto cleanup; + } + + memcpy(dcontrollers, dst->controllers, dst->ncontrollers*sizeof(dst->controllers[0])); + qsort(dcontrollers, dst->ncontrollers, sizeof(virDomainControllerDefPtr), + virDomainControllerCmp); + for (i = 0 ; i < src->ncontrollers ; i++) - if (!virDomainControllerDefCheckABIStability(src->controllers[i], dst->controllers[i])) + if (!virDomainControllerDefCheckABIStability(scontrollers[i], dcontrollers[i])) goto cleanup; + VIR_FREE(scontrollers); + VIR_FREE(dcontrollers); + if (src->nfss != dst->nfss) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain filesystem count %d does not match source %d"), -- 1.7.8.6

1 1

[libvirt] [PATCH] json: fix interface locale dependency
by Martin Kletzander 06 Aug '12

06 Aug '12

libvirt creates invalid commands if wrong locale is selected. For example with locale that uses comma as a decimal point, JSON commands created with decimal numbers are invalid because comma separates the entries in JSON. But even when decimal point is affected, grouping is not, because for grouping to be enabled with *printf, there has to be a apostrophe flag specified (and supported). --- Fortunately, there should be no other place where output-formatting is affected by this problem. I tried to change this in various ways with this posted one being the cleanest from my point of view, because: - setting locale is per-proccess, not per-thread (not thread-safe) - there is no number parsing that mangles the output number because of floating point precision src/util/json.c | 23 +++++++++++++++++++++-- 1 files changed, 21 insertions(+), 2 deletions(-) diff --git a/src/util/json.c b/src/util/json.c index 5132989..753a548 100644 --- a/src/util/json.c +++ b/src/util/json.c @@ -23,6 +23,8 @@ #include <config.h> +#include <locale.h> + #include "json.h" #include "memory.h" #include "virterror_internal.h" @@ -44,7 +46,6 @@ /* XXX fixme */ #define VIR_FROM_THIS VIR_FROM_NONE - typedef struct _virJSONParserState virJSONParserState; typedef virJSONParserState *virJSONParserStatePtr; struct _virJSONParserState { @@ -200,9 +201,27 @@ virJSONValuePtr virJSONValueNewNumberUlong(unsigned long long data) virJSONValuePtr virJSONValueNewNumberDouble(double data) { virJSONValuePtr val = NULL; - char *str; + char *str, *radix, *tmp; + if (virAsprintf(&str, "%lf", data) < 0) return NULL; + + /* because printing double is locale-dependent, we could end up + * with invalid JSON code, so we have to do something like this */ + radix = localeconv()->decimal_point; + tmp = strstr(str, radix); + if (tmp) { + *tmp = '.'; + if (strlen(radix) > 1) { + /* if the current locale specifies more characters as + * decimal point then cover the others with decimal + * numbers */ + memcpy(tmp + 1, + tmp + strlen(radix), + strlen(str) - (tmp - str)); + } + } + val = virJSONValueNewNumber(str); VIR_FREE(str); return val; -- 1.7.8.6

4 7

[libvirt] [PATCH] build: drop conditional use of mdns code
by Eric Blake 06 Aug '12

06 Aug '12

Commit 1f6f723 missed a step. At first I was worried that scrubbing the conditionals would lead to a runtime failure when compiled without avahi, but my testing makes it appear that the runtime error will only occur if the .conf files in /etc request mdns advertisement; and the old behavior was to silently ignore the request, so this is actually a better behavior of explicitly failing only when the config requests the impossible. * src/rpc/virnetserver.c: Drop HAVE_AVAHI conditionals; all callers already passed NULL if mdns_adv was not configured. --- In response to: https://www.redhat.com/archives/libvir-list/2012-August/msg00130.html I originally thought it would be harder than this, but my testing seems to show that this works. Caveat: my testing without avahi was done in a VM and not on bare metal, and since nested virt is slower, I may have inadvertently cut an important corner and missed a flaw in my above reasoning about why this is safe. So a close review, including checking all call sites, would be appreciated. src/rpc/virnetserver.c | 18 ++---------------- 1 file changed, 2 insertions(+), 16 deletions(-) diff --git a/src/rpc/virnetserver.c b/src/rpc/virnetserver.c index 248ad9f..295e8fd 100644 --- a/src/rpc/virnetserver.c +++ b/src/rpc/virnetserver.c @@ -36,9 +36,7 @@ #include "util.h" #include "virfile.h" #include "event.h" -#if HAVE_AVAHI -# include "virnetservermdns.h" -#endif +#include "virnetservermdns.h" #ifndef SA_SIGINFO # define SA_SIGINFO 0 @@ -81,10 +79,8 @@ struct _virNetServer { int sigwatch; char *mdnsGroupName; -#if HAVE_AVAHI virNetServerMDNSPtr mdns; virNetServerMDNSGroupPtr mdnsGroup; -#endif size_t nservices; virNetServerServicePtr *services; @@ -364,7 +360,6 @@ virNetServerPtr virNetServerNew(size_t min_workers, virReportOOMError(); goto error; } -#if HAVE_AVAHI if (srv->mdnsGroupName) { if (!(srv->mdns = virNetServerMDNSNew())) goto error; @@ -372,7 +367,6 @@ virNetServerPtr virNetServerNew(size_t min_workers, srv->mdnsGroupName))) goto error; } -#endif if (virMutexInit(&srv->lock) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -592,14 +586,13 @@ error: int virNetServerAddService(virNetServerPtr srv, virNetServerServicePtr svc, - const char *mdnsEntryName ATTRIBUTE_UNUSED) + const char *mdnsEntryName) { virNetServerLock(srv); if (VIR_EXPAND_N(srv->services, srv->nservices, 1) < 0) goto no_memory; -#if HAVE_AVAHI if (mdnsEntryName) { int port = virNetServerServiceGetPort(svc); @@ -608,7 +601,6 @@ int virNetServerAddService(virNetServerPtr srv, port)) goto error; } -#endif srv->services[srv->nservices-1] = svc; virNetServerServiceRef(svc); @@ -622,9 +614,7 @@ int virNetServerAddService(virNetServerPtr srv, no_memory: virReportOOMError(); -#if HAVE_AVAHI error: -#endif virNetServerUnlock(srv); return -1; } @@ -694,11 +684,9 @@ void virNetServerRun(virNetServerPtr srv) virNetServerLock(srv); -#if HAVE_AVAHI if (srv->mdns && virNetServerMDNSStart(srv->mdns) < 0) goto cleanup; -#endif srv->quit = 0; @@ -826,9 +814,7 @@ void virNetServerFree(virNetServerPtr srv) VIR_FREE(srv->clients); VIR_FREE(srv->mdnsGroupName); -#if HAVE_AVAHI virNetServerMDNSFree(srv->mdns); -#endif virMutexDestroy(&srv->lock); VIR_FREE(srv); -- 1.7.11.2

2 2

[libvirt] [PATCH 00/13 v2] Introduce a virObject module fo reference counting
by Daniel P. Berrange 06 Aug '12

06 Aug '12

A followup to https://www.redhat.com/archives/libvir-list/2012-July/msg00476.html Notable changes - Change virAtomicIntInc to return new value, instead of void for compat with existing API - Use verify_true instead of verify in macros - Most other fixes from previous series

4 29

[libvirt] Debian packaging for the Java bindings
by Wido den Hollander 06 Aug '12

06 Aug '12

Currently the Java bindings for libvirt do not provide a Debian package. Users with Debian based systems like Ubuntu are now forced to compile from source since no binary distribution of the JAR file is available. This patch adds building Debian packages with ant $ ant deb This will build a .deb file in the target directory. It requires dpkg-dev to be installed. Wido

2 5

[libvirt] [test-API][PATCH] Fix xml parser problem when node have both attribute and value
by Wayne Sun 06 Aug '12

06 Aug '12

When xml node have both attribute and value at first level, the parser will broke. After fix, the node key will have a dictionary with both value and attr inside. For example, the xml node: <capacity unit='bytes'>536870912000</capacity> will be parsed into: {u'capacity': {'attr': {u'unit': u'bytes'}, 'value': u'536870912000'}} Also when fetch the attribute key, should use a new param (attrkey) other than exist key in outside loop. Signed-off-by: Wayne Sun <gsun(a)redhat.com> --- utils/xml_parser.py | 22 +++++++++++++++++----- 1 files changed, 17 insertions(+), 5 deletions(-) diff --git a/utils/xml_parser.py b/utils/xml_parser.py index 04e7501..01b928f 100644 --- a/utils/xml_parser.py +++ b/utils/xml_parser.py @@ -88,15 +88,21 @@ class xml_parser(object): if thenode.attributes != None: tmpattr = dict() if thenode.attributes.length > 0: - for key in thenode.attributes.keys(): + for attrkey in thenode.attributes.keys(): tmpattr.update( - {key:thenode.attributes.get(key).nodeValue}) + {attrkey:thenode.attributes.get(attrkey).nodeValue}) attrdic = { "attr":tmpattr } if key in out: if out[key] == None: - out[key] = value if attrdic != None: - out[key].update(attrdic) + if value == None: + out[key] = attrdic + else: + valdic = { "value":value } + valdic.update(attrdic) + out[key] = valdic + else: + out[key] = value elif type(out[key]) == list: if attrdic != None: newdict.update(attrdic) @@ -111,7 +117,13 @@ class xml_parser(object): else: out[key] = value if attrdic != None: - out[key].update(attrdic) + if value == None: + newdict[key] = attrdic + else: + valdic = { "value":value } + valdic.update(attrdic) + newdict = valdic + out[key] = newdict self.parseintodict(thenode, level+1, out, key) return out -- 1.7.1

2 1

[libvirt] [libvirt-php] [PATCH] libvirt_domain_update_device() not defined
by Katelyn Schiesser 04 Aug '12

04 Aug '12

This patch makes libvirt_domain_update_device() available within PHP. Previously it simply threw an error for undefinded function. Katelyn Schiesser (1): Make libvirt_domain_update_device() available. src/libvirt-php.c | 1 + 1 file changed, 1 insertion(+) -- 1.7.11.3

1 1

[libvirt] [PATCH] [RFC] xen-xm: Generate UUID if not specified
by Jim Fehlig 03 Aug '12

03 Aug '12

I received a bug report about 'virsh domxml-from-native xen-xm' failing when the xm configuration does not contain a UUID. IMO, this is a bit harsh since UUID is not even required when defining a domain. I first took the approach of skipping the parsing of UUID when it is not specified in the xm config, but that results in a UUID of all zeros, which is the dom0 UUID from the xen tools perspective. I'd like to hear what other folks think about the attached patch, which generates a UUID if it is not specified in the xm config. Regards, Jim

2 2

[libvirt] [PATCH] client: Free message when freeing client
by Peter Krempa 03 Aug '12

03 Aug '12

The last message of the client was not freed leaking 4 bytes of memory in the client when the remote daemon crashed while processing a message. --- src/rpc/virnetclient.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/src/rpc/virnetclient.c b/src/rpc/virnetclient.c index b210a72..cb373b6 100644 --- a/src/rpc/virnetclient.c +++ b/src/rpc/virnetclient.c @@ -499,6 +499,9 @@ void virNetClientFree(virNetClientPtr client) #if HAVE_SASL virNetSASLSessionFree(client->sasl); #endif + + virNetMessageClear(&client->msg); + virNetClientUnlock(client); virMutexDestroy(&client->lock); -- 1.7.8.6

2 2

[libvirt] [PATCH] conf: Remove console stream callback only when freeing console helper
by Peter Krempa 03 Aug '12

03 Aug '12

Commit ba226d334acbc49f6751b430e0c4e00f69eef6bf tried to fix crash of the daemon when a domain with a open console was destroyed. The fix was wrong as it tried to remove the callback also when the stream was aborted, where at that point the fd stream driver was already freed and removed. This patch clears the callbacks with a helper right before the hash is freed, so that it doesn't interfere with other codepaths where the stream object is freed. --- src/conf/virconsole.c | 16 +++++++++++++--- 1 files changed, 13 insertions(+), 3 deletions(-) diff --git a/src/conf/virconsole.c b/src/conf/virconsole.c index 912aff6..b3f6eb6 100644 --- a/src/conf/virconsole.c +++ b/src/conf/virconsole.c @@ -219,9 +219,6 @@ static void virConsoleHashEntryFree(void *data, const char *pty = name; virStreamPtr st = data; - /* remove callback from stream */ - virFDStreamSetInternalCloseCb(st, NULL, NULL, NULL); - /* free stream reference */ virStreamFree(st); @@ -290,6 +287,18 @@ error: } /** + * Helper to clear stream callbacks when freeing the hash + */ +static void virConsoleFreeClearCallbacks(void *payload, + const void *name ATTRIBUTE_UNUSED, + void *data ATTRIBUTE_UNUSED) +{ + virStreamPtr st = payload; + + virFDStreamSetInternalCloseCb(st, NULL, NULL, NULL); +} + +/** * Free structures for handling open console streams. * * @cons Pointer to the private structure. @@ -300,6 +309,7 @@ void virConsoleFree(virConsolesPtr cons) return; virMutexLock(&cons->lock); + virHashForEach(cons->hash, virConsoleFreeClearCallbacks, NULL); virHashFree(cons->hash); virMutexUnlock(&cons->lock); virMutexDestroy(&cons->lock); -- 1.7.8.6

3 4

[libvirt] [PATCH v1] ESX: Add "Byte" datatype
by Ata E Husain Bohra 03 Aug '12

03 Aug '12

Append "Byte" to set of predefined datatype objects. Signed-off-by: Ata E Husain Bohra <ata.husain(a)hotmail.com> --- src/esx/esx_vi_generator.py | 1 + src/esx/esx_vi_types.c | 57 +++++++++++++++++++++++++++++++++++++++++++ src/esx/esx_vi_types.h | 29 ++++++++++++++++++++++ 3 files changed, 87 insertions(+) diff --git a/src/esx/esx_vi_generator.py b/src/esx/esx_vi_generator.py index 910478c..af2d57e 100755 --- a/src/esx/esx_vi_generator.py +++ b/src/esx/esx_vi_generator.py @@ -1496,6 +1496,7 @@ def open_and_print(filename): predefined_enums = ["Boolean"] predefined_objects = ["AnyType", + "Byte", "Int", "Long", "String", diff --git a/src/esx/esx_vi_types.c b/src/esx/esx_vi_types.c index 708aeda..d7bd3b7 100644 --- a/src/esx/esx_vi_types.c +++ b/src/esx/esx_vi_types.c @@ -774,6 +774,9 @@ esxVI_Type_ToString(esxVI_Type type) case esxVI_Type_String: return "xsd:string"; + case esxVI_Type_Byte: + return "xsd:byte"; + case esxVI_Type_Short: return "xsd:short"; @@ -816,6 +819,8 @@ esxVI_Type_FromString(const char *type) return esxVI_Type_AnyType; } else if (STREQ(type, "xsd:string")) { return esxVI_Type_String; + } else if (STREQ(type, "xsd:byte")) { + return esxVI_Type_Byte; } else if (STREQ(type, "xsd:short")) { return esxVI_Type_Short; } else if (STREQ(type, "xsd:int")) { @@ -942,6 +947,10 @@ esxVI_AnyType_DeepCopy(esxVI_AnyType **dest, esxVI_AnyType *src) (*dest)->string = (*dest)->value; break; + case esxVI_Type_Byte: + (*dest)->int8 = src->int8; + break; + case esxVI_Type_Short: (*dest)->int16 = src->int16; break; @@ -1059,6 +1068,10 @@ esxVI_AnyType_Deserialize(xmlNodePtr node, esxVI_AnyType **anyType) (*anyType)->string = (*anyType)->value; break; + case esxVI_Type_Byte: + _DESERIALIZE_NUMBER(Byte, "xsd:byte", int8, INT8_MIN, INT8_MAX); + break; + case esxVI_Type_Short: _DESERIALIZE_NUMBER(Short, "xsd:short", int16, INT16_MIN, INT16_MAX); break; @@ -1299,6 +1312,50 @@ esxVI_String_DeserializeValue(xmlNodePtr node, char **value) /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * + * XSD: Byte + */ + +/* esxVI_Byte_Alloc */ +ESX_VI__TEMPLATE__ALLOC(Byte) + +/* esxVI_Byte_Free */ +ESX_VI__TEMPLATE__FREE(Byte, +{ + esxVI_Byte_Free(&item->_next); +}) + +/* esxVI_Byte_Validate */ +ESX_VI__TEMPLATE__VALIDATE(Byte, +{ +}) + +/* esxVI_Byte_AppendToList */ +ESX_VI__TEMPLATE__LIST__APPEND(Byte) + +/* esxVI_Byte_DeepCopy */ +ESX_VI__TEMPLATE__DEEP_COPY(Byte, +{ + (*dest)->value = src->value; +}) + +/* esxVI_Byte_DeepCopyList */ +ESX_VI__TEMPLATE__LIST__DEEP_COPY(Byte) + +/* esxVI_Byte_Serialize */ +ESX_VI__TEMPLATE__SERIALIZE(Byte, +{ + virBufferAsprintf(output, "%d", (int8_t)item->value); +}) + +/* esxVI_Byte_SerializeList */ +ESX_VI__TEMPLATE__LIST__SERIALIZE(Byte) + +/* esxVI_Byte_Deserialize */ +ESX_VI__TEMPLATE__DESERIALIZE_NUMBER(Byte, "xsd:byte", INT8_MIN, INT8_MAX); + + + +/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * XSD: Int */ diff --git a/src/esx/esx_vi_types.h b/src/esx/esx_vi_types.h index dbcfee0..4df0157 100644 --- a/src/esx/esx_vi_types.h +++ b/src/esx/esx_vi_types.h @@ -38,6 +38,7 @@ typedef struct _esxVI_ManagedObject esxVI_ManagedObject; typedef enum _esxVI_Boolean esxVI_Boolean; typedef struct _esxVI_AnyType esxVI_AnyType; typedef struct _esxVI_String esxVI_String; +typedef struct _esxVI_Byte esxVI_Byte; typedef struct _esxVI_Int esxVI_Int; typedef struct _esxVI_Long esxVI_Long; typedef struct _esxVI_DateTime esxVI_DateTime; @@ -73,6 +74,7 @@ enum _esxVI_Type { esxVI_Type_Boolean, esxVI_Type_AnyType, esxVI_Type_String, + esxVI_Type_Byte, esxVI_Type_Short, esxVI_Type_Int, esxVI_Type_Long, @@ -146,6 +148,7 @@ struct _esxVI_AnyType { union { esxVI_Boolean boolean; /* optional */ char *string; /* optional */ + int8_t int8; /* optional */ int16_t int16; /* optional */ int32_t int32; /* optional */ int64_t int64; /* optional */ @@ -199,6 +202,32 @@ int esxVI_String_DeserializeValue(xmlNodePtr node, char **value); /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * + * XSD: Byte + */ + +struct _esxVI_Byte { + esxVI_Byte *_next; /* optional */ + esxVI_Type _type; /* required */ + + int8_t value; /* required */ +}; + +int esxVI_Byte_Alloc(esxVI_Byte **number); +void esxVI_Byte_Free(esxVI_Byte **numberList); +int esxVI_Byte_Validate(esxVI_Byte *number); +int esxVI_Byte_AppendToList(esxVI_Byte **numberList, esxVI_Byte *number); +int esxVI_Byte_DeepCopy(esxVI_Byte **dest, esxVI_Byte *src); +int esxVI_Byte_DeepCopyList(esxVI_Byte **destList, esxVI_Byte *srcList); +int esxVI_Byte_Serialize(esxVI_Byte *number, const char *element, + virBufferPtr output); +int esxVI_Byte_SerializeList(esxVI_Byte *numberList, const char *element, + virBufferPtr output); +int esxVI_Byte_Deserialize(xmlNodePtr node, esxVI_Byte **number); + + + + +/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * XSD: Int */ -- 1.7.9.5

2 1

[libvirt] [PATCH v10 0/9] Add basic driver for Parallels Cloud Server
by Dmitry Guryanov 03 Aug '12

03 Aug '12

Parallels Cloud Server is a virtualization solution that allows users to simultaneously run multiple virtual machines and containers on the same physical server. More information can be found here: http://www.parallels.com/products/pcs/ Also beta version of Parallels Cloud Server can be downloaded there. Changes in v10: * Change the FSF address * Replace format strings without % with ' "%s", string ' Dmitry Guryanov (9): parallels: add driver skeleton add function virCommandNewVAList parallels: add functions to list domains and get info parallels: implement functions for domain life cycle management parallels: get info about serial ports parallels: add support of VNC remote display parallels: implement virDomainDefineXML operation for existing domains parallels: add storage driver parallels: implement VM creation configure.ac | 61 +- docs/drvparallels.html.in | 28 + include/libvirt/virterror.h | 1 + libvirt.spec.in | 9 +- mingw-libvirt.spec.in | 6 + po/POTFILES.in | 3 + src/Makefile.am | 15 + src/conf/domain_conf.c | 3 +- src/conf/domain_conf.h | 1 + src/driver.h | 1 + src/libvirt.c | 9 + src/parallels/parallels_driver.c | 1735 +++++++++++++++++++++++++++++++++++++ src/parallels/parallels_driver.h | 28 + src/parallels/parallels_storage.c | 1390 +++++++++++++++++++++++++++++ src/parallels/parallels_utils.c | 149 ++++ src/parallels/parallels_utils.h | 66 ++ src/util/command.c | 22 + src/util/command.h | 3 + src/util/virterror.c | 3 +- 19 files changed, 3511 insertions(+), 22 deletions(-) create mode 100644 docs/drvparallels.html.in create mode 100644 src/parallels/parallels_driver.c create mode 100644 src/parallels/parallels_driver.h create mode 100644 src/parallels/parallels_storage.c create mode 100644 src/parallels/parallels_utils.c create mode 100644 src/parallels/parallels_utils.h

4 16

[libvirt] [PATCH v2] qemu: Set reasonable RSS limit on domain startup
by Michal Privoznik 03 Aug '12

03 Aug '12

If there's a memory leak in qemu or qemu is exploited the host's system will sooner or later start trashing instead of killing the bad process. This however has impact on performance and other guests as well. Therefore we should set a reasonable RSS limit even when user hasn't set any. It's better to be secure by default. --- diff to v1: -the expression for reasonable limit adapted to VRAM + XBZRLE (libvirt doesn't override migrate_cache_size yet, so the default 64MB should fit, and it did indeed during my testing) src/qemu/qemu_cgroup.c | 76 +++++++++++++++++++++++++++-------------------- 1 files changed, 44 insertions(+), 32 deletions(-) diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c index dee9de6..b11d28b 100644 --- a/src/qemu/qemu_cgroup.c +++ b/src/qemu/qemu_cgroup.c @@ -339,42 +339,54 @@ int qemuSetupCgroup(struct qemud_driver *driver, } } - if (vm->def->mem.hard_limit != 0 || - vm->def->mem.soft_limit != 0 || - vm->def->mem.swap_hard_limit != 0) { - if (qemuCgroupControllerActive(driver, VIR_CGROUP_CONTROLLER_MEMORY)) { - if (vm->def->mem.hard_limit != 0) { - rc = virCgroupSetMemoryHardLimit(cgroup, vm->def->mem.hard_limit); - if (rc != 0) { - virReportSystemError(-rc, - _("Unable to set memory hard limit for domain %s"), - vm->def->name); - goto cleanup; - } - } - if (vm->def->mem.soft_limit != 0) { - rc = virCgroupSetMemorySoftLimit(cgroup, vm->def->mem.soft_limit); - if (rc != 0) { - virReportSystemError(-rc, - _("Unable to set memory soft limit for domain %s"), - vm->def->name); - goto cleanup; - } + if (qemuCgroupControllerActive(driver, VIR_CGROUP_CONTROLLER_MEMORY)) { + unsigned long long hard_limit = vm->def->mem.hard_limit; + + if (!hard_limit) { + /* If there is no hard_limit set, set a reasonable + * one to avoid system trashing caused by exploited qemu. + * As 'reasonable limit' has been chosen: + * (1 + k) * (domain memory + total video memory) + F + * where k = 0.02 and F = 200MB. */ + hard_limit = vm->def->mem.max_balloon; + for (i = 0; i < vm->def->nvideos; i++) + hard_limit += vm->def->videos[i]->vram; + hard_limit = hard_limit * 1.02 + 204800; + } + + rc = virCgroupSetMemoryHardLimit(cgroup, hard_limit); + if (rc != 0) { + virReportSystemError(-rc, + _("Unable to set memory hard limit for domain %s"), + vm->def->name); + goto cleanup; + } + if (vm->def->mem.soft_limit != 0) { + rc = virCgroupSetMemorySoftLimit(cgroup, vm->def->mem.soft_limit); + if (rc != 0) { + virReportSystemError(-rc, + _("Unable to set memory soft limit for domain %s"), + vm->def->name); + goto cleanup; } + } - if (vm->def->mem.swap_hard_limit != 0) { - rc = virCgroupSetMemSwapHardLimit(cgroup, vm->def->mem.swap_hard_limit); - if (rc != 0) { - virReportSystemError(-rc, - _("Unable to set swap hard limit for domain %s"), - vm->def->name); - goto cleanup; - } + if (vm->def->mem.swap_hard_limit != 0) { + rc = virCgroupSetMemSwapHardLimit(cgroup, vm->def->mem.swap_hard_limit); + if (rc != 0) { + virReportSystemError(-rc, + _("Unable to set swap hard limit for domain %s"), + vm->def->name); + goto cleanup; } - } else { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("Memory cgroup is not available on this host")); } + } else if (vm->def->mem.hard_limit != 0 || + vm->def->mem.soft_limit != 0 || + vm->def->mem.swap_hard_limit != 0) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Memory cgroup is not available on this host")); + } else { + VIR_WARN("Could not autoset a RSS limit for domain %s", vm->def->name); } if (vm->def->cputune.shares != 0) { -- 1.7.8.6

2 1