- Devel - libvirt List Archives

[libvirt] [PATCH] Catch dnsmasq start failures
by Guido Günther 25 Jul '11

25 Jul '11

While we checked the return value we didn't maks sure ret != 0 which resulted in dnsmasq errors being ignored. --- src/network/bridge_driver.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index 554a8ac..4882753 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -731,8 +731,10 @@ networkStartDhcpDaemon(virNetworkObjPtr network) if (ret < 0) goto cleanup; - if (virCommandRun(cmd, NULL) < 0) + ret = virCommandRun(cmd, NULL); + if (ret < 0) { goto cleanup; + } /* * There really is no race here - when dnsmasq daemonizes, its -- 1.7.5.4

2 2

[libvirt] [PATCH 1/2] SASL: Introduce session mutex
by Michal Privoznik 25 Jul '11

25 Jul '11

Some of SASL interacting functions can be called within two or more threads with the same pointer. Therefore we need to protect virNetSASLSessionPtr with mutex to avoid non-consistent states. --- src/rpc/virnetsaslcontext.c | 67 +++++++++++++++++++++++++++++++++++++++++- 1 files changed, 65 insertions(+), 2 deletions(-) diff --git a/src/rpc/virnetsaslcontext.c b/src/rpc/virnetsaslcontext.c index 6b2a883..ef91b9d 100644 --- a/src/rpc/virnetsaslcontext.c +++ b/src/rpc/virnetsaslcontext.c @@ -28,6 +28,7 @@ #include "virterror_internal.h" #include "memory.h" #include "logging.h" +#include "threads.h" #define VIR_FROM_THIS VIR_FROM_RPC #define virNetError(code, ...) \ @@ -41,6 +42,7 @@ struct _virNetSASLContext { }; struct _virNetSASLSession { + virMutex lock; sasl_conn_t *conn; int refs; size_t maxbufsize; @@ -145,6 +147,16 @@ void virNetSASLContextFree(virNetSASLContextPtr ctxt) VIR_FREE(ctxt); } +static void virNetSASLSessionLock(virNetSASLSessionPtr session) +{ + virMutexLock(&session->lock); +} + +static void virNetSASLSessionUnlock(virNetSASLSessionPtr session) +{ + virMutexUnlock(&session->lock); +} + virNetSASLSessionPtr virNetSASLSessionNewClient(virNetSASLContextPtr ctxt ATTRIBUTE_UNUSED, const char *service, const char *hostname, @@ -160,6 +172,9 @@ virNetSASLSessionPtr virNetSASLSessionNewClient(virNetSASLContextPtr ctxt ATTRIB goto cleanup; } + if (virMutexInit(&sasl->lock) < 0) + goto cleanup; + sasl->refs = 1; /* Arbitrary size for amount of data we can encode in a single block */ sasl->maxbufsize = 1 << 16; @@ -198,6 +213,9 @@ virNetSASLSessionPtr virNetSASLSessionNewServer(virNetSASLContextPtr ctxt ATTRIB goto cleanup; } + if (virMutexInit(&sasl->lock) < 0) + goto cleanup; + sasl->refs = 1; /* Arbitrary size for amount of data we can encode in a single block */ sasl->maxbufsize = 1 << 16; @@ -226,7 +244,9 @@ cleanup: void virNetSASLSessionRef(virNetSASLSessionPtr sasl) { + virNetSASLSessionLock(sasl); sasl->refs++; + virNetSASLSessionUnlock(sasl); } int virNetSASLSessionExtKeySize(virNetSASLSessionPtr sasl, @@ -234,13 +254,16 @@ int virNetSASLSessionExtKeySize(virNetSASLSessionPtr sasl, { int err; + virNetSASLSessionLock(sasl); err = sasl_setprop(sasl->conn, SASL_SSF_EXTERNAL, &ssf); if (err != SASL_OK) { virNetError(VIR_ERR_INTERNAL_ERROR, _("cannot set external SSF %d (%s)"), err, sasl_errstring(err, NULL, NULL)); + virNetSASLSessionUnlock(sasl); return -1; } + virNetSASLSessionUnlock(sasl); return 0; } @@ -249,13 +272,16 @@ const char *virNetSASLSessionGetIdentity(virNetSASLSessionPtr sasl) const void *val; int err; + virNetSASLSessionLock(sasl); err = sasl_getprop(sasl->conn, SASL_USERNAME, &val); if (err != SASL_OK) { virNetError(VIR_ERR_AUTH_FAILED, _("cannot query SASL username on connection %d (%s)"), err, sasl_errstring(err, NULL, NULL)); + virNetSASLSessionUnlock(sasl); return NULL; } + virNetSASLSessionUnlock(sasl); if (val == NULL) { virNetError(VIR_ERR_AUTH_FAILED, _("no client username was found")); @@ -272,13 +298,17 @@ int virNetSASLSessionGetKeySize(virNetSASLSessionPtr sasl) int err; int ssf; const void *val; + + virNetSASLSessionLock(sasl); err = sasl_getprop(sasl->conn, SASL_SSF, &val); if (err != SASL_OK) { virNetError(VIR_ERR_AUTH_FAILED, _("cannot query SASL ssf on connection %d (%s)"), err, sasl_errstring(err, NULL, NULL)); + virNetSASLSessionUnlock(sasl); return -1; } + virNetSASLSessionUnlock(sasl); ssf = *(const int *)val; return ssf; } @@ -291,6 +321,7 @@ int virNetSASLSessionSecProps(virNetSASLSessionPtr sasl, sasl_security_properties_t secprops; int err; + virNetSASLSessionLock(sasl); VIR_DEBUG("minSSF=%d maxSSF=%d allowAnonymous=%d maxbufsize=%zu", minSSF, maxSSF, allowAnonymous, sasl->maxbufsize); @@ -307,8 +338,10 @@ int virNetSASLSessionSecProps(virNetSASLSessionPtr sasl, virNetError(VIR_ERR_INTERNAL_ERROR, _("cannot set security props %d (%s)"), err, sasl_errstring(err, NULL, NULL)); + virNetSASLSessionUnlock(sasl); return -1; } + virNetSASLSessionUnlock(sasl); return 0; } @@ -319,17 +352,20 @@ static int virNetSASLSessionUpdateBufSize(virNetSASLSessionPtr sasl) unsigned *maxbufsize; int err; + virNetSASLSessionLock(sasl); err = sasl_getprop(sasl->conn, SASL_MAXOUTBUF, (const void **)&maxbufsize); if (err != SASL_OK) { virNetError(VIR_ERR_INTERNAL_ERROR, _("cannot get security props %d (%s)"), err, sasl_errstring(err, NULL, NULL)); + virNetSASLSessionUnlock(sasl); return -1; } VIR_DEBUG("Negotiated bufsize is %u vs requested size %zu", *maxbufsize, sasl->maxbufsize); sasl->maxbufsize = *maxbufsize; + virNetSASLSessionUnlock(sasl); return 0; } @@ -339,6 +375,7 @@ char *virNetSASLSessionListMechanisms(virNetSASLSessionPtr sasl) char *ret; int err; + virNetSASLSessionLock(sasl); err = sasl_listmech(sasl->conn, NULL, /* Don't need to set user */ "", /* Prefix */ @@ -351,8 +388,10 @@ char *virNetSASLSessionListMechanisms(virNetSASLSessionPtr sasl) virNetError(VIR_ERR_INTERNAL_ERROR, _("cannot list SASL mechanisms %d (%s)"), err, sasl_errdetail(sasl->conn)); + virNetSASLSessionUnlock(sasl); return NULL; } + virNetSASLSessionUnlock(sasl); if (!(ret = strdup(mechlist))) { virReportOOMError(); return NULL; @@ -373,6 +412,7 @@ int virNetSASLSessionClientStart(virNetSASLSessionPtr sasl, VIR_DEBUG("sasl=%p mechlist=%s prompt_need=%p clientout=%p clientoutlen=%p mech=%p", sasl, mechlist, prompt_need, clientout, clientoutlen, mech); + virNetSASLSessionLock(sasl); int err = sasl_client_start(sasl->conn, mechlist, prompt_need, @@ -380,6 +420,7 @@ int virNetSASLSessionClientStart(virNetSASLSessionPtr sasl, &outlen, mech); + virNetSASLSessionUnlock(sasl); *clientoutlen = outlen; switch (err) { @@ -414,12 +455,14 @@ int virNetSASLSessionClientStep(virNetSASLSessionPtr sasl, VIR_DEBUG("sasl=%p serverin=%s serverinlen=%zu prompt_need=%p clientout=%p clientoutlen=%p", sasl, serverin, serverinlen, prompt_need, clientout, clientoutlen); + virNetSASLSessionLock(sasl); int err = sasl_client_step(sasl->conn, serverin, inlen, prompt_need, clientout, &outlen); + virNetSASLSessionUnlock(sasl); *clientoutlen = outlen; switch (err) { @@ -449,6 +492,8 @@ int virNetSASLSessionServerStart(virNetSASLSessionPtr sasl, { unsigned inlen = clientinlen; unsigned outlen = 0; + + virNetSASLSessionLock(sasl); int err = sasl_server_start(sasl->conn, mechname, clientin, @@ -456,6 +501,7 @@ int virNetSASLSessionServerStart(virNetSASLSessionPtr sasl, serverout, &outlen); + virNetSASLSessionUnlock(sasl); *serveroutlen = outlen; switch (err) { @@ -486,12 +532,14 @@ int virNetSASLSessionServerStep(virNetSASLSessionPtr sasl, unsigned inlen = clientinlen; unsigned outlen = 0; + virNetSASLSessionLock(sasl); int err = sasl_server_step(sasl->conn, clientin, inlen, serverout, &outlen); + virNetSASLSessionUnlock(sasl); *serveroutlen = outlen; switch (err) { @@ -514,7 +562,11 @@ int virNetSASLSessionServerStep(virNetSASLSessionPtr sasl, size_t virNetSASLSessionGetMaxBufSize(virNetSASLSessionPtr sasl) { - return sasl->maxbufsize; + size_t ret; + virNetSASLSessionLock(sasl); + ret = sasl->maxbufsize; + virNetSASLSessionUnlock(sasl); + return ret; } ssize_t virNetSASLSessionEncode(virNetSASLSessionPtr sasl, @@ -534,6 +586,7 @@ ssize_t virNetSASLSessionEncode(virNetSASLSessionPtr sasl, return -1; } + virNetSASLSessionLock(sasl); err = sasl_encode(sasl->conn, input, inlen, @@ -545,8 +598,10 @@ ssize_t virNetSASLSessionEncode(virNetSASLSessionPtr sasl, virNetError(VIR_ERR_INTERNAL_ERROR, _("failed to encode SASL data: %d (%s)"), err, sasl_errstring(err, NULL, NULL)); + virNetSASLSessionUnlock(sasl); return -1; } + virNetSASLSessionUnlock(sasl); return 0; } @@ -567,6 +622,7 @@ ssize_t virNetSASLSessionDecode(virNetSASLSessionPtr sasl, return -1; } + virNetSASLSessionLock(sasl); err = sasl_decode(sasl->conn, input, inlen, @@ -577,8 +633,10 @@ ssize_t virNetSASLSessionDecode(virNetSASLSessionPtr sasl, virNetError(VIR_ERR_INTERNAL_ERROR, _("failed to decode SASL data: %d (%s)"), err, sasl_errstring(err, NULL, NULL)); + virNetSASLSessionUnlock(sasl); return -1; } + virNetSASLSessionUnlock(sasl); return 0; } @@ -587,12 +645,17 @@ void virNetSASLSessionFree(virNetSASLSessionPtr sasl) if (!sasl) return; + virNetSASLSessionLock(sasl); sasl->refs--; - if (sasl->refs > 0) + if (sasl->refs > 0) { + virNetSASLSessionUnlock(sasl); return; + } if (sasl->conn) sasl_dispose(&sasl->conn); + virNetSASLSessionUnlock(sasl); + virMutexDestroy(&sasl->lock); VIR_FREE(sasl); } -- 1.7.5.rc3

2 2

[libvirt] [PATCH] Add libtasn1-devel as a BuildRequires for libvirt.spec
by Daniel P. Berrange 25 Jul '11

25 Jul '11

* libvirt.spec.in: Add libtasn1-devel --- libvirt.spec.in | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 002239c..e2b7f65 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -332,6 +332,7 @@ BuildRequires: libxslt BuildRequires: readline-devel BuildRequires: ncurses-devel BuildRequires: gettext +BuildRequires: libtasn1-devel BuildRequires: gnutls-devel %if 0%{?fedora} >= 12 || 0%{?rhel} >= 6 # for augparse, optionally used in testing -- 1.7.1

2 1

[libvirt] [PATCH] tests: detect gnutls errors
by Eric Blake 25 Jul '11

25 Jul '11

* tests/virnettlscontexttest.c (testTLSLoadKey): Report errors. --- Something in gnutls 2.8.5 (RHEL 6) was more leniant than gnutls 2.8.6 (Fedora 14). This still doesn't solve the failure, but at least gets us to see that newer gnutls_x509_privkey_import doesn't like our define of PRIVATE_KEY. tests/virnettlscontexttest.c | 12 ++++++++++-- 1 files changed, 10 insertions(+), 2 deletions(-) diff --git a/tests/virnettlscontexttest.c b/tests/virnettlscontexttest.c index e70cd8b..043ccc2 100644 --- a/tests/virnettlscontexttest.c +++ b/tests/virnettlscontexttest.c @@ -410,10 +410,18 @@ static gnutls_x509_privkey_t testTLSLoadKey(void) { gnutls_x509_privkey_t key; const gnutls_datum_t data = { (unsigned char *)PRIVATE_KEY, strlen(PRIVATE_KEY) }; + int err; - gnutls_x509_privkey_init(&key); + if ((err = gnutls_x509_privkey_init(&key)) < 0) { + VIR_WARN("Failed to init key %s", gnutls_strerror(err)); + abort(); + } - gnutls_x509_privkey_import(key, &data, GNUTLS_X509_FMT_PEM); + if ((err = gnutls_x509_privkey_import(key, &data, + GNUTLS_X509_FMT_PEM)) < 0) { + VIR_WARN("Failed to init key %s", gnutls_strerror(err)); + abort(); + } return key; } -- 1.7.4.4

4 6

[libvirt] [PATCH] rename cfs_* to vcpu_*
by Wen Congyang 25 Jul '11

25 Jul '11

In the XML file we now have <cputune> <shares>1024</shares> <period>90000</period> <quota>0</quota> </cputune> But the schedinfo parameter are being named cpu_shares: 1024 cfs_period: 90000 cfs_quota: 0 The period/quota is per-vcpu value, so these new tunables should be named 'vcpu_period' and 'vcpu_quota'. --- src/qemu/qemu_driver.c | 16 ++++++++-------- 1 files changed, 8 insertions(+), 8 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 52e5d69..9cae318 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6243,10 +6243,10 @@ static int qemuSetSchedulerParametersFlags(virDomainPtr dom, if (flags & VIR_DOMAIN_AFFECT_CONFIG) { vmdef->cputune.shares = params[i].value.ul; } - } else if (STREQ(param->field, "cfs_period")) { + } else if (STREQ(param->field, "vcpu_period")) { if (param->type != VIR_TYPED_PARAM_ULLONG) { qemuReportError(VIR_ERR_INVALID_ARG, "%s", - _("invalid type for cfs_period tunable," + _("invalid type for vcpu_period tunable," " expected a 'ullong'")); goto cleanup; } @@ -6263,10 +6263,10 @@ static int qemuSetSchedulerParametersFlags(virDomainPtr dom, if (flags & VIR_DOMAIN_AFFECT_CONFIG) { vmdef->cputune.period = params[i].value.ul; } - } else if (STREQ(param->field, "cfs_quota")) { + } else if (STREQ(param->field, "vcpu_quota")) { if (param->type != VIR_TYPED_PARAM_LLONG) { qemuReportError(VIR_ERR_INVALID_ARG, "%s", - _("invalid type for cfs_quota tunable," + _("invalid type for vcpu_quota tunable," " expected a 'llong'")); goto cleanup; } @@ -6525,10 +6525,10 @@ out: if (*nparams > saved_nparams) { params[1].value.ul = period; params[1].type = VIR_TYPED_PARAM_ULLONG; - if (virStrcpyStatic(params[1].field, "cfs_period") == NULL) { + if (virStrcpyStatic(params[1].field, "vcpu_period") == NULL) { qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("Field cfs_period too long for destination")); + _("Field vcpu_period too long for destination")); goto cleanup; } saved_nparams++; @@ -6537,10 +6537,10 @@ out: if (*nparams > saved_nparams) { params[2].value.ul = quota; params[2].type = VIR_TYPED_PARAM_LLONG; - if (virStrcpyStatic(params[2].field, "cfs_quota") == NULL) { + if (virStrcpyStatic(params[2].field, "vcpu_quota") == NULL) { qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("Field cfs_quota too long for destination")); + _("Field vcpu_quota too long for destination")); goto cleanup; } saved_nparams++; -- 1.7.1

3 2

[libvirt] New upstream repo for libvirt-qmf
by Zane Bitter 25 Jul '11

25 Jul '11

As part of the renaming of libvirt-qpid to libvirt-qmf, the libvirt-qmf upstream is now hosted on the Matahari Project's GitHub account here: https://github.com/matahari/libvirt-qmf regards, Zane.

1 0

[libvirt] [PATCH v4 0/7] Add support for setting QoS
by Michal Privoznik 25 Jul '11

25 Jul '11

This patch series add support for setting traffic shaping and policing on both domain's interface and network's virtual bridge. Basically, this is done via 'tc' from iproute2 package. For shaping is HTB used, for policing we need u32 match selector. Both should be available in RHEL-6 kernel. How this works: On an virtual interface which has limits defined a root qdisc are replaced. Ingress root for outbound traffic shaping and egress for inbound. Basically, in inbound traffic policing is applied, on outbound shaping. New qdiscs are set to limit the traffic to rate set in XML. For shaping it is possible to set the size of buffer. Accepted values for rate, peak and burst are integer numbers. Units are kilobytes per second for rate or kilobytes for size. Supported devices are VIR_DOMAIN_NET_TYPE_NETWORK, VIR_DOMAIN_NET_TYPE_BRIDGE and VIR_DOMAIN_NET_TYPE_DIRECT. diff to v3: -Laine's review included diff to v2: -Jirka's review included diff to v1: -rebase to current HEAD -add support for macvtap devices Michal Privoznik (7): bandwidth: Define schema and create documentation bandwidth: Declare internal structures bandwidth: Add parsing and free functions bandwidth: Create format functions bandwidth: Implement functions to enable and disable QoS bandwidth: Add test cases for network bandwidth: Add domain schema test suite configure.ac | 4 + docs/formatdomain.html.in | 34 +++ docs/formatnetwork.html.in | 30 ++ docs/schemas/domain.rng | 3 + docs/schemas/network.rng | 3 + docs/schemas/networkcommon.rng | 48 +++ libvirt.spec.in | 2 +- src/conf/domain_conf.c | 8 + src/conf/domain_conf.h | 1 + src/conf/network_conf.c | 10 + src/conf/network_conf.h | 1 + src/libvirt_private.syms | 5 + src/network/bridge_driver.c | 18 ++ src/qemu/qemu_command.c | 11 +- src/util/macvtap.c | 12 +- src/util/macvtap.h | 3 +- src/util/network.c | 380 +++++++++++++++++++++++++ src/util/network.h | 22 ++ tests/domainschemadata/domain-bandwidth.xml | 72 +++++ tests/networkxml2xmlin/bandwidth-network.xml | 16 + tests/networkxml2xmlout/bandwidth-network.xml | 16 + tests/networkxml2xmltest.c | 1 + 22 files changed, 696 insertions(+), 4 deletions(-) create mode 100644 tests/domainschemadata/domain-bandwidth.xml create mode 100644 tests/networkxml2xmlin/bandwidth-network.xml create mode 100644 tests/networkxml2xmlout/bandwidth-network.xml -- 1.7.5.rc3

2 16

[libvirt] SSH URIs invoking askpass + sudo don't play well together
by Cole Robinson 25 Jul '11

25 Jul '11

$ cat test.py import os import sys import libvirt def drop_tty(): if os.fork() != 0: os._exit(0) os.setsid() host = sys.argv[1] # Need to drop controlling tty otherwise SSH won't call askpass drop_tty() libvirt.open("qemu+ssh://root@%s/system" % host) $ python test.py localhost <askpass pops up> $ sudo python test.py localhost libvir: RPC error : Cannot recv data: No protocol specified (ssh-askpass:25684): Gtk-WARNING **: cannot open display: :0.0 : Connection reset by peered. Traceback (most recent call last): File "test.py", line 14, in <module> libvirt.open("qemu+ssh://root@%s/system" % host) File "/usr/lib64/python2.7/site-packages/libvirt.py", line 236, in open if ret is None:raise libvirtError('virConnectOpen() failed') libvirt.libvirtError: Cannot recv data: No protocol specified (ssh-askpass:25684): Gtk-WARNING **: cannot open display: :0.0 : Connection reset by peered. virt-manager does drop_tty by default so that users will get askpass if applicable. however as shown above, doing sudo virt-manager prevents this from working. The following libvirt patch makes everything work: diff --git a/src/rpc/virnetsocket.c b/src/rpc/virnetsocket.c index d4c0bdd..ad1c02e 100644 --- a/src/rpc/virnetsocket.c +++ b/src/rpc/virnetsocket.c @@ -606,7 +606,8 @@ int virNetSocketNewConnectSSH(const char *nodename, virCommandAddEnvPass(cmd, "SSH_AUTH_SOCK"); virCommandAddEnvPass(cmd, "SSH_ASKPASS"); virCommandAddEnvPass(cmd, "DISPLAY"); - virCommandClearCaps(cmd); + virCommandAddEnvPass(cmd, "XAUTHORITY"); + //virCommandClearCaps(cmd); if (service) virCommandAddArgList(cmd, "-p", service, NULL); However I assume that's too heavy handed. Anyone have thoughts? FYI I don't think this is a regression or anything, since the original BZ was against RHEL 6.1 which doesn't have the new RPC code: https://bugzilla.redhat.com/show_bug.cgi?id=700523 Thanks, Cole

2 1

[libvirt] libvirt.org outage
by Eric Blake 25 Jul '11

25 Jul '11

libvirt.org appears to be down, possibly for as long as the entire weekend. While that doesn't help anyone trying to browse the online documentation, we at least have the benefit of git being a distributed version control system. For those who would like to track what will be pushed to upstream libvirt.git once it is back online, I've got my personal repo available for the purpose. Assuming that I caught things just before the power outage, then it will be a trivial sync to get everything from my master branch back upstream once things are back to normal. Browse the latest state at: http://repo.or.cz/w/libvirt/ericb.git Track the latest state of upstream patches with: git pull git://repo.or.cz/libvirt/ericb.git master Propose your own patches for me to merge in to the master branch (the mob branch has no push restrictions - anyone can push there, but that also means that anyone can rewind history there, so let me know the commit id of anything that you have pushed there that I should then sync into the master branch): git push mob@repo.or.cz:/srv/git/libvirt/ericb.git +HEAD:mob Feel free to ask questions on list or on irc://irc.oftc.net/virt if you want to coordinate on bleeding-edge development this weekend. -- Eric Blake eblake(a)redhat.com +1-801-349-2682 Libvirt virtualization library http://libvirt.org

4 5

[libvirt] [PATCH] docs: Break up 'Basic Resources' XML section
by Cole Robinson 25 Jul '11

25 Jul '11

We had a bit too many elements crammed in there. Separate it into different headings: - CPU Allocation (<vcpus>) - CPU Tuning (<cputune>) - Memory allocation (<memory> and <currentMemory>) - Memory backing (<memoryBacking>) - Memory tuning (<memtune>) - Numa tuning (<numatune>) - Block I/O tuning (<blkiotune>) --- docs/formatdomain.html.in | 227 ++++++++++++++++++++++++++++++--------------- 1 files changed, 154 insertions(+), 73 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 83146ed..847b9ed 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -282,85 +282,17 @@ </dd> </dl> - <h3><a name="elementsResources">Basic resources</a></h3> + <h3><a name="elementsCPUAllocation">CPU Allocation</a></h3> <pre> +<domain> ... - <memory>524288</memory> - <currentMemory>524288</currentMemory> - <memoryBacking> - <hugepages/> - </memoryBacking> - <blkiotune> - <weight>800</weight> - </blkiotune> - <memtune> - <hard_limit>1048576</hard_limit> - <soft_limit>131072</soft_limit> - <swap_hard_limit>2097152</swap_hard_limit> - <min_guarantee>65536</min_guarantee> - </memtune> <vcpu cpuset="1-4,^3,6" current="1">2</vcpu> - <cputune> - <vcpupin vcpu="0" cpuset="1-4,^2"/> - <vcpupin vcpu="1" cpuset="0,1"/> - <vcpupin vcpu="2" cpuset="2,3"/> - <vcpupin vcpu="3" cpuset="0,4"/> - <shares>2048</shares> - <period>1000000</period> - <quota>-1</quota> - </cputune> - <numatune> - <memory mode="strict" nodeset="1-4,^3"/> - </numatune> - ...</pre> + ... +</domain> +</pre> <dl> - <dt><code>memory</code></dt> - <dd>The maximum allocation of memory for the guest at boot time. - The units for this value are kilobytes (i.e. blocks of 1024 bytes)</dd> - <dt><code>currentMemory</code></dt> - <dd>The actual allocation of memory for the guest. This value can - be less than the maximum allocation, to allow for ballooning - up the guests memory on the fly. If this is omitted, it defaults - to the same value as the <code>memory</code> element</dd> - <dt><code>memoryBacking</code></dt> - <dd>The optional <code>memoryBacking</code> element, may have an - <code>hugepages</code> element set within it. This tells the - hypervisor that the guest should have its memory allocated using - hugepages instead of the normal native page size.</dd> - <dt><code>blkiotune</code></dt> - <dd> The optional <code>blkiotune</code> element provides the ability - to tune Blkio cgroup tunable parameters for the domain. If this is - omitted, it defaults to the OS provided defaults.</dd> - <dt><code>weight</code></dt> - <dd> The optional <code>weight</code> element is the I/O weight of the - guest. The value should be in range [100, 1000].</dd> - <dt><code>memtune</code></dt> - <dd> The optional <code>memtune</code> element provides details - regarding the memory tunable parameters for the domain. If this is - omitted, it defaults to the OS provided defaults. For QEMU/KVM, the - parameters are applied to the QEMU process as a whole. Thus, when - counting them, one needs to add up guest RAM, guest video RAM, and - some memory overhead of QEMU itself. The last piece is hard to - determine so one needs guess and try.</dd> - <dt><code>hard_limit</code></dt> - <dd> The optional <code>hard_limit</code> element is the maximum memory - the guest can use. The units for this value are kilobytes (i.e. blocks - of 1024 bytes)</dd> - <dt><code>soft_limit</code></dt> - <dd> The optional <code>soft_limit</code> element is the memory limit to - enforce during memory contention. The units for this value are - kilobytes (i.e. blocks of 1024 bytes)</dd> - <dt><code>swap_hard_limit</code></dt> - <dd> The optional <code>swap_hard_limit</code> element is the maximum - memory plus swap the guest can use. The units for this value are - kilobytes (i.e. blocks of 1024 bytes). This has to be more than - hard_limit value provided</dd> - <dt><code>min_guarantee</code></dt> - <dd> The optional <code>min_guarantee</code> element is the guaranteed - minimum memory allocation for the guest. The units for this value are - kilobytes (i.e. blocks of 1024 bytes)</dd> <dt><code>vcpu</code></dt> <dd>The content of this element defines the maximum number of virtual CPUs allocated for the guest OS, which must be between 1 and @@ -375,6 +307,28 @@ be used to specify whether fewer than the maximum number of virtual CPUs should be enabled. </dd> + </dl> + + + <h3><a name="elementsCPUTuning">CPU Tuning</a></h3> + +<pre> +<domain> + ... + <cputune> + <vcpupin vcpu="0" cpuset="1-4,^2"/> + <vcpupin vcpu="1" cpuset="0,1"/> + <vcpupin vcpu="2" cpuset="2,3"/> + <vcpupin vcpu="3" cpuset="0,4"/> + <shares>2048</shares> + <period>1000000</period> + <quota>-1</quota> + </cputune> + ... +</domain> +</pre> + + <dl> <dt><code>cputune</code></dt> <dd> The optional <code>cputune</code> element provides details @@ -422,6 +376,110 @@ speed. (NB: Only qemu driver support) <span class="since">Since 0.9.4</span> </dd> + </dl> + + + <h3><a name="elementsMemoryAllocation">Memory Allocation</a></h3> + +<pre> +<domain> + ... + <memory>524288</memory> + <currentMemory>524288</currentMemory> + ... +</domain> +</pre> + + <dl> + <dt><code>memory</code></dt> + <dd>The maximum allocation of memory for the guest at boot time. + The units for this value are kilobytes (i.e. blocks of 1024 bytes)</dd> + <dt><code>currentMemory</code></dt> + <dd>The actual allocation of memory for the guest. This value can + be less than the maximum allocation, to allow for ballooning + up the guests memory on the fly. If this is omitted, it defaults + to the same value as the <code>memory</code> element</dd> + </dl> + + + <h3><a name="elementsMemoryBacking">Memory Backing</a></h3> + +<pre> +<domain> + ... + <memoryBacking> + <hugepages/> + </memoryBacking> + ... +</domain> +</pre> + + <dl> + <dt><code>memoryBacking</code></dt> + <dd>The optional <code>memoryBacking</code> element, may have an + <code>hugepages</code> element set within it. This tells the + hypervisor that the guest should have its memory allocated using + hugepages instead of the normal native page size.</dd> + </dl> + + + <h3><a name="elementsMemoryTuning">Memory Tuning</a></h3> + +<pre> +<domain> + ... + <memtune> + <hard_limit>1048576</hard_limit> + <soft_limit>131072</soft_limit> + <swap_hard_limit>2097152</swap_hard_limit> + <min_guarantee>65536</min_guarantee> + </memtune> + ... +</domain> +</pre> + + <dl> + <dt><code>memtune</code></dt> + <dd> The optional <code>memtune</code> element provides details + regarding the memory tunable parameters for the domain. If this is + omitted, it defaults to the OS provided defaults. For QEMU/KVM, the + parameters are applied to the QEMU process as a whole. Thus, when + counting them, one needs to add up guest RAM, guest video RAM, and + some memory overhead of QEMU itself. The last piece is hard to + determine so one needs guess and try.</dd> + <dt><code>hard_limit</code></dt> + <dd> The optional <code>hard_limit</code> element is the maximum memory + the guest can use. The units for this value are kilobytes (i.e. blocks + of 1024 bytes)</dd> + <dt><code>soft_limit</code></dt> + <dd> The optional <code>soft_limit</code> element is the memory limit to + enforce during memory contention. The units for this value are + kilobytes (i.e. blocks of 1024 bytes)</dd> + <dt><code>swap_hard_limit</code></dt> + <dd> The optional <code>swap_hard_limit</code> element is the maximum + memory plus swap the guest can use. The units for this value are + kilobytes (i.e. blocks of 1024 bytes). This has to be more than + hard_limit value provided</dd> + <dt><code>min_guarantee</code></dt> + <dd> The optional <code>min_guarantee</code> element is the guaranteed + minimum memory allocation for the guest. The units for this value are + kilobytes (i.e. blocks of 1024 bytes)</dd> + </dl> + + + <h3><a name="elementsNUMATuning">NUMA Node Tuning</a></h3> + +<pre> +<domain> + ... + <numatune> + <memory mode="strict" nodeset="1-4,^3"/> + </numatune> + ... +</domain> +</pre> + + <dl> <dt><code>numatune</code></dt> <dd> The optional <code>numatune</code> element provides details of @@ -440,6 +498,29 @@ </dd> </dl> + + <h3><a name="elementsBlockTuning">Block I/O Tuning</a></h3> +<pre> +<domain> + ... + <blkiotune> + <weight>800</weight> + </blkiotune> + ... +</domain> +</pre> + + <dl> + <dt><code>blkiotune</code></dt> + <dd> The optional <code>blkiotune</code> element provides the ability + to tune Blkio cgroup tunable parameters for the domain. If this is + omitted, it defaults to the OS provided defaults.</dd> + <dt><code>weight</code></dt> + <dd> The optional <code>weight</code> element is the I/O weight of the + guest. The value should be in range [100, 1000].</dd> + </dl> + + <h3><a name="elementsCPU">CPU model and topology</a></h3> <p> -- 1.7.4.4

2 2

[libvirt] [PATCHv2 0/4] support the listenNetwork attribute in <graphics>
by Laine Stump 25 Jul '11

25 Jul '11

This patch series resolves the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=703851 In short, it implements support for a new "listenNetwork" attribute in the domain's <graphics> element. When listenNetwork is specified, libvirt will look for a network of that name (from the networks that can be created within libvirt), and derive a listen address from the physical interface used to connect that network to the outside world. (More details are given in each commit message). This is V2. The main differences from V1 are: 1) everything was rebased 2) I eliminated #if WITH_NETWORK in the .c files by defining the one missing function as static inline when WITH_NETWORK is false. This series is meant to be applied on top of the "network physical device abstraction" patch series I sent a couple hours ago: https://www.redhat.com/archives/libvir-list/2011-July/msg01294.html Don't attempt to apply it by itself!

3 18

[libvirt] [libvirt-test-API][PATCH 2/2] Add clean part for install_windows_cdrom
by Wayne Sun 25 Jul '11

25 Jul '11

* Add cleanup function install_windows_cdrom_clean --- repos/domain/install_windows_cdrom.py | 88 +++++++++++++++++++++++++++----- 1 files changed, 74 insertions(+), 14 deletions(-) diff --git a/repos/domain/install_windows_cdrom.py b/repos/domain/install_windows_cdrom.py index f1441df..2ea0ee7 100644 --- a/repos/domain/install_windows_cdrom.py +++ b/repos/domain/install_windows_cdrom.py @@ -51,6 +51,15 @@ __version__ = "0.1.0" __credits__ = "Copyright (C) 2010 Red Hat, Inc." __all__ = ['install_windows_cdrom', 'usage'] +VIRSH_QUIET_LIST = "virsh --quiet list --all|awk '{print $2}'|grep \"^%s$\"" +VM_STAT = "virsh --quiet list --all| grep \"\\b%s\\b\"|grep off" +VM_DESTROY = "virsh destroy %s" +VM_UNDEFINE = "virsh undefine %s" + +FLOOPY_IMG = "/tmp/floppy.img" +ISO_MOUNT_POINT = "/mnt/libvirt_windows" + + def usage(): print '''usage: mandatory arguments:guesttype guestname @@ -132,19 +141,19 @@ def prepare_iso(iso_file, mount_point): return 0, iso_local_path def prepare_floppy_image(guestname, guestos, guestarch, - windows_unattended_path, cdkey, floppy_img): + windows_unattended_path, cdkey, FLOOPY_IMG): """Making corresponding floppy images for the given guestname """ - if os.path.exists(floppy_img): - os.remove(floppy_img) + if os.path.exists(FLOOPY_IMG): + os.remove(FLOOPY_IMG) - create_cmd = 'dd if=/dev/zero of=%s bs=1440k count=1' % floppy_img + create_cmd = 'dd if=/dev/zero of=%s bs=1440k count=1' % FLOOPY_IMG (status, text) = commands.getstatusoutput(create_cmd) if status: logger.error("failed to create floppy image") return 1 - format_cmd = 'mkfs.msdos -s 1 %s' % floppy_img + format_cmd = 'mkfs.msdos -s 1 %s' % FLOOPY_IMG (status, text) = commands.getstatusoutput(format_cmd) if status: logger.error("failed to format floppy image") @@ -159,7 +168,7 @@ def prepare_floppy_image(guestname, guestos, guestarch, os.makedirs(floppy_mount) try: - mount_cmd = 'mount -o loop %s %s' % (floppy_img, floppy_mount) + mount_cmd = 'mount -o loop %s %s' % (FLOOPY_IMG, floppy_mount) (status, text) = commands.getstatusoutput(mount_cmd) if status: logger.error( @@ -202,7 +211,7 @@ def prepare_floppy_image(guestname, guestos, guestarch, cleanup(floppy_mount) - os.chmod(floppy_img, 0755) + os.chmod(FLOOPY_IMG, 0755) logger.info("Boot floppy created successfuly") return 0 @@ -339,22 +348,18 @@ def install_windows_cdrom(params): logger.info('prepare pre-installation environment...') logger.info('mount windows nfs server to /mnt/libvirt_windows') - iso_mount_point = "/mnt/libvirt_windows" - - status, iso_local_path = prepare_iso(iso_file, iso_mount_point) + status, iso_local_path = prepare_iso(iso_file, ISO_MOUNT_POINT) if status: logger.error("installation failed") return 1 params['bootcd'] = iso_local_path - floppy_img = "/tmp/floppy.img" - status = prepare_floppy_image(guestname, guestos, guestarch, - windows_unattended_path, cdkey, floppy_img) + windows_unattended_path, cdkey, FLOOPY_IMG) if status: logger.error("making floppy image failed") return 1 - params['floppysource'] = floppy_img + params['floppysource'] = FLOOPY_IMG xmlobj = xmlbuilder.XmlBuilder() guestxml = xmlobj.build_domain_install_win(params) @@ -458,3 +463,58 @@ def install_windows_cdrom(params): return return_close(conn, logger, 0) +def install_windows_cdrom_clean(params): + """ clean testing environment """ + logger = params['logger'] + guestname = params.get('guestname') + guesttype = params.get('guesttype') + + util = utils.Utils() + hypervisor = util.get_hypervisor() + if hypervisor == 'xen': + imgfullpath = os.path.join('/var/lib/xen/images', guestname) + elif hypervisor == 'kvm': + imgfullpath = os.path.join('/var/lib/libvirt/images', guestname) + + (status, output) = commands.getstatusoutput(VIRSH_QUIET_LIST % guestname) + if status: + pass + else: + logger.info("remove guest %s, and its disk image file" % guestname) + (status, output) = commands.getstatusoutput(VM_STAT % guestname) + if status: + (status, output) = commands.getstatusoutput(VM_DESTROY % guestname) + if status: + logger.error("failed to destroy guest %s" % guestname) + logger.error("%s" % output) + else: + (status, output) = commands.getstatusoutput(VM_UNDEFINE % guestname) + if status: + logger.error("failed to undefine guest %s" % guestname) + logger.error("%s" % output) + else: + (status, output) = commands.getstatusoutput(VM_UNDEFINE % guestname) + if status: + logger.error("failed to undefine guest %s" % guestname) + logger.error("%s" % output) + + guestos = params.get('guestos') + guestarch = params.get('guestarch') + + envfile = os.path.join(homepath, 'env.cfg') + envparser = env_parser.Envparser(envfile) + iso_file = envparser.get_value("guest", guestos + '_' + guestarch) + + status, iso_local_path = prepare_iso(iso_file, ISO_MOUNT_POINT) + if os.path.exists(iso_local_path): + os.remove(iso_local_path) + + iso_local_path_1 = iso_local_path + ".1" + if os.path.exists(iso_local_path_1): + os.remove(iso_local_path_1) + + if os.path.exists(imgfullpath): + os.remove(imgfullpath) + + if os.path.exists(FLOOPY_IMG): + os.remove(FLOOPY_IMG) -- 1.7.6

3 5

[libvirt] [libvirt-test-API][PATCH 2/2] Add clean part for install_windows_cdrom
by Wayne Sun 25 Jul '11

25 Jul '11

* Add cleanup function install_windows_cdrom_clean --- repos/domain/install_windows_cdrom.py | 88 +++++++++++++++++++++++++++----- 1 files changed, 74 insertions(+), 14 deletions(-) diff --git a/repos/domain/install_windows_cdrom.py b/repos/domain/install_windows_cdrom.py index f1441df..2ea0ee7 100644 --- a/repos/domain/install_windows_cdrom.py +++ b/repos/domain/install_windows_cdrom.py @@ -51,6 +51,15 @@ __version__ = "0.1.0" __credits__ = "Copyright (C) 2010 Red Hat, Inc." __all__ = ['install_windows_cdrom', 'usage'] +VIRSH_QUIET_LIST = "virsh --quiet list --all|awk '{print $2}'|grep \"^%s$\"" +VM_STAT = "virsh --quiet list --all| grep \"\\b%s\\b\"|grep off" +VM_DESTROY = "virsh destroy %s" +VM_UNDEFINE = "virsh undefine %s" + +FLOOPY_IMG = "/tmp/floppy.img" +ISO_MOUNT_POINT = "/mnt/libvirt_windows" + + def usage(): print '''usage: mandatory arguments:guesttype guestname @@ -132,19 +141,19 @@ def prepare_iso(iso_file, mount_point): return 0, iso_local_path def prepare_floppy_image(guestname, guestos, guestarch, - windows_unattended_path, cdkey, floppy_img): + windows_unattended_path, cdkey, FLOOPY_IMG): """Making corresponding floppy images for the given guestname """ - if os.path.exists(floppy_img): - os.remove(floppy_img) + if os.path.exists(FLOOPY_IMG): + os.remove(FLOOPY_IMG) - create_cmd = 'dd if=/dev/zero of=%s bs=1440k count=1' % floppy_img + create_cmd = 'dd if=/dev/zero of=%s bs=1440k count=1' % FLOOPY_IMG (status, text) = commands.getstatusoutput(create_cmd) if status: logger.error("failed to create floppy image") return 1 - format_cmd = 'mkfs.msdos -s 1 %s' % floppy_img + format_cmd = 'mkfs.msdos -s 1 %s' % FLOOPY_IMG (status, text) = commands.getstatusoutput(format_cmd) if status: logger.error("failed to format floppy image") @@ -159,7 +168,7 @@ def prepare_floppy_image(guestname, guestos, guestarch, os.makedirs(floppy_mount) try: - mount_cmd = 'mount -o loop %s %s' % (floppy_img, floppy_mount) + mount_cmd = 'mount -o loop %s %s' % (FLOOPY_IMG, floppy_mount) (status, text) = commands.getstatusoutput(mount_cmd) if status: logger.error( @@ -202,7 +211,7 @@ def prepare_floppy_image(guestname, guestos, guestarch, cleanup(floppy_mount) - os.chmod(floppy_img, 0755) + os.chmod(FLOOPY_IMG, 0755) logger.info("Boot floppy created successfuly") return 0 @@ -339,22 +348,18 @@ def install_windows_cdrom(params): logger.info('prepare pre-installation environment...') logger.info('mount windows nfs server to /mnt/libvirt_windows') - iso_mount_point = "/mnt/libvirt_windows" - - status, iso_local_path = prepare_iso(iso_file, iso_mount_point) + status, iso_local_path = prepare_iso(iso_file, ISO_MOUNT_POINT) if status: logger.error("installation failed") return 1 params['bootcd'] = iso_local_path - floppy_img = "/tmp/floppy.img" - status = prepare_floppy_image(guestname, guestos, guestarch, - windows_unattended_path, cdkey, floppy_img) + windows_unattended_path, cdkey, FLOOPY_IMG) if status: logger.error("making floppy image failed") return 1 - params['floppysource'] = floppy_img + params['floppysource'] = FLOOPY_IMG xmlobj = xmlbuilder.XmlBuilder() guestxml = xmlobj.build_domain_install_win(params) @@ -458,3 +463,58 @@ def install_windows_cdrom(params): return return_close(conn, logger, 0) +def install_windows_cdrom_clean(params): + """ clean testing environment """ + logger = params['logger'] + guestname = params.get('guestname') + guesttype = params.get('guesttype') + + util = utils.Utils() + hypervisor = util.get_hypervisor() + if hypervisor == 'xen': + imgfullpath = os.path.join('/var/lib/xen/images', guestname) + elif hypervisor == 'kvm': + imgfullpath = os.path.join('/var/lib/libvirt/images', guestname) + + (status, output) = commands.getstatusoutput(VIRSH_QUIET_LIST % guestname) + if status: + pass + else: + logger.info("remove guest %s, and its disk image file" % guestname) + (status, output) = commands.getstatusoutput(VM_STAT % guestname) + if status: + (status, output) = commands.getstatusoutput(VM_DESTROY % guestname) + if status: + logger.error("failed to destroy guest %s" % guestname) + logger.error("%s" % output) + else: + (status, output) = commands.getstatusoutput(VM_UNDEFINE % guestname) + if status: + logger.error("failed to undefine guest %s" % guestname) + logger.error("%s" % output) + else: + (status, output) = commands.getstatusoutput(VM_UNDEFINE % guestname) + if status: + logger.error("failed to undefine guest %s" % guestname) + logger.error("%s" % output) + + guestos = params.get('guestos') + guestarch = params.get('guestarch') + + envfile = os.path.join(homepath, 'env.cfg') + envparser = env_parser.Envparser(envfile) + iso_file = envparser.get_value("guest", guestos + '_' + guestarch) + + status, iso_local_path = prepare_iso(iso_file, ISO_MOUNT_POINT) + if os.path.exists(iso_local_path): + os.remove(iso_local_path) + + iso_local_path_1 = iso_local_path + ".1" + if os.path.exists(iso_local_path_1): + os.remove(iso_local_path_1) + + if os.path.exists(imgfullpath): + os.remove(imgfullpath) + + if os.path.exists(FLOOPY_IMG): + os.remove(FLOOPY_IMG) -- 1.7.6

1 1

[libvirt] [PATCH] driver.h: Fix two driver documentation mistakes
by Wieland Hoffmann 22 Jul '11

22 Jul '11

--- src/driver.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/driver.h b/src/driver.h index 9d0d3de..adc3e1c 100644 --- a/src/driver.h +++ b/src/driver.h @@ -945,7 +945,7 @@ typedef virInterfaceDriver *virInterfaceDriverPtr; /** * _virInterfaceDriver: * - * Structure associated to a network virtualization driver, defining the various + * Structure associated to a network interface driver, defining the various * entry points for it. * * All drivers must support the following fields/methods: @@ -1106,7 +1106,7 @@ typedef virStorageDriver *virStorageDriverPtr; /** * _virStorageDriver: * - * Structure associated to a network virtualization driver, defining the various + * Structure associated to a storage driver, defining the various * entry points for it. * * All drivers must support the following fields/methods: -- 1.7.6

2 1

Re: [libvirt] [Qemu-devel] live snapshot wiki updated
by Eric Blake 22 Jul '11

22 Jul '11

[adding the libvir-list] On 07/19/2011 08:09 AM, Jes Sorensen wrote: > On 07/19/11 15:58, Eric Blake wrote: >> On 07/19/2011 07:27 AM, Jes Sorensen wrote: >>> Eric, what happens if libvirt in an selinux environment tells QEMU to >>> launch using an image file that is backed by backing file(s)? >> >> Before starting qemu, libvirt first parses all the image files, to see >> if any of them have backing images. For every qcow2 or qed image with a >> backing file, libvirt sets the SELinux context of both the qcow2 image >> and its backing file so that qemu will be able to successfully open() >> them. But if any of those files reside on NFS, then it is not possible >> to label individual files, so it requires setting the SELinux bool >> virt_use_nfs, which thus gives qemu the power to open() arbitrary files >> on NFS, and you've lost security. > > Urgh, libvirt parsing image files is really unfortunate, it really > doesn't give me warm fuzzy feelings :( libvirt really should not know > about internals of image formats. But even if you add new features to qemu to avoid needing this in the future, it doesn't change the past - libvirt will always have to know how to parse image files understood by older qemu, and so as long as libvirt already knows how to do that parsing, we might as well take advantage of it. Besides, I feel that having a well-documented file format, so that independent applications can both parse the same file with the same semantics by obeying the file format specification, is a good design goal. > >> It would be nice if libvirt had a way to pass fds for every disk and >> backing file up front; then, SELinux can work around the lack of NFS >> per-file labelling by blocking open() in qemu. In fact, this has >> already been proposed: > > A cleaner solution seems to have libvirt provide a call-back allowing > QEMU to call out and have libvirt open a file descriptor instead. This > way libvirt can validate it and open it for QEMU and pass it back. Yes, that could probably be made to work with libvirt. > > If we cannot do something like this, I would prefer to have backing > files on NFS should simply not be supported when running in an selinux > setup. As nice as that sentiment is, it will never fly, because it would be a regression in current behavior. The whole reason that the virt_use_nfs SELinux bool exists is that some people are willing to make the partial security tradeoff. Besides, the use of sVirt via SELinux is more than just open() protection - while the current virt_use_nfs bool makes NFS less secure than otherwise possible, it still gives some nice guarantees to the rest of the qemu process such as passthrough accesses to local pci devices. Just because it is currently not as secure to mix NFS shared storage with backing files doesn't stop some people from wanting to do it [in fact, that's my current development setup - I use qcow2 images on NFS shared storage, keep SELinux enabled, and enable the virt_use_nfs bool]. This discussion is about adding enhancements that make SELinux even more powerful when using NFS shared storage, by adding fd passing (whether libvirt parses in advance, or whether qemu raises an event and requires feedback from libvirt), and not about crippling the existing capability to use the virt_use_nfs selinux bool. -- Eric Blake eblake(a)redhat.com +1-801-349-2682 Libvirt virtualization library http://libvirt.org

11 64

[libvirt] [PATCH] build: Use $(PYTHON) instead of python for the keycode map generator
by Matthias Bolte 22 Jul '11

22 Jul '11

Also prepend $(AM_V_GEN). --- src/Makefile.am | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index 481caba..eef0669 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -90,7 +90,7 @@ EXTRA_DIST += $(srcdir)/util/virkeymaps.h $(srcdir)/util/keymaps.csv \ $(srcdir)/util/virkeymaps.h: $(srcdir)/util/keymaps.csv \ $(srcdir)/util/virkeycode-mapgen.py - python $(srcdir)/util/virkeycode-mapgen.py <$(srcdir)/util/keymaps.csv >$@ + $(AM_V_GEN)$(PYTHON) $(srcdir)/util/virkeycode-mapgen.py <$(srcdir)/util/keymaps.csv >$@ $(srcdir)/util/virkeycode.c: $(srcdir)/util/virkeycode.h $(srcdir)/util/virkeymaps.h -- 1.7.4.1

3 5

[libvirt] [PATCH] Pre-create /var/lib/libvirt/sanlock directory
by Daniel P. Berrange 22 Jul '11

22 Jul '11

From: "Daniel P. Berrange" <berrange(a)redhat.com> The sanlock plugin for libvirt expects the directory /var/lib/libvirt/sanlock to exist. Create this and add it to the RPM * libvirt.spec.in: Add /var/lib/libvirt/sanlock * src/Makefile.am: Create /var/lib/libvirt/sanlock --- libvirt.spec.in | 1 + src/Makefile.am | 6 ++++++ 2 files changed, 7 insertions(+), 0 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 6cbd9ac..7c8b2ec 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1046,6 +1046,7 @@ fi %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/sanlock.so %{_datadir}/augeas/lenses/libvirt_sanlock.aug %{_datadir}/augeas/lenses/tests/test_libvirt_sanlock.aug +%dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/sanlock %{_sbindir}/virt-sanlock-cleanup %{_mandir}/man8/virt-sanlock-cleanup.8* %endif diff --git a/src/Makefile.am b/src/Makefile.am index 481caba..c1786cf 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1396,6 +1396,9 @@ install-data-local: $(MKDIR_P) "$(DESTDIR)$(localstatedir)/cache/libvirt" $(MKDIR_P) "$(DESTDIR)$(localstatedir)/lib/libvirt/images" $(MKDIR_P) "$(DESTDIR)$(localstatedir)/lib/libvirt/boot" +if HAVE_SANLOCK + $(MKDIR_P) "$(DESTDIR)$(localstatedir)/lib/libvirt/sanlock" +endif if WITH_QEMU $(MKDIR_P) "$(DESTDIR)$(localstatedir)/lib/libvirt/qemu" $(MKDIR_P) "$(DESTDIR)$(localstatedir)/run/libvirt/qemu" @@ -1438,6 +1441,9 @@ uninstall-local:: rmdir "$(DESTDIR)$(localstatedir)/cache/libvirt" ||: rmdir "$(DESTDIR)$(localstatedir)/lib/libvirt/images" ||: rmdir "$(DESTDIR)$(localstatedir)/lib/libvirt/boot" ||: +if HAVE_SANLOCK + rmdir "$(DESTDIR)$(localstatedir)/lib/libvirt/sanlock" ||: +endif if WITH_QEMU rmdir "$(DESTDIR)$(localstatedir)/lib/libvirt/qemu" ||: rmdir "$(DESTDIR)$(localstatedir)/run/libvirt/qemu" ||: -- 1.7.6

2 2

[libvirt] [PATCH 00/12] New API: virDominShutdownFlags
by Michal Privoznik 22 Jul '11

22 Jul '11

This series creates new API which adds flags to virDomainShutdown. As mentioned here many times, it is a bad luck all APIs don't have flags parameter. Parameter for this might be needed to select different ways of shutting down a domain. Currently, no new functionality is implemented, but this paves the way for creating multiple ways of domain shutting down. Therefore, calling this new API is the same as calling its predecessor. Michal Privoznik (12): shutdown: Define new public API virDomainShutdownFlags shutdown: Wire up the remote protocol shutdown: Implement internal API for qemu driver shutdown: Implement internal API for ESX driver shutdown: Implement internal API for libxl driver shutdown: Implement internal API for openvz driver shutdown: Implement internal API for phyp driver shutdown: Implement internal API for uml driver shutdown: Implement internal API for vbox driver shutdown: Implement internal API for vmware driver shutdown: Implement internal API for xen driver shutdown: Implement internal API for xenapi driver include/libvirt/libvirt.h.in | 6 ++++ src/driver.h | 4 +++ src/esx/esx_driver.c | 12 ++++++++- src/libvirt.c | 54 ++++++++++++++++++++++++++++++++++++++++++ src/libvirt_public.syms | 1 + src/libxl/libxl_driver.c | 12 ++++++++- src/openvz/openvz_driver.c | 1 + src/phyp/phyp_driver.c | 12 ++++++++- src/qemu/qemu_driver.c | 12 ++++++++- src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 8 +++++- src/remote_protocol-structs | 5 ++++ src/uml/uml_driver.c | 15 +++++++++++- src/vbox/vbox_tmpl.c | 14 ++++++++++- src/vmware/vmware_driver.c | 1 + src/xen/xen_driver.c | 14 ++++++++-- src/xen/xen_driver.h | 2 +- src/xen/xen_hypervisor.c | 2 +- src/xen/xen_inotify.c | 2 +- src/xen/xend_internal.c | 10 +++++-- src/xen/xend_internal.h | 2 +- src/xen/xm_internal.c | 2 +- src/xen/xs_internal.c | 10 +++++-- src/xen/xs_internal.h | 3 +- src/xenapi/xenapi_driver.c | 25 ++++++++++++++++++- 25 files changed, 206 insertions(+), 24 deletions(-) -- 1.7.5.rc3

3 16

[libvirt] RFC: Implement virDomainGetIPAddress()
by Michal Novotny 22 Jul '11

22 Jul '11

Hi guys, some time ago I've been investigating the options to get the guest's IP address information without having to connect to guest's VNC window or console. It was for one project I've been working on and I found that the solution lies in the procfs, precisely in the /proc/{PID}/net/arp... The format is as follows: $ cat /proc/{PID}/net/arp IP address HW type Flags HW address Mask Device 192.168.122.36 0x1 0x2 52:54:00:35:76:e6 * virbr0 where the HW address matches the MAC address associated to the guest's NIC. Implementing such an API shouldn't be a big problem however I know that there's some option to run libvirt on Windows machines. It should be just the client so it shouldn't really matter however I'd like to ask you whether it's really not an issue. The function should return a string of the guest's IP address as read from the procfs or return a NULL value if there's no IP address associated with the guest. If the multiple NICs are being used by the guest then the function should return either the IP address matching the MAC address passed to the function or the first IP address if omitted. The prototype should be: char *virDomainGetIPAddress(virDomainPtr domain, char *devmac); For this the internal information about PID of the process spawned should be used (this is already being tracked and stored by libvirt IMHO) to access the /proc/{PID}/net/arp file. This API function would be very useful since it would give libvirt users option to get the information of the guest's IP address without having to connect to guest's VNC window or console. For virsh this could be implemented directly into the dominfo subcommand. What do you think about implementing this ? Thanks, Michal -- Michal Novotny <minovotn(a)redhat.com>, RHCE, Red Hat Virtualization | libvirt-php bindings | php-virt-control.org

3 12

[libvirt] [PATCH 0/3] Support readonly mounts in LXC
by Daniel P. Berrange 22 Jul '11

22 Jul '11

This patch series introduces support for readonly mounts in LXC. In includes general refactoring which will help other patches coming later too.

2 7

[libvirt] [PATCH] xenapi: Fix double-freeing the session in xenapiClose
by Matthias Bolte 22 Jul '11

22 Jul '11

xen_session_logout already frees the whole session object. Don't call xenSessionFree on a freed session object. Reported by Sharmila Radhakrishnan. --- src/xenapi/xenapi_driver.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/xenapi/xenapi_driver.c b/src/xenapi/xenapi_driver.c index 97da1d1..dbc03cb 100644 --- a/src/xenapi/xenapi_driver.c +++ b/src/xenapi/xenapi_driver.c @@ -230,7 +230,7 @@ xenapiClose (virConnectPtr conn) if (priv->session != NULL) { xen_session_logout(priv->session); - xenSessionFree(priv->session); + priv->session = NULL; } VIR_FREE(priv->url); -- 1.7.4.1

2 2

[libvirt] [PATCH] remote/ssh: optional "keyfile" parameter.
by Oskari Saarenmaa 22 Jul '11

22 Jul '11

New optional parameter "keyfile" for ssh transport allows the user to select the private key to be used to authenticate to the remote host. --- docs/remote.html.in | 16 ++++++++++++++++ src/remote/remote_driver.c | 9 ++++++++- src/rpc/virnetclient.c | 4 +++- src/rpc/virnetclient.h | 1 + src/rpc/virnetsocket.c | 3 +++ src/rpc/virnetsocket.h | 1 + tests/virnetsockettest.c | 12 ++++++++++++ 7 files changed, 44 insertions(+), 2 deletions(-) diff --git a/docs/remote.html.in b/docs/remote.html.in index 39d65aa..b554950 100644 --- a/docs/remote.html.in +++ b/docs/remote.html.in @@ -275,6 +275,22 @@ Note that parameter values must be <td colspan="2"/> <td> Example: <code>netcat=/opt/netcat/bin/nc</code> </td> </tr> + + <tr> + <td> + <code>keyfile</code> + </td> + <td> ssh </td> + <td> + The name of the private key file to use to authentication to the remote + machine. If this option is not used the default keys are used. + </td> + </tr> + <tr> + <td colspan="2"/> + <td> Example: <code>keyfile=/root/.ssh/example_key</code> </td> + </tr> + <tr> <td> <code>no_verify</code> diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index c2f8bbd..3878fc9 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -343,7 +343,7 @@ doRemoteOpen (virConnectPtr conn, char *name = NULL, *command = NULL, *sockname = NULL, *netcat = NULL; char *port = NULL, *authtype = NULL, *username = NULL; int no_verify = 0, no_tty = 0; - char *pkipath = NULL; + char *pkipath = NULL, *keyfile = NULL; /* Return code from this function, and the private data. */ int retcode = VIR_DRV_OPEN_ERROR; @@ -416,6 +416,11 @@ doRemoteOpen (virConnectPtr conn, netcat = strdup (var->value); if (!netcat) goto out_of_memory; var->ignore = 1; + } else if (STRCASEEQ (var->name, "keyfile")) { + VIR_FREE(keyfile); + keyfile = strdup (var->value); + if (!keyfile) goto out_of_memory; + var->ignore = 1; } else if (STRCASEEQ (var->name, "no_verify")) { no_verify = atoi (var->value); var->ignore = 1; @@ -573,6 +578,7 @@ doRemoteOpen (virConnectPtr conn, no_tty, no_verify, netcat ? netcat : "nc", + keyfile, sockname))) goto failed; @@ -672,6 +678,7 @@ doRemoteOpen (virConnectPtr conn, VIR_FREE(sockname); VIR_FREE(authtype); VIR_FREE(netcat); + VIR_FREE(keyfile); VIR_FREE(username); VIR_FREE(port); VIR_FREE(pkipath); diff --git a/src/rpc/virnetclient.c b/src/rpc/virnetclient.c index d3965c6..1bda763 100644 --- a/src/rpc/virnetclient.c +++ b/src/rpc/virnetclient.c @@ -189,11 +189,13 @@ virNetClientPtr virNetClientNewSSH(const char *nodename, bool noTTY, bool noVerify, const char *netcat, + const char *keyfile, const char *path) { virNetSocketPtr sock; - if (virNetSocketNewConnectSSH(nodename, service, binary, username, noTTY, noVerify, netcat, path, &sock) < 0) + if (virNetSocketNewConnectSSH(nodename, service, binary, username, noTTY, + noVerify, netcat, keyfile, path, &sock) < 0) return NULL; return virNetClientNew(sock, NULL); diff --git a/src/rpc/virnetclient.h b/src/rpc/virnetclient.h index 6acdf50..3e5659c 100644 --- a/src/rpc/virnetclient.h +++ b/src/rpc/virnetclient.h @@ -46,6 +46,7 @@ virNetClientPtr virNetClientNewSSH(const char *nodename, bool noTTY, bool noVerify, const char *netcat, + const char *keyfile, const char *path); virNetClientPtr virNetClientNewExternal(const char **cmdargv); diff --git a/src/rpc/virnetsocket.c b/src/rpc/virnetsocket.c index 7ea1ab7..57373a0 100644 --- a/src/rpc/virnetsocket.c +++ b/src/rpc/virnetsocket.c @@ -578,6 +578,7 @@ int virNetSocketNewConnectSSH(const char *nodename, bool noTTY, bool noVerify, const char *netcat, + const char *keyfile, const char *path, virNetSocketPtr *retsock) { @@ -594,6 +595,8 @@ int virNetSocketNewConnectSSH(const char *nodename, virCommandAddArgList(cmd, "-p", service, NULL); if (username) virCommandAddArgList(cmd, "-l", username, NULL); + if (keyfile) + virCommandAddArgList(cmd, "-i", keyfile, NULL); if (noTTY) virCommandAddArgList(cmd, "-T", "-o", "BatchMode=yes", "-e", "none", NULL); diff --git a/src/rpc/virnetsocket.h b/src/rpc/virnetsocket.h index 5f882ac..479be28 100644 --- a/src/rpc/virnetsocket.h +++ b/src/rpc/virnetsocket.h @@ -69,6 +69,7 @@ int virNetSocketNewConnectSSH(const char *nodename, bool noTTY, bool noVerify, const char *netcat, + const char *keyfile, const char *path, virNetSocketPtr *addr); diff --git a/tests/virnetsockettest.c b/tests/virnetsockettest.c index 1697ced..fd8151b 100644 --- a/tests/virnetsockettest.c +++ b/tests/virnetsockettest.c @@ -379,6 +379,7 @@ struct testSSHData { bool noTTY; bool noVerify; const char *netcat; + const char *keyfile; const char *path; const char *expectOut; @@ -400,6 +401,7 @@ static int testSocketSSH(const void *opaque) data->noTTY, data->noVerify, data->netcat, + data->keyfile, data->path, &csock) < 0) goto cleanup; @@ -542,6 +544,16 @@ mymain(void) if (virtTestRun("SSH test 5", 1, testSocketSSH, &sshData5) < 0) ret = -1; + struct testSSHData sshData6 = { + .nodename = "example.com", + .path = "/tmp/socket", + .keyfile = "/root/.ssh/example_key", + .noVerify = true, + .expectOut = "-i /root/.ssh/example_key -o StrictHostKeyChecking=no example.com nc -U /tmp/socket\n", + }; + if (virtTestRun("SSH test 6", 1, testSocketSSH, &sshData6) < 0) + ret = -1; + #endif return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); -- 1.7.6

2 1

[libvirt] [PATCH RESEND RFC v4 0/6] support cpu bandwidth in libvirt
by Wen Congyang 22 Jul '11

22 Jul '11

Resend this patchset TODO: 1. We create sub directory for each vcpu in cpu subsystem. So we should recalculate cpu.shares for each vcpu. Changelog: v4: address Adam Litke's comment v3: fix some small bugs implement the simple way v2: almost rewrite the patchset to support to control each vcpu's bandwidth. Limit quota to [-1, 2^64/1000] at the schemas level. We will check it at cgroup level. Wen Congyang (6): Introduce the function virCgroupForVcpu cgroup: Implement cpu.cfs_period_us and cpu.cfs_quota_us tuning API Update XML Schema for new entries qemu: Implement period and quota tunable XML configuration and parsing qemu: Implement cfs_period and cfs_quota's modification doc: Add documentation for new cputune elements period and quota docs/formatdomain.html.in | 19 ++ docs/schemas/domain.rng | 26 ++- src/conf/domain_conf.c | 20 ++- src/conf/domain_conf.h | 2 + src/libvirt_private.syms | 5 + src/qemu/qemu_cgroup.c | 137 ++++++++++ src/qemu/qemu_cgroup.h | 4 + src/qemu/qemu_driver.c | 312 +++++++++++++++++++++-- src/qemu/qemu_process.c | 4 + src/util/cgroup.c | 153 +++++++++++- src/util/cgroup.h | 11 + tests/qemuxml2argvdata/qemuxml2argv-cputune.xml | 2 + 12 files changed, 659 insertions(+), 36 deletions(-)

6 35

[libvirt] [PATCH 0/3] More work on TLS certificate code
by Daniel P. Berrange 22 Jul '11

22 Jul '11

This series started off with an attempt to refactor the TLS certificate validation code to remove duplication. I then realized I ought to be testing such sensitive code too. So the big interesting part of this patch is a test case todo validation using very certificates. Rather than add a bunch of certs to GIT, I have written (nasty) GNUTLS code to generate certs on the fly with a variety of good & bad data in them.

2 7

[libvirt] [PATCHv2 0/9] network: physical device abstraction aka 'virtual switch'
by Laine Stump 22 Jul '11

22 Jul '11

This series deprecates patches 04/10 - 10/10 of the previous series of the same name, posted here: https://www.redhat.com/archives/libvir-list/2011-July/msg00149.html This patch is in response to the following bug reports: https://bugzilla.redhat.com/show_bug.cgi?id=643947 (RHEL) https://bugzilla.redhat.com/show_bug.cgi?id=636106 (upstream) The first 4 patches of the earlier series were reasonable cleanups in their own right, and were ACKed, so I pushed them earlier. I reorganized the remaining 6 patches accord to advice from Dan Berrange and Eric Blake. Some notes about correlation between v1 and v2: [PATCHv2 1/9] util: define MAX A new patch [PATCHv2 2/9] conf: put virtPortProfile struct / functions in a common location Was 05/10 in v1: https://www.redhat.com/archives/libvir-list/2011-July/msg00154.html [PATCHv2 3/9] conf: virDomainNetDef points to (rather than contains) virtPortProfile This was also part of 05/10 in v1. I separated it out to make review of pure code movement (in 2/9) easier. [PATCHv2 4/9] conf: support abstracted interface info in domain interface XML [PATCHv2 5/9] conf: support abstracted interface info in network XML These two were 06/10 and 07/10 in v1: https://www.redhat.com/archives/libvir-list/2011-July/msg00155.html https://www.redhat.com/archives/libvir-list/2011-July/msg00156.html However, they were split differently. In v1 it was split into RNG changes vs. parser changes with network and domain combined in each patch. In v2, I reorganized (based on Dan's advice) to have one patch containing all domain XML changes, from RNG up through parser, test cases, and documentation, and one patch for network XML changes. [PATCHv2 6/9] network: separate Start/Shutdown functions for new network types This was patch 08/10 in v1: https://www.redhat.com/archives/libvir-list/2011-July/msg00157.html It is unchanged from the original. [PATCHv2 7/9] qemu: use virDomainNetGetActual*() functions where appropriate [PATCHv2 8/9] qemu: use virDomainNetGetActual*() in qemuDomainXMLToNative These two were patch 09/10 in v1: https://www.redhat.com/archives/libvir-list/2011-July/msg00158.html In v2, I just split out one piece of code that was more complicated than just replacing direct data references with helper functions, and modified the commit message to be more clear about the "NOP" nature of the change. [PATCHv2 9/9] network: internal API functions to manage assignment of physdev to guest This was 10/10 in v1: https://www.redhat.com/archives/libvir-list/2011-July/msg00159.html The main modification here was to remove all of the #if WITH_NETWORK from qemu_*.c, and instead define static inline NOP functions for the functions I'd previously eliminated references to with #if WITH_NETWORK (in the case that libvirt is build --without-network). This works out very well, except that make syntax-check doesn't like ATTRIBUTE_UNUSED in the inline static functions (I think we should change syntax-check rather than going back to the old #if WITH_NETWORK). Comments about other changes I've made *within* each patch are in the responses to the original patches, as well as in the annotations to the new patches.

3 24