- Devel - libvirt List Archives

[libvirt] [PATCH] docs: silence warnings about generated API docs
by Eric Blake 09 Mar '11

09 Mar '11

I noticed these while testing 'make dist'. Parsing ./../src/util/event.c Function comment for virEventRegisterDefaultImpl lacks description of return value Function comment for virEventRunDefaultImpl lacks description of return value Parsing ./../src/util/virterror.c Missing comment for function virSetErrorLogPriorityFunc * src/util/event.c (virEventRegisterDefaultImpl) (virEventRunDefaultImpl): Document return types. * src/util/virterror.c (virSetErrorLogPriorityFunc): Provide docs. --- Enough material that I thought I'd wait for an ack. src/util/event.c | 6 +++++- src/util/virterror.c | 8 +++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/src/util/event.c b/src/util/event.c index 0d88b55..bc0129c 100644 --- a/src/util/event.c +++ b/src/util/event.c @@ -1,8 +1,8 @@ /* * event.c: event loop for monitoring file handles * + * Copyright (C) 2007, 2011 Red Hat, Inc. * Copyright (C) 2007 Daniel P. Berrange - * Copyright (C) 2007 Red Hat, Inc. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -140,6 +140,8 @@ void virEventRegisterImpl(virEventAddHandleFunc addHandle, * Once registered, the application can invoke * virEventRunDefaultImpl in a loop to process * events + * + * Returns 0 on success, -1 on failure. */ int virEventRegisterDefaultImpl(void) { @@ -178,6 +180,8 @@ int virEventRegisterDefaultImpl(void) * if (virEventRunDefaultImpl() < 0) * ...print error... * } + * + * Returns 0 on success, -1 on failure. */ int virEventRunDefaultImpl(void) { diff --git a/src/util/virterror.c b/src/util/virterror.c index aaa3720..f136054 100644 --- a/src/util/virterror.c +++ b/src/util/virterror.c @@ -1,7 +1,7 @@ /* * virterror.c: implements error handling and reporting code for libvirt * - * Copy: Copyright (C) 2006, 2008-2010 Red Hat, Inc. + * Copy: Copyright (C) 2006, 2008-2011 Red Hat, Inc. * * See COPYING.LIB for the License of this software * @@ -1344,6 +1344,12 @@ void virReportOOMErrorFull(int domcode, virerr, NULL, NULL, -1, -1, virerr, NULL); } +/** + * virSetErrorLogPriorityFunc: + * @func: function to install + * + * Install a function used to filter error logging based on error priority. + */ void virSetErrorLogPriorityFunc(virErrorLogPriorityFunc func) { virErrorLogPriorityFilter = func; -- 1.7.4

2 2

[libvirt] [PATCH] Add XML config switch to enable/disable vhost-net support
by Laine Stump 09 Mar '11

09 Mar '11

This patch is in response to https://bugzilla.redhat.com/show_bug.cgi?id=643050 The existing libvirt support for the vhost-net backend to the virtio network driver happens automatically - if the vhost-net device is available, it is always enabled, otherwise the standard userland virtio backend is used. This patch makes it possible to force whether or not vhost-net is used with a bit of XML. Adding a <driver> element to the interface XML, eg: <interface type="network"> <model type="virtio"/> <driver name="vhost"/> will force use of vhost-net (if it's not available, the domain will fail to start). if driver name="qemu", vhost-net will not be used even if it is available. If there is no <driver name='xxx'/> in the config, libvirt will revert to the pre-existing automatic behavior - use vhost-net if it's available, and userland backend if vhost-net isn't available. --- Note that I don't really like the "name='vhost|qemu'" nomenclature, but am including it here just to get the patches on the list. I could live with it this way, or with any of the following (anyone have a strong opinion?) (note that in all cases, nothing specified means "try to use vhost, but fallback to userland if necessary") vhost='on|off' vhost='required|disabled' mode='vhost|qemu' mode='kernel|user' backend='kernel|user' (So far the strongest opinion has been for the current "name='vhost|qemu'") Oh, and also - sorry Eric, but I didn't have the brain cells left tonight to add this new bit to the documentation, and I really want to get the patch up/in now, so that will have to wait for a followup next week :-) docs/schemas/domain.rng | 13 ++++++++ src/conf/domain_conf.c | 27 +++++++++++++++++- src/conf/domain_conf.h | 10 ++++++ src/qemu/qemu_command.c | 71 +++++++++++++++++++++++++++++++++++++++-------- src/qemu/qemu_command.h | 3 -- 5 files changed, 108 insertions(+), 16 deletions(-) diff --git a/docs/schemas/domain.rng b/docs/schemas/domain.rng index a524e4b..6d0654d 100644 --- a/docs/schemas/domain.rng +++ b/docs/schemas/domain.rng @@ -1005,6 +1005,19 @@ </element> </optional> <optional> + <element name="driver"> + <optional> + <attribute name="name"> + <choice> + <value>qemu</value> + <value>vhost</value> + </choice> + </attribute> + </optional> + <empty/> + </element> + </optional> + <optional> <ref name="address"/> </optional> <optional> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index b4df38c..04ed502 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -184,6 +184,10 @@ VIR_ENUM_IMPL(virDomainNet, VIR_DOMAIN_NET_TYPE_LAST, "internal", "direct") +VIR_ENUM_IMPL(virDomainNetBackend, VIR_DOMAIN_NET_BACKEND_TYPE_LAST, + "qemu", + "vhost") + VIR_ENUM_IMPL(virDomainChrChannelTarget, VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_LAST, "guestfwd", @@ -2289,6 +2293,7 @@ virDomainNetDefParseXML(virCapsPtr caps, char *address = NULL; char *port = NULL; char *model = NULL; + char *backend = NULL; char *filter = NULL; char *internal = NULL; char *devaddr = NULL; @@ -2371,6 +2376,8 @@ virDomainNetDefParseXML(virCapsPtr caps, script = virXMLPropString(cur, "path"); } else if (xmlStrEqual (cur->name, BAD_CAST "model")) { model = virXMLPropString(cur, "type"); + } else if (xmlStrEqual (cur->name, BAD_CAST "driver")) { + backend = virXMLPropString(cur, "name"); } else if (xmlStrEqual (cur->name, BAD_CAST "filterref")) { filter = virXMLPropString(cur, "filter"); VIR_FREE(filterparams); @@ -2558,6 +2565,18 @@ virDomainNetDefParseXML(virCapsPtr caps, model = NULL; } + if ((backend != NULL) && + (def->model && STREQ(def->model, "virtio"))) { + int b; + if ((b = virDomainNetBackendTypeFromString(backend)) < 0) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("Unkown interface <driver name='%s'> has been specified"), + backend); + goto error; + } + def->backend = b; + def->backend_specified = 1; + } if (filter != NULL) { switch (def->type) { case VIR_DOMAIN_NET_TYPE_ETHERNET: @@ -2584,6 +2603,7 @@ cleanup: VIR_FREE(script); VIR_FREE(bridge); VIR_FREE(model); + VIR_FREE(backend); VIR_FREE(filter); VIR_FREE(type); VIR_FREE(internal); @@ -6275,9 +6295,14 @@ virDomainNetDefFormat(virBufferPtr buf, if (def->ifname) virBufferEscapeString(buf, " <target dev='%s'/>\n", def->ifname); - if (def->model) + if (def->model) { virBufferEscapeString(buf, " <model type='%s'/>\n", def->model); + if (STREQ(def->model, "virtio") && def->backend_specified) { + virBufferVSprintf(buf, " <driver name='%s'/>\n", + virDomainNetBackendTypeToString(def->backend)); + } + } if (def->filter) { virBufferEscapeString(buf, " <filterref filter='%s'", def->filter); diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index a459a22..451ccad 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -292,6 +292,13 @@ enum virDomainNetType { VIR_DOMAIN_NET_TYPE_LAST, }; +/* the backend driver used for virtio interfaces */ +enum virDomainNetBackendType { + VIR_DOMAIN_NET_BACKEND_TYPE_QEMU, /* userland */ + VIR_DOMAIN_NET_BACKEND_TYPE_VHOST, /* kernel */ + + VIR_DOMAIN_NET_BACKEND_TYPE_LAST, +}; /* the mode type for macvtap devices */ enum virDomainNetdevMacvtapType { @@ -310,6 +317,8 @@ struct _virDomainNetDef { enum virDomainNetType type; unsigned char mac[VIR_MAC_BUFLEN]; char *model; + enum virDomainNetBackendType backend; + int backend_specified : 1; union { struct { char *dev; @@ -1264,6 +1273,7 @@ VIR_ENUM_DECL(virDomainControllerModel) VIR_ENUM_DECL(virDomainFS) VIR_ENUM_DECL(virDomainFSAccessMode) VIR_ENUM_DECL(virDomainNet) +VIR_ENUM_DECL(virDomainNetBackend) VIR_ENUM_DECL(virDomainChrDevice) VIR_ENUM_DECL(virDomainChrChannelTarget) VIR_ENUM_DECL(virDomainChrConsoleTarget) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 86c5bb5..9eb54a1 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -302,24 +302,61 @@ cleanup: } -int +static int qemuOpenVhostNet(virDomainNetDefPtr net, - unsigned long long qemuCmdFlags) + unsigned long long qemuCmdFlags, + int *vhostfd) { - /* If qemu supports vhost-net mode (including the -netdev command - * option), the nic model is virtio, and we can open - * /dev/vhost_net, assume that vhost-net mode is available and - * return the fd to /dev/vhost_net. Otherwise, return -1. - */ + *vhostfd = -1; /* assume we won't use vhost */ + /* If the config says explicitly to not use vhost, return now */ + if (net->backend_specified && + (net->backend == VIR_DOMAIN_NET_BACKEND_TYPE_QEMU)) { + return 0; + } + + /* If qemu doesn't support vhost-net mode (including the -netdev command + * option), don't try to open the device. + */ if (!(qemuCmdFlags & QEMUD_CMD_FLAG_VNET_HOST && qemuCmdFlags & QEMUD_CMD_FLAG_NETDEV && - qemuCmdFlags & QEMUD_CMD_FLAG_DEVICE && - net->model && STREQ(net->model, "virtio"))) - return -1; + qemuCmdFlags & QEMUD_CMD_FLAG_DEVICE)) { + if (net->backend_specified && + (net->backend == VIR_DOMAIN_NET_BACKEND_TYPE_VHOST)) { + qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, + "%s", _("vhost-net is not supported with " + "this QEMU binary")); + return -1; + } + return 0; + } - return open("/dev/vhost-net", O_RDWR, 0); + /* If the nic model isn't virtio, don't try to open. */ + if (!(net->model && STREQ(net->model, "virtio"))) { + if (net->backend_specified && + (net->backend == VIR_DOMAIN_NET_BACKEND_TYPE_VHOST)) { + qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, + "%s", _("vhost-net is only supported for " + "virtio network interfaces")); + return -1; + } + return 0; + } + + *vhostfd = open("/dev/vhost-net", O_RDWR, 0); + + /* If the config says explicitly to use vhost and we couldn't open it, + * report an error. + */ + if ((*vhostfd < 0) && net->backend_specified && + (net->backend == VIR_DOMAIN_NET_BACKEND_TYPE_VHOST)) { + qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, + "%s", _("vhost-net was requested for an interface, " + "but is unavailable")); + return -1; + } + return 0; } @@ -3278,7 +3315,10 @@ qemuBuildCommandLine(virConnectPtr conn, net->type == VIR_DOMAIN_NET_TYPE_DIRECT) { /* Attempt to use vhost-net mode for these types of network device */ - int vhostfd = qemuOpenVhostNet(net, qemuCmdFlags); + int vhostfd; + + if (qemuOpenVhostNet(net, qemuCmdFlags, &vhostfd) < 0) + goto error; if (vhostfd >= 0) { virCommandTransferFD(cmd, vhostfd); @@ -4618,6 +4658,13 @@ qemuParseCommandLineNet(virCapsPtr caps, } else if (STREQ(keywords[i], "model")) { def->model = values[i]; values[i] = NULL; + } else if (STREQ(keywords[i], "vhost")) { + if ((values[i] == NULL) || STREQ(values[i], "on")) { + def->backend = VIR_DOMAIN_NET_BACKEND_TYPE_VHOST; + } else if (STREQ(keywords[i], "off")) { + def->backend = VIR_DOMAIN_NET_BACKEND_TYPE_QEMU; + } + def->backend_specified = 1; } } diff --git a/src/qemu/qemu_command.h b/src/qemu/qemu_command.h index 4c42a10..5439184 100644 --- a/src/qemu/qemu_command.h +++ b/src/qemu/qemu_command.h @@ -116,9 +116,6 @@ int qemuNetworkIfaceConnect(virConnectPtr conn, unsigned long long qemCmdFlags) ATTRIBUTE_NONNULL(1); -int qemuOpenVhostNet(virDomainNetDefPtr net, - unsigned long long qemuCmdFlags); - int qemuPhysIfaceConnect(virConnectPtr conn, struct qemud_driver *driver, virDomainNetDefPtr net, -- 1.7.3.4

4 8

[libvirt] [PATCH 2/2] Make sure the rundir is accessible by the user
by Guido Günther 09 Mar '11

09 Mar '11

otherwise the user might not have enough permissions to access the socket if roots umask is 077. http://bugs.debian.org/614210 --- daemon/libvirtd.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index 610e7fd..a968e05 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -3156,7 +3156,9 @@ static int create_rundir (void) { const char *rundir = LOCALSTATEDIR "/run/libvirt"; int ret = 0; + mode_t old_umask; + old_umask = umask(022); if (mkdir (rundir, 0755)) { if (errno != EEXIST) { char ebuf[1024]; @@ -3165,6 +3167,7 @@ static int create_rundir (void) ret = VIR_DAEMON_ERR_RUNDIR; } } + umask(old_umask); return ret; } -- 1.7.4.1

2 3

[libvirt] [PATCH] storage: replace the deprecated option of qemu-img.
by Osier Yang 09 Mar '11

09 Mar '11

qemu-img silently disable "-e", so we can't use it for volume encryption anymore, change it into "-o encryption=on". I'm afraid of it will inroduce compatibility problem for older qemu without "-o" option, but "-o" option is already used in the codes, seems it's fine. * src/storage/storage_backend.c --- src/storage/storage_backend.c | 17 +++++++++++------ 1 files changed, 11 insertions(+), 6 deletions(-) diff --git a/src/storage/storage_backend.c b/src/storage/storage_backend.c index 2eede74..c381444 100644 --- a/src/storage/storage_backend.c +++ b/src/storage/storage_backend.c @@ -778,7 +778,7 @@ virStorageBackendCreateQemuImg(virConnectPtr conn, imgargv[8] = vol->target.path; imgargv[9] = size; if (vol->target.encryption != NULL) - imgargv[10] = "-e"; + imgargv[10] = "-o encryption=on"; break; case QEMU_IMG_BACKING_FORMAT_OPTIONS: @@ -786,13 +786,18 @@ virStorageBackendCreateQemuImg(virConnectPtr conn, virReportOOMError(); goto cleanup; } + + if (vol->target.encryption != NULL) { + if (virAsprintf(&optflag, ",encryption=on") < 0) { + virReportOOMError(); + goto cleanup; + } + } + imgargv[6] = "-o"; imgargv[7] = optflag; imgargv[8] = vol->target.path; imgargv[9] = size; - if (vol->target.encryption != NULL) - imgargv[10] = "-e"; - break; default: VIR_INFO("Unable to set backing store format for %s with %s", @@ -800,7 +805,7 @@ virStorageBackendCreateQemuImg(virConnectPtr conn, imgargv[6] = vol->target.path; imgargv[7] = size; if (vol->target.encryption != NULL) - imgargv[8] = "-e"; + imgargv[8] = "-o encryption=on"; } ret = virStorageBackendCreateExecCommand(pool, vol, imgargv); @@ -817,7 +822,7 @@ virStorageBackendCreateQemuImg(virConnectPtr conn, NULL }; if (vol->target.encryption != NULL) - imgargv[6] = "-e"; + imgargv[6] = "-o encryption=on"; ret = virStorageBackendCreateExecCommand(pool, vol, imgargv); } -- 1.7.4

3 4

[libvirt] [PATCH] docs: correct range of default NAT subnet
by Eric Blake 09 Mar '11

09 Mar '11

* docs/formatdomain.html.in: Fix typo. --- Pushing under the trivial rule. docs/formatdomain.html.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 9b9ab29..8b6e5e4 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -1145,7 +1145,7 @@ network config with '<code>virsh net-dumpxml [networkname]</code>'. There is one virtual network called 'default' setup out of the box which does NAT'ing to the default route and has an IP range of - <code>192.168.22.0/255.255.255.0</code>. Each guest will have an + <code>192.168.122.0/255.255.255.0</code>. Each guest will have an associated tun device created with a name of vnetN, which can also be overridden with the <target> element (see <a href="#elementsNICSTargetOverride">overriding the target element</a>). -- 1.7.4

2 1

[libvirt] [PATCH 2/2] libvirtd: Remove indirect linking
by Guido Günther 09 Mar '11

09 Mar '11

as described at http://wiki.debian.org/ToolChain/DSOLinking https://fedoraproject.org/wiki/UnderstandingDSOLinkChange otherwise the build fails on current Debian unstable with: CCLD libvirtd /usr/bin/ld: ../src/.libs/libvirt_driver_lxc.a(libvirt_driver_lxc_la-lxc_container.o): undefined reference to symbol 'capng_apply' /usr/bin/ld: note: 'capng_apply' is defined in DSO //usr/lib/libcap-ng.so.0 so try adding it to the linker command line CCLD libvirtd /usr/bin/ld: ../src/.libs/libvirt_driver_storage.a(libvirt_driver_storage_la-storage_backend.o): undefined reference to symbol 'fgetfilecon' /usr/bin/ld: note: 'fgetfilecon' is defined in DSO //lib/libselinux.so.1 so try adding it to the linker command line //lib/libselinux.so.1: could not read symbols: Invalid operation O.k. to apply? Cheers, -- Guido --- daemon/Makefile.am | 10 +++++++++- 1 files changed, 9 insertions(+), 1 deletions(-) diff --git a/daemon/Makefile.am b/daemon/Makefile.am index 912440c..2083084 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -145,7 +145,15 @@ if WITH_NWFILTER endif endif -libvirtd_LDADD += ../src/libvirt.la +if WITH_SECDRIVER_SELINUX + libvirtd_LDADD += $(SELINUX_LIBS) +endif +if WITH_SECDRIVER_APPARMOR + libvirtd_LDADD += $(APPARMOR_LIBS) +endif + +libvirtd_LDADD += ../src/libvirt.la \ + $(CAPNG_LIBS) if HAVE_POLKIT if HAVE_POLKIT0 -- 1.7.4.1

2 4

[libvirt] [libvirt-snmp][PATCH] configure.ac: lower required minimal version of autoconf
by Michal Privoznik 09 Mar '11

09 Mar '11

so we can build even on rhel 5.6 where the original version is not yet. --- configure.ac | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/configure.ac b/configure.ac index 468fb07..dcab0ae 100644 --- a/configure.ac +++ b/configure.ac @@ -2,7 +2,7 @@ AC_INIT([libvirt-snmp],[0.0.1],[libvir-list@redhat.com],[],[http://libvirt.org]) AM_INIT_AUTOMAKE([-Wall -Werror]) AC_CONFIG_HEADERS([config.h]) -AC_PREREQ([2.66]) +AC_PREREQ([2.50]) AC_CHECK_FUNCS([memset]) AC_CHECK_FUNCS([strdup]) AC_CHECK_HEADERS([stdlib.h]) -- 1.7.4

3 2

[libvirt] (no subject)
by Guido Günther 09 Mar '11

09 Mar '11

>From 4a3765d97c3f5049aa294a4b7b629eabfd9cf04d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Guido=20G=C3=BCnther?= <agx(a)sigxcpu.org> Date: Mon, 7 Mar 2011 22:22:36 +0100 Subject: [PATCH 1/2] Move rundir creation into separate function --- daemon/libvirtd.c | 31 ++++++++++++++++++++----------- 1 files changed, 20 insertions(+), 11 deletions(-) diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index 452566c..610e7fd 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -3150,6 +3150,24 @@ enum { OPT_VERSION = 129 }; + +/* Ensure the rundir exists (on tmpfs on some systems) */ +static int create_rundir (void) +{ + const char *rundir = LOCALSTATEDIR "/run/libvirt"; + int ret = 0; + + if (mkdir (rundir, 0755)) { + if (errno != EEXIST) { + char ebuf[1024]; + VIR_ERROR(_("unable to create rundir %s: %s"), rundir, + virStrerror(errno, ebuf, sizeof(ebuf))); + ret = VIR_DAEMON_ERR_RUNDIR; + } + } + return ret; +} + #define MAX_LISTEN 5 int main(int argc, char **argv) { struct qemud_server *server = NULL; @@ -3276,17 +3294,8 @@ int main(int argc, char **argv) { /* Ensure the rundir exists (on tmpfs on some systems) */ if (geteuid() == 0) { - const char *rundir = LOCALSTATEDIR "/run/libvirt"; - - if (mkdir (rundir, 0755)) { - if (errno != EEXIST) { - char ebuf[1024]; - VIR_ERROR(_("unable to create rundir %s: %s"), rundir, - virStrerror(errno, ebuf, sizeof(ebuf))); - ret = VIR_DAEMON_ERR_RUNDIR; - goto error; - } - } + if (create_rundir ()) + goto error; } /* Beyond this point, nothing should rely on using -- 1.7.4.1

2 2

[libvirt] [PATCH] Fix a wrong error message threw to user.
by Hu Tao 09 Mar '11

09 Mar '11

--- src/qemu/qemu_driver.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 0f7cbad..f26b1ef 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -4209,8 +4209,8 @@ static int qemuDomainUpdateDeviceFlags(virDomainPtr dom, default: qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, - _("disk device type '%s' cannot be updated"), - virDomainDiskDeviceTypeToString(dev->data.disk->device)); + _("device type '%s' cannot be updated"), + virDomainDeviceTypeToString(dev->type)); break; } -- 1.7.3.1

2 1

[libvirt] [PATCH] security: ignore disk opening failure of DAC driver.
by Osier Yang 09 Mar '11

09 Mar '11

Which blocks the domain booting up if one of the disks can't be opened (e.g. doesn't exist). --- src/security/security_dac.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index fba2d1d..8bb5bc9 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -182,7 +182,7 @@ virSecurityDACSetSecurityImageLabel(virSecurityManagerPtr mgr, return virDomainDiskDefForeachPath(disk, virSecurityManagerGetAllowDiskFormatProbing(mgr), - false, + true, virSecurityDACSetSecurityFileLabel, mgr); } -- 1.7.4

2 1

[libvirt] [PATCH] dynamic_ownership documentation
by Stephan Mueller 09 Mar '11

09 Mar '11

Hi, I would like to propose the following patch for the libvirtd.conf file to document sVirt and its usage. If you have suggestions to add better wording, please let me know. (If you reply with comments, could you please CC me as I am not on the list.) Ciao Stephan --- diff --git a/cc-config/cc/libvirtd.conf b/cc-config/cc/libvirtd.conf index 43e19d8..a9acc21 100644 --- a/cc-config/cc/libvirtd.conf +++ b/cc-config/cc/libvirtd.conf @@ -154,7 +154,52 @@ auth_unix_rw = "none" # mechanism as well, by using 'sasl' for this option #auth_tls = "none" - +################################################################# +# +# sVirt protection mechanisms +# +# The following options specify the separation of virtual machines +# based on SELinux categories. As virtual machines execute with the +# same user ID, an additional separation functionality is necessary +# to prevent different virtual machines from interfering with each other +# in case the simulation environment provided with QEMU is +# successfully broken by a rogue guest. +# +# The sVirt protection mechanism implements two modes of operation: +# dynamic assignment of SELinux categories +# static assignment of SELinux labels +# +# A dynamic assignment of categories implies that libvirt generates +# a unique SELinux category that the virtual machine and its resources +# are assigned to during the instantiation of the virtual machine. +# SELinux ensures that each virtual machine can only access resources +# labeled with the same category as the virtual machine itself. +# +# A static assignment of SELinux labels imply that the administrator +# manually configures the SELinux label of the virtual machine in +# /etc/libvirt/qemu/<VM-DESCRIPTOR> based on the following example: +# +# <seclabel model='selinux' type="static"> +# <label>system_u:system_r:qemu_t:s0:c210.c502</label> +# </seclabel> +# +# The <label> tag specifies a full SELinux label the virtual machine +# will be executed with. +# +# In addition to the setting of the SELinux label of the virtual +# machine, the administrator must manually set the SELinux label +# of all resources the virtual machine accesses appropriately. +# +# NOTE: The dynamic assignment of categories is only intended for +# systems with the targeted SELinux policy. Systems with the MLS +# SELinux policy MUST use the static assignment of labels. +# It is possible that static assignment is configured for +# systems with the targeted policy as well. +# +# dynamic_ownership: 0 == static assignment of SELinux labels +# 1 == dynamic assignment of SELinux labels +dynamic_ownership=1 +#

3 4

[libvirt] how to install 'devel' module from source files...
by john alexander sanabria ordonez 09 Mar '11

09 Mar '11

Hi, I'm wondering how, when libvirt is installed from sources, to also install the 'development' files? I installed libvirt-0.8.8 with no problems and 'virsh' works OK. However, when I try to install, for instance libvirt-ruby, it asks me for libvirt development files. What extra step is required? Thanks,

2 1

[libvirt] [PATCH 1/2] build: fix build on cygwin
by Eric Blake 09 Mar '11

09 Mar '11

On cygwin: CC libvirt_util_la-cgroup.lo util/cgroup.c: In function 'virCgroupKillRecursiveInternal': util/cgroup.c:1458: warning: implicit declaration of function 'virCgroupNew' [-Wimplicit-function-declaration] * src/util/cgroup.c (virCgroupKill): Don't build on platforms where virCgroupNew is unsupported. --- Pushing under the build-breaker rule. And this time, it really was a cygwin failure ;) src/util/cgroup.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/util/cgroup.c b/src/util/cgroup.c index c5b8cdd..8551acd 100644 --- a/src/util/cgroup.c +++ b/src/util/cgroup.c @@ -1308,7 +1308,7 @@ int virCgroupGetFreezerState(virCgroupPtr group, char **state) } -#ifdef HAVE_KILL +#if defined HAVE_KILL && defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R static int virCgroupKillInternal(virCgroupPtr group, int signum, virHashTablePtr pids) { int rc; @@ -1523,7 +1523,7 @@ int virCgroupKillPainfully(virCgroupPtr group) return rc; } -#else /* HAVE_KILL */ +#else /* !(HAVE_KILL, HAVE_MNTENT_H, HAVE_GETMNTENT_R) */ int virCgroupKill(virCgroupPtr group ATTRIBUTE_UNUSED, int signum ATTRIBUTE_UNUSED) { @@ -1539,4 +1539,4 @@ int virCgroupKillPainfully(virCgroupPtr group ATTRIBUTE_UNUSED) { return -ENOSYS; } -#endif /* HAVE_KILL */ +#endif /* HAVE_KILL, HAVE_MNTENT_H, HAVE_GETMNTENT_R */ -- 1.7.4

1 1

[libvirt] [PATCH] build: fix building error when building without libvirtd
by Wen Congyang 09 Mar '11

09 Mar '11

When building libvirt without libvirtd, I receive the following errors: make[1]: Leaving directory `/home/wency/source/test/libvirt/src' (cd daemon && make top_distdir=../libvirt-0.8.8 distdir=../libvirt-0.8.8/daemon \ am__remove_distdir=: am__skip_length_check=: am__skip_mode_fix=: distdir) make[1]: Entering directory `/home/wency/source/test/libvirt/daemon' make[1]: *** No rule to make target `libvirtd.8.in', needed by `distdir'. Stop. make[1]: Leaving directory `/home/wency/source/test/libvirt/daemon' make: *** [distdir] Error 1 This bug was caused by commit 6db98a2d. Signed-off-by: Wen Congyang <wency(a)cn.fujitsu.com> --- daemon/Makefile.am | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/daemon/Makefile.am b/daemon/Makefile.am index 912440c..b4880a9 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -38,7 +38,6 @@ EXTRA_DIST = \ test_libvirtd.aug \ THREADING.txt \ libvirtd.pod.in \ - libvirtd.8.in \ libvirtd.stp \ $(AVAHI_SOURCES) \ $(DAEMON_SOURCES) @@ -47,6 +46,8 @@ BUILT_SOURCES = if WITH_LIBVIRTD +EXTRA_DIST += libvirtd.8.in + man8_MANS = libvirtd.8 sbin_PROGRAMS = libvirtd -- 1.7.1

2 3

[libvirt] [RFC PATCH] cgroup: allow fine-tuning of device ACL permissions
by Eric Blake 09 Mar '11

09 Mar '11

Adding audit points showed that we were granting too much privilege to qemu; it should not need any mknod rights to recreate any devices other than ptys. On the other hand, lxc should have all device privileges. The solution is adding a flag parameter. * src/util/cgroup.h (virCgroup*Device*): Adjust prototypes. * src/util/cgroup.c (virCgroupAllowDevice) (virCgroupAllowDeviceMajor, virCgroupAllowDevicePath) (virCgroupDenyDevice, virCgroupDenyDeviceMajor) (virCgroupDenyDevicePath): Add parameter. * src/qemu/qemu_cgroup.c: Update clients. * src/qemu/qemu_driver.c (qemudDomainSaveFlag): Likewise. * src/lxc/lxc_controller.c (lxcSetContainerResources): Likewise. --- https://bugzilla.redhat.com/show_bug.cgi?id=683163 was created based on my audit patches. RFC for two reasons: This patch won't apply unless you have my other pending qemu audit patches in place (I still need to post those, but ran out of time for now...) I need to do a followup patch to also restrict write access to a disk explicitly marked read-only from qemu's point of view. But I wanted to at least get this email posted to start feedback. src/lxc/lxc_controller.c | 9 +++++-- src/qemu/qemu_cgroup.c | 23 +++++++++++------- src/qemu/qemu_driver.c | 9 +++++-- src/util/cgroup.c | 55 +++++++++++++++++++++++++++++++++------------ src/util/cgroup.h | 26 ++++++++++++++++----- 5 files changed, 86 insertions(+), 36 deletions(-) diff --git a/src/lxc/lxc_controller.c b/src/lxc/lxc_controller.c index d2b113c..296b302 100644 --- a/src/lxc/lxc_controller.c +++ b/src/lxc/lxc_controller.c @@ -1,5 +1,6 @@ /* - * Copyright (C) 2010 Red Hat, Inc. Copyright IBM Corp. 2008 + * Copyright (C) 2010-2011 Red Hat, Inc. + * Copyright IBM Corp. 2008 * * lxc_controller.c: linux container process controller * @@ -168,7 +169,8 @@ static int lxcSetContainerResources(virDomainDefPtr def) rc = virCgroupAllowDevice(cgroup, dev->type, dev->major, - dev->minor); + dev->minor, + VIR_CGROUP_DEVICE_RWM); if (rc != 0) { virReportSystemError(-rc, _("Unable to allow device %c:%d:%d for domain %s"), @@ -177,7 +179,8 @@ static int lxcSetContainerResources(virDomainDefPtr def) } } - rc = virCgroupAllowDeviceMajor(cgroup, 'c', LXC_DEV_MAJ_PTY); + rc = virCgroupAllowDeviceMajor(cgroup, 'c', LXC_DEV_MAJ_PTY, + VIR_CGROUP_DEVICE_RWM); if (rc != 0) { virReportSystemError(-rc, _("Unable to allow PYT devices for domain %s"), diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c index ebf9ad5..3c124fd 100644 --- a/src/qemu/qemu_cgroup.c +++ b/src/qemu/qemu_cgroup.c @@ -66,7 +66,8 @@ qemuSetupDiskPathAllow(virDomainDiskDefPtr disk ATTRIBUTE_UNUSED, VIR_DEBUG("Process path %s for disk", path); /* XXX RO vs RW */ - rc = virCgroupAllowDevicePath(data->cgroup, path); + rc = virCgroupAllowDevicePath(data->cgroup, path, + VIR_CGROUP_DEVICE_RW); qemuAuditCgroupPath(data->vm, data->cgroup, "allow", path, rc); if (rc < 0) { if (rc == -EACCES) { /* Get this for root squash NFS */ @@ -106,8 +107,8 @@ qemuTeardownDiskPathDeny(virDomainDiskDefPtr disk ATTRIBUTE_UNUSED, int rc; VIR_DEBUG("Process path %s for disk", path); - /* XXX RO vs RW */ - rc = virCgroupDenyDevicePath(data->cgroup, path); + rc = virCgroupDenyDevicePath(data->cgroup, path, + VIR_CGROUP_DEVICE_RWM); qemuAuditCgroupPath(data->vm, data->cgroup, "deny", path, rc); if (rc < 0) { if (rc == -EACCES) { /* Get this for root squash NFS */ @@ -150,7 +151,8 @@ qemuSetupChardevCgroup(virDomainDefPtr def, VIR_DEBUG("Process path '%s' for disk", dev->source.data.file.path); - rc = virCgroupAllowDevicePath(data->cgroup, dev->source.data.file.path); + rc = virCgroupAllowDevicePath(data->cgroup, dev->source.data.file.path, + VIR_CGROUP_DEVICE_RW); qemuAuditCgroupPath(data->vm, data->cgroup, "allow", dev->source.data.file.path, rc); if (rc < 0) { @@ -172,7 +174,8 @@ int qemuSetupHostUsbDeviceCgroup(usbDevice *dev ATTRIBUTE_UNUSED, int rc; VIR_DEBUG("Process path '%s' for USB device", path); - rc = virCgroupAllowDevicePath(data->cgroup, path); + rc = virCgroupAllowDevicePath(data->cgroup, path, + VIR_CGROUP_DEVICE_RW); qemuAuditCgroupPath(data->vm, data->cgroup, "allow", path, rc); if (rc < 0) { virReportSystemError(-rc, @@ -226,7 +229,8 @@ int qemuSetupCgroup(struct qemud_driver *driver, goto cleanup; } - rc = virCgroupAllowDeviceMajor(cgroup, 'c', DEVICE_PTY_MAJOR); + rc = virCgroupAllowDeviceMajor(cgroup, 'c', DEVICE_PTY_MAJOR, + VIR_CGROUP_DEVICE_RWM); qemuAuditCgroupMajor(vm, cgroup, "allow", DEVICE_PTY_MAJOR, "pty", rc == 0); if (rc != 0) { @@ -240,7 +244,8 @@ int qemuSetupCgroup(struct qemud_driver *driver, ((vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC && driver->vncAllowHostAudio) || (vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_SDL)))) { - rc = virCgroupAllowDeviceMajor(cgroup, 'c', DEVICE_SND_MAJOR); + rc = virCgroupAllowDeviceMajor(cgroup, 'c', DEVICE_SND_MAJOR, + VIR_CGROUP_DEVICE_RWM); qemuAuditCgroupMajor(vm, cgroup, "allow", DEVICE_SND_MAJOR, "sound", rc == 0); if (rc != 0) { @@ -251,8 +256,8 @@ int qemuSetupCgroup(struct qemud_driver *driver, } for (i = 0; deviceACL[i] != NULL ; i++) { - rc = virCgroupAllowDevicePath(cgroup, - deviceACL[i]); + rc = virCgroupAllowDevicePath(cgroup, deviceACL[i], + VIR_CGROUP_DEVICE_RW); qemuAuditCgroupPath(vm, cgroup, "allow", deviceACL[i], rc); if (rc < 0 && rc != -ENOENT) { diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 1981cdf..7b4edc5 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -1962,7 +1962,8 @@ static int qemudDomainSaveFlag(struct qemud_driver *driver, virDomainPtr dom, vm->def->name); goto endjob; } - rc = virCgroupAllowDevicePath(cgroup, path); + rc = virCgroupAllowDevicePath(cgroup, path, + VIR_CGROUP_DEVICE_RW); qemuAuditCgroupPath(vm, cgroup, "allow", path, rc); if (rc < 0) { virReportSystemError(-rc, @@ -2012,7 +2013,8 @@ static int qemudDomainSaveFlag(struct qemud_driver *driver, virDomainPtr dom, VIR_WARN("failed to restore save state label on %s", path); if (cgroup != NULL) { - rc = virCgroupDenyDevicePath(cgroup, path); + rc = virCgroupDenyDevicePath(cgroup, path, + VIR_CGROUP_DEVICE_RWM); qemuAuditCgroupPath(vm, cgroup, "deny", path, rc); if (rc < 0) VIR_WARN("Unable to deny device %s for %s %d", @@ -2044,7 +2046,8 @@ endjob: } if (cgroup != NULL) { - rc = virCgroupDenyDevicePath(cgroup, path); + rc = virCgroupDenyDevicePath(cgroup, path, + VIR_CGROUP_DEVICE_RWM); qemuAuditCgroupPath(vm, cgroup, "deny", path, rc); if (rc < 0) VIR_WARN("Unable to deny device %s for %s: %d", diff --git a/src/util/cgroup.c b/src/util/cgroup.c index a16b1ab..10e3143 100644 --- a/src/util/cgroup.c +++ b/src/util/cgroup.c @@ -1081,7 +1081,7 @@ int virCgroupGetSwapHardLimit(virCgroupPtr group, unsigned long long *kb) /** * virCgroupDenyAllDevices: * - * @group: The cgroup to deny devices for + * @group: The cgroup to deny all permissions, for all devices * * Returns: 0 on success */ @@ -1100,15 +1100,20 @@ int virCgroupDenyAllDevices(virCgroupPtr group) * @type: The device type (i.e., 'c' or 'b') * @major: The major number of the device * @minor: The minor number of the device + * @perms: Bitwise or of VIR_CGROUP_DEVICE permission bits to allow * * Returns: 0 on success */ -int virCgroupAllowDevice(virCgroupPtr group, char type, int major, int minor) +int virCgroupAllowDevice(virCgroupPtr group, char type, int major, int minor, + int perms) { int rc; char *devstr = NULL; - if (virAsprintf(&devstr, "%c %i:%i rwm", type, major, minor) == -1) { + if (virAsprintf(&devstr, "%c %i:%i %s%s%s", type, major, minor, + perms & VIR_CGROUP_DEVICE_READ ? "r" : "", + perms & VIR_CGROUP_DEVICE_WRITE ? "w" : "", + perms & VIR_CGROUP_DEVICE_MKNOD ? "m" : "") == -1) { rc = -ENOMEM; goto out; } @@ -1129,15 +1134,20 @@ out: * @group: The cgroup to allow an entire device major type for * @type: The device type (i.e., 'c' or 'b') * @major: The major number of the device type + * @perms: Bitwise or of VIR_CGROUP_DEVICE permission bits to allow * * Returns: 0 on success */ -int virCgroupAllowDeviceMajor(virCgroupPtr group, char type, int major) +int virCgroupAllowDeviceMajor(virCgroupPtr group, char type, int major, + int perms) { int rc; char *devstr = NULL; - if (virAsprintf(&devstr, "%c %i:* rwm", type, major) == -1) { + if (virAsprintf(&devstr, "%c %i:* %s%s%s", type, major, + perms & VIR_CGROUP_DEVICE_READ ? "r" : "", + perms & VIR_CGROUP_DEVICE_WRITE ? "w" : "", + perms & VIR_CGROUP_DEVICE_MKNOD ? "m" : "") == -1) { rc = -ENOMEM; goto out; } @@ -1157,6 +1167,7 @@ int virCgroupAllowDeviceMajor(virCgroupPtr group, char type, int major) * * @group: The cgroup to allow the device for * @path: the device to allow + * @perms: Bitwise or of VIR_CGROUP_DEVICE permission bits to allow * * Queries the type of device and its major/minor number, and * adds that to the cgroup ACL @@ -1165,7 +1176,7 @@ int virCgroupAllowDeviceMajor(virCgroupPtr group, char type, int major) * negative errno value on failure */ #if defined(major) && defined(minor) -int virCgroupAllowDevicePath(virCgroupPtr group, const char *path) +int virCgroupAllowDevicePath(virCgroupPtr group, const char *path, int perms) { struct stat sb; @@ -1178,11 +1189,13 @@ int virCgroupAllowDevicePath(virCgroupPtr group, const char *path) return virCgroupAllowDevice(group, S_ISCHR(sb.st_mode) ? 'c' : 'b', major(sb.st_rdev), - minor(sb.st_rdev)); + minor(sb.st_rdev), + perms); } #else int virCgroupAllowDevicePath(virCgroupPtr group ATTRIBUTE_UNUSED, - const char *path ATTRIBUTE_UNUSED) + const char *path ATTRIBUTE_UNUSED, + int perms ATTRIBUTE_UNUSED) { return -ENOSYS; } @@ -1196,15 +1209,20 @@ int virCgroupAllowDevicePath(virCgroupPtr group ATTRIBUTE_UNUSED, * @type: The device type (i.e., 'c' or 'b') * @major: The major number of the device * @minor: The minor number of the device + * @perms: Bitwise or of VIR_CGROUP_DEVICE permission bits to deny * * Returns: 0 on success */ -int virCgroupDenyDevice(virCgroupPtr group, char type, int major, int minor) +int virCgroupDenyDevice(virCgroupPtr group, char type, int major, int minor, + int perms) { int rc; char *devstr = NULL; - if (virAsprintf(&devstr, "%c %i:%i rwm", type, major, minor) == -1) { + if (virAsprintf(&devstr, "%c %i:%i %s%s%s", type, major, minor, + perms & VIR_CGROUP_DEVICE_READ ? "r" : "", + perms & VIR_CGROUP_DEVICE_WRITE ? "w" : "", + perms & VIR_CGROUP_DEVICE_MKNOD ? "m" : "") == -1) { rc = -ENOMEM; goto out; } @@ -1225,15 +1243,20 @@ out: * @group: The cgroup to deny an entire device major type for * @type: The device type (i.e., 'c' or 'b') * @major: The major number of the device type + * @perms: Bitwise or of VIR_CGROUP_DEVICE permission bits to deny * * Returns: 0 on success */ -int virCgroupDenyDeviceMajor(virCgroupPtr group, char type, int major) +int virCgroupDenyDeviceMajor(virCgroupPtr group, char type, int major, + int perms) { int rc; char *devstr = NULL; - if (virAsprintf(&devstr, "%c %i:* rwm", type, major) == -1) { + if (virAsprintf(&devstr, "%c %i:* %s%s%s", type, major, + perms & VIR_CGROUP_DEVICE_READ ? "r" : "", + perms & VIR_CGROUP_DEVICE_WRITE ? "w" : "", + perms & VIR_CGROUP_DEVICE_MKNOD ? "m" : "") == -1) { rc = -ENOMEM; goto out; } @@ -1249,7 +1272,7 @@ int virCgroupDenyDeviceMajor(virCgroupPtr group, char type, int major) } #if defined(major) && defined(minor) -int virCgroupDenyDevicePath(virCgroupPtr group, const char *path) +int virCgroupDenyDevicePath(virCgroupPtr group, const char *path, int perms) { struct stat sb; @@ -1262,11 +1285,13 @@ int virCgroupDenyDevicePath(virCgroupPtr group, const char *path) return virCgroupDenyDevice(group, S_ISCHR(sb.st_mode) ? 'c' : 'b', major(sb.st_rdev), - minor(sb.st_rdev)); + minor(sb.st_rdev), + perms); } #else int virCgroupDenyDevicePath(virCgroupPtr group ATTRIBUTE_UNUSED, - const char *path ATTRIBUTE_UNUSED) + const char *path ATTRIBUTE_UNUSED, + int perms ATTRIBUTE_UNUSED) { return -ENOSYS; } diff --git a/src/util/cgroup.h b/src/util/cgroup.h index b3c5f27..16ffb46 100644 --- a/src/util/cgroup.h +++ b/src/util/cgroup.h @@ -60,27 +60,41 @@ int virCgroupGetMemorySoftLimit(virCgroupPtr group, unsigned long long *kb); int virCgroupSetSwapHardLimit(virCgroupPtr group, unsigned long long kb); int virCgroupGetSwapHardLimit(virCgroupPtr group, unsigned long long *kb); +enum { + VIR_CGROUP_DEVICE_READ = 1, + VIR_CGROUP_DEVICE_WRITE = 2, + VIR_CGROUP_DEVICE_MKNOD = 4, + VIR_CGROUP_DEVICE_RW = VIR_CGROUP_DEVICE_READ | VIR_CGROUP_DEVICE_WRITE, + VIR_CGROUP_DEVICE_RWM = VIR_CGROUP_DEVICE_RW | VIR_CGROUP_DEVICE_MKNOD, +}; + int virCgroupDenyAllDevices(virCgroupPtr group); int virCgroupAllowDevice(virCgroupPtr group, char type, int major, - int minor); + int minor, + int perms); int virCgroupAllowDeviceMajor(virCgroupPtr group, char type, - int major); + int major, + int perms); int virCgroupAllowDevicePath(virCgroupPtr group, - const char *path); + const char *path, + int perms); int virCgroupDenyDevice(virCgroupPtr group, char type, int major, - int minor); + int minor, + int perms); int virCgroupDenyDeviceMajor(virCgroupPtr group, char type, - int major); + int major, + int perms); int virCgroupDenyDevicePath(virCgroupPtr group, - const char *path); + const char *path, + int perms); int virCgroupSetCpuShares(virCgroupPtr group, unsigned long long shares); int virCgroupGetCpuShares(virCgroupPtr group, unsigned long long *shares); -- 1.7.4

1 0

[libvirt] Fix cygwin build
by Daniel Veillard 09 Mar '11

09 Mar '11

In virLogEmergencyDumpAll I was using SIGBUS and SIGUSR2, and apparently they arent; defined on cygwin signal.h header. I decided to make the code conditional for all of them and not just those two for portability sake. I resisted doing this on the daemon side because as far as I know we don't compile it on WIN32. So I just pushed the following under the build breaking rule, Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

2 2

[libvirt] [PATCH 1/2] virsh: Remove indirect link against libxml2
by Guido Günther 08 Mar '11

08 Mar '11

as described at http://wiki.debian.org/ToolChain/DSOLinking https://fedoraproject.org/wiki/UnderstandingDSOLinkChange otherwise the build fails on current Debian unstable with: CCLD virsh /usr/bin/ld: virsh-virsh.o: undefined reference to symbol 'xmlSaveTree@@LIBXML2_2.6.8' /usr/bin/ld: note: 'xmlSaveTree@@LIBXML2_2.6.8' is defined in DSO //usr/lib/libxml2.so.2 so try adding it to the linker command line //usr/lib/libxml2.so.2: could not read symbols: Invalid operation O.k. to apply? -- Guido --- tools/Makefile.am | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/tools/Makefile.am b/tools/Makefile.am index 68471ea..3e31dbd 100644 --- a/tools/Makefile.am +++ b/tools/Makefile.am @@ -47,6 +47,7 @@ virsh_LDADD = \ ../src/libvirt.la \ ../src/libvirt-qemu.la \ ../gnulib/lib/libgnu.la \ + $(LIBXML_LIBS) \ $(VIRSH_LIBS) virsh_CFLAGS = \ -I$(top_srcdir)/gnulib/lib -I../gnulib/lib \ -- 1.7.4.1

2 2

[libvirt] [PATCH 0/2] virsh: Change command option parsing
by Michal Privoznik 08 Mar '11

08 Mar '11

This series changes some of vshCommandOpt* functions to return tri-state result according to cases if argument was found and valid and permutations. In addition, we ensure const-correctness of vshCommandOptString function and related code. Michal Privoznik (2): virsh: change vshCommandOptString return type and fix const-correctness virsh: Change option parsing functions to return tri-state information. tools/virsh.c | 717 +++++++++++++++++++++++++++------------------------------ 1 files changed, 335 insertions(+), 382 deletions(-) -- 1.7.4

2 4

[libvirt] [RFC PATCH 0/5] Allow data upload/download to/from storage volumes
by Daniel P. Berrange 08 Mar '11

08 Mar '11

This patch series introduces two new APIs to allow data upload/download to/from storage volumes, using the streams APIs. Mostly I wrote this so I had an easier way to test the streams handling in my RPC patch series than using QEMU tunnelled migration code. Cole has expressed an interest in this kind of functionality in the past to allow virt-manager to upload kernel/initrd to remote hosts for provisioning guests. Most of the code here is pretty boring & trivial. The first patch is the one that is remotely interesting. One might argue we should just spawn 'dd' instead of this, but dd has some annoying aspects (you can't control its write offset in units smaller than the block size) and this could be useful more broadly.

2 9

[libvirt] [PATCH] docs/formatdomain: Add release info for disk <driver> attributes
by Cole Robinson 08 Mar '11

08 Mar '11

--- docs/formatdomain.html.in | 7 ++++--- 1 files changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 84b1cab..9b9ab29 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -785,8 +785,7 @@ <dd> The optional driver element allows specifying further details related to the hypervisor driver used to provide the disk. - Since 0.1.8; <code>io</code> attribute - since 0.8.8 + Since 0.1.8 <ul> <li> If the hypervisor supports multiple backend drivers, then @@ -802,16 +801,18 @@ The optional <code>cache</code> attribute controls the cache mechanism, possible values are "default", "none", "writethrough" and "writeback". + Since 0.6.0 </li> <li> The optional <code>error_policy</code> attribute controls how the hypervisor will behave on an error, possible values are "stop", "ignore", and "enospace". + Since 0.8.0 </li> <li> The optional <code>io</code> attribute controls specific policies on I/O; qemu guests support "threads" and - "native". + "native". Since 0.8.8 </li> </ul> </dd> -- 1.7.4

2 2

[libvirt] [PATCH 0/3] device-detaching with generated mac
by Michal Privoznik 08 Mar '11

08 Mar '11

When detaching interface via detach-device or virDomainDetachDevice() we parse input XML and (probably) generate a random MAC. This leads then into not finding interface and thus error. When a mac wasn't specified and domain has exactly one interface, semantic is clear. Otherwise we require <mac> in input XML. Michal Privoznik (3): Introduce flag representing if MAC address of interface was generated or not. qemu: Check for generated MACs while detaching interface xen: Check for generated MACs while detaching interface src/conf/domain_conf.c | 2 ++ src/conf/domain_conf.h | 1 + src/qemu/qemu_hotplug.c | 26 ++++++++++++++++++++------ src/xen/xm_internal.c | 3 ++- 4 files changed, 25 insertions(+), 7 deletions(-) -- 1.7.4

5 8

[libvirt] [PATCH v2 0/4] Support domain snapshots with current QMP
by Jiri Denemark 08 Mar '11

08 Mar '11

This version 2 of this series implements the third alternative (suggested by Dan Berrange) for falling back to HMP if appropriate snapshot command does not exist in QMP. Version 2: - refactor text monitor commands into parts which can be called directly from json monitor code - implement HMP fallback for loadvm and delvm in addition to savevm Jiri Denemark (4): qemu: Refactor text monitor snapshot commands qemu: Fallback to HMP when savevm QMP command is not found qemu: Refactor qemuDomainSnapshotCreateXML qemu: Stop guest CPUs before creating a snapshot src/qemu/qemu_driver.c | 156 ++++++++++++++++++++++---------- src/qemu/qemu_monitor_json.c | 204 +++++++++++++++++++++++++++++++++++------- src/qemu/qemu_monitor_text.c | 179 ++++++++++++++++++++++++++----------- src/qemu/qemu_monitor_text.h | 8 ++ 4 files changed, 411 insertions(+), 136 deletions(-) -- 1.7.4.1

1 4

[libvirt] Add persistent XML for cpu tunables
by Osier Yang 08 Mar '11

08 Mar '11

These are pretty rough patches, something like a draft, I beleive there must be many problems, please review it heavily, :-) New XML: <cputune> <shares>2048</shares> <vcpupin vcpu='0' cpuset='0-4,^1'/> <vcpupin vcpu='1' cpuset='1,3'/> <vcpupin vcpu='2' cpuset='0,2'/> </cputune> "shares" is to define the the proportional weighted cpu share for the domain. "vcpupin" is to define the cpu affinities of vcpus, it will not be displayed if one doesn't specify it explicitly in XML or set the cpu affinites for vcpu via "vcpupin", means there will be no vcpupin element in domain XML by default, and the constraints are: - Error if one specify entries more than the count of maxvcpus. - Error when one specify entries for same vcpu. - Error if value of attribute "vcpu" is more than count of "maxvcpus - 1". Attribute "cpuset" works same as "cpuset" of element "vcpu", reuse the codes for parsing and formating value of "cpuset" of element "vcpu". NB, the idea to add persistent XML for "cpushares" is from "Nikunj A. Dadhania": https://www.redhat.com/archives/libvir-list/2011-January/msg01183.html I rebased it and include it together in this patch series. [PATCH 1/6] cputune: new tests for testing cputune xml [PATCH 2/6] cputune: support cputune for xend driver [PATCH 3/6] cputune: support cputune for qemu driver [PATCH 4/6] cputune: support cputune xml for LXC driver [PATCH 5/6] cputune: support cputune xml config [PATCH 6/6] cputune: Add docs xml schema for cputune xml

2 11

[libvirt] libvirt-php: various fixes
by Tiziano Mueller 08 Mar '11

08 Mar '11

While building a libvirt-php package for Gentoo Linux I had to workaround a couple of build issues. The first two patches are the results. The last patch is a fix for the case libvirt has been built without Xen support. In this case libvirt_connect (and phpinfo()) fails because virGetVersion is called with a non-NULL typeVer argument and libvirt therefore checks for Xen version. I guess the documentation for virGetVersion should be updated since it also returns 0 if both type and typeVer are NULL. [PATCH 1/3] Fix building with threaded php. [PATCH 2/3] add --with-php-config flag [PATCH 3/3] fix libvirt_connect failure without Xen

2 5

[libvirt] [PATCH] Fix performance problem of virStorageVolCreateXMLFrom()
by Minoru Usui 08 Mar '11

08 Mar '11

virStorageVolCreateXMLFrom() is slow if destination Pool is LVM. Because write block size is not appropriate. On linux environment, block size of LVM Pool which is made by virStoragePoolCreateXML() is 4096 bytes. On the other hand, write block size of virStorageVolCreateXMLFrom() is 512 bytes. This value are hard corded in virStorageBackendCopyToFD(). This patch fix this block size problem on linux. [lvm block size] # virsh vol-dumpxml vol.img --pool lvm-pool |grep '<path>' <path>/dev/lvm-pool/vol.img</path> # blockdev --getbsz /dev/lvm-pool/vol.img 4096 [before patch] # echo 1 > /proc/sys/vm/drop_caches # time virsh vol-create-from lvm-pool vol.xml --inputpool dir-pool vol.img real 1m17.736s user 0m0.007s sys 0m0.021s [after patch] # echo 1 > /proc/sys/vm/drop_caches # time virsh vol-create-from lvm-pool vol.xml --inputpool dir-pool vol.img real 0m36.883s user 0m0.011s sys 0m0.031s Signed-off-by: Minoru Usui <usui(a)mxm.nes.nec.co.jp> --- src/storage/storage_backend.c | 23 +++++++++++++++++++---- 1 files changed, 19 insertions(+), 4 deletions(-) diff --git a/src/storage/storage_backend.c b/src/storage/storage_backend.c index 174155d..a1a930c 100644 --- a/src/storage/storage_backend.c +++ b/src/storage/storage_backend.c @@ -36,6 +36,10 @@ #include <sys/stat.h> #include <sys/param.h> #include <dirent.h> +#ifdef __linux__ +#include <sys/ioctl.h> +#include <linux/fs.h> +#endif #if HAVE_SELINUX # include <selinux/selinux.h> @@ -108,6 +112,9 @@ enum { TOOL_QCOW_CREATE, }; +#define READ_BLOCK_SIZE_DEFAULT (1024 * 1024) +#define WRITE_BLOCK_SIZE_DEFAULT (512) + static int ATTRIBUTE_NONNULL (2) virStorageBackendCopyToFD(virStorageVolDefPtr vol, virStorageVolDefPtr inputvol, @@ -119,8 +126,10 @@ virStorageBackendCopyToFD(virStorageVolDefPtr vol, int amtread = -1; int ret = 0; unsigned long long remain; - size_t rbytes = 1024 * 1024; /* For Read */ - char zerobuf[512]; + size_t rbytes = READ_BLOCK_SIZE_DEFAULT; + size_t wbytes = WRITE_BLOCK_SIZE_DEFAULT; + int interval; + char zerobuf[WRITE_BLOCK_SIZE_DEFAULT]; char *buf = NULL; if ((inputfd = open(inputvol->target.path, O_RDONLY)) < 0) { @@ -131,6 +140,12 @@ virStorageBackendCopyToFD(virStorageVolDefPtr vol, goto cleanup; } +#ifdef __linux__ + if (ioctl(fd, BLKBSZGET, &wbytes) < 0) { + wbytes = WRITE_BLOCK_SIZE_DEFAULT; + } +#endif + bzero(&zerobuf, sizeof(zerobuf)); if (VIR_ALLOC_N(buf, rbytes) < 0) { @@ -160,7 +175,7 @@ virStorageBackendCopyToFD(virStorageVolDefPtr vol, * blocks */ amtleft = amtread; do { - int interval = ((512 > amtleft) ? amtleft : 512); + interval = ((wbytes > amtleft) ? amtleft : wbytes); int offset = amtread - amtleft; if (is_dest_file && memcmp(buf+offset, zerobuf, interval) == 0) { @@ -179,7 +194,7 @@ virStorageBackendCopyToFD(virStorageVolDefPtr vol, goto cleanup; } - } while ((amtleft -= 512) > 0); + } while ((amtleft -= interval) > 0); } if (VIR_CLOSE(inputfd) < 0) { -- Minoru Usui <usui(a)mxm.nes.nec.co.jp>

2 2