- Devel - libvirt List Archives

[libvirt] libvirt & cgroup support - why are vm cgroups created under libvirt cgroup?
by Nikola Ciprich 15 Oct '10

15 Oct '10

Hello, I'd like to use cgroups for resources counting and management, but I'd like to use blkio-cgroup controller as well. I created simple patch for libvirt adding support for it (and I'd like to submit the patch once it's tested properly). But it seems that blkio-cgroup controller doesn't support cgroups inside cgroups (the way libvirt uses them - /cgroup/libvirt/vmxxx). Is there some possibility libvirt would be adjusted to support separate toplevel cgroup for each vm so blkio-cgroup could be used? Or is there some important reason for the way it works now? thanks a lot in advance for any reply with best regards nik -- ------------------------------------- Ing. Nikola CIPRICH LinuxBox.cz, s.r.o. 28. rijna 168, 709 01 Ostrava tel.: +420 596 603 142 fax: +420 596 621 273 mobil: +420 777 093 799 www.linuxbox.cz mobil servis: +420 737 238 656 email servis: servis(a)linuxbox.cz -------------------------------------

1 0

Re: [libvirt] [virt-tools-list] [PATCH] add AM_MAINTAINER_MODE macro
by Eric Blake 15 Oct '10

15 Oct '10

[adding libvir-list] On 10/15/2010 06:06 AM, Eric Blake wrote: > On 10/15/2010 05:29 AM, Guido Günther wrote: >> Hi, >> On Wed, Sep 29, 2010 at 04:46:23PM +0200, Guido Günther wrote: > > Odd - I cannot find the original mail, even when looking in the archives: > https://www.redhat.com/archives/libvir-list/2010-September/date.html Oh, I see why - I was looking on the wrong list. Libvirt patches should generally be sent to libvir-list. > >>> Hi, >>> Please add the AM_MAINTAINER_MODE macro to configure.ac for >>> virt-manager. This allows downstream distributions to disable this >>> feature so no autotools are required to build the package. The patch >>> doesn't change behaviour for upstream: >>> >>> http://www.gnu.org/software/hello/manual/automake/maintainer_002dmode.html >>> > > The automake manual recommends against maintainer mode: > http://www.gnu.org/software/automake/manual/automake.html#maintainer_002dmo… > > >> Several years ago François Pinard pointed out several arguments >> against this AM_MAINTAINER_MODE macro. Most of them relate to >> insecurity. By removing dependencies you get non-dependable builds: >> changes to sources files can have no effect on generated files and >> this can be very confusing when unnoticed. He adds that security >> shouldn't be reserved to maintainers (what --enable-maintainer-mode >> suggests), on the contrary. If one user has to modify a Makefile.am, >> then either Makefile.in should be updated or a warning should be >> output (this is what Automake uses missing for) but the last thing you >> want is that nothing happens and the user doesn't notice it (this is >> what happens when rebuild rules are disabled by AM_MAINTAINER_MODE). >> >> Jim Meyering, the inventor of the AM_MAINTAINER_MODE macro was swayed >> by François's arguments, and got rid of AM_MAINTAINER_MODE in all of >> his packages. > > Furthermore, downstream distributions should not require autotools to > build a package if they do not make any changes to any of the > configure.ac/Makefile.am source files in the first place; and > conversely, if you ARE patching those files, then you WANT to rerun the > autotools and not silently disable them. > >>> AM_INIT_AUTOMAKE([-Wno-portability]) >>> +AM_MAINTAINER_MODE([enable]) >>> >> >> Any chance this gets applied? > > I'm very reluctant to make this change without a better demonstration > why you think it is needed, and only after exhausting other attempts to > fix the root cause problem that you are really hitting. > -- Eric Blake eblake(a)redhat.com +1-801-349-2682 Libvirt virtualization library http://libvirt.org

1 1

[libvirt] usage of PKG_CHECK_ in libvirt
by Alejandro Mery 15 Oct '10

15 Oct '10

hi, I want to try to add some basic support for (linux-)vserver to libvirt and after reading some old mail threads I noticed you vanished PKG_CHECK_EXISTS back in 2008. is it still not welcomed in libvirt? PKG_CHECK_MODULES also? Thanks, Alejandro Mery

3 3

[libvirt] [PATCH] Make sure that filedescriptors are only closed once
by Stefan Berger 15 Oct '10

15 Oct '10

Setting fd=-1 in these places makes sure that the fd is not closed twice later on in 'clean:'. This is of course a recipe for disaster in a multi-threaded system where the filedescriptor can belong to something else right away. At least we have a pattern... (looks like I can close the augeas bug as well...) Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/conf/domain_conf.c | 2 ++ src/conf/network_conf.c | 2 ++ src/conf/nwfilter_conf.c | 4 ++++ src/conf/storage_conf.c | 2 ++ 4 files changed, 10 insertions(+) Index: libvirt-acl/src/conf/domain_conf.c =================================================================== --- libvirt-acl.orig/src/conf/domain_conf.c +++ libvirt-acl/src/conf/domain_conf.c @@ -6805,6 +6805,8 @@ int virDomainSaveXML(const char *configD goto cleanup; } + fd = -1; + ret = 0; cleanup: if (fd != -1) Index: libvirt-acl/src/conf/network_conf.c =================================================================== --- libvirt-acl.orig/src/conf/network_conf.c +++ libvirt-acl/src/conf/network_conf.c @@ -694,6 +694,8 @@ int virNetworkSaveXML(const char *config goto cleanup; } + fd = -1; + ret = 0; cleanup: Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -2200,6 +2200,8 @@ int virNWFilterSaveXML(const char *confi goto cleanup; } + fd = -1; + ret = 0; cleanup: @@ -2611,6 +2613,8 @@ virNWFilterPoolObjSaveDef(virNWFilterDri goto cleanup; } + fd = -1; + ret = 0; cleanup: Index: libvirt-acl/src/conf/storage_conf.c =================================================================== --- libvirt-acl.orig/src/conf/storage_conf.c +++ libvirt-acl/src/conf/storage_conf.c @@ -1567,6 +1567,8 @@ virStoragePoolObjSaveDef(virStorageDrive goto cleanup; } + fd = -1; + ret = 0; cleanup:

2 1

[libvirt] [PATCH] esx: Handle name escaping properly
by Matthias Bolte 15 Oct '10

15 Oct '10

VMware uses a mix of percent-, pipe- and base64-encoding in different combinations in different places. Add a testcase for this. --- src/esx/README | 25 ++++ src/esx/esx_driver.c | 72 ++++++----- src/esx/esx_storage_driver.c | 42 ++++++- src/esx/esx_util.c | 198 ++++++++++++++++++++++++++++++ src/esx/esx_util.h | 18 +++ src/esx/esx_vi.c | 6 + src/esx/esx_vmx.c | 88 +++++--------- tests/esxutilstest.c | 51 ++++++++ tests/xml2vmxdata/xml2vmx-annotation.vmx | 2 +- 9 files changed, 405 insertions(+), 97 deletions(-) diff --git a/src/esx/README b/src/esx/README index 9ae93b1..b7a5865 100644 --- a/src/esx/README +++ b/src/esx/README @@ -86,3 +86,28 @@ It tries to cancel the blocked task, but this may not be possible, because there are task like the power-on task that is marked as non-cancelable. So the driver may leave blocked tasks behind if automatic question handling is disabled. + + + +Different escaping schemes used in different places +=================================================== + +A domain name in the vSphere API has [%/\] escaped as %XX (percent-encoding), +where XX is the ASCII code of the escaped char in hex. + +A domainName entry in a VMX config file is percent-encoded and has [|"] escaped +as |XX (pipe-encoding). + +A annotation entry in a VMX config file is pipe-encoded. + +A datastore item name has the special Windows path characters ["*<>:|?] +replaced by underscores (_). The result is escaped using percent-encoding and +base64-encoding. This isn't a bijective encoding. Therefore, escaped datastore +item names cannot be unescaped completely. + +For base64-encoding sequences of chars that don't match [a-zA-Z0-9'(),. _-] +are replaced by their base64 form (the padding is omitted). An encoded sequence +begins with a plus (+), ends with a minus (-) and can contain a plus (+). The +minus (-) is omitted if the string ends in a base64-encoded sequence. VMware +uses the comma (,) instead of the slash (/) in the base64 alphabet to avoid +conflicts with the slash as path separator. diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c index e959be2..8bc3be2 100644 --- a/src/esx/esx_driver.c +++ b/src/esx/esx_driver.c @@ -2708,7 +2708,6 @@ esxListDefinedDomains(virConnectPtr conn, char **const names, int maxnames) esxVI_String *propertyNameList = NULL; esxVI_ObjectContent *virtualMachineList = NULL; esxVI_ObjectContent *virtualMachine = NULL; - esxVI_DynamicProperty *dynamicProperty = NULL; esxVI_VirtualMachinePowerState powerState; int count = 0; int i; @@ -2745,27 +2744,15 @@ esxListDefinedDomains(virConnectPtr conn, char **const names, int maxnames) continue; } - for (dynamicProperty = virtualMachine->propSet; - dynamicProperty != NULL; - dynamicProperty = dynamicProperty->_next) { - if (STREQ(dynamicProperty->name, "name")) { - if (esxVI_AnyType_ExpectType(dynamicProperty->val, - esxVI_Type_String) < 0) { - goto cleanup; - } - - names[count] = strdup(dynamicProperty->val->string); + names[count] = NULL; - if (names[count] == NULL) { - virReportOOMError(); - goto cleanup; - } - - count++; - break; - } + if (esxVI_GetVirtualMachineIdentity(virtualMachine, NULL, &names[count], + NULL) < 0) { + goto cleanup; } + ++count; + if (count >= maxnames) { break; } @@ -2864,14 +2851,18 @@ esxDomainCreateWithFlags(virDomainPtr domain, unsigned int flags) return result; } + + static int esxDomainCreate(virDomainPtr domain) { return esxDomainCreateWithFlags(domain, 0); } + + static virDomainPtr -esxDomainDefineXML(virConnectPtr conn, const char *xml ATTRIBUTE_UNUSED) +esxDomainDefineXML(virConnectPtr conn, const char *xml) { esxPrivate *priv = conn->privateData; virDomainDefPtr def = NULL; @@ -2883,6 +2874,7 @@ esxDomainDefineXML(virConnectPtr conn, const char *xml ATTRIBUTE_UNUSED) esxVMX_Data data; char *datastoreName = NULL; char *directoryName = NULL; + char *escapedName = NULL; virBuffer buffer = VIR_BUFFER_INITIALIZER; char *url = NULL; char *datastoreRelatedPath = NULL; @@ -2912,6 +2904,13 @@ esxDomainDefineXML(virConnectPtr conn, const char *xml ATTRIBUTE_UNUSED) goto cleanup; } + if (virtualMachine == NULL && + esxVI_LookupVirtualMachineByName(priv->primary, def->name, NULL, + &virtualMachine, + esxVI_Occurrence_OptionalItem) < 0) { + goto cleanup; + } + if (virtualMachine != NULL) { /* FIXME */ ESX_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", @@ -2992,7 +2991,13 @@ esxDomainDefineXML(virConnectPtr conn, const char *xml ATTRIBUTE_UNUSED) virBufferAddChar(&buffer, '/'); } - virBufferURIEncodeString(&buffer, def->name); + escapedName = esxUtil_EscapeDatastoreItem(def->name); + + if (escapedName == NULL) { + goto cleanup; + } + + virBufferURIEncodeString(&buffer, escapedName); virBufferAddLit(&buffer, ".vmx?dcPath="); virBufferURIEncodeString(&buffer, priv->primary->datacenter->name); virBufferAddLit(&buffer, "&dsName="); @@ -3005,29 +3010,31 @@ esxDomainDefineXML(virConnectPtr conn, const char *xml ATTRIBUTE_UNUSED) url = virBufferContentAndReset(&buffer); + /* Check, if VMX file already exists */ + /* FIXME */ + + /* Upload VMX file */ + VIR_DEBUG("Uploading .vmx config, url='%s' vmx='%s'", url, vmx); + + if (esxVI_Context_UploadFile(priv->primary, url, vmx) < 0) { + goto cleanup; + } + + /* Register the domain */ if (directoryName != NULL) { if (virAsprintf(&datastoreRelatedPath, "[%s] %s/%s.vmx", datastoreName, - directoryName, def->name) < 0) { + directoryName, escapedName) < 0) { virReportOOMError(); goto cleanup; } } else { if (virAsprintf(&datastoreRelatedPath, "[%s] %s.vmx", datastoreName, - def->name) < 0) { + escapedName) < 0) { virReportOOMError(); goto cleanup; } } - /* Check, if VMX file already exists */ - /* FIXME */ - - /* Upload VMX file */ - if (esxVI_Context_UploadFile(priv->primary, url, vmx) < 0) { - goto cleanup; - } - - /* Register the domain */ if (esxVI_RegisterVM_Task(priv->primary, priv->primary->datacenter->vmFolder, datastoreRelatedPath, NULL, esxVI_Boolean_False, priv->primary->computeResource->resourcePool, @@ -3061,6 +3068,7 @@ esxDomainDefineXML(virConnectPtr conn, const char *xml ATTRIBUTE_UNUSED) VIR_FREE(vmx); VIR_FREE(datastoreName); VIR_FREE(directoryName); + VIR_FREE(escapedName); VIR_FREE(url); VIR_FREE(datastoreRelatedPath); esxVI_ObjectContent_Free(&virtualMachine); diff --git a/src/esx/esx_storage_driver.c b/src/esx/esx_storage_driver.c index 329020b..72e0d7a 100644 --- a/src/esx/esx_storage_driver.c +++ b/src/esx/esx_storage_driver.c @@ -915,9 +915,13 @@ esxStorageVolumeCreateXML(virStoragePoolPtr pool, const char *xmldesc, virStoragePoolDef poolDef; virStorageVolDefPtr def = NULL; char *tmp; - char *datastorePath = NULL; + char *unescapedDatastorePath = NULL; + char *unescapedDirectoryName = NULL; + char *unescapedDirectoryAndFileName = NULL; char *directoryName = NULL; + char *fileName = NULL; char *datastorePathWithoutFileName = NULL; + char *datastorePath = NULL; esxVI_FileInfo *fileInfo = NULL; esxVI_FileBackedVirtualDiskSpec *virtualDiskSpec = NULL; esxVI_ManagedObjectReference *task = NULL; @@ -995,15 +999,30 @@ esxStorageVolumeCreateXML(virStoragePoolPtr pool, const char *xmldesc, goto cleanup; } - if (virAsprintf(&datastorePath, "[%s] %s", pool->name, def->name) < 0) { + if (virAsprintf(&unescapedDatastorePath, "[%s] %s", pool->name, + def->name) < 0) { virReportOOMError(); goto cleanup; } if (def->target.format == VIR_STORAGE_FILE_VMDK) { - /* Create directory, if it doesn't exist yet */ - if (esxUtil_ParseDatastorePath(datastorePath, NULL, &directoryName, - NULL) < 0) { + /* Parse and escape datastore path */ + if (esxUtil_ParseDatastorePath(unescapedDatastorePath, NULL, + &unescapedDirectoryName, + &unescapedDirectoryAndFileName) < 0) { + goto cleanup; + } + + directoryName = esxUtil_EscapeDatastoreItem(unescapedDirectoryName); + + if (directoryName == NULL) { + goto cleanup; + } + + fileName = esxUtil_EscapeDatastoreItem(unescapedDirectoryAndFileName + + strlen(unescapedDirectoryName) + 1); + + if (fileName == NULL) { goto cleanup; } @@ -1013,6 +1032,13 @@ esxStorageVolumeCreateXML(virStoragePoolPtr pool, const char *xmldesc, goto cleanup; } + if (virAsprintf(&datastorePath, "[%s] %s/%s", pool->name, directoryName, + fileName) < 0) { + virReportOOMError(); + goto cleanup; + } + + /* Create directory, if it doesn't exist yet */ if (esxVI_LookupFileInfoByDatastorePath (priv->primary, datastorePathWithoutFileName, true, &fileInfo, esxVI_Occurrence_OptionalItem) < 0) { @@ -1115,9 +1141,13 @@ esxStorageVolumeCreateXML(virStoragePoolPtr pool, const char *xmldesc, esxVI_ObjectContent_Free(&datastore); esxVI_DatastoreInfo_Free(&datastoreInfo); virStorageVolDefFree(def); - VIR_FREE(datastorePath); + VIR_FREE(unescapedDatastorePath); + VIR_FREE(unescapedDirectoryName); + VIR_FREE(unescapedDirectoryAndFileName); VIR_FREE(directoryName); + VIR_FREE(fileName); VIR_FREE(datastorePathWithoutFileName); + VIR_FREE(datastorePath); esxVI_FileInfo_Free(&fileInfo); esxVI_FileBackedVirtualDiskSpec_Free(&virtualDiskSpec); esxVI_ManagedObjectReference_Free(&task); diff --git a/src/esx/esx_util.c b/src/esx/esx_util.c index 99cc4f6..5fe72fc 100644 --- a/src/esx/esx_util.c +++ b/src/esx/esx_util.c @@ -24,6 +24,7 @@ #include <config.h> +#include <c-ctype.h> #include <netdb.h> #include "internal.h" @@ -621,3 +622,200 @@ esxUtil_ReformatUuid(const char *input, char *output) return 0; } + + + +char * +esxUtil_EscapeHex(const char *string, char escape, const char *special) +{ + char *escaped = NULL; + size_t length = 1; /* 1 byte for termination */ + const char *tmp1 = string; + char *tmp2; + + /* Calculate length of escaped string */ + while (*tmp1 != '\0') { + if (*tmp1 == escape || strspn(tmp1, special) > 0) { + length += 2; + } + + ++tmp1; + ++length; + } + + if (VIR_ALLOC_N(escaped, length) < 0) { + virReportOOMError(); + return NULL; + } + + tmp1 = string; /* reading from this one */ + tmp2 = escaped; /* writing to this one */ + + /* Escape to 'cXX' where c is the escape char and X is a hex digit */ + while (*tmp1 != '\0') { + if (*tmp1 == escape || strspn(tmp1, special) > 0) { + *tmp2++ = escape; + + snprintf(tmp2, 3, "%02x", (unsigned int)*tmp1); + + tmp2 += 2; + } else { + *tmp2++ = *tmp1; + } + + ++tmp1; + } + + *tmp2 = '\0'; + + return escaped; +} + + + +int +esxUtil_UnescapeHex(char *string, char escape) +{ + char *tmp1 = string; /* reading from this one */ + char *tmp2 = string; /* writing to this one */ + + /* Unescape from 'cXX' where c is the escape char and X is a hex digit */ + while (*tmp1 != '\0') { + if (*tmp1 == escape) { + if (!c_isxdigit(tmp1[1]) || !c_isxdigit(tmp1[2])) { + return -1; + } + + *tmp2++ = virHexToBin(tmp1[1]) * 16 + virHexToBin(tmp1[2]); + tmp1 += 3; + } else { + *tmp2++ = *tmp1++; + } + } + + *tmp2 = '\0'; + + return 0; +} + + + +char * +esxUtil_EscapeBase64(const char *string) +{ + /* 'normal' characters don't get base64 encoded */ + static const char *normal = + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'(),. _-"; + + /* VMware uses ',' instead of the path separator '/' in the base64 alphabet */ + static const char *base64 = + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+,"; + + virBuffer buffer = VIR_BUFFER_INITIALIZER; + const char *tmp1 = string; + size_t length; + unsigned char c1, c2, c3; + + /* Escape sequences of non-'normal' characters as base64 without padding */ + while (*tmp1 != '\0') { + length = strspn(tmp1, normal); + + if (length > 0) { + virBufferAdd(&buffer, tmp1, length); + + tmp1 += length; + } else { + length = strcspn(tmp1, normal); + + virBufferAddChar(&buffer, '+'); + + while (length > 0) { + c1 = *tmp1++; + c2 = length > 1 ? *tmp1++ : 0; + c3 = length > 2 ? *tmp1++ : 0; + + virBufferAddChar(&buffer, base64[(c1 >> 2) & 0x3f]); + virBufferAddChar(&buffer, base64[((c1 << 4) + (c2 >> 4)) & 0x3f]); + + if (length > 1) { + virBufferAddChar(&buffer, base64[((c2 << 2) + (c3 >> 6)) & 0x3f]); + } + + if (length > 2) { + virBufferAddChar(&buffer, base64[c3 & 0x3f]); + } + + length -= length > 3 ? 3 : length; + } + + if (*tmp1 != '\0') { + virBufferAddChar(&buffer, '-'); + } + } + } + + if (virBufferError(&buffer)) { + virReportOOMError(); + virBufferFreeAndReset(&buffer); + + return NULL; + } + + return virBufferContentAndReset(&buffer); +} + + + +void +esxUtil_ReplaceSpecialWindowsPathChars(char *string) +{ + /* '/' and '\\' are missing on purpose */ + static const char *specials = "\"*<>:|?"; + + char *tmp = string; + size_t length; + + while (*tmp != '\0') { + length = strspn(tmp, specials); + + while (length > 0) { + *tmp++ = '_'; + --length; + } + + if (*tmp != '\0') { + ++tmp; + } + } +} + + + +char * +esxUtil_EscapeDatastoreItem(const char *string) +{ + char *replaced = strdup(string); + char *escaped1; + char *escaped2 = NULL; + + if (replaced == NULL) { + virReportOOMError(); + return NULL; + } + + esxUtil_ReplaceSpecialWindowsPathChars(replaced); + + escaped1 = esxUtil_EscapeHexPercent(replaced); + + if (escaped1 == NULL) { + goto cleanup; + } + + escaped2 = esxUtil_EscapeBase64(escaped1); + + cleanup: + VIR_FREE(replaced); + VIR_FREE(escaped1); + + return escaped2; +} diff --git a/src/esx/esx_util.h b/src/esx/esx_util.h index 650f145..669a4f2 100644 --- a/src/esx/esx_util.h +++ b/src/esx/esx_util.h @@ -71,4 +71,22 @@ int esxUtil_GetConfigBoolean(virConfPtr conf, const char *name, bool *boolean_, int esxUtil_ReformatUuid(const char *input, char *output); +char *esxUtil_EscapeHex(const char *string, char escape, const char *special); + +# define esxUtil_EscapeHexPipe(_string) esxUtil_EscapeHex(_string, '|', "\"") + +# define esxUtil_EscapeHexPercent(_string) esxUtil_EscapeHex(_string, '%', "/\\") + +int esxUtil_UnescapeHex(char *string, char escape); + +# define esxUtil_UnescapeHexPipe(_string) esxUtil_UnescapeHex(_string, '|') + +# define esxUtil_UnescapeHexPercent(_string) esxUtil_UnescapeHex(_string, '%') + +char *esxUtil_EscapeBase64(const char *string); + +void esxUtil_ReplaceSpecialWindowsPathChars(char *string); + +char *esxUtil_EscapeDatastoreItem(const char *string); + #endif /* __ESX_UTIL_H__ */ diff --git a/src/esx/esx_vi.c b/src/esx/esx_vi.c index d361f01..c450730 100644 --- a/src/esx/esx_vi.c +++ b/src/esx/esx_vi.c @@ -2014,6 +2014,12 @@ esxVI_GetVirtualMachineIdentity(esxVI_ObjectContent *virtualMachine, goto failure; } + if (esxUtil_UnescapeHexPercent(*name) < 0) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", + _("Domain name contains invalid escape sequence")); + goto failure; + } + break; } } diff --git a/src/esx/esx_vmx.c b/src/esx/esx_vmx.c index ece16b2..e17e1e7 100644 --- a/src/esx/esx_vmx.c +++ b/src/esx/esx_vmx.c @@ -876,8 +876,6 @@ esxVMX_ParseConfig(esxVMX_Context *ctx, virCapsPtr caps, const char *vmx, long long numvcpus = 0; char *sched_cpu_affinity = NULL; char *guestOS = NULL; - char *tmp1; - char *tmp2; int controller; int bus; int port; @@ -982,34 +980,28 @@ esxVMX_ParseConfig(esxVMX_Context *ctx, virCapsPtr caps, const char *vmx, goto cleanup; } + if (def->name != NULL) { + if (esxUtil_UnescapeHexPercent(def->name) < 0 || + esxUtil_UnescapeHexPipe(def->name) < 0) { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", + _("VMX entry 'name' contains invalid escape sequence")); + goto cleanup; + } + } + /* vmx:annotation -> def:description */ if (esxUtil_GetConfigString(conf, "annotation", &def->description, true) < 0) { goto cleanup; } - /* Unescape '|XX' where X is a hex digit */ if (def->description != NULL) { - tmp1 = def->description; /* reading from this one */ - tmp2 = def->description; /* writing to this one */ - - while (*tmp1 != '\0') { - if (*tmp1 == '|') { - if (!c_isxdigit(tmp1[1]) || !c_isxdigit(tmp1[2])) { - ESX_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", - _("VMX entry 'annotation' contains invalid " - "escape sequence")); - goto cleanup; - } - - *tmp2++ = virHexToBin(tmp1[1]) * 16 + virHexToBin(tmp1[2]); - tmp1 += 3; - } else { - *tmp2++ = *tmp1++; - } + if (esxUtil_UnescapeHexPipe(def->description) < 0) { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", + _("VMX entry 'annotation' contains invalid escape " + "sequence")); + goto cleanup; } - - *tmp2 = '\0'; } /* vmx:memsize -> def:mem.max_balloon */ @@ -2460,9 +2452,8 @@ esxVMX_FormatConfig(esxVMX_Context *ctx, virCapsPtr caps, virDomainDefPtr def, int sched_cpu_affinity_length; unsigned char zero[VIR_UUID_BUFLEN]; virBuffer buffer = VIR_BUFFER_INITIALIZER; - size_t length; - char *tmp1; - char *tmp2; + char *preliminaryDisplayName = NULL; + char *displayName = NULL; char *annotation = NULL; bool scsi_present[4] = { false, false, false, false }; int scsi_virtualDev[4] = { -1, -1, -1, -1 }; @@ -2536,44 +2527,23 @@ esxVMX_FormatConfig(esxVMX_Context *ctx, virCapsPtr caps, virDomainDefPtr def, } /* def:name -> vmx:displayName */ - virBufferVSprintf(&buffer, "displayName = \"%s\"\n", def->name); - - /* def:description -> vmx:annotation */ - if (def->description != NULL) { - /* Escape '"' as '|22' and '|' as '|7C' */ - length = 1; /* 1 byte for termination */ - tmp1 = def->description; - - while (*tmp1 != '\0') { - if (*tmp1 == '"' || *tmp1 == '|') { - length += 2; - } - - ++tmp1; - ++length; - } + preliminaryDisplayName = esxUtil_EscapeHexPipe(def->name); - if (VIR_ALLOC_N(annotation, length) < 0) { - virReportOOMError(); - goto cleanup; - } + if (preliminaryDisplayName == NULL) { + goto cleanup; + } - tmp1 = def->description; /* reading from this one */ - tmp2 = annotation; /* writing to this one */ + displayName = esxUtil_EscapeHexPercent(preliminaryDisplayName); - while (*tmp1 != '\0') { - if (*tmp1 == '"') { - *tmp2++ = '|'; *tmp2++ = '2'; *tmp2++ = '2'; - } else if (*tmp1 == '|') { - *tmp2++ = '|'; *tmp2++ = '7'; *tmp2++ = 'C'; - } else { - *tmp2++ = *tmp1; - } + if (displayName == NULL) { + goto cleanup; + } - ++tmp1; - } + virBufferVSprintf(&buffer, "displayName = \"%s\"\n", displayName); - *tmp2 = '\0'; + /* def:description -> vmx:annotation */ + if (def->description != NULL) { + annotation = esxUtil_EscapeHexPipe(def->description); virBufferVSprintf(&buffer, "annotation = \"%s\"\n", annotation); } @@ -2780,6 +2750,8 @@ esxVMX_FormatConfig(esxVMX_Context *ctx, virCapsPtr caps, virDomainDefPtr def, virBufferFreeAndReset(&buffer); } + VIR_FREE(preliminaryDisplayName); + VIR_FREE(displayName); VIR_FREE(annotation); return vmx; diff --git a/tests/esxutilstest.c b/tests/esxutilstest.c index 4906ad4..c9a59c7 100644 --- a/tests/esxutilstest.c +++ b/tests/esxutilstest.c @@ -227,6 +227,56 @@ testConvertDateTimeToCalendarTime(const void *data ATTRIBUTE_UNUSED) +struct testDatastoreItem { + const char *string; + const char *escaped; +}; + +static struct testDatastoreItem datastoreItems[] = { + { "normal", "normal" }, + { "Aä1ö2ü3ß4#5~6!7§8/9%Z", + "A+w6Q-1+w7Y-2+w7w-3+w58-4+Iw-5+fg-6+IQ-7+wqc-8+JQ-2f9+JQ-25Z" }, + { "Z~6!7§8/9%0#1\"2'3`4&A", + "Z+fg-6+IQ-7+wqc-8+JQ-2f9+JQ-250+Iw-1_2'3+YA-4+Jg-A" }, + { "標準語", "+5qiZ5rqW6Kqe" }, + { "!\"#$%&'()*+,-./0123456789:;<=>?", + "+IQ-_+IyQl-25+Jg-'()_+Kw-,-.+JQ-2f0123456789_+Ow-_+PQ-__" }, + { "A Z[\\]^_B", "A Z+WyU-5c+XV4-_B" }, + { "A`B@{|}~DEL", "A+YA-B+QHs-_+fX4-DEL" }, + { "hÀÁÂÃÄÅH", "h+w4DDgcOCw4PDhMOF-H" }, + { "A쿀Z", "A+7L+A-Z" }, + { "!쿀A", "+Iey,gA-A" }, + { "~~~", "+fn5+" }, + { "~~~A", "+fn5+-A" }, + { "K%U/H\\Z", "K+JQ-25U+JQ-2fH+JQ-5cZ" }, +}; + +static int +testEscapeDatastoreItem(const void *data ATTRIBUTE_UNUSED) +{ + int i; + char *escaped = NULL; + + for (i = 0; i < ARRAY_CARDINALITY(datastoreItems); ++i) { + VIR_FREE(escaped); + + escaped = esxUtil_EscapeDatastoreItem(datastoreItems[i].string); + + if (escaped == NULL) { + return -1; + } + + if (STRNEQ(datastoreItems[i].escaped, escaped)) { + VIR_FREE(escaped); + return -1; + } + } + + return 0; +} + + + static int mymain(int argc, char **argv) { @@ -258,6 +308,7 @@ mymain(int argc, char **argv) DO_TEST(DiskNameToIndex); DO_TEST(ParseDatastorePath); DO_TEST(ConvertDateTimeToCalendarTime); + DO_TEST(EscapeDatastoreItem); return result == 0 ? EXIT_SUCCESS : EXIT_FAILURE; } diff --git a/tests/xml2vmxdata/xml2vmx-annotation.vmx b/tests/xml2vmxdata/xml2vmx-annotation.vmx index 47d060d..5754c31 100644 --- a/tests/xml2vmxdata/xml2vmx-annotation.vmx +++ b/tests/xml2vmxdata/xml2vmx-annotation.vmx @@ -3,7 +3,7 @@ virtualHW.version = "4" guestOS = "other" uuid.bios = "56 4d 9b ef ac d9 b4 e0-c8 f0 ae a8 b9 10 35 15" displayName = "annotation" -annotation = "Some |7Ctext|7C to test the |22escaping|22: |7C|7C|22|22|7C|7C|22|7C Unescaped!" +annotation = "Some |7ctext|7c to test the |22escaping|22: |7c|7c|22|22|7c|7c|22|7c Unescaped!" memsize = "4" numvcpus = "1" floppy0.present = "false" -- 1.7.0.4

3 5

[libvirt] [PATCH] nwfilter: prevent multiple filters with different name but same UUID
by Stefan Berger 14 Oct '10

14 Oct '10

Patch to prevent multiple nwfilters with different name but same UUID. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/conf/nwfilter_conf.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -2399,6 +2399,20 @@ virNWFilterPoolObjAssignDef(virConnectPt { virNWFilterPoolObjPtr pool; + pool = virNWFilterPoolObjFindByUUID(pools, def->uuid); + + if (pool) { + if (!STREQ(def->name, pool->def->name)) { + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, + _("filter with same UUID but different name " + "('%s') already exists"), + pool->def->name); + virNWFilterPoolObjUnlock(pool); + return NULL; + } + virNWFilterPoolObjUnlock(pool); + } + if (virNWFilterDefLoopDetect(conn, pools, def)) { virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, "%s", _("filter would introduce a loop"));

2 2

[libvirt] How to rename a domain?
by Ganesh Pagade 14 Oct '10

14 Oct '10

Hi, I am using libvirt Java bindings. How can I rename a domain? Is there an API to do this? Thanks, -Ganesh

2 1

[libvirt] [PATCH v2] Added new attribute accessmode to filesystem element
by Harsh Prateek Bora 14 Oct '10

14 Oct '10

This patch introduces new attribute to filesystem element to support customizable access mode for mount type. Valid accessmode are: passthrough, mapped and squash. Usage: <filesystem type='mount' accessmode='passthrough'> <source dir='/export/to/guest'/> <target dir='mount_tag'/> </filesystem> Here is the detailed explanation on these access modes: Access mode: mapped -------------------- Fileserver intercepts and maps all the file object create requests. Files on the fileserver will be created with Fileserver's user credentials and the client-user's credentials are stored in extended attributes. During getattr() server extracts the client-user's credentials from extended attributes and sends to the client. This adds a great deal of security in the cloud environments where the guest's(client) user space is kept completely isolated from host's user space. Access mode : passthrough -------------------------- In this security model, Fileserver passes down all requests to the underlying filesystem. File system objects on the fileserver will be created with client-user's credentials. This is done by setting setuid()/setgid() during creation or chmod/chown after file creation. At the end of create protocol request, files on the fileserver will be owned by cleint-user's uid/gid. This model mimic's current NFSv3 level of security. Access mode: squash -------------------- In 'squash' mode, the (filesystem) server attempts to preserve user/group ownership from guest, however: - If the server is running as root this mode is equivalent to passthrough. - If the server is running as non-root, all files just have uid/gid matching the server process. Note: This patch is based on Daniel's patch to support 9pfs. It shall be applied after applying Daniel's patch to support 9pfs. Signed-off-by: Harsh Prateek Bora <harsh(a)linux.vnet.ibm.com> --- v2: - fixed compilation errors missed in v1. docs/schemas/domain.rng | 7 +++++++ src/conf/domain_conf.c | 30 ++++++++++++++++++++++++++++-- src/conf/domain_conf.h | 11 +++++++++++ src/qemu/qemu_conf.c | 11 +++++++++-- 4 files changed, 55 insertions(+), 4 deletions(-) diff --git a/docs/schemas/domain.rng b/docs/schemas/domain.rng index ccb8cf3..c0e5149 100644 --- a/docs/schemas/domain.rng +++ b/docs/schemas/domain.rng @@ -761,6 +761,13 @@ </choice> <optional> <ref name="address"/> + <attribute name="accessmode"> + <choice> + <value>passthrough</value> + <value>mapped</value> + <value>squash</value> + </choice> + </attribute> </optional> </element> </define> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index e05d5d7..991b284 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -161,6 +161,12 @@ VIR_ENUM_IMPL(virDomainFS, VIR_DOMAIN_FS_TYPE_LAST, "file", "template") +VIR_ENUM_IMPL(virDomainFSAccessMode, VIR_DOMAIN_FS_ACCESSMODE_LAST, + "passthrough", + "mapped", + "squash") + + VIR_ENUM_IMPL(virDomainNet, VIR_DOMAIN_NET_TYPE_LAST, "user", "ethernet", @@ -1847,6 +1853,7 @@ virDomainFSDefParseXML(xmlNodePtr node, char *type = NULL; char *source = NULL; char *target = NULL; + char *accessmode = NULL; if (VIR_ALLOC(def) < 0) { virReportOOMError(); @@ -1864,6 +1871,17 @@ virDomainFSDefParseXML(xmlNodePtr node, def->type = VIR_DOMAIN_FS_TYPE_MOUNT; } + accessmode = virXMLPropString(node, "accessmode"); + if (accessmode) { + if ((def->accessmode = virDomainFSAccessModeTypeFromString(accessmode)) < 0) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("unknown accessmode '%s'"), accessmode); + goto error; + } + } else { + def->accessmode = VIR_DOMAIN_FS_ACCESSMODE_PASSTHROUGH; + } + cur = node->children; while (cur != NULL) { if (cur->type == XML_ELEMENT_NODE) { @@ -5602,6 +5620,7 @@ virDomainFSDefFormat(virBufferPtr buf, int flags) { const char *type = virDomainFSTypeToString(def->type); + const char *accessmode = virDomainFSAccessModeTypeToString(def->accessmode); if (!type) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, @@ -5609,9 +5628,16 @@ virDomainFSDefFormat(virBufferPtr buf, return -1; } + if (!accessmode) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("unexpected accessmode %d"), def->accessmode); + return -1; + } + + virBufferVSprintf(buf, - " <filesystem type='%s'>\n", - type); + " <filesystem type='%s' accessmode='%s'>\n", + type, accessmode); if (def->src) { switch (def->type) { diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 7195c04..0668ce5 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -236,10 +236,20 @@ enum virDomainFSType { VIR_DOMAIN_FS_TYPE_LAST }; +/* Filesystem mount access mode */ +enum virDomainFSAccessMode { + VIR_DOMAIN_FS_ACCESSMODE_PASSTHROUGH, + VIR_DOMAIN_FS_ACCESSMODE_MAPPED, + VIR_DOMAIN_FS_ACCESSMODE_SQUASH, + + VIR_DOMAIN_FS_ACCESSMODE_LAST +}; + typedef struct _virDomainFSDef virDomainFSDef; typedef virDomainFSDef *virDomainFSDefPtr; struct _virDomainFSDef { int type; + int accessmode; char *src; char *dst; unsigned int readonly : 1; @@ -1167,6 +1177,7 @@ VIR_ENUM_DECL(virDomainDiskErrorPolicy) VIR_ENUM_DECL(virDomainController) VIR_ENUM_DECL(virDomainControllerModel) VIR_ENUM_DECL(virDomainFS) +VIR_ENUM_DECL(virDomainFSAccessMode) VIR_ENUM_DECL(virDomainNet) VIR_ENUM_DECL(virDomainChrDevice) VIR_ENUM_DECL(virDomainChrChannelTarget) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 18a302a..110b9e2 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -2783,11 +2783,18 @@ char *qemuBuildFSStr(virDomainFSDefPtr fs, if (fs->type != VIR_DOMAIN_FS_TYPE_MOUNT) { qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("can only passthrough directories")); + _("only supports mount filesystem type")); goto error; } - virBufferAddLit(&opt, "local,security_model=passthrough"); + virBufferAddLit(&opt, "local"); + if (fs->accessmode == VIR_DOMAIN_FS_ACCESSMODE_MAPPED) { + virBufferAddLit(&opt, ",security_model=mapped"); + } else if(fs->accessmode == VIR_DOMAIN_FS_ACCESSMODE_PASSTHROUGH) { + virBufferAddLit(&opt, ",security_model=passthrough"); + } else if(fs->accessmode == VIR_DOMAIN_FS_ACCESSMODE_SQUASH) { + virBufferAddLit(&opt, ",security_model=none"); + } virBufferVSprintf(&opt, ",id=%s%s", QEMU_FSDEV_HOST_PREFIX, fs->info.alias); virBufferVSprintf(&opt, ",path=%s", fs->src); -- 1.7.1.1

4 3

[libvirt] Improving our ChangeLog format?
by Justin Clift 14 Oct '10

14 Oct '10

Hi all, Noticed an entry in a recent LWN.net article about PostgreSQL's conversion to git. One of the things mentioned sounds relevant to us : Robert Haas has documented how to get commit summaries and sizes from Git. He wrote a perl script (which Tom Lane improved) that allows you to produce a changelog suitable for release notes from Git. http://git.postgresql.org/gitweb?p=postgresql.git;a=blob_plain;f=src/tools/… The changelog mention might be useful for us, as the PostgreSQL changelog looks a bunch more useful than ours. The PostgreSQL ChangeLog: http://www.postgresql.org/docs/9.0/static/release-9-0.html Our ChangeLog: http://libvirt.org/news.html Mentioning this in case anyone has the time/inclination to look into it. Any takers? :) Regards and best wishes, Justin Clift

4 7

[libvirt] [PATCH] Fix statstest when driver modules are enabled
by Daniel P. Berrange 14 Oct '10

14 Oct '10

The statstest is xen specific. Instead of filling the code with a huge number of #ifdef WITH_XEN, just make its entire compilation conditional in the Makefile.am. Also ensure it links to the Xen driver so that it builds when driver modules are enabled * tests/Makefile.am: Make statstest xen conditional. Link to xen driver * tests/Makefile.am: Remove all conditionals --- tests/Makefile.am | 8 ++++---- tests/statstest.c | 7 ------- 2 files changed, 4 insertions(+), 11 deletions(-) diff --git a/tests/Makefile.am b/tests/Makefile.am index 64fac75..44fe579 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -238,6 +238,10 @@ reconnect_SOURCES = \ reconnect.c reconnect_LDADD = $(LDADDS) +statstest_SOURCES = \ + statstest.c testutils.h testutils.c +statstest_LDADD = ../src/libvirt_driver_xen.la $(LDADDS) + else EXTRA_DIST += xml2sexprtest.c sexpr2xmltest.c xmconfigtest.c \ xencapstest.c reconnect.c \ @@ -328,10 +332,6 @@ nodeinfotest_SOURCES = \ nodeinfotest.c testutils.h testutils.c nodeinfotest_LDADD = $(LDADDS) -statstest_SOURCES = \ - statstest.c testutils.h testutils.c -statstest_LDADD = $(LDADDS) - if WITH_SECDRIVER_SELINUX seclabeltest_SOURCES = \ seclabeltest.c diff --git a/tests/statstest.c b/tests/statstest.c index 5fad190..551615b 100644 --- a/tests/statstest.c +++ b/tests/statstest.c @@ -9,15 +9,12 @@ #include "xen/block_stats.h" #include "testutils.h" -#if WITH_XEN static void testQuietError(void *userData ATTRIBUTE_UNUSED, virErrorPtr error ATTRIBUTE_UNUSED) { /* nada */ } -#endif -#if __linux__ && WITH_XEN static int testDevice(const char *path, int expect) { int actual = xenLinuxDomainDeviceID(NULL, 1, path); @@ -43,14 +40,11 @@ static int testDeviceHelper(const void *data) return testDevice(info->dev, info->num); } -#endif - static int mymain(int argc ATTRIBUTE_UNUSED, char **argv ATTRIBUTE_UNUSED) { int ret = 0; -#if __linux__ && WITH_XEN /* Some of our tests delibrately test failure cases, so * register a handler to stop error messages cluttering * up display @@ -201,7 +195,6 @@ mymain(int argc ATTRIBUTE_UNUSED, DO_TEST("/dev/xvda1", 51713); DO_TEST("/dev/xvda15", 51727); -#endif return(ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); } -- 1.7.2.3

2 1

[libvirt] [PATCH] build: provide URL in 'configure --help'
by Eric Blake 14 Oct '10

14 Oct '10

* configure.ac (AC_INIT): Provide email and URL. --- Before: Report bugs to the package provider. After: Report bugs to <libvir-list(a)redhat.com>. libvirt home page: <http://libvirt.org>. configure.ac | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/configure.ac b/configure.ac index b868e50..2803aa3 100644 --- a/configure.ac +++ b/configure.ac @@ -1,6 +1,6 @@ dnl Process this file with autoconf to produce a configure script. -AC_INIT([libvirt], [0.8.4]) +AC_INIT([libvirt], [0.8.4], [libvir-list(a)redhat.com] [], [http://libvirt.org] AC_CONFIG_SRCDIR([src/libvirt.c]) AC_CONFIG_AUX_DIR([build-aux]) AC_CONFIG_HEADERS([config.h]) -- 1.7.2.3

2 2

[libvirt] [PATCH] Conditionally include termios.h
by Daniel P. Berrange 14 Oct '10

14 Oct '10

The configure.ac file checks for termios.h, but its use is not protected by HAVE_TERMIOS_H. This breaks the build on mingw32 * src/util/util.c: Conditionally include termios.h --- src/util/util.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/src/util/util.c b/src/util/util.c index 586baee..b6b9712 100644 --- a/src/util/util.c +++ b/src/util/util.c @@ -43,7 +43,9 @@ #endif #include <string.h> #include <signal.h> -#include <termios.h> +#if HAVE_TERMIOS_H +# include <termios.h> +#endif #include "c-ctype.h" #ifdef HAVE_PATHS_H -- 1.7.2.3

4 10

[libvirt] [PATCH] Added new attribute accessmode to filesystem element
by Harsh Prateek Bora 14 Oct '10

14 Oct '10

This patch introduces new attribute to filesystem element to support customizable access mode for mount type. Valid accessmode are: passthrough, mapped and squash. Usage: <filesystem type='mount' accessmode='passthrough'> <source dir='/export/to/guest'/> <target dir='mount_tag'/> </filesystem> Here is the detailed explanation on these access modes: Access mode: mapped -------------------- Fileserver intercepts and maps all the file object create requests. Files on the fileserver will be created with Fileserver's user credentials and the client-user's credentials are stored in extended attributes. During getattr() server extracts the client-user's credentials from extended attributes and sends to the client. This adds a great deal of security in the cloud environments where the guest's(client) user space is kept completely isolated from host's user space. Access mode : passthrough -------------------------- In this security model, Fileserver passes down all requests to the underlying filesystem. File system objects on the fileserver will be created with client-user's credentials. This is done by setting setuid()/setgid() during creation or chmod/chown after file creation. At the end of create protocol request, files on the fileserver will be owned by cleint-user's uid/gid. This model mimic's current NFSv3 level of security. Access mode: squash -------------------- In 'squash' mode, the (filesystem) server attempts to preserve user/group ownership from guest, however: - If the server is running as root this mode is equivalent to passthrough. - If the server is running as non-root, all files just have uid/gid matching the server process. Note: This patch is based on Daniel's patch to support 9pfs. It shall be applied after applying Daniel's patch to support 9pfs. Signed-off-by: Harsh Prateek Bora <harsh(a)linux.vnet.ibm.com> --- docs/schemas/domain.rng | 7 +++++++ src/conf/domain_conf.c | 30 ++++++++++++++++++++++++++++-- src/conf/domain_conf.h | 11 +++++++++++ src/qemu/qemu_conf.c | 10 ++++++++-- 4 files changed, 54 insertions(+), 4 deletions(-) diff --git a/docs/schemas/domain.rng b/docs/schemas/domain.rng index ccb8cf3..c0e5149 100644 --- a/docs/schemas/domain.rng +++ b/docs/schemas/domain.rng @@ -761,6 +761,13 @@ </choice> <optional> <ref name="address"/> + <attribute name="accessmode"> + <choice> + <value>passthrough</value> + <value>mapped</value> + <value>squash</value> + </choice> + </attribute> </optional> </element> </define> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index e05d5d7..68c8441 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -161,6 +161,12 @@ VIR_ENUM_IMPL(virDomainFS, VIR_DOMAIN_FS_TYPE_LAST, "file", "template") +VIR_ENUM_IMPL(virDomainFSAccessMode, VIR_DOMAIN_FS_SECURITY_LAST, + "passthrough", + "mapped", + "squash") + + VIR_ENUM_IMPL(virDomainNet, VIR_DOMAIN_NET_TYPE_LAST, "user", "ethernet", @@ -1847,6 +1853,7 @@ virDomainFSDefParseXML(xmlNodePtr node, char *type = NULL; char *source = NULL; char *target = NULL; + char *accessmode = NULL; if (VIR_ALLOC(def) < 0) { virReportOOMError(); @@ -1864,6 +1871,17 @@ virDomainFSDefParseXML(xmlNodePtr node, def->type = VIR_DOMAIN_FS_TYPE_MOUNT; } + accessmode = virXMLPropString(node, "accessmode"); + if (accessmode) { + if ((def->accessmode = virDomainFSAccessModeTypeFromString(accessmode)) < 0) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("unknown accessmode '%s'"), accessmode); + goto error; + } + } else { + def->accessmode = VIR_DOMAIN_FS_ACCESSMODE_PASSTHROUGH; + } + cur = node->children; while (cur != NULL) { if (cur->type == XML_ELEMENT_NODE) { @@ -5602,6 +5620,7 @@ virDomainFSDefFormat(virBufferPtr buf, int flags) { const char *type = virDomainFSTypeToString(def->type); + const char *accessmode = virDomainFSAccessModeTypeToString(def->accessmode); if (!type) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, @@ -5609,9 +5628,16 @@ virDomainFSDefFormat(virBufferPtr buf, return -1; } + if (!accessmode) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("unexpected accessmode %d"), def->accessmode); + return -1; + } + + virBufferVSprintf(buf, - " <filesystem type='%s'>\n", - type); + " <filesystem type='%s' accessmode='%s'>\n", + type, accessmode); if (def->src) { switch (def->type) { diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 7195c04..0668ce5 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -236,10 +236,20 @@ enum virDomainFSType { VIR_DOMAIN_FS_TYPE_LAST }; +/* Filesystem mount access mode */ +enum virDomainFSAccessMode { + VIR_DOMAIN_FS_ACCESSMODE_PASSTHROUGH, + VIR_DOMAIN_FS_ACCESSMODE_MAPPED, + VIR_DOMAIN_FS_ACCESSMODE_SQUASH, + + VIR_DOMAIN_FS_ACCESSMODE_LAST +}; + typedef struct _virDomainFSDef virDomainFSDef; typedef virDomainFSDef *virDomainFSDefPtr; struct _virDomainFSDef { int type; + int accessmode; char *src; char *dst; unsigned int readonly : 1; @@ -1167,6 +1177,7 @@ VIR_ENUM_DECL(virDomainDiskErrorPolicy) VIR_ENUM_DECL(virDomainController) VIR_ENUM_DECL(virDomainControllerModel) VIR_ENUM_DECL(virDomainFS) +VIR_ENUM_DECL(virDomainFSAccessMode) VIR_ENUM_DECL(virDomainNet) VIR_ENUM_DECL(virDomainChrDevice) VIR_ENUM_DECL(virDomainChrChannelTarget) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 18a302a..0961d8a 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -2783,11 +2783,17 @@ char *qemuBuildFSStr(virDomainFSDefPtr fs, if (fs->type != VIR_DOMAIN_FS_TYPE_MOUNT) { qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("can only passthrough directories")); + _("only supports mount filesystem type")); goto error; } - virBufferAddLit(&opt, "local,security_model=passthrough"); + virBufferAddLit(&opt, "local"); + if (fs->accessmode == VIR_DOMAIN_FS_ACCESSMODE_SQUASH) { + virBufferAddLit(&opt, ",security_model=none"); + } else { + virBufferAddLit(&opt, ",security_model=%s", + virDomainFSAccessModeTypeToString(fs->accessmode)); + } virBufferVSprintf(&opt, ",id=%s%s", QEMU_FSDEV_HOST_PREFIX, fs->info.alias); virBufferVSprintf(&opt, ",path=%s", fs->src); -- 1.7.1.1

3 2

[libvirt] [PATCH] qemu: Prohibit migration of guests with host devices
by Jiri Denemark 14 Oct '10

14 Oct '10

Explicitly raising a nice error in the case user tries to migrate a guest with assigned host devices is much better than waiting for a mysterious error with no clue for the reason. --- src/qemu/qemu_driver.c | 19 +++++++++++++++++++ 1 files changed, 19 insertions(+), 0 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index f68995f..16f34f7 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -10380,6 +10380,19 @@ static void qemuDomainEventQueue(struct qemud_driver *driver, /* Migration support. */ +static bool ATTRIBUTE_NONNULL(1) +qemuDomainIsMigratable(virDomainDefPtr def) +{ + if (def->nhostdevs > 0) { + qemuReportError(VIR_ERR_OPERATION_INVALID, + _("Domain with assigned host devices cannot be migrated")); + return false; + } + + return true; +} + + /* Tunnelled migration stream support */ struct qemuStreamMigFile { int fd; @@ -10709,6 +10722,9 @@ qemudDomainMigratePrepareTunnel(virConnectPtr dconn, goto cleanup; } + if (!qemuDomainIsMigratable(def)) + goto cleanup; + /* Target domain name, maybe renamed. */ if (dname) { VIR_FREE(def->name); @@ -10976,6 +10992,9 @@ qemudDomainMigratePrepare2 (virConnectPtr dconn, goto cleanup; } + if (!qemuDomainIsMigratable(def)) + goto cleanup; + /* Target domain name, maybe renamed. */ if (dname) { VIR_FREE(def->name); -- 1.7.3.1

3 4

[libvirt] Xen string2sexpr and sexpr2string lose quotes?
by Thomas Graves 14 Oct '10

14 Oct '10

Hello all, I am running xen on rhel5 and using libvirt0.7.2 (I also tried 0.7.7) and it looks like the routines string2sexpr and sexpr2string seem to lose the quotes around the image args in the configuration. Has anyone seen this and have a patch for this? I have the following libvirt config: <os> <type>linux</type> <kernel>/usr/lib/xen/boot/pv-grub-x86_64.gz</kernel> <cmdline>(hd0,0)/grub/menu.lst</cmdline> </os> It generates the xm config info: (image (linux (kernel /usr/lib/xen/boot/pv-grub-x86_64.gz) (args '(hd0,0)/grub/menu.lst') (device_model /usr/lib64/xen/bin/qemu-dm) ) ) I call virDomainSetAutostart on the domain and traced it through and saw that it gets the string quoted (args '(hd0,0)/grub/menu.lst') from xen then ends up calling string2sexpr, changes the xend_on_start, and then sexpr2string, and it ends up without quotes (args (hd0,0)/grub/menu.lst) and that is what it sends back to xen. Xen then seems to chop it off to (args ('hd0,0')) Thanks, Tom

3 2

[libvirt] [PATCH] Improve error reporting in test suites
by Daniel P. Berrange 14 Oct '10

14 Oct '10

Before running each test case clear the thread local error indicator. After running each test case, dispatch any error that was reported * tests/testutils.c: Fix error reporting in test suites --- tests/testutils.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/tests/testutils.c b/tests/testutils.c index 8171f10..70e7538 100644 --- a/tests/testutils.c +++ b/tests/testutils.c @@ -124,8 +124,12 @@ virtTestRun(const char *title, int nloops, int (*body)(const void *data), const if (ts) GETTIMEOFDAY(&before); + virResetLastError(); if ((ret = body(data)) != 0) break; + virErrorPtr err = virGetLastError(); + if (err) + virDispatchError(NULL); if (ts) { GETTIMEOFDAY(&after); ts[i] = DIFF_MSEC(&after, &before); -- 1.7.2.3

2 3

[libvirt] [PATCH v3] Added new attribute mount_security to filesystem element
by Harsh Prateek Bora 14 Oct '10

14 Oct '10

This patch introduces new attribute to filesystem element to support customizable security for mount type. Valid mount_security are: passthrough and mapped. Usage: <filesystem type='mount' mount_security='passthrough'> <source dir='/export/to/guest'/> <target dir='mount_tag'/> </filesystem> Here is the detailed explanation on these security models: Security model: mapped ---------------------- Fileserver intercepts and maps all the file object create requests. Files on the fileserver will be created with Fileserver's user credentials and the client-user's credentials are stored in extended attributes. During getattr() server extracts the client-user's credentials from extended attributes and sends to the client. This adds a great deal of security in the cloud environments where the guest's(client) user space is kept completely isolated from host's user space. Security model : passthrough ---------------------------- In this security model, Fileserver passes down all requests to the underlying filesystem. File system objects on the fileserver will be created with client-user's credentials. This is done by setting setuid()/setgid() during creation or chmod/chown after file creation. At the end of create protocol request, files on the fileserver will be owned by cleint-user's uid/gid. This model mimic's current NFSv3 level of security. Note: This patch is based on Daniel's patch to support 9pfs. It shall be applied after applying Daniel's patch to support 9pfs. v3: - QEMU cmdline still uses security_model, changes done by mistake reverted. Signed-off-by: Harsh Prateek Bora <harsh(a)linux.vnet.ibm.com> --- docs/schemas/domain.rng | 6 ++++++ src/conf/domain_conf.c | 29 +++++++++++++++++++++++++++-- src/conf/domain_conf.h | 10 ++++++++++ src/qemu/qemu_conf.c | 9 +++++++-- 4 files changed, 50 insertions(+), 4 deletions(-) diff --git a/docs/schemas/domain.rng b/docs/schemas/domain.rng index ccb8cf3..36eec63 100644 --- a/docs/schemas/domain.rng +++ b/docs/schemas/domain.rng @@ -761,6 +761,12 @@ </choice> <optional> <ref name="address"/> + <attribute name="mount_security"> + <choice> + <value>passthrough</value> + <value>mapped</value> + </choice> + </attribute> </optional> </element> </define> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index e05d5d7..ece6937 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -161,6 +161,11 @@ VIR_ENUM_IMPL(virDomainFS, VIR_DOMAIN_FS_TYPE_LAST, "file", "template") +VIR_ENUM_IMPL(virDomainFSMountSecurity, VIR_DOMAIN_FS_SECURITY_LAST, + "passthrough", + "mapped") + + VIR_ENUM_IMPL(virDomainNet, VIR_DOMAIN_NET_TYPE_LAST, "user", "ethernet", @@ -1847,6 +1852,7 @@ virDomainFSDefParseXML(xmlNodePtr node, char *type = NULL; char *source = NULL; char *target = NULL; + char *mount_security = NULL; if (VIR_ALLOC(def) < 0) { virReportOOMError(); @@ -1864,6 +1870,17 @@ virDomainFSDefParseXML(xmlNodePtr node, def->type = VIR_DOMAIN_FS_TYPE_MOUNT; } + mount_security = virXMLPropString(node, "mount_security"); + if (mount_security) { + if ((def->mount_security = virDomainFSMountSecurityTypeFromString(mount_security)) < 0) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("unknown mount security '%s'"), mount_security); + goto error; + } + } else { + def->mount_security = VIR_DOMAIN_FS_SECURITY_PASSTHROUGH; + } + cur = node->children; while (cur != NULL) { if (cur->type == XML_ELEMENT_NODE) { @@ -5602,6 +5619,7 @@ virDomainFSDefFormat(virBufferPtr buf, int flags) { const char *type = virDomainFSTypeToString(def->type); + const char *mount_sec = virDomainFSMountSecurityTypeToString(def->mount_security); if (!type) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, @@ -5609,9 +5627,16 @@ virDomainFSDefFormat(virBufferPtr buf, return -1; } + if (!mount_sec) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("unexpected mount security %d"), def->mount_security); + return -1; + } + + virBufferVSprintf(buf, - " <filesystem type='%s'>\n", - type); + " <filesystem type='%s' mount_security='%s'>\n", + type, mount_sec); if (def->src) { switch (def->type) { diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 7195c04..3463942 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -236,10 +236,19 @@ enum virDomainFSType { VIR_DOMAIN_FS_TYPE_LAST }; +/* Filesystem mount security model */ +enum virDomainFSMountSecurity { + VIR_DOMAIN_FS_SECURITY_PASSTHROUGH, + VIR_DOMAIN_FS_SECURITY_MAPPED, + + VIR_DOMAIN_FS_SECURITY_LAST +}; + typedef struct _virDomainFSDef virDomainFSDef; typedef virDomainFSDef *virDomainFSDefPtr; struct _virDomainFSDef { int type; + int mount_security; char *src; char *dst; unsigned int readonly : 1; @@ -1167,6 +1176,7 @@ VIR_ENUM_DECL(virDomainDiskErrorPolicy) VIR_ENUM_DECL(virDomainController) VIR_ENUM_DECL(virDomainControllerModel) VIR_ENUM_DECL(virDomainFS) +VIR_ENUM_DECL(virDomainFSMountSecurity) VIR_ENUM_DECL(virDomainNet) VIR_ENUM_DECL(virDomainChrDevice) VIR_ENUM_DECL(virDomainChrChannelTarget) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 18a302a..53ebe5a 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -2014,6 +2014,7 @@ qemuAssignDeviceAliases(virDomainDefPtr def, unsigned long long qemuCmdFlags) if (virAsprintf(&def->fss[i]->info.alias, "fs%d", i) < 0) goto no_memory; } + for (i = 0; i < def->nsounds ; i++) { if (virAsprintf(&def->sounds[i]->info.alias, "sound%d", i) < 0) goto no_memory; @@ -2783,11 +2784,15 @@ char *qemuBuildFSStr(virDomainFSDefPtr fs, if (fs->type != VIR_DOMAIN_FS_TYPE_MOUNT) { qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("can only passthrough directories")); + _("only supports mount filesystem type")); goto error; } - virBufferAddLit(&opt, "local,security_model=passthrough"); + virBufferAddLit(&opt, "local"); + if (fs->mount_security == VIR_DOMAIN_FS_SECURITY_PASSTHROUGH) + virBufferAddLit(&opt, ",security_model=passthrough"); + else if (fs->mount_security == VIR_DOMAIN_FS_SECURITY_MAPPED) + virBufferAddLit(&opt, ",security_model=mapped"); virBufferVSprintf(&opt, ",id=%s%s", QEMU_FSDEV_HOST_PREFIX, fs->info.alias); virBufferVSprintf(&opt, ",path=%s", fs->src); -- 1.7.1.1

5 5

[libvirt] [PATCH] cpu: Fix vendor for recent CPU models
by Jiri Denemark 14 Oct '10

14 Oct '10

Recent CPU models were specified using invalid vendor element <vendor>NAME</vendor>, which was silently ignored due to a bug in the code which was parsing it. --- src/cpu/cpu_map.xml | 12 ++++++------ src/cpu/cpu_x86.c | 11 +++++++++-- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/src/cpu/cpu_map.xml b/src/cpu/cpu_map.xml index edbb21c..75c6522 100644 --- a/src/cpu/cpu_map.xml +++ b/src/cpu/cpu_map.xml @@ -355,7 +355,7 @@ </model> <model name='Conroe'> - <vendor>Intel</vendor> + <vendor name='Intel'/> <feature name='sse2'/> <feature name='sse'/> <feature name='fxsr'/> @@ -386,7 +386,7 @@ </model> <model name='Penryn'> - <vendor>Intel</vendor> + <vendor name='Intel'/> <feature name='sse2'/> <feature name='sse'/> <feature name='fxsr'/> @@ -419,7 +419,7 @@ </model> <model name='Nehalem'> - <vendor>Intel</vendor> + <vendor name='Intel'/> <feature name='sse2'/> <feature name='sse'/> <feature name='fxsr'/> @@ -454,7 +454,7 @@ </model> <model name='Opteron_G1'> - <vendor>AMD</vendor> + <vendor name='AMD'/> <feature name='sse2'/> <feature name='sse'/> <feature name='fxsr'/> @@ -483,7 +483,7 @@ </model> <model name='Opteron_G2'> - <vendor>AMD</vendor> + <vendor name='AMD'/> <feature name='sse2'/> <feature name='sse'/> <feature name='fxsr'/> @@ -516,7 +516,7 @@ </model> <model name='Opteron_G3'> - <vendor>AMD</vendor> + <vendor name='AMD'/> <feature name='sse2'/> <feature name='sse'/> <feature name='fxsr'/> diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c index 1937901..26a5c3f 100644 --- a/src/cpu/cpu_x86.c +++ b/src/cpu/cpu_x86.c @@ -1015,8 +1015,15 @@ x86ModelLoad(xmlXPathContextPtr ctxt, sizeof(*model->cpuid) * model->ncpuid); } - vendor = virXPathString("string(./vendor/@name)", ctxt); - if (vendor) { + if (virXPathBoolean("boolean(./vendor)", ctxt)) { + vendor = virXPathString("string(./vendor/@name)", ctxt); + if (!vendor) { + virCPUReportError(VIR_ERR_INTERNAL_ERROR, + _("Invalid vendor element in CPU model %s"), + model->name); + goto ignore; + } + if (!(model->vendor = x86VendorFind(map, vendor))) { virCPUReportError(VIR_ERR_INTERNAL_ERROR, _("Unknown vendor %s referenced by CPU model %s"), -- 1.7.3.1

2 2

[libvirt] [PATCH] cpu: Use vendor in baseline CPU only if all hosts use it
by Jiri Denemark 14 Oct '10

14 Oct '10

When only some host CPUs given to cpuBaseline contain <vendor> element, baseline CPU should not contain it. Otherwise the result would not be compatible with the host CPUs without vendor. CPU vendors are still taken into account when computing baseline CPU, it's just removed from the result. --- src/cpu/cpu_x86.c | 16 ++++++++++++---- 1 files changed, 12 insertions(+), 4 deletions(-) diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c index 26a5c3f..c6ab871 100644 --- a/src/cpu/cpu_x86.c +++ b/src/cpu/cpu_x86.c @@ -1621,6 +1621,7 @@ x86Baseline(virCPUDefPtr *cpus, unsigned int i; const struct x86_vendor *vendor = NULL; struct x86_model *model = NULL; + bool outputVendor = true; if (!(map = x86LoadMap())) goto error; @@ -1634,8 +1635,9 @@ x86Baseline(virCPUDefPtr *cpus, cpu->type = VIR_CPU_TYPE_GUEST; cpu->match = VIR_CPU_MATCH_EXACT; - if (cpus[0]->vendor && - !(vendor = x86VendorFind(map, cpus[0]->vendor))) { + if (!cpus[0]->vendor) + outputVendor = false; + else if (!(vendor = x86VendorFind(map, cpus[0]->vendor))) { virCPUReportError(VIR_ERR_OPERATION_FAILED, _("Unknown CPU vendor %s"), cpus[0]->vendor); goto error; @@ -1657,8 +1659,11 @@ x86Baseline(virCPUDefPtr *cpus, if (cpus[i]->vendor) vn = cpus[i]->vendor; - else if (model->vendor) - vn = model->vendor->name; + else { + outputVendor = false; + if (model->vendor) + vn = model->vendor->name; + } if (vn) { if (!vendor) { @@ -1694,6 +1699,9 @@ x86Baseline(virCPUDefPtr *cpus, if (x86Decode(cpu, data, models, nmodels, NULL) < 0) goto error; + if (!outputVendor) + VIR_FREE(cpu->vendor); + VIR_FREE(cpu->arch); cleanup: -- 1.7.3.1

2 2

[libvirt] [PATCH 0/2] tests: Make debuging 'make check' failures easier
by Jiri Denemark 14 Oct '10

14 Oct '10

Jiri Denemark (2): tests: Do not override LIBVIRT_DEBUG variable tests: Honor LIBVIRT_{DEBUG,LOG_*} variables tests/Makefile.am | 1 - tests/testutils.c | 1 + 2 files changed, 1 insertions(+), 1 deletions(-) -- 1.7.3.1

2 4

[libvirt] [PATCH] test: silence nwfilter test
by Stefan Berger 14 Oct '10

14 Oct '10

This patch silences the nwfilter test case. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- tests/nwfilterxml2xmltest.c | 120 +++++++++++++++++++++++++++----------------- 1 file changed, 75 insertions(+), 45 deletions(-) Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -4,6 +4,7 @@ #include <stdlib.h> #include <unistd.h> #include <string.h> +#include <stdbool.h> #include <sys/types.h> #include <fcntl.h> @@ -22,7 +23,9 @@ static char *abs_srcdir; #define MAX_FILE 4096 -static int testCompareXMLToXMLFiles(const char *inxml, const char *outxml) { +static int testCompareXMLToXMLFiles(const char *inxml, + const char *outxml, + bool expect_warning) { char inXmlData[MAX_FILE]; char *inXmlPtr = &(inXmlData[0]); char outXmlData[MAX_FILE]; @@ -30,6 +33,7 @@ static int testCompareXMLToXMLFiles(cons char *actual = NULL; int ret = -1; virNWFilterDefPtr dev = NULL; + char *log; if (virtTestLoadFile(inxml, &inXmlPtr, MAX_FILE) < 0) goto fail; @@ -39,6 +43,20 @@ static int testCompareXMLToXMLFiles(cons if (!(dev = virNWFilterDefParseString(NULL, inXmlData))) goto fail; + if ((log = virtTestLogContentAndReset()) == NULL) + goto fail; + + if ((*log != '\0') != expect_warning) { + free(log); + goto fail; + } + free(log); + + if (expect_warning) { + /* need to suppress the errors */ + virResetLastError(); + } + if (!(actual = virNWFilterDefFormat(dev))) goto fail; @@ -55,14 +73,20 @@ static int testCompareXMLToXMLFiles(cons return ret; } +typedef struct test_parms { + const char *name; + bool expect_warning; +} test_parms; + static int testCompareXMLToXMLHelper(const void *data) { + const test_parms *tp = data; char inxml[PATH_MAX]; char outxml[PATH_MAX]; snprintf(inxml, PATH_MAX, "%s/nwfilterxml2xmlin/%s.xml", - abs_srcdir, (const char*)data); + abs_srcdir, tp->name); snprintf(outxml, PATH_MAX, "%s/nwfilterxml2xmlout/%s.xml", - abs_srcdir, (const char*)data); - return testCompareXMLToXMLFiles(inxml, outxml); + abs_srcdir, tp->name); + return testCompareXMLToXMLFiles(inxml, outxml, !!tp->expect_warning); } @@ -83,51 +107,57 @@ mymain(int argc, char **argv) if (!abs_srcdir) abs_srcdir = getcwd(cwd, sizeof(cwd)); -#define DO_TEST(name) \ - if (virtTestRun("NWFilter XML-2-XML " name, \ - 1, testCompareXMLToXMLHelper, (name)) < 0) \ - ret = -1 - - DO_TEST("mac-test"); - DO_TEST("arp-test"); - DO_TEST("rarp-test"); - DO_TEST("ip-test"); - DO_TEST("ipv6-test"); - - DO_TEST("tcp-test"); - DO_TEST("udp-test"); - DO_TEST("icmp-test"); - DO_TEST("igmp-test"); - DO_TEST("sctp-test"); - DO_TEST("udplite-test"); - DO_TEST("esp-test"); - DO_TEST("ah-test"); - DO_TEST("all-test"); - - DO_TEST("tcp-ipv6-test"); - DO_TEST("udp-ipv6-test"); - DO_TEST("icmpv6-test"); - DO_TEST("sctp-ipv6-test"); - DO_TEST("udplite-ipv6-test"); - DO_TEST("esp-ipv6-test"); - DO_TEST("ah-ipv6-test"); - DO_TEST("all-ipv6-test"); - - DO_TEST("ref-test"); - DO_TEST("ref-rule-test"); - DO_TEST("ipt-no-macspoof-test"); - DO_TEST("icmp-direction-test"); - DO_TEST("icmp-direction2-test"); - DO_TEST("icmp-direction3-test"); +#define DO_TEST(NAME, EXPECT_WARN) \ + do { \ + test_parms tp = { \ + .name = NAME, \ + .expect_warning = EXPECT_WARN, \ + }; \ + if (virtTestRun("NWFilter XML-2-XML " NAME, \ + 1, testCompareXMLToXMLHelper, (&tp)) < 0) \ + ret = -1; \ + } while (0) + + DO_TEST("mac-test", true); + DO_TEST("arp-test", true); + DO_TEST("rarp-test", true); + DO_TEST("ip-test", true); + DO_TEST("ipv6-test", true); + + DO_TEST("tcp-test", true); + DO_TEST("udp-test", true); + DO_TEST("icmp-test", true); + DO_TEST("igmp-test", false); + DO_TEST("sctp-test", true); + DO_TEST("udplite-test", false); + DO_TEST("esp-test", false); + DO_TEST("ah-test", false); + DO_TEST("all-test", false); + + DO_TEST("tcp-ipv6-test", true); + DO_TEST("udp-ipv6-test", true); + DO_TEST("icmpv6-test", true); + DO_TEST("sctp-ipv6-test", true); + DO_TEST("udplite-ipv6-test", true); + DO_TEST("esp-ipv6-test", true); + DO_TEST("ah-ipv6-test", true); + DO_TEST("all-ipv6-test", true); + + DO_TEST("ref-test", false); + DO_TEST("ref-rule-test", false); + DO_TEST("ipt-no-macspoof-test", false); + DO_TEST("icmp-direction-test", false); + DO_TEST("icmp-direction2-test", false); + DO_TEST("icmp-direction3-test", false); - DO_TEST("conntrack-test"); + DO_TEST("conntrack-test", false); - DO_TEST("hex-data-test"); + DO_TEST("hex-data-test", true); - DO_TEST("comment-test"); + DO_TEST("comment-test", true); - DO_TEST("example-1"); - DO_TEST("example-2"); + DO_TEST("example-1", false); + DO_TEST("example-2", false); return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); }

2 2

[libvirt] [PATCH] nwfilter: cut off connections after changing filters
by Stefan Berger 14 Oct '10

14 Oct '10

The following filter transition from a filter allowing incoming TCP connections <rule action='accept' direction='in' priority='401'> <tcp/> </rule> <rule action='accept' direction='out' priority='500'> <tcp/> </rule> to one that does not allow them <rule action='drop' direction='in' priority='401'> <tcp/> </rule> <rule action='accept' direction='out' priority='500'> <tcp/> </rule> did previously not cut off existing (ssh) connections but only prevented newly initiated ones. The attached patch allows to cut off existing connections as well, thus enforcing what the filter is showing. I had only tested with a configuration where the physical interface is connected to the bridge where the filters are applied. This patch now also solves a filtering problem where the physical interface is not connected to the bridge, but the bridge is given an IP address and the host routes between bridge and physical interface. Here the filters drop non-allowed traffic on the outgoing side on the host. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -1100,6 +1100,19 @@ err_exit: return 1; } + +static void +iptablesEnforceDirection(int directionIn, + virNWFilterRuleDefPtr rule, + virBufferPtr buf) +{ + if (rule->tt != VIR_NWFILTER_RULE_DIRECTION_INOUT) + virBufferVSprintf(buf, " -m conntrack --ctdir %s", + (directionIn) ? "Original" + : "Reply"); +} + + /* * _iptablesCreateRuleInstance: * @chainPrefix : The prefix to put in front of the name of the chain @@ -1494,6 +1507,10 @@ _iptablesCreateRuleInstance(int directio if (match && !skipMatch) virBufferVSprintf(&buf, " %s", match); + if (defMatch && match != NULL) + iptablesEnforceDirection(directionIn, + rule, + &buf); virBufferVSprintf(&buf, " -j %s" CMD_DEF_POST CMD_SEPARATOR

2 1

[libvirt] [PATCH] Fix Xen SEXPR generation to properly quote strings containing ()
by Daniel P. Berrange 13 Oct '10

13 Oct '10

* src/xen/sexpr.c: Ensure () are escaped in sexpr2string * tests/sexpr2xmldata/sexpr2xml-boot-grub.sexpr, tests/sexpr2xmldata/sexpr2xml-boot-grub.xml, tests/xml2sexprdata/xml2sexpr-boot-grub.sexpr, tests/xml2sexprdata/xml2sexpr-boot-grub.xml: Data files to check escaping * tests/sexpr2xmltest.c, tests/xml2sexprtest.c: Add boot-grub escaping test case --- src/xen/sexpr.c | 4 ++- tests/sexpr2xmldata/sexpr2xml-boot-grub.sexpr | 1 + tests/sexpr2xmldata/sexpr2xml-boot-grub.xml | 26 +++++++++++++++++++++++++ tests/sexpr2xmltest.c | 2 + tests/xml2sexprdata/xml2sexpr-boot-grub.sexpr | 1 + tests/xml2sexprdata/xml2sexpr-boot-grub.xml | 21 ++++++++++++++++++++ tests/xml2sexprtest.c | 2 + 7 files changed, 56 insertions(+), 1 deletions(-) create mode 100644 tests/sexpr2xmldata/sexpr2xml-boot-grub.sexpr create mode 100644 tests/sexpr2xmldata/sexpr2xml-boot-grub.xml create mode 100644 tests/xml2sexprdata/xml2sexpr-boot-grub.sexpr create mode 100644 tests/xml2sexprdata/xml2sexpr-boot-grub.xml diff --git a/src/xen/sexpr.c b/src/xen/sexpr.c index 2184060..330280e 100644 --- a/src/xen/sexpr.c +++ b/src/xen/sexpr.c @@ -244,7 +244,9 @@ sexpr2string(const struct sexpr * sexpr, char *buffer, size_t n_buffer) ret += tmp; break; case SEXPR_VALUE: - if (strchr(sexpr->u.value, ' ')) + if (strchr(sexpr->u.value, ' ') || + strchr(sexpr->u.value, ')') || + strchr(sexpr->u.value, '(')) tmp = snprintf(buffer + ret, n_buffer - ret, "'%s'", sexpr->u.value); else diff --git a/tests/sexpr2xmldata/sexpr2xml-boot-grub.sexpr b/tests/sexpr2xmldata/sexpr2xml-boot-grub.sexpr new file mode 100644 index 0000000..f42fc32 --- /dev/null +++ b/tests/sexpr2xmldata/sexpr2xml-boot-grub.sexpr @@ -0,0 +1 @@ +(domain (domid 6)(name 'pvtest')(memory 420)(maxmem 420)(vcpus 2)(uuid '596a5d2171f48fb2e068e2386a5c413e')(on_poweroff 'destroy')(on_reboot 'destroy')(on_crash 'destroy')(image (linux (kernel '/usr/lib/xen/boot/pv-grub-x86_64.gz')(args '(hd0,0)/grub/menu.lst')))(device (vbd (dev 'xvda')(uname 'phy:/dev/MainVG/GuestVG')(mode 'w')))) diff --git a/tests/sexpr2xmldata/sexpr2xml-boot-grub.xml b/tests/sexpr2xmldata/sexpr2xml-boot-grub.xml new file mode 100644 index 0000000..9221bdd --- /dev/null +++ b/tests/sexpr2xmldata/sexpr2xml-boot-grub.xml @@ -0,0 +1,26 @@ +<domain type='xen' id='6'> + <name>pvtest</name> + <uuid>596a5d21-71f4-8fb2-e068-e2386a5c413e</uuid> + <memory>430080</memory> + <currentMemory>430080</currentMemory> + <vcpu>2</vcpu> + <os> + <type>linux</type> + <kernel>/usr/lib/xen/boot/pv-grub-x86_64.gz</kernel> + <cmdline>(hd0,0)/grub/menu.lst</cmdline> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>destroy</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='block' device='disk'> + <driver name='phy'/> + <source dev='/dev/MainVG/GuestVG'/> + <target dev='xvda' bus='xen'/> + </disk> + <console type='pty'> + <target type='xen' port='0'/> + </console> + </devices> +</domain> diff --git a/tests/sexpr2xmltest.c b/tests/sexpr2xmltest.c index 8c75c52..d62b44f 100644 --- a/tests/sexpr2xmltest.c +++ b/tests/sexpr2xmltest.c @@ -172,6 +172,8 @@ mymain(int argc, char **argv) DO_TEST("fv-net-ioemu", "fv-net-ioemu", 1); DO_TEST("fv-net-netfront", "fv-net-netfront", 1); + DO_TEST("boot-grub", "boot-grub", 1); + virCapabilitiesFree(caps); return(ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); diff --git a/tests/xml2sexprdata/xml2sexpr-boot-grub.sexpr b/tests/xml2sexprdata/xml2sexpr-boot-grub.sexpr new file mode 100644 index 0000000..a9d14df --- /dev/null +++ b/tests/xml2sexprdata/xml2sexpr-boot-grub.sexpr @@ -0,0 +1 @@ +(vm (name 'pvtest')(memory 420)(maxmem 420)(vcpus 2)(uuid '596a5d21-71f4-8fb2-e068-e2386a5c413e')(on_poweroff 'destroy')(on_reboot 'destroy')(on_crash 'destroy')(image (linux (kernel '/usr/lib/xen/boot/pv-grub-x86_64.gz')(args (hd0,0)/grub/menu.lst)))(device (vbd (dev 'xvda')(uname 'phy:/dev/MainVG/GuestLV')(mode 'w')))) \ No newline at end of file diff --git a/tests/xml2sexprdata/xml2sexpr-boot-grub.xml b/tests/xml2sexprdata/xml2sexpr-boot-grub.xml new file mode 100644 index 0000000..b9b1c9f --- /dev/null +++ b/tests/xml2sexprdata/xml2sexpr-boot-grub.xml @@ -0,0 +1,21 @@ +<domain type='xen' id='15'> + <name>pvtest</name> + <uuid>596a5d2171f48fb2e068e2386a5c413e</uuid> + <os> + <type>linux</type> + <kernel>/usr/lib/xen/boot/pv-grub-x86_64.gz</kernel> + <cmdline>(hd0,0)/grub/menu.lst</cmdline> + </os> + <memory>430080</memory> + <vcpu>2</vcpu> + <on_poweroff>destroy</on_poweroff> + <on_reboot>destroy</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='block' device='disk'> + <source dev='/dev/MainVG/GuestLV'/> + <target dev='xvda'/> + </disk> + <console tty='/dev/pts/4'/> + </devices> +</domain> diff --git a/tests/xml2sexprtest.c b/tests/xml2sexprtest.c index 49b7574..77cf760 100644 --- a/tests/xml2sexprtest.c +++ b/tests/xml2sexprtest.c @@ -161,6 +161,8 @@ mymain(int argc, char **argv) DO_TEST("fv-net-ioemu", "fv-net-ioemu", "fvtest", 1); DO_TEST("fv-net-netfront", "fv-net-netfront", "fvtest", 1); + DO_TEST("boot-grub", "boot-grub", "fvtest", 1); + virCapabilitiesFree(caps); return(ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); -- 1.7.2.3

2 3

[libvirt] [PATCH] Fix several minor problems introduced by the memtune series
by Matthias Bolte 13 Oct '10

13 Oct '10

Add proper documentation to the new VIR_DOMAIN_MEMORY_* macros in libvirt.h.in to placate apibuild.py. Mark args as unused in for libvirt_virDomain{Get,Set}MemoryParameters in the Python bindings and add both to the libvirtMethods array. Update remote_protocol-structs to placate make syntax-check. Undo unintended modifications in vboxDomainGetInfo. Update the function table of the VirtualBox and XenAPI drivers. --- include/libvirt/libvirt.h.in | 28 ++++++++++++++++++++++++++++ python/libvirt-override.c | 6 ++++-- src/remote_protocol-structs | 35 +++++++++++++++++++++++++++++++++++ src/vbox/vbox_tmpl.c | 6 ++++-- src/xenapi/xenapi_driver.c | 2 ++ 5 files changed, 73 insertions(+), 4 deletions(-) diff --git a/include/libvirt/libvirt.h.in b/include/libvirt/libvirt.h.in index e244eac..ca8e6fa 100644 --- a/include/libvirt/libvirt.h.in +++ b/include/libvirt/libvirt.h.in @@ -695,9 +695,37 @@ typedef enum { */ #define VIR_DOMAIN_MEMORY_FIELD_LENGTH 80 + +/** + * VIR_DOMAIN_MEMORY_HARD_LIMIT: + * + * Macro for the well-known tunable hard_limit. + */ + #define VIR_DOMAIN_MEMORY_HARD_LIMIT "hard_limit" + +/** + * VIR_DOMAIN_MEMORY_SOFT_LIMIT: + * + * Macro for the well-known tunable soft_limit. + */ + #define VIR_DOMAIN_MEMORY_SOFT_LIMIT "soft_limit" + +/** + * VIR_DOMAIN_MEMORY_MIN_GUARANTEE: + * + * Macro for the well-known tunable min_guarantee. + */ + #define VIR_DOMAIN_MEMORY_MIN_GUARANTEE "min_guarantee" + +/** + * VIR_DOMAIN_SWAP_HARD_LIMIT: + * + * Macro for the well-known tunable swap_hard_limit. + */ + #define VIR_DOMAIN_SWAP_HARD_LIMIT "swap_hard_limit" /** diff --git a/python/libvirt-override.c b/python/libvirt-override.c index c43ab15..4a03d72 100644 --- a/python/libvirt-override.c +++ b/python/libvirt-override.c @@ -374,14 +374,14 @@ libvirt_virDomainSetSchedulerParameters(PyObject *self ATTRIBUTE_UNUSED, /* FIXME: This is a place holder for the implementation. */ static PyObject * libvirt_virDomainSetMemoryParameters(PyObject *self ATTRIBUTE_UNUSED, - PyObject *args) { + PyObject *args ATTRIBUTE_UNUSED) { return VIR_PY_INT_FAIL; } /* FIXME: This is a place holder for the implementation. */ static PyObject * libvirt_virDomainGetMemoryParameters(PyObject *self ATTRIBUTE_UNUSED, - PyObject *args) { + PyObject *args ATTRIBUTE_UNUSED) { return VIR_PY_INT_FAIL; } @@ -3532,6 +3532,8 @@ static PyMethodDef libvirtMethods[] = { {(char *) "virDomainGetSchedulerType", libvirt_virDomainGetSchedulerType, METH_VARARGS, NULL}, {(char *) "virDomainGetSchedulerParameters", libvirt_virDomainGetSchedulerParameters, METH_VARARGS, NULL}, {(char *) "virDomainSetSchedulerParameters", libvirt_virDomainSetSchedulerParameters, METH_VARARGS, NULL}, + {(char *) "virDomainSetMemoryParameters", libvirt_virDomainSetMemoryParameters, METH_VARARGS, NULL}, + {(char *) "virDomainGetMemoryParameters", libvirt_virDomainGetMemoryParameters, METH_VARARGS, NULL}, {(char *) "virDomainGetVcpus", libvirt_virDomainGetVcpus, METH_VARARGS, NULL}, {(char *) "virDomainPinVcpu", libvirt_virDomainPinVcpu, METH_VARARGS, NULL}, {(char *) "virConnectListStoragePools", libvirt_virConnectListStoragePools, METH_VARARGS, NULL}, diff --git a/src/remote_protocol-structs b/src/remote_protocol-structs index a5fc6aa..838423e 100644 --- a/src/remote_protocol-structs +++ b/src/remote_protocol-structs @@ -70,6 +70,21 @@ struct remote_sched_param { remote_nonnull_string field; remote_sched_param_value value; }; +struct remote_memory_param_value { + int type; + union { + int i; + u_int ui; + int64_t l; + uint64_t ul; + double d; + int b; + } remote_memory_param_value_u; +}; +struct remote_memory_param { + remote_nonnull_string field; + remote_memory_param_value value; +}; struct remote_open_args { remote_string name; int flags; @@ -151,6 +166,26 @@ struct remote_domain_set_scheduler_parameters_args { remote_sched_param * params_val; } params; }; +struct remote_domain_set_memory_parameters_args { + remote_nonnull_domain dom; + struct { + u_int params_len; + remote_memory_param * params_val; + } params; + u_int flags; +}; +struct remote_domain_get_memory_parameters_args { + remote_nonnull_domain dom; + int nparams; + u_int flags; +}; +struct remote_domain_get_memory_parameters_ret { + struct { + u_int params_len; + remote_memory_param * params_val; + } params; + int nparams; +}; struct remote_domain_block_stats_args { remote_nonnull_domain dom; remote_nonnull_string path; diff --git a/src/vbox/vbox_tmpl.c b/src/vbox/vbox_tmpl.c index 65bfd9e..7e7d8e4 100644 --- a/src/vbox/vbox_tmpl.c +++ b/src/vbox/vbox_tmpl.c @@ -1734,8 +1734,8 @@ static int vboxDomainGetInfo(virDomainPtr dom, virDomainInfoPtr info) { info->cpuTime = 0; info->nrVirtCpu = CPUCount; - info->mem.cur_balloon = memorySize * 1024; - info->mem.max_balloon = maxMemorySize * 1024; + info->memory = memorySize * 1024; + info->maxMem = maxMemorySize * 1024; switch(state) { case MachineState_Running: info->state = VIR_DOMAIN_RUNNING; @@ -8344,6 +8344,8 @@ virDriver NAME(Driver) = { vboxDomainRevertToSnapshot, /* domainRevertToSnapshot */ vboxDomainSnapshotDelete, /* domainSnapshotDelete */ NULL, /* qemuDomainMonitorCommand */ + NULL, /* domainSetMemoryParameters */ + NULL, /* domainGetMemoryParameters */ }; virNetworkDriver NAME(NetworkDriver) = { diff --git a/src/xenapi/xenapi_driver.c b/src/xenapi/xenapi_driver.c index ad5b5d8..e62a139 100644 --- a/src/xenapi/xenapi_driver.c +++ b/src/xenapi/xenapi_driver.c @@ -1821,6 +1821,8 @@ static virDriver xenapiDriver = { NULL, /* domainRevertToSnapshot */ NULL, /* domainSnapshotDelete */ NULL, /* qemuDomainMonitorCommand */ + NULL, /* domainSetMemoryParameters */ + NULL, /* domainGetMemoryParameters */ }; /** -- 1.7.0.4

3 5

[libvirt] [PATCH] Enable support for nested SVM (v4)
by Daniel P. Berrange 13 Oct '10

13 Oct '10

This enables support for nested SVM using the regular CPU model/features block. If the CPU model or features include 'svm', then the '-enable-nesting' flag will be added to the QEMU command line. Latest out of tree patches for nested 'vmx', no longer require the '-enable-nesting' flag. They instead just look at the cpu features. Several of the models already include svm support, but QEMU was just masking out the svm bit silently. So this will enable SVM on such models In v4: changed bool to int to allow error code propagation * src/qemu/qemu_conf.h: flag for -enable-nesting * src/qemu/qemu_conf.c: Use -enable-nesting if VMX or SVM are in the CPUID * src/cpu/cpu.h, src/cpu/cpu.c: API to check for a named feature * src/cpu/cpu_x86.c: x86 impl of feature check * src/libvirt_private.syms: Add cpuHasFeature * src/qemuhelptest.c: Add nesting flag where required --- src/cpu/cpu.c | 24 ++++++++++++++++++++++++ src/cpu/cpu.h | 11 +++++++++++ src/cpu/cpu_x86.c | 30 ++++++++++++++++++++++++++++++ src/libvirt_private.syms | 1 + src/qemu/qemu_conf.c | 24 ++++++++++++++++++++++-- src/qemu/qemu_conf.h | 1 + tests/qemuhelptest.c | 12 ++++++++---- 7 files changed, 97 insertions(+), 6 deletions(-) diff --git a/src/cpu/cpu.c b/src/cpu/cpu.c index def6974..62db3fe 100644 --- a/src/cpu/cpu.c +++ b/src/cpu/cpu.c @@ -424,3 +424,27 @@ cpuUpdate(virCPUDefPtr guest, return driver->update(guest, host); } + +int +cpuHasFeature(const char *arch, + const union cpuData *data, + const char *feature) +{ + struct cpuArchDriver *driver; + + VIR_DEBUG("arch=%s, data=%p, feature=%s", + arch, data, feature); + + if ((driver = cpuGetSubDriver(arch)) == NULL) + return -1; + + if (driver->hasFeature == NULL) { + virCPUReportError(VIR_ERR_NO_SUPPORT, + _("cannot check guest CPU data for %s architecture"), + arch); + return -1; + } + + return driver->hasFeature(data, feature); +} + diff --git a/src/cpu/cpu.h b/src/cpu/cpu.h index a745917..76d0e8e 100644 --- a/src/cpu/cpu.h +++ b/src/cpu/cpu.h @@ -82,6 +82,10 @@ typedef int (*cpuArchUpdate) (virCPUDefPtr guest, const virCPUDefPtr host); +typedef int +(*cpuArchHasFeature) (const union cpuData *data, + const char *feature); + struct cpuArchDriver { const char *name; @@ -95,6 +99,7 @@ struct cpuArchDriver { cpuArchGuestData guestData; cpuArchBaseline baseline; cpuArchUpdate update; + cpuArchHasFeature hasFeature; }; @@ -151,4 +156,10 @@ extern int cpuUpdate (virCPUDefPtr guest, const virCPUDefPtr host); +extern int +cpuHasFeature(const char *arch, + const union cpuData *data, + const char *feature); + + #endif /* __VIR_CPU_H__ */ diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c index 1937901..813b499 100644 --- a/src/cpu/cpu_x86.c +++ b/src/cpu/cpu_x86.c @@ -1754,6 +1754,35 @@ cleanup: return ret; } +static int x86HasFeature(const union cpuData *data, + const char *name) +{ + struct x86_map *map; + struct x86_feature *feature; + int ret = -1; + int i; + + if (!(map = x86LoadMap())) + return -1; + + if (!(feature = x86FeatureFind(map, name))) + goto cleanup; + + for (i = 0 ; i < feature->ncpuid ; i++) { + struct cpuX86cpuid *cpuid; + + cpuid = x86DataCpuid(data, feature->cpuid[i].function); + if (cpuid && x86cpuidMatchMasked(cpuid, feature->cpuid + i)) { + ret = 1; + goto cleanup; + } + } + ret = 0; + +cleanup: + x86MapFree(map); + return ret; +} struct cpuArchDriver cpuDriverX86 = { .name = "x86", @@ -1771,4 +1800,5 @@ struct cpuArchDriver cpuDriverX86 = { .guestData = x86GuestData, .baseline = x86Baseline, .update = x86Update, + .hasFeature = x86HasFeature, }; diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 1d8ea95..966289b 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -96,6 +96,7 @@ cpuEncode; cpuGuestData; cpuNodeData; cpuUpdate; +cpuHasFeature; # cpu_conf.h diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 16145b0..de14f92 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -1211,6 +1211,8 @@ static unsigned long long qemudComputeCmdFlags(const char *help, flags |= QEMUD_CMD_FLAG_NO_KVM_PIT; if (strstr(help, "-tdf")) flags |= QEMUD_CMD_FLAG_TDF; + if (strstr(help, "-enable-nesting")) + flags |= QEMUD_CMD_FLAG_NESTING; if (strstr(help, ",menu=on")) flags |= QEMUD_CMD_FLAG_BOOT_MENU; if (strstr(help, "-fsdev")) @@ -3577,7 +3579,8 @@ qemuBuildCpuArgStr(const struct qemud_driver *driver, const char *emulator, unsigned long long qemuCmdFlags, const struct utsname *ut, - char **opt) + char **opt, + bool *hasHwVirt) { const virCPUDefPtr host = driver->caps->host.cpu; virCPUDefPtr guest = NULL; @@ -3588,6 +3591,8 @@ qemuBuildCpuArgStr(const struct qemud_driver *driver, virBuffer buf = VIR_BUFFER_INITIALIZER; int i; + *hasHwVirt = false; + if (def->cpu && def->cpu->model) { if (qemudProbeCPUModels(emulator, qemuCmdFlags, ut->machine, &ncpus, &cpus) < 0) @@ -3603,6 +3608,7 @@ qemuBuildCpuArgStr(const struct qemud_driver *driver, if (ncpus > 0 && host) { virCPUCompareResult cmp; const char *preferred; + int hasSVM; cmp = cpuGuestData(host, def->cpu, &data); switch (cmp) { @@ -3629,6 +3635,14 @@ qemuBuildCpuArgStr(const struct qemud_driver *driver, if (cpuDecode(guest, data, cpus, ncpus, preferred) < 0) goto cleanup; + /* Only 'svm' requires --enable-nesting. The nested + * 'vmx' patches now simply hook off the CPU features + */ + hasSVM = cpuHasFeature(guest->arch, data, "svm"); + if (hasSVM < 0) + goto cleanup; + *hasHwVirt = hasSVM > 0 ? true : false; + virBufferVSprintf(&buf, "%s", guest->model); for (i = 0; i < guest->nfeatures; i++) { char sign; @@ -3755,6 +3769,7 @@ int qemudBuildCommandLine(virConnectPtr conn, char *cpu; char *smp; int last_good_net = -1; + bool hasHwVirt = false; uname_normalize(&ut); @@ -3948,13 +3963,18 @@ int qemudBuildCommandLine(virConnectPtr conn, ADD_ARG_LIT(def->os.machine); } - if (qemuBuildCpuArgStr(driver, def, emulator, qemuCmdFlags, &ut, &cpu) < 0) + if (qemuBuildCpuArgStr(driver, def, emulator, qemuCmdFlags, + &ut, &cpu, &hasHwVirt) < 0) goto error; if (cpu) { ADD_ARG_LIT("-cpu"); ADD_ARG_LIT(cpu); VIR_FREE(cpu); + + if ((qemuCmdFlags & QEMUD_CMD_FLAG_NESTING) && + hasHwVirt) + ADD_ARG_LIT("-enable-nesting"); } if (disableKQEMU) diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index fbd89de..d2e6857 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -94,6 +94,7 @@ enum qemud_cmd_flags { QEMUD_CMD_FLAG_BOOT_MENU = (1LL << 38), /* -boot menu=on support */ QEMUD_CMD_FLAG_ENABLE_KQEMU = (1LL << 39), /* -enable-kqemu flag */ QEMUD_CMD_FLAG_FSDEV = (1LL << 40), /* -fstype filesystem passthrough */ + QEMUD_CMD_FLAG_NESTING = (1LL << 41), /* -enable-nesting (SVM/VMX) */ }; /* Main driver state */ diff --git a/tests/qemuhelptest.c b/tests/qemuhelptest.c index 56a49fd..d072cb0 100644 --- a/tests/qemuhelptest.c +++ b/tests/qemuhelptest.c @@ -171,7 +171,8 @@ mymain(int argc, char **argv) QEMUD_CMD_FLAG_RTC_TD_HACK | QEMUD_CMD_FLAG_NO_HPET | QEMUD_CMD_FLAG_NO_KVM_PIT | - QEMUD_CMD_FLAG_TDF, + QEMUD_CMD_FLAG_TDF | + QEMUD_CMD_FLAG_NESTING, 10005, 1, 0); DO_TEST("kvm-86", QEMUD_CMD_FLAG_VNC_COLON | @@ -194,7 +195,8 @@ mymain(int argc, char **argv) QEMUD_CMD_FLAG_RTC_TD_HACK | QEMUD_CMD_FLAG_NO_HPET | QEMUD_CMD_FLAG_NO_KVM_PIT | - QEMUD_CMD_FLAG_TDF, + QEMUD_CMD_FLAG_TDF | + QEMUD_CMD_FLAG_NESTING, 10050, 1, 0); DO_TEST("qemu-kvm-0.11.0-rc2", QEMUD_CMD_FLAG_VNC_COLON | @@ -221,7 +223,8 @@ mymain(int argc, char **argv) QEMUD_CMD_FLAG_NO_HPET | QEMUD_CMD_FLAG_NO_KVM_PIT | QEMUD_CMD_FLAG_TDF | - QEMUD_CMD_FLAG_BOOT_MENU, + QEMUD_CMD_FLAG_BOOT_MENU | + QEMUD_CMD_FLAG_NESTING, 10092, 1, 0); DO_TEST("qemu-0.12.1", QEMUD_CMD_FLAG_VNC_COLON | @@ -277,7 +280,8 @@ mymain(int argc, char **argv) QEMUD_CMD_FLAG_NO_HPET | QEMUD_CMD_FLAG_NO_KVM_PIT | QEMUD_CMD_FLAG_TDF | - QEMUD_CMD_FLAG_BOOT_MENU, + QEMUD_CMD_FLAG_BOOT_MENU | + QEMUD_CMD_FLAG_NESTING, 12003, 1, 0); return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; -- 1.7.2.3

3 2