- Devel - libvirt List Archives

[libvirt] Ephemeral VM operation
by Dave Allan 09 Oct '10

09 Oct '10

A number of hypervisors have a mode in which changes made to storage are not persisted across a reboot of the VM. qemu uses the -snapshot flag; VMware refers to this functionality as non-persistent disk[1]. Is this functionality something that is interesting to libvirt? Dave [1] http://www.virtuesofvirtualization.com/2006/10/magic-of-nonpersistent-drive…

4 3

[libvirt] [PATCH] Pass -n to ip(6)tables
by Guido Günther 08 Oct '10

08 Oct '10

Hi, attached patch passes -n to ip(6)tables to avoid long timeouts waiting for DNS servers. O.k. to apply? Cheers, -- Guido

2 2

[libvirt] [PATCH] Added new attribute security_model to filesystem element
by Harsh Prateek Bora 07 Oct '10

07 Oct '10

This patch introduces new attribute to filesystem element to support customizable security_model for mount type. Valid security_model are: passthrough, mapped and none. Usage: <filesystem type='mount' security_model='passthrough'> <source dir='/export/to/guest'/> <target dir='mount_tag'/> </filesystem> Note: This patch is based on Daniel's patch to support 9pfs. It shall be applied after applying Daniel's patch to support 9pfs. Signed-off-by: Harsh Prateek Bora <harsh(a)linux.vnet.ibm.com> --- docs/schemas/domain.rng | 7 +++++++ src/conf/domain_conf.c | 30 ++++++++++++++++++++++++++++-- src/conf/domain_conf.h | 10 ++++++++++ src/qemu/qemu_conf.c | 11 +++++++++-- 4 files changed, 54 insertions(+), 4 deletions(-) diff --git a/docs/schemas/domain.rng b/docs/schemas/domain.rng index ccb8cf3..43a292d 100644 --- a/docs/schemas/domain.rng +++ b/docs/schemas/domain.rng @@ -761,6 +761,13 @@ </choice> <optional> <ref name="address"/> + <attribute name="security_model"> + <choice> + <value>passthrough</value> + <value>mapped</value> + <value>none</value> + </choice> + </attribute> </optional> </element> </define> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index e05d5d7..a9881d1 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -161,6 +161,12 @@ VIR_ENUM_IMPL(virDomainFS, VIR_DOMAIN_FS_TYPE_LAST, "file", "template") +VIR_ENUM_IMPL(virDomainFSSecurityModel, VIR_DOMAIN_FS_SECURITY_LAST, + "passthrough", + "mapped", + "none") + + VIR_ENUM_IMPL(virDomainNet, VIR_DOMAIN_NET_TYPE_LAST, "user", "ethernet", @@ -1847,6 +1853,7 @@ virDomainFSDefParseXML(xmlNodePtr node, char *type = NULL; char *source = NULL; char *target = NULL; + char *security_model; if (VIR_ALLOC(def) < 0) { virReportOOMError(); @@ -1864,6 +1871,17 @@ virDomainFSDefParseXML(xmlNodePtr node, def->type = VIR_DOMAIN_FS_TYPE_MOUNT; } + security_model = virXMLPropString(node, "security_model"); + if (security_model) { + if ((def->security_model = virDomainFSSecurityModelTypeFromString(security_model)) < 0) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("unknown security model '%s'"), security_model); + goto error; + } + } else { + def->security_model = VIR_DOMAIN_FS_SECURITY_PASSTHROUGH; + } + cur = node->children; while (cur != NULL) { if (cur->type == XML_ELEMENT_NODE) { @@ -5602,6 +5620,7 @@ virDomainFSDefFormat(virBufferPtr buf, int flags) { const char *type = virDomainFSTypeToString(def->type); + const char *sec_model = virDomainFSSecurityModelTypeToString(def->security_model); if (!type) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, @@ -5609,9 +5628,16 @@ virDomainFSDefFormat(virBufferPtr buf, return -1; } + if (!sec_model) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("unexpected security model %d"), def->security_model); + return -1; + } + + virBufferVSprintf(buf, - " <filesystem type='%s'>\n", - type); + " <filesystem type='%s' security_model='%s'>\n", + type, sec_model); if (def->src) { switch (def->type) { diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 7195c04..6adf027 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -236,10 +236,20 @@ enum virDomainFSType { VIR_DOMAIN_FS_TYPE_LAST }; +/* Filesystem mount security model */ +enum virDomainFSSecurityModel { + VIR_DOMAIN_FS_SECURITY_PASSTHROUGH, + VIR_DOMAIN_FS_SECURITY_MAPPED, + VIR_DOMAIN_FS_SECURITY_NONE, + + VIR_DOMAIN_FS_SECURITY_LAST +}; + typedef struct _virDomainFSDef virDomainFSDef; typedef virDomainFSDef *virDomainFSDefPtr; struct _virDomainFSDef { int type; + int security_model; char *src; char *dst; unsigned int readonly : 1; diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 18a302a..6b96d2f 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -2014,6 +2014,7 @@ qemuAssignDeviceAliases(virDomainDefPtr def, unsigned long long qemuCmdFlags) if (virAsprintf(&def->fss[i]->info.alias, "fs%d", i) < 0) goto no_memory; } + for (i = 0; i < def->nsounds ; i++) { if (virAsprintf(&def->sounds[i]->info.alias, "sound%d", i) < 0) goto no_memory; @@ -2783,11 +2784,17 @@ char *qemuBuildFSStr(virDomainFSDefPtr fs, if (fs->type != VIR_DOMAIN_FS_TYPE_MOUNT) { qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("can only passthrough directories")); + _("only supports mount filesystem type")); goto error; } - virBufferAddLit(&opt, "local,security_model=passthrough"); + virBufferAddLit(&opt, "local"); + if (fs->security_model == VIR_DOMAIN_FS_SECURITY_PASSTHROUGH) + virBufferAddLit(&opt, ",security_model=passthrough"); + else if (fs->security_model == VIR_DOMAIN_FS_SECURITY_MAPPED) + virBufferAddLit(&opt, ",security_model=mapped"); + else if (fs->security_model == VIR_DOMAIN_FS_SECURITY_NONE) + virBufferAddLit(&opt, ",security_model=none"); virBufferVSprintf(&opt, ",id=%s%s", QEMU_FSDEV_HOST_PREFIX, fs->info.alias); virBufferVSprintf(&opt, ",path=%s", fs->src); -- 1.7.1.1

5 5

[libvirt] [PATCH v3] nwfilter: resolve deadlock between VM operations and filter update
by Stefan Berger 07 Oct '10

07 Oct '10

V3: - removed debugging code - I looked through existing code and I could not find any other instances where the filter and domain_lock were locked without a preceding qemu/uml_driver lock. So the 2nd assumption seems to hold and no further changes should be required for this issue. V2: - remove the locks from qemudVMFilterRebuild & umlVMFilterRebuild This is from a bug report and conversation on IRC where Soren reported that while a filter update is occurring on one or more VMs (due to a rule having been edited for example), a deadlock can occur when a VM referencing a filter is started. The problem is caused by the two locking sequences of qemu driver, qemu domain, filter # for the VM start operation filter, qemu_driver, qemu_domain # for the filter update operation that obviously don't lock in the same order. The problem is the 2nd lock sequence. Here the qemu_driver lock is being grabbed in qemu_driver:qemudVMFilterRebuild() The following solution is based on the idea of trying to re-arrange the 2nd sequence of locks as follows: qemu_driver, filter, qemu_driver, qemu_domain and making the qemu driver recursively lockable so that a second lock can occur, this would then lead to the following net-locking sequence qemu_driver, filter, qemu_domain where the 2nd qemu_driver lock has been ( logically ) eliminated. The 2nd part of the idea is that the sequence of locks (filter, qemu_domain) and (qemu_domain, filter) becomes interchangeable if all code paths where filter AND qemu_domain are locked have a preceding qemu_domain lock that basically blocks their concurrent execution So, the following code paths exist towards qemu_driver:qemudVMFilterRebuild where we now want to put a qemu_driver lock in front of the filter lock. -> nwfilterUndefine() [ locks the filter ] -> virNWFilterTestUnassignDef() -> virNWFilterTriggerVMFilterRebuild() -> qemudVMFilterRebuild() -> nwfilterDefine() -> virNWFilterPoolAssignDef() [ locks the filter ] -> virNWFilterTriggerVMFilterRebuild() -> qemudVMFilterRebuild() -> nwfilterDriverReload() -> virNWFilterPoolLoadAllConfigs() ->virNWFilterPoolObjLoad() -> virNWFilterPoolAssignDef() [ locks the filter ] -> virNWFilterTriggerVMFilterRebuild() -> qemudVMFilterRebuild() -> nwfilterDriverStartup() -> virNWFilterPoolLoadAllConfigs() ->virNWFilterPoolObjLoad() -> virNWFilterPoolAssignDef() [ locks the filter ] -> virNWFilterTriggerVMFilterRebuild() -> qemudVMFilterRebuild() Qemu is not the only driver using the nwfilter driver, but also the UML driver calls into it. Therefore qemuVMFilterRebuild() can be exchanged with umlVMFilterRebuild() along with the driver lock of qemu_driver that can now be a uml_driver. Further, since UML and Qemu domains can be running on the same machine, the triggering of a rebuild of the filter can touch both types of drivers and their domains. In the patch below I am now extending each nwfilter callback driver with functions for locking and unlocking the (VM) driver (UML, QEMU) and introduce new functions for locking all registered callback drivers and unlocking them. Then I am distributing the lock-all-cbdrivers/unlock-all-cbdrivers call into the above call paths. The last shown callpath starting with nwfilterDriverStart() is problematic since it is initialize before the Qemu and UML drives are and thus a lock in the path would result in a NULL pointer attempted to be locked -- the call to virNWFilterTriggerVMFilterRebuild() is never called, so we never lock either the qemu_driver or the uml_driver in that path. Therefore, only the first 3 paths now receive calls to lock and unlock all callback drivers. Now that the locks are distributed where it matters I can remove the qemu_driver and uml_driver lock from qemudVMFilterRebuild() and umlVMFilterRebuild() and not requiring the recursive locks. For now I want to put this out as an RFC patch. I have tested it by 'stretching' the critical section after the define/undefine functions each lock the filter so I can (easily) concurrently execute another VM operation (suspend,start). That code is in this patch and if you want you can de-activate it. It seems to work ok and operations are being blocked while the update is being done. I still also want to verify the other assumption above that locking filter and qemu_domain always has a preceding qemu_driver lock. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/conf/nwfilter_conf.c | 18 ++++++++++++++++++ src/conf/nwfilter_conf.h | 6 ++++++ src/libvirt_private.syms | 2 ++ src/nwfilter/nwfilter_driver.c | 13 +++++++++++++ src/qemu/qemu_driver.c | 19 +++++++++++++++---- src/uml/uml_driver.c | 18 ++++++++++++++---- 6 files changed, 68 insertions(+), 8 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -658,6 +658,8 @@ void virNWFilterConfLayerShutdown(void); typedef int (*virNWFilterRebuild)(virConnectPtr conn, virHashIterator, void *data); +typedef void (*virNWFilterVoidCall)(void); + typedef struct _virNWFilterCallbackDriver virNWFilterCallbackDriver; typedef virNWFilterCallbackDriver *virNWFilterCallbackDriverPtr; @@ -665,9 +667,13 @@ struct _virNWFilterCallbackDriver { const char *name; virNWFilterRebuild vmFilterRebuild; + virNWFilterVoidCall vmDriverLock; + virNWFilterVoidCall vmDriverUnlock; }; void virNWFilterRegisterCallbackDriver(virNWFilterCallbackDriverPtr); +void virNWFilterCallbackDriversLock(void); +void virNWFilterCallbackDriversUnlock(void); VIR_ENUM_DECL(virNWFilterRuleAction); Index: libvirt-acl/src/qemu/qemu_driver.c =================================================================== --- libvirt-acl.orig/src/qemu/qemu_driver.c +++ libvirt-acl/src/qemu/qemu_driver.c @@ -12725,11 +12725,7 @@ static int qemudVMFilterRebuild(virConnectPtr conn ATTRIBUTE_UNUSED, virHashIterator iter, void *data) { - struct qemud_driver *driver = qemu_driver; - - qemuDriverLock(driver); virHashForEach(qemu_driver->domains.objs, iter, data); - qemuDriverUnlock(driver); return 0; } @@ -12757,9 +12753,24 @@ qemudVMFiltersInstantiate(virConnectPtr return err; } + +static void +qemudVMDriverLock(void) { + qemuDriverLock(qemu_driver); +}; + + +static void +qemudVMDriverUnlock(void) { + qemuDriverUnlock(qemu_driver); +}; + + static virNWFilterCallbackDriver qemuCallbackDriver = { .name = "QEMU", .vmFilterRebuild = qemudVMFilterRebuild, + .vmDriverLock = qemudVMDriverLock, + .vmDriverUnlock = qemudVMDriverUnlock, }; int qemuRegister(void) { Index: libvirt-acl/src/uml/uml_driver.c =================================================================== --- libvirt-acl.orig/src/uml/uml_driver.c +++ libvirt-acl/src/uml/uml_driver.c @@ -2202,11 +2202,7 @@ static int umlVMFilterRebuild(virConnectPtr conn ATTRIBUTE_UNUSED, virHashIterator iter, void *data) { - struct uml_driver *driver = uml_driver; - - umlDriverLock(driver); virHashForEach(uml_driver->domains.objs, iter, data); - umlDriverUnlock(driver); return 0; } @@ -2219,9 +2215,23 @@ static virStateDriver umlStateDriver = { .active = umlActive, }; +static void +umlVMDriverLock(void) +{ + umlDriverLock(uml_driver); +} + +static void +umlVMDriverUnlock(void) +{ + umlDriverUnlock(uml_driver); +} + static virNWFilterCallbackDriver umlCallbackDriver = { .name = "UML", .vmFilterRebuild = umlVMFilterRebuild, + .vmDriverLock = umlVMDriverLock, + .vmDriverUnlock = umlVMDriverUnlock, }; int umlRegister(void) { Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -2303,6 +2303,24 @@ virNWFilterRegisterCallbackDriver(virNWF } } +void +virNWFilterCallbackDriversLock(void) +{ + int i; + + for (i = 0; i < nCallbackDriver; i++) + callbackDrvArray[i]->vmDriverLock(); +} + +void +virNWFilterCallbackDriversUnlock(void) +{ + int i; + + for (i = 0; i < nCallbackDriver; i++) + callbackDrvArray[i]->vmDriverUnlock(); +} + static virHashIterator virNWFilterDomainFWUpdateCB; Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -535,6 +535,8 @@ virNWFilterConfLayerShutdown; virNWFilterLockFilterUpdates; virNWFilterUnlockFilterUpdates; virNWFilterPrintStateMatchFlags; +virNWFilterCallbackDriversLock; +virNWFilterCallbackDriversUnlock; # nwfilter_params.h Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -34,6 +34,7 @@ #include "memory.h" #include "domain_conf.h" #include "domain_nwfilter.h" +#include "nwfilter_conf.h" #include "nwfilter_driver.h" #include "nwfilter_gentech_driver.h" @@ -152,9 +153,13 @@ nwfilterDriverReload(void) { virNWFilterLearnThreadsTerminate(true); nwfilterDriverLock(driverState); + virNWFilterCallbackDriversLock(); + virNWFilterPoolLoadAllConfigs(conn, &driverState->pools, driverState->configDir); + + virNWFilterCallbackDriversUnlock(); nwfilterDriverUnlock(driverState); virConnectClose(conn); @@ -328,6 +333,8 @@ nwfilterDefine(virConnectPtr conn, virNWFilterPtr ret = NULL; nwfilterDriverLock(driver); + virNWFilterCallbackDriversLock(); + if (!(def = virNWFilterDefParseString(conn, xml))) goto cleanup; @@ -347,6 +354,8 @@ cleanup: virNWFilterDefFree(def); if (pool) virNWFilterPoolObjUnlock(pool); + + virNWFilterCallbackDriversUnlock(); nwfilterDriverUnlock(driver); return ret; } @@ -359,6 +368,8 @@ nwfilterUndefine(virNWFilterPtr obj) { int ret = -1; nwfilterDriverLock(driver); + virNWFilterCallbackDriversLock(); + pool = virNWFilterPoolObjFindByUUID(&driver->pools, obj->uuid); if (!pool) { virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, @@ -385,6 +396,8 @@ nwfilterUndefine(virNWFilterPtr obj) { cleanup: if (pool) virNWFilterPoolObjUnlock(pool); + + virNWFilterCallbackDriversUnlock(); nwfilterDriverUnlock(driver); return ret; }

1 0

[libvirt] [PATCH v2 0/5] nwfilter: Support comment attribute in filter rule descriptions
by Stefan Berger 07 Oct '10

07 Oct '10

V2: - work on the iptables instantiation patch (2/5) - work on the parser patch (1/5) - small changes to the test cases (5/5) The following patch series adds support for a comment node to the XML attributes of all protocols. If possible, as for example in case of iptables, the comments are instantiated (iptables ... -m comment --comment ...). The patches do the following: - extend the parser and XML generator to parse and create XML with the comment attribute - instantiate the comment in case of ip(6)tables - extend the nwfilter.rng schema with the comment attribute - add the information to the web docs - add a test case for the XML parser/generator to be run during 'make check' Regards, Stefan

4 21

[libvirt] [TCK][PATCH] nwfilter: implement support for --force flag
by Stefan Berger 07 Oct '10

07 Oct '10

Implement support for the --force command line option to delete existing VMs and nwfilters starting with 'tck'. Fix how the --no-attach flag is handled. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> diff --git a/scripts/nwfilter/nwfilter2vmtest.sh b/scripts/nwfilter/nwfilter2vmtest.sh index b527ee8..496c220 100644 --- a/scripts/nwfilter/nwfilter2vmtest.sh +++ b/scripts/nwfilter/nwfilter2vmtest.sh @@ -23,6 +23,7 @@ FLAG_ATTACH="$((1<<1))" FLAG_VERBOSE="$((1<<2))" FLAG_LIBVIRT_TEST="$((1<<3))" FLAG_TAP_TEST="$((1<<4))" +FLAG_FORCE_CLEAN="$((1<<5))" failctr=0 passctr=0 @@ -47,6 +48,8 @@ Options: --verbose : Verbose output --libvirt-test : Use the libvirt test output format --tap-test : TAP format output + --force : Allow the automatic cleaning of VMs and nwfilters + previously created by the TCK test suite This test will create two virtual machines. The one virtual machine will use a filter called '${TESTFILTERNAME}', and reference the filter @@ -498,11 +501,12 @@ function main() { while [ $# -ne 0 ]; do case "$1" in --help|-h|-\?) usage ${prgname}; exit 0;; - --noattach) ((flags ^= FLAG_ATTACH ));; + --noattach) ((flags &= ~FLAG_ATTACH ));; --wait) ((flags |= FLAG_WAIT ));; --verbose) ((flags |= FLAG_VERBOSE ));; --libvirt-test) ((flags |= FLAG_LIBVIRT_TEST ));; --tap-test) ((flags |= FLAG_TAP_TEST ));; + --force) ((flags |= FLAG_FORCE_CLEAN ));; *) usage ${prgname}; exit 1;; esac shift 1 @@ -523,12 +527,14 @@ function main() { exit 0 fi - for name in `virsh nwfilter-list | awk '{print $2}'` + for name in `virsh list | awk '{print $2}'` do case ${name} in tck*) - if [ "x${LIBVIRT_TCK_AUTOCLEAN}" == "x1" ]; then - res=$(virsh nwfilter-undefine ${name} 2>&1) + if [ "x${LIBVIRT_TCK_AUTOCLEAN}" == "x1" -o \ + $((flags & FLAG_FORCE_CLEAN)) -ne 0 ]; then + res=$(virsh destroy ${name} 2>&1) + res=$(virsh undefine ${name} 2>&1) if [ $? -ne 0 ]; then echo "Bail out! Could not undefine nwfiler ${name}: ${res}" exit 0 @@ -544,8 +550,9 @@ function main() { do case ${name} in tck*) - if [ "x${LIBVIRT_TCK_AUTOCLEAN}" == "x1" ]; then - res=$(virsh undefine ${name} 2>&1) + if [ "x${LIBVIRT_TCK_AUTOCLEAN}" == "x1" -o \ + $((flags & FLAG_FORCE_CLEAN)) -ne 0 ]; then + res=$(virsh nwfilter-undefine ${name} 2>&1) if [ $? -ne 0 ]; then echo "Bail out! Could not undefine domain ${name}: ${res}" exit 1

2 2

[libvirt] Using -netdev with qemu/kvm rather than old style
by Pete Ashdown 07 Oct '10

07 Oct '10

I have 0.8.3 installed and my net devices are still being defined via -net rather than -netdev. I have found that using the latter allows my ethernet to properly offload and gives a 35% performance gain. Looking through the libvirt code I find in qemu_conf.c: /* Possible combinations * * 1. Old way: -net nic,model=e1000,vlan=1 -net tap,vlan=1 * 2. Semi-new: -device e1000,vlan=1 -net tap,vlan=1 * 3. Best way: -netdev type=tap,id=netdev1 -device e1000,id=netdev1 * * NB, no support for -netdev without use of -device */ How do I convince virsh/libvirt to use #3, the "Best way"?

2 1

[libvirt] [PATCH] [DOCS] nwfilter: Add 2nd example to the html docs
by Stefan Berger 07 Oct '10

07 Oct '10

This patch adds another example to the nwfilter html page and provides 2 solutions for how to write a filter meeting the given requirements using newly added features. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- docs/formatnwfilter.html.in | 180 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 179 insertions(+), 1 deletion(-) Index: libvirt-acl/docs/formatnwfilter.html.in =================================================================== --- libvirt-acl.orig/docs/formatnwfilter.html.in +++ libvirt-acl/docs/formatnwfilter.html.in @@ -1468,7 +1468,8 @@ <li>prevents a VM's interface from MAC, IP and ARP spoofing</li> <li>opens only TCP ports 22 and 80 of a VM's interface</li> <li>allows the VM to send ping traffic from an interface - but no let the VM be pinged on the interface</li> + but not let the VM be pinged on the interface</li> + <li>allows the VM to do DNS lookups (UDP towards port 53)</li> </ul> <p> The requirement to prevent spoofing is fulfilled by the existing @@ -1510,6 +1511,11 @@ <icmp/> </rule> +  + <rule action='accept' direction='out'> + <udp dstportstart='53'/> + </rule> +  <rule action='drop' direction='inout'> <all/> @@ -1556,6 +1562,178 @@ </rule> </pre> + <h3><a name="nwfwriteexample2nd">Second example custom filter</a></h3> + <p> + In this example we now want to build a similar filter as in the + example above, but extend the list of requirements with an + ftp server located inside the VM. Further, we will be using features + that have been added in <span class="since">version 0.8.5</span>. + The requirements for this filter shall be: + </p> + <ul> + <li>prevents a VM's interface from MAC, IP and ARP spoofing</li> + <li>opens only TCP ports 22 and 80 of a VM's interface</li> + <li>allows the VM to send ping traffic from an interface + but not let the VM be pinged on the interface</li> + <li>allows the VM to do DNS lookups (UDP towards port 53)</li> + <li>enable an ftp server (in active mode) to be run inside the VM + </ul> + <p> + The additional requirement of allowing an ftp server to be run inside + the VM maps into the requirement of allowing port 21 to be reachable + for ftp control traffic as well as enabling the VM to establish an + outgoing tcp connection originating from the VM's TCP port 20 back to + the ftp client (ftp active mode). There are several ways of how this + filter can be written and we present 2 solutions. + <br><br> + The 1st solution makes use of the <code>state</code> attribute of + the TCP protocol that gives us a hook into the connection tracking + framework of the Linux host. For the VM-initiated ftp data connection + (ftp active mode) we use the <code>RELATED</code> state that allows + us to detect that the VM-initated ftp data connection is a consequence of + ( or 'has a relationship with' ) an existing ftp control connection, + thus we want to allow it to let packets + pass the firewall. The <code>RELATED</code> state, however, is only + valid for the very first packet of the outgoing TCP connection for the + ftp data path. Afterwards, the state to compare against is + <code>ESTABLISHED</code>, which then applies equally + to the incoming and outgoing direction. All this is related to the ftp + data traffic origination from TCP port 20 of the VM. This then leads to + the following solution + <span class="since">(since 0.8.5 (Qemu, KVM, UML))</span>: + </p> +<pre> +<filter name='test-eth0'> +  + <filterref filter='clean-traffic'/> + +  + <rule action='accept' direction='in'> + <tcp dstportstart='21'/> + </rule> + +  + <rule action='accept' direction='out'> + <tcp srcportstart='20' state='RELATED,ESTABLISHED'/> + </rule> + +  + <rule action='accept' direction='in'> + <tcp dstportstart='20' state='ESTABLISHED'/> + </rule> + +  + <rule action='accept' direction='in'> + <tcp dstportstart='22'/> + </rule> + + <rule action='accept' direction='in'> + <tcp dstportstart='80'/> + </rule> + +  + <rule action='accept' direction='out'> + <icmp/> + </rule> + +  + <rule action='accept' direction='out'> + <udp dstportstart='53'/> + </rule> + +  + <rule action='drop' direction='inout'> + <all/> + </rule> + +</filter> +</pre> + <p> + Before trying out a filter using the <code>RELATED</code> state, + you have to make sure that the approriate connection tracking module + has been loaded into the host's kernel. Depending on the version of the + kernel, you must run either one of the following two commands before + the ftp connection with the VM is established. + </p> +<pre> + modprobe nf_conntrack_ftp # where available or + + modprobe ip_conntrack_ftp # if above is not available +</pre> + <p> + If other protocols than ftp are to be used in conjunction with the + <code>RELATED</code> state, their corresponding module must be loaded. + Modules exist at least for the protocols ftp, tftp, irc, sip, + sctp, and amanda. + </p> + <p> + The 2nd solution makes uses the state flags of connections more + than the previous solution did. + In this solution we take advantage of the fact that the + <code>NEW</code> state of a connection is valid when the very + first packet of a traffic flow is seen. Subsequently, if the very first + packet of a flow is accepted, the flow becomes a connection and enters + the <code>ESTABLISHED</code> state. This allows us to write a general + rule for allowing packets of <code>ESTABLISHED</code> connections to + reach the VM or be sent by the VM. + We write specific rules for the very first packets identified by the + <code>NEW</code> state and for which ports they are acceptable. All + packets for ports that are not explicitly accepted will be dropped and + therefore the connection will not go into the <code>ESTABLISHED</code> + state and any subsequent packets be dropped. + </p> + +<pre> +<filter name='test-eth0'> +  + <filterref filter='clean-traffic'/> + +  + <rule action='accept' direction='in'> + <all state='ESTABLISHED'/> + </rule> + +  + <rule action='accept' direction='out'> + <all state='ESTABLISHED,RELATED'/> + </rule> + +  + <rule action='accept' direction='in'> + <tcp dstportstart='21' dstportend='22' state='NEW'/> + </rule> + + <rule action='accept' direction='in'> + <tcp dstportstart='80' state='NEW'/> + </rule> + +  + <rule action='accept' direction='out'> + <icmp state='NEW'/> + </rule> + +  + <rule action='accept' direction='out'> + <udp dstportstart='53' state='NEW'/> + </rule> + +  + <rule action='drop' direction='inout'> + <all/> + </rule> + +</filter> + +</pre> <h2><a name="nwflimits">Limitations</a></h2> <p>

3 3

[libvirt] [patch 0/5] nwfilter: add a 'state' attribute to protocols
by Stefan Berger 07 Oct '10

07 Oct '10

The following patch series introduces an attribute 'state' for iptables- supported protocols. This gives the user more control over the 'state match' of the underlying ip(6)tables implementation and allows to create filtering rules that are more efficient to evaluate. TCK test cases will be posted later. Each rule containing a state attribute with either one of the values NEW, ESTABLISHED, RELATED, INVALID or NONE, gets one iptables rule created for the direction of the rule. The keyword 'NONE' does the same, but doesn't generate a rule with the 'state match'. If no state attribute is used, a symmetric rule in the incoming and outgoing direction is generated (as was done previously). The patches do the following: - extend the parser and XML generator to parse and create XML with the state attribute - instantiate the state in case of ip(6)tables - extend the nwfilter.rng schema with the state attribute's possible values - add information about the new state attribute to the web docs - add a test case for the XML parser/generator to be run during 'make check' I valgrind'ed this patch and it looks all memory is freed appropriately. Regards, Stefan

4 16

[libvirt] [PATCH] document authentication with PolicyKit-1
by Gerd v. Egidy 07 Oct '10

07 Oct '10

Hi, I just encountered the same problem with the newer PolicyKit as discussed e.g. in this thread: http://lists.fedoraproject.org/pipermail/virt/2010-June/002081.html I solved it and thought updating the documentation for PolicyKit 1 would be nice. Patch attached. Kind regards, Gerd -- Address (better: trap) for people I really don't want to get mail from: jonas(a)cactusamerica.com

4 4

[libvirt] bug: network lock-out
by Zdenek Styblik 07 Oct '10

07 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I'm sorry to report this, but network should start or stop regardless iptables status. virsh # net-start default error: Failed to start network default error: internal error '/usr/sbin/iptables --table filter --delete INPUT - --in-interface virbr0 --protocol udp --destination-port 69 --jump ACCEPT' exited with non-zero status 1 and signal 0: iptables: Bad rule (does a matching rule exist in that chain?). Ok, so I'm going to create this rule to make you happy. virsh # net-start default error: Failed to start network default error: internal error '/usr/sbin/iptables --table mangle --delete POSTROUTING --out-interface virbr0 --protocol udp --destination-port 68 - --jump CHECKSUM --checksum-fill' exited with non-zero status 2 and signal 0: iptables v1.4.7: unknown option `--checksum-fill' Try `iptables -h' or 'iptables --help' for more information. And Oops, because I don't have CHECKSUM support. And to note, it's not even in kernel. Rely on such features is unfriendly and bellow belt :) Once again, I'm locked by hard-coded features :( That's why I "fight" against these. btw it's strange to me that libvirt is deleting rules that shouldn't be present since I want to start network, not to stop it. Let's dump all nwfilters and hope for miracle...and nothing. Same errors, although nwfilter rules are gone. What the ...? :| libvirt-0.8.4 Regards, Zdenek - -- Zdenek Styblik Net/Linux admin OS TurnovFree.net email: stybla(a)turnovfree.net jabber: stybla(a)jabber.turnovfree.net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkyrezwACgkQ8MreUbSH7ikbpQCdEDtbwG+PV6u0yvUZYzXlQas9 ohEAoIyy/HPZwtWlaOAgtx6jnOEFashR =u7st -----END PGP SIGNATURE-----

3 8

[libvirt] libvirt and nested pagind
by Eduardo 07 Oct '10

07 Oct '10

Good afternoon! Searching on the web, I joint some codes and produced those patches. Now I have a server running perfectly with the following scenario: AMD Phenom 8400 x3; Slackware64 13.1 on a slim and custom 2.6.35.2 Linux; qemu-kvm 0.12.5; libvirt 0.8.4. Patch of libvirt 0.8.3: diff -Naur ../libvirt-0.8.3//docs/schemas/domain.rng ./docs/schemas/domain.rng --- ../libvirt-0.8.3//docs/schemas/domain.rng 2010-07-29 06:48:30.000000000 -0300 +++ ./docs/schemas/domain.rng 2010-09-01 16:51:57.710851479 -0300 @@ -1595,6 +1595,11 @@ <empty/> </element> </optional> + <optional> + <element name="nesting"> + <empty/> + </element> + </optional> </interleave> </element> </optional> diff -Naur ../libvirt-0.8.3//src/conf/domain_conf.c ./src/conf/domain_conf.c --- ../libvirt-0.8.3//src/conf/domain_conf.c 2010-08-02 16:16:42.000000000 -0300 +++ ./src/conf/domain_conf.c 2010-09-01 16:51:57.710851479 -0300 @@ -75,7 +75,8 @@ VIR_ENUM_IMPL(virDomainFeature, VIR_DOMAIN_FEATURE_LAST, "acpi", "apic", - "pae") + "pae", + "nesting") VIR_ENUM_IMPL(virDomainLifecycle, VIR_DOMAIN_LIFECYCLE_LAST, "destroy", diff -Naur ../libvirt-0.8.3//src/conf/domain_conf.h ./src/conf/domain_conf.h --- ../libvirt-0.8.3//src/conf/domain_conf.h 2010-07-29 06:48:30.000000000 -0300 +++ ./src/conf/domain_conf.h 2010-09-01 16:51:57.710851479 -0300 @@ -649,6 +649,7 @@ VIR_DOMAIN_FEATURE_ACPI, VIR_DOMAIN_FEATURE_APIC, VIR_DOMAIN_FEATURE_PAE, + VIR_DOMAIN_FEATURE_NESTING, VIR_DOMAIN_FEATURE_LAST }; diff -Naur ../libvirt-0.8.3//src/qemu/qemu_conf.c ./src/qemu/qemu_conf.c --- ../libvirt-0.8.3//src/qemu/qemu_conf.c 2010-08-04 09:21:27.000000000 -0300 +++ ./src/qemu/qemu_conf.c 2010-09-01 16:57:47.485469640 -0300 @@ -1190,6 +1190,8 @@ flags |= QEMUD_CMD_FLAG_MEM_PATH; if (strstr(help, "-chardev")) flags |= QEMUD_CMD_FLAG_CHARDEV; + if (strstr(help, "-enable-nesting")) + flags |= QEMUD_CMD_FLAG_NESTING; if (strstr(help, "-balloon")) flags |= QEMUD_CMD_FLAG_BALLOON; if (strstr(help, "-device")) @@ -3907,6 +3909,9 @@ goto error; } } + if ((qemuCmdFlags & QEMUD_CMD_FLAG_NESTING) && + (def->features & (1 << VIR_DOMAIN_FEATURE_NESTING))) + ADD_ARG_LIT("-enable-nesting"); /* * NB, -nographic *MUST* come before any serial, or monitor @@ -6265,6 +6270,8 @@ fullscreen = 1; } else if (STREQ(arg, "-localtime")) { def->clock.offset = VIR_DOMAIN_CLOCK_OFFSET_LOCALTIME; + } else if (STREQ(arg, "-enable-nesting")) { + def->features |= (1 << VIR_DOMAIN_FEATURE_NESTING); } else if (STREQ(arg, "-kernel")) { WANT_VALUE(); if (!(def->os.kernel = strdup(val))) diff -Naur ../libvirt-0.8.3//src/qemu/qemu_conf.h ./src/qemu/qemu_conf.h --- ../libvirt-0.8.3//src/qemu/qemu_conf.h 2010-07-28 11:18:15.000000000 -0300 +++ ./src/qemu/qemu_conf.h 2010-09-01 16:58:29.900876561 -0300 @@ -92,6 +92,7 @@ QEMUD_CMD_FLAG_PCI_CONFIGFD = (1LL << 36), /* pci-assign.configfd */ QEMUD_CMD_FLAG_NODEFCONFIG = (1LL << 37), /* -nodefconfig */ QEMUD_CMD_FLAG_BOOT_MENU = (1LL << 38), /* -boot menu=on support */ + QEMUD_CMD_FLAG_NESTING = (1LL << 39), /* Is the -enable-nesting flag available */ }; /* Main driver state */ Patch of libvirt 0.8.4: diff -Naur libvirt-0.8.4/docs/schemas/domain.rng libvirt-0.8.4.edu/docs/schemas/domain.rng --- libvirt-0.8.4/docs/schemas/domain.rng 2010-08-31 10:44:13.000000000 -0300 +++ libvirt-0.8.4.edu/docs/schemas/domain.rng 2010-09-28 14:34:40.626234752 -0300 @@ -1619,6 +1619,11 @@ <empty/> </element> </optional> + <optional> + <element name="nesting"> + <empty/> + </element> + </optional> </interleave> </element> </optional> diff -Naur libvirt-0.8.4/src/conf/domain_conf.c libvirt-0.8.4.edu/src/conf/domain_conf.c --- libvirt-0.8.4/src/conf/domain_conf.c 2010-08-31 10:44:13.000000000 -0300 +++ libvirt-0.8.4.edu/src/conf/domain_conf.c 2010-09-28 14:35:36.069149447 -0300 @@ -75,7 +75,8 @@ VIR_ENUM_IMPL(virDomainFeature, VIR_DOMAIN_FEATURE_LAST, "acpi", "apic", - "pae") + "pae", + "nesting") VIR_ENUM_IMPL(virDomainLifecycle, VIR_DOMAIN_LIFECYCLE_LAST, "destroy", diff -Naur libvirt-0.8.4/src/conf/domain_conf.h libvirt-0.8.4.edu/src/conf/domain_conf.h --- libvirt-0.8.4/src/conf/domain_conf.h 2010-08-31 10:44:13.000000000 -0300 +++ libvirt-0.8.4.edu/src/conf/domain_conf.h 2010-09-28 14:36:11.931054102 -0300 @@ -650,6 +650,7 @@ VIR_DOMAIN_FEATURE_ACPI, VIR_DOMAIN_FEATURE_APIC, VIR_DOMAIN_FEATURE_PAE, + VIR_DOMAIN_FEATURE_NESTING, VIR_DOMAIN_FEATURE_LAST }; diff -Naur libvirt-0.8.4/src/qemu/qemu_conf.c libvirt-0.8.4.edu/src/qemu/qemu_conf.c --- libvirt-0.8.4/src/qemu/qemu_conf.c 2010-09-10 09:38:13.000000000 -0300 +++ libvirt-0.8.4.edu/src/qemu/qemu_conf.c 2010-09-28 14:38:36.218612249 -0300 @@ -1192,6 +1192,8 @@ flags |= QEMUD_CMD_FLAG_MEM_PATH; if (strstr(help, "-chardev")) flags |= QEMUD_CMD_FLAG_CHARDEV; + if (strstr(help, "-enable-nesting")) + flags |= QEMUD_CMD_FLAG_NESTING; if (strstr(help, "-balloon")) flags |= QEMUD_CMD_FLAG_BALLOON; if (strstr(help, "-device")) @@ -3944,6 +3946,9 @@ goto error; } } + if ((qemuCmdFlags & QEMUD_CMD_FLAG_NESTING) && + (def->features & (1 << VIR_DOMAIN_FEATURE_NESTING))) + ADD_ARG_LIT("-enable-nesting"); /* * NB, -nographic *MUST* come before any serial, or monitor @@ -6303,6 +6308,8 @@ fullscreen = 1; } else if (STREQ(arg, "-localtime")) { def->clock.offset = VIR_DOMAIN_CLOCK_OFFSET_LOCALTIME; + } else if (STREQ(arg, "-enable-nesting")) { + def->features |= (1 << VIR_DOMAIN_FEATURE_NESTING); } else if (STREQ(arg, "-kernel")) { WANT_VALUE(); if (!(def->os.kernel = strdup(val))) diff -Naur libvirt-0.8.4/src/qemu/qemu_conf.h libvirt-0.8.4.edu/src/qemu/qemu_conf.h --- libvirt-0.8.4/src/qemu/qemu_conf.h 2010-08-31 10:44:13.000000000 -0300 +++ libvirt-0.8.4.edu/src/qemu/qemu_conf.h 2010-09-28 14:38:58.739788135 -0300 @@ -93,6 +93,8 @@ QEMUD_CMD_FLAG_NODEFCONFIG = (1LL << 37), /* -nodefconfig */ QEMUD_CMD_FLAG_BOOT_MENU = (1LL << 38), /* -boot menu=on support */ QEMUD_CMD_FLAG_ENABLE_KQEMU = (1LL << 39), /* -enable-kqemu flag */ + QEMUD_CMD_FLAG_NESTING = (1LL << 39), /* Is the -enable-nesting flag available */ + }; /* Main driver state */ -- *Eduardo Ramos* www.freedominterface.org +55 12 91051687 exten=>eduardo,1,hangup()

2 1

[libvirt] [PATCH] Added new attribute exportfs_type to filesystem element
by Harsh Prateek Bora 07 Oct '10

07 Oct '10

This patch introduces a new attribute export_fs to the filesystem element which specifies the type of export. Currently only 'local' type of exported filesystem is supported. More types like NFS, clusterFS, etc. can be added later as required. Note: This patch is based on the following two patches: 1) Daniel's patch to support 9pfs: https://www.redhat.com/archives/libvir-list/2010-September/msg00358.html 2) Another related patch to support 'security_model' attribute: https://www.redhat.com/archives/libvir-list/2010-September/msg00435.html Signed-off-by: Harsh Prateek Bora <harsh(a)linux.vnet.ibm.com> --- docs/schemas/domain.rng | 5 +++++ src/conf/domain_conf.c | 24 ++++++++++++++++++++++-- src/conf/domain_conf.h | 9 +++++++++ src/qemu/qemu_conf.c | 3 ++- 4 files changed, 38 insertions(+), 3 deletions(-) diff --git a/docs/schemas/domain.rng b/docs/schemas/domain.rng index 43a292d..5b7563a 100644 --- a/docs/schemas/domain.rng +++ b/docs/schemas/domain.rng @@ -768,6 +768,11 @@ <value>none</value> </choice> </attribute> + <attribute name="exportfs_type"> + <choice> + <value>local</value> + </choice> + </attribute> </optional> </element> </define> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index a9881d1..6d728a7 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -166,6 +166,8 @@ VIR_ENUM_IMPL(virDomainFSSecurityModel, VIR_DOMAIN_FS_SECURITY_LAST, "mapped", "none") +VIR_ENUM_IMPL(virDomainFSExportType, VIR_DOMAIN_FS_EXPORT_TYPE_LAST, + "local") VIR_ENUM_IMPL(virDomainNet, VIR_DOMAIN_NET_TYPE_LAST, "user", @@ -1851,6 +1853,7 @@ virDomainFSDefParseXML(xmlNodePtr node, virDomainFSDefPtr def; xmlNodePtr cur; char *type = NULL; + char *exportfs_type = NULL; char *source = NULL; char *target = NULL; char *security_model; @@ -1871,6 +1874,17 @@ virDomainFSDefParseXML(xmlNodePtr node, def->type = VIR_DOMAIN_FS_TYPE_MOUNT; } + exportfs_type = virXMLPropString(node, "exportfs_type"); + if (exportfs_type) { + if ((def->exportfs_type = virDomainFSExportTypeTypeFromString(exportfs_type)) < 0) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("unknown exportfs type '%s'"), exportfs_type); + goto error; + } + } else { + def->exportfs_type = VIR_DOMAIN_FS_EXPORT_TYPE_LOCAL; + } + security_model = virXMLPropString(node, "security_model"); if (security_model) { if ((def->security_model = virDomainFSSecurityModelTypeFromString(security_model)) < 0) { @@ -5621,6 +5635,7 @@ virDomainFSDefFormat(virBufferPtr buf, { const char *type = virDomainFSTypeToString(def->type); const char *sec_model = virDomainFSSecurityModelTypeToString(def->security_model); + const char *expfs_type = virDomainFSExportTypeTypeToString(def->exportfs_type); if (!type) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, @@ -5628,6 +5643,11 @@ virDomainFSDefFormat(virBufferPtr buf, return -1; } + if (!expfs_type) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("unexpected exportfs type %d"), def->type); + } + if (!sec_model) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, _("unexpected security model %d"), def->security_model); @@ -5636,8 +5656,8 @@ virDomainFSDefFormat(virBufferPtr buf, virBufferVSprintf(buf, - " <filesystem type='%s' security_model='%s'>\n", - type, sec_model); + " <filesystem type='%s' exportfs_type='%s' security_model='%s'>\n", + type, expfs_type, sec_model); if (def->src) { switch (def->type) { diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 6adf027..956cac0 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -245,10 +245,18 @@ enum virDomainFSSecurityModel { VIR_DOMAIN_FS_SECURITY_LAST }; +/* Export Filesystem Type */ +enum virDomainFSExportType { + VIR_DOMAIN_FS_EXPORT_TYPE_LOCAL, + + VIR_DOMAIN_FS_EXPORT_TYPE_LAST +}; + typedef struct _virDomainFSDef virDomainFSDef; typedef virDomainFSDef *virDomainFSDefPtr; struct _virDomainFSDef { int type; + int exportfs_type; int security_model; char *src; char *dst; @@ -1177,6 +1185,7 @@ VIR_ENUM_DECL(virDomainDiskErrorPolicy) VIR_ENUM_DECL(virDomainController) VIR_ENUM_DECL(virDomainControllerModel) VIR_ENUM_DECL(virDomainFS) +VIR_ENUM_DECL(virDomainFSExportType) VIR_ENUM_DECL(virDomainNet) VIR_ENUM_DECL(virDomainChrDevice) VIR_ENUM_DECL(virDomainChrChannelTarget) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 6b96d2f..458beab 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -2788,7 +2788,8 @@ char *qemuBuildFSStr(virDomainFSDefPtr fs, goto error; } - virBufferAddLit(&opt, "local"); + if (fs->exportfs_type == VIR_DOMAIN_FS_EXPORT_TYPE_LOCAL) + virBufferAddLit(&opt, "local"); if (fs->security_model == VIR_DOMAIN_FS_SECURITY_PASSTHROUGH) virBufferAddLit(&opt, ",security_model=passthrough"); else if (fs->security_model == VIR_DOMAIN_FS_SECURITY_MAPPED) -- 1.7.1.1

4 3

[libvirt] nwfilter: test code to provoke deadlock
by Stefan Berger 07 Oct '10

07 Oct '10

Attached are the bash scripts and xml files for provoking the deadlock. With the new patch applied the deadlock does not occur anymore. Regards, Stefan

1 0

[libvirt] [PATCH] [RFC] nwfilter: resolve deadlock between VM operations and filter update
by Stefan Berger 06 Oct '10

06 Oct '10

This is from a bug report and conversation on IRC where Soren reported that while a filter update is occurring on one or more VMs (due to a rule having been edited for example), a deadlock can occur when a VM referencing a filter is started. The problem is caused by the two locking sequences of qemu driver, qemu domain, filter # for the VM start operation filter, qemu_driver, qemu_domain # for the filter update operation that obviously don't lock in the same order. The problem is the 2nd lock sequence. Here the qemu_driver lock is being grabbed in qemu_driver:qemudVMFilterRebuild() The following solution is based on the idea of trying to re-arrange the 2nd sequence of locks as follows: qemu_driver, filter, qemu_driver, qemu_domain and making the qemu driver recursively lockable so that a second lock can occur, this would then lead to the following net-locking sequence qemu_driver, filter, qemu_domain where the 2nd qemu_driver lock has been ( logically ) eliminated. The 2nd part of the idea is that the sequence of locks (filter, qemu_domain) and (qemu_domain, filter) becomes interchangeable if all code paths where filter AND qemu_domain are locked have a preceding qemu_domain lock that basically blocks their concurrent execution So, the following code paths exist towards qemu_driver:qemudVMFilterRebuild where we now want to put a qemu_driver lock in front of the filter lock. -> nwfilterUndefine() [ locks the filter ] -> virNWFilterTestUnassignDef() -> virNWFilterTriggerVMFilterRebuild() -> qemudVMFilterRebuild() -> nwfilterDefine() -> virNWFilterPoolAssignDef() [ locks the filter ] -> virNWFilterTriggerVMFilterRebuild() -> qemudVMFilterRebuild() -> nwfilterDriverReload() -> virNWFilterPoolLoadAllConfigs() ->virNWFilterPoolObjLoad() -> virNWFilterPoolAssignDef() [ locks the filter ] -> virNWFilterTriggerVMFilterRebuild() -> qemudVMFilterRebuild() -> nwfilterDriverStartup() -> virNWFilterPoolLoadAllConfigs() ->virNWFilterPoolObjLoad() -> virNWFilterPoolAssignDef() [ locks the filter ] -> virNWFilterTriggerVMFilterRebuild() -> qemudVMFilterRebuild() Qemu is not the only driver using the nwfilter driver, but also the UML driver calls into it. Therefore qemuVMFilterRebuild() can be exchanged with umlVMFilterRebuild() along with the driver lock of qemu_driver that can now be a uml_driver. Further, since UML and Qemu domains can be running on the same machine, the triggering of a rebuild of the filter can touch both types of drivers and their domains. In the patch below I am now extending each nwfilter callback driver with functions for locking and unlocking the (VM) driver (UML, QEMU) and introduce new functions for locking all registered callback drivers and unlocking them. Then I am distributing the lock-all-cbdrivers/unlock-all-cbdrivers call into the above call paths. The last shown callpath starting with nwfilterDriverStart() is problematic since it is initialize before the Qemu and UML drives are and thus a lock in the path would result in a NULL pointer attempted to be locked -- the call to virNWFilterTriggerVMFilterRebuild() is never called, so we never lock either the qemu_driver or the uml_driver in that path. Therefore, only the first 3 paths now receive calls to lock and unlock all callback drivers. Now that the locks are distributed where it matters I can remove the qemu_driver and uml_driver lock from qemudVMFilterRebuild() and umlVMFilterRebuild() and not requiring the recursive locks. For now I want to put this out as an RFC patch. I have tested it by 'stretching' the critical section after the define/undefine functions each lock the filter so I can (easily) concurrently execute another VM operation (suspend,start). That code is in this patch and if you want you can de-activate it. It seems to work ok and operations are being blocked while the update is being done. I still also want to verify the other assumption above that locking filter and qemu_domain always has a preceding qemu_driver lock. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/conf/nwfilter_conf.c | 18 ++++++++++++++++++ src/conf/nwfilter_conf.h | 6 ++++++ src/libvirt_private.syms | 2 ++ src/nwfilter/nwfilter_driver.c | 20 ++++++++++++++++++++ src/qemu/qemu_driver.c | 15 +++++++++++++++ src/uml/uml_driver.c | 14 ++++++++++++++ 6 files changed, 75 insertions(+) Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -639,6 +639,8 @@ void virNWFilterConfLayerShutdown(void); typedef int (*virNWFilterRebuild)(virConnectPtr conn, virHashIterator, void *data); +typedef void (*virNWFilterVoidCall)(void); + typedef struct _virNWFilterCallbackDriver virNWFilterCallbackDriver; typedef virNWFilterCallbackDriver *virNWFilterCallbackDriverPtr; @@ -646,9 +648,13 @@ struct _virNWFilterCallbackDriver { const char *name; virNWFilterRebuild vmFilterRebuild; + virNWFilterVoidCall vmDriverLock; + virNWFilterVoidCall vmDriverUnlock; }; void virNWFilterRegisterCallbackDriver(virNWFilterCallbackDriverPtr); +void virNWFilterCallbackDriversLock(void); +void virNWFilterCallbackDriversUnlock(void); VIR_ENUM_DECL(virNWFilterRuleAction); Index: libvirt-acl/src/qemu/qemu_driver.c =================================================================== --- libvirt-acl.orig/src/qemu/qemu_driver.c +++ libvirt-acl/src/qemu/qemu_driver.c @@ -12757,9 +12757,24 @@ qemudVMFiltersInstantiate(virConnectPtr return err; } + +static void +qemudVMDriverLock(void) { + qemuDriverLock(qemu_driver); +}; + + +static void +qemudVMDriverUnlock(void) { + qemuDriverUnlock(qemu_driver); +}; + + static virNWFilterCallbackDriver qemuCallbackDriver = { .name = "QEMU", .vmFilterRebuild = qemudVMFilterRebuild, + .vmDriverLock = qemudVMDriverLock, + .vmDriverUnlock = qemudVMDriverUnlock, }; int qemuRegister(void) { Index: libvirt-acl/src/uml/uml_driver.c =================================================================== --- libvirt-acl.orig/src/uml/uml_driver.c +++ libvirt-acl/src/uml/uml_driver.c @@ -2219,9 +2219,23 @@ static virStateDriver umlStateDriver = { .active = umlActive, }; +static void +umlVMDriverLock(void) +{ + umlDriverLock(uml_driver); +} + +static void +umlVMDriverUnlock(void) +{ + umlDriverUnlock(uml_driver); +} + static virNWFilterCallbackDriver umlCallbackDriver = { .name = "UML", .vmFilterRebuild = umlVMFilterRebuild, + .vmDriverLock = umlVMDriverLock, + .vmDriverUnlock = umlVMDriverUnlock, }; int umlRegister(void) { Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -2161,6 +2161,24 @@ virNWFilterRegisterCallbackDriver(virNWF } } +void +virNWFilterCallbackDriversLock(void) +{ + int i; + + for (i = 0; i < nCallbackDriver; i++) + callbackDrvArray[i]->vmDriverLock(); +} + +void +virNWFilterCallbackDriversUnlock(void) +{ + int i; + + for (i = 0; i < nCallbackDriver; i++) + callbackDrvArray[i]->vmDriverUnlock(); +} + static virHashIterator virNWFilterDomainFWUpdateCB; Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -534,6 +534,8 @@ virNWFilterConfLayerInit; virNWFilterConfLayerShutdown; virNWFilterLockFilterUpdates; virNWFilterUnlockFilterUpdates; +virNWFilterCallbackDriversLock; +virNWFilterCallbackDriversUnlock; # nwfilter_params.h Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -34,6 +34,7 @@ #include "memory.h" #include "domain_conf.h" #include "domain_nwfilter.h" +#include "nwfilter_conf.h" #include "nwfilter_driver.h" #include "nwfilter_gentech_driver.h" @@ -152,9 +153,13 @@ nwfilterDriverReload(void) { virNWFilterLearnThreadsTerminate(true); nwfilterDriverLock(driverState); + virNWFilterCallbackDriversLock(); + virNWFilterPoolLoadAllConfigs(conn, &driverState->pools, driverState->configDir); + + virNWFilterCallbackDriversUnlock(); nwfilterDriverUnlock(driverState); virConnectClose(conn); @@ -328,12 +333,21 @@ nwfilterDefine(virConnectPtr conn, virNWFilterPtr ret = NULL; nwfilterDriverLock(driver); + virNWFilterCallbackDriversLock(); + if (!(def = virNWFilterDefParseString(conn, xml))) goto cleanup; if (!(pool = virNWFilterPoolObjAssignDef(conn, &driver->pools, def))) goto cleanup; +#define CRITICAL_SECTION_STRETCH 10 +if (true) { + fprintf(stderr,"sleep in %s\n", __FUNCTION__); + sleep(CRITICAL_SECTION_STRETCH); + fprintf(stderr,"continue in %s\n", __FUNCTION__); +} + if (virNWFilterPoolObjSaveDef(driver, pool, def) < 0) { virNWFilterPoolObjRemove(&driver->pools, pool); def = NULL; @@ -347,6 +361,8 @@ cleanup: virNWFilterDefFree(def); if (pool) virNWFilterPoolObjUnlock(pool); + + virNWFilterCallbackDriversUnlock(); nwfilterDriverUnlock(driver); return ret; } @@ -359,6 +375,8 @@ nwfilterUndefine(virNWFilterPtr obj) { int ret = -1; nwfilterDriverLock(driver); + virNWFilterCallbackDriversLock(); + pool = virNWFilterPoolObjFindByUUID(&driver->pools, obj->uuid); if (!pool) { virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, @@ -366,6 +384,12 @@ nwfilterUndefine(virNWFilterPtr obj) { goto cleanup; } +if (true) { + fprintf(stderr,"sleep in %s\n", __FUNCTION__); + sleep(CRITICAL_SECTION_STRETCH); + fprintf(stderr,"continue in %s\n", __FUNCTION__); +} + if (virNWFilterTestUnassignDef(obj->conn, pool)) { virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, "%s", @@ -385,6 +409,8 @@ nwfilterUndefine(virNWFilterPtr obj) { cleanup: if (pool) virNWFilterPoolObjUnlock(pool); + + virNWFilterCallbackDriversUnlock(); nwfilterDriverUnlock(driver); return ret; }

1 1

[libvirt] [PATCH] xen: Fix bogus error when attaching a device
by Jiri Denemark 06 Oct '10

06 Oct '10

The xm internal xen driver only supports disk and network devices to be added to a guest. On an attempt to attach any other device the xm driver used VIR_ERR_XML_ERROR which resulted in a completely bogus error message: error: Failed to attach device from pci.xml error: XML description for unknown device is not well formed or invalid --- src/xen/xm_internal.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/xen/xm_internal.c b/src/xen/xm_internal.c index fcc9378..00f0df8 100644 --- a/src/xen/xm_internal.c +++ b/src/xen/xm_internal.c @@ -2980,8 +2980,8 @@ xenXMDomainAttachDeviceFlags(virDomainPtr domain, const char *xml, } default: - xenXMError(VIR_ERR_XML_ERROR, - "%s", _("unknown device")); + xenXMError(VIR_ERR_OPERATION_INVALID, "%s", + _("Xm driver only supports adding disk or network devices")); goto cleanup; } -- 1.7.3.1

3 5

[libvirt] The last two remaining "out of the box" build failures for OS X
by Justin Clift 06 Oct '10

06 Oct '10

Hi all, On the home straight getting libvirt to work "out of the box" on MacOS X. (ideal scenario: it's "good enough" today. :>) With the very latest git snapshot, to get a working compile requires these options to be used: ./configure --without-network --without-storage-fs Leaving either of the network or storage-fs options not explicitly disabled, causes failure during compilation. Wondering if these two or fundamentally Linux specific things, so we should update our configure.ac to not attempt them on non-Linux, or do they indicate actual problem(s)? *********************************************************************** *********************************************************************** The remainder of this email is kind of lengthy, giving info on the specific errors caused by each of the above options. Feel free to ignore this if it's of no interest. :) + Leaving off --without-network gives *********************************************************************** gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../gnulib/lib -I../gnulib/lib -I../include -I../src/util -I../include -I/usr/include/libxml2 -DLIBDIR=\"/opt/libvirt/lib\" -DBINDIR=\"/opt/libvirt/libexec\" -DSBINDIR=\"/opt/libvirt/sbin\" -DSYSCONF_DIR=\"/opt/libvirt/etc\" -DLOCALEBASEDIR=\"/opt/libvirt/share/locale\" -DPKGDATADIR=\"/opt/libvirt/share/libvirt\" -DLOCAL_STATE_DIR=\"/opt/libvirt/var\" -DGETTEXT_PACKAGE=\"libvirt\" -Wall -Wformat -Wformat-security -Wmissing-prototypes -Wnested-externs -Wpointer-arith -Wextra -Wshadow -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Winline -Wredundant-decls -Wno-sign-compare -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fasynchronous-unwind-tables -fdiagnostics-show-option -DIN_LIBVIRT -g -O2 -MT libvirt_util_la-bridge.lo -MD -MP -MF .deps/libvirt_util_la-bridge.Tpo -c util/bridge.c -fno-common -DPIC -o .libs/libvirt_util_la-bridge.o gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../gnulib/lib -I../gnulib/lib -I../include -I../src/util -I../include -I/usr/include/libxml2 -DLIBDIR=\"/opt/libvirt/lib\" -DBINDIR=\"/opt/libvirt/libexec\" -DSBINDIR=\"/opt/libvirt/sbin\" -DSYSCONF_DIR=\"/opt/libvirt/etc\" -DLOCALEBASEDIR=\"/opt/libvirt/share/locale\" -DPKGDATADIR=\"/opt/libvirt/share/libvirt\" -DLOCAL_STATE_DIR=\"/opt/libvirt/var\" -DGETTEXT_PACKAGE=\"libvirt\" -Wall -Wformat -Wformat-security -Wmissing-prototypes -Wnested-externs -Wpointer-arith -Wextra -Wshadow -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Winline -Wredundant-decls -Wno-sign-compare -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fasynchronous-unwind-tables -fdiagnostics-show-option -DIN_LIBVIRT -g -O2 -MT libvirt_util_la-buf.lo -MD -MP -MF .deps/libvirt_util_la-buf.Tpo -c util/buf.c -fno-common -DPIC -o .libs/libvirt_util_la-buf.o In file included from util/bridge.h:29, from util/bridge.c:26: /usr/include/net/if.h:264: error: field 'ifru_addr' has incomplete type /usr/include/net/if.h:265: error: field 'ifru_dstaddr' has incomplete type /usr/include/net/if.h:266: error: field 'ifru_broadaddr' has incomplete type /usr/include/net/if.h:305: error: field 'ifra_addr' has incomplete type /usr/include/net/if.h:306: error: field 'ifra_broadaddr' has incomplete type /usr/include/net/if.h:307: error: field 'ifra_mask' has incomplete type /usr/include/net/if.h:379: error: field 'addr' has incomplete type /usr/include/net/if.h:380: error: field 'dstaddr' has incomplete type util/bridge.c:41:55: error: linux/param.h: No such file or directory util/bridge.c:42:55: error: linux/sockios.h: No such file or directory util/bridge.c:43:55: error: linux/if_bridge.h: No such file or directory util/bridge.c:44:55: error: linux/if_tun.h: No such file or directory util/bridge.c: In function 'ifSetInterfaceMac': util/bridge.c:311: error: 'SIOCGIFHWADDR' undeclared (first use in this function) util/bridge.c:311: error: (Each undeclared identifier is reported only once util/bridge.c:311: error: for each function it appears in.) util/bridge.c:314: error: 'struct ifreq' has no member named 'ifr_hwaddr' util/bridge.c:314: error: 'struct ifreq' has no member named 'ifr_hwaddr' util/bridge.c:314: error: 'struct ifreq' has no member named 'ifr_hwaddr' util/bridge.c:314: error: 'struct ifreq' has no member named 'ifr_hwaddr' util/bridge.c:316: error: 'SIOCSIFHWADDR' undeclared (first use in this function) util/bridge.c: In function 'brAddTap': util/bridge.c:498: error: 'IFF_TAP' undeclared (first use in this function) util/bridge.c:498: error: 'IFF_NO_PI' undeclared (first use in this function) util/bridge.c:512: error: 'TUNSETIFF' undeclared (first use in this function) util/bridge.c:534: error: 'TUNSETPERSIST' undeclared (first use in this function) util/bridge.c: In function 'brDeleteTap': util/bridge.c:564: error: 'IFF_TAP' undeclared (first use in this function) util/bridge.c:564: error: 'IFF_NO_PI' undeclared (first use in this function) util/bridge.c:571: error: 'TUNSETIFF' undeclared (first use in this function) util/bridge.c:572: error: 'TUNSETPERSIST' undeclared (first use in this function) make[3]: *** [libvirt_util_la-bridge.lo] Error 1 make[3]: *** Waiting for unfinished jobs.... gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../gnulib/lib -I../gnulib/lib -I../include -I../src/util -I../include -I/usr/include/libxml2 -DLIBDIR=\"/opt/libvirt/lib\" -DBINDIR=\"/opt/libvirt/libexec\" -DSBINDIR=\"/opt/libvirt/sbin\" -DSYSCONF_DIR=\"/opt/libvirt/etc\" -DLOCALEBASEDIR=\"/opt/libvirt/share/locale\" -DPKGDATADIR=\"/opt/libvirt/share/libvirt\" -DLOCAL_STATE_DIR=\"/opt/libvirt/var\" -DGETTEXT_PACKAGE=\"libvirt\" -Wall -Wformat -Wformat-security -Wmissing-prototypes -Wnested-externs -Wpointer-arith -Wextra -Wshadow -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Winline -Wredundant-decls -Wno-sign-compare -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fasynchronous-unwind-tables -fdiagnostics-show-option -DIN_LIBVIRT -g -O2 -MT libvirt_util_la-buf.lo -MD -MP -MF .deps/libvirt_util_la-buf.Tpo -c util/buf.c -o libvirt_util_la-buf.o >/dev/null 2>&1 make[2]: *** [all] Error 2 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 $ *********************************************************************** + Leaving off --without-storage-fs gives *********************************************************************** gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../gnulib/lib -I../gnulib/lib -I../include -I../src/util -I../include -I/usr/include/libxml2 -DLIBDIR=\"/opt/libvirt/lib\" -DBINDIR=\"/opt/libvirt/libexec\" -DSBINDIR=\"/opt/libvirt/sbin\" -DSYSCONF_DIR=\"/opt/libvirt/etc\" -DLOCALEBASEDIR=\"/opt/libvirt/share/locale\" -DPKGDATADIR=\"/opt/libvirt/share/libvirt\" -DLOCAL_STATE_DIR=\"/opt/libvirt/var\" -DGETTEXT_PACKAGE=\"libvirt\" -Wall -Wformat -Wformat-security -Wmissing-prototypes -Wnested-externs -Wpointer-arith -Wextra -Wshadow -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Winline -Wredundant-decls -Wno-sign-compare -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fasynchronous-unwind-tables -fdiagnostics-show-option -DIN_LIBVIRT -I../src/conf -g -O2 -MT libvirt_driver_storage_la-storage_backend_fs.lo -MD -MP -MF .deps/libvirt_driver_storage_la-storage_backend_fs.Tpo -c storage/storage_backend_fs.c -fno-common -DPIC -o .libs/libvirt_driver_storage_la-storage_backend_fs.o storage/storage_backend_fs.c:145:21: error: mntent.h: No such file or directory storage/storage_backend_fs.c: In function 'virStorageBackendFileSystemIsMounted': storage/storage_backend_fs.c:274: error: storage size of 'ent' isn't known storage/storage_backend_fs.c:277: error: '_PATH_MOUNTED' undeclared (first use in this function) storage/storage_backend_fs.c:277: error: (Each undeclared identifier is reported only once storage/storage_backend_fs.c:277: error: for each function it appears in.) storage/storage_backend_fs.c:284: warning: implicit declaration of function 'getmntent_r' storage/storage_backend_fs.c:284: warning: nested extern declaration of 'getmntent_r' [-Wnested-externs] storage/storage_backend_fs.c:284: warning: comparison between pointer and integer storage/storage_backend_fs.c:274: warning: unused variable 'ent' [-Wunused-variable] make[3]: *** [libvirt_driver_storage_la-storage_backend_fs.lo] Error 1 make[3]: *** Waiting for unfinished jobs.... make[2]: *** [all] Error 2 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 $ This one kind of looked like it almost got through the compile stage. ;) ***********************************************************************

3 4

[libvirt] [PATCH] Add the device alias element to the domain.rng schema
by Matthias Bolte 05 Oct '10

05 Oct '10

Every device element that can contain an address element can also contain an alias element, but the domain.rng didn't reflect this. Therefore, running virt-xml-validate on the virsh dumpxml output of an active domain failed. It doesn't fail for inactive domains, because in that case dumpxml doesn't include the alias elements. Add the device alias element to the domain.rng schema and add a new test case to cover this. Indirectly reported by Jon Stanley. --- docs/schemas/domain.rng | 42 +++++++++++++++ tests/domainschemadata/device-aliases.xml | 79 +++++++++++++++++++++++++++++ 2 files changed, 121 insertions(+), 0 deletions(-) create mode 100644 tests/domainschemadata/device-aliases.xml diff --git a/docs/schemas/domain.rng b/docs/schemas/domain.rng index 2e0457b..8fdf864 100644 --- a/docs/schemas/domain.rng +++ b/docs/schemas/domain.rng @@ -503,6 +503,9 @@ <ref name="encryption"/> </optional> <optional> + <ref name="alias"/> + </optional> + <optional> <ref name="address"/> </optional> </define> @@ -697,6 +700,9 @@ </attribute> </optional> <optional> + <ref name="alias"/> + </optional> + <optional> <ref name="address"/> </optional> </element> @@ -762,6 +768,9 @@ </group> </choice> <optional> + <ref name="alias"/> + </optional> + <optional> <ref name="address"/> </optional> </element> @@ -924,6 +933,9 @@ </element> </optional> <optional> + <ref name="alias"/> + </optional> + <optional> <ref name="address"/> </optional> <optional> @@ -1157,6 +1169,9 @@ </element> </optional> <optional> + <ref name="alias"/> + </optional> + <optional> <ref name="address"/> </optional> </element> @@ -1240,6 +1255,9 @@ <ref name="qemucdevTgtDef"/> </optional> <optional> + <ref name="alias"/> + </optional> + <optional> <ref name="address"/> </optional> </interleave> @@ -1345,6 +1363,9 @@ </choice> </attribute> <optional> + <ref name="alias"/> + </optional> + <optional> <ref name="address"/> </optional> </element> @@ -1369,6 +1390,9 @@ </attribute> </optional> <optional> + <ref name="alias"/> + </optional> + <optional> <ref name="address"/> </optional> </element> @@ -1383,6 +1407,9 @@ </choice> </attribute> <optional> + <ref name="alias"/> + </optional> + <optional> <ref name="address"/> </optional> </element> @@ -1426,6 +1453,9 @@ <ref name="virtioTarget"/> </choice> <optional> + <ref name="alias"/> + </optional> + <optional> <ref name="address"/> </optional> </interleave> @@ -1449,6 +1479,9 @@ </attribute> </optional> <optional> + <ref name="alias"/> + </optional> + <optional> <ref name="address"/> </optional> </element> @@ -1492,6 +1525,9 @@ </element> </group> <optional> + <ref name="alias"/> + </optional> + <optional> <ref name="address"/> </optional> </element> @@ -1728,6 +1764,12 @@ </element> </define> + <define name="alias"> + <element name="alias"> + <attribute name="name"/> + </element> + </define> + <define name="filterref-node-attributes"> <attribute name="filter"> <data type="NCName"/> diff --git a/tests/domainschemadata/device-aliases.xml b/tests/domainschemadata/device-aliases.xml new file mode 100644 index 0000000..6b0299e --- /dev/null +++ b/tests/domainschemadata/device-aliases.xml @@ -0,0 +1,79 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory>219200</memory> + <currentMemory>219200</currentMemory> + <vcpu>1</vcpu> + <os> + <type arch='x86_64' machine='pc-0.12'>hvm</type> + <boot dev='cdrom'/> + </os> + <features> + <acpi/> + <apic/> + <pae/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='raw'/> + <source file='/var/lib/libvirt/images/QEMUGuest1.img'/> + <target dev='hda' bus='ide'/> + <alias name='ide0-0-0'/> + <address type='drive' controller='0' bus='0' unit='0'/> + </disk> + <disk type='file' device='cdrom'> + <driver name='qemu' type='raw'/> + <source file='/var/lib/libvirt/images/foobar.iso'/> + <target dev='hdc' bus='ide'/> + <readonly/> + <alias name='ide0-1-0'/> + <address type='drive' controller='0' bus='1' unit='0'/> + </disk> + <filesystem type='file'> + <source file='/var/lib/libvirt/images/foobar.iso'/> + <target dir='/var/lib/libvirt/images'/> + <alias name='filesystem0'/> + </filesystem> + <controller type='ide' index='0'> + <alias name='ide0'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/> + </controller> + <interface type='user'> + <mac address='52:54:00:b5:36:36'/> + <alias name='net0'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <serial type='pty'> + <source path='/dev/pts/15'/> + <target port='0'/> + <alias name='serial0'/> + </serial> + <console type='pty' tty='/dev/pts/15'> + <source path='/dev/pts/15'/> + <target type='serial' port='0'/> + <alias name='serial0'/> + </console> + <input type='mouse' bus='ps2'> + <alias name='input0'/> + </input> + <graphics type='vnc' port='5900' autoport='no' listen='0.0.0.0'/> + <video> + <model type='cirrus' vram='9216' heads='1'/> + <alias name='video0'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <watchdog model='ib700' action='poweroff'> + <alias name='watchdog0'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x10' function='0x0'/> + </watchdog> + <memballoon model='virtio'> + <alias name='balloon0'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </memballoon> + </devices> +</domain> -- 1.7.0.4

2 1

[libvirt] OSX 10.6 build failures
by Justin Clift 05 Oct '10

05 Oct '10

Hi us, Going through the process of getting libvirt to compile on OSX, making notes of the failures on the way through (from a clean system) to be fixed. a) libtool -> glibtool libtoolize -> glibtoolize It turns out that autogen.sh is hard coded to use "libtool", and wants the GNU version. OSX supplies has it's own version, without a --version option, so autogen.sh fails. Installing GNU libtool through MacPorts, makes it available as glibtool, with libtoolize being glibtoolize. Adjusting autogen.sh to detect that, then set LIBTOOL and LIBTOOLIZE appropriately was fairly trivial. Will submit a patch to fix that in a bit. b) pkg-config The next thing to barf was autoconf, complaining about AC_MSG_ERROR not being a defined macro. Googling with some persistence showed this is caused by pkg-config not being installed. Fixed that. Will submit a patch for that too. Probably "pkg-config --version" based, copying the approach used for the other autogen.sh checks. c) This is a compilation failure, one I don't readily know how to fix: ... Making all in src make all-am CC libvirt_util_la-network.lo util/network.c: In function 'getIPv6Addr': util/network.c:50: error: 'struct in6_addr' has no member named 's6_addr16' util/network.c:50: error: 'struct in6_addr' has no member named 's6_addr16' util/network.c:50: error: 'struct in6_addr' has no member named 's6_addr16' util/network.c:50: error: 'struct in6_addr' has no member named 's6_addr16' make[3]: *** [libvirt_util_la-network.lo] Error 1 make[2]: *** [all] Error 2 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 $ They're the only problems so far, though most things have been disabled on the ./configure line so it's only the client libraries being built. Anyone know how to address that third one? Regards and best wishes, Justin Clift

2 7

[libvirt] [PATCH] configure: disable network and storage-fs drivers on mac os x
by Justin Clift 05 Oct '10

05 Oct '10

Disabling these two drivers on MacOS X, where they are known to not work, allows libvirt (including the daemon) to compile without any further changes. --- Whooo, we now run on MacOS X too. Anyone with a BSD around, that wants to check there, in case we get lucky? :) configure.ac | 39 ++++++++++++++++++++++++++++----------- 1 files changed, 28 insertions(+), 11 deletions(-) diff --git a/configure.ac b/configure.ac index 6c4e828..2dbfc72 100644 --- a/configure.ac +++ b/configure.ac @@ -182,12 +182,24 @@ if test "$prefix" = "/usr" && test "$sysconfdir" = '${prefix}/etc' ; then sysconfdir='/etc' fi -dnl lxc and qemu drivers require linux headers +dnl Make some notes about which OS we're compiling for, as the lxc and qemu +dnl drivers require linux headers, while storage_mpath and nwfilter are also +dnl linux specific. The "network" and "storage_fs" drivers are known to not +dnl work on MacOS X presently, so we also make a note if compiling for that + +with_linux=no +with_osx=no case "$host" in *-*-linux*) # match linux here so the *) case will match anything non-linux + with_linux=yes ;; *) + case "$host" in + *-*-darwin*) + with_osx=yes + ;; + esac if test "x$with_lxc" != "xyes" then with_lxc=no @@ -198,6 +210,7 @@ case "$host" in fi ;; esac +AM_CONDITIONAL([WITH_LINUX], [test "$with_linux" = "yes"]) dnl Allow to build without Xen, QEMU/KVM, test or remote driver AC_ARG_WITH([xen], @@ -1306,12 +1319,18 @@ fi AC_SUBST([READLINE_CFLAGS]) AC_SUBST([VIRSH_LIBS]) +dnl check if the network driver should be compiled AC_ARG_WITH([network], AC_HELP_STRING([--with-network], [with virtual network driver @<:@default=yes@:>@]),[],[with_network=yes]) -if test "$with_libvirtd" = "no" ; then + +dnl theres no use compiling the network driver without the libvirt +dnl daemon, nor compiling it for MacOS X, where it breaks the compile + +if test "$with_libvirtd" = "no" || test "$with_osx" = "yes"; then with_network=no fi + if test "$with_network" = "yes" ; then AC_DEFINE_UNQUOTED([WITH_NETWORK], 1, [whether network driver is enabled]) fi @@ -1389,6 +1408,11 @@ if test "$with_storage_dir" = "yes" ; then fi AM_CONDITIONAL([WITH_STORAGE_DIR], [test "$with_storage_dir" = "yes"]) +dnl storage-fs does not work on MacOS X + +if test "$with_osx" = "yes"; then + with_storage_fs=no +fi if test "$with_storage_fs" = "yes" || test "$with_storage_fs" = "check"; then AC_PATH_PROG([MOUNT], [mount], [], [$PATH:/sbin:/usr/sbin]) @@ -1503,14 +1527,6 @@ if test "$with_storage_scsi" = "check"; then fi AM_CONDITIONAL([WITH_STORAGE_SCSI], [test "$with_storage_scsi" = "yes"]) -with_linux=no -case "$host" in - *-*-linux*) - with_linux=yes - ;; -esac -AM_CONDITIONAL([WITH_LINUX], [test "$with_linux" = "yes"]) - if test "$with_storage_mpath" = "check" && test "$with_linux" = "yes"; then with_storage_mpath=yes @@ -2030,6 +2046,8 @@ then fi AM_CONDITIONAL([WITH_NODE_DEVICES], [test "$with_nodedev" = "yes"]) +dnl nwfilter should only be compiled for linux, and only if the +dnl libvirt daemon is also being compiled with_nwfilter=yes if test "$with_libvirtd" = "no" || test "$with_linux" != "yes"; then @@ -2040,7 +2058,6 @@ if test "$with_nwfilter" = "yes" ; then fi AM_CONDITIONAL([WITH_NWFILTER], [test "$with_nwfilter" = "yes"]) - AC_ARG_WITH([qemu-user], AC_HELP_STRING([--with-qemu-user], [username to run QEMU system instance as @<:@default=root@:>@]), [QEMU_USER=${withval}], -- 1.7.3

3 5

Re: [libvirt] Here they
by Jaromír Červenka 05 Oct '10

05 Oct '10

Hi there, Arnaud, where did you get latest source of my C# binding? Because my svn server doesn't work a couple of months, so maybe you used old one. I attached latest one in this mail. I am so sorry that I discontinued work of my bindings for libivirt, but I discovered Ruby language and I felt love in it and I ported my web interface for libvirt - now is built on Chris's ruby-libvirt. Arnaud I noticed that you didn't used my classes which "envelops" bare libvirt functions, am I right? Good work anyway, I'm glad that part of my job wont be lose :) Regards, Jaromír Červenka Official openSUSE community member Web: http://www.cervajz.com/ Jabber: cervajz(a)cervajz.com MSN: jara.cervenka(a)seznam.cz Tel.: +420 607 592 687 Alt. e-mails: jaromir.cervenka(a)opensuse.org, jaromir.cervenka(a)speel.cz Dne 24. září 2010 17:47 <arnaud.champion(a)devatom.fr> napsal(a): > I'm very away from a licence expert :) but I think that should be similar > to libvirt, so LGPL 2 or later seems good for me. > > A lot of code comes from Jaromír, I have changed these things : > - improve pinning and marshaling of struct, methods for using with C# and > windows libvirt binaries > - Add delegate to handle callbacks, this include pinnings and marshaling > also (I have to work little on the pinning/marshaling of the delegate > virConnectAuthCallback, because it seems that I have some trouble around > packing structure virConnectCredential) > > I have also added some XML auto documentation descriptors. > > > > -------------------------------------------------- > From: "Daniel Veillard" <veillard(a)redhat.com> > Sent: Friday, September 24, 2010 2:15 PM > To: <arnaud.champion(a)devatom.fr> > Cc: "Jaromír Červenka" <cervajz(a)cervajz.com> > Subject: Re: Here they > > > On Fri, Sep 24, 2010 at 11:29:51AM +0200, arnaud.champion(a)devatom.frwrote: >> >>> Hi, >>> >> >> Bonjour, >> >> As I have said, here are the libvirt C# bindings that I have modified. >>> For info, I use them in a project (DAVIM) and they work find, I will make a >>> doc to explain what is covered and what is not... >>> >>> Let me know if you have any question. >>> >> >> yes at least two: >> >> - what is the Licence for the code in that ZIP ? I would assume >> LGPL version 2 or later, to be similar to libvirt itself >> - how much of that code is coming from Jaromír ? >> >> thanks ! >> >> PS : Sorry for my poor english. FYI, DAVIM, is a tool to create / manage >>> Libvirt/KVM it is free to download at www.Devatom.fr the tol is in >>> english or french but the website is in french only. Let me know if you want >>> I send you the tool if you want to test it. >>> >> >> Pas de probleme ! >> A priori je n'ai pas de C# ni de machine Windows donc pas tres utile >> pour moi, mais merci ... >> >> Daniel >> >> -- >> Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ >> daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ >> http://veillard.com/ | virtualization library http://libvirt.org/ >> >> >

4 7

[libvirt] virt-install feature request
by Stanley, Jon [Tech] 04 Oct '10

04 Oct '10

So virt-install is a really nice piece of software, but it's a bit too complicated for our use case :). We would want some mode of it to simply generate XML and go home :). The use case is that we have a script which carries out a number of other actions in addition to creating a guest, and creating a guest and putting an OS on it are two separate steps. It would also be nice to have some command line interface to modify a guest's boot selection, for example, changing from PXE to local disk. Even nicer would be a concept of boot order - we have a setup where the first normal boot order is PXE, and if that fails (which it should a majority of the time) then go to local disk.

2 1

[libvirt] [PATCH] nwfilter: fix memory leaks
by Stefan Berger 04 Oct '10

04 Oct '10

Fixing memory leak shown by valgrind and freeing buffer in two more places. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -1508,7 +1508,11 @@ _iptablesCreateRuleInstance(int directio } if (virBufferUse(&prefix)) { - virBufferVSprintf(&prefix, "%s", virBufferContentAndReset(&buf)); + char *s = virBufferContentAndReset(&buf); + + virBufferVSprintf(&prefix, "%s", s); + + VIR_FREE(s); final = &prefix; @@ -1531,11 +1535,13 @@ _iptablesCreateRuleInstance(int directio err_exit: virBufferFreeAndReset(&buf); + virBufferFreeAndReset(&prefix); return -1; exit_no_error: virBufferFreeAndReset(&buf); + virBufferFreeAndReset(&prefix); return 0; }

2 2

[libvirt] [PATCH] esx: Add support for virtual serial device network backing
by Matthias Bolte 02 Oct '10

02 Oct '10

Since version 4.1 ESX(i) can expose virtual serial devices over TCP. Add support in the VMX handling code for this, add test cases to cover it and add links to some documentation. ESX supports two additional protocols: TELNETS and TLS. Add them to the list of serial-over-TCP protocols. --- docs/formatdomain.html.in | 4 +- src/conf/domain_conf.c | 18 ++- src/conf/domain_conf.h | 3 + src/esx/README | 23 ++- src/esx/esx_vmx.c | 163 ++++++++++++++++++-- .../vmx2xmldata/vmx2xml-serial-network-client.vmx | 6 + .../vmx2xmldata/vmx2xml-serial-network-client.xml | 25 +++ .../vmx2xmldata/vmx2xml-serial-network-server.vmx | 6 + .../vmx2xmldata/vmx2xml-serial-network-server.xml | 25 +++ tests/vmx2xmltest.c | 2 + .../xml2vmxdata/xml2vmx-serial-network-client.vmx | 14 ++ .../xml2vmxdata/xml2vmx-serial-network-client.xml | 15 ++ .../xml2vmxdata/xml2vmx-serial-network-server.vmx | 14 ++ .../xml2vmxdata/xml2vmx-serial-network-server.xml | 15 ++ tests/xml2vmxtest.c | 2 + 15 files changed, 304 insertions(+), 31 deletions(-) create mode 100644 tests/vmx2xmldata/vmx2xml-serial-network-client.vmx create mode 100644 tests/vmx2xmldata/vmx2xml-serial-network-client.xml create mode 100644 tests/vmx2xmldata/vmx2xml-serial-network-server.vmx create mode 100644 tests/vmx2xmldata/vmx2xml-serial-network-server.xml create mode 100644 tests/xml2vmxdata/xml2vmx-serial-network-client.vmx create mode 100644 tests/xml2vmxdata/xml2vmx-serial-network-client.xml create mode 100644 tests/xml2vmxdata/xml2vmx-serial-network-server.vmx create mode 100644 tests/xml2vmxdata/xml2vmx-serial-network-server.xml diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 5e56dae..2f64f8d 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -1461,7 +1461,9 @@ qemu-kvm -net nic,model=? /dev/null ...</pre> <p> - Alternatively you can use telnet instead of raw TCP. + Alternatively you can use <code>telnet</code> instead of <code>raw</code> TCP. + <span class="since">Since 0.8.5</span> you can also use <code>telnets</code> + (secure telnet) and <code>tls</code>. <p> <pre> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index e05d5d7..92aa3d1 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -203,6 +203,12 @@ VIR_ENUM_IMPL(virDomainChr, VIR_DOMAIN_CHR_TYPE_LAST, "tcp", "unix") +VIR_ENUM_IMPL(virDomainChrTcpProtocol, VIR_DOMAIN_CHR_TCP_PROTOCOL_LAST, + "raw", + "telnet", + "telnets", + "tls") + VIR_ENUM_IMPL(virDomainSoundModel, VIR_DOMAIN_SOUND_MODEL_LAST, "sb16", "es1370", @@ -2748,12 +2754,10 @@ virDomainChrDefParseXML(virCapsPtr caps, def->data.tcp.listen = 1; } - if (protocol == NULL || - STREQ(protocol, "raw")) + if (protocol == NULL) def->data.tcp.protocol = VIR_DOMAIN_CHR_TCP_PROTOCOL_RAW; - else if (STREQ(protocol, "telnet")) - def->data.tcp.protocol = VIR_DOMAIN_CHR_TCP_PROTOCOL_TELNET; - else { + else if ((def->data.tcp.protocol = + virDomainChrTcpProtocolTypeFromString(protocol)) < 0) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, _("Unknown protocol '%s'"), protocol); goto error; @@ -5848,9 +5852,7 @@ virDomainChrDefFormat(virBufferPtr buf, def->data.tcp.host, def->data.tcp.service); virBufferVSprintf(buf, " <protocol type='%s'/>\n", - def->data.tcp.protocol == - VIR_DOMAIN_CHR_TCP_PROTOCOL_TELNET - ? "telnet" : "raw"); + virDomainChrTcpProtocolTypeToString(def->data.tcp.protocol)); break; case VIR_DOMAIN_CHR_TYPE_UNIX: diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 7195c04..9bf13d8 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -357,6 +357,8 @@ enum virDomainChrType { enum virDomainChrTcpProtocol { VIR_DOMAIN_CHR_TCP_PROTOCOL_RAW, VIR_DOMAIN_CHR_TCP_PROTOCOL_TELNET, + VIR_DOMAIN_CHR_TCP_PROTOCOL_TELNETS, /* secure telnet */ + VIR_DOMAIN_CHR_TCP_PROTOCOL_TLS, VIR_DOMAIN_CHR_TCP_PROTOCOL_LAST, }; @@ -1172,6 +1174,7 @@ VIR_ENUM_DECL(virDomainChrDevice) VIR_ENUM_DECL(virDomainChrChannelTarget) VIR_ENUM_DECL(virDomainChrConsoleTarget) VIR_ENUM_DECL(virDomainChr) +VIR_ENUM_DECL(virDomainChrTcpProtocol) VIR_ENUM_DECL(virDomainSoundModel) VIR_ENUM_DECL(virDomainMemballoonModel) VIR_ENUM_DECL(virDomainWatchdogModel) diff --git a/src/esx/README b/src/esx/README index 7254332..9ae93b1 100644 --- a/src/esx/README +++ b/src/esx/README @@ -3,13 +3,24 @@ Some links to relevant documentation ==================================== -VI/vSphere API: http://www.vmware.com/support/developer/vc-sdk/visdk25pubs/ReferenceGuide/ - http://www.vmware.com/support/developer/vc-sdk/visdk400pubs/ReferenceGuide/ -VMX config: http://www.sanbarrow.com/vmx.html -CPUID: http://www.sandpile.org/ia32/cpuid.htm -Memory model: http://www.vmware.com/pdf/esx3_memory.pdf - http://www.vmware.com/pdf/usenix_resource_mgmt.pdf +VI/vSphere API: + http://www.vmware.com/support/developer/vc-sdk/visdk25pubs/ReferenceGuide/ + http://www.vmware.com/support/developer/vc-sdk/visdk400pubs/ReferenceGuide/ + http://www.vmware.com/support/developer/vc-sdk/visdk41pubs/ApiReference/ +VMX config: + http://www.sanbarrow.com/vmx.html + +CPUID: + http://www.sandpile.org/ia32/cpuid.htm + +Memory model: + http://www.vmware.com/pdf/esx3_memory.pdf + http://www.vmware.com/pdf/usenix_resource_mgmt.pdf + +Virtual serial port (network backed): + http://www.vmware.com/support/developer/vc-sdk/visdk41pubs/ApiReference/vim… + http://www.vmware.com/support/developer/vc-sdk/visdk41pubs/vsp41_usingproxy… diff --git a/src/esx/esx_vmx.c b/src/esx/esx_vmx.c index 59eb3b2..bfebc4a 100644 --- a/src/esx/esx_vmx.c +++ b/src/esx/esx_vmx.c @@ -379,6 +379,36 @@ def->serials[0]... ??? <=> serial0.yieldOnMsrRead = "true" # defaults to "false", FIXME: not representable +## serials: network, server (since vSphere 4.1) ################################ + +->type = _CHR_TYPE_TCP <=> serial0.fileType = "network" + +->data.tcp.host = <host> <=> serial0.fileName = "<protocol>://<host>:<service>" +->data.tcp.service = <service> # e.g. "telnet://0.0.0.0:42001" +->data.tcp.protocol = <protocol> + +->data.tcp.listen = 1 <=> serial0.network.endPoint = "server" # defaults to "server" + +??? <=> serial0.vspc = "foobar" # defaults to <not present>, FIXME: not representable +??? <=> serial0.tryNoRxLoss = "false" # defaults to "false", FIXME: not representable +??? <=> serial0.yieldOnMsrRead = "true" # defaults to "false", FIXME: not representable + + +## serials: network, client (since vSphere 4.1) ################################ + +->type = _CHR_TYPE_TCP <=> serial0.fileType = "network" + +->data.tcp.host = <host> <=> serial0.fileName = "<protocol>://<host>:<service>" +->data.tcp.service = <service> # e.g. "telnet://192.168.0.17:42001" +->data.tcp.protocol = <protocol> + +->data.tcp.listen = 0 <=> serial0.network.endPoint = "client" # defaults to "server" + +??? <=> serial0.vspc = "foobar" # defaults to <not present>, FIXME: not representable +??? <=> serial0.tryNoRxLoss = "false" # defaults to "false", FIXME: not representable +??? <=> serial0.yieldOnMsrRead = "true" # defaults to "false", FIXME: not representable + + ################################################################################ ## parallels ################################################################### @@ -424,8 +454,11 @@ def->parallels[0]... #define VIR_FROM_THIS VIR_FROM_ESX +#define ESX_BUILD_VMX_NAME_EXTRA(_suffix, _extra) \ + snprintf(_suffix##_name, sizeof(_suffix##_name), "%s."_extra, prefix); + #define ESX_BUILD_VMX_NAME(_suffix) \ - snprintf(_suffix##_name, sizeof(_suffix##_name), "%s."#_suffix, prefix); + ESX_BUILD_VMX_NAME_EXTRA(_suffix, #_suffix) /* directly map the virDomainControllerModel to esxVMX_SCSIControllerModel, * this is good enough for now because all virDomainControllerModel values @@ -2113,6 +2146,11 @@ esxVMX_ParseSerial(esxVMX_Context *ctx, virConfPtr conf, int port, char fileName_name[48] = ""; char *fileName = NULL; + char network_endPoint_name[48] = ""; + char *network_endPoint = NULL; + + xmlURIPtr parsedUri = NULL; + if (def == NULL || *def != NULL) { ESX_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid argument")); return -1; @@ -2137,6 +2175,7 @@ esxVMX_ParseSerial(esxVMX_Context *ctx, virConfPtr conf, int port, ESX_BUILD_VMX_NAME(startConnected); ESX_BUILD_VMX_NAME(fileType); ESX_BUILD_VMX_NAME(fileName); + ESX_BUILD_VMX_NAME_EXTRA(network_endPoint, "network.endPoint"); /* vmx:present */ if (esxUtil_GetConfigBoolean(conf, present_name, &present, false, @@ -2165,6 +2204,12 @@ esxVMX_ParseSerial(esxVMX_Context *ctx, virConfPtr conf, int port, goto cleanup; } + /* vmx:network.endPoint -> def:data.tcp.listen */ + if (esxUtil_GetConfigString(conf, network_endPoint_name, &network_endPoint, + true) < 0) { + goto cleanup; + } + /* Setup virDomainChrDef */ if (STRCASEEQ(fileType, "device")) { (*def)->target.port = port; @@ -2190,10 +2235,72 @@ esxVMX_ParseSerial(esxVMX_Context *ctx, virConfPtr conf, int port, (*def)->data.file.path = fileName; fileName = NULL; + } else if (STRCASEEQ(fileType, "network")) { + (*def)->target.port = port; + (*def)->type = VIR_DOMAIN_CHR_TYPE_TCP; + + parsedUri = xmlParseURI(fileName); + + if (parsedUri == NULL) { + virReportOOMError(); + goto cleanup; + } + + if (parsedUri->port == 0) { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, + _("VMX entry '%s' doesn't contain a port part"), + fileName_name); + goto cleanup; + } + + (*def)->data.tcp.host = strdup(parsedUri->server); + + if ((*def)->data.tcp.host == NULL) { + virReportOOMError(); + goto cleanup; + } + + if (virAsprintf(&(*def)->data.tcp.service, "%d", parsedUri->port) < 0) { + virReportOOMError(); + goto cleanup; + } + + /* See vSphere API documentation about VirtualSerialPortURIBackingInfo */ + if (parsedUri->scheme == NULL || + STRCASEEQ(parsedUri->scheme, "tcp") || + STRCASEEQ(parsedUri->scheme, "tcp4") || + STRCASEEQ(parsedUri->scheme, "tcp6")) { + (*def)->data.tcp.protocol = VIR_DOMAIN_CHR_TCP_PROTOCOL_RAW; + } else if (STRCASEEQ(parsedUri->scheme, "telnet")) { + (*def)->data.tcp.protocol = VIR_DOMAIN_CHR_TCP_PROTOCOL_TELNET; + } else if (STRCASEEQ(parsedUri->scheme, "telnets")) { + (*def)->data.tcp.protocol = VIR_DOMAIN_CHR_TCP_PROTOCOL_TELNETS; + } else if (STRCASEEQ(parsedUri->scheme, "ssl") || + STRCASEEQ(parsedUri->scheme, "tcp+ssl") || + STRCASEEQ(parsedUri->scheme, "tcp4+ssl") || + STRCASEEQ(parsedUri->scheme, "tcp6+ssl")) { + (*def)->data.tcp.protocol = VIR_DOMAIN_CHR_TCP_PROTOCOL_TLS; + } else { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, + _("VMX entry '%s' contains unsupported scheme '%s'"), + fileName_name, parsedUri->scheme); + goto cleanup; + } + + if (network_endPoint == NULL || STRCASEEQ(network_endPoint, "server")) { + (*def)->data.tcp.listen = 1; + } else if (STRCASEEQ(network_endPoint, "client")) { + (*def)->data.tcp.listen = 0; + } else { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, + _("Expecting VMX entry '%s' to be 'server' or 'client' " + "but found '%s'"), network_endPoint_name, network_endPoint); + goto cleanup; + } } else { ESX_ERROR(VIR_ERR_INTERNAL_ERROR, _("Expecting VMX entry '%s' to be 'device', 'file' or 'pipe' " - "but found '%s'"), fileType_name, fileType); + "or 'network' but found '%s'"), fileType_name, fileType); goto cleanup; } @@ -2207,6 +2314,8 @@ esxVMX_ParseSerial(esxVMX_Context *ctx, virConfPtr conf, int port, VIR_FREE(fileType); VIR_FREE(fileName); + VIR_FREE(network_endPoint); + xmlFreeURI(parsedUri); return result; @@ -3069,6 +3178,7 @@ esxVMX_FormatSerial(esxVMX_Context *ctx, virDomainChrDefPtr def, virBufferPtr buffer) { char *fileName = NULL; + const char *protocol; if (def->target.port < 0 || def->target.port > 3) { ESX_ERROR(VIR_ERR_INTERNAL_ERROR, @@ -3077,13 +3187,6 @@ esxVMX_FormatSerial(esxVMX_Context *ctx, virDomainChrDefPtr def, return -1; } - if (def->data.file.path == NULL) { - ESX_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", - _("Expecting domain XML attribute 'path' of entry " - "'devices/serial/source' to be present")); - return -1; - } - virBufferVSprintf(buffer, "serial%d.present = \"true\"\n", def->target.port); /* def:type -> vmx:fileType and def:data.file.path -> vmx:fileName */ @@ -3124,6 +3227,41 @@ esxVMX_FormatSerial(esxVMX_Context *ctx, virDomainChrDefPtr def, def->target.port, def->data.file.path); break; + case VIR_DOMAIN_CHR_TYPE_TCP: + switch (def->data.tcp.protocol) { + case VIR_DOMAIN_CHR_TCP_PROTOCOL_RAW: + protocol = "tcp"; + break; + + case VIR_DOMAIN_CHR_TCP_PROTOCOL_TELNET: + protocol = "telnet"; + break; + + case VIR_DOMAIN_CHR_TCP_PROTOCOL_TELNETS: + protocol = "telnets"; + break; + + case VIR_DOMAIN_CHR_TCP_PROTOCOL_TLS: + protocol = "ssl"; + break; + + default: + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, + _("Unsupported character device TCP protocol '%s'"), + virDomainChrTcpProtocolTypeToString(def->data.tcp.protocol)); + return -1; + } + + virBufferVSprintf(buffer, "serial%d.fileType = \"network\"\n", + def->target.port); + virBufferVSprintf(buffer, "serial%d.fileName = \"%s://%s:%s\"\n", + def->target.port, protocol, def->data.tcp.host, + def->data.tcp.service); + virBufferVSprintf(buffer, "serial%d.network.endPoint = \"%s\"\n", + def->target.port, + def->data.tcp.listen ? "server" : "client"); + break; + default: ESX_ERROR(VIR_ERR_INTERNAL_ERROR, _("Unsupported character device type '%s'"), @@ -3154,13 +3292,6 @@ esxVMX_FormatParallel(esxVMX_Context *ctx, virDomainChrDefPtr def, return -1; } - if (def->data.file.path == NULL) { - ESX_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", - _("Expecting domain XML attribute 'path' of entry " - "'devices/parallel/source' to be present")); - return -1; - } - virBufferVSprintf(buffer, "parallel%d.present = \"true\"\n", def->target.port); diff --git a/tests/vmx2xmldata/vmx2xml-serial-network-client.vmx b/tests/vmx2xmldata/vmx2xml-serial-network-client.vmx new file mode 100644 index 0000000..18cfc57 --- /dev/null +++ b/tests/vmx2xmldata/vmx2xml-serial-network-client.vmx @@ -0,0 +1,6 @@ +config.version = "8" +virtualHW.version = "4" +serial0.present = "true" +serial0.fileType = "network" +serial0.fileName = "tcp://192.168.0.17:42001" +serial0.network.endPoint = "client" diff --git a/tests/vmx2xmldata/vmx2xml-serial-network-client.xml b/tests/vmx2xmldata/vmx2xml-serial-network-client.xml new file mode 100644 index 0000000..b0c0715 --- /dev/null +++ b/tests/vmx2xmldata/vmx2xml-serial-network-client.xml @@ -0,0 +1,25 @@ +<domain type='vmware'> + <uuid>00000000-0000-0000-0000-000000000000</uuid> + <memory>32768</memory> + <currentMemory>32768</currentMemory> + <vcpu>1</vcpu> + <os> + <type arch='i686'>hvm</type> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <serial type='tcp'> + <source mode='connect' host='192.168.0.17' service='42001'/> + <protocol type='raw'/> + <target port='0'/> + </serial> + <console type='tcp'> + <source mode='connect' host='192.168.0.17' service='42001'/> + <protocol type='raw'/> + <target type='serial' port='0'/> + </console> + </devices> +</domain> diff --git a/tests/vmx2xmldata/vmx2xml-serial-network-server.vmx b/tests/vmx2xmldata/vmx2xml-serial-network-server.vmx new file mode 100644 index 0000000..d4a9c41 --- /dev/null +++ b/tests/vmx2xmldata/vmx2xml-serial-network-server.vmx @@ -0,0 +1,6 @@ +config.version = "8" +virtualHW.version = "4" +serial0.present = "true" +serial0.fileType = "network" +serial0.fileName = "telnets://0.0.0.0:42001" +serial0.network.endPoint = "server" diff --git a/tests/vmx2xmldata/vmx2xml-serial-network-server.xml b/tests/vmx2xmldata/vmx2xml-serial-network-server.xml new file mode 100644 index 0000000..e151017 --- /dev/null +++ b/tests/vmx2xmldata/vmx2xml-serial-network-server.xml @@ -0,0 +1,25 @@ +<domain type='vmware'> + <uuid>00000000-0000-0000-0000-000000000000</uuid> + <memory>32768</memory> + <currentMemory>32768</currentMemory> + <vcpu>1</vcpu> + <os> + <type arch='i686'>hvm</type> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <serial type='tcp'> + <source mode='bind' host='0.0.0.0' service='42001'/> + <protocol type='telnets'/> + <target port='0'/> + </serial> + <console type='tcp'> + <source mode='bind' host='0.0.0.0' service='42001'/> + <protocol type='telnets'/> + <target type='serial' port='0'/> + </console> + </devices> +</domain> diff --git a/tests/vmx2xmltest.c b/tests/vmx2xmltest.c index c71f536..2d59297 100644 --- a/tests/vmx2xmltest.c +++ b/tests/vmx2xmltest.c @@ -266,6 +266,8 @@ mymain(int argc, char **argv) DO_TEST("serial-pipe-server-vm", "serial-pipe", esxVI_ProductVersion_ESX35); DO_TEST("serial-pipe-client-app", "serial-pipe", esxVI_ProductVersion_ESX35); DO_TEST("serial-pipe-server-vm", "serial-pipe", esxVI_ProductVersion_ESX35); + DO_TEST("serial-network-server", "serial-network-server", esxVI_ProductVersion_ESX41); + DO_TEST("serial-network-client", "serial-network-client", esxVI_ProductVersion_ESX41); DO_TEST("parallel-file", "parallel-file", esxVI_ProductVersion_ESX35); DO_TEST("parallel-device", "parallel-device", esxVI_ProductVersion_ESX35); diff --git a/tests/xml2vmxdata/xml2vmx-serial-network-client.vmx b/tests/xml2vmxdata/xml2vmx-serial-network-client.vmx new file mode 100644 index 0000000..d10f403 --- /dev/null +++ b/tests/xml2vmxdata/xml2vmx-serial-network-client.vmx @@ -0,0 +1,14 @@ +config.version = "8" +virtualHW.version = "7" +guestOS = "other" +uuid.bios = "56 4d 9b ef ac d9 b4 e0-c8 f0 ae a8 b9 10 35 15" +displayName = "serial-network" +memsize = "4" +numvcpus = "1" +floppy0.present = "false" +floppy1.present = "false" +serial0.present = "true" +serial0.fileType = "network" +serial0.fileName = "tcp://192.168.0.17:42001" +serial0.network.endPoint = "client" +serial0.yieldOnMsrRead = "true" diff --git a/tests/xml2vmxdata/xml2vmx-serial-network-client.xml b/tests/xml2vmxdata/xml2vmx-serial-network-client.xml new file mode 100644 index 0000000..e2a5afe --- /dev/null +++ b/tests/xml2vmxdata/xml2vmx-serial-network-client.xml @@ -0,0 +1,15 @@ +<domain type='vmware'> + <name>serial-network</name> + <uuid>564d9bef-acd9-b4e0-c8f0-aea8b9103515</uuid> + <memory>4096</memory> + <os> + <type>hvm</type> + </os> + <devices> + <serial type='tcp'> + <source mode="connect" host="192.168.0.17" service="42001"/> + <protocol type="raw"/> + <target port='0'/> + </serial> + </devices> +</domain> diff --git a/tests/xml2vmxdata/xml2vmx-serial-network-server.vmx b/tests/xml2vmxdata/xml2vmx-serial-network-server.vmx new file mode 100644 index 0000000..b5d77f4 --- /dev/null +++ b/tests/xml2vmxdata/xml2vmx-serial-network-server.vmx @@ -0,0 +1,14 @@ +config.version = "8" +virtualHW.version = "7" +guestOS = "other" +uuid.bios = "56 4d 9b ef ac d9 b4 e0-c8 f0 ae a8 b9 10 35 15" +displayName = "serial-network" +memsize = "4" +numvcpus = "1" +floppy0.present = "false" +floppy1.present = "false" +serial0.present = "true" +serial0.fileType = "network" +serial0.fileName = "ssl://0.0.0.0:42001" +serial0.network.endPoint = "server" +serial0.yieldOnMsrRead = "true" diff --git a/tests/xml2vmxdata/xml2vmx-serial-network-server.xml b/tests/xml2vmxdata/xml2vmx-serial-network-server.xml new file mode 100644 index 0000000..a17e2fe --- /dev/null +++ b/tests/xml2vmxdata/xml2vmx-serial-network-server.xml @@ -0,0 +1,15 @@ +<domain type='vmware'> + <name>serial-network</name> + <uuid>564d9bef-acd9-b4e0-c8f0-aea8b9103515</uuid> + <memory>4096</memory> + <os> + <type>hvm</type> + </os> + <devices> + <serial type='tcp'> + <source mode="bind" host="0.0.0.0" service="42001"/> + <protocol type="tls"/> + <target port='0'/> + </serial> + </devices> +</domain> diff --git a/tests/xml2vmxtest.c b/tests/xml2vmxtest.c index 2a457b4..0881ae9 100644 --- a/tests/xml2vmxtest.c +++ b/tests/xml2vmxtest.c @@ -259,6 +259,8 @@ mymain(int argc, char **argv) DO_TEST("serial-file", "serial-file", esxVI_ProductVersion_ESX35); DO_TEST("serial-device", "serial-device", esxVI_ProductVersion_ESX35); DO_TEST("serial-pipe", "serial-pipe", esxVI_ProductVersion_ESX35); + DO_TEST("serial-network-server", "serial-network-server", esxVI_ProductVersion_ESX41); + DO_TEST("serial-network-client", "serial-network-client", esxVI_ProductVersion_ESX41); DO_TEST("parallel-file", "parallel-file", esxVI_ProductVersion_ESX35); DO_TEST("parallel-device", "parallel-device", esxVI_ProductVersion_ESX35); -- 1.7.0.4

2 2

[libvirt] cpulimit and kvm process
by Mihamina Rakotomandimby 01 Oct '10

01 Oct '10

Manao ahoana, Hello, Bonjour, I would like to launch several KVM guests on a multicore CPU. The number of the KVM process is over the number of physical cores. I would like to limit each KVM process to say... 10% of CPU I first use "cpulimit " Would you know some better way to limit them? it's in order to avoid 4 VM to hog all the 4 hardware cores. I also use all the livbirt tools, if there si any sol Misaotra, Thanks, Merci. -- Architecte Informatique chez Blueline/Gulfsat: Administration Systeme, Recherche & Developpement +261 34 56 000 19

4 3