- Devel - libvirt List Archives

[libvirt] [PATCH v2] Makefile: Fix parallel build after Xen-xl parser introduction
by Michal Privoznik 07 Jan '15

07 Jan '15

Well, the parallel build doesn't work as there are not dependencies set correctly. When running 'make -j' I see this error: make[2]: Entering directory '/home/zippy/work/libvirt/libvirt.git/src' GEN util/virkeymaps.h GEN locking/lock_protocol.h make[2]: *** No rule to make target 'xenconfig/xen_xl_disk.h', needed by 'all'. Stop. make[2]: *** Waiting for unfinished jobs.... GEN lxc/lxc_controller_dispatch.h The fix is to correctly set dependencies by letting make know that .c and .h are to be generated from .l. Moreover, the section is moved closer to the other section which uses it. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- This is reworked version of my first patch. The difference is that I'm using a stamp this time. src/Makefile.am | 46 +++++++++++++++++++++++++++++----------------- 1 file changed, 29 insertions(+), 17 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index c6d736e..e00ff63 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1000,23 +1000,6 @@ CPU_SOURCES = \ VMX_SOURCES = \ vmx/vmx.c vmx/vmx.h -AM_LFLAGS = -Pxl_disk_ --header-file=../$*.h -LEX_OUTPUT_ROOT = lex.xl_disk_ -BUILT_SOURCES += xenconfig/xen_xl_disk.c xenconfig/xen_xl_disk.h -# Generated header file is not implicitly added to dist -EXTRA_DIST += xenconfig/xen_xl_disk.h -CLEANFILES += xenconfig/xen_xl_disk.h xenconfig/xen_xl_disk.c - -XENXLDISKPARSER_SOURCES = xenconfig/xen_xl_disk.l - -XENCONFIG_SOURCES = \ - xenconfig/xenxs_private.h \ - xenconfig/xen_common.c xenconfig/xen_common.h \ - xenconfig/xen_sxpr.c xenconfig/xen_sxpr.h \ - xenconfig/xen_xm.c xenconfig/xen_xm.h \ - xenconfig/xen_xl.c xenconfig/xen_xl.h \ - xenconfig/xen_xl_disk.h - pkgdata_DATA = cpu/cpu_map.xml EXTRA_DIST += $(pkgdata_DATA) @@ -1070,6 +1053,33 @@ libvirt_vmx_la_SOURCES = $(VMX_SOURCES) endif WITH_VMX if WITH_XENCONFIG + +XENXLDISKPARSER_GENERATED_STAMP = .xen_xl_disk.stamp + +$(XENXLDISKPARSER_GENERATED): $(XENXLDISKPARSER_GENERATED_STAMP) + +$(XENXLDISKPARSER_GENERATED_STAMP): $(XENXLDISKPARSER_SOURCES) + $(AM_V_GEN) $(SHELL) $(YLWRAP) $< lex.xl_disk_.c xenconfig/xen_xl_disk.c \ + -- $(LEXCOMPILE) && touch $@ + +AM_LFLAGS = -Pxl_disk_ --header-file=../$*.h +XENXLDISKPARSER_GENERATED = xenconfig/xen_xl_disk.c xenconfig/xen_xl_disk.h + +BUILT_SOURCES += $(XENXLDISKPARSER_GENERATED) +EXTRA_DIST += $(XENXLDISKPARSER_GENERATED) $(XENXLDISKPARSER_GENERATED_STAMP) +MAINTAINERCLEANFILES += $(XENXLDISKPARSER_GENERATED) \ + $(XENXLDISKPARSER_GENERATED_STAMP) + +XENXLDISKPARSER_SOURCES = xenconfig/xen_xl_disk.l + +XENCONFIG_SOURCES = \ + xenconfig/xenxs_private.h \ + xenconfig/xen_common.c xenconfig/xen_common.h \ + xenconfig/xen_sxpr.c xenconfig/xen_sxpr.h \ + xenconfig/xen_xm.c xenconfig/xen_xm.h \ + xenconfig/xen_xl.c xenconfig/xen_xl.h \ + xenconfig/xen_xl_disk_i.h + # Flex generated XL disk parser needs to be compiled without WARN_FLAGS # Add the generated object to its own library to control CFLAGS noinst_LTLIBRARIES += libvirt_xenxldiskparser.la @@ -1077,6 +1087,8 @@ libvirt_xenxldiskparser_la_CFLAGS = \ -I$(top_srcdir)/src/conf $(AM_CFLAGS) -Wno-unused-parameter libvirt_xenxldiskparser_la_SOURCES = \ $(XENXLDISKPARSER_SOURCES) +libvirt_xenxldiskparser_la_DEPENDENCIES = \ + $(XENXLDISKPARSER_GENERATED) noinst_LTLIBRARIES += libvirt_xenconfig.la libvirt_la_BUILT_LIBADD += libvirt_xenconfig.la -- 2.0.5

4 3

[libvirt] [PATCHv5 00/18] LXC IP configuration feature
by Cédric Bosdonnat 06 Jan '15

06 Jan '15

Hi all, It's time for offering presents, so I'm sending you my updated patch series for IP configuration in LXC containers. The changes with v4 include: * Replacing the <gateway> element by a <route> one. * Addressing the comments you guys made I didn't forbid the use of iproute2 / ifconfig in containers if built without libnl, as I'm not sure about the possible consequences. Could it introduce regressions for some use cases/distros? Cédric Bosdonnat (18): Forgot to cleanup ifname_guest* in domain network def parsing virNetDevSetIPv4Address: libnl implementation Renamed virNetDevSetIPv4Address to virNetDevSetIPAddress virNetDevAddRoute: implementation using netlink virNetDevClearIPv4Address: netlink implementation Renamed virNetDevClearIPv4Address to virNetDevClearIPAddress Domain conf: allow more than one IP address for net devices IP doc LXC: set IP addresses to veth devices in the container lxc conf2xml: convert IP addresses Allow network capabilities hostdev to configure IP addresses lxc conf2xml: convert ip addresses for hostdev NICs Domain network devices can now have a <route> element lxc conf2xml: convert lxc.network.ipv[46].gateway LXC: use the new net devices routes definition LXC: honour network devices link state Openvz --ipadd can be provided multiple times Report error if a driver can't handle multiple IP addresses docs/formatdomain.html.in | 46 +++ docs/schemas/domaincommon.rng | 75 ++++- src/conf/domain_conf.c | 320 ++++++++++++++++++-- src/conf/domain_conf.h | 29 +- src/libvirt_private.syms | 6 +- src/lxc/lxc_container.c | 56 +++- src/lxc/lxc_native.c | 202 +++++++++---- src/network/bridge_driver.c | 4 +- src/openvz/openvz_conf.c | 2 +- src/openvz/openvz_driver.c | 11 +- src/qemu/qemu_driver.c | 26 +- src/qemu/qemu_hotplug.c | 5 +- src/uml/uml_conf.c | 2 +- src/util/virnetdev.c | 332 ++++++++++++++++++--- src/util/virnetdev.h | 14 +- src/util/virnetlink.c | 38 +++ src/util/virnetlink.h | 2 + src/util/virsocketaddr.h | 4 + src/vbox/vbox_common.c | 16 +- src/xenconfig/xen_common.c | 29 +- src/xenconfig/xen_sxpr.c | 26 +- .../lxcconf2xmldata/lxcconf2xml-physnetwork.config | 4 + tests/lxcconf2xmldata/lxcconf2xml-physnetwork.xml | 4 + tests/lxcconf2xmldata/lxcconf2xml-simple.config | 4 + tests/lxcconf2xmldata/lxcconf2xml-simple.xml | 4 + tests/lxcxml2xmldata/lxc-hostdev.xml | 4 + tests/lxcxml2xmldata/lxc-idmap.xml | 4 + tests/openvzutilstest.c | 2 +- tests/sexpr2xmldata/sexpr2xml-bridge-ipaddr.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-net-routed.xml | 2 +- 30 files changed, 1107 insertions(+), 168 deletions(-) -- 2.1.2

5 40

[libvirt] [PATCH] docs: Document some -boot option limitations on UEFI
by Michal Privoznik 06 Jan '15

06 Jan '15

It was brought to my attention that some -boot options may not work with UEFI. For instance, rebootTimeout is very SeaBIOS specific,splash logo is not implemented yet on OVMF, and so on. We should document this limitation at least. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- docs/formatdomain.html.in | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 499879e..a35316e 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -174,6 +174,18 @@ elements are mutually exclusive. <span class="since">Since 0.1.3, per-device boot since 0.8.8</span> </dd> + </dl> + <p>Up till here the BIOS/UEFI configuration knobs are generic enough to + be implemented by majority (if not all) firmwares out there. However, + from now on not every single setting makes sense to all firmwares. For + instance, <code>rebootTimeout</code> doesn't make sense for UEFI, + <code>useserial</code> might not be usable with a BIOS firmware that + doesn't produce any output onto serial line, etc. Moreover, firmwares + don't usually export their capabilities for libvirt (or users) to check. + And the set of their capabilities can change with every new release. + Hence users are advised to try the settings they use before relying on + them in production.</p> + <dl> <dt><code>bootmenu</code></dt> <dd> Whether or not to enable an interactive boot menu prompt on guest startup. The <code>enable</code> attribute can be either "yes" or "no". -- 2.0.5

2 1

[libvirt] [PATCHv2] qemu: fix tc old rules will be cleaned if set tc new rules fail
by Luyao Huang 06 Jan '15

06 Jan '15

https://bugzilla.redhat.com/show_bug.cgi?id=1177723 If tc cmd failed (maybe value too large) when we use virDomainSetInterfaceParameters , the old rules will be clean. Restore the old rules if tc failed. Signed-off-by: Luyao Huang <lhuang(a)redhat.com> --- v1 make a big mistake that i used a old libvirt src/qemu/qemu_driver.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 73a825d..650e0dd 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -10494,8 +10494,12 @@ qemuDomainSetInterfaceParameters(virDomainPtr dom, sizeof(*newBandwidth->out)); } - if (virNetDevBandwidthSet(net->ifname, newBandwidth, false) < 0) + if (virNetDevBandwidthSet(net->ifname, newBandwidth, false) < 0) { + ignore_value(virNetDevBandwidthSet(net->ifname, + net->bandwidth, + false)); goto endjob; + } virNetDevBandwidthFree(net->bandwidth); if (newBandwidth->in || newBandwidth->out) { -- 1.8.3.1

2 1

[libvirt] [PATCH] qemu: fix miss goto cleanup in qemuDomainAttachNetDevice
by Luyao Huang 06 Jan '15

06 Jan '15

This place have a wrong logic, maybe forget goto cleanup. Also fix some small things. Signed-off-by: Luyao Huang <lhuang(a)redhat.com> --- I am not sure i am right, but hotplug a net do not a address may cause a issue. src/qemu/qemu_hotplug.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 5d0d8e0..bfe1bd0 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -924,7 +924,7 @@ int qemuDomainAttachNetDevice(virConnectPtr conn, /* Set device online immediately */ if (qemuInterfaceStartDevice(net) < 0) - goto cleanup; + goto cleanup; /* Set Bandwidth */ if (virNetDevSupportBandwidth(actualType) && @@ -952,7 +952,8 @@ int qemuDomainAttachNetDevice(virConnectPtr conn, goto cleanup; } else if (virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_VIRTIO_S390)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("virtio-s390 net device cannot be hotplugged.")); + _("virtio-s390 net device cannot be hotplugged.")); + goto cleanup; } else if (virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_DEVICE) && virDomainPCIAddressEnsureAddr(priv->pciaddrs, &net->info) < 0) { goto cleanup; -- 1.8.3.1

2 1

[libvirt] [PATCH] virnetlink: fix build on non-Linux
by Eric Blake 06 Jan '15

06 Jan '15

Commit 4dc04d3a added virNetlinkGetErrorCode, but forgot to provide a fallback, which kills the build on mingw (among others): CCLD libvirt.la Cannot export virNetlinkGetErrorCode: symbol not defined collect2: error: ld returned 1 exit status * src/util/virnetlink.c (virNetlinkGetErrorCode): Provide fallback. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule. src/util/virnetlink.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/src/util/virnetlink.c b/src/util/virnetlink.c index 1a2b7a1..d52f66a 100644 --- a/src/util/virnetlink.c +++ b/src/util/virnetlink.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2010-2014 Red Hat, Inc. + * Copyright (C) 2010-2015 Red Hat, Inc. * Copyright (C) 2010-2012 IBM Corporation * * This library is free software; you can redistribute it and/or @@ -276,7 +276,9 @@ int virNetlinkCommand(struct nl_msg *nl_msg, return ret; } -int virNetlinkGetErrorCode(struct nlmsghdr *resp, unsigned int recvbuflen) + +int +virNetlinkGetErrorCode(struct nlmsghdr *resp, unsigned int recvbuflen) { struct nlmsgerr *err; int result = 0; @@ -314,6 +316,7 @@ int virNetlinkGetErrorCode(struct nlmsghdr *resp, unsigned int recvbuflen) return -EINVAL; } + static void virNetlinkEventServerLock(virNetlinkEventSrvPrivatePtr driver) { @@ -872,4 +875,13 @@ int virNetlinkEventRemoveClient(int watch ATTRIBUTE_UNUSED, return -1; } + +int +virNetlinkGetErrorCode(struct nlmsghdr *resp ATTRIBUTE_UNUSED, + unsigned int recvbuflen ATTRIBUTE_UNUSED) +{ + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _(unsupported)); + return -EINVAL; +} + #endif /* __linux__ */ -- 2.1.0

2 1

[libvirt] [PATCH RFC] LXC: don't RO mount /proc, /sys when user namespce enabled
by Chen Hanxiao 06 Jan '15

06 Jan '15

If we enabled user ns and provided a uid/gid map, we do not need to mount /proc, /sys as readonly. Leave it to kernel for protection. Signed-off-by: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> --- src/lxc/lxc_container.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 1b9e2f2..3b5845a 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -983,6 +983,12 @@ static int lxcContainerMountBasicFS(bool userns_enabled, goto cleanup; } + /* don't readonly mount when userns is enabled */ + if (userns_enabled) { + VIR_FREE(mnt_src); + continue; + } + if (bindOverReadonly && mount(mnt_src, mnt->dst, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY, NULL) < 0) { -- 1.9.3

5 5

[libvirt] [PATCH] networkGetDHCPLeases: Remove unnecessary error reporting
by Nehal J Wani 06 Jan '15

06 Jan '15

Lack of a lease (whether mac is given or not) is a normal expected scenario. There is no need to raise an error. Signed-off-by: Nehal J Wani <nehaljw.kkd1(a)gmail.com> --- src/network/bridge_driver.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index 29222d0..6a49a23 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -3654,12 +3654,6 @@ networkGetDHCPLeases(virNetworkPtr network, VIR_FREE(lease); } - if (need_results && mac && !leases_ret) { - virReportError(VIR_ERR_INTERNAL_ERROR, - _("no lease with matching MAC address: %s"), mac); - goto error; - } - if (leases_ret) { /* NULL terminated array */ ignore_value(VIR_REALLOC_N(leases_ret, nleases + 1)); -- 2.1.0

3 2

[libvirt] [PATCH] qemu: use a wrong name for guest panic status
by Luyao Huang 06 Jan '15

06 Jan '15

https://bugzilla.redhat.com/show_bug.cgi?id=1178652 We will get a warning when we have a guest in paused status(casue by kernel panic) and restart libvirtd, warning message like this: Qemu reported unknown VM status: 'guest-panicked' and this seems because we set a wrong status name in qemu_monitor.c, and from qemu qapi-schema.json file we know this status should named 'guest-panicked'. Signed-off-by: Luyao Huang <lhuang(a)redhat.com> --- src/qemu/qemu_monitor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index 100bbd0..57a13ab 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -127,7 +127,7 @@ VIR_ENUM_IMPL(qemuMonitorVMStatus, QEMU_MONITOR_VM_STATUS_LAST, "debug", "inmigrate", "internal-error", "io-error", "paused", "postmigrate", "prelaunch", "finish-migrate", "restore-vm", - "running", "save-vm", "shutdown", "watchdog", "guest-panic") + "running", "save-vm", "shutdown", "watchdog", "guest-panicked") typedef enum { QEMU_MONITOR_BLOCK_IO_STATUS_OK, -- 1.8.3.1

2 1

[libvirt] [PATCH] Makefile: Fix parallel build after Xen-xl parser introduction
by Michal Privoznik 06 Jan '15

06 Jan '15

Well, the parallel build doesn't work as there are not dependencies set correctly. When running 'make -j' I see this error: make[2]: Entering directory '/home/zippy/work/libvirt/libvirt.git/src' GEN util/virkeymaps.h GEN locking/lock_protocol.h make[2]: *** No rule to make target 'xenconfig/xen_xl_disk.h', needed by 'all'. Stop. make[2]: *** Waiting for unfinished jobs.... GEN lxc/lxc_controller_dispatch.h The fix is to correctly set dependencies by letting make know that .c and .h are to be generated from .l. Moreover, the section is moved closer to the other section which uses it. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- I'm not fully satisfied with this patch yet. I mean, for some reason it creates 'src/.h' file, but hey - it makes parallel build work again. Any brighter idea appreciated. src/Makefile.am | 36 +++++++++++++++++++----------------- 1 file changed, 19 insertions(+), 17 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index c6d736e..7619cf0 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1000,23 +1000,6 @@ CPU_SOURCES = \ VMX_SOURCES = \ vmx/vmx.c vmx/vmx.h -AM_LFLAGS = -Pxl_disk_ --header-file=../$*.h -LEX_OUTPUT_ROOT = lex.xl_disk_ -BUILT_SOURCES += xenconfig/xen_xl_disk.c xenconfig/xen_xl_disk.h -# Generated header file is not implicitly added to dist -EXTRA_DIST += xenconfig/xen_xl_disk.h -CLEANFILES += xenconfig/xen_xl_disk.h xenconfig/xen_xl_disk.c - -XENXLDISKPARSER_SOURCES = xenconfig/xen_xl_disk.l - -XENCONFIG_SOURCES = \ - xenconfig/xenxs_private.h \ - xenconfig/xen_common.c xenconfig/xen_common.h \ - xenconfig/xen_sxpr.c xenconfig/xen_sxpr.h \ - xenconfig/xen_xm.c xenconfig/xen_xm.h \ - xenconfig/xen_xl.c xenconfig/xen_xl.h \ - xenconfig/xen_xl_disk.h - pkgdata_DATA = cpu/cpu_map.xml EXTRA_DIST += $(pkgdata_DATA) @@ -1078,6 +1061,25 @@ libvirt_xenxldiskparser_la_CFLAGS = \ libvirt_xenxldiskparser_la_SOURCES = \ $(XENXLDISKPARSER_SOURCES) +AM_LFLAGS = -Pxl_disk_ --header-file=../$*.h +XENXLDISKPARSER_GENERATED = xenconfig/xen_xl_disk.c xenconfig/xen_xl_disk.h +BUILT_SOURCES += $(XENXLDISKPARSER_GENERATED) +EXTRA_DIST += $(XENXLDISKPARSER_GENERATED) +MAINTAINERCLEANFILES += $(XENXLDISKPARSER_GENERATED) + +XENXLDISKPARSER_SOURCES = xenconfig/xen_xl_disk.l + +$(XENXLDISKPARSER_GENERATED): $(XENXLDISKPARSER_SOURCES) + $(SHELL) $(YLWRAP) $< lex.xl_disk_.c $@ -- $(LEXCOMPILE) + +XENCONFIG_SOURCES = \ + xenconfig/xenxs_private.h \ + xenconfig/xen_common.c xenconfig/xen_common.h \ + xenconfig/xen_sxpr.c xenconfig/xen_sxpr.h \ + xenconfig/xen_xm.c xenconfig/xen_xm.h \ + xenconfig/xen_xl.c xenconfig/xen_xl.h \ + xenconfig/xen_xl_disk_i.h + noinst_LTLIBRARIES += libvirt_xenconfig.la libvirt_la_BUILT_LIBADD += libvirt_xenconfig.la libvirt_xenconfig_la_CFLAGS = \ -- 2.0.5

4 3

[libvirt] [PATCH] maint: update to latest gnulib
by Eric Blake 06 Jan '15

06 Jan '15

Another update is required to pick up today's gnulib fix for mingw builds (now that gnulib turns on mingw's replacement printf that understands %lld, it must also tell the compiler to respect the improved definition of PRIdMAX and friends). * .gnulib: Update to latest. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule. * .gnulib 498a1b6...c27f1a3 (3): > doc: update INSTALL from autoconf > stdio: fix use of PRIdMAX on modern mingw > Fix check for pthreads.h pollution on Mingw64 .gnulib | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gnulib b/.gnulib index 498a1b6..c27f1a3 160000 --- a/.gnulib +++ b/.gnulib @@ -1 +1 @@ -Subproject commit 498a1b6bc7d70f944ca0f939e1bc470889fdce76 +Subproject commit c27f1a356f2f321daa7f971ef276a1dbfa873bf8 -- 2.1.0

1 0

[libvirt] [PATCH 0/2] Misc fixes
by Cédric Bosdonnat 05 Jan '15

05 Jan '15

Hi there, Here are 2 patches fixing tiny annoying problems. One of them, makes apparmor profiles handle /usr/lib64 folder and the other one fixes an uncleaned piece of domain config. Cédric Bosdonnat (2): Teach AppArmor, that /usr/lib64 may exist. Fix error when starting a container after an error examples/apparmor/libvirt-qemu | 2 +- examples/apparmor/usr.lib.libvirt.virt-aa-helper | 4 ++-- examples/apparmor/usr.sbin.libvirtd | 4 ++-- src/lxc/lxc_process.c | 1 + 4 files changed, 6 insertions(+), 5 deletions(-) -- 2.1.2

5 7

[libvirt] Query: Implementation of virNetworkGetDHCPLeases
by Nehal J Wani 05 Jan '15

05 Jan '15

In the method networkGetDHCPLeases inside ./src/network/bridge_driver.c , we have: if (need_results && mac && !leases_ret) { virReportError(VIR_ERR_INTERNAL_ERROR, _("no lease with matching MAC address: %s"), mac); goto error; } Is this really required? In my opinion, since we are already filling rv with nleases (which will be 0, in case no lease corresponding to given mac is found), user will know that there is no result for his query. Why to report error? This results in: virsh # net-dhcp-leases --mac 00:50:56:c0:00:01 default error: Failed to get leases info for default error: internal error: no lease with matching MAC address: 00:50:56:c0:00:01 -- Nehal J Wani

2 1

[libvirt] [PATCH] maint: fix date in local gnulib patch
by Daniel P. Berrange 05 Jan '15

05 Jan '15

The local gnulib ssize_t.m4.diff patch no longer applied due to changed context from the date change. --- gnulib/local/m4/ssize_t.m4.diff | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Pushed as another build breaker fix diff --git a/gnulib/local/m4/ssize_t.m4.diff b/gnulib/local/m4/ssize_t.m4.diff index 08c2b9c..12cff12 100644 --- a/gnulib/local/m4/ssize_t.m4.diff +++ b/gnulib/local/m4/ssize_t.m4.diff @@ -5,7 +5,7 @@ index 209d64c..5ea72a1 100644 @@ -1,4 +1,4 @@ -# ssize_t.m4 serial 5 (gettext-0.18.2) +# ssize_t.m4 serial 6 (gettext-0.18.2) - dnl Copyright (C) 2001-2003, 2006, 2010-2014 Free Software Foundation, Inc. + dnl Copyright (C) 2001-2003, 2006, 2010-2015 Free Software Foundation, Inc. dnl This file is free software; the Free Software Foundation dnl gives unlimited permission to copy and/or distribute it, @@ -17,7 +17,21 @@ AC_DEFUN([gt_TYPE_SSIZE_T], -- 2.1.0

1 0

[libvirt] [PATCH] maint: update to latest gnulib
by Daniel P. Berrange 05 Jan '15

05 Jan '15

Sync to latest gnulib to get files updated with 2015 copyright date to fix syntax-check * .gnulib: update to latest * bootstrap: Regenerate from upstream Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- .gnulib | 2 +- bootstrap | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) Pushed as build-breaker fix for 'make syntax-check' year check diff --git a/.gnulib b/.gnulib index 3914f31..498a1b6 160000 --- a/.gnulib +++ b/.gnulib @@ -1 +1 @@ -Subproject commit 3914f3153576e9a5ba4002bde27de05211b5a79c +Subproject commit 498a1b6bc7d70f944ca0f939e1bc470889fdce76 diff --git a/bootstrap b/bootstrap index e0c4ec2..2fdf267 100755 --- a/bootstrap +++ b/bootstrap @@ -4,7 +4,7 @@ scriptversion=2014-12-08.12; # UTC # Bootstrap this package from checked-out sources. -# Copyright (C) 2003-2014 Free Software Foundation, Inc. +# Copyright (C) 2003-2015 Free Software Foundation, Inc. # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by -- 2.1.0

2 1

[libvirt] libvirt memory usage statistics
by Narayanan, Krishnaprasad 05 Jan '15

05 Jan '15

Hello all, I am using libvirt version 1.1.1 on one of the nodes which has several VMs. When I used virsh dommemstat <domain UUID>, I am getting the following flags: actual, swap_in and rss. I am not able to get the unused memory that is associated with the virtual machine. Can I kindly know is there a documentation that describe the memory flags? Further, can I get help from the forum to obtain information about the unused memory associated with the virtual machine? Regards, Krishnaprasad

2 1

[libvirt] [PATCH 0/3] Fix migration to older libvirt
by Pavel Hrdina 05 Jan '15

05 Jan '15

Recently I've implemented new feature that we can set "vgamem_mb" for QXL device and also I've fixed libvirt to honor the 'vram' attribute and pass that value to QEMU process. But with this change the migration to older libvirt stopped working because QEMU silently updates the video memory size if the value is too low or there are some dependencies (for example QXL device has to have 'ram' size twice as 'vgamem'). To fix the migration we need to load the updated values from QEMU and store them into the status XML. Pavel Hrdina (3): qemu_monitor: introduce new function to get QOM path qemu_monitor: move qemuMonitorJSONObjectProperty from qemu_monitor_json qemu_process: detect updated video ram size values from QEMU src/qemu/qemu_monitor.c | 207 ++++++++++++++++++++++++++++--------------- src/qemu/qemu_monitor.h | 38 ++++++++ src/qemu/qemu_monitor_json.c | 12 +-- src/qemu/qemu_monitor_json.h | 34 +------ src/qemu/qemu_process.c | 108 ++++++++++++++++++++++ tests/qemumonitorjsontest.c | 10 +-- 6 files changed, 295 insertions(+), 114 deletions(-) -- 2.0.4

3 8

[libvirt] [PATCH] src/Makefile.am: fix build breaker for xenconfig
by Pavel Hrdina 05 Jan '15

05 Jan '15

Commit 2c78051a introduced build breaker with type in Makefile.am by specifying wrong header file. Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- Pushed as build breaker. src/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Makefile.am b/src/Makefile.am index 8ccc273..c6d736e 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1015,7 +1015,7 @@ XENCONFIG_SOURCES = \ xenconfig/xen_sxpr.c xenconfig/xen_sxpr.h \ xenconfig/xen_xm.c xenconfig/xen_xm.h \ xenconfig/xen_xl.c xenconfig/xen_xl.h \ - xenconfig/xen_xl_disk_i.h + xenconfig/xen_xl_disk.h pkgdata_DATA = cpu/cpu_map.xml -- 2.0.5

1 0

[libvirt] [PATCH V2 0/2] fix xen HVM pae|apic|acpi features parser
by Chunyan Liu 05 Jan '15

05 Jan '15

According to xm.config manual, HVM pae|apic|acpi feature default is 1 (enabled). But in conversion from xm config to libvirt xml, if xm config doesn't contain pae|apic|acpi, it sets default value to 0, this causes some problems in HVM guest. Update parser codes to set HVM pae|apic|acpi default value to 1 to match xm config convension. Add tests data to test it. --- Changes to v1: * update xmconfigtest Chunyan Liu (2): xenconfig: set HVM pae/apic/acpi/ default to 1 Add tests to xmconfigtest src/xenconfig/xen_common.c | 6 +-- .../xmconfigdata/test-fullvirt-default-feature.cfg | 23 +++++++++++ .../xmconfigdata/test-fullvirt-default-feature.xml | 48 ++++++++++++++++++++++ tests/xmconfigtest.c | 20 ++++++++- 4 files changed, 92 insertions(+), 5 deletions(-) create mode 100644 tests/xmconfigdata/test-fullvirt-default-feature.cfg create mode 100644 tests/xmconfigdata/test-fullvirt-default-feature.xml -- 1.8.4.5

2 3

[libvirt] libvirt memory flags
by Narayanan, Krishnaprasad 03 Jan '15

03 Jan '15

Hallo all, I am using libvirt version 1.1.1 on one of the nodes which has several VMs. When I executed the command, virsh dommemstat <domain UUID>, I am getting the following flags as output: actual, swap_in and rss. The API does not return "unused memory" flag that is associated to the virtual machine / domain. Can I kindly know is there a documentation that describes different memory flags? Further, can I get help from the forum to obtain information about the unused memory associated with the virtual machine / domain? Regards, Krishnaprasad

3 3

[libvirt] [PATCH] qemu: fix tc old rules will be cleaned after set tc new rules fail
by Luyao Huang 31 Dec '14

31 Dec '14

https://bugzilla.redhat.com/show_bug.cgi?id=1177723 If tc cmd failed when we use qemuDomainSetInterfaceParameters, the old rules will be clean. Restore the old rules if tc failed. Signed-off-by: Luyao Huang <lhuang(a)redhat.com> --- src/qemu/qemu_driver.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index c01da6c..810bd35 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -9915,8 +9915,12 @@ qemuDomainSetInterfaceParameters(virDomainPtr dom, if (virNetDevBandwidthSet(net->ifname, newBandwidth, false) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, - _("cannot set bandwidth limits on %s"), + _("cannot set bandwidth limits on %s" + "- attempting to restore old settings"), device); + ignore_value(virNetDevBandwidthSet(net->ifname, + net->bandwidth, + false)); goto cleanup; } -- 1.8.3.1

1 1

[libvirt] [PATCH] tests: Set up two more overrides for root builders
by Martin Kletzander 25 Dec '14

25 Dec '14

There are two more places after commit 3865941b that need to be adapted in order to get rid of some test failures when building as root. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- tests/networkxml2firewalltest.c | 2 ++ tests/virfirewalltest.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/tests/networkxml2firewalltest.c b/tests/networkxml2firewalltest.c index 1225c44..c69ab54 100644 --- a/tests/networkxml2firewalltest.c +++ b/tests/networkxml2firewalltest.c @@ -135,6 +135,8 @@ mymain(void) ret = -1; \ } while (0) + virFirewallSetLockOverride(true); + if (virFirewallSetBackend(VIR_FIREWALL_BACKEND_DIRECT) < 0) { ret = -1; goto cleanup; diff --git a/tests/virfirewalltest.c b/tests/virfirewalltest.c index 81c5557..1f8d8f1 100644 --- a/tests/virfirewalltest.c +++ b/tests/virfirewalltest.c @@ -1168,6 +1168,8 @@ mymain(void) RUN_TEST_DIRECT(name, method) # endif /* ! WITH_DBUS */ + virFirewallSetLockOverride(true); + RUN_TEST("single group", testFirewallSingleGroup); RUN_TEST("remove rule", testFirewallRemoveRule); RUN_TEST("many groups", testFirewallManyGroups); -- 2.2.1

3 3

[libvirt] [PATCHv3] lxc: give RW access to /proc/sys/net/ipv[46] to containers
by Cédric Bosdonnat 23 Dec '14

23 Dec '14

Some programs want to change some values for the network interfaces configuration in /proc/sys/net/ipv[46] folders. Giving RW access on them allows wicked to work on openSUSE 13.2+. Reusing the lxcNeedNetworkNamespace function to tell lxcContainerMountBasicFS if the netns is disabled. When no netns is set up, then we don't mount the /proc/sys/net/ipv[46] folder RW as these would provide full access to the host NICs config. --- Diff to v2: * mount from /.oldroot as suggested by Dan... removed the whole temporary mount related code as it turned out useless. src/lxc/lxc_container.c | 64 +++++++++++++++++++++++++++++++------------------ 1 file changed, 41 insertions(+), 23 deletions(-) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 3b08b86..1b9e2f2 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -800,15 +800,18 @@ typedef struct { int mflags; bool skipUserNS; bool skipUnmounted; + bool skipNoNetns; } virLXCBasicMountInfo; static const virLXCBasicMountInfo lxcBasicMounts[] = { - { "proc", "/proc", "proc", MS_NOSUID|MS_NOEXEC|MS_NODEV, false, false }, - { "/proc/sys", "/proc/sys", NULL, MS_BIND|MS_RDONLY, false, false }, - { "sysfs", "/sys", "sysfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, false, false }, - { "securityfs", "/sys/kernel/security", "securityfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, true, true }, + { "proc", "/proc", "proc", MS_NOSUID|MS_NOEXEC|MS_NODEV, false, false, false }, + { "/proc/sys", "/proc/sys", NULL, MS_BIND|MS_RDONLY, false, false, false }, + { "/.oldroot/proc/sys/net/ipv4", "/proc/sys/net/ipv4", NULL, MS_BIND, false, false, true }, + { "/.oldroot/proc/sys/net/ipv6", "/proc/sys/net/ipv6", NULL, MS_BIND, false, false, true }, + { "sysfs", "/sys", "sysfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, false, false, false }, + { "securityfs", "/sys/kernel/security", "securityfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, true, true, false }, #if WITH_SELINUX - { SELINUX_MOUNT, SELINUX_MOUNT, "selinuxfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, true, true }, + { SELINUX_MOUNT, SELINUX_MOUNT, "selinuxfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, true, true, false }, #endif }; @@ -940,10 +943,24 @@ static int lxcContainerMountBasicFS(bool userns_enabled, continue; } + /* Skip mounts with missing source without shouting: it may be a + * missing folder in /proc due to the absence of a kernel feature */ + if (STRPREFIX(mnt_src, "/") && !virFileExists(mnt_src)) { + VIR_DEBUG("Skipping due to missing source: %s", mnt_src); + VIR_FREE(mnt_src); + continue; + } + + if (mnt->skipNoNetns && netns_disabled) { + VIR_DEBUG("Skipping due to absence of network namespace"); + VIR_FREE(mnt_src); + continue; + } + if (virFileMakePath(mnt->dst) < 0) { virReportSystemError(errno, _("Failed to mkdir %s"), - mnt_src); + mnt->dst); goto cleanup; } @@ -1697,6 +1714,23 @@ static int lxcContainerUnmountForSharedRoot(const char *stateDir, } +static bool +lxcNeedNetworkNamespace(virDomainDefPtr def) +{ + size_t i; + if (def->nets != NULL) + return true; + if (def->features[VIR_DOMAIN_FEATURE_PRIVNET] == VIR_TRISTATE_SWITCH_ON) + return true; + for (i = 0; i < def->nhostdevs; i++) { + if (def->hostdevs[i]->mode == VIR_DOMAIN_HOSTDEV_MODE_CAPABILITIES && + def->hostdevs[i]->source.caps.type == VIR_DOMAIN_HOSTDEV_CAPS_TYPE_NET) + return true; + } + return false; +} + + /* Got a FS mapped to /, we're going the pivot_root * approach to do a better-chroot-than-chroot * this is based on this thread http://lkml.org/lkml/2008/3/5/29 @@ -1741,7 +1775,7 @@ static int lxcContainerSetupPivotRoot(virDomainDefPtr vmDef, /* Mounts the core /proc, /sys, etc filesystems */ if (lxcContainerMountBasicFS(vmDef->idmap.nuidmap, - !vmDef->nnets) < 0) + !lxcNeedNetworkNamespace(vmDef)) < 0) goto cleanup; /* Ensure entire root filesystem (except /.oldroot) is readonly */ @@ -2240,22 +2274,6 @@ virArch lxcContainerGetAlt32bitArch(virArch arch) } -static bool -lxcNeedNetworkNamespace(virDomainDefPtr def) -{ - size_t i; - if (def->nets != NULL) - return true; - if (def->features[VIR_DOMAIN_FEATURE_PRIVNET] == VIR_TRISTATE_SWITCH_ON) - return true; - for (i = 0; i < def->nhostdevs; i++) { - if (def->hostdevs[i]->mode == VIR_DOMAIN_HOSTDEV_MODE_CAPABILITIES && - def->hostdevs[i]->source.caps.type == VIR_DOMAIN_HOSTDEV_CAPS_TYPE_NET) - return true; - } - return false; -} - /** * lxcContainerStart: * @def: pointer to virtual machine structure -- 2.1.2

3 2

[libvirt] LSN-2014-0010: CVE-2014-8136 deadlock on failed migration
by Eric Blake 23 Dec '14

23 Dec '14

Libvirt Security Notice: LSN-2014-0008 ====================================== Summary: deadlock on failed migration Reported on: 20141208 Published on: 20141208 Fixed on: 20141209 Reported by: Peter Krempa <pkrempa(a)redhat.com> Patched by: Peter Krempa <pkrempa(a)redhat.com> See also: CVE-2014-8136 Description ----------- When using fine-grained ACLs to restrict users from migrating domains, a logic bug could leave the domain locked and prevent further operation on that domain. Impact ------ A client that lacks the domain:migrate fine-grained ACL could use a failed migration attempt to trigger a denial of service against a more privileged user. Workaround ---------- The bug is mitigated by the fact that the "perform" and "finish" states of migration can generally be reached only after a successful "begin" or "prepare" state, both of which also require the same domain:migrate permission. Furthermore, the "prepare" state also requires the domain:write permission, and any user which has been granted that permission is already deemed to have full control over the system; even if domain:migrate permission is dynamically denied after migration has already started in order to trigger the flaw, an attack by such a user generally does not constitute a denial of service against a more privileged user. On the other hand, a malicious client that has access to the read-write socket via only a weaker privilege such as domain:read can send RPC commands out of order, to attempt a "perform" without going through the prerequisite states, and thereby trigger the bug in a manner that forms a denial of service. Read-only clients cannot trigger the problem, even via bad RPC commands. It is possible to avoid the bug by not using the fine-grained access control mechanism. Affected product ---------------- Name: libvirt Repository: git://libvirt.org/git/libvirt.git http://libvirt.org/git/?p=libvirt.git Branch: master Broken in: v1.1.0 Broken in: v1.1.1 Broken in: v1.1.2 Broken in: v1.1.3 Broken in: v1.1.4 Broken in: v1.2.0 Broken in: v1.2.1 Broken in: v1.2.2 Broken in: v1.2.3 Broken in: v1.2.4 Broken in: v1.2.5 Broken in: v1.2.6 Broken in: v1.2.7 Broken in: v1.2.8 Broken in: v1.2.9 Broken in: v1.2.10 Fixed in: v1.2.11 Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 2bdcd29c713dfedd813c89f56ae98f6f3898313d Branch: v1.1.0-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 540872ceae9d2850e42d3615f017feb46ab585aa Branch: v1.1.1-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: fb1e0312f4cfc2375ee94d40e5f2999cd761337d Branch: v1.1.2-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 12c35ca8e6a1dff79fe706b24edc094be7df9f93 Branch: v1.1.3-maint Broken in: v1.1.3.1 Broken in: v1.1.3.2 Broken in: v1.1.3.3 Broken in: v1.1.3.4 Broken in: v1.1.3.5 Broken in: v1.1.3.6 Broken in: v1.1.3.7 Broken in: v1.1.3.8 Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 63934cae465f757c774db1fa4e86d3c8bda4591b Branch: v1.1.4-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 995516ad3dc64fb5a5102ad0fbbea6e1701f0d8d Branch: v1.2.0-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 0d365c6f707f55e77ff14d6a52a59b7d1c43f8a4 Branch: v1.2.1-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 75dfd58284de1fdc146b8aa3deb7d6a2057f0391 Branch: v1.2.2-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: f5a151754f2080598049baf5d68282f183a30f5c Branch: v1.2.3-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: e0e2f7eafc5adfbac4343592def097cbe8a67653 Branch: v1.2.4-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 4ba560e050fa83a2ef2083fbfa0ad9484b9393d4 Branch: v1.2.5-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: cd3d695a6be8398b399d0d06c26a618b12ad8946 Branch: v1.2.6-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: bad50b7501ebfe8076a6f7809d7b44b7a94c38ef Branch: v1.2.7-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 220759259bcbcc705a96dc1cbaeb2f2ce980c479 Branch: v1.2.8-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 372bfe63b501c7580400107682633ad421416f88 Branch: v1.2.9-maint Broken in: v1.2.9.1 Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 12496319a24dd923c5f321c84112fd0e73979413 Branch: v1.2.10-maint Broken by: abf75aea247ef6e432e5a51bcdb21972e50a4cd1 Fixed by: 2a121c635306cd498cdabb63a806ae17821b245f -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

1 0

[libvirt] LSN-2014-0009: CVE-2014-8135 crash when using virStorageVolUpload
by Eric Blake 23 Dec '14

23 Dec '14

Libvirt Security Notice: LSN-2014-0009 ====================================== Summary: crash when using virStorageVolUpload Reported on: 20141202 Published on: 20141203 Fixed on: 20141203 Reported by: Pei Zhang <pzhang(a)redhat.com> Patched by: Luyao Huang <lhuang(a)redhat.com> See also: CVE-2014-8135 Description ----------- Incorrect parameter validation of the virStorageVolUpload command could cause libvirtd to attempt to dereference NULL. Impact ------ When using fine-grained ACLs, a user that is permitted to modify storage volumes but not create arbitrary domains can use bogus parameters to cause a denial of service attack against more privileged users. Workaround ---------- Passing valid parameters to virStorageVolUpload will not trigger a problem. It is also possible to prevent the denial of service by stopping the use of the fine grained access control mechanism, or by not granting users the storage_vol:data_write permission if they do not also have the domain:write permission; doing this will not prevent the crash for invalid parameters, but such a crash is no longer a security attack. Affected product ---------------- Name: libvirt Repository: git://libvirt.org/git/libvirt.git http://libvirt.org/git/?p=libvirt.git Branch: master Broken in: v1.2.8 Broken in: v1.2.9 Broken in: v1.2.10 Fixed in: v1.2.11 Broken by: 4a85bf3e2fa703fdc14e8c49d5017ef04832a1d7 Fixed by: 87b9437f8951f9d24f9a85c6bbfff0e54df8c984 Branch: v1.2.8-maint Broken by: 4a85bf3e2fa703fdc14e8c49d5017ef04832a1d7 Fixed by: 05ba8c50b15f7078ba7981f550fc59c3dc74c469 Branch: v1.2.9-maint Broken in: v1.2.9.1 Broken by: 4a85bf3e2fa703fdc14e8c49d5017ef04832a1d7 Fixed by: 584e876ba2057b472074dbf177d2397392d70363 Branch: v1.2.10-maint Broken by: 4a85bf3e2fa703fdc14e8c49d5017ef04832a1d7 Fixed by: c89df3695b397d155ca15ac174c983ae9a77387e -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

1 0