- Devel - libvirt List Archives

[libvirt] [PATCH] esx: Fix a bug in the XML code for storage pools
by Geoff Hickey 16 Jul '14

16 Jul '14

For ESX, the code that builds XML descriptions for attached storage pools was not setting the host count to anything when it returned a host name. --- src/esx/esx_storage_backend_vmfs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/esx/esx_storage_backend_vmfs.c b/src/esx/esx_storage_backend_vmfs.c index 6bed3ce..cf0da84 100644 --- a/src/esx/esx_storage_backend_vmfs.c +++ b/src/esx/esx_storage_backend_vmfs.c @@ -488,6 +488,7 @@ esxStoragePoolGetXMLDesc(virStoragePoolPtr pool, unsigned int flags) if (VIR_ALLOC_N(def.source.hosts, 1) < 0) goto cleanup; def.type = VIR_STORAGE_POOL_NETFS; + def.source.nhost = 1; def.source.hosts[0].name = nasInfo->nas->remoteHost; def.source.dir = nasInfo->nas->remotePath; -- 1.9.1

2 1

[libvirt] [PATCH v2] support for QEMU vhost-user
by Michele Paolino 16 Jul '14

16 Jul '14

This patch adds support for the QEMU vhost-user feature to libvirt. vhost-user enables the communication between a QEMU virtual machine and other userspace process using the Virtio transport protocol. It uses a char dev (e.g. Unix socket) for the control plane, while the data plane based on shared memory. The XML looks like: <interface type='vhostuser'> <source type='unix' path='/tmp/vhost.sock' mode='server'/> <mac address='52:54:00:3b:83:1a'/> <model type='virtio'/> </interface> changes from v1: * addressed comments * removed unnecessary checks * series merged in a single patch The previous version of this patch can be found at: http://www.redhat.com/archives/libvir-list/2014-July/msg00111.html Signed-off-by: Michele Paolino <m.paolino(a)virtualopensystems.com> --- docs/formatdomain.html.in | 34 +++++++++ docs/schemas/domaincommon.rng | 25 +++++++ src/conf/domain_conf.c | 87 ++++++++++++++++++++++ src/conf/domain_conf.h | 10 ++- src/libxl/libxl_conf.c | 1 + src/lxc/lxc_process.c | 1 + src/qemu/qemu_command.c | 63 ++++++++++++++++ src/uml/uml_conf.c | 5 ++ src/xenxs/xen_sxpr.c | 1 + .../qemuxml2argv-net-vhostuser.args | 7 ++ .../qemuxml2argv-net-vhostuser.xml | 33 ++++++++ tests/qemuxml2argvtest.c | 1 + tests/qemuxml2xmltest.c | 1 + 13 files changed, 267 insertions(+), 2 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-net-vhostuser.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-net-vhostuser.xml diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 3f8bbee..606b7d4 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -3927,6 +3927,40 @@ qemu-kvm -net nic,model=? /dev/null <span class="since">Since 0.9.5</span> </p> + <h5><a name="elementVhostuser">vhost-user interface</a></h5> + + <p> + vhost-user enables the communication between a QEMU virtual machine + and other userspace process using the Virtio transport protocol. + A char dev (e.g. Unix socket) is used for the control plane, while + the data plane is based on shared memory. + </p> + +<pre> + ... + <devices> + <interface type='vhostuser'> + <source type='unix' path='/tmp/vhost.sock' mode='server'> + </source> + <mac address='52:54:00:3b:83:1a'> + </mac> + <model type='virtio'> + </model> + </interface> + </devices> + ...</pre> + + <p> + The <code><source></code> element has to be specified + along with the type of char device. + Currently, only type='unix' is supported, where the path (the + directory path of the socket) and mode attributes are required. + Both <code>mode='server'</code> and <code>mode='client'</code> + are supported. + vhost-user requires the virtio model type, thus the + <code><model></code> element is mandatory. + </p> + <h4><a name="elementsInput">Input devices</a></h4> <p> diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index af51eee..c9c02b6 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -1968,6 +1968,31 @@ </group> <group> <attribute name="type"> + <value>vhostuser</value> + </attribute> + <interleave> + <element name="source"> + <attribute name="type"> + <choice> + <value>unix</value> + </choice> + </attribute> + <attribute name="path"> + <ref name="absFilePath"/> + </attribute> + <attribute name="mode"> + <choice> + <value>server</value> + <value>client</value> + </choice> + </attribute> + <empty/> + </element> + <ref name="interface-options"/> + </interleave> + </group> + <group> + <attribute name="type"> <value>network</value> </attribute> <interleave> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 8df43b7..fb286c6 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -349,6 +349,7 @@ VIR_ENUM_IMPL(virDomainFSWrpolicy, VIR_DOMAIN_FS_WRPOLICY_LAST, VIR_ENUM_IMPL(virDomainNet, VIR_DOMAIN_NET_TYPE_LAST, "user", "ethernet", + "vhostuser", "server", "client", "mcast", @@ -1361,6 +1362,10 @@ void virDomainNetDefFree(virDomainNetDefPtr def) VIR_FREE(def->data.ethernet.ipaddr); break; + case VIR_DOMAIN_NET_TYPE_VHOSTUSER: + virDomainChrSourceDefFree(def->data.vhostuser); + break; + case VIR_DOMAIN_NET_TYPE_SERVER: case VIR_DOMAIN_NET_TYPE_CLIENT: case VIR_DOMAIN_NET_TYPE_MCAST: @@ -6665,6 +6670,9 @@ virDomainNetDefParseXML(virDomainXMLOptionPtr xmlopt, char *mode = NULL; char *linkstate = NULL; char *addrtype = NULL; + char *vhostuser_mode = NULL; + char *vhostuser_path = NULL; + char *vhostuser_type = NULL; virNWFilterHashTablePtr filterparams = NULL; virDomainActualNetDefPtr actual = NULL; xmlNodePtr oldnode = ctxt->node; @@ -6710,6 +6718,12 @@ virDomainNetDefParseXML(virDomainXMLOptionPtr xmlopt, xmlStrEqual(cur->name, BAD_CAST "source")) { dev = virXMLPropString(cur, "dev"); mode = virXMLPropString(cur, "mode"); + } else if (!vhostuser_path && !vhostuser_mode && !vhostuser_type + && def->type == VIR_DOMAIN_NET_TYPE_VHOSTUSER && + xmlStrEqual(cur->name, BAD_CAST "source")) { + vhostuser_type = virXMLPropString(cur, "type"); + vhostuser_path = virXMLPropString(cur, "path"); + vhostuser_mode = virXMLPropString(cur, "mode"); } else if (!def->virtPortProfile && xmlStrEqual(cur->name, BAD_CAST "virtualport")) { if (def->type == VIR_DOMAIN_NET_TYPE_NETWORK) { @@ -6867,6 +6881,65 @@ virDomainNetDefParseXML(virDomainXMLOptionPtr xmlopt, actual = NULL; break; + case VIR_DOMAIN_NET_TYPE_VHOSTUSER: + if (STRNEQ_NULLABLE(model, "virtio")) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Wrong or no <model> 'type' attribute " + "specified with <interface type='vhostuser'/>. " + "vhostuser requires the virtio-net* frontend")); + goto error; + } + + if (STRNEQ_NULLABLE(vhostuser_type, "unix")) { + if (vhostuser_type) + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("Type='%s' unsupported for" + " <interface type='vhostuser'>"), + vhostuser_type); + else + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("No <source> 'type' attribute " + "specified for <interface " + "type='vhostuser'>")); + goto error; + } + + if (vhostuser_path == NULL) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("No <source> 'path' attribute " + "specified with <interface " + "type='vhostuser'/>")); + goto error; + } + + if (vhostuser_mode == NULL) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("No <source> 'mode' attribute " + "specified with <interface " + "type='vhostuser'/>")); + goto error; + } + + if (VIR_ALLOC(def->data.vhostuser) < 0) + goto error; + + def->data.vhostuser->type = VIR_DOMAIN_CHR_TYPE_UNIX; + def->data.vhostuser->data.nix.path = vhostuser_path; + + if (STREQ(vhostuser_mode, "server")) + def->data.vhostuser->data.nix.listen = true; + else if (STREQ(vhostuser_mode, "client")) + def->data.vhostuser->data.nix.listen = false; + else { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Wrong <source> 'mode' attribute " + "specified with <interface " + "type='vhostuser'/>")); + goto error; + } + vhostuser_path = NULL; + break; + case VIR_DOMAIN_NET_TYPE_ETHERNET: if (dev != NULL) { def->data.ethernet.dev = dev; @@ -7112,6 +7185,9 @@ virDomainNetDefParseXML(virDomainXMLOptionPtr xmlopt, VIR_FREE(portgroup); VIR_FREE(address); VIR_FREE(port); + VIR_FREE(vhostuser_type); + VIR_FREE(vhostuser_path); + VIR_FREE(vhostuser_mode); VIR_FREE(ifname); VIR_FREE(dev); virDomainActualNetDefFree(actual); @@ -15987,6 +16063,17 @@ virDomainNetDefFormat(virBufferPtr buf, def->data.ethernet.ipaddr); break; + case VIR_DOMAIN_NET_TYPE_VHOSTUSER: + if (def->data.vhostuser->type == VIR_DOMAIN_CHR_TYPE_UNIX) { + virBufferAddLit(buf, "<source type='unix'"); + virBufferEscapeString(buf, " path='%s'", + def->data.vhostuser->data.nix.path); + if (def->data.vhostuser->data.nix.listen) + virBufferAddLit(buf, " mode='server'"); + virBufferAddLit(buf, "/>\n"); + } + break; + case VIR_DOMAIN_NET_TYPE_BRIDGE: virBufferEscapeString(buf, "<source bridge='%s'/>\n", def->data.bridge.brname); diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index eb5bad7..91f7524 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -133,6 +133,12 @@ typedef virDomainIdMapDef *virDomainIdMapDefPtr; typedef struct _virDomainPanicDef virDomainPanicDef; typedef virDomainPanicDef *virDomainPanicDefPtr; +/* forward declarations virDomainChrSourceDef, required by + * virDomainNetDef + */ +typedef struct _virDomainChrSourceDef virDomainChrSourceDef; +typedef virDomainChrSourceDef *virDomainChrSourceDefPtr; + /* Flags for the 'type' field in virDomainDeviceDef */ typedef enum { VIR_DOMAIN_DEVICE_NONE = 0, @@ -795,6 +801,7 @@ struct _virDomainFSDef { typedef enum { VIR_DOMAIN_NET_TYPE_USER, VIR_DOMAIN_NET_TYPE_ETHERNET, + VIR_DOMAIN_NET_TYPE_VHOSTUSER, VIR_DOMAIN_NET_TYPE_SERVER, VIR_DOMAIN_NET_TYPE_CLIENT, VIR_DOMAIN_NET_TYPE_MCAST, @@ -880,6 +887,7 @@ struct _virDomainNetDef { char *dev; char *ipaddr; } ethernet; + virDomainChrSourceDefPtr vhostuser; struct { char *address; int port; @@ -1006,8 +1014,6 @@ typedef enum { } virDomainChrSpicevmcName; /* The host side information for a character device. */ -typedef struct _virDomainChrSourceDef virDomainChrSourceDef; -typedef virDomainChrSourceDef *virDomainChrSourceDefPtr; struct _virDomainChrSourceDef { int type; /* virDomainChrType */ union { diff --git a/src/libxl/libxl_conf.c b/src/libxl/libxl_conf.c index 4b6b5c0..c196136 100644 --- a/src/libxl/libxl_conf.c +++ b/src/libxl/libxl_conf.c @@ -955,6 +955,7 @@ libxlMakeNic(virDomainDefPtr def, return -1; break; } + case VIR_DOMAIN_NET_TYPE_VHOSTUSER: case VIR_DOMAIN_NET_TYPE_USER: case VIR_DOMAIN_NET_TYPE_SERVER: case VIR_DOMAIN_NET_TYPE_CLIENT: diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c index 0aef13a..854f65d 100644 --- a/src/lxc/lxc_process.c +++ b/src/lxc/lxc_process.c @@ -437,6 +437,7 @@ static int virLXCProcessSetupInterfaces(virConnectPtr conn, case VIR_DOMAIN_NET_TYPE_USER: case VIR_DOMAIN_NET_TYPE_ETHERNET: + case VIR_DOMAIN_NET_TYPE_VHOSTUSER: case VIR_DOMAIN_NET_TYPE_SERVER: case VIR_DOMAIN_NET_TYPE_CLIENT: case VIR_DOMAIN_NET_TYPE_MCAST: diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index af4d009..e2d4645 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -6923,6 +6923,66 @@ qemuBuildGraphicsCommandLine(virQEMUDriverConfigPtr cfg, } static int +qemuBuildVhostuserCommandLine(virCommandPtr cmd, + virDomainDefPtr def, + virDomainNetDefPtr net, + virQEMUCapsPtr qemuCaps) +{ + virBuffer chardev_buf = VIR_BUFFER_INITIALIZER; + virBuffer netdev_buf = VIR_BUFFER_INITIALIZER; + + char* nic = NULL; + char* str = NULL; + + if (!qemuDomainSupportsNetdev(def, qemuCaps, net)) { + virReportError(VIR_ERR_INTERNAL_ERROR, + "%s", _("Netdev support unavailable")); + goto error; + } + + if (net->data.vhostuser->type == VIR_DOMAIN_CHR_TYPE_UNIX) { + virBufferAsprintf(&chardev_buf, "socket,id=char%s,path=%s%s", + net->info.alias, net->data.vhostuser->data.nix.path, + net->data.vhostuser->data.nix.listen ? ",server" : ""); + } + + virBufferAsprintf(&netdev_buf, "type=vhost-user,id=host%s,chardev=char%s", + net->info.alias, net->info.alias); + + if (virBufferError(&chardev_buf) || virBufferError(&netdev_buf)) { + virReportOOMError(); + goto error; + } + + str = virBufferContentAndReset(&chardev_buf); + virCommandAddArgList(cmd, "-chardev", str, NULL); + VIR_FREE(str); + + str = virBufferContentAndReset(&netdev_buf); + virCommandAddArgList(cmd, "-netdev", str, NULL); + VIR_FREE(str); + + if (!(nic = qemuBuildNicDevStr(def, net, -1, 0, 0, qemuCaps))) { + virReportError(VIR_ERR_INTERNAL_ERROR, + "%s", _("Error generating NIC -device string")); + goto error; + } + + virCommandAddArgList(cmd, "-device", nic, NULL); + VIR_FREE(nic); + + return 0; + + error: + virBufferFreeAndReset(&chardev_buf); + virBufferFreeAndReset(&netdev_buf); + VIR_FREE(nic); + VIR_FREE(str); + + return -1; +} + +static int qemuBuildInterfaceCommandLine(virCommandPtr cmd, virQEMUDriverPtr driver, virConnectPtr conn, @@ -6945,6 +7005,9 @@ qemuBuildInterfaceCommandLine(virCommandPtr cmd, int actualType = virDomainNetGetActualType(net); size_t i; + if (actualType == VIR_DOMAIN_NET_TYPE_VHOSTUSER) + return qemuBuildVhostuserCommandLine(cmd, def, net, qemuCaps); + if (actualType == VIR_DOMAIN_NET_TYPE_HOSTDEV) { /* NET_TYPE_HOSTDEV devices are really hostdev devices, so * their commandlines are constructed with other hostdevs. diff --git a/src/uml/uml_conf.c b/src/uml/uml_conf.c index 464d56d..d33d9b4 100644 --- a/src/uml/uml_conf.c +++ b/src/uml/uml_conf.c @@ -182,6 +182,11 @@ umlBuildCommandLineNet(virConnectPtr conn, } break; + case VIR_DOMAIN_NET_TYPE_VHOSTUSER: + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("vhostuser networking type not supported")); + goto error; + case VIR_DOMAIN_NET_TYPE_SERVER: virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("TCP server networking type not supported")); diff --git a/src/xenxs/xen_sxpr.c b/src/xenxs/xen_sxpr.c index aacf74c..fe49c42 100644 --- a/src/xenxs/xen_sxpr.c +++ b/src/xenxs/xen_sxpr.c @@ -1933,6 +1933,7 @@ xenFormatSxprNet(virConnectPtr conn, virBufferEscapeSexpr(buf, "(ip '%s')", def->data.ethernet.ipaddr); break; + case VIR_DOMAIN_NET_TYPE_VHOSTUSER: case VIR_DOMAIN_NET_TYPE_USER: case VIR_DOMAIN_NET_TYPE_SERVER: case VIR_DOMAIN_NET_TYPE_CLIENT: diff --git a/tests/qemuxml2argvdata/qemuxml2argv-net-vhostuser.args b/tests/qemuxml2argvdata/qemuxml2argv-net-vhostuser.args new file mode 100644 index 0000000..cc66ec3 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-net-vhostuser.args @@ -0,0 +1,7 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ +/usr/bin/qemu -S -M \ +pc -m 214 -smp 1 -nographic -nodefaults -monitor unix:/tmp/test-monitor,server,nowait \ +-no-acpi -boot c -usb -hda /dev/HostVG/QEMUGuest1 \ +-chardev socket,id=charnet0,path=/tmp/vhost.sock,server \ +-netdev type=vhost-user,id=hostnet0,chardev=charnet0 \ +-device virtio-net-pci,netdev=hostnet0,id=net0,mac=52:54:00:ee:96:6b,bus=pci.0,addr=0x3 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-net-vhostuser.xml b/tests/qemuxml2argvdata/qemuxml2argv-net-vhostuser.xml new file mode 100644 index 0000000..b49d48e --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-net-vhostuser.xml @@ -0,0 +1,33 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='i686' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0'/> + <controller type='ide' index='0'/> + <controller type='pci' index='0' model='pci-root'/> + <interface type='vhostuser'> + <mac address='52:54:00:ee:96:6b'/> + <source type='unix' path='/tmp/vhost.sock' mode='server'/> + <model type='virtio'/> + </interface> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index d5066d2..2099624 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -927,6 +927,7 @@ mymain(void) DO_TEST_FAILURE("misc-enable-s4", NONE); DO_TEST("misc-no-reboot", NONE); DO_TEST("misc-uuid", QEMU_CAPS_NAME, QEMU_CAPS_UUID); + DO_TEST("net-vhostuser", QEMU_CAPS_DEVICE, QEMU_CAPS_NETDEV); DO_TEST("net-user", NONE); DO_TEST("net-virtio", NONE); DO_TEST("net-virtio-device", diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c index 200d50f..359125a 100644 --- a/tests/qemuxml2xmltest.c +++ b/tests/qemuxml2xmltest.c @@ -245,6 +245,7 @@ mymain(void) DO_TEST("misc-disable-suspends"); DO_TEST("misc-enable-s4"); DO_TEST("misc-no-reboot"); + DO_TEST("net-vhostuser"); DO_TEST("net-user"); DO_TEST("net-virtio"); DO_TEST("net-virtio-device"); -- 1.9.3

2 1

[libvirt] Changing the default qemu path in libvirt
by satheesh 16 Jul '14

16 Jul '14

Hi All, I would like to change the default qemu path in libvirt xml and the changed path has to be used while installing VMs using virt-install. There was a similar question rasied some years back, I could not find the answer to the same. http://www.redhat.com/archives/libvir-list/2011-December/msg01100.html Is that possible right now?, If we have the support already, please point to the same. Thanks in advance. Regards, -Satheesh.

2 1

[libvirt] [PATCH 0/3] LXC guest network device name changes
by Cédric Bosdonnat 16 Jul '14

16 Jul '14

This patch series allows users to configure the network device name in the LXC container. I intentionaly didn't allow this for hostdev net interfaces as the NIC would be returned with a different name to the host and we have no way to guess under what name it was returned to the host namespace. This will help filling the feature gap with LXC WRT network configuration. Cédric Bosdonnat (3): lxc network configuration allows setting target container NIC name lxc conf2xml: convert lxc.network.name for veth networks lxc network device names change documentation docs/formatdomain.html.in | 17 +++++++++++++ docs/schemas/domaincommon.rng | 17 +++++++++++++ src/conf/domain_conf.c | 27 ++++++++++++++++++++ src/conf/domain_conf.h | 2 ++ src/lxc/lxc_container.c | 29 +++++++++++++++++++--- src/lxc/lxc_native.c | 22 +++++++++++----- src/lxc/lxc_process.c | 25 +++++++++++++++++++ .../lxcconf2xmldata/lxcconf2xml-physnetwork.config | 1 + tests/lxcconf2xmldata/lxcconf2xml-simple.xml | 1 + tests/lxcxml2xmldata/lxc-idmap.xml | 1 + 10 files changed, 132 insertions(+), 10 deletions(-) -- 1.8.4.5

5 8

[libvirt] [PATCH 0/8] Add support for setting DAC permissions on remote filesystems
by Peter Krempa 16 Jul '14

16 Jul '14

Peter Krempa (8): storage: Implement storage driver helper to chown disk images storage: Add witness for checking storage volume use in security driver security: DAC: Remove superfluous link resolution security: DAC: Introduce callback to perform image chown security: DAC: Plumb usage of chown callback qemu: Implement DAC driver chown callback to co-operate with storage drv storage: Implement virStorageFileCreate for local and gluster files qemu: snapshot: Use storage driver to pre-create snapshot file src/qemu/qemu_driver.c | 66 ++++++++++++++++---- src/security/security_dac.c | 109 +++++++++++++++++++++++----------- src/security/security_dac.h | 3 + src/security/security_manager.c | 4 +- src/security/security_manager.h | 19 +++++- src/storage/storage_backend.h | 6 ++ src/storage/storage_backend_fs.c | 29 +++++++++ src/storage/storage_backend_gluster.c | 27 +++++++++ src/storage/storage_driver.c | 58 ++++++++++++++++++ src/storage/storage_driver.h | 3 + 10 files changed, 277 insertions(+), 47 deletions(-) -- 2.0.0

1 9

[libvirt] [PATCHv3 0/2] virsh: Fix negative value parsing in vcpuinfo
by Peter Krempa 16 Jul '14

16 Jul '14

Jincheng Miao (1): virsh: forbid negative vcpu argument to vcpupin Peter Krempa (1): virsh: Reject negative numbers in vshCommandOptUInt tests/vcpupin | 29 ++++++++++++++++++++++++++++- tools/virsh-domain.c | 35 ++++++++++++++++++----------------- tools/virsh.c | 4 ++-- 3 files changed, 48 insertions(+), 20 deletions(-) -- 1.9.3

3 7

[libvirt] [PREPOST 01/17] src/xenxs:Introduce function
by David Kiarie 16 Jul '14

16 Jul '14

From: Kiarie Kahurani <davidkiarie4(a)gmail.com> Introduce function xenParseXMGeneral(virConfPtr conf, ...); This function parses the xm general options such as uuid and name signed-off-by: David Kiarie <davidkiarie4(a)gmail.com> --- src/xenxs/xen_xm.c | 65 +++++++++++++++++++++++++++++++----------------------- 1 file changed, 37 insertions(+), 28 deletions(-) diff --git a/src/xenxs/xen_xm.c b/src/xenxs/xen_xm.c index 25a042d..1953a85 100644 --- a/src/xenxs/xen_xm.c +++ b/src/xenxs/xen_xm.c @@ -253,44 +253,25 @@ xenXMConfigGetUUID(virConfPtr conf, const char *name, unsigned char *uuid) * Turn a config record into a lump of XML describing the * domain, suitable for later feeding for virDomainCreateXML */ -virDomainDefPtr -xenParseXM(virConfPtr conf, int xendConfigVersion, - virCapsPtr caps) +static int xenParseXMGeneral(virConfPtr conf, virDomainDefPtr def, + virCapsPtr caps) { + + const char *defaultMachine; const char *str; int hvm = 0; - int val; - virConfValuePtr list; - virDomainDefPtr def = NULL; - virDomainDiskDefPtr disk = NULL; - virDomainNetDefPtr net = NULL; - virDomainGraphicsDefPtr graphics = NULL; - virDomainHostdevDefPtr hostdev = NULL; - size_t i; - const char *defaultMachine; - int vmlocaltime = 0; - unsigned long count; - char *script = NULL; - char *listenAddr = NULL; - - if (VIR_ALLOC(def) < 0) - return NULL; - - def->virtType = VIR_DOMAIN_VIRT_XEN; - def->id = -1; if (xenXMConfigCopyString(conf, "name", &def->name) < 0) - goto cleanup; + return -1; if (xenXMConfigGetUUID(conf, "uuid", def->uuid) < 0) - goto cleanup; - + return -1; if ((xenXMConfigGetString(conf, "builder", &str, "linux") == 0) && STREQ(str, "hvm")) hvm = 1; if (VIR_STRDUP(def->os.type, hvm ? "hvm" : "xen") < 0) - goto cleanup; + return -1; def->os.arch = virCapabilitiesDefaultGuestArch(caps, @@ -300,7 +281,7 @@ xenParseXM(virConfPtr conf, int xendConfigVersion, virReportError(VIR_ERR_INTERNAL_ERROR, _("no supported architecture for os type '%s'"), def->os.type); - goto cleanup; + return -1; } defaultMachine = virCapabilitiesDefaultGuestMachine(caps, @@ -309,9 +290,37 @@ xenParseXM(virConfPtr conf, int xendConfigVersion, virDomainVirtTypeToString(def->virtType)); if (defaultMachine != NULL) { if (VIR_STRDUP(def->os.machine, defaultMachine) < 0) - goto cleanup; + return -1; } + return 0; +} +virDomainDefPtr +xenParseXM(virConfPtr conf, int xendConfigVersion, + virCapsPtr caps) +{ + const char *str; + int hvm = 0; + int val; + virConfValuePtr list; + virDomainDefPtr def = NULL; + virDomainDiskDefPtr disk = NULL; + virDomainNetDefPtr net = NULL; + virDomainGraphicsDefPtr graphics = NULL; + virDomainHostdevDefPtr hostdev = NULL; + size_t i; + int vmlocaltime = 0; + unsigned long count; + char *script = NULL; + char *listenAddr = NULL; + + if (VIR_ALLOC(def) < 0) + return NULL; + def->virtType = VIR_DOMAIN_VIRT_XEN; + def->id = -1; + if (xenParseXMGeneral(conf, def, caps) < 0) + goto cleanup; + hvm = (STREQ(def->os.type, "hvm")); if (hvm) { const char *boot; if (xenXMConfigCopyString(conf, "kernel", &def->os.loader) < 0) -- 1.8.4.5

4 42

[libvirt] [PATCH] blockjob: wait for pivot to complete
by Eric Blake 16 Jul '14

16 Jul '14

https://bugzilla.redhat.com/show_bug.cgi?id=1119173 documents that commit eaba79d was flawed in the implementation of the VIR_DOMAIN_BLOCK_JOB_ABORT_ASYNC flag when it comes to completing a blockcopy. Basically, the qemu pivot action is async (the QMP command returns immediately, but the user must wait for the BLOCK_JOB_COMPLETE event to know that all I/O related to the job has finally been flushed), but the libvirt command was documented as synchronous by default. As active block commit will also be using this code, it is worth fixing now. * src/qemu/qemu_driver.c (qemuDomainBlockJobImpl): Don't skip wait loop after pivot. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Shown here with extra context, to hopefully aid the review. src/qemu/qemu_driver.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index ecccf6c..300e49e 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -14973,45 +14973,45 @@ qemuDomainBlockJobImpl(virDomainObjPtr vm, if (!device) goto endjob; disk = vm->def->disks[idx]; if (mode == BLOCK_JOB_PULL && disk->mirror) { virReportError(VIR_ERR_BLOCK_COPY_ACTIVE, _("disk '%s' already in active block job"), disk->dst); goto endjob; } if (mode == BLOCK_JOB_ABORT && (flags & VIR_DOMAIN_BLOCK_JOB_ABORT_PIVOT) && !(async && disk->mirror)) { virReportError(VIR_ERR_OPERATION_INVALID, _("pivot of disk '%s' requires an active copy job"), disk->dst); goto endjob; } if (disk->mirror && mode == BLOCK_JOB_ABORT && (flags & VIR_DOMAIN_BLOCK_JOB_ABORT_PIVOT)) { ret = qemuDomainBlockPivot(conn, driver, vm, device, disk); - goto endjob; + goto waitjob; } if (base && (virStorageFileParseChainIndex(disk->dst, base, &baseIndex) < 0 || !(baseSource = virStorageFileChainLookup(disk->src, disk->src, base, baseIndex, NULL)))) goto endjob; if (baseSource) { if (qemuGetDriveSourceString(baseSource, NULL, &basePath) < 0) goto endjob; if (flags & VIR_DOMAIN_BLOCK_REBASE_RELATIVE) { if (!virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_CHANGE_BACKING_FILE)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("this QEMU binary doesn't support relative " "block pull/rebase")); goto endjob; } if (virStorageFileGetRelativeBackingPath(disk->src->backingStore, baseSource, @@ -15030,44 +15030,45 @@ qemuDomainBlockJobImpl(virDomainObjPtr vm, qemuDomainObjEnterMonitor(driver, vm); ret = qemuMonitorBlockJob(priv->mon, device, basePath, backingPath, bandwidth, info, mode, async); qemuDomainObjExitMonitor(driver, vm); if (ret < 0) goto endjob; /* Snoop block copy operations, so future cancel operations can * avoid checking if pivot is safe. */ if (mode == BLOCK_JOB_INFO && ret == 1 && disk->mirror && info->cur == info->end && info->type == VIR_DOMAIN_BLOCK_JOB_TYPE_COPY) disk->mirroring = true; /* A successful block job cancelation stops any mirroring. */ if (mode == BLOCK_JOB_ABORT && disk->mirror) { /* XXX We should also revoke security labels and disk lease on * the mirror, and audit that fact, before dropping things. */ virStorageSourceFree(disk->mirror); disk->mirror = NULL; disk->mirroring = false; } + waitjob: /* With synchronous block cancel, we must synthesize an event, and * we silently ignore the ABORT_ASYNC flag. With asynchronous * block cancel, the event will come from qemu, but without the * ABORT_ASYNC flag, we must block to guarantee synchronous * operation. We do the waiting while still holding the VM job, * to prevent newly scheduled block jobs from confusing us. */ if (mode == BLOCK_JOB_ABORT) { if (!async) { /* Older qemu that lacked async reporting also lacked * active commit, so we can hardcode the event to pull. * We have to generate two variants of the event. */ int type = VIR_DOMAIN_BLOCK_JOB_TYPE_PULL; int status = VIR_DOMAIN_BLOCK_JOB_CANCELED; event = virDomainEventBlockJobNewFromObj(vm, disk->src->path, type, status); event2 = virDomainEventBlockJob2NewFromObj(vm, disk->dst, type, status); } else if (!(flags & VIR_DOMAIN_BLOCK_JOB_ABORT_ASYNC)) { while (1) { /* Poll every 50ms */ static struct timespec ts = { .tv_sec = 0, .tv_nsec = 50 * 1000 * 1000ull }; -- 1.9.3

2 2

[libvirt] [PATCH v2] util: forbid freeing const pointers
by Eric Blake 16 Jul '14

16 Jul '14

Now that we've finally fixed all the violators, it's time to enforce that any pointer to a const object is never freed (it is aliasing some other memory, where the non-const original should be freed instead). Alas, the code still needs a normal vs. Coverity version, but at least we are still guaranteeing that the macro call evaluates its argument exactly once. I verified that we still get the following compiler warnings, which in turn halts the build thanks to -Werror on gcc (hmm, gcc 4.8.3's placement of the ^ for ?: type mismatch is a bit off, but that's not our problem): int oops1 = 0; VIR_FREE(oops1); const char *oops2 = NULL; VIR_FREE(oops2); struct blah { int dummy; } oops3; VIR_FREE(oops3); util/virauthconfig.c:159:35: error: pointer/integer type mismatch in conditional expression [-Werror] VIR_FREE(oops1); ^ util/virauthconfig.c:161:5: error: passing argument 1 of 'virFree' discards 'const' qualifier from pointer target type [-Werror] VIR_FREE(oops2); ^ In file included from util/virauthconfig.c:28:0: util/viralloc.h:79:6: note: expected 'void *' but argument is of type 'const void *' void virFree(void *ptrptr) ATTRIBUTE_NONNULL(1); ^ util/virauthconfig.c:163:35: error: type mismatch in conditional expression VIR_FREE(oops3); ^ * src/util/viralloc.h (VIR_FREE): No longer cast away const. * src/xenapi/xenapi_utils.c (xenSessionFree): Work around bogus header. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- v2: this depends on the existing 1/4, while being a replacement to all of 2-4/4 at once. https://www.redhat.com/archives/libvir-list/2014-July/msg00716.html src/util/viralloc.h | 11 +++++------ src/xenapi/xenapi_utils.c | 4 +++- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/src/util/viralloc.h b/src/util/viralloc.h index 7125e67..bf85c16 100644 --- a/src/util/viralloc.h +++ b/src/util/viralloc.h @@ -548,18 +548,17 @@ void virFree(void *ptrptr) ATTRIBUTE_NONNULL(1); * This macro is safe to use on arguments with side effects. */ # if !STATIC_ANALYSIS -/* The ternary ensures that ptr is a pointer and not an integer type, - * while evaluating ptr only once. This gives us extra compiler - * safety when compiling under gcc. For now, we intentionally cast - * away const, since a number of callers safely pass const char *. +/* The ternary ensures that ptr is a non-const pointer and not an + * integer type, all while evaluating ptr only once. This gives us + * extra compiler safety when compiling under gcc. */ -# define VIR_FREE(ptr) virFree((void *) (1 ? (const void *) &(ptr) : (ptr))) +# define VIR_FREE(ptr) virFree(1 ? (void *) &(ptr) : (ptr)) # else /* The Coverity static analyzer considers the else path of the "?:" and * flags the VIR_FREE() of the address of the address of memory as a * RESOURCE_LEAK resulting in numerous false positives (eg, VIR_FREE(&ptr)) */ -# define VIR_FREE(ptr) virFree((void *) &(ptr)) +# define VIR_FREE(ptr) virFree(&(ptr)) # endif void virAllocTestInit(void); diff --git a/src/xenapi/xenapi_utils.c b/src/xenapi/xenapi_utils.c index a80d136..ef89f42 100644 --- a/src/xenapi/xenapi_utils.c +++ b/src/xenapi/xenapi_utils.c @@ -44,13 +44,15 @@ void xenSessionFree(xen_session *session) { size_t i; + char *tmp; if (session->error_description != NULL) { for (i = 0; i < session->error_description_count; i++) VIR_FREE(session->error_description[i]); VIR_FREE(session->error_description); } /* The session_id member is type of 'const char *'. Sigh. */ - VIR_FREE(session->session_id); + tmp = (char *)session->session_id; + VIR_FREE(tmp); VIR_FREE(session); } -- 1.9.3

2 2

[libvirt] [PATCH 0/6] Fix regression with relative backing names in storage pools
by Peter Krempa 16 Jul '14

16 Jul '14

Our recent refactors broke relative backing names in storage pools, fix it partially. Peter Krempa (6): storage: backend: Fix formatting of function arguments storage: Track backing store of a volume in the target struct storage: backend: fs: Touch up coding style storage: fs: Process backing store data in virStorageBackendProbeTarget storage: fs: Properly parse backing store info storage: fs: Don't fail volume update if backing store isn't accessible src/conf/storage_conf.c | 53 +++++++++-------- src/conf/storage_conf.h | 1 - src/storage/storage_backend.c | 40 ++++++------- src/storage/storage_backend_fs.c | 103 ++++++++++++++++++---------------- src/storage/storage_backend_gluster.c | 20 +++++-- src/storage/storage_backend_logical.c | 11 ++-- 6 files changed, 129 insertions(+), 99 deletions(-) -- 2.0.0

2 13

[libvirt] [PATCH 0/4] fix virReportSystemError misuse
by Jincheng Miao 16 Jul '14

16 Jul '14

virReportSystemError() reports some OS errors, and the first argument of it should be the error number defined in errno.h. virReportError() reports libvirt errors, and the first argument should be the error number defined in virerrno.h. This patch set fix some misuse of virReportSystemError: passing virerrno instead of errno. Jincheng Miao (4): qemu: fix wrong errno report in qemuMonitorOpenUnix lxc: print ENOTSUP when usernamespace is not supported openvz: print EOVERFLOW when barrier:limit are too long util: print errno in virObjectLockableNew src/lxc/lxc_container.c | 2 +- src/openvz/openvz_conf.c | 2 +- src/qemu/qemu_monitor.c | 7 +++++-- src/util/virobject.c | 2 +- 4 files changed, 8 insertions(+), 5 deletions(-) -- 1.8.3.1

3 12

[libvirt] [PATCH] spec: Update polkit dependencies for CVE-2013-4311
by Jiri Denemark 16 Jul '14

16 Jul '14

Use secured polkit on distros which provide it. However, RHEL-6 will still allow for older polkit-0.93 rather than forcing polkit-0.96-5 which is not available in all RHEL-6 releases. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- libvirt.spec.in | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 8d1acfa..f32ab00 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -535,7 +535,9 @@ BuildRequires: module-init-tools BuildRequires: cyrus-sasl-devel %endif %if %{with_polkit} - %if 0%{?fedora} >= 12 || 0%{?rhel} >= 6 + %if 0%{?fedora} >= 21 || 0%{?rhel} >= 7 +BuildRequires: polkit-devel >= 0.112 + %elif 0%{?fedora} >= 12 || 0%{?rhel} >= 6 BuildRequires: polkit-devel >= 0.93 %else BuildRequires: PolicyKit-devel >= 0.6 @@ -698,7 +700,9 @@ Requires: avahi-libs %endif %endif %if %{with_polkit} - %if 0%{?fedora} >= 12 || 0%{?rhel} >=6 + %if 0%{?fedora} >= 21 || 0%{?rhel} >= 7 +Requires: polkit >= 0.112 + %elif 0%{?fedora} >= 12 || 0%{?rhel} >=6 Requires: polkit >= 0.93 %else Requires: PolicyKit >= 0.6 -- 2.0.0

2 4

[libvirt] [PATCH] spec: fix invalid syntax
by Eric Blake 16 Jul '14

16 Jul '14

Commit 20e01504 broke 'make rpm': error: line 540: Unknown tag: %elif 020 >= 12 || 0 >= 6 Apparently, even though shell has elif so that you can do a chain of conditionals, the rpm spec file does not, and you have to nest things instead. * libvirt.spec.in: Convert %elif to proper nested %if. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule. libvirt.spec.in | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 47bfec5..9c7b241 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -537,10 +537,12 @@ BuildRequires: cyrus-sasl-devel %if %{with_polkit} %if 0%{?fedora} >= 20 || 0%{?rhel} >= 7 BuildRequires: polkit-devel >= 0.112 - %elif 0%{?fedora} >= 12 || 0%{?rhel} >= 6 -BuildRequires: polkit-devel >= 0.93 %else + %if 0%{?fedora} >= 12 || 0%{?rhel} >= 6 +BuildRequires: polkit-devel >= 0.93 + %else BuildRequires: PolicyKit-devel >= 0.6 + %endif %endif %endif %if %{with_storage_fs} @@ -702,10 +704,12 @@ Requires: avahi-libs %if %{with_polkit} %if 0%{?fedora} >= 20 || 0%{?rhel} >= 7 Requires: polkit >= 0.112 - %elif 0%{?fedora} >= 12 || 0%{?rhel} >=6 -Requires: polkit >= 0.93 %else + %if 0%{?fedora} >= 12 || 0%{?rhel} >=6 +Requires: polkit >= 0.93 + %else Requires: PolicyKit >= 0.6 + %endif %endif %endif %if %{with_cgconfig} -- 1.9.3

1 0

Re: [libvirt] Enable kvm on aarch64, Cleanup F-16/18 conditionals
by Eric Blake 16 Jul '14

16 Jul '14

On 07/15/2014 04:00 PM, Peter Robinson wrote: [reformatting to avoid top-posting] > On Tue, Jul 15, 2014 at 6:52 PM, Daniel P. Berrange <berrange(a)redhat.com> wrote: >> Historically we've kept support for building libvirt against >> Fedora versions even if unsupported by Fedora itself, because >> we've found people often stick on old Fedora versions. At some >> point though it does get a bit insane. eg we don't really need >> Fedora 8 support at this point. If we are going todo a cleanup >> though, we should do it throughout the spec, not just in these >> few places > Sorry, I missed the Fedora 8 stuff. Would it even work on Fedora 8 > with all the various other changes? Not sure it's worth the effort for > the few people that want that release as a hypervisor, I can > understand for the supported elX releases but not sure the Fedora > releases that are systemd based give value to elX releases and are > generally relatively ancient history. Dan do you really have know > users of the latest release running it on F-8? > > In terms of pushing upstream Cole has said he's happy to push the > commits to ensure it fits your work flows. Doing an out-of-the-box build on RHEL 5 is the oldest configuration still actively (if marginally) supported, ideally for as long as RHEL 5 remains a live platform (several more years to go). We have build-bots that ensure that we can build on RHEL 5, although I'm not sure if those buildbots are exercising 'make rpm' to test the older parts of the spec file. Historically, RHEL 5.10 is based off of libvirt-0.8.2, and that was the release in use during Fedora 13. So it's _definitely_ worth culling any conditionals older than F13; but stuff between F13 and F18 might be shared with RHEL 5, and therefore more effort to cull the Fedora side while still leaving the RHEL side intact. I could go either way if we were to set some sort of policy (maybe: any fedora release that is unsupported for more than a year is no longer required to be supported in the spec file), and use that to justify cleanups of older parts of the spec file as long as it doesn't break RHEL 5. F16 is definitely more than a year out-of-date, F18 is a bit more borderline on whether we are ready to call it unsupported. Anyone else on the libvirt list have an opinion on how far back we can clean without annoying people that are slow on the upgrade to modern Fedora? -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

1 0

[libvirt] [PATCH 0/4] Resolve const correctness isues
by Michal Privoznik 15 Jul '14

15 Jul '14

Okay, okay. The approach in 4/4 can be considered hackish, but hey - it works! Michal Privoznik (4): Fix const correctness viralloc: Honor const correctness in VIR_FREE VIR_FREE: Avoid doing side work in callees virFree: Check const correctness src/conf/network_conf.c | 12 ++++++++---- src/locking/lock_driver_lockd.c | 2 +- src/qemu/qemu_capabilities.c | 2 +- src/remote/remote_driver.c | 2 +- src/util/viralloc.c | 6 ++++-- src/util/viralloc.h | 33 ++++++++++++++++----------------- src/xenapi/xenapi_utils.c | 3 ++- tools/virsh-domain.c | 4 ++-- tools/wireshark/src/packet-libvirt.c | 6 +++--- tools/wireshark/src/packet-libvirt.h | 4 ++-- 10 files changed, 40 insertions(+), 34 deletions(-) -- 1.8.5.5

5 15

[libvirt] [PATCH 0/2] Implement interface stats for BSD
by Roman Bogorodskiy 15 Jul '14

15 Jul '14

This series implements support for querying network interface stats on (Free)BSD. It's more of an RFC, because I'm uncertain about few things: - It feels a little strange to have a source file that implements only a single function like this. I am wondering if it would be better to just move it to something like util/virnetdev.c? - FreeBSD stores interface data in the if_data struct and a number of outgoing packet drops is stored in a field 'ifi_oqdrops'. This field was added in -CURRENT and later merged back to 10-STABLE. In order not to break the ABI, it's available only if _IFI_OQDROPS is defined. I've added a configure.ac check which adds -D_IFI_OQDROPS before checking this field and resetting it back if it is not present. This way, this flag will present when the field is available even if the flag is not needed (e.g. on -CURRENT). Is there a better way of doing it? I was thinking about trying to check this field without the flag and if it fails check one more time with the flag, but it looks a little messy. - Did I get it right that the stats reported are from the guest POV, e.g. when downloading a large file from guest, it should look like: vnet0 rx_bytes 731603341 vnet0 rx_packets 518354 vnet0 rx_errs 0 vnet0 rx_drop 0 vnet0 tx_bytes 17577834 vnet0 tx_packets 264226 vnet0 tx_errs 0 vnet0 tx_drop 0 Roman Bogorodskiy (2): util: virstatslinux: make more generic Implement interface stats for BSD configure.ac | 13 ++++- po/POTFILES.in | 2 +- src/Makefile.am | 2 +- src/libvirt_linux.syms | 3 -- src/libvirt_private.syms | 2 + src/lxc/lxc_driver.c | 2 +- src/openvz/openvz_driver.c | 2 +- src/qemu/qemu_driver.c | 16 +----- src/uml/uml_driver.c | 2 +- src/util/{virstatslinux.c => virstats.c} | 93 +++++++++++++++++++++++++------- src/util/{virstatslinux.h => virstats.h} | 12 ++--- src/xen/xen_hypervisor.c | 2 +- tests/statstest.c | 2 +- 13 files changed, 102 insertions(+), 51 deletions(-) rename src/util/{virstatslinux.c => virstats.c} (61%) rename src/util/{virstatslinux.h => virstats.h} (77%) -- 1.9.0

2 4

Re: [libvirt] Enable kvm on aarch64, Cleanup F-16/18 conditionals
by Eric Blake 15 Jul '14

15 Jul '14

reposting to the upstream list - we'd like to keep the downstream .spec file in sync with upstream, rather than needlessly diverging. On 07/15/2014 10:52 AM, Peter Robinson wrote: > commit ae37ed3500672f12383825c84dd5ae940fb90ff8 > Author: Peter Robinson <pbrobinson(a)gmail.com> > Date: Tue Jul 15 17:52:18 2014 +0100 > > Enable kvm on aarch64, Cleanup F-16/18 conditionals > > libvirt.spec | 28 ++++++++-------------------- > 1 files changed, 8 insertions(+), 20 deletions(-) > --- > diff --git a/libvirt.spec b/libvirt.spec > index fad21d9..213760d 100644 > --- a/libvirt.spec > +++ b/libvirt.spec > @@ -55,14 +55,10 @@ > > %define with_qemu_tcg %{with_qemu} > # Change if we ever provide qemu-kvm binaries on non-x86 hosts > -%if 0%{?fedora} >= 18 > - %if 0%{?fedora} >= 20 > - %define qemu_kvm_arches %{ix86} x86_64 ppc64 s390x %{arm} > - %else > - %define qemu_kvm_arches %{ix86} x86_64 ppc64 s390x > - %endif > +%if 0%{?fedora} >= 20 > + %define qemu_kvm_arches %{ix86} x86_64 %{power64} s390x %{arm} aarch64 > %else > - %define qemu_kvm_arches %{ix86} x86_64 > + %define qemu_kvm_arches %{ix86} x86_64 %{power64} s390x > %endif > > %ifarch %{qemu_kvm_arches} > @@ -212,18 +208,6 @@ > %define with_xen 0 > %endif > > -# Fedora doesn't have any QEMU on ppc64 until FC16 - only ppc > -%if 0%{?fedora} && 0%{?fedora} < 16 > - %ifarch ppc64 > - %define with_qemu 0 > - %endif > -%endif > - > -# Fedora doesn't have new enough Xen for libxl until F18 > -%if 0%{?fedora} && 0%{?fedora} < 18 > - %define with_libxl 0 > -%endif > - > # PolicyKit was introduced in Fedora 8 / RHEL-6 or newer > %if 0%{?fedora} >= 8 || 0%{?rhel} >= 6 > %define with_polkit 0%{!?_without_polkit:1} > @@ -385,7 +369,7 @@ > Summary: Library providing a simple virtualization API > Name: libvirt > Version: 1.2.6 > -Release: 1%{?dist}%{?extra_release} > +Release: 2%{?dist}%{?extra_release} > License: LGPLv2+ > Group: Development/Libraries > BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root > @@ -2236,6 +2220,10 @@ exit 0 > %doc examples/systemtap > > %changelog > +* Tue Jul 15 2014 Peter Robinson <pbrobinson(a)fedoraproject.org> 1.2.6-2 > +- Enable kvm on aarch64 > +- Cleanup F-16/18 conditionals > + > * Wed Jul 2 2014 Daniel P. Berrange <berrange(a)redhat.com> - 1.2.6-1 > - Update to 1.2.6 release > > -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

2 1

[libvirt] [PATCH 0/3] libxl: support hotplug of <interface> device
by Chunyan Liu 15 Jul '14

15 Jul '14

This patch series is to add support for attach/detaching an <interface> device. At the same time, add two fixes (1/3 and 3/3) Chunyan Liu (3): libxl: add HOSTDEV type in libxlDomainDetachDeviceConfig libxl: support hotplug of <interface> libxl: fix return value error Attach|DetachDeviceFlags .gnulib | 2 +- src/libxl/libxl_domain.c | 12 ++- src/libxl/libxl_driver.c | 193 +++++++++++++++++++++++++++++++++++++++++------ 3 files changed, 180 insertions(+), 27 deletions(-) -- 1.8.4.5

2 4

[libvirt] [PATCH v2 00/16] Support for per-guest-node binding
by Martin Kletzander 15 Jul '14

15 Jul '14

Currently we are only able to bind the whole domain to some host nodes using the /domain/numatune/memory element. Numerous requests were made to support host<->guest numa node bindings, so this series tries to implement that using /domain/numatune/memnode elements. That is incompatible with automatic numa placement (numad) since that makes no sense. Some of these patches were ACK'd in the previous round, but this version completely rewrites the parsing and formatting of the numatune XML element and places it into a separate file. Hence the repost of all the patches even with those ACK'd ones. Patches 1-3 move some code around, patch 4 adds cell id specification into the XML (which is used later on). Then patches 5-7 rework the numatune handling, which clears out some odd things, but mostly cleans the parsing code. Patch 8 adds the support for memnode elements in the XML conf code and together with patch 9 enables the use of it outside numatune_conf.c. After that, I needed to probe qemu for 2 capabilities; for one of them patch 10 adds the possibility to probe for it, then two following patches 11 and 12 add the probing data. One of the capabilities tells us that we can use disjoint ranges (not necessarily for the cpus= param) with qemu, so patch 13 makes a use of it. Finally patch 14 uses the memnode data to tell qemu which host nodes should be used for the allocations of memory blocks. Patch 15 does almost nothing, but the next patch looks better with it. And the last patch, number 16, fixes a bug with KVM and cgroups. One last note, APIs for handling the memnode settings will be added later. I'm sending this to prepare the ground for Michal's work with hugepages. Martin Kletzander (16): qemu: purely a code movement qemu: remove useless error check conf: purely a code movement conf, schema: add 'id' field for cells numatune: create new module for numatune numatune: unify numatune struct and enum names numatune: Encapsulate numatune configuration in order to unify results conf, schema: add support for memnode elements numatune: add support for per-node memory bindings in private APIs qemu: allow qmp probing for cmdline options without params qemu: memory-backend-ram capability probing qemu: newer -numa parameter capability probing qemu: enable disjoint numa cpu ranges qemu: pass numa node binding preferences to qemu qemu: split out cpuset.mems setting qemu: leave restricting cpuset.mems after initialization docs/formatdomain.html.in | 26 +- docs/schemas/domaincommon.rng | 22 + po/POTFILES.in | 1 + src/Makefile.am | 3 +- src/conf/cpu_conf.c | 39 +- src/conf/cpu_conf.h | 3 +- src/conf/domain_conf.c | 203 ++----- src/conf/domain_conf.h | 10 +- src/conf/numatune_conf.c | 589 +++++++++++++++++++++ src/conf/numatune_conf.h | 108 ++++ src/libvirt_private.syms | 24 +- src/lxc/lxc_cgroup.c | 20 +- src/lxc/lxc_controller.c | 5 +- src/lxc/lxc_native.c | 15 +- src/parallels/parallels_driver.c | 7 +- src/qemu/qemu_capabilities.c | 16 +- src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_cgroup.c | 52 +- src/qemu/qemu_cgroup.h | 4 +- src/qemu/qemu_command.c | 98 +++- src/qemu/qemu_driver.c | 84 ++- src/qemu/qemu_monitor.c | 6 +- src/qemu/qemu_monitor.h | 3 +- src/qemu/qemu_monitor_json.c | 8 +- src/qemu/qemu_monitor_json.h | 3 +- src/qemu/qemu_process.c | 12 +- src/util/virnuma.c | 61 +-- src/util/virnuma.h | 28 +- tests/qemucapabilitiesdata/caps_1.6.50-1.caps | 1 + tests/qemucapabilitiesdata/caps_1.6.50-1.replies | 5 + tests/qemumonitorjsontest.c | 20 +- .../qemuxml2argv-cpu-numa-disjoint.args | 6 + .../qemuxml2argv-cpu-numa-disjoint.xml | 28 + tests/qemuxml2argvdata/qemuxml2argv-cpu-numa1.xml | 6 +- tests/qemuxml2argvdata/qemuxml2argv-cpu-numa2.xml | 6 +- tests/qemuxml2argvdata/qemuxml2argv-cpu-numa3.xml | 25 + .../qemuxml2argv-numatune-auto-prefer.xml | 29 + .../qemuxml2argv-numatune-memnode-no-memory.args | 8 + .../qemuxml2argv-numatune-memnode-no-memory.xml | 30 ++ .../qemuxml2argv-numatune-memnode-nocpu.xml | 25 + .../qemuxml2argv-numatune-memnode.args | 11 + .../qemuxml2argv-numatune-memnode.xml | 33 ++ .../qemuxml2argv-numatune-memnodes-problematic.xml | 31 ++ tests/qemuxml2argvtest.c | 12 + .../qemuxml2xmlout-cpu-numa1.xml | 28 + .../qemuxml2xmlout-cpu-numa2.xml | 28 + .../qemuxml2xmlout-numatune-auto-prefer.xml | 29 + .../qemuxml2xmlout-numatune-memnode.xml | 33 ++ tests/qemuxml2xmltest.c | 8 + 49 files changed, 1467 insertions(+), 387 deletions(-) create mode 100644 src/conf/numatune_conf.c create mode 100644 src/conf/numatune_conf.h create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-numa-disjoint.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-numa-disjoint.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-numa3.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-numatune-auto-prefer.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-numatune-memnode-no-memory.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-numatune-memnode-no-memory.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-numatune-memnode-nocpu.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-numatune-memnode.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-numatune-memnode.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-numatune-memnodes-problematic.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-cpu-numa1.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-cpu-numa2.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-numatune-auto-prefer.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-numatune-memnode.xml -- 2.0.0

3 31

[libvirt] [PATCH 0/2] Tri-state bool enum cleanups
by Ján Tomko 15 Jul '14

15 Jul '14

We have been using a few different enum types with the same values: DEFAULT ENABLED = "on" / "yes" DISABLED = "off" / "no" Replace these with just two enums with rather unimaginative names: virDomainYesNo and virDomainOnOff Ján Tomko (2): Introduce virDomainYesNo enum type Introduce virDomainOnOff enum src/conf/domain_conf.c | 194 +++++++++++++++++------------------------------ src/conf/domain_conf.h | 127 +++++-------------------------- src/libvirt_private.syms | 26 +------ src/libxl/libxl_conf.c | 6 +- src/lxc/lxc_container.c | 4 +- src/lxc/lxc_native.c | 2 +- src/qemu/qemu_command.c | 80 +++++++++---------- src/qemu/qemu_driver.c | 4 +- src/qemu/qemu_process.c | 2 +- src/vbox/vbox_tmpl.c | 22 +++--- src/xenxs/xen_sxpr.c | 20 ++--- src/xenxs/xen_xm.c | 20 ++--- 12 files changed, 174 insertions(+), 333 deletions(-) -- 1.8.5.5

3 9

[libvirt] [PATCHv3] Rework lxc apparmor profile
by Cédric Bosdonnat 15 Jul '14

15 Jul '14

Rework the apparmor lxc profile abstraction to mimic ubuntu's container-default. This profile allows quite a lot, but strives to restrict access to dangerous resources. Removing the explicit authorizations to bash, systemd and cron files, forces them to keep the lxc profile for all applications inside the container. PUx permissions where leading to running systemd (and others tasks) unconfined. Put the generic files, network and capabilities restrictions directly in the TEMPLATE.lxc: this way, users can restrict them on a per container basis. --- Diff to v2: * Fixed missing goto cleanup examples/apparmor/Makefile.am | 6 +- examples/apparmor/TEMPLATE.lxc | 15 ++++ examples/apparmor/{TEMPLATE => TEMPLATE.qemu} | 2 +- examples/apparmor/libvirt-lxc | 119 +++++++++++++++++++++++--- src/security/security_apparmor.c | 21 +++-- src/security/virt-aa-helper.c | 29 +------ 6 files changed, 149 insertions(+), 43 deletions(-) create mode 100644 examples/apparmor/TEMPLATE.lxc rename examples/apparmor/{TEMPLATE => TEMPLATE.qemu} (75%) diff --git a/examples/apparmor/Makefile.am b/examples/apparmor/Makefile.am index a741e94..7a20e16 100644 --- a/examples/apparmor/Makefile.am +++ b/examples/apparmor/Makefile.am @@ -15,7 +15,8 @@ ## <http://www.gnu.org/licenses/>. EXTRA_DIST= \ - TEMPLATE \ + TEMPLATE.qemu \ + TEMPLATE.lxc \ libvirt-qemu \ libvirt-lxc \ usr.lib.libvirt.virt-aa-helper \ @@ -36,6 +37,7 @@ abstractions_DATA = \ templatesdir = $(apparmordir)/libvirt templates_DATA = \ - TEMPLATE \ + TEMPLATE.qemu \ + TEMPLATE.lxc \ $(NULL) endif WITH_APPARMOR_PROFILES diff --git a/examples/apparmor/TEMPLATE.lxc b/examples/apparmor/TEMPLATE.lxc new file mode 100644 index 0000000..7b64885 --- /dev/null +++ b/examples/apparmor/TEMPLATE.lxc @@ -0,0 +1,15 @@ +# +# This profile is for the domain whose UUID matches this file. +# + +#include <tunables/global> + +profile LIBVIRT_TEMPLATE { + #include <abstractions/libvirt-lxc> + + # Globally allows everything to run under this profile + # These can be narrowed depending on the container's use. + file, + capability, + network, +} diff --git a/examples/apparmor/TEMPLATE b/examples/apparmor/TEMPLATE.qemu similarity index 75% rename from examples/apparmor/TEMPLATE rename to examples/apparmor/TEMPLATE.qemu index 187dec5..008a221 100644 --- a/examples/apparmor/TEMPLATE +++ b/examples/apparmor/TEMPLATE.qemu @@ -5,5 +5,5 @@ #include <tunables/global> profile LIBVIRT_TEMPLATE { - #include <abstractions/libvirt-driver> + #include <abstractions/libvirt-qemu> } diff --git a/examples/apparmor/libvirt-lxc b/examples/apparmor/libvirt-lxc index d404328..4bfb503 100644 --- a/examples/apparmor/libvirt-lxc +++ b/examples/apparmor/libvirt-lxc @@ -2,16 +2,115 @@ #include <abstractions/base> - # Needed for lxc-enter-namespace - capability sys_admin, - capability sys_chroot, + umount, - # Added for lxc-enter-namespace --cmd /bin/bash - /bin/bash PUx, + # ignore DENIED message on / remount + deny mount options=(ro, remount) -> /, - /usr/sbin/cron PUx, - /usr/lib/systemd/systemd PUx, + # allow tmpfs mounts everywhere + mount fstype=tmpfs, - /usr/lib/libsystemd-*.so.* mr, - /usr/lib/libudev-*.so.* mr, - /etc/ld.so.cache mr, + # allow mqueue mounts everywhere + mount fstype=mqueue, + + # allow fuse mounts everywhere + mount fstype=fuse.*, + + # deny writes in /proc/sys/fs but allow binfmt_misc to be mounted + mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/, + deny @{PROC}/sys/fs/** wklx, + + # allow efivars to be mounted, writing to it will be blocked though + mount fstype=efivarfs -> /sys/firmware/efi/efivars/, + + # block some other dangerous paths + deny @{PROC}/sysrq-trigger rwklx, + deny @{PROC}/mem rwklx, + deny @{PROC}/kmem rwklx, + + # deny writes in /sys except for /sys/fs/cgroup, also allow + # fusectl, securityfs and debugfs to be mounted there (read-only) + mount fstype=fusectl -> /sys/fs/fuse/connections/, + mount fstype=securityfs -> /sys/kernel/security/, + mount fstype=debugfs -> /sys/kernel/debug/, + mount fstype=proc -> /proc/, + mount fstype=sysfs -> /sys/, + deny /sys/firmware/efi/efivars/** rwklx, + deny /sys/kernel/security/** rwklx, + + # generated by: lxc-generate-aa-rules.py container-rules.base + deny /proc/sys/[^kn]*{,/**} wklx, + deny /proc/sys/k[^e]*{,/**} wklx, + deny /proc/sys/ke[^r]*{,/**} wklx, + deny /proc/sys/ker[^n]*{,/**} wklx, + deny /proc/sys/kern[^e]*{,/**} wklx, + deny /proc/sys/kerne[^l]*{,/**} wklx, + deny /proc/sys/kernel/[^smhd]*{,/**} wklx, + deny /proc/sys/kernel/d[^o]*{,/**} wklx, + deny /proc/sys/kernel/do[^m]*{,/**} wklx, + deny /proc/sys/kernel/dom[^a]*{,/**} wklx, + deny /proc/sys/kernel/doma[^i]*{,/**} wklx, + deny /proc/sys/kernel/domai[^n]*{,/**} wklx, + deny /proc/sys/kernel/domain[^n]*{,/**} wklx, + deny /proc/sys/kernel/domainn[^a]*{,/**} wklx, + deny /proc/sys/kernel/domainna[^m]*{,/**} wklx, + deny /proc/sys/kernel/domainnam[^e]*{,/**} wklx, + deny /proc/sys/kernel/domainname?*{,/**} wklx, + deny /proc/sys/kernel/h[^o]*{,/**} wklx, + deny /proc/sys/kernel/ho[^s]*{,/**} wklx, + deny /proc/sys/kernel/hos[^t]*{,/**} wklx, + deny /proc/sys/kernel/host[^n]*{,/**} wklx, + deny /proc/sys/kernel/hostn[^a]*{,/**} wklx, + deny /proc/sys/kernel/hostna[^m]*{,/**} wklx, + deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx, + deny /proc/sys/kernel/hostname?*{,/**} wklx, + deny /proc/sys/kernel/m[^s]*{,/**} wklx, + deny /proc/sys/kernel/ms[^g]*{,/**} wklx, + deny /proc/sys/kernel/msg*/** wklx, + deny /proc/sys/kernel/s[^he]*{,/**} wklx, + deny /proc/sys/kernel/se[^m]*{,/**} wklx, + deny /proc/sys/kernel/sem*/** wklx, + deny /proc/sys/kernel/sh[^m]*{,/**} wklx, + deny /proc/sys/kernel/shm*/** wklx, + deny /proc/sys/kernel?*{,/**} wklx, + deny /proc/sys/n[^e]*{,/**} wklx, + deny /proc/sys/ne[^t]*{,/**} wklx, + deny /proc/sys/net?*{,/**} wklx, + deny /sys/[^fdc]*{,/**} wklx, + deny /sys/c[^l]*{,/**} wklx, + deny /sys/cl[^a]*{,/**} wklx, + deny /sys/cla[^s]*{,/**} wklx, + deny /sys/clas[^s]*{,/**} wklx, + deny /sys/class/[^n]*{,/**} wklx, + deny /sys/class/n[^e]*{,/**} wklx, + deny /sys/class/ne[^t]*{,/**} wklx, + deny /sys/class/net?*{,/**} wklx, + deny /sys/class?*{,/**} wklx, + deny /sys/d[^e]*{,/**} wklx, + deny /sys/de[^v]*{,/**} wklx, + deny /sys/dev[^i]*{,/**} wklx, + deny /sys/devi[^c]*{,/**} wklx, + deny /sys/devic[^e]*{,/**} wklx, + deny /sys/device[^s]*{,/**} wklx, + deny /sys/devices/[^v]*{,/**} wklx, + deny /sys/devices/v[^i]*{,/**} wklx, + deny /sys/devices/vi[^r]*{,/**} wklx, + deny /sys/devices/vir[^t]*{,/**} wklx, + deny /sys/devices/virt[^u]*{,/**} wklx, + deny /sys/devices/virtu[^a]*{,/**} wklx, + deny /sys/devices/virtua[^l]*{,/**} wklx, + deny /sys/devices/virtual/[^n]*{,/**} wklx, + deny /sys/devices/virtual/n[^e]*{,/**} wklx, + deny /sys/devices/virtual/ne[^t]*{,/**} wklx, + deny /sys/devices/virtual/net?*{,/**} wklx, + deny /sys/devices/virtual?*{,/**} wklx, + deny /sys/devices?*{,/**} wklx, + deny /sys/f[^s]*{,/**} wklx, + deny /sys/fs/[^c]*{,/**} wklx, + deny /sys/fs/c[^g]*{,/**} wklx, + deny /sys/fs/cg[^r]*{,/**} wklx, + deny /sys/fs/cgr[^o]*{,/**} wklx, + deny /sys/fs/cgro[^u]*{,/**} wklx, + deny /sys/fs/cgrou[^p]*{,/**} wklx, + deny /sys/fs/cgroup?*{,/**} wklx, + deny /sys/fs?*{,/**} wklx, diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index 9603c78..e6563de 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -351,26 +351,37 @@ AppArmorSetSecuritySCSILabel(virSCSIDevicePtr dev ATTRIBUTE_UNUSED, static int AppArmorSecurityManagerProbe(const char *virtDriver ATTRIBUTE_UNUSED) { - char *template = NULL; + char *template_qemu = NULL; + char *template_lxc = NULL; int rc = SECURITY_DRIVER_DISABLE; if (use_apparmor() < 0) return rc; /* see if template file exists */ - if (virAsprintf(&template, "%s/TEMPLATE", + if (virAsprintf(&template_qemu, "%s/TEMPLATE.qemu", APPARMOR_DIR "/libvirt") == -1) return rc; - if (!virFileExists(template)) { + if (virAsprintf(&template_lxc, "%s/TEMPLATE.lxc", + APPARMOR_DIR "/libvirt") == -1) + goto cleanup; + + if (!virFileExists(template_qemu)) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("template \'%s\' does not exist"), template_qemu); + goto cleanup; + } + if (!virFileExists(template_lxc)) { virReportError(VIR_ERR_INTERNAL_ERROR, - _("template \'%s\' does not exist"), template); + _("template \'%s\' does not exist"), template_lxc); goto cleanup; } rc = SECURITY_DRIVER_ENABLE; cleanup: - VIR_FREE(template); + VIR_FREE(template_qemu); + VIR_FREE(template_lxc); return rc; } diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index f11855d..fe9ad59 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -336,24 +336,20 @@ create_profile(const char *profile, const char *profile_name, char *pcontent = NULL; char *replace_name = NULL; char *replace_files = NULL; - char *replace_driver = NULL; const char *template_name = "\nprofile LIBVIRT_TEMPLATE"; const char *template_end = "\n}"; - const char *template_driver = "libvirt-driver"; int tlen, plen; int fd; int rc = -1; - const char *driver_name = "qemu"; - - if (virtType == VIR_DOMAIN_VIRT_LXC) - driver_name = "lxc"; if (virFileExists(profile)) { vah_error(NULL, 0, _("profile exists")); goto end; } - if (virAsprintfQuiet(&template, "%s/TEMPLATE", APPARMOR_DIR "/libvirt") < 0) { + + if (virAsprintfQuiet(&template, "%s/TEMPLATE.%s", APPARMOR_DIR "/libvirt", + virDomainVirtTypeToString(virtType)) < 0) { vah_error(NULL, 0, _("template name exceeds maximum length")); goto end; } @@ -378,11 +374,6 @@ create_profile(const char *profile, const char *profile_name, goto clean_tcontent; } - if (strstr(tcontent, template_driver) == NULL) { - vah_error(NULL, 0, _("no replacement string in template")); - goto clean_tcontent; - } - /* '\nprofile <profile_name>\0' */ if (virAsprintfQuiet(&replace_name, "\nprofile %s", profile_name) == -1) { vah_error(NULL, 0, _("could not allocate memory for profile name")); @@ -397,15 +388,7 @@ create_profile(const char *profile, const char *profile_name, goto clean_tcontent; } - /* 'libvirt-<driver_name>\0' */ - if (virAsprintfQuiet(&replace_driver, "libvirt-%s", driver_name) == -1) { - vah_error(NULL, 0, _("could not allocate memory for profile driver")); - VIR_FREE(replace_driver); - goto clean_tcontent; - } - - plen = tlen + strlen(replace_name) - strlen(template_name) + - strlen(replace_driver) - strlen(template_driver) + 1; + plen = tlen + strlen(replace_name) - strlen(template_name) + 1; if (virtType != VIR_DOMAIN_VIRT_LXC) plen += strlen(replace_files) - strlen(template_end); @@ -422,9 +405,6 @@ create_profile(const char *profile, const char *profile_name, pcontent[0] = '\0'; strcpy(pcontent, tcontent); - if (replace_string(pcontent, plen, template_driver, replace_driver) < 0) - goto clean_all; - if (replace_string(pcontent, plen, template_name, replace_name) < 0) goto clean_all; @@ -455,7 +435,6 @@ create_profile(const char *profile, const char *profile_name, clean_replace: VIR_FREE(replace_name); VIR_FREE(replace_files); - VIR_FREE(replace_driver); clean_tcontent: VIR_FREE(tcontent); end: -- 1.8.4.5

2 1

[libvirt] [PATCH 0/2] AppArmor lxc profile fixes
by Cédric Bosdonnat 15 Jul '14

15 Jul '14

Hi all, Here are 2 patches fixing AppArmor profiles for lxc containers. The main problem was that the current profile was: 1/ too restricting as it needed to allow all needed applications 2/ used PUx permissions, which made systemd (or bash) run as unprofiled as they have no profiles defined. The new profile is based on container-default profile shipped for lxc on Ubuntu. All applications are now running under the parent profile (ix permission) and some critical files accesses are denied. The first patch also avoid writing the useless libvirt-UUID.files for lxc containers. Cédric Bosdonnat (2): Don't output libvirt-UUID.files for LXC apparmor profiles Rework lxc apparmor profile examples/apparmor/Makefile.am | 6 +- examples/apparmor/TEMPLATE.lxc | 15 ++++ examples/apparmor/{TEMPLATE => TEMPLATE.qemu} | 2 +- examples/apparmor/libvirt-lxc | 119 +++++++++++++++++++++++--- src/security/security_apparmor.c | 20 +++-- src/security/virt-aa-helper.c | 32 ++----- 6 files changed, 150 insertions(+), 44 deletions(-) create mode 100644 examples/apparmor/TEMPLATE.lxc rename examples/apparmor/{TEMPLATE => TEMPLATE.qemu} (75%) -- 1.8.4.5

4 11

[libvirt] [PATCH 0/2] Fix condition value assignments in conditions
by Ján Tomko 15 Jul '14

15 Jul '14

Split into two patches, as we might want to backport the first one somewhere. Ján Tomko (2): Fix error on fs pool build failure Fix assignment of comparison against zero src/storage/storage_backend_fs.c | 2 +- tests/virnettlshelpers.c | 4 ++-- tools/virsh-network.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) -- 1.8.5.5

2 3

[libvirt] [PATCH] qemu: blockcopy: Initialize correct source structure
by Peter Krempa 15 Jul '14

15 Jul '14

4cc1f1a01fb338de939ba88eb933931687b22336 introduced a crash when doing a block copy as virStorageSourceInitChainElement was called on "disk->mirror" that is still NULL at that point instead of "mirror" which temporarily holds the mirror source struct until it's fully initialized. This resulted into a crash as a NULL was dereferenced. Reported by: Shanzi Yu <shyu(a)redhat.com> --- Fortunately unreleased. src/qemu/qemu_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 8d40bc9..c0ad446 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -15309,7 +15309,7 @@ qemuDomainBlockCopy(virDomainObjPtr vm, if (VIR_STRDUP(mirror->path, dest) < 0) goto endjob; - if (virStorageSourceInitChainElement(disk->mirror, disk->src, false) < 0) + if (virStorageSourceInitChainElement(mirror, disk->src, false) < 0) goto endjob; if (qemuDomainPrepareDiskChainElement(driver, vm, mirror, -- 2.0.0

2 2

Re: [libvirt] [libvirt-users] LVM Volume Creation
by Ravi Samji 15 Jul '14

15 Jul '14

Hi All, I'm having issue with creating LVM Volume via libvirt. We are running libvirtd 1.2 with KVM. We are creating Volume Group (VG01) outside of libvirt and defining a storage pool for it. Here is the StoragePool XML for the Volume Group created outside libvirt. <pool type="logical"> <name>VG01</name> <target> <path>/dev/VG01</path> </target> </pool> We are creating Logical Volume (ub_test01.img) through libvirt in the Volume Group (VG01) Here is the XML to create Storage Volume in LVM Storage Pool VG01. <volume type="block"> <name>ub_test01.img</name> <allocation>0</allocation> <capacity unit="M">1</capacity> <target> <format type="lvm2" /> </target> </volume> When I create the Logical Volume from libvirt using above XML and run lvs command to list logical volumes, this is what I see. LV VG Attr LSize Origin Snap% Move Log Copy% Convert --------------- ------- ------- ------- ----------------------- ------- ------- ------- ------- ------- foo VG01 -wi-a- 1.00g ub_test01.img VG01 swi-a- 4.00m [ub_test01.img_vorigin] 0.20 root ops-02 -wi-ao 227.08g swap_1 ops-02 -wi-ao 5.75g As you see, ub_test01.img shows that it has an Origin indicating that it was created as a snapshot, but, that Origin doesn't exist and wasn't specified. I'd appreciate if you anyone can help me understand what is going on and/or describe how to make libvirt create logical volumes not as a snapshot. I'm happy to enable debugging to see what command libvirt is running to create the volume if someone case describe how to enable debugging. Regards, Ravi Message sent via Atmail Open - http://atmail.org/

2 1