- Devel - libvirt List Archives

[libvirt] [PATCH] tests: Set abs_*dir in a consistent way
by Jiri Denemark 20 Mar '14

20 Mar '14

Use $(shell cd $(...) && pwd) to set abs_*dir variables similarly to what src/Makefile.am does. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- tests/Makefile.am | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/tests/Makefile.am b/tests/Makefile.am index 90f70ff..20a98c7 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -16,6 +16,10 @@ ## License along with this library. If not, see ## <http://www.gnu.org/licenses/>. +# old automake does not provide abs_{src,build}dir variables +abs_builddir = $(shell pwd) +abs_srcdir = $(shell cd $(srcdir) && pwd) + SHELL = $(PREFERABLY_POSIX_SHELL) INCLUDES = \ @@ -28,8 +32,8 @@ INCLUDES = \ $(GETTEXT_CPPFLAGS) AM_CFLAGS = \ - -Dabs_builddir="\"`pwd`\"" \ - -Dabs_srcdir="\"`cd '$(srcdir)'; pwd`\"" \ + -Dabs_builddir="\"$(abs_builddir)\"" \ + -Dabs_srcdir="\"$(abs_srcdir)\"" \ $(LIBXML_CFLAGS) \ $(GNUTLS_CFLAGS) \ $(SASL_CFLAGS) \ @@ -373,7 +377,7 @@ TESTS = $(test_programs) \ # Also, BSD sh doesn't like 'a=b b=$$a', so we can't use an # intermediate shell variable, but must do all the expansion in make -lv_abs_top_builddir=`cd '$(top_builddir)'; pwd` +lv_abs_top_builddir=$(shell cd '$(top_builddir)'; pwd) path_add = $(subst :,$(PATH_SEPARATOR),\ $(subst !,$(lv_abs_top_builddir)/,!daemon:!tools:!tests)) @@ -381,9 +385,9 @@ VIR_TEST_EXPENSIVE ?= $(VIR_TEST_EXPENSIVE_DEFAULT) TESTS_ENVIRONMENT = \ abs_top_builddir=$(lv_abs_top_builddir) \ abs_top_srcdir=`cd '$(top_srcdir)'; pwd` \ - abs_builddir=`pwd` \ - abs_srcdir=`cd '$(srcdir)'; pwd` \ - CONFIG_HEADER="`cd '$(top_builddir)'; pwd`/config.h" \ + abs_builddir=$(abs_builddir) \ + abs_srcdir=$(abs_srcdir) \ + CONFIG_HEADER="$(lv_abs_top_builddir)/config.h" \ PATH="$(path_add)$(PATH_SEPARATOR)$$PATH" \ SHELL="$(SHELL)" \ LIBVIRT_DRIVER_DIR="$(lv_abs_top_builddir)/src/.libs" \ -- 1.9.0

2 2

[libvirt] [PATCH] qemu: Return meaningful error when qemu dies early
by Jiri Denemark 20 Mar '14

20 Mar '14

https://bugzilla.redhat.com/show_bug.cgi?id=844378 When qemu dies early after connecting to its monitor but before we actually try to read something from the monitor, we would just fail domain start with useless message: "An error occurred, but the cause is unknown" This is because the real error gets reported in a monitor EOF handler executing within libvirt's event loop. The fix is to take any error set in qemuMonitor structure and propagate it into the thread-local error when qemuMonitorClose is called and no thread-local error is set. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/qemu/qemu_monitor.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index b2af0ae..bca2612 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -924,6 +924,12 @@ void qemuMonitorClose(qemuMonitorPtr mon) virCondSignal(&mon->notify); } + /* Propagate existing monitor error in case the current thread has no + * error set. + */ + if (mon->lastError.code != VIR_ERR_OK && !virGetLastError()) + virSetError(&mon->lastError); + virObjectUnlock(mon); virObjectUnref(mon); } -- 1.9.0

2 3

[libvirt] CPU Topology in Libvirt Java 0.51
by Vikas Kokare 20 Mar '14

20 Mar '14

We are trying to get the cpu topology data (cores, sockets, threads) using the Java binding of the libvirt API, after connecting to a hypervisor. We are expecting the domain (vm) XML payload to contain the <cpu> element with the <topology> sub-element, but it is not present. <cpu mode='custom' match='exact'> <model fallback='allow'>Penryn</model> <vendor>Intel</vendor> <feature policy='require' name='tm2'/> ... </cpu>

3 2

Re: [libvirt] Adding support to limit client connections for vnc/spice display driver
by Patil, Tushar 20 Mar '14

20 Mar '14

On Wed, Mar 19, 2014 at 06:41:16PM +0000, Patil, Tushar wrote: > > >> We are using KVM hypervisor driver for running OpenStack IaaS. Couple >> of months back we have reported one security issue [1] in OS. Basically >> we want to limit on the number of vnc client connections that can be >> opened by users for a given VM. I know that there is share policy where >> you can specify "VNC_SHARE_MODE_EXCLUSIVE" share mode. But it only allows >> one client connection to the vnc console, it will disconnect all previously >> opened vnc client connections. Since vnc display driver already has the >> data of client connections, it would be possible to add the logic to limit >> on the number of client connections. >> >> What we want is the ability to specify threshold how many vnc client >> connections should be allowed at any given point of time in the domain >> xml for graphics device (especially for vnc/spice)? >> >> Example > ><graphics type="vnc" autoport="yes" keymap="en-us" listen="127.0.0.1"/, share-policy="limit-connections", connections="5"> >> >> Add support to accept new share policy "limit-connections'. >> So in the above example, when user tries to open vnc display for the 6th >>time, then the request should be rejected. >> >> I need your expert opinion in deciding whether it's a good idea to add >> this support in the vnc/spice display driver or this kind of constraint >> should be imposed outside libvirt? > Libvirt isn't at all involved in vnc/spice connections. They happen > directly between QEMU & the client app, optionally via Nova's proxy > service. If QEMU had a setting for such a limit then libvirt could > set it, but AFAIK none exists, so there's nothing libvirt can do > about this currently. So options are either todo work in QEMU to > add this config feature, then wire it into libvirt, or address it in > the Nova proxy service. Thanks for your advice. I will add a new feature request in qemu. After this feature is added to qemu, I will then add a request in libvirt to use the newly added parameters. Thanks and Best Regards, Tushar ______________________________________________________________________ Disclaimer:This email and any attachments are sent in strictest confidence for the sole use of the addressee and may contain legally privileged, confidential, and proprietary data. If you are not the intended recipient, please advise the sender by replying promptly to this email and then delete and destroy this email and any attachments without any further use, copying or forwarding

1 0

[libvirt] [PATCHv2 0/7] arbitrary qemu monitor events
by Eric Blake 20 Mar '14

20 Mar '14

v1 was here: https://www.redhat.com/archives/libvir-list/2014-February/msg00000.html Many of the patches in the series were acked back then, but the 'virsh' changes were made conditional on getting 'virsh event' working first, so it missed the last release. Changes in v2: rebase to master, s/1.2.2/1.2.3/, simplify virsh patch (2/7) to use framework for event tracking. Also, the python bindings need review (no change to v1): https://www.redhat.com/archives/libvir-list/2014-February/msg00197.html Note that Dan was hesitant about patches 6 and 7 in v1, but if we don't take those patches, then the API is over-engineered. Either we are willing to support filtering on specific event names and patterns, or I should respin a v3 of this series that simplifies the API in patch 1 to not expose that possibility. Personally, I think the ability to expose all 'spice_*' related events at once, without being drowned by other events, is worth the complexity of server-side filtering. I also note that the bulk of the complexity was isolated to the qemu-specific code with no noticeable impact to the normal event code (the changes to domain_event.c are primarily additions, and the changes to object_event.c are merely tweaks to allow qemu filtering to be server-side only in comparison to normal events that can do some of the filtering client side). Eric Blake (7): qemu: new API for tracking arbitrary monitor events qemu: virsh wrapper for qemu events qemu: create object for qemu monitor events qemu: wire up RPC for qemu monitor events qemu: enable monitor event reporting qemu: enable monitor event filtering by name qemu: allow filtering events by regex daemon/libvirtd.h | 2 + daemon/remote.c | 209 ++++++++++++++++++++++++++++++++++++ include/libvirt/libvirt-qemu.h | 46 +++++++- src/conf/domain_event.c | 234 +++++++++++++++++++++++++++++++++++++++++ src/conf/domain_event.h | 23 ++++ src/conf/object_event.c | 40 ++++--- src/driver.h | 15 +++ src/libvirt-qemu.c | 124 ++++++++++++++++++++++ src/libvirt_private.syms | 2 + src/libvirt_qemu.syms | 6 ++ src/qemu/qemu_driver.c | 51 +++++++++ src/qemu/qemu_monitor.c | 14 +++ src/qemu/qemu_monitor.h | 13 ++- src/qemu/qemu_monitor_json.c | 21 +++- src/qemu/qemu_process.c | 29 +++++ src/qemu_protocol-structs | 22 ++++ src/remote/qemu_protocol.x | 50 ++++++++- src/remote/remote_driver.c | 143 ++++++++++++++++++++++++- src/rpc/gendispatch.pl | 13 +-- tools/virsh-domain.c | 148 ++++++++++++++++++++++++++ tools/virsh.pod | 30 +++++- 21 files changed, 1203 insertions(+), 32 deletions(-) -- 1.8.5.3

2 9

[libvirt] Question about VIR_ALLOC vs vshMalloc
by Solly Ross 20 Mar '14

20 Mar '14

I was wondering what the reason was for seemingly near-duplicate code. VIR_ALLOC and vshMalloc (and similar methods for calloc, etc), seem to be roughly identical in function, with the only difference being that VIR_ALLOC and friends are used in libvirt proper, whereas vshMalloc and friends are used in the virsh code. Is there a reason why virsh does not simply use VIR_ALLOC and friends? Best Regards, Solly Ross

2 1

[libvirt] [PATCH] is_selinux_enabled returns -1 on error, account for this.
by Scott Sullivan 20 Mar '14

20 Mar '14

Per the documentation, is_selinux_enabled() returns -1 on error. Account for this. Previously when -1 was being returned the condition would still be true. I was noticing this because on my system that has selinux disabled I was getting this in the libvirt.log every 5 seconds: error : virIdentityGetSystem:173 : Unable to lookup SELinux process context: Invalid argument With this patch applied, I no longer get these messages every 5 seconds. I am submitting this in case its deemed useful for inclusion. Anyone have any comments on this change? This is a patch off current master. From 23e0780db43ebd3ea90710750639df901c261674 Mon Sep 17 00:00:00 2001 From: Scott Sullivan <ssullivan(a)liquidweb.com> Date: Tue, 18 Mar 2014 12:55:50 -0400 Subject: [PATCH] is_selinux_enabled returns -1 on error, account for this. --- src/security/security_selinux.c | 2 +- src/util/viridentity.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 02c7496..5f46bef 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -784,7 +784,7 @@ error: static int virSecuritySELinuxSecurityDriverProbe(const char *virtDriver) { - if (!is_selinux_enabled()) + if (is_selinux_enabled() <= 0) return SECURITY_DRIVER_DISABLE; if (virtDriver && STREQ(virtDriver, "LXC")) { diff --git a/src/util/viridentity.c b/src/util/viridentity.c index 351fdd7..05e7568 100644 --- a/src/util/viridentity.c +++ b/src/util/viridentity.c @@ -169,7 +169,7 @@ virIdentityPtr virIdentityGetSystem(void) goto cleanup; #if WITH_SELINUX - if (is_selinux_enabled()) { + if (is_selinux_enabled() > 0) { if (getcon(&con) < 0) { virReportSystemError(errno, "%s", _("Unable to lookup SELinux process context")); -- 1.7.10.4

2 3

[libvirt] [PATCH python] override: Return NULL on python failure in getCPUModelNames
by Cole Robinson 20 Mar '14

20 Mar '14

Eric pointed this out on the last patch, but I pushed it before noticing his message. --- libvirt-override.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt-override.c b/libvirt-override.c index 71e241e..2532400 100644 --- a/libvirt-override.c +++ b/libvirt-override.c @@ -2350,7 +2350,7 @@ done: error: Py_XDECREF(rv); - rv = VIR_PY_NONE; + rv = NULL; goto done; } #endif /* LIBVIR_CHECK_VERSION(1, 1, 3) */ -- 1.8.5.3

2 2

[libvirt] [PATCH python] override: GetCPUModelNames should return None on failure
by Cole Robinson 20 Mar '14

20 Mar '14

Right now, on failure, libvirt.py doesn't raise an exception and just returns -1 to the user. --- libvirt-override.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt-override.c b/libvirt-override.c index 7f746ed..9fed299 100644 --- a/libvirt-override.c +++ b/libvirt-override.c @@ -2326,7 +2326,7 @@ libvirt_virConnectGetCPUModelNames(PyObject *self ATTRIBUTE_UNUSED, LIBVIRT_END_ALLOW_THREADS; if (c_retval == -1) - return VIR_PY_INT_FAIL; + return VIR_PY_NONE; if ((rv = PyList_New(c_retval)) == NULL) goto error; -- 1.8.5.3

2 3

[libvirt] [PATCH 0/2] bhyve: add xml2args unittest
by Roman Bogorodskiy 20 Mar '14

20 Mar '14

Add testing for xml -> args generation. It's largely based on the similar test for qemu. As it's my first experience with unit testing in libvirt and in unit testing in C in general, I'm not sure I haven't miss some important pieces, but it works as expected for me. I'm also not sure about the license headers: some tests have them, some don't, so I decided not to add them for now. Roman Bogorodskiy (2): Move virBhyveTapGetRealDeviceName to virnetdevtap bhyve: add xml2args unittest src/bhyve/bhyve_command.c | 70 +--------- src/libvirt_private.syms | 1 + src/util/virnetdevtap.c | 78 +++++++++++ src/util/virnetdevtap.h | 3 + tests/Makefile.am | 25 ++++ .../bhyvexml2argvdata/bhyvexml2argv-acpiapic.args | 2 + tests/bhyvexml2argvdata/bhyvexml2argv-acpiapic.xml | 24 ++++ tests/bhyvexml2argvdata/bhyvexml2argv-base.args | 2 + tests/bhyvexml2argvdata/bhyvexml2argv-base.xml | 20 +++ .../bhyvexml2argv-disk-virtio.args | 2 + .../bhyvexml2argv-disk-virtio.xml | 20 +++ tests/bhyvexml2argvmock.c | 38 +++++ tests/bhyvexml2argvtest.c | 154 +++++++++++++++++++++ 13 files changed, 370 insertions(+), 69 deletions(-) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-acpiapic.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-acpiapic.xml create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-base.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-base.xml create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-disk-virtio.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-disk-virtio.xml create mode 100644 tests/bhyvexml2argvmock.c create mode 100644 tests/bhyvexml2argvtest.c -- 1.8.4.2

1 3

[libvirt] [PATCHv4] Ignore missing files on pool refresh
by Ján Tomko 20 Mar '14

20 Mar '14

If we cannot stat/open a file on pool refresh, returning -1 aborts the refresh and the pool is undefined. Don't treat missing files as fatal unless VolOpenCheckMode is called with the VIR_STORAGE_VOL_OPEN_ERROR flag. https://bugzilla.redhat.com/show_bug.cgi?id=977706 --- v1: https://www.redhat.com/archives/libvir-list/2013-July/msg00635.html v2: https://www.redhat.com/archives/libvir-list/2013-July/msg00639.html v3: https://www.redhat.com/archives/libvir-list/2013-July/msg01026.html (by Guanan Ren, also checked the 'open' call) v4: do not call open on sockets and fifos and only skip missing files if we're doing a pool refresh, otherwise 'vol-info' on a missing volume returns 'unknown error' src/storage/storage_backend.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/storage/storage_backend.c b/src/storage/storage_backend.c index d14e633..97ab7b8 100644 --- a/src/storage/storage_backend.c +++ b/src/storage/storage_backend.c @@ -1212,6 +1212,10 @@ virStorageBackendVolOpenCheckMode(const char *path, struct stat *sb, char *base = last_component(path); if (lstat(path, sb) < 0) { + if (errno == ENOENT && !(flags & VIR_STORAGE_VOL_OPEN_ERROR)) { + VIR_WARN("ignoring missing file '%s'", path); + return -2; + } virReportSystemError(errno, _("cannot stat file '%s'"), path); @@ -1238,6 +1242,10 @@ virStorageBackendVolOpenCheckMode(const char *path, struct stat *sb, VIR_WARN("ignoring dangling symlink '%s'", path); return -2; } + if (errno == ENOENT && !(flags & VIR_STORAGE_VOL_OPEN_ERROR)) { + VIR_WARN("ignoring missing file '%s'", path); + return -2; + } virReportSystemError(errno, _("cannot open volume '%s'"), -- 1.8.3.2

3 5

[libvirt] [PATCH] Ignore char devices in storage pools by default
by Ján Tomko 20 Mar '14

20 Mar '14

Without this, using /dev/mapper as a directory pool fails in virStorageBackendUpdateVolTargetInfoFD: cannot seek to end of file '/dev/mapper/control': Illegal seek Skip over character devices by default. https://bugzilla.redhat.com/show_bug.cgi?id=710866 --- src/storage/storage_backend.h | 1 - 1 file changed, 1 deletion(-) diff --git a/src/storage/storage_backend.h b/src/storage/storage_backend.h index 5314411..f5e9440 100644 --- a/src/storage/storage_backend.h +++ b/src/storage/storage_backend.h @@ -130,7 +130,6 @@ enum { # define VIR_STORAGE_VOL_OPEN_DEFAULT (VIR_STORAGE_VOL_OPEN_ERROR |\ VIR_STORAGE_VOL_OPEN_REG |\ - VIR_STORAGE_VOL_OPEN_CHAR |\ VIR_STORAGE_VOL_OPEN_BLOCK) int virStorageBackendVolOpenCheckMode(const char *path, struct stat *sb, -- 1.8.3.2

2 2

[libvirt] [PATCH] virNetClientSetTLSSession: Restore original signal mask
by Michal Privoznik 20 Mar '14

20 Mar '14

Currently, we use pthread_sigmask(SIG_BLOCK, ...) prior to calling poll(). This is okay, as we don't want poll() to be interrupted. However, then - immediately as we fall out from the poll() - we try to restore the original sigmask - again using SIG_BLOCK. But as the man page says, SIG_BLOCK adds signals to the signal mask: SIG_BLOCK The set of blocked signals is the union of the current set and the set argument. Therefore, when restoring the original mask, we need to completely overwrite the one we set earlier and hence we should be using: SIG_SETMASK The set of blocked signals is set to the argument set. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Notes: This is a very old bug. It's worth backporting onto all maint branches we have. src/rpc/virnetclient.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/rpc/virnetclient.c b/src/rpc/virnetclient.c index b288b74..255997b 100644 --- a/src/rpc/virnetclient.c +++ b/src/rpc/virnetclient.c @@ -792,7 +792,7 @@ int virNetClientSetTLSSession(virNetClientPtr client, if (ret < 0 && (errno == EAGAIN || errno == EINTR)) goto repoll; - ignore_value(pthread_sigmask(SIG_BLOCK, &oldmask, NULL)); + ignore_value(pthread_sigmask(SIG_SETMASK, &oldmask, NULL)); } ret = virNetTLSContextCheckCertificate(tls, client->tls); @@ -816,7 +816,7 @@ int virNetClientSetTLSSession(virNetClientPtr client, if (ret < 0 && (errno == EAGAIN || errno == EINTR)) goto repoll2; - ignore_value(pthread_sigmask(SIG_BLOCK, &oldmask, NULL)); + ignore_value(pthread_sigmask(SIG_SETMASK, &oldmask, NULL)); len = virNetTLSSessionRead(client->tls, buf, 1); if (len < 0 && errno != ENOMSG) { -- 1.9.0

4 5

[libvirt] [PATCH] Fix indentation in iscsi storage backend
by Ján Tomko 20 Mar '14

20 Mar '14

--- Pushed as trivial. src/storage/storage_backend_iscsi.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/src/storage/storage_backend_iscsi.c b/src/storage/storage_backend_iscsi.c index 7e7ffad..fde2b4b 100644 --- a/src/storage/storage_backend_iscsi.c +++ b/src/storage/storage_backend_iscsi.c @@ -244,8 +244,8 @@ virStorageBackendISCSICheckPool(virConnectPtr conn ATTRIBUTE_UNUSED, *isActive = false; if (pool->def->source.nhost != 1) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("Expected exactly 1 host for the storage pool")); + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Expected exactly 1 host for the storage pool")); return -1; } @@ -317,12 +317,12 @@ virStorageBackendISCSISetAuth(const char *portal, virReportError(VIR_ERR_INTERNAL_ERROR, _("could not get the value of the secret " "for username %s using uuid '%s'"), - chap.username, uuidStr); + chap.username, uuidStr); } else { virReportError(VIR_ERR_INTERNAL_ERROR, _("could not get the value of the secret " "for username %s using usage value '%s'"), - chap.username, chap.secret.usage); + chap.username, chap.secret.usage); } goto cleanup; } @@ -371,8 +371,8 @@ virStorageBackendISCSIStartPool(virConnectPtr conn, int ret = -1; if (pool->def->source.nhost != 1) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("Expected exactly 1 host for the storage pool")); + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Expected exactly 1 host for the storage pool")); return -1; } @@ -435,7 +435,7 @@ virStorageBackendISCSIRefreshPool(virConnectPtr conn ATTRIBUTE_UNUSED, return 0; - cleanup: +cleanup: VIR_FREE(session); return -1; } -- 1.8.3.2

1 0

[libvirt] Outreach Program for Women application deadline extended
by Stefan Hajnoczi 20 Mar '14

20 Mar '14

Good news! The deadline for Outreach Program for Women applications to work on QEMU, KVM, or libvirt for 12 weeks this summer has been extended to March 31st 19:00 UTC: https://wiki.gnome.org/OutreachProgramForWomen/2014/MayAugust#Participating… Outreach Program for Women was started by GNOME specifically for women who want to start contributing to open source. It has since grown to include other organizations and we are able to take part this summer! If you would like to apply or know someone who might be interested in a 12-week, paid, open source gig from May 19 to August 18, take a look at our wiki: http://qemu-project.org/Outreach_Program_for_Women_Summer_2014 Join the #qemu-gsoc IRC channel on irc.oftc.net to chat with mentors or ask questions. Stefan

1 0

[libvirt] [PATCH v2 00/16] Fix styles of curly braces around function bodies
by Martin Kletzander 20 Mar '14

20 Mar '14

Basically a v2 of: https://www.redhat.com/archives/libvir-list/2014-March/msg00987.html with way more tuned regexp, wrapped lines, syntax-check and so on. Martin Kletzander (16): Use K&R style for curly braces in tests/ Use K&R style for curly braces in src/xen*/ Use K&R style for curly braces in src/util/ Use K&R style for curly braces in src/rpc/ Use K&R style for curly braces in src/conf/ Use K&R style for curly braces in src/qemu/ Use K&R style for curly braces in src/storage/ Use K&R style for curly braces in src/openvz/ Use K&R style for curly braces in src/nwfilter/ Use K&R style for curly braces in src/test/test_driver.c Use K&R style for curly braces in src/uml/ Use K&R style for curly braces in src/lxc/lxc_driver.c Use K&R style for curly braces in src/network/bridge_driver.c Use K&R style for curly braces in src/vbox/ Use K&R style for curly braces in remaining files Require K&R styled curly braces around function bodies cfg.mk | 7 ++ daemon/libvirtd-config.c | 9 +- docs/internals/command.html.in | 3 +- examples/dominfo/info1.c | 7 +- src/conf/domain_conf.c | 9 +- src/conf/domain_nwfilter.c | 13 ++- src/conf/interface_conf.c | 54 ++++++--- src/conf/nwfilter_conf.c | 30 +++-- src/conf/nwfilter_params.c | 3 +- src/interface/interface_backend_netcf.c | 8 +- src/interface/interface_backend_udev.c | 4 +- src/interface/interface_driver.c | 4 +- src/libxl/libxl_driver.c | 3 +- src/lxc/lxc_driver.c | 30 +++-- src/network/bridge_driver.c | 54 ++++++--- src/node_device/node_device_driver.c | 5 +- src/nwfilter/nwfilter_driver.c | 32 +++-- src/nwfilter/nwfilter_ebiptables_driver.c | 3 +- src/nwfilter/nwfilter_learnipaddr.c | 41 ++++--- src/openvz/openvz_conf.c | 15 ++- src/openvz/openvz_driver.c | 45 ++++--- src/qemu/qemu_agent.c | 5 +- src/qemu/qemu_command.c | 6 +- src/qemu/qemu_driver.c | 94 ++++++++++----- src/qemu/qemu_migration.c | 3 +- src/qemu/qemu_monitor.c | 3 +- src/qemu/qemu_monitor_json.c | 3 +- src/qemu/qemu_monitor_text.c | 20 +++- src/rpc/virnetserver.c | 8 +- src/rpc/virnetserverclient.c | 5 +- src/rpc/virnettlscontext.c | 5 +- src/secret/secret_driver.c | 8 +- src/security/security_stack.c | 8 +- src/storage/storage_backend_fs.c | 12 +- src/storage/storage_driver.c | 78 ++++++++----- src/test/test_driver.c | 135 ++++++++++++++------- src/uml/uml_conf.c | 5 +- src/uml/uml_driver.c | 78 ++++++++----- src/util/vircgroup.c | 9 +- src/util/virconf.c | 5 +- src/util/virdbus.c | 8 +- src/util/virerror.c | 3 +- src/util/vireventpoll.c | 29 +++-- src/util/virhook.c | 11 +- src/util/virnetdevvportprofile.c | 5 +- src/util/virrandom.c | 5 +- src/util/virsocketaddr.c | 26 +++-- src/util/virsysinfo.c | 15 ++- src/util/virthread.c | 5 +- src/util/virutil.c | 20 ++-- src/util/virutil.h | 12 +- src/util/viruuid.c | 5 +- src/vbox/vbox_driver.c | 5 +- src/vbox/vbox_tmpl.c | 188 ++++++++++++++++++++---------- src/xen/xen_driver.c | 6 +- src/xen/xen_hypervisor.c | 5 +- src/xen/xm_internal.c | 10 +- src/xenapi/xenapi_utils.c | 5 +- src/xenxs/xen_xm.c | 35 ++++-- tests/commandhelper.c | 5 +- tests/qemuargv2xmltest.c | 3 +- tests/shunloadhelper.c | 5 +- tests/testutils.c | 15 ++- tests/testutilslxc.c | 3 +- tests/testutilsqemu.c | 3 +- tests/testutilsxen.c | 3 +- tests/virshtest.c | 54 ++++++--- tests/virusbtest.c | 3 +- tests/xencapstest.c | 33 ++++-- 69 files changed, 929 insertions(+), 465 deletions(-) -- 1.9.0

2 33

[libvirt] Adding support to limit client connections for vnc/spice display driver
by Patil, Tushar 20 Mar '14

20 Mar '14

Hello, Greeting!!! We are using KVM hypervisor driver for running OpenStack IaaS. Couple of months back we have reported one security issue [1] in OS. Basically we want to limit on the number of vnc client connections that can be opened by users for a given VM. I know that there is share policy where you can specify "VNC_SHARE_MODE_EXCLUSIVE" share mode. But it only allows one client connection to the vnc console, it will disconnect all previously opened vnc client connections. Since vnc display driver already has the data of client connections, it would be possible to add the logic to limit on the number of client connections. What we want is the ability to specify threshold how many vnc client connections should be allowed at any given point of time in the domain xml for graphics device (especially for vnc/spice)? Example <graphics type="vnc" autoport="yes" keymap="en-us" listen="127.0.0.1"/, share-policy="limit-connections", connections="5"> Add support to accept new share policy "limit-connections'. So in the above example, when user tries to open vnc display for the 6th time, then the request should be rejected. I need your expert opinion in deciding whether it's a good idea to add this support in the vnc/spice display driver or this kind of constraint should be imposed outside libvirt? [1] : https://bugs.launchpad.net/nova/+bug/1227575 Tushar ______________________________________________________________________ Disclaimer:This email and any attachments are sent in strictest confidence for the sole use of the addressee and may contain legally privileged, confidential, and proprietary data. If you are not the intended recipient, please advise the sender by replying promptly to this email and then delete and destroy this email and any attachments without any further use, copying or forwarding

2 1

[libvirt] [PATCH] Fix unitialized data in virSocketAddrMask
by Daniel P. Berrange 20 Mar '14

20 Mar '14

The virSocketAddrMask method did not initialize all fields in the sockaddr_in6 struct. In paticular the 'sin6_scope_id' field could contain random garbage, which would in turn affect the result of any later virSocketAddrFormat calls. This led to ip6tables rules in the FORWARD chain which matched on random garbage sin6_scope_id. Fortunately these were ACCEPT rules, so the impact was merely that desired traffic was blocked, rather than undesired traffic allowed. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/util/virsocketaddr.c | 1 + tests/sockettest.c | 53 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 54 insertions(+) diff --git a/src/util/virsocketaddr.c b/src/util/virsocketaddr.c index 3f270e2..1099eae 100644 --- a/src/util/virsocketaddr.c +++ b/src/util/virsocketaddr.c @@ -424,6 +424,7 @@ virSocketAddrMask(const virSocketAddr *addr, const virSocketAddr *netmask, virSocketAddrPtr network) { + memset(network, 0, sizeof(*network)); if (addr->data.stor.ss_family != netmask->data.stor.ss_family) { network->data.stor.ss_family = AF_UNSPEC; return -1; diff --git a/tests/sockettest.c b/tests/sockettest.c index e613546..68b0536 100644 --- a/tests/sockettest.c +++ b/tests/sockettest.c @@ -153,6 +153,49 @@ static int testNetmaskHelper(const void *opaque) return testNetmask(data->addr1, data->addr2, data->netmask, data->pass); } + + +static int testMaskNetwork(const char *addrstr, + int prefix, + const char *networkstr) +{ + virSocketAddr addr; + virSocketAddr network; + char *gotnet = NULL; + + /* Intentionally fill with garbage */ + memset(&network, 1, sizeof(network)); + + if (virSocketAddrParse(&addr, addrstr, AF_UNSPEC) < 0) + return -1; + + if (virSocketAddrMaskByPrefix(&addr, prefix, &network) < 0) + return -1; + + if (!(gotnet = virSocketAddrFormat(&network))) + return -1; + + if (STRNEQ(networkstr, gotnet)) { + VIR_FREE(gotnet); + fprintf(stderr, "Expected %s, got %s\n", networkstr, gotnet); + return -1; + } + VIR_FREE(gotnet); + return 0; +} + +struct testMaskNetworkData { + const char *addr1; + int prefix; + const char *network; +}; +static int testMaskNetworkHelper(const void *opaque) +{ + const struct testMaskNetworkData *data = opaque; + return testMaskNetwork(data->addr1, data->prefix, data->network); +} + + static int testWildcard(const char *addrstr, bool pass) { @@ -255,6 +298,14 @@ mymain(void) ret = -1; \ } while (0) +#define DO_TEST_MASK_NETWORK(addr1, prefix, network) \ + do { \ + struct testMaskNetworkData data = { addr1, prefix, network }; \ + if (virtTestRun("Test mask network " addr1 " / " #prefix " == " network, \ + testMaskNetworkHelper, &data) < 0) \ + ret = -1; \ + } while (0) + #define DO_TEST_WILDCARD(addr, pass) \ do { \ struct testWildcardData data = { addr, pass}; \ @@ -324,6 +375,8 @@ mymain(void) DO_TEST_NETMASK("2000::1:1", "9000::1:1", "ffff:ffff:ffff:ffff:ffff:ffff:ffff:0", false); + DO_TEST_MASK_NETWORK("2001:db8:ca2:2::1", 64, "2001:db8:ca2:2::"); + DO_TEST_WILDCARD("0.0.0.0", true); DO_TEST_WILDCARD("::", true); DO_TEST_WILDCARD("0", true); -- 1.8.5.3

2 1

[libvirt] [PATCH] Fix virQEMUCapsLoadCache leaks
by Ján Tomko 20 Mar '14

20 Mar '14

Valgrind reported leaking of maxCpus and arch strings from virXPathString, as well as the leak of the machineMaxCpus array. Use 'tmp' for the strings we don't want to free, to allow freeing of 'str' in the cleanup label and free machineMaxCpus in virCapsReset too. --- src/qemu/qemu_capabilities.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 2914200..e742c03 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -2376,7 +2376,8 @@ virQEMUCapsLoadCache(virQEMUCapsPtr qemuCaps, const char *filename, int n; xmlNodePtr *nodes = NULL; xmlXPathContextPtr ctxt = NULL; - char *str; + char *str = NULL; + char *tmp; long long int l; if (!(doc = virXMLParseFile(filename))) @@ -2432,7 +2433,6 @@ virQEMUCapsLoadCache(virQEMUCapsPtr qemuCaps, const char *filename, if (flag < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, _("Unknown qemu capabilities flag %s"), str); - VIR_FREE(str); goto cleanup; } VIR_FREE(str); @@ -2463,6 +2463,7 @@ virQEMUCapsLoadCache(virQEMUCapsPtr qemuCaps, const char *filename, _("unknown arch %s in QEMU capabilities cache"), str); goto cleanup; } + VIR_FREE(str); if ((n = virXPathNodeSet("./cpu", ctxt, &nodes)) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -2476,12 +2477,12 @@ virQEMUCapsLoadCache(virQEMUCapsPtr qemuCaps, const char *filename, goto cleanup; for (i = 0; i < n; i++) { - if (!(str = virXMLPropString(nodes[i], "name"))) { + if (!(tmp = virXMLPropString(nodes[i], "name"))) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("missing cpu name in QEMU capabilities cache")); goto cleanup; } - qemuCaps->cpuDefinitions[i] = str; + qemuCaps->cpuDefinitions[i] = tmp; } } VIR_FREE(nodes); @@ -2503,12 +2504,12 @@ virQEMUCapsLoadCache(virQEMUCapsPtr qemuCaps, const char *filename, goto cleanup; for (i = 0; i < n; i++) { - if (!(str = virXMLPropString(nodes[i], "name"))) { + if (!(tmp = virXMLPropString(nodes[i], "name"))) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("missing machine name in QEMU capabilities cache")); goto cleanup; } - qemuCaps->machineTypes[i] = str; + qemuCaps->machineTypes[i] = tmp; qemuCaps->machineAliases[i] = virXMLPropString(nodes[i], "alias"); @@ -2519,12 +2520,14 @@ virQEMUCapsLoadCache(virQEMUCapsPtr qemuCaps, const char *filename, _("malformed machine cpu count in QEMU capabilities cache")); goto cleanup; } + VIR_FREE(str); } } VIR_FREE(nodes); ret = 0; - cleanup: +cleanup: + VIR_FREE(str); VIR_FREE(nodes); xmlXPathFreeContext(ctxt); xmlFreeDoc(doc); @@ -2668,6 +2671,7 @@ virQEMUCapsReset(virQEMUCapsPtr qemuCaps) } VIR_FREE(qemuCaps->machineTypes); VIR_FREE(qemuCaps->machineAliases); + VIR_FREE(qemuCaps->machineMaxCpus); qemuCaps->nmachineTypes = 0; } -- 1.8.3.2

2 2

[libvirt] [PATCH v2] daemon: Enhance documentation for changing NOFILE limit
by Jiri Denemark 20 Mar '14

20 Mar '14

Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- daemon/libvirtd.sysconf | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/daemon/libvirtd.sysconf b/daemon/libvirtd.sysconf index 3af1f03..8bdddd3 100644 --- a/daemon/libvirtd.sysconf +++ b/daemon/libvirtd.sysconf @@ -20,5 +20,13 @@ # #SDL_AUDIODRIVER=pulse -# Override the maximum number of opened files +# Override the maximum number of opened files. +# This only works with traditional init scripts. In systemd world, the limit +# can only be changed by overriding LimitNOFILE for libvirtd.service. To do +# that, just create a *.conf file in /etc/systemd/system/libvirtd.service.d/ +# (for example /etc/systemd/system/libvirtd.service.d/openfiles.conf) and +# write the following two lines in it: +# [Service] +# LimitNOFILE=2048 +# #LIBVIRTD_NOFILES_LIMIT=2048 -- 1.9.0

2 2

[libvirt] [PATCH V2 00/13] libxl: add basic support for migration
by Jim Fehlig 20 Mar '14

20 Mar '14

V2 of https://www.redhat.com/archives/libvir-list/2014-March/msg00156.html New in this version: not much. I rebased on the hostdev passthrough changes and added a few 'begin phase' checks to fail early if the domain is not migratable. See 13/13 for details. Based on an earlier patch from Chunyan Liu https://www.redhat.com/archives/libvir-list/2013-September/msg00667.html This patch series adds basic migration support to the libxl driver. Follow-up patches can improve pre-migration checks and add support for additional migration flags. Patches 1-12 are almost exclusively code motion, moving functions from the main driver module into the libxl_domain and libxl_conf modules. Patch 13 contains the actual migration impl. Jim Fehlig (13): libxl: move libxlDomainEventQueue to libxl_domain libxl: move libxlDomainManagedSavePath to libxl_domain libxl: move libxlSaveImageOpen to libxl_domain libxl: move libxlVmCleanup{,Job} to libxl_domain libxl: move libxlDomEventsRegister to libxl_domain libxl: move libxlDomainAutoCoreDump to libxl_domain libxl: move libxlDoNodeGetInfo to libxl_conf libxl: move libxlDomainSetVcpuAffinities to libxl_domain libxl: move libxlFreeMem to libxl_domain libxl: move libxlVmStart to libxl_domain libxl: include a pointer to the driver in libxlDomainObjPrivate libxl: move domain event handler to libxl_domain libxl: add migration support po/POTFILES.in | 1 + src/Makefile.am | 3 +- src/libxl/libxl_conf.c | 36 ++ src/libxl/libxl_conf.h | 10 + src/libxl/libxl_domain.c | 705 +++++++++++++++++++++++++++++++ src/libxl/libxl_domain.h | 51 ++- src/libxl/libxl_driver.c | 988 +++++++++++--------------------------------- src/libxl/libxl_migration.c | 598 +++++++++++++++++++++++++++ src/libxl/libxl_migration.h | 78 ++++ 9 files changed, 1716 insertions(+), 754 deletions(-) create mode 100644 src/libxl/libxl_migration.c create mode 100644 src/libxl/libxl_migration.h -- 1.8.1.4

2 19

[libvirt] [Question] Start VMs coincidently failed
by Wangyufei (James) 20 Mar '14

20 Mar '14

Hello, When I start multi VMs coincidently and any of the cgroup directories named machine doesn't exist. There's a chance that VM start failed. And the errors reported are: 1. Unable to initialize /machine cgroup: File exists 2. Unable to create cgroup for sit_vm_16: No such file or directory So I analyze it and find that: If thread A and thread B start VMs at the same time, there's a chance that, thread A creat directory failed and thread B succeed. Then thread A will clean up machine directory, and thread B will do something in the machine directory cleaned up by thread A. At last thread B failed too because it can't find the directory. Thread A reports error 1 and thread B reports error 2. Well, the true reason is that the judgement of dirctory existence and the operation of creating directory is not atomic. At first, I want to find a lock to fix it, but failed. Then I apply a patch to get the EEXIST through to fix it. Guys, any better idea? My best regards WangYufei

1 0

[libvirt] Why using AC_PATH_PROG to detect the location of run-time external programs
by Howard Tsai 19 Mar '14

19 Mar '14

Hello, I am wondering why AC_PATH_PROG is used to detect the location of run-time external programs (such as dnsmasq, ovs-vsctl, etc.), and hardcoded the locations in binary. It seems wrong to me. At compile-time, configure script should only determine whether the resulting binary should support the use of these external programs. The actual location of these programs should be determined at run-time, either from libvirtd.conf or by $PATH. I haven't looked into how to fix it. The problem I ran into earlier is this: on my dev box, I have Open vSwitch utility ovs-vsctl installed locally in /usr/local/bin. Therefore, at build-time, libvirt detected the location of ovs-vsctl and hardcoded '/usr/local/bin/ovs-vsctl' in libvirtd. When I package libvirt and install it on my test box, it couldn't find ovs-vsctl, as ovs-vsctl is installed at /usr/bin/ovs-vsctl in the test box, so it failed. Thanks, Howard

2 1

[libvirt] [PATCH] qemu: Fix seamless SPICE migration
by Martin Kletzander 19 Mar '14

19 Mar '14

Since the wait is done during migration (still inside QEMU_ASYNC_JOB_MIGRATION_OUT), the code should enter the monitor as such in order to prohibit all other jobs from interfering in the meantime. This patch fixes bug #1009886 in which qemuDomainGetBlockInfo was waiting on the monitor condition and after GetSpiceMigrationStatus mangled its internal data, the daemon crashed. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1009886 Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- src/qemu/qemu_migration.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index d7b89fc..3a1aab7 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -1595,7 +1595,10 @@ qemuMigrationWaitForSpice(virQEMUDriverPtr driver, /* Poll every 50ms for progress & to allow cancellation */ struct timespec ts = { .tv_sec = 0, .tv_nsec = 50 * 1000 * 1000ull }; - qemuDomainObjEnterMonitor(driver, vm); + if (qemuDomainObjEnterMonitorAsync(driver, vm, + QEMU_ASYNC_JOB_MIGRATION_OUT) < 0) + return -1; + if (qemuMonitorGetSpiceMigrationStatus(priv->mon, &spice_migrated) < 0) { qemuDomainObjExitMonitor(driver, vm); -- 1.8.3.2

3 3

[libvirt] Zombie process after open libvirt connection
by Carlos Rodrigues 19 Mar '14

19 Mar '14

Hello, I have the following Perl test script and when open libvirt connection with qemu+tls i get zombie process. Let me show the output of script for different versions: * connection with qemu+libssh2 or test:/// $ perl test-chldhandle-bug.pl init... pid=15305 while... fork 1 end... pid=15307 receive chld fork 2 end... pid=15308 receive chld connection open fork 3 end... pid=15350 receive chld fork 4 receive chld go next... * connection with qemu+tls $ perl test-chldhandle-bug.pl init... pid=13723 while... fork 1 end... pid=13725 receive chld fork 2 end... pid=13726 receive chld 2014-03-13 18:15:56.639+0000: 13723: info : libvirt version: 1.0.5.7, package: 2.fc19 (Fedora Project, 2013-11-17-23:21:57, buildvm-18.phx2.fedoraproject.org) 2014-03-13 18:15:56.639+0000: 13723: warning : virNetTLSContextCheckCertificate:1099 : Certificate check failed Certificate [session] owner does not match the hostname 10.10.4.249 connection open fork 3 end... pid=13773 fork 4 end... pid=13800 go next... Does anyone know how can i solve this issue? Regards, -- Carlos Rodrigues Engenheiro de Software Sénior Eurotux Informática, S.A. | www.eurotux.com (t) +351 253 680 300 (m) +351 911 926 110

2 8