- Devel - libvirt List Archives

[libvirt] [PATCH 0/6] Fix regression with relative backing names in storage pools
by Peter Krempa 16 Jul '14

16 Jul '14

Our recent refactors broke relative backing names in storage pools, fix it partially. Peter Krempa (6): storage: backend: Fix formatting of function arguments storage: Track backing store of a volume in the target struct storage: backend: fs: Touch up coding style storage: fs: Process backing store data in virStorageBackendProbeTarget storage: fs: Properly parse backing store info storage: fs: Don't fail volume update if backing store isn't accessible src/conf/storage_conf.c | 53 +++++++++-------- src/conf/storage_conf.h | 1 - src/storage/storage_backend.c | 40 ++++++------- src/storage/storage_backend_fs.c | 103 ++++++++++++++++++---------------- src/storage/storage_backend_gluster.c | 20 +++++-- src/storage/storage_backend_logical.c | 11 ++-- 6 files changed, 129 insertions(+), 99 deletions(-) -- 2.0.0

2 13

[libvirt] [PATCH 0/4] fix virReportSystemError misuse
by Jincheng Miao 16 Jul '14

16 Jul '14

virReportSystemError() reports some OS errors, and the first argument of it should be the error number defined in errno.h. virReportError() reports libvirt errors, and the first argument should be the error number defined in virerrno.h. This patch set fix some misuse of virReportSystemError: passing virerrno instead of errno. Jincheng Miao (4): qemu: fix wrong errno report in qemuMonitorOpenUnix lxc: print ENOTSUP when usernamespace is not supported openvz: print EOVERFLOW when barrier:limit are too long util: print errno in virObjectLockableNew src/lxc/lxc_container.c | 2 +- src/openvz/openvz_conf.c | 2 +- src/qemu/qemu_monitor.c | 7 +++++-- src/util/virobject.c | 2 +- 4 files changed, 8 insertions(+), 5 deletions(-) -- 1.8.3.1

3 12

[libvirt] [PATCH] spec: Update polkit dependencies for CVE-2013-4311
by Jiri Denemark 16 Jul '14

16 Jul '14

Use secured polkit on distros which provide it. However, RHEL-6 will still allow for older polkit-0.93 rather than forcing polkit-0.96-5 which is not available in all RHEL-6 releases. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- libvirt.spec.in | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 8d1acfa..f32ab00 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -535,7 +535,9 @@ BuildRequires: module-init-tools BuildRequires: cyrus-sasl-devel %endif %if %{with_polkit} - %if 0%{?fedora} >= 12 || 0%{?rhel} >= 6 + %if 0%{?fedora} >= 21 || 0%{?rhel} >= 7 +BuildRequires: polkit-devel >= 0.112 + %elif 0%{?fedora} >= 12 || 0%{?rhel} >= 6 BuildRequires: polkit-devel >= 0.93 %else BuildRequires: PolicyKit-devel >= 0.6 @@ -698,7 +700,9 @@ Requires: avahi-libs %endif %endif %if %{with_polkit} - %if 0%{?fedora} >= 12 || 0%{?rhel} >=6 + %if 0%{?fedora} >= 21 || 0%{?rhel} >= 7 +Requires: polkit >= 0.112 + %elif 0%{?fedora} >= 12 || 0%{?rhel} >=6 Requires: polkit >= 0.93 %else Requires: PolicyKit >= 0.6 -- 2.0.0

2 4

[libvirt] [PATCH] spec: fix invalid syntax
by Eric Blake 15 Jul '14

15 Jul '14

Commit 20e01504 broke 'make rpm': error: line 540: Unknown tag: %elif 020 >= 12 || 0 >= 6 Apparently, even though shell has elif so that you can do a chain of conditionals, the rpm spec file does not, and you have to nest things instead. * libvirt.spec.in: Convert %elif to proper nested %if. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule. libvirt.spec.in | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 47bfec5..9c7b241 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -537,10 +537,12 @@ BuildRequires: cyrus-sasl-devel %if %{with_polkit} %if 0%{?fedora} >= 20 || 0%{?rhel} >= 7 BuildRequires: polkit-devel >= 0.112 - %elif 0%{?fedora} >= 12 || 0%{?rhel} >= 6 -BuildRequires: polkit-devel >= 0.93 %else + %if 0%{?fedora} >= 12 || 0%{?rhel} >= 6 +BuildRequires: polkit-devel >= 0.93 + %else BuildRequires: PolicyKit-devel >= 0.6 + %endif %endif %endif %if %{with_storage_fs} @@ -702,10 +704,12 @@ Requires: avahi-libs %if %{with_polkit} %if 0%{?fedora} >= 20 || 0%{?rhel} >= 7 Requires: polkit >= 0.112 - %elif 0%{?fedora} >= 12 || 0%{?rhel} >=6 -Requires: polkit >= 0.93 %else + %if 0%{?fedora} >= 12 || 0%{?rhel} >=6 +Requires: polkit >= 0.93 + %else Requires: PolicyKit >= 0.6 + %endif %endif %endif %if %{with_cgconfig} -- 1.9.3

1 0

Re: [libvirt] Enable kvm on aarch64, Cleanup F-16/18 conditionals
by Eric Blake 15 Jul '14

15 Jul '14

On 07/15/2014 04:00 PM, Peter Robinson wrote: [reformatting to avoid top-posting] > On Tue, Jul 15, 2014 at 6:52 PM, Daniel P. Berrange <berrange(a)redhat.com> wrote: >> Historically we've kept support for building libvirt against >> Fedora versions even if unsupported by Fedora itself, because >> we've found people often stick on old Fedora versions. At some >> point though it does get a bit insane. eg we don't really need >> Fedora 8 support at this point. If we are going todo a cleanup >> though, we should do it throughout the spec, not just in these >> few places > Sorry, I missed the Fedora 8 stuff. Would it even work on Fedora 8 > with all the various other changes? Not sure it's worth the effort for > the few people that want that release as a hypervisor, I can > understand for the supported elX releases but not sure the Fedora > releases that are systemd based give value to elX releases and are > generally relatively ancient history. Dan do you really have know > users of the latest release running it on F-8? > > In terms of pushing upstream Cole has said he's happy to push the > commits to ensure it fits your work flows. Doing an out-of-the-box build on RHEL 5 is the oldest configuration still actively (if marginally) supported, ideally for as long as RHEL 5 remains a live platform (several more years to go). We have build-bots that ensure that we can build on RHEL 5, although I'm not sure if those buildbots are exercising 'make rpm' to test the older parts of the spec file. Historically, RHEL 5.10 is based off of libvirt-0.8.2, and that was the release in use during Fedora 13. So it's _definitely_ worth culling any conditionals older than F13; but stuff between F13 and F18 might be shared with RHEL 5, and therefore more effort to cull the Fedora side while still leaving the RHEL side intact. I could go either way if we were to set some sort of policy (maybe: any fedora release that is unsupported for more than a year is no longer required to be supported in the spec file), and use that to justify cleanups of older parts of the spec file as long as it doesn't break RHEL 5. F16 is definitely more than a year out-of-date, F18 is a bit more borderline on whether we are ready to call it unsupported. Anyone else on the libvirt list have an opinion on how far back we can clean without annoying people that are slow on the upgrade to modern Fedora? -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

1 0

[libvirt] [PATCH 0/4] Resolve const correctness isues
by Michal Privoznik 15 Jul '14

15 Jul '14

Okay, okay. The approach in 4/4 can be considered hackish, but hey - it works! Michal Privoznik (4): Fix const correctness viralloc: Honor const correctness in VIR_FREE VIR_FREE: Avoid doing side work in callees virFree: Check const correctness src/conf/network_conf.c | 12 ++++++++---- src/locking/lock_driver_lockd.c | 2 +- src/qemu/qemu_capabilities.c | 2 +- src/remote/remote_driver.c | 2 +- src/util/viralloc.c | 6 ++++-- src/util/viralloc.h | 33 ++++++++++++++++----------------- src/xenapi/xenapi_utils.c | 3 ++- tools/virsh-domain.c | 4 ++-- tools/wireshark/src/packet-libvirt.c | 6 +++--- tools/wireshark/src/packet-libvirt.h | 4 ++-- 10 files changed, 40 insertions(+), 34 deletions(-) -- 1.8.5.5

5 15

[libvirt] [PATCH 0/2] Implement interface stats for BSD
by Roman Bogorodskiy 15 Jul '14

15 Jul '14

This series implements support for querying network interface stats on (Free)BSD. It's more of an RFC, because I'm uncertain about few things: - It feels a little strange to have a source file that implements only a single function like this. I am wondering if it would be better to just move it to something like util/virnetdev.c? - FreeBSD stores interface data in the if_data struct and a number of outgoing packet drops is stored in a field 'ifi_oqdrops'. This field was added in -CURRENT and later merged back to 10-STABLE. In order not to break the ABI, it's available only if _IFI_OQDROPS is defined. I've added a configure.ac check which adds -D_IFI_OQDROPS before checking this field and resetting it back if it is not present. This way, this flag will present when the field is available even if the flag is not needed (e.g. on -CURRENT). Is there a better way of doing it? I was thinking about trying to check this field without the flag and if it fails check one more time with the flag, but it looks a little messy. - Did I get it right that the stats reported are from the guest POV, e.g. when downloading a large file from guest, it should look like: vnet0 rx_bytes 731603341 vnet0 rx_packets 518354 vnet0 rx_errs 0 vnet0 rx_drop 0 vnet0 tx_bytes 17577834 vnet0 tx_packets 264226 vnet0 tx_errs 0 vnet0 tx_drop 0 Roman Bogorodskiy (2): util: virstatslinux: make more generic Implement interface stats for BSD configure.ac | 13 ++++- po/POTFILES.in | 2 +- src/Makefile.am | 2 +- src/libvirt_linux.syms | 3 -- src/libvirt_private.syms | 2 + src/lxc/lxc_driver.c | 2 +- src/openvz/openvz_driver.c | 2 +- src/qemu/qemu_driver.c | 16 +----- src/uml/uml_driver.c | 2 +- src/util/{virstatslinux.c => virstats.c} | 93 +++++++++++++++++++++++++------- src/util/{virstatslinux.h => virstats.h} | 12 ++--- src/xen/xen_hypervisor.c | 2 +- tests/statstest.c | 2 +- 13 files changed, 102 insertions(+), 51 deletions(-) rename src/util/{virstatslinux.c => virstats.c} (61%) rename src/util/{virstatslinux.h => virstats.h} (77%) -- 1.9.0

2 4

Re: [libvirt] Enable kvm on aarch64, Cleanup F-16/18 conditionals
by Eric Blake 15 Jul '14

15 Jul '14

reposting to the upstream list - we'd like to keep the downstream .spec file in sync with upstream, rather than needlessly diverging. On 07/15/2014 10:52 AM, Peter Robinson wrote: > commit ae37ed3500672f12383825c84dd5ae940fb90ff8 > Author: Peter Robinson <pbrobinson(a)gmail.com> > Date: Tue Jul 15 17:52:18 2014 +0100 > > Enable kvm on aarch64, Cleanup F-16/18 conditionals > > libvirt.spec | 28 ++++++++-------------------- > 1 files changed, 8 insertions(+), 20 deletions(-) > --- > diff --git a/libvirt.spec b/libvirt.spec > index fad21d9..213760d 100644 > --- a/libvirt.spec > +++ b/libvirt.spec > @@ -55,14 +55,10 @@ > > %define with_qemu_tcg %{with_qemu} > # Change if we ever provide qemu-kvm binaries on non-x86 hosts > -%if 0%{?fedora} >= 18 > - %if 0%{?fedora} >= 20 > - %define qemu_kvm_arches %{ix86} x86_64 ppc64 s390x %{arm} > - %else > - %define qemu_kvm_arches %{ix86} x86_64 ppc64 s390x > - %endif > +%if 0%{?fedora} >= 20 > + %define qemu_kvm_arches %{ix86} x86_64 %{power64} s390x %{arm} aarch64 > %else > - %define qemu_kvm_arches %{ix86} x86_64 > + %define qemu_kvm_arches %{ix86} x86_64 %{power64} s390x > %endif > > %ifarch %{qemu_kvm_arches} > @@ -212,18 +208,6 @@ > %define with_xen 0 > %endif > > -# Fedora doesn't have any QEMU on ppc64 until FC16 - only ppc > -%if 0%{?fedora} && 0%{?fedora} < 16 > - %ifarch ppc64 > - %define with_qemu 0 > - %endif > -%endif > - > -# Fedora doesn't have new enough Xen for libxl until F18 > -%if 0%{?fedora} && 0%{?fedora} < 18 > - %define with_libxl 0 > -%endif > - > # PolicyKit was introduced in Fedora 8 / RHEL-6 or newer > %if 0%{?fedora} >= 8 || 0%{?rhel} >= 6 > %define with_polkit 0%{!?_without_polkit:1} > @@ -385,7 +369,7 @@ > Summary: Library providing a simple virtualization API > Name: libvirt > Version: 1.2.6 > -Release: 1%{?dist}%{?extra_release} > +Release: 2%{?dist}%{?extra_release} > License: LGPLv2+ > Group: Development/Libraries > BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root > @@ -2236,6 +2220,10 @@ exit 0 > %doc examples/systemtap > > %changelog > +* Tue Jul 15 2014 Peter Robinson <pbrobinson(a)fedoraproject.org> 1.2.6-2 > +- Enable kvm on aarch64 > +- Cleanup F-16/18 conditionals > + > * Wed Jul 2 2014 Daniel P. Berrange <berrange(a)redhat.com> - 1.2.6-1 > - Update to 1.2.6 release > > -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

2 1

[libvirt] [PATCH 0/3] libxl: support hotplug of <interface> device
by Chunyan Liu 15 Jul '14

15 Jul '14

This patch series is to add support for attach/detaching an <interface> device. At the same time, add two fixes (1/3 and 3/3) Chunyan Liu (3): libxl: add HOSTDEV type in libxlDomainDetachDeviceConfig libxl: support hotplug of <interface> libxl: fix return value error Attach|DetachDeviceFlags .gnulib | 2 +- src/libxl/libxl_domain.c | 12 ++- src/libxl/libxl_driver.c | 193 +++++++++++++++++++++++++++++++++++++++++------ 3 files changed, 180 insertions(+), 27 deletions(-) -- 1.8.4.5

2 4

[libvirt] [PATCH v2 00/16] Support for per-guest-node binding
by Martin Kletzander 15 Jul '14

15 Jul '14

Currently we are only able to bind the whole domain to some host nodes using the /domain/numatune/memory element. Numerous requests were made to support host<->guest numa node bindings, so this series tries to implement that using /domain/numatune/memnode elements. That is incompatible with automatic numa placement (numad) since that makes no sense. Some of these patches were ACK'd in the previous round, but this version completely rewrites the parsing and formatting of the numatune XML element and places it into a separate file. Hence the repost of all the patches even with those ACK'd ones. Patches 1-3 move some code around, patch 4 adds cell id specification into the XML (which is used later on). Then patches 5-7 rework the numatune handling, which clears out some odd things, but mostly cleans the parsing code. Patch 8 adds the support for memnode elements in the XML conf code and together with patch 9 enables the use of it outside numatune_conf.c. After that, I needed to probe qemu for 2 capabilities; for one of them patch 10 adds the possibility to probe for it, then two following patches 11 and 12 add the probing data. One of the capabilities tells us that we can use disjoint ranges (not necessarily for the cpus= param) with qemu, so patch 13 makes a use of it. Finally patch 14 uses the memnode data to tell qemu which host nodes should be used for the allocations of memory blocks. Patch 15 does almost nothing, but the next patch looks better with it. And the last patch, number 16, fixes a bug with KVM and cgroups. One last note, APIs for handling the memnode settings will be added later. I'm sending this to prepare the ground for Michal's work with hugepages. Martin Kletzander (16): qemu: purely a code movement qemu: remove useless error check conf: purely a code movement conf, schema: add 'id' field for cells numatune: create new module for numatune numatune: unify numatune struct and enum names numatune: Encapsulate numatune configuration in order to unify results conf, schema: add support for memnode elements numatune: add support for per-node memory bindings in private APIs qemu: allow qmp probing for cmdline options without params qemu: memory-backend-ram capability probing qemu: newer -numa parameter capability probing qemu: enable disjoint numa cpu ranges qemu: pass numa node binding preferences to qemu qemu: split out cpuset.mems setting qemu: leave restricting cpuset.mems after initialization docs/formatdomain.html.in | 26 +- docs/schemas/domaincommon.rng | 22 + po/POTFILES.in | 1 + src/Makefile.am | 3 +- src/conf/cpu_conf.c | 39 +- src/conf/cpu_conf.h | 3 +- src/conf/domain_conf.c | 203 ++----- src/conf/domain_conf.h | 10 +- src/conf/numatune_conf.c | 589 +++++++++++++++++++++ src/conf/numatune_conf.h | 108 ++++ src/libvirt_private.syms | 24 +- src/lxc/lxc_cgroup.c | 20 +- src/lxc/lxc_controller.c | 5 +- src/lxc/lxc_native.c | 15 +- src/parallels/parallels_driver.c | 7 +- src/qemu/qemu_capabilities.c | 16 +- src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_cgroup.c | 52 +- src/qemu/qemu_cgroup.h | 4 +- src/qemu/qemu_command.c | 98 +++- src/qemu/qemu_driver.c | 84 ++- src/qemu/qemu_monitor.c | 6 +- src/qemu/qemu_monitor.h | 3 +- src/qemu/qemu_monitor_json.c | 8 +- src/qemu/qemu_monitor_json.h | 3 +- src/qemu/qemu_process.c | 12 +- src/util/virnuma.c | 61 +-- src/util/virnuma.h | 28 +- tests/qemucapabilitiesdata/caps_1.6.50-1.caps | 1 + tests/qemucapabilitiesdata/caps_1.6.50-1.replies | 5 + tests/qemumonitorjsontest.c | 20 +- .../qemuxml2argv-cpu-numa-disjoint.args | 6 + .../qemuxml2argv-cpu-numa-disjoint.xml | 28 + tests/qemuxml2argvdata/qemuxml2argv-cpu-numa1.xml | 6 +- tests/qemuxml2argvdata/qemuxml2argv-cpu-numa2.xml | 6 +- tests/qemuxml2argvdata/qemuxml2argv-cpu-numa3.xml | 25 + .../qemuxml2argv-numatune-auto-prefer.xml | 29 + .../qemuxml2argv-numatune-memnode-no-memory.args | 8 + .../qemuxml2argv-numatune-memnode-no-memory.xml | 30 ++ .../qemuxml2argv-numatune-memnode-nocpu.xml | 25 + .../qemuxml2argv-numatune-memnode.args | 11 + .../qemuxml2argv-numatune-memnode.xml | 33 ++ .../qemuxml2argv-numatune-memnodes-problematic.xml | 31 ++ tests/qemuxml2argvtest.c | 12 + .../qemuxml2xmlout-cpu-numa1.xml | 28 + .../qemuxml2xmlout-cpu-numa2.xml | 28 + .../qemuxml2xmlout-numatune-auto-prefer.xml | 29 + .../qemuxml2xmlout-numatune-memnode.xml | 33 ++ tests/qemuxml2xmltest.c | 8 + 49 files changed, 1467 insertions(+), 387 deletions(-) create mode 100644 src/conf/numatune_conf.c create mode 100644 src/conf/numatune_conf.h create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-numa-disjoint.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-numa-disjoint.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-numa3.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-numatune-auto-prefer.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-numatune-memnode-no-memory.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-numatune-memnode-no-memory.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-numatune-memnode-nocpu.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-numatune-memnode.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-numatune-memnode.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-numatune-memnodes-problematic.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-cpu-numa1.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-cpu-numa2.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-numatune-auto-prefer.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-numatune-memnode.xml -- 2.0.0

3 31

[libvirt] [PATCH 0/2] Tri-state bool enum cleanups
by Ján Tomko 15 Jul '14

15 Jul '14

We have been using a few different enum types with the same values: DEFAULT ENABLED = "on" / "yes" DISABLED = "off" / "no" Replace these with just two enums with rather unimaginative names: virDomainYesNo and virDomainOnOff Ján Tomko (2): Introduce virDomainYesNo enum type Introduce virDomainOnOff enum src/conf/domain_conf.c | 194 +++++++++++++++++------------------------------ src/conf/domain_conf.h | 127 +++++-------------------------- src/libvirt_private.syms | 26 +------ src/libxl/libxl_conf.c | 6 +- src/lxc/lxc_container.c | 4 +- src/lxc/lxc_native.c | 2 +- src/qemu/qemu_command.c | 80 +++++++++---------- src/qemu/qemu_driver.c | 4 +- src/qemu/qemu_process.c | 2 +- src/vbox/vbox_tmpl.c | 22 +++--- src/xenxs/xen_sxpr.c | 20 ++--- src/xenxs/xen_xm.c | 20 ++--- 12 files changed, 174 insertions(+), 333 deletions(-) -- 1.8.5.5

3 9

[libvirt] [PATCHv3] Rework lxc apparmor profile
by Cédric Bosdonnat 15 Jul '14

15 Jul '14

Rework the apparmor lxc profile abstraction to mimic ubuntu's container-default. This profile allows quite a lot, but strives to restrict access to dangerous resources. Removing the explicit authorizations to bash, systemd and cron files, forces them to keep the lxc profile for all applications inside the container. PUx permissions where leading to running systemd (and others tasks) unconfined. Put the generic files, network and capabilities restrictions directly in the TEMPLATE.lxc: this way, users can restrict them on a per container basis. --- Diff to v2: * Fixed missing goto cleanup examples/apparmor/Makefile.am | 6 +- examples/apparmor/TEMPLATE.lxc | 15 ++++ examples/apparmor/{TEMPLATE => TEMPLATE.qemu} | 2 +- examples/apparmor/libvirt-lxc | 119 +++++++++++++++++++++++--- src/security/security_apparmor.c | 21 +++-- src/security/virt-aa-helper.c | 29 +------ 6 files changed, 149 insertions(+), 43 deletions(-) create mode 100644 examples/apparmor/TEMPLATE.lxc rename examples/apparmor/{TEMPLATE => TEMPLATE.qemu} (75%) diff --git a/examples/apparmor/Makefile.am b/examples/apparmor/Makefile.am index a741e94..7a20e16 100644 --- a/examples/apparmor/Makefile.am +++ b/examples/apparmor/Makefile.am @@ -15,7 +15,8 @@ ## <http://www.gnu.org/licenses/>. EXTRA_DIST= \ - TEMPLATE \ + TEMPLATE.qemu \ + TEMPLATE.lxc \ libvirt-qemu \ libvirt-lxc \ usr.lib.libvirt.virt-aa-helper \ @@ -36,6 +37,7 @@ abstractions_DATA = \ templatesdir = $(apparmordir)/libvirt templates_DATA = \ - TEMPLATE \ + TEMPLATE.qemu \ + TEMPLATE.lxc \ $(NULL) endif WITH_APPARMOR_PROFILES diff --git a/examples/apparmor/TEMPLATE.lxc b/examples/apparmor/TEMPLATE.lxc new file mode 100644 index 0000000..7b64885 --- /dev/null +++ b/examples/apparmor/TEMPLATE.lxc @@ -0,0 +1,15 @@ +# +# This profile is for the domain whose UUID matches this file. +# + +#include <tunables/global> + +profile LIBVIRT_TEMPLATE { + #include <abstractions/libvirt-lxc> + + # Globally allows everything to run under this profile + # These can be narrowed depending on the container's use. + file, + capability, + network, +} diff --git a/examples/apparmor/TEMPLATE b/examples/apparmor/TEMPLATE.qemu similarity index 75% rename from examples/apparmor/TEMPLATE rename to examples/apparmor/TEMPLATE.qemu index 187dec5..008a221 100644 --- a/examples/apparmor/TEMPLATE +++ b/examples/apparmor/TEMPLATE.qemu @@ -5,5 +5,5 @@ #include <tunables/global> profile LIBVIRT_TEMPLATE { - #include <abstractions/libvirt-driver> + #include <abstractions/libvirt-qemu> } diff --git a/examples/apparmor/libvirt-lxc b/examples/apparmor/libvirt-lxc index d404328..4bfb503 100644 --- a/examples/apparmor/libvirt-lxc +++ b/examples/apparmor/libvirt-lxc @@ -2,16 +2,115 @@ #include <abstractions/base> - # Needed for lxc-enter-namespace - capability sys_admin, - capability sys_chroot, + umount, - # Added for lxc-enter-namespace --cmd /bin/bash - /bin/bash PUx, + # ignore DENIED message on / remount + deny mount options=(ro, remount) -> /, - /usr/sbin/cron PUx, - /usr/lib/systemd/systemd PUx, + # allow tmpfs mounts everywhere + mount fstype=tmpfs, - /usr/lib/libsystemd-*.so.* mr, - /usr/lib/libudev-*.so.* mr, - /etc/ld.so.cache mr, + # allow mqueue mounts everywhere + mount fstype=mqueue, + + # allow fuse mounts everywhere + mount fstype=fuse.*, + + # deny writes in /proc/sys/fs but allow binfmt_misc to be mounted + mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/, + deny @{PROC}/sys/fs/** wklx, + + # allow efivars to be mounted, writing to it will be blocked though + mount fstype=efivarfs -> /sys/firmware/efi/efivars/, + + # block some other dangerous paths + deny @{PROC}/sysrq-trigger rwklx, + deny @{PROC}/mem rwklx, + deny @{PROC}/kmem rwklx, + + # deny writes in /sys except for /sys/fs/cgroup, also allow + # fusectl, securityfs and debugfs to be mounted there (read-only) + mount fstype=fusectl -> /sys/fs/fuse/connections/, + mount fstype=securityfs -> /sys/kernel/security/, + mount fstype=debugfs -> /sys/kernel/debug/, + mount fstype=proc -> /proc/, + mount fstype=sysfs -> /sys/, + deny /sys/firmware/efi/efivars/** rwklx, + deny /sys/kernel/security/** rwklx, + + # generated by: lxc-generate-aa-rules.py container-rules.base + deny /proc/sys/[^kn]*{,/**} wklx, + deny /proc/sys/k[^e]*{,/**} wklx, + deny /proc/sys/ke[^r]*{,/**} wklx, + deny /proc/sys/ker[^n]*{,/**} wklx, + deny /proc/sys/kern[^e]*{,/**} wklx, + deny /proc/sys/kerne[^l]*{,/**} wklx, + deny /proc/sys/kernel/[^smhd]*{,/**} wklx, + deny /proc/sys/kernel/d[^o]*{,/**} wklx, + deny /proc/sys/kernel/do[^m]*{,/**} wklx, + deny /proc/sys/kernel/dom[^a]*{,/**} wklx, + deny /proc/sys/kernel/doma[^i]*{,/**} wklx, + deny /proc/sys/kernel/domai[^n]*{,/**} wklx, + deny /proc/sys/kernel/domain[^n]*{,/**} wklx, + deny /proc/sys/kernel/domainn[^a]*{,/**} wklx, + deny /proc/sys/kernel/domainna[^m]*{,/**} wklx, + deny /proc/sys/kernel/domainnam[^e]*{,/**} wklx, + deny /proc/sys/kernel/domainname?*{,/**} wklx, + deny /proc/sys/kernel/h[^o]*{,/**} wklx, + deny /proc/sys/kernel/ho[^s]*{,/**} wklx, + deny /proc/sys/kernel/hos[^t]*{,/**} wklx, + deny /proc/sys/kernel/host[^n]*{,/**} wklx, + deny /proc/sys/kernel/hostn[^a]*{,/**} wklx, + deny /proc/sys/kernel/hostna[^m]*{,/**} wklx, + deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx, + deny /proc/sys/kernel/hostname?*{,/**} wklx, + deny /proc/sys/kernel/m[^s]*{,/**} wklx, + deny /proc/sys/kernel/ms[^g]*{,/**} wklx, + deny /proc/sys/kernel/msg*/** wklx, + deny /proc/sys/kernel/s[^he]*{,/**} wklx, + deny /proc/sys/kernel/se[^m]*{,/**} wklx, + deny /proc/sys/kernel/sem*/** wklx, + deny /proc/sys/kernel/sh[^m]*{,/**} wklx, + deny /proc/sys/kernel/shm*/** wklx, + deny /proc/sys/kernel?*{,/**} wklx, + deny /proc/sys/n[^e]*{,/**} wklx, + deny /proc/sys/ne[^t]*{,/**} wklx, + deny /proc/sys/net?*{,/**} wklx, + deny /sys/[^fdc]*{,/**} wklx, + deny /sys/c[^l]*{,/**} wklx, + deny /sys/cl[^a]*{,/**} wklx, + deny /sys/cla[^s]*{,/**} wklx, + deny /sys/clas[^s]*{,/**} wklx, + deny /sys/class/[^n]*{,/**} wklx, + deny /sys/class/n[^e]*{,/**} wklx, + deny /sys/class/ne[^t]*{,/**} wklx, + deny /sys/class/net?*{,/**} wklx, + deny /sys/class?*{,/**} wklx, + deny /sys/d[^e]*{,/**} wklx, + deny /sys/de[^v]*{,/**} wklx, + deny /sys/dev[^i]*{,/**} wklx, + deny /sys/devi[^c]*{,/**} wklx, + deny /sys/devic[^e]*{,/**} wklx, + deny /sys/device[^s]*{,/**} wklx, + deny /sys/devices/[^v]*{,/**} wklx, + deny /sys/devices/v[^i]*{,/**} wklx, + deny /sys/devices/vi[^r]*{,/**} wklx, + deny /sys/devices/vir[^t]*{,/**} wklx, + deny /sys/devices/virt[^u]*{,/**} wklx, + deny /sys/devices/virtu[^a]*{,/**} wklx, + deny /sys/devices/virtua[^l]*{,/**} wklx, + deny /sys/devices/virtual/[^n]*{,/**} wklx, + deny /sys/devices/virtual/n[^e]*{,/**} wklx, + deny /sys/devices/virtual/ne[^t]*{,/**} wklx, + deny /sys/devices/virtual/net?*{,/**} wklx, + deny /sys/devices/virtual?*{,/**} wklx, + deny /sys/devices?*{,/**} wklx, + deny /sys/f[^s]*{,/**} wklx, + deny /sys/fs/[^c]*{,/**} wklx, + deny /sys/fs/c[^g]*{,/**} wklx, + deny /sys/fs/cg[^r]*{,/**} wklx, + deny /sys/fs/cgr[^o]*{,/**} wklx, + deny /sys/fs/cgro[^u]*{,/**} wklx, + deny /sys/fs/cgrou[^p]*{,/**} wklx, + deny /sys/fs/cgroup?*{,/**} wklx, + deny /sys/fs?*{,/**} wklx, diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index 9603c78..e6563de 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -351,26 +351,37 @@ AppArmorSetSecuritySCSILabel(virSCSIDevicePtr dev ATTRIBUTE_UNUSED, static int AppArmorSecurityManagerProbe(const char *virtDriver ATTRIBUTE_UNUSED) { - char *template = NULL; + char *template_qemu = NULL; + char *template_lxc = NULL; int rc = SECURITY_DRIVER_DISABLE; if (use_apparmor() < 0) return rc; /* see if template file exists */ - if (virAsprintf(&template, "%s/TEMPLATE", + if (virAsprintf(&template_qemu, "%s/TEMPLATE.qemu", APPARMOR_DIR "/libvirt") == -1) return rc; - if (!virFileExists(template)) { + if (virAsprintf(&template_lxc, "%s/TEMPLATE.lxc", + APPARMOR_DIR "/libvirt") == -1) + goto cleanup; + + if (!virFileExists(template_qemu)) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("template \'%s\' does not exist"), template_qemu); + goto cleanup; + } + if (!virFileExists(template_lxc)) { virReportError(VIR_ERR_INTERNAL_ERROR, - _("template \'%s\' does not exist"), template); + _("template \'%s\' does not exist"), template_lxc); goto cleanup; } rc = SECURITY_DRIVER_ENABLE; cleanup: - VIR_FREE(template); + VIR_FREE(template_qemu); + VIR_FREE(template_lxc); return rc; } diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index f11855d..fe9ad59 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -336,24 +336,20 @@ create_profile(const char *profile, const char *profile_name, char *pcontent = NULL; char *replace_name = NULL; char *replace_files = NULL; - char *replace_driver = NULL; const char *template_name = "\nprofile LIBVIRT_TEMPLATE"; const char *template_end = "\n}"; - const char *template_driver = "libvirt-driver"; int tlen, plen; int fd; int rc = -1; - const char *driver_name = "qemu"; - - if (virtType == VIR_DOMAIN_VIRT_LXC) - driver_name = "lxc"; if (virFileExists(profile)) { vah_error(NULL, 0, _("profile exists")); goto end; } - if (virAsprintfQuiet(&template, "%s/TEMPLATE", APPARMOR_DIR "/libvirt") < 0) { + + if (virAsprintfQuiet(&template, "%s/TEMPLATE.%s", APPARMOR_DIR "/libvirt", + virDomainVirtTypeToString(virtType)) < 0) { vah_error(NULL, 0, _("template name exceeds maximum length")); goto end; } @@ -378,11 +374,6 @@ create_profile(const char *profile, const char *profile_name, goto clean_tcontent; } - if (strstr(tcontent, template_driver) == NULL) { - vah_error(NULL, 0, _("no replacement string in template")); - goto clean_tcontent; - } - /* '\nprofile <profile_name>\0' */ if (virAsprintfQuiet(&replace_name, "\nprofile %s", profile_name) == -1) { vah_error(NULL, 0, _("could not allocate memory for profile name")); @@ -397,15 +388,7 @@ create_profile(const char *profile, const char *profile_name, goto clean_tcontent; } - /* 'libvirt-<driver_name>\0' */ - if (virAsprintfQuiet(&replace_driver, "libvirt-%s", driver_name) == -1) { - vah_error(NULL, 0, _("could not allocate memory for profile driver")); - VIR_FREE(replace_driver); - goto clean_tcontent; - } - - plen = tlen + strlen(replace_name) - strlen(template_name) + - strlen(replace_driver) - strlen(template_driver) + 1; + plen = tlen + strlen(replace_name) - strlen(template_name) + 1; if (virtType != VIR_DOMAIN_VIRT_LXC) plen += strlen(replace_files) - strlen(template_end); @@ -422,9 +405,6 @@ create_profile(const char *profile, const char *profile_name, pcontent[0] = '\0'; strcpy(pcontent, tcontent); - if (replace_string(pcontent, plen, template_driver, replace_driver) < 0) - goto clean_all; - if (replace_string(pcontent, plen, template_name, replace_name) < 0) goto clean_all; @@ -455,7 +435,6 @@ create_profile(const char *profile, const char *profile_name, clean_replace: VIR_FREE(replace_name); VIR_FREE(replace_files); - VIR_FREE(replace_driver); clean_tcontent: VIR_FREE(tcontent); end: -- 1.8.4.5

2 1

[libvirt] [PATCH 0/2] AppArmor lxc profile fixes
by Cédric Bosdonnat 15 Jul '14

15 Jul '14

Hi all, Here are 2 patches fixing AppArmor profiles for lxc containers. The main problem was that the current profile was: 1/ too restricting as it needed to allow all needed applications 2/ used PUx permissions, which made systemd (or bash) run as unprofiled as they have no profiles defined. The new profile is based on container-default profile shipped for lxc on Ubuntu. All applications are now running under the parent profile (ix permission) and some critical files accesses are denied. The first patch also avoid writing the useless libvirt-UUID.files for lxc containers. Cédric Bosdonnat (2): Don't output libvirt-UUID.files for LXC apparmor profiles Rework lxc apparmor profile examples/apparmor/Makefile.am | 6 +- examples/apparmor/TEMPLATE.lxc | 15 ++++ examples/apparmor/{TEMPLATE => TEMPLATE.qemu} | 2 +- examples/apparmor/libvirt-lxc | 119 +++++++++++++++++++++++--- src/security/security_apparmor.c | 20 +++-- src/security/virt-aa-helper.c | 32 ++----- 6 files changed, 150 insertions(+), 44 deletions(-) create mode 100644 examples/apparmor/TEMPLATE.lxc rename examples/apparmor/{TEMPLATE => TEMPLATE.qemu} (75%) -- 1.8.4.5

4 11

[libvirt] [PATCH 0/2] Fix condition value assignments in conditions
by Ján Tomko 15 Jul '14

15 Jul '14

Split into two patches, as we might want to backport the first one somewhere. Ján Tomko (2): Fix error on fs pool build failure Fix assignment of comparison against zero src/storage/storage_backend_fs.c | 2 +- tests/virnettlshelpers.c | 4 ++-- tools/virsh-network.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) -- 1.8.5.5

2 3

[libvirt] [PATCH] qemu: blockcopy: Initialize correct source structure
by Peter Krempa 15 Jul '14

15 Jul '14

4cc1f1a01fb338de939ba88eb933931687b22336 introduced a crash when doing a block copy as virStorageSourceInitChainElement was called on "disk->mirror" that is still NULL at that point instead of "mirror" which temporarily holds the mirror source struct until it's fully initialized. This resulted into a crash as a NULL was dereferenced. Reported by: Shanzi Yu <shyu(a)redhat.com> --- Fortunately unreleased. src/qemu/qemu_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 8d40bc9..c0ad446 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -15309,7 +15309,7 @@ qemuDomainBlockCopy(virDomainObjPtr vm, if (VIR_STRDUP(mirror->path, dest) < 0) goto endjob; - if (virStorageSourceInitChainElement(disk->mirror, disk->src, false) < 0) + if (virStorageSourceInitChainElement(mirror, disk->src, false) < 0) goto endjob; if (qemuDomainPrepareDiskChainElement(driver, vm, mirror, -- 2.0.0

2 2

Re: [libvirt] [libvirt-users] LVM Volume Creation
by Ravi Samji 15 Jul '14

15 Jul '14

Hi All, I'm having issue with creating LVM Volume via libvirt. We are running libvirtd 1.2 with KVM. We are creating Volume Group (VG01) outside of libvirt and defining a storage pool for it. Here is the StoragePool XML for the Volume Group created outside libvirt. <pool type="logical"> <name>VG01</name> <target> <path>/dev/VG01</path> </target> </pool> We are creating Logical Volume (ub_test01.img) through libvirt in the Volume Group (VG01) Here is the XML to create Storage Volume in LVM Storage Pool VG01. <volume type="block"> <name>ub_test01.img</name> <allocation>0</allocation> <capacity unit="M">1</capacity> <target> <format type="lvm2" /> </target> </volume> When I create the Logical Volume from libvirt using above XML and run lvs command to list logical volumes, this is what I see. LV VG Attr LSize Origin Snap% Move Log Copy% Convert --------------- ------- ------- ------- ----------------------- ------- ------- ------- ------- ------- foo VG01 -wi-a- 1.00g ub_test01.img VG01 swi-a- 4.00m [ub_test01.img_vorigin] 0.20 root ops-02 -wi-ao 227.08g swap_1 ops-02 -wi-ao 5.75g As you see, ub_test01.img shows that it has an Origin indicating that it was created as a snapshot, but, that Origin doesn't exist and wasn't specified. I'd appreciate if you anyone can help me understand what is going on and/or describe how to make libvirt create logical volumes not as a snapshot. I'm happy to enable debugging to see what command libvirt is running to create the volume if someone case describe how to enable debugging. Regards, Ravi Message sent via Atmail Open - http://atmail.org/

2 1

[libvirt] python bindings links?
by Eric Blake 14 Jul '14

14 Jul '14

According to http://libvirt.org/bindings.html, python bindings are still listed as part of libvirt.git. But now that they are a separate git repository, we probably ought to have a more official page for these bindings, including an easy-to-find link to the repository viewer. Right now, libvirt.org/python doesn't have any hits; seems like the obvious place to put such information, given that we already have libvirt.org/php. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

2 1

[libvirt] LVM Volume Creation
by Ravi Samji 14 Jul '14

14 Jul '14

Hi All, I'm having issue with creating LVM volume via libvirt. XML of LVM StoragePool is: VG01 /dev/VG01 (existing vg) XML of create volume in lvm pool is: ub_test01.img 0 1 When I create the volume with above XML defn, lvs command to list logical volume shows a value in the origin column indicating it was created as snapshot.. the strange thing is that the origin volume does not exist..! something strange going on. You can see the lvs output here See http://pastebin.com/prk6VqwD [1] I'd appreciate if you anyone can help me understand what is going on and/or describe how to make libvirt create logical volumes not as a snapshot. We are running libvirtd 1.2 with KVM. Regards, Ravi ------------------------- Message sent via Atmail Open - http://atmail.org/ Links: ------ [1] http://pastebin.com/prk6VqwD

2 1

[libvirt] [libvirt-glib 1/3] Add gvir_config_capabilities_cpu_get_model()
by Zeeshan Ali (Khattak) 14 Jul '14

14 Jul '14

Add a method to get the model of the CPU from capabilities. --- libvirt-gconfig/libvirt-gconfig-capabilities-cpu.c | 6 ++++++ libvirt-gconfig/libvirt-gconfig-capabilities-cpu.h | 2 ++ libvirt-gconfig/libvirt-gconfig.sym | 2 ++ 3 files changed, 10 insertions(+) diff --git a/libvirt-gconfig/libvirt-gconfig-capabilities-cpu.c b/libvirt-gconfig/libvirt-gconfig-capabilities-cpu.c index f4753ff..255c4d7 100644 --- a/libvirt-gconfig/libvirt-gconfig-capabilities-cpu.c +++ b/libvirt-gconfig/libvirt-gconfig-capabilities-cpu.c @@ -60,6 +60,12 @@ gvir_config_capabilities_cpu_get_arch(GVirConfigCapabilitiesCpu *cpu) return gvir_config_object_get_node_content(GVIR_CONFIG_OBJECT(cpu), "arch"); } +const gchar * +gvir_config_capabilities_cpu_get_model(GVirConfigCapabilitiesCpu *cpu) +{ + return gvir_config_object_get_node_content(GVIR_CONFIG_OBJECT(cpu), "model"); +} + /** * gvir_config_capabilities_cpu_add_feature: * diff --git a/libvirt-gconfig/libvirt-gconfig-capabilities-cpu.h b/libvirt-gconfig/libvirt-gconfig-capabilities-cpu.h index ce3613f..c6c152f 100644 --- a/libvirt-gconfig/libvirt-gconfig-capabilities-cpu.h +++ b/libvirt-gconfig/libvirt-gconfig-capabilities-cpu.h @@ -66,6 +66,8 @@ GType gvir_config_capabilities_cpu_get_type(void); const gchar * gvir_config_capabilities_cpu_get_arch(GVirConfigCapabilitiesCpu *cpu); +const gchar * +gvir_config_capabilities_cpu_get_model(GVirConfigCapabilitiesCpu *cpu); void gvir_config_capabilities_cpu_add_feature(GVirConfigCapabilitiesCpu *cpu, GVirConfigCapabilitiesCpuFeature *feature); GList * diff --git a/libvirt-gconfig/libvirt-gconfig.sym b/libvirt-gconfig/libvirt-gconfig.sym index 0d33fdb..86dada6 100644 --- a/libvirt-gconfig/libvirt-gconfig.sym +++ b/libvirt-gconfig/libvirt-gconfig.sym @@ -689,6 +689,8 @@ global: LIBVIRT_GCONFIG_0.1.9 { global: + gvir_config_capabilities_cpu_get_model; + gvir_config_capabilities_host_get_secmodels; gvir_config_capabilities_host_secmodel_get_doi; -- 1.9.3

2 10

[libvirt] [PATCH] GetBlockInfo: Use the correct path to qemuOpenFile
by John Ferlan 14 Jul '14

14 Jul '14

Commit id '3ea661de' refactored the code to use the 'disk->src->path' instead of getting the path from virDomainDiskGetSource(). The one call to qemuOpenFile() didn't use the disk source path, rather it used the path as passed from the caller (in this case 'vda') - this caused a failure with the virt-test/tp-libvirt as follows: $ virsh domblkinfo virt-tests-vm1 vda error: cannot stat file '/home/virt-test/shared/data/images/jeos-20-64.qcow2': Bad file descriptor $ Signed-off-by: John Ferlan <jferlan(a)redhat.com> --- NOTE: Luckily this hasn't crept into a release... src/qemu/qemu_driver.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index ecccf6c..8d40bc9 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -10370,7 +10370,8 @@ qemuDomainGetBlockInfo(virDomainPtr dom, goto cleanup; } - if ((fd = qemuOpenFile(driver, vm, path, O_RDONLY, NULL, NULL)) == -1) + if ((fd = qemuOpenFile(driver, vm, disk->src->path, O_RDONLY, + NULL, NULL)) == -1) goto cleanup; if (fstat(fd, &sb) < 0) { -- 1.9.3

2 1

[libvirt] [PATCHv3 0/3] Couple of seclabels improvements
by Michal Privoznik 14 Jul '14

14 Jul '14

Some patches of the previous version are pushed already. However, there are some new too. Michal Privoznik (3): conf: Always format seclabel's model virSecurityLabelDefParseXML: Rework virSecurityLabelDef: use enum type for @type src/conf/domain_conf.c | 129 +++++++++++---------- src/security/security_dac.c | 2 +- src/util/virseclabel.h | 2 +- .../qemuxml2argv-seclabel-dynamic-none.xml | 28 +++++ tests/qemuxml2xmltest.c | 1 + 5 files changed, 101 insertions(+), 61 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-seclabel-dynamic-none.xml -- 1.8.5.5

2 8

[libvirt] [PATCH 0/2] capabilities cleanups
by Eric Blake 14 Jul '14

14 Jul '14

I'm still trying to figure out how best to expose capabilities in the new virConnectGetDomainCapabilities for things such as active commit - we may want to tweak that XML before it becomes baked in as part of the 1.2.7 release. But meanwhile, these two patches should be fairly non-controversial. Eric Blake (2): docs: mention more about older capability feature bits capabilities: use bool instead of int docs/formatcaps.html.in | 42 +++++++++++++++++++++++++++++++++++++++- src/bhyve/bhyve_capabilities.c | 2 +- src/conf/capabilities.c | 18 ++++++++--------- src/conf/capabilities.h | 18 ++++++++--------- src/esx/esx_driver.c | 4 ++-- src/libxl/libxl_conf.c | 4 ++-- src/lxc/lxc_conf.c | 4 ++-- src/openvz/openvz_conf.c | 2 +- src/parallels/parallels_driver.c | 2 +- src/phyp/phyp_driver.c | 2 +- src/qemu/qemu_capabilities.c | 17 ++++++++-------- src/security/virt-aa-helper.c | 2 +- src/test/test_driver.c | 6 +++--- src/uml/uml_conf.c | 2 +- src/vbox/vbox_tmpl.c | 2 +- src/vmware/vmware_conf.c | 2 +- src/xen/xen_hypervisor.c | 31 ++++++++++++++--------------- src/xenapi/xenapi_driver.c | 2 +- tests/qemucaps2xmltest.c | 2 +- tests/testutils.c | 2 +- tests/testutilslxc.c | 2 +- tests/testutilsqemu.c | 6 +++--- tests/testutilsxen.c | 2 +- tests/vircaps2xmltest.c | 2 +- tests/vircapstest.c | 2 +- tests/vmx2xmltest.c | 2 +- tests/xml2vmxtest.c | 2 +- 27 files changed, 112 insertions(+), 72 deletions(-) -- 1.9.3

2 4

[libvirt] [PATCHv2]util:openvswitch:Delete port if it is exist when add port
by Lichunhe 14 Jul '14

14 Jul '14

If the ovs service stop abnormal, or host cold reboot, vm is destroyed after ovs service stop. The ovs port which connect to interface of vm will not be clear. When the ovs service restart, recover configuration from db, but the interface is no exist, port recovery failed, and then vm restart on the same host, libvirt add port again, but the port configuration is same as before, ovs will not connect the interface, only store the configuration in db. Below will trigger this problem, virsh start vm service openvswitch-switch stop virsh destroy vm service openvswitch-switch start virsh start vm Signed-off-by: Chunhe Li <lichunhe(a)huawei.com> --- src/util/virnetdevopenvswitch.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util/virnetdevopenvswitch.c b/src/util/virnetdevopenvswitch.c index 9bcbfb1..2c414ad 100644 --- a/src/util/virnetdevopenvswitch.c +++ b/src/util/virnetdevopenvswitch.c @@ -84,8 +84,8 @@ int virNetDevOpenvswitchAddPort(const char *brname, const char *ifname, cmd = virCommandNew(OVSVSCTL); - virCommandAddArgList(cmd, "--timeout=5", "--", "--may-exist", "add-port", - brname, ifname, NULL); + virCommandAddArgList(cmd, "--timeout=5", "--", "--if-exists", "del-port", + ifname, "--", "add-port", brname, ifname, NULL); if (virtVlan && virtVlan->nTags > 0) { -- 1.9.2.msysgit.0

2 1

[libvirt] [PATCHv2 0/2] doc: Improve snapshot/blockjob docs
by Peter Krempa 14 Jul '14

14 Jul '14

Peter Krempa (2): doc: Document that snapshot name of block-backed disk isnt autogenerated doc: Be more specific about semantics of _REUSE_EXT flag docs/formatsnapshot.html.in | 8 +++++--- src/libvirt.c | 23 ++++++++++++++--------- tools/virsh.pod | 21 +++++++++++++-------- 3 files changed, 32 insertions(+), 20 deletions(-) -- 2.0.0

2 4

[libvirt] [PATCH] conf: Fix possible NULL dereference in virStorageVolTargetDefFormat
by Matthias Bolte 11 Jul '14

11 Jul '14

Commit dae1568c6c6455091e8cd9bc2e90a22af3d3880c converted the perms member of the virStorageVolTarget struct into a pointer to make it optional. But virStorageVolTargetDefFormat did not check perms for NULL before dereferencing it. --- src/conf/storage_conf.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/src/conf/storage_conf.c b/src/conf/storage_conf.c index 9ac5975..aa29658 100644 --- a/src/conf/storage_conf.c +++ b/src/conf/storage_conf.c @@ -1423,22 +1423,24 @@ virStorageVolTargetDefFormat(virStorageVolOptionsPtr options, virBufferAsprintf(buf, "<format type='%s'/>\n", format); } - virBufferAddLit(buf, "<permissions>\n"); - virBufferAdjustIndent(buf, 2); + if (def->perms) { + virBufferAddLit(buf, "<permissions>\n"); + virBufferAdjustIndent(buf, 2); - virBufferAsprintf(buf, "<mode>0%o</mode>\n", - def->perms->mode); - virBufferAsprintf(buf, "<owner>%u</owner>\n", - (unsigned int) def->perms->uid); - virBufferAsprintf(buf, "<group>%u</group>\n", - (unsigned int) def->perms->gid); + virBufferAsprintf(buf, "<mode>0%o</mode>\n", + def->perms->mode); + virBufferAsprintf(buf, "<owner>%u</owner>\n", + (unsigned int) def->perms->uid); + virBufferAsprintf(buf, "<group>%u</group>\n", + (unsigned int) def->perms->gid); - virBufferEscapeString(buf, "<label>%s</label>\n", - def->perms->label); + virBufferEscapeString(buf, "<label>%s</label>\n", + def->perms->label); - virBufferAdjustIndent(buf, -2); - virBufferAddLit(buf, "</permissions>\n"); + virBufferAdjustIndent(buf, -2); + virBufferAddLit(buf, "</permissions>\n"); + } if (def->timestamps) { virBufferAddLit(buf, "<timestamps>\n"); -- 1.9.1

2 2

[libvirt] [PATCH] virseclabel: Resolve Coverity FORWARD_NULL issue
by John Ferlan 11 Jul '14

11 Jul '14

Resolve issue introduced by commit id '13adf1b' Signed-off-by: John Ferlan <jferlan(a)redhat.com> --- src/util/virseclabel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/virseclabel.c b/src/util/virseclabel.c index e9d973c..02a8342 100644 --- a/src/util/virseclabel.c +++ b/src/util/virseclabel.c @@ -61,7 +61,7 @@ virSecurityLabelDefNew(const char *model) if (VIR_ALLOC(seclabel) < 0 || VIR_STRDUP(seclabel->model, model) < 0) { virSecurityLabelDefFree(seclabel); - seclabel = NULL; + return NULL; } seclabel->relabel = true; -- 1.9.3

2 1

[libvirt] [PATCHv2 0/2] AppArmor lxc profile fixes
by Cédric Bosdonnat 11 Jul '14

11 Jul '14

Diff to v1: * virt-aa-helper: don't return -1 when reloading the profile: nothing to do isn't a bad thing sometimes. Cédric Bosdonnat (2): Don't output libvirt-UUID.files for LXC apparmor profiles Rework lxc apparmor profile examples/apparmor/Makefile.am | 6 +- examples/apparmor/TEMPLATE.lxc | 15 ++++ examples/apparmor/{TEMPLATE => TEMPLATE.qemu} | 2 +- examples/apparmor/libvirt-lxc | 119 +++++++++++++++++++++++--- src/security/security_apparmor.c | 20 +++-- src/security/virt-aa-helper.c | 34 ++------ 6 files changed, 152 insertions(+), 44 deletions(-) create mode 100644 examples/apparmor/TEMPLATE.lxc rename examples/apparmor/{TEMPLATE => TEMPLATE.qemu} (75%) -- 1.8.4.5

2 3

[libvirt] [PATCH] libxl: Correct cast to virDomainDiskDiscard enum.
by Jim Fehlig 11 Jul '14

11 Jul '14

From: Ian Campbell <Ian.Campbell(a)citrix.com> This was converted to a typedef in 5a2bd4c9171d "conf: more enum cleanups in "src/conf/domain_conf.h"" causing: libxl/libxl_conf.c: In function 'libxlDiskSetDiscard': libxl/libxl_conf.c:724:19: error: conversion to incomplete type Signed-off-by: Ian Campbell <ian.campbell(a)citrix.com> --- This build failure was found by the osstest build bot http://lists.xen.org/archives/html/xen-devel/2014-07/msg01552.html Pushing under the build-breaker rule. src/libxl/libxl_conf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libxl/libxl_conf.c b/src/libxl/libxl_conf.c index 0b4a0b5..f620d47 100644 --- a/src/libxl/libxl_conf.c +++ b/src/libxl/libxl_conf.c @@ -721,7 +721,7 @@ libxlDiskSetDiscard(libxl_device_disk *x_disk, int discard) if (!x_disk->readwrite) return 0; #if defined(LIBXL_HAVE_LIBXL_DEVICE_DISK_DISCARD_ENABLE) - switch ((enum virDomainDiskDiscard)discard) { + switch ((virDomainDiskDiscard)discard) { case VIR_DOMAIN_DISK_DISCARD_DEFAULT: case VIR_DOMAIN_DISK_DISCARD_LAST: break; -- 1.8.4.5

1 0

[libvirt] CPU model API (v2)
by Zeeshan Ali (Khattak) 11 Jul '14

11 Jul '14

v2: * Correct hierarchy for GVirConfigDomainCpuModel * Correct order of new symbols in .sym file

1 4

[libvirt] [PATCH v3] LXC: add support for --config in setmem command
by Chen Hanxiao 11 Jul '14

11 Jul '14

In lxc, we could not use setmem command with --config options. This patch will add support for this. Signed-off-by: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> --- v3: add max_balloon check for AFFECT_CONFIG v2: use virDomainSetMemoryFlagsEnsureACL remove redundant domain running check src/lxc/lxc_driver.c | 58 ++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 47 insertions(+), 11 deletions(-) diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index 3253211..f04b543 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -711,36 +711,64 @@ static int lxcDomainSetMaxMemory(virDomainPtr dom, unsigned long newmax) return ret; } -static int lxcDomainSetMemory(virDomainPtr dom, unsigned long newmem) +static int lxcDomainSetMemoryFlags(virDomainPtr dom, unsigned long newmem, + unsigned int flags) { virDomainObjPtr vm; + virDomainDefPtr persistentDef = NULL; + virCapsPtr caps = NULL; int ret = -1; virLXCDomainObjPrivatePtr priv; + virLXCDriverPtr driver = dom->conn->privateData; + virLXCDriverConfigPtr cfg = NULL; + unsigned long oldmax = 0; + + virCheckFlags(VIR_DOMAIN_AFFECT_LIVE | + VIR_DOMAIN_AFFECT_CONFIG, -1); if (!(vm = lxcDomObjFromDomain(dom))) goto cleanup; + cfg = virLXCDriverGetConfig(driver); + priv = vm->privateData; - if (virDomainSetMemoryEnsureACL(dom->conn, vm->def) < 0) + if (virDomainSetMemoryFlagsEnsureACL(dom->conn, vm->def, flags) < 0) goto cleanup; - if (newmem > vm->def->mem.max_balloon) { + if (!(caps = virLXCDriverGetCapabilities(driver, false))) + goto cleanup; + + if (virDomainLiveConfigHelperMethod(caps, driver->xmlopt, vm, &flags, + &persistentDef) < 0) + goto cleanup; + + if (flags & VIR_DOMAIN_AFFECT_LIVE) + oldmax = vm->def->mem.max_balloon; + if (flags & VIR_DOMAIN_AFFECT_CONFIG) { + if (!oldmax || oldmax > persistentDef->mem.max_balloon) + oldmax = persistentDef->mem.max_balloon; + } + + if (newmem > oldmax) { virReportError(VIR_ERR_INVALID_ARG, "%s", _("Cannot set memory higher than max memory")); goto cleanup; } - if (!virDomainObjIsActive(vm)) { - virReportError(VIR_ERR_OPERATION_INVALID, - "%s", _("Domain is not running")); - goto cleanup; + if (flags & VIR_DOMAIN_AFFECT_LIVE) { + if (virCgroupSetMemory(priv->cgroup, newmem) < 0) { + virReportError(VIR_ERR_OPERATION_FAILED, + "%s", _("Failed to set memory for domain")); + goto cleanup; + } } - if (virCgroupSetMemory(priv->cgroup, newmem) < 0) { - virReportError(VIR_ERR_OPERATION_FAILED, - "%s", _("Failed to set memory for domain")); - goto cleanup; + if (flags & VIR_DOMAIN_AFFECT_CONFIG) { + sa_assert(persistentDef); + persistentDef->mem.cur_balloon = newmem; + if (virDomainSaveConfig(cfg->configDir, persistentDef) < 0) + goto cleanup; } ret = 0; @@ -748,9 +776,16 @@ static int lxcDomainSetMemory(virDomainPtr dom, unsigned long newmem) cleanup: if (vm) virObjectUnlock(vm); + virObjectUnref(caps); + virObjectUnref(cfg); return ret; } +static int lxcDomainSetMemory(virDomainPtr dom, unsigned long newmem) +{ + return lxcDomainSetMemoryFlags(dom, newmem, VIR_DOMAIN_AFFECT_LIVE); +} + static int lxcDomainSetMemoryParameters(virDomainPtr dom, virTypedParameterPtr params, @@ -5697,6 +5732,7 @@ static virDriver lxcDriver = { .domainGetMaxMemory = lxcDomainGetMaxMemory, /* 0.7.2 */ .domainSetMaxMemory = lxcDomainSetMaxMemory, /* 0.7.2 */ .domainSetMemory = lxcDomainSetMemory, /* 0.7.2 */ + .domainSetMemoryFlags = lxcDomainSetMemoryFlags, /* 1.2.7 */ .domainSetMemoryParameters = lxcDomainSetMemoryParameters, /* 0.8.5 */ .domainGetMemoryParameters = lxcDomainGetMemoryParameters, /* 0.8.5 */ .domainSetBlkioParameters = lxcDomainSetBlkioParameters, /* 0.9.8 */ -- 1.9.0

2 1

[libvirt] [PATCH 0/4] support for QEMU vhost-user
by Michele Paolino 11 Jul '14

11 Jul '14

This series adds support for the QEMU vhost-user feature to libvirt. vhost-user enables the communication between a QEMU virtual machine and other userspace process using the Virtio transport protocol. It uses a char dev (e.g. Unix socket) for the control plane, while the data plane based on shared memory. The XML looks like: <interface type='vhostuser'> <source type='unix' path='/tmp/vhost.sock' mode='server'/> <mac address='52:54:00:3b:83:1a'/> <model type='virtio'/> </interface> Our use case is the deployment of Snabbswitch in an OpenStack/NFV environment. Snabbswitch uses a Unix socket to implement the vhost-user control plane, thus we focused on the support for the type=unix attribute of the <source> element. To test it with Snabbswitch, it is necessary to apply the following patches (respectively from Chen Fan and Michele Paolino): http://www.redhat.com/archives/libvir-list/2014-June/msg01195.html http://www.redhat.com/archives/libvir-list/2014-June/msg01418.html It is also possible to directly checkout the Virtual Open Systems' libvirt repository(branch "vhost-user_support) at the address: https://github.com/virtualopensystems/libvirt. This patch is based on the previous work from Luke Gorrie: http://www.redhat.com/archives/libvir-list/2014-May/msg00934.html Michele Paolino (4): vhost-user support: domain configuration vhost-user support: qemu command-line vhost-user support: tests and docs vhost-user support: lxc,xenxs,uml docs/formatdomain.html.in | 34 +++++++++ docs/schemas/domaincommon.rng | 39 +++++++++++ src/conf/domain_conf.c | 81 ++++++++++++++++++++++ src/conf/domain_conf.h | 10 ++- src/lxc/lxc_process.c | 1 + src/qemu/qemu_command.c | 58 ++++++++++++++++ src/uml/uml_conf.c | 5 ++ src/xenxs/xen_sxpr.c | 1 + .../qemuxml2argv-net-vhostuser.args | 7 ++ .../qemuxml2argv-net-vhostuser.xml | 33 +++++++++ tests/qemuxml2argvtest.c | 1 + tests/qemuxml2xmltest.c | 1 + 12 files changed, 269 insertions(+), 2 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-net-vhostuser.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-net-vhostuser.xml -- 1.9.3

2 13

[libvirt] [PATCH v2 0/4] Couple of seclabels improvements
by Michal Privoznik 11 Jul '14

11 Jul '14

diff to v1: - rework the 3rd patch - introduce one more bugfix Michal Privoznik (4): virSecurityLabelDef: substitute 'norelabel' with 'relabel' virSecurityDeviceLabelDef: substitute 'norelabel' with 'relabel' conf: Always format seclabel's model conf: Don't allow multiple seclabels for same model src/conf/domain_conf.c | 67 ++++++++++++---------- src/security/security_apparmor.c | 10 ++-- src/security/security_dac.c | 22 +++---- src/security/security_manager.c | 2 +- src/security/security_selinux.c | 32 +++++------ src/util/virseclabel.c | 2 +- src/util/virseclabel.h | 4 +- .../qemuxml2argv-seclabel-dynamic-none.xml | 28 +++++++++ .../qemuxml2argv-seclabel-multiple.xml | 40 +++++++++++++ tests/qemuxml2argvtest.c | 1 + tests/qemuxml2xmltest.c | 1 + 11 files changed, 142 insertions(+), 67 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-seclabel-dynamic-none.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-seclabel-multiple.xml -- 1.8.5.5

4 10

[libvirt] [PATCH 0/3] storage: Fix operations working with local storage only
by Peter Krempa 11 Jul '14

11 Jul '14

Peter Krempa (3): conf: storage: Add helper to determine whether storage vol is local storage: wipe: Don't attempt to wipe remote storage storage: Split out volume upload/download as separate backend function src/conf/storage_conf.c | 19 +++++++++++++ src/conf/storage_conf.h | 2 ++ src/libvirt_private.syms | 1 + src/storage/storage_backend.c | 31 ++++++++++++++++++++ src/storage/storage_backend.h | 30 ++++++++++++++++++++ src/storage/storage_backend_disk.c | 2 ++ src/storage/storage_backend_fs.c | 7 +++++ src/storage/storage_backend_iscsi.c | 2 ++ src/storage/storage_backend_logical.c | 2 ++ src/storage/storage_backend_mpath.c | 2 ++ src/storage/storage_backend_scsi.c | 2 ++ src/storage/storage_driver.c | 53 ++++++++++++++--------------------- 12 files changed, 121 insertions(+), 32 deletions(-) -- 2.0.0

3 7

[libvirt] [PATCH v2] LXC: add support for --config in setmem command
by Chen Hanxiao 11 Jul '14

11 Jul '14

In lxc, we could not use setmem command with --config options. This patch will add support for this. Signed-off-by: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> --- v2: use virDomainSetMemoryFlagsEnsureACL remove redundant domain running check src/lxc/lxc_driver.c | 48 +++++++++++++++++++++++++++++++++++++----------- 1 file changed, 37 insertions(+), 11 deletions(-) diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index b47ac5e..93f496b 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -711,18 +711,33 @@ static int lxcDomainSetMaxMemory(virDomainPtr dom, unsigned long newmax) return ret; } -static int lxcDomainSetMemory(virDomainPtr dom, unsigned long newmem) +static int lxcDomainSetMemoryFlags(virDomainPtr dom, unsigned long newmem, + unsigned int flags) { virDomainObjPtr vm; + virDomainDefPtr persistentDef = NULL; + virCapsPtr caps = NULL; int ret = -1; virLXCDomainObjPrivatePtr priv; + virLXCDriverPtr driver = dom->conn->privateData; + virLXCDriverConfigPtr cfg = NULL; + + virCheckFlags(VIR_DOMAIN_AFFECT_LIVE | + VIR_DOMAIN_AFFECT_CONFIG, -1); if (!(vm = lxcDomObjFromDomain(dom))) goto cleanup; priv = vm->privateData; - if (virDomainSetMemoryEnsureACL(dom->conn, vm->def) < 0) + if (virDomainSetMemoryFlagsEnsureACL(dom->conn, vm->def, flags) < 0) + goto cleanup; + + if (!(caps = virLXCDriverGetCapabilities(driver, false))) + goto cleanup; + + if (virDomainLiveConfigHelperMethod(caps, driver->xmlopt, vm, &flags, + &persistentDef) < 0) goto cleanup; if (newmem > vm->def->mem.max_balloon) { @@ -731,16 +746,19 @@ static int lxcDomainSetMemory(virDomainPtr dom, unsigned long newmem) goto cleanup; } - if (!virDomainObjIsActive(vm)) { - virReportError(VIR_ERR_OPERATION_INVALID, - "%s", _("Domain is not running")); - goto cleanup; - } + if (flags & VIR_DOMAIN_AFFECT_CONFIG) { + cfg = virLXCDriverGetConfig(driver); + persistentDef->mem.cur_balloon = newmem; + if (virDomainSaveConfig(cfg->configDir, persistentDef) < 0) + goto cleanup; + } - if (virCgroupSetMemory(priv->cgroup, newmem) < 0) { - virReportError(VIR_ERR_OPERATION_FAILED, - "%s", _("Failed to set memory for domain")); - goto cleanup; + if (flags & VIR_DOMAIN_AFFECT_LIVE) { + if (virCgroupSetMemory(priv->cgroup, newmem) < 0) { + virReportError(VIR_ERR_OPERATION_FAILED, + "%s", _("Failed to set memory for domain")); + goto cleanup; + } } ret = 0; @@ -748,9 +766,16 @@ static int lxcDomainSetMemory(virDomainPtr dom, unsigned long newmem) cleanup: if (vm) virObjectUnlock(vm); + virObjectUnref(caps); + virObjectUnref(cfg); return ret; } +static int lxcDomainSetMemory(virDomainPtr dom, unsigned long newmem) +{ + return lxcDomainSetMemoryFlags(dom, newmem, VIR_DOMAIN_AFFECT_LIVE); +} + static int lxcDomainSetMemoryParameters(virDomainPtr dom, virTypedParameterPtr params, @@ -5697,6 +5722,7 @@ static virDriver lxcDriver = { .domainGetMaxMemory = lxcDomainGetMaxMemory, /* 0.7.2 */ .domainSetMaxMemory = lxcDomainSetMaxMemory, /* 0.7.2 */ .domainSetMemory = lxcDomainSetMemory, /* 0.7.2 */ + .domainSetMemoryFlags = lxcDomainSetMemoryFlags, /* 1.2.7 */ .domainSetMemoryParameters = lxcDomainSetMemoryParameters, /* 0.8.5 */ .domainGetMemoryParameters = lxcDomainGetMemoryParameters, /* 0.8.5 */ .domainSetBlkioParameters = lxcDomainSetBlkioParameters, /* 0.9.8 */ -- 1.9.0

3 2

[libvirt] Bug: iohelper drops I/O error messages
by Jason J. Herne 10 Jul '14

10 Jul '14

During a recent managed save operation I received the following error message: error: operation failed: domain save job: unexpectedly failed. It turns out that I had run out of disk space. After a brief investigation I discovered that libvirt_iohelper is exec'ed and is used to handle all I/O during a (Qemu) managed save operation. While iohelper appears to be set up to log error conditions when they occur, for some reason the logging is getting lost. I'm hoping someone can help figure out why these errors are getting lost. It would be nice to present a useful error message to the user when a managed save fails because of an I/O error. I was able to work around this problem with a patch that bypasses iohelper entirely but I doubt that is really the best thing to do. Does anyone know why these error messages are getting suppressed?

2 2

[libvirt] [PATCHv5 0/4] Outline of rewriting vbox Driver
by Taowei 10 Jul '14

10 Jul '14

Fix some problems in last patch. Includes: * Re-manage the patches in a better order, move some symbol definitions into the proper patch. * Make the API in vboxUniformedAPI hierarchical. So when more apis introduced into the uniformed api, it wouldn't go to a mess. * Rewrite the vboxDomainSave in a better way. Taowei (4): Define vboxUniformedAPI Implement vboxInitialize and vboxDomainSave Implement uniformed api for each vbox version Install vboxUniformedAPI po/POTFILES.in | 1 + src/Makefile.am | 4 +- src/vbox/vbox_common.c | 183 +++++++++++++++ src/vbox/vbox_common.h | 151 ++++++++++++ src/vbox/vbox_driver.c | 22 +- src/vbox/vbox_tmpl.c | 504 ++++++++++++++++++++++++----------------- src/vbox/vbox_uniformed_api.h | 211 +++++++++++++++++ 7 files changed, 868 insertions(+), 208 deletions(-) create mode 100644 src/vbox/vbox_common.c create mode 100644 src/vbox/vbox_common.h create mode 100644 src/vbox/vbox_uniformed_api.h -- 1.7.9.5

2 5

[libvirt] [PATCH V2] storagevol: add nocow to vol xml
by Chunyan Liu 10 Jul '14

10 Jul '14

Add 'nocow' to storage volume xml so that user can have an option to set NOCOW flag to the newly created volume. It's useful on btrfs file system to enhance performance. Btrfs has low performance when hosting VM images, even more when the guest in those VM are also using btrfs as file system. One way to mitigate this bad performance is to turn off COW attributes on VM files. Generally, there are two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then all newly created files will be NOCOW. b) per file. Add the NOCOW file attribute. It could only be done to empty or new files. This patch tries the second way, according to 'nocow' option, it could set NOCOW flag per file: for raw file images, handle 'nocow' in libvirt code; for non-raw file images, pass 'nocow=on' option to qemu-img, and let qemu-img to handle that (requires qemu-img version >= 2.1). Signed-off-by: Chunyan Liu <cyliu(a)suse.com> --- Changes: - now qemu-img can handle 'nocow=on' option, just pass 'nocow=on' to qemu-img for non-raw file images. No need to handle all file type in libvirt code. Pervious version is here: http://www.redhat.com/archives/libvir-list/2013-December/msg01257.html --- docs/formatstorage.html.in | 7 +++++++ docs/schemas/storagevol.rng | 5 +++++ src/conf/storage_conf.c | 3 +++ src/storage/storage_backend.c | 22 ++++++++++++++++++++++ src/util/virstoragefile.h | 1 + 5 files changed, 38 insertions(+) diff --git a/docs/formatstorage.html.in b/docs/formatstorage.html.in index 1cd82b4..e8862bf 100644 --- a/docs/formatstorage.html.in +++ b/docs/formatstorage.html.in @@ -385,6 +385,7 @@ <label>virt_image_t</label> </permissions> <compat>1.1</compat> + <nocow/> <features> <lazy_refcounts/> </features> @@ -424,6 +425,12 @@ 1.1 is used. If omitted, qemu-img default is used. <span class="since">Since 1.1.0</span> </dd> + <dt><code>nocow</code></dt> + <dd>Turn off COW of the newly created volume. So far, this is only valid + to a file image in btrfs file system. It will improve performance when + the file image is used in VM. To create non-raw file images, it + requires QEMU version since 2.1. <span class="since">Since 1.2.6</span> + </dd> <dt><code>features</code></dt> <dd>Format-specific features. Only used for <code>qcow2</code> now. Valid sub-elements are: diff --git a/docs/schemas/storagevol.rng b/docs/schemas/storagevol.rng index 3798476..1b2d4cc 100644 --- a/docs/schemas/storagevol.rng +++ b/docs/schemas/storagevol.rng @@ -138,6 +138,11 @@ <ref name='compat'/> </optional> <optional> + <element name='nocow'> + <empty/> + </element> + </optional> + <optional> <ref name='fileFormatFeatures'/> </optional> </interleave> diff --git a/src/conf/storage_conf.c b/src/conf/storage_conf.c index 9ac5975..77ea23e 100644 --- a/src/conf/storage_conf.c +++ b/src/conf/storage_conf.c @@ -1285,6 +1285,9 @@ virStorageVolDefParseXML(virStoragePoolDefPtr pool, virStringFreeList(version); } + if (virXPathNode("./target/nocow", ctxt)) + ret->target.nocow = true; + if (options->featureFromString && virXPathNode("./target/features", ctxt)) { if ((n = virXPathNodeSet("./target/features/*", ctxt, &nodes)) < 0) goto error; diff --git a/src/storage/storage_backend.c b/src/storage/storage_backend.c index e83a108..80347de 100644 --- a/src/storage/storage_backend.c +++ b/src/storage/storage_backend.c @@ -37,6 +37,9 @@ #ifdef __linux__ # include <sys/ioctl.h> # include <linux/fs.h> +# ifndef FS_NOCOW_FL +# define FS_NOCOW_FL 0x00800000 /* Do not cow file */ +# endif #endif #if WITH_SELINUX @@ -452,6 +455,21 @@ virStorageBackendCreateRaw(virConnectPtr conn ATTRIBUTE_UNUSED, goto cleanup; } + if (vol->target.nocow) { +#ifdef __linux__ + int attr; + + /* Set NOCOW flag. This is an optimisation for btrfs. + * The FS_IOC_SETFLAGS ioctl return value will be ignored since any + * failure of this operation should not block the left work. + */ + if (ioctl(fd, FS_IOC_GETFLAGS, &attr) == 0) { + attr |= FS_NOCOW_FL; + ioctl(fd, FS_IOC_SETFLAGS, &attr); + } +#endif + } + if ((ret = createRawFile(fd, vol, inputvol)) < 0) /* createRawFile already reported the exact error. */ ret = -1; @@ -717,6 +735,7 @@ virStorageBackendCreateQemuImgOpts(char **opts, bool preallocate, int format, const char *compat, + bool nocow, virBitmapPtr features) { virBuffer buf = VIR_BUFFER_INITIALIZER; @@ -729,6 +748,8 @@ virStorageBackendCreateQemuImgOpts(char **opts, virBufferAddLit(&buf, "encryption=on,"); if (preallocate) virBufferAddLit(&buf, "preallocation=metadata,"); + if (nocow) + virBufferAddLit(&buf, "nocow=on,"); if (compat) virBufferAsprintf(&buf, "compat=%s,", compat); @@ -948,6 +969,7 @@ virStorageBackendCreateQemuImgCmd(virConnectPtr conn, do_encryption, preallocate, vol->target.format, compat, + vol->target.nocow, vol->target.features) < 0) { virCommandFree(cmd); return NULL; diff --git a/src/util/virstoragefile.h b/src/util/virstoragefile.h index 4f7357b..baaa42a 100644 --- a/src/util/virstoragefile.h +++ b/src/util/virstoragefile.h @@ -247,6 +247,7 @@ struct _virStorageSource { * pool-specific enum for storage volumes */ virBitmapPtr features; char *compat; + bool nocow; virStoragePermsPtr perms; virStorageTimestampsPtr timestamps; -- 1.8.4.5

3 2

[libvirt] [PATCH] build: package .pc files for mingw64
by Eric Blake 09 Jul '14

09 Jul '14

Commit 65d8c92a fixed the mingw spec file for 32-bit builds, but forgot to make the adjustment for 64-bit builds: Checking for unpackaged file(s): /usr/lib/rpm/check-files /home/eblake/rpmbuild/BUILDROOT/mingw-libvirt-1.2.7-1.fc20.eblake1404944503.x86_64 error: Installed (but unpackaged) file(s) found: /usr/x86_64-w64-mingw32/sys-root/mingw/lib/pkgconfig/libvirt-lxc.pc /usr/x86_64-w64-mingw32/sys-root/mingw/lib/pkgconfig/libvirt-qemu.pc * mingw-libvirt.spec.in (%files): List missing .pc files. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule, since I detected it via ./autobuild.sh. Also backporting to v1.2.6-maint. mingw-libvirt.spec.in | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mingw-libvirt.spec.in b/mingw-libvirt.spec.in index a555f9c..a1e58cb 100644 --- a/mingw-libvirt.spec.in +++ b/mingw-libvirt.spec.in @@ -258,6 +258,8 @@ rm -rf $RPM_BUILD_ROOT%{mingw64_libexecdir}/libvirt-guests.sh %{mingw64_libdir}/libvirt.dll.a %{mingw64_libdir}/pkgconfig/libvirt.pc +%{mingw64_libdir}/pkgconfig/libvirt-qemu.pc +%{mingw64_libdir}/pkgconfig/libvirt-lxc.pc %{mingw64_libdir}/libvirt-lxc.dll.a %{mingw64_libdir}/libvirt-qemu.dll.a -- 1.9.3

1 0

[libvirt] [PATCH] build: fix gnulib build for mingw
by Eric Blake 09 Jul '14

09 Jul '14

Pavel flagged a build regression under mingw, and traced it to a recent flaw in gnulib for working around nl_langinfo. This picks up the fix. * gnulib: Update to latest, for mingw build fixes. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule * .gnulib 9d5efe7...2d28074 (2): > nl_langinfo: fix build under mingw > mountlist: do not classify a bind-mounted dir entry as "dummy" .gnulib | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gnulib b/.gnulib index 9d5efe7..2d28074 160000 --- a/.gnulib +++ b/.gnulib @@ -1 +1 @@ -Subproject commit 9d5efe7d61e1d96a6d7c97ffa4d21c5e33e9bd30 +Subproject commit 2d280742a9e30088aa169f53353765d5daafe4c0 -- 1.9.3

1 0

[libvirt] [PATCH v3] libxl: add discard support to libxl_device_disk
by Olaf Hering 09 Jul '14

09 Jul '14

Translate libvirt discard settings into libxl-4.5 discard settings. Signed-off-by: Olaf Hering <olaf(a)aepfle.de> --- v3: passing discard= with old libxl is now a fatal error v2: add cast to switch variable to let compiler check if the code handles all enum values src/libxl/libxl_conf.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/src/libxl/libxl_conf.c b/src/libxl/libxl_conf.c index 8eeaf82..538cfa4 100644 --- a/src/libxl/libxl_conf.c +++ b/src/libxl/libxl_conf.c @@ -715,6 +715,35 @@ libxlMakeDomBuildInfo(virDomainDefPtr def, return -1; } +static int +libxlDiskSetDiscard(libxl_device_disk *x_disk, int discard) +{ + if (!x_disk->readwrite) + return 0; +#if defined(LIBXL_HAVE_LIBXL_DEVICE_DISK_DISCARD_ENABLE) + switch ((enum virDomainDiskDiscard)discard) { + case VIR_DOMAIN_DISK_DISCARD_DEFAULT: + case VIR_DOMAIN_DISK_DISCARD_LAST: + break; + case VIR_DOMAIN_DISK_DISCARD_UNMAP: + libxl_defbool_set(&x_disk->discard_enable, true); + break; + case VIR_DOMAIN_DISK_DISCARD_IGNORE: + libxl_defbool_set(&x_disk->discard_enable, false); + break; + } + return 0; +#else + if (discard == VIR_DOMAIN_DISK_DISCARD_DEFAULT) + return 0; + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("This version of libxenlight does not support " + "disk 'discard' option passing")); + return -1; +#endif +} + + int libxlMakeDisk(virDomainDiskDefPtr l_disk, libxl_device_disk *x_disk) { @@ -829,6 +858,8 @@ libxlMakeDisk(virDomainDiskDefPtr l_disk, libxl_device_disk *x_disk) x_disk->removable = 1; x_disk->readwrite = !l_disk->readonly; x_disk->is_cdrom = l_disk->device == VIR_DOMAIN_DISK_DEVICE_CDROM ? 1 : 0; + if (libxlDiskSetDiscard(x_disk, l_disk->discard) < 0) + return -1; /* An empty CDROM must have the empty format, otherwise libxl fails. */ if (x_disk->is_cdrom && !x_disk->pdev_path) x_disk->format = LIBXL_DISK_FORMAT_EMPTY;

2 1

[libvirt] [libvirt-glib] [PATCH v4 0/3] Add API to fetch snapshots
by Timm Bäder 09 Jul '14

09 Jul '14

Argh, sorry about the earlier version, die last mail didn't get through the smtp server. This patchset replaces the old one and includes gvir_domain_fetch_snapshots_async as well as a version of gvir_domain_fetch_snapshots that works with it. Timm Bäder (3): libvirt-gobject-domain: Add _fetch_snapshots libvirt-gobject-domain: Add _get_snapshots GVirDomain: Add async version of _fetch_snapshots libvirt-gobject/libvirt-gobject-domain.c | 164 +++++++++++++++++++++++++++++++ libvirt-gobject/libvirt-gobject-domain.h | 51 ++++++++++ libvirt-gobject/libvirt-gobject.sym | 5 + 3 files changed, 220 insertions(+) -- 2.0.1

2 10

[libvirt] [PATCH] qemu: don't error out when cgroups don't exist
by Martin Kletzander 09 Jul '14

09 Jul '14

When creating cgroups for vcpu and emulator threads whilst starting a domain, we explicitly skip creating those cgroups in case priv->cgroup is NULL (cgroups not supported) because SetAffinity() serves the same purpose. If the host supports only some cgroups (the ones we need are either unmounted or disabled in qemu.conf), we error out with weird message even though we could continue starting the domain. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1097028 Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- src/qemu/qemu_cgroup.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c index 3394c68..0af6ac5 100644 --- a/src/qemu/qemu_cgroup.c +++ b/src/qemu/qemu_cgroup.c @@ -949,7 +949,11 @@ qemuSetupCgroupForVcpu(virDomainObjPtr vm) virCgroupFree(&cgroup_vcpu); } - return -1; + if (period || quota) + return -1; + + virResetLastError(); + return 0; } int @@ -1016,7 +1020,11 @@ qemuSetupCgroupForEmulator(virQEMUDriverPtr driver, virCgroupFree(&cgroup_emulator); } - return -1; + if (period || quota) + return -1; + + virResetLastError(); + return 0; } int -- 2.0.0

3 4

[libvirt] [PATCH] check for cfg->spiceTLS earlier in qemuProcessSPICEAllocatePorts
by Ján Tomko 09 Jul '14

09 Jul '14

This saves a few lines of code and catches the error when: <spice autoport ='yes' defaultMode='any' ..> <channel name='main' mode='secure'/> </spice> is specified with spice_tls = 0 in qemu.conf. Instead of this error in qemuBuildGraphicsSPICECommandLine: error: unsupported configuration: spice secure channels set in XML configuration, but TLS port is not provided an error is reported in qemuProcessSPICEAllocatePorts: error: unsupported configuration: Auto allocation of spice TLS port requested but spice TLS is disabled in qemu.conf Inspired by: https://www.redhat.com/archives/libvir-list/2014-June/msg01408.html --- src/qemu/qemu_process.c | 33 +++++++++++---------------------- 1 file changed, 11 insertions(+), 22 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 570960e..ccc571b 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -3534,7 +3534,8 @@ qemuProcessSPICEAllocatePorts(virQEMUDriverPtr driver, break; case VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_ANY: - needTLSPort = true; + if (cfg->spiceTLS) + needTLSPort = true; needPort = true; break; } @@ -3552,28 +3553,16 @@ qemuProcessSPICEAllocatePorts(virQEMUDriverPtr driver, if (needTLSPort || graphics->data.spice.tlsPort == -1) { if (!cfg->spiceTLS) { - /* log an error and fail if tls was specifically - * requested, or simply ignore (don't allocate a port) - * if we're here due to "defaultMode='any'" - * (aka unspecified). - */ - if ((graphics->data.spice.tlsPort == -1) || - (graphics->data.spice.defaultMode - == VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_SECURE)) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("Auto allocation of spice TLS port requested " - "but spice TLS is disabled in qemu.conf")); - goto error; - } - } else { - /* cfg->spiceTLS *is* in place, so it makes sense to - * allocate a port. - */ - if (virPortAllocatorAcquire(driver->remotePorts, &tlsPort) < 0) - goto error; - - graphics->data.spice.tlsPort = tlsPort; + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Auto allocation of spice TLS port requested " + "but spice TLS is disabled in qemu.conf")); + goto error; } + + if (virPortAllocatorAcquire(driver->remotePorts, &tlsPort) < 0) + goto error; + + graphics->data.spice.tlsPort = tlsPort; } return 0; -- 1.8.5.5

2 1

[libvirt] [PATCH] util: storage: Fix build after 25924dec0f9329d429aadae14e273602307e2214
by Peter Krempa 09 Jul '14

09 Jul '14

The commit referenced above changed function arguments of virStorageFileGetMetadataFromBuf() but didn't tweak the ATTRIBUTE_NONNULL tied to them. This was caught by coverity as it actually obeys them. We disabled them for GCC and thus it didn't show up. Additionally in commit 3ea661deeabadc3c114dfb6f662b9fd17d714a01 I passed NULL to the backingFormat argument which was also marked as nonnull. Use a dummy int's address when the argument isn't supplied so that the code doesn't need to change much. --- src/util/virstoragefile.c | 4 ++++ src/util/virstoragefile.h | 3 +-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/src/util/virstoragefile.c b/src/util/virstoragefile.c index 505b652..de0e27a 100644 --- a/src/util/virstoragefile.c +++ b/src/util/virstoragefile.c @@ -955,6 +955,10 @@ virStorageFileGetMetadataFromBuf(const char *path, int *backingFormat) { virStorageSourcePtr ret = NULL; + int dummy; + + if (!backingFormat) + backingFormat = &dummy; if (!(ret = virStorageFileMetadataNew(path, format))) return NULL; diff --git a/src/util/virstoragefile.h b/src/util/virstoragefile.h index 744a6ba..528cfad 100644 --- a/src/util/virstoragefile.h +++ b/src/util/virstoragefile.h @@ -301,8 +301,7 @@ virStorageSourcePtr virStorageFileGetMetadataFromBuf(const char *path, size_t len, int format, int *backingFormat) - ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(4) - ATTRIBUTE_NONNULL(5); + ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2); int virStorageFileChainGetBroken(virStorageSourcePtr chain, char **broken_file); -- 2.0.0

3 4

[libvirt] [PATCH 0/3] Couple of seclabels improvements
by Michal Privoznik 09 Jul '14

09 Jul '14

Yes, the first two patches basically revert 693eac388f1759d. Only the last one fixes a real problem. Michal Privoznik (3): virSecurityLabelDef: substitute 'norelabel' with 'relabel' virSecurityDeviceLabelDef: substitute 'norelabel' with 'relabel' conf: Disallow <seclabel type='none' relabel='yes'/> src/conf/domain_conf.c | 40 +++++++++++++++++++++++----------------- src/security/security_apparmor.c | 10 +++++----- src/security/security_dac.c | 22 +++++++++++----------- src/security/security_manager.c | 2 +- src/security/security_selinux.c | 32 ++++++++++++++------------------ src/util/virseclabel.c | 2 +- src/util/virseclabel.h | 4 ++-- 7 files changed, 57 insertions(+), 55 deletions(-) -- 1.8.5.5

1 3

[libvirt] [PATCHv2] conf: Improve metadata type verification
by Peter Krempa 09 Jul '14

09 Jul '14

Split out checking of invalid metadata type from the switch statement so that we can use the typecasted enum value to allow tracking addition of new items by the compliler. Also avoids two dead-code break statements. --- Version 2: - move the check back to the original function so that we don't break forward compat src/conf/domain_conf.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index b80e7cf..fa76eb4 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -19575,6 +19575,12 @@ virDomainObjGetMetadata(virDomainObjPtr vm, virCheckFlags(VIR_DOMAIN_AFFECT_LIVE | VIR_DOMAIN_AFFECT_CONFIG, NULL); + if (type >= VIR_DOMAIN_METADATA_LAST) { + virReportError(VIR_ERR_INVALID_ARG, + _("unknown metadata type '%d'"), type); + goto cleanup; + } + if (virDomainLiveConfigHelperMethod(caps, xmlopt, vm, &flags, &def) < 0) goto cleanup; @@ -19601,10 +19607,7 @@ virDomainObjGetMetadata(virDomainObjPtr vm, goto cleanup; break; - default: - virReportError(VIR_ERR_INVALID_ARG, "%s", - _("unknown metadata type")); - goto cleanup; + case VIR_DOMAIN_METADATA_LAST: break; } @@ -19630,6 +19633,12 @@ virDomainDefSetMetadata(virDomainDefPtr def, char *tmp; int ret = -1; + if (type >= VIR_DOMAIN_METADATA_LAST) { + virReportError(VIR_ERR_INVALID_ARG, + _("unknown metadata type '%d'"), type); + goto cleanup; + } + switch ((virDomainMetadataType) type) { case VIR_DOMAIN_METADATA_DESCRIPTION: if (VIR_STRDUP(tmp, metadata) < 0) @@ -19683,10 +19692,7 @@ virDomainDefSetMetadata(virDomainDefPtr def, } break; - default: - virReportError(VIR_ERR_INVALID_ARG, "%s", - _("unknown metadata type")); - goto cleanup; + case VIR_DOMAIN_METADATA_LAST: break; } -- 2.0.0

2 2

[libvirt] [PATCH] virsh: document the possibility of accepting integers for numatune mode
by Martin Kletzander 09 Jul '14

09 Jul '14

According to the code, 'virsh numatune' supports integers for specifying --mode as well as the string definitions "strict", "interleave", and "preferred". However, this possibility was not documented anywhere, so this patch adds it to both the man page and command help. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1085706 Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- tools/virsh-domain.c | 3 ++- tools/virsh.pod | 8 +++++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c index b5b9f91..5a17aff 100644 --- a/tools/virsh-domain.c +++ b/tools/virsh-domain.c @@ -7823,7 +7823,8 @@ static const vshCmdOptDef opts_numatune[] = { }, {.name = "mode", .type = VSH_OT_DATA, - .help = N_("NUMA mode, one of strict, preferred and interleave") + .help = N_("NUMA mode, one of strict, preferred and interleave \n" + "or a number from the virDomainNumatuneMemMode enum") }, {.name = "nodeset", .type = VSH_OT_DATA, diff --git a/tools/virsh.pod b/tools/virsh.pod index 99d0b74..a5e8406 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -1402,9 +1402,11 @@ Set or get a domain's numa parameters, corresponding to the <numatune> element of domain XML. Without flags, the current settings are displayed. -I<mode> can be one of `strict', `interleave' and `preferred'. For a -running domain, the mode can't be changed, and the nodeset can be -changed only if the domain was started with a mode of `strict'. +I<mode> can be one of `strict', `interleave' and `preferred' or any +valid number from the virDomainNumatuneMemMode enum in case the daemon +supports it. For a running domain, the mode can't be changed, and the +nodeset can be changed only if the domain was started with a mode of +`strict'. I<nodeset> is a list of numa nodes used by the host for running the domain. Its syntax is a comma separated list, with '-' for ranges and '^' for -- 2.0.0

2 1

[libvirt] Build failed in Jenkins: libvirt-syntax-check #2465
by Jenkins CI 09 Jul '14

09 Jul '14

See <http://honk.sigxcpu.org:8001/job/libvirt-syntax-check/2465/> ------------------------------------------ [...truncated 148 lines...] 0.43 prohibit_empty_lines_at_EOF prohibit_error_without_use grep: write error grep: write error /bin/sed: couldn't write 25 items to stdout: Broken pipe sed: couldn't write 1 item to stdout: Broken pipe 0.48 prohibit_error_without_use prohibit_exit_in_tests 0.53 prohibit_exit_in_tests prohibit_fork_wrappers 0.72 prohibit_fork_wrappers prohibit_getenv 0.63 prohibit_getenv prohibit_gethostby 0.61 prohibit_gethostby prohibit_gethostname 0.62 prohibit_gethostname prohibit_getopt_without_use grep: write error grep: write error /bin/sed: couldn't write 25 items to stdout: Broken pipe sed: couldn't write 1 item to stdout: Broken pipe 0.45 prohibit_getopt_without_use prohibit_gettext_markup 0.66 prohibit_gettext_markup prohibit_gettext_noop 0.62 prohibit_gettext_noop prohibit_hash_pjw_without_use grep: write error grep: write error /bin/sed: couldn't write 60 items to stdout: Broken pipe sed: couldn't write 1 item to stdout: Broken pipe 0.43 prohibit_hash_pjw_without_use prohibit_have_config_h 0.65 prohibit_have_config_h prohibit_ignore_value_without_use grep: write error grep: write error /bin/sed: couldn't write 25 items to stdout: Broken pipe sed: couldn't write 1 item to stdout: Broken pipe 0.50 prohibit_ignore_value_without_use prohibit_include_public_headers_brackets 0.60 prohibit_include_public_headers_brackets prohibit_include_public_headers_quote 0.44 prohibit_include_public_headers_quote prohibit_int_ijk 0.84 prohibit_int_ijk prohibit_internal_functions 0.78 prohibit_internal_functions prohibit_intprops_without_use grep: write error grep: write error /bin/sed: couldn't write 25 items to stdout: Broken pipe sed: couldn't write 1 item to stdout: Broken pipe 0.40 prohibit_intprops_without_use prohibit_inttostr_without_use grep: write error grep: write error /bin/sed: couldn't write 25 items to stdout: Broken pipe sed: couldn't write 1 item to stdout: Broken pipe 0.43 prohibit_inttostr_without_use prohibit_libgen 0.83 prohibit_libgen prohibit_long_lines 0.56 prohibit_long_lines prohibit_long_options_without_use grep: write error grep: write error /bin/sed: couldn't write 25 items to stdout: Broken pipe sed: couldn't write 1 item to stdout: Broken pipe 0.44 prohibit_long_options_without_use prohibit_loop_iijjkk 0.80 prohibit_loop_iijjkk prohibit_loop_var_decl 0.46 prohibit_loop_var_decl prohibit_magic_number_exit 0.98 prohibit_magic_number_exit prohibit_mixed_case_abbreviations 0.49 prohibit_mixed_case_abbreviations prohibit_mkstemp 0.58 prohibit_mkstemp prohibit_newline_at_end_of_diagnostic 0.61 prohibit_newline_at_end_of_diagnostic prohibit_nonreentrant 27.36 prohibit_nonreentrant prohibit_openat_without_use grep: write error grep: write error /bin/sed: couldn't write 25 items to stdout: Broken pipe sed: couldn't write 1 item to stdout: Broken pipe 0.43 prohibit_openat_without_use prohibit_path_max_allocation 0.62 prohibit_path_max_allocation prohibit_posixver_without_use grep: write error grep: write error /bin/sed: couldn't write 25 items to stdout: Broken pipe sed: couldn't write 1 item to stdout: Broken pipe 0.42 prohibit_posixver_without_use prohibit_raw_allocation 0.68 prohibit_raw_allocation prohibit_readdir 0.56 prohibit_readdir prohibit_readlink 0.63 prohibit_readlink prohibit_return_as_function 0.61 prohibit_return_as_function prohibit_reversed_compare_failure 0.49 prohibit_reversed_compare_failure prohibit_risky_id_promotion 0.65 prohibit_risky_id_promotion prohibit_root_dev_ino_without_use grep: write error grep: write error /bin/sed: couldn't write 25 items to stdout: Broken pipe sed: couldn't write 1 item to stdout: Broken pipe 0.40 prohibit_root_dev_ino_without_use prohibit_safe_read_without_use grep: write error grep: write error /bin/sed: couldn't write 43 items to stdout: Broken pipe sed: couldn't write 60 items to stdout: Broken pipe 0.38 prohibit_safe_read_without_use prohibit_same_without_use grep: write error grep: write error /bin/sed: couldn't write 1 item to stdout: Broken pipe sed: couldn't write 60 items to stdout: Broken pipe 0.39 prohibit_same_without_use prohibit_select 0.64 prohibit_select prohibit_semicolon_at_eol_in_python 0.30 prohibit_semicolon_at_eol_in_python prohibit_setuid 0.64 prohibit_setuid prohibit_signal_without_use grep: write error grep: write error /bin/sed: couldn't write 25 items to stdout: Broken pipe sed: couldn't write 60 items to stdout: Broken pipe 0.42 prohibit_signal_without_use prohibit_sprintf 0.65 prohibit_sprintf prohibit_stddef_without_use grep: write error grep: write error /bin/sed: couldn't write 25 items to stdout: Broken pipe sed: couldn't write 1 item to stdout: Broken pipe 0.40 prohibit_stddef_without_use prohibit_stdio--_without_use grep: write error grep: write error /bin/sed: couldn't write 25 items to stdout: Broken pipe sed: couldn't write 1 item to stdout: Broken pipe 0.40 prohibit_stdio--_without_use prohibit_stdio-safer_without_use grep: write error grep: write error /bin/sed: couldn't write 25 items to stdout: Broken pipe sed: couldn't write 1 item to stdout: Broken pipe 0.37 prohibit_stdio-safer_without_use prohibit_strcmp 0.59 prohibit_strcmp prohibit_strdup 0.61 prohibit_strdup prohibit_strings_without_use grep: write error grep: write error /bin/sed: couldn't write 25 items to stdout: Broken pipe sed: couldn't write 1 item to stdout: Broken pipe 0.36 prohibit_strings_without_use prohibit_strncmp 0.66 prohibit_strncmp prohibit_strncpy 0.59 prohibit_strncpy prohibit_strtol 1.19 prohibit_strtol prohibit_test_double_equal 0.44 prohibit_test_double_equal prohibit_test_minus_ao 0.67 prohibit_test_minus_ao prohibit_unbounded_arrays_in_rpc 0.24 prohibit_unbounded_arrays_in_rpc prohibit_undesirable_word_seq 31.97 prohibit_undesirable_word_seq prohibit_useless_translation 1.09 prohibit_useless_translation prohibit_verify_without_use grep: write error grep: write error /bin/sed: couldn't write 25 items to stdout: Broken pipe sed: couldn't write 1 item to stdout: Broken pipe 0.42 prohibit_verify_without_use prohibit_virBufferAdd_with_string_literal 0.57 prohibit_virBufferAdd_with_string_literal prohibit_virBufferAsprintf_with_string_literal 0.55 prohibit_virBufferAsprintf_with_string_literal prohibit_virConnectOpen_in_virsh 0.25 prohibit_virConnectOpen_in_virsh prohibit_windows_special_chars_in_filename 0.15 prohibit_windows_special_chars_in_filename prohibit_wrong_filename_in_comment 0.70 prohibit_wrong_filename_in_comment prohibit_xalloc_without_use grep: write error grep: write error /bin/sed: couldn't write 25 items to stdout: Broken pipe sed: couldn't write 1 item to stdout: Broken pipe 0.37 prohibit_xalloc_without_use prohibit_xfreopen_without_use grep: write error grep: write error /bin/sed: couldn't write 25 items to stdout: Broken pipe sed: couldn't write 1 item to stdout: Broken pipe 0.36 prohibit_xfreopen_without_use prohibit_xmlGetProp 0.54 prohibit_xmlGetProp prohibit_xmlURI 0.59 prohibit_xmlURI proper_name_utf8_requires_ICONV 0.38 proper_name_utf8_requires_ICONV redundant_const 0.61 redundant_const require_config_h 0.30 require_config_h require_config_h_first grep: write error grep: write error /bin/sed: couldn't write 43 items to stdout: Broken pipe sed: couldn't write 60 items to stdout: Broken pipe 7.92 require_config_h_first require_enum_last_marker 0.46 require_enum_last_marker require_locale_h 0.47 require_locale_h require_space_before_label 0.43 require_space_before_label require_whitespace_in_translation 1.00 require_whitespace_in_translation size_of_brackets 0.63 size_of_brackets spec_indentation cppi: libvirt.spec.in: line 771: not properly indented cppi: libvirt.spec.in: line 773: not properly indented cppi: libvirt.spec.in: line 788: not properly indented cppi: libvirt.spec.in: line 790: not properly indented maint.mk: incorrect preprocessor indentation make: *** [sc_spec_indentation] Error 1 Build step 'Execute shell' marked build as failure

5 5

[libvirt] [PATCHv5 00/28] Refactor changing of domain disk source
by Peter Krempa 09 Jul '14

09 Jul '14

v4 wasn't reviewed, but recent patches caused pretty serious conflicts thus I'm posting a rebased version. Note that one of the patches was already pushed as a part of a different series. This series is also a preparation for fixing issue with libvirt not setting correct permissions on gluster volumes. Peter Krempa (28): storage: Implement virStorageFileCreate for local and gluster files qemu: Don't propagate whole disk definition into qemuDomainGetImageIds qemu: Add helper to initialize storage file backend with correct uid/gid storage: file: Tolerate NULL src when uninitializing the backend conf: Don't output seclabels for backingStore elements storage: Move readonly and shared flags to disk source from disk def util: storagefile: Add deep copy for struct virStorageSource util: storage: Add function to transfer config parts to new chain element util: storage: Copy parent's disk metadata to backing chain elements util: cgroup: Add helper to convert device mode to string qemu: cgroup: Add functions to set cgroup image stuff on individual imgs qemu: cgroup: Setup only the top level disk image for read-write access locking: Add APIs to lock individual image files security: Introduce APIs to label single images security: selinux: Implement per-image seclabel restore security: selinux: Implement per-image seclabel set security: DAC: Implement per-image seclabel restore security: DAC: Implement per-image seclabel set security: AppArmor: Implement per-image seclabel restore security: AppArmor: Implement per-image seclabel set util: storage: Make virStorageFileChainLookup more network storage aware util: storage: Return complete parent info from virStorageFileChainLookup qemu: blockcopy: Use the mirror disk source to label the files qemu: block: Properly track disk source while pivotting to new image qemu: snapshot: Improve approach to deal with snapshot metadata qemu: Refactor qemuDomainPrepareDiskChainElement qemu: snapshot: Refactor image labelling of new snapshot files qemu: snapshot: Use storage driver to pre-create snapshot file src/conf/domain_conf.c | 77 +++++--- src/conf/domain_conf.h | 2 - src/libvirt_private.syms | 7 + src/libxl/libxl_conf.c | 2 +- src/locking/domain_lock.c | 65 ++++--- src/locking/domain_lock.h | 8 + src/lxc/lxc_cgroup.c | 2 +- src/lxc/lxc_controller.c | 2 +- src/lxc/lxc_driver.c | 2 +- src/qemu/qemu_cgroup.c | 109 ++++++----- src/qemu/qemu_cgroup.h | 3 + src/qemu/qemu_command.c | 14 +- src/qemu/qemu_conf.c | 4 +- src/qemu/qemu_domain.c | 29 ++- src/qemu/qemu_domain.h | 4 + src/qemu/qemu_driver.c | 350 +++++++++++----------------------- src/qemu/qemu_migration.c | 16 +- src/security/security_apparmor.c | 55 ++++-- src/security/security_dac.c | 111 +++++------ src/security/security_driver.h | 10 + src/security/security_manager.c | 56 ++++++ src/security/security_manager.h | 7 + src/security/security_nop.c | 19 ++ src/security/security_selinux.c | 150 +++++++++------ src/security/security_stack.c | 38 ++++ src/security/virt-aa-helper.c | 2 +- src/storage/storage_backend_fs.c | 17 ++ src/storage/storage_backend_gluster.c | 28 +++ src/storage/storage_driver.c | 2 +- src/util/vircgroup.c | 62 ++++-- src/util/vircgroup.h | 2 + src/util/virstoragefile.c | 280 ++++++++++++++++++++++++--- src/util/virstoragefile.h | 14 +- src/vbox/vbox_tmpl.c | 30 +-- src/xenxs/xen_sxpr.c | 10 +- src/xenxs/xen_xm.c | 10 +- tests/virstoragetest.c | 86 ++++----- 37 files changed, 1075 insertions(+), 610 deletions(-) -- 1.9.3

2 59

[libvirt] [PATCH] qemu: fix domxml-to-native failing when spice_tls is not enabled
by Jincheng Miao 09 Jul '14

09 Jul '14

The default graphics channel mode is 'any', so as to defaultMode attribute. If defaultMode and channel mode are all the default value 'any', qemuConnectDomainXMLToNative will set TLSPort. But in qemuBuildGraphicsSPICECommandLine, if spice_tls is not enabled, libvirtd will report an error to tell the user that spice TLS is disabled in qemu.conf. So qemuConnectDomainXMLToNative should check spice_tls is enabled, then decide to allocate an tlsPort number to this graphics. If user specified defaultMode is 'secure', qemuConnectDomainXMLToNative could allocate tlsPort, and then let qemuBuildGraphicsSPICECommandLine reports the spice_tls disabled error. The related bug is: https://bugzilla.redhat.com/show_bug.cgi?id=1113868 Signed-off-by: Jincheng Miao <jmiao(a)redhat.com> --- src/qemu/qemu_driver.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index d34da6f..d1e3b2f 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6013,7 +6013,8 @@ static char *qemuConnectDomainXMLToNative(virConnectPtr conn, break; case VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_ANY: - needTLSPort = true; + if (cfg->spiceTLS) + needTLSPort = true; needPort = true; break; } -- 1.7.1

2 2