- Devel - libvirt List Archives

[libvirt] [PATCH v6 0/4] support dumping guest memory in compressed format
by qiaonuohan＠cn.fujitsu.com 17 Mar '14

17 Mar '14

dumping guest's memory is introduced without compression supported, but now qemu can dump guest's memory in kdump-compressed format. This patchset is used to add support in libvirt side to let qemu do the dump in compressed format and please refer the following address to see implementation of the qemu side, the lastest version of qemu side is v9. http://lists.nongnu.org/archive/html/qemu-devel/2014-02/msg03016.html ChangLog: Changes from v5 to v6: 1. add qemuMonitorGetDumpGuestMemoryCapability API to check the available dump format Changes from v4 to v5: 1. modify some restriction check Changes from v3 to v4: 1. dropping patch "add dump_memory_format in qemu.conf" 2. fix to follow some conventions Changes from v2 to v3: 1. address Jiri Denemark's comment about adding a new public API instead of changing an old one. Changes from v1 to v2: 1. address Daniel P. Berrange's comment about using a new parameter to replace flags like VIR_DUMP_COMPRESS_ZLIB. qiaonuohan (4): add new virDomainCoreDumpWithFormat API qemu: add qemuMonitorGetDumpGuestMemoryCapability qemu: add support for virDomainCoreDumpWithFormat API allow "virsh dump --memory-only" specify dump format include/libvirt/libvirt.h.in | 8 ++++ src/driver.h | 7 ++++ src/libvirt.c | 92 ++++++++++++++++++++++++++++++++++++++++++++ src/libvirt_public.syms | 5 +++ src/qemu/qemu_driver.c | 50 +++++++++++++++++++----- src/qemu/qemu_monitor.c | 27 +++++++++++-- src/qemu/qemu_monitor.h | 6 ++- src/qemu/qemu_monitor_json.c | 86 ++++++++++++++++++++++++++++++++++++++--- src/qemu/qemu_monitor_json.h | 6 ++- src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 15 +++++++- src/remote_protocol-structs | 7 ++++ src/test/test_driver.c | 21 ++++++++-- tests/qemumonitorjsontest.c | 2 +- tools/virsh-domain.c | 30 +++++++++++++-- tools/virsh.pod | 6 +++ 16 files changed, 342 insertions(+), 27 deletions(-) -- 1.8.5.3

2 5

[libvirt] [PATCH v2 0/5] Expose FSFreeze/FSThaw within the guest as API
by Tomoki Sekiyama 15 Mar '14

15 Mar '14

Hello, This is patchset v2 to add FSFreeze/FSThaw API for custom disk snapshotting. Changes to v1: * added quiesced status tracking to avoid double fsfreeze in qemu driver * removed unused 'mountPoint' argument * use "@acl: domain:write" in remote driver * rebased to master (v1: http://www.redhat.com/archives/libvir-list/2013-November/msg00610.html ) === Description === Currently FSFreeze and FSThaw are supported by qemu guest agent and they are used internally in snapshot-create command with --quiesce option. However, when users want to utilize the native snapshot feature of storage devices (such as LVM over iSCSI, enterprise storage appliances, etc.), they need to issue fsfreeze command separately from libvirt-driven snapshots. (OpenStack cinder provides these storages' snapshot feature, but it cannot quiesce the guest filesystems automatically for now.) Although virDomainQemuGuestAgent() API could be used for this purpose, it is only for debugging and is not supported officially. This patchset adds virDomainFSFreeze()/virDomainFSThaw() APIs and virsh domfsfreeze/domfsthaw commands to enable the users to freeze and thaw domain's filesystems cleanly. The APIs have flags option currently unsupported for future extension. --- Tomoki Sekiyama (5): Introduce virDomainFSFreeze() and virDomainFSThaw() public API remote: Implement virDomainFSFreeze and virDomainFSThaw qemu: Track domain quiesced status qemu: Implement virDomainFSFreeze and virDomainFSThaw virsh: Expose new virDomainFSFreeze and virDomainFSThaw API include/libvirt/libvirt.h.in | 6 ++ src/driver.h | 10 ++++ src/libvirt.c | 70 +++++++++++++++++++++++++ src/libvirt_public.syms | 5 ++ src/qemu/qemu_domain.h | 2 + src/qemu/qemu_driver.c | 119 ++++++++++++++++++++++++++++++++++++++---- src/remote/remote_driver.c | 2 + src/remote/remote_protocol.x | 23 ++++++++ src/remote_protocol-structs | 9 +++ src/rpc/gendispatch.pl | 2 + tools/virsh-domain.c | 92 ++++++++++++++++++++++++++++++++ tools/virsh.pod | 15 +++++ 12 files changed, 344 insertions(+), 11 deletions(-)

2 12

[libvirt] [PATCH] libvirt-tck: Ignore SIGPIPE in 051-daemon-hook.t
by Mike Latimer 14 Mar '14

14 Mar '14

This test completes successfully, but results in a return code of 141 due to a broken pipe when restarting libvirtd. This patch just masks the SIGPIPE and undefines $tck to avoid the 141 return code. If there is a way to reestablish the tck connection after the restart, that would be a better solution. --- scripts/hooks/051-daemon-hook.t | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/scripts/hooks/051-daemon-hook.t b/scripts/hooks/051-daemon-hook.t index 165cf4e..a6c3d03 100644 --- a/scripts/hooks/051-daemon-hook.t +++ b/scripts/hooks/051-daemon-hook.t @@ -163,5 +163,10 @@ SKIP: { ok(`service libvirtd status` =~ /running/, "libvirtd is running"); $hook->cleanup(); + + # Restarting libvirtd broke the tck connection, so ignore sigpipe and + # undefine $tck to avoid a return code of 141 + $SIG{PIPE} = 'IGNORE'; + undef $tck; }; -- 1.8.4.5

2 4

[libvirt] [PATCH v2 1/3] qemu: XMLToNative: Don't show -S
by Cole Robinson 14 Mar '14

14 Mar '14

-S causes qemu to start in the paused state. Since XML2Native is intended to generate something that users can run directly, this will trip them up. --- v2: s/forXMLToArgv/standalone/g src/qemu/qemu_command.c | 8 ++++++-- src/qemu/qemu_command.h | 3 ++- src/qemu/qemu_driver.c | 6 ++++-- src/qemu/qemu_process.c | 2 +- tests/qemuxml2argvtest.c | 2 +- tests/qemuxmlnstest.c | 2 +- 6 files changed, 15 insertions(+), 8 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index aa1a3db..3e6a172 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -7711,7 +7711,8 @@ qemuBuildCommandLine(virConnectPtr conn, int migrateFd, virDomainSnapshotObjPtr snapshot, enum virNetDevVPortProfileOp vmop, - qemuBuildCommandLineCallbacksPtr callbacks) + qemuBuildCommandLineCallbacksPtr callbacks, + bool standalone) { virErrorPtr originalError = NULL; size_t i, j; @@ -7820,7 +7821,10 @@ qemuBuildCommandLine(virConnectPtr conn, virCommandAddArg(cmd, def->name); } } - virCommandAddArg(cmd, "-S"); /* freeze CPU */ + + if (!standalone) + virCommandAddArg(cmd, "-S"); /* freeze CPU */ + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_ENABLE_FIPS)) virCommandAddArg(cmd, "-enable-fips"); diff --git a/src/qemu/qemu_command.h b/src/qemu/qemu_command.h index ebb0b1d..50dc4a0 100644 --- a/src/qemu/qemu_command.h +++ b/src/qemu/qemu_command.h @@ -76,7 +76,8 @@ virCommandPtr qemuBuildCommandLine(virConnectPtr conn, int migrateFd, virDomainSnapshotObjPtr current_snapshot, enum virNetDevVPortProfileOp vmop, - qemuBuildCommandLineCallbacksPtr callbacks) + qemuBuildCommandLineCallbacksPtr callbacks, + bool forXMLToArgv) ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(11); /* Generate '-device' string for chardev device */ diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index ba470a1..a01739c 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5956,8 +5956,10 @@ static char *qemuConnectDomainXMLToNative(virConnectPtr conn, if (!(cmd = qemuBuildCommandLine(conn, driver, def, &monConfig, monitor_json, qemuCaps, - NULL, -1, NULL, VIR_NETDEV_VPORT_PROFILE_OP_NO_OP, - &buildCommandLineCallbacks))) + NULL, -1, NULL, + VIR_NETDEV_VPORT_PROFILE_OP_NO_OP, + &buildCommandLineCallbacks, + true))) goto cleanup; ret = virCommandToString(cmd); diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 809ab37..35ad62a 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -3856,7 +3856,7 @@ int qemuProcessStart(virConnectPtr conn, if (!(cmd = qemuBuildCommandLine(conn, driver, vm->def, priv->monConfig, priv->monJSON, priv->qemuCaps, migrateFrom, stdin_fd, snapshot, vmop, - &buildCommandLineCallbacks))) + &buildCommandLineCallbacks, false))) goto cleanup; /* now that we know it is about to start call the hook if present */ diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 5d6a64b..8d7d9e5 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -357,7 +357,7 @@ static int testCompareXMLToArgvFiles(const char *xml, (flags & FLAG_JSON), extraFlags, migrateFrom, migrateFd, NULL, VIR_NETDEV_VPORT_PROFILE_OP_NO_OP, - &testCallbacks))) { + &testCallbacks, false))) { if (!virtTestOOMActive() && (flags & FLAG_EXPECT_FAILURE)) { ret = 0; diff --git a/tests/qemuxmlnstest.c b/tests/qemuxmlnstest.c index 20a5ccd..81d496e 100644 --- a/tests/qemuxmlnstest.c +++ b/tests/qemuxmlnstest.c @@ -119,7 +119,7 @@ static int testCompareXMLToArgvFiles(const char *xml, vmdef, &monitor_chr, json, extraFlags, migrateFrom, migrateFd, NULL, VIR_NETDEV_VPORT_PROFILE_OP_NO_OP, - &testCallbacks))) + &testCallbacks, false))) goto fail; if (!virtTestOOMActive()) { -- 1.8.5.3

2 4

[libvirt] [PATCH v3] qemu: cleanup tap devices on FreeBSD
by Roman Bogorodskiy 14 Mar '14

14 Mar '14

We have to explicitly destroy TAP devices on FreeBSD because they're not freed after being closed, otherwise we end up with orphaned TAP devices after destroying a domain. --- src/qemu/qemu_process.c | 14 ++++++++++++-- src/util/virnetdevtap.h | 6 ++++++ 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index ffa939a..d1acafc 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -4373,7 +4373,10 @@ void qemuProcessStop(virQEMUDriverPtr driver, def = vm->def; for (i = 0; i < def->nnets; i++) { virDomainNetDefPtr net = def->nets[i]; - if (virDomainNetGetActualType(net) == VIR_DOMAIN_NET_TYPE_DIRECT) { + vport = virDomainNetGetActualVirtPortProfile(net); + + switch (virDomainNetGetActualType(net)) { + case VIR_DOMAIN_NET_TYPE_DIRECT: ignore_value(virNetDevMacVLanDeleteWithVPortProfile( net->ifname, &net->mac, virDomainNetGetActualDirectDev(net), @@ -4381,11 +4384,18 @@ void qemuProcessStop(virQEMUDriverPtr driver, virDomainNetGetActualVirtPortProfile(net), cfg->stateDir)); VIR_FREE(net->ifname); + break; + case VIR_DOMAIN_NET_TYPE_BRIDGE: + case VIR_DOMAIN_NET_TYPE_NETWORK: +#ifdef VIR_NETDEV_TAP_REQUIRE_MANUAL_CLEANUP + if (!(vport && vport->virtPortType == VIR_NETDEV_VPORT_PROFILE_OPENVSWITCH)) + ignore_value(virNetDevTapDelete(net->ifname)); +#endif + break; } /* release the physical device (or any other resources used by * this interface in the network driver */ - vport = virDomainNetGetActualVirtPortProfile(net); if (vport && vport->virtPortType == VIR_NETDEV_VPORT_PROFILE_OPENVSWITCH) ignore_value(virNetDevOpenvswitchRemovePort( virDomainNetGetActualBridgeName(net), diff --git a/src/util/virnetdevtap.h b/src/util/virnetdevtap.h index a762b31..1e5bd19 100644 --- a/src/util/virnetdevtap.h +++ b/src/util/virnetdevtap.h @@ -27,6 +27,12 @@ # include "virnetdevvportprofile.h" # include "virnetdevvlan.h" +# ifdef __FreeBSD__ +/* This should be defined on OSes that don't automatically + * cleanup released devices */ +# define VIR_NETDEV_TAP_REQUIRE_MANUAL_CLEANUP 1 +# endif + int virNetDevTapCreate(char **ifname, int *tapfd, int tapfdSize, -- 1.8.4.3

2 1

[libvirt] [PATCH 1/3] qemu: XMLToNative: Don't show -S
by Cole Robinson 14 Mar '14

14 Mar '14

-S causes qemu to start in the paused state. Since XML2Native is intended to generate something that users can run directly, this will trip them up. --- src/qemu/qemu_command.c | 8 ++++++-- src/qemu/qemu_command.h | 3 ++- src/qemu/qemu_driver.c | 6 ++++-- src/qemu/qemu_process.c | 2 +- tests/qemuxml2argvtest.c | 2 +- tests/qemuxmlnstest.c | 2 +- 6 files changed, 15 insertions(+), 8 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index aa1a3db..755a72a 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -7711,7 +7711,8 @@ qemuBuildCommandLine(virConnectPtr conn, int migrateFd, virDomainSnapshotObjPtr snapshot, enum virNetDevVPortProfileOp vmop, - qemuBuildCommandLineCallbacksPtr callbacks) + qemuBuildCommandLineCallbacksPtr callbacks, + bool forXMLToArgv) { virErrorPtr originalError = NULL; size_t i, j; @@ -7820,7 +7821,10 @@ qemuBuildCommandLine(virConnectPtr conn, virCommandAddArg(cmd, def->name); } } - virCommandAddArg(cmd, "-S"); /* freeze CPU */ + + if (!forXMLToArgv) + virCommandAddArg(cmd, "-S"); /* freeze CPU */ + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_ENABLE_FIPS)) virCommandAddArg(cmd, "-enable-fips"); diff --git a/src/qemu/qemu_command.h b/src/qemu/qemu_command.h index ebb0b1d..50dc4a0 100644 --- a/src/qemu/qemu_command.h +++ b/src/qemu/qemu_command.h @@ -76,7 +76,8 @@ virCommandPtr qemuBuildCommandLine(virConnectPtr conn, int migrateFd, virDomainSnapshotObjPtr current_snapshot, enum virNetDevVPortProfileOp vmop, - qemuBuildCommandLineCallbacksPtr callbacks) + qemuBuildCommandLineCallbacksPtr callbacks, + bool forXMLToArgv) ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(11); /* Generate '-device' string for chardev device */ diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index ba470a1..a01739c 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5956,8 +5956,10 @@ static char *qemuConnectDomainXMLToNative(virConnectPtr conn, if (!(cmd = qemuBuildCommandLine(conn, driver, def, &monConfig, monitor_json, qemuCaps, - NULL, -1, NULL, VIR_NETDEV_VPORT_PROFILE_OP_NO_OP, - &buildCommandLineCallbacks))) + NULL, -1, NULL, + VIR_NETDEV_VPORT_PROFILE_OP_NO_OP, + &buildCommandLineCallbacks, + true))) goto cleanup; ret = virCommandToString(cmd); diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 809ab37..35ad62a 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -3856,7 +3856,7 @@ int qemuProcessStart(virConnectPtr conn, if (!(cmd = qemuBuildCommandLine(conn, driver, vm->def, priv->monConfig, priv->monJSON, priv->qemuCaps, migrateFrom, stdin_fd, snapshot, vmop, - &buildCommandLineCallbacks))) + &buildCommandLineCallbacks, false))) goto cleanup; /* now that we know it is about to start call the hook if present */ diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 5d6a64b..8d7d9e5 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -357,7 +357,7 @@ static int testCompareXMLToArgvFiles(const char *xml, (flags & FLAG_JSON), extraFlags, migrateFrom, migrateFd, NULL, VIR_NETDEV_VPORT_PROFILE_OP_NO_OP, - &testCallbacks))) { + &testCallbacks, false))) { if (!virtTestOOMActive() && (flags & FLAG_EXPECT_FAILURE)) { ret = 0; diff --git a/tests/qemuxmlnstest.c b/tests/qemuxmlnstest.c index 20a5ccd..81d496e 100644 --- a/tests/qemuxmlnstest.c +++ b/tests/qemuxmlnstest.c @@ -119,7 +119,7 @@ static int testCompareXMLToArgvFiles(const char *xml, vmdef, &monitor_chr, json, extraFlags, migrateFrom, migrateFd, NULL, VIR_NETDEV_VPORT_PROFILE_OP_NO_OP, - &testCallbacks))) + &testCallbacks, false))) goto fail; if (!virtTestOOMActive()) { -- 1.8.5.3

5 12

[libvirt] [PATCH] Fix build with qemu driver disabled
by Roman Bogorodskiy 14 Mar '14

14 Mar '14

Do not include test_libvirt_lockd.aug when configured without qemu driver. https://bugzilla.redhat.com/show_bug.cgi?id=1071777 --- src/Makefile.am | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index 25d0370..e5cbad0 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1757,7 +1757,9 @@ if WITH_QEMU test_libvirt_lockd.aug: locking/test_libvirt_lockd.aug.in \ locking/qemu-lockd.conf $(AUG_GENTEST) $(AM_V_GEN)$(AUG_GENTEST) locking/qemu-lockd.conf $< $@ -endif WITH_QEMU +else ! WITH_QEMU +test_libvirt_lockd.aug: +endif ! WITH_QEMU test_virtlockd.aug: locking/test_virtlockd.aug.in \ locking/virtlockd.conf $(AUG_GENTEST) @@ -2122,12 +2124,12 @@ lockd_la_LIBADD = ../gnulib/lib/libgnu.la \ libvirt-net-rpc-client.la \ $(NULL) augeas_DATA += locking/libvirt_lockd.aug -augeastest_DATA += test_libvirt_lockd.aug -CLEANFILES += test_libvirt_lockd.aug if WITH_DTRACE_PROBES lockd_la_LIBADD += libvirt_probes.lo endif WITH_DTRACE_PROBES if WITH_QEMU +augeastest_DATA += test_libvirt_lockd.aug +CLEANFILES += test_libvirt_lockd.aug nodist_conf_DATA += locking/qemu-lockd.conf BUILT_SOURCES += locking/qemu-lockd.conf DISTCLEANFILES += locking/qemu-lockd.conf -- 1.8.4.2

2 1

[libvirt] [PATCH] openvzRegister: Check for error return
by John Ferlan 14 Mar '14

14 Mar '14

A recent change to openvz_driver.c caused Coverity to make additional comparisons and find that the openvzRegister() was not checking the status of virRegisterDriver() call like other callers and thus generated a CHECKED_RETURN condition Signed-off-by: John Ferlan <jferlan(a)redhat.com> --- src/openvz/openvz_driver.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/openvz/openvz_driver.c b/src/openvz/openvz_driver.c index 393f397..c10fa05 100644 --- a/src/openvz/openvz_driver.c +++ b/src/openvz/openvz_driver.c @@ -2239,6 +2239,7 @@ static virDriver openvzDriver = { }; int openvzRegister(void) { - virRegisterDriver(&openvzDriver); + if (virRegisterDriver(&openvzDriver) < 0) + return -1; return 0; } -- 1.8.5.3

2 1

[libvirt] [PATCH 0/6] eliminate hardcoded indent from all XML - PART 2
by Laine Stump 14 Mar '14

14 Mar '14

This is a followup to https://www.redhat.com/archives/libvir-list/2014-March/msg00350.html Eric had ACKed all of those patches, but pointed out some omissions. The first patch of this series should be squashed into 1/9 of the previous series (which I haven't yet pushed), and the others are new. The final patch adds a syntax-check rule to keep new hardcoded spacing from creeping in. (I'm still pondering the idea of giving virBuffer a "pretty print" mode. It would certainly make it more difficult to mess up indentation). Laine Stump (6): squash this into domain conf XML "eliminate hardcoded indent" patch virsh: eliminate hardcoded indentation in xml generated for commands qemu: eliminate hardcoded indent from migration cookie xml util: eliminate hardcoded indent in virConnectSysInfo formatting qemu: elmininate hardcoded indent in capabilities cache XML build: detect/prohibit hardcoded XML indent in syntax-check cfg.mk | 7 ++++- src/conf/domain_conf.c | 2 +- src/lxc/lxc_domain.c | 4 +-- src/qemu/qemu_capabilities.c | 20 ++++++------ src/qemu/qemu_domain.c | 45 ++++++++++++++++----------- src/qemu/qemu_migration.c | 49 ++++++++++++++++++------------ src/util/virsysinfo.c | 72 ++++++++++++++++++++++++-------------------- tools/virsh-domain.c | 43 ++++++++++++++------------ tools/virsh-pool.c | 40 +++++++++++++++--------- tools/virsh-snapshot.c | 24 +++++++++------ tools/virsh-volume.c | 26 ++++++++++------ 11 files changed, 196 insertions(+), 136 deletions(-) -- 1.8.5.3

2 13

[libvirt] [PATCH] nwfilter: Add ARP src/dst IP mask for ebtables ARP
by Stefan Berger 13 Mar '14

13 Mar '14

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com> Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=862887 Add a netmask for the source and destination IP address for the ebtables --arp-ip-src and --arp-ip-dst options. Extend the XML parser with support for XML attributes for these netmasks similar to already supported netmasks. Extend the documentation. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- docs/formatnwfilter.html.in | 10 ++++++++++ src/conf/nwfilter_conf.c | 12 ++++++++++++ src/conf/nwfilter_conf.h | 2 ++ src/nwfilter/nwfilter_ebiptables_driver.c | 28 ++++++++++++++++++++++++---- 4 files changed, 48 insertions(+), 4 deletions(-) diff --git a/docs/formatnwfilter.html.in b/docs/formatnwfilter.html.in index 5c06bf2..fb3a326 100644 --- a/docs/formatnwfilter.html.in +++ b/docs/formatnwfilter.html.in @@ -990,11 +990,21 @@ <td>Source IP address in ARP/RARP packet</td> </tr> <tr> + <td>arpsrcipmask <span class="since">(Since 1.2.3)</span></td> + <td>IP_MASK</td> + <td>Source IP mask</td> + </tr> + <tr> <td>arpdstipaddr</td> <td>IP_ADDR</td> <td>Destination IP address in ARP/RARP packet</td> </tr> <tr> + <td>arpdstipmask <span class="since">(Since 1.2.3)</span></td> + <td>IP_MASK</td> + <td>Destination IP mask</td> + </tr> + <tr> <td>comment <span class="since">(Since 0.8.5)</span></td> <td>STRING</td> <td>text with max. 256 characters</td> diff --git a/src/conf/nwfilter_conf.c b/src/conf/nwfilter_conf.c index d25e0cc..73e668f 100644 --- a/src/conf/nwfilter_conf.c +++ b/src/conf/nwfilter_conf.c @@ -173,7 +173,9 @@ static const char dstmacmask_str[] = "dstmacmask"; static const char arpsrcmacaddr_str[] = "arpsrcmacaddr"; static const char arpdstmacaddr_str[] = "arpdstmacaddr"; static const char arpsrcipaddr_str[] = "arpsrcipaddr"; +static const char arpsrcipmask_str[] = "arpsrcipmask"; static const char arpdstipaddr_str[] = "arpdstipaddr"; +static const char arpdstipmask_str[] = "arpdstipmask"; static const char srcipaddr_str[] = "srcipaddr"; static const char srcipmask_str[] = "srcipmask"; static const char dstipaddr_str[] = "dstipaddr"; @@ -198,7 +200,9 @@ static const char ipsetflags_str[] = "ipsetflags"; #define ARPSRCMACADDR arpsrcmacaddr_str #define ARPDSTMACADDR arpdstmacaddr_str #define ARPSRCIPADDR arpsrcipaddr_str +#define ARPSRCIPMASK arpsrcipmask_str #define ARPDSTIPADDR arpdstipaddr_str +#define ARPDSTIPMASK arpdstipmask_str #define SRCIPADDR srcipaddr_str #define SRCIPMASK srcipmask_str #define DSTIPADDR dstipaddr_str @@ -1302,10 +1306,18 @@ static const virXMLAttr2Struct arpAttributes[] = { .datatype = DATATYPE_IPADDR, .dataIdx = offsetof(virNWFilterRuleDef, p.arpHdrFilter.dataARPSrcIPAddr), }, { + .name = ARPSRCIPMASK, + .datatype = DATATYPE_IPMASK, + .dataIdx = offsetof(virNWFilterRuleDef, p.arpHdrFilter.dataARPSrcIPMask), + }, { .name = ARPDSTIPADDR, .datatype = DATATYPE_IPADDR, .dataIdx = offsetof(virNWFilterRuleDef, p.arpHdrFilter.dataARPDstIPAddr), }, { + .name = ARPDSTIPMASK, + .datatype = DATATYPE_IPMASK, + .dataIdx = offsetof(virNWFilterRuleDef, p.arpHdrFilter.dataARPDstIPMask), + }, { .name = "gratuitous", .datatype = DATATYPE_BOOLEAN, .dataIdx = offsetof(virNWFilterRuleDef, p.arpHdrFilter.dataGratuitousARP), diff --git a/src/conf/nwfilter_conf.h b/src/conf/nwfilter_conf.h index 8c59330..071343e 100644 --- a/src/conf/nwfilter_conf.h +++ b/src/conf/nwfilter_conf.h @@ -209,8 +209,10 @@ struct _arpHdrFilterDef { nwItemDesc dataOpcode; nwItemDesc dataARPSrcMACAddr; nwItemDesc dataARPSrcIPAddr; + nwItemDesc dataARPSrcIPMask; nwItemDesc dataARPDstMACAddr; nwItemDesc dataARPDstIPAddr; + nwItemDesc dataARPDstIPMask; nwItemDesc dataGratuitousARP; nwItemDesc dataComment; }; diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index bea9535..a4b38e7 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -2059,6 +2059,7 @@ ebtablesCreateRuleInstance(char chainPrefix, { char macaddr[VIR_MAC_STRING_BUFLEN], ipaddr[INET_ADDRSTRLEN], + ipmask[INET_ADDRSTRLEN], ipv6addr[INET6_ADDRSTRLEN], number[MAX(INT_BUFSIZE_BOUND(uint32_t), INT_BUFSIZE_BOUND(int))], @@ -2066,6 +2067,7 @@ ebtablesCreateRuleInstance(char chainPrefix, char chain[MAX_CHAINNAME_LENGTH]; virBuffer buf = VIR_BUFFER_INITIALIZER; const char *target; + bool hasMask; if (!ebtables_cmd_path) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -2269,11 +2271,20 @@ ebtablesCreateRuleInstance(char chainPrefix, &rule->p.arpHdrFilter.dataARPSrcIPAddr) < 0) goto err_exit; + if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataARPSrcIPMask)) { + if (printDataType(vars, + ipmask, sizeof(ipmask), + &rule->p.arpHdrFilter.dataARPSrcIPMask) < 0) + goto err_exit; + hasMask = true; + } + virBufferAsprintf(&buf, - " %s %s %s", + " %s %s %s/%s", reverse ? "--arp-ip-dst" : "--arp-ip-src", ENTRY_GET_NEG_SIGN(&rule->p.arpHdrFilter.dataARPSrcIPAddr), - ipaddr); + ipaddr, + hasMask ? ipmask : "32"); } if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataARPDstIPAddr)) { @@ -2282,11 +2293,20 @@ ebtablesCreateRuleInstance(char chainPrefix, &rule->p.arpHdrFilter.dataARPDstIPAddr) < 0) goto err_exit; + if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataARPDstIPMask)) { + if (printDataType(vars, + ipmask, sizeof(ipmask), + &rule->p.arpHdrFilter.dataARPDstIPMask) < 0) + goto err_exit; + hasMask = true; + } + virBufferAsprintf(&buf, - " %s %s %s", + " %s %s %s/%s", reverse ? "--arp-ip-src" : "--arp-ip-dst", ENTRY_GET_NEG_SIGN(&rule->p.arpHdrFilter.dataARPDstIPAddr), - ipaddr); + ipaddr, + hasMask ? ipmask : "32"); } if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataARPSrcMACAddr)) { -- 1.8.1.4

2 2

[libvirt] [PATCH] nwfilter: Fix rule priority problem
by Stefan Berger 13 Mar '14

13 Mar '14

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com> Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1072292 Fix a problem related to rule priorities that did not allow to have rules applied that had a higher priority than the chain they were in. In this case the chain did not exist yet when the rule was instantiated. The solution is to adjust the priority of rules if the priority of the chain is of higher value. That way the chain will be created before the rule. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 9d6cc90..59e07f6 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -3736,7 +3736,6 @@ ebiptablesApplyNewRules(const char *ifname, } } - /* cleanup whatever may exist */ if (ebtables_cmd_path) { NWFILTER_SET_EBTABLES_SHELLVAR(&buf); @@ -3770,6 +3769,23 @@ ebiptablesApplyNewRules(const char *ifname, NWFILTER_SET_EBTABLES_SHELLVAR(&buf); + /* walk the list of rules and increase the priority + * of rules in case the chain priority is of higher value; + * this preserves the order of the rules and ensures that + * the chain will be created before the chain's rules + * are created; don't adjust rules in the root chain + * example: a rule of priority -510 will be adjusted to + * priority -500 and the chain with priority -500 will + * then be created before it. + */ + for (i = 0; i < nruleInstances; i++) { + if (inst[i]->chainPriority > inst[i]->priority && + !strstr("root", inst[i]->neededProtocolChain)) { + + inst[i]->priority = inst[i]->chainPriority; + } + } + /* process ebtables commands; interleave commands from filters with commands for creating and connecting ebtables chains */ j = 0; -- 1.8.1.4

2 2

[libvirt] [PATCH] hostdev: add virObject field to virHostdevManager struct
by Jim Fehlig 13 Mar '14

13 Mar '14

Commit 6b306d66 converted virHostdevManager to a virObject, but missed adding a virObject field to the virHostdevManager struct. Result is memory corruption when taking a reference on an instance of the object, where atomic inc is done on the stateDir field. Later use of stateDir crashes libvirtd. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- src/util/virhostdev.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/util/virhostdev.h b/src/util/virhostdev.h index ade7e2f..a56a2b5 100644 --- a/src/util/virhostdev.h +++ b/src/util/virhostdev.h @@ -45,6 +45,8 @@ typedef enum { typedef struct _virHostdevManager virHostdevManager; typedef virHostdevManager *virHostdevManagerPtr; struct _virHostdevManager { + virObject parent; + char *stateDir; virPCIDeviceListPtr activePCIHostdevs; -- 1.8.1.4

2 2

[libvirt] How to build libvirt installation environment on ARM64?
by Chenqun (kuhn) 13 Mar '14

13 Mar '14

Hi all, The libvirt can be used for ARM64? If it can be used for ARM64, what resources are needed for setup ? How to build libvirt installation environment on ARM64? I got some resource as follow: 1.ARM64 hardware is based Cortex-A57 fastmodel 2.Host and Guest kernel is linux 3.13.0 3.ARM64 filesystem from linaro releases (http://releases.linaro.org/latest/openembedded/aarch64/) 4.Qemu 1.6.50 5.Libvirt-1.2.0 My configure shell as follow： export PKG_CONFIG=/usr/local/bin/pkg-config export PKG_CONFIG_SYSROOT_DIR=/home/aarch64 export PKG_CONFIG_PATH=/home/aarch64/usr/lib/pkgconfig ./configure --target=aarch64 \ --prefix=/home/chenq/libvirt/install \ --host=aarch64-linux-gnu \ --libdir=/home/aarch64 CC=aarch64-linux-gnu-gcc \ LIBXML_CFLAGS="/home/aarch64/usr/lib" CFLAGS="/home/aarch64/usr/include/libfdt" LDFLAGS="/home/aarch64/lib" Then configure error as follow： … checking for DEVMAPPER... no checking for dm_task_run in -ldevmapper... no checking libdevmapper.h usability... no checking libdevmapper.h presence... no checking for libdevmapper.h... no configure: error: You must install device-mapper-devel/libdevmapper >= 1.0.0 to compile libvirt I think this only one error is found. The libvirt depends on a lot of other libs,it will be find more similar errors. So, how to create a friendly environment to compile and install libvirt on ARM64 ? Thanks, --Kuhn

2 3

[libvirt] [PATCH 0/4] Fix capitalization of abbreviations
by Daniel P. Berrange 13 Mar '14

13 Mar '14

Complete the cleanup of bogus capitalization of Pci/Scsi/Usb Daniel P. Berrange (4): Replace Scsi with SCSI throughout Replace Usb with USB throughout Replace Pci with PCI throughout Add syntax check to validate capitalization of abbreviations cfg.mk | 8 +++++ src/conf/device_conf.c | 4 +-- src/conf/device_conf.h | 6 ++-- src/conf/domain_conf.c | 70 +++++++++++++++++++------------------- src/conf/domain_conf.h | 30 ++++++++-------- src/conf/node_device_conf.c | 28 +++++++-------- src/conf/node_device_conf.h | 2 +- src/libvirt_private.syms | 10 +++--- src/libxl/libxl_conf.c | 8 ++--- src/libxl/libxl_conf.h | 2 +- src/libxl/libxl_driver.c | 4 +-- src/lxc/lxc_cgroup.c | 6 ++-- src/lxc/lxc_cgroup.h | 4 +-- src/lxc/lxc_driver.c | 6 ++-- src/lxc/lxc_hostdev.c | 6 ++-- src/lxc/lxc_hostdev.h | 2 +- src/lxc/lxc_process.c | 2 +- src/network/bridge_driver.c | 2 +- src/node_device/node_device_udev.c | 4 +-- src/qemu/qemu_capabilities.c | 58 +++++++++++++++---------------- src/qemu/qemu_cgroup.c | 10 +++--- src/qemu/qemu_command.c | 30 ++++++++-------- src/qemu/qemu_command.h | 2 +- src/qemu/qemu_hostdev.c | 2 +- src/qemu/qemu_hotplug.c | 2 +- src/qemu/qemu_monitor_text.c | 10 +++--- src/util/virhostdev.c | 2 +- src/vmx/vmx.c | 2 +- src/xen/xen_driver.c | 10 +++--- tests/virpcimock.c | 16 ++++----- 30 files changed, 178 insertions(+), 170 deletions(-) -- 1.8.5.3

2 5

[libvirt] [PATCH v3] Add helper program to create custom leases
by Nehal J Wani 13 Mar '14

13 Mar '14

Introduce helper program to catch events from dnsmasq and maintain a custom lease file per network. It supports dhcpv4 and dhcpv6. The file is saved as "<interface-name>.status". Each lease contains the following info: <expiry-time (epoch time)> <mac> <iaid> <ip-address> <hostname> <clientid> Example of custom leases file content: [ { "iaid": "1221229", "ip-address": "2001:db8:ca2:2:1::95", "mac-address": "52:54:00:12:a2:6d", "hostname": "Fedora20", "client-id": "00:04:1a:c1:d9:6b:5a:0a:e2:bc:f8:4b:1e:37:2e:38:22:55", "expiry-time": 1393244216 }, { "ip-address": "192.168.150.208", "mac-address": "52:54:00:11:56:b3", "hostname": "Wani-PC", "client-id": "01:52:54:00:11:56:b3", "expiry-time": 1393244248 } ] src/Makefile.am: * Add options to compile the helper program src/network/bridge_driver.c: * Introduce networkDnsmasqLeaseFileNameCustom() * Invoke helper program along with dnsmasq * Delete the .status file when corresponding n/w is destroyed. src/util/leaseshelper.c * Helper program to create the custom lease file --- v3: * Improved file handling, removed redundant copying, introduced --help and --version v2: * Changed format to JSON * Refer: https://www.redhat.com/archives/libvir-list/2014-January/msg01234.html v1: * Refer: https://www.redhat.com/archives/libvir-list/2014-January/msg00626.html src/Makefile.am | 16 +++ src/network/bridge_driver.c | 19 +++ src/util/leaseshelper.c | 303 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 338 insertions(+), 0 deletions(-) create mode 100644 src/util/leaseshelper.c diff --git a/src/Makefile.am b/src/Makefile.am index 6d21e5d..b8e1993 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -849,6 +849,9 @@ STORAGE_HELPER_DISK_SOURCES = \ UTIL_IO_HELPER_SOURCES = \ util/iohelper.c +UTIL_LEASES_HELPER_SOURCES = \ + util/leaseshelper.c + # Network filters NWFILTER_DRIVER_SOURCES = \ nwfilter/nwfilter_driver.h nwfilter/nwfilter_driver.c \ @@ -2444,6 +2447,19 @@ libvirt_iohelper_CFLAGS = \ $(AM_CFLAGS) \ $(PIE_CFLAGS) \ $(NULL) + +libexec_PROGRAMS += libvirt_leaseshelper +libvirt_leaseshelper_SOURCES = $(UTIL_LEASES_HELPER_SOURCES) +libvirt_leaseshelper_LDADD = \ + libvirt_util.la \ + ../gnulib/lib/libgnu.la +if WITH_DTRACE_PROBES +libvirt_leaseshelper_LDADD += libvirt_probes.lo +endif WITH_DTRACE_PROBES + +libvirt_leaseshelper_CFLAGS = \ + $(PIE_CFLAGS) \ + $(NULL) endif WITH_LIBVIRTD if WITH_STORAGE_DISK diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index a6c719d..9fb750f 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -205,6 +205,16 @@ networkDnsmasqLeaseFileNameFunc networkDnsmasqLeaseFileName = networkDnsmasqLeaseFileNameDefault; static char * +networkDnsmasqLeaseFileNameCustom(const char *bridge) +{ + char *leasefile; + + ignore_value(virAsprintf(&leasefile, "%s/%s.status", + driverState->dnsmasqStateDir, bridge)); + return leasefile; +} + +static char * networkDnsmasqConfigFileName(const char *netname) { char *conffile; @@ -240,6 +250,7 @@ networkRemoveInactive(virNetworkDriverStatePtr driver, virNetworkObjPtr net) { char *leasefile = NULL; + char *customleasefile = NULL; char *radvdconfigfile = NULL; char *configfile = NULL; char *radvdpidbase = NULL; @@ -258,6 +269,9 @@ networkRemoveInactive(virNetworkDriverStatePtr driver, if (!(leasefile = networkDnsmasqLeaseFileName(def->name))) goto cleanup; + if (!(customleasefile = networkDnsmasqLeaseFileNameCustom(def->bridge))) + goto cleanup; + if (!(radvdconfigfile = networkRadvdConfigFileName(def->name))) goto cleanup; @@ -274,6 +288,7 @@ networkRemoveInactive(virNetworkDriverStatePtr driver, /* dnsmasq */ dnsmasqDelete(dctx); unlink(leasefile); + unlink(customleasefile); unlink(configfile); /* radvd */ @@ -1117,6 +1132,10 @@ networkBuildDhcpDaemonCommandLine(virNetworkObjPtr network, cmd = virCommandNew(dnsmasqCapsGetBinaryPath(caps)); virCommandAddArgFormat(cmd, "--conf-file=%s", configfile); + + /* This helper is used to create custom leases file for libvirt */ + virCommandAddArgFormat(cmd, "--dhcp-script=%s", LIBEXECDIR "/libvirt_leaseshelper"); + *cmdout = cmd; ret = 0; cleanup: diff --git a/src/util/leaseshelper.c b/src/util/leaseshelper.c new file mode 100644 index 0000000..bd8110f --- /dev/null +++ b/src/util/leaseshelper.c @@ -0,0 +1,303 @@ +/* + * leasehelper.c: Helper program to create custom leases file + * + * Copyright (C) 2014 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + * + * Author: Nehal J Wani <nehaljw.kkd1(a)gmail.com> + */ + +#include <config.h> + +#include <stdio.h> +#include <stdlib.h> +#include <sys/stat.h> + +#include "virutil.h" +#include "virthread.h" +#include "virfile.h" +#include "virbuffer.h" +#include "virstring.h" +#include "virerror.h" +#include "viralloc.h" +#include "virjson.h" +#include "configmake.h" + +#define VIR_FROM_THIS VIR_FROM_NETWORK + +/** + * VIR_NETWORK_DHCP_LEASE_FILE_SIZE_MAX: + * + * Macro providing the upper limit on the size of leases file + */ +#define VIR_NETWORK_DHCP_LEASE_FILE_SIZE_MAX (2 * 1024 * 1024) + +static const char *program_name; + +/* Display version information. */ +static void +helperVersion(const char *argv0) +{ + printf("%s (%s) %s\n", argv0, PACKAGE_NAME, PACKAGE_VERSION); +} + +ATTRIBUTE_NORETURN static void +usage(int status) +{ + if (status) { + fprintf(stderr, _("%s: try --help for more details\n"), program_name); + } else { + printf(_("Usage: %s ACTION MAC|CLIENTID IP HOSTNAME\n" + " or: %s ACTION MAC|CLIENTID IP\n"), + program_name, program_name); + } + exit(status); +} + +static int +customLeaseRewriteFile(int fd, void *opaque) +{ + char **data = opaque; + + if (safewrite(fd, *data, strlen(*data)) < 0) + return -1; + + return 0; +} + +int +main(int argc, char **argv) +{ + char *lease_entries = NULL; + char *custom_lease_file = NULL; + const char *ip = NULL; + const char *mac = NULL; + const char *action = NULL; + const char *iaid = virGetEnvAllowSUID("DNSMASQ_IAID"); + const char *clientid = virGetEnvAllowSUID("DNSMASQ_CLIENT_ID"); + const char *interface = virGetEnvAllowSUID("DNSMASQ_INTERFACE"); + const char *exptime = virGetEnvAllowSUID("DNSMASQ_LEASE_EXPIRES"); + const char *hostname = virGetEnvAllowSUID("DNSMASQ_SUPPLIED_HOSTNAME"); + const char *leases_str = NULL; + long long expirytime = 0; + size_t i = 0; + int rv = EXIT_FAILURE; + int size = 0; + int custom_lease_file_len = 0; + bool add = false; + bool delete = false; + virJSONValuePtr lease_new = NULL; + virJSONValuePtr lease_tmp = NULL; + virJSONValuePtr leases_array = NULL; + virJSONValuePtr leases_array_new = NULL; + + virSetErrorFunc(NULL, NULL); + virSetErrorLogPriorityFunc(NULL); + + program_name = argv[0]; + + if (setlocale(LC_ALL, "") == NULL || + bindtextdomain(PACKAGE, LOCALEDIR) == NULL || + textdomain(PACKAGE) == NULL) { + fprintf(stderr, _("%s: initialization failed\n"), program_name); + exit(EXIT_FAILURE); + } + + if (virThreadInitialize() < 0 || + virErrorInitialize() < 0) { + fprintf(stderr, _("%s: initialization failed\n"), program_name); + exit(EXIT_FAILURE); + } + + /* Doesn't hurt to check */ + if (argc > 1) { + if(STREQ(argv[1], "--help")) + usage(EXIT_SUCCESS); + + if (STREQ(argv[1], "--version")) { + helperVersion(argv[0]); + exit(EXIT_SUCCESS); + } + } + + if (argc != 4 && argc != 5) { + /* Refer man page of dnsmasq --dhcp-script for more details */ + usage(EXIT_FAILURE); + } + + /* Make sure dnsmasq knows the interface. The interface name is not known + * when dnsmasq (re)starts and throws 'del' events for expired leases. + * So, if any old lease has expired, it will be automatically removed the + * next time this program is invoked */ + if (!interface) + goto cleanup; + + ip = argv[3]; + mac = argv[2]; + action = argv[1]; + + /* In case hostname is known, it is the 5th argument */ + if (argc == 5) + hostname = argv[4]; + + if (virAsprintf(&custom_lease_file, "%s/%s.status", LOCALSTATEDIR + "/lib/libvirt/dnsmasq/", interface) < 0) + goto cleanup; + + /* Check if it is an IPv6 lease */ + if (virGetEnvAllowSUID("DNSMASQ_IAID")) { + mac = virGetEnvAllowSUID("DNSMASQ_MAC"); + clientid=argv[2]; + } + + /* Since interfaces can be hot plugged, we need to make sure that the + * corresponding custom lease file exists. If not, 'touch' it */ + if (virFileTouch(custom_lease_file, 0644) < 0) + goto cleanup; + + /* Read entire contents */ + if ((custom_lease_file_len = virFileReadAll(custom_lease_file, + VIR_NETWORK_DHCP_LEASE_FILE_SIZE_MAX, + &lease_entries)) < 0) { + goto cleanup; + } + + if (STREQ(action, "add") || STREQ(action, "old") || STREQ(action, "del")) { + if (mac || STREQ(action, "del")) { + /* Delete the corresponding lease */ + delete = true; + if (STREQ(action, "add") || STREQ(action, "old")) { + add = true; + /* Create new lease */ + if (!(lease_new = virJSONValueNewObject())) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("failed to create json")); + goto cleanup; + } + + if (virStrToLong_ll(exptime, NULL, 10, &expirytime) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Unable to convert lease expiry time to long long: %s"), + exptime); + goto cleanup; + } + + if ((iaid && virJSONValueObjectAppendString(lease_new, "iaid", + iaid) < 0) || + (ip && virJSONValueObjectAppendString(lease_new, "ip-address", + ip) < 0) || + (mac && virJSONValueObjectAppendString(lease_new, "mac-address", + mac) < 0) || + (hostname && virJSONValueObjectAppendString(lease_new, "hostname", + hostname) < 0) || + (clientid && virJSONValueObjectAppendString(lease_new, "client-id", + clientid) < 0) || + (expirytime && virJSONValueObjectAppendNumberLong(lease_new, "expiry-time", + expirytime) < 0)) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("failed to create json")); + goto cleanup; + } + } + } + } + else { + fprintf(stderr, _("Unsupported action: %s\n"), action); + exit(EXIT_FAILURE); + } + + /* Check for previous leases */ + if (custom_lease_file_len) { + if (!(leases_array = virJSONValueFromString(lease_entries))) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("invalid json in file: %s"), custom_lease_file); + goto cleanup; + } + + if ((size = virJSONValueArraySize(leases_array)) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("couldn't fetch array of leases")); + goto cleanup; + } + } + + if (!(leases_array_new = virJSONValueNewArray())) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("failed to create json")); + goto cleanup; + } + + for (i = 0; i < size; i++) { + const char *ip_tmp = NULL; + long long exptime_tmp = -1; + + if (!(lease_tmp = virJSONValueArrayGet(leases_array, i))) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("failed to parse json")); + goto cleanup; + } + + if (!(ip_tmp = virJSONValueObjectGetString(lease_tmp, "ip-address")) || + (virJSONValueObjectGetNumberLong(lease_tmp, "expiry-time", &exptime_tmp) < 0)) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("failed to parse json")); + goto cleanup; + } + + /* Check whether lease has expired or not */ + if (exptime_tmp < (long long) time(NULL)) + continue; + + /* Check whether lease has to be included or not */ + if (delete && STREQ(ip_tmp, ip)) + continue; + + /* Add old lease to new array */ + if (virJSONValueArrayAppend(leases_array_new, lease_tmp) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("failed to create json")); + goto cleanup; + } + } + + if (add) { + if (virJSONValueArrayAppend(leases_array_new, lease_new) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("failed to create json")); + goto cleanup; + } + } + + if (!(leases_str = virJSONValueToString(leases_array_new, true))) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("empty json array")); + goto cleanup; + } + + /* Write to file */ + if (virFileRewrite(custom_lease_file, 0644, + customLeaseRewriteFile, &leases_str) < 0) + goto cleanup; + + rv = EXIT_SUCCESS; + +cleanup: + VIR_FREE(custom_lease_file); + virJSONValueFree(lease_new); + virJSONValueFree(leases_array); + virJSONValueFree(leases_array_new); + return rv; +} -- 1.7.1

2 5

[libvirt] [PATCH] hotplug:Fix log mistake in qemuMonitorAddNetdev
by Wangrui (K) 13 Mar '14

13 Mar '14

>From 81de0ce710bad91a2df18247e681b5a83872b8d5 Mon Sep 17 00:00:00 2001 From: Wang Rui <moon.wangrui(a)huawei.com> Date: Thu, 13 Mar 2014 17:05:03 +0000 Subject: [PATCH] hotplug:Fix log mistake in qemuMonitorAddNetdev VIR_DEBUG in qemuMonitorAddNetdev should print vhostfdSize Signed-off-by: Wang Rui <moon.wangrui(a)huawei.com> --- src/qemu/qemu_monitor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index e4707b7..b2af0ae 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -2781,7 +2781,7 @@ int qemuMonitorAddNetdev(qemuMonitorPtr mon, VIR_DEBUG("mon=%p netdevstr=%s tapfd=%p tapfdName=%p tapfdSize=%d" "vhostfd=%p vhostfdName=%p vhostfdSize=%d", mon, netdevstr, tapfd, tapfdName, tapfdSize, - vhostfd, vhostfdName, tapfdSize); + vhostfd, vhostfdName, vhostfdSize); if (!mon) { virReportError(VIR_ERR_INVALID_ARG, "%s", -- 1.8.3.4

2 1

[libvirt] [PATCH] Make ABI stability issue easier to debug
by Jiri Denemark 13 Mar '14

13 Mar '14

When ABI stability check fails, we only log the error message describing the incompatibility. Let's log both XMLs in case of an error to make it easier to analyze where and why the stability check failed. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/conf/domain_conf.c | 125 ++++++++++++++++++++++++++++--------------------- 1 file changed, 72 insertions(+), 53 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index e1b0115..a528257 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -13866,13 +13866,16 @@ virDomainDefCheckABIStability(virDomainDefPtr src, virDomainDefPtr dst) { size_t i; + virErrorPtr err; + char *strSrc; + char *strDst; if (src->virtType != dst->virtType) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain virt type %s does not match source %s"), virDomainVirtTypeToString(dst->virtType), virDomainVirtTypeToString(src->virtType)); - return false; + goto error; } if (memcmp(src->uuid, dst->uuid, VIR_UUID_BUFLEN) != 0) { @@ -13883,7 +13886,7 @@ virDomainDefCheckABIStability(virDomainDefPtr src, virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain uuid %s does not match source %s"), uuiddst, uuidsrc); - return false; + goto error; } /* Not strictly ABI related, but we want to make sure domains @@ -13894,60 +13897,60 @@ virDomainDefCheckABIStability(virDomainDefPtr src, virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain name '%s' does not match source '%s'"), dst->name, src->name); - return false; + goto error; } if (src->mem.max_balloon != dst->mem.max_balloon) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain max memory %lld does not match source %lld"), dst->mem.max_balloon, src->mem.max_balloon); - return false; + goto error; } if (src->mem.cur_balloon != dst->mem.cur_balloon) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain current memory %lld does not match source %lld"), dst->mem.cur_balloon, src->mem.cur_balloon); - return false; + goto error; } if (src->mem.hugepage_backed != dst->mem.hugepage_backed) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain huge page backing %d does not match source %d"), dst->mem.hugepage_backed, src->mem.hugepage_backed); - return false; + goto error; } if (src->vcpus != dst->vcpus) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain vCPU count %d does not match source %d"), dst->vcpus, src->vcpus); - return false; + goto error; } if (src->maxvcpus != dst->maxvcpus) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain vCPU max %d does not match source %d"), dst->maxvcpus, src->maxvcpus); - return false; + goto error; } if (STRNEQ(src->os.type, dst->os.type)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain OS type %s does not match source %s"), dst->os.type, src->os.type); - return false; + goto error; } if (src->os.arch != dst->os.arch){ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain architecture %s does not match source %s"), virArchToString(dst->os.arch), virArchToString(src->os.arch)); - return false; + goto error; } if (STRNEQ_NULLABLE(src->os.machine, dst->os.machine)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain OS type %s does not match source %s"), dst->os.machine, src->os.machine); - return false; + goto error; } if (src->os.smbios_mode != dst->os.smbios_mode) { @@ -13955,203 +13958,203 @@ virDomainDefCheckABIStability(virDomainDefPtr src, _("Target domain SMBIOS mode %s does not match source %s"), virDomainSmbiosModeTypeToString(dst->os.smbios_mode), virDomainSmbiosModeTypeToString(src->os.smbios_mode)); - return false; + goto error; } if (!virDomainDefFeaturesCheckABIStability(src, dst)) - return false; + goto error; if (src->clock.ntimers != dst->clock.ntimers) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("Target domain timers do not match source")); - return false; + goto error; } for (i = 0; i < src->clock.ntimers; i++) { if (!virDomainTimerDefCheckABIStability(src->clock.timers[i], dst->clock.timers[i])) - return false; + goto error; } if (!virCPUDefIsEqual(src->cpu, dst->cpu)) - return false; + goto error; if (!virSysinfoIsEqual(src->sysinfo, dst->sysinfo)) - return false; + goto error; if (src->ndisks != dst->ndisks) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain disk count %zu does not match source %zu"), dst->ndisks, src->ndisks); - return false; + goto error; } for (i = 0; i < src->ndisks; i++) if (!virDomainDiskDefCheckABIStability(src->disks[i], dst->disks[i])) - return false; + goto error; if (src->ncontrollers != dst->ncontrollers) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain controller count %zu " "does not match source %zu"), dst->ncontrollers, src->ncontrollers); - return false; + goto error; } for (i = 0; i < src->ncontrollers; i++) if (!virDomainControllerDefCheckABIStability(src->controllers[i], dst->controllers[i])) - return false; + goto error; if (src->nfss != dst->nfss) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain filesystem count %zu " "does not match source %zu"), dst->nfss, src->nfss); - return false; + goto error; } for (i = 0; i < src->nfss; i++) if (!virDomainFsDefCheckABIStability(src->fss[i], dst->fss[i])) - return false; + goto error; if (src->nnets != dst->nnets) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain net card count %zu " "does not match source %zu"), dst->nnets, src->nnets); - return false; + goto error; } for (i = 0; i < src->nnets; i++) if (!virDomainNetDefCheckABIStability(src->nets[i], dst->nets[i])) - return false; + goto error; if (src->ninputs != dst->ninputs) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain input device count %zu " "does not match source %zu"), dst->ninputs, src->ninputs); - return false; + goto error; } for (i = 0; i < src->ninputs; i++) if (!virDomainInputDefCheckABIStability(src->inputs[i], dst->inputs[i])) - return false; + goto error; if (src->nsounds != dst->nsounds) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain sound card count %zu " "does not match source %zu"), dst->nsounds, src->nsounds); - return false; + goto error; } for (i = 0; i < src->nsounds; i++) if (!virDomainSoundDefCheckABIStability(src->sounds[i], dst->sounds[i])) - return false; + goto error; if (src->nvideos != dst->nvideos) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain video card count %zu " "does not match source %zu"), dst->nvideos, src->nvideos); - return false; + goto error; } for (i = 0; i < src->nvideos; i++) if (!virDomainVideoDefCheckABIStability(src->videos[i], dst->videos[i])) - return false; + goto error; if (src->nhostdevs != dst->nhostdevs) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain host device count %zu " "does not match source %zu"), dst->nhostdevs, src->nhostdevs); - return false; + goto error; } for (i = 0; i < src->nhostdevs; i++) if (!virDomainHostdevDefCheckABIStability(src->hostdevs[i], dst->hostdevs[i])) - return false; + goto error; if (src->nsmartcards != dst->nsmartcards) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain smartcard count %zu " "does not match source %zu"), dst->nsmartcards, src->nsmartcards); - return false; + goto error; } for (i = 0; i < src->nsmartcards; i++) if (!virDomainSmartcardDefCheckABIStability(src->smartcards[i], dst->smartcards[i])) - return false; + goto error; if (src->nserials != dst->nserials) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain serial port count %zu " "does not match source %zu"), dst->nserials, src->nserials); - return false; + goto error; } for (i = 0; i < src->nserials; i++) if (!virDomainSerialDefCheckABIStability(src->serials[i], dst->serials[i])) - return false; + goto error; if (src->nparallels != dst->nparallels) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain parallel port count %zu " "does not match source %zu"), dst->nparallels, src->nparallels); - return false; + goto error; } for (i = 0; i < src->nparallels; i++) if (!virDomainParallelDefCheckABIStability(src->parallels[i], dst->parallels[i])) - return false; + goto error; if (src->nchannels != dst->nchannels) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain channel count %zu " "does not match source %zu"), dst->nchannels, src->nchannels); - return false; + goto error; } for (i = 0; i < src->nchannels; i++) if (!virDomainChannelDefCheckABIStability(src->channels[i], dst->channels[i])) - return false; + goto error; if (src->nconsoles != dst->nconsoles) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain console count %zu " "does not match source %zu"), dst->nconsoles, src->nconsoles); - return false; + goto error; } for (i = 0; i < src->nconsoles; i++) if (!virDomainConsoleDefCheckABIStability(src->consoles[i], dst->consoles[i])) - return false; + goto error; if (src->nhubs != dst->nhubs) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Target domain hub device count %zu " "does not match source %zu"), dst->nhubs, src->nhubs); - return false; + goto error; } for (i = 0; i < src->nhubs; i++) if (!virDomainHubDefCheckABIStability(src->hubs[i], dst->hubs[i])) - return false; + goto error; if ((!src->redirfilter && dst->redirfilter) || (src->redirfilter && !dst->redirfilter)) { @@ -14159,13 +14162,13 @@ virDomainDefCheckABIStability(virDomainDefPtr src, _("Target domain USB redirection filter count %d " "does not match source %d"), dst->redirfilter ? 1 : 0, src->redirfilter ? 1 : 0); - return false; + goto error; } if (src->redirfilter && !virDomainRedirFilterDefCheckABIStability(src->redirfilter, dst->redirfilter)) - return false; + goto error; if ((!src->watchdog && dst->watchdog) || (src->watchdog && !dst->watchdog)) { @@ -14173,12 +14176,12 @@ virDomainDefCheckABIStability(virDomainDefPtr src, _("Target domain watchdog count %d " "does not match source %d"), dst->watchdog ? 1 : 0, src->watchdog ? 1 : 0); - return false; + goto error; } if (src->watchdog && !virDomainWatchdogDefCheckABIStability(src->watchdog, dst->watchdog)) - return false; + goto error; if ((!src->memballoon && dst->memballoon) || (src->memballoon && !dst->memballoon)) { @@ -14186,21 +14189,37 @@ virDomainDefCheckABIStability(virDomainDefPtr src, _("Target domain memory balloon count %d " "does not match source %d"), dst->memballoon ? 1 : 0, src->memballoon ? 1 : 0); - return false; + goto error; } if (src->memballoon && !virDomainMemballoonDefCheckABIStability(src->memballoon, dst->memballoon)) - return false; + goto error; if (!virDomainRNGDefCheckABIStability(src->rng, dst->rng)) - return false; + goto error; if (!virDomainPanicCheckABIStability(src->panic, dst->panic)) - return false; + goto error; return true; + +error: + err = virSaveLastError(); + + strSrc = virDomainDefFormat(src, 0); + strDst = virDomainDefFormat(dst, 0); + VIR_DEBUG("XMLs that failed stability check were: src=\"%s\", dst=\"%s\"", + NULLSTR(strSrc), NULLSTR(strDst)); + VIR_FREE(strSrc); + VIR_FREE(strDst); + + if (err) { + virSetError(err); + virFreeError(err); + } + return false; } -- 1.9.0

2 2

[libvirt] [PATCH 0/7] Test parsing of iscsiadm output
by Ján Tomko 13 Mar '14

13 Mar '14

Introduce virCommandSetMockOutputFile for faking output of asynchronous commands and use it to test parsing of iscsiadm output in virStorageBackendISCSISession and virStorageBackendISCSIScanTargets Ján Tomko (7): Change virStorageBackendISCSISession 'probe' arg to bool Introduce virStoragePoolSourceDeviceClear Use size_t for ndevice in pool source definition Introduce vircommandpriv.h for functions used by tests Add virCommandSetMockOutputFile Add test for virStorageBackendISCSISession Add a test for virStorageBackendISCSIScanTargets src/Makefile.am | 5 +- src/conf/storage_conf.c | 36 ++--- src/conf/storage_conf.h | 3 +- src/libvirt_private.syms | 2 + src/storage/storage_backend_iscsi.c | 14 +- src/storage/storage_backend_iscsipriv.h | 36 +++++ src/util/vircommand.c | 35 ++++- src/util/vircommand.h | 2 - src/util/vircommandpriv.h | 29 ++++ tests/Makefile.am | 14 +- tests/storageiscsidata/iscsiadm_sendtargets | 6 + tests/storageiscsidata/iscsiadm_session | 6 + tests/storageiscsidata/iscsiadm_session_nonflash | 6 + tests/storageiscsitest.c | 186 +++++++++++++++++++++++ tests/virkmodtest.c | 2 +- tests/virnetdevbandwidthtest.c | 2 +- 16 files changed, 350 insertions(+), 34 deletions(-) create mode 100644 src/storage/storage_backend_iscsipriv.h create mode 100644 src/util/vircommandpriv.h create mode 100644 tests/storageiscsidata/iscsiadm_sendtargets create mode 100644 tests/storageiscsidata/iscsiadm_session create mode 100644 tests/storageiscsidata/iscsiadm_session_nonflash create mode 100644 tests/storageiscsitest.c -- 1.8.3.2

2 16

[libvirt] [PATCH] qemu: Forbid "sgio" support for SCSI generic host device
by Osier Yang 13 Mar '14

13 Mar '14

The kernel didn't support the unprivileged SGIO for SCSI generic device finally, and since it's unknow whether the way to support unprivileged SGIO for SCSI generic device will be similar as for SCSI block device or not, even it's simliar (I.e. via sysfs, for SCSI block device, it's /sys/dev/block/8\:0/queue/unpriv_sgio, for example), the file name might be different, So it's better not guess what it should be like currently. This patch removes the related code (mainly about the "shareable" checking on the "sgio" setting, it's not supported at all, why we leave checking code there? :-), and error out if "sgio" is specified in the domain config. --- src/qemu/qemu_conf.c | 87 ++++++++++++---------------------------------------- 1 file changed, 20 insertions(+), 67 deletions(-) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 2c397b0..ad6348d 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -739,12 +739,8 @@ qemuCheckSharedDevice(virHashTablePtr sharedDevices, virDomainDeviceDefPtr dev) { virDomainDiskDefPtr disk = NULL; - virDomainHostdevDefPtr hostdev = NULL; char *sysfs_path = NULL; char *key = NULL; - char *hostdev_name = NULL; - char *hostdev_path = NULL; - char *device_path = NULL; int val; int ret = 0; @@ -756,27 +752,11 @@ qemuCheckSharedDevice(virHashTablePtr sharedDevices, */ if (disk->device != VIR_DOMAIN_DISK_DEVICE_LUN) return 0; - - device_path = disk->src; - } else if (dev->type == VIR_DOMAIN_DEVICE_HOSTDEV) { - hostdev = dev->data.hostdev; - - if (!(hostdev_name = virSCSIDeviceGetDevName(NULL, - hostdev->source.subsys.u.scsi.adapter, - hostdev->source.subsys.u.scsi.bus, - hostdev->source.subsys.u.scsi.target, - hostdev->source.subsys.u.scsi.unit))) - goto cleanup; - - if (virAsprintf(&hostdev_path, "/dev/%s", hostdev_name) < 0) - goto cleanup; - - device_path = hostdev_path; } else { return 0; } - if (!(sysfs_path = virGetUnprivSGIOSysfsPath(device_path, NULL))) { + if (!(sysfs_path = virGetUnprivSGIOSysfsPath(disk->src, NULL))) { ret = -1; goto cleanup; } @@ -787,7 +767,7 @@ qemuCheckSharedDevice(virHashTablePtr sharedDevices, if (!virFileExists(sysfs_path)) goto cleanup; - if (!(key = qemuGetSharedDeviceKey(device_path))) { + if (!(key = qemuGetSharedDeviceKey(disk->src))) { ret = -1; goto cleanup; } @@ -798,7 +778,7 @@ qemuCheckSharedDevice(virHashTablePtr sharedDevices, if (!(virHashLookup(sharedDevices, key))) goto cleanup; - if (virGetDeviceUnprivSGIO(device_path, NULL, &val) < 0) { + if (virGetDeviceUnprivSGIO(disk->src, NULL, &val) < 0) { ret = -1; goto cleanup; } @@ -810,36 +790,25 @@ qemuCheckSharedDevice(virHashTablePtr sharedDevices, disk->sgio == VIR_DOMAIN_DEVICE_SGIO_UNFILTERED)) goto cleanup; - if (dev->type == VIR_DOMAIN_DEVICE_DISK) { - if (disk->type == VIR_DOMAIN_DISK_TYPE_VOLUME) { - virReportError(VIR_ERR_OPERATION_INVALID, - _("sgio of shared disk 'pool=%s' 'volume=%s' conflicts " - "with other active domains"), - disk->srcpool->pool, - disk->srcpool->volume); - } else { - virReportError(VIR_ERR_OPERATION_INVALID, - _("sgio of shared disk '%s' conflicts with other " - "active domains"), disk->src); - } + if (disk->type == VIR_DOMAIN_DISK_TYPE_VOLUME) { + virReportError(VIR_ERR_OPERATION_INVALID, + _("sgio of shared disk 'pool=%s' 'volume=%s' conflicts " + "with other active domains"), + disk->srcpool->pool, + disk->srcpool->volume); } else { virReportError(VIR_ERR_OPERATION_INVALID, - _("sgio of shared scsi host device '%s-%d-%d-%d' conflicts " - "with other active domains"), - hostdev->source.subsys.u.scsi.adapter, - hostdev->source.subsys.u.scsi.bus, - hostdev->source.subsys.u.scsi.target, - hostdev->source.subsys.u.scsi.unit); + _("sgio of shared disk '%s' conflicts with other " + "active domains"), disk->src); } ret = -1; cleanup: - VIR_FREE(hostdev_name); - VIR_FREE(hostdev_path); VIR_FREE(sysfs_path); VIR_FREE(key); return ret; } + bool qemuSharedDeviceEntryDomainExists(qemuSharedDeviceEntryPtr entry, const char *name, @@ -1116,8 +1085,6 @@ qemuSetUnprivSGIO(virDomainDeviceDefPtr dev) virDomainHostdevDefPtr hostdev = NULL; char *sysfs_path = NULL; char *path = NULL; - char *hostdev_name = NULL; - char *hostdev_path = NULL; int val = -1; int ret = 0; @@ -1135,22 +1102,15 @@ qemuSetUnprivSGIO(virDomainDeviceDefPtr dev) } else if (dev->type == VIR_DOMAIN_DEVICE_HOSTDEV) { hostdev = dev->data.hostdev; - if (!hostdev->shareable || - !(hostdev->mode == VIR_DOMAIN_HOSTDEV_MODE_SUBSYS && - hostdev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI)) - return 0; - - if (!(hostdev_name = virSCSIDeviceGetDevName(NULL, - hostdev->source.subsys.u.scsi.adapter, - hostdev->source.subsys.u.scsi.bus, - hostdev->source.subsys.u.scsi.target, - hostdev->source.subsys.u.scsi.unit))) - goto cleanup; - - if (virAsprintf(&hostdev_path, "/dev/%s", hostdev_name) < 0) + if (hostdev->source.subsys.u.scsi.sgio) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("'sgio' is not supported for SCSI " + "generic device yet ")); + ret = -1; goto cleanup; + } - path = hostdev_path; + return 0; } else { return 0; } @@ -1162,12 +1122,7 @@ qemuSetUnprivSGIO(virDomainDeviceDefPtr dev) } /* By default, filter the SG_IO commands, i.e. set unpriv_sgio to 0. */ - - if (dev->type == VIR_DOMAIN_DEVICE_DISK) - val = (disk->sgio == VIR_DOMAIN_DEVICE_SGIO_UNFILTERED); - else - val = (hostdev->source.subsys.u.scsi.sgio == - VIR_DOMAIN_DEVICE_SGIO_UNFILTERED); + val = (disk->sgio == VIR_DOMAIN_DEVICE_SGIO_UNFILTERED); /* Do not do anything if unpriv_sgio is not supported by the kernel and the * whitelist is enabled. But if requesting unfiltered access, always call @@ -1179,8 +1134,6 @@ qemuSetUnprivSGIO(virDomainDeviceDefPtr dev) cleanup: VIR_FREE(sysfs_path); - VIR_FREE(hostdev_name); - VIR_FREE(hostdev_path); return ret; } -- 1.8.1.4

2 5

[libvirt] [PATCH] docs: add VMmanager to web apps
by Martin Kletzander 13 Mar '14

13 Mar '14

This is a request for adding a VMmanager application as requested and described by Ksenya Phil. Signed-off-by: Ksenya Phil <philka2003(a)mail.ru> Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- docs/apps.html.in | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/docs/apps.html.in b/docs/apps.html.in index 7b581db..86e45fc 100644 --- a/docs/apps.html.in +++ b/docs/apps.html.in @@ -393,6 +393,15 @@ with FreeIPA for Kerberos authentication, and in the future, certificate management. </dd> + <dt><a href="http://ispsystem.com/en/software/vmmanager">VMmanager</a></dt> + <dd> + VMmanager is a software solution for virtualization management + that can be used both for hosting virtual machines and + building a cloud. VMmanager can manage not only one server, + but a large cluster of hypervisors. It delivers a number of + functions, such as live migration that allows for load + balancing between cluster nodes, monitoring CPU, memory. + </dd> </dl> <h2><a name="mobile">Mobile applications</a></h2> -- 1.9.0

2 2

[libvirt] [PATCH v14 00/49] write separate module for hostdev passthrough
by Chunyan Liu 13 Mar '14

13 Mar '14

These patches implements a separate module for hostdev passthrough so that it could be shared by different drivers and can maintain a global state of a host device. Patch 1: fix memory leak in virscsi.c Patch 2: improve virHostdevManager to use virOject wrapper and keep reference Patches 3~7: switch existing qemu and lxc driver to use virHostdevManager's lists, so that to maintain a global state of every host device. Patches 8~45 are to extract general code from qemu_hostdev.c piece by piece, make them reusable common APIs. Patches 46: unit test for the virhostdev common library Patches 47: add a hostdev backend type for xen Patches 48: add pci passthrough to libxl driver based on the common library Patches 49: change lxc to use common library APIs --- changes to v13: * change virHostdevManager, use virObject and keep reference, solve 'free' problem * add .hostdevMgr to qemu/lxc/libxl driver, get virHostdevManager in StateInitialize for once and keep reference, instead of getting it every time virHostdevManager is used. * fix v13 3/49 "qemu-reuse-hostdev-interfaces-to-avoid-duplicate.patch": update qemuPrepareHostUSBDevices parameters to specify hostdevs and nhostdevs, so that could be reused in qemu_hotplug. * rebase left patches Chunyan Liu (49): virscsi: fix memory leak virhostdev: use virObject to virHostdevManager to keep reference update qemuPrepareHostUSBDevices parameters to keep consistency qemu: reuse hostdev interfaces to avoid duplicate qemu: remove functions used internally only from qemu_hostdev.h qemu: use general virhostdev lists instead of its own lxc: use general virhostdev lists instead of its own qemu_hostdev: move cfg->relaxedACS as a flag qemu_hostdev: move ColdBoot as a flag qemu_hostdev: move netconfig file location to virhostdev stateDir extract general code from qemuPrepareHostdevPCIDevices rename qemu*NetConfigRestore/Replace to virHostdevNetConfigRestore/Replace rename qemuGet*PciHostDeviceList to virHostdevGet*PciHostDeviceList pass driver name as a parameter to virHostdevPrepareHostdevPCIDevices extract general code from qemuDomainReAttachHostdevDevices pass driver name as a parameter to virHostdevReAttachPCIDevices rename qemuReAttachPciDevice to virHostdevReAttachPciDevice move virHostdevPrepare(ReAttach)PCIDevices to virhostdev.c extract general code from qemuUpdateActivePciHostdevs extract general code from qemuUpdateActiveUsbHostdevs extract general code from qemuUpdateActiveScsiHostdevs pass driver_name as parameter of virHostdevUpdate*Hostdevs functions move virHostdevUpdate* functions to virhostdev.c extract general code from qemuPrepareHostUSBDevices rename qemu*USBDevices to virHostdev*USBDevices pass driver name to virHostdevPrepareUSBDevices move virHostdevPrepareHostUSBDevices to virhostdev.c extract general code from qemuPrepareHostSCSIDevices pass driver name as parameter to virHostdevPrepareSCSIDevices move virHostdevPrepareHostSCSIDevices to virhostdev.c extract general code from qemuDomainReAttachHostUsbDevices pass driver name as paramter to virHostdevReAttachUsbHostdevs move virHostdevReAttachUsbHostdevs to virhostdev.c extract general code from qemuDomainReAttachHostScsiDevices pass driver name as parameter to virHostdevReAttachScciHostdevs move virHostdevReAttachHostScsiDevices to virhostdev.c extract general code of NodeDeviceDetach extract general code of NodeDeviceReAttach extract general code of NodeDeviceReset move virHostdevNodeDevice* to virhostdev.c improve parameter name to let it more meaningful rename some function names to keep consistency improve virHostdevUpdate* parameters to make it more widely used add 3 wrapper functions for prepare/reattach/update domain hostdevs add parameter checks to common interfaces add unit test for new virhostdev common library change lxc_hostdev.c to use virhostdev common library APIs add hostdev pci backend type for xen add pci passthrough to libxl driver .gitignore | 1 + docs/schemas/domaincommon.rng | 1 + src/conf/domain_conf.c | 3 +- src/conf/domain_conf.h | 1 + src/libvirt_private.syms | 15 + src/libxl/libxl_conf.c | 63 ++ src/libxl/libxl_conf.h | 7 +- src/libxl/libxl_domain.c | 9 + src/libxl/libxl_driver.c | 454 +++++++++++- src/lxc/lxc_conf.h | 5 +- src/lxc/lxc_driver.c | 12 +- src/lxc/lxc_hostdev.c | 307 +------- src/qemu/qemu_command.c | 3 +- src/qemu/qemu_conf.h | 9 +- src/qemu/qemu_driver.c | 76 +- src/qemu/qemu_hostdev.c | 1203 ++----------------------------- src/qemu/qemu_hostdev.h | 29 +- src/qemu/qemu_hotplug.c | 78 +- src/qemu/qemu_process.c | 8 +- src/util/virhostdev.c | 1565 ++++++++++++++++++++++++++++++++++++++++- src/util/virhostdev.h | 96 +++ src/util/virscsi.c | 13 +- tests/Makefile.am | 5 + tests/virhostdevtest.c | 507 +++++++++++++ 24 files changed, 2832 insertions(+), 1638 deletions(-) create mode 100644 tests/virhostdevtest.c -- 1.9.0

5 104

[libvirt] libvirt: [PATCH] libxl: Check for control_d string to decide about dom0
by Stefan Bader 13 Mar '14

13 Mar '14

I have been looking into a bug report (see BugLink) which reported libvirt to fail starting inside a Xen guest. Upon further investigation I found that some tools that help monitoring Xen guests will mount xenfs to /proc/xen. This will create a capabilities files there even if the guest is not dom0. However it will return nothing when reading from it. Ian, just to sanity check myself. I looked at the xenfs code and to me there only seem to be those two outcomes (either "control_d" for running in dom0 or notrhing if not). With the following patch applied, libvirt starts up correctly in the normal guests (with xenfs mounted) without initializing libxl. And also in dom0 where it still enables the libxl driver (if the xl toolstack is selected). -Stefan >From f11949caca6dfe1a802472a2a6d4fe760115ccc6 Mon Sep 17 00:00:00 2001 From: Stefan Bader <stefan.bader(a)canonical.com> Date: Wed, 12 Mar 2014 11:37:16 +0100 Subject: [PATCH] libxl: Check for control_d string to decide about dom0 As soon as any guest mounts xenfs to /proc/xen, there is a capabilities file in that directory. However it returns nothing when reading from it. Change the test to actually check the contents of the file. BugLink: http://bugs.launchpad.net/bugs/1248025 Signed-off-by: Stefan Bader <stefan.bader(a)canonical.com> --- src/libxl/libxl_driver.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index 65d80a2..844e828 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -944,6 +944,7 @@ libxlDriverShouldLoad(bool privileged) bool ret = false; virCommandPtr cmd; int status; + char *output = NULL; /* Don't load if non-root */ if (!privileged) { @@ -951,8 +952,17 @@ libxlDriverShouldLoad(bool privileged) return ret; } - /* Don't load if not running on a Xen control domain (dom0) */ - if (!virFileExists("/proc/xen/capabilities")) { + /* + * Don't load if not running on a Xen control domain (dom0). It is not + * sufficient to check for the file to exist as any guest can mount + * xenfs to /proc/xen. + */ + status = virFileReadAll("/proc/xen/capabilities", 10. &output); + if (status >= 0) { + status = strncmp(output, "control_d", 9); + } + VIR_FREE(output); + if (status) { VIR_INFO("No Xen capabilities detected, probably not running " "in a Xen Dom0. Disabling libxenlight driver"); -- 1.7.9.5

4 4

[libvirt] [PATCH] Fix Invalid write in virCryptoHashString()
by Nehal J Wani 12 Mar '14

12 Mar '14

While running vircryptotest, it was found that valgrind pointed out the following error: ==27453== Invalid write of size 1 ==27453== at 0x4C7D7C9: virCryptoHashString (vircrypto.c:76) ==27453== by 0x401C4E: testCryptoHash (vircryptotest.c:41) ==27453== by 0x402A11: virtTestRun (testutils.c:199) ==27453== by 0x401AD5: mymain (vircryptotest.c:76) ==27453== by 0x40318D: virtTestMain (testutils.c:782) ==27453== by 0x3E6CE1ED1C: (below main) (libc-start.c:226) ==27453== Address 0x51f0541 is 0 bytes after a block of size 65 alloc'd ==27453== at 0x4A0577B: calloc (vg_replace_malloc.c:593) ==27453== by 0x4C69F2E: virAllocN (viralloc.c:189) ==27453== by 0x4C7D76B: virCryptoHashString (vircrypto.c:69) ==27453== by 0x401C4E: testCryptoHash (vircryptotest.c:41) ==27453== by 0x402A11: virtTestRun (testutils.c:199) ==27453== by 0x401AD5: mymain (vircryptotest.c:76) ==27453== by 0x40318D: virtTestMain (testutils.c:782) ==27453== by 0x3E6CE1ED1C: (below main) (libc-start.c:226) ==27453== ...and many more --- The errors go away, if I either do: Line 76: (*output)[hashstrlen - 1] = '\0'; or Line 61: if (VIR_ALLOC_N(*output, hashstrlen + 1) < 0) But the second one seems less harmful, as anyway we are going to free that memory. src/util/vircrypto.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/util/vircrypto.c b/src/util/vircrypto.c index 3af3aa3..aa2b0c8 100644 --- a/src/util/vircrypto.c +++ b/src/util/vircrypto.c @@ -66,7 +66,7 @@ virCryptoHashString(virCryptoHash hash, return -1; } - if (VIR_ALLOC_N(*output, hashstrlen) < 0) + if (VIR_ALLOC_N(*output, hashstrlen + 1) < 0) return -1; for (i = 0; i < hashinfo[hash].hashlen; i++) { -- 1.7.1

2 1

[libvirt] [PATCH] Fix type mismatch of virNetDev*NetConfig on non-Linux
by Ján Tomko 12 Mar '14

12 Mar '14

Commit b4bbaee changed char* to const char*, but omitted the non-Linux version. --- Pushed as a build breaker fix. src/util/virnetdev.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/util/virnetdev.c b/src/util/virnetdev.c index 9d8b7cf..55781b2 100644 --- a/src/util/virnetdev.c +++ b/src/util/virnetdev.c @@ -1802,11 +1802,11 @@ virNetDevLinkDump(const char *ifname ATTRIBUTE_UNUSED, } int -virNetDevReplaceNetConfig(char *linkdev ATTRIBUTE_UNUSED, +virNetDevReplaceNetConfig(const char *linkdev ATTRIBUTE_UNUSED, int vf ATTRIBUTE_UNUSED, const virMacAddr *macaddress ATTRIBUTE_UNUSED, int vlanid ATTRIBUTE_UNUSED, - char *stateDir ATTRIBUTE_UNUSED) + const char *stateDir ATTRIBUTE_UNUSED) { virReportSystemError(ENOSYS, "%s", _("Unable to replace net config on this platform")); @@ -1815,9 +1815,9 @@ virNetDevReplaceNetConfig(char *linkdev ATTRIBUTE_UNUSED, } int -virNetDevRestoreNetConfig(char *linkdev ATTRIBUTE_UNUSED, +virNetDevRestoreNetConfig(const char *linkdev ATTRIBUTE_UNUSED, int vf ATTRIBUTE_UNUSED, - char *stateDir ATTRIBUTE_UNUSED) + const char *stateDir ATTRIBUTE_UNUSED) { virReportSystemError(ENOSYS, "%s", _("Unable to restore net config on this platform")); -- 1.8.3.2

1 0

[libvirt] [PATCH] Load CPU map from builddir when run uninstalled
by Jiri Denemark 12 Mar '14

12 Mar '14

When libvirtd is run from a build directory without being installed, it should not depend on files from a libvirt package installed in the system. Not only because there may not be any libvirt installed at all. We already do a good job for plugins but cpu_map.xml was still loaded from the system. The Makefile.am change is necessary to make this all work from VPATH builds since libvirtd has no idea where to find libvirt sources. It only knows the path from which it was started, i.e, a builddir. https://bugzilla.redhat.com/show_bug.cgi?id=1074327 Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- daemon/libvirtd.c | 7 ++++++- src/Makefile.am | 4 ++++ src/cpu/cpu_map.c | 3 +++ 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index 72f0e81..d91e1e9 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -103,6 +103,7 @@ #include "configmake.h" #include "virdbus.h" +#include "cpu/cpu_map.h" #if WITH_SASL virNetSASLContextPtr saslCtxt = NULL; @@ -1155,13 +1156,16 @@ int main(int argc, char **argv) { if (strstr(argv[0], "lt-libvirtd") || strstr(argv[0], "/daemon/.libs/libvirtd")) { char *tmp = strrchr(argv[0], '/'); + char *cpumap; if (!tmp) { fprintf(stderr, _("%s: cannot identify driver directory\n"), argv[0]); exit(EXIT_FAILURE); } *tmp = '\0'; char *driverdir; - if (virAsprintfQuiet(&driverdir, "%s/../../src/.libs", argv[0]) < 0) { + if (virAsprintfQuiet(&driverdir, "%s/../../src/.libs", argv[0]) < 0 || + virAsprintfQuiet(&cpumap, "%s/../../src/cpu/cpu_map.xml", + argv[0]) < 0) { fprintf(stderr, _("%s: initialization failed\n"), argv[0]); exit(EXIT_FAILURE); } @@ -1174,6 +1178,7 @@ int main(int argc, char **argv) { #ifdef WITH_DRIVER_MODULES virDriverModuleInitialize(driverdir); #endif + cpuMapOverride(cpumap); *tmp = '/'; /* Must not free 'driverdir' - it is still used */ } diff --git a/src/Makefile.am b/src/Makefile.am index 25d0370..306880b 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -977,6 +977,10 @@ libvirt_la_BUILT_LIBADD += libvirt_cpu.la libvirt_cpu_la_CFLAGS = \ -I$(top_srcdir)/src/conf $(AM_CFLAGS) libvirt_cpu_la_SOURCES = $(CPU_SOURCES) +libvirt_cpu_la_DEPENDENCIES = $(abs_builddir)/cpu/cpu_map.xml + +$(abs_builddir)/cpu/cpu_map.xml: + $(AM_V_GEN)ln -s $(srcdir)/cpu/cpu_map.xml $@ if WITH_VMX noinst_LTLIBRARIES += libvirt_vmx.la diff --git a/src/cpu/cpu_map.c b/src/cpu/cpu_map.c index 7c2bdec..f6c63d4 100644 --- a/src/cpu/cpu_map.c +++ b/src/cpu/cpu_map.c @@ -28,6 +28,7 @@ #include "cpu_map.h" #include "configmake.h" #include "virstring.h" +#include "virlog.h" #define VIR_FROM_THIS VIR_FROM_CPU @@ -86,6 +87,8 @@ int cpuMapLoad(const char *arch, int element; const char *mapfile = (cpumap ? cpumap : CPUMAPFILE); + VIR_DEBUG("Loading CPU map from %s", mapfile); + if (arch == NULL) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("undefined hardware architecture")); -- 1.9.0

3 4

[libvirt] [PATCH] nwfilter: Add missing goto err_exit in error path
by Stefan Berger 12 Mar '14

12 Mar '14

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com> https://bugzilla.redhat.com/show_bug.cgi?id=1071095 Add a missing goto err_exit in the error path where an unsupported value is assigned to the CTRL_IP_LEARNING key. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- src/nwfilter/nwfilter_gentech_driver.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/nwfilter/nwfilter_gentech_driver.c b/src/nwfilter/nwfilter_gentech_driver.c index e576dc4..5c3b25e 100644 --- a/src/nwfilter/nwfilter_gentech_driver.c +++ b/src/nwfilter/nwfilter_gentech_driver.c @@ -732,6 +732,7 @@ virNWFilterInstantiate(const unsigned char *vmuuid ATTRIBUTE_UNUSED, _("filter '%s' " "learning value '%s' invalid."), filter->name, learning); + goto err_exit; } } else goto err_unresolvable_vars; -- 1.8.1.4

2 2

[libvirt] libvirtError: this function is not supported by the connection driver: virInterfaceDefineXML
by Sijo Jose 12 Mar '14

12 Mar '14

Hi, Could anyone help I'm getting the following error when I tried to add a new network interface. DETAILS Connection --------------------------- import libvirt conn = libvirt.open('qemu:///system') Interface XML ---------------------- <interface type="bridge" name="br0"> <start mode="onboot"/> <mtu size="1500"/> <protocol family="ipv4"> <dhcp/> </protocol> <bridge stp="off" delay="0.01"> <interface type="ethernet" name="eth0"> <mac address="ab:bb:cc:dd:ee:ff"/> </interface> <interface type="ethernet" name="eth1"/> </bridge> </interface> In [96]: conn.interfaceDefineXML(interfacexml,0) ---------------------------------------------------------------------------libvirtError Traceback (most recent call last)/home/saju/<ipython-input-96-0536ffe3fa23> in <module>()----> 1 conn.interfaceDefineXML(br1xml,0) /usr/lib/python2.7/dist-packages/libvirt.pyc in interfaceDefineXML(self, xml, flags) 2750 libvirtd. """ 2751 ret = libvirtmod.virInterfaceDefineXML(self._o, xml, flags)-> 2752 if ret is None:raise libvirtError('virInterfaceDefineXML() failed', conn=self) 2753 __tmp = virInterface(self, _obj=ret) 2754 return __tmp libvirtError: this function is not supported by the connection driver: virInterfaceDefineXML Regards Sijo Jose

1 0

[libvirt] [PATCH] qemu.conf: Mention virtlockd in @lock_manager description
by Michal Privoznik 12 Mar '14

12 Mar '14

When I played with virtlockd I was stunned by lacking documentation. My frustration got bigger when I had to read the patches to get the correct value to set in qemu.conf. Moreover, from pure libvirt-pride I'm changing commented value from sanlock to lockd. We want to favor our own implementation after all. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu.conf | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index e436084..f0e802f 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -402,11 +402,13 @@ #allow_disk_format_probing = 1 -# To enable 'Sanlock' project based locking of the file -# content (to prevent two VMs writing to the same -# disk), uncomment this +# In order to prevent accidentally starting two domains that +# share one writable disk, libvirt offers two approaches for +# locking files. The first one is sanlock, the other one, +# virtlockd, is then our own implementation. Accepted values +# are "sanlock" and "lockd". # -#lock_manager = "sanlock" +#lock_manager = "lockd" -- 1.9.0

3 4

[libvirt] [PATCH] qemu: don't munge user input during block commit
by Eric Blake 11 Mar '14

11 Mar '14

While investigating https://bugzilla.redhat.com/show_bug.cgi?id=1061827 I noticed that we pass user input unscathed for block-pull, but always pass a canonical absolute name through for block-commit. [Note that we probably _ought_ to validate that the user's request for block-pull actually matches the backing chain, the way we already do for block-commit - but that's a separate issue. Further note that the ability to pass user input through unscathed allows backdoors such as specifying a backing image that is a network URI such as a gluster disk, instead of forcing things to the local file system; which is an area still under active investigation on whether libvirt needs to behave differently for network disks.] Since qemu may write the name that the user passed in as the backing file, a user may have a reason to want a relative file name passed through to qemu, and always munging things to absolute prevents that. Put another way, if you have the backing chain: [A] <- [B(back=./A)] <- [C(back=./B)] and commit B into A (virsh blockcommit $dom vda --base A --top B), the metadata of C will have to be re-written. But should it be rewritten as [C(back=./A)] or as [C(back=/path/to/A)]? Still up in the air is whether qemu's decision should be based on whether B and/or C had relative paths, or on whether the --base and/or --top arguments to the command were relative paths; but if we always pass a canonical name, we've prevented the spelling of the command arguments from being part of the hueristics that qemu uses. I also audited the code, and verified that we never call qemuMonitorBlockCommit() with a NULL base, either before or after the change to qemu_driver.c. * src/qemu/qemu_driver.c (qemuDomainBlockCommit): Preserve user's spelling, since absolute vs. relative matters to qemu. * src/qemu/qemu_monitor.h (qemuMonitorBlockCommit): Base is never null. * src/qemu/qemu_monitor.c (qemuMonitorBlockCommit): Likewise. * src/qemu/qemu_monitor_json.h (qemuMonitorJSONBlockCommit): Likewise. * src/qemu/qemu_monitor_json.c (qemuMonitorJSONBlockCommit): Likewise. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- I was _hoping_ that this would solve the mentioned bugzilla. But even with this applied, qemu still ended up writing an absolute backing file name into the active file in the backing chain, so that bug has been reassigned back to qemu - it probably has to do with the fact that libvirt always spawns qemu with -drive pointing to an absolute name, which is unrelated to what this patch fixes. Therefore, I'm a little bit hesitant to apply this patch, but wanted to post it for review anyway. src/qemu/qemu_driver.c | 11 ++++++++--- src/qemu/qemu_monitor.c | 4 ++-- src/qemu/qemu_monitor.h | 3 ++- src/qemu/qemu_monitor_json.c | 2 +- src/qemu/qemu_monitor_json.h | 5 +++-- 5 files changed, 16 insertions(+), 9 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 9aad2dc..31adf78 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -15383,10 +15383,15 @@ qemuDomainBlockCommit(virDomainPtr dom, const char *path, const char *base, VIR_DISK_CHAIN_READ_WRITE) < 0)) goto endjob; - /* Start the commit operation. */ + /* Start the commit operation. Pass the user's original spelling, + * if any, through to qemu, since qemu behaves differently + * depending on whether the input was specified as relative or + * absolute (that is, our absolute top_canon may do the wrong + * thing if the user specified a name). */ qemuDomainObjEnterMonitor(driver, vm); - ret = qemuMonitorBlockCommit(priv->mon, device, top_canon, base_canon, - bandwidth); + ret = qemuMonitorBlockCommit(priv->mon, device, + top ? top : top_canon, + base ? base : base_canon, bandwidth); qemuDomainObjExitMonitor(driver, vm); endjob: diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index a2769db..e4707b7 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -1,7 +1,7 @@ /* * qemu_monitor.c: interaction with QEMU monitor console * - * Copyright (C) 2006-2013 Red Hat, Inc. + * Copyright (C) 2006-2014 Red Hat, Inc. * Copyright (C) 2006 Daniel P. Berrange * * This library is free software; you can redistribute it and/or @@ -3188,7 +3188,7 @@ qemuMonitorBlockCommit(qemuMonitorPtr mon, const char *device, unsigned long long speed; VIR_DEBUG("mon=%p, device=%s, top=%s, base=%s, bandwidth=%ld", - mon, device, NULLSTR(top), NULLSTR(base), bandwidth); + mon, device, top, base, bandwidth); /* Convert bandwidth MiB to bytes - unfortunately the JSON QMP protocol is * limited to LLONG_MAX also for unsigned values */ diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h index eabf000..7bb465b 100644 --- a/src/qemu/qemu_monitor.h +++ b/src/qemu/qemu_monitor.h @@ -647,7 +647,8 @@ int qemuMonitorBlockCommit(qemuMonitorPtr mon, const char *top, const char *base, unsigned long bandwidth) - ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3); + ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3) + ATTRIBUTE_NONNULL(4); int qemuMonitorArbitraryCommand(qemuMonitorPtr mon, const char *cmd, diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index ee3ae15..40d6d1a 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -3307,7 +3307,7 @@ qemuMonitorJSONBlockCommit(qemuMonitorPtr mon, const char *device, "s:device", device, "U:speed", speed, "s:top", top, - base ? "s:base" : NULL, base, + "s:base", base, NULL); if (!cmd) return -1; diff --git a/src/qemu/qemu_monitor_json.h b/src/qemu/qemu_monitor_json.h index a93c51e..ef71588 100644 --- a/src/qemu/qemu_monitor_json.h +++ b/src/qemu/qemu_monitor_json.h @@ -1,7 +1,7 @@ /* * qemu_monitor_json.h: interaction with QEMU monitor console * - * Copyright (C) 2006-2009, 2011-2013 Red Hat, Inc. + * Copyright (C) 2006-2009, 2011-2014 Red Hat, Inc. * Copyright (C) 2006 Daniel P. Berrange * * This library is free software; you can redistribute it and/or @@ -258,7 +258,8 @@ int qemuMonitorJSONBlockCommit(qemuMonitorPtr mon, const char *top, const char *base, unsigned long long bandwidth) - ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3); + ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3) + ATTRIBUTE_NONNULL(4); int qemuMonitorJSONArbitraryCommand(qemuMonitorPtr mon, const char *cmd_str, -- 1.8.5.3

2 2

[libvirt] [PATCH] iptables: don't log command probe failures
by Eric Blake 11 Mar '14

11 Mar '14

Commit b9dd878f caused a regression in iptables interaction by logging non-zero status at a higher level than VIR_INFO. Revert that portion of the commit, as well as adding a comment explaining why we check the status ourselves. Reported by Nehal J Wani. * src/util/viriptables.c (virIpTablesOnceInit): Undo log regression. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- src/util/viriptables.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/util/viriptables.c b/src/util/viriptables.c index 9e03cc4..45f7789 100644 --- a/src/util/viriptables.c +++ b/src/util/viriptables.c @@ -60,6 +60,7 @@ static int virIpTablesOnceInit(void) { virCommandPtr cmd; + int status; #if HAVE_FIREWALLD firewall_cmd_path = virFindFileInPath("firewall-cmd"); @@ -70,7 +71,8 @@ virIpTablesOnceInit(void) cmd = virCommandNew(firewall_cmd_path); virCommandAddArgList(cmd, "--state", NULL); - if (virCommandRun(cmd, NULL) < 0) { + /* don't log non-zero status */ + if (virCommandRun(cmd, &status) < 0 || status != 0) { VIR_INFO("firewall-cmd found but disabled for iptables"); VIR_FREE(firewall_cmd_path); firewall_cmd_path = NULL; @@ -87,7 +89,8 @@ virIpTablesOnceInit(void) cmd = virCommandNew(IPTABLES_PATH); virCommandAddArgList(cmd, "-w", "-L", "-n", NULL); - if (virCommandRun(cmd, NULL) < 0) { + /* don't log non-zero status */ + if (virCommandRun(cmd, &status) < 0 || status != 0) { VIR_INFO("xtables locking not supported by your iptables"); } else { VIR_INFO("using xtables locking for iptables"); -- 1.8.5.3

2 2

[libvirt] [PATCH] build: work around FreeBSD stdlib.h bug
by Eric Blake 11 Mar '14

11 Mar '14

POSIX requires that <stdlib.h> expose WIFEXITED and friends, but FreeBSD and others fail to comply. We can work around it manually by including <sys/wait.h>, or we can work around it automatically by using gnulib's system-posix module. * bootstrap.conf (gnulib_modules): Add system-posix. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- I'll wait for a review on this one - we don't use system(), and it feels a little bit odd to list the system() module merely for its side effect of a fixed <stdlib.h>. The alternative is to continue using <sys/wait.h> everywhere that we use WIFEXITED and friends. bootstrap.conf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/bootstrap.conf b/bootstrap.conf index d24a714..bc6ce80 100644 --- a/bootstrap.conf +++ b/bootstrap.conf @@ -1,6 +1,6 @@ # Bootstrap configuration. -# Copyright (C) 2010-2013 Red Hat, Inc. +# Copyright (C) 2010-2014 Red Hat, Inc. # This library is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser General Public @@ -112,6 +112,7 @@ strerror_r-posix strptime strsep strtok_r +system-posix sys_stat sys_wait termios -- 1.8.5.3

3 7

[libvirt] [PATCH v3] nwfilter: Deactivate iptables MAC address check where needed
by Stefan Berger 11 Mar '14

11 Mar '14

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com> Recent Linux iptables (3.11.7) refuses to create iptables MAC address check rules using -m mac --mac-source <addr> where previous versions still allowed it. So we now need to deactivate the filtering rules for when the incoming traffic is filtered before it is sent into the VM. Those are typically the chains that start with FO-* or start with FP-* when they are being built. Adapt the documentation to reflect the fact that srcmacaddr, when used in iptables rules, should be regarded as deprecated due to the above mentioned problems. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- docs/formatnwfilter.html.in | 54 +++++++++++-------------------- src/nwfilter/nwfilter_ebiptables_driver.c | 29 ++++++++++------- 2 files changed, 36 insertions(+), 47 deletions(-) diff --git a/docs/formatnwfilter.html.in b/docs/formatnwfilter.html.in index 4b95fce..5c06bf2 100644 --- a/docs/formatnwfilter.html.in +++ b/docs/formatnwfilter.html.in @@ -1209,7 +1209,9 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated and + MAC address filtering using for example the mac protocol + above should be used</td> </tr> <tr> <td>srcipaddr</td> @@ -1320,22 +1322,9 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated and + MAC address filtering using for example the mac protocol + above should be used</td> </tr> <tr> <td>srcipaddr</td> @@ -1429,22 +1418,9 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated and + MAC address filtering using for example the mac protocol + above should be used</td> </tr> <tr> <td>srcipaddr</td> @@ -1529,7 +1505,9 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated and + MAC address filtering using for example the mac protocol + above should be used</td> </tr> <tr> <td>srcipaddr</td> @@ -1640,7 +1618,9 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated and + MAC address filtering using for example the mac protocol + above should be used</td> </tr> <tr> <td>srcipaddr</td> @@ -1735,7 +1715,9 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated and + MAC address filtering using for example the mac protocol + above should be used</td> </tr> <tr> <td>srcipaddr</td> diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 352c08f..bea9535 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -972,7 +972,7 @@ static int iptablesHandleSrcMacAddr(virBufferPtr buf, virNWFilterVarCombIterPtr vars, nwItemDescPtr srcMacAddr, - bool directionIn, + const char *chain, bool directionIn, bool *srcmacskipped) { char macaddr[VIR_MAC_STRING_BUFLEN]; @@ -984,6 +984,14 @@ iptablesHandleSrcMacAddr(virBufferPtr buf, return 0; } + /* recent Linux iptables does not allow this filtering rule to be + * applied to the FP-/FO- chains + */ + if (chain[1] == CHAINPREFIX_HOST_OUT_TEMP) { + *srcmacskipped = true; + return 0; + } + if (printDataType(vars, macaddr, sizeof(macaddr), srcMacAddr) < 0) @@ -1366,7 +1374,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.tcpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1421,7 +1429,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1454,7 +1462,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpliteHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1482,7 +1490,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.espHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1506,11 +1514,10 @@ _iptablesCreateRuleInstance(bool directionIn, virBufferAddLit(&buf, " -p ah"); bufUsed = virBufferUse(&buf); - if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.ahHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1538,7 +1545,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.sctpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1574,7 +1581,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.icmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1636,7 +1643,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.igmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1664,7 +1671,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.allHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; -- 1.8.1.4

1 0

[libvirt] Get disk size for disk type="network"
by Qiang Fu 11 Mar '14

11 Mar '14

Hi, In the output of "virsh dumpxml" command the disk section is as follows: <disk type='network' device='disk'> <driver name='qemu' type='raw' cache='writeback'/> <auth username='svl-cc1-cinder-user'> <secret type='ceph' uuid='e80afa94-a64c-486c-9e34-d55e85f26406'/> </auth> <source protocol='rbd' name='svl-cc1-cinder-volume-1/volume-0a4cdeab-863d-4394-845f-008b993bc4e9'> <host name='10.34.114.211' port='6789'/> <host name='10.34.114.212' port='6789'/> <host name='10.34.114.213' port='6789'/> </source> <target dev='vda' bus='virtio'/> <serial>0a4cdeab-863d-4394-845f-008b993bc4e9</serial> <alias name='virtio-disk0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> </disk> In this case how can I use libvirt to get the disk/volume size information? Thanks, Bruce

2 2

[libvirt] [PATCH] libxl: support sexpr in native to XML conversion
by Jim Fehlig 11 Mar '14

11 Mar '14

Supporting sexpr in connectDomainXMLFromNative in the libxl driver adds flexibility for users importing legacy Xen configuration into libvirt. E.g. this patch allows importing previous xend-managed domains from /var/lib/xend/domains/<dom-uuid>/config.sxp into the libvirt libxl driver. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- src/libxl/libxl_driver.c | 40 +++++++++++++++++++++++++++------------- 1 file changed, 27 insertions(+), 13 deletions(-) diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index a79efcb..65d80a2 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -46,6 +46,7 @@ #include "libxl_driver.h" #include "libxl_conf.h" #include "xen_xm.h" +#include "xen_sxpr.h" #include "virtypedparam.h" #include "viruri.h" #include "virstring.h" @@ -62,6 +63,7 @@ #define LIBXL_DOM_REQ_HALT 4 #define LIBXL_CONFIG_FORMAT_XM "xen-xm" +#define LIBXL_CONFIG_FORMAT_SEXPR "xen-sxpr" /* Number of Xen scheduler parameters */ #define XEN_SCHED_CREDIT_NPARAM 2 @@ -2867,8 +2869,9 @@ libxlDomainGetXMLDesc(virDomainPtr dom, unsigned int flags) } static char * -libxlConnectDomainXMLFromNative(virConnectPtr conn, const char * nativeFormat, - const char * nativeConfig, +libxlConnectDomainXMLFromNative(virConnectPtr conn, + const char *nativeFormat, + const char *nativeConfig, unsigned int flags) { libxlDriverPrivatePtr driver = conn->privateData; @@ -2882,22 +2885,33 @@ libxlConnectDomainXMLFromNative(virConnectPtr conn, const char * nativeFormat, if (virConnectDomainXMLFromNativeEnsureACL(conn) < 0) goto cleanup; - if (STRNEQ(nativeFormat, LIBXL_CONFIG_FORMAT_XM)) { + if (STREQ(nativeFormat, LIBXL_CONFIG_FORMAT_XM)) { + if (!(conf = virConfReadMem(nativeConfig, strlen(nativeConfig), 0))) + goto cleanup; + + if (!(def = xenParseXM(conf, + cfg->verInfo->xen_version_major, + cfg->caps))) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("parsing xm config failed")); + goto cleanup; + } + } else if (STREQ(nativeFormat, LIBXL_CONFIG_FORMAT_SEXPR)) { + /* only support latest xend config format */ + if (!(def = xenParseSxprString(nativeConfig, + XEND_CONFIG_VERSION_3_1_0, + NULL, + -1))) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("parsing sxpr config failed")); + goto cleanup; + } + } else { virReportError(VIR_ERR_INVALID_ARG, _("unsupported config type %s"), nativeFormat); goto cleanup; } - if (!(conf = virConfReadMem(nativeConfig, strlen(nativeConfig), 0))) - goto cleanup; - - if (!(def = xenParseXM(conf, - cfg->verInfo->xen_version_major, - cfg->caps))) { - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("parsing xm config failed")); - goto cleanup; - } - xml = virDomainDefFormat(def, VIR_DOMAIN_XML_INACTIVE); cleanup: -- 1.8.1.4

2 2

[libvirt] [PATCH] storage: Fix bugs in VIR_APPEND_ELEMENT series
by John Ferlan 11 Mar '14

11 Mar '14

>From commit id 'd53bbfd1' Found one core and one possible memory leak. Core seen during local virt-test/tp_libvirt run for the vol_create_from test. The memory leak was seen by inspection during a review of all VIR_APPEND_ELEMENT changes In storage_backend_disk/virStorageBackendDiskMakeDataVol(), the 'vol' needs to be kept around since it's used later, so use the _COPY macro. This caused a segv in libvirtd: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fffe87c3700 (LWP 6919)] virStorageBackendDiskMakeDataVol (vol=0x0, groups=0x7fffc8000d70, pool=0x7fffc8002460) at storage/storage_backend_disk.c:66 66 if (vol->target.path == NULL) { In storage_backend_rbd/virStorageBackendRBDRefreshPool() there's a failure path where the 'vol' needs to go through virStorageVolDefFree() since it wouldn't be appended. Signed-off-by: John Ferlan <jferlan(a)redhat.com> --- src/storage/storage_backend_disk.c | 3 ++- src/storage/storage_backend_rbd.c | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/src/storage/storage_backend_disk.c b/src/storage/storage_backend_disk.c index b261773..2b6011b 100644 --- a/src/storage/storage_backend_disk.c +++ b/src/storage/storage_backend_disk.c @@ -57,7 +57,8 @@ virStorageBackendDiskMakeDataVol(virStoragePoolObjPtr pool, */ tmp = strrchr(groups[0], '/'); if (VIR_STRDUP(vol->name, tmp ? tmp + 1 : groups[0]) < 0 || - VIR_APPEND_ELEMENT(pool->volumes.objs, pool->volumes.count, vol) < 0) { + VIR_APPEND_ELEMENT_COPY(pool->volumes.objs, + pool->volumes.count, vol) < 0) { virStorageVolDefFree(vol); return -1; } diff --git a/src/storage/storage_backend_rbd.c b/src/storage/storage_backend_rbd.c index bc52474..d78dbe4 100644 --- a/src/storage/storage_backend_rbd.c +++ b/src/storage/storage_backend_rbd.c @@ -401,6 +401,7 @@ static int virStorageBackendRBDRefreshPool(virConnectPtr conn, } if (VIR_APPEND_ELEMENT(pool->volumes.objs, pool->volumes.count, vol) < 0) { + virStorageVolDefFree(vol); virStoragePoolObjClearVols(pool); goto cleanup; } -- 1.8.5.3

2 1

[libvirt] [PATCH v2] nwfilter: Deactivate iptables MAC address check where needed
by Stefan Berger 11 Mar '14

11 Mar '14

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com> Recent Linux iptables (3.11.7) refuses to create iptables MAC address check rules using -m mac --mac-source <addr> where previous versions still allowed it. So we now need to deactivate the filtering rules for when the incoming traffic is filtered before it is sent into the VM. Those are typically the chains that start with FO-* or start with FP-* when they are being built. Adapt the documentation to reflect the fact that srcmacaddr, when used in iptables rules, should be regarded as deprecated due to the above mentioned problems. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- docs/formatnwfilter.html.in | 42 +++++-------------------------- src/nwfilter/nwfilter_ebiptables_driver.c | 29 +++++++++++++-------- 2 files changed, 24 insertions(+), 47 deletions(-) diff --git a/docs/formatnwfilter.html.in b/docs/formatnwfilter.html.in index 4b95fce..ee23d8e 100644 --- a/docs/formatnwfilter.html.in +++ b/docs/formatnwfilter.html.in @@ -1209,7 +1209,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1320,22 +1320,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1429,22 +1414,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1529,7 +1499,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1640,7 +1610,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1735,7 +1705,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 352c08f..ae20bf0 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -972,7 +972,7 @@ static int iptablesHandleSrcMacAddr(virBufferPtr buf, virNWFilterVarCombIterPtr vars, nwItemDescPtr srcMacAddr, - bool directionIn, + const char *chain, bool directionIn, bool *srcmacskipped) { char macaddr[VIR_MAC_STRING_BUFLEN]; @@ -984,6 +984,14 @@ iptablesHandleSrcMacAddr(virBufferPtr buf, return 0; } + /* recent Linux iptables does not allow this filteirng rule to be + * applied to all FO-* chains + */ + if (chain[1] == CHAINPREFIX_HOST_OUT_TEMP) { + *srcmacskipped = true; + return 0; + } + if (printDataType(vars, macaddr, sizeof(macaddr), srcMacAddr) < 0) @@ -1366,7 +1374,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.tcpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1421,7 +1429,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1454,7 +1462,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpliteHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1482,7 +1490,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.espHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1506,11 +1514,10 @@ _iptablesCreateRuleInstance(bool directionIn, virBufferAddLit(&buf, " -p ah"); bufUsed = virBufferUse(&buf); - if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.ahHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1538,7 +1545,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.sctpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1574,7 +1581,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.icmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1636,7 +1643,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.igmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1664,7 +1671,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.allHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; -- 1.8.1.4

2 1

[libvirt] Google Summer of Code 2014 - Rewriting Virtual-Box Driver
by prashanth sunder 11 Mar '14

11 Mar '14

Hello, I am applying for the project idea "Rewriting Virtual-Box Driver" suggested by Michal Privoznik(mprivozn(a)redhat.com) in the "Qemu" ideas page ( http://wiki.qemu.org/Google_Summer_of_Code_2014) In the short span of time that I had after my discussion with Mr. Privoznik, the current Virtual Box driver code is not structured very well(lot of #ifdef's in the current code) and very hard to read. Since libvirt has to support all versions of Virtual Box, the current code decides on what code to compile based on the value of the macro VBOX_API_VERSION that is checked during ./configure. The only thing after discussion that we were able to come up with is putting version specific code under particular files and only compile the those necessary files during "make" For instance, if a function X() supports version A, B, C we will have function X() in vbox_A.c just for version A, function X() in vbox_B.c just for version B and so on. Any other suggestions than the above mentioned one which can be used to fix the problem?? Regards, Prashanth Sunder

2 1

[libvirt] [PATCH] Fix sec label setup when attaching to QEMU processes
by Daniel P. Berrange 11 Mar '14

11 Mar '14

When attaching to a QEMU process, the def->seclabels array is going to be empty. The qemuProcessAttach method must thus populate it with data for the security drivers. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/qemu/qemu_process.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 1f00840..7d41c93 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -4479,6 +4479,7 @@ int qemuProcessAttach(virConnectPtr conn ATTRIBUTE_UNUSED, virDomainPausedReason reason; virSecurityLabelPtr seclabel = NULL; virSecurityLabelDefPtr seclabeldef = NULL; + bool seclabelgen = false; virSecurityManagerPtr* sec_managers = NULL; const char *model; virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(driver); @@ -4529,10 +4530,16 @@ int qemuProcessAttach(virConnectPtr conn ATTRIBUTE_UNUSED, goto error; for (i = 0; sec_managers[i]; i++) { + seclabelgen = false; + VIR_ERROR("Iter %zu", i); model = virSecurityManagerGetModel(sec_managers[i]); seclabeldef = virDomainDefGetSecurityLabelDef(vm->def, model); - if (seclabeldef == NULL) - goto error; + VIR_ERROR("model %s def %p", model, seclabeldef); + if (seclabeldef == NULL) { + if (!(seclabeldef = virDomainDefGenSecurityLabelDef(model))) + goto error; + seclabelgen = true; + } seclabeldef->type = VIR_DOMAIN_SECLABEL_STATIC; if (VIR_ALLOC(seclabel) < 0) goto error; @@ -4546,6 +4553,12 @@ int qemuProcessAttach(virConnectPtr conn ATTRIBUTE_UNUSED, if (VIR_STRDUP(seclabeldef->label, seclabel->label) < 0) goto error; VIR_FREE(seclabel); + + if (seclabelgen) { + if (VIR_APPEND_ELEMENT(vm->def->seclabels, vm->def->nseclabels, seclabeldef) < 0) + goto error; + seclabelgen = false; + } } VIR_DEBUG("Creating domain log file"); @@ -4692,6 +4705,8 @@ error: VIR_FORCE_CLOSE(logfile); VIR_FREE(seclabel); VIR_FREE(sec_managers); + if (seclabelgen) + virSecurityLabelDefFree(seclabeldef); virDomainChrSourceDefFree(monConfig); virObjectUnref(cfg); virObjectUnref(caps); -- 1.8.5.3

2 2

[libvirt] Suspending access to opened/active /dev/nodes during application runtime
by Lukasz Pawelczyk 11 Mar '14

11 Mar '14

Problem: Has anyone thought about a mechanism to limit/remove an access to a device during an application runtime? Meaning we have an application that has an open file descriptor to some /dev/node and depending on *something* it gains or looses the access to it gracefully (with or without a notification, but without any fatal consequences). Example: LXC. Imagine we have 2 separate containers. Both running full operating systems. Specifically with 2 X servers. Both running concurrently of course. Both need the same input devices (e.g. we have just one mouse). This creates a security problem when we want to have completely separate environments. One container is active (being displayed on a monitor and controlled with a mouse) while the other container runs evtest /dev/input/something and grabs the secret password user typed in the other. Solutions: The complete solution would comprise of 2 parts: - a mechanism that would allow to temporally "hide" a device from an open file descriptor. - a mechanism for deciding whether application/process/namespace should have an access to a specific device at a specific moment Let's focus on the first problem only, as it would need to be solved first anyway. I haven't found anything that would allow me to do it. There are a lot mechanisms that make it possible to restrict an access during open(): - DAC - ACL (controlled by hand or with uaccess) - LSM (in general) - device cgroups But all of those can't do a thing when the device is already opened and an application has a file descriptor. I don't see such mechanism in kernel sources either. I do imagine that it would not be possible for every device to handle such a thing (dri comes to mind) without breaking something (graphics card state in dri example). But there is class of simple input/output devices that would handle this without problems. I did implement some proof-of-concept solution for an evdev driver by allowing or disallowing events that go to evdev_client structure using some arbitrary condition. But this is far from a generic solution. My proof-of-concept is somewhat similar to this (I just found it): http://www.spinics.net/lists/linux-input/msg25547.html Though a little bit wider in scope. But neither is flawless nor generic. Has anyone had any thoughts about a similar problem? -- Regards Havner

4 5

[libvirt] How to apply for Google Summer of Code
by Stefan Hajnoczi 11 Mar '14

11 Mar '14

Dear students, Applications for Google Summer of Code opened on Monday, 10th of March and will continue until Friday, 21st of March. The common question we are getting is "How do I apply?" :). Here is the application checklist: 1. Choose a project idea and get in touch with the mentor. The project ideas and mentors are listed here: http://qemu-project.org/Google_Summer_of_Code_2014 2. Put together a rough project plan (design + schedule) that breaks down the solution you are proposing. You can email a draft to your mentor for feedback or ask for clarifications about the project idea. 3. Go to http://google-melange.com/, log in and submit your application form for QEMU. The application template is here: https://www.google-melange.com/gsoc/org2/google/gsoc2014/qemu Remember the deadline for applications Friday, 21st of March. You can reach mentors on #qemu-gsoc on irc.oftc.net or via email. Stefan

1 0

[libvirt] [PATCH v2 0/3] Add caching of QEMU probed capabilities
by Daniel P. Berrange 11 Mar '14

11 Mar '14

A followup to https://www.redhat.com/archives/libvir-list/2014-March/msg00297.html Probing capabilities takes 200-300ms per binary and we have as many as 26 binaries. This noticably slows down libvirtd startup. It does not look like performance of probing QEMU can be improved, so this series introduces caching of the capabilities information. So the first time libvirtd starts it'll be slow, but thereafter it is fast. The cache is invalidated any time the QEMU binary timestamp changes or the libvirtd binary or driver module timestamp changes. In v2: - Store timestamps in XML file instead of non-portable utimes() - Use ctime instead of mtime since the latter can be faked by package managers to go backwards in time. Daniel P. Berrange (3): Add helper APIs to track if libvirtd or loadable modules have changed Change QEMU capabilities cache to check ctime instead of mtime Cache result of QEMU capabilities extraction daemon/libvirtd.c | 2 + src/driver.c | 2 + src/libvirt_private.syms | 2 + src/qemu/qemu_capabilities.c | 442 +++++++++++++++++++++++++++++++++++++++++-- src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_driver.c | 1 + src/util/virutil.c | 23 +++ src/util/virutil.h | 4 + 8 files changed, 467 insertions(+), 11 deletions(-) -- 1.8.5.3

3 8

[libvirt] [PATCH] tests: Distribute securityselinuxhelperdata
by Jiri Denemark 11 Mar '14

11 Mar '14

Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- Notes: Pushed as a build-breaker since 'make distcheck' fails without this patch. tests/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/Makefile.am b/tests/Makefile.am index 5c1f420..3267ad3 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -97,6 +97,7 @@ EXTRA_DIST = \ qemuxml2xmloutdata \ qemuxmlnsdata \ secretxml2xmlin \ + securityselinuxhelperdata \ securityselinuxlabeldata \ schematestutils.sh \ sexpr2xmldata \ -- 1.9.0

1 0

[libvirt] [PATCH] BZ1072677: Avoid freeing of 0 file descriptor
by Stefan Berger 11 Mar '14

11 Mar '14

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com> Avoid the freeing of an array of zero file descriptors in case of error. Introduce a macro VIR_INIT_N_FD to initialize such an array's elements to -1. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- src/qemu/qemu_hotplug.c | 14 +++++++++++--- src/util/virfile.h | 12 ++++++++++++ 2 files changed, 23 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 6703c92..b295db2 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -874,9 +874,12 @@ int qemuDomainAttachNetDevice(virConnectPtr conn, tapfdSize = vhostfdSize = net->driver.virtio.queues; if (!tapfdSize) tapfdSize = vhostfdSize = 1; - if (VIR_ALLOC_N(tapfd, tapfdSize) < 0 || - VIR_ALLOC_N(vhostfd, vhostfdSize) < 0) + if (VIR_ALLOC_N(tapfd, tapfdSize) < 0) goto cleanup; + VIR_INIT_N_FD(tapfd, tapfdSize); + if (VIR_ALLOC_N(vhostfd, vhostfdSize) < 0) + goto cleanup; + VIR_INIT_N_FD(vhostfd, vhostfdSize); if (qemuNetworkIfaceConnect(vm->def, conn, driver, net, priv->qemuCaps, tapfd, &tapfdSize) < 0) goto cleanup; @@ -885,8 +888,12 @@ int qemuDomainAttachNetDevice(virConnectPtr conn, goto cleanup; } else if (actualType == VIR_DOMAIN_NET_TYPE_DIRECT) { tapfdSize = vhostfdSize = 1; - if (VIR_ALLOC(tapfd) < 0 || VIR_ALLOC(vhostfd) < 0) + if (VIR_ALLOC(tapfd) < 0) + goto cleanup; + *tapfd = -1; + if (VIR_ALLOC(vhostfd) < 0) goto cleanup; + *vhostfd = -1; if ((tapfd[0] = qemuPhysIfaceConnect(vm->def, driver, net, priv->qemuCaps, VIR_NETDEV_VPORT_PROFILE_OP_CREATE)) < 0) @@ -898,6 +905,7 @@ int qemuDomainAttachNetDevice(virConnectPtr conn, vhostfdSize = 1; if (VIR_ALLOC(vhostfd) < 0) goto cleanup; + *vhostfd = -1; if (qemuOpenVhostNet(vm->def, net, priv->qemuCaps, vhostfd, &vhostfdSize) < 0) goto cleanup; } diff --git a/src/util/virfile.h b/src/util/virfile.h index 20baf6f..802cf01 100644 --- a/src/util/virfile.h +++ b/src/util/virfile.h @@ -75,6 +75,18 @@ FILE *virFileFdopen(int *fdptr, const char *mode) ATTRIBUTE_RETURN_CHECK; VIR_FILE_CLOSE_PRESERVE_ERRNO | \ VIR_FILE_CLOSE_DONT_LOG)) +static inline void vir_init_n_int(int *ptr, int count, int value) +{ + int i; + + for (i = 0; i < count; i++) + ptr[i] = value; +} + +/* Initialize an array of file descriptors to -1 */ +# define VIR_INIT_N_FD(ptr, count) \ + vir_init_n_int(ptr, count, -1) + /* Opaque type for managing a wrapper around a fd. */ struct _virFileWrapperFd; -- 1.8.1.4

3 5

[libvirt] [PATCH v2] qemu: cleanup tap devices on FreeBSD
by Roman Bogorodskiy 11 Mar '14

11 Mar '14

We have to explicitly destroy TAP devices on FreeBSD because they're not freed after being closed, otherwise we end up with orphaned TAP devices after destroying a domain. --- src/qemu/qemu_process.c | 7 +++++++ src/util/virnetdevtap.h | 6 ++++++ 2 files changed, 13 insertions(+) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index ffa939a..6806539 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -61,6 +61,7 @@ #include "viruuid.h" #include "virprocess.h" #include "virtime.h" +#include "virnetdevbridge.h" #include "virnetdevtap.h" #include "virbitmap.h" #include "viratomic.h" @@ -4381,6 +4382,12 @@ void qemuProcessStop(virQEMUDriverPtr driver, virDomainNetGetActualVirtPortProfile(net), cfg->stateDir)); VIR_FREE(net->ifname); +#ifdef VIR_NETDEV_TAP_REQUIRE_MANUAL_CLEANUP + } else if (virDomainNetGetActualType(net) == VIR_DOMAIN_NET_TYPE_BRIDGE) { + ignore_value(virNetDevBridgeRemovePort(virDomainNetGetActualBridgeName(net), + net->ifname)); + ignore_value(virNetDevTapDelete(net->ifname)); +#endif } /* release the physical device (or any other resources used by * this interface in the network driver diff --git a/src/util/virnetdevtap.h b/src/util/virnetdevtap.h index a762b31..1e5bd19 100644 --- a/src/util/virnetdevtap.h +++ b/src/util/virnetdevtap.h @@ -27,6 +27,12 @@ # include "virnetdevvportprofile.h" # include "virnetdevvlan.h" +# ifdef __FreeBSD__ +/* This should be defined on OSes that don't automatically + * cleanup released devices */ +# define VIR_NETDEV_TAP_REQUIRE_MANUAL_CLEANUP 1 +# endif + int virNetDevTapCreate(char **ifname, int *tapfd, int tapfdSize, -- 1.8.4.3

2 2

[libvirt] [PATCH] datatypes: Fix comments
by Michael Chapman 11 Mar '14

11 Mar '14

- As of commit 2ff4c137, all virGet*() functions in datatypes.c always return pointers to new objects. Objects are not cached in a per-connection hashtable. - Fix variable names in comments for all vir*Dispose() functions in datatypes.c. - Add comments for virGetStream(), virStreamDispose(), virGetDomainSnapshot(), virDomainSnapshotDispose(). Signed-off-by: Michael Chapman <mike(a)very.puzzling.org> --- src/datatypes.c | 126 +++++++++++++++++++++++++++++++++----------------------- 1 file changed, 74 insertions(+), 52 deletions(-) diff --git a/src/datatypes.c b/src/datatypes.c index 20752cd..6f98aed 100644 --- a/src/datatypes.c +++ b/src/datatypes.c @@ -96,9 +96,9 @@ VIR_ONCE_GLOBAL_INIT(virDataTypes) /** * virGetConnect: * - * Allocates a new hypervisor connection structure + * Allocates a new hypervisor connection object. * - * Returns a new pointer or NULL in case of error. + * Returns a pointer to the connection object, or NULL on error. */ virConnectPtr virGetConnect(void) @@ -126,7 +126,7 @@ error: /** * virConnectDispose: - * @conn: the hypervisor connection to release + * @obj: the hypervisor connection to release * * Unconditionally release all memory associated with a connection. * The connection object must not be used once this method returns. @@ -196,12 +196,10 @@ virConnectCloseCallbackDataDispose(void *obj) * @name: pointer to the domain name * @uuid: pointer to the uuid * - * Lookup if the domain is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates a new domain object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. * - * Returns a pointer to the domain, or NULL in case of failure + * Returns a pointer to the domain object, or NULL on error. */ virDomainPtr virGetDomain(virConnectPtr conn, const char *name, const unsigned char *uuid) @@ -234,7 +232,7 @@ error: /** * virDomainDispose: - * @domain: the domain to release + * @obj: the domain to release * * Unconditionally release all memory associated with a domain. * The domain object must not be used once this method returns. @@ -262,12 +260,10 @@ virDomainDispose(void *obj) * @name: pointer to the network name * @uuid: pointer to the uuid * - * Lookup if the network is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates a new network object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. * - * Returns a pointer to the network, or NULL in case of failure + * Returns a pointer to the network object, or NULL on error. */ virNetworkPtr virGetNetwork(virConnectPtr conn, const char *name, const unsigned char *uuid) @@ -299,7 +295,7 @@ error: /** * virNetworkDispose: - * @network: the network to release + * @obj: the network to release * * Unconditionally release all memory associated with a network. * The network object must not be used once this method returns. @@ -327,13 +323,10 @@ virNetworkDispose(void *obj) * @name: pointer to the interface name * @mac: pointer to the mac * - * Lookup if the interface is already registered for that connection, - * if yes return a new pointer to it (possibly updating the MAC - * address), if no allocate a new structure, and register it in the - * table. In any case a corresponding call to virObjectUnref() is - * needed to not leak data. + * Allocates a new interface object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. * - * Returns a pointer to the interface, or NULL in case of failure + * Returns a pointer to the interface object, or NULL on error. */ virInterfacePtr virGetInterface(virConnectPtr conn, const char *name, const char *mac) @@ -368,7 +361,7 @@ error: /** * virInterfaceDispose: - * @interface: the interface to release + * @obj: the interface to release * * Unconditionally release all memory associated with an interface. * The interface object must not be used once this method returns. @@ -396,12 +389,10 @@ virInterfaceDispose(void *obj) * @privateData: pointer to driver specific private data * @freeFunc: private data cleanup function pointer specfic to driver * - * Lookup if the storage pool is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates a new storage pool object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. * - * Returns a pointer to the storage pool, or NULL in case of failure + * Returns a pointer to the storage pool object, or NULL on error. */ virStoragePoolPtr virGetStoragePool(virConnectPtr conn, const char *name, @@ -440,7 +431,7 @@ error: /** * virStoragePoolDispose: - * @pool: the pool to release + * @obj: the storage pool to release * * Unconditionally release all memory associated with a pool. * The pool object must not be used once this method returns. @@ -475,12 +466,10 @@ virStoragePoolDispose(void *obj) * @privateData: pointer to driver specific private data * @freeFunc: private data cleanup function pointer specfic to driver * - * Lookup if the storage vol is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates a new storage volume object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. * - * Returns a pointer to the storage vol, or NULL in case of failure + * Returns a pointer to the storage volume object, or NULL on error. */ virStorageVolPtr virGetStorageVol(virConnectPtr conn, const char *pool, const char *name, @@ -520,7 +509,7 @@ error: /** * virStorageVolDispose: - * @vol: the vol to release + * @obj: the storage volume to release * * Unconditionally release all memory associated with a volume. * The volume object must not be used once this method returns. @@ -550,12 +539,10 @@ virStorageVolDispose(void *obj) * @conn: the hypervisor connection * @name: device name (unique on node) * - * Lookup if the device is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates a new node device object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. * - * Returns a pointer to the node device, or NULL in case of failure + * Returns a pointer to the node device object, or NULL on error. */ virNodeDevicePtr virGetNodeDevice(virConnectPtr conn, const char *name) @@ -585,7 +572,7 @@ error: /** * virNodeDeviceDispose: - * @dev: the dev to release + * @obj: the node device to release * * Unconditionally release all memory associated with a device. * The device object must not be used once this method returns. @@ -611,12 +598,10 @@ virNodeDeviceDispose(void *obj) * @conn: the hypervisor connection * @uuid: secret UUID * - * Lookup if the secret is already registered for that connection, if so return - * a pointer to it, otherwise allocate a new structure, and register it in the - * table. In any case a corresponding call to virObjectUnref() is needed to not - * leak data. + * Allocates a new secret object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. * - * Returns a pointer to the secret, or NULL in case of failure + * Returns a pointer to the secret object, or NULL on error. */ virSecretPtr virGetSecret(virConnectPtr conn, const unsigned char *uuid, @@ -650,7 +635,7 @@ error: /** * virSecretDispose: - * @secret: the secret to release + * @obj: the secret to release * * Unconditionally release all memory associated with a secret. * The secret object must not be used once this method returns. @@ -672,6 +657,15 @@ virSecretDispose(void *obj) } +/** + * virGetStream: + * @conn: the hypervisor connection + * + * Allocates a new stream object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. + * + * Returns a pointer to the stream object, or NULL on error. + */ virStreamPtr virGetStream(virConnectPtr conn) { @@ -688,6 +682,16 @@ virGetStream(virConnectPtr conn) return ret; } +/** + * virStreamDispose: + * @obj: the stream to release + * + * Unconditionally release all memory associated with a stream. + * The stream object must not be used once this method returns. + * + * It will also unreference the associated connection object, + * which may also be released if its ref count hits zero. + */ static void virStreamDispose(void *obj) { @@ -704,12 +708,10 @@ virStreamDispose(void *obj) * @name: pointer to the network filter pool name * @uuid: pointer to the uuid * - * Lookup if the network filter is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates a new network filter object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. * - * Returns a pointer to the network, or NULL in case of failure + * Returns a pointer to the network filter object, or NULL on error. */ virNWFilterPtr virGetNWFilter(virConnectPtr conn, const char *name, @@ -744,7 +746,7 @@ error: /** * virNWFilterDispose: - * @nwfilter: the nwfilter to release + * @obj: the network filter to release * * Unconditionally release all memory associated with a nwfilter. * The nwfilter object must not be used once this method returns. @@ -766,6 +768,16 @@ virNWFilterDispose(void *obj) } +/** + * virGetDomainSnapshot: + * @domain: the domain to snapshot + * @name: pointer to the domain snapshot name + * + * Allocates a new domain snapshot object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. + * + * Returns a pointer to the domain snapshot object, or NULL on error. + */ virDomainSnapshotPtr virGetDomainSnapshot(virDomainPtr domain, const char *name) { @@ -792,6 +804,16 @@ error: } +/** + * virDomainSnapshotDispose: + * @obj: the domain snapshot to release + * + * Unconditionally release all memory associated with a snapshot. + * The snapshot object must not be used once this method returns. + * + * It will also unreference the associated connection object, + * which may also be released if its ref count hits zero. + */ static void virDomainSnapshotDispose(void *obj) { -- 1.8.5.3

1 0

[libvirt] [PATCH] datatypes: Fix comments
by Michael Chapman 11 Mar '14

11 Mar '14

- As of commit 2ff4c137, all virGet*() functions in datatypes.c always return pointers to new objects. Objects are not cached in a per-connection hashtable. - As of commit 46ec5f85, the conn.lock mutex does not need to be held when calling any vir*Dispose() function in datatypes.c (via virObjectUnref()). - Add comments for virGetStream(), virStreamDispose(), virGetDomainSnapshot(), virDomainSnapshotDispose(). Signed-off-by: Michael Chapman <mike(a)very.puzzling.org> --- src/datatypes.c | 174 ++++++++++++++++++++++++++++++++------------------------ 1 file changed, 99 insertions(+), 75 deletions(-) diff --git a/src/datatypes.c b/src/datatypes.c index 73f17e7..aafa54b 100644 --- a/src/datatypes.c +++ b/src/datatypes.c @@ -96,9 +96,8 @@ VIR_ONCE_GLOBAL_INIT(virDataTypes) /** * virGetConnect: * - * Allocates a new hypervisor connection structure - * - * Returns a new pointer or NULL in case of error. + * Allocates and returns a pointer to a new hypervisor connection object. + * Returns NULL on error. */ virConnectPtr virGetConnect(void) @@ -129,9 +128,7 @@ error: * @conn: the hypervisor connection to release * * Unconditionally release all memory associated with a connection. - * The conn.lock mutex must be held prior to calling this, and will - * be released prior to this returning. The connection obj must not - * be used once this method returns. + * The connection object must not be used once this method returns. */ static void virConnectDispose(void *obj) @@ -198,12 +195,12 @@ virConnectCloseCallbackDataDispose(void *obj) * @name: pointer to the domain name * @uuid: pointer to the uuid * - * Lookup if the domain is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates and returns a pointer to a new domain object. + * Returns NULL on error. * - * Returns a pointer to the domain, or NULL in case of failure + * The domain object holds a reference to the hypervisor connection. + * When the domain object is no longer needed, virObjectUnref() must be + * called in order to not leak data. */ virDomainPtr virGetDomain(virConnectPtr conn, const char *name, const unsigned char *uuid) @@ -239,9 +236,7 @@ error: * @domain: the domain to release * * Unconditionally release all memory associated with a domain. - * The conn.lock mutex must be held prior to calling this, and will - * be released prior to this returning. The domain obj must not - * be used once this method returns. + * The domain object must not be used once this method returns. * * It will also unreference the associated connection object, * which may also be released if its ref count hits zero. @@ -266,12 +261,12 @@ virDomainDispose(void *obj) * @name: pointer to the network name * @uuid: pointer to the uuid * - * Lookup if the network is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates and returns a pointer to a new network object. + * Returns NULL on error. * - * Returns a pointer to the network, or NULL in case of failure + * The network object holds a reference to the hypervisor connection. + * When the network object is no longer needed, virObjectUnref() must be + * called in order to not leak data. */ virNetworkPtr virGetNetwork(virConnectPtr conn, const char *name, const unsigned char *uuid) @@ -306,9 +301,7 @@ error: * @network: the network to release * * Unconditionally release all memory associated with a network. - * The conn.lock mutex must be held prior to calling this, and will - * be released prior to this returning. The network obj must not - * be used once this method returns. + * The network object must not be used once this method returns. * * It will also unreference the associated connection object, * which may also be released if its ref count hits zero. @@ -333,13 +326,12 @@ virNetworkDispose(void *obj) * @name: pointer to the interface name * @mac: pointer to the mac * - * Lookup if the interface is already registered for that connection, - * if yes return a new pointer to it (possibly updating the MAC - * address), if no allocate a new structure, and register it in the - * table. In any case a corresponding call to virObjectUnref() is - * needed to not leak data. + * Allocates and returns a pointer to a new interface object. + * Returns NULL on error. * - * Returns a pointer to the interface, or NULL in case of failure + * The interface object holds a reference to the hypervisor connection. + * When the interface object is no longer needed, virObjectUnref() must be + * called in order to not leak data. */ virInterfacePtr virGetInterface(virConnectPtr conn, const char *name, const char *mac) @@ -377,9 +369,7 @@ error: * @interface: the interface to release * * Unconditionally release all memory associated with an interface. - * The conn.lock mutex must be held prior to calling this, and will - * be released prior to this returning. The interface obj must not - * be used once this method returns. + * The interface object must not be used once this method returns. * * It will also unreference the associated connection object, * which may also be released if its ref count hits zero. @@ -404,12 +394,12 @@ virInterfaceDispose(void *obj) * @privateData: pointer to driver specific private data * @freeFunc: private data cleanup function pointer specfic to driver * - * Lookup if the storage pool is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates and returns a pointer to a new storage pool object. + * Returns NULL on error. * - * Returns a pointer to the storage pool, or NULL in case of failure + * The pool object holds a reference to the hypervisor connection. + * When the pool object is no longer needed, virObjectUnref() must be + * called in order to not leak data. */ virStoragePoolPtr virGetStoragePool(virConnectPtr conn, const char *name, @@ -451,9 +441,7 @@ error: * @pool: the pool to release * * Unconditionally release all memory associated with a pool. - * The conn.lock mutex must be held prior to calling this, and will - * be released prior to this returning. The pool obj must not - * be used once this method returns. + * The pool object must not be used once this method returns. * * It will also unreference the associated connection object, * which may also be released if its ref count hits zero. @@ -485,12 +473,12 @@ virStoragePoolDispose(void *obj) * @privateData: pointer to driver specific private data * @freeFunc: private data cleanup function pointer specfic to driver * - * Lookup if the storage vol is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates and returns a pointer to a new storage volume object. + * Returns NULL on error. * - * Returns a pointer to the storage vol, or NULL in case of failure + * The volume object holds a reference to the hypervisor connection. + * When the volume object is no longer needed, virObjectUnref() must be + * called in order to not leak data. */ virStorageVolPtr virGetStorageVol(virConnectPtr conn, const char *pool, const char *name, @@ -532,10 +520,8 @@ error: * virStorageVolDispose: * @vol: the vol to release * - * Unconditionally release all memory associated with a vol. - * The conn.lock mutex must be held prior to calling this, and will - * be released prior to this returning. The vol obj must not - * be used once this method returns. + * Unconditionally release all memory associated with a volume. + * The volume object must not be used once this method returns. * * It will also unreference the associated connection object, * which may also be released if its ref count hits zero. @@ -562,12 +548,12 @@ virStorageVolDispose(void *obj) * @conn: the hypervisor connection * @name: device name (unique on node) * - * Lookup if the device is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates and returns a pointer to a new node device object. + * Returns NULL on error. * - * Returns a pointer to the node device, or NULL in case of failure + * The device object holds a reference to the hypervisor connection. + * When the device object is no longer needed, virObjectUnref() must be + * called in order to not leak data. */ virNodeDevicePtr virGetNodeDevice(virConnectPtr conn, const char *name) @@ -599,10 +585,8 @@ error: * virNodeDeviceDispose: * @dev: the dev to release * - * Unconditionally release all memory associated with a dev. - * The conn.lock mutex must be held prior to calling this, and will - * be released prior to this returning. The dev obj must not - * be used once this method returns. + * Unconditionally release all memory associated with a device. + * The device object must not be used once this method returns. * * It will also unreference the associated connection object, * which may also be released if its ref count hits zero. @@ -625,12 +609,12 @@ virNodeDeviceDispose(void *obj) * @conn: the hypervisor connection * @uuid: secret UUID * - * Lookup if the secret is already registered for that connection, if so return - * a pointer to it, otherwise allocate a new structure, and register it in the - * table. In any case a corresponding call to virObjectUnref() is needed to not - * leak data. + * Allocates and returns a pointer to a new secret object. + * Returns NULL on error. * - * Returns a pointer to the secret, or NULL in case of failure + * The secret object holds a reference to the hypervisor connection. + * When the secret object is no longer needed, virObjectUnref() must be + * called in order to not leak data. */ virSecretPtr virGetSecret(virConnectPtr conn, const unsigned char *uuid, @@ -666,12 +650,11 @@ error: * virSecretDispose: * @secret: the secret to release * - * Unconditionally release all memory associated with a secret. The conn.lock - * mutex must be held prior to calling this, and will be released prior to this - * returning. The secret obj must not be used once this method returns. + * Unconditionally release all memory associated with a secret. + * The secret object must not be used once this method returns. * - * It will also unreference the associated connection object, which may also be - * released if its ref count hits zero. + * It will also unreference the associated connection object, + * which may also be released if its ref count hits zero. */ static void virSecretDispose(void *obj) @@ -687,6 +670,17 @@ virSecretDispose(void *obj) } +/** + * virGetStream: + * @conn: the hypervisor connection + * + * Allocates and returns a pointer to a new stream object. + * Returns NULL on error. + * + * The secret object holds a reference to the hypervisor connection. + * When the secret object is no longer needed, virObjectUnref() must be + * called in order to not leak data. + */ virStreamPtr virGetStream(virConnectPtr conn) { @@ -703,6 +697,16 @@ virGetStream(virConnectPtr conn) return ret; } +/** + * virStreamDispose: + * @stream: the stream to release + * + * Unconditionally release all memory associated with a stream. + * The stream object must not be used once this method returns. + * + * It will also unreference the associated connection object, + * which may also be released if its ref count hits zero. + */ static void virStreamDispose(void *obj) { @@ -719,12 +723,12 @@ virStreamDispose(void *obj) * @name: pointer to the network filter pool name * @uuid: pointer to the uuid * - * Lookup if the network filter is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates and returns a pointer to a new nwfilter object. + * Returns NULL on error. * - * Returns a pointer to the network, or NULL in case of failure + * The nwfilter object holds a reference to the hypervisor connection. + * When the nwfilter object is no longer needed, virObjectUnref() must be + * called in order to not leak data. */ virNWFilterPtr virGetNWFilter(virConnectPtr conn, const char *name, @@ -762,9 +766,7 @@ error: * @nwfilter: the nwfilter to release * * Unconditionally release all memory associated with a nwfilter. - * The conn.lock mutex must be held prior to calling this, and will - * be released prior to this returning. The nwfilter obj must not - * be used once this method returns. + * The nwfilter object must not be used once this method returns. * * It will also unreference the associated connection object, * which may also be released if its ref count hits zero. @@ -783,6 +785,18 @@ virNWFilterDispose(void *obj) } +/** + * virGetDomainSnapshot: + * @conn: the hypervisor connection + * @name: pointer to the domain snapshot name + * + * Allocates and returns a pointer to a new domain snapshot object. + * Returns NULL on error. + * + * The snapshot object holds a reference to the hypervisor connection. + * When the snapshot object is no longer needed, virObjectUnref() must be + * called in order to not leak data. + */ virDomainSnapshotPtr virGetDomainSnapshot(virDomainPtr domain, const char *name) { @@ -809,6 +823,16 @@ error: } +/** + * virDomainSnapshotDispose: + * @snapshot: the snapshot to release + * + * Unconditionally release all memory associated with a snapshot. + * The snapshot object must not be used once this method returns. + * + * It will also unreference the associated connection object, + * which may also be released if its ref count hits zero. + */ static void virDomainSnapshotDispose(void *obj) { -- 1.8.5.3

2 3

[libvirt] [PATCH] nwfilter: Deactivate iptables MAC address check where needed
by Stefan Berger 10 Mar '14

10 Mar '14

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com> Recent Linux iptables (3.11.7) refuses to create iptables MAC address check rules using -m mac --mac-source <addr> where previous versions still allowed it. So we now need to deactivate the filtering rules for when the incoming traffic is filtered before it is sent into the VM. Those are typically the chains that start with FO-* or start with FP-* when they are being built. Adapt the documentation to reflect the fact that srcmacaddr, when used in iptables rules, should be regarded as deprecated due to the above mentioned problems. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- docs/formatnwfilter.html.in | 42 +++++-------------------------- src/nwfilter/nwfilter_ebiptables_driver.c | 29 +++++++++++++-------- 2 files changed, 24 insertions(+), 47 deletions(-) diff --git a/docs/formatnwfilter.html.in b/docs/formatnwfilter.html.in index 4b95fce..ee23d8e 100644 --- a/docs/formatnwfilter.html.in +++ b/docs/formatnwfilter.html.in @@ -1209,7 +1209,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1320,22 +1320,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1429,22 +1414,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1529,7 +1499,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1640,7 +1610,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1735,7 +1705,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 9d6cc90..ebc3505 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -972,7 +972,7 @@ static int iptablesHandleSrcMacAddr(virBufferPtr buf, virNWFilterVarCombIterPtr vars, nwItemDescPtr srcMacAddr, - bool directionIn, + const char *chain, bool directionIn, bool *srcmacskipped) { char macaddr[VIR_MAC_STRING_BUFLEN]; @@ -984,6 +984,14 @@ iptablesHandleSrcMacAddr(virBufferPtr buf, return 0; } + /* recent Linux iptables does not allow this filteirng rule to be + * applied to all FO-* chains + */ + if (chain[1] == CHAINPREFIX_HOST_OUT_TEMP ) { + *srcmacskipped = true; + return 0; + } + if (printDataType(vars, macaddr, sizeof(macaddr), srcMacAddr) < 0) @@ -1366,7 +1374,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.tcpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1421,7 +1429,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1454,7 +1462,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpliteHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1482,7 +1490,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.espHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1506,11 +1514,10 @@ _iptablesCreateRuleInstance(bool directionIn, virBufferAddLit(&buf, " -p ah"); bufUsed = virBufferUse(&buf); - if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.ahHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1538,7 +1545,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.sctpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1574,7 +1581,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.icmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1636,7 +1643,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.igmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1664,7 +1671,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.allHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; -- 1.8.1.4

2 2

[libvirt] [PATCH 1/3] no_mac_source
by Stefan Berger 10 Mar '14

10 Mar '14

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com> Subject nwfilter: Deactivate iptables MAC address check where needed Recent Linux iptables (3.11.7) refuses to create iptables MAC address check rules using -m mac --mac-source <addr> where previous versions still allowed it. So we now need to deactivate the filtering rules for when the incoming traffic is filtered before it is sent into the VM. Those are typically the chains that start with FO-* or start with FP-* when they are being built. Adapt the documentation to reflect the fact that srcmacaddr, when used in iptables rules, should be regarded as deprecated due to the above mentioned problems. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- docs/formatnwfilter.html.in | 42 +++++-------------------------- src/nwfilter/nwfilter_ebiptables_driver.c | 29 +++++++++++++-------- 2 files changed, 24 insertions(+), 47 deletions(-) diff --git a/docs/formatnwfilter.html.in b/docs/formatnwfilter.html.in index 4b95fce..ee23d8e 100644 --- a/docs/formatnwfilter.html.in +++ b/docs/formatnwfilter.html.in @@ -1209,7 +1209,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1320,22 +1320,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1429,22 +1414,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1529,7 +1499,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1640,7 +1610,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1735,7 +1705,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 9d6cc90..ebc3505 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -972,7 +972,7 @@ static int iptablesHandleSrcMacAddr(virBufferPtr buf, virNWFilterVarCombIterPtr vars, nwItemDescPtr srcMacAddr, - bool directionIn, + const char *chain, bool directionIn, bool *srcmacskipped) { char macaddr[VIR_MAC_STRING_BUFLEN]; @@ -984,6 +984,14 @@ iptablesHandleSrcMacAddr(virBufferPtr buf, return 0; } + /* recent Linux iptables does not allow this filteirng rule to be + * applied to all FO-* chains + */ + if (chain[1] == CHAINPREFIX_HOST_OUT_TEMP ) { + *srcmacskipped = true; + return 0; + } + if (printDataType(vars, macaddr, sizeof(macaddr), srcMacAddr) < 0) @@ -1366,7 +1374,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.tcpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1421,7 +1429,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1454,7 +1462,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpliteHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1482,7 +1490,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.espHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1506,11 +1514,10 @@ _iptablesCreateRuleInstance(bool directionIn, virBufferAddLit(&buf, " -p ah"); bufUsed = virBufferUse(&buf); - if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.ahHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1538,7 +1545,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.sctpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1574,7 +1581,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.icmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1636,7 +1643,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.igmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1664,7 +1671,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.allHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; -- 1.8.1.4

2 1

[libvirt] Unable to start Nehalem VM on Nehalem host
by Ruben Kerkhof 10 Mar '14

10 Mar '14

Hi list, I'm trying to debug a strange issue I have, and I'd appreciate some help. I've upgraded libvirt to 1.2.2, on Scientific Linux, with qemu-kvm-0.12.1.2-2.415.el6_5.3 Here’s my analysis so far: I figured out that libvirt uses HMP to get the list of models from qemu-kvm by running qemu-kvm -cpu ?model -nodefconfig. This returns the following: x86 Opteron_G5 AMD Opteron 63xx class CPU x86 Opteron_G4 AMD Opteron 62xx class CPU x86 Opteron_G3 AMD Opteron 23xx (Gen 3 Class Opteron) x86 Opteron_G2 AMD Opteron 22xx (Gen 2 Class Opteron) x86 Opteron_G1 AMD Opteron 240 (Gen 1 Class Opteron) x86 Haswell Intel Core Processor (Haswell) x86 SandyBridge Intel Xeon E312xx (Sandy Bridge) x86 Westmere Westmere E56xx/L56xx/X56xx (Nehalem-C) x86 Nehalem Intel Core i7 9xx (Nehalem Class Core i7) x86 Penryn Intel Core 2 Duo P9xxx (Penryn Class Core 2) x86 Conroe Intel Celeron_4x0 (Conroe/Merom Class Core 2) x86 cpu64-rhel5 QEMU Virtual CPU version (cpu64-rhel5) x86 cpu64-rhel6 QEMU Virtual CPU version (cpu64-rhel6) x86 n270 Intel(R) Atom(TM) CPU N270 @ 1.60GHz x86 athlon QEMU Virtual CPU version 0.12.1 x86 pentium3 x86 pentium2 x86 pentium x86 486 x86 coreduo Genuine Intel(R) CPU T2600 @ 2.16GHz x86 qemu32 QEMU Virtual CPU version 0.12.1 x86 kvm64 Common KVM processor x86 core2duo Intel(R) Core(TM)2 Duo CPU T7700 @ 2.40GHz x86 phenom AMD Phenom(tm) 9550 Quad-Core Processor x86 qemu64 QEMU Virtual CPU version 0.12.1 The comment describing the function parsing this list states that the output is expected to be as follows: /* Format: * <arch> <model> * qemu-0.13 encloses some model names in []: * <arch> [<model>] */ static int virQEMUCapsParseX86Models(const char *output, virQEMUCapsPtr qemuCaps) { but this function doesn’t strip the rest of the line, so the models array becomes: Breakpoint 1, x86Decode (cpu=0x7fffd82a8460, data=0x7fffd8272d00, models=0x7fffd82b7440, nmodels=25, preferred=0x7fffd82a81f0 "Nehalem", flags=0) at cpu/cpu_x86.c:1487 1487 { (gdb) p models $1 = (const char **) 0x7fffd82b7440 (gdb) p *models $2 = 0x7fffd82ba240 "Opteron_G5 AMD Opteron 63xx class CPU", ' ' <repeats 22 times> (gdb) p *models@25 $3 = {0x7fffd82ba240 "Opteron_G5 AMD Opteron 63xx class CPU", ' ' <repeats 22 times>, 0x7fffd82c8c30 "Opteron_G4 AMD Opteron 62xx class CPU", ' ' <repeats 22 times>, 0x7fffd8169e00 "Opteron_G3 AMD Opteron 23xx (Gen 3 Class Opteron) ", 0x7fffd8169cb0 "Opteron_G2 AMD Opteron 22xx (Gen 2 Class Opteron) ", 0x7fffd8169b60 "Opteron_G1 AMD Opteron 240 (Gen 1 Class Opteron)", ' ' <repeats 11 times>, 0x7fffd8169a10 "Haswell Intel Core Processor (Haswell)", ' ' <repeats 18 times>, 0x7fffd81697e0 "SandyBridge Intel Xeon E312xx (Sandy Bridge)", ' ' <repeats 16 times>, 0x7fffd8169690 "Westmere Westmere E56xx/L56xx/X56xx (Nehalem-C) ", 0x7fffd8169460 "Nehalem Intel Core i7 9xx (Nehalem Class Core i7) ", 0x7fffd81693f0 "Penryn Intel Core 2 Duo P9xxx (Penryn Class Core 2) ", 0x7fffd8169310 "Conroe Intel Celeron_4x0 (Conroe/Merom Class Core 2) ", 0x7fffd8169230 "cpu64-rhel5 QEMU Virtual CPU version (cpu64-rhel5) ", 0x7fffd8169150 "cpu64-rhel6 QEMU Virtual CPU version (cpu64-rhel6) ", 0x7fffd82ba2b0 "n270 Intel(R) Atom(TM) CPU N270 @ 1.60GHz ", 0x7fffd81690e0 "athlon QEMU Virtual CPU version 0.12.1", ' ' <repeats 17 times>, 0x7fffd8169000 "pentium3", ' ' <repeats 50 times>, 0x7fffd8168f90 "pentium2", ' ' <repeats 50 times>, 0x7fffd8168eb0 "pentium", ' ' <repeats 50 times>, 0x7fffd82a8760 "486", ' ' <repeats 50 times>, 0x7fffd8168e40 "coreduo Genuine Intel(R) CPU", ' ' <repeats 11 times>, "T2600 @ 2.16GHz ", 0x7fffd8168d60 "qemu32 QEMU Virtual CPU version 0.12.1", ' ' <repeats 17 times>, 0x7fffd82bb150 "kvm64 Common KVM processor", ' ' <repeats 28 times>, 0x7fffd8168cf0 "core2duo Intel(R) Core(TM)2 Duo CPU T7700 @ 2.40GHz ", 0x7fffd8168c10 "phenom AMD Phenom(tm) 9550 Quad-Core Processor ", 0x7fffd8168b30 "qemu64 QEMU Virtual CPU version 0.12.1", ' ' <repeats 17 times>} cpuModellsAllowed then does a strcmp between “Nehalem” and "Nehalem Intel Core i7 9xx (Nehalem Class Core i7)” which fails, and the vm fails to start with: 2014-03-10 14:56:16.917+0000: 8328: info : qemuDomainDefineXML:6231 : Creating domain '530df8bd-7b64-4553-b4f4-18922e1327bf' 2014-03-10 14:56:17.114+0000: 8329: warning : x86Decode:1515 : Preferred CPU model Nehalem not allowed by hypervisor; closest supported model will be used 2014-03-10 14:56:17.114+0000: 8329: error : x86Decode:1571 : internal error: Cannot find suitable CPU model for given data Kind regards, Ruben Kerkhof

2 2

[libvirt] [PATCH] virSecurityDACSetSecurityImageLabel: Unmark @def as unused
by Michal Privoznik 10 Mar '14

10 Mar '14

The @def is clearly used just a few lines below. There's no need to use ATTRIBUTE_UNUSED for it. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/security/security_dac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 09b5e57..85e6eec 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -342,25 +342,25 @@ virSecurityDACSetSecurityFileLabel(virDomainDiskDefPtr disk ATTRIBUTE_UNUSED, static int virSecurityDACSetSecurityImageLabel(virSecurityManagerPtr mgr, - virDomainDefPtr def ATTRIBUTE_UNUSED, + virDomainDefPtr def, virDomainDiskDefPtr disk) { void *params[2]; virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); if (!priv->dynamicOwnership) return 0; if (disk->type == VIR_DOMAIN_DISK_TYPE_NETWORK) return 0; params[0] = mgr; params[1] = def; return virDomainDiskDefForeachPath(disk, false, virSecurityDACSetSecurityFileLabel, params); } -- 1.9.0

2 1