- Devel - libvirt List Archives

[libvirt] [PATCH] atomic snapshots, round 3
by Eric Blake 27 Mar '12

27 Mar '12

Depends on round 2 being applied first: https://www.redhat.com/archives/libvir-list/2012-March/msg00761.html This is the next part of my overall RFC: https://www.redhat.com/archives/libvir-list/2012-March/msg00578.html Eric Blake (1): snapshot: improve qemu handling of reused snapshot targets src/libvirt.c | 11 +++++++---- src/qemu/qemu_driver.c | 33 ++++++++++++++++++++++----------- src/qemu/qemu_monitor.c | 14 ++++++++------ src/qemu/qemu_monitor.h | 4 +++- src/qemu/qemu_monitor_json.c | 6 +++++- src/qemu/qemu_monitor_json.h | 4 +++- 6 files changed, 48 insertions(+), 24 deletions(-) -- 1.7.7.6

3 5

[libvirt] [PATCH v2 1/1] qemu, util: on restart of libvirt restart vepa callbacks
by D. Herrendoerfer 27 Mar '12

27 Mar '12

From: "D. Herrendoerfer" <d.herrendoerfer(a)herrendoerfer.name> When libvirtd is restarted, also restart the netlink event message callbacks for existing VEPA connections and send a message to lldpad for these existing links, so it learns the new libvirtd pid. This only includes qemu support as a base if this works out I'll add others. Signed-off-by: D. Herrendoerfer <d.herrendoerfer(a)herrendoerfer.name> --- src/qemu/qemu_driver.c | 30 ++++++++++ src/util/virnetdevmacvlan.c | 128 +++++++++++++++++++++++++++++++++--------- src/util/virnetdevmacvlan.h | 9 +++ 3 files changed, 139 insertions(+), 28 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 538a419..c93ece3 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -412,6 +412,34 @@ cleanup: virDomainObjUnlock(vm); } + +static void qemuDomainNetsRestart(void *payload, + const void *name ATTRIBUTE_UNUSED, + void *data) +{ + int i; + virDomainObjPtr vm = (virDomainObjPtr)payload; + virDomainDefPtr def = vm->def; + + virDomainObjLock(vm); + + for (i = 0; i < def->nnets; i++) { + virDomainNetDefPtr net = def->nets[i]; + if (net->type == VIR_DOMAIN_NET_TYPE_DIRECT && + net->data.direct.mode == VIR_NETDEV_MACVLAN_MODE_VEPA) { + VIR_DEBUG("Device active on %s in VEPA mode. Reassociating.",net->ifname); + ignore_value(virNetDevMacVLanRestartWithVPortProfile(net->ifname, + net->mac, + net->data.direct.linkdev, + def->uuid, + net->data.direct.virtPortProfile, + VIR_NETDEV_VPORT_PROFILE_OP_CREATE)); + } + } + + virDomainObjUnlock(vm); +} + /** * qemudStartup: * @@ -668,6 +696,8 @@ qemudStartup(int privileged) { NULL, NULL) < 0) goto error; + virHashForEach(qemu_driver->domains.objs, qemuDomainNetsRestart, NULL); + conn = virConnectOpen(qemu_driver->privileged ? "qemu:///system" : "qemu:///session"); diff --git a/src/util/virnetdevmacvlan.c b/src/util/virnetdevmacvlan.c index 647679f..eca4b6e 100644 --- a/src/util/virnetdevmacvlan.c +++ b/src/util/virnetdevmacvlan.c @@ -769,6 +769,49 @@ virNetDevMacVLanVPortProfileDestroyCallback(int watch ATTRIBUTE_UNUSED, virNetlinkCallbackDataFree((virNetlinkCallbackDataPtr)opaque); } +static int +virNetDevMacVLanVPortProfileRegisterCallback(const char *ifname, + const unsigned char *macaddress, + const char *linkdev, + const unsigned char *vmuuid, + virNetDevVPortProfilePtr virtPortProfile, + enum virNetDevVPortProfileOp vmOp) +{ + virNetlinkCallbackDataPtr calld = NULL; + + if (virtPortProfile && virNetlinkEventServiceIsRunning()) { + if (VIR_ALLOC(calld) < 0) + goto memory_error; + if ((calld->cr_ifname = strdup(ifname)) == NULL) + goto memory_error; + if (VIR_ALLOC(calld->virtPortProfile) < 0) + goto memory_error; + memcpy(calld->virtPortProfile, virtPortProfile, sizeof(*virtPortProfile)); + if (VIR_ALLOC_N(calld->macaddress, VIR_MAC_BUFLEN) < 0) + goto memory_error; + memcpy(calld->macaddress, macaddress, VIR_MAC_BUFLEN); + if ((calld->linkdev = strdup(linkdev)) == NULL) + goto memory_error; + if (VIR_ALLOC_N(calld->vmuuid, VIR_UUID_BUFLEN) < 0) + goto memory_error; + memcpy(calld->vmuuid, vmuuid, VIR_UUID_BUFLEN); + + calld->vmOp = vmOp; + + virNetlinkEventAddClient(virNetDevMacVLanVPortProfileCallback, + virNetDevMacVLanVPortProfileDestroyCallback, + calld, macaddress); + } + + return 0; + + memory_error: + virReportOOMError(); + virNetlinkCallbackDataFree(calld); + + return -1; +} + /** * virNetDevMacVLanCreateWithVPortProfile: @@ -810,7 +853,6 @@ int virNetDevMacVLanCreateWithVPortProfile(const char *tgifname, int retries, do_retry = 0; uint32_t macvtapMode; const char *cr_ifname; - virNetlinkCallbackDataPtr calld = NULL; int ret; int vf = -1; @@ -917,36 +959,12 @@ create_name: goto disassociate_exit; } - if (virtPortProfile && virNetlinkEventServiceIsRunning()) { - if (VIR_ALLOC(calld) < 0) - goto memory_error; - if ((calld->cr_ifname = strdup(cr_ifname)) == NULL) - goto memory_error; - if (VIR_ALLOC(calld->virtPortProfile) < 0) - goto memory_error; - memcpy(calld->virtPortProfile, virtPortProfile, sizeof(*virtPortProfile)); - if (VIR_ALLOC_N(calld->macaddress, VIR_MAC_BUFLEN) < 0) - goto memory_error; - memcpy(calld->macaddress, macaddress, VIR_MAC_BUFLEN); - if ((calld->linkdev = strdup(linkdev)) == NULL) - goto memory_error; - if (VIR_ALLOC_N(calld->vmuuid, VIR_UUID_BUFLEN) < 0) - goto memory_error; - memcpy(calld->vmuuid, vmuuid, VIR_UUID_BUFLEN); - - calld->vmOp = vmOp; - - virNetlinkEventAddClient(virNetDevMacVLanVPortProfileCallback, - virNetDevMacVLanVPortProfileDestroyCallback, - calld, macaddress); - } + if (virNetDevMacVLanVPortProfileRegisterCallback(cr_ifname, macaddress, + linkdev, vmuuid, virtPortProfile, vmOp) < 0 ) + goto disassociate_exit; return rc; - memory_error: - virReportOOMError(); - virNetlinkCallbackDataFree(calld); - disassociate_exit: ignore_value(virNetDevVPortProfileDisassociate(cr_ifname, virtPortProfile, @@ -1003,6 +1021,48 @@ int virNetDevMacVLanDeleteWithVPortProfile(const char *ifname, return ret; } +/** + * virNetDevMacVLanRestartWithVPortProfile: + * Register a port profile callback handler for a VM that + * is already running + * . + * @cr_ifname: Interface name that the macvtap has. + * @macaddress: The MAC address for the macvtap device + * @linkdev: The interface name of the NIC to connect to the external bridge + * @vmuuid: The UUID of the VM the macvtap belongs to + * @virtPortProfile: pointer to object holding the virtual port profile data + * @vmOp: Operation to use during setup of the association + * + * Returns 0; returns -1 on error. + */ +int virNetDevMacVLanRestartWithVPortProfile(const char *cr_ifname, + const unsigned char *macaddress, + const char *linkdev, + const unsigned char *vmuuid, + virNetDevVPortProfilePtr virtPortProfile, + enum virNetDevVPortProfileOp vmOp) +{ + int rc = 0; + + rc = virNetDevMacVLanVPortProfileRegisterCallback(cr_ifname, macaddress, + linkdev, vmuuid, + virtPortProfile, vmOp); + if (rc < 0) + goto error; + + ignore_value(virNetDevVPortProfileAssociate(cr_ifname, + virtPortProfile, + macaddress, + linkdev, + -1, + vmuuid, + vmOp, true)); + +error: + return rc; + +} + #else /* ! WITH_MACVTAP */ int virNetDevMacVLanCreate(const char *ifname ATTRIBUTE_UNUSED, const char *type ATTRIBUTE_UNUSED, @@ -1052,4 +1112,16 @@ int virNetDevMacVLanDeleteWithVPortProfile(const char *ifname ATTRIBUTE_UNUSED, _("Cannot create macvlan devices on this platform")); return -1; } + +int virNetDevMacVLanRestartWithVPortProfile(const char *cr_ifname ATTRIBUTE_UNUSED, + const unsigned char *macaddress ATTRIBUTE_UNUSED, + const char *linkdev ATTRIBUTE_UNUSED, + const unsigned char *vmuuid ATTRIBUTE_UNUSED, + virNetDevVPortProfilePtr virtPortProfile ATTRIBUTE_UNUSED, + enum virNetDevVPortProfileOp vmOp ATTRIBUTE_UNUSED) +{ + virReportSystemError(ENOSYS, "%s", + _("Cannot create macvlan devices on this platform")); + return -1; +} #endif /* ! WITH_MACVTAP */ diff --git a/src/util/virnetdevmacvlan.h b/src/util/virnetdevmacvlan.h index 130ecea..14640cf 100644 --- a/src/util/virnetdevmacvlan.h +++ b/src/util/virnetdevmacvlan.h @@ -75,4 +75,13 @@ int virNetDevMacVLanDeleteWithVPortProfile(const char *ifname, ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3) ATTRIBUTE_NONNULL(6) ATTRIBUTE_RETURN_CHECK; +int virNetDevMacVLanRestartWithVPortProfile(const char *cr_ifname, + const unsigned char *macaddress, + const char *linkdev, + const unsigned char *vmuuid, + virNetDevVPortProfilePtr virtPortProfile, + enum virNetDevVPortProfileOp vmOp) + ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3) + ATTRIBUTE_NONNULL(4) ATTRIBUTE_NONNULL(5) ATTRIBUTE_RETURN_CHECK; + #endif /* __UTIL_MACVTAP_H__ */ -- 1.7.7.6

2 2

[libvirt] LIBVIRT-PHP List of domains
by Ali Raza Memon 27 Mar '12

27 Mar '12

Hi.. I am trying to get the names of all the xen domains using libvirt-php. I saw this php script: <?php $conn = libvirt_connect('null', false); $doms = libvirt_list_domains($conn); print_r($doms); ?> It gives me error. Could you please tell me how to connect to xen hypervisor? I have also tried: $conn = libvirt_connect('xen:///', false); but it wont work..

2 1

Re: [libvirt] [PATCH] Add migration APIs for libxl driver
by Chunyan Liu 27 Mar '12

27 Mar '12

>>>> "Chun Yan Liu" <cyliu(a)suse.com> 3/6/2012 2:29 PM >>> >> I didn't get a chance to test this yet, but have some initial review >> comments. >> >>> Signed-off-by: Chunyan Liu >>> --- >>> src/libxl/libxl_driver.c | 617 >>> ++++++++++++++++++++++++++++++++++++++++++++++ >>> src/libxl/libxl_driver.h | 17 ++- >>> 2 files changed, 632 insertions(+), 2 deletions(-) >>> >>> diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c >>> index d5fa64a..4037635 100644 >>> --- a/src/libxl/libxl_driver.c >>> +++ b/src/libxl/libxl_driver.c >>> @@ -30,6 +30,12 @@ >>> #include >>> #include >>> #include >>> +#include >>> +#include >>> +#include >>> +#include >>> +#include >>> +#include >>> >>> #include "internal.h" >>> #include "logging.h" >>> @@ -60,6 +66,13 @@ >>> #define XEN_SCHED_CREDIT_NPARAM 2 >>> >>> static libxlDriverPrivatePtr libxl_driver = NULL; >>> +static virThread migrate_receive_thread; >>> >> >> This prevents receiving concurrent migrations. > Yes. It is a problem. Defined as "static" is to be used in Begin3 function > virThreadCreate and in Finish3() function virThreadJoin, but actually the > thread will exit when receiving data completed or meets error, so > virThreadJoin doesn't have much effect here. If a call of virThreadJoin is > not needed, then can specify migrate_receive_thread as a local variable. About concurrent migrations, there is another problem in migration port. Every time a migration operation is issued, it will create a socket connection between source and host to transfer data. If a port specified, target side will create a socket and bind to that port, otherwise will bind to a DEFAULT_MIGRATION_PORT (current implementation). But if 1st migration occupies the DEFAULT_MIGRATION_PORT, then 2nd migration (without specifying port) will fail to bind to the DEFAULT_MIGRATION_PORT again. So, to ensure concurrent migrations, perhaps we need a group of ports for migration usage, every migration operation probes for a usable port. How do you think? Thanks, Chunyan

3 8

[libvirt] [PATCH 0/2] Cleanup for return with parentheses
by Martin Kletzander 26 Mar '12

26 Mar '12

3 9

[libvirt] [PATCH] Expand docs for timer tick policy
by Daniel P. Berrange 26 Mar '12

26 Mar '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> --- docs/formatdomain.html.in | 25 ++++++++++++++++++++----- 1 files changed, 20 insertions(+), 5 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 814e270..c2eabc5 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -1016,11 +1016,23 @@ </dd> <dt><code>tickpolicy</code></dt> <dd> - The <code>tickpolicy</code> attribute determines how - missed ticks in the guest are handled, and can be "delay", - "catchup", "merge", or "discard". If the policy is - "catchup", there can be further details in - the <code>catchup</code> sub-element. + + The <code>tickpolicy</code> attribute determines what + happens whens QEMU misses a deadline for injecting a + tick to the guest: + + <dl> + <dt><code>delay</code></dt> + <dd>Continue to deliver ticks at the normal rate. The guest time will be delayed due to the late tick</dd> + <dt><code>catchup</code></dt> + <dd>Deliver ticks at a higher rate to catchup with the missed tick. The guest time should not be delayed once catch is complete.</dd> + <dt><code>merge</code></dt> + <dd>Merge the missed tick(s) into one tick and inject. The guest time may be delayed, depending on how the OS reacts to the merging of ticks</dd> + <dt><code>discard</code></dt> + <dd>Throw away the missed tick(s) and continue with future injection normally. The guest time may be delayed, unless the OS has explicit handling of lost ticks</dd> + </dl> + If the policy is "catchup", there can be further details in + the <code>catchup</code> sub-element. <dl> <dt><code>catchup</code></dt> <dd> @@ -1030,6 +1042,9 @@ and <code>limit</code>. </dd> </dl> + + Note that hypervisors are not required to support all policies across all time sources + </dd> <dt><code>frequency</code></dt> <dd> -- 1.7.7.6

2 1

[libvirt] Createion of external snapshot qcow2
by Pankaj Rawat 26 Mar '12

26 Mar '12

Hi all, I have a query regarding the external snapshot in qcow2 also known as backing file. In qemu I created a external snapshot and then create its xml in order to boot it from VIRSH. But that is complex process. I want to know whether there is any command in LIBVIRT which can create external snapshot(Backing file) and also we can boot from it? DISCLAIMER: ----------------------------------------------------------------------------------------------------------------------- The contents of this e-mail and any attachment(s) are confidential and intended for the named recipient(s) only. It shall not attach any liability on the originator or NECHCL or its affiliates. Any views or opinions presented in this email are solely those of the author and may not necessarily reflect the opinions of NECHCL or its affiliates. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of this message without the prior written consent of the author of this e-mail is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately. . -----------------------------------------------------------------------------------------------------------------------

2 1

[libvirt] [PATCH 0/3] build: fix 3 Fedora 17 build errors
by Laine Stump 26 Mar '12

26 Mar '12

The first two of these ("missing initializer") I would expect anybody to get if they're building with -Wall on Fedora 17, but the problems have been there at least since the last libvirt release. The last error only happens if you manually specify CFLAGS with no -O (or with -O0). Although these break the build for me, none of it is new, so I'll wait for ACKs before pushing. (I do think it would be good to get these fixes into the -rc2 candidate, though).

2 6

[libvirt] libvirt support for hot plugging multifunction PCI devices to KVM guests
by Nandini Chandra 26 Mar '12

26 Mar '12

I'd like to understand where libvirt is with regards to supporting hot plugging of multifunction PCI devices to a KVM guest. http://www.redhat.com/archives/libvir-list/2011-December/msg00621.html According to the above thread,the --multifunction option can be specified with the virsh attach-disk command.What purpose does this option serve? Thanks, Nandini Chandra

1 0

[libvirt] sr-iov ethernet VF is not assigned correctly to guest
by Scott 26 Mar '12

26 Mar '12

Hi, I'm hoping someone could possibly show me what I may be doing wrong here, and why I'm not seeing the expected results Thanks in advance! Server Information:HP Product Name: ProLiant DL165 G7 Ethernet Card Information: Intel 82599EB 10-Gigabit SFI/SFP+ uname: Linux 3.0.0-16-server x86_64 GNU/Linux OS Release: Ubuntu 11.10 qemu-kvm version 0.14.1+noroms-0ubuntu6.2 First, here's a list of my VFs: # ip link show: 2: eth0: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc mq master bond0 state UP qlen 1000 link/ether 00:1b:21:7d:70:16 brd ff:ff:ff:ff:ff:ff vf 0 MAC 02:22:25:00:00:00 vf 1 MAC 02:22:25:00:00:01 vf 2 MAC 02:22:25:00:00:02 vf 3 MAC 02:22:25:00:00:03 vf 4 MAC 02:22:25:00:00:04 vf 5 MAC 02:22:25:00:00:05 vf 6 MAC 02:22:25:00:00:06 3: eth1: <NO-CARRIER,BROADCAST,MULTICAST,SLAVE,UP> mtu 1500 qdisc mq master bond0 state DOWN qlen 1000 link/ether 00:1b:21:7d:70:16 brd ff:ff:ff:ff:ff:ff vf 0 MAC 02:22:25:01:00:00 vf 1 MAC 02:22:25:01:00:01 vf 2 MAC 02:22:25:01:00:02 vf 3 MAC 02:22:25:01:00:03 vf 4 MAC 02:22:25:01:00:04 vf 5 MAC 02:22:25:01:00:05 vf 6 MAC 02:22:25:01:00:06 # lspci |grep 05 05:00.0 Ethernet controller: Intel Corporation 82576 Gigabit Network Connection (rev 01) 05:00.1 Ethernet controller: Intel Corporation 82576 Gigabit Network Connection (rev 01) 05:10.0 Ethernet controller: Intel Corporation 82576 Virtual Function (rev 01) 05:10.1 Ethernet controller: Intel Corporation 82576 Virtual Function (rev 01) 05:10.2 Ethernet controller: Intel Corporation 82576 Virtual Function (rev 01) 05:10.3 Ethernet controller: Intel Corporation 82576 Virtual Function (rev 01) 05:10.4 Ethernet controller: Intel Corporation 82576 Virtual Function (rev 01) 05:10.5 Ethernet controller: Intel Corporation 82576 Virtual Function (rev 01) 05:10.6 Ethernet controller: Intel Corporation 82576 Virtual Function (rev 01) 05:10.7 Ethernet controller: Intel Corporation 82576 Virtual Function (rev 01) 05:11.0 Ethernet controller: Intel Corporation 82576 Virtual Function (rev 01) 05:11.1 Ethernet controller: Intel Corporation 82576 Virtual Function (rev 01) 05:11.2 Ethernet controller: Intel Corporation 82576 Virtual Function (rev 01) 05:11.3 Ethernet controller: Intel Corporation 82576 Virtual Function (rev 01) 05:11.4 Ethernet controller: Intel Corporation 82576 Virtual Function (rev 01) 05:11.5 Ethernet controller: Intel Corporation 82576 Virtual Function (rev 01) # virsh nodedev-list |grep 05 pci_0000_05_00_0 pci_0000_05_00_1 pci_0000_05_10_0 pci_0000_05_10_1 pci_0000_05_10_2 pci_0000_05_10_3 pci_0000_05_10_4 pci_0000_05_10_5 pci_0000_05_10_6 pci_0000_05_10_7 pci_0000_05_11_0 pci_0000_05_11_1 pci_0000_05_11_2 pci_0000_05_11_3 pci_0000_05_11_4 pci_0000_05_11_5 4 Now detach 05.10.0 and 05.11.0 from the host: # virsh nodedev-dettach pci_0000_05_10_0 Device pci_0000_05_10_0 dettached # virsh nodedev-dettach pci_0000_05_11_0 Device pci_0000_05_11_0 dettached 5. Get the host, slot, function information: # virsh nodedev-dumpxml pci_0000_05_10_0|grep -e bus -e slot -e fun |head -3 <bus>5</bus> <slot>16</slot> <function>0</function> # virsh nodedev-dumpxml pci_0000_05_11_0|grep -e bus -e slot -e fun |head -3 <bus>5</bus> <slot>17</slot> <function>0</function> == GUEST-A == XML: ... <hostdev mode='subsystem' type='pci' managed='yes'> <source> <address domain='0x0000' bus='0x05' slot='0x10' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='yes'> <source> <address domain='0x0000' bus='0x05' slot='0x11' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> </hostdev> ... CLI: /usr/bin/kvm -S \ -M pc-0.14 \ -enable-kvm \ -m 256 \ -smp 1,sockets=1,cores=1,threads=1 \ -name GUEST-A \ -uuid 9bac7b2f-dbb4-0f2a-08e6-47018d6630db \ -nodefconfig -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/HOST-A.monitor,server,nowait \ -mon chardev=charmonitor,id=monitor,mode=readline \ -rtc base=utc \ -boot cn \ -drive file=/srv/node/sdc1/HOST-A.raw,if=none,id=drive-virtio-disk0,boot=on,format=raw,cache=none \ -device virtio-blk-pci,bus=pci.0,addr=0x3,drive=drive-virtio-disk0,id=virtio-disk0 \ -chardev pty,id=charserial0 \ -device isa-serial,chardev=charserial0,id=serial0 \ -usb \ -vnc 0.0.0.0:0 \ -vga cirrus \ -device pci-assign,host=05:10.0,id=hostdev0,configfd=20,bus=pci.0,addr=0x4 \ -device pci-assign,host=05:11.0,id=hostdev1,configfd=21,bus=pci.0,addr=0x5 \ -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x6 dmesg: [ 3.072509] igbvf 0000:00:04.0: Intel(R) 82576 Virtual Function [ 3.072514] igbvf 0000:00:04.0: Address: 02:22:25:00:00:00 [ 3.072516] igbvf 0000:00:04.0: MAC: 1 [ 3.241325] igbvf 0000:00:05.0: Intel(R) 82576 Virtual Function [ 3.241329] igbvf 0000:00:05.0: Address: 02:22:25:00:00:04 [ 3.241332] igbvf 0000:00:05.0: MAC: 1 ip link: 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 02:22:25:00:00:00 brd ff:ff:ff:ff:ff:ff 3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 02:22:25:00:00:04 brd ff:ff:ff:ff:ff:ff Expected Results: GUEST-A should have the following assignment: eth0 should = eth0-vf0 (bus:5, slot:10, fun:0), mac: 02:22:25:00:00:00 eth1 should = eth1-vf0 (bus:5, slot:11, fun:0), mac: 02:22:25:01:00:00

2 2

[libvirt] [PATCH 1/2] Add support for setting init argv for LXC
by Daniel P. Berrange 26 Mar '12

26 Mar '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> Pass argv to the init binary of LXC, using a new <initarg> element. * docs/formatdomain.html.in: Document <os> usage for containers * docs/schemas/domaincommon.rng: Add <initarg> element * src/conf/domain_conf.c, src/conf/domain_conf.h: parsing and formatting of <initarg> * src/lxc/lxc_container.c: Setup LXC argv * tests/Makefile.am, tests/lxcxml2xmldata/lxc-systemd.xml, tests/lxcxml2xmltest.c, tests/testutilslxc.c, tests/testutilslxc.h: Test parsing/formatting of LXC related XML parts --- docs/formatdomain.html.in | 22 +++++ docs/schemas/domaincommon.rng | 5 + src/conf/domain_conf.c | 28 ++++++- src/conf/domain_conf.h | 1 + src/lxc/lxc_container.c | 3 + tests/Makefile.am | 21 +++++ tests/lxcxml2xmldata/lxc-systemd.xml | 30 +++++++ tests/lxcxml2xmltest.c | 141 ++++++++++++++++++++++++++++++++++ tests/testutilslxc.c | 63 +++++++++++++++ tests/testutilslxc.h | 4 + 10 files changed, 316 insertions(+), 2 deletions(-) create mode 100644 tests/lxcxml2xmldata/lxc-systemd.xml create mode 100644 tests/lxcxml2xmltest.c create mode 100644 tests/testutilslxc.c create mode 100644 tests/testutilslxc.h diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index c2eabc5..1211e50 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -250,6 +250,28 @@ installation media source / kickstart file</dd> </dl> + <h4><a name="eleemntsOSContainer">Container boot</a></h4> + + + When booting a domain using container based virtualization, instead + of a kernel / boot image, a path to the init binary is required, using + the <code>init</code> element. By default this will be launched with + no arguments. To specify the initial argv, use the <code>initarg</code> + element, repeated as many time as is required. The <code>cmdline</code> + element, if set will be used to provide an equivalent to <code>/proc/cmdline</code> + but will not effect init argv. + + + <pre> + <os> + <type arch='x86_64'>exe</type> + <init>/bin/systemd</init> + <initarg>--unit</initarg> + <initarg>emergency.service</initarg> + </os> + </pre> + + <h3><a name="elementsSysinfo">SMBIOS System Information</a></h3> diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index 1f5232e..730f3d8 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -378,6 +378,11 @@ <ref name="absFilePath"/> </element> </optional> + <zeroOrMore> + <element name="initarg"> + <text/> + </element> + </zeroOrMore> </interleave> </element> </define> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 3921c0f..6f71e33 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -1559,6 +1559,9 @@ void virDomainDefFree(virDomainDefPtr def) VIR_FREE(def->os.arch); VIR_FREE(def->os.machine); VIR_FREE(def->os.init); + for (i = 0 ; def->os.initargv && def->os.initargv[i] ; i++) + VIR_FREE(def->os.initargv[i]); + VIR_FREE(def->os.initargv); VIR_FREE(def->os.kernel); VIR_FREE(def->os.initrd); VIR_FREE(def->os.cmdline); @@ -8188,6 +8191,25 @@ static virDomainDefPtr virDomainDefParseXML(virCapsPtr caps, } } def->os.cmdline = virXPathString("string(./os/cmdline[1])", ctxt); + + if ((n = virXPathNodeSet("./os/initarg", ctxt, &nodes)) < 0) { + goto error; + } + + if (VIR_ALLOC_N(def->os.initargv, n+1) < 0) + goto no_memory; + for (i = 0 ; i < n ; i++) { + if (!nodes[i]->children || + !nodes[i]->children->content) { + virDomainReportError(VIR_ERR_XML_ERROR, "%s", + _("No data supplied for <initarg> element")); + goto error; + } + if (!(def->os.initargv[i] = strdup((const char*)nodes[i]->children->content))) + goto no_memory; + } + def->os.initargv[n] = NULL; + VIR_FREE(nodes); } if (STREQ(def->os.type, "xen") || @@ -12171,6 +12193,7 @@ virDomainDefFormatInternal(virDomainDefPtr def, char uuidstr[VIR_UUID_STRING_BUFLEN]; const char *type = NULL; int n, allones = 1; + int i; bool blkio = false; virCheckFlags(DUMPXML_FLAGS | @@ -12332,7 +12355,6 @@ virDomainDefFormatInternal(virDomainDefPtr def, virBufferAsprintf(buf, " <quota>%lld</quota>\n", def->cputune.quota); if (def->cputune.vcpupin) { - int i; for (i = 0; i < def->cputune.nvcpupin; i++) { virBufferAsprintf(buf, " <vcpupin vcpu='%u' ", def->cputune.vcpupin[i]->vcpuid); @@ -12408,6 +12430,9 @@ virDomainDefFormatInternal(virDomainDefPtr def, virBufferEscapeString(buf, " <init>%s</init>\n", def->os.init); + for (i = 0 ; def->os.initargv && def->os.initargv[i] ; i++) + virBufferEscapeString(buf, " <initarg>%s</initarg>\n", + def->os.initargv[i]); virBufferEscapeString(buf, " <loader>%s</loader>\n", def->os.loader); virBufferEscapeString(buf, " <kernel>%s</kernel>\n", @@ -12462,7 +12487,6 @@ virDomainDefFormatInternal(virDomainDefPtr def, virBufferAddLit(buf, " </os>\n"); if (def->features) { - int i; virBufferAddLit(buf, " <features>\n"); for (i = 0 ; i < VIR_DOMAIN_FEATURE_LAST ; i++) { if (def->features & (1 << i)) { diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 10030a4..3fcb026 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -1354,6 +1354,7 @@ struct _virDomainOSDef { int bootDevs[VIR_DOMAIN_BOOT_LAST]; int bootmenu; char *init; + char **initargv; char *kernel; char *initrd; char *cmdline; diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index bb64b60..0755b3c 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -122,6 +122,9 @@ static virCommandPtr lxcContainerBuildInitCmd(virDomainDefPtr vmDef) cmd = virCommandNew(vmDef->os.init); + if (vmDef->os.initargv && vmDef->os.initargv[0]) + virCommandAddArgSet(cmd, (const char **)vmDef->os.initargv); + virCommandAddEnvString(cmd, "PATH=/bin:/sbin"); virCommandAddEnvString(cmd, "TERM=linux"); virCommandAddEnvString(cmd, "container=lxc-libvirt"); diff --git a/tests/Makefile.am b/tests/Makefile.am index 4755a3e..4a0686f 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -60,6 +60,7 @@ EXTRA_DIST = \ domainsnapshotxml2xmlin \ domainsnapshotxml2xmlout \ interfaceschemadata \ + lxcxml2xmldata \ networkschematest \ networkxml2xmlin \ networkxml2xmlout \ @@ -115,6 +116,10 @@ check_PROGRAMS += qemuxml2argvtest qemuxml2xmltest qemuxmlnstest \ qemumonitortest endif +if WITH_LXC +check_PROGRAMS += lxcxml2xmltest +endif + if WITH_OPENVZ check_PROGRAMS += openvzutilstest endif @@ -245,6 +250,10 @@ TESTS += qemuxml2argvtest qemuxml2xmltest qemuxmlnstest qemuargv2xmltest \ qemumonitortest endif +if WITH_LXC +TESTS += lxcxml2xmltest +endif + if WITH_OPENVZ TESTS += openvzutilstest endif @@ -383,6 +392,18 @@ EXTRA_DIST += qemuxml2argvtest.c qemuxml2xmltest.c qemuargv2xmltest.c \ qemumonitortest.c testutilsqemu.c testutilsqemu.h endif +if WITH_LXC + +lxc_LDADDS = ../src/libvirt_driver_lxc.la + +lxcxml2xmltest_SOURCES = \ + lxcxml2xmltest.c testutilslxc.c testutilslxc.h \ + testutils.c testutils.h +lxcxml2xmltest_LDADD = $(lxc_LDADDS) $(LDADDS) +else +EXTRA_DIST += lxcxml2xmltest.c testutilslxc.c testutilslxc.h +endif + if WITH_OPENVZ openvzutilstest_SOURCES = \ openvzutilstest.c \ diff --git a/tests/lxcxml2xmldata/lxc-systemd.xml b/tests/lxcxml2xmldata/lxc-systemd.xml new file mode 100644 index 0000000..bf239c2 --- /dev/null +++ b/tests/lxcxml2xmldata/lxc-systemd.xml @@ -0,0 +1,30 @@ +<domain type='lxc'> + <name>demo</name> + <uuid>8369f1ac-7e46-e869-4ca5-759d51478066</uuid> + <memory unit='KiB'>500000</memory> + <currentMemory unit='KiB'>500000</currentMemory> + <vcpu>1</vcpu> + <os> + <type arch='x86_64'>exe</type> + <init>/bin/systemd</init> + <initarg>--unit</initarg> + <initarg>emergency.service</initarg> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <filesystem type='mount' accessmode='passthrough'> + <source dir='/root/container'/> + <target dir='/'/> + </filesystem> + <filesystem type='mount' accessmode='passthrough'> + <source dir='/home'/> + <target dir='/home'/> + </filesystem> + <console type='pty'> + <target type='lxc' port='0'/> + </console> + </devices> +</domain> diff --git a/tests/lxcxml2xmltest.c b/tests/lxcxml2xmltest.c new file mode 100644 index 0000000..558bd01 --- /dev/null +++ b/tests/lxcxml2xmltest.c @@ -0,0 +1,141 @@ +#include <config.h> + +#include <stdio.h> +#include <stdlib.h> +#include <unistd.h> +#include <string.h> + +#include <sys/types.h> +#include <fcntl.h> + +#ifdef WITH_LXC + +# include "internal.h" +# include "testutils.h" +# include "lxc/lxc_conf.h" +# include "testutilslxc.h" + +static virCapsPtr caps; + +static int +testCompareXMLToXMLFiles(const char *inxml, const char *outxml, bool live) +{ + char *inXmlData = NULL; + char *outXmlData = NULL; + char *actual = NULL; + int ret = -1; + virDomainDefPtr def = NULL; + + if (virtTestLoadFile(inxml, &inXmlData) < 0) + goto fail; + if (virtTestLoadFile(outxml, &outXmlData) < 0) + goto fail; + + if (!(def = virDomainDefParseString(caps, inXmlData, + 1 << VIR_DOMAIN_VIRT_LXC, + live ? 0 : VIR_DOMAIN_XML_INACTIVE))) + goto fail; + + if (!(actual = virDomainDefFormat(def, VIR_DOMAIN_XML_SECURE))) + goto fail; + + if (STRNEQ(outXmlData, actual)) { + virtTestDifference(stderr, outXmlData, actual); + goto fail; + } + + ret = 0; + fail: + VIR_FREE(inXmlData); + VIR_FREE(outXmlData); + VIR_FREE(actual); + virDomainDefFree(def); + return ret; +} + +struct testInfo { + const char *name; + int different; + bool inactive_only; +}; + +static int +testCompareXMLToXMLHelper(const void *data) +{ + const struct testInfo *info = data; + char *xml_in = NULL; + char *xml_out = NULL; + int ret = -1; + + if (virAsprintf(&xml_in, "%s/lxcxml2xmldata/lxc-%s.xml", + abs_srcdir, info->name) < 0 || + virAsprintf(&xml_out, "%s/lxcxml2xmloutdata/lxc-%s.xml", + abs_srcdir, info->name) < 0) + goto cleanup; + + if (info->different) { + ret = testCompareXMLToXMLFiles(xml_in, xml_out, false); + } else { + ret = testCompareXMLToXMLFiles(xml_in, xml_in, false); + } + if (!info->inactive_only) { + if (info->different) { + ret = testCompareXMLToXMLFiles(xml_in, xml_out, true); + } else { + ret = testCompareXMLToXMLFiles(xml_in, xml_in, true); + } + } + +cleanup: + VIR_FREE(xml_in); + VIR_FREE(xml_out); + return ret; +} + + +static int +mymain(void) +{ + int ret = 0; + + if ((caps = testLXCCapsInit()) == NULL) + return (EXIT_FAILURE); + +# define DO_TEST_FULL(name, is_different, inactive) \ + do { \ + const struct testInfo info = {name, is_different, inactive}; \ + if (virtTestRun("LXC XML-2-XML " name, \ + 1, testCompareXMLToXMLHelper, &info) < 0) \ + ret = -1; \ + } while (0) + +# define DO_TEST(name) \ + DO_TEST_FULL(name, 0, false) + +# define DO_TEST_DIFFERENT(name) \ + DO_TEST_FULL(name, 1, false) + + /* Unset or set all envvars here that are copied in lxcdBuildCommandLine + * using ADD_ENV_COPY, otherwise these tests may fail due to unexpected + * values for these envvars */ + setenv("PATH", "/bin", 1); + + DO_TEST("systemd"); + + virCapabilitiesFree(caps); + + return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); +} + +VIRT_TEST_MAIN(mymain) + +#else +# include "testutils.h" + +int +main(void) +{ + return EXIT_AM_SKIP; +} + +#endif /* WITH_LXC */ diff --git a/tests/testutilslxc.c b/tests/testutilslxc.c new file mode 100644 index 0000000..e6193af --- /dev/null +++ b/tests/testutilslxc.c @@ -0,0 +1,63 @@ +#include <config.h> +#ifdef WITH_LXC +# include <stdlib.h> + +# include "testutilslxc.h" +# include "testutils.h" +# include "memory.h" +# include "domain_conf.h" + + +static int testLXCDefaultConsoleType(const char *ostype ATTRIBUTE_UNUSED) +{ + return VIR_DOMAIN_CHR_CONSOLE_TARGET_TYPE_LXC; +} + + +virCapsPtr testLXCCapsInit(void) { + virCapsPtr caps; + virCapsGuestPtr guest; + + if ((caps = virCapabilitiesNew("x86_64", + 0, 0)) == NULL) + return NULL; + + caps->defaultConsoleTargetType = testLXCDefaultConsoleType; + + if ((guest = virCapabilitiesAddGuest(caps, "exe", "i686", 32, + "/usr/libexec/libvirt_lxc", NULL, + 0, NULL)) == NULL) + goto error; + + if (!virCapabilitiesAddGuestDomain(guest, "lxc", NULL, NULL, 0, NULL)) + goto error; + + + if ((guest = virCapabilitiesAddGuest(caps, "exe", "x86_64", 64, + "/usr/libexec/libvirt_lxc", NULL, + 0, NULL)) == NULL) + goto error; + + if (!virCapabilitiesAddGuestDomain(guest, "lxc", NULL, NULL, 0, NULL)) + goto error; + + + if (virTestGetDebug()) { + char *caps_str; + + caps_str = virCapabilitiesFormatXML(caps); + if (!caps_str) + goto error; + + fprintf(stderr, "LXC driver capabilities:\n%s", caps_str); + + VIR_FREE(caps_str); + } + + return caps; + +error: + virCapabilitiesFree(caps); + return NULL; +} +#endif diff --git a/tests/testutilslxc.h b/tests/testutilslxc.h new file mode 100644 index 0000000..ee8056f --- /dev/null +++ b/tests/testutilslxc.h @@ -0,0 +1,4 @@ + +#include "capabilities.h" + +virCapsPtr testLXCCapsInit(void); -- 1.7.7.6

2 3

[libvirt] [PATCH] Prefer to use 'qemu-system-i386' over 'qemu'
by Daniel P. Berrange 26 Mar '12

26 Mar '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> For i686 arch we look for the 'qemu' binary, followed by the 'qemu-system-x86_64' binary. This is not good with QEMU 1.0, since the 'qemu' binary was renamed to 'qemu-system-i386' and the 'qemu' name might be reused for another purpose later. Make sure we look for 'qemu-system-i386', then 'qemu-system-x86_64' then the qemu-kvm binary. Only use 'qemu' as a very last resort * src/qemu/qemu_capabilities.c: Prefer qemu-system-i386 --- src/qemu/qemu_capabilities.c | 48 ++++++++++++++++++++++++----------------- 1 files changed, 28 insertions(+), 20 deletions(-) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 0e09d6d..16d9b21 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -169,7 +169,6 @@ struct qemu_arch_info { int wordsize; const char *machine; const char *binary; - const char *altbinary; const struct qemu_feature_flags *flags; int nflags; }; @@ -189,25 +188,25 @@ static const struct qemu_feature_flags const arch_info_x86_64_flags [] = { /* The archicture tables for supported QEMU archs */ static const struct qemu_arch_info const arch_info_hvm[] = { - { "i686", 32, NULL, "qemu", - "qemu-system-x86_64", arch_info_i686_flags, 4 }, + { "i686", 32, NULL, "qemu-system-i386", + arch_info_i686_flags, 4 }, { "x86_64", 64, NULL, "qemu-system-x86_64", - NULL, arch_info_x86_64_flags, 2 }, - { "arm", 32, NULL, "qemu-system-arm", NULL, NULL, 0 }, - { "microblaze", 32, NULL, "qemu-system-microblaze", NULL, NULL, 0 }, - { "microblazeel", 32, NULL, "qemu-system-microblazeel", NULL, NULL, 0 }, - { "mips", 32, NULL, "qemu-system-mips", NULL, NULL, 0 }, - { "mipsel", 32, NULL, "qemu-system-mipsel", NULL, NULL, 0 }, - { "sparc", 32, NULL, "qemu-system-sparc", NULL, NULL, 0 }, - { "ppc", 32, NULL, "qemu-system-ppc", NULL, NULL, 0 }, - { "ppc64", 64, NULL, "qemu-system-ppc64", NULL, NULL, 0 }, - { "itanium", 64, NULL, "qemu-system-ia64", NULL, NULL, 0 }, - { "s390x", 64, NULL, "qemu-system-s390x", NULL, NULL, 0 }, + arch_info_x86_64_flags, 2 }, + { "arm", 32, NULL, "qemu-system-arm", NULL, 0 }, + { "microblaze", 32, NULL, "qemu-system-microblaze", NULL, 0 }, + { "microblazeel", 32, NULL, "qemu-system-microblazeel", NULL, 0 }, + { "mips", 32, NULL, "qemu-system-mips", NULL, 0 }, + { "mipsel", 32, NULL, "qemu-system-mipsel", NULL, 0 }, + { "sparc", 32, NULL, "qemu-system-sparc", NULL, 0 }, + { "ppc", 32, NULL, "qemu-system-ppc", NULL, 0 }, + { "ppc64", 64, NULL, "qemu-system-ppc64", NULL, 0 }, + { "itanium", 64, NULL, "qemu-system-ia64", NULL, 0 }, + { "s390x", 64, NULL, "qemu-system-s390x", NULL, 0 }, }; static const struct qemu_arch_info const arch_info_xen[] = { - { "i686", 32, "xenner", "xenner", NULL, arch_info_i686_flags, 4 }, - { "x86_64", 64, "xenner", "xenner", NULL, arch_info_x86_64_flags, 2 }, + { "i686", 32, "xenner", "xenner", arch_info_i686_flags, 4 }, + { "x86_64", 64, "xenner", "xenner", arch_info_x86_64_flags, 2 }, }; @@ -643,10 +642,11 @@ qemuCapsInitGuest(virCapsPtr caps, */ binary = virFindFileInPath(info->binary); - if (binary == NULL || !virFileIsExecutable(binary)) { - VIR_FREE(binary); - binary = virFindFileInPath(info->altbinary); - } + /* If i386 binary is missing, we can trivially + * replace it with a qemu-system-x86_64 binary + */ + if (binary == NULL && STREQ(info->binary, "qemu-system-i386")) + binary = virFindFileInPath("qemu-system-x86_64"); /* Can use acceleration for KVM/KQEMU if * - host & guest arches match @@ -668,6 +668,10 @@ qemuCapsInitGuest(virCapsPtr caps, continue; haskvm = 1; + + /* We can use the KVM binary for the TCG case too + * (probably) + */ if (!binary) binary = kvmbin; @@ -679,6 +683,10 @@ qemuCapsInitGuest(virCapsPtr caps, haskqemu = 1; } + /* Another fallback for i386, try the old name now */ + if (binary == NULL && STREQ(info->binary, "qemu-system-i386")) + binary = virFindFileInPath("qemu"); + if (!binary) return 0; -- 1.7.7.6

2 1

[libvirt] Vlan ID - Portgroup
by Daniele Milani 26 Mar '12

26 Mar '12

Hi all, I have the following problem: reading the documentation I wasn't able to understand if it is possible to associate a VlanID to a portgroup. Does anyone know if it is possible and (more important) how does it work? Bests, Daniele Milani

3 13

[libvirt] [PATCH] Detect location fo selinux mount point
by Daniel P. Berrange 26 Mar '12

26 Mar '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> The SELinux mount point moved from /selinux to /sys/fs/selinux when systemd came along. * configure.ac: Probe for SELinux mount point * src/lxc/lxc_container.c: Use SELinux mount point determined by configure.ac --- configure.ac | 19 ++++++++++++++++++- src/lxc/lxc_container.c | 6 ++++-- 2 files changed, 22 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index d624ef2..c1f9f45 100644 --- a/configure.ac +++ b/configure.ac @@ -1238,6 +1238,10 @@ AC_ARG_WITH([selinux], AC_HELP_STRING([--with-selinux], [use SELinux to manage security @<:@default=check@:>@]), [], [with_selinux=check]) +AC_ARG_WITH([selinux_mount], + AC_HELP_STRING([--with-selinux-mount], [set SELinux mount point @<:@default=check@:>@]), + [], + [with_selinux_mount=check]) SELINUX_CFLAGS= SELINUX_LIBS= @@ -1261,7 +1265,20 @@ if test "$with_selinux" != "no"; then LIBS="$old_libs" fi if test "$with_selinux" = "yes"; then + AC_MSG_CHECKING([SELinux mount point]) + if test "$with_selinux_mount" = "check" || test -z "$with_selinux_mount"; then + if test -d /sys/fs/selinux ; then + SELINUX_MOUNT=/sys/fs/selinux + else + SELINUX_MOUNT=/selinux + fi + else + SELINUX_MOUNT=$with_selinux_mount + fi + AC_MSG_RESULT([$SELINUX_MOUNT]) + SELINUX_LIBS="-lselinux" + AC_DEFINE_UNQUOTED([SELINUX_MOUNT], ["$SELINUX_MOUNT"], [SELinux mount point]) AC_DEFINE_UNQUOTED([HAVE_SELINUX], 1, [whether basic SELinux functionality is available]) dnl We prefer to use <selinux/label.h> and selabel_open, but can fall dnl back to matchpathcon for the sake of RHEL 5's version of libselinux. @@ -2640,7 +2657,7 @@ AC_MSG_NOTICE([ Disk: $with_storage_disk]) AC_MSG_NOTICE([]) AC_MSG_NOTICE([Security Drivers]) AC_MSG_NOTICE([]) -AC_MSG_NOTICE([ SELinux: $with_secdriver_selinux]) +AC_MSG_NOTICE([ SELinux: $with_secdriver_selinux ($SELINUX_MOUNT)]) AC_MSG_NOTICE([AppArmor: $with_secdriver_apparmor]) AC_MSG_NOTICE([]) AC_MSG_NOTICE([Driver Loadable Modules]) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 267fbfb..bb64b60 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -444,8 +444,10 @@ static int lxcContainerMountBasicFS(const char *srcprefix, bool pivotRoot) { false, "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY }, { true, "/sys", "/sys", NULL, NULL, MS_BIND }, { true, "/sys", "/sys", NULL, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY }, - { true, "/selinux", "/selinux", NULL, NULL, MS_BIND }, - { true, "/selinux", "/selinux", NULL, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY }, +#if HAVE_SELINUX + { true, SELINUX_MOUNT, SELINUX_MOUNT, NULL, NULL, MS_BIND }, + { true, SELINUX_MOUNT, SELINUX_MOUNT, NULL, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY }, +#endif }; int i, rc = -1; char *opts = NULL; -- 1.7.7.6

2 1

[libvirt] libvirt: xen: Shutdown detection fixes
by Stefan Bader 26 Mar '12

26 Mar '12

The issue is easy to observe when using virt-manager as a frontend. Its main window seems to open connections for the up/down main display once and then only repeats DomainGetInfo on the same connection to check whether the instance is up or shut down. The initial open on the connection sets the domain id to -1 for inactive managed domains. And once running, the hypervisor driver returns the status. But after shutdown, the domain cannot be found by the hypervisor driver and the domain info is obtained by the xend driver. However, that expects the domain id to be -1 for inactive domains. This is not true (anymore). In testing I found that domain/status seems to be always present and better suited to check whether a domain is running or not (0 for shutdown and 2 for running, there are probably other values, too). Beside the change, which does fix this problem, the question is whether there should be a mechanism that resets domain->id to -1 when the instance is found to be shut down. And if that should happen, should it be done by any sub-driver or by the unified driver. The second problem I observed when I shut down an instance from the vnc console provided by virt-manager. As soon as the instance was down, the log produced internal errors about every second. Found this again, to be related to the unified driver approach. The call that causes the many error messages is GetVcpus. While the instance is up, the hypervisor driver returns those. But after shutdown, the domain cannot be found by that driver. The xend driver works, though. So what happens is that the hypervisor driver logs an internal error but the call succeeds because the xend driver returns successful. This generally opens the question whether a sub-driver should log any errors (at least not on error level, maybe debug)? The second patch only quiets down the one message I saw repeated that often. There are some other errors logged without any obvious problems interacting with the instances, but those are by far less often. -Stefan Please cc: me on replies as I am (yeah still) not subscribed to this m-l. Thanks.

1 2

[libvirt] [PATCH 1/2] build: drop obsolete qparams test
by Eric Blake 26 Mar '12

26 Mar '12

Otherwise, 'make check' breaks since commit bc1ff160 deleted qparams.h. A later patch will ensure that viruri takes over what qparams used to do. * tests/qparamtest.c (mymain): Delete, now that we have viruri. * tests/Makefile.am (check_PROGRAMS, TESTS, qparamtest_SOURCES): Delete old test. * .gitignore: Add recent test additions. --- Pushing this under the build-breaker rule. .gitignore | 3 +++ tests/Makefile.am | 7 +------ 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index b35e863..2f27ff4 100644 --- a/.gitignore +++ b/.gitignore @@ -139,11 +139,14 @@ /tests/ssh /tests/statstest /tests/utiltest +/tests/virauthconfigtest /tests/virbuftest /tests/virhashtest +/tests/virkeyfiletest /tests/virnet*test /tests/virshtest /tests/virtimetest +/tests/viruritest /tests/vmx2xmltest /tests/xencapstest /tests/xmconfigtest diff --git a/tests/Makefile.am b/tests/Makefile.am index 0e5ca39..4755a3e 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -92,7 +92,7 @@ EXTRA_DIST = \ .valgrind.supp check_PROGRAMS = virshtest conftest sockettest \ - nodeinfotest qparamtest virbuftest \ + nodeinfotest virbuftest \ commandtest commandhelper seclabeltest \ virhashtest virnetmessagetest virnetsockettest ssh \ utiltest virnettlscontexttest shunloadtest \ @@ -210,7 +210,6 @@ EXTRA_DIST += $(test_scripts) TESTS = virshtest \ nodeinfotest \ - qparamtest \ virbuftest \ sockettest \ commandtest \ @@ -529,10 +528,6 @@ seclabeltest_SOURCES = \ seclabeltest.c seclabeltest_LDADD = ../src/libvirt_driver_security.la $(LDADDS) -qparamtest_SOURCES = \ - qparamtest.c testutils.h testutils.c -qparamtest_LDADD = $(LDADDS) - virbuftest_SOURCES = \ virbuftest.c testutils.h testutils.c virbuftest_LDADD = $(LDADDS) -- 1.7.7.6

2 2

[libvirt] [libvirt-glib] [PATCH] cannot build master - conn_test fails to build due to missing linkage on in tree libvirt-gconfig
by Alban Browaeys 26 Mar '12

26 Mar '12

link conn_test againt in tree libvirt-gconfig Description of problem: CCLD conn-test ../libvirt-gobject/.libs/libvirt-gobject-1.0.so: undefined reference to `gvir_config_domain_interface_get_ifname(a)LIBVIRT_GCONFIG_0.0.4' Attach patch add ../libvirt-gconfig/libvirt-gconfig-1.0.la \ to the conn_test_LDADD to fix this issue. >From b62413c4b888b140ad6d7214d2163ce06f57ff19 Mon Sep 17 00:00:00 2001 From: Alban Browaeys <prahal(a)yahoo.com> Date: Tue, 6 Mar 2012 20:55:14 +0100 Subject: [PATCH] examples: test not linked against in tree libvirt-gconfig CCLD conn-test ../libvirt-gobject/.libs/libvirt-gobject-1.0.so: undefined reference to `gvir_config_domain_interface_get_ifname(a)LIBVIRT_GCONFIG_0.0.4' --- examples/Makefile.am | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/examples/Makefile.am b/examples/Makefile.am index b77076d..09843e5 100644 --- a/examples/Makefile.am +++ b/examples/Makefile.am @@ -24,6 +24,7 @@ conn_test_CFLAGS = \ conn_test_SOURCES = \ conn-test.c conn_test_LDADD = \ + ../libvirt-gconfig/libvirt-gconfig-1.0.la \ ../libvirt-gobject/libvirt-gobject-1.0.la \ $(LIBVIRT_LIBS) \ $(GLIB2_LIBS) \ -- 1.7.9.1

2 1

[libvirt] [test-API PATCHv2] libs: Add flags for streams and the console
by Peter Krempa 26 Mar '12

26 Mar '12

Add the local copy of the flags. --- lib/domainAPI.py | 3 +++ lib/streamAPI.py | 3 +++ 2 files changed, 6 insertions(+), 0 deletions(-) diff --git a/lib/domainAPI.py b/lib/domainAPI.py index bc0069b..43565c2 100644 --- a/lib/domainAPI.py +++ b/lib/domainAPI.py @@ -912,3 +912,6 @@ VIR_DOMAIN_AFFECT_CURRENT = 0 VIR_DOMAIN_AFFECT_LIVE = 1 VIR_DOMAIN_AFFECT_CONFIG = 2 +# virDomainConsoleFlags +VIR_DOMAIN_CONSOLE_FORCE = 1 +VIR_DOMAIN_CONSOLE_SAFE = 2 diff --git a/lib/streamAPI.py b/lib/streamAPI.py index 18ce71e..0dfda28 100644 --- a/lib/streamAPI.py +++ b/lib/streamAPI.py @@ -118,3 +118,6 @@ VIR_EVENT_HANDLE_READABLE = 1 VIR_EVENT_HANDLE_WRITABLE = 2 VIR_EVENT_HANDLE_ERROR = 4 VIR_EVENT_HANDLE_HANGUP = 8 + +# virStreamFlags +VIR_STREAM_NONBLOCK = 1 -- 1.7.3.4

3 2

[libvirt] [test-API PATCH] streamAPI: Create stream objects that are already encapsulated
by Peter Krempa 26 Mar '12

26 Mar '12

With this patch, the newStream() method of the ConnectAPI class returns an already encapsulated StreamAPI object . *lib/connectAPI.py: - modify newStream method to return StreamAPI object *lib/streamAPI.py: - modify constructor to take virStream objects --- lib/connectAPI.py | 4 +++- lib/streamAPI.py | 9 ++------- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/lib/connectAPI.py b/lib/connectAPI.py index f52467f..2723fc8 100644 --- a/lib/connectAPI.py +++ b/lib/connectAPI.py @@ -24,6 +24,7 @@ import os import re import libvirt +from lib import streamAPI def append_path(path): """Append root path of package""" @@ -226,7 +227,8 @@ class ConnectAPI(object): def newStream(self, flag = 0): try: - return self.conn.newStream(flag) + st_obj = self.conn.newStream(flag) + return streamAPI.StreamAPI(st_obj) except libvirt.libvirtError, e: message = e.get_error_message() code = e.get_error_code() diff --git a/lib/streamAPI.py b/lib/streamAPI.py index 18ce71e..f551992 100644 --- a/lib/streamAPI.py +++ b/lib/streamAPI.py @@ -38,13 +38,8 @@ append_path(result.group(0)) import exception class StreamAPI(object): - def __init__(self, conn, flags = 0): - try: - self.stream = conn.newStream(flags) - except libvirt.libvirtError, e: - message = e.get_error_message() - code = e.get_error_code() - raise exception.LibvirtAPI(message, code) + def __init__(self, stream): + self.stream = stream; def getStream(self): return self.stream -- 1.7.3.4

2 2

[libvirt] [PATCH] test-API: Remove trailing spaces
by Osier Yang 26 Mar '12

26 Mar '12

Script used to do the work: % for f in $(find . -type f -name "*.py"); do \ sed -i -e "s/$?*$\s\+$/\1/g" $f; \ done --- env_inspect.py | 20 +++++----- exception.py | 12 +++--- lib/snapshotAPI.py | 18 ++++---- logxmlparser.py | 80 +++++++++++++++++++------------------- process.py | 6 +- repos/domain/attach_interface.py | 2 +- repos/domain/ownership_test.py | 2 +- 7 files changed, 70 insertions(+), 70 deletions(-) diff --git a/env_inspect.py b/env_inspect.py index e790e03..a290329 100644 --- a/env_inspect.py +++ b/env_inspect.py @@ -13,11 +13,11 @@ # The GPL text is available in the file COPYING that accompanies this # distribution and at <http://www.gnu.org/licenses>. # -# Filename: envinspect.py -# Summary: To generate a callable class for clearing testing environment -# Description: The module match the reference of clearing function -# from each testcase to the corresponding testcase's -# argument in the order of testcase running +# Filename: envinspect.py +# Summary: To generate a callable class for clearing testing environment +# Description: The module match the reference of clearing function +# from each testcase to the corresponding testcase's +# argument in the order of testcase running import subprocess @@ -72,7 +72,7 @@ class EnvInspect(object): """to check and collect the testing enviroment infomation before performing testing """ - + def __init__(self, logger): self.logger = logger @@ -87,7 +87,7 @@ class EnvInspect(object): self.logger.info(" %-36s%-6s" % (get_libvirt_ver()[1], result)) if get_libvirt_pyth_ver()[0] == 100: - result = NOTOK + result = NOTOK flag = 1 else: result = OK @@ -100,7 +100,7 @@ class EnvInspect(object): result = OK self.logger.info(" %-36s%-6s" % (get_libvirt_cli_ver()[1], result)) - if get_qemu_kvm_ver()[0] == 150 and flag == 0: + if get_qemu_kvm_ver()[0] == 150 and flag == 0: flag = 0 elif get_qemu_kvm_ver()[0] == 150 and flag == 1: flag = 1 @@ -115,8 +115,8 @@ class EnvInspect(object): result = OK self.logger.info(" %-36s%-6s" % (get_kernel_ver()[1], result)) - return flag - + return flag + OK = "ok" NOTOK = "not ok" diff --git a/exception.py b/exception.py index 1a6d6f1..5a6a6d3 100644 --- a/exception.py +++ b/exception.py @@ -13,10 +13,10 @@ # The GPL text is available in the file COPYING that accompanies this # distribution and at <http://www.gnu.org/licenses>. # -# Filename: exception.py -# Summary: the exception class -# Description: The module defines the exceptions the framework could use -# when fatal error occurred. +# Filename: exception.py +# Summary: the exception class +# Description: The module defines the exceptions the framework could use +# when fatal error occurred. import libvirt @@ -32,13 +32,13 @@ class LibvirtException(Exception): return repr(self.errorstr) def response(self): - self.status = {'code':self.code, 'message':"%s:%s" % + self.status = {'code':self.code, 'message':"%s:%s" % (self.message, str(self))} return self.status class FileDoesNotExist(LibvirtException): code = 201 - message = "File does not exist" + message = "File does not exist" class SectionDoesNotExist(LibvirtException): code = 202 diff --git a/lib/snapshotAPI.py b/lib/snapshotAPI.py index 43ccb89..d363992 100644 --- a/lib/snapshotAPI.py +++ b/lib/snapshotAPI.py @@ -24,14 +24,14 @@ import libvirt import re import os -def append_path(path): +def append_path(path): """Append root path of package""" if path in sys.path: pass else: sys.path.append(path) - -pwd = os.getcwd() + +pwd = os.getcwd() result = re.search('(.*)libvirt-test-API', pwd) append_path(result.group(0)) @@ -39,7 +39,7 @@ import exception class SnapshotAPI(object): def __init__(self, connection): - self.conn = connection + self.conn = connection def create(self, domname, xml_desc, flag = 0): try: @@ -57,7 +57,7 @@ class SnapshotAPI(object): except libvirt.libvirtError, e: message = e.get_error_message() code = e.get_error_code() - raise exception.LibvirtAPI(message, code) + raise exception.LibvirtAPI(message, code) def snapshot_name_list(self, domname, flag = 0): try: @@ -66,7 +66,7 @@ class SnapshotAPI(object): except libvirt.libvirtError, e: message = e.get_error_message() code = e.get_error_code() - raise exception.LibvirtAPI(message, code) + raise exception.LibvirtAPI(message, code) def snapshot_nums(self, domname, flag = 0): try: @@ -95,7 +95,7 @@ class SnapshotAPI(object): message = e.get_error_message() code = e.get_error_code() raise exception.LibvirtAPI(message, code) - + def delete(self, domname, snapname, flag = 0): try: snap = self.snapshot_lookup_by_name(domname, snapname, flag = 0) @@ -103,7 +103,7 @@ class SnapshotAPI(object): except libvirt.libvirtError, e: message = e.get_error_message() code = e.get_error_code() - raise exception.LibvirtAPI(message, code) + raise exception.LibvirtAPI(message, code) def get_xml_desc(self, domname, snapname, flag = 0): try: @@ -122,4 +122,4 @@ class SnapshotAPI(object): message = e.get_error_message() code = e.get_error_code() raise exception.LibvirtAPI(message, code) - + diff --git a/logxmlparser.py b/logxmlparser.py index 014397e..48e3c51 100644 --- a/logxmlparser.py +++ b/logxmlparser.py @@ -13,10 +13,10 @@ # The GPL text is available in the file COPYING that accompanies this # distribution and at <http://www.gnu.org/licenses>. # -# Filename: xmlparser.py -# Summary: generate xmlfile for log management -# Description: The module gives methods to write xml block -# during a testrun running +# Filename: xmlparser.py +# Summary: generate xmlfile for log management +# Description: The module gives methods to write xml block +# during a testrun running import os import copy @@ -30,19 +30,19 @@ class LogXMLParser(object): """ def __init__(self, logxml): self.logxml = logxml - self.doc = Document() + self.doc = Document() - def generate_logxml(self): + def generate_logxml(self): """ generate a new log xml file with head if that doesn't exist """ XMLFILE = open(self.logxml, "w") XMLFILE.write('<?xml version="1.0"?><?xml-stylesheet type="text/xsl"\ href="log.xsl"?><log xmlns:xlink= \ - "http://www.w3.org/1999/xlink"></log>') - XMLFILE.close() + "http://www.w3.org/1999/xlink"></log>') + XMLFILE.close() def add_testrun_xml(self, testrunid): """ add testrun info into log xml file""" - xmldoc = minidom.parse(self.logxml) + xmldoc = minidom.parse(self.logxml) testrun = self.doc.createElement('testrun') testrun.setAttribute("name", testrunid) xmldoc.childNodes[1].appendChild(testrun) @@ -52,30 +52,30 @@ class LogXMLParser(object): def add_test_xml(self, testrunid, testid): """ add a test info into log xml file""" xmldoc = minidom.parse(self.logxml) - test = self.doc.createElement('test') + test = self.doc.createElement('test') test.setAttribute("id", testid) testrunlist = xmldoc.getElementsByTagName('testrun') for testrun in testrunlist: runattr = testrun.attributes["name"] if runattr.value == testrunid: - testrun.appendChild(test) + testrun.appendChild(test) - self.__write_to_file(xmldoc, self.logxml) + self.__write_to_file(xmldoc, self.logxml) def add_testprocedure_xml(self, testrunid, testid, test_procedure): """ add test procedure info into log xml file """ xmldoc = minidom.parse(self.logxml) procedure = self.doc.createElement('test_procedure') - casename = test_procedure.keys()[0] + casename = test_procedure.keys()[0] valuedict = test_procedure[casename] test_casename = self.doc.createElement('action') - test_casename.setAttribute('name', casename) + test_casename.setAttribute('name', casename) for arg in valuedict.keys(): - test_arg = self.doc.createElement('arg') - test_arg.setAttribute("name", arg) + test_arg = self.doc.createElement('arg') + test_arg.setAttribute("name", arg) test_value = self.doc.createTextNode(valuedict[arg]) test_arg.appendChild(test_value) test_casename.appendChild(test_arg) @@ -92,20 +92,20 @@ class LogXMLParser(object): if testattr.value == testid: test.appendChild(procedure) - self. __write_to_file(xmldoc, self.logxml) + self. __write_to_file(xmldoc, self.logxml) - def add_test_summary(self, testrunid, testid, result, + def add_test_summary(self, testrunid, testid, result, start_time, end_time, path): """ add a test summary xml block into log xml file """ xmldoc = minidom.parse(self.logxml) testresult = self.doc.createElement('result') resulttext = self.doc.createTextNode(result) testresult.appendChild(resulttext) - + teststarttime = self.doc.createElement('start_time') starttimetext = self.doc.createTextNode(start_time) teststarttime.appendChild(starttimetext) - + testendtime = self.doc.createElement('end_time') endtimetext = self.doc.createTextNode(end_time) testendtime.appendChild(endtimetext) @@ -126,20 +126,20 @@ class LogXMLParser(object): test.childNodes.insert(0, testpath) test.childNodes.insert(0, testendtime) test.childNodes.insert(0, teststarttime) - test.childNodes.insert(0, testresult) + test.childNodes.insert(0, testresult) self. __write_to_file(xmldoc, self.logxml) - def add_testrun_summary(self, testrunid, passnum, failnum, totalnum, + def add_testrun_summary(self, testrunid, passnum, failnum, totalnum, start_time, end_time): """ add a testrun summary xml block into log xml file """ xmldoc = minidom.parse(self.logxml) testpass = self.doc.createElement('pass') passtext = self.doc.createTextNode(str(passnum)) testpass.appendChild(passtext) - - testfail = self.doc.createElement('fail') + + testfail = self.doc.createElement('fail') failtext = self.doc.createTextNode(str(failnum)) testfail.appendChild(failtext) @@ -154,7 +154,7 @@ class LogXMLParser(object): teststarttime = self.doc.createElement('start_time') starttimetext = self.doc.createTextNode(start_time) teststarttime.appendChild(starttimetext) - + testendtime = self.doc.createElement('end_time') endtimetext = self.doc.createTextNode(end_time) testendtime.appendChild(endtimetext) @@ -170,10 +170,10 @@ class LogXMLParser(object): testrun.childNodes.insert(0, testpass) self. __write_to_file(xmldoc, self.logxml) - + def remove_test_xml(self, testrunid, testid): """ to remove a test xml block from a log xml file """ - xmldoc = minidom.parse(self.logxml) + xmldoc = minidom.parse(self.logxml) testrunlist = xmldoc.getElementsByTagName('testrun') testrunattrlist = [] @@ -187,21 +187,21 @@ class LogXMLParser(object): testattr = test.attributes["id"] if testattr.value == testid: testattrlist.append(testattr.value) - testrun.removeChild(test) + testrun.removeChild(test) if len(testattrlist) == 0: raise exception.NoTestFound( - "In the xmllog file testrunid %s no testid %s found" % + "In the xmllog file testrunid %s no testid %s found" % (testrunid, testid)) if len(testrunattrlist) == 0: raise exception.NoTestRunFound( - "In the xmllog file no testrunid %s found" % + "In the xmllog file no testrunid %s found" % testrunid) - self. __write_to_file(xmldoc, self.logxml) - + self. __write_to_file(xmldoc, self.logxml) + def remove_testrun_xml(self, testrunid): """ remove a testrun xml block from log xml file """ - xmldoc = minidom.parse(self.logxml) + xmldoc = minidom.parse(self.logxml) testrunlist = xmldoc.getElementsByTagName('testrun') testrunattrlist = [] @@ -213,9 +213,9 @@ class LogXMLParser(object): if len(testrunattrlist) == 0: raise exception.NoTestRunFound( - "In the xmllog file no testrunid %s found" % + "In the xmllog file no testrunid %s found" % testrunid) - + self. __write_to_file(xmldoc, self.logxml) def remove_alltestrun_xml(self): @@ -228,8 +228,8 @@ class LogXMLParser(object): runattr = testrun.attributes["name"] testrunattrlist.append(runattr.value) xmldoc.childNodes[1].removeChild(testrun) - - self. __write_to_file(xmldoc, self.logxml) + + self. __write_to_file(xmldoc, self.logxml) return testrunattrlist def merge_xmlfiles(self, logxml_two): @@ -241,13 +241,13 @@ class LogXMLParser(object): for testrun in testrunlist_two_copy: xmldoc_one.childNodes[1].appendChild(testrun) - - self. __write_to_file(xmldoc_one, self.logxml) + + self. __write_to_file(xmldoc_one, self.logxml) self. __write_to_file(xmldoc_two, logxml_two) def __write_to_file(self, xmldoc, logxml): """ save changes into log xml file """ file = open(logxml, "w") - xmldoc.writexml(file) + xmldoc.writexml(file) file.close() diff --git a/process.py b/process.py index 4d65f72..a712816 100644 --- a/process.py +++ b/process.py @@ -13,10 +13,10 @@ # The GPL text is available in the file COPYING that accompanies this # distribution and at <http://www.gnu.org/licenses>. # -# Filename: process.py -# Summary: multiprocessing module +# Filename: process.py +# Summary: multiprocessing module # Description: If the switch of multiprocessing is on, -# the module will be called to fork subprocess +# the module will be called to fork subprocess import os import sys diff --git a/repos/domain/attach_interface.py b/repos/domain/attach_interface.py index 9d475a3..e6bbbda 100644 --- a/repos/domain/attach_interface.py +++ b/repos/domain/attach_interface.py @@ -107,7 +107,7 @@ def attach_interface(params): return 1 finally: conn.close() - logger.info("closed hypervisor connection") + logger.info("closed hypervisor connection") if test_result: return 0 diff --git a/repos/domain/ownership_test.py b/repos/domain/ownership_test.py index 1eacbcf..5464d86 100644 --- a/repos/domain/ownership_test.py +++ b/repos/domain/ownership_test.py @@ -230,7 +230,7 @@ def ownership_test(params): logger.info("check the domain state") ret = check_domain_running(domobj, guestname, logger) if ret: - return return_close(conn, logger, 1) + return return_close(conn, logger, 1) try: domobj.save(guestname, SAVE_FILE) -- 1.7.7.3

2 1

[libvirt] [PATCH] Add qemu support for ppc64 on FC16 or above for rpm packaging
by Li Zhang 25 Mar '12

25 Mar '12

On Fedora16 or above, qemu is supported now. So it is added in rpm packaging. Signed-off-by: Li Zhang <zhlcindy(a)linux.vnet.ibm.com> --- libvirt.spec.in | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 072fd8e..568a84f 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -139,8 +139,8 @@ %define with_xen 0 %endif -# Fedora doesn't have any QEMU on ppc64 - only ppc -%if 0%{?fedora} +# Fedora doesn't have any QEMU on ppc64 until FC16 - only ppc +%if 0%{?fedora} < 16 %ifarch ppc64 %define with_qemu 0 %endif -- 1.7.5.4

2 4

[libvirt] QEMU fstatfs(2) and libvirt SELinux policy
by Stefan Hajnoczi 24 Mar '12

24 Mar '12

Hi, I have a question about the libvirt SELinux policy that can be applied to QEMU processes. Yesterday Laine helped Khoa and me diagnose an issue where QEMU was doing fstatfs(2) but SELinux prevented this FILESYSTEM__GETATTR operation, resulting in a failed syscall with -EACCES. The SELinux hook is: security/selinux/hooks.c:selinux_sb_statfs(): return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad); It turns out this problem also affects XFS discard support in QEMU today. QEMU calls platform_test_xfs_fd() in libxfs, which works like this: static __inline__ int platform_test_xfs_fd(int fd) { struct statfs buf; if (fstatfs(fd, &buf) < 0) return 0; return (buf.f_type == 0x58465342); /* XFSB */ } In other words, XFS detection will fail when SELinux is enabled. I'm not familiar with libvirt's use of SELinux. Can someone explain if we need to expand the policy in libvirt and how to do that? Thanks, Stefan

7 10

[libvirt] [PATCH] spec: Add missed dependancy for numad
by Osier Yang 24 Mar '12

24 Mar '12

numad is available since Fedora 17 and RHEL6.X. And it's not supported on s390[x] and ARM. --- configure.ac | 26 +++++++++++++++++++++----- libvirt.spec.in | 19 ++++++++++++++++++- src/qemu/qemu_process.c | 2 +- 3 files changed, 40 insertions(+), 7 deletions(-) diff --git a/configure.ac b/configure.ac index 31f0835..ce9c0ff 100644 --- a/configure.ac +++ b/configure.ac @@ -1445,14 +1445,29 @@ AM_CONDITIONAL([HAVE_NUMACTL], [test "$with_numactl" != "no"]) AC_SUBST([NUMACTL_CFLAGS]) AC_SUBST([NUMACTL_LIBS]) -dnl Do we have numad? -if test "$with_qemu" = "yes"; then - AC_PATH_PROG([NUMAD], [numad], [], [/bin:/usr/bin:/usr/local/bin:$PATH]) +dnl numad +AC_ARG_WITH([numad], + AC_HELP_STRING([--with-numad], [use numad to manage CPU placement dynamically @<:@default=check@:>@]), + [], + [with_numad=check]) - if test -n "$NUMAD"; then - AC_DEFINE_UNQUOTED([NUMAD],["$NUMAD"], [Location or name of the numad program]) +if test "$with_numad" != "no" ; then + AC_PATH_PROG([NUMAD], [numad], [], [/bin:/usr/bin]) + if test -z "$NUMAD" ; then + if test "$with_numad" = "check"; then + with_numad="no" + else + AC_MSG_ERROR([You must install the 'numad' to manage CPU placement dynamically]) fi + else + with_numad="yes" + fi + if test "$with_numad" = "yes"; then + AC_DEFINE_UNQUOTED([HAVE_NUMAD], 1, [whether numad is available]) + AC_DEFINE_UNQUOTED([NUMAD],["$NUMAD"], [Location or name of the numad program]) + fi fi +AM_CONDITIONAL([HAVE_NUMAD], [test "$with_numad" != "no"]) dnl pcap lib LIBPCAP_CONFIG="pcap-config" @@ -2774,6 +2789,7 @@ AC_MSG_NOTICE([Warning Flags: $WARN_CFLAGS]) AC_MSG_NOTICE([ Readline: $lv_use_readline]) AC_MSG_NOTICE([ Python: $with_python]) AC_MSG_NOTICE([ DTrace: $with_dtrace]) +AC_MSG_NOTICE([ numad: $with_numad]) AC_MSG_NOTICE([ XML Catalog: $XML_CATALOG_FILE]) AC_MSG_NOTICE([ Init script: $with_init_script]) AC_MSG_NOTICE([Console locks: $with_console_lock_files]) diff --git a/libvirt.spec.in b/libvirt.spec.in index 072fd8e..78800c7 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -84,6 +84,7 @@ %define with_cgconfig 0%{!?_without_cgconfig:0} %define with_sanlock 0%{!?_without_sanlock:0} %define with_systemd 0%{!?_without_systemd:0} +%define with_numad 0%{!?_without_numad:0} # Non-server/HV driver defaults which are always enabled %define with_python 0%{!?_without_python:1} @@ -205,11 +206,19 @@ %define with_storage_disk 0 %endif -# Enable libpcap library %if %{with_qemu} %define with_nwfilter 0%{!?_without_nwfilter:%{server_drivers}} +# Enable libpcap library %define with_libpcap 0%{!?_without_libpcap:%{server_drivers}} %define with_macvtap 0%{!?_without_macvtap:%{server_drivers}} + +# numad is used to manage the CPU placement dynamically, +# it's not available on s390[x] and ARM. +%if 0%{?fedora} >= 17 || 0%{?rhel} >= 6 +%ifnarch s390 s390x %{arm} +%define with_numad 0%{!?_without_numad:%{server_drivers}} +%endif +%endif %endif %if %{with_macvtap} @@ -357,6 +366,9 @@ Requires(post): systemd-sysv Requires(preun): systemd-units Requires(postun): systemd-units %endif +%if %{with_numad} +Requires: numad +%endif # All build-time requirements %if 0%{?enable_autotools} @@ -690,6 +702,10 @@ of recent versions of Linux (and other OSes). %define _without_numactl --without-numactl %endif +%if ! %{with_numad} +%define _without_numad --without-numad +%endif + %if ! %{with_capng} %define _without_capng --without-capng %endif @@ -775,6 +791,7 @@ autoreconf -if %{?_without_storage_disk} \ %{?_without_storage_mpath} \ %{?_without_numactl} \ + %{?_without_numad} \ %{?_without_capng} \ %{?_without_netcf} \ %{?_without_selinux} \ diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 8915a9a..d0706b4 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -1633,7 +1633,7 @@ qemuProcessInitNumaMemoryPolicy(virDomainObjPtr vm) } #endif -#if defined(NUMAD) +#if HAVE_NUMAD static char * qemuGetNumadAdvice(virDomainDefPtr def) { -- 1.7.7.3

2 2

[libvirt] [PATCH 0/2] atomic snapshots, round 2
by Eric Blake 23 Mar '12

23 Mar '12

Depends on round 1 v2 being applied first: https://www.redhat.com/archives/libvir-list/2012-March/msg00747.html So far, I've tested that the error handling path works when targeting the qemu of Fedora 16; I still plan to test that the success path works with a self-built qemu using the code that has been accepted for the upcoming qemu 1.1. Eric Blake (2): snapshot: add support for qemu transaction command snapshot: wire up qemu transaction command src/qemu/qemu_driver.c | 112 ++++++++++++++++++++++++++++++++++++++++-- src/qemu/qemu_monitor.c | 33 ++++++++++-- src/qemu/qemu_monitor.h | 4 ++ src/qemu/qemu_monitor_json.c | 82 ++++++++++++++++++++++++------- src/qemu/qemu_monitor_json.h | 2 + 5 files changed, 205 insertions(+), 28 deletions(-) -- 1.7.7.6

2 6

[libvirt] [PATCH 0/3] atomic snapshots, round 1
by Eric Blake 23 Mar '12

23 Mar '12

I figured it's better to post small patch series for incremental review than to slam the list with a 20 patch series. I'm in the middle of coding up my RFC for interaction with the new qemu 1.1 'transaction' monitor command, and this is the first step. [1] https://www.redhat.com/archives/libvir-list/2012-March/msg00578.html To avoid a merge conflict, this patch [2] needs to be applied first. [2] https://www.redhat.com/archives/libvir-list/2012-March/msg00744.html Eric Blake (3): snapshot: add qemu capability for 'transaction' command snapshot: add atomic create flag snapshot: rudimentary qemu support for atomic disk snapshot include/libvirt/libvirt.h.in | 2 ++ src/libvirt.c | 21 ++++++++++++++------- src/qemu/qemu_capabilities.c | 1 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_driver.c | 40 +++++++++++++++++++++++++++------------- src/qemu/qemu_monitor_json.c | 3 +++ tools/virsh.c | 6 ++++++ tools/virsh.pod | 16 ++++++++++++++-- 8 files changed, 68 insertions(+), 22 deletions(-) -- 1.7.7.6

2 13

[libvirt] [PATCH 00/14] Support reading auth credentials from a config file
by Daniel P. Berrange 23 Mar '12

23 Mar '12

When connecting to a remote libvirtd, or hypervisor that requires authentication we have callbacks which can be used to prompt for various credentials. This is tedious if you are looking to automate stuff though. While we could let each application implement a custom auth callback for fetching credentials from a config file, it is nicer if we provide this ability directly in libvirt, so that all apps can benefit from it. So this series introduces a new config file in which authentication credentials can be placed. It supports setting multiple sets of credentials, of varying types in one file. I use the '.ini' config file syntax, since this makes it easy to reuse the same config file in virt-viewer & similar apps to store VNC / SPICE credentials. To find the config file we check for each of - Path from LIBVIRT_AUTH_FILE env var - Query param 'authfile=PATH' in the URI params - /etc/libvirt/auth.conf - $HOME/.libvirt/auth.conf if no config file is present, everything should carry on as normal. If the config is present, then it is consulted to fill in credentials first. Only if there are still missing credentials, will the auth callbacks then be invoked. See the docs in patch 12 of this series for the config file syntax examples. This is supported for all drivers that do auth, remote, esx, xenapi, hyperv and phyp, though I have only tested it with the remote driver. I would appreciate someone giving it a go with the other drivers. The first 7 patches are actually all related to the viruri.[ch] file, expanding its functionality & adding tests. This is to make sure the auth config patches can have easy access to the query params. The last 7 patches are related to the auth config file support again including tests

3 37

[libvirt] [PATCH] build: fix incorrect enum declaration
by Eric Blake 23 Mar '12

23 Mar '12

Recent changes have caused build failures on builds where pdwtags works: commit a26a196 mistakenly exported a public variable commits a26a196, 57ddcc2, 487c063 all had copy-paste bugs in hand-updating the golden API rather than rerunning pdwtags * include/libvirt/libvirt.h.in (virDomainEventTrayChangeReason): Make this a typedef, not external storage. * src/remote_protocol-structs (remote_procedure): Fix spelling. --- Pushing under the build-breaker rule, as 'make -C src check' failed. The build is still broken, though, due to a missing qparams.h file causing 'make -C tests check' to fail. include/libvirt/libvirt.h.in | 2 +- src/remote_protocol-structs | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/include/libvirt/libvirt.h.in b/include/libvirt/libvirt.h.in index c702e66..8bb5c57 100644 --- a/include/libvirt/libvirt.h.in +++ b/include/libvirt/libvirt.h.in @@ -3684,7 +3684,7 @@ typedef void (*virConnectDomainEventDiskChangeCallback)(virConnectPtr conn, * * The reason describing why the callback was called */ -enum { +typedef enum { VIR_DOMAIN_EVENT_TRAY_CHANGE_OPEN = 0, VIR_DOMAIN_EVENT_TRAY_CHANGE_CLOSE, diff --git a/src/remote_protocol-structs b/src/remote_protocol-structs index 474e574..9b2414f 100644 --- a/src/remote_protocol-structs +++ b/src/remote_protocol-structs @@ -1654,13 +1654,13 @@ struct remote_domain_event_tray_change_msg { remote_nonnull_domain dom; remote_nonnull_string devAlias; int reason; -} +}; struct remote_domain_event_pmwakeup_msg { remote_nonnull_domain dom; -} +}; struct remote_domain_event_pmsuspend_msg { remote_nonnull_domain dom; -} +}; struct remote_domain_managed_save_args { remote_nonnull_domain dom; u_int flags; @@ -2189,7 +2189,7 @@ enum remote_procedure { REMOTE_PROC_DOMAIN_GET_METADATA = 265, REMOTE_PROC_DOMAIN_BLOCK_REBASE = 266, REMOTE_PROC_DOMAIN_PM_WAKEUP = 267, - REMOTE_PROC_DOMAIN_TRAY_CHANGE = 268, - REMOTE_PROC_DOMAIN_PMWAKEUP = 269, - REMOTE_PROC_DOMAIN_PMSUSPEND = 270, + REMOTE_PROC_DOMAIN_EVENT_TRAY_CHANGE = 268, + REMOTE_PROC_DOMAIN_EVENT_PMWAKEUP = 269, + REMOTE_PROC_DOMAIN_EVENT_PMSUSPEND = 270, }; -- 1.7.7.6

1 0

[libvirt] [PATCH 0/6] atomic snapshots, rounds 4 and 5
by Eric Blake 23 Mar '12

23 Mar '12

I was originally going to send this as two rounds, one for the XML additions of adding mirrors, and one for the flag addition to virDomainSnapshotDelete for mapping to drive-reopen; but it turned out that testing is easier if I finish the series. Note that this is minimally tested at the moment; I'm posting it to get review started, but I plan on hammering it tomorrow, and possibly coming up with slight alterations for a v2. This assumes that rounds 1-3 (ending here) have been applied: https://www.redhat.com/archives/libvir-list/2012-March/msg00846.html This should finish out my RFC here: https://www.redhat.com/archives/libvir-list/2012-March/msg00578.html but with one major caveat: https://lists.gnu.org/archive/html/qemu-devel/2012-03/msg01524.html Upstream qemu has not yet committed the 'drive-mirror' or 'drive-reopen' monitor commands, which this series (rounds 4-5) depends on. There are still bugs being worked out under the hood on the qemu side, and there is a slight possibility that fixing those bugs may change the public interface. Therefore, part of the review of this series should be to determine whether we take the risk of applying the patch now, or waiting for qemu to stabilize a bit further. I will probably push rounds 1-3 tomorrow, since they have been ACK'd (well, round 3 is still awaiting review), and since qemu has committed to the 'transaction' monitor command for qemu 1.1. For reference, it is likely that RHEL 6.3 will not wait for qemu 1.1, but will instead provide RHEL-specific monitor commands named __com.redhat_drive-mirror and __com.redhat_drive-reopen; I have hopefully structured things well enough that it will be a couple lines of patching to qemu_monitor_json.c to recognize that alternate command name. Eric Blake (6): snapshot: allow for creation of mirrored snapshots snapshot: add new snapshot delete flags snapshot: make it possible to check for mirrored snapshot snapshot: expose qemu commands for mirrored storage migration snapshot: implement new snapshot delete flags in qemu snapshot: enable mirrored snapshots on transient vm docs/formatsnapshot.html.in | 31 +++ docs/schemas/domainsnapshot.rng | 8 + include/libvirt/libvirt.h.in | 6 + src/conf/domain_conf.c | 58 +++++- src/conf/domain_conf.h | 4 + src/libvirt.c | 37 +++- src/libvirt_private.syms | 2 + src/qemu/qemu_capabilities.c | 3 + src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_driver.c | 242 +++++++++++++++++++- src/qemu/qemu_monitor.c | 50 ++++ src/qemu/qemu_monitor.h | 14 ++ src/qemu/qemu_monitor_json.c | 70 ++++++- src/qemu/qemu_monitor_json.h | 21 ++- .../disk_snapshot_mirror.xml | 13 + .../disk_snapshot_mirror.xml | 49 ++++ tests/domainsnapshotxml2xmltest.c | 4 +- tools/virsh.c | 13 + tools/virsh.pod | 21 ++- 19 files changed, 622 insertions(+), 26 deletions(-) create mode 100644 tests/domainsnapshotxml2xmlin/disk_snapshot_mirror.xml create mode 100644 tests/domainsnapshotxml2xmlout/disk_snapshot_mirror.xml -- 1.7.7.6

2 9

[libvirt] [PATCH 0/11 v2] Add supports for three new QMP events
by Osier Yang 23 Mar '12

23 Mar '12

v1 ~ v2: * Two more patches, [5/11] to prohibit tray='open' for block type disk. And [9/11] to introduce a new domain state 'pmsuspended' * Definition (including name) for DEVICE_TRAY_MOVED event is changed into: typedef void (*virConnectDomainEventTrayChangeCallback)(virConnectPtr conn, virDomainPtr dom, const char *devAlias, int reason, void *opaque); * Definition for both SUSPEND and WAKEUP event are changed, one more parameter 'int reason' for future extension. * While SUSPEND event is emitted, the running domain will be transfered into the new domain state "pmsuspended", instead of "paused". And while WAKEUP is emitted, it will transfer the domain state to running only if the domain state is "pmsuspended". This patch series adds support for 3 new QMP events: WAKEUP, SUSPEND, and DEVICE_TRAY_MOVED, and related changes on domain's conf and status. [1/11] Add support for tray moved event [2/11] ~ [6/11]: New attribute "tray" is added to disk target, it indicates the tray status of removable disk, i.e. CDROM and Floppy disks, its value could be either of "open" or "closed", defaults to "closed", and a removable disk with tray == "open" won't have the source when domain is started. The value of "tray" will be updated while tray moved event is emitted from guest. tray status 'open' is prohibited for block type disk. Prior to these patches, if the user ejected the medium of removable disk from guest side, and then do migration or save/restoring, the guest will still starts the medium source ,and thus the medium will still exists in guest, which is strange. These patches fix it. [7/11] + [11/11]: Add support for wakeup event, and update the domain status to running if the domain is in pmsuspended state, while the wakeup event is emitted. [9/11] Introduce new domain state "pmsuspended", which indicates the domain has been suspended by guest power management, e.g, entered into s3 state. [8/11] + [10/11]: Add support for suspend event, and update the domain status to pmsuspended if the domain was running, while the suspend event is emitted. Osier Yang(11) Add support for event tray moved of removable disks docs: Add documentation for new attribute tray of disk target conf: Parse and for the tray attribute qemu: Do not start with source for removable disks if tray is open qemu: Prohibit setting tray status as open for block type disk qemu: Update tray status while tray moved event is emitted Add support for the wakeup event Add support for the suspend event New domain state pmsuspended qemu: Update domain state to pmsuspended while suspend event occurs qemu: Update domain status to running while wakeup event is emitted daemon/remote.c | 79 ++++++++++ docs/formatdomain.html.in | 13 ++- docs/schemas/domaincommon.rng | 8 + examples/domain-events/events-c/event-test.c | 66 +++++++++- examples/domain-events/events-python/event-test.py | 12 ++ include/libvirt/libvirt.h.in | 98 ++++++++++++- python/libvirt-override-virConnect.py | 27 ++++ python/libvirt-override.c | 150 ++++++++++++++++++++ src/conf/domain_conf.c | 71 ++++++++-- src/conf/domain_conf.h | 9 ++ src/conf/domain_event.c | 115 +++++++++++++++ src/conf/domain_event.h | 10 ++ src/libvirt_private.syms | 6 + src/qemu/qemu_command.c | 31 ++++- src/qemu/qemu_monitor.c | 33 +++++ src/qemu/qemu_monitor.h | 16 ++- src/qemu/qemu_monitor_json.c | 45 ++++++ src/qemu/qemu_process.c | 121 ++++++++++++++++ src/remote/remote_driver.c | 95 ++++++++++++ src/remote/remote_protocol.x | 19 +++- src/remote_protocol-structs | 14 ++ tests/qemuxml2argvdata/qemuxml2argv-boot-cdrom.xml | 2 +- .../qemuxml2argv-boot-complex-bootindex.xml | 6 +- .../qemuxml2argvdata/qemuxml2argv-boot-complex.xml | 6 +- .../qemuxml2argvdata/qemuxml2argv-boot-floppy.xml | 2 +- ...uxml2argv-boot-menu-disable-drive-bootindex.xml | 2 +- .../qemuxml2argv-boot-menu-disable-drive.xml | 2 +- .../qemuxml2argv-boot-menu-disable.xml | 2 +- .../qemuxml2argv-boot-menu-enable.xml | 2 +- tests/qemuxml2argvdata/qemuxml2argv-boot-multi.xml | 2 +- tests/qemuxml2argvdata/qemuxml2argv-boot-order.xml | 4 +- tests/qemuxml2argvdata/qemuxml2argv-bootloader.xml | 2 +- tests/qemuxml2argvdata/qemuxml2argv-disk-aio.xml | 2 +- .../qemuxml2argv-disk-cdrom-empty.xml | 2 +- ...qemuxml2argv-disk-cdrom-tray-no-device-cap.args | 4 + .../qemuxml2argv-disk-cdrom-tray-no-device-cap.xml | 32 ++++ .../qemuxml2argv-disk-cdrom-tray.args | 10 ++ .../qemuxml2argv-disk-cdrom-tray.xml | 43 ++++++ tests/qemuxml2argvdata/qemuxml2argv-disk-cdrom.xml | 2 +- .../qemuxml2argv-disk-copy_on_read.xml | 2 +- .../qemuxml2argv-disk-drive-boot-cdrom.xml | 2 +- .../qemuxml2argv-disk-drive-boot-disk.xml | 2 +- .../qemuxml2argv-disk-drive-cache-directsync.xml | 2 +- .../qemuxml2argv-disk-drive-cache-unsafe.xml | 2 +- .../qemuxml2argv-disk-drive-cache-v1-none.xml | 2 +- .../qemuxml2argv-disk-drive-cache-v1-wb.xml | 2 +- .../qemuxml2argv-disk-drive-cache-v1-wt.xml | 2 +- .../qemuxml2argv-disk-drive-cache-v2-none.xml | 2 +- .../qemuxml2argv-disk-drive-cache-v2-wb.xml | 2 +- .../qemuxml2argv-disk-drive-cache-v2-wt.xml | 2 +- ...muxml2argv-disk-drive-error-policy-enospace.xml | 2 +- .../qemuxml2argv-disk-drive-error-policy-stop.xml | 2 +- ...rgv-disk-drive-error-policy-wreport-rignore.xml | 2 +- .../qemuxml2argv-disk-drive-fmt-qcow.xml | 2 +- .../qemuxml2argv-disk-drive-no-boot.xml | 4 +- .../qemuxml2argv-disk-drive-readonly-disk.xml | 2 +- .../qemuxml2argv-disk-drive-readonly-no-device.xml | 2 +- .../qemuxml2argv-disk-drive-shared.xml | 2 +- ...emuxml2argv-disk-floppy-tray-no-device-cap.args | 4 + ...qemuxml2argv-disk-floppy-tray-no-device-cap.xml | 37 +++++ .../qemuxml2argv-disk-floppy-tray.args | 10 ++ .../qemuxml2argv-disk-floppy-tray.xml | 37 +++++ .../qemuxml2argvdata/qemuxml2argv-disk-floppy.xml | 4 +- .../qemuxml2argv-disk-ioeventfd.xml | 2 +- tests/qemuxml2argvdata/qemuxml2argv-disk-order.xml | 2 +- .../qemuxml2argv-disk-snapshot.xml | 2 +- .../qemuxml2argvdata/qemuxml2argv-disk-virtio.xml | 2 +- .../qemuxml2argvdata/qemuxml2argv-disk-xenvbd.xml | 2 +- tests/qemuxml2argvdata/qemuxml2argv-event_idx.xml | 2 +- .../qemuxml2argv-floppy-drive-fat.xml | 2 +- .../qemuxml2argv-graphics-spice-timeout.xml | 2 +- tests/qemuxml2argvdata/qemuxml2argv-lease.xml | 2 +- .../qemuxml2argv-net-bandwidth.xml | 2 +- tests/qemuxml2argvtest.c | 6 + .../qemuxml2xmlout-graphics-spice-timeout.xml | 2 +- tests/vmx2xmldata/vmx2xml-cdrom-ide-device.xml | 2 +- tests/vmx2xmldata/vmx2xml-cdrom-ide-file.xml | 2 +- tests/vmx2xmldata/vmx2xml-cdrom-scsi-device.xml | 2 +- tests/vmx2xmldata/vmx2xml-cdrom-scsi-file.xml | 2 +- tests/vmx2xmldata/vmx2xml-esx-in-the-wild-2.xml | 8 +- tests/vmx2xmldata/vmx2xml-esx-in-the-wild-3.xml | 4 +- tests/vmx2xmldata/vmx2xml-esx-in-the-wild-5.xml | 2 +- tests/vmx2xmldata/vmx2xml-esx-in-the-wild-6.xml | 2 +- tests/vmx2xmldata/vmx2xml-floppy-device.xml | 2 +- tests/vmx2xmldata/vmx2xml-floppy-file.xml | 2 +- tests/vmx2xmldata/vmx2xml-ws-in-the-wild-1.xml | 2 +- tests/vmx2xmldata/vmx2xml-ws-in-the-wild-2.xml | 2 +- tools/virsh.c | 12 ++ tools/virsh.pod | 7 +- 89 files changed, 1277 insertions(+), 99 deletions(-) Osier

2 26

[libvirt] [PATCH v3 0/3] Sysinfo improvements for PowerPC & x86
by Prerna 23 Mar '12

23 Mar '12

This series of patches implements the following: Patch 1/2 : Implement sysinfo for PowerPC. OnPowerPC, sysinfo is obtained by reading /proc/cpuinfo since dmidecode is not available. Patch 2/2 : Based on Eric's suggestion (http://www.redhat.com/archives/libvir-list/2012-February/msg00509.html) Allow x86 to read host system's processor information from /proc/cpuinfo in the event dmidecode is not available. Changelog : ----------- v1->v2 : * Rebased and cleanups done. v2->v3: * Patch 1/2 : rebased. * Patch 2/2 : As reported by Daniel, it was found that 'dmidecode' lists socket (and not core-level) information under the <processor> XML tag. The /proc/cpuinfo fallback is also accordingly modified to display a listing of the available sockets under the '<processor>' XML tag under sysinfo. (http://www.spinics.net/linux/fedora/libvir/msg53922.html) Thanks, -- Prerna Saxena Linux Technology Centre, IBM Systems and Technology Lab, Bangalore, India

2 5

[libvirt] clarify freecell documentation v2
by Dave Allan 23 Mar '12

23 Mar '12

Modified per Eric's feedback: removed incorrect virsh help change, removed unnecessary examples in the manpage. I also fixed two instances in which I referred to nodes instead of cells. Dave

2 3

[libvirt] [PATCH] libvirt:docs: fix typo
by Zhou Peng 23 Mar '12

23 Mar '12

--- docs/formatdomain.html.in | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 4edada3..3a504a1 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -2903,8 +2903,8 @@ qemu-kvm -net nic,model=? /dev/null 0.9.3. - Mouse mode is set by the <code>mouse<code/> element, - setting it's <code>mode<code/> attribute to one of + Mouse mode is set by the <code>mouse</code> element, + setting it's <code>mode</code> attribute to one of <code>server</code> or <code>client</code> , since 0.9.11. If no mode is specified, the qemu default will be used (client mode). -- 1.7.7.6

2 1

Re: [libvirt] [libvirt PATCHv6 1/1] add DHCP snooping
by David Stevens 23 Mar '12

23 Mar '12

Stefan Berger/Watson/IBM wrote on 03/22/2012 05:33:41 PM: > > Ok. > An idea may be that the threat has to 'find' its snoop request in a > global list every time it processes a packet. Once it cannot find it > anymore, it dies. Removing the request from the global list would be > the way to terminate the threat. Also, it would have to hold a look > to the snoop request while it does anything else than waiting for > packets in the pcap library. Actually, that's exactly what I was going to do -- a hash list of valid threads and exit if it isn't in the list; then still remove the req's and free them as the current code does, which means they won't interfere with each other, but the cancel code can be separated, in the same place, but synchronous with no signal; Thread management independent of req management. +_DLS

1 0

Re: [libvirt] [libvirt PATCHv6 1/1] add DHCP snooping
by Stefan Berger 23 Mar '12

23 Mar '12

David Stevens/Beaverton/IBM wrote on 03/22/2012 08:10:44 PM: > From: David Stevens/Beaverton/IBM > To: Stefan Berger/Watson/IBM > Cc: Eric Blake <eblake(a)redhat.com>, libvir-list(a)redhat.com > Date: 03/22/2012 08:10 PM > Subject: Re: [libvirt] [libvirt PATCHv6 1/1] add DHCP snooping > > Stefan Berger/Watson/IBM wrote on 03/22/2012 05:00:45 PM: > > > Maybe we should go with the previous code from a while ago which was > > setting a flag for the thread to die. It caused other work-arounds > > to become necessary but at least we don't have to deal with possibly > > async. deaths of threads holding locks. > > Yes, I have in mind a way to do this now that should keep the > simplicity and still not use signals. I'll try this out and > repost. > Ok. An idea may be that the threat has to 'find' its snoop request in a global list every time it processes a packet. Once it cannot find it anymore, it dies. Removing the request from the global list would be the way to terminate the threat. Also, it would have to hold a look to the snoop request while it does anything else than waiting for packets in the pcap library. Stefan

1 0

Re: [libvirt] [libvirt PATCHv6 1/1] add DHCP snooping
by David Stevens 23 Mar '12

23 Mar '12

Stefan Berger/Watson/IBM wrote on 03/22/2012 05:00:45 PM: > Maybe we should go with the previous code from a while ago which was > setting a flag for the thread to die. It caused other work-arounds > to become necessary but at least we don't have to deal with possibly > async. deaths of threads holding locks. Yes, I have in mind a way to do this now that should keep the simplicity and still not use signals. I'll try this out and repost. +-DLS

1 0

Re: [libvirt] [libvirt PATCHv6 1/1] add DHCP snooping
by Stefan Berger 23 Mar '12

23 Mar '12

David Stevens/Beaverton/IBM wrote on 03/22/2012 07:26:06 PM: > From: David Stevens/Beaverton/IBM > To: Eric Blake <eblake(a)redhat.com> > Cc: libvir-list(a)redhat.com, Stefan Berger/Watson/IBM@IBMUS > Date: 03/22/2012 07:26 PM > Subject: Re: [libvirt] [libvirt PATCHv6 1/1] add DHCP snooping > > Eric Blake <eblake(a)redhat.com> wrote on 03/22/2012 03:54:31 PM: > > > > > pthread_cancel() tends to imply that you are properly managing signal > > blocking across threads; we haven't used it anywhere else in libvirt, > > and I'm extremely wary of pulling it in now, as there's probably a lot > > of subtle bugs that it would expose. Are you sure you can't do this in > > some other manner without dragging in pthread_cancel()? > Well, I was trying to avoid it in the earlier versions, but we ran > into races where a new snooper thread could start up on the same interface > before the old one woke up and noticed it was supposed to die; the old > thread would then interfere with the new thread in unpleasant ways. Right. I had created several patches on top of your previous code. From what I remember pretty much all scenarios were working: SIGHUP, multiple IP addresses, suspend/resume... Some of the code that became necessary due to the interaction of the threads really wasn't 'nice' (tricky)... Stefan

1 0

Re: [libvirt] [libvirt PATCHv6 1/1] add DHCP snooping
by David Stevens 23 Mar '12

23 Mar '12

Stefan Berger/Watson/IBM wrote on 03/22/2012 03:04:53 PM: > > I have some concerns about the cancelation of the thread. It can > hold the snoop lock and get cancelled while holding it. Next time > that lock is grabbed we will get a deadlock... > The snoop lock is acquired in virNWFilterDHCPSnoopEnd(), which is where the pthread_cancel() directly (for valid leases) or the freeReq()/pthread_cancel() is done. So, the canceler has the lock and the canceling thread can't have it, then. The only other case I see is when the config goes invalid and we exit the snooper loop; he frees the snoop_lock() before removing his own hash entry, which will cancel the same thread doing the remove. Again, it can't have the snoop lock when canceled. Is there some other case you think I'm missing? +-DLS

3 3

Re: [libvirt] [libvirt PATCHv6 1/1] add DHCP snooping
by Stefan Berger 22 Mar '12

22 Mar '12

David Stevens/Beaverton/IBM wrote on 03/22/2012 04:22:55 PM: > From: David Stevens/Beaverton/IBM > To: Stefan Berger/Watson/IBM > Cc: "Daniel P. Berrange" <berrange(a)redhat.com>, libvir-list(a)redhat.com > Date: 03/22/2012 04:23 PM > Subject: Re: [libvirt PATCHv6 1/1] add DHCP snooping > > Stefan Berger/Watson/IBM wrote on 03/22/2012 12:22:20 PM: > > > > I tried it. It doesn't apply more than one IP address. The code also > > doesn't apply cleanly to the tip. > > > > Stefan > > Stefan, > I did a git pull yesterday to which this patch is > applied; here is the last entry before the patch: > > commit 25fb4c65a54e3c34c8084b2d49b888d11685a973 > Author: Eric Blake <eblake(a)redhat.com> > Date: Tue Mar 20 17:04:38 2012 -0600 > > build: drop a painfully long gnulib test Maybe it was my fault while copying and pasting from email app into a VNC session and tabs got distorted ... I have some concerns about the cancelation of the thread. It can hold the snoop lock and get cancelled while holding it. Next time that lock is grabbed we will get a deadlock... Stefan

1 0

[libvirt] clarify freecell documentation
by Dave Allan 22 Mar '12

22 Mar '12

There were a couple of minor inaccuracies in the freecell manpage and virsh help. The first patch fixes the manpage and the second, to virsh.c, attempts to fix the help output. The virsh.c patch appears to produce the correct output, but is pure cargo cult programming, so it should be very carefully reviewed. Dave

2 6

Re: [libvirt] [libvirt PATCHv6 1/1] add DHCP snooping
by David Stevens 22 Mar '12

22 Mar '12

Stefan Berger/Watson/IBM wrote on 03/22/2012 12:22:20 PM: > > I tried it. It doesn't apply more than one IP address. The code also > doesn't apply cleanly to the tip. > > Stefan Stefan, I did a git pull yesterday to which this patch is applied; here is the last entry before the patch: commit 25fb4c65a54e3c34c8084b2d49b888d11685a973 Author: Eric Blake <eblake(a)redhat.com> Date: Tue Mar 20 17:04:38 2012 -0600 build: drop a painfully long gnulib test Am I using the wrong git tree, or can you be more specific about the errors you're seeing? The last I looked at this there was no multiple address support and this code is not attempting to add it. If you're saying that ip_learning, which this optionally substitutes for, now supports multiple addresses, I can look at adding it. The goal of this patch is simply to use only valid DHCP leases as the basis for anti-spoofing rules as a more secure method than the existing learning code. +-DLS

1 0

[libvirt] clarify doc references to documentation
by Dave Allan 22 Mar '12

22 Mar '12

This patch is a v2 follwing up on: http://www.redhat.com/archives/libvir-list/2012-February/msg01104.html rebased to the current HEAD and incorporating the changes suggested by Eric. I've also made a couple of minor unrelated cleanups to the affected sentences to make the whole thing read a bit better. Dave

2 3

[libvirt] [libvirt PATCHv6 1/1] add DHCP snooping
by David L Stevens 22 Mar '12

22 Mar '12

This patch adds DHCP snooping support to libvirt. The learning method for IP addresses is specified by setting the "ip_learning" variable to one of "any" [default] (existing IP learning code), "none" (static only addresses) or "dhcp" (DHCP snooping). Active leases are saved in a lease file and reloaded on restart or HUP. Changes since v5: - use VMUUID+MAC to identify interfaces for leases - use direct pthread_cancel to kill snooper threads to avoid races with re-used host interfaces Signed-off-by: David L Stevens <dlstevens(a)us.ibm.com> --- docs/formatnwfilter.html.in | 17 + src/Makefile.am | 2 + src/nwfilter/nwfilter_dhcpsnoop.c | 1078 ++++++++++++++++++++++++++++++++ src/nwfilter/nwfilter_dhcpsnoop.h | 38 ++ src/nwfilter/nwfilter_driver.c | 6 + src/nwfilter/nwfilter_gentech_driver.c | 59 ++- 6 files changed, 1187 insertions(+), 13 deletions(-) create mode 100644 src/nwfilter/nwfilter_dhcpsnoop.c create mode 100644 src/nwfilter/nwfilter_dhcpsnoop.h diff --git a/docs/formatnwfilter.html.in b/docs/formatnwfilter.html.in index 9cb7644..ad10765 100644 --- a/docs/formatnwfilter.html.in +++ b/docs/formatnwfilter.html.in @@ -2189,6 +2189,23 @@ In case a VM is resumed after suspension or migrated, IP address detection will be restarted. + + Variable ip_learning may be used to specify + the IP address learning method. Valid values are any, dhcp, + or none. The default value is any, meaning that libvirt + may use any packet to determine the address in use by a VM. A value of + dhcp specifies that libvirt should only honor DHCP server-assigned + addresses with valid leases. If ip_learning is set to none, + libvirt does not do address learning and referencing IP without + assigning it an explicit value is an error. + + Use of ip_learning=dhcp (DHCP snooping) provides additional + anti-spoofing security, especially when combined with a filter allowing + only trusted DHCP servers to assign addresses. If the DHCP lease expires, + the VM will no longer be able to use the IP address until it acquires a + new, valid lease from a DHCP server. If the VM is migrated, it must get + a new valid DHCP lease to use an IP address (e.g., by + bringing the VM interface down and up again). <h3><a name="nwflimitsmigr">VM Migration</a></h3> diff --git a/src/Makefile.am b/src/Makefile.am index e57eca2..4dc1609 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -508,6 +508,8 @@ NWFILTER_DRIVER_SOURCES = \ nwfilter/nwfilter_driver.h nwfilter/nwfilter_driver.c \ nwfilter/nwfilter_gentech_driver.c \ nwfilter/nwfilter_gentech_driver.h \ + nwfilter/nwfilter_dhcpsnoop.c \ + nwfilter/nwfilter_dhcpsnoop.h \ nwfilter/nwfilter_ebiptables_driver.c \ nwfilter/nwfilter_ebiptables_driver.h \ nwfilter/nwfilter_learnipaddr.c \ diff --git a/src/nwfilter/nwfilter_dhcpsnoop.c b/src/nwfilter/nwfilter_dhcpsnoop.c new file mode 100644 index 0000000..682a4ab --- /dev/null +++ b/src/nwfilter/nwfilter_dhcpsnoop.c @@ -0,0 +1,1078 @@ +/* + * nwfilter_dhcpsnoop.c: support for DHCP snooping used by a VM + * on an interface + * + * Copyright (C) 2011 IBM Corp. + * Copyright (C) 2011 David L Stevens + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: David L Stevens <dlstevens(a)us.ibm.com> + * Based in part on work by Stefan Berger <stefanb(a)us.ibm.com> + */ + +#include <config.h> + +#ifdef HAVE_LIBPCAP +#include <pcap.h> +#endif + +#include <fcntl.h> +#include <sys/ioctl.h> +#include <signal.h> + +#include <arpa/inet.h> +#include <net/ethernet.h> +#include <netinet/ip.h> +#include <netinet/udp.h> +#include <net/if.h> +#include <net/if_arp.h> +#include <intprops.h> + +#include "internal.h" + +#include "buf.h" +#include "memory.h" +#include "logging.h" +#include "datatypes.h" +#include "virterror_internal.h" +#include "threads.h" +#include "conf/nwfilter_params.h" +#include "conf/domain_conf.h" +#include "nwfilter_gentech_driver.h" +#include "nwfilter_ebiptables_driver.h" +#include "nwfilter_dhcpsnoop.h" +#include "virnetdev.h" +#include "virfile.h" +#include "configmake.h" + +#define VIR_FROM_THIS VIR_FROM_NWFILTER + +#ifdef HAVE_LIBPCAP + +#define LEASEFILE LOCALSTATEDIR "/run/libvirt/network/nwfilter.leases" +#define TMPLEASEFILE LOCALSTATEDIR "/run/libvirt/network/nwfilter.ltmp" +static int lease_fd = -1; +static int nleases = 0; /* number of active leases */ +static int wleases = 0; /* number of written leases */ + +static virHashTablePtr SnoopReqs; +static virHashTablePtr IfnameToKey; +static pthread_mutex_t SnoopLock; + +#define snoop_lock() { pthread_mutex_lock(&SnoopLock); } +#define snoop_unlock() { pthread_mutex_unlock(&SnoopLock); } + +#define VIR_IFKEY_LEN ((VIR_UUID_STRING_BUFLEN) + (VIR_MAC_STRING_BUFLEN)) + +struct virNWFilterSnoopReq { + virNWFilterTechDriverPtr techdriver; + const char *ifname; + int ifindex; + const char *linkdev; + enum virDomainNetType nettype; + char ifkey[VIR_IFKEY_LEN]; + unsigned char macaddr[VIR_MAC_BUFLEN]; + const char *filtername; + virNWFilterHashTablePtr vars; + virNWFilterDriverStatePtr driver; + int running; + /* start and end of lease list, ordered by lease time */ + struct iplease *start; + struct iplease *end; + pthread_t thread; +}; + +#define POLL_INTERVAL 10*1000 /* 10 secs */ +#define MAXERRS 25 /* retries on failing device */ + +struct iplease { + uint32_t ipl_ipaddr; + uint32_t ipl_server; + struct virNWFilterSnoopReq *ipl_req; + unsigned int ipl_timeout; + /* timer list */ + struct iplease *ipl_prev; + struct iplease *ipl_next; +}; + +static struct iplease *ipl_getbyip(struct iplease *start, uint32_t ipaddr); +static void ipl_update(struct iplease *pl, uint32_t timeout); + +static struct virNWFilterSnoopReq *newreq(const char *ifkey); + +static void lease_open(void); +static void lease_close(void); +static void lease_load(void); +static void lease_save(struct iplease *ipl); +static void lease_restore(struct virNWFilterSnoopReq *req); +static void lease_refresh(void); + +/* + * ipl_ladd - add an IP lease to a list + */ +static void +ipl_ladd(struct iplease *plnew, struct iplease **start, struct iplease **end) +{ + struct iplease *pl; + + plnew->ipl_next = plnew->ipl_prev = 0; + if (!*start) { + *start = *end = plnew; + return; + } + for (pl = *end; pl && plnew->ipl_timeout < pl->ipl_timeout; + pl = pl->ipl_prev) + /* empty */ ; + if (!pl) { + plnew->ipl_next = *start; + *start = plnew; + } else { + plnew->ipl_next = pl->ipl_next; + pl->ipl_next = plnew; + } + plnew->ipl_prev = pl; + if (plnew->ipl_next) + plnew->ipl_next->ipl_prev = plnew; + else + *end = plnew; +} + +/* + * ipl_tadd - add an IP lease to the timer list + */ +static void +ipl_tadd(struct iplease *plnew) +{ + struct virNWFilterSnoopReq *req = plnew->ipl_req; + + ipl_ladd(plnew, &req->start, &req->end); +} + +/* + * ipl_install - install rule for a lease + */ +static int +ipl_install(struct iplease *ipl) +{ + char ipbuf[20]; /* dotted decimal IP addr string */ + int rc; + virNWFilterVarValuePtr ipVar; + + if (!inet_ntop(AF_INET, &ipl->ipl_ipaddr, ipbuf, sizeof(ipbuf))) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("ipl_install inet_ntop " "failed (0x%08X)"), + ipl->ipl_ipaddr); + return -1; + } + ipVar = virNWFilterVarValueCreateSimpleCopyValue(ipbuf); + if (!ipVar) { + virReportOOMError(); + return -1; + } + if (virNWFilterHashTablePut(ipl->ipl_req->vars, "IP", ipVar, 1)) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("Could not add variable \"IP\" to hashmap")); + virNWFilterVarValueFree(ipVar); + return -1; + } + rc = virNWFilterInstantiateFilterLate(NULL, + ipl->ipl_req->ifname, + ipl->ipl_req->ifindex, + ipl->ipl_req->linkdev, + ipl->ipl_req->nettype, + ipl->ipl_req->macaddr, + ipl->ipl_req->filtername, + ipl->ipl_req->vars, + ipl->ipl_req->driver); + if (rc) + return -1; + return 0; +} + +/* + * ipl_add - create or update an IP lease + */ +static void +ipl_add(struct iplease *plnew, bool update_leasefile) +{ + struct iplease *pl; + struct virNWFilterSnoopReq *req = plnew->ipl_req; + + pl = ipl_getbyip(req->start, plnew->ipl_ipaddr); + if (pl) { + ipl_update(pl, plnew->ipl_timeout); + if (update_leasefile) + lease_save(pl); + return; + } + /* support for multiple addresses requires the ability to add filters + * to existing chains, or to instantiate address lists via + * virNWFilterInstantiateFilterLate(). Until one of those capabilities + * is added, don't allow a new address when one is already assigned to + * this interface. + */ + if (req->start) + return; /* silently ignore multiple addresses */ + + if (VIR_ALLOC(pl) < 0) { + virReportOOMError(); + return; + } + *pl = *plnew; + + if (req->running && ipl_install(pl) < 0) { + VIR_FREE(pl); + return; + } + ipl_tadd(pl); + nleases++; + if (update_leasefile) + lease_save(pl); +} + +/* + * ipl_tdel - remove an IP lease from a list + */ +static void +ipl_ldel(struct iplease *ipl, struct iplease **start, struct iplease **end) +{ + if (ipl->ipl_prev) + ipl->ipl_prev->ipl_next = ipl->ipl_next; + else + *start = ipl->ipl_next; + if (ipl->ipl_next) + ipl->ipl_next->ipl_prev = ipl->ipl_prev; + else + *end = ipl->ipl_prev; + ipl->ipl_next = ipl->ipl_prev = 0; +} + +/* + * ipl_tdel - remove an IP lease from the timer list + */ +static void +ipl_tdel(struct iplease *ipl) +{ + struct virNWFilterSnoopReq *req = ipl->ipl_req; + + ipl_ldel(ipl, &req->start, &req->end); + ipl->ipl_timeout = 0; +} + +/* + * ipl_del - delete an IP lease + */ +static void +ipl_del(struct virNWFilterSnoopReq *req, uint32_t ipaddr, bool update_leasefile) +{ + struct iplease *ipl; + + ipl = ipl_getbyip(req->start, ipaddr); + if (ipl == NULL) + return; + + ipl_tdel(ipl); + + if (update_leasefile) { + lease_save(ipl); + + /* + * for multiple address support, this needs to remove those rules + * referencing "IP" with ipl's ip value. + */ + if (req->techdriver->applyDHCPOnlyRules(req->ifname, req->macaddr, + NULL, false)) + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "ipl_ldel failed"); + } + VIR_FREE(ipl); + nleases--; +} + +/* + * ipl_update - update the timeout on an IP lease + */ +static void +ipl_update(struct iplease *ipl, uint32_t timeout) +{ + if (timeout < ipl->ipl_timeout) + return; /* no take-backs */ + ipl_tdel(ipl); + ipl->ipl_timeout = timeout; + ipl_tadd(ipl); + return; +} + +/* + * ipl_getbyip - lookup IP lease by IP address + */ +static struct iplease * +ipl_getbyip(struct iplease *start, uint32_t ipaddr) +{ + struct iplease *pl; + + for (pl = start; pl && pl->ipl_ipaddr != ipaddr; pl = pl->ipl_next) + /* empty */ ; + return pl; +} + +/* + * ipl_trun - run the IP lease timeout list + */ +static unsigned int +ipl_trun(struct virNWFilterSnoopReq *req) +{ + uint32_t now; + + now = time(0); + while (req->start && req->start->ipl_timeout <= now) + ipl_del(req, req->start->ipl_ipaddr, 1); + return 0; +} + +typedef unsigned char Eaddr[6]; + +struct eth { + Eaddr eh_dst; + Eaddr eh_src; + unsigned short eh_type; + union { + unsigned char eu_data[0]; + struct vlan_hdr { + unsigned short ev_flags; + unsigned short ev_type; + unsigned char ev_data[0]; + } eu_vlh; + } eth_un; +} ATTRIBUTE_PACKED; + +#define eh_data eth_un.eu_data +#define ehv_data eth_un.eu_vlh.ev_data +#define ehv_type eth_un.eu_vlh.ev_type + +struct dhcp { + unsigned char d_op; + unsigned char d_htype; + unsigned char d_hlen; + unsigned char d_hops; + unsigned int d_xid; + unsigned short d_secs; + unsigned short d_flags; + unsigned int d_ciaddr; + unsigned int d_yiaddr; + unsigned int d_siaddr; + unsigned int d_giaddr; + unsigned char d_chaddr[16]; + char d_sname[64]; + char d_file[128]; + unsigned char d_opts[0]; +}; + +/* DHCP options */ + +#define DHCPO_PAD 0 +#define DHCPO_LEASE 51 /* lease time in secs */ +#define DHCPO_MTYPE 53 /* message type */ +#define DHCPO_END 255 /* end of options */ + +/* DHCP message types */ +#define DHCPDECLINE 4 +#define DHCPACK 5 +#define DHCPRELEASE 7 + +unsigned char dhcp_magic[4] = { 99, 130, 83, 99 }; + +static int +dhcp_getopt(struct dhcp *pd, int len, int *pmtype, int *pleasetime) +{ + int oind, olen; + int oend; + + olen = len - sizeof *pd; + oind = 0; + + if (olen < 4) /* bad magic */ + return -1; + if (memcmp(dhcp_magic, pd->d_opts, sizeof dhcp_magic) != 0) + return -1; /* bad magic */ + oind += sizeof dhcp_magic; + + oend = 0; + + *pmtype = *pleasetime = 0; + + while (oind < olen) { + switch (pd->d_opts[oind]) { + case DHCPO_LEASE: + if (olen - oind < 6) + goto malformed; + if (*pleasetime) + return -1; /* duplicate lease time */ + *pleasetime = + ntohl(*(unsigned int *) (pd->d_opts + oind + 2)); + break; + case DHCPO_MTYPE: + if (olen - oind < 3) + goto malformed; + if (*pmtype) + return -1; /* duplicate message type */ + *pmtype = pd->d_opts[oind + 2]; + break; + case DHCPO_PAD: + oind++; + continue; + + case DHCPO_END: + oend = 1; + break; + default: + if (olen - oind < 2) + goto malformed; + } + if (oend) + break; + oind += pd->d_opts[oind + 1] + 2; + } + return 0; + malformed: + VIR_WARN("got lost in the options!"); + return -1; +} + +static void +dhcpdecode(struct virNWFilterSnoopReq *req, struct eth *pep, int len) +{ + struct iphdr *pip; + struct udphdr *pup; + struct dhcp *pd; + struct iplease ipl; + int mtype, leasetime; + + /* go through the protocol headers */ + switch (ntohs(pep->eh_type)) { + case ETHERTYPE_IP: + pip = (struct iphdr *) pep->eh_data; + len -= offsetof(struct eth, eh_data); + break; + case ETHERTYPE_VLAN: + if (ntohs(pep->ehv_type) != ETHERTYPE_IP) + return; + pip = (struct iphdr *) pep->ehv_data; + len -= offsetof(struct eth, ehv_data); + break; + default: + return; + } + pip = (struct iphdr *) pep->eh_data; + len -= sizeof(*pep); + pup = (struct udphdr *) ((char *) pip + (pip->ihl << 2)); + len -= pip->ihl << 2; + pd = (struct dhcp *) ((char *) pup + sizeof(*pup)); + len -= sizeof(*pup); + if (len < 0) + return; /* dhcpdecode: invalid packet length */ + if (dhcp_getopt(pd, len, &mtype, &leasetime) < 0) + return; + + memset(&ipl, 0, sizeof(ipl)); + ipl.ipl_ipaddr = pd->d_yiaddr; + ipl.ipl_server = pd->d_siaddr; + if (leasetime == ~0) + ipl.ipl_timeout = ~0; + else + ipl.ipl_timeout = time(0) + leasetime; + ipl.ipl_req = req; + + switch (mtype) { + case DHCPACK: + ipl_add(&ipl, 1); + break; + case DHCPDECLINE: + case DHCPRELEASE: + ipl_del(req, ipl.ipl_ipaddr, 1); + break; + default: + break; + } +} + +#define PBUFSIZE 576 /* >= IP/TCP/DHCP headers */ +#define TIMEOUT 30 /* secs */ + +static pcap_t * +dhcpopen(const char *intf) +{ + pcap_t *handle = NULL; + struct bpf_program fp; + char filter[64]; + char pcap_errbuf[PCAP_ERRBUF_SIZE]; + time_t start; + + start = time(0); + while (handle == NULL && time(0) - start < TIMEOUT) + handle = pcap_open_live(intf, PBUFSIZE, 0, POLL_INTERVAL, pcap_errbuf); + + if (handle == NULL) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("pcap_open_live: %s"), pcap_errbuf); + return 0; + } + + sprintf(filter, "port 67 or dst port 68"); + if (pcap_compile(handle, &fp, filter, 1, PCAP_NETMASK_UNKNOWN) != 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("pcap_compile: %s"), pcap_geterr(handle)); + return 0; + } + if (pcap_setfilter(handle, &fp) != 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("pcap_setfilter: %s"), pcap_geterr(handle)); + return 0; + } + pcap_freecode(&fp); + return handle; +} + +static void +snoopReqFree(struct virNWFilterSnoopReq *req) +{ + struct iplease *ipl; + + if (!req) + return; + + /* free all leases */ + for (ipl = req->start; ipl; ipl = req->start) + ipl_del(req, ipl->ipl_ipaddr, 0); + + /* free all req data */ + VIR_FREE(req->ifname); + VIR_FREE(req->linkdev); + VIR_FREE(req->filtername); + virNWFilterHashTableFree(req->vars); + VIR_FREE(req); +} + +static void * +virNWFilterDHCPSnoop(void *req0) +{ + struct virNWFilterSnoopReq *req = req0; + pcap_t *handle; + struct pcap_pkthdr *hdr; + struct eth *packet; + int ifindex, tmp; + int errcount; + + if (pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &tmp) < 0) + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "pthread_setcancelstate " + "failed; ifname \"%s\"", req->ifname ? + req->ifname : "<NULL>"); + if (pthread_setcanceltype(PTHREAD_CANCEL_ASYNCHRONOUS, &tmp) < 0) + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "pthread_setcanceltype " + "failed; ifname \"%s\"", req->ifname ? + req->ifname : "<NULL>"); + handle = dhcpopen(req->ifname); + if (!handle) + return 0; + + req->running++; + + ifindex = if_nametoindex(req->ifname); + + lease_restore(req); + + errcount = 0; + while (1) { + int rv; + + snoop_lock(); + ipl_trun(req); + snoop_unlock(); + + rv = pcap_next_ex(handle, &hdr, (const u_char **)&packet); + + if (rv < 0) { + if (virNetDevValidateConfig(req->ifname, NULL, ifindex) <= 0) + break; + if (++errcount > MAXERRS) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("ifname \"%s\" failing; reopening"), + req->ifname); + pcap_close(handle); + handle = dhcpopen(req->ifname); + if (!handle) + break; + } + continue; + } + errcount = 0; + if (rv) { + snoop_lock(); + dhcpdecode(req, packet, hdr->caplen); + snoop_unlock(); + } + } + req->running = 0; + (void) virHashRemoveEntry(IfnameToKey, req->ifname); + VIR_FREE(req->ifname); + /* if we still have a valid lease, keep the req for restarts */ + if (!req->start || req->start->ipl_timeout < time(0)) + (void) virHashRemoveEntry(SnoopReqs, req->ifkey); + return 0; +} + +static void +ifkeyFormat(char *ifkey, const unsigned char *vmuuid, + unsigned const char *macaddr) +{ + virUUIDFormat(vmuuid, ifkey); + ifkey[VIR_UUID_STRING_BUFLEN-1] = '-'; + virMacAddrFormat(macaddr, ifkey + VIR_UUID_STRING_BUFLEN); +} + +int +virNWFilterDHCPSnoopReq(virNWFilterTechDriverPtr techdriver, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *vmuuid, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver) +{ + struct virNWFilterSnoopReq *req; + bool isnewreq; + char ifkey[VIR_IFKEY_LEN]; + + ifkeyFormat(ifkey, vmuuid, macaddr); + snoop_lock(); + req = virHashLookup(SnoopReqs, ifkey); + isnewreq = req == NULL; + if (!isnewreq) { + if (req->running) { + snoop_unlock(); + return 0; + } + } else { + req = newreq(ifkey); + if (!req) { + snoop_unlock(); + return 1; + } + } + + req->techdriver = techdriver; + req->ifindex = if_nametoindex(ifname); + req->linkdev = linkdev ? strdup(linkdev) : NULL; + req->nettype = nettype; + req->ifname = strdup(ifname); + memcpy(req->macaddr, macaddr, sizeof(req->macaddr)); + req->filtername = strdup(filtername); + if (req->filtername == NULL) { + snoop_unlock(); + snoopReqFree(req); + virReportOOMError(); + return 1; + } + + if (techdriver->applyDHCPOnlyRules(req->ifname, req->macaddr, NULL, + false)) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "applyDHCPOnlyRules " + "failed - spoofing not protected!"); + } + + req->vars = virNWFilterHashTableCreate(0); + if (!req->vars) { + snoop_unlock(); + snoopReqFree(req); + virReportOOMError(); + return 1; + } + if (virNWFilterHashTablePutAll(filterparams, req->vars)) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterDHCPSnoopReq: can't copy variables" + " on if %s"), ifkey); + snoop_unlock(); + snoopReqFree(req); + return 1; + } + req->driver = driver; + + if (virHashAddEntry(IfnameToKey, ifname, req->ifkey)) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterDHCPSnoopReq ifname map failed" + " on interface \"%s\" key \"%s\""), ifname, + ifkey); + snoop_unlock(); + snoopReqFree(req); + return 1; + } + if (isnewreq && virHashAddEntry(SnoopReqs, ifkey, req)) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterDHCPSnoopReq req add failed on" + " interface \"%s\" ifkey \"%s\""), ifname, + ifkey); + (void) virHashRemoveEntry(IfnameToKey, ifname); + snoop_unlock(); + snoopReqFree(req); + return 1; + } + snoop_unlock(); + if (pthread_create(&req->thread, NULL, virNWFilterDHCPSnoop, req) != 0) { + snoop_lock(); + (void) virHashRemoveEntry(IfnameToKey, ifname); + (void) virHashRemoveEntry(SnoopReqs, ifkey); + snoop_unlock(); + snoopReqFree(req); + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterDHCPSnoopReq pthread_create failed" + " on interface \"%s\""), ifname); + return 1; + } + return 0; +} + +/* + * freeReq - hash table free function to kill a request + */ +static void +freeReq(void *req0, const void *name ATTRIBUTE_UNUSED) +{ + struct virNWFilterSnoopReq *req = (struct virNWFilterSnoopReq *) req0; + + if (!req) + return; + + if (req->running) + (void) pthread_cancel(req->thread); + snoopReqFree(req); +} + +static void +lease_close(void) +{ + VIR_FORCE_CLOSE(lease_fd); +} + +static void +lease_open(void) +{ + lease_close(); + + lease_fd = open(LEASEFILE, O_CREAT|O_RDWR|O_APPEND, 0644); +} + +int +virNWFilterDHCPSnoopInit(void) +{ + if (SnoopReqs) + return 0; + + if (pthread_mutex_init(&SnoopLock, 0) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("pthread_mutex_init: %s"), strerror(errno)); + return -1; + } + snoop_lock(); + IfnameToKey = virHashCreate(0, NULL); + SnoopReqs = virHashCreate(0, freeReq); + if (!SnoopReqs) { + snoop_unlock(); + virReportOOMError(); + return -1; + } + lease_load(); + lease_open(); + + snoop_unlock(); + return 0; +} + +void +virNWFilterDHCPSnoopEnd(const char *ifname) +{ + char *ifkey = NULL; + + snoop_lock(); + if (!SnoopReqs) { + snoop_unlock(); + return; + } + + if (ifname) { + ifkey = (char *)virHashLookup(IfnameToKey, ifname); + (void) virHashRemoveEntry(IfnameToKey, ifname); + if (!ifkey) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("ifname \"%s\" not in key map"), ifname); + snoop_unlock(); + return; + } + } + + if (ifkey) { + struct virNWFilterSnoopReq *req; + + req = virHashLookup(SnoopReqs, ifkey); + if (!req) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("ifkey \"%s\" has no req"), ifkey); + snoop_unlock(); + return; + } + if (!req->start || req->start->ipl_timeout < time(0)) { + (void) virHashRemoveEntry(SnoopReqs, req->ifkey); + snoop_unlock(); + return; + } + /* keep valid lease req; drop interface association */ + req->running = 0; + (void) pthread_cancel(req->thread); + VIR_FREE(req->ifname); + } else { /* free all of them */ + lease_close(); + virHashFree(IfnameToKey); + virHashFree(SnoopReqs); + IfnameToKey = virHashCreate(0, 0); + if (!IfnameToKey) { + snoop_unlock(); + virReportOOMError(); + return; + } + SnoopReqs = virHashCreate(0, freeReq); + if (!SnoopReqs) { + virHashFree(IfnameToKey); + snoop_unlock(); + virReportOOMError(); + return; + } + lease_load(); + } + snoop_unlock(); +} + +static int +lease_write(int lfd, const char *ifkey, struct iplease *ipl) +{ + char lbuf[256],ipstr[16],dhcpstr[16]; + + if (inet_ntop(AF_INET, &ipl->ipl_ipaddr, ipstr, sizeof ipstr) == 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("inet_ntop(0x%08X) failed"), ipl->ipl_ipaddr); + return -1; + } + if (inet_ntop(AF_INET, &ipl->ipl_server, dhcpstr, sizeof dhcpstr) == 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("inet_ntop(0x%08X) failed"), ipl->ipl_server); + return -1; + } + /* time intf ip dhcpserver */ + snprintf(lbuf, sizeof(lbuf), "%u %s %s %s\n", ipl->ipl_timeout, + ifkey, ipstr, dhcpstr); + if (write(lfd, lbuf, strlen(lbuf)) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("lease file write failed: %s"), + strerror(errno)); + return -1; + } + (void) fsync(lfd); + return 0; +} + +static void +lease_save(struct iplease *ipl) +{ + struct virNWFilterSnoopReq *req = ipl->ipl_req; + + if (lease_fd < 0) + lease_open(); + if (lease_write(lease_fd, req->ifkey, ipl) < 0) + return; + /* keep dead leases at < ~95% of file size */ + if (++wleases >= nleases*20) + lease_load(); /* load & refresh lease file */ +} + +static struct virNWFilterSnoopReq * +newreq(const char *ifkey) +{ + struct virNWFilterSnoopReq *req; + + if (VIR_ALLOC(req) < 0) { + virReportOOMError(); + return NULL; + } + strncpy(req->ifkey, ifkey, sizeof req->ifkey); + + return req; +} + +static void +SaveSnoopReqIter(void *payload, + const void *name ATTRIBUTE_UNUSED, + void *data) +{ + struct virNWFilterSnoopReq *req = payload; + int tfd = (int)data; + struct iplease *ipl; + + /* clean up orphaned, expired leases */ + if (!req->running) { + uint32_t now; + + now = time(0); + for (ipl = req->start; ipl; ipl = ipl->ipl_next) + if (ipl->ipl_timeout < now) + ipl_del(req, ipl->ipl_ipaddr , 0); + if (!req->start) { + snoopReqFree(req); + return; + } + } + for (ipl = req->start; ipl; ipl = ipl->ipl_next) + (void) lease_write(tfd, req->ifkey, ipl); +} + +static void +lease_refresh(void) +{ + int tfd; + + (void) unlink(TMPLEASEFILE); + /* lease file loaded, delete old one */ + tfd = open(TMPLEASEFILE, O_CREAT|O_RDWR|O_TRUNC|O_EXCL, 0644); + if (tfd < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("open(\"%s\"): %s"), + TMPLEASEFILE, strerror(errno)); + return; + } + if (SnoopReqs) + virHashForEach(SnoopReqs, SaveSnoopReqIter, (void *)tfd); + (void) close(tfd); + if (rename(TMPLEASEFILE, LEASEFILE) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("rename(\"%s\", \"%s\"): %s"), + TMPLEASEFILE, LEASEFILE, strerror(errno)); + (void) unlink(TMPLEASEFILE); + } + wleases = 0; + lease_open(); +} + + +static void +lease_load(void) +{ + char line[256], ifkey[VIR_IFKEY_LEN], ipstr[16], srvstr[16]; + struct iplease ipl; + struct virNWFilterSnoopReq *req; + time_t now; + FILE *fp; + int ln = 0; + + fp = fopen(LEASEFILE, "r"); + time(&now); + while (fp && fgets(line, sizeof(line), fp)) { + if (line[strlen(line)-1] != '\n') { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("lease_load lease file line %d corrupt"), + ln); + break; + } + ln++; + /* key len 55 = "VMUUID"+'-'+"MAC" */ + if (sscanf(line, "%u %55s %16s %16s", &ipl.ipl_timeout, + ifkey, ipstr, srvstr) < 4) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("lease_load lease file line %d corrupt"), + ln); + break;; + } + if (ipl.ipl_timeout && ipl.ipl_timeout < now) + continue; + req = virHashLookup(SnoopReqs, ifkey); + if (!req) { + req = newreq(ifkey); + if (!req) + break; + if (virHashAddEntry(SnoopReqs, ifkey, req)) { + snoopReqFree(req); + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("lease_load req add failed on " + "interface \"%s\""), ifkey); + continue; + } + } + + if (inet_pton(AF_INET, ipstr, &ipl.ipl_ipaddr) <= 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("line %d corrupt ipaddr \"%s\""), + ln, ipstr); + continue; + } + (void) inet_pton(AF_INET, srvstr, &ipl.ipl_server); + ipl.ipl_req = req; + + if (ipl.ipl_timeout) + ipl_add(&ipl, 0); + else + ipl_del(req, ipl.ipl_ipaddr, 0); + } + if (fp != NULL) + (void) fclose(fp); + lease_refresh(); +} + +static void +lease_restore(struct virNWFilterSnoopReq *req) +{ + struct iplease *ipl; + + for (ipl=req->start; ipl; ipl=ipl->ipl_next) + (void) ipl_install(ipl); +} + +#else /* HAVE_LIBPCAP */ +int +virNWFilterDHCPSnoopInit(void) +{ + return -1; +} + +void +virNWFilterDHCPSnoopEnd(const char *ifname ATTRIBUTE_UNUSED) +{ + return; +} + +int +virNWFilterDHCPSnoopReq(virNWFilterTechDriverPtr techdriver ATTRIBUTE_UNUSED, + const char *ifname ATTRIBUTE_UNUSED, + const char *linkdev ATTRIBUTE_UNUSED, + enum virDomainNetType nettype ATTRIBUTE_UNUSED, + char *vmuuid ATTRIBUTE_UNUSED, + const unsigned char *macaddr ATTRIBUTE_UNUSED, + const char *filtername ATTRIBUTE_UNUSED, + virNWFilterHashTablePtr filterparams ATTRIBUTE_UNUSED, + virNWFilterDriverStatePtr driver ATTRIBUTE_UNUSED) +{ + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("libvirt was not compiled " + "with libpcap and \"ip_learning='dhcp'\" requires" + " it.")); + return 1; +} +#endif /* HAVE_LIBPCAP */ diff --git a/src/nwfilter/nwfilter_dhcpsnoop.h b/src/nwfilter/nwfilter_dhcpsnoop.h new file mode 100644 index 0000000..25500e2 --- /dev/null +++ b/src/nwfilter/nwfilter_dhcpsnoop.h @@ -0,0 +1,38 @@ +/* + * nwfilter_dhcpsnoop.h: support DHCP snooping for a VM on an interface + * + * Copyright (C) 2010 IBM Corp. + * Copyright (C) 2010 David L Stevens + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: David L Stevens <dlstevens(a)us.ibm.com> + */ + +#ifndef __NWFILTER_DHCPSNOOP_H +#define __NWFILTER_DHCPSNOOP_H + +int virNWFilterDHCPSnoopInit(void); +int virNWFilterDHCPSnoopReq(virNWFilterTechDriverPtr techdriver, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *vmuuid, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver); +void virNWFilterDHCPSnoopEnd(const char *ifname); +#endif /* __NWFILTER_DHCPSNOOP_H */ diff --git a/src/nwfilter/nwfilter_driver.c b/src/nwfilter/nwfilter_driver.c index ffb4b5d..d014a19 100644 --- a/src/nwfilter/nwfilter_driver.c +++ b/src/nwfilter/nwfilter_driver.c @@ -39,6 +39,7 @@ #include "nwfilter_gentech_driver.h" #include "configmake.h" +#include "nwfilter_dhcpsnoop.h" #include "nwfilter_learnipaddr.h" #define VIR_FROM_THIS VIR_FROM_NWFILTER @@ -66,6 +67,8 @@ static int nwfilterDriverStartup(int privileged) { char *base = NULL; + if (virNWFilterDHCPSnoopInit() < 0) + return -1; if (virNWFilterLearnInit() < 0) return -1; @@ -127,6 +130,7 @@ alloc_err_exit: conf_init_err: virNWFilterTechDriversShutdown(); + virNWFilterDHCPSnoopEnd(0); virNWFilterLearnShutdown(); return -1; @@ -149,6 +153,7 @@ nwfilterDriverReload(void) { conn = virConnectOpen("qemu:///system"); if (conn) { + virNWFilterDHCPSnoopEnd(0); /* shut down all threads -- they will be restarted if necessary */ virNWFilterLearnThreadsTerminate(true); @@ -203,6 +208,7 @@ nwfilterDriverShutdown(void) { virNWFilterConfLayerShutdown(); virNWFilterTechDriversShutdown(); + virNWFilterDHCPSnoopEnd(0); virNWFilterLearnShutdown(); nwfilterDriverLock(driverState); diff --git a/src/nwfilter/nwfilter_gentech_driver.c b/src/nwfilter/nwfilter_gentech_driver.c index fc71e7b..245adb0 100644 --- a/src/nwfilter/nwfilter_gentech_driver.c +++ b/src/nwfilter/nwfilter_gentech_driver.c @@ -32,6 +32,7 @@ #include "virterror_internal.h" #include "nwfilter_gentech_driver.h" #include "nwfilter_ebiptables_driver.h" +#include "nwfilter_dhcpsnoop.h" #include "nwfilter_learnipaddr.h" #include "virnetdev.h" #include "datatypes.h" @@ -42,6 +43,8 @@ #define NWFILTER_STD_VAR_MAC "MAC" #define NWFILTER_STD_VAR_IP "IP" +#define NWFILTER_DFLT_LEARN "any" + static int _virNWFilterTeardownFilter(const char *ifname); @@ -662,6 +665,9 @@ virNWFilterInstantiate(const unsigned char *vmuuid ATTRIBUTE_UNUSED, void **ptrs = NULL; int instantiate = 1; char *buf; + virNWFilterVarValuePtr lv; + const char *learning; + bool reportIP = false; virNWFilterHashTablePtr missing_vars = virNWFilterHashTableCreate(0); if (!missing_vars) { @@ -678,22 +684,47 @@ virNWFilterInstantiate(const unsigned char *vmuuid ATTRIBUTE_UNUSED, if (rc < 0) goto err_exit; + lv = virHashLookup(vars->hashTable, "ip_learning"); + if (lv && lv->valType == NWFILTER_VALUE_TYPE_SIMPLE) + learning = lv->u.simple.value; + else + learning = NULL; + + if (learning == NULL) + learning = NWFILTER_DFLT_LEARN; + if (virHashSize(missing_vars->hashTable) == 1) { if (virHashLookup(missing_vars->hashTable, NWFILTER_STD_VAR_IP) != NULL) { - if (virNWFilterLookupLearnReq(ifindex) == NULL) { - rc = virNWFilterLearnIPAddress(techdriver, - ifname, - ifindex, - linkdev, - nettype, macaddr, - filter->name, - vars, driver, - DETECT_DHCP|DETECT_STATIC); + if (c_strcasecmp(learning, "none") == 0) { /* no learning */ + reportIP = true; + goto err_unresolvable_vars; } - goto err_exit; - } - goto err_unresolvable_vars; + if (c_strcasecmp(learning, "dhcp") == 0) { + rc = virNWFilterDHCPSnoopReq(techdriver, ifname, linkdev, + nettype, vmuuid, macaddr, + filter->name, vars, driver); + goto err_exit; + } else if (c_strcasecmp(learning, "any") == 0) { + if (virNWFilterLookupLearnReq(ifindex) == NULL) { + rc = virNWFilterLearnIPAddress(techdriver, + ifname, + ifindex, + linkdev, + nettype, macaddr, + filter->name, + vars, driver, + DETECT_DHCP|DETECT_STATIC); + } + goto err_exit; + } else { + rc = 1; + virNWFilterReportError(VIR_ERR_PARSE_FAILED, _("filter '%s' " + "learning value '%s' invalid."), + filter->name, learning); + } + } else + goto err_unresolvable_vars; } else if (virHashSize(missing_vars->hashTable) > 1) { goto err_unresolvable_vars; } else if (!forceWithPendingReq && @@ -761,7 +792,7 @@ err_exit: err_unresolvable_vars: - buf = virNWFilterPrintVars(missing_vars->hashTable, ", ", false, false); + buf = virNWFilterPrintVars(missing_vars->hashTable, ", ", false, reportIP); if (buf) { virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("Cannot instantiate filter due to unresolvable " @@ -1092,6 +1123,8 @@ _virNWFilterTeardownFilter(const char *ifname) return -1; } + virNWFilterDHCPSnoopEnd(ifname); + virNWFilterTerminateLearnReq(ifname); if (virNWFilterLockIface(ifname) < 0) -- 1.7.6.5

2 1

[libvirt] [PATCH] Leave all child processes running when stopping systemd service
by Daniel P. Berrange 22 Mar '12

22 Mar '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> Currently the libvirt.service unit file for systemd does not specify any kill mode. So systemd kills off every process inside its cgroup. ie all dnsmasq processes, all virtual machines. This obviously not what we want. Set KillMode=process so that it only kills the top level process of libvirtd * daemon/libvirtd.service.in: Add KillMode=process Reported-By: Mark McLoughlin <markmc(a)redhat.com> Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- daemon/libvirtd.service.in | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/daemon/libvirtd.service.in b/daemon/libvirtd.service.in index 8f2458a..d6e46ab 100644 --- a/daemon/libvirtd.service.in +++ b/daemon/libvirtd.service.in @@ -15,6 +15,7 @@ Before=libvirt-guests.service EnvironmentFile=-/etc/sysconfig/libvirtd ExecStart=@sbindir@/libvirtd $LIBVIRTD_ARGS ExecReload=/bin/kill -HUP $MAINPID +KillMode=process # Override the maximum number of opened files #LimitNOFILE=2048 -- 1.7.7.6

2 5

[libvirt] [test-API PATCH] libs: Add flags for streams and the console
by Peter Krempa 22 Mar '12

22 Mar '12

Add the local copy of the flags. --- lib/connectAPI.py | 2 ++ lib/domainAPI.py | 3 +++ 2 files changed, 5 insertions(+), 0 deletions(-) diff --git a/lib/connectAPI.py b/lib/connectAPI.py index dab5e7d..2723fc8 100644 --- a/lib/connectAPI.py +++ b/lib/connectAPI.py @@ -350,3 +350,5 @@ class ConnectAPI(object): VIR_CRED_AUTHNAME = libvirt.VIR_CRED_AUTHNAME VIR_CRED_PASSPHRASE = libvirt.VIR_CRED_PASSPHRASE +# virStreamFlags +VIR_STREAM_NONBLOCK = 1 diff --git a/lib/domainAPI.py b/lib/domainAPI.py index bc0069b..43565c2 100644 --- a/lib/domainAPI.py +++ b/lib/domainAPI.py @@ -912,3 +912,6 @@ VIR_DOMAIN_AFFECT_CURRENT = 0 VIR_DOMAIN_AFFECT_LIVE = 1 VIR_DOMAIN_AFFECT_CONFIG = 2 +# virDomainConsoleFlags +VIR_DOMAIN_CONSOLE_FORCE = 1 +VIR_DOMAIN_CONSOLE_SAFE = 2 -- 1.7.3.4

2 1

[libvirt] [PATCH] Use virDomainFindbyID and pass id instead of a pointer to lxcMontitorEvent.
by Thomas Hunger 22 Mar '12

22 Mar '12

This fixes a race condition when VIR_EVENT_HANDLE_HANGUP is triggered during lxcDomainDestroyFlags: lxcMonitorEvent tries to acquire the driver lock held by lxcDomainDestroyFlags and blocks. Meanwhile lxcDomainDestroyFlags will free the "vm" structure and release the driver lock. lxcMonitorEvent unblocks and operates on an invalid "vm" pointer. By using virDomainFindbyID lxcMonitorEvent avoids using an invalid vm pointer. --- src/lxc/lxc_driver.c | 13 +++++++++---- 1 files changed, 9 insertions(+), 4 deletions(-) diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index 3af8084..c55e164 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -1523,12 +1523,17 @@ static void lxcMonitorEvent(int watch, void *data) { lxc_driver_t *driver = lxc_driver; - virDomainObjPtr vm = data; + int id = (int)data; + virDomainObjPtr vm = NULL; virDomainEventPtr event = NULL; lxcDomainObjPrivatePtr priv; lxcDriverLock(driver); - virDomainObjLock(vm); + vm = virDomainFindByID(&driver->domains, id); + if (vm == NULL) { + lxcDriverUnlock(driver); + goto cleanup; + } lxcDriverUnlock(driver); priv = vm->privateData; @@ -1950,7 +1955,7 @@ static int lxcVmStart(virConnectPtr conn, priv->monitor, VIR_EVENT_HANDLE_ERROR | VIR_EVENT_HANDLE_HANGUP, lxcMonitorEvent, - vm, NULL)) < 0) { + (void*)vm->def->id, NULL)) < 0) { goto error; } @@ -2513,7 +2518,7 @@ lxcReconnectVM(void *payload, const void *name ATTRIBUTE_UNUSED, void *opaque) priv->monitor, VIR_EVENT_HANDLE_ERROR | VIR_EVENT_HANDLE_HANGUP, lxcMonitorEvent, - vm, NULL)) < 0) + (void*)vm->def->id, NULL)) < 0) goto error; if (virSecurityManagerReserveLabel(driver->securityManager, -- 1.7.2.5

1 0

[libvirt] Does libvirt check MCS labels during hot-add disk image ?
by Onkar N Mahajan 22 Mar '12

22 Mar '12

Libvirt doesn't care about security during hot add disk images. It even accepts addition of disk images of other guest running on the host. Steps followed to create this scenario : Started two VMs with following security configurations: vm1: <seclabel type='dynamic' model='selinux' relabel='yes'> <label>system_u:system_r:svirt_t:s0:c219,c564</label> <imagelabel>system_u:object_r:svirt_image_t:s0:c219,c564</imagelabel> </seclabel> vm2 : <seclabel type='dynamic' model='selinux' relabel='yes'> <label>system_u:system_r:svirt_t:s0:c122,c658</label> <imagelabel>system_u:object_r:svirt_image_t:s0:c122,c658</imagelabel> </seclabel> # virsh list --all Id Name State ---------------------------------- 28 vm1 running 29 vm2 running # ls -lZ /var/lib/libvirt/images/ -rw-------. qemu qemu system_u:object_r:svirt_image_t:s0:c219,c564 vm1.img -rw-------. qemu qemu system_u:object_r:svirt_image_t:s0:c122,c658 vm2.img # ps auxZ | grep qemu-kvm | grep -v grep system_u:system_r:svirt_t:s0:c219,c564 qemu 15744 47.2 5.8 2757852 472224 ? Sl 11:47 0:18 /usr/libexec/qemu-kvm -S -M rhel6.2.0 -enable-kvm -m 2048 -smp 4,sockets=4,cores=1,threads=1 -name vm1 -uuid d3d3a3ee-4edf-a3d3-8dab-a77740266270 -nodefconfig -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/vm1.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc -no-shutdown -drive file=/var/lib/libvirt/images/vm1.img,if=none,id=drive-virtio-disk0,format=raw,cache=none -device virtio-blk-pci,bus=pci.0,addr=0x5,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1 -drive if=none,media=cdrom,id=drive-ide0-1-0,readonly=on,format=raw -device ide-drive,bus=ide.1,unit=0,drive=drive-ide0-1-0,id=ide0-1-0 -netdev tap,fd=26,id=hostnet0,vhost=on,vhostfd=27 -device virtio-net-pci,netdev=hostnet0,id=net0,mac=52:54:00:a1:29:45,bus=pci.0,addr=0x3 -chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 -usb -device usb-tablet,id=input0 -vnc 127.0.0.1:0 -vga cirrus -device intel-hda,id=sound0,bus=pci.0,addr=0x4 -device hda-duplex,id=sound0-codec0,bus=sound0.0,cad=0 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x6 system_u:system_r:svirt_t:s0:c122,c658 qemu 15780 58.4 6.5 3063496 524048 ? Sl 11:47 0:20 /usr/libexec/qemu-kvm -S -M rhel6.2.0 -enable-kvm -m 2048 -smp 4,sockets=4,cores=1,threads=1 -name vm2 -uuid b07607f8-2d03-cc1f-272b-22863667d1a4 -nodefconfig -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/vm2.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc -no-shutdown -drive file=/var/lib/libvirt/images/vm2.img,if=none,id=drive-virtio-disk0,format=raw,cache=none -device virtio-blk-pci,bus=pci.0,addr=0x5,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1 -drive if=none,media=cdrom,id=drive-ide0-1-0,readonly=on,format=raw -device ide-drive,bus=ide.1,unit=0,drive=drive-ide0-1-0,id=ide0-1-0 -netdev tap,fd=28,id=hostnet0,vhost=on,vhostfd=29 -device virtio-net-pci,netdev=hostnet0,id=net0,mac=52:54:00:e0:76:d1,bus=pci.0,addr=0x3 -chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 -usb -device usb-tablet,id=input0 -vnc 127.0.0.1:1 -vga cirrus -device intel-hda,id=sound0,bus=pci.0,addr=0x4 -device hda-duplex,id=sound0-codec0,bus=sound0.0,cad=0 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x6 Now, try to add vm1's disk image into vm2 - this must not be allowed - since for virtualized guest images. Only svirt_t processes with the same MCS fields can read/write these images. i.e., for vm2 to access vm1's disk image it's MCS label must be 's0:c660,c689'. Hot addition of vm1's image i.e., /var/lib/libvirt/images/vm1.img is successful ( which must not be allowed ) moreover , MCS label for vm1's image has changed to that of vm2 # ls -lZ /var/lib/libvirt/images/ -rw-------. qemu qemu system_u:object_r:svirt_image_t:s0:c122,c658 vm1.img -rw-------. qemu qemu system_u:object_r:svirt_image_t:s0:c122,c658 vm2.img Trying to read/write on vm1 will generate AVC messages Seen following message in /var/log/audit/audit.log : type=VIRT_RESOURCE msg=audit(1332310867.790:10312): user pid=5114 uid=0 auid=0 ses=3 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=attach vm="vm2" uuid=b07607f8-2d03-cc1f-272b-22863667d1a4 old-disk="?" new-disk="/var/lib/libvirt/images/vm1.img": exe=2F7573722F7362696E2F6C69627669727464202864656C6574656429 hostname=? addr=? terminal=? res=success' type=AVC msg=audit(1332310963.333:10313): avc: denied { write } for pid=16241 comm="qemu-kvm" path="/var/lib/libvirt/images/vm1.img" dev=sda1 ino=6431944 scontext=system_u:system_r:svirt_t:s0:c219,c564 tcontext=system_u:object_r:svirt_image_t:s0:c122,c658 tclass=file type=SYSCALL msg=audit(1332310963.333:10313): arch=c000003e syscall=18 success=no exit=-13 a0=9 a1=7fd3bc59d000 a2=1000 a3=10891b000 items=0 ppid=1 pid=16241 auid=0 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=3 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c219,c564 key=(null) type=AVC msg=audit(1332310963.337:10314): avc: denied { read } for pid=16241 comm="qemu-kvm" path="/var/lib/libvirt/images/vm1.img" dev=sda1 ino=6431944 scontext=system_u:system_r:svirt_t:s0:c219,c564 tcontext=system_u:object_r:svirt_image_t:s0:c122,c658 tclass=file type=SYSCALL msg=audit(1332310963.337:10314): arch=c000003e syscall=295 success=no exit=-13 a0=9 a1=2d24368 a2=4 a3=88664000 items=0 ppid=1 pid=16241 auid=0 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=3 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c219,c564 key=(null) type=AVC msg=audit(1332310963.338:10315): avc: denied { read } for pid=16241 comm="qemu-kvm" path="/var/lib/libvirt/images/vm1.img" dev=sda1 ino=6431944 scontext=system_u:system_r:svirt_t:s0:c219,c564 tcontext=system_u:object_r:svirt_image_t:s0:c122,c658 tclass=file type=SYSCALL msg=audit(1332310963.338:10315): arch=c000003e syscall=17 success=no exit=-13 a0=9 a1=7fd3bce4f000 a2=1000 a3=88664000 items=0 ppid=1 pid=16241 auid=0 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=3 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c219,c564 key=(null) type=AVC msg=audit(1332310967.954:10316): avc: denied { read } for pid=16241 comm="qemu-kvm" path="/var/lib/libvirt/images/vm1.img" dev=sda1 ino=6431944 scontext=system_u:system_r:svirt_t:s0:c219,c564 tcontext=system_u:object_r:svirt_image_t:s0:c122,c658 tclass=file type=SYSCALL msg=audit(1332310967.954:10316): arch=c000003e syscall=295 success=no exit=-13 a0=9 a1=2d43768 a2=3 a3=1907c8000 items=0 ppid=1 pid=16241 auid=0 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=3 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c219,c564 key=(null) type=AVC msg=audit(1332310967.955:10317): avc: denied { read } for pid=16241 comm="qemu-kvm" path="/var/lib/libvirt/images/vm1.img" dev=sda1 ino=6431944 scontext=system_u:system_r:svirt_t:s0:c219,c564 tcontext=system_u:object_r:svirt_image_t:s0:c122,c658 tclass=file type=SYSCALL msg=audit(1332310967.955:10317): arch=c000003e syscall=17 success=no exit=-13 a0=9 a1=7fd3bac95000 a2=1000 a3=1907c8000 items=0 ppid=1 pid=16241 auid=0 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=3 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c219,c564 key=(null) type=AVC msg=audit(1332310968.594:10318): avc: denied { write } for pid=16241 comm="qemu-kvm" path="/var/lib/libvirt/images/vm1.img" dev=sda1 ino=6431944 scontext=system_u:system_r:svirt_t:s0:c219,c564 tcontext=system_u:object_r:svirt_image_t:s0:c122,c658 tclass=file type=SYSCALL msg=audit(1332310968.594:10318): arch=c000003e syscall=18 success=no exit=-13 a0=9 a1=7fd3bded9000 a2=1000 a3=2c3f000 items=0 ppid=1 pid=16241 auid=0 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=3 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c219,c564 key=(null) type=AVC msg=audit(1332310968.594:10319): avc: denied { write } for pid=16241 comm="qemu-kvm" path="/var/lib/libvirt/images/vm1.img" dev=sda1 ino=6431944 scontext=system_u:system_r:svirt_t:s0:c219,c564 tcontext=system_u:object_r:svirt_image_t:s0:c122,c658 tclass=file type=SYSCALL msg=audit(1332310968.594:10319): arch=c000003e syscall=18 success=no exit=-13 a0=9 a1=7fd3b7947000 a2=1000 a3=9db2d000 items=0 ppid=1 pid=16241 auid=0 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=3 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c219,c564 key=(null) type=AVC msg=audit(1332310968.594:10320): avc: denied { write } for pid=16241 comm="qemu-kvm" path="/var/lib/libvirt/images/vm1.img" dev=sda1 ino=6431944 scontext=system_u:system_r:svirt_t:s0:c219,c564 tcontext=system_u:object_r:svirt_image_t:s0:c122,c658 tclass=file type=SYSCALL msg=audit(1332310968.594:10320): arch=c000003e syscall=296 success=no exit=-13 a0=9 a1=2d6c0f8 a2=b a3=18851e000 items=0 ppid=1 pid=16241 auid=0 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=3 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c219,c564 key=(null) type=AVC msg=audit(1332310968.598:10321): avc: denied { write } for pid=16241 comm="qemu-kvm" path="/var/lib/libvirt/images/vm1.img" dev=sda1 ino=6431944 scontext=system_u:system_r:svirt_t:s0:c219,c564 tcontext=system_u:object_r:svirt_image_t:s0:c122,c658 tclass=file type=SYSCALL msg=audit(1332310968.598:10321): arch=c000003e syscall=18 success=no exit=-13 a0=9 a1=7fd383b0f000 a2=1000 a3=18842e000 items=0 ppid=1 pid=16241 auid=0 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=3 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c219,c564 key=(null) restricting vm1 read/write it's own image. Changing seclabels with virsh/virt-manager is not supported so defined a new XML with <seclabel type='dynamic' model='selinux' relabel='no'> <label>system_u:system_r:svirt_t:s0:c110,c401</label> <imagelabel>system_u:object_r:svirt_image_t:s0:c110,c401</imagelabel> </seclabel> but when I try to define it , gives me error : # virsh define vm3.xml error: Failed to define domain from vm3.xml error: unsupported configuration: dynamic label type must use resource relabeling looks like it's not possible to assign relabel='no' with dynamic labelling. libvirt/src/conf/domain_conf.c : if (def->type == VIR_DOMAIN_SECLABEL_DYNAMIC && def->norelabel) { virDomainReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("dynamic label type must use resource relabeling")); goto error; } -- Onkar N Mahajan System Software Engineer, IBM Linux Technology Center, Bangalore,India

2 1

[libvirt] [test-API PATCH 0/7] Multiple fixes and improvements series
by Peter Krempa 22 Mar '12

22 Mar '12

This is a set of more or less independent fixes and improvements to the test API. I ran across these while trying to write a basic test case as a "Hello world!" to the test-API. Improvements are in fields of cross-distro compatibility, broken API's and typos and usability. Peter Krempa (7): utils: Make ipget.sh more portable lib: fix streamAPI class domainAPI: Add wrapper method to work with domain's console connections repos/domain/create.py: Fix typo in path to python executable utils: Allow suffixes in path to the main checkout folder parser: Be more specific on mistakes in case files domain/[start|destroy]: Add a optional noping flag to skip the ping test exception.py | 10 +++++++++ lib/domainAPI.py | 9 ++++++++ lib/streamAPI.py | 52 +++++++++++++++++++++++----------------------- proxy.py | 4 +++ repos/domain/create.py | 2 +- repos/domain/destroy.py | 50 +++++++++++++++++++++++++------------------- repos/domain/start.py | 50 +++++++++++++++++++++----------------------- utils/Python/utils.py | 2 +- utils/ipget.sh | 4 +- 9 files changed, 105 insertions(+), 78 deletions(-) -- 1.7.3.4

5 26

[libvirt] [PATCHv2] python: Avoid memory leaks on libvirt_virNodeGetCPUStats
by Alex Jia 22 Mar '12

22 Mar '12

Detected by valgrind. Leaks are introduced in commit 4955602. * python/libvirt-override.c (libvirt_virNodeGetCPUStats): fix memory leaks and improve codes return value. For details, please see the following link: RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=770943 Signed-off-by: Alex Jia <ajia(a)redhat.com> --- python/libvirt-override.c | 36 ++++++++++++++++++++++++++---------- 1 files changed, 26 insertions(+), 10 deletions(-) diff --git a/python/libvirt-override.c b/python/libvirt-override.c index 8ed9f73..22ee975 100644 --- a/python/libvirt-override.c +++ b/python/libvirt-override.c @@ -2503,7 +2503,9 @@ libvirt_virNodeGetCellsFreeMemory(PyObject *self ATTRIBUTE_UNUSED, PyObject *arg static PyObject * libvirt_virNodeGetCPUStats(PyObject *self ATTRIBUTE_UNUSED, PyObject *args) { - PyObject *ret; + PyObject *ret = NULL; + PyObject *key = NULL; + PyObject *val = NULL; PyObject *pyobj_conn; virConnectPtr conn; unsigned int flags; @@ -2512,7 +2514,7 @@ libvirt_virNodeGetCPUStats(PyObject *self ATTRIBUTE_UNUSED, PyObject *args) virNodeCPUStatsPtr stats = NULL; if (!PyArg_ParseTuple(args, (char *)"Oii:virNodeGetCPUStats", &pyobj_conn, &cpuNum, &flags)) - return(NULL); + return ret; conn = (virConnectPtr)(PyvirConnect_Get(pyobj_conn)); LIBVIRT_BEGIN_ALLOW_THREADS; @@ -2523,7 +2525,7 @@ libvirt_virNodeGetCPUStats(PyObject *self ATTRIBUTE_UNUSED, PyObject *args) if (nparams) { if (VIR_ALLOC_N(stats, nparams) < 0) - return VIR_PY_NONE; + return PyErr_NoMemory(); LIBVIRT_BEGIN_ALLOW_THREADS; c_retval = virNodeGetCPUStats(conn, cpuNum, stats, &nparams, flags); @@ -2533,18 +2535,32 @@ libvirt_virNodeGetCPUStats(PyObject *self ATTRIBUTE_UNUSED, PyObject *args) return VIR_PY_NONE; } } - if (!(ret = PyDict_New())) { - VIR_FREE(stats); - return VIR_PY_NONE; - } + + if (!(ret = PyDict_New())) + goto error; + for (i = 0; i < nparams; i++) { - PyDict_SetItem(ret, - libvirt_constcharPtrWrap(stats[i].field), - libvirt_ulonglongWrap(stats[i].value)); + key = libvirt_constcharPtrWrap(stats[i].field); + val = libvirt_ulonglongWrap(stats[i].value); + + if (!key || !val || PyDict_SetItem(ret, key, val) < 0) { + Py_DECREF(ret); + ret = NULL; + goto error; + } + + Py_DECREF(key); + Py_DECREF(val); } VIR_FREE(stats); return ret; + +error: + VIR_FREE(stats); + Py_XDECREF(key); + Py_XDECREF(val); + return ret; } static PyObject * -- 1.7.1

2 2

[libvirt] [PATCH] build: drop a painfully long gnulib test
by Eric Blake 21 Mar '12

21 Mar '12

On machines with massive amounts of CPUs, the gnulib 'test-lock' could take minutes, or even appear to deadlock, because of timing interactions between multiple cores. See https://bugzilla.redhat.com/show_bug.cgi?id=797284. For precedence, note that iwhd has done the same: https://lists.gnu.org/archive/html/bug-gnulib/2012-01/msg00311.html We can re-enable things if gnulib ever analyzes and improves the situation. * bootstrap.conf (gnulib_tool_option_extras): Avoid lock-tests. --- Personally, I haven't run into the problem on my 2-core laptop; where do I sign up for one of the 2048-core machines in that BZ? :) But since I haven't seen it, I can't push this under the trivial rule, so I'll wait for a review. bootstrap.conf | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/bootstrap.conf b/bootstrap.conf index 03da267..c6f7fd9 100644 --- a/bootstrap.conf +++ b/bootstrap.conf @@ -174,6 +174,7 @@ gnulib_tool_option_extras="\ --with-tests\ --makefile-name=gnulib.mk\ --avoid=pt_chown\ + --avoid=lock-tests\ " local_gl_dir=gnulib/local -- 1.7.7.6

2 2

[libvirt] [PATCH 0/5] Make migration more robust when client dies
by Jiri Denemark 21 Mar '12

21 Mar '12

Libvirt daemon was not completely ready to lose a connection to the client (may even be source libvirtd) which is controling the migration. We might end up with dangling migration jobs on both source and destination daemons. More details about the scenarios this might happen can be found in patches 2/5 and 5/5 which fix the issue using infrastructure set up by the other patches in this series. Jiri Denemark (5): qemu: Add support for domain cleanup callbacks qemu: Avoid dangling migration-in job on shutoff domains qemu: Add connection close callbacks qemu: Make autodestroy utilize connection close callbacks qemu: Avoid dangling migration-out job when client dies src/qemu/qemu_conf.c | 172 +++++++++++++++++++++++++++++++++++++++++++++ src/qemu/qemu_conf.h | 30 +++++++- src/qemu/qemu_domain.c | 75 +++++++++++++++++++- src/qemu/qemu_domain.h | 17 +++++ src/qemu/qemu_driver.c | 10 ++- src/qemu/qemu_migration.c | 88 +++++++++++++++++++++++ src/qemu/qemu_migration.h | 4 + src/qemu/qemu_process.c | 109 +++++++---------------------- 8 files changed, 413 insertions(+), 92 deletions(-) -- 1.7.8.5

2 14