- Devel - libvirt List Archives

[libvirt] Accepting RELATED, ESTABLISHED (TCP) connections into VM using Network Filters
by Wido den Hollander 16 Jun '17

16 Jun '17

Hi, Over the past few days I've been trying to get a prototype working of a stateful firewall for a Virtual Machine using Libvirt's network filters. My goal is to replace the current custom Python/Java code in the Apache CloudStack [0] project by Network Filters of Libvirt. Both IPv4 and IPv6 should work, but I started off with IPv4 and I have issues with accepting back RELATED,ESTABLISHED connections into the VM. In the guest's XML I have this defined: <filterref filter='nwfilter-test'> <parameter name='IP' value='192.168.200.250'/> <parameter name='IPV6' value='2001:db8:100:0:5054:ff:fe9c:6ce6'/> <parameter name='IPV6' value='fe80::5054:ff:fe9c:6ce6'/> </filterref> And the filter currently looks like this: <filter name='nwfilter-test' chain='root'> <uuid>a2493284-9dd5-4c20-98b5-7e70745b53de</uuid>  <filterref filter='no-mac-spoofing'/> <filterref filter='no-ip-spoofing'/> <filterref filter='no-arp-spoofing'/> <filterref filter='allow-dhcp'/>  <rule action='accept' direction='in' priority='100'> <all state='RELATED,ESTABLISHED'/> </rule> <rule action='return' direction='in' priority='500'> <icmp/> </rule> <rule action='accept' direction='in' priority='500'> <tcp dstportstart='22'/> </rule> <rule action='accept' direction='in' priority='500'> <tcp dstportstart='80'/> </rule> <rule action='reject' direction='in' priority='1000'> <all/> </rule> </filter> I can SSH into the VM and also visit the Webserver running on it. But going out the VM results in issues: root@nwfilter-test:~# telnet 109.72.92.155 80 Trying 109.72.92.155... telnet: Unable to connect to remote host: Connection refused root@nwfilter-test:~# I can however ping the same target: root@nwfilter-test:~# ping -c 2 109.72.92.155 PING 109.72.92.155 (109.72.92.155) 56(84) bytes of data. 64 bytes from 109.72.92.155: icmp_seq=1 ttl=56 time=13.2 ms 64 bytes from 109.72.92.155: icmp_seq=2 ttl=56 time=14.1 ms --- 109.72.92.155 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 13.225/13.703/14.182/0.492 ms root@nwfilter-test:~# Looking at iptables-save it seems like the right rules are programmed: -A FI-vnet1 -p icmp -j RETURN -A FI-vnet1 -p tcp -m tcp --sport 22 -m conntrack --ctstate ESTABLISHED -m conntrack --ctdir REPLY -j RETURN -A FI-vnet1 -p tcp -m tcp --sport 80 -m conntrack --ctstate ESTABLISHED -m conntrack --ctdir REPLY -j RETURN -A FI-vnet1 -j REJECT --reject-with icmp-port-unreachable -A FO-vnet1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FO-vnet1 -p icmp -j RETURN -A FO-vnet1 -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -m conntrack --ctdir ORIGINAL -j ACCEPT -A FO-vnet1 -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -m conntrack --ctdir ORIGINAL -j ACCEPT -A FO-vnet1 -j REJECT --reject-with icmp-port-unreachable -A HI-vnet1 -p icmp -j RETURN -A HI-vnet1 -p tcp -m tcp --sport 22 -m conntrack --ctstate ESTABLISHED -m conntrack --ctdir REPLY -j RETURN -A HI-vnet1 -p tcp -m tcp --sport 80 -m conntrack --ctstate ESTABLISHED -m conntrack --ctdir REPLY -j RETURN -A HI-vnet1 -j REJECT --reject-with icmp-port-unreachable -A libvirt-host-in -m physdev --physdev-in vnet1 -g HI-vnet1 -A libvirt-in -m physdev --physdev-in vnet1 -g FI-vnet1 -A libvirt-in-post -m physdev --physdev-in vnet1 -j ACCEPT -A libvirt-out -m physdev --physdev-out vnet1 --physdev-is-bridged -g FO-vnet1 I tried changing 'accept' into 'return' for the incoming RELATED,ESTABLISHED rules, but that didn't help. I also tried searching for example of more complex network filters, but all I keep finding are the default filters of Libvirt. Does anybody know what I'm doing wrong here? Or are there any examples of working filters out there? Thank you! Wido [0]: http://cloudstack.apache.org/

1 0

[libvirt] [PATCH v2] Report more correct information for cache control
by Martin Kletzander 16 Jun '17

16 Jun '17

On some platforms the number of bits in the cbm_mask might not be divisible by 4 (and not even by 2), so we need to properly count the bits. Similar file, min_cbm_bits, is properly parsed and used, but if the number is greater than one, we lose the information about granularity when reporting the data in capabilities. For that matter always report granularity, but if it is not the same as the minimum, add that information in there as well. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- v2: - More expressive comments for structure members - Cache size adjusted to match the SKX machine (33M) v1: - https://www.redhat.com/archives/libvir-list/2017-June/msg00229.html docs/schemas/capability.rng | 7 ++++- src/conf/capabilities.c | 34 ++++++++++++++++++---- src/conf/capabilities.h | 11 +++++-- .../linux-resctrl-skx/resctrl/info/L3/cbm_mask | 1 + .../linux-resctrl-skx/resctrl/info/L3/min_cbm_bits | 1 + .../linux-resctrl-skx/resctrl/info/L3/num_closids | 1 + .../linux-resctrl-skx/resctrl/schemata | 1 + .../system/cpu/cpu0/cache/index0/id | 1 + .../system/cpu/cpu0/cache/index0/level | 1 + .../system/cpu/cpu0/cache/index0/shared_cpu_list | 1 + .../system/cpu/cpu0/cache/index0/shared_cpu_map | 1 + .../system/cpu/cpu0/cache/index0/size | 1 + .../system/cpu/cpu0/cache/index0/type | 1 + .../linux-resctrl-skx/system/cpu/cpu0/online | 1 + .../system/cpu/cpu0/topology/core_id | 1 + .../system/cpu/cpu0/topology/core_siblings | 1 + .../system/cpu/cpu0/topology/core_siblings_list | 1 + .../system/cpu/cpu0/topology/physical_package_id | 1 + .../system/cpu/cpu0/topology/thread_siblings | 1 + .../system/cpu/cpu0/topology/thread_siblings_list | 1 + .../linux-resctrl-skx/system/cpu/online | 1 + .../linux-resctrl-skx/system/cpu/present | 1 + .../linux-resctrl-skx/system/node/node0/cpu0 | 1 + .../linux-resctrl-skx/system/node/node0/cpulist | 1 + .../linux-resctrl-skx/system/node/node0/cpumap | 1 + .../linux-resctrl-skx/system/node/node0/distance | 1 + .../linux-resctrl-skx/system/node/online | 1 + .../vircaps2xmldata/vircaps-x86_64-resctrl-cdp.xml | 8 ++--- .../vircaps2xmldata/vircaps-x86_64-resctrl-skx.xml | 31 ++++++++++++++++++++ tests/vircaps2xmldata/vircaps-x86_64-resctrl.xml | 4 +-- tests/vircaps2xmltest.c | 1 + 31 files changed, 104 insertions(+), 16 deletions(-) create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/resctrl/info/L3/cbm_mask create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/resctrl/info/L3/min_cbm_bits create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/resctrl/info/L3/num_closids create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/resctrl/schemata create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/id create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/level create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/shared_cpu_list create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/shared_cpu_map create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/size create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/type create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/online create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/core_id create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/core_siblings create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/core_siblings_list create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/physical_package_id create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/thread_siblings create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/thread_siblings_list create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/online create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/present create mode 120000 tests/vircaps2xmldata/linux-resctrl-skx/system/node/node0/cpu0 create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/node/node0/cpulist create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/node/node0/cpumap create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/node/node0/distance create mode 100644 tests/vircaps2xmldata/linux-resctrl-skx/system/node/online create mode 100644 tests/vircaps2xmldata/vircaps-x86_64-resctrl-skx.xml diff --git a/docs/schemas/capability.rng b/docs/schemas/capability.rng index e5cbfa362ec0..071090c2d991 100644 --- a/docs/schemas/capability.rng +++ b/docs/schemas/capability.rng @@ -273,9 +273,14 @@ </attribute> <zeroOrMore> <element name='control'> - <attribute name='min'> + <attribute name='granularity'> <ref name='unsignedInt'/> </attribute> + <optional> + <attribute name='min'> + <ref name='unsignedInt'/> + </attribute> + </optional> <attribute name='unit'> <ref name='unit'/> </attribute> diff --git a/src/conf/capabilities.c b/src/conf/capabilities.c index 3becc7e18c62..0f99f3096292 100644 --- a/src/conf/capabilities.c +++ b/src/conf/capabilities.c @@ -31,6 +31,7 @@ #include <unistd.h> #include "capabilities.h" +#include "c-ctype.h" #include "count-one-bits.h" #include "cpu_conf.h" #include "domain_conf.h" @@ -906,11 +907,24 @@ virCapabilitiesFormatCaches(virBufferPtr buf, virBufferAdjustIndent(&controlBuf, indent + 4); for (j = 0; j < bank->ncontrols; j++) { - bool min_kilos = !(bank->controls[j]->min % 1024); + bool min_kilos = !(bank->controls[j]->granularity % 1024); + + /* Only use KiB if both values are divisible */ + if (bank->controls[j]->min) + min_kilos = min_kilos && !(bank->controls[j]->min % 1024); + + virBufferAsprintf(&controlBuf, + "<control granularity='%llu'", + bank->controls[j]->granularity >> (min_kilos * 10)); + + if (bank->controls[j]->min) { + virBufferAsprintf(&controlBuf, + " min='%llu'", + bank->controls[j]->min >> (min_kilos * 10)); + } + virBufferAsprintf(&controlBuf, - "<control min='%llu' unit='%s' " - "type='%s' maxAllocs='%u'/>\n", - bank->controls[j]->min >> (min_kilos * 10), + " unit='%s' type='%s' maxAllocs='%u'/>\n", min_kilos ? "KiB" : "B", virCacheTypeToString(bank->controls[j]->scope), bank->controls[j]->max_allocation); @@ -1598,9 +1612,11 @@ virCapabilitiesGetCacheControl(virCapsHostCacheBankPtr bank, virCacheType scope) { int ret = -1; + char *tmp = NULL; char *path = NULL; char *cbm_mask = NULL; char *type_upper = NULL; + unsigned int bits = 0; unsigned int min_cbm_bits = 0; virCapsHostCacheControlPtr control; @@ -1632,8 +1648,14 @@ virCapabilitiesGetCacheControl(virCapsHostCacheBankPtr bank, virStringTrimOptionalNewline(cbm_mask); - /* cbm_mask: cache bit mask, it's in hex, eg: fffff */ - control->min = min_cbm_bits * bank->size / (strlen(cbm_mask) * 4); + for (tmp = cbm_mask; *tmp != '\0'; tmp++) { + if (c_isxdigit(*tmp)) + bits += count_one_bits(virHexToBin(*tmp)); + } + + control->granularity = bank->size / bits; + if (min_cbm_bits != 1) + control->min = min_cbm_bits * control->granularity; control->scope = scope; diff --git a/src/conf/capabilities.h b/src/conf/capabilities.h index ee87d598ef66..39a9bc689279 100644 --- a/src/conf/capabilities.h +++ b/src/conf/capabilities.h @@ -151,9 +151,14 @@ VIR_ENUM_DECL(virCache); typedef struct _virCapsHostCacheControl virCapsHostCacheControl; typedef virCapsHostCacheControl *virCapsHostCacheControlPtr; struct _virCapsHostCacheControl { - unsigned long long min; /* minimum cache control size in B */ - virCacheType scope; /* data, code or both */ - unsigned int max_allocation; /* max number of supported allocations */ + /* Smallest possible increase of the allocation size in bytes */ + unsigned long long granularity; + /* Minimal allocatable size in bytes (if different from granularity) */ + unsigned long long min; + /* Type of the allocation */ + virCacheType scope; + /* Maximum number of simultaneous allocations */ + unsigned int max_allocation; }; typedef struct _virCapsHostCacheBank virCapsHostCacheBank; diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/resctrl/info/L3/cbm_mask b/tests/vircaps2xmldata/linux-resctrl-skx/resctrl/info/L3/cbm_mask new file mode 100644 index 000000000000..d482bbb26931 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/resctrl/info/L3/cbm_mask @@ -0,0 +1 @@ +7ff diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/resctrl/info/L3/min_cbm_bits b/tests/vircaps2xmldata/linux-resctrl-skx/resctrl/info/L3/min_cbm_bits new file mode 100644 index 000000000000..d00491fd7e5b --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/resctrl/info/L3/min_cbm_bits @@ -0,0 +1 @@ +1 diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/resctrl/info/L3/num_closids b/tests/vircaps2xmldata/linux-resctrl-skx/resctrl/info/L3/num_closids new file mode 100644 index 000000000000..b6a7d89c68e0 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/resctrl/info/L3/num_closids @@ -0,0 +1 @@ +16 diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/resctrl/schemata b/tests/vircaps2xmldata/linux-resctrl-skx/resctrl/schemata new file mode 100644 index 000000000000..4a4913735386 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/resctrl/schemata @@ -0,0 +1 @@ +L3:0=7ff;1=7ff diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/id b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/id new file mode 100644 index 000000000000..573541ac9702 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/id @@ -0,0 +1 @@ +0 diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/level b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/level new file mode 100644 index 000000000000..00750edc07d6 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/level @@ -0,0 +1 @@ +3 diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/shared_cpu_list b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/shared_cpu_list new file mode 100644 index 000000000000..573541ac9702 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/shared_cpu_list @@ -0,0 +1 @@ +0 diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/shared_cpu_map b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/shared_cpu_map new file mode 100644 index 000000000000..5325a8dff751 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/shared_cpu_map @@ -0,0 +1 @@ +001 diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/size b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/size new file mode 100644 index 000000000000..d23da60c1205 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/size @@ -0,0 +1 @@ +33M diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/type b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/type new file mode 100644 index 000000000000..e4fd9dccda2c --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/cache/index0/type @@ -0,0 +1 @@ +Unified diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/online b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/online new file mode 100644 index 000000000000..d00491fd7e5b --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/online @@ -0,0 +1 @@ +1 diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/core_id b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/core_id new file mode 100644 index 000000000000..573541ac9702 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/core_id @@ -0,0 +1 @@ +0 diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/core_siblings b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/core_siblings new file mode 100644 index 000000000000..5325a8dff751 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/core_siblings @@ -0,0 +1 @@ +001 diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/core_siblings_list b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/core_siblings_list new file mode 100644 index 000000000000..573541ac9702 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/core_siblings_list @@ -0,0 +1 @@ +0 diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/physical_package_id b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/physical_package_id new file mode 100644 index 000000000000..573541ac9702 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/physical_package_id @@ -0,0 +1 @@ +0 diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/thread_siblings b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/thread_siblings new file mode 100644 index 000000000000..5325a8dff751 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/thread_siblings @@ -0,0 +1 @@ +001 diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/thread_siblings_list b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/thread_siblings_list new file mode 100644 index 000000000000..573541ac9702 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/cpu0/topology/thread_siblings_list @@ -0,0 +1 @@ +0 diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/online b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/online new file mode 100644 index 000000000000..573541ac9702 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/online @@ -0,0 +1 @@ +0 diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/present b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/present new file mode 100644 index 000000000000..573541ac9702 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/cpu/present @@ -0,0 +1 @@ +0 diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/node/node0/cpu0 b/tests/vircaps2xmldata/linux-resctrl-skx/system/node/node0/cpu0 new file mode 120000 index 000000000000..c841bea28b2b --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/node/node0/cpu0 @@ -0,0 +1 @@ +../../cpu/cpu0 \ No newline at end of file diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/node/node0/cpulist b/tests/vircaps2xmldata/linux-resctrl-skx/system/node/node0/cpulist new file mode 100644 index 000000000000..573541ac9702 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/node/node0/cpulist @@ -0,0 +1 @@ +0 diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/node/node0/cpumap b/tests/vircaps2xmldata/linux-resctrl-skx/system/node/node0/cpumap new file mode 100644 index 000000000000..5325a8dff751 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/node/node0/cpumap @@ -0,0 +1 @@ +001 diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/node/node0/distance b/tests/vircaps2xmldata/linux-resctrl-skx/system/node/node0/distance new file mode 100644 index 000000000000..f599e28b8ab0 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/node/node0/distance @@ -0,0 +1 @@ +10 diff --git a/tests/vircaps2xmldata/linux-resctrl-skx/system/node/online b/tests/vircaps2xmldata/linux-resctrl-skx/system/node/online new file mode 100644 index 000000000000..573541ac9702 --- /dev/null +++ b/tests/vircaps2xmldata/linux-resctrl-skx/system/node/online @@ -0,0 +1 @@ +0 diff --git a/tests/vircaps2xmldata/vircaps-x86_64-resctrl-cdp.xml b/tests/vircaps2xmldata/vircaps-x86_64-resctrl-cdp.xml index 49aa0b98ca88..7361537bfb56 100644 --- a/tests/vircaps2xmldata/vircaps-x86_64-resctrl-cdp.xml +++ b/tests/vircaps2xmldata/vircaps-x86_64-resctrl-cdp.xml @@ -42,12 +42,12 @@ </topology> <cache> <bank id='0' level='3' type='both' size='15360' unit='KiB' cpus='0-5'> - <control min='768' unit='KiB' type='code' maxAllocs='8'/> - <control min='768' unit='KiB' type='data' maxAllocs='8'/> + <control granularity='768' unit='KiB' type='code' maxAllocs='8'/> + <control granularity='768' unit='KiB' type='data' maxAllocs='8'/> </bank> <bank id='1' level='3' type='both' size='15360' unit='KiB' cpus='6-11'> - <control min='768' unit='KiB' type='code' maxAllocs='8'/> - <control min='768' unit='KiB' type='data' maxAllocs='8'/> + <control granularity='768' unit='KiB' type='code' maxAllocs='8'/> + <control granularity='768' unit='KiB' type='data' maxAllocs='8'/> </bank> </cache> </host> diff --git a/tests/vircaps2xmldata/vircaps-x86_64-resctrl-skx.xml b/tests/vircaps2xmldata/vircaps-x86_64-resctrl-skx.xml new file mode 100644 index 000000000000..4e91c87de3b1 --- /dev/null +++ b/tests/vircaps2xmldata/vircaps-x86_64-resctrl-skx.xml @@ -0,0 +1,31 @@ +<capabilities> + + <host> + <cpu> + <arch>x86_64</arch> + </cpu> + <power_management/> + <migration_features> + <live/> + </migration_features> + <topology> + <cells num='1'> + <cell id='0'> + <memory unit='KiB'>1048576</memory> + <pages unit='KiB' size='4'>2048</pages> + <pages unit='KiB' size='2048'>4096</pages> + <pages unit='KiB' size='1048576'>6144</pages> + <cpus num='1'> + <cpu id='0' socket_id='0' core_id='0' siblings='0'/> + </cpus> + </cell> + </cells> + </topology> + <cache> + <bank id='0' level='3' type='both' size='33792' unit='KiB' cpus='0'> + <control granularity='3072' unit='KiB' type='both' maxAllocs='16'/> + </bank> + </cache> + </host> + +</capabilities> diff --git a/tests/vircaps2xmldata/vircaps-x86_64-resctrl.xml b/tests/vircaps2xmldata/vircaps-x86_64-resctrl.xml index cb78b4ab788d..eb02ad3322a2 100644 --- a/tests/vircaps2xmldata/vircaps-x86_64-resctrl.xml +++ b/tests/vircaps2xmldata/vircaps-x86_64-resctrl.xml @@ -42,10 +42,10 @@ </topology> <cache> <bank id='0' level='3' type='both' size='15360' unit='KiB' cpus='0-5'> - <control min='1536' unit='KiB' type='both' maxAllocs='4'/> + <control granularity='768' min='1536' unit='KiB' type='both' maxAllocs='4'/> </bank> <bank id='1' level='3' type='both' size='15360' unit='KiB' cpus='6-11'> - <control min='1536' unit='KiB' type='both' maxAllocs='4'/> + <control granularity='768' min='1536' unit='KiB' type='both' maxAllocs='4'/> </bank> </cache> </host> diff --git a/tests/vircaps2xmltest.c b/tests/vircaps2xmltest.c index ae1cd521111e..c0a67858fec3 100644 --- a/tests/vircaps2xmltest.c +++ b/tests/vircaps2xmltest.c @@ -120,6 +120,7 @@ mymain(void) DO_TEST_FULL("resctrl", VIR_ARCH_X86_64, true, true, true); DO_TEST_FULL("resctrl-cdp", VIR_ARCH_X86_64, true, true, true); + DO_TEST_FULL("resctrl-skx", VIR_ARCH_X86_64, true, true, true); return ret; } -- 2.13.1

3 2

[libvirt] [PATCH go-xml] support virtualport for interface and add test code
by zhenwei.pi 16 Jun '17

16 Jun '17

--- domain.go | 29 +++++++++++++++++------------ domain_test.go | 4 ++++ 2 files changed, 21 insertions(+), 12 deletions(-) diff --git a/domain.go b/domain.go index eb7ff9e..ecb8550 100644 --- a/domain.go +++ b/domain.go @@ -185,19 +185,24 @@ type DomainInterfaceDriver struct { Queues uint `xml:"queues,attr,omitempty"` } +type DomainInterfaceVirtualport struct { + Type string `xml:"type,attr"` +} + type DomainInterface struct { - XMLName xml.Name `xml:"interface"` - Type string `xml:"type,attr"` - MAC *DomainInterfaceMAC `xml:"mac"` - Model *DomainInterfaceModel `xml:"model"` - Source *DomainInterfaceSource `xml:"source"` - Target *DomainInterfaceTarget `xml:"target"` - Alias *DomainInterfaceAlias `xml:"alias"` - Link *DomainInterfaceLink `xml:"link"` - Boot *DomainDeviceBoot `xml:"boot"` - Script *DomainInterfaceScript `xml:"script"` - Driver *DomainInterfaceDriver `xml:"driver"` - Address *DomainAddress `xml:"address"` + XMLName xml.Name `xml:"interface"` + Type string `xml:"type,attr"` + MAC *DomainInterfaceMAC `xml:"mac"` + Model *DomainInterfaceModel `xml:"model"` + Source *DomainInterfaceSource `xml:"source"` + Target *DomainInterfaceTarget `xml:"target"` + Alias *DomainInterfaceAlias `xml:"alias"` + Link *DomainInterfaceLink `xml:"link"` + Boot *DomainDeviceBoot `xml:"boot"` + Script *DomainInterfaceScript `xml:"script"` + Driver *DomainInterfaceDriver `xml:"driver"` + Virtualport *DomainInterfaceVirtualport `xml:"virtualport"` + Address *DomainAddress `xml:"address"` } type DomainChardevSource struct { diff --git a/domain_test.go b/domain_test.go index 6b37719..9de725c 100644 --- a/domain_test.go +++ b/domain_test.go @@ -565,6 +565,9 @@ var domainTestData = []struct { Model: &DomainInterfaceModel{ Type: "virtio", }, + Virtualport: &DomainInterfaceVirtualport{ + Type: "openvswitch", + }, }, }, }, @@ -577,6 +580,7 @@ var domainTestData = []struct { ` <interface type="network">`, ` <mac address="00:11:22:33:44:55"></mac>`, ` <model type="virtio"></model>`, + ` <virtualport type="openvswitch"></virtualport>`, ` </interface>`, ` </devices>`, `</domain>`, -- 2.7.4

1 0

[libvirt] [PATCH v2 0/8] virObject adjustments for common object
by John Ferlan 16 Jun '17

16 Jun '17

v1: https://www.redhat.com/archives/libvir-list/2017-May/msg01178.html rfc: https://www.redhat.com/archives/libvir-list/2017-April/msg00321.html Now that 3.5.0 is out, hopefully this can be considered early and more progress can be made this month. Differences to v1: - Remove the magic_marker, replace with checks vs. existing magic without the object # specific value. Also added a assert for the object# not exceeding 0xcafeffff. - Remove the recursive lock setup.... I believe I've had some success with removing the need for recursive locks in nwfilter. I'll post a series shortly with that removed for scrutiny. Beyond that as in v1: I'm "close enough" to at least convert secrets, nwfilters, nodedevs, and interfaces to use a more common object methodolgy to add/store, fetch/find, search, list, etc. the objects in something other than a linear forward linked list. Converting the storage pool, storage volume, and network is taking longer than hoped since there are so many patches to get from pointA to pointB. So I'll focus on the 4 and work through getting the complete model published/adopted as those have been in my branches for a while now. These patches get as far as the creation of the common object which is a start. The first 4 patches are essentially setup. Patches 5-6 are more or less what patch 7-8 were. Patches 7-8 are essentially the new driver/common object extension. Patches 5-6 from the RFC still exist in my branches and would be the next logical step. It was a conscious decision to just use the "default" string comparison for hash table key. That key could be a UUID, but since the UUID can easily be converted from unsigned to signed - I believe it would be far simpler to keep that mechanism rather than complexity introduced by having "different" key search algorithms when the key isn't a char *. John Ferlan (8): util: Formatting cleanups to virobject API util: Introduce virObjectGetLockableObj util: Generate a common internal only error print util: Add safety net of checks to ensure valid object util: Introduce virObjectPoolableHashElement util: Add virObjectPoolableHashElementGet*Key util: Introduce virObjectPoolableDef util: Add virObjectPoolableDef* accessor API's src/libvirt_private.syms | 11 ++ src/util/virobject.c | 458 +++++++++++++++++++++++++++++++++++++++++++---- src/util/virobject.h | 123 +++++++++++-- 3 files changed, 538 insertions(+), 54 deletions(-) -- 2.9.4

2 20

[libvirt] [PATCH] maint: update to latest gnulib
by Daniel P. Berrange 15 Jun '17

15 Jun '17

This fixes an incompatibility with glibc 2.25.90 Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- Pushed as a broken build fix to get CI back online .gnulib | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gnulib b/.gnulib index da830b5..ce4ee4c 160000 --- a/.gnulib +++ b/.gnulib @@ -1 +1 @@ -Subproject commit da830b5146cb553ac2a4bcfe76caeb57bda24cc3 +Subproject commit ce4ee4cbb596a9d7de2786cf8c48cf62a4edede7 -- 2.9.3

2 6

[libvirt] [PATCH] Temporarily disable format truncation warnings
by Daniel P. Berrange 15 Jun '17

15 Jun '17

GCC 7.1 introduces a new -Wformat-truncation warning flag that reports if it thinks the maximum possible size of the formatted output will exceed the provided fixed buffer. This is enabled automatically by the -Wformat warning flag. There are quite a few places hit by this in libvirt which need rewriting. This is non-trivial work in some places, so temporarily disable the new warning until those fixes can be implemented. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- m4/virt-compile-warnings.m4 | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/m4/virt-compile-warnings.m4 b/m4/virt-compile-warnings.m4 index d7bb172f3..fa0940fc6 100644 --- a/m4/virt-compile-warnings.m4 +++ b/m4/virt-compile-warnings.m4 @@ -169,6 +169,10 @@ AC_DEFUN([LIBVIRT_COMPILE_WARNINGS],[ wantwarn="$wantwarn -Wno-format" fi + # -Wformat enables this by default, and we should keep it, + # but need to rewrite various areas of code first + wantwarn="$wantwarn -Wno-format-truncation" + # This should be < 256 really. Currently we're down to 4096, # but using 1024 bytes sized buffers (mostly for virStrerror) # stops us from going down further -- 2.13.1

2 1

[libvirt] [PATCH] qemu: Remove inactive vm when failed to start it
by Yi Wang 15 Jun '17

15 Jun '17

Libvirt forgets to remove inactive vm when failed to start a defined vm. That may result in residual domain in driver->domains on such condition: during the process of starting a vm, undefine it, and qemu exit because of some exception. As we undefined the vm successfully, the vm->persistent was set to 0, we will always fail to undefine it until restart libvirtd. Signed-off-by: Yi Wang <wang.yi59(a)zte.com.cn> --- src/qemu/qemu_driver.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index ba1dba5..581f02f 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -7185,6 +7185,8 @@ qemuDomainCreateWithFlags(virDomainPtr dom, unsigned int flags) endjob: qemuProcessEndJob(driver, vm); + if (ret < 0) + qemuDomainRemoveInactive(driver, vm); cleanup: virDomainObjEndAPI(&vm); -- 1.8.3.1

1 0

[libvirt] [PATCH 2/2] qemu: fixing internationalization problem with sched kernel entry.
by Julio Faracco 15 Jun '17

15 Jun '17

In qemuGetSchedInfo(), libvirt is trying to parse some field of /proc/*/sched. Some fields are floating point numbers and their separator is always a dot. When you change the locale of the system, you can change the mantissa separator (to a comma separator) of floating point numbers and it affects the parser. This commit introduces the virStrToDoubleSafe() to avoid comma as a separator. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1457634 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1457481 Signed-off-by: Julio Faracco <jcfaracco(a)gmail.com> --- src/qemu/qemu_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index ba1dba5..f1b104f 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -1369,7 +1369,7 @@ qemuGetSchedInfo(unsigned long long *cpuWait, while (*line == ' ') line++; - if (virStrToDouble(line, NULL, &val) < 0) { + if (virStrToDoubleSafe(line, NULL, &val) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, _("Unable to parse sched info value '%s'"), line); -- 2.7.4

2 1

[libvirt] [PATCH v5 0/4] Loadparm support
by Farhan Ali 15 Jun '17

15 Jun '17

This patch series introduces the support for new s390x 'loadparm' feature. The 'loadparm' can be used to select the boot entry to boot from, for a boot device. Here is a link to the QEMU patches: https://lists.nongnu.org/archive/html/qemu-devel/2017-05/msg00192.html ChangeLog --------- v4 -> v5: - Separated qemu capabilities data into a separate patch. (patch 3) - Add formatdomain.html.in to patch 1 v3 -> v4 - Break news and documentation updates to a separate patch (patch 3) - Merge test cases with qemu patch (patch 2) - Add xml2xml test case (patch 2) - Add qemucapabilities test (patch 2) - Rebased the patch series on master commit 5970b13 udev: Fix build on older platforms v2 -> v3: - Updated news.xml and formatdomain.html.in with a more architectural description of loadparm (patch 1) v1 -> v2: - Rebased the patch series on the latest master, commit 2f69dd3 virfiletest: include linux/falloc.h Thanks Farhan Ali Farhan Ali (4): conf : Add loadparm boot option for a boot device qemu : Add loadparm to qemu command line string qemu: capabilities: Add data for qemu capabilities for s390x news: Update news for loadparm feature docs/formatdomain.html.in | 9 +- docs/news.xml | 11 + docs/schemas/domaincommon.rng | 7 + src/conf/device_conf.h | 1 + src/conf/domain_conf.c | 69 +- src/qemu/qemu_capabilities.c | 3 + src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_command.c | 33 + .../qemucapabilitiesdata/caps_2.9.50.s390x.replies | 14587 +++++++++++++++++++ tests/qemucapabilitiesdata/caps_2.9.50.s390x.xml | 302 + ...-machine-loadparm-multiple-disks-nets-s390.args | 28 + ...v-machine-loadparm-multiple-disks-nets-s390.xml | 43 + .../qemuxml2argv-machine-loadparm-net-s390.args | 20 + .../qemuxml2argv-machine-loadparm-net-s390.xml | 26 + ...xml2argv-machine-loadparm-s390-char-invalid.xml | 26 + ...uxml2argv-machine-loadparm-s390-len-invalid.xml | 26 + .../qemuxml2argv-machine-loadparm-s390.args | 20 + .../qemuxml2argv-machine-loadparm-s390.xml | 26 + tests/qemuxml2argvtest.c | 19 + ...t-machine-loadparm-multiple-disks-nets-s390.xml | 44 + tests/qemuxml2xmltest.c | 4 + 21 files changed, 15303 insertions(+), 4 deletions(-) create mode 100644 tests/qemucapabilitiesdata/caps_2.9.50.s390x.replies create mode 100644 tests/qemucapabilitiesdata/caps_2.9.50.s390x.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-loadparm-multiple-disks-nets-s390.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-loadparm-multiple-disks-nets-s390.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-loadparm-net-s390.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-loadparm-net-s390.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-loadparm-s390-char-invalid.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-loadparm-s390-len-invalid.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-loadparm-s390.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-machine-loadparm-s390.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-machine-loadparm-multiple-disks-nets-s390.xml -- 1.9.1

2 10

[libvirt] [PATCH] Disable the -Wduplicated-branches warning
by Daniel P. Berrange 15 Jun '17

15 Jun '17

Depending on the platform/architecture, a number of conditionals in libvirt code expand the same on both branches. This is expected behaviour and harmless, so disable the warning to avoid creating unexpected build failures Two examples, mingw32: ../../src/util/vircommand.c: In function 'virCommandWait': ../../src/util/vircommand.c:2562:51: error: this condition has identical branches [-Werror=duplicated-branches] *exitstatus = cmd->rawStatus ? status : WEXITSTATUS(status); ^ and gcc7.1 In file included from util/virobject.c:28:0: util/virobject.c: In function 'virClassNew': util/viratomic.h:176:46: error: this condition has identical branches [-Werror=duplicated-branches] (void)(0 ? *(atomic) ^ *(atomic) : 0); \ ^ util/virobject.c:144:20: note: in expansion of macro 'virAtomicIntInc' klass->magic = virAtomicIntInc(&magicCounter); ^~~~~~~~~~~~~~~ Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- m4/virt-compile-warnings.m4 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/m4/virt-compile-warnings.m4 b/m4/virt-compile-warnings.m4 index 768a5c8..d7bb172 100644 --- a/m4/virt-compile-warnings.m4 +++ b/m4/virt-compile-warnings.m4 @@ -61,6 +61,9 @@ AC_DEFUN([LIBVIRT_COMPILE_WARNINGS],[ dontwarn="$dontwarn -Wenum-compare" # gcc 5.1 -Wformat-signedness mishandles enums, not ready for prime time dontwarn="$dontwarn -Wformat-signedness" + # Several conditionals expand the same on both branches + # depending on the particular platform/architecture + dontwarn="$dontwarn -Wduplicated-branches" # gcc 4.2 treats attribute(format) as an implicit attribute(nonnull), # which triggers spurious warnings for our usage -- 2.9.3

2 1