- Devel - libvirt List Archives

[libvirt] 1GB huge pages and incompatible VM memory size
by Jim Fehlig 15 Mar '17

15 Mar '17

Hi All, Matt encountered the following issue when using 1GB huge pages with libvirt > This problem turned out to be entirely my fault because I didn't round > the VM's memory size to a 1G multiple, and the kernel tried to split > the VMA at the end of the region, triggering this code in the kernel > do_mbind() path, > > static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma, > unsigned long addr, int new_below) > { > struct vm_area_struct *new; > int err; > > if (is_vm_hugetlb_page(vma) && (addr & > ~(huge_page_mask(hstate_vma(vma))))) > return -EINVAL; > > I have no idea how a less fortunate developer without access to MM > experts would have figured this out. It's a shame virsh didn't error > out when I initially setup 1G hugepages with an incompatible VM memory > size. What do folks think about improving libvirt to warn or error when using a VM memory size that is not compatible with the host hugepage configuration? Regards, Jim

3 4

[libvirt] [PATCH] bhyve: add config file support
by Roman Bogorodskiy 15 Mar '17

15 Mar '17

Introduce config file support for the bhyve driver. The only available setting at present is 'firmware_dir' for specifying a directory with UEFI firmware files. --- src/Makefile.am | 25 +++++++- src/bhyve/bhyve.conf | 7 +++ src/bhyve/bhyve_capabilities.c | 9 ++- src/bhyve/bhyve_capabilities.h | 5 +- src/bhyve/bhyve_conf.c | 112 +++++++++++++++++++++++++++++++++++ src/bhyve/bhyve_conf.h | 32 ++++++++++ src/bhyve/bhyve_driver.c | 11 +++- src/bhyve/bhyve_utils.h | 12 ++++ src/bhyve/libvirtd_bhyve.aug | 39 ++++++++++++ src/bhyve/test_libvirtd_bhyve.aug.in | 5 ++ 10 files changed, 252 insertions(+), 5 deletions(-) create mode 100644 src/bhyve/bhyve.conf create mode 100644 src/bhyve/bhyve_conf.c create mode 100644 src/bhyve/bhyve_conf.h create mode 100644 src/bhyve/libvirtd_bhyve.aug create mode 100644 src/bhyve/test_libvirtd_bhyve.aug.in diff --git a/src/Makefile.am b/src/Makefile.am index 02579659a..f0d8efe50 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -930,6 +930,8 @@ BHYVE_DRIVER_SOURCES = \ bhyve/bhyve_capabilities.h \ bhyve/bhyve_command.c \ bhyve/bhyve_command.h \ + bhyve/bhyve_conf.c \ + bhyve/bhyve_conf.h \ bhyve/bhyve_parse_command.c \ bhyve/bhyve_parse_command.h \ bhyve/bhyve_device.c \ @@ -1575,7 +1577,14 @@ libvirt_driver_bhyve_impl_la_CFLAGS = \ $(AM_CFLAGS) libvirt_driver_bhyve_impl_la_LDFLAGS = $(AM_LDFLAGS) libvirt_driver_bhyve_impl_la_SOURCES = $(BHYVE_DRIVER_SOURCES) + +conf_DATA += bhyve/bhyve.conf +augeas_DATA += bhyve/libvirtd_bhyve.aug +augeastest_DATA += test_libvirtd_bhyve.aug endif WITH_BHYVE +EXTRA_DIST += bhyve/bhyve.conf \ + bhyve/libvirtd_bhyve.aug \ + bhyve/test_libvirtd_bhyve.aug.in if WITH_NETWORK noinst_LTLIBRARIES += libvirt_driver_network_impl.la @@ -2125,11 +2134,12 @@ check-local: check-augeas check-augeas-sanlock \ check-augeas-lockd \ check-augeas-libxl \ + check-augeas-bhyve \ $(NULL) check-augeas: check-augeas-qemu check-augeas-lxc check-augeas-sanlock \ check-augeas-lockd check-augeas-virtlockd check-augeas-libxl \ - check-augeas-virtlogd + check-augeas-bhyve check-augeas-virtlogd AUG_GENTEST = $(PERL) $(top_srcdir)/build-aux/augeas-gentest.pl EXTRA_DIST += $(top_srcdir)/build-aux/augeas-gentest.pl @@ -2212,6 +2222,19 @@ else ! WITH_LIBXL check-augeas-libxl: endif ! WITH_LIBXL +if WITH_BHYVE +test_libvirtd_bhyve.aug: bhyve/test_libvirtd_bhyve.aug.in \ + $(srcdir)/bhyve/bhyve.conf $(AUG_GENTEST) + $(AM_V_GEN)$(AUG_GENTEST) $(srcdir)/bhyve/bhyve.conf $< $@ + +check-augeas-bhyve: test_libvirtd_bhyve.aug + $(AM_V_GEN)if test -x '$(AUGPARSE)'; then \ + '$(AUGPARSE)' -I $(srcdir)/bhyve test_libvirtd_bhyve.aug; \ + fi +else ! WITH_BHYVE +check-augeas-bhyve: +endif ! WITH_BHYVE + test_virtlogd.aug: logging/test_virtlogd.aug.in \ logging/virtlogd.conf $(AUG_GENTEST) $(AM_V_GEN)$(AUG_GENTEST) $(srcdir)/logging/virtlogd.conf $< $@ diff --git a/src/bhyve/bhyve.conf b/src/bhyve/bhyve.conf new file mode 100644 index 000000000..2a8baacff --- /dev/null +++ b/src/bhyve/bhyve.conf @@ -0,0 +1,7 @@ +# Master configuration file for the bhyve driver. +# All settings described here are optional - if omitted, sensible +# defaults are used. + +# Path to a directory with firmware files. By default it's pointing +# to the directory that sysutils/bhyve-firmware installs files into. +#firmware_dir = "/usr/local/share/uefi-firmware" diff --git a/src/bhyve/bhyve_capabilities.c b/src/bhyve/bhyve_capabilities.c index 5e6094e3c..da06ba711 100644 --- a/src/bhyve/bhyve_capabilities.c +++ b/src/bhyve/bhyve_capabilities.c @@ -111,7 +111,8 @@ virBhyveCapsBuild(void) } virDomainCapsPtr -virBhyveDomainCapsBuild(const char *emulatorbin, +virBhyveDomainCapsBuild(bhyveConnPtr conn, + const char *emulatorbin, const char *machine, virArch arch, virDomainVirtType virttype) @@ -120,8 +121,9 @@ virBhyveDomainCapsBuild(const char *emulatorbin, unsigned int bhyve_caps = 0; DIR *dir; struct dirent *entry; - const char *firmware_dir = "/usr/local/share/uefi-firmware"; size_t firmwares_alloc = 0; + virBhyveDriverConfigPtr cfg = virBhyveDriverGetConfig(conn); + const char *firmware_dir = cfg->firmwareDir; if (!(caps = virDomainCapsNew(emulatorbin, machine, arch, virttype))) goto cleanup; @@ -152,7 +154,10 @@ virBhyveDomainCapsBuild(const char *emulatorbin, caps->os.loader.values.nvalues++; } + } else { + VIR_WARN("Cannot open firmware directory %s", firmware_dir); } + caps->disk.supported = true; VIR_DOMAIN_CAPS_ENUM_SET(caps->disk.diskDevice, VIR_DOMAIN_DISK_DEVICE_DISK, diff --git a/src/bhyve/bhyve_capabilities.h b/src/bhyve/bhyve_capabilities.h index 8fb97d730..3d8edb490 100644 --- a/src/bhyve/bhyve_capabilities.h +++ b/src/bhyve/bhyve_capabilities.h @@ -25,8 +25,11 @@ # include "capabilities.h" # include "conf/domain_capabilities.h" +# include "bhyve_conf.h" + virCapsPtr virBhyveCapsBuild(void); -virDomainCapsPtr virBhyveDomainCapsBuild(const char *emulatorbin, +virDomainCapsPtr virBhyveDomainCapsBuild(bhyveConnPtr, + const char *emulatorbin, const char *machine, virArch arch, virDomainVirtType virttype); diff --git a/src/bhyve/bhyve_conf.c b/src/bhyve/bhyve_conf.c new file mode 100644 index 000000000..b0b40c575 --- /dev/null +++ b/src/bhyve/bhyve_conf.c @@ -0,0 +1,112 @@ +/* + * bhyve_conf.c: bhyve config file + * + * Copyright (C) 2017 Roman Bogorodskiy + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + * + */ + +#include <config.h> + +#include "viralloc.h" +#include "virlog.h" +#include "virstring.h" +#include "bhyve_conf.h" +#include "configmake.h" + +#define VIR_FROM_THIS VIR_FROM_BHYVE + +VIR_LOG_INIT("bhyve.bhyve_conf"); + +static virClassPtr virBhyveDriverConfigClass; +static void virBhyveDriverConfigDispose(void *obj); + +static int virBhyveConfigOnceInit(void) +{ + if (!(virBhyveDriverConfigClass = virClassNew(virClassForObject(), + "virBhyveDriverConfig", + sizeof(virBhyveDriverConfig), + virBhyveDriverConfigDispose))) + return -1; + + return 0; +} + +VIR_ONCE_GLOBAL_INIT(virBhyveConfig) + +virBhyveDriverConfigPtr +virBhyveDriverConfigNew(void) +{ + virBhyveDriverConfigPtr cfg; + + if (virBhyveConfigInitialize() < 0) + return NULL; + + if (!(cfg = virObjectNew(virBhyveDriverConfigClass))) + return NULL; + + if (VIR_STRDUP(cfg->firmwareDir, DATADIR "/uefi-firmware") < 0) + goto error; + + return cfg; + + error: + virObjectUnref(cfg); + return NULL; +} + +int +virBhyveLoadDriverConfig(virBhyveDriverConfigPtr cfg, + const char *filename) +{ + virConfPtr conf; + int ret = -1; + + if (access(filename, R_OK) == -1) { + VIR_INFO("Could not read bhyve config file %s", filename); + return 0; + } + + if (!(conf = virConfReadFile(filename, 0))) + return -1; + + if (virConfGetValueString(conf, "firmware_dir", + &cfg->firmwareDir) < 0) + goto cleanup; + + ret = 0; + cleanup: + virConfFree(conf); + return ret; +} + +virBhyveDriverConfigPtr +virBhyveDriverGetConfig(bhyveConnPtr driver) +{ + virBhyveDriverConfigPtr cfg; + bhyveDriverLock(driver); + cfg = virObjectRef(driver->config); + bhyveDriverUnlock(driver); + return cfg; +} + +static void +virBhyveDriverConfigDispose(void *obj) +{ + virBhyveDriverConfigPtr cfg = obj; + + VIR_FREE(cfg->firmwareDir); +} diff --git a/src/bhyve/bhyve_conf.h b/src/bhyve/bhyve_conf.h new file mode 100644 index 000000000..3f105ace1 --- /dev/null +++ b/src/bhyve/bhyve_conf.h @@ -0,0 +1,32 @@ +/* + * bhyve_conf.h: bhyve config file + * + * Copyright (C) 2017 Roman Bogorodskiy + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + * + */ + +#ifndef BHYVE_CONF_H +# define BHYVE_CONF_H + +# include "bhyve_utils.h" + +virBhyveDriverConfigPtr virBhyveDriverConfigNew(void); +virBhyveDriverConfigPtr virBhyveDriverGetConfig(bhyveConnPtr driver); +int virBhyveLoadDriverConfig(virBhyveDriverConfigPtr cfg, + const char *filename); + +#endif /* BHYVE_CONF_H */ diff --git a/src/bhyve/bhyve_driver.c b/src/bhyve/bhyve_driver.c index 759825c28..3258c2720 100644 --- a/src/bhyve/bhyve_driver.c +++ b/src/bhyve/bhyve_driver.c @@ -55,6 +55,7 @@ #include "virhostmem.h" #include "conf/domain_capabilities.h" +#include "bhyve_conf.h" #include "bhyve_device.h" #include "bhyve_driver.h" #include "bhyve_command.h" @@ -1228,6 +1229,7 @@ bhyveStateCleanup(void) virSysinfoDefFree(bhyve_driver->hostsysinfo); virObjectUnref(bhyve_driver->closeCallbacks); virObjectUnref(bhyve_driver->domainEventState); + virObjectUnref(bhyve_driver->config); virMutexDestroy(&bhyve_driver->lock); VIR_FREE(bhyve_driver); @@ -1276,6 +1278,12 @@ bhyveStateInitialize(bool privileged, bhyve_driver->hostsysinfo = virSysinfoRead(); + if (!(bhyve_driver->config = virBhyveDriverConfigNew())) + goto cleanup; + + if (virBhyveLoadDriverConfig(bhyve_driver->config, SYSCONFDIR "/libvirt/bhyve.conf") < 0) + goto cleanup; + if (virFileMakePath(BHYVE_LOG_DIR) < 0) { virReportSystemError(errno, _("Failed to mkdir %s"), @@ -1657,7 +1665,8 @@ bhyveConnectGetDomainCapabilities(virConnectPtr conn, goto cleanup; } - if (!(caps = virBhyveDomainCapsBuild(emulatorbin, machine, arch, virttype))) + if (!(caps = virBhyveDomainCapsBuild(conn->privateData, emulatorbin, + machine, arch, virttype))) goto cleanup; ret = virDomainCapsFormat(caps); diff --git a/src/bhyve/bhyve_utils.h b/src/bhyve/bhyve_utils.h index 9a911608c..db50e012a 100644 --- a/src/bhyve/bhyve_utils.h +++ b/src/bhyve/bhyve_utils.h @@ -34,8 +34,20 @@ # define BHYVE_STATE_DIR LOCALSTATEDIR "/run/libvirt/bhyve" # define BHYVE_LOG_DIR LOCALSTATEDIR "/log/libvirt/bhyve" +typedef struct _virBhyveDriverConfig virBhyveDriverConfig; +typedef struct _virBhyveDriverConfig *virBhyveDriverConfigPtr; + +struct _virBhyveDriverConfig { + virObject parent; + + char *firmwareDir; +}; + struct _bhyveConn { virMutex lock; + + virBhyveDriverConfigPtr config; + virDomainObjListPtr domains; virCapsPtr caps; virDomainXMLOptionPtr xmlopt; diff --git a/src/bhyve/libvirtd_bhyve.aug b/src/bhyve/libvirtd_bhyve.aug new file mode 100644 index 000000000..66079376c --- /dev/null +++ b/src/bhyve/libvirtd_bhyve.aug @@ -0,0 +1,39 @@ +(* /etc/libvirt/bhyve.conf *) + +module Libvirtd_bhyve = + autoload xfm + + let eol = del /[ \t]*\n/ "\n" + let value_sep = del /[ \t]*=[ \t]*/ " = " + let indent = del /[ \t]*/ "" + + let array_sep = del /,[ \t\n]*/ ", " + let array_start = del /\[[ \t\n]*/ "[ " + let array_end = del /\]/ "]" + + let str_val = del /\"/ "\"" . store /[^\"]*/ . del /\"/ "\"" + let bool_val = store /0|1/ + let int_val = store /[0-9]+/ + let str_array_element = [ seq "el" . str_val ] . del /[ \t\n]*/ "" + let str_array_val = counter "el" . array_start . ( str_array_element . ( array_sep . str_array_element ) * ) ? . array_end + + let str_entry (kw:string) = [ key kw . value_sep . str_val ] + let bool_entry (kw:string) = [ key kw . value_sep . bool_val ] + let int_entry (kw:string) = [ key kw . value_sep . int_val ] + let str_array_entry (kw:string) = [ key kw . value_sep . str_array_val ] + + let log_entry = str_entry "firmware_dir" + + (* Each enty in the config is one of the following three ... *) + let entry = log_entry + let comment = [ label "#comment" . del /#[ \t]*/ "# " . store /([^ \t\n][^\n]*)?/ . del /\n/ "\n" ] + let empty = [ label "#empty" . eol ] + + let record = indent . entry . eol + + let lns = ( record | comment | empty ) * + + let filter = incl "/etc/libvirt/bhyve.conf" + . Util.stdexcl + + let xfm = transform lns filter diff --git a/src/bhyve/test_libvirtd_bhyve.aug.in b/src/bhyve/test_libvirtd_bhyve.aug.in new file mode 100644 index 000000000..f28e58614 --- /dev/null +++ b/src/bhyve/test_libvirtd_bhyve.aug.in @@ -0,0 +1,5 @@ +module Test_libvirtd_bhyve = + ::CONFIG:: + + test Libvirtd_bhyve.lns get conf = +{ "firmware_dir" = "/usr/local/share/uefi-firmware" } -- 2.11.0

3 3

[libvirt] [PATCH] docs: moved 'timestamps' and 'encryption' sub-element description in formatstorage doc
by Alexander Vasilenko 15 Mar '17

15 Mar '17

--- docs/formatstorage.html.in | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/docs/formatstorage.html.in b/docs/formatstorage.html.in index c787a059d..225e19000 100644 --- a/docs/formatstorage.html.in +++ b/docs/formatstorage.html.in @@ -456,24 +456,6 @@ will be filled with the values used by the existing directory. <span class="since">Since 1.2.16</span> </dd> - <dt><code>timestamps</code></dt> - <dd>Provides timing information about the volume. Up to four - sub-elements are present, - where <code>atime</code>, <code>btime</code>, <code>ctime</code> - and <code>mtime</code> hold the access, birth, change and - modification time of the volume, where known. The used time - format is <seconds>.<nanoseconds> since the - beginning of the epoch (1 Jan 1970). If nanosecond resolution - is 0 or otherwise unsupported by the host OS or filesystem, - then the nanoseconds part is omitted. This is a readonly - attribute and is ignored when creating a volume. - <span class="since">Since 0.10.0</span> - </dd> - <dt><code>encryption</code></dt> - <dd>If present, specifies how the volume is encrypted. See - the <a href="formatstorageencryption.html">Storage Encryption</a> page - for more information. - </dd> </dl> <h3><a name="StoragePoolExtents">Device extents</a></h3> @@ -658,6 +640,24 @@ will be filled with the values used by the existing file. <span class="since">Since 0.4.1</span> </dd> + <dt><code>timestamps</code></dt> + <dd>Provides timing information about the volume. Up to four + sub-elements are present, + where <code>atime</code>, <code>btime</code>, <code>ctime</code> + and <code>mtime</code> hold the access, birth, change and + modification time of the volume, where known. The used time + format is <seconds>.<nanoseconds> since the + beginning of the epoch (1 Jan 1970). If nanosecond resolution + is 0 or otherwise unsupported by the host OS or filesystem, + then the nanoseconds part is omitted. This is a readonly + attribute and is ignored when creating a volume. + <span class="since">Since 0.10.0</span> + </dd> + <dt><code>encryption</code></dt> + <dd>If present, specifies how the volume is encrypted. See + the <a href="formatstorageencryption.html">Storage Encryption</a> page + for more information. + </dd> <dt><code>compat</code></dt> <dd>Specify compatibility level. So far, this is only used for <code>type='qcow2'</code> volumes. Valid values are <code>0.10</code> -- 2.12.0

2 1

[libvirt] [PATCH] virtperf: Revert PERF_COUNT_HW_REF_CPU_CYCLES conditional
by Olaf Hering 15 Mar '17

15 Mar '17

All PERF_* names are enmus. Enums are ordinary code for CPP. An ifdef does not trigger. Fixes 1d29c889a ("Make use of PERF_COUNT_HW_REF_CPU_CYCLES conditional") Signed-off-by: Olaf Hering <olaf(a)aepfle.de> --- src/util/virperf.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/src/util/virperf.c b/src/util/virperf.c index e39cebbe0..33039544a 100644 --- a/src/util/virperf.c +++ b/src/util/virperf.c @@ -108,13 +108,8 @@ static struct virPerfEventAttr attrs[] = { .attrType = PERF_TYPE_HARDWARE, .attrConfig = PERF_COUNT_HW_STALLED_CYCLES_BACKEND}, {.type = VIR_PERF_EVENT_REF_CPU_CYCLES, -# ifdef PERF_COUNT_HW_REF_CPU_CYCLES .attrType = PERF_TYPE_HARDWARE, .attrConfig = PERF_COUNT_HW_REF_CPU_CYCLES -# else - .attrType = 0, - .attrConfig = 0, -# endif }, {.type = VIR_PERF_EVENT_CPU_CLOCK, .attrType = PERF_TYPE_SOFTWARE,

2 3

[libvirt] [PATCH] [Changelog]:If there is a process with a client which registers event callbacks, and it calls libvirt's API which uses the same virConnectPtr in that callback function. When this process exit abnormally lead to client disconnect, there is a possibility that the libvirtd's main thread is use virServerClient to send event just after the virServerClient been freed by job thread. Following is backtrace:
by xinhua.Cao 14 Mar '17

14 Mar '17

#0 0x00007fda223d66d8 in virClassIsDerivedFrom (klass=0xdeadbeef, parent=0x7fda24c81b40) at util/virobject.c:169 #1 0x00007fda223d6a1e in virObjectIsClass (anyobj=anyobj@entry=0x7fd9e575b400, klass=<optimized out>) at util/virobject.c:365 #2 0x00007fda223d6a44 in virObjectLock (anyobj=0x7fd9e575b400) at util/virobject.c:317 #3 0x00007fda22507f71 in virNetServerClientSendMessage (client=client@entry=0x7fd9e575b400, msg=msg@entry=0x7fd9ec30de90) at rpc/virnetserverclient.c:1422 #4 0x00007fda230d714d in remoteDispatchObjectEventSend (client=0x7fd9e575b400, program=0x7fda24c844e0, procnr=348, proc=0x7fda2310e5e0 <xdr_remote_domain_event_callback_tunable_msg>, data=0x7ffc3857fdb0) at remote.c:3803 #5 0x00007fda230dd71b in remoteRelayDomainEventTunable (conn=<optimized out>, dom=0x7fda27cd7660, params=0x7fda27f3aae0, nparams=1,opaque=0x7fd9e6c99e00) at remote.c:1033 #6 0x00007fda224484cb in virDomainEventDispatchDefaultFunc (conn=0x7fda27cd0120, event=0x7fda2736ea00, cb=0x7fda230dd610 <remoteRelayDomainEventTunable>, cbopaque=0x7fd9e6c99e00) at conf/domain_event.c:1910 #7 0x00007fda22446871 in virObjectEventStateDispatchCallbacks (callbacks=<optimized out>, callbacks=<optimized out>, event=0x7fda2736ea00,state=0x7fda24ca3960) at conf/object_event.c:722 #8 virObjectEventStateQueueDispatch (callbacks=0x7fda24c65800, queue=0x7ffc3857fe90, state=0x7fda24ca3960) at conf/object_event.c:736 #9 virObjectEventStateFlush (state=0x7fda24ca3960) at conf/object_event.c:814 #10 virObjectEventTimer (timer=<optimized out>, opaque=0x7fda24ca3960) at conf/object_event.c:560 #11 0x00007fda223ae8b9 in virEventPollDispatchTimeouts () at util/vireventpoll.c:458 #12 virEventPollRunOnce () at util/vireventpoll.c:654 #13 0x00007fda223ad1d2 in virEventRunDefaultImpl () at util/virevent.c:314 #14 0x00007fda225046cd in virNetDaemonRun (dmn=0x7fda24c775c0) at rpc/virnetdaemon.c:818 #15 0x00007fda230d6351 in main (argc=<optimized out>, argv=<optimized out>) at libvirtd.c:1623 Let's clean all event callback when client close. Signed-off-by: xinhua.Cao <caoxinhua(a)huawei.com> this patch resolved the bug which reported by Wang King. and the prior patch link is http://www.redhat.com/archives/libvir-list/2017-February/msg00452.html --- daemon/remote.c | 60 +++++++++++++++++++++++++++------------------------------ 1 file changed, 28 insertions(+), 32 deletions(-) diff --git a/daemon/remote.c b/daemon/remote.c index 4aa43c223..22330307f 100644 --- a/daemon/remote.c +++ b/daemon/remote.c @@ -100,6 +100,7 @@ static void make_nonnull_node_device(remote_nonnull_node_device *dev_dst, virNod static void make_nonnull_secret(remote_nonnull_secret *secret_dst, virSecretPtr secret_src); static void make_nonnull_nwfilter(remote_nonnull_nwfilter *net_dst, virNWFilterPtr nwfilter_src); static void make_nonnull_domain_snapshot(remote_nonnull_domain_snapshot *snapshot_dst, virDomainSnapshotPtr snapshot_src); +static void remoteClientCleanEventCallbacks(struct daemonClientPrivate *priv); static int remoteSerializeDomainDiskErrors(virDomainDiskErrorPtr errors, @@ -1389,24 +1390,15 @@ void remoteRelayConnectionClosedEvent(virConnectPtr conn ATTRIBUTE_UNUSED, int r &msg); } -/* - * You must hold lock for at least the client - * We don't free stuff here, merely disconnect the client's - * network socket & resources. - * We keep the libvirt connection open until any async - * jobs have finished, then clean it up elsewhere - */ -void remoteClientFreeFunc(void *data) +static void remoteClientCleanEventCallbacks(struct daemonClientPrivate *priv) { - struct daemonClientPrivate *priv = data; - /* Deregister event delivery callback */ - if (priv->conn) { - virIdentityPtr sysident = virIdentityGetSystem(); + if (priv && priv->conn) { size_t i; - + virIdentityPtr sysident = virIdentityGetSystem(); virIdentitySetCurrent(sysident); + virMutexLock(&priv->lock); for (i = 0; i < priv->ndomainEventCallbacks; i++) { int callbackID = priv->domainEventCallbacks[i]->callbackID; if (callbackID < 0) { @@ -1420,6 +1412,7 @@ void remoteClientFreeFunc(void *data) VIR_WARN("unexpected domain event deregister failure"); } VIR_FREE(priv->domainEventCallbacks); + priv->ndomainEventCallbacks = 0; for (i = 0; i < priv->nnetworkEventCallbacks; i++) { int callbackID = priv->networkEventCallbacks[i]->callbackID; @@ -1435,21 +1428,7 @@ void remoteClientFreeFunc(void *data) VIR_WARN("unexpected network event deregister failure"); } VIR_FREE(priv->networkEventCallbacks); - - for (i = 0; i < priv->nstorageEventCallbacks; i++) { - int callbackID = priv->storageEventCallbacks[i]->callbackID; - if (callbackID < 0) { - VIR_WARN("unexpected incomplete storage pool callback %zu", i); - continue; - } - VIR_DEBUG("Deregistering remote storage pool event relay %d", - callbackID); - priv->storageEventCallbacks[i]->callbackID = -1; - if (virConnectStoragePoolEventDeregisterAny(priv->conn, - callbackID) < 0) - VIR_WARN("unexpected storage pool event deregister failure"); - } - VIR_FREE(priv->storageEventCallbacks); + priv->nnetworkEventCallbacks = 0; for (i = 0; i < priv->nqemuEventCallbacks; i++) { int callbackID = priv->qemuEventCallbacks[i]->callbackID; @@ -1465,28 +1444,45 @@ void remoteClientFreeFunc(void *data) VIR_WARN("unexpected qemu monitor event deregister failure"); } VIR_FREE(priv->qemuEventCallbacks); + priv->nqemuEventCallbacks = 0; if (priv->closeRegistered) { if (virConnectUnregisterCloseCallback(priv->conn, remoteRelayConnectionClosedEvent) < 0) VIR_WARN("unexpected close callback event deregister failure"); } - - virConnectClose(priv->conn); - + virMutexUnlock(&priv->lock); virIdentitySetCurrent(NULL); virObjectUnref(sysident); } +} + + +/* + * You must hold lock for at least the client + * We don't free stuff here, merely disconnect the client's + * network socket & resources. + * We keep the libvirt connection open until any async + * jobs have finished, then clean it up elsewhere + */ +void remoteClientFreeFunc(void *data) +{ + struct daemonClientPrivate *priv = data; + if (!priv || !priv->conn) + return; + + remoteClientCleanEventCallbacks(priv); + virConnectClose(priv->conn); VIR_FREE(priv); } - static void remoteClientCloseFunc(virNetServerClientPtr client) { struct daemonClientPrivate *priv = virNetServerClientGetPrivateData(client); daemonRemoveAllClientStreams(priv->streams); + remoteClientCleanEventCallbacks(priv); } -- 2.12.0.windows.1

2 1

[libvirt] [PATCH 0/4] Prevent loosing IPv6 routes due to forwarding
by Cédric Bosdonnat 14 Mar '17

14 Mar '17

Hi all, When enabling IPv6 forwarding on hosts getting Router Advertised routes, the host looses the RA routes. To prevent this, check if the host has such routes. In case there are some, check that the accept_ra is set to 2 before bringing the network up. Cédric Bosdonnat (4): util: extract the request sending code from virNetlinkCommand() util: add virNetlinkDumpCommand() bridge_driver.c: more uses of SYSCTL_PATH network: check accept_ra before enabling ipv6 forwarding src/libvirt_private.syms | 1 + src/network/bridge_driver.c | 187 +++++++++++++++++++++++++++++++++++++++++--- src/util/virnetlink.c | 145 +++++++++++++++++++++++++--------- src/util/virnetlink.h | 9 +++ 4 files changed, 298 insertions(+), 44 deletions(-) -- 2.11.0

3 9

[libvirt] [PATCH] docs: document virt-host-validate bhyve support
by Roman Bogorodskiy 14 Mar '17

14 Mar '17

Add an entry about virt-host-validate bhyve support and update the driver's page. --- docs/drvbhyve.html.in | 13 ++++++++++++- docs/news.xml | 10 +++++++++- 2 files changed, 21 insertions(+), 2 deletions(-) diff --git a/docs/drvbhyve.html.in b/docs/drvbhyve.html.in index da6f1e0b2..64a1ff694 100644 --- a/docs/drvbhyve.html.in +++ b/docs/drvbhyve.html.in @@ -13,9 +13,20 @@ of bhyve are supported. In order to enable bhyve on your FreeBSD host, you'll need to load the <code>vmm</code> kernel module. Additionally, <code>if_tap</code> and <code>if_bridge</code> modules -should be loaded for networking support. +should be loaded for networking support. Also, <span class="since">since 3.2.0</span> the +<code>virt-host-validate(1)</code> supports the bhyve host validation and could be +used like this: </p> +<pre> +$ virt-host-validate bhyve + BHYVE: Checking for vmm module : PASS + BHYVE: Checking for if_tap module : PASS + BHYVE: Checking for if_bridge module : PASS + BHYVE: Checking for nmdm module : PASS +$ +</pre> + <p> Additional information on bhyve could be obtained on <a href="http://bhyve.org/">bhyve.org</a>. </p> diff --git a/docs/news.xml b/docs/news.xml index 951539575..57fafebb8 100644 --- a/docs/news.xml +++ b/docs/news.xml @@ -12,7 +12,15 @@ <libvirt> <release version="v3.2.0" date="unreleased"> <section title="New features"> - <change/> + <change> + <summary> + virt-host-validate: Add bhyve support + </summary> + <description> + Add support for validation of the bhyve hypervisor hosts + using the virt-host-validate tool. + </description> + </change> </section> <section title="Improvements"> <change> -- 2.11.0

2 2

[libvirt] [PATCH] Switch to GSSAPI (kerberos) instead of the insecure DIGEST-MD5
by Daniel P. Berrange 14 Mar '17

14 Mar '17

RFC 6331 documents a number of serious security weaknesses in the SASL DIGEST-MD5 mechanism. As such, libvirtd should not by using it as a default mechanism. GSSAPI is the only other viable SASL mechanism that can provide secure session encryption so enable that by defalt as the replacement. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- daemon/libvirtd.sasl | 44 +++++++++++++++++--------- docs/auth.html.in | 89 +++++++++++++++++++++++++++++++++++++++++----------- libvirt.spec.in | 6 ++-- 3 files changed, 102 insertions(+), 37 deletions(-) diff --git a/daemon/libvirtd.sasl b/daemon/libvirtd.sasl index 5e2528d..2be99ef 100644 --- a/daemon/libvirtd.sasl +++ b/daemon/libvirtd.sasl @@ -1,31 +1,45 @@ -# If you want to use the non-TLS socket, then you *must* include -# the GSSAPI or DIGEST-MD5 mechanisms, because they are the only -# ones that can offer session encryption as well as authentication. +# If you want to use the non-TLS socket, then you *must* pick a +# mechanism which provides session encryption as well as +# authentication. # -# If you're only using TLS, then you can turn on any mechanisms +# If you are only using TLS, then you can turn on any mechanisms # you like for authentication, because TLS provides the encryption # -# Default to a simple username+password mechanism -mech_list: digest-md5 +# If you are only using UNIX, sockets then encryption is not +# required at all. +# +# Since SASL is the default for the libvirtd non-TLS socket, we +# pick a strong mechanism by default. +# +# NB, previously DIGEST-MD5 was set as the default mechanism for +# libvirt. Per RFC 6331 this is vulnerable to many serious security +# flaws as should no longer be used. Thus GSSAPI is now the default. +# +# To use GSSAPI requires that a libvirtd service principal is +# added to the Kerberos server for each host running libvirtd. +# This principal needs to be exported to the keytab file listed below +mech_list: gssapi + +# If using a TLS socket or UNIX socket only, it is possible to +# enable plugins which don't provide session encryption. The +# 'scram-sha-1' plugin allows plain username/password authentication +# to be performed +# +#mech_list: scram-sha-1 -# Before you can use GSSAPI, you need a service principle on the -# KDC server for libvirt, and that to be exported to the keytab -# file listed below -#mech_list: gssapi # # You can also list many mechanisms at once, then the user can choose # by adding '?auth=sasl.gssapi' to their libvirt URI, eg # qemu+tcp://hostname/system?auth=sasl.gssapi -#mech_list: digest-md5 gssapi +#mech_list: scram-sha-1 gssapi # Some older builds of MIT kerberos on Linux ignore this option & # instead need KRB5_KTNAME env var. # For modern Linux, and other OS, this should be sufficient # -# There is no default value here, uncomment if you need this -#keytab: /etc/libvirt/krb5.tab +keytab: /etc/libvirt/krb5.tab -# If using digest-md5 for username/passwds, then this is the file +# If using scram-sha-1 for username/passwds, then this is the file # containing the passwds. Use 'saslpasswd2 -a libvirt [username]' # to add entries, and 'sasldblistusers2 -f [sasldb_path]' to browse it -sasldb_path: /etc/libvirt/passwd.db +#sasldb_path: /etc/libvirt/passwd.db diff --git a/docs/auth.html.in b/docs/auth.html.in index 08feacc..9f2e317 100644 --- a/docs/auth.html.in +++ b/docs/auth.html.in @@ -204,16 +204,71 @@ ResultActive=yes</pre> Further examples of PolicyKit setup can be found on the <a href="http://wiki.libvirt.org/page/SSHPolicyKitSetup">wiki page</a>. </p> - <h2><a name="ACL_server_username">Username/password auth</a></h2> + <h2><a name="ACL_server_sasl">SASL pluggable authentication</a></h2> + <p> -The plain TCP socket of the libvirt daemon defaults to using SASL for authentication. -The SASL mechanism configured by default is DIGEST-MD5, which provides a basic -username+password style authentication. It also provides for encryption of the data -stream, so the security of the plain TCP socket is on a par with that of the TLS -socket. If desired the UNIX socket and TLS socket can also have SASL enabled by -setting the <code>auth_unix_ro</code>, <code>auth_unix_rw</code>, <code>auth_tls</code> -config params in <code>libvirt.conf</code>. -</p> +Libvirt integrates with the cyrus-sasl library to provide a pluggable authentication +system using the SASL protocol. SASL can be used in combination with libvirtd's TLS +or TCP socket listeners. When used with the TCP listener, the SASL mechanism is +rqeuired to provide session encryption in addition to authentication. Only a very +few SASL mechanisms are able todo this, and of those that can do it, only the +GSSAPI plugin is considered acceptably secure by modern standards: + </p> + + <dl> + <dt>GSSAPI</dt> + <dd><strong>This is the current default mechanism to use with libvirtd</strong>. + It uses the Kerberos v5 authentication protocol underneath, and assuming + the Kerberos client/server are configured with modern ciphers (AES), + it provides strong session encryption capabilities.</dd> + + <dt>DIGEST-MD5</dt> + <dd>This was previously set as the default mechanism to use with libvirtd. + It provides a simple username/password based authentication mechanism + that includes session encryption. + <a href="https://tools.ietf.org/html/rfc6331">RFC 6331</a>, however, + documents a number of serious security flaws with DIGEST-MD5 and as a + result marks it as <code>OBSOLETE</code>. Specific concerns are that + it is vulnerable to MITM attacks and the MD5 hash can be brute-forced + to reveal the password. A replacement is provided via the SCRAM mechanism, + however, note that this is does not provide encryption, so the SCRAM + mechanism can only be used on the libvirtd TLS listener. + </dd> + + <dt>PASSDSS-3DES-1</dt> + <dd>This provides a simple username/password based authentication + mechanism that includes session encryption. The current cyrus-sasl + implementation does not provide a way to validate the server's + public key identity, thus it is susceptible to a MITM attacker + impersonating the server.</dd> + + <dt>KERBEROS_V4</dt> + <dd>This uses the obsolete Kerberos v4 protocol to provide both authentication + and session encryption. Kerberos v4 protocol has been obsolete since the + early 1990's and has known security vulnerabilities so this will never be + used in practice.</dd> + </dl> + + <p> + Other SASL mechanisms, not listed above, can only be used when the libvirtd + TLS or UNIX socket listeners. + </p> + + <h3><a name="ACL_server_username">Username/password auth</a></h3> + <p> +As noted above, the DIGEST-MD5 mechanism is considered obsolete and should +not be used anymore. To provide a simple username/password auth scheme on +the libvirt UNIX socket or TLS listeners, however, it is possible to use +the SCRAM mechanism. The <code>auth_unix_ro</code>, <code>auth_unix_rw</code>, +<code>auth_tls</code> config params in <code>libvirt.conf</code> can be used +to turn on SASL auth in these listeners. + </p> + <p> +Since the libvirt SASL config file defaults to using GSSAPI (Kerberos), a +config change is rquired to enable plain password auth. This is done by +editting <code>/etc/sasl2/libvirt.conf</code> to set the <code>mech_list</code> +parameter to <code>scram-sha-1</code>. + </p> <p> Out of the box, no user accounts are defined, so no clients will be able to authenticate on the TCP socket. Adding users and setting their passwords is done with the <code>saslpasswd2</code> @@ -241,17 +296,13 @@ again: <pre> # saslpasswd2 -a libvirt -d fred </pre> - <h2><a name="ACL_server_kerberos">Kerberos auth</a></h2> + <h3><a name="ACL_server_kerberos">GSSAPI/Kerberos auth</a></h3> <p> -The plain TCP socket of the libvirt daemon defaults to using SASL for authentication. -The SASL mechanism configured by default is DIGEST-MD5, which provides a basic -username+password style authentication. To enable Kerberos single-sign-on instead, -the libvirt SASL configuration file must be changed. This is <code>/etc/sasl2/libvirt.conf</code>. -The <code>mech_list</code> parameter must first be changed to <code>gssapi</code> -instead of the default <code>digest-md5</code>, and keytab should be set to -<code>/etc/libvirt/krb5.tab</code> . If SASL is enabled on the UNIX -and/or TLS sockets, Kerberos will also be used for them. Like DIGEST-MD5, the Kerberos -mechanism provides data encryption of the session. +The plain TCP listener of the libvirt daemon defaults to using SASL for authentication. +The libvirt SASL config also defaults to GSSAPI, so there is no need to edit the +SASL config when using GSSAPI. If the libvirtd TLS or UNIX listeners are used, +then the Kerberos session encryption will be disabled since it is not required +in these scenarios - only the plain TCP listener needs encryption </p> <p> Some operating systems do not install the SASL kerberos plugin by default. It diff --git a/libvirt.spec.in b/libvirt.spec.in index 57ac88e..1d24985 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -979,9 +979,9 @@ Group: Development/Libraries # (client invokes 'nc' against the UNIX socket on the server) Requires: nc Requires: cyrus-sasl -# Not technically required, but makes 'out-of-box' config -# work correctly & doesn't have onerous dependencies -Requires: cyrus-sasl-md5 +# Needed by default sasl.conf - no onerous extra deps, since +# 100's of other things on a system already pull in krb5-libs +Requires: cyrus-sasl-gssapi %description libs Shared libraries for accessing the libvirt daemon. -- 2.9.3

3 2

[libvirt] [PATCH 0/7] qemu: Report better host-model CPUs in domain caps
by Jiri Denemark 13 Mar '17

13 Mar '17

One of the main reasons for introducing host-model CPU definition in a domain capabilities XML was the inability to express disabled features in a host capabilities XML. That is, when a host CPU is, e.g., Haswell without x2apic support, host capabilities XML will have to report it as Westmere + a bunch of additional features., but we really want to use Haswell - x2apic when creating a host-model CPU. Unfortunately, I somehow forgot to do the last step and the code would just copy the CPU definition found in the host capabilities XML. This changed recently for new QEMU versions which allow us to query host CPU, but any slightly older QEMU will not benefit from any change I did. This patch makes sure the right CPU model is filled in the domain capabilities even with old QEMU. The issue was reported in https://bugzilla.redhat.com/show_bug.cgi?id=1426456 Jiri Denemark (7): Do not format <arch> in guest CPU XML cpu: Replace cpuNodeData with virCPUGetHost cpu: Add virCPUType parameter to virCPUGetHost cpu: Add list of allowed CPU models to virCPUGetHost qemu: Refactor virQEMUCapsInitCPU qemu: Report better host-model CPUs in domain caps cputest: New test for Intel Core i7-4510U src/bhyve/bhyve_capabilities.c | 35 +--- src/conf/cpu_conf.c | 2 +- src/cpu/cpu.c | 100 ++++++++-- src/cpu/cpu.h | 16 +- src/cpu/cpu_arm.c | 1 - src/cpu/cpu_ppc64.c | 30 +-- src/cpu/cpu_s390.c | 1 - src/cpu/cpu_x86.c | 29 ++- src/libvirt_private.syms | 2 +- src/qemu/qemu_capabilities.c | 61 +++---- src/qemu/qemu_capspriv.h | 5 + src/vmware/vmware_conf.c | 20 +- src/vz/vz_driver.c | 22 +-- tests/Makefile.am | 11 +- tests/cputest.c | 1 + tests/cputestdata/x86_64-cpuid-A10-5800K-guest.xml | 1 - tests/cputestdata/x86_64-cpuid-A10-5800K-json.xml | 1 - tests/cputestdata/x86_64-cpuid-Atom-D510-guest.xml | 1 - tests/cputestdata/x86_64-cpuid-Atom-N450-guest.xml | 1 - .../x86_64-cpuid-Core-i5-2500-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Core-i5-2500-json.xml | 1 - .../x86_64-cpuid-Core-i5-2540M-guest.xml | 1 - .../x86_64-cpuid-Core-i5-2540M-json.xml | 1 - .../x86_64-cpuid-Core-i5-4670T-guest.xml | 1 - .../x86_64-cpuid-Core-i5-4670T-json.xml | 1 - .../x86_64-cpuid-Core-i5-6600-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Core-i5-6600-json.xml | 1 - .../x86_64-cpuid-Core-i7-2600-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Core-i7-2600-json.xml | 1 - .../x86_64-cpuid-Core-i7-3520M-guest.xml | 1 - .../x86_64-cpuid-Core-i7-3740QM-guest.xml | 1 - .../x86_64-cpuid-Core-i7-3740QM-json.xml | 1 - .../x86_64-cpuid-Core-i7-3770-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Core-i7-3770-json.xml | 1 - .../x86_64-cpuid-Core-i7-4510U-guest.xml | 29 +++ .../x86_64-cpuid-Core-i7-4510U-host.xml | 44 +++++ .../x86_64-cpuid-Core-i7-4510U-json.xml | 15 ++ tests/cputestdata/x86_64-cpuid-Core-i7-4510U.json | 203 +++++++++++++++++++++ tests/cputestdata/x86_64-cpuid-Core-i7-4510U.xml | 34 ++++ .../x86_64-cpuid-Core-i7-4600U-guest.xml | 1 - .../x86_64-cpuid-Core-i7-4600U-json.xml | 1 - .../x86_64-cpuid-Core-i7-5600U-guest.xml | 1 - .../x86_64-cpuid-Core-i7-5600U-json.xml | 1 - .../cputestdata/x86_64-cpuid-Core2-E6850-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Core2-E6850-json.xml | 1 - .../cputestdata/x86_64-cpuid-Core2-Q9500-guest.xml | 1 - tests/cputestdata/x86_64-cpuid-FX-8150-guest.xml | 1 - .../x86_64-cpuid-Opteron-1352-guest.xml | 1 - .../x86_64-cpuid-Opteron-2350-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Opteron-2350-json.xml | 1 - .../x86_64-cpuid-Opteron-6234-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Opteron-6234-json.xml | 1 - .../x86_64-cpuid-Opteron-6282-guest.xml | 1 - .../x86_64-cpuid-Pentium-P6100-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Phenom-B95-guest.xml | 1 - tests/cputestdata/x86_64-cpuid-Phenom-B95-json.xml | 1 - tests/cputestdata/x86_64-cpuid-Xeon-5110-guest.xml | 1 - .../x86_64-cpuid-Xeon-E3-1245-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Xeon-E3-1245-json.xml | 1 - .../x86_64-cpuid-Xeon-E5-2630-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Xeon-E5-2630-json.xml | 1 - .../x86_64-cpuid-Xeon-E5-2650-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Xeon-E5-2650-json.xml | 1 - .../x86_64-cpuid-Xeon-E7-4820-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Xeon-E7-4820-json.xml | 1 - .../x86_64-cpuid-Xeon-E7-8890-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Xeon-W3520-guest.xml | 1 - tests/cputestdata/x86_64-cpuid-Xeon-W3520-json.xml | 1 - .../cputestdata/x86_64-cpuid-Xeon-X5460-guest.xml | 1 - tests/domaincapstest.c | 6 + tests/qemucpumock.c | 35 ++++ tests/qemuxml2argvtest.c | 6 +- 72 files changed, 560 insertions(+), 197 deletions(-) create mode 100644 tests/cputestdata/x86_64-cpuid-Core-i7-4510U-guest.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Core-i7-4510U-host.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Core-i7-4510U-json.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Core-i7-4510U.json create mode 100644 tests/cputestdata/x86_64-cpuid-Core-i7-4510U.xml create mode 100644 tests/qemucpumock.c -- 2.12.0

2 8

[libvirt] [PATCH] qemuDomainBuildNamespace: Handle file mount points
by Michal Privoznik 13 Mar '17

13 Mar '17

https://bugzilla.redhat.com/show_bug.cgi?id=1431112 Yeah, that's right. A mount point doesn't have to be a directory. It can be a file too. However, the code that tries to preserve mount points under /dev for new namespace for qemu does not count with that option. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_domain.c | 37 +++++++++++++++++++++++++++++++++---- 1 file changed, 33 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index d5833b026..07ce22417 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -7741,10 +7741,21 @@ qemuDomainBuildNamespace(virQEMUDriverConfigPtr cfg, /* Save some mount points because we want to share them with the host */ for (i = 0; i < ndevMountsPath; i++) { + struct stat sb; + if (devMountsSavePath[i] == devPath) continue; - if (virFileMakePath(devMountsSavePath[i]) < 0) { + if (stat(devMountsPath[i], &sb) < 0) { + virReportSystemError(errno, + _("Unable to stat: %s"), + devMountsPath[i]); + goto cleanup; + } + + /* At this point, devMountsPath is either a regular file or a directory. */ + if ((S_ISDIR(sb.st_mode) && virFileMakePath(devMountsSavePath[i]) < 0) || + (S_ISREG(sb.st_mode) && virFileTouch(devMountsSavePath[i], sb.st_mode) < 0)) { virReportSystemError(errno, _("Failed to create %s"), devMountsSavePath[i]); @@ -7780,15 +7791,33 @@ qemuDomainBuildNamespace(virQEMUDriverConfigPtr cfg, goto cleanup; for (i = 0; i < ndevMountsPath; i++) { + struct stat sb; + if (devMountsSavePath[i] == devPath) continue; - if (virFileMakePath(devMountsPath[i]) < 0) { - virReportSystemError(errno, _("Cannot create %s"), - devMountsPath[i]); + if (stat(devMountsSavePath[i], &sb) < 0) { + virReportSystemError(errno, + _("Unable to stat: %s"), + devMountsSavePath[i]); goto cleanup; } + if (S_ISDIR(sb.st_mode)) { + if (virFileMakePath(devMountsPath[i]) < 0) { + virReportSystemError(errno, _("Cannot create %s"), + devMountsPath[i]); + goto cleanup; + } + } else { + if (virFileMakeParentPath(devMountsPath[i]) < 0 || + virFileTouch(devMountsPath[i], sb.st_mode) < 0) { + virReportSystemError(errno, _("Cannot create %s"), + devMountsPath[i]); + goto cleanup; + } + } + if (virFileMoveMount(devMountsSavePath[i], devMountsPath[i]) < 0) goto cleanup; } -- 2.11.0

2 1