- Devel - libvirt List Archives

[libvirt] [PATCHv5 0/8] bulk stats: QEMU implementation
by Francesco Romani 25 Sep '14

25 Sep '14

This patchset enhances the QEMU support for the new bulk stats API to include equivalents of these APIs: virDomainBlockInfo virDomainGetInfo - for balloon stats virDomainGetCPUStats virDomainBlockStatsFlags virDomainInterfaceStats virDomainGetVcpusFlags virDomainGetVcpus This subset of API is the one oVirt relies on. Scale/stress test on an oVirt test environment is in progress. The patchset is organized as follows: - the first patch enhances the internal stats gathering API to accomodate the needs of the groups which extract information using QEMU monitor jobs. - the next five patches implement the bulk stats groups, extracting helpers where do refactoring to extract internal helpers every time it is feasible and convenient. - the seventh patch enhances the virsh domstats command with options to use the new bulk stats. - the last patch enhances the block stats group adding the wr_highest_offset information, needed by oVirt for thin provisioned disks. ChangeLog v5: address reviewer's comment - Eric pointed out a possible flaw in balloon stats if QEMU monitor needs to be queried. A proper fix require further discussion and API changes (possbily just a new flag); However, since the balloon event is available in QEMU >= 1.2, I just dropped the query and relied on the event instead. Support for older QEMUs will be reintroduced, if needed, with following patches. - fix: per-domain monitor check and reporting. (pointed out by Peter) - reset last error when fail silently. (pointed out by Peter) v4: address reviewer's comment - addressed reviewers comments (Peter, Wang Rui). - pushed domain check into group stats functions. This follows the strategy to gather and report as much data as possible, silently skipping errors along the way. - moved the block allocation patch to the end of the series. v3: more polishing and fixes after first review - addressed Eric's comments. - squashed patches which extracts helpers with patches which use them. - changed gathering strategy: now code tries to reap as much information as possible instead to give up and bail out with error. Only critical errors cause the bulk stats to fail. - moved away from the transfer semantics. I find it error-prone and not flexible enough, I'd like to avoid as much as possible. - rearranged helpers to have one single QEMU query job with many monitor jobs nested inside. - fixed docs. - implemented missing virsh domstats bits. in v2: polishing and optimizations. - incorporated feedback from Li Wei (thanks). - added documentation. - optimized block group to gather all the information with just one call to QEMU monitor. - stripped to bare bones merged the 'block info' group into the 'block' group - oVirt actually needs just one stat from there. - reorganized the keys to be more consistent and shorter. Francesco Romani (8): qemu: bulk stats: extend internal collection API qemu: bulk stats: implement CPU stats group qemu: bulk stats: implement balloon group qemu: bulk stats: implement VCPU group qemu: bulk stats: implement interface group qemu: bulk stats: implement block group virsh: add options to query bulk stats group qemu: bulk stats: add block allocation information include/libvirt/libvirt.h.in | 5 + src/libvirt.c | 61 +++++ src/qemu/qemu_driver.c | 530 +++++++++++++++++++++++++++++++++++++------ src/qemu/qemu_monitor.c | 26 +++ src/qemu/qemu_monitor.h | 21 ++ src/qemu/qemu_monitor_json.c | 227 +++++++++++++----- src/qemu/qemu_monitor_json.h | 4 + tools/virsh-domain-monitor.c | 35 +++ tools/virsh.pod | 4 +- 9 files changed, 777 insertions(+), 136 deletions(-) -- 1.9.3

4 26

[libvirt] [PATCH] polkit_driver: fix possible segfault
by Pavel Hrdina 25 Sep '14

25 Sep '14

The changes in commit c7542573 introduced a segfault. Found by coverity. Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/access/viraccessdriverpolkit.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/access/viraccessdriverpolkit.c b/src/access/viraccessdriverpolkit.c index 2bc1842..2fd4fed 100644 --- a/src/access/viraccessdriverpolkit.c +++ b/src/access/viraccessdriverpolkit.c @@ -87,6 +87,12 @@ virAccessDriverPolkitGetCaller(const char *actionid, actionid); return -1; } + if (!pid) { + virAccessError(VIR_ERR_INTERNAL_ERROR, "%s", + _("No UNIX process ID available")); + goto cleanup; + } + if (virIdentityGetUNIXProcessID(identity, pid) < 0) goto cleanup; if (virIdentityGetUNIXProcessTime(identity, startTime) < 0) @@ -94,12 +100,6 @@ virAccessDriverPolkitGetCaller(const char *actionid, if (virIdentityGetUNIXUserID(identity, uid) < 0) goto cleanup; - if (!pid) { - virAccessError(VIR_ERR_INTERNAL_ERROR, "%s", - _("No UNIX process ID available")); - goto cleanup; - } - if (virIdentityGetUNIXProcessTime(identity, startTime) < 0) goto cleanup; -- 1.8.5.5

3 3

[libvirt] [PATCH] blkdeviotune: trigger tunable event for blkdeviotune updates
by Pavel Hrdina 25 Sep '14

25 Sep '14

With the blkdeviotune event this patch also fixes a bug that the updated live values weren't saved to the live XML so they won't survive restarting the libvirtd. Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- include/libvirt/libvirt.h.in | 56 ++++++++++++++++++++++++++++++++++++++++++++ src/qemu/qemu_driver.c | 54 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 110 insertions(+) diff --git a/include/libvirt/libvirt.h.in b/include/libvirt/libvirt.h.in index 898f8b5..32930e2 100644 --- a/include/libvirt/libvirt.h.in +++ b/include/libvirt/libvirt.h.in @@ -5262,6 +5262,61 @@ typedef void (*virConnectDomainEventDeviceRemovedCallback)(virConnectPtr conn, */ #define VIR_DOMAIN_EVENT_CPUTUNE_EMULATOR_QUOTA "cputune.emulator_quota" +/** + * VIR_DOMAIN_EVENT_BLKDEVIOTUNE_DISK: + * + * Macro represents the name of guest disk for which the values are updated, + * as VIR_TYPED_PARAM_STRING. + */ +#define VIR_DOMAIN_EVENT_BLKDEVIOTUNE_DISK "blkdeviotune.disk" + +/** + * VIR_DOMAIN_EVENT_BLKDEVIOTUNE_TOTAL_BYTES_SEC: + * + * Marco represents the total throughput limit in bytes per second, + * as VIR_TYPED_PARAM_ULLONG. + */ +#define VIR_DOMAIN_EVENT_BLKDEVIOTUNE_TOTAL_BYTES_SEC "blkdeviotune.total_bytes_sec" + +/** + * VIR_DOMAIN_EVENT_BLKDEVIOTUNE_READ_BYTES_SEC: + * + * Marco represents the read throughput limit in bytes per second, + * as VIR_TYPED_PARAM_ULLONG. + */ +#define VIR_DOMAIN_EVENT_BLKDEVIOTUNE_READ_BYTES_SEC "blkdeviotune.read_bytes_sec" + +/** + * VIR_DOMAIN_EVENT_BLKDEVIOTUNE_WRITE_BYTES_SEC: + * + * Macro represents the write throughput limit in bytes per second, + * as VIR_TYPED_PARAM_ULLONG. + */ +#define VIR_DOMAIN_EVENT_BLKDEVIOTUNE_WRITE_BYTES_SEC "blkdeviotune.write_bytes_sec" + +/** + * VIR_DOMAIN_EVENT_BLKDEVIOTUNE_TOTAL_IOPS_SEC: + * + * Macro represents the total I/O operations per second, + * as VIR_TYPED_PARAM_ULLONG. + */ +#define VIR_DOMAIN_EVENT_BLKDEVIOTUNE_TOTAL_IOPS_SEC "blkdeviotune.total_iops_sec" + +/** + * VIR_DOMAIN_EVENT_BLKDEVIOTUNE_READ_IOPS_SEC: + * + * Macro represents the read I/O operations per second, + * as VIR_TYPED_PARAM_ULLONG. + */ +#define VIR_DOMAIN_EVENT_BLKDEVIOTUNE_READ_IOPS_SEC "blkdeviotune.read_iops_sec" + +/** + * VIR_DOMAIN_EVENT_BLKDEVIOTUNE_WRITE_IOPS_SEC: + * + * Macro represents the write I/O operations per second, + * as VIR_TYPED_PARAM_ULLONG. + */ +#define VIR_DOMAIN_EVENT_BLKDEVIOTUNE_WRITE_IOPS_SEC "blkdeviotune.write_iops_sec" /** * virConnectDomainEventTunableCallback: @@ -5277,6 +5332,7 @@ typedef void (*virConnectDomainEventDeviceRemovedCallback)(virConnectPtr conn, * * Currently supported name spaces: * "cputune.*" + * "blkdeviotune.*" * * The callback signature to use when registering for an event of type * VIR_DOMAIN_EVENT_ID_TUNABLE with virConnectDomainEventRegisterAny() diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index d1a0657..173333a 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -16274,6 +16274,10 @@ qemuDomainSetBlockIoTune(virDomainPtr dom, bool set_iops = false; virQEMUDriverConfigPtr cfg = NULL; virCapsPtr caps = NULL; + virObjectEventPtr event = NULL; + virTypedParameterPtr eventParams = NULL; + int eventNparams = 0; + int eventMaxparams = 0; virCheckFlags(VIR_DOMAIN_AFFECT_LIVE | VIR_DOMAIN_AFFECT_CONFIG, -1); @@ -16315,6 +16319,10 @@ qemuDomainSetBlockIoTune(virDomainPtr dom, &persistentDef) < 0) goto endjob; + if (virTypedParamsAddString(&eventParams, &eventNparams, &eventMaxparams, + VIR_DOMAIN_EVENT_BLKDEVIOTUNE_DISK, disk) < 0) + goto endjob; + for (i = 0; i < nparams; i++) { virTypedParameterPtr param = &params[i]; @@ -16328,26 +16336,56 @@ qemuDomainSetBlockIoTune(virDomainPtr dom, if (STREQ(param->field, VIR_DOMAIN_BLOCK_IOTUNE_TOTAL_BYTES_SEC)) { info.total_bytes_sec = param->value.ul; set_bytes = true; + if (virTypedParamsAddULLong(&eventParams, &eventNparams, + &eventMaxparams, + VIR_DOMAIN_EVENT_BLKDEVIOTUNE_TOTAL_BYTES_SEC, + param->value.ul) < 0) + goto endjob; } else if (STREQ(param->field, VIR_DOMAIN_BLOCK_IOTUNE_READ_BYTES_SEC)) { info.read_bytes_sec = param->value.ul; set_bytes = true; + if (virTypedParamsAddULLong(&eventParams, &eventNparams, + &eventMaxparams, + VIR_DOMAIN_EVENT_BLKDEVIOTUNE_READ_BYTES_SEC, + param->value.ul) < 0) + goto endjob; } else if (STREQ(param->field, VIR_DOMAIN_BLOCK_IOTUNE_WRITE_BYTES_SEC)) { info.write_bytes_sec = param->value.ul; set_bytes = true; + if (virTypedParamsAddULLong(&eventParams, &eventNparams, + &eventMaxparams, + VIR_DOMAIN_EVENT_BLKDEVIOTUNE_WRITE_BYTES_SEC, + param->value.ul) < 0) + goto endjob; } else if (STREQ(param->field, VIR_DOMAIN_BLOCK_IOTUNE_TOTAL_IOPS_SEC)) { info.total_iops_sec = param->value.ul; set_iops = true; + if (virTypedParamsAddULLong(&eventParams, &eventNparams, + &eventMaxparams, + VIR_DOMAIN_EVENT_BLKDEVIOTUNE_TOTAL_IOPS_SEC, + param->value.ul) < 0) + goto endjob; } else if (STREQ(param->field, VIR_DOMAIN_BLOCK_IOTUNE_READ_IOPS_SEC)) { info.read_iops_sec = param->value.ul; set_iops = true; + if (virTypedParamsAddULLong(&eventParams, &eventNparams, + &eventMaxparams, + VIR_DOMAIN_EVENT_BLKDEVIOTUNE_READ_IOPS_SEC, + param->value.ul) < 0) + goto endjob; } else if (STREQ(param->field, VIR_DOMAIN_BLOCK_IOTUNE_WRITE_IOPS_SEC)) { info.write_iops_sec = param->value.ul; set_iops = true; + if (virTypedParamsAddULLong(&eventParams, &eventNparams, + &eventMaxparams, + VIR_DOMAIN_EVENT_BLKDEVIOTUNE_WRITE_IOPS_SEC, + param->value.ul) < 0) + goto endjob; } } @@ -16405,6 +16443,20 @@ qemuDomainSetBlockIoTune(virDomainPtr dom, if (ret < 0) goto endjob; vm->def->disks[idx]->blkdeviotune = info; + + ret = virDomainSaveStatus(driver->xmlopt, cfg->stateDir, vm); + if (ret < 0) { + virReportError(VIR_ERR_OPERATION_FAILED, "%s", + _("Saving live XML config failed")); + goto endjob; + } + + if (eventNparams) { + event = virDomainEventTunableNewFromDom(dom, eventParams, eventNparams); + eventNparams = 0; + if (event) + qemuDomainEventQueue(driver, event); + } } if (flags & VIR_DOMAIN_AFFECT_CONFIG) { @@ -16437,6 +16489,8 @@ qemuDomainSetBlockIoTune(virDomainPtr dom, VIR_FREE(device); if (vm) virObjectUnlock(vm); + if (eventNparams) + virTypedParamsFree(eventParams, eventNparams); virObjectUnref(caps); virObjectUnref(cfg); return ret; -- 1.8.5.5

2 3

[libvirt] [PATCH] Fix build without polkit
by Pavel Hrdina 25 Sep '14

25 Sep '14

The commit 1b854c76 introduced a new function 'virPolkitCheckAuth' and in the #else section when you don't have polkit all attributes should be follwed by ATTRIBUTE_UNUSED. Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- Pushed as build breaker. src/util/virpolkit.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/util/virpolkit.c b/src/util/virpolkit.c index 203bd6e..f4ea736 100644 --- a/src/util/virpolkit.c +++ b/src/util/virpolkit.c @@ -238,12 +238,12 @@ int virPolkitCheckAuth(const char *actionid, #else /* ! WITH_POLKIT1 && ! WITH_POLKIT0 */ -int virPolkitCheckAuth(const char *actionid, - pid_t pid, - unsigned long long startTime, - uid_t uid, - const char **details, - bool allowInteraction) +int virPolkitCheckAuth(const char *actionid ATTRIBUTE_UNUSED, + pid_t pid ATTRIBUTE_UNUSED, + unsigned long long startTime ATTRIBUTE_UNUSED, + uid_t uid ATTRIBUTE_UNUSED, + const char **details ATTRIBUTE_UNUSED, + bool allowInteraction ATTRIBUTE_UNUSED) { VIR_ERROR(_("Polkit auth attempted, even though polkit is not available")); virReportError(VIR_ERR_AUTH_FAILED, "%s", -- 1.8.5.5

1 0

[libvirt] [PATCH 0/4] Add API to manipulate huge pages pool
by Michal Privoznik 25 Sep '14

25 Sep '14

This may seem like a cherry on top of the cake, but once we allow guests to use huge pages we must allow admins to allocate ones. Michal Privoznik (4): Introduce virNodeAllocPages virnuma: Introduce virNumaSetPagePoolSize nodeinfo: Implement nodeAllocPages virsh: Expose virNodeAllocPages daemon/remote.c | 37 ++++++++++++ include/libvirt/libvirt.h.in | 16 ++++++ src/driver.h | 10 ++++ src/libvirt.c | 67 ++++++++++++++++++++++ src/libvirt_private.syms | 2 + src/libvirt_public.syms | 1 + src/lxc/lxc_driver.c | 22 +++++++ src/nodeinfo.c | 29 ++++++++++ src/nodeinfo.h | 7 +++ src/qemu/qemu_driver.c | 22 +++++++ src/remote/remote_driver.c | 47 +++++++++++++++ src/remote/remote_protocol.x | 20 ++++++- src/remote_protocol-structs | 17 ++++++ src/uml/uml_driver.c | 22 +++++++ src/util/virnuma.c | 108 ++++++++++++++++++++++++++++++++++ src/util/virnuma.h | 4 ++ src/vbox/vbox_common.c | 19 ++++++ tools/virsh-host.c | 134 +++++++++++++++++++++++++++++++++++++++++++ tools/virsh.pod | 12 ++++ 19 files changed, 595 insertions(+), 1 deletion(-) -- 1.8.5.5

3 7

[libvirt] [PATCH] tunable_event: extend debug message and tweak limit for remote message
by Pavel Hrdina 25 Sep '14

25 Sep '14

It would be nice to also print a params pointer and number of params in the debug message and the previous limit for number of params in the rpc message was too large. The 2048 params will be enough for future events. Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- daemon/remote.c | 4 ++-- src/remote/remote_protocol.x | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/daemon/remote.c b/daemon/remote.c index ddd510c..9884bae 100644 --- a/daemon/remote.c +++ b/daemon/remote.c @@ -990,8 +990,8 @@ remoteRelayDomainEventTunable(virConnectPtr conn, !remoteRelayDomainEventCheckACL(callback->client, conn, dom)) return -1; - VIR_DEBUG("Relaying domain tunable event %s %d, callback %d", - dom->name, dom->id, callback->callbackID); + VIR_DEBUG("Relaying domain tunable event %s %d, callback %d, params %p %n", + dom->name, dom->id, callback->callbackID, params, nparams); /* build return data */ memset(&data, 0, sizeof(data)); diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index 0c6a91e..cd190ef 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -248,7 +248,7 @@ const REMOTE_NETWORK_DHCP_LEASES_MAX = 65536; const REMOTE_CONNECT_GET_ALL_DOMAIN_STATS_MAX = 4096; /* Upper limit of message size for tunable event. */ -const REMOTE_DOMAIN_EVENT_TUNABLE_MAX = 8388608; +const REMOTE_DOMAIN_EVENT_TUNABLE_MAX = 2048; /* UUID. VIR_UUID_BUFLEN definition comes from libvirt.h */ typedef opaque remote_uuid[VIR_UUID_BUFLEN]; -- 1.8.5.5

2 2

[libvirt] [RFC] exclusive vcpu-cpu pinning
by Ján Tomko 25 Sep '14

25 Sep '14

Hello developers! Currently, our default cgroup layout is: -top level cgroup \-machine (machine.slice with systemd) `-vm1.libvirt-qemu (machine-qemu\x2dvm1.scope with systemd) `-emulator `-vcpu0 \-vcpu1 \-vm2.libvirt-qemu `-emulator `-vcpu0 `-vcpu1 To free some CPUs for exclusive use, either all processes from the top level cgroup should be moved to another one (which does not seem like a great idea) or isolcpus= should be specified on the kernel command line. The cpuset.cpu_exclusive option can be set on a cgroup if * all the groups up to the top level group have it set * the cpuset of the current group is a subset of the parent group and no siblings use any cpus from the current cpuset This would mean that to keep the existing nested structure, all vcpus and the emulator thread would need to have an exclusive CPU, e.g: <vcpu placement='static' cpuset='4-6'>2</vcpu> <cputune exclusive='yes'> <vcpupin vcpu='0' cpuset='5'/> <vcpupin vcpu='1' cpuset='6'/> <emulatorpin cpuset='4'/> </cputune> (The only two issues I found: 1) libvirt would have to mess with systemd's 'machine-scope' behind it's back (setting cpu_exclusive) 2) creating machines without explicit cpu pinning fails, as libvirt tries to write all the cpus to the cpuset, even those the other machine uses exclusively) I've also thought about just keeping track of the 'exclusived' CPUs in libvirt. This would not work across drivers. And it could possibly be needed to solve issue 2). Do you think any of these options would be useful? Bug: https://bugzilla.redhat.com/show_bug.cgi?id=996758 Jan

3 4

[libvirt] [PATCH] hotplug: Fix libvirtd crash on qemu-attached guest
by John Ferlan 25 Sep '14

25 Sep '14

https://bugzilla.redhat.com/show_bug.cgi?id=1141621 Using qemu-attach to attach to a qemu created process and then attempting to virsh detach-interface caused a libvirtd crash since the assumption was that device aliases were in place and that assumption is not necessarily true for the qemu-attach environment. Add some more verbiage to the virsh man page. Signed-off-by: John Ferlan <jferlan(a)redhat.com> --- Notes: * The bz also mentions a failure for the hotplug/virsh attach-interface, but that has been resolved by commit id 'ba7468db' * For the bz, the attempt to attach-interface/hotplug still is not successful, since device aliases are not set for the PCI controller. * I did try adding a call to qemuAssignDeviceAliases() during the qemu- attach code; however, that failed as well (perhaps for a different reason) as the attach to PCI slot 3 function 0 was not available for rtl8139 since it was being used by e1000 * If it's desired to add the alias call in that's fine, then that could be added in qemuDomainQemuAttach prior to the qemuDomainAssignAddresses call similar to qemuConnectDomainXMLToNative. src/qemu/qemu_hotplug.c | 3 ++- tools/virsh.pod | 5 +++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 7bc19cd..b7514ce 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -3520,7 +3520,8 @@ qemuDomainDetachNetDevice(virConnectPtr conn, qemuDomainMarkDeviceForRemoval(vm, &detach->info); qemuDomainObjEnterMonitor(driver, vm); - if (virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_DEVICE)) { + if (virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_DEVICE) && + detach->info.alias) { if (qemuMonitorDelDevice(priv->mon, detach->info.alias) < 0) { qemuDomainObjExitMonitor(driver, vm); virDomainAuditNet(vm, detach, NULL, "detach", false); diff --git a/tools/virsh.pod b/tools/virsh.pod index 9919f92..947adaf 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -3686,8 +3686,9 @@ using the UNIX driver. Ideally the process will also have had the Not all functions of libvirt are expected to work reliably after attaching to an externally launched QEMU process. There may be -issues with the guest ABI changing upon migration, and hotunplug -may not work. +issues with the guest ABI changing upon migration and device hotplug +or hotunplug may not work. The attached environment should be considered +primarily read-only. =item B<qemu-monitor-command> I<domain> { [I<--hmp>] | [I<--pretty>] } I<command>... -- 1.9.3

3 3

[libvirt] [PATCH] nodeinfo: fix nodeGetFreePages when max node is zero
by Jincheng Miao 25 Sep '14

25 Sep '14

In nodeGetFreePages, if startCell is given by '0', and the max node number is '0' too. The for-loop wouldn't be executed. So convert it to while-loop. Before: > virsh freepages --cellno 0 --pagesize 4 error: internal error: no suitable info found After: > virsh freepages --cellno 0 --pagesize 4 4KiB: 472637 Signed-off-by: Jincheng Miao <jmiao(a)redhat.com> --- src/nodeinfo.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/nodeinfo.c b/src/nodeinfo.c index 2459922..1fe190a 100644 --- a/src/nodeinfo.c +++ b/src/nodeinfo.c @@ -2042,18 +2042,19 @@ nodeGetFreePages(unsigned int npages, } lastCell = MIN(lastCell, startCell + cellCount); + cell = startCell; - for (cell = startCell; cell < lastCell; cell++) { + do { for (i = 0; i < npages; i++) { unsigned int page_size = pages[i]; unsigned int page_free; - if (virNumaGetPageInfo(cell, page_size, 0, NULL, &page_free) < 0) + if (virNumaGetPageInfo(cell++, page_size, 0, NULL, &page_free) < 0) goto cleanup; counts[ncounts++] = page_free; } - } + } while (cell < lastCell); if (!ncounts) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", -- 1.9.3

2 4

[libvirt] [PATCH] security: Fix labelling host devices (bz 1145968)
by Cole Robinson 24 Sep '14

24 Sep '14

The check for ISCSI devices was missing a check of subsys type, which meant we could skip labelling of other host devices as well. This fixes USB hotplug on F21 https://bugzilla.redhat.com/show_bug.cgi?id=1145968 --- src/security/security_apparmor.c | 3 ++- src/security/security_dac.c | 6 ++++-- src/security/security_selinux.c | 6 ++++-- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index 041ce65..3025284 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -828,7 +828,8 @@ AppArmorSetSecurityHostdevLabel(virSecurityManagerPtr mgr, /* Like AppArmorRestoreSecurityImageLabel() for a networked disk, * do nothing for an iSCSI hostdev */ - if (scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI) + if (dev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI && + scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI) return 0; if (profile_loaded(secdef->imagelabel) < 0) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index e398d2c..85253af 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -523,7 +523,8 @@ virSecurityDACSetSecurityHostdevLabel(virSecurityManagerPtr mgr, /* Like virSecurityDACSetSecurityImageLabel() for a networked disk, * do nothing for an iSCSI hostdev */ - if (scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI) + if (dev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI && + scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI) return 0; cbdata.manager = mgr; @@ -657,7 +658,8 @@ virSecurityDACRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr, /* Like virSecurityDACRestoreSecurityImageLabelInt() for a networked disk, * do nothing for an iSCSI hostdev */ - if (scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI) + if (dev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI && + scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI) return 0; switch ((virDomainHostdevSubsysType) dev->source.subsys.type) { diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index b9efbc5..ea1efc9 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -1327,7 +1327,8 @@ virSecuritySELinuxSetSecurityHostdevSubsysLabel(virDomainDefPtr def, /* Like virSecuritySELinuxSetSecurityImageLabelInternal() for a networked * disk, do nothing for an iSCSI hostdev */ - if (scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI) + if (dev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI && + scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI) return 0; switch (dev->source.subsys.type) { @@ -1520,7 +1521,8 @@ virSecuritySELinuxRestoreSecurityHostdevSubsysLabel(virSecurityManagerPtr mgr, /* Like virSecuritySELinuxRestoreSecurityImageLabelInt() for a networked * disk, do nothing for an iSCSI hostdev */ - if (scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI) + if (dev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI && + scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI) return 0; switch (dev->source.subsys.type) { -- 2.1.0

2 2