- Devel - libvirt List Archives

[libvirt] [PATCHv2] qemu: min_guarantee: Parameter 'min_guarantee' not supported
by Erik Skultety 22 Aug '14

22 Aug '14

The 'min_guarantee' is used by VMware ESX and OpenVZ drivers, with qemu however, libvirt should report error when starting a domain, because this element is not used. Resolves https://bugzilla.redhat.com/show_bug.cgi?id=1122455 --- docs/formatdomain.html.in | 3 ++- src/qemu/qemu_process.c | 7 +++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index bd99ae0..eacf8db 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -713,7 +713,8 @@ <dt><code>min_guarantee</code></dt> <dd> The optional <code>min_guarantee</code> element is the guaranteed minimum memory allocation for the guest. The units for this value are - kibibytes (i.e. blocks of 1024 bytes)</dd> + kibibytes (i.e. blocks of 1024 bytes). This element is only supported + by VMware ESX and OpenVZ drivers.</dd> </dl> diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 9e6a9ae..39cce7c 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -3993,6 +3993,13 @@ int qemuProcessStart(virConnectPtr conn, flags & VIR_QEMU_PROCESS_START_COLD) < 0) goto cleanup; + if (vm->def->mem.min_guarantee) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Parameter 'min_guarantee' " + "not supported by QEMU.")); + goto cleanup; + } + if (VIR_ALLOC(priv->monConfig) < 0) goto cleanup; -- 1.9.3

2 1

[libvirt] [PATCHv3] numatune: setting --mode does not work well
by Erik Skultety 22 Aug '14

22 Aug '14

When trying to set numatune mode directly using virsh numatune command, correct error is raised, however numatune structure was not deallocated, thus resulting in creating an empty numatune element in the guest XML, if none was present before. Running the same command aftewards results in a successful change with broken XML structure. Patch fixes the deallocation problem as well as checking for invalid attribute combination VIR_DOMAIN_NUMATUNE_PLACEMENT_AUTO + a nonempty nodeset. Resolves https://bugzilla.redhat.com/show_bug.cgi?id=1129998 --- src/conf/numatune_conf.c | 45 ++++++++++++++-------- ...-numad-auto-vcpu-static-numatune-no-nodeset.xml | 31 +++++++++++++++ tests/qemuxml2argvtest.c | 1 + 3 files changed, 62 insertions(+), 15 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-numad-auto-vcpu-static-numatune-no-nodeset.xml diff --git a/src/conf/numatune_conf.c b/src/conf/numatune_conf.c index 48d1d04..ff0f3eb 100644 --- a/src/conf/numatune_conf.c +++ b/src/conf/numatune_conf.c @@ -437,14 +437,27 @@ virDomainNumatuneSet(virDomainNumatunePtr *numatunePtr, int mode, virBitmapPtr nodeset) { - bool create = !*numatunePtr; /* Whether we are creating new struct */ + bool created = false; int ret = -1; - virDomainNumatunePtr numatune = NULL; + virDomainNumatunePtr numatune; /* No need to do anything in this case */ if (mode == -1 && placement == -1 && !nodeset) return 0; + if (!(*numatunePtr)) { + if (VIR_ALLOC(*numatunePtr) < 0) + goto cleanup; + + created = true; + if (mode == -1) + mode = VIR_DOMAIN_NUMATUNE_MEM_STRICT; + if (placement == -1) + placement = VIR_DOMAIN_NUMATUNE_PLACEMENT_DEFAULT; + } + + numatune = *numatunePtr; + /* Range checks */ if (mode != -1 && (mode < 0 || mode >= VIR_DOMAIN_NUMATUNE_MEM_LAST)) { @@ -453,6 +466,7 @@ virDomainNumatuneSet(virDomainNumatunePtr *numatunePtr, mode); goto cleanup; } + if (placement != -1 && (placement < 0 || placement >= VIR_DOMAIN_NUMATUNE_PLACEMENT_LAST)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, @@ -461,21 +475,9 @@ virDomainNumatuneSet(virDomainNumatunePtr *numatunePtr, goto cleanup; } - if (create && VIR_ALLOC(*numatunePtr) < 0) - goto cleanup; - numatune = *numatunePtr; - - if (create) { - /* Defaults for new struct */ - if (mode == -1) - mode = VIR_DOMAIN_NUMATUNE_MEM_STRICT; - - if (placement == -1) - placement = VIR_DOMAIN_NUMATUNE_PLACEMENT_DEFAULT; - } - if (mode != -1) numatune->memory.mode = mode; + if (nodeset) { virBitmapFree(numatune->memory.nodeset); numatune->memory.nodeset = virBitmapNewCopy(nodeset); @@ -500,13 +502,26 @@ virDomainNumatuneSet(virDomainNumatunePtr *numatunePtr, goto cleanup; } + /* setting nodeset when placement auto is invalid */ + if (placement == VIR_DOMAIN_NUMATUNE_PLACEMENT_AUTO && + numatune->memory.nodeset) { + virBitmapFree(numatune->memory.nodeset); + numatune->memory.nodeset = NULL; + } + if (placement != -1) numatune->memory.placement = placement; numatune->memory.specified = true; ret = 0; + cleanup: + if (ret < 0 && created) { + virDomainNumatuneFree(*numatunePtr); + *numatunePtr = NULL; + } + return ret; } diff --git a/tests/qemuxml2argvdata/qemuxml2argv-numad-auto-vcpu-static-numatune-no-nodeset.xml b/tests/qemuxml2argvdata/qemuxml2argv-numad-auto-vcpu-static-numatune-no-nodeset.xml new file mode 100644 index 0000000..b3cb5c5 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-numad-auto-vcpu-static-numatune-no-nodeset.xml @@ -0,0 +1,31 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='auto'>2</vcpu> + <numatune> + <memory mode='interleave' placement='static'/> + </numatune> + <os> + <type arch='i686' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <cpu> + <topology sockets='2' cores='1' threads='1'/> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu</emulator> + <disk type='block' device='disk'> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='ide' index='0'/> + <memballoon model='virtio'/> + </devices> +</domain> diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 65dc9c7..b289d0e 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -1223,6 +1223,7 @@ mymain(void) DO_TEST_PARSE_ERROR("numatune-memnodes-problematic", NONE); DO_TEST("numad", NONE); DO_TEST("numad-auto-vcpu-static-numatune", NONE); + DO_TEST_PARSE_ERROR("numad-auto-vcpu-static-numatune-no-nodeset", NONE); DO_TEST("numad-auto-memory-vcpu-cpuset", NONE); DO_TEST("numad-auto-memory-vcpu-no-cpuset-and-placement", NONE); DO_TEST("numad-static-memory-auto-vcpu", NONE); -- 1.9.3

2 1

[libvirt] [PATCH] iotune: setting an invalid value now reports error
by Erik Skultety 22 Aug '14

22 Aug '14

When trying to set an invalid value into iotune element, standard behavior was to not report any error, rather to reset all affected subelements of the iotune element back to 0 which results in ignoring those particular subelements by XML generator. Patch further examines the return code of the virXPathULongLong function and in case of an invalid non-integer value raises an error. Fixed to preserve consistency with invalid value checking of other elements. Resolves https://bugzilla.redhat.com/show_bug.cgi?id=1131811 --- src/conf/domain_conf.c | 55 +++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 43 insertions(+), 12 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 9557020..592aa94 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -5416,6 +5416,7 @@ virDomainDiskDefParseXML(virDomainXMLOptionPtr xmlopt, char *mirrorType = NULL; int expected_secret_usage = -1; int auth_secret_usage = -1; + int ret = 0; if (!(def = virDomainDiskDefNew())) return NULL; @@ -5644,40 +5645,70 @@ virDomainDiskDefParseXML(virDomainXMLOptionPtr xmlopt, goto error; } } else if (xmlStrEqual(cur->name, BAD_CAST "iotune")) { - if (virXPathULongLong("string(./iotune/total_bytes_sec)", + ret = virXPathULongLong("string(./iotune/total_bytes_sec)", ctxt, - &def->blkdeviotune.total_bytes_sec) < 0) { + &def->blkdeviotune.total_bytes_sec); + if (ret < 0 && ret != -2) { def->blkdeviotune.total_bytes_sec = 0; + } else if (ret == -2) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("total throughput limit must be an integer")); + goto error; } - if (virXPathULongLong("string(./iotune/read_bytes_sec)", + ret = virXPathULongLong("string(./iotune/read_bytes_sec)", ctxt, - &def->blkdeviotune.read_bytes_sec) < 0) { + &def->blkdeviotune.read_bytes_sec); + if (ret < 0 && ret != -2) { def->blkdeviotune.read_bytes_sec = 0; + } else if (ret == -2) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("read throughput limit must be an integer")); + goto error; } - if (virXPathULongLong("string(./iotune/write_bytes_sec)", + ret = virXPathULongLong("string(./iotune/write_bytes_sec)", ctxt, - &def->blkdeviotune.write_bytes_sec) < 0) { + &def->blkdeviotune.write_bytes_sec); + if (ret < 0 && ret != -2) { def->blkdeviotune.write_bytes_sec = 0; + } else if (ret == -2) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("write throughput limit must be an integer")); + goto error; } - if (virXPathULongLong("string(./iotune/total_iops_sec)", + ret = virXPathULongLong("string(./iotune/total_iops_sec)", ctxt, - &def->blkdeviotune.total_iops_sec) < 0) { + &def->blkdeviotune.total_iops_sec); + if (ret < 0 && ret != -2) { def->blkdeviotune.total_iops_sec = 0; + } else if (ret == -2) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("total I/O operations limit must be an integer")); + goto error; } - if (virXPathULongLong("string(./iotune/read_iops_sec)", + ret = virXPathULongLong("string(./iotune/read_iops_sec)", ctxt, - &def->blkdeviotune.read_iops_sec) < 0) { + &def->blkdeviotune.read_iops_sec); + if (ret < 0 && ret != -2) { def->blkdeviotune.read_iops_sec = 0; + } else if (ret == -2) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("read I/O operations limit must be an integer")); + goto error; } - if (virXPathULongLong("string(./iotune/write_iops_sec)", + ret = virXPathULongLong("string(./iotune/write_iops_sec)", ctxt, - &def->blkdeviotune.write_iops_sec) < 0) { + &def->blkdeviotune.write_iops_sec); + if (ret < 0 && ret != -2) { def->blkdeviotune.write_iops_sec = 0; + } else if (ret == -2) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("write I/O operations limit must be an integer")); + goto error; } if ((def->blkdeviotune.total_bytes_sec && -- 1.9.3

2 1

[libvirt] [PATCH v2 0/5] Parallels: patchset
by Alexander Burluka 22 Aug '14

22 Aug '14

Another patchset for Parallels libvirt driver. This patchset includes some minor bugfixing and adds some functions required to start OpenStack Changes in v2: fixed wrong error codes in config error handling. Alexander Burluka (5): Parallels: add virNodeGetCPUMap(). Parallels: fix error with video card RAM dimension Parallels: Change config report errors code. Parallels: Add domainCreateWithFlags() function. Parallels: add events emiting while creating domain. src/parallels/parallels_driver.c | 155 ++++++++++++++++++++++++++++----------- 1 file changed, 113 insertions(+), 42 deletions(-) -- 1.9.1

3 10

[libvirt] [PATCH v5 0/3] OVMF exposure
by Michal Privoznik 22 Aug '14

22 Aug '14

Diff to v4: -rebased onto current master -introduced nvram/@template as requested by Dan -yet another Laszlo's review worked in Michal Privoznik (3): conf: Extend <loader/> and introduce <nvram/> qemu: Implement extended loader and nvram qemu: Automatically create NVRAM store docs/formatdomain.html.in | 22 +++- docs/schemas/domaincommon.rng | 28 +++++ libvirt.spec.in | 2 + src/Makefile.am | 1 + src/conf/domain_conf.c | 96 ++++++++++++++- src/conf/domain_conf.h | 23 +++- src/libvirt_private.syms | 3 + src/qemu/libvirtd_qemu.aug | 3 + src/qemu/qemu.conf | 14 +++ src/qemu/qemu_command.c | 97 ++++++++++++++- src/qemu/qemu_conf.c | 94 ++++++++++++++ src/qemu/qemu_conf.h | 5 + src/qemu/qemu_process.c | 137 +++++++++++++++++++++ src/qemu/test_libvirtd_qemu.aug.in | 3 + src/security/security_dac.c | 8 ++ src/security/security_selinux.c | 8 ++ src/security/virt-aa-helper.c | 4 +- src/vbox/vbox_common.c | 7 +- src/xenapi/xenapi_driver.c | 3 +- src/xenconfig/xen_common.c | 7 +- src/xenconfig/xen_sxpr.c | 16 +-- tests/domainschemadata/domain-bios-nvram-empty.xml | 40 ++++++ .../qemuxml2argvdata/qemuxml2argv-bios-nvram.args | 10 ++ tests/qemuxml2argvdata/qemuxml2argv-bios-nvram.xml | 40 ++++++ tests/qemuxml2argvtest.c | 2 + .../qemuxml2xmlout-pci-bridge-many-disks.xml | 2 +- tests/qemuxml2xmltest.c | 2 + tests/sexpr2xmldata/sexpr2xml-fv-autoport.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-empty-kernel.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-force-hpet.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-force-nohpet.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-kernel.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-legacy-vfb.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-localtime.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-net-ioemu.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-net-netfront.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-parallel-tcp.xml | 2 +- .../sexpr2xml-fv-serial-dev-2-ports.xml | 2 +- .../sexpr2xml-fv-serial-dev-2nd-port.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-serial-file.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-serial-null.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-serial-pipe.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-serial-pty.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-serial-stdio.xml | 2 +- .../sexpr2xml-fv-serial-tcp-telnet.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-serial-tcp.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-serial-udp.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-serial-unix.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-sound-all.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-sound.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-usbmouse.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-usbtablet.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-utc.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-v2.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-no-source-cdrom.xml | 2 +- tests/xmconfigdata/test-escape-paths.xml | 2 +- tests/xmconfigdata/test-fullvirt-force-hpet.xml | 2 +- tests/xmconfigdata/test-fullvirt-force-nohpet.xml | 2 +- tests/xmconfigdata/test-fullvirt-localtime.xml | 2 +- tests/xmconfigdata/test-fullvirt-net-ioemu.xml | 2 +- tests/xmconfigdata/test-fullvirt-net-netfront.xml | 2 +- tests/xmconfigdata/test-fullvirt-new-cdrom.xml | 2 +- tests/xmconfigdata/test-fullvirt-old-cdrom.xml | 2 +- tests/xmconfigdata/test-fullvirt-parallel-tcp.xml | 2 +- .../test-fullvirt-serial-dev-2-ports.xml | 2 +- .../test-fullvirt-serial-dev-2nd-port.xml | 2 +- tests/xmconfigdata/test-fullvirt-serial-file.xml | 2 +- tests/xmconfigdata/test-fullvirt-serial-null.xml | 2 +- tests/xmconfigdata/test-fullvirt-serial-pipe.xml | 2 +- tests/xmconfigdata/test-fullvirt-serial-pty.xml | 2 +- tests/xmconfigdata/test-fullvirt-serial-stdio.xml | 2 +- .../test-fullvirt-serial-tcp-telnet.xml | 2 +- tests/xmconfigdata/test-fullvirt-serial-tcp.xml | 2 +- tests/xmconfigdata/test-fullvirt-serial-udp.xml | 2 +- tests/xmconfigdata/test-fullvirt-serial-unix.xml | 2 +- tests/xmconfigdata/test-fullvirt-sound.xml | 2 +- tests/xmconfigdata/test-fullvirt-usbmouse.xml | 2 +- tests/xmconfigdata/test-fullvirt-usbtablet.xml | 2 +- tests/xmconfigdata/test-fullvirt-utc.xml | 2 +- tests/xmconfigdata/test-no-source-cdrom.xml | 2 +- tests/xmconfigdata/test-pci-devs.xml | 2 +- 82 files changed, 705 insertions(+), 82 deletions(-) create mode 100644 tests/domainschemadata/domain-bios-nvram-empty.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-bios-nvram.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-bios-nvram.xml -- 1.8.5.5

2 6

[libvirt] [PATCH] virsh: Fix help info for freepages
by Li Yang 22 Aug '14

22 Aug '14

Signed-off-by: Li Yang <liyang.fnst(a)cn.fujitsu.com> --- tools/virsh-host.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/virsh-host.c b/tools/virsh-host.c index ae14311..ad821b3 100644 --- a/tools/virsh-host.c +++ b/tools/virsh-host.c @@ -263,10 +263,10 @@ cmdFreecell(vshControl *ctl, const vshCmd *cmd) */ static const vshCmdInfo info_freepages[] = { {.name = "help", - .data = N_("NUMA free memory") + .data = N_("NUMA free pages") }, {.name = "desc", - .data = N_("display available free memory for the NUMA cell.") + .data = N_("display available free pages for the NUMA cell.") }, {.name = NULL} }; -- 1.7.1

2 1

[libvirt] [PATCH] util: compare floor attribute in virNetDevBandwidthEqual
by Martin Kletzander 22 Aug '14

22 Aug '14

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1064770 Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- src/util/virnetdevbandwidth.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/util/virnetdevbandwidth.c b/src/util/virnetdevbandwidth.c index 1e00116..5fa231a 100644 --- a/src/util/virnetdevbandwidth.c +++ b/src/util/virnetdevbandwidth.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2009-2013 Red Hat, Inc. + * Copyright (C) 2009-2014 Red Hat, Inc. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -342,6 +342,7 @@ virNetDevBandwidthEqual(virNetDevBandwidthPtr a, if (a->in->average != b->in->average || a->in->peak != b->in->peak || + a->in->floor != b->in->floor || a->in->burst != b->in->burst) return false; } else if (b->in) { @@ -355,6 +356,7 @@ virNetDevBandwidthEqual(virNetDevBandwidthPtr a, if (a->out->average != b->out->average || a->out->peak != b->out->peak || + a->out->floor != b->out->floor || a->out->burst != b->out->burst) return false; } else if (b->out) { -- 2.0.4

2 1

[libvirt] [PATCH] build: fix mingw build with virCommandReorderFDs
by Martin Kletzander 22 Aug '14

22 Aug '14

Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- Notes: pushed as a build-breaker src/util/vircommand.c | 4 ++-- src/util/virutil.c | 12 ++++++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/src/util/vircommand.c b/src/util/vircommand.c index 3b3e6f5..1d6dbd9 100644 --- a/src/util/vircommand.c +++ b/src/util/vircommand.c @@ -201,6 +201,8 @@ virCommandFDSet(virCommandPtr cmd, return 0; } +#ifndef WIN32 + static void virCommandReorderFDs(virCommandPtr cmd) { @@ -273,8 +275,6 @@ virCommandReorderFDs(virCommandPtr cmd) return; } -#ifndef WIN32 - /** * virFork: * diff --git a/src/util/virutil.c b/src/util/virutil.c index 1d897d9..2edbec5 100644 --- a/src/util/virutil.c +++ b/src/util/virutil.c @@ -2397,6 +2397,8 @@ void virUpdateSelfLastChanged(const char *path) } } +#ifndef WIN32 + /** * virGetListenFDs: * @@ -2458,3 +2460,13 @@ virGetListenFDs(void) return nfds; } + +#else /* WIN32 */ + +unsigned int +virGetListenFDs(void) +{ + return 0; +} + +#endif /* WIN32 */ -- 2.0.4

1 0

[libvirt] RFC: sVirt disk isolation with network based storage
by Daniel P. Berrange 22 Aug '14

22 Aug '14

As everyone knows sVirt is our nice solution to isolating guest resources from other (malicious) guests through SELinux labelling of the appropriate files / device nodes. This has been pretty effective since we introduced it to libvirt. In the last year or two, particularly in the cloud arena, there has been a big shift towards use of network based storage. Initially we were relying on kernel drivers / FUSE layers that exposed this network storage as devices or nodes in the host filesystem, so sVirt still stood a chance of being useful if the devices /FUSE layer supported labelling. Now though QEMU has native support for talking to gluster, ceph/rbd, iscsi and even nfs servers. This support is increasingly used in preference to using the kernel drivers / FUSE layers since it provides a simpler and thus (in theory) better performing I/O path for the network storage and does not require any privileged setup tasks on the host ahead of time. The problem is that I beleive this is blowing a decent sized hole in our sVirt isolation story. eg when we launch QEMU with an argument like this: -drive 'file=rbd:pool/image:auth_supported=none:\ mon_host=mon1.example.org\:6321\;mon2.example.org\:6322\;\ mon3.example.org\:6322,if=virtio,format=raw' We are trusting QEMU to only ever access the disk volume 'pool/image'. There are, in all likelihood, many 100's or 1000's of disk images on the server it is connecting to and nothing is stopping QEMU from accessing any of them AFAICT. There is no currrently implemented mechanism by which the sVirt label that QEMU runs under is made available to the remote RBD server to use for enforcement, nor any way in which libvirt could tell the RBD server which label was applied for which disk. The same seems to apply for Gluster, iSCSI, and NFS too when accessed directly from a network client inside the QEMU process. As it stands the only approach I see for isolating each virtual machines disk(s) from other virtual machines is to make use of user authentication with these services. eg each virtual machine would need to have its own dedicated user account on the RBD/Gluster/iSCSI/NFS server, and the disk volumes for the VM would have to be made accessible solely to that user account. Assuming such user account / disk mapping exists in the servers today that can be made to work but it is an incredibly awful solution to deal with when VMs are being dynamically created & deleted very frequently. Today apps like OpenStack just have a single RBD username and password for everything they do. Any virtual machines running with RBD storage on OpenStack thus have no sVirt protection for their disk images AFAICT. To protect images OpenStack would have to dynamically create & delete new user accounts on the RBD server & setup disk access for them. I don't see that kind of approach being viable. IIUC, there is some mechanism at the IP stack level where the kernel can take the SELinux label of the process that establishes the network connection and pass it across to the server. If there was a way in the RBD API for libvirt to label the volumes, then potentially we could have a system where the RBD server did sVirt enforcement, based on the instructions from libvirt & the label of the client process. Thoughts on what to do about this ? Network based storage, where the network client is inside each QEMU server, is here to stay so I don't think we can ignore the problem long term. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|

3 4

Re: [libvirt] pvspinlock not accepted by libvirt
by bancfc＠openmailbox.org 22 Aug '14

22 Aug '14

I'm using libvirt version 1.1.3.5 at the moment. I am sure I followed the right syntax as I put it under the features section: <features> ... <pvspinlock/> </features> It says: error internal error: unexpected feature pvspinlock Failed. try again?

2 1