- Devel - libvirt List Archives

[libvirt] [PATCH] nwfilter: Deactivate iptables MAC address check where needed
by Stefan Berger 10 Mar '14

10 Mar '14

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com> Recent Linux iptables (3.11.7) refuses to create iptables MAC address check rules using -m mac --mac-source <addr> where previous versions still allowed it. So we now need to deactivate the filtering rules for when the incoming traffic is filtered before it is sent into the VM. Those are typically the chains that start with FO-* or start with FP-* when they are being built. Adapt the documentation to reflect the fact that srcmacaddr, when used in iptables rules, should be regarded as deprecated due to the above mentioned problems. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- docs/formatnwfilter.html.in | 42 +++++-------------------------- src/nwfilter/nwfilter_ebiptables_driver.c | 29 +++++++++++++-------- 2 files changed, 24 insertions(+), 47 deletions(-) diff --git a/docs/formatnwfilter.html.in b/docs/formatnwfilter.html.in index 4b95fce..ee23d8e 100644 --- a/docs/formatnwfilter.html.in +++ b/docs/formatnwfilter.html.in @@ -1209,7 +1209,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1320,22 +1320,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1429,22 +1414,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1529,7 +1499,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1640,7 +1610,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1735,7 +1705,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 9d6cc90..ebc3505 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -972,7 +972,7 @@ static int iptablesHandleSrcMacAddr(virBufferPtr buf, virNWFilterVarCombIterPtr vars, nwItemDescPtr srcMacAddr, - bool directionIn, + const char *chain, bool directionIn, bool *srcmacskipped) { char macaddr[VIR_MAC_STRING_BUFLEN]; @@ -984,6 +984,14 @@ iptablesHandleSrcMacAddr(virBufferPtr buf, return 0; } + /* recent Linux iptables does not allow this filteirng rule to be + * applied to all FO-* chains + */ + if (chain[1] == CHAINPREFIX_HOST_OUT_TEMP ) { + *srcmacskipped = true; + return 0; + } + if (printDataType(vars, macaddr, sizeof(macaddr), srcMacAddr) < 0) @@ -1366,7 +1374,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.tcpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1421,7 +1429,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1454,7 +1462,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpliteHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1482,7 +1490,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.espHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1506,11 +1514,10 @@ _iptablesCreateRuleInstance(bool directionIn, virBufferAddLit(&buf, " -p ah"); bufUsed = virBufferUse(&buf); - if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.ahHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1538,7 +1545,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.sctpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1574,7 +1581,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.icmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1636,7 +1643,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.igmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1664,7 +1671,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.allHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; -- 1.8.1.4

2 2

[libvirt] [PATCH 1/3] no_mac_source
by Stefan Berger 10 Mar '14

10 Mar '14

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com> Subject nwfilter: Deactivate iptables MAC address check where needed Recent Linux iptables (3.11.7) refuses to create iptables MAC address check rules using -m mac --mac-source <addr> where previous versions still allowed it. So we now need to deactivate the filtering rules for when the incoming traffic is filtered before it is sent into the VM. Those are typically the chains that start with FO-* or start with FP-* when they are being built. Adapt the documentation to reflect the fact that srcmacaddr, when used in iptables rules, should be regarded as deprecated due to the above mentioned problems. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- docs/formatnwfilter.html.in | 42 +++++-------------------------- src/nwfilter/nwfilter_ebiptables_driver.c | 29 +++++++++++++-------- 2 files changed, 24 insertions(+), 47 deletions(-) diff --git a/docs/formatnwfilter.html.in b/docs/formatnwfilter.html.in index 4b95fce..ee23d8e 100644 --- a/docs/formatnwfilter.html.in +++ b/docs/formatnwfilter.html.in @@ -1209,7 +1209,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1320,22 +1320,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1429,22 +1414,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1529,7 +1499,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1640,7 +1610,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1735,7 +1705,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 9d6cc90..ebc3505 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -972,7 +972,7 @@ static int iptablesHandleSrcMacAddr(virBufferPtr buf, virNWFilterVarCombIterPtr vars, nwItemDescPtr srcMacAddr, - bool directionIn, + const char *chain, bool directionIn, bool *srcmacskipped) { char macaddr[VIR_MAC_STRING_BUFLEN]; @@ -984,6 +984,14 @@ iptablesHandleSrcMacAddr(virBufferPtr buf, return 0; } + /* recent Linux iptables does not allow this filteirng rule to be + * applied to all FO-* chains + */ + if (chain[1] == CHAINPREFIX_HOST_OUT_TEMP ) { + *srcmacskipped = true; + return 0; + } + if (printDataType(vars, macaddr, sizeof(macaddr), srcMacAddr) < 0) @@ -1366,7 +1374,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.tcpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1421,7 +1429,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1454,7 +1462,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpliteHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1482,7 +1490,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.espHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1506,11 +1514,10 @@ _iptablesCreateRuleInstance(bool directionIn, virBufferAddLit(&buf, " -p ah"); bufUsed = virBufferUse(&buf); - if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.ahHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1538,7 +1545,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.sctpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1574,7 +1581,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.icmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1636,7 +1643,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.igmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1664,7 +1671,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.allHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; -- 1.8.1.4

2 1

[libvirt] Unable to start Nehalem VM on Nehalem host
by Ruben Kerkhof 10 Mar '14

10 Mar '14

Hi list, I'm trying to debug a strange issue I have, and I'd appreciate some help. I've upgraded libvirt to 1.2.2, on Scientific Linux, with qemu-kvm-0.12.1.2-2.415.el6_5.3 Here’s my analysis so far: I figured out that libvirt uses HMP to get the list of models from qemu-kvm by running qemu-kvm -cpu ?model -nodefconfig. This returns the following: x86 Opteron_G5 AMD Opteron 63xx class CPU x86 Opteron_G4 AMD Opteron 62xx class CPU x86 Opteron_G3 AMD Opteron 23xx (Gen 3 Class Opteron) x86 Opteron_G2 AMD Opteron 22xx (Gen 2 Class Opteron) x86 Opteron_G1 AMD Opteron 240 (Gen 1 Class Opteron) x86 Haswell Intel Core Processor (Haswell) x86 SandyBridge Intel Xeon E312xx (Sandy Bridge) x86 Westmere Westmere E56xx/L56xx/X56xx (Nehalem-C) x86 Nehalem Intel Core i7 9xx (Nehalem Class Core i7) x86 Penryn Intel Core 2 Duo P9xxx (Penryn Class Core 2) x86 Conroe Intel Celeron_4x0 (Conroe/Merom Class Core 2) x86 cpu64-rhel5 QEMU Virtual CPU version (cpu64-rhel5) x86 cpu64-rhel6 QEMU Virtual CPU version (cpu64-rhel6) x86 n270 Intel(R) Atom(TM) CPU N270 @ 1.60GHz x86 athlon QEMU Virtual CPU version 0.12.1 x86 pentium3 x86 pentium2 x86 pentium x86 486 x86 coreduo Genuine Intel(R) CPU T2600 @ 2.16GHz x86 qemu32 QEMU Virtual CPU version 0.12.1 x86 kvm64 Common KVM processor x86 core2duo Intel(R) Core(TM)2 Duo CPU T7700 @ 2.40GHz x86 phenom AMD Phenom(tm) 9550 Quad-Core Processor x86 qemu64 QEMU Virtual CPU version 0.12.1 The comment describing the function parsing this list states that the output is expected to be as follows: /* Format: * <arch> <model> * qemu-0.13 encloses some model names in []: * <arch> [<model>] */ static int virQEMUCapsParseX86Models(const char *output, virQEMUCapsPtr qemuCaps) { but this function doesn’t strip the rest of the line, so the models array becomes: Breakpoint 1, x86Decode (cpu=0x7fffd82a8460, data=0x7fffd8272d00, models=0x7fffd82b7440, nmodels=25, preferred=0x7fffd82a81f0 "Nehalem", flags=0) at cpu/cpu_x86.c:1487 1487 { (gdb) p models $1 = (const char **) 0x7fffd82b7440 (gdb) p *models $2 = 0x7fffd82ba240 "Opteron_G5 AMD Opteron 63xx class CPU", ' ' <repeats 22 times> (gdb) p *models@25 $3 = {0x7fffd82ba240 "Opteron_G5 AMD Opteron 63xx class CPU", ' ' <repeats 22 times>, 0x7fffd82c8c30 "Opteron_G4 AMD Opteron 62xx class CPU", ' ' <repeats 22 times>, 0x7fffd8169e00 "Opteron_G3 AMD Opteron 23xx (Gen 3 Class Opteron) ", 0x7fffd8169cb0 "Opteron_G2 AMD Opteron 22xx (Gen 2 Class Opteron) ", 0x7fffd8169b60 "Opteron_G1 AMD Opteron 240 (Gen 1 Class Opteron)", ' ' <repeats 11 times>, 0x7fffd8169a10 "Haswell Intel Core Processor (Haswell)", ' ' <repeats 18 times>, 0x7fffd81697e0 "SandyBridge Intel Xeon E312xx (Sandy Bridge)", ' ' <repeats 16 times>, 0x7fffd8169690 "Westmere Westmere E56xx/L56xx/X56xx (Nehalem-C) ", 0x7fffd8169460 "Nehalem Intel Core i7 9xx (Nehalem Class Core i7) ", 0x7fffd81693f0 "Penryn Intel Core 2 Duo P9xxx (Penryn Class Core 2) ", 0x7fffd8169310 "Conroe Intel Celeron_4x0 (Conroe/Merom Class Core 2) ", 0x7fffd8169230 "cpu64-rhel5 QEMU Virtual CPU version (cpu64-rhel5) ", 0x7fffd8169150 "cpu64-rhel6 QEMU Virtual CPU version (cpu64-rhel6) ", 0x7fffd82ba2b0 "n270 Intel(R) Atom(TM) CPU N270 @ 1.60GHz ", 0x7fffd81690e0 "athlon QEMU Virtual CPU version 0.12.1", ' ' <repeats 17 times>, 0x7fffd8169000 "pentium3", ' ' <repeats 50 times>, 0x7fffd8168f90 "pentium2", ' ' <repeats 50 times>, 0x7fffd8168eb0 "pentium", ' ' <repeats 50 times>, 0x7fffd82a8760 "486", ' ' <repeats 50 times>, 0x7fffd8168e40 "coreduo Genuine Intel(R) CPU", ' ' <repeats 11 times>, "T2600 @ 2.16GHz ", 0x7fffd8168d60 "qemu32 QEMU Virtual CPU version 0.12.1", ' ' <repeats 17 times>, 0x7fffd82bb150 "kvm64 Common KVM processor", ' ' <repeats 28 times>, 0x7fffd8168cf0 "core2duo Intel(R) Core(TM)2 Duo CPU T7700 @ 2.40GHz ", 0x7fffd8168c10 "phenom AMD Phenom(tm) 9550 Quad-Core Processor ", 0x7fffd8168b30 "qemu64 QEMU Virtual CPU version 0.12.1", ' ' <repeats 17 times>} cpuModellsAllowed then does a strcmp between “Nehalem” and "Nehalem Intel Core i7 9xx (Nehalem Class Core i7)” which fails, and the vm fails to start with: 2014-03-10 14:56:16.917+0000: 8328: info : qemuDomainDefineXML:6231 : Creating domain '530df8bd-7b64-4553-b4f4-18922e1327bf' 2014-03-10 14:56:17.114+0000: 8329: warning : x86Decode:1515 : Preferred CPU model Nehalem not allowed by hypervisor; closest supported model will be used 2014-03-10 14:56:17.114+0000: 8329: error : x86Decode:1571 : internal error: Cannot find suitable CPU model for given data Kind regards, Ruben Kerkhof

2 2

[libvirt] [PATCH] virSecurityDACSetSecurityImageLabel: Unmark @def as unused
by Michal Privoznik 10 Mar '14

10 Mar '14

The @def is clearly used just a few lines below. There's no need to use ATTRIBUTE_UNUSED for it. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/security/security_dac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 09b5e57..85e6eec 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -342,25 +342,25 @@ virSecurityDACSetSecurityFileLabel(virDomainDiskDefPtr disk ATTRIBUTE_UNUSED, static int virSecurityDACSetSecurityImageLabel(virSecurityManagerPtr mgr, - virDomainDefPtr def ATTRIBUTE_UNUSED, + virDomainDefPtr def, virDomainDiskDefPtr disk) { void *params[2]; virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); if (!priv->dynamicOwnership) return 0; if (disk->type == VIR_DOMAIN_DISK_TYPE_NETWORK) return 0; params[0] = mgr; params[1] = def; return virDomainDiskDefForeachPath(disk, false, virSecurityDACSetSecurityFileLabel, params); } -- 1.9.0

2 1

[libvirt] [PATCH 0/7] Remove overhead of disabled logging calls
by Daniel P. Berrange 10 Mar '14

10 Mar '14

Looking at the performance of the libvirtd event loop when used with libvirt sandbox and apps which do lots of I/O I discovered that a huge amount of time was being spent in our logging APIs making the event loop quite poor at dealing with frequently firing poll events for small data sizes. To track this down I created the following short demo program which simulates a libvirtd event loop thread, watching 500 FDs (eg 500 QEMU or LXC console or monitor FDs). In the test no logging outputs are enabled, so ideally the log overhead would be near zero. Running the demo for 51200 iterations initially took 1 minute 40 seconds. oprofile traces show that in this test run the logging APIs were totally dominant in CPU time, over the work done in the event loop. Note the demo program's FD handler doesn't actually do any work, so this is showing the worst case behaviour, but it is none-the-less a good illustration of the loggin overhead. After refactoring the logging code, the overhead of logging calls when no outputs are enabled is reduced to a single function call which does 2 integer comparisons without any mutex locks. The demo program now completes in 3.3 seconds. IOW, 97% of the original CPU time for the demo was consumed by the logging APIs ! The main feature we loose in this series is the global logging buffer. This ring buffer currently collects all log mesages regardless of log filter settings, and dumps them to stderr upon crash of libvirtd. As the amount of logging code in libvirt has grown, the signal/noise ratio of data in the global log buffer has gone down significantly. Whenever libvirtd crashes, my first reaction to ask the reporter to reproduce with a specifically tailored set of log filters set. Thus, IMHO, the global log buffer is no longer a compelling enough feature to justify its significant performance overhead. Rather than remove it entirely though, I've changed it in two parts. The first patch removes the overhead of it, but leaves a more tailored verson of it still present. This removes the contribution it makes to performance overheads. The last patch, which is not performance relevant, simply deletes the rest of the global log buffer entirely. I'm mostly ambivalent on whether to apply patch 7 or not. IMHO the global log buffer is mostly useless once patch 1 is applied, but if people think it is worth keeping it, patch 7 can be dropped and I won't mind. The demo program used is $ cat demo.c #include <libvirt/libvirt.h> #include <unistd.h> #include <stdio.h> static void ignore(int handle, int fd, int events, void *opaque) { // nada } #define STEPS (1024 * 5) #define ITERATIONS (STEPS * 10) #define NFILES 500 int main(int argc, char **argv) { int fds[NFILES][2]; int i; virEventRegisterDefaultImpl(); for (i = 0 ; i < NFILES ; i++) { char c = '0'; if (pipe(fds[i]) < 0) { perror("pipe"); return -1; } if (write(fds[i][1], &c, 1) < 0) return -1; virEventAddHandle(fds[i][0], VIR_EVENT_HANDLE_READABLE, ignore, NULL, NULL); } for (i = 0 ; i < ITERATIONS ; i++) { if (!(i % STEPS)) fprintf(stderr, "."); virEventRunDefaultImpl(); } return 0; } Simply compile & run it with no args $ gcc -Wall `pkg-config --cflags --libs libvirt` -o demo demo.c $ time ./demo .......... real 1m39.981s user 1m34.894s sys 0m4.851s Now make it use the newly compiled libvirt version $ export LD_LIBRARY_PATH=`pwd`/src/.libs $ time ./demo .......... real 0m3.316s user 0m2.896s sys 0m0.412s 97% execution time removed ! Daniel P. Berrange (7): Reduce performance overhead of the global log buffer Refactor code that skips logging of error messages Move dtrace probe macros into separate header file Turn virLogSource into a struct instead of an enum Add virLogSource variables to all source files Switch to filtering based on log source name instead of filename Remove global log buffer feature entirely daemon/libvirtd-config.c | 5 +- daemon/libvirtd-config.h | 1 - daemon/libvirtd.aug | 1 - daemon/libvirtd.c | 5 +- daemon/libvirtd.conf | 7 - daemon/libvirtd.h | 1 - daemon/remote.c | 3 + daemon/stream.c | 2 + daemon/test_libvirtd.aug.in | 1 - docs/apibuild.py | 30 +++ docs/logging.html.in | 10 - src/access/viraccessdriverpolkit.c | 3 + src/access/viraccessmanager.c | 3 + src/bhyve/bhyve_command.c | 2 + src/bhyve/bhyve_driver.c | 2 + src/bhyve/bhyve_process.c | 2 + src/conf/domain_audit.c | 2 + src/conf/domain_conf.c | 2 + src/conf/domain_event.c | 1 + src/conf/network_event.c | 2 + src/conf/nwfilter_params.c | 2 + src/conf/object_event.c | 2 + src/conf/secret_conf.c | 2 + src/conf/snapshot_conf.c | 2 + src/conf/storage_conf.c | 1 - src/conf/virchrdev.c | 2 + src/cpu/cpu.c | 2 + src/cpu/cpu_powerpc.c | 2 + src/cpu/cpu_x86.c | 2 + src/datatypes.c | 2 + src/driver.c | 2 + src/esx/esx_device_monitor.c | 1 - src/esx/esx_driver.c | 2 + src/esx/esx_interface_driver.c | 2 - src/esx/esx_network_driver.c | 2 - src/esx/esx_nwfilter_driver.c | 2 - src/esx/esx_secret_driver.c | 2 - src/esx/esx_storage_backend_iscsi.c | 2 - src/esx/esx_storage_backend_vmfs.c | 2 + src/esx/esx_util.c | 2 +- src/esx/esx_vi.c | 2 +- src/esx/esx_vi_methods.c | 1 - src/esx/esx_vi_types.c | 2 +- src/fdstream.c | 2 + src/hyperv/hyperv_device_monitor.c | 2 - src/hyperv/hyperv_driver.c | 3 +- src/hyperv/hyperv_interface_driver.c | 2 - src/hyperv/hyperv_network_driver.c | 2 - src/hyperv/hyperv_nwfilter_driver.c | 2 - src/hyperv/hyperv_secret_driver.c | 2 - src/hyperv/hyperv_storage_driver.c | 2 - src/hyperv/hyperv_util.c | 2 +- src/hyperv/hyperv_wmi.c | 2 - src/interface/interface_backend_netcf.c | 2 + src/internal.h | 74 ------ src/libvirt-lxc.c | 2 + src/libvirt-qemu.c | 2 + src/libvirt.c | 2 + src/libxl/libxl_conf.c | 2 + src/libxl/libxl_domain.c | 1 + src/libxl/libxl_driver.c | 2 + src/locking/domain_lock.c | 2 + src/locking/lock_daemon.c | 4 +- src/locking/lock_daemon_config.c | 4 +- src/locking/lock_daemon_config.h | 1 - src/locking/lock_daemon_dispatch.c | 5 +- src/locking/lock_driver_lockd.c | 2 + src/locking/lock_driver_nop.c | 2 + src/locking/lock_driver_sanlock.c | 2 + src/locking/lock_manager.c | 2 + src/locking/test_virtlockd.aug.in | 2 - src/locking/virtlockd.aug | 1 - src/locking/virtlockd.conf | 7 - src/lxc/lxc_cgroup.c | 2 + src/lxc/lxc_conf.c | 2 + src/lxc/lxc_container.c | 2 + src/lxc/lxc_controller.c | 2 + src/lxc/lxc_domain.c | 2 + src/lxc/lxc_driver.c | 1 + src/lxc/lxc_fuse.c | 1 - src/lxc/lxc_hostdev.c | 2 + src/lxc/lxc_monitor.c | 2 + src/lxc/lxc_native.c | 1 + src/lxc/lxc_process.c | 2 + src/network/bridge_driver.c | 2 + src/network/bridge_driver_linux.c | 3 + src/network/bridge_driver_platform.h | 1 - src/node_device/node_device_driver.c | 2 - src/node_device/node_device_hal.c | 2 + src/node_device/node_device_linux_sysfs.c | 2 + src/node_device/node_device_udev.c | 4 +- src/nodeinfo.c | 1 - src/nwfilter/nwfilter_dhcpsnoop.c | 2 + src/nwfilter/nwfilter_driver.c | 2 + src/nwfilter/nwfilter_ebiptables_driver.c | 2 + src/nwfilter/nwfilter_gentech_driver.c | 1 + src/nwfilter/nwfilter_learnipaddr.c | 2 + src/openvz/openvz_driver.c | 2 + src/parallels/parallels_driver.c | 2 + src/phyp/phyp_driver.c | 3 + src/qemu/qemu_agent.c | 2 + src/qemu/qemu_bridge_filter.c | 1 - src/qemu/qemu_capabilities.c | 4 +- src/qemu/qemu_cgroup.c | 2 + src/qemu/qemu_command.c | 2 + src/qemu/qemu_conf.c | 2 + src/qemu/qemu_domain.c | 2 + src/qemu/qemu_driver.c | 2 + src/qemu/qemu_hostdev.c | 2 + src/qemu/qemu_hotplug.c | 3 + src/qemu/qemu_migration.c | 2 + src/qemu/qemu_monitor.c | 3 + src/qemu/qemu_monitor_json.c | 3 + src/qemu/qemu_monitor_text.c | 3 + src/qemu/qemu_process.c | 2 + src/remote/remote_driver.c | 2 + src/rpc/virkeepalive.c | 3 + src/rpc/virnetclient.c | 3 + src/rpc/virnetclientprogram.c | 2 + src/rpc/virnetclientstream.c | 2 + src/rpc/virnetmessage.c | 2 + src/rpc/virnetsaslcontext.c | 2 + src/rpc/virnetserver.c | 47 +--- src/rpc/virnetserverclient.c | 3 + src/rpc/virnetservermdns.c | 2 + src/rpc/virnetserverprogram.c | 2 + src/rpc/virnetsocket.c | 2 + src/rpc/virnetsshsession.c | 2 + src/rpc/virnettlscontext.c | 3 + src/secret/secret_driver.c | 2 + src/security/security_apparmor.c | 3 + src/security/security_dac.c | 3 + src/security/security_driver.c | 2 + src/security/security_manager.c | 1 + src/security/security_selinux.c | 2 + src/storage/storage_backend.c | 2 + src/storage/storage_backend_disk.c | 2 + src/storage/storage_backend_fs.c | 2 + src/storage/storage_backend_gluster.c | 2 + src/storage/storage_backend_iscsi.c | 2 + src/storage/storage_backend_logical.c | 2 + src/storage/storage_backend_mpath.c | 2 + src/storage/storage_backend_rbd.c | 2 + src/storage/storage_backend_scsi.c | 2 + src/storage/storage_backend_sheepdog.c | 1 - src/storage/storage_driver.c | 2 + src/test/test_driver.c | 2 + src/uml/uml_conf.c | 1 + src/uml/uml_driver.c | 2 + src/util/viralloc.c | 2 + src/util/virarch.c | 2 + src/util/viraudit.c | 9 +- src/util/viraudit.h | 10 +- src/util/virauth.c | 2 + src/util/virauthconfig.c | 1 + src/util/vircgroup.c | 2 + src/util/virclosecallbacks.c | 2 + src/util/vircommand.c | 2 + src/util/virconf.c | 2 + src/util/virdbus.c | 2 + src/util/virdnsmasq.c | 3 + src/util/virebtables.c | 2 + src/util/virerror.c | 16 +- src/util/virevent.c | 2 + src/util/vireventpoll.c | 3 + src/util/virfile.c | 2 + src/util/virhash.c | 2 + src/util/virhook.c | 2 + src/util/viridentity.c | 1 + src/util/viriptables.c | 2 + src/util/virjson.c | 1 + src/util/virkeyfile.c | 2 + src/util/virlockspace.c | 2 + src/util/virlog.c | 379 ++++-------------------------- src/util/virlog.h | 49 ++-- src/util/virnetdev.c | 2 + src/util/virnetdevmacvlan.c | 1 + src/util/virnetdevtap.c | 2 + src/util/virnetdevveth.c | 2 + src/util/virnetdevvportprofile.c | 2 + src/util/virnetlink.c | 2 + src/util/virnodesuspend.c | 2 + src/util/virnuma.c | 2 + src/util/virobject.c | 3 + src/util/virpci.c | 2 + src/util/virpidfile.c | 2 + src/util/virprobe.h | 100 ++++++++ src/util/virprocess.c | 2 + src/util/virrandom.c | 2 + src/util/virscsi.c | 1 - src/util/virstoragefile.c | 2 + src/util/virstring.c | 2 + src/util/virsysinfo.c | 1 - src/util/virsystemd.c | 1 + src/util/virusb.c | 2 + src/util/virutil.c | 2 + src/util/viruuid.c | 2 + src/vbox/vbox_MSCOMGlue.c | 2 + src/vbox/vbox_XPCOMCGlue.c | 1 + src/vbox/vbox_driver.c | 1 + src/vbox/vbox_tmpl.c | 3 + src/vmx/vmx.c | 2 + src/xen/xen_driver.c | 3 + src/xen/xen_hypervisor.c | 2 + src/xen/xen_inotify.c | 2 + src/xen/xend_internal.c | 2 + src/xen/xm_internal.c | 2 + src/xen/xs_internal.c | 2 + src/xenapi/xenapi_utils.c | 2 + src/xenxs/xen_sxpr.c | 2 + tests/domainconftest.c | 2 + tests/eventtest.c | 2 + tests/fdstreamtest.c | 2 + tests/libvirtdconftest.c | 2 + tests/qemumonitortestutils.c | 2 + tests/securityselinuxlabeltest.c | 2 + tests/securityselinuxtest.c | 2 + tests/sockettest.c | 2 + tests/testutils.c | 4 +- tests/virauthconfigtest.c | 2 + tests/vircgrouptest.c | 2 + tests/virdbustest.c | 2 + tests/virdrivermoduletest.c | 2 + tests/virhashtest.c | 2 + tests/viridentitytest.c | 1 + tests/virkeycodetest.c | 1 + tests/virkeyfiletest.c | 1 + tests/virlockspacetest.c | 2 + tests/virnetmessagetest.c | 2 + tests/virnetsockettest.c | 2 + tests/virnettlscontexttest.c | 2 + tests/virnettlshelpers.c | 2 + tests/virnettlssessiontest.c | 2 + tests/virportallocatortest.c | 1 + tests/virstoragetest.c | 2 + tests/virstringtest.c | 2 + tests/virsystemdtest.c | 2 + tests/virtimetest.c | 2 + tests/viruritest.c | 2 + tools/virsh-console.c | 2 + 240 files changed, 637 insertions(+), 563 deletions(-) create mode 100644 src/util/virprobe.h -- 1.8.5.3

4 26

[libvirt] limit downtime during life migration from xl/virsh
by Olaf Hering 10 Mar '14

10 Mar '14

During live migration of VMs from one host to another the VM is suspended for an unpredictable amount of time. The actual downtime depends on how many new pages will be dirty and the band width to the destination host. Since VM memory size grows faster than transfer rates the currently available tuneables will cause troubles for workloads within the VM which can not handle large timejumps. I have already written code to tweak the inner loop doing the actual migration work in libxc. But the patchset exposes the details of the loop to the cmdline, as such it is not portable nor is it a friendly UI for the hostadmin. Here is my proposal for a new option for virsh and 2 new options for xl: [xl | virsh --live] --max-suspend-time N --timeout N VM host --max-suspend-time N: as the name suggests, the VM downtime must not be longer than specified. The code doing the migration has to estimate the transfer speed. If the VM is about to be suspended, it has to check if the remaining dirty pages can be transfered within the required timeframe. If not, the migration is aborted, the VM continues to run on the src host, the new VM on the dst host is destroyed and an error is returned. --timeout N: if a VM is busy and its workload causes many new dirty pages the migrate command would take forever. This option is supposed to stop the migration attempt if the number of new dirty pages is too high. It would change the semantics of "virsh migrate --timeout n", which currently forces a suspend (according to the help text). I'm not sure if its acceptable to add this option just for the libxl (and maybe xend) target in libvirt, until someone steps up to do also the kvm part. For Xen it would be added for xl only, obviously. Olaf

3 4

[libvirt] QEMU participating in Outreach Program for Women
by Stefan Hajnoczi 10 Mar '14

10 Mar '14

I am delighted to announce that we are participating in Outreach Program for Women! The same QEMU, KVM, and libvirt project ideas are shared with Google Summer of Code. Outreach Program for Women was started by GNOME specifically for women who want to start contributing to open source. It has since grown to include other organizations and we are able to take part this summer! If you would like to apply or know someone who might be interested in a 12-week, paid, open source gig from May 19 to August 18, take a look at our wiki: http://qemu-project.org/Outreach_Program_for_Women_Summer_2014 The application period starts today (March 10th) and the deadline is March 19th. Join the #qemu-gsoc IRC channel on irc.oftc.net to chat with mentors or ask questions. Also see the official OPW page for an overview of how it works: https://wiki.gnome.org/OutreachProgramForWomen/ Stefan

1 0

[libvirt] [PATCH 0/8] Misc ebtables cleanup patches
by Daniel P. Berrange 10 Mar '14

10 Mar '14

In doing some work on the firewall code in libvirt I came across lots of cruft which could usefully be cleaned up.. Daniel P. Berrange (8): Remove many decls from bridge driver platform header Remove decl of method which doesn't exist in virebtables.h Make ebtablesForwardPolicyReject static Remove unused variables from ebtablesContext Remove data structure holding list of ebtables rules Remove worthless ebtRules data structure Remove unused ebtablesRemoveForwardPolicyReject method Remove broken error reporting in QEMU mac filtering src/Makefile.am | 4 +- src/network/bridge_driver_linux.c | 42 ++++--- src/network/bridge_driver_nop.c | 42 ------- src/network/bridge_driver_platform.h | 22 ---- src/qemu/qemu_bridge_filter.c | 104 ---------------- src/qemu/qemu_bridge_filter.h | 37 ------ src/qemu/qemu_command.c | 11 +- src/qemu/qemu_conf.c | 1 - src/qemu/qemu_driver.c | 7 +- src/qemu/qemu_hotplug.c | 11 +- src/qemu/qemu_process.c | 10 +- src/util/virebtables.c | 233 +++-------------------------------- src/util/virebtables.h | 24 ---- 13 files changed, 60 insertions(+), 488 deletions(-) delete mode 100644 src/qemu/qemu_bridge_filter.c delete mode 100644 src/qemu/qemu_bridge_filter.h -- 1.8.5.3

2 9

[libvirt] [PATCH] libvirt-tck: Update hook syntax for libvirt 0.9.0+
by Mike Latimer 10 Mar '14

10 Mar '14

Starting with libvirt 0.9.0+, hook scripts can be called from several new locations. These locations must also be reflected in the expected logs of the hook tests. The final test in 052-domain-hook.t intentionally produces a failed start, which should show the first stage in the startup hook process, followed by all the stages in the destroy process. In addition to the above changes, libvirtd init scripts can return daemon status in several different ways (due to distribution differences, sysvinit vs. systemd, etc). This patch allows for 'running|active', and 'stopped|unused|inactive' responses which the hook tests rely on. --- lib/Sys/Virt/TCK/Hooks.pm | 17 ++++++++++++----- scripts/hooks/051-daemon-hook.t | 2 +- scripts/hooks/052-domain-hook.t | 6 +++--- 3 files changed, 16 insertions(+), 9 deletions(-) diff --git a/lib/Sys/Virt/TCK/Hooks.pm b/lib/Sys/Virt/TCK/Hooks.pm index 75f98e9..2ae2c2a 100644 --- a/lib/Sys/Virt/TCK/Hooks.pm +++ b/lib/Sys/Virt/TCK/Hooks.pm @@ -73,10 +73,10 @@ sub libvirtd_status { my $status = `service libvirtd status`; my $_ = $status; - if (/running/) { - $self->{libvirtd_status} = 'running'; - } elsif (/stopped/) { + if (/stopped|unused|inactive/) { $self->{libvirtd_status} = 'stopped'; + } elsif (/running|active/) { + $self->{libvirtd_status} = 'running'; } return $self; @@ -146,13 +146,20 @@ sub expect_log { } elsif ($self->{type} eq 'qemu' or $self->{type} eq 'lxc') { if ($domain_state eq &Sys::Virt::Domain::STATE_RUNNING) { if ($action eq 'destroy') { - $expect_log = "$hook $domain_name stopped end -"; + $expect_log = "$hook $domain_name stopped end -\n". + "$hook $domain_name release end -"; } else { die "hooks testing doesn't support $action running domain"; } } elsif ($domain_state eq &Sys::Virt::Domain::STATE_SHUTOFF) { if ($action eq 'start') { - $expect_log = "$hook $domain_name start begin -"; + $expect_log = "$hook $domain_name prepare begin -\n". + "$hook $domain_name start begin -\n". + "$hook $domain_name started begin -"; + } elsif ($action eq 'failstart') { + $expect_log = "$hook $domain_name prepare begin -\n". + "$hook $domain_name stopped end -\n". + "$hook $domain_name release end -"; } else { die "hooks testing doesn't support $action shutoff domain"; } diff --git a/scripts/hooks/051-daemon-hook.t b/scripts/hooks/051-daemon-hook.t index d9cfb3a..165cf4e 100644 --- a/scripts/hooks/051-daemon-hook.t +++ b/scripts/hooks/051-daemon-hook.t @@ -85,7 +85,7 @@ SKIP: { ok($hook->compare_log(), "$hook->{name} is invoked correctly while $hook->{action} libvirtd"); diag "check if libvirtd is stopped"; - ok(`service libvirtd status` =~ /stopped/, "libvirtd is stopped"); + ok(`service libvirtd status` =~ /stopped|unused|inactive/, "libvirtd is stopped"); # start libvirtd $hook->action('start'); diff --git a/scripts/hooks/052-domain-hook.t b/scripts/hooks/052-domain-hook.t index e3b55ec..90b8a48 100644 --- a/scripts/hooks/052-domain-hook.t +++ b/scripts/hooks/052-domain-hook.t @@ -90,7 +90,7 @@ SKIP: { ok(-f "$hook->{name}", "$hook->{name} is invoked"); my $actual_log_data = slurp($hook->{log_name}); - diag "acutal log: $hook->{log_name} '$actual_log_data'"; + diag "actual log: $hook->{log_name} '$actual_log_data'"; diag "expect log:\n $hook->{expect_log}"; @@ -147,7 +147,7 @@ SKIP: { $hook->domain_name($domain_name); $hook->domain_state($domain_state); - $hook->action('start'); + $hook->action('failstart'); $hook->expect_log(); diag "start $domain_name"; @@ -170,7 +170,7 @@ SKIP: { diag "expect log:\n $hook->{expect_log}"; diag "check if the actual log is same with expected log"; - ok($hook->compare_log, "$hook->{name} is invoked correctly while start $domain_name"); + ok($hook->compare_log, "$hook->{name} is invoked correctly while failing to start $domain_name"); # undefine domain diag "undefine $domain_name"; -- 1.8.4.5

3 4

[libvirt] [PATCH v2] qemu: Advertise <drivediscard/> in capabilities if 'discard' is supported.
by Richard W.M. Jones 10 Mar '14

10 Mar '14

The capabilities will have a <drivediscard/> feature if you are allowed to use the qemu attribute: <driver name='qemu' ... discard='unmap|ignore' /> The new capabilities XML looks like this: <capabilities> ... <guest> <os_type>hvm</os_type> ... <features> <drivediscard/> </features> </guest> </capabilities> --- src/conf/capabilities.c | 3 ++- src/qemu/qemu_capabilities.c | 4 ++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/src/conf/capabilities.c b/src/conf/capabilities.c index c1c4ab8..ff5912a 100644 --- a/src/conf/capabilities.c +++ b/src/conf/capabilities.c @@ -947,7 +947,8 @@ virCapabilitiesFormatXML(virCapsPtr caps) STREQ(caps->guests[i]->features[j]->name, "nonpae") || STREQ(caps->guests[i]->features[j]->name, "ia64_be") || STREQ(caps->guests[i]->features[j]->name, "cpuselection") || - STREQ(caps->guests[i]->features[j]->name, "deviceboot")) { + STREQ(caps->guests[i]->features[j]->name, "deviceboot") || + STREQ(caps->guests[i]->features[j]->name, "drivediscard")) { virBufferAsprintf(&xml, " <%s/>\n", caps->guests[i]->features[j]->name); } else { diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index cae25e0..b755fb2 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -778,6 +778,10 @@ virQEMUCapsInitGuest(virCapsPtr caps, !virCapabilitiesAddGuestFeature(guest, "deviceboot", 1, 0)) goto error; + if (virQEMUCapsGet(qemubinCaps, QEMU_CAPS_DRIVE_DISCARD) && + !virCapabilitiesAddGuestFeature(guest, "drivediscard", 0, 0)) + goto error; + if (virCapabilitiesAddGuestDomain(guest, "qemu", NULL, -- 1.8.5.3

1 1