- Devel - libvirt List Archives

[libvirt] [PATCH] qemu: cleanup tap devices on FreeBSD
by Roman Bogorodskiy 26 Feb '14

26 Feb '14

We have to explicitly destroy TAP devices on FreeBSD because they're not freed after being closed, otherwise we end up with orphaned TAP devices after destroying a domain. --- src/qemu/qemu_process.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index ffa939a..9181423 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -61,6 +61,7 @@ #include "viruuid.h" #include "virprocess.h" #include "virtime.h" +#include "virnetdevbridge.h" #include "virnetdevtap.h" #include "virbitmap.h" #include "viratomic.h" @@ -4381,6 +4382,12 @@ void qemuProcessStop(virQEMUDriverPtr driver, virDomainNetGetActualVirtPortProfile(net), cfg->stateDir)); VIR_FREE(net->ifname); + } else if (virDomainNetGetActualType(net) == VIR_DOMAIN_NET_TYPE_BRIDGE) { + /* On some OSes, e.g. FreeBSD, tap devices are not cleaned up when released, + * so we have to handle that manually */ + ignore_value(virNetDevBridgeRemovePort(virDomainNetGetActualBridgeName(net), + net->ifname)); + ignore_value(virNetDevTapDelete(net->ifname)); } /* release the physical device (or any other resources used by * this interface in the network driver -- 1.8.4.3

3 5

Re: [libvirt] [lxc-devel] capset fails with userns
by Serge Hallyn 26 Feb '14

26 Feb '14

Quoting Stephan Sachse (ste.sachse(a)gmail.com) > > Look at security/commoncap.c:cap_inode_setxattr() > > > > Whereas file ownership is properly namespaced, and task capabilities > > are properly namespaced, file capabilities are more problematic. To > > support this, I think we'd need a new capability xattr format. If we > > add the kuid_t of the user_namespace root id, I think we could safely > > support this. > > sorry for this :) but i'm not a kernel/c programmer. No no, thanks for raising the issue, and thanks for having sent a patch! > maybe there must be more then one cap set per file. > > security.capability for the init_ns > security.capability.{kuid_t} for the userns > > the name of the xattr must be transparently mapped. > > in userns for get*() if there is no security.capability.{kuid_t} use > the security.capability. but never write to security.capability always > to security.capability.{kuid_t} > > or the format of security.capability must be changed to support more > then one set of caps. every capability set must be associated with a > kuid_t. To avoid impacting the performance of the host case, we could keep the current XATTR_NAME_CAPS format in init_user_ns, and add a new XATTR_NAME_CAPS_V2 which adds the kuid_t. > back to line one of my mail: i'm not a kernel/c programmer :'( This frankly looks like fun, but I won't have time to work on this this week. If anyone else does, I'll happily look at the patches. thanks, -serge

1 0

[libvirt] LXC: capset fails with userns
by Stephan Sachse 26 Feb '14

26 Feb '14

w/ userns: [root@fedora2 ~]# setcap 'cap_net_admin,cap_net_raw+ep' /usr/bin/ping Failed to set capabilities on file `/usr/bin/ping' (Operation not permitted) [root@fedora2 ~]# id uid=0(root) gid=0(root) groups=0(root) w/o userns: [root@fedora2 ~]# setcap 'cap_net_admin,cap_net_raw+ep' /usr/bin/ping [root@fedora2 ~]# getcap /usr/bin/ping /usr/bin/ping = cap_net_admin,cap_net_raw+ep [root@fedora2 ~]# id uid=0(root) gid=0(root) groups=0(root) every yum install <pkg> where the pkg has file capabilities fails with Error unpacking rpm package <PKG> error: unpacking of archive failed on file <FILE>: cpio: cap_set_file is there a way to get this working? /stephan -- Software is like sex, it's better when it's free!

3 8

[libvirt] [PATCH v2 0/2] support dumping guest memory in compressed format
by Qiao Nuohan 26 Feb '14

26 Feb '14

dumping guest's memroy is introduced without compression supported, and this is a freature regression of 'virsh dump --memory-only'. This patchset is used to add support in libvirt side to make qemu dump guest's memory in kdump-compressed format and please refer the following address to see implementation of the qemu side, the lastest version of qemu side is v9(ready for being queued). http://lists.nongnu.org/archive/html/qemu-devel/2014-02/msg03016.html ChangLog: Changes from v1 to v2: 1. address Daniel P. Berrange's comment about using a new parameter to replace flags like VIR_DUMP_COMPRESS_ZLIB. qiaonuohan (2): make qemu dump memory in kdump-compressed format add dump_memory_format in qemu.conf include/libvirt/libvirt.h.in | 15 +++++++++- src/driver.h | 3 +- src/libvirt.c | 10 +++++-- src/qemu/libvirtd_qemu.aug | 1 + src/qemu/qemu.conf | 13 +++++++- src/qemu/qemu_conf.c | 3 ++ src/qemu/qemu_conf.h | 2 ++ src/qemu/qemu_driver.c | 61 +++++++++++++++++++++++++++++++++----- src/qemu/qemu_monitor.c | 6 ++-- src/qemu/qemu_monitor.h | 3 +- src/qemu/qemu_monitor_json.c | 4 ++- src/qemu/qemu_monitor_json.h | 3 +- src/qemu/test_libvirtd_qemu.aug.in | 1 + src/remote/remote_protocol.x | 1 + src/test/test_driver.c | 12 +++++++- tests/qemumonitorjsontest.c | 2 +- tools/virsh-domain.c | 45 +++++++++++++++++++++++++++- 17 files changed, 163 insertions(+), 22 deletions(-)

4 7

[libvirt] [PATCH] spec: Fix braces around macros
by Peter Krempa 26 Feb '14

26 Feb '14

In commit 72f7658ba24491672e6b81118f892400916e9404 I've added a few macros with bad bracing. Although they work as expected fix them so that we use uniform syntax. --- libvirt.spec.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index fae4bb7..ef3b832 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -98,7 +98,7 @@ %else %define with_storage_sheepdog 0 %endif -%if 0%{?fedora} >= 19 || 0%{?rhel >= 6} +%if 0%{?fedora} >= 19 || 0%{?rhel} >= 6 %define with_storage_gluster 0%{!?_without_storage_gluster:%{server_drivers}} %else %define with_storage_gluster 0 @@ -155,7 +155,7 @@ # libgfapi is built only on x86_64 on rhel %ifnarch x86_64 - %if 0%{?rhel >= 6} + %if 0%{?rhel} >= 6 %define with_storage_gluster 0 %endif %endif -- 1.8.5.5

3 3

[libvirt] [PATCH] spec: Use correct versions of libgfapi in RHEL builds
by Peter Krempa 26 Feb '14

26 Feb '14

RHEL still uses the 3.4.0 package of libgfapi and the package is built only for x86_64. --- libvirt.spec.in | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 3d5a69e..67b5557 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -98,7 +98,7 @@ %else %define with_storage_sheepdog 0 %endif -%if 0%{?fedora} >= 19 +%if 0%{?fedora} >= 19 || 0%{?rhel >= 6} %define with_storage_gluster 0%{!?_without_storage_gluster:%{server_drivers}} %else %define with_storage_gluster 0 @@ -153,6 +153,13 @@ %define with_numactl 0 %endif +# libgfapi is built only on x86_64 on rhel +%ifnarch x86_64 + %if 0%{?rhel >= 6} + %define with_storage_gluster 0 + %endif +%endif + # RHEL doesn't ship OpenVZ, VBox, UML, PowerHypervisor, # VMWare, libxenserver (xenapi), libxenlight (Xen 4.1 and newer), # or HyperV. @@ -571,9 +578,14 @@ BuildRequires: ceph-devel %endif %endif %if %{with_storage_gluster} +%if 0%{?rhel} >= 6 +BuildRequires: glusterfs-api-devel >= 3.4.0 +BuildRequires: glusterfs-devel >= 3.4.0 +%else BuildRequires: glusterfs-api-devel >= 3.4.1 BuildRequires: glusterfs-devel >= 3.4.1 %endif +%endif %if %{with_numactl} # For QEMU/LXC numa info BuildRequires: numactl-devel -- 1.8.5.5

4 4

[libvirt] [PATCH 0/3] spec file improvements
by Eric Blake 26 Feb '14

26 Feb '14

Our spec file is non-deterministic if you have this in your ~/.rpmmacros: %_without_udev 1 because it then depends on whether you have systemd-devel installed rather than being explicitly stated in the spec file. [At this point, I'm sending the series to get the review started on the two trivial parts; I'm still working on patch 3, including coming up with a formula for proving that the unpatched build was non-deterministic, rather than just my claim above] Eric Blake (2): build: fix spelling of configure --with-systemd-daemon spec: explicitly avoid bhyve on Linux libvirt.spec.in | 2 ++ m4/virt-lib.m4 | 20 +++++++++++++------- 2 files changed, 15 insertions(+), 7 deletions(-) -- 1.8.5.3

3 7

[libvirt] [PATCH] virsh: Honour -q in domblklist, vcpupin and emulatorpin
by Michal Privoznik 26 Feb '14

26 Feb '14

If user wants to grep some info from domain, e.g. disk paths: # virsh -q domblklist win7 | awk '{print $2}' Source /var/lib/libvirt/images/windows.qcow2 /home/zippy/work/tmp/en_windows_7_professional_x64_dvd_X15-65805.iso while with my change: # virsh -q domblklist win7 | awk '{print $2}' /var/lib/libvirt/images/windows.qcow2 /home/zippy/work/tmp/en_windows_7_professional_x64_dvd_X15-65805.iso We don't print table header in other commands, like list. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tools/virsh-domain-monitor.c | 14 +++++++------- tools/virsh-domain.c | 10 +++++----- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/tools/virsh-domain-monitor.c b/tools/virsh-domain-monitor.c index 1192565..4905b7e 100644 --- a/tools/virsh-domain-monitor.c +++ b/tools/virsh-domain-monitor.c @@ -495,12 +495,12 @@ cmdDomblklist(vshControl *ctl, const vshCmd *cmd) goto cleanup; if (details) - vshPrint(ctl, "%-10s %-10s %-10s %s\n", _("Type"), - _("Device"), _("Target"), _("Source")); + vshPrintExtra(ctl, "%-10s %-10s %-10s %s\n", _("Type"), + _("Device"), _("Target"), _("Source")); else - vshPrint(ctl, "%-10s %s\n", _("Target"), _("Source")); + vshPrintExtra(ctl, "%-10s %s\n", _("Target"), _("Source")); - vshPrint(ctl, "------------------------------------------------\n"); + vshPrintExtra(ctl, "------------------------------------------------\n"); for (i = 0; i < ndisks; i++) { char *type = NULL; @@ -609,9 +609,9 @@ cmdDomiflist(vshControl *ctl, const vshCmd *cmd) if (ninterfaces < 0) goto cleanup; - vshPrint(ctl, "%-10s %-10s %-10s %-11s %s\n", _("Interface"), _("Type"), - _("Source"), _("Model"), _("MAC")); - vshPrint(ctl, "-------------------------------------------------------\n"); + vshPrintExtra(ctl, "%-10s %-10s %-10s %-11s %s\n", _("Interface"), + _("Type"), _("Source"), _("Model"), _("MAC")); + vshPrintExtra(ctl, "-------------------------------------------------------\n"); for (i = 0; i < ninterfaces; i++) { char *type = NULL; diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c index 3e73340..2e3f0ed 100644 --- a/tools/virsh-domain.c +++ b/tools/virsh-domain.c @@ -5815,8 +5815,8 @@ cmdVcpuPin(vshControl *ctl, const vshCmd *cmd) if ((ncpus = virDomainGetVcpuPinInfo(dom, info.nrVirtCpu, cpumaps, cpumaplen, flags)) >= 0) { - vshPrint(ctl, "%s %s\n", _("VCPU:"), _("CPU Affinity")); - vshPrint(ctl, "----------------------------------\n"); + vshPrintExtra(ctl, "%s %s\n", _("VCPU:"), _("CPU Affinity")); + vshPrintExtra(ctl, "----------------------------------\n"); for (i = 0; i < ncpus; i++) { if (vcpu != -1 && i != vcpu) continue; @@ -5944,9 +5944,9 @@ cmdEmulatorPin(vshControl *ctl, const vshCmd *cmd) cpumaps = vshMalloc(ctl, cpumaplen); if (virDomainGetEmulatorPinInfo(dom, cpumaps, cpumaplen, flags) >= 0) { - vshPrint(ctl, "%s %s\n", _("emulator:"), _("CPU Affinity")); - vshPrint(ctl, "----------------------------------\n"); - vshPrint(ctl, " *: "); + vshPrintExtra(ctl, "%s %s\n", _("emulator:"), _("CPU Affinity")); + vshPrintExtra(ctl, "----------------------------------\n"); + vshPrintExtra(ctl, " *: "); ret = vshPrintPinInfo(cpumaps, cpumaplen, maxcpu, 0); vshPrint(ctl, "\n"); } -- 1.9.0

2 1

[libvirt] [PATCH] network: don't even call networkRunHook if there is no network
by Laine Stump 26 Feb '14

26 Feb '14

networkAllocateActualDevice() is called for *all* interfaces, not just those with type='network'. In that case, it will jump down to its validate: label immediately, without allocating anything. After validation is done, two counters are potentially updated (one for the network, and one for any particular physical device that is chosen), and then networkRunHook() is called. This patch refactors that code a slight bit so that networkRunHook() doesn't get called if netdef is NULL (i.e. type != network) and to place the conditional increment of dev->connections inside the "if (netdef)" as well - dev can never be non-null if netdef is null (because "dev" is the pointer to a device in a network's pool of devices), so this doesn't have any functional effect, it just makes the code clearer. --- src/network/bridge_driver.c | 47 ++++++++++++++++++++++----------------------- 1 file changed, 23 insertions(+), 24 deletions(-) diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index 152bd06..3fb5ad3 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -3662,36 +3662,35 @@ validate: } } - if (dev) { - /* mark the allocation */ - dev->connections++; - if (actualType != VIR_DOMAIN_NET_TYPE_HOSTDEV) { - VIR_DEBUG("Using physical device %s, %d connections", - dev->device.dev, dev->connections); - } else { - VIR_DEBUG("Using physical device %04x:%02x:%02x.%x, connections %d", - dev->device.pci.domain, dev->device.pci.bus, - dev->device.pci.slot, dev->device.pci.function, - dev->connections); - } - } - if (netdef) { netdef->connections++; VIR_DEBUG("Using network %s, %d connections", netdef->name, netdef->connections); - } - /* finally we can call the 'plugged' hook script if any */ - if (networkRunHook(network, dom, iface, - VIR_HOOK_NETWORK_OP_IFACE_PLUGGED, - VIR_HOOK_SUBOP_BEGIN) < 0) { - /* adjust for failure */ - if (dev) - dev->connections--; - if (netdef) + if (dev) { + /* mark the allocation */ + dev->connections++; + if (actualType != VIR_DOMAIN_NET_TYPE_HOSTDEV) { + VIR_DEBUG("Using physical device %s, %d connections", + dev->device.dev, dev->connections); + } else { + VIR_DEBUG("Using physical device %04x:%02x:%02x.%x, connections %d", + dev->device.pci.domain, dev->device.pci.bus, + dev->device.pci.slot, dev->device.pci.function, + dev->connections); + } + } + + /* finally we can call the 'plugged' hook script if any */ + if (networkRunHook(network, dom, iface, + VIR_HOOK_NETWORK_OP_IFACE_PLUGGED, + VIR_HOOK_SUBOP_BEGIN) < 0) { + /* adjust for failure */ netdef->connections--; - goto error; + if (dev) + dev->connections--; + goto error; + } } ret = 0; -- 1.8.5.3

3 3

[libvirt] [PATCH] network: unplug bandwidth and call networkRunHook only when appropriate
by Laine Stump 26 Feb '14

26 Feb '14

According to commit b4e0299dm if networkAllocateActualDevice() was successful, it will *always* allocate an iface->data.network.actual, so we can use this during networkReleaseActualDevice() to know if there is really anything to undo. We were properly using this information to only decrement the network connections counter if it had previously been incremented, but we were unconditionally unplugging bandwidth and calling the "unplugged" network hook for *all* interfaces (during qemuProcessStop()) whether they had been previously plugged or not. This caused problems if a domain failed to start at some time prior to all interfaces being allocated. (I encountered this when an interface had a bandwidth floor set but no inbound QoS). This patch changes both the call to networkUnplugBandwidth() and the call to networkRunHook() to only be called if there was a previous call to "plug" for the same interface. --- src/network/bridge_driver.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index 3fb5ad3..c797f8f 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -3936,7 +3936,8 @@ networkReleaseActualDevice(virDomainDefPtr dom, } netdef = network->def; - if ((netdef->forward.type == VIR_NETWORK_FORWARD_NONE || + if (iface->data.network.actual && + (netdef->forward.type == VIR_NETWORK_FORWARD_NONE || netdef->forward.type == VIR_NETWORK_FORWARD_NAT || netdef->forward.type == VIR_NETWORK_FORWARD_ROUTE) && networkUnplugBandwidth(network, iface) < 0) @@ -4029,15 +4030,15 @@ networkReleaseActualDevice(virDomainDefPtr dom, } success: - if (iface->data.network.actual) + if (iface->data.network.actual) { netdef->connections--; + VIR_DEBUG("Releasing network %s, %d connections", + netdef->name, netdef->connections); - /* finally we can call the 'unplugged' hook script if any */ - networkRunHook(network, dom, iface, VIR_HOOK_NETWORK_OP_IFACE_UNPLUGGED, - VIR_HOOK_SUBOP_BEGIN); - - VIR_DEBUG("Releasing network %s, %d connections", - netdef->name, netdef->connections); + /* finally we can call the 'unplugged' hook script if any */ + networkRunHook(network, dom, iface, VIR_HOOK_NETWORK_OP_IFACE_UNPLUGGED, + VIR_HOOK_SUBOP_BEGIN); + } ret = 0; cleanup: if (network) -- 1.8.5.3

3 2