- Devel - libvirt List Archives

[libvirt] libvirt.org outage
by Eric Blake 25 Jul '11

25 Jul '11

libvirt.org appears to be down, possibly for as long as the entire weekend. While that doesn't help anyone trying to browse the online documentation, we at least have the benefit of git being a distributed version control system. For those who would like to track what will be pushed to upstream libvirt.git once it is back online, I've got my personal repo available for the purpose. Assuming that I caught things just before the power outage, then it will be a trivial sync to get everything from my master branch back upstream once things are back to normal. Browse the latest state at: http://repo.or.cz/w/libvirt/ericb.git Track the latest state of upstream patches with: git pull git://repo.or.cz/libvirt/ericb.git master Propose your own patches for me to merge in to the master branch (the mob branch has no push restrictions - anyone can push there, but that also means that anyone can rewind history there, so let me know the commit id of anything that you have pushed there that I should then sync into the master branch): git push mob@repo.or.cz:/srv/git/libvirt/ericb.git +HEAD:mob Feel free to ask questions on list or on irc://irc.oftc.net/virt if you want to coordinate on bleeding-edge development this weekend. -- Eric Blake eblake(a)redhat.com +1-801-349-2682 Libvirt virtualization library http://libvirt.org

4 5

[libvirt] [PATCH] docs: Break up 'Basic Resources' XML section
by Cole Robinson 25 Jul '11

25 Jul '11

We had a bit too many elements crammed in there. Separate it into different headings: - CPU Allocation (<vcpus>) - CPU Tuning (<cputune>) - Memory allocation (<memory> and <currentMemory>) - Memory backing (<memoryBacking>) - Memory tuning (<memtune>) - Numa tuning (<numatune>) - Block I/O tuning (<blkiotune>) --- docs/formatdomain.html.in | 227 ++++++++++++++++++++++++++++++--------------- 1 files changed, 154 insertions(+), 73 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 83146ed..847b9ed 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -282,85 +282,17 @@ </dd> </dl> - <h3><a name="elementsResources">Basic resources</a></h3> + <h3><a name="elementsCPUAllocation">CPU Allocation</a></h3> <pre> +<domain> ... - <memory>524288</memory> - <currentMemory>524288</currentMemory> - <memoryBacking> - <hugepages/> - </memoryBacking> - <blkiotune> - <weight>800</weight> - </blkiotune> - <memtune> - <hard_limit>1048576</hard_limit> - <soft_limit>131072</soft_limit> - <swap_hard_limit>2097152</swap_hard_limit> - <min_guarantee>65536</min_guarantee> - </memtune> <vcpu cpuset="1-4,^3,6" current="1">2</vcpu> - <cputune> - <vcpupin vcpu="0" cpuset="1-4,^2"/> - <vcpupin vcpu="1" cpuset="0,1"/> - <vcpupin vcpu="2" cpuset="2,3"/> - <vcpupin vcpu="3" cpuset="0,4"/> - <shares>2048</shares> - <period>1000000</period> - <quota>-1</quota> - </cputune> - <numatune> - <memory mode="strict" nodeset="1-4,^3"/> - </numatune> - ...</pre> + ... +</domain> +</pre> <dl> - <dt><code>memory</code></dt> - <dd>The maximum allocation of memory for the guest at boot time. - The units for this value are kilobytes (i.e. blocks of 1024 bytes)</dd> - <dt><code>currentMemory</code></dt> - <dd>The actual allocation of memory for the guest. This value can - be less than the maximum allocation, to allow for ballooning - up the guests memory on the fly. If this is omitted, it defaults - to the same value as the <code>memory</code> element</dd> - <dt><code>memoryBacking</code></dt> - <dd>The optional <code>memoryBacking</code> element, may have an - <code>hugepages</code> element set within it. This tells the - hypervisor that the guest should have its memory allocated using - hugepages instead of the normal native page size.</dd> - <dt><code>blkiotune</code></dt> - <dd> The optional <code>blkiotune</code> element provides the ability - to tune Blkio cgroup tunable parameters for the domain. If this is - omitted, it defaults to the OS provided defaults.</dd> - <dt><code>weight</code></dt> - <dd> The optional <code>weight</code> element is the I/O weight of the - guest. The value should be in range [100, 1000].</dd> - <dt><code>memtune</code></dt> - <dd> The optional <code>memtune</code> element provides details - regarding the memory tunable parameters for the domain. If this is - omitted, it defaults to the OS provided defaults. For QEMU/KVM, the - parameters are applied to the QEMU process as a whole. Thus, when - counting them, one needs to add up guest RAM, guest video RAM, and - some memory overhead of QEMU itself. The last piece is hard to - determine so one needs guess and try.</dd> - <dt><code>hard_limit</code></dt> - <dd> The optional <code>hard_limit</code> element is the maximum memory - the guest can use. The units for this value are kilobytes (i.e. blocks - of 1024 bytes)</dd> - <dt><code>soft_limit</code></dt> - <dd> The optional <code>soft_limit</code> element is the memory limit to - enforce during memory contention. The units for this value are - kilobytes (i.e. blocks of 1024 bytes)</dd> - <dt><code>swap_hard_limit</code></dt> - <dd> The optional <code>swap_hard_limit</code> element is the maximum - memory plus swap the guest can use. The units for this value are - kilobytes (i.e. blocks of 1024 bytes). This has to be more than - hard_limit value provided</dd> - <dt><code>min_guarantee</code></dt> - <dd> The optional <code>min_guarantee</code> element is the guaranteed - minimum memory allocation for the guest. The units for this value are - kilobytes (i.e. blocks of 1024 bytes)</dd> <dt><code>vcpu</code></dt> <dd>The content of this element defines the maximum number of virtual CPUs allocated for the guest OS, which must be between 1 and @@ -375,6 +307,28 @@ be used to specify whether fewer than the maximum number of virtual CPUs should be enabled. </dd> + </dl> + + + <h3><a name="elementsCPUTuning">CPU Tuning</a></h3> + +<pre> +<domain> + ... + <cputune> + <vcpupin vcpu="0" cpuset="1-4,^2"/> + <vcpupin vcpu="1" cpuset="0,1"/> + <vcpupin vcpu="2" cpuset="2,3"/> + <vcpupin vcpu="3" cpuset="0,4"/> + <shares>2048</shares> + <period>1000000</period> + <quota>-1</quota> + </cputune> + ... +</domain> +</pre> + + <dl> <dt><code>cputune</code></dt> <dd> The optional <code>cputune</code> element provides details @@ -422,6 +376,110 @@ speed. (NB: Only qemu driver support) <span class="since">Since 0.9.4</span> </dd> + </dl> + + + <h3><a name="elementsMemoryAllocation">Memory Allocation</a></h3> + +<pre> +<domain> + ... + <memory>524288</memory> + <currentMemory>524288</currentMemory> + ... +</domain> +</pre> + + <dl> + <dt><code>memory</code></dt> + <dd>The maximum allocation of memory for the guest at boot time. + The units for this value are kilobytes (i.e. blocks of 1024 bytes)</dd> + <dt><code>currentMemory</code></dt> + <dd>The actual allocation of memory for the guest. This value can + be less than the maximum allocation, to allow for ballooning + up the guests memory on the fly. If this is omitted, it defaults + to the same value as the <code>memory</code> element</dd> + </dl> + + + <h3><a name="elementsMemoryBacking">Memory Backing</a></h3> + +<pre> +<domain> + ... + <memoryBacking> + <hugepages/> + </memoryBacking> + ... +</domain> +</pre> + + <dl> + <dt><code>memoryBacking</code></dt> + <dd>The optional <code>memoryBacking</code> element, may have an + <code>hugepages</code> element set within it. This tells the + hypervisor that the guest should have its memory allocated using + hugepages instead of the normal native page size.</dd> + </dl> + + + <h3><a name="elementsMemoryTuning">Memory Tuning</a></h3> + +<pre> +<domain> + ... + <memtune> + <hard_limit>1048576</hard_limit> + <soft_limit>131072</soft_limit> + <swap_hard_limit>2097152</swap_hard_limit> + <min_guarantee>65536</min_guarantee> + </memtune> + ... +</domain> +</pre> + + <dl> + <dt><code>memtune</code></dt> + <dd> The optional <code>memtune</code> element provides details + regarding the memory tunable parameters for the domain. If this is + omitted, it defaults to the OS provided defaults. For QEMU/KVM, the + parameters are applied to the QEMU process as a whole. Thus, when + counting them, one needs to add up guest RAM, guest video RAM, and + some memory overhead of QEMU itself. The last piece is hard to + determine so one needs guess and try.</dd> + <dt><code>hard_limit</code></dt> + <dd> The optional <code>hard_limit</code> element is the maximum memory + the guest can use. The units for this value are kilobytes (i.e. blocks + of 1024 bytes)</dd> + <dt><code>soft_limit</code></dt> + <dd> The optional <code>soft_limit</code> element is the memory limit to + enforce during memory contention. The units for this value are + kilobytes (i.e. blocks of 1024 bytes)</dd> + <dt><code>swap_hard_limit</code></dt> + <dd> The optional <code>swap_hard_limit</code> element is the maximum + memory plus swap the guest can use. The units for this value are + kilobytes (i.e. blocks of 1024 bytes). This has to be more than + hard_limit value provided</dd> + <dt><code>min_guarantee</code></dt> + <dd> The optional <code>min_guarantee</code> element is the guaranteed + minimum memory allocation for the guest. The units for this value are + kilobytes (i.e. blocks of 1024 bytes)</dd> + </dl> + + + <h3><a name="elementsNUMATuning">NUMA Node Tuning</a></h3> + +<pre> +<domain> + ... + <numatune> + <memory mode="strict" nodeset="1-4,^3"/> + </numatune> + ... +</domain> +</pre> + + <dl> <dt><code>numatune</code></dt> <dd> The optional <code>numatune</code> element provides details of @@ -440,6 +498,29 @@ </dd> </dl> + + <h3><a name="elementsBlockTuning">Block I/O Tuning</a></h3> +<pre> +<domain> + ... + <blkiotune> + <weight>800</weight> + </blkiotune> + ... +</domain> +</pre> + + <dl> + <dt><code>blkiotune</code></dt> + <dd> The optional <code>blkiotune</code> element provides the ability + to tune Blkio cgroup tunable parameters for the domain. If this is + omitted, it defaults to the OS provided defaults.</dd> + <dt><code>weight</code></dt> + <dd> The optional <code>weight</code> element is the I/O weight of the + guest. The value should be in range [100, 1000].</dd> + </dl> + + <h3><a name="elementsCPU">CPU model and topology</a></h3> <p> -- 1.7.4.4

2 2

[libvirt] [PATCHv2 0/4] support the listenNetwork attribute in <graphics>
by Laine Stump 25 Jul '11

25 Jul '11

This patch series resolves the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=703851 In short, it implements support for a new "listenNetwork" attribute in the domain's <graphics> element. When listenNetwork is specified, libvirt will look for a network of that name (from the networks that can be created within libvirt), and derive a listen address from the physical interface used to connect that network to the outside world. (More details are given in each commit message). This is V2. The main differences from V1 are: 1) everything was rebased 2) I eliminated #if WITH_NETWORK in the .c files by defining the one missing function as static inline when WITH_NETWORK is false. This series is meant to be applied on top of the "network physical device abstraction" patch series I sent a couple hours ago: https://www.redhat.com/archives/libvir-list/2011-July/msg01294.html Don't attempt to apply it by itself!

3 18

[libvirt] [libvirt-test-API][PATCH 2/2] Add clean part for install_windows_cdrom
by Wayne Sun 25 Jul '11

25 Jul '11

* Add cleanup function install_windows_cdrom_clean --- repos/domain/install_windows_cdrom.py | 88 +++++++++++++++++++++++++++----- 1 files changed, 74 insertions(+), 14 deletions(-) diff --git a/repos/domain/install_windows_cdrom.py b/repos/domain/install_windows_cdrom.py index f1441df..2ea0ee7 100644 --- a/repos/domain/install_windows_cdrom.py +++ b/repos/domain/install_windows_cdrom.py @@ -51,6 +51,15 @@ __version__ = "0.1.0" __credits__ = "Copyright (C) 2010 Red Hat, Inc." __all__ = ['install_windows_cdrom', 'usage'] +VIRSH_QUIET_LIST = "virsh --quiet list --all|awk '{print $2}'|grep \"^%s$\"" +VM_STAT = "virsh --quiet list --all| grep \"\\b%s\\b\"|grep off" +VM_DESTROY = "virsh destroy %s" +VM_UNDEFINE = "virsh undefine %s" + +FLOOPY_IMG = "/tmp/floppy.img" +ISO_MOUNT_POINT = "/mnt/libvirt_windows" + + def usage(): print '''usage: mandatory arguments:guesttype guestname @@ -132,19 +141,19 @@ def prepare_iso(iso_file, mount_point): return 0, iso_local_path def prepare_floppy_image(guestname, guestos, guestarch, - windows_unattended_path, cdkey, floppy_img): + windows_unattended_path, cdkey, FLOOPY_IMG): """Making corresponding floppy images for the given guestname """ - if os.path.exists(floppy_img): - os.remove(floppy_img) + if os.path.exists(FLOOPY_IMG): + os.remove(FLOOPY_IMG) - create_cmd = 'dd if=/dev/zero of=%s bs=1440k count=1' % floppy_img + create_cmd = 'dd if=/dev/zero of=%s bs=1440k count=1' % FLOOPY_IMG (status, text) = commands.getstatusoutput(create_cmd) if status: logger.error("failed to create floppy image") return 1 - format_cmd = 'mkfs.msdos -s 1 %s' % floppy_img + format_cmd = 'mkfs.msdos -s 1 %s' % FLOOPY_IMG (status, text) = commands.getstatusoutput(format_cmd) if status: logger.error("failed to format floppy image") @@ -159,7 +168,7 @@ def prepare_floppy_image(guestname, guestos, guestarch, os.makedirs(floppy_mount) try: - mount_cmd = 'mount -o loop %s %s' % (floppy_img, floppy_mount) + mount_cmd = 'mount -o loop %s %s' % (FLOOPY_IMG, floppy_mount) (status, text) = commands.getstatusoutput(mount_cmd) if status: logger.error( @@ -202,7 +211,7 @@ def prepare_floppy_image(guestname, guestos, guestarch, cleanup(floppy_mount) - os.chmod(floppy_img, 0755) + os.chmod(FLOOPY_IMG, 0755) logger.info("Boot floppy created successfuly") return 0 @@ -339,22 +348,18 @@ def install_windows_cdrom(params): logger.info('prepare pre-installation environment...') logger.info('mount windows nfs server to /mnt/libvirt_windows') - iso_mount_point = "/mnt/libvirt_windows" - - status, iso_local_path = prepare_iso(iso_file, iso_mount_point) + status, iso_local_path = prepare_iso(iso_file, ISO_MOUNT_POINT) if status: logger.error("installation failed") return 1 params['bootcd'] = iso_local_path - floppy_img = "/tmp/floppy.img" - status = prepare_floppy_image(guestname, guestos, guestarch, - windows_unattended_path, cdkey, floppy_img) + windows_unattended_path, cdkey, FLOOPY_IMG) if status: logger.error("making floppy image failed") return 1 - params['floppysource'] = floppy_img + params['floppysource'] = FLOOPY_IMG xmlobj = xmlbuilder.XmlBuilder() guestxml = xmlobj.build_domain_install_win(params) @@ -458,3 +463,58 @@ def install_windows_cdrom(params): return return_close(conn, logger, 0) +def install_windows_cdrom_clean(params): + """ clean testing environment """ + logger = params['logger'] + guestname = params.get('guestname') + guesttype = params.get('guesttype') + + util = utils.Utils() + hypervisor = util.get_hypervisor() + if hypervisor == 'xen': + imgfullpath = os.path.join('/var/lib/xen/images', guestname) + elif hypervisor == 'kvm': + imgfullpath = os.path.join('/var/lib/libvirt/images', guestname) + + (status, output) = commands.getstatusoutput(VIRSH_QUIET_LIST % guestname) + if status: + pass + else: + logger.info("remove guest %s, and its disk image file" % guestname) + (status, output) = commands.getstatusoutput(VM_STAT % guestname) + if status: + (status, output) = commands.getstatusoutput(VM_DESTROY % guestname) + if status: + logger.error("failed to destroy guest %s" % guestname) + logger.error("%s" % output) + else: + (status, output) = commands.getstatusoutput(VM_UNDEFINE % guestname) + if status: + logger.error("failed to undefine guest %s" % guestname) + logger.error("%s" % output) + else: + (status, output) = commands.getstatusoutput(VM_UNDEFINE % guestname) + if status: + logger.error("failed to undefine guest %s" % guestname) + logger.error("%s" % output) + + guestos = params.get('guestos') + guestarch = params.get('guestarch') + + envfile = os.path.join(homepath, 'env.cfg') + envparser = env_parser.Envparser(envfile) + iso_file = envparser.get_value("guest", guestos + '_' + guestarch) + + status, iso_local_path = prepare_iso(iso_file, ISO_MOUNT_POINT) + if os.path.exists(iso_local_path): + os.remove(iso_local_path) + + iso_local_path_1 = iso_local_path + ".1" + if os.path.exists(iso_local_path_1): + os.remove(iso_local_path_1) + + if os.path.exists(imgfullpath): + os.remove(imgfullpath) + + if os.path.exists(FLOOPY_IMG): + os.remove(FLOOPY_IMG) -- 1.7.6

3 5

[libvirt] [libvirt-test-API][PATCH 2/2] Add clean part for install_windows_cdrom
by Wayne Sun 24 Jul '11

24 Jul '11

* Add cleanup function install_windows_cdrom_clean --- repos/domain/install_windows_cdrom.py | 88 +++++++++++++++++++++++++++----- 1 files changed, 74 insertions(+), 14 deletions(-) diff --git a/repos/domain/install_windows_cdrom.py b/repos/domain/install_windows_cdrom.py index f1441df..2ea0ee7 100644 --- a/repos/domain/install_windows_cdrom.py +++ b/repos/domain/install_windows_cdrom.py @@ -51,6 +51,15 @@ __version__ = "0.1.0" __credits__ = "Copyright (C) 2010 Red Hat, Inc." __all__ = ['install_windows_cdrom', 'usage'] +VIRSH_QUIET_LIST = "virsh --quiet list --all|awk '{print $2}'|grep \"^%s$\"" +VM_STAT = "virsh --quiet list --all| grep \"\\b%s\\b\"|grep off" +VM_DESTROY = "virsh destroy %s" +VM_UNDEFINE = "virsh undefine %s" + +FLOOPY_IMG = "/tmp/floppy.img" +ISO_MOUNT_POINT = "/mnt/libvirt_windows" + + def usage(): print '''usage: mandatory arguments:guesttype guestname @@ -132,19 +141,19 @@ def prepare_iso(iso_file, mount_point): return 0, iso_local_path def prepare_floppy_image(guestname, guestos, guestarch, - windows_unattended_path, cdkey, floppy_img): + windows_unattended_path, cdkey, FLOOPY_IMG): """Making corresponding floppy images for the given guestname """ - if os.path.exists(floppy_img): - os.remove(floppy_img) + if os.path.exists(FLOOPY_IMG): + os.remove(FLOOPY_IMG) - create_cmd = 'dd if=/dev/zero of=%s bs=1440k count=1' % floppy_img + create_cmd = 'dd if=/dev/zero of=%s bs=1440k count=1' % FLOOPY_IMG (status, text) = commands.getstatusoutput(create_cmd) if status: logger.error("failed to create floppy image") return 1 - format_cmd = 'mkfs.msdos -s 1 %s' % floppy_img + format_cmd = 'mkfs.msdos -s 1 %s' % FLOOPY_IMG (status, text) = commands.getstatusoutput(format_cmd) if status: logger.error("failed to format floppy image") @@ -159,7 +168,7 @@ def prepare_floppy_image(guestname, guestos, guestarch, os.makedirs(floppy_mount) try: - mount_cmd = 'mount -o loop %s %s' % (floppy_img, floppy_mount) + mount_cmd = 'mount -o loop %s %s' % (FLOOPY_IMG, floppy_mount) (status, text) = commands.getstatusoutput(mount_cmd) if status: logger.error( @@ -202,7 +211,7 @@ def prepare_floppy_image(guestname, guestos, guestarch, cleanup(floppy_mount) - os.chmod(floppy_img, 0755) + os.chmod(FLOOPY_IMG, 0755) logger.info("Boot floppy created successfuly") return 0 @@ -339,22 +348,18 @@ def install_windows_cdrom(params): logger.info('prepare pre-installation environment...') logger.info('mount windows nfs server to /mnt/libvirt_windows') - iso_mount_point = "/mnt/libvirt_windows" - - status, iso_local_path = prepare_iso(iso_file, iso_mount_point) + status, iso_local_path = prepare_iso(iso_file, ISO_MOUNT_POINT) if status: logger.error("installation failed") return 1 params['bootcd'] = iso_local_path - floppy_img = "/tmp/floppy.img" - status = prepare_floppy_image(guestname, guestos, guestarch, - windows_unattended_path, cdkey, floppy_img) + windows_unattended_path, cdkey, FLOOPY_IMG) if status: logger.error("making floppy image failed") return 1 - params['floppysource'] = floppy_img + params['floppysource'] = FLOOPY_IMG xmlobj = xmlbuilder.XmlBuilder() guestxml = xmlobj.build_domain_install_win(params) @@ -458,3 +463,58 @@ def install_windows_cdrom(params): return return_close(conn, logger, 0) +def install_windows_cdrom_clean(params): + """ clean testing environment """ + logger = params['logger'] + guestname = params.get('guestname') + guesttype = params.get('guesttype') + + util = utils.Utils() + hypervisor = util.get_hypervisor() + if hypervisor == 'xen': + imgfullpath = os.path.join('/var/lib/xen/images', guestname) + elif hypervisor == 'kvm': + imgfullpath = os.path.join('/var/lib/libvirt/images', guestname) + + (status, output) = commands.getstatusoutput(VIRSH_QUIET_LIST % guestname) + if status: + pass + else: + logger.info("remove guest %s, and its disk image file" % guestname) + (status, output) = commands.getstatusoutput(VM_STAT % guestname) + if status: + (status, output) = commands.getstatusoutput(VM_DESTROY % guestname) + if status: + logger.error("failed to destroy guest %s" % guestname) + logger.error("%s" % output) + else: + (status, output) = commands.getstatusoutput(VM_UNDEFINE % guestname) + if status: + logger.error("failed to undefine guest %s" % guestname) + logger.error("%s" % output) + else: + (status, output) = commands.getstatusoutput(VM_UNDEFINE % guestname) + if status: + logger.error("failed to undefine guest %s" % guestname) + logger.error("%s" % output) + + guestos = params.get('guestos') + guestarch = params.get('guestarch') + + envfile = os.path.join(homepath, 'env.cfg') + envparser = env_parser.Envparser(envfile) + iso_file = envparser.get_value("guest", guestos + '_' + guestarch) + + status, iso_local_path = prepare_iso(iso_file, ISO_MOUNT_POINT) + if os.path.exists(iso_local_path): + os.remove(iso_local_path) + + iso_local_path_1 = iso_local_path + ".1" + if os.path.exists(iso_local_path_1): + os.remove(iso_local_path_1) + + if os.path.exists(imgfullpath): + os.remove(imgfullpath) + + if os.path.exists(FLOOPY_IMG): + os.remove(FLOOPY_IMG) -- 1.7.6

1 1

[libvirt] [PATCH] driver.h: Fix two driver documentation mistakes
by Wieland Hoffmann 22 Jul '11

22 Jul '11

--- src/driver.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/driver.h b/src/driver.h index 9d0d3de..adc3e1c 100644 --- a/src/driver.h +++ b/src/driver.h @@ -945,7 +945,7 @@ typedef virInterfaceDriver *virInterfaceDriverPtr; /** * _virInterfaceDriver: * - * Structure associated to a network virtualization driver, defining the various + * Structure associated to a network interface driver, defining the various * entry points for it. * * All drivers must support the following fields/methods: @@ -1106,7 +1106,7 @@ typedef virStorageDriver *virStorageDriverPtr; /** * _virStorageDriver: * - * Structure associated to a network virtualization driver, defining the various + * Structure associated to a storage driver, defining the various * entry points for it. * * All drivers must support the following fields/methods: -- 1.7.6

2 1

Re: [libvirt] [Qemu-devel] live snapshot wiki updated
by Eric Blake 22 Jul '11

22 Jul '11

[adding the libvir-list] On 07/19/2011 08:09 AM, Jes Sorensen wrote: > On 07/19/11 15:58, Eric Blake wrote: >> On 07/19/2011 07:27 AM, Jes Sorensen wrote: >>> Eric, what happens if libvirt in an selinux environment tells QEMU to >>> launch using an image file that is backed by backing file(s)? >> >> Before starting qemu, libvirt first parses all the image files, to see >> if any of them have backing images. For every qcow2 or qed image with a >> backing file, libvirt sets the SELinux context of both the qcow2 image >> and its backing file so that qemu will be able to successfully open() >> them. But if any of those files reside on NFS, then it is not possible >> to label individual files, so it requires setting the SELinux bool >> virt_use_nfs, which thus gives qemu the power to open() arbitrary files >> on NFS, and you've lost security. > > Urgh, libvirt parsing image files is really unfortunate, it really > doesn't give me warm fuzzy feelings :( libvirt really should not know > about internals of image formats. But even if you add new features to qemu to avoid needing this in the future, it doesn't change the past - libvirt will always have to know how to parse image files understood by older qemu, and so as long as libvirt already knows how to do that parsing, we might as well take advantage of it. Besides, I feel that having a well-documented file format, so that independent applications can both parse the same file with the same semantics by obeying the file format specification, is a good design goal. > >> It would be nice if libvirt had a way to pass fds for every disk and >> backing file up front; then, SELinux can work around the lack of NFS >> per-file labelling by blocking open() in qemu. In fact, this has >> already been proposed: > > A cleaner solution seems to have libvirt provide a call-back allowing > QEMU to call out and have libvirt open a file descriptor instead. This > way libvirt can validate it and open it for QEMU and pass it back. Yes, that could probably be made to work with libvirt. > > If we cannot do something like this, I would prefer to have backing > files on NFS should simply not be supported when running in an selinux > setup. As nice as that sentiment is, it will never fly, because it would be a regression in current behavior. The whole reason that the virt_use_nfs SELinux bool exists is that some people are willing to make the partial security tradeoff. Besides, the use of sVirt via SELinux is more than just open() protection - while the current virt_use_nfs bool makes NFS less secure than otherwise possible, it still gives some nice guarantees to the rest of the qemu process such as passthrough accesses to local pci devices. Just because it is currently not as secure to mix NFS shared storage with backing files doesn't stop some people from wanting to do it [in fact, that's my current development setup - I use qcow2 images on NFS shared storage, keep SELinux enabled, and enable the virt_use_nfs bool]. This discussion is about adding enhancements that make SELinux even more powerful when using NFS shared storage, by adding fd passing (whether libvirt parses in advance, or whether qemu raises an event and requires feedback from libvirt), and not about crippling the existing capability to use the virt_use_nfs selinux bool. -- Eric Blake eblake(a)redhat.com +1-801-349-2682 Libvirt virtualization library http://libvirt.org

11 64

[libvirt] [PATCH] build: Use $(PYTHON) instead of python for the keycode map generator
by Matthias Bolte 22 Jul '11

22 Jul '11

Also prepend $(AM_V_GEN). --- src/Makefile.am | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index 481caba..eef0669 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -90,7 +90,7 @@ EXTRA_DIST += $(srcdir)/util/virkeymaps.h $(srcdir)/util/keymaps.csv \ $(srcdir)/util/virkeymaps.h: $(srcdir)/util/keymaps.csv \ $(srcdir)/util/virkeycode-mapgen.py - python $(srcdir)/util/virkeycode-mapgen.py <$(srcdir)/util/keymaps.csv >$@ + $(AM_V_GEN)$(PYTHON) $(srcdir)/util/virkeycode-mapgen.py <$(srcdir)/util/keymaps.csv >$@ $(srcdir)/util/virkeycode.c: $(srcdir)/util/virkeycode.h $(srcdir)/util/virkeymaps.h -- 1.7.4.1

3 5

[libvirt] [PATCH] Pre-create /var/lib/libvirt/sanlock directory
by Daniel P. Berrange 22 Jul '11

22 Jul '11

From: "Daniel P. Berrange" <berrange(a)redhat.com> The sanlock plugin for libvirt expects the directory /var/lib/libvirt/sanlock to exist. Create this and add it to the RPM * libvirt.spec.in: Add /var/lib/libvirt/sanlock * src/Makefile.am: Create /var/lib/libvirt/sanlock --- libvirt.spec.in | 1 + src/Makefile.am | 6 ++++++ 2 files changed, 7 insertions(+), 0 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 6cbd9ac..7c8b2ec 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1046,6 +1046,7 @@ fi %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/sanlock.so %{_datadir}/augeas/lenses/libvirt_sanlock.aug %{_datadir}/augeas/lenses/tests/test_libvirt_sanlock.aug +%dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/sanlock %{_sbindir}/virt-sanlock-cleanup %{_mandir}/man8/virt-sanlock-cleanup.8* %endif diff --git a/src/Makefile.am b/src/Makefile.am index 481caba..c1786cf 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1396,6 +1396,9 @@ install-data-local: $(MKDIR_P) "$(DESTDIR)$(localstatedir)/cache/libvirt" $(MKDIR_P) "$(DESTDIR)$(localstatedir)/lib/libvirt/images" $(MKDIR_P) "$(DESTDIR)$(localstatedir)/lib/libvirt/boot" +if HAVE_SANLOCK + $(MKDIR_P) "$(DESTDIR)$(localstatedir)/lib/libvirt/sanlock" +endif if WITH_QEMU $(MKDIR_P) "$(DESTDIR)$(localstatedir)/lib/libvirt/qemu" $(MKDIR_P) "$(DESTDIR)$(localstatedir)/run/libvirt/qemu" @@ -1438,6 +1441,9 @@ uninstall-local:: rmdir "$(DESTDIR)$(localstatedir)/cache/libvirt" ||: rmdir "$(DESTDIR)$(localstatedir)/lib/libvirt/images" ||: rmdir "$(DESTDIR)$(localstatedir)/lib/libvirt/boot" ||: +if HAVE_SANLOCK + rmdir "$(DESTDIR)$(localstatedir)/lib/libvirt/sanlock" ||: +endif if WITH_QEMU rmdir "$(DESTDIR)$(localstatedir)/lib/libvirt/qemu" ||: rmdir "$(DESTDIR)$(localstatedir)/run/libvirt/qemu" ||: -- 1.7.6

2 2

[libvirt] [PATCH 00/12] New API: virDominShutdownFlags
by Michal Privoznik 22 Jul '11

22 Jul '11

This series creates new API which adds flags to virDomainShutdown. As mentioned here many times, it is a bad luck all APIs don't have flags parameter. Parameter for this might be needed to select different ways of shutting down a domain. Currently, no new functionality is implemented, but this paves the way for creating multiple ways of domain shutting down. Therefore, calling this new API is the same as calling its predecessor. Michal Privoznik (12): shutdown: Define new public API virDomainShutdownFlags shutdown: Wire up the remote protocol shutdown: Implement internal API for qemu driver shutdown: Implement internal API for ESX driver shutdown: Implement internal API for libxl driver shutdown: Implement internal API for openvz driver shutdown: Implement internal API for phyp driver shutdown: Implement internal API for uml driver shutdown: Implement internal API for vbox driver shutdown: Implement internal API for vmware driver shutdown: Implement internal API for xen driver shutdown: Implement internal API for xenapi driver include/libvirt/libvirt.h.in | 6 ++++ src/driver.h | 4 +++ src/esx/esx_driver.c | 12 ++++++++- src/libvirt.c | 54 ++++++++++++++++++++++++++++++++++++++++++ src/libvirt_public.syms | 1 + src/libxl/libxl_driver.c | 12 ++++++++- src/openvz/openvz_driver.c | 1 + src/phyp/phyp_driver.c | 12 ++++++++- src/qemu/qemu_driver.c | 12 ++++++++- src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 8 +++++- src/remote_protocol-structs | 5 ++++ src/uml/uml_driver.c | 15 +++++++++++- src/vbox/vbox_tmpl.c | 14 ++++++++++- src/vmware/vmware_driver.c | 1 + src/xen/xen_driver.c | 14 ++++++++-- src/xen/xen_driver.h | 2 +- src/xen/xen_hypervisor.c | 2 +- src/xen/xen_inotify.c | 2 +- src/xen/xend_internal.c | 10 +++++-- src/xen/xend_internal.h | 2 +- src/xen/xm_internal.c | 2 +- src/xen/xs_internal.c | 10 +++++-- src/xen/xs_internal.h | 3 +- src/xenapi/xenapi_driver.c | 25 ++++++++++++++++++- 25 files changed, 206 insertions(+), 24 deletions(-) -- 1.7.5.rc3

3 16