- Devel - libvirt List Archives

[libvirt] [PATCH 3/9] add DHCP snooping support to nwfilter
by David L Stevens 11 May '11

11 May '11

This patch changes rules of the form: if ! addr drop accept to: if addr return ... drop The patch adds a "mac" chain to do a mac address list and separates the "arp" chain into separate "arpmac" and "arpip" chains that can check multiple MAC or IP addresses in any combination. This patch itself does not support multiple addresses via the MAC and IP variables, but only changes the form of the rules to allow multiple addresses in the future. Signed-off-by: David L Stevens <dlstevens(a)us.ibm.com> diff --git a/examples/xml/nwfilter/Makefile.am b/examples/xml/nwfilter/Makefile.am index 439e7b8..8ef9a71 100644 --- a/examples/xml/nwfilter/Makefile.am +++ b/examples/xml/nwfilter/Makefile.am @@ -7,6 +7,8 @@ FILTERS = \ allow-ipv4.xml \ clean-traffic.xml \ no-arp-spoofing.xml \ + no-arpmac-spoofing.xml \ + no-arpip-spoofing.xml \ no-ip-multicast.xml \ no-ip-spoofing.xml \ no-mac-broadcast.xml \ diff --git a/examples/xml/nwfilter/allow-arp.xml b/examples/xml/nwfilter/allow-arp.xml index 63a92b2..006bb54 100644 --- a/examples/xml/nwfilter/allow-arp.xml +++ b/examples/xml/nwfilter/allow-arp.xml @@ -1,3 +1,6 @@ -<filter name='allow-arp' chain='arp'> +<filter name='allow-arp' chain='arpmac'> + <rule direction='inout' action='accept'/> +</filter> +<filter name='allow-arp' chain='arpip'> <rule direction='inout' action='accept'/> </filter> diff --git a/examples/xml/nwfilter/clean-traffic.xml b/examples/xml/nwfilter/clean-traffic.xml index 40f0ecb..9cee799 100644 --- a/examples/xml/nwfilter/clean-traffic.xml +++ b/examples/xml/nwfilter/clean-traffic.xml @@ -11,10 +11,10 @@  <filterref filter='no-arp-spoofing'/> -  - <filterref filter='no-other-l2-traffic'/> -  <filterref filter='qemu-announce-self'/> +  + <filterref filter='no-other-l2-traffic'/> + </filter> diff --git a/examples/xml/nwfilter/no-arp-spoofing.xml b/examples/xml/nwfilter/no-arp-spoofing.xml index fdd4e60..1979b20 100644 --- a/examples/xml/nwfilter/no-arp-spoofing.xml +++ b/examples/xml/nwfilter/no-arp-spoofing.xml @@ -1,17 +1,4 @@ -<filter name='no-arp-spoofing' chain='arp'> - <uuid>f88f1932-debf-4aa1-9fbe-f10d3aa4bc95</uuid> - <rule action='drop' direction='out' priority='300' > - <mac match='no' srcmacaddr='$MAC'/> - </rule> - -  -  - <rule action='drop' direction='out' priority='350' > - <arp match='no' arpsrcmacaddr='$MAC'/> - </rule> - <rule action='drop' direction='out' priority='400' > - <arp match='no' arpsrcipaddr='$IP' /> - </rule> -  - <rule action='drop' direction='out' priority='1000' /> +<filter name='no-arp-spoofing'> + <filterref filter='no-arpmac-spoofing' /> + <filterref filter='no-arpip-spoofing' /> </filter> diff --git a/examples/xml/nwfilter/no-arpip-spoofing.xml b/examples/xml/nwfilter/no-arpip-spoofing.xml new file mode 100644 index 0000000..ee42d40 --- /dev/null +++ b/examples/xml/nwfilter/no-arpip-spoofing.xml @@ -0,0 +1,12 @@ +<filter name='no-arpip-spoofing' chain='arpip'> +  +  + <rule action='return' direction='out' priority='400' > + <arp match='yes' arpsrcipaddr='$IP' /> + </rule> + <rule action='return' direction='out' priority='410' > + <arp match='yes' arpsrcipaddr='0.0.0.0' /> + </rule> +  + <rule action='drop' direction='out' priority='1000' /> +</filter> diff --git a/examples/xml/nwfilter/no-arpmac-spoofing.xml b/examples/xml/nwfilter/no-arpmac-spoofing.xml new file mode 100644 index 0000000..90499d3 --- /dev/null +++ b/examples/xml/nwfilter/no-arpmac-spoofing.xml @@ -0,0 +1,7 @@ +<filter name='no-arpmac-spoofing' chain='arpmac'> + <rule action='return' direction='out' priority='350' > + <arp match='yes' arpsrcmacaddr='$MAC'/> + </rule> +  + <rule action='drop' direction='out' priority='1000' /> +</filter> diff --git a/examples/xml/nwfilter/no-ip-spoofing.xml b/examples/xml/nwfilter/no-ip-spoofing.xml index b8c94c8..84e8a5e 100644 --- a/examples/xml/nwfilter/no-ip-spoofing.xml +++ b/examples/xml/nwfilter/no-ip-spoofing.xml @@ -1,7 +1,9 @@ <filter name='no-ip-spoofing' chain='ipv4'>  - <rule action='drop' direction='out'> - <ip match='no' srcipaddr='$IP' /> + <rule action='return' direction='out'> + <ip match='yes' srcipaddr='$IP' /> </rule> +  + <rule action='drop' direction='out' /> </filter> diff --git a/examples/xml/nwfilter/no-mac-spoofing.xml b/examples/xml/nwfilter/no-mac-spoofing.xml index f210623..aee56c7 100644 --- a/examples/xml/nwfilter/no-mac-spoofing.xml +++ b/examples/xml/nwfilter/no-mac-spoofing.xml @@ -1,5 +1,9 @@ -<filter name='no-mac-spoofing' chain='ipv4'> - <rule action='drop' direction='out' priority='10'> - <mac match='no' srcmacaddr='$MAC' /> - </rule> +<filter name='no-mac-spoofing' chain='mac'> +  +  + <rule action='return' direction='out' priority='350' > + <mac match='yes' srcmacaddr='$MAC'/> + </rule> +  + <rule action='drop' direction='out' priority='1000' /> </filter> diff --git a/examples/xml/nwfilter/no-other-l2-traffic.xml b/examples/xml/nwfilter/no-other-l2-traffic.xml index 8bad86e..0501b1a 100644 --- a/examples/xml/nwfilter/no-other-l2-traffic.xml +++ b/examples/xml/nwfilter/no-other-l2-traffic.xml @@ -1,7 +1,12 @@ -<filter name='no-other-l2-traffic'> +<filter name='no-other-l2-traffic' chain='root'> -  - <rule action='drop' direction='inout' priority='1000'/> +  + <rule action='accept' direction='inout'> + <mac protocolid='0x800' /> + </rule> + <rule action='accept' direction='inout'> + <mac protocolid='0x806' /> + </rule> + <rule action='drop' direction='inout' priority='1000' /> </filter> diff --git a/src/conf/nwfilter_conf.c b/src/conf/nwfilter_conf.c index c5705c1..df1a012 100644 --- a/src/conf/nwfilter_conf.c +++ b/src/conf/nwfilter_conf.c @@ -82,7 +82,9 @@ VIR_ENUM_IMPL(virNWFilterEbtablesTable, VIR_NWFILTER_EBTABLES_TABLE_LAST, VIR_ENUM_IMPL(virNWFilterChainSuffix, VIR_NWFILTER_CHAINSUFFIX_LAST, "root", - "arp", + "mac", + "arpmac", + "arpip", "rarp", "ipv4", "ipv6"); diff --git a/src/conf/nwfilter_conf.h b/src/conf/nwfilter_conf.h index ef60b6b..4d60751 100644 --- a/src/conf/nwfilter_conf.h +++ b/src/conf/nwfilter_conf.h @@ -425,7 +425,9 @@ struct _virNWFilterEntry { enum virNWFilterChainSuffixType { VIR_NWFILTER_CHAINSUFFIX_ROOT = 0, - VIR_NWFILTER_CHAINSUFFIX_ARP, + VIR_NWFILTER_CHAINSUFFIX_MAC, + VIR_NWFILTER_CHAINSUFFIX_ARPMAC, + VIR_NWFILTER_CHAINSUFFIX_ARPIP, VIR_NWFILTER_CHAINSUFFIX_RARP, VIR_NWFILTER_CHAINSUFFIX_IPv4, VIR_NWFILTER_CHAINSUFFIX_IPv6, diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 39bd4a5..fa6f719 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -129,20 +129,24 @@ struct ushort_map { enum l3_proto_idx { - L3_PROTO_IPV4_IDX = 0, - L3_PROTO_IPV6_IDX, - L3_PROTO_ARP_IDX, + L3_PROTO_MAC_IDX = 0, + L3_PROTO_ARPMAC_IDX, + L3_PROTO_ARPIP_IDX, L3_PROTO_RARP_IDX, + L3_PROTO_IPV4_IDX, + L3_PROTO_IPV6_IDX, L3_PROTO_LAST_IDX }; #define USHORTMAP_ENTRY_IDX(IDX, ATT, VAL) [IDX] = { .attr = ATT, .val = VAL } static const struct ushort_map l3_protocols[] = { - USHORTMAP_ENTRY_IDX(L3_PROTO_IPV4_IDX, ETHERTYPE_IP , "ipv4"), - USHORTMAP_ENTRY_IDX(L3_PROTO_IPV6_IDX, ETHERTYPE_IPV6 , "ipv6"), - USHORTMAP_ENTRY_IDX(L3_PROTO_ARP_IDX , ETHERTYPE_ARP , "arp"), - USHORTMAP_ENTRY_IDX(L3_PROTO_RARP_IDX, ETHERTYPE_REVARP, "rarp"), + USHORTMAP_ENTRY_IDX(L3_PROTO_MAC_IDX, 0 , "mac"), + USHORTMAP_ENTRY_IDX(L3_PROTO_IPV4_IDX, ETHERTYPE_IP , "ipv4"), + USHORTMAP_ENTRY_IDX(L3_PROTO_IPV6_IDX, ETHERTYPE_IPV6 , "ipv6"), + USHORTMAP_ENTRY_IDX(L3_PROTO_ARPMAC_IDX,ETHERTYPE_ARP , "arpmac"), + USHORTMAP_ENTRY_IDX(L3_PROTO_ARPIP_IDX, ETHERTYPE_ARP , "arpip"), + USHORTMAP_ENTRY_IDX(L3_PROTO_RARP_IDX, ETHERTYPE_REVARP, "rarp"), USHORTMAP_ENTRY_IDX(L3_PROTO_LAST_IDX, 0 , NULL), }; @@ -1946,7 +1950,7 @@ ebtablesCreateRuleInstance(char chainPrefix, virBufferVSprintf(&buf, " -p 0x%x", (rule->prtclType == VIR_NWFILTER_RULE_PROTOCOL_ARP) - ? l3_protocols[L3_PROTO_ARP_IDX].attr + ? l3_protocols[L3_PROTO_ARPMAC_IDX].attr : l3_protocols[L3_PROTO_RARP_IDX].attr); if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataHWType)) { @@ -2767,15 +2771,22 @@ ebtablesCreateTmpSubChain(virBufferPtr buf, char rootchain[MAX_CHAINNAME_LENGTH], chain[MAX_CHAINNAME_LENGTH]; char chainPrefix = (incoming) ? CHAINPREFIX_HOST_IN_TEMP : CHAINPREFIX_HOST_OUT_TEMP; + char protostr[16]; PRINT_ROOT_CHAIN(rootchain, chainPrefix, ifname); PRINT_CHAIN(chain, chainPrefix, ifname, l3_protocols[protoidx].val); + if (l3_protocols[protoidx].attr) + snprintf(protostr, sizeof(protostr), "-p 0x%04x ", + l3_protocols[protoidx].attr); + else + protostr[0] = '\0'; + virBufferVSprintf(buf, CMD_DEF("%s -t %s -N %s") CMD_SEPARATOR CMD_EXEC "%s" - CMD_DEF("%s -t %s -A %s -p 0x%x -j %s") CMD_SEPARATOR + CMD_DEF("%s -t %s -A %s %s -j %s") CMD_SEPARATOR CMD_EXEC "%s", @@ -2784,7 +2795,7 @@ ebtablesCreateTmpSubChain(virBufferPtr buf, CMD_STOPONERR(stopOnError), ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, - rootchain, l3_protocols[protoidx].attr, chain, + rootchain, protostr, chain, CMD_STOPONERR(stopOnError)); @@ -3357,6 +3368,11 @@ ebiptablesApplyNewRules(virConnectPtr conn ATTRIBUTE_UNUSED, if (chains_out != 0) ebtablesCreateTmpRootChain(&buf, 0, ifname, 1); + if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_MAC)) + ebtablesCreateTmpSubChain(&buf, 1, ifname, L3_PROTO_MAC_IDX, 1); + if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_MAC)) + ebtablesCreateTmpSubChain(&buf, 0, ifname, L3_PROTO_MAC_IDX, 1); + if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv4)) ebtablesCreateTmpSubChain(&buf, 1, ifname, L3_PROTO_IPV4_IDX, 1); if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv4)) @@ -3368,10 +3384,14 @@ ebiptablesApplyNewRules(virConnectPtr conn ATTRIBUTE_UNUSED, ebtablesCreateTmpSubChain(&buf, 0, ifname, L3_PROTO_IPV6_IDX, 1); /* keep arp,rarp as last */ - if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_ARP)) - ebtablesCreateTmpSubChain(&buf, 1, ifname, L3_PROTO_ARP_IDX, 1); - if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_ARP)) - ebtablesCreateTmpSubChain(&buf, 0, ifname, L3_PROTO_ARP_IDX, 1); + if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_ARPMAC)) + ebtablesCreateTmpSubChain(&buf, 1, ifname, L3_PROTO_ARPMAC_IDX, 1); + if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_ARPIP)) + ebtablesCreateTmpSubChain(&buf, 1, ifname, L3_PROTO_ARPIP_IDX, 1); + if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_ARPMAC)) + ebtablesCreateTmpSubChain(&buf, 0, ifname, L3_PROTO_ARPMAC_IDX, 1); + if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_ARPIP)) + ebtablesCreateTmpSubChain(&buf, 0, ifname, L3_PROTO_ARPIP_IDX, 1); if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_RARP)) ebtablesCreateTmpSubChain(&buf, 1, ifname, L3_PROTO_RARP_IDX, 1); if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_RARP))

2 1

[libvirt] [PATCH 0/9] add DHCP snooping support to nwfilter
by David L Stevens 11 May '11

11 May '11

The following series of patches replaces IP address learning in network filtering with DHCP snooping. The existing address learning capability does not provide security since it relies on addresses used in initial packets sent by the guest to determine an IP address. A spoofing guest can simply arrange to send packets using the target address early on. With DHCP snooping, only addresses acknowledged by a DHCP server can be used by the guest, and only for the given lease time if the address lease is not renewed. The patches also add support for multiple IP addresses per interface. The split: p1 -add return & continue support Add support for "return" and "continue" in filters. p2 -fix ARP input checks Fix a bug that breaks correct use of ARP by overfiltering. p3 -add MAC check; split ARP intp ARPMAC and ARPIP Support for multiple IP addresses in ARP checks, and allow for multiple MAC addresses in the future. p4 -set default protocol policy to "DROP"; edit filters Change default protocol policy to "DROP", rather than adding explicit "DROP" rules at the end of all of them. This is for multiple address support. p5 -optional "modify" (don't use temp, generate placeholder rules) Add support to dynamically add and remove filters without re-installing an entire chain. p6 -addRules Add support for adding new rules to a chain incrementally. Remove support was already there. p7 -ChangeVar support Add support to change chains that have a matching variable substitution to either add or delete rules with the given variable value (e.g., "IP") p8 -add DHCP snooping The DHCP snooping code itself. p9 -delete learnipaddr Clean up remaining learnipaddr infrastructure.

4 3

[libvirt] [PATCH 1/2] build: remove some dead assignments
by Eric Blake 11 May '11

11 May '11

No syntactic effect; this merely silences some clang warnings. * src/libxl/libxl_driver.c (libxlDomainSetVcpusFlags): Drop redundant ret=0 statement. * src/qemu/qemu_monitor_text.c (qemuMonitorTextDriveDel): Likewise. --- More clang fallout, found by switching over to rawhide. src/libxl/libxl_driver.c | 1 - src/qemu/qemu_monitor_text.c | 1 - 2 files changed, 0 insertions(+), 2 deletions(-) diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index dec4f43..5355b57 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -1659,7 +1659,6 @@ libxlDomainSetVcpusFlags(virDomainPtr dom, unsigned int nvcpus, def->maxvcpus = nvcpus; if (nvcpus < def->vcpus) def->vcpus = nvcpus; - ret = 0; break; case VIR_DOMAIN_VCPU_CONFIG: diff --git a/src/qemu/qemu_monitor_text.c b/src/qemu/qemu_monitor_text.c index 53781c8..7ace95f 100644 --- a/src/qemu/qemu_monitor_text.c +++ b/src/qemu/qemu_monitor_text.c @@ -2396,7 +2396,6 @@ int qemuMonitorTextDriveDel(qemuMonitorPtr mon, } else if (STRPREFIX(reply, "Device '") && (strstr(reply, "not found"))) { /* NB: device not found errors mean the drive was auto-deleted and we * ignore the error */ - ret = 0; } else if (STRNEQ(reply, "")) { qemuReportError(VIR_ERR_OPERATION_FAILED, _("deleting %s drive failed: %s"), drivestr, reply); -- 1.7.4.4

2 5

[libvirt] [PATCH] maint: avoid double-close bug in gnulib
by Eric Blake 11 May '11

11 May '11

Regression introduced in commit 9d8e01a1d. * .gnulib: Update to latest, for fclose fix. --- Solves the issue raised here: https://www.redhat.com/archives/libvir-list/2011-May/msg00580.html * .gnulib a6676cc...112b21e (19): > fclose: avoid double close race when possible > openat: correct new comment > openat: add comments > openat: reduce syscalls in first probe of /proc > autoupdate > maint.mk: change semantics/name of tight_scope variables > maint.mk: fix oops > maint.mk: tweak new rule's name not to impinge > maint.mk: add a syntax-check rule to ensure tightly-scoped symbols > gc: Remove gl_PREREQ_GC (not used). > Comments. > glob: Remove obsolete macro. > intprops: Sun C 5.11 supports __typeof__ > intprops: switch to usual gnulib indenting and naming > maint.mk: suppress "Entering/Leaving directory" diag in announcement > tzset: Fix gettimeofday wrapper on Solaris 2.6. > ignore-value, verify: Omit include files from lib_SOURCES. > fclose: Simplify autoconf macro. > canonicalize-lgpl: Fix autoconf macro ordering bug. .gnulib | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/.gnulib b/.gnulib index a6676cc..112b21e 160000 --- a/.gnulib +++ b/.gnulib @@ -1 +1 @@ -Subproject commit a6676cca6498ce67c5a3c8d7221b8d6c30b61dc4 +Subproject commit 112b21e3861a4887731b61888d1388127957ba93 -- 1.7.4.4

1 1

[libvirt] [PATCH] tests: avoid crash when run under gcov
by Eric Blake 11 May '11

11 May '11

Running ./autobuild.sh failed when gcov is installed, because commandtest ended up crashing during gcov's getenv() call after exit() had already started. I traced this nasty bug back to a scoping issue present since the test introduction. * tests/commandtest.c (mymain): Move newenv... (newenv): ...to a scope that is still useful during exit(). --- Pushing under the build-breaker rule. tests/commandtest.c | 25 ++++++++++++++----------- 1 files changed, 14 insertions(+), 11 deletions(-) diff --git a/tests/commandtest.c b/tests/commandtest.c index caad698..429a026 100644 --- a/tests/commandtest.c +++ b/tests/commandtest.c @@ -748,6 +748,18 @@ cleanup: return ret; } +static const char *const newenv[] = { + "PATH=/usr/bin:/bin", + "HOSTNAME=test", + "LANG=C", + "HOME=/home/test", + "USER=test", + "LOGNAME=test" + "TMPDIR=/tmp", + "DISPLAY=:0.0", + NULL +}; + static int mymain(void) { @@ -771,18 +783,9 @@ mymain(void) virInitialize(); - const char *const newenv[] = { - "PATH=/usr/bin:/bin", - "HOSTNAME=test", - "LANG=C", - "HOME=/home/test", - "USER=test", - "LOGNAME=test" - "TMPDIR=/tmp", - "DISPLAY=:0.0", - NULL - }; environ = (char **)newenv; # define DO_TEST(NAME) \ if (virtTestRun("Command Exec " #NAME " test", \ -- 1.7.4.4

2 2

[libvirt] CfP 6th Workshop on Virtualization in High-Performance Cloud Computing (VHPC'11) - Deadline Extension
by VHPC 11 11 May '11

11 May '11

Due to several requests, the deadline has been extended to the 20th of June. -- ================================================================= CALL FOR PAPERS 6th Workshop on Virtualization in High-Performance Cloud Computing VHPC'11 as part of Euro-Par 2011, Bordeaux, France ================================================================= Date: August 30, 2011 Euro-Par 2011: http://europar2011.bordeaux.inria.fr/ Workshop URL: http://vhpc.org SUBMISSION DEADLINE: Full Paper: June 20, 2011 (extended) Scope: Virtualization has become a common abstraction layer in modern data centers, enabling resource owners to manage complex infrastructure independently of their applications. Conjointly virtualization is becoming a driving technology for a manifold of industry grade IT services. The cloud concept includes the notion of a separation between resource owners and users, adding services such as hosted application frameworks and queuing. Utilizing the same infrastructure, clouds carry significant potential for use in high-performance scientific computing. The ability of clouds to provide for requests and releases of vast computing resource dynamically and close to the marginal cost of providing the services is unprecedented in the history of scientific and commercial computing. Distributed computing concepts that leverage federated resource access are popular within the grid community, but have not seen previously desired deployed levels so far. Also, many of the scientific datacenters have not adopted virtualization or cloud concepts yet. This workshop aims to bring together industrial providers with the scientific community in order to foster discussion, collaboration and mutual exchange of knowledge and experience. The workshop will be one day in length, composed of 20 min paper presentations, each followed by 10 min discussion sections. Presentations may be accompanied by interactive demonstrations. It concludes with a 30 min panel discussion by presenters. TOPICS Topics include, but are not limited to, the following subjects: - Virtualization in cloud, cluster and grid environments - VM-based cloud performance modeling - Workload characterizations for VM-based environments - Software as a Service (SaaS) - Cloud reliability, fault-tolerance, and security - Cloud, cluster and grid filesystems - QoS and and service levels - Cross-layer VM optimizations - Virtualized I/O and storage - Virtualization and HPC architectures including NUMA - System and process/bytecode VM convergence - Paravirtualized driver development - Research and education use cases - VM cloud, cluster distribution algorithms - MPI on virtual machines and clouds - Cloud frameworks and API sets - Checkpointing of large compute jobs - Cloud load balancing - Accelerator virtualization - Instrumentation interfaces and languages - Hardware support for virtualization - High-performance network virtualization - Auto-tuning of VMM and VM parameters - High-speed interconnects - Hypervisor extensions and tools for cluster and grid computing - VMMs/Hypervisors - Cloud use cases including optimizations - Performance modeling - Fault tolerant VM environments - VMM performance tuning on various load types - Cloud provisioning - Virtual machine monitor platforms - Pass-through VM device access - Management, deployment of VM-based environments PAPER SUBMISSION Papers submitted to the workshop will be reviewed by at least two members of the program committee and external reviewers. Submissions should include abstract, key words, the e-mail address of the corresponding author, and must not exceed 10 pages, including tables and figures at a main font size no smaller than 11 point. Submission of a paper should be regarded as a commitment that, should the paper be accepted, at least one of the authors will register and attend the conference to present the work. Accepted papers will be published in the Springer LNCS series - the format must be according to the Springer LNCS Style. Initial submissions are in PDF, accepted papers will be requested to provided source files. Format Guidelines: http://www.springer.de/comp/lncs/authors.html Submission Link: http://edas.info/newPaper.php?c=10155 IMPORTANT DATES June 20 2011 - Full paper submission (extended) July 15 2011 - Acceptance notification August 3 2011 - Camera-ready version due August 30 2011 - September 2 - conference CHAIR Michael Alexander (chair), IBM, Austria Gianluigi Zanetti (co-chair), CRS4, Italy PROGRAM COMMITTEE Paolo Anedda, CRS4, Italy Volker Buege, University of Karlsruhe, Germany Giovanni Busonera, CRS4, Italy Roberto Canonico, University of Napoli, Italy Tommaso Cucinotta, Scuola Superiore Sant'Anna, Italy William Gardner, University of Guelph, Canada Werner Fischer, Thomas-Krenn AG, Germany Wolfgang Gentzsch, Max Planck Gesellschaft, Germany Marcus Hardt, Forschungszentrum Karlsruhe, Germany Sverre Jarp, CERN, Switzerland Shantenu Sjha, Louisiana State University, USA Xuxian Jiang, NC State, USA Kenji Kaneda, Google, USA Simone Leo, CRS4, Italy Ignancio Llorente, Universidad Complutense de Madrid, Spain, Naoya Maruyama, Tokyo Institute of Technology, Japan Jean-Marc Menaud, Ecole des Mines de Nantes, France Anastassios Nanos, National Technical University of Athens, Greece Jose Renato Santos, HP Labs, USA Deepak Singh, Amazon Webservices, USA Boria Sotomayor, University of Chicago, USA Yoshio Turner, HP Labs, USA Kurt Tutschku, University of Vienna, Austria Lizhe Wang, Indiana University, USA Chao-Tung Yang, Tunghai University, China DURATION: Workshop Duration is one day. GENERAL INFORMATION The workshop will be held as part of Euro-Par 2011, organized by INRIA, CNRS and the University of Bordeaux I, II, France. Euro-Par 2011: http://europar2011.bordeaux.inria.fr/

1 0

[libvirt] [PATCH 0/2] More graceful handing of monitor failures
by Daniel P. Berrange 11 May '11

11 May '11

Currently when libvirt has a serious error doing I/O and/or parsing of the QEMU monitor, it will kill off the guest. Application developers have expressed a desire for more graceful handling of this scenario. In particular to allow the guest OS to continue to run, without any further monitor interactons, and then kill/restart it at a time which is convenient to the guest admin/apps. This is a proof of concept of that.

3 5

[libvirt] [PATCH] build: fix VPATH build with distributed generated files
by Eric Blake 11 May '11

11 May '11

* daemon/Makefile.am (DAEMON_GENERATED, remote_dispatch_*.h) (qemu_dispatch_*.h): Update to live in srcdir, since they are distributed. Detected by Daniel P. Berrange's autobuilder. --- Pushing under the build-breaker rule. daemon/Makefile.am | 102 +++++++++++++++++++++++++++++++--------------------- 1 files changed, 61 insertions(+), 41 deletions(-) diff --git a/daemon/Makefile.am b/daemon/Makefile.am index 114adf3..f734c89 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -3,16 +3,16 @@ CLEANFILES = DAEMON_GENERATED = \ - remote_dispatch_prototypes.h \ - remote_dispatch_table.h \ - remote_dispatch_args.h \ - remote_dispatch_ret.h \ - remote_dispatch_bodies.h \ - qemu_dispatch_prototypes.h \ - qemu_dispatch_table.h \ - qemu_dispatch_args.h \ - qemu_dispatch_ret.h \ - qemu_dispatch_bodies.h + $(srcdir)/remote_dispatch_prototypes.h \ + $(srcdir)/remote_dispatch_table.h \ + $(srcdir)/remote_dispatch_args.h \ + $(srcdir)/remote_dispatch_ret.h \ + $(srcdir)/remote_dispatch_bodies.h \ + $(srcdir)/qemu_dispatch_prototypes.h \ + $(srcdir)/qemu_dispatch_table.h \ + $(srcdir)/qemu_dispatch_args.h \ + $(srcdir)/qemu_dispatch_ret.h \ + $(srcdir)/qemu_dispatch_bodies.h DAEMON_SOURCES = \ libvirtd.c libvirtd.h \ @@ -186,7 +186,7 @@ CLEANFILES += probes.h probes.o endif install-data-local: install-init install-data-sasl install-data-polkit \ - install-logrotate + install-logrotate mkdir -p $(DESTDIR)$(localstatedir)/log/libvirt mkdir -p $(DESTDIR)$(localstatedir)/run/libvirt mkdir -p $(DESTDIR)$(localstatedir)/lib/libvirt @@ -213,38 +213,58 @@ remote.h: $(DAEMON_GENERATED) REMOTE_PROTOCOL = $(top_srcdir)/src/remote/remote_protocol.x QEMU_PROTOCOL = $(top_srcdir)/src/remote/qemu_protocol.x -remote_dispatch_prototypes.h: $(srcdir)/remote_generator.pl $(REMOTE_PROTOCOL) - $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -c -p remote $(REMOTE_PROTOCOL) > $@ - -remote_dispatch_table.h: $(srcdir)/remote_generator.pl $(REMOTE_PROTOCOL) - $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -c -t remote $(REMOTE_PROTOCOL) > $@ - -remote_dispatch_args.h: $(srcdir)/remote_generator.pl $(REMOTE_PROTOCOL) - $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -c -a remote $(REMOTE_PROTOCOL) > $@ - -remote_dispatch_ret.h: $(srcdir)/remote_generator.pl $(REMOTE_PROTOCOL) - $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -c -r remote $(REMOTE_PROTOCOL) > $@ - -remote_dispatch_bodies.h: $(srcdir)/remote_generator.pl $(REMOTE_PROTOCOL) - $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -c -b remote $(REMOTE_PROTOCOL) > $@ - -qemu_dispatch_prototypes.h: $(srcdir)/remote_generator.pl $(QEMU_PROTOCOL) - $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -p qemu $(QEMU_PROTOCOL) > $@ - -qemu_dispatch_table.h: $(srcdir)/remote_generator.pl $(QEMU_PROTOCOL) - $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -t qemu $(QEMU_PROTOCOL) > $@ - -qemu_dispatch_args.h: $(srcdir)/remote_generator.pl $(QEMU_PROTOCOL) - $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -a qemu $(QEMU_PROTOCOL) > $@ - -qemu_dispatch_ret.h: $(srcdir)/remote_generator.pl $(QEMU_PROTOCOL) - $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -r qemu $(QEMU_PROTOCOL) > $@ - -qemu_dispatch_bodies.h: $(srcdir)/remote_generator.pl $(QEMU_PROTOCOL) - $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -b qemu $(QEMU_PROTOCOL) > $@ +$(srcdir)/remote_dispatch_prototypes.h: $(srcdir)/remote_generator.pl \ + $(REMOTE_PROTOCOL) + $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -c -p remote \ + $(REMOTE_PROTOCOL) > $@ + +$(srcdir)/remote_dispatch_table.h: $(srcdir)/remote_generator.pl \ + $(REMOTE_PROTOCOL) + $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -c -t remote \ + $(REMOTE_PROTOCOL) > $@ + +$(srcdir)/remote_dispatch_args.h: $(srcdir)/remote_generator.pl \ + $(REMOTE_PROTOCOL) + $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -c -a remote \ + $(REMOTE_PROTOCOL) > $@ + +$(srcdir)/remote_dispatch_ret.h: $(srcdir)/remote_generator.pl \ + $(REMOTE_PROTOCOL) + $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -c -r remote \ + $(REMOTE_PROTOCOL) > $@ + +$(srcdir)/remote_dispatch_bodies.h: $(srcdir)/remote_generator.pl \ + $(REMOTE_PROTOCOL) + $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -c -b remote \ + $(REMOTE_PROTOCOL) > $@ + +$(srcdir)/qemu_dispatch_prototypes.h: $(srcdir)/remote_generator.pl \ + $(QEMU_PROTOCOL) + $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -p qemu \ + $(QEMU_PROTOCOL) > $@ + +$(srcdir)/qemu_dispatch_table.h: $(srcdir)/remote_generator.pl \ + $(QEMU_PROTOCOL) + $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -t qemu \ + $(QEMU_PROTOCOL) > $@ + +$(srcdir)/qemu_dispatch_args.h: $(srcdir)/remote_generator.pl \ + $(QEMU_PROTOCOL) + $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -a qemu \ + $(QEMU_PROTOCOL) > $@ + +$(srcdir)/qemu_dispatch_ret.h: $(srcdir)/remote_generator.pl \ + $(QEMU_PROTOCOL) + $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -r qemu \ + $(QEMU_PROTOCOL) > $@ + +$(srcdir)/qemu_dispatch_bodies.h: $(srcdir)/remote_generator.pl \ + $(QEMU_PROTOCOL) + $(AM_V_GEN)perl -w $(srcdir)/remote_generator.pl -b qemu \ + $(QEMU_PROTOCOL) > $@ LOGROTATE_CONFS = libvirtd.qemu.logrotate libvirtd.lxc.logrotate \ - libvirtd.uml.logrotate libvirtd.logrotate + libvirtd.uml.logrotate libvirtd.logrotate BUILT_SOURCES += $(LOGROTATE_CONFS) -- 1.7.4.4

1 0

[libvirt] [PATCH] docs: avoid double 'the'
by Eric Blake 11 May '11

11 May '11

* docs/testsuites.html.in: Keep 'make syntax-check' happy. --- Pushing under the build-breaker rule. docs/testsuites.html.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/docs/testsuites.html.in b/docs/testsuites.html.in index 86fd5ef..4441d94 100644 --- a/docs/testsuites.html.in +++ b/docs/testsuites.html.in @@ -29,7 +29,7 @@ <a href="python.html">Python bindings</a> of libvirt. It is available separately as a <a href="ftp://libvirt.org/libvirt/libvirt-test-API/">download</a>, - or directly get the + or directly get the <a href="http://libvirt.org/git/?p=libvirt-test-API.git">version from GIT</a>. </ul> -- 1.7.4.4

1 0

[libvirt] Crash state and QEMU
by Anthony Liguori 11 May '11

11 May '11

Hi, As far as I can tell, if QEMU exits abruptly or with a non-zero status code, libvirt treats this as a domain destruction given no real indication to the user that something bad happened. But libvirt does have a crashed state for domains, it's just not used for QEMU guests. I was wondering how intention of a design decision this was. Right now there's no good way for a management tool to detect a crashed guest/QEMU. Is there something I'm overlooking? Regards, Anthony Liguori

4 4