libxl_spawner_record_pid() should be able to write the pid to arbitrary paths.
v2:
- use const char* for ->pid_path, and update comment
Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Ian Jackson <ian.jackson.citrix.com>
Committed-by: Ian Jackson <ian.jackson.citrix.com>
Some distros enable -D_FORTIFY_SOURCE=2 by default
(https://wiki.ubuntu.com/CompilerFlags) which adds the warn_unused_result
attribute to several functions including read(2) and write(2)
Although we don't really care about error reading or writing the libxl spawn fd
catch them anyway to keep this warning happy.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Tested-by: Olaf Hering <olaf@aepfle.de>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
It prevents callers from deliberately passing file descriptors to the child,
hides any callers who erroneously do so and doesn't deal with all file
descriptors in any case.
Rather than remove it all together replace it with some debug code
which checks for open file handles which do not have either O_CLOEXEC
or FD_CLOEXEC set. To enable the debug set _LIBXL_DEBUG_EXEC_FDS=1 to
print any open and non-CLOEXEC non-stdio FDs just before libxl__exec
actualy calls exec. Set _LIBXL_DEBUG_EXEC_FDS=2 to abort if any of
these exist.
On the basis of this debugging fix some leaked filehandles:
* The read end of the pipe used to wake the parent from the
intermediate process during libxl__spawn_spawn was leaked into the
intermediate process.
* The file descriptor representing the xl lock was not marked
O_CLOEXEC (the lock itself is already specified to not be
inherited across a fork).
* The file descriptors passed to libxl__exec to be dup'd as
std{in,out,err} were leaked at their original number. They are
harmless (an attacker can just as easily use fd 0..2) but close
anyway since it removes a case which a person evaluating open fd's
needs to consider.
* libxl_run_bootloader was leaking the xenconsole pty master into
the bootloader child process.
* If the bootloader fails to get as far as opening its end of the
FIFO then we can also hang, check that the process has not exited
as part of that loop. (we actually block opening the FIFO too so
this is only a partial fix for the case where the bootlader has
crashed quickly).
With these fixes I have tested that device models, bootloaders
(pygrub) and vncviewers which are spawned via libxl__exec with no
unexpected file descriptors open, at least in my configuration.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
When the device model is starting up push checks for spawn failure down into
libxl__wait_for_device_model, allowing us to fail more quickly when the device
model fails to start (e.g. due to a missing library or an early setup error
etc).
In order to allow the select loop in libxl__wait_for_device_model to wake when
the child dies add pipe between the parent and the intermediate process which
the intermediate process can use to signal the parent.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Passing a libxl__device_model_starting to a generic function and expecting it
to scrobble inside for the generic data structure is a strange interface.
Instead pass in a libxl__spawn_starting and an opaque hook data pointer.
The for_spawn member of libxl__device_model_starting was annotated with
"first!", suggesting that someone intended to use pointer casting tricks to
move between the outer and inner struct. However the field is a pointer not a
inline struct so this doesn't work (and it isn't used this way anyhow). Remove
the comment, and move the field away from the front for good measure.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Also ensure that static and hidden functions use the libxl__ prefix
not just libxl_ (in the case of static functions only when they use a
libxl prefix to start with).
This follows the policy described in libxl.h "libxl memory
management".
Based on a manual audit of:
grep ^static tools/libxl/libxl*.[ch]| grep libxl_ctx
grep libxl__ tools/libxl/*.h| grep libxl_ctx
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
These functions are introduced as the new way to create domains with libxl
they prevent the callers from need to know about low-level implementation
details such as:
- libxl_domain_make()
- libxl_domain_build()
- libxl_domain_restore()
- when to attach the console
- how to start the device model
Above mentioned functions and all API's for the device model, which are now
redundant, have been made internal to libxl and no longer accessible.
The ocaml binding for libxl has not been properly updated to reflect the
changes, wrappers for the old functions have been removed but the code to wrap
the new functions has not been added.
Signed-off-by: Gianni Tedesco <gianni.tedesco@citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
At least one of my compilers complains about the broken const
qualifier in the fork_exec_bootloader() call (despite the cast).
Fix this properly by propagating the const attribute down the
call stack.
Signed-off-by: Andre Przywara <andre.przywara@amd.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
It's not clear that the namespace rules described in libxl.h are
intended to apply to internal types but I don't see why not.
sed -i -e 's/\<libxl_device\>/libxl__device/g' tools/libxl/*.[ch]
sed -i -e 's/\<libxl_device_kinds\>/libxl__device_kinds/g' tools/libxl/*.[ch]
sed -i -e 's/\<libxl_gc\>/libxl__gc/g' tools/libxl/*.[ch]
sed -i -e 's/\<libxl_gc_owner\>/libxl__gc_owner/g' tools/libxl/*.[ch]
sed -i -e 's/\<libxl_spawn_starting\>/libxl__spawn_starting/g' tools/libxl/*.[ch]
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
This patch covers the remaining functions identified by:
rgrep _hidden tools/libxl/*.h | grep -v libxl__
sed -i -e 's/XL_LOG/LIBXL__LOG/g' tools/libxl/*.[ch]
sed -i -e 's/xl_log/libxl__log/g' tools/libxl/*.[ch]
sed -i -e 's/\(build_\(pre\|post\|pv\|hvm\)\)/libxl__\1/g' tools/libxl/*.[ch]
sed -i -e 's/is_hvm/libxl__domain_is_hvm/g' tools/libxl/*.[ch]
sed -i -e 's/get_shutdown_reason/libxl__domain_shutdown_reason/g' tools/libxl/*.[ch]
sed -i -e 's/restore_common/libxl__domain_restore_common/g' tools/libxl/*.[ch]
sed -i -e 's/core_suspend/libxl__domain_suspend_common/g' tools/libxl/*.[ch]
sed -i -e 's/save_device_model/libxl__domain_save_device_model/g' tools/libxl/*.[ch]
sed -i -e 's/device_disk_backend_type_of_phystype/libxl__device_disk_backend_type_of_phystype/g' tools/libxl/*.[ch]
sed -i -e 's/\<libxl_blktap_enabled\>/libxl__blktap_enabled/g' tools/libxl/*.[ch]
sed -i -e 's/\<libxl_blktap_devpath\>/libxl__blktap_devpath/g' tools/libxl/*.[ch]
Add _hidden to libxl__blktap_enabled and libxl__blktap_devpath
Inline dominfo_libxl__domain_shutdown_reason(info) into
libxl__domain_shutdown_reason, its only caller.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
This patch covers all those which could be trivially converted automatically.
sed -n -e 's/_hidden.*[ \*]libxl_\([^_][^()]*\)(.*/\1/pg' tools/libxl/*.h | \
while read i ; do \
sed -i -e "s/libxl_$i/libxl__$i/g" tools/libxl/*.[ch]; \
done
sed -n -e 's/_hidden.*_libxl_\([^_][^()]*\)(.*/\1/pg' tools/libxl/*.h | \
while read i ; do \
sed -i -e "s/_libxl_$i/libxl__$i/g" tools/libxl/*.[ch]; \
done
Check that diffstat includes libxl but not xl.
Fixup tools/libxl/xl_cmdimpl.c which used libxl_device_del instead of
libxl_device_disk_del in a printf.
(Patch runes re-run by Ian Jackson to refresh against tip libxl.)
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Currently scratch variables allocated by libxl have the same lifetime as
the context. While this is suitable for one off invocations of xl. It is
not so great for a daemon process linking to libxl. In that case there
will be prolific leakage of heap memory.
My proposed solution involves create a new libxl_gc structure, which
contains a pointer to an owning context as well as the garbage
collection data. Top-level library functions which expect to do a lot of
scratch allocations put gc struct on the stack and initialize it with a
macro. Before returning they then call libxl_free_all on this struct.
This means that static helper functions called by such functions will
usually take a gc instead of a ctx as a first parameter.
The patch touches almost every code-path so a close review and testing
would be much appreciated. I have tested with valgrind all of the parts
I could which looked non-straightforward. Suffice to say that it seems
crash-free even if we have exposed a few real memory leaks. These are
for cases where we return eg. block list to an xl caller but there is no
appropriate block_list_free() function to call. Ian Campbells work in
this area should sew up all these loose ends.
Signed-off-by: Gianni Tedesco <gianni.tedesco@citrix.com>
committer: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
We now require callers to provide a xentoollog_logger* for
libxl_ctx_init, and use that for all our own logging and also for
xc_interface_open.
Corresponding change to xl.c.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
xl would like to use libxl_report_exitstatus, so expose it in
libxl_utils.h to avoid having to write it twice. Also, give it a
"level" argument to set the loglevel of the resulting message.
Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
* Expose libxl_fork in libxl_utils.h
* Expose libxl_pipe in libxl_utils.h
* Make libxl_exec put SIGPIPE back (so that libxl callers may
have SIGPIPE ignored)
xl would like to use libxl_fork (which is like fork(2) except that it
logs errors) and also a similar function libxl_pipe. So put these in
libxl_utils.[ch] and use them in libxl.c as appropriate, to avoid
having to duplicate code between xl and libxl.
Also, make sure that subprocesses spawned by libxl have SIGPIPE set
back to SIG_DFL as they are entitled to expect. This means that a
libxl caller which sets SIGPIPE to SIG_IGN is no longer buggy. (This
is relevant for xl migration, because xl would like to be such a
caller.)
Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
simplify some lines, and keep the xl style consistant with itself.
use libxl_sprintf instead of snprintf/sprintf
Signed-off-by: Vincent Hanquez <vincent.hanquez@eu.citrix.com>
this patch makes libxl_create_stubdom wait for pv qemu to be properly
initialized before unpausing the stubdom.
A new libxl_device_model_starting pointer is used to wait for pv qemu
initialization while the libxl_device_model_starting pointer given by
the user is initialized to a new structure with an empty for_spawn
member, because nothing that was spawn has to be waited for anymore.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
This patch makes xl create check whether qemu-dm has started
correctly, and causes it to fail immediately with appropriate errors
if not. There are other bugfixes too.
More specifically:
* libxl_create_device_model forks twice rather than once so that the
process which calls libxl does not end up being the actual parent
of qemu. That avoids the need for the qemu-dm process to be reaped
at some indefinite time in the future.
* The first fork generates an intermediate process which is
responsible for writing the qemu-dm pid to xenstore and then merely
waits to collect and report on qemu-dm's exit status during
startup. New arguments to libxl_create_device_model allow the
preservation of its pid so that a later call can check whether the
startup is successful.
* The core of this functionality (the double fork, waitpid, signal
handling and so forth) is abstracted away into a new facility
libxl_spawn_... in libxl_exec.c.
Consequential changes:
* libxl_wait_for_device_model now takes a callback function parameter
which is called repeatedly in the loop iteration and allows the
caller to abort the wait.
* libxl_exec no longer calls fork; there is a new libxl_fork.
* There is a hook to override waitpid, which will be necessary for
some callers.
Remaining problems and other issues I noticed or we found:
* The error handling is rather inconsistent still and lacking in
places.
* destroy_device_model can kill random dom0 processes (!)
Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
osdeps.[hc] previously mistakenly declared and defined [v]asprintf.
These functions are available in the libc on most platforms. Also,
osdeps.h is used by xc.c but xc.c is not part of the library, so
osdeps.h is part of the public interface and should have a better
name.
So now, instead:
* osdeps.h is libxl_osdeps.h.
* _GNU_SOURCE is #defined in libxl_osdeps.h so that we get the system
[v]asprintf (and various other functions)
* libxl_osdeps.h is included first in every libxl*.c file (it needs
to be before any system headers so that _GNU_SOURCE) takes effect.
* osdeps.[hc] only provide their own reimplementation of [v]asprintf
if NEED_OWN_ASPRINTF is defined. Currently it is not ever defined
but this is provided for any platform which needs it.
* While I was editing the #includes in each .c file, I put them all
into the same order: "libxl_osdeps.h", then system headers,
then local headers.
* xs.h is included in libxl.h. This is needed for "bool"; it has to
not be typedefed in libxl.h because otherwise we get a duplicate
definition when including xs.h.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* Introduce new variants of the logging functions which include
errno values (converted using strerror) in the messages passed to
the
application's logging callback.
* Use the new errno-including logging functions everywhere where
appropriate. In general, xc_... functions return errno values or 0;
xs_... functions return 0 or -1 (or some such) setting errno.
* When libxl_xs_get_dompath fails, do not treat it as an allocation
error. It isn't: it usually means xenstored failed.
* Remove many spurious \n's from log messages. (The applications log
callback is expected to add a \n if it wants to do that, so libxl's
logging functions should be passed strings without \n.)
Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Olaf Hering
Ian Campbell
Christoph Egger
Ian Jackson
Gianni Tedesco
Andre Przywara
Stefano Stabellini
Keir Fraser