September 2013 - Devel - libvirt List Archives

[libvirt] [PATCH v2 0/3] Improve PPC CPU driver
by Li Zhang 09 Sep '13

09 Sep '13

From: Li Zhang <zhlcindy(a)linux.vnet.ibm.com> Currently, PPC CPU driver doesn't support to parse guest data. It can't pass CPU parameters to Qemu command line. This patchset is to implement .guestData to support to parse guest CPU configuration and .update to support host-model and host-passthrough. The guest CPU configuration is as the following: <cpu match='exact'> <model>POWER7_v2.3</model> <vendor>IBM</vendor> </cpu> v2 -> v1: * Remove features functions calling for non-x86 platform (Doug Goldstein) * Improve update code. * Merge update code with guestData. Li Zhang (3): Remove CPU features check for non-x86 platform. cpu: Implement guestData and update for PPC cpu: Add cpu test cases for PPC CPU driver. src/cpu/cpu_powerpc.c | 178 ++++++++++++++++++++- src/qemu/qemu_command.c | 16 +- tests/cputest.c | 9 ++ tests/cputestdata/ppc64-baseline-1-result.xml | 3 + .../ppc64-baseline-incompatible-vendors.xml | 14 ++ .../ppc64-baseline-no-vendor-result.xml | 3 + tests/cputestdata/ppc64-baseline-no-vendor.xml | 7 + tests/cputestdata/ppc64-exact.xml | 3 + tests/cputestdata/ppc64-guest-nofallback.xml | 4 + tests/cputestdata/ppc64-guest.xml | 4 + .../ppc64-host+guest,ppc_models-result.xml | 5 + ...st-nofallback,ppc_models,POWER7_v2.1-result.xml | 5 + tests/cputestdata/ppc64-host.xml | 6 + tests/cputestdata/ppc64-strict.xml | 3 + .../qemuxml2argv-pseries-cpu-exact.args | 7 + .../qemuxml2argv-pseries-cpu-exact.xml | 21 +++ tests/qemuxml2argvtest.c | 1 + 17 files changed, 279 insertions(+), 10 deletions(-) create mode 100644 tests/cputestdata/ppc64-baseline-1-result.xml create mode 100644 tests/cputestdata/ppc64-baseline-incompatible-vendors.xml create mode 100644 tests/cputestdata/ppc64-baseline-no-vendor-result.xml create mode 100644 tests/cputestdata/ppc64-baseline-no-vendor.xml create mode 100644 tests/cputestdata/ppc64-exact.xml create mode 100644 tests/cputestdata/ppc64-guest-nofallback.xml create mode 100644 tests/cputestdata/ppc64-guest.xml create mode 100644 tests/cputestdata/ppc64-host+guest,ppc_models-result.xml create mode 100644 tests/cputestdata/ppc64-host+guest-nofallback,ppc_models,POWER7_v2.1-result.xml create mode 100644 tests/cputestdata/ppc64-host.xml create mode 100644 tests/cputestdata/ppc64-strict.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-pseries-cpu-exact.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-pseries-cpu-exact.xml -- 1.8.1.4

5 13

[libvirt] [PATCH] Add support for enabling SASL for SPICE guests
by Daniel P. Berrange 08 Sep '13

08 Sep '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> QEMU has support for SASL auth for SPICE guests, but libvirt has no way to enable it. Following the example from VNC where it is globally enabled via qemu.conf Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/qemu/libvirtd_qemu.aug | 2 ++ src/qemu/qemu.conf | 16 ++++++++++++++++ src/qemu/qemu_command.c | 10 ++++++++++ src/qemu/qemu_conf.c | 3 +++ src/qemu/qemu_conf.h | 2 ++ src/qemu/test_libvirtd_qemu.aug.in | 2 ++ 6 files changed, 35 insertions(+) diff --git a/src/qemu/libvirtd_qemu.aug b/src/qemu/libvirtd_qemu.aug index cd13d53..118d4c7 100644 --- a/src/qemu/libvirtd_qemu.aug +++ b/src/qemu/libvirtd_qemu.aug @@ -38,6 +38,8 @@ module Libvirtd_qemu = | bool_entry "spice_tls" | str_entry "spice_tls_x509_cert_dir" | str_entry "spice_password" + | bool_entry "spice_sasl" + | str_entry "spice_sasl_dir" let nogfx_entry = bool_entry "nographics_allow_host_audio" diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index 5fd6263..6d4e99e 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -140,6 +140,22 @@ #spice_password = "XYZ12345" +# Enable use of SASL encryption on the SPICE server. This requires +# a SPICE client which supports the SASL protocol extension. +# +# It is necessary to configure /etc/sasl2/qemu.conf to choose +# the desired SASL plugin (eg, GSSPI for Kerberos) +# +#spice_sasl = 1 + +# The default SASL configuration file is located in /etc/sasl2/ +# When running libvirtd unprivileged, it may be desirable to +# override the configs in this location. Set this parameter to +# point to the directory, and create a qemu.conf in that location +# +#spice_sasl_dir = "/some/directory/sasl2" + + # By default, if no graphical front end is configured, libvirt will disable # QEMU audio output since directly talking to alsa/pulseaudio may not work # with various security settings. If you know what you're doing, enable diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 91ca86a..5e4ebc8 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -7065,6 +7065,16 @@ qemuBuildGraphicsSPICECommandLine(virQEMUDriverConfigPtr cfg, virBufferAsprintf(&opt, "tls-port=%u", tlsPort); } + if (cfg->spiceSASL) { + virBufferAddLit(&opt, ",sasl"); + + if (cfg->spiceSASLdir) + virCommandAddEnvPair(cmd, "SASL_CONF_DIR", + cfg->spiceSASLdir); + + /* TODO: Support ACLs later */ + } + switch (virDomainGraphicsListenGetType(graphics, 0)) { case VIR_DOMAIN_GRAPHICS_LISTEN_TYPE_ADDRESS: listenAddr = virDomainGraphicsListenGetAddress(graphics, 0); diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 1f57f72..41ca7a3 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -266,6 +266,7 @@ static void virQEMUDriverConfigDispose(void *obj) VIR_FREE(cfg->spiceTLSx509certdir); VIR_FREE(cfg->spiceListen); VIR_FREE(cfg->spicePassword); + VIR_FREE(cfg->spiceSASLdir); VIR_FREE(cfg->hugetlbfsMount); VIR_FREE(cfg->hugepagePath); @@ -379,6 +380,8 @@ int virQEMUDriverConfigLoadFile(virQEMUDriverConfigPtr cfg, GET_VALUE_BOOL("spice_tls", cfg->spiceTLS); GET_VALUE_STR("spice_tls_x509_cert_dir", cfg->spiceTLSx509certdir); + GET_VALUE_BOOL("spice_sasl", cfg->spiceSASL); + GET_VALUE_STR("spice_sasl_dir", cfg->spiceSASLdir); GET_VALUE_STR("spice_listen", cfg->spiceListen); GET_VALUE_STR("spice_password", cfg->spicePassword); diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index 206f2c6..cbd7053 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -111,6 +111,8 @@ struct _virQEMUDriverConfig { bool spiceTLS; char *spiceTLSx509certdir; + bool spiceSASL; + char *spiceSASLdir; char *spiceListen; char *spicePassword; diff --git a/src/qemu/test_libvirtd_qemu.aug.in b/src/qemu/test_libvirtd_qemu.aug.in index ea770dc..1a9fb20 100644 --- a/src/qemu/test_libvirtd_qemu.aug.in +++ b/src/qemu/test_libvirtd_qemu.aug.in @@ -15,6 +15,8 @@ module Test_libvirtd_qemu = { "spice_tls" = "1" } { "spice_tls_x509_cert_dir" = "/etc/pki/libvirt-spice" } { "spice_password" = "XYZ12345" } +{ "spice_sasl" = "1" } +{ "spice_sasl_dir" = "/some/directory/sasl2" } { "nographics_allow_host_audio" = "1" } { "remote_display_port_min" = "5900" } { "remote_display_port_max" = "65535" } -- 1.8.3.1

2 1

[libvirt] [PATCHv5 0/5] Introduce API to query IP addresses for given domain
by Nehal J Wani 08 Sep '13

08 Sep '13

This feature has been requested for a very long time. Since qemu guest agent gives us reliable results, now the wait is over. The RFC was first proposed by Michal Privoznik: http://www.redhat.com/archives/libvir-list/2012-February/msg00437.html A patch was submitted, using structs: https://www.redhat.com/archives/libvir-list/2012-June/msg00220.html Another patch was submitted, using XML: https://www.redhat.com/archives/libvir-list/2012-June/msg00904.html Neither of the patches were accepted, probably due to lack of extensibility and usability. Hence, we thought of using virTypedParameters for reporting list of interfaces along with their MAC address and IP addresses. The RFC can be found here: https://www.redhat.com/archives/libvir-list/2013-July/msg00084.html The idea of extensibility was rejected and rendered out of scope of libvirt. Hence, we were back to structs. This API is called virDomainInterfaceAddresses which returns a dynamically allocated array of virDomainInterface struct. The great disadvantage is once this gets released, it's written in stone and we cannot change or add an item into it. The API supports two methods: * Return information (list of all associated interfaces with MAC address and IP addresses) of all of the domain interfaces by default (if no interface name is provided) * Return information for the specified interface (if an interface name is provided) v5: * s/virDomainInterfacesAddresses/virDomainInterfaceAddresses. * Case for IP aliasing handled using virHashTable. * New test cases added, involving multiple and 0 IP addresse(s) per interface. * IP prefix changed from int to unsigned int. * Changes to practice libvirt habits. v4: * Various style nits, indentation errors, memory leaks fixed. * https://www.redhat.com/archives/libvir-list/2013-August/msg01265.html v3: * Upper bounds to number of interfaces and addresses per interface introduced. * Change from array of structs to array of pointers * ifaces_count moved from function argument to return value * Changes in variable names * Test cases added for qemuAgentGetInterfaces. * https://www.redhat.com/archives/libvir-list/2013-August/msg01215.html v2: * Logical errors, memory leaks and few other errors fixed. * https://www.redhat.com/archives/libvir-list/2013-August/msg00631.html v1: * http://www.redhat.com/archives/libvir-list/2013-July/msg01553.html Nehal J Wani (5): domifaddr: Implement the public APIs domifaddr: Implement the remote protocol domifaddr: Implement the API for qemu domifaddr: Add virsh support domifaddr: Expose python binding daemon/remote.c | 131 +++++++++++++++++++++++++++ examples/python/Makefile.am | 2 +- examples/python/README | 1 + examples/python/domipaddrs.py | 50 +++++++++++ include/libvirt/libvirt.h.in | 32 +++++++ python/generator.py | 3 + python/libvirt-override-api.xml | 8 +- python/libvirt-override.c | 111 +++++++++++++++++++++++ src/driver.h | 6 ++ src/libvirt.c | 115 ++++++++++++++++++++++++ src/libvirt_public.syms | 6 ++ src/qemu/qemu_agent.c | 193 ++++++++++++++++++++++++++++++++++++++++ src/qemu/qemu_agent.h | 3 + src/qemu/qemu_driver.c | 55 ++++++++++++ src/remote/remote_driver.c | 99 +++++++++++++++++++++ src/remote/remote_protocol.x | 40 ++++++++- src/remote_protocol-structs | 24 +++++ tests/qemuagenttest.c | 149 +++++++++++++++++++++++++++++++ tools/virsh-domain-monitor.c | 119 +++++++++++++++++++++++++ tools/virsh.pod | 11 +++ 20 files changed, 1155 insertions(+), 3 deletions(-) create mode 100755 examples/python/domipaddrs.py -- 1.7.11.7

4 33

[libvirt] [PATCH 0/n] improvements to native-to-xml parsing
by Eric Blake 06 Sep '13

06 Sep '13

I tried to use 'virsh qemu-attach', and hit different failures with both libvirt.git on Fedora 19, and with an older version of libvirt on RHEL 6. I'm posting patches that I have so far to start reviews, but need to write still more patches as I still haven't succeeded at attaching. I also need to add a patch to the testsuite to cover the command line that I'm trying to attach to. Eric Blake (3): qemu: only parse basename when determining emulator properties qemu: simplify list cleanup qemu: recognize -machine accel=kvm when parsing native src/conf/domain_conf.c | 6 ++++ src/qemu/qemu_command.c | 87 +++++++++++++++++++++++++------------------------ 2 files changed, 50 insertions(+), 43 deletions(-) -- 1.8.3.1

3 19

[libvirt] [PATCH] LXC:fix typo in lxc_container.c
by Chen Hanxiao 06 Sep '13

06 Sep '13

From: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> fix typo in lxc_container.c Signed-off-by: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> --- src/lxc/lxc_container.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 8abaea0..cf096f3 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -1145,7 +1145,7 @@ lxcContainerMountDetectFilesystem(const char *src ATTRIBUTE_UNUSED, #endif /* ! WITH_BLKID */ /* - * This functions attempts to do automatic detection of filesystem + * This function attempts to do automatic detection of filesystem * type following the same rules as the util-linux 'mount' binary. * * The main difference is that we don't (currently) try to use @@ -1600,7 +1600,7 @@ static int lxcContainerResolveSymlinks(virDomainDefPtr vmDef) } /* - * This is running as the 'init' process insid the container. + * This is running as the 'init' process inside the container. * It removes some capabilities that could be dangerous to * host system, since they are not currently "containerized" */ @@ -1750,7 +1750,7 @@ static int lxcContainerChild(void *data) if (lxcContainerSendContinue(argv->handshakefd) < 0) { virReportSystemError(errno, "%s", - _("failed to send continue signal to controller")); + _("Failed to send continue signal to controller")); goto cleanup; } -- 1.8.2.1

2 1

[libvirt] [PATCH 0/3] caps: expose the user and group owner of the HV
by Giuseppe Scrivano 06 Sep '13

06 Sep '13

virt-manager has no way to known the user/group that run the HV process without requiring the user to manually set it trough setup.py or assuming "root" as default value. This series extends the Guest capabilities with "hv_user" and "hv_group", to inform the libvirt user about the user/group (when qemu is used) that run the HV process. Giuseppe Scrivano (3): caps: new internal function "virCapabilitiesSetHvUserAndGroup" qemu: set hv_user/hv_group caps to the user/group which runs qemu caps: add tests and documentation for hv_user and hv_group docs/schemas/capability.rng | 10 +++++++ src/conf/capabilities.c | 46 +++++++++++++++++++++++++++++++ src/conf/capabilities.h | 7 +++++ src/libvirt_private.syms | 1 + src/qemu/qemu_capabilities.c | 3 ++ tests/capabilityschemadata/caps-test2.xml | 4 +++ 6 files changed, 71 insertions(+) -- 1.8.3.1

2 12

[libvirt] [PATCH 0/3] Keep original file label
by Michal Privoznik 06 Sep '13

06 Sep '13

This is just a resurrection of my previous patchset. As of atomicity problem, I just realized there is none. The qemuProcessHook (which is responsible for locking the files) is called prior virSecurityManagerSetAllLabel (responsible for chown()-ing). Anyway, even if there's still one and it's pre-existing, it shouldn't block this set, should it? Michal Privoznik (3): virFile: Add APIs for extended attributes handling virfile: Introduce internal API for managing ACL security_dac: Favour ACLs over chown() configure.ac | 2 + libvirt.spec.in | 1 + m4/virt-acl.m4 | 9 ++ src/Makefile.am | 4 +- src/libvirt_private.syms | 6 + src/security/security_dac.c | 297 ++++++++++++++++++++++++++++++++++++++----- src/util/virfile.c | 301 ++++++++++++++++++++++++++++++++++++++++++++ src/util/virfile.h | 28 +++++ 8 files changed, 617 insertions(+), 31 deletions(-) create mode 100644 m4/virt-acl.m4 -- 1.8.1.5

2 7

[libvirt] [PATCH] qemu: Remove unnecessary variable assignment
by Hongwei Bi 06 Sep '13

06 Sep '13

Remove unnecessary 'addrs = NULL' in qemuDomainAssignS390Addresses() and qemuDomainAssignPCIAddresses() due to the related Free function in label cleanup. --- src/qemu/qemu_command.c | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 643532f..3cc9c1d 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -1320,7 +1320,6 @@ qemuDomainAssignS390Addresses(virDomainDefPtr def, qemuDomainCCWAddressSetFree(priv->ccwaddrs); priv->persistentAddrs = 1; priv->ccwaddrs = addrs; - addrs = NULL; } else { priv->persistentAddrs = 0; } @@ -1901,7 +1900,6 @@ qemuDomainAssignPCIAddresses(virDomainDefPtr def, qemuDomainPCIAddressSetFree(priv->pciaddrs); priv->persistentAddrs = 1; priv->pciaddrs = addrs; - addrs = NULL; } else { priv->persistentAddrs = 0; } -- 1.7.1

3 2

[libvirt] [PATCH 1/1] qemu: avoid users specifying CPU features for non-x86 plaftorm.
by Li Zhang 06 Sep '13

06 Sep '13

From: Li Zhang <zhlcindy(a)linux.vnet.ibm.com> Currently, only X86 provides users CPU features with CPUID instruction. If users specify the features for non-x86, it should tell users to remove them. This patch is to report one error if features are specified by users for non-x86 platform. Signed-off-by: Li Zhang <zhlcindy(a)linux.vnet.ibm.com> --- src/qemu/qemu_command.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 91ca86a..1a158e4 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -10644,6 +10644,14 @@ qemuParseCommandLineCPU(virDomainDefPtr dom, if (*feature == '\0') goto syntax; + if (dom->os.arch != VIR_ARCH_X86_64 && + dom->os.arch != VIR_ARCH_I686) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("%s platform doesn't support CPU features'"), + virArchToString(dom->os.arch)); + goto cleanup; + } + if (STREQ(feature, "kvmclock")) { bool present = (policy == VIR_CPU_FEATURE_REQUIRE); size_t j; -- 1.8.1.4

1 0

[libvirt] [PATCH] Docs: fix a typo in virt-login-shell.pod
by Alex Jia 06 Sep '13

06 Sep '13

Signed-off-by: Alex Jia <ajia(a)redhat.com> --- tools/virt-login-shell.pod | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/tools/virt-login-shell.pod b/tools/virt-login-shell.pod index e27d500..bcd7855 100644 --- a/tools/virt-login-shell.pod +++ b/tools/virt-login-shell.pod @@ -11,7 +11,7 @@ B<virt-login-shell> The B<virt-login-shell> program is a setuid shell that is used to join an LXC container that matches the user's name. If the container is not running, virt-login-shell will attempt to start the container. -virt-sandbox-shell is not allowed to be run by root. Normal users will get +virt-login-shell is not allowed to be run by root. Normal users will get added to a container that matches their username, if it exists, and they are configured in /etc/libvirt/virt-login-shell.conf. -- 1.7.1

2 2