November 2018 - Devel - libvirt List Archives

[libvirt] Information sent in libvirt during the sasl usage and tls
by Anastasiya Ruzhanskaya 26 Nov '18

26 Nov '18

Hello everyone! I am trying without any success to decipher traffic from client to server in virt-manager in wireshark, but I don't know the sessioon key there, so seems no chance to do this. This is why I want to ask, is any info related to the certificate sent through the connection? Or if I use kerberos protocol for authentication, will the user id be sent in every message from client to server? Or only during authentication?

2 2

[libvirt] [PATCH libvirt-python] Add daemon to list of shutdown reasons
by Philipp Hahn 26 Nov '18

26 Nov '18

Add the support to work with libvirt commit 66a85cb13. Signed-off-by: Philipp Hahn <hahn(a)univention.de> --- examples/event-test.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/event-test.py b/examples/event-test.py index 709277b..81ebfc1 100755 --- a/examples/event-test.py +++ b/examples/event-test.py @@ -489,7 +489,7 @@ DOM_EVENTS = Description( ("Started", ("Booted", "Migrated", "Restored", "Snapshot", "Wakeup")), ("Suspended", ("Paused", "Migrated", "IOError", "Watchdog", "Restored", "Snapshot", "API error", "Postcopy", "Postcopy failed")), ("Resumed", ("Unpaused", "Migrated", "Snapshot", "Postcopy")), - ("Stopped", ("Shutdown", "Destroyed", "Crashed", "Migrated", "Saved", "Failed", "Snapshot")), + ("Stopped", ("Shutdown", "Destroyed", "Crashed", "Migrated", "Saved", "Failed", "Snapshot", "Daemon")), ("Shutdown", ("Finished", "On guest request", "On host request")), ("PMSuspended", ("Memory", "Disk")), ("Crashed", ("Panicked",)), -- 2.11.0

2 1

[libvirt] Why "integratorcp" as the default machine type for ARM / AArch64?
by Kashyap Chamarthy 26 Nov '18

26 Nov '18

Hi I see in the following change, Dan added the default machine types for all architectures: https://libvirt.org/git/?p=libvirt.git;a=commitdiff;h=26cfb1a3 ("qemu: ensure default machine types don't change if QEMU changes") What caught my eye was the default machine type chosen ("integratorcp") for ARM / AAarch64: + [VIR_ARCH_ARMV7L] = "integratorcp", + [VIR_ARCH_ARMV7B] = "integratorcp", + + [VIR_ARCH_AARCH64] = "integratorcp", I thought the default for AArch64 / ARM would be 'virt'---as I learnt that upstream QEMU explicitly designed the 'virt' board for ARM / AArch64-based machine machines (because it supports PCI, 'virtio', has decent RAM limits, etc.) So, shouldn't the default for the above be changed from "integratorcp" to "virt"? PS: I thought "integratorcp" board was picked as it was probably the first entry when you run `qemu-system-aarch64 -machine help`, but that wasn't the case on my Fedora-28 machine---it was the 12th entry. -- /kashyap

2 4

[libvirt] [PATCH] util: netdevbridge: fall back to ioctl from sysfs
by Christian Ehrhardt 26 Nov '18

26 Nov '18

There are certain cases e.g. containers where the sysfs path might exists, but might fail. Unfortunately the exact restrictions are only known to libvirt when trying to write to it so we need to try it. But in case it fails there is no need to fully abort, in those cases try to fall back to the older ioctl interface which can still work. That makes setting up a bridge in unprivileged LXD containers work. Fixes: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1802906 Signed-off-by: Christian Ehrhardt <christian.ehrhardt(a)canonical.com> --- src/util/virnetdevbridge.c | 48 +++++++++++++++++++++----------------- 1 file changed, 26 insertions(+), 22 deletions(-) diff --git a/src/util/virnetdevbridge.c b/src/util/virnetdevbridge.c index 071ebb7b35..cbba3c9652 100644 --- a/src/util/virnetdevbridge.c +++ b/src/util/virnetdevbridge.c @@ -113,6 +113,8 @@ static int virNetDevBridgeCmd(const char *brname, * or by ioctl on older kernels. Perhaps we could just use * ioctl for every kernel, but its not clear what the long * term lifespan of the ioctl interface is... + * Fall back to ioctl if sysfs interface is not available or + * failing (e.g. due to container isolation). */ static int virNetDevBridgeSet(const char *brname, const char *paramname, /* sysfs param name */ @@ -128,29 +130,31 @@ static int virNetDevBridgeSet(const char *brname, if (virFileExists(path)) { char valuestr[INT_BUFSIZE_BOUND(value)]; snprintf(valuestr, sizeof(valuestr), "%lu", value); - if (virFileWriteStr(path, valuestr, 0) < 0) { - virReportSystemError(errno, - _("Unable to set bridge %s %s"), brname, paramname); - return -1; - } + if (virFileWriteStr(path, valuestr, 0) >= 0) + return 0; + virReportSystemError(errno, + _("Unable to set bridge %s %s via sysfs"), + brname, paramname); + } + + unsigned long paramid; + if (STREQ(paramname, "stp_state")) { + paramid = BRCTL_SET_BRIDGE_STP_STATE; + } else if (STREQ(paramname, "forward_delay")) { + paramid = BRCTL_SET_BRIDGE_FORWARD_DELAY; } else { - unsigned long paramid; - if (STREQ(paramname, "stp_state")) { - paramid = BRCTL_SET_BRIDGE_STP_STATE; - } else if (STREQ(paramname, "forward_delay")) { - paramid = BRCTL_SET_BRIDGE_FORWARD_DELAY; - } else { - virReportSystemError(EINVAL, - _("Unable to set bridge %s %s"), brname, paramname); - return -1; - } - unsigned long args[] = { paramid, value, 0, 0 }; - ifr->ifr_data = (char*)&args; - if (ioctl(fd, SIOCDEVPRIVATE, ifr) < 0) { - virReportSystemError(errno, - _("Unable to set bridge %s %s"), brname, paramname); - return -1; - } + virReportSystemError(EINVAL, + _("Unable to set bridge %s %s via ioctl"), + brname, paramname); + return -1; + } + unsigned long args[] = { paramid, value, 0, 0 }; + ifr->ifr_data = (char*)&args; + if (ioctl(fd, SIOCDEVPRIVATE, ifr) < 0) { + virReportSystemError(errno, + _("Failed to set bridge %s %s via ioctl"), + brname, paramname); + return -1; } return 0; -- 2.17.1

3 9

[libvirt] [PATCH v2 0/4] rpc: fixing compilation error due to deprecated functions.
by Julio Faracco 23 Nov '18

23 Nov '18

After 0.8.0 release, libssh deprecated some functions like: ssh_is_server_known() and ssh_write_knownhost(). They were replaced by ssh_session_is_known_server() and ssh_session_update_known_hosts() respectively. This serie creates the alias to keep the compatibility and create an auxiliar enum to help it because ssh_session_update_known_hosts() introduced new state returns. Julio Faracco (4): m4: checking if ssh_session_is_known_server() exists. rpc: replacing ssh_is_server_known() by ssh_session_is_known_server(). m4: checking if ssh_session_update_known_hosts() exists. rpc: replacing ssh_write_knownhost() by ssh_session_update_known_hosts(). m4/virt-libssh.m4 | 12 ++++++++++++ src/rpc/virnetlibsshsession.c | 31 +++++++++++++++++++++++-------- 2 files changed, 35 insertions(+), 8 deletions(-) -- 2.19.1

2 5

[libvirt] [PATCH v2 0/4] qemu: Fix offline migration onto the same host
by Michal Privoznik 23 Nov '18

23 Nov '18

v2 of: https://www.redhat.com/archives/libvir-list/2018-November/msg00832.html diff to v1: - in 2/4 I'm passing @priv whenever possible - only doing s/priv/NULL/ in 3/4 as suggested in review Patches 1/4 and 4/4 are reviewed already (not pushed yet though). Michal Prívozník (4): qemuMigrationDstPrepareAny: Don't overwrite error in cleanup path qemuMigrationEatCookie: Pass virDomainDef instead of virDomainObj qemuMigrationDstPrepareAny: Parse cookie before adding domain onto list qemuMigrationSrcConfirm: Don't remove domain config if confirm phase fails src/qemu/qemu_migration.c | 42 ++++++++++++++++++++------------ src/qemu/qemu_migration_cookie.c | 23 ++++++++--------- src/qemu/qemu_migration_cookie.h | 4 ++- 3 files changed, 41 insertions(+), 28 deletions(-) -- 2.18.1

2 6

[libvirt] [PATCH 0/4] qemu: Fix offline migration onto the same host
by Michal Privoznik 23 Nov '18

23 Nov '18

This started as a report on #virt that the following command makes libvirt lose domain and which is worse - remove its XML! virsh migrate --offline --undefinesource --persistent $dom qemu+tcp://localhost/system Turns out, there are two problems. The first one is that we try to add incoming domain definition onto virDomainObjList before parsing migration cookie; the second one being VIR_MIGRATE_UNDEFINE_SOURCE takes effect regardless of migration success or failure. Michal Prívozník (4): qemuMigrationDstPrepareAny: Don't overwrite error in cleanup path qemuMigrationEatCookie: Pass virDomainDef instead of virDomainObj qemuMigrationDstPrepareAny: Parse cookie before adding domain onto list qemuMigrationSrcConfirm: Don't remove domain config if confirm phase fails src/qemu/qemu_migration.c | 42 ++++++++++++++++++++------------ src/qemu/qemu_migration_cookie.c | 23 ++++++++--------- src/qemu/qemu_migration_cookie.h | 4 ++- 3 files changed, 41 insertions(+), 28 deletions(-) -- 2.18.1

2 8

[libvirt] [jenkins-ci PATCH] Revert "Enable {media, tree}uri tests for libosinfo"
by Andrea Bolognani 23 Nov '18

23 Nov '18

While a very good idea in theory, it turns out that running these tests on CI results in a lot of false positives due to issues on the remote side, which are of course entirely out of our control. This reverts commit ad8cdcf7a1e0e293e3cea19f36187b943bb881dd. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- guests/playbooks/build/projects/libosinfo.yml | 4 ---- projects/libosinfo.yaml | 3 --- 2 files changed, 7 deletions(-) diff --git a/guests/playbooks/build/projects/libosinfo.yml b/guests/playbooks/build/projects/libosinfo.yml index dce1333..311a52b 100644 --- a/guests/playbooks/build/projects/libosinfo.yml +++ b/guests/playbooks/build/projects/libosinfo.yml @@ -9,10 +9,6 @@ - include: '{{ playbook_base }}/jobs/autotools-build-job.yml' - include: '{{ playbook_base }}/jobs/autotools-syntax-check-job.yml' - include: '{{ playbook_base }}/jobs/autotools-check-job.yml' - vars: - local_env: | - # Run tests that require network connectivity - export LIBOSINFO_NETWORK_TESTS=1 - include: '{{ playbook_base }}/jobs/autotools-rpm-job.yml' vars: machines: '{{ rpm_machines }}' diff --git a/projects/libosinfo.yaml b/projects/libosinfo.yaml index bf9ea6b..0376d0c 100644 --- a/projects/libosinfo.yaml +++ b/projects/libosinfo.yaml @@ -12,9 +12,6 @@ parent_jobs: 'libosinfo-build' - autotools-check-job: parent_jobs: 'libosinfo-syntax-check' - local_env: | - # Run tests that require network connectivity - export LIBOSINFO_NETWORK_TESTS=1 - autotools-rpm-job: parent_jobs: 'libosinfo-check' machines: '{rpm_machines}' -- 2.19.1

2 1

[libvirt] [PATCH 00/12] Autoselect a DRM node for egl-headless and add it to cmdline
by Erik Skultety 22 Nov '18

22 Nov '18

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1628892. The problem is that we didn't put the DRI device into the namespace for QEMU to access, but that was only a part of the issue. The other part of the issue is that QEMU doesn't support specifying 'rendernode' for egl-headless yet (some patches to solve this are already upstream for 3.1, some are still waiting to be merged). Instead, QEMU's been autoselecting the DRI device on its own. There's no compelling reason for libvirt not doing that instead and thus prevent any permission-related issues. Unlike for SPICE though, I deliberately didn't add an XML attribute for users to select the rendernode for egl-headless, because: a) most of the time, users really don't care about which DRM node will be used and libvirt will most probably do a good decision b) egl-headless is only useful until we have a remote OpenGL acceleration support within SPICE c) for SPICE (or for SDL for that matter at some point), the rendernode is specified as part of the <gl> subelement which says "if enabled, use OpenGL acceleration", but egl-headless graphics type essentially serves the same purpose, it's like having <gl enabled='yes'/> for SPICE, thus having a <gl> subelement for egl-headless type is rather confusing Erik Skultety (12): util: Introduce virHostGetDRMRenderNode helper qemu: command: spice: Pick the first available DRM render node qemu: caps: Start probing for egl-headless display type qemu: caps: Introduce QEMU_EGL_HEADLESS_RENDERNODE capability qemu: command: Introduce qemuBuildGraphicsEGLHeadlessCommandLine helper conf: Add egl-headless to virDomainGraphicsDef union qemu: domain: Put the egl-headless' rendernode device into the namespace qemu: cgroup: Add the DRI device to the cgroup list for egl-headless too command: Put the 'rendernode' option onto egl-headless graphics cmdline security: dac: Relabel the DRI render device for egl-headless too tests: Add a test case for the egl-headless' rendernode option docs: Provide a news update for libvirt being able to pick a DRI device docs/news.xml | 13 ++++ src/conf/domain_conf.h | 3 + src/libvirt_private.syms | 1 + src/qemu/qemu_capabilities.c | 17 +++-- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_cgroup.c | 15 ++-- src/qemu/qemu_command.c | 72 +++++++++++++++---- src/qemu/qemu_domain.c | 15 ++-- src/security/security_dac.c | 21 +++--- src/util/virutil.c | 53 ++++++++++++++ src/util/virutil.h | 2 + ...cs-egl-headless-rendernode-autoselect.args | 26 +++++++ ...ics-egl-headless-rendernode-autoselect.xml | 1 + tests/qemuxml2argvmock.c | 9 +++ tests/qemuxml2argvtest.c | 4 ++ 15 files changed, 220 insertions(+), 33 deletions(-) create mode 100644 tests/qemuxml2argvdata/graphics-egl-headless-rendernode-autoselect.args create mode 120000 tests/qemuxml2argvdata/graphics-egl-headless-rendernode-autoselect.xml -- 2.19.1

3 20

[libvirt] [PATCH v2] security: aa-helper: fix static defined vfio MDEVs
by Christian Ehrhardt 22 Nov '18

22 Nov '18

virt-aa-helper needs to grant QEMU access to VFIO MDEV devices. This extends commit 74e86b6b which only covered PCI hostdevs for VFIO-PCI assignment by now also covering vfio MDEVs. It has still the same limitations regarding the device lifecycle, IOW we're unable to predict the actual VFIO device being created, thus we need wildcards. Also note that the hotplug case, where apparmor is able to detect the actual VFIO device during runtime, is already covered by commit 606afafb. Signed-off-by: Christian Ehrhardt <christian.ehrhardt(a)canonical.com> Reviewed-by: Erik Skultety <eskultet(a)redhat.com> Reviewed-by: Boris Fiuczynski <fiuczy(a)linux.ibm.com> --- src/security/virt-aa-helper.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 03cc15c9d3..c7488432d6 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1105,6 +1105,23 @@ get_files(vahControl * ctl) break; } + case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_MDEV: { + virDomainHostdevSubsysMediatedDevPtr mdevsrc = &dev->source.subsys.u.mdev; + switch ((virMediatedDeviceModelType) mdevsrc->model) { + case VIR_MDEV_MODEL_TYPE_VFIO_PCI: + case VIR_MDEV_MODEL_TYPE_VFIO_AP: + case VIR_MDEV_MODEL_TYPE_VFIO_CCW: + needsVfio = true; + break; + case VIR_MDEV_MODEL_TYPE_LAST: + default: + virReportEnumRangeError(virMediatedDeviceModelType, + mdevsrc->model); + break; + } + break; + } + case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI: { virPCIDevicePtr pci = virPCIDeviceNew( dev->source.subsys.u.pci.addr.domain, -- 2.17.1

2 1