March 2018 - Devel - libvirt List Archives

[libvirt] [PATCH] docs: link to security.libvirt.org website
by Daniel P. Berrangé 17 Mar '18

17 Mar '18

We forgot to tell anyone that we were publishing security notices online at https://security.libvirt.org Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- docs/securityprocess.html.in | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/docs/securityprocess.html.in b/docs/securityprocess.html.in index 2bab07bf39..adf30259b0 100644 --- a/docs/securityprocess.html.in +++ b/docs/securityprocess.html.in @@ -37,6 +37,19 @@ moderator and the reporter copied on any replies. </p> + <h2><a id="secnotice">Security notices</a></h2> + + <p> + Information for all historical security issues is maintained in + machine parsable format in the + <a href="https://libvirt.org/git/?p=libvirt-security-notice.git;a=log">libvirt-security-notice GIT repository</a> and + <a href="https://security.libvirt.org">published online</a> + in text, HTML and XML formats. Security notices are published + on the <a href="https://libvirt.org/contact.html#email">libvirt-announce mailing list</a> + when any embargo is lifted, or as soon as triaged if already + public knowledge. + </p> + <h2><a id="seclist">Security team</a></h2> <p> @@ -102,12 +115,5 @@ will be responsible for backporting the officially published fixes to other release branches where applicable. </p> - - <h2><a id="notification">Notification of issues</a></h2> - - <p> - When an embargo expires, security issues will be announced on both - the libvirt development and announcement <a href="https://libvirt.org/contact.html#email">mailing lists</a>. - </p> </body> </html> -- 2.14.3

3 2

[libvirt] [GSoC] Contribution towards GSoC'18 [BiteSizedTasks].
by Sukrit Bhatnagar 16 Mar '18

16 Mar '18

Task: Use comma escaping for more command line values in qemu Added virQEMUBuildBufferEscapeComma wherever applicable in src/qemu/qemu_command.c as specified in the Task page. Places where no changes were made: - src->hosts->socket in qemuBuildNetworkDriveURI uses virAsprintf not virBufferAsprintf - TYPE_DEV, TYPE_FILE, TYPE_PIPE, TYPE_UNIX not found in qemuBuildChrArgStr - not applicable on data.nix.path in qemuBuildVhostuserCommandLine - UNCLEAR: places that use strchr in qemuBuildSmartcardCommandLine, can be converted to use virBufferEscape All tests which were passed by an unmodified clone were passed after I made these changes. Once `make syntax-check` gave a false error related to matching of braces in if-else. Your feedback is welcome :) Signed-off-by: Sukrit Bhatnagar <skrtbhtngr(a)gmail.com> --- src/qemu/qemu_command.c | 74 ++++++++++++++++++++++++++++++------------------- 1 file changed, 45 insertions(+), 29 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index fa0aa5d5c..beabf8837 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -474,8 +474,10 @@ qemuBuildRomStr(virBufferPtr buf, default: break; } - if (info->romfile) - virBufferAsprintf(buf, ",romfile=%s", info->romfile); + if (info->romfile) { + virBufferAddLit(buf, ",romfile="); + virQEMUBuildBufferEscapeComma(buf, info->romfile); + } } return 0; } @@ -2177,11 +2179,15 @@ qemuBuildDriveDevStr(const virDomainDef *def, virBufferAsprintf(&opt, ",wwn=0x%s", disk->wwn); } - if (disk->vendor) - virBufferAsprintf(&opt, ",vendor=%s", disk->vendor); + if (disk->vendor) { + virBufferAddLit(&opt, ",vendor="); + virQEMUBuildBufferEscapeComma(&opt, disk->vendor); + } - if (disk->product) - virBufferAsprintf(&opt, ",product=%s", disk->product); + if (disk->product) { + virBufferAddLit(&opt, ",product="); + virQEMUBuildBufferEscapeComma(&opt, disk->product); + } if (disk->bus == VIR_DOMAIN_DISK_BUS_USB) { if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_USB_STORAGE_REMOVABLE)) { @@ -2418,7 +2424,8 @@ qemuBuildFSStr(virDomainFSDefPtr fs, } virBufferAsprintf(&opt, ",id=%s%s", QEMU_FSDEV_HOST_PREFIX, fs->info.alias); - virBufferAsprintf(&opt, ",path=%s", fs->src->path); + virBufferAddLit(&opt, ",path="); + virQEMUBuildBufferEscapeComma(&opt, fs->src->path); if (fs->readonly) { if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_FSDEV_READONLY)) { @@ -2463,7 +2470,8 @@ qemuBuildFSDevStr(const virDomainDef *def, virBufferAsprintf(&opt, ",id=%s", fs->info.alias); virBufferAsprintf(&opt, ",fsdev=%s%s", QEMU_FSDEV_HOST_PREFIX, fs->info.alias); - virBufferAsprintf(&opt, ",mount_tag=%s", fs->dst); + virBufferAddLit(&opt, ",mount_tag="); + virQEMUBuildBufferEscapeComma(&opt, fs->dst); if (qemuBuildVirtioOptionsStr(&opt, fs->virtio, qemuCaps) < 0) goto error; @@ -3603,10 +3611,9 @@ qemuBuildHostNetStr(virDomainNetDefPtr net, break; case VIR_DOMAIN_NET_TYPE_CLIENT: - virBufferAsprintf(&buf, "socket%cconnect=%s:%d,", - type_sep, - net->data.socket.address, - net->data.socket.port); + virBufferAsprintf(&buf, "socket%cconnect=", type_sep); + virQEMUBuildBufferEscapeComma(&buf, net->data.socket.address); + virBufferAsprintf(&buf, ":%d,", net->data.socket.port); break; case VIR_DOMAIN_NET_TYPE_SERVER: @@ -4858,7 +4865,8 @@ qemuBuildChrChardevFileStr(virLogManagerPtr logManager, virBufferAsprintf(buf, ",%s=%s,%s=on", filearg, fdpath, appendarg); VIR_FREE(fdpath); } else { - virBufferAsprintf(buf, ",%s=%s", filearg, fileval); + virBufferAsprintf(buf, ",%s=", filearg); + virQEMUBuildBufferEscapeComma(buf, fileval); if (appendval != VIR_TRISTATE_SWITCH_ABSENT) { virBufferAsprintf(buf, ",%s=%s", appendarg, virTristateSwitchTypeToString(appendval)); @@ -4916,9 +4924,10 @@ qemuBuildChrChardevStr(virLogManagerPtr logManager, break; case VIR_DOMAIN_CHR_TYPE_DEV: - virBufferAsprintf(&buf, "%s,id=%s,path=%s", + virBufferAsprintf(&buf, "%s,id=%s,path=", STRPREFIX(alias, "parallel") ? "parport" : "tty", - charAlias, dev->data.file.path); + charAlias); + virQEMUBuildBufferEscapeComma(&buf, dev->data.file.path); break; case VIR_DOMAIN_CHR_TYPE_FILE: @@ -4938,8 +4947,8 @@ qemuBuildChrChardevStr(virLogManagerPtr logManager, break; case VIR_DOMAIN_CHR_TYPE_PIPE: - virBufferAsprintf(&buf, "pipe,id=%s,path=%s", charAlias, - dev->data.file.path); + virBufferAsprintf(&buf, "pipe,id=%s,path=", charAlias); + virQEMUBuildBufferEscapeComma(&buf, dev->data.file.path); break; case VIR_DOMAIN_CHR_TYPE_STDIO: @@ -7829,10 +7838,14 @@ qemuBuildGraphicsVNCCommandLine(virQEMUDriverConfigPtr cfg, if (cfg->vncTLS) { virBufferAddLit(&opt, ",tls"); - if (cfg->vncTLSx509verify) - virBufferAsprintf(&opt, ",x509verify=%s", cfg->vncTLSx509certdir); - else - virBufferAsprintf(&opt, ",x509=%s", cfg->vncTLSx509certdir); + if (cfg->vncTLSx509verify) { + virBufferAddLit(&opt, ",x509verify="); + virQEMUBuildBufferEscapeComma(&opt, cfg->vncTLSx509certdir); + } + else { + virBufferAddLit(&opt, ",x509="); + virQEMUBuildBufferEscapeComma(&opt, cfg->vncTLSx509certdir); + } } if (cfg->vncSASL) { @@ -7977,8 +7990,11 @@ qemuBuildGraphicsSPICECommandLine(virQEMUDriverConfigPtr cfg, !cfg->spicePassword) virBufferAddLit(&opt, "disable-ticketing,"); - if (hasSecure) - virBufferAsprintf(&opt, "x509-dir=%s,", cfg->spiceTLSx509certdir); + if (hasSecure) { + virBufferAddLit(&opt, "x509-dir="); + virQEMUBuildBufferEscapeComma(&opt, cfg->spiceTLSx509certdir); + virBufferAddLit(&opt, ","); + } switch (graphics->data.spice.defaultMode) { case VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_SECURE: @@ -9463,9 +9479,9 @@ qemuBuildDomainLoaderCommandLine(virCommandPtr cmd, NULL); } - virBufferAsprintf(&buf, - "file=%s,if=pflash,format=raw,unit=%d", - loader->path, unit); + virBufferAddLit(&buf, "file="); + virQEMUBuildBufferEscapeComma(&buf, loader->path); + virBufferAsprintf(&buf, ",if=pflash,format=raw,unit=%d", unit); unit++; if (loader->readonly) { @@ -9478,9 +9494,9 @@ qemuBuildDomainLoaderCommandLine(virCommandPtr cmd, if (loader->nvram) { virBufferFreeAndReset(&buf); - virBufferAsprintf(&buf, - "file=%s,if=pflash,format=raw,unit=%d", - loader->nvram, unit); + virBufferAddLit(&buf, "file="); + virQEMUBuildBufferEscapeComma(&buf, loader->nvram); + virBufferAsprintf(&buf, ",if=pflash,format=raw,unit=%d", unit); virCommandAddArg(cmd, "-drive"); virCommandAddArgBuffer(cmd, &buf); -- 2.16.2

2 1

[libvirt] [PATCH 0/2] Don't report a VFIO error for mdev when IOMMU is disabled
by Erik Skultety 16 Mar '18

16 Mar '18

Unlike GPU assignment, mdev doesn't need the IOMMU to be enabled within kernel, since the physical parent device takes care of the isolation, i.e. there's an IOMMU group entry for each mdev created under sysfs, thus a VM can start successfully Erik Skultety (2): util:mdev: Improve the error msg on non-existent mdev prior to VM start qemu: hostdev: Don't error out on domain with an mdev when IOMMU is off src/qemu/qemu_hostdev.c | 7 ++++++- src/util/virmdev.c | 16 +++++++++++++--- 2 files changed, 19 insertions(+), 4 deletions(-) -- 2.13.6

2 7

[libvirt] [PATCH 0/2] Another round of build fixes
by Michal Privoznik 16 Mar '18

16 Mar '18

Pushed under build-breaker rule. Michal Privoznik (2): virarptable: Avoid cast align warnings virnetlink: Provide virNetlinkGetNeighbor non-Linux stub src/util/virarptable.c | 100 ++++++++++++++++++++++++------------------------- src/util/virnetlink.c | 11 ++++++ 2 files changed, 61 insertions(+), 50 deletions(-) -- 2.16.1

1 2

[libvirt] [PATCH 0/2] Two small fixes
by Michal Privoznik 16 Mar '18

16 Mar '18

*** BLURB HERE *** Michal Privoznik (2): src: Don't add virarptable.c to setuid library virarptable: Include rtnetlink.h only on Linux src/Makefile.am | 1 - src/util/virarptable.c | 3 +++ src/util/virarptable.h | 1 - 3 files changed, 3 insertions(+), 2 deletions(-) -- 2.16.1

3 6

[libvirt] [GSoC] git send-email help
by Sukrit Bhatnagar 16 Mar '18

16 Mar '18

Hi, I am trying to mail a patch I made to this list, but git send-email is not working. I have followed the steps in Contributing Guidelines page. What can I do? Thanks, Sukrit

2 1

[libvirt] [RFC PATCH 00/28] Enable multifunction pci hotplug
by Shivaprasad G Bhat 16 Mar '18

16 Mar '18

Hi All, I have revisited/rewritten my previously posted patches. Here is the RFC. Since this patchset is a complete rewrite, I am starting with v1 here. The semantics is as discussed before https://www.redhat.com/archives/libvir-list/2016-April/msg01057.html As I went on to refactor the code to support multifunction virtio devices, I realised the abort/cleanup path would be a nightmare there, in case of failures. So, dropped that attempt. The current RFC limits to the real practical use cases of Multifunction PCI hostdevices. All new test code to support multifunction PCI hostdevices and test cases are added to prove the functionality. So, to summarise ============= Patch 1 - is a bug fix Patch 2-6 - Adds all PCI/VFIO/Multifunction/multiple devices per IOMMU group support to our mock test environment. Patches till here, are kind of basic and independent but necessary for the remaining patches. ============= Patch 7-14 - Detect and auto-address PCI multifunction devices. ============= Patch 15-25 - Refactor/Prepare for hotplug/unplug Patch 26-28 - Finally implement Hotplug/Unplug Thanks, Shivaprasad --- Shivaprasad G Bhat (28): Fix the iommu group path in mock pci util: move the hostdev passthrough support functions to utility tests: pci: Mock the iommu groups and vfio virpcitest: Change the stub driver to vfio from pci-stub virpcimock: Mock the SRIOV Virtual functions tests: qemu: Add test case for pci-hostdev hotplug tests: Add a baseline test for multifunction pci device use case util: virpci: detect if the device is a multifunction device from sysfs tests: qemu: mock pci environment for qemuargv2xmltests virhostdev: Introduce virHostdevPCIDevicesBelongToSameSlot qemu: address: Separate the slots into multiple aggregates qemu: address: Enable auto addressing multifunction cards util: make virHostdevIsVirtualFunction() public conf: qemu: validate multifunction hostdevice domain configs conf: Add helper to get active functions of a slot of domain qemu: hostdev: Move the hostdev preparation to a separate function qemu: hotplug: Move the detach of PCI device to the beginnging of live hotplug qemu: hotplug: move assignment outside qemuDomainAttachHostPCIDevice Introduce virDomainDeviceDefParseXMLMany Introduce qemuDomainDeviceParseXMLMany qemu: refactor qemuDomain[Attach|Detach]DeviceConfig qemu: refactor qemuDomain[Attach|Detach]DeviceLive qemu: hotplug: Queue and wait for multiple devices domain: addr: Introduce virDomainPCIAddressEnsureMultifunctionAddress qemu: hotplug: Implement multifunction device hotplug qemu: hotplug : Prevent updates to mulitfunction device qemu: hotplug: Move out the Single function check qemu: hotplug: Implement multifunction device unplug src/conf/device_conf.h | 7 src/conf/domain_addr.c | 127 ++++++- src/conf/domain_addr.h | 41 +- src/conf/domain_conf.c | 194 +++++++++- src/conf/domain_conf.h | 39 ++ src/libvirt_private.syms | 14 + src/node_device/node_device_udev.c | 2 src/qemu/qemu_capabilities.c | 5 src/qemu/qemu_domain.c | 72 ++++ src/qemu/qemu_domain.h | 19 + src/qemu/qemu_domain_address.c | 375 ++++++++++++++++++- src/qemu/qemu_domain_address.h | 15 + src/qemu/qemu_driver.c | 197 +++++++--- src/qemu/qemu_hostdev.c | 70 ---- src/qemu/qemu_hostdev.h | 3 src/qemu/qemu_hotplug.c | 389 ++++++++++++++++---- src/qemu/qemu_hotplug.h | 14 + src/util/virhostdev.c | 96 +++++ src/util/virhostdev.h | 11 + src/util/virpci.c | 22 + src/util/virpci.h | 8 src/util/virprocess.h | 2 tests/Makefile.am | 7 tests/qemuargv2xmldata/hostdev-pci-address.args | 2 tests/qemuargv2xmldata/hostdev-pci-address.xml | 2 tests/qemuargv2xmltest.c | 18 + tests/qemuhotplugtest.c | 98 ++++- .../qemuhotplug-hostdev-pci.xml | 6 .../qemuhotplug-multifunction-hostdev-pci-2.xml | 14 + .../qemuhotplug-multifunction-hostdev-pci.xml | 20 + .../qemuhotplug-base-live+hostdev-pci.xml | 60 +++ ...hotplug-base-live+multifunction-hostdev-pci.xml | 76 ++++ .../qemuhotplug-pseries-base-live+hostdev-pci.xml | 53 +++ ...eries-base-live+multifunction-hostdev-pci-2.xml | 61 +++ ...pseries-base-live+multifunction-hostdev-pci.xml | 69 ++++ .../qemuhotplug-pseries-base-live.xml | 45 ++ .../hostdev-pci-address-device.args | 2 .../hostdev-pci-address-device.xml | 2 tests/qemuxml2argvdata/hostdev-pci-address.args | 2 tests/qemuxml2argvdata/hostdev-pci-address.xml | 2 .../hostdev-pci-multifunction.args | 31 ++ .../qemuxml2argvdata/hostdev-pci-multifunction.xml | 59 +++ .../hostdev-pci-no-primary-function.xml | 23 + tests/qemuxml2argvdata/hostdev-pci-validate.args | 25 + tests/qemuxml2argvdata/hostdev-pci-validate.xml | 29 + .../qemuxml2argvdata/hostdev-vfio-multidomain.args | 2 .../qemuxml2argvdata/hostdev-vfio-multidomain.xml | 2 tests/qemuxml2argvdata/hostdev-vfio.args | 2 tests/qemuxml2argvdata/hostdev-vfio.xml | 2 tests/qemuxml2argvdata/net-hostdev-fail.xml | 2 .../qemuxml2argvdata/net-hostdev-multidomain.args | 2 tests/qemuxml2argvdata/net-hostdev-multidomain.xml | 2 tests/qemuxml2argvdata/net-hostdev-vfio.args | 2 tests/qemuxml2argvdata/net-hostdev-vfio.xml | 2 tests/qemuxml2argvdata/net-hostdev.args | 2 tests/qemuxml2argvdata/net-hostdev.xml | 2 tests/qemuxml2argvdata/pci-rom.args | 4 tests/qemuxml2argvdata/pci-rom.xml | 4 tests/qemuxml2argvdata/pseries-hostdevs-1.args | 5 tests/qemuxml2argvdata/pseries-hostdevs-3.args | 5 tests/qemuxml2argvtest.c | 17 + tests/qemuxml2xmloutdata/hostdev-pci-address.xml | 2 .../hostdev-pci-multifunction.xml | 79 ++++ tests/qemuxml2xmloutdata/hostdev-vfio.xml | 2 tests/qemuxml2xmloutdata/net-hostdev-vfio.xml | 2 tests/qemuxml2xmloutdata/net-hostdev.xml | 2 tests/qemuxml2xmloutdata/pci-rom.xml | 4 tests/qemuxml2xmloutdata/pseries-hostdevs-1.xml | 4 tests/qemuxml2xmloutdata/pseries-hostdevs-3.xml | 4 tests/qemuxml2xmltest.c | 1 tests/virhostdevtest.c | 39 -- tests/virpcimock.c | 199 +++++++++- tests/virpcitest.c | 12 - tests/virpcitestdata/0000-06-12.0.config | Bin tests/virpcitestdata/0000-06-12.1.config | Bin tests/virpcitestdata/0000-06-12.2.config | Bin tests/virpcitestdata/0005-90-01.1.config | Bin tests/virpcitestdata/0005-90-01.2.config | Bin tests/virpcitestdata/0005-90-01.3.config | Bin tests/virprocessmock.c | 28 + 80 files changed, 2463 insertions(+), 400 deletions(-) create mode 100644 tests/qemuhotplugtestdevices/qemuhotplug-hostdev-pci.xml create mode 100644 tests/qemuhotplugtestdevices/qemuhotplug-multifunction-hostdev-pci-2.xml create mode 100644 tests/qemuhotplugtestdevices/qemuhotplug-multifunction-hostdev-pci.xml create mode 100644 tests/qemuhotplugtestdomains/qemuhotplug-base-live+hostdev-pci.xml create mode 100644 tests/qemuhotplugtestdomains/qemuhotplug-base-live+multifunction-hostdev-pci.xml create mode 100644 tests/qemuhotplugtestdomains/qemuhotplug-pseries-base-live+hostdev-pci.xml create mode 100644 tests/qemuhotplugtestdomains/qemuhotplug-pseries-base-live+multifunction-hostdev-pci-2.xml create mode 100644 tests/qemuhotplugtestdomains/qemuhotplug-pseries-base-live+multifunction-hostdev-pci.xml create mode 100644 tests/qemuhotplugtestdomains/qemuhotplug-pseries-base-live.xml create mode 100644 tests/qemuxml2argvdata/hostdev-pci-multifunction.args create mode 100644 tests/qemuxml2argvdata/hostdev-pci-multifunction.xml create mode 100644 tests/qemuxml2argvdata/hostdev-pci-no-primary-function.xml create mode 100644 tests/qemuxml2argvdata/hostdev-pci-validate.args create mode 100644 tests/qemuxml2argvdata/hostdev-pci-validate.xml create mode 100644 tests/qemuxml2xmloutdata/hostdev-pci-multifunction.xml create mode 100644 tests/virpcitestdata/0000-06-12.0.config create mode 100644 tests/virpcitestdata/0000-06-12.1.config create mode 100644 tests/virpcitestdata/0000-06-12.2.config create mode 100644 tests/virpcitestdata/0005-90-01.3.config create mode 100644 tests/virprocessmock.c -- Signature

4 39

[libvirt] [PATCH] docs: Fix apibuild.py syntax
by John Ferlan 16 Mar '18

16 Mar '18

Commit id '477502de3' altered the entry to add one too many closing parenthesis ')' and that propagated into commit id '9176b42bd'. Signed-off-by: John Ferlan <jferlan(a)redhat.com> --- Pushed as a build breaker: GEN news.html File "./apibuild.py", line 481 line.split()))) ^ SyntaxError: invalid syntax docs/apibuild.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/apibuild.py b/docs/apibuild.py index ba359c98c..67b7eed1e 100755 --- a/docs/apibuild.py +++ b/docs/apibuild.py @@ -478,7 +478,7 @@ class CLexer: if line[0] == '#': self.tokens = list(map((lambda x: ('preproc', x)), - line.split()))) + line.split())) # We might have whitespace between the '#' and preproc # macro name, so instead of having a single token element -- 2.13.6

1 0

[libvirt] [PATCH v2 0/8] Introduce partial Python 3 support
by Andrea Bolognani 16 Mar '18

16 Mar '18

This series takes care of all the trivial stuff, paving the way for someone with good Python knowledge to jump in and finish porting. Changes since [v1]: * the build system no longer needs tweaks; * patches are organized by type of change for easier review. [v1] https://www.redhat.com/archives/libvir-list/2018-March/msg00687.html Andrea Bolognani (8): python3: Use the print() function python3: Use the repr() function python3: Use the 'in' keyword python3: Remove uses of string.*() functions python3: Call list() explicitly as needed python3: Replace keys() + sort() with sorted() python3: Open files in text instead of binary mode python3: Fix sort function docs/apibuild.py | 372 ++++++++++++++++++------------------- src/esx/esx_vi_generator.py | 27 ++- src/hyperv/hyperv_wmi_generator.py | 17 +- 3 files changed, 200 insertions(+), 216 deletions(-) -- 2.14.3

2 18

[libvirt] [PATCH] travis: Don't install xz on macOS
by Andrea Bolognani 16 Mar '18

16 Mar '18

It's already being dragged in by Python. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- .travis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index d1f09f9cad..d071c98634 100644 --- a/.travis.yml +++ b/.travis.yml @@ -18,7 +18,7 @@ matrix: - brew update - brew unlink python - brew upgrade - - brew install rpcgen yajl xz + - brew install rpcgen yajl script: # We can't run make distcheck/syntax-check because they # fail on macOS, but doing 'install' and 'dist' gives us -- 2.14.3

2 1