April 2018 - Devel - libvirt List Archives

[libvirt] [PATCH] docs: Update the format of the generate metadata example
by John Ferlan 05 Apr '18

05 Apr '18

Initially, update the UUID field to have the proper format, but then also changed the type, id, and name fields. Signed-off-by: John Ferlan <jferlan(a)redhat.com> --- While beginning to think more about the vmgenid RFC and creating a <genid/> element under the <uuid>, I noted that the existing name and uuid fields were a bit out of date. docs/formatdomain.html.in | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 82e7d7ce66..984563379e 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -31,9 +31,9 @@ <h3><a id="elementsMetadata">General metadata</a></h3> <pre> -<domain type='xen' id='3'> - <name>fv0</name> - <uuid>4dea22b31d52d8f32516782e98ab3fa0</uuid> +<domain type='kvm' id='1'> + <name>MyFirstGuest</name> + <uuid>4dea22b3-1d52-d8f3-2516-782e98ab3fa0</uuid> <title>A short description - title - of the domain</title> <description>Some human readable description</description> <metadata> -- 2.13.6

2 1

[libvirt] [dbus PATCH v2 0/5] Introduce Network Interface
by Katerina Koukiou 04 Apr '18

04 Apr '18

This patchset introduces also some basic methods and properties for Network interface. More functionality will be added in following patchsets. New functions are covered by the test suite. Changes from v1: I forgot to the test_network.py in v1. Katerina Koukiou (5): Introduce Network Interface Implement ListNetworks method for Connect interface Implement virtDBusUtilVirNetworkFromBusPath helper function. Implement Name property for Network interface Implement NetworkLookupByName method for Connect interface data/Makefile.am | 3 +- data/org.libvirt.Connect.xml | 12 +++++ data/org.libvirt.Network.xml | 11 +++++ src/Makefile.am | 3 +- src/connect.c | 75 ++++++++++++++++++++++++++++++ src/connect.h | 1 + src/network.c | 107 +++++++++++++++++++++++++++++++++++++++++++ src/network.h | 9 ++++ src/util.c | 33 +++++++++++++ src/util.h | 15 ++++++ test/Makefile.am | 3 +- test/libvirttest.py | 12 +++++ test/test_connect.py | 11 +++++ test/test_network.py | 19 ++++++++ 14 files changed, 311 insertions(+), 3 deletions(-) create mode 100644 data/org.libvirt.Network.xml create mode 100644 src/network.c create mode 100644 src/network.h create mode 100755 test/test_network.py -- 2.15.0

2 11

[libvirt] [PATCH v3 0/3] Improve handling of multipath devices
by Michal Privoznik 04 Apr '18

04 Apr '18

The saga continues. Turns out, this is bug in both libvirt AND kernel. Firstly, kernel uses different CGroup for checking open() than for ioctl() [1]. However, libvirt needs to allow all targets in the CGroup too. Not only it's logical, kernel devel says it never worked. QEMU was able to open the devmapper device but any subsequent read()/write() would fail because of CGroup perms. Anyway, it's not only RHEL which is affected by this bug. I've upgraded my Gentoo to 4.16 and I'm hitting it even though I was not with 4.15. It all started with upstream kernel commit of 519049afead4f7c3e6446028. This changed call in dm_blk_ioctl() from dm_grab_bdev_for_ioctl() to dm_get_bdev_for_ioctl(). The former merely increases refcount on some internal kernel strcut, the latter calls blkdev_get() which calls __blkdev_get() which actually performs CGroup check. 1: https://bugzilla.redhat.com/show_bug.cgi?id=1557769#c54 Diff to v2: - Changed virDevMapperGetTargets() to do recursive target fetching, and at the same time make it return string list of devices rather than MAJ:MIN pairs. This is because dm_task_set_name() accepts path as string. There's also dm_task_set_major_minor() but: a) handling multiple arrays and merging them (because of recursion) - the code would look ugly, b) we don't need to introduce virDomainAuditCgroupMajorMinor() just to pass MAJ:MIN to it. - Implemented dropping of permissions when unplugging a disk (was missing in previous versions) Michal Privoznik (3): util: Introduce virDevMapperGetTargets qemu_cgroup: Handle device mapper targets properly news: Document device mapper fix docs/news.xml | 10 +++ libvirt.spec.in | 2 + src/libvirt_private.syms | 4 + src/qemu/qemu_cgroup.c | 69 +++++++++++++--- src/util/Makefile.inc.am | 2 + src/util/virdevmapper.c | 200 +++++++++++++++++++++++++++++++++++++++++++++++ src/util/virdevmapper.h | 31 ++++++++ 7 files changed, 309 insertions(+), 9 deletions(-) create mode 100644 src/util/virdevmapper.c create mode 100644 src/util/virdevmapper.h -- 2.16.1

2 7

[libvirt] how to expose missing libxl APIs in xml?
by Olaf Hering 04 Apr '18

04 Apr '18

libvirt lacks support for various API interfaces provided by libxl. There is probably no list to track the items not supported by libvirt. Where should such list be maintained, in libvirt.git? The specific case I have right now is this member of libxl_domain_build_info: tools/libxl/libxl_types.idl:483: ("max_grant_frames", uint32, {'init_val': 'LIBXL_MAX_GRANT_FRAMES_DEFAULT'}), How should this be exposed in the guest xml? Olaf

1 0

[libvirt] [Question] Any plan about supporting MBA (Memory Bandwidth Allocation) in libvirt ?
by Zhanghailiang 04 Apr '18

04 Apr '18

Hi, Intel RDT/MBA has been supported by kernel for a time, we also support CAT in libvirt, which is part of RDT. but I didn't find any discussion or patches about MBA feature in Libvirt, does anyone propose supporting it in libvirt ? Thanks, Hailiang

2 1

[libvirt] [PATCH v2 0/3] Clean/fix test driver usage of FindBy{UUID|ID}
by John Ferlan 04 Apr '18

04 Apr '18

v1: https://www.redhat.com/archives/libvir-list/2018-March/msg00507.html e.g., part of a 20 patch series: https://www.redhat.com/archives/libvir-list/2018-March/msg00489.html Changes since v1: * Add patches 2 and 3 essentially... Doing the same ByIDRef as ByUUIDRef and fixing the ListRemove consumers to do the Lock. NB: The ByIDRef logic was formerly part of patch 20 - this just extracts it a bit to make it more orderly. John Ferlan (3): test: Use virDomainObjListFindByUUIDRef test: Use virDomainObjListFindByIDRef test: Need to relock afer virDomainObjListRemove src/test/test_driver.c | 42 +++++++++++++++++++++++++----------------- 1 file changed, 25 insertions(+), 17 deletions(-) -- 2.13.6

2 7

[libvirt] [dbus PATCH 0/5] Introduce Network Interface
by Katerina Koukiou 04 Apr '18

04 Apr '18

This patchset introduces also some basic methods and properties for Network interface. More functionality will be added in following patchsets. New functions are covered by the test suite. Katerina Koukiou (5): Introduce Network Interface Implement ListNetworks method for Connect interface Implement virtDBusUtilVirNetworkFromBusPath helper function. Implement Name property for Network interface Implement NetworkLookupByName method for Connect interface data/Makefile.am | 3 +- data/org.libvirt.Connect.xml | 12 +++++ data/org.libvirt.Network.xml | 11 +++++ src/Makefile.am | 3 +- src/connect.c | 75 ++++++++++++++++++++++++++++++ src/connect.h | 1 + src/network.c | 107 +++++++++++++++++++++++++++++++++++++++++++ src/network.h | 9 ++++ src/util.c | 33 +++++++++++++ src/util.h | 15 ++++++ test/Makefile.am | 3 +- test/libvirttest.py | 12 +++++ test/test_connect.py | 11 +++++ 13 files changed, 292 insertions(+), 3 deletions(-) create mode 100644 data/org.libvirt.Network.xml create mode 100644 src/network.c create mode 100644 src/network.h -- 2.15.0

1 6

[libvirt] hash: failed on concurrent iterating.
by Zhangzijian 04 Apr '18

04 Apr '18

In function 'virHashForEach/virHashSearch', 'table->iterating' prevent concurrent iterating. But most caller evoke it, after hold a read lock. This will lead the second caller failed to iterate the table. So, the caller should hold a write lock, then iterate the table.

4 6

[libvirt] [PATCH] tests: utils: Fix out-of-bounds access to memory in virTestCompareToFile
by Peter Krempa 04 Apr '18

04 Apr '18

Similarly to 3506f1ecfde, the contents of 'cmpcontent' may be an empty string so the following code would access memory out of the array. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- tests/testutils.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/testutils.c b/tests/testutils.c index 4bd1b63755..7c095caac9 100644 --- a/tests/testutils.c +++ b/tests/testutils.c @@ -797,10 +797,11 @@ virTestCompareToFile(const char *strcontent, if (filecontent) { size_t filecontentLen = strlen(filecontent); + size_t cmpcontentLen = strlen(cmpcontent); if (filecontentLen > 0 && filecontent[filecontentLen - 1] == '\n' && - cmpcontent[strlen(cmpcontent) - 1] != '\n') { + (cmpcontentLen == 0 || cmpcontent[cmpcontentLen - 1] != '\n')) { if (virAsprintf(&fixedcontent, "%s\n", cmpcontent) < 0) goto failure; cmpcontent = fixedcontent; -- 2.16.2

2 1

[libvirt] [libvirt PATCH] qemu: Add support for specifying SPICE TLS ciphers
by Ján Tomko 04 Apr '18

04 Apr '18

From: Christophe Fergeau <cfergeau(a)redhat.com> This commit adds a 'spice_tls_ciphers' parameter in qemu.conf which allows to configure which TLS ciphers SPICE will be using for its TLS connections. https://bugzilla.redhat.com/show_bug.cgi?id=1562032 Signed-off-by: Christophe Fergeau <cfergeau(a)redhat.com> Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- This is mostly useful as a workaround for missing crypto policies, so I'm not sure if it's upstream material. Changes from the patch attached to the BZ: ciphers(2) -> ciphers(1) Added augeas changes and tests escape the string before passing it to QEMU src/qemu/libvirtd_qemu.aug | 1 + src/qemu/qemu.conf | 5 ++++ src/qemu/qemu_command.c | 8 +++++- src/qemu/qemu_conf.c | 3 +++ src/qemu/qemu_conf.h | 1 + src/qemu/test_libvirtd_qemu.aug.in | 1 + .../graphics-spice-sasl-ciphers.args | 29 ++++++++++++++++++++++ .../graphics-spice-sasl-ciphers.xml | 1 + tests/qemuxml2argvtest.c | 5 ++++ 9 files changed, 53 insertions(+), 1 deletion(-) create mode 100644 tests/qemuxml2argvdata/graphics-spice-sasl-ciphers.args create mode 120000 tests/qemuxml2argvdata/graphics-spice-sasl-ciphers.xml diff --git a/src/qemu/libvirtd_qemu.aug b/src/qemu/libvirtd_qemu.aug index c19bf3a43..15222d7e3 100644 --- a/src/qemu/libvirtd_qemu.aug +++ b/src/qemu/libvirtd_qemu.aug @@ -44,6 +44,7 @@ module Libvirtd_qemu = let spice_entry = str_entry "spice_listen" | bool_entry "spice_tls" | str_entry "spice_tls_x509_cert_dir" + | str_entry "spice_tls_ciphers" | bool_entry "spice_auto_unix_socket" | str_entry "spice_password" | bool_entry "spice_sasl" diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index 07eab7eff..1d7b6c555 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -181,6 +181,11 @@ #spice_tls_x509_cert_dir = "/etc/pki/libvirt-spice" +# The ciphers used by spice can be overridden here. This is an OpenSSL cipher +# list as documented in ciphers(1) +#spice_tls_ciphers = "DEFAULT" + + # Enable this option to have SPICE served over an automatically created # unix socket. This prevents unprivileged access from users on the # host machine. diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 682d71441..adf0b2cb9 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -8028,8 +8028,14 @@ qemuBuildGraphicsSPICECommandLine(virQEMUDriverConfigPtr cfg, !cfg->spicePassword) virBufferAddLit(&opt, "disable-ticketing,"); - if (hasSecure) + if (hasSecure) { virBufferAsprintf(&opt, "x509-dir=%s,", cfg->spiceTLSx509certdir); + if (cfg->spiceTLSCiphers) { + virBufferAddLit(&opt, "tls-ciphers="); + virQEMUBuildBufferEscapeComma(&opt, cfg->spiceTLSCiphers); + virBufferAddLit(&opt, ","); + } + } switch (graphics->data.spice.defaultMode) { case VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_SECURE: diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 36cf3a281..92afd252d 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -374,6 +374,7 @@ static void virQEMUDriverConfigDispose(void *obj) VIR_FREE(cfg->vncSASLdir); VIR_FREE(cfg->spiceTLSx509certdir); + VIR_FREE(cfg->spiceTLSCiphers); VIR_FREE(cfg->spiceListen); VIR_FREE(cfg->spicePassword); VIR_FREE(cfg->spiceSASLdir); @@ -550,6 +551,8 @@ int virQEMUDriverConfigLoadFile(virQEMUDriverConfigPtr cfg, goto cleanup; if (virConfGetValueString(conf, "spice_tls_x509_cert_dir", &cfg->spiceTLSx509certdir) < 0) goto cleanup; + if (virConfGetValueString(conf, "spice_tls_ciphers", &cfg->spiceTLSCiphers) < 0) + goto cleanup; if (virConfGetValueBool(conf, "spice_sasl", &cfg->spiceSASL) < 0) goto cleanup; if (virConfGetValueString(conf, "spice_sasl_dir", &cfg->spiceSASLdir) < 0) diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index e1ad5463f..9ab9f4e37 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -128,6 +128,7 @@ struct _virQEMUDriverConfig { bool spiceTLS; char *spiceTLSx509certdir; + char *spiceTLSCiphers; bool spiceSASL; char *spiceSASLdir; char *spiceListen; diff --git a/src/qemu/test_libvirtd_qemu.aug.in b/src/qemu/test_libvirtd_qemu.aug.in index 688e5b9fd..2f62b383e 100644 --- a/src/qemu/test_libvirtd_qemu.aug.in +++ b/src/qemu/test_libvirtd_qemu.aug.in @@ -17,6 +17,7 @@ module Test_libvirtd_qemu = { "spice_listen" = "0.0.0.0" } { "spice_tls" = "1" } { "spice_tls_x509_cert_dir" = "/etc/pki/libvirt-spice" } +{ "spice_tls_ciphers" = "DEFAULT" } { "spice_auto_unix_socket" = "1" } { "spice_password" = "XYZ12345" } { "spice_sasl" = "1" } diff --git a/tests/qemuxml2argvdata/graphics-spice-sasl-ciphers.args b/tests/qemuxml2argvdata/graphics-spice-sasl-ciphers.args new file mode 100644 index 000000000..2f608ad7c --- /dev/null +++ b/tests/qemuxml2argvdata/graphics-spice-sasl-ciphers.args @@ -0,0 +1,29 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/home/test \ +USER=test \ +LOGNAME=test \ +SASL_CONF_PATH=/root/.sasl2 \ +QEMU_AUDIO_DRV=spice \ +/usr/bin/qemu-system-i686 \ +-name QEMUGuest1 \ +-S \ +-M pc \ +-m 214 \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-nodefaults \ +-chardev socket,id=charmonitor,path=/tmp/lib/domain--1-QEMUGuest1/monitor.sock,\ +server,nowait \ +-mon chardev=charmonitor,id=monitor,mode=readline \ +-no-acpi \ +-boot c \ +-usb \ +-drive file=/dev/HostVG/QEMUGuest1,format=raw,if=none,id=drive-ide0-0-0 \ +-device ide-drive,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0 \ +-spice port=5903,tls-port=5904,addr=127.0.0.1,sasl,\ +x509-dir=/etc/pki/libvirt-spice,tls-ciphers=DEFAULT,tls-channel=default \ +-vga qxl \ +-global qxl-vga.ram_size=67108864 \ +-global qxl-vga.vram_size=33554432 \ +-device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3 diff --git a/tests/qemuxml2argvdata/graphics-spice-sasl-ciphers.xml b/tests/qemuxml2argvdata/graphics-spice-sasl-ciphers.xml new file mode 120000 index 000000000..1bfac9efa --- /dev/null +++ b/tests/qemuxml2argvdata/graphics-spice-sasl-ciphers.xml @@ -0,0 +1 @@ +graphics-spice-sasl.xml \ No newline at end of file diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 308d71f72..29f702c5c 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -1126,6 +1126,11 @@ mymain(void) DO_TEST("graphics-spice-sasl", QEMU_CAPS_SPICE, QEMU_CAPS_DEVICE_QXL); + ignore_value(VIR_STRDUP(driver.config->spiceTLSCiphers, "DEFAULT")); + DO_TEST("graphics-spice-sasl-ciphers", + QEMU_CAPS_SPICE, + QEMU_CAPS_DEVICE_QXL); + VIR_FREE(driver.config->spiceTLSCiphers); VIR_FREE(driver.config->spiceSASLdir); driver.config->spiceSASL = 0; DO_TEST("graphics-spice-agentmouse", -- 2.13.6

4 3