December 2013 - Devel - libvirt List Archives

[libvirt] [PATCH] build: fix building with '--enable-test-locking'
by Martin Kletzander 18 Dec '13

18 Dec '13

When test-locking is enabled, CFLAGS have -Dbool=char, which makes pipefd[bool] fail (obviously). Forcing the subscript to be bool by double negation fixes the build breaker. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- Notes: I still can't build with '--enable-test-locking' and I'm not sure this is the proper way to fix it. Also, the code wasn't touched for months, so I'm not pushing it as a build-breaker. src/util/virfile.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/virfile.c b/src/util/virfile.c index 631cd06..88674ec 100644 --- a/src/util/virfile.c +++ b/src/util/virfile.c @@ -262,7 +262,7 @@ virFileWrapperFdNew(int *fd, const char *name, unsigned int flags) } VIR_FORCE_CLOSE(*fd); - *fd = pipefd[output]; + *fd = pipefd[!!output]; return ret; error: -- 1.8.5.1

3 6

[libvirt] libvirt live modify
by Umar Draz 18 Dec '13

18 Dec '13

Hi Can we modify a Virtual machine while its running, I want to update the <discription> and <title> Br. Umar

4 13

[libvirt] [PATCHv3] qemu: ask for -enable-fips when FIPS is required
by Eric Blake 18 Dec '13

18 Dec '13

On a system that is enforcing FIPS, most libraries honor the current mode by default. Qemu, on the other hand, refused to honor FIPS mode unless you add the '-enable-fips' command line option; worse, this option is not discoverable via QMP, and is only present on binaries built for Linux. So, if we detect FIPS mode, then we unconditionally ask for FIPS; either qemu is new enough to have the option and then correctly cripple insecure VNC passwords, or it is so old that we are correctly avoiding a FIPS violation by preventing qemu from starting. Meanwhile, if we don't detect FIPS mode, then omitting the argument is safe whether the qemu has the option (but it would do nothing because FIPS is disabled) or whether qemu lacks the option (including in the case where we are not running on Linux). The testsuite was a bit interesting: we don't want our test to depend on whether it is being run in FIPS mode, so I had to tweak things to set the capability bit outside of our normal interaction with capability parsing. This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1035474 * src/qemu/qemu_capabilities.h (QEMU_CAPS_ENABLE_FIPS): New bit. * src/qemu/qemu_capabilities.c (virQEMUCapsInitQMP): Conditionally set capability according to detection of FIPS mode. * src/qemu/qemu_command.c (qemuBuildCommandLine): Use it. * tests/qemucapabilitiestest.c (testQemuCaps): Conditionally set capability to test expected output. * tests/qemucapabilitiesdata/caps_1.2.2-1.caps: Update list. * tests/qemucapabilitiesdata/caps_1.6.0-1.caps: Likewise. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- v3: use virFileReadAll correctly src/qemu/qemu_capabilities.c | 27 ++++++++++++++++++++++++++- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 2 ++ tests/qemucapabilitiesdata/caps_1.2.2-1.caps | 1 + tests/qemucapabilitiesdata/caps_1.6.0-1.caps | 1 + tests/qemucapabilitiestest.c | 20 +++++++++++++++----- 6 files changed, 46 insertions(+), 6 deletions(-) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 5e9c65e..4f64f87 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -245,7 +245,8 @@ VIR_ENUM_IMPL(virQEMUCaps, QEMU_CAPS_LAST, "kvm-pit-lost-tick-policy", "boot-strict", /* 160 */ - "pvpanic", /* 161 */ + "pvpanic", + "enable-fips", ); struct _virQEMUCaps { @@ -2630,6 +2631,30 @@ virQEMUCapsInitQMP(virQEMUCapsPtr qemuCaps, config.data.nix.path = monpath; config.data.nix.listen = false; + /* Qemu 1.2 and later have a binary flag -enable-fips that must be + * used for VNC auth to obey FIPS settings; but the flag only + * exists on Linux, and with no way to probe for it via QMP. Our + * solution: if FIPS mode is required, then unconditionally use + * the flag, regardless of qemu version, for the following matrix: + * + * old QEMU new QEMU + * FIPS enabled doesn't start VNC auth disabled + * FIPS disabled/missing VNC auth enabled VNC auth enabled + * + * Setting the flag here instead of in virQEMUCapsInitQMPMonitor + * or virQEMUCapsInitHelp also allows the testsuite to be + * independent of FIPS setting. + */ + if (virFileExists("/proc/sys/crypto/fips_enabled")) { + char *buf = NULL; + + if (virFileReadAll("/proc/sys/crypto/fips_enabled", 10, &buf) < 0) + goto cleanup; + if (STREQ(buf, "1\n")) + virQEMUCapsSet(qemuCaps, QEMU_CAPS_ENABLE_FIPS); + VIR_FREE(buf); + } + VIR_DEBUG("Try to get caps via QMP qemuCaps=%p", qemuCaps); /* diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index bbf4972..efb3f43 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -200,6 +200,7 @@ enum virQEMUCapsFlags { QEMU_CAPS_KVM_PIT_TICK_POLICY = 159, /* kvm-pit.lost_tick_policy */ QEMU_CAPS_BOOT_STRICT = 160, /* -boot strict */ QEMU_CAPS_DEVICE_PANIC = 161, /* -device pvpanic */ + QEMU_CAPS_ENABLE_FIPS = 162, /* -enable-fips */ QEMU_CAPS_LAST, /* this must always be the last item */ }; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index a80559e..d723dc8 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -7747,6 +7747,8 @@ qemuBuildCommandLine(virConnectPtr conn, } } virCommandAddArg(cmd, "-S"); /* freeze CPU */ + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_ENABLE_FIPS)) + virCommandAddArg(cmd, "-enable-fips"); if (qemuBuildMachineArgStr(cmd, def, qemuCaps) < 0) goto error; diff --git a/tests/qemucapabilitiesdata/caps_1.2.2-1.caps b/tests/qemucapabilitiesdata/caps_1.2.2-1.caps index 73a561d..c3ae814 100644 --- a/tests/qemucapabilitiesdata/caps_1.2.2-1.caps +++ b/tests/qemucapabilitiesdata/caps_1.2.2-1.caps @@ -112,4 +112,5 @@ <flag name='usb-storage'/> <flag name='usb-storage.removable'/> <flag name='kvm-pit-lost-tick-policy'/> + <flag name='enable-fips'/> </qemuCaps> diff --git a/tests/qemucapabilitiesdata/caps_1.6.0-1.caps b/tests/qemucapabilitiesdata/caps_1.6.0-1.caps index c7ce591..2d50cf9 100644 --- a/tests/qemucapabilitiesdata/caps_1.6.0-1.caps +++ b/tests/qemucapabilitiesdata/caps_1.6.0-1.caps @@ -138,4 +138,5 @@ <flag name='boot-strict'/> <flag name='pvpanic'/> <flag name='reboot-timeout'/> + <flag name='enable-fips'/> </qemuCaps> diff --git a/tests/qemucapabilitiestest.c b/tests/qemucapabilitiestest.c index d912171..3b34f78 100644 --- a/tests/qemucapabilitiestest.c +++ b/tests/qemucapabilitiestest.c @@ -31,6 +31,7 @@ typedef testQemuData *testQemuDataPtr; struct _testQemuData { virDomainXMLOptionPtr xmlopt; const char *base; + bool fips; }; static qemuMonitorTestPtr @@ -192,6 +193,12 @@ testQemuCaps(const void *opaque) qemuMonitorTestGetMonitor(mon)) < 0) goto cleanup; + /* So that our test does not depend on the contents of /proc, we + * hoisted the setting of ENABLE_FIPS to virQEMUCapsInitQMP. But + * we do want to test the effect of that flag. */ + if (data->fips) + virQEMUCapsSet(capsComputed, QEMU_CAPS_ENABLE_FIPS); + if (testQemuCapsCompare(capsProvided, capsComputed) < 0) goto cleanup; @@ -227,16 +234,19 @@ mymain(void) data.xmlopt = xmlopt; -#define DO_TEST(name) \ - data.base = name; \ - if (virtTestRun(name, testQemuCaps, &data) < 0) \ +#define DO_TEST_FULL(name, use_fips) \ + data.base = name; \ + data.fips = use_fips; \ + if (virtTestRun(name, testQemuCaps, &data) < 0) \ ret = -1 - DO_TEST("caps_1.2.2-1"); +#define DO_TEST(name) DO_TEST_FULL(name, false) + + DO_TEST_FULL("caps_1.2.2-1", true); DO_TEST("caps_1.3.1-1"); DO_TEST("caps_1.4.2-1"); DO_TEST("caps_1.5.3-1"); - DO_TEST("caps_1.6.0-1"); + DO_TEST_FULL("caps_1.6.0-1", true); DO_TEST("caps_1.6.50-1"); virObjectUnref(xmlopt); -- 1.8.4.2

2 2

[libvirt] [PATCH] Fix race leading to crash when setting up dbus watches
by Daniel P. Berrange 18 Dec '13

18 Dec '13

Currently the virDBusAddWatch does virEventAddHandle(fd, flags, virDBusWatchCallback, watch, NULL); dbus_watch_set_data(watch, info, virDBusWatchFree); Unfortunately this is racy - since the event loop is in a different thread, the virDBusWatchCallback method may be run before we get to calling dbus_watch_set_data. We must reverse the order of these calls See https://bugzilla.redhat.com/show_bug.cgi?id=885445 Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/util/virdbus.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util/virdbus.c b/src/util/virdbus.c index 4e4c267..a0cbbfe 100644 --- a/src/util/virdbus.c +++ b/src/util/virdbus.c @@ -238,15 +238,15 @@ static dbus_bool_t virDBusAddWatch(DBusWatch *watch, # else fd = dbus_watch_get_fd(watch); # endif + dbus_watch_set_data(watch, info, virDBusWatchFree); info->bus = (DBusConnection *)data; info->watch = virEventAddHandle(fd, flags, virDBusWatchCallback, watch, NULL); if (info->watch < 0) { - VIR_FREE(info); + dbus_watch_set_data(watch, NULL, NULL); return 0; } - dbus_watch_set_data(watch, info, virDBusWatchFree); return 1; } -- 1.8.4.2

2 1

[libvirt] [PATCH] configure: make --with-test-suite work
by Martin Kletzander 18 Dec '13

18 Dec '13

Our option '--with-test-suite' could have never worked since it was defined as AC_ARG_ENABLE([with-test-suite], ...), thus working only as '--enable-with-test-suite', but documented in configure.ac as AC_HELP_STRING([--with-test-suite], ...). In my optinion, the help string is as it should be, but the option is wrong. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- configure.ac | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/configure.ac b/configure.ac index 5446634..2ebb941 100644 --- a/configure.ac +++ b/configure.ac @@ -2035,14 +2035,14 @@ dnl Allow perl/python overrides AC_PATH_PROGS([PYTHON], [python2 python]) AC_PATH_PROG([PERL], [perl]) -AC_ARG_ENABLE([with-test-suite], - [AS_HELP_STRING([--with-test-suite], - [build test suite by default @<:@default=check@:>@])], - [case "${withval}" in - yes|no|check) ;; - *) AC_MSG_ERROR([bad value ${withval} for tests option]) ;; - esac], - [withval=check]) +AC_ARG_WITH([test-suite], + [AS_HELP_STRING([--with-test-suite], + [build test suite by default @<:@default=check@:>@])], + [case "${withval}" in + yes|no|check) ;; + *) AC_MSG_ERROR([bad value ${withval} for tests option]) ;; + esac], + [withval=check]) AC_MSG_CHECKING([Whether to build test suite by default]) if test "$withval" = "check" ; then -- 1.8.5.1

2 2

[libvirt] [PATCH] lxc: simplify command when connecting lxc multi console
by Chen Hanxiao 18 Dec '13

18 Dec '13

From: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> If we config more than one consoles for container, we always named them as "consoleN". We had to type a complex option "--devname consoleN". This patch enables option "--devname N" to be equal to "--devname consoleN". Signed-off-by: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> --- src/lxc/lxc_driver.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index 61a90ca..13213a5 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -2439,6 +2439,7 @@ lxcDomainOpenConsole(virDomainPtr dom, int ret = -1; virDomainChrDefPtr chr = NULL; size_t i; + char *tmp_name = NULL; virCheckFlags(0, -1); @@ -2455,9 +2456,17 @@ lxcDomainOpenConsole(virDomainPtr dom, } if (dev_name) { + if (STRPREFIX(dev_name, "console")) { + if (VIR_STRDUP(tmp_name, dev_name) < 0) + goto cleanup; + } else { + if (virAsprintf(&tmp_name, "console%s", dev_name) < 0) + goto cleanup; + } + for (i = 0; i < vm->def->nconsoles; i++) { if (vm->def->consoles[i]->info.alias && - STREQ(vm->def->consoles[i]->info.alias, dev_name)) { + STREQ(vm->def->consoles[i]->info.alias, tmp_name)) { chr = vm->def->consoles[i]; break; } @@ -2490,6 +2499,7 @@ lxcDomainOpenConsole(virDomainPtr dom, cleanup: if (vm) virObjectUnlock(vm); + VIR_FREE(tmp_name); return ret; } -- 1.8.2.1

3 4

[libvirt] [PATCH] libxl: libxl_get_max_cpus returning a libxl error from 4.4 onward
by Dario Faggioli 18 Dec '13

18 Dec '13

Starting from commit 2e82c18c in Xen (will be included in Xen 4.4) libxl_get_max_cpus() start returning a proper libxl error code, in case of failure. It returning 0 is now basically impossible but, theoretically, still wrong, not to mention that using '<= 0' makes this correct for both Xen 4.4 and Xen 4.3 (and 4.2). That's why we go for it (rather than just '< 0'). Signed-off-by: Dario Faggioli <dario.faggioli(a)citrix.com> Cc: Jim Fehlig <jfehlig(a)suse.com> Cc: Ian Jackson <Ian.Jackson(a)eu.citrix.com> --- src/libxl/libxl_driver.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index 692c3b7..a31b094 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -1101,9 +1101,11 @@ libxlConnectGetMaxVcpus(virConnectPtr conn, const char *type ATTRIBUTE_UNUSED) cfg = libxlDriverConfigGet(driver); ret = libxl_get_max_cpus(cfg->ctx); - /* libxl_get_max_cpus() will return 0 if there were any failures, - e.g. xc_physinfo() failing */ - if (ret == 0) + /* On failure, libxl_get_max_cpus() will return ERROR_FAIL from Xen 4.4 + * onward, but it ever returning 0 is obviously wrong too (and it is + * what happens, on failure, on Xen 4.3 and earlier). Therefore, a 'less + * or equal' is the catchall we want. */ + if (ret <= 0) ret = -1; virObjectUnref(cfg);

2 2

[libvirt] [PATCH] qemu: fix typo PCi => PCI
by Martin Kletzander 18 Dec '13

18 Dec '13

Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- src/qemu/qemu_process.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index bd9546e..d0fde54 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -3829,7 +3829,7 @@ int qemuProcessStart(virConnectPtr conn, * Normally PCI addresses are assigned in the virDomainCreate * or virDomainDefine methods. We might still need to assign * some here to cope with the question of upgrades. Regardless - * we also need to populate the PCi address set cache for later + * we also need to populate the PCI address set cache for later * use in hotplug */ if (virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_DEVICE)) { @@ -4560,7 +4560,7 @@ int qemuProcessAttach(virConnectPtr conn ATTRIBUTE_UNUSED, * Normally PCI addresses are assigned in the virDomainCreate * or virDomainDefine methods. We might still need to assign * some here to cope with the question of upgrades. Regardless - * we also need to populate the PCi address set cache for later + * we also need to populate the PCI address set cache for later * use in hotplug */ if (virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_DEVICE)) { -- 1.8.5.1

4 4

[libvirt] [PATCH] qemu: add support for error messages greater than 1024 characters
by Michele Paolino 18 Dec '13

18 Dec '13

In libvirt, the default error message length is 1024 bytes. This is not enough for qemu to print long error messages such as the list of supported ARM machine models (more than 1700 chars). This is raised when the machine entry in the XML file is wrong, but there may be now or in future other verbose error messages. The above patch enables libvirt to print error messages >1024 for qemu. Signed-off-by: Michele Paolino <m.paolino(a)virtualopensystems.com> --- src/qemu/qemu_process.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index bd9546e..c2e2136 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -1904,10 +1904,25 @@ cleanup: * a possible read of the fd in the monitor code doesn't influence this * error delivery option */ ignore_value(lseek(logfd, pos, SEEK_SET)); - qemuProcessReadLog(logfd, buf + len, buf_size - len - 1, 0, true); - virReportError(VIR_ERR_INTERNAL_ERROR, - _("process exited while connecting to monitor: %s"), - buf); + len = qemuProcessReadLog(logfd, buf + len, buf_size - len - 1, 0, true); + + /* virReportError error buffer is limited to 1024 byte*/ + if (len < 1024){ + virReportError(VIR_ERR_INTERNAL_ERROR, + _("process exited while connecting to monitor: %s"), + buf); + } else { + if (STRPREFIX(buf, "Supported machines are:")) + virReportError(VIR_ERR_INTERNAL_ERROR, + _("process exited while connecting to monitor:" + "please check machine model")); + else + virReportError(VIR_ERR_INTERNAL_ERROR, + _("process exited while connecting to monitor")); + + VIR_ERROR("%s", buf); + } + ret = -1; } -- 1.7.9.5

5 9

[libvirt] [PATCH] tests: be more explicit on qcow2 versions in virstoragetest
by Eric Blake 17 Dec '13

17 Dec '13

While working on v1.0.5-maint (the branch in use on Fedora 19) with the host at Fedora 20, I got a failure in virstoragetest. I traced it to the fact that we were using qemu-img to create a qcow2 file, but qemu-img changed from creating v2 files by default in F19 to creating v3 files in F20. Rather than leaving it up to qemu-img, it is better to write the test to force testing of BOTH file formats (better code coverage and all). This patch alone does not fix all the failures in v1.0.5-maint; for that, we must decide to either teach the older branch to understand v3 files, or to reject them outright as unsupported. But for upstream, making the test less dependent on changing qemu-img defaults is always a good thing. * tests/virstoragetest.c (testPrepImages): Simplify creation of raw file; check if qemu supports compat and if so use it. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- tests/virstoragetest.c | 32 +++++++++++++++++++++++--------- 1 file changed, 23 insertions(+), 9 deletions(-) diff --git a/tests/virstoragetest.c b/tests/virstoragetest.c index e5c73f5..db0cf1c 100644 --- a/tests/virstoragetest.c +++ b/tests/virstoragetest.c @@ -87,6 +87,8 @@ testPrepImages(void) { int ret = EXIT_FAILURE; virCommandPtr cmd = NULL; + char *buf = NULL; + bool compat = false; qemuimg = virFindFileInPath("kvm-img"); if (!qemuimg) @@ -94,6 +96,18 @@ testPrepImages(void) if (!qemuimg) goto skip; + /* See if qemu-img supports '-o compat=xxx'. If so, we force the + * use of both v2 and v3 files; if not, it is v2 only but the test + * still works. */ + cmd = virCommandNewArgList(qemuimg, "create", "-f", "qcow2", + "-o?", "/dev/null", NULL); + virCommandSetOutputBuffer(cmd, &buf); + if (virCommandRun(cmd, NULL) < 0) + goto skip; + if (strstr(buf, "compat ")) + compat = true; + VIR_FREE(buf); + if (virAsprintf(&absraw, "%s/raw", datadir) < 0 || virAsprintf(&absqcow2, "%s/qcow2", datadir) < 0 || virAsprintf(&abswrap, "%s/wrap", datadir) < 0 || @@ -111,10 +125,8 @@ testPrepImages(void) goto cleanup; } - /* I'm lazy enough to use a shell one-liner instead of open/write/close */ - virCommandFree(cmd); - cmd = virCommandNewArgList("sh", "-c", "printf %1024d 0 > raw", NULL); - if (virCommandRun(cmd, NULL) < 0) { + if (virAsprintf(&buf, "%1024d", 0) < 0 || + virFileWriteStr("raw", buf, 0600) < 0) { fprintf(stderr, "unable to create raw file\n"); goto cleanup; } @@ -126,9 +138,10 @@ testPrepImages(void) /* Create a qcow2 wrapping relative raw; later on, we modify its * metadata to test other configurations */ virCommandFree(cmd); - cmd = virCommandNewArgList(qemuimg, "create", "-f", "qcow2", - "-obacking_file=raw,backing_fmt=raw", "qcow2", - NULL); + cmd = virCommandNewArgList(qemuimg, "create", "-f", "qcow2", NULL); + virCommandAddArgFormat(cmd, "-obacking_file=raw,backing_fmt=raw%s", + compat ? ",compat=0.10" : ""); + virCommandAddArg(cmd, "qcow2"); if (virCommandRun(cmd, NULL) < 0) goto skip; /* Make sure our later uses of 'qemu-img rebase' will work */ @@ -146,8 +159,8 @@ testPrepImages(void) * can correctly avoid insecure probing. */ virCommandFree(cmd); cmd = virCommandNewArgList(qemuimg, "create", "-f", "qcow2", NULL); - virCommandAddArgFormat(cmd, "-obacking_file=%s,backing_fmt=qcow2", - absqcow2); + virCommandAddArgFormat(cmd, "-obacking_file=%s,backing_fmt=qcow2%s", + absqcow2, compat ? ",compat=1.1" : ""); virCommandAddArg(cmd, "wrap"); if (virCommandRun(cmd, NULL) < 0) goto skip; @@ -172,6 +185,7 @@ testPrepImages(void) ret = 0; cleanup: + VIR_FREE(buf); virCommandFree(cmd); if (ret) testCleanupImages(); -- 1.8.4.2

1 0