November 2014 - Devel - libvirt List Archives

[libvirt] [python PATCH] Check return value of libvirt_uintUnwrap
by Jiri Denemark 06 Nov '14

06 Nov '14

libvirt_virDomainSendKey didn't check whether libvirt_uintUnwrap succeeded or not. https://bugzilla.redhat.com/show_bug.cgi?id=1161039 Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- Providing extra context for easier review... libvirt-override.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libvirt-override.c b/libvirt-override.c index a53b46f..f496c6e 100644 --- a/libvirt-override.c +++ b/libvirt-override.c @@ -7119,47 +7119,48 @@ static PyObject * libvirt_virDomainSendKey(PyObject *self ATTRIBUTE_UNUSED, PyObject *args) { PyObject *py_retval; virDomainPtr domain; PyObject *pyobj_domain; PyObject *pyobj_list; int codeset; int holdtime; unsigned int flags; int ret; size_t i; unsigned int keycodes[VIR_DOMAIN_SEND_KEY_MAX_KEYS]; unsigned int nkeycodes; if (!PyArg_ParseTuple(args, (char *)"OiiOiI:virDomainSendKey", &pyobj_domain, &codeset, &holdtime, &pyobj_list, &nkeycodes, &flags)) { DEBUG("%s failed to parse tuple\n", __FUNCTION__); return VIR_PY_INT_FAIL; } domain = (virDomainPtr) PyvirDomain_Get(pyobj_domain); if (!PyList_Check(pyobj_list)) { return VIR_PY_INT_FAIL; } if (nkeycodes != PyList_Size(pyobj_list) || nkeycodes > VIR_DOMAIN_SEND_KEY_MAX_KEYS) { return VIR_PY_INT_FAIL; } for (i = 0; i < nkeycodes; i++) { - libvirt_uintUnwrap(PyList_GetItem(pyobj_list, i), &(keycodes[i])); + if (libvirt_uintUnwrap(PyList_GetItem(pyobj_list, i), &keycodes[i]) < 0) + return VIR_PY_INT_FAIL; } LIBVIRT_BEGIN_ALLOW_THREADS; ret = virDomainSendKey(domain, codeset, holdtime, keycodes, nkeycodes, flags); LIBVIRT_END_ALLOW_THREADS; DEBUG("virDomainSendKey ret=%d\n", ret); py_retval = libvirt_intWrap(ret); return py_retval; } #if LIBVIR_CHECK_VERSION(1, 0, 3) -- 2.1.3

3 4

[libvirt] [PATCH] Fix build-time pkg-config files in VPATH
by Jiri Denemark 06 Nov '14

06 Nov '14

Since libvirt.h was split into several files, it is impossible to compile anything against a VPATH-built libvirt. In VPATH, only libvirt.h is in build/include/libvirt while all other libvirt-*.h files are in source/include/libvirt. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/libvirt-lxc.pc.in | 3 ++- src/libvirt-qemu.pc.in | 3 ++- src/libvirt.pc.in | 3 ++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/src/libvirt-lxc.pc.in b/src/libvirt-lxc.pc.in index dd04950..b9e1319 100644 --- a/src/libvirt-lxc.pc.in +++ b/src/libvirt-lxc.pc.in @@ -6,6 +6,7 @@ prefix=@abs_top_builddir@ exec_prefix=@abs_top_builddir@ libdir=@abs_top_builddir@/src/.libs includedir=@abs_top_builddir@/include +source_includedir=@abs_top_srcdir@/include datarootdir=@abs_top_srcdir@ libvirt_lxc_api=@datadir@/docs/libvirt-lxc-api.xml @@ -15,4 +16,4 @@ Version: @VERSION@ Description: libvirt LXC library Requires: Libs: -L${libdir} -lvirt-lxc -Cflags: -I${includedir} +Cflags: -I${includedir} -I${source_includedir} diff --git a/src/libvirt-qemu.pc.in b/src/libvirt-qemu.pc.in index 5483da9..173ec5c 100644 --- a/src/libvirt-qemu.pc.in +++ b/src/libvirt-qemu.pc.in @@ -6,6 +6,7 @@ prefix=@abs_top_builddir@ exec_prefix=@abs_top_builddir@ libdir=@abs_top_builddir@/src/.libs includedir=@abs_top_builddir@/include +source_includedir=@abs_top_srcdir@/include datarootdir=@abs_top_srcdir@ libvirt_qemu_api=@datadir@/docs/libvirt-qemu-api.xml @@ -15,4 +16,4 @@ Version: @VERSION@ Description: libvirt QEMU library Requires: Libs: -L${libdir} -lvirt-qemu -Cflags: -I${includedir} +Cflags: -I${includedir} -I${source_includedir} diff --git a/src/libvirt.pc.in b/src/libvirt.pc.in index 548fa77..9fe2f1f 100644 --- a/src/libvirt.pc.in +++ b/src/libvirt.pc.in @@ -6,6 +6,7 @@ prefix=@abs_top_builddir@ exec_prefix=@abs_top_builddir@ libdir=@abs_top_builddir@/src/.libs includedir=@abs_top_builddir@/include +source_includedir=@abs_top_srcdir@/include datarootdir=@abs_top_srcdir@ libvirt_api=@datadir@/docs/libvirt-api.xml @@ -20,4 +21,4 @@ Version: @VERSION@ Description: libvirt library Requires: Libs: -L${libdir} -lvirt -Cflags: -I${includedir} +Cflags: -I${includedir} -I${source_includedir} -- 2.1.3

2 1

[libvirt] [PATCH] virsh: Fix types for option bandwidth in block*
by Hao Liu 06 Nov '14

06 Nov '14

Bandwidth options in blockcommit, blockcopy, blockjob and blockpull are parsed by vshCommandOptULWrap() and should be shown as a number type option. And a typo is fixed. Signed-off-by: Hao Liu <hliu(a)redhat.com> --- tools/virsh-domain.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c index dfc3a8c..bd5f404 100644 --- a/tools/virsh-domain.c +++ b/tools/virsh-domain.c @@ -1616,7 +1616,7 @@ static const vshCmdOptDef opts_block_commit[] = { .help = N_("fully-qualified path of disk") }, {.name = "bandwidth", - .type = VSH_OT_DATA, + .type = VSH_OT_INT, .help = N_("bandwidth limit in MiB/s") }, {.name = "base", @@ -1834,7 +1834,7 @@ static const vshCmdOptDef opts_block_copy[] = { .help = N_("path of the copy to create") }, {.name = "bandwidth", - .type = VSH_OT_DATA, + .type = VSH_OT_INT, .help = N_("bandwidth limit in MiB/s") }, {.name = "shallow", @@ -2190,8 +2190,8 @@ static const vshCmdOptDef opts_block_job[] = { .help = N_("implies --info; output details rather than human summary") }, {.name = "bandwidth", - .type = VSH_OT_DATA, - .help = N_("set the Bandwidth limit in MiB/s") + .type = VSH_OT_INT, + .help = N_("set the bandwidth limit in MiB/s") }, {.name = NULL} }; @@ -2349,7 +2349,7 @@ static const vshCmdOptDef opts_block_pull[] = { .help = N_("fully-qualified path of disk") }, {.name = "bandwidth", - .type = VSH_OT_DATA, + .type = VSH_OT_INT, .help = N_("bandwidth limit in MiB/s") }, {.name = "base", -- 1.8.3.1

2 1

[libvirt] [PATCH v2 0/8] Post-copy live migration support
by Cristian Klein 06 Nov '14

06 Nov '14

Qemu currently implements pre-copy live migration. VM memory pages are first copied from the source hypervisor to the destination, potentially multiple times as pages get dirtied during transfer, then VCPU state is migrated. Unfortunately, if the VM dirties memory faster than the network bandwidth, then pre-copy cannot finish. `virsh` currently includes an option to suspend a VM after a timeout, so that migration may finish, but at the expense of downtime. A future version of qemu will implement post-copy live migration. The VCPU state is first migrated to the destination hypervisor, then memory pages are pulled from the source hypervisor. Post-copy has the potential to do migration with zero-downtime, despite the VM dirtying pages fast, with minimum performance impact. On the other hand, one post-copy is in progress, any network failure would render the VM unusable, as its memory is partitioned between the source and destination hypervisor. Therefore, post-copy should only be used when necessary. Post-copy migration in qemu will work as follows: (1) The `x-postcopy-ram` migration capability needs to be set. (2) Migration is started. (3) When the user decides so, post-copy migration is activated by sending the `migrate-start-postcopy` command. Qemu acknowledges by setting migration status to `postcopy-active`. v2: - Fixed formatting - Set target version to libvirt 1.2.10 - Only use JSON monitor - Renamed `qemuMigrateStartPostCopy` to `qemuDomainMigrateStartPostCopy` - Added parameter `flags` to domainMigrateStartPostCopy (currently unused) - Misc fixes required for `make check` - Stop perform phase, when post-copy starts - Wait for post-copy completion in confirm phase, before killing source VM Implementation note: `qemuMigrationWaitForCompletion` is overloaded. When called the first time it waits for post-copy to start, when called the second time it waits for post-copy to complete. I did so to reduce code duplication, but am not sure this is the best solution. Cristian Klein (8): Added public API to enable post-copy migration Added public API to start post-copy migration Added low-level API to qemu post-copy migration Implemented VIR_MIGRATE_POSTCOPY in qemu driver Added job type VIR_DOMAIN_JOB_PHASE1_COMPLETED Implemented post-copy migration logic in qemu Implement virDomainMigrateStartPostCopy in qemu virsh: add postcopy-after option to migrate command include/libvirt/libvirt.h.in | 5 +++ src/driver.h | 5 +++ src/libvirt.c | 46 ++++++++++++++++++++++++ src/libvirt_public.syms | 5 +++ src/qemu/qemu_driver.c | 58 ++++++++++++++++++++++++++++++ src/qemu/qemu_migration.c | 85 ++++++++++++++++++++++++++++++++++++++++++-- src/qemu/qemu_migration.h | 3 +- src/qemu/qemu_monitor.c | 24 +++++++++++-- src/qemu/qemu_monitor.h | 4 +++ src/qemu/qemu_monitor_json.c | 23 +++++++++++- src/qemu/qemu_monitor_json.h | 1 + src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 13 ++++++- src/remote_protocol-structs | 5 +++ tools/virsh-domain.c | 75 ++++++++++++++++++++++++++++++++++++-- tools/virsh.pod | 5 +++ 16 files changed, 347 insertions(+), 11 deletions(-) -- 1.9.1

6 29

[libvirt] [PATCH] CVE-2014-7823: dumpxml: security hole with migratable flag
by Eric Blake 06 Nov '14

06 Nov '14

Commit 28f8dfd (v1.0.0) introduced a security hole: in at least the qemu implementation of virDomainGetXMLDesc, the use of the flag VIR_DOMAIN_XML_MIGRATABLE (which is usable from a read-only connection) triggers the implicit use of VIR_DOMAIN_XML_SECURE prior to calling qemuDomainFormatXML. However, the use of VIR_DOMAIN_XML_SECURE is supposed to be restricted to read-write clients only. This patch treats the migratable flag as requiring the same permissions, rather than analyzing what might break if migratable xml no longer includes secret information. Fortunately, the information leak is low-risk: all that is gated by the VIR_DOMAIN_XML_SECURE flag is the VNC connection password; but VNC passwords are already weak (FIPS forbids their use, and on a non-FIPS machine, anyone stupid enough to trust a max-8-byte password sent in plaintext over the network deserves what they get). SPICE offers better security than VNC, and all other secrets are properly protected by use of virSecret associations rather than direct output in domain XML. * src/remote/remote_protocol.x (REMOTE_PROC_DOMAIN_GET_XML_DESC): Tighten rules on use of migratable flag. * src/libvirt-domain.c (virDomainGetXMLDesc): Likewise. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- The libvirt-security list agreed that this did not need an embargo because it is low-risk; but I'm on the road this week, so while this patch for master can go in now, I won't complete the backport to all the affected stable branches (everything since v1.0.0) or do the Libvirt Security Notice writeup until Monday. src/libvirt-domain.c | 3 ++- src/remote/remote_protocol.x | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c index 7dc3146..2b0defc 100644 --- a/src/libvirt-domain.c +++ b/src/libvirt-domain.c @@ -2607,7 +2607,8 @@ virDomainGetXMLDesc(virDomainPtr domain, unsigned int flags) virCheckDomainReturn(domain, NULL); conn = domain->conn; - if ((conn->flags & VIR_CONNECT_RO) && (flags & VIR_DOMAIN_XML_SECURE)) { + if ((conn->flags & VIR_CONNECT_RO) && + (flags & (VIR_DOMAIN_XML_SECURE | VIR_DOMAIN_XML_MIGRATABLE))) { virReportError(VIR_ERR_OPERATION_DENIED, "%s", _("virDomainGetXMLDesc with secure flag")); goto error; diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index db12cda..ebf4530 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -3255,6 +3255,7 @@ enum remote_procedure { * @generate: both * @acl: domain:read * @acl: domain:read_secure:VIR_DOMAIN_XML_SECURE + * @acl: domain:read_secure:VIR_DOMAIN_XML_MIGRATABLE */ REMOTE_PROC_DOMAIN_GET_XML_DESC = 14, -- 1.9.3

1 1

[libvirt] [PATCH 0/3] Fix build without NUMA
by Michal Privoznik 06 Nov '14

06 Nov '14

Even though these patches would qualify as build breaker fixes, I don't think they are that critical to be pushed without somebody else's taking a look on them. Michal Privoznik (3): virnuma: Add some more comments private.syms: Export virDomainNumatuneSpecifiedMaxNode qemuxml2argvmock: Mock virNumaNodesetIsAvailable src/libvirt_private.syms | 1 + src/util/virnuma.c | 14 +++++++------- tests/qemuxml2argvmock.c | 9 +++++++++ 3 files changed, 17 insertions(+), 7 deletions(-) -- 2.0.4

3 7

[libvirt] [PATCH 0/3] Libvirt memory & NUMA fixes
by Prerna Saxena 05 Nov '14

05 Nov '14

This patch set addresses a bunch of memory & NUMA fixes. Series Description: =========== Patch 1/3 : Use consistent data type to represent memory elements in various XML attributes. This ensures all memory elements are always represented as 'unsigned long long'. Patch 2/3 : This adds a 'unit' attribute alongwith the 'memory' attribute of a NUMA cell. This enables users to easily describe how much memory needs to be allocated to each NUMA cell for a guest domain. Patch 3/3 : This augments test cases to add the 'unit' tag. Regards, -- Prerna Saxena Linux Technology Centre, IBM Systems and Technology Lab, Bangalore, India

2 7

[libvirt] [PATCHv2 0/2] network: bandwidth tuning in session mode revert patch
by Erik Skultety 05 Nov '14

05 Nov '14

Erik Skultety (2): qemu: revert patch - bandwidth tuning in session mode Iface: disallow network tuning in session mode globally src/qemu/qemu_command.c | 11 ----------- src/qemu/qemu_driver.c | 9 --------- src/util/virnetdevbandwidth.c | 8 ++++++++ tests/Makefile.am | 11 ++++++++++- tests/virnetdevbandwidthtest.c | 14 +++++++++++++- 5 files changed, 31 insertions(+), 22 deletions(-) -- 1.9.3

2 4

[libvirt] [PATCH] UpdateDevice: Allow startupPolicy update
by Michal Privoznik 05 Nov '14

05 Nov '14

Users might want to update startupPolicy via the virDomainUpdateDeviceFlags API too. This patch implements the feature on config layer. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_driver.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 6acaea8..6fc15c0 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -7437,6 +7437,7 @@ qemuDomainUpdateDeviceConfig(virQEMUCapsPtr qemuCaps, if (disk->src->format) orig->src->format = disk->src->format; disk->src->path = NULL; + orig->startupPolicy = disk->startupPolicy; break; case VIR_DOMAIN_DEVICE_NET: -- 2.0.4

2 2

[libvirt] Local qemu migration
by Marc-André Lureau 05 Nov '14

05 Nov '14

Hi, Attempting to migration from session to system qemu fails because of the following checks in qemuMigrationCookieXMLParse(): if (STREQ(mig->remoteHostname, mig->localHostname)) { virReportError(VIR_ERR_INTERNAL_ERROR, _("Attempt to migrate guest to the same host %s"), mig->remoteHostname); goto error; } .... if (memcmp(mig->remoteHostuuid, mig->localHostuuid, VIR_UUID_BUFLEN) == 0) { virReportError(VIR_ERR_INTERNAL_ERROR, _("Attempt to migrate guest to the same host %s"), tmp); goto error; Is there a technical limitation for this error? If not, could it be overriden with an additional flag? cheers -- Marc-André Lureau

4 6