May 2019 - Devel - libvirt List Archives

[libvirt] [jenkins-ci PATCH] lcitool: use yaml.safe_load instead of load
by Daniel P. Berrangé 03 May '19

03 May '19

The yaml.load() method is historically unsafe as it allowed for arbitrary code execution: ./lcitool:323: YAMLLoadWarning: calling yaml.load() without Loader=... is deprecated, as the default Loader is unsafe. Please read https://msg.pyyaml.org/load for full details. The PyYAML >= 5.1 is now safe by default, but has none the less deprecated the plain load() method to avoid risk for people running their app on older versions. For our needs safe_load() suffices and is compatible with RHEL-7 Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- guests/lcitool | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/guests/lcitool b/guests/lcitool index 1c18b5a..30b6430 100755 --- a/guests/lcitool +++ b/guests/lcitool @@ -257,7 +257,7 @@ class Inventory: @staticmethod def _add_facts_from_file(facts, yaml_path): with open(yaml_path, "r") as infile: - some_facts = yaml.load(infile) + some_facts = yaml.safe_load(infile) for fact in some_facts: facts[fact] = some_facts[fact] @@ -301,7 +301,7 @@ class Projects: try: with open(mappings_path, "r") as infile: - mappings = yaml.load(infile) + mappings = yaml.safe_load(infile) self._mappings = mappings["mappings"] except Exception as ex: raise Exception("Can't load mappings: {}".format(ex)) @@ -320,7 +320,7 @@ class Projects: try: with open(yaml_path, "r") as infile: - packages = yaml.load(infile) + packages = yaml.safe_load(infile) self._packages[project] = packages["packages"] except Exception as ex: raise Exception( -- 2.21.0

2 1

[libvirt] [jenkins-ci PATCH] lcitool: don't use SafeConfigParser under Python3
by Daniel P. Berrangé 03 May '19

03 May '19

Since Python 3.2 the SafeConfigParser class is renamed to just ConfigParser. The SafeConfigParser alias is targetted for deletion. ./lcitool:224: DeprecationWarning: The SafeConfigParser class has been renamed to ConfigParser in Python 3.2. This alias will be removed in future versions. Use ConfigParser directly instead. This switches to use ConfigParser all the time on Py3. Technically this is wrong on 3.0 and 3.1, but in reality no one will still be using those, only more modern 3.x versions, or the legacy 2.7. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- guests/lcitool | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/guests/lcitool b/guests/lcitool index d3937be..1c18b5a 100755 --- a/guests/lcitool +++ b/guests/lcitool @@ -31,9 +31,9 @@ import yaml # This is necessary to maintain Python 2.7 compatibility try: - import configparser + from configparser import ConfigParser except ImportError: - import ConfigParser as configparser + from ConfigParser import SafeConfigParser as ConfigParser class Util: @@ -221,7 +221,7 @@ class Inventory: ansible_cfg_path = os.path.join(base, "ansible.cfg") try: - parser = configparser.SafeConfigParser() + parser = ConfigParser() parser.read(ansible_cfg_path) inventory_path = parser.get("defaults", "inventory") except Exception as ex: -- 2.21.0

2 1

[libvirt] [dockerfiles PATCH 0/3] Refresh, add Fedora 30, drop Fedora 28
by Andrea Bolognani 03 May '19

03 May '19

Pushed under the Dockerfile refresh rule. Andrea Bolognani (3): Refresh after adding ncurses for libvirt Add Fedora 30 Drop Fedora 28 buildenv-centos-7.Dockerfile | 1 + buildenv-debian-9-cross-aarch64.Dockerfile | 1 + buildenv-debian-9-cross-armv6l.Dockerfile | 1 + buildenv-debian-9-cross-armv7l.Dockerfile | 1 + buildenv-debian-9-cross-mips.Dockerfile | 1 + buildenv-debian-9-cross-mips64el.Dockerfile | 1 + buildenv-debian-9-cross-mipsel.Dockerfile | 1 + buildenv-debian-9-cross-ppc64le.Dockerfile | 1 + buildenv-debian-9-cross-s390x.Dockerfile | 1 + buildenv-debian-9.Dockerfile | 1 + buildenv-debian-sid-cross-aarch64.Dockerfile | 1 + buildenv-debian-sid-cross-armv6l.Dockerfile | 1 + buildenv-debian-sid-cross-armv7l.Dockerfile | 1 + buildenv-debian-sid-cross-i686.Dockerfile | 1 + buildenv-debian-sid-cross-mips.Dockerfile | 1 + buildenv-debian-sid-cross-mips64el.Dockerfile | 1 + buildenv-debian-sid-cross-mipsel.Dockerfile | 1 + buildenv-debian-sid-cross-ppc64le.Dockerfile | 1 + buildenv-debian-sid-cross-s390x.Dockerfile | 1 + buildenv-debian-sid.Dockerfile | 1 + buildenv-fedora-29.Dockerfile | 1 + buildenv-fedora-28.Dockerfile => buildenv-fedora-30.Dockerfile | 3 ++- buildenv-fedora-rawhide.Dockerfile | 1 + buildenv-ubuntu-18.Dockerfile | 1 + 24 files changed, 25 insertions(+), 1 deletion(-) rename buildenv-fedora-28.Dockerfile => buildenv-fedora-30.Dockerfile (98%) -- 2.20.1

2 5

[libvirt] [PATCH] RFC: use a slirp helper process
by marcandre.lureau＠redhat.com 03 May '19

03 May '19

From: Marc-André Lureau <marcandre.lureau(a)redhat.com> I am throwing this away for discussions, and early feedback. With the upcoming release of libslirp[1], we have an opportunity to run SLIRP networking in a separate process. This will allow for stricter security policies for both qemu & slirp, as slirp is notoriously not very safe (discussed on ML, various CVEs, and even the code says so explicitly in the comments), yet people rely on it regularly. For network type "user", libvirt could spawn an helper process (an experimental version is [2]). It would setup a socket pair between qemu and the helper and use -net socket. qemu could then be built without libslirp! (imho, qemu should deprecate built-in -net user support, and doesn't need to grow its own sub-process handling) This libvirt patch is a bit rough, I am not sure where things should go. In particular, how to manage the subprocesses properly (security aspects, and lifecycle etc), and how to deal with migration (prevent migrating from non-helper to helper version etc). It seems guestfwd has been non-functional for a while. This is also something that the current experimental helper doesn't support atm. Doing all the various "channel" types that libvirt/qemu support would be tedious, and probably unnecessary. But the underlying libslirp library support redirections the same way qemu does today, so it could be added if necessary. At this point, the slirp-helper doesn't handle migration. But is it really worth it? From a guest POV, it would look like packet lost or disconnection. Adding migration handling is possible, to avoid a disconnection event. How should it be done? via a libvirt provided socket for storage? via its own file transferred by libvirt? via qemu somehow (qemu wouldn't really know about the external process but would copy around the migration bits?). Does the helper need to have a "standard" & capabilities, similar to what is proposed for vhost-user [3]? This would allow for easier competing implementation to emerge (I have plans in mind, not using libslirp). Thanks for the feedback! [1] https://gitlab.freedesktop.org/slirp/libslirp [2] https://github.com/elmarco/libslirp-rs [3] https://git.qemu.org/?p=qemu.git;a=blob;f=docs/interop/vhost-user.json Signed-off-by: Marc-André Lureau <marcandre.lureau(a)redhat.com> --- m4/virt-driver-qemu.m4 | 5 ++ src/qemu/libvirtd_qemu.aug | 1 + src/qemu/qemu.conf | 3 ++ src/qemu/qemu_capabilities.c | 6 +++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 38 +++++++++++--- src/qemu/qemu_command.h | 3 +- src/qemu/qemu_conf.c | 7 ++- src/qemu/qemu_conf.h | 1 + src/qemu/qemu_domain.c | 11 ++++ src/qemu/qemu_domain.h | 3 ++ src/qemu/qemu_hotplug.c | 5 +- src/qemu/qemu_interface.c | 80 ++++++++++++++++++++++++++++++ src/qemu/qemu_interface.h | 6 +++ src/qemu/test_libvirtd_qemu.aug.in | 1 + 15 files changed, 161 insertions(+), 10 deletions(-) diff --git a/m4/virt-driver-qemu.m4 b/m4/virt-driver-qemu.m4 index a1d05bbd7f..705b1f592b 100644 --- a/m4/virt-driver-qemu.m4 +++ b/m4/virt-driver-qemu.m4 @@ -105,6 +105,11 @@ AC_DEFUN([LIBVIRT_DRIVER_CHECK_QEMU], [ [/usr/bin:/usr/libexec]) AC_DEFINE_UNQUOTED([QEMU_PR_HELPER], ["$QEMU_PR_HELPER"], [QEMU PR helper]) + AC_PATH_PROG([SLIRP_HELPER], [slirp-helper], + [/usr/bin/slirp-helper], + [/usr/bin:/usr/libexec]) + AC_DEFINE_UNQUOTED([SLIRP_HELPER], ["$SLIRP_HELPER"], + [slirp helper]) ]) AC_DEFUN([LIBVIRT_DRIVER_RESULT_QEMU], [ diff --git a/src/qemu/libvirtd_qemu.aug b/src/qemu/libvirtd_qemu.aug index b311f02da6..15206454e0 100644 --- a/src/qemu/libvirtd_qemu.aug +++ b/src/qemu/libvirtd_qemu.aug @@ -88,6 +88,7 @@ module Libvirtd_qemu = | bool_entry "clear_emulator_capabilities" | str_entry "bridge_helper" | str_entry "pr_helper" + | str_entry "slirp_helper" | bool_entry "set_process_name" | int_entry "max_processes" | int_entry "max_files" diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index 334b4cd4ee..725ae791c5 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -810,6 +810,9 @@ # used whenever <reservations/> are enabled for SCSI LUN devices. #pr_helper = "/usr/bin/qemu-pr-helper" +# Path to the SLIRP networking helper. +#slirp_helper = "/usr/bin/slirp-helper" + # User for the swtpm TPM Emulator # # Default is 'tss'; this is the same user that tcsd (TrouSerS) installs diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index f8ea66b577..86cef7b9ab 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -524,6 +524,7 @@ VIR_ENUM_IMPL(virQEMUCaps, "scsi-disk.device_id", "virtio-pci-non-transitional", "overcommit", + "net-socket-dgram", ); @@ -4212,6 +4213,11 @@ virQEMUCapsInitQMPVersionCaps(virQEMUCapsPtr qemuCaps) ARCH_IS_PPC64(qemuCaps->arch)) { virQEMUCapsSet(qemuCaps, QEMU_CAPS_MACHINE_PSERIES_MAX_CPU_COMPAT); } + + /* -net socket,fd= with dgram socket (for ex, with slirp helper) */ + if (qemuCaps->version >= 3001092) { + virQEMUCapsSet(qemuCaps, QEMU_CAPS_NET_SOCKET_DGRAM); + } } diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 23ecef8c63..9db4c1bf2d 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -506,6 +506,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */ QEMU_CAPS_SCSI_DISK_DEVICE_ID, /* 'device_id' property of scsi disk */ QEMU_CAPS_VIRTIO_PCI_TRANSITIONAL, /* virtio *-pci-{non-}transitional devices */ QEMU_CAPS_OVERCOMMIT, /* -overcommit */ + QEMU_CAPS_NET_SOCKET_DGRAM, QEMU_CAPS_LAST /* this must always be the last item */ } virQEMUCapsFlags; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 9df7b7e8ea..6a047fa8f9 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -4066,7 +4066,8 @@ qemuBuildHostNetStr(virDomainNetDefPtr net, char **tapfd, size_t tapfdSize, char **vhostfd, - size_t vhostfdSize) + size_t vhostfdSize, + char *slirpfd) { bool is_tap = false; virBuffer buf = VIR_BUFFER_INITIALIZER; @@ -4137,6 +4138,12 @@ qemuBuildHostNetStr(virDomainNetDefPtr net, break; case VIR_DOMAIN_NET_TYPE_USER: + if (slirpfd) { + virBufferAsprintf(&buf, "socket,fd=%s,", + slirpfd); + break; + } + virBufferAddLit(&buf, "user,"); for (i = 0; i < net->guestIP.nips; i++) { const virNetDevIPAddr *ip = net->guestIP.ips[i]; @@ -8721,10 +8728,10 @@ qemuInterfaceVhostuserConnect(virQEMUDriverPtr driver, static int qemuBuildInterfaceCommandLine(virQEMUDriverPtr driver, + virDomainObjPtr vm, virLogManagerPtr logManager, virSecurityManagerPtr secManager, virCommandPtr cmd, - virDomainDefPtr def, virDomainNetDefPtr net, virQEMUCapsPtr qemuCaps, unsigned int bootindex, @@ -8733,6 +8740,7 @@ qemuBuildInterfaceCommandLine(virQEMUDriverPtr driver, size_t *nnicindexes, int **nicindexes) { + virDomainDefPtr def = vm->def; int ret = -1; char *nic = NULL; char *host = NULL; @@ -8743,12 +8751,13 @@ qemuBuildInterfaceCommandLine(virQEMUDriverPtr driver, size_t vhostfdSize = 0; char **tapfdName = NULL; char **vhostfdName = NULL; + int slirpfd = -1; + char *slirpfdName = NULL; virDomainNetType actualType = virDomainNetGetActualType(net); virNetDevBandwidthPtr actualBandwidth; bool requireNicdev = false; size_t i; - if (!bootindex) bootindex = net->info.bootIndex; @@ -8971,6 +8980,18 @@ qemuBuildInterfaceCommandLine(virQEMUDriverPtr driver, goto cleanup; } + if (actualType == VIR_DOMAIN_NET_TYPE_USER && + virQEMUCapsGet(qemuCaps, QEMU_CAPS_NET_SOCKET_DGRAM) && + !standalone) { + if (qemuInterfaceOpenSlirp(driver, vm, net, &slirpfd) < 0) { + goto cleanup; + } + virCommandPassFD(cmd, slirpfd, + VIR_COMMAND_PASS_FD_CLOSE_PARENT); + if (virAsprintf(&slirpfdName, "%d", slirpfd) < 0) + goto cleanup; + } + for (i = 0; i < tapfdSize; i++) { if (qemuSecuritySetTapFDLabel(driver->securityManager, def, tapfd[i]) < 0) @@ -8993,7 +9014,8 @@ qemuBuildInterfaceCommandLine(virQEMUDriverPtr driver, if (!(host = qemuBuildHostNetStr(net, driver, tapfdName, tapfdSize, - vhostfdName, vhostfdSize))) + vhostfdName, vhostfdSize, + slirpfdName))) goto cleanup; virCommandAddArgList(cmd, "-netdev", host, NULL); @@ -9032,6 +9054,7 @@ qemuBuildInterfaceCommandLine(virQEMUDriverPtr driver, virSetError(saved_err); virFreeError(saved_err); } + VIR_FREE(slirpfdName); for (i = 0; vhostfd && i < vhostfdSize && vhostfd[i] >= 0; i++) { if (ret < 0) VIR_FORCE_CLOSE(vhostfd[i]); @@ -9061,10 +9084,10 @@ qemuBuildInterfaceCommandLine(virQEMUDriverPtr driver, */ static int qemuBuildNetCommandLine(virQEMUDriverPtr driver, + virDomainObjPtr vm, virLogManagerPtr logManager, virSecurityManagerPtr secManager, virCommandPtr cmd, - virDomainDefPtr def, virQEMUCapsPtr qemuCaps, virNetDevVPortProfileOp vmop, bool standalone, @@ -9075,6 +9098,7 @@ qemuBuildNetCommandLine(virQEMUDriverPtr driver, size_t i; int last_good_net = -1; virErrorPtr originalError = NULL; + virDomainDefPtr def = vm->def; if (def->nnets) { unsigned int bootNet = 0; @@ -9090,7 +9114,7 @@ qemuBuildNetCommandLine(virQEMUDriverPtr driver, for (i = 0; i < def->nnets; i++) { virDomainNetDefPtr net = def->nets[i]; - if (qemuBuildInterfaceCommandLine(driver, logManager, secManager, cmd, def, net, + if (qemuBuildInterfaceCommandLine(driver, vm, logManager, secManager, cmd, net, qemuCaps, bootNet, vmop, standalone, nnicindexes, nicindexes) < 0) @@ -10818,7 +10842,7 @@ qemuBuildCommandLine(virQEMUDriverPtr driver, if (qemuBuildFSDevCommandLine(cmd, def, qemuCaps) < 0) goto error; - if (qemuBuildNetCommandLine(driver, logManager, secManager, cmd, def, + if (qemuBuildNetCommandLine(driver, vm, logManager, secManager, cmd, qemuCaps, vmop, standalone, nnicindexes, nicindexes, &bootHostdevNet) < 0) goto error; diff --git a/src/qemu/qemu_command.h b/src/qemu/qemu_command.h index 9565a7a377..93696cb8d0 100644 --- a/src/qemu/qemu_command.h +++ b/src/qemu/qemu_command.h @@ -88,7 +88,8 @@ char *qemuBuildHostNetStr(virDomainNetDefPtr net, char **tapfd, size_t tapfdSize, char **vhostfd, - size_t vhostfdSize); + size_t vhostfdSize, + char *slirpfd); /* Current, best practice */ char *qemuBuildNicDevStr(virDomainDefPtr def, diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index daea11dacb..e3cc0921a6 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -297,7 +297,8 @@ virQEMUDriverConfigPtr virQEMUDriverConfigNew(bool privileged) } if (VIR_STRDUP(cfg->bridgeHelperName, QEMU_BRIDGE_HELPER) < 0 || - VIR_STRDUP(cfg->prHelperName, QEMU_PR_HELPER) < 0) + VIR_STRDUP(cfg->prHelperName, QEMU_PR_HELPER) < 0 || + VIR_STRDUP(cfg->slirpHelperName, SLIRP_HELPER) < 0) goto error; cfg->clearEmulatorCapabilities = true; @@ -387,6 +388,7 @@ static void virQEMUDriverConfigDispose(void *obj) VIR_FREE(cfg->hugetlbfs); VIR_FREE(cfg->bridgeHelperName); VIR_FREE(cfg->prHelperName); + VIR_FREE(cfg->slirpHelperName); VIR_FREE(cfg->saveImageFormat); VIR_FREE(cfg->dumpImageFormat); @@ -681,6 +683,9 @@ virQEMUDriverConfigLoadProcessEntry(virQEMUDriverConfigPtr cfg, if (virConfGetValueString(conf, "pr_helper", &cfg->prHelperName) < 0) return -1; + if (virConfGetValueString(conf, "slirp_helper", &cfg->slirpHelperName) < 0) + return -1; + if (virConfGetValueBool(conf, "set_process_name", &cfg->setProcessName) < 0) return -1; if (virConfGetValueUInt(conf, "max_processes", &cfg->maxProcesses) < 0) diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index 983e74a3cf..7ae09f8f8c 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -160,6 +160,7 @@ struct _virQEMUDriverConfig { char *bridgeHelperName; char *prHelperName; + char *slirpHelperName; bool macFilter; diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index f9f5ffc22b..626702c3ed 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -2345,6 +2345,15 @@ qemuDomainObjPrivateXMLFormatPR(virBufferPtr buf, } +static void +qemuDomainObjPrivateXMLFormatSlirp(virBufferPtr buf, + qemuDomainObjPrivatePtr priv) +{ + if (priv->slirpPid) + virBufferAddLit(buf, "<Slirp/>\n"); +} + + static int qemuDomainObjPrivateXMLFormatNBDMigrationSource(virBufferPtr buf, virStorageSourcePtr src, @@ -2555,6 +2564,8 @@ qemuDomainObjPrivateXMLFormat(virBufferPtr buf, qemuDomainObjPrivateXMLFormatPR(buf, priv); + qemuDomainObjPrivateXMLFormatSlirp(buf, priv); + if (virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_BLOCKDEV)) virBufferAsprintf(buf, "<nodename index='%llu'/>\n", priv->nodenameindex); diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h index 06640a9510..f7937bf436 100644 --- a/src/qemu/qemu_domain.h +++ b/src/qemu/qemu_domain.h @@ -365,6 +365,9 @@ struct _qemuDomainObjPrivate { /* true if qemu-pr-helper process is running for the domain */ bool prDaemonRunning; + /* todo: list of running slirp processes */ + pid_t slirpPid; + /* counter for generating node names for qemu disks */ unsigned long long nodenameindex; diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index a4f7d111b1..f6ee9815ab 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1355,6 +1355,7 @@ qemuDomainAttachNetDevice(virQEMUDriverPtr driver, qemuDomainObjPrivatePtr priv = vm->privateData; virDomainDeviceDef dev = { VIR_DOMAIN_DEVICE_NET, { .net = net } }; virErrorPtr originalError = NULL; + char *slirpfdName = NULL; char **tapfdName = NULL; int *tapfd = NULL; size_t tapfdSize = 0; @@ -1592,7 +1593,8 @@ qemuDomainAttachNetDevice(virQEMUDriverPtr driver, if (!(netstr = qemuBuildHostNetStr(net, driver, tapfdName, tapfdSize, - vhostfdName, vhostfdSize))) + vhostfdName, vhostfdSize, + slirpfdName))) goto cleanup; qemuDomainObjEnterMonitor(driver, vm); @@ -1720,6 +1722,7 @@ qemuDomainAttachNetDevice(virQEMUDriverPtr driver, VIR_FREE(vhostfdName); VIR_FREE(charDevAlias); virObjectUnref(conn); + VIR_FREE(slirpfdName); virDomainCCWAddressSetFree(ccwaddrs); return ret; diff --git a/src/qemu/qemu_interface.c b/src/qemu/qemu_interface.c index c8effa68f4..55423d6895 100644 --- a/src/qemu/qemu_interface.c +++ b/src/qemu/qemu_interface.c @@ -603,6 +603,86 @@ qemuInterfaceBridgeConnect(virDomainDefPtr def, } +/** + * qemuInterfaceOpenSlirp: + * @net: network definition + * @slirpfd: slirp connection + * + * Returns: 0 on success + * -1 on failure + */ +int +qemuInterfaceOpenSlirp(virQEMUDriverPtr driver, + virDomainObjPtr vm, + virDomainNetDefPtr net, + int *slirpfd) +{ + int i, pair[2] = { -1, -1 }; + VIR_AUTOPTR(virCommand) cmd = NULL; + VIR_AUTOFREE(char *) cmdstr = NULL; + VIR_AUTOFREE(char *) addr = NULL; + virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(driver); + qemuDomainObjPrivatePtr priv = vm->privateData; + + if (socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) < 0) { + virReportSystemError(errno, "%s", _("failed to create socket")); + goto error; + } + + cmd = virCommandNew(cfg->slirpHelperName); + virCommandAddArgFormat(cmd, "--fd=%d", pair[1]); + virCommandPassFD(cmd, pair[1], + VIR_COMMAND_PASS_FD_CLOSE_PARENT); + + for (i = 0; i < net->guestIP.nips; i++) { + const virNetDevIPAddr *ip = net->guestIP.ips[i]; + const char *opt = ""; + + if (!(addr = virSocketAddrFormat(&ip->address))) + goto error; + + if (VIR_SOCKET_ADDR_IS_FAMILY(&ip->address, AF_INET)) + opt = "--net"; + if (VIR_SOCKET_ADDR_IS_FAMILY(&ip->address, AF_INET6)) + opt = "--prefix-ipv6"; + + virCommandAddArgFormat(cmd, "%s=%s", opt, addr); + VIR_FREE(addr); + + if (ip->prefix) { + if (VIR_SOCKET_ADDR_IS_FAMILY(&ip->address, AF_INET)) { + virSocketAddr netmask; + VIR_AUTOFREE(char *) netmaskStr = NULL; + + if (virSocketAddrPrefixToNetmask(ip->prefix, &netmask, AF_INET) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Failed to translate prefix %d to netmask"), + ip->prefix); + goto error; + } + if (!(netmaskStr = virSocketAddrFormat(&netmask))) + goto error; + virCommandAddArgFormat(cmd, "--mask=%s", netmaskStr); + } + if (VIR_SOCKET_ADDR_IS_FAMILY(&ip->address, AF_INET6)) + virCommandAddArgFormat(cmd, "--prefix-length-ipv6=%u", ip->prefix); + } + } + + virCommandClearCaps(cmd); + if (virCommandRunAsync(cmd, &priv->slirpPid) < 0) { + goto error; + } + + *slirpfd = pair[0]; + return 0; + +error: + VIR_FORCE_CLOSE(pair[0]); + return -1; +} + + /** * qemuInterfaceOpenVhostNet: * @def: domain definition diff --git a/src/qemu/qemu_interface.h b/src/qemu/qemu_interface.h index f3ec540eda..de6195462b 100644 --- a/src/qemu/qemu_interface.h +++ b/src/qemu/qemu_interface.h @@ -55,4 +55,10 @@ int qemuInterfaceOpenVhostNet(virDomainDefPtr def, virDomainNetDefPtr net, int *vhostfd, size_t *vhostfdSize); + +int qemuInterfaceOpenSlirp(virQEMUDriverPtr driver, + virDomainObjPtr vm, + virDomainNetDefPtr net, + int *slirpfd); + #endif /* LIBVIRT_QEMU_INTERFACE_H */ diff --git a/src/qemu/test_libvirtd_qemu.aug.in b/src/qemu/test_libvirtd_qemu.aug.in index fea1d308b7..5796e5d1eb 100644 --- a/src/qemu/test_libvirtd_qemu.aug.in +++ b/src/qemu/test_libvirtd_qemu.aug.in @@ -102,5 +102,6 @@ module Test_libvirtd_qemu = } { "memory_backing_dir" = "/var/lib/libvirt/qemu/ram" } { "pr_helper" = "/usr/bin/qemu-pr-helper" } +{ "slirp_helper" = "/usr/bin/slirp-helper" } { "swtpm_user" = "tss" } { "swtpm_group" = "tss" } -- 2.21.0.313.ge35b8cb8e2

5 4

[libvirt] [PATCH v2 1/1] tests/virhostdevtest: remove virHostdevHostSupportsPassthroughKVM
by Daniel Henrique Barboza 03 May '19

03 May '19

virhostdevtest is using pci mock to emulate all PCI attach/detach operations. This means that that this test does not rely on KVM support of the host anymore and the tests in this file shouldn't be affected by it. Suggested-by: Michal Privoznik <mprivozn(a)redhat.com> Signed-off-by: Daniel Henrique Barboza <danielhb413(a)gmail.com> --- tests/virhostdevtest.c | 61 +++++++++--------------------------------- 1 file changed, 12 insertions(+), 49 deletions(-) diff --git a/tests/virhostdevtest.c b/tests/virhostdevtest.c index 4e067b10d1..20eaca82e0 100644 --- a/tests/virhostdevtest.c +++ b/tests/virhostdevtest.c @@ -126,37 +126,6 @@ myInit(void) return -1; } -# if HAVE_LINUX_KVM_H -# include <linux/kvm.h> -static bool -virHostdevHostSupportsPassthroughKVM(void) -{ - int kvmfd = -1; - bool ret = false; - - if ((kvmfd = open("/dev/kvm", O_RDONLY)) < 0) - goto cleanup; - -# ifdef KVM_CAP_IOMMU - if ((ioctl(kvmfd, KVM_CHECK_EXTENSION, KVM_CAP_IOMMU)) <= 0) - goto cleanup; - - ret = true; -# endif - - cleanup: - VIR_FORCE_CLOSE(kvmfd); - - return ret; -} -# else -static bool -virHostdevHostSupportsPassthroughKVM(void) -{ - return false; -} -# endif - static int testVirHostdevPreparePCIHostdevs_unmanaged(void) { @@ -483,12 +452,10 @@ testVirHostdevRoundtripUnmanaged(const void *opaque ATTRIBUTE_UNUSED) if (testVirHostdevDetachPCINodeDevice() < 0) goto out; - if (virHostdevHostSupportsPassthroughKVM()) { - if (testVirHostdevPreparePCIHostdevs_unmanaged() < 0) - goto out; - if (testVirHostdevReAttachPCIHostdevs_unmanaged() < 0) - goto out; - } + if (testVirHostdevPreparePCIHostdevs_unmanaged() < 0) + goto out; + if (testVirHostdevReAttachPCIHostdevs_unmanaged() < 0) + goto out; if (testVirHostdevReAttachPCINodeDevice() < 0) goto out; @@ -512,12 +479,10 @@ testVirHostdevRoundtripManaged(const void *opaque ATTRIBUTE_UNUSED) { int ret = -1; - if (virHostdevHostSupportsPassthroughKVM()) { - if (testVirHostdevPreparePCIHostdevs_managed(false) < 0) - goto out; - if (testVirHostdevReAttachPCIHostdevs_managed(false) < 0) - goto out; - } + if (testVirHostdevPreparePCIHostdevs_managed(false) < 0) + goto out; + if (testVirHostdevReAttachPCIHostdevs_managed(false) < 0) + goto out; ret = 0; @@ -544,12 +509,10 @@ testVirHostdevRoundtripMixed(const void *opaque ATTRIBUTE_UNUSED) if (testVirHostdevDetachPCINodeDevice() < 0) goto out; - if (virHostdevHostSupportsPassthroughKVM()) { - if (testVirHostdevPreparePCIHostdevs_managed(true) < 0) - goto out; - if (testVirHostdevReAttachPCIHostdevs_managed(true) < 0) - goto out; - } + if (testVirHostdevPreparePCIHostdevs_managed(true) < 0) + goto out; + if (testVirHostdevReAttachPCIHostdevs_managed(true) < 0) + goto out; if (testVirHostdevReAttachPCINodeDevice() < 0) goto out; -- 2.20.1

2 1

[libvirt] [PATCH] qemuConnectOpen: Drop unused @cfg and simplify
by Michal Privoznik 03 May '19

03 May '19

After 65a372d6e0 the @cfg variable is no longer used. This means we can drop it and therefore drop 'cleanup' label with it. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_driver.c | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index c072bed1ce..30945d1545 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -1094,44 +1094,37 @@ static virDrvOpenStatus qemuConnectOpen(virConnectPtr conn, virConfPtr conf ATTRIBUTE_UNUSED, unsigned int flags) { - virQEMUDriverConfigPtr cfg = NULL; - virDrvOpenStatus ret = VIR_DRV_OPEN_ERROR; virCheckFlags(VIR_CONNECT_RO, VIR_DRV_OPEN_ERROR); if (qemu_driver == NULL) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("qemu state driver is not active")); - goto cleanup; + return VIR_DRV_OPEN_ERROR; } - cfg = virQEMUDriverGetConfig(qemu_driver); - if (virQEMUDriverIsPrivileged(qemu_driver)) { if (STRNEQ(conn->uri->path, "/system") && STRNEQ(conn->uri->path, "/session")) { virReportError(VIR_ERR_INTERNAL_ERROR, _("unexpected QEMU URI path '%s', try qemu:///system"), conn->uri->path); - goto cleanup; + return VIR_DRV_OPEN_ERROR; } } else { if (STRNEQ(conn->uri->path, "/session")) { virReportError(VIR_ERR_INTERNAL_ERROR, _("unexpected QEMU URI path '%s', try qemu:///session"), conn->uri->path); - goto cleanup; + return VIR_DRV_OPEN_ERROR; } } if (virConnectOpenEnsureACL(conn) < 0) - goto cleanup; + return VIR_DRV_OPEN_ERROR; conn->privateData = qemu_driver; - ret = VIR_DRV_OPEN_SUCCESS; - cleanup: - virObjectUnref(cfg); - return ret; + return VIR_DRV_OPEN_SUCCESS; } static int qemuConnectClose(virConnectPtr conn) -- 2.21.0

2 1

[libvirt] [PATCH v2 0/8] CPU Model Baseline and Comparison for s390x
by walling＠linux.ibm.com 02 May '19

02 May '19

From: Collin Walling <walling(a)linux.ibm.com> Changelog: v1 - introduce baseline - split patches into small chunks - free'd lingering qemuMonitorCPUModelInfo pointer - when converting from virCPUDef -> virJSON, consider feature policy FORCED for enabled This is the second iteration of the CPU Model Comparison and Baseline patches for s390x. The previous version only showed comparison as a preview, and it can be found here: https://www.redhat.com/archives/libvir-list/2019-April/msg01046.html The first patch pull some code out of the CPU Model Expansion JSON function so that it can be later used for the Comparison and Baseline JSON functions. The rest of the patches follow this sequence: - introduce JSON monitor functions - introduce capability and update test files - hook up monitor functions to virsh command Thanks @Daniel, I added your Tested-by where I felt made most sense. Collin Walling (8): qemu_monitor: helper functions for CPU models qemu_monitor: implement query-cpu-model-baseline qemu_capabilities: introduce QEMU_CAPS_QUERY_CPU_MODEL_BASELINE qemu_driver: hook up query-cpu-model-baseline qemu_monitor: implement query-cpu-model-comparison qemu_capabilities: introduce QEMU_CAPS_QUERY_CPU_MODEL_COMPARISON cpu_conf: xml to cpu definition parse helper qemu_driver: hook up query-cpu-model-comparison src/conf/cpu_conf.c | 30 +++ src/conf/cpu_conf.h | 6 + src/cpu/cpu.c | 14 +- src/libvirt_private.syms | 1 + src/qemu/qemu_capabilities.c | 156 +++++++++++++ src/qemu/qemu_capabilities.h | 20 ++ src/qemu/qemu_driver.c | 38 +++ src/qemu/qemu_monitor.c | 44 ++++ src/qemu/qemu_monitor.h | 18 ++ src/qemu/qemu_monitor_json.c | 285 ++++++++++++++++++++--- src/qemu/qemu_monitor_json.h | 20 ++ tests/qemucapabilitiesdata/caps_2.10.0.s390x.xml | 2 + tests/qemucapabilitiesdata/caps_2.11.0.s390x.xml | 2 + tests/qemucapabilitiesdata/caps_2.12.0.s390x.xml | 2 + tests/qemucapabilitiesdata/caps_2.8.0.s390x.xml | 2 + tests/qemucapabilitiesdata/caps_2.9.0.s390x.xml | 2 + tests/qemucapabilitiesdata/caps_3.0.0.s390x.xml | 2 + 17 files changed, 595 insertions(+), 49 deletions(-) -- 2.7.4

3 18

[libvirt] [jenkins-ci PATCH] lcitool: use slirp networking if running non-root
by Daniel P. Berrangé 02 May '19

02 May '19

The virtual networks are only available to the system libvirt instance. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- guests/lcitool | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/guests/lcitool b/guests/lcitool index 0f60704..9d17f1a 100755 --- a/guests/lcitool +++ b/guests/lcitool @@ -511,9 +511,12 @@ class Application: facts["install_disk_size"], facts["install_storage_pool"], ) - network_arg = "network={},model=virtio".format( - facts["install_network"], - ) + if os.geteuid() == 0: + network_arg = "network={},model=virtio".format( + facts["install_network"], + ) + else: + network_arg = "user,model=virtio" # Different operating systems require different configuration # files for unattended installation to work, but some operating -- 2.21.0

1 1

[libvirt] [jenkins-ci PATCH] lcitool: check for virt-install existing
by Daniel P. Berrangé 02 May '19

02 May '19

This improves: $ ./lcitool install libvirt-fedora-29 ./lcitool: Failed to install 'libvirt-fedora-29': [Errno 2] No such file or directory To $ ./lcitool install libvirt-fedora-29 ./lcitool: Cannot find virt-install in $PATH Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- guests/lcitool | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/guests/lcitool b/guests/lcitool index 0f60704..3be16c8 100755 --- a/guests/lcitool +++ b/guests/lcitool @@ -37,6 +37,23 @@ except ImportError: class Util: + @staticmethod + def which(program): + def is_exe(fpath): + return os.path.isfile(fpath) and os.access(fpath, os.X_OK) + + fpath, fname = os.path.split(program) + if fpath: + if is_exe(program): + return program + else: + for path in os.environ["PATH"].split(os.pathsep): + exe_file = os.path.join(path, program) + if is_exe(exe_file): + return exe_file + + return None + @staticmethod def get_base(): return os.path.dirname(os.path.abspath(__file__)) @@ -534,8 +551,12 @@ class Application: # a kernel argument extra_arg = "console=ttyS0 ks=file:/{}".format(install_config) + vipath = Util.which("virt-install") + if vipath is None: + raise Exception("Cannot find virt-install in $PATH") + cmd = [ - "virt-install", + vipath, "--name", host, "--location", facts["install_url"], "--virt-type", facts["install_virt_type"], -- 2.21.0

2 1

[libvirt] [PATCH v3] qemu.conf: Make nvram list obsolete
by Michal Privoznik 02 May '19

02 May '19

Now that libvirt has firmware auto selection feature the nvram config knob is more or less obsolete. It still makes sense in cases where distro users are using does not provide FW descriptor files, therefore I'm not removing it. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu.conf | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index 334b4cd4ee..5a85789d81 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -740,6 +740,14 @@ # Location of master nvram file # +# This configuration option is obsolete. Libvirt will follow the +# QEMU firmware metadata specification to automatically locate +# firmware images. See docs/interop/firmware.json in the QEMU +# source tree. These metadata files are distributed alongside any +# firmware images intended for use with QEMU. +# +# ------------------------------------------ +# # When a domain is configured to use UEFI instead of standard # BIOS it may use a separate storage for UEFI variables. If # that's the case libvirt creates the variable store per domain -- 2.21.0

2 1