- Devel - libvirt List Archives

[libvirt] [PATCH 00/11] qemu: format CCID controllers after USB hubs
by Ján Tomko 24 Jan '19

24 Jan '19

https://bugzilla.redhat.com/show_bug.cgi?id=1599971 Ján Tomko (11): qemu: move out legacy USB controller formatting qemu: exit early if USB_CONTROLLER_MODEL_NONE is present Add qemuBuildDomainForbidLegacyUSBController qemu: separate counting of legacy USB controllers qemu: separate counting of USB controllers qemuBuildControllerDevStr: remove nusbcontroller argument qemu: Introduce qemuBuildControllersByTypeCommandLine qemu: format CCID controllers after USB hubs qemuBuildControllersByTypeCommandLine: free devstr in the cleanup section rename qemuBuildControllerDevCommandLine qemuBuildControllersCommandLine: use i instead of j as the counter src/qemu/qemu_command.c | 222 +++++++++++------- src/qemu/qemu_command.h | 3 +- src/qemu/qemu_hotplug.c | 2 +- tests/qemuxml2argvdata/chardev-reconnect.args | 2 +- tests/qemuxml2argvdata/controller-order.args | 2 +- tests/qemuxml2argvdata/name-escape.args | 2 +- .../smartcard-controller.args | 2 +- .../smartcard-host-certificates-database.args | 2 +- .../smartcard-host-certificates.args | 2 +- tests/qemuxml2argvdata/smartcard-host.args | 2 +- .../smartcard-passthrough-spicevmc.args | 2 +- .../smartcard-passthrough-tcp.args | 2 +- tests/qemuxml2argvdata/user-aliases.args | 2 +- 13 files changed, 150 insertions(+), 97 deletions(-) -- 2.20.1

2 13

[libvirt] [python PATCH 0/3] travis: misc fixes to build
by Daniel P. Berrangé 24 Jan '19

24 Jan '19

Fix the travis build which has been broken for a while Daniel P. Berrangé (3): travis: remove python 2.6 and 3.6 from build matrix travis: switch from trusty to xenial dist travis: add testing of 5.0.0 release .travis.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.20.1

2 4

[libvirt] [PATCH v2 00/17] implement cgroups v2 devices support
by Pavel Hrdina 24 Jan '19

24 Jan '19

In cgroups v2 there is no devices controller, BPF should be used instead. Changes in v2: - fixed build on bsd and older kernels without cgroup BPF - cgroup bpf devices code moved to separate file Documentation for eBPF: <http://man7.org/linux/man-pages/man2/bpf.2.html> <https://www.kernel.org/doc/Documentation/networking/filter.txt> <https://docs.cilium.io/en/v1.3/bpf/> Pavel Hrdina (17): util: introduce virbpf helpers vircgroup: introduce virCgroupV2DevicesAvailable vircgroup: introduce virCgroupV2DevicesAttachProg vircgroup: introduce virCgroupV2DevicesDetectProg vircgroup: introduce virCgroupV2DevicesCreateProg vircgroup: introduce virCgroupV2DevicesPrepareProg vircgroup: introduce virCgroupV2DevicesRemoveProg vircgroup: introduce virCgroupV2DeviceGetPerms vircgroup: introduce virCgroupV2DevicesGetKey vircgroup: introduce virCgroupV2AllowDevice vircgroup: introduce virCgroupV2DenyDevice vircgroup: introduce virCgroupV2AllowAllDevices vircgroup: introduce virCgroupV2DenyAllDevices vircgroup: workaround devices in hybrid mode vircgroupv2: detech BPF program before removing cgroup vircgroupv2: use dummy process to workaround kernel bug with systemd vircgroupmock: mock virCgroupV2DevicesAvailable configure.ac | 6 + include/libvirt/virterror.h | 1 + src/Makefile.am | 2 + src/libvirt_private.syms | 27 ++ src/lxc/lxc_cgroup.c | 1 + src/qemu/qemu_cgroup.c | 6 +- src/util/Makefile.inc.am | 4 + src/util/virbpf.c | 437 +++++++++++++++++++++ src/util/virbpf.h | 271 +++++++++++++ src/util/vircgroup.c | 19 +- src/util/vircgroup.h | 1 + src/util/vircgroupbackend.h | 3 +- src/util/vircgrouppriv.h | 12 + src/util/vircgroupv1.c | 9 +- src/util/vircgroupv2.c | 119 +++++- src/util/vircgroupv2devices.c | 625 ++++++++++++++++++++++++++++++ src/util/vircgroupv2devices.h | 57 +++ src/util/virerror.c | 1 + src/util/virsystemd.c | 2 +- src/util/virsystemd.h | 2 + tests/vircgroupdata/hybrid.parsed | 2 +- tests/vircgroupmock.c | 7 + tests/vircgrouptest.c | 4 +- 23 files changed, 1608 insertions(+), 10 deletions(-) create mode 100644 src/util/virbpf.c create mode 100644 src/util/virbpf.h create mode 100644 src/util/vircgroupv2devices.c create mode 100644 src/util/vircgroupv2devices.h -- 2.20.1

3 25

[libvirt] [PATCH 0/3] Improve block job handling docs
by Peter Krempa 24 Jan '19

24 Jan '19

Modernize documentation for our APIs and clean up some old cruft. Some of those may be slightly controversial. Peter Krempa (3): qemu: Don't reject making domain persistent if block copy is running lib: Clarify that any block job may block VM save or device detach lib: domain: Emphasise that users should wait for block job READY state via events src/libvirt-domain.c | 33 +++++++++++++-------------------- src/qemu/qemu_driver.c | 6 ------ 2 files changed, 13 insertions(+), 26 deletions(-) -- 2.20.1

2 5

[libvirt] [PATCH v2 0/4] Restructure firewall rules for virtual networks into private chains
by Daniel P. Berrangé 24 Jan '19

24 Jan '19

v1: https://www.redhat.com/archives/libvir-list/2018-November/msg00018.html The virtual networks in NAT mode are supposed to only allow outbound network access for guests. Unfortunately due to ordering of the firewall rules libvirt creates, when you have multiple virtual networks, guests on the more recently created virtual networks can connect to guests on old virtual networks. This was reported way back in 2008 but we always thought the fix would be very complicated to deal with, so we've been putting it off forever. In parallel with this there's also been a long standing desire since 2009 to move our firewall rules out of the builtin chains, to libvirt private chains. This is to make it easier for admins to use hook scripts to setup rules in the builtin chains that take priority over rules libvirt creates. In implementing the changes to use private chains, I suddenly realized that fixing the network to network traffic blocking problem was trivial if I grouped the forwarding rules into three distinct sets. So this series finally fixes an annoying 10 year old bug, and implements a 9 year old RFE. It may take us a while, but we'll get to your bugs eventually ;-) Changed in v2: - Detect whether chains already exist before creating them - Only try to delete legacy rules from builtin chain during startup Daniel P. Berrangé (4): network: add platform driver callbacks around firewall reload util: pass layer into firewall query callback util: create private chains for virtual network firewall rules util: move virtual network firwall rules into private chains src/libvirt_private.syms | 2 + src/network/bridge_driver.c | 13 +- src/network/bridge_driver_linux.c | 32 +++ src/network/bridge_driver_nop.c | 11 + src/network/bridge_driver_platform.h | 3 + src/nwfilter/nwfilter_ebiptables_driver.c | 17 +- src/util/virfirewall.c | 2 +- src/util/virfirewall.h | 1 + src/util/viriptables.c | 254 +++++++++++++++--- src/util/viriptables.h | 4 + .../nat-default-linux.args | 32 +-- .../nat-ipv6-linux.args | 48 ++-- .../nat-many-ips-linux.args | 60 ++--- .../nat-no-dhcp-linux.args | 46 ++-- .../nat-tftp-linux.args | 34 +-- .../route-default-linux.args | 22 +- tests/virfirewalltest.c | 3 +- 17 files changed, 405 insertions(+), 179 deletions(-) -- 2.19.2

3 9

[libvirt] [PATCH 0/3] Some random fixes
by Michal Privoznik 24 Jan '19

24 Jan '19

*** BLURB HERE *** Michal Prívozník (3): virPCIGetNetName: Initialize @netname to NULL virpci: Fix memleak in virPCIDeviceIterDevices domain_conf: Free egl render node in virDomainGraphicsDefFree src/conf/domain_conf.c | 3 +++ src/util/virnetdev.c | 2 -- src/util/virpci.c | 4 ++++ 3 files changed, 7 insertions(+), 2 deletions(-) -- 2.19.2

2 8

[libvirt] [PATCH] qemu-nbd: Deprecate qemu-nbd --partition
by Eric Blake 24 Jan '19

24 Jan '19

The existing qemu-nbd --partition code claims to handle logical partitions up to 8, since its introduction in 2008 (commit 7a5ca86). However, the implementation is bogus (actual MBR logical partitions form a sort of linked list, with one partition per extended table entry, rather than four logical partitions in a single extended table), making the code unlikely to work for anything beyond -P5 on actual guest images. What's more, the code does not support GPT partitions, which are becoming more popular, and maintaining device subsetting in both NBD and the raw device is unnecessary maintenance burden. And nbdkit has just added code to properly handle an arbitrary number of MBR partitions, along with its existing code for handling GPT partitions. Note that obtaining the offsets of a partition can be learned by using 'qemu-nbd -c /dev/nbd0 file.qcow2 && sfdisk --dump /dev/nbd0', but by the time you've done that, you might as well just mount /dev/nbd0p1 that the kernel creates for you. Start the clock on the deprecation cycle, with an example of how to write device subsetting without using -P. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- qemu-deprecated.texi | 27 +++++++++++++++++++++++++++ qemu-nbd.texi | 6 ++++-- qemu-nbd.c | 2 ++ 3 files changed, 33 insertions(+), 2 deletions(-) diff --git a/qemu-deprecated.texi b/qemu-deprecated.texi index 219206a836f..12f8b30943f 100644 --- a/qemu-deprecated.texi +++ b/qemu-deprecated.texi @@ -175,3 +175,30 @@ The above, converted to the current supported format: @subsubsection "irq": "" (since 3.0.0) The ``irq'' property is obsoleted. + +@section Related binaries + +@subsection qemu-nbd --partition (since 4.0.0) + +The ``qemu-nbd --partition $digit'' code (also spelled @option{-P}) +can only handle MBR partitions, and does not correctly handle logical +partitions beyond partition 5. If you know the relative position of +the partition (perhaps by using @code{sfdisk} or similar, either in +the guest or when mapping the entire device through /dev/nbd0 in the +host), you can achieve the effect of exporting just that subset of the +disk by use of the @option{--image-opts} option with a raw blockdev +using the @code{offset} and @code{size} parameters layered on top of +any other existing blockdev. + +For example, if partition 1 is 100MiB starting at 1MiB, the old command + +@example{qemu-nbd -P 1 -f qcow2 file.qcow2} + +can be rewritten as: + +@example{qemu-nbd --image-opts driver=raw,offset=1M,size=100M,file.driver=qcow2,file.backing.driver=file,file.backing.filename=file.qcow2} + +Alternatively, the @code{nbdkit} project provides a more powerful +partition filter on top of its nbd plugin, which can be used to select +an arbitrary MBR or GPT partition on top of any other full-image NBD +export. diff --git a/qemu-nbd.texi b/qemu-nbd.texi index 386bece4680..d0c51828149 100644 --- a/qemu-nbd.texi +++ b/qemu-nbd.texi @@ -56,8 +56,10 @@ auto-detecting. @item -r, --read-only Export the disk as read-only. @item -P, --partition=@var{num} -Only expose MBR partition @var{num}. Understands physical partitions -1-4 and logical partitions 5-8. +Deprecated: Only expose MBR partition @var{num}. Understands physical +partitions 1-4 and logical partition 5. New code should instead use +@option{--image-opts} with the raw driver wrapping a subset of the +original image. @item -B, --bitmap=@var{name} If @var{filename} has a qcow2 persistent bitmap @var{name}, expose that bitmap via the ``qemu:dirty-bitmap:@var{name}'' context diff --git a/qemu-nbd.c b/qemu-nbd.c index 1f7b2a03f5d..00c07fd27ea 100644 --- a/qemu-nbd.c +++ b/qemu-nbd.c @@ -787,6 +787,8 @@ int main(int argc, char **argv) flags &= ~BDRV_O_RDWR; break; case 'P': + warn_report("The '-P' option is deprecated; use --image-opts with " + "a raw device wrapper for subset exports instead"); if (qemu_strtoi(optarg, NULL, 0, &partition) < 0 || partition < 1 || partition > 8) { error_report("Invalid partition '%s'", optarg); -- 2.20.1

3 4

[libvirt] [PATCH] qemu: improve compile-time check of qemuBlockjobState mapping
by Eric Blake 23 Jan '19

23 Jan '19

Asserting the value we set four lines earlier in qemuBlockjobState doesn't buy us any safety (if the public header adds a value, we end up skipping that value without the compiler warning us of our gap); what we really want is to assert that the value auto-assigned by the compiler matches the actual last value in the public headers (as was done below for qemuBlockJobType). Add useful comments while at it. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- The spelling VIR_DOMAIN_BLOCK_JOB_LAST vs. VIR_DOMAIN_BLOCK_JOB_TYPE_LAST took me on a wild goose chase; the least I can do is make the code nicer for the next reader. src/qemu/qemu_blockjob.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_blockjob.h b/src/qemu/qemu_blockjob.h index ed63f2c709..c7325c6daf 100644 --- a/src/qemu/qemu_blockjob.h +++ b/src/qemu/qemu_blockjob.h @@ -29,15 +29,17 @@ * This enum has to map all known block job states from enum virDomainBlockJobType * to the same values. All internal blockjobs can be mapped after and don't * need to have stable values. */ typedef enum { + /* Mapped to public enum */ QEMU_BLOCKJOB_STATE_COMPLETED = VIR_DOMAIN_BLOCK_JOB_COMPLETED, QEMU_BLOCKJOB_STATE_FAILED = VIR_DOMAIN_BLOCK_JOB_FAILED, QEMU_BLOCKJOB_STATE_CANCELLED = VIR_DOMAIN_BLOCK_JOB_CANCELED, QEMU_BLOCKJOB_STATE_READY = VIR_DOMAIN_BLOCK_JOB_READY, - QEMU_BLOCKJOB_STATE_NEW = VIR_DOMAIN_BLOCK_JOB_LAST, + /* Additional enum values local to qemu */ + QEMU_BLOCKJOB_STATE_NEW, QEMU_BLOCKJOB_STATE_RUNNING, QEMU_BLOCKJOB_STATE_LAST } qemuBlockjobState; verify((int)QEMU_BLOCKJOB_STATE_NEW == VIR_DOMAIN_BLOCK_JOB_LAST); @@ -45,15 +47,17 @@ verify((int)QEMU_BLOCKJOB_STATE_NEW == VIR_DOMAIN_BLOCK_JOB_LAST); * This enum has to map all known block job types from enum virDomainBlockJobType * to the same values. All internal blockjobs can be mapped after and don't * need to have stable values. */ typedef enum { + /* Mapped to public enum */ QEMU_BLOCKJOB_TYPE_NONE = VIR_DOMAIN_BLOCK_JOB_TYPE_UNKNOWN, QEMU_BLOCKJOB_TYPE_PULL = VIR_DOMAIN_BLOCK_JOB_TYPE_PULL, QEMU_BLOCKJOB_TYPE_COPY = VIR_DOMAIN_BLOCK_JOB_TYPE_COPY, QEMU_BLOCKJOB_TYPE_COMMIT = VIR_DOMAIN_BLOCK_JOB_TYPE_COMMIT, QEMU_BLOCKJOB_TYPE_ACTIVE_COMMIT = VIR_DOMAIN_BLOCK_JOB_TYPE_ACTIVE_COMMIT, + /* Additional enum values local to qemu */ QEMU_BLOCKJOB_TYPE_INTERNAL, QEMU_BLOCKJOB_TYPE_LAST } qemuBlockJobType; verify((int)QEMU_BLOCKJOB_TYPE_INTERNAL == VIR_DOMAIN_BLOCK_JOB_TYPE_LAST); -- 2.20.1

2 1

[libvirt] [PATCH v3 0/4] util: Fixing libvirt errors on cavium/thunder-nicvf
by dann frazier 23 Jan '19

23 Jan '19

Following up on my offer to take the baton[*], here's a v3 of this series that should address the provided feedback provided for Radoslaw's v2. ThunderX is Cavium SoC. This platform contain SRIOV NIC. Unlike other commonly known network devices it does not have VF functionality duplicated in its PF. PF is purely management device (on HW level). This creates several problems with existing libvirt code as in many places libvirt assumes that each VF netdev has PF netdev assigned. This patch series trying to address issues which can be easily fixed. (mostly bug fixes found while working on full featured solution) First patch in series is most important as it allows to unblock the netdev detection and use <hostdev> on this platform.i <interface type="hostdev" still does not work as it requires bigger changes both on netdev driver and in libvirt itself. More details about those issues can be found at: https://bugs.linaro.org/show_bug.cgi?id=3778 https://bugs.launchpad.net/charm-nova-compute/+bug/1771662 v3: - Reinstated error path in virNetDevGetPhysicalFunction() - Add missing free of *pfname in error path - Use proper < 0 comparisons when checking for errors v2: - error reporting taken out of virNetDevGetPhysicalFunction() and moved to calling function virNetDevGetVirtualFunctionInfo() - curly braces removed from single line - net-> model check removed as STREQ_NULLABLE() follows [*] https://www.redhat.com/archives/libvir-list/2019-January/msg00201.html Radoslaw Biernacki (4): util: fixing wrong assumption that PF has to have netdev assigned util: Code simplification util: Fix for NULL dereference util: Fixing invalid error checking from virPCIGetNetname() src/qemu/qemu_domain_address.c | 13 ++++---- src/util/virhostdev.c | 2 +- src/util/virnetdev.c | 55 ++++++++++++---------------------- 3 files changed, 25 insertions(+), 45 deletions(-) -- 2.20.1

3 9

[libvirt] [PATCH 0/2] apparmor: support named profiles
by Jim Fehlig 23 Jan '19

23 Jan '19

Upstream apparmor is switching to named profiles. Many profiles have already made the switch. Patch 1 changes the libvirtd profile to account for dnsmasq's switch to a named profile. Patch 2 is optional and changes the libvirtd profile to a named profile. It will need a bit of coorindation with upstream apparmor since the dnsmasq profile currently has 'peer=/usr/sbin/libvirtd'. Jim Fehlig (2): apparmor: Add support for named profiles apparmor: convert libvirtd profile to a named profile src/security/apparmor/usr.sbin.libvirtd | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) -- 2.19.2

2 5