- Devel - libvirt List Archives

[libvirt] [PATCH 00/11] Implement alternative metadata locking
by Michal Privoznik 02 Oct '18

02 Oct '18

The latest events (and bugs reported on the list) got me thinking. I went back to the drawing board and relized we don't need virtlockd if we fork() for every transaction. The whole reason for offloading file locking to virtlockd is that there is no good version of file locking in POSIX. flock() locks entire file which would clash with qemu and therefore we can't use it. Then, fcntl(F_SETLK) (which we expose as virFileLock()) allows us to lock only some bytes, but it has few critical problems: a) the lock is not shared across fork() (only the parent has all the locks, not the child), b) the lock is not owned by file descriptor, but (pid,inode) pair. Therefore, if one thread holds the lock and the other close()-s any FD referring to the inode, it releases all the locks on that inode [1]. Since we can't guarantee this won't happen in multithreaded app like libvirtd we created a separate, single threaded binary (virtlockd) to work around those problems [2]. However, since namespaces are on by default (and therefore arguably more of our users use them than don't), we are fork()-ing anyway when setting up security labels. But the child runs single threaded, so it can do the locking instead of offloading it to a separate process. All that we need to do is: 1) make sure to fork() every time (even when namespaces are disabled), 2) make sure the child won't create any threads (trivial). I tried to write patches to make virtlockd work, but turns out it would be another 10+ patches which looks like worthless work to me given that we have cleaner solution. Having said that, I'm also reverting some patches that modified virtlockd because we will not need it after all. 1: Worse, imagine two file names for the same inode, aka file2 is a hardlink to file1. Locking file1 and closing file2 results in releasing the lock. 2: There are sane locks, so called Open File Description locks, which work well even in aforementioned cases. The lock is associated with the FD and not (pid,inode) pair. But they are Linux only. Michal Prívozník (11): security: Always spawn process for transactions security_manager: Rework metadata locking Revert "security_manager: Load lock plugin on init" Revert "qemu_conf: Introduce metadata_lock_manager" Revert "lock_manager: Allow disabling configFile for virLockManagerPluginNew" Revert "lock_driver: Introduce VIR_LOCK_MANAGER_ACQUIRE_ROLLBACK" Revert "lock_driver: Introduce VIR_LOCK_MANAGER_RESOURCE_TYPE_METADATA" Revert "_virLockManagerLockDaemonPrivate: Move @hasRWDisks into dom union" Revert "lock_driver: Introduce new VIR_LOCK_MANAGER_OBJECT_TYPE_DAEMON" Revert "lock_driver_lockd: Introduce VIR_LOCK_SPACE_PROTOCOL_ACQUIRE_RESOURCE_METADATA flag" Revert "virlockspace: Allow caller to specify start and length offset in virLockSpaceAcquireResource" cfg.mk | 4 +- src/locking/lock_daemon_dispatch.c | 11 +- src/locking/lock_driver.h | 12 -- src/locking/lock_driver_lockd.c | 421 ++++++++++++------------------------- src/locking/lock_driver_lockd.h | 1 - src/locking/lock_driver_sanlock.c | 44 ++-- src/locking/lock_manager.c | 10 +- src/lxc/lxc_controller.c | 3 +- src/lxc/lxc_driver.c | 2 +- src/qemu/qemu_conf.c | 1 - src/qemu/qemu_conf.h | 1 - src/qemu/qemu_driver.c | 3 - src/security/security_dac.c | 18 +- src/security/security_manager.c | 218 ++++++++----------- src/security/security_manager.h | 19 +- src/security/security_selinux.c | 18 +- src/util/virlockspace.c | 15 +- src/util/virlockspace.h | 4 - tests/seclabeltest.c | 2 +- tests/securityselinuxlabeltest.c | 2 +- tests/securityselinuxtest.c | 2 +- tests/testutilsqemu.c | 2 +- tests/virlockspacetest.c | 29 +-- 23 files changed, 287 insertions(+), 555 deletions(-) -- 2.16.4

1 11

[libvirt] [tck PATCH] Fix runtime "undefined global" error in 100-disk-encryption.t
by Laine Stump 02 Oct '18

02 Oct '18

Commit 3836a38c added a $secret-undefine call at the end of 100-disk-encryption.t because the presence of the secret was reportedly causing an error when the test was run a 2nd time. Unfortunately the definition of "my $secret" was inside a SKIP: { ... } block, but the $secret->undefine was added just outside that block, so the test failed when it was run. Signed-off-by: Laine Stump <laine(a)laine.org> --- NB: this test is disabled unconditionally at the start of the SKIP block anyway, so I'm not sure how Jim encountered the error leading to the original patch. scripts/qemu/100-disk-encryption.t | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/qemu/100-disk-encryption.t b/scripts/qemu/100-disk-encryption.t index 1a36650..12386ae 100644 --- a/scripts/qemu/100-disk-encryption.t +++ b/scripts/qemu/100-disk-encryption.t @@ -117,6 +117,6 @@ diag "Undefining the inactive domain config"; $dom->undefine; ok_error(sub { $conn->get_domain_by_name("tck") }, "NO_DOMAIN error raised from missing domain", 42); -} $secret->undefine; +} -- 2.17.1

3 2

[libvirt] question about syntax of storage volume <target> element
by Jim Fehlig 02 Oct '18

02 Oct '18

I've attempted to use virt-manager to create a new VM that uses a volume from an rbd-based network pool, but have not been able to progress past step 4/5 where VM storage is selected. It appears virt-manager has problems properly detecting the volume as network-based storage, but before investigating those further I have a question about the syntax of the <target> element of a storage volume. The storage management page [0] of the website describing rbd volumes claims that the <path> subelement contains an 'rbd:rbd/' prefix in the volume path. But the page describing pool and volume format [1] syntax does not contain any info wrt specifying network URLs in the <path> subelement. What is the expectation wrt the <path> subelement of the <target> element within rbd volume config? In general, should the <path> subelement encode the scheme (e.g. rbd://) of a network-based volume? And if so, should it be formatted in the traditional 'rbd://' vs 'rbd:rbd/' syntax? Regards, Jim [0] https://libvirt.org/storage.html#StorageBackendRBD [1] https://libvirt.org/formatstorage.html#StorageVolTarget

4 4

[libvirt] [PATCH 0/8] qemu: Fix disk hotplug/media change regression
by Peter Krempa 02 Oct '18

02 Oct '18

Few of my recent patches (see the first two reverts) introduced a regression when adding disks. The disk alias is needed when creating names of certain backend objects (secrets/TLS). The code preparing those was moved prior to alias formatting. Revert those patches and fix it in a different way. Peter Krempa (8): Revert "qemu: hotplug: Prepare disk source in qemuDomainAttachDeviceDiskLive" Revert "qemu: hotplug: consolidate media change code paths" qemu: hotplug: Use new source when preparing/translating for media change qemu: hotplug: Prepare disk source for media changing qemu: hotplug: Add wrapper for disk hotplug code qemu: conf: Export qemuAddSharedDisk qemu: hotplug: Split out media change code from disk hotplug qemu: hotplug: Refactor qemuDomainAttachDeviceDiskLiveInternal src/qemu/qemu_conf.c | 2 +- src/qemu/qemu_conf.h | 5 ++ src/qemu/qemu_driver.c | 7 +- src/qemu/qemu_hotplug.c | 188 ++++++++++++++++++++++------------------ src/qemu/qemu_hotplug.h | 9 +- tests/qemuhotplugtest.c | 2 +- 6 files changed, 123 insertions(+), 90 deletions(-) -- 2.17.1

2 18

[libvirt] [PATCH 0/2] cpu_map: Add Icelake CPU models
by Jiri Denemark 02 Oct '18

02 Oct '18

The second patch mentions that ospke feature was removed in QEMU 3.0, see http://lists.nongnu.org/archive/html/qemu-devel/2018-09/msg02113.html for discussion about how to deal with removed CPU features. Jiri Denemark (2): cpu_map: Add features for Icelake CPUs cpu_map: Add Icelake CPU models src/cpu_map/x86_Icelake-Client.xml | 85 +++++++++++++++++ src/cpu_map/x86_Icelake-Server.xml | 95 +++++++++++++++++++ src/cpu_map/x86_features.xml | 33 +++++++ .../x86_64-cpuid-Core-i5-6600-guest.xml | 1 + .../x86_64-cpuid-Core-i5-6600-host.xml | 1 + .../x86_64-cpuid-Core-i7-5600U-arat-guest.xml | 1 + .../x86_64-cpuid-Core-i7-5600U-arat-host.xml | 1 + .../x86_64-cpuid-Core-i7-5600U-guest.xml | 1 + .../x86_64-cpuid-Core-i7-5600U-host.xml | 1 + .../x86_64-cpuid-Core-i7-5600U-ibrs-guest.xml | 1 + .../x86_64-cpuid-Core-i7-5600U-ibrs-host.xml | 1 + .../x86_64-cpuid-Core-i7-7700-guest.xml | 1 + .../x86_64-cpuid-Core-i7-7700-host.xml | 1 + .../x86_64-cpuid-Xeon-E3-1245-v5-guest.xml | 1 + .../x86_64-cpuid-Xeon-E3-1245-v5-host.xml | 1 + .../x86_64-cpuid-Xeon-E5-2623-v4-guest.xml | 1 + .../x86_64-cpuid-Xeon-E5-2623-v4-host.xml | 1 + .../x86_64-cpuid-Xeon-E5-2650-v4-guest.xml | 1 + .../x86_64-cpuid-Xeon-E5-2650-v4-host.xml | 1 + .../x86_64-cpuid-Xeon-Gold-5115-guest.xml | 1 + .../x86_64-cpuid-Xeon-Gold-5115-host.xml | 1 + .../x86_64-cpuid-Xeon-Gold-6148-guest.xml | 1 + .../x86_64-cpuid-Xeon-Gold-6148-host.xml | 1 + 23 files changed, 233 insertions(+) create mode 100644 src/cpu_map/x86_Icelake-Client.xml create mode 100644 src/cpu_map/x86_Icelake-Server.xml -- 2.19.0

3 4

[libvirt] [PATCH] virFileIsSharedFSType: Check for fuse.glusterfs too
by Michal Privoznik 02 Oct '18

02 Oct '18

https://bugzilla.redhat.com/show_bug.cgi?id=1632711 GlusterFS is typically safe when it comes to migration. It's a network FS after all. However, it can be mounted via FUSE driver they provide. If that is the case we fail to identify it and think migration is not safe and require VIR_MIGRATE_UNSAFE flag. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/util/virfile.c | 77 ++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 75 insertions(+), 2 deletions(-) diff --git a/src/util/virfile.c b/src/util/virfile.c index f8ae07fe4a..ccffa063a6 100644 --- a/src/util/virfile.c +++ b/src/util/virfile.c @@ -3458,6 +3458,75 @@ int virFilePrintf(FILE *fp, const char *msg, ...) # ifndef HUGETLBFS_MAGIC # define HUGETLBFS_MAGIC 0x958458f6 # endif +# ifndef FUSE_SUPER_MAGIC +# define FUSE_SUPER_MAGIC 0x65735546 +# endif + +# define PROC_MOUNTS "/proc/mounts" + +static int +virFileIsShareFixFUSE(const char *path, + long *f_type) +{ + char *dirpath = NULL; + const char **mounts = NULL; + size_t nmounts = 0; + size_t i; + char *p; + FILE *f = NULL; + struct mntent mb; + char mntbuf[1024]; + bool found = false; + int ret = -1; + + if (VIR_STRDUP(dirpath, path) < 0) + return -1; + + if (!(f = setmntent(PROC_MOUNTS, "r"))) { + virReportSystemError(errno, + _("Unable to open %s"), + PROC_MOUNTS); + goto cleanup; + } + + while (getmntent_r(f, &mb, mntbuf, sizeof(mntbuf))) { + if (STRNEQ("fuse.glusterfs", mb.mnt_type)) + continue; + + if (VIR_APPEND_ELEMENT_COPY(mounts, nmounts, mb.mnt_dir) < 0) + goto cleanup; + } + + do { + if ((p = strrchr(dirpath, '/')) == NULL) { + virReportSystemError(EINVAL, + _("Invalid relative path '%s'"), path); + goto cleanup; + } + + if (p == dirpath) + *(p+1) = '\0'; + else + *p = '\0'; + + for (i = 0; i < nmounts; i++) { + if (STREQ(dirpath, mounts[i])) { + found = true; + VIR_DEBUG("Found gluster FUSE mountpoint=%s for path=%s. " + "Fixing shared FS type", mounts[i], path); + *f_type = GFS2_MAGIC; + } + } + } while (!found && p != dirpath); + + ret = 0; + cleanup: + endmntent(f); + VIR_FREE(mounts); + VIR_FREE(dirpath); + return ret; +} + int virFileIsSharedFSType(const char *path, @@ -3503,6 +3572,12 @@ virFileIsSharedFSType(const char *path, return -1; } + if (sb.f_type == FUSE_SUPER_MAGIC) { + VIR_DEBUG("Found FUSE mount for path=%s. Trying to fix it", path); + if (virFileIsShareFixFUSE(path, (long *) &sb.f_type) < 0) + return -1; + } + VIR_DEBUG("Check if path %s with FS magic %lld is shared", path, (long long int)sb.f_type); @@ -3594,8 +3669,6 @@ virFileGetDefaultHugepageSize(unsigned long long *size) return 0; } -# define PROC_MOUNTS "/proc/mounts" - int virFileFindHugeTLBFS(virHugeTLBFSPtr *ret_fs, size_t *ret_nfs) -- 2.16.4

2 1

[libvirt] [PATCH] tests: reintroduce tests for libxl's legacy nested setting
by Jim Fehlig 01 Oct '18

01 Oct '18

The preferred location for setting the nested CPU flag changed in Xen 4.10 and is advertised via the LIBXL_HAVE_BUILDINFO_NESTED_HVM define. Commit 95d19cd0 changed libxl to use the new preferred location but unconditionally changed the tests, causing 'make check' failures against Xen < 4.10 that do not contain the new location. Commit e94415d5 fixed the failures by only running the tests when LIBXL_HAVE_BUILDINFO_NESTED_HVM is defined. Since libvirt supports several versions of Xen that use the old nested location, it is prudent to test the flag is set correctly. This patch reintroduces the tests for the legacy location of the nested setting. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- We could probably get by with one test for the old nested location, in which case I'd drop vnuma-hvm-legacy-nest. Any opinions on that? .../fullvirt-cpuid-legacy-nest.json | 60 ++++++ .../fullvirt-cpuid-legacy-nest.xml | 34 ++++ .../vnuma-hvm-legacy-nest.json | 178 ++++++++++++++++++ .../vnuma-hvm-legacy-nest.xml | 100 ++++++++++ tests/libxlxml2domconfigtest.c | 3 + 5 files changed, 375 insertions(+) diff --git a/tests/libxlxml2domconfigdata/fullvirt-cpuid-legacy-nest.json b/tests/libxlxml2domconfigdata/fullvirt-cpuid-legacy-nest.json new file mode 100644 index 0000000000..cdc8b9867d --- /dev/null +++ b/tests/libxlxml2domconfigdata/fullvirt-cpuid-legacy-nest.json @@ -0,0 +1,60 @@ +{ + "c_info": { + "type": "hvm", + "name": "XenGuest2", + "uuid": "c7a5fdb2-cdaf-9455-926a-d65c16db1809" + }, + "b_info": { + "max_vcpus": 1, + "avail_vcpus": [ + 0 + ], + "max_memkb": 592896, + "target_memkb": 403456, + "shadow_memkb": 5656, + "cpuid": [ + { + "leaf": 1, + "ecx": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx0", + "edx": "xxxxxxxxxxxxxxxxxxxxxxxxxxx1xxxx" + } + ], + "sched_params": { + }, + "type.hvm": { + "pae": "True", + "apic": "True", + "acpi": "True", + "nested_hvm": "False", + "nographic": "True", + "vnc": { + "enable": "False" + }, + "sdl": { + "enable": "False" + }, + "spice": { + + }, + "boot": "c", + "rdm": { + + } + }, + "arch_arm": { + + } + }, + "disks": [ + { + "pdev_path": "/dev/HostVG/XenGuest2", + "vdev": "hda", + "backend": "phy", + "format": "raw", + "removable": 1, + "readwrite": 1 + } + ], + "on_reboot": "restart", + "on_crash": "restart" +} diff --git a/tests/libxlxml2domconfigdata/fullvirt-cpuid-legacy-nest.xml b/tests/libxlxml2domconfigdata/fullvirt-cpuid-legacy-nest.xml new file mode 100644 index 0000000000..4f06db0714 --- /dev/null +++ b/tests/libxlxml2domconfigdata/fullvirt-cpuid-legacy-nest.xml @@ -0,0 +1,34 @@ +<domain type='xen'> + <name>XenGuest2</name> + <uuid>c7a5fdb2-cdaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>592896</memory> + <currentMemory unit='KiB'>403456</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='xenfv'>hvm</type> + </os> + <features> + <acpi/> + <apic/> + <pae/> + </features> + <cpu mode='host-passthrough'> + <feature policy='forbid' name='pni'/> + <feature policy='forbid' name='vmx'/> + <feature policy='require' name='tsc'/> + </cpu> + <clock offset='variable' adjustment='0' basis='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>restart</on_crash> + <devices> + <disk type='block' device='disk'> + <driver name='phy' type='raw'/> + <source dev='/dev/HostVG/XenGuest2'/> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + </devices> +</domain> diff --git a/tests/libxlxml2domconfigdata/vnuma-hvm-legacy-nest.json b/tests/libxlxml2domconfigdata/vnuma-hvm-legacy-nest.json new file mode 100644 index 0000000000..3b2fc5f40f --- /dev/null +++ b/tests/libxlxml2domconfigdata/vnuma-hvm-legacy-nest.json @@ -0,0 +1,178 @@ +{ + "c_info": { + "type": "hvm", + "name": "test-hvm", + "uuid": "2147d599-9cc6-c0dc-92ab-4064b5446e9b" + }, + "b_info": { + "max_vcpus": 6, + "avail_vcpus": [ + 0, + 1, + 2, + 3, + 4, + 5 + ], + "vnuma_nodes": [ + { + "memkb": 2097152, + "distances": [ + 10, + 21, + 31, + 41, + 51, + 61 + ], + "vcpus": [ + 0 + ] + }, + { + "memkb": 2097152, + "distances": [ + 21, + 10, + 21, + 31, + 41, + 51 + ], + "vcpus": [ + 1 + ] + }, + { + "memkb": 2097152, + "distances": [ + 31, + 21, + 10, + 21, + 31, + 41 + ], + "vcpus": [ + 2 + ] + }, + { + "memkb": 2097152, + "distances": [ + 41, + 31, + 21, + 10, + 21, + 31 + ], + "vcpus": [ + 3 + ] + }, + { + "memkb": 2097152, + "distances": [ + 51, + 41, + 31, + 21, + 10, + 21 + ], + "vcpus": [ + 4 + ] + }, + { + "memkb": 2097152, + "distances": [ + 61, + 51, + 41, + 31, + 21, + 10 + ], + "vcpus": [ + 5 + ] + } + ], + "max_memkb": 1048576, + "target_memkb": 1048576, + "video_memkb": 8192, + "shadow_memkb": 14336, + "device_model_version": "qemu_xen", + "device_model": "/bin/true", + "sched_params": { + + }, + "type.hvm": { + "pae": "True", + "apic": "True", + "acpi": "True", + "nested_hvm": "True", + "vga": { + "kind": "cirrus" + }, + "vnc": { + "enable": "True", + "listen": "0.0.0.0", + "findunused": "False" + }, + "sdl": { + "enable": "False" + }, + "spice": { + + }, + "boot": "c", + "rdm": { + + } + }, + "arch_arm": { + + } + }, + "disks": [ + { + "pdev_path": "/var/lib/xen/images/test-hvm.img", + "vdev": "hda", + "backend": "qdisk", + "format": "raw", + "removable": 1, + "readwrite": 1 + } + ], + "nics": [ + { + "devid": 0, + "mac": "00:16:3e:66:12:b4", + "bridge": "br0", + "script": "/etc/xen/scripts/vif-bridge", + "nictype": "vif_ioemu" + } + ], + "vfbs": [ + { + "devid": -1, + "vnc": { + "enable": "True", + "listen": "0.0.0.0", + "findunused": "False" + }, + "sdl": { + "enable": "False" + } + } + ], + "vkbs": [ + { + "devid": -1 + } + ], + "on_reboot": "restart" +} diff --git a/tests/libxlxml2domconfigdata/vnuma-hvm-legacy-nest.xml b/tests/libxlxml2domconfigdata/vnuma-hvm-legacy-nest.xml new file mode 100644 index 0000000000..6e265e31a9 --- /dev/null +++ b/tests/libxlxml2domconfigdata/vnuma-hvm-legacy-nest.xml @@ -0,0 +1,100 @@ +<domain type='xen'> + <name>test-hvm</name> + <description>None</description> + <uuid>2147d599-9cc6-c0dc-92ab-4064b5446e9b</uuid> + <memory>1048576</memory> + <currentMemory>1048576</currentMemory> + <vcpu>6</vcpu> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <clock offset='utc'/> + <os> + <type>hvm</type> + <loader>/usr/lib/xen/boot/hvmloader</loader> + <boot dev='hd'/> + </os> + <features> + <apic/> + <acpi/> + <pae/> + </features> + <cpu mode='host-passthrough'> + <numa> + <cell id='0' cpus='0' memory='2097152' unit='KiB'> + <distances> + <sibling id='0' value='10'/> + <sibling id='1' value='21'/> + <sibling id='2' value='31'/> + <sibling id='3' value='41'/> + <sibling id='4' value='51'/> + <sibling id='5' value='61'/> + </distances> + </cell> + <cell id='1' cpus='1' memory='2097152' unit='KiB'> + <distances> + <sibling id='0' value='21'/> + <sibling id='1' value='10'/> + <sibling id='2' value='21'/> + <sibling id='3' value='31'/> + <sibling id='4' value='41'/> + <sibling id='5' value='51'/> + </distances> + </cell> + <cell id='2' cpus='2' memory='2097152' unit='KiB'> + <distances> + <sibling id='0' value='31'/> + <sibling id='1' value='21'/> + <sibling id='2' value='10'/> + <sibling id='3' value='21'/> + <sibling id='4' value='31'/> + <sibling id='5' value='41'/> + </distances> + </cell> + <cell id='3' cpus='3' memory='2097152' unit='KiB'> + <distances> + <sibling id='0' value='41'/> + <sibling id='1' value='31'/> + <sibling id='2' value='21'/> + <sibling id='3' value='10'/> + <sibling id='4' value='21'/> + <sibling id='5' value='31'/> + </distances> + </cell> + <cell id='4' cpus='4' memory='2097152' unit='KiB'> + <distances> + <sibling id='0' value='51'/> + <sibling id='1' value='41'/> + <sibling id='2' value='31'/> + <sibling id='3' value='21'/> + <sibling id='4' value='10'/> + <sibling id='5' value='21'/> + </distances> + </cell> + <cell id='5' cpus='5' memory='2097152' unit='KiB'> + <distances> + <sibling id='0' value='61'/> + <sibling id='1' value='51'/> + <sibling id='2' value='41'/> + <sibling id='3' value='31'/> + <sibling id='4' value='21'/> + <sibling id='5' value='10'/> + </distances> + </cell> + </numa> + </cpu> + <devices> + <emulator>/bin/true</emulator> + <disk type='file' device='disk'> + <driver name='qemu'/> + <source file='/var/lib/xen/images/test-hvm.img'/> + <target dev='hda'/> + </disk> + <interface type='bridge'> + <source bridge='br0'/> + <mac address='00:16:3e:66:12:b4'/> + <script path='/etc/xen/scripts/vif-bridge'/> + </interface> + <graphics type='vnc' port='-1' autoport='yes' listen='0.0.0.0'/> + </devices> +</domain> diff --git a/tests/libxlxml2domconfigtest.c b/tests/libxlxml2domconfigtest.c index 22f9c2c871..cf2132563e 100644 --- a/tests/libxlxml2domconfigtest.c +++ b/tests/libxlxml2domconfigtest.c @@ -212,6 +212,9 @@ mymain(void) # ifdef LIBXL_HAVE_BUILDINFO_NESTED_HVM DO_TEST("vnuma-hvm"); DO_TEST("fullvirt-cpuid"); +# else + DO_TEST("vnuma-hvm-legacy-nest"); + DO_TEST("fullvirt-cpuid-legacy-nest"); # endif -- 2.18.0

2 5

[libvirt] Release of libvirt-4.8.0
by Daniel Veillard 01 Oct '18

01 Oct '18

It is out, as planned, tagged in git, the signed tarball and rpms are at the usual place: ftp://libvirt.org/libvirt/ I also make a python binding release which include event testing updates, you can find those at ftp://libvirt.org/libvirt/python/ This is a relatively large release considering the number of patches going in please note the Removed Feature section below: New features: - Xen: Support PM Suspend and Wakeup The libxl driver now supports the virDomainPMSuspendForDuration and virDomainPMWakeup APIs. Removed features: - Xen: Drop support for Xen 4.4 and 4.5 Xen 4.4 and 4.5 are no longer supported by the Xen community. Drop support for these older versions and require Xen >= 4.6. - nwfilter: Disallow binding creation in session mode Ensure that a filter binding creation is not attempted in session mode and generates a proper error message. Improvements: - qemu: Retrieve guest hostname through QEMU Guest Agent command QEMU is now able to retrieve the guest hostname using a new QEMU-GA command called 'guest-get-host-name'. Virsh users can execute 'domhostname' for QEMU driver for domains configured to use the Guest Agent. - virsh: Implement vsh-table in virsh and virsh-admin The new API fixes problems with table-alignment, making the tables more readable and deals with unicode. Bug fixes: - storage: Allow inputvol to be encrypted When creating a storage volume based on another volume, the base input volume is allowed to be encrypted. - virsh: Require explicit --domain for domxml-to-native The --domain option for domxml-to-native virsh command has always been documented as required, but commit v4.3.0-127-gd86531daf2 accidentally made it optional. - lxc_monitor: Avoid AB / BA lock race A deadlock situation could occur when autostarting a LXC domain 'guest' due to two threads attempting to take opposing locks while holding opposing locks (AB BA problem). Thanks everybody for your help with this release. Enjoy ! Daniel -- Daniel Veillard | Red Hat Developers Tools http://developer.redhat.com/ veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] [libvirt PATCH v4] news: Update for 4.8.0 release
by Fabiano Fidêncio 01 Oct '18

01 Oct '18

Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> --- I went through the commits since last release and added a few notes which seem to be relevant for the news. In case you notice there's something missing, please, either send me the text to add it (and I'll re-sping this patch) and add the text before merging this one. Changes since v1: - Actually run make-check in order to be sure the changes are fine. Changes since v2: - Fixed and reworded some parts according to John's and Erik's suggestions. - Added, according to Erik's suggestion: - util: Introduce VIR_AUTOCLOSE macro to automatically close files' fds - virsh: Implement vsh-table in virsh and virsh-admin Changes since v3: - Dropped: - util: Introduce VIR_AUTOCLOSE macro to automatically close files' fds (by Peter's suggestion) - utils: Introduce resource monitor capability interface (by John's suggestion as this work is still a on-going work) - libxl: Add support to set shadow memory for any guest type (after a face-to-face discussion with Peter and Erik) -- docs/news.xml | 47 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) diff --git a/docs/news.xml b/docs/news.xml index 3ed6ff8aeb..166e641811 100644 --- a/docs/news.xml +++ b/docs/news.xml @@ -55,6 +55,15 @@ Drop support for these older versions and require Xen >= 4.6. </description> </change> + <change> + <summary> + nwfilter: Disallow binding creation in session mode + </summary> + <description> + Ensure that a filter binding creation is not attempted in session + mode and generates a proper error message. + </description> + </change> </section> <section title="Improvements"> <change> @@ -68,8 +77,46 @@ Guest Agent. </description> </change> + <change> + <summary> + virsh: Implement vsh-table in virsh and virsh-admin + </summary> + <description> + The new API fixes problems with table-alignment, making the tables + more readable and deals with unicode. + </description> + </change> </section> <section title="Bug fixes"> + <change> + <summary> + storage: Allow inputvol to be encrypted + </summary> + <description> + When creating a storage volume based on another volume, the base + input volume is allowed to be encrypted. + </description> + </change> + <change> + <summary> + virsh: Require explicit --domain for domxml-to-native + </summary> + <description> + The --domain option for domxml-to-native virsh command has always + been documented as required, but commit v4.3.0-127-gd86531daf2 + accidentally made it optional. + </description> + </change> + <change> + <summary> + lxc_monitor: Avoid AB / BA lock race + </summary> + <description> + A deadlock situation could occur when autostarting a LXC domain + 'guest' due to two threads attempting to take opposing locks while + holding opposing locks (AB BA problem). + </description> + </change> </section> </release> <release version="v4.7.0" date="2018-09-03"> -- 2.19.0

2 1

[libvirt] [PATCH] security: dac: also label listen UNIX sockets
by Ján Tomko 01 Oct '18

01 Oct '18

We switched to opening mode='bind' sockets ourselves: commit 30fb2276d88b275dc2aad6ddd28c100d944b59a5 qemu: support passing pre-opened UNIX socket listen FD in v4.5.0-rc1~251 Then fixed qemuBuildChrChardevStr to change libvirtd's label while creating the socket: commit b0c6300fc42bbc3e5eb0b236392f7344581c5810 qemu: ensure FDs passed to QEMU for chardevs have correct SELinux labels v4.5.0-rc1~52 Also add labeling of these sockets to the DAC driver. Instead of trying to figure out which one was created by libvirt, label it if it exists. https://bugzilla.redhat.com/show_bug.cgi?id=1633389 Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/security/security_dac.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 62442745dd..da4a6c72fe 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -1308,7 +1308,12 @@ virSecurityDACSetChardevLabel(virSecurityManagerPtr mgr, break; case VIR_DOMAIN_CHR_TYPE_UNIX: - if (!dev_source->data.nix.listen) { + if (!dev_source->data.nix.listen || + (dev_source->data.nix.path && + virFileExists(dev_source->data.nix.path))) { + /* Also label mode='bind' sockets if they exist, + * e.g. because they were created by libvirt + * and passed via FD */ if (virSecurityDACSetOwnership(mgr, NULL, dev_source->data.nix.path, user, group) < 0) -- 2.16.4

3 5