- Devel - libvirt List Archives

[libvirt] [PATCH 00/12] Autoselect a DRM node for egl-headless and add it to cmdline
by Erik Skultety 22 Nov '18

22 Nov '18

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1628892. The problem is that we didn't put the DRI device into the namespace for QEMU to access, but that was only a part of the issue. The other part of the issue is that QEMU doesn't support specifying 'rendernode' for egl-headless yet (some patches to solve this are already upstream for 3.1, some are still waiting to be merged). Instead, QEMU's been autoselecting the DRI device on its own. There's no compelling reason for libvirt not doing that instead and thus prevent any permission-related issues. Unlike for SPICE though, I deliberately didn't add an XML attribute for users to select the rendernode for egl-headless, because: a) most of the time, users really don't care about which DRM node will be used and libvirt will most probably do a good decision b) egl-headless is only useful until we have a remote OpenGL acceleration support within SPICE c) for SPICE (or for SDL for that matter at some point), the rendernode is specified as part of the <gl> subelement which says "if enabled, use OpenGL acceleration", but egl-headless graphics type essentially serves the same purpose, it's like having <gl enabled='yes'/> for SPICE, thus having a <gl> subelement for egl-headless type is rather confusing Erik Skultety (12): util: Introduce virHostGetDRMRenderNode helper qemu: command: spice: Pick the first available DRM render node qemu: caps: Start probing for egl-headless display type qemu: caps: Introduce QEMU_EGL_HEADLESS_RENDERNODE capability qemu: command: Introduce qemuBuildGraphicsEGLHeadlessCommandLine helper conf: Add egl-headless to virDomainGraphicsDef union qemu: domain: Put the egl-headless' rendernode device into the namespace qemu: cgroup: Add the DRI device to the cgroup list for egl-headless too command: Put the 'rendernode' option onto egl-headless graphics cmdline security: dac: Relabel the DRI render device for egl-headless too tests: Add a test case for the egl-headless' rendernode option docs: Provide a news update for libvirt being able to pick a DRI device docs/news.xml | 13 ++++ src/conf/domain_conf.h | 3 + src/libvirt_private.syms | 1 + src/qemu/qemu_capabilities.c | 17 +++-- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_cgroup.c | 15 ++-- src/qemu/qemu_command.c | 72 +++++++++++++++---- src/qemu/qemu_domain.c | 15 ++-- src/security/security_dac.c | 21 +++--- src/util/virutil.c | 53 ++++++++++++++ src/util/virutil.h | 2 + ...cs-egl-headless-rendernode-autoselect.args | 26 +++++++ ...ics-egl-headless-rendernode-autoselect.xml | 1 + tests/qemuxml2argvmock.c | 9 +++ tests/qemuxml2argvtest.c | 4 ++ 15 files changed, 220 insertions(+), 33 deletions(-) create mode 100644 tests/qemuxml2argvdata/graphics-egl-headless-rendernode-autoselect.args create mode 120000 tests/qemuxml2argvdata/graphics-egl-headless-rendernode-autoselect.xml -- 2.19.1

3 20

[libvirt] [PATCH v2] security: aa-helper: fix static defined vfio MDEVs
by Christian Ehrhardt 22 Nov '18

22 Nov '18

virt-aa-helper needs to grant QEMU access to VFIO MDEV devices. This extends commit 74e86b6b which only covered PCI hostdevs for VFIO-PCI assignment by now also covering vfio MDEVs. It has still the same limitations regarding the device lifecycle, IOW we're unable to predict the actual VFIO device being created, thus we need wildcards. Also note that the hotplug case, where apparmor is able to detect the actual VFIO device during runtime, is already covered by commit 606afafb. Signed-off-by: Christian Ehrhardt <christian.ehrhardt(a)canonical.com> Reviewed-by: Erik Skultety <eskultet(a)redhat.com> Reviewed-by: Boris Fiuczynski <fiuczy(a)linux.ibm.com> --- src/security/virt-aa-helper.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 03cc15c9d3..c7488432d6 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1105,6 +1105,23 @@ get_files(vahControl * ctl) break; } + case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_MDEV: { + virDomainHostdevSubsysMediatedDevPtr mdevsrc = &dev->source.subsys.u.mdev; + switch ((virMediatedDeviceModelType) mdevsrc->model) { + case VIR_MDEV_MODEL_TYPE_VFIO_PCI: + case VIR_MDEV_MODEL_TYPE_VFIO_AP: + case VIR_MDEV_MODEL_TYPE_VFIO_CCW: + needsVfio = true; + break; + case VIR_MDEV_MODEL_TYPE_LAST: + default: + virReportEnumRangeError(virMediatedDeviceModelType, + mdevsrc->model); + break; + } + break; + } + case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI: { virPCIDevicePtr pci = virPCIDeviceNew( dev->source.subsys.u.pci.addr.domain, -- 2.17.1

2 1

[libvirt] [PATCH] security: aa-helper: fix static defined vfio MDEVs
by Christian Ehrhardt 22 Nov '18

22 Nov '18

For vfio MDEVs we need to allow qemu the vfio access in apparmor. This is extending the older fix 74e86b6b: "Fix apparmor profile to make vfio pci passthrough work" which was for VFIO PCI passthrough on static hostdevs to now also cover vfio MDEVs. It is having the same limitations of the lifecycle at that time being unable to detect the actual vfio device and therefore adds a wildcars. Please also note that hotplug - which in can detect the right device at runtime - is covered by labeling callbacks in 606afafb: "security: Enable labeling of vfio mediated devices" Signed-off-by: Christian Ehrhardt <christian.ehrhardt(a)canonical.com> --- src/security/virt-aa-helper.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 03cc15c9d3..c7488432d6 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1105,6 +1105,23 @@ get_files(vahControl * ctl) break; } + case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_MDEV: { + virDomainHostdevSubsysMediatedDevPtr mdevsrc = &dev->source.subsys.u.mdev; + switch ((virMediatedDeviceModelType) mdevsrc->model) { + case VIR_MDEV_MODEL_TYPE_VFIO_PCI: + case VIR_MDEV_MODEL_TYPE_VFIO_AP: + case VIR_MDEV_MODEL_TYPE_VFIO_CCW: + needsVfio = true; + break; + case VIR_MDEV_MODEL_TYPE_LAST: + default: + virReportEnumRangeError(virMediatedDeviceModelType, + mdevsrc->model); + break; + } + break; + } + case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI: { virPCIDevicePtr pci = virPCIDeviceNew( dev->source.subsys.u.pci.addr.domain, -- 2.17.1

3 3

Re: [libvirt] Overview of libvirt incremental backup API, part 2 (incremental/differential pull mode)
by Michael Ablassmeier 22 Nov '18

22 Nov '18

hi, after watching Johns slides from the kvm forum (thanks for that) i had some quick look at the backup-v3 branch. Just to provide some feebdack for you guys, and some questions. My main question is about the part of the NBD backup. By default what you get from reading all the NDB data is a thick provisioned image of the domains disk. One can use the `qemu-img map' function to get a detailed information about the used blocks in the image, in case one wants to create a thin provisioned backup. As a third party backup vendor you cannot allways depend on qemu tools, because you might not even install any software on the host you are taking a backup from. So is, or will there be any way to get an output that represents the same information from the map function in the backup XML description via the libvirt API? Would it make sense to provide this information in the `backup-dumpxml' output? >From what i know in the Citrix XEN implementation, they provide a way to read this information via the API, because they do not want the backup vendor to install any component on the host systems. Another thing i came across is that libvirt currently seems to forget about the running backup job if a domain is destroyed and started after a backup job was created: [root@x ~]# virsh backup-begin centos backup-pull.xml Backup id 1 started backup used description from 'backup-pull.xml' [root@x ~]# virsh destroy centos && virsh start centos [root@x ~]# virsh backup-end --id 1 centos error: Requested operation is not valid: No active block job 'tmp-hda' [root@x ~]# virsh backup-dumpxml --id 1 centos <domainbackup mode='pull' id='1'> <server transport='tcp' name='localhost' port='10809'/> <disks> <disk name='hda' type='file'> <driver type='qcow2'/> <scratch file='/vm/base.img.1542876138'/> </disk> </disks> </domainbackup> thanks for your hard work on this! bye, - michael

1 0

[libvirt] [PATCH] qemu: handle multicast overflow on macvtap for NIC_RX_FILTER_CHANGED
by Jason Baron 21 Nov '18

21 Nov '18

Guest network devices can set 'overflow' when there are a number of multicast ips configured. For virtio_net, the limit is only 64. In this case, the list of mac addresses is empty and the 'overflow' condition is set. Thus, the guest will currently receive no multicast traffic in this state. When 'overflow' is set in the guest, let's turn this into ALLMULTI on the host. Signed-off-by: Jason Baron <jbaron(a)akamai.com> --- src/qemu/qemu_driver.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 7fb9102..ea36db8 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -4443,11 +4443,11 @@ static void syncNicRxFilterMultiMode(char *ifname, virNetDevRxFilterPtr guestFilter, virNetDevRxFilterPtr hostFilter) { - if (hostFilter->multicast.mode != guestFilter->multicast.mode) { + if (hostFilter->multicast.mode != guestFilter->multicast.mode || + guestFilter->multicast.overflow) { switch (guestFilter->multicast.mode) { case VIR_NETDEV_RX_FILTER_MODE_ALL: if (virNetDevSetRcvAllMulti(ifname, true)) { - VIR_WARN("Couldn't set allmulticast flag to 'on' for " "device %s while responding to " "NIC_RX_FILTER_CHANGED", ifname); @@ -4455,17 +4455,29 @@ syncNicRxFilterMultiMode(char *ifname, virNetDevRxFilterPtr guestFilter, break; case VIR_NETDEV_RX_FILTER_MODE_NORMAL: - if (virNetDevSetRcvMulti(ifname, true)) { + if (guestFilter->multicast.overflow && + (hostFilter->multicast.mode == VIR_NETDEV_RX_FILTER_MODE_ALL)) { + break; + } + if (virNetDevSetRcvMulti(ifname, true)) { VIR_WARN("Couldn't set multicast flag to 'on' for " "device %s while responding to " "NIC_RX_FILTER_CHANGED", ifname); } - if (virNetDevSetRcvAllMulti(ifname, false)) { - VIR_WARN("Couldn't set allmulticast flag to 'off' for " - "device %s while responding to " - "NIC_RX_FILTER_CHANGED", ifname); + if (guestFilter->multicast.overflow == true) { + if (virNetDevSetRcvAllMulti(ifname, true)) { + VIR_WARN("Couldn't set allmulticast flag to 'on' for " + "device %s while responding to " + "NIC_RX_FILTER_CHANGED", ifname); + } + } else { + if (virNetDevSetRcvAllMulti(ifname, false)) { + VIR_WARN("Couldn't set allmulticast flag to 'off' for " + "device %s while responding to " + "NIC_RX_FILTER_CHANGED", ifname); + } } break; -- 2.7.4

2 1

[libvirt] [PATCH go] Add back compat constants for iothreads
by Daniel P. Berrangé 21 Nov '18

21 Nov '18

Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- domain_compat.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) Pushed as a build break fix for old libvirt diff --git a/domain_compat.h b/domain_compat.h index 371bcc4..19a3e24 100644 --- a/domain_compat.h +++ b/domain_compat.h @@ -917,4 +917,20 @@ struct _virDomainInterface { #define VIR_DOMAIN_SHUTOFF_DAEMON 8 #endif +#ifndef VIR_DOMAIN_STATS_IOTHREAD +#define VIR_DOMAIN_STATS_IOTHREAD (1 << 7) +#endif + +#ifndef VIR_DOMAIN_IOTHREAD_POLL_GROW +#define VIR_DOMAIN_IOTHREAD_POLL_GROW "poll_grow" +#endif + +#ifndef VIR_DOMAIN_IOTHREAD_POLL_SHRINK +#define VIR_DOMAIN_IOTHREAD_POLL_SHRINK "poll_shrink" +#endif + +#ifndef VIR_DOMAIN_IOTHREAD_POLL_MAX_NS +#define VIR_DOMAIN_IOTHREAD_POLL_MAX_NS "poll_max_ns" +#endif + #endif /* LIBVIRT_GO_DOMAIN_COMPAT_H__ */ -- 2.19.1

1 0

[libvirt] [sandbox PATCH 0/2] Resolve builder issues
by Radostin Stoyanov 21 Nov '18

21 Nov '18

Radostin Stoyanov (2): builder: Use prefix '=> /' to identify lib path Use "/boot/vmlinuz-linux" as default kernel path bin/virt-sandbox.c | 5 +++-- libvirt-sandbox/libvirt-sandbox-builder-machine.c | 4 ++++ libvirt-sandbox/libvirt-sandbox-builder.c | 14 ++++++-------- 3 files changed, 13 insertions(+), 10 deletions(-) -- 2.17.1

2 4

[libvirt] [libvirt-go PATCH] Add virDomainSetIOThreadParams binding
by John Ferlan 21 Nov '18

21 Nov '18

Signed-off-by: John Ferlan <jferlan(a)redhat.com> --- Well I've given it a "go", hopefully it's (more or less) right. The build and test at least pass ;-) domain.go | 52 +++++++++++++++++++++++++++++++++++++++++++++++ domain_wrapper.go | 20 ++++++++++++++++++ domain_wrapper.h | 8 ++++++++ 3 files changed, 80 insertions(+) diff --git a/domain.go b/domain.go index e011980..3a6811f 100644 --- a/domain.go +++ b/domain.go @@ -769,6 +769,7 @@ const ( DOMAIN_STATS_INTERFACE = DomainStatsTypes(C.VIR_DOMAIN_STATS_INTERFACE) DOMAIN_STATS_BLOCK = DomainStatsTypes(C.VIR_DOMAIN_STATS_BLOCK) DOMAIN_STATS_PERF = DomainStatsTypes(C.VIR_DOMAIN_STATS_PERF) + DOMAIN_STATS_IOTHREAD = DomainStatsTypes(C.VIR_DOMAIN_STATS_IOTHREAD) ) type DomainCoreDumpFlags int @@ -4207,6 +4208,57 @@ func (d *Domain) DelIOThread(id uint, flags DomainModificationImpact) error { return nil } +// See also https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainSetIOThreadPa… + +type DomainSetIOThreadParams struct { + PollMaxNsSet bool + PollMaxNs uint64 + PollGrowSet bool + PollGrow uint + PollShrinkSet bool + PollShrink uint64 +} + +func getSetIOThreadParamsFieldInfo(params *DomainSetIOThreadParams) map[string]typedParamsFieldInfo { + return map[string]typedParamsFieldInfo{ + C.VIR_DOMAIN_IOTHREAD_POLL_MAX_NS: typedParamsFieldInfo{ + set: &params.PollMaxNsSet, + ul: &params.PollMaxNs, + }, + C.VIR_DOMAIN_IOTHREAD_POLL_GROW: typedParamsFieldInfo{ + set: &params.PollGrowSet, + ui: &params.PollGrow, + }, + C.VIR_DOMAIN_IOTHREAD_POLL_SHRINK: typedParamsFieldInfo{ + set: &params.PollShrinkSet, + ul: &params.PollShrink, + }, + } +} + +func (d *Domain) SetIOThreadParams(iothreadid uint, params *DomainSetIOThreadParams, flags DomainModificationImpact) error { + if C.LIBVIR_VERSION_NUMBER < 4010000 { + return makeNotImplementedError("virDomainSetIOThreadParams") + } + info := getSetIOThreadParamsFieldInfo(params) + + cparams, gerr := typedParamsPackNew(info) + if gerr != nil { + return gerr + } + nparams := len(*cparams) + + defer C.virTypedParamsClear((*C.virTypedParameter)(unsafe.Pointer(&(*cparams)[0])), C.int(nparams)) + + var err C.virError + ret := C.virDomainSetIOThreadParamsWrapper(d.ptr, C.uint(iothreadid), (*C.virTypedParameter)(unsafe.Pointer(&(*cparams)[0])), C.int(nparams), C.uint(flags), &err) + if ret == -1 { + return makeError(&err) + } + + return nil +} + // See also https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainGetEmulatorPi… func (d *Domain) GetEmulatorPinInfo(flags DomainModificationImpact) ([]bool, error) { var cnodeinfo C.virNodeInfo diff --git a/domain_wrapper.go b/domain_wrapper.go index b42dd42..f674bd5 100644 --- a/domain_wrapper.go +++ b/domain_wrapper.go @@ -1913,6 +1913,26 @@ virDomainSetGuestVcpusWrapper(virDomainPtr domain, } +int +virDomainSetIOThreadParamsWrapper(virDomainPtr domain, + unsigned int iothread_id, + virTypedParameterPtr params, + int nparams, + unsigned int flags, + virErrorPtr err) +{ +#if LIBVIR_VERSION_NUMBER < 4010000 + assert(0); // Caller should have checked version +#else + int ret = virDomainSetIOThreadParams(domain, iothread_id, params, nparams, flags); + if (ret < 0) { + virCopyLastError(err); + } + return ret; +#endif +} + + int virDomainSetInterfaceParametersWrapper(virDomainPtr domain, const char *device, diff --git a/domain_wrapper.h b/domain_wrapper.h index 7bd8282..48a4cd3 100644 --- a/domain_wrapper.h +++ b/domain_wrapper.h @@ -813,6 +813,14 @@ virDomainSetGuestVcpusWrapper(virDomainPtr domain, unsigned int flags, virErrorPtr err); +int +virDomainSetIOThreadParamsWrapper(virDomainPtr domain, + unsigned int iothread_id, + virTypedParameterPtr params, + int nparams, + unsigned int flags, + virErrorPtr err); + int virDomainSetInterfaceParametersWrapper(virDomainPtr domain, const char *device, -- 2.17.2

2 1

[libvirt] Reporting of IP detected by network filter
by Marcin Mirecki 21 Nov '18

21 Nov '18

Hello, The network filters feature has an option of automatically detecting the IP of a VM [1]. Is it possible to retrieve this IP by any means? If not, would you considering adding such a feature? It would be very useful for uses cases where there is no guest agent. Thanks, Marcin [1] https://libvirt.org/formatnwfilter.html#nwfelemsRulesAdvIPAddrDetection

3 3

[libvirt] [PATCH] util: Fix a bug in virResctrlMonitorGetStats
by Wang Huaqiang 20 Nov '18

20 Nov '18

The path argument of virFileIsDir should be a full name of file, pathname and filename. Fixed it by passing the full path name to virFileIsDir. Signed-off-by: Wang Huaqiang <huaqiang.wang(a)intel.com> --- src/util/virresctrl.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/util/virresctrl.c b/src/util/virresctrl.c index 7aeca9d..e0ad460 100644 --- a/src/util/virresctrl.c +++ b/src/util/virresctrl.c @@ -2665,6 +2665,7 @@ virResctrlMonitorGetStats(virResctrlMonitorPtr monitor, int ret = -1; DIR *dirp = NULL; char *datapath = NULL; + char *filepath = NULL; struct dirent *ent = NULL; virResctrlMonitorStatsPtr stat = NULL; @@ -2684,13 +2685,18 @@ virResctrlMonitorGetStats(virResctrlMonitorPtr monitor, while (virDirRead(dirp, &ent, datapath) > 0) { char *node_id = NULL; + VIR_FREE(filepath); + /* Looking for directory that contains resource utilization * information file. The directory name is arranged in format * "mon_<node_name>_<node_id>". For example, "mon_L3_00" and * "mon_L3_01" are two target directories for a two nodes system * with resource utilization data file for each node respectively. */ - if (!virFileIsDir(ent->d_name)) + if (virAsprintf(&filepath, "%s/%s", datapath, ent->d_name) < 0); + goto cleanup; + + if (!virFileIsDir(filepath)) continue; /* Looking for directory has a prefix 'mon_L' */ @@ -2734,6 +2740,7 @@ virResctrlMonitorGetStats(virResctrlMonitorPtr monitor, ret = 0; cleanup: VIR_FREE(datapath); + VIR_FREE(filepath); VIR_FREE(stat); VIR_DIR_CLOSE(dirp); return ret; -- 2.7.4

2 1