- Devel - libvirt List Archives

[libvirt] [patch 1/1] virt-aa-helper: Add support for smartcard host-certificates
by Arnaud Patard 20 Nov '19

20 Nov '19

When emulating smartcard with host certificates, qemu needs to be able to read the certificates files, which is denied by apparmor. Add necessary code to add the smartcard certificates related directory to the apparmor profile. This code supports only this case smartcard 'host' and 'passthrough' settings are not supported, as I can't test them. Signed-off-by: Arnaud Patard <apatard(a)hupstream.com> Index: libvirt-5.0.0/src/security/virt-aa-helper.c =================================================================== --- libvirt-5.0.0.orig/src/security/virt-aa-helper.c +++ libvirt-5.0.0/src/security/virt-aa-helper.c @@ -1251,6 +1251,26 @@ get_files(vahControl * ctl) } } + for (i = 0; i < ctl->def->nsmartcards; i++) { + virDomainSmartcardDefPtr sc = ctl->def->smartcards[i]; + virDomainSmartcardType sc_type = sc->type; + char *sc_db = (char *)VIR_DOMAIN_SMARTCARD_DEFAULT_DATABASE; + if (sc->data.cert.database) + sc_db = sc->data.cert.database; + switch(sc_type) { + case VIR_DOMAIN_SMARTCARD_TYPE_HOST: + break; + case VIR_DOMAIN_SMARTCARD_TYPE_HOST_CERTIFICATES: + virBufferAsprintf(&buf, " \"%s/\" rk,\n", sc_db); + virBufferAsprintf(&buf, " \"%s/*\" rk,\n", sc_db); + break; + case VIR_DOMAIN_SMARTCARD_TYPE_PASSTHROUGH: + break; + case VIR_DOMAIN_SMARTCARD_TYPE_LAST: + break; + } + } + if (ctl->def->virtType == VIR_DOMAIN_VIRT_KVM) { for (i = 0; i < ctl->def->nnets; i++) { virDomainNetDefPtr net = ctl->def->nets[i];

3 3

[libvirt] [PATCH] virsh: limit completion of 'domhostname' to active domains
by Pino Toscano 20 Nov '19

20 Nov '19

Getting the hostname of guest usually requires a in-guest agent, or generally can be determined only on active domains. Signed-off-by: Pino Toscano <ptoscano(a)redhat.com> --- tools/virsh-domain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c index b248a15c16..6be9780836 100644 --- a/tools/virsh-domain.c +++ b/tools/virsh-domain.c @@ -11668,7 +11668,7 @@ static const vshCmdInfo info_domhostname[] = { }; static const vshCmdOptDef opts_domhostname[] = { - VIRSH_COMMON_OPT_DOMAIN_FULL(0), + VIRSH_COMMON_OPT_DOMAIN_FULL(VIR_CONNECT_LIST_DOMAINS_ACTIVE), {.name = NULL} }; -- 2.21.0

3 2

[libvirt] FYI mail problems for libvirt lists
by Daniel P. Berrangé 20 Nov '19

20 Nov '19

It has come to our attention that many, possibly even all, people with non-redhat.com email addresses are unable to send mail to most libvirt mailing lists, receiving bounce messages saying the address doesn't exist eg Final-Recipient: rfc822; libvirt-users(a)redhat.com Action: failed Status: 5.0.0 Remote-MTA: dns; us-smtp-inbound-1.mimecast.com Diagnostic-Code: smtp; 550 Invalid Recipient - https://community.mimecast.com/docs/DOC-1369#550 [boadZMN8PrGodBBK6pzKWg.us309] In my testing, libvir-list(a)redhat.com is the only list that is currently accepting incoming mail from non-redhat.com addresses. I see bounces from libvirt-users(a)redhat.com, libvirt-ci(a)redhat.com, libvirt-announce(a)redhat.com and libvirt-security(a)redhat.com, as well as from the undocumented alias libvirt-list(a)redhat.com We believe outgoing mail delivery is still working normally in all cases. The problems appear to be caused by some changes that Red Hat administrators made to the email infrastructure recently. We have a severity 1 ticket open for this issue and are taking all possible steps to escalate it & get it resolved at the soonest opportunity. In the mean time if any users need assistance with libvirt questions, please feel free to ignore our normal guidance and use the main development list libvir-list(a)redhat.com for questions, as this appears to still be working. Alternatively you can use IRC #virt on irc.oftc.net If you need to report any security issues with libvirt, please try the libvirt-security(a)redhat.com list first, but if you get a bounce then email myself directly. Please accept our apologies for the disruption this is causing to the libvirt mailing lists. Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

1 1

[libvirt] [PATCH 00/13] drop usage of c-type gnulib module
by Pavel Hrdina 20 Nov '19

20 Nov '19

Pavel Hrdina (13): util: define IS_BLANK instead of using c_isblank from gnulib use g_ascii_isalnum instead of c_isalnum from gnulib use g_ascii_isalpha instead of c_isalpha from gnulib use g_ascii_iscntrl instead of c_iscntrl from gnulib use g_ascii_isdigit instead of c_isdigit frum gnulib use g_ascii_islower instead of c_islower from gnulib use g_ascii_isprint instead of c_isprint from gnulib use g_ascii_isspace instead of c_isspace from gnulib use g_ascii_isxdigit instead of c_isxdigit from gnulib use g_ascii_tolower instead of c_tolower from gnulib use g_ascii_toupper instead of c_toupper from gnulib syntax-check: update c-type checks to refer to Glib bootstrap.conf: drop usage of c-type gnulib module bootstrap.conf | 1 - build-aux/syntax-check.mk | 11 ++--------- src/bhyve/bhyve_parse_command.c | 3 +-- src/conf/network_conf.c | 3 +-- src/conf/nwfilter_conf.c | 3 +-- src/interface/interface_backend_udev.c | 5 ++--- src/libxl/libxl_conf.c | 3 +-- src/node_device/node_device_udev.c | 3 +-- src/qemu/qemu_agent.c | 3 +-- src/qemu/qemu_domain.c | 3 +-- src/qemu/qemu_monitor.c | 3 +-- src/qemu/qemu_qapi.c | 4 +--- src/remote/remote_driver.c | 3 +-- src/rpc/virnetsocket.c | 3 +-- src/storage/parthelper.c | 5 ++--- src/util/virbitmap.c | 5 ++--- src/util/virconf.c | 18 +++++++++--------- src/util/virfile.c | 8 +++----- src/util/virhostcpu.c | 7 +++---- src/util/virkeyfile.c | 9 +++++---- src/util/virmacaddr.c | 11 +++++------ src/util/virnetdevvportprofile.c | 3 +-- src/util/virpidfile.c | 3 +-- src/util/virstoragefile.c | 3 +-- src/util/virstring.c | 13 ++++++------- src/util/virutil.c | 11 +++++------ src/util/viruuid.c | 9 ++++----- src/vmx/vmx.c | 8 +++----- tools/virsh-console.c | 3 +-- tools/virsh-domain.c | 3 +-- tools/vsh-table.c | 5 ++--- tools/vsh.c | 5 ++--- 32 files changed, 71 insertions(+), 109 deletions(-) -- 2.23.0

1 14

[libvirt] [PATCH 0/9] Batch removal of gnulib modules
by Peter Krempa 20 Nov '19

20 Nov '19

This is a series of patches collecting gnulib module removals. Patches from Jano and Pavel have alreadny my R-bs but at least one of my patches does not. Jano, I couldn't find your patch for removal of the mkostemp functions so please provide it. I'll push it later today once I get Jano's patch so that we have only one point of disruption. Ján Tomko (3): gnulib: remove use of 'byteswap' module gnulib: remove use of 'vsnprintf' module bootstrap: remove regex module Pavel Hrdina (4): bootstrap.conf: remove usage of snprintf gnulib module syntax-check: update of sprintf rule to mention g_snpritnf syntax-check: forbid usage of snprintf bootstrap.conf: drop c-strcasestr gnulib module Peter Krempa (2): gnulib: remove 'areadlink' module gnulib: Remove use of 'strsep' module bootstrap.conf | 7 ------- build-aux/syntax-check.mk | 12 ++++++++++-- po/POTFILES.in | 1 - src/qemu/qemu_monitor_json.c | 1 - 4 files changed, 10 insertions(+), 11 deletions(-) -- 2.23.0

2 16

[libvirt] [PATCH] bootstrap.conf: drop c-strcasestr gnulib module
by Pavel Hrdina 20 Nov '19

20 Nov '19

Last usage was removed by commit <41f88886198e231285cc813f8c0687c8ec5c9488> and commit <0f4d31720430b4e3735064cc0d8f88a1a438e154> forgot to drop include. Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- bootstrap.conf | 1 - src/qemu/qemu_monitor_json.c | 1 - 2 files changed, 2 deletions(-) diff --git a/bootstrap.conf b/bootstrap.conf index 4c784487e2..3eab6e1f3c 100644 --- a/bootstrap.conf +++ b/bootstrap.conf @@ -24,7 +24,6 @@ bind byteswap c-ctype c-strcase -c-strcasestr canonicalize-lgpl chown clock-time diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index 10f6a4cadc..fb662cb18b 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -40,7 +40,6 @@ #include "virprobe.h" #include "virstring.h" #include "cpu/cpu_x86.h" -#include "c-strcasestr.h" #include "virenum.h" #ifdef WITH_DTRACE_PROBES -- 2.23.0

3 2

[libvirt] [PATCH] qemu: Forcibly mknod() even if it exists
by Michal Privoznik 20 Nov '19

20 Nov '19

Another weird bug appeared concerning qemu namespaces. Basically the problem is as follows: 1) Issue an API that causes libvirt to create a node in domain's namespace, say /dev/sda with 8:0 as major:minor (the API can be attach-disk for instance). Or simply create the node from a console by hand. 2) Detach the disk from qemu. 3) Do something that makes /dev/sda change it's minor number. 4) Try to attach the disk again. The problem is, in a few cases - like disk-detach - we don't remove the corresponding /dev node from the mount namespace (because it may be used by some other disk's backing chain). But this creates a problem, because if the node changes its MAJ:MIN numbers we don't propagate the change into the domain's namespace. We do plain mknod() and ignore EEXIST which obviously is not enough because it doesn't guarantee that the node has updated MAJ:MIN pair. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1752978 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_domain.c | 25 +++++++++---------------- 1 file changed, 9 insertions(+), 16 deletions(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 262b74d1ab..f54b9b21ff 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -13203,16 +13203,14 @@ qemuDomainCreateDeviceRecursive(const char *device, allow_noent, ttl - 1) < 0) goto cleanup; } else if (isDev) { - if (create && - mknod(devicePath, sb.st_mode, sb.st_rdev) < 0) { - if (errno == EEXIST) { - ret = 0; - } else { + if (create) { + unlink(devicePath); + if (mknod(devicePath, sb.st_mode, sb.st_rdev) < 0) { virReportSystemError(errno, _("Failed to make device %s"), devicePath); + goto cleanup; } - goto cleanup; } } else if (isReg) { if (create && @@ -13996,17 +13994,12 @@ qemuDomainAttachDeviceMknodHelper(pid_t pid G_GNUC_UNUSED, } else if (isDev) { VIR_DEBUG("Creating dev %s (%d,%d)", data->file, major(data->sb.st_rdev), minor(data->sb.st_rdev)); + unlink(data->file); if (mknod(data->file, data->sb.st_mode, data->sb.st_rdev) < 0) { - /* Because we are not removing devices on hotunplug, or - * we might be creating part of backing chain that - * already exist due to a different disk plugged to - * domain, accept EEXIST. */ - if (errno != EEXIST) { - virReportSystemError(errno, - _("Unable to create device %s"), - data->file); - goto cleanup; - } + virReportSystemError(errno, + _("Unable to create device %s"), + data->file); + goto cleanup; } else { delDevice = true; } -- 2.23.0

2 4

[libvirt] [PATCH 0/4] qemu: block: implement optional removal of committed snapshot images
by Pavel Mores 20 Nov '19

20 Nov '19

Adds handling of the VIR_DOMAIN_BLOCK_COMMIT_DELETE flag to the qemu driver which previously just ignored it. This should fix a problem with the virsh blockcommit command where --delete did nothing. https://bugzilla.redhat.com/show_bug.cgi?id=1008350 Pavel Mores (4): qemu: block: propagate the delete flag to where it can actually be used qemu: block: use the delete flag to delete snapshot images if requested qemu: block: store the delete flag in libvirtd's status XML qemu: block: add unit test of storing the delete flag in status XML src/qemu/qemu_blockjob.c | 35 ++++++++++++++++++- src/qemu/qemu_blockjob.h | 4 ++- src/qemu/qemu_domain.c | 4 +++ src/qemu/qemu_driver.c | 5 +-- .../blockjob-blockdev-in.xml | 1 + 5 files changed, 45 insertions(+), 4 deletions(-) -- 2.21.0

1 5

[libvirt] [PATCH] lib: fix documentation typo in virDomainGetGuestInfo()
by Jonathon Jongsma 19 Nov '19

19 Nov '19

Signed-off-by: Jonathon Jongsma <jjongsma(a)redhat.com> --- src/libvirt-domain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c index 02622cb2ca..2d9c4061e2 100644 --- a/src/libvirt-domain.c +++ b/src/libvirt-domain.c @@ -12272,7 +12272,7 @@ virDomainSetVcpu(virDomainPtr domain, * "timezone.offset" - the offset to UTC in seconds as an int * * VIR_DOMAIN_GUEST_INFO_FILESYSTEM: - * Returns inforamtion about the filesystems within the domain. The typed + * Returns information about the filesystems within the domain. The typed * parameter keys are in this format: * * "fs.count" - the number of filesystems defined on this domain -- 2.21.0

3 2

Re: [libvirt] [PATCH 0/6] VFIO mdev aggregated resources handling
by Alex Williamson 19 Nov '19

19 Nov '19

On Thu, 24 Oct 2019 13:08:23 +0800 Zhenyu Wang <zhenyuw(a)linux.intel.com> wrote: > Hi, > > This is a refresh for previous send of this series. I got impression that > some SIOV drivers would still deploy their own create and config method so > stopped effort on this. But seems this would still be useful for some other > SIOV driver which may simply want capability to aggregate resources. So here's > refreshed series. > > Current mdev device create interface depends on fixed mdev type, which get uuid > from user to create instance of mdev device. If user wants to use customized > number of resource for mdev device, then only can create new mdev type for that > which may not be flexible. This requirement comes not only from to be able to > allocate flexible resources for KVMGT, but also from Intel scalable IO > virtualization which would use vfio/mdev to be able to allocate arbitrary > resources on mdev instance. More info on [1] [2] [3]. > > To allow to create user defined resources for mdev, it trys to extend mdev > create interface by adding new "aggregate=xxx" parameter following UUID, for > target mdev type if aggregation is supported, it can create new mdev device > which contains resources combined by number of instances, e.g > > echo "<uuid>,aggregate=10" > create > > VM manager e.g libvirt can check mdev type with "aggregation" attribute which > can support this setting. If no "aggregation" attribute found for mdev type, > previous behavior is still kept for one instance allocation. And new sysfs > attribute "aggregated_instances" is created for each mdev device to show allocated number. Given discussions we've had recently around libvirt interacting with mdev, I think that libvirt would rather have an abstract interface via mdevctl[1]. Therefore can you evaluate how mdevctl would support this creation extension? It seems like it would fit within the existing mdev and mdevctl framework if aggregation were simply a sysfs attribute for the device. For example, the mdevctl steps might look like this: mdevctl define -u UUID -p PARENT -t TYPE mdevctl modify -u UUID --addattr=mdev/aggregation --value=2 mdevctl start -u UUID When mdevctl starts the mdev, it will first create it using the existing mechanism, then apply aggregation attribute, which can consume the necessary additional instances from the parent device, or return an error, which would unwind and return a failure code to the caller (libvirt). I think the vendor driver would then have freedom to decide when the attribute could be modified, for instance it would be entirely reasonable to return -EBUSY if the user attempts to modify the attribute while the mdev device is in-use. Effectively aggregation simply becomes a standardized attribute with common meaning. Thoughts? [cc libvirt folks for their impression] Thanks, Alex [1] https://github.com/mdevctl/mdevctl > References: > [1] https://software.intel.com/en-us/download/intel-virtualization-technology-f… > [2] https://software.intel.com/en-us/download/intel-scalable-io-virtualization-… > [3] https://schd.ws/hosted_files/lc32018/00/LC3-SIOV-final.pdf > > Zhenyu Wang (6): > vfio/mdev: Add new "aggregate" parameter for mdev create > vfio/mdev: Add "aggregation" attribute for supported mdev type > vfio/mdev: Add "aggregated_instances" attribute for supported mdev > device > Documentation/driver-api/vfio-mediated-device.rst: Update for > vfio/mdev aggregation support > Documentation/ABI/testing/sysfs-bus-vfio-mdev: Update for vfio/mdev > aggregation support > drm/i915/gvt: Add new type with aggregation support > > Documentation/ABI/testing/sysfs-bus-vfio-mdev | 24 ++++++ > .../driver-api/vfio-mediated-device.rst | 23 ++++++ > drivers/gpu/drm/i915/gvt/gvt.c | 4 +- > drivers/gpu/drm/i915/gvt/gvt.h | 11 ++- > drivers/gpu/drm/i915/gvt/kvmgt.c | 53 ++++++++++++- > drivers/gpu/drm/i915/gvt/vgpu.c | 56 ++++++++++++- > drivers/vfio/mdev/mdev_core.c | 36 ++++++++- > drivers/vfio/mdev/mdev_private.h | 6 +- > drivers/vfio/mdev/mdev_sysfs.c | 79 ++++++++++++++++++- > include/linux/mdev.h | 19 +++++ > 10 files changed, 294 insertions(+), 17 deletions(-) >

4 6