- Devel - libvirt List Archives

[libvirt] [PATCH] tools: fix regression passing command with virt-login-shell
by Daniel P. Berrangé 30 Sep '19

30 Sep '19

It is documented that a command to run inside the container can be passed with the -c arg. virt-login-shell -c "ls -l /" This fixes commit 4feeb2d986b98013ebfb1d41ab6b9007b6cce6e2 Author: Daniel P. Berrangé <berrange(a)redhat.com> Date: Thu Aug 1 10:58:31 2019 +0100 tools: split virt-login-shell into two binaries Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- tools/virt-login-shell.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/tools/virt-login-shell.c b/tools/virt-login-shell.c index f92cc0a749..f5aa02420b 100644 --- a/tools/virt-login-shell.c +++ b/tools/virt-login-shell.c @@ -38,11 +38,13 @@ int main(int argc, char **argv) { char uidstr[INT_BUFSIZE_BOUND(uid_t)]; char gidstr[INT_BUFSIZE_BOUND(gid_t)]; - const char *const newargv[] = { + const char * newargv[] = { LIBEXECDIR "/virt-login-shell-helper", uidstr, gidstr, NULL, + NULL, + NULL, }; char *newenv[] = { NULL, @@ -60,8 +62,15 @@ int main(int argc, char **argv) { exit(EXIT_FAILURE); } - if (argc != 1) { - fprintf(stderr, "%s: no arguments expected\n", argv[0]); + if (argc == 3) { + if (strcmp(argv[1], "-c") != 0) { + fprintf(stderr, "%s: syntax: %s [-c CMDSTR]\n", argv[0], argv[0]); + exit(EXIT_FAILURE); + } + newargv[3] = argv[1]; + newargv[4] = argv[2]; + } else if (argc != 1) { + fprintf(stderr, "%s: syntax: %s [-c CMDSTR]\n", argv[0], argv[0]); exit(EXIT_FAILURE); } -- 2.21.0

2 1

[libvirt] [PATCH] network: allow DHCP/DNS/TFTP explicitly in OUTPUT rules
by Daniel P. Berrangé 28 Sep '19

28 Sep '19

From: Malina Salina <malina.salina(a)protonmail.com> While the default iptables setup used by Fedora/RHEL distros only restricts traffic on the INPUT and/or FORWARD rules, some users might have custom firewalls that restrict the OUTPUT rules too. These can prevent DHCP/DNS/TFTP responses from dnsmasq from reaching the guest VMs. We should thus whitelist these protocols in the OUTPUT chain, as well as the INPUT chain. Signed-off-by: Malina Salina <malina.salina(a)protonmail.com> Initial patch then modified to add unit tests and IPv6 support Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/libvirt_private.syms | 2 + src/network/bridge_driver_linux.c | 29 ++++++++++--- src/util/viriptables.c | 36 ++++++++++++++++ src/util/viriptables.h | 8 ++++ .../nat-default-linux.args | 21 ++++++++++ .../nat-ipv6-linux.args | 42 +++++++++++++++++++ .../nat-many-ips-linux.args | 21 ++++++++++ .../nat-no-dhcp-linux.args | 42 +++++++++++++++++++ .../nat-tftp-linux.args | 28 +++++++++++++ .../route-default-linux.args | 21 ++++++++++ 10 files changed, 244 insertions(+), 6 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 7b681fac64..83b97af364 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -2186,6 +2186,7 @@ iptablesAddForwardRejectIn; iptablesAddForwardRejectOut; iptablesAddOutputFixUdpChecksum; iptablesAddTcpInput; +iptablesAddTcpOutput; iptablesAddUdpInput; iptablesAddUdpOutput; iptablesRemoveDontMasquerade; @@ -2198,6 +2199,7 @@ iptablesRemoveForwardRejectIn; iptablesRemoveForwardRejectOut; iptablesRemoveOutputFixUdpChecksum; iptablesRemoveTcpInput; +iptablesRemoveTcpOutput; iptablesRemoveUdpInput; iptablesRemoveUdpOutput; iptablesSetDeletePrivate; diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_linux.c index 35459c10d1..0b6ff45b17 100644 --- a/src/network/bridge_driver_linux.c +++ b/src/network/bridge_driver_linux.c @@ -553,18 +553,23 @@ networkAddGeneralIPv4FirewallRules(virFirewallPtr fw, break; } - /* allow DHCP requests through to dnsmasq */ + /* allow DHCP requests through to dnsmasq & back out */ iptablesAddTcpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 67); iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 67); + iptablesAddTcpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 68); iptablesAddUdpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 68); - /* allow DNS requests through to dnsmasq */ + /* allow DNS requests through to dnsmasq & back out */ iptablesAddTcpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53); iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53); + iptablesAddTcpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53); + iptablesAddUdpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53); - /* allow TFTP requests through to dnsmasq if necessary */ - if (ipv4def && ipv4def->tftproot) + /* allow TFTP requests through to dnsmasq if necessary & back out*/ + if (ipv4def && ipv4def->tftproot) { iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 69); + iptablesAddUdpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 69); + } /* Catch all rules to block forwarding to/from bridges */ iptablesAddForwardRejectOut(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge); @@ -592,13 +597,18 @@ networkRemoveGeneralIPv4FirewallRules(virFirewallPtr fw, iptablesRemoveForwardRejectIn(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge); iptablesRemoveForwardRejectOut(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge); - if (ipv4def && ipv4def->tftproot) + if (ipv4def && ipv4def->tftproot) { iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 69); + iptablesRemoveUdpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 69); + } iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53); iptablesRemoveTcpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53); + iptablesRemoveUdpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53); + iptablesRemoveTcpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53); iptablesRemoveUdpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 68); + iptablesRemoveTcpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 68); iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 67); iptablesRemoveTcpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 67); } @@ -626,10 +636,14 @@ networkAddGeneralIPv6FirewallRules(virFirewallPtr fw, iptablesAddForwardAllowCross(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge); if (virNetworkDefGetIPByIndex(def, AF_INET6, 0)) { - /* allow DNS over IPv6 */ + /* allow DNS over IPv6 & back out */ iptablesAddTcpInput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53); iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53); + iptablesAddTcpOutput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53); + iptablesAddUdpOutput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53); + /* allow DHCPv6 & back out */ iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 547); + iptablesAddUdpOutput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 546); } } @@ -643,7 +657,10 @@ networkRemoveGeneralIPv6FirewallRules(virFirewallPtr fw, } if (virNetworkDefGetIPByIndex(def, AF_INET6, 0)) { + iptablesRemoveUdpOutput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 546); iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 547); + iptablesRemoveUdpOutput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53); + iptablesRemoveTcpOutput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53); iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53); iptablesRemoveTcpInput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53); } diff --git a/src/util/viriptables.c b/src/util/viriptables.c index 0e3c0ad73a..46d0c3df7a 100644 --- a/src/util/viriptables.c +++ b/src/util/viriptables.c @@ -303,6 +303,42 @@ iptablesRemoveUdpInput(virFirewallPtr fw, iptablesInput(fw, layer, deletePrivate, iface, port, REMOVE, 0); } +/** + * iptablesAddTcpOutput: + * @ctx: pointer to the IP table context + * @iface: the interface name + * @port: the TCP port to add + * + * Add an output to the IP table allowing access to the given @port from + * the given @iface interface for TCP packets + */ +void +iptablesAddTcpOutput(virFirewallPtr fw, + virFirewallLayer layer, + const char *iface, + int port) +{ + iptablesOutput(fw, layer, true, iface, port, ADD, 1); +} + +/** + * iptablesRemoveTcpOutput: + * @ctx: pointer to the IP table context + * @iface: the interface name + * @port: the UDP port to remove + * + * Removes an output from the IP table, hence forbidding access to the given + * @port from the given @iface interface for TCP packets + */ +void +iptablesRemoveTcpOutput(virFirewallPtr fw, + virFirewallLayer layer, + const char *iface, + int port) +{ + iptablesOutput(fw, layer, deletePrivate, iface, port, REMOVE, 1); +} + /** * iptablesAddUdpOutput: * @ctx: pointer to the IP table context diff --git a/src/util/viriptables.h b/src/util/viriptables.h index feea988acd..07b4851013 100644 --- a/src/util/viriptables.h +++ b/src/util/viriptables.h @@ -45,6 +45,14 @@ void iptablesRemoveUdpInput (virFirewallPtr fw, const char *iface, int port); +void iptablesAddTcpOutput (virFirewallPtr fw, + virFirewallLayer layer, + const char *iface, + int port); +void iptablesRemoveTcpOutput (virFirewallPtr fw, + virFirewallLayer layer, + const char *iface, + int port); void iptablesAddUdpOutput (virFirewallPtr fw, virFirewallLayer layer, const char *iface, diff --git a/tests/networkxml2firewalldata/nat-default-linux.args b/tests/networkxml2firewalldata/nat-default-linux.args index c9d523d043..ab18f30bd0 100644 --- a/tests/networkxml2firewalldata/nat-default-linux.args +++ b/tests/networkxml2firewalldata/nat-default-linux.args @@ -16,6 +16,13 @@ iptables \ --table filter \ --insert LIBVIRT_OUT \ --out-interface virbr0 \ +--protocol tcp \ +--destination-port 68 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ --protocol udp \ --destination-port 68 \ --jump ACCEPT @@ -35,6 +42,20 @@ iptables \ --jump ACCEPT iptables \ --table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol tcp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ --insert LIBVIRT_FWO \ --in-interface virbr0 \ --jump REJECT diff --git a/tests/networkxml2firewalldata/nat-ipv6-linux.args b/tests/networkxml2firewalldata/nat-ipv6-linux.args index a57b9266af..05d9ee33ca 100644 --- a/tests/networkxml2firewalldata/nat-ipv6-linux.args +++ b/tests/networkxml2firewalldata/nat-ipv6-linux.args @@ -16,6 +16,13 @@ iptables \ --table filter \ --insert LIBVIRT_OUT \ --out-interface virbr0 \ +--protocol tcp \ +--destination-port 68 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ --protocol udp \ --destination-port 68 \ --jump ACCEPT @@ -35,6 +42,20 @@ iptables \ --jump ACCEPT iptables \ --table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol tcp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ --insert LIBVIRT_FWO \ --in-interface virbr0 \ --jump REJECT @@ -81,11 +102,32 @@ ip6tables \ --jump ACCEPT ip6tables \ --table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol tcp \ +--destination-port 53 \ +--jump ACCEPT +ip6tables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 53 \ +--jump ACCEPT +ip6tables \ +--table filter \ --insert LIBVIRT_INP \ --in-interface virbr0 \ --protocol udp \ --destination-port 547 \ --jump ACCEPT +ip6tables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 546 \ +--jump ACCEPT iptables \ --table filter \ --insert LIBVIRT_FWO \ diff --git a/tests/networkxml2firewalldata/nat-many-ips-linux.args b/tests/networkxml2firewalldata/nat-many-ips-linux.args index 1bdc43fd6a..82e1380f51 100644 --- a/tests/networkxml2firewalldata/nat-many-ips-linux.args +++ b/tests/networkxml2firewalldata/nat-many-ips-linux.args @@ -16,6 +16,13 @@ iptables \ --table filter \ --insert LIBVIRT_OUT \ --out-interface virbr0 \ +--protocol tcp \ +--destination-port 68 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ --protocol udp \ --destination-port 68 \ --jump ACCEPT @@ -35,6 +42,20 @@ iptables \ --jump ACCEPT iptables \ --table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol tcp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ --insert LIBVIRT_FWO \ --in-interface virbr0 \ --jump REJECT diff --git a/tests/networkxml2firewalldata/nat-no-dhcp-linux.args b/tests/networkxml2firewalldata/nat-no-dhcp-linux.args index 7d359f3824..8954cc5473 100644 --- a/tests/networkxml2firewalldata/nat-no-dhcp-linux.args +++ b/tests/networkxml2firewalldata/nat-no-dhcp-linux.args @@ -16,6 +16,13 @@ iptables \ --table filter \ --insert LIBVIRT_OUT \ --out-interface virbr0 \ +--protocol tcp \ +--destination-port 68 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ --protocol udp \ --destination-port 68 \ --jump ACCEPT @@ -35,6 +42,20 @@ iptables \ --jump ACCEPT iptables \ --table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol tcp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ --insert LIBVIRT_FWO \ --in-interface virbr0 \ --jump REJECT @@ -81,11 +102,32 @@ ip6tables \ --jump ACCEPT ip6tables \ --table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol tcp \ +--destination-port 53 \ +--jump ACCEPT +ip6tables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 53 \ +--jump ACCEPT +ip6tables \ +--table filter \ --insert LIBVIRT_INP \ --in-interface virbr0 \ --protocol udp \ --destination-port 547 \ --jump ACCEPT +ip6tables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 546 \ +--jump ACCEPT iptables \ --table filter \ --insert LIBVIRT_FWO \ diff --git a/tests/networkxml2firewalldata/nat-tftp-linux.args b/tests/networkxml2firewalldata/nat-tftp-linux.args index b721801b70..88e9929b62 100644 --- a/tests/networkxml2firewalldata/nat-tftp-linux.args +++ b/tests/networkxml2firewalldata/nat-tftp-linux.args @@ -16,6 +16,13 @@ iptables \ --table filter \ --insert LIBVIRT_OUT \ --out-interface virbr0 \ +--protocol tcp \ +--destination-port 68 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ --protocol udp \ --destination-port 68 \ --jump ACCEPT @@ -35,6 +42,20 @@ iptables \ --jump ACCEPT iptables \ --table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol tcp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ --insert LIBVIRT_INP \ --in-interface virbr0 \ --protocol udp \ @@ -42,6 +63,13 @@ iptables \ --jump ACCEPT iptables \ --table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 69 \ +--jump ACCEPT +iptables \ +--table filter \ --insert LIBVIRT_FWO \ --in-interface virbr0 \ --jump REJECT diff --git a/tests/networkxml2firewalldata/route-default-linux.args b/tests/networkxml2firewalldata/route-default-linux.args index ed3c560f74..c427d9602d 100644 --- a/tests/networkxml2firewalldata/route-default-linux.args +++ b/tests/networkxml2firewalldata/route-default-linux.args @@ -16,6 +16,13 @@ iptables \ --table filter \ --insert LIBVIRT_OUT \ --out-interface virbr0 \ +--protocol tcp \ +--destination-port 68 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ --protocol udp \ --destination-port 68 \ --jump ACCEPT @@ -35,6 +42,20 @@ iptables \ --jump ACCEPT iptables \ --table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol tcp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ --insert LIBVIRT_FWO \ --in-interface virbr0 \ --jump REJECT -- 2.21.0

2 1

[libvirt] [PATCH v2] tools: fix regression passing command with virt-login-shell
by Daniel P. Berrangé 28 Sep '19

28 Sep '19

It is documented that a command to run inside the container can be passed with the -c arg. virt-login-shell -c "ls -l /" This fixes commit 4feeb2d986b98013ebfb1d41ab6b9007b6cce6e2 Author: Daniel P. Berrangé <berrange(a)redhat.com> Date: Thu Aug 1 10:58:31 2019 +0100 tools: split virt-login-shell into two binaries Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- tools/virt-login-shell.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/tools/virt-login-shell.c b/tools/virt-login-shell.c index f92cc0a749..7d1e0ccc8a 100644 --- a/tools/virt-login-shell.c +++ b/tools/virt-login-shell.c @@ -38,12 +38,8 @@ int main(int argc, char **argv) { char uidstr[INT_BUFSIZE_BOUND(uid_t)]; char gidstr[INT_BUFSIZE_BOUND(gid_t)]; - const char *const newargv[] = { - LIBEXECDIR "/virt-login-shell-helper", - uidstr, - gidstr, - NULL, - }; + const char * newargv[6]; + size_t nargs = 0; char *newenv[] = { NULL, NULL, @@ -60,10 +56,23 @@ int main(int argc, char **argv) { exit(EXIT_FAILURE); } - if (argc != 1) { - fprintf(stderr, "%s: no arguments expected\n", argv[0]); + newargv[nargs++] = LIBEXECDIR "/virt-login-shell-helper"; + if (argc == 3) { + if (strcmp(argv[1], "-c") != 0) { + fprintf(stderr, "%s: syntax: %s [-c CMDSTR]\n", argv[0], argv[0]); + exit(EXIT_FAILURE); + } + newargv[nargs++] = argv[1]; + newargv[nargs++] = argv[2]; + } else if (argc != 1) { + fprintf(stderr, "%s: syntax: %s [-c CMDSTR]\n", argv[0], argv[0]); exit(EXIT_FAILURE); } + newargv[nargs++] = uidstr; + newargv[nargs++] = gidstr; + newargv[nargs++] = NULL; + + assert(nargs <= (sizeof(newargv)/sizeof(newargv[0]))); if (term && asprintf(&(newenv[0]), "TERM=%s", term) < 0) { -- 2.21.0

2 1

[libvirt] [PATCH 0/2] Fix cgroupv2 issue on Fedora 31
by Cole Robinson 27 Sep '19

27 Sep '19

There's been a bunch of reports of VM startup failures on Fedora 31 and elsewhere: https://bugzilla.redhat.com/show_bug.cgi?id=1751120 The reproducer I found is running a mock build, which adds a name=systemd cgroup to /proc/self/cgroup, which messes up libvirt's logic. The first patch has a bit more detail. I'm not positive this is entirely correct... maybe we should be doing something with that cgroup in some way? I'm kinda ignorant here. I also filed a systemd bug incase that behavior is unintentional. We probably want to change libvirt regardless though https://bugzilla.redhat.com/show_bug.cgi?id=1756143 Cole Robinson (2): vircgroupv2: Fix VM startup when legacy cgroups are defined vircgroup: Add some VIR_DEBUG statements src/util/vircgroup.c | 3 ++- src/util/vircgroupv2.c | 15 ++++++++++++++- 2 files changed, 16 insertions(+), 2 deletions(-) -- 2.23.0

2 5

[libvirt] [PATCH v2 0/7] qemu: checkpoints: Collect most code in a single place
by Peter Krempa 27 Sep '19

27 Sep '19

The checkpoint code is quite complex and was dispersed in many places. Refactor it to be in one new separate file. I also plan to do the same to the snapshot code once this is dealt with. Additionally aggregating all the code in one place will allow refactoring and reuse in the incremental backup implementation. diff to v1: - rebased on top of the patches to remove checking of AUTODESTROY - kept only one instance of virCheckFlags per API (inside qemu_checkpoint.c) Peter Krempa (7): qemu: Move, rename and export qemuDomObjFromDomain conf: Drop pointless 'domain' argument from virDomainCheckpointRedefinePrep conf: Drop pointless 'domain' argument from virDomainSnapshotRedefinePrep qemu: driver: Remove misplaced qemuDomainObjEndJob in qemuDomainCheckpointGetXMLDesc qemu: driver: Move checkpoint-related code to qemu_checkpoint.c qemu: domain: Move checkpoint related code to qemu_checkpoint.c qemu: driver: Don't pull in qemu_monitor_json.h directly src/conf/checkpoint_conf.c | 7 +- src/conf/checkpoint_conf.h | 3 +- src/conf/snapshot_conf.c | 5 +- src/conf/snapshot_conf.h | 3 +- src/qemu/Makefile.inc.am | 2 + src/qemu/qemu_checkpoint.c | 646 ++++++++++++++++++++++++++++++++++ src/qemu/qemu_checkpoint.h | 55 +++ src/qemu/qemu_domain.c | 193 ++--------- src/qemu/qemu_domain.h | 16 +- src/qemu/qemu_driver.c | 689 ++++++++----------------------------- src/test/test_driver.c | 4 +- 11 files changed, 887 insertions(+), 736 deletions(-) create mode 100644 src/qemu/qemu_checkpoint.c create mode 100644 src/qemu/qemu_checkpoint.h -- 2.21.0

3 16

[libvirt] [PATCH 0/8] qemu: Lock-out checkpoints until backups are ready
by Peter Krempa 27 Sep '19

27 Sep '19

See patch 6/8 for the reasoning. This series applies on top of the v2 of splitting checkpoints into a separate file. Peter Krempa (8): qemu: checkpoint: Refactor cleanup in qemuCheckpointCreateXML qemu: checkpoint: Remove open-ended TODOs qemu: Simplify argument list of qemuDomainBlockPullCommon qemu: Don't repeat virDomainObjEndAPI in qemuDomainBlockPull qemu: caps: Add capability for incremental backup support qemu: checkpoint: Forbid creating checkpoints until we support backups qemu: Aggregate interlocking of blockjobs by checkpoints in one place qemu: domain: Base block job interlocking on QEMU_CAPS_INCREMENTAL_BACKUP src/qemu/qemu_capabilities.c | 3 +++ src/qemu/qemu_capabilities.h | 3 +++ src/qemu/qemu_checkpoint.c | 42 +++++++++++++----------------- src/qemu/qemu_domain.c | 24 +++++++++++++++++ src/qemu/qemu_domain.h | 4 +++ src/qemu/qemu_driver.c | 50 +++++++++++++----------------------- 6 files changed, 70 insertions(+), 56 deletions(-) -- 2.21.0

2 15

[libvirt] [PATCH] remote: fix systemd IP socket activation with virtproxyd
by Daniel P. Berrangé 27 Sep '19

27 Sep '19

We recently forbid the use of --listen with socket activation: commit 3a6a725b8f575890ee6c151ad1f46ea0ceea1f3b Author: Daniel P. Berrangé <berrange(a)redhat.com> Date: Thu Aug 22 14:52:16 2019 +0100 remote: forbid the --listen arg when systemd socket activation In this change we forgot that virtproxyd doesn't have a --listen parameter, and instead behaves as if it was always present. Thus when systemd socket activation is present, we must disable this built-in default Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/remote/remote_daemon.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/remote/remote_daemon.c b/src/remote/remote_daemon.c index 7195ac9218..43409edd24 100644 --- a/src/remote/remote_daemon.c +++ b/src/remote/remote_daemon.c @@ -423,11 +423,20 @@ daemonSetupNetworking(virNetServerPtr srv, return -1; #ifdef WITH_IP +# ifdef (LIBVIRTD if (act && ipsock) { VIR_ERROR(_("--listen parameter not permitted with systemd activation " "sockets, see 'man libvirtd' for further guidance")); return -1; } +# else /* ! LIBVIRTD */ + /* We don't have a --listen arg with virtproxyd, we're just + * hardcoded to assume --listen. Thus with systemd we must + * change that default + */ + if (act) + ipsock = 0; +# endif /* ! LIBVIRTD */ #endif /* ! WITH_IP */ if (config->unix_sock_group) { -- 2.21.0

2 5

[libvirt] [PATCH] qemu_monitor: s/size_t/ULL/ in qemuMonitorSave{Virtual, Physical}Memory
by Michal Privoznik 27 Sep '19

27 Sep '19

As it turns out, on my 32bit ARM machine size_t is not the same size as ULL. However, @length argument for both functions is type of size_t but it's treated as ULL - for instance when passed to qemuMonitorJSONMakeCommand(). The problem is that because of "U:size" the virJSONValueObjectAddVArgs() expects an ULL argument but on the stack there are size_t and char * arguments (which coincidentally add up to size of ULL). So the created command has only two arguments "val" and incorrect "size" and no "path" which is required. I've tried to find other occurrences of this pattern but at the rest of places where size_t is used it tracks size of an array so that's safe. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_monitor.c | 8 ++++---- src/qemu/qemu_monitor.h | 4 ++-- src/qemu/qemu_monitor_json.c | 6 +++--- src/qemu/qemu_monitor_json.h | 4 ++-- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index b6d2936872..7959933e7c 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -2348,10 +2348,10 @@ qemuMonitorChangeMedia(qemuMonitorPtr mon, int qemuMonitorSaveVirtualMemory(qemuMonitorPtr mon, unsigned long long offset, - size_t length, + unsigned long long length, const char *path) { - VIR_DEBUG("offset=%llu length=%zu path=%s", offset, length, path); + VIR_DEBUG("offset=%llu length=%llu path=%s", offset, length, path); QEMU_CHECK_MONITOR(mon); @@ -2362,10 +2362,10 @@ qemuMonitorSaveVirtualMemory(qemuMonitorPtr mon, int qemuMonitorSavePhysicalMemory(qemuMonitorPtr mon, unsigned long long offset, - size_t length, + unsigned long long length, const char *path) { - VIR_DEBUG("offset=%llu length=%zu path=%s", offset, length, path); + VIR_DEBUG("offset=%llu length=%llu path=%s", offset, length, path); QEMU_CHECK_MONITOR(mon); diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h index 8fc11c955e..95de891150 100644 --- a/src/qemu/qemu_monitor.h +++ b/src/qemu/qemu_monitor.h @@ -726,11 +726,11 @@ int qemuMonitorChangeMedia(qemuMonitorPtr mon, int qemuMonitorSaveVirtualMemory(qemuMonitorPtr mon, unsigned long long offset, - size_t length, + unsigned long long length, const char *path); int qemuMonitorSavePhysicalMemory(qemuMonitorPtr mon, unsigned long long offset, - size_t length, + unsigned long long length, const char *path); int qemuMonitorSetMigrationSpeed(qemuMonitorPtr mon, diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index cdfaf9785a..d99d291d89 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -3100,7 +3100,7 @@ int qemuMonitorJSONChangeMedia(qemuMonitorPtr mon, static int qemuMonitorJSONSaveMemory(qemuMonitorPtr mon, const char *cmdtype, unsigned long long offset, - size_t length, + unsigned long long length, const char *path) { int ret = -1; @@ -3129,7 +3129,7 @@ static int qemuMonitorJSONSaveMemory(qemuMonitorPtr mon, int qemuMonitorJSONSaveVirtualMemory(qemuMonitorPtr mon, unsigned long long offset, - size_t length, + unsigned long long length, const char *path) { return qemuMonitorJSONSaveMemory(mon, "memsave", offset, length, path); @@ -3137,7 +3137,7 @@ int qemuMonitorJSONSaveVirtualMemory(qemuMonitorPtr mon, int qemuMonitorJSONSavePhysicalMemory(qemuMonitorPtr mon, unsigned long long offset, - size_t length, + unsigned long long length, const char *path) { return qemuMonitorJSONSaveMemory(mon, "pmemsave", offset, length, path); diff --git a/src/qemu/qemu_monitor_json.h b/src/qemu/qemu_monitor_json.h index a608410703..63f569716d 100644 --- a/src/qemu/qemu_monitor_json.h +++ b/src/qemu/qemu_monitor_json.h @@ -118,11 +118,11 @@ int qemuMonitorJSONChangeMedia(qemuMonitorPtr mon, int qemuMonitorJSONSaveVirtualMemory(qemuMonitorPtr mon, unsigned long long offset, - size_t length, + unsigned long long length, const char *path); int qemuMonitorJSONSavePhysicalMemory(qemuMonitorPtr mon, unsigned long long offset, - size_t length, + unsigned long long length, const char *path); int qemuMonitorJSONSetMigrationSpeed(qemuMonitorPtr mon, -- 2.21.0

2 1

Re: [libvirt] [PATCH] i386: Re-add "pconfig" CPUID flag name
by Eduardo Habkost 27 Sep '19

27 Sep '19

(CCing libvir-list) On Thu, Sep 26, 2019 at 11:58:30PM +0200, Paolo Bonzini wrote: > Is this really needed? QEMU's value of pconfig=on vs. off should be > provided by QMP CPU model queries, if a property is not available then > Libvirt should not try to set it to off. > Libvirt can easily work around it for new VMs, and it should. The issue are VMs that were created with QEMU 3.1.0. QEMU 3.1.0 was telling libvirt "Icelake-Server can't be used unless pconfig=off is used", and libvirt was adding pconfig=off to the domain XML as expected. It would be wrong for libvirt to remove a device option when migrating an existing VM to another QEMU version. We can change the rules (and document that), but do we want to? > Paolo > > Il gio 26 set 2019, 23:23 Eduardo Habkost <ehabkost(a)redhat.com> ha scritto: > > > QEMU 3.1.0 was shipped with the "pconfig" CPU property available, > > added by commit 5131dc433df5 ("i386: Add CPUID bit for PCONFIG"). > > > > Then the feature was removed in QEMU 4.0.0 (and 3.1.1), by commit > > 712f807e1965 ("Revert 'i386: Add CPUID bit for PCONFIG'"). > > > > In theory this would be OK, but we do have a problem: existing > > software (like libvirt) was already using "pconfig=off" since > > QEMU 3.1.0 on some cases. This means software that worked with > > QEMU 3.1.0 doesn't work with QEMU 3.1.1 and newer. > > > > One symptom is the following error being generated by > > virt-install while trying to use the 'host-model' CPU model, on a > > host that's identified as Icelake-Server: > > > > ERROR internal error: qemu unexpectedly closed the monitor: \ > > 2019-09-24T22:57:42.550032Z qemu-kvm: \ > > can't apply global Icelake-Server-x86_64-cpu.pconfig=off: Property > > '.pconfig' not found > > > > Re-add "pconfig" to feature_word_info[FEAT_7_0_EDX].feat_names so > > "pconfig=off" will work again. > > > > This change still won't let users set "monitor=on" because all > > accelerators currently report the feature as unsupported. But to > > make sure PCONFIG won't be enabled by accident in the future > > before we implement the necessary migration code, also add the > > feature to .unmigratable_flags. > > > > Fixes: 712f807e1965 ("Revert 'i386: Add CPUID bit for PCONFIG'") > > Signed-off-by: Eduardo Habkost <ehabkost(a)redhat.com> > > --- > > target/i386/cpu.h | 2 ++ > > target/i386/cpu.c | 8 +++++++- > > 2 files changed, 9 insertions(+), 1 deletion(-) > > > > diff --git a/target/i386/cpu.h b/target/i386/cpu.h > > index 8e090acd74..b728bd22f1 100644 > > --- a/target/i386/cpu.h > > +++ b/target/i386/cpu.h > > @@ -731,6 +731,8 @@ typedef uint32_t FeatureWordArray[FEATURE_WORDS]; > > #define CPUID_7_0_EDX_AVX512_4VNNIW (1U << 2) > > /* AVX512 Multiply Accumulation Single Precision */ > > #define CPUID_7_0_EDX_AVX512_4FMAPS (1U << 3) > > +/* PCONFIG Instruction */ > > +#define CPUID_7_0_EDX_PCONFIG (1U << 18) > > /* Speculation Control */ > > #define CPUID_7_0_EDX_SPEC_CTRL (1U << 26) > > /* Arch Capabilities */ > > diff --git a/target/i386/cpu.c b/target/i386/cpu.c > > index 71034aeb5a..3e25505bd3 100644 > > --- a/target/i386/cpu.c > > +++ b/target/i386/cpu.c > > @@ -1084,7 +1084,7 @@ static FeatureWordInfo > > feature_word_info[FEATURE_WORDS] = { > > NULL, NULL, NULL, NULL, > > NULL, NULL, "md-clear", NULL, > > NULL, NULL, NULL, NULL, > > - NULL, NULL, NULL /* pconfig */, NULL, > > + NULL, NULL, "pconfig", NULL, > > NULL, NULL, NULL, NULL, > > NULL, NULL, "spec-ctrl", "stibp", > > NULL, "arch-capabilities", "core-capability", "ssbd", > > @@ -1095,6 +1095,12 @@ static FeatureWordInfo > > feature_word_info[FEATURE_WORDS] = { > > .reg = R_EDX, > > }, > > .tcg_features = TCG_7_0_EDX_FEATURES, > > + /* > > + * CPU state altered by the PCONFIG instruction (e.g. MKTME key > > table) > > + * is not migrated by QEMU yet, so PCONFIG is unmigratable until > > + * this is implemented. > > + */ > > + .unmigratable_flags = CPUID_7_0_EDX_PCONFIG, > > }, > > [FEAT_7_1_EAX] = { > > .type = CPUID_FEATURE_WORD, > > -- > > 2.21.0 > > > > -- Eduardo

2 2

[libvirt] [PATCH v3 00/22] scripts: convert most perl scripts to python
by Daniel P. Berrangé 27 Sep '19

27 Sep '19

This series is an effort to reduce the number of different languages we use by eliminating most use of perl in favour of python. This aligns with fact that the likely future build system we'll use (meson) is written in python, and that python is much more commonly used/understood by developers these days than perl. With this applied we use perl in a handful of places only: - src/rpc/gendispatch.pl - this is a horrendously large script and very hard to understand/follow. A straight syntax conversion to Python would still leave a hgue and hard to understand/follow script. It really needs a clean room rewrite from scratch, with better structure. - src/rpc/genprotocol.pl - fairly easy to convert, but might be obsolete depending on approach for rewriting gendispatch.pl, so ignored for now - tests/oomtrace.pl - will be purge by the patches that drop OOM handling anyway - tools/wireshark/util/genxdrstub.pl - a very large script, which I haven't got the courage to tackle yet. - cfg.mk/maint.mk - many syntax rules involve regexes which are fed to perl. Decision on what to do with syntax-check rules punted to another time. - build-aux/gitlog-to-changelog - build-aux/useless-if-before-free - Both pulled in from gnulib. Could be rewritten quite easily if desired, but given that we aren't maintainers of them right now, they're ignored as they don't really impact our developers. In v3: - All scripts comply with all flake8 style rules with exception of E129 visually indented line with same indent as next logical line In v2: - Pulled in patch to hacking file - Converted many more scripts - Forced UTF-8 character set to avoid ascii codec on py3 < 3.7 Daniel P. Berrangé (22): docs: document that C & Python are the preferred languages build-aux: rewrite augest test generator in Python build-aux: rewrite po file minimizer in Python build-aux: rewrite duplicate header checker in Python build-aux: rewrite whitespace checker in Python build-aux: rewrite mock inline checker in Python build-aux: rewrite header ifdef checker in Python src: rewrite ACL permissions checker in Python src: rewrite symfile sorting checker in Python src: rewrite symfile library checker in Python src: rewrite systemtap probe generator in Python src: rewrite systemtap function generator in Python src: rewrite driver name checker in Python src: rewrite driver impl checker in Python src: rewrite ACL rule checker in Python src: rewrite polkit ACL generator in Python src: rewrite remote protocol checker in Python tests: rewrite test argv line wrapper in Python tests: rewrite qemu capability grouper in Python tests: rewrite file access checker in Python docs: rewrite hvsupport.html page generator in python docs: rewrite polkit docs generator in Python Makefile.am | 12 +- build-aux/augeas-gentest.pl | 60 --- build-aux/augeas-gentest.py | 72 ++++ build-aux/check-spacing.pl | 198 ---------- build-aux/check-spacing.py | 229 +++++++++++ build-aux/header-ifdef.pl | 182 --------- build-aux/header-ifdef.py | 231 +++++++++++ build-aux/minimize-po.pl | 37 -- build-aux/minimize-po.py | 60 +++ build-aux/mock-noinline.pl | 75 ---- build-aux/mock-noinline.py | 89 +++++ build-aux/prohibit-duplicate-header.pl | 26 -- build-aux/prohibit-duplicate-header.py | 57 +++ cfg.mk | 30 +- docs/Makefile.am | 14 +- docs/genaclperms.pl | 125 ------ docs/genaclperms.py | 123 ++++++ docs/hacking.html.in | 30 ++ docs/hvsupport.pl | 458 ---------------------- docs/hvsupport.py | 516 +++++++++++++++++++++++++ po/Makefile.am | 2 +- src/Makefile.am | 156 +++----- src/access/Makefile.inc.am | 7 +- src/access/genpolkit.pl | 119 ------ src/access/genpolkit.py | 122 ++++++ src/bhyve/Makefile.inc.am | 4 +- src/check-aclperms.pl | 73 ---- src/check-aclperms.py | 78 ++++ src/check-aclrules.pl | 252 ------------ src/check-aclrules.py | 263 +++++++++++++ src/check-driverimpls.pl | 80 ---- src/check-driverimpls.py | 102 +++++ src/check-drivername.pl | 83 ---- src/check-drivername.py | 114 ++++++ src/check-remote-protocol.py | 137 +++++++ src/check-symfile.pl | 70 ---- src/check-symfile.py | 81 ++++ src/check-symsorting.pl | 106 ----- src/check-symsorting.py | 119 ++++++ src/dtrace2systemtap.pl | 130 ------- src/dtrace2systemtap.py | 143 +++++++ src/interface/Makefile.inc.am | 2 +- src/libxl/Makefile.inc.am | 4 +- src/locking/Makefile.inc.am | 6 +- src/logging/Makefile.inc.am | 2 +- src/lxc/Makefile.inc.am | 4 +- src/network/Makefile.inc.am | 2 +- src/node_device/Makefile.inc.am | 2 +- src/nwfilter/Makefile.inc.am | 2 +- src/qemu/Makefile.inc.am | 4 +- src/remote/Makefile.inc.am | 4 +- src/rpc/Makefile.inc.am | 2 +- src/rpc/gensystemtap.pl | 193 --------- src/rpc/gensystemtap.py | 184 +++++++++ src/secret/Makefile.inc.am | 2 +- src/storage/Makefile.inc.am | 2 +- src/vbox/Makefile.inc.am | 2 +- src/vz/Makefile.inc.am | 2 +- tests/Makefile.am | 4 +- tests/check-file-access.pl | 126 ------ tests/check-file-access.py | 123 ++++++ tests/file_access_whitelist.txt | 2 +- tests/group-qemu-caps.pl | 124 ------ tests/group-qemu-caps.py | 123 ++++++ tests/test-wrap-argv.pl | 174 --------- tests/test-wrap-argv.py | 170 ++++++++ tests/testutils.c | 16 +- 67 files changed, 3283 insertions(+), 2863 deletions(-) delete mode 100755 build-aux/augeas-gentest.pl create mode 100755 build-aux/augeas-gentest.py delete mode 100755 build-aux/check-spacing.pl create mode 100755 build-aux/check-spacing.py delete mode 100644 build-aux/header-ifdef.pl create mode 100644 build-aux/header-ifdef.py delete mode 100755 build-aux/minimize-po.pl create mode 100755 build-aux/minimize-po.py delete mode 100644 build-aux/mock-noinline.pl create mode 100644 build-aux/mock-noinline.py delete mode 100644 build-aux/prohibit-duplicate-header.pl create mode 100644 build-aux/prohibit-duplicate-header.py delete mode 100755 docs/genaclperms.pl create mode 100755 docs/genaclperms.py delete mode 100755 docs/hvsupport.pl create mode 100755 docs/hvsupport.py delete mode 100755 src/access/genpolkit.pl create mode 100755 src/access/genpolkit.py delete mode 100755 src/check-aclperms.pl create mode 100755 src/check-aclperms.py delete mode 100755 src/check-aclrules.pl create mode 100755 src/check-aclrules.py delete mode 100755 src/check-driverimpls.pl create mode 100755 src/check-driverimpls.py delete mode 100755 src/check-drivername.pl create mode 100644 src/check-drivername.py create mode 100644 src/check-remote-protocol.py delete mode 100755 src/check-symfile.pl create mode 100755 src/check-symfile.py delete mode 100755 src/check-symsorting.pl create mode 100755 src/check-symsorting.py delete mode 100755 src/dtrace2systemtap.pl create mode 100755 src/dtrace2systemtap.py delete mode 100755 src/rpc/gensystemtap.pl create mode 100755 src/rpc/gensystemtap.py delete mode 100755 tests/check-file-access.pl create mode 100755 tests/check-file-access.py delete mode 100755 tests/group-qemu-caps.pl create mode 100755 tests/group-qemu-caps.py delete mode 100755 tests/test-wrap-argv.pl create mode 100755 tests/test-wrap-argv.py -- 2.21.0

6 46