- Devel - libvirt List Archives

[libvirt] [PATCH 0/7] Support rng backend model 'builtin'
by Han Han 07 Jan '20

07 Jan '20

https://bugzilla.redhat.com/show_bug.cgi?id=1785091 This rng backend is added since QEMU 4.2. It uses getrandom() syscall to generate random instread of external rng source. QEMU bug reference: https://bugzilla.redhat.com/show_bug.cgi?id=1689946 Han Han (7): qemu_capabilities: Introduce QEMU_CAPS_OBJECT_RNG_BUILTIN util: Do not assume comma after object id qemu: Implement builtin rng backend docs: Add schemas for rng backend builtin tests: Add tests fr virtio-rng backend builtin docs: Documents for virtio-rng backend builtin news: Update news for rng backend type builtin docs/formatdomain.html.in | 10 ++++++ docs/formatdomaincaps.html.in | 1 + docs/news.xml | 10 ++++++ docs/schemas/domaincommon.rng | 6 ++++ src/conf/domain_audit.c | 2 ++ src/conf/domain_conf.c | 9 ++++++ src/conf/domain_conf.h | 1 + src/qemu/qemu_capabilities.c | 4 +++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 15 +++++++++ src/qemu/qemu_domain.c | 3 ++ src/util/virqemu.c | 13 ++++---- .../domaincapsdata/qemu_4.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_4.2.0-tcg.x86_64.xml | 1 + .../qemu_4.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_4.2.0.x86_64.xml | 1 + .../caps_4.2.0.aarch64.xml | 1 + .../qemucapabilitiesdata/caps_4.2.0.ppc64.xml | 1 + .../qemucapabilitiesdata/caps_4.2.0.s390x.xml | 1 + .../caps_4.2.0.x86_64.xml | 1 + .../qemuxml2argvdata/virtio-rng-builtin.args | 30 ++++++++++++++++++ tests/qemuxml2argvdata/virtio-rng-builtin.xml | 26 ++++++++++++++++ tests/qemuxml2argvtest.c | 3 ++ .../qemuxml2xmloutdata/virtio-rng-builtin.xml | 31 +++++++++++++++++++ tests/qemuxml2xmltest.c | 2 ++ 28 files changed, 172 insertions(+), 6 deletions(-) create mode 100644 tests/qemuxml2argvdata/virtio-rng-builtin.args create mode 100644 tests/qemuxml2argvdata/virtio-rng-builtin.xml create mode 100644 tests/qemuxml2xmloutdata/virtio-rng-builtin.xml -- 2.23.0

2 17

[libvirt] Xen + libvirt + TPM
by Arthur Borsboom 07 Jan '20

07 Jan '20

Hello, I am trying to get TPM 2.0 pass through to work with Xen and libvirt, but I can't get it to work. According to the following sites both Xen and libirt have TPM 2.0 support. https://wiki.xen.org/wiki/Virtual_Trusted_Platform_Module_(vTPM) https://libvirt.org/formatdomain.html#elementsTpm However, when I add a TPM device to a VM (by virt-manager), the VM guest XML does contain the TPM configuration, but the VM guest (linux) does not show any TPM device. Also, when looking in /var/log/libvirt/libxl/vmguest.log there is no mention of tpm in the (converted libvirt XML to libxl) vm structure. Is this because libvirt only supports TPM with QEMU? If so, are there any development plans for TPM support with XEN? Is there a workaround for the time being? Best regards, Arthur Borsboom.

2 1

[libvirt] [PATCHv2 0/2] Introduce the support of Intel RDT-MBM
by Wang Huaqiang 07 Jan '20

07 Jan '20

This is a followup to Daniel's review in thread https://www.redhat.com/archives/libvir-list/2019-December/msg00978.html. Hi Daniel, In this series, patch 1/2 is trying to fix a bug that using the 64bit, instead of the current 32bit, interface, to hold cache monitor value reported by underlying 64bit counter. In last series, you have suggested of adding a new field such as "cpu.cache.monitor.%zu.bank.%zu.bytes64" for new 64bit counter result, and keep the old but already exported 32bit field, to avoid reporting a truncated cache monitor result to user. But considering the fact that, in reality, CPU cache size will never exceed 4GB in size, it is safe to truccate a 64bit counter to 32 bit since the counter is counting for the cache size that vcpus are using. Change List: v2: * Using old "cpu.cache.monitor.%zu.bank.%zu.bytes" field for cache monitor result, and keeping the interface consistent. * Add 'virsh domstats --memory' document in file 'virsh.rst' Wang Huaqiang (2): util, resctrl: using 64bit interface instead of 32bit for counters Introduce command 'virsh domstats --memory' for reporting memory BW docs/manpages/virsh.rst | 22 +++++- include/libvirt/libvirt-domain.h | 1 + src/libvirt-domain.c | 21 ++++++ src/qemu/qemu_driver.c | 118 ++++++++++++++++++++++++++++++- src/util/virfile.c | 40 +++++++++++ src/util/virfile.h | 2 + src/util/virresctrl.c | 6 +- src/util/virresctrl.h | 2 +- tools/virsh-domain-monitor.c | 7 ++ 9 files changed, 211 insertions(+), 8 deletions(-) -- 2.23.0

3 6

[libvirt] [PATCH 0/2] qemu_firmware: Try to autofill for old style UEFI specification
by Michal Privoznik 06 Jan '20

06 Jan '20

See 2/2 for info. Michal Prívozník (2): qemu_firmware: Pass virDomainDef into qemuFirmwareFillDomain() qemu_firmware: Try to autofill for old style UEFI specification src/qemu/qemu_firmware.c | 90 +++++++++++++++++++++++++++++++++------- src/qemu/qemu_firmware.h | 2 +- src/qemu/qemu_process.c | 2 +- 3 files changed, 78 insertions(+), 16 deletions(-) -- 2.24.1

2 5

[libvirt] [jenkins-ci PATCH 0/2] CentOS fixes
by Fabiano Fidêncio 06 Jan '20

06 Jan '20

This series consists in two simple patches: - Mention CentOS8 as a valid OS version; - Only install OpenVZ on CentOS 7; Fabiano Fidêncio (2): guests: Mention CentOS8 as a valid OS version guests: Only install OpenVZ on CentOS 7 guests/playbooks/update/tasks/base.yml | 1 + guests/vars/mappings.yml | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) -- 2.23.0

2 4

[libvirt] [PATCH] ci: Fetch list of available container images dynamically
by Andrea Bolognani 06 Jan '20

06 Jan '20

Any static list of images is destined to become outdated eventually, so let's start generating it dynamically instead. Unfortunately there doesn't seem to be a straightforward way to get Podman/Docker to list all repositories under quay.io/libvirt, so we have to resort to searching and filtering manually; and since the two tools behave slightly differently in that regard, it's more sane to have the logic in a separate shell script than it would be to keep it inline in the Makefile with all the annoying escaping that would entail. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- ci/Makefile | 37 +++++++++++++------------------------ ci/list-images.sh | 26 ++++++++++++++++++++++++++ 2 files changed, 39 insertions(+), 24 deletions(-) create mode 100644 ci/list-images.sh diff --git a/ci/Makefile b/ci/Makefile index 27c1049b38..acb655941c 100644 --- a/ci/Makefile +++ b/ci/Makefile @@ -238,6 +238,17 @@ ci-build@%: ci-check@%: $(MAKE) -C $(CI_ROOTDIR) ci-build@$* CI_MAKE_ARGS="check" +ci-list-images: + @echo + @echo "Available x86 container images:" + @echo + @sh list-images.sh "$(CI_ENGINE)" "$(CI_IMAGE_PREFIX)" | grep -v cross + @echo + @echo "Available cross-compiler container images:" + @echo + @sh list-images.sh "$(CI_ENGINE)" "$(CI_IMAGE_PREFIX)" | grep cross + @echo + ci-help: @echo "Build libvirt inside containers used for CI" @echo @@ -246,30 +257,8 @@ ci-help: @echo " ci-build@\$$IMAGE - run a default 'make'" @echo " ci-check@\$$IMAGE - run a 'make check'" @echo " ci-shell@\$$IMAGE - run an interactive shell" - @echo - @echo "Available x86 container images:" - @echo - @echo " centos-7" - @echo " debian-9" - @echo " debian-10" - @echo " debian-sid" - @echo " fedora-29" - @echo " fedora-30" - @echo " fedora-rawhide" - @echo " ubuntu-16" - @echo " ubuntu-18" - @echo - @echo "Available cross-compiler container images:" - @echo - @echo " debian-{9,10,sid}-cross-aarch64" - @echo " debian-{9,10,sid}-cross-armv6l" - @echo " debian-{9,10,sid}-cross-armv7l" - @echo " debian-{10,sid}-cross-i686" - @echo " debian-{9,10,sid}-cross-mips64el" - @echo " debian-{9,10,sid}-cross-mips" - @echo " debian-{9,10,sid}-cross-mipsel" - @echo " debian-{9,10,sid}-cross-ppc64le" - @echo " debian-{9,10,sid}-cross-s390x" + @echo " ci-list-images - list available images" + @echo " ci-help - show this help message" @echo @echo "Available make variables:" @echo diff --git a/ci/list-images.sh b/ci/list-images.sh new file mode 100644 index 0000000000..35efdb6982 --- /dev/null +++ b/ci/list-images.sh @@ -0,0 +1,26 @@ +#!/bin/sh + +engine="$1" +prefix="$2" + +do_podman() { + # Podman freaks out if the search term ends with a dash, which ours + # by default does, so let's strip it. The repository name is the + # second field in the output, and it already starts with the registry + podman search --limit 100 "${prefix%-}" | while read _ repo _; do + echo "$repo" + done +} + +do_docker() { + # Docker doesn't include the registry name in the output, so we have + # to add it. The repository name is the first field in the output + registry="${prefix%%/*}" + docker search --limit 100 "$prefix" | while read repo _; do + echo "$registry/$repo" + done +} + +"do_$engine" | grep "^$prefix" | sed "s,^$prefix,,g" | while read repo; do + echo " $repo" +done | sort -u -- 2.23.0

2 2

[libvirt] [PATCH 0/2] vircgroupv2devices: Avoid double close on map FD
by Michal Privoznik 06 Jan '20

06 Jan '20

*** BLURB HERE *** Michal Prívozník (2): vircgroupv2devices: Unexport virCgroupV2DevicesAttachProg() vircgroupv2devices: Avoid double close on map FD src/libvirt_private.syms | 1 - src/util/vircgroupv2devices.c | 29 +++++------------------------ src/util/vircgroupv2devices.h | 5 ----- 3 files changed, 5 insertions(+), 30 deletions(-) -- 2.24.1

2 3

[libvirt] [PATCH] qemu: backup: Move capability check after inactive check
by Peter Krempa 06 Jan '20

06 Jan '20

Inactive VM doesn't have qemuCaps set thus we'd never properly report that VM backups are supported only for running VMs. Move the capability check after the active check. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_backup.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/qemu/qemu_backup.c b/src/qemu/qemu_backup.c index c0445e0869..86b10a2b8a 100644 --- a/src/qemu/qemu_backup.c +++ b/src/qemu/qemu_backup.c @@ -750,12 +750,6 @@ qemuBackupBegin(virDomainObjPtr vm, virCheckFlags(VIR_DOMAIN_BACKUP_BEGIN_REUSE_EXTERNAL, -1); - if (!virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_INCREMENTAL_BACKUP)) { - virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", - _("incremental backup is not supported yet")); - return -1; - } - if (!(def = virDomainBackupDefParseString(backupXML, priv->driver->xmlopt, 0))) return -1; @@ -793,6 +787,12 @@ qemuBackupBegin(virDomainObjPtr vm, goto endjob; } + if (!virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_INCREMENTAL_BACKUP)) { + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", + _("incremental backup is not supported yet")); + goto endjob; + } + if (priv->backup) { virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("another backup job is already running")); -- 2.24.1

2 1

[libvirt] [PATCH] util: time: Fix comment for virTimeFieldsNow
by Peter Krempa 06 Jan '20

06 Jan '20

Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/util/virtime.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Trivial. diff --git a/src/util/virtime.c b/src/util/virtime.c index 54466b2f39..13f899cb91 100644 --- a/src/util/virtime.c +++ b/src/util/virtime.c @@ -223,7 +223,7 @@ int virTimeMillisNow(unsigned long long *now) /** - * virTimeFieldsNowRaw: + * virTimeFieldsNow: * @fields: filled with current time fields * * Retrieves the current time, in broken-down field format. -- 2.24.1

1 0

[libvirt] stream does not work in non-block mode with event loop implementation on Fibers
by senid senid 06 Jan '20

06 Jan '20

*libvirt_stream_event_add_callback* creates *passthrough* variable using *rb_ary_new2* and pass it to *virStreamEventAddCallback* at *ext/libvirt/stream.c:272*. After that ruby garbage collector removes this variable (I think because there is no references for *passthrough* in ruby code). https://bugzilla.redhat.com/show_bug.cgi?id=1787914#

1 0

[libvirt] [PATCH 00/23] Take 64 gnulib modules, eliminate 14, to give 50 remaining
by Daniel P. Berrangé 06 Jan '20

06 Jan '20

In the last days before the xmas break I took some time to eliminate 14 more gnulib modules, bringing us down to just 50 left to go. They're getting harder to eliminate as we go on, but to give some hints, I've annotated every module in bootstrap.conf with a suggested replacement strategy. Daniel P. Berrangé (23): build: set min version for CLang to 3.4 / XCode CLang to 5.1 docs: expand macOS platform support coverage travis: add macOS Xcode 11.3 testing util: add note about event file descriptors on Windows src: always pull in glib/gstdio.h header src: switch to use g_setenv/g_unsetenv util: add compat wrapper for g_fsync src: use g_fsync for portability util: introduce virFileDataSync src: use g_lstat() instead of lstat() src: switch from fnmatch to g_pattern_match_simple src: replace clock_gettime()/gettimeofday() with g_get_real_time() src: replace last_component() with g_path_get_basename() util: replace IS_ABSOLUTE_FILE_NAME with g_path_is_absolute src: replace mdir_name() with g_path_get_dirname() src: remove unused imports of dirname.h src: replace getcwd() with g_get_current_dir() util: use realpath/g_canonicalize_filename util: replace gethostname() with g_get_hostname() src: replace WSAStartup with g_networking_init() src: replace strptime()/timegm()/mktime() with GDateTime APIs set bootstrap: remove now unused gnulib modules bootstrap: annotate with info about desired replacement .travis.yml | 15 ++ bootstrap.conf | 173 +++++++++++++++--------- build-aux/syntax-check.mk | 4 +- config-post.h | 18 ++- docs/platforms.html.in | 13 +- include/libvirt/libvirt-event.h | 4 + m4/virt-glib.m4 | 2 +- src/conf/domain_conf.c | 32 ++--- src/conf/moment_conf.c | 7 +- src/conf/node_device_conf.c | 6 +- src/esx/esx_vi_types.c | 71 +--------- src/internal.h | 4 +- src/libvirt.c | 25 +--- src/libvirt_private.syms | 2 + src/libxl/libxl_driver.c | 21 +-- src/locking/lock_driver_sanlock.c | 6 +- src/node_device/node_device_udev.c | 12 +- src/nwfilter/nwfilter_dhcpsnoop.c | 2 +- src/qemu/qemu_backup.c | 5 +- src/qemu/qemu_command.c | 1 - src/qemu/qemu_domain.c | 14 +- src/qemu/qemu_driver.c | 7 +- src/qemu/qemu_firmware.c | 4 +- src/qemu/qemu_tpm.c | 33 +---- src/remote/libvirtd.conf.in | 8 +- src/rpc/virnetsaslcontext.c | 11 +- src/rpc/virnetsocket.c | 5 +- src/rpc/virnettlscontext.c | 10 +- src/security/security_dac.c | 2 +- src/security/virt-aa-helper.c | 8 +- src/storage/storage_backend_disk.c | 9 +- src/storage/storage_driver.c | 1 - src/storage/storage_util.c | 11 +- src/test/test_driver.c | 51 ++----- src/util/glibcompat.c | 13 ++ src/util/glibcompat.h | 6 + src/util/iohelper.c | 2 +- src/util/vircgroupv1.c | 4 +- src/util/virevent.c | 7 + src/util/virfile.c | 49 ++++--- src/util/virfile.h | 2 + src/util/virlog.c | 22 +-- src/util/virmdev.c | 12 +- src/util/virnetdev.c | 5 +- src/util/virpci.c | 17 ++- src/util/virstoragefile.c | 13 +- src/util/virsystemd.c | 4 +- src/util/virtime.c | 22 +-- src/util/virutil.c | 12 +- src/vbox/vbox_XPCOMCGlue.c | 4 +- src/vmware/vmware_conf.c | 7 +- src/vz/vz_sdk.c | 10 +- tests/eventtest.c | 18 +-- tests/libxlxml2domconfigtest.c | 4 +- tests/lxcxml2xmltest.c | 2 +- tests/qemudomaincheckpointxml2xmltest.c | 2 +- tests/qemudomainsnapshotxml2xmltest.c | 2 +- tests/qemufirmwaretest.c | 2 +- tests/qemuhotplugtest.c | 2 +- tests/qemumemlocktest.c | 2 +- tests/qemusecuritytest.c | 4 +- tests/qemuvhostusertest.c | 2 +- tests/qemuxml2argvtest.c | 24 ++-- tests/qemuxml2xmltest.c | 4 +- tests/securityselinuxhelper.c | 4 +- tests/testutils.c | 15 +- tests/testutils.h | 6 +- tests/testutilsqemu.c | 4 +- tests/vircgrouptest.c | 16 +-- tests/virconfdata/libvirtd.conf | 8 +- tests/virconfdata/libvirtd.out | 8 +- tests/virfilemock.c | 12 +- tests/virfiletest.c | 4 +- tests/virhostdevtest.c | 2 +- tests/virnettlscontexttest.c | 2 +- tests/virnettlssessiontest.c | 2 +- tests/virpcimock.c | 3 +- tests/virpcitest.c | 2 +- tests/virportallocatortest.c | 2 +- tests/virstoragetest.c | 1 - tests/virsystemdtest.c | 46 +++---- tests/virtimetest.c | 4 +- tools/virsh-domain.c | 10 +- tools/virt-login-shell-helper.c | 17 ++- tools/vsh.c | 27 +--- tools/vsh.h | 1 - 86 files changed, 470 insertions(+), 602 deletions(-) -- 2.24.1

3 31

[libvirt] [PATCH 00/11] qemu: backup: Fixes and improvements
by Peter Krempa 06 Jan '20

06 Jan '20

I've got a report of pull-mode backup not working properly. While investigating I've found out few other problems and one regression caused by a recent patch. All of those are fixed below. Additionally the last 3 patches are RFC and were created based on the discussion on qemu-block and I don't really intend to push them right away. At least until the discussion there is over: https://lists.gnu.org/archive/html/qemu-block/2019-12/msg00416.html Peter Krempa (11): qemu: block: Use proper asyncJob when waiting for completion of blockdev-create qemu: Reset the node-name allocator in qemuDomainObjPrivateDataClear qemu: backup: Configure backup store image with backing file qemu: backup: Move deletion of backup images to job termination qemu: blockjob: Remove infrastructure for remembering to delete image qemu: backup: Properly propagate async job type when cancelling the job qemu: process: Terminate backup job on VM destroy schemas: backup: Remove pointless <choice> for 'name' of backup disk RFC: conf: backup: Allow configuration of names exported via NBD qemu: backup: Implement support for backup disk export name configuration qemu: backup: Implement support for backup disk bitmap name configuration docs/formatbackup.html.in | 9 +++ docs/schemas/domainbackup.rng | 16 ++-- src/conf/backup_conf.c | 11 +++ src/conf/backup_conf.h | 2 + src/qemu/qemu_backup.c | 77 +++++++++++++------ src/qemu/qemu_backup.h | 10 ++- src/qemu/qemu_block.c | 4 +- src/qemu/qemu_blockjob.c | 20 +---- src/qemu/qemu_blockjob.h | 2 - src/qemu/qemu_domain.c | 10 +-- src/qemu/qemu_driver.c | 2 +- src/qemu/qemu_process.c | 8 +- .../backup-pull-seclabel.xml | 2 +- .../backup-pull-seclabel.xml | 2 +- .../qemustatusxml2xmldata/backup-pull-in.xml | 1 - 15 files changed, 110 insertions(+), 66 deletions(-) -- 2.23.0

4 29

[libvirt] [PATCH] Cleaning up pools is not always ideal
by ebenner 06 Jan '20

06 Jan '20

Libvirt cleans up pools that error out by deactivating them. When using LVM this is not very useful. We rather would have our own system handle any real failures and to many situations where errors are meaningless and unimportant cause Libvirt to disable our pools continuously causing lots of grief. This patch is what we use to add a config option to disable this behavior. An example of one of the issues we encountered requiring this patch is a race condition between Libvirt and LVM. Pool refreshes will hand if LVM is having an action performed, then Libvirt will continue when LVM finishes. When a pool is being refreshed while an LV is being removed, the refresh hangs as expected, when the removal is completed the refresh continues. Afterwards when the refresh goes to refresh the specific LV it errors because it cannot be found and the entire pool is disabled. Bellow are two commands when run together reliably recreates the issue. while :; do lvcreate /dev/vgpool --name TEST -L 100G && lvremove -f /dev/vgpool/TEST; done while :; do virsh pool-refresh vgpool; done I am aware this is not the most elegant solution here and am up for suggestions for resolving the underlying issue, however we never need our pools to be disabled because of an error and I am sure there are other's who's usecase may be similar. --- src/remote/libvirtd.conf.in | 7 +++++++ src/storage/storage_driver.c | 38 ++++++++++++++++++++++++++++++++---- 2 files changed, 41 insertions(+), 4 deletions(-) diff --git a/src/remote/libvirtd.conf.in b/src/remote/libvirtd.conf.in index 34741183cc..5600c26eca 100644 --- a/src/remote/libvirtd.conf.in +++ b/src/remote/libvirtd.conf.in @@ -506,3 +506,10 @@ # potential infinite waits blocking libvirt. # #ovs_timeout = 5 + +################################################################### +# This decides whether to disable pools that errors in some way such as during a refresh +# This can negatively affect LVM pools. 1 = disable the pools, 2 = don't disable the pools +# Do not use this if you are not using only LVM pools +# +cleanup_pools = 1 diff --git a/src/storage/storage_driver.c b/src/storage/storage_driver.c index 6bbf52f729..93ebcd662c 100644 --- a/src/storage/storage_driver.c +++ b/src/storage/storage_driver.c @@ -55,6 +55,7 @@ VIR_LOG_INIT("storage.storage_driver"); static virStorageDriverStatePtr driver; +static int cleanup_pools = -1; static int storageStateCleanup(void); @@ -74,6 +75,20 @@ static void storageDriverUnlock(void) virMutexUnlock(&driver->lock); } +static int cleanupPools(void) +{ + if (cleanup_pools == -1) { + g_autoptr(virConf) libvirtConf = NULL; + virConfLoadConfig(&libvirtConf, "libvirtd.conf"); + + if (!virConfGetValueInt(libvirtConf, "cleanup_pools", &cleanup_pools) + || (cleanup_pools != 0 && cleanup_pools != 1)) + cleanup_pools = 1; + } + + return cleanup_pools; +} + static void storagePoolRefreshFailCleanup(virStorageBackendPtr backend, @@ -81,14 +96,26 @@ storagePoolRefreshFailCleanup(virStorageBackendPtr backend, const char *stateFile) { virErrorPtr orig_err; - virErrorPreserveLast(&orig_err); virStoragePoolObjClearVols(obj); if (stateFile) unlink(stateFile); - if (backend->stopPool) - backend->stopPool(obj); + + if (!cleanupPools()) { + virStoragePoolDefPtr def = virStoragePoolObjGetDef(obj); + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Failed to refresh storage pool '%s'. Would have disabled this pool but clean_pools = 0: %s"), + def->name, virGetLastErrorMessage()); + } else { + virStoragePoolDefPtr def = virStoragePoolObjGetDef(obj); + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Failed to refresh storage pool '%s'. Disabled this pool because clean_pools = 1: %s"), + def->name, virGetLastErrorMessage()); + if (backend->stopPool) { + backend->stopPool(obj); + } + } virErrorRestore(&orig_err); } @@ -101,7 +128,10 @@ storagePoolRefreshImpl(virStorageBackendPtr backend, virStoragePoolObjClearVols(obj); if (backend->refreshPool(obj) < 0) { storagePoolRefreshFailCleanup(backend, obj, stateFile); - return -1; + if (!cleanupPools()) + return 0; + else + return -1; } return 0; -- 2.24.1

1 0

[libvirt] [PATCH v2 00/12] Various bhyve driver improvements for FreeBSD
by Ryan Moeller 05 Jan '20

05 Jan '20

The main changes are: * Add support for standard hooks in bhyve backend: - prepare - start - started - stopped - release * Some code cleanup & general housekeeping in bhyve backend * Add support for reboot in bhyve backend, both from within the VM and from the host Ryan Moeller (12): Add hooks for bhyve backend Fix build errors on FreeBSD Simplify bhyve driver caps helpers Remove redundant parameter to virBhyveProcessStart() Factor out conn Fix indentation Eliminate rc variable Make bhyveMonitor a virClass Don't bother seeking to the end of a file opened O_APPEND Add reboot support for bhyve backend Fix bhyvexml2argvtest Add missing virtlogd.init for OpenRC src/bhyve/bhyve_command.c | 40 ++++----- src/bhyve/bhyve_command.h | 4 +- src/bhyve/bhyve_driver.c | 67 ++++++++++---- src/bhyve/bhyve_driver.h | 4 +- src/bhyve/bhyve_monitor.c | 165 +++++++++++++++++++++++------------ src/bhyve/bhyve_monitor.h | 2 + src/bhyve/bhyve_process.c | 106 +++++++++++++++------- src/bhyve/bhyve_process.h | 4 +- src/conf/virnetworkobj.c | 7 +- src/logging/Makefile.inc.am | 10 +++ src/logging/virtlogd.init.in | 14 +++ src/util/virhook.c | 15 ++++ src/util/virhook.h | 11 +++ tests/bhyvexml2argvtest.c | 4 +- 14 files changed, 319 insertions(+), 134 deletions(-) create mode 100644 src/logging/virtlogd.init.in -- 2.23.0

3 22

[libvirt] [PATCH] virsh: Add a completer for `domifaddr` --source parameter.
by Julio Faracco 04 Jan '20

04 Jan '20

The command `domifaddr` can use three different sources to grab IP address of a Virtual Machine: lease, agent and arp. This parameter does not have a completer function to return source options. Signed-off-by: Julio Faracco <jcfaracco(a)gmail.com> --- tools/virsh-completer-domain.c | 17 +++++++++++++++++ tools/virsh-completer-domain.h | 5 +++++ tools/virsh-domain-monitor.c | 1 + 3 files changed, 23 insertions(+) diff --git a/tools/virsh-completer-domain.c b/tools/virsh-completer-domain.c index 0311ee50d0..c8709baa38 100644 --- a/tools/virsh-completer-domain.c +++ b/tools/virsh-completer-domain.c @@ -296,3 +296,20 @@ virshDomainShutdownModeCompleter(vshControl *ctl, return virshCommaStringListComplete(mode, modes); } + + +char ** +virshDomainIfAddrSourceCompleter(vshControl *ctl, + const vshCmd *cmd, + unsigned int flags) +{ + const char *sources[] = {"lease", "agent", "arp", NULL}; + const char *source = NULL; + + virCheckFlags(0, NULL); + + if (vshCommandOptStringQuiet(ctl, cmd, "source", &source) < 0) + return NULL; + + return virshCommaStringListComplete(source, sources); +} diff --git a/tools/virsh-completer-domain.h b/tools/virsh-completer-domain.h index 083ab327cc..f5e5625051 100644 --- a/tools/virsh-completer-domain.h +++ b/tools/virsh-completer-domain.h @@ -53,3 +53,8 @@ char ** virshDomainDeviceAliasCompleter(vshControl *ctl, char ** virshDomainShutdownModeCompleter(vshControl *ctl, const vshCmd *cmd, unsigned int flags); + +char ** +virshDomainIfAddrSourceCompleter(vshControl *ctl, + const vshCmd *cmd, + unsigned int flags); diff --git a/tools/virsh-domain-monitor.c b/tools/virsh-domain-monitor.c index 30b186ffd1..1d1f87eb9e 100644 --- a/tools/virsh-domain-monitor.c +++ b/tools/virsh-domain-monitor.c @@ -2346,6 +2346,7 @@ static const vshCmdOptDef opts_domifaddr[] = { {.name = "source", .type = VSH_OT_STRING, .flags = VSH_OFLAG_NONE, + .completer = virshDomainIfAddrSourceCompleter, .help = N_("address source: 'lease', 'agent', or 'arp'")}, {.name = NULL} }; -- 2.20.1

3 4

[libvirt] [PULL 0/3] Block patches
by Stefan Hajnoczi 03 Jan '20

03 Jan '20

The following changes since commit aceeaa69d28e6f08a24395d0aa6915b687d0a681: Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2019-12-17' into staging (2019-12-17 15:55:20 +0000) are available in the Git repository at: https://github.com/stefanha/qemu.git tags/block-pull-request for you to fetch changes up to 725fe5d10dbd4259b1853b7d253cef83a3c0d22a: virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh (2019-12-19 16:20:25 +0000) ---------------------------------------------------------------- Pull request ---------------------------------------------------------------- Li Hangjing (1): virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh Stefan Hajnoczi (2): virtio-blk: deprecate SCSI passthrough docs: fix rst syntax errors in unbuilt docs docs/arm-cpu-features.rst | 6 +++--- docs/virtio-net-failover.rst | 4 ++-- docs/virtio-pmem.rst | 19 ++++++++++--------- hw/block/dataplane/virtio-blk.c | 2 +- qemu-deprecated.texi | 11 +++++++++++ 5 files changed, 27 insertions(+), 15 deletions(-) -- 2.23.0

2 4

[libvirt] [PATCH] docs: Harmonize backend names for QEMU and LXC
by Michael Weiser 03 Jan '20

03 Jan '20

Trivially replace usages of qemu and lxc in the virsh manpage with their more heavily used and (according to Wikipedia) correct upper-case spellings QEMU and LXC. Signed-off-by: Michael Weiser <michael.weiser(a)gmx.de> Suggested-by: Daniel Henrique Barboza <danielhb413(a)gmail.com> --- docs/manpages/virsh.rst | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/manpages/virsh.rst b/docs/manpages/virsh.rst index fea0527caf..7e26676570 100644 --- a/docs/manpages/virsh.rst +++ b/docs/manpages/virsh.rst @@ -577,7 +577,7 @@ from the domain's XML <os/> element and <type/> subelement or one from a list of machines from the ``virsh capabilities`` output for a specific architecture and domain type. -For the qemu hypervisor, a *virttype* of either 'qemu' or 'kvm' must be +For the QEMU hypervisor, a *virttype* of either 'qemu' or 'kvm' must be supplied along with either the *emulatorbin* or *arch* in order to generate output for the default *machine*. Supplying a *machine* value will generate output for the specific machine. @@ -1072,7 +1072,7 @@ read I/O operations limit. write I/O operations limit. *--size-iops-sec* specifies size I/O operations limit per second. *--group-name* specifies group name to share I/O quota between multiple drives. -For a qemu domain, if no name is provided, then the default is to have a single +For a QEMU domain, if no name is provided, then the default is to have a single group for each *device*. Older versions of virsh only accepted these options with underscore @@ -1084,7 +1084,7 @@ An explicit 0 also clears any limit. A non-zero value for a given total cannot be mixed with non-zero values for read or write. It is up to the hypervisor to determine how to handle the length values. -For the qemu hypervisor, if an I/O limit value or maximum value is set, +For the QEMU hypervisor, if an I/O limit value or maximum value is set, then the default value of 1 second will be displayed. Supplying a 0 will reset the value back to the default. @@ -1642,7 +1642,7 @@ domblkstat Get device block stats for a running domain. A *block-device* corresponds to a unique target name (<target dev='name'/>) or source file (<source file='name'/>) for one of the disk devices attached to *domain* (see -also ``domblklist`` for listing these names). On a lxc or qemu domain, +also ``domblklist`` for listing these names). On a LXC or QEMU domain, omitting the *block-device* yields device block stats summarily for the entire domain. @@ -3247,7 +3247,7 @@ destination). Some hypervisors do not support this feature and will return an error if this parameter is used. Optional *disks-port* sets the port that hypervisor on destination side should -bind to for incoming disks traffic. Currently it is supported only by qemu. +bind to for incoming disks traffic. Currently it is supported only by QEMU. migrate-compcache -- 2.24.1

2 1

[libvirt] [PATCH v2 0/3] Mark and document restore with managed save as risky
by Michael Weiser 03 Jan '20

03 Jan '20

This series marks restore of an inactive qemu snapshot while there is managed saved state as risky due to the reasons explained in patch 1 and 3. Patch 2 is a simple reformatting of the documentation with no other changes in preparation of addition of more reasons why reverts might need to be forced. Changes from v1: - reword error message to "error: revert requires force: snapshot without memory state, removal of existing managed saved state strongly recommended to avoid corruption" - add documentation of the new behaviour Michael Weiser (3): qemu: Warn of restore with managed save being risky docs: Reformat snapshot-revert force reasons docs: Add snapshot-revert qemu managedsave force docs/manpages/virsh.rst | 39 ++++++++++++++++++++++++--------------- src/qemu/qemu_driver.c | 9 +++++++++ 2 files changed, 33 insertions(+), 15 deletions(-) -- 2.24.1

2 5

[libvirt] [PATCH] Add overrides for network port UUID getter/lookup methods
by Daniel P. Berrangé 03 Jan '20

03 Jan '20

The generator creates broken code for all these methods. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- generator.py | 3 ++ libvirt-override-api.xml | 16 ++++++++ libvirt-override.c | 83 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 102 insertions(+) diff --git a/generator.py b/generator.py index cba9d47..426f007 100755 --- a/generator.py +++ b/generator.py @@ -430,6 +430,9 @@ skip_impl = ( 'virNetworkGetUUID', 'virNetworkGetUUIDString', 'virNetworkLookupByUUID', + 'virNetworkPortGetUUID', + 'virNetworkPortGetUUIDString', + 'virNetworkPortLookupByUUID', 'virDomainGetAutostart', 'virNetworkGetAutostart', 'virDomainBlockStats', diff --git a/libvirt-override-api.xml b/libvirt-override-api.xml index 7a0d4c5..4ab403c 100644 --- a/libvirt-override-api.xml +++ b/libvirt-override-api.xml @@ -64,6 +64,12 @@ <arg name='conn' type='virConnectPtr' info='pointer to the hypervisor connection'/> <arg name='uuid' type='const unsigned char *' info='the UUID string for the network, must be 16 bytes'/> </function> + <function name='virNetworkPortLookupByUUID' file='python'> + <info>Try to lookup a port on the given network based on its UUID.</info> + <return type='virNetworkPortPtr' info='a new network port object or NULL in case of failure'/> + <arg name='net' type='virNetworkPtr' info='pointer to the network object'/> + <arg name='uuid' type='const unsigned char *' info='the UUID string for the network port, must be 16 bytes'/> + </function> <function name='virDomainGetInfo' file='python'> <info>Extract information about a domain. Note that if the connection used to get the domain is limited only a partial set of the information can be extracted.</info> <return type='char *' info='the list of information or None in case of error'/> @@ -153,6 +159,16 @@ <return type='char *' info='the UUID string or None in case of error'/> <arg name='net' type='virNetworkPtr' info='a network object'/> </function> + <function name='virNetworkPortGetUUID' file='python'> + <info>Extract the UUID unique Identifier of a network port.</info> + <return type='char *' info='the 16 bytes string or None in case of error'/> + <arg name='domain' type='virNetworkPortPtr' info='a network port object'/> + </function> + <function name='virNetworkPortGetUUIDString' file='python'> + <info>Fetch globally unique ID of the network port as a string.</info> + <return type='char *' info='the UUID string or None in case of error'/> + <arg name='net' type='virNetworkPortPtr' info='a network port object'/> + </function> <function name='virStoragePoolGetUUID' file='python'> <info>Extract the UUID unique Identifier of a storage pool.</info> <return type='char *' info='the 16 bytes string or None in case of error'/> diff --git a/libvirt-override.c b/libvirt-override.c index 4e4c00a..2b39ace 100644 --- a/libvirt-override.c +++ b/libvirt-override.c @@ -10185,6 +10185,86 @@ libvirt_virNetworkPortGetParameters(PyObject *self ATTRIBUTE_UNUSED, virTypedParamsFree(params, nparams); return dict; } + +static PyObject * +libvirt_virNetworkPortGetUUID(PyObject *self ATTRIBUTE_UNUSED, + PyObject *args) +{ + unsigned char uuid[VIR_UUID_BUFLEN]; + virNetworkPortPtr port; + PyObject *pyobj_port; + int c_retval; + + if (!PyArg_ParseTuple(args, (char *)"O:virNetworkPortGetUUID", &pyobj_port)) + return NULL; + port = (virNetworkPortPtr) PyvirNetworkPort_Get(pyobj_port); + + if (port == NULL) + return VIR_PY_NONE; + + LIBVIRT_BEGIN_ALLOW_THREADS; + c_retval = virNetworkPortGetUUID(port, &uuid[0]); + LIBVIRT_END_ALLOW_THREADS; + + if (c_retval < 0) + return VIR_PY_NONE; + + return libvirt_charPtrSizeWrap((char *) &uuid[0], VIR_UUID_BUFLEN); +} + +static PyObject * +libvirt_virNetworkPortGetUUIDString(PyObject *self ATTRIBUTE_UNUSED, + PyObject *args) +{ + char uuidstr[VIR_UUID_STRING_BUFLEN]; + virNetworkPortPtr port; + PyObject *pyobj_port; + int c_retval; + + if (!PyArg_ParseTuple(args, (char *)"O:virNetworkPortGetUUIDString", + &pyobj_port)) + return NULL; + port = (virNetworkPortPtr) PyvirNetworkPort_Get(pyobj_port); + + if (port == NULL) + return VIR_PY_NONE; + + LIBVIRT_BEGIN_ALLOW_THREADS; + c_retval = virNetworkPortGetUUIDString(port, &uuidstr[0]); + LIBVIRT_END_ALLOW_THREADS; + + if (c_retval < 0) + return VIR_PY_NONE; + + return libvirt_constcharPtrWrap((char *) &uuidstr[0]); +} + +static PyObject * +libvirt_virNetworkPortLookupByUUID(PyObject *self ATTRIBUTE_UNUSED, + PyObject *args) +{ + virNetworkPortPtr c_retval; + virNetworkPtr net; + PyObject *pyobj_net; + unsigned char *uuid; + int len; + + if (!PyArg_ParseTuple(args, (char *)"Oz#:virNetworkPortLookupByUUID", + &pyobj_net, &uuid, &len)) + return NULL; + net = (virNetworkPtr) PyvirNetwork_Get(pyobj_net); + + if ((uuid == NULL) || (len != VIR_UUID_BUFLEN)) + return VIR_PY_NONE; + + LIBVIRT_BEGIN_ALLOW_THREADS; + c_retval = virNetworkPortLookupByUUID(net, uuid); + LIBVIRT_END_ALLOW_THREADS; + + return libvirt_virNetworkPortPtrWrap((virNetworkPortPtr) c_retval); +} + + #endif /* LIBVIR_CHECK_VERSION(5, 5, 0) */ #if LIBVIR_CHECK_VERSION(5, 7, 0) @@ -10535,6 +10615,9 @@ static PyMethodDef libvirtMethods[] = { {(char *) "virNetworkListAllPorts", libvirt_virNetworkListAllPorts, METH_VARARGS, NULL}, {(char *) "virNetworkPortSetParameters", libvirt_virNetworkPortSetParameters, METH_VARARGS, NULL}, {(char *) "virNetworkPortGetParameters", libvirt_virNetworkPortGetParameters, METH_VARARGS, NULL}, + {(char *) "virNetworkPortGetUUID", libvirt_virNetworkPortGetUUID, METH_VARARGS, NULL}, + {(char *) "virNetworkPortGetUUIDString", libvirt_virNetworkPortGetUUIDString, METH_VARARGS, NULL}, + {(char *) "virNetworkPortLookupByUUID", libvirt_virNetworkPortLookupByUUID, METH_VARARGS, NULL}, #endif /* LIBVIR_CHECK_VERSION(5, 5, 0) */ #if LIBVIR_CHECK_VERSION(5, 7, 0) {(char *) "virDomainGetGuestInfo", libvirt_virDomainGetGuestInfo, METH_VARARGS, NULL}, -- 2.24.1

2 2

[libvirt] when libvirt xml define nic driver e1000, my vm fail to start
by thomas.kuang 03 Jan '20

03 Jan '20

hi, all: my xml define interface as following: <interface type='ethernet'> <mac address='00:04:00:41:03:11'/> <model type='e1000'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </interface> when run the command: bash-4.1# virsh start root-vsys_v77 error: Failed to start domain root-vsys_v77 error: Unable to open /dev/net/tun, is tun module loaded?: No such file or directory is my xml define error ? how can create my vm with nic driver e1000 ? bash-4.1# libvirtd -v ,yum install libvirt 2020-01-02 10:00:49.261+0000: 8349: info : libvirt version: 4.5.0, package: 23.el7 (CentOS BuildSystem <http://bugs.centos.org>, 2019-08-09-00:39:08, x86-02.bsys.centos.org) 2020-01-02 10:00:49.261+0000: 8349: info : hostname: NSG 2020-01-02 10:00:49.261+0000: 8349: warning : virGetHostnameImpl:719 : getaddrinfo failed for 'NSG': Name or service not known 2020-01-02 10:00:49.263+0000: 8349: info : libvirt version: 4.5.0, package: 23.el7 (CentOS BuildSystem <http://bugs.centos.org>, 2019-08-09-00:39:08, x86-02.bsys.centos.org) 2020-01-02 10:00:49.263+0000: 8349: info : hostname: NSG 2020-01-02 10:00:49.263+0000: 8349: info : virObjectNew:248 : OBJECT_NEW: obj=0x5605a6104de0 classname=virAccessManager 2020-01-02 10:00:49.263+0000: 8349: info : virObjectNew:248 : OBJECT_NEW: obj=0x5605a60f54e0 classname=virAccessManager my emulator is qemu-3.0 ,i download qemu source code and compiled the emulator: bash-4.1# /usr/local/bin/qemu-system-x86_64 --version QEMU emulator version 3.0.0 Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers thanks !

1 0

[libvirt] [PATCH] qemu: Warn of restore with managed save being risky
by Michael Weiser 02 Jan '20

02 Jan '20

Internal snapshots of a non-running domain do not carry any memory state and restoring such a snapshot will not replace existing saved memory state. This allows a scenario, where a user first suspends a domain into managedsave, restores a non-running snapshot and then resumes the domain from managedsave. After that, the guest system will run with its previous memory state atop a different disk state. The most obvious possible fallout from this is extensive file system corruption. Swap content and RAID bitmaps might also be off. This has been discussed[1] and fixed[2] from the end-user perspective for virt-manager. This patch marks the restore operation as risky at the libvirt level, requiring the user to remove the saved memory state first or force the operation. [1] https://www.redhat.com/archives/virt-tools-list/2019-November/msg00011.html [2] https://www.redhat.com/archives/virt-tools-list/2019-December/msg00049.html Signed-off-by: Michael Weiser <michael.weiser(a)gmx.de> Cc: Cole Robinson <crobinso(a)redhat.com> --- src/qemu/qemu_driver.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index ec8faf384c..dcd103d3bb 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -16652,6 +16652,15 @@ qemuDomainRevertToSnapshot(virDomainSnapshotPtr snapshot, _("must respawn qemu to start inactive snapshot")); goto endjob; } + if (vm->hasManagedSave && + !(snapdef->state == VIR_DOMAIN_SNAPSHOT_RUNNING || + snapdef->state == VIR_DOMAIN_SNAPSHOT_PAUSED)) { + virReportError(VIR_ERR_SNAPSHOT_REVERT_RISKY, "%s", + _("revert to snapshot while there is a managed " + "saved state will cause corruption when run, " + "remove saved state first")); + goto endjob; + } } if (snap->def->dom) { -- 2.24.1

2 6

[libvirt] [PATCH RFC] update cacrl without restarting libvirtd via virt-admin
by Zhangbo (Oscar) 02 Jan '20

02 Jan '20

This is an RFC request for supporting virt-admin to update cacrl without restarting libvirtd. When a client wants to establish a TLS connection with libvirtd, a CRL file is used by libvirtd to verify the client's certificate. Right now, if the CRL file is changed, you must restart libvirtd to make it take effect. The restart behavior of libvirtd will cause clients connecting with libvirtd to fail. In a server cluster, the CRL file may be updated quite frequently due to the large amount of certificates. If the new CRL does not take effect in time, there are security risks. So you may need to restart libvirtd frequently to make the CRL take effect in time. However, frequent restarts will affect the reliability of cluster virtual machine management(such as openstack) services. This RFC patch adds a virt-admin command to update the server's CRL *online*. This patch is not elegant enough, if this feature makes sense, I'd do more improvements. --- include/libvirt/libvirt-admin.h | 4 ++ src/admin/admin_protocol.x | 13 +++++- src/admin/admin_server.c | 13 ++++++ src/admin/admin_server.h | 4 ++ src/admin/libvirt-admin.c | 33 ++++++++++++++++ src/admin/libvirt_admin_private.syms | 1 + src/admin/libvirt_admin_public.syms | 1 + src/rpc/virnetserver.c | 58 +++++++++++++++++++++++++++ src/rpc/virnetserver.h | 3 ++ src/rpc/virnettlscontext.c | 33 ++++++++++++++++ src/rpc/virnettlscontext.h | 3 ++ tools/virt-admin.c | 59 ++++++++++++++++++++++++++++ 12 files changed, 224 insertions(+), 1 deletion(-) diff --git a/include/libvirt/libvirt-admin.h b/include/libvirt/libvirt-admin.h index abf2792926..2df43db567 100644 --- a/include/libvirt/libvirt-admin.h +++ b/include/libvirt/libvirt-admin.h @@ -402,6 +402,10 @@ int virAdmServerSetClientLimits(virAdmServerPtr srv, int nparams, unsigned int flags); +int virAdmServerUpdateTlsFile(virAdmServerPtr srv, + unsigned int filetype, + unsigned int flags); + int virAdmConnectGetLoggingOutputs(virAdmConnectPtr conn, char **outputs, unsigned int flags); diff --git a/src/admin/admin_protocol.x b/src/admin/admin_protocol.x index 42e215d23a..c74c0d777b 100644 --- a/src/admin/admin_protocol.x +++ b/src/admin/admin_protocol.x @@ -181,6 +181,12 @@ struct admin_server_set_client_limits_args { unsigned int flags; }; +struct admin_server_update_tls_file_args { + admin_nonnull_server srv; + unsigned int filetype; + unsigned int flags; +}; + struct admin_connect_get_logging_outputs_args { unsigned int flags; }; @@ -314,5 +320,10 @@ enum admin_procedure { /** * @generate: both */ - ADMIN_PROC_CONNECT_SET_LOGGING_FILTERS = 17 + ADMIN_PROC_CONNECT_SET_LOGGING_FILTERS = 17, + + /** + * @generate: both + */ + ADMIN_PROC_SERVER_UPDATE_TLS_FILE = 18 }; diff --git a/src/admin/admin_server.c b/src/admin/admin_server.c index ba87f701c3..2f695eea4f 100644 --- a/src/admin/admin_server.c +++ b/src/admin/admin_server.c @@ -367,3 +367,16 @@ adminServerSetClientLimits(virNetServerPtr srv, return 0; } + +int +adminServerUpdateTlsFile(virNetServerPtr srv, + unsigned int filetype, + unsigned int flags) +{ + virCheckFlags(0, -1); + + if (virNetServerUpdateTlsFile(srv, filetype) < 0) + return -1; + + return 0; +} diff --git a/src/admin/admin_server.h b/src/admin/admin_server.h index 1d5cbec55f..748235811a 100644 --- a/src/admin/admin_server.h +++ b/src/admin/admin_server.h @@ -67,3 +67,7 @@ int adminServerSetClientLimits(virNetServerPtr srv, virTypedParameterPtr params, int nparams, unsigned int flags); + +int adminServerUpdateTlsFile(virNetServerPtr srv, + unsigned int filetype, + unsigned int flags); diff --git a/src/admin/libvirt-admin.c b/src/admin/libvirt-admin.c index 4099a54854..13c8db016d 100644 --- a/src/admin/libvirt-admin.c +++ b/src/admin/libvirt-admin.c @@ -1082,6 +1082,39 @@ virAdmServerSetClientLimits(virAdmServerPtr srv, return ret; } +/** + * virAdmServerUpdateTlsFile: + * @srv: a valid server object reference + * @filetype: TLS file type, such as crl, cert, key + * @flags: extra flags; not used yet, so callers should always pass 0 + * + * update TLS Context in TLS service. + * + * Returns 0 if the TLS files have been updated successfully or -1 in case of an + * error. + */ +int +virAdmServerUpdateTlsFile(virAdmServerPtr srv, + unsigned int filetype, + unsigned int flags) +{ + int ret = -1; + + VIR_DEBUG("srv=%p, filetype=%u flags=%x", srv, filetype, flags); + virResetLastError(); + + virCheckAdmServerGoto(srv, error); + + /* rpc call to update tls file */ + if ((ret = remoteAdminServerUpdateTlsFile(srv, filetype, flags)) < 0) + goto error; + + return ret; + error: + virDispatchError(NULL); + return ret; +} + /** * virAdmConnectGetLoggingOutputs: * @conn: pointer to an active admin connection diff --git a/src/admin/libvirt_admin_private.syms b/src/admin/libvirt_admin_private.syms index 9526412de8..d563757482 100644 --- a/src/admin/libvirt_admin_private.syms +++ b/src/admin/libvirt_admin_private.syms @@ -31,6 +31,7 @@ xdr_admin_server_lookup_client_args; xdr_admin_server_lookup_client_ret; xdr_admin_server_set_client_limits_args; xdr_admin_server_set_threadpool_parameters_args; +xdr_admin_server_update_tls_file_args; # datatypes.h virAdmClientClass; diff --git a/src/admin/libvirt_admin_public.syms b/src/admin/libvirt_admin_public.syms index 9a3f843780..97b223bfba 100644 --- a/src/admin/libvirt_admin_public.syms +++ b/src/admin/libvirt_admin_public.syms @@ -38,6 +38,7 @@ LIBVIRT_ADMIN_2.0.0 { virAdmClientClose; virAdmServerGetClientLimits; virAdmServerSetClientLimits; + virAdmServerUpdateTlsFile; }; LIBVIRT_ADMIN_3.0.0 { diff --git a/src/rpc/virnetserver.c b/src/rpc/virnetserver.c index 4122636805..fc18b2a224 100644 --- a/src/rpc/virnetserver.c +++ b/src/rpc/virnetserver.c @@ -1209,3 +1209,61 @@ virNetServerSetClientLimits(virNetServerPtr srv, virObjectUnlock(srv); return ret; } + +int +virNetServerUpdateTlsFile(virNetServerPtr srv, + unsigned int filetype) +{ + int ret = -1; +#if WITH_GNUTLS + size_t i; + int cnt = 0; + virNetTLSContextPtr ctxt = NULL; + virNetServerServicePtr svc = NULL; + + if (filetype != TYPE_CACRL_LIBVIRT) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("Don't support CRL filetype: %d"), + filetype); + return ret; + } + + virObjectLock(srv); + + /* find svcTLS from srv */ + for (i = 0; i < srv->nservices; i++) { + svc = srv->services[i]; + /* find tls from svc */ + ctxt = virNetServerServiceGetTLSContext(svc); + if (ctxt == NULL) + continue; + + ret = virNetTLSContextUpdateCRL(ctxt); + if (ret < 0) { + VIR_ERROR(_("update tls file fail, " + "filetype: %d, svcID: %zu"), filetype, i); + ret = -1; + goto cleanup; + } + VIR_INFO("update success, filetype: %d, svcID: %zu", filetype, i); + cnt++; + } + + if (cnt == 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("no tls server found, don't need update %d"), + filetype); + } else { + VIR_INFO("update tls file complete, filetype: %d", + filetype); + } + + cleanup: + virObjectUnlock(srv); +#else + virReportError(VIR_ERR_SYSTEM_ERROR, + _("Don't support GNUTLS: %d"), + filetype); +#endif + return ret; +} diff --git a/src/rpc/virnetserver.h b/src/rpc/virnetserver.h index 260c99b22d..d0138d250f 100644 --- a/src/rpc/virnetserver.h +++ b/src/rpc/virnetserver.h @@ -133,3 +133,6 @@ size_t virNetServerGetCurrentUnauthClients(virNetServerPtr srv); int virNetServerSetClientLimits(virNetServerPtr srv, long long int maxClients, long long int maxClientsUnauth); + +int virNetServerUpdateTlsFile(virNetServerPtr srv, + unsigned int filetype); diff --git a/src/rpc/virnettlscontext.c b/src/rpc/virnettlscontext.c index 08944f6771..1cc3cb8620 100644 --- a/src/rpc/virnettlscontext.c +++ b/src/rpc/virnettlscontext.c @@ -1106,6 +1106,39 @@ int virNetTLSContextCheckCertificate(virNetTLSContextPtr ctxt, return ret; } +int virNetTLSContextUpdateCRL(virNetTLSContextPtr ctxt) +{ + int ret = -1; + char *cacrl = NULL; + + if (VIR_STRDUP(cacrl, LIBVIRT_CACRL) < 0) + return -1; + + if (!virFileExists(cacrl)) { + virReportSystemError(errno, _("%s not exist"), cacrl); + goto cleanup; + } + + virObjectLock(ctxt); + + ret = gnutls_certificate_set_x509_crl_file(ctxt->x509cred, + cacrl, + GNUTLS_X509_FMT_PEM); + if (ret < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("Unable to update x509 CRL %s: %s"), + cacrl, gnutls_strerror(ret)); + } else { + VIR_INFO("Load %d CRL from %s", ret, cacrl); + ret = 0; + } + + virObjectUnlock(ctxt); + cleanup: + VIR_FREE(cacrl); + return ret; +} + void virNetTLSContextDispose(void *obj) { virNetTLSContextPtr ctxt = obj; diff --git a/src/rpc/virnettlscontext.h b/src/rpc/virnettlscontext.h index f3273bc26a..b823ab2c3f 100644 --- a/src/rpc/virnettlscontext.h +++ b/src/rpc/virnettlscontext.h @@ -23,6 +23,8 @@ #include "internal.h" #include "virobject.h" +#define TYPE_CACRL_LIBVIRT 13 + typedef struct _virNetTLSContext virNetTLSContext; typedef virNetTLSContext *virNetTLSContextPtr; @@ -65,6 +67,7 @@ virNetTLSContextPtr virNetTLSContextNewClient(const char *cacert, int virNetTLSContextCheckCertificate(virNetTLSContextPtr ctxt, virNetTLSSessionPtr sess); +int virNetTLSContextUpdateCRL(virNetTLSContextPtr ctxt); typedef ssize_t (*virNetTLSSessionWriteFunc)(const char *buf, size_t len, void *opaque); diff --git a/tools/virt-admin.c b/tools/virt-admin.c index 30106d1971..25971dbf27 100644 --- a/tools/virt-admin.c +++ b/tools/virt-admin.c @@ -50,6 +50,8 @@ /* we don't need precision to milliseconds in this module */ #define VIRT_ADMIN_TIME_BUFLEN VIR_TIME_STRING_BUFLEN - 3 +#define LIBVIRT_CACRL_TYPE 13 + static char *progname; static const vshCmdGrp cmdGroups[]; @@ -1103,6 +1105,57 @@ cmdDaemonLogOutputs(vshControl *ctl, const vshCmd *cmd) return true; } +/* ------------------------ + * Command update-crl-file + * ------------------------ + */ +static const vshCmdInfo info_srv_update_tls_file[] = { + {.name = "help", + .data = N_("notify tls file type, current only support libvirt cacrl(13)") + }, + {.name = "desc", + .data = N_("notify libvirtd TLS server hot update CACRL.") + }, + {.name = NULL} +}; + +static const vshCmdOptDef opts_srv_update_tls_file[] = { + {.name = "server", + .type = VSH_OT_DATA, + .flags = VSH_OFLAG_REQ, + .help = N_("Server to reload the CRL file."), + }, + {.name = NULL} +}; + +static bool +cmdSrvUpdateTlsFile(vshControl *ctl, const vshCmd *cmd) +{ + bool ret = false; + const char *srvname = NULL; + unsigned int filetype = LIBVIRT_CACRL_TYPE; + + virAdmServerPtr srv = NULL; + vshAdmControlPtr priv = ctl->privData; + + if (vshCommandOptStringReq(ctl, cmd, "server", &srvname) < 0) + return false; + + if (!(srv = virAdmConnectLookupServer(priv->conn, srvname, 0))) + goto cleanup; + + if (virAdmServerUpdateTlsFile(srv, filetype, 0) < 0) { + vshError(ctl, "%s", _("Unable to update server's tls file.")); + goto cleanup; + } + + ret = true; + + cleanup: + virAdmServerFree(srv); + return ret; +} + static void * vshAdmConnectionHandler(vshControl *ctl) { @@ -1486,6 +1539,12 @@ static const vshCmdDef managementCmds[] = { .info = info_daemon_log_outputs, .flags = 0 }, + {.name = "update-crl-file", + .handler = cmdSrvUpdateTlsFile, + .opts = opts_srv_update_tls_file, + .info = info_srv_update_tls_file, + .flags = 0 + }, {.name = NULL} };

2 1

[libvirt] [PATCH] fix class type instantiated when listing network ports
by Daniel P. Berrangé 02 Jan '20

02 Jan '20

Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt-override-virNetwork.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt-override-virNetwork.py b/libvirt-override-virNetwork.py index 749ee44..4245322 100644 --- a/libvirt-override-virNetwork.py +++ b/libvirt-override-virNetwork.py @@ -6,6 +6,6 @@ retlist = list() for domptr in ret: - retlist.append(virNetwork(self, _obj=domptr)) + retlist.append(virNetworkPort(self, _obj=domptr)) return retlist -- 2.24.1

2 1

[libvirt] [PATCH v2 0/5] Remove the last "no_memory" label
by Fabiano Fidêncio 02 Jan '20

02 Jan '20

This series touches virfirewall.c, the last place where a no_memory label can be found. The series: - Gets rid of setting and checking for ENOMEM as a firewall's error; - Use g_auto / g_autofree in a few different places; - Adapt ADD_ARG() macro as VIR_RESIZE_N() just aborts in case of OOM; - Remove no_memory mention from the hacking guide; Changes since v1: https://www.redhat.com/archives/libvir-list/2020-January/msg00018.html - Daniel suggested to get rid of ADD_ARG(). Instead of doing so, I've adapted the macro (as it does more than just a realloc) and, by doing so, got rid of the no_memory labels; - Dropped: - util: Rename 'no_memory' label to 'cleanup' - util: Add ADD_ARG_RETURN_ON_ERROR - util: Add ADD_ARG_RETURN_VALUE_ON_ERROR - Added: - util: Adapt ADD_ARG() macro Fabiano Fidêncio (5): util: Don't set/check for ENOMEM as a firewall error util: Use g_auto/g_autofree in virFirewallAddRuleFullV() util: Use g_auto in virFirewallStartTransaction() util: Adapt ADD_ARG() macro docs: Remove mention to no_memory label docs/hacking.html.in | 1 - src/util/virfirewall.c | 65 +++++++++++------------------------------- 2 files changed, 16 insertions(+), 50 deletions(-) -- 2.24.1

1 5

[libvirt] [PATCH] travis: fix homebrew install of python3
by Daniel P. Berrangé 02 Jan '20

02 Jan '20

The Python3 package has started failing to install from HomeBrew with the following: Error: The `brew link` step did not complete successfully The formula built, but is not symlinked into /usr/local Could not symlink Frameworks/Python.framework/Headers Target /usr/local/Frameworks/Python.framework/Headers is a symlink belonging to python@2. You can unlink it: brew unlink python@2 To force the link and overwrite all conflicting files: brew link --overwrite python The result is that libvirt fails to find python3: checking for python3... no configure: error: 'python3' binary is required to build libvirt It is unclear what changed in Travis/HomeBrew to break our previously working setup, but running the suggested command fixes it well enough for libvirt's CI needs. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- Pushed as a CI build fix .travis.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.travis.yml b/.travis.yml index 44ff5e9898..f129706456 100644 --- a/.travis.yml +++ b/.travis.yml @@ -67,6 +67,9 @@ matrix: env: - PATH="/usr/local/opt/gettext/bin:/usr/local/opt/ccache/libexec:/usr/local/opt/rpcgen/bin:$PATH" - PKG_CONFIG_PATH="/usr/local/opt/libxml2/lib/pkgconfig" + before_script: + # Hack to blow away py2 + - brew link --overwrite python script: # We can't run 'distcheck' or 'syntax-check' because they fail on # macOS, but doing 'install' and 'dist' gives us some useful coverage -- 2.24.1

1 0