- Devel - libvirt List Archives

[libvirt] [PATCH v3 0/2] Add machine type pc-1.0-qemu-kvm for live migrate compatibility with qemu-kvm
by Alex Bligh 23 Sep '14

23 Sep '14

This patch series adds inbound migrate capability from qemu-kvm version 1.0. The main ideas are those set out in Cole Robinson's patch here: http://pkgs.fedoraproject.org/cgit/qemu.git/tree/0001-Fix-migration-from-qe… however, rather than patching statically (and breaking inbound migration on existing machine types), I have added a new machine type (pc-1.0-qemu-kvm) without affecting any other machine types. The existing pc-1.0 machine type is renamed to pc-1.0-qemu-git, with pc-1.0 becoming an alias for one or another, as selected by a configure option (defaulting to pc-1.0-qemu-git, IE no change). Two aproaches are taken: * In hw/timer/i8254_common.c, the VMSTATE_UINT32_TEST macro is used to test the version for the irq_disable flags, allowing version 3 or more, or version 2 for an inbound migrate from qemu-kvm (only). * In hw/acpi/piix4.c, qemu-kvm incorrectly uses version 2 for a version 3 structure, causing acpi_load_old to be used. acpi_load_old detects this situation based on the machine type and restarts the attempt to load the vmstate using a customised VMStateDescription. The above cleaner approach is unavailable here. I developed this on qemu 2.0 but have forward ported it (trivially) to master. My testing has been on a VM live-migrated-to-file from Ubuntu Precise qemu-kvm 1.0. I have given this a moderate degree of testing but it could do with more. Note that certain hardware devices (including QXL) will not migrate properly due to a fundamental difference in their internal state between versions. Also note that (as expected) migration from qemu-2.x to qemu-1.0 will not work, even if the machine types are the same. Alex Bligh (2): Add machine type pc-1.0-qemu-kvm for live migrate compatibility with qemu-kvm Add configure option --enable-pc-1-0-qemu-kvm configure | 12 ++++++++++++ hw/acpi/piix4.c | 47 +++++++++++++++++++++++++++++++++++++++++++++-- hw/i386/pc_piix.c | 38 +++++++++++++++++++++++++++++++++++++- hw/timer/i8254_common.c | 10 +++++++++- 4 files changed, 103 insertions(+), 4 deletions(-) -- 1.7.9.5

7 28

[libvirt] [PATCH] cpu: fix wrong single quote mark
by Chen Fan 23 Sep '14

23 Sep '14

Signed-off-by: Chen Fan <chen.fan.fnst(a)cn.fujitsu.com> --- src/conf/cpu_conf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/conf/cpu_conf.c b/src/conf/cpu_conf.c index 6c454ee..116aa58 100644 --- a/src/conf/cpu_conf.c +++ b/src/conf/cpu_conf.c @@ -413,7 +413,7 @@ virCPUDefParseXML(xmlNodePtr node, for (j = 0; j < i; j++) { if (STREQ(name, def->features[j].name)) { virReportError(VIR_ERR_XML_ERROR, - _("CPU feature `%s' specified more than once"), + _("CPU feature '%s' specified more than once"), name); VIR_FREE(name); goto error; @@ -731,7 +731,7 @@ virCPUDefUpdateFeatureInternal(virCPUDefPtr def, } virReportError(VIR_ERR_INTERNAL_ERROR, - _("CPU feature `%s' specified more than once"), + _("CPU feature '%s' specified more than once"), name); return -1; -- 1.9.3

2 1

[libvirt] [PATCH v1 0/3] Check migration configuration
by Chen Fan 23 Sep '14

23 Sep '14

This version differs from the patch set "conf: Check migration_host is valid or not during libvirt restarts" I posted 2 weeks ago, I droped checking the migration_host on target host. and find an issue when setting migration_host. Chen Fan (3): migration: add migration_host support for Ipv6 address without brackets conf: Check migration_host is localhost or not during restart conf: Check migration_address is valid or not during restart src/qemu/qemu.conf | 2 +- src/qemu/qemu_conf.c | 21 +++++++++++++++++++++ src/qemu/qemu_migration.c | 19 +++++++++++++++---- src/qemu/test_libvirtd_qemu.aug.in | 2 +- 4 files changed, 38 insertions(+), 6 deletions(-) -- 1.9.3

3 8

[libvirt] [PATCH v2 0/2] Use huge pages on UMA guests widely
by Michal Privoznik 22 Sep '14

22 Sep '14

*** BLURB HERE *** Michal Privoznik (2): conf: Disallow nonexistent NUMA nodes for hugepages qemu: Honor hugepages for UMA domains src/qemu/qemu_command.c | 49 ++++++++++++++++++++-- .../qemuxml2argv-hugepages-pages4.xml | 45 ++++++++++++++++++++ .../qemuxml2argv-hugepages-pages5.args | 7 ++++ .../qemuxml2argv-hugepages-pages5.xml | 32 ++++++++++++++ tests/qemuxml2argvtest.c | 3 ++ 5 files changed, 132 insertions(+), 4 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-hugepages-pages4.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-hugepages-pages5.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-hugepages-pages5.xml -- 1.8.5.5

3 4

[libvirt] [PATCH 0/4] bulk stats: QEMU implementation polishing
by Francesco Romani 22 Sep '14

22 Sep '14

This patchset does polishing on the QEMU bulk stats implementation. The main issue this patchset addresses is that, unless a critical error is found, bulk stats should be silent and ignore errors. To do so, virResetLastError() is used in a few places, but this is not enough since errors are logged anyway. A better approach is to avoid to report error entirely. The patchset is organized as follows: - patches 1 to 3 enhances the functions used in the bulk stats path(s) adding a 'bool report' flag, to let the caller optionally suppress error reporting. - patch 4 is a general polishing patch which reduces repetition of the code in the block stats collection. Francesco Romani (4): qemu: make qemuDomainHelperGetVcpus silent make virNetInterfaceStats silent qemu: make qemuMonitorGetAllBlockStatsInfo silent qemu: json monitor: reduce duplicated code src/lxc/lxc_driver.c | 2 +- src/openvz/openvz_driver.c | 2 +- src/qemu/qemu_driver.c | 32 +++++----- src/qemu/qemu_monitor.c | 12 ++-- src/qemu/qemu_monitor.h | 3 +- src/qemu/qemu_monitor_json.c | 136 ++++++++++++++++++++----------------------- src/qemu/qemu_monitor_json.h | 3 +- src/util/virstats.c | 21 ++++--- src/util/virstats.h | 3 +- src/xen/xen_hypervisor.c | 2 +- 10 files changed, 111 insertions(+), 105 deletions(-) -- 1.9.3

4 7

[libvirt] [PATCH] qemu: raise an error when trying to use readonly sata disks
by Giuseppe Scrivano 22 Sep '14

22 Sep '14

commit 72f919f558902968bd0cf9f99f25ac62cbfe3ac6 introduced an user friendly error message when trying to use IDE disks as readonly. Do the same thing for the SATA bus. Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1112939 Signed-off-by: Giuseppe Scrivano <gscrivan(a)redhat.com> --- src/qemu/qemu_command.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 86e0290..ca1b6cb 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -3508,11 +3508,17 @@ qemuBuildDriveStr(virConnectPtr conn, virBufferAddLit(&opt, ",boot=on"); if (disk->src->readonly && virQEMUCapsGet(qemuCaps, QEMU_CAPS_DRIVE_READONLY)) { - if (disk->bus == VIR_DOMAIN_DISK_BUS_IDE && - disk->device == VIR_DOMAIN_DISK_DEVICE_DISK) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("readonly ide disks are not supported")); - goto error; + if (disk->device == VIR_DOMAIN_DISK_DEVICE_DISK) { + if (disk->bus == VIR_DOMAIN_DISK_BUS_IDE) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("readonly ide disks are not supported")); + goto error; + } + if (disk->bus == VIR_DOMAIN_DISK_BUS_SATA) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("readonly sata disks are not supported")); + goto error; + } } virBufferAddLit(&opt, ",readonly=on"); } -- 1.9.3

2 2

[libvirt] [PATCHv2] qemu: hook: Provide hook when restoring a domain save image
by Peter Krempa 22 Sep '14

22 Sep '14

--- docs/hooks.html.in | 11 ++++++++ src/qemu/qemu_driver.c | 70 +++++++++++++++++++++++++++++++++++++++++++++----- src/util/virhook.c | 3 ++- src/util/virhook.h | 1 + 4 files changed, 78 insertions(+), 7 deletions(-) diff --git a/docs/hooks.html.in b/docs/hooks.html.in index 07b9d49..1aae00c 100644 --- a/docs/hooks.html.in +++ b/docs/hooks.html.in @@ -177,6 +177,17 @@ script returns failure or the output XML is not valid, incoming migration will be canceled. This hook may be used, e.g., to change location of disk images for incoming domains.</li> + <li>Since 1.2.9, the qemu hook script is + also called when restoring a saved image either via the API or + automatically when restoring a managed save machine. It is called + as: <pre>/etc/libvirt/hooks/qemu guest_name restore begin -</pre> + with domain XML sent to standard input of the script. In this case, + the script acts as a filter and is supposed to modify the domain + XML and print it out on its standard output. Empty output is + identical to copying the input XML without changing it. In case the + script returns failure or the output XML is not valid, restore of the + image will be aborted. This hook may be used, e.g., to change + location of disk images for restored domains.</li> <li>Since 0.9.13, the qemu hook script is also called when the libvirtd daemon restarts and reconnects to previously running QEMU processes. If the script fails, the diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index ee542bf..e73d4f9 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5644,20 +5644,24 @@ qemuDomainRestoreFlags(virConnectPtr conn, unsigned int flags) { virQEMUDriverPtr driver = conn->privateData; + qemuDomainObjPrivatePtr priv = NULL; virDomainDefPtr def = NULL; - virDomainDefPtr newdef = NULL; virDomainObjPtr vm = NULL; + char *xml = NULL; + char *xmlout = NULL; + const char *newxml = dxml; int fd = -1; int ret = -1; virQEMUSaveHeader header; virFileWrapperFdPtr wrapperFd = NULL; + bool hook_taint = false; virCheckFlags(VIR_DOMAIN_SAVE_BYPASS_CACHE | VIR_DOMAIN_SAVE_RUNNING | VIR_DOMAIN_SAVE_PAUSED, -1); - fd = qemuDomainSaveImageOpen(driver, path, &def, &header, NULL, + fd = qemuDomainSaveImageOpen(driver, path, &def, &header, &xml, (flags & VIR_DOMAIN_SAVE_BYPASS_CACHE) != 0, &wrapperFd, false, false); if (fd < 0) @@ -5666,12 +5670,31 @@ qemuDomainRestoreFlags(virConnectPtr conn, if (virDomainRestoreFlagsEnsureACL(conn, def) < 0) goto cleanup; - if (dxml) { - if (!(newdef = qemuDomainSaveImageUpdateDef(driver, def, dxml))) + if (virHookPresent(VIR_HOOK_DRIVER_QEMU)) { + int hookret; + + if ((hookret = virHookCall(VIR_HOOK_DRIVER_QEMU, def->name, + VIR_HOOK_QEMU_OP_RESTORE, + VIR_HOOK_SUBOP_BEGIN, + NULL, + dxml ? dxml : xml, + &xmlout)) < 0) + goto cleanup; + + if (hookret == 0 && xmlout) { + VIR_DEBUG("Using hook-filtered domain XML: %s", xmlout); + hook_taint = true; + newxml = xmlout; + } + } + + if (newxml) { + virDomainDefPtr tmp; + if (!(tmp = qemuDomainSaveImageUpdateDef(driver, def, newxml))) goto cleanup; virDomainDefFree(def); - def = newdef; + def = tmp; } if (!(vm = virDomainObjListAdd(driver->domains, def, @@ -5687,6 +5710,11 @@ qemuDomainRestoreFlags(virConnectPtr conn, else if (flags & VIR_DOMAIN_SAVE_PAUSED) header.was_running = 0; + if (hook_taint) { + priv = vm->privateData; + priv->hookRun = true; + } + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0) goto cleanup; @@ -5705,6 +5733,8 @@ qemuDomainRestoreFlags(virConnectPtr conn, cleanup: virDomainDefFree(def); VIR_FORCE_CLOSE(fd); + VIR_FREE(xml); + VIR_FREE(xmlout); virFileWrapperFdFree(wrapperFd); if (vm) virObjectUnlock(vm); @@ -5842,12 +5872,15 @@ qemuDomainObjRestore(virConnectPtr conn, bool bypass_cache) { virDomainDefPtr def = NULL; + qemuDomainObjPrivatePtr priv = vm->privateData; int fd = -1; int ret = -1; + char *xml = NULL; + char *xmlout = NULL; virQEMUSaveHeader header; virFileWrapperFdPtr wrapperFd = NULL; - fd = qemuDomainSaveImageOpen(driver, path, &def, &header, NULL, + fd = qemuDomainSaveImageOpen(driver, path, &def, &header, &xml, bypass_cache, &wrapperFd, false, true); if (fd < 0) { if (fd == -3) @@ -5855,6 +5888,29 @@ qemuDomainObjRestore(virConnectPtr conn, goto cleanup; } + if (virHookPresent(VIR_HOOK_DRIVER_QEMU)) { + int hookret; + + if ((hookret = virHookCall(VIR_HOOK_DRIVER_QEMU, def->name, + VIR_HOOK_QEMU_OP_RESTORE, + VIR_HOOK_SUBOP_BEGIN, + NULL, xml, &xmlout)) < 0) + goto cleanup; + + if (hookret == 0 && xmlout) { + virDomainDefPtr tmp; + + VIR_DEBUG("Using hook-filtered domain XML: %s", xmlout); + + if (!(tmp = qemuDomainSaveImageUpdateDef(driver, def, xmlout))) + goto cleanup; + + virDomainDefFree(def); + def = tmp; + priv->hookRun = true; + } + } + if (STRNEQ(vm->def->name, def->name) || memcmp(vm->def->uuid, def->uuid, VIR_UUID_BUFLEN)) { char vm_uuidstr[VIR_UUID_STRING_BUFLEN]; @@ -5878,6 +5934,8 @@ qemuDomainObjRestore(virConnectPtr conn, VIR_WARN("Failed to close %s", path); cleanup: + VIR_FREE(xml); + VIR_FREE(xmlout); virDomainDefFree(def); VIR_FORCE_CLOSE(fd); virFileWrapperFdFree(wrapperFd); diff --git a/src/util/virhook.c b/src/util/virhook.c index ac7b40f..25d0783 100644 --- a/src/util/virhook.c +++ b/src/util/virhook.c @@ -77,7 +77,8 @@ VIR_ENUM_IMPL(virHookQemuOp, VIR_HOOK_QEMU_OP_LAST, "migrate", "started", "reconnect", - "attach") + "attach", + "restore") VIR_ENUM_IMPL(virHookLxcOp, VIR_HOOK_LXC_OP_LAST, "start", diff --git a/src/util/virhook.h b/src/util/virhook.h index 5bc0a5f..550ef84 100644 --- a/src/util/virhook.h +++ b/src/util/virhook.h @@ -60,6 +60,7 @@ typedef enum { VIR_HOOK_QEMU_OP_STARTED, /* domain has started */ VIR_HOOK_QEMU_OP_RECONNECT, /* domain is being reconnected by libvirt */ VIR_HOOK_QEMU_OP_ATTACH, /* domain is being attached to be libvirt */ + VIR_HOOK_QEMU_OP_RESTORE, /* domain is being restored */ VIR_HOOK_QEMU_OP_LAST, } virHookQemuOpType; -- 2.1.0

2 2

[libvirt] [PATCH 0/5] Refactor save image opening and add restore hook
by Peter Krempa 22 Sep '14

22 Sep '14

This series refactors (splits) the save image open function into separate chunks and introduces a filter-hook that is called when restoring a save image. Peter Krempa (5): qemu: save image: Split out user provided XML checker qemu: save image: Add possibility to return XML stored in the image qemu: save image: Split out new definition check/update qemu: save image: Split out checks done only when editing the save img qemu: hook: Provide hook when restoring a domain save image docs/hooks.html.in | 11 +++ src/qemu/qemu_driver.c | 261 ++++++++++++++++++++++++++++++++++--------------- src/util/virhook.c | 3 +- src/util/virhook.h | 1 + 4 files changed, 195 insertions(+), 81 deletions(-) -- 2.1.0

2 11

[libvirt] [PATCH] rng: validating tap and vhost attributes separately
by Jianwei Hu 22 Sep '14

22 Sep '14

When using virt-xml-validate to check tap and vhost attributes in <interface> of domain xml, should validate them separately, don't combine to check them, we can ignore/specify any of them. --- docs/schemas/domaincommon.rng | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index 36bc184..b6b309d 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -2313,12 +2313,16 @@ </optional> <optional> <element name="backend"> + <optional> <attribute name='tap'> <ref name='absFilePath'/> </attribute> + </optional> + <optional> <attribute name='vhost'> <ref name='absFilePath'/> </attribute> + </optional> </element> </optional> <optional> -- 1.8.3.1

2 1

[libvirt] [PATCH] docs: vhost-net should instead of net-vhost
by Jianwei Hu 22 Sep '14

22 Sep '14

It's a minor typo issue, /dev/vhost-net is a default device. # ll /dev/vhost-net crw-------. 1 root root 10, 238 Sep 22 20:30 /dev/vhost-net --- docs/formatdomain.html.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 5e2b65a..eefdd5e 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -3989,7 +3989,7 @@ qemu-kvm -net nic,model=? /dev/null <source network='default'/> <target dev='vnet1'/> <model type='virtio'/> - <backend tap='/dev/net/tun' vhost='/dev/net-vhost'/> + <backend tap='/dev/net/tun' vhost='/dev/vhost-net'/> <driver name='vhost' txmode='iothread' ioeventfd='on' event_idx='off' queues='5'/> </interface> </devices> -- 1.8.3.1

2 1

[libvirt] [PATCH] qemu: Pass file descriptor when using TPM passthrough
by Stefan Berger 22 Sep '14

22 Sep '14

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com> Pass the TPM file descriptor to QEMU via command line. Instead of passing /dev/tpm0 we now pass /dev/fdset/10 and the additional parameters -add-fd set=10,fd=20. This addresses the use case when QEMU is started with non-root privileges and QEMU cannot open /dev/tpm0 for example. One problem is that for the passing of the file descriptor set to work, virCommandReorderFDs must not be called on the virCommand. This is prevented by setting a flag in the virCommandPassFDGetFDIndex that is checked to be clear when virCommandReorderFDs is run. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- src/libvirt_private.syms | 1 + src/qemu/qemu_command.c | 132 ++++++++++++++++++++++++++++++++++++++++++++--- src/util/vircommand.c | 33 ++++++++++++ src/util/vircommand.h | 3 ++ 4 files changed, 162 insertions(+), 7 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 10ebd12..b203398 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1149,6 +1149,7 @@ virCommandNewArgList; virCommandNewArgs; virCommandNonblockingFDs; virCommandPassFD; +virCommandPassFDGetFDIndex; virCommandPassListenFDs; virCommandRawStatus; virCommandRequireHandshake; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 7b87a31..950d212 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -157,6 +157,58 @@ VIR_ENUM_IMPL(qemuNumaPolicy, VIR_DOMAIN_NUMATUNE_MEM_LAST, "interleave"); /** + * qemuVirCommandGetFDSet: + * @cmd: the command to modify + * @fd: fd to reassign to the child + * + * Get the parameters for the QEMU -add-fd command line option + * for the given file descriptor. The file descriptor must previously + * have been 'transferred' in a virCommandPassFD() call. + * This function for example returns "set=10,fd=20". + */ +static char * +qemuVirCommandGetFDSet(virCommandPtr cmd, int fd) +{ + char *result = NULL; + int idx = virCommandPassFDGetFDIndex(cmd, fd); + + if (idx >= 0) { + ignore_value(virAsprintf(&result, "set=%d,fd=%d", idx, fd) < 0); + } else { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("file descriptor %d has not been transferred"), fd); + } + + return result; +} + +/** + * qemuVirCommandGetDevSet: + * @cmd: the command to modify + * @fd: fd to reassign to the child + * + * Get the parameters for the QEMU path= parameter where a file + * descriptor is accessed via a file descriptor set, for example + * /dev/fdset/10. The file descriptor must previously have been + * 'transferred' in a virCommandPassFD() call. + */ +static char * +qemuVirCommandGetDevSet(virCommandPtr cmd, int fd) +{ + char *result = NULL; + int idx = virCommandPassFDGetFDIndex(cmd, fd); + + if (idx >= 0) { + ignore_value(virAsprintf(&result, "/dev/fdset/%d", idx) < 0); + } else { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("file descriptor %d has not been transferred"), fd); + } + return result; +} + + +/** * qemuPhysIfaceConnect: * @def: the definition of the VM (needed by 802.1Qbh and audit) * @driver: pointer to the driver instance @@ -5779,14 +5831,20 @@ qemuBuildRNGDeviceArgs(virCommandPtr cmd, static char *qemuBuildTPMBackendStr(const virDomainDef *def, + virCommandPtr cmd, virQEMUCapsPtr qemuCaps, - const char *emulator) + const char *emulator, + int *tpmfd, int *cancelfd) { const virDomainTPMDef *tpm = def->tpm; virBuffer buf = VIR_BUFFER_INITIALIZER; const char *type = virDomainTPMBackendTypeToString(tpm->type); - char *cancel_path; + char *cancel_path = NULL; const char *tpmdev; + char *devset = NULL, *cancel_devset = NULL; + + *tpmfd = -1; + *cancelfd = -1; virBufferAsprintf(&buf, "%s,id=tpm-%s", type, tpm->info.alias); @@ -5799,11 +5857,47 @@ static char *qemuBuildTPMBackendStr(const virDomainDef *def, if (!(cancel_path = virTPMCreateCancelPath(tpmdev))) goto error; - virBufferAddLit(&buf, ",path="); - virBufferEscape(&buf, ',', ",", "%s", tpmdev); + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_ADD_FD)) { + *tpmfd = open(tpmdev, O_RDWR); + if (*tpmfd < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Could not open TPM device %s"), tpmdev); + goto error; + } + + virCommandPassFD(cmd, *tpmfd, + VIR_COMMAND_PASS_FD_CLOSE_PARENT); + devset = qemuVirCommandGetDevSet(cmd, *tpmfd); + if (devset == NULL) + goto error; + + *cancelfd = open(cancel_path, O_WRONLY); + if (*cancelfd < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Could not open TPM device's cancel path " + "%s"), cancel_path); + goto error; + } + + virCommandPassFD(cmd, *cancelfd, + VIR_COMMAND_PASS_FD_CLOSE_PARENT); + cancel_devset = qemuVirCommandGetDevSet(cmd, *cancelfd); + if (cancel_devset == NULL) + goto error; + + virBufferAddLit(&buf, ",path="); + virBufferEscape(&buf, ',', ",", "%s", devset); - virBufferAddLit(&buf, ",cancel-path="); - virBufferEscape(&buf, ',', ",", "%s", cancel_path); + virBufferAddLit(&buf, ",cancel-path="); + virBufferEscape(&buf, ',', ",", "%s", cancel_devset); + } else { + /* all test cases will use this path */ + virBufferAddLit(&buf, ",path="); + virBufferEscape(&buf, ',', ",", "%s", tpmdev); + + virBufferAddLit(&buf, ",cancel-path="); + virBufferEscape(&buf, ',', ",", "%s", cancel_path); + } VIR_FREE(cancel_path); break; @@ -5823,6 +5917,10 @@ static char *qemuBuildTPMBackendStr(const virDomainDef *def, emulator, type); error: + VIR_FREE(devset); + VIR_FREE(cancel_devset); + VIR_FREE(cancel_path); + virBufferFreeAndReset(&buf); return NULL; } @@ -8770,13 +8868,33 @@ qemuBuildCommandLine(virConnectPtr conn, if (def->tpm) { char *optstr; + int tpmfd = -1; + int cancelfd = -1; + char *fdset; - if (!(optstr = qemuBuildTPMBackendStr(def, qemuCaps, emulator))) + if (!(optstr = qemuBuildTPMBackendStr(def, cmd, qemuCaps, emulator, + &tpmfd, &cancelfd))) goto error; virCommandAddArgList(cmd, "-tpmdev", optstr, NULL); VIR_FREE(optstr); + if (tpmfd >= 0) { + fdset = qemuVirCommandGetFDSet(cmd, tpmfd); + if (!fdset) + goto error; + + virCommandAddArgList(cmd, "-add-fd", fdset, NULL); + } + + if (cancelfd >= 0) { + fdset = qemuVirCommandGetFDSet(cmd, cancelfd); + if (!fdset) + goto error; + + virCommandAddArgList(cmd, "-add-fd", fdset, NULL); + } + if (!(optstr = qemuBuildTPMDevStr(def, qemuCaps, emulator))) goto error; diff --git a/src/util/vircommand.c b/src/util/vircommand.c index cbe94f8..fd70e78 100644 --- a/src/util/vircommand.c +++ b/src/util/vircommand.c @@ -67,6 +67,7 @@ enum { VIR_EXEC_RUN_SYNC = (1 << 3), VIR_EXEC_ASYNC_IO = (1 << 4), VIR_EXEC_LISTEN_FDS = (1 << 5), + VIR_EXEC_FIXED_FDS = (1 << 6), }; typedef struct _virCommandFD virCommandFD; @@ -214,6 +215,12 @@ virCommandReorderFDs(virCommandPtr cmd) if (!cmd || cmd->has_error || !cmd->npassfd) return; + if ((cmd->flags & VIR_EXEC_FIXED_FDS)) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("The fds are fixed and cannot be reordered")); + goto error; + } + for (i = 0; i < cmd->npassfd; i++) maxfd = MAX(cmd->passfd[i].fd, maxfd); @@ -1020,6 +1027,32 @@ virCommandPassListenFDs(virCommandPtr cmd) cmd->flags |= VIR_EXEC_LISTEN_FDS; } +/* + * virCommandPassFDGetFDIndex: + * @cmd: pointer to virCommand + * @fd: FD to get index of + * + * Determine the index of the FD in the transfer set. + * + * Returns index >= 0 if @set contains @fd, + * -1 otherwise. + */ +int +virCommandPassFDGetFDIndex(virCommandPtr cmd, int fd) +{ + size_t i = 0; + + while (i < cmd->npassfd) { + if (cmd->passfd[i].fd == fd) { + cmd->flags |= VIR_EXEC_FIXED_FDS; + return i; + } + i++; + } + + return -1; +} + /** * virCommandSetPidFile: * @cmd: the command to modify diff --git a/src/util/vircommand.h b/src/util/vircommand.h index bf65de4..198da2f 100644 --- a/src/util/vircommand.h +++ b/src/util/vircommand.h @@ -62,6 +62,9 @@ void virCommandPassFD(virCommandPtr cmd, void virCommandPassListenFDs(virCommandPtr cmd); +int virCommandPassFDGetFDIndex(virCommandPtr cmd, + int fd); + void virCommandSetPidFile(virCommandPtr cmd, const char *pidfile) ATTRIBUTE_NONNULL(2); -- 1.9.3

2 2

[libvirt] [PATCH v2 0/9] qemu: Introduce support for new the block_set_io_throttle parameters add in the version 1.7 of qemu.
by Matthias Gatto 22 Sep '14

22 Sep '14

This series of patches add support for bps_max, bps_rd_max, bps_wr_max, bps_max, bps_rd_max, bps_wr_max, and iops_size in the functions qemuDomainSetBlockIoTune and qemuDomainGetBlockIoTune. The last patch add support for terse parameters to the virsh blkdeviotune command. v2: spellfix Matthias Gatto (9): qemu: Add defines for the news throttle options qemu: Add news throttle options to the structure _virDomainBlockIoTuneInfo. qemu: Add the capabilitie to detect if the qemu binary have the capability to use bps_max and friends qemu: Add bps_max and friends qemu driver qemu: Add bps_max and friend to domain_conf qemu: Add bps_max and friends QMP suport qemu: Add bps_max and friends "text" support qemu: add bps_max and friends to qemu command generation virsh: Add bps_max and friends to virsh include/libvirt/libvirt.h.in | 54 +++++++++++++++ src/conf/domain_conf.c | 89 +++++++++++++++++++++++- src/conf/domain_conf.h | 8 +++ src/qemu/qemu_capabilities.c | 6 ++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 49 ++++++++++++++ src/qemu/qemu_driver.c | 158 +++++++++++++++++++++++++++++++++++++++++-- src/qemu/qemu_monitor_json.c | 58 +++++++++++++--- src/qemu/qemu_monitor_text.c | 75 ++++++++++++++++++-- tests/qemumonitorjsontest.c | 2 +- tools/virsh-domain.c | 119 ++++++++++++++++++++++++++++++++ 11 files changed, 595 insertions(+), 24 deletions(-) -- 1.8.3.1

2 18

[libvirt] [PATCH v1 00/10] Keep original security label
by Michal Privoznik 22 Sep '14

22 Sep '14

I know I've sent several versions like ages ago, so this should not start with v1, but hey, this is completely new approach, so I'm gonna start from 1. Here, the virtlockd is misused to hold the original seclabels (although only DAC label is implemented so far). Even more, it does a reference counting, so that only the last label restore does the job, not the previous ones. Michal Privoznik (10): locking: Allow seclabel remembering locking: Implement seclabel stubs for NOP domain_lock: Introduce seclabel APIs locking: Add virLockSeclabelProtocol driver_lockd: Implement seclabel APIs lock_daemon: Implement server dispatch lock_daemon: Implement seclabel APIs security_dac: Cleanup virSecurityDACSetOwnershipInternal usage virSecurityManagerNew: Add virLockManagerPluginPtr security_dac: Keep original label .gitignore | 2 + src/Makefile.am | 34 ++- src/libvirt_private.syms | 4 + src/lock_seclabel_protocol-structs | 21 ++ src/locking/domain_lock.c | 65 ++++++ src/locking/domain_lock.h | 10 + src/locking/lock_daemon.c | 388 ++++++++++++++++++++++++++++++++++- src/locking/lock_daemon.h | 8 + src/locking/lock_daemon_dispatch.c | 77 +++++++ src/locking/lock_daemon_dispatch.h | 3 + src/locking/lock_driver.h | 43 ++++ src/locking/lock_driver_lockd.c | 118 ++++++++++- src/locking/lock_driver_nop.c | 22 ++ src/locking/lock_manager.c | 26 +++ src/locking/lock_manager.h | 9 + src/locking/lock_seclabel_protocol.x | 53 +++++ src/lxc/lxc_controller.c | 2 +- src/lxc/lxc_driver.c | 3 +- src/qemu/qemu_driver.c | 7 +- src/security/security_dac.c | 145 ++++++++++--- src/security/security_manager.c | 25 ++- src/security/security_manager.h | 6 +- tests/Makefile.am | 1 + tests/qemuhotplugtest.c | 2 +- tests/seclabeltest.c | 2 +- tests/securityselinuxlabeltest.c | 2 +- tests/securityselinuxtest.c | 2 +- 27 files changed, 1028 insertions(+), 52 deletions(-) create mode 100644 src/lock_seclabel_protocol-structs create mode 100644 src/locking/lock_seclabel_protocol.x -- 1.8.5.5

3 23

[libvirt] Looking for sponsors for Outreach Program for Women 2014 December-March
by Stefan Hajnoczi 20 Sep '14

20 Sep '14

Dear QEMU, libvirt, and KVM communities, Thanks to mentors from our communities, we have assembled project ideas for Outreach Program for Women 2014 December-March (with more on the way!): http://qemu-project.org/Outreach_Program_for_Women_2014_DecemberMarch OPW is a program that allows women to work full-time for 12 weeks on open source projects. QEMU, the Linux kernel, and other organizations have participated successfully in the past. Outreach Program for Women participants are funded by sponsors - usually companies or organizations that wish to see the open source community grow and increase inclusion of women in open source. We are now looking for funding to make OPW December-March possible. Maybe your company is interested in becoming a sponsor? All the details are explained here: https://wiki.gnome.org/OutreachProgramForWomen/Admin/InfoForOrgs Thanks, Stefan

1 0

[libvirt] [PATCHv2] Renamed internal __mon_yday into mon_yday to avoid conflicts
by Cédric Bosdonnat 19 Sep '14

19 Sep '14

libc has another constant with the same name, which leads to redefinition error when building against static libvirt --- src/util/virtime.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util/virtime.c b/src/util/virtime.c index acbec41..9d365d5 100644 --- a/src/util/virtime.c +++ b/src/util/virtime.c @@ -105,7 +105,7 @@ int virTimeFieldsNowRaw(struct tm *fields) #define DIV(a, b) ((a) / (b) - ((a) % (b) < 0)) #define LEAPS_THRU_END_OF(y) (DIV (y, 4) - DIV (y, 100) + DIV (y, 400)) -const unsigned short int __mon_yday[2][13] = { +static const unsigned short int mon_yday[2][13] = { /* Normal years. */ { 0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334, 365 }, /* Leap years. */ @@ -160,7 +160,7 @@ void virTimeFieldsThen(unsigned long long when, struct tm *fields) fields->tm_year = y - 1900; fields->tm_yday = days; - ip = __mon_yday[is_leap_year(y)]; + ip = mon_yday[is_leap_year(y)]; for (y = 11; days < (long int) ip[y]; --y) continue; days -= ip[y]; -- 1.8.4.5

2 1

[libvirt] [PATCH] libxl: Drop driver lock in libxlDomainDefineXML
by Jim Fehlig 19 Sep '14

19 Sep '14

There is no need to acquire the driver-wide lock in libxlDomainDefineXML. When switching to jobs in the libxl driver, most driver-wide locks were removed. The locking here was preserved since I mistakenly thought virDomainObjListAdd needed protection. This is not the case, so remove the unnecessary locking. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- src/libxl/libxl_driver.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index 2f2c590..d4ecd62 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -2381,25 +2381,22 @@ libxlDomainDefineXML(virConnectPtr conn, const char *xml) virObjectEventPtr event = NULL; virDomainDefPtr oldDef = NULL; - /* Lock the driver until the virDomainObj is created and locked */ - libxlDriverLock(driver); if (!(def = virDomainDefParseString(xml, cfg->caps, driver->xmlopt, 1 << VIR_DOMAIN_VIRT_XEN, VIR_DOMAIN_XML_INACTIVE))) - goto cleanup_unlock; + goto cleanup; if (virDomainDefineXMLEnsureACL(conn, def) < 0) - goto cleanup_unlock; + goto cleanup; if (!(vm = virDomainObjListAdd(driver->domains, def, driver->xmlopt, 0, &oldDef))) - goto cleanup_unlock; + goto cleanup; def = NULL; vm->persistent = 1; - libxlDriverUnlock(driver); if (virDomainSaveConfig(cfg->configDir, vm->newDef ? vm->newDef : vm->def) < 0) { @@ -2426,10 +2423,6 @@ libxlDomainDefineXML(virConnectPtr conn, const char *xml) libxlDomainEventQueue(driver, event); virObjectUnref(cfg); return dom; - - cleanup_unlock: - libxlDriverUnlock(driver); - goto cleanup; } static int -- 1.8.4.5

2 2

[libvirt] Plan for next release
by Daniel Veillard 19 Sep '14

19 Sep '14

If we want to push 1.2.9 around Oct 1st, I suggest to be prepared to enter freeze on the 25th, so there is a small week to push patches if you want features in the freeze, Daniel -- Daniel Veillard | Open Source and Standards, Red Hat veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] [PATCH] libxl: Implement basic video device selection
by Stefan Bader 19 Sep '14

19 Sep '14

Re-pushing this as the old thread got rather stale. Some of the VFB setup went in a bug fix. Not sure I missed a detail in rebasing bug the keyboard setting may be the only thing missing... -Stefan [v2: Check return code of VIR_STRDUP and fix indentation] [v3: Split out VRAM fixup and return error for unsupported video type] [v4: Re-arrange code and move VFB setup into libxlMakeVfbList] [v5: Rebased against head which already had some VFB setup code] >From b3ff8f4c658d29f15e673af88b9ae2fdfa3c1317 Mon Sep 17 00:00:00 2001 From: Stefan Bader <stefan.bader(a)canonical.com> Date: Thu, 27 Mar 2014 16:01:18 +0100 Subject: [PATCH] libxl: Implement basic video device selection This started as an investigation into an issue where libvirt (using the libxl driver) and the Xen host, like an old couple, could not agree on who is responsible for selecting the VNC port to use. Things usually (and a bit surprisingly) did work because, just like that old couple, they had the same idea on what to do by default. However it was possible that this ended up in a big argument. The problem is that display information exists in two different places: in the vfbs list and in the build info. And for launching the device model, only the latter is used. But that never gets initialized from libvirt. So Xen allows the device model to select a default port while libvirt thinks it has told Xen that this is done by libvirt (though the vfbs config). While fixing that, I made a stab at actually evaluating the configuration of the video device. So that it is now possible to at least decide between a Cirrus or standard VGA emulation and to modify the VRAM within certain limits using libvirt. Signed-off-by: Stefan Bader <stefan.bader(a)canonical.com> --- src/libxl/libxl_conf.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/src/libxl/libxl_conf.c b/src/libxl/libxl_conf.c index acba69c..2727230 100644 --- a/src/libxl/libxl_conf.c +++ b/src/libxl/libxl_conf.c @@ -1200,6 +1200,8 @@ libxlMakeVfbList(virPortAllocatorPtr graphicsports, if (VIR_STRDUP(b_info->u.hvm.sdl.xauthority, vfb.sdl.xauthority) < 0) goto error; } + if (VIR_STRDUP(b_info->u.hvm.keymap, vfb.keymap) < 0) + goto error; } return 0; @@ -1462,6 +1464,45 @@ libxlMakeCapabilities(libxl_ctx *ctx) return NULL; } +static int +libxlMakeVideo(virDomainDefPtr def, libxl_domain_config *d_config) +{ + libxl_domain_build_info *b_info = &d_config->b_info; + + if (d_config->c_info.type != LIBXL_DOMAIN_TYPE_HVM) + return 0; + + /* + * Take the first defined video device (graphics card) to display + * on the first graphics device (display). + * Right now only type and vram info is used and anything beside + * type xen and vga is mapped to cirrus. + */ + if (def->nvideos) { + switch (def->videos[0]->type) { + case VIR_DOMAIN_VIDEO_TYPE_VGA: + case VIR_DOMAIN_VIDEO_TYPE_XEN: + b_info->u.hvm.vga.kind = LIBXL_VGA_INTERFACE_TYPE_STD; + break; + case VIR_DOMAIN_VIDEO_TYPE_CIRRUS: + b_info->u.hvm.vga.kind = LIBXL_VGA_INTERFACE_TYPE_CIRRUS; + break; + default: + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + "%s", + _("video type not supported by libxl")); + return -1; + } + b_info->video_memkb = def->videos[0]->vram ? + def->videos[0]->vram : + LIBXL_MEMKB_DEFAULT; + } else { + libxl_defbool_set(&b_info->u.hvm.nographic, 1); + } + + return 0; +} + int libxlBuildDomainConfig(virPortAllocatorPtr graphicsports, virDomainDefPtr def, @@ -1488,6 +1529,15 @@ libxlBuildDomainConfig(virPortAllocatorPtr graphicsports, if (libxlMakePCIList(def, d_config) < 0) return -1; + /* + * Now that any potential VFBs are defined, it is time to update the + * build info with the data of the primary display. Some day libxl + * might implicitely do so but as it does not right now, better be + * explicit. + */ + if (libxlMakeVideo(def, d_config) < 0) + return -1; + d_config->on_reboot = libxlActionFromVirLifecycle(def->onReboot); d_config->on_poweroff = libxlActionFromVirLifecycle(def->onPoweroff); d_config->on_crash = libxlActionFromVirLifecycleCrash(def->onCrash); -- 1.9.1

2 2

Re: [libvirt] Adding multiple graphics devices to a vm
by bancfc＠openmailbox.org 19 Sep '14

19 Sep '14

Thanks that was it. Apparently Debian includes the package xserver-xorg-video-qxl but doesn't have it setup/installed out of the box. After I did this, I was able to get high resolutions with SPICE.

1 0

[libvirt] [PATCH v2 0/5] Add "rawio" for hostdev
by John Ferlan 19 Sep '14

19 Sep '14

v1 is here: http://www.redhat.com/archives/libvir-list/2014-September/msg00502.html Changes since v1 (from code review): * Insert patch 1 to insert a missing goto if rawio is set, but the build doesn't suport CAP_SYS_RAWIO. * Insert patch 2 to use the TristateBool for virDomainDiskDef and the associated changes where it's used in code * Patch 3, 4, 5: Use TristateBool for hostdev rawio and the virYesNo in the rng John Ferlan (5): qemu: Add missing goto on rawio domain_conf: Change virDomainDiskDef 'rawio' to use virTristateBool hostdev: Add "rawio" attribute to _virDomainHostdevSubsysSCSI qemu: Process the hostdev "rawio" setting domain_conf: Process the "rawio" for a hostdev device docs/formatdomain.html.in | 12 +++++-- docs/schemas/domaincommon.rng | 12 +++++-- src/conf/domain_conf.c | 40 +++++++++++++++------- src/conf/domain_conf.h | 4 +-- src/qemu/qemu_domain.c | 23 +++++++++++-- src/qemu/qemu_domain.h | 4 +++ src/qemu/qemu_driver.c | 1 + src/qemu/qemu_process.c | 23 ++++++++++++- .../qemuxml2argv-hostdev-scsi-rawio.xml | 35 +++++++++++++++++++ tests/qemuxml2xmltest.c | 1 + 10 files changed, 132 insertions(+), 23 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-hostdev-scsi-rawio.xml -- 1.9.3

2 8

[libvirt] retiring v0.9.6-maint
by Eric Blake 19 Sep '14

19 Sep '14

Any objections to retiring the v0.9.6-maint branch? After all, we have already retired the v0.9.11-maint branch (http://libvirt.org/git/?p=libvirt.git;a=commit;h=cd0d348ed) and the only activity on v0.9.6-maint since 0.9.6.4 was released in January 2013 was the backport of a single CVE fix. The branch no longer builds cleanly on Fedora 20, and while I could identify patches to backport to fix the build situation, it's not worth my time if we can just retire the branch. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

4 6

[libvirt] Adding multiple graphics devices to a vm
by bancfc＠openmailbox.org 19 Sep '14

19 Sep '14

I was trying different video devices to correct the problem of having 1024x768 as the maximum resolution for Debian guests. I found out that adding VMVGA gives the wide variety of choice of resolutions I was looking for and adjusts the display properly, in contrast to the deformed way xconf file did. However I still want to make use of SPICE and QXL. Is there a way to have both vmvga and qxl attached and working on the same guest? How would I go about doing this in the XML? thanks.

2 1

[libvirt] [PATCH 0/3] Add "rawio" for hostdev
by John Ferlan 19 Sep '14

19 Sep '14

The "rawio" setting for a <device.../> <disk.../> lun isn't duplicated in the scsi_host hostdev device for a lun. Rather than "requiring" some disk in the disk list to add the rawio, add the "rawio" property to the scsi_host hostdev lun. John Ferlan (3): hostdev: Add "rawio" attribute to _virDomainHostdevSubsysSCSI qemu: Process the hostdev "rawio" setting domain_conf: Process the "rawio" for a hostdev device docs/formatdomain.html.in | 12 ++++++-- docs/schemas/domaincommon.rng | 18 +++++++---- src/conf/domain_conf.c | 31 +++++++++++++++++++ src/conf/domain_conf.h | 2 ++ src/qemu/qemu_domain.c | 21 +++++++++++++ src/qemu/qemu_domain.h | 4 +++ src/qemu/qemu_driver.c | 1 + src/qemu/qemu_process.c | 20 ++++++++++++- .../qemuxml2argv-hostdev-scsi-rawio.xml | 35 ++++++++++++++++++++++ tests/qemuxml2xmltest.c | 1 + 10 files changed, 135 insertions(+), 10 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-hostdev-scsi-rawio.xml -- 1.9.3

3 9

[libvirt] [PATCH] LXC: add HOME environment variable docs
by Chen Hanxiao 19 Sep '14

19 Sep '14

commit 3020594ac57c5e06e79f3db8c765f6bb18c40802 add HOME environment variable. Add a doc for this. Signed-off-by: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> --- docs/drvlxc.html.in | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/drvlxc.html.in b/docs/drvlxc.html.in index 403ce24..31da37c 100644 --- a/docs/drvlxc.html.in +++ b/docs/drvlxc.html.in @@ -88,6 +88,8 @@ to be provided by all container technologies on Linux. <dd>The fixed string <code>/bin:/usr/bin</code></dd> <dt>TERM</dt> <dd>The fixed string <code>linux</code></dd> +<dt>HOME</dt> +<dd>The fixed string <code>/</code></dd> </dl> -- 1.9.0

2 1

[libvirt] [PATCH v2] Move the FIPS detection from capabilities
by Pavel Hrdina 19 Sep '14

19 Sep '14

We are not detecting the presence of FIPS from QEMU, but from procfs and that means it's not QEMU capability. It was decided that we will pass this flag to QEMU even if it's not supported by old QEMU binaries. This patch also reverts changes done by commit a21cfb0f to qemucapabilitestest and implements a new test case in qemuxml2argvtest. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1135431 Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/qemu/qemu_capabilities.c | 24 --------------- src/qemu/qemu_command.c | 34 ++++++++++++++++++++-- src/qemu/qemu_command.h | 6 +++- src/qemu/qemu_driver.c | 3 +- src/qemu/qemu_process.c | 3 +- tests/qemucapabilitiesdata/caps_1.2.2-1.caps | 1 - tests/qemucapabilitiesdata/caps_1.6.0-1.caps | 1 - tests/qemucapabilitiestest.c | 20 ++++--------- .../qemuxml2argv-fips-enabled.args | 6 ++++ .../qemuxml2argvdata/qemuxml2argv-fips-enabled.xml | 25 ++++++++++++++++ tests/qemuxml2argvtest.c | 9 +++++- tests/qemuxmlnstest.c | 2 +- 12 files changed, 86 insertions(+), 48 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-fips-enabled.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-fips-enabled.xml diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 9246813..5c3778d 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -3215,30 +3215,6 @@ virQEMUCapsInitQMP(virQEMUCapsPtr qemuCaps, config.data.nix.path = monpath; config.data.nix.listen = false; - /* Qemu 1.2 and later have a binary flag -enable-fips that must be - * used for VNC auth to obey FIPS settings; but the flag only - * exists on Linux, and with no way to probe for it via QMP. Our - * solution: if FIPS mode is required, then unconditionally use - * the flag, regardless of qemu version, for the following matrix: - * - * old QEMU new QEMU - * FIPS enabled doesn't start VNC auth disabled - * FIPS disabled/missing VNC auth enabled VNC auth enabled - * - * Setting the flag here instead of in virQEMUCapsInitQMPMonitor - * or virQEMUCapsInitHelp also allows the testsuite to be - * independent of FIPS setting. - */ - if (virFileExists("/proc/sys/crypto/fips_enabled")) { - char *buf = NULL; - - if (virFileReadAll("/proc/sys/crypto/fips_enabled", 10, &buf) < 0) - goto cleanup; - if (STREQ(buf, "1\n")) - virQEMUCapsSet(qemuCaps, QEMU_CAPS_ENABLE_FIPS); - VIR_FREE(buf); - } - VIR_DEBUG("Try to get caps via QMP qemuCaps=%p", qemuCaps); /* diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index f2e6e5a..911d026 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -3293,6 +3293,35 @@ qemuCheckDiskConfig(virDomainDiskDefPtr disk) } +/* Qemu 1.2 and later have a binary flag -enable-fips that must be + * used for VNC auth to obey FIPS settings; but the flag only + * exists on Linux, and with no way to probe for it via QMP. Our + * solution: if FIPS mode is required, then unconditionally use + * the flag, regardless of qemu version, for the following matrix: + * + * old QEMU new QEMU + * FIPS enabled doesn't start VNC auth disabled + * FIPS disabled/missing VNC auth enabled VNC auth enabled + */ +bool +qemuCheckFips(void) +{ + bool ret = false; + + if (virFileExists("/proc/sys/crypto/fips_enabled")) { + char *buf = NULL; + + if (virFileReadAll("/proc/sys/crypto/fips_enabled", 10, &buf) < 0) + return ret; + if (STREQ(buf, "1\n")) + ret = true; + VIR_FREE(buf); + } + + return ret; +} + + char * qemuBuildDriveStr(virConnectPtr conn, virDomainDiskDefPtr disk, @@ -7543,7 +7572,8 @@ qemuBuildCommandLine(virConnectPtr conn, virDomainSnapshotObjPtr snapshot, virNetDevVPortProfileOp vmop, qemuBuildCommandLineCallbacksPtr callbacks, - bool standalone) + bool standalone, + bool enableFips) { virErrorPtr originalError = NULL; size_t i, j; @@ -7656,7 +7686,7 @@ qemuBuildCommandLine(virConnectPtr conn, if (!standalone) virCommandAddArg(cmd, "-S"); /* freeze CPU */ - if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_ENABLE_FIPS)) + if (enableFips) virCommandAddArg(cmd, "-enable-fips"); if (qemuBuildMachineArgStr(cmd, def, qemuCaps) < 0) diff --git a/src/qemu/qemu_command.h b/src/qemu/qemu_command.h index 633ff71..aa40c9e 100644 --- a/src/qemu/qemu_command.h +++ b/src/qemu/qemu_command.h @@ -78,7 +78,8 @@ virCommandPtr qemuBuildCommandLine(virConnectPtr conn, virDomainSnapshotObjPtr current_snapshot, virNetDevVPortProfileOp vmop, qemuBuildCommandLineCallbacksPtr callbacks, - bool forXMLToArgv) + bool forXMLToArgv, + bool enableFips) ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(11); /* Generate '-device' string for chardev device */ @@ -273,4 +274,7 @@ int qemuGetDriveSourceString(virStorageSourcePtr src, char **source); int qemuCheckDiskConfig(virDomainDiskDefPtr disk); + +bool +qemuCheckFips(void); #endif /* __QEMU_COMMAND_H__*/ diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 5fd89a3..f1b3348 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6127,7 +6127,8 @@ static char *qemuConnectDomainXMLToNative(virConnectPtr conn, NULL, -1, NULL, VIR_NETDEV_VPORT_PROFILE_OP_NO_OP, &buildCommandLineCallbacks, - true))) + true, + qemuCheckFips()))) goto cleanup; ret = virCommandToString(cmd); diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 8853d27..40b8576 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -4304,7 +4304,8 @@ int qemuProcessStart(virConnectPtr conn, if (!(cmd = qemuBuildCommandLine(conn, driver, vm->def, priv->monConfig, priv->monJSON, priv->qemuCaps, migrateFrom, stdin_fd, snapshot, vmop, - &buildCommandLineCallbacks, false))) + &buildCommandLineCallbacks, false, + qemuCheckFips()))) goto cleanup; /* now that we know it is about to start call the hook if present */ diff --git a/tests/qemucapabilitiesdata/caps_1.2.2-1.caps b/tests/qemucapabilitiesdata/caps_1.2.2-1.caps index c8a379a..3b1b699 100644 --- a/tests/qemucapabilitiesdata/caps_1.2.2-1.caps +++ b/tests/qemucapabilitiesdata/caps_1.2.2-1.caps @@ -112,7 +112,6 @@ <flag name='usb-storage'/> <flag name='usb-storage.removable'/> <flag name='kvm-pit-lost-tick-policy'/> - <flag name='enable-fips'/> <flag name='usb-kbd'/> <flag name='host-pci-multidomain'/> <flag name='usb-audio'/> diff --git a/tests/qemucapabilitiesdata/caps_1.6.0-1.caps b/tests/qemucapabilitiesdata/caps_1.6.0-1.caps index e10f030..21d4320 100644 --- a/tests/qemucapabilitiesdata/caps_1.6.0-1.caps +++ b/tests/qemucapabilitiesdata/caps_1.6.0-1.caps @@ -138,7 +138,6 @@ <flag name='boot-strict'/> <flag name='pvpanic'/> <flag name='reboot-timeout'/> - <flag name='enable-fips'/> <flag name='spice-file-xfer-disable'/> <flag name='spiceport'/> <flag name='usb-kbd'/> diff --git a/tests/qemucapabilitiestest.c b/tests/qemucapabilitiestest.c index 4e5f9e5..c52ec6c 100644 --- a/tests/qemucapabilitiestest.c +++ b/tests/qemucapabilitiestest.c @@ -31,7 +31,6 @@ typedef testQemuData *testQemuDataPtr; struct _testQemuData { virDomainXMLOptionPtr xmlopt; const char *base; - bool fips; }; static qemuMonitorTestPtr @@ -143,12 +142,6 @@ testQemuCaps(const void *opaque) qemuMonitorTestGetMonitor(mon)) < 0) goto cleanup; - /* So that our test does not depend on the contents of /proc, we - * hoisted the setting of ENABLE_FIPS to virQEMUCapsInitQMP. But - * we do want to test the effect of that flag. */ - if (data->fips) - virQEMUCapsSet(capsComputed, QEMU_CAPS_ENABLE_FIPS); - if (testQemuCapsCompare(capsProvided, capsComputed) < 0) goto cleanup; @@ -183,19 +176,16 @@ mymain(void) data.xmlopt = xmlopt; -#define DO_TEST_FULL(name, use_fips) \ - data.base = name; \ - data.fips = use_fips; \ - if (virtTestRun(name, testQemuCaps, &data) < 0) \ +#define DO_TEST(name) \ + data.base = name; \ + if (virtTestRun(name, testQemuCaps, &data) < 0) \ ret = -1 -#define DO_TEST(name) DO_TEST_FULL(name, false) - - DO_TEST_FULL("caps_1.2.2-1", true); + DO_TEST("caps_1.2.2-1"); DO_TEST("caps_1.3.1-1"); DO_TEST("caps_1.4.2-1"); DO_TEST("caps_1.5.3-1"); - DO_TEST_FULL("caps_1.6.0-1", true); + DO_TEST("caps_1.6.0-1"); DO_TEST("caps_1.6.50-1"); virObjectUnref(xmlopt); diff --git a/tests/qemuxml2argvdata/qemuxml2argv-fips-enabled.args b/tests/qemuxml2argvdata/qemuxml2argv-fips-enabled.args new file mode 100644 index 0000000..196f61f --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-fips-enabled.args @@ -0,0 +1,6 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ +/usr/bin/qemu \ +-S -enable-fips -M pc -m 214 -smp 1 -nographic -monitor \ +unix:/tmp/test-monitor,server,nowait -no-acpi -boot c -usb \ +-hda /dev/HostVG/QEMUGuest1 -net none -serial \ +none -parallel none diff --git a/tests/qemuxml2argvdata/qemuxml2argv-fips-enabled.xml b/tests/qemuxml2argvdata/qemuxml2argv-fips-enabled.xml new file mode 100644 index 0000000..a6b041d --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-fips-enabled.xml @@ -0,0 +1,25 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static' cpuset='1-4,8-20,525'>1</vcpu> + <os> + <type arch='i686' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu</emulator> + <disk type='block' device='disk'> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='ide' index='0'/> + <memballoon model='virtio'/> + </devices> +</domain> diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 275e699..ab923d0 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -259,6 +259,7 @@ typedef enum { FLAG_EXPECT_FAILURE = 1 << 1, FLAG_EXPECT_PARSE_ERROR = 1 << 2, FLAG_JSON = 1 << 3, + FLAG_FIPS = 1 << 4, } virQemuXML2ArgvTestFlags; static int testCompareXMLToArgvFiles(const char *xml, @@ -360,7 +361,8 @@ static int testCompareXMLToArgvFiles(const char *xml, (flags & FLAG_JSON), extraFlags, migrateFrom, migrateFd, NULL, VIR_NETDEV_VPORT_PROFILE_OP_NO_OP, - &testCallbacks, false))) { + &testCallbacks, false, + (flags & FLAG_FIPS)))) { if (!virtTestOOMActive() && (flags & FLAG_EXPECT_FAILURE)) { ret = 0; @@ -443,6 +445,9 @@ testCompareXMLToArgvHelper(const void *data) if (virQEMUCapsGet(info->extraFlags, QEMU_CAPS_MONITOR_JSON)) flags |= FLAG_JSON; + if (virQEMUCapsGet(info->extraFlags, QEMU_CAPS_ENABLE_FIPS)) + flags |= FLAG_FIPS; + result = testCompareXMLToArgvFiles(xml, args, info->extraFlags, info->migrateFrom, info->migrateFd, flags); @@ -1455,6 +1460,8 @@ mymain(void) DO_TEST("panic", QEMU_CAPS_DEVICE_PANIC, QEMU_CAPS_DEVICE, QEMU_CAPS_NODEFCONFIG); + DO_TEST("fips-enabled", QEMU_CAPS_ENABLE_FIPS); + virObjectUnref(driver.config); virObjectUnref(driver.caps); virObjectUnref(driver.xmlopt); diff --git a/tests/qemuxmlnstest.c b/tests/qemuxmlnstest.c index e8f70d6..b3a608c 100644 --- a/tests/qemuxmlnstest.c +++ b/tests/qemuxmlnstest.c @@ -119,7 +119,7 @@ static int testCompareXMLToArgvFiles(const char *xml, vmdef, &monitor_chr, json, extraFlags, migrateFrom, migrateFd, NULL, VIR_NETDEV_VPORT_PROFILE_OP_NO_OP, - &testCallbacks, false))) + &testCallbacks, false, false))) goto fail; if (!virtTestOOMActive()) { -- 1.8.5.5

2 2