- Devel - libvirt List Archives

[libvirt PATCH] docs: add news item about GNULIB removal
by Daniel P. Berrangé 14 Feb '20

14 Feb '20

While we have CI testing coverage for many platforms, we don't test any non-GLibC based Linux and there are other non-Linux platforms we don't officially target, both of which might hit regressions. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- docs/news.xml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/docs/news.xml b/docs/news.xml index f567a1182e..54ccc31abe 100644 --- a/docs/news.xml +++ b/docs/news.xml @@ -84,6 +84,25 @@ </change> </section> <section title="Improvements"> + <change> + <summary> + use of GNULIB has been completely eliminated + </summary> + <description> + Historically libvirt has embedded GNULIB to provide fixes for + various platform portability problems. This usage has now been + eliminated and alternative approaches for platform portability + problems adopted where required. This has been validated on the + set of platforms covered by automated CI build testing: Fedora + 30, 31 and rawhide; CentOS 7 and 8; Debian 9 and 10; Ubuntu 18.04; + FreeBSD 11 and 12; Mingw-w64; macOS 10.14 with XCode 10.3 and 11.3. + Other Linux distros of a similar vintage using GLibC are expected + to work. Linux distros using non-GLibC packages, and other + non-Linux platforms may encounter regressions when building this + release. Please report any build problems encountered back to the + project maintainers for resolution. + </description> + </change> </section> <section title="Bug fixes"> </section> -- 2.24.1

2 3

[PATCH] qemu_domain: Modify access to a NVMe disk iff needed
by Michal Privoznik 14 Feb '20

14 Feb '20

If a domain has a NVMe disk it already has the access configured. Trying to configure it again on a commit or some other operation is wrong and condemned to failure. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_domain.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 72f03c3a35..b0e90f818d 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -11676,13 +11676,13 @@ qemuDomainStorageSourceAccessModify(virQEMUDriverPtr driver, revoke_lockspace = true; - if (qemuDomainStorageSourceAccessModifyNVMe(driver, vm, src, false) < 0) - goto revoke; - - revoke_nvme = true; - /* When modifying access of existing @src namespace does not need update */ if (!(flags & QEMU_DOMAIN_STORAGE_SOURCE_ACCESS_MODIFY_ACCESS)) { + if (qemuDomainStorageSourceAccessModifyNVMe(driver, vm, src, false) < 0) + goto revoke; + + revoke_nvme = true; + if (qemuDomainNamespaceSetupDisk(vm, src) < 0) goto revoke; -- 2.24.1

2 1

[libvirt PATCH v2 0/8] qemu: Add support for the armvtimer timer
by Andrea Bolognani 14 Feb '20

14 Feb '20

This new timer model can be used to control the behavior of the virtual timer for KVM ARM/virt guests. Changes from [v1]: * redesign the XML interface completely, notably moving the configuration knob from <cpu> to <clock>. [v1] https://www.redhat.com/archives/libvir-list/2020-January/msg01475.html Andrea Bolognani (8): qemu: Use switch statement in qemuBuildCpuCommandLine() qemu: Add the QEMU_CAPS_CPU_KVM_NO_ADJVTIME capability conf: Introduce VIR_DOMAIN_TIMER_NAME_ARMVTIMER qemu: Validate configuration for the armvtimer timer qemu: Format the armvtimer timer on the command line tests: Add test case for the armvtimer timer docs: List the armvtimer timer among all others news: Mention the armvtimer timer docs/formatdomain.html.in | 6 +-- docs/news.xml | 10 ++++ docs/schemas/domaincommon.rng | 1 + src/conf/domain_conf.c | 1 + src/conf/domain_conf.h | 1 + src/libxl/libxl_conf.c | 1 + src/libxl/xen_common.c | 1 + src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 49 +++++++++++++++---- src/qemu/qemu_domain.c | 36 ++++++++++++++ .../caps_5.0.0.aarch64.xml | 1 + .../clock-timer-armvtimer.aarch64-latest.args | 32 ++++++++++++ .../clock-timer-armvtimer.xml | 27 ++++++++++ tests/qemuxml2argvtest.c | 2 + .../clock-timer-armvtimer.aarch64-latest.xml | 1 + tests/qemuxml2xmltest.c | 1 + 17 files changed, 160 insertions(+), 13 deletions(-) create mode 100644 tests/qemuxml2argvdata/clock-timer-armvtimer.aarch64-latest.args create mode 100644 tests/qemuxml2argvdata/clock-timer-armvtimer.xml create mode 120000 tests/qemuxml2xmloutdata/clock-timer-armvtimer.aarch64-latest.xml -- 2.24.1

4 27

[PULL 00/10] Ui 20200212 patches
by Gerd Hoffmann 13 Feb '20

13 Feb '20

The following changes since commit e18e5501d8ac692d32657a3e1ef545b14e72b730: Merge remote-tracking branch 'remotes/dgilbert-gitlab/tags/pull-virtiofs-20200210' into staging (2020-02-10 18:09:14 +0000) are available in the Git repository at: git://git.kraxel.org/qemu tags/ui-20200212-pull-request for you to fetch changes up to 483644c25b932360018d15818d8bcd8c85ba70b8: ui/cocoa: Drop workarounds for pre-10.12 OSX (2020-02-12 13:27:08 +0100) ---------------------------------------------------------------- gtk: refresh rate fix. cocoa: drop pre-10.12 support. ui: rework show-cursor option. ---------------------------------------------------------------- Gerd Hoffmann (7): ui: add show-cursor option ui: wire up legacy -show-cursor option ui/sdl: switch to new show-cursor option ui/cocoa: switch to new show-cursor option ui/gtk: implement show-cursor option ui: drop curor_hide global variable. ui: deprecate legacy -show-cursor option Peter Maydell (1): ui/cocoa: Drop workarounds for pre-10.12 OSX Philippe Mathieu-Daudé (2): ui/gtk: Update gd_refresh_rate_millihz() to handle VirtualConsole ui/gtk: Fix gd_refresh_rate_millihz() when widget window is not realized include/sysemu/sysemu.h | 1 - ui/gtk.c | 27 +++++++++++------- ui/sdl2.c | 16 +++++------ vl.c | 16 +++++++++-- qapi/ui.json | 3 ++ qemu-deprecated.texi | 5 ++++ ui/cocoa.m | 63 +++-------------------------------------- 7 files changed, 51 insertions(+), 80 deletions(-) -- 2.18.2

2 11

[rust PATCH 0/3] Implement virStoragePoolListVolumes and virStoragePoolListAllVolumes
by mathias＠pius.io 13 Feb '20

13 Feb '20

From: Mathias Pius <mathias(a)pius.io> This patch implements virStoragePoolListAllVolumes and virStoragePoolListVolumes for the StoragePool object. I'm not too familiar with the libvirt codebase, so I've used similar functions from connect.rs and domain.rs for so the implementations should (hopefully) be as correct as those. I've taken the liberty of using Vec::with_capacity when allocating vectors to store the result of these operations in, to prevent reallocations while converting the object types from the internal type to StorageVol and Strings. Feedback is very welcome! Mathias Pius (3): Implement virStoragePoolListAllVolumes and virStoragePoolListVolumes for StoragePool cargo fmt Newline at end of file src/storage_pool.rs | 55 ++++++++++++++++++++++++++++++++++++++++++- tests/storage_pool.rs | 34 ++++++++++++++++++++++++++ 2 files changed, 88 insertions(+), 1 deletion(-) -- 2.25.0

2 4

[PATCH v2 0/7] Couple of apparmor fixes
by Michal Privoznik 12 Feb '20

12 Feb '20

v2 of: https://www.redhat.com/archives/libvir-list/2020-January/msg01068.html diff to v1: - Keep old paths to virt-aa-helper in profiles as SUSE still uses it. - patch 7/7 is new Michal Prívozník (7): apparmor: Fix parthelper, iohelper and virt-aa-helper paths in profiles apparmor: Allow libvirt to spawn virt-aa-helper and libvirt_lxc docs: Fix virt-aa-helper location apparmor: Rename virt-aa-helper profile apparmor: Sort paths in blocks in libvirt-qemu profile apparmor: Allow some more BIOS/UEFI paths apparmor: Drop 'Last modified' comment from profiles docs/drvqemu.html.in | 2 +- src/security/Makefile.inc.am | 10 +-- src/security/apparmor/libvirt-lxc | 2 - src/security/apparmor/libvirt-qemu | 80 +++++++++---------- ...t-aa-helper => usr.libexec.virt-aa-helper} | 7 +- src/security/apparmor/usr.sbin.libvirtd | 7 +- 6 files changed, 53 insertions(+), 55 deletions(-) rename src/security/apparmor/{usr.lib.libvirt.virt-aa-helper => usr.libexec.virt-aa-helper} (88%) -- 2.24.1

2 17

[libvirt PATCH v2] qemu: drop support for monitor connections on PTYs
by Daniel P. Berrangé 12 Feb '20

12 Feb '20

Libvirt switched to using a UNIX socket for monitors in 2009 for version 0.7.0. It seems unlikely that there is a running QEMU process that hasn't been restarted for 11 years while also taking a libvirt upgrade. Therefore we can drop support for opening a PTY for the QEMU monitor. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- In v2: - Now with all changes actually committed src/qemu/qemu_monitor.c | 60 +++++++---------------------------------- 1 file changed, 9 insertions(+), 51 deletions(-) diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index 802ad20aa1..008d4a0e75 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -77,7 +77,6 @@ struct _qemuMonitor { * = 0: not registered * < 0: an error occurred during the registration of @fd */ int watch; - int hasSendFD; virDomainObjPtr vm; @@ -303,21 +302,6 @@ qemuMonitorOpenUnix(const char *monitor, } -static int -qemuMonitorOpenPty(const char *monitor) -{ - int monfd; - - if ((monfd = open(monitor, O_RDWR)) < 0) { - virReportError(VIR_ERR_INTERNAL_ERROR, - _("Unable to open monitor path %s"), monitor); - return -1; - } - - return monfd; -} - - /* This method processes data that has been received * from the monitor. Looking for async events and * replies/errors. @@ -434,12 +418,6 @@ qemuMonitorIOWrite(qemuMonitorPtr mon) if (!mon->msg || mon->msg->txOffset == mon->msg->txLength) return 0; - if (mon->msg->txFD != -1 && !mon->hasSendFD) { - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("Monitor does not support sending of file descriptors")); - return -1; - } - buf = mon->msg->txBuffer + mon->msg->txOffset; len = mon->msg->txLength - mon->msg->txOffset; if (mon->msg->txFD == -1) @@ -707,7 +685,6 @@ qemuMonitorIO(int watch, int fd, int events, void *opaque) static qemuMonitorPtr qemuMonitorOpenInternal(virDomainObjPtr vm, int fd, - bool hasSendFD, qemuMonitorCallbacksPtr cb, void *opaque) { @@ -736,7 +713,6 @@ qemuMonitorOpenInternal(virDomainObjPtr vm, goto cleanup; } mon->fd = fd; - mon->hasSendFD = hasSendFD; mon->vm = virObjectRef(vm); mon->waitGreeting = true; mon->cb = cb; @@ -810,7 +786,6 @@ qemuMonitorOpen(virDomainObjPtr vm, void *opaque) { int fd = -1; - bool hasSendFD = false; qemuMonitorPtr ret = NULL; timeout += QEMU_DEFAULT_MONITOR_WAIT; @@ -819,28 +794,18 @@ qemuMonitorOpen(virDomainObjPtr vm, * deleted until the monitor gets its own reference. */ virObjectRef(vm); - switch (config->type) { - case VIR_DOMAIN_CHR_TYPE_UNIX: - hasSendFD = true; - virObjectUnlock(vm); - fd = qemuMonitorOpenUnix(config->data.nix.path, - vm->pid, retry, timeout); - virObjectLock(vm); - break; - - case VIR_DOMAIN_CHR_TYPE_PTY: - virObjectUnlock(vm); - fd = qemuMonitorOpenPty(config->data.file.path); - virObjectLock(vm); - break; - - default: + if (config->type != VIR_DOMAIN_CHR_TYPE_UNIX) { virReportError(VIR_ERR_INTERNAL_ERROR, _("unable to handle monitor type: %s"), virDomainChrTypeToString(config->type)); - break; + goto cleanup; } + virObjectUnlock(vm); + fd = qemuMonitorOpenUnix(config->data.nix.path, + vm->pid, retry, timeout); + virObjectLock(vm); + if (fd < 0) goto cleanup; @@ -850,7 +815,7 @@ qemuMonitorOpen(virDomainObjPtr vm, goto cleanup; } - ret = qemuMonitorOpenInternal(vm, fd, hasSendFD, cb, opaque); + ret = qemuMonitorOpenInternal(vm, fd, cb, opaque); cleanup: if (!ret) VIR_FORCE_CLOSE(fd); @@ -865,7 +830,7 @@ qemuMonitorOpenFD(virDomainObjPtr vm, qemuMonitorCallbacksPtr cb, void *opaque) { - return qemuMonitorOpenInternal(vm, sockfd, true, cb, opaque); + return qemuMonitorOpenInternal(vm, sockfd, cb, opaque); } @@ -2675,13 +2640,6 @@ qemuMonitorSendFileHandle(qemuMonitorPtr mon, return -1; } - if (!mon->hasSendFD) { - virReportError(VIR_ERR_OPERATION_UNSUPPORTED, - _("qemu is not using a unix socket monitor, " - "cannot send fd %s"), fdname); - return -1; - } - return qemuMonitorJSONSendFileHandle(mon, fdname, fd); } -- 2.24.1

2 1

[PATCH 1/2] qemu: monitor:Prevent a NULl pointer from being accessed
by Yi Wang 12 Feb '20

12 Feb '20

From: Huang Zijiang <huang.zijiang(a)zte.com.cn> virJSONValueObjectGetObject maybe return NULL if the key is missing or if value is not the correct TYPE, so we have to prevent a NULl pointer from being accessed. Signed-off-by: Huang Zijiang <huang.zijiang(a)zte.com.cn> Signed-off-by: Yi Wang <wang.yi59(a)zte.com.cn> --- src/qemu/qemu_monitor_json.c | 89 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 88 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index e5164d2..51b40e0 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -1697,7 +1697,12 @@ qemuMonitorJSONGetStatus(qemuMonitorPtr mon, goto cleanup; data = virJSONValueObjectGetObject(reply, "return"); - + if (!data){ + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("query-status reply was missing return data")); + return -1; + } + if (virJSONValueObjectGetBoolean(data, "running", running) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("query-status reply was missing running state")); @@ -2018,6 +2023,11 @@ int qemuMonitorJSONGetVirtType(qemuMonitorPtr mon, goto cleanup; data = virJSONValueObjectGetObject(reply, "return"); + if (!data) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("query-kvm reply was missing return data")); + return -1; + } if (virJSONValueObjectGetBoolean(data, "enabled", &val) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -2179,6 +2189,11 @@ qemuMonitorJSONGetBalloonInfo(qemuMonitorPtr mon, goto cleanup; data = virJSONValueObjectGetObject(reply, "return"); + if (!data) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("query-balloon reply was missing return data")); + return -1; + } if (virJSONValueObjectGetNumberUlong(data, "actual", &mem) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -2280,6 +2295,11 @@ int qemuMonitorJSONGetMemoryStats(qemuMonitorPtr mon, goto cleanup; data = virJSONValueObjectGetObject(reply, "return"); + if (!data) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("reply was missing return data")); + return -1; + } if (!(statsdata = virJSONValueObjectGet(data, "stats"))) { VIR_DEBUG("data does not include 'stats'"); @@ -3478,6 +3498,11 @@ qemuMonitorJSONGetMigrationStatsReply(virJSONValuePtr reply, const char *tmp; ret = virJSONValueObjectGetObject(reply, "return"); + if (!ret) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("info migration reply was missing return data")); + return -1; + } if (!(statusstr = virJSONValueObjectGetString(ret, "status"))) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -3787,6 +3812,11 @@ qemuMonitorJSONQueryDump(qemuMonitorPtr mon, goto cleanup; result = virJSONValueObjectGetObject(reply, "return"); + if (!result) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("query-dump reply was missing return data")); + return -1; + } ret = qemuMonitorJSONExtractDumpStats(result, stats); @@ -3824,6 +3854,11 @@ qemuMonitorJSONGetDumpGuestMemoryCapability(qemuMonitorPtr mon, goto cleanup; caps = virJSONValueObjectGetObject(reply, "return"); + if (!caps) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("query-dump-guest-memory-capability reply was missing return data")); + return -1; + } if (!(formats = virJSONValueObjectGetArray(caps, "formats"))) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -4676,6 +4711,11 @@ qemuMonitorJSONDiskNameLookupOne(virJSONValuePtr image, return NULL; if (top != target) { backing = virJSONValueObjectGetObject(image, "backing-image"); + if (!backing) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("reply was missing return backing-image ")); + return -1; + } return qemuMonitorJSONDiskNameLookupOne(backing, top->backingStore, target); } @@ -5519,6 +5559,12 @@ int qemuMonitorJSONGetVersion(qemuMonitorPtr mon, goto cleanup; data = virJSONValueObjectGetObject(reply, "return"); + if (!data) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("query-version reply was missing return data")); + return -1; + } + if (!(qemu = virJSONValueObjectGetObject(data, "qemu"))) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -5972,6 +6018,11 @@ qemuMonitorJSONGetCPUModelExpansion(qemuMonitorPtr mon, return -1; data = virJSONValueObjectGetObject(reply, "return"); + if (!data) { + (VIR_ERR_INTERNAL_ERROR, "%s", + _("query-cpu-model-expansion reply was missing return data")); + return -1; + } if (qemuMonitorJSONParseCPUModelData(data, "query-cpu-model-expansion", fail_no_props, &cpu_model, &cpu_props, @@ -6027,6 +6078,11 @@ qemuMonitorJSONGetCPUModelBaseline(qemuMonitorPtr mon, return -1; data = virJSONValueObjectGetObject(reply, "return"); + if (!data) { + (VIR_ERR_INTERNAL_ERROR, "%s", + _("query-cpu-model-baseline reply was missing return data")); + return -1; + } if (qemuMonitorJSONParseCPUModelData(data, "query-cpu-model-baseline", false, &cpu_model, &cpu_props, @@ -6067,6 +6123,11 @@ qemuMonitorJSONGetCPUModelComparison(qemuMonitorPtr mon, return -1; data = virJSONValueObjectGetObject(reply, "return"); + if (!data) { + (VIR_ERR_INTERNAL_ERROR, "%s", + _("query-cpu-model-comparison reply was missing return data")); + return -1; + } if (!(data_result = virJSONValueObjectGetString(data, "result"))) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -6342,6 +6403,11 @@ int qemuMonitorJSONGetKVMState(qemuMonitorPtr mon, goto cleanup; data = virJSONValueObjectGetObject(reply, "return"); + if (!data) { + (VIR_ERR_INTERNAL_ERROR, "%s", + _("qemu-kvm reply was missing return data")); + return -1; + } if (virJSONValueObjectGetBoolean(data, "enabled", enabled) < 0 || virJSONValueObjectGetBoolean(data, "present", present) < 0) { @@ -6823,6 +6889,11 @@ qemuMonitorJSONGetTargetArch(qemuMonitorPtr mon) goto cleanup; data = virJSONValueObjectGetObject(reply, "return"); + if (!data) { + (VIR_ERR_INTERNAL_ERROR, "%s", + _("query-target reply was missing return data")); + return -1; + } if (!(arch = virJSONValueObjectGetString(data, "arch"))) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -7090,6 +7161,11 @@ qemuMonitorJSONGetSEVCapabilities(qemuMonitorPtr mon, goto cleanup; caps = virJSONValueObjectGetObject(reply, "return"); + if (!caps) { + (VIR_ERR_INTERNAL_ERROR, "%s", + _("query-sev-capabilities reply was missing return data")); + return -1; + } if (virJSONValueObjectGetNumberUint(caps, "cbitpos", &cbitpos) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -7555,6 +7631,12 @@ qemuMonitorJSONAttachCharDev(qemuMonitorPtr mon, if (chr->type == VIR_DOMAIN_CHR_TYPE_PTY) { virJSONValuePtr data = virJSONValueObjectGetObject(reply, "return"); + if (!data) { + (VIR_ERR_INTERNAL_ERROR, "%s", + _("chardev-add reply was missing return data")); + return -1; + } + const char *path; if (!(path = virJSONValueObjectGetString(data, "pty"))) { @@ -9006,6 +9088,11 @@ qemuMonitorJSONGetSEVMeasurement(qemuMonitorPtr mon) goto cleanup; data = virJSONValueObjectGetObject(reply, "return"); + if (!data) { + (VIR_ERR_INTERNAL_ERROR, "%s", + _("query-sev-launch-measure reply was missing return data")); + return -1; + } if (!(tmp = virJSONValueObjectGetString(data, "data"))) goto cleanup; -- 1.9.1

2 1

[PATCH] util: Prevent a NULl pointer from being accessed
by Yi Wang 12 Feb '20

12 Feb '20

From: Huang Zijiang <huang.zijiang(a)zte.com.cn> virJSONValueObjectGetObject maybe return NULL if the key is missing or if value is not the correct TYPE, so we have to prevent a NULl pointer from being accessed. Signed-off-by: Huang Zijiang <huang.zijiang(a)zte.com.cn> Signed-off-by: Yi Wang <wang.yi59(a)zte.com.cn> --- src/util/virstoragefile.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/util/virstoragefile.c b/src/util/virstoragefile.c index e46ac99..53224b5 100644 --- a/src/util/virstoragefile.c +++ b/src/util/virstoragefile.c @@ -3378,6 +3378,11 @@ virStorageSourceParseBackingJSONSheepdog(virStorageSourcePtr src, const char *filename; const char *vdi = virJSONValueObjectGetString(json, "vdi"); virJSONValuePtr server = virJSONValueObjectGetObject(json, "server"); + if (!server) { + virReportError(VIR_ERR_INVALID_ARG, "%s", + _("missing server in JSON backing volume definition")); + return -1; + } /* legacy URI based syntax passed via 'filename' option */ if ((filename = virJSONValueObjectGetString(json, "filename"))) { -- 1.9.1

2 1

[PATCH] util: Prevent a NULl pointer from being accessed
by Yi Wang 12 Feb '20

12 Feb '20

From: Huang Zijiang <huang.zijiang(a)zte.com.cn> virJSONValueObjectGetObject maybe return NULL if the key is missing or if value is not the correct TYPE, so we have to prevent a NULl pointer from being accessed. Signed-off-by: Huang Zijiang <huang.zijiang(a)zte.com.cn> Signed-off-by: Yi Wang <wang.yi59(a)zte.com.cn> --- src/util/virqemu.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/util/virqemu.c b/src/util/virqemu.c index f3a233a..29fbe4e 100644 --- a/src/util/virqemu.c +++ b/src/util/virqemu.c @@ -257,6 +257,11 @@ virQEMUBuildObjectCommandlineFromJSON(virBufferPtr buf, const char *type = virJSONValueObjectGetString(objprops, "qom-type"); const char *alias = virJSONValueObjectGetString(objprops, "id"); virJSONValuePtr props = virJSONValueObjectGetObject(objprops, "props"); + if (!props) { + virReportError(VIR_ERR_INVALID_ARG, "%s", + _("reply was missing return props data")); + return -1; + } return virQEMUBuildObjectCommandlineFromJSONInternal(buf, type, alias, props); } -- 1.9.1

2 1

[PATCH v3 0/7] ui: rework -show-cursor option
by Gerd Hoffmann 12 Feb '20

12 Feb '20

Add -display {sdl,gtk,cocoa},show-cursor=on as replacement for -show-cursor. sdl + cocoa are switched over (no change in behavior), gtk support is added. Gerd Hoffmann (7): ui: add show-cursor option ui: wire up legacy -show-cursor option ui/sdl: switch to new show-cursor option ui/cocoa: switch to new show-cursor option ui/gtk: implement show-cursor option ui: drop curor_hide global variable. ui: deprecate legacy -show-cursor option include/sysemu/sysemu.h | 1 - ui/gtk.c | 8 ++++++-- ui/sdl2.c | 16 ++++++++-------- vl.c | 16 ++++++++++++++-- qapi/ui.json | 3 +++ qemu-deprecated.texi | 5 +++++ ui/cocoa.m | 4 ++++ 7 files changed, 40 insertions(+), 13 deletions(-) -- 2.18.1

4 11

[libvirt PATCH] qemu: drop support for monitor connections on PTYs
by Daniel P. Berrangé 12 Feb '20

12 Feb '20

Libvirt switched to using a UNIX socket for monitors in 2009 for version 0.7.0. It seems unlikely that there is a running QEMU process that hasn't been restarted for 11 years while also taking a libvirt upgrade. Therefore we can drop support for opening a PTY for the QEMU monitor. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/qemu/qemu_monitor.c | 43 ++++++++--------------------------------- 1 file changed, 8 insertions(+), 35 deletions(-) diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index 802ad20aa1..e998586a6b 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -77,7 +77,6 @@ struct _qemuMonitor { * = 0: not registered * < 0: an error occurred during the registration of @fd */ int watch; - int hasSendFD; virDomainObjPtr vm; @@ -434,12 +433,6 @@ qemuMonitorIOWrite(qemuMonitorPtr mon) if (!mon->msg || mon->msg->txOffset == mon->msg->txLength) return 0; - if (mon->msg->txFD != -1 && !mon->hasSendFD) { - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("Monitor does not support sending of file descriptors")); - return -1; - } - buf = mon->msg->txBuffer + mon->msg->txOffset; len = mon->msg->txLength - mon->msg->txOffset; if (mon->msg->txFD == -1) @@ -707,7 +700,6 @@ qemuMonitorIO(int watch, int fd, int events, void *opaque) static qemuMonitorPtr qemuMonitorOpenInternal(virDomainObjPtr vm, int fd, - bool hasSendFD, qemuMonitorCallbacksPtr cb, void *opaque) { @@ -736,7 +728,6 @@ qemuMonitorOpenInternal(virDomainObjPtr vm, goto cleanup; } mon->fd = fd; - mon->hasSendFD = hasSendFD; mon->vm = virObjectRef(vm); mon->waitGreeting = true; mon->cb = cb; @@ -810,7 +801,6 @@ qemuMonitorOpen(virDomainObjPtr vm, void *opaque) { int fd = -1; - bool hasSendFD = false; qemuMonitorPtr ret = NULL; timeout += QEMU_DEFAULT_MONITOR_WAIT; @@ -819,28 +809,18 @@ qemuMonitorOpen(virDomainObjPtr vm, * deleted until the monitor gets its own reference. */ virObjectRef(vm); - switch (config->type) { - case VIR_DOMAIN_CHR_TYPE_UNIX: - hasSendFD = true; - virObjectUnlock(vm); - fd = qemuMonitorOpenUnix(config->data.nix.path, - vm->pid, retry, timeout); - virObjectLock(vm); - break; - - case VIR_DOMAIN_CHR_TYPE_PTY: - virObjectUnlock(vm); - fd = qemuMonitorOpenPty(config->data.file.path); - virObjectLock(vm); - break; - - default: + if (config->type != VIR_DOMAIN_CHR_TYPE_UNIX) { virReportError(VIR_ERR_INTERNAL_ERROR, _("unable to handle monitor type: %s"), virDomainChrTypeToString(config->type)); - break; + goto cleanup; } + virObjectUnlock(vm); + fd = qemuMonitorOpenUnix(config->data.nix.path, + vm->pid, retry, timeout); + virObjectLock(vm); + if (fd < 0) goto cleanup; @@ -850,7 +830,7 @@ qemuMonitorOpen(virDomainObjPtr vm, goto cleanup; } - ret = qemuMonitorOpenInternal(vm, fd, hasSendFD, cb, opaque); + ret = qemuMonitorOpenInternal(vm, fd, cb, opaque); cleanup: if (!ret) VIR_FORCE_CLOSE(fd); @@ -2675,13 +2655,6 @@ qemuMonitorSendFileHandle(qemuMonitorPtr mon, return -1; } - if (!mon->hasSendFD) { - virReportError(VIR_ERR_OPERATION_UNSUPPORTED, - _("qemu is not using a unix socket monitor, " - "cannot send fd %s"), fdname); - return -1; - } - return qemuMonitorJSONSendFileHandle(mon, fdname, fd); } -- 2.24.1

1 0

[libvirt PATCH 0/5] qemu: add stricter checks of permissibility of the QoS parameter 'floor'
by Pavel Mores 12 Feb '20

12 Feb '20

Aims to fix https://bugzilla.redhat.com/show_bug.cgi?id=1750219 Libvirt previously silently accepted attempts to set 'floor' even for direct bridge interface types where the parameter is not supported. This could happen when manipulating both inactive and active (e.g. via 'virsh domiftune') domain configuration. Pavel Mores (5): qemu: fail on attempt to set 'floor' if interface type is not 'network' qemu: check if 'floor' is supported for given interface and network qemu: call networkPlugBandwidth() for all types of network docs: QoS parameter 'floor' is supported for 'open' networks too qemu: reuse convenience variable introduced in a00b97f27672b3 docs/formatnetwork.html.in | 2 +- src/network/bridge_driver.c | 27 +++++++++++++++++++++------ src/qemu/qemu_driver.c | 13 ++++++++++--- 3 files changed, 32 insertions(+), 10 deletions(-) -- 2.24.1

4 13

[libvirt] [patch v2 1/1] virt-aa-helper: Add support for smartcard host-certificates
by Arnaud Patard 12 Feb '20

12 Feb '20

When emulating smartcard with host certificates, qemu needs to be able to read the certificates files. Add necessary code to add the smartcard certificates file path to the apparmor profile. Passthrough support has been tested with spicevmc and remote-viewer. v2: - Fix CodingStyle - Add support for 'host' case. - Add a comment to mention that the passthrough case doesn't need some configuration - Use one rule with '{,*}' instead of two rules. Signed-off-by: Arnaud Patard <apatard(a)hupstream.com> Index: libvirt/src/security/virt-aa-helper.c =================================================================== --- libvirt.orig/src/security/virt-aa-helper.c +++ libvirt/src/security/virt-aa-helper.c @@ -1271,6 +1271,39 @@ get_files(vahControl * ctl) } } + for (i = 0; i < ctl->def->nsmartcards; i++) { + virDomainSmartcardDefPtr sc = ctl->def->smartcards[i]; + virDomainSmartcardType sc_type = sc->type; + char *sc_db = (char *)VIR_DOMAIN_SMARTCARD_DEFAULT_DATABASE; + if (sc->data.cert.database) + sc_db = sc->data.cert.database; + switch (sc_type) { + /* + * Note: At time of writing, to get this working, qemu seccomp sandbox has + * to be disabled or the host must be running QEMU with commit + * 9a1565a03b79d80b236bc7cc2dbce52a2ef3a1b8. + * It's possibly due to libcacard:vcard_emul_new_event_thread(), which calls + * PR_CreateThread(), which calls {g,s}etpriority(). And resourcecontrol seccomp + * filter forbids it (cf src/qemu/qemu_command.c which seems to always use + * resourcecontrol=deny). + */ + case VIR_DOMAIN_SMARTCARD_TYPE_HOST: + virBufferAddLit(&buf, " \"/etc/pki/nssdb/{,*}\" rk,\n"); + break; + case VIR_DOMAIN_SMARTCARD_TYPE_HOST_CERTIFICATES: + virBufferAsprintf(&buf, " \"%s/{,*}\" rk,\n", sc_db); + break; + /* + * Nothing to do for passthrough, as the smartcard + * access is done through TCP or Spice + */ + case VIR_DOMAIN_SMARTCARD_TYPE_PASSTHROUGH: + break; + case VIR_DOMAIN_SMARTCARD_TYPE_LAST: + break; + } + } + if (ctl->def->virtType == VIR_DOMAIN_VIRT_KVM) { for (i = 0; i < ctl->def->nnets; i++) { virDomainNetDefPtr net = ctl->def->nets[i];

3 6

[PATCH v1 00/14] vircgroup code duplication purge
by Daniel Henrique Barboza 11 Feb '20

11 Feb '20

Hi, This is my attempt to a side quest from Cole Robinson reported in the wiki. It started with an innocent code duplication reduction work, then I got dragged into code duplication inside LXC and QEMU drivers. There is a significant amount of code sharing between LXC and QEMU drivers that should be handled in a work on its own, but I didn't shy away from the duplications that are related to vircgroup code in some capacity. Last 3 patches are an attempt to clean up libvirt_private.syms a bit, turning some vircgroup functions to static after the changes made. These are trivial, but annoying changes to review in a single patch - hence 3 patches to allow for happier reviews. The maintainer is free to merge the those together when pushing. Daniel Henrique Barboza (14): vircgroup: add virCgroupSetupBlkioTune() vircgroup: add virCgroupSetupMemtune() vircgroup: add virCgroupSetupCpusetCpus() vircgroup: add virCgroupSetAndRetrieveCpuShares() vircgroup: add virCgroupSetupCpuPeriodQuota() domain_conf: add virDomainMergeBlkioDevice() domain_conf: add virDomainParseBlkioDeviceStr() vircgroup: add virCgroupSetupDomainBlkioParameters() domain_conf: add virDomainParseMergePersistentDefBlkioParams() vircgroup: add virCgroupSetMemoryLimitParameters() vircgroup: add virCgroupGetCpuPeriodQuota() vircgroup: turn virCgroup{Get/Set}BlkioDevice* static vircgroup: turn SetMemory and SetCpusetCpus functions static vircgroup: turn more cgroup functions static src/conf/domain_conf.c | 222 ++++++++++++++++++++ src/conf/domain_conf.h | 13 ++ src/libvirt_private.syms | 31 +-- src/lxc/lxc_cgroup.c | 91 +------- src/lxc/lxc_driver.c | 428 ++------------------------------------ src/qemu/qemu_cgroup.c | 113 +--------- src/qemu/qemu_driver.c | 399 +---------------------------------- src/util/vircgroup.c | 436 +++++++++++++++++++++++++++++++++++---- src/util/vircgroup.h | 75 +++---- 9 files changed, 707 insertions(+), 1101 deletions(-) -- 2.24.1

3 19

[libvirt PATCH] docs: Improve documentation for <serial> and <console>
by Andrea Bolognani 11 Feb '20

11 Feb '20

Users expect to be able to configure the <console> element and see that configuration reflected into the <serial> element or at least sticking, however due to our crazy back-compat code that doesn't always happen. There's really not much we can do to make this kind of corner cases work as the user would expect, especially not without introducing additional complexity in a part of libvirt that already has more than a fair share of it; we can, however, improve the documentation so that it will nudge said users in the right direction. https://bugzilla.redhat.com/show_bug.cgi?id=1770725 Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- docs/formatdomain.html.in | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 44e2062d01..5ccf39abd1 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -7510,7 +7510,10 @@ qemu-kvm -net nic,model=? /dev/null <span class="since">since 4.7.0</span>, <code>16550a</code> (usable with the <code>system-serial</code> target type); <code>sclpconsole</code> and <code>sclplmconsole</code> (usable with - the <code>sclp-serial</code> target type). + the <code>sclp-serial</code> target type). Providing a target model is + usually unnecessary: libvirt will automatically pick one that's suitable + for the chosen target type, and overriding that value is generally not + recommended. </p> <p> @@ -7656,7 +7659,8 @@ qemu-kvm -net nic,model=? /dev/null for early boot logging / interactive / recovery use, and one paravirtualized serial console to be used eg. as a side channel. Most people will be fine with having just the first <code>console</code> - element in their configuration. + element in their configuration, but if a specific configuration is + desired then both elements should be specified. </p> <p> -- 2.24.1

2 1

[PATCH 0/6] update tls files without restarting libvirtd
by Zhang Bo 11 Feb '20

11 Feb '20

When a client wants to establish a TLS connection with libvirtd, a CRL file， CA cert and server cert/key are used. Right now, if these files are changed, you must restart libvirtd to make them take effect. The restart behavior of libvirtd will cause clients connecting with libvirtd to fail. In a server cluster, these files, mostly the CRL, may be updated quite frequently dueto the large amount of certificates. If the new file does not take effect in time, there are security risks. So you may need to restart libvirtd frequently to make the CRL etc. take effect in time. However, frequent restarts will affect the reliability of cluster virtual machine management(such as openstack) services. These patches add a virt-admin command to update the tls related files *online*. Zhang Bo (6): virnettlscontext: refactoring virNetTLSContextLoadCredentials virnetserver: Introduce virNetServerUpdateTlsFiles admin: Introduce virAdmServerUpdateTlsFiles admin: support server cert update mode virt-admin: Introduce command srv-update-tls docs: update virt-admin.rst for server-update-tls docs/manpages/virt-admin.rst | 21 ++++ include/libvirt/libvirt-admin.h | 26 ++++ src/admin/admin_protocol.x | 13 +- src/admin/admin_server.c | 8 ++ src/admin/admin_server.h | 4 + src/admin/libvirt-admin.c | 39 ++++++ src/admin/libvirt_admin_private.syms | 1 + src/admin/libvirt_admin_public.syms | 1 + src/libvirt_remote.syms | 1 + src/rpc/virnetserver.c | 81 ++++++++++++ src/rpc/virnetserver.h | 4 + src/rpc/virnetserverclient.c | 4 + src/rpc/virnettlscontext.c | 179 +++++++++++++++++++-------- src/rpc/virnettlscontext.h | 3 + tools/virt-admin.c | 88 +++++++++++++ 15 files changed, 419 insertions(+), 54 deletions(-) -- 2.23.0.windows.1

2 8

[libvirt PATCH 0/7] virshtest: remove virTestCaptureProgramOutput
by Ján Tomko 11 Feb '20

11 Feb '20

Use virCommand instead of open-coding it and do some other cleanups found along the way. Ján Tomko (7): testutils: check return value of g_setenv testutils: use g_autofree testutils: use g_autoptr testutils: remove unnecessary labels virshtest: refactor testCompareOutputLit virshtest: use virCommand instead of custom impl testutils: remove now unused virTestCaptureProgramOutput tests/testutils.c | 171 +++++++++------------------------------------- tests/testutils.h | 2 - tests/virshtest.c | 35 ++++++---- 3 files changed, 54 insertions(+), 154 deletions(-) -- 2.21.1

2 15

[libvirt PATCH 0/9] syntax-check: fix sc-prohibit-cross-inclusion
by Ján Tomko 11 Feb '20

11 Feb '20

And drop some legacy stuff, since I already had to open the file. Ján Tomko (9): syntax-check: do not enforce ChangeLog syntax syntax-check: fix sc-prohibit-cross-inclusion syntax-check: drop vulnerable Makefile checks syntax-check: drop CVS keyword expansion check syntax-check: drop update-NEWS-hash syntax-check: exclude: remove deleted files syntax-check: exclude: remove virstring syntax-check: remove README syntax-check: remove some exception mechanisms build-aux/syntax-check.mk | 73 +++------------------------------------ 1 file changed, 5 insertions(+), 68 deletions(-) -- 2.24.1

2 10

glib crash via eventtest.c
by Cole Robinson 10 Feb '20

10 Feb '20

I attempted to review some patches on Friday and started hitting occasional crashes via eventtest.c. Long story short it's a glib bug: https://gitlab.gnome.org/GNOME/glib/merge_requests/1358 It's a ref counting issue caused when g_source_remove (virEventRemoveHandle) is called from one thread, while the main loop is in a particular state in a different thread. The way vireventglib is implemented means every user initiated g_source_remove is likely called from a different thread so we risk hitting this. Not sure how likely it is in realworld usage, vireventtest.c is pretty pathologic in this area. We could change vireventglib.c to do the final source_unref from the idle callback which would avoid the problem Thanks, Cole

2 1

Fwd: FW: [libvirt PATCH 0/6] Introduce Local Migration Support in Libvirt
by Prerna 10 Feb '20

10 Feb '20

On 2/3/20, 7:16 PM, "Daniel P. Berrangé" <berrange(a)redhat.com> wrote: On Mon, Feb 03, 2020 at 10:42:48AM -0300, Daniel Henrique Barboza wrote: > Hi Daniel, > > I am happy that Libvirt is pushing local migration/live patching support, but > at the same time I am wondering what changed from what you said here: Err, this isn't libvirt pushing local migration. I'm simply re-posting these patches on behalf of Shaju who is unable to post the patches due to our broken mail server. Don't take this as meaning that I approve of the patches. They're simply here for discussion as any other patch proposal is. Thank you for forwarding the patch to the list, Danpb. That is largely still my view. Sure, and we will be happy to discuss this further, as noted below :) > To give you a background, we have live patching enhancements in IBM backlog > since a few years ago, and one on the reasons these were being postponed > time and time again were the lack of Libvirt support and this direction of > "Libvirt is not interested in supporting it". And this message above was being > used internally as the rationale for it. Hi Daniel HB, Thank you for pointing out the fact that this has been in discussion since 2013. While Shaju's patches were independent as an RFC, we will be happy to collaborate to push for a joint solution. The fact that this has been requested time and again, and the fact that most commercial cloud deployments out there already have an in-place upgrade story [1] [2] -- should be good reason we holistically examine the use case once again. [1] https://kb.vmware.com/s/article/2005389 [2] https://dl.acm.org/doi/10.1145/3297858.3304034 Danpb had explained in much detail as to why mangling file and particularly socket paths can be messy in this patchset. However, even if libvirtd blocks in-place migrations for such legacy VMs until apps switch to more stringent XML semantics, it still may help cutting edge apps that intend to leverage this. I understand the presence of collision-causing file and socket paths can easily be checked as pre-migration checks, and should be trivial to implement. We can include a revised patchset with this check in place. Support for this feature has been present in qemu for a while for this use-case, and so maybe it is time we pass on the goodness up the stack as well. Happy to discuss more details on implementation and semantics, Warm regards, Prerna Saxena

1 0

撤回: [PATCH 6/6] docs: update virt-admin.rst for server-update-tls
by Zhangbo (Oscar) 09 Feb '20

09 Feb '20

Zhangbo (Oscar) 将撤回邮件“[PATCH 6/6] docs: update virt-admin.rst for server-update-tls”。

1 0

撤回: [PATCH 5/6] virt-admin: Introduce command srv-update-tls
by Zhangbo (Oscar) 09 Feb '20

09 Feb '20

Zhangbo (Oscar) 将撤回邮件“[PATCH 5/6] virt-admin: Introduce command srv-update-tls”。

1 0

撤回: [PATCH 4/6] admin: support server cert update mode
by Zhangbo (Oscar) 09 Feb '20

09 Feb '20

Zhangbo (Oscar) 将撤回邮件“[PATCH 4/6] admin: support server cert update mode”。

1 0

撤回: [PATCH 3/6] admin: Introduce virAdmServerUpdateTlsFiles
by Zhangbo (Oscar) 09 Feb '20

09 Feb '20

Zhangbo (Oscar) 将撤回邮件“[PATCH 3/6] admin: Introduce virAdmServerUpdateTlsFiles”。

1 0

撤回: [PATCH 2/6] virnetserver: Introduce virNetServerUpdateTlsFiles
by Zhangbo (Oscar) 09 Feb '20

09 Feb '20

Zhangbo (Oscar) 将撤回邮件“[PATCH 2/6] virnetserver: Introduce virNetServerUpdateTlsFiles”。

1 0

撤回: [PATCH 1/6] virnettlscontext: refactoring virNetTLSContextLoadCredentials
by Zhangbo (Oscar) 09 Feb '20

09 Feb '20

Zhangbo (Oscar) 将撤回邮件“[PATCH 1/6] virnettlscontext: refactoring virNetTLSContextLoadCredentials”。

1 0

撤回: [PATCH 0/6] update tls files without restarting libvirtd
by Zhangbo (Oscar) 09 Feb '20

09 Feb '20

Zhangbo (Oscar) 将撤回邮件“[PATCH 0/6] update tls files without restarting libvirtd”。

1 0

[PATCH 6/6] docs: update virt-admin.rst for server-update-tls
by Zhangbo (Oscar) 09 Feb '20

09 Feb '20

Update the manpage for the 'server-update-tls' command --- docs/manpages/virt-admin.rst | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/docs/manpages/virt-admin.rst b/docs/manpages/virt-admin.rst index 51c3d3917e..e19d1f1577 100644 --- a/docs/manpages/virt-admin.rst +++ b/docs/manpages/virt-admin.rst @@ -442,6 +442,27 @@ Set new client-related limits on *server*. *--max-clients*. +server-update-tls +----------------- + +**Syntax:** + +.. code-block:: + + server-update-tls server [--filetypes types] + +Update tls context on *server*. + +- *server* + + Available servers on a daemon. Currently only supports 'libvirtd'. + +- *--filetypes* + + Indicate which TLS related files need to be updated, such as CA cert, CA CRL, + server cert/key. ``types`` is bitwise-OR of tls related files. + + CLIENT COMMANDS =============== -- 2.23.0.windows.1

1 0

[PATCH 5/6] virt-admin: Introduce command srv-update-tls
by Zhangbo (Oscar) 09 Feb '20

09 Feb '20

wire-up virAdmServerUpdateTlsFiles API into virt-admin client. --- tools/virt-admin.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 88 insertions(+) diff --git a/tools/virt-admin.c b/tools/virt-admin.c index 32edfe5757..85235ae03d 100644 --- a/tools/virt-admin.c +++ b/tools/virt-admin.c @@ -957,6 +957,84 @@ cmdSrvClientsSet(vshControl *ctl, const vshCmd *cmd) goto cleanup; } +/* ------------------------ + * Command srv-update-tls + * ------------------------ + */ +static const vshCmdInfo info_srv_update_tls_file[] = { + {.name = "help", + .data = N_("notify server to update TLS related files online.") + }, + {.name = "desc", + .data = N_("notify server to update the CA cert, " + "CA CRL, server cert / key without restarts. " + "See OPTIONS for currently supported attributes.") + }, + {.name = NULL} +}; + +static const vshCmdOptDef opts_srv_update_tls_file[] = { + {.name = "server", + .type = VSH_OT_DATA, + .flags = VSH_OFLAG_REQ, + .help = N_("Available servers on a daemon. " + "Currently only supports 'libvirtd'.") + }, + {.name = "filetypes", + .type = VSH_OT_INT, + .flags = VSH_OFLAG_REQ, + .help = N_("filetypes that need to be updated. " + "bitwise-OR of tls filetypes flags.\n" + " parameter Description:\n" + " --filetypes 1 ===> cacert\n" + " --filetypes 2 ===> cacrl\n" + " --filetypes 4 ===> server-cert\n" + " --filetypes 8 ===> server-key\n" + " or a combination of several values. eg:\n" + " --filetypes 3 ===> cacert | cacrl\n" + " notice:\n" + " server cert and key must be updated together.\n") + }, + {.name = NULL} +}; + +static bool +cmdSrvUpdateTlsFiles(vshControl *ctl, const vshCmd *cmd) +{ + bool ret = false; + const char *srvname = NULL; + unsigned int filetypes; + + virAdmServerPtr srv = NULL; + vshAdmControlPtr priv = ctl->privData; + + if (vshCommandOptStringReq(ctl, cmd, "server", &srvname) < 0) + return false; + + if (vshCommandOptUInt(ctl, cmd, "filetypes", &filetypes) < 0) + return false; + + if (filetypes == 0) { + vshError(ctl, "%s", _("filetypes can not be 0.")); + goto cleanup; + } + + if (!(srv = virAdmConnectLookupServer(priv->conn, srvname, 0))) + goto cleanup; + + if (virAdmServerUpdateTlsFiles(srv, filetypes, VIR_TLS_UPDATE_CLEAR) < 0) { + vshError(ctl, "%s", _("Unable to update server's tls related files.")); + goto cleanup; + } + + ret = true; + vshPrint(ctl, "update tls related files succeed\n"); + + cleanup: + virAdmServerFree(srv); + return ret; +} + /* -------------------------- * Command daemon-log-filters * -------------------------- @@ -1436,6 +1514,16 @@ static const vshCmdDef managementCmds[] = { .info = info_srv_clients_set, .flags = 0 }, + {.name = "srv-update-tls", + .flags = VSH_CMD_FLAG_ALIAS, + .alias = "server-update-tls" + }, + {.name = "server-update-tls", + .handler = cmdSrvUpdateTlsFiles, + .opts = opts_srv_update_tls_file, + .info = info_srv_update_tls_file, + .flags = 0 + }, {.name = "daemon-log-filters", .handler = cmdDaemonLogFilters, .opts = opts_daemon_log_filters, -- 2.23.0.windows.1

1 0

[PATCH 4/6] admin: support server cert update mode
by Zhangbo (Oscar) 09 Feb '20

09 Feb '20

virAdmServerUpdateTlsFiles: @flags specifies how to update server cert/key in tls service. Two modes are currently supported: append mode and clear mode, means whether to clear the original cert then add the new one, or just append to the original one. --- include/libvirt/libvirt-admin.h | 14 ++++++++++++++ src/admin/admin_server.c | 7 +------ src/admin/libvirt-admin.c | 7 ++++++- src/rpc/virnetserver.c | 17 +++++++++++++---- src/rpc/virnetserver.h | 3 ++- src/rpc/virnettlscontext.c | 7 +++++-- src/rpc/virnettlscontext.h | 3 ++- 7 files changed, 43 insertions(+), 15 deletions(-) diff --git a/include/libvirt/libvirt-admin.h b/include/libvirt/libvirt-admin.h index 6e38261129..dfdd81ae83 100644 --- a/include/libvirt/libvirt-admin.h +++ b/include/libvirt/libvirt-admin.h @@ -392,6 +392,20 @@ int virAdmClientClose(virAdmClientPtr client, unsigned int flags); # define VIR_SERVER_CLIENTS_UNAUTH_CURRENT "nclients_unauth" +typedef enum { + /* free old credentials and then set new tls context. + */ + VIR_TLS_UPDATE_CLEAR = 0, + + /* do not clear original certificates and keys. + */ + VIR_TLS_UPDATE_APPEND = 1, + + /* boundary value for flag check (unreachable). + */ + VIR_TLS_UPDATE_FLAG_MAX = 2, +} virServerTlsUpdateFlag; + /* tls related filetype flags. */ typedef enum { VIR_TLS_FILE_TYPE_CA_CERT = (1U << 0), diff --git a/src/admin/admin_server.c b/src/admin/admin_server.c index 558913367b..43c7e00d90 100644 --- a/src/admin/admin_server.c +++ b/src/admin/admin_server.c @@ -373,10 +373,5 @@ adminServerUpdateTlsFiles(virNetServerPtr srv, unsigned int filetypes, unsigned int flags) { - virCheckFlags(0, -1); - - if (virNetServerUpdateTlsFiles(srv, filetypes) < 0) - return -1; - - return 0; + return virNetServerUpdateTlsFiles(srv, filetypes, flags); } diff --git a/src/admin/libvirt-admin.c b/src/admin/libvirt-admin.c index f3f92ed91c..b6ba72b577 100644 --- a/src/admin/libvirt-admin.c +++ b/src/admin/libvirt-admin.c @@ -1086,12 +1086,17 @@ virAdmServerSetClientLimits(virAdmServerPtr srv, * virAdmServerUpdateTlsFiles: * @srv: a valid server object reference * @filetypes: bitwise-OR of virServerTlsFiletype - * @flags: extra flags; not used yet, so callers should always pass 0 + * @flags: mode that specifies the update method * * Notify server to update tls file, such as cacert, cacrl, server cert / key. * Mark the files that need to be updated by the @filetypes parameter. * See virServerTlsFiletype for detailed description of accepted filetypes. * + * @flags specifies how to update server cert/key in tls service, + * and is either the value VIR_TLS_UPDATE_APPEND, or VIR_TLS_UPDATE_CLEAR. + * The default value is VIR_TLS_UPDATE_CLEAR. See virServerTlsUpdateFlag for + * detailed description. + * * Returns 0 if the TLS files have been updated successfully or -1 in case of an * error. */ diff --git a/src/rpc/virnetserver.c b/src/rpc/virnetserver.c index 65ec677d0a..72c4d37bc6 100644 --- a/src/rpc/virnetserver.c +++ b/src/rpc/virnetserver.c @@ -1226,7 +1226,8 @@ virNetServerGetTLSContext(virNetServerPtr srv) return ctxt; } -static int virNetServerUpdateTlsFilesCheckParams(unsigned int filetypes) +static int virNetServerUpdateTlsFilesCheckParams(unsigned int filetypes, + unsigned int flags) { bool haveSrvCert = filetypes & VIR_TLS_FILE_TYPE_SERVER_CERT; bool haveSrvKey = filetypes & VIR_TLS_FILE_TYPE_SERVER_KEY; @@ -1239,12 +1240,20 @@ static int virNetServerUpdateTlsFilesCheckParams(unsigned int filetypes) return -1; } + if (flags >= VIR_TLS_UPDATE_FLAG_MAX) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("don not support flags: %d"), + flags); + return -1; + } + return 0; } int virNetServerUpdateTlsFiles(virNetServerPtr srv, - unsigned int filetypes) + unsigned int filetypes, + unsigned int flags) { int ret = -1; #ifndef WITH_GNUTLS @@ -1254,7 +1263,7 @@ virNetServerUpdateTlsFiles(virNetServerPtr srv, #else virNetTLSContextPtr ctxt = NULL; - if (virNetServerUpdateTlsFilesCheckParams(filetypes)) + if (virNetServerUpdateTlsFilesCheckParams(filetypes, flags)) return -1; virObjectLock(srv); @@ -1266,7 +1275,7 @@ virNetServerUpdateTlsFiles(virNetServerPtr srv, goto cleanup; } - if (virNetTLSContextReload(ctxt, filetypes)) { + if (virNetTLSContextReload(ctxt, filetypes, flags)) { VIR_ERROR(_("reload server's tls context fail")); goto cleanup; } diff --git a/src/rpc/virnetserver.h b/src/rpc/virnetserver.h index 99466dd041..1a905aa483 100644 --- a/src/rpc/virnetserver.h +++ b/src/rpc/virnetserver.h @@ -135,4 +135,5 @@ int virNetServerSetClientLimits(virNetServerPtr srv, long long int maxClientsUnauth); int virNetServerUpdateTlsFiles(virNetServerPtr srv, - unsigned int filetypes); + unsigned int filetypes, + unsigned int flags); diff --git a/src/rpc/virnettlscontext.c b/src/rpc/virnettlscontext.c index 8baa6a15b2..a66aaece69 100644 --- a/src/rpc/virnettlscontext.c +++ b/src/rpc/virnettlscontext.c @@ -1140,7 +1140,8 @@ void virNetTLSContextDispose(void *obj) } int virNetTLSContextReload(virNetTLSContextPtr ctxt, - unsigned int filetypes) + unsigned int filetypes, + unsigned int flags) { int ret = -1; char *cacert = NULL; @@ -1165,7 +1166,9 @@ int virNetTLSContextReload(virNetTLSContextPtr ctxt, } if (filetypes & VIR_TLS_FILE_TYPE_SERVER_CERT) { - gnutls_certificate_free_keys(ctxt->x509cred); + if (flags == VIR_TLS_UPDATE_CLEAR) + gnutls_certificate_free_keys(ctxt->x509cred); + if (virNetTLSContextSetCertAndKey(ctxt, cert, key, false)) goto cleanup; } diff --git a/src/rpc/virnettlscontext.h b/src/rpc/virnettlscontext.h index 9e83caf255..929487af99 100644 --- a/src/rpc/virnettlscontext.h +++ b/src/rpc/virnettlscontext.h @@ -66,7 +66,8 @@ int virNetTLSContextCheckCertificate(virNetTLSContextPtr ctxt, virNetTLSSessionPtr sess); int virNetTLSContextReload(virNetTLSContextPtr ctxt, - unsigned int filetypes); + unsigned int filetypes, + unsigned int flags); typedef ssize_t (*virNetTLSSessionWriteFunc)(const char *buf, size_t len, void *opaque); -- 2.23.0.windows.1

1 0

[PATCH 3/6] admin: Introduce virAdmServerUpdateTlsFiles
by Zhangbo (Oscar) 09 Feb '20

09 Feb '20

The server needs to use CA certificate, CRL, server certificate/key to complete the TLS handshake. If these files change, we need to restart libvirtd for them to take effect. This API can update the TLS context without restarting libvirtd. --- include/libvirt/libvirt-admin.h | 4 ++++ src/admin/admin_protocol.x | 13 ++++++++++- src/admin/admin_server.c | 13 +++++++++++ src/admin/admin_server.h | 4 ++++ src/admin/libvirt-admin.c | 34 ++++++++++++++++++++++++++++ src/admin/libvirt_admin_private.syms | 1 + src/admin/libvirt_admin_public.syms | 1 + 7 files changed, 69 insertions(+), 1 deletion(-) diff --git a/include/libvirt/libvirt-admin.h b/include/libvirt/libvirt-admin.h index 3edc044490..6e38261129 100644 --- a/include/libvirt/libvirt-admin.h +++ b/include/libvirt/libvirt-admin.h @@ -410,6 +410,10 @@ int virAdmServerSetClientLimits(virAdmServerPtr srv, int nparams, unsigned int flags); +int virAdmServerUpdateTlsFiles(virAdmServerPtr srv, + unsigned int filetypes, + unsigned int flags); + int virAdmConnectGetLoggingOutputs(virAdmConnectPtr conn, char **outputs, unsigned int flags); diff --git a/src/admin/admin_protocol.x b/src/admin/admin_protocol.x index 42e215d23a..0fc8c54c80 100644 --- a/src/admin/admin_protocol.x +++ b/src/admin/admin_protocol.x @@ -181,6 +181,12 @@ struct admin_server_set_client_limits_args { unsigned int flags; }; +struct admin_server_update_tls_files_args { + admin_nonnull_server srv; + unsigned int filetypes; + unsigned int flags; +}; + struct admin_connect_get_logging_outputs_args { unsigned int flags; }; @@ -314,5 +320,10 @@ enum admin_procedure { /** * @generate: both */ - ADMIN_PROC_CONNECT_SET_LOGGING_FILTERS = 17 + ADMIN_PROC_CONNECT_SET_LOGGING_FILTERS = 17, + + /** + * @generate: both + */ + ADMIN_PROC_SERVER_UPDATE_TLS_FILES = 18 }; diff --git a/src/admin/admin_server.c b/src/admin/admin_server.c index ba87f701c3..558913367b 100644 --- a/src/admin/admin_server.c +++ b/src/admin/admin_server.c @@ -367,3 +367,16 @@ adminServerSetClientLimits(virNetServerPtr srv, return 0; } + +int +adminServerUpdateTlsFiles(virNetServerPtr srv, + unsigned int filetypes, + unsigned int flags) +{ + virCheckFlags(0, -1); + + if (virNetServerUpdateTlsFiles(srv, filetypes) < 0) + return -1; + + return 0; +} diff --git a/src/admin/admin_server.h b/src/admin/admin_server.h index 1d5cbec55f..bd355017f2 100644 --- a/src/admin/admin_server.h +++ b/src/admin/admin_server.h @@ -67,3 +67,7 @@ int adminServerSetClientLimits(virNetServerPtr srv, virTypedParameterPtr params, int nparams, unsigned int flags); + +int adminServerUpdateTlsFiles(virNetServerPtr srv, + unsigned int filetypes, + unsigned int flags); diff --git a/src/admin/libvirt-admin.c b/src/admin/libvirt-admin.c index 4099a54854..f3f92ed91c 100644 --- a/src/admin/libvirt-admin.c +++ b/src/admin/libvirt-admin.c @@ -1082,6 +1082,40 @@ virAdmServerSetClientLimits(virAdmServerPtr srv, return ret; } +/** + * virAdmServerUpdateTlsFiles: + * @srv: a valid server object reference + * @filetypes: bitwise-OR of virServerTlsFiletype + * @flags: extra flags; not used yet, so callers should always pass 0 + * + * Notify server to update tls file, such as cacert, cacrl, server cert / key. + * Mark the files that need to be updated by the @filetypes parameter. + * See virServerTlsFiletype for detailed description of accepted filetypes. + * + * Returns 0 if the TLS files have been updated successfully or -1 in case of an + * error. + */ +int +virAdmServerUpdateTlsFiles(virAdmServerPtr srv, + unsigned int filetypes, + unsigned int flags) +{ + int ret = -1; + + VIR_DEBUG("srv=%p, filetypes=%u, flags=0x%x", srv, filetypes, flags); + virResetLastError(); + + virCheckAdmServerGoto(srv, error); + + if ((ret = remoteAdminServerUpdateTlsFiles(srv, filetypes, flags)) < 0) + goto error; + + return ret; + error: + virDispatchError(NULL); + return ret; +} + /** * virAdmConnectGetLoggingOutputs: * @conn: pointer to an active admin connection diff --git a/src/admin/libvirt_admin_private.syms b/src/admin/libvirt_admin_private.syms index 9526412de8..157a45341e 100644 --- a/src/admin/libvirt_admin_private.syms +++ b/src/admin/libvirt_admin_private.syms @@ -31,6 +31,7 @@ xdr_admin_server_lookup_client_args; xdr_admin_server_lookup_client_ret; xdr_admin_server_set_client_limits_args; xdr_admin_server_set_threadpool_parameters_args; +xdr_admin_server_update_tls_files_args; # datatypes.h virAdmClientClass; diff --git a/src/admin/libvirt_admin_public.syms b/src/admin/libvirt_admin_public.syms index 9a3f843780..8126973e5b 100644 --- a/src/admin/libvirt_admin_public.syms +++ b/src/admin/libvirt_admin_public.syms @@ -38,6 +38,7 @@ LIBVIRT_ADMIN_2.0.0 { virAdmClientClose; virAdmServerGetClientLimits; virAdmServerSetClientLimits; + virAdmServerUpdateTlsFiles; }; LIBVIRT_ADMIN_3.0.0 { -- 2.23.0.windows.1

1 0

[PATCH 2/6] virnetserver: Introduce virNetServerUpdateTlsFiles
by Zhangbo (Oscar) 09 Feb '20

09 Feb '20

Add an API to update server's tls context before admin method can be introduced. --- include/libvirt/libvirt-admin.h | 8 ++++ src/libvirt_remote.syms | 1 + src/rpc/virnetserver.c | 72 +++++++++++++++++++++++++++++++++ src/rpc/virnetserver.h | 3 ++ src/rpc/virnetserverclient.c | 4 ++ src/rpc/virnettlscontext.c | 41 +++++++++++++++++++ src/rpc/virnettlscontext.h | 2 + 7 files changed, 131 insertions(+) diff --git a/include/libvirt/libvirt-admin.h b/include/libvirt/libvirt-admin.h index abf2792926..3edc044490 100644 --- a/include/libvirt/libvirt-admin.h +++ b/include/libvirt/libvirt-admin.h @@ -392,6 +392,14 @@ int virAdmClientClose(virAdmClientPtr client, unsigned int flags); # define VIR_SERVER_CLIENTS_UNAUTH_CURRENT "nclients_unauth" +/* tls related filetype flags. */ +typedef enum { + VIR_TLS_FILE_TYPE_CA_CERT = (1U << 0), + VIR_TLS_FILE_TYPE_CA_CRL = (1U << 1), + VIR_TLS_FILE_TYPE_SERVER_CERT = (1U << 2), + VIR_TLS_FILE_TYPE_SERVER_KEY = (1U << 3), +} virServerTlsFiletype; + int virAdmServerGetClientLimits(virAdmServerPtr srv, virTypedParameterPtr *params, int *nparams, diff --git a/src/libvirt_remote.syms b/src/libvirt_remote.syms index 0493467f46..0018a0c41d 100644 --- a/src/libvirt_remote.syms +++ b/src/libvirt_remote.syms @@ -137,6 +137,7 @@ virNetServerSetClientLimits; virNetServerSetThreadPoolParameters; virNetServerSetTLSContext; virNetServerUpdateServices; +virNetServerUpdateTlsFiles; # rpc/virnetserverclient.h diff --git a/src/rpc/virnetserver.c b/src/rpc/virnetserver.c index c87dade1a8..65ec677d0a 100644 --- a/src/rpc/virnetserver.c +++ b/src/rpc/virnetserver.c @@ -1207,3 +1207,75 @@ virNetServerSetClientLimits(virNetServerPtr srv, virObjectUnlock(srv); return ret; } + +static virNetTLSContextPtr +virNetServerGetTLSContext(virNetServerPtr srv) +{ + size_t i; + virNetTLSContextPtr ctxt = NULL; + virNetServerServicePtr svc = NULL; + + /* find svcTLS from srv, get svcTLS->tls */ + for (i = 0; i < srv->nservices; i++) { + svc = srv->services[i]; + ctxt = virNetServerServiceGetTLSContext(svc); + if (ctxt != NULL) + break; + } + + return ctxt; +} + +static int virNetServerUpdateTlsFilesCheckParams(unsigned int filetypes) +{ + bool haveSrvCert = filetypes & VIR_TLS_FILE_TYPE_SERVER_CERT; + bool haveSrvKey = filetypes & VIR_TLS_FILE_TYPE_SERVER_KEY; + + if ((haveSrvCert && !haveSrvKey) || + (!haveSrvCert && haveSrvKey)) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("server cert/key must be updated together. " + "filetypes: %d"), filetypes); + return -1; + } + + return 0; +} + +int +virNetServerUpdateTlsFiles(virNetServerPtr srv, + unsigned int filetypes) +{ + int ret = -1; +#ifndef WITH_GNUTLS + virReportError(VIR_ERR_SYSTEM_ERROR, + _("Don't support GNUTLS, can't to update filetypes: %d"), + filetypes); +#else + virNetTLSContextPtr ctxt = NULL; + + if (virNetServerUpdateTlsFilesCheckParams(filetypes)) + return -1; + + virObjectLock(srv); + + ctxt = virNetServerGetTLSContext(srv); + if (!ctxt) { + VIR_ERROR(_("no tls svc found, can't to update filetypes: %d"), + filetypes); + goto cleanup; + } + + if (virNetTLSContextReload(ctxt, filetypes)) { + VIR_ERROR(_("reload server's tls context fail")); + goto cleanup; + } + + VIR_INFO("update all tls files complete, filetypes: %d", filetypes); + ret = 0; + + cleanup: + virObjectUnlock(srv); +#endif + return ret; +} diff --git a/src/rpc/virnetserver.h b/src/rpc/virnetserver.h index 260c99b22d..99466dd041 100644 --- a/src/rpc/virnetserver.h +++ b/src/rpc/virnetserver.h @@ -133,3 +133,6 @@ size_t virNetServerGetCurrentUnauthClients(virNetServerPtr srv); int virNetServerSetClientLimits(virNetServerPtr srv, long long int maxClients, long long int maxClientsUnauth); + +int virNetServerUpdateTlsFiles(virNetServerPtr srv, + unsigned int filetypes); diff --git a/src/rpc/virnetserverclient.c b/src/rpc/virnetserverclient.c index 67b3bf9531..f0952cadde 100644 --- a/src/rpc/virnetserverclient.c +++ b/src/rpc/virnetserverclient.c @@ -1117,7 +1117,9 @@ int virNetServerClientInit(virNetServerClientPtr client) client->tls); /* Begin the TLS handshake. */ + virObjectLock(client->tlsCtxt); ret = virNetTLSSessionHandshake(client->tls); + virObjectUnlock(client->tlsCtxt); if (ret == 0) { /* Unlikely, but ... Next step is to check the certificate. */ if (virNetServerClientCheckAccess(client) < 0) @@ -1438,7 +1440,9 @@ virNetServerClientDispatchHandshake(virNetServerClientPtr client) { int ret; /* Continue the handshake. */ + virObjectLock(client->tlsCtxt); ret = virNetTLSSessionHandshake(client->tls); + virObjectUnlock(client->tlsCtxt); if (ret == 0) { /* Finished. Next step is to check the certificate. */ if (virNetServerClientCheckAccess(client) < 0) diff --git a/src/rpc/virnettlscontext.c b/src/rpc/virnettlscontext.c index 12811bed78..8baa6a15b2 100644 --- a/src/rpc/virnettlscontext.c +++ b/src/rpc/virnettlscontext.c @@ -1139,6 +1139,47 @@ void virNetTLSContextDispose(void *obj) gnutls_certificate_free_credentials(ctxt->x509cred); } +int virNetTLSContextReload(virNetTLSContextPtr ctxt, + unsigned int filetypes) +{ + int ret = -1; + char *cacert = NULL; + char *cacrl = NULL; + char *cert = NULL; + char *key = NULL; + + virObjectLock(ctxt); + + if (virNetTLSContextLocateCredentials(NULL, false, true, + &cacert, &cacrl, &cert, &key) < 0) + goto cleanup; + + if (filetypes & VIR_TLS_FILE_TYPE_CA_CERT) { + if (virNetTLSContextSetCACert(ctxt, cacert, false)) + goto cleanup; + } + + if (filetypes & VIR_TLS_FILE_TYPE_CA_CRL) { + if (virNetTLSContextSetCACRL(ctxt, cacrl, false)) + goto cleanup; + } + + if (filetypes & VIR_TLS_FILE_TYPE_SERVER_CERT) { + gnutls_certificate_free_keys(ctxt->x509cred); + if (virNetTLSContextSetCertAndKey(ctxt, cert, key, false)) + goto cleanup; + } + + ret = 0; + + cleanup: + virObjectUnlock(ctxt); + VIR_FREE(cacert); + VIR_FREE(cacrl); + VIR_FREE(key); + VIR_FREE(cert); + return ret; +} static ssize_t virNetTLSSessionPush(void *opaque, const void *buf, size_t len) diff --git a/src/rpc/virnettlscontext.h b/src/rpc/virnettlscontext.h index f3273bc26a..9e83caf255 100644 --- a/src/rpc/virnettlscontext.h +++ b/src/rpc/virnettlscontext.h @@ -65,6 +65,8 @@ virNetTLSContextPtr virNetTLSContextNewClient(const char *cacert, int virNetTLSContextCheckCertificate(virNetTLSContextPtr ctxt, virNetTLSSessionPtr sess); +int virNetTLSContextReload(virNetTLSContextPtr ctxt, + unsigned int filetypes); typedef ssize_t (*virNetTLSSessionWriteFunc)(const char *buf, size_t len, void *opaque); -- 2.23.0.windows.1

1 0

[PATCH 1/6] virnettlscontext: refactoring virNetTLSContextLoadCredentials
by Zhangbo (Oscar) 09 Feb '20

09 Feb '20

Encapsulate the code for setting TLS-related files into functions, which is convenient for other modules to call. --- src/rpc/virnettlscontext.c | 135 ++++++++++++++++++++++--------------- 1 file changed, 82 insertions(+), 53 deletions(-) diff --git a/src/rpc/virnettlscontext.c b/src/rpc/virnettlscontext.c index 44f0dfce77..12811bed78 100644 --- a/src/rpc/virnettlscontext.c +++ b/src/rpc/virnettlscontext.c @@ -594,6 +594,85 @@ static int virNetTLSContextSanityCheckCredentials(bool isServer, return ret; } +static int virNetTLSContextSetCACert(virNetTLSContextPtr ctxt, + const char *cacert, + bool allowMissing) +{ + int err; + if (virNetTLSContextCheckCertFile("CA certificate", cacert, allowMissing) < 0) + return -1; + + VIR_DEBUG("loading CA cert from %s", cacert); + err = gnutls_certificate_set_x509_trust_file(ctxt->x509cred, + cacert, + GNUTLS_X509_FMT_PEM); + if (err < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("Unable to set x509 CA certificate: %s: %s"), + cacert, gnutls_strerror(err)); + return -1; + } + + return 0; +} + +static int virNetTLSContextSetCACRL(virNetTLSContextPtr ctxt, + const char *cacrl, + bool allowMissing) +{ + int rv, err; + if ((rv = virNetTLSContextCheckCertFile("CA revocation list", cacrl, allowMissing)) < 0) + return -1; + + if (rv == 0) { + VIR_DEBUG("loading CRL from %s", cacrl); + err = gnutls_certificate_set_x509_crl_file(ctxt->x509cred, + cacrl, + GNUTLS_X509_FMT_PEM); + if (err < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("Unable to set x509 certificate revocation list: %s: %s"), + cacrl, gnutls_strerror(err)); + return -1; + } + } else { + VIR_DEBUG("Skipping non-existent CA CRL %s", cacrl); + } + + return 0; +} + +static int virNetTLSContextSetCertAndKey(virNetTLSContextPtr ctxt, + const char *cert, + const char *key, + bool allowMissing) +{ + int rv, err; + if ((rv = virNetTLSContextCheckCertFile("certificate", cert, allowMissing)) < 0) + return -1; + if (rv == 0 && + (rv = virNetTLSContextCheckCertFile("private key", key, allowMissing)) < 0) + return -1; + + if (rv == 0) { + VIR_DEBUG("loading cert and key from %s and %s", cert, key); + err = + gnutls_certificate_set_x509_key_file(ctxt->x509cred, + cert, key, + GNUTLS_X509_FMT_PEM); + if (err < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("Unable to set x509 key and certificate: %s, %s: %s"), + key, cert, gnutls_strerror(err)); + return -1; + } + } else { + VIR_DEBUG("Skipping non-existent cert %s key %s on client", + cert, key); + } + + return 0; +} static int virNetTLSContextLoadCredentials(virNetTLSContextPtr ctxt, bool isServer, @@ -602,69 +681,19 @@ static int virNetTLSContextLoadCredentials(virNetTLSContextPtr ctxt, const char *cert, const char *key) { - int err; - if (cacert && cacert[0] != '\0') { - if (virNetTLSContextCheckCertFile("CA certificate", cacert, false) < 0) - return -1; - - VIR_DEBUG("loading CA cert from %s", cacert); - err = gnutls_certificate_set_x509_trust_file(ctxt->x509cred, - cacert, - GNUTLS_X509_FMT_PEM); - if (err < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("Unable to set x509 CA certificate: %s: %s"), - cacert, gnutls_strerror(err)); + if (virNetTLSContextSetCACert(ctxt, cacert, false)) return -1; - } } if (cacrl && cacrl[0] != '\0') { - int rv; - if ((rv = virNetTLSContextCheckCertFile("CA revocation list", cacrl, true)) < 0) + if (virNetTLSContextSetCACRL(ctxt, cacrl, true)) return -1; - - if (rv == 0) { - VIR_DEBUG("loading CRL from %s", cacrl); - err = gnutls_certificate_set_x509_crl_file(ctxt->x509cred, - cacrl, - GNUTLS_X509_FMT_PEM); - if (err < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("Unable to set x509 certificate revocation list: %s: %s"), - cacrl, gnutls_strerror(err)); - return -1; - } - } else { - VIR_DEBUG("Skipping non-existent CA CRL %s", cacrl); - } } if (cert && cert[0] != '\0' && key && key[0] != '\0') { - int rv; - if ((rv = virNetTLSContextCheckCertFile("certificate", cert, !isServer)) < 0) + if (virNetTLSContextSetCertAndKey(ctxt, cert, key, !isServer)) return -1; - if (rv == 0 && - (rv = virNetTLSContextCheckCertFile("private key", key, !isServer)) < 0) - return -1; - - if (rv == 0) { - VIR_DEBUG("loading cert and key from %s and %s", cert, key); - err = - gnutls_certificate_set_x509_key_file(ctxt->x509cred, - cert, key, - GNUTLS_X509_FMT_PEM); - if (err < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("Unable to set x509 key and certificate: %s, %s: %s"), - key, cert, gnutls_strerror(err)); - return -1; - } - } else { - VIR_DEBUG("Skipping non-existent cert %s key %s on client", - cert, key); - } } return 0; -- 2.23.0.windows.1

1 0

[PATCH 0/6] update tls files without restarting libvirtd
by Zhangbo (Oscar) 09 Feb '20

09 Feb '20

When a client wants to establish a TLS connection with libvirtd, a CRL file， CA cert and server cert/key are used. Right now, if these files are changed, you must restart libvirtd to make them take effect. The restart behavior of libvirtd will cause clients connecting with libvirtd to fail. In a server cluster, these files, mostly the CRL, may be updated quite frequently dueto the large amount of certificates. If the new file does not take effect in time, there are security risks. So you may need to restart libvirtd frequently to make the CRL etc. take effect in time. However, frequent restarts will affect the reliability of cluster virtual machine management(such as openstack) services. These patches add a virt-admin command to update the tls related files *online*. Zhang Bo (6): virnettlscontext: refactoring virNetTLSContextLoadCredentials virnetserver: Introduce virNetServerUpdateTlsFiles admin: Introduce virAdmServerUpdateTlsFiles admin: support server cert update mode virt-admin: Introduce command srv-update-tls docs: update virt-admin.rst for server-update-tls docs/manpages/virt-admin.rst | 21 ++++ include/libvirt/libvirt-admin.h | 26 ++++ src/admin/admin_protocol.x | 13 +- src/admin/admin_server.c | 8 ++ src/admin/admin_server.h | 4 + src/admin/libvirt-admin.c | 39 ++++++ src/admin/libvirt_admin_private.syms | 1 + src/admin/libvirt_admin_public.syms | 1 + src/libvirt_remote.syms | 1 + src/rpc/virnetserver.c | 81 ++++++++++++ src/rpc/virnetserver.h | 4 + src/rpc/virnetserverclient.c | 4 + src/rpc/virnettlscontext.c | 179 +++++++++++++++++++-------- src/rpc/virnettlscontext.h | 3 + tools/virt-admin.c | 88 +++++++++++++ 15 files changed, 419 insertions(+), 54 deletions(-) -- 2.23.0.windows.1

1 0

[libvirt PATCH] src: use closefrom() for mass closing of FDs
by Daniel P. Berrangé 09 Feb '20

09 Feb '20

On FreeBSD 12 the default ulimit settings allow for 100,000 open file descriptors. As a result spawning processes in libvirt is abominably slow. Fortunately FreeBSD has long since provided a good solution in the form of closefrom(), which closes all FDs equal to or larger than the specified parameter. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/util/vircommand.c | 60 ++++++++++++++++++++++++++++++++++++++++--- tests/testutils.c | 9 +++++++ 2 files changed, 66 insertions(+), 3 deletions(-) diff --git a/src/util/vircommand.c b/src/util/vircommand.c index 904a3023c5..764fb2fe43 100644 --- a/src/util/vircommand.c +++ b/src/util/vircommand.c @@ -494,6 +494,59 @@ virCommandMassCloseGetFDsGeneric(virCommandPtr cmd G_GNUC_UNUSED, } # endif /* !__linux__ */ +# ifdef __FreeBSD__ + +static int +virCommandMassClose(virCommandPtr cmd, + int childin, + int childout, + int childerr) +{ + int lastfd = -1; + int fd = -1; + + /* + * Two phases of closing. + * + * The first (inefficient) phase iterates over FDs, + * preserving certain FDs we need to pass down, and + * closing others. The number of iterations is bounded + * to the number of the biggest FD we need to preserve. + * + * The second (speedy) phase uses closefrom() to cull + * all remaining FDs in the process. + * + * Usually the first phase will be fairly quick only + * processing a handful of low FD numbers, and thus using + * closefrom() is a massive win for high ulimit() NFILES + * values. + */ + lastfd = MAX(lastfd, childin); + lastfd = MAX(lastfd, childout); + lastfd = MAX(lastfd, childerr); + + while (fd < cmd->npassfd) + lastfd = MAX(lastfd, cmd->passfd[fd].fd); + + for (fd = 0; fd <= lastfd; fd++) { + if (fd == childin || fd == childout || fd == childerr) + continue; + if (!virCommandFDIsSet(cmd, fd)) { + int tmpfd = fd; + VIR_MASS_CLOSE(tmpfd); + } else if (virSetInherit(fd, true) < 0) { + virReportSystemError(errno, _("failed to preserve fd %d"), fd); + return -1; + } + } + + closefrom(lastfd + 1); + + return 0; +} + +# else /* ! __FreeBSD__ */ + static int virCommandMassClose(virCommandPtr cmd, int childin, @@ -520,13 +573,13 @@ virCommandMassClose(virCommandPtr cmd, if (!(fds = virBitmapNew(openmax))) return -1; -# ifdef __linux__ +# ifdef __linux__ if (virCommandMassCloseGetFDsLinux(cmd, fds) < 0) return -1; -# else +# else if (virCommandMassCloseGetFDsGeneric(cmd, fds) < 0) return -1; -# endif +# endif fd = virBitmapNextSetBit(fds, 2); for (; fd >= 0; fd = virBitmapNextSetBit(fds, fd)) { @@ -544,6 +597,7 @@ virCommandMassClose(virCommandPtr cmd, return 0; } +# endif /* ! __FreeBSD__ */ /* * virExec: diff --git a/tests/testutils.c b/tests/testutils.c index 7b9a5ea05b..662203d707 100644 --- a/tests/testutils.c +++ b/tests/testutils.c @@ -333,8 +333,10 @@ static void virTestCaptureProgramExecChild(const char *const argv[], int pipefd) { +# ifndef __FreeBSD__ size_t i; int open_max; +# endif /* ! __FreeBSD__ */ int stdinfd = -1; const char *const env[] = { "LANG=C", @@ -344,6 +346,7 @@ void virTestCaptureProgramExecChild(const char *const argv[], if ((stdinfd = open("/dev/null", O_RDONLY)) < 0) goto cleanup; +# ifndef __FreeBSD__ open_max = sysconf(_SC_OPEN_MAX); if (open_max < 0) goto cleanup; @@ -356,6 +359,7 @@ void virTestCaptureProgramExecChild(const char *const argv[], VIR_FORCE_CLOSE(tmpfd); } } +# endif /* __FreeBSD__ */ if (dup2(stdinfd, STDIN_FILENO) != STDIN_FILENO) goto cleanup; @@ -364,6 +368,11 @@ void virTestCaptureProgramExecChild(const char *const argv[], if (dup2(pipefd, STDERR_FILENO) != STDERR_FILENO) goto cleanup; +# ifdef __FreeBSD__ + closefrom(STDERR_FILENO); + stdinfd = pipefd = -1; +# endif + /* SUS is crazy here, hence the cast */ execve(argv[0], (char *const*)argv, (char *const*)env); -- 2.24.1

2 1

New release of libvirt-php?
by Neal Gompa 08 Feb '20

08 Feb '20

Hey, It's been a couple of years (!!!) since the last libvirt-php release. Since then, the code has been pretty dramatically restructured to more closely mimic how libvirt and other bindings are structured. With that and the new API add just pushed, could we get a new release of libvirt-php? IMO, it's a bad sign when the Fedora package has gone through 10 builds with a version bump with basically no interaction on my part (automated rebuilds or mass change builds!). -- 真実はいつも一つ！/ Always, there's only one truth!

3 5

Release of libvirt-php-0.5.5
by Michal Prívozník 08 Feb '20

08 Feb '20

After 2.5 years, I'm glad to announce new release of PHP bindings. You can download them from here: https://libvirt.org/sources/php/libvirt-php-0.5.5.tar.gz The changelog contains a lot of code cleanups, bug fixes and some new APIs implemented (virDomainReset and virDomainInterfaceAddresses). Thanks to everybody who helped with the release. Michal

1 0

[PATCH 0/2] virsh: qemu-monitor-command: Improve docs and retrun value handling
by Peter Krempa 07 Feb '20

07 Feb '20

2/2 was already reviewed, but it depends on the docs patch. Peter Krempa (2): docs: virsh: Modernize docs for qemu-monitor-command virsh: Allow extracting 'return' section of QMP command in 'qemu-monitor-command' docs/manpages/virsh.rst | 24 ++++++++++++++-------- tools/virsh-domain.c | 44 ++++++++++++++++++++++++++++++++--------- 2 files changed, 51 insertions(+), 17 deletions(-) -- 2.24.1

2 3

[libvirt PATCH] tests: avoid referencing stale readdir pointer
by Daniel P. Berrangé 07 Feb '20

07 Feb '20

The contents of 'struct dirent' are only valid until the next call to readdir() or closedir(). It is thus invalid to save a pointer to the 'd_name' field. Somehow this hasn't affected the test suite until recently when FreeBSD 12 started showing use of uninitialized memory resulting in test failures. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- Pushed as a build fix tests/testutilsqemu.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tests/testutilsqemu.c b/tests/testutilsqemu.c index c17e284930..0cb9a7456d 100644 --- a/tests/testutilsqemu.c +++ b/tests/testutilsqemu.c @@ -497,7 +497,7 @@ testQemuGetLatestCapsForArch(const char *arch, char *tmp = NULL; unsigned long maxver = 0; unsigned long ver; - const char *maxname = NULL; + g_autofree char *maxname = NULL; char *ret = NULL; fullsuffix = g_strdup_printf("%s.%s", arch, suffix); @@ -522,7 +522,8 @@ testQemuGetLatestCapsForArch(const char *arch, } if (ver > maxver) { - maxname = ent->d_name; + g_free(maxname); + maxname = g_strdup(ent->d_name); maxver = ver; } } -- 2.24.1

1 0

[libvirt PATCH 0/2] qemu: fix crash on invalid bandwidth request
by Ján Tomko 07 Feb '20

07 Feb '20

https://bugzilla.redhat.com/show_bug.cgi?id=1800505 Ján Tomko (2): qemu: do not revert to NULL bandwidth qemu: preserve error on bandwidth rollback src/qemu/qemu_driver.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) -- 2.21.1

2 4

[libvirt PATCH 0/3] qemu: Fix default CPU for old s390 machine types
by Jiri Denemark 07 Feb '20

07 Feb '20

See the last patch for detailed description and https://bugzilla.redhat.com/show_bug.cgi?id=1795651 for a discussion about this topic. Jiri Denemark (3): qemu: Pass machine type to virQEMUCapsIsCPUModeSupported qemuxml2*test: Add default CPU tests for s390-ccw-virtio-2.7 machines qemu_capabilities: Disable CPU models on old s390 machine types src/qemu/qemu_capabilities.c | 29 ++++++++++++++--- src/qemu/qemu_capabilities.h | 3 +- src/qemu/qemu_domain.c | 3 +- src/qemu/qemu_process.c | 2 +- ...t-cpu-kvm-ccw-virtio-2.7.s390x-latest.args | 32 +++++++++++++++++++ .../s390-default-cpu-kvm-ccw-virtio-2.7.xml | 16 ++++++++++ ...t-cpu-tcg-ccw-virtio-2.7.s390x-latest.args | 32 +++++++++++++++++++ .../s390-default-cpu-tcg-ccw-virtio-2.7.xml | 16 ++++++++++ tests/qemuxml2argvtest.c | 2 ++ ...lt-cpu-kvm-ccw-virtio-2.7.s390x-latest.xml | 24 ++++++++++++++ ...lt-cpu-tcg-ccw-virtio-2.7.s390x-latest.xml | 26 +++++++++++++++ tests/qemuxml2xmltest.c | 2 ++ 12 files changed, 180 insertions(+), 7 deletions(-) create mode 100644 tests/qemuxml2argvdata/s390-default-cpu-kvm-ccw-virtio-2.7.s390x-latest.args create mode 100644 tests/qemuxml2argvdata/s390-default-cpu-kvm-ccw-virtio-2.7.xml create mode 100644 tests/qemuxml2argvdata/s390-default-cpu-tcg-ccw-virtio-2.7.s390x-latest.args create mode 100644 tests/qemuxml2argvdata/s390-default-cpu-tcg-ccw-virtio-2.7.xml create mode 100644 tests/qemuxml2xmloutdata/s390-default-cpu-kvm-ccw-virtio-2.7.s390x-latest.xml create mode 100644 tests/qemuxml2xmloutdata/s390-default-cpu-tcg-ccw-virtio-2.7.s390x-latest.xml -- 2.25.0

4 9

[libvirt PATCH] testutils: print a helpful summary of failed tests
by Ján Tomko 07 Feb '20

07 Feb '20

When debugging test failures in seven independent test cases, it might be helpful to only gather the debug output of the failing cases. Record the indexes of the tests that fail and print them in the VIR_TEST_RANGE of the command line that will result in only those tests being run. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- tests/testutils.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/tests/testutils.c b/tests/testutils.c index 7b9a5ea05b..0cf0ac7e5c 100644 --- a/tests/testutils.c +++ b/tests/testutils.c @@ -54,6 +54,7 @@ static unsigned int testRegenerate = -1; static size_t testCounter; static virBitmapPtr testBitmap; +static virBitmapPtr failedTests; virArch virTestHostArch = VIR_ARCH_X86_64; @@ -172,6 +173,9 @@ virTestRun(const char *title, fprintf(stderr, "!"); } + if (ret != 0) + ignore_value(virBitmapSetBitExpand(failedTests, testCounter)); + g_unsetenv("VIR_TEST_MOCK_TESTNAME"); return ret; } @@ -930,6 +934,9 @@ int virTestMain(int argc, } } + if (!(failedTests = virBitmapNew(1))) + return EXIT_FAILURE; + ret = (func)(); virResetLastError(); @@ -938,6 +945,11 @@ int virTestMain(int argc, fprintf(stderr, "%*s", 40 - (int)(testCounter % 40), ""); fprintf(stderr, " %-3zu %s\n", testCounter, ret == 0 ? "OK" : "FAIL"); } + if (ret == EXIT_FAILURE && !virBitmapIsAllClear(failedTests)) { + g_autofree char *failed = virBitmapFormat(failedTests); + fprintf(stderr, "Some tests failed. Run them using:\n"); + fprintf(stderr, "VIR_TEST_DEBUG=1 VIR_TEST_RANGE=%s %s\n", failed, argv[0]); + } virLogReset(); return ret; } -- 2.21.1

2 1

[libvirt-php PATCH] libvirt-domain: Introduce libvirt_domain_reset()
by Marcus Recck 07 Feb '20

07 Feb '20

We currently have all other power-related functions implemented, but are missing the ability to call virDomainReset from the PHP bindings. This adds that functionality. Signed-off-by: Marcus Recck <mrecck(a)datto.com> --- doc/source/libvirt/entities.functions.xml | 1 + .../functions/libvirt-domain-reboot.xml | 1 + .../functions/libvirt-domain-reset.xml | 82 +++++++++++++++++++ .../functions/libvirt-domain-resume.xml | 1 + .../functions/libvirt-domain-shutdown.xml | 1 + .../functions/libvirt-domain-suspend.xml | 1 + examples/libvirt.php | 9 ++ src/libvirt-domain.c | 24 ++++++ src/libvirt-domain.h | 2 + 9 files changed, 122 insertions(+) create mode 100644 doc/source/libvirt/functions/libvirt-domain-reset.xml diff --git a/doc/source/libvirt/entities.functions.xml b/doc/source/libvirt/entities.functions.xml index 58faefa..0c1c83c 100644 --- a/doc/source/libvirt/entities.functions.xml +++ b/doc/source/libvirt/entities.functions.xml @@ -22,6 +22,7 @@ &reference.libvirt.functions.libvirt-domain-migrate-to-uri; &reference.libvirt.functions.libvirt-domain-migrate; &reference.libvirt.functions.libvirt-domain-reboot; +&reference.libvirt.functions.libvirt-domain-reset; &reference.libvirt.functions.libvirt-domain-resume; &reference.libvirt.functions.libvirt-domain-shutdown; &reference.libvirt.functions.libvirt-domain-suspend; diff --git a/doc/source/libvirt/functions/libvirt-domain-reboot.xml b/doc/source/libvirt/functions/libvirt-domain-reboot.xml index b2531f6..8e00ece 100644 --- a/doc/source/libvirt/functions/libvirt-domain-reboot.xml +++ b/doc/source/libvirt/functions/libvirt-domain-reboot.xml @@ -53,6 +53,7 @@ <member><function>libvirt_domain_shutdown</function></member> <member><function>libvirt_domain_suspend</function></member> <member><function>libvirt_domain_create</function></member> + <member><function>libvirt_domain_reset</function></member> </simplelist> </para> </refsect1> diff --git a/doc/source/libvirt/functions/libvirt-domain-reset.xml b/doc/source/libvirt/functions/libvirt-domain-reset.xml new file mode 100644 index 0000000..51af0c1 --- /dev/null +++ b/doc/source/libvirt/functions/libvirt-domain-reset.xml @@ -0,0 +1,82 @@ +<?xml version="1.0" encoding="utf-8"?> + + +<refentry xml:id="function.libvirt-domain-reset" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink"> + <refnamediv> + <refname>libvirt_domain_reset</refname> + <refpurpose>Reset a domain</refpurpose> + </refnamediv> + + <refsect1 role="description"> + &reftitle.description; + <methodsynopsis> + <type>bool</type><methodname>libvirt_domain_reset</methodname> + <methodparam ><type>resource</type><parameter>domain</parameter></methodparam> + </methodsynopsis> + <para> + Reset a domain immediately without any guest shutdown. + </para> + + </refsect1> + + <refsect1 role="parameters"> + &reftitle.parameters; + <para> + <variablelist> + <varlistentry> + <term><parameter>domain</parameter></term> + <listitem> + <para> + Domain resource of domain to reset. You can get domain resource using various functions (i.e. <function>libvirt_domain_lookup_by_uuid</function> or <function>libvirt_list_domains</function>). + </para> + </listitem> + </varlistentry> + </variablelist> + </para> + </refsect1> + + <refsect1 role="returnvalues"> + &reftitle.returnvalues; +  + <para> + &true; on success and &false; on failure + </para> + </refsect1> + + + + <refsect1 role="seealso"> + &reftitle.seealso; + <para> + <simplelist> + <member><function>libvirt_domain_reboot</function></member> + <member><function>libvirt_domain_resume</function></member> + <member><function>libvirt_domain_suspend</function></member> + <member><function>libvirt_domain_create</function></member> + <member><function>libvirt_domain_shutdown</function></member> + </simplelist> + </para> + </refsect1> + +</refentry> + + diff --git a/doc/source/libvirt/functions/libvirt-domain-resume.xml b/doc/source/libvirt/functions/libvirt-domain-resume.xml index c7d1ba4..cf6378a 100644 --- a/doc/source/libvirt/functions/libvirt-domain-resume.xml +++ b/doc/source/libvirt/functions/libvirt-domain-resume.xml @@ -53,6 +53,7 @@ <member><function>libvirt_domain_shutdown</function></member> <member><function>libvirt_domain_suspend</function></member> <member><function>libvirt_domain_create</function></member> + <member><function>libvirt_domain_reset</function></member> </simplelist> </para> </refsect1> diff --git a/doc/source/libvirt/functions/libvirt-domain-shutdown.xml b/doc/source/libvirt/functions/libvirt-domain-shutdown.xml index 99d6dde..5ae430b 100644 --- a/doc/source/libvirt/functions/libvirt-domain-shutdown.xml +++ b/doc/source/libvirt/functions/libvirt-domain-shutdown.xml @@ -53,6 +53,7 @@ <member><function>libvirt_domain_resume</function></member> <member><function>libvirt_domain_suspend</function></member> <member><function>libvirt_domain_create</function></member> + <member><function>libvirt_domain_reset</function></member> </simplelist> </para> </refsect1> diff --git a/doc/source/libvirt/functions/libvirt-domain-suspend.xml b/doc/source/libvirt/functions/libvirt-domain-suspend.xml index 6787c7e..6627a5e 100644 --- a/doc/source/libvirt/functions/libvirt-domain-suspend.xml +++ b/doc/source/libvirt/functions/libvirt-domain-suspend.xml @@ -53,6 +53,7 @@ <member><function>libvirt_domain_resume</function></member> <member><function>libvirt_domain_shutdown</function></member> <member><function>libvirt_domain_create</function></member> + <member><function>libvirt_domain_reset</function></member> </simplelist> </para> </refsect1> diff --git a/examples/libvirt.php b/examples/libvirt.php index 8e56327..1b1c9d0 100644 --- a/examples/libvirt.php +++ b/examples/libvirt.php @@ -873,6 +873,15 @@ class Libvirt { return ($tmp) ? $tmp : $this->_set_last_error(); } + function domain_reset($domain) { + $dom = $this->get_domain_object($domain); + if (!$dom) + return false; + + $tmp = libvirt_domain_reset($dom); + return ($tmp) ? $tmp: $this->_set_last_error(); + } + function domain_suspend($domain) { $dom = $this->get_domain_object($domain); if (!$dom) diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c index 701aab3..9a7f28c 100644 --- a/src/libvirt-domain.c +++ b/src/libvirt-domain.c @@ -1496,6 +1496,30 @@ PHP_FUNCTION(libvirt_domain_reboot) RETURN_TRUE; } +/* + * Function name: libvirt_domain_reset + * Since version: 0.5.5 + * Description: Function is used to reset the domain identified by its resource + * Arguments: @res [resource]: libvirt domain resource, e.g. from libvirt_domain_lookup_by_*() + @flags [int]: optional flags + * Returns: TRUE for success, FALSE on error + */ +PHP_FUNCTION(libvirt_domain_reset) +{ + php_libvirt_domain *domain = NULL; + zval *zdomain; + int retval; + zend_long flags = 0; + + GET_DOMAIN_FROM_ARGS("r|l", &zdomain, &flags); + + retval = virDomainReset(domain->domain, flags); + DPRINTF("%s: virDomainReset(%p) returned %d\n", PHPFUNC, domain->domain, retval); + if (retval != 0) + RETURN_FALSE; + RETURN_TRUE; +} + /* * Function name: libvirt_domain_define_xml * Since version: 0.4.1(-1) diff --git a/src/libvirt-domain.h b/src/libvirt-domain.h index f15237f..8b80c9c 100644 --- a/src/libvirt-domain.h +++ b/src/libvirt-domain.h @@ -74,6 +74,7 @@ PHP_FE(libvirt_domain_managedsave, arginfo_libvirt_conn) \ PHP_FE(libvirt_domain_undefine, arginfo_libvirt_conn) \ PHP_FE(libvirt_domain_reboot, arginfo_libvirt_conn_flags) \ + PHP_FE(libvirt_domain_reset, arginfo_libvirt_conn_flags) \ PHP_FE(libvirt_domain_define_xml, arginfo_libvirt_conn_xml) \ PHP_FE(libvirt_domain_create_xml, arginfo_libvirt_conn_xml) \ PHP_FE(libvirt_domain_xml_from_native, arginfo_libvirt_domain_xml_from_native) \ @@ -165,6 +166,7 @@ PHP_FUNCTION(libvirt_domain_suspend); PHP_FUNCTION(libvirt_domain_managedsave); PHP_FUNCTION(libvirt_domain_undefine); PHP_FUNCTION(libvirt_domain_reboot); +PHP_FUNCTION(libvirt_domain_reset); PHP_FUNCTION(libvirt_domain_define_xml); PHP_FUNCTION(libvirt_domain_create_xml); PHP_FUNCTION(libvirt_domain_xml_from_native); -- 2.24.0

3 2

[PATCH v2 0/6] ui: rework -show-cursor option
by Gerd Hoffmann 07 Feb '20

07 Feb '20

Gerd Hoffmann (6): ui: add show-cursor option ui/gtk: implement show-cursor option ui/sdl: implement show-cursor option ui/cocoa: implement show-cursor option ui: wire up legacy -show-cursor option ui: deprecate legacy -show-cursor option include/sysemu/sysemu.h | 1 - ui/gtk.c | 8 +++++++- ui/sdl2.c | 28 ++++++++++++++++++++-------- vl.c | 6 ++++-- qapi/ui.json | 3 +++ qemu-deprecated.texi | 5 +++++ ui/cocoa.m | 4 ++++ 7 files changed, 43 insertions(+), 12 deletions(-) -- 2.18.1

4 11

[PATCH 00/15] qemu: Handle 'size' and 'offset' attributes of 'raw' format
by Peter Krempa 06 Feb '20

06 Feb '20

This series fixes and improves the 'json:' pseudo-protocol parser and implements the 'offset' and 'size' attributes and exposes them as <slice> in the XML. https://bugzilla.redhat.com/show_bug.cgi?id=1791788 Peter Krempa (15): virStorageSourceParseBackingJSON: Pass around original backing file string virStorageSourceParseBackingJSON: Move deflattening of json: URIs out of recursion virStorageSourceJSONDriverParser: annotate 'format' drivers virStorageSourceParseBackingJSON: Allow 'json:' pseudo URIs without 'file' wrapper virStorageSourceParseBackingJSON: Prevent arbitrary nesting with format drivers tests: virstorage: Add test cases for "json:" pseudo-URI without 'file' wrapper tests: virstorage: Add test data for json specified raw image with offset/size util: virstoragefile: Add data structure for storing storage source slices qemuBlockStorageSourceGetFormatRawProps: format 'offset' and 'size' for slice qemuDomainValidateStorageSource: Reject unsupported slices docs: formatdomain: Close <source> on one of disk examples docs: Document the new <slices> sub-element of disk's <source> conf: Implement support for <slices> of disk source tests: qemu: Add test data for the new <slice> element virStorageSourceParseBackingJSONRaw: Parse 'offset' and 'size' attributes docs/formatdomain.html.in | 12 ++ docs/schemas/domaincommon.rng | 33 ++++ src/conf/domain_conf.c | 92 +++++++++++ src/qemu/qemu_block.c | 12 +- src/qemu/qemu_domain.c | 15 ++ src/util/virstoragefile.c | 156 +++++++++++++----- src/util/virstoragefile.h | 12 ++ .../disk-slices.x86_64-latest.args | 50 ++++++ tests/qemuxml2argvdata/disk-slices.xml | 45 +++++ tests/qemuxml2argvtest.c | 2 + .../disk-slices.x86_64-latest.xml | 56 +++++++ tests/qemuxml2xmltest.c | 2 + tests/virstoragetest.c | 23 +++ 13 files changed, 462 insertions(+), 48 deletions(-) create mode 100644 tests/qemuxml2argvdata/disk-slices.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-slices.xml create mode 100644 tests/qemuxml2xmloutdata/disk-slices.x86_64-latest.xml -- 2.24.1

3 35

[PULL 07/46] qemu-deprecated: Remove text about Python 2
by Philippe Mathieu-Daudé 06 Feb '20

06 Feb '20

From: Thomas Huth <thuth(a)redhat.com> Python 2 support has been removed, so we should now also remove the announcement text for the deprecation. Signed-off-by: Thomas Huth <thuth(a)redhat.com> Reviewed by: Aleksandar Markovic <amarkovic(a)wavecomp.com> Reviewed-by: John Snow <jsnow(a)redhat.com> Message-Id: <20200109095116.18201-1-thuth(a)redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd(a)redhat.com> --- qemu-deprecated.texi | 8 -------- 1 file changed, 8 deletions(-) diff --git a/qemu-deprecated.texi b/qemu-deprecated.texi index ea3e10bde3..97668edf92 100644 --- a/qemu-deprecated.texi +++ b/qemu-deprecated.texi @@ -351,14 +351,6 @@ they have no effect when used with @option{-n} to skip image creation. Silently ignored options can be confusing, so this combination of options will be made an error in future versions. -@section Build system - -@subsection Python 2 support (since 4.1.0) - -In the future, QEMU will require Python 3 to be available at -build time. Support for Python 2 in scripts shipped with QEMU -is deprecated. - @section Backwards compatibility @subsection Runnability guarantee of CPU models (since 4.1.0) -- 2.21.1

1 0

[PATCH 0/4] qemu: Fix handling of 'copy-on-read' on hotplug with blockdev
by Peter Krempa 06 Feb '20

06 Feb '20

See patch 4. Peter Krempa (4): qemuMonitorJSONBlockdevAdd: Refactor cleanup qemuMonitorJSONBlockdevDel: Refactor cleanup qemuMonitorBlockdevAdd: Take double pointer argument qemu: hotplug: Fix handling of the 'copy-on-read' layer with blockdev src/qemu/qemu_block.c | 14 ++------------ src/qemu/qemu_hotplug.c | 25 +++++++++++++++--------- src/qemu/qemu_monitor.c | 16 ++++++---------- src/qemu/qemu_monitor.h | 2 +- src/qemu/qemu_monitor_json.c | 37 +++++++++++++----------------------- src/qemu/qemu_monitor_json.h | 2 +- 6 files changed, 39 insertions(+), 57 deletions(-) -- 2.24.1

3 6

[PATCH] qemuBlockStorageSourceGetBackendProps: Report errors on all switch cases
by Peter Krempa 06 Feb '20

06 Feb '20

Few switch cases returned failure but didn't report an error. For a situation when the backingStore type='volume' was not translated the following error would occur: $ virsh start VM error: Failed to start domain VM error: An error occurred, but the cause is unknown After this patch: $ virsh start VM error: Failed to start domain VM error: internal error: storage source pool 'tmp' volume 'pull3.qcow2' is not translated Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_block.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/qemu/qemu_block.c b/src/qemu/qemu_block.c index 63116ef5f2..0ee10dd770 100644 --- a/src/qemu/qemu_block.c +++ b/src/qemu/qemu_block.c @@ -1081,8 +1081,14 @@ qemuBlockStorageSourceGetBackendProps(virStorageSourcePtr src, break; case VIR_STORAGE_TYPE_VOLUME: + virReportError(VIR_ERR_INTERNAL_ERROR, + _("storage source pool '%s' volume '%s' is not translated"), + src->srcpool->pool, src->srcpool->volume); + return NULL; + case VIR_STORAGE_TYPE_NONE: case VIR_STORAGE_TYPE_LAST: + virReportEnumRangeError(virStorageType, actualType); return NULL; case VIR_STORAGE_TYPE_NETWORK: @@ -1141,6 +1147,7 @@ qemuBlockStorageSourceGetBackendProps(virStorageSourcePtr src, case VIR_STORAGE_NET_PROTOCOL_NONE: case VIR_STORAGE_NET_PROTOCOL_LAST: + virReportEnumRangeError(virStorageNetProtocol, src->protocol); return NULL; } break; -- 2.24.1

3 2

[PATCH] docs: render <span class="literal"> with monospace font
by Daniel P. Berrangé 06 Feb '20

06 Feb '20

When using ``....`` in RST, this results in <span class="literal">...</span> instead of <code>...</code>. We thus need an extra rule to render it with a monospace font. Colouring a light gray also helps the text stand out a little more and matches background of <pre> blocks. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- docs/libvirt.css | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/libvirt.css b/docs/libvirt.css index d2e1842b62..50cf02e348 100644 --- a/docs/libvirt.css +++ b/docs/libvirt.css @@ -574,3 +574,8 @@ ul.news-section-content li dl dd { margin-top: 0.5em; margin-bottom: 0.5em; } + +span.literal, code { + font-family: monospace; + background: #eeeeee; +} -- 2.24.1

2 2