- Devel - libvirt List Archives

[libvirt] [PATCH] libxl: fix typo in debug message
by Guido Günther 16 Mar '17

16 Mar '17

--- src/libxl/libxl_migration.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libxl/libxl_migration.c b/src/libxl/libxl_migration.c index fb833d1a3..6b5b981f1 100644 --- a/src/libxl/libxl_migration.c +++ b/src/libxl/libxl_migration.c @@ -325,7 +325,7 @@ libxlMigrateReceive(virNetSocketPtr sock, goto fail; } VIR_DEBUG("Accepted migration connection." - " Spawing thread to process migration data"); + " Spawning thread to process migration data"); recvfd = virNetSocketDupFD(client_sock, true); virObjectUnref(client_sock); -- 2.11.0

2 2

[libvirt] [PATCH 0/2] Adaptive timeout for connecting to qemu monitor
by Michal Privoznik 16 Mar '17

16 Mar '17

I am not able to test this properly (my host has "just" 32GiB of RAM), but I've patched qemu to insert some delay into its init process and it worked just fine. Michal Privoznik (2): virTimeBackOffWait: Avoid long periods of sleep qemu: Adaptive timeout for connecting to monitor src/qemu/qemu_capabilities.c | 2 +- src/qemu/qemu_monitor.c | 36 +++++++++++++++++++++++++++++++----- src/qemu/qemu_monitor.h | 1 + src/qemu/qemu_process.c | 8 ++++++++ src/util/virtime.c | 14 ++++++++++++-- tests/qemumonitortestutils.c | 1 + 6 files changed, 54 insertions(+), 8 deletions(-) -- 2.11.0

4 13

[libvirt] [PATCH] Short circuit SASL auth when no mechanisms are available
by Daniel P. Berrange 16 Mar '17

16 Mar '17

If the SASL config does not have any mechanisms we currently just report an empty list to the client which will then fail to identify a usable mechanism. This is a server config error, so we should fail immediately on the server side. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/rpc/virnetsaslcontext.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/rpc/virnetsaslcontext.c b/src/rpc/virnetsaslcontext.c index 37a5da2..c4492ec 100644 --- a/src/rpc/virnetsaslcontext.c +++ b/src/rpc/virnetsaslcontext.c @@ -390,6 +390,12 @@ char *virNetSASLSessionListMechanisms(virNetSASLSessionPtr sasl) err, sasl_errdetail(sasl->conn)); goto cleanup; } + VIR_DEBUG("SASL mechanism list is '%s'", mechlist); + if (STREQ(mechlist, "")) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("no SASL mechanisms are available")); + goto cleanup; + } ignore_value(VIR_STRDUP(ret, mechlist)); cleanup: -- 2.9.3

2 1

[libvirt] [PATCH] Sanity check explicit TLS file paths
by Daniel P. Berrange 16 Mar '17

16 Mar '17

When providing explicit x509 cert/key paths in libvirtd.conf, the user must provide all three. If one or more is missed, this leads to obscure errors at runtime when negotiating the TLS session Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- daemon/libvirtd.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index 9b98f33..40aa2b6 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -544,6 +544,22 @@ daemonSetupNetworking(virNetServerPtr srv, if (config->ca_file || config->cert_file || config->key_file) { + if (!config->ca_file) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + "No CA certificate path set to match server key/cert"); + goto cleanup; + } + if (!config->cert_file) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + "No server certificate path set to match server key"); + goto cleanup; + } + if (!config->key_file) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + "No server key path set to match server cert"); + goto cleanup; + } + VIR_DEBUG("Using CA='%s' cert='%s' key='%s'", config->ca_file, config->cert_file, config->key_file); if (!(ctxt = virNetTLSContextNewServer(config->ca_file, config->crl_file, config->cert_file, -- 2.9.3

2 1

[libvirt] [PATCH 0/2] Fix nodedev error message and test driver logic
by John Ferlan 15 Mar '17

15 Mar '17

The first patch is related to review comments from my Converge Storage Pool vHBA logic Patch1 w/r/t a weak error message The second patch is pulled from Patch17 of that series and is just an adjustment in the storage pool create xml logic Neither of these require news.xml updates... John Ferlan (2): conf: Alter error message for vHBA creation using parent wwnn/wwpn test: Don't assume a configFile exists for Storage Pool tests src/conf/node_device_conf.c | 17 +++++++++++++---- src/test/test_driver.c | 6 ++++++ 2 files changed, 19 insertions(+), 4 deletions(-) -- 2.9.3

2 4

[libvirt] [PATCH v3 00/18] Converge Storage Pool vHBA logic with Node Device
by John Ferlan 15 Mar '17

15 Mar '17

v2: http://www.redhat.com/archives/libvir-list/2017-March/msg00161.html Changes since v2: - Pushed the former patch1 after a slight adjustment replace a spurrious lost line - [NEW] Patch 1 - Fixes an existing bug - details in patch - [UPD] Patch 2 - Split out what Jano noted about new checks into it's own - [UPD] Patch 3->14 - Rework the former patch2 to split out the step by step details it took to get to patch2. - [No Change] Patch 15-18 -> Patch15->16 ACKed in v1, but I just left these in the order I had -> Patch17->18 Unchanged - same comment as v2 (copied so as to not force someone would go back to v2): Even though there is concern over usage of API's in this manner (e.g. calling virNodeDeviceLookupSCSIHostByWWN as well as virNodeDeviceCreateXML) - the "purpose" of the exercise is a means to have the StoragePool code use the same algorithms as the node device code instead of what could be a potentially long slow journey through the sysfs file system. The key piece being the replication of the API's that find the parent in the node device object list. I suppose it would be possible to add even more API's to get that answer, but I'm not sure it'd be worthwhile at this point. As for the concern about deadlock - I understand it, but since the whole purpose of the API is to essentially utilize the nodedev create algorithm there'd be no reason for nodedev to call it. If it doesn't get ACK'd - that's OK - I can hold onto it and reconsider some other means at some point in time in the future (probably distant future too). John Ferlan (18): conf: Ensure both parent_wwnn/parent_wwpn provided conf: Add missing validate for fchost search fields conf: Split out storage pool source adapter helpers conf: Rework parsing in virStoragePoolDefParseSourceAdapter conf: Introduce storage_adapter_conf conf: Rename API's in storage_adapter_conf conf: Extract FCHost adapter type processing into their own helpers conf: Extract SCSI adapter type processing into their own helpers conf: Split up virStoragePoolSourceAdapter conf: Rework storage_adapter_conf to use adapter specific typedefs conf: Rework storage_conf to use adapter specific typedefs storage: Rework getAdapterName to use adapter specific typedefs storage: Rework createVport and deleteVport conf: Convert virStoragePoolSourceAdapter to virStorageAdapter util: Rename virFileWaitForDevices conf: Move/rename createVport and deleteVport util: Alter virNodeDevice{Create|Delete}Vport to use nodedev APIs tests: Add more storage pool vHBA tests po/POTFILES.in | 1 + src/Makefile.am | 1 + src/conf/node_device_conf.c | 332 ++++++++++++++++++++++++++++++++ src/conf/node_device_conf.h | 9 + src/conf/storage_adapter_conf.c | 330 ++++++++++++++++++++++++++++++++ src/conf/storage_adapter_conf.h | 84 ++++++++ src/conf/storage_conf.c | 348 ++++++++-------------------------- src/conf/storage_conf.h | 36 +--- src/libvirt_private.syms | 13 +- src/node_device/node_device_driver.c | 2 +- src/phyp/phyp_driver.c | 3 +- src/storage/storage_backend_disk.c | 6 +- src/storage/storage_backend_iscsi.c | 2 +- src/storage/storage_backend_logical.c | 4 +- src/storage/storage_backend_mpath.c | 2 +- src/storage/storage_backend_scsi.c | 267 +++++--------------------- src/storage/storage_util.c | 2 +- src/test/test_driver.c | 11 +- src/util/virfile.h | 2 - src/util/virutil.c | 4 +- src/util/virutil.h | 2 + tests/fchosttest.c | 47 +++++ 22 files changed, 968 insertions(+), 540 deletions(-) create mode 100644 src/conf/storage_adapter_conf.c create mode 100644 src/conf/storage_adapter_conf.h -- 2.9.3

3 61

[libvirt] [PATCH v3 00/17] Introduce NVDIMM support
by Michal Privoznik 15 Mar '17

15 Mar '17

NVDIMMs are new type of ultra fast storage that's plugged into DIMM slot and can hold the stored info throughout reboots. After all, NV stands for non-volatile. In virtualization world, this has an awesome advantage - less VM_EXITs on 'disk' IO. https://nvdimm.wiki.kernel.org/ How to test this feature? $ > /tmp/nvdimm $ truncate --size 512M /tmp/nvdimm $ virsh edit $mydom <memory model='nvdimm' access='shared'> <source> <path>/tmp/nvdimm</path> </source> <target> <size unit='MiB'>512</size> <node>0</node> <label> <size unit='KiB'>128</size> </label> </target> <address type='dimm' slot='0'/> </memory> $ virsh start $mydom $ ssh $mydom "echo \"Hello world\" > /dev/pmem0" $ hexdump -C /tmp/nvdimm 00000000 48 65 6c 6c 6f 20 77 6f 72 6c 64 0a 00 00 00 00 |Hello world.....| 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 20000000 diff to v2: - John's review points worked in - Couple of more patches to clean up qemuBuildMemoryBackendStr Michal Privoznik (17): qemuBuildMemoryBackendStr: Don't overwrite @force qemuBuildMemoryBackendStr: Check for @memAccess properly qemuBuildMemoryBackendStr: Pass virDomainMemoryDefPtr qemuBuildMemoryBackendStr: Reorder args and update comment Introduce NVDIMM memory model qemu: Introduce QEMU_CAPS_DEVICE_NVDIMM qemu: Implement NVDIMM conf: Introduce @access to <memory/> qemu: Implement @access for <memory/> banks qemu: Introduce label-size for NVDIMMs security_dac: Label host side of NVDIMM security_selinux: Label host side of NVDIMM security: Introduce internal APIs for memdev labelling secdrivers: Implement memdev relabel APIs qemu_hotplug: Relabel memdev qemu: Allow nvdimm in devices CGroups qemu: Namespaces for NVDIMM docs/formatdomain.html.in | 83 ++++++++-- docs/schemas/domaincommon.rng | 47 ++++-- src/conf/domain_conf.c | 146 +++++++++++++---- src/conf/domain_conf.h | 5 + src/libvirt_private.syms | 2 + src/qemu/qemu_alias.c | 10 +- src/qemu/qemu_capabilities.c | 9 ++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_cgroup.c | 49 ++++++ src/qemu/qemu_cgroup.h | 4 + src/qemu/qemu_command.c | 172 +++++++++++++-------- src/qemu/qemu_command.h | 15 +- src/qemu/qemu_domain.c | 113 +++++++++++++- src/qemu/qemu_domain.h | 8 + src/qemu/qemu_hotplug.c | 40 ++++- src/qemu/qemu_security.c | 56 +++++++ src/qemu/qemu_security.h | 8 + src/security/security_dac.c | 76 +++++++++ src/security/security_driver.h | 9 ++ src/security/security_manager.c | 56 +++++++ src/security/security_manager.h | 7 + src/security/security_nop.c | 19 +++ src/security/security_selinux.c | 69 +++++++++ src/security/security_stack.c | 38 +++++ .../qemuxml2argv-memory-hotplug-nvdimm-access.args | 26 ++++ .../qemuxml2argv-memory-hotplug-nvdimm-access.xml | 56 +++++++ .../qemuxml2argv-memory-hotplug-nvdimm-label.args | 26 ++++ .../qemuxml2argv-memory-hotplug-nvdimm-label.xml | 59 +++++++ .../qemuxml2argv-memory-hotplug-nvdimm.args | 26 ++++ .../qemuxml2argv-memory-hotplug-nvdimm.xml | 56 +++++++ tests/qemuxml2argvtest.c | 8 +- ...qemuxml2xmlout-memory-hotplug-nvdimm-access.xml | 1 + .../qemuxml2xmlout-memory-hotplug-nvdimm-label.xml | 1 + .../qemuxml2xmlout-memory-hotplug-nvdimm.xml | 1 + tests/qemuxml2xmltest.c | 3 + 35 files changed, 1164 insertions(+), 141 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-memory-hotplug-nvdimm-access.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-memory-hotplug-nvdimm-access.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-memory-hotplug-nvdimm-label.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-memory-hotplug-nvdimm-label.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-memory-hotplug-nvdimm.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-memory-hotplug-nvdimm.xml create mode 120000 tests/qemuxml2xmloutdata/qemuxml2xmlout-memory-hotplug-nvdimm-access.xml create mode 120000 tests/qemuxml2xmloutdata/qemuxml2xmlout-memory-hotplug-nvdimm-label.xml create mode 120000 tests/qemuxml2xmloutdata/qemuxml2xmlout-memory-hotplug-nvdimm.xml -- 2.11.0

2 36

[libvirt] libvirt and dmesg
by Michel Pierre-Jacques 15 Mar '17

15 Mar '17

Hi all, il try to find the way to obtain the same use as in the lxc config file lxc.kmsg=0 how to do that, with the xml of a lxc domain, i make lot of try without success . is there another way to deny access to the dmesg for a libvirt lxc domain ? --- Kogitae AE Infogérance Linux / Administrateur Système le Domaine Picard 21-23 rue de la cornée 70800 Anjeux -------------------------- Tel : +33 (0)3 68 33 53 64 IRC : http://kogitae.fr/irc ------------------------------------ 9h-12h & 14h-18h / Lundi au Vendredi Sur RDV en dehors

2 2

[libvirt] 1GB huge pages and incompatible VM memory size
by Jim Fehlig 14 Mar '17

14 Mar '17

Hi All, Matt encountered the following issue when using 1GB huge pages with libvirt > This problem turned out to be entirely my fault because I didn't round > the VM's memory size to a 1G multiple, and the kernel tried to split > the VMA at the end of the region, triggering this code in the kernel > do_mbind() path, > > static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma, > unsigned long addr, int new_below) > { > struct vm_area_struct *new; > int err; > > if (is_vm_hugetlb_page(vma) && (addr & > ~(huge_page_mask(hstate_vma(vma))))) > return -EINVAL; > > I have no idea how a less fortunate developer without access to MM > experts would have figured this out. It's a shame virsh didn't error > out when I initially setup 1G hugepages with an incompatible VM memory > size. What do folks think about improving libvirt to warn or error when using a VM memory size that is not compatible with the host hugepage configuration? Regards, Jim

3 4

[libvirt] [PATCH] bhyve: add config file support
by Roman Bogorodskiy 14 Mar '17

14 Mar '17

Introduce config file support for the bhyve driver. The only available setting at present is 'firmware_dir' for specifying a directory with UEFI firmware files. --- src/Makefile.am | 25 +++++++- src/bhyve/bhyve.conf | 7 +++ src/bhyve/bhyve_capabilities.c | 9 ++- src/bhyve/bhyve_capabilities.h | 5 +- src/bhyve/bhyve_conf.c | 112 +++++++++++++++++++++++++++++++++++ src/bhyve/bhyve_conf.h | 32 ++++++++++ src/bhyve/bhyve_driver.c | 11 +++- src/bhyve/bhyve_utils.h | 12 ++++ src/bhyve/libvirtd_bhyve.aug | 39 ++++++++++++ src/bhyve/test_libvirtd_bhyve.aug.in | 5 ++ 10 files changed, 252 insertions(+), 5 deletions(-) create mode 100644 src/bhyve/bhyve.conf create mode 100644 src/bhyve/bhyve_conf.c create mode 100644 src/bhyve/bhyve_conf.h create mode 100644 src/bhyve/libvirtd_bhyve.aug create mode 100644 src/bhyve/test_libvirtd_bhyve.aug.in diff --git a/src/Makefile.am b/src/Makefile.am index 02579659a..f0d8efe50 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -930,6 +930,8 @@ BHYVE_DRIVER_SOURCES = \ bhyve/bhyve_capabilities.h \ bhyve/bhyve_command.c \ bhyve/bhyve_command.h \ + bhyve/bhyve_conf.c \ + bhyve/bhyve_conf.h \ bhyve/bhyve_parse_command.c \ bhyve/bhyve_parse_command.h \ bhyve/bhyve_device.c \ @@ -1575,7 +1577,14 @@ libvirt_driver_bhyve_impl_la_CFLAGS = \ $(AM_CFLAGS) libvirt_driver_bhyve_impl_la_LDFLAGS = $(AM_LDFLAGS) libvirt_driver_bhyve_impl_la_SOURCES = $(BHYVE_DRIVER_SOURCES) + +conf_DATA += bhyve/bhyve.conf +augeas_DATA += bhyve/libvirtd_bhyve.aug +augeastest_DATA += test_libvirtd_bhyve.aug endif WITH_BHYVE +EXTRA_DIST += bhyve/bhyve.conf \ + bhyve/libvirtd_bhyve.aug \ + bhyve/test_libvirtd_bhyve.aug.in if WITH_NETWORK noinst_LTLIBRARIES += libvirt_driver_network_impl.la @@ -2125,11 +2134,12 @@ check-local: check-augeas check-augeas-sanlock \ check-augeas-lockd \ check-augeas-libxl \ + check-augeas-bhyve \ $(NULL) check-augeas: check-augeas-qemu check-augeas-lxc check-augeas-sanlock \ check-augeas-lockd check-augeas-virtlockd check-augeas-libxl \ - check-augeas-virtlogd + check-augeas-bhyve check-augeas-virtlogd AUG_GENTEST = $(PERL) $(top_srcdir)/build-aux/augeas-gentest.pl EXTRA_DIST += $(top_srcdir)/build-aux/augeas-gentest.pl @@ -2212,6 +2222,19 @@ else ! WITH_LIBXL check-augeas-libxl: endif ! WITH_LIBXL +if WITH_BHYVE +test_libvirtd_bhyve.aug: bhyve/test_libvirtd_bhyve.aug.in \ + $(srcdir)/bhyve/bhyve.conf $(AUG_GENTEST) + $(AM_V_GEN)$(AUG_GENTEST) $(srcdir)/bhyve/bhyve.conf $< $@ + +check-augeas-bhyve: test_libvirtd_bhyve.aug + $(AM_V_GEN)if test -x '$(AUGPARSE)'; then \ + '$(AUGPARSE)' -I $(srcdir)/bhyve test_libvirtd_bhyve.aug; \ + fi +else ! WITH_BHYVE +check-augeas-bhyve: +endif ! WITH_BHYVE + test_virtlogd.aug: logging/test_virtlogd.aug.in \ logging/virtlogd.conf $(AUG_GENTEST) $(AM_V_GEN)$(AUG_GENTEST) $(srcdir)/logging/virtlogd.conf $< $@ diff --git a/src/bhyve/bhyve.conf b/src/bhyve/bhyve.conf new file mode 100644 index 000000000..2a8baacff --- /dev/null +++ b/src/bhyve/bhyve.conf @@ -0,0 +1,7 @@ +# Master configuration file for the bhyve driver. +# All settings described here are optional - if omitted, sensible +# defaults are used. + +# Path to a directory with firmware files. By default it's pointing +# to the directory that sysutils/bhyve-firmware installs files into. +#firmware_dir = "/usr/local/share/uefi-firmware" diff --git a/src/bhyve/bhyve_capabilities.c b/src/bhyve/bhyve_capabilities.c index 5e6094e3c..da06ba711 100644 --- a/src/bhyve/bhyve_capabilities.c +++ b/src/bhyve/bhyve_capabilities.c @@ -111,7 +111,8 @@ virBhyveCapsBuild(void) } virDomainCapsPtr -virBhyveDomainCapsBuild(const char *emulatorbin, +virBhyveDomainCapsBuild(bhyveConnPtr conn, + const char *emulatorbin, const char *machine, virArch arch, virDomainVirtType virttype) @@ -120,8 +121,9 @@ virBhyveDomainCapsBuild(const char *emulatorbin, unsigned int bhyve_caps = 0; DIR *dir; struct dirent *entry; - const char *firmware_dir = "/usr/local/share/uefi-firmware"; size_t firmwares_alloc = 0; + virBhyveDriverConfigPtr cfg = virBhyveDriverGetConfig(conn); + const char *firmware_dir = cfg->firmwareDir; if (!(caps = virDomainCapsNew(emulatorbin, machine, arch, virttype))) goto cleanup; @@ -152,7 +154,10 @@ virBhyveDomainCapsBuild(const char *emulatorbin, caps->os.loader.values.nvalues++; } + } else { + VIR_WARN("Cannot open firmware directory %s", firmware_dir); } + caps->disk.supported = true; VIR_DOMAIN_CAPS_ENUM_SET(caps->disk.diskDevice, VIR_DOMAIN_DISK_DEVICE_DISK, diff --git a/src/bhyve/bhyve_capabilities.h b/src/bhyve/bhyve_capabilities.h index 8fb97d730..3d8edb490 100644 --- a/src/bhyve/bhyve_capabilities.h +++ b/src/bhyve/bhyve_capabilities.h @@ -25,8 +25,11 @@ # include "capabilities.h" # include "conf/domain_capabilities.h" +# include "bhyve_conf.h" + virCapsPtr virBhyveCapsBuild(void); -virDomainCapsPtr virBhyveDomainCapsBuild(const char *emulatorbin, +virDomainCapsPtr virBhyveDomainCapsBuild(bhyveConnPtr, + const char *emulatorbin, const char *machine, virArch arch, virDomainVirtType virttype); diff --git a/src/bhyve/bhyve_conf.c b/src/bhyve/bhyve_conf.c new file mode 100644 index 000000000..b0b40c575 --- /dev/null +++ b/src/bhyve/bhyve_conf.c @@ -0,0 +1,112 @@ +/* + * bhyve_conf.c: bhyve config file + * + * Copyright (C) 2017 Roman Bogorodskiy + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + * + */ + +#include <config.h> + +#include "viralloc.h" +#include "virlog.h" +#include "virstring.h" +#include "bhyve_conf.h" +#include "configmake.h" + +#define VIR_FROM_THIS VIR_FROM_BHYVE + +VIR_LOG_INIT("bhyve.bhyve_conf"); + +static virClassPtr virBhyveDriverConfigClass; +static void virBhyveDriverConfigDispose(void *obj); + +static int virBhyveConfigOnceInit(void) +{ + if (!(virBhyveDriverConfigClass = virClassNew(virClassForObject(), + "virBhyveDriverConfig", + sizeof(virBhyveDriverConfig), + virBhyveDriverConfigDispose))) + return -1; + + return 0; +} + +VIR_ONCE_GLOBAL_INIT(virBhyveConfig) + +virBhyveDriverConfigPtr +virBhyveDriverConfigNew(void) +{ + virBhyveDriverConfigPtr cfg; + + if (virBhyveConfigInitialize() < 0) + return NULL; + + if (!(cfg = virObjectNew(virBhyveDriverConfigClass))) + return NULL; + + if (VIR_STRDUP(cfg->firmwareDir, DATADIR "/uefi-firmware") < 0) + goto error; + + return cfg; + + error: + virObjectUnref(cfg); + return NULL; +} + +int +virBhyveLoadDriverConfig(virBhyveDriverConfigPtr cfg, + const char *filename) +{ + virConfPtr conf; + int ret = -1; + + if (access(filename, R_OK) == -1) { + VIR_INFO("Could not read bhyve config file %s", filename); + return 0; + } + + if (!(conf = virConfReadFile(filename, 0))) + return -1; + + if (virConfGetValueString(conf, "firmware_dir", + &cfg->firmwareDir) < 0) + goto cleanup; + + ret = 0; + cleanup: + virConfFree(conf); + return ret; +} + +virBhyveDriverConfigPtr +virBhyveDriverGetConfig(bhyveConnPtr driver) +{ + virBhyveDriverConfigPtr cfg; + bhyveDriverLock(driver); + cfg = virObjectRef(driver->config); + bhyveDriverUnlock(driver); + return cfg; +} + +static void +virBhyveDriverConfigDispose(void *obj) +{ + virBhyveDriverConfigPtr cfg = obj; + + VIR_FREE(cfg->firmwareDir); +} diff --git a/src/bhyve/bhyve_conf.h b/src/bhyve/bhyve_conf.h new file mode 100644 index 000000000..3f105ace1 --- /dev/null +++ b/src/bhyve/bhyve_conf.h @@ -0,0 +1,32 @@ +/* + * bhyve_conf.h: bhyve config file + * + * Copyright (C) 2017 Roman Bogorodskiy + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + * + */ + +#ifndef BHYVE_CONF_H +# define BHYVE_CONF_H + +# include "bhyve_utils.h" + +virBhyveDriverConfigPtr virBhyveDriverConfigNew(void); +virBhyveDriverConfigPtr virBhyveDriverGetConfig(bhyveConnPtr driver); +int virBhyveLoadDriverConfig(virBhyveDriverConfigPtr cfg, + const char *filename); + +#endif /* BHYVE_CONF_H */ diff --git a/src/bhyve/bhyve_driver.c b/src/bhyve/bhyve_driver.c index 759825c28..3258c2720 100644 --- a/src/bhyve/bhyve_driver.c +++ b/src/bhyve/bhyve_driver.c @@ -55,6 +55,7 @@ #include "virhostmem.h" #include "conf/domain_capabilities.h" +#include "bhyve_conf.h" #include "bhyve_device.h" #include "bhyve_driver.h" #include "bhyve_command.h" @@ -1228,6 +1229,7 @@ bhyveStateCleanup(void) virSysinfoDefFree(bhyve_driver->hostsysinfo); virObjectUnref(bhyve_driver->closeCallbacks); virObjectUnref(bhyve_driver->domainEventState); + virObjectUnref(bhyve_driver->config); virMutexDestroy(&bhyve_driver->lock); VIR_FREE(bhyve_driver); @@ -1276,6 +1278,12 @@ bhyveStateInitialize(bool privileged, bhyve_driver->hostsysinfo = virSysinfoRead(); + if (!(bhyve_driver->config = virBhyveDriverConfigNew())) + goto cleanup; + + if (virBhyveLoadDriverConfig(bhyve_driver->config, SYSCONFDIR "/libvirt/bhyve.conf") < 0) + goto cleanup; + if (virFileMakePath(BHYVE_LOG_DIR) < 0) { virReportSystemError(errno, _("Failed to mkdir %s"), @@ -1657,7 +1665,8 @@ bhyveConnectGetDomainCapabilities(virConnectPtr conn, goto cleanup; } - if (!(caps = virBhyveDomainCapsBuild(emulatorbin, machine, arch, virttype))) + if (!(caps = virBhyveDomainCapsBuild(conn->privateData, emulatorbin, + machine, arch, virttype))) goto cleanup; ret = virDomainCapsFormat(caps); diff --git a/src/bhyve/bhyve_utils.h b/src/bhyve/bhyve_utils.h index 9a911608c..db50e012a 100644 --- a/src/bhyve/bhyve_utils.h +++ b/src/bhyve/bhyve_utils.h @@ -34,8 +34,20 @@ # define BHYVE_STATE_DIR LOCALSTATEDIR "/run/libvirt/bhyve" # define BHYVE_LOG_DIR LOCALSTATEDIR "/log/libvirt/bhyve" +typedef struct _virBhyveDriverConfig virBhyveDriverConfig; +typedef struct _virBhyveDriverConfig *virBhyveDriverConfigPtr; + +struct _virBhyveDriverConfig { + virObject parent; + + char *firmwareDir; +}; + struct _bhyveConn { virMutex lock; + + virBhyveDriverConfigPtr config; + virDomainObjListPtr domains; virCapsPtr caps; virDomainXMLOptionPtr xmlopt; diff --git a/src/bhyve/libvirtd_bhyve.aug b/src/bhyve/libvirtd_bhyve.aug new file mode 100644 index 000000000..66079376c --- /dev/null +++ b/src/bhyve/libvirtd_bhyve.aug @@ -0,0 +1,39 @@ +(* /etc/libvirt/bhyve.conf *) + +module Libvirtd_bhyve = + autoload xfm + + let eol = del /[ \t]*\n/ "\n" + let value_sep = del /[ \t]*=[ \t]*/ " = " + let indent = del /[ \t]*/ "" + + let array_sep = del /,[ \t\n]*/ ", " + let array_start = del /\[[ \t\n]*/ "[ " + let array_end = del /\]/ "]" + + let str_val = del /\"/ "\"" . store /[^\"]*/ . del /\"/ "\"" + let bool_val = store /0|1/ + let int_val = store /[0-9]+/ + let str_array_element = [ seq "el" . str_val ] . del /[ \t\n]*/ "" + let str_array_val = counter "el" . array_start . ( str_array_element . ( array_sep . str_array_element ) * ) ? . array_end + + let str_entry (kw:string) = [ key kw . value_sep . str_val ] + let bool_entry (kw:string) = [ key kw . value_sep . bool_val ] + let int_entry (kw:string) = [ key kw . value_sep . int_val ] + let str_array_entry (kw:string) = [ key kw . value_sep . str_array_val ] + + let log_entry = str_entry "firmware_dir" + + (* Each enty in the config is one of the following three ... *) + let entry = log_entry + let comment = [ label "#comment" . del /#[ \t]*/ "# " . store /([^ \t\n][^\n]*)?/ . del /\n/ "\n" ] + let empty = [ label "#empty" . eol ] + + let record = indent . entry . eol + + let lns = ( record | comment | empty ) * + + let filter = incl "/etc/libvirt/bhyve.conf" + . Util.stdexcl + + let xfm = transform lns filter diff --git a/src/bhyve/test_libvirtd_bhyve.aug.in b/src/bhyve/test_libvirtd_bhyve.aug.in new file mode 100644 index 000000000..f28e58614 --- /dev/null +++ b/src/bhyve/test_libvirtd_bhyve.aug.in @@ -0,0 +1,5 @@ +module Test_libvirtd_bhyve = + ::CONFIG:: + + test Libvirtd_bhyve.lns get conf = +{ "firmware_dir" = "/usr/local/share/uefi-firmware" } -- 2.11.0

3 3

[libvirt] [PATCH] docs: moved 'timestamps' and 'encryption' sub-element description in formatstorage doc
by Alexander Vasilenko 14 Mar '17

14 Mar '17

--- docs/formatstorage.html.in | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/docs/formatstorage.html.in b/docs/formatstorage.html.in index c787a059d..225e19000 100644 --- a/docs/formatstorage.html.in +++ b/docs/formatstorage.html.in @@ -456,24 +456,6 @@ will be filled with the values used by the existing directory. <span class="since">Since 1.2.16</span> </dd> - <dt><code>timestamps</code></dt> - <dd>Provides timing information about the volume. Up to four - sub-elements are present, - where <code>atime</code>, <code>btime</code>, <code>ctime</code> - and <code>mtime</code> hold the access, birth, change and - modification time of the volume, where known. The used time - format is <seconds>.<nanoseconds> since the - beginning of the epoch (1 Jan 1970). If nanosecond resolution - is 0 or otherwise unsupported by the host OS or filesystem, - then the nanoseconds part is omitted. This is a readonly - attribute and is ignored when creating a volume. - <span class="since">Since 0.10.0</span> - </dd> - <dt><code>encryption</code></dt> - <dd>If present, specifies how the volume is encrypted. See - the <a href="formatstorageencryption.html">Storage Encryption</a> page - for more information. - </dd> </dl> <h3><a name="StoragePoolExtents">Device extents</a></h3> @@ -658,6 +640,24 @@ will be filled with the values used by the existing file. <span class="since">Since 0.4.1</span> </dd> + <dt><code>timestamps</code></dt> + <dd>Provides timing information about the volume. Up to four + sub-elements are present, + where <code>atime</code>, <code>btime</code>, <code>ctime</code> + and <code>mtime</code> hold the access, birth, change and + modification time of the volume, where known. The used time + format is <seconds>.<nanoseconds> since the + beginning of the epoch (1 Jan 1970). If nanosecond resolution + is 0 or otherwise unsupported by the host OS or filesystem, + then the nanoseconds part is omitted. This is a readonly + attribute and is ignored when creating a volume. + <span class="since">Since 0.10.0</span> + </dd> + <dt><code>encryption</code></dt> + <dd>If present, specifies how the volume is encrypted. See + the <a href="formatstorageencryption.html">Storage Encryption</a> page + for more information. + </dd> <dt><code>compat</code></dt> <dd>Specify compatibility level. So far, this is only used for <code>type='qcow2'</code> volumes. Valid values are <code>0.10</code> -- 2.12.0

2 1

[libvirt] [PATCH] virtperf: Revert PERF_COUNT_HW_REF_CPU_CYCLES conditional
by Olaf Hering 14 Mar '17

14 Mar '17

All PERF_* names are enmus. Enums are ordinary code for CPP. An ifdef does not trigger. Fixes 1d29c889a ("Make use of PERF_COUNT_HW_REF_CPU_CYCLES conditional") Signed-off-by: Olaf Hering <olaf(a)aepfle.de> --- src/util/virperf.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/src/util/virperf.c b/src/util/virperf.c index e39cebbe0..33039544a 100644 --- a/src/util/virperf.c +++ b/src/util/virperf.c @@ -108,13 +108,8 @@ static struct virPerfEventAttr attrs[] = { .attrType = PERF_TYPE_HARDWARE, .attrConfig = PERF_COUNT_HW_STALLED_CYCLES_BACKEND}, {.type = VIR_PERF_EVENT_REF_CPU_CYCLES, -# ifdef PERF_COUNT_HW_REF_CPU_CYCLES .attrType = PERF_TYPE_HARDWARE, .attrConfig = PERF_COUNT_HW_REF_CPU_CYCLES -# else - .attrType = 0, - .attrConfig = 0, -# endif }, {.type = VIR_PERF_EVENT_CPU_CLOCK, .attrType = PERF_TYPE_SOFTWARE,

2 3

[libvirt] [PATCH] [Changelog]:If there is a process with a client which registers event callbacks, and it calls libvirt's API which uses the same virConnectPtr in that callback function. When this process exit abnormally lead to client disconnect, there is a possibility that the libvirtd's main thread is use virServerClient to send event just after the virServerClient been freed by job thread. Following is backtrace:
by xinhua.Cao 13 Mar '17

13 Mar '17

#0 0x00007fda223d66d8 in virClassIsDerivedFrom (klass=0xdeadbeef, parent=0x7fda24c81b40) at util/virobject.c:169 #1 0x00007fda223d6a1e in virObjectIsClass (anyobj=anyobj@entry=0x7fd9e575b400, klass=<optimized out>) at util/virobject.c:365 #2 0x00007fda223d6a44 in virObjectLock (anyobj=0x7fd9e575b400) at util/virobject.c:317 #3 0x00007fda22507f71 in virNetServerClientSendMessage (client=client@entry=0x7fd9e575b400, msg=msg@entry=0x7fd9ec30de90) at rpc/virnetserverclient.c:1422 #4 0x00007fda230d714d in remoteDispatchObjectEventSend (client=0x7fd9e575b400, program=0x7fda24c844e0, procnr=348, proc=0x7fda2310e5e0 <xdr_remote_domain_event_callback_tunable_msg>, data=0x7ffc3857fdb0) at remote.c:3803 #5 0x00007fda230dd71b in remoteRelayDomainEventTunable (conn=<optimized out>, dom=0x7fda27cd7660, params=0x7fda27f3aae0, nparams=1,opaque=0x7fd9e6c99e00) at remote.c:1033 #6 0x00007fda224484cb in virDomainEventDispatchDefaultFunc (conn=0x7fda27cd0120, event=0x7fda2736ea00, cb=0x7fda230dd610 <remoteRelayDomainEventTunable>, cbopaque=0x7fd9e6c99e00) at conf/domain_event.c:1910 #7 0x00007fda22446871 in virObjectEventStateDispatchCallbacks (callbacks=<optimized out>, callbacks=<optimized out>, event=0x7fda2736ea00,state=0x7fda24ca3960) at conf/object_event.c:722 #8 virObjectEventStateQueueDispatch (callbacks=0x7fda24c65800, queue=0x7ffc3857fe90, state=0x7fda24ca3960) at conf/object_event.c:736 #9 virObjectEventStateFlush (state=0x7fda24ca3960) at conf/object_event.c:814 #10 virObjectEventTimer (timer=<optimized out>, opaque=0x7fda24ca3960) at conf/object_event.c:560 #11 0x00007fda223ae8b9 in virEventPollDispatchTimeouts () at util/vireventpoll.c:458 #12 virEventPollRunOnce () at util/vireventpoll.c:654 #13 0x00007fda223ad1d2 in virEventRunDefaultImpl () at util/virevent.c:314 #14 0x00007fda225046cd in virNetDaemonRun (dmn=0x7fda24c775c0) at rpc/virnetdaemon.c:818 #15 0x00007fda230d6351 in main (argc=<optimized out>, argv=<optimized out>) at libvirtd.c:1623 Let's clean all event callback when client close. Signed-off-by: xinhua.Cao <caoxinhua(a)huawei.com> this patch resolved the bug which reported by Wang King. and the prior patch link is http://www.redhat.com/archives/libvir-list/2017-February/msg00452.html --- daemon/remote.c | 60 +++++++++++++++++++++++++++------------------------------ 1 file changed, 28 insertions(+), 32 deletions(-) diff --git a/daemon/remote.c b/daemon/remote.c index 4aa43c223..22330307f 100644 --- a/daemon/remote.c +++ b/daemon/remote.c @@ -100,6 +100,7 @@ static void make_nonnull_node_device(remote_nonnull_node_device *dev_dst, virNod static void make_nonnull_secret(remote_nonnull_secret *secret_dst, virSecretPtr secret_src); static void make_nonnull_nwfilter(remote_nonnull_nwfilter *net_dst, virNWFilterPtr nwfilter_src); static void make_nonnull_domain_snapshot(remote_nonnull_domain_snapshot *snapshot_dst, virDomainSnapshotPtr snapshot_src); +static void remoteClientCleanEventCallbacks(struct daemonClientPrivate *priv); static int remoteSerializeDomainDiskErrors(virDomainDiskErrorPtr errors, @@ -1389,24 +1390,15 @@ void remoteRelayConnectionClosedEvent(virConnectPtr conn ATTRIBUTE_UNUSED, int r &msg); } -/* - * You must hold lock for at least the client - * We don't free stuff here, merely disconnect the client's - * network socket & resources. - * We keep the libvirt connection open until any async - * jobs have finished, then clean it up elsewhere - */ -void remoteClientFreeFunc(void *data) +static void remoteClientCleanEventCallbacks(struct daemonClientPrivate *priv) { - struct daemonClientPrivate *priv = data; - /* Deregister event delivery callback */ - if (priv->conn) { - virIdentityPtr sysident = virIdentityGetSystem(); + if (priv && priv->conn) { size_t i; - + virIdentityPtr sysident = virIdentityGetSystem(); virIdentitySetCurrent(sysident); + virMutexLock(&priv->lock); for (i = 0; i < priv->ndomainEventCallbacks; i++) { int callbackID = priv->domainEventCallbacks[i]->callbackID; if (callbackID < 0) { @@ -1420,6 +1412,7 @@ void remoteClientFreeFunc(void *data) VIR_WARN("unexpected domain event deregister failure"); } VIR_FREE(priv->domainEventCallbacks); + priv->ndomainEventCallbacks = 0; for (i = 0; i < priv->nnetworkEventCallbacks; i++) { int callbackID = priv->networkEventCallbacks[i]->callbackID; @@ -1435,21 +1428,7 @@ void remoteClientFreeFunc(void *data) VIR_WARN("unexpected network event deregister failure"); } VIR_FREE(priv->networkEventCallbacks); - - for (i = 0; i < priv->nstorageEventCallbacks; i++) { - int callbackID = priv->storageEventCallbacks[i]->callbackID; - if (callbackID < 0) { - VIR_WARN("unexpected incomplete storage pool callback %zu", i); - continue; - } - VIR_DEBUG("Deregistering remote storage pool event relay %d", - callbackID); - priv->storageEventCallbacks[i]->callbackID = -1; - if (virConnectStoragePoolEventDeregisterAny(priv->conn, - callbackID) < 0) - VIR_WARN("unexpected storage pool event deregister failure"); - } - VIR_FREE(priv->storageEventCallbacks); + priv->nnetworkEventCallbacks = 0; for (i = 0; i < priv->nqemuEventCallbacks; i++) { int callbackID = priv->qemuEventCallbacks[i]->callbackID; @@ -1465,28 +1444,45 @@ void remoteClientFreeFunc(void *data) VIR_WARN("unexpected qemu monitor event deregister failure"); } VIR_FREE(priv->qemuEventCallbacks); + priv->nqemuEventCallbacks = 0; if (priv->closeRegistered) { if (virConnectUnregisterCloseCallback(priv->conn, remoteRelayConnectionClosedEvent) < 0) VIR_WARN("unexpected close callback event deregister failure"); } - - virConnectClose(priv->conn); - + virMutexUnlock(&priv->lock); virIdentitySetCurrent(NULL); virObjectUnref(sysident); } +} + + +/* + * You must hold lock for at least the client + * We don't free stuff here, merely disconnect the client's + * network socket & resources. + * We keep the libvirt connection open until any async + * jobs have finished, then clean it up elsewhere + */ +void remoteClientFreeFunc(void *data) +{ + struct daemonClientPrivate *priv = data; + if (!priv || !priv->conn) + return; + + remoteClientCleanEventCallbacks(priv); + virConnectClose(priv->conn); VIR_FREE(priv); } - static void remoteClientCloseFunc(virNetServerClientPtr client) { struct daemonClientPrivate *priv = virNetServerClientGetPrivateData(client); daemonRemoveAllClientStreams(priv->streams); + remoteClientCleanEventCallbacks(priv); } -- 2.12.0.windows.1

2 1

[libvirt] [PATCH 0/4] Prevent loosing IPv6 routes due to forwarding
by Cédric Bosdonnat 13 Mar '17

13 Mar '17

Hi all, When enabling IPv6 forwarding on hosts getting Router Advertised routes, the host looses the RA routes. To prevent this, check if the host has such routes. In case there are some, check that the accept_ra is set to 2 before bringing the network up. Cédric Bosdonnat (4): util: extract the request sending code from virNetlinkCommand() util: add virNetlinkDumpCommand() bridge_driver.c: more uses of SYSCTL_PATH network: check accept_ra before enabling ipv6 forwarding src/libvirt_private.syms | 1 + src/network/bridge_driver.c | 187 +++++++++++++++++++++++++++++++++++++++++--- src/util/virnetlink.c | 145 +++++++++++++++++++++++++--------- src/util/virnetlink.h | 9 +++ 4 files changed, 298 insertions(+), 44 deletions(-) -- 2.11.0

3 9

[libvirt] [PATCH] docs: document virt-host-validate bhyve support
by Roman Bogorodskiy 13 Mar '17

13 Mar '17

Add an entry about virt-host-validate bhyve support and update the driver's page. --- docs/drvbhyve.html.in | 13 ++++++++++++- docs/news.xml | 10 +++++++++- 2 files changed, 21 insertions(+), 2 deletions(-) diff --git a/docs/drvbhyve.html.in b/docs/drvbhyve.html.in index da6f1e0b2..64a1ff694 100644 --- a/docs/drvbhyve.html.in +++ b/docs/drvbhyve.html.in @@ -13,9 +13,20 @@ of bhyve are supported. In order to enable bhyve on your FreeBSD host, you'll need to load the <code>vmm</code> kernel module. Additionally, <code>if_tap</code> and <code>if_bridge</code> modules -should be loaded for networking support. +should be loaded for networking support. Also, <span class="since">since 3.2.0</span> the +<code>virt-host-validate(1)</code> supports the bhyve host validation and could be +used like this: </p> +<pre> +$ virt-host-validate bhyve + BHYVE: Checking for vmm module : PASS + BHYVE: Checking for if_tap module : PASS + BHYVE: Checking for if_bridge module : PASS + BHYVE: Checking for nmdm module : PASS +$ +</pre> + <p> Additional information on bhyve could be obtained on <a href="http://bhyve.org/">bhyve.org</a>. </p> diff --git a/docs/news.xml b/docs/news.xml index 951539575..57fafebb8 100644 --- a/docs/news.xml +++ b/docs/news.xml @@ -12,7 +12,15 @@ <libvirt> <release version="v3.2.0" date="unreleased"> <section title="New features"> - <change/> + <change> + <summary> + virt-host-validate: Add bhyve support + </summary> + <description> + Add support for validation of the bhyve hypervisor hosts + using the virt-host-validate tool. + </description> + </change> </section> <section title="Improvements"> <change> -- 2.11.0

2 2

[libvirt] [PATCH] Switch to GSSAPI (kerberos) instead of the insecure DIGEST-MD5
by Daniel P. Berrange 13 Mar '17

13 Mar '17

RFC 6331 documents a number of serious security weaknesses in the SASL DIGEST-MD5 mechanism. As such, libvirtd should not by using it as a default mechanism. GSSAPI is the only other viable SASL mechanism that can provide secure session encryption so enable that by defalt as the replacement. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- daemon/libvirtd.sasl | 44 +++++++++++++++++--------- docs/auth.html.in | 89 +++++++++++++++++++++++++++++++++++++++++----------- libvirt.spec.in | 6 ++-- 3 files changed, 102 insertions(+), 37 deletions(-) diff --git a/daemon/libvirtd.sasl b/daemon/libvirtd.sasl index 5e2528d..2be99ef 100644 --- a/daemon/libvirtd.sasl +++ b/daemon/libvirtd.sasl @@ -1,31 +1,45 @@ -# If you want to use the non-TLS socket, then you *must* include -# the GSSAPI or DIGEST-MD5 mechanisms, because they are the only -# ones that can offer session encryption as well as authentication. +# If you want to use the non-TLS socket, then you *must* pick a +# mechanism which provides session encryption as well as +# authentication. # -# If you're only using TLS, then you can turn on any mechanisms +# If you are only using TLS, then you can turn on any mechanisms # you like for authentication, because TLS provides the encryption # -# Default to a simple username+password mechanism -mech_list: digest-md5 +# If you are only using UNIX, sockets then encryption is not +# required at all. +# +# Since SASL is the default for the libvirtd non-TLS socket, we +# pick a strong mechanism by default. +# +# NB, previously DIGEST-MD5 was set as the default mechanism for +# libvirt. Per RFC 6331 this is vulnerable to many serious security +# flaws as should no longer be used. Thus GSSAPI is now the default. +# +# To use GSSAPI requires that a libvirtd service principal is +# added to the Kerberos server for each host running libvirtd. +# This principal needs to be exported to the keytab file listed below +mech_list: gssapi + +# If using a TLS socket or UNIX socket only, it is possible to +# enable plugins which don't provide session encryption. The +# 'scram-sha-1' plugin allows plain username/password authentication +# to be performed +# +#mech_list: scram-sha-1 -# Before you can use GSSAPI, you need a service principle on the -# KDC server for libvirt, and that to be exported to the keytab -# file listed below -#mech_list: gssapi # # You can also list many mechanisms at once, then the user can choose # by adding '?auth=sasl.gssapi' to their libvirt URI, eg # qemu+tcp://hostname/system?auth=sasl.gssapi -#mech_list: digest-md5 gssapi +#mech_list: scram-sha-1 gssapi # Some older builds of MIT kerberos on Linux ignore this option & # instead need KRB5_KTNAME env var. # For modern Linux, and other OS, this should be sufficient # -# There is no default value here, uncomment if you need this -#keytab: /etc/libvirt/krb5.tab +keytab: /etc/libvirt/krb5.tab -# If using digest-md5 for username/passwds, then this is the file +# If using scram-sha-1 for username/passwds, then this is the file # containing the passwds. Use 'saslpasswd2 -a libvirt [username]' # to add entries, and 'sasldblistusers2 -f [sasldb_path]' to browse it -sasldb_path: /etc/libvirt/passwd.db +#sasldb_path: /etc/libvirt/passwd.db diff --git a/docs/auth.html.in b/docs/auth.html.in index 08feacc..9f2e317 100644 --- a/docs/auth.html.in +++ b/docs/auth.html.in @@ -204,16 +204,71 @@ ResultActive=yes</pre> Further examples of PolicyKit setup can be found on the <a href="http://wiki.libvirt.org/page/SSHPolicyKitSetup">wiki page</a>. </p> - <h2><a name="ACL_server_username">Username/password auth</a></h2> + <h2><a name="ACL_server_sasl">SASL pluggable authentication</a></h2> + <p> -The plain TCP socket of the libvirt daemon defaults to using SASL for authentication. -The SASL mechanism configured by default is DIGEST-MD5, which provides a basic -username+password style authentication. It also provides for encryption of the data -stream, so the security of the plain TCP socket is on a par with that of the TLS -socket. If desired the UNIX socket and TLS socket can also have SASL enabled by -setting the <code>auth_unix_ro</code>, <code>auth_unix_rw</code>, <code>auth_tls</code> -config params in <code>libvirt.conf</code>. -</p> +Libvirt integrates with the cyrus-sasl library to provide a pluggable authentication +system using the SASL protocol. SASL can be used in combination with libvirtd's TLS +or TCP socket listeners. When used with the TCP listener, the SASL mechanism is +rqeuired to provide session encryption in addition to authentication. Only a very +few SASL mechanisms are able todo this, and of those that can do it, only the +GSSAPI plugin is considered acceptably secure by modern standards: + </p> + + <dl> + <dt>GSSAPI</dt> + <dd><strong>This is the current default mechanism to use with libvirtd</strong>. + It uses the Kerberos v5 authentication protocol underneath, and assuming + the Kerberos client/server are configured with modern ciphers (AES), + it provides strong session encryption capabilities.</dd> + + <dt>DIGEST-MD5</dt> + <dd>This was previously set as the default mechanism to use with libvirtd. + It provides a simple username/password based authentication mechanism + that includes session encryption. + <a href="https://tools.ietf.org/html/rfc6331">RFC 6331</a>, however, + documents a number of serious security flaws with DIGEST-MD5 and as a + result marks it as <code>OBSOLETE</code>. Specific concerns are that + it is vulnerable to MITM attacks and the MD5 hash can be brute-forced + to reveal the password. A replacement is provided via the SCRAM mechanism, + however, note that this is does not provide encryption, so the SCRAM + mechanism can only be used on the libvirtd TLS listener. + </dd> + + <dt>PASSDSS-3DES-1</dt> + <dd>This provides a simple username/password based authentication + mechanism that includes session encryption. The current cyrus-sasl + implementation does not provide a way to validate the server's + public key identity, thus it is susceptible to a MITM attacker + impersonating the server.</dd> + + <dt>KERBEROS_V4</dt> + <dd>This uses the obsolete Kerberos v4 protocol to provide both authentication + and session encryption. Kerberos v4 protocol has been obsolete since the + early 1990's and has known security vulnerabilities so this will never be + used in practice.</dd> + </dl> + + <p> + Other SASL mechanisms, not listed above, can only be used when the libvirtd + TLS or UNIX socket listeners. + </p> + + <h3><a name="ACL_server_username">Username/password auth</a></h3> + <p> +As noted above, the DIGEST-MD5 mechanism is considered obsolete and should +not be used anymore. To provide a simple username/password auth scheme on +the libvirt UNIX socket or TLS listeners, however, it is possible to use +the SCRAM mechanism. The <code>auth_unix_ro</code>, <code>auth_unix_rw</code>, +<code>auth_tls</code> config params in <code>libvirt.conf</code> can be used +to turn on SASL auth in these listeners. + </p> + <p> +Since the libvirt SASL config file defaults to using GSSAPI (Kerberos), a +config change is rquired to enable plain password auth. This is done by +editting <code>/etc/sasl2/libvirt.conf</code> to set the <code>mech_list</code> +parameter to <code>scram-sha-1</code>. + </p> <p> Out of the box, no user accounts are defined, so no clients will be able to authenticate on the TCP socket. Adding users and setting their passwords is done with the <code>saslpasswd2</code> @@ -241,17 +296,13 @@ again: <pre> # saslpasswd2 -a libvirt -d fred </pre> - <h2><a name="ACL_server_kerberos">Kerberos auth</a></h2> + <h3><a name="ACL_server_kerberos">GSSAPI/Kerberos auth</a></h3> <p> -The plain TCP socket of the libvirt daemon defaults to using SASL for authentication. -The SASL mechanism configured by default is DIGEST-MD5, which provides a basic -username+password style authentication. To enable Kerberos single-sign-on instead, -the libvirt SASL configuration file must be changed. This is <code>/etc/sasl2/libvirt.conf</code>. -The <code>mech_list</code> parameter must first be changed to <code>gssapi</code> -instead of the default <code>digest-md5</code>, and keytab should be set to -<code>/etc/libvirt/krb5.tab</code> . If SASL is enabled on the UNIX -and/or TLS sockets, Kerberos will also be used for them. Like DIGEST-MD5, the Kerberos -mechanism provides data encryption of the session. +The plain TCP listener of the libvirt daemon defaults to using SASL for authentication. +The libvirt SASL config also defaults to GSSAPI, so there is no need to edit the +SASL config when using GSSAPI. If the libvirtd TLS or UNIX listeners are used, +then the Kerberos session encryption will be disabled since it is not required +in these scenarios - only the plain TCP listener needs encryption </p> <p> Some operating systems do not install the SASL kerberos plugin by default. It diff --git a/libvirt.spec.in b/libvirt.spec.in index 57ac88e..1d24985 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -979,9 +979,9 @@ Group: Development/Libraries # (client invokes 'nc' against the UNIX socket on the server) Requires: nc Requires: cyrus-sasl -# Not technically required, but makes 'out-of-box' config -# work correctly & doesn't have onerous dependencies -Requires: cyrus-sasl-md5 +# Needed by default sasl.conf - no onerous extra deps, since +# 100's of other things on a system already pull in krb5-libs +Requires: cyrus-sasl-gssapi %description libs Shared libraries for accessing the libvirt daemon. -- 2.9.3

3 2

[libvirt] [PATCH 0/7] qemu: Report better host-model CPUs in domain caps
by Jiri Denemark 13 Mar '17

13 Mar '17

One of the main reasons for introducing host-model CPU definition in a domain capabilities XML was the inability to express disabled features in a host capabilities XML. That is, when a host CPU is, e.g., Haswell without x2apic support, host capabilities XML will have to report it as Westmere + a bunch of additional features., but we really want to use Haswell - x2apic when creating a host-model CPU. Unfortunately, I somehow forgot to do the last step and the code would just copy the CPU definition found in the host capabilities XML. This changed recently for new QEMU versions which allow us to query host CPU, but any slightly older QEMU will not benefit from any change I did. This patch makes sure the right CPU model is filled in the domain capabilities even with old QEMU. The issue was reported in https://bugzilla.redhat.com/show_bug.cgi?id=1426456 Jiri Denemark (7): Do not format <arch> in guest CPU XML cpu: Replace cpuNodeData with virCPUGetHost cpu: Add virCPUType parameter to virCPUGetHost cpu: Add list of allowed CPU models to virCPUGetHost qemu: Refactor virQEMUCapsInitCPU qemu: Report better host-model CPUs in domain caps cputest: New test for Intel Core i7-4510U src/bhyve/bhyve_capabilities.c | 35 +--- src/conf/cpu_conf.c | 2 +- src/cpu/cpu.c | 100 ++++++++-- src/cpu/cpu.h | 16 +- src/cpu/cpu_arm.c | 1 - src/cpu/cpu_ppc64.c | 30 +-- src/cpu/cpu_s390.c | 1 - src/cpu/cpu_x86.c | 29 ++- src/libvirt_private.syms | 2 +- src/qemu/qemu_capabilities.c | 61 +++---- src/qemu/qemu_capspriv.h | 5 + src/vmware/vmware_conf.c | 20 +- src/vz/vz_driver.c | 22 +-- tests/Makefile.am | 11 +- tests/cputest.c | 1 + tests/cputestdata/x86_64-cpuid-A10-5800K-guest.xml | 1 - tests/cputestdata/x86_64-cpuid-A10-5800K-json.xml | 1 - tests/cputestdata/x86_64-cpuid-Atom-D510-guest.xml | 1 - tests/cputestdata/x86_64-cpuid-Atom-N450-guest.xml | 1 - .../x86_64-cpuid-Core-i5-2500-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Core-i5-2500-json.xml | 1 - .../x86_64-cpuid-Core-i5-2540M-guest.xml | 1 - .../x86_64-cpuid-Core-i5-2540M-json.xml | 1 - .../x86_64-cpuid-Core-i5-4670T-guest.xml | 1 - .../x86_64-cpuid-Core-i5-4670T-json.xml | 1 - .../x86_64-cpuid-Core-i5-6600-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Core-i5-6600-json.xml | 1 - .../x86_64-cpuid-Core-i7-2600-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Core-i7-2600-json.xml | 1 - .../x86_64-cpuid-Core-i7-3520M-guest.xml | 1 - .../x86_64-cpuid-Core-i7-3740QM-guest.xml | 1 - .../x86_64-cpuid-Core-i7-3740QM-json.xml | 1 - .../x86_64-cpuid-Core-i7-3770-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Core-i7-3770-json.xml | 1 - .../x86_64-cpuid-Core-i7-4510U-guest.xml | 29 +++ .../x86_64-cpuid-Core-i7-4510U-host.xml | 44 +++++ .../x86_64-cpuid-Core-i7-4510U-json.xml | 15 ++ tests/cputestdata/x86_64-cpuid-Core-i7-4510U.json | 203 +++++++++++++++++++++ tests/cputestdata/x86_64-cpuid-Core-i7-4510U.xml | 34 ++++ .../x86_64-cpuid-Core-i7-4600U-guest.xml | 1 - .../x86_64-cpuid-Core-i7-4600U-json.xml | 1 - .../x86_64-cpuid-Core-i7-5600U-guest.xml | 1 - .../x86_64-cpuid-Core-i7-5600U-json.xml | 1 - .../cputestdata/x86_64-cpuid-Core2-E6850-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Core2-E6850-json.xml | 1 - .../cputestdata/x86_64-cpuid-Core2-Q9500-guest.xml | 1 - tests/cputestdata/x86_64-cpuid-FX-8150-guest.xml | 1 - .../x86_64-cpuid-Opteron-1352-guest.xml | 1 - .../x86_64-cpuid-Opteron-2350-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Opteron-2350-json.xml | 1 - .../x86_64-cpuid-Opteron-6234-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Opteron-6234-json.xml | 1 - .../x86_64-cpuid-Opteron-6282-guest.xml | 1 - .../x86_64-cpuid-Pentium-P6100-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Phenom-B95-guest.xml | 1 - tests/cputestdata/x86_64-cpuid-Phenom-B95-json.xml | 1 - tests/cputestdata/x86_64-cpuid-Xeon-5110-guest.xml | 1 - .../x86_64-cpuid-Xeon-E3-1245-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Xeon-E3-1245-json.xml | 1 - .../x86_64-cpuid-Xeon-E5-2630-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Xeon-E5-2630-json.xml | 1 - .../x86_64-cpuid-Xeon-E5-2650-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Xeon-E5-2650-json.xml | 1 - .../x86_64-cpuid-Xeon-E7-4820-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Xeon-E7-4820-json.xml | 1 - .../x86_64-cpuid-Xeon-E7-8890-guest.xml | 1 - .../cputestdata/x86_64-cpuid-Xeon-W3520-guest.xml | 1 - tests/cputestdata/x86_64-cpuid-Xeon-W3520-json.xml | 1 - .../cputestdata/x86_64-cpuid-Xeon-X5460-guest.xml | 1 - tests/domaincapstest.c | 6 + tests/qemucpumock.c | 35 ++++ tests/qemuxml2argvtest.c | 6 +- 72 files changed, 560 insertions(+), 197 deletions(-) create mode 100644 tests/cputestdata/x86_64-cpuid-Core-i7-4510U-guest.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Core-i7-4510U-host.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Core-i7-4510U-json.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Core-i7-4510U.json create mode 100644 tests/cputestdata/x86_64-cpuid-Core-i7-4510U.xml create mode 100644 tests/qemucpumock.c -- 2.12.0

2 8

[libvirt] [PATCH] qemuDomainBuildNamespace: Handle file mount points
by Michal Privoznik 13 Mar '17

13 Mar '17

https://bugzilla.redhat.com/show_bug.cgi?id=1431112 Yeah, that's right. A mount point doesn't have to be a directory. It can be a file too. However, the code that tries to preserve mount points under /dev for new namespace for qemu does not count with that option. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_domain.c | 37 +++++++++++++++++++++++++++++++++---- 1 file changed, 33 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index d5833b026..07ce22417 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -7741,10 +7741,21 @@ qemuDomainBuildNamespace(virQEMUDriverConfigPtr cfg, /* Save some mount points because we want to share them with the host */ for (i = 0; i < ndevMountsPath; i++) { + struct stat sb; + if (devMountsSavePath[i] == devPath) continue; - if (virFileMakePath(devMountsSavePath[i]) < 0) { + if (stat(devMountsPath[i], &sb) < 0) { + virReportSystemError(errno, + _("Unable to stat: %s"), + devMountsPath[i]); + goto cleanup; + } + + /* At this point, devMountsPath is either a regular file or a directory. */ + if ((S_ISDIR(sb.st_mode) && virFileMakePath(devMountsSavePath[i]) < 0) || + (S_ISREG(sb.st_mode) && virFileTouch(devMountsSavePath[i], sb.st_mode) < 0)) { virReportSystemError(errno, _("Failed to create %s"), devMountsSavePath[i]); @@ -7780,15 +7791,33 @@ qemuDomainBuildNamespace(virQEMUDriverConfigPtr cfg, goto cleanup; for (i = 0; i < ndevMountsPath; i++) { + struct stat sb; + if (devMountsSavePath[i] == devPath) continue; - if (virFileMakePath(devMountsPath[i]) < 0) { - virReportSystemError(errno, _("Cannot create %s"), - devMountsPath[i]); + if (stat(devMountsSavePath[i], &sb) < 0) { + virReportSystemError(errno, + _("Unable to stat: %s"), + devMountsSavePath[i]); goto cleanup; } + if (S_ISDIR(sb.st_mode)) { + if (virFileMakePath(devMountsPath[i]) < 0) { + virReportSystemError(errno, _("Cannot create %s"), + devMountsPath[i]); + goto cleanup; + } + } else { + if (virFileMakeParentPath(devMountsPath[i]) < 0 || + virFileTouch(devMountsPath[i], sb.st_mode) < 0) { + virReportSystemError(errno, _("Cannot create %s"), + devMountsPath[i]); + goto cleanup; + } + } + if (virFileMoveMount(devMountsSavePath[i], devMountsPath[i]) < 0) goto cleanup; } -- 2.11.0

2 1

[libvirt] [PATCH] Enable forgotten VIR_CONNECT_LIST_STORAGE_POOLS_* flags
by Jiri Denemark 13 Mar '17

13 Mar '17

VIR_CONNECT_LIST_STORAGE_POOLS_VSTORAGE and VIR_CONNECT_LIST_STORAGE_POOLS_ZFS were added to libvirt but the listing API was not properly updated to use them. https://bugzilla.redhat.com/show_bug.cgi?id=1431543 Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/conf/storage_conf.c | 6 +++++- src/conf/storage_conf.h | 3 ++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/src/conf/storage_conf.c b/src/conf/storage_conf.c index a52eeba07..3cfaf2b9b 100644 --- a/src/conf/storage_conf.c +++ b/src/conf/storage_conf.c @@ -2671,7 +2671,11 @@ virStoragePoolMatch(virStoragePoolObjPtr poolobj, (MATCH(VIR_CONNECT_LIST_STORAGE_POOLS_SHEEPDOG) && (poolobj->def->type == VIR_STORAGE_POOL_SHEEPDOG)) || (MATCH(VIR_CONNECT_LIST_STORAGE_POOLS_GLUSTER) && - (poolobj->def->type == VIR_STORAGE_POOL_GLUSTER)))) + (poolobj->def->type == VIR_STORAGE_POOL_GLUSTER)) || + (MATCH(VIR_CONNECT_LIST_STORAGE_POOLS_ZFS) && + poolobj->def->type == VIR_STORAGE_POOL_ZFS) || + (MATCH(VIR_CONNECT_LIST_STORAGE_POOLS_VSTORAGE) && + poolobj->def->type == VIR_STORAGE_POOL_VSTORAGE))) return false; } diff --git a/src/conf/storage_conf.h b/src/conf/storage_conf.h index 1723afc0a..c3a88d284 100644 --- a/src/conf/storage_conf.h +++ b/src/conf/storage_conf.h @@ -544,7 +544,8 @@ VIR_ENUM_DECL(virStoragePartedFs) VIR_CONNECT_LIST_STORAGE_POOLS_RBD | \ VIR_CONNECT_LIST_STORAGE_POOLS_SHEEPDOG | \ VIR_CONNECT_LIST_STORAGE_POOLS_GLUSTER | \ - VIR_CONNECT_LIST_STORAGE_POOLS_ZFS) + VIR_CONNECT_LIST_STORAGE_POOLS_ZFS | \ + VIR_CONNECT_LIST_STORAGE_POOLS_VSTORAGE) # define VIR_CONNECT_LIST_STORAGE_POOLS_FILTERS_ALL \ (VIR_CONNECT_LIST_STORAGE_POOLS_FILTERS_ACTIVE | \ -- 2.12.0

2 1

[libvirt] [PATCH 7/7] docs: moved 'timestamps' and 'encryption' sub-element description in formatstorage doc
by Alexander Vasilenko 12 Mar '17

12 Mar '17

--- docs/formatstorage.html.in | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/docs/formatstorage.html.in b/docs/formatstorage.html.in index c787a059d..225e19000 100644 --- a/docs/formatstorage.html.in +++ b/docs/formatstorage.html.in @@ -456,24 +456,6 @@ will be filled with the values used by the existing directory. <span class="since">Since 1.2.16</span> </dd> - <dt><code>timestamps</code></dt> - <dd>Provides timing information about the volume. Up to four - sub-elements are present, - where <code>atime</code>, <code>btime</code>, <code>ctime</code> - and <code>mtime</code> hold the access, birth, change and - modification time of the volume, where known. The used time - format is <seconds>.<nanoseconds> since the - beginning of the epoch (1 Jan 1970). If nanosecond resolution - is 0 or otherwise unsupported by the host OS or filesystem, - then the nanoseconds part is omitted. This is a readonly - attribute and is ignored when creating a volume. - <span class="since">Since 0.10.0</span> - </dd> - <dt><code>encryption</code></dt> - <dd>If present, specifies how the volume is encrypted. See - the <a href="formatstorageencryption.html">Storage Encryption</a> page - for more information. - </dd> </dl> <h3><a name="StoragePoolExtents">Device extents</a></h3> @@ -658,6 +640,24 @@ will be filled with the values used by the existing file. <span class="since">Since 0.4.1</span> </dd> + <dt><code>timestamps</code></dt> + <dd>Provides timing information about the volume. Up to four + sub-elements are present, + where <code>atime</code>, <code>btime</code>, <code>ctime</code> + and <code>mtime</code> hold the access, birth, change and + modification time of the volume, where known. The used time + format is <seconds>.<nanoseconds> since the + beginning of the epoch (1 Jan 1970). If nanosecond resolution + is 0 or otherwise unsupported by the host OS or filesystem, + then the nanoseconds part is omitted. This is a readonly + attribute and is ignored when creating a volume. + <span class="since">Since 0.10.0</span> + </dd> + <dt><code>encryption</code></dt> + <dd>If present, specifies how the volume is encrypted. See + the <a href="formatstorageencryption.html">Storage Encryption</a> page + for more information. + </dd> <dt><code>compat</code></dt> <dd>Specify compatibility level. So far, this is only used for <code>type='qcow2'</code> volumes. Valid values are <code>0.10</code> -- 2.12.0

1 0

[libvirt] [PATCH 0/6] bhyve UEFI and graphics support
by Roman Bogorodskiy 12 Mar '17

12 Mar '17

Fabian Freyer (5): bhyve: virBhyveProbeCaps: BHYVE_CAP_LPC_BOOTROM bhyve: add support for booting from UEFI bhyve: test cases for UEFI bhyvexml2argvtest bhyve: enumerate UEFI firmwares bhyve: add video support Roman Bogorodskiy (1): bhyve: test cases for VNC docs/formatdomain.html.in | 3 +- docs/schemas/domaincommon.rng | 1 + po/POTFILES.in | 1 + src/bhyve/bhyve_capabilities.c | 93 ++++++++++++++++ src/bhyve/bhyve_capabilities.h | 2 + src/bhyve/bhyve_command.c | 130 +++++++++++++++++++++- src/bhyve/bhyve_device.c | 11 ++ src/bhyve/bhyve_driver.c | 27 ++++- src/bhyve/bhyve_process.c | 55 ++++----- src/conf/domain_conf.c | 5 +- src/conf/domain_conf.h | 1 + src/qemu/qemu_command.c | 9 +- src/qemu/qemu_domain_address.c | 1 + tests/bhyvexml2argvdata/bhyvexml2argv-uefi.args | 11 ++ tests/bhyvexml2argvdata/bhyvexml2argv-uefi.ldargs | 1 + tests/bhyvexml2argvdata/bhyvexml2argv-uefi.xml | 23 ++++ tests/bhyvexml2argvdata/bhyvexml2argv-vnc.args | 12 ++ tests/bhyvexml2argvdata/bhyvexml2argv-vnc.ldargs | 1 + tests/bhyvexml2argvdata/bhyvexml2argv-vnc.xml | 26 +++++ tests/bhyvexml2argvtest.c | 18 ++- tests/domaincapsschemadata/full.xml | 1 + 21 files changed, 394 insertions(+), 38 deletions(-) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-uefi.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-uefi.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-uefi.xml create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-vnc.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-vnc.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-vnc.xml -- 2.11.0

4 18

[libvirt] [PATCH] virt-host-validate: add bhyve support
by Roman Bogorodskiy 11 Mar '17

11 Mar '17

Add bhyve support to virt-host-validate(1). It checks for the essential kernel modules to be available so that user can actually start VMs, have networking and console access. It uses the kldnext(2)/kldstat(2) routines to retrieve modules list. As bhyve is only available on FreeBSD and these routines were available long before bhyve appeared, not adding any specific configure checks for that. --- po/POTFILES.in | 1 + tools/Makefile.am | 1 + tools/virt-host-validate-bhyve.c | 78 ++++++++++++++++++++++++++++++++++++++++ tools/virt-host-validate-bhyve.h | 27 ++++++++++++++ tools/virt-host-validate.c | 12 +++++++ tools/virt-host-validate.pod | 4 +-- 6 files changed, 121 insertions(+), 2 deletions(-) create mode 100644 tools/virt-host-validate-bhyve.c create mode 100644 tools/virt-host-validate-bhyve.h diff --git a/po/POTFILES.in b/po/POTFILES.in index 9f66697d7..51b5859cb 100644 --- a/po/POTFILES.in +++ b/po/POTFILES.in @@ -306,6 +306,7 @@ tools/virsh-snapshot.c tools/virsh-volume.c tools/virsh.c tools/virt-admin.c +tools/virt-host-validate-bhyve.c tools/virt-host-validate-common.c tools/virt-host-validate-lxc.c tools/virt-host-validate-qemu.c diff --git a/tools/Makefile.am b/tools/Makefile.am index e6ae15025..a8bd3d1c2 100644 --- a/tools/Makefile.am +++ b/tools/Makefile.am @@ -142,6 +142,7 @@ virt_host_validate_SOURCES = \ virt-host-validate-common.c virt-host-validate-common.h \ virt-host-validate-qemu.c virt-host-validate-qemu.h \ virt-host-validate-lxc.c virt-host-validate-lxc.h \ + virt-host-validate-bhyve.c virt-host-validate-bhyve.h \ $(NULL) virt_host_validate_LDFLAGS = \ diff --git a/tools/virt-host-validate-bhyve.c b/tools/virt-host-validate-bhyve.c new file mode 100644 index 000000000..c7bf96f05 --- /dev/null +++ b/tools/virt-host-validate-bhyve.c @@ -0,0 +1,78 @@ +/* + * virt-host-validate-bhyve.c: Sanity check a bhyve hypervisor host + * + * Copyright (C) 2017 Roman Bogorodskiy + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + * + */ + +#include <config.h> + +#include <sys/param.h> +#include <sys/linker.h> +#include <stdio.h> + +#include "virt-host-validate-bhyve.h" +#include "virt-host-validate-common.h" + +#define MODULE_STATUS(mod, err_msg, err_code) \ + virHostMsgCheck("BHYVE", _("for %s module"), #mod); \ + if (mod ## _loaded) { \ + virHostMsgPass(); \ + } else { \ + virHostMsgFail(err_code, \ + _("%s module is not loaded, " err_msg), \ + #mod); \ + ret = -1; \ + } \ + +#define MODULE_STATUS_FAIL(mod, err_msg) \ + MODULE_STATUS(mod, err_msg, VIR_HOST_VALIDATE_FAIL) + +#define MODULE_STATUS_WARN(mod, err_msg) \ + MODULE_STATUS(mod, err_msg, VIR_HOST_VALIDATE_WARN) + + +int virHostValidateBhyve(void) +{ + int ret = 0; + int fileid = 0; + struct kld_file_stat stat; + bool vmm_loaded = false, if_tap_loaded = false; + bool if_bridge_loaded = false, nmdm_loaded = false; + + for (fileid = kldnext(0); fileid > 0; fileid = kldnext(fileid)) { + stat.version = sizeof(struct kld_file_stat); + if (kldstat(fileid, &stat) < 0) + continue; + + if (STREQ(stat.name, "vmm.ko")) + vmm_loaded = true; + else if (STREQ(stat.name, "if_tap.ko")) + if_tap_loaded = true; + else if (STREQ(stat.name, "if_bridge.ko")) + if_bridge_loaded = true; + else if (STREQ(stat.name, "nmdm.ko")) + nmdm_loaded = true; + } + + MODULE_STATUS_FAIL(vmm, "will not be able to start VMs"); + MODULE_STATUS_WARN(if_tap, "networking will not work"); + MODULE_STATUS_WARN(if_bridge, "bridged networking will not work"); + MODULE_STATUS_WARN(nmdm, "nmdm console will not work"); + + return ret; +} diff --git a/tools/virt-host-validate-bhyve.h b/tools/virt-host-validate-bhyve.h new file mode 100644 index 000000000..290d4336f --- /dev/null +++ b/tools/virt-host-validate-bhyve.h @@ -0,0 +1,27 @@ +/* + * virt-host-validate-bhyve.h: Sanity check a bhyve hypervisor host + * + * Copyright (C) 2017 Roman Bogorodskiy + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + * + */ + +#ifndef __VIRT_HOST_VALIDATE_BHYVE_H__ +# define __VIRT_HOST_VALIDATE_BHYVE_H__ + +int virHostValidateBhyve(void); + +#endif /* __VIRT_HOST_VALIDATE_BHYVE_H__ */ diff --git a/tools/virt-host-validate.c b/tools/virt-host-validate.c index f09282412..29d2482b6 100644 --- a/tools/virt-host-validate.c +++ b/tools/virt-host-validate.c @@ -36,6 +36,9 @@ #if WITH_LXC # include "virt-host-validate-lxc.h" #endif +#if WITH_BHYVE +# include "virt-host-validate-bhyve.h" +#endif static void show_help(FILE *out, const char *argv0) @@ -48,6 +51,7 @@ show_help(FILE *out, const char *argv0) "\n" " - qemu\n" " - lxc\n" + " - bhyve\n" "\n" " Options:\n" " -h, --help Display command line help\n" @@ -130,6 +134,14 @@ main(int argc, char **argv) } #endif +#if WITH_BHYVE + if (!hvname || STREQ(hvname, "bhyve")) { + usedHvname = true; + if (virHostValidateBhyve() < 0) + ret = EXIT_FAILURE; + } +#endif + if (hvname && !usedHvname) { fprintf(stderr, _("%s: unsupported hypervisor name %s\n"), argv[0], hvname); diff --git a/tools/virt-host-validate.pod b/tools/virt-host-validate.pod index 84917c83b..910114175 100644 --- a/tools/virt-host-validate.pod +++ b/tools/virt-host-validate.pod @@ -12,8 +12,8 @@ This tool validates that the host is configured in a suitable way to run libvirt hypervisor drivers. If invoked without any arguments it will check support for all hypervisor drivers it is aware of. Optionally it can be given a particular hypervisor -type ('qemu' or 'lxc') to restrict the checks to those relevant -for that virtualization technology +type ('qemu', 'lxc' or 'bhyve') to restrict the checks +to those relevant for that virtualization technology =head1 OPTIONS -- 2.11.0

2 2

[libvirt] [REPOST PATCHv2 0/6] Converge Storage Pool vHBA logic with Node Device
by John Ferlan 10 Mar '17

10 Mar '17

Repost to merge in recent changes (thru commit id 'dec6d9df') v1: http://www.redhat.com/archives/libvir-list/2017-February/msg00963.html Changes since v1: NB: Former Patch 1 - was pushed Patch 1 - Was the old patch 2... Similar for rest of series... Altered to match the adjusted testNodeDeviceMockCreateVport from commit 2a862092 Patch 2 - reworked the code to not place the new module in src/util, but rather in src/conf as storage_adapter_conf.{c,h}. The concepts didn't change - only the name/location. Removed the changes for util/virvirscsi.c since virSCSIHostGetNameByParentaddr wouldn't be allowed to use virStorageAdapterSCSIHostPtr since it's a conf definition. Patch 3 - Unchanged, ACK'd in v1 Patch 4 - Unchanged, ACK'd in v1 Patch 5 - Unchanged... Even though there is concern over usage of API's in this manner (e.g. calling virNodeDeviceLookupSCSIHostByWWN as well as virNodeDeviceCreateXML) - the "purpose" of the exercise is a means to have the StoragePool code use the same algorithms as the node device code instead of what could be a potentially long slow journey through the sysfs file system. The key piece being the replication of the API's that find the parent in the node device object list. I suppose it would be possible to add even more API's to get that answer, but I'm not sure it'd be worthwhile at this point. As for the concern about deadlock - I understand it, but since the whole purpose of the API is to essentially utilize the nodedev create algorithm there'd be no reason for nodedev to call it. If it doesn't get ACK'd - that's OK - I can hold onto it and reconsider some other means at some point in time in the future (probably distant future too). Patch 6 - Unchanged The former patch 8 is dropped for now - needs some more "discussion" as to viability and/or need. John Ferlan (6): tests: Add createVHBAByStoragePool-by-parent to fchosttest conf: Convert virStoragePoolSourceAdapter to virStorageAdapter util: Rename virFileWaitForDevices conf: Move/rename createVport and deleteVport util: Alter virNodeDevice{Create|Delete}Vport to use nodedev APIs tests: Add more storage pool vHBA tests po/POTFILES.in | 1 + src/Makefile.am | 1 + src/conf/node_device_conf.c | 332 +++++++++++++++++++++++++++++++++ src/conf/node_device_conf.h | 9 + src/conf/storage_adapter_conf.c | 291 +++++++++++++++++++++++++++++ src/conf/storage_adapter_conf.h | 89 +++++++++ src/conf/storage_conf.c | 333 ++++++++-------------------------- src/conf/storage_conf.h | 35 +--- src/libvirt_private.syms | 20 +- src/node_device/node_device_driver.c | 2 +- src/phyp/phyp_driver.c | 3 +- src/storage/storage_backend_disk.c | 6 +- src/storage/storage_backend_iscsi.c | 2 +- src/storage/storage_backend_logical.c | 4 +- src/storage/storage_backend_mpath.c | 2 +- src/storage/storage_backend_scsi.c | 267 +++++---------------------- src/storage/storage_util.c | 2 +- src/test/test_driver.c | 99 +++++++++- src/util/virfile.h | 2 - src/util/virutil.c | 4 +- src/util/virutil.h | 2 + tests/fchosttest.c | 111 ++++++++++++ 22 files changed, 1087 insertions(+), 530 deletions(-) create mode 100644 src/conf/storage_adapter_conf.c create mode 100644 src/conf/storage_adapter_conf.h -- 2.9.3

2 9

[libvirt] [PATCH for-2.9 v3 0/3] Use non-blacklisted family/model/stepping for Haswell CPU model
by Eduardo Habkost 10 Mar '17

10 Mar '17

I plan to merge this bug fix into 2.9. Changes v2 -> v3: * Rebase to latest master * Don't touch max_x86_cpu_initfn() to reduce risk post hard freeze Changes v1 -> v2: * Coding style fixes * Make series simpler: * Don't use trick: char vendor[static (CPUID_VENDOR_SZ + 1)] because it confuses checkpatch.pl * Removed patch "Add explicit array size to x86_cpu_vendor_words2str()" * Rebased on top of my x86-next branch: https://github.com/ehabkost/qemu x86-next Git branch for testing: https://github.com/ehabkost/qemu-hacks work/x86-rtm-blacklist Diff from v1: diff --git a/target/i386/cpu.h b/target/i386/cpu.h index cd94726e43..647435a1d9 100644 --- a/target/i386/cpu.h +++ b/target/i386/cpu.h @@ -1431,7 +1431,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count, void cpu_clear_apic_feature(CPUX86State *env); void host_cpuid(uint32_t function, uint32_t count, uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx); -void host_vendor_fms(char vendor[static (CPUID_VENDOR_SZ + 1)], int *family, int *model, int *stepping); +void host_vendor_fms(char *vendor, int *family, int *model, int *stepping); /* helper.c */ int x86_cpu_handle_mmu_fault(CPUState *cpu, vaddr addr, diff --git a/target/i386/cpu.c b/target/i386/cpu.c index 25c6c5e115..eab1ad7935 100644 --- a/target/i386/cpu.c +++ b/target/i386/cpu.c @@ -682,7 +682,7 @@ void host_cpuid(uint32_t function, uint32_t count, *edx = vec[3]; } -void host_vendor_fms(char vendor[static (CPUID_VENDOR_SZ + 1)], int *family, int *model, int *stepping) +void host_vendor_fms(char *vendor, int *family, int *model, int *stepping) { uint32_t eax, ebx, ecx, edx; @@ -1570,7 +1570,8 @@ static void host_x86_cpu_class_init(ObjectClass *oc, void *data) xcc->kvm_required = true; xcc->ordering = 9; - host_vendor_fms(host_cpudef.vendor, &host_cpudef.family, &host_cpudef.model, &host_cpudef.stepping); + host_vendor_fms(host_cpudef.vendor, &host_cpudef.family, + &host_cpudef.model, &host_cpudef.stepping); cpu_x86_fill_model_id(host_cpudef.model_id); --- A recent glibc commit[1] added a blacklist to ensure it won't use TSX on hosts that are known to have a broken TSX implementation. Our existing Haswell CPU model has a blacklisted family/model/stepping combination, so it has to be updated to make sure guests will really use TSX. This is done by patch 5/5. However, to do this safely we need to ensure the host CPU is not a blacklisted one, so we won't mislead guests by exposing known-to-be-good FMS values on a known-to-be-broken host. This is done by patch 3/5. [1] https://sourceware.org/git/?p=glibc.git;a=commit;h=2702856bf45c82cf8e69f206… --- Cc: dgilbert(a)redhat.com Cc: fweimer(a)redhat.com Cc: carlos(a)redhat.com Cc: triegel(a)redhat.com Cc: berrange(a)redhat.com Cc: jdenemar(a)redhat.com Cc: pbonzini(a)redhat.com Eduardo Habkost (3): i386: host_vendor_fms() helper function i386/kvm: Blacklist TSX on known broken hosts i386: Change stepping of Haswell to non-blacklisted value include/hw/i386/pc.h | 5 +++++ target/i386/cpu.h | 1 + target/i386/cpu.c | 21 ++++++++++++++++++++- target/i386/kvm.c | 17 +++++++++++++++++ 4 files changed, 43 insertions(+), 1 deletion(-) -- 2.11.0.259.g40922b1

1 4

[libvirt] [PATCH v3] Document preferred naming conventions
by Daniel P. Berrange 10 Mar '17

10 Mar '17

This documents the preferred conventions for naming files, structs, enums, typedefs and functions. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- Changed in v3: - Clarify function naming wrt verb & subject - Simplify macro naming, since in practice libvirt code doesn't follow any rules consistently aside from having a VIR_ prefix. HACKING | 80 ++++++++++++++++++++++++++++++++++++++++++++ docs/hacking.html.in | 93 ++++++++++++++++++++++++++++++++++++++++++++++++++++ docs/hacking2.xsl | 4 +++ 3 files changed, 177 insertions(+) diff --git a/HACKING b/HACKING index fff003b..2c65985 100644 --- a/HACKING +++ b/HACKING @@ -239,6 +239,86 @@ on the subject, on Richard Jones' guide to working with open source projects <http://people.redhat.com/rjones/how-to-supply-code-to-open-source-projects/>. +Naming conventions +================== +When reading libvirt code, a number of different naming conventions will be +evident due to various changes in thinking over the course of the project's +lifetime. The conventions documented below should be followed when creating +any entirely new files in libvirt. When working on existing files, while it is +desirable to apply these conventions, keeping a consistent style with existing +code in that particular file is generally more important. The overall guiding +principal is that every file, enum, struct, function, macro and typedef name +must have a 'vir' or 'VIR' prefix. All local scope variable names are exempt, +and global variables are exempt, unless exported in a header file. + +*File names* + +File naming varies depending on the subdirectory. The preferred style is to +have a 'vir' prefix, followed by a name which matches the name of the +functions / objects inside the file. For example, a file containing an object +'virHashtable' is stored in files 'virhashtable.c' and 'virhashtable.h'. +Sometimes, methods which would otherwise be declared 'static' need to be +exported for use by a test suite. For this purpose a second header file should +be added with a suffix of 'priv'. e.g. 'virhashtablepriv.h'. Use of +underscores in file names is discouraged when using the 'vir' prefix style. +The 'vir' prefix naming applies to src/util, src/rpc and tests/ directories. +Most other directories do not follow this convention. + + + +*Enum type & field names* + +All enums should have a 'vir' prefix in their typedef name, and each following +word should have its first letter in uppercase. The enum name should match the +typedef name with a leading underscore. The enum member names should be in all +uppercase, and use an underscore to separate each word. The enum member name +prefix should match the enum typedef name. + + typedef enum _virSocketType virSocketType; + enum _virSocketType { + VIR_SOCKET_TYPE_IPV4, + VIR_SOCKET_TYPE_IPV6, + }; + + +*Struct type names* + +All structs should have a 'vir' prefix in their typedef name, and each +following word should have its first letter in uppercase. The struct name +should be the same as the typedef name with a leading underscore. A second +typedef should be given for a pointer to the struct with a 'Ptr' suffix. + + typedef struct _virHashTable virHashTable; + typedef virHashTable *virHashTablePtr; + struct _virHashTable { + ... + }; + + +*Function names* + +All functions should have a 'vir' prefix in their name, followed by one or +more words with first letter of each word capitalized. Underscores should not +be used in function names. If the function is operating on an object, then the +function name prefix should match the object typedef name, otherwise it should +match the filename. Following this comes the verb / action name, and finally +an optional subject name. For example, given an object 'virHashTable', all +functions should have a name 'virHashTable$VERB' or +'virHashTable$VERB$SUBJECT". e.g. 'virHashTableLookup' or +'virHashTableGetValue'. + + + +*Macro names* + +All macros should have a "VIR" prefix in their name, followed by one or more +uppercase words separated by underscores. The macro argument names should be +in lowercase. Aside from having a "VIR" prefix there are no common practices +for the rest of the macro name. + + + + Code indentation ================ Libvirt's C source code generally adheres to some basic code-formatting diff --git a/docs/hacking.html.in b/docs/hacking.html.in index b1bb149..d904c3a 100644 --- a/docs/hacking.html.in +++ b/docs/hacking.html.in @@ -314,6 +314,99 @@ Richard Jones' guide to working with open source projects</a>. </p> + <h2><a name="naming">Naming conventions</a></h2> + + <p> + When reading libvirt code, a number of different naming conventions will + be evident due to various changes in thinking over the course of the + project's lifetime. The conventions documented below should be followed + when creating any entirely new files in libvirt. When working on existing + files, while it is desirable to apply these conventions, keeping a + consistent style with existing code in that particular file is generally + more important. The overall guiding principal is that every file, enum, + struct, function, macro and typedef name must have a 'vir' or 'VIR' prefix. + All local scope variable names are exempt, and global variables are exempt, + unless exported in a header file. + </p> + + <dl> + <dt>File names</dt> + <dd> + <p> + File naming varies depending on the subdirectory. The preferred + style is to have a 'vir' prefix, followed by a name which matches + the name of the functions / objects inside the file. For example, + a file containing an object 'virHashtable' is stored in files + 'virhashtable.c' and 'virhashtable.h'. Sometimes, methods which + would otherwise be declared 'static' need to be exported for use + by a test suite. For this purpose a second header file should be + added with a suffix of 'priv'. e.g. 'virhashtablepriv.h'. Use of + underscores in file names is discouraged when using the 'vir' + prefix style. The 'vir' prefix naming applies to src/util, + src/rpc and tests/ directories. Most other directories do not + follow this convention. + </p> + </dd> + <dt>Enum type & field names</dt> + <dd> + <p> + All enums should have a 'vir' prefix in their typedef name, + and each following word should have its first letter in + uppercase. The enum name should match the typedef name with + a leading underscore. The enum member names should be in all + uppercase, and use an underscore to separate each word. The + enum member name prefix should match the enum typedef name. + </p> + <pre> + typedef enum _virSocketType virSocketType; + enum _virSocketType { + VIR_SOCKET_TYPE_IPV4, + VIR_SOCKET_TYPE_IPV6, + };</pre> + </dd> + <dt>Struct type names</dt> + <dd> + <p> + All structs should have a 'vir' prefix in their typedef name, + and each following word should have its first letter in + uppercase. The struct name should be the same as the typedef + name with a leading underscore. A second typedef should be + given for a pointer to the struct with a 'Ptr' suffix. + </p> + <pre> + typedef struct _virHashTable virHashTable; + typedef virHashTable *virHashTablePtr; + struct _virHashTable { + ... + };</pre> + </dd> + <dt>Function names</dt> + <dd> + <p> + All functions should have a 'vir' prefix in their name, + followed by one or more words with first letter of each + word capitalized. Underscores should not be used in function + names. If the function is operating on an object, then the + function name prefix should match the object typedef name, + otherwise it should match the filename. Following this + comes the verb / action name, and finally an optional + subject name. For example, given an object 'virHashTable', + all functions should have a name 'virHashTable$VERB' or + 'virHashTable$VERB$SUBJECT". e.g. 'virHashTableLookup' + or 'virHashTableGetValue'. + </p> + </dd> + <dt>Macro names</dt> + <dd> + <p> + All macros should have a "VIR" prefix in their name, followed + by one or more uppercase words separated by underscores. The + macro argument names should be in lowercase. Aside from having + a "VIR" prefix there are no common practices for the rest of + the macro name. + </p> + </dd> + </dl> <h2><a name="indent">Code indentation</a></h2> <p> diff --git a/docs/hacking2.xsl b/docs/hacking2.xsl index 3595b7e..7e5ac82 100644 --- a/docs/hacking2.xsl +++ b/docs/hacking2.xsl @@ -114,6 +114,10 @@ from docs/hacking.html.in! <xsl:template match="html:li/html:ul/html:li">-- <xsl:apply-templates/><xsl:value-of select="$newline"/><xsl:value-of select="$newline"/> </xsl:template> +<xsl:template match="html:dl/html:dt">*<xsl:apply-templates/>*<xsl:value-of select="$newline"/><xsl:value-of select="$newline"/> +</xsl:template> +<xsl:template match="html:dl/html:dd"><xsl:apply-templates/><xsl:value-of select="$newline"/><xsl:value-of select="$newline"/> +</xsl:template>  -- 2.9.3

5 7

[libvirt] [PATCH] qemuProcessHandleMonitorEOF: Disable namespace for domain
by Michal Privoznik 10 Mar '17

10 Mar '17

https://bugzilla.redhat.com/show_bug.cgi?id=1430634 If a qemu process has died, we get EOF on its monitor. At this point, since qemu process was the only one running in the namespace kernel has already cleaned the namespace up. Any attempt of ours to enter it has to fail. This really happened in the bug linked above. We've tried to attach a disk to qemu and while we were in the monitor talking to qemu it just died. Therefore our code tried to do some roll back (e.g. deny the device in cgroups again, restore labels, etc.). However, during the roll back (esp. when restoring labels) we still thought that domain has a namespace. So we used secdriver's transactions. This failed as there is no namespace to enter. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_domain.c | 25 +++++++++++++++++++++++++ src/qemu/qemu_domain.h | 3 +++ src/qemu/qemu_process.c | 4 ++++ 3 files changed, 32 insertions(+) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 1a42fcf1b..d5833b026 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -201,6 +201,22 @@ qemuDomainEnableNamespace(virDomainObjPtr vm, } +static void +qemuDomainDisableNamespace(virDomainObjPtr vm, + qemuDomainNamespace ns) +{ + qemuDomainObjPrivatePtr priv = vm->privateData; + + if (priv->namespaces) { + ignore_value(virBitmapClearBit(priv->namespaces, ns)); + if (virBitmapIsAllClear(priv->namespaces)) { + virBitmapFree(priv->namespaces); + priv->namespaces = NULL; + } + } +} + + void qemuDomainEventQueue(virQEMUDriverPtr driver, virObjectEventPtr event) { @@ -7805,6 +7821,15 @@ qemuDomainCreateNamespace(virQEMUDriverPtr driver, } +void +qemuDomainDestroyNamespace(virQEMUDriverPtr driver ATTRIBUTE_UNUSED, + virDomainObjPtr vm) +{ + if (qemuDomainNamespaceEnabled(vm, QEMU_DOMAIN_NS_MOUNT)) + qemuDomainDisableNamespace(vm, QEMU_DOMAIN_NS_MOUNT); +} + + bool qemuDomainNamespaceAvailable(qemuDomainNamespace ns ATTRIBUTE_UNUSED) { diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h index 7fa717390..c646828e6 100644 --- a/src/qemu/qemu_domain.h +++ b/src/qemu/qemu_domain.h @@ -816,6 +816,9 @@ int qemuDomainBuildNamespace(virQEMUDriverConfigPtr cfg, int qemuDomainCreateNamespace(virQEMUDriverPtr driver, virDomainObjPtr vm); +void qemuDomainDestroyNamespace(virQEMUDriverPtr driver, + virDomainObjPtr vm); + bool qemuDomainNamespaceAvailable(qemuDomainNamespace ns); int qemuDomainNamespaceSetupDisk(virQEMUDriverPtr driver, diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index fcba7d309..b9c1847bb 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -314,6 +314,10 @@ qemuProcessHandleMonitorEOF(qemuMonitorPtr mon ATTRIBUTE_UNUSED, */ qemuMonitorUnregister(mon); + /* We don't want any cleanup from EOF handler (or any other + * thread) to enter qemu namespace. */ + qemuDomainDestroyNamespace(driver, vm); + cleanup: virObjectUnlock(vm); } -- 2.11.0

2 2

[libvirt] [PATCH] qemuxml2argvtest: Don't overwrite driver stateDir
by Michal Privoznik 10 Mar '17

10 Mar '17

This is a very historic artefact. Back in the old days of 830ba76c3e when we had macros to add arguments onto qemu command line (!) we thought it was a good idea to let qemu write out the PID file. So we passed -pidfile $stateDir/$domName onto the command line. Thus, in order for tests to work we needed stable stateDir in the qemu driver. Unfortunately, after 16efa11aa696 where stateDir is mkdtemp()-d, this approach lead to a leak of temp dir. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tests/qemuxml2argvtest.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index d2d267fce..00b0e25cd 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -581,9 +581,6 @@ mymain(void) if (VIR_STRDUP_QUIET(driver.config->chardevTLSx509certdir, "/etc/pki/libvirt-chardev") < 0) return EXIT_FAILURE; - VIR_FREE(driver.config->stateDir); - if (VIR_STRDUP_QUIET(driver.config->stateDir, "/nowhere") < 0) - return EXIT_FAILURE; VIR_FREE(driver.config->hugetlbfs); if (VIR_ALLOC_N(driver.config->hugetlbfs, 2) < 0) return EXIT_FAILURE; -- 2.11.0

2 1

[libvirt] [PATCH 0/2] qemu: properly handle delayed vCPU hotunplug
by Peter Krempa 10 Mar '17

10 Mar '17

Patch 1 would help in debugging this issue. Patch 2 fixes the bug. Peter Krempa (2): qemu: hotplug: Add debug log when dispatching device removal to existing thread qemu: hotplug: Reset device removal waiting code after vCPU unplug src/qemu/qemu_hotplug.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) -- 2.12.0

3 6

[libvirt] [RFC PATCH 0/2] qemu: Fix ACPI on aarch64
by Andrea Bolognani 09 Mar '17

09 Mar '17

Posted as RFC due to the concerns outlined in patch 1. Andrea Bolognani (2): qemu: Advertise ACPI support for aarch64 guests tests: Initialize basic capabilities properly src/qemu/qemu_capabilities.c | 30 +++++++++++++++++----- .../caps_2.6.0-gicv2.aarch64.xml | 1 + .../caps_2.6.0-gicv3.aarch64.xml | 1 + .../qemuxml2argv-balloon-ccw-deflate.args | 1 - .../qemuxml2argv-console-sclp.args | 1 - .../qemuxml2argv-console-virtio-ccw.args | 1 - .../qemuxml2argv-console-virtio-s390.args | 1 - .../qemuxml2argv-cpu-s390-features.args | 1 - .../qemuxml2argv-cpu-s390-zEC12.args | 1 - .../qemuxml2argv-disk-virtio-ccw-many.args | 1 - .../qemuxml2argv-disk-virtio-ccw.args | 1 - .../qemuxml2argv-disk-virtio-s390.args | 1 - .../qemuxml2argv-disk-virtio-scsi-ccw.args | 1 - tests/qemuxml2argvdata/qemuxml2argv-fs9p-ccw.args | 1 - .../qemuxml2argv-hostdev-scsi-vhost-scsi-ccw.args | 1 - .../qemuxml2argv-hugepages-numa.args | 1 + .../qemuxml2argv-iothreads-disk-virtio-ccw.args | 1 - .../qemuxml2argv-iothreads-virtio-scsi-ccw.args | 1 - .../qemuxml2argv-machine-aeskeywrap-off-cap.args | 1 - .../qemuxml2argv-machine-aeskeywrap-off-caps.args | 1 - .../qemuxml2argv-machine-aeskeywrap-on-cap.args | 1 - .../qemuxml2argv-machine-aeskeywrap-on-caps.args | 1 - .../qemuxml2argv-machine-deakeywrap-off-cap.args | 1 - .../qemuxml2argv-machine-deakeywrap-off-caps.args | 1 - .../qemuxml2argv-machine-deakeywrap-on-cap.args | 1 - .../qemuxml2argv-machine-deakeywrap-on-caps.args | 1 - .../qemuxml2argv-machine-keywrap-none-caps.args | 1 - .../qemuxml2argv-machine-keywrap-none.args | 1 - .../qemuxml2argv-memory-hotplug-ppc64-nonuma.args | 1 - .../qemuxml2argv-net-virtio-ccw.args | 1 - .../qemuxml2argv-net-virtio-s390.args | 1 - tests/qemuxml2argvdata/qemuxml2argv-ppc-dtb.args | 1 - .../qemuxml2argv-ppce500-serial.args | 1 - .../qemuxml2argv-pseries-basic.args | 1 - .../qemuxml2argv-pseries-cpu-compat.args | 1 - .../qemuxml2argv-pseries-cpu-exact.args | 1 - .../qemuxml2argv-pseries-cpu-le.args | 1 - .../qemuxml2argv-pseries-nvram.args | 1 - .../qemuxml2argv-pseries-panic-missing.args | 1 - .../qemuxml2argv-pseries-panic-no-address.args | 1 - .../qemuxml2argv-pseries-usb-default.args | 1 - .../qemuxml2argv-pseries-usb-kbd.args | 1 - .../qemuxml2argv-pseries-usb-multi.args | 1 - .../qemuxml2argv-pseries-vio-user-assigned.args | 1 - .../qemuxml2argvdata/qemuxml2argv-pseries-vio.args | 1 - .../qemuxml2argv-q35-virt-manager-basic.args | 1 + ...muxml2argv-s390-allow-bogus-usb-controller.args | 1 - .../qemuxml2argv-s390-allow-bogus-usb-none.args | 1 - .../qemuxml2argv-s390-panic-missing.args | 1 - .../qemuxml2argv-s390-panic-no-address.args | 1 - .../qemuxml2argv-virtio-rng-ccw.args | 1 - .../qemuxml2argv-watchdog-diag288.args | 1 - tests/qemuxml2argvtest.c | 16 ++++++++++-- 53 files changed, 41 insertions(+), 56 deletions(-) -- 2.7.4

3 9

[libvirt] [PATCH v2] Revert "conf: move iothread XML validation from qemu_command"
by Pavel Hrdina 09 Mar '17

09 Mar '17

This reverts commit c96bd78e4e71c799dc391566fa9f0652dec55dca. So our code is one big mess and we modify domain definition while building qemu_command line and our hotplug code share only part of the parsing and command line building code. Let's revert that change because to fix it properly would require refactor and move a lot of things. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1430275 --- src/conf/domain_conf.c | 62 ++------------------------------ src/qemu/qemu_command.c | 96 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 99 insertions(+), 59 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index a58f997621..569becb99d 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -4737,8 +4737,7 @@ virDomainDiskAddressDiskBusCompatibility(virDomainDiskBus bus, static int -virDomainDiskDefValidate(const virDomainDef *def, - const virDomainDiskDef *disk) +virDomainDiskDefValidate(const virDomainDiskDef *disk) { /* Validate LUN configuration */ if (disk->device == VIR_DOMAIN_DISK_DEVICE_LUN) { @@ -4768,24 +4767,6 @@ virDomainDiskDefValidate(const virDomainDef *def, return -1; } - if (disk->iothread > 0) { - if (disk->bus != VIR_DOMAIN_DISK_BUS_VIRTIO || - (disk->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI && - disk->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_CCW)) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("IOThreads are only available for virtio pci and " - "virtio ccw disk")); - return -1; - } - - if (!virDomainIOThreadIDFind(def, disk->iothread)) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, - _("Invalid IOThread id '%u' for disk '%s'"), - disk->iothread, disk->dst); - return -1; - } - } - return 0; } @@ -4837,47 +4818,12 @@ virDomainNetDefValidate(const virDomainNetDef *net) static int -virDomainControllerDefValidate(const virDomainDef *def, - const virDomainControllerDef *cont) -{ - if (cont->iothread > 0) { - if (cont->type != VIR_DOMAIN_CONTROLLER_TYPE_SCSI || - cont->model != VIR_DOMAIN_CONTROLLER_MODEL_SCSI_VIRTIO_SCSI) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, - _("IOThreads are only supported for virtio-scsi " - "controllers, model is '%s'"), - virDomainControllerModelSCSITypeToString(cont->model)); - return -1; - } - - if (cont->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI && - cont->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_CCW) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("IOThreads are only available for virtio pci and " - "virtio ccw controllers")); - return -1; - } - - if (!virDomainIOThreadIDFind(def, cont->iothread)) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, - _("Invalid IOThread id '%u' for controller '%s'"), - cont->iothread, - virDomainControllerTypeToString(cont->type)); - return -1; - } - } - - return 0; -} - - -static int virDomainDeviceDefValidateInternal(const virDomainDeviceDef *dev, const virDomainDef *def) { switch ((virDomainDeviceType) dev->type) { case VIR_DOMAIN_DEVICE_DISK: - return virDomainDiskDefValidate(def, dev->data.disk); + return virDomainDiskDefValidate(dev->data.disk); case VIR_DOMAIN_DEVICE_REDIRDEV: return virDomainRedirdevDefValidate(def, dev->data.redirdev); @@ -4885,9 +4831,6 @@ virDomainDeviceDefValidateInternal(const virDomainDeviceDef *dev, case VIR_DOMAIN_DEVICE_NET: return virDomainNetDefValidate(dev->data.net) - case VIR_DOMAIN_DEVICE_CONTROLLER: - return virDomainControllerDefValidate(def, dev->data.controller); - case VIR_DOMAIN_DEVICE_LEASE: case VIR_DOMAIN_DEVICE_FS: case VIR_DOMAIN_DEVICE_INPUT: @@ -4895,6 +4838,7 @@ virDomainDeviceDefValidateInternal(const virDomainDeviceDef *dev, case VIR_DOMAIN_DEVICE_VIDEO: case VIR_DOMAIN_DEVICE_HOSTDEV: case VIR_DOMAIN_DEVICE_WATCHDOG: + case VIR_DOMAIN_DEVICE_CONTROLLER: case VIR_DOMAIN_DEVICE_GRAPHICS: case VIR_DOMAIN_DEVICE_HUB: case VIR_DOMAIN_DEVICE_SMARTCARD: diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 6545a93259..145a0127f2 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -1871,6 +1871,49 @@ qemuBuildDriveStr(virDomainDiskDefPtr disk, } +static bool +qemuCheckIOThreads(const virDomainDef *def, + virDomainDiskDefPtr disk) +{ + /* Right "type" of disk" */ + switch ((virDomainDiskBus)disk->bus) { + case VIR_DOMAIN_DISK_BUS_VIRTIO: + if (disk->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI && + disk->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_CCW) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("IOThreads only available for virtio pci and " + "virtio ccw disk")); + return false; + } + break; + + case VIR_DOMAIN_DISK_BUS_IDE: + case VIR_DOMAIN_DISK_BUS_FDC: + case VIR_DOMAIN_DISK_BUS_SCSI: + case VIR_DOMAIN_DISK_BUS_XEN: + case VIR_DOMAIN_DISK_BUS_USB: + case VIR_DOMAIN_DISK_BUS_UML: + case VIR_DOMAIN_DISK_BUS_SATA: + case VIR_DOMAIN_DISK_BUS_SD: + case VIR_DOMAIN_DISK_BUS_LAST: + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("IOThreads not available for bus %s target %s"), + virDomainDiskBusTypeToString(disk->bus), disk->dst); + return false; + } + + /* Can we find the disk iothread in the iothreadid list? */ + if (!virDomainIOThreadIDFind(def, disk->iothread)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("Disk iothread '%u' not defined in iothreadid"), + disk->iothread); + return false; + } + + return true; +} + + char * qemuBuildDriveDevStr(const virDomainDef *def, virDomainDiskDefPtr disk, @@ -1889,6 +1932,9 @@ qemuBuildDriveDevStr(const virDomainDef *def, if (!qemuCheckCCWS390AddressSupport(def, disk->info, qemuCaps, disk->dst)) goto error; + if (disk->iothread && !qemuCheckIOThreads(def, disk)) + goto error; + switch (disk->bus) { case VIR_DOMAIN_DISK_BUS_IDE: if (disk->info.addr.drive.target != 0) { @@ -2521,6 +2567,52 @@ qemuBuildUSBControllerDevStr(virDomainControllerDefPtr def, } +/* qemuCheckSCSIControllerIOThreads: + * @domainDef: Pointer to domain def + * @def: Pointer to controller def + * @qemuCaps: Capabilities + * + * If this controller definition has iothreads set, let's make sure the + * configuration is right before adding to the command line + * + * Returns true if either supported or there are no iothreads for controller; + * otherwise, returns false if configuration is not quite right. + */ +static bool +qemuCheckSCSIControllerIOThreads(const virDomainDef *domainDef, + virDomainControllerDefPtr def) +{ + if (!def->iothread) + return true; + + if (def->model != VIR_DOMAIN_CONTROLLER_MODEL_SCSI_VIRTIO_SCSI) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("IOThreads only supported for virtio-scsi " + "controllers model is '%s'"), + virDomainControllerModelSCSITypeToString(def->model)); + return false; + } + + if (def->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI && + def->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_CCW) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("IOThreads only available for virtio pci and " + "virtio ccw controllers")); + return false; + } + + /* Can we find the controller iothread in the iothreadid list? */ + if (!virDomainIOThreadIDFind(domainDef, def->iothread)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("controller iothread '%u' not defined in iothreadid"), + def->iothread); + return false; + } + + return true; +} + + char * qemuBuildControllerDevStr(const virDomainDef *domainDef, virDomainControllerDefPtr def, @@ -2571,6 +2663,8 @@ qemuBuildControllerDevStr(const virDomainDef *domainDef, if (def->info.type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_CCW) { virBufferAddLit(&buf, "virtio-scsi-ccw"); if (def->iothread) { + if (!qemuCheckSCSIControllerIOThreads(domainDef, def)) + goto error; virBufferAsprintf(&buf, ",iothread=iothread%u", def->iothread); } @@ -2583,6 +2677,8 @@ qemuBuildControllerDevStr(const virDomainDef *domainDef, } else { virBufferAddLit(&buf, "virtio-scsi-pci"); if (def->iothread) { + if (!qemuCheckSCSIControllerIOThreads(domainDef, def)) + goto error; virBufferAsprintf(&buf, ",iothread=iothread%u", def->iothread); } -- 2.12.0

2 1

[libvirt] Revisiting qemu monitor timeout on VM start
by Jim Fehlig 09 Mar '17

09 Mar '17

Hi All, Encountering a qemu monitor timeout when starting a VM has been discussed here before, e.g. https://www.redhat.com/archives/libvir-list/2014-January/msg00060.html https://www.redhat.com/archives/libvir-list/2014-January/msg00408.html Recently I've received reports of the same when starting large memory VMs backed by 1G huge pages. In one of the reports, Matt timed how long it takes to allocate 402GB worth of hugetlbfs pages (these are 1G pages, but the time is similar for 2M): real 105.47 user 0.05 sys 105.42 The time is spent entirely in the kernel zero'ing pages and as you can see it exceeds the 30 second monitor timeout in libvirt. Do folks have any suggestions on how to avoid the timeout? Obviously one solution is to introduce a knob in qemu.conf to control the timeout, as was proposed in the above threads. Another solution that came to mind is changing qemu to open the monitor earlier, making it available while the kernel is off scrubbing pages. I'm not familiar enough with qemu code to know if such a change is possible, but given the amount of initialization done in main() prior to calling mon_init_func(), my confidence in this idea is low. Perhaps someone more familiar with qemu initialization can comment on that. Thanks in advance for comments on these ideas or alternate proposals! Regards, Jim

3 2

[libvirt] [PATCH] configure: disable scsi stroage driver on non-Linux
by Roman Bogorodskiy 09 Mar '17

09 Mar '17

Even though scsi storage driver builds fine on non-Linux, it will not work properly because it relies on Linux procfs, so disable that in configure if we're not building for Linux. --- configure.ac | 1 + 1 file changed, 1 insertion(+) diff --git a/configure.ac b/configure.ac index e61ab7ba6..cf50422d5 100644 --- a/configure.ac +++ b/configure.ac @@ -192,6 +192,7 @@ if test $with_linux = no; then with_lxc=no fi with_dtrace=no + with_storage_scsi=no fi if test $with_freebsd = yes; then -- 2.11.0

2 2

[libvirt] [PATCH v2 00/14] Introduce NVDIMM support
by Michal Privoznik 09 Mar '17

09 Mar '17

v2 of: https://www.redhat.com/archives/libvir-list/2017-February/msg01229.html How to test this feature? $ > /tmp/nvdimm $ truncate --size 512M /tmp/nvdimm $ virsh edit $mydom <memory model='nvdimm' access='shared'> <source> <path>/tmp/nvdimm</path> </source> <target> <size unit='MiB'>512</size> <node>0</node> <label> <size unit='KiB'>128</size> </label> </target> <address type='dimm' slot='0'/> </memory> $ virsh start $mydom $ ssh $mydom "echo \"Hello world\" > /dev/pmem0" $ hexdump -C /tmp/nvdimm 00000000 48 65 6c 6c 6f 20 77 6f 72 6c 64 0a 00 00 00 00 |Hello world.....| 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 20000000 Michal Privoznik (14): qemuBuildMemoryBackendStr: Reorder args and update comment Introduce NVDIMM memory model qemu: Introduce QEMU_CAPS_DEVICE_NVDIMM qemu: Implement NVDIMM conf: Introduce @access to <memory/> qemu: Implement @access for <memory/> banks qemu: Introduce label-size for NVDIMMs security_dac: Label host side of NVDIMM security_selinux: Label host side of NVDIMM security: Introduce internal APIs for memdev labelling secdrivers: Implement memdev relabel APIs qemu_hotplug: Relabel memdev qemu: Allow nvdimm in devices CGroups qemu: Namespaces for NVDIMM docs/formatdomain.html.in | 79 ++++++++--- docs/schemas/domaincommon.rng | 47 +++++-- src/conf/domain_conf.c | 131 +++++++++++++---- src/conf/domain_conf.h | 5 + src/libvirt_private.syms | 2 + src/qemu/qemu_alias.c | 10 +- src/qemu/qemu_capabilities.c | 9 ++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_cgroup.c | 49 +++++++ src/qemu/qemu_cgroup.h | 4 + src/qemu/qemu_command.c | 155 +++++++++++++++------ src/qemu/qemu_command.h | 16 ++- src/qemu/qemu_domain.c | 105 +++++++++++++- src/qemu/qemu_domain.h | 8 ++ src/qemu/qemu_hotplug.c | 42 +++++- src/qemu/qemu_security.c | 56 ++++++++ src/qemu/qemu_security.h | 8 ++ src/security/security_dac.c | 76 ++++++++++ src/security/security_driver.h | 9 ++ src/security/security_manager.c | 56 ++++++++ src/security/security_manager.h | 7 + src/security/security_nop.c | 19 +++ src/security/security_selinux.c | 69 +++++++++ src/security/security_stack.c | 38 +++++ .../qemuxml2argv-memory-hotplug-nvdimm-access.args | 26 ++++ .../qemuxml2argv-memory-hotplug-nvdimm-access.xml | 56 ++++++++ .../qemuxml2argv-memory-hotplug-nvdimm-label.args | 26 ++++ .../qemuxml2argv-memory-hotplug-nvdimm-label.xml | 59 ++++++++ .../qemuxml2argv-memory-hotplug-nvdimm.args | 26 ++++ .../qemuxml2argv-memory-hotplug-nvdimm.xml | 56 ++++++++ tests/qemuxml2argvtest.c | 8 +- ...qemuxml2xmlout-memory-hotplug-nvdimm-access.xml | 1 + .../qemuxml2xmlout-memory-hotplug-nvdimm-label.xml | 1 + .../qemuxml2xmlout-memory-hotplug-nvdimm.xml | 1 + tests/qemuxml2xmltest.c | 3 + 35 files changed, 1144 insertions(+), 120 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-memory-hotplug-nvdimm-access.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-memory-hotplug-nvdimm-access.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-memory-hotplug-nvdimm-label.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-memory-hotplug-nvdimm-label.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-memory-hotplug-nvdimm.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-memory-hotplug-nvdimm.xml create mode 120000 tests/qemuxml2xmloutdata/qemuxml2xmlout-memory-hotplug-nvdimm-access.xml create mode 120000 tests/qemuxml2xmloutdata/qemuxml2xmlout-memory-hotplug-nvdimm-label.xml create mode 120000 tests/qemuxml2xmloutdata/qemuxml2xmlout-memory-hotplug-nvdimm.xml -- 2.11.0

2 37

[libvirt] [PATCH] domain_conf: move iothread check for address type back to qemu_command
by Pavel Hrdina 09 Mar '17

09 Mar '17

This partially reverts commit c96bd78e4e. If an API virDomainAttachDevice(Flags) is used the device address is assigned after the validation and the address type may not be set. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1430275 Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/conf/domain_conf.c | 18 ++++-------------- src/qemu/qemu_command.c | 22 ++++++++++++++++++++++ 2 files changed, 26 insertions(+), 14 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 97d42fe993..747706e673 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -4769,12 +4769,10 @@ virDomainDiskDefValidate(const virDomainDef *def, } if (disk->iothread > 0) { - if (disk->bus != VIR_DOMAIN_DISK_BUS_VIRTIO || - (disk->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI && - disk->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_CCW)) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("IOThreads are only available for virtio pci and " - "virtio ccw disk")); + if (disk->bus != VIR_DOMAIN_DISK_BUS_VIRTIO) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("IOThreads are not available for bus '%s', disk '%s'"), + virDomainDiskBusTypeToString(disk->bus), disk->dst); return -1; } @@ -4850,14 +4848,6 @@ virDomainControllerDefValidate(const virDomainDef *def, return -1; } - if (cont->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI && - cont->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_CCW) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("IOThreads are only available for virtio pci and " - "virtio ccw controllers")); - return -1; - } - if (!virDomainIOThreadIDFind(def, cont->iothread)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Invalid IOThread id '%u' for controller '%s'"), diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 6545a93259..b49242a7df 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -1871,6 +1871,21 @@ qemuBuildDriveStr(virDomainDiskDefPtr disk, } +static int +qemuBuildCheckIOThreadAddress(virDomainDeviceInfo info) +{ + if (info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI && + info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_CCW) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("IOThreads are only available for virtio pci and " + "virtio ccw")); + return -1; + } + + return 0; +} + + char * qemuBuildDriveDevStr(const virDomainDef *def, virDomainDiskDefPtr disk, @@ -1889,6 +1904,9 @@ qemuBuildDriveDevStr(const virDomainDef *def, if (!qemuCheckCCWS390AddressSupport(def, disk->info, qemuCaps, disk->dst)) goto error; + if (disk->iothread > 0 && qemuBuildCheckIOThreadAddress(disk->info) < 0) + goto error; + switch (disk->bus) { case VIR_DOMAIN_DISK_BUS_IDE: if (disk->info.addr.drive.target != 0) { @@ -2571,6 +2589,8 @@ qemuBuildControllerDevStr(const virDomainDef *domainDef, if (def->info.type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_CCW) { virBufferAddLit(&buf, "virtio-scsi-ccw"); if (def->iothread) { + if (qemuBuildCheckIOThreadAddress(def->info) < 0) + goto error; virBufferAsprintf(&buf, ",iothread=iothread%u", def->iothread); } @@ -2583,6 +2603,8 @@ qemuBuildControllerDevStr(const virDomainDef *domainDef, } else { virBufferAddLit(&buf, "virtio-scsi-pci"); if (def->iothread) { + if (qemuBuildCheckIOThreadAddress(def->info) < 0) + goto error; virBufferAsprintf(&buf, ",iothread=iothread%u", def->iothread); } -- 2.12.0

2 1

[libvirt] [PATCH] doc updates
by Philipp Hahn 09 Mar '17

09 Mar '17

3 13

[libvirt] Making containers creation easy
by Cedric Bosdonnat 09 Mar '17

09 Mar '17

Hi all, I've worked on making the containers rootfs creation easy. Here is a wrap-up of my work: http://bosdonnat.fr/system-container-images.html Any opinion on that? Anything to do to move it forward? -- Cedric

3 4

[libvirt] [PATCH v2 0/2] fix migration related graphics listen code bugs
by Pavel Hrdina 09 Mar '17

09 Mar '17

Pavel Hrdina (2): conf: store "autoGenerated" for graphics listen in status XML conf: properly skip graphics listen element in migratable XML src/conf/domain_conf.c | 20 +++++++++++++++++++- src/qemu/qemu_domain.c | 3 ++- 2 files changed, 21 insertions(+), 2 deletions(-) -- 2.12.0

2 3

[libvirt] [PATCH v2 00/10] perf: Add software perf events
by Nitesh Konkar 09 Mar '17

09 Mar '17

This patch series adds software perf events. The perl and go patches shall follow shortly. Nitesh Konkar (10): perf: add cpu_clock software perf event support perf: add task_clock software perf event support perf: add page_faults software perf event support perf: add context_switches software perf event support perf: add cpu_migrations software perf event support perf: add page_faults_min software perf event support perf: add page_faults_maj software perf event support perf: add alignment_faults software perf event support perf: add emulation_faults software perf event support news: Update the news.xml about perf events added docs/formatdomain.html.in | 74 +++++++++++++++++++++++ docs/news.xml | 11 ++++ docs/schemas/domaincommon.rng | 9 +++ include/libvirt/libvirt-domain.h | 92 +++++++++++++++++++++++++++++ src/libvirt-domain.c | 25 ++++++++ src/qemu/qemu_driver.c | 9 +++ src/util/virperf.c | 33 ++++++++++- src/util/virperf.h | 9 +++ tests/genericxml2xmlindata/generic-perf.xml | 9 +++ tools/virsh.pod | 27 +++++++++ 10 files changed, 297 insertions(+), 1 deletion(-) -- 1.9.3

3 14

[libvirt] [PATCH 0/2] fix migration related graphics listen code bugs
by Pavel Hrdina 09 Mar '17

09 Mar '17

Pavel Hrdina (2): conf: store "autoGenerated" for graphics listen in status XML conf: properly skip graphics listen element in migratable XML src/conf/domain_conf.c | 18 +++++++++++++++++- src/qemu/qemu_domain.c | 3 ++- 2 files changed, 19 insertions(+), 2 deletions(-) -- 2.11.1

2 3

[libvirt] ANNOUNCE: virt-manager 1.4.1 released
by Cole Robinson 09 Mar '17

09 Mar '17

I'm happy to announce the release of virt-manager 1.4.1! virt-manager is a desktop application for managing KVM, Xen, and LXC virtualization via libvirt. The release can be downloaded from: http://virt-manager.org/download/ This release includes: - storage/nodedev event API support (Jovanka Gulicoska) - UI options for enabling spice GL (Marc-André Lureau) - Add default virtio-rng /dev/urandom for supported guest OS - Cloning and rename support for UEFI VMs (Pavel Hrdina) - libguestfs inspection UI improvements (Pino Toscano) - virt-install: Add --qemu-commandline - virt-install: Add --network vhostuser (Chen Hanxiao) - virt-install: Add --sysinfo (Charles Arnold) Thanks to everyone who has contributed to this release through testing, bug reporting, submitting patches, and otherwise sending in feedback! Thanks, Cole

1 0

[libvirt] [PATCH] qemu: Rename variable
by John Ferlan 08 Mar '17

08 Mar '17

Rename 'secretUsageType' to 'usageType' since it's superfluous in an API qemu*Secret* Signed-off-by: John Ferlan <jferlan(a)redhat.com> --- Pushed as trivial - based upon Jirka's review comment from patch 1 of the "Alter TLS/UUID algorithms to be a bit more generic" series. src/qemu/qemu_domain.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index bffb8ac..4d184d3 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -965,7 +965,7 @@ qemuDomainChrSourcePrivateDispose(void *obj) /* qemuDomainSecretPlainSetup: * @conn: Pointer to connection * @secinfo: Pointer to secret info - * @secretUsageType: The virSecretUsageType + * @usageType: The virSecretUsageType * @username: username to use for authentication (may be NULL) * @seclookupdef: Pointer to seclookupdef data * @@ -976,7 +976,7 @@ qemuDomainChrSourcePrivateDispose(void *obj) static int qemuDomainSecretPlainSetup(virConnectPtr conn, qemuDomainSecretInfoPtr secinfo, - virSecretUsageType secretUsageType, + virSecretUsageType usageType, const char *username, virSecretLookupTypeDefPtr seclookupdef) { @@ -984,7 +984,7 @@ qemuDomainSecretPlainSetup(virConnectPtr conn, if (VIR_STRDUP(secinfo->s.plain.username, username) < 0) return -1; - return virSecretGetSecretString(conn, seclookupdef, secretUsageType, + return virSecretGetSecretString(conn, seclookupdef, usageType, &secinfo->s.plain.secret, &secinfo->s.plain.secretlen); } @@ -995,7 +995,7 @@ qemuDomainSecretPlainSetup(virConnectPtr conn, * @priv: pointer to domain private object * @secinfo: Pointer to secret info * @srcalias: Alias of the disk/hostdev used to generate the secret alias - * @secretUsageType: The virSecretUsageType + * @usageType: The virSecretUsageType * @username: username to use for authentication (may be NULL) * @seclookupdef: Pointer to seclookupdef data * @isLuks: True/False for is for luks (alias generation) @@ -1009,7 +1009,7 @@ qemuDomainSecretAESSetup(virConnectPtr conn, qemuDomainObjPrivatePtr priv, qemuDomainSecretInfoPtr secinfo, const char *srcalias, - virSecretUsageType secretUsageType, + virSecretUsageType usageType, const char *username, virSecretLookupTypeDefPtr seclookupdef, bool isLuks) @@ -1038,7 +1038,7 @@ qemuDomainSecretAESSetup(virConnectPtr conn, goto cleanup; /* Grab the unencoded secret */ - if (virSecretGetSecretString(conn, seclookupdef, secretUsageType, + if (virSecretGetSecretString(conn, seclookupdef, usageType, &secret, &secretlen) < 0) goto cleanup; @@ -1072,7 +1072,7 @@ qemuDomainSecretAESSetup(virConnectPtr conn, * @priv: pointer to domain private object * @secinfo: Pointer to secret info * @srcalias: Alias of the disk/hostdev used to generate the secret alias - * @secretUsageType: The virSecretUsageType + * @usageType: The virSecretUsageType * @username: username to use for authentication (may be NULL) * @seclookupdef: Pointer to seclookupdef data * @isLuks: True when is luks (generates different alias) @@ -1089,22 +1089,22 @@ qemuDomainSecretSetup(virConnectPtr conn, qemuDomainObjPrivatePtr priv, qemuDomainSecretInfoPtr secinfo, const char *srcalias, - virSecretUsageType secretUsageType, + virSecretUsageType usageType, const char *username, virSecretLookupTypeDefPtr seclookupdef, bool isLuks) { if (virCryptoHaveCipher(VIR_CRYPTO_CIPHER_AES256CBC) && virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_OBJECT_SECRET) && - (secretUsageType == VIR_SECRET_USAGE_TYPE_CEPH || - secretUsageType == VIR_SECRET_USAGE_TYPE_VOLUME || - secretUsageType == VIR_SECRET_USAGE_TYPE_TLS)) { + (usageType == VIR_SECRET_USAGE_TYPE_CEPH || + usageType == VIR_SECRET_USAGE_TYPE_VOLUME || + usageType == VIR_SECRET_USAGE_TYPE_TLS)) { if (qemuDomainSecretAESSetup(conn, priv, secinfo, srcalias, - secretUsageType, username, + usageType, username, seclookupdef, isLuks) < 0) return -1; } else { - if (qemuDomainSecretPlainSetup(conn, secinfo, secretUsageType, + if (qemuDomainSecretPlainSetup(conn, secinfo, usageType, username, seclookupdef) < 0) return -1; } @@ -1253,14 +1253,14 @@ qemuDomainSecretDiskPrepare(virConnectPtr conn, qemuDomainDiskPrivatePtr diskPriv = QEMU_DOMAIN_DISK_PRIVATE(disk); if (qemuDomainSecretDiskCapable(src)) { - virSecretUsageType secretUsageType = VIR_SECRET_USAGE_TYPE_ISCSI; + virSecretUsageType usageType = VIR_SECRET_USAGE_TYPE_ISCSI; if (src->protocol == VIR_STORAGE_NET_PROTOCOL_RBD) - secretUsageType = VIR_SECRET_USAGE_TYPE_CEPH; + usageType = VIR_SECRET_USAGE_TYPE_CEPH; if (!(diskPriv->secinfo = qemuDomainSecretInfoNew(conn, priv, disk->info.alias, - secretUsageType, src->auth->username, + usageType, src->auth->username, &src->auth->seclookupdef, false))) return -1; } -- 2.9.3

1 0

[libvirt] [PATCH] tests: Add storagevol tests for format=iso
by Cole Robinson 08 Mar '17

08 Mar '17

Demonstrates the bug fix in commit 0e5db762627 --- tests/storagevolxml2argvdata/iso-input.argv | 1 + tests/storagevolxml2argvdata/iso.argv | 1 + tests/storagevolxml2argvtest.c | 7 +++++++ tests/storagevolxml2xmlin/vol-file-iso.xml | 10 ++++++++++ tests/storagevolxml2xmlout/vol-file-iso.xml | 11 +++++++++++ tests/storagevolxml2xmltest.c | 1 + 6 files changed, 31 insertions(+) create mode 100644 tests/storagevolxml2argvdata/iso-input.argv create mode 100644 tests/storagevolxml2argvdata/iso.argv create mode 100644 tests/storagevolxml2xmlin/vol-file-iso.xml create mode 100644 tests/storagevolxml2xmlout/vol-file-iso.xml diff --git a/tests/storagevolxml2argvdata/iso-input.argv b/tests/storagevolxml2argvdata/iso-input.argv new file mode 100644 index 0000000..333d7e6 --- /dev/null +++ b/tests/storagevolxml2argvdata/iso-input.argv @@ -0,0 +1 @@ +qemu-img convert -f raw -O raw /var/lib/libvirt/images/test.iso /var/lib/libvirt/images/sparse.img \ No newline at end of file diff --git a/tests/storagevolxml2argvdata/iso.argv b/tests/storagevolxml2argvdata/iso.argv new file mode 100644 index 0000000..40b99c5 --- /dev/null +++ b/tests/storagevolxml2argvdata/iso.argv @@ -0,0 +1 @@ +qemu-img create -f raw /var/lib/libvirt/images/test.iso 1024K \ No newline at end of file diff --git a/tests/storagevolxml2argvtest.c b/tests/storagevolxml2argvtest.c index bf9dbe5..24c3bac 100644 --- a/tests/storagevolxml2argvtest.c +++ b/tests/storagevolxml2argvtest.c @@ -272,6 +272,13 @@ mymain(void) "pool-dir", "vol-qcow2-nocapacity-backing", NULL, NULL, "qcow2-nocapacity", 0, FMT_OPTIONS); + DO_TEST("pool-dir", "vol-file-iso", + NULL, NULL, + "iso", 0, FMT_OPTIONS); + DO_TEST("pool-dir", "vol-file", + "pool-dir", "vol-file-iso", + "iso-input", 0, FMT_OPTIONS); + return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; } diff --git a/tests/storagevolxml2xmlin/vol-file-iso.xml b/tests/storagevolxml2xmlin/vol-file-iso.xml new file mode 100644 index 0000000..b1f0756 --- /dev/null +++ b/tests/storagevolxml2xmlin/vol-file-iso.xml @@ -0,0 +1,10 @@ +<volume> + <name>test.iso</name> + <source/> + <capacity unit="MiB">1</capacity> + <allocation unit="MiB">1</allocation> + <target> + <format type='iso'/> + <path>/var/lib/libvirt/images/test.iso</path> + </target> +</volume> diff --git a/tests/storagevolxml2xmlout/vol-file-iso.xml b/tests/storagevolxml2xmlout/vol-file-iso.xml new file mode 100644 index 0000000..9783124 --- /dev/null +++ b/tests/storagevolxml2xmlout/vol-file-iso.xml @@ -0,0 +1,11 @@ +<volume type='file'> + <name>test.iso</name> + <source> + </source> + <capacity unit='bytes'>1048576</capacity> + <allocation unit='bytes'>1048576</allocation> + <target> + <path>/var/lib/libvirt/images/test.iso</path> + <format type='iso'/> + </target> +</volume> diff --git a/tests/storagevolxml2xmltest.c b/tests/storagevolxml2xmltest.c index db82bea..18e8016 100644 --- a/tests/storagevolxml2xmltest.c +++ b/tests/storagevolxml2xmltest.c @@ -100,6 +100,7 @@ mymain(void) DO_TEST("pool-dir", "vol-file"); DO_TEST("pool-dir", "vol-file-naming"); DO_TEST("pool-dir", "vol-file-backing"); + DO_TEST("pool-dir", "vol-file-iso"); DO_TEST("pool-dir", "vol-qcow2"); DO_TEST("pool-dir", "vol-qcow2-1.1"); DO_TEST("pool-dir", "vol-qcow2-lazy"); -- 2.9.3

2 1

[libvirt] [PATCH] Make use of PERF_COUNT_HW_REF_CPU_CYCLES conditional
by Daniel P. Berrange 08 Mar '17

08 Mar '17

The PERF_COUNT_HW_REF_CPU_CYCLES constant is not available on all Linux distros libvirt targets, so its use must be made conditional. Other constant have existed long enough that we can assume they exist, as we don't support very old distros like RHEL-5 any more. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/util/virperf.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/util/virperf.c b/src/util/virperf.c index 49ec258..f64692b 100644 --- a/src/util/virperf.c +++ b/src/util/virperf.c @@ -104,8 +104,14 @@ static struct virPerfEventAttr attrs[] = { .attrType = PERF_TYPE_HARDWARE, .attrConfig = PERF_COUNT_HW_STALLED_CYCLES_BACKEND}, {.type = VIR_PERF_EVENT_REF_CPU_CYCLES, +# ifdef PERF_COUNT_HW_REF_CPU_CYCLES .attrType = PERF_TYPE_HARDWARE, - .attrConfig = PERF_COUNT_HW_REF_CPU_CYCLES}, + .attrConfig = PERF_COUNT_HW_REF_CPU_CYCLES +# else + .attrType = 0, + .attrConfig = 0, +# endif + }, }; typedef struct virPerfEventAttr *virPerfEventAttrPtr; -- 2.9.3

2 2

[libvirt] [PATCH v3 0/8] Alter TLS/UUID algorithms to be a bit more generic
by John Ferlan 08 Mar '17

08 Mar '17

This is a *split* from the v2 series for migration TLS. I figure what's here may be useful for the Veritas code... The most recent qemu patches ar using TLS, which means when the libvirt patches are updated they'll need similar type support. v2: http://www.redhat.com/archives/libvir-list/2017-February/msg01374.html Adjustments here are mainly in patch 2 which is new - the former patch2 is migrate TLS specific so it's moved later, but not in this series. The patch2 here does the TLS setup with the UUID. Essentially the end result is creation of a TLS/UUID secret info setup API and the splitting of the hotplug code for chardev to allow creation of TLS objects. John Ferlan (8): qemu: Introduce qemuDomainSecretInfoNew qemu: Introduce qemuDomainSecretInfoTLSNew qemu: Move exit monitor calls in failure paths qemu: Refactor hotplug to introduce qemuDomain{Add|Del}TLSObjects qemu: Refactor qemuDomainGetChardevTLSObjects to converge code qemu: Move qemuDomainSecretChardevPrepare call qemu: Move qemuDomainPrepareChardevSourceTLS call qemu: Introduce qemuDomainGetTLSObjects src/qemu/qemu_domain.c | 182 +++++++++++++++----------- src/qemu/qemu_hotplug.c | 341 +++++++++++++++++++++++++----------------------- src/qemu/qemu_hotplug.h | 24 ++++ 3 files changed, 309 insertions(+), 238 deletions(-) -- 2.9.3

2 16

[libvirt] [PATCH v1 0/3] libxl: nestedhvm support
by Wim Ten Have 08 Mar '17

08 Mar '17

From: Wim ten Have <wim.ten.have(a)oracle.com> This patch enhances host-passthrough capability to advertise the required vendor CPU virtualization feature which will be used to enable 'nestedhvm' in the libxl driver. For Intel virtualization (VT-x) .. <cpu mode='host-passthrough'> <feature policy='require' name='vmx'/> </cpu> For AMD virtualization (AMD-V) .. <cpu mode='host-passthrough'> <feature policy='require' name='svm'/> </cpu> Joao Martins (2): libxl: set nestedhvm when vmx|svm is required xenconfig: add conversion of domxml nestedhvm Wim ten Have (1): xlconfigtest: add test and data for 'nestedhvm' support src/libxl/libxl_conf.c | 9 ++++ src/xenconfig/xen_xl.c | 41 +++++++++++++++++ tests/xlconfigdata/test-fullvirt-nestedhvm.cfg | 26 +++++++++++ tests/xlconfigdata/test-fullvirt-nestedhvm.xml | 61 ++++++++++++++++++++++++++ tests/xlconfigtest.c | 1 + 5 files changed, 138 insertions(+) create mode 100644 tests/xlconfigdata/test-fullvirt-nestedhvm.cfg create mode 100644 tests/xlconfigdata/test-fullvirt-nestedhvm.xml -- 2.9.3

3 7

[libvirt] [PATCH] qemuTestDriverInit: Don't access live data
by Michal Privoznik 08 Mar '17

08 Mar '17

Some of our tests (e.g. qemuhotplugtest) call virDomainSaveConfig(). Now the problem is, qemuTestDriverInit() creates a fake qemu driver and fills it with some fake configuration. At least so we hoped. The truth is, it calls regular virQEMUDriverConfigNew() and then fix couple of paths. Literally. Therefore our tests see regular stateDir and configDir for the user that is running the tests. Directories, where live domain XMLs are stored. Let's just hope our test suite hasn't mangled any of them. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tests/testutilsqemu.c | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/tests/testutilsqemu.c b/tests/testutilsqemu.c index 56a89c913..0726cd317 100644 --- a/tests/testutilsqemu.c +++ b/tests/testutilsqemu.c @@ -513,6 +513,10 @@ qemuTestParseCapabilities(virCapsPtr caps, void qemuTestDriverFree(virQEMUDriver *driver) { virMutexDestroy(&driver->lock); + if (driver->config) { + virFileDeleteTree(driver->config->stateDir); + virFileDeleteTree(driver->config->configDir); + } virQEMUCapsCacheFree(driver->qemuCapsCache); virObjectUnref(driver->xmlopt); virObjectUnref(driver->caps); @@ -548,9 +552,14 @@ int qemuTestCapsCacheInsert(virQEMUCapsCachePtr cache, const char *binary, return ret; } +# define STATEDIRTEMPLATE abs_builddir "/qemustatedir-XXXXXX" +# define CONFIGDIRTEMPLATE abs_builddir "/qemuconfigdir-XXXXXX" + int qemuTestDriverInit(virQEMUDriver *driver) { virSecurityManagerPtr mgr = NULL; + char statedir[] = STATEDIRTEMPLATE; + char configdir[] = CONFIGDIRTEMPLATE; memset(driver, 0, sizeof(*driver)); @@ -561,6 +570,11 @@ int qemuTestDriverInit(virQEMUDriver *driver) if (!driver->config) goto error; + /* Do this early so that qemuTestDriverFree() doesn't see (unlink) the real + * dirs. */ + VIR_FREE(driver->config->stateDir); + VIR_FREE(driver->config->configDir); + /* Overwrite some default paths so it's consistent for tests. */ VIR_FREE(driver->config->libDir); VIR_FREE(driver->config->channelTargetDir); @@ -568,6 +582,26 @@ int qemuTestDriverInit(virQEMUDriver *driver) VIR_STRDUP(driver->config->channelTargetDir, "/tmp/channel") < 0) goto error; + if (!mkdtemp(statedir)) { + virFilePrintf(stderr, "Cannot create fake stateDir"); + goto error; + } + + if (VIR_STRDUP(driver->config->stateDir, statedir) < 0) { + rmdir(statedir); + goto error; + } + + if (!mkdtemp(configdir)) { + virFilePrintf(stderr, "Cannot create fake configDir"); + goto error; + } + + if (VIR_STRDUP(driver->config->configDir, configdir) < 0) { + rmdir(configdir); + goto error; + } + driver->caps = testQemuCapsInit(); if (!driver->caps) goto error; -- 2.11.0

3 4

[libvirt] [PATCH] qemu_process: don't probe iothreads if it's not supported by QEMU
by Pavel Hrdina 08 Mar '17

08 Mar '17

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1430258 Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/qemu/qemu_process.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 78d10099af..fcba7d3097 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -2098,6 +2098,11 @@ qemuProcessDetectIOThreadPIDs(virQEMUDriverPtr driver, int ret = -1; size_t i; + if (!virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_OBJECT_IOTHREAD)) { + ret = 0; + goto cleanup; + } + /* Get the list of IOThreads from qemu */ if (qemuDomainObjEnterMonitorAsync(driver, vm, asyncJob) < 0) goto cleanup; -- 2.12.0

2 1

[libvirt] [PATCH v2 0/2] default USB controller for PPC fix and API_UPDATE patch
by Pavel Hrdina 08 Mar '17

08 Mar '17

Pavel Hrdina (2): qemu_migration: don't allow ABI changes for persistent migration qemu_domain: use correct default USB controller on ppc64 src/qemu/qemu_domain.c | 16 ++++++++++++---- src/qemu/qemu_migration.c | 1 - 2 files changed, 12 insertions(+), 5 deletions(-) -- 2.12.0

3 4

[libvirt] [PATCH] libvirt-remote:fix use-after-free when sending event message
by Caoxinhua 08 Mar '17

08 Mar '17

>From 6b42792cfee124a742999e698e348e99b382ba16 Mon Sep 17 00:00:00 2001 From: c00207022 <caoxinhua(a)huawei.com> Date: Thu, 2 Mar 2017 12:07:27 +0800 Subject: [PATCH] libvirt-remote:fix use-after-free when sending event message [Changelog]:If there is a process with a client which registers event callbacks, and it calls libvirt's API which uses the same virConnectPtr in that callback function. When this process exit abnormally lead to client disconnect, there is a possibility that the libvirtd's main thread is use virServerClient to send event just after the virServerClient been freed by job thread. Following is backtrace: #0 0x00007fda223d66d8 in virClassIsDerivedFrom (klass=0xdeadbeef, parent=0x7fda24c81b40) at util/virobject.c:169 #1 0x00007fda223d6a1e in virObjectIsClass (anyobj=anyobj@entry=0x7fd9e575b400, klass=<optimized out>) at util/virobject.c:365 #2 0x00007fda223d6a44 in virObjectLock (anyobj=0x7fd9e575b400) at util/virobject.c:317 #3 0x00007fda22507f71 in virNetServerClientSendMessage (client=client@entry=0x7fd9e575b400, msg=msg@entry=0x7fd9ec30de90) at rpc/virnetserverclient.c:1422 #4 0x00007fda230d714d in remoteDispatchObjectEventSend (client=0x7fd9e575b400, program=0x7fda24c844e0, procnr=348, proc=0x7fda2310e5e0 <xdr_remote_domain_event_callback_tunable_msg>, data=0x7ffc3857fdb0) at remote.c:3803 #5 0x00007fda230dd71b in remoteRelayDomainEventTunable (conn=<optimized out>, dom=0x7fda27cd7660, params=0x7fda27f3aae0, nparams=1, opaque=0x7fd9e6c99e00) at remote.c:1033 #6 0x00007fda224484cb in virDomainEventDispatchDefaultFunc (conn=0x7fda27cd0120, event=0x7fda2736ea00, cb=0x7fda230dd610 <remoteRelayDomainEventTunable>, cbopaque=0x7fd9e6c99e00) at conf/domain_event.c:1910 #7 0x00007fda22446871 in virObjectEventStateDispatchCallbacks (callbacks=<optimized out>, callbacks=<optimized out>, event=0x7fda2736ea00, state=0x7fda24ca3960) at conf/object_event.c:722 #8 virObjectEventStateQueueDispatch (callbacks=0x7fda24c65800, queue=0x7ffc3857fe90, state=0x7fda24ca3960) at conf/object_event.c:736 #9 virObjectEventStateFlush (state=0x7fda24ca3960) at conf/object_event.c:814 #10 virObjectEventTimer (timer=<optimized out>, opaque=0x7fda24ca3960) at conf/object_event.c:560 #11 0x00007fda223ae8b9 in virEventPollDispatchTimeouts () at util/vireventpoll.c:458 #12 virEventPollRunOnce () at util/vireventpoll.c:654 #13 0x00007fda223ad1d2 in virEventRunDefaultImpl () at util/virevent.c:314 #14 0x00007fda225046cd in virNetDaemonRun (dmn=0x7fda24c775c0) at rpc/virnetdaemon.c:818 #15 0x00007fda230d6351 in main (argc=<optimized out>, argv=<optimized out>) at libvirtd.c:1623 Let's clean all event callback when client close. Signed-off-by: Caoxinhua <caoxinhua(a)huawei.com> --- daemon/remote.c | 76 +++++++++++++++++++++------------------------------------ 1 file changed, 28 insertions(+), 48 deletions(-) diff --git a/daemon/remote.c b/daemon/remote.c index 23c9de4..fb7cd50 100644 --- a/daemon/remote.c +++ b/daemon/remote.c @@ -101,6 +101,7 @@ static void make_nonnull_node_device(remote_nonnull_node_device *dev_dst, virNod static void make_nonnull_secret(remote_nonnull_secret *secret_dst, virSecretPtr secret_src); static void make_nonnull_nwfilter(remote_nonnull_nwfilter *net_dst, virNWFilterPtr nwfilter_src); static void make_nonnull_domain_snapshot(remote_nonnull_domain_snapshot *snapshot_dst, virDomainSnapshotPtr snapshot_src); +static void remoteClientCleanEventCallbacks(struct daemonClientPrivate *priv); static int remoteSerializeDomainDiskErrors(virDomainDiskErrorPtr errors, @@ -1483,24 +1484,15 @@ void remoteRelayConnectionClosedEvent(virConnectPtr conn ATTRIBUTE_UNUSED, int r &msg); } -/* - * You must hold lock for at least the client - * We don't free stuff here, merely disconnect the client's - * network socket & resources. - * We keep the libvirt connection open until any async - * jobs have finished, then clean it up elsewhere - */ -void remoteClientFreeFunc(void *data) +static void remoteClientCleanEventCallbacks(struct daemonClientPrivate *priv) { - struct daemonClientPrivate *priv = data; - /* Deregister event delivery callback */ - if (priv->conn) { - virIdentityPtr sysident = virIdentityGetSystem(); + if (priv && priv->conn) { size_t i; - + virIdentityPtr sysident = virIdentityGetSystem(); virIdentitySetCurrent(sysident); + virMutexLock(&priv->lock); for (i = 0; i < priv->ndomainEventCallbacks; i++) { int callbackID = priv->domainEventCallbacks[i]->callbackID; if (callbackID < 0) { @@ -1514,6 +1506,7 @@ void remoteClientFreeFunc(void *data) VIR_WARN("unexpected domain event deregister failure"); } VIR_FREE(priv->domainEventCallbacks); + priv->ndomainEventCallbacks = 0; for (i = 0; i < priv->nnetworkEventCallbacks; i++) { int callbackID = priv->networkEventCallbacks[i]->callbackID; @@ -1529,36 +1522,7 @@ void remoteClientFreeFunc(void *data) VIR_WARN("unexpected network event deregister failure"); } VIR_FREE(priv->networkEventCallbacks); - - for (i = 0; i < priv->nstorageEventCallbacks; i++) { - int callbackID = priv->storageEventCallbacks[i]->callbackID; - if (callbackID < 0) { - VIR_WARN("unexpected incomplete storage pool callback %zu", i); - continue; - } - VIR_DEBUG("Deregistering remote storage pool event relay %d", - callbackID); - priv->storageEventCallbacks[i]->callbackID = -1; - if (virConnectStoragePoolEventDeregisterAny(priv->conn, - callbackID) < 0) - VIR_WARN("unexpected storage pool event deregister failure"); - } - VIR_FREE(priv->storageEventCallbacks); - - for (i = 0; i < priv->nnodeDeviceEventCallbacks; i++) { - int callbackID = priv->nodeDeviceEventCallbacks[i]->callbackID; - if (callbackID < 0) { - VIR_WARN("unexpected incomplete node device callback %zu", i); - continue; - } - VIR_DEBUG("Deregistering remote node device event relay %d", - callbackID); - priv->nodeDeviceEventCallbacks[i]->callbackID = -1; - if (virConnectNodeDeviceEventDeregisterAny(priv->conn, - callbackID) < 0) - VIR_WARN("unexpected node device event deregister failure"); - } - VIR_FREE(priv->nodeDeviceEventCallbacks); + priv->nnetworkEventCallbacks = 0; for (i = 0; i < priv->nqemuEventCallbacks; i++) { int callbackID = priv->qemuEventCallbacks[i]->callbackID; @@ -1574,31 +1538,47 @@ void remoteClientFreeFunc(void *data) VIR_WARN("unexpected qemu monitor event deregister failure"); } VIR_FREE(priv->qemuEventCallbacks); + priv->nqemuEventCallbacks = 0; if (priv->closeRegistered) { if (virConnectUnregisterCloseCallback(priv->conn, remoteRelayConnectionClosedEvent) < 0) VIR_WARN("unexpected close callback event deregister failure"); } - - virConnectClose(priv->conn); - + virMutexUnlock(&priv->lock); virIdentitySetCurrent(NULL); virObjectUnref(sysident); } +} + + +/* + * You must hold lock for at least the client + * We don't free stuff here, merely disconnect the client's + * network socket & resources. + * We keep the libvirt connection open until any async + * jobs have finished, then clean it up elsewhere + */ +void remoteClientFreeFunc(void *data) +{ + struct daemonClientPrivate *priv = data; + if (!priv || !priv->conn) + return; + + remoteClientCleanEventCallbacks(priv); + virConnectClose(priv->conn); VIR_FREE(priv); } - static void remoteClientCloseFunc(virNetServerClientPtr client) { struct daemonClientPrivate *priv = virNetServerClientGetPrivateData(client); daemonRemoveAllClientStreams(priv->streams); + remoteClientCleanEventCallbacks(priv); } - void *remoteClientInitHook(virNetServerClientPtr client, void *opaque ATTRIBUTE_UNUSED) { -- 1.8.3.1

2 2

[libvirt] [PATCH] network: don't use dhcp-authoritative on static networks
by Martin Wilck 07 Mar '17

07 Mar '17

"Static" DHCP networks are those where no dynamic DHCP range is defined, only a list of host entries is used to serve permanent IP addresses. On such networks, we don't want dnsmasq to reply to other requests than those statically defined. But "dhcp-authoritative" will cause dnsmasq to do just that. Therefore we can't use "dhcp-authoritative" for static networks. Fixes: 4ac20b3ae "network: add dnsmasq option 'dhcp-authoritative'" Signed-off-by: Martin Wilck <mwilck(a)suse.com> --- src/network/bridge_driver.c | 9 ++++++++- tests/networkxml2confdata/dhcp6host-routed-network.conf | 1 - 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index ae1589d8c..17c6f3a0f 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -1355,7 +1355,14 @@ networkDnsmasqConfContents(virNetworkObjPtr network, if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET)) { if (ipdef->nranges || ipdef->nhosts) { virBufferAddLit(&configbuf, "dhcp-no-override\n"); - virBufferAddLit(&configbuf, "dhcp-authoritative\n"); + /* + * Use "dhcp-authoritative" only for dynamic DHCP. + * In a static-only network, it would cause dnsmasq + * to reply to requests from other hosts than those + * statically defined. + */ + if (ipdef->nranges || !ipdef->nhosts) + virBufferAddLit(&configbuf, "dhcp-authoritative\n"); } if (ipdef->tftproot) { diff --git a/tests/networkxml2confdata/dhcp6host-routed-network.conf b/tests/networkxml2confdata/dhcp6host-routed-network.conf index 87a149880..5728ee430 100644 --- a/tests/networkxml2confdata/dhcp6host-routed-network.conf +++ b/tests/networkxml2confdata/dhcp6host-routed-network.conf @@ -10,7 +10,6 @@ bind-dynamic interface=virbr1 dhcp-range=192.168.122.1,static dhcp-no-override -dhcp-authoritative dhcp-range=2001:db8:ac10:fd01::1,static,64 dhcp-hostsfile=/var/lib/libvirt/dnsmasq/local.hostsfile addn-hosts=/var/lib/libvirt/dnsmasq/local.addnhosts -- 2.11.0

2 5