- Devel - libvirt List Archives

[libvirt] [PATCH 0/2] cpu: speculative store buffer bypass mitigation (CVE-2018-3639)
by Daniel P. Berrangé 24 May '18

24 May '18

This provides the libvirt part of the mitigations for the speculative store buffer bypass vulnerabilities on the x86 platform[1], and is the companion of the kernel patches merged in: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… And QEMU patches posted at https://lists.gnu.org/archive/html/qemu-devel/2018-05/msg04795.html [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1528 https://access.redhat.com/security/vulnerabilities/ssbd Daniel P. Berrangé (2): cpu: define the 'ssbd' CPUID feature bit (CVE-2018-3639) cpu: define the 'virt-ssbd' CPUID feature bit (CVE-2018-3639) src/cpu/cpu_map.xml | 6 ++++++ 1 file changed, 6 insertions(+) -- 2.17.0

3 4

[libvirt] [PATCH] news: Add TLS non-shared storage migration
by Peter Krempa 24 May '18

24 May '18

Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- docs/news.xml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/news.xml b/docs/news.xml index 8f2c7d5dff..329b1c7129 100644 --- a/docs/news.xml +++ b/docs/news.xml @@ -54,6 +54,16 @@ a QEMU virtual machine. </description> </change> + <change> + <summary> + Add support for migration of QEMU VMs with non-shared storage over TLS + </summary> + <description> + It's now possible to use the VIR_MIGRATE_TLS flag together with + VIR_MIGRATE_NON_SHARED_DISK. The connection is then secured using the + TLS environment which is setup for the migration connection. + </description> + </change> </section> <section title="Improvements"> <change> -- 2.16.2

2 3

[libvirt] [PATCH v2] Edit test capabilities to contain different cell pagesizes.
by Roland Schulz 23 May '18

23 May '18

Signed-off-by: Roland Schulz <schullzroll(a)gmail.com> --- src/test/test_driver.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/src/test/test_driver.c b/src/test/test_driver.c index 467587b19..3fe0c2831 100644 --- a/src/test/test_driver.c +++ b/src/test/test_driver.c @@ -322,30 +322,34 @@ testBuildCapabilities(virConnectPtr conn) if (virCapabilitiesAddHostFeature(caps, "nonpae") < 0) goto error; - if (VIR_ALLOC_N(caps->host.pagesSize, 2) < 0) + if (VIR_ALLOC_N(caps->host.pagesSize, 4) < 0) goto error; caps->host.pagesSize[caps->host.nPagesSize++] = 4; + caps->host.pagesSize[caps->host.nPagesSize++] = 8; caps->host.pagesSize[caps->host.nPagesSize++] = 2048; + caps->host.pagesSize[caps->host.nPagesSize++] = 1024 * 1024; for (i = 0; i < privconn->numCells; i++) { virCapsHostNUMACellCPUPtr cpu_cells; virCapsHostNUMACellPageInfoPtr pages; - size_t nPages; + size_t nPages = caps->host.nPagesSize - 1; if (VIR_ALLOC_N(cpu_cells, privconn->cells[i].numCpus) < 0 || - VIR_ALLOC_N(pages, caps->host.nPagesSize) < 0) { + VIR_ALLOC_N(pages, caps->host.nPagesSize - 1) < 0) { VIR_FREE(cpu_cells); goto error; } - - nPages = caps->host.nPagesSize; + if (i == 1) + pages[0].size = caps->host.pagesSize[0]; + else + pages[0].size = caps->host.pagesSize[1]; memcpy(cpu_cells, privconn->cells[i].cpus, sizeof(*cpu_cells) * privconn->cells[i].numCpus); - for (j = 0; j < nPages; j++) - pages[j].size = caps->host.pagesSize[j]; + for (j = 1; j < nPages; j++) + pages[j].size = caps->host.pagesSize[j+1]; pages[0].avail = privconn->cells[i].mem / pages[0].size; -- 2.17.0

2 3

[libvirt] [PATCH 0/8] qemu: Kill text/HMP monitor code
by Peter Krempa 23 May '18

23 May '18

Most of the code is now dead as we support qemu 1.5 and upwards. Remove the unused bits. Peter Krempa (8): qemu: monitor: Drop fallback to text monitor for 'inject-nmi' command qemu: monitor: Drop fallback to text monitor for 'send-key' command qemu: monitor: Remove unused qemuMonitor(Add|Remove)HostNetwork qemu: monitor: Drop QEMU_CHECK_MONITOR_JSON... macros qemu: monitor: Drop JSON versions of savevm/delvm/loadv tests: Drop qemumonitortest qemu: monitor: Drop calls to text monitor impl where possible qemu: monitor: Remove dead code from text monitor src/qemu/qemu_monitor.c | 519 +++------- src/qemu/qemu_monitor.h | 12 - src/qemu/qemu_monitor_json.c | 41 +- src/qemu/qemu_monitor_json.h | 4 - src/qemu/qemu_monitor_text.c | 2166 ------------------------------------------ src/qemu/qemu_monitor_text.h | 150 --- tests/Makefile.am | 11 +- tests/qemumonitortest.c | 203 ---- 8 files changed, 144 insertions(+), 2962 deletions(-) delete mode 100644 tests/qemumonitortest.c -- 2.16.2

2 18

[libvirt] [PATCH] qemu: monitor: Remove diskSecretLookup monitor event
by Peter Krempa 23 May '18

23 May '18

After the text monitor was deleted this event can't be triggered. Remove it and all the unnecessary code. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- This applies on top of the text monitor removal series. I forgot to include it while splitting branches. src/qemu/qemu_monitor.c | 16 ---------------- src/qemu/qemu_monitor.h | 12 ------------ src/qemu/qemu_process.c | 28 ---------------------------- 3 files changed, 56 deletions(-) diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index ac1fbddb91..02d2629eb0 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -1287,22 +1287,6 @@ qemuMonitorHMPCommandWithFd(qemuMonitorPtr mon, } while (0) -int -qemuMonitorGetDiskSecret(qemuMonitorPtr mon, - const char *path, - char **secret, - size_t *secretLen) -{ - int ret = -1; - *secret = NULL; - *secretLen = 0; - - QEMU_MONITOR_CALLBACK(mon, ret, diskSecretLookup, mon->vm, - path, secret, secretLen); - return ret; -} - - int qemuMonitorEmitEvent(qemuMonitorPtr mon, const char *event, long long seconds, unsigned int micros, diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h index b3aeb83cf0..212d1e3e16 100644 --- a/src/qemu/qemu_monitor.h +++ b/src/qemu/qemu_monitor.h @@ -121,12 +121,6 @@ typedef void (*qemuMonitorEofNotifyCallback)(qemuMonitorPtr mon, typedef void (*qemuMonitorErrorNotifyCallback)(qemuMonitorPtr mon, virDomainObjPtr vm, void *opaque); -typedef int (*qemuMonitorDiskSecretLookupCallback)(qemuMonitorPtr mon, - virDomainObjPtr vm, - const char *path, - char **secret, - size_t *secretLen, - void *opaque); typedef int (*qemuMonitorDomainEventCallback)(qemuMonitorPtr mon, virDomainObjPtr vm, const char *event, @@ -285,7 +279,6 @@ struct _qemuMonitorCallbacks { qemuMonitorDestroyCallback destroy; qemuMonitorEofNotifyCallback eofNotify; qemuMonitorErrorNotifyCallback errorNotify; - qemuMonitorDiskSecretLookupCallback diskSecretLookup; qemuMonitorDomainEventCallback domainEvent; qemuMonitorDomainShutdownCallback domainShutdown; qemuMonitorDomainResetCallback domainReset; @@ -369,11 +362,6 @@ int qemuMonitorHMPCommandWithFd(qemuMonitorPtr mon, # define qemuMonitorHMPCommand(mon, cmd, reply) \ qemuMonitorHMPCommandWithFd(mon, cmd, -1, reply) -int qemuMonitorGetDiskSecret(qemuMonitorPtr mon, - const char *path, - char **secret, - size_t *secretLen); - int qemuMonitorEmitEvent(qemuMonitorPtr mon, const char *event, long long seconds, unsigned int micros, const char *details); diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 5b73a61962..2ba432630f 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -436,33 +436,6 @@ qemuProcessGetVolumeQcowPassphrase(virDomainDiskDefPtr disk, return ret; } -static int -qemuProcessFindVolumeQcowPassphrase(qemuMonitorPtr mon ATTRIBUTE_UNUSED, - virDomainObjPtr vm, - const char *path, - char **secretRet, - size_t *secretLen, - void *opaque ATTRIBUTE_UNUSED) -{ - virDomainDiskDefPtr disk; - int ret = -1; - - virObjectLock(vm); - if (!(disk = virDomainDiskByName(vm->def, path, true))) { - virReportError(VIR_ERR_INTERNAL_ERROR, - _("no disk found with path %s"), - path); - goto cleanup; - } - - ret = qemuProcessGetVolumeQcowPassphrase(disk, secretRet, secretLen); - - cleanup: - virObjectUnlock(vm); - return ret; -} - - static int qemuProcessHandleReset(qemuMonitorPtr mon ATTRIBUTE_UNUSED, virDomainObjPtr vm, @@ -1709,7 +1682,6 @@ qemuProcessHandleDumpCompleted(qemuMonitorPtr mon ATTRIBUTE_UNUSED, static qemuMonitorCallbacks monitorCallbacks = { .eofNotify = qemuProcessHandleMonitorEOF, .errorNotify = qemuProcessHandleMonitorError, - .diskSecretLookup = qemuProcessFindVolumeQcowPassphrase, .domainEvent = qemuProcessHandleEvent, .domainShutdown = qemuProcessHandleShutdown, .domainStop = qemuProcessHandleStop, -- 2.16.2

2 1

[libvirt] [PATCH 00/15] qemu: Implement non-shared storage migration via TLS (blockdev-add saga)
by Peter Krempa 23 May '18

23 May '18

Implement the non-shared storage migration when TLS is enabled. This is done by using blockdev-add to add the NBD endpoint with the TLS environment alias configured properly. Peter Krempa (15): qemu: block: Don't nest storage layer properties into format layer conf: domain: Export virDomainStorageSourceParse qemu: migration: Don't access disk members without lock qemu: caps: Add capability for blockdev-add/blockdev-del qemu: monitor: Factor out and document code to format QMP command qemu: monitor: Add implementation for blockdev-add and blockdev-del qemu: monitor: Introduce support for blockdev-mirror qemu: block: Add helpers for hot-adding virStorageSource via blockdev qemu: domain: Extract NBD disk migration private data formatting qemu: domain: Extract parsing of NBD status XML qemu: domain: Add private data for NBD migration storage source definition test: Add status XML test for NBD tls storage migration qemu: migration: Rename NBD migration functions qemu: migration: Extract code responsible for calling drive-mirror qemu: migration: Add support for transporting NBD over TLS src/conf/domain_conf.c | 2 +- src/conf/domain_conf.h | 6 + src/libvirt_private.syms | 1 + src/qemu/qemu_block.c | 163 +++++++- src/qemu/qemu_block.h | 34 ++ src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_domain.c | 242 +++++++++-- src/qemu/qemu_domain.h | 1 + src/qemu/qemu_migration.c | 306 ++++++++++---- src/qemu/qemu_monitor.c | 59 +++ src/qemu/qemu_monitor.h | 16 + src/qemu/qemu_monitor_json.c | 164 +++++++- src/qemu/qemu_monitor_json.h | 18 + tests/qemublocktest.c | 11 +- .../xml2json/block-raw-noopts.json | 15 +- .../qemublocktestdata/xml2json/dir-fat-cache.json | 27 +- .../qemublocktestdata/xml2json/dir-fat-floppy.json | 19 +- .../xml2json/dir-fat-readonly.json | 19 +- .../xml2json/file-backing_basic-aio_threads.json | 82 ++-- .../file-backing_basic-cache-directsync.json | 108 ++--- .../xml2json/file-backing_basic-cache-none.json | 108 ++--- .../xml2json/file-backing_basic-cache-unsafe.json | 108 ++--- .../file-backing_basic-cache-writeback.json | 108 ++--- .../file-backing_basic-cache-writethrough.json | 108 ++--- .../xml2json/file-backing_basic-detect.json | 76 ++-- .../xml2json/file-backing_basic-noopts.json | 60 +-- .../xml2json/file-backing_basic-unmap-detect.json | 76 ++-- .../xml2json/file-backing_basic-unmap-ignore.json | 76 ++-- .../xml2json/file-backing_basic-unmap.json | 76 ++-- .../xml2json/file-bochs-noopts.json | 15 +- .../xml2json/file-cloop-noopts.json | 15 +- .../xml2json/file-dmg-noopts.json | 15 +- .../xml2json/file-ploop-noopts.json | 15 +- .../file-qcow2-backing-chain-encryption.json | 30 +- .../xml2json/file-qcow2-backing-chain-noopts.json | 150 +++---- .../file-qcow2-backing-chain-unterminated.json | 30 +- .../xml2json/file-raw-aio_native.json | 25 +- .../qemublocktestdata/xml2json/file-raw-luks.json | 15 +- .../xml2json/file-raw-noopts.json | 15 +- .../xml2json/file-vdi-noopts.json | 15 +- .../xml2json/file-vhd-noopts.json | 15 +- .../xml2json/file-vpc-noopts.json | 15 +- .../network-qcow2-backing-chain-cache-unsafe.json | 74 ++-- ...etwork-qcow2-backing-chain-encryption_auth.json | 64 +-- tests/qemucapabilitiesdata/caps_2.10.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_2.10.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_2.10.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.10.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.11.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.9.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_2.9.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.9.0.x86_64.xml | 1 + .../migration-out-nbd-tls-in.xml | 464 +++++++++++++++++++++ .../migration-out-nbd-tls-out.xml | 1 + tests/qemuxml2xmltest.c | 1 + 60 files changed, 2172 insertions(+), 906 deletions(-) create mode 100644 tests/qemustatusxml2xmldata/migration-out-nbd-tls-in.xml create mode 120000 tests/qemustatusxml2xmldata/migration-out-nbd-tls-out.xml -- 2.16.2

2 19

[libvirt] [PATCH v4 0/4] qemu: Add support for -device hda-output (disable line-in)
by Filip Alac 23 May '18

23 May '18

Add support for hda 'output' codec for ich6 and ich9 sound devices, which allow us to disable line-in for guest. 'hda-output' codec is available since 0.14 version of qemu. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1126641 v1: https://www.redhat.com/archives/libvir-list/2018-May/msg01311.html v2: https://www.redhat.com/archives/libvir-list/2018-May/msg01450.html - Split patch into series of patches - Add description of feature in docs/news.xml - Improve the documentation in docs/formatdomain.html.in - Fixes coding standard errors/inconsistencies v3: https://www.redhat.com/archives/libvir-list/2018-May/msg01506.html - Moved all tests to third patch - Made possible to compile every patch by alone except fourth which depends on the first and on the second patch. v4: - Moved some qemu_command and qemu_capabilities hunks from the first patch into second patch. Filip Alac (4): conf: Introduce codec type 'output' tests: Extend qemu_capabilities with 'hda-output' codec tests: qemu: Extends tests for 'output' codec docs: news: Describe 'output' codec docs/formatdomain.html.in | 15 ++++++++++++--- docs/news.xml | 8 ++++++++ docs/schemas/domaincommon.rng | 1 + src/conf/domain_conf.c | 3 ++- src/conf/domain_conf.h | 1 + src/qemu/qemu_capabilities.c | 2 ++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 5 ++++- tests/qemucapabilitiesdata/caps_1.5.3.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_1.6.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_1.7.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.1.1.x86_64.xml | 1 + .../qemucapabilitiesdata/caps_2.10.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_2.10.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_2.10.0.x86_64.xml | 1 + .../qemucapabilitiesdata/caps_2.12.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.4.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.5.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.6.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_2.6.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_2.6.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.7.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.8.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.9.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_2.9.0.x86_64.xml | 1 + .../migration-in-params-in.xml | 1 + .../migration-out-nbd-in.xml | 1 + .../migration-out-nbd-out.xml | 1 + .../migration-out-params-in.xml | 1 + tests/qemustatusxml2xmldata/modern-in.xml | 1 + tests/qemuxml2argvdata/sound-device.args | 2 ++ tests/qemuxml2argvdata/sound-device.xml | 2 ++ tests/qemuxml2argvtest.c | 1 + tests/qemuxml2xmloutdata/sound-device.xml | 2 ++ 36 files changed, 62 insertions(+), 5 deletions(-) -- 2.17.0

2 5

[libvirt] [ [PATCH v3 0/8] virsh completion for event, secret-event, pool-event and nodedev-event
by Lin Ma 23 May '18

23 May '18

v2 -> v3: Most of patches in original v2 patchset were pushed, only 2 patches left, So create a new patchset for including the 2 patches and 6 new completion patches which about secret-event, pool-event and nodedev-event. (Borrowed code & idea from Michal Privoznik for these patches design) Lin Ma (8): virsh-secret: Rename vshEventCallback to vshSecretEventCallback virsh: Add event name completion to 'secret-event' command virsh: Move vshEventCallback structure definition to virsh-domain.h virsh: Add event name completion to 'event' command virsh-pool: Rename vshEventCallback to vshPoolEventCallback virsh: Add event name completion to 'pool-event' command virsh-nodedev: Rename vshEventCallback to vshNodedevEventCallback virsh: Add event name completion to 'nodedev-event' command tools/virsh-completer.c | 119 ++++++++++++++++++++++++++++++++++++++++++++++++ tools/virsh-completer.h | 15 ++++++ tools/virsh-domain.c | 9 +--- tools/virsh-domain.h | 8 ++++ tools/virsh-nodedev.c | 19 +++----- tools/virsh-nodedev.h | 8 ++++ tools/virsh-pool.c | 19 +++----- tools/virsh-pool.h | 8 ++++ tools/virsh-secret.c | 18 +++----- tools/virsh-secret.h | 8 ++++ 10 files changed, 189 insertions(+), 42 deletions(-) -- 2.16.2

1 3

[libvirt] Issue
by Mehdi AROUI 23 May '18

23 May '18

HEllo, I try to install libvirt-python in my windows 10, with version 3.6 of python, but I have the message * pkg-config binary is required to compile libvirt-python* how to fix that. thanks in advance regards.

1 0

[libvirt] [PATCH 0/2] qemu: probe for -sandbox support
by Ján Tomko 22 May '18

22 May '18

There is a patch proposal on qemu-devel that removes the -sandbox option completely without CONFIG_SECCOMP: http://lists.nongnu.org/archive/html/qemu-devel/2018-05/msg03312.html Now that we assume query-command-line-options support, we can probe for it and honor the seccomp_sandbox = 0 qemu.conf option even without passing the -sandbox off option. Ján Tomko (2): Reintroduce QEMU_CAPS_SECCOMP_SANDBOX qemu: only pass -sandbox off if supported src/qemu/qemu_capabilities.c | 1 + src/qemu/qemu_capabilities.h | 2 +- src/qemu/qemu_command.c | 3 ++- tests/qemucapabilitiesdata/caps_1.5.3.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_1.6.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_1.7.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.1.1.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.10.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_2.10.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_2.10.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.10.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.11.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.4.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.5.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.6.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_2.6.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_2.6.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.7.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.7.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.8.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.8.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.9.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_2.9.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.9.0.x86_64.xml | 1 + 28 files changed, 29 insertions(+), 2 deletions(-) -- 2.16.1

2 3