- Devel - libvirt List Archives

[libvirt] [PATCH v3 0/6] Add support for video and input devices on S390
by Farhan Ali 23 Mar '18

23 Mar '18

Hi, This patch series adds Libvirt support for video and input devices for QEMU guests on S390. QEMU v2.11.0 added support for the virtio-gpu-ccw device [1] and virtio-{keyboard, mouse, tablet}-ccw devices [2], which can be used as video and input devices respectively. Thanks Farhan [1] https://git.qemu.org/?p=qemu.git;a=commit;h=1f8ad88935f5cb5a2968909e392dbee… [2] https://git.qemu.org/?p=qemu.git;a=commit;h=3382cf1fabbf722dce931846853dae7… ChangeLog --------- v2 -> v3 - Update 2.12 capabilities files (patch 1 and 4). - Move video model change to it's own separate patch (patch 3). - Separate virtio-gpu-ccw tests into appropriate patches as per Jan's suggestions (patch 1, 2 and 3). - Squash virtio input ccw tests with functionality patch (patch 5). v1 -> v2 - Split virtio-gpu-ccw capability (patch 1) and functionality (patch 2) into 2 patches. - Code changes per John's comments (patch 2). - Split capability for input devices (patch 4) and functionality (patch 5) into 2 patches. - Modify news update as per John's suggestion (patch 7). Farhan Ali (6): qemu: Introduce a new capability for virtio-gpu-ccw qemu: Add support for virtio-gpu-ccw video device on S390 qemu: Change default video model type to virtio for S390 qemu: Introduce capabilities for virtio input ccw devices qemu: Add support for virtio input ccw devices news: Update for virtio-gpu-ccw and virtio input ccw devices docs/formatdomain.html.in | 5 ++ docs/news.xml | 10 +++ src/qemu/qemu_capabilities.c | 13 ++++ src/qemu/qemu_capabilities.h | 6 ++ src/qemu/qemu_command.c | 27 +++++-- src/qemu/qemu_domain.c | 2 +- src/qemu/qemu_domain_address.c | 12 +++- src/qemu/qemu_process.c | 5 +- .../qemucapabilitiesdata/caps_2.11.0.s390x.replies | 83 +++++++++++++++++++--- tests/qemucapabilitiesdata/caps_2.11.0.s390x.xml | 6 +- .../qemucapabilitiesdata/caps_2.12.0.s390x.replies | 81 ++++++++++++++++++--- tests/qemucapabilitiesdata/caps_2.12.0.s390x.xml | 4 ++ tests/qemuxml2argvdata/input-virtio-ccw.args | 26 +++++++ tests/qemuxml2argvdata/input-virtio-ccw.xml | 29 ++++++++ .../qemuxml2argvdata/video-virtio-gpu-ccw-auto.xml | 18 +++++ tests/qemuxml2argvdata/video-virtio-gpu-ccw.args | 25 +++++++ tests/qemuxml2argvdata/video-virtio-gpu-ccw.xml | 35 +++++++++ tests/qemuxml2argvtest.c | 15 ++++ tests/qemuxml2xmloutdata/input-virtio-ccw.xml | 37 ++++++++++ .../video-virtio-gpu-ccw-auto.xml | 35 +++++++++ tests/qemuxml2xmloutdata/video-virtio-gpu-ccw.xml | 39 ++++++++++ tests/qemuxml2xmltest.c | 22 ++++++ 22 files changed, 508 insertions(+), 27 deletions(-) create mode 100644 tests/qemuxml2argvdata/input-virtio-ccw.args create mode 100644 tests/qemuxml2argvdata/input-virtio-ccw.xml create mode 100644 tests/qemuxml2argvdata/video-virtio-gpu-ccw-auto.xml create mode 100644 tests/qemuxml2argvdata/video-virtio-gpu-ccw.args create mode 100644 tests/qemuxml2argvdata/video-virtio-gpu-ccw.xml create mode 100644 tests/qemuxml2xmloutdata/input-virtio-ccw.xml create mode 100644 tests/qemuxml2xmloutdata/video-virtio-gpu-ccw-auto.xml create mode 100644 tests/qemuxml2xmloutdata/video-virtio-gpu-ccw.xml -- 2.7.4

2 7

[libvirt] [PATCH 0/3] tests: Improvements and cleanups to capabilities testing
by Andrea Bolognani 23 Mar '18

23 Mar '18

*** BLURB NOW OR FOREVER HOLD YOUR PEACE *** Andrea Bolognani (3): tests: domaincaps: Order by architecture tests: domaincaps: Add QEMU 2.12 tests: qemucapabilities: Drop mostly duplicated data ...rt.aarch64.xml => qemu_2.12.0-virt.aarch64.xml} | 5 +- ...icv2-virt.aarch64.xml => qemu_2.12.0.ppc64.xml} | 51 +- ...icv2-virt.aarch64.xml => qemu_2.12.0.s390x.xml} | 50 +- tests/domaincapsschemadata/qemu_2.12.0.x86_64.xml | 143 + ...irt.aarch64.xml => qemu_2.6.0-virt.aarch64.xml} | 0 tests/domaincapstest.c | 44 +- .../caps_2.10.0-gicv3.aarch64.replies | 16495 ----------------- .../caps_2.10.0-gicv3.aarch64.xml | 310 - ...aarch64.replies => caps_2.10.0.aarch64.replies} | 0 ...0-gicv2.aarch64.xml => caps_2.10.0.aarch64.xml} | 0 .../caps_2.12.0-gicv2.aarch64.replies | 18551 ------------------- .../caps_2.12.0-gicv2.aarch64.xml | 322 - ...aarch64.replies => caps_2.12.0.aarch64.replies} | 0 ...0-gicv3.aarch64.xml => caps_2.12.0.aarch64.xml} | 0 .../caps_2.6.0-gicv3.aarch64.replies | 13035 ------------- .../caps_2.6.0-gicv3.aarch64.xml | 287 - ....aarch64.replies => caps_2.6.0.aarch64.replies} | 0 ....0-gicv2.aarch64.xml => caps_2.6.0.aarch64.xml} | 0 tests/qemucapabilitiestest.c | 9 +- 19 files changed, 192 insertions(+), 49110 deletions(-) rename tests/domaincapsschemadata/{qemu_2.6.0-gicv3-virt.aarch64.xml => qemu_2.12.0-virt.aarch64.xml} (95%) copy tests/domaincapsschemadata/{qemu_2.6.0-gicv2-virt.aarch64.xml => qemu_2.12.0.ppc64.xml} (50%) copy tests/domaincapsschemadata/{qemu_2.6.0-gicv2-virt.aarch64.xml => qemu_2.12.0.s390x.xml} (50%) create mode 100644 tests/domaincapsschemadata/qemu_2.12.0.x86_64.xml rename tests/domaincapsschemadata/{qemu_2.6.0-gicv2-virt.aarch64.xml => qemu_2.6.0-virt.aarch64.xml} (100%) delete mode 100644 tests/qemucapabilitiesdata/caps_2.10.0-gicv3.aarch64.replies delete mode 100644 tests/qemucapabilitiesdata/caps_2.10.0-gicv3.aarch64.xml rename tests/qemucapabilitiesdata/{caps_2.10.0-gicv2.aarch64.replies => caps_2.10.0.aarch64.replies} (100%) rename tests/qemucapabilitiesdata/{caps_2.10.0-gicv2.aarch64.xml => caps_2.10.0.aarch64.xml} (100%) delete mode 100644 tests/qemucapabilitiesdata/caps_2.12.0-gicv2.aarch64.replies delete mode 100644 tests/qemucapabilitiesdata/caps_2.12.0-gicv2.aarch64.xml rename tests/qemucapabilitiesdata/{caps_2.12.0-gicv3.aarch64.replies => caps_2.12.0.aarch64.replies} (100%) rename tests/qemucapabilitiesdata/{caps_2.12.0-gicv3.aarch64.xml => caps_2.12.0.aarch64.xml} (100%) delete mode 100644 tests/qemucapabilitiesdata/caps_2.6.0-gicv3.aarch64.replies delete mode 100644 tests/qemucapabilitiesdata/caps_2.6.0-gicv3.aarch64.xml rename tests/qemucapabilitiesdata/{caps_2.6.0-gicv2.aarch64.replies => caps_2.6.0.aarch64.replies} (100%) rename tests/qemucapabilitiesdata/{caps_2.6.0-gicv2.aarch64.xml => caps_2.6.0.aarch64.xml} (100%) -- 2.14.3

2 4

[libvirt] [PATCH] conf: avoid reporting errors when network driver is disabled
by Daniel P. Berrangé 23 Mar '18

23 Mar '18

In previous releases all these methods were a no-op if the network driver is disabled. These helper methods are called unconditionally for all types of network interface, so must be no-ops if missing. Other code will already generate an error if the network driver is disabled and a NIC with type=network is used. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/conf/domain_conf.c | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index c8d051fa9f..79d6bd378e 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -28979,10 +28979,13 @@ int virDomainNetAllocateActualDevice(virDomainDefPtr dom, virDomainNetDefPtr iface) { + /* Just silently ignore if network driver isn't present. If something + * has tried to use a NIC with type=network, other code will already + * cause an error. This ensures type=bridge doesn't break when + * network driver is compiled out. + */ if (!netAllocate) { - virReportError(VIR_ERR_NO_SUPPORT, "%s", - _("Network device allocation not available")); - return -1; + return 0; } return netAllocate(dom, iface); @@ -28993,8 +28996,6 @@ virDomainNetNotifyActualDevice(virDomainDefPtr dom, virDomainNetDefPtr iface) { if (!netNotify) { - virReportError(VIR_ERR_NO_SUPPORT, "%s", - _("Network device notification not available")); return; } @@ -29007,9 +29008,7 @@ virDomainNetReleaseActualDevice(virDomainDefPtr dom, virDomainNetDefPtr iface) { if (!netRelease) { - virReportError(VIR_ERR_NO_SUPPORT, "%s", - _("Network device release not available")); - return -1; + return 0; } return netRelease(dom, iface); @@ -29020,9 +29019,7 @@ virDomainNetBandwidthChangeAllowed(virDomainNetDefPtr iface, virNetDevBandwidthPtr newBandwidth) { if (!netBandwidthChangeAllowed) { - virReportError(VIR_ERR_NO_SUPPORT, "%s", - _("Network device bandwidth change query not available")); - return -1; + return 0; } return netBandwidthChangeAllowed(iface, newBandwidth); @@ -29033,9 +29030,7 @@ virDomainNetBandwidthUpdate(virDomainNetDefPtr iface, virNetDevBandwidthPtr newBandwidth) { if (!netBandwidthUpdate) { - virReportError(VIR_ERR_NO_SUPPORT, "%s", - _("Network device bandwidth update not available")); - return -1; + return 0; } return netBandwidthUpdate(iface, newBandwidth); -- 2.14.3

2 2

[libvirt] [PATCH python] Disable Python 2 on future RHEL and Fedora > 29
by Daniel P. Berrangé 23 Mar '18

23 Mar '18

The end of Python 2 is nearing, so declare when it will be removed from libvirt Python binding RPMs. NB, this doesn't imply we'll be removing py2 support from upstream libvirt-python on the same timeframe - we'll consider what todo wrt that when upstream Python 2 finally goes EOL. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt-python.spec.in | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libvirt-python.spec.in b/libvirt-python.spec.in index 7953c82..9697ea8 100644 --- a/libvirt-python.spec.in +++ b/libvirt-python.spec.in @@ -13,6 +13,10 @@ %endif %define _with_python2 1 +%if 0%{?fedora} > 29 || 0%{?rhel} > 7 +%define _with_python2 0 +%endif + %define _with_python3 0 %if 0%{?fedora} || 0%{?rhel} > 7 %define _with_python3 1 -- 2.14.3

2 1

[libvirt] [dbus PATCH 00/10] *** Use API calls supporting flags ***
by Katerina Koukiou 23 Mar '18

23 Mar '18

* Replace all API calls to support flags where possible. * Replace libvirt-dbus API method names to follow naming of libvirt API. * Change type of virtDBusDomainGetVcpus from property to method. Katerina Koukiou (10): virtDBusDomainGetVcpus: Should be implemented as method and not as property GetVcpus API method: Renamed to GetVcpusFlags virtDBusDomainShutdown: Use virDomainShutdownFlags instead of virDomainShutdown Shutdown API method: Renamed to ShutdownFlags virtDBusDomainCreate: Use virDomainCreateWithFlags instead of virDomainCreate Create API method: Renamed to CreateWithFlags virtDBusDomainUndefine: Use virDomainUndefineFlags instead of virDomainUndefine Undefine API method: Renamed to UndefineFlags virtDBusDomainDestroy: Use virDomainDestroyFlags instead of virDomainDestroy Destroy API method: Renamed to DestroyFlags data/org.libvirt.Domain.xml | 21 +++++-- src/domain.c | 134 +++++++++++++++++++++++++------------------- test/test_domain.py | 22 +++++--- 3 files changed, 106 insertions(+), 71 deletions(-) -- 2.15.0

3 14

[libvirt] [PATCH] qemu: Build smartcard command line more wisely
by Michal Privoznik 23 Mar '18

23 Mar '18

https://bugzilla.redhat.com/show_bug.cgi?id=1558317 Similarly to b133fac356324c3 we need to look up alias of CCID controller when constructing smartcard command line instead of relying on broken assumption it will always be 'ccid0'. After user aliases it can be anything. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_command.c | 38 +++++++++++++++++++++++++++++++- tests/qemuxml2argvdata/user-aliases.args | 3 +++ tests/qemuxml2argvdata/user-aliases.xml | 11 +++++++++ tests/qemuxml2argvtest.c | 3 ++- 4 files changed, 53 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index a8afbd14fa..937a7d1b7b 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -8701,6 +8701,32 @@ qemuBuildNetCommandLine(virQEMUDriverPtr driver, } +static const char * +qemuBuildSmartcardFindCCIDController(const virDomainDef *def, + const virDomainSmartcardDef *smartcard) +{ + size_t i; + + /* Should never happen. But doesn't hurt to check. */ + if (smartcard->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_CCID) + return NULL; + + for (i = 0; i < def->ncontrollers; i++) { + const virDomainControllerDef *tmp = def->controllers[i]; + + if (tmp->type != VIR_DOMAIN_CONTROLLER_TYPE_CCID) + continue; + + if (tmp->idx != smartcard->info.addr.ccid.controller) + continue; + + return tmp->info.alias; + } + + return NULL; +} + + static int qemuBuildSmartcardCommandLine(virLogManagerPtr logManager, virCommandPtr cmd, @@ -8714,6 +8740,7 @@ qemuBuildSmartcardCommandLine(virLogManagerPtr logManager, char *devstr; virBuffer opt = VIR_BUFFER_INITIALIZER; const char *database; + const char *contAlias = NULL; if (!def->nsmartcards) return 0; @@ -8811,8 +8838,17 @@ qemuBuildSmartcardCommandLine(virLogManagerPtr logManager, virBufferFreeAndReset(&opt); return -1; } + + if (!(contAlias = qemuBuildSmartcardFindCCIDController(def, + smartcard))) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Unable to find controller for %s"), + smartcard->info.alias); + return -1; + } + virCommandAddArg(cmd, "-device"); - virBufferAsprintf(&opt, ",id=%s,bus=ccid0.0", smartcard->info.alias); + virBufferAsprintf(&opt, ",id=%s,bus=%s.0", smartcard->info.alias, contAlias); virCommandAddArgBuffer(cmd, &opt); return 0; diff --git a/tests/qemuxml2argvdata/user-aliases.args b/tests/qemuxml2argvdata/user-aliases.args index 4c9c951cef..ad93947104 100644 --- a/tests/qemuxml2argvdata/user-aliases.args +++ b/tests/qemuxml2argvdata/user-aliases.args @@ -31,6 +31,8 @@ server,nowait \ -global PIIX4_PM.disable_s4=0 \ -boot cd \ -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x8 \ +-device usb-ccid,id=ua-myCCID,bus=ua-SomeWeirdController.0,port=1 \ +-device usb-ccid,id=ua-myCCID2,bus=ua-SomeWeirdController.0,port=2 \ -usb \ -drive file=/var/lib/libvirt/images/fd.img,format=raw,if=none,\ id=drive-ua-myDisk1,cache=none \ @@ -55,6 +57,7 @@ bus=pci.0,addr=0x9 \ -device rtl8139,vlan=2,id=ua-AndAlsoClientMode,mac=52:54:00:8c:b1:f8,bus=pci.0,\ addr=0xa \ -net socket,connect=127.0.0.1:1234,vlan=2,name=hostua-AndAlsoClientMode \ +-device ccid-card-emulated,backend=nss-emulated,id=smartcard0,bus=ua-myCCID.0 \ -chardev pty,id=charserial0 \ -device isa-serial,chardev=charserial0,id=serial0 \ -chardev pty,id=charserial1 \ diff --git a/tests/qemuxml2argvdata/user-aliases.xml b/tests/qemuxml2argvdata/user-aliases.xml index 52132a82d7..9ce123b477 100644 --- a/tests/qemuxml2argvdata/user-aliases.xml +++ b/tests/qemuxml2argvdata/user-aliases.xml @@ -85,6 +85,14 @@ <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> </controller> <controller type='fdc' index='0'/> + <controller type='ccid' index='0'> + <alias name='ua-myCCID'/> + <address type='usb' bus='0' port='1'/> + </controller> + <controller type='ccid' index='1'> + <alias name='ua-myCCID2'/> + <address type='usb' bus='0' port='2'/> + </controller> <interface type='ethernet'> <mac address='52:54:00:d6:c0:0b'/> <model type='virtio'/> @@ -109,6 +117,9 @@ <alias name='ua-AndAlsoClientMode'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x0a' function='0x0'/> </interface> + <smartcard mode='host'> + <address type='ccid' controller='0' slot='0'/> + </smartcard> <serial type='pty'> <target type='isa-serial' port='0'> <model name='isa-serial'/> diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 5ece3f0cc6..064fd3b767 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -2995,7 +2995,8 @@ mymain(void) QEMU_CAPS_OBJECT_MEMORY_FILE, QEMU_CAPS_PIIX_DISABLE_S3, QEMU_CAPS_PIIX_DISABLE_S4, QEMU_CAPS_VNC, QEMU_CAPS_DEVICE_ISA_SERIAL, - QEMU_CAPS_HDA_DUPLEX); + QEMU_CAPS_HDA_DUPLEX, + QEMU_CAPS_CCID_EMULATED); DO_TEST("user-aliases2", QEMU_CAPS_DEVICE_IOH3420, QEMU_CAPS_ICH9_AHCI); DO_TEST("user-aliases-usb", QEMU_CAPS_KVM, QEMU_CAPS_PIIX_DISABLE_S3, QEMU_CAPS_PIIX_DISABLE_S4, -- 2.16.1

2 1

[libvirt] [PATCH] qemu: domain: Drop declaration of qemuDomainDefValidateDisk
by Peter Krempa 23 Mar '18

23 Mar '18

There is no such function in our code. Commit abca72faa49 added it spuriously. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- Pushed as trivial. src/qemu/qemu_domain.h | 3 --- 1 file changed, 3 deletions(-) diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h index 6d3e6eb5e3..63d9fb6d21 100644 --- a/src/qemu/qemu_domain.h +++ b/src/qemu/qemu_domain.h @@ -888,9 +888,6 @@ bool qemuDomainVcpuHotplugIsInOrder(virDomainDefPtr def) void qemuDomainVcpuPersistOrder(virDomainDefPtr def) ATTRIBUTE_NONNULL(1); -int qemuDomainDefValidateDisk(const virDomainDiskDef *disk, - virQEMUCapsPtr qemuCaps); - int qemuDomainCheckMonitor(virQEMUDriverPtr driver, virDomainObjPtr vm, qemuDomainAsyncJob asyncJob); -- 2.16.2

1 0

[libvirt] [PATCH 0/4] Be consistent with vir*Obj*Remove* APIs
by John Ferlan 23 Mar '18

23 Mar '18

Using comments from recent changes/reviews w/ libxl and usage of the virDomainObjListRemove which note that it's "a problem" that the Remove API expects a locked @obj on input, but then returns the @obj unlocked. Although adjusting domainobjlist is a "future" task, we can at least modify the other drivers/vir*obj modules to be consistent at least with respect to expecting and returning a locked (and reffed) object. Thus, modify interface, secret, nodedev, and storage pool. The network is already done this way and nwfilter appears to be a lost cause as we cannot come to a concensus over how to use hash objects and thus the code still uses forward linked list object manipulation. Changes for virdomainobjlist require a number of other changes to happen first with respect to consistent usage of Find and Add API's to return locked and ref counted objects, then being able to have the virDomainObjListRemove be consistent as well. John Ferlan (4): secret: Return with locked obj from virSecretObjListRemove interface: Return with locked obj from virInterfaceObjListRemove nodedev: Return with locked obj from virNodeDeviceObjListRemove storagepool: Return with locked obj from virStoragePoolObjRemove src/conf/virinterfaceobj.c | 13 ++++++++++++- src/conf/virnodedeviceobj.c | 13 ++++++++++++- src/conf/virsecretobj.c | 15 ++++++++------- src/conf/virstorageobj.c | 17 ++++++++++++++--- src/node_device/node_device_hal.c | 4 ++-- src/node_device/node_device_udev.c | 2 +- src/secret/secret_driver.c | 4 ---- src/storage/storage_driver.c | 12 +----------- src/test/test_driver.c | 20 +++++--------------- 9 files changed, 55 insertions(+), 45 deletions(-) -- 2.13.6

2 6

[libvirt] [PATCH] lxc: report error message raised by the failing function
by Prafull 23 Mar '18

23 Mar '18

The code that calls VIR_WARN after a function fails, doesn't report the error message raised by the failing function. Such error messages are now reported in lxc/lxc_driver.c Signed-off-by: Prafullkumar T <talep158(a)gmail.com> --- src/lxc/lxc_driver.c | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index 4f6b93b..4f600f3 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -3915,8 +3915,8 @@ lxcDomainAttachDeviceDiskLive(virLXCDriverPtr driver, major(sb.st_rdev), minor(sb.st_rdev), perms) < 0) - VIR_WARN("cannot deny device %s for domain %s", - src, vm->def->name); + VIR_WARN("cannot deny device %s for domain %s: %s", + src, vm->def->name, virGetLastErrorMessage()); goto cleanup; } @@ -4011,8 +4011,8 @@ lxcDomainAttachDeviceNetLive(virConnectPtr conn, goto cleanup; } else { VIR_WARN("setting bandwidth on interfaces of " - "type '%s' is not implemented yet", - virDomainNetTypeToString(actualType)); + "type '%s' is not implemented yet: %s", + virDomainNetTypeToString(actualType), virGetLastErrorMessage()); } } @@ -4116,8 +4116,8 @@ lxcDomainAttachDeviceHostdevSubsysUSBLive(virLXCDriverPtr driver, if (virUSBDeviceFileIterate(usb, virLXCTeardownHostUSBDeviceCgroup, priv->cgroup) < 0) - VIR_WARN("cannot deny device %s for domain %s", - src, vm->def->name); + VIR_WARN("cannot deny device %s for domain %s: %s", + src, vm->def->name, virGetLastErrorMessage()); goto cleanup; } @@ -4190,8 +4190,8 @@ lxcDomainAttachDeviceHostdevStorageLive(virLXCDriverPtr driver, major(sb.st_rdev), minor(sb.st_rdev), VIR_CGROUP_DEVICE_RWM) < 0) - VIR_WARN("cannot deny device %s for domain %s", - def->source.caps.u.storage.block, vm->def->name); + VIR_WARN("cannot deny device %s for domain %s: %s", + def->source.caps.u.storage.block, vm->def->name, virGetLastErrorMessage()); goto cleanup; } @@ -4262,8 +4262,8 @@ lxcDomainAttachDeviceHostdevMiscLive(virLXCDriverPtr driver, major(sb.st_rdev), minor(sb.st_rdev), VIR_CGROUP_DEVICE_RWM) < 0) - VIR_WARN("cannot deny device %s for domain %s", - def->source.caps.u.storage.block, vm->def->name); + VIR_WARN("cannot deny device %s for domain %s: %s", + def->source.caps.u.storage.block, vm->def->name, virGetLastErrorMessage()); goto cleanup; } @@ -4434,8 +4434,8 @@ lxcDomainDetachDeviceDiskLive(virDomainObjPtr vm, if (virCgroupDenyDevicePath(priv->cgroup, src, VIR_CGROUP_DEVICE_RWM, false) != 0) - VIR_WARN("cannot deny device %s for domain %s", - src, vm->def->name); + VIR_WARN("cannot deny device %s for domain %s: %s", + src, vm->def->name, virGetLastErrorMessage()); virDomainDiskRemove(vm->def, idx); virDomainDiskDefFree(def); @@ -4567,8 +4567,8 @@ lxcDomainDetachDeviceHostdevUSBLive(virLXCDriverPtr driver, if (virUSBDeviceFileIterate(usb, virLXCTeardownHostUSBDeviceCgroup, priv->cgroup) < 0) - VIR_WARN("cannot deny device %s for domain %s", - dst, vm->def->name); + VIR_WARN("cannot deny device %s for domain %s: %s", + dst, vm->def->name, virGetLastErrorMessage()); virObjectLock(hostdev_mgr->activeUSBHostdevs); virUSBDeviceListDel(hostdev_mgr->activeUSBHostdevs, usb); @@ -4623,8 +4623,8 @@ lxcDomainDetachDeviceHostdevStorageLive(virDomainObjPtr vm, if (virCgroupDenyDevicePath(priv->cgroup, def->source.caps.u.storage.block, VIR_CGROUP_DEVICE_RWM, false) != 0) - VIR_WARN("cannot deny device %s for domain %s", - def->source.caps.u.storage.block, vm->def->name); + VIR_WARN("cannot deny device %s for domain %s: %s", + def->source.caps.u.storage.block, vm->def->name, virGetLastErrorMessage()); virDomainHostdevRemove(vm->def, idx); virDomainHostdevDefFree(def); @@ -4673,8 +4673,8 @@ lxcDomainDetachDeviceHostdevMiscLive(virDomainObjPtr vm, if (virCgroupDenyDevicePath(priv->cgroup, def->source.caps.u.misc.chardev, VIR_CGROUP_DEVICE_RWM, false) != 0) - VIR_WARN("cannot deny device %s for domain %s", - def->source.caps.u.misc.chardev, vm->def->name); + VIR_WARN("cannot deny device %s for domain %s: %s", + def->source.caps.u.misc.chardev, vm->def->name, virGetLastErrorMessage()); virDomainHostdevRemove(vm->def, idx); virDomainHostdevDefFree(def); -- 2.1.4

3 2

[libvirt] [PATCH] remote: remove some __sun conditionals
by Daniel P. Berrangé 23 Mar '18

23 Mar '18

The libvirtd daemon has some arbitrary logic to drop privileges, but only on Solaris platforms. This was added during Xen days, when Xen was the only driver running in libvirtd. There's no expectation or testing that this works with the new libxl stack, nor whether dropping privileges breaks any of the secondary drivers. Finally, we'll be splitting drivers out into their own independant daemons, so this won't be applicable to libvirtd in future anyway. The remote driver client meanwhile arbitrarily disables daemon auto-spawn when connecting as non-root, breaking a key feature of libvirt unprivileged connections. Since we've not had any contributions for Solaris since circa 2012 and we don't do any CI testing we should consider this platform unmaintained and thus reasonable to remove this cruft. If someone steps forward to maintain Solaris again, this code would need re-evaluating to come up with something more targetted. There's various __sun conditionals in the Xen driver code, but those are not touched. This is all for the legacy Xen driver, which will be entirely removed at some point in future, so not benefit to hacking out just the Solaris parts. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/remote/remote_daemon.c | 33 --------------------------------- src/remote/remote_driver.c | 2 -- 2 files changed, 35 deletions(-) diff --git a/src/remote/remote_daemon.c b/src/remote/remote_daemon.c index 2f9dfad443..31c6ce1b61 100644 --- a/src/remote/remote_daemon.c +++ b/src/remote/remote_daemon.c @@ -675,30 +675,6 @@ daemonVersion(const char *argv0) printf("%s (%s) %s\n", argv0, PACKAGE_NAME, PACKAGE_VERSION); } -#ifdef __sun -static int -daemonSetupPrivs(void) -{ - chown("/var/run/libvirt", SYSTEM_UID, SYSTEM_UID); - - if (__init_daemon_priv(PU_RESETGROUPS | PU_CLEARLIMITSET, - SYSTEM_UID, SYSTEM_UID, PRIV_XVM_CONTROL, NULL)) { - VIR_ERROR(_("additional privileges are required")); - return -1; - } - - if (priv_set(PRIV_OFF, PRIV_ALLSETS, PRIV_FILE_LINK_ANY, PRIV_PROC_INFO, - PRIV_PROC_SESSION, PRIV_PROC_EXEC, PRIV_PROC_FORK, NULL)) { - VIR_ERROR(_("failed to set reduced privileges")); - return -1; - } - - return 0; -} -#else -# define daemonSetupPrivs() 0 -#endif - static void daemonShutdownHandler(virNetDaemonPtr dmn, siginfo_t *sig ATTRIBUTE_UNUSED, @@ -1336,15 +1312,6 @@ int main(int argc, char **argv) { goto cleanup; } - /* Beyond this point, nothing should rely on using - * getuid/geteuid() == 0, for privilege level checks. - */ - VIR_DEBUG("Dropping privileges (if required)"); - if (daemonSetupPrivs() < 0) { - ret = VIR_DAEMON_ERR_PRIVS; - goto cleanup; - } - daemonInitialize(); remoteProcs[REMOTE_PROC_AUTH_LIST].needAuth = false; diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index f765c09416..34e5ced0a9 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -1350,7 +1350,6 @@ remoteConnectOpen(virConnectPtr conn, */ if (!conn->uri) { VIR_DEBUG("Auto-probe remote URI"); -#ifndef __sun if (geteuid() > 0) { VIR_DEBUG("Auto-spawn user daemon instance"); rflags |= VIR_DRV_OPEN_REMOTE_USER; @@ -1359,7 +1358,6 @@ remoteConnectOpen(virConnectPtr conn, STRNEQ(autostart, "0"))) rflags |= VIR_DRV_OPEN_REMOTE_AUTOSTART; } -#endif } ret = doRemoteOpen(conn, priv, auth, conf, rflags); -- 2.14.3

2 1