- Devel - libvirt List Archives

[libvirt] [PATCH 0/2] Two qemu config validation patches
by Laine Stump 19 Dec '17

19 Dec '17

The first is a bug fix to a recently pushed bugfix, the 2nd is just reorganizing working code. Laine Stump (2): qemu: assign correct type of PCI address for vhost-scsi when using pcie-root qemu: move qemuDomainDefValidateVideo into qemuDomainDeviceDefValidateVideo src/qemu/qemu_domain.c | 151 +++++++++------------ src/qemu/qemu_domain_address.c | 7 + .../hostdev-scsi-vhost-scsi-pcie.args | 25 ++++ .../hostdev-scsi-vhost-scsi-pcie.xml | 23 ++++ tests/qemuxml2argvtest.c | 7 + .../hostdev-scsi-vhost-scsi-pcie.xml | 40 ++++++ tests/qemuxml2xmltest.c | 7 + 7 files changed, 175 insertions(+), 85 deletions(-) create mode 100644 tests/qemuxml2argvdata/hostdev-scsi-vhost-scsi-pcie.args create mode 100644 tests/qemuxml2argvdata/hostdev-scsi-vhost-scsi-pcie.xml create mode 100644 tests/qemuxml2xmloutdata/hostdev-scsi-vhost-scsi-pcie.xml -- 2.13.6

2 4

[libvirt] libvirt wiki account request
by Ján Tomko 18 Dec '17

18 Dec '17

Hello. On 5th anniversary of commit 9d92bf1 I would like to request a libvirt wiki account. login: jtomko e-mail: jtomko(a)redhat.com password: hunter2 Thank you, Jan

3 2

[libvirt] Qemu capability probes lifecycle should be tied to libvirtd
by Christian Ehrhardt 18 Dec '17

18 Dec '17

Hi, on libvirt 3.10 I see a set of qemu processes used for capability probing [1] (in my case 8x x86_64 and 3xi386 which seems a lot, but ok). But when stopping the service those still stay around [2]. That is correct for guests that were started by libvirt as their lifecycle isn't tied to the libvirtd service. But those probes are IMHO tied to the service. At first this might seem non-relevant, but e.g. when users want to uninstall they might think on stopping their guests, but I'd assume no one will clean up the capability probes before the hard removal. But then on the removal scripts will run into issues e.g. failing to remove users as they are still in use by those qemu processes. Right now Distro's have to be aware to clean those up at least at times where packaging would expect them to be gone, but I wanted to ask if there would be a consensus that it would be "correct" to stop the processes on a libvirtd stop? [1]: http://paste.ubuntu.com/26208661/ [2]: http://paste.ubuntu.com/26208664/ P.S. I discussed this on IRC last Friday, but other than Michael confirming the current state there was no further traction on the discussion yet. -- Christian Ehrhardt Software Engineer, Ubuntu Server Canonical Ltd

2 2

[libvirt] virsh save/restore not working
by Christopher Pereira 18 Dec '17

18 Dec '17

Hi, We are unable to do a basic virsh save/restore operation on two different servers, using different libvirt versions. Error is: "Failed to restore domain (Start tag expected, '<' not found)" The XML inside the status file is valid. We filed a bug report with details here: https://bugzilla.redhat.com/show_bug.cgi?id=1525734 Any hint?

1 0

[libvirt] [PATCH] Improve filtering of Xen domain0 in libvirt-guests
by Jim Fehlig 18 Dec '17

18 Dec '17

The list_guests function in libvirt-guests uses 'grep -v' to filter Xen domain0 from a list of guests. If domain0 is the only item in the list, 'grep -v' returns 1, causing the 'stop' operation to fail when action is 'suspend'. Improve the filtering by using sed to remove domain0 from the list of guests. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- Failure of the 'stop' operation was fixed in commit 69ed99c7 by marking domain0 as a persistent domain. That fixes cases where domain0 is the only domain in the list of persistent domains. But there may be cases where domain0 is the only domain in 'virsh list --uuid', and the code should be made more robust to handle those. tools/libvirt-guests.sh.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/libvirt-guests.sh.in b/tools/libvirt-guests.sh.in index 791d9277b..8a158cca4 100644 --- a/tools/libvirt-guests.sh.in +++ b/tools/libvirt-guests.sh.in @@ -121,7 +121,7 @@ list_guests() { return 1 fi - echo "$list" | grep -v 00000000-0000-0000-0000-000000000000 + echo "$list" | sed "/00000000-0000-0000-0000-000000000000/d" } # guest_name URI UUID -- 2.15.1

2 1

[libvirt] RFC: auto port allocations
by Nikolay Shirokovskiy 18 Dec '17

18 Dec '17

There is a problem with current port allocations in libvirt. 1. With default qemu driver conf values remote_display_port_min = 5900 and remote_websocket_port_min = 5700 one can not start more than 200 domains each of one have vnc graphics with auto allocated socket and websocket. For the 200th domain driver allocate 6100 port for both socket and websocket and qemu fail to start. 2. Different hypervisor drivers use port pools with same borders (libxl and qemu migration ports, hardcoded libxl vnc sockets and default conf qemu vnc sockets for example. However I'm not sure it is possible/practical to use these drivers simultaneously on same host). As a result there can be failures due to races when first driver check for bind successfully then second driver check for bind successfully and then both pass same port value to hypervisors. Suggestion is to make port bitmap driver/daemon global and leave only borders in port pool object. This was we can solve the first and the both issues correspondingly. Nikolay

2 1

[libvirt] [perl] Fix check of return value from virStreamRecv*
by Jim Fehlig 18 Dec '17

18 Dec '17

Commit 049baec5 introduced a small bug in the logic checking return value of virStreamRecv*. Change the logic to only croak when return value is < 0 and not equal to -2 or -3. --- Changes | 2 +- Virt.xs | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Changes b/Changes index 3763b1d..96b42f8 100644 --- a/Changes +++ b/Changes @@ -2,7 +2,7 @@ Revision history for perl module Sys::Virt 4.0.0 2018-00-00 - - XXX + - Fix check of return value from virStreamRecv* 3.9.1 2017-12-05 diff --git a/Virt.xs b/Virt.xs index 415eb8a..c47b915 100644 --- a/Virt.xs +++ b/Virt.xs @@ -8074,7 +8074,7 @@ recv(st, data, nbytes, flags=0) else RETVAL = virStreamRecv(st, rawdata, nbytes); - if (RETVAL != -2 && RETVAL != -3) { + if ((RETVAL < 0) && (RETVAL != -2 || RETVAL != -3)) { Safefree(rawdata); _croak_error(); } -- 2.15.1

2 1

[libvirt] [PATCH] deamon: TLS: use default value if ca_file, cert_file or key_file not set
by Chen Hanxiao 18 Dec '17

18 Dec '17

From: Chen Hanxiao <chenhanxiao(a)gmail.com> As the description of daemon/libvirtd.conf, setting key_file, cert_file or key_file will override the default value. But if we set any one of them, we need to set all the rest of them. This patch set default value to them as daemon/libvirtd.conf described. Signed-off-by: Chen Hanxiao <chenhanxiao(a)gmail.com> --- daemon/libvirtd.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index 6d3b83355..93983f63b 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -493,19 +493,28 @@ daemonSetupNetworking(virNetServerPtr srv, config->cert_file || config->key_file) { if (!config->ca_file) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("No CA certificate path set to match server key/cert")); - goto cleanup; + VIR_WARN("Using default path for ca_file"); + if (VIR_STRDUP(config->ca_file, LIBVIRT_CACERT) < 0) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("No CA certificate path set to match server key/cert")); + goto cleanup; + } } if (!config->cert_file) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("No server certificate path set to match server key")); - goto cleanup; + VIR_WARN("Using default path for cert_file"); + if (VIR_STRDUP(config->cert_file, LIBVIRT_SERVERCERT) < 0) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("No server certificate path set to match server key")); + goto cleanup; + } } if (!config->key_file) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("No server key path set to match server cert")); - goto cleanup; + VIR_WARN("Using default path for key_file"); + if (VIR_STRDUP(config->key_file, LIBVIRT_SERVERKEY) < 0) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("No server key path set to match server cert")); + goto cleanup; + } } VIR_DEBUG("Using CA='%s' cert='%s' key='%s'", config->ca_file, config->cert_file, config->key_file); -- 2.14.3

1 0

[libvirt] [PATCH] apparmor: add ptrace/mediation rules for unconfined guests
by Christian Ehrhardt 16 Dec '17

16 Dec '17

If a guest runs unconfined <seclabel type='none'>, but libvirtd is confined then the peer for signal/ptrace can only be detected as 'unconfined'. That triggers issues like: apparmor="DENIED" operation="signal" profile="/usr/sbin/libvirtd" pid=22395 comm="libvirtd" requested_mask="send" denied_mask="send" signal=term peer="unconfined" To fix this add unconfined as an allowed peer for those operations. I discussed with the apparmor folks, right now there is no better separation to be made in this case. But there might be further down the road with "policy namespaces with scope and view control + stacking" This is more a use-case addition than a fix to the following two changes: - 3b1d19e6 AppArmor: add rules needed with additional mediation features - b482925c apparmor: support ptrace checks Signed-off-by: Christian Ehrhardt <christian.ehrhardt(a)canonical.com> --- examples/apparmor/usr.sbin.libvirtd | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/examples/apparmor/usr.sbin.libvirtd b/examples/apparmor/usr.sbin.libvirtd index 8d61d15..23e8aa3 100644 --- a/examples/apparmor/usr.sbin.libvirtd +++ b/examples/apparmor/usr.sbin.libvirtd @@ -61,6 +61,10 @@ signal (send) peer=/usr/sbin/dnsmasq, signal (read, send) peer=libvirt-*, + # required if guests run unconfined seclabel type='none' but libvirtd is confined + signal (read, send) peer=unconfined, + ptrace (trace) peer=unconfined, + # Very lenient profile for libvirtd since we want to first focus on confining # the guests. Guests will have a very restricted profile. / r, -- 2.7.4

3 2

[libvirt] [PATCH] add support of iSER transport type in qemu with libiscsi
by lichstor＠gmail.com 16 Dec '17

16 Dec '17

From: zhangshengyu <zhangshengyu(a)fusionstack.cn> --- src/conf/domain_conf.c | 13 ++++++++ src/qemu/qemu_block.c | 17 +++++++++- src/util/virstoragefile.c | 3 +- src/util/virstoragefile.h | 1 + tests/qemuxml2argvdata/disk-drive-network-iser.xml | 37 ++++++++++++++++++++++ 5 files changed, 69 insertions(+), 2 deletions(-) create mode 100644 tests/qemuxml2argvdata/disk-drive-network-iser.xml diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 66e21c4bd..bf20cfd0c 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -7201,6 +7201,9 @@ virDomainHostdevSubsysSCSIiSCSIDefParseXML(xmlNodePtr sourcenode, iscsisrc->src->type = VIR_STORAGE_TYPE_NETWORK; iscsisrc->src->protocol = VIR_STORAGE_NET_PROTOCOL_ISCSI; +virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("virDomainHostdevSubsysSCSIiSCSIDefParseXML")); + if (!(iscsisrc->src->path = virXMLPropString(sourcenode, "name"))) { virReportError(VIR_ERR_XML_ERROR, "%s", _("missing iSCSI hostdev source path name")); @@ -8416,6 +8419,7 @@ virDomainDiskSourceNetworkParse(xmlNodePtr node, unsigned int flags) { char *protocol = NULL; + char *transport = NULL; char *haveTLS = NULL; char *tlsCfg = NULL; int tlsCfgVal; @@ -8427,6 +8431,10 @@ virDomainDiskSourceNetworkParse(xmlNodePtr node, goto cleanup; } + if (!(transport = virXMLPropString(node, "transport"))) { + VIR_WARN("missing network source transport type"); + } + if ((src->protocol = virStorageNetProtocolTypeFromString(protocol)) <= 0) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("unknown protocol type '%s'"), protocol); @@ -8495,6 +8503,9 @@ virDomainDiskSourceNetworkParse(xmlNodePtr node, if (virDomainStorageNetworkParseHosts(node, &src->hosts, &src->nhosts) < 0) goto cleanup; + if(src->hosts) + src->hosts->transport = virStorageNetHostTransportTypeFromString(transport); + virStorageSourceNetworkAssignDefaultPorts(src); ret = 0; @@ -22326,6 +22337,8 @@ virDomainDiskSourceFormatNetwork(virBufferPtr attrBuf, VIR_FREE(path); + virBufferEscapeString(attrBuf, " transport='%s'", "iser"); + if (src->haveTLS != VIR_TRISTATE_BOOL_ABSENT && !(flags & VIR_DOMAIN_DEF_FORMAT_MIGRATABLE && src->tlsFromConfig)) diff --git a/src/qemu/qemu_block.c b/src/qemu/qemu_block.c index 585f0255e..dcd7c6a5e 100644 --- a/src/qemu/qemu_block.c +++ b/src/qemu/qemu_block.c @@ -506,6 +506,20 @@ qemuBlockStorageSourceBuildJSONSocketAddress(virStorageNetHostDefPtr host, goto cleanup; break; + case VIR_STORAGE_NET_HOST_TRANS_ISER: + transport = "iser"; + if (virAsprintf(&port, "%u", host->port) < 0) + goto cleanup; + + if (virJSONValueObjectCreate(&server, + "s:type", transport, + "s:host", host->name, + "s:port", port, + NULL) < 0) + goto cleanup; + + + break; case VIR_STORAGE_NET_HOST_TRANS_UNIX: if (virJSONValueObjectCreate(&server, "s:type", "unix", @@ -831,7 +845,8 @@ qemuBlockStorageSourceGetISCSIProps(virStorageSourcePtr src) "s:portal", portal, "s:target", target, "u:lun", lun, - "s:transport", "tcp", + "s:transport", + virStorageNetHostTransportTypeToString(src->hosts->transport), "S:user", username, "S:password-secret", objalias, NULL)); diff --git a/src/util/virstoragefile.c b/src/util/virstoragefile.c index 6594715e5..02d62a68e 100644 --- a/src/util/virstoragefile.c +++ b/src/util/virstoragefile.c @@ -92,7 +92,8 @@ VIR_ENUM_IMPL(virStorageNetProtocol, VIR_STORAGE_NET_PROTOCOL_LAST, VIR_ENUM_IMPL(virStorageNetHostTransport, VIR_STORAGE_NET_HOST_TRANS_LAST, "tcp", "unix", - "rdma") + "rdma", + "iser") VIR_ENUM_IMPL(virStorageSourcePoolMode, VIR_STORAGE_SOURCE_POOL_MODE_LAST, diff --git a/src/util/virstoragefile.h b/src/util/virstoragefile.h index 24382a0a6..4eb650186 100644 --- a/src/util/virstoragefile.h +++ b/src/util/virstoragefile.h @@ -147,6 +147,7 @@ typedef enum { VIR_STORAGE_NET_HOST_TRANS_TCP, VIR_STORAGE_NET_HOST_TRANS_UNIX, VIR_STORAGE_NET_HOST_TRANS_RDMA, + VIR_STORAGE_NET_HOST_TRANS_ISER, VIR_STORAGE_NET_HOST_TRANS_LAST } virStorageNetHostTransport; diff --git a/tests/qemuxml2argvdata/disk-drive-network-iser.xml b/tests/qemuxml2argvdata/disk-drive-network-iser.xml new file mode 100644 index 000000000..b3f4f9bfb --- /dev/null +++ b/tests/qemuxml2argvdata/disk-drive-network-iser.xml @@ -0,0 +1,37 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>e301d9ab-f5ad-47bf-988c-9645577a1af4</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='i686' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-i686</emulator> + <disk type='network' device='disk'> + <driver name='qemu' type='raw'/> + <source protocol='iscsi' name='iqn.1992-01.com.example' transport='iser'> + <host name='example.org' port='6000'/> + </source> + <target dev='vda' bus='virtio'/> + </disk> + <disk type='network' device='disk'> + <driver name='qemu' type='raw'/> + <source protocol='iscsi' name='iqn.1992-01.com.example/1' transport='iser'> + <host name='example.org' port='6000'/> + </source> + <target dev='vdb' bus='virtio'/> + </disk> + <controller type='usb' index='0'/> + <controller type='pci' index='0' model='pci-root'/> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <memballoon model='none'/> + </devices> +</domain> -- 2.13.6 (Apple Git-96)

3 3