- Devel - libvirt List Archives

[libvirt] [PATCH 0/4] Add TLS for TCP chardev redirdev and rng backends
by John Ferlan 24 Oct '16

24 Oct '16

This "would" conflict with other TLS/TCP changes on list depending on order of commit, but it does work against the current top. The conflict would be limited to the new helper qemuDomainGetChardevTLSObjects and changing the 'if (!cfg->chardevTLS)' to the corresponding 'if dev->source.data.tcp.haveTLS != VIR_TRISTATE_BOOL_YES)' once Pavel's changes are in and of course removing the need to fetch 'cfg'. Then if my other changes related to making 'source' a pointer in the _virDomainChrDef is accepted, the 'source.' here would change to 'source->'. Essentially during the review process of adding a secret to access the TLS environment, it was determined that the backends for redirdev and rng weren't adding the TLS object on hotplug, even though the command line processing would add it. NB: Smartcard would be in the same category, but it doesn't support hotplug, so we're off the hook for that. John Ferlan (4): qemu: Introduce qemuDomainGetChardevTLSObjects for hotplug qemu: Clean up error path in qemuDomainAttachRedirdevDevice qemu: Add TLS hotplug for qemuDomainAttachRedirdevDevice qemu: Add TLS hotplug for qemuDomainAttachRNGDevice src/qemu/qemu_hotplug.c | 125 ++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 99 insertions(+), 26 deletions(-) -- 2.7.4

2 8

[libvirt] 转发: Re: How libvirt address qemu command line args
by zhunxun＠gmail.com 23 Oct '16

23 Oct '16

zhunxun(a)gmail.com 发件人： zhunxun(a)gmail.com 发送时间： 2016-10-23 17:42 收件人： berrange 主题： Re: Re: [libvirt] How libvirt address qemu command line args Thanks，However,I have to use this method.Now I wander how get the VM xml contents in Libvirt source code,I try output some message in qemuProcessStart function like this ,but I get nothing,anyone can help me?? thanks! my code is : in qemuStartProcess function char *str=qemuDomainDefFormatXML(driver, vm->def, 0); FILE *op=fopen("/root/libvirt.log","a"); if(op!=NULL){ if(str!=NULL) fprintf(op,"str----cmd : %s\n",str); else fprintf(op,"str is null\n"); fclose(op); }else{ fprintf(op,"open file error!\n"); } zhunxun(a)gmail.com From: Daniel P. Berrange Date: 2016-10-19 15:35 To: Michal Privoznik CC: zhunxun(a)gmail.com; libvir-list Subject: Re: [libvirt] How libvirt address qemu command line args On Wed, Oct 19, 2016 at 10:17:21AM +0800, Michal Privoznik wrote: > On 18.10.2016 14:59, zhunxun(a)gmail.com wrote: > > Now I want to add some args about TPM to domain's XML,so I can start a domain by virt-manager or other virsh command,and then ,I would like to use sVIrt security context to label vTPM and correspondingVM,But I do not know how to get these XML args in libvirt. > > the key problem is that how can i get and recognize these args!!! > > related XML content : > > Usually, grepping the code for cmd name <-> XML element/attribute > translation is sufficient (esp. if you grep tests/) > > > > > <qemu:commandline> > > <qemu:arg value='-enable-kvm'/> > > Firstly, this is obsolete in favour of "-machine accel=kvm". In any > case, <domain type='kvm'/> will do the trick (libvirt will use whatever > is supported by qemu binary in your system). > > > <qemu:arg value='-drive'/> > > <qemu:arg value='file=/root/nvram_2.0-jin.qcow2,if=none,id=nvram0-0-0,format=qcow2'/> > > Okay, this is not supported by libvirt yet. We don't really have a way > how to specify NVRAM in anything other than a raw file. BTW: isn't qcow > too big gun for NVRAM? I mean, NVRAM has a fixed size of what ~190 KB? > QCOW header is about the same size. > > > <qemu:arg value='-device'/> > > <qemu:arg value='tpm-tis,tpmdev=tpm-tpm0,id=tpm0'/> > > <qemu:arg value='-tpmdev'/> > > <qemu:arg value='libtpms,id=tpm-tpm0,nvram=nvram0-0-0,startup=clear'/> > > I'm not sure there's a way how to put startup=clean on the cmd line. I'm > not even sure what it does. > And I have not idea what libtpms is either :-) > > > <qemu:arg value='-bios'/> > > <qemu:arg value='/root/xenSeabios/out/bios.bin'/> > > </qemu:commandline> > > On top of all that - QEMU is likely to fail to start since libvirt by default runs it as qemu:qemu user/group, and so it won't have permission to read any of the files in /root. If you have selinux/apparmour that will also block permission. This is an example of why usage of qemu:commandline is discouraged - it will always have problems with permissions if you pass files using it. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://entangle-photo.org -o- http://search.cpan.org/~danberr/ :|

1 0

[libvirt] [PATCH 0/3] Alter 'source' to be virDomainChrSourceDefPtr in _virDomainChrDef
by John Ferlan 22 Oct '16

22 Oct '16

Yes, it's absolutely terrifying; however, in order to "fix" problems noted during the review of the TLS chardev TCP 'properly' making the 'source' be a pointer and then moving the 'privateData' from _virDomainChrDef to _virDomainChrSourceDef will allow for setting of the 'secinfo' for the smartcard, rng, and redirdev backends that use a TCP channel. 95% of the changes obviously fell out of build issues from a 'make check syntax-check'. The remaining 5% of the changes are from sources I don't normally build; however, those were found by using cscope on the sources and finding references of "source\.{type|data|logfile|logappend} (IOW: virDomainChrSourceDef members). John Ferlan (3): vmx: Use the allocator virDomainChrDefNew Introduce virDomainChrSourceDefNew for virDomainChrDefPtr conf: Move the privateData from virDomainChrDef to virDomainChrSourceDef src/bhyve/bhyve_command.c | 8 ++--- src/bhyve/bhyve_driver.c | 2 +- src/bhyve/bhyve_parse_command.c | 20 +++++------ src/conf/domain_audit.c | 4 +-- src/conf/domain_conf.c | 53 +++++++++++++++++---------- src/conf/domain_conf.h | 4 +-- src/libxl/libxl_conf.c | 42 +++++++++++----------- src/libxl/libxl_domain.c | 22 ++++++------ src/libxl/libxl_driver.c | 4 +-- src/lxc/lxc_driver.c | 4 +-- src/lxc/lxc_native.c | 2 +- src/lxc/lxc_process.c | 6 ++-- src/qemu/qemu_cgroup.c | 2 +- src/qemu/qemu_command.c | 28 +++++++-------- src/qemu/qemu_domain.c | 16 ++++----- src/qemu/qemu_driver.c | 8 ++--- src/qemu/qemu_hotplug.c | 6 ++-- src/qemu/qemu_parse_command.c | 4 +-- src/qemu/qemu_process.c | 28 +++++++-------- src/security/security_dac.c | 4 +-- src/security/security_selinux.c | 4 +-- src/security/virt-aa-helper.c | 70 ++++++++++++++++++------------------ src/uml/uml_conf.c | 14 ++++---- src/uml/uml_driver.c | 12 +++---- src/vbox/vbox_common.c | 46 ++++++++++++------------ src/vmx/vmx.c | 78 ++++++++++++++++++++-------------------- src/vz/vz_sdk.c | 78 ++++++++++++++++++++-------------------- src/xen/xen_driver.c | 4 +-- src/xenconfig/xen_sxpr.c | 76 +++++++++++++++++++-------------------- src/xenconfig/xen_xl.c | 14 ++++---- tests/securityselinuxlabeltest.c | 14 ++++---- 31 files changed, 346 insertions(+), 331 deletions(-) -- 2.7.4

2 8

[libvirt] [PATCH 00/15] qemu: Add QMP schema introspection and use it to add gluster debug setting
by Peter Krempa 22 Oct '16

22 Oct '16

Add support for QMP schema introspection along with test data adding and fixup and use it to detect support for gluster debug setting in qemu. Thanks to Andrea and Pavel for gathering test data for me so I don't have to compile multiple qemu versions or deal with minority architectures. (I honoured them by granting them autorship on the patches) This series also includes the gluster posting from Prasanna which I've properly split, reordered and fixed. Andrea Bolognani (5): tests: qemucaps: Update ppc64 replies for qemu 2.6.0 release tests: qemucaps: Update aarch64 gicv2 replies for qemu 2.6.0 release tests: qemucaps: Add QMP introspection data for qemu 2.6.0 on ppc64le tests: qemucaps: Add QMP introspection data for qemu 2.6.0 on aarch64 gicv2 tests: qemucaps: Add QMP introspection data for qemu 2.6.0 on aarch64 gicv3 Pavel Hrdina (3): tests: qemucaps: Add QMP introspection data for qemu 2.5.0 on x86 tests: qemucaps: Add QMP introspection data for qemu 2.6.0 on x86 tests: qemucaps: Add QMP introspection data for qemu 2.7.0 on x86 Peter Krempa (4): util: json: add helper to iterate and steal members of json array qemu: monitor: Add code to retrieve and store QMP schema data tests: qemucaps: Temporarily remove 'query-qmp-schema' from test data qemu: capabilities: Add support for QMP schema introspection Prasanna Kumar Kalever (3): qemu: capabilities: Detect support for gluster debug setting qemu: conf: add option for tuning debug logging level qemu: command: Add debug option for gluster volumes src/libvirt_private.syms | 1 + src/qemu/libvirtd_qemu.aug | 3 + src/qemu/qemu.conf | 20 + src/qemu/qemu_capabilities.c | 183 + src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_command.c | 19 +- src/qemu/qemu_command.h | 1 + src/qemu/qemu_conf.c | 3 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_hotplug.c | 6 +- src/qemu/qemu_monitor.c | 11 + src/qemu/qemu_monitor.h | 2 + src/qemu/qemu_monitor_json.c | 67 + src/qemu/qemu_monitor_json.h | 3 + src/util/virjson.c | 36 + src/util/virjson.h | 6 + .../qemuargv2xml-disk-drive-network-gluster.args | 7 +- .../qemucapabilitiesdata/caps_2.5.0.x86_64.replies | 7545 ++++++++++++++++++ tests/qemucapabilitiesdata/caps_2.5.0.x86_64.xml | 1 + .../caps_2.6.0-gicv2.aarch64.replies | 8036 ++++++++++++++++++- .../caps_2.6.0-gicv2.aarch64.xml | 3 +- .../caps_2.6.0-gicv3.aarch64.replies | 8007 ++++++++++++++++++- .../caps_2.6.0-gicv3.aarch64.xml | 1 + .../caps_2.6.0.ppc64le.replies | 8026 ++++++++++++++++++- tests/qemucapabilitiesdata/caps_2.6.0.ppc64le.xml | 5 +- .../qemucapabilitiesdata/caps_2.6.0.x86_64.replies | 8005 +++++++++++++++++++ tests/qemucapabilitiesdata/caps_2.6.0.x86_64.xml | 1 + .../qemucapabilitiesdata/caps_2.7.0.x86_64.replies | 8356 ++++++++++++++++++++ tests/qemucapabilitiesdata/caps_2.7.0.x86_64.xml | 2 + .../qemuxml2argv-disk-drive-network-gluster.args | 12 +- tests/qemuxml2argvtest.c | 3 +- 31 files changed, 48326 insertions(+), 48 deletions(-) 1000:1 ratio ;) -- 2.10.0

2 31

[libvirt] [PATCH] xenFormatXLDisk: Fix commas for arguments
by Michal Privoznik 22 Oct '16

22 Oct '16

instead of: virBufferAdd(buf, "arg1,"); virBufferAdd(buf, "arg2"); lets have: virBufferAdd(buf, "arg1"); virBufferAdd(buf, ",arg2"); Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/xenconfig/xen_xl.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/src/xenconfig/xen_xl.c b/src/xenconfig/xen_xl.c index 742f1ef..337f9dd 100644 --- a/src/xenconfig/xen_xl.c +++ b/src/xenconfig/xen_xl.c @@ -1022,33 +1022,33 @@ xenFormatXLDisk(virConfValuePtr list, virDomainDiskDefPtr disk) virBufferAddLit(&buf, "format="); switch (format) { case VIR_STORAGE_FILE_RAW: - virBufferAddLit(&buf, "raw,"); + virBufferAddLit(&buf, "raw"); break; case VIR_STORAGE_FILE_VHD: - virBufferAddLit(&buf, "xvhd,"); + virBufferAddLit(&buf, "xvhd"); break; case VIR_STORAGE_FILE_QCOW: - virBufferAddLit(&buf, "qcow,"); + virBufferAddLit(&buf, "qcow"); break; case VIR_STORAGE_FILE_QCOW2: - virBufferAddLit(&buf, "qcow2,"); + virBufferAddLit(&buf, "qcow2"); break; /* set default */ default: - virBufferAddLit(&buf, "raw,"); + virBufferAddLit(&buf, "raw"); } /* device */ - virBufferAsprintf(&buf, "vdev=%s,", disk->dst); + virBufferAsprintf(&buf, ",vdev=%s", disk->dst); /* access */ - virBufferAddLit(&buf, "access="); + virBufferAddLit(&buf, ",access="); if (disk->src->readonly) - virBufferAddLit(&buf, "ro,"); + virBufferAddLit(&buf, "ro"); else if (disk->src->shared) - virBufferAddLit(&buf, "!,"); + virBufferAddLit(&buf, "!"); else - virBufferAddLit(&buf, "rw,"); + virBufferAddLit(&buf, "rw"); if (disk->transient) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("transient disks not supported yet")); @@ -1057,18 +1057,18 @@ xenFormatXLDisk(virConfValuePtr list, virDomainDiskDefPtr disk) /* backendtype */ if (driver) { - virBufferAddLit(&buf, "backendtype="); + virBufferAddLit(&buf, ",backendtype="); if (STREQ(driver, "qemu") || STREQ(driver, "file")) - virBufferAddLit(&buf, "qdisk,"); + virBufferAddLit(&buf, "qdisk"); else if (STREQ(driver, "tap")) - virBufferAddLit(&buf, "tap,"); + virBufferAddLit(&buf, "tap"); else if (STREQ(driver, "phy")) - virBufferAddLit(&buf, "phy,"); + virBufferAddLit(&buf, "phy"); } /* devtype */ if (disk->device == VIR_DOMAIN_DISK_DEVICE_CDROM) - virBufferAddLit(&buf, "devtype=cdrom,"); + virBufferAddLit(&buf, ",devtype=cdrom"); /* * target @@ -1082,7 +1082,7 @@ xenFormatXLDisk(virConfValuePtr list, virDomainDiskDefPtr disk) goto cleanup; if (target) - virBufferAsprintf(&buf, "target=%s", target); + virBufferAsprintf(&buf, ",target=%s", target); if (virBufferCheckError(&buf) < 0) goto cleanup; -- 2.8.4

2 3

[libvirt] [PATCH 0/2] vz: add serial number to disk devices
by Nikolay Shirokovskiy 21 Oct '16

21 Oct '16

Only the first patch is really on the subject. The second one is bugfix that is included mainly because it touches the same place (and nice to have to test first patch too...) Nikolay Shirokovskiy (2): vz: add serial number to disk devices vz: set something in disk driver name src/vz/vz_sdk.c | 16 ++++++++++++++++ src/vz/vz_utils.c | 6 +++--- 2 files changed, 19 insertions(+), 3 deletions(-) -- 1.8.3.1

2 5

[libvirt] [PATCH v2 0/3] qemu: util: vz: support setting disk serial number
by Maxim Nestratov 21 Oct '16

21 Oct '16

Actually this is a combination of the two previous series https://www.redhat.com/archives/libvir-list/2016-October/msg00890.html and https://www.redhat.com/archives/libvir-list/2016-September/msg01024.html Maxim Nestratov (1): util: qemu: make qemuSafeSerialParamValue function usable by other drivers Nikolay Shirokovskiy (2): vz: set something in disk driver name vz: add serial number to disk devices src/libvirt_private.syms | 1 + src/qemu/qemu_command.c | 19 +------------------ src/util/virutil.c | 16 ++++++++++++++++ src/util/virutil.h | 2 ++ src/vz/vz_sdk.c | 24 ++++++++++++++++++++++++ src/vz/vz_utils.c | 6 +++--- 6 files changed, 47 insertions(+), 21 deletions(-) -- 2.4.11

1 4

[libvirt] [PATCH] bhyve: Need to add parameter to virDomainChrDefNew
by John Ferlan 21 Oct '16

21 Oct '16

Commit id '5f2a13278' missed this one. Signed-off-by: John Ferlan <jferlan(a)redhat.com> --- Pushed as build breaker https://ci.centos.org/view/libvirt-project/job/libvirt-master-build/150/sys… src/bhyve/bhyve_parse_command.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/bhyve/bhyve_parse_command.c b/src/bhyve/bhyve_parse_command.c index fd9384d..1a7de3d 100644 --- a/src/bhyve/bhyve_parse_command.c +++ b/src/bhyve/bhyve_parse_command.c @@ -287,7 +287,7 @@ bhyveParseBhyveLPCArg(virDomainDefPtr def, /* Only support com%d */ if (STRPREFIX(type, "com") && type[4] == 0) { - if (!(chr = virDomainChrDefNew())) + if (!(chr = virDomainChrDefNew(NULL))) goto error; chr->source.type = VIR_DOMAIN_CHR_TYPE_NMDM; -- 2.7.4

1 0

[libvirt] [PATCH 0/4] qemuBuildHostNetStr cleanups
by Ján Tomko 21 Oct '16

21 Oct '16

This is not a blurb. Ján Tomko (4): qemuBuildHostNetStr: use type_sep earlier qemuBuildHostNetStr: do not start options with a comma qemuBuildHostNetStr: move stray VIR_DOMAIN_NET_TYPE_INTERNAL qemuBuildHostNetStr: remove dead code src/qemu/qemu_command.c | 49 +++++++++++++++++++++---------------------------- 1 file changed, 21 insertions(+), 28 deletions(-) -- 2.7.3

2 8

[libvirt] [PATCH v10 0/4] Add native TLS encrypted chardev TCP support
by John Ferlan 21 Oct '16

21 Oct '16

v9: http://www.redhat.com/archives/libvir-list/2016-October/msg00726.html "Theorically speaking" patch #2 is "separate" from patches 1, 3, & 4. That is patch 3 and 4 are adding the secret uuid processing handling which is different than the enable/disable property logic for patch 2. I've left them all together though since just to be consistent with previous series. Differences in v10 ... Pushed the previous series 2/5 and 3/5 since they were ACK'd ... Create a new patch 1 to have helper qemuDomainSupportTLSChardevTCP It's mostly unnecessary without patch 2 though, but it made adding or "separating" patch 2 from patches 3 & 4 a whole lot easier... ... Modified former patch 1 (now patch 2) to accommodate for a paradigm where tls='yes' and chardev_tls=0 might be possible. The new helper is used to whether to add the TLS information or not. ... Modified former patch 4 (now patch 3) to accommodate for the changes Pavel has made to the code and to generate the secalias using the "charAlias" ... Modified former patch 4 (now patch 4) to use the "charAlias" as well and merge in Pavel's changes NOTE: Even though 'yes' is a now possibility, it is an option that's assuming chardev_tls=0 so I don't feel the issues raised during review of v8 regarding needing to consider a currently running 2.3.0 domain that still needs to work when 2.4.0 is applied. I believe it will be with the way the optional property is being used, thus with respect to the points in: http://www.redhat.com/archives/libvir-list/2016-October/msg00732.html The proposed qemuProcessPrepareDomain change is invalid since haveTLS is a tristate and chardevTLS is a bistate. This is what I meant about being a bit dangerous (e.g. BOOL_NO=2, BOOL_YES=1, and BOOL_ABSENT=0); however, "chardevTLS=1" is enabled (yes) and "chardevTLS=0" is disabled (absent). While it looks good when typing, when you get down to the details sometimes you find those 'gotchas'. Even if the shorthand logic were fixed, it's not going to be good to assume that setting the domain property or disabling the domain property is the desired action. The qemuProcessAttach is for qemu-attach and not the path that libvirt uses to reconnect to running domains (which is qemuProcessReconnect). There's so much broken from the qemu-attach right now - I doubt it really works at all. With respect to the reconnect processing (since that's really what you were thinking about)... There is no "options" provided/found in that code. New code could possibly "read" the '/proc/$pid/cmdline' file and look for 'tls-creds', but the only purpose of that would be to manage 'assumptions' with how the "tls='{yes|no}'" property is used. Altering virDomainChrSourceDefParseXML and virDomainChrSourceDefFormat to manage some new boolean 'tlsFromConfig' that I'm not sure could be set properly is something I think is outside these patches. John Ferlan (4): qemu: Introduce qemuDomainSupportTLSChardevTCP domain: Add optional 'tls' attribute for TCP chardev qemu: Add a secret object to/for a chardev tcp with secret qemu: Add secret object hotplug for TCP chardev TLS docs/formatdomain.html.in | 28 +++++ docs/schemas/domaincommon.rng | 5 + src/conf/domain_conf.c | 22 +++- src/conf/domain_conf.h | 1 + src/qemu/qemu_command.c | 33 ++++- src/qemu/qemu_command.h | 1 + src/qemu/qemu_domain.c | 133 ++++++++++++++++++++- src/qemu/qemu_domain.h | 18 ++- src/qemu/qemu_driver.c | 2 +- src/qemu/qemu_hotplug.c | 58 ++++++++- src/qemu/qemu_hotplug.h | 3 +- src/qemu/qemu_process.c | 4 +- tests/qemuhotplugtest.c | 2 +- ...uxml2argv-serial-tcp-tlsx509-chardev-notls.args | 30 +++++ ...muxml2argv-serial-tcp-tlsx509-chardev-notls.xml | 50 ++++++++ ...xml2argv-serial-tcp-tlsx509-secret-chardev.args | 38 ++++++ ...uxml2argv-serial-tcp-tlsx509-secret-chardev.xml | 50 ++++++++ tests/qemuxml2argvtest.c | 20 ++++ ...xml2xmlout-serial-tcp-tlsx509-chardev-notls.xml | 1 + tests/qemuxml2xmltest.c | 1 + 20 files changed, 483 insertions(+), 17 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-serial-tcp-tlsx509-chardev-notls.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-serial-tcp-tlsx509-chardev-notls.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-serial-tcp-tlsx509-secret-chardev.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-serial-tcp-tlsx509-secret-chardev.xml create mode 120000 tests/qemuxml2xmloutdata/qemuxml2xmlout-serial-tcp-tlsx509-chardev-notls.xml -- 2.7.4

2 15