- Devel - libvirt List Archives

[libvirt] GSoC 2017
by Michal Privoznik 11 Oct '16

11 Oct '16

Dear list, the new round of Google Summer of Code has been announced just now [1]. I believe libvirt wants to participate again, therefore I've started a new wikipage where we can collect ideas for students to work on [2]. If you have any idea just put it on the list please. If you are shy, drop me an e-mail and I'll put it there for you. Also, if you want to participate as a mentor, just add yourself to a project that has none yet (or talk to other mentors for cooperation). Please note that nothing is decided yet, the program has been just announced, we have been not selected yet. I haven't even filled out the application form yet. But in order to do so, I need a list of possible ideas and mentors. Thank you! Michal 1: https://opensource.googleblog.com/2016/10/announcing-google-code-in-2016-an… 2: http://wiki.libvirt.org/page/Google_Summer_of_Code_2017

1 0

[libvirt] [PATCH 0/2] Maybe fix a crash and some unnecessary logging
by Martin Kletzander 11 Oct '16

11 Oct '16

First patch fixes some unnecessary loging I've found out thanks to Vincent's crash reproducer. The second one is an RFC, I would like to know what others think about and can find (and maybe help). More info in that commit message. Martin Kletzander (2): Don't update timer if there's none. Purge marked callbacks before dispatching events src/conf/object_event.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) -- 2.10.1

2 6

[libvirt] [PATCH 0/7] Fixes to various different issues
by John Ferlan 10 Oct '16

10 Oct '16

All found by Coverity.... Not being so diligent lately... There are a few more, but they're all false positives so I'll keep those local. John Ferlan (7): conf: Remove incorrect check when encoding shmem audit message tests: Prefer virGetLastErrorMessage in testSELinuxLabeling qemu: Remove possibility of NULL dereference util: Resolve memory leaks in virLogParse{Output|Filter} vsh: Fix some issues in auto completion code util: Remove need for local 'nelems' tests: Need to initialize data src/conf/domain_audit.c | 4 ++-- src/qemu/qemu_capabilities.c | 7 +++++-- src/util/virlog.c | 4 ++-- src/util/virqemu.c | 3 +-- tests/qemumonitorjsontest.c | 2 +- tests/securityselinuxlabeltest.c | 6 ++---- tools/vsh.c | 7 ++++--- 7 files changed, 17 insertions(+), 16 deletions(-) -- 2.7.4

2 16

[libvirt] Analysis of the effect of adding PCIe root ports
by Richard W.M. Jones 10 Oct '16

10 Oct '16

I was asked to look at the impact on boot times of adding (empty) PCIe root ports to the device model. The proposal from Laine is to add a few of these to every guest to allow hotplugging. Last time I looked into this I found that probing any (legacy) PCI device is expensive because of the inefficient way that qemu emulates accesses to PCI config space, requiring IIRC 2 or 4 VMEXITs to access every word. (PCI slots which are not occupied are basically free, the problem is PCI devices). At that time I did not look at Q35/PCIe at all. We generally aim for boot times under 600-700ms. Probing PCI devices takes a significant fraction of this time. The detailed analysis is attached. It comes from a program called 'boot-analysis' (https://github.com/libguestfs/libguestfs/tree/master/utils/boot-analysis) It is best viewed using 'less -r' so that you can see the colours. The summary table is: Number of ports 0 1 2 3 4 bios:overhead 874 884 875 878 935 kernel:entry 159 163 165 174 491 kernel:initcalls-before-userspace 1065 1090 1110 1147 1263 /init:udev-overhead 173 187 185 193 301 insmod virtio_pci 43 41 41 41 74 TOTAL + 51 + 62 + 119 + 750 (All times are in milliseconds.) A few observations: (1) For #ports <= 3, each extra port adds around 30-40ms to the boot time, which is consistent with what I saw when I measured legacy PCI. (2) There is a sudden, unexplained and reproducible discontinuity when going from 3 to 4 ports. (Because libguestfs uses other devices, this might not actually be 3 to 4 PCIe devices, this is spare ports after all the others added for libguestfs devices.) (3) "kernel:entry" covers a lot of initialization that happens before the kernel prints its version string. This is moderately affected by adding PCIe ports until we hit the discontinuity. Based on this analysis I conclude: (a) Unless we can explain the discontinuity, avoid adding more than 3 root ports. (b) It would be nice to turn the whole thing off for people who don't care about / need hotplugging. (c) We could make PCI probing a lot faster by having the kernel handle PCI config space. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com libguestfs lets you edit virtual machines. Supports shell scripting, bindings from many languages. http://libguestfs.org

4 15

[libvirt] [PATCH 0/2] network: add dnsmasq option 'dhcp-authoritative'
by Martin Wilck 10 Oct '16

10 Oct '16

Lest it be forgotten, here is a rebased version of my "dhcp-authoritative" patch (against 77d24de). According to dnsmasq(8), this option "should be set when dnsmasq is definitely the only DHCP server on a network", whis is the case for libvirt-managed networks. In practice, this option has the effect that an expired lease can be reacquired by the client using a DHCPREQUEST unless it has been given to another client in the meantime. Without "dhcp-authoritative", this operation always fails, which can be quite cumbersome. There is no protection against rogue clients hijacking other client's IP addresses, but that isn't specific to libvirt, and IP addresses don't provide security anyway. This is ovbiously not aimed at production environments; it's a convenience for developers and casual users who'd rather not be bothered with network XML host entries or the like. Original submission: https://www.redhat.com/archives/libvir-list/2016-September/msg00739.html Daniel's post where he said that "unless there's a obvious downside to it, it seems reasonable to add that": https://www.redhat.com/archives/libvir-list/2016-September/msg01305.html Regards, Martin Martin Wilck (2): network: add dnsmasq option 'dhcp-authoritative' tests/networkxml2confdata: add dhcp-authoritative option src/network/bridge_driver.c | 4 +++- tests/networkxml2confdata/dhcp6-nat-network.conf | 1 + tests/networkxml2confdata/dhcp6host-routed-network.conf | 1 + tests/networkxml2confdata/isolated-network.conf | 1 + tests/networkxml2confdata/nat-network-dns-srv-record-minimal.conf | 1 + tests/networkxml2confdata/nat-network-dns-srv-record.conf | 1 + tests/networkxml2confdata/nat-network-dns-txt-record.conf | 1 + tests/networkxml2confdata/nat-network-name-with-quotes.conf | 1 + tests/networkxml2confdata/nat-network.conf | 1 + tests/networkxml2confdata/netboot-network.conf | 1 + tests/networkxml2confdata/netboot-proxy-network.conf | 1 + 11 files changed, 13 insertions(+), 1 deletion(-) -- 2.10.0

2 4

[libvirt] dnsmasq option "dhcp-authoritative" in libvirt virtual networks?
by Martin Wilck 10 Oct '16

10 Oct '16

Hello, I am seeing a slightly annoying behavior of libvirt-created networks on my system. Whenever a VM fails to renew its DHCP lease in time (for example because my laptop is suspended), the IP address changes, causing various annoyances. If this happens, the log message "DHCPNAK(virbrX): ... lease not found" appears in the libvirtd logs. Looking at the dnsmasq code, it seems that this would be fixed by running dnsmasq with the "dhcp-authoritative" option, which, according to the dnsmasq man page, "should be set when dnsmasq is definitely the only DHCP server on a network" - IMO that's the case for libvirtd- managed virtual networks. So the question comes to my mind: is there a good reason why libvirtd doesn't set "dhcp-authoritative" on the dnsmasq instances it starts? Regards Martin -- Dr. Martin Wilck <mwilck(a)suse.com>, Tel. +49 (0)911 74053 2107 SUSELinux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton HRB 21284 (AG Nürnberg)

4 6

[libvirt] [PATCH] audit: add audit information about panic devices
by Chen Hanxiao 10 Oct '16

10 Oct '16

From: Chen Hanxiao <chenhanxiao(a)gmail.com> This patch add audit info for panic notifier devices. Signed-off-by: Chen Hanxiao <chenhanxiao(a)gmail.com> --- docs/auditlog.html.in | 15 +++++++++++++++ src/conf/domain_audit.c | 38 ++++++++++++++++++++++++++++++++++++++ src/conf/domain_audit.h | 4 ++++ src/libvirt_private.syms | 1 + 4 files changed, 58 insertions(+) diff --git a/docs/auditlog.html.in b/docs/auditlog.html.in index 0c778aa..45464af 100644 --- a/docs/auditlog.html.in +++ b/docs/auditlog.html.in @@ -371,5 +371,20 @@ <dd>Path of the backing character device for given emulated device</dd> </dl> + + <h4><a name="typeresourcepanic">Panic notifier</a></h4> + <p> + The <code>msg</code> field will include the following sub-fields + </p> + + <dl> + <dt><code>resrc</code></dt> + <dd>The type of resource assigned. Set to <code>panic</code></dd> + <dt><code>reason</code></dt> + <dd>The reason which caused the resource to be assigned to happen</dd> + <dt><code>model</code></dt> + <dd>The model of the panic notifier device</dd> + </dl> + </body> </html> diff --git a/src/conf/domain_audit.c b/src/conf/domain_audit.c index fd20ace..e48a63d 100644 --- a/src/conf/domain_audit.c +++ b/src/conf/domain_audit.c @@ -893,6 +893,9 @@ virDomainAuditStart(virDomainObjPtr vm, const char *reason, bool success) for (i = 0; i < vm->def->nshmems; i++) virDomainAuditShmem(vm, vm->def->shmems[i], "start", true); + for (i = 0; i < vm->def->npanics; i++) + virDomainAuditPanic(vm, vm->def->panics[i], "start", true); + virDomainAuditMemory(vm, 0, virDomainDefGetMemoryTotal(vm->def), "start", true); virDomainAuditVcpu(vm, 0, virDomainDefGetVcpus(vm->def), "start", true); @@ -1006,3 +1009,38 @@ virDomainAuditShmem(virDomainObjPtr vm, VIR_FREE(shmem); return; } + +void +virDomainAuditPanic(virDomainObjPtr vm, + virDomainPanicDefPtr def, + const char *reason, + bool success) +{ + char uuidstr[VIR_UUID_STRING_BUFLEN]; + char *vmname = virAuditEncode("vm", vm->def->name); + const char *panic_model = virDomainPanicModelTypeToString(def->model); + char *model = virAuditEncode("model", VIR_AUDIT_STR(panic_model)); + const char *virt = virDomainVirtTypeToString(vm->def->virtType); + + virUUIDFormat(vm->def->uuid, uuidstr); + + if (!vmname || !model) { + VIR_WARN("OOM while encoding audit message"); + goto cleanup; + } + + if (!virt) { + VIR_WARN("Unexpected virt type %d while encoding audit message", + vm->def->virtType); + virt = "?"; + } + + VIR_AUDIT(VIR_AUDIT_RECORD_RESOURCE, success, + "virt=%s resrc=PanicNotifier reason=%s %s uuid=%s %s", + virt, reason, vmname, uuidstr, model); + + cleanup: + VIR_FREE(vmname); + VIR_FREE(model); + return; +} diff --git a/src/conf/domain_audit.h b/src/conf/domain_audit.h index 8cb585d..10ecc2a 100644 --- a/src/conf/domain_audit.h +++ b/src/conf/domain_audit.h @@ -133,6 +133,10 @@ void virDomainAuditShmem(virDomainObjPtr vm, virDomainShmemDefPtr def, const char *reason, bool success) ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3); +void virDomainAuditPanic(virDomainObjPtr vm, + virDomainPanicDefPtr def, + const char *reason, bool success) + ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3); #endif /* __VIR_DOMAIN_AUDIT_H__ */ diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 923afd1..94ec7cb 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -146,6 +146,7 @@ virDomainAuditIOThread; virDomainAuditMemory; virDomainAuditNet; virDomainAuditNetDevice; +virDomainAuditPanic; virDomainAuditRedirdev; virDomainAuditRNG; virDomainAuditSecurityLabel; -- 1.8.3.1

3 3

[libvirt] [PATCH 00/11] cleanups and improvements for video device code
by Pavel Hrdina 10 Oct '16

10 Oct '16

Pavel Hrdina (11): tests: fix some QXL capability combinations that doesn't make sense qemu_capabilities: join capabilities for qxl and qxl-vga devices qemu_capabilities: mark QEMU_CAPS_VGA_QXL capability as deprecated qemu_domain: move video validation out of qemu_command qemu_process: move video validation out of qemu_command qemu_capabilities: rename QEMU_CAPS_VIRTIO_GPU_VIRGL qemu_command: separate code for video device via -vga attribute qemu_command: cleanup qemuBuildVideoCommandLine qemu_capabilities: check for existence of virtio-vga qemu_command: properly detect which model to use for video device qemu_command: add support to use virtio as secondary video device docs/formatdomain.html.in | 3 +- src/qemu/qemu_capabilities.c | 23 +- src/qemu/qemu_capabilities.h | 15 +- src/qemu/qemu_command.c | 335 +++++++++------------ src/qemu/qemu_domain.c | 70 +++++ src/qemu/qemu_domain.h | 3 + src/qemu/qemu_domain_address.c | 6 - src/qemu/qemu_process.c | 54 +++- .../qemu_2.6.0-gicv2-virt.aarch64.xml | 1 - .../qemu_2.6.0-gicv3-virt.aarch64.xml | 1 - tests/domaincapsschemadata/qemu_2.6.0.aarch64.xml | 1 - tests/domaincapsschemadata/qemu_2.6.0.ppc64le.xml | 1 - .../qemucapabilitiesdata/caps_1.2.2.x86_64.replies | 70 +---- tests/qemucapabilitiesdata/caps_1.2.2.x86_64.xml | 4 - .../qemucapabilitiesdata/caps_1.3.1.x86_64.replies | 76 +---- tests/qemucapabilitiesdata/caps_1.3.1.x86_64.xml | 4 - .../qemucapabilitiesdata/caps_1.4.2.x86_64.replies | 74 +---- tests/qemucapabilitiesdata/caps_1.4.2.x86_64.xml | 4 - .../qemucapabilitiesdata/caps_1.5.3.x86_64.replies | 74 +---- tests/qemucapabilitiesdata/caps_1.5.3.x86_64.xml | 4 - .../qemucapabilitiesdata/caps_1.6.0.x86_64.replies | 74 +---- tests/qemucapabilitiesdata/caps_1.6.0.x86_64.xml | 4 - .../qemucapabilitiesdata/caps_1.7.0.x86_64.replies | 74 +---- tests/qemucapabilitiesdata/caps_1.7.0.x86_64.xml | 4 - .../qemucapabilitiesdata/caps_2.1.1.x86_64.replies | 74 +---- tests/qemucapabilitiesdata/caps_2.1.1.x86_64.xml | 4 - .../qemucapabilitiesdata/caps_2.4.0.x86_64.replies | 107 ++----- tests/qemucapabilitiesdata/caps_2.4.0.x86_64.xml | 6 +- .../qemucapabilitiesdata/caps_2.5.0.x86_64.replies | 117 +++---- tests/qemucapabilitiesdata/caps_2.5.0.x86_64.xml | 6 +- .../caps_2.6.0-gicv2.aarch64.replies | 43 ++- .../caps_2.6.0-gicv2.aarch64.xml | 1 - .../caps_2.6.0-gicv3.aarch64.replies | 43 ++- .../caps_2.6.0-gicv3.aarch64.xml | 1 - .../caps_2.6.0.ppc64le.replies | 43 ++- tests/qemucapabilitiesdata/caps_2.6.0.ppc64le.xml | 2 +- .../qemucapabilitiesdata/caps_2.6.0.x86_64.replies | 117 +++---- tests/qemucapabilitiesdata/caps_2.6.0.x86_64.xml | 6 +- .../qemucapabilitiesdata/caps_2.7.0.x86_64.replies | 122 +++----- tests/qemucapabilitiesdata/caps_2.7.0.x86_64.xml | 6 +- tests/qemuhelptest.c | 4 - .../qemuxml2argv-pcie-root-port.args | 5 +- .../qemuxml2argv-pcie-switch-downstream-port.args | 5 +- .../qemuxml2argv-pcie-switch-upstream-port.args | 5 +- .../qemuxml2argv-pcihole64-q35.args | 5 +- .../qemuxml2argv-q35-usb2-multi.args | 5 +- .../qemuxml2argv-q35-usb2-reorder.args | 5 +- tests/qemuxml2argvdata/qemuxml2argv-q35-usb2.args | 5 +- tests/qemuxml2argvdata/qemuxml2argv-q35.args | 5 +- .../qemuxml2argv-video-virtio-gpu-device.args | 2 +- .../qemuxml2argv-video-virtio-gpu-sec.args | 25 ++ .../qemuxml2argv-video-virtio-gpu-sec.xml | 36 +++ .../qemuxml2argv-video-virtio-gpu-spice-gl.args | 2 +- .../qemuxml2argv-video-virtio-gpu-virgl.args | 2 +- .../qemuxml2argv-video-virtio-vga.args | 24 ++ ...evice.xml => qemuxml2argv-video-virtio-vga.xml} | 11 +- tests/qemuxml2argvtest.c | 152 +++++----- tests/qemuxml2xmltest.c | 18 +- 58 files changed, 778 insertions(+), 1215 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-video-virtio-gpu-sec.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-video-virtio-gpu-sec.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-video-virtio-vga.args rename tests/qemuxml2argvdata/{qemuxml2argv-video-qxl-sec-nodevice.xml => qemuxml2argv-video-virtio-vga.xml} (77%) -- 2.10.0

2 31

[libvirt] [PATCH v2 00/20] Split parsing and defining logic of daemon's logging
by Erik Skultety 10 Oct '16

10 Oct '16

v2 of the original series https://www.redhat.com/archives/libvir-list/2016-May/msg00229.html since v1: - as Cole pointed out in 20/38 of the original series, the patches were not designed in an elegant way and they were hard to review, so this series reworked the whole series: -> first the existing methods that do combine parsing and defining logic and which should be dropped are renamed to a more accurate name -> all the necessary methods to achieve the "split" are introduced gradually, interconnected with each other -> finally, all the callers switch to the new logic introduced in the early patches in a transparent way -> all the original poorly named methods are completely dropped - also, the original series introduced a new set of API locks because there was an issue with 2 concurrent setters that while setter1 was preparing its local set of outputs to replace the existing global one, setter2 might just replace the global set with its copy, invalidating all fds of the setter1's set because the original series used a concept of *copying* (not duplicating) of fds, so the copied fd would be invalidated by issuing reset by setter2. This series however, duplicates the file-based outputs' (that should remain opened) fds. So even if setter2 replaces the original set with its copy and calls reset, effectively closing all fds, it does not matter for setter1, since unlink only decrements the number of references to a specific opened fd. Erik Skultety (20): virlog: Rename virLogParse* to virLogParseAndDefine* virlog: Introduce virLogOutputNew virlog: Introduce virLogFilterNew virlog: Introduce virLogFindOutput virlog: Introduce virLogDefineOutputs virlog: Introduce virLogDefineFilters virlog: Introduce virLogNewOutputTo* as a replacement for virLogAddOutputTo* virlog: Take a special care of syslog when setting new set of log outputs virlog: Introduce virLogParseOutput virlog: Introduce virLogParseFilter virlog: Introduce virLogParseOutputs virlog: Introduce virLogParseFilters virlog: Introduce virLogSetOutputs virlog: Introduce virLogSetFilters daemon: Split output parsing and output defining daemon: Split filter parsing and filter defining virlog: Remove functions that aren't used anywhere anymore virlog: Make some of the methods static virlog: Store the journald fd within the output object virlog: Split parsing and setting priority daemon/libvirtd.c | 8 +- src/libvirt_private.syms | 10 +- src/locking/lock_daemon.c | 8 +- src/logging/log_daemon.c | 8 +- src/util/virlog.c | 1079 ++++++++++++++++++++++++++------------------- src/util/virlog.h | 61 +-- tests/eventtest.c | 3 +- tests/testutils.c | 11 +- tests/virlogtest.c | 10 +- 9 files changed, 702 insertions(+), 496 deletions(-) -- 2.5.5

3 52

[libvirt] [PATCH] vz: fix vnc host address
by Mikhail Feoktistov 10 Oct '16

10 Oct '16

Empty string means 127.0.0.1 in terms of vzSDK But in this case we should set 0.0.0.0 --- .gnulib | 2 +- src/vz/vz_sdk.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.gnulib b/.gnulib index e89b4a7..a2a3943 160000 --- a/.gnulib +++ b/.gnulib @@ -1 +1 @@ -Subproject commit e89b4a7aefce9cb02963920712ba7cdd13641644 +Subproject commit a2a39436b65f329630df4a93ec4e30aeae403c54 diff --git a/src/vz/vz_sdk.c b/src/vz/vz_sdk.c index f2a5c96..7011cbf 100644 --- a/src/vz/vz_sdk.c +++ b/src/vz/vz_sdk.c @@ -2967,7 +2967,7 @@ static int prlsdkApplyGraphicsParams(PRL_HANDLE sdkdom, glisten = virDomainGraphicsGetListen(gr, 0); pret = PrlVmCfg_SetVNCHostName(sdkdom, glisten && glisten->address ? - glisten->address : ""); + glisten->address : "0.0.0.0"); prlsdkCheckRetGoto(pret, cleanup); ret = 0; -- 1.8.3.1

3 3