- Devel - libvirt List Archives

[libvirt] [PATCH] libxl: advertise support for migration V3
by Jim Fehlig 31 Aug '16

31 Aug '16

The libxl driver has long supported migration V3 but has never indicated so in the connectSupportsFeature API. As a result, apps such as virt-manager that use the more generic virDomainMigrate API fail with libvirtError: this function is not supported by the connection driver: virDomainMigrate Add VIR_DRV_FEATURE_MIGRATION_V3 to the list of features marked as supported in the connectSupportsFeature API. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- src/libxl/libxl_driver.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index a573c82..3ffaa74 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -5677,6 +5677,7 @@ libxlConnectSupportsFeature(virConnectPtr conn, int feature) return -1; switch (feature) { + case VIR_DRV_FEATURE_MIGRATION_V3: case VIR_DRV_FEATURE_TYPED_PARAM_STRING: case VIR_DRV_FEATURE_MIGRATION_PARAMS: case VIR_DRV_FEATURE_MIGRATION_P2P: -- 2.9.2

3 5

Re: [libvirt] Virtqueue size exceeded error when resuming VM
by Moshe Levi 30 Aug '16

30 Aug '16

It seem that on Ubuntu they reverted the patch See https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/1612089 I tested on Ubuntu with 14.04 and it working ii ipxe-qemu 1.0.0+git-20131111.c3d1e78-2ubuntu1.1 all PXE boot firmware - ROM images for qemu ii qemu-keymaps 2.0.0+dfsg-2ubuntu1.22 all QEMU keyboard maps ii qemu-kvm 2.0.0+dfsg-2ubuntu1.27 amd64 QEMU Full virtualization ii qemu-system-common 2.0.0+dfsg-2ubuntu1.22 amd64 QEMU full system emulation binaries (common files) ii qemu-system-x86 2.0.0+dfsg-2ubuntu1.27 I also test it with Ubuntu 16.04 and it working. But on redhat 7.2 I still have the issue. qemu-img-1.5.3-105.el7_2.7.x86_64 libvirt-daemon-driver-qemu-1.2.17-13.el7_2.5.x86_64 qemu-system-x86-2.0.0-1.el7.6.x86_64 ipxe-roms-qemu-20160127-1.git6366fa7a.el7.noarch qemu-common-2.0.0-1.el7.6.x86_64 qemu-kvm-common-1.5.3-105.el7_2.7.x86_64 qemu-kvm-1.5.3-105.el7_2.7.x86_64 I didn't find new packages that revert the patch. Does anyone know what is the plan for RedHat? > -----Original Message----- > From: Moshe Levi > Sent: Monday, August 08, 2016 2:50 PM > To: Libvirt <libvir-list(a)redhat.com> > Subject: Virtqueue size exceeded error when resuming VM > > Hi, > A new security fix [1],[2] and [3] merged to qemu. > After updating the packages we started to get "qemu-system-x86_64: > Virtqueue size exceeded", when resuming the guest. > > Our environment is OpenStack master and we have Mellanox CI that test SR- > IOV functionality. > Ubuntu 14.04 with Qemu 2.0.0+dfsg-2ubuntu1.26 that contains the fixes see > [2] > ii qemu-kvm 2.0.0+dfsg-2ubuntu1.26 amd64 QEMU > Full virtualization > ii qemu-system-x86 2.0.0+dfsg-2ubuntu1.26 amd64 > QEMU full system emulation binaries (x86) > ii qemu-utils 2.0.0+dfsg-2ubuntu1.26 amd64 QEMU > utilities > Our CI started to fail last week when this security packages released. > > The scenarios is as follows (sorry for the OpenStack commands :)) : > 1. nova boot guest > 2. nova suspend guest > 3. nova resume guest > > The result is that the guest is in poweroff state and when I power it on > everything is working fine. > > I tested in direct port (SR-IOV) and normal port (virtual port) and it happens > in both cases. > > > According to the [3] it prevent from malicious guest to submit more requests > than the virtqueuesize permits. > Our CI uses proprietary Cirros image with mlnx4_en driver. > (http://13.69.151.247/images/mellanox_eth.img) > I started to test it with other images to see if the problem with our image. > I also tested with Ubuntu image - https://cloud- > images.ubuntu.com/wily/current/wily-server-cloudimg-amd64-disk1.img > And OpenStack Cirros image http://download.cirros-cloud.net/0.3.4/cirros- > 0.3.4-x86_64-disk.img > > The Ubuntu image had the same failure, but the Cirros worked. > > I wonder if there is a problem with the patch or with the images? > What in these images can make them malicious guest? > > > > [1] - https://access.redhat.com/security/cve/cve-2016-5403 > [2] - http://www.ubuntu.com/usn/usn-3047-1/ > [3] - https://lists.gnu.org/archive/html/qemu-devel/2016-07/msg06257.html

1 0

[libvirt] [PATCH v2] tests: fix segfault in objecteventtest
by Roman Bogorodskiy 29 Aug '16

29 Aug '16

Test 12 from objecteventtest (createXML add event) segaults on FreeBSD with bus error. At some point it calls testNodeDeviceDestroy() from the test driver. And it fails when it tries to unlock the device in the "out:" label of this function. Unlocking fails because the previous step was a call to virNodeDeviceObjRemove from conf/node_device_conf.c. This function removes the given device from the device list and cleans up the object, including destroying of its mutex. However, it does not nullify the pointer that was given to it. As a result, we end up in testNodeDeviceDestroy() here: out: if (obj) virNodeDeviceObjUnlock(obj); And instead of skipping this, we try to do Unlock and fail because of malformed mutex. Change virNodeDeviceObjRemove to use double pointer and set pointer to NULL. --- src/conf/node_device_conf.c | 13 +++++++------ src/conf/node_device_conf.h | 2 +- src/node_device/node_device_hal.c | 4 ++-- src/test/test_driver.c | 2 +- 4 files changed, 11 insertions(+), 10 deletions(-) diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c index a23d8ef..719abcd 100644 --- a/src/conf/node_device_conf.c +++ b/src/conf/node_device_conf.c @@ -207,22 +207,23 @@ virNodeDeviceObjPtr virNodeDeviceAssignDef(virNodeDeviceObjListPtr devs, } void virNodeDeviceObjRemove(virNodeDeviceObjListPtr devs, - virNodeDeviceObjPtr dev) + virNodeDeviceObjPtr *dev) { size_t i; - virNodeDeviceObjUnlock(dev); + virNodeDeviceObjUnlock(*dev); for (i = 0; i < devs->count; i++) { - virNodeDeviceObjLock(dev); - if (devs->objs[i] == dev) { - virNodeDeviceObjUnlock(dev); + virNodeDeviceObjLock(*dev); + if (devs->objs[i] == *dev) { + virNodeDeviceObjUnlock(*dev); virNodeDeviceObjFree(devs->objs[i]); + *dev = NULL; VIR_DELETE_ELEMENT(devs->objs, i, devs->count); break; } - virNodeDeviceObjUnlock(dev); + virNodeDeviceObjUnlock(*dev); } } diff --git a/src/conf/node_device_conf.h b/src/conf/node_device_conf.h index 8f23a98..9f00500 100644 --- a/src/conf/node_device_conf.h +++ b/src/conf/node_device_conf.h @@ -249,7 +249,7 @@ virNodeDeviceObjPtr virNodeDeviceAssignDef(virNodeDeviceObjListPtr devs, virNodeDeviceDefPtr def); void virNodeDeviceObjRemove(virNodeDeviceObjListPtr devs, - virNodeDeviceObjPtr dev); + virNodeDeviceObjPtr *dev); char *virNodeDeviceDefFormat(const virNodeDeviceDef *def); diff --git a/src/node_device/node_device_hal.c b/src/node_device/node_device_hal.c index ef0cd9c..fb7bf25 100644 --- a/src/node_device/node_device_hal.c +++ b/src/node_device/node_device_hal.c @@ -530,7 +530,7 @@ dev_refresh(const char *udi) /* Simply "rediscover" device -- incrementally handling changes * to sub-capabilities (like net.80203) is nasty ... so avoid it. */ - virNodeDeviceObjRemove(&driver->devs, dev); + virNodeDeviceObjRemove(&driver->devs, &dev); } else { VIR_DEBUG("no device named %s", name); } @@ -560,7 +560,7 @@ device_removed(LibHalContext *ctx ATTRIBUTE_UNUSED, dev = virNodeDeviceFindByName(&driver->devs, name); VIR_DEBUG("%s", name); if (dev) - virNodeDeviceObjRemove(&driver->devs, dev); + virNodeDeviceObjRemove(&driver->devs, &dev); else VIR_DEBUG("no device named %s", name); nodeDeviceUnlock(); diff --git a/src/test/test_driver.c b/src/test/test_driver.c index bc1f93d..53cfa3c 100644 --- a/src/test/test_driver.c +++ b/src/test/test_driver.c @@ -5534,7 +5534,7 @@ testNodeDeviceDestroy(virNodeDevicePtr dev) 0); virNodeDeviceObjLock(obj); - virNodeDeviceObjRemove(&driver->devs, obj); + virNodeDeviceObjRemove(&driver->devs, &obj); out: if (obj) -- 2.7.4

2 2

[libvirt] RFC: Limited dynamic ownership
by Martin Kletzander 29 Aug '16

29 Aug '16

Hi everyone, so there was an idea about limiting the relabelling of images that libvirt does. And I'm taking the liberty of pitching my idea how to approach this. I feel like it's pretty simple thing and there's not much to talk about, but a) I could've missed something and b) you might hate the way I approach it. The idea is to extend the seclabel XML, for example: <seclabel type='dynamic' model='dac' relabel='whitelist'> <path>/var/lib/libvirt/images</path> <path>/data/virt-stuff</path> </seclabel> Either we allow 'relabel' to be set to 'whitelist' or add a new attribute with a name like 'mode' or something, which will control how we relabel the files (actually relabel='no' can mean 'whitelist' and relabel='yes' can mean blacklist without adding anything there). After that you can specify what paths are (dis)allowed to be labelled. Actually thinking about it I like the following the most: <seclabel type='dynamic' model='dac' relabel='no'> <whitelist path='/data'/> <blacklist path='/data/private/non-virt/stuff'/> </seclabel> which I believe is pretty explanatory. Feel free to ask if it's not. And let me know what you think. And have a nice day!!! Martin

2 4

[libvirt] RFC: Qemu/SeaBIOS/VGA/PXE upgrades vs. longterm-snapshot/migration
by Philipp Hahn 29 Aug '16

29 Aug '16

Hello, If my understanding of migration/snapshots is correct, the target/loading VM must be a clone of the source/saving VM, that is have the same devices, RAM/PCI layout, etc. In the past I have had several issues with Qemu, when the distribution (Debian) updates their packaging of SeaBIOS/iPXE/VgaROM, which changes the the next/previous power-of-2 size and thus changes the PCI layout, preventing me from loading old snapshots. As the BIOS file is provided externally, it is prone to such (accidental) updates. As (AFAIK) libvirt does not track the Qemu version, BIOS files inside its XML data, there's always the danger of making snapshots invalid by updating Qemu and the BIOS files. Some questions: 1. Does Qemu use ROM shadowing, that is copying the ROM to RAM? This makes sense on real HW as ROMs are a low slower than RAM. In that case the content of the "ROM" would already be contained inside the VM-State and it would be enough to provide an "empty ROM file of the right size". 2. If Qemu does no ROM shadowing, what happens if I suspend a VM while executing ROM or SMM code and then doing an SeaBIOS update? (my DOS-assembler knowledge is quiet old nowadays) 3. How do others handle long-term snapshots? Just say "good-bye" to your old snapshots when upgrading to a newer Qemu version or keeping the old, probably unmaintained and vulnerable Qemu/BIOS binaries until the end-of-time? Thanks in advance Philipp -- Philipp Hahn Open Source Software Engineer Univention GmbH be open. Mary-Somerville-Str. 1 D-28359 Bremen Tel.: +49 421 22232-0 Fax : +49 421 22232-99 hahn(a)univention.de http://www.univention.de/ Geschäftsführer: Peter H. Ganten HRB 20755 Amtsgericht Bremen Steuer-Nr.: 71-597-02876

2 1

[libvirt] [PATCH] bhyve: fix disks address allocation
by Roman Bogorodskiy 29 Aug '16

29 Aug '16

As bhyve currently doesn't use controller addressing and simply uses 1 implicit controller for 1 disk device, the scheme looks the following: pci addrees -> (implicit controller) -> disk device So in fact we identify disk devices by pci address of implicit controller and just pass it this way to bhyve in a form: -s pci_addr,ahci-(cd|hd),/path/to/disk Therefore, we cannot use virDeviceInfoPCIAddressWanted() because it does not expect that disk devices might need PCI address assignment. As a result, if a disk was specified without address, it will not be generated and domain will to start. Until proper controller addressing is not implemented in the bhyve driver, force each disk to have PCI address generated if it was not specified by user. --- src/bhyve/bhyve_device.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/bhyve/bhyve_device.c b/src/bhyve/bhyve_device.c index 8373a5f..ca30e9f 100644 --- a/src/bhyve/bhyve_device.c +++ b/src/bhyve/bhyve_device.c @@ -107,7 +107,8 @@ bhyveAssignDevicePCISlots(virDomainDefPtr def, } for (i = 0; i < def->ndisks; i++) { - if (!virDeviceInfoPCIAddressWanted(&def->disks[i]->info)) + if (def->disks[i]->info.type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI && + !virPCIDeviceAddressIsEmpty(&def->disks[i]->info.addr.pci)) continue; if (virDomainPCIAddressReserveNextSlot(addrs, &def->disks[i]->info, -- 2.9.2

2 2

[libvirt] [PATCH 0/6] auto-assign addresses when <address type='pci'/> is specified
by Laine Stump 28 Aug '16

28 Aug '16

This is an alternative to Cole's series that permits <address type='pci'/> to force assignment of a PCI address, which is particularly useful on platforms that could connect the same device in different ways (e.g. aarch64/virt). Here is Cole's last iteration of the series: https://www.redhat.com/archives/libvir-list/2016-May/msg01088.html I had expressed a dislike of the "auto_allocate" flag that his series temporarily adds to the address (while simultaneously changing the address type to NONE) and suggested just changing all the necessary places to check for a valid PCI address instead of just checking the address type. He replied that this wasn't as simple as it looked, so I decided to try it; turns out he's right. But I still like this method better because it's not playing tricks with the address type, or adding a temporary private attribute to what should be pure config data. Your opinion may vary though :-) Note that patch 5/6 incorporates the same test case that Cole used in his penultimate patch, and I've added his patch to check the case of aarch64 at the end as well. Cole Robinson (1): tests: qemu: test <address type='pci'/> with aarch64 Laine Stump (5): conf: move virDomainDeviceInfo definition from domain_conf.h to device_conf.h conf: new functions to check if PCI address is wanted/present conf: allow type='pci' addresses with no address attributes specified bhyve: auto-assign addresses when <address type='pci'/> is specified qemu: auto-assign addresses when <address type='pci'/> is specified docs/schemas/basictypes.rng | 8 +- src/bhyve/bhyve_device.c | 10 +- src/conf/device_conf.c | 6 +- src/conf/device_conf.h | 132 ++++++++++++++++++++- src/conf/domain_addr.c | 2 +- src/conf/domain_conf.c | 13 +- src/conf/domain_conf.h | 129 -------------------- src/qemu/qemu_domain_address.c | 64 +++++----- ...l2argv-aarch64-virtio-pci-manual-addresses.args | 4 +- ...ml2argv-aarch64-virtio-pci-manual-addresses.xml | 5 + .../qemuxml2argv-pci-autofill-addr.args | 25 ++++ .../qemuxml2argv-pci-autofill-addr.xml | 35 ++++++ tests/qemuxml2argvtest.c | 1 + ...2xmlout-aarch64-virtio-pci-manual-addresses.xml | 5 + .../qemuxml2xmlout-pci-autofill-addr.xml | 41 +++++++ tests/qemuxml2xmltest.c | 1 + 16 files changed, 298 insertions(+), 183 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-pci-autofill-addr.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-pci-autofill-addr.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-pci-autofill-addr.xml -- 2.5.5

4 21

[libvirt] [PATCH] docs: Add missing / to closing tag
by Christophe Fergeau 27 Aug '16

27 Aug '16

The iothread example for virtio-scsi should be <driver iothread='4'/> rather than <driver iothread='4'> for the XML to be valid. --- I've already pushed this under the docs/trivial rule. Christophe docs/formatdomain.html.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index f1dadc6..8c15a73 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -3166,7 +3166,7 @@ <address type='pci' domain='0x0000' bus='0x00' slot='0x0a' function='0x0'/> </controller> <controller type='scsi' index='0' model='virtio-scsi'> - <driver iothread='4'> + <driver iothread='4'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x0b' function='0x0'/> </controller> ... -- 2.7.4

1 0

[libvirt] [PATCH 0/6] Fix a few issues introduced by adding vcpu hotplug
by Peter Krempa 27 Aug '16

27 Aug '16

Peter Krempa (6): virsh: vcpuinfo: Report vcpu number from the structure rather than it's position qemu: driver: Fix qemuDomainHelperGetVcpus for sparse vcpu topologies doc: clarify documentation for vcpu order conf: Don't validate vcpu count in XML parser qemu: driver: Validate configuration when setting maximum vcpu count conf: Fix build with picky GCC docs/formatdomain.html.in | 7 ++++--- src/conf/domain_conf.c | 13 ++++--------- src/qemu/qemu_driver.c | 23 ++++++++++++++++++----- tools/virsh-domain.c | 3 ++- 4 files changed, 28 insertions(+), 18 deletions(-) -- 2.8.2

2 12

[libvirt] [PATCH] vz: update domain cache after device updates
by Nikolay Shirokovskiy 27 Aug '16

27 Aug '16

--- src/vz/vz_driver.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/vz/vz_driver.c b/src/vz/vz_driver.c index b34fe33..f223794 100644 --- a/src/vz/vz_driver.c +++ b/src/vz/vz_driver.c @@ -1694,6 +1694,9 @@ static int vzDomainUpdateDeviceFlags(virDomainPtr domain, if (prlsdkUpdateDevice(driver, dom, dev) < 0) goto cleanup; + if (prlsdkUpdateDomain(driver, dom) < 0) + goto cleanup; + ret = 0; cleanup: -- 1.8.3.1

3 2