- Devel - libvirt List Archives

[libvirt] [PATCH] Introduce gnutls_priority config option
by Ján Tomko 19 May '16

19 May '16

The defaults provided by gnutls_set_default_priority are not configurable at runtime. Introduce a new config option to libvirt.conf that will be passed to gnutls_priority_set. One of the possible options is "@SYSTEM", where gnutls will get the settings from /etc/gnutls/default-priorities. Note that the /etc/libvirt/libvirt.conf file is only used by libvirt processes running as root, for regular users the file in $XDG_CONFIG_HOME or ~/.config is used. https://bugzilla.redhat.com/show_bug.cgi?id=1333404 --- src/libvirt.conf | 6 +++++ src/rpc/virnettlscontext.c | 59 +++++++++++++++++++++++++++++++++++++++------- 2 files changed, 56 insertions(+), 9 deletions(-) diff --git a/src/libvirt.conf b/src/libvirt.conf index da4dfbe..688c572 100644 --- a/src/libvirt.conf +++ b/src/libvirt.conf @@ -16,3 +16,9 @@ # (@uri_default also prevents probing of the hypervisor driver). # #uri_default = "qemu:///system" + +# +# Override the priority of exchange methods, ciphers etc. used by gnutls. +# See gnutls_priority_set_direct(3). +# +#gnutls_priority = "@SYSTEM" diff --git a/src/rpc/virnettlscontext.c b/src/rpc/virnettlscontext.c index 947038d..e93887c 100644 --- a/src/rpc/virnettlscontext.c +++ b/src/rpc/virnettlscontext.c @@ -35,6 +35,7 @@ #include "virstring.h" #include "viralloc.h" +#include "virconf.h" #include "virerror.h" #include "virfile.h" #include "virutil.h" @@ -86,10 +87,17 @@ static virClassPtr virNetTLSContextClass; static virClassPtr virNetTLSSessionClass; static void virNetTLSContextDispose(void *obj); static void virNetTLSSessionDispose(void *obj); +static gnutls_priority_t *virNetTLSPriorityCache; static int virNetTLSContextOnceInit(void) { + virConfPtr conf = NULL; + virConfValuePtr value = NULL; + const char *err_pos; + int ret = -1; + int rc; + if (!(virNetTLSContextClass = virClassNew(virClassForObjectLockable(), "virNetTLSContext", sizeof(virNetTLSContext), @@ -102,7 +110,32 @@ static int virNetTLSContextOnceInit(void) virNetTLSSessionDispose))) return -1; - return 0; + if (virConfLoadConfig(&conf, NULL) < 0) + return -1; + + if ((value = virConfGetValue(conf, "gnutls_priority"))) { + if (value->type != VIR_CONF_STRING) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Expected a string for 'gnutls_priority' config parameter")); + goto cleanup; + } + VIR_DEBUG("Using gnutls priority '%s'", value->str); + if (VIR_ALLOC(virNetTLSPriorityCache) < 0) + goto cleanup; + if ((rc = gnutls_priority_init(virNetTLSPriorityCache, value->str, + &err_pos)) != 0) { + VIR_FREE(virNetTLSPriorityCache); + virReportError(VIR_ERR_SYSTEM_ERROR, + _("Failed to initialize TLS session priority \"%s\": %s"), + err_pos, gnutls_strerror(rc)); + goto cleanup; + } + } + + ret = 0; + cleanup: + virConfFree(conf); + return ret; } VIR_ONCE_GLOBAL_INIT(virNetTLSContext) @@ -1224,14 +1257,22 @@ virNetTLSSessionPtr virNetTLSSessionNew(virNetTLSContextPtr ctxt, goto error; } - /* avoid calling all the priority functions, since the defaults - * are adequate. - */ - if ((err = gnutls_set_default_priority(sess->session)) != 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, - _("Failed to set TLS session priority %s"), - gnutls_strerror(err)); - goto error; + /* Use the defaults unless a priority string was specified in the + * config file */ + if (virNetTLSPriorityCache) { + if ((err = gnutls_priority_set(sess->session, *virNetTLSPriorityCache)) != 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("Failed to set TLS session priority %s"), + gnutls_strerror(err)); + goto error; + } + } else { + if ((err = gnutls_set_default_priority(sess->session)) != 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("Failed to set TLS session priority %s"), + gnutls_strerror(err)); + goto error; + } } if ((err = gnutls_credentials_set(sess->session, -- 2.7.3

2 3

[libvirt] [PATCH v7 0/5] vz: add migration support
by Nikolay Shirokovskiy 19 May '16

19 May '16

Difference from v6 ================== Minor fixes suggested by reviewer. Nikolay Shirokovskiy (5): vz: save session uuid on login vz: fix const correctness case vz: implement managed migration vz: implement p2p migration vz: cleanup: define vz format of uuids src/vz/vz_driver.c | 559 +++++++++++++++++++++++++++++++++++++++++++++++++++++ src/vz/vz_sdk.c | 90 +++++++-- src/vz/vz_sdk.h | 6 + src/vz/vz_utils.c | 2 +- src/vz/vz_utils.h | 7 +- 5 files changed, 648 insertions(+), 16 deletions(-) -- 1.8.3.1

2 8

[libvirt] [PATCH v2 0/5] admin: Introduce APIs to get/set client-related limits
by Erik Skultety 19 May '16

19 May '16

since v1: - symbols added to libvirt_remote.syms - APIs renamed - dropped some unwanted client-side flags checks - dropped unnecessary ifs before calling virAdmServerFree (because it handles NULL gracefully) - a man page entry virt-admin's commands created Erik Skultety (5): virnetserver: Introduce server's client-related limits getters admin: Introduce some public constants related to server's client limits admin: Introduce virAdmServerGetClientLimits admin: Introduce virAdmServerSetClientLimits virt-admin: Introduce commands srv-clients-info and srv-clients-set daemon/admin.c | 82 +++++++++++++++++++ daemon/admin_server.c | 76 ++++++++++++++++++ daemon/admin_server.h | 10 +++ include/libvirt/libvirt-admin.h | 52 ++++++++++++ src/admin/admin_protocol.x | 30 ++++++- src/admin/admin_remote.c | 74 +++++++++++++++++ src/admin_protocol-structs | 20 +++++ src/libvirt-admin.c | 85 ++++++++++++++++++++ src/libvirt_admin_private.syms | 3 + src/libvirt_admin_public.syms | 2 + src/libvirt_remote.syms | 4 + src/rpc/virnetserver.c | 83 +++++++++++++++++++ src/rpc/virnetserver.h | 9 +++ tools/virt-admin.c | 174 ++++++++++++++++++++++++++++++++++++++++ tools/virt-admin.pod | 38 +++++++++ 15 files changed, 741 insertions(+), 1 deletion(-) -- 2.5.5

2 7

[libvirt] [PATCH] qemu: Don't lose VM runtime state on libvirt downgrade
by Cole Robinson 19 May '16

19 May '16

Run libvirtd from git with latest qemu, start a VM, stop libvirtd. Run an older libvirtd version an you may see an error like: qemuDomainObjPrivateXMLParse:857 : internal error: Unknown qemu capabilities flag device-tray-moved-event Libvirt finds a cached capabilities flag it doesn't understand, and fails to parse the VM runtime state. It now thinks the VM isn't running, when it is. This is potentially serious since it could lead to disk corruption if the VM is re-run. For the common case of unknown qemu capabilities flags, treat an unknown flag as non-fatal and continue on --- src/qemu/qemu_domain.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index b0eb3b6..dbf8124 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -1411,18 +1411,18 @@ qemuDomainObjPrivateXMLParse(xmlXPathContextPtr ctxt, goto error; for (i = 0; i < n; i++) { + int flag; char *str = virXMLPropString(nodes[i], "name"); - if (str) { - int flag = virQEMUCapsTypeFromString(str); - if (flag < 0) { - virReportError(VIR_ERR_INTERNAL_ERROR, - _("Unknown qemu capabilities flag %s"), str); - VIR_FREE(str); - goto error; - } - VIR_FREE(str); + if (!str) + continue; + + flag = virQEMUCapsTypeFromString(str); + if (flag < 0) { + VIR_WARN("Unknown qemu capabilities flag %s", str); + } else { virQEMUCapsSet(qemuCaps, flag); } + VIR_FREE(str); } priv->qemuCaps = qemuCaps; -- 2.7.4

3 4

[libvirt] [PATCH] qemu_cgroup: allow access to /dev/dri for virtio-vga
by Ján Tomko 19 May '16

19 May '16

QEMU needs access to the /dev/dri/render* device for virgl to work. Allow access to all /dev/dri/* devices for domains with <video> <model type='virtio' heads='1' primary='yes'> <acceleration accel3d='yes'/> </model> </video> https://bugzilla.redhat.com/show_bug.cgi?id=1337290 --- src/qemu/qemu_cgroup.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c index 1e04a68..d676d66 100644 --- a/src/qemu/qemu_cgroup.c +++ b/src/qemu/qemu_cgroup.c @@ -51,6 +51,7 @@ static const char *const defaultDeviceACL[] = { }; #define DEVICE_PTY_MAJOR 136 #define DEVICE_SND_MAJOR 116 +#define DEVICE_DRI_MAJOR 226 static int @@ -626,6 +627,19 @@ qemuSetupDevicesCgroup(virQEMUDriverPtr driver, goto cleanup; } + if (vm->def->nvideos) { + virDomainVideoDefPtr vid = vm->def->videos[0]; + if (vid->type == VIR_DOMAIN_VIDEO_TYPE_VIRTIO && + vid->accel && vid->accel->accel3d) { + rv = virCgroupAllowDevice(priv->cgroup, 'c', DEVICE_DRI_MAJOR, -1, + VIR_CGROUP_DEVICE_RW); + virDomainAuditCgroupMajor(vm, priv->cgroup, "allow", DEVICE_DRI_MAJOR, + "sound", "rw", rv == 0); + if (rv < 0) + goto cleanup; + } + } + for (i = 0; deviceACL[i] != NULL; i++) { if (!virFileExists(deviceACL[i])) { VIR_DEBUG("Ignoring non-existent device %s", deviceACL[i]); -- 2.7.3

3 3

[libvirt] [PATCH v4 0/3] Add AES Secret Object support (for RBD only)
by John Ferlan 19 May '16

19 May '16

v3: http://www.redhat.com/archives/libvir-list/2016-May/msg00444.html Changes since v3 (by patch)... 1. Separate out the mock for virRandomBytes. I realize this is not the desired state, but figured to at least be prepared for what would be coming as a followup to: http://www.redhat.com/archives/libvir-list/2016-May/msg00735.html that I'd at least adjust the code to follow using a different random number generator (use increasing i instead of just 0xff for all) 2. Changes from code review... Change name from IV to AES, plus others qemuDomainSecretAESSetup is variable based on HAVE_GNUTLS_CIPHER_ENCRYPT Changes to utilize virStringEncodeBase64 Moved qemuDomainSecretSetup into this version (and made i 3. Split out mock (into patch 1) Comment cleanup Still unresolved from code review is a review comment in qemuBuildDriveStr regarding where the desire movement was. There's a very specific order to where the "password-secret=%s," can be placed. It just wasn't clear from the review comment where exactly it was expected to "move" those lines John Ferlan (3): tests: Add mock for virRandomBytes [NOT TO BE PUSHED] qemu: Introduce new Secret AES API's qemu: Utilize qemu secret objects for RBD auth/secret configure.ac | 1 + src/qemu/qemu_alias.c | 23 +++ src/qemu/qemu_alias.h | 2 + src/qemu/qemu_command.c | 122 +++++++++++- src/qemu/qemu_domain.c | 206 ++++++++++++++++++++- ...muxml2argv-disk-drive-network-rbd-auth-AES.args | 31 ++++ ...emuxml2argv-disk-drive-network-rbd-auth-AES.xml | 42 +++++ tests/qemuxml2argvmock.c | 31 +++- tests/qemuxml2argvtest.c | 3 + 9 files changed, 451 insertions(+), 10 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-rbd-auth-AES.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-rbd-auth-AES.xml -- 2.5.5

2 11

[libvirt] [PATCH v2 2/8] Release address in function granularity than slot
by Shivaprasad G Bhat 18 May '16

18 May '16

The commit 6fe678c is partly reverted. The code is moved around and cant revert staright. Signed-off-by: Shivaprasad G Bhat <sbhat(a)linux.vnet.ibm.com> --- src/conf/domain_addr.c | 22 +++++++++------------- src/libvirt_private.syms | 1 + src/qemu/qemu_domain_address.c | 2 +- 3 files changed, 11 insertions(+), 14 deletions(-) diff --git a/src/conf/domain_addr.c b/src/conf/domain_addr.c index acd8ce6..35c7cd4 100644 --- a/src/conf/domain_addr.c +++ b/src/conf/domain_addr.c @@ -472,21 +472,17 @@ virDomainPCIAddressEnsureAddr(virDomainPCIAddressSetPtr addrs, goto cleanup; if (dev->type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI) { - /* We do not support hotplug multi-function PCI device now, so we should - * reserve the whole slot. The function of the PCI device must be 0. - */ - if (dev->addr.pci.function != 0) { - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("Only PCI device addresses with function=0" - " are supported")); - goto cleanup; - } + if (((dev->addr.pci.function == 0) && (dev->addr.pci.multi == VIR_TRISTATE_SWITCH_ON)) || + dev->addr.pci.function != 0) { - if (!virDomainPCIAddressValidate(addrs, &dev->addr.pci, - addrStr, flags, true)) - goto cleanup; + if (!virDomainPCIAddressValidate(addrs, &dev->addr.pci, + addrStr, flags, true)) + goto cleanup; - ret = virDomainPCIAddressReserveSlot(addrs, &dev->addr.pci, flags); + ret = virDomainPCIAddressReserveAddr(addrs, &dev->addr.pci, flags, false, true); + } else { + ret = virDomainPCIAddressReserveSlot(addrs, &dev->addr.pci, flags); + } } else { ret = virDomainPCIAddressReserveNextSlot(addrs, dev, flags); } diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index fb24808..e4953b7 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -98,6 +98,7 @@ virDomainPCIAddressBusSetModel; virDomainPCIAddressEnsureAddr; virDomainPCIAddressFlagsCompatible; virDomainPCIAddressGetNextSlot; +virDomainPCIAddressReleaseAddr; virDomainPCIAddressReleaseSlot; virDomainPCIAddressReserveAddr; virDomainPCIAddressReserveNextSlot; diff --git a/src/qemu/qemu_domain_address.c b/src/qemu/qemu_domain_address.c index 9c8c262..1e7d98c 100644 --- a/src/qemu/qemu_domain_address.c +++ b/src/qemu/qemu_domain_address.c @@ -1682,7 +1682,7 @@ qemuDomainReleaseDeviceAddress(virDomainObjPtr vm, NULLSTR(devstr)); else if (info->type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI && virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_DEVICE) && - virDomainPCIAddressReleaseSlot(priv->pciaddrs, + virDomainPCIAddressReleaseAddr(priv->pciaddrs, &info->addr.pci) < 0) VIR_WARN("Unable to release PCI address on %s", NULLSTR(devstr));

1 0

[libvirt] [PATCH 0/4] qemu: Assign addresses via virDomainDefPostParse
by Cole Robinson 18 May '16

18 May '16

This series adds a new domain post parse callback virDomainDefAssignAddressesCallback, which we use in the qemu driver to trigger qemuDomainAssignAddresses via PostParse. This streamlines things a bit, but is also needed for some future work. After this series, the only remaining open coded qemuDomainAssignAddresses calls involve populating the runtime VM address caches, which I discussesd here: http://www.redhat.com/archives/libvir-list/2016-May/msg01071.html Cole Robinson (4): domain: Add virDomainDefAssignAddressesCallback qemu: Assign device addresses in PostParse qemu: Remove redundant qemuDomainAssignAddresses calls qemu: Call virDomainDefPostParse via CONFIG hotplug src/conf/domain_conf.c | 7 ++ src/conf/domain_conf.h | 8 ++ src/qemu/qemu_domain.c | 25 ++++++ src/qemu/qemu_driver.c | 90 +++++++++------------- .../qemuargv2xmldata/qemuargv2xml-pseries-disk.xml | 4 +- tests/qemuxml2argvtest.c | 2 +- tests/qemuxml2xmltest.c | 11 +-- 7 files changed, 83 insertions(+), 64 deletions(-) -- 2.7.4

3 21

[libvirt] [PATCH 0/2] vz: add domain snapshots functionality
by Nikolay Shirokovskiy 18 May '16

18 May '16

The first patch do all the job. It is rather large but does not touch any existing code so I found it reasonable not to split it. Nikolay Shirokovskiy (2): vz: add domain snapshots functionality vz: drop prlsdkDomainHasSnapshots src/libvirt_private.syms | 2 + src/vz/vz_driver.c | 535 +++++++++++++++++++++++++++++++++++++++++++++++ src/vz/vz_sdk.c | 303 +++++++++++++++++++++------ src/vz/vz_sdk.h | 5 + src/vz/vz_utils.h | 1 + 5 files changed, 777 insertions(+), 69 deletions(-) -- 1.8.3.1

2 5

[libvirt] [PATCH] Revert "qemu_hotplug: fix checking graphics ports"
by Pavel Hrdina 18 May '16

18 May '16

This reverts commit 1ccc7fbff34ea44e5b0cf01a359d127a4c62a695. We cannot check ports if autoport is set because we set ports to 0 while parsing device XML. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1336134 Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/qemu/qemu_hotplug.c | 13 ++++++++----- .../qemuhotplug-graphics-spice-listen-network.xml | 2 +- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index f40b34d..07b419d 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -2666,8 +2666,9 @@ qemuDomainChangeGraphics(virQEMUDriverPtr driver, switch (dev->type) { case VIR_DOMAIN_GRAPHICS_TYPE_VNC: - if (olddev->data.vnc.autoport != dev->data.vnc.autoport || - olddev->data.vnc.port != dev->data.vnc.port) { + if ((olddev->data.vnc.autoport != dev->data.vnc.autoport) || + (!dev->data.vnc.autoport && + (olddev->data.vnc.port != dev->data.vnc.port))) { virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", _("cannot change port settings on vnc graphics")); goto cleanup; @@ -2709,9 +2710,11 @@ qemuDomainChangeGraphics(virQEMUDriverPtr driver, break; case VIR_DOMAIN_GRAPHICS_TYPE_SPICE: - if (olddev->data.spice.autoport != dev->data.spice.autoport || - olddev->data.spice.port != dev->data.spice.port || - olddev->data.spice.tlsPort != dev->data.spice.tlsPort) { + if ((olddev->data.spice.autoport != dev->data.spice.autoport) || + (!dev->data.spice.autoport && + (olddev->data.spice.port != dev->data.spice.port)) || + (!dev->data.spice.autoport && + (olddev->data.spice.tlsPort != dev->data.spice.tlsPort))) { virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", _("cannot change port settings on spice graphics")); goto cleanup; diff --git a/tests/qemuhotplugtestdata/qemuhotplug-graphics-spice-listen-network.xml b/tests/qemuhotplugtestdata/qemuhotplug-graphics-spice-listen-network.xml index f2a6aeb..426a14d 100644 --- a/tests/qemuhotplugtestdata/qemuhotplug-graphics-spice-listen-network.xml +++ b/tests/qemuhotplugtestdata/qemuhotplug-graphics-spice-listen-network.xml @@ -1,4 +1,4 @@ - <graphics autoport='yes' connected='disconnect' keymap='en-us' passwd='password2' passwdValidTo='2013-06-20T01:34:37' type='spice'> + <graphics autoport='yes' connected='disconnect' keymap='en-us' passwd='password2' passwdValidTo='2013-06-20T01:34:37' port='5900' tlsPort='5901' type='spice'> <listen address='10.65.210.231' network='vdsm-rhevm' type='network'/> <channel mode='secure' name='main'/> <channel mode='secure' name='display'/> -- 2.8.2

2 1