- Devel - libvirt List Archives

[libvirt] [PATCH v2 0/8] Post-copy live migration support
by Cristian Klein 06 Nov '14

06 Nov '14

Qemu currently implements pre-copy live migration. VM memory pages are first copied from the source hypervisor to the destination, potentially multiple times as pages get dirtied during transfer, then VCPU state is migrated. Unfortunately, if the VM dirties memory faster than the network bandwidth, then pre-copy cannot finish. `virsh` currently includes an option to suspend a VM after a timeout, so that migration may finish, but at the expense of downtime. A future version of qemu will implement post-copy live migration. The VCPU state is first migrated to the destination hypervisor, then memory pages are pulled from the source hypervisor. Post-copy has the potential to do migration with zero-downtime, despite the VM dirtying pages fast, with minimum performance impact. On the other hand, one post-copy is in progress, any network failure would render the VM unusable, as its memory is partitioned between the source and destination hypervisor. Therefore, post-copy should only be used when necessary. Post-copy migration in qemu will work as follows: (1) The `x-postcopy-ram` migration capability needs to be set. (2) Migration is started. (3) When the user decides so, post-copy migration is activated by sending the `migrate-start-postcopy` command. Qemu acknowledges by setting migration status to `postcopy-active`. v2: - Fixed formatting - Set target version to libvirt 1.2.10 - Only use JSON monitor - Renamed `qemuMigrateStartPostCopy` to `qemuDomainMigrateStartPostCopy` - Added parameter `flags` to domainMigrateStartPostCopy (currently unused) - Misc fixes required for `make check` - Stop perform phase, when post-copy starts - Wait for post-copy completion in confirm phase, before killing source VM Implementation note: `qemuMigrationWaitForCompletion` is overloaded. When called the first time it waits for post-copy to start, when called the second time it waits for post-copy to complete. I did so to reduce code duplication, but am not sure this is the best solution. Cristian Klein (8): Added public API to enable post-copy migration Added public API to start post-copy migration Added low-level API to qemu post-copy migration Implemented VIR_MIGRATE_POSTCOPY in qemu driver Added job type VIR_DOMAIN_JOB_PHASE1_COMPLETED Implemented post-copy migration logic in qemu Implement virDomainMigrateStartPostCopy in qemu virsh: add postcopy-after option to migrate command include/libvirt/libvirt.h.in | 5 +++ src/driver.h | 5 +++ src/libvirt.c | 46 ++++++++++++++++++++++++ src/libvirt_public.syms | 5 +++ src/qemu/qemu_driver.c | 58 ++++++++++++++++++++++++++++++ src/qemu/qemu_migration.c | 85 ++++++++++++++++++++++++++++++++++++++++++-- src/qemu/qemu_migration.h | 3 +- src/qemu/qemu_monitor.c | 24 +++++++++++-- src/qemu/qemu_monitor.h | 4 +++ src/qemu/qemu_monitor_json.c | 23 +++++++++++- src/qemu/qemu_monitor_json.h | 1 + src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 13 ++++++- src/remote_protocol-structs | 5 +++ tools/virsh-domain.c | 75 ++++++++++++++++++++++++++++++++++++-- tools/virsh.pod | 5 +++ 16 files changed, 347 insertions(+), 11 deletions(-) -- 1.9.1

6 29

[libvirt] [PATCH] CVE-2014-7823: dumpxml: security hole with migratable flag
by Eric Blake 06 Nov '14

06 Nov '14

Commit 28f8dfd (v1.0.0) introduced a security hole: in at least the qemu implementation of virDomainGetXMLDesc, the use of the flag VIR_DOMAIN_XML_MIGRATABLE (which is usable from a read-only connection) triggers the implicit use of VIR_DOMAIN_XML_SECURE prior to calling qemuDomainFormatXML. However, the use of VIR_DOMAIN_XML_SECURE is supposed to be restricted to read-write clients only. This patch treats the migratable flag as requiring the same permissions, rather than analyzing what might break if migratable xml no longer includes secret information. Fortunately, the information leak is low-risk: all that is gated by the VIR_DOMAIN_XML_SECURE flag is the VNC connection password; but VNC passwords are already weak (FIPS forbids their use, and on a non-FIPS machine, anyone stupid enough to trust a max-8-byte password sent in plaintext over the network deserves what they get). SPICE offers better security than VNC, and all other secrets are properly protected by use of virSecret associations rather than direct output in domain XML. * src/remote/remote_protocol.x (REMOTE_PROC_DOMAIN_GET_XML_DESC): Tighten rules on use of migratable flag. * src/libvirt-domain.c (virDomainGetXMLDesc): Likewise. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- The libvirt-security list agreed that this did not need an embargo because it is low-risk; but I'm on the road this week, so while this patch for master can go in now, I won't complete the backport to all the affected stable branches (everything since v1.0.0) or do the Libvirt Security Notice writeup until Monday. src/libvirt-domain.c | 3 ++- src/remote/remote_protocol.x | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c index 7dc3146..2b0defc 100644 --- a/src/libvirt-domain.c +++ b/src/libvirt-domain.c @@ -2607,7 +2607,8 @@ virDomainGetXMLDesc(virDomainPtr domain, unsigned int flags) virCheckDomainReturn(domain, NULL); conn = domain->conn; - if ((conn->flags & VIR_CONNECT_RO) && (flags & VIR_DOMAIN_XML_SECURE)) { + if ((conn->flags & VIR_CONNECT_RO) && + (flags & (VIR_DOMAIN_XML_SECURE | VIR_DOMAIN_XML_MIGRATABLE))) { virReportError(VIR_ERR_OPERATION_DENIED, "%s", _("virDomainGetXMLDesc with secure flag")); goto error; diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index db12cda..ebf4530 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -3255,6 +3255,7 @@ enum remote_procedure { * @generate: both * @acl: domain:read * @acl: domain:read_secure:VIR_DOMAIN_XML_SECURE + * @acl: domain:read_secure:VIR_DOMAIN_XML_MIGRATABLE */ REMOTE_PROC_DOMAIN_GET_XML_DESC = 14, -- 1.9.3

1 1

[libvirt] [PATCH 0/3] Fix build without NUMA
by Michal Privoznik 06 Nov '14

06 Nov '14

Even though these patches would qualify as build breaker fixes, I don't think they are that critical to be pushed without somebody else's taking a look on them. Michal Privoznik (3): virnuma: Add some more comments private.syms: Export virDomainNumatuneSpecifiedMaxNode qemuxml2argvmock: Mock virNumaNodesetIsAvailable src/libvirt_private.syms | 1 + src/util/virnuma.c | 14 +++++++------- tests/qemuxml2argvmock.c | 9 +++++++++ 3 files changed, 17 insertions(+), 7 deletions(-) -- 2.0.4

3 7

[libvirt] [PATCH 0/3] Libvirt memory & NUMA fixes
by Prerna Saxena 05 Nov '14

05 Nov '14

This patch set addresses a bunch of memory & NUMA fixes. Series Description: =========== Patch 1/3 : Use consistent data type to represent memory elements in various XML attributes. This ensures all memory elements are always represented as 'unsigned long long'. Patch 2/3 : This adds a 'unit' attribute alongwith the 'memory' attribute of a NUMA cell. This enables users to easily describe how much memory needs to be allocated to each NUMA cell for a guest domain. Patch 3/3 : This augments test cases to add the 'unit' tag. Regards, -- Prerna Saxena Linux Technology Centre, IBM Systems and Technology Lab, Bangalore, India

2 7

[libvirt] [PATCHv2 0/2] network: bandwidth tuning in session mode revert patch
by Erik Skultety 05 Nov '14

05 Nov '14

Erik Skultety (2): qemu: revert patch - bandwidth tuning in session mode Iface: disallow network tuning in session mode globally src/qemu/qemu_command.c | 11 ----------- src/qemu/qemu_driver.c | 9 --------- src/util/virnetdevbandwidth.c | 8 ++++++++ tests/Makefile.am | 11 ++++++++++- tests/virnetdevbandwidthtest.c | 14 +++++++++++++- 5 files changed, 31 insertions(+), 22 deletions(-) -- 1.9.3

2 4

[libvirt] [PATCH] UpdateDevice: Allow startupPolicy update
by Michal Privoznik 05 Nov '14

05 Nov '14

Users might want to update startupPolicy via the virDomainUpdateDeviceFlags API too. This patch implements the feature on config layer. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_driver.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 6acaea8..6fc15c0 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -7437,6 +7437,7 @@ qemuDomainUpdateDeviceConfig(virQEMUCapsPtr qemuCaps, if (disk->src->format) orig->src->format = disk->src->format; disk->src->path = NULL; + orig->startupPolicy = disk->startupPolicy; break; case VIR_DOMAIN_DEVICE_NET: -- 2.0.4

2 2

[libvirt] Local qemu migration
by Marc-André Lureau 05 Nov '14

05 Nov '14

Hi, Attempting to migration from session to system qemu fails because of the following checks in qemuMigrationCookieXMLParse(): if (STREQ(mig->remoteHostname, mig->localHostname)) { virReportError(VIR_ERR_INTERNAL_ERROR, _("Attempt to migrate guest to the same host %s"), mig->remoteHostname); goto error; } .... if (memcmp(mig->remoteHostuuid, mig->localHostuuid, VIR_UUID_BUFLEN) == 0) { virReportError(VIR_ERR_INTERNAL_ERROR, _("Attempt to migrate guest to the same host %s"), tmp); goto error; Is there a technical limitation for this error? If not, could it be overriden with an additional flag? cheers -- Marc-André Lureau

4 6

[libvirt] [PATCH] remote: Fix memory leak in remoteConnectGetAllDomainStats
by Peter Krempa 05 Nov '14

05 Nov '14

The remote call actually doesn't free the arguments array so we leak memory in case a domain list is specified. As the remote domain list array consists only of stolen pointers from the actual domain objects it's sufficient just to free the array. Valgrind message: ==1081452== 64 bytes in 1 blocks are definitely lost in loss record 632 of 726 ==1081452== at 0x4C296D0: calloc (vg_replace_malloc.c:618) ==1081452== by 0x4EA5CB4: virAllocN (viralloc.c:191) ==1081452== by 0x505D21E: remoteConnectGetAllDomainStats (remote_driver.c:7785) ==1081452== by 0x50081AA: virDomainListGetStats (libvirt-domain.c:11080) ==1081452== by 0x155249: cmdDomstats (virsh-domain-monitor.c:2147) ==1081452== by 0x12FB73: vshCommandRun (virsh.c:1935) ==1081452== by 0x133FEB: main (virsh.c:3719) --- src/remote/remote_driver.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 65c04d9..d111e10 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -7846,6 +7846,7 @@ remoteConnectGetAllDomainStats(virConnectPtr conn, VIR_FREE(elem); } virDomainStatsRecordListFree(tmpret); + VIR_FREE(args.doms.doms_val); xdr_free((xdrproc_t)xdr_remote_connect_get_all_domain_stats_ret, (char *) &ret); -- 2.1.0

2 1

[libvirt] [sandbox PATCH 0/2] v1.1 bugfix: support dhcp network interfaces
by Gene Czarcinski 05 Nov '14

05 Nov '14

Resubmitted to add "sandbox PATCH" to Subject v1.1 adds some documentation changes. Support for a network such as -N dhcp,source=default was not working in that dhclient was not being started. Although I am not sure what the real problem is, the solution is to use g_spawn_sync() instead of g_spawn_async() to start /sbin/dhclient. The second patch addes "-v" to the dhclient arguments to improve debugging info. The dhclient into will be in /var/log/messages the Secure Contrainer host system and not in the container itself. Gene Czarcinski (2): v1.1 for dhclient use g_spawn_sync() v1.1 add -v to dhclient parameter arguments libvirt-sandbox/libvirt-sandbox-init-common.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) -- 1.9.3

2 3

[libvirt] [libvirt-sandbox][PATCH 0/4] Couple of fixes to compile again
by Michal Privoznik 05 Nov '14

05 Nov '14

It's been a while that I tried to build libvirt-sandbox. And guess what, it doesn't compile cleanly so here are some patches to fix the issues I met. Michal Privoznik (4): virt-selinux.m4: Define SELINUX variables Makefile: link SELINUX into libvirt-sandbox-1.0.so m4: sync macros with libvirt libvirt-sandbox-config.c: Fix comment libvirt-sandbox/Makefile.am | 4 +- libvirt-sandbox/libvirt-sandbox-config.c | 2 +- m4/manywarnings.m4 | 217 ++++++++++++++++++++----------- m4/virt-compile-warnings.m4 | 216 ++++++++++++++++++++++-------- m4/virt-selinux.m4 | 6 +- m4/warnings.m4 | 82 +++++++++--- 6 files changed, 369 insertions(+), 158 deletions(-) -- 2.0.4

2 6