- Devel - libvirt List Archives

[libvirt] sVirt adequate protection when guest hugepages option enabled?
by bancfc＠openmailbox.org 19 Aug '14

19 Aug '14

Hi I've been looking at enabling hugepages for guests and came across the note that SELinux was not able to handle their confinement properly back then: https://fedoraproject.org/wiki/Features/KVM_Huge_Page_Backed_Memory#Current… Was this ever resolved? Does sVirt provide adequate protection when this option is used for guests? Thanks.

1 0

[libvirt] [PATCH 0/5] Fix vcpu pinning info propagation on vcpu cold-unplug
by Peter Krempa 18 Aug '14

18 Aug '14

Remove the vcpupin info on cold cpuunplug. Also refactor a few unpleasant-to-look-at functions found while looking for the problem. Peter Krempa (5): qemu: process: Remove unnecessary argument and rename function conf: cpupin: Remove useless checking of vcpupin element count conf: Refactor virDomainVcpuPinDefParseXML qemu: cpu: unplug: Remove vcpu pinning on cold cpu unplug qemu: process: Pin on per-vcpu basis instead of per-vcpupin element src/conf/domain_conf.c | 64 +++++++++++++++++++++---------------------------- src/qemu/qemu_driver.c | 7 ++++++ src/qemu/qemu_process.c | 20 +++++++++------- 3 files changed, 46 insertions(+), 45 deletions(-) -- 2.0.2

2 7

[libvirt] [PATCH] virsh: man: Crosslink "desc" and "metadata" sections
by Peter Krempa 18 Aug '14

18 Aug '14

Those two commands work with a single API so cross-link them. --- tools/virsh.pod | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tools/virsh.pod b/tools/virsh.pod index d072a7f..da68c08 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -656,6 +656,7 @@ effect on the next boot. Show or modify description and title of a domain. These values are user fields that allow to store arbitrary textual data to allow easy identification of domains. Title should be short, although it's not enforced. +(See also B<metadata> that works with XML based domain metadata.) Flags I<--live> or I<--config> select whether this command works on live or persistent definitions of the domain. If both I<--live> and I<--config> @@ -1261,7 +1262,8 @@ Show or modify custom XML metadata of a domain. The metadata is a user defined XML that allows to store arbitrary XML data in the domain definition. Multiple separate custom metadata pieces can be stored in the domain XML. The pieces are identified by a private XML namespace provided via the -I<uri> argument. +I<uri> argument. (See also B<desc> that works with textual metadata of +a domain.) Flags I<--live> or I<--config> select whether this command works on live or persistent definitions of the domain. If both I<--live> and I<--config> -- 2.0.2

2 2

[libvirt] [PATCH] man: virsh: Add man page for "virsh metadata"
by Peter Krempa 18 Aug '14

18 Aug '14

Patch adding the command forgot to add the man page entry. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1130379 --- tools/virsh.pod | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/tools/virsh.pod b/tools/virsh.pod index f07deec..d072a7f 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -1254,6 +1254,36 @@ I<--total> for only the total stats, I<start> for only the per-cpu stats of the CPUs from I<start>, I<count> for only I<count> CPUs' stats. +=item B<metadata> I<domain> [[I<--live>] [I<--config>] | [I<--current>]] +[I<--edit>] [I<uri>] [I<key>] [I<set>] [I<--remove>] + +Show or modify custom XML metadata of a domain. The metadata is a user +defined XML that allows to store arbitrary XML data in the domain definition. +Multiple separate custom metadata pieces can be stored in the domain XML. +The pieces are identified by a private XML namespace provided via the +I<uri> argument. + +Flags I<--live> or I<--config> select whether this command works on live +or persistent definitions of the domain. If both I<--live> and I<--config> +are specified, the I<--config> option takes precedence on getting the current +description and both live configuration and config are updated while setting +the description. I<--current> is exclusive and implied if none of these was +specified. + +Flag I<--remove> specifies that the metadata element specified by the I<uri> +argument should be removed rather than updated. + +Flag I<--edit> specifies that an editor with the metadata identified by the +I<uri> argument should be opened and the contents saved back afterwards. +Otherwise the new contents can be provided via the I<set> argument. + +When setting metadata via I<--edit> or I<set> the I<key> argument must be +specified and is used to prefix the custom elements to bind them +to the private namespace. + +If neither of I<--edit> and I<set> are specified the XML metadata corresponding +to the I<uri> namespace is displayed instead of being modified. + =item B<migrate> [I<--live>] [I<--offline>] [I<--direct>] [I<--p2p> [I<--tunnelled>]] [I<--persistent>] [I<--undefinesource>] [I<--suspend>] [I<--copy-storage-all>] [I<--copy-storage-inc>] [I<--change-protection>] [I<--unsafe>] [I<--verbose>] -- 2.0.2

2 3

[libvirt] [PATCH] man: virsh: Add 'vcpu_period' and 'vcpu_quota' support info for LXC
by Li Yang 18 Aug '14

18 Aug '14

Signed-off-by: Li Yang <liyang.fnst(a)cn.fujitsu.com> --- tools/virsh.pod | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/tools/virsh.pod b/tools/virsh.pod index f07deec..a2d89b2 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -1570,7 +1570,7 @@ I<domain> Allows you to show (and set) the domain scheduler parameters. The parameters available for each hypervisor are: -LXC (posix scheduler) : cpu_shares +LXC (posix scheduler) : cpu_shares, vcpu_period, vcpu_quota QEMU/KVM (posix scheduler): cpu_shares, vcpu_period, vcpu_quota, emulator_period, emulator_quota -- 1.7.1

2 1

[libvirt] [libvirt-glib] [PATCH 0/4] Add some async versions of synchronous snapshot API
by Timm Bäder 18 Aug '14

18 Aug '14

This adds async versions of a few snapshot related functions and a patch that cleans up some doc comments I crewed up in earlier commits. All the sync versions don't seem cancellable to me since we can't just throw the result away like we do when fetching snapshots in case the operation gets cancelled, so none of them take a GCancellable. Timm Bäder (4): GVirDomain: Fix some doc comments of the snapshot API GVirDomainSnapshot: Add async version of _revert_to GVirDomain: Add async version of _create_snapshot GVirDomainSnapshot: Add async version of _delete libvirt-gobject/libvirt-gobject-domain-snapshot.c | 112 ++++++++++++++++++++++ libvirt-gobject/libvirt-gobject-domain-snapshot.h | 19 ++++ libvirt-gobject/libvirt-gobject-domain.c | 77 ++++++++++++++- libvirt-gobject/libvirt-gobject-domain.h | 11 +++ libvirt-gobject/libvirt-gobject.sym | 6 ++ 5 files changed, 220 insertions(+), 5 deletions(-) -- 2.0.4

2 9

[libvirt] [PATCHv3] qemu: Redundant listen address entry in quest xml
by Erik Skultety 18 Aug '14

18 Aug '14

When editing guest's XML (on QEMU), it was possible to add multiple listen elements into graphics parent element. However QEMU does not support listening on multiple addresses. Configuration is tested for multiple 'listen address' and if positive, an error is raised. --- src/qemu/qemu_process.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 52d9052..f3a6af5 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -3950,6 +3950,11 @@ int qemuProcessStart(virConnectPtr conn, goto cleanup; } graphics->listens[0].fromConfig = true; + } else if (graphics->nListens > 1) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("QEMU does not support multiple listen " + "addresses for one graphics device.")); + goto cleanup; } } } -- 1.9.3

2 1

[libvirt] [PATCH] qemuDomainFSFreeze: report unless the agent supports mountpoints param
by Tomoki Sekiyama 16 Aug '14

16 Aug '14

This patch gives users a nicer error message when the QEMU guest agent is not new enough to support 'guest-fsfreeze-freeze-list' command, which is used by qemuDomainFSFreeze() to freeze specified filesystems only. Before this patch, it was depending on the agent to complain about unknown command: # virsh domfsfreeze domain --mountpoint /mnt/point error: Unable to freeze filesystems error: internal error: unable to execute QEMU agent command 'guest- fsfreeze-freeze-list': The command guest-fsfreeze-freeze-list has not been found After: # virsh domfsfreeze domain --mountpoint /mnt/point error: Unable to freeze filesystems error: argument unsupported: this version of guest agent doesn't support specifying mountpoints Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama(a)hds.com> --- src/qemu/qemu_agent.c | 79 ++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 78 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_agent.c b/src/qemu/qemu_agent.c index a10954a..8102b36 100644 --- a/src/qemu/qemu_agent.c +++ b/src/qemu/qemu_agent.c @@ -1279,6 +1279,75 @@ void qemuAgentNotifyEvent(qemuAgentPtr mon, } } +static int qemuAgentCommandSupported(qemuAgentPtr mon, + const char *cmdname) +{ + int ret = -1; + size_t i; + int ndata; + virJSONValuePtr cmd; + virJSONValuePtr data; + virJSONValuePtr reply = NULL; + + cmd = qemuAgentMakeCommand("guest-info", NULL); + if (!cmd) + return -1; + + if (qemuAgentCommand(mon, cmd, &reply, false, + VIR_DOMAIN_QEMU_AGENT_COMMAND_BLOCK) < 0) + goto cleanup; + + if (!(data = virJSONValueObjectGet(reply, "return"))) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("guest-info reply was missing return data")); + goto cleanup; + } + + if (!(data = virJSONValueObjectGet(data, "supported_commands"))) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("guest-info reply was missing supported_commands")); + goto cleanup; + } + + if (data->type != VIR_JSON_TYPE_ARRAY) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("guest-info supported_commands was not an array")); + goto cleanup; + } + + ndata = virJSONValueArraySize(data); + + for (i = 0; i < ndata; i++) { + virJSONValuePtr entry = virJSONValueArrayGet(data, i); + const char *name; + + if (!entry) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("array element missing in guest-info " + "supported_commands")); + goto cleanup; + } + + if (!(name = virJSONValueObjectGetString(entry, "name"))) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("guest-info supported_commands was missing name")); + goto cleanup; + } + + if (strcmp(name, cmdname) == 0) { + ret = 1; + goto cleanup; + } + } + + ret = 0; + + cleanup: + virJSONValueFree(cmd); + virJSONValueFree(reply); + return ret; +} + VIR_ENUM_DECL(qemuAgentShutdownMode); VIR_ENUM_IMPL(qemuAgentShutdownMode, @@ -1346,8 +1415,16 @@ int qemuAgentFSFreeze(qemuAgentPtr mon, const char **mountpoints, return -1; if (qemuAgentCommand(mon, cmd, &reply, true, - VIR_DOMAIN_QEMU_AGENT_COMMAND_BLOCK) < 0) + VIR_DOMAIN_QEMU_AGENT_COMMAND_BLOCK) < 0) { + if (mountpoints && nmountpoints) { + if (qemuAgentCommandSupported(mon, + "guest-fsfreeze-freeze-list") == 0) + virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s", + _("this version of guest agent doesn't support " + "specifying mountpoints")); + } goto cleanup; + } if (virJSONValueObjectGetNumberInt(reply, "return", &ret) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s",

2 2

[libvirt] [PATCH v2 0/3] OVMF exposure
by Michal Privoznik 15 Aug '14

15 Aug '14

diff to v1: - adapt to new code - restrict usage to x86_64 qemu guests - Adapted to Laszlo's suggestion for qemu.conf format Michal Privoznik (3): conf: Extend <loader/> and introduce <nvram/> qemu: Implement extended loader and nvram qemu: Automatically create NVRAM store configure.ac | 1 - docs/formatdomain.html.in | 19 ++- docs/schemas/domaincommon.rng | 21 ++++ libvirt.spec.in | 2 + src/Makefile.am | 1 + src/conf/domain_conf.c | 87 +++++++++++++- src/conf/domain_conf.h | 22 +++- src/libvirt_private.syms | 3 + src/qemu/libvirtd_qemu.aug | 3 + src/qemu/qemu.conf | 14 +++ src/qemu/qemu_command.c | 97 ++++++++++++++- src/qemu/qemu_conf.c | 92 +++++++++++++++ src/qemu/qemu_conf.h | 5 + src/qemu/qemu_process.c | 131 +++++++++++++++++++++ src/qemu/test_libvirtd_qemu.aug.in | 3 + src/security/security_dac.c | 8 ++ src/security/security_selinux.c | 8 ++ src/security/virt-aa-helper.c | 4 +- src/vbox/vbox_common.c | 7 +- src/xenapi/xenapi_driver.c | 3 +- src/xenxs/xen_sxpr.c | 16 +-- src/xenxs/xen_xm.c | 7 +- .../qemuxml2argvdata/qemuxml2argv-bios-nvram.args | 10 ++ tests/qemuxml2argvdata/qemuxml2argv-bios-nvram.xml | 40 +++++++ tests/qemuxml2argvtest.c | 2 + .../qemuxml2xmlout-pci-bridge-many-disks.xml | 2 +- tests/qemuxml2xmltest.c | 2 + tests/sexpr2xmldata/sexpr2xml-fv-autoport.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-empty-kernel.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-force-hpet.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-force-nohpet.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-kernel.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-legacy-vfb.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-localtime.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-net-ioemu.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-net-netfront.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-parallel-tcp.xml | 2 +- .../sexpr2xml-fv-serial-dev-2-ports.xml | 2 +- .../sexpr2xml-fv-serial-dev-2nd-port.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-serial-file.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-serial-null.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-serial-pipe.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-serial-pty.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-serial-stdio.xml | 2 +- .../sexpr2xml-fv-serial-tcp-telnet.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-serial-tcp.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-serial-udp.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-serial-unix.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-sound-all.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-sound.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-usbmouse.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-usbtablet.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-utc.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv-v2.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-fv.xml | 2 +- tests/sexpr2xmldata/sexpr2xml-no-source-cdrom.xml | 2 +- tests/xmconfigdata/test-escape-paths.xml | 2 +- tests/xmconfigdata/test-fullvirt-force-hpet.xml | 2 +- tests/xmconfigdata/test-fullvirt-force-nohpet.xml | 2 +- tests/xmconfigdata/test-fullvirt-localtime.xml | 2 +- tests/xmconfigdata/test-fullvirt-net-ioemu.xml | 2 +- tests/xmconfigdata/test-fullvirt-net-netfront.xml | 2 +- tests/xmconfigdata/test-fullvirt-new-cdrom.xml | 2 +- tests/xmconfigdata/test-fullvirt-old-cdrom.xml | 2 +- tests/xmconfigdata/test-fullvirt-parallel-tcp.xml | 2 +- .../test-fullvirt-serial-dev-2-ports.xml | 2 +- .../test-fullvirt-serial-dev-2nd-port.xml | 2 +- tests/xmconfigdata/test-fullvirt-serial-file.xml | 2 +- tests/xmconfigdata/test-fullvirt-serial-null.xml | 2 +- tests/xmconfigdata/test-fullvirt-serial-pipe.xml | 2 +- tests/xmconfigdata/test-fullvirt-serial-pty.xml | 2 +- tests/xmconfigdata/test-fullvirt-serial-stdio.xml | 2 +- .../test-fullvirt-serial-tcp-telnet.xml | 2 +- tests/xmconfigdata/test-fullvirt-serial-tcp.xml | 2 +- tests/xmconfigdata/test-fullvirt-serial-udp.xml | 2 +- tests/xmconfigdata/test-fullvirt-serial-unix.xml | 2 +- tests/xmconfigdata/test-fullvirt-sound.xml | 2 +- tests/xmconfigdata/test-fullvirt-usbmouse.xml | 2 +- tests/xmconfigdata/test-fullvirt-usbtablet.xml | 2 +- tests/xmconfigdata/test-fullvirt-utc.xml | 2 +- tests/xmconfigdata/test-no-source-cdrom.xml | 2 +- tests/xmconfigdata/test-pci-devs.xml | 2 +- 82 files changed, 637 insertions(+), 83 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-bios-nvram.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-bios-nvram.xml -- 1.8.5.5

2 7

[libvirt] Support for kvm=off cpu option
by Alex Williamson 15 Aug '14

15 Aug '14

As of QEMU 2.1 we now have a new -cpu option, kvm=on|off which controls whether we expose KVM as the hypervisor via the MSR hypervisor nodes. The default is on. The off state is meant to hide kvm from standard detection routines. This allows us to disable paravirtualization detection in the guest and can be used to bypass hypervisor checks in certain guest drivers[1]. How would we like to enable this in libvirt? One option would be a processor feature, ex: <feature policy='disable' name='kvm'/> But since this doesn't map to a cpuid feature, I don't know if that would be acceptable. Another option might be to a domain feature, similar to some of the other hyper-v related flags. <domain type='kvm'> <features> <kvm> <kvm state='off'> </kvm> <hyperv> <relaxed state='on'> ... </hyperv> </features> ... </domain> Any other suggestions? Preference? Thanks, Alex [1] http://lists.gnu.org/archive/html/qemu-devel/2014-06/msg00302.html

2 2