October 2020 - Devel - libvirt List Archives

[PATCH] os: deprecate the -enable-fips option and QEMU's FIPS enforcement
by Daniel P. Berrangé 22 Oct '20

22 Oct '20

The -enable-fips option was added a long time ago to prevent the use of single DES when VNC when FIPS mode is enabled. It should never have been added, because apps are supposed to unconditionally honour FIPS mode based on the '/proc/sys/crypto/fips_enabled' file contents. In addition there is more to achieving FIPS compliance than merely blocking use of certain algorithms. Those algorithms which are used need to perform self-tests at runtime. QEMU's built-in cryptography provider has no support for self-tests, and neither does the nettle library. If QEMU is required to be used in a FIPS enabled host, then it must be built with the libgcrypt library enabled, which will unconditionally enforce FIPS compliance in any algorithm usage. Thus there is no need to keep either the -enable-fips option in QEMU, or QEMU's internal FIPS checking methods. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- docs/system/deprecated.rst | 11 +++++++++++ os-posix.c | 3 +++ 2 files changed, 14 insertions(+) diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst index 905628f3a0..faa2bc49b1 100644 --- a/docs/system/deprecated.rst +++ b/docs/system/deprecated.rst @@ -158,6 +158,17 @@ devices. It is possible to use drives the board doesn't pick up with -device. This usage is now deprecated. Use ``if=none`` instead. +``--enable-fips`` (since 5.2) + +This option restricts usage of certain cryptographic algorithms when +the host is operating in FIPS mode. + +If FIPS compliance is required, QEMU should be built with the ``libgcrypt`` +library enabled as a cryptography provider. + +Neither the ``nettle`` library, or the built-in cryptography provider are +supported on FIPS enabled hosts. + QEMU Machine Protocol (QMP) commands ------------------------------------ diff --git a/os-posix.c b/os-posix.c index 1de2839554..a6846f51c1 100644 --- a/os-posix.c +++ b/os-posix.c @@ -153,6 +153,9 @@ int os_parse_cmd_args(int index, const char *optarg) break; #if defined(CONFIG_LINUX) case QEMU_OPTION_enablefips: + warn_report("-enable-fips is deprecated, please build QEMU with " + "the `libgcrypt` library as the cryptography provider " + "to enable FIPS compliance"); fips_set_state(true); break; #endif -- 2.26.2

4 7

[PATCH 00/15] util: hash: Use glib's GHashTable - preparation (part 1)
by Peter Krempa 22 Oct '20

22 Oct '20

Glib provides a hash table implementation called GHashTable. In this part of the series we'll refactor two instances of code which use non-string keys for hashtable to use GHashTable directly which simplifies the code (glib provides int hashing functions). Since GHashTable is not a direct replacement for virHashTable without code modification (glib's functions don't accept NULL hash table, ours do) the next step will be to use virHashTable as a shim to provide NULL compatibility and adapt to our slightly different style of iterators. For this step we modify the variable type for the key to be 'char *' as there's no other option left and remove various internals which won't be compatible with GHashTable. Second part (WIP, [1]) will then rewrite virHashTable internals to use GHashTable, which will be used as an intermediate step before removal which requires audit of all callers. [1]: https://gitlab.com/pipo.sk/libvirt/-/commits/glib-hash-part2 - needs auditing of all callers of virHashForeach to ensure that they don't modify the hash table itself from the callback Peter Krempa (15): virCgroupKillRecursive: Return -1 on failure condition util: virhash: Remove virHashTableSize util: cgroup: Use GHashTable instead of virHashTable virCgroupKillRecursive: Refactor cleanup conf: domain_addr: Refactor hash usage in zpci reservation code virHashAtomicNew: Remove 'size' argument conf: nwfilter: Replace 'virNWFilterHashTableCreate' with 'virHashNew' tests: hash: Prepare for replacement of virHashCreate qemuDomainObjPrivateAlloc: Use virHashNew instead of virHashCreate Replace all instances of 'virHashCreate' with 'virHashNew' util: hash: Remove virHashValueFree util: hash: Remove virHashCreateFull util: hash: Change type of hash table name/key to 'char' util: virhash: Remove key handling callbacks virHashRemoveAll: Don't return number of removed items src/conf/domain_addr.c | 125 +++-------- src/conf/domain_addr.h | 4 +- src/conf/domain_conf.c | 4 +- src/conf/domain_nwfilter.c | 2 +- src/conf/nwfilter_ipaddrmap.c | 2 +- src/conf/nwfilter_params.c | 14 +- src/conf/nwfilter_params.h | 2 +- src/conf/virchrdev.c | 4 +- src/conf/virdomainmomentobjlist.c | 8 +- src/conf/virdomainobjlist.c | 16 +- src/conf/virinterfaceobj.c | 12 +- src/conf/virnetworkobj.c | 21 +- src/conf/virnodedeviceobj.c | 20 +- src/conf/virnwfilterbindingdef.c | 2 +- src/conf/virnwfilterbindingobjlist.c | 6 +- src/conf/virsecretobj.c | 10 +- src/conf/virstorageobj.c | 32 +-- src/hyperv/hyperv_wmi.c | 2 +- src/hypervisor/virclosecallbacks.c | 4 +- src/libvirt_private.syms | 5 +- src/libxl/libxl_logger.c | 2 +- src/locking/lock_daemon.c | 10 +- src/nwfilter/nwfilter_dhcpsnoop.c | 12 +- src/nwfilter/nwfilter_ebiptables_driver.c | 4 +- src/nwfilter/nwfilter_gentech_driver.c | 14 +- src/nwfilter/nwfilter_learnipaddr.c | 4 +- src/qemu/qemu_block.c | 6 +- src/qemu/qemu_blockjob.c | 2 +- src/qemu/qemu_capabilities.c | 6 +- src/qemu/qemu_checkpoint.c | 2 +- src/qemu/qemu_domain.c | 8 +- src/qemu/qemu_domain.h | 2 +- src/qemu/qemu_driver.c | 2 +- src/qemu/qemu_interop_config.c | 2 +- src/qemu/qemu_migration.c | 2 +- src/qemu/qemu_migration_cookie.c | 2 +- src/qemu/qemu_monitor.c | 10 +- src/qemu/qemu_monitor_json.c | 2 +- src/qemu/qemu_process.c | 2 +- src/qemu/qemu_qapi.c | 2 +- src/qemu/qemu_snapshot.c | 4 +- src/rpc/virnetdaemon.c | 16 +- src/security/security_selinux.c | 4 +- src/test/test_driver.c | 6 +- src/util/vircgroup.c | 76 ++----- src/util/vircgroupbackend.h | 3 +- src/util/vircgrouppriv.h | 2 +- src/util/vircgroupv1.c | 2 +- src/util/vircgroupv2.c | 2 +- src/util/virfilecache.c | 4 +- src/util/virhash.c | 201 +++--------------- src/util/virhash.h | 94 ++------ src/util/viriptables.c | 4 +- src/util/virlockspace.c | 8 +- src/util/virmacmap.c | 6 +- src/util/virstoragefile.c | 4 +- src/util/virsystemd.c | 2 +- tests/nwfilterxml2firewalltest.c | 6 +- tests/qemumonitorjsontest.c | 12 +- tests/qemusecuritymock.c | 12 +- .../blockjob-blockdev-in.xml | 110 +++++----- tests/testutilsqemu.c | 2 +- tests/virhashtest.c | 52 ++--- 63 files changed, 340 insertions(+), 683 deletions(-) -- 2.26.2

4 39

[PATCH 0/2] parthelper: Initialize error object
by Michal Privoznik 22 Oct '20

22 Oct '20

To observe the error fixed in 1/2 apply the following patch and run parthelper under valgrind, e.g. like this: valgrind libvirt_parthelper /dev/sda -g diff --git i/src/util/virdevmapper.c w/src/util/virdevmapper.c index 4d27c9f104..fad76f35a1 100644 --- i/src/util/virdevmapper.c +++ w/src/util/virdevmapper.c @@ -57,6 +57,8 @@ virDevMapperGetMajor(unsigned int *major) VIR_AUTOSTRINGLIST lines = NULL; size_t i; + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("blah")); + if (!virFileExists(CONTROL_PATH)) return -2; Michal Prívozník (2): parthelper: Initialize error object parthelper: Don't leak @canonical_path src/storage/parthelper.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.26.2

2 3

[PATCH v11 00/13] Apply COR-filter to the block-stream permanently
by Andrey Shinkevich 22 Oct '20

22 Oct '20

The iotest case test_stream_parallel still does not pass after the COR-filter is inserted into the backing chain. As the test case may not be initialized, it does not make a sense and was removed again. v11: 04: Base node overlay is used instead of base. 05: Base node overlay is used instead of base. 06: New. 07: New. 08: New. 09: The new BDS-member 'supported_read_flags' is applied. 10: The 'base_metadata' variable renamed to 'base_unfiltered'. 11: New. 12: The backing-file argument is left in the QMP interface. Warning added. 13: The BDRV_REQ_COPY_ON_READ removed from the stream_populate(); The 'implicit' initialization moved back to COR-filter driver. Base node overlay is used instead of base. The v8 Message-Id: <1601383109-110988-1-git-send-email-andrey.shinkevich(a)virtuozzo.com> Andrey Shinkevich (13): copy-on-read: Support preadv/pwritev_part functions copy-on-read: add filter append/drop functions qapi: add filter-node-name to block-stream copy-on-read: pass overlay base node name to COR driver copy-on-read: limit COR operations to base in COR driver block: modify the comment for BDRV_REQ_PREFETCH flag block: include supported_read_flags into BDS structure copy-on-read: add support for BDRV_REQ_PREFETCH to COR-filter copy-on-read: skip non-guest reads if no copy needed stream: skip filters when writing backing file name to QCOW2 header stream: mark backing-file argument as deprecated stream: remove unused backing-file name parameter block: apply COR-filter to block-stream jobs block/copy-on-read.c | 171 ++++++++++++++++++++++++++++++++++++++--- block/copy-on-read.h | 35 +++++++++ block/io.c | 3 +- block/monitor/block-hmp-cmds.c | 4 +- block/stream.c | 112 ++++++++++++++++----------- blockdev.c | 25 +++--- docs/system/deprecated.rst | 6 ++ include/block/block.h | 7 +- include/block/block_int.h | 13 +++- qapi/block-core.json | 6 ++ tests/qemu-iotests/030 | 51 ++---------- tests/qemu-iotests/030.out | 4 +- tests/qemu-iotests/141.out | 2 +- tests/qemu-iotests/245 | 19 +++-- 14 files changed, 324 insertions(+), 134 deletions(-) create mode 100644 block/copy-on-read.h -- 1.8.3.1

3 55

[libvirt PATCH] rpm: disable LTO in Fedora 34
by Daniel P. Berrangé 21 Oct '20

21 Oct '20

A binutils change has caused breakage when linking the tests /usr/bin/ld: tests/libtest_qemu_driver.so: undefined reference to `__open_missing_mode' This is probably a regression in binutils, so disable LTO until we get more clarity on the root cause and whether binutils or libvirt will need changing. https://bugzilla.redhat.com/show_bug.cgi?id=1889763 Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libvirt.spec.in b/libvirt.spec.in index 325566f329..2a4324b974 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -990,6 +990,13 @@ Libvirt plugin for NSS for translating domain names into IP addresses. %autosetup -S git_am %build + +%if 0%{?fedora} == 34 + # binutils change in F34 broke linking of tests + # https://bugzilla.redhat.com/show_bug.cgi?id=1889763 + %define _lto_cflags %{nil} +%endif + %if ! %{supported_platform} echo "This RPM requires either Fedora >= %{min_fedora} or RHEL >= %{min_rhel}" exit 1 -- 2.26.2

2 2

[PATCH v3 0/9] more Hyper-V APIs
by Matt Coleman 21 Oct '20

21 Oct '20

This set of patches adds several new APIs and fixes several others. Changes since v2: * adapted to all of Michal's recent changes * enabled usage of g_autoptr for hypervInvokeParamsList * avoid overwriting errors from hypervGetWmiClass() * use switch statements instead of if for v1/v2 parameter differences * added a helper function for domainReboot and domainReset * removed translation for the shutdown reason * changed the name of the constant for domainManagedSave on v2 to reflect the wording in Microsoft's documentation Matt Coleman (9): hyperv: enable usage of g_autoptr for hypervInvokeParamsList hyperv: avoid overwriting errors from hypervGetWmiClass() hyperv: implement domainSetAutostart hyperv: implement nodeGetFreeMemory hyperv: implement domainReboot and domainReset hyperv: implement domainShutdown and domainShutdownFlags hyperv: fix domainSuspend and domainResume on Hyper-V V2 hyperv: fix domainManagedSave on Hyper-V V2 news: more Hyper-V APIs NEWS.rst | 7 +- src/hyperv/hyperv_driver.c | 353 ++++++++++++++++++++++---- src/hyperv/hyperv_wmi.h | 1 + src/hyperv/hyperv_wmi_classes.h | 3 + src/hyperv/hyperv_wmi_generator.input | 78 ++++++ 5 files changed, 391 insertions(+), 51 deletions(-) -- 2.27.0

2 21

[PATCH] util: fix very old bug/typo in virNetDevParseVfInfo()
by Laine Stump 21 Oct '20

21 Oct '20

When this function was recently changed to add in parsing of IFLA_VF_STATS, I noticed that the checks for existence of IFLA_VF_MAC and IFLA_VF_VLAN were looking in the *wrong array*. The array that contains the results of parsing each IFLA_VFINFO in tb[IFLA_VFINFO_LIST] is tb_vf, but we were checking for these in tb (which is the array containing the results of the toplevel parsing of the netlink message, *not* the results of parsing one of the nested IFLA_VFINFO's. This incorrect code has been here since the function was originally written in 2012. It has only worked all these years due to coincidence - the items at those indexes in tb are IFLA_ADDRESS and IFLA_BROADCAST (of the *PF*, not of any of its VFs), and those happen to always be present in the toplevel netlink message; since we are only looking in the incorrect place to check for mere existence of the attribute (but are doing the actual retrieval of the attribute from the correct place), this bug has no real consequences other than confusing anyone trying to understand the code. Signed-off-by: Laine Stump <laine(a)redhat.com> --- src/util/virnetdev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util/virnetdev.c b/src/util/virnetdev.c index e284d62233..591a73cb45 100644 --- a/src/util/virnetdev.c +++ b/src/util/virnetdev.c @@ -1691,7 +1691,7 @@ virNetDevParseVfInfo(struct nlattr **tb, int32_t vf, virMacAddrPtr mac, return rc; } - if (mac && tb[IFLA_VF_MAC]) { + if (mac && tb_vf[IFLA_VF_MAC]) { vf_mac = RTA_DATA(tb_vf[IFLA_VF_MAC]); if (vf_mac && vf_mac->vf == vf) { virMacAddrSetRaw(mac, vf_mac->mac); @@ -1699,7 +1699,7 @@ virNetDevParseVfInfo(struct nlattr **tb, int32_t vf, virMacAddrPtr mac, } } - if (vlanid && tb[IFLA_VF_VLAN]) { + if (vlanid && tb_vf[IFLA_VF_VLAN]) { vf_vlan = RTA_DATA(tb_vf[IFLA_VF_VLAN]); if (vf_vlan && vf_vlan->vf == vf) { *vlanid = vf_vlan->vlan; -- 2.26.2

2 1

[PATCH v2 0/2] qemu: stop passing -enable-fips to QEMU >= 5.2.0
by Peter Krempa 21 Oct '20

21 Oct '20

v2: - rebased patch 2 on current master - sanitized testing of -enable-fips in qemuxml2argvtest - reused existing QEMU_CAPS_ENABLE_FIPS flag with inverted logic (saves us from having to remove it later and also doesn't add new flag to new guests) - qemuxml2argvtest now tests the output, which is more obvious on qemu version bumps than qemucapabilitiestest Daniel P. Berrangé (1): qemu: stop passing -enable-fips to QEMU >= 5.2.0 Peter Krempa (1): qemuxml2argvtest: Sanitize testing of '-enable-fips' src/qemu/qemu_capabilities.c | 7 ++++ src/qemu/qemu_command.c | 12 +++++- src/qemu/qemu_command.h | 2 +- src/qemu/qemu_driver.c | 2 +- src/qemu/qemu_process.c | 2 +- .../caps_1.5.3.x86_64.xml | 1 + .../caps_1.6.0.x86_64.xml | 1 + .../caps_1.7.0.x86_64.xml | 1 + .../caps_2.1.1.x86_64.xml | 1 + .../caps_2.10.0.aarch64.xml | 1 + .../caps_2.10.0.ppc64.xml | 1 + .../caps_2.10.0.s390x.xml | 1 + .../caps_2.10.0.x86_64.xml | 1 + .../caps_2.11.0.s390x.xml | 1 + .../caps_2.11.0.x86_64.xml | 1 + .../caps_2.12.0.aarch64.xml | 1 + .../caps_2.12.0.ppc64.xml | 1 + .../caps_2.12.0.s390x.xml | 1 + .../caps_2.12.0.x86_64.xml | 1 + .../caps_2.4.0.x86_64.xml | 1 + .../caps_2.5.0.x86_64.xml | 1 + .../caps_2.6.0.aarch64.xml | 1 + .../qemucapabilitiesdata/caps_2.6.0.ppc64.xml | 1 + .../caps_2.6.0.x86_64.xml | 1 + .../qemucapabilitiesdata/caps_2.7.0.s390x.xml | 1 + .../caps_2.7.0.x86_64.xml | 1 + .../qemucapabilitiesdata/caps_2.8.0.s390x.xml | 1 + .../caps_2.8.0.x86_64.xml | 1 + .../qemucapabilitiesdata/caps_2.9.0.ppc64.xml | 1 + .../qemucapabilitiesdata/caps_2.9.0.s390x.xml | 1 + .../caps_2.9.0.x86_64.xml | 1 + .../qemucapabilitiesdata/caps_3.0.0.ppc64.xml | 1 + .../caps_3.0.0.riscv32.xml | 1 + .../caps_3.0.0.riscv64.xml | 1 + .../qemucapabilitiesdata/caps_3.0.0.s390x.xml | 1 + .../caps_3.0.0.x86_64.xml | 1 + .../qemucapabilitiesdata/caps_3.1.0.ppc64.xml | 1 + .../caps_3.1.0.x86_64.xml | 1 + .../caps_4.0.0.aarch64.xml | 1 + .../qemucapabilitiesdata/caps_4.0.0.ppc64.xml | 1 + .../caps_4.0.0.riscv32.xml | 1 + .../caps_4.0.0.riscv64.xml | 1 + .../qemucapabilitiesdata/caps_4.0.0.s390x.xml | 1 + .../caps_4.0.0.x86_64.xml | 1 + .../caps_4.1.0.x86_64.xml | 1 + .../caps_4.2.0.aarch64.xml | 1 + .../qemucapabilitiesdata/caps_4.2.0.ppc64.xml | 1 + .../qemucapabilitiesdata/caps_4.2.0.s390x.xml | 1 + .../caps_4.2.0.x86_64.xml | 1 + .../caps_5.0.0.aarch64.xml | 1 + .../qemucapabilitiesdata/caps_5.0.0.ppc64.xml | 1 + .../caps_5.0.0.riscv64.xml | 1 + .../caps_5.0.0.x86_64.xml | 1 + .../caps_5.1.0.x86_64.xml | 1 + .../caps_5.2.0.x86_64.xml | 1 + tests/qemuxml2argvdata/fips-enabled.args | 31 -------------- .../fips-enabled.x86_64-5.1.0.args | 40 ++++++++++++++++++ .../fips-enabled.x86_64-latest.args | 41 +++++++++++++++++++ tests/qemuxml2argvtest.c | 16 +++++--- tests/testutilsqemu.h | 2 +- 60 files changed, 163 insertions(+), 42 deletions(-) delete mode 100644 tests/qemuxml2argvdata/fips-enabled.args create mode 100644 tests/qemuxml2argvdata/fips-enabled.x86_64-5.1.0.args create mode 100644 tests/qemuxml2argvdata/fips-enabled.x86_64-latest.args -- 2.26.2

2 4

[libvirt PATCH] qemu: stop passing -enable-fips to QEMU >= 5.2.0
by Daniel P. Berrangé 21 Oct '20

21 Oct '20

Use of the -enable-fips option is being deprecated in QEMU >= 5.2.0. If FIPS compliance is required, QEMU must be built with libcrypt which will unconditionally enforce it. Thus there is no need for libvirt to pass -enable-fips to modern QEMU. Unfortunately there was never any way to probe for -enable-fips in the first instance, it was enabled by libvirt based on version number originally, and then later unconditionally enabled when libvirt dropped support for older QEMU. Similarly we now use a version number check to decide when to stop passing -enable-fips. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/qemu/qemu_capabilities.c | 8 ++++++++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 12 +++++++++++- src/qemu/qemu_command.h | 2 +- src/qemu/qemu_driver.c | 2 +- src/qemu/qemu_process.c | 2 +- 6 files changed, 23 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 81d9ecd886..b4271cd863 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -601,6 +601,7 @@ VIR_ENUM_IMPL(virQEMUCaps, /* 380 */ "usb-host.hostdevice", "virtio-balloon.free-page-reporting", + "fips-implied", ); @@ -5151,6 +5152,13 @@ virQEMUCapsInitQMPVersionCaps(virQEMUCapsPtr qemuCaps) /* TCG couldn't be disabled nor queried until QEMU 2.10 */ if (qemuCaps->version < 2010000) virQEMUCapsSet(qemuCaps, QEMU_CAPS_TCG); + + /* -enable-fips is deprecated in QEMU 5.2.0, and QEMU + * should be built with gcrypt to achieve FIPS compliance + * automatically / implicitly + */ + if (qemuCaps->version >= 5002000) + virQEMUCapsSet(qemuCaps, QEMU_CAPS_FIPS_IMPLIED); } diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 44c45589f0..2976879fa3 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -581,6 +581,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */ /* 380 */ QEMU_CAPS_USB_HOST_HOSTDEVICE, /* -device usb-host.hostdevice */ QEMU_CAPS_VIRTIO_BALLOON_FREE_PAGE_REPORTING, /*virtio balloon free-page-reporting */ + QEMU_CAPS_FIPS_IMPLIED, /* -enable-fips is no longer required, delegate to gcrypt */ QEMU_CAPS_LAST /* this must always be the last item */ } virQEMUCapsFlags; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 697a2db62b..a8cb608c28 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -1089,10 +1089,20 @@ qemuDiskConfigBlkdeviotuneEnabled(virDomainDiskDefPtr disk) * old QEMU new QEMU * FIPS enabled doesn't start VNC auth disabled * FIPS disabled/missing VNC auth enabled VNC auth enabled + * + * In QEMU 5.2.0, use of -enable-fips was deprecated. In scenarios + * where FIPS is required, QEMU must be built against libgcrypt + * which automatically enforces FIPS compliance. */ bool -qemuCheckFips(void) +qemuCheckFips(virDomainObjPtr vm) { + qemuDomainObjPrivatePtr priv = vm->privateData; + virQEMUCapsPtr qemuCaps = priv->qemuCaps; + + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_FIPS_IMPLIED)) + return false; + if (virFileExists("/proc/sys/crypto/fips_enabled")) { g_autofree char *buf = NULL; diff --git a/src/qemu/qemu_command.h b/src/qemu/qemu_command.h index 8a30f2852c..8d46c65fcc 100644 --- a/src/qemu/qemu_command.h +++ b/src/qemu/qemu_command.h @@ -215,7 +215,7 @@ qemuDiskConfigBlkdeviotuneEnabled(virDomainDiskDefPtr disk); bool -qemuCheckFips(void); +qemuCheckFips(virDomainObjPtr vm); virJSONValuePtr qemuBuildHotpluggableCPUProps(const virDomainVcpuDef *vcpu) ATTRIBUTE_NONNULL(1); diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 825bdd9119..53e4b9d085 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6452,7 +6452,7 @@ static char *qemuConnectDomainXMLToNative(virConnectPtr conn, } if (!(cmd = qemuProcessCreatePretendCmd(driver, vm, NULL, - qemuCheckFips(), true, false, + qemuCheckFips(vm), true, false, VIR_QEMU_PROCESS_START_COLD))) goto cleanup; diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 5bc76a75e3..db5d834b7c 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -6820,7 +6820,7 @@ qemuProcessLaunch(virConnectPtr conn, incoming ? incoming->launchURI : NULL, snapshot, vmop, false, - qemuCheckFips(), + qemuCheckFips(vm), &nnicindexes, &nicindexes, 0))) goto cleanup; -- 2.26.2

2 1

[PATCH v5 1/2] util: support PCI passthrough net device stats collection
by zhenwei pi 20 Oct '20

20 Oct '20

Collect PCI passthrough net device stats from kernel by netlink API. Currently, libvirt can not get PCI passthrough net device stats, run command: #virsh domifstat instance --interface=52:54:00:2d:b2:35 error: Failed to get interface stats instance 52:54:00:2d:b2:35 error: internal error: Interface name not provided The PCI device(usually SR-IOV virtual function device) is detached while it's used in PCI passthrough mode. And we can not parse this device from /proc/net/dev any more. In this patch, libvirt checks net device is VF of not firstly, then query virNetDevVFInterfaceStats(new API). virNetDevVFInterfaceStats gets PF name, then dumps VF stats by netlink, compares with VF index and get stats(suggest by Laine, original version is implemented by zhenwei which parses VFs info of all PFs, compares MAC address until the two MAC addresses match). address until the two MAC addresses match. '#ip -s link show' can get the same result. Instead of parsing the output result, implement this feature by libnl API. Notice that this feature depends on driver of PF. Test on Mellanox ConnectX-4 Lx, it works well. Also test on Intel Corporation 82599ES, it works, but only get 0. (ip-link command get the same result). IFLA_VF_STATS is supported since Linux-4.2, suggested by Laine, just using defined(__linux__) && WITH_LIBNL is enough. Thanks to Laine, Daniel<berrange(a)redhat.com> & DHB for suggestions. Signed-off-by: zhenwei pi <pizhenwei(a)bytedance.com> --- src/libvirt_private.syms | 1 + src/qemu/qemu_driver.c | 13 ++++++++ src/util/virnetdev.c | 82 ++++++++++++++++++++++++++++++++++++++++++++++-- src/util/virnetdev.h | 4 +++ 4 files changed, 98 insertions(+), 2 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 52e9c6313f..ae543589f1 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -2584,6 +2584,7 @@ virNetDevSetRootQDisc; virNetDevSetupControl; virNetDevSysfsFile; virNetDevValidateConfig; +virNetDevVFInterfaceStats; # util/virnetdevbandwidth.h diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 825bdd9119..519af71fc1 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -10132,6 +10132,19 @@ qemuDomainInterfaceStats(virDomainPtr dom, if (virDomainNetGetActualType(net) == VIR_DOMAIN_NET_TYPE_VHOSTUSER) { if (virNetDevOpenvswitchInterfaceStats(net->ifname, stats) < 0) goto cleanup; + } else if (virDomainNetGetActualType(net) == VIR_DOMAIN_NET_TYPE_HOSTDEV) { + virDomainHostdevDefPtr hostdev = virDomainNetGetActualHostdev(net); + virPCIDeviceAddressPtr vfAddr; + + if (!hostdev) { + virReportError(VIR_ERR_INTERNAL_ERROR, + "%s", _("hostdev interface missing hostdev data")); + goto cleanup; + } + + vfAddr = &hostdev->source.subsys.u.pci.addr; + if (virNetDevVFInterfaceStats(vfAddr, stats) < 0) + goto cleanup; } else { if (virNetDevTapInterfaceStats(net->ifname, stats, !virDomainNetTypeSharesHostView(net)) < 0) diff --git a/src/util/virnetdev.c b/src/util/virnetdev.c index 5c7660dab4..f53e1751b3 100644 --- a/src/util/virnetdev.c +++ b/src/util/virnetdev.c @@ -1514,6 +1514,17 @@ static struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = { .maxlen = sizeof(struct ifla_vf_mac) }, [IFLA_VF_VLAN] = { .type = NLA_UNSPEC, .maxlen = sizeof(struct ifla_vf_vlan) }, + [IFLA_VF_STATS] = { .type = NLA_NESTED }, +}; + + +static struct nla_policy ifla_vfstats_policy[IFLA_VF_STATS_MAX+1] = { + [IFLA_VF_STATS_RX_PACKETS] = { .type = NLA_U64 }, + [IFLA_VF_STATS_TX_PACKETS] = { .type = NLA_U64 }, + [IFLA_VF_STATS_RX_BYTES] = { .type = NLA_U64 }, + [IFLA_VF_STATS_TX_BYTES] = { .type = NLA_U64 }, + [IFLA_VF_STATS_BROADCAST] = { .type = NLA_U64 }, + [IFLA_VF_STATS_MULTICAST] = { .type = NLA_U64 }, }; @@ -1651,13 +1662,14 @@ virNetDevSetVfConfig(const char *ifname, int vf, static int virNetDevParseVfConfig(struct nlattr **tb, int32_t vf, virMacAddrPtr mac, - int *vlanid) + int *vlanid, virDomainInterfaceStatsPtr stats) { int rc = -1; struct ifla_vf_mac *vf_mac; struct ifla_vf_vlan *vf_vlan; struct nlattr *tb_vf_info = {NULL, }; struct nlattr *tb_vf[IFLA_VF_MAX+1]; + struct nlattr *tb_vf_stats[IFLA_VF_STATS_MAX+1]; int rem; if (!tb[IFLA_VFINFO_LIST]) { @@ -1693,6 +1705,26 @@ virNetDevParseVfConfig(struct nlattr **tb, int32_t vf, virMacAddrPtr mac, } } + if (stats && tb_vf[IFLA_VF_STATS] && tb_vf[IFLA_VF_MAC]) { + vf_mac = RTA_DATA(tb_vf[IFLA_VF_MAC]); + if (vf_mac && vf_mac->vf == vf) { + rc = nla_parse_nested(tb_vf_stats, IFLA_VF_STATS_MAX, + tb_vf[IFLA_VF_STATS], + ifla_vfstats_policy); + if (rc < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("error parsing IFLA_VF_STATS")); + return rc; + } + + stats->rx_bytes = nla_get_u64(tb_vf_stats[IFLA_VF_STATS_RX_BYTES]); + stats->tx_bytes = nla_get_u64(tb_vf_stats[IFLA_VF_STATS_TX_BYTES]); + stats->rx_packets = nla_get_u64(tb_vf_stats[IFLA_VF_STATS_RX_PACKETS]); + stats->tx_packets = nla_get_u64(tb_vf_stats[IFLA_VF_STATS_TX_PACKETS]); + rc = 0; + } + } + if (rc == 0) break; } @@ -1714,7 +1746,43 @@ virNetDevGetVfConfig(const char *ifname, int vf, virMacAddrPtr mac, if (virNetlinkDumpLink(ifname, ifindex, &nlData, tb, 0, 0) < 0) return -1; - return virNetDevParseVfConfig(tb, vf, mac, vlanid); + return virNetDevParseVfConfig(tb, vf, mac, vlanid, NULL); +} + + +/** + * virNetDevVFInterfaceStats: + * @vfAddr: PCI address of a VF + * @stats: returns stats of the VF interface + * + * Get the VF interface from kernel by netlink. + * Returns 0 on success, -1 on failure. + */ +int +virNetDevVFInterfaceStats(virPCIDeviceAddressPtr vfAddr, + virDomainInterfaceStatsPtr stats) +{ + g_autofree void *nlData = NULL; + struct nlattr *tb[IFLA_MAX + 1] = {NULL, }; + g_autofree char *vfSysfsPath = NULL; + g_autofree char *pfname = NULL; + int vf = -1; + + if (virPCIDeviceAddressGetSysfsFile(vfAddr, &vfSysfsPath) < 0) + return -1; + + if (!virPCIIsVirtualFunction(vfSysfsPath)) { + virReportError(VIR_ERR_INTERNAL_ERROR, _("'%s' is not a VF device"), vfSysfsPath); + return -1; + } + + if (virPCIGetVirtualFunctionInfo(vfSysfsPath, -1, &pfname, &vf) < 0) + return -1; + + if (virNetlinkDumpLink(pfname, -1, &nlData, tb, 0, 0) < 0) + return -1; + + return virNetDevParseVfConfig(tb, vf, NULL, NULL, stats); } @@ -2330,6 +2398,16 @@ virNetDevSetNetConfig(const char *linkdev G_GNUC_UNUSED, } +int +virNetDevVFInterfaceStats(virPCIDeviceAddressPtr vfAddr G_GNUC_UNUSED, + virDomainInterfaceStatsPtr stats G_GNUC_UNUSED) +{ + virReportSystemError(ENOSYS, "%s", + _("Unable to get VF net device stats on this platform")); + return -1; +} + + #endif /* defined(WITH_LIBNL) */ VIR_ENUM_IMPL(virNetDevIfState, diff --git a/src/util/virnetdev.h b/src/util/virnetdev.h index dfef49938f..53e606c61c 100644 --- a/src/util/virnetdev.h +++ b/src/util/virnetdev.h @@ -316,4 +316,8 @@ int virNetDevSetRootQDisc(const char *ifname, const char *qdisc) G_GNUC_NO_INLINE; +int virNetDevVFInterfaceStats(virPCIDeviceAddressPtr vfAddr, + virDomainInterfaceStatsPtr stats) +ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2); + G_DEFINE_AUTOPTR_CLEANUP_FUNC(virNetDevRxFilter, virNetDevRxFilterFree); -- 2.11.0

2 3