September 2020 - Devel - libvirt List Archives

[PATCH 0/2] qemu: migration corner case fix and cleanup
by Nikolay Shirokovskiy 06 Nov '20

06 Nov '20

Nikolay Shirokovskiy (2): qemu: fix qemuMigrationSrcCleanup to use qemuMigrationJobFinish qemu: don't needlessly unset close callback during perform phase src/qemu/qemu_migration.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) -- 1.8.3.1

3 9

[libvirt PATCH v2 00/10] remote: introduce a custom netcat impl for ssh tunnelling
by Daniel P. Berrangé 26 Oct '20

26 Oct '20

We have long had a problem with use of netcat for ssh tunnelling because there's no guarantee the UNIX socket path the client builds will match the UNIX socket path the remote host uses. We don't even allow session mode SSH tunnelling for this reason. We also can't easily auto-spawn libvirtd in session mode. With the introduction of modular daemons we also have potential for two completely different UNIX socket paths even for system mode, and the client can't know which to use. The solution to all these problems is to introduce a custom netcat impl. Instead passing the UNIX socket path, we pass the libvirt driver URI. The custom netcat then decides which socket path to use based on the remote build host environment. We still have to support netcat for interoperability with legacy libvirt versions, but we can default to the new virt-nc. Daniel P. Berrangé (10): rpc: merge logic for generating remote SSH shell script remote: push logic for default netcat binary into common helper remote: split off enums into separate source file remote: split out function for parsing URI scheme remote: parse the remote transport string earlier remote: split out function for constructing socket path remote: extract logic for determining daemon to connect to remote: introduce virt-ssh-helper binary rpc: switch order of args in virNetClientNewSSH rpc: use new virt-ssh-helper binary for remote tunnelling build-aux/syntax-check.mk | 2 +- docs/uri.html.in | 24 +- libvirt.spec.in | 2 + po/POTFILES.in | 2 + src/libvirt_remote.syms | 1 + src/remote/Makefile.inc.am | 33 +++ src/remote/remote_driver.c | 323 ++++--------------------- src/remote/remote_sockets.c | 277 +++++++++++++++++++++ src/remote/remote_sockets.h | 70 ++++++ src/remote/remote_ssh_helper.c | 425 +++++++++++++++++++++++++++++++++ src/rpc/virnetclient.c | 166 ++++++++----- src/rpc/virnetclient.h | 29 ++- src/rpc/virnetsocket.c | 37 +-- src/rpc/virnetsocket.h | 4 +- tests/virnetsockettest.c | 12 +- 15 files changed, 1035 insertions(+), 372 deletions(-) create mode 100644 src/remote/remote_sockets.c create mode 100644 src/remote/remote_sockets.h create mode 100644 src/remote/remote_ssh_helper.c -- 2.26.2

2 14

[RFC PATCH v2] fix error message in virMigrate3 if connection is broken
by Nikolay Shirokovskiy 15 Oct '20

15 Oct '20

Changes from v1 [1]: - return error value from VIR_DRV_SUPPORTS_FEATURE instead of setting error to out argument (decrease over enginering level on patch generator in other words :) Currently virDomainMigrate3 reports "this function is not supported by the connection driver: virDomainMigrate3" if connection to destination for example is broken. This is a bit misleading. This is a result of we treat errors as unsupported feature in VIR_DRV_SUPPORTS_FEATURE macro. Let's return error from macro as is. I guess all the other occurences of VIR_DRV_SUPPORTS_FEATURE need to be updated as well so that we detect errors early and not have issues similar to virDomainMigrate3. I'm going to fix the other places if this RFC is approved. [1] https://www.redhat.com/archives/libvir-list/2020-September/msg01056.html --- src/driver.h | 14 ++++++++ src/libvirt-domain.c | 91 +++++++++++++++++++++++++++++++++++++--------------- 2 files changed, 79 insertions(+), 26 deletions(-) diff --git a/src/driver.h b/src/driver.h index 6278aa0..c29b2fa 100644 --- a/src/driver.h +++ b/src/driver.h @@ -60,6 +60,20 @@ typedef enum { (drv)->connectSupportsFeature((conn), (feature)) > 0 : 0) +/* + * A little wrapper for connectSupportsFeature API to test that the API + * itself is available first. Return values are same as for API. + * + * Returns: + * -1 on error + * 0 feature is not supported + * 1 feature is supported + */ +#define VIR_DRV_SUPPORTS_FEATURE2(drv, conn, feature) \ + ((drv)->connectSupportsFeature ? \ + (drv)->connectSupportsFeature((conn), (feature)) : 0) + + #define __VIR_DRIVER_H_INCLUDES___ #include "driver-hypervisor.h" diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c index cde86c7..03c357f 100644 --- a/src/libvirt-domain.c +++ b/src/libvirt-domain.c @@ -3846,6 +3846,9 @@ virDomainMigrate3(virDomainPtr domain, const char *dname = NULL; const char *dxml = NULL; unsigned long long bandwidth = 0; + int rc_src; + int rc_dst; + int rc; VIR_DOMAIN_DEBUG(domain, "dconn=%p, params=%p, nparms=%u flags=0x%x", dconn, params, nparams, flags); @@ -3878,15 +3881,21 @@ virDomainMigrate3(virDomainPtr domain, } if (flags & VIR_MIGRATE_OFFLINE) { - if (!VIR_DRV_SUPPORTS_FEATURE(domain->conn->driver, domain->conn, - VIR_DRV_FEATURE_MIGRATION_OFFLINE)) { + rc = VIR_DRV_SUPPORTS_FEATURE2(domain->conn->driver, domain->conn, + VIR_DRV_FEATURE_MIGRATION_OFFLINE); + if (rc < 0) { + goto error; + } else if (rc == 0) { virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s", _("offline migration is not supported by " "the source host")); goto error; } - if (!VIR_DRV_SUPPORTS_FEATURE(dconn->driver, dconn, - VIR_DRV_FEATURE_MIGRATION_OFFLINE)) { + rc = VIR_DRV_SUPPORTS_FEATURE2(dconn->driver, dconn, + VIR_DRV_FEATURE_MIGRATION_OFFLINE); + if (rc < 0) { + goto error; + } else if (rc == 0) { virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s", _("offline migration is not supported by " "the destination host")); @@ -3899,21 +3908,30 @@ virDomainMigrate3(virDomainPtr domain, * the flag for just the source side. We mask it out to allow * migration from newer source to an older destination that * rejects the flag. */ - if (flags & VIR_MIGRATE_CHANGE_PROTECTION && - !VIR_DRV_SUPPORTS_FEATURE(domain->conn->driver, domain->conn, - VIR_DRV_FEATURE_MIGRATE_CHANGE_PROTECTION)) { - virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s", - _("cannot enforce change protection")); - goto error; + if (flags & VIR_MIGRATE_CHANGE_PROTECTION) { + rc = VIR_DRV_SUPPORTS_FEATURE2(domain->conn->driver, domain->conn, + VIR_DRV_FEATURE_MIGRATE_CHANGE_PROTECTION); + if (rc < 0) { + goto error; + } else if (rc == 0) { + virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s", + _("cannot enforce change protection")); + goto error; + } } flags &= ~VIR_MIGRATE_CHANGE_PROTECTION; /* Prefer extensible API but fall back to older migration APIs if params * only contains parameters which were supported by the older API. */ - if (VIR_DRV_SUPPORTS_FEATURE(domain->conn->driver, domain->conn, - VIR_DRV_FEATURE_MIGRATION_PARAMS) && - VIR_DRV_SUPPORTS_FEATURE(dconn->driver, dconn, - VIR_DRV_FEATURE_MIGRATION_PARAMS)) { + rc_src = VIR_DRV_SUPPORTS_FEATURE2(domain->conn->driver, domain->conn, + VIR_DRV_FEATURE_MIGRATION_PARAMS); + if (rc_src < 0) + goto error; + rc_dst = VIR_DRV_SUPPORTS_FEATURE2(dconn->driver, dconn, + VIR_DRV_FEATURE_MIGRATION_PARAMS); + if (rc_dst < 0) + goto error; + if (rc_src && rc_dst) { VIR_DEBUG("Using migration protocol 3 with extensible parameters"); ddomain = virDomainMigrateVersion3Params(domain, dconn, params, nparams, flags); @@ -3939,17 +3957,30 @@ virDomainMigrate3(virDomainPtr domain, goto error; } - if (VIR_DRV_SUPPORTS_FEATURE(domain->conn->driver, domain->conn, - VIR_DRV_FEATURE_MIGRATION_V3) && - VIR_DRV_SUPPORTS_FEATURE(dconn->driver, dconn, - VIR_DRV_FEATURE_MIGRATION_V3)) { + rc_src = VIR_DRV_SUPPORTS_FEATURE2(domain->conn->driver, domain->conn, + VIR_DRV_FEATURE_MIGRATION_V3); + if (rc_src < 0) + goto error; + rc_dst = VIR_DRV_SUPPORTS_FEATURE2(dconn->driver, dconn, + VIR_DRV_FEATURE_MIGRATION_V3); + if (rc_dst < 0) + goto error; + if (rc_src && rc_dst) { VIR_DEBUG("Using migration protocol 3"); ddomain = virDomainMigrateVersion3(domain, dconn, dxml, flags, dname, uri, bandwidth); - } else if (VIR_DRV_SUPPORTS_FEATURE(domain->conn->driver, domain->conn, - VIR_DRV_FEATURE_MIGRATION_V2) && - VIR_DRV_SUPPORTS_FEATURE(dconn->driver, dconn, - VIR_DRV_FEATURE_MIGRATION_V2)) { + goto done; + } + + rc_src = VIR_DRV_SUPPORTS_FEATURE2(domain->conn->driver, domain->conn, + VIR_DRV_FEATURE_MIGRATION_V2); + if (rc_src < 0) + goto error; + rc_dst = VIR_DRV_SUPPORTS_FEATURE2(dconn->driver, dconn, + VIR_DRV_FEATURE_MIGRATION_V2); + if (rc_dst < 0) + goto error; + if (rc_src && rc_dst) { VIR_DEBUG("Using migration protocol 2"); if (dxml) { virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s", @@ -3959,10 +3990,18 @@ virDomainMigrate3(virDomainPtr domain, } ddomain = virDomainMigrateVersion2(domain, dconn, flags, dname, uri, bandwidth); - } else if (VIR_DRV_SUPPORTS_FEATURE(domain->conn->driver, domain->conn, - VIR_DRV_FEATURE_MIGRATION_V1) && - VIR_DRV_SUPPORTS_FEATURE(dconn->driver, dconn, - VIR_DRV_FEATURE_MIGRATION_V1)) { + goto done; + } + + rc_src = VIR_DRV_SUPPORTS_FEATURE2(domain->conn->driver, domain->conn, + VIR_DRV_FEATURE_MIGRATION_V1); + if (rc_src < 0) + goto error; + rc_dst = VIR_DRV_SUPPORTS_FEATURE2(dconn->driver, dconn, + VIR_DRV_FEATURE_MIGRATION_V1); + if (rc_dst < 0) + goto error; + if (rc_src && rc_dst) { VIR_DEBUG("Using migration protocol 1"); if (dxml) { virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s", -- 1.8.3.1

1 1

[PATCH v3] util: support PCI passthrough net device stats collection
by zhenwei pi 12 Oct '20

12 Oct '20

Collect PCI passthrough net device stats from kernel by netlink API. Currently, libvirt can not get PCI passthrough net device stats, run command: #virsh domifstat instance --interface=52:54:00:2d:b2:35 error: Failed to get interface stats instance 52:54:00:2d:b2:35 error: internal error: Interface name not provided The PCI device(usually SR-IOV virtual function device) is detached while it's used in PCI passthrough mode. And we can not parse this device from /proc/net/dev any more. In this patch, libvirt check net device is VF of not firstly, then query virNetDevVFInterfaceStats(new API). virNetDevVFInterfaceStats parses VFs info of all PFs, compares MAC address until the two MAC addresses match. '#ip -s link show' can get the same result. Instead of parsing the output result, implement this feature by libnl API. Notice that this feature deponds on driver of PF. Test on Mellanox ConnectX-4 Lx, it works well. Also test on Intel Corporation 82599ES, it works, but only get 0. (ip-link command get the same result). IFLA_VF_STATS is supported since Linux-4.2, suggested by Laine, just using defined(__linux__) && WITH_LIBNL is enough. Signed-off-by: zhenwei pi <pizhenwei(a)bytedance.com> --- src/libvirt_private.syms | 1 + src/qemu/qemu_driver.c | 3 ++ src/util/virnetdev.c | 121 +++++++++++++++++++++++++++++++++++++++++++++++ src/util/virnetdev.h | 5 ++ 4 files changed, 130 insertions(+) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index bdbe3431b8..bcc40b8d69 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -2585,6 +2585,7 @@ virNetDevSetRcvMulti; virNetDevSetupControl; virNetDevSysfsFile; virNetDevValidateConfig; +virNetDevVFInterfaceStats; # util/virnetdevbandwidth.h diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index ae715c01d7..f554010c40 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -10196,6 +10196,9 @@ qemuDomainInterfaceStats(virDomainPtr dom, if (virDomainNetGetActualType(net) == VIR_DOMAIN_NET_TYPE_VHOSTUSER) { if (virNetDevOpenvswitchInterfaceStats(net->ifname, stats) < 0) goto cleanup; + } else if (virDomainNetGetActualType(net) == VIR_DOMAIN_NET_TYPE_HOSTDEV) { + if (virNetDevVFInterfaceStats(&net->mac, stats) < 0) + goto cleanup; } else { if (virNetDevTapInterfaceStats(net->ifname, stats, !virDomainNetTypeSharesHostView(net)) < 0) diff --git a/src/util/virnetdev.c b/src/util/virnetdev.c index e1a4cc2bef..3d54d07606 100644 --- a/src/util/virnetdev.c +++ b/src/util/virnetdev.c @@ -1489,6 +1489,7 @@ static struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = { .maxlen = sizeof(struct ifla_vf_mac) }, [IFLA_VF_VLAN] = { .type = NLA_UNSPEC, .maxlen = sizeof(struct ifla_vf_vlan) }, + [IFLA_VF_STATS] = { .type = NLA_NESTED }, }; @@ -2265,6 +2266,116 @@ virNetDevSetNetConfig(const char *linkdev, int vf, return 0; } +static struct nla_policy ifla_vfstats_policy[IFLA_VF_STATS_MAX+1] = { + [IFLA_VF_STATS_RX_PACKETS] = { .type = NLA_U64 }, + [IFLA_VF_STATS_TX_PACKETS] = { .type = NLA_U64 }, + [IFLA_VF_STATS_RX_BYTES] = { .type = NLA_U64 }, + [IFLA_VF_STATS_TX_BYTES] = { .type = NLA_U64 }, + [IFLA_VF_STATS_BROADCAST] = { .type = NLA_U64 }, + [IFLA_VF_STATS_MULTICAST] = { .type = NLA_U64 }, +}; + +static int +virNetDevParseVfStats(struct nlattr **tb, virMacAddrPtr mac, + virDomainInterfaceStatsPtr stats) +{ + int ret = -1, len; + struct ifla_vf_mac *vf_lladdr; + struct nlattr *nla, *t[IFLA_VF_MAX+1]; + struct nlattr *stb[IFLA_VF_STATS_MAX+1]; + + if (tb == NULL || mac == NULL || stats == NULL) { + return -1; + } + + if (!tb[IFLA_VFINFO_LIST]) + return -1; + + len = nla_len(tb[IFLA_VFINFO_LIST]); + + for (nla = nla_data(tb[IFLA_VFINFO_LIST]); nla_ok(nla, len); + nla = nla_next(nla, &len)) { + ret = nla_parse(t, IFLA_VF_MAX, nla_data(nla), nla_len(nla), + ifla_vf_policy); + if (ret < 0) + return -1; + + if (t[IFLA_VF_MAC] == NULL) { + continue; + } + + vf_lladdr = nla_data(t[IFLA_VF_MAC]); + if (virMacAddrCmpRaw(mac, vf_lladdr->mac)) { + continue; + } + + if (t[IFLA_VF_STATS]) { + ret = nla_parse_nested(stb, IFLA_VF_STATS_MAX, + t[IFLA_VF_STATS], + ifla_vfstats_policy); + if (ret < 0) + return -1; + + stats->rx_bytes = nla_get_u64(stb[IFLA_VF_STATS_RX_BYTES]); + stats->tx_bytes = nla_get_u64(stb[IFLA_VF_STATS_TX_BYTES]); + stats->rx_packets = nla_get_u64(stb[IFLA_VF_STATS_RX_PACKETS]); + stats->tx_packets = nla_get_u64(stb[IFLA_VF_STATS_TX_PACKETS]); + } + return 0; + } + + return ret; +} + +/** + * virNetDevVFInterfaceStats: + * @mac: MAC address of the VF interface + * @stats: returns stats of the VF interface + * + * Get the VF interface from kernel by netlink. + * Returns 0 on success, -1 on failure. + */ +int +virNetDevVFInterfaceStats(virMacAddrPtr mac, + virDomainInterfaceStatsPtr stats) +{ + int rc = -1; + void *nlData = NULL; + struct nlattr *tb[IFLA_MAX + 1] = {NULL, }; + char *sysfsDevicePath = NULL; + DIR *dirp = NULL; + struct dirent *dp; + + if (virDirOpen(&dirp, SYSFS_NET_DIR) < 0) + return -1; + + /* get all PCI net devices, and parse VFs list from netlink API. + * compare MAC address, collect device stats if matching. + */ + while (virDirRead(dirp, &dp, SYSFS_NET_DIR) > 0) { + if (virNetDevSysfsFile(&sysfsDevicePath, dp->d_name, "device") < 0) + break; + + if (virNetDevIsPCIDevice(sysfsDevicePath)) { + rc = virNetlinkDumpLink(dp->d_name, -1, &nlData, tb, 0, 0); + if (rc < 0) { + rc = -1; + goto cleanup; + } + + rc = virNetDevParseVfStats(tb, mac, stats); + VIR_FREE(nlData); + if (rc == 0) + goto cleanup; + } + VIR_FREE(sysfsDevicePath); + } + + cleanup: + VIR_FREE(sysfsDevicePath); + VIR_DIR_CLOSE(dirp); + return rc; +} #else /* defined(__linux__) && defined(WITH_LIBNL) && defined(IFLA_VF_MAX) */ @@ -2309,6 +2420,16 @@ virNetDevSetNetConfig(const char *linkdev G_GNUC_UNUSED, } +int +virNetDevVFInterfaceStats(virMacAddrPtr mac G_GNUC_UNUSED, + virDomainInterfaceStatsPtr stats G_GNUC_UNUSED) +{ + virReportSystemError(ENOSYS, "%s", + _("Unable to get VF net device stats on this platform")); + return -1; +} + + #endif /* defined(__linux__) && defined(WITH_LIBNL) && defined(IFLA_VF_MAX) */ VIR_ENUM_IMPL(virNetDevIfState, diff --git a/src/util/virnetdev.h b/src/util/virnetdev.h index 5f581323ed..ff59d9d341 100644 --- a/src/util/virnetdev.h +++ b/src/util/virnetdev.h @@ -312,4 +312,9 @@ int virNetDevSysfsFile(char **pf_sysfs_device_link, int virNetDevRunEthernetScript(const char *ifname, const char *script) G_GNUC_NO_INLINE; +int virNetDevVFInterfaceStats(virMacAddrPtr mac, + virDomainInterfaceStatsPtr stats) +ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2); + + G_DEFINE_AUTOPTR_CLEANUP_FUNC(virNetDevRxFilter, virNetDevRxFilterFree); -- 2.11.0

3 3

[PATCH] qemu.conf: Re-word the description for *_tls_x509_verify
by Fangge Jin 09 Oct '20

09 Oct '20

The original descirption for *_tls_x509_verify is a little misleading by saying that "Enabling this option will reject any client who does not have a ca-cert.pem certificate". Signed-off-by: Fangge Jin <fjin(a)redhat.com> --- src/qemu/qemu.conf | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index a96bedb114..b1bd3cecbd 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -109,9 +109,8 @@ # issuing an x509 certificate to every client who needs to connect. # # Enabling this option will reject any client that does not have a -# ca-cert.pem certificate signed by the CA in the vnc_tls_x509_cert_dir -# (or default_tls_x509_cert_dir) as well as the corresponding client-*.pem -# files described in default_tls_x509_cert_dir. +# certificate(as described in default_tls_x509_verify) signed by the +# CA in the vnc_tls_x509_cert_dir (or default_tls_x509_cert_dir). # # If this option is not supplied, it will be set to the value of # "default_tls_x509_verify". @@ -248,9 +247,8 @@ # issuing an x509 certificate to every client who needs to connect. # # Enabling this option will reject any client that does not have a -# ca-cert.pem certificate signed by the CA in the chardev_tls_x509_cert_dir -# (or default_tls_x509_cert_dir) as well as the corresponding client-*.pem -# files described in default_tls_x509_cert_dir. +# certificate(as described in default_tls_x509_verify) signed by the +# CA in the chardev_tls_x509_cert_dir (or default_tls_x509_cert_dir). # # If this option is not supplied, it will be set to the value of # "default_tls_x509_verify". @@ -375,9 +373,8 @@ # issuing an x509 certificate to every client who needs to connect. # # Enabling this option will reject any client that does not have a -# ca-cert.pem certificate signed by the CA in the migrate_tls_x509_cert_dir -# (or default_tls_x509_cert_dir) as well as the corresponding client-*.pem -# files described in default_tls_x509_cert_dir. +# certificate(as described in default_tls_x509_verify) signed by the +# CA in the migrate_tls_x509_cert_dir (or default_tls_x509_cert_dir). # # If this option is not supplied, it will be set to the value of # "default_tls_x509_verify". @@ -412,9 +409,8 @@ # issuing an x509 certificate to every client who needs to connect. # # Enabling this option will reject any client that does not have a -# ca-cert.pem certificate signed by the CA in the backup_tls_x509_cert_dir -# (or default_tls_x509_cert_dir) as well as the corresponding client-*.pem -# files described in default_tls_x509_cert_dir. +# certificate(as described in default_tls_x509_verify) signed by the +# CA in the backup_tls_x509_cert_dir (or default_tls_x509_cert_dir). # # If this option is not supplied, it will be set to the value of # "default_tls_x509_verify". -- 2.20.1

2 1

[PATCH] the leading space in volmode check will never match the leading tab output from zfs get
by richardburakowski＠gmail.com 09 Oct '20

09 Oct '20

Signed-off-by: Richard Burakowski <richard.burakowski(a)gmail.com> --- src/storage/storage_backend_zfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/storage/storage_backend_zfs.c b/src/storage/storage_backend_zfs.c index dc692f47ed..439f5b2fd5 100644 --- a/src/storage/storage_backend_zfs.c +++ b/src/storage/storage_backend_zfs.c @@ -71,7 +71,7 @@ virStorageBackendZFSVolModeNeeded(void) return ret; } - if (strstr(error, " volmode ")) + if (strstr(error, "volmode ")) return 1; else return 0; -- 2.26.2

3 2

[libvirt PATCH v3 0/8] Make unknown XML elements fail CPU comparison
by Tim Wiederhake 07 Oct '20

07 Oct '20

We currently ignore unknown elements in the CPU XML description, e.g. with virsh cpu-compare and hypervisor-cpu-compare. This makes '<cpu><faeture name="..."/></cpu>' (note the typo in "faeture") semantically identic to '<cpu/>'. No error is reported. This series adds checks for unrecognized attributes and elements in the "<cpu>" element, catching this kind of mistake. V1: https://www.redhat.com/archives/libvir-list/2020-September/msg00933.html V2: https://www.redhat.com/archives/libvir-list/2020-September/msg01073.html Changed: * Added more detailed commit messages * Added missing man page details * Split the changes slightly differently in the commits * CPU tests now always validate XML documents * Fixed typo "nonexistant" -> "nonexistent" Tim Wiederhake (8): schema: Unify apostrophe and quotation mark usage schema: Move host cpu definition to cputypes.rng schema: Move guest cpu definition to cputypes.rng schema: Add schema for guest or host cpu definition util: Allow validation for single XML node cpu: Wire in XML validation virsh: Add "validate" argument to [hypervisor-]cpu-compare tests: Add tests for unknown elements and attributes in cpu defintion docs/manpages/virsh.rst | 9 +- docs/schemas/basictypes.rng | 82 +-- docs/schemas/capability.rng | 466 ++++++--------- docs/schemas/cpu.rng | 12 + docs/schemas/cputypes.rng | 117 +++- docs/schemas/domain.rng | 10 +- docs/schemas/domainbackup.rng | 178 +++--- docs/schemas/domaincaps.rng | 236 ++++---- docs/schemas/domaincheckpoint.rng | 62 +- docs/schemas/domaincommon.rng | 431 +++++++------- docs/schemas/domainsnapshot.rng | 104 ++-- docs/schemas/interface.rng | 6 +- docs/schemas/meson.build | 1 + docs/schemas/network.rng | 44 +- docs/schemas/networkcommon.rng | 26 +- docs/schemas/networkport.rng | 6 +- docs/schemas/nodedev.rng | 464 +++++++-------- docs/schemas/nwfilter.rng | 32 +- docs/schemas/nwfilterbinding.rng | 4 +- docs/schemas/secret.rng | 70 +-- docs/schemas/storagecommon.rng | 110 ++-- docs/schemas/storagepool.rng | 584 +++++++++---------- docs/schemas/storagepoolcaps.rng | 64 +- docs/schemas/storagevol.rng | 150 ++--- include/libvirt/libvirt-host.h | 2 + src/bhyve/bhyve_driver.c | 7 +- src/conf/cpu_conf.c | 25 +- src/conf/cpu_conf.h | 6 +- src/conf/domain_conf.c | 3 +- src/cpu/cpu.c | 5 +- src/cpu/cpu.h | 3 +- src/libxl/libxl_driver.c | 7 +- src/qemu/qemu_domain.c | 5 +- src/qemu/qemu_driver.c | 18 +- src/qemu/qemu_migration_cookie.c | 3 +- src/util/virxml.c | 15 + src/util/virxml.h | 6 + tests/cputest.c | 28 +- tests/cputestdata/x86_64-bogus-attribute.xml | 2 + tests/cputestdata/x86_64-bogus-element.xml | 3 + tools/virsh-host.c | 14 + 41 files changed, 1762 insertions(+), 1658 deletions(-) create mode 100644 docs/schemas/cpu.rng create mode 100644 tests/cputestdata/x86_64-bogus-attribute.xml create mode 100644 tests/cputestdata/x86_64-bogus-element.xml -- 2.26.2

2 9

[PATCH V4] Modify virCPUarmCompare to perform compare actions
by Zhenyu Zheng 05 Oct '20

05 Oct '20

Modify virCPUarmCompare in cpu_arm.c to perform compare action. This patch only adds host to host CPU compare, the rest cases remains the same. This is useful for source and destination host compare during migrations to avoid migration between different CPU models that have different CPU freatures. Signed-off-by: Zhenyu Zheng <zheng.zhenyu(a)outlook.com> --- src/cpu/cpu_arm.c | 39 ++++++++++++++++++++++++++++++++++++--- 1 file changed, 36 insertions(+), 3 deletions(-) diff --git a/src/cpu/cpu_arm.c b/src/cpu/cpu_arm.c index 939a3b8390..64bd0f03c2 100644 --- a/src/cpu/cpu_arm.c +++ b/src/cpu/cpu_arm.c @@ -463,10 +463,43 @@ virCPUarmBaseline(virCPUDefPtr *cpus, } static virCPUCompareResult -virCPUarmCompare(virCPUDefPtr host G_GNUC_UNUSED, - virCPUDefPtr cpu G_GNUC_UNUSED, - bool failMessages G_GNUC_UNUSED) +virCPUarmCompare(virCPUDefPtr host, + virCPUDefPtr cpu, + bool failIncompatible +) { + /* Only support host to host CPU compare for ARM*/ + if (cpu->type != VIR_CPU_TYPE_HOST) + return VIR_CPU_COMPARE_IDENTICAL; + + if (!host || !host->model) { + if (failIncompatible) { + virReportError(VIR_ERR_CPU_INCOMPATIBLE, "%s", + _("unknown host CPU")); + return VIR_CPU_COMPARE_ERROR; + } else { + VIR_WARN("unknown host CPU"); + return VIR_CPU_COMPARE_INCOMPATIBLE; + } + } + + /* Compare vendor and model to check if CPUs are identical */ + if (STRNEQ_NULLABLE(host->vendor, cpu->vendor) || + STRNEQ_NULLABLE(host->model, cpu->model)) { + VIR_DEBUG("Host CPU model does not match required CPU " + "vendor %s or(and) model %s", + NULLSTR(cpu->vendor), NULLSTR(cpu->model)); + + if (failIncompatible) { + virReportError(VIR_ERR_CPU_INCOMPATIBLE, + _("Host CPU model does not match required CPU " + "vendor %s or(and) model %s"), + NULLSTR(cpu->vendor), NULLSTR(cpu->model)); + return VIR_CPU_COMPARE_ERROR; + } else { + return VIR_CPU_COMPARE_INCOMPATIBLE; + } + } return VIR_CPU_COMPARE_IDENTICAL; } -- 2.20.1

3 2

[libvirt PATCH 0/9] Make unknown XML elements fail CPU comparison
by Tim Wiederhake 05 Oct '20

05 Oct '20

We currently ignore unknown elements in the CPU XML description, e.g. with virsh cpu-compare and hypervisor-cpu-compare. This makes '<cpu><faeture name=3D"..."/></cpu>' (note the typo in "faeture") semantically identic to '<cpu/>'. No error is reported. This series adds checks for unrecognized attributes and elements in the "<cpu>" element, catching this kind of mistake. V1: https://www.redhat.com/archives/libvir-list/2020-September/msg00933.html Changed: * Factored out Schema defintion of different cpu elements * Performing validation against actual schema * Add "--validate" option to virsh [hypervisor-]cpu-compare to opt-in to vali= dation * Drive-by: Unify quotation style in docs/schemas/* Tim Wiederhake (9): schema: Unify apostrophe and quotation mark usage schema: Move host cpu definition to cputypes.rng schema: Move guest cpu definition to cputypes.rng schema: Add schema for guest or host cpu definition util: Allow validation for single XML node cpu: Validate XML virsh: Add "validate" argument to [hypervisor-]cpu-compare tests: cpu: Allow passing flags to cpuTestLoadXML tests: Add tests for unknown elements and attributes in cpu defintion docs/schemas/basictypes.rng | 82 +-- docs/schemas/capability.rng | 466 ++++++--------- docs/schemas/cpu.rng | 12 + docs/schemas/cputypes.rng | 117 +++- docs/schemas/domain.rng | 10 +- docs/schemas/domainbackup.rng | 178 +++--- docs/schemas/domaincaps.rng | 236 ++++---- docs/schemas/domaincheckpoint.rng | 62 +- docs/schemas/domaincommon.rng | 431 +++++++------- docs/schemas/domainsnapshot.rng | 104 ++-- docs/schemas/interface.rng | 6 +- docs/schemas/meson.build | 1 + docs/schemas/network.rng | 44 +- docs/schemas/networkcommon.rng | 26 +- docs/schemas/networkport.rng | 6 +- docs/schemas/nodedev.rng | 464 +++++++-------- docs/schemas/nwfilter.rng | 32 +- docs/schemas/nwfilterbinding.rng | 4 +- docs/schemas/secret.rng | 70 +-- docs/schemas/storagecommon.rng | 110 ++-- docs/schemas/storagepool.rng | 584 +++++++++---------- docs/schemas/storagepoolcaps.rng | 64 +- docs/schemas/storagevol.rng | 150 ++--- include/libvirt/libvirt-host.h | 1 + src/bhyve/bhyve_driver.c | 7 +- src/conf/cpu_conf.c | 28 +- src/conf/cpu_conf.h | 6 +- src/conf/domain_conf.c | 3 +- src/cpu/cpu.c | 5 +- src/cpu/cpu.h | 3 +- src/libxl/libxl_driver.c | 7 +- src/qemu/qemu_domain.c | 5 +- src/qemu/qemu_driver.c | 18 +- src/qemu/qemu_migration_cookie.c | 3 +- src/util/virxml.c | 15 + src/util/virxml.h | 6 + tests/cputest.c | 52 +- tests/cputestdata/x86_64-bogus-attribute.xml | 2 + tests/cputestdata/x86_64-bogus-element.xml | 3 + tools/virsh-host.c | 14 + 40 files changed, 1773 insertions(+), 1664 deletions(-) create mode 100644 docs/schemas/cpu.rng create mode 100644 tests/cputestdata/x86_64-bogus-attribute.xml create mode 100644 tests/cputestdata/x86_64-bogus-element.xml --=20 2.26.2

4 30

[PATCH] rpm: Simplify qemu+kvm conditionals and eliminate duplication
by Neal Gompa 05 Oct '20

05 Oct '20

The conditionals for enabling qemu+kvm were unnecessarily complex. In practice, there were far fewer cases where the functionality would be disabled than what the conditional logic expressed, and this change simplifies it to the realistic set of options. Signed-off-by: Neal Gompa <ngompa13(a)gmail.com> --- libvirt.spec.in | 49 +++++++++++++++++++++++-------------------------- 1 file changed, 23 insertions(+), 26 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index c4a7c30737..6940066de9 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -20,31 +20,12 @@ %define with_qemu_tcg %{with_qemu} -%define qemu_kvm_arches %{ix86} x86_64 - -%if 0%{?fedora} - %define qemu_kvm_arches %{ix86} x86_64 %{power64} s390x %{arm} aarch64 -%endif - -%if 0%{?rhel} - %define with_qemu_tcg 0 - %define qemu_kvm_arches x86_64 %{power64} aarch64 s390x -%endif - # On RHEL 7 and older macro _vpath_builddir is not defined. %if 0%{?rhel} && 0%{?rhel} <= 7 %define _vpath_builddir %{_target_platform} %endif -%ifarch %{qemu_kvm_arches} - %define with_qemu_kvm %{with_qemu} -%else - %define with_qemu_kvm 0 -%endif - -%if ! %{with_qemu_tcg} && ! %{with_qemu_kvm} - %define with_qemu 0 -%endif +%define with_qemu_kvm %{with_qemu} # Then the hypervisor drivers that run outside libvirtd, in libvirt.so %define with_openvz 0%{!?_without_openvz:1} @@ -61,12 +42,6 @@ %endif %define with_storage_gluster 0%{!?_without_storage_gluster:1} -%ifnarch %{qemu_kvm_arches} - # gluster is only built where qemu driver is enabled on RHEL 8 - %if 0%{?rhel} >= 8 - %define with_storage_gluster 0 - %endif -%endif %define with_numactl 0%{!?_without_numactl:1} @@ -97,6 +72,11 @@ # Finally set the OS / architecture specific special cases +# KVM is available on most architectures +%ifnarch %{ix86} x86_64 %{power64} s390x %{arm} aarch64 + %define with_qemu_kvm 0 +%endif + # Xen is available only on i386 x86_64 ia64 %ifnarch %{ix86} x86_64 ia64 %define with_libxl 0 @@ -122,6 +102,23 @@ %define with_storage_rbd 0 %endif +# RHEL does not ship qemu-tcg +%if 0%{?rhel} + %define with_qemu_tcg 0 +%endif + +# In the event that qemu-tcg and qemu-kvm are unavailable, don't ship qemu +%if ! %{with_qemu_tcg} && ! %{with_qemu_kvm} + %define with_qemu 0 +%endif + +%if ! %{with_qemu_kvm} + # gluster is only built where qemu driver is enabled on RHEL 8 + %if 0%{?rhel} >= 8 + %define with_storage_gluster 0 + %endif +%endif + # RHEL doesn't ship OpenVZ, VBox, PowerHypervisor, # VMware, libxenlight (Xen 4.1 and newer), # or HyperV. -- 2.26.2

2 2