July 2021 - Devel - libvirt List Archives

[libvirt][PATCH v4 0/4] Support query and use SGX
by Haibin Huang 28 Jul '21

28 Jul '21

This patch series provides support for enabling Intel's Software Guard Extensions (SGX) feature in guest VM. Giving the SGX support in QEMU is still pending for reviewing, this patch series is not submmited for code review, but only describe the SGX enabling solution design that contains changes to virConnectGetDomainCapabilities API response and domain definition. All comments/suggestions would be highly appreciated. Intel Software Guard Extensions (Intel® SGX) is a set of instructions that increases the security of application code and data, giving them more protection from disclosure or modification. Developers can partition sensitive information into enclaves, which are areas of execution in memory with more security protection. The typical flow looks below at very high level: 1. Calls virConnectGetDomainCapabilities API to domain capabilities that includes the following SGX information. <feature> ... <sgx supported='yes'> <epc_size unit=’KiB’>N</epc_size> </sgx> </feature> 2. User requests to start a guest calling virCreateXML() with SGX requirement. It should contain <launchSecurity type='sgx'> <epc_size unit='KiB'>N</epc_size> </launchSecurity> Haibin Huang (1): Support to query SGX capability Lin Yang (3): conf: Introduce SGX related element into domain xml qemu: Add command-line to generate SGX EPC memory backend qemu: Add command-line to enable SGX src/conf/domain_capabilities.c | 29 ++++ src/conf/domain_capabilities.h | 13 ++ src/conf/domain_conf.c | 106 +++++++++---- src/conf/domain_conf.h | 10 ++ src/conf/virconftypes.h | 3 + src/libvirt_private.syms | 2 +- src/qemu/qemu_capabilities.c | 146 ++++++++++++++++++ src/qemu/qemu_capabilities.h | 6 + src/qemu/qemu_command.c | 30 ++++ src/qemu/qemu_monitor.c | 10 ++ src/qemu/qemu_monitor.h | 3 + src/qemu/qemu_monitor_json.c | 91 +++++++++++ src/qemu/qemu_monitor_json.h | 3 + tests/domaincapsdata/bhyve_basic.x86_64.xml | 1 + tests/domaincapsdata/bhyve_fbuf.x86_64.xml | 1 + tests/domaincapsdata/bhyve_uefi.x86_64.xml | 1 + tests/domaincapsdata/empty.xml | 1 + tests/domaincapsdata/libxl-xenfv.xml | 1 + tests/domaincapsdata/libxl-xenpv.xml | 1 + .../domaincapsdata/qemu_1.5.3-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_1.5.3-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_1.5.3.x86_64.xml | 1 + .../domaincapsdata/qemu_1.6.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_1.6.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_1.6.0.x86_64.xml | 1 + .../domaincapsdata/qemu_1.7.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_1.7.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_1.7.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.1.1-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.1.1-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.1.1.x86_64.xml | 1 + .../domaincapsdata/qemu_2.10.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.10.0-tcg.x86_64.xml | 1 + .../qemu_2.10.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.10.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.10.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_2.10.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.10.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.11.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.11.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.11.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.11.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.12.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.12.0-tcg.x86_64.xml | 1 + .../qemu_2.12.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.12.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.12.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_2.12.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.12.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.4.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.4.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.4.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.5.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.5.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.5.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.6.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.6.0-tcg.x86_64.xml | 1 + .../qemu_2.6.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.6.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.6.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_2.6.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.7.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.7.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.7.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.7.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.8.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.8.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.8.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.8.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.9.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.9.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.9.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_2.9.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.9.0.x86_64.xml | 1 + .../domaincapsdata/qemu_3.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_3.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_3.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_3.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_3.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_3.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_3.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_3.1.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_3.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_4.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_4.0.0-tcg.x86_64.xml | 1 + .../qemu_4.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_4.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_4.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_4.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_4.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_4.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_4.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_4.2.0-tcg.x86_64.xml | 1 + .../qemu_4.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_4.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.0.0-tcg.x86_64.xml | 1 + .../qemu_5.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_5.1.0.x86_64.xml | 1 + 109 files changed, 519 insertions(+), 29 deletions(-) -- 2.17.1

5 25

Turning off -Werror
by Richard W.M. Jones 28 Jul '21

28 Jul '21

commit 3c3c55be66e230ef09ad927eda038dc32f01a166 Author: Daniel P. Berrangé <berrange(a)redhat.com> Date: Thu Apr 8 11:50:30 2021 +0100 meson: don't probe for -Werror if --werror is enabled Builds are failing in Fedora Rawhide at the moment because of a warning being turned into an error. Fedora's spec file has this which is supposed to turn off -Werror, but it no longer works after the above commit was added. https://src.fedoraproject.org/rpms/libvirt/blob/rawhide/f/libvirt.spec#_189 I'm trying to understand how you're supposed to turn off -Werror. According to meson documentation omitting --werror should work. According to some different docs, use --werror=false. Neither are working for me. I'm actually wondering if the commit above is wrong. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com virt-top is 'top' for virtual machines. Tiny program with many powerful monitoring features, net stats, disk stats, logging, etc. http://people.redhat.com/~rjones/virt-top

2 2

[PATCH 0/2] qemu: block: Pass discard requests through the copy-on-read block filter (for 7.6?)
by Peter Krempa 28 Jul '21

28 Jul '21

See 1/2 Peter Krempa (2): qemu: block: Pass discard requests through the copy-on-read block filter NEWS: Mention fix for 'copy_on_read' disks with trimming enabled NEWS.rst | 6 ++++++ src/qemu/qemu_block.c | 1 + tests/qemuxml2argvdata/disk-copy_on_read.x86_64-latest.args | 2 +- 3 files changed, 8 insertions(+), 1 deletion(-) -- 2.31.1

4 6

[RFC PATCH v2 0/8] LIBVIRT: X86: TDX support
by Zhenzhong Duan 28 Jul '21

28 Jul '21

Thanks Peter, Pavel and Daniel's comments on v1 version, now the v2 comes. * What's TDX? TDX stands for Trust Domain Extensions which isolates VMs from the virtual-machine manager (VMM)/hypervisor and any other software on the platform. To support TDX, multiple software components, not only KVM but also QEMU, guest Linux and virtual bios, need to be updated. For more details, please check link[1], there are TDX spec links and public repository link at github for each software component. This patchset is another software component to extend libvirt to support TDX, with which one can start a VM from high level rather than running qemu directly. * The goal of this RFC patch The purpose of this post is to get feedback early on high level design issue of libvirt enhancement for TDX. Referenced much on AMD SEV and S390 PV implemention at link[2][3]. This 2nd version is rebased on upstream + s390 v4 version as shown in [3] to utilize the common launchsecurity framework code. * Patch organization - patch 1-3: Support query of TDX capabilities. - patch 4-6: Add TDX type to launchsecurity framework. - patch 7: Add general loader support for TDX. - patch 8: Add firmware descriptor support for TDX. * Misc Just let you know we have released v2 version of TDX qemu in [1], and the API for libvirt is keeping stable. Using these patches we have succesfully booted and tested a guest both with and without TDX enabled. * Diff to v1: - give up using qmp cmd and check TDX directly on host for TDX capabilities. - use launchsecurity framework to support TDX - use <os>.<loader> for general loader - add auto firmware match feature for TDX A example TDVF fimware description file 70-edk2-x86_64-tdx.json: { "description": "UEFI firmware for x86_64, supporting Intel TDX", "interface-types": [ "uefi" ], "mapping": { "device": "generic", "filename": "/usr/share/OVMF/OVMF_CODE-tdx.fd" }, "targets": [ { "architecture": "x86_64", "machines": [ "pc-q35-*" ] } ], "features": [ "intel-tdx", "verbose-dynamic" ], "tags": [ ] } Links: [1] https://lists.nongnu.org/archive/html/qemu-devel/2021-07/msg01682.html [2] https://github.com/codomania/libvirt/commits/v9 [3] https://www.mail-archive.com/libvir-list@redhat.com/msg219144.html Zhenzhong Duan (8): qemu: Check if INTEL Trust Domain Extention support is enabled qemu: Add TDX capability conf: expose TDX feature in domain capabilities conf: add tdx as launch security type qemu: Add command line and validation for TDX type qemu: force special parameters enabled for TDX guest qemu: Add general loader support qemu: Add firmware descriptor support for TDX docs/formatdomaincaps.html.in | 17 ++++++ docs/schemas/domaincaps.rng | 9 +++ docs/schemas/domaincommon.rng | 18 ++++++ src/conf/domain_capabilities.c | 1 + src/conf/domain_capabilities.h | 1 + src/conf/domain_conf.c | 49 ++++++++++++++++ src/conf/domain_conf.h | 11 ++++ src/conf/virconftypes.h | 2 + src/qemu/qemu_capabilities.c | 44 ++++++++++++++- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 38 +++++++++++++ src/qemu/qemu_firmware.c | 100 ++++++++++++++++++++++++++++++++- src/qemu/qemu_namespace.c | 2 + src/qemu/qemu_process.c | 1 + src/qemu/qemu_validate.c | 28 +++++++++ 15 files changed, 319 insertions(+), 3 deletions(-) -- 2.25.1

3 12

[PATCH v4 0/3] domstats:add haltpolling time statistic interface
by Yang Fei 27 Jul '21

27 Jul '21

This series add the ability to statistic the halt polling time when VM execute HLT(arm is WFI). v1: https://listman.redhat.com/archives/libvir-list/2021-July/msg00029.html v2: https://listman.redhat.com/archives/libvir-list/2021-July/msg00339.html v3: https://listman.redhat.com/archives/libvir-list/2021-July/msg00445.html changes from v1: - Move virGetCgroupValueRaw to utils.c and rename it virGetValueRaw. So that we can call it to obtain halt polling time. - Helper function virGetCpuHaltPollTime and virGetDebugFsKvmValue are added in a separate patch - Use STRPREFIX to match the path prefix. - Fix the logic that domstats will break when platform is non-linux, debugfs isn't mounted and so on. change from v2: - Drop patch 1, use virFileReadValueUllong() to get halt polling data. - Delete unnecessary error report in logs. - Remove the qemuDomainGetStatsCpuHaltPollTime function conditionally compiled on linux. - Document the new parameters in src/libvirt-domain.c. change from v3: - Add function virFileReadValueUllongQuiet without error report. - Move virGetCpuHaltPollTime to src/util/virhostcpu.c and change the name to virHostCPUGetHaltPollTime. - Replace the function which will report errors: virDirOpenIfExists -> virDirOpenQuiet virFileReadValueUllong -> virFileReadValueUllongQuiet Yang Fei (3): util: Add virFileReadValueUllongQuiet util: Add virHostCPUGetHaltPollTime qemu: Introduce qemuDomainGetStatsCpuHaltPollTime docs/manpages/virsh.rst | 4 ++++ src/libvirt-domain.c | 7 +++++++ src/libvirt_private.syms | 2 ++ src/qemu/qemu_driver.c | 20 ++++++++++++++++++++ src/util/virfile.c | 24 ++++++++++++++++++++++++ src/util/virfile.h | 2 ++ src/util/virhostcpu.c | 39 +++++++++++++++++++++++++++++++++++++++ src/util/virhostcpu.h | 4 ++++ 8 files changed, 102 insertions(+) -- 2.23.0

2 9

[PATCH 0/3] NEWS updates for 7.6
by Peter Krempa 27 Jul '21

27 Jul '21

Peter Krempa (3): NEWS: Use 'code' style for constant names in entry for recent migration fix NEWS: Mention security bug in storage pool object lookup (CVE-2021-3667) NEWS: Mention change to VIR_DOMAIN_EVENT_ID_BLOCK_THRESHOLD NEWS.rst | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) -- 2.31.1

2 4

[PATCH] storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
by Peter Krempa 27 Jul '21

27 Jul '21

'virStoragePoolObjListSearch' returns a locked and refed object, thus we must release it on ACL permission failure. Fixes: 7aa0e8c0cb8 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1984318 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- Technically a security issue since it DoS-es the objects a user doesn't have access to for users which do have access. Posting to standard devel list since the bugzilla above is public. src/storage/storage_driver.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/storage/storage_driver.c b/src/storage/storage_driver.c index c2ff4b8d06..6aa10d89f6 100644 --- a/src/storage/storage_driver.c +++ b/src/storage/storage_driver.c @@ -1738,8 +1738,10 @@ storagePoolLookupByTargetPath(virConnectPtr conn, storagePoolLookupByTargetPathCallback, cleanpath))) { def = virStoragePoolObjGetDef(obj); - if (virStoragePoolLookupByTargetPathEnsureACL(conn, def) < 0) + if (virStoragePoolLookupByTargetPathEnsureACL(conn, def) < 0) { + virStoragePoolObjEndAPI(&obj); return NULL; + } pool = virGetStoragePool(conn, def->name, def->uuid, NULL, NULL); virStoragePoolObjEndAPI(&obj); -- 2.31.1

3 4

[libvirt PATCH] schema: make target mandatory for filesystems
by Ján Tomko 27 Jul '21

27 Jul '21

Commit 12967c3e13 incorrectly made the target optional. The validation was re-introduced by commit e8863b91f (which put it into FSDefValidate instead of the parser), but it did not amend the schema to make it mandatory again. https://bugzilla.redhat.com/show_bug.cgi?id=1969232 Fixes: e8863b91fb98f077d4c44a11bd7ea84c5e6b29ef Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- docs/schemas/domaincommon.rng | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index 14c5d4ee68..2442078969 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -2859,12 +2859,10 @@ </group> </choice> <interleave> - <optional> - <element name="target"> - <attribute name="dir"/> - <empty/> - </element> - </optional> + <element name="target"> + <attribute name="dir"/> + <empty/> + </element> <optional> <attribute name="accessmode"> <choice> -- 2.31.1

2 1

[libvirt RFC PATCH 0/2] domxml-to-native: lower users' expectations
by Ján Tomko 27 Jul '21

27 Jul '21

We do not support some configs that assume fd passing. Add a disclaimer to the API and the virsh command, and a bit frendlier error message to the vsock command line generator. (Alternatively, we could fill in some random values for the file descriptor numbers, just to give the user an idea what the command line would look like. But this still won't give them a functional equivalent of the command line. Which is not possible in all cases anyway) Ján Tomko (2): domxml-to-native: add disclaimer about fd passing qemu: error out if vsock does not have a pre-opened file descriptor docs/manpages/virsh.rst | 2 ++ src/libvirt-domain.c | 3 +++ src/qemu/qemu_command.c | 6 ++++++ 3 files changed, 11 insertions(+) -- 2.31.1

2 3

[libvirt PATCH 0/4] RFC: tests: introduce lavocado
by Beraldo Leal 27 Jul '21

27 Jul '21

lavocado aims to be an alternative test framework for the libvirt project using Python, python-libvirt and Avocado. This can be used to write unit, functional and integration tests and it is inspired by the libvirt-tck framework. This series introduces the basic framework along with some basic test examples that I got from libvirt-tck. I would appreciate your comments on this RFC, to see if this fits this project's needs. Also, names and locations are just a proposal and can be changed. For now, this framework assumes that you are going to run the tests in a fresh clean environment, i.e. a VM. If you decide to use your local system, beware that execution of the tests may affect your system. One of the future goals of this framework is to utilize nested virtualization technologies and hence make sure an L1 guest is provisioned automatically for the tests to be executed in this environment and not tamper with your main system. I'm adding more information with some details inside the README file. Beraldo Leal (4): tests: introduce lavocado: initial code structure tests.lavocado: adding basic transient domain tests tests.lavocado: adding a .gitignore tests.lavocado: adding a README and Makefile for convenience tests/lavocado/.gitignore | 3 + tests/lavocado/Makefile | 2 + tests/lavocado/README.md | 124 +++++++++++++++++ tests/lavocado/lavocado/__init__.py | 0 tests/lavocado/lavocado/defaults.py | 11 ++ tests/lavocado/lavocado/exceptions.py | 20 +++ tests/lavocado/lavocado/helpers/__init__.py | 0 tests/lavocado/lavocado/helpers/domains.py | 75 ++++++++++ tests/lavocado/lavocado/test.py | 144 ++++++++++++++++++++ tests/lavocado/requirements.txt | 3 + tests/lavocado/templates/domain.xml.jinja | 20 +++ tests/lavocado/tests/domain/transient.py | 102 ++++++++++++++ 12 files changed, 504 insertions(+) create mode 100644 tests/lavocado/.gitignore create mode 100644 tests/lavocado/Makefile create mode 100644 tests/lavocado/README.md create mode 100644 tests/lavocado/lavocado/__init__.py create mode 100644 tests/lavocado/lavocado/defaults.py create mode 100644 tests/lavocado/lavocado/exceptions.py create mode 100644 tests/lavocado/lavocado/helpers/__init__.py create mode 100644 tests/lavocado/lavocado/helpers/domains.py create mode 100644 tests/lavocado/lavocado/test.py create mode 100644 tests/lavocado/requirements.txt create mode 100644 tests/lavocado/templates/domain.xml.jinja create mode 100644 tests/lavocado/tests/domain/transient.py -- 2.26.3

4 25