June 2022 - Devel - libvirt List Archives

[libvirt PATCH 00/28] Improve firmware autoselection
by Andrea Bolognani 27 Jun '22

27 Jun '22

The main motivation behind this series was making it as simple as possible ("one click") to enable Secure Boot for a VM. In the process I ended up fixing, improving and cleaning up various parts of the firmware selection interface. GitLab branch: https://gitlab.com/abologna/libvirt/-/commits/firmware Test pipeline: https://gitlab.com/abologna/libvirt/-/pipelines/571485540 Andrea Bolognani (28): tests: Remove firmware bits from unrelated tests tests: Use firmware autoselection on aarch64 tests: Drop bios-nvram-os-interleave test tests: Rename and reorganize firmware tests tests: Use minimal hardware for firmware tests tests: Don't set NVRAM path manually tests: Don't use loader.secure=no with firmware autoselection tests: Add more firmware tests conf: Move virDomainLoaderDefParseXML() conf: Rename virDomainLoaderDefParseXMLNvram() conf: Move setting type for NVRAM source conf: Move nvramTemplate parsing conf: Handle NVRAM in virDomainLoaderDefParseXML() conf: Rename virDomainLoaderDefParseXML() argument conf: Use nodes in virDomainLoaderDefParseXMLNvram() conf: Always parse NVRAM path if present conf: Enable secure-boot when enrolled-keys is enabled conf: Add return value to virDomainDefPostParseOs() conf: Reject enrolled-keys=yes with secure-boot=no conf: Always parse all firmware information conf: Refactor virDomainDefOSValidate() conf: Validate firmware configuration more thoroughly conf: Always parse firmware features conf: Reject features when using manual firmware selection qemu_firmware: Enable loader.secure when requires-smm qemu_firmware: enrolled-keys requires secure-boot docs: Add kbase page for Secure Boot NEWS: Document improvements to firmware autoselection NEWS.rst | 5 + docs/kbase/index.rst | 3 + docs/kbase/meson.build | 1 + docs/kbase/secureboot.rst | 102 ++++++++++ src/conf/domain_conf.c | 182 ++++++++++-------- src/conf/domain_validate.c | 83 ++++++-- src/qemu/qemu_firmware.c | 16 +- tests/qemusecuritytest.c | 6 +- .../aarch64-os-firmware-efi.xml | 31 --- .../bios-nvram-os-interleave.xml | 40 ---- .../bios-nvram-rw-implicit.xml | 35 ---- tests/qemuxml2argvdata/bios-nvram-rw.xml | 35 ---- tests/qemuxml2argvdata/bios-nvram-secure.xml | 35 ---- tests/qemuxml2argvdata/bios.xml | 37 ---- ...firmware-auto-bios-nvram.x86_64-latest.err | 1 + .../firmware-auto-bios-nvram.xml | 18 ++ ... => firmware-auto-bios.x86_64-latest.args} | 12 +- tests/qemuxml2argvdata/firmware-auto-bios.xml | 17 ++ ...ware-auto-efi-aarch64.aarch64-latest.args} | 6 +- ...uefi.xml => firmware-auto-efi-aarch64.xml} | 12 +- ...enrolled-keys-no-secboot.x86_64-latest.err | 1 + ...ware-auto-efi-enrolled-keys-no-secboot.xml | 21 ++ ...auto-efi-enrolled-keys.x86_64-latest.args} | 14 +- .../firmware-auto-efi-enrolled-keys.xml | 20 ++ ...auto-efi-loader-insecure.x86_64-latest.err | 1 + .../firmware-auto-efi-loader-insecure.xml | 18 ++ ...are-auto-efi-loader-path.x86_64-latest.err | 1 + .../firmware-auto-efi-loader-path.xml | 18 ++ ...auto-efi-loader-secure.x86_64-latest.args} | 15 +- .../firmware-auto-efi-loader-secure.xml | 18 ++ ...o-efi-no-enrolled-keys.x86_64-latest.args} | 3 - .../firmware-auto-efi-no-enrolled-keys.xml | 20 ++ ...re-auto-efi-no-secboot.x86_64-latest.args} | 3 - .../firmware-auto-efi-no-secboot.xml | 20 ++ ...irmware-auto-efi-nvram.x86_64-latest.args} | 10 +- .../firmware-auto-efi-nvram.xml | 18 ++ ...mware-auto-efi-secboot.x86_64-latest.args} | 8 +- .../firmware-auto-efi-secboot.xml | 20 ++ ...s => firmware-auto-efi.x86_64-latest.args} | 8 +- tests/qemuxml2argvdata/firmware-auto-efi.xml | 17 ++ ...anual-bios-rw-implicit.x86_64-latest.args} | 8 +- ...l => firmware-manual-bios-rw-implicit.xml} | 7 +- ...irmware-manual-bios-rw.x86_64-latest.args} | 8 +- ...o-path.xml => firmware-manual-bios-rw.xml} | 7 +- .../{bios.args => firmware-manual-bios.args} | 11 +- .../qemuxml2argvdata/firmware-manual-bios.xml | 15 ++ ... => firmware-manual-efi-acpi-aarch64.args} | 1 - ...l => firmware-manual-efi-acpi-aarch64.xml} | 4 +- ...args => firmware-manual-efi-acpi-q35.args} | 1 - ...i.xml => firmware-manual-efi-acpi-q35.xml} | 4 +- ...ware-manual-efi-features.x86_64-latest.err | 1 + ...e.xml => firmware-manual-efi-features.xml} | 12 +- ...th.err => firmware-manual-efi-no-path.err} | 0 ...th.xml => firmware-manual-efi-no-path.xml} | 5 +- ...> firmware-manual-efi-noacpi-aarch64.args} | 1 - ...=> firmware-manual-efi-noacpi-aarch64.xml} | 4 +- ...err => firmware-manual-efi-noacpi-q35.err} | 0 ...xml => firmware-manual-efi-noacpi-q35.xml} | 4 +- ...-manual-efi-nvram-file.x86_64-latest.args} | 4 +- ...xml => firmware-manual-efi-nvram-file.xml} | 6 +- ...-efi-nvram-network-iscsi.x86_64-4.1.0.err} | 0 ...fi-nvram-network-iscsi.x86_64-latest.args} | 4 +- ...rmware-manual-efi-nvram-network-iscsi.xml} | 9 +- ...-efi-nvram-network-nbd.x86_64-latest.args} | 4 +- ...firmware-manual-efi-nvram-network-nbd.xml} | 9 +- ...ual-efi-nvram-template.x86_64-latest.args} | 4 +- ...=> firmware-manual-efi-nvram-template.xml} | 6 +- ...e.args => firmware-manual-efi-secure.args} | 9 +- ...efi.xml => firmware-manual-efi-secure.xml} | 11 +- ...os-nvram.args => firmware-manual-efi.args} | 7 +- ...m-template.xml => firmware-manual-efi.xml} | 8 +- ...=> firmware-manual-noefi-acpi-aarch64.err} | 0 ...=> firmware-manual-noefi-acpi-aarch64.xml} | 7 +- ...gs => firmware-manual-noefi-acpi-q35.args} | 4 - ...xml => firmware-manual-noefi-acpi-q35.xml} | 7 +- ...firmware-manual-noefi-noacpi-aarch64.args} | 4 - ... firmware-manual-noefi-noacpi-aarch64.xml} | 7 +- ... => firmware-manual-noefi-noacpi-q35.args} | 4 - ...l => firmware-manual-noefi-noacpi-q35.xml} | 7 +- tests/qemuxml2argvdata/os-firmware-bios.xml | 68 ------- .../os-firmware-efi-secboot.xml | 68 ------- tests/qemuxml2argvdata/os-firmware-efi.xml | 68 ------- .../pci-bridge-many-disks.args | 1 - .../pci-bridge-many-disks.xml | 1 - .../virtio-iommu-aarch64.aarch64-latest.args | 2 +- .../qemuxml2argvdata/virtio-iommu-aarch64.xml | 6 +- tests/qemuxml2argvtest.c | 61 +++--- .../bios-nvram-os-interleave.xml | 52 ----- tests/qemuxml2xmloutdata/bios-nvram.xml | 44 ----- .../firmware-auto-bios.x86_64-latest.xml} | 23 +-- ...mware-auto-efi-aarch64.aarch64-latest.xml} | 12 +- ...-auto-efi-enrolled-keys.x86_64-latest.xml} | 21 +- ...-auto-efi-loader-secure.x86_64-latest.xml} | 22 +-- ...to-efi-no-enrolled-keys.x86_64-latest.xml} | 18 +- ...are-auto-efi-no-secboot.x86_64-latest.xml} | 20 +- ...firmware-auto-efi-nvram.x86_64-latest.xml} | 22 +-- ...rmware-auto-efi-secboot.x86_64-latest.xml} | 20 +- .../firmware-auto-efi.x86_64-latest.xml} | 21 +- ...e-manual-efi-nvram-file.x86_64-latest.xml} | 9 +- ...efi-nvram-network-iscsi.x86_64-latest.xml} | 11 +- ...l-efi-nvram-network-nbd.x86_64-latest.xml} | 11 +- .../firmware-manual-efi.xml} | 15 +- .../os-firmware-bios.x86_64-latest.xml | 72 ------- ...are-efi-no-enrolled-keys.x86_64-latest.xml | 1 - .../os-firmware-efi-secboot.x86_64-latest.xml | 72 ------- .../os-firmware-efi.x86_64-latest.xml | 72 ------- .../pci-bridge-many-disks.xml | 1 - .../virtio-iommu-aarch64.aarch64-latest.xml | 6 +- tests/qemuxml2xmltest.c | 25 +-- 109 files changed, 708 insertions(+), 1282 deletions(-) create mode 100644 docs/kbase/secureboot.rst delete mode 100644 tests/qemuxml2argvdata/aarch64-os-firmware-efi.xml delete mode 100644 tests/qemuxml2argvdata/bios-nvram-os-interleave.xml delete mode 100644 tests/qemuxml2argvdata/bios-nvram-rw-implicit.xml delete mode 100644 tests/qemuxml2argvdata/bios-nvram-rw.xml delete mode 100644 tests/qemuxml2argvdata/bios-nvram-secure.xml delete mode 100644 tests/qemuxml2argvdata/bios.xml create mode 100644 tests/qemuxml2argvdata/firmware-auto-bios-nvram.x86_64-latest.err create mode 100644 tests/qemuxml2argvdata/firmware-auto-bios-nvram.xml rename tests/qemuxml2argvdata/{os-firmware-bios.x86_64-latest.args => firmware-auto-bios.x86_64-latest.args} (55%) create mode 100644 tests/qemuxml2argvdata/firmware-auto-bios.xml rename tests/qemuxml2argvdata/{aarch64-os-firmware-efi.aarch64-latest.args => firmware-auto-efi-aarch64.aarch64-latest.args} (91%) copy tests/qemuxml2argvdata/{aarch64-acpi-uefi.xml => firmware-auto-efi-aarch64.xml} (53%) create mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-enrolled-keys-no-secboot.x86_64-latest.err create mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-enrolled-keys-no-secboot.xml rename tests/qemuxml2argvdata/{os-firmware-efi-secboot.x86_64-latest.args => firmware-auto-efi-enrolled-keys.x86_64-latest.args} (60%) create mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-enrolled-keys.xml create mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-loader-insecure.x86_64-latest.err create mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-loader-insecure.xml create mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-loader-path.x86_64-latest.err create mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-loader-path.xml rename tests/qemuxml2argvdata/{os-firmware-efi.x86_64-latest.args => firmware-auto-efi-loader-secure.x86_64-latest.args} (59%) create mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-loader-secure.xml copy tests/qemuxml2argvdata/{os-firmware-efi-no-enrolled-keys.x86_64-latest.args => firmware-auto-efi-no-enrolled-keys.x86_64-latest.args} (84%) create mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-no-enrolled-keys.xml copy tests/qemuxml2argvdata/{os-firmware-efi-no-enrolled-keys.x86_64-latest.args => firmware-auto-efi-no-secboot.x86_64-latest.args} (84%) create mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-no-secboot.xml copy tests/qemuxml2argvdata/{os-firmware-efi-no-enrolled-keys.x86_64-latest.args => firmware-auto-efi-nvram.x86_64-latest.args} (65%) create mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-nvram.xml copy tests/qemuxml2argvdata/{os-firmware-efi-no-enrolled-keys.x86_64-latest.args => firmware-auto-efi-secboot.x86_64-latest.args} (73%) create mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-secboot.xml rename tests/qemuxml2argvdata/{os-firmware-efi-no-enrolled-keys.x86_64-latest.args => firmware-auto-efi.x86_64-latest.args} (73%) create mode 100644 tests/qemuxml2argvdata/firmware-auto-efi.xml rename tests/qemuxml2argvdata/{bios-nvram-rw.x86_64-latest.args => firmware-manual-bios-rw-implicit.x86_64-latest.args} (68%) copy tests/qemuxml2argvdata/{bios-nvram-no-path.xml => firmware-manual-bios-rw-implicit.xml} (70%) rename tests/qemuxml2argvdata/{bios-nvram-rw-implicit.x86_64-latest.args => firmware-manual-bios-rw.x86_64-latest.args} (68%) copy tests/qemuxml2argvdata/{bios-nvram-no-path.xml => firmware-manual-bios-rw.xml} (68%) rename tests/qemuxml2argvdata/{bios.args => firmware-manual-bios.args} (65%) create mode 100644 tests/qemuxml2argvdata/firmware-manual-bios.xml rename tests/qemuxml2argvdata/{aarch64-acpi-uefi.args => firmware-manual-efi-acpi-aarch64.args} (98%) rename tests/qemuxml2argvdata/{aarch64-acpi-uefi.xml => firmware-manual-efi-acpi-aarch64.xml} (89%) rename tests/qemuxml2argvdata/{q35-acpi-uefi.args => firmware-manual-efi-acpi-q35.args} (98%) copy tests/qemuxml2argvdata/{q35-acpi-uefi.xml => firmware-manual-efi-acpi-q35.xml} (90%) create mode 100644 tests/qemuxml2argvdata/firmware-manual-efi-features.x86_64-latest.err copy tests/qemuxml2argvdata/{bios-nvram-template.xml => firmware-manual-efi-features.xml} (67%) rename tests/qemuxml2argvdata/{bios-nvram-no-path.err => firmware-manual-efi-no-path.err} (100%) rename tests/qemuxml2argvdata/{bios-nvram-no-path.xml => firmware-manual-efi-no-path.xml} (79%) rename tests/qemuxml2argvdata/{aarch64-noacpi-uefi.args => firmware-manual-efi-noacpi-aarch64.args} (98%) rename tests/qemuxml2argvdata/{aarch64-noacpi-uefi.xml => firmware-manual-efi-noacpi-aarch64.xml} (88%) rename tests/qemuxml2argvdata/{q35-noacpi-uefi.err => firmware-manual-efi-noacpi-q35.err} (100%) rename tests/qemuxml2argvdata/{q35-noacpi-uefi.xml => firmware-manual-efi-noacpi-q35.xml} (89%) rename tests/qemuxml2argvdata/{bios-nvram-file.x86_64-latest.args => firmware-manual-efi-nvram-file.x86_64-latest.args} (89%) rename tests/qemuxml2argvdata/{bios-nvram-file.xml => firmware-manual-efi-nvram-file.xml} (81%) rename tests/qemuxml2argvdata/{bios-nvram-network-iscsi.x86_64-4.1.0.err => firmware-manual-efi-nvram-network-iscsi.x86_64-4.1.0.err} (100%) rename tests/qemuxml2argvdata/{bios-nvram-network-iscsi.x86_64-latest.args => firmware-manual-efi-nvram-network-iscsi.x86_64-latest.args} (91%) rename tests/qemuxml2argvdata/{bios-nvram-network-iscsi.xml => firmware-manual-efi-nvram-network-iscsi.xml} (76%) rename tests/qemuxml2argvdata/{bios-nvram-network-nbd.x86_64-latest.args => firmware-manual-efi-nvram-network-nbd.x86_64-latest.args} (89%) rename tests/qemuxml2argvdata/{bios-nvram-network-nbd.xml => firmware-manual-efi-nvram-network-nbd.xml} (72%) rename tests/qemuxml2argvdata/{bios-nvram-template.x86_64-latest.args => firmware-manual-efi-nvram-template.x86_64-latest.args} (89%) copy tests/qemuxml2argvdata/{bios-nvram-template.xml => firmware-manual-efi-nvram-template.xml} (79%) rename tests/qemuxml2argvdata/{bios-nvram-secure.args => firmware-manual-efi-secure.args} (67%) rename tests/qemuxml2argvdata/{q35-acpi-uefi.xml => firmware-manual-efi-secure.xml} (60%) rename tests/qemuxml2argvdata/{bios-nvram.args => firmware-manual-efi.args} (76%) rename tests/qemuxml2argvdata/{bios-nvram-template.xml => firmware-manual-efi.xml} (71%) rename tests/qemuxml2argvdata/{aarch64-acpi-nouefi.err => firmware-manual-noefi-acpi-aarch64.err} (100%) rename tests/qemuxml2argvdata/{aarch64-acpi-nouefi.xml => firmware-manual-noefi-acpi-aarch64.xml} (61%) rename tests/qemuxml2argvdata/{q35-acpi-nouefi.args => firmware-manual-noefi-acpi-q35.args} (84%) rename tests/qemuxml2argvdata/{q35-acpi-nouefi.xml => firmware-manual-noefi-acpi-q35.xml} (63%) rename tests/qemuxml2argvdata/{aarch64-noacpi-nouefi.args => firmware-manual-noefi-noacpi-aarch64.args} (83%) rename tests/qemuxml2argvdata/{aarch64-noacpi-nouefi.xml => firmware-manual-noefi-noacpi-aarch64.xml} (59%) rename tests/qemuxml2argvdata/{q35-noacpi-nouefi.args => firmware-manual-noefi-noacpi-q35.args} (84%) rename tests/qemuxml2argvdata/{q35-noacpi-nouefi.xml => firmware-manual-noefi-noacpi-q35.xml} (60%) delete mode 100644 tests/qemuxml2argvdata/os-firmware-bios.xml delete mode 100644 tests/qemuxml2argvdata/os-firmware-efi-secboot.xml delete mode 100644 tests/qemuxml2argvdata/os-firmware-efi.xml delete mode 100644 tests/qemuxml2xmloutdata/bios-nvram-os-interleave.xml delete mode 100644 tests/qemuxml2xmloutdata/bios-nvram.xml copy tests/{qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml => qemuxml2xmloutdata/firmware-auto-bios.x86_64-latest.xml} (55%) rename tests/qemuxml2xmloutdata/{aarch64-os-firmware-efi.aarch64-latest.xml => firmware-auto-efi-aarch64.aarch64-latest.xml} (71%) copy tests/{qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml => qemuxml2xmloutdata/firmware-auto-efi-enrolled-keys.x86_64-latest.xml} (58%) copy tests/{qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml => qemuxml2xmloutdata/firmware-auto-efi-loader-secure.x86_64-latest.xml} (57%) copy tests/{qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml => qemuxml2xmloutdata/firmware-auto-efi-no-enrolled-keys.x86_64-latest.xml} (61%) copy tests/{qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml => qemuxml2xmloutdata/firmware-auto-efi-no-secboot.x86_64-latest.xml} (58%) copy tests/{qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml => qemuxml2xmloutdata/firmware-auto-efi-nvram.x86_64-latest.xml} (57%) copy tests/{qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml => qemuxml2xmloutdata/firmware-auto-efi-secboot.x86_64-latest.xml} (58%) rename tests/{qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml => qemuxml2xmloutdata/firmware-auto-efi.x86_64-latest.xml} (57%) rename tests/qemuxml2xmloutdata/{bios-nvram-file.x86_64-latest.xml => firmware-manual-efi-nvram-file.x86_64-latest.xml} (75%) rename tests/qemuxml2xmloutdata/{bios-nvram-network-iscsi.x86_64-latest.xml => firmware-manual-efi-nvram-network-iscsi.x86_64-latest.xml} (76%) rename tests/qemuxml2xmloutdata/{bios-nvram-network-nbd.x86_64-latest.xml => firmware-manual-efi-nvram-network-nbd.x86_64-latest.xml} (74%) rename tests/{qemuxml2argvdata/bios-nvram.xml => qemuxml2xmloutdata/firmware-manual-efi.xml} (65%) delete mode 100644 tests/qemuxml2xmloutdata/os-firmware-bios.x86_64-latest.xml delete mode 120000 tests/qemuxml2xmloutdata/os-firmware-efi-no-enrolled-keys.x86_64-latest.xml delete mode 100644 tests/qemuxml2xmloutdata/os-firmware-efi-secboot.x86_64-latest.xml delete mode 100644 tests/qemuxml2xmloutdata/os-firmware-efi.x86_64-latest.xml -- 2.35.3

4 33

[PATCH] NEWS: Document my contributions for the upcoming release
by Michal Privoznik 27 Jun '22

27 Jun '22

There are couple of features/improvements/bugfixes I contributed into the upcoming release. Include those worth mentioning in the NEWS. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- NEWS.rst | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 9a92fb4fcb..bb8d9a89b1 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -27,10 +27,40 @@ v8.5.0 (unreleased) A new ``VIR_MIGRATE_POSTCOPY_RESUME`` flag (``virsh migrate --postcopy-resume``) was introduced for recovering from a failed post-copy migration. + * Introduce thread_pool_min and thread_pool_max attributes to IOThread + + New attributes ``thread_pool_min`` and ``thread_pool_max`` were introduced + to ``<iothread/>`` as well as new ``<defaultiothread/>`` element with the + same attributes. This way it's possible to instruct QEMU to spawn enough + worker threads for an IOThread upfront, resulting in predictable time + needed to process an I/O requests. + * **Improvements** + * Define a TFTP server without a DHCP server in network configuration + + It's now possible to define a network with no DHCP server but with a TFTP + server. This may be useful when DHCP service is provided by other entity on + the network than libvirt spawned dnsmasq. + * **Bug fixes** + * qemu: Restore label to temp file in qemuDomainScreenshot() + + When virDomainScreenshot() is called, libvirt instructs QEMU to save the + screenshot into a temporary file. This file needs to be labelled correctly, + so that QEMU can access it. And since the file is temporary (it's deleted + after the screenshot was taken) the corresponding label restore was + missing. This proven to be problematic for profile based models, like + AppArmor, where the temporary files were added into the profile but never + removed, which resulted in longer profile recalculation times. + + * qemuBuildInterfaceConnect: Initialize @tapfd array + + Due to an uninitialized array, unsuccessful attempt to start a guest with + an ``<interface/>`` might have resulted in closing of a random FD and thus + sudden disconnect of a client or other random failures. + v8.4.0 (2022-06-01) =================== -- 2.35.1

2 1

[libvirt PATCH] qemu_migration: Avoid mem.hard_limit > 0 check
by Jiri Denemark 27 Jun '22

27 Jun '22

My original commit v8.4.0-288-gf01fc4d119 accidentally forgot to fix both instances of the same problem. While it fixed the destination side of migration, the source one remained broken. However, that commit was also wrong in saying the issue could have caused unlimited memory locking to be allowed for QEMU when RDMA migration was used. It could not, because the code would refuse to even think about starting RDMA migration if hard_limit was not set. But avoiding the "mem.hard_limit > 0" check is useful anyway. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/qemu/qemu_migration.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 2a6b7b7819..9a10ce4abe 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -4623,7 +4623,7 @@ qemuMigrationSrcStart(virDomainObj *vm, switch (spec->destType) { case MIGRATION_DEST_HOST: if (STREQ(spec->dest.host.protocol, "rdma") && - vm->def->mem.hard_limit > 0 && + virMemoryLimitIsSet(vm->def->mem.hard_limit) && qemuDomainSetMaxMemLock(vm, vm->def->mem.hard_limit << 10, &priv->preMigrationMemlock) < 0) { return -1; -- 2.35.1

2 1

[libvirt PATCH 0/3] RFC: using nbdkit for network drives in libvirt
by Jonathon Jongsma 24 Jun '22

24 Jun '22

Hi guys, I've been working on adding support for nbdkit to libvirt for network storage sources like http and ssh. See https://bugzilla.redhat.com/show_bug.cgi?id=2016527 for more information, but the summary is that RHEL does not want to ship the qemu storage plugins for curl and ssh. Handling them outside of the qemu process provides several advantages such as reduced attack surface and stability. I have something that works for me, but as I have not dealt with the storage stuff much before, I have a feeling that I'm missing some things. A quick summary of the code: - at startup I query to see whether nbdkit exists on the host and if so, I query which plugins/filters are installed. This is stored as qemuNbdkitCaps on the qemu driver - When the driver prepares the domain, we go through each disk source and determine whether the nbdkit capabilities allow us to support this disk via nbdkit, and if so, we allocate a qemuNbdkitProcess object and stash it in the private data of the virStorageSource. - The presence or absence of this qemuNbdkitProcess data then indicates whether this disk will be served to qemu indirectly via nbdkit or not - When we launch the qemuProcess, as part of the "external device start" step, I launch a ndkit process for each disk that is supported by nbdkit. I also optionally fork a child process to communicate authentication details and cookies to the nbdkit process via a unix socket. - for devices which are served by the ndkit process, I change the qemu commandline in the following ways: - I no longer pass auth/cookie secrets to qemu (those are handled by nbdkit) - I replace the actual network URL of the remote disk source with the path to the nbdkit unix socket Known shortcomings - I don't yet re-query for nbdkit / nbdkit caps, so need to restart libvirt to pick up newly-installed nbdkit or additional capabilities - testing is pretty limited at the moment - selinux not working yet - creating disks isn't supported, though Rich has added some support for that upstream in the nbdkit ssh plugin. I'd appreciate feedback on what i've got so far. Jonathon Jongsma (3): docs: clarify 'readahead' and 'timeout' for disks schema: Be more flexible for diskSourceNetworkProtocolPropsCommon WIP: use nbdkit for remote disk sources docs/formatdomain.rst | 10 +- include/libvirt/virterror.h | 1 + po/POTFILES | 1 + src/conf/schemas/domaincommon.rng | 34 +- src/qemu/meson.build | 1 + src/qemu/qemu_block.c | 64 +- src/qemu/qemu_block.h | 1 + src/qemu/qemu_command.c | 26 +- src/qemu/qemu_conf.c | 19 + src/qemu/qemu_conf.h | 5 + src/qemu/qemu_domain.c | 110 ++- src/qemu/qemu_domain.h | 5 + src/qemu/qemu_driver.c | 4 +- src/qemu/qemu_extdevice.c | 25 + src/qemu/qemu_nbdkit.c | 629 ++++++++++++++++++ src/qemu/qemu_nbdkit.h | 89 +++ src/qemu/qemu_validate.c | 22 +- src/qemu/qemu_validate.h | 4 +- src/util/virerror.c | 1 + tests/qemublocktest.c | 8 +- tests/qemustatusxml2xmldata/modern-in.xml | 1 - ...sk-cdrom-network-nbdkit.x86_64-latest.args | 42 ++ .../disk-cdrom-network-nbdkit.xml | 1 + ...isk-network-http-nbdkit.x86_64-latest.args | 45 ++ .../disk-network-http-nbdkit.xml | 1 + ...work-source-curl-nbdkit.x86_64-latest.args | 49 ++ .../disk-network-source-curl-nbdkit.xml | 1 + ...isk-network-source-curl.x86_64-latest.args | 53 ++ .../disk-network-source-curl.xml | 71 ++ tests/qemuxml2argvtest.c | 12 + tests/testutilsqemu.c | 16 + tests/testutilsqemu.h | 4 + 32 files changed, 1302 insertions(+), 53 deletions(-) create mode 100644 src/qemu/qemu_nbdkit.c create mode 100644 src/qemu/qemu_nbdkit.h create mode 100644 tests/qemuxml2argvdata/disk-cdrom-network-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-cdrom-network-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-http-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-network-http-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-network-source-curl-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl.xml -- 2.35.3

3 8

[PATCH] storage: pool: Allow more intricate nfs protocol versions
by Peter Krempa 24 Jun '22

24 Jun '22

Treat the 'protocolVer' field as a string so that e.g. '4.1' can be used. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/conf/schemas/storagepool.rng | 4 +--- src/conf/storage_conf.c | 14 +++----------- src/conf/storage_conf.h | 2 +- src/storage/storage_util.c | 4 ++-- .../pool-netfs-protocol-ver-linux.argv | 2 +- .../pool-netfs-protocol-ver.xml | 2 +- .../pool-netfs-protocol-ver.xml | 2 +- 7 files changed, 10 insertions(+), 20 deletions(-) diff --git a/src/conf/schemas/storagepool.rng b/src/conf/schemas/storagepool.rng index bd24b8b8d0..d81ead532a 100644 --- a/src/conf/schemas/storagepool.rng +++ b/src/conf/schemas/storagepool.rng @@ -577,9 +577,7 @@ <ref name="sourcefmtnetfs"/> <optional> <element name="protocol"> - <attribute name="ver"> - <ref name="unsignedInt"/> - </attribute> + <attribute name="ver"/> </element> </optional> <optional> diff --git a/src/conf/storage_conf.c b/src/conf/storage_conf.c index 5da0bf20dd..251fb9f0a2 100644 --- a/src/conf/storage_conf.c +++ b/src/conf/storage_conf.c @@ -483,6 +483,7 @@ virStoragePoolSourceClear(virStoragePoolSource *source) virStorageAuthDefFree(source->auth); VIR_FREE(source->vendor); VIR_FREE(source->product); + VIR_FREE(source->protocolVer); } @@ -526,7 +527,6 @@ virStoragePoolDefParseSource(xmlXPathContextPtr ctxt, virStoragePoolOptions *options; int n; g_autoptr(virStorageAuthDef) authdef = NULL; - g_autofree char *ver = NULL; g_autofree xmlNodePtr *nodeset = NULL; g_autofree char *sourcedir = NULL; VIR_XPATH_NODE_AUTORESTORE(ctxt) @@ -634,7 +634,7 @@ virStoragePoolDefParseSource(xmlXPathContextPtr ctxt, } /* Option protocol version string (NFSvN) */ - if ((ver = virXPathString("string(./protocol/@ver)", ctxt))) { + if ((source->protocolVer = virXPathString("string(./protocol/@ver)", ctxt))) { if ((source->format != VIR_STORAGE_POOL_NETFS_NFS) && (source->format != VIR_STORAGE_POOL_NETFS_AUTO)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, @@ -643,12 +643,6 @@ virStoragePoolDefParseSource(xmlXPathContextPtr ctxt, virStoragePoolFormatFileSystemNetTypeToString(source->format)); return -1; } - if (virStrToLong_uip(ver, NULL, 0, &source->protocolVer) < 0) { - virReportError(VIR_ERR_XML_ERROR, - _("storage pool protocol ver '%s' is malformed"), - ver); - return -1; - } } source->vendor = virXPathString("string(./vendor/@name)", ctxt); @@ -1099,9 +1093,7 @@ virStoragePoolSourceFormat(virBuffer *buf, if (src->auth) virStorageAuthDefFormat(buf, src->auth); - if (src->protocolVer) - virBufferAsprintf(buf, "<protocol ver='%u'/>\n", src->protocolVer); - + virBufferEscapeString(buf, "<protocol ver='%s'/>\n", src->protocolVer); virBufferEscapeString(buf, "<vendor name='%s'/>\n", src->vendor); virBufferEscapeString(buf, "<product name='%s'/>\n", src->product); diff --git a/src/conf/storage_conf.h b/src/conf/storage_conf.h index de39c3f294..a1bf243935 100644 --- a/src/conf/storage_conf.h +++ b/src/conf/storage_conf.h @@ -213,7 +213,7 @@ struct _virStoragePoolSource { int format; /* Protocol version value for netfs */ - unsigned int protocolVer; + char *protocolVer; }; typedef struct _virStoragePoolTarget virStoragePoolTarget; diff --git a/src/storage/storage_util.c b/src/storage/storage_util.c index 6ed2078b65..3871718b09 100644 --- a/src/storage/storage_util.c +++ b/src/storage/storage_util.c @@ -4201,8 +4201,8 @@ virStorageBackendFileSystemMountCmd(const char *cmdstr, virCommand *cmd = NULL; g_autofree char *nfsVers = NULL; - if (def->type == VIR_STORAGE_POOL_NETFS && def->source.protocolVer > 0) - nfsVers = g_strdup_printf("nfsvers=%u", def->source.protocolVer); + if (def->type == VIR_STORAGE_POOL_NETFS && def->source.protocolVer) + nfsVers = g_strdup_printf("nfsvers=%s", def->source.protocolVer); cmd = virCommandNew(cmdstr); if (netauto) diff --git a/tests/storagepoolxml2argvdata/pool-netfs-protocol-ver-linux.argv b/tests/storagepoolxml2argvdata/pool-netfs-protocol-ver-linux.argv index dac46a074f..da3e0c5927 100644 --- a/tests/storagepoolxml2argvdata/pool-netfs-protocol-ver-linux.argv +++ b/tests/storagepoolxml2argvdata/pool-netfs-protocol-ver-linux.argv @@ -1,5 +1,5 @@ mount \ --o nodev,nosuid,noexec,nfsvers=3 \ +-o nodev,nosuid,noexec,nfsvers=4.1 \ -t nfs \ localhost:/var/lib/libvirt/images \ /mnt diff --git a/tests/storagepoolxml2xmlin/pool-netfs-protocol-ver.xml b/tests/storagepoolxml2xmlin/pool-netfs-protocol-ver.xml index 40f3f94e41..f35992e3c8 100644 --- a/tests/storagepoolxml2xmlin/pool-netfs-protocol-ver.xml +++ b/tests/storagepoolxml2xmlin/pool-netfs-protocol-ver.xml @@ -8,7 +8,7 @@ <host name='localhost'/> <dir path='/var/lib/libvirt/images'/> <format type='nfs'/> - <protocol ver='3'/> + <protocol ver='4.1'/> </source> <target> <path>/mnt</path> diff --git a/tests/storagepoolxml2xmlout/pool-netfs-protocol-ver.xml b/tests/storagepoolxml2xmlout/pool-netfs-protocol-ver.xml index 5fcad1305b..74c2f5edfe 100644 --- a/tests/storagepoolxml2xmlout/pool-netfs-protocol-ver.xml +++ b/tests/storagepoolxml2xmlout/pool-netfs-protocol-ver.xml @@ -8,7 +8,7 @@ <host name='localhost'/> <dir path='/var/lib/libvirt/images'/> <format type='nfs'/> - <protocol ver='3'/> + <protocol ver='4.1'/> </source> <target> <path>/mnt</path> -- 2.36.1

4 4

[libvirt PATCH 0/7] qemu: Add support for zero-copy migration
by Jiri Denemark 23 Jun '22

23 Jun '22

This series also fixes a few issues around memory locking limit in migration code which I found while implementing the feature. Jiri Denemark (7): qemu: Add qemuDomainSetMaxMemLock helper qemu_migration: Use qemuDomainSetMaxMemLock qemu_migration: Restore original memory locking limit qemu_migration: Don't set unlimited memlock limit for RDMA Add VIR_MIGRATE_ZEROCOPY flag virsh: Add support for VIR_MIGRATE_ZEROCOPY flag qemu_migration: Implement VIR_MIGRATE_ZEROCOPY flag docs/manpages/virsh.rst | 7 +- include/libvirt/libvirt-domain.h | 9 +++ src/qemu/qemu_domain.c | 107 ++++++++++++++++++++----------- src/qemu/qemu_domain.h | 6 ++ src/qemu/qemu_migration.c | 34 ++++++++-- src/qemu/qemu_migration.h | 1 + src/qemu/qemu_migration_params.c | 6 ++ src/qemu/qemu_migration_params.h | 1 + tools/virsh-domain.c | 7 ++ 9 files changed, 136 insertions(+), 42 deletions(-) -- 2.35.1

3 13

[libvirt PATCH] conf: virDomainDefParseMemory: remove pointless assignment
by Ján Tomko 22 Jun '22

22 Jun '22

Evaluate the XPath as a boolean, instead of trying to get a node out of it. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/conf/domain_conf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 9fe930a5d8..709ca53790 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -19184,7 +19184,7 @@ virDomainDefParseMemory(virDomainDef *def, } } - if ((node = virXPathNode("./memoryBacking/nosharepages", ctxt))) + if (virXPathBoolean("boolean(./memoryBacking/nosharepages)", ctxt)) def->mem.nosharepages = true; if (virXPathBoolean("boolean(./memoryBacking/locked)", ctxt)) -- 2.34.1

2 1

[libvirt PATCH] docs: update links to listman
by Ján Tomko 22 Jun '22

22 Jun '22

The mailman for mailing lists hosted by Red Hat seems to have moved to listman.redhat.com. While the old links still seem to work, point our docs to the new location to avoid the redirect. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- docs/bindings.rst | 2 +- docs/contact.rst | 12 ++++++------ docs/submitting-patches.rst | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/bindings.rst b/docs/bindings.rst index 81a4a67067..522d443d50 100644 --- a/docs/bindings.rst +++ b/docs/bindings.rst @@ -57,6 +57,6 @@ For information on using libvirt on **Windows** `please see the Windows support page <windows.html>`__. Support, requests or help for libvirt bindings are welcome on the -`mailing list <https://www.redhat.com/mailman/listinfo/libvir-list/>`__, +`mailing list <https://listman.redhat.com/mailman/listinfo/libvir-list/>`__, as usual try to provide enough background information and make sure you use recent version, see the `help page <bugs.html>`__. diff --git a/docs/contact.rst b/docs/contact.rst index f8f7e806b3..f20801e895 100644 --- a/docs/contact.rst +++ b/docs/contact.rst @@ -21,9 +21,9 @@ There are three mailing-lists: **libvir-list(a)redhat.com** (for development) Archives - https://www.redhat.com/archives/libvir-list + https://listman.redhat.com/archives/libvir-list List info - https://www.redhat.com/mailman/listinfo/libvir-list + https://listman.redhat.com/mailman/listinfo/libvir-list This is a high volume mailing list. It is a place for discussions about the **development** of libvirt. @@ -37,9 +37,9 @@ There are three mailing-lists: **libvirt-users(a)redhat.com** (for users) Archives - https://www.redhat.com/archives/libvirt-users + https://listman.redhat.com/archives/libvirt-users List info - https://www.redhat.com/mailman/listinfo/libvirt-users + https://listman.redhat.com/mailman/listinfo/libvirt-users This is a moderate volume mailing list. It is a place for discussions involving libvirt **users**. @@ -53,9 +53,9 @@ There are three mailing-lists: **libvirt-announce(a)redhat.com** (for release notices) Archives - https://www.redhat.com/archives/libvirt-announce + https://listman.redhat.com/archives/libvirt-announce List info - https://www.redhat.com/mailman/listinfo/libvirt-announce + https://listman.redhat.com/mailman/listinfo/libvirt-announce This is a low volume mailing list, with restricted posting, for announcements of new libvirt releases. diff --git a/docs/submitting-patches.rst b/docs/submitting-patches.rst index 7cb5c2e172..7bc22323ee 100644 --- a/docs/submitting-patches.rst +++ b/docs/submitting-patches.rst @@ -68,7 +68,7 @@ particularly bad at this. If everything went well, your patch should show up on the `libvir-list -archives <https://www.redhat.com/archives/libvir-list/>`__ in a +archives <https://listman.redhat.com/archives/libvir-list/>`__ in a matter of minutes; if you still can't find it on there after an hour or so, you should double-check your setup. **Note that, if you are not already a subscriber, your very first post to the -- 2.34.1

2 1

[libvirt PATCHv2] storagefile: set size field of ploop to 8
by Ján Tomko 22 Jun '22

22 Jun '22

For all file formats, the length of the size field is assumed and hardcoded to be 8 bytes. Fix the length for the ploop format - since we specify the offset, we read 8 bytes of the length, not 0. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/storage_file/storage_file_probe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/storage_file/storage_file_probe.c b/src/storage_file/storage_file_probe.c index 54e095ffd3..9465af5d96 100644 --- a/src/storage_file/storage_file_probe.c +++ b/src/storage_file/storage_file_probe.c @@ -296,7 +296,7 @@ static struct FileTypeInfo const fileTypeInfo[] = { [VIR_STORAGE_FILE_VHD] = { 0, NULL, LV_LITTLE_ENDIAN, -1, 0, {0}, 0, 0, 0, NULL, NULL, NULL, NULL }, [VIR_STORAGE_FILE_PLOOP] = { 0, "WithouFreSpacExt", LV_LITTLE_ENDIAN, - -2, 0, {0}, PLOOP_IMAGE_SIZE_OFFSET, 0, + -2, 0, {0}, PLOOP_IMAGE_SIZE_OFFSET, 8, PLOOP_SIZE_MULTIPLIER, NULL, NULL, NULL, NULL }, /* All formats with a backing store probe below here */ -- 2.34.1

2 1

[PATCH] Add support for network backed NVRAM
by Rohit Kumar 22 Jun '22

22 Jun '22

Signed-off-by: Rohit Kumar <rohit.kumar3(a)nutanix.com> --- NEWS.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 9a8624a97e..9766dbe1df 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -17,6 +17,11 @@ v8.5.0 (unreleased) * **New features** + * qemu: Introduce support for network backed NVRAM + + Users can now use remote store NVRAM image by specifying attribute + `type='network'` with `<nvram>` element. + * qemu: Add support for post-copy migration recovery A new ``VIR_MIGRATE_POSTCOPY_RESUME`` flag (``virsh migrate --postcopy-resume``) -- 2.25.1

3 3