November 2023 - Devel - libvirt List Archives

[PATCH 0/6] Adapt to libxml2-2.12.0
by Michal Privoznik 21 Nov '23

21 Nov '23

There is a new release of libxml2 and we have a technical debt we need to address before we can compile with it cleanly. Michal Prívozník (6): vbox_snapshot_conf: Parse XMLs without net access vbox_snapshot_conf: Keep indent in snapshot XML virxml: include <libxml/xmlsave.h> for xmlIndentTreeOutput declaration virXMLParseHelper: Store XML parsing flags in a variable virxml: Introduce parsing APIs that keep indentation lib: Replace xmlKeepBlanksDefault() with virXMLParseWithIndent() src/conf/backup_conf.c | 8 +++----- src/conf/checkpoint_conf.c | 8 +++----- src/conf/domain_conf.c | 11 +++-------- src/conf/network_conf.c | 6 ++---- src/conf/snapshot_conf.c | 8 +++----- src/util/virxml.c | 24 +++++++++++++++++------- src/util/virxml.h | 29 +++++++++++++++++++++++++---- src/vbox/vbox_snapshot_conf.c | 27 +++++++++++++++++++-------- tools/virsh-util.c | 5 +---- 9 files changed, 76 insertions(+), 50 deletions(-) -- 2.41.0

2 12

[PATCH v2 00/14] random fixes for 8.2 pre-PR (tests, plugins, docs, semihosting)
by Alex Bennée 20 Nov '23

20 Nov '23

I've just been trying to clear some of the bugs against various subsystems. These are mostly testing changes and a minor tweak I found while checking up on semihosting behaviour. Enabling arm-softmmu check-tcg tests expands our testing abilities slightly for the 32 bit side of the family. For v2 ------ - fixed up register test for ppc64/s390x - added gdbstub doc patch - review comments for arm-softmmu testing - changed handling of "native" cross for linux-user I intend to roll the PR on Wednesday. The following need still review: tests/tcg: finesse the registers check for "hidden" regs configure: don't try a "native" cross for linux-user tests/tcg: enable semiconsole test for Arm tests/tcg: enable arm softmmu tests docs/system: clarify limits of using gdbstub in system emulation docs/emulation: expand warning about semihosting tests/tcg: fixup Aarch64 semiconsole test Alex Bennée (10): tests/docker: merge debian-native with debian-amd64 tests/tcg: fixup Aarch64 semiconsole test docs/emulation: expand warning about semihosting docs/system: clarify limits of using gdbstub in system emulation hw/core: skip loading debug on all failures testing: move arm system tests into their own folder tests/tcg: enable arm softmmu tests tests/tcg: enable semiconsole test for Arm configure: don't try a "native" cross for linux-user tests/tcg: finesse the registers check for "hidden" regs Daniel P. Berrangé (1): tests/docker: replace fedora-i386 with debian-i686 Greg Manning (1): plugins: fix win plugin tests on cross compile Philippe Mathieu-Daudé (2): .gitlab-ci.d/cirrus: Upgrade macOS to 13 (Ventura) target/nios2: Deprecate the Nios II architecture docs/about/deprecated.rst | 15 + docs/about/emulation.rst | 5 +- docs/system/gdb.rst | 13 +- configure | 27 +- hw/core/loader.c | 2 +- hw/nios2/10m50_devboard.c | 1 + hw/nios2/generic_nommu.c | 1 + tests/tcg/arm/system/semiconsole.c | 42 +++ .gitlab-ci.d/buildtest.yml | 12 +- .gitlab-ci.d/cirrus.yml | 6 +- .../cirrus/{macos-12.vars => macos-13.vars} | 2 +- .gitlab-ci.d/container-cross.yml | 11 +- .gitlab-ci.d/containers.yml | 2 +- .gitlab-ci.d/crossbuilds.yml | 14 +- contrib/plugins/Makefile | 2 +- plugins/meson.build | 2 +- tests/docker/Makefile.include | 3 - .../dockerfiles/debian-i686-cross.docker | 182 +++++++++++ tests/docker/dockerfiles/debian-native.docker | 54 ---- .../{debian-amd64.docker => debian.docker} | 7 +- .../dockerfiles/fedora-i386-cross.docker | 40 --- tests/lcitool/refresh | 18 +- tests/plugin/meson.build | 3 +- tests/tcg/aarch64/Makefile.softmmu-target | 5 +- tests/tcg/arm/Makefile.softmmu-target | 76 ++++- tests/tcg/arm/system/boot.S | 301 ++++++++++++++++++ tests/tcg/arm/system/kernel.ld | 24 ++ .../tcg/arm/{ => system}/test-armv6m-undef.S | 0 .../tcg/arm/{ => system}/test-armv6m-undef.ld | 0 tests/tcg/multiarch/gdbstub/registers.py | 87 +++-- tests/tcg/ppc64/Makefile.target | 7 - tests/tcg/s390x/Makefile.target | 4 - 32 files changed, 775 insertions(+), 193 deletions(-) create mode 100644 tests/tcg/arm/system/semiconsole.c rename .gitlab-ci.d/cirrus/{macos-12.vars => macos-13.vars} (95%) create mode 100644 tests/docker/dockerfiles/debian-i686-cross.docker delete mode 100644 tests/docker/dockerfiles/debian-native.docker rename tests/docker/dockerfiles/{debian-amd64.docker => debian.docker} (96%) delete mode 100644 tests/docker/dockerfiles/fedora-i386-cross.docker create mode 100644 tests/tcg/arm/system/boot.S create mode 100644 tests/tcg/arm/system/kernel.ld rename tests/tcg/arm/{ => system}/test-armv6m-undef.S (100%) rename tests/tcg/arm/{ => system}/test-armv6m-undef.ld (100%) -- 2.39.2

3 17

[libvirt PATCH 0/6] polkit: Make it possible to write safer rules
by Andrea Bolognani 20 Nov '23

20 Nov '23

See patch 5/6 for details. Andrea Bolognani (6): docs: The Polkit access driver is disabled by default docs: Document org.libvirt.unix.* actions rpc: Introduce virNetServerHasGranularPolkit() remote: Set granularPolkit if applicable remote: Expose granularPolkit attribute to rules docs: Document granularPolkit attribute docs/aclpolkit.rst | 33 +++++++++++++++++++++++++++++ src/libvirt_remote.syms | 1 + src/locking/lock_daemon.c | 6 ++++-- src/logging/log_daemon.c | 6 ++++-- src/lxc/lxc_controller.c | 3 ++- src/remote/remote_daemon.c | 24 +++++++++++++++++---- src/remote/remote_daemon_dispatch.c | 6 +++++- src/rpc/virnetserver.c | 16 ++++++++++++-- src/rpc/virnetserver.h | 4 +++- tests/virnetdaemontest.c | 3 ++- 10 files changed, 88 insertions(+), 14 deletions(-) -- 2.42.0

2 7

[libvirt PATCH] kbase: More info on firmware change for existing VMs
by Andrea Bolognani 20 Nov '23

20 Nov '23

The need to remove the <loader> and <nvram> elements in order to make the firmware autoselection process kick in again is not exactly intuitive, so document it explicitly. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- docs/kbase/secureboot.rst | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-) diff --git a/docs/kbase/secureboot.rst b/docs/kbase/secureboot.rst index 4340454a7b..6c22b08d22 100644 --- a/docs/kbase/secureboot.rst +++ b/docs/kbase/secureboot.rst @@ -72,16 +72,36 @@ relevant documentation Changing an existing VM ======================= -Once the VM has been created, updating the XML configuration as -described above is **not** enough to change the Secure Boot status: -the NVRAM file associated with the VM has to be regenerated from its -template as well. +When a VM is defined, libvirt will pick the firmware that best +satisfies the provided criteria and record this information for use +on subsequent boots. The resulting XML configuration will look like +this: + +:: + + <os firmware='efi'> + <firmware> + <feature enabled='yes' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> + </firmware> + <loader readonly='yes' secure='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader> + <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/vm_VARS.fd</nvram> + </os> + +In order to force libvirt to repeat the firmware autoselection +process, it's necessary to remove the ``<loader>`` and ``<nvram>`` +elements. Failure to do so will likely result in an error. + +Note that updating the XML configuration as described above is +**not** enough to change the Secure Boot status: the NVRAM file +associated with the VM has to be regenerated from its template as +well. In order to do that, update the XML and then start the VM with :: - $ virsh start $vm --reset-nvram + $ virsh start vm --reset-nvram This option is only available starting with libvirt 8.1.0, so if your version of libvirt is older than that you will have to delete the -- 2.41.0

2 1

[PATCH-for-8.2] target/nios2: Deprecate the Nios II architecture
by Philippe Mathieu-Daudé 17 Nov '23

17 Nov '23

See commit 9ba1caf510 ("MAINTAINERS: Mark the Nios II CPU as orphan"), last contribution from Chris was in 2012 [1] and Marek in 2018 [2]. [1] https://lore.kernel.org/qemu-devel/1352607539-10455-2-git-send-email-crwulf… [2] https://lore.kernel.org/qemu-devel/805fc7b5-03f0-56d4-abfd-ed010d4fa769@den… Signed-off-by: Philippe Mathieu-Daudé <philmd(a)linaro.org> --- docs/about/deprecated.rst | 15 +++++++++++++++ hw/nios2/10m50_devboard.c | 1 + hw/nios2/generic_nommu.c | 1 + 3 files changed, 17 insertions(+) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 78550c07bf..f7aa556294 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -236,6 +236,16 @@ it. Since all recent x86 hardware from the past >10 years is capable of the 64-bit x86 extensions, a corresponding 64-bit OS should be used instead. +System emulator CPUs +-------------------- + +Nios II CPU (since 8.2) +''''''''''''''''''''''' + +The Nios II architecture is orphan. The ``nios2`` guest CPU support is +deprecated and will be removed in a future version of QEMU. + + System emulator machines ------------------------ @@ -254,6 +264,11 @@ These old machine types are quite neglected nowadays and thus might have various pitfalls with regards to live migration. Use a newer machine type instead. +Nios II ``10m50-ghrd`` and ``nios2-generic-nommu`` machines (since 8.2) +''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +The Nios II architecture is orphan. + Backend options --------------- diff --git a/hw/nios2/10m50_devboard.c b/hw/nios2/10m50_devboard.c index 952a0dc33e..6cb32f777b 100644 --- a/hw/nios2/10m50_devboard.c +++ b/hw/nios2/10m50_devboard.c @@ -160,6 +160,7 @@ static void nios2_10m50_ghrd_class_init(ObjectClass *oc, void *data) mc->desc = "Altera 10M50 GHRD Nios II design"; mc->init = nios2_10m50_ghrd_init; mc->is_default = true; + mc->deprecation_reason = "Nios II architecture is deprecated"; object_class_property_add_bool(oc, "vic", get_vic, set_vic); object_class_property_set_description(oc, "vic", diff --git a/hw/nios2/generic_nommu.c b/hw/nios2/generic_nommu.c index 48edb3ae37..defa16953f 100644 --- a/hw/nios2/generic_nommu.c +++ b/hw/nios2/generic_nommu.c @@ -95,6 +95,7 @@ static void nios2_generic_nommu_machine_init(struct MachineClass *mc) { mc->desc = "Generic NOMMU Nios II design"; mc->init = nios2_generic_nommu_init; + mc->deprecation_reason = "Nios II architecture is deprecated"; } DEFINE_MACHINE("nios2-generic-nommu", nios2_generic_nommu_machine_init); -- 2.41.0

6 5

[libvirt PATCH] rpc: Pass GPG_TTY and TERM environment variables
by Andrea Bolognani 17 Nov '23

17 Nov '23

gpg-agent can be used instead of ssh-agent to authenticate against an SSH server, but in order to do so the GPG_TTY and TERM environment variables need to be passed through. For obvious reasons, we avoid doing that when no_tty=1 is found in the connection URI. https://bugs.debian.org/843863 https://gitlab.com/libvirt/libvirt/-/merge_requests/290 Thanks: Guilhem Moulin <guilhem(a)guilhem.org> Thanks: Kunwu Chan <chentao(a)kylinos.cn> Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- src/rpc/virnetsocket.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/rpc/virnetsocket.c b/src/rpc/virnetsocket.c index b58f7a6b8f..151077c2dd 100644 --- a/src/rpc/virnetsocket.c +++ b/src/rpc/virnetsocket.c @@ -843,6 +843,11 @@ int virNetSocketNewConnectSSH(const char *nodename, virCommandAddEnvPass(cmd, "OPENSSL_CONF"); virCommandAddEnvPass(cmd, "DISPLAY"); virCommandAddEnvPass(cmd, "XAUTHORITY"); + if (!noTTY) { + /* Needed for gpg-agent's curses-based authentication prompt */ + virCommandAddEnvPass(cmd, "GPG_TTY"); + virCommandAddEnvPass(cmd, "TERM"); + } virCommandClearCaps(cmd); if (service) -- 2.41.0

2 1

[libvirt PATCH] qemu_snapshot: fix reverting to inactive snapshot
by Pavel Hrdina 16 Nov '23

16 Nov '23

When reverting to inactive snapshot updating the domain definition needs to happen after the new overlays are created otherwise qemu-img will correctly fail with error: Trying to create an image with the same filename as the backing file Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/qemu/qemu_snapshot.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c index 1962ba4027..5fc0b82e79 100644 --- a/src/qemu/qemu_snapshot.c +++ b/src/qemu/qemu_snapshot.c @@ -2157,13 +2157,20 @@ qemuSnapshotRevertExternalInactive(virDomainObj *vm, { virQEMUDriver *driver = QEMU_DOMAIN_PRIVATE(vm)->driver; g_autoptr(virBitmap) created = NULL; + int ret = -1; created = virBitmapNew(tmpsnapdef->ndisks); + if (qemuSnapshotCreateQcow2Files(driver, domdef, tmpsnapdef, created) < 0) + goto cleanup; + if (qemuSnapshotDomainDefUpdateDisk(domdef, tmpsnapdef, false) < 0) - return -1; + goto cleanup; - if (qemuSnapshotCreateQcow2Files(driver, domdef, tmpsnapdef, created) < 0) { + ret = 0; + + cleanup: + if (ret < 0 && created) { ssize_t bit = -1; virErrorPtr err = NULL; @@ -2180,11 +2187,9 @@ qemuSnapshotRevertExternalInactive(virDomainObj *vm, } virErrorRestore(&err); - - return -1; } - return 0; + return ret; } -- 2.41.0

2 1

[libvirt PATCH] qemu_snapshot: fix snapshot deletion that had multiple children
by Pavel Hrdina 16 Nov '23

16 Nov '23

When we revert to non-leaf snapshot and create new branch or branches the overlay in snapshot metadata is no longer usable as a disk source for deletion of that snapshot. We need to use other places to figure out the correct storage source. Fixes: https://gitlab.com/libvirt/libvirt/-/issues/534 Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/qemu/qemu_snapshot.c | 46 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 44 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c index 1962ba4027..ee06e72b11 100644 --- a/src/qemu/qemu_snapshot.c +++ b/src/qemu/qemu_snapshot.c @@ -2748,6 +2748,44 @@ qemuSnapshotGetDisksWithBackingStore(virDomainObj *vm, } +/** + * qemuSnapshotExternalGetSnapDiskSrc: + * @vm: domain object + * @snap: snapshot object + * @snapDisk: disk definition from snapshost + * + * Try to get actual disk source for @snapDisk as the source stored in + * snapshot metadata is not always the correct source we need to work with. + * This happens mainly after reverting to non-leaf snapshot and creating + * new branch with new snapshot. + * + * Returns disk source on success, NULL on error. + */ +static virStorageSource * +qemuSnapshotExternalGetSnapDiskSrc(virDomainObj *vm, + virDomainMomentObj *snap, + virDomainSnapshotDiskDef *snapDisk) +{ + virDomainDiskDef *disk = NULL; + + /* Should never happen when deleting external snapshot as for now we do + * not support this specific case for now. */ + if (snap->nchildren > 1) + return snapDisk->src; + + if (snap->first_child) { + disk = qemuDomainDiskByName(snap->first_child->def->dom, snapDisk->name); + } else if (virDomainSnapshotGetCurrent(vm->snapshots) == snap) { + disk = qemuDomainDiskByName(vm->def, snapDisk->name); + } + + if (disk) + return disk->src; + + return snapDisk->src; +} + + /** * qemuSnapshotDeleteExternalPrepareData: * @vm: domain object @@ -2802,18 +2840,22 @@ qemuSnapshotDeleteExternalPrepareData(virDomainObj *vm, } if (data->merge) { + virStorageSource *snapDiskSrc = NULL; + data->domDisk = qemuDomainDiskByName(vm->def, snapDisk->name); if (!data->domDisk) return -1; + snapDiskSrc = qemuSnapshotExternalGetSnapDiskSrc(vm, snap, data->snapDisk); + if (virDomainObjIsActive(vm)) { data->diskSrc = virStorageSourceChainLookupBySource(data->domDisk->src, - data->snapDisk->src, + snapDiskSrc, &data->prevDiskSrc); if (!data->diskSrc) return -1; - if (!virStorageSourceIsSameLocation(data->diskSrc, data->snapDisk->src)) { + if (!virStorageSourceIsSameLocation(data->diskSrc, snapDiskSrc)) { virReportError(VIR_ERR_OPERATION_FAILED, "%s", _("VM disk source and snapshot disk source are not the same")); return -1; -- 2.41.0

2 1

[libvirt PATCH 0/3] Introduce VIR_MIGRATE_ASSUME_SHARED_STORAGE
by Andrea Bolognani 13 Nov '23

13 Nov '23

This was initially motivated by a KubeVirt issue[1] concerning integration with the Portworx storage provide, but it turns out to be more generally applicable: since mounting an NFS share on the same host that is exporting it is known to cause issues and is therefore not recommended, we need a way to allow migration in such a configuration while still not going quite as far as VIR_MIGRATE_UNSAFE does and losing all handrails. [1] https://issues.redhat.com/browse/CNV-34322 Andrea Bolognani (3): include: Introduce VIR_MIGRATE_ASSUME_SHARED_STORAGE qemu: Implement VIR_MIGRATE_ASSUME_SHARED_STORAGE support virsh: Wire up VIR_MIGRATE_ASSUME_SHARED_STORAGE support docs/manpages/virsh.rst | 5 ++++- include/libvirt/libvirt-domain.h | 14 ++++++++++++++ src/qemu/qemu_migration.c | 5 +++++ src/qemu/qemu_migration.h | 1 + tools/virsh-domain.c | 5 +++++ 5 files changed, 29 insertions(+), 1 deletion(-) -- 2.41.0

3 11

[v2 0/4] Support for dirty-limit live migration
by Hyman Huang 12 Nov '23

12 Nov '23

Hello, this is series version 2. Just certain that it won't be overlooked. Please review, thanks, Yong v2: - rebase on master v1: In qemu>=8.1, the dirty-limit functionality for live migration was included. In the live migration scenario, it implements the force convergence using the dirty-limit approach, which results in better reliable read performance. A straightforward dirty-limit capability for live migration is added by this patchset. Users might not care about other dirty-limit arguments like "x-vcpu-dirty-limit-period" or "vcpu-dirty-limit," thus do not expose them to Libvirt and leave the default settings in place. values as default. For more details about dirty-limit. please see the following reference: https://lore.kernel.org/qemu- devel/169024923116.19090.10825599068950039132-0(a)git.sr.ht/ Hyman Huang (4): Add VIR_MIGRATE_DIRTY_LIMIT flag qemu_migration: Implement VIR_MIGRATE_DIRTY_LIMIT flag virsh: Add support for VIR_MIGRATE_DIRTY_LIMIT flag NEWS: document support for dirty-limit live migration NEWS.rst | 8 ++++++++ docs/manpages/virsh.rst | 10 +++++++++- include/libvirt/libvirt-domain.h | 5 +++++ src/libvirt-domain.c | 8 ++++++++ src/qemu/qemu_migration.c | 8 ++++++++ src/qemu/qemu_migration.h | 1 + src/qemu/qemu_migration_params.c | 6 ++++++ src/qemu/qemu_migration_params.h | 1 + tools/virsh-domain.c | 10 ++++++++++ 9 files changed, 56 insertions(+), 1 deletion(-) -- 2.39.1

1 4