December 2024 - Devel - libvirt List Archives

[PATCH 1/1] virt-aa-helper: allow riscv64 EDK II
by Heinrich Schuchardt 09 Dec '24

09 Dec '24

Debian has packaged EDK II for 64-bit RISC-V in directory /usr/share/qemu-efi-riscv64/. For usage with libvirt update the AppArmor helper. Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt(a)canonical.com> --- src/security/virt-aa-helper.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index e82b5de2b4..1cf9d7ad3d 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -481,6 +481,7 @@ valid_path(const char *path, const bool readonly) "/usr/share/AAVMF/", "/usr/share/qemu-efi/", /* for AAVMF images */ "/usr/share/qemu-efi-aarch64/", + "/usr/share/qemu-efi-riscv64/", "/usr/share/qemu/", /* SUSE path for OVMF and AAVMF images */ "/usr/lib/u-boot/", "/usr/lib/riscv64-linux-gnu/opensbi", -- 2.45.2

1 0

[PATCH 0/5] cpu_map: Add missing -v1 models
by Jiri Denemark 05 Dec '24

05 Dec '24

CPU models that do not have a list of versions attached are still advertised as aliases to corresponding -v1 variants. We should add the missing variants to the CPU map. Available on gitlab: git fetch https://gitlab.com/jirkade/libvirt.git cpu-versions Pipeline: https://gitlab.com/jirkade/libvirt/-/pipelines/1564399375 Jiri Denemark (5): cpu_map: Sort data files in meson.build sync_qemu_models_i386: Update meson.build sync_qemu_models_i386: Ignore old models sync_qemu_models_i386: Generate missing -v1 variants cpu_map: Add missing -v1 models src/cpu_map/index.xml | 2 + src/cpu_map/meson.build | 18 +++--- src/cpu_map/sync_qemu_models_i386.py | 58 +++++++++++++++++++ src/cpu_map/x86_EPYC-Genoa-v1.xml | 6 ++ src/cpu_map/x86_KnightsMill-v1.xml | 6 ++ .../domaincapsdata/qemu_5.2.0-q35.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_5.2.0-tcg.x86_64.xml | 20 ++++++- tests/domaincapsdata/qemu_5.2.0.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_6.0.0-q35.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_6.0.0-tcg.x86_64.xml | 20 ++++++- tests/domaincapsdata/qemu_6.0.0.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_6.1.0-q35.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_6.1.0-tcg.x86_64.xml | 20 ++++++- tests/domaincapsdata/qemu_6.1.0.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 20 ++++++- tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 20 ++++++- tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 20 ++++++- tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 14 ++++- .../qemu_7.2.0-tcg.x86_64+hvf.xml | 16 ++++- .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 16 ++++- tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 16 ++++- tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 46 ++++++++++++++- .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 56 +++++++++++++++++- tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 46 ++++++++++++++- .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 46 ++++++++++++++- .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 55 +++++++++++++++++- tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 46 ++++++++++++++- .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 46 ++++++++++++++- .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 54 ++++++++++++++++- tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 46 ++++++++++++++- .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 46 ++++++++++++++- .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 54 ++++++++++++++++- tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 46 ++++++++++++++- .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 46 ++++++++++++++- .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 54 ++++++++++++++++- tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 46 ++++++++++++++- 45 files changed, 1152 insertions(+), 63 deletions(-) create mode 100644 src/cpu_map/x86_EPYC-Genoa-v1.xml create mode 100644 src/cpu_map/x86_KnightsMill-v1.xml -- 2.47.0

3 10

[libvirt PATCH] lxc: remove no longer working netns check
by Leigh Brown 05 Dec '24

05 Dec '24

Since iproute2 v6.12.0, the command "ip link set lo netns -1" can no longer be used to check for netns support, as it now validates PIDs are not less than zero. Since every kernel we care about has the support, just remove the check. Signed-off-by: Leigh Brown <leigh(a)solinno.co.uk> --- src/lxc/lxc_conf.h | 1 - src/lxc/lxc_driver.c | 36 ------------------------------------ 2 files changed, 37 deletions(-) diff --git a/src/lxc/lxc_conf.h b/src/lxc/lxc_conf.h index c0967ac63b..a639e3989f 100644 --- a/src/lxc/lxc_conf.h +++ b/src/lxc/lxc_conf.h @@ -49,7 +49,6 @@ struct _virLXCDriverConfig { char *stateDir; char *logDir; bool log_libvirtd; - int have_netns; char *securityDriverName; bool securityDefaultConfined; diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index d682e7168a..2488940feb 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -422,12 +422,6 @@ lxcDomainDefineXMLFlags(virConnectPtr conn, const char *xml, unsigned int flags) if (virSecurityManagerVerify(driver->securityManager, def) < 0) goto cleanup; - if ((def->nets != NULL) && !(cfg->have_netns)) { - virReportError(VIR_ERR_OPERATION_INVALID, - "%s", _("System lacks NETNS support")); - goto cleanup; - } - if (!(vm = virDomainObjListAdd(driver->domains, &def, driver->xmlopt, 0, &oldDef))) @@ -974,12 +968,6 @@ static int lxcDomainCreateWithFiles(virDomainPtr dom, if (virDomainCreateWithFilesEnsureACL(dom->conn, vm->def) < 0) goto cleanup; - if ((vm->def->nets != NULL) && !(cfg->have_netns)) { - virReportError(VIR_ERR_OPERATION_INVALID, - "%s", _("System lacks NETNS support")); - goto cleanup; - } - if (virDomainObjBeginJob(vm, VIR_JOB_MODIFY) < 0) goto cleanup; @@ -1088,13 +1076,6 @@ lxcDomainCreateXMLWithFiles(virConnectPtr conn, if (virSecurityManagerVerify(driver->securityManager, def) < 0) goto cleanup; - if ((def->nets != NULL) && !(cfg->have_netns)) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, - "%s", _("System lacks NETNS support")); - goto cleanup; - } - - if (!(vm = virDomainObjListAdd(driver->domains, &def, driver->xmlopt, VIR_DOMAIN_OBJ_LIST_ADD_LIVE | @@ -1386,22 +1367,6 @@ lxcDomainDestroy(virDomainPtr dom) return lxcDomainDestroyFlags(dom, 0); } -static int lxcCheckNetNsSupport(void) -{ - g_autoptr(virCommand) cmd = virCommandNewArgList("ip", "link", "set", "lo", - "netns", "-1", NULL); - int ip_rc; - - if (virCommandRun(cmd, &ip_rc) < 0 || ip_rc == 255) - return 0; - - if (virProcessNamespaceAvailable(VIR_PROCESS_NAMESPACE_NET) < 0) - return 0; - - return 1; -} - - static virSecurityManager * lxcSecurityInit(virLXCDriverConfig *cfg) { @@ -1481,7 +1446,6 @@ lxcStateInitialize(bool privileged, goto cleanup; cfg->log_libvirtd = false; /* by default log to container logfile */ - cfg->have_netns = lxcCheckNetNsSupport(); /* Call function to load lxc driver configuration information */ if (virLXCLoadDriverConfig(cfg, SYSCONFDIR "/libvirt/lxc.conf") < 0) -- 2.39.5

2 1

[PATCH] rpm: replace 'git' with 'git-core'
by Daniel P. Berrangé 04 Dec '24

04 Dec '24

We don't need the full git package, git-core is sufficient and a smaller build root install. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 901ed9c464..9c1d0a423d 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -331,7 +331,7 @@ Requires: libvirt-libs = %{version}-%{release} BuildRequires: python3-docutils BuildRequires: meson >= 0.56.0 BuildRequires: ninja-build -BuildRequires: git +BuildRequires: git-core BuildRequires: perl-interpreter BuildRequires: python3 BuildRequires: python3-pytest -- 2.46.0

2 1

[PATCH] util: Fix typo in virNetDevOpenvswitchInterfaceSetQos
by Jiri Denemark 04 Dec '24

04 Dec '24

The typo is causing virtqemud to crash when starting a domain with ovs bridge interface and QOS. https://issues.redhat.com/browse/RHEL-69840 Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/util/virnetdevopenvswitch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/virnetdevopenvswitch.c b/src/util/virnetdevopenvswitch.c index a1bd9f3d5b..0f5d23b794 100644 --- a/src/util/virnetdevopenvswitch.c +++ b/src/util/virnetdevopenvswitch.c @@ -958,7 +958,7 @@ virNetDevOpenvswitchInterfaceSetQos(const char *ifname, } if (rx) { - if (rx->peak && tx->peak != rx->average) { + if (rx->peak && rx->peak != rx->average) { VIR_WARN("Setting different 'peak' value than 'average' for QoS for OVS interface %s might have unexpected results", ifname); } -- 2.47.0

2 1

[RFC PATCH 0/3] iproute2 bridge vlan support
by Leigh Brown 04 Dec '24

04 Dec '24

The iproute2 bridge command supports the capability for VLAN filtering that allows each interface connected to a bridge to be configured to use one or more VLANs. For simple setups, this capability is enough to allow virtual machines or containers to be put onto separate VLANs without creating multiple bridges and VLANs on the host. The first patch adds a new function virNetDevBridgeSetupVlans() that will, given a virNetDevVlan structure, execute the required bridge vlan commands to configure the given interface accordingly. The second patch updates the virNetDevBridgeAddPort() function to allow a virNetDevVlan parameter to be passed, and to call the virNetDevBridgeSetupVlans() function. The third patch updates the lxc and tap code to pass the virNetDevLan parameter from the configuration and to update the XML validation to permit the VLAN-related tags for standard bridges. Usage example ============= Configure the host with systemd-networkd as follows: /etc/systemd/network/br0.netdev (br0.network not shown) [NetDev] Name=br0 Kind=bridge MACAddress=xx:xx:xx:xx:xx:xx [Bridge] VLANFiltering=on /etc/systemd/network/eno1.network [Match] Name=eno1 [Network] Bridge=br0 [Link] MTUBytes=9000 [BridgeVLAN] VLAN=40 [BridgeVLAN] VLAN=60 Then add <vlan> tags into the lxc or qemu config: lxc interface definition: <interface type='bridge'> <mac address='xx:xx:xx:xx:xx:xx'/> <source bridge='br0'/> <vlan> <tag id='40'/> </vlan> </interface> qemu interface definition: <interface type='network'> <mac address='xx:xx:xx:xx:xx:xx'/> <source network='br0'/> <vlan> <tag id='60'/> </vlan> <model type='virtio'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </interface> Then, after starting them, you will see the following $ sudo bridge vlan port vlan-id eno1 1 PVID Egress Untagged 40 60 br0 1 PVID Egress Untagged vnet0 60 PVID Egress Untagged vnet1 40 PVID Egress Untagged This is an RFC because I am not very familiar with the code, but all feedback is welcome! Regards, Leigh. Leigh Brown (3): util: bridge: add virNetDevBridgeSetupVlans() util: bridge: virNetDevBridgeAddPort vlan support util: bridge: enable bridge vlan support meson.build | 1 + src/conf/domain_validate.c | 3 +- src/lxc/lxc_process.c | 3 +- src/util/virnetdevbridge.c | 65 +++++++++++++++++++++++++++++++++++--- src/util/virnetdevbridge.h | 4 ++- src/util/virnetdevtap.c | 2 +- 6 files changed, 70 insertions(+), 8 deletions(-) -- 2.39.5

1 3

[PATCH v3 0/5] ch: handle events from cloud-hypervisor
by Purna Pavan Chandra Aekkaladevi 03 Dec '24

03 Dec '24

changes from v2->v3: * Remove patch 'utils: Implement virFileIsNamedPipe' as it is no more needed. * Remove the eventmonitorpath only if it exists * Added domain name as a prefix to logs from ch_events.c. This will make debugging easier. * Simplified event parsing logic by reserving a byte for null char. changes from v1->v2: * Rebase on latest master * Use /* */ for comments * Remove fifo file if already exists * Address other comments from Praveen Paladugu cloud-hypervisor raises various events, including VM lifecylce operations such as boot, shutdown, pause, resume, etc. Libvirt will now read these events and take the necessary actions, such as correctly updating the domain state. A FIFO file is passed to `--event-monitor` option of cloud-hypervisor. Libvirt creates a new thread that acts as the reader of the fifo file and continuously monitors for new events. Currently, shutdown events are handled by updating the domain state appropriately. Purna Pavan Chandra Aekkaladevi (5): ch: pass --event-monitor option to cloud-hypervisor ch: start a new thread for handling ch events ch: events: Read and parse cloud-hypervisor events ch: events: facilitate lifecycle events handling NEWS: Mention event handling support in ch driver NEWS.rst | 7 + po/POTFILES | 1 + src/ch/ch_events.c | 329 ++++++++++++++++++++++++++++++++++++++++++++ src/ch/ch_events.h | 54 ++++++++ src/ch/ch_monitor.c | 52 ++++++- src/ch/ch_monitor.h | 11 ++ src/ch/meson.build | 2 + 7 files changed, 449 insertions(+), 7 deletions(-) create mode 100644 src/ch/ch_events.c create mode 100644 src/ch/ch_events.h -- 2.34.1

3 14

[libvirt PATCH] qemu: tpm: do not update profile name for transient domains
by Ján Tomko 03 Dec '24

03 Dec '24

If we do not have a persistent definition, there's no point in looking for it since we cannot store it. This fixes the crash when starting a transient domain. https://issues.redhat.com/browse/RHEL-69774 Fixes: d79542eec669eb9c449bb8228179e7a87e768017 Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/qemu/qemu_extdevice.c | 5 ++++- src/qemu/qemu_tpm.c | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_extdevice.c b/src/qemu/qemu_extdevice.c index a6f31f9773..d4b6e11e0b 100644 --- a/src/qemu/qemu_extdevice.c +++ b/src/qemu/qemu_extdevice.c @@ -190,7 +190,10 @@ qemuExtDevicesStart(virQEMUDriver *driver, for (i = 0; i < def->ntpms; i++) { virDomainTPMDef *tpm = def->tpms[i]; - virDomainTPMDef *persistentTPMDef = persistentDef->tpms[i]; + virDomainTPMDef *persistentTPMDef = NULL; + + if (persistentDef) + persistentTPMDef = persistentDef->tpms[i]; if (tpm->type == VIR_DOMAIN_TPM_TYPE_EMULATOR && qemuExtTPMStart(driver, vm, tpm, persistentTPMDef, diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index f223dcb9ae..f5e0184e54 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -773,7 +773,7 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm, incomingMigration) < 0) goto error; - if (run_setup && !incomingMigration && + if (run_setup && !incomingMigration && persistentTPMDef && qemuTPMEmulatorUpdateProfileName(&tpm->data.emulator, persistentTPMDef, cfg, saveDef) < 0) goto error; -- 2.47.0

3 2

Release of libvirt-10.10.0
by Jiri Denemark 02 Dec '24

02 Dec '24

The 10.10.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * New features * qemu: add multi boot device support on s390x For classical mainframe guests (i.e. LPAR or z/VM installations), you always have to explicitly specify the disk where you want to boot from (or "IPL" from, in s390x-speak -- IPL means "Initial Program Load"). In the past QEMU only used the first device in the boot order to IPL from. With the new multi boot device support on s390x that is available with QEMU version 9.2 and newer, this limitation is lifted. If the IPL fails for the first device with the lowest boot index, the device with the second lowest boot index will be tried and so on until IPL is successful or there are no remaining boot devices to try. Limitation: The s390x BIOS will try to IPL up to 8 total devices, any number of which may be disks or network devices. * qemu: Add support for versioned CPU models Updates to QEMU CPU models with -vN suffix can now be used in libvirt just like any other CPU model. * qemu: Support for the 'data-file' QCOW2 image feature The QEMU hypervisor driver now supports QCOW2 images with 'data-file' feature present (both when probing form the image itself and when specified explicitly via ``<dataStore>`` element). This can be useful when it's required to keep data "raw" on disk, but the use case requires features of the QCOW2 format such as incremental backups. * swtpm: Add support for profiles Upcoming swtpm release will have TPM profile support that allows to restrict a TPM's provided set of crypto algorithms and commands. Users can now select profile by using ``<profile/>`` in their TPM XML definition. * Improvements * qemu: Support UEFI NVRAM images on block storage Libvirt now allows users to use block storage as backend for UEFI NVRAM images and allows them to be in format different than the template. When qcow2 is used as the format, the images are now also auto-populated from the template. * qemu: Automatically add IOMMU when needed When domain of 'qemu' or 'kvm' type has more than 255 vCPUs IOMMU with EIM mode is required. Starting with this release libvirt automatically adds one (or turns on the EIM mode if there's IOMMU without it). * ch: allow hostdevs in domain definition The Cloud Hypervisor driver (ch) now supports ``<hostdev/>``-s. * ch: Enable callbacks for ch domain events The Cloud Hypervisor driver (ch) now supports emitting events on domain define, undefine, start, boot, stop and destroy. * Bug fixes * qemu: Fix reversion and inactive deletion of internal snapshots with UEFI NVRAM In `v10.9.0 (2024-11-01)`_ creation of internal snapshots of VMs with UEFI firmware was allowed, but certain operations such as reversion or inactive deletion didn't work properly as they didn't consider the NVRAM qcow2 file. * virnetdevopenvswitch: Warn on unsupported QoS settings For OpenVSwitch vNICs libivrt does not set QoS directly using 'tc' but offloads setting to OVS. But OVS is not as feature full as libvirt in this regard and setting different 'peak' than 'average' results in vNIC always sticking with 'peak'. Produce a warning if that's the case. Enjoy. Jirka

1 0