January 2019 - Devel - libvirt List Archives

[libvirt] [PATCH 0/3] Some random fixes
by Michal Privoznik 24 Jan '19

24 Jan '19

*** BLURB HERE *** Michal Prívozník (3): virPCIGetNetName: Initialize @netname to NULL virpci: Fix memleak in virPCIDeviceIterDevices domain_conf: Free egl render node in virDomainGraphicsDefFree src/conf/domain_conf.c | 3 +++ src/util/virnetdev.c | 2 -- src/util/virpci.c | 4 ++++ 3 files changed, 7 insertions(+), 2 deletions(-) -- 2.19.2

2 8

[libvirt] [PATCH] qemu-nbd: Deprecate qemu-nbd --partition
by Eric Blake 24 Jan '19

24 Jan '19

The existing qemu-nbd --partition code claims to handle logical partitions up to 8, since its introduction in 2008 (commit 7a5ca86). However, the implementation is bogus (actual MBR logical partitions form a sort of linked list, with one partition per extended table entry, rather than four logical partitions in a single extended table), making the code unlikely to work for anything beyond -P5 on actual guest images. What's more, the code does not support GPT partitions, which are becoming more popular, and maintaining device subsetting in both NBD and the raw device is unnecessary maintenance burden. And nbdkit has just added code to properly handle an arbitrary number of MBR partitions, along with its existing code for handling GPT partitions. Note that obtaining the offsets of a partition can be learned by using 'qemu-nbd -c /dev/nbd0 file.qcow2 && sfdisk --dump /dev/nbd0', but by the time you've done that, you might as well just mount /dev/nbd0p1 that the kernel creates for you. Start the clock on the deprecation cycle, with an example of how to write device subsetting without using -P. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- qemu-deprecated.texi | 27 +++++++++++++++++++++++++++ qemu-nbd.texi | 6 ++++-- qemu-nbd.c | 2 ++ 3 files changed, 33 insertions(+), 2 deletions(-) diff --git a/qemu-deprecated.texi b/qemu-deprecated.texi index 219206a836f..12f8b30943f 100644 --- a/qemu-deprecated.texi +++ b/qemu-deprecated.texi @@ -175,3 +175,30 @@ The above, converted to the current supported format: @subsubsection "irq": "" (since 3.0.0) The ``irq'' property is obsoleted. + +@section Related binaries + +@subsection qemu-nbd --partition (since 4.0.0) + +The ``qemu-nbd --partition $digit'' code (also spelled @option{-P}) +can only handle MBR partitions, and does not correctly handle logical +partitions beyond partition 5. If you know the relative position of +the partition (perhaps by using @code{sfdisk} or similar, either in +the guest or when mapping the entire device through /dev/nbd0 in the +host), you can achieve the effect of exporting just that subset of the +disk by use of the @option{--image-opts} option with a raw blockdev +using the @code{offset} and @code{size} parameters layered on top of +any other existing blockdev. + +For example, if partition 1 is 100MiB starting at 1MiB, the old command + +@example{qemu-nbd -P 1 -f qcow2 file.qcow2} + +can be rewritten as: + +@example{qemu-nbd --image-opts driver=raw,offset=1M,size=100M,file.driver=qcow2,file.backing.driver=file,file.backing.filename=file.qcow2} + +Alternatively, the @code{nbdkit} project provides a more powerful +partition filter on top of its nbd plugin, which can be used to select +an arbitrary MBR or GPT partition on top of any other full-image NBD +export. diff --git a/qemu-nbd.texi b/qemu-nbd.texi index 386bece4680..d0c51828149 100644 --- a/qemu-nbd.texi +++ b/qemu-nbd.texi @@ -56,8 +56,10 @@ auto-detecting. @item -r, --read-only Export the disk as read-only. @item -P, --partition=@var{num} -Only expose MBR partition @var{num}. Understands physical partitions -1-4 and logical partitions 5-8. +Deprecated: Only expose MBR partition @var{num}. Understands physical +partitions 1-4 and logical partition 5. New code should instead use +@option{--image-opts} with the raw driver wrapping a subset of the +original image. @item -B, --bitmap=@var{name} If @var{filename} has a qcow2 persistent bitmap @var{name}, expose that bitmap via the ``qemu:dirty-bitmap:@var{name}'' context diff --git a/qemu-nbd.c b/qemu-nbd.c index 1f7b2a03f5d..00c07fd27ea 100644 --- a/qemu-nbd.c +++ b/qemu-nbd.c @@ -787,6 +787,8 @@ int main(int argc, char **argv) flags &= ~BDRV_O_RDWR; break; case 'P': + warn_report("The '-P' option is deprecated; use --image-opts with " + "a raw device wrapper for subset exports instead"); if (qemu_strtoi(optarg, NULL, 0, &partition) < 0 || partition < 1 || partition > 8) { error_report("Invalid partition '%s'", optarg); -- 2.20.1

3 4

[libvirt] [PATCH] qemu: improve compile-time check of qemuBlockjobState mapping
by Eric Blake 23 Jan '19

23 Jan '19

Asserting the value we set four lines earlier in qemuBlockjobState doesn't buy us any safety (if the public header adds a value, we end up skipping that value without the compiler warning us of our gap); what we really want is to assert that the value auto-assigned by the compiler matches the actual last value in the public headers (as was done below for qemuBlockJobType). Add useful comments while at it. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- The spelling VIR_DOMAIN_BLOCK_JOB_LAST vs. VIR_DOMAIN_BLOCK_JOB_TYPE_LAST took me on a wild goose chase; the least I can do is make the code nicer for the next reader. src/qemu/qemu_blockjob.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_blockjob.h b/src/qemu/qemu_blockjob.h index ed63f2c709..c7325c6daf 100644 --- a/src/qemu/qemu_blockjob.h +++ b/src/qemu/qemu_blockjob.h @@ -29,15 +29,17 @@ * This enum has to map all known block job states from enum virDomainBlockJobType * to the same values. All internal blockjobs can be mapped after and don't * need to have stable values. */ typedef enum { + /* Mapped to public enum */ QEMU_BLOCKJOB_STATE_COMPLETED = VIR_DOMAIN_BLOCK_JOB_COMPLETED, QEMU_BLOCKJOB_STATE_FAILED = VIR_DOMAIN_BLOCK_JOB_FAILED, QEMU_BLOCKJOB_STATE_CANCELLED = VIR_DOMAIN_BLOCK_JOB_CANCELED, QEMU_BLOCKJOB_STATE_READY = VIR_DOMAIN_BLOCK_JOB_READY, - QEMU_BLOCKJOB_STATE_NEW = VIR_DOMAIN_BLOCK_JOB_LAST, + /* Additional enum values local to qemu */ + QEMU_BLOCKJOB_STATE_NEW, QEMU_BLOCKJOB_STATE_RUNNING, QEMU_BLOCKJOB_STATE_LAST } qemuBlockjobState; verify((int)QEMU_BLOCKJOB_STATE_NEW == VIR_DOMAIN_BLOCK_JOB_LAST); @@ -45,15 +47,17 @@ verify((int)QEMU_BLOCKJOB_STATE_NEW == VIR_DOMAIN_BLOCK_JOB_LAST); * This enum has to map all known block job types from enum virDomainBlockJobType * to the same values. All internal blockjobs can be mapped after and don't * need to have stable values. */ typedef enum { + /* Mapped to public enum */ QEMU_BLOCKJOB_TYPE_NONE = VIR_DOMAIN_BLOCK_JOB_TYPE_UNKNOWN, QEMU_BLOCKJOB_TYPE_PULL = VIR_DOMAIN_BLOCK_JOB_TYPE_PULL, QEMU_BLOCKJOB_TYPE_COPY = VIR_DOMAIN_BLOCK_JOB_TYPE_COPY, QEMU_BLOCKJOB_TYPE_COMMIT = VIR_DOMAIN_BLOCK_JOB_TYPE_COMMIT, QEMU_BLOCKJOB_TYPE_ACTIVE_COMMIT = VIR_DOMAIN_BLOCK_JOB_TYPE_ACTIVE_COMMIT, + /* Additional enum values local to qemu */ QEMU_BLOCKJOB_TYPE_INTERNAL, QEMU_BLOCKJOB_TYPE_LAST } qemuBlockJobType; verify((int)QEMU_BLOCKJOB_TYPE_INTERNAL == VIR_DOMAIN_BLOCK_JOB_TYPE_LAST); -- 2.20.1

2 1

[libvirt] [PATCH v3 0/4] util: Fixing libvirt errors on cavium/thunder-nicvf
by dann frazier 23 Jan '19

23 Jan '19

Following up on my offer to take the baton[*], here's a v3 of this series that should address the provided feedback provided for Radoslaw's v2. ThunderX is Cavium SoC. This platform contain SRIOV NIC. Unlike other commonly known network devices it does not have VF functionality duplicated in its PF. PF is purely management device (on HW level). This creates several problems with existing libvirt code as in many places libvirt assumes that each VF netdev has PF netdev assigned. This patch series trying to address issues which can be easily fixed. (mostly bug fixes found while working on full featured solution) First patch in series is most important as it allows to unblock the netdev detection and use <hostdev> on this platform.i <interface type="hostdev" still does not work as it requires bigger changes both on netdev driver and in libvirt itself. More details about those issues can be found at: https://bugs.linaro.org/show_bug.cgi?id=3778 https://bugs.launchpad.net/charm-nova-compute/+bug/1771662 v3: - Reinstated error path in virNetDevGetPhysicalFunction() - Add missing free of *pfname in error path - Use proper < 0 comparisons when checking for errors v2: - error reporting taken out of virNetDevGetPhysicalFunction() and moved to calling function virNetDevGetVirtualFunctionInfo() - curly braces removed from single line - net-> model check removed as STREQ_NULLABLE() follows [*] https://www.redhat.com/archives/libvir-list/2019-January/msg00201.html Radoslaw Biernacki (4): util: fixing wrong assumption that PF has to have netdev assigned util: Code simplification util: Fix for NULL dereference util: Fixing invalid error checking from virPCIGetNetname() src/qemu/qemu_domain_address.c | 13 ++++---- src/util/virhostdev.c | 2 +- src/util/virnetdev.c | 55 ++++++++++++---------------------- 3 files changed, 25 insertions(+), 45 deletions(-) -- 2.20.1

3 9

[libvirt] [PATCH 0/2] apparmor: support named profiles
by Jim Fehlig 23 Jan '19

23 Jan '19

Upstream apparmor is switching to named profiles. Many profiles have already made the switch. Patch 1 changes the libvirtd profile to account for dnsmasq's switch to a named profile. Patch 2 is optional and changes the libvirtd profile to a named profile. It will need a bit of coorindation with upstream apparmor since the dnsmasq profile currently has 'peer=/usr/sbin/libvirtd'. Jim Fehlig (2): apparmor: Add support for named profiles apparmor: convert libvirtd profile to a named profile src/security/apparmor/usr.sbin.libvirtd | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) -- 2.19.2

2 5

[libvirt] [PATCH 0/3] Update some recent/previous x86_64 qemu capabilities
by John Ferlan 23 Jan '19

23 Jan '19

The existing 2.12 and 3.1 caps are based on a pre-release RC, so update to at least the release version. The 3.0 caps were missing the sev-guest (as were the 3.1 caps), so hand massage the .replies output to make sure they're added. There really "should be" some way to do these automagically... With these in place review of Nikolay's upstream posting related to using l2 cache will be "cleaner"... John Ferlan (3): qemu: Update x86_64 QEMU 2.12.0 capabilities qemu: Update x86_64 QEMU 3.0.0 capabilities qemu: Update x86_64 QEMU 3.1.0 capabilities .../qemu_2.12.0.x86_64.xml | 37 +- .../caps_2.12.0.x86_64.replies | 513 +++++++++--------- .../caps_2.12.0.x86_64.xml | 182 ++----- .../caps_3.0.0.x86_64.replies | 73 +-- .../caps_3.0.0.x86_64.xml | 19 +- .../caps_3.1.0.x86_64.replies | 93 ++-- .../caps_3.1.0.x86_64.xml | 28 +- 7 files changed, 412 insertions(+), 533 deletions(-) -- 2.20.1

4 8

[libvirt] [PATCH] libxl: Set current memory value after successful balloon
by Jim Fehlig 23 Jan '19

23 Jan '19

The libxl driver does not set the new memory value in the active domain def after a successful balloon. This results in the old memory value in <currentMemory>. E.g. virsh dumpxml test | grep currentMemory <currentMemory unit='KiB'>20971520</currentMemory> virsh setmem test 16777216 --live virsh dumpxml test | grep currentMemory <currentMemory unit='KiB'>20971520</currentMemory> Set the new memory value in active domain def after a successful call to libxl_set_memory_target(). Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- src/libxl/libxl_driver.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index e30c9891d2..f11597b0d7 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -1676,6 +1676,7 @@ libxlDomainSetMemoryFlags(virDomainPtr dom, unsigned long newmem, " with libxenlight"), vm->def->id); goto endjob; } + vm->def->mem.cur_balloon = newmem; } if (flags & VIR_DOMAIN_MEM_CONFIG) { -- 2.19.2

2 1

[libvirt] [PATCH] qemu-options: Remove deprecated "-virtioconsole" option
by Thomas Huth 23 Jan '19

23 Jan '19

It's been deprecated since QEMU 3.0, and nobody complained so far, so it is time to remove this option now. Signed-off-by: Thomas Huth <thuth(a)redhat.com> --- docs/qdev-device-use.txt | 4 ---- include/hw/boards.h | 1 - qemu-deprecated.texi | 5 ---- qemu-options.hx | 10 -------- vl.c | 61 +----------------------------------------------- 5 files changed, 1 insertion(+), 80 deletions(-) diff --git a/docs/qdev-device-use.txt b/docs/qdev-device-use.txt index 98229b3..cc53e97 100644 --- a/docs/qdev-device-use.txt +++ b/docs/qdev-device-use.txt @@ -190,10 +190,6 @@ The appropriate DEVNAME depends on the machine type. For type "pc": -device usb-braille,chardev=braille -chardev braille,id=braille -* -virtioconsole becomes - -device virtio-serial-pci,class=C,vectors=V,ioeventfd=IOEVENTFD,max_ports=N - -device virtconsole,is_console=NUM,nr=NR,name=NAME - LEGACY-CHARDEV translates to -chardev HOST-OPTS... as follows: * null becomes -chardev null diff --git a/include/hw/boards.h b/include/hw/boards.h index f82f284..5df67d2 100644 --- a/include/hw/boards.h +++ b/include/hw/boards.h @@ -181,7 +181,6 @@ struct MachineClass { int default_cpus; unsigned int no_serial:1, no_parallel:1, - use_virtcon:1, no_floppy:1, no_cdrom:1, no_sdcard:1, diff --git a/qemu-deprecated.texi b/qemu-deprecated.texi index 72b8191..5cc18b4 100644 --- a/qemu-deprecated.texi +++ b/qemu-deprecated.texi @@ -60,11 +60,6 @@ The @code{--no-frame} argument works with SDL 1.2 only. The other user interfaces never implemented this in the first place. So this will be removed together with SDL 1.2 support. -@subsection -virtioconsole (since 3.0.0) - -Option @option{-virtioconsole} has been replaced by -@option{-device virtconsole}. - @subsection -clock (since 3.0.0) The @code{-clock} option is ignored since QEMU version 1.7.0. There is no diff --git a/qemu-options.hx b/qemu-options.hx index 269eda7..5330603 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -3635,16 +3635,6 @@ character to Control-t. @end table ETEXI -DEF("virtioconsole", HAS_ARG, QEMU_OPTION_virtiocon, \ - "-virtioconsole c\n" \ - " set virtio console\n", QEMU_ARCH_ALL) -STEXI -@item -virtioconsole @var{c} -@findex -virtioconsole -Set virtio console. -This option is deprecated, please use @option{-device virtconsole} instead. -ETEXI - DEF("show-cursor", 0, QEMU_OPTION_show_cursor, \ "-show-cursor show cursor\n", QEMU_ARCH_ALL) STEXI diff --git a/vl.c b/vl.c index a5ae5f2..595d610 100644 --- a/vl.c +++ b/vl.c @@ -164,7 +164,6 @@ int no_frame; static int num_serial_hds; static Chardev **serial_hds; Chardev *parallel_hds[MAX_PARALLEL_PORTS]; -Chardev *virtcon_hds[MAX_VIRTIO_CONSOLES]; int win2k_install_hack = 0; int singlestep = 0; int smp_cpus; @@ -215,7 +214,6 @@ bool xen_domid_restrict; static int has_defaults = 1; static int default_serial = 1; static int default_parallel = 1; -static int default_virtcon = 1; static int default_monitor = 1; static int default_floppy = 1; static int default_cdrom = 1; @@ -236,8 +234,6 @@ static struct { { .driver = "ide-drive", .flag = &default_cdrom }, { .driver = "scsi-cd", .flag = &default_cdrom }, { .driver = "scsi-hd", .flag = &default_cdrom }, - { .driver = "virtio-serial-pci", .flag = &default_virtcon }, - { .driver = "virtio-serial", .flag = &default_virtcon }, { .driver = "VGA", .flag = &default_vga }, { .driver = "isa-vga", .flag = &default_vga }, { .driver = "cirrus-vga", .flag = &default_vga }, @@ -2374,7 +2370,6 @@ struct device_config { DEV_BT, /* -bt */ DEV_SERIAL, /* -serial */ DEV_PARALLEL, /* -parallel */ - DEV_VIRTCON, /* -virtioconsole */ DEV_DEBUGCON, /* -debugcon */ DEV_GDB, /* -gdb, -s */ DEV_SCLP, /* s390 sclp */ @@ -2472,39 +2467,6 @@ static int parallel_parse(const char *devname) return 0; } -static int virtcon_parse(const char *devname) -{ - QemuOptsList *device = qemu_find_opts("device"); - static int index = 0; - char label[32]; - QemuOpts *bus_opts, *dev_opts; - - if (strcmp(devname, "none") == 0) - return 0; - if (index == MAX_VIRTIO_CONSOLES) { - error_report("too many virtio consoles"); - exit(1); - } - - bus_opts = qemu_opts_create(device, NULL, 0, &error_abort); - qemu_opt_set(bus_opts, "driver", "virtio-serial", &error_abort); - - dev_opts = qemu_opts_create(device, NULL, 0, &error_abort); - qemu_opt_set(dev_opts, "driver", "virtconsole", &error_abort); - - snprintf(label, sizeof(label), "virtcon%d", index); - virtcon_hds[index] = qemu_chr_new_mux_mon(label, devname); - if (!virtcon_hds[index]) { - error_report("could not connect virtio console" - " to character backend '%s'", devname); - return -1; - } - qemu_opt_set(dev_opts, "chardev", label, &error_abort); - - index++; - return 0; -} - static int debugcon_parse(const char *devname) { QemuOpts *opts; @@ -3546,15 +3508,6 @@ int main(int argc, char **argv, char **envp) exit(1); } break; - case QEMU_OPTION_virtiocon: - warn_report("This option is deprecated, " - "use '-device virtconsole' instead"); - add_device_config(DEV_VIRTCON, optarg); - default_virtcon = 0; - if (strncmp(optarg, "mon:", 4) == 0) { - default_monitor = 0; - } - break; case QEMU_OPTION_parallel: add_device_config(DEV_PARALLEL, optarg); default_parallel = 0; @@ -4171,9 +4124,6 @@ int main(int argc, char **argv, char **envp) if (!has_defaults || machine_class->no_parallel) { default_parallel = 0; } - if (!has_defaults || !machine_class->use_virtcon) { - default_virtcon = 0; - } if (!has_defaults || machine_class->no_floppy) { default_floppy = 0; } @@ -4206,8 +4156,7 @@ int main(int argc, char **argv, char **envp) * usage, -nographic is just a no-op in this case. */ if (nographic - && (default_parallel || default_serial - || default_monitor || default_virtcon)) { + && (default_parallel || default_serial || default_monitor)) { error_report("-nographic cannot be used with -daemonize"); exit(1); } @@ -4224,13 +4173,9 @@ int main(int argc, char **argv, char **envp) add_device_config(DEV_PARALLEL, "null"); if (default_serial && default_monitor) { add_device_config(DEV_SERIAL, "mon:stdio"); - } else if (default_virtcon && default_monitor) { - add_device_config(DEV_VIRTCON, "mon:stdio"); } else { if (default_serial) add_device_config(DEV_SERIAL, "stdio"); - if (default_virtcon) - add_device_config(DEV_VIRTCON, "stdio"); if (default_monitor) monitor_parse("stdio", "readline", false); } @@ -4241,8 +4186,6 @@ int main(int argc, char **argv, char **envp) add_device_config(DEV_PARALLEL, "vc:80Cx24C"); if (default_monitor) monitor_parse("vc:80Cx24C", "readline", false); - if (default_virtcon) - add_device_config(DEV_VIRTCON, "vc:80Cx24C"); } #if defined(CONFIG_VNC) @@ -4473,8 +4416,6 @@ int main(int argc, char **argv, char **envp) exit(1); if (foreach_device_config(DEV_PARALLEL, parallel_parse) < 0) exit(1); - if (foreach_device_config(DEV_VIRTCON, virtcon_parse) < 0) - exit(1); if (foreach_device_config(DEV_DEBUGCON, debugcon_parse) < 0) exit(1); -- 1.8.3.1

2 3

[libvirt] [PATCH v3 0/5] add disk driver metadata_cache_size option
by Nikolay Shirokovskiy 23 Jan '19

23 Jan '19

As this patch series only works with -blockdev configurations it is better to be pushed only after -blockdev is supported. Then 'news' and 'xml' patch need to be updated to have correct libvirt version. Diff from v2 [1]: ================= - move caps patch to top - add news patch - add _CAPPED to capabilitity name to distinguish from correspondent qemu capabilitiy - better option explanation in formatdomain.html - misc tests/english fixes as suggested We have come to agreement with John in mailing list to support QEMU versions which do not let use INT64_MAX as "maximum" value. But this will require changing qemuBlockStorageSourceGetFormatQcow2Props and a lot of other functions signature (which was not noticed during conversation). Thus I don't add such a functionality. Anyway the patch requires -blockdev from QEMU so we could only support single QEMU 3.0 version. [1] https://www.redhat.com/archives/libvir-list/2018-November/msg00313.html Nikolay Shirokovskiy (5): qemu: caps: add QEMU_CAPS_QCOW2_L2_CACHE_SIZE_CAPPED xml: add disk driver metadata_cache_size option qemu: support metadata-cache-size for blockdev news: add notice for new metadata cache size policy option DO NOT APPLY: add xml2argv test for metadata_cache_size docs/formatdomain.html.in | 11 ++++++ docs/news.xml | 11 ++++++ docs/schemas/domaincommon.rng | 11 ++++++ src/conf/domain_conf.c | 17 +++++++++ src/conf/domain_conf.h | 9 +++++ src/qemu/qemu_block.c | 5 ++- src/qemu/qemu_capabilities.c | 5 +++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 23 ++++++++++++ src/qemu/qemu_domain.c | 2 ++ src/util/virstoragefile.c | 1 + src/util/virstoragefile.h | 1 + .../qemuxml2argvdata/disk-metadata_cache_size.args | 39 ++++++++++++++++++++ .../qemuxml2argvdata/disk-metadata_cache_size.xml | 35 ++++++++++++++++++ tests/qemuxml2argvtest.c | 2 ++ .../disk-metadata_cache_size.xml | 41 ++++++++++++++++++++++ tests/qemuxml2xmltest.c | 2 ++ 17 files changed, 215 insertions(+), 1 deletion(-) create mode 100644 tests/qemuxml2argvdata/disk-metadata_cache_size.args create mode 100644 tests/qemuxml2argvdata/disk-metadata_cache_size.xml create mode 100644 tests/qemuxml2xmloutdata/disk-metadata_cache_size.xml -- 1.8.3.1

2 12

[libvirt] [PATCH v2] virt-aa-helper: generate rules for gl enabled graphics devices
by Christian Ehrhardt 23 Jan '19

23 Jan '19

This adds the virt-aa-helper support for gl enabled graphics devices to generate rules for the needed rendernode paths. Example in domain xml: <graphics type='spice'> <gl enable='yes' rendernode='/dev/dri/bar'/> </graphics> results in: "/dev/dri/bar" rw, Special cases are: - multiple devices with rendernodes -> all are added - non explicit rendernodes -> follow recently added virHostGetDRMRenderNode - rendernode without opengl (in egl-headless for example) -> still add the node Updates in V2: - avoid leaking rendernode - logically group patch hunks - drop base /dev/dri access - simplify detection of the need for a default rendernode - add tests in tests/virt-aa-helper-test - rebased to recent master Fixes: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1757085 Signed-off-by: Christian Ehrhardt <christian.ehrhardt(a)canonical.com> --- src/security/virt-aa-helper.c | 12 ++++++++++++ tests/virt-aa-helper-test | 6 ++++++ 2 files changed, 18 insertions(+) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 64a425671d..a84dd5a8c9 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1062,6 +1062,18 @@ get_files(vahControl * ctl) for (i = 0; i < ctl->def->ngraphics; i++) { virDomainGraphicsDefPtr graphics = ctl->def->graphics[i]; size_t n; + const char *rendernode = virDomainGraphicsGetRenderNode(graphics); + + if (rendernode) + vah_add_file(&buf, rendernode, "rw"); + else + if (virDomainGraphicsNeedsAutoRenderNode(graphics)) { + char * defaultRenderNode = virHostGetDRMRenderNode(); + if (defaultRenderNode) { + vah_add_file(&buf, defaultRenderNode, "rw"); + VIR_FREE(defaultRenderNode); + } + } for (n = 0; n < graphics->nListens; n++) { virDomainGraphicsListenDef listenObj = graphics->listens[n]; diff --git a/tests/virt-aa-helper-test b/tests/virt-aa-helper-test index fb400574dc..6e674bfe5c 100755 --- a/tests/virt-aa-helper-test +++ b/tests/virt-aa-helper-test @@ -378,6 +378,12 @@ testme "0" "input dev passthrough" "-r -u $valid_uuid" "$test_xml" "$disk2.*rw,$ sed -e "s,###UUID###,$uuid,g" -e "s,###DISK###,$disk1,g" -e "s,<memory>524288</memory>,<memory>1048576</memory>,g" -e "s,</devices>,<memory model='nvdimm'><source><path>$disk2</path></source><target><size unit='KiB'>524288</size><node>0</node></target></memory></devices>,g" "$template_xml" > "$test_xml" testme "0" "nvdimm" "-r -u $valid_uuid" "$test_xml" "$disk2.*rw,$" +sed -e "s,###UUID###,$uuid,g" -e "s,###DISK###,$disk1,g" -e "s,</devices>,<graphics type='egl-headless'><gl rendernode='/dev/dri/testegl1'/></graphics></devices>,g" "$template_xml" > "$test_xml" +testme "0" "dri egl" "-r -u $valid_uuid" "$test_xml" "/dev/dri/testegl1.*rw,$" + +sed -e "s,###UUID###,$uuid,g" -e "s,###DISK###,$disk1,g" -e "s,</devices>,<graphics type='spice'><gl enable='yes' rendernode='/dev/dri/testegl2'/></graphics></devices>,g" "$template_xml" > "$test_xml" +testme "0" "dri spice" "-r -u $valid_uuid" "$test_xml" "/dev/dri/testegl2.*rw,$" + testme "0" "help" "-h" echo "" >$output -- 2.17.1

3 4