December 2020 - Devel - libvirt List Archives

[PATCH] docs/formatstorageencryption.html.in: support qcow2 format in luks encryption volume
by Meina Li 24 Dec '20

24 Dec '20

Signed-off-by: Meina Li <meili(a)redhat.com> --- docs/formatstorageencryption.html.in | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/formatstorageencryption.html.in b/docs/formatstorageencryption.html.in index ea80a87cfb..7215c307d7 100644 --- a/docs/formatstorageencryption.html.in +++ b/docs/formatstorageencryption.html.in @@ -128,7 +128,9 @@ <p> Here is an example specifying use of the <code>luks</code> format for - a specific cipher algorithm for volume creation: + a specific cipher algorithm for volume creation. + <span class="since">Since 6.10.0,</span> the <code>target</code> format + can also support <code>qcow2</code> type with <code>luks</code> encryption. </p> <pre> <volume> -- 2.27.0

2 1

[RFC 3/5] pci: introduce apci-index property for PCI device
by Igor Mammedov 22 Dec '20

22 Dec '20

In x86/ACPI world, since systemd v197, linux distros are using predictable network interface naming since systemd v197. Which on QEMU based VMs results into path based naming scheme, that names network interfaces based on PCI topology. With this one has to plug NIC in exacly the same bus/slot, which was used when disk image was first provisioned/configured or one risks to loose network configuration due to NIC being renamed to actually used topology. That also restricts freedom reshape PCI configuration of VM without need to reconfigure used guest image. systemd also offers "onboard" naming scheme which is preffered over PCI slot/topology one, provided that firmware implements: " PCI Firmware Specification 3.1 4.6.7. DSM for Naming a PCI or PCI Express Device Under Operating Systems " that allows to assign user defined index to PCI device, which systemd will use to name NIC. For example, using -device e1000,acpi-index=100 guest will rename NIC to 'eno100', where 'eno' is default prefix for "onboard" naming scheme. This doesn't reqiure any advance configuration on guest side. Hope is that 'acpi-index' will be easier to consume by mangment layer, compared to forcing specic PCI topology and/or having several disk image templates for different topologies and will help to simplify process of spawning VM from the same template without need to reconfigure guest network configuration. this patch adds, 'acpi-index'* property and wires up (abuses) unused pci hotplug registers to pass index value to AML code at runtime. Following patch will add corresponding _DSM code and wire it up to PCI devices described in ACPI. *) name comes from linux kernel terminology Signed-off-by: Igor Mammedov <imammedo(a)redhat.com> --- CC: libvir-list(a)redhat.com include/hw/acpi/pcihp.h | 7 ++++++- include/hw/pci/pci.h | 1 + hw/acpi/pci.c | 6 ++++++ hw/acpi/pcihp.c | 25 ++++++++++++++++++++++++- hw/i386/acpi-build.c | 10 ++++++++++ hw/pci/pci.c | 1 + 6 files changed, 48 insertions(+), 2 deletions(-) diff --git a/include/hw/acpi/pcihp.h b/include/hw/acpi/pcihp.h index dfd375820f..72d1773ca1 100644 --- a/include/hw/acpi/pcihp.h +++ b/include/hw/acpi/pcihp.h @@ -46,6 +46,7 @@ typedef struct AcpiPciHpPciStatus { typedef struct AcpiPciHpState { AcpiPciHpPciStatus acpi_pcihp_pci_status[ACPI_PCIHP_MAX_HOTPLUG_BUS]; uint32_t hotplug_select; + uint32_t acpi_index; PCIBus *root; MemoryRegion io; bool legacy_piix; @@ -71,6 +72,8 @@ void acpi_pcihp_reset(AcpiPciHpState *s, bool acpihp_root_off); extern const VMStateDescription vmstate_acpi_pcihp_pci_status; +bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id); + #define VMSTATE_PCI_HOTPLUG(pcihp, state, test_pcihp) \ VMSTATE_UINT32_TEST(pcihp.hotplug_select, state, \ test_pcihp), \ @@ -78,6 +81,8 @@ extern const VMStateDescription vmstate_acpi_pcihp_pci_status; ACPI_PCIHP_MAX_HOTPLUG_BUS, \ test_pcihp, 1, \ vmstate_acpi_pcihp_pci_status, \ - AcpiPciHpPciStatus) + AcpiPciHpPciStatus), \ + VMSTATE_UINT32_TEST(pcihp.acpi_index, state, \ + vmstate_acpi_pcihp_use_acpi_index) #endif diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h index 259f9c992d..e592532558 100644 --- a/include/hw/pci/pci.h +++ b/include/hw/pci/pci.h @@ -357,6 +357,7 @@ struct PCIDevice { /* ID of standby device in net_failover pair */ char *failover_pair_id; + uint32_t acpi_index; }; void pci_register_bar(PCIDevice *pci_dev, int region_num, diff --git a/hw/acpi/pci.c b/hw/acpi/pci.c index 9510597a19..07d5101d83 100644 --- a/hw/acpi/pci.c +++ b/hw/acpi/pci.c @@ -27,6 +27,7 @@ #include "hw/acpi/aml-build.h" #include "hw/acpi/pci.h" #include "hw/pci/pcie_host.h" +#include "hw/acpi/pcihp.h" void build_mcfg(GArray *table_data, BIOSLinker *linker, AcpiMcfgInfo *info) { @@ -59,3 +60,8 @@ void build_mcfg(GArray *table_data, BIOSLinker *linker, AcpiMcfgInfo *info) "MCFG", table_data->len - mcfg_start, 1, NULL, NULL); } +bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id) +{ + AcpiPciHpState *s = opaque; + return s->acpi_index; +} diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c index 9dc4d3e2db..9634567e3a 100644 --- a/hw/acpi/pcihp.c +++ b/hw/acpi/pcihp.c @@ -347,7 +347,8 @@ static uint64_t pci_read(void *opaque, hwaddr addr, unsigned int size) trace_acpi_pci_down_read(val); break; case PCI_EJ_BASE: - /* No feature defined yet */ + val = s->acpi_index; + s->acpi_index = 0; trace_acpi_pci_features_read(val); break; case PCI_RMV_BASE: @@ -367,8 +368,30 @@ static uint64_t pci_read(void *opaque, hwaddr addr, unsigned int size) static void pci_write(void *opaque, hwaddr addr, uint64_t data, unsigned int size) { + int slot; + PCIBus *bus; + BusChild *kid, *next; AcpiPciHpState *s = opaque; + + s->acpi_index = 0; switch (addr) { + case PCI_UP_BASE: + slot = ctz32(data); + + if (s->hotplug_select >= ACPI_PCIHP_MAX_HOTPLUG_BUS) { + break; + } + + bus = acpi_pcihp_find_hotplug_bus(s, s->hotplug_select); + QTAILQ_FOREACH_SAFE(kid, &bus->qbus.children, sibling, next) { + Object *o = OBJECT(kid->child); + PCIDevice *dev = PCI_DEVICE(o); + if (PCI_SLOT(dev->devfn) == slot) { + s->acpi_index = object_property_get_uint(o, "acpi-index", NULL); + break; + } + } + break; case PCI_EJ_BASE: if (s->hotplug_select >= ACPI_PCIHP_MAX_HOTPLUG_BUS) { break; diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c index f18b71dea9..27d2958e25 100644 --- a/hw/i386/acpi-build.c +++ b/hw/i386/acpi-build.c @@ -1132,6 +1132,16 @@ static void build_piix4_pci_hotplug(Aml *table) aml_append(method, aml_return(aml_int(0))); aml_append(scope, method); + method = aml_method("AIDX", 2, AML_NOTSERIALIZED); + aml_append(method, aml_acquire(aml_name("BLCK"), 0xFFFF)); + aml_append(method, aml_store(aml_arg(0), aml_name("BNUM"))); + aml_append(method, + aml_store(aml_shiftleft(aml_int(1), aml_arg(1)), aml_name("PCIU"))); + aml_append(method, aml_store(aml_name("B0EJ"), aml_local(0))); + aml_append(method, aml_release(aml_name("BLCK"))); + aml_append(method, aml_return(aml_local(0))); + aml_append(scope, method); + aml_append(table, scope); } diff --git a/hw/pci/pci.c b/hw/pci/pci.c index d4349ea577..617f48ff3b 100644 --- a/hw/pci/pci.c +++ b/hw/pci/pci.c @@ -76,6 +76,7 @@ static Property pci_props[] = { QEMU_PCIE_EXTCAP_INIT_BITNR, true), DEFINE_PROP_STRING("failover_pair_id", PCIDevice, failover_pair_id), + DEFINE_PROP_UINT32("acpi-index", PCIDevice, acpi_index, -1), DEFINE_PROP_END_OF_LIST() }; -- 2.27.0

1 0

libvirt-lxc: Permission issue of /proc/net
by John Hurnett 22 Dec '20

22 Dec '20

Hi, I've encountered a problem that some of /proc/net/ files can't be accessed in unprivileged containers, because it is owned by nobody:nogroup (-1:-1) and have 440 permissions. This exact issue was solved in LXC project by unsharing netns: https://github.com/lxc/lxc/commit/5b1e83cbc498cd3edeaf13afa987d530299a35a7 . Maybe it could be similarly fixed on libvirt-lxc? BR, John H.

1 0

[libvirt PATCH] vmx: Don't error out on missing filename for cdrom
by Martin Kletzander 21 Dec '20

21 Dec '20

This is perfectly valid in VMWare and the VM just boots with an empty drive. We used to just skip the whole drive before, but since we changed how we parse empty cdrom drives this now results in an error and the user not being able to even dump the XML. Instead of erroring out, just keep the drive empty. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1903953 Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- src/vmx/vmx.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/src/vmx/vmx.c b/src/vmx/vmx.c index b86dbe9ca267..40e4ef962992 100644 --- a/src/vmx/vmx.c +++ b/src/vmx/vmx.c @@ -2447,10 +2447,18 @@ virVMXParseDisk(virVMXContext *ctx, virDomainXMLOptionPtr xmlopt, virConfPtr con goto cleanup; } + tmp = ctx->parseFileName(fileName, ctx->opaque); virDomainDiskSetType(*def, VIR_STORAGE_TYPE_FILE); - if (!(tmp = ctx->parseFileName(fileName, ctx->opaque))) - goto cleanup; - virDomainDiskSetSource(*def, tmp); + /* It is easily possible to have a cdrom with non-existing filename + * as the image and vmware just provides an empty cdrom. + * + * See: https://bugzilla.redhat.com/1903953 + */ + if (tmp) { + virDomainDiskSetSource(*def, tmp); + } else { + virResetLastError(); + } VIR_FREE(tmp); } else if (deviceType && STRCASEEQ(deviceType, "atapi-cdrom")) { virDomainDiskSetType(*def, VIR_STORAGE_TYPE_BLOCK); -- 2.29.2

3 3

libvirt-lxc: Permission issue of /proc/net
by John Hurnett 20 Dec '20

20 Dec '20

Hi, I've encountered a problem that some of /proc/net/ files can't be accessed in unprivileged containers, because it is owned by nobody:nogroup (-1:-1) and have 440 permissions. This exact issue was solved in LXC project by unsharing netns: https://github.com/lxc/lxc/commit/5b1e83cbc498cd3edeaf13afa987d530299a35a7 . Maybe it could be similarly fixed on libvirt-lxc? BR, John H.

1 0

Hotplugng disk not adding backing layers to apparmor profile
by Russell Cattelan 18 Dec '20

18 Dec '20

We have been working on a feature at IBM cloud around snapshots. One of the workflows is to add a snapshoted disk to a running virtual instance. This involves adding a disk that has at minimum 2 qcow2 files, one for the active overlay and one or more backing files. The problem we are running into is that they dynamic update of the apparmor profile appears to only add the first file in the chain to the profile. It based on some experiments it appears that this should be adding all the files to the security profile but this seems to only do the first (topmost) file. "disk->src" https://gitlab.com/libvirt/libvirt/-/blob/a7db0b757d210071d39e6d116e6a4bc76… I does not appear to loop over the disks where as qemuBlockStorageSourceChainAttach does https://gitlab.com/libvirt/libvirt/-/blob/a7db0b757d210071d39e6d116e6a4bc76… The attached disk then fails since apparmor will reject the backing files access. This is fairly easy to demonstrate when apparmor is active. <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/mnt2/hotplug2.qcow2' index='1'/> <backingStore type='file' index='2'> <format type='qcow2'/> <source file='/mnt2/hotplug1.qcow2'/> <backingStore/> </backingStore> <target dev='vdc' bus='virtio'/> </disk> virsh attach-device test1 /mnt2/attach.xml [535657.524784] audit: type=1400 audit(1608242451.762:79): apparmor="DENIED" operation="open" profile="libvirt-a7fd0ca2-1429-4a60-9ab4-a545660666ce" name="/mnt2/hotplug1.qcow2" pid=11999 comm="qemu-system-x86" requested_mask="r" denied_mask="r" fsuid=64055 ouid=64055 -Russell Cattelan

1 0

Hotplugng disk not adding backing layers to apparmor profile
by Russell Cattelan 18 Dec '20

18 Dec '20

We have been working on a feature at IBM cloud around snapshots. One of the workflows is to add a snapshoted disk to a running virtual instance. This involves adding a disk that has at minimum 2 qcow2 files, one for the active overlay and one or more backing files. The problem we are running into is that they dynamic update of the apparmor profile appears to only add the first file in the chain to the profile. It based on some experiments it appears that this should be adding all the files to the security profile but this seems to only do the first (topmost) file. "disk->src" https://gitlab.com/libvirt/libvirt/-/blob/a7db0b757d210071d39e6d116e6a4bc76… I does not appear to loop over the disks where as qemuBlockStorageSourceChainAttach does https://gitlab.com/libvirt/libvirt/-/blob/a7db0b757d210071d39e6d116e6a4bc76… The attached disk then fails since apparmor will reject the backing files access. This is fairly easy to demonstrate when apparmor is active. <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/mnt2/hotplug2.qcow2' index='1'/> <backingStore type='file' index='2'> <format type='qcow2'/> <source file='/mnt2/hotplug1.qcow2'/> <backingStore/> </backingStore> <target dev='vdc' bus='virtio'/> </disk> virsh attach-device test1 /mnt2/attach.xml [535657.524784] audit: type=1400 audit(1608242451.762:79): apparmor="DENIED" operation="open" profile="libvirt-a7fd0ca2-1429-4a60-9ab4-a545660666ce" name="/mnt2/hotplug1.qcow2" pid=11999 comm="qemu-system-x86" requested_mask="r" denied_mask="r" fsuid=64055 ouid=64055 -Russell Cattelan

1 0

[libvirt PATCH 00/29] Refactor scripts in tests/cputestdata
by Tim Wiederhake 18 Dec '20

18 Dec '20

This series refactors the various scripts found in tests/cputestdata and adds support for CORE_CAPABILITY MSR, as found on e.g. SnowRidge. Acquiring test data on a new system is a two step process. "cpu-gather.sh" gathers information on the target machine and has as few dependencies as possible. "cpu-parse.sh" processes this information but requires access to a libvirt source tree and has more dependencies, e.g. "xmltodict". This series merges three of the four involved scripts (cpu-gather.sh, cpu-parse.sh and cpu-reformat.py) into a single python3 script. python3 already was a dependency for cpu-gather.sh and care has been taken to not depend on modules that are not installed by default [1]. Merging the fourth script, cpu-cpuid.py, will come in a seperate series. Patches 1 to 14 transform cpu-gather into a python script, preserving the format of the output (except for consistent "\n" line endings; previously the tool would output a mix of "\n" and "\r\n"). Patches 15 to 23 merge cpu-parse into the script. In this process, the format of the intermediary data is changed to json. Patches 24 to 29 add support for "all in one" operation and extracting IA32_CORE_CAPABILITY_MSR, which can be found on e.g. SnowRidge CPUs. Old usage: ./cpu-gather.sh | ./cpu-parse.sh New: ./cpu-gather.py [--gather] | ./cpu-gather.py --parse Alternative on single machine: ./cpu-gather.py --gather --parse [1] https://docs.python.org/3/py-modindex.html Tim Wiederhake (29): cpu-cpuid: Shorten overly long line cpu-gather: Create python wrapper for shell script cpu-gather: Move model_name to new script cpu-gather: Allow overwriting model name cpu-gather: Move cpuid call to new script cpu-gather: Allow overwriting cpuid binary location cpu-gather: Move msr decoding to new script cpu-gather: Move qemu detection to new script cpu-gather: Move static model expansion to new script cpu-gather: Move static model extraction to new script cpu-gather: Move simple model extraction to new script cpu-gather: Move full model extraction to new script cpu-gather: Merge model gathering logic cpu-gather: Delete old script cpu-gather: Separate data input and output cpu-parse: Wrap with python script cpu-gather: Transport data as json cpu-parse: Move model name detection to new script cpu-parse: Move file name generation to new script cpu-parse: Move xml output to new script cpu-parse: Move json output to new script cpu-parse: Move call to cpu-cpuid.py to new script cpu-parse: Delete old script cpu-gather: Ignore empty responses from qemu cpu-gather: Ignore shutdown messages from qemu cpu-gather: Parse cpuid leaves early cpu-gather: Allow gathering and parsing data in one step. cpu-gather: Prepare gather_msr for reading multiple msr cpu-gather: Add IA32_CORE_CAPABILITY_MSR tests/cputestdata/cpu-cpuid.py | 5 +- tests/cputestdata/cpu-gather.py | 365 ++++++++++++++++++++++++++++++ tests/cputestdata/cpu-gather.sh | 103 --------- tests/cputestdata/cpu-parse.sh | 65 ------ tests/cputestdata/cpu-reformat.py | 9 - 5 files changed, 368 insertions(+), 179 deletions(-) create mode 100755 tests/cputestdata/cpu-gather.py delete mode 100755 tests/cputestdata/cpu-gather.sh delete mode 100755 tests/cputestdata/cpu-parse.sh delete mode 100755 tests/cputestdata/cpu-reformat.py -- 2.26.2

2 32

[libvirt PATCH 0/2] Schema fixes for virsh [hypervisor-]cpu-compare
by Tim Wiederhake 18 Dec '20

18 Dec '20

See individual commit messages for more details. Tim Wiederhake (2): schemas: Deduplicate cpuTopology in cputypes.rng schema: Allow counter element in host cpu definition docs/schemas/cputypes.rng | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) -- 2.26.2

2 3

[libvirt PATCH 0/3] Few fixes for migration over UNIX socket
by Martin Kletzander 17 Dec '20

17 Dec '20

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1638889 Martin Kletzander (3): qemu: Fix possible segfault when migrating disks docs: Slightly alter disks-uri description in virsh man qemu: Extra check for NBD URI being specified docs/manpages/virsh.rst | 22 +++++++++++----------- src/qemu/qemu_driver.c | 21 +++++++++++++++++++++ src/qemu/qemu_migration.c | 5 +++++ 3 files changed, 37 insertions(+), 11 deletions(-) -- 2.29.2

3 6