February 2020 - Devel - libvirt List Archives

[libvirt PATCH] docs: fix docs about bandwidth setting with bridge networks
by Daniel P. Berrangé 26 Feb '20

26 Feb '20

We now support setting bandwidth on networks with type bridge. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- docs/formatnetwork.html.in | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/formatnetwork.html.in b/docs/formatnetwork.html.in index 3d807ecab6..ec055c8360 100644 --- a/docs/formatnetwork.html.in +++ b/docs/formatnetwork.html.in @@ -548,10 +548,10 @@ (<span class="since">since 0.9.4</span>). Setting <code>bandwidth</code> for a network is supported only for networks with a <code><forward></code> mode - of <code>route</code>, <code>nat</code>, or no mode at all - (i.e. an "isolated" network). Setting <code>bandwidth</code> - is <b>not</b> supported for forward modes - of <code>bridge</code>, <code>passthrough</code>, <code>private</code>, + of <code>route</code>, <code>nat</code>, <code>bridge</code>, + or no mode at all (i.e. an "isolated" network). Setting + <code>bandwidth</code> is <b>not</b> supported for forward modes + <code>passthrough</code>, <code>private</code>, or <code>hostdev</code>. Attempts to do this will lead to a failure to define the network or to create a transient network. </p> -- 2.24.1

2 1

[PATCH] docs: document port isolated property in domain/network/networkport
by Laine Stump 26 Feb '20

26 Feb '20

Signed-off-by: Laine Stump <laine(a)redhat.com> --- I had thought I'd included documentation with the patch that added parsing/formatting for this, but after crobinso noticed it was missing, I realized that I had only put documentation in an earlier version of the patches (that put the option inside <virtualport>). Oops :-/ docs/formatdomain.html.in | 31 +++++++++++++++++++++++++++++++ docs/formatnetwork.html.in | 25 +++++++++++++++++++++++++ docs/formatnetworkport.html.in | 11 +++++++++++ 3 files changed, 67 insertions(+) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 4fef2a0a97..28770188dd 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -6539,6 +6539,37 @@ qemu-kvm -net nic,model=? /dev/null traffic for that VLAN will be tagged. </p> + <h5><a id="elementPort">Isolating guests's network traffic from each other</a></h5> + +<pre> +... +<devices> + <interface type='network'> + <source network='default'/> + <b><port isolated='yes'/></b> + </interface> +</devices> +...</pre> + + <p> + <span class="since">Since 6.1.0.</span> The <code>port</code> + element property <code>isolated</code>, when set + to <code>yes</code> (default setting is <code>no</code>) is used + to isolate this interface's network traffic from that of other + guest interfaces connected to the same network that also + have <code><port isolated='yes'/></code>. This setting is + only supported for emulated interface devices that use a + standard tap device to connect to the network via a Linux host + bridge. This property can be inherited from a libvirt network, + so if all guests that will be connected to the network should be + isolated, it is better to put the setting in the network + configuration. (NB: this only prevents guests that + have <code>isolated='yes'</code> from communicating with each + other; if there is a guest on the same bridge that doesn't + have <code>isolated='yes'</code>, even the isolated guests will + be able to communicate with it.) + </p> + <h5><a id="elementLink">Modifying virtual link state</a></h5> <pre> ... diff --git a/docs/formatnetwork.html.in b/docs/formatnetwork.html.in index 3d807ecab6..f1e7ce5e4e 100644 --- a/docs/formatnetwork.html.in +++ b/docs/formatnetwork.html.in @@ -729,6 +729,31 @@ or <code><interface></code>. </p> + <h5><a id="elementPort">Isolating ports from one another</a></h5> + +<pre> +<network> + <name>isolated-ports</name> + <forward mode='bridge'/> + <bridge name='br0'/> + <port isolated='yes'/> +</network> +</pre> + + <p> + <span class="since">Since 6.1.0.</span> The <code>port</code> + element property <code>isolated</code>, when set + to <code>yes</code> (default setting is <code>no</code>) is used + to isolate the network traffic of each guest on the network from + all other guests connected to the network; it does not have an + effect on communication between the guests and the host, or + between the guests and destinations beyond this network. This + setting is only supported for networks that use a Linux host + bridge to connect guest interfaces via a standard tap device + (i.e. those with a forward mode of nat, route, open, bridge, or + no forward mode). + </p> + <h5><a id="elementsPortgroup">Portgroups</a></h5> <pre> diff --git a/docs/formatnetworkport.html.in b/docs/formatnetworkport.html.in index 0425e069ce..199a05f929 100644 --- a/docs/formatnetworkport.html.in +++ b/docs/formatnetworkport.html.in @@ -84,6 +84,7 @@ <outbound average='128' peak='256' burst='256'/> </bandwidth> <rxfilters trustGuest='yes'/> + <port isolated='yes'/> <virtualport type='802.1Qbg'> <parameters managerid='11' typeid='1193047' typeidversion='2'/> </virtualport> @@ -110,6 +111,16 @@ only supported for the virtio device model and for macvtap connections on the host. </dd> + <dt><code>port</code></dt> + <dd> <span class="since">Since 6.1.0.</span> + The <code>port</code> element property + <code>isolated</code>, when set to <code>yes</code> (default + setting is <code>no</code>) is used to isolate this port's + network traffic from other ports on the same network that also + have <code><port isolated='yes'/></code>. This setting + is only supported for emulated network devices connected to a + Linux host bridge via a standard tap device. + </dd> <dt><code>virtualport</code></dt> <dd>The <code>virtualport</code> element describes metadata that needs to be provided to the underlying network subsystem. It -- 2.24.1

2 1

[PATCH 0/7] qemu: Use 'flat' version of query-named-block-nodes
by Peter Krempa 26 Feb '20

26 Feb '20

Don't request the recursive output since we don't use it. Peter Krempa (7): tests: qemucapabilities: Update capabilities of qemu-5.0.0 on x86_64 qemu: monitor: Remove leftovers from password callback qemu: capabilities: Add capability for the 'flat' argument of 'query-named-block-nodes' qemu: monitor: Refactor variable cleanup in qemuMonitorJSONQueryNamedBlockNodes qemuCheckpointDiscardBitmaps: Use qemuBlockGetNamedNodeData qemu: monitor: Add 'flat' parameter for qemuMonitorJSONQueryNamedBlockNodes qemu: Don't request nested entries in qemuBlockGetNamedNodeData src/qemu/qemu_block.c | 4 +- src/qemu/qemu_capabilities.c | 4 + src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_checkpoint.c | 4 +- src/qemu/qemu_monitor.c | 9 +- src/qemu/qemu_monitor.h | 12 +- src/qemu/qemu_monitor_json.c | 31 +- src/qemu/qemu_monitor_json.h | 6 +- .../caps_5.0.0.x86_64.replies | 6185 +++++++++-------- .../caps_5.0.0.x86_64.xml | 3 +- 10 files changed, 3388 insertions(+), 2873 deletions(-) -- 2.24.1

2 14

[libvirt PATCHv4 00/15] add virtiofs support (virtio-fs epopee)
by Ján Tomko 26 Feb '20

26 Feb '20

For: https://bugzilla.redhat.com/show_bug.cgi?id=1694166 v3: https://www.redhat.com/archives/libvir-list/2020-January/msg01401.html v4: * place virtiofsd into the emulator cgroup * do not leak the log file descriptor * better validation of the path existence and shared memory support * run as root:root explicitly * correctly use listification in RST document bonus: 15/15 wip for SELinux integration Avaliable on my repo (except for the bonus round) git fetch https://repo.or.cz/libvirt/jtomko.git virtiofs-v4 TODO: * a bug against selinux-policy * address the inconsistency of some downstreams wrt placing the json files into /usr/share/qemu vs. /usr/share/qemu-kvm: https://bugzilla.redhat.com/show_bug.cgi?id=1804196 Daniel P. Berrangé (1): docs: reduce excessive spacing in ToC for RST files Ján Tomko (14): schema: wrap fsDriver in a choice group qemuExtDevicesStart: pass logManager qemu: add QEMU_CAPS_VHOST_USER_FS docs: add virtiofs kbase conf: qemu: add virtiofs fsdriver type conf: add virtiofs-related elements and attributes qemu: add virtiofsd_debug to qemu.conf qemu: validate virtiofs filesystems qemu: forbid migration with vhost-user-fs device qemu: add code for handling virtiofsd qemu: put virtiofsd in the emulator cgroup qemu: use the vhost-user schemas to find binary qemu: build vhost-user-fs device command line wip: SELinux integration for virtiofsd docs/formatdomain.html.in | 35 +- docs/kbase.html.in | 3 + docs/kbase/virtiofs.rst | 152 ++++++++ docs/libvirt.css | 4 + docs/schemas/domaincommon.rng | 88 ++++- po/POTFILES.in | 1 + src/conf/domain_conf.c | 108 +++++- src/conf/domain_conf.h | 16 + src/libvirt_private.syms | 2 + src/qemu/Makefile.inc.am | 2 + src/qemu/libvirtd_qemu.aug | 1 + src/qemu/qemu.conf | 7 + src/qemu/qemu_capabilities.c | 4 + src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_command.c | 47 ++- src/qemu/qemu_conf.c | 2 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_domain.c | 66 +++- src/qemu/qemu_domain.h | 2 +- src/qemu/qemu_domain_address.c | 4 + src/qemu/qemu_extdevice.c | 43 +++ src/qemu/qemu_extdevice.h | 1 + src/qemu/qemu_migration.c | 10 + src/qemu/qemu_process.c | 4 +- src/qemu/qemu_security.c | 40 ++ src/qemu/qemu_security.h | 7 + src/qemu/qemu_vhost_user.c | 40 ++ src/qemu/qemu_vhost_user.h | 4 + src/qemu/qemu_virtiofs.c | 341 ++++++++++++++++++ src/qemu/qemu_virtiofs.h | 48 +++ src/qemu/test_libvirtd_qemu.aug.in | 1 + src/security/security_dac.c | 20 + src/security/security_driver.h | 2 + src/security/security_manager.c | 12 + src/security/security_manager.h | 4 + src/security/security_nop.c | 1 + src/security/security_selinux.c | 69 ++++ src/security/security_stack.c | 19 + .../caps_4.2.0.aarch64.xml | 1 + .../qemucapabilitiesdata/caps_4.2.0.s390x.xml | 1 + .../caps_4.2.0.x86_64.xml | 1 + .../caps_5.0.0.aarch64.xml | 1 + .../caps_5.0.0.x86_64.xml | 1 + ...vhost-user-fs-fd-memory.x86_64-latest.args | 39 ++ .../vhost-user-fs-fd-memory.xml | 43 +++ ...vhost-user-fs-hugepages.x86_64-latest.args | 47 +++ .../vhost-user-fs-hugepages.xml | 75 ++++ tests/qemuxml2argvtest.c | 14 + .../vhost-user-fs-fd-memory.x86_64-latest.xml | 1 + .../vhost-user-fs-hugepages.x86_64-latest.xml | 1 + tests/qemuxml2xmltest.c | 3 + 51 files changed, 1420 insertions(+), 22 deletions(-) create mode 100644 docs/kbase/virtiofs.rst create mode 100644 src/qemu/qemu_virtiofs.c create mode 100644 src/qemu/qemu_virtiofs.h create mode 100644 tests/qemuxml2argvdata/vhost-user-fs-fd-memory.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/vhost-user-fs-fd-memory.xml create mode 100644 tests/qemuxml2argvdata/vhost-user-fs-hugepages.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/vhost-user-fs-hugepages.xml create mode 120000 tests/qemuxml2xmloutdata/vhost-user-fs-fd-memory.x86_64-latest.xml create mode 120000 tests/qemuxml2xmloutdata/vhost-user-fs-hugepages.x86_64-latest.xml -- 2.24.1

4 34

[PATCH] network: bridge_driver: Use new helpers for storing libvirt errors
by Gaurav Agrawal 25 Feb '20

25 Feb '20

From: GAURAV AGRAWAL <agrawalgaurav(a)gnome.org> Signed-off-by: Gaurav Agrawal <agrawalgaurav(a)gnome.org> --- src/network/bridge_driver_linux.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_linux.c index 7bbde5c6a9..fde33b5d38 100644 --- a/src/network/bridge_driver_linux.c +++ b/src/network/bridge_driver_linux.c @@ -22,6 +22,7 @@ #include <config.h> #include "viralloc.h" +#include "virerror.h" #include "virfile.h" #include "viriptables.h" #include "virstring.h" @@ -53,7 +54,7 @@ static void networkSetupPrivateChains(void) if (rc < 0) { VIR_DEBUG("Failed to create global IPv4 chains: %s", virGetLastErrorMessage()); - errInitV4 = virSaveLastError(); + virErrorPreserveLast(&errInitV4); virResetLastError(); } else { virFreeError(errInitV4); @@ -70,7 +71,7 @@ static void networkSetupPrivateChains(void) if (rc < 0) { VIR_DEBUG("Failed to create global IPv6 chains: %s", virGetLastErrorMessage()); - errInitV6 = virSaveLastError(); + virErrorPreserveLast(&errInitV6); virResetLastError(); } else { virFreeError(errInitV6); -- 2.24.1

3 5

Plans for next release
by Daniel Veillard 25 Feb '20

25 Feb '20

I'm a bit late, but it seems that if we freeze tomorrow, then RC2 could be provided on Friday and if everythig looks fine we can push 6.1.0 on Monday 2nd, so that's the plan, I hope this works for everyone ! Daniel -- Daniel Veillard | Red Hat Developers Tools http://developer.redhat.com/ veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt PATCH 0/8] Include networkportdef.h in domain_conf.h
by Ján Tomko 25 Feb '20

25 Feb '20

The netdev_bandwidth_conf module contains XML parsing and formatting functions operating on types from util/virnetdevbandwidth.h as well as helper functions using types from domain_conf.h and network_conf.h It does not, however, introduce any new types, so there's no need to include its header in other header files. Move its inclusion in networkportdef.h to the corresponding networkportdef.c file, where it's used, which clears the path for networkportdef.h inclusion in domain_conf.h. Patch 1 is unrelated; Patch 5 was intended to help remove the dependency of the header file on network_conf.h (by passing int instead of enum) and patch 6 would lessen the dependency from domain_conf.h to virconftypes.h, but later I realized this might not be necessary. (Thanks, Pavel!) Ján Tomko (8): conf: virnwfilterbindingdef: include virxml.h bridge: include netdev_bandwidth_conf.h conf: virnetworkportdef: include virnetdevmacvlan conf: rename virNetDevSupportBandwidth to virNetDevSupportsBandwidth conf: virNetDevSupportsBandwidth: move into the C file conf: do not pass vm object to virDomainClearNetBandwidth conf: reduce includes in virnetworkportdef.h conf: include virnetworkportdef.h in domain_conf.h src/conf/domain_conf.h | 6 +----- src/conf/netdev_bandwidth_conf.c | 35 ++++++++++++++++++++++++++------ src/conf/netdev_bandwidth_conf.h | 26 ++---------------------- src/conf/virnetworkportdef.c | 5 +++++ src/conf/virnetworkportdef.h | 3 --- src/conf/virnwfilterbindingdef.h | 1 + src/libvirt_private.syms | 1 + src/lxc/lxc_driver.c | 4 ++-- src/lxc/lxc_process.c | 2 +- src/network/bridge_driver.c | 2 ++ src/qemu/qemu_command.c | 2 +- src/qemu/qemu_driver.c | 4 ++-- src/qemu/qemu_hotplug.c | 4 ++-- src/qemu/qemu_process.c | 2 +- 14 files changed, 50 insertions(+), 47 deletions(-) -- 2.24.1

3 12

[libvirt PATCH] qemu: Do not set default CPU for archs without CPU driver
by Jiri Denemark 25 Feb '20

25 Feb '20

Whenever there is a guest CPU configured in domain XML, we will call some CPU driver APIs to validate the CPU definition and check its compatibility with the hypervisor. Thus domains with guest CPU specification can only be started if the guest architecture is supported by the CPU driver. But we would add a default CPU to any domain as long as QEMU reports it causing failures to start any domain on affected architectures. https://bugzilla.redhat.com/show_bug.cgi?id=1805755 Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/cpu/cpu.c | 24 ++++++++++++++++++++++++ src/cpu/cpu.h | 3 +++ src/libvirt_private.syms | 1 + src/qemu/qemu_domain.c | 3 +++ 4 files changed, 31 insertions(+) diff --git a/src/cpu/cpu.c b/src/cpu/cpu.c index ae3a0acc10..6d6191fe4e 100644 --- a/src/cpu/cpu.c +++ b/src/cpu/cpu.c @@ -1096,3 +1096,27 @@ virCPUDataAddFeature(virCPUDataPtr cpuData, return driver->dataAddFeature(cpuData, name); } + + +/** + * virCPUArchIsSupported: + * + * @arch: CPU architecture + * + * Returns true if the architecture is supported by any CPU driver. + */ +bool +virCPUArchIsSupported(virArch arch) +{ + size_t i; + size_t j; + + for (i = 0; i < G_N_ELEMENTS(drivers); i++) { + for (j = 0; j < drivers[i]->narch; j++) { + if (arch == drivers[i]->arch[j]) + return true; + } + } + + return false; +} diff --git a/src/cpu/cpu.h b/src/cpu/cpu.h index 2e8b8923ae..f779d2be17 100644 --- a/src/cpu/cpu.h +++ b/src/cpu/cpu.h @@ -265,6 +265,9 @@ int virCPUDataAddFeature(virCPUDataPtr cpuData, const char *name); +bool +virCPUArchIsSupported(virArch arch); + /* virCPUDataFormat and virCPUDataParse are implemented for unit tests only and * have no real-life usage */ diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 9d172d3bd0..e27b6f29bc 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1309,6 +1309,7 @@ virStoragePoolObjVolumeListExport; # cpu/cpu.h cpuDecode; cpuEncode; +virCPUArchIsSupported; virCPUBaseline; virCPUCheckFeature; virCPUCompare; diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 446a517df9..7d274a4fa5 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -4576,6 +4576,9 @@ qemuDomainDefSetDefaultCPU(virDomainDefPtr def, def->cpu->model)) return 0; + if (!virCPUArchIsSupported(def->os.arch)) + return 0; + /* Default CPU model info from QEMU is usable for TCG only except for * x86, s390, and ppc64. */ if (!ARCH_IS_X86(def->os.arch) && -- 2.25.1

2 1

[PATCH] virt-aa-helper: Fix build by including virutil.h
by Jim Fehlig 25 Feb '20

25 Feb '20

Commit fb01e1a44d missed including virutil.h, causing the following compilation error ../../src/security/virt-aa-helper.c:1055:43: error: implicit declaration of function 'virHostGetDRMRenderNode' [-Werror=implicit-function-declaration] 1055 | char *defaultRenderNode = virHostGetDRMRenderNode(); Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- Pushing under the build-breaker rule. src/security/virt-aa-helper.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 6f36652c7c..b6f58efdea 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -41,6 +41,7 @@ #include "virxml.h" #include "viruuid.h" #include "virusb.h" +#include "virutil.h" #include "virpci.h" #include "virfile.h" #include "configmake.h" -- 2.25.0

3 3

[libvirt PATCH] tests: fix missing test data for network port XML
by Daniel P. Berrangé 25 Feb '20

25 Feb '20

The network port XML files were not including any usage of vlan tags or port options, and one of the files was not even processed. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- tests/virnetworkportxml2xmldata/plug-network.xml | 5 +++++ tests/virnetworkportxml2xmltest.c | 1 + 2 files changed, 6 insertions(+) diff --git a/tests/virnetworkportxml2xmldata/plug-network.xml b/tests/virnetworkportxml2xmldata/plug-network.xml index a3a8899148..8e7fc6d010 100644 --- a/tests/virnetworkportxml2xmldata/plug-network.xml +++ b/tests/virnetworkportxml2xmldata/plug-network.xml @@ -10,6 +10,11 @@ <inbound average='1000' peak='4000' floor='2000' burst='1024'/> <outbound average='128' peak='256' burst='32768'/> </bandwidth> + <vlan trunk='yes'> + <tag id='2'/> + <tag id='1729'/> + </vlan> + <port isolated='yes'/> <rxfilters trustGuest='yes'/> <plug type='network' bridge='virbr0'/> </networkport> diff --git a/tests/virnetworkportxml2xmltest.c b/tests/virnetworkportxml2xmltest.c index 1b2175dd9d..039da96490 100644 --- a/tests/virnetworkportxml2xmltest.c +++ b/tests/virnetworkportxml2xmltest.c @@ -94,6 +94,7 @@ mymain(void) DO_TEST("plug-bridge-mactbl"); DO_TEST("plug-direct"); DO_TEST("plug-hostdev-pci"); + DO_TEST("plug-network"); return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; } -- 2.24.1

2 1