October 2021 - Devel - libvirt List Archives

[PATCH v2 00/10] qemu: Fix image labels lost after migration with shared fs
by Peng Liang 11 Oct '21

11 Oct '21

This is v2 of: https://listman.redhat.com/archives/libvir-list/2021-August/msg00698.html When migrating using shared fs, the dst host will remember the image labels again before launching the VM and the src host will remove the image labels after migration. It leads to that the image labels lost after migration. Patch 8-10 are the real fix patches. v1 -> v2: 1. fix check of virFileIsSharedFS in patch10 (patch9 in v1) [Michal] 2. add implementation of SELinux (patch5, 7, 8) [Michal] Peng Liang (10): security: add virSecurityUpdateTimestampIfexists security: add virSecurityManagerUpdateImageLabel security: implement domainUpdateSecurityImageLabel for stack security: implement domainUpdateSecurityImageLabel for DAC security: implement domainUpdateSecurityImageLabel for SELinux qemu: add qemuSecurityUpdateImageLabel security: rename 2 functions in DAC and SELinux security: don't remember image labels when migrating with shared fs migration: don't remove image labels after migration migration: update image labels in dst after migration src/libvirt_private.syms | 1 + src/qemu/qemu_migration.c | 12 +++++++ src/qemu/qemu_process.c | 5 ++- src/qemu/qemu_security.c | 10 ++++++ src/qemu/qemu_security.h | 5 +++ src/security/security_dac.c | 58 ++++++++++++++++++++++++-------- src/security/security_driver.h | 5 +++ src/security/security_manager.c | 29 ++++++++++++++++ src/security/security_manager.h | 5 +++ src/security/security_selinux.c | 59 +++++++++++++++++++++++++-------- src/security/security_stack.c | 20 +++++++++++ src/security/security_util.c | 32 ++++++++++++++++++ src/security/security_util.h | 4 +++ 13 files changed, 218 insertions(+), 27 deletions(-) -- 2.31.1

1 10

[PATCH] qemu: capabilities: Remove QEMU_CAPS_PIIX4_ACPI_HOTPLUG_BRIDGE
by Peter Krempa 11 Oct '21

11 Oct '21

Commit 58ba0f6a3d7342fba29edbbf2bb9cb5497c870e5 added a capability which is supported by all qemu versions we support. Remove it and the associated dead code. Since the capability isn't present in any upstream release we can delete it completely. Specifically the commit itself states that it was introduced "around (qemu) 2.1". The rest of the code handles properly that the feature is used only on x86 with the i440fx machine so the capability is pointless. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_capabilities.c | 2 -- src/qemu/qemu_capabilities.h | 1 - src/qemu/qemu_command.c | 3 +-- src/qemu/qemu_validate.c | 14 +------------- tests/qemucapabilitiesdata/caps_2.11.0.x86_64.xml | 1 - tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml | 1 - tests/qemucapabilitiesdata/caps_3.0.0.x86_64.xml | 1 - tests/qemucapabilitiesdata/caps_3.1.0.x86_64.xml | 1 - tests/qemucapabilitiesdata/caps_4.0.0.x86_64.xml | 1 - tests/qemucapabilitiesdata/caps_4.1.0.x86_64.xml | 1 - tests/qemucapabilitiesdata/caps_4.2.0.x86_64.xml | 1 - tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml | 1 - tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml | 1 - tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml | 1 - tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml | 1 - tests/qemucapabilitiesdata/caps_6.1.0.x86_64.xml | 1 - .../pc-i440fx-acpi-hotplug-bridge-disable.err | 1 - .../q35-acpi-hotplug-bridge-disable.err | 2 +- tests/qemuxml2argvtest.c | 4 +--- tests/qemuxml2xmltest.c | 6 ++---- 20 files changed, 6 insertions(+), 39 deletions(-) delete mode 100644 tests/qemuxml2argvdata/pc-i440fx-acpi-hotplug-bridge-disable.err diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index c4d0e1858c..e95a44517e 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -644,7 +644,6 @@ VIR_ENUM_IMPL(virQEMUCaps, "virtio-mem-pci", /* QEMU_CAPS_DEVICE_VIRTIO_MEM_PCI */ "memory-backend-file.reserve", /* QEMU_CAPS_MEMORY_BACKEND_RESERVE */ "piix4.acpi-root-pci-hotplug", /* QEMU_CAPS_PIIX4_ACPI_ROOT_PCI_HOTPLUG */ - "piix4.acpi-hotplug-bridge", /* QEMU_CAPS_PIIX4_ACPI_HOTPLUG_BRIDGE */ "ich9.acpi-hotplug-bridge", /* QEMU_CAPS_ICH9_ACPI_HOTPLUG_BRIDGE */ ); @@ -1474,7 +1473,6 @@ static struct virQEMUCapsDevicePropsFlags virQEMUCapsDevicePropsPiix4PM[] = { { "disable_s3", QEMU_CAPS_PIIX_DISABLE_S3, NULL }, { "disable_s4", QEMU_CAPS_PIIX_DISABLE_S4, NULL }, { "acpi-root-pci-hotplug", QEMU_CAPS_PIIX4_ACPI_ROOT_PCI_HOTPLUG, NULL }, - { "acpi-pci-hotplug-with-bridge-support", QEMU_CAPS_PIIX4_ACPI_HOTPLUG_BRIDGE, NULL }, }; static struct virQEMUCapsDevicePropsFlags virQEMUCapsDevicePropsUSBRedir[] = { diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index e9bd6c8885..92337d2503 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -624,7 +624,6 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */ QEMU_CAPS_DEVICE_VIRTIO_MEM_PCI, /* -device virtio-mem-pci */ QEMU_CAPS_MEMORY_BACKEND_RESERVE, /* -object memory-backend-*.reserve= */ QEMU_CAPS_PIIX4_ACPI_ROOT_PCI_HOTPLUG, /* -M pc PIIX4_PM.acpi-root-pci-hotplug */ - QEMU_CAPS_PIIX4_ACPI_HOTPLUG_BRIDGE, /* -M pc PIIX4_PM.acpi-pci-hotplug-with-bridge-support */ QEMU_CAPS_ICH9_ACPI_HOTPLUG_BRIDGE, /* -M q35 ICH9-LPC.acpi-pci-hotplug-with-bridge-support */ QEMU_CAPS_LAST /* this must always be the last item */ diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 995b294736..5b7a3e5bc3 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -6151,8 +6151,7 @@ qemuBuildPMCommandLine(virCommand *cmd, if (acpihp_br != VIR_TRISTATE_SWITCH_ABSENT) { const char *pm_object = NULL; - if (!qemuDomainIsQ35(def) && - virQEMUCapsGet(qemuCaps, QEMU_CAPS_PIIX4_ACPI_HOTPLUG_BRIDGE)) + if (!qemuDomainIsQ35(def)) pm_object = "PIIX4_PM"; if (qemuDomainIsQ35(def) && diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c index be609c9d39..3e573faa4d 100644 --- a/src/qemu/qemu_validate.c +++ b/src/qemu/qemu_validate.c @@ -175,13 +175,9 @@ qemuValidateDomainDefPSeriesFeature(const virDomainDef *def, static int qemuValidateDomainDefPCIFeature(const virDomainDef *def, - virQEMUCaps *qemuCaps, int feature) { size_t i; - bool q35Dom = qemuDomainIsQ35(def); - bool q35cap = q35Dom && virQEMUCapsGet(qemuCaps, - QEMU_CAPS_ICH9_ACPI_HOTPLUG_BRIDGE); if (def->features[feature] == VIR_TRISTATE_SWITCH_ABSENT) return 0; @@ -199,14 +195,6 @@ qemuValidateDomainDefPCIFeature(const virDomainDef *def, virArchToString(def->os.arch)); return -1; } - if (!q35cap && - !virQEMUCapsGet(qemuCaps, - QEMU_CAPS_PIIX4_ACPI_HOTPLUG_BRIDGE)) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("acpi-bridge-hotplug is not available " - "with this QEMU binary")); - return -1; - } break; case VIR_DOMAIN_PCI_LAST: @@ -337,7 +325,7 @@ qemuValidateDomainDefFeatures(const virDomainDef *def, break; case VIR_DOMAIN_FEATURE_PCI: - if (qemuValidateDomainDefPCIFeature(def, qemuCaps, i) < 0) + if (qemuValidateDomainDefPCIFeature(def, i) < 0) return -1; break; case VIR_DOMAIN_FEATURE_SMM: diff --git a/tests/qemucapabilitiesdata/caps_2.11.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_2.11.0.x86_64.xml index 65bfe911dd..d6549d6440 100644 --- a/tests/qemucapabilitiesdata/caps_2.11.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_2.11.0.x86_64.xml @@ -172,7 +172,6 @@ <flag name='am53c974'/> <flag name='cpu-max'/> <flag name='input-linux'/> - <flag name='piix4.acpi-hotplug-bridge'/> <version>2011000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100288</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml index e4d936886b..354a95cebc 100644 --- a/tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml @@ -184,7 +184,6 @@ <flag name='cpu-max'/> <flag name='input-linux'/> <flag name='virtio-blk.queue-size'/> - <flag name='piix4.acpi-hotplug-bridge'/> <version>2011090</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100289</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_3.0.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_3.0.0.x86_64.xml index b903fbe403..cffe482bf6 100644 --- a/tests/qemucapabilitiesdata/caps_3.0.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_3.0.0.x86_64.xml @@ -190,7 +190,6 @@ <flag name='cpu-max'/> <flag name='input-linux'/> <flag name='virtio-blk.queue-size'/> - <flag name='piix4.acpi-hotplug-bridge'/> <version>3000000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100239</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_3.1.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_3.1.0.x86_64.xml index 143edb4e52..514e5985ac 100644 --- a/tests/qemucapabilitiesdata/caps_3.1.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_3.1.0.x86_64.xml @@ -194,7 +194,6 @@ <flag name='input-linux'/> <flag name='query-display-options'/> <flag name='virtio-blk.queue-size'/> - <flag name='piix4.acpi-hotplug-bridge'/> <version>3000092</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100240</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_4.0.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_4.0.0.x86_64.xml index 936726939d..5e733fec13 100644 --- a/tests/qemucapabilitiesdata/caps_4.0.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_4.0.0.x86_64.xml @@ -202,7 +202,6 @@ <flag name='input-linux'/> <flag name='query-display-options'/> <flag name='virtio-blk.queue-size'/> - <flag name='piix4.acpi-hotplug-bridge'/> <version>4000000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100240</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_4.1.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_4.1.0.x86_64.xml index 742e71e4ae..ba9ee0dd96 100644 --- a/tests/qemucapabilitiesdata/caps_4.1.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_4.1.0.x86_64.xml @@ -209,7 +209,6 @@ <flag name='input-linux'/> <flag name='query-display-options'/> <flag name='virtio-blk.queue-size'/> - <flag name='piix4.acpi-hotplug-bridge'/> <version>4001000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100241</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_4.2.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_4.2.0.x86_64.xml index 52d0acef3d..034a770b08 100644 --- a/tests/qemucapabilitiesdata/caps_4.2.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_4.2.0.x86_64.xml @@ -220,7 +220,6 @@ <flag name='input-linux'/> <flag name='query-display-options'/> <flag name='virtio-blk.queue-size'/> - <flag name='piix4.acpi-hotplug-bridge'/> <version>4002000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100242</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml index ccd7e53ea8..aae5fe018f 100644 --- a/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml @@ -227,7 +227,6 @@ <flag name='input-linux'/> <flag name='query-display-options'/> <flag name='virtio-blk.queue-size'/> - <flag name='piix4.acpi-hotplug-bridge'/> <version>5000000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100241</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml index 267a3acd9d..e9ae3c5abb 100644 --- a/tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml @@ -230,7 +230,6 @@ <flag name='query-display-options'/> <flag name='virtio-blk.queue-size'/> <flag name='virtio-mem-pci'/> - <flag name='piix4.acpi-hotplug-bridge'/> <version>5001000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100242</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml index 2be17f0e45..98b5f34f2b 100644 --- a/tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml @@ -232,7 +232,6 @@ <flag name='virtio-blk.queue-size'/> <flag name='virtio-mem-pci'/> <flag name='piix4.acpi-root-pci-hotplug'/> - <flag name='piix4.acpi-hotplug-bridge'/> <version>5002000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100243</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml index 9070eb85aa..f13a909314 100644 --- a/tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml @@ -240,7 +240,6 @@ <flag name='virtio-blk.queue-size'/> <flag name='virtio-mem-pci'/> <flag name='piix4.acpi-root-pci-hotplug'/> - <flag name='piix4.acpi-hotplug-bridge'/> <version>6000000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100242</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_6.1.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_6.1.0.x86_64.xml index 01833aff4b..9c9f17a83d 100644 --- a/tests/qemucapabilitiesdata/caps_6.1.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_6.1.0.x86_64.xml @@ -243,7 +243,6 @@ <flag name='virtio-mem-pci'/> <flag name='memory-backend-file.reserve'/> <flag name='piix4.acpi-root-pci-hotplug'/> - <flag name='piix4.acpi-hotplug-bridge'/> <flag name='ich9.acpi-hotplug-bridge'/> <version>6001000</version> <kvmVersion>0</kvmVersion> diff --git a/tests/qemuxml2argvdata/pc-i440fx-acpi-hotplug-bridge-disable.err b/tests/qemuxml2argvdata/pc-i440fx-acpi-hotplug-bridge-disable.err deleted file mode 100644 index 8c09a3cd76..0000000000 --- a/tests/qemuxml2argvdata/pc-i440fx-acpi-hotplug-bridge-disable.err +++ /dev/null @@ -1 +0,0 @@ -unsupported configuration: acpi-bridge-hotplug is not available with this QEMU binary diff --git a/tests/qemuxml2argvdata/q35-acpi-hotplug-bridge-disable.err b/tests/qemuxml2argvdata/q35-acpi-hotplug-bridge-disable.err index 8c09a3cd76..03c57b805d 100644 --- a/tests/qemuxml2argvdata/q35-acpi-hotplug-bridge-disable.err +++ b/tests/qemuxml2argvdata/q35-acpi-hotplug-bridge-disable.err @@ -1 +1 @@ -unsupported configuration: acpi-bridge-hotplug is not available with this QEMU binary +unsupported configuration: The 'i82801b11-bridge' device is not supported by this QEMU binary diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 116ba714eb..b2a5c58bae 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -2570,10 +2570,8 @@ mymain(void) DO_TEST("pc-i440fx-acpi-hotplug-bridge-disable", QEMU_CAPS_DEVICE_PCI_BRIDGE, QEMU_CAPS_DEVICE_IOH3420, - QEMU_CAPS_DEVICE_DMI_TO_PCI_BRIDGE, - QEMU_CAPS_PIIX4_ACPI_HOTPLUG_BRIDGE); + QEMU_CAPS_DEVICE_DMI_TO_PCI_BRIDGE); DO_TEST_PARSE_ERROR_NOCAPS("q35-acpi-hotplug-bridge-disable"); - DO_TEST_PARSE_ERROR_NOCAPS("pc-i440fx-acpi-hotplug-bridge-disable"); /* verify that we fail when acpi-bridge-hotplug option is specified for * archs other than x86 */ diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c index 2e622c002f..ba2d9652cd 100644 --- a/tests/qemuxml2xmltest.c +++ b/tests/qemuxml2xmltest.c @@ -428,10 +428,8 @@ mymain(void) QEMU_CAPS_PIIX4_ACPI_ROOT_PCI_HOTPLUG); DO_TEST("pc-i440fx-acpi-root-hotplug-enable", QEMU_CAPS_PIIX4_ACPI_ROOT_PCI_HOTPLUG); - DO_TEST("pc-i440fx-acpi-hotplug-bridge-disable", - QEMU_CAPS_PIIX4_ACPI_HOTPLUG_BRIDGE); - DO_TEST("pc-i440fx-acpi-hotplug-bridge-enable", - QEMU_CAPS_PIIX4_ACPI_HOTPLUG_BRIDGE); + DO_TEST_NOCAPS("pc-i440fx-acpi-hotplug-bridge-disable"); + DO_TEST_NOCAPS("pc-i440fx-acpi-hotplug-bridge-enable"); DO_TEST("q35-acpi-hotplug-bridge-disable", QEMU_CAPS_DEVICE_PCI_BRIDGE, QEMU_CAPS_DEVICE_IOH3420, -- 2.31.1

2 2

[libvirt PATCH 0/5] Add virCPUDataIsIdentical
by Tim Wiederhake 11 Oct '21

11 Oct '21

A function to compare two `virCPUData` objects. This is a prerequisite for a later series, that will add the host's cpuid information to the cpu flag cache as per [1], to solve BZ 1953389 [2]. [1] https://listman.redhat.com/archives/libvir-list/2021-August/msg00293.html [2] https://bugzilla.redhat.com/show_bug.cgi?id=1953389 Tim Wiederhake (5): cpu_arm: No need to protect macro definitions cpu: Add virCPUDataIsIdentical cpu_x86: Implement virCPUDataIsIdentical for x86 cpu_arm: Implement virCPUDataIsIdentical for arm cpu_ppc64: Implement virCPUDataIsIdentical for ppc64 src/cpu/cpu.c | 29 +++++++++++++++++ src/cpu/cpu.h | 9 ++++++ src/cpu/cpu_arm.c | 34 +++++++++++++++++--- src/cpu/cpu_ppc64.c | 26 +++++++++++++++ src/cpu/cpu_x86.c | 69 ++++++++++++++++++++++++++++++++++++++++ src/libvirt_private.syms | 1 + 6 files changed, 164 insertions(+), 4 deletions(-) -- 2.31.1

1 5

[libvirt PATCH 00/21] qemu: Implement virtio-iommu support
by Andrea Bolognani 11 Oct '21

11 Oct '21

The first couple of patches add replies files and as such have been aggressively snipped to deal with mailing list message size limits. Grab the unabriged version with $ git fetch https://gitlab.com/abologna/libvirt.git virtio-iommu As noted in those patches, some of the QEMU changes this series depends on have not yet been accepted upstream: the relevant patches are https://lists.gnu.org/archive/html/qemu-devel/2021-10/msg00161.html https://lists.gnu.org/archive/html/qemu-devel/2021-09/msg07819.html and of course this series should only be merged once those have gone in. Andrea Bolognani (21): DONOTMERGEYET: Add replies for QEMU 6.2.0 on x86_64 DONOTMERGEYET: Add replies for QEMU 6.2.0 on aarch64 conf: Make virDomainDeviceInfoFormat() const correct conf: Introduce VIR_PCI_CONNECT_INTEGRATED conf: Add IOMMU support to virDomainDeviceDefCopy() conf: Add new/free functions for virDomainIOMMUDef qemu: Tweak some code qemu: Introduce QEMU_CAPS_DEVICE_VIRTIO_IOMMU_PCI qemu: Introduce QEMU_CAPS_VIRTIO_IOMMU_BOOT_BYPASS conf: Introduce virtio model for <iommu> tests: Add test cases for virtio-iommu qemu: Validate machine type used with virtio-iommu qemu: Validate capabilities for virtio-iommu qemu: Validate use of ACPI with virtio-iommu conf: Add virDomainDeviceInfo to virDomainIOMMUDef qemu: Assign PCI address to virtio-iommu qemu: Validate address type for virtio-iommu tests: Add test for virtio-iommu address qemu: Generate command line for virtio-iommu docs: Document virtio-iommu news: Document virtio-iommu NEWS.rst | 4 + docs/formatdomain.rst | 5 +- docs/schemas/domaincommon.rng | 64 +- src/conf/domain_addr.c | 21 +- src/conf/domain_addr.h | 30 +- src/conf/domain_conf.c | 74 +- src/conf/domain_conf.h | 5 + src/qemu/qemu_capabilities.c | 10 + src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_command.c | 35 +- src/qemu/qemu_domain_address.c | 33 +- src/qemu/qemu_validate.c | 32 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 220 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 226 + .../qemu_6.2.0-virt.aarch64.xml | 184 + tests/domaincapsdata/qemu_6.2.0.aarch64.xml | 178 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 220 + .../caps_5.0.0.aarch64.replies | 71 +- .../caps_5.0.0.aarch64.xml | 1 + .../caps_5.0.0.ppc64.replies | 59 +- .../qemucapabilitiesdata/caps_5.0.0.ppc64.xml | 1 + .../caps_5.0.0.riscv64.replies | 55 +- .../caps_5.0.0.riscv64.xml | 1 + .../caps_5.0.0.x86_64.replies | 71 +- .../caps_5.0.0.x86_64.xml | 1 + .../caps_5.1.0.x86_64.replies | 71 +- .../caps_5.1.0.x86_64.xml | 1 + .../caps_5.2.0.aarch64.replies | 71 +- .../caps_5.2.0.aarch64.xml | 1 + .../caps_5.2.0.ppc64.replies | 59 +- .../qemucapabilitiesdata/caps_5.2.0.ppc64.xml | 1 + .../caps_5.2.0.riscv64.replies | 55 +- .../caps_5.2.0.riscv64.xml | 1 + .../caps_5.2.0.s390x.replies | 59 +- .../qemucapabilitiesdata/caps_5.2.0.s390x.xml | 1 + .../caps_5.2.0.x86_64.replies | 71 +- .../caps_5.2.0.x86_64.xml | 1 + .../caps_6.0.0.aarch64.replies | 71 +- .../caps_6.0.0.aarch64.xml | 1 + .../caps_6.0.0.s390x.replies | 59 +- .../qemucapabilitiesdata/caps_6.0.0.s390x.xml | 1 + .../caps_6.0.0.x86_64.replies | 71 +- .../caps_6.0.0.x86_64.xml | 1 + .../caps_6.1.0.x86_64.replies | 71 +- .../caps_6.1.0.x86_64.xml | 1 + ...h64.replies => caps_6.2.0.aarch64.replies} | 5621 ++++++++++------- ...0.0.aarch64.xml => caps_6.2.0.aarch64.xml} | 57 +- ...6_64.replies => caps_6.2.0.x86_64.replies} | 4154 +++++++----- ...6.1.0.x86_64.xml => caps_6.2.0.x86_64.xml} | 85 +- .../virtio-iommu-aarch64.aarch64-latest.args | 35 + .../qemuxml2argvdata/virtio-iommu-aarch64.xml | 20 + ...mmu-invalid-address-type.x86_64-latest.err | 1 + .../virtio-iommu-invalid-address-type.xml | 20 + ...io-iommu-invalid-address.x86_64-latest.err | 1 + .../virtio-iommu-invalid-address.xml | 20 + .../virtio-iommu-no-acpi.x86_64-latest.err | 1 + .../qemuxml2argvdata/virtio-iommu-no-acpi.xml | 15 + ...rtio-iommu-wrong-machine.x86_64-latest.err | 1 + .../virtio-iommu-wrong-machine.xml | 18 + .../virtio-iommu-x86_64.x86_64-6.1.0.err | 1 + .../virtio-iommu-x86_64.x86_64-latest.args | 31 + .../qemuxml2argvdata/virtio-iommu-x86_64.xml | 18 + tests/qemuxml2argvtest.c | 7 + .../virtio-iommu-aarch64.aarch64-latest.xml | 34 + .../virtio-iommu-x86_64.x86_64-latest.xml | 36 + tests/qemuxml2xmltest.c | 2 + 66 files changed, 8192 insertions(+), 4257 deletions(-) create mode 100644 tests/domaincapsdata/qemu_6.2.0-q35.x86_64.xml create mode 100644 tests/domaincapsdata/qemu_6.2.0-tcg.x86_64.xml create mode 100644 tests/domaincapsdata/qemu_6.2.0-virt.aarch64.xml create mode 100644 tests/domaincapsdata/qemu_6.2.0.aarch64.xml create mode 100644 tests/domaincapsdata/qemu_6.2.0.x86_64.xml copy tests/qemucapabilitiesdata/{caps_6.0.0.aarch64.replies => caps_6.2.0.aarch64.replies} (92%) copy tests/qemucapabilitiesdata/{caps_6.0.0.aarch64.xml => caps_6.2.0.aarch64.xml} (92%) copy tests/qemucapabilitiesdata/{caps_6.1.0.x86_64.replies => caps_6.2.0.x86_64.replies} (96%) copy tests/qemucapabilitiesdata/{caps_6.1.0.x86_64.xml => caps_6.2.0.x86_64.xml} (97%) create mode 100644 tests/qemuxml2argvdata/virtio-iommu-aarch64.aarch64-latest.args create mode 100644 tests/qemuxml2argvdata/virtio-iommu-aarch64.xml create mode 100644 tests/qemuxml2argvdata/virtio-iommu-invalid-address-type.x86_64-latest.err create mode 100644 tests/qemuxml2argvdata/virtio-iommu-invalid-address-type.xml create mode 100644 tests/qemuxml2argvdata/virtio-iommu-invalid-address.x86_64-latest.err create mode 100644 tests/qemuxml2argvdata/virtio-iommu-invalid-address.xml create mode 100644 tests/qemuxml2argvdata/virtio-iommu-no-acpi.x86_64-latest.err create mode 100644 tests/qemuxml2argvdata/virtio-iommu-no-acpi.xml create mode 100644 tests/qemuxml2argvdata/virtio-iommu-wrong-machine.x86_64-latest.err create mode 100644 tests/qemuxml2argvdata/virtio-iommu-wrong-machine.xml create mode 100644 tests/qemuxml2argvdata/virtio-iommu-x86_64.x86_64-6.1.0.err create mode 100644 tests/qemuxml2argvdata/virtio-iommu-x86_64.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/virtio-iommu-x86_64.xml create mode 100644 tests/qemuxml2xmloutdata/virtio-iommu-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxml2xmloutdata/virtio-iommu-x86_64.x86_64-latest.xml -- 2.31.1

2 23

[PATCH] apparmor: ceph config file names
by christian.ehrhardt＠canonical.com 11 Oct '21

11 Oct '21

From: Christian Ehrhardt <christian.ehrhardt(a)canonical.com> If running multiple [1] clusters (uncommon) the ceph config file will be derived from the cluster name. Therefore the rule to allow to read ceph config files need to be opened up slightly to allow for that condition. [1]: https://docs.ceph.com/en/mimic/rados/configuration/common/#running-multiple… Fixes: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1588576 Signed-off-by: Christian Ehrhardt <christian.ehrhardt(a)canonical.com> --- src/security/apparmor/libvirt-qemu | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu index 4156428163..8cd76d48ec 100644 --- a/src/security/apparmor/libvirt-qemu +++ b/src/security/apparmor/libvirt-qemu @@ -199,7 +199,7 @@ /sys/class/ r, # for rbd - /etc/ceph/ceph.conf r, + /etc/ceph/*.conf r, # Various functions will need to enumerate /tmp (e.g. ceph), allow the base # dir and a few known functions like samba support. -- 2.33.0

4 3

[PATCH] libvirt qemu add rbd mirror dest in qemuDomainBlockCopyCommon
by dinglimin＠cmss.chinamobile.com 10 Oct '21

10 Oct '21

From: dinglimin <dinglimin(a)cmss.chinamobile.com> The BlockCopy command is designed to copy a chain of disk backup images to dest. For RBD external destination, before the modification, only the '--XML' parameter is supported by 'blockdev-mirror'. After the modification, the '--dest' parameter(--dest 'rbd:xxx/xxx:auth_supported=none:mon_host=xxx.xxx.xxx.xxx')can be used. Signed-off-by: dinglimin <dinglimin(a)cmss.chinamobile.com> --- src/qemu/qemu_driver.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 760d30a..db15898 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -14963,12 +14963,27 @@ qemuDomainBlockCopyCommon(virDomainObj *vm, virStorageSource *mirrorBacking = NULL; g_autoptr(GHashTable) blockNamedNodeData = NULL; int rc = 0; + const char *p = NULL; /* Preliminaries: find the disk we are editing, sanity checks */ virCheckFlags(VIR_DOMAIN_BLOCK_COPY_SHALLOW | VIR_DOMAIN_BLOCK_COPY_REUSE_EXT | VIR_DOMAIN_BLOCK_COPY_TRANSIENT_JOB, -1); + /* if mirror->path contains 'rbd:' prefix, set rbd attributes */ + if (STRPREFIX(mirror->path, "rbd:")) { + mirror->format = VIR_STORAGE_FILE_RAW; + mirror->protocol = VIR_STORAGE_NET_PROTOCOL_RBD; + mirror->type = VIR_STORAGE_TYPE_NETWORK; + + p = g_strdup(mirror->path); + if (virStorageSourceParseRBDColonString(p, mirror) < 0) { + virReportError(VIR_ERR_INVALID_ARG, "%s", + _("RBD path conversion failed")); + return -1; + } + } + if (virStorageSourceIsRelative(mirror)) { virReportError(VIR_ERR_INVALID_ARG, "%s", _("absolute path must be used as block copy target")); -- 1.8.3.1

2 2

Module/Tool/SO to convert from KVM-xml => QEMU-native?
by Ajay Garg 10 Oct '21

10 Oct '21

Hi All. Following has been done : 1. "sudo apt-get install virt-manager" Above installed all packages required for libvirt/kvm/qemu via apt, and a vm was setup successfully. Also, the vm booting works fine, when the green start-button of virt-manager is clicked. 2. Next, qemu was compiled from sources, and only and only the following was replaced, as : "sudo cp build/qemu-system-x86_64 /usr/bin/qemu-system-x86_64" 3. Now, if the green-button on the virt-manager is clicked, following error is seen : ########################################################## Please use server=on instead qemu-system-x86_64: -chardev socket,id=charmonitor,fd=31,server,nowait: warning: short-form boolean option 'nowait' deprecated Please use wait=off instead qemu-system-x86_64: -spice port=5900,addr=127.0.0.1,disable-ticketing,image-compression=off,seamless-migration=on: warning: short-form boolean option 'disable-ticketing' deprecated Please use disable-ticketing=on instead ########################################################## So, what are the minimum libvirt modules that need to be replaced, so that upon booting up, the kvm-xml is converted to qemu-native in the latest qemu-compatible format? Thanks and Regards, Ajay

1 2

[PATCH RFC 0/5] Subject: [PATCH RFC 0/5] qapi: Add feature flags to enum members
by Markus Armbruster 09 Oct '21

09 Oct '21

PATCH 1+2 add feature flags to enum members. Awkward due to an introspection design mistake; see PATCH 1 for details. Feedback welcome, in particular from management application guys. PATCH 3+4 implement policy deprecated-input={reject,crash} for enum values. Policy deprecated-output=hide is not implemented, because we can't hide a value without hiding the entire member, which is almost certainly more than the requester of this policy bargained for. Perhaps we want a new policy deprecated-output=crash to help us catch unwanted use of deprecated enum values. Thoughts? PATCH 5 puts the new feature flags to use. It makes sense only on top of Vladimir's deprecation of drive-backup. See its commit message for a reference. Based on my "[PATCH 00/22] qapi: Remove simple unions from the schema language". Based-on: Message-Id: <20210913123932.3306639-1-armbru(a)redhat.com> Markus Armbruster (5): qapi: Enable enum member introspection to show more than name qapi: Add feature flags to enum members qapi: Move compat policy from QObject to generic visitor qapi: Implement deprecated-input={reject,crash} for enum values block: Deprecate transaction type drive-backup docs/devel/qapi-code-gen.rst | 4 ++- qapi/compat.json | 3 +++ qapi/introspect.json | 23 ++++++++++++++-- qapi/transaction.json | 5 +++- include/qapi/qobject-input-visitor.h | 4 --- include/qapi/qobject-output-visitor.h | 4 --- include/qapi/util.h | 6 ++++- include/qapi/visitor-impl.h | 3 +++ include/qapi/visitor.h | 9 +++++++ qapi/qapi-visit-core.c | 27 ++++++++++++++++--- qapi/qmp-dispatch.c | 4 +-- qapi/qobject-input-visitor.c | 14 +--------- qapi/qobject-output-visitor.c | 14 +--------- scripts/qapi/expr.py | 3 ++- scripts/qapi/introspect.py | 19 ++++++++++--- scripts/qapi/schema.py | 22 +++++++++++++-- scripts/qapi/types.py | 17 +++++++++++- tests/qapi-schema/doc-good.json | 5 +++- tests/qapi-schema/doc-good.out | 3 +++ tests/qapi-schema/doc-good.txt | 3 +++ .../qapi-schema/enum-dict-member-unknown.err | 2 +- tests/qapi-schema/qapi-schema-test.json | 3 ++- tests/qapi-schema/qapi-schema-test.out | 1 + tests/qapi-schema/test-qapi.py | 1 + 24 files changed, 144 insertions(+), 55 deletions(-) -- 2.31.1

4 18

Squelch 'eof from qemu monitor' error on normal VM shutdown
by Jim Fehlig 08 Oct '21

08 Oct '21

Hi All, Likely Christian received a bug report that motivated commit aeda1b8c56, which was later reverted by Michal with commit 72adaf2f10. In the past, I recall being asked about "internal error: End of file from qemu monitor" on normal VM shutdown and gave a hand wavy response using some of Michal's words from the revert commit message. I recently received a bug report (sorry, but no public link) from a concerned user about this error and wondered if there is some way to improve it? I went down some dead ends before circling back to Christian's patch. When rebased to latest master, I cannot reproduce the hangs reported by Michal [1]. Perhaps Nikolay's series to resolve hangs/crashes of libvirtd [2] has now made Christian's patch viable? Regards Jim [1] https://bugzilla.redhat.com/show_bug.cgi?id=1536461 [2] https://listman.redhat.com/archives/libvir-list/2020-July/msg01606.html

3 6

[PATCH v3] qemu: tpm: Run swtpm_setup --create-config-files in session mode
by Stefan Berger 08 Oct '21

08 Oct '21

Using swtpm v0.7.0 we can run swtpm_setup to create default config files for swtpm_setup and swtpm-localca in session mode. Now a user can start a VM with an attached TPM without having to run this program on the command line before. This program needs to run once. This patch addresses the issue raised in https://bugzilla.redhat.com/show_bug.cgi?id=2010649 Signed-off-by: Stefan Berger <stefanb(a)linux.ibm.com> --- v3: - Removed logfile parameter v2: - fixed return code if swtpm_setup doesn't support the option --- src/qemu/qemu_tpm.c | 39 +++++++++++++++++++++++++++++++++++++++ src/util/virtpm.c | 1 + src/util/virtpm.h | 1 + 3 files changed, 41 insertions(+) diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index 100481503c..434c357c24 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -385,6 +385,42 @@ qemuTPMSetupEncryption(const unsigned char *secretuuid, return virCommandSetSendBuffer(cmd, g_steal_pointer(&secret), secret_len); } + +/* + * qemuTPMCreateConfigFiles: run swtpm_setup --create-config-files skip-if-exist + */ +static int +qemuTPMCreateConfigFiles(void) +{ + g_autofree char *swtpm_setup = virTPMGetSwtpmSetup(); + g_autoptr(virCommand) cmd = NULL; + int exitstatus; + + if (!swtpm_setup) + return -1; + + if (!virTPMSwtpmSetupCapsGet( + VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_CREATE_CONFIG_FILES)) + return 0; + + cmd = virCommandNew(swtpm_setup); + if (!cmd) + return -1; + + virCommandAddArgList(cmd, "--create-config-files", "skip-if-exist", NULL); + virCommandClearCaps(cmd); + + if (virCommandRun(cmd, &exitstatus) < 0 || exitstatus != 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Could not run '%s' to create config files. exitstatus: %d", + swtpm_setup, exitstatus); + return -1; + } + + return 0; +} + + /* * qemuTPMEmulatorRunSetup * @@ -432,6 +468,9 @@ qemuTPMEmulatorRunSetup(const char *storagepath, "this requires privileged mode for a " "TPM 1.2\n"), 0600); + if (!privileged && qemuTPMCreateConfigFiles()) + return -1; + cmd = virCommandNew(swtpm_setup); if (!cmd) return -1; diff --git a/src/util/virtpm.c b/src/util/virtpm.c index 1a567139b4..0f50de866c 100644 --- a/src/util/virtpm.c +++ b/src/util/virtpm.c @@ -45,6 +45,7 @@ VIR_ENUM_IMPL(virTPMSwtpmFeature, VIR_ENUM_IMPL(virTPMSwtpmSetupFeature, VIR_TPM_SWTPM_SETUP_FEATURE_LAST, "cmdarg-pwdfile-fd", + "cmdarg-create-config-files", ); /** diff --git a/src/util/virtpm.h b/src/util/virtpm.h index d021a083b4..3bb03b3b33 100644 --- a/src/util/virtpm.h +++ b/src/util/virtpm.h @@ -38,6 +38,7 @@ typedef enum { typedef enum { VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_PWDFILE_FD, + VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_CREATE_CONFIG_FILES, VIR_TPM_SWTPM_SETUP_FEATURE_LAST } virTPMSwtpmSetupFeature; -- 2.31.1

2 3