March 2021 - Devel - libvirt List Archives

[libvirt PATCH] conf: remove duplicated firmware type attribute
by Daniel P. Berrangé 29 Mar '21

29 Mar '21

The <os firmware='efi'> <firmware type='efi'> <feature enabled='no' name='enrolled-keys'/> </firmware> </os> repeats the firmware attribute twice. This has no functional benefit, as evidenced by fact that we use a single struct field to store both attributes, while needlessly introducing an error scenario. The XML can just be simplified to: <os firmware='efi'> <firmware> <feature enabled='no' name='enrolled-keys'/> </firmware> </os> which also means that we don't need to emit the empty element <firmware type='efi'/> for all existing configs too. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- docs/formatdomain.rst | 8 ---- docs/schemas/domaincommon.rng | 10 +--- src/conf/domain_conf.c | 48 ++++++------------- .../os-firmware-efi-no-enrolled-keys.xml | 2 +- .../os-firmware-invalid-type.xml | 28 ----------- tests/qemuxml2argvtest.c | 1 - ...aarch64-os-firmware-efi.aarch64-latest.xml | 1 - .../os-firmware-bios.x86_64-latest.xml | 1 - .../os-firmware-efi-secboot.x86_64-latest.xml | 1 - .../os-firmware-efi.x86_64-latest.xml | 1 - tests/vmx2xmldata/vmx2xml-firmware-efi.xml | 1 - 11 files changed, 18 insertions(+), 84 deletions(-) delete mode 100644 tests/qemuxml2argvdata/os-firmware-invalid-type.xml diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index 9392c80113..741130bf21 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -158,14 +158,6 @@ harddisk, cdrom, network) determining where to obtain/find the boot image. ``firmware`` :since:`Since 7.2.0 QEMU/KVM only` - When used together with ``firmware`` attribute of ``os`` element the ``type`` - attribute must have the same value. - - List of mandatory attributes: - - - ``type`` (accepted values are ``bios`` and ``efi``) same as the ``firmware`` - attribute of ``os`` element. - When using firmware auto-selection there are different features enabled in the firmwares. The list of features can be used to limit what firmware should be automatically selected for the VM. The list of features can be specified diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index 1dbfc68f18..f5ced5b7a2 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -278,13 +278,7 @@ <ref name="ostypehvm"/> <optional> <element name="firmware"> - <attribute name="type"> - <choice> - <value>bios</value> - <value>efi</value> - </choice> - </attribute> - <zeroOrMore> + <oneOrMore> <element name="feature"> <attribute name="enabled"> <ref name="virYesNo"/> @@ -296,7 +290,7 @@ </choice> </attribute> </element> - </zeroOrMore> + </oneOrMore> </element> </optional> <optional> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index b0eba9f7bd..d050a519c6 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -19590,31 +19590,21 @@ virDomainDefParseBootFirmwareOptions(virDomainDefPtr def, xmlXPathContextPtr ctxt) { g_autofree char *firmware = virXPathString("string(./os/@firmware)", ctxt); - g_autofree char *type = virXPathString("string(./os/firmware/@type)", ctxt); g_autofree xmlNodePtr *nodes = NULL; g_autofree int *features = NULL; int fw = 0; int n = 0; size_t i; - if (!firmware && !type) + if (!firmware) return 0; - if (firmware && type && STRNEQ(firmware, type)) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("firmware attribute and firmware type has to be the same")); - return -1; - } - - if (!type) - type = g_steal_pointer(&firmware); - - fw = virDomainOsDefFirmwareTypeFromString(type); + fw = virDomainOsDefFirmwareTypeFromString(firmware); if (fw <= 0) { virReportError(VIR_ERR_XML_ERROR, _("unknown firmware value %s"), - type); + firmware); return -1; } @@ -29491,30 +29481,22 @@ virDomainDefFormatInternalSetRootName(virDomainDefPtr def, virBufferAsprintf(buf, ">%s</type>\n", virDomainOSTypeToString(def->os.type)); - if (def->os.firmware) { - virBufferAsprintf(buf, "<firmware type='%s'", - virDomainOsDefFirmwareTypeToString(def->os.firmware)); - - if (def->os.firmwareFeatures) { - virBufferAddLit(buf, ">\n"); - - virBufferAdjustIndent(buf, 2); + if (def->os.firmwareFeatures) { + virBufferAddLit(buf, "<firmware>\n"); + virBufferAdjustIndent(buf, 2); - for (i = 0; i < VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_LAST; i++) { - if (def->os.firmwareFeatures[i] == VIR_TRISTATE_BOOL_ABSENT) - continue; + for (i = 0; i < VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_LAST; i++) { + if (def->os.firmwareFeatures[i] == VIR_TRISTATE_BOOL_ABSENT) + continue; - virBufferAsprintf(buf, "<feature enabled='%s' name='%s'/>\n", - virTristateBoolTypeToString(def->os.firmwareFeatures[i]), - virDomainOsDefFirmwareFeatureTypeToString(i)); - } + virBufferAsprintf(buf, "<feature enabled='%s' name='%s'/>\n", + virTristateBoolTypeToString(def->os.firmwareFeatures[i]), + virDomainOsDefFirmwareFeatureTypeToString(i)); + } - virBufferAdjustIndent(buf, -2); + virBufferAdjustIndent(buf, -2); - virBufferAddLit(buf, "</firmware>\n"); - } else { - virBufferAddLit(buf, "/>\n"); - } + virBufferAddLit(buf, "</firmware>\n"); } virBufferEscapeString(buf, "<init>%s</init>\n", diff --git a/tests/qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml b/tests/qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml index 8944ce70bb..352908f745 100644 --- a/tests/qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml +++ b/tests/qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml @@ -6,7 +6,7 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> - <firmware type='efi'> + <firmware> <feature enabled='no' name='enrolled-keys'/> </firmware> <boot dev='hd'/> diff --git a/tests/qemuxml2argvdata/os-firmware-invalid-type.xml b/tests/qemuxml2argvdata/os-firmware-invalid-type.xml deleted file mode 100644 index 41360df0f7..0000000000 --- a/tests/qemuxml2argvdata/os-firmware-invalid-type.xml +++ /dev/null @@ -1,28 +0,0 @@ -<domain type='kvm'> - <name>fedora</name> - <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> - <memory unit='KiB'>8192</memory> - <currentMemory unit='KiB'>8192</currentMemory> - <vcpu placement='static'>1</vcpu> - <os firmware='efi'> - <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> - <firmware type='bios'/> - <loader secure='no'/> - <nvram>/var/lib/libvirt/qemu/nvram/fedora_VARS.fd</nvram> - <boot dev='hd'/> - <bootmenu enable='yes'/> - </os> - <features> - <acpi/> - <apic/> - <pae/> - </features> - <clock offset='utc'/> - <on_poweroff>destroy</on_poweroff> - <on_reboot>restart</on_reboot> - <on_crash>restart</on_crash> - <devices> - <emulator>/usr/bin/qemu-system-x86_64</emulator> - <memballoon model='none'/> - </devices> -</domain> diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 12c2b68fd7..3439f34ef1 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -3582,7 +3582,6 @@ mymain(void) DO_TEST_CAPS_LATEST("os-firmware-efi"); DO_TEST_CAPS_LATEST("os-firmware-efi-secboot"); DO_TEST_CAPS_LATEST("os-firmware-efi-no-enrolled-keys"); - DO_TEST_CAPS_LATEST_PARSE_ERROR("os-firmware-invalid-type"); DO_TEST_CAPS_ARCH_LATEST("aarch64-os-firmware-efi", "aarch64"); DO_TEST_CAPS_LATEST("vhost-user-vga"); diff --git a/tests/qemuxml2xmloutdata/aarch64-os-firmware-efi.aarch64-latest.xml b/tests/qemuxml2xmloutdata/aarch64-os-firmware-efi.aarch64-latest.xml index cb4f3ccfce..627e285ae1 100644 --- a/tests/qemuxml2xmloutdata/aarch64-os-firmware-efi.aarch64-latest.xml +++ b/tests/qemuxml2xmloutdata/aarch64-os-firmware-efi.aarch64-latest.xml @@ -6,7 +6,6 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='aarch64' machine='virt-4.0'>hvm</type> - <firmware type='efi'/> <kernel>/aarch64.kernel</kernel> <initrd>/aarch64.initrd</initrd> <cmdline>earlyprintk console=ttyAMA0,115200n8 rw root=/dev/vda rootwait</cmdline> diff --git a/tests/qemuxml2xmloutdata/os-firmware-bios.x86_64-latest.xml b/tests/qemuxml2xmloutdata/os-firmware-bios.x86_64-latest.xml index 016c5b863f..df6f61421a 100644 --- a/tests/qemuxml2xmloutdata/os-firmware-bios.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/os-firmware-bios.x86_64-latest.xml @@ -6,7 +6,6 @@ <vcpu placement='static'>1</vcpu> <os firmware='bios'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> - <firmware type='bios'/> <loader secure='no'/> <nvram>/var/lib/libvirt/qemu/nvram/fedora_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/os-firmware-efi-secboot.x86_64-latest.xml b/tests/qemuxml2xmloutdata/os-firmware-efi-secboot.x86_64-latest.xml index fa5eaa3148..c383546cc6 100644 --- a/tests/qemuxml2xmloutdata/os-firmware-efi-secboot.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/os-firmware-efi-secboot.x86_64-latest.xml @@ -6,7 +6,6 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> - <firmware type='efi'/> <loader secure='yes'/> <nvram>/var/lib/libvirt/qemu/nvram/fedora_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/qemuxml2xmloutdata/os-firmware-efi.x86_64-latest.xml b/tests/qemuxml2xmloutdata/os-firmware-efi.x86_64-latest.xml index 382146c23b..04d57860e7 100644 --- a/tests/qemuxml2xmloutdata/os-firmware-efi.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/os-firmware-efi.x86_64-latest.xml @@ -6,7 +6,6 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> - <firmware type='efi'/> <loader secure='no'/> <nvram>/var/lib/libvirt/qemu/nvram/fedora_VARS.fd</nvram> <boot dev='hd'/> diff --git a/tests/vmx2xmldata/vmx2xml-firmware-efi.xml b/tests/vmx2xmldata/vmx2xml-firmware-efi.xml index fa10daf3a6..fee707fe71 100644 --- a/tests/vmx2xmldata/vmx2xml-firmware-efi.xml +++ b/tests/vmx2xmldata/vmx2xml-firmware-efi.xml @@ -6,7 +6,6 @@ <vcpu placement='static'>1</vcpu> <os firmware='efi'> <type arch='i686'>hvm</type> - <firmware type='efi'/> </os> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> -- 2.30.2

2 2

[libvirt PATCH 0/9] improve firmware auto-selection
by Pavel Hrdina 29 Mar '21

29 Mar '21

Cleanup the parser code and implement firmware feature filtering support to allow users to modify firmware auto-selection behavior per VM. More details in PATCH 08. Pavel Hrdina (9): docs: improve description of secure attribute for loader element conf: introduce virDomainDefParseBootInitOptions conf: introduce virDomainDefParseBootKernelOptions conf: introduce virDomainDefParseBootFirmwareOptions conf: introduce virDomainDefParseBootLoaderOptions conf: introduce virDomainDefParseBootAcpiOptions conf: use switch in virDomainDefParseBootOptions conf: introduce support for firmware auto-selection feature filtering qemu: implement support for firmware auto-selection feature filtering docs/formatdomain.rst | 35 +- docs/schemas/domaincommon.rng | 23 + src/conf/domain_conf.c | 396 ++++++++++++------ src/conf/domain_conf.h | 10 + src/qemu/qemu_firmware.c | 40 ++ .../os-firmware-efi-invalid-type.xml | 28 ++ ...re-efi-no-enrolled-keys.x86_64-latest.args | 49 +++ .../os-firmware-efi-no-enrolled-keys.xml | 25 ++ ...os-firmware-invalid-type.x86_64-latest.err | 1 + .../os-firmware-invalid-type.xml | 28 ++ tests/qemuxml2argvtest.c | 2 + ...aarch64-os-firmware-efi.aarch64-latest.xml | 1 + .../os-firmware-bios.x86_64-latest.xml | 1 + ...are-efi-no-enrolled-keys.x86_64-latest.xml | 50 +++ .../os-firmware-efi-secboot.x86_64-latest.xml | 1 + .../os-firmware-efi.x86_64-latest.xml | 1 + tests/qemuxml2xmltest.c | 1 + tests/vmx2xmldata/vmx2xml-firmware-efi.xml | 1 + 18 files changed, 567 insertions(+), 126 deletions(-) create mode 100644 tests/qemuxml2argvdata/os-firmware-efi-invalid-type.xml create mode 100644 tests/qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/os-firmware-efi-no-enrolled-keys.xml create mode 100644 tests/qemuxml2argvdata/os-firmware-invalid-type.x86_64-latest.err create mode 100644 tests/qemuxml2argvdata/os-firmware-invalid-type.xml create mode 100644 tests/qemuxml2xmloutdata/os-firmware-efi-no-enrolled-keys.x86_64-latest.xml -- 2.30.2

4 21

[PATCH] qemu_driver: Acquire MODIFY job in qemuDomainStartDirtyRateCalc()
by Michal Privoznik 29 Mar '21

29 Mar '21

This API talks to QEMU and changes its internal state. Therefore, it should acquire QEMU_JOB_MODIFY instead of QEMU_JOB_QUERY. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 69dc704a44..af015f0625 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -20425,7 +20425,7 @@ qemuDomainStartDirtyRateCalc(virDomainPtr dom, if (virDomainStartDirtyRateCalcEnsureACL(dom->conn, vm->def) < 0) goto cleanup; - if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_QUERY) < 0) + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0) goto cleanup; if (!virDomainObjIsActive(vm)) { -- 2.26.3

2 1

[libvirt PATCH] remote: don't allow dirty rate API with read permission
by Daniel P. Berrangé 29 Mar '21

29 Mar '21

This API interacts with the hypervisor and makes changes to its behaviour, so must be protected by the write permission. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/remote/remote_protocol.x | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index 7fdc65f029..743c21b316 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -6743,7 +6743,7 @@ enum remote_procedure { /** * @generate: both - * @acl: domain:read + * @acl: domain:write */ REMOTE_PROC_DOMAIN_START_DIRTY_RATE_CALC = 427 }; -- 2.30.2

3 2

[PATCH v1 00/12] libxl: bump LIBXL_API_VERSION
by Olaf Hering 29 Mar '21

29 Mar '21

Various changes to handle libxl API variants. Olaf Olaf Hering (12): libxl: add API wrapper for libxl_domain_create_restore libxl: add API wrapper for libxl_retrieve_domain_configuration libxl: add API wrapper for libxl_domain_shutdown libxl: add API wrapper for libxl_domain_reboot libxl: add API wrapper for libxl_domain_pause libxl: add API wrapper for libxl_domain_unpause libxl: add API wrapper for libxl_domain_need_memory libxl: add API wrapper for libxl_get_free_memory libxl: add API wrapper for libxl_set_vcpuonline libxl: add API wrapper for libxl_send_trigger libxl: add API wrapper for libxl_set_memory_target libxl: use API 4.13 to support domUs with more than 4TB meson.build | 7 +- src/libxl/libxl_api.h | 219 ++++++++++++++++++++++++++++++++++++ src/libxl/libxl_conf.c | 5 +- src/libxl/libxl_domain.c | 23 ++-- src/libxl/libxl_driver.c | 21 ++-- src/libxl/libxl_migration.c | 3 +- tests/libxlmock.c | 7 +- 7 files changed, 259 insertions(+), 26 deletions(-) create mode 100644 src/libxl/libxl_api.h

3 22

[PATCH] src: drop some forward declarations in src/storage/storage_backend_sheepdog.c
by peili 29 Mar '21

29 Mar '21

--- src/storage/storage_backend_sheepdog.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/src/storage/storage_backend_sheepdog.c b/src/storage/storage_backend_sheepdog.c index 8c37947308..010e86aa14 100644 --- a/src/storage/storage_backend_sheepdog.c +++ b/src/storage/storage_backend_sheepdog.c @@ -35,12 +35,6 @@ #define VIR_FROM_THIS VIR_FROM_STORAGE -static int virStorageBackendSheepdogRefreshVol(virStoragePoolObjPtr pool, - virStorageVolDefPtr vol); - -void virStorageBackendSheepdogAddHostArg(virCommandPtr cmd, - virStoragePoolObjPtr pool); - int virStorageBackendSheepdogParseNodeInfo(virStoragePoolDefPtr pool, char *output) -- 2.20.1

3 3

[PATCH] rpc: libssh2: Enable EC host keys
by Bastian Germann 28 Mar '21

28 Mar '21

libssh2 has ECDSA and ED25519 support beginning with v1.9.0. libvirt cannot make use of those because it will handle them as unknown key types. Add support for those host key types. Signed-off-by: Bastian Germann <bastiangermann(a)fishpost.de> --- libvirt.spec.in | 2 +- meson.build | 2 +- src/rpc/virnetsshsession.c | 12 ++++++++++++ 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index f9af330186..8f5b3f126c 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -359,7 +359,7 @@ BuildRequires: libcap-ng-devel >= 0.5.0 BuildRequires: fuse-devel >= 2.8.6 %endif %if %{with_libssh2} -BuildRequires: libssh2-devel >= 1.3.0 +BuildRequires: libssh2-devel >= 1.9.0 %endif %if %{with_netcf} BuildRequires: netcf-devel >= 0.2.2 diff --git a/meson.build b/meson.build index ea93a2a8ec..5e5b22107c 100644 --- a/meson.build +++ b/meson.build @@ -1142,7 +1142,7 @@ else libssh_dep = dependency('', required: false) endif -libssh2_version = '1.3' +libssh2_version = '1.9' if get_option('driver_remote').enabled() libssh2_dep = dependency('libssh2', version: '>=' + libssh2_version, required: get_option('libssh2')) if libssh2_dep.found() diff --git a/src/rpc/virnetsshsession.c b/src/rpc/virnetsshsession.c index fe77594f65..cb081bcf4f 100644 --- a/src/rpc/virnetsshsession.c +++ b/src/rpc/virnetsshsession.c @@ -389,6 +389,18 @@ virNetSSHCheckHostKey(virNetSSHSessionPtr sess) case LIBSSH2_HOSTKEY_TYPE_DSS: keyType = LIBSSH2_KNOWNHOST_KEY_SSHDSS; break; + case LIBSSH2_HOSTKEY_TYPE_ECDSA_256: + keyType = LIBSSH2_KNOWNHOST_KEY_ECDSA_256; + break; + case LIBSSH2_HOSTKEY_TYPE_ECDSA_384: + keyType = LIBSSH2_KNOWNHOST_KEY_ECDSA_384; + break; + case LIBSSH2_HOSTKEY_TYPE_ECDSA_521: + keyType = LIBSSH2_KNOWNHOST_KEY_ECDSA_521; + break; + case LIBSSH2_HOSTKEY_TYPE_ED25519: + keyType = LIBSSH2_KNOWNHOST_KEY_ED25519; + break; case LIBSSH2_HOSTKEY_TYPE_UNKNOWN: default: -- 2.30.2

2 1

[PATCH] src: drop some forward declarations in src/storage/storage_backend_sheepdog.c
by peili 27 Mar '21

27 Mar '21

--- src/storage/storage_backend_sheepdog.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/src/storage/storage_backend_sheepdog.c b/src/storage/storage_backend_sheepdog.c index 8c37947308..010e86aa14 100644 --- a/src/storage/storage_backend_sheepdog.c +++ b/src/storage/storage_backend_sheepdog.c @@ -35,12 +35,6 @@ #define VIR_FROM_THIS VIR_FROM_STORAGE -static int virStorageBackendSheepdogRefreshVol(virStoragePoolObjPtr pool, - virStorageVolDefPtr vol); - -void virStorageBackendSheepdogAddHostArg(virCommandPtr cmd, - virStoragePoolObjPtr pool); - int virStorageBackendSheepdogParseNodeInfo(virStoragePoolDefPtr pool, char *output) -- 2.20.1

1 0

[PATCH] qemu: virtiofs: support <sandbox mode='chroot'/>
by Cole Robinson 26 Mar '21

26 Mar '21

Add a new XML element <filesystem> <binary> <sandbox mode='chroot|namespace'/> </binary> </filesystem> Which maps to `virtiofsd -o sandbox=chroot|namespace`, which was added in qemu 5.2.0: https://git.qemu.org/?p=qemu.git;a=commit;h=06844584b62a43384642f7243b0fc01… Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- docs/formatdomain.rst | 4 ++++ docs/schemas/domaincommon.rng | 12 ++++++++++ src/conf/domain_conf.c | 23 +++++++++++++++++++ src/conf/domain_conf.h | 10 ++++++++ src/libvirt_private.syms | 1 + src/qemu/qemu_virtiofs.c | 2 ++ .../vhost-user-fs-fd-memory.xml | 1 + 7 files changed, 53 insertions(+) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index 9392c80113..9dda39dbcb 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -3234,6 +3234,7 @@ A directory on the host that can be accessed directly from the guest. <driver type='virtiofs' queue='1024'/> <binary path='/usr/libexec/virtiofsd' xattr='on'> <cache mode='always'/> + <sandbox mode='namespace'/> <lock posix='on' flock='on'/> </binary> <source dir='/path'/> @@ -3358,6 +3359,9 @@ A directory on the host that can be accessed directly from the guest. ``cache`` element, possible ``mode`` values being ``none`` and ``always``. Locking can be controlled via the ``lock`` element - attributes ``posix`` and ``flock`` both accepting values ``on`` or ``off``. ( :since:`Since 6.2.0` ) + The sandboxing method used by virtiofsd can be configured with the ``sandbox`` + element, possible ``mode`` values being ``namespace`` and + ``chroot``. ( :since:`Since 7.2.0` ) ``source`` The resource on the host that is being accessed in the guest. The ``name`` attribute must be used with ``type='template'``, and the ``dir`` attribute diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index 1dbfc68f18..6404ebf210 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -2960,6 +2960,18 @@ </optional> </element> </optional> + <optional> + <element name="sandbox"> + <optional> + <attribute name="mode"> + <choice> + <value>namespace</value> + <value>chroot</value> + </choice> + </attribute> + </optional> + </element> + </optional> <optional> <element name="lock"> <optional> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index b0eba9f7bd..70a900ee25 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -538,6 +538,13 @@ VIR_ENUM_IMPL(virDomainFSCacheMode, "always", ); +VIR_ENUM_IMPL(virDomainFSSandboxMode, + VIR_DOMAIN_FS_SANDBOX_MODE_LAST, + "default", + "namespace", + "chroot", +); + VIR_ENUM_IMPL(virDomainNet, VIR_DOMAIN_NET_TYPE_LAST, @@ -10373,6 +10380,7 @@ virDomainFSDefParseXML(virDomainXMLOptionPtr xmlopt, g_autofree char *binary = virXPathString("string(./binary/@path)", ctxt); g_autofree char *xattr = virXPathString("string(./binary/@xattr)", ctxt); g_autofree char *cache = virXPathString("string(./binary/cache/@mode)", ctxt); + g_autofree char *sandbox = virXPathString("string(./binary/sandbox/@mode)", ctxt); g_autofree char *posix_lock = virXPathString("string(./binary/lock/@posix)", ctxt); g_autofree char *flock = virXPathString("string(./binary/lock/@flock)", ctxt); int val; @@ -10406,6 +10414,16 @@ virDomainFSDefParseXML(virDomainXMLOptionPtr xmlopt, def->cache = val; } + if (sandbox) { + if ((val = virDomainFSSandboxModeTypeFromString(sandbox)) <= 0) { + virReportError(VIR_ERR_XML_ERROR, + _("cannot parse sandbox mode '%s' for virtiofs"), + sandbox); + goto error; + } + def->sandbox = val; + } + if (posix_lock) { if ((val = virTristateSwitchTypeFromString(posix_lock)) <= 0) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, @@ -25483,6 +25501,11 @@ virDomainFSDefFormat(virBufferPtr buf, virDomainFSCacheModeTypeToString(def->cache)); } + if (def->sandbox != VIR_DOMAIN_FS_SANDBOX_MODE_DEFAULT) { + virBufferAsprintf(&binaryBuf, "<sandbox mode='%s'/>\n", + virDomainFSSandboxModeTypeToString(def->sandbox)); + } + if (def->posix_lock != VIR_TRISTATE_SWITCH_ABSENT) { virBufferAsprintf(&lockAttrBuf, " posix='%s'", virTristateSwitchTypeToString(def->posix_lock)); diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 0b8895bbdf..d77b04847b 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -846,6 +846,14 @@ typedef enum { VIR_DOMAIN_FS_CACHE_MODE_LAST } virDomainFSCacheMode; +typedef enum { + VIR_DOMAIN_FS_SANDBOX_MODE_DEFAULT = 0, + VIR_DOMAIN_FS_SANDBOX_MODE_NAMESPACE, + VIR_DOMAIN_FS_SANDBOX_MODE_CHROOT, + + VIR_DOMAIN_FS_SANDBOX_MODE_LAST +} virDomainFSSandboxMode; + struct _virDomainFSDef { int type; int fsdriver; /* enum virDomainFSDriverType */ @@ -870,6 +878,7 @@ struct _virDomainFSDef { virDomainFSCacheMode cache; virTristateSwitch posix_lock; virTristateSwitch flock; + virDomainFSSandboxMode sandbox; virDomainVirtioOptionsPtr virtio; virObjectPtr privateData; }; @@ -3800,6 +3809,7 @@ VIR_ENUM_DECL(virDomainFSAccessMode); VIR_ENUM_DECL(virDomainFSWrpolicy); VIR_ENUM_DECL(virDomainFSModel); VIR_ENUM_DECL(virDomainFSCacheMode); +VIR_ENUM_DECL(virDomainFSSandboxMode); VIR_ENUM_DECL(virDomainNet); VIR_ENUM_DECL(virDomainNetBackend); VIR_ENUM_DECL(virDomainNetVirtioTxMode); diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index cb9fe7c80a..04b2bc9dcd 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -414,6 +414,7 @@ virDomainFSDriverTypeToString; virDomainFSIndexByName; virDomainFSInsert; virDomainFSRemove; +virDomainFSSandboxModeTypeToString; virDomainFSTypeFromString; virDomainFSTypeToString; virDomainFSWrpolicyTypeFromString; diff --git a/src/qemu/qemu_virtiofs.c b/src/qemu/qemu_virtiofs.c index 2e239cad66..988b757d6f 100644 --- a/src/qemu/qemu_virtiofs.c +++ b/src/qemu/qemu_virtiofs.c @@ -131,6 +131,8 @@ qemuVirtioFSBuildCommandLine(virQEMUDriverConfigPtr cfg, virQEMUBuildBufferEscapeComma(&opts, fs->src->path); if (fs->cache) virBufferAsprintf(&opts, ",cache=%s", virDomainFSCacheModeTypeToString(fs->cache)); + if (fs->sandbox) + virBufferAsprintf(&opts, ",sandbox=%s", virDomainFSSandboxModeTypeToString(fs->sandbox)); if (fs->xattr == VIR_TRISTATE_SWITCH_ON) virBufferAddLit(&opts, ",xattr"); diff --git a/tests/qemuxml2argvdata/vhost-user-fs-fd-memory.xml b/tests/qemuxml2argvdata/vhost-user-fs-fd-memory.xml index 2277850c2c..abddf0870b 100644 --- a/tests/qemuxml2argvdata/vhost-user-fs-fd-memory.xml +++ b/tests/qemuxml2argvdata/vhost-user-fs-fd-memory.xml @@ -30,6 +30,7 @@ <driver type='virtiofs' queue='1024'/> <binary path='/usr/libexec/virtiofsd' xattr='on'> <cache mode='always'/> + <sandbox mode='chroot'/> <lock posix='off' flock='off'/> </binary> <source dir='/path'/> -- 2.30.2

2 2

[libvirt PATCH v5 00/30] Add support for persistent mediated devices
by Jonathon Jongsma 26 Mar '21

26 Mar '21

This patch series follows the previously-merged series which added support for transient mediated devices. This series expands mdev support to include persistent device definitions. Again, it relies on mdevctl as the backend. It follows the common libvirt pattern of APIs by adding the following new APIs for node devices: - virNodeDeviceDefineXML() - defines a persistent device - virNodeDeviceUndefine() - undefines a persistent device - virNodeDeviceCreate() - starts a previously-defined device It also adds virsh commands mapping to these new APIs: nodedev-define, nodedev-undefine, and nodedev-start. Since we rely on mdevctl for the definition of mediated devices, we need a way to stay up-to-date with devices that are defined by mdevctl (outside of libvirt). The method for staying up-to-date is currently a little bit crude due to the fact that mdevctl does not emit any events when new devices are added or removed. As a workaround, we create a file monitor for the mdevctl config directory and re-query mdevctl when we detect changes within that directory. In the future, mdevctl may introduce a more elegant solution. Changes in v5: - Rebase to git master - updated new API version info to 7.2.0 - capture and relay stderr message from mdevctl - changed to using GHashTable functions directly instead of deprecated virHash functions - protected mdevctlMonitors with a mutex - added a couple patches to fix the 5s delay when defining a new mdev. These are currently separate patches added to the end of the series, but could be squashed into the earlier commits if that's preferred. - various other minor review fixes Changes in v4: - rebase to git master - switch to throwaway thread for querying mdevctl - fixed a bug when removing devices because I was accidentally using virHashForEach() instead of virHashForeachSafe() - use DEFINED/UNDEFINED events instead of STARTED/STOPPED events - changes related to merging information about mdev devices from both udev a= nd mdevctl: - Re-used the same function to copy extra data from mdevctl regardless of whether we're processing a udev event or a mdevctl event (recommended by Erik). This results in slightly more complex handling of the object lifetimes (see patch 9), but it consolidates some code. - nodeDeviceDefCopyFromMdevctl() previously only copied the data that was unique to mdevctl and didn't exist in udev. It now copies additional data (possibly overwriting some udev). This solves a problem where a device = is defined but not active (i.e. we have not gotten any data from udev), and then changed (e.g. somebody calls 'mdevctl modify' to change the mdev type), but libvirt was not updating to the new definition. - fix a bug where we were mistakenly emitting 'update' events for devices th= at had not changed - Added the ability to specify a uuid for an mdev via device XML. - split some commits into multiple patches - updated new API version info to 7.1.0 - Fixed a bug reported by Yan Fu which hangs the client when attempting to destroy a nodedev that is in use by an active vm. See https://www.redhat.com/archives/libvir-list/2021-February/msg00116.html for solution suggested by Alex. - numerous smaller fixes from review findings changes in v3: - streamlined tests -- removed some unnecessary duplication - split out patch to factor out node device name generation function - split nodeDeviceParseMdevctlChildDevice() into a separate function - added follow-up patch to remove space-padded alignment in header - refactored the mdevctl update handling significantly: - no longer a separate persistent thread that gets signaled by a timer - now piggybacks onto the existing udev thread and signals the thread in t= he same way that the udev event does. - Daniel suggested spawning a throw-away thread to handle mdevctl updates, but that introduces the complexity of possibly serializing multiple throw-away threads (e.g. if we get an 'created' event followed immediate= ly by a 'deleted' event, two threads may be spawned and we'd need to ensure they are properly ordered) - added virNodeDeviceObjListForEach() and virNodeDeviceObjListRemoveLocked() to simplify removing devices that are removed from mdevctl. - coding style fixes - NOTE: per Erik's request, I experimented with changing the way that mdevctl commands were generated and tested (e.g. introducing something like virMdevctlGetCommand(def, MDEVCTL_COMMAND_<SUBCOMMAND>, ...)), but it was too invasive and awkward and didn't seem worthwhile Changes in v2: - rebase to latest git master Jonathon Jongsma (30): nodedev: capture and report stderror from mdevctl tests: remove extra trailing semicolon nodedev: introduce concept of 'active' node devices nodedev: Add ability to filter by active state nodedev: fix docs for virConnectListAllNodeDevices() nodedev: expose internal helper for naming devices nodedev: add ability to parse mdevs from mdevctl nodedev: add ability to list defined mdevs nodedev: add persistence to virNodeDeviceObj nodedev: add DEFINED/UNDEFINED lifecycle events nodedev: add mdevctl devices to node device list nodedev: add helper functions to remove node devices nodedev: handle mdevs that disappear from mdevctl nodedev: Refresh mdev devices when changes are detected nodedev: add function to generate mdevctl define command api: add virNodeDeviceDefineXML() virsh: Add --inactive, --all to nodedev-list virsh: add nodedev-define command nodedev: refactor tests to support mdev undefine api: add virNodeDeviceUndefine() virsh: Factor out function to find node device virsh: add nodedev-undefine command api: add virNodeDeviceCreate() virsh: add "nodedev-start" command nodedev: add <uuid> element to mdev caps nodedev: add ability to specify UUID for new mdevs nodedev: fix hang when destroying an mdev in use nodedev: add docs about mdev attribute order nodedev: factor out function to add mediated devices nodedev: avoid delay when defining a new mdev docs/formatnode.html.in | 5 +- docs/schemas/nodedev.rng | 43 +- examples/c/misc/event-test.c | 4 + include/libvirt/libvirt-nodedev.h | 20 +- src/access/viraccessperm.c | 2 +- src/access/viraccessperm.h | 6 + src/conf/node_device_conf.c | 14 + src/conf/node_device_conf.h | 8 + src/conf/virnodedeviceobj.c | 147 +++- src/conf/virnodedeviceobj.h | 24 + src/driver-nodedev.h | 14 + src/libvirt-nodedev.c | 141 +++- src/libvirt_private.syms | 6 + src/libvirt_public.syms | 7 + src/node_device/node_device_driver.c | 743 +++++++++++++++++- src/node_device/node_device_driver.h | 50 +- src/node_device/node_device_udev.c | 217 ++++- src/remote/remote_driver.c | 3 + src/remote/remote_protocol.x | 40 +- src/remote_protocol-structs | 16 + src/rpc/gendispatch.pl | 1 + ...19_36ea_4111_8f0a_8c9a70e21366-define.argv | 2 + ...19_36ea_4111_8f0a_8c9a70e21366-define.json | 1 + ...019_36ea_4111_8f0a_8c9a70e21366-start.argv | 3 +- ...39_495e_4243_ad9f_beb3f14c23d9-define.argv | 1 + ...39_495e_4243_ad9f_beb3f14c23d9-define.json | 1 + ...16_1ca8_49ac_b176_871d16c13076-define.argv | 1 + ...16_1ca8_49ac_b176_871d16c13076-define.json | 1 + tests/nodedevmdevctldata/mdevctl-create.argv | 1 + .../mdevctl-list-defined.argv | 1 + .../mdevctl-list-multiple.json | 59 ++ .../mdevctl-list-multiple.out.xml | 43 + .../nodedevmdevctldata/mdevctl-undefine.argv | 1 + tests/nodedevmdevctltest.c | 232 +++++- ...v_d069d019_36ea_4111_8f0a_8c9a70e21366.xml | 1 + tools/virsh-nodedev.c | 269 ++++++- 36 files changed, 1935 insertions(+), 193 deletions(-) create mode 100644 tests/nodedevmdevctldata/mdev_d069d019_36ea_4111_8f0a_8c9= a70e21366-define.argv create mode 100644 tests/nodedevmdevctldata/mdev_d069d019_36ea_4111_8f0a_8c9= a70e21366-define.json create mode 100644 tests/nodedevmdevctldata/mdev_d2441d39_495e_4243_ad9f_beb= 3f14c23d9-define.argv create mode 100644 tests/nodedevmdevctldata/mdev_d2441d39_495e_4243_ad9f_beb= 3f14c23d9-define.json create mode 100644 tests/nodedevmdevctldata/mdev_fedc4916_1ca8_49ac_b176_871= d16c13076-define.argv create mode 100644 tests/nodedevmdevctldata/mdev_fedc4916_1ca8_49ac_b176_871= d16c13076-define.json create mode 100644 tests/nodedevmdevctldata/mdevctl-create.argv create mode 100644 tests/nodedevmdevctldata/mdevctl-list-defined.argv create mode 100644 tests/nodedevmdevctldata/mdevctl-list-multiple.json create mode 100644 tests/nodedevmdevctldata/mdevctl-list-multiple.out.xml create mode 100644 tests/nodedevmdevctldata/mdevctl-undefine.argv --=20 2.26.2

2 34