Add SELinux policy for Virt
by Nikola Knazekova
Hi,
I created SELinux policy for Libvirt drivers, as part of Decentralized SELinux Policy (DSP) project.
DSP guidelines is available: https://fedoraproject.org/wiki/SELinux/IndependentPolicy
Discussion about the first version of SELinux policy for Libvirt is available on gitlab:
https://gitlab.com/libvirt/libvirt/-/merge_requests/65
SELinux policy was created for:
Hypervisor drivers:
- virtqemud (QEMU/KVM)
- virtlxcd (LXC)
- virtvboxd (VirtualBox)
Secondary drivers:
- virtstoraged (host storage mgmt)
- virtnetworkd (virtual network mgmt)
- virtinterface (network interface mgmt)
- virtnodedevd (physical device mgmt)
- virtsecretd (security credential mgmt)
- virtnwfilterd (ip[6]tables/ebtables mgmt)
- virtproxyd (proxy daemon)
SELinux policy for virtvxz and virtxend has not been created yet, because I wasn't able to reproduce AVC messages.
These drivers run in unconfined_domain until the AVC messages are reproduced internally and policy for these drivers is made.
Can you please look at it?
Thanks
Nikola
2 years, 10 months
[PATCH 2/2] qemu-img: Require -F with -b backing image
by Eric Blake
Back in commit d9f059aa6c (qemu-img: Deprecate use of -b without -F),
we deprecated the ability to create a file with a backing image that
requires qemu to perform format probing. Qemu can still probe older
files for backwards compatibility, but it is time to finish off the
ability to create such images, due to the potential security risk they
present. Update a couple of iotests affected by the change.
Signed-off-by: Eric Blake <eblake(a)redhat.com>
---
docs/system/deprecated.rst | 20 -----------------
docs/system/removed-features.rst | 19 ++++++++++++++++
block.c | 37 ++++++++++----------------------
qemu-img.c | 6 ++++--
tests/qemu-iotests/114 | 18 ++++++++--------
tests/qemu-iotests/114.out | 11 ++++------
tests/qemu-iotests/301 | 4 +---
tests/qemu-iotests/301.out | 16 ++------------
8 files changed, 50 insertions(+), 81 deletions(-)
diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
index 9ec1a9d0e03e..aa6f7d84e583 100644
--- a/docs/system/deprecated.rst
+++ b/docs/system/deprecated.rst
@@ -315,26 +315,6 @@ this CPU is also deprecated.
Related binaries
----------------
-qemu-img backing file without format (since 5.1)
-''''''''''''''''''''''''''''''''''''''''''''''''
-
-The use of ``qemu-img create``, ``qemu-img rebase``, or ``qemu-img
-convert`` to create or modify an image that depends on a backing file
-now recommends that an explicit backing format be provided. This is
-for safety: if QEMU probes a different format than what you thought,
-the data presented to the guest will be corrupt; similarly, presenting
-a raw image to a guest allows a potential security exploit if a future
-probe sees a non-raw image based on guest writes.
-
-To avoid the warning message, or even future refusal to create an
-unsafe image, you must pass ``-o backing_fmt=`` (or the shorthand
-``-F`` during create) to specify the intended backing format. You may
-use ``qemu-img rebase -u`` to retroactively add a backing format to an
-existing image. However, be aware that there are already potential
-security risks to blindly using ``qemu-img info`` to probe the format
-of an untrusted backing image, when deciding what format to add into
-an existing image.
-
Backwards compatibility
-----------------------
diff --git a/docs/system/removed-features.rst b/docs/system/removed-features.rst
index 28b5df757d35..1928d8a483c0 100644
--- a/docs/system/removed-features.rst
+++ b/docs/system/removed-features.rst
@@ -466,6 +466,25 @@ backing chain should be performed with ``qemu-img rebase -u`` either
before or after the remaining changes being performed by amend, as
appropriate.
+qemu-img backing file without format (removed in 6.1)
+'''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+The use of ``qemu-img create``, ``qemu-img rebase``, or ``qemu-img
+convert`` to create or modify an image that depends on a backing file
+now requires that an explicit backing format be provided. This is
+for safety: if QEMU probes a different format than what you thought,
+the data presented to the guest will be corrupt; similarly, presenting
+a raw image to a guest allows a potential security exploit if a future
+probe sees a non-raw image based on guest writes.
+
+To avoid creating unsafe backing chains, you must pass ``-o
+backing_fmt=`` (or the shorthand ``-F`` during create) to specify the
+intended backing format. You may use ``qemu-img rebase -u`` to
+retroactively add a backing format to an existing image. However, be
+aware that there are already potential security risks to blindly using
+``qemu-img info`` to probe the format of an untrusted backing image,
+when deciding what format to add into an existing image.
+
Block devices
-------------
diff --git a/block.c b/block.c
index 874c22c43e3d..931e37a8499b 100644
--- a/block.c
+++ b/block.c
@@ -5033,7 +5033,7 @@ int coroutine_fn bdrv_co_check(BlockDriverState *bs,
* -ENOTSUP - format driver doesn't support changing the backing file
*/
int bdrv_change_backing_file(BlockDriverState *bs, const char *backing_file,
- const char *backing_fmt, bool warn)
+ const char *backing_fmt, bool require)
{
BlockDriver *drv = bs->drv;
int ret;
@@ -5047,10 +5047,8 @@ int bdrv_change_backing_file(BlockDriverState *bs, const char *backing_file,
return -EINVAL;
}
- if (warn && backing_file && !backing_fmt) {
- warn_report("Deprecated use of backing file without explicit "
- "backing format, use of this image requires "
- "potentially unsafe format probing");
+ if (require && backing_file && !backing_fmt) {
+ return -EINVAL;
}
if (drv->bdrv_change_backing_file != NULL) {
@@ -6556,24 +6554,11 @@ void bdrv_img_create(const char *filename, const char *fmt,
goto out;
} else {
if (!backing_fmt) {
- warn_report("Deprecated use of backing file without explicit "
- "backing format (detected format of %s)",
- bs->drv->format_name);
- if (bs->drv != &bdrv_raw) {
- /*
- * A probe of raw deserves the most attention:
- * leaving the backing format out of the image
- * will ensure bs->probed is set (ensuring we
- * don't accidentally commit into the backing
- * file), and allow more spots to warn the users
- * to fix their toolchain when opening this image
- * later. For other images, we can safely record
- * the format that we probed.
- */
- backing_fmt = bs->drv->format_name;
- qemu_opt_set(opts, BLOCK_OPT_BACKING_FMT, backing_fmt,
- NULL);
- }
+ error_setg(&local_err,
+ "Backing file specified without backing format");
+ error_append_hint(&local_err, "Detected format of %s.",
+ bs->drv->format_name);
+ goto out;
}
if (size == -1) {
/* Opened BS, have no size */
@@ -6590,9 +6575,9 @@ void bdrv_img_create(const char *filename, const char *fmt,
}
/* (backing_file && !(flags & BDRV_O_NO_BACKING)) */
} else if (backing_file && !backing_fmt) {
- warn_report("Deprecated use of unopened backing file without "
- "explicit backing format, use of this image requires "
- "potentially unsafe format probing");
+ error_setg(&local_err,
+ "Backing file specified without backing format");
+ goto out;
}
if (size == -1) {
diff --git a/qemu-img.c b/qemu-img.c
index a5993682aad4..3cdfcaa23f6b 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -2505,8 +2505,10 @@ static int img_convert(int argc, char **argv)
if (out_baseimg_param) {
if (!qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT)) {
- warn_report("Deprecated use of backing file without explicit "
- "backing format");
+ error_report("Use of backing file requires explicit "
+ "backing format");
+ ret = -1;
+ goto out;
}
}
diff --git a/tests/qemu-iotests/114 b/tests/qemu-iotests/114
index 43cb0bc6c344..3e30b402bc4c 100755
--- a/tests/qemu-iotests/114
+++ b/tests/qemu-iotests/114
@@ -44,16 +44,16 @@ _supported_os Linux
# qcow2.py does not work too well with external data files
_unsupported_imgopts data_file
-# Intentionally specify backing file without backing format; demonstrate
-# the difference in warning messages when backing file could be probed.
-# Note that only a non-raw probe result will affect the resulting image.
+# Older qemu-img could set up backing file without backing format; modern
+# qemu can't but we can use qcow2.py to simulate older files.
truncate -s $((64 * 1024 * 1024)) "$TEST_IMG.orig"
-_make_test_img -b "$TEST_IMG.orig" 64M
+_make_test_img -b "$TEST_IMG.orig" -F raw 64M
+$PYTHON qcow2.py "$TEST_IMG" del-header-ext 0xE2792ACA
TEST_IMG="$TEST_IMG.base" _make_test_img 64M
$QEMU_IMG convert -O qcow2 -B "$TEST_IMG.orig" "$TEST_IMG.orig" "$TEST_IMG"
-_make_test_img -b "$TEST_IMG.base" 64M
-_make_test_img -u -b "$TEST_IMG.base" 64M
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT 64M
+_make_test_img -u -b "$TEST_IMG.base" -F $IMGFMT 64M
# Set an invalid backing file format
$PYTHON qcow2.py "$TEST_IMG" add-header-ext 0xE2792ACA "foo"
@@ -64,9 +64,9 @@ _img_info
$QEMU_IO -c "open $TEST_IMG" -c "read 0 4k" 2>&1 | _filter_qemu_io | _filter_testdir
$QEMU_IO -c "open -o backing.driver=$IMGFMT $TEST_IMG" -c "read 0 4k" | _filter_qemu_io
-# Rebase the image, to show that omitting backing format triggers a warning,
-# but probing now lets us use the backing file.
-$QEMU_IMG rebase -u -b "$TEST_IMG.base" "$TEST_IMG"
+# Rebase the image, to show that backing format is required.
+$QEMU_IMG rebase -u -b "$TEST_IMG.base" "$TEST_IMG" && echo "unexpected pass"
+$QEMU_IMG rebase -u -b "$TEST_IMG.base" -F $IMGFMT "$TEST_IMG"
$QEMU_IO -c "open $TEST_IMG" -c "read 0 4k" 2>&1 | _filter_qemu_io | _filter_testdir
# success, all done
diff --git a/tests/qemu-iotests/114.out b/tests/qemu-iotests/114.out
index 0a37d20c82a9..172454401257 100644
--- a/tests/qemu-iotests/114.out
+++ b/tests/qemu-iotests/114.out
@@ -1,12 +1,9 @@
QA output created by 114
-qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of raw)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.orig
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.orig backing_fmt=raw
Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
-qemu-img: warning: Deprecated use of backing file without explicit backing format
-qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of IMGFMT)
+qemu-img: Use of backing file requires explicit backing format
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
-qemu-img: warning: Deprecated use of unopened backing file without explicit backing format, use of this image requires potentially unsafe format probing
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
image: TEST_DIR/t.IMGFMT
file format: IMGFMT
virtual size: 64 MiB (67108864 bytes)
@@ -17,7 +14,7 @@ qemu-io: can't open device TEST_DIR/t.qcow2: Could not open backing file: Unknow
no file open, try 'help open'
read 4096/4096 bytes at offset 0
4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-qemu-img: warning: Deprecated use of backing file without explicit backing format, use of this image requires potentially unsafe format probing
+qemu-img: Could not change the backing file to '/home/eblake/qemu/build/tests/qemu-iotests/scratch/t.qcow2.base': Invalid argument
read 4096/4096 bytes at offset 0
4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
*** done
diff --git a/tests/qemu-iotests/301 b/tests/qemu-iotests/301
index 9f943cadbe24..220de1043fa5 100755
--- a/tests/qemu-iotests/301
+++ b/tests/qemu-iotests/301
@@ -3,7 +3,7 @@
#
# Test qcow backing file warnings
#
-# Copyright (C) 2020 Red Hat, Inc.
+# Copyright (C) 2020-2021 Red Hat, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -46,7 +46,6 @@ echo "== qcow backed by qcow =="
TEST_IMG="$TEST_IMG.base" _make_test_img $size
_make_test_img -b "$TEST_IMG.base" $size
-_img_info
_make_test_img -b "$TEST_IMG.base" -F $IMGFMT $size
_img_info
@@ -71,7 +70,6 @@ echo "== qcow backed by raw =="
rm "$TEST_IMG.base"
truncate --size=$size "$TEST_IMG.base"
_make_test_img -b "$TEST_IMG.base" $size
-_img_info
_make_test_img -b "$TEST_IMG.base" -F raw $size
_img_info
diff --git a/tests/qemu-iotests/301.out b/tests/qemu-iotests/301.out
index 9004dad6392f..e280658191e1 100644
--- a/tests/qemu-iotests/301.out
+++ b/tests/qemu-iotests/301.out
@@ -2,13 +2,7 @@ QA output created by 301
== qcow backed by qcow ==
Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=33554432
-qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of IMGFMT)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
-image: TEST_DIR/t.IMGFMT
-file format: IMGFMT
-virtual size: 32 MiB (33554432 bytes)
-cluster_size: 512
-backing file: TEST_DIR/t.IMGFMT.base
+qemu-img: TEST_DIR/t.IMGFMT: Backing file specified without backing format
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
image: TEST_DIR/t.IMGFMT
file format: IMGFMT
@@ -36,13 +30,7 @@ cluster_size: 512
backing file: TEST_DIR/t.IMGFMT.base
== qcow backed by raw ==
-qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of raw)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base
-image: TEST_DIR/t.IMGFMT
-file format: IMGFMT
-virtual size: 32 MiB (33554432 bytes)
-cluster_size: 512
-backing file: TEST_DIR/t.IMGFMT.base
+qemu-img: TEST_DIR/t.IMGFMT: Backing file specified without backing format
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=raw
image: TEST_DIR/t.IMGFMT
file format: IMGFMT
--
2.31.1
2 years, 10 months
Avoiding lockspace already exists error from virtlockd
by Jim Fehlig
Hi All!
I received a bug report about virtlockd emitting an error whenever libvirtd is
(re)started
May 25 15:44:31 virt81 virtlockd[7723]: Requested operation is not valid:
Lockspace for path /data/libvirtd/lockspace already exists
The problem is easily reproducible with git master by enabling lockd in
qemu.conf, setting file_lockspace_dir in qemu-lockd.conf, then restarting libvirtd.
If I understand the code correctly, when the qemu driver loads, it calls
virLockManagerPluginNew, which dlopens lockd.so and calls drvInit, aka
virLockManagerLockDaemonInit. Here the driver object is created, config loaded,
and virLockManagerLockDaemonSetupLockspace is called.
virLockManagerLockDaemonSetupLockspace sends
virLockSpaceProtocolCreateLockSpaceArgs rpc to virtlockd, where it is dispatched
to virLockSpaceProtocolDispatchCreateLockSpace. Alas we encounter the error when
virLockDaemonFindLockSpace finds the existing lockspace.
I'm not really sure how to go about fixing it and fishing for opinions.
virLockManagerLockDaemonSetupLockspace already has some code to handle the error
https://gitlab.com/libvirt/libvirt/-/blob/master/src/locking/lock_driver_...
Since libvirtd ignores VIR_ERR_OPERATION_INVALID, should virtlockd be changed to
not return error in that case? It would be better if libvirtd knew it already
told virtlockd to configure the lockspace and avoid needlessly doing it again.
BTW, this cosmetic problem is exasperated by the default '--timeout 120' option
to libvirtd, since it results in more daemon restarts.
Thanks for any suggestions!
Jim
2 years, 10 months
[RFCv3 00/25] RFC: Generate parsexml/formatbuf functions based on directives
by Shi Lei
V2 here: [https://listman.redhat.com/archives/libvir-list/2020-September/msg00204.html]
Differ from V2:
* Add tests for xmlgen to illustrate all the different features we can use
and make sure its proper functions in the future.
* Add docs/xmlgen.rst to explain the usage of all directives and the tool
itself.
* Now xmlgen can check whether the first item of enum ends with _NONE, _DEFAULT
or _ABSENT and generate proper code. So we no longer need to add extra
'default' item for enum.
* Now xmlgen can provide extra [tips] when we execute its command-line to show
generated code for preview.
* Enable/disable hooks by macros rather than by special directives.
* Add virStrToBoolYesNo/virStrToBoolTrueFalse/virStrToBoolOnOff
and explicitly check both the true and false values.
* Stronger check for python3-clang and libclang.so to make sure it can work.
* Add python3-clang to the libvirt.spec.in and the mingw-libvirt.spec.in.
Thanks!
Shi Lei (25):
scripts: Add a tool to generate xml parse/format functions
maint: Check python3-clang and libclang
maint: Call xmlgen automatically when c-head-files change
docs: Add xmlgen.rst to explain how to use it
build-aux: Only check *.[ch] for sc_prohibit_useless_translation
tests: Add tests for xmlgen
util: Add some xml-helper-functions to cooperate with xmlgen
util: Add helper aliases and functions for 'bool' and 'time_t' to cooperate with xmlgen
util: Add parsexml/formatbuf helper functions for virSocketAddr
util: Add virUUID type and parse/format functions
conf: Extract error-checking code from virNetworkDNSTxtDefParseXML
conf: Replace virNetworkDNSTxtDefParseXML(hardcoded) with namesake(generated)
conf: Generate virNetworkDNSTxtDefFormatBuf
conf: Extract error-checking code from virNetworkDNSSrvDefParseXML
conf: Replace virNetworkDNSSrvDefParseXML(hardcoded) with namesake(generated)
conf: Generate virNetworkDNSSrvDefFormatBuf
conf: Extract error-checking code from virNetworkDNSHostDefParseXML
conf: Replace virNetworkDNSHostDefParseXML(hardcoded) with namesake(generated)
conf: Generate virNetworkDNSHostDefFormatBuf
conf: Extract virNetworkDNSForwarderParseXML from virNetworkDNSParseXML
conf: Replace virNetworkDNSForwarderParseXML(hardcoded) with namesake(generated)
conf: Generate virNetworkDNSForwarderFormatBuf
conf: Extract error-checking code from virNetworkDNSDefParseXML
conf: Replace virNetworkDNSDefParseXML(hardcoded) with namesake(generated)
conf: Generate virNetworkDNSDefFormatBuf
build-aux/syntax-check.mk | 2 +-
docs/meson.build | 1 +
docs/xmlgen.rst | 684 +++++++++++++
libvirt.spec.in | 1 +
meson.build | 10 +
mingw-libvirt.spec.in | 1 +
po/POTFILES.in | 2 +
scripts/meson.build | 8 +
scripts/xmlgen/directive.py | 1192 ++++++++++++++++++++++
scripts/xmlgen/go | 29 +
scripts/xmlgen/main.py | 534 ++++++++++
scripts/xmlgen/utils.py | 121 +++
src/conf/meson.build | 37 +
src/conf/network_conf.c | 463 ++-------
src/conf/network_conf.h | 59 +-
src/internal.h | 8 +
src/libvirt_private.syms | 13 +
src/meson.build | 6 +
src/util/meson.build | 36 +
src/util/virbuffer.c | 44 +
src/util/virbuffer.h | 8 +-
src/util/virsocketaddr.c | 42 +
src/util/virsocketaddr.h | 23 +-
src/util/virstring.c | 102 ++
src/util/virstring.h | 15 +
src/util/viruuid.c | 31 +
src/util/viruuid.h | 18 +
src/util/virxml.c | 120 +++
src/util/virxml.h | 6 +
tests/meson.build | 3 +
tests/xmlgenin/conf/array.h | 17 +
tests/xmlgenin/conf/empty.h | 7 +
tests/xmlgenin/conf/enum-first-item.h | 12 +
tests/xmlgenin/conf/external.h | 9 +
tests/xmlgenin/conf/genformat-separate.h | 11 +
tests/xmlgenin/conf/genformat.h | 11 +
tests/xmlgenin/conf/genparse.h | 11 +
tests/xmlgenin/conf/namespace.h | 12 +
tests/xmlgenin/conf/required.h | 9 +
tests/xmlgenin/conf/skipparse.h | 10 +
tests/xmlgenin/conf/specify.h | 13 +
tests/xmlgenin/conf/xmlattr.h | 10 +
tests/xmlgenin/conf/xmlelem.h | 10 +
tests/xmlgenin/conf/xmlgroup.h | 8 +
tests/xmlgenin/conf/xmlswitch.h | 17 +
tests/xmlgenin/util/enums.h | 58 ++
tests/xmlgenin/util/structs.h | 67 ++
tests/xmlgenout/array.txt | 364 +++++++
tests/xmlgenout/empty.txt | 181 ++++
tests/xmlgenout/enum-first-item.txt | 297 ++++++
tests/xmlgenout/external.txt | 205 ++++
tests/xmlgenout/genformat-separate.txt | 190 ++++
tests/xmlgenout/genformat.txt | 142 +++
tests/xmlgenout/genparse.txt | 154 +++
tests/xmlgenout/namespace.txt | 222 ++++
tests/xmlgenout/required.txt | 236 +++++
tests/xmlgenout/skipparse.txt | 223 ++++
tests/xmlgenout/specify.txt | 291 ++++++
tests/xmlgenout/xmlattr.txt | 252 +++++
tests/xmlgenout/xmlelem.txt | 243 +++++
tests/xmlgenout/xmlgroup.txt | 204 ++++
tests/xmlgenout/xmlswitch.txt | 470 +++++++++
tests/xmlgentest.c | 107 ++
tools/meson.build | 3 +
64 files changed, 7289 insertions(+), 406 deletions(-)
create mode 100644 docs/xmlgen.rst
create mode 100644 scripts/xmlgen/directive.py
create mode 100755 scripts/xmlgen/go
create mode 100755 scripts/xmlgen/main.py
create mode 100644 scripts/xmlgen/utils.py
create mode 100644 tests/xmlgenin/conf/array.h
create mode 100644 tests/xmlgenin/conf/empty.h
create mode 100644 tests/xmlgenin/conf/enum-first-item.h
create mode 100644 tests/xmlgenin/conf/external.h
create mode 100644 tests/xmlgenin/conf/genformat-separate.h
create mode 100644 tests/xmlgenin/conf/genformat.h
create mode 100644 tests/xmlgenin/conf/genparse.h
create mode 100644 tests/xmlgenin/conf/namespace.h
create mode 100644 tests/xmlgenin/conf/required.h
create mode 100644 tests/xmlgenin/conf/skipparse.h
create mode 100644 tests/xmlgenin/conf/specify.h
create mode 100644 tests/xmlgenin/conf/xmlattr.h
create mode 100644 tests/xmlgenin/conf/xmlelem.h
create mode 100644 tests/xmlgenin/conf/xmlgroup.h
create mode 100644 tests/xmlgenin/conf/xmlswitch.h
create mode 100644 tests/xmlgenin/util/enums.h
create mode 100644 tests/xmlgenin/util/structs.h
create mode 100644 tests/xmlgenout/array.txt
create mode 100644 tests/xmlgenout/empty.txt
create mode 100644 tests/xmlgenout/enum-first-item.txt
create mode 100644 tests/xmlgenout/external.txt
create mode 100644 tests/xmlgenout/genformat-separate.txt
create mode 100644 tests/xmlgenout/genformat.txt
create mode 100644 tests/xmlgenout/genparse.txt
create mode 100644 tests/xmlgenout/namespace.txt
create mode 100644 tests/xmlgenout/required.txt
create mode 100644 tests/xmlgenout/skipparse.txt
create mode 100644 tests/xmlgenout/specify.txt
create mode 100644 tests/xmlgenout/xmlattr.txt
create mode 100644 tests/xmlgenout/xmlelem.txt
create mode 100644 tests/xmlgenout/xmlgroup.txt
create mode 100644 tests/xmlgenout/xmlswitch.txt
create mode 100644 tests/xmlgentest.c
--
2.25.1
2 years, 10 months
[PATCH v2 00/14] news update since v6.9 to v7.0
by Han Han
Diff from v1:
- Drop the news "Introduce VIR_DOMAIN_CHECKPOINT_REDEFINE_VALIDATE flag"
- Move the news of virt-aa-helper to bug fix part
- Update some descriptions of news
v1: https://listman.redhat.com/archives/libvir-list/2021-April/msg00456.html
Thanks for the advice from Peter Krempa and Erik Skultety.
Han Han (14):
news: make SEV attrs 'cbitpos' & 'reducedPhysBits' optional
news: support device stats collection for SR-IOV VF hostdev
news: virt-aa-helper: allow guest to create hard links for mounted
9pfs paths
news: cpu_map: Add EPYC-Rome cpu model
news: cpu: Support for XML validation in cpu comparison
logging: allow max_len=0 to disable log rollover
news: qemu: Set noqueue qdisc for TAP devices
news: qemu: Introduce virtio free page reporting feature
news: qemu: virtiofs can be used without NUMA nodes
news: qemu: Add 'fmode' and 'dmode' options for 9pfs
news: Introduce "migrate_tls_force" to qemu.conf
qemu: support kvm-poll-control performance hint
news: cpu_map: Add Snowridge cpu model
news: qemu: Add support for NFS disk protocol
NEWS.rst | 74 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 74 insertions(+)
--
2.31.1
2 years, 11 months
[PATCH v3 00/15] Introduce virtio-mem <memory/> model
by Michal Privoznik
v3 of:
https://listman.redhat.com/archives/libvir-list/2021-February/msg00961.html
diff to v2:
- Dropped code that forbade use of virtio-mem and memballoon at the same
time;
- This meant that I had to adjust memory accounting,
qemuDomainSetMemoryFlags() - see patches 11/15 and 12/15 which are new.
- Fixed small nits raised by Peter in his review of v2
Michal Prívozník (15):
virhostmem: Introduce virHostMemGetTHPSize()
qemu_process: Deduplicate code in qemuProcessNeedHugepagesPath()
qemu_process: Drop needless check in
qemuProcessNeedMemoryBackingPath()
qemu_capabilities: Introduce QEMU_CAPS_DEVICE_VIRTIO_MEM_PCI
conf: Introduce virtio-mem <memory/> model
qemu: Build command line for virtio-mem
qemu: Wire up <memory/> live update
qemu: Wire up MEMORY_DEVICE_SIZE_CHANGE event
Introduce MEMORY_DEVICE_SIZE_CHANGE event
qemu: Refresh the actual size of virtio-mem on monitor reconnect
qemu: Account for both memballoon and virtio-mem
qemuDomainSetMemoryFlags: Take virtio-mem into consideration
virsh: Introduce update-memory-device command
news: document recent virtio memory addition
kbase: Document virtio-mem
NEWS.rst | 7 +
docs/formatdomain.rst | 45 +++-
docs/kbase/index.rst | 4 +
docs/kbase/memorydevices.rst | 150 +++++++++++
docs/kbase/meson.build | 1 +
docs/manpages/virsh.rst | 30 +++
docs/schemas/domaincommon.rng | 16 ++
examples/c/misc/event-test.c | 17 ++
include/libvirt/libvirt-domain.h | 23 ++
src/conf/domain_conf.c | 115 ++++++++-
src/conf/domain_conf.h | 15 ++
src/conf/domain_event.c | 84 +++++++
src/conf/domain_event.h | 10 +
src/conf/domain_validate.c | 39 +++
src/libvirt_private.syms | 5 +
src/qemu/qemu_alias.c | 10 +-
src/qemu/qemu_capabilities.c | 2 +
src/qemu/qemu_capabilities.h | 1 +
src/qemu/qemu_command.c | 13 +-
src/qemu/qemu_domain.c | 50 +++-
src/qemu/qemu_domain.h | 1 +
src/qemu/qemu_domain_address.c | 38 ++-
src/qemu/qemu_driver.c | 233 +++++++++++++++++-
src/qemu/qemu_hotplug.c | 18 ++
src/qemu/qemu_hotplug.h | 5 +
src/qemu/qemu_monitor.c | 37 +++
src/qemu/qemu_monitor.h | 27 ++
src/qemu/qemu_monitor_json.c | 97 ++++++--
src/qemu/qemu_monitor_json.h | 5 +
src/qemu/qemu_process.c | 118 ++++++++-
src/qemu/qemu_validate.c | 8 +
src/remote/remote_daemon_dispatch.c | 30 +++
src/remote/remote_driver.c | 32 +++
src/remote/remote_protocol.x | 15 +-
src/remote_protocol-structs | 7 +
src/security/security_apparmor.c | 1 +
src/security/security_dac.c | 2 +
src/security/security_selinux.c | 2 +
src/util/virhostmem.c | 63 +++++
src/util/virhostmem.h | 3 +
tests/domaincapsmock.c | 9 +
.../caps_5.1.0.x86_64.xml | 1 +
.../caps_5.2.0.x86_64.xml | 1 +
.../caps_6.0.0.x86_64.xml | 1 +
...mory-hotplug-virtio-mem.x86_64-latest.args | 49 ++++
.../memory-hotplug-virtio-mem.xml | 67 +++++
tests/qemuxml2argvtest.c | 1 +
...emory-hotplug-virtio-mem.x86_64-latest.xml | 1 +
tests/qemuxml2xmltest.c | 1 +
tools/virsh-domain.c | 169 +++++++++++++
50 files changed, 1612 insertions(+), 67 deletions(-)
create mode 100644 docs/kbase/memorydevices.rst
create mode 100644 tests/qemuxml2argvdata/memory-hotplug-virtio-mem.x86_64-latest.args
create mode 100644 tests/qemuxml2argvdata/memory-hotplug-virtio-mem.xml
create mode 120000 tests/qemuxml2xmloutdata/memory-hotplug-virtio-mem.x86_64-latest.xml
--
2.26.2
2 years, 11 months
[libvirt PATCH v2 0/7] Enable sanitizers
by Tim Wiederhake
This series enables and adds AddressSanitizer and UndefinedBehaviorSanitizer
builds to the CI.
See:
https://clang.llvm.org/docs/AddressSanitizer.html and
https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html
These sanitizers already found some issues in libvirt, e.g.
4eb7c621985dad4de911ec394ac628bd1a5b29ab,
1294de209cee6643511265c7e2d4283c047cf652,
8b8c91f487592c6c067847ca59dde405ca17573f, or
1c34211c22de28127a509edbf2cf2f44cb0d891e.
There exist two more relevant sanitizers, ThreadSanitizer and MemorySanitizer.
Unfortunately, those two require an instrumented build of all dependencies,
including libc, to work correctly.
Note that clang and gcc have different implementations of these sanitizers,
hence the introduction of two new jobs to the CI. The latter one issues a
warning about the use of LD_PRELOAD in `virTestMain`, which in this
particular case can be safely ignored by setting `ASAN_OPTIONS` to
verify_asan_link_order=0` for the gcc build.
Changes since V1:
Incorporated changes suggested by Pavel, except for #6 (now #7): The statement
in https://listman.redhat.com/archives/libvir-list/2021-May/msg00070.html on
the sanitizers working with Fedora 33 is wrong, I was fooled by caching. The
bug described there is present in Fedora 33, 34, and Rawhide.
Cheers,
Tim
Tim Wiederhake (7):
meson: Allow larger stack frames when instrumenting
meson: Allow undefined symbols when sanitizers are enabled
tests: virfilemock: realpath: Allow non-null second parameter
openvz: Add missing symbols to libvirt_openvz.syms
tests: openvzutilstest: Remove duplicate linking with libvirt_openvz.a
virt-aa-helper: Remove duplicate linking with src/datatypes.o
ci: Enable address and undefined behavior sanitizers
.gitlab-ci.yml | 35 +++++++++++++++++++++++++++++++++++
build-aux/syntax-check.mk | 2 +-
meson.build | 14 ++++++++++----
src/libvirt_openvz.syms | 2 ++
src/security/meson.build | 1 -
tests/meson.build | 2 +-
tests/virfilemock.c | 20 ++++++++++++--------
7 files changed, 61 insertions(+), 15 deletions(-)
--
2.26.3
2 years, 11 months
[libvirt PATCH 0/4] Support autostart for mediated devices
by Jonathon Jongsma
This is a short patch series based on an initial patch from Boris Fiuczynski
that I massaged a little bit and added a few additional patches.
This allows you to define mediated devices in libvirt which are started
automatically at boot or parent device plugin.
Boris Fiuczynski (1):
nodedev: support auto-start property for mdevs
Jonathon Jongsma (3):
test: move nodedev xml2xml output to a separate dir
tests: nodedevxml2xmltest: test more mdev files
docs: nodedev: document mdev uuid property
docs/formatnode.html.in | 14 ++++++++
docs/schemas/nodedev.rng | 11 +++++++
src/conf/node_device_conf.c | 20 ++++++++++-
src/conf/node_device_conf.h | 12 +++++++
src/libvirt_private.syms | 2 ++
src/node_device/node_device_driver.c | 7 +++-
.../mdevctl-list-multiple.out.xml | 4 +++
tests/nodedevschemadata/mdev_autostart.xml | 10 ++++++
tests/nodedevschemadata/mdev_manual.xml | 10 ++++++
tests/nodedevxml2xmlout/DVD_GCC_4247N.xml | 15 +++++++++
tests/nodedevxml2xmlout/DVD_with_media.xml | 18 ++++++++++
tests/nodedevxml2xmlout/ap_07_0038.xml | 9 +++++
tests/nodedevxml2xmlout/ap_card07.xml | 8 +++++
tests/nodedevxml2xmlout/ap_matrix.xml | 7 ++++
.../ap_matrix_mdev_types.xml | 14 ++++++++
tests/nodedevxml2xmlout/ccw_0_0_ffff.xml | 10 ++++++
tests/nodedevxml2xmlout/computer.xml | 16 +++++++++
.../css_0_0_fffe_mdev_types.xml | 17 ++++++++++
tests/nodedevxml2xmlout/css_0_0_ffff.xml | 10 ++++++
tests/nodedevxml2xmlout/drm_renderD129.xml | 10 ++++++
...v_3627463d_b7f0_4fea_b468_f1da537d301b.xml | 9 +++++
tests/nodedevxml2xmlout/mdev_autostart.xml | 11 +++++++
...v_d069d019_36ea_4111_8f0a_8c9a70e21366.xml | 10 ++++++
...v_d2441d39_495e_4243_ad9f_beb3f14c23d9.xml | 11 +++++++
...v_ee0b88c4_f554_4dc1_809d_b2a01e8e48ad.xml | 10 ++++++
...v_fedc4916_1ca8_49ac_b176_871d16c13076.xml | 10 ++++++
tests/nodedevxml2xmlout/mdev_manual.xml | 11 +++++++
.../net_00_13_02_b9_f9_d3.xml | 21 ++++++++++++
.../net_00_15_58_2f_e9_55.xml | 21 ++++++++++++
.../pci_0000_00_02_0_header_type.xml | 16 +++++++++
.../pci_0000_00_1c_0_header_type.xml | 21 ++++++++++++
.../pci_0000_02_10_7_mdev_types.xml | 33 +++++++++++++++++++
.../pci_0000_02_10_7_sriov.xml | 24 ++++++++++++++
.../pci_0000_02_10_7_sriov_pf_vfs_all.xml | 29 ++++++++++++++++
...0_02_10_7_sriov_pf_vfs_all_header_type.xml | 31 +++++++++++++++++
.../pci_0000_02_10_7_sriov_vfs.xml | 27 +++++++++++++++
..._0000_02_10_7_sriov_zero_vfs_max_count.xml | 22 +++++++++++++
tests/nodedevxml2xmlout/pci_1002_71c4.xml | 14 ++++++++
.../pci_8086_0c0c_snd_hda_intel.xml | 17 ++++++++++
.../pci_8086_10c9_sriov_pf.xml | 18 ++++++++++
.../pci_8086_27c5_scsi_host.xml | 7 ++++
.../pci_8086_27c5_scsi_host_0.xml | 7 ++++
.../pci_8086_27c5_scsi_host_0_unique_id.xml | 8 +++++
...i_8086_27c5_scsi_host_scsi_device_lun0.xml | 11 +++++++
.../pci_8086_27c5_scsi_host_scsi_host.xml | 7 ++++
.../pci_8086_4238_pcie_wireless.xml | 27 +++++++++++++++
tests/nodedevxml2xmlout/scsi_target0_0_0.xml | 7 ++++
tests/nodedevxml2xmlout/scsi_target1_0_0.xml | 12 +++++++
...rial_3600c0ff000d7a2a5d463ff4902000000.xml | 19 +++++++++++
...al_SATA_HTS721010G9SA00_MPCZ12Y0GNGWSE.xml | 14 ++++++++
.../usb_device_1d6b_1_0000_00_1d_0.xml | 10 ++++++
.../usb_device_1d6b_1_0000_00_1d_0_if0.xml | 10 ++++++
tests/nodedevxml2xmltest.c | 17 +++++++---
53 files changed, 739 insertions(+), 7 deletions(-)
create mode 100644 tests/nodedevschemadata/mdev_autostart.xml
create mode 100644 tests/nodedevschemadata/mdev_manual.xml
create mode 100644 tests/nodedevxml2xmlout/DVD_GCC_4247N.xml
create mode 100644 tests/nodedevxml2xmlout/DVD_with_media.xml
create mode 100644 tests/nodedevxml2xmlout/ap_07_0038.xml
create mode 100644 tests/nodedevxml2xmlout/ap_card07.xml
create mode 100644 tests/nodedevxml2xmlout/ap_matrix.xml
create mode 100644 tests/nodedevxml2xmlout/ap_matrix_mdev_types.xml
create mode 100644 tests/nodedevxml2xmlout/ccw_0_0_ffff.xml
create mode 100644 tests/nodedevxml2xmlout/computer.xml
create mode 100644 tests/nodedevxml2xmlout/css_0_0_fffe_mdev_types.xml
create mode 100644 tests/nodedevxml2xmlout/css_0_0_ffff.xml
create mode 100644 tests/nodedevxml2xmlout/drm_renderD129.xml
create mode 100644 tests/nodedevxml2xmlout/mdev_3627463d_b7f0_4fea_b468_f1da537d301b.xml
create mode 100644 tests/nodedevxml2xmlout/mdev_autostart.xml
create mode 100644 tests/nodedevxml2xmlout/mdev_d069d019_36ea_4111_8f0a_8c9a70e21366.xml
create mode 100644 tests/nodedevxml2xmlout/mdev_d2441d39_495e_4243_ad9f_beb3f14c23d9.xml
create mode 100644 tests/nodedevxml2xmlout/mdev_ee0b88c4_f554_4dc1_809d_b2a01e8e48ad.xml
create mode 100644 tests/nodedevxml2xmlout/mdev_fedc4916_1ca8_49ac_b176_871d16c13076.xml
create mode 100644 tests/nodedevxml2xmlout/mdev_manual.xml
create mode 100644 tests/nodedevxml2xmlout/net_00_13_02_b9_f9_d3.xml
create mode 100644 tests/nodedevxml2xmlout/net_00_15_58_2f_e9_55.xml
create mode 100644 tests/nodedevxml2xmlout/pci_0000_00_02_0_header_type.xml
create mode 100644 tests/nodedevxml2xmlout/pci_0000_00_1c_0_header_type.xml
create mode 100644 tests/nodedevxml2xmlout/pci_0000_02_10_7_mdev_types.xml
create mode 100644 tests/nodedevxml2xmlout/pci_0000_02_10_7_sriov.xml
create mode 100644 tests/nodedevxml2xmlout/pci_0000_02_10_7_sriov_pf_vfs_all.xml
create mode 100644 tests/nodedevxml2xmlout/pci_0000_02_10_7_sriov_pf_vfs_all_header_type.xml
create mode 100644 tests/nodedevxml2xmlout/pci_0000_02_10_7_sriov_vfs.xml
create mode 100644 tests/nodedevxml2xmlout/pci_0000_02_10_7_sriov_zero_vfs_max_count.xml
create mode 100644 tests/nodedevxml2xmlout/pci_1002_71c4.xml
create mode 100644 tests/nodedevxml2xmlout/pci_8086_0c0c_snd_hda_intel.xml
create mode 100644 tests/nodedevxml2xmlout/pci_8086_10c9_sriov_pf.xml
create mode 100644 tests/nodedevxml2xmlout/pci_8086_27c5_scsi_host.xml
create mode 100644 tests/nodedevxml2xmlout/pci_8086_27c5_scsi_host_0.xml
create mode 100644 tests/nodedevxml2xmlout/pci_8086_27c5_scsi_host_0_unique_id.xml
create mode 100644 tests/nodedevxml2xmlout/pci_8086_27c5_scsi_host_scsi_device_lun0.xml
create mode 100644 tests/nodedevxml2xmlout/pci_8086_27c5_scsi_host_scsi_host.xml
create mode 100644 tests/nodedevxml2xmlout/pci_8086_4238_pcie_wireless.xml
create mode 100644 tests/nodedevxml2xmlout/scsi_target0_0_0.xml
create mode 100644 tests/nodedevxml2xmlout/scsi_target1_0_0.xml
create mode 100644 tests/nodedevxml2xmlout/storage_serial_3600c0ff000d7a2a5d463ff4902000000.xml
create mode 100644 tests/nodedevxml2xmlout/storage_serial_SATA_HTS721010G9SA00_MPCZ12Y0GNGWSE.xml
create mode 100644 tests/nodedevxml2xmlout/usb_device_1d6b_1_0000_00_1d_0.xml
create mode 100644 tests/nodedevxml2xmlout/usb_device_1d6b_1_0000_00_1d_0_if0.xml
--
2.31.1
2 years, 11 months
[PATCH] meson.build: Compile with -Walloca
by Thomas Huth
We are already compiling libvirt with -Wvla - so it does not make
too much sense to still allow people to use alloca() instead. Thus
put it on the list of things we want to warn about. Fortunately,
there is currently no warning with this flag, so the current
sources should be clean.
Signed-off-by: Thomas Huth <thuth(a)redhat.com>
---
meson.build | 1 +
1 file changed, 1 insertion(+)
diff --git a/meson.build b/meson.build
index 40c841e777..a97efdf8f4 100644
--- a/meson.build
+++ b/meson.build
@@ -234,6 +234,7 @@ cc_flags += [
'-Waddress-of-packed-member',
'-Waggressive-loop-optimizations',
'-Walloc-size-larger-than=@0@'.format(alloc_max.stdout().strip()),
+ '-Walloca',
'-Warray-bounds=2',
'-Wattribute-alias=2',
'-Wattribute-warning',
--
2.27.0
2 years, 11 months
[PATCH] meson.build: Remove the -Wvla-larger-then flag
by Thomas Huth
The flag has a typo in it, it's "...-than=..." and not "...-then=...",
so this was in fact never used. Since we're also using -Wvla (without
size), we should already get warnings about any variable length arrays
anyway, so the additional "-Wvla-larger-than" does not make much sense
and thus we can simply drop this.
Signed-off-by: Thomas Huth <thuth(a)redhat.com>
---
meson.build | 1 -
1 file changed, 1 deletion(-)
diff --git a/meson.build b/meson.build
index 4f23f9104e..40c841e777 100644
--- a/meson.build
+++ b/meson.build
@@ -390,7 +390,6 @@ cc_flags += [
'-Wvariadic-macros',
'-Wvector-operation-performance',
'-Wvla',
- '-Wvla-larger-then=4031',
'-Wvolatile-register-var',
'-Wwrite-strings',
]
--
2.27.0
2 years, 11 months
