July 2021 - Devel - libvirt List Archives

Requesting a release of ruby-libvirt gem
by Darragh Bailey 11 Jul '21

11 Jul '21

Hi, Would it be possible to get a new release of the ruby-libvirt gem pushed to rubygems? Currently with the latest vagrant moving to ruby 3.0, bumping into an issue with ruby-libvirt having problems being installed as a dependency of vagrant-libvirt: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/1322 https://github.com/hashicorp/vagrant/issues/12445 The latest master contains a fix for the include path of the st.h file from ruby includes. There is a workaround mentioned at https://github.com/hashicorp/vagrant/issues/12445#issuecomment-876566065 using: CFLAGS="-I/opt/vagrant/embedded/include/ruby-3.0.0/ruby" vagrant plugin install vagrant-libvirt I've done a test using rvm with both ruby 2.6.6 and 3.0.0 to check building a local package of the latest tip of ruby-libvirt can be installed correctly for both ruby 3.0 and earlier so it shouldn't break with slightly older versions of vagrant. -- Darragh Bailey

1 0

[PATCH 0/2] qemu: Do not erase duplicate input from namespace
by Kristina Hanicova 09 Jul '21

09 Jul '21

If the attempt to attach an input device failed, we erased the unattached device from the namespace. This resulted in erasing an already attached device in case of a duplicate. We need to check for existing file in the namespace in order to determine erasing it in case of a failure. Kristina Hanicova (2): qemu: Check for existing file in namespace qemu: Do not erase input device from namespace if duplicate src/qemu/qemu_hotplug.c | 3 +-- src/qemu/qemu_namespace.c | 34 ++++++++++++++++++++++------------ src/qemu/qemu_namespace.h | 3 ++- src/util/virprocess.c | 6 ++++-- 4 files changed, 29 insertions(+), 17 deletions(-) -- 2.31.1

3 5

[PATCH 3/2] qemu-img: Improve error for rebase without backing format
by Eric Blake 09 Jul '21

09 Jul '21

When removeing support for qemu-img being able to create backing chains without embedded backing formats, we caused a poor error message as caught by iotest 114. Improve the situation to inform the user what went wrong. Suggested-by: Kevin Wolf <kwolf(a)redhat.com> Signed-off-by: Eric Blake <eblake(a)redhat.com> --- qemu-img.c | 3 +++ tests/qemu-iotests/114.out | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/qemu-img.c b/qemu-img.c index 7c0e73882dd4..b017734c255a 100644 --- a/qemu-img.c +++ b/qemu-img.c @@ -3786,6 +3786,9 @@ static int img_rebase(int argc, char **argv) if (ret == -ENOSPC) { error_report("Could not change the backing file to '%s': No " "space left in the file header", out_baseimg); + } else if (ret == -EINVAL && out_baseimg && !out_basefmt) { + error_report("Could not change the backing file to '%s': backing " + "format must be specified", out_baseimg); } else if (ret < 0) { error_report("Could not change the backing file to '%s': %s", out_baseimg, strerror(-ret)); diff --git a/tests/qemu-iotests/114.out b/tests/qemu-iotests/114.out index 172454401257..016e9ce3ecfb 100644 --- a/tests/qemu-iotests/114.out +++ b/tests/qemu-iotests/114.out @@ -14,7 +14,7 @@ qemu-io: can't open device TEST_DIR/t.qcow2: Could not open backing file: Unknow no file open, try 'help open' read 4096/4096 bytes at offset 0 4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) -qemu-img: Could not change the backing file to '/home/eblake/qemu/build/tests/qemu-iotests/scratch/t.qcow2.base': Invalid argument +qemu-img: Could not change the backing file to '/home/eblake/qemu/build/tests/qemu-iotests/scratch/t.qcow2.base': backing format must be specified read 4096/4096 bytes at offset 0 4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) *** done -- 2.31.1

2 3

[PATCH] qemu: Fix error code for SEV launchSecurity unsupported
by Boris Fiuczynski 09 Jul '21

09 Jul '21

When SEV is not supported but specified in the domain XML by a user it should not result in an internal error (VIR_ERR_INTERNAL_ERROR) therefore switching to XML error (VIR_ERR_CONFIG_UNSUPPORTED). Signed-off-by: Boris Fiuczynski <fiuczy(a)linux.ibm.com> --- This patch is based on top of the series [PATCH v4 0/8] Support for launchSecurity type s390-pv src/qemu/qemu_validate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c index 7482bedee6..bb672727d5 100644 --- a/src/qemu/qemu_validate.c +++ b/src/qemu/qemu_validate.c @@ -1218,7 +1218,7 @@ qemuValidateDomainDef(const virDomainDef *def, switch ((virDomainLaunchSecurity) def->sec->sectype) { case VIR_DOMAIN_LAUNCH_SECURITY_SEV: if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV_GUEST)) { - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("SEV launch security is not supported with " "this QEMU binary")); return -1; -- 2.31.1

1 0

[libvirt PATCH 0/2] Remove macros "VIR_INSERT_ELEMENT_COPY" and "VIR_INSERT_ELEMENT_COPY_INPLACE"
by Tim Wiederhake 09 Jul '21

09 Jul '21

There was but one use left, and that is removed in patch 1. Tim Wiederhake (2): virQEMUCapsGetMachineTypesCaps: Use GPtrArray viralloc: Delete VIR_INSERT_ELEMENT_COPY and VIR_INSERT_ELEMENT_COPY_INPLACE src/qemu/qemu_capabilities.c | 37 ++++++++++++++++++------------------ src/util/viralloc.h | 22 ++++----------------- 2 files changed, 22 insertions(+), 37 deletions(-) -- 2.31.1

2 5

[libvirt PATCH] qemu: remove default audio backend for migratable XML
by Daniel P. Berrangé 09 Jul '21

09 Jul '21

When seeing a guest with a sound device, and no audio backend, we automatically add an audio backend XML element based on the historical QEMU driver behaviour. Unfortunately when we live migrate back to an old libvirt, it may not understand the audio driver type we configured. We thus need to strip the default audio backend when migrating. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/libvirt_private.syms | 1 + src/qemu/qemu_domain.c | 128 ++++++++++++++++++++++++++++++--------- 2 files changed, 101 insertions(+), 28 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 43e6398ae5..cc7533a707 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -226,6 +226,7 @@ virDiskNameParse; virDiskNameToBusDeviceIndex; virDiskNameToIndex; virDomainActualNetDefFree; +virDomainAudioDefFree; virDomainAudioFormatTypeFromString; virDomainAudioFormatTypeToString; virDomainAudioIOCommonIsSet; diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 8488f58e09..3af678a283 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -3587,18 +3587,19 @@ qemuDomainDefAddImplicitInputDevice(virDomainDef *def) } static int -qemuDomainDefAddDefaultAudioBackend(virQEMUDriver *driver, - virDomainDef *def) +qemuDomainDefSuggestDefaultAudioBackend(virQEMUDriver *driver, + virDomainDef *def, + bool *addAudio, + int *audioBackend, + int *audioSDLDriver) { size_t i; - bool addAudio = false; bool audioPassthrough = false; - int audioBackend = VIR_DOMAIN_AUDIO_TYPE_NONE; g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver); - if (def->naudios > 0) { - return 0; - } + *addAudio = false; + *audioBackend = VIR_DOMAIN_AUDIO_TYPE_NONE; + *audioSDLDriver = VIR_DOMAIN_AUDIO_SDL_DRIVER_DEFAULT; for (i = 0; i < def->ngraphics; i++) { virDomainGraphicsDef *graph = def->graphics[i]; @@ -3609,18 +3610,18 @@ qemuDomainDefAddDefaultAudioBackend(virQEMUDriver *driver, audioPassthrough = true; } else { audioPassthrough = false; - audioBackend = VIR_DOMAIN_AUDIO_TYPE_NONE; + *audioBackend = VIR_DOMAIN_AUDIO_TYPE_NONE; } - addAudio = true; + *addAudio = true; break; case VIR_DOMAIN_GRAPHICS_TYPE_SPICE: audioPassthrough = false; - audioBackend = VIR_DOMAIN_AUDIO_TYPE_SPICE; - addAudio = true; + *audioBackend = VIR_DOMAIN_AUDIO_TYPE_SPICE; + *addAudio = true; break; case VIR_DOMAIN_GRAPHICS_TYPE_SDL: audioPassthrough = true; - addAudio = true; + *addAudio = true; break; case VIR_DOMAIN_GRAPHICS_TYPE_RDP: @@ -3639,24 +3640,24 @@ qemuDomainDefAddDefaultAudioBackend(virQEMUDriver *driver, audioPassthrough = true; } else { audioPassthrough = false; - audioBackend = VIR_DOMAIN_AUDIO_TYPE_NONE; + *audioBackend = VIR_DOMAIN_AUDIO_TYPE_NONE; } - addAudio = true; + *addAudio = true; } - if (addAudio && audioPassthrough) { + if (*addAudio && audioPassthrough) { const char *audioenv = g_getenv("QEMU_AUDIO_DRV"); if (audioenv == NULL) { - addAudio = false; + *addAudio = false; } else { /* * QEMU audio driver names are mostly the same as * libvirt XML audio backend names */ if (STREQ(audioenv, "pa")) { - audioBackend = VIR_DOMAIN_AUDIO_TYPE_PULSEAUDIO; + *audioBackend = VIR_DOMAIN_AUDIO_TYPE_PULSEAUDIO; } else { - if ((audioBackend = virDomainAudioTypeTypeFromString(audioenv)) < 0) { + if (((*audioBackend) = virDomainAudioTypeTypeFromString(audioenv)) < 0) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("unknown QEMU_AUDIO_DRV setting %s"), audioenv); return -1; @@ -3664,6 +3665,79 @@ qemuDomainDefAddDefaultAudioBackend(virQEMUDriver *driver, } } } + + if (*addAudio && *audioBackend == VIR_DOMAIN_AUDIO_TYPE_SDL) { + const char *sdldriver = g_getenv("SDL_AUDIODRIVER"); + if (sdldriver != NULL && + (((*audioSDLDriver) = + virDomainAudioSDLDriverTypeFromString(sdldriver)) <= 0)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("unknown SDL_AUDIODRIVER setting %s"), sdldriver); + return -1; + } + } + + return 0; +} + +static int +qemuDomainDefClearDefaultAudioBackend(virQEMUDriver *driver, + virDomainDef *def) +{ + bool addAudio; + int audioBackend; + int audioSDLDriver; + virDomainAudioDef *audio; + + if (def->naudios != 1) { + return 0; + } + + if (qemuDomainDefSuggestDefaultAudioBackend(driver, + def, + &addAudio, + &audioBackend, + &audioSDLDriver) < 0) + return -1; + + if (!addAudio) + return 0; + + audio = def->audios[0]; + if (audio->type != audioBackend) + return 0; + + if (audio->type == VIR_DOMAIN_AUDIO_TYPE_SDL && + audio->backend.sdl.driver != audioSDLDriver) + return 0; + + virDomainAudioDefFree(audio); + g_free(def->audios); + def->naudios = 0; + def->audios = NULL; + + return 0; +} + +static int +qemuDomainDefAddDefaultAudioBackend(virQEMUDriver *driver, + virDomainDef *def) +{ + bool addAudio; + int audioBackend; + int audioSDLDriver; + + if (def->naudios > 0) { + return 0; + } + + if (qemuDomainDefSuggestDefaultAudioBackend(driver, + def, + &addAudio, + &audioBackend, + &audioSDLDriver) < 0) + return -1; + if (addAudio) { virDomainAudioDef *audio = g_new0(virDomainAudioDef, 1); @@ -3674,16 +3748,8 @@ qemuDomainDefAddDefaultAudioBackend(virQEMUDriver *driver, def->audios = g_new0(virDomainAudioDef *, def->naudios); def->audios[0] = audio; - if (audioBackend == VIR_DOMAIN_AUDIO_TYPE_SDL) { - const char *sdldriver = g_getenv("SDL_AUDIODRIVER"); - if (sdldriver != NULL && - ((audio->backend.sdl.driver = - virDomainAudioSDLDriverTypeFromString(sdldriver)) <= 0)) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, - _("unknown SDL_AUDIODRIVER setting %s"), sdldriver); - return -1; - } - } + if (audioBackend == VIR_DOMAIN_AUDIO_TYPE_SDL) + audio->backend.sdl.driver = audioSDLDriver; } return 0; @@ -6298,6 +6364,12 @@ qemuDomainDefFormatBufInternal(virQEMUDriver *driver, if (def->cpu && qemuDomainMakeCPUMigratable(def->cpu) < 0) return -1; + + /* Old libvirt doesn't understand <audio> elements so + * remove any we added by default + */ + if (qemuDomainDefClearDefaultAudioBackend(driver, def) < 0) + return -1; } format: -- 2.31.1

2 1

[PATCH] lib: Specify domain redefinition requirements
by Roman Bolshakov 09 Jul '21

09 Jul '21

There might be misunderstanding [1] when libvirt permits domain redefinition and if it's a valid case at all. 1. https://github.com/ansible-collections/community.libvirt/blob/b973d7c4b4058… Signed-off-by: Roman Bolshakov <r.bolshakov(a)yadro.com> --- src/libvirt-domain.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c index 750e32f0ca..e48f3cdb02 100644 --- a/src/libvirt-domain.c +++ b/src/libvirt-domain.c @@ -6290,8 +6290,8 @@ virDomainGetBlockInfo(virDomainPtr domain, const char *disk, * * Define a domain, but does not start it. * This definition is persistent, until explicitly undefined with - * virDomainUndefine(). A previous definition for this domain would be - * overridden if it already exists. + * virDomainUndefine(). A previous definition for this domain with the same + * UUID and name would be overridden if it already exists. * * virDomainFree should be used to free the resources after the * domain object is no longer needed. @@ -6333,8 +6333,8 @@ virDomainDefineXML(virConnectPtr conn, const char *xml) * * Defines a domain, but does not start it. * This definition is persistent, until explicitly undefined with - * virDomainUndefine(). A previous definition for this domain would be - * overridden if it already exists. + * virDomainUndefine(). A previous definition for this domain with the same + * UUID and name would be overridden if it already exists. * * virDomainFree should be used to free the resources after the * domain object is no longer needed. -- 2.32.0

2 1

[PATCH v4 0/8] Support for launchSecurity type s390-pv
by Boris Fiuczynski 08 Jul '21

08 Jul '21

This patch series introduces the launch security type s390-pv. Specifying s390-pv as launch security type in an s390 domain prepares for running the guest in protected virtualization secure mode, also known as IBM Secure Execution. diff to v3: - moved virDomainSEVDef into a union - improved XML formating for launchSecurity - use a shared id on the qemu cmd line for confidential-guest-support - added check for s390-pv host support into XML validation - changed from ignoring to failing if launchSecuroty child elements are provided for s390-pv - reduced test to a single failing test - add availability of s390-pv in domain capabilities diff to v2: - Broke up previous patch one into three patches diff to v1: - Rebased to current master - Added verification check for confidential-guest-support capability Boris Fiuczynski (8): schemas: Make SEV policy on launch security optional conf: rework SEV XML parse and format methods qemu: make KVMSupportsSecureGuest capability available conf: refactor launch security to allow more types qemu: add s390-pv-guest capability conf: add availability of s390-pv in domain capabilities qemu: use common id lsec0 for launchSecurity docs: add s390-pv documentation docs/formatdomain.rst | 7 + docs/kbase/s390_protected_virt.rst | 55 ++++++- docs/schemas/domaincaps.rng | 9 ++ docs/schemas/domaincommon.rng | 13 +- src/conf/domain_capabilities.c | 1 + src/conf/domain_capabilities.h | 1 + src/conf/domain_conf.c | 143 +++++++++++++----- src/conf/domain_conf.h | 17 ++- src/conf/virconftypes.h | 2 + src/qemu/qemu_capabilities.c | 24 +++ src/qemu/qemu_capabilities.h | 4 + src/qemu/qemu_cgroup.c | 4 +- src/qemu/qemu_command.c | 75 +++++++-- src/qemu/qemu_driver.c | 3 +- src/qemu/qemu_firmware.c | 33 ++-- src/qemu/qemu_namespace.c | 21 ++- src/qemu/qemu_process.c | 35 ++++- src/qemu/qemu_validate.c | 32 +++- src/security/security_dac.c | 6 +- tests/domaincapsdata/qemu_2.11.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.12.0.s390x.xml | 1 + tests/domaincapsdata/qemu_3.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_4.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_4.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_5.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_6.0.0.s390x.xml | 1 + tests/domaincapsmock.c | 17 +++ .../launch-security-s390-pv.xml | 18 +++ tests/genericxml2xmltest.c | 1 + .../qemucapabilitiesdata/caps_6.0.0.s390x.xml | 1 + ...nch-security-s390-pv-fail.s390x-latest.err | 1 + .../launch-security-s390-pv-fail.xml | 33 ++++ .../launch-security-s390-pv.s390x-latest.args | 35 +++++ .../launch-security-s390-pv.xml | 30 ++++ ...v-missing-platform-info.x86_64-2.12.0.args | 4 +- ...urity-sev-missing-policy.x86_64-2.12.0.err | 1 + .../launch-security-sev-missing-policy.xml | 34 +++++ .../launch-security-sev.x86_64-2.12.0.args | 4 +- .../launch-security-sev.x86_64-6.0.0.args | 4 +- tests/qemuxml2argvmock.c | 16 ++ tests/qemuxml2argvtest.c | 4 + 41 files changed, 588 insertions(+), 107 deletions(-) create mode 100644 tests/genericxml2xmlindata/launch-security-s390-pv.xml create mode 100644 tests/qemuxml2argvdata/launch-security-s390-pv-fail.s390x-latest.err create mode 100644 tests/qemuxml2argvdata/launch-security-s390-pv-fail.xml create mode 100644 tests/qemuxml2argvdata/launch-security-s390-pv.s390x-latest.args create mode 100644 tests/qemuxml2argvdata/launch-security-s390-pv.xml create mode 100644 tests/qemuxml2argvdata/launch-security-sev-missing-policy.x86_64-2.12.0.err create mode 100644 tests/qemuxml2argvdata/launch-security-sev-missing-policy.xml -- 2.31.1

1 8

[PATCH] vircgroup: Improve virCgroupControllerAvailable wrt to CGroupsV2
by Michal Privoznik 08 Jul '21

08 Jul '21

It all started as a simple bug: trying to move domain memory between NUMA nodes (e.g. via virsh numatune) did not work. I've traced the problem to qemuProcessHook() because that's where we decide whether to rely on CGroups or use numactl APIs to satisfy <numatune/>. The problem was that virCgroupControllerAvailable() was telling us that cpuset controller is unavailable. This is CGroupsV2, and pretty weird because CGroupsV2 definitely do support cpuset controller and I had them mounted in a standard way. What I found out (with Pavel's help) was that virCgroupNewSelf() was looking into the following path to detect supported controllers: /sys/fs/cgroup/system.slice/cgroup.controllers However, if there's no other VM running then the system.slice only has 'memory' and 'pids' controllers. Therefore, we saw 'cpuset' as not available. The fix is to look at the top most path, which has the full set of controllers: /sys/fs/cgroup/cgroup.controllers Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1976690 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/util/vircgroup.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c index 65a81e8d6f..1b3b28342e 100644 --- a/src/util/vircgroup.c +++ b/src/util/vircgroup.c @@ -2996,7 +2996,10 @@ virCgroupControllerAvailable(int controller) { g_autoptr(virCgroup) cgroup = NULL; - if (virCgroupNewSelf(&cgroup) < 0) + /* Don't use virCgroupNewSelf() - we might be running in a slice that + * doesn't have @controller but the domain (for which we will later use + * virCgroupHasController()) might have it. */ + if (virCgroupNew("/", -1, &cgroup) < 0) return false; return virCgroupHasController(cgroup, controller); -- 2.31.1

2 1

Add SELinux policy for Virt
by Nikola Knazekova 08 Jul '21

08 Jul '21

Hi, I created SELinux policy for Libvirt drivers, as part of Decentralized SELinux Policy (DSP) project. DSP guidelines is available: https://fedoraproject.org/wiki/SELinux/IndependentPolicy Discussion about the first version of SELinux policy for Libvirt is available on gitlab: https://gitlab.com/libvirt/libvirt/-/merge_requests/65 SELinux policy was created for: Hypervisor drivers: - virtqemud (QEMU/KVM) - virtlxcd (LXC) - virtvboxd (VirtualBox) Secondary drivers: - virtstoraged (host storage mgmt) - virtnetworkd (virtual network mgmt) - virtinterface (network interface mgmt) - virtnodedevd (physical device mgmt) - virtsecretd (security credential mgmt) - virtnwfilterd (ip[6]tables/ebtables mgmt) - virtproxyd (proxy daemon) SELinux policy for virtvxz and virtxend has not been created yet, because I wasn't able to reproduce AVC messages. These drivers run in unconfined_domain until the AVC messages are reproduced internally and policy for these drivers is made. Can you please look at it? Thanks Nikola

5 45