August 2022 - Devel - libvirt List Archives

[PATCH] tpm: Refactor open-coded bitmap 'activePcrBanks' to virBitmap
by Peter Krempa 01 Aug '22

01 Aug '22

Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- Applies on top of Michal's series to fix 'activePcrBank' handling. src/conf/domain_conf.c | 17 +++++++++-------- src/conf/domain_conf.h | 2 +- src/qemu/qemu_tpm.c | 21 +++++++++------------ 3 files changed, 19 insertions(+), 21 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index ddd6fe1c90..fccb29bc63 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -3255,6 +3255,7 @@ void virDomainTPMDefFree(virDomainTPMDef *def) virObjectUnref(def->data.emulator.source); g_free(def->data.emulator.storagepath); g_free(def->data.emulator.logfile); + virBitmapFree(def->data.emulator.activePcrBanks); break; case VIR_DOMAIN_TPM_TYPE_LAST: break; @@ -10442,6 +10443,8 @@ virDomainTPMDefParseXML(virDomainXMLOption *xmlopt, if ((nnodes = virXPathNodeSet("./backend/active_pcr_banks/*", ctxt, &nodes)) < 0) break; + if (nnodes > 0) + def->data.emulator.activePcrBanks = virBitmapNew(0); for (i = 0; i < nnodes; i++) { if ((bank = virDomainTPMPcrBankTypeFromString((const char *)nodes[i]->name)) < 0) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, @@ -10449,7 +10452,7 @@ virDomainTPMDefParseXML(virDomainXMLOption *xmlopt, nodes[i]->name); goto error; } - def->data.emulator.activePcrBanks |= (1 << bank); + virBitmapSetBitExpand(def->data.emulator.activePcrBanks, bank); } break; case VIR_DOMAIN_TPM_TYPE_LAST: @@ -20671,7 +20674,8 @@ virDomainTPMDefCheckABIStability(virDomainTPMDef *src, return false; } - if (src->data.emulator.activePcrBanks != dst->data.emulator.activePcrBanks) { + if (!virBitmapEqual(src->data.emulator.activePcrBanks, + dst->data.emulator.activePcrBanks)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("Target active PCR banks doesn't match source")); return false; @@ -24235,13 +24239,10 @@ virDomainTPMDefFormat(virBuffer *buf, } if (def->data.emulator.activePcrBanks) { g_auto(virBuffer) activePcrBanksBuf = VIR_BUFFER_INIT_CHILD(&backendChildBuf); - size_t i; + ssize_t bank = -1; - for (i = VIR_DOMAIN_TPM_PCR_BANK_SHA1; i < VIR_DOMAIN_TPM_PCR_BANK_LAST; i++) { - if ((def->data.emulator.activePcrBanks & (1 << i))) - virBufferAsprintf(&activePcrBanksBuf, "<%s/>\n", - virDomainTPMPcrBankTypeToString(i)); - } + while ((bank = virBitmapNextSetBit(def->data.emulator.activePcrBanks, bank)) > -1) + virBufferAsprintf(&activePcrBanksBuf, "<%s/>\n", virDomainTPMPcrBankTypeToString(bank)); virXMLFormatElement(&backendChildBuf, "active_pcr_banks", NULL, &activePcrBanksBuf); } diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 200a75d705..724265b6b5 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -1451,7 +1451,7 @@ struct _virDomainTPMDef { unsigned char secretuuid[VIR_UUID_BUFLEN]; bool hassecretuuid; bool persistent_state; - unsigned int activePcrBanks; + virBitmap *activePcrBanks; } emulator; } data; }; diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index f28dd2e1e9..c08b0851da 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -444,19 +444,16 @@ qemuTPMEmulatorRunSetup(const char *storagepath, static char * -qemuTPMPcrBankBitmapToStr(unsigned int pcrBanks) +qemuTPMPcrBankBitmapToStr(virBitmap *activePcrBanks) { g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER; - const char *comma = ""; - size_t i; - - for (i = VIR_DOMAIN_TPM_PCR_BANK_SHA1; i < VIR_DOMAIN_TPM_PCR_BANK_LAST; i++) { - if (pcrBanks & (1 << i)) { - virBufferAsprintf(&buf, "%s%s", - comma, virDomainTPMPcrBankTypeToString(i)); - comma = ","; - } - } + ssize_t bank = -1; + + while ((bank = virBitmapNextSetBit(activePcrBanks, bank)) > -1) + virBufferAsprintf(&buf, "%s,", virDomainTPMPcrBankTypeToString(bank)); + + virBufferTrim(&buf, ","); + return virBufferContentAndReset(&buf); } @@ -481,7 +478,7 @@ static int qemuTPMEmulatorReconfigure(const char *storagepath, uid_t swtpm_user, gid_t swtpm_group, - unsigned int activePcrBanks, + virBitmap *activePcrBanks, const char *logfile, const virDomainTPMVersion tpmversion, const unsigned char *secretuuid) -- 2.36.1

2 1

[PATCH 0/8] conf: Don't lose <active_pcr_banks/> when no TPM version is provided
by Michal Privoznik 01 Aug '22

01 Aug '22

*** BLURB HERE *** Michal Prívozník (8): conf: Report an error when default TPM model is provided conf: Report error when default TPM version is provided conf: Drop needless setting of VIR_DOMAIN_TPM_VERSION_DEFAULT conf: Move _virDomainTPMDef::version into _virDomainTPMDef::data::emulator conf: Use virXMLPropEnum more when parsing TPM qemu_domain: Move TPM post parse code into qemuDomainTPMDefPostParse() qemu: Move TPMs validation out of PostParse conf: Don't lose <active_pcr_banks/> when no TPM version is provided src/conf/domain_conf.c | 81 +++++++++++++------------------- src/conf/domain_conf.h | 10 ++-- src/conf/domain_validate.c | 28 ++++++++++- src/qemu/qemu_command.c | 2 +- src/qemu/qemu_domain.c | 63 ++++++------------------- src/qemu/qemu_tpm.c | 10 ++-- src/qemu/qemu_validate.c | 87 ++++++++++++++++++++++++----------- src/security/virt-aa-helper.c | 2 +- 8 files changed, 147 insertions(+), 136 deletions(-) -- 2.35.1

3 23

Can RHEL7 VM run remote libvirt commands to Fedora36 host?
by Carol Bouchard 01 Aug '22

01 Aug '22

I have a test environment that use to work but no longer does. My laptop is Fedora36 (libvirt version 8.1.0.2) while the VMs it spawns are RHEL7 (max libvirt version is 4.5.0). The source of my problem seems to be that RHEL7 libvirt needs rw socket /var/run/libvirt/libvirt-sock which no longer exists in fedora36. The following is successful from RHEL7 VM to laptop: virsh -d0 --connect 'qemu+ssh://192.168.120.1/system?*socket*=/var/run/libvirt/libvirt-sock-ro' domstate beaker-test-vm1.beaker If I change the action from domstate to start, it fails on error: Failed to start domain beaker-test-vm1.beaker error: operation forbidden: read only access prevents virDomainCreate which made me realize ro stands for read-only; however, there is no libvirt-sock. I tried some of the other socket files without success. Is there a work-around? Carol

2 3

[PATCH] spec: Remove duplicate check of libvirtd status
by Jim Fehlig 01 Aug '22

01 Aug '22

The %posttrans scriptlet checks if libvirtd is active within a condition that is only executed if libvirtd is active. Remove the duplicate check. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- This patch contains an improvement Martin suggested while reviewing another patch to the posttrans scriptlet https://listman.redhat.com/archives/libvir-list/2022-July/232947.html The problem of not restarting socket units if libvird is inactive persists, but it is not clear if socket units need restarted on package update. libvirt.spec.in | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 9d788b790f..a238edf2aa 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1365,18 +1365,12 @@ then # own the sockets again when it comes back up. Thus we must # do this particular ordering, so that we get libvirtd # running with socket activation in use - /bin/systemctl is-active libvirtd.service 1>/dev/null 2>&1 - if test $? = 0 - then - /bin/systemctl stop libvirtd.service >/dev/null 2>&1 || : - - /bin/systemctl try-restart \ - libvirtd.socket \ - libvirtd-ro.socket \ - libvirtd-admin.socket >/dev/null 2>&1 || : - - /bin/systemctl start libvirtd.service >/dev/null 2>&1 || : - fi + /bin/systemctl stop libvirtd.service >/dev/null 2>&1 || : + /bin/systemctl try-restart \ + libvirtd.socket \ + libvirtd-ro.socket \ + libvirtd-admin.socket >/dev/null 2>&1 || : + /bin/systemctl start libvirtd.service >/dev/null 2>&1 || : fi fi -- 2.36.1

2 2

Release of libvirt-8.6.0
by Jiri Denemark 01 Aug '22

01 Aug '22

The 8.6.0 release of both libvirt and libvirt-python is tagged and signed tarballs and source RPMs are available at https://libvirt.org/sources/ https://libvirt.org/sources/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * Improvements * conf: Improved firmware autoselection The firmware autoselection feature now behaves more intuitively, reports better error messages on failure and comes with high-level documentation. Enjoy. Jirka

1 0