March 2023 - Devel - libvirt List Archives

[PATCH 00/14] qemuBuildThreadContextProps: Prune .node-afinity wrt <emulatorpin/>
by Michal Privoznik 13 Mar '23

13 Mar '23

See 12/14 for explanation and seeing the fix in action. Michal Prívozník (14): virnuma: Move virNumaNodesetToCPUset() our of WITH_NUMACTL virnuma: Introduce virNumaCPUSetToNodeset() virnumamock: Introduce virNumaGetNodeOfCPU() mock qemuxml2argvtest: Use virnuma mock qemuxml2argvdata: Adjust maximum NUMA node used qemuxml2argvdata: Extend vCPUs placement in memory-hotplug-dimm-addr.xml qemuxml2argvmock: Drop virNuma* mocks qemu: Move cpuset preference evaluation into a separate function qemu: Fix qemuDomainGetEmulatorPinInfo() qemu: Add @nodemaskRet argument to qemuBuildMemoryBackendProps() qemu: Add @nodemask argument to qemuBuildThreadContextProps() qemuBuildThreadContextProps: Prune .node-afinity wrt <emulatorpin/> docs: Document memory allocation and emulator pinning limitation NEWS: Document recent thread-context bug fix NEWS.rst | 7 + docs/formatdomain.rst | 4 +- src/libvirt_private.syms | 2 + src/qemu/qemu_command.c | 90 +++++++---- src/qemu/qemu_command.h | 8 +- src/qemu/qemu_domain.c | 18 +++ src/qemu/qemu_domain.h | 5 + src/qemu/qemu_driver.c | 11 +- src/qemu/qemu_hotplug.c | 2 +- src/qemu/qemu_process.c | 9 +- src/util/virnuma.c | 148 ++++++++++++------ src/util/virnuma.h | 5 +- tests/meson.build | 2 +- ...emory-hotplug-dimm-addr.x86_64-latest.args | 2 +- .../memory-hotplug-dimm-addr.xml | 2 +- .../migrate-numa-unaligned.args | 4 +- .../migrate-numa-unaligned.xml | 4 +- .../numatune-memnode-restrictive-mode.xml | 4 +- ...-unavailable-restrictive.x86_64-latest.err | 2 +- ...mnode-unavailable-strict.x86_64-latest.err | 2 +- tests/qemuxml2argvdata/numatune-memnode.args | 4 +- .../numatune-memnode.x86_64-5.2.0.args | 4 +- .../numatune-memnode.x86_64-latest.args | 4 +- tests/qemuxml2argvdata/numatune-memnode.xml | 4 +- ...umatune-static-nodeset-exceed-hostnode.err | 2 +- tests/qemuxml2argvmock.c | 41 ----- tests/qemuxml2argvtest.c | 5 +- ...memory-hotplug-dimm-addr.x86_64-latest.xml | 2 +- tests/qemuxml2xmloutdata/numatune-memnode.xml | 4 +- .../linux-basic/system/cpu/cpu0/node0 | 1 + .../linux-basic/system/cpu/cpu1/node0 | 1 + .../linux-basic/system/cpu/cpu10/node2 | 1 + .../linux-basic/system/cpu/cpu11/node2 | 1 + .../linux-basic/system/cpu/cpu12/node3 | 1 + .../linux-basic/system/cpu/cpu13/node3 | 1 + .../linux-basic/system/cpu/cpu14/node3 | 1 + .../linux-basic/system/cpu/cpu15/node3 | 1 + .../linux-basic/system/cpu/cpu2/node0 | 1 + .../linux-basic/system/cpu/cpu3/node0 | 1 + .../linux-basic/system/cpu/cpu4/node1 | 1 + .../linux-basic/system/cpu/cpu5/node1 | 1 + .../linux-basic/system/cpu/cpu6/node1 | 1 + .../linux-basic/system/cpu/cpu7/node1 | 1 + .../linux-basic/system/cpu/cpu8/node2 | 1 + .../linux-basic/system/cpu/cpu9/node2 | 1 + .../linux-caches/system/cpu/cpu0/node0 | 1 + .../linux-caches/system/cpu/cpu1/node0 | 1 + .../linux-caches/system/cpu/cpu2/node0 | 1 + .../linux-caches/system/cpu/cpu3/node0 | 1 + .../linux-caches/system/cpu/cpu4/node0 | 1 + .../linux-caches/system/cpu/cpu5/node0 | 1 + .../linux-caches/system/cpu/cpu6/node0 | 1 + .../linux-caches/system/cpu/cpu7/node0 | 1 + .../system/cpu/cpu0/node0 | 1 + .../linux-resctrl/system/cpu/cpu0/node0 | 1 + .../linux-resctrl/system/cpu/cpu1/node0 | 1 + .../linux-resctrl/system/cpu/cpu10/node1 | 1 + .../linux-resctrl/system/cpu/cpu11/node1 | 1 + .../linux-resctrl/system/cpu/cpu2/node0 | 1 + .../linux-resctrl/system/cpu/cpu3/node0 | 1 + .../linux-resctrl/system/cpu/cpu4/node0 | 1 + .../linux-resctrl/system/cpu/cpu5/node0 | 1 + .../linux-resctrl/system/cpu/cpu6/node1 | 1 + .../linux-resctrl/system/cpu/cpu7/node1 | 1 + .../linux-resctrl/system/cpu/cpu8/node1 | 1 + .../linux-resctrl/system/cpu/cpu9/node1 | 1 + tests/virnumamock.c | 42 +++++ 67 files changed, 317 insertions(+), 163 deletions(-) create mode 120000 tests/vircaps2xmldata/linux-basic/system/cpu/cpu0/node0 create mode 120000 tests/vircaps2xmldata/linux-basic/system/cpu/cpu1/node0 create mode 120000 tests/vircaps2xmldata/linux-basic/system/cpu/cpu10/node2 create mode 120000 tests/vircaps2xmldata/linux-basic/system/cpu/cpu11/node2 create mode 120000 tests/vircaps2xmldata/linux-basic/system/cpu/cpu12/node3 create mode 120000 tests/vircaps2xmldata/linux-basic/system/cpu/cpu13/node3 create mode 120000 tests/vircaps2xmldata/linux-basic/system/cpu/cpu14/node3 create mode 120000 tests/vircaps2xmldata/linux-basic/system/cpu/cpu15/node3 create mode 120000 tests/vircaps2xmldata/linux-basic/system/cpu/cpu2/node0 create mode 120000 tests/vircaps2xmldata/linux-basic/system/cpu/cpu3/node0 create mode 120000 tests/vircaps2xmldata/linux-basic/system/cpu/cpu4/node1 create mode 120000 tests/vircaps2xmldata/linux-basic/system/cpu/cpu5/node1 create mode 120000 tests/vircaps2xmldata/linux-basic/system/cpu/cpu6/node1 create mode 120000 tests/vircaps2xmldata/linux-basic/system/cpu/cpu7/node1 create mode 120000 tests/vircaps2xmldata/linux-basic/system/cpu/cpu8/node2 create mode 120000 tests/vircaps2xmldata/linux-basic/system/cpu/cpu9/node2 create mode 120000 tests/vircaps2xmldata/linux-caches/system/cpu/cpu0/node0 create mode 120000 tests/vircaps2xmldata/linux-caches/system/cpu/cpu1/node0 create mode 120000 tests/vircaps2xmldata/linux-caches/system/cpu/cpu2/node0 create mode 120000 tests/vircaps2xmldata/linux-caches/system/cpu/cpu3/node0 create mode 120000 tests/vircaps2xmldata/linux-caches/system/cpu/cpu4/node0 create mode 120000 tests/vircaps2xmldata/linux-caches/system/cpu/cpu5/node0 create mode 120000 tests/vircaps2xmldata/linux-caches/system/cpu/cpu6/node0 create mode 120000 tests/vircaps2xmldata/linux-caches/system/cpu/cpu7/node0 create mode 120000 tests/vircaps2xmldata/linux-resctrl-skx-twocaches/system/cpu/cpu0/node0 create mode 120000 tests/vircaps2xmldata/linux-resctrl/system/cpu/cpu0/node0 create mode 120000 tests/vircaps2xmldata/linux-resctrl/system/cpu/cpu1/node0 create mode 120000 tests/vircaps2xmldata/linux-resctrl/system/cpu/cpu10/node1 create mode 120000 tests/vircaps2xmldata/linux-resctrl/system/cpu/cpu11/node1 create mode 120000 tests/vircaps2xmldata/linux-resctrl/system/cpu/cpu2/node0 create mode 120000 tests/vircaps2xmldata/linux-resctrl/system/cpu/cpu3/node0 create mode 120000 tests/vircaps2xmldata/linux-resctrl/system/cpu/cpu4/node0 create mode 120000 tests/vircaps2xmldata/linux-resctrl/system/cpu/cpu5/node0 create mode 120000 tests/vircaps2xmldata/linux-resctrl/system/cpu/cpu6/node1 create mode 120000 tests/vircaps2xmldata/linux-resctrl/system/cpu/cpu7/node1 create mode 120000 tests/vircaps2xmldata/linux-resctrl/system/cpu/cpu8/node1 create mode 120000 tests/vircaps2xmldata/linux-resctrl/system/cpu/cpu9/node1 -- 2.39.2

3 33

[libvirt PATCH 0/2] Fix virtiofs hotplug after daemon restart
by Ján Tomko 13 Mar '23

13 Mar '23

Ján Tomko (2): qemu: relax shared memory check for vhostuser daemons qemu: remove unused argument src/qemu/qemu_validate.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) -- 2.39.2

2 4

[libvirt PATCH] util: virXMLValidatorInit: improve translatable errors
by Ján Tomko 13 Mar '23

13 Mar '23

In some translations, the RNG initials were mistranslated as a random number generator. Spell it out as RelaxNG to make it clearer. Include the word 'schema' and quotes around the filename. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/util/virxml.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/util/virxml.c b/src/util/virxml.c index af4be4e443..c0789c062c 100644 --- a/src/util/virxml.c +++ b/src/util/virxml.c @@ -1563,7 +1563,7 @@ virXMLValidatorInit(const char *schemafile) if (!(validator->rngParser = xmlRelaxNGNewParserCtxt(validator->schemafile))) { virReportError(VIR_ERR_INTERNAL_ERROR, - _("Unable to create RNG parser for %s"), + _("Unable to create RelaxNG parser for schema '%s'"), validator->schemafile); return NULL; } @@ -1575,7 +1575,7 @@ virXMLValidatorInit(const char *schemafile) if (!(validator->rng = xmlRelaxNGParse(validator->rngParser))) { virReportError(VIR_ERR_INTERNAL_ERROR, - _("Unable to parse RNG %s: %s"), + _("Unable to parse RelaxNG schema '%s': %s"), validator->schemafile, virBufferCurrentContent(&validator->buf)); return NULL; @@ -1583,7 +1583,7 @@ virXMLValidatorInit(const char *schemafile) if (!(validator->rngValid = xmlRelaxNGNewValidCtxt(validator->rng))) { virReportError(VIR_ERR_INTERNAL_ERROR, - _("Unable to create RNG validation context %s"), + _("Unable to create RelaxNG validation context for schema '%s'"), validator->schemafile); return NULL; } -- 2.39.2

2 1

[PATCH] remote: fix typo in error message string
by Daniel P. Berrangé 13 Mar '23

13 Mar '23

Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- Pushing as a trivial fix src/remote/remote_daemon_dispatch.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c index 0d843d63f6..32d5f46db9 100644 --- a/src/remote/remote_daemon_dispatch.c +++ b/src/remote/remote_daemon_dispatch.c @@ -7332,7 +7332,7 @@ remoteDispatchDomainAuthorizedSshKeysGet(virNetServer *server G_GNUC_UNUSED, if (nkeys > REMOTE_DOMAIN_AUTHORIZED_SSH_KEYS_MAX) { virReportError(VIR_ERR_INTERNAL_ERROR, - _("Number of keys %d, which exceeds max liit: %d"), + _("Number of keys %d, which exceeds max limit: %d"), nkeys, REMOTE_DOMAIN_AUTHORIZED_SSH_KEYS_MAX); goto cleanup; } @@ -7369,7 +7369,7 @@ remoteDispatchDomainAuthorizedSshKeysSet(virNetServer *server G_GNUC_UNUSED, if (args->keys.keys_len > REMOTE_DOMAIN_AUTHORIZED_SSH_KEYS_MAX) { virReportError(VIR_ERR_INTERNAL_ERROR, - _("Number of keys %d, which exceeds max liit: %d"), + _("Number of keys %d, which exceeds max limit: %d"), args->keys.keys_len, REMOTE_DOMAIN_AUTHORIZED_SSH_KEYS_MAX); goto cleanup; } -- 2.39.2

1 0

[PATCH] docs: Fix searching in the wiki
by Peter Krempa 13 Mar '23

13 Mar '23

Conversion of the wiki to static pages means that the integrated search no longer functions. Use the same approach we have for other search to simply defer to google. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- docs/js/main.js | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/docs/js/main.js b/docs/js/main.js index 2edc628304..c37f9756a7 100644 --- a/docs/js/main.js +++ b/docs/js/main.js @@ -54,21 +54,16 @@ function advancedsearch(e) { } } + form.setAttribute("action", "https://google.com/search"); + newq.setAttribute("name", "q"); + if (what == "website") { - form.setAttribute("action", "https://google.com/search"); - newq.setAttribute("name", "q"); newq.value = "site:libvirt.org " + q.value; } else if (what == "wiki") { - form.setAttribute("action", "https://wiki.libvirt.org/index.php"); - newq.setAttribute("name", "search"); - newq.value = q.value; + newq.value = "site:wiki.libvirt.org " + q.value; } else if (what == "devs") { - form.setAttribute("action", "https://google.com/search"); - newq.setAttribute("name", "q"); newq.value = "site:redhat.com/archives/libvir-list " + q.value; } else if (what == "users") { - form.setAttribute("action", "https://google.com/search"); - newq.setAttribute("name", "q"); newq.value = "site:redhat.com/archives/libvirt-users " + q.value; } -- 2.39.2

2 1

[PATCH] Use G_N_ELEMENTS() more
by Michal Privoznik 13 Mar '23

13 Mar '23

In a few places we still use the good old: sizeof(var) / sizeof(var[0]) sizeof(var) / sizeof(int) The G_N_ELEMENTS() macro is preferred though. In a few places we don't link with glib, so provide the macro definition. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- examples/c/misc/openauth.c | 4 +++- src/libvirt.c | 2 +- tests/virbitmaptest.c | 4 ++-- tests/virnetdevtest.c | 8 ++++---- tools/nss/libvirt_nss.c | 3 ++- tools/virt-login-shell.c | 3 ++- 6 files changed, 14 insertions(+), 10 deletions(-) diff --git a/examples/c/misc/openauth.c b/examples/c/misc/openauth.c index 4c9dd34be3..9c6a1323c6 100644 --- a/examples/c/misc/openauth.c +++ b/examples/c/misc/openauth.c @@ -7,6 +7,8 @@ #include <libvirt/libvirt.h> #include <libvirt/virterror.h> +#define G_N_ELEMENTS(Array) (sizeof(Array) / sizeof(*(Array))) + static void showError(virConnectPtr conn) { @@ -205,7 +207,7 @@ static int credTypes[] = { /* The auth struct that will be passed to virConnectOpenAuth */ static virConnectAuth auth = { credTypes, - sizeof(credTypes) / sizeof(int), + G_N_ELEMENTS(credTypes), authCallback, NULL, /* cbdata will be initialized in main */ }; diff --git a/src/libvirt.c b/src/libvirt.c index 748f2d8ba0..fac074b73a 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -192,7 +192,7 @@ static int virConnectCredTypeDefault[] = { static virConnectAuth virConnectAuthDefault = { virConnectCredTypeDefault, - sizeof(virConnectCredTypeDefault)/sizeof(int), + G_N_ELEMENTS(virConnectCredTypeDefault), virConnectAuthCallbackDefault, NULL, }; diff --git a/tests/virbitmaptest.c b/tests/virbitmaptest.c index 89dc702da2..f4fadb7c8a 100644 --- a/tests/virbitmaptest.c +++ b/tests/virbitmaptest.c @@ -271,7 +271,7 @@ test4c(const void *data G_GNUC_UNUSED) if (virBitmapNextSetBit(bitmap, i) != -1) return -1; - j = sizeof(bitsPos)/sizeof(int) - 1; + j = G_N_ELEMENTS(bitsPos) - 1; if (virBitmapLastSetBit(bitmap) != bitsPos[j]) return -1; @@ -328,7 +328,7 @@ test5(const void *v G_GNUC_UNUSED) i = 0; j = -1; - while (i < sizeof(bits)/sizeof(int) && + while (i < G_N_ELEMENTS(bits) && (j = virBitmapNextSetBit(bitmap, j)) >= 0) { if (j != bits[i++]) return -1; diff --git a/tests/virnetdevtest.c b/tests/virnetdevtest.c index aec84c6c35..42f1a74ee9 100644 --- a/tests/virnetdevtest.c +++ b/tests/virnetdevtest.c @@ -186,7 +186,7 @@ testVirNetDevSetVfMac(const void *opaque G_GNUC_UNUSED) .macaddr = { .addr = { 0, 0, 0, 7, 7, 7 } }, .allow_retry = true, .rc = -EINVAL }, }; - for (i = 0; i < sizeof(testCases) / sizeof(struct testCase); ++i) { + for (i = 0; i < G_N_ELEMENTS(testCases); ++i) { rc = virNetDevSetVfMac(testCases[i].ifname, testCases[i].vf_num, &testCases[i].macaddr, &testCases[i].allow_retry); if (rc != testCases[i].rc) { @@ -252,14 +252,14 @@ testVirNetDevSetVfVlan(const void *opaque G_GNUC_UNUSED) { .ifname = "fakeiface-ok", .vf_num = 1, .rc = 0 }, }; - for (i = 0; i < sizeof(testCases) / sizeof(struct testCase); ++i) { + for (i = 0; i < G_N_ELEMENTS(testCases); ++i) { rc = virNetDevSetVfVlan(testCases[i].ifname, testCases[i].vf_num, &testCases[i].vlan_id); if (rc != testCases[i].rc) { return -1; } } - for (i = 0; i < sizeof(nullVLANTestCases) / sizeof(struct nullVlanTestCase); ++i) { + for (i = 0; i < G_N_ELEMENTS(nullVLANTestCases); ++i) { rc = virNetDevSetVfVlan(nullVLANTestCases[i].ifname, nullVLANTestCases[i].vf_num, NULL); if (rc != nullVLANTestCases[i].rc) { return -1; @@ -292,7 +292,7 @@ testVirNetDevSetVfConfig(const void *opaque G_GNUC_UNUSED) { .ifname = "fakeiface-nomacerror-novlanerror", .rc = 0 }, }; - for (i = 0; i < sizeof(testCases) / sizeof(struct testCase); ++i) { + for (i = 0; i < G_N_ELEMENTS(testCases); ++i) { rc = virNetDevSetVfConfig(testCases[i].ifname, vfNum, &mac, &vlanid, allowRetry); if (rc != testCases[i].rc) { return -1; diff --git a/tools/nss/libvirt_nss.c b/tools/nss/libvirt_nss.c index a6e8e4b12b..ec7763224b 100644 --- a/tools/nss/libvirt_nss.c +++ b/tools/nss/libvirt_nss.c @@ -53,6 +53,7 @@ #define LIBVIRT_ALIGN(x) (((x) + __SIZEOF_POINTER__ - 1) & ~(__SIZEOF_POINTER__ - 1)) #define FAMILY_ADDRESS_SIZE(family) ((family) == AF_INET6 ? 16 : 4) +#define G_N_ELEMENTS(Array) (sizeof(Array) / sizeof(*(Array))) static int leaseAddressSorter(const void *a, @@ -595,7 +596,7 @@ nss_module_register(const char *name __attribute__((unused)), unsigned int *size, nss_module_unregister_fn *unregister) { - *size = sizeof(methods) / sizeof(methods[0]); + *size = G_N_ELEMENTS(methods); *unregister = NULL; return methods; } diff --git a/tools/virt-login-shell.c b/tools/virt-login-shell.c index 25449f972d..8a67e2223c 100644 --- a/tools/virt-login-shell.c +++ b/tools/virt-login-shell.c @@ -30,6 +30,7 @@ #include "configmake.h" +#define G_N_ELEMENTS(Array) (sizeof(Array) / sizeof(*(Array))) #define VIR_INT64_STR_BUFLEN 21 int main(int argc, char **argv) { @@ -69,7 +70,7 @@ int main(int argc, char **argv) { newargv[nargs++] = gidstr; newargv[nargs++] = NULL; - assert(nargs <= (sizeof(newargv)/sizeof(newargv[0]))); + assert(nargs <= G_N_ELEMENTS(newargv)); if (term && asprintf(&(newenv[0]), "TERM=%s", term) < 0) { -- 2.39.2

2 1

[PATCH v1 0/3] qemu: add luks-any encryption support for RBD images
by Or Ozeri 13 Mar '23

13 Mar '23

Starting from Ceph 0f93f745 (unreleased 18.0.0) and qemu b8f218ef (unreleased 8.0.0), qemu and librbd users can use a wildcard format ("luks-any" in qemu, "luks" in librbd). This format can be used to parse the image as either LUKS or LUKS2, auto-detecting the actual format from the on-disk header. This patch series enables libvirt users to use this wildcard format as well (for RBD images only, of course). I manually patched the qemu 8.0.0 replies file to reflect relevant qemu support, to allow my tests to run. Note that any build qemu will not support this feature, unless compiled while having a librbd that has this feature bundled. Or Ozeri (3): tests: qemucapabilitiesdata: Add luks-any encryption format qemu: capabilities: Introduce QEMU_CAPS_RBD_ENCRYPTION_LUKS_ANY capability qemu: add luks-any encryption support for RBD images docs/formatstorageencryption.rst | 9 ++++ src/conf/schemas/storagecommon.rng | 1 + src/conf/storage_encryption_conf.c | 2 +- src/conf/storage_encryption_conf.h | 1 + src/libvirt_private.syms | 1 + src/qemu/qemu_block.c | 10 ++++- src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_domain.c | 32 +++++++++++++- .../caps_8.0.0.x86_64.replies | 7 +++ .../caps_8.0.0.x86_64.xml | 1 + ...k-rbd-encryption-luks-any.x86_64-7.2.0.err | 1 + ...rbd-encryption-luks-any.x86_64-latest.args | 38 ++++++++++++++++ .../disk-network-rbd-encryption-luks-any.xml | 39 ++++++++++++++++ tests/qemuxml2argvtest.c | 2 + ...-rbd-encryption-luks-any.x86_64-latest.xml | 44 +++++++++++++++++++ tests/qemuxml2xmltest.c | 1 + 17 files changed, 187 insertions(+), 5 deletions(-) create mode 100644 tests/qemuxml2argvdata/disk-network-rbd-encryption-luks-any.x86_64-7.2.0.err create mode 100644 tests/qemuxml2argvdata/disk-network-rbd-encryption-luks-any.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-network-rbd-encryption-luks-any.xml create mode 100644 tests/qemuxml2xmloutdata/disk-network-rbd-encryption-luks-any.x86_64-latest.xml -- 2.25.1

3 8

[PATCH v1 0/7] qemu: add support for librbd layered encryption
by Or Ozeri 13 Mar '23

13 Mar '23

Starting from Ceph 0f93f745 (unreleased 18.0.0) and qemu 0f385a24 (unreleased 8.0.0), qemu and librbd users can use encrypted RBD cloned images, where the parent image is encrypted using a different scheme (e.g. different passphrase). Opening such image require supplying of multiple secrets. This patch series allows libvirt users to supply multiple secrets necessary for using such RBD images. For example: <encryption format='luks' engine='librbd'> <secret type='passphrase' uuid='0a81f5b2-8403-7b23-c8d6-21ccc2f80fb0'/> <secret type='passphrase' uuid='0a81f5b2-8403-7b23-c8d6-21ccc2f80d6f'/> </encryption> Note that unlike the qemu and libvirt API, we don't allow the user to specify the format of the parent image, but just the passphrase. We do so to minimize the changes made in libvirt. To still be able to support RBD images where the parent is encrypted using a different format (e.g. LUKS2 cloned image of a LUKS parent), an additional patch series allowing for LUKS* (luks-any) format will be submitted. In high-level, this patch series does the following: - change the qemuBlockStorageSourceAttachData struct to support multiple secrets - change the qemuDomainStorageSourcePrivate struct to support multiple secrets - translate multiple secrets from virStorageEncryption to qemu private data I manually patched the qemu 8.0.0 replies file to reflect relevant qemu support, to allow my tests to run. Note that any build qemu will not support this feature, unless compiled while having a librbd that has this feature bundled. Or Ozeri (7): tests: qemucapabilitiesdata: Add rbd encryption layering qemu: capabilities: Introduce QEMU_CAPS_RBD_ENCRYPTION_LAYERING capability qemu: add support for multiple secret aliases qemu: add multi-secret support in qemuBlockStorageSourceAttachData qemu: add multi-secret support in _qemuDomainStorageSourcePrivate qemu: support pass-on of multiple secrets to _qemuDomainStorageSourcePrivate qemu: add support for librbd layered encryption docs/formatstorageencryption.rst | 11 +- src/conf/schemas/storagecommon.rng | 4 +- src/qemu/qemu_alias.c | 8 +- src/qemu/qemu_alias.h | 3 +- src/qemu/qemu_block.c | 70 ++++++++---- src/qemu/qemu_block.h | 5 +- src/qemu/qemu_blockjob.c | 6 + src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 31 +++-- src/qemu/qemu_domain.c | 106 ++++++++++++++---- src/qemu/qemu_domain.h | 3 +- src/qemu/qemu_hotplug.c | 2 +- src/qemu/qemu_migration_params.c | 2 +- tests/qemublocktest.c | 7 +- .../caps_8.0.0.x86_64.replies | 5 + .../caps_8.0.0.x86_64.xml | 1 + ...k-rbd-encryption-layering.x86_64-7.2.0.err | 1 + ...rbd-encryption-layering.x86_64-latest.args | 39 +++++++ .../disk-network-rbd-encryption-layering.xml | 40 +++++++ tests/qemuxml2argvtest.c | 2 + ...-rbd-encryption-layering.x86_64-latest.xml | 45 ++++++++ tests/qemuxml2xmltest.c | 1 + 23 files changed, 332 insertions(+), 63 deletions(-) create mode 100644 tests/qemuxml2argvdata/disk-network-rbd-encryption-layering.x86_64-7.2.0.err create mode 100644 tests/qemuxml2argvdata/disk-network-rbd-encryption-layering.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-network-rbd-encryption-layering.xml create mode 100644 tests/qemuxml2xmloutdata/disk-network-rbd-encryption-layering.x86_64-latest.xml -- 2.25.1

3 16

[libvirt PATCH 0/4] qemu/security: start passt process with correct SELinux label
by Laine Stump 10 Mar '23

10 Mar '23

All the necessary explanation is in Path 3/4 We may want to turn on this same behavior for some other external processes, but right now the one we need it for is passt. Resolves: https://bugzilla.redhat.com/2172267 Laine Stump (4): util: add an API to retrieve the resolved path to a virCommand's binary security: make args to virSecuritySELinuxContextAddRange() const security: make it possible to set SELinux label of child process from its binary qemu: set SELinux label of passt process to its own binary's label src/libvirt_private.syms | 1 + src/qemu/qemu_dbus.c | 2 +- src/qemu/qemu_passt.c | 2 +- src/qemu/qemu_process.c | 2 +- src/qemu/qemu_security.c | 5 ++- src/qemu/qemu_security.h | 1 + src/qemu/qemu_slirp.c | 2 +- src/qemu/qemu_tpm.c | 3 +- src/qemu/qemu_vhost_user_gpu.c | 2 +- src/security/security_apparmor.c | 1 + src/security/security_dac.c | 1 + src/security/security_driver.h | 1 + src/security/security_manager.c | 8 +++- src/security/security_manager.h | 1 + src/security/security_nop.c | 1 + src/security/security_selinux.c | 77 ++++++++++++++++++++++++++++++-- src/security/security_stack.c | 5 ++- src/util/vircommand.c | 51 ++++++++++++++++----- src/util/vircommand.h | 1 + 19 files changed, 143 insertions(+), 24 deletions(-) -- 2.39.2

3 7

[libvirt PATCH v3] qemu: implement QEMU NBD source reconnect delay attribute
by Christian Nautze 10 Mar '23

10 Mar '23

Currently it's only possible to set this parameter during domain creation via QEMU commandline passthrough feature. With the new delay attribute it's also possible to set this parameter if you want to attach a new NBD disk using "virsh attach-device domain device.xml" e.g.: <disk type='network' device='disk'> <driver name='qemu' type='raw'/> <source protocol='nbd' name='foo'> <host name='example.org' port='6000'/> <reconnect delay='10'/> </source> <target dev='vdb' bus='virtio'/> </disk> Signed-off-by: Christian Nautze <christian.nautze(a)exoscale.ch> --- Changes: schema reconnect element: drop mandatory 'enabled' attribute when using 'delay' reconnect element: use choice for attributes --- docs/formatdomain.rst | 11 +++++++-- src/conf/domain_conf.c | 12 ++++++++++ src/conf/schemas/domaincommon.rng | 3 +++ src/conf/schemas/storagecommon.rng | 19 ++++++++++----- src/conf/storage_source_conf.c | 1 + src/conf/storage_source_conf.h | 4 ++++ src/qemu/qemu_block.c | 4 +++- src/qemu/qemu_domain.c | 9 ++++++++ .../disk-network-nbd.x86_64-latest.args | 23 +++++++++++-------- tests/qemuxml2argvdata/disk-network-nbd.xml | 8 +++++++ tests/qemuxml2xmloutdata/disk-network-nbd.xml | 9 ++++++++ 11 files changed, 84 insertions(+), 19 deletions(-) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index 638768c18d..e4ea330a0d 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -2946,13 +2946,20 @@ paravirtualized driver is specified via the ``disk`` element. are intended to be default, then the entire element may be omitted. ``reconnect`` For disk type ``vhostuser`` configures reconnect timeout if the connection - is lost. It has two mandatory attributes: + is lost. This is set with the two mandatory attributes ``enabled`` and + ``timeout``. + For disk type ``network`` and protocol ``nbd`` the QEMU NBD reconnect delay + can be set via attribute ``delay``: ``enabled`` If the reconnect feature is enabled, accepts ``yes`` and ``no`` ``timeout`` The amount of seconds after which hypervisor tries to reconnect. - + ``delay`` + Only for NBD hosts. The amount of seconds during which all requests are + paused and will be rerun after a successful reconnect. After that time, any + delayed requests and all future requests before a successful reconnect + will immediately fail. If not set the default QEMU value is 0. For a "file" or "volume" disk type which represents a cdrom or floppy (the ``device`` attribute), it is possible to define policy what to do with the diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 84ffd93b7f..1e5c88e45d 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -7146,6 +7146,15 @@ virDomainDiskSourceNetworkParse(xmlNodePtr node, src->tlsFromConfig = !!value; } + if (src->protocol == VIR_STORAGE_NET_PROTOCOL_NBD) { + xmlNodePtr cur; + if ((cur = virXPathNode("./reconnect", ctxt))) { + if (virXMLPropUInt(cur, "delay", 10, VIR_XML_PROP_NONE, + &src->reconnectDelay) < 0) + return -1; + } + } + /* for historical reasons we store the volume and image name in one XML * element although it complicates thing when attempting to access them. */ if (src->path && @@ -22087,6 +22096,9 @@ virDomainDiskSourceFormatNetwork(virBuffer *attrBuf, virBufferAddLit(childBuf, "/>\n"); } + if (src->reconnectDelay) { + virBufferAsprintf(childBuf, "<reconnect delay='%u'/>\n", src->reconnectDelay); + } virBufferEscapeString(childBuf, "<snapshot name='%s'/>\n", src->snapshot); virBufferEscapeString(childBuf, "<config file='%s'/>\n", src->configFile); diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng index ab4886b783..03aab6f7e5 100644 --- a/src/conf/schemas/domaincommon.rng +++ b/src/conf/schemas/domaincommon.rng @@ -2199,6 +2199,9 @@ </optional> <ref name="diskSourceCommon"/> <ref name="diskSourceNetworkHost"/> + <optional> + <ref name="reconnect"/> + </optional> <optional> <ref name="encryption"/> </optional> diff --git a/src/conf/schemas/storagecommon.rng b/src/conf/schemas/storagecommon.rng index 4d6e646c9a..23eff9ecb1 100644 --- a/src/conf/schemas/storagecommon.rng +++ b/src/conf/schemas/storagecommon.rng @@ -55,14 +55,21 @@ <define name="reconnect"> <element name="reconnect"> - <attribute name="enabled"> - <ref name="virYesNo"/> - </attribute> - <optional> - <attribute name="timeout"> + <choice> + <group> + <attribute name="enabled"> + <ref name="virYesNo"/> + </attribute> + <optional> + <attribute name="timeout"> + <ref name="unsignedInt"/> + </attribute> + </optional> + </group> + <attribute name="delay"> <ref name="unsignedInt"/> </attribute> - </optional> + </choice> </element> </define> diff --git a/src/conf/storage_source_conf.c b/src/conf/storage_source_conf.c index cecd7e811e..58009fd06e 100644 --- a/src/conf/storage_source_conf.c +++ b/src/conf/storage_source_conf.c @@ -811,6 +811,7 @@ virStorageSourceCopy(const virStorageSource *src, def->sslverify = src->sslverify; def->readahead = src->readahead; def->timeout = src->timeout; + def->reconnectDelay = src->reconnectDelay; def->metadataCacheMaxSize = src->metadataCacheMaxSize; /* storage driver metadata are not copied */ diff --git a/src/conf/storage_source_conf.h b/src/conf/storage_source_conf.h index 14a6825d54..c6187dda59 100644 --- a/src/conf/storage_source_conf.h +++ b/src/conf/storage_source_conf.h @@ -312,6 +312,10 @@ struct _virStorageSource { unsigned long long readahead; /* size of the readahead buffer in bytes */ unsigned long long timeout; /* connection timeout in seconds */ + /* NBD QEMU reconnect-delay option, + * 0 as default value */ + unsigned int reconnectDelay; + virStorageSourceNVMeDef *nvme; /* type == VIR_STORAGE_TYPE_NVME */ virDomainChrSourceDef *vhostuser; /* type == VIR_STORAGE_TYPE_VHOST_USER */ diff --git a/src/qemu/qemu_block.c b/src/qemu/qemu_block.c index 5e700eff99..8fcebd8992 100644 --- a/src/qemu/qemu_block.c +++ b/src/qemu/qemu_block.c @@ -529,6 +529,7 @@ qemuBlockStorageSourceGetNBDProps(virStorageSource *src, "S:export", src->path, "S:tls-creds", tlsAlias, "S:tls-hostname", tlsHostname, + "p:reconnect-delay", src->reconnectDelay, NULL) < 0) return NULL; @@ -1848,7 +1849,8 @@ qemuBlockGetBackingStoreString(virStorageSource *src, src->ncookies == 0 && src->sslverify == VIR_TRISTATE_BOOL_ABSENT && src->timeout == 0 && - src->readahead == 0) { + src->readahead == 0 && + src->reconnectDelay == 0) { switch ((virStorageNetProtocol) src->protocol) { case VIR_STORAGE_NET_PROTOCOL_NBD: diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 4cf9a259ea..1206d59f4a 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -5020,6 +5020,15 @@ qemuDomainValidateStorageSource(virStorageSource *src, } } + if (src->reconnectDelay > 0) { + if (actualType != VIR_STORAGE_TYPE_NETWORK || + src->protocol != VIR_STORAGE_NET_PROTOCOL_NBD) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("reconnect delay is supported only with NBD protocol")); + return -1; + } + } + if (src->query && (actualType != VIR_STORAGE_TYPE_NETWORK || (src->protocol != VIR_STORAGE_NET_PROTOCOL_HTTPS && diff --git a/tests/qemuxml2argvdata/disk-network-nbd.x86_64-latest.args b/tests/qemuxml2argvdata/disk-network-nbd.x86_64-latest.args index 21e619af3e..e8d13b0bd4 100644 --- a/tests/qemuxml2argvdata/disk-network-nbd.x86_64-latest.args +++ b/tests/qemuxml2argvdata/disk-network-nbd.x86_64-latest.args @@ -28,21 +28,24 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \ -no-acpi \ -boot strict=on \ -device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \ --blockdev '{"driver":"nbd","server":{"type":"inet","host":"example.org","port":"6000"},"node-name":"libvirt-5-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"nbd","server":{"type":"inet","host":"example.org","port":"6000"},"node-name":"libvirt-6-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"node-name":"libvirt-6-format","read-only":false,"driver":"raw","file":"libvirt-6-storage"}' \ +-device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x2","drive":"libvirt-6-format","id":"virtio-disk0","bootindex":1}' \ +-blockdev '{"driver":"nbd","server":{"type":"inet","host":"example.org","port":"6000"},"export":"bar","node-name":"libvirt-5-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-5-format","read-only":false,"driver":"raw","file":"libvirt-5-storage"}' \ --device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x2","drive":"libvirt-5-format","id":"virtio-disk0","bootindex":1}' \ --blockdev '{"driver":"nbd","server":{"type":"inet","host":"example.org","port":"6000"},"export":"bar","node-name":"libvirt-4-storage","auto-read-only":true,"discard":"unmap"}' \ +-device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x3","drive":"libvirt-5-format","id":"virtio-disk1"}' \ +-blockdev '{"driver":"nbd","server":{"type":"inet","host":"::1","port":"6000"},"node-name":"libvirt-4-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-4-format","read-only":false,"driver":"raw","file":"libvirt-4-storage"}' \ --device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x3","drive":"libvirt-4-format","id":"virtio-disk1"}' \ --blockdev '{"driver":"nbd","server":{"type":"inet","host":"::1","port":"6000"},"node-name":"libvirt-3-storage","auto-read-only":true,"discard":"unmap"}' \ +-device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x4","drive":"libvirt-4-format","id":"virtio-disk2"}' \ +-blockdev '{"driver":"nbd","server":{"type":"inet","host":"::1","port":"6000"},"export":"bar","node-name":"libvirt-3-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-3-format","read-only":false,"driver":"raw","file":"libvirt-3-storage"}' \ --device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x4","drive":"libvirt-3-format","id":"virtio-disk2"}' \ --blockdev '{"driver":"nbd","server":{"type":"inet","host":"::1","port":"6000"},"export":"bar","node-name":"libvirt-2-storage","auto-read-only":true,"discard":"unmap"}' \ +-device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x5","drive":"libvirt-3-format","id":"virtio-disk3"}' \ +-blockdev '{"driver":"nbd","server":{"type":"unix","path":"/var/run/nbdsock"},"export":"bar","node-name":"libvirt-2-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-2-format","read-only":false,"driver":"raw","file":"libvirt-2-storage"}' \ --device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x5","drive":"libvirt-2-format","id":"virtio-disk3"}' \ --blockdev '{"driver":"nbd","server":{"type":"unix","path":"/var/run/nbdsock"},"export":"bar","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \ +-device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x6","drive":"libvirt-2-format","id":"virtio-disk4"}' \ +-blockdev '{"driver":"nbd","server":{"type":"inet","host":"example.org","port":"6000"},"export":"foo","reconnect-delay":10,"node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \ --device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x6","drive":"libvirt-1-format","id":"virtio-disk4"}' \ +-device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x7","drive":"libvirt-1-format","id":"virtio-disk5"}' \ -audiodev '{"id":"audio1","driver":"none"}' \ -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ -msg timestamp=on diff --git a/tests/qemuxml2argvdata/disk-network-nbd.xml b/tests/qemuxml2argvdata/disk-network-nbd.xml index 8ac6cc3b7b..4e8b1e5b03 100644 --- a/tests/qemuxml2argvdata/disk-network-nbd.xml +++ b/tests/qemuxml2argvdata/disk-network-nbd.xml @@ -49,6 +49,14 @@ </source> <target dev='vde' bus='virtio'/> </disk> + <disk type='network' device='disk'> + <driver name='qemu' type='raw'/> + <source protocol='nbd' name='foo'> + <host name='example.org' port='6000'/> + <reconnect delay='10'/> + </source> + <target dev='vdf' bus='virtio'/> + </disk> <controller type='usb' index='0'/> <controller type='ide' index='0'/> <controller type='pci' index='0' model='pci-root'/> diff --git a/tests/qemuxml2xmloutdata/disk-network-nbd.xml b/tests/qemuxml2xmloutdata/disk-network-nbd.xml index f8dcca4bab..38d1f290c8 100644 --- a/tests/qemuxml2xmloutdata/disk-network-nbd.xml +++ b/tests/qemuxml2xmloutdata/disk-network-nbd.xml @@ -54,6 +54,15 @@ <target dev='vde' bus='virtio'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> </disk> + <disk type='network' device='disk'> + <driver name='qemu' type='raw'/> + <source protocol='nbd' name='foo'> + <host name='example.org' port='6000'/> + <reconnect delay='10'/> + </source> + <target dev='vdf' bus='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </disk> <controller type='usb' index='0'> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> </controller> -- 2.34.1

2 2