September 2023 - Devel - libvirt List Archives

[libvirt PATCH v8 00/37] Use nbdkit for http/ftp/ssh network drives in libvirt
by Jonathon Jongsma 22 Sep '23

22 Sep '23

This is the eighth version of this patch series. See https://bugzilla.redhat.com/show_bug.cgi?id=2016527 for more information. Note that testing this requires selinux policy changes which are not fully done, but there is a new policy in development that has allowed me to run with selinux in enforcing mode for the common cases. See https://bugzilla.redhat.com/show_bug.cgi?id=2182505 for more information. The following scenarios should work now with selinux enabled using the selinux policy from that bug: - http/https disks - ssh disks with password authentication - ssh disks with passwordless keyfile The one major thing that doesn't work and is difficult to get working with selinux enabled is the ssh-agent. This is because there doesn't seem to be any selinux policy for ssh-agent, so by default the ssh-agent socket is labeled unconfined_t. We cannot allow access from the libvirt/qemu to unconfined_t because that would open up access to just about anything on the host. So additional work will likely be necessary for ssh-agent/libvirt interaction in the future. Fortunately ssh-agent is something that never was really supported with the old qemu block driver either, so I think we could potentially merge this patchset either without the ssh-agent patches or with a note that ssh-agent won't work with selinux enabled. Changes in v8: - Hopefully addressed all of Peter's issues, in addition to: - updated documentation to say 9.8.0, since 9.7.0 is currently in freeze - used WITH_NBDKIT instead of WITH_DECL_SYS_PIDFD_OPEN to make the code a bit more concise and understandable - enabled ci by adding libnbd to the dependencies, which uncovered a couple additional minor issues with those platforms that don't support the pidfd_open syscall - don't run nbdkit tests when WITH_NBDKIT is not defined - avoid warnings with unused function arguments - note that the ubuntu containers are currently failing due to a LeakSanitizer error, but I haven't reproduced it locally and can't figure out how to get better information from the leak sanitizer. Pointers appreciated: https://gitlab.com/jjongsma/libvirt/-/jobs/4991631193 - One change of note is a new patch "qemu: improve error handling when restarting nbdkit". In order to provide better error reporting to the user and avoid VIR_WARN as suggested by Peter, some functions now return an error and this error is propagated up to qemuProcessReconnect(). This could potentially result in running domains being killed upon a libvirt restart, but only if they were in a state where they were was not a running nbdkit backend or libvirt couldn't monitor the process nbdkit. Jonathon Jongsma (37): schema: allow 'ssh' as a protocol for network disks qemu: Add functions for determining nbdkit availability qemu: expand nbdkit capabilities util: Allow virFileCache data to be any GObject qemu: implement basic virFileCache for nbdkit caps qemu: implement persistent file cache for nbdkit caps qemu: use file cache for nbdkit caps qemu: Add qemuNbdkitProcess qemu: query nbdkit module dir from binary qemu: add functions to start and stop nbdkit Generalize qemuDomainLogContextNew() qemu: Extract qemuDomainLogContext into a new file qemu: move qemuProcessReadLog() to qemuLogContext qemu: log error output from nbdkit tests: add ability to test various nbdkit capabilities qemu: split qemuDomainSecretStorageSourcePrepare qemu: include nbdkit state in private xml util: secure erase virCommand send buffers qemu: pass sensitive data to nbdkit via pipe qemu: use nbdkit to serve network disks if available util: make virCommandSetSendBuffer testable tests: add tests for nbdkit invocation qemu: add test for authenticating a https network disk qemu: Add Taint for nbdkit restart failure qemu: Monitor nbdkit process for exit qemu: improve error handling when restarting nbdkit qemu: try to connect to nbdkit early to detect errors schema: add password configuration for ssh disk qemu: implement password auth for ssh disks with nbdkit schema: add configuration for host verification of ssh disks qemu: implement knownHosts for ssh disks with nbdkit schema: add keyfile configuration for ssh disks qemu: implement keyfile auth for ssh disks with nbdkit schema: add ssh-agent configuration for ssh disks qemu: implement ssh-agent auth for ssh disks with nbdkit rpm: update spec file for for nbdkit support ci: add libnbd to build build-aux/syntax-check.mk | 2 +- ci/buildenv/almalinux-8.sh | 1 + ci/buildenv/centos-stream-8.sh | 1 + ci/buildenv/centos-stream-9.sh | 1 + ci/buildenv/debian-12-cross-aarch64.sh | 1 + ci/buildenv/debian-12-cross-armv6l.sh | 1 + ci/buildenv/debian-12-cross-armv7l.sh | 1 + ci/buildenv/debian-12-cross-i686.sh | 1 + ci/buildenv/debian-12-cross-mips64el.sh | 1 + ci/buildenv/debian-12-cross-mipsel.sh | 1 + ci/buildenv/debian-12-cross-ppc64le.sh | 1 + ci/buildenv/debian-12-cross-s390x.sh | 1 + ci/buildenv/debian-12.sh | 1 + ci/buildenv/debian-sid-cross-aarch64.sh | 1 + ci/buildenv/debian-sid-cross-armv6l.sh | 1 + ci/buildenv/debian-sid-cross-armv7l.sh | 1 + ci/buildenv/debian-sid-cross-i686.sh | 1 + ci/buildenv/debian-sid-cross-mips64el.sh | 1 + ci/buildenv/debian-sid-cross-mipsel.sh | 1 + ci/buildenv/debian-sid-cross-ppc64le.sh | 1 + ci/buildenv/debian-sid-cross-s390x.sh | 1 + ci/buildenv/debian-sid.sh | 1 + ci/buildenv/fedora-37.sh | 1 + ci/buildenv/fedora-38-cross-mingw32.sh | 1 + ci/buildenv/fedora-38-cross-mingw64.sh | 1 + ci/buildenv/fedora-38.sh | 1 + ci/buildenv/fedora-rawhide-cross-mingw32.sh | 1 + ci/buildenv/fedora-rawhide-cross-mingw64.sh | 1 + ci/buildenv/fedora-rawhide.sh | 1 + ci/buildenv/opensuse-leap-15.sh | 1 + ci/buildenv/opensuse-tumbleweed.sh | 1 + ci/buildenv/ubuntu-2204.sh | 1 + ci/containers/almalinux-8.Dockerfile | 1 + ci/containers/centos-stream-8.Dockerfile | 1 + ci/containers/centos-stream-9.Dockerfile | 1 + .../debian-12-cross-aarch64.Dockerfile | 1 + .../debian-12-cross-armv6l.Dockerfile | 1 + .../debian-12-cross-armv7l.Dockerfile | 1 + ci/containers/debian-12-cross-i686.Dockerfile | 1 + .../debian-12-cross-mips64el.Dockerfile | 1 + .../debian-12-cross-mipsel.Dockerfile | 1 + .../debian-12-cross-ppc64le.Dockerfile | 1 + .../debian-12-cross-s390x.Dockerfile | 1 + ci/containers/debian-12.Dockerfile | 1 + .../debian-sid-cross-aarch64.Dockerfile | 1 + .../debian-sid-cross-armv6l.Dockerfile | 1 + .../debian-sid-cross-armv7l.Dockerfile | 1 + .../debian-sid-cross-i686.Dockerfile | 1 + .../debian-sid-cross-mips64el.Dockerfile | 1 + .../debian-sid-cross-mipsel.Dockerfile | 1 + .../debian-sid-cross-ppc64le.Dockerfile | 1 + .../debian-sid-cross-s390x.Dockerfile | 1 + ci/containers/debian-sid.Dockerfile | 1 + ci/containers/fedora-37.Dockerfile | 1 + .../fedora-38-cross-mingw32.Dockerfile | 1 + .../fedora-38-cross-mingw64.Dockerfile | 1 + ci/containers/fedora-38.Dockerfile | 1 + .../fedora-rawhide-cross-mingw32.Dockerfile | 1 + .../fedora-rawhide-cross-mingw64.Dockerfile | 1 + ci/containers/fedora-rawhide.Dockerfile | 1 + ci/containers/opensuse-leap-15.Dockerfile | 1 + ci/containers/opensuse-tumbleweed.Dockerfile | 1 + ci/containers/ubuntu-2204.Dockerfile | 1 + ci/lcitool/projects/libvirt.yml | 1 + docs/formatdomain.rst | 45 +- libvirt.spec.in | 8 + meson.build | 18 + meson_options.txt | 1 + po/POTFILES | 2 + src/conf/domain_conf.c | 38 + src/conf/domain_conf.h | 1 + src/conf/schemas/domaincommon.rng | 55 + src/conf/storage_source_conf.c | 6 + src/conf/storage_source_conf.h | 6 +- src/libvirt_private.syms | 1 + src/qemu/meson.build | 3 + src/qemu/qemu_block.c | 162 ++- src/qemu/qemu_conf.c | 22 + src/qemu/qemu_conf.h | 6 + src/qemu/qemu_domain.c | 436 +++--- src/qemu/qemu_domain.h | 31 +- src/qemu/qemu_driver.c | 20 + src/qemu/qemu_extdevice.c | 62 + src/qemu/qemu_hotplug.c | 7 + src/qemu/qemu_logcontext.c | 329 +++++ src/qemu/qemu_logcontext.h | 41 + src/qemu/qemu_nbdkit.c | 1291 +++++++++++++++++ src/qemu/qemu_nbdkit.h | 119 ++ src/qemu/qemu_nbdkitpriv.h | 31 + src/qemu/qemu_process.c | 126 +- src/qemu/qemu_process.h | 3 + src/util/vircommand.c | 19 +- src/util/vircommand.h | 8 + src/util/vircommandpriv.h | 4 + src/util/virfilecache.c | 14 +- src/util/virfilecache.h | 2 +- tests/meson.build | 5 + tests/qemublocktest.c | 2 +- ...w2-invalid.json => network-ssh-qcow2.json} | 0 ...cow2-invalid.xml => network-ssh-qcow2.xml} | 0 .../disk-cdrom-network.args.disk0 | 6 + .../disk-cdrom-network.args.disk1 | 8 + .../disk-cdrom-network.args.disk1.pipe.778 | 1 + .../disk-cdrom-network.args.disk2 | 8 + .../disk-cdrom-network.args.disk2.pipe.780 | 1 + .../disk-network-http.args.disk0 | 6 + .../disk-network-http.args.disk1 | 5 + .../disk-network-http.args.disk2 | 6 + .../disk-network-http.args.disk2.pipe.778 | 1 + .../disk-network-http.args.disk3 | 7 + .../disk-network-http.args.disk3.pipe.780 | 1 + ...work-source-curl-nbdkit-backing.args.disk0 | 7 + ...ce-curl-nbdkit-backing.args.disk0.pipe.778 | 1 + .../disk-network-source-curl.args.disk0 | 7 + ...sk-network-source-curl.args.disk0.pipe.778 | 1 + .../disk-network-source-curl.args.disk1 | 9 + ...sk-network-source-curl.args.disk1.pipe.780 | 1 + ...sk-network-source-curl.args.disk1.pipe.782 | 1 + .../disk-network-source-curl.args.disk2 | 7 + ...sk-network-source-curl.args.disk2.pipe.782 | 1 + ...sk-network-source-curl.args.disk2.pipe.784 | 1 + .../disk-network-source-curl.args.disk3 | 6 + .../disk-network-source-curl.args.disk4 | 6 + .../disk-network-ssh-key.args.disk0 | 9 + .../disk-network-ssh-key.args.disk1 | 9 + .../disk-network-ssh-password.args.disk0 | 9 + ...k-network-ssh-password.args.disk0.pipe.778 | 1 + .../disk-network-ssh.args.disk0 | 7 + .../disk-network-ssh.args.disk1 | 8 + .../disk-network-ssh.args.disk1.pipe.778 | 1 + .../disk-network-ssh.args.disk2 | 9 + tests/qemunbdkittest.c | 310 ++++ tests/qemustatusxml2xmldata/modern-in.xml | 4 + ...sk-cdrom-network-nbdkit.x86_64-latest.args | 42 + .../disk-cdrom-network-nbdkit.xml | 1 + ...isk-network-http-nbdkit.x86_64-latest.args | 44 + .../disk-network-http-nbdkit.xml | 1 + ...rce-curl-nbdkit-backing.x86_64-latest.args | 37 + ...isk-network-source-curl-nbdkit-backing.xml | 45 + ...work-source-curl-nbdkit.x86_64-latest.args | 49 + .../disk-network-source-curl-nbdkit.xml | 1 + ...isk-network-source-curl.x86_64-latest.args | 53 + .../disk-network-source-curl.xml | 74 + .../qemuxml2argvdata/disk-network-ssh-key.xml | 44 + ...disk-network-ssh-nbdkit.x86_64-latest.args | 35 + .../disk-network-ssh-nbdkit.xml | 1 + ...sk-network-ssh-password.x86_64-latest.args | 35 + .../disk-network-ssh-password.xml | 35 + .../disk-network-ssh.x86_64-latest.args | 35 + tests/qemuxml2argvdata/disk-network-ssh.xml | 32 + tests/qemuxml2argvtest.c | 23 + tests/testutilsqemu.c | 26 + tests/testutilsqemu.h | 4 + 153 files changed, 3599 insertions(+), 472 deletions(-) create mode 100644 src/qemu/qemu_logcontext.c create mode 100644 src/qemu/qemu_logcontext.h create mode 100644 src/qemu/qemu_nbdkit.c create mode 100644 src/qemu/qemu_nbdkit.h create mode 100644 src/qemu/qemu_nbdkitpriv.h rename tests/qemublocktestdata/imagecreate/{network-ssh-qcow2-invalid.json => network-ssh-qcow2.json} (100%) rename tests/qemublocktestdata/imagecreate/{network-ssh-qcow2-invalid.xml => network-ssh-qcow2.xml} (100%) create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk1 create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk1.pipe.778 create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk2 create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk2.pipe.780 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk1 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk2 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk2.pipe.778 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk3 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk3.pipe.780 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl-nbdkit-backing.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl-nbdkit-backing.args.disk0.pipe.778 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk0.pipe.778 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk1 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk1.pipe.780 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk1.pipe.782 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk2 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk2.pipe.782 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk2.pipe.784 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk3 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk4 create mode 100644 tests/qemunbdkitdata/disk-network-ssh-key.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-network-ssh-key.args.disk1 create mode 100644 tests/qemunbdkitdata/disk-network-ssh-password.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-network-ssh-password.args.disk0.pipe.778 create mode 100644 tests/qemunbdkitdata/disk-network-ssh.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-network-ssh.args.disk1 create mode 100644 tests/qemunbdkitdata/disk-network-ssh.args.disk1.pipe.778 create mode 100644 tests/qemunbdkitdata/disk-network-ssh.args.disk2 create mode 100644 tests/qemunbdkittest.c create mode 100644 tests/qemuxml2argvdata/disk-cdrom-network-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-cdrom-network-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-http-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-network-http-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl-nbdkit-backing.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl-nbdkit-backing.xml create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-network-source-curl-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl.xml create mode 100644 tests/qemuxml2argvdata/disk-network-ssh-key.xml create mode 100644 tests/qemuxml2argvdata/disk-network-ssh-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-network-ssh-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-ssh-password.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-network-ssh-password.xml create mode 100644 tests/qemuxml2argvdata/disk-network-ssh.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-network-ssh.xml -- 2.41.0

3 48

[libvirt PATCH] qemu: Improve error message for failed firmware autoselection
by Andrea Bolognani 22 Sep '23

22 Sep '23

The current message can be misleading, because it seems to suggest that no firmware of the requested type is available on the system. What actually happens most of the time, however, is that despite having multiple firmwares of the right type to choose from, none of them is suitable because of lacking some specific feature or being incompatible with some setting that the user has explicitly enabled. Providing an error message that describes exactly the problem is not feasible, since we would have to list each candidate along with the reason why we rejected it, which would get out of hand quickly. As a small but hopefully helpful improvement over the current situation, reword the error message to make it clearer that the culprit is not necessarily the firmware type, but rather the overall domain configuration. Suggested-by: Michael Kjörling <7d1340278307(a)ewoof.net> Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- src/qemu/qemu_firmware.c | 2 +- .../firmware-auto-efi-loader-path-nonstandard.x86_64-latest.err | 2 +- ...rmware-auto-efi-nvram-template-nonstandard.x86_64-latest.err | 2 +- .../firmware-auto-efi-rw-abi-update.x86_64-latest.err | 2 +- tests/qemuxml2argvdata/firmware-auto-efi-rw.x86_64-latest.err | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index 3dcd139a47..d39e61d071 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -1854,7 +1854,7 @@ qemuFirmwareFillDomain(virQEMUDriver *driver, } } else { virReportError(VIR_ERR_OPERATION_FAILED, - _("Unable to find any firmware to satisfy '%1$s'"), + _("Unable to find '%1$s' firmware that is compatible with the current configuration"), virDomainOsDefFirmwareTypeToString(def->os.firmware)); return -1; } diff --git a/tests/qemuxml2argvdata/firmware-auto-efi-loader-path-nonstandard.x86_64-latest.err b/tests/qemuxml2argvdata/firmware-auto-efi-loader-path-nonstandard.x86_64-latest.err index 4cfde1bd2e..3edb2b3451 100644 --- a/tests/qemuxml2argvdata/firmware-auto-efi-loader-path-nonstandard.x86_64-latest.err +++ b/tests/qemuxml2argvdata/firmware-auto-efi-loader-path-nonstandard.x86_64-latest.err @@ -1 +1 @@ -operation failed: Unable to find any firmware to satisfy 'efi' +operation failed: Unable to find 'efi' firmware that is compatible with the current configuration diff --git a/tests/qemuxml2argvdata/firmware-auto-efi-nvram-template-nonstandard.x86_64-latest.err b/tests/qemuxml2argvdata/firmware-auto-efi-nvram-template-nonstandard.x86_64-latest.err index 4cfde1bd2e..3edb2b3451 100644 --- a/tests/qemuxml2argvdata/firmware-auto-efi-nvram-template-nonstandard.x86_64-latest.err +++ b/tests/qemuxml2argvdata/firmware-auto-efi-nvram-template-nonstandard.x86_64-latest.err @@ -1 +1 @@ -operation failed: Unable to find any firmware to satisfy 'efi' +operation failed: Unable to find 'efi' firmware that is compatible with the current configuration diff --git a/tests/qemuxml2argvdata/firmware-auto-efi-rw-abi-update.x86_64-latest.err b/tests/qemuxml2argvdata/firmware-auto-efi-rw-abi-update.x86_64-latest.err index 4cfde1bd2e..3edb2b3451 100644 --- a/tests/qemuxml2argvdata/firmware-auto-efi-rw-abi-update.x86_64-latest.err +++ b/tests/qemuxml2argvdata/firmware-auto-efi-rw-abi-update.x86_64-latest.err @@ -1 +1 @@ -operation failed: Unable to find any firmware to satisfy 'efi' +operation failed: Unable to find 'efi' firmware that is compatible with the current configuration diff --git a/tests/qemuxml2argvdata/firmware-auto-efi-rw.x86_64-latest.err b/tests/qemuxml2argvdata/firmware-auto-efi-rw.x86_64-latest.err index 4cfde1bd2e..3edb2b3451 100644 --- a/tests/qemuxml2argvdata/firmware-auto-efi-rw.x86_64-latest.err +++ b/tests/qemuxml2argvdata/firmware-auto-efi-rw.x86_64-latest.err @@ -1 +1 @@ -operation failed: Unable to find any firmware to satisfy 'efi' +operation failed: Unable to find 'efi' firmware that is compatible with the current configuration -- 2.41.0

2 2

[PATCH 0/3] A couple of virtio-mem/virtio-pmem address improvements
by Michal Privoznik 22 Sep '23

22 Sep '23

*** BLURB HERE *** Michal Prívozník (3): domain_validate: Validate VIRTIO_PMEM address alignment virDomainMemoryDefValidate: Fix VIRTIO_MEM alignment check virDomainMemoryDefValidate: Check for overlapping memory devices src/conf/domain_validate.c | 59 ++++++++++++++++++- ...rtio-mem-overlap-address.x86_64-latest.err | 1 + ...ory-hotplug-virtio-mem-overlap-address.xml | 50 ++++++++++++++++ tests/qemuxml2argvtest.c | 1 + 4 files changed, 110 insertions(+), 1 deletion(-) create mode 100644 tests/qemuxml2argvdata/memory-hotplug-virtio-mem-overlap-address.x86_64-latest.err create mode 100644 tests/qemuxml2argvdata/memory-hotplug-virtio-mem-overlap-address.xml -- 2.41.0

2 4

[PATCH] test_driver: Implement virConnectGetDomainCapabilities()
by Michal Privoznik 20 Sep '23

20 Sep '23

Our test driver lacks implementation for virConnectGetDomainCapabilities(). Provide one, though a trivial one. Mostly so that something else than VIR_ERR_NO_SUPPORT error is returned. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/test/test_driver.c | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/src/test/test_driver.c b/src/test/test_driver.c index c1d4d71b78..a8705a8da2 100644 --- a/src/test/test_driver.c +++ b/src/test/test_driver.c @@ -10000,6 +10000,41 @@ testNetworkSetMetadata(virNetworkPtr net, return ret; } +static char * +testConnectGetDomainCapabilities(virConnectPtr conn G_GNUC_UNUSED, + const char *emulatorbin, + const char *arch_str, + const char *machine, + const char *virttype_str, + unsigned int flags) +{ + g_autoptr(virDomainCaps) domCaps = NULL; + virArch arch = VIR_ARCH_NONE; + int virttype = VIR_DOMAIN_VIRT_NONE; + + virCheckFlags(0, NULL); + + if (arch_str && + (arch = virArchFromString(arch_str)) == VIR_ARCH_NONE) { + virReportError(VIR_ERR_INVALID_ARG, + _("unknown architecture: %1$s"), arch_str); + return NULL; + } + + if (virttype_str && + (virttype = virDomainVirtTypeFromString(virttype_str)) < 0) { + virReportError(VIR_ERR_INVALID_ARG, + _("unknown virttype: %1$s"), virttype_str); + return NULL; + } + + if (!(domCaps = virDomainCapsNew(emulatorbin, machine, arch, virttype))) + return NULL; + + return virDomainCapsFormat(domCaps); +} + + /* * Test driver */ @@ -10167,6 +10202,7 @@ static virHypervisorDriver testHypervisorDriver = { .domainCheckpointGetParent = testDomainCheckpointGetParent, /* 5.6.0 */ .domainCheckpointDelete = testDomainCheckpointDelete, /* 5.6.0 */ .domainGetMessages = testDomainGetMessages, /* 7.6.0 */ + .connectGetDomainCapabilities = testConnectGetDomainCapabilities, /* 9.8.0 */ }; static virNetworkDriver testNetworkDriver = { -- 2.41.0

2 1

[libvirt PATCH] qemu_nbdkit: fix possible null dereference
by Pavel Hrdina 20 Sep '23

20 Sep '23

Function virGetConnectSecret() can return NULL so we need to check it since in virSecretGetSecretString() it gets dereferenced. Reported-by: coverity Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/qemu/qemu_nbdkit.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/qemu/qemu_nbdkit.c b/src/qemu/qemu_nbdkit.c index 66b09cd240..17819ca992 100644 --- a/src/qemu/qemu_nbdkit.c +++ b/src/qemu/qemu_nbdkit.c @@ -971,6 +971,9 @@ qemuNbdkitProcessBuildCommandAuth(virStorageAuthDef *authdef, } conn = virGetConnectSecret(); + if (!conn) + return -1; + if (virSecretGetSecretString(conn, &authdef->seclookupdef, secrettype, -- 2.41.0

2 1

[PATCH 0/4] virerror: Make virReportEnumRangeError() check for type mismatch
by Michal Privoznik 20 Sep '23

20 Sep '23

There are few cases where virReportEnumRangeError() is passed to a mismatching enum. With patch 4/4 we can check for this at compile time (assuming -Wenum-compare is available). For instance with clang I get: FAILED: src/conf/libvirt_conf.a.p/domain_validate.c.o clang ... ../src/conf/domain_validate.c:184:9: error: comparison of different enumeration types ('virDomainVideoBackendType' and 'virDomainInputType') [-Werror,-Wenum-compare] virReportEnumRangeError(virDomainInputType, video->backend); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../src/util/virerror.h:175:47: note: expanded from macro 'virReportEnumRangeError' (__typeof__(value))1 == (typname)1 && sizeof((typname)1) != 0 ? #typname : #typname) ~~~~~~~~~~~~~~~~~~~~ ^ ~~~~~~~~~~ Whereas with gcc I get more obscure error: FAILED: src/conf/libvirt_conf.a.p/domain_validate.c.o cc ... In file included from ../src/util/virthread.h:25, from ../src/util/virobject.h:25, from ../src/conf/capabilities.h:28, from ../src/conf/domain_conf.h:31, from ../src/conf/domain_validate.h:25, from ../src/conf/domain_validate.c:23: ../src/conf/domain_validate.c: In function ‘virDomainVideoDefValidate’: ../src/util/virerror.h:175:47: error: comparison between ‘enum <anonymous>’ and ‘enum <anonymous>’ [-Werror=enum-compare] 175 | (__typeof__(value))1 == (typname)1 && sizeof((typname)1) != 0 ? #typname : #typname) | ^~ ../src/conf/domain_validate.c:184:9: note: in expansion of macro ‘virReportEnumRangeError’ 184 | virReportEnumRangeError(virDomainInputType, video->backend); | ^~~~~~~~~~~~~~~~~~~~~~~ But I guess this is also okay-ish - it reports there is a problem with code. NB this only works with variables that are of a certain enum types. It does not work with those generic 'int var /* someEnum */' declarations, understandably. But as we use virXMLPropEnum() more, we can declare variables of their true type (enum) and get more and more calls to virReportEnumRangeError() checked. Michal Prívozník (4): virnetdevvportprofile: Turn virNetDevVPortProfileLinkOp enum into a proper typedef virNetDevVPortProfileOp8021Qbh: Use proper type in virReportEnumRangeError() virDomainVideoDefValidate: Use proper type in virReportEnumRangeError() virerror: Make virReportEnumRangeError() check for type mismatch src/conf/domain_validate.c | 2 +- src/util/virerror.h | 14 ++++++++------ src/util/virnetdevvportprofile.c | 10 +++++----- 3 files changed, 14 insertions(+), 12 deletions(-) -- 2.41.0

2 5

[PATCH] libxl: Fix Domain-0 ballooning logic
by Jim Fehlig 19 Sep '23

19 Sep '23

When Domain-0 autoballooning is enabled, it's possible that memory may need to be ballooned down in Domain-0 to accommodate the needs of another virtual machine. libxlDomainFreeMemory handles this task, but due to a logic bug is underflowing the variable containing Domain-0 new target memory. The resulting huge numbers are filtered by libxlSetMemoryTargetWrapper and memory is not changed. Under the covers, libxlDomainFreeMemory uses Xen's libxl_set_memory_target API, which includes a 'relative' parameter for specifying how to set the target. If true, the target is an increment/decrement value over the current memory, otherwise target is taken as an absolute value. libxlDomainFreeMemory sets 'relative' to true, but never allows for negative values by declaring the target memory variable as an unsigned. Fix by declaring the variable as signed, which also requried adjusting libxlSetMemoryTargetWrapper. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- src/libxl/libxl_api_wrapper.h | 16 ++++++---------- src/libxl/libxl_domain.c | 2 +- 2 files changed, 7 insertions(+), 11 deletions(-) diff --git a/src/libxl/libxl_api_wrapper.h b/src/libxl/libxl_api_wrapper.h index a9627f7983..c9582294cc 100644 --- a/src/libxl/libxl_api_wrapper.h +++ b/src/libxl/libxl_api_wrapper.h @@ -193,24 +193,20 @@ libxlSendTriggerWrapper(libxl_ctx *ctx, static inline int libxlSetMemoryTargetWrapper(libxl_ctx *ctx, uint32_t domid, - uint64_t target_memkb, + int64_t target_memkb, int relative, int enforce) { int ret = -1; - /* Technically this guard could be LIBXL_HAVE_MEMKB_64BITS */ -#if LIBXL_API_VERSION < 0x040800 - if (target_memkb < UINT_MAX) { - uint32_t val32 = target_memkb; +#ifdef LIBXL_HAVE_MEMKB_64BITS + ret = libxl_set_memory_target(ctx, domid, target_memkb, relative, enforce); +#else + if (target_memkb < INT_MAX) { + int32_t val32 = target_memkb; ret = libxl_set_memory_target(ctx, domid, val32, relative, enforce); } -#else - if (target_memkb < LLONG_MAX) { - int64_t val64 = target_memkb; - ret = libxl_set_memory_target(ctx, domid, val64, relative, enforce); - } #endif return ret; diff --git a/src/libxl/libxl_domain.c b/src/libxl/libxl_domain.c index 6c167df63e..0c4beffd6a 100644 --- a/src/libxl/libxl_domain.c +++ b/src/libxl/libxl_domain.c @@ -926,7 +926,7 @@ libxlDomainFreeMem(libxl_ctx *ctx, libxl_domain_config *d_config) { uint64_t needed_mem; uint64_t free_mem; - uint64_t target_mem; + int64_t target_mem; int tries = 3; int wait_secs = 10; -- 2.42.0

2 2

Share qemuInterfacexxxxConnect methods with ch
by Praveen Paladugu 19 Sep '23

19 Sep '23

Folks, I am working on upstreaming network support for ch driver. Like qemu driver,ch driver invokes steps in qemuInterfaceEthernetConnect, qemuInterfaceBridgeConnect methods to connect tap devices to appropriate host backends. Current implementation clones aboves methods to ch_interface files and uses them. I'd like to drop driver specific args from above methods and move them to a common place so that qemu and ch drivers can share above methods. int virInterfaceEthernetConnect(virDomainDef *def, virDomainNetDef *net, ebtablesContext *ebtables, bool macFilter, bool privileged, int *tapfd, size_t tapfdSize) I started with `qemuInterfaceEthernetConnect` and modified the signature as shown above. I initially tried putting `virInterfaceEthernetConnect` in 'src/util' but that caused a lot of cross inclusions. Above definition pulls in domain_conf.h, domain_nwfilter.h, domain_audit.h and more headers, into utils which causes cross inclusion. I later created interface/interface_connect.{c,h} files and moved the methods to these files. This would require driver code to include interface/interface_connect.h, which seemed better than above cross inclusion scenario. Do you see any issues with moving above methods to interface/interface_connect.x files? Any other ideas on how to reorg above methods so that they can be shared by qemu and ch drivers? Praveen

2 2

[PATCH 00/16] nwfilter: Add support for user defined metadata
by K Shiva Kiran 19 Sep '23

19 Sep '23

This patchset adds support for the following user defined metadata fields for network filters. - title: A short description of the filter. - description: Any documentation that the user wants to store. - metadata: Other metadata in XML form. K Shiva Kiran (16): xml: Add <title>, <description> and <metadata> to nwfilter xml schema conf: Add parser logic for nwfilter metadata fields nwfilter: Add enum to operate on user defined metadata nwfilter: Add error code and message for missing metadata nwfilter: Introduce public API to modify user metadata nwfilter: Introduce public API to retrieve user-defined metadata nwfilter: Implement RPC virsh: Add helper method to retrieve xml from NWFilter def virsh: Add new command `nwfilter-desc` virsh: Add new command `nwfilter-metadata` virsh: Add option --title for nwfilter-list docs: Document nwfilter metadata related commands virnwfilterobj: Add virNWFilterObjGetMetadata() virnwfilterobj: Add virNWFilterObjSetMetadata() nwfilter_driver: Add Driver implementation for metadata NEWS: Introduce user-defined metadata fields for NWFilter object NEWS.rst | 18 ++ docs/formatnwfilter.rst | 31 +++ docs/manpages/virsh.rst | 98 +++++++- include/libvirt/libvirt-nwfilter.h | 27 ++ include/libvirt/virterror.h | 1 + src/conf/nwfilter_conf.c | 30 +++ src/conf/nwfilter_conf.h | 5 + src/conf/schemas/nwfilter.rng | 9 + src/conf/virnwfilterobj.c | 148 +++++++++++ src/conf/virnwfilterobj.h | 13 + src/driver-nwfilter.h | 15 ++ src/libvirt-nwfilter.c | 154 ++++++++++++ src/libvirt_private.syms | 2 + src/libvirt_public.syms | 6 + src/nwfilter/nwfilter_driver.c | 61 +++++ src/remote/remote_driver.c | 2 + src/remote/remote_protocol.x | 34 ++- src/remote_protocol-structs | 19 ++ src/util/virerror.c | 3 + tools/virsh-nwfilter.c | 387 ++++++++++++++++++++++++++++- tools/virsh-util.c | 25 ++ tools/virsh-util.h | 9 + 22 files changed, 1089 insertions(+), 8 deletions(-) -- 2.42.0

2 25

[libvirt PATCH v3 00/12] Extract the integration job commands to a shell script
by Erik Skultety 19 Sep '23

19 Sep '23

v1 here: https://listman.redhat.com/archives/libvir-list/2023-September/242121.html Since v1: - introduced a new run_cmd_quiet helper function instead of using eval to deal with Shell redirections - added more info from the POSIX standard on test's -a,-o options - added commit references to the vendor locking of Avocado to v98.0 in the past Erik Skultety (12): syntax-check: Drop the shell's 'check for minus' rule ci: integration: Extract the integration CI main recipe to jobs.sh ci: integration: Adjust the check for CentOS Stream version ci: integration: Drop the 'install-deps' hidden job and reference ci: jobs.sh: Drop comment about the need for Avocado 98.0 ci: jobs.sh: integration: Use --quiet with virsh ci: jobs.sh: run_integration: Add/Rewrite/Reformat commentaries ci: jobs.sh: run_integration: Make POSIX-compliant ci: jobs.sh: Introduce a quiet version of run_cmd ci: jobs.sh: integration: Execute commands via 'run_cmd[_quiet]' helpers ci: jobs.sh: run_integration: Print DAEMONS variable for debugging ci: jobs.sh: Define and create SCRATCH_DIR for local executions build-aux/syntax-check.mk | 9 ------- ci/integration-template.yml | 42 +++-------------------------- ci/jobs.sh | 54 +++++++++++++++++++++++++++++++++++++ 3 files changed, 57 insertions(+), 48 deletions(-) -- 2.41.0

2 14