- Devel - libvirt List Archives

[PATCH v2 0/4] Add TPM emulator <source file=''/>
by marcandre.lureau＠redhat.com 04 Oct '24

04 Oct '24

From: Marc-André Lureau <marcandre.lureau(a)redhat.com> Hi, When swtpm capabilities reports "nvram-backend-dir", it can accepts a single file or block device where TPM state will be stored. --tpmstate must be backend-uri=file://. v2: - add <source dir='..'/> support as well (Daniel) Related: https://issues.redhat.com/browse/CNV-35250 Marc-André Lureau (4): util: check swtpm nvram-backend-dir capability schema: add TPM emulator <source file='..'> schema: add TPM emulator <source dir='..'> qemu_tpm: handle file/block storage source docs/formatdomain.rst | 18 +++++ src/conf/domain_conf.c | 28 +++++++ src/conf/domain_conf.h | 7 ++ src/conf/schemas/domaincommon.rng | 20 +++++ src/qemu/qemu_tpm.c | 76 +++++++++++++++---- src/util/virtpm.c | 1 + src/util/virtpm.h | 1 + .../qemuxmlconfdata/tpm-emulator-tpm2-enc.xml | 1 + tests/qemuxmlconfdata/tpm-emulator-tpm2.xml | 1 + 9 files changed, 140 insertions(+), 13 deletions(-) -- 2.45.2.827.g557ae147e6

5 22

[PATCH 0/2] add disk hotplug/unplug support to test hypervisor
by John Levon 04 Oct '24

04 Oct '24

John Levon (2): test_driver: provide basic disk hotplug support test_driver: provide basic disk hotunplug support src/test/test_driver.c | 276 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 273 insertions(+), 3 deletions(-) -- 2.34.1

1 2

[PATCH] util: Look for newer name of cpu wait time statistic
by Martin Kletzander 03 Oct '24

03 Oct '24

It looks like linux changed the key for wait time in /proc/<pid>/sched and /proc/<pid>/task/<tid>/sched files in commit ceeadb83aea2 (or around that time) from se.statistics.wait_sum to just wait_sum. Similarly to the previous change (from se.wait_sum) just look for the new name first. Resolves: https://issues.redhat.com/browse/RHEL-60030 Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- src/util/virprocess.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/util/virprocess.c b/src/util/virprocess.c index f1e5e4decd68..dd4bd866102e 100644 --- a/src/util/virprocess.c +++ b/src/util/virprocess.c @@ -1849,8 +1849,10 @@ virProcessGetSchedInfo(unsigned long long *cpuWait, const char *line = lines[i]; /* Needs CONFIG_SCHEDSTATS. The second check + * is the name used before ceeadb83aea2, the third one * is the old name the kernel used in past */ - if (STRPREFIX(line, "se.statistics.wait_sum") || + if (STRPREFIX(line, "wait_sum") || + STRPREFIX(line, "se.statistics.wait_sum") || STRPREFIX(line, "se.wait_sum")) { line = strchr(line, ':'); if (!line) { -- 2.46.2

2 1

[PATCH v7 00/14] qemu: Introduce shared_filesystems configuration option
by Andrea Bolognani 03 Oct '24

03 Oct '24

The need to have something like this in the first place is driven by KubeVirt (see [1] and [2]). A draft version of this series has been integrated into KubeVirt and it has been confirmed that it was effective in removing the need to use LD_PRELOAD hacks in the storage provider. Changes from [v6]: * only skip metadata locking for the swtpm lock file; * other tweaks based on review feedback. Changes from [v5]: * make migration of domains with TPM work (patches 12 and 13); * fixed all typos for "remember"; * added R-bs for Peter's patches. Changes from [v4] (v5 was posted by Peter): * added patch 7 cleaning up a helper function (noticed just while reading the code) * added patch 8 properly unrefing security labels in dac/selinux drivers on outgoing migration * patch 11: added handling of the 'nvram' image file (and refactored the function to allow reuse) Changes from [v3] (v4 was posted by Peter): * patch 2/8 was modified to change the docs for the new option. * patches 1-5 will get an R-b by me as I've adopted them. * patches 6, 9-11 are new. * patches 7, 8 were not part of v3 Changes from [v2]: * added canonicalization for user-provided paths; * fixed compilation issues when AppArmor support is enabled. Changes from [v1]: * documented more explicitly that the newly introduced option is intended for very specific scenarios and not general usage; as part of this, the NEWS update has been dropped too; * made a few tweaks and addressed a few oversight based on review feedback; * several preparatory cleanup patches have been pushed. Changes from [v0]: * reworked approach. [v6] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/7TTR… [v5] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/HNF5… [v4] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/FWR7… [v3] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/PISB… [v2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/XPCP… [v1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/XEIS… [v0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/MMKV… [1] https://issues.redhat.com/browse/CNV-34322 [2] https://issues.redhat.com/browse/CNV-39370 Andrea Bolognani (8): security: Fix alignment qemu: Introduce shared_filesystems configuration option qemu: Propagate shared_filesystems utils: Use overrides in virFileIsSharedFS() qemu: Always set labels for TPM state security: Always forget labels for TPM state directory security: Allow skipping locking when labeling lock files qemu: Handle locking of TPM state directory for incoming migration Peter Krempa (6): virFileIsSharedFSOverride: Export virParseOwnershipIds: Refactor virSecuritySELinuxRestoreImageLabelInt: Move FD image relabeling after 'migrated' check security_(dac|selinux): Unref remembered security labels on outgoing migration storage_source: Add field for skipping seclabel remembering qemu: migration: Don't remember seclabel for images shared from current host src/conf/storage_source_conf.c | 3 + src/conf/storage_source_conf.h | 9 ++ src/libvirt_private.syms | 1 + src/lxc/lxc_controller.c | 3 +- src/lxc/lxc_driver.c | 2 +- src/lxc/lxc_process.c | 4 +- src/qemu/libvirtd_qemu.aug | 3 + src/qemu/qemu.conf.in | 26 +++++ src/qemu/qemu_conf.c | 31 ++++++ src/qemu/qemu_conf.h | 2 + src/qemu/qemu_domain.c | 7 +- src/qemu/qemu_extdevice.c | 2 +- src/qemu/qemu_migration.c | 83 ++++++++++++++-- src/qemu/qemu_security.c | 147 ++++++++++++++++++++-------- src/qemu/qemu_security.h | 6 +- src/qemu/qemu_tpm.c | 51 +++++++--- src/qemu/qemu_tpm.h | 10 +- src/qemu/test_libvirtd_qemu.aug.in | 5 + src/security/security_apparmor.c | 8 +- src/security/security_dac.c | 61 +++++++++--- src/security/security_driver.h | 11 ++- src/security/security_manager.c | 54 ++++++++--- src/security/security_manager.h | 15 ++- src/security/security_nop.c | 5 + src/security/security_selinux.c | 151 +++++++++++++++++++++++------ src/security/security_stack.c | 38 ++++++-- src/util/virfile.c | 63 +++++++++++- src/util/virfile.h | 5 +- src/util/virutil.c | 20 ++-- tests/securityselinuxlabeltest.c | 2 +- tests/virfiletest.c | 2 +- 31 files changed, 666 insertions(+), 164 deletions(-) -- 2.46.2

2 19

[PATCH V2 0/4] Rework qemu internal active snapshots to use QMP
by Nikolai Barybin 03 Oct '24

03 Oct '24

Den, Peter, Daniel thank you for your comments! I'm sending v2 of this patchset. Changes since last revision: - dropped [PATCH 4/4] qemu monitor: reap qemu_monitor_text - added new patch: qemu capabilities: add QEMU_CAPS_SNAPSHOT_SAVE/_DELETE - preserved old-style snapshotting (HMP savevm) in case we have QEMU < 6.0 - enhanced requirements for allowing snapshotting. All writable disks should be qcow2, non-shared. If such disks exist and we have qcow2 NVRAM, add NVRAM device to the list of wrdevs. But never save vmstate to NVRAM - make char** wrdevs list allocation inside qemuSnapshotActiveInternalGetWrdevListHelper() Nikolai Barybin (4): qemu monitor: add snaphot-save/delete QMP commands qemu blockjob: add snapshot-save/delete job types qemu capabilities: add QEMU_CAPS_SNAPSHOT_SAVE/_DELETE qemu snapshot: use QMP snapshot-save/delete for internal snapshots src/qemu/qemu_block.c | 2 + src/qemu/qemu_blockjob.c | 6 +- src/qemu/qemu_blockjob.h | 2 + src/qemu/qemu_capabilities.c | 4 + src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_domain.c | 4 + src/qemu/qemu_monitor.c | 30 +++ src/qemu/qemu_monitor.h | 13 ++ src/qemu/qemu_monitor_json.c | 66 ++++++ src/qemu/qemu_monitor_json.h | 13 ++ src/qemu/qemu_snapshot.c | 207 ++++++++++++++++-- .../caps_6.0.0_aarch64.xml | 2 + .../qemucapabilitiesdata/caps_6.0.0_s390x.xml | 2 + .../caps_6.0.0_x86_64.xml | 2 + .../caps_6.1.0_x86_64.xml | 2 + .../caps_6.2.0_aarch64.xml | 2 + .../qemucapabilitiesdata/caps_6.2.0_ppc64.xml | 2 + .../caps_6.2.0_x86_64.xml | 2 + .../caps_7.0.0_aarch64+hvf.xml | 2 + .../caps_7.0.0_aarch64.xml | 2 + .../qemucapabilitiesdata/caps_7.0.0_ppc64.xml | 2 + .../caps_7.0.0_x86_64.xml | 2 + .../qemucapabilitiesdata/caps_7.1.0_ppc64.xml | 2 + .../caps_7.1.0_x86_64.xml | 2 + tests/qemucapabilitiesdata/caps_7.2.0_ppc.xml | 2 + .../caps_7.2.0_x86_64+hvf.xml | 2 + .../caps_7.2.0_x86_64.xml | 2 + .../caps_8.0.0_riscv64.xml | 2 + .../caps_8.0.0_x86_64.xml | 2 + .../qemucapabilitiesdata/caps_8.1.0_s390x.xml | 2 + .../caps_8.1.0_x86_64.xml | 2 + .../caps_8.2.0_aarch64.xml | 2 + .../caps_8.2.0_armv7l.xml | 2 + .../caps_8.2.0_loongarch64.xml | 2 + .../qemucapabilitiesdata/caps_8.2.0_s390x.xml | 2 + .../caps_8.2.0_x86_64.xml | 2 + .../qemucapabilitiesdata/caps_9.0.0_sparc.xml | 2 + .../caps_9.0.0_x86_64.xml | 2 + .../caps_9.1.0_x86_64.xml | 2 + 39 files changed, 391 insertions(+), 14 deletions(-) -- 2.43.5

2 14

[PATCH 0/2] add NIC hotplug support to test hypervisor
by John Levon 03 Oct '24

03 Oct '24

These two patches add basic support for NIC hot[un]plug to the test hypervisor, based on the qemu driver; only ethernet and bridge type VNICS are currently supported. John Levon (2): test_driver: provide basic NIC hotplug support test_driver: provide basic NIC hotunplug support src/test/test_driver.c | 305 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 283 insertions(+), 22 deletions(-) -- 2.34.1

2 9

[PATCH v6 00/13] qemu: Introduce shared_filesystems configuration option
by Andrea Bolognani 02 Oct '24

02 Oct '24

The need to have something like this in the first place is driven by KubeVirt (see [1] and [2]). A draft version of this series has been integrated into KubeVirt and it has been confirmed that it was effective in removing the need to use LD_PRELOAD hacks in the storage provider. Changes from [v5]: * make migration of domains with TPM work (patches 12 and 13); * fixed all typos for "remember"; * added R-bs for Peter's patches. Changes from [v4] (v5 was posted by Peter): * added patch 7 cleaning up a helper function (noticed just while reading the code) * added patch 8 properly unrefing security labels in dac/selinux drivers on outgoing migration * patch 11: added handling of the 'nvram' image file (and refactored the function to allow reuse) Changes from [v3] (v4 was posted by Peter): * patch 2/8 was modified to change the docs for the new option. * patches 1-5 will get an R-b by me as I've adopted them. * patches 6, 9-11 are new. * patches 7, 8 were not part of v3 Changes from [v2]: * added canonicalization for user-provided paths; * fixed compilation issues when AppArmor support is enabled. Changes from [v1]: * documented more explicitly that the newly introduced option is intended for very specific scenarios and not general usage; as part of this, the NEWS update has been dropped too; * made a few tweaks and addressed a few oversight based on review feedback; * several preparatory cleanup patches have been pushed. Changes from [v0]: * reworked approach. [v5] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/HNF… [v4] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/FWR… [v3] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/PIS… [v2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/XPCP… [v1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/XEIS… [v0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/MMKV… [1] https://issues.redhat.com/browse/CNV-34322 [2] https://issues.redhat.com/browse/CNV-39370 Andrea Bolognani (7): security: Fix alignment qemu: Introduce shared_filesystems configuration option qemu: Propagate shared_filesystems utils: Use overrides in virFileIsSharedFS() qemu: Always set labels for TPM state security: Always forget labels for TPM state directory qemu: Don't lock TPM state directory for incoming migration Peter Krempa (6): virFileIsSharedFSOverride: Export virParseOwnershipIds: Refactor virSecuritySELinuxRestoreImageLabelInt: Move FD image relabeling after 'migrated' check security_(dac|selinux): Unref remembered security labels on outgoing migration storage_source: Add field for skipping seclabel remembering qemu: migration: Don't remember seclabel for images shared from current host src/conf/storage_source_conf.c | 3 + src/conf/storage_source_conf.h | 9 ++ src/libvirt_private.syms | 1 + src/lxc/lxc_controller.c | 3 +- src/lxc/lxc_driver.c | 2 +- src/lxc/lxc_process.c | 4 +- src/qemu/libvirtd_qemu.aug | 3 + src/qemu/qemu.conf.in | 26 +++++ src/qemu/qemu_conf.c | 31 ++++++ src/qemu/qemu_conf.h | 2 + src/qemu/qemu_domain.c | 7 +- src/qemu/qemu_extdevice.c | 2 +- src/qemu/qemu_migration.c | 86 ++++++++++++++--- src/qemu/qemu_security.c | 95 +++++++++++++----- src/qemu/qemu_security.h | 6 +- src/qemu/qemu_tpm.c | 50 ++++++---- src/qemu/qemu_tpm.h | 10 +- src/qemu/test_libvirtd_qemu.aug.in | 5 + src/security/security_apparmor.c | 8 +- src/security/security_dac.c | 53 +++++++++-- src/security/security_driver.h | 8 +- src/security/security_manager.c | 33 +++++-- src/security/security_manager.h | 9 +- src/security/security_nop.c | 5 + src/security/security_selinux.c | 148 +++++++++++++++++++++++------ src/security/security_stack.c | 32 +++++-- src/util/virfile.c | 63 +++++++++++- src/util/virfile.h | 5 +- src/util/virutil.c | 20 ++-- tests/securityselinuxlabeltest.c | 2 +- tests/virfiletest.c | 2 +- 31 files changed, 594 insertions(+), 139 deletions(-) -- 2.46.0

2 17

[PATCH v2] domain_validate: Validate dma_translation for iommu models
by Han Han 02 Oct '24

02 Oct '24

The attribute dma_translation is only supported by intel-iommu device. Report an error when it is used for the other iommu devices. Fixes: 6866f958c1 Signed-off-by: Han Han <hhan(a)redhat.com> --- v2: update the tests v1: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/6CHF… src/conf/domain_validate.c | 3 ++- ...io-iommu-dma-translation.x86_64-latest.err | 1 + .../virtio-iommu-dma-translation.xml | 20 +++++++++++++++++++ tests/qemuxmlconftest.c | 1 + 4 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 tests/qemuxmlconfdata/virtio-iommu-dma-translation.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/virtio-iommu-dma-translation.xml diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c index eddb4a5e74..b8ae9ed79d 100644 --- a/src/conf/domain_validate.c +++ b/src/conf/domain_validate.c @@ -2980,7 +2980,8 @@ virDomainIOMMUDefValidate(const virDomainIOMMUDef *iommu) iommu->caching_mode != VIR_TRISTATE_SWITCH_ABSENT || iommu->eim != VIR_TRISTATE_SWITCH_ABSENT || iommu->iotlb != VIR_TRISTATE_SWITCH_ABSENT || - iommu->aw_bits != 0) { + iommu->aw_bits != 0 || + iommu->dma_translation != VIR_TRISTATE_SWITCH_ABSENT) { virReportError(VIR_ERR_XML_ERROR, _("iommu model '%1$s' doesn't support additional attributes"), virDomainIOMMUModelTypeToString(iommu->model)); diff --git a/tests/qemuxmlconfdata/virtio-iommu-dma-translation.x86_64-latest.err b/tests/qemuxmlconfdata/virtio-iommu-dma-translation.x86_64-latest.err new file mode 100644 index 0000000000..2c3a272725 --- /dev/null +++ b/tests/qemuxmlconfdata/virtio-iommu-dma-translation.x86_64-latest.err @@ -0,0 +1 @@ +XML error: iommu model 'virtio' doesn't support additional attributes diff --git a/tests/qemuxmlconfdata/virtio-iommu-dma-translation.xml b/tests/qemuxmlconfdata/virtio-iommu-dma-translation.xml new file mode 100644 index 0000000000..a3723f266b --- /dev/null +++ b/tests/qemuxmlconfdata/virtio-iommu-dma-translation.xml @@ -0,0 +1,20 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='q35'>hvm</type> + </os> + <features> + <acpi/> + </features> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' model='none'/> + <memballoon model='none'/> + <iommu model='virtio'> + <driver dma_translation='on'/> + </iommu> + </devices> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 61eb4cda75..dfcf67d2d0 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -2766,6 +2766,7 @@ mymain(void) DO_TEST_CAPS_LATEST_PARSE_ERROR("virtio-iommu-no-acpi"); DO_TEST_CAPS_LATEST_PARSE_ERROR("virtio-iommu-invalid-address-type"); DO_TEST_CAPS_LATEST_PARSE_ERROR("virtio-iommu-invalid-address"); + DO_TEST_CAPS_LATEST_PARSE_ERROR("virtio-iommu-dma-translation"); DO_TEST_CAPS_LATEST("cpu-hotplug-startup"); DO_TEST_CAPS_ARCH_LATEST_PARSE_ERROR("cpu-hotplug-granularity", "ppc64"); -- 2.46.1

2 1

[PATCH 0/2] libxl_conf: Fix crashes in libxl config generation
by Rayhan Faizel 02 Oct '24

02 Oct '24

This patch series includes fixes for config generation of multiple serial devices and handling of unsupported graphics types. Both of these were discovered some time back using fuzzing techniques. Rayhan Faizel (2): libxl_conf: Fix config generation for multiple serial devices libxl_conf: Add check for unsupported graphics type src/libxl/libxl_conf.c | 15 +++-- .../multiple-serial.json | 63 +++++++++++++++++++ .../multiple-serial.xml | 47 ++++++++++++++ .../libxlxml2domconfigdata/single-serial.json | 52 +++++++++++++++ .../libxlxml2domconfigdata/single-serial.xml | 25 ++++++++ tests/libxlxml2domconfigtest.c | 3 + 6 files changed, 200 insertions(+), 5 deletions(-) create mode 100644 tests/libxlxml2domconfigdata/multiple-serial.json create mode 100644 tests/libxlxml2domconfigdata/multiple-serial.xml create mode 100644 tests/libxlxml2domconfigdata/single-serial.json create mode 100644 tests/libxlxml2domconfigdata/single-serial.xml -- 2.34.1

2 4

[PATCH v3] docs: Mark "gluster" support in QEMU as deprecated
by Thomas Huth 02 Oct '24

02 Oct '24

According to https://marc.info/?l=fedora-devel-list&m=171934833215726 the GlusterFS development effectively ended. Thus mark it as deprecated in QEMU, so we can remove it in a future release if the project does not gain momentum again. Acked-by: Niels de Vos <ndevos(a)redhat.com> Acked-by: Markus Armbruster <armbru(a)redhat.com> Signed-off-by: Thomas Huth <thuth(a)redhat.com> --- v3: Some rewordings according to Markus' and Daniel's suggestions docs/about/deprecated.rst | 9 +++++++++ qapi/block-core.json | 8 +++++++- block/gluster.c | 2 ++ 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index c0aa52def5..c41e55f710 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -414,6 +414,15 @@ Specifying the iSCSI password in plain text on the command line using the used instead, to refer to a ``--object secret...`` instance that provides a password via a file, or encrypted. +``gluster`` backend (since 9.2) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +According to https://marc.info/?l=fedora-devel-list&m=171934833215726 +the GlusterFS development effectively ended. Unless the development +gains momentum again, the QEMU project will remove the gluster backend +in a future release. + + Character device options '''''''''''''''''''''''' diff --git a/qapi/block-core.json b/qapi/block-core.json index c3b0a2376b..8181abef54 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json @@ -3192,12 +3192,18 @@ # # @snapshot-access: Since 7.0 # +# Features: +# +# @deprecated: Member @gluster is deprecated because GlusterFS +# development ceased. +# # Since: 2.9 ## { 'enum': 'BlockdevDriver', 'data': [ 'blkdebug', 'blklogwrites', 'blkreplay', 'blkverify', 'bochs', 'cloop', 'compress', 'copy-before-write', 'copy-on-read', 'dmg', - 'file', 'snapshot-access', 'ftp', 'ftps', 'gluster', + 'file', 'snapshot-access', 'ftp', 'ftps', + {'name': 'gluster', 'features': [ 'deprecated' ] }, {'name': 'host_cdrom', 'if': 'HAVE_HOST_BLOCK_DEVICE' }, {'name': 'host_device', 'if': 'HAVE_HOST_BLOCK_DEVICE' }, 'http', 'https', diff --git a/block/gluster.c b/block/gluster.c index f8b415f381..f03d05251e 100644 --- a/block/gluster.c +++ b/block/gluster.c @@ -809,6 +809,8 @@ static int qemu_gluster_open(BlockDriverState *bs, QDict *options, goto out; } + warn_report_once("'gluster' is deprecated"); + filename = qemu_opt_get(opts, GLUSTER_OPT_FILENAME); s->debug = qemu_opt_get_number(opts, GLUSTER_OPT_DEBUG, -- 2.46.1

1 0