- Devel - libvirt List Archives

[PATCH] Revert "network: allow "modify" option for DNS-Srv records"
by Adam Julis 05 Aug '24

05 Aug '24

This reverts commit cf934c87cca32149675020ea595712aad25978e6. The matching logic is flawed and it would complicate support of this command. Signed-off-by: Adam Julis <ajulis(a)redhat.com> --- See discussion: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/6VV… src/conf/network_conf.c | 27 +++++-------------- .../srv-not-existing.xml | 1 - .../srv-record-modify-few.xml | 1 - .../nat-network-dns-srv-modify-few.xml | 26 ------------------ tests/networkxml2xmlupdatetest.c | 10 +------ 5 files changed, 7 insertions(+), 58 deletions(-) delete mode 100644 tests/networkxml2xmlupdatein/srv-not-existing.xml delete mode 100644 tests/networkxml2xmlupdatein/srv-record-modify-few.xml delete mode 100644 tests/networkxml2xmlupdateout/nat-network-dns-srv-modify-few.xml diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c index 68eee367c4..3af4e1d036 100644 --- a/src/conf/network_conf.c +++ b/src/conf/network_conf.c @@ -3257,6 +3257,12 @@ virNetworkDefUpdateDNSSrv(virNetworkDef *def, command == VIR_NETWORK_UPDATE_COMMAND_ADD_LAST); int foundCt = 0; + if (command == VIR_NETWORK_UPDATE_COMMAND_MODIFY) { + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", + _("DNS SRV records cannot be modified, only added or deleted")); + goto cleanup; + } + if (virNetworkDefUpdateCheckElementName(def, ctxt->node, "srv") < 0) goto cleanup; @@ -3306,27 +3312,6 @@ virNetworkDefUpdateDNSSrv(virNetworkDef *def, virNetworkDNSSrvDefClear(&dns->srvs[foundIdx]); VIR_DELETE_ELEMENT(dns->srvs, foundIdx, dns->nsrvs); - } else if (command == VIR_NETWORK_UPDATE_COMMAND_MODIFY) { - - if (foundCt == 0) { - virReportError(VIR_ERR_OPERATION_INVALID, - _("couldn't locate a matching DNS SRV record in network %1$s"), - def->name); - goto cleanup; - } - - if (foundCt > 1) { - virReportError(VIR_ERR_OPERATION_INVALID, - _("multiple DNS SRV records matching all specified fields were found in network %1$s"), - def->name); - goto cleanup; - } - - virNetworkDNSSrvDefClear(&dns->srvs[foundIdx]); - - memcpy(&dns->srvs[foundIdx], &srv, sizeof(virNetworkDNSSrvDef)); - memset(&srv, 0, sizeof(virNetworkDNSSrvDef)); - } else { virNetworkDefUpdateUnknownCommand(command); goto cleanup; diff --git a/tests/networkxml2xmlupdatein/srv-not-existing.xml b/tests/networkxml2xmlupdatein/srv-not-existing.xml deleted file mode 100644 index 401e14c616..0000000000 --- a/tests/networkxml2xmlupdatein/srv-not-existing.xml +++ /dev/null @@ -1 +0,0 @@ -<srv service='name' protocol='tcp' domain='unknown-domain' target='.' port='666' priority='99' weight='10'/> diff --git a/tests/networkxml2xmlupdatein/srv-record-modify-few.xml b/tests/networkxml2xmlupdatein/srv-record-modify-few.xml deleted file mode 100644 index 88ec1b97d9..0000000000 --- a/tests/networkxml2xmlupdatein/srv-record-modify-few.xml +++ /dev/null @@ -1 +0,0 @@ -<srv service='name' protocol='tcp' domain='test-domain-name' target='.' port='1221' priority='42' weight='69'/> diff --git a/tests/networkxml2xmlupdateout/nat-network-dns-srv-modify-few.xml b/tests/networkxml2xmlupdateout/nat-network-dns-srv-modify-few.xml deleted file mode 100644 index a7e5fcffa6..0000000000 --- a/tests/networkxml2xmlupdateout/nat-network-dns-srv-modify-few.xml +++ /dev/null @@ -1,26 +0,0 @@ -<network> - <name>default</name> - <uuid>81ff0d90-c91e-6742-64da-4a736edb9a9b</uuid> - <forward dev='eth1' mode='nat'> - <interface dev='eth1'/> - </forward> - <bridge name='virbr0' stp='on' delay='0'/> - <dns> - <srv service='name' protocol='tcp' domain='test-domain-name' target='.' port='1221' priority='42' weight='69'/> - </dns> - <ip address='192.168.122.1' netmask='255.255.255.0'> - <dhcp> - <range start='192.168.122.2' end='192.168.122.254'/> - <host mac='00:16:3e:77:e2:ed' name='a.example.com' ip='192.168.122.10'/> - <host mac='00:16:3e:3e:a9:1a' name='b.example.com' ip='192.168.122.11'/> - </dhcp> - </ip> - <ip family='ipv4' address='192.168.123.1' netmask='255.255.255.0'> - </ip> - <ip family='ipv6' address='2001:db8:ac10:fe01::1' prefix='64'> - </ip> - <ip family='ipv6' address='2001:db8:ac10:fd01::1' prefix='64'> - </ip> - <ip family='ipv4' address='10.24.10.1'> - </ip> -</network> diff --git a/tests/networkxml2xmlupdatetest.c b/tests/networkxml2xmlupdatetest.c index 875cede035..60931a2eba 100644 --- a/tests/networkxml2xmlupdatetest.c +++ b/tests/networkxml2xmlupdatetest.c @@ -337,6 +337,7 @@ mymain(void) "nat-network-dns-srv-record", "nat-network-dns-srv-records", VIR_NETWORK_UPDATE_COMMAND_ADD_LAST); + DO_TEST_FAIL("delete-missing-srv-record-service", "srv-record-service", "nat-network", @@ -359,15 +360,6 @@ mymain(void) "nat-network-dns-srv-record", "nat-network", VIR_NETWORK_UPDATE_COMMAND_DELETE); - DO_TEST("modify-srv-record-protocol", - "srv-record-modify-few", - "nat-network-dns-srv-record", - "nat-network-dns-srv-modify-few", - VIR_NETWORK_UPDATE_COMMAND_MODIFY); - DO_TEST_FAIL("modify-not-existing-srv-record", - "srv-not-existing", - "nat-network-dns-srv-record", - VIR_NETWORK_UPDATE_COMMAND_MODIFY); return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; -- 2.45.2

2 1

[PATCH] network: allow "modify" option for DNS-Srv records
by Adam Julis 05 Aug '24

05 Aug '24

The "modify" command allows to replace an existing Srv record (some of its elements respectively: port, priority and weight). The primary key used to choose the modify record is the remaining parameters, only one of them is required. Not using some of these parameters may cause duplicate records and error message. This logic is there because of the previous implementation (Add and Delete options) in the function. Tests in networkxml2xmlupdatetest.c contain replacements of an existing DNS-Srv record and failure due to non-existing record. Resolves: https://gitlab.com/libvirt/libvirt/-/issues/639 Signed-off-by: Adam Julis <ajulis(a)redhat.com> --- src/conf/network_conf.c | 27 ++++++++++++++----- .../srv-not-existing.xml | 1 + .../srv-record-modify-few.xml | 1 + .../nat-network-dns-srv-modify-few.xml | 26 ++++++++++++++++++ tests/networkxml2xmlupdatetest.c | 10 ++++++- 5 files changed, 58 insertions(+), 7 deletions(-) create mode 100644 tests/networkxml2xmlupdatein/srv-not-existing.xml create mode 100644 tests/networkxml2xmlupdatein/srv-record-modify-few.xml create mode 100644 tests/networkxml2xmlupdateout/nat-network-dns-srv-modify-few.xml diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c index 2a541cd5b0..fc387f9566 100644 --- a/src/conf/network_conf.c +++ b/src/conf/network_conf.c @@ -3255,12 +3255,6 @@ virNetworkDefUpdateDNSSrv(virNetworkDef *def, command == VIR_NETWORK_UPDATE_COMMAND_ADD_LAST); int foundCt = 0; - if (command == VIR_NETWORK_UPDATE_COMMAND_MODIFY) { - virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", - _("DNS SRV records cannot be modified, only added or deleted")); - goto cleanup; - } - if (virNetworkDefUpdateCheckElementName(def, ctxt->node, "srv") < 0) goto cleanup; @@ -3310,6 +3304,27 @@ virNetworkDefUpdateDNSSrv(virNetworkDef *def, virNetworkDNSSrvDefClear(&dns->srvs[foundIdx]); VIR_DELETE_ELEMENT(dns->srvs, foundIdx, dns->nsrvs); + } else if (command == VIR_NETWORK_UPDATE_COMMAND_MODIFY) { + + if (foundCt == 0) { + virReportError(VIR_ERR_OPERATION_INVALID, + _("couldn't locate a matching DNS SRV record in network %1$s"), + def->name); + goto cleanup; + } + + if (foundCt > 1) { + virReportError(VIR_ERR_OPERATION_INVALID, + _("multiple DNS SRV records matching all specified fields were found in network %1$s"), + def->name); + goto cleanup; + } + + virNetworkDNSSrvDefClear(&dns->srvs[foundIdx]); + + memcpy(&dns->srvs[foundIdx], &srv, sizeof(virNetworkDNSSrvDef)); + memset(&srv, 0, sizeof(virNetworkDNSSrvDef)); + } else { virNetworkDefUpdateUnknownCommand(command); goto cleanup; diff --git a/tests/networkxml2xmlupdatein/srv-not-existing.xml b/tests/networkxml2xmlupdatein/srv-not-existing.xml new file mode 100644 index 0000000000..401e14c616 --- /dev/null +++ b/tests/networkxml2xmlupdatein/srv-not-existing.xml @@ -0,0 +1 @@ +<srv service='name' protocol='tcp' domain='unknown-domain' target='.' port='666' priority='99' weight='10'/> diff --git a/tests/networkxml2xmlupdatein/srv-record-modify-few.xml b/tests/networkxml2xmlupdatein/srv-record-modify-few.xml new file mode 100644 index 0000000000..88ec1b97d9 --- /dev/null +++ b/tests/networkxml2xmlupdatein/srv-record-modify-few.xml @@ -0,0 +1 @@ +<srv service='name' protocol='tcp' domain='test-domain-name' target='.' port='1221' priority='42' weight='69'/> diff --git a/tests/networkxml2xmlupdateout/nat-network-dns-srv-modify-few.xml b/tests/networkxml2xmlupdateout/nat-network-dns-srv-modify-few.xml new file mode 100644 index 0000000000..a7e5fcffa6 --- /dev/null +++ b/tests/networkxml2xmlupdateout/nat-network-dns-srv-modify-few.xml @@ -0,0 +1,26 @@ +<network> + <name>default</name> + <uuid>81ff0d90-c91e-6742-64da-4a736edb9a9b</uuid> + <forward dev='eth1' mode='nat'> + <interface dev='eth1'/> + </forward> + <bridge name='virbr0' stp='on' delay='0'/> + <dns> + <srv service='name' protocol='tcp' domain='test-domain-name' target='.' port='1221' priority='42' weight='69'/> + </dns> + <ip address='192.168.122.1' netmask='255.255.255.0'> + <dhcp> + <range start='192.168.122.2' end='192.168.122.254'/> + <host mac='00:16:3e:77:e2:ed' name='a.example.com' ip='192.168.122.10'/> + <host mac='00:16:3e:3e:a9:1a' name='b.example.com' ip='192.168.122.11'/> + </dhcp> + </ip> + <ip family='ipv4' address='192.168.123.1' netmask='255.255.255.0'> + </ip> + <ip family='ipv6' address='2001:db8:ac10:fe01::1' prefix='64'> + </ip> + <ip family='ipv6' address='2001:db8:ac10:fd01::1' prefix='64'> + </ip> + <ip family='ipv4' address='10.24.10.1'> + </ip> +</network> diff --git a/tests/networkxml2xmlupdatetest.c b/tests/networkxml2xmlupdatetest.c index 383cbf85ce..59e6ce98e5 100644 --- a/tests/networkxml2xmlupdatetest.c +++ b/tests/networkxml2xmlupdatetest.c @@ -328,7 +328,6 @@ mymain(void) "nat-network-dns-srv-record", "nat-network-dns-srv-records", VIR_NETWORK_UPDATE_COMMAND_ADD_LAST); - DO_TEST_FAIL("delete-missing-srv-record-service", "srv-record-service", "nat-network", @@ -351,6 +350,15 @@ mymain(void) "nat-network-dns-srv-record", "nat-network", VIR_NETWORK_UPDATE_COMMAND_DELETE); + DO_TEST("modify-srv-record-protocol", + "srv-record-modify-few", + "nat-network-dns-srv-record", + "nat-network-dns-srv-modify-few", + VIR_NETWORK_UPDATE_COMMAND_MODIFY); + DO_TEST_FAIL("modify-not-existing-srv-record", + "srv-not-existing", + "nat-network-dns-srv-record", + VIR_NETWORK_UPDATE_COMMAND_MODIFY); return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; -- 2.45.2

3 2

[PATCH v2 0/7] introduce job-change qmp command
by Vladimir Sementsov-Ogievskiy 02 Aug '24

02 Aug '24

Hi all! This is an updated first part of my "[RFC 00/15] block job API" Supersedes: <20240313150907.623462-1-vsementsov(a)yandex-team.ru> v2: - only job-change for now, as a first step - drop "type-based unions", and keep type parameter as is for now (I now doubt that this was good idea, as it makes QAPI protocol dependent on context) 03: improve documentation 06: deprecated only block-job-change for now 07: new Vladimir Sementsov-Ogievskiy (7): qapi: rename BlockJobChangeOptions to JobChangeOptions blockjob: block_job_change_locked(): check job type qapi: block-job-change: make copy-mode parameter optional blockjob: move change action implementation to job from block-job qapi: add job-change qapi/block-core: derpecate block-job-change iotests/mirror-change-copy-mode: switch to job-change command block/mirror.c | 13 +++++--- blockdev.c | 4 +-- blockjob.c | 20 ------------ docs/about/deprecated.rst | 5 +++ include/block/blockjob.h | 11 ------- include/block/blockjob_int.h | 7 ----- include/qemu/job.h | 12 +++++++ job-qmp.c | 15 +++++++++ job.c | 23 ++++++++++++++ qapi/block-core.json | 31 ++++++++++++++----- .../tests/mirror-change-copy-mode | 2 +- 11 files changed, 90 insertions(+), 53 deletions(-) -- 2.34.1

2 15

[PATCH v5 00/11] qemu: Introduce shared_filesystems configuration option
by Peter Krempa 02 Aug '24

02 Aug '24

v4: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/FWR… For justification see v3: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/PIS… This version includes patches that deal with seclabel remembering without instructing users to disable it. Diff to v4: - added patch 7 cleaning up a helper function (noticed just while reading the code) - added patch 8 properly unrefing security labels in dac/selinux drivers on outgoing migration - patch 11: added handling of the 'nvram' image file (and refactored the function to allow reuse) Tested migrating both ways including uefi nvram image. Didn't test TPM though. Diff to v3 (numbering fixed): - Patch 2/8 was modified to change the docs for the new option. - Patches 1-5 will get an R-b by me as I've adopted them. - Patches 6, 9-11 are new. - Patches 7, 8 were not part of v3 Andrea Bolognani (5): security: Fix alignment qemu: Introduce shared_filesystems configuration option qemu: Propagate shared_filesystems utils: Use overrides in virFileIsSharedFS() qemu: Always set labels for TPM state Peter Krempa (6): virFileIsSharedFSOverride: Export virParseOwnershipIds: Refactor virSecuritySELinuxRestoreImageLabelInt: Move FD image relabeling after 'migrated' check security_(dac|selinux): Unref remebered security labels on outgoing migration storage_source: Add field for skipping seclabel remembering qemu: migration: Don't remember seclabel for images shared from current host src/conf/storage_source_conf.c | 3 + src/conf/storage_source_conf.h | 9 +++ src/libvirt_private.syms | 1 + src/lxc/lxc_controller.c | 3 +- src/lxc/lxc_driver.c | 2 +- src/lxc/lxc_process.c | 4 +- src/qemu/libvirtd_qemu.aug | 3 + src/qemu/qemu.conf.in | 26 +++++++++ src/qemu/qemu_conf.c | 31 ++++++++++ src/qemu/qemu_conf.h | 2 + src/qemu/qemu_domain.c | 7 ++- src/qemu/qemu_extdevice.c | 2 +- src/qemu/qemu_migration.c | 86 +++++++++++++++++++++++---- src/qemu/qemu_security.c | 85 ++++++++++++++++++++------- src/qemu/qemu_tpm.c | 38 ++++++------ src/qemu/qemu_tpm.h | 10 ++-- src/qemu/test_libvirtd_qemu.aug.in | 5 ++ src/security/security_apparmor.c | 8 ++- src/security/security_dac.c | 53 +++++++++++++---- src/security/security_driver.h | 8 ++- src/security/security_manager.c | 33 ++++++++--- src/security/security_manager.h | 9 ++- src/security/security_nop.c | 5 ++ src/security/security_selinux.c | 94 +++++++++++++++++++++--------- src/security/security_stack.c | 32 +++++++--- src/util/virfile.c | 63 +++++++++++++++++++- src/util/virfile.h | 5 +- src/util/virutil.c | 20 +++---- tests/securityselinuxlabeltest.c | 2 +- tests/virfiletest.c | 2 +- 30 files changed, 517 insertions(+), 134 deletions(-) -- 2.45.2

1 11

[PATCH v4 0/8] qemu: Introduce shared_filesystems configuration option
by Peter Krempa 01 Aug '24

01 Aug '24

For justification see v3: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/PIS… This version includes patches that deal with seclabel remembering without instructing users to disable it. Patch 2/8 was modified to change the docs for the new option. Patches 1-5 will get an R-b by me as I've adopted them. Patches 6-8 are new. Andrea Bolognani (5): security: Fix alignment qemu: Introduce shared_filesystems configuration option qemu: Propagate shared_filesystems utils: Use overrides in virFileIsSharedFS() qemu: Always set labels for TPM state Peter Krempa (3): virFileIsSharedFSOverride: Export storage_source: Add field for skipping seclabel remembering qemu: migration: Don't remember seclabel for images shared from current host src/conf/storage_source_conf.c | 3 ++ src/conf/storage_source_conf.h | 9 ++++ src/libvirt_private.syms | 1 + src/lxc/lxc_controller.c | 3 +- src/lxc/lxc_driver.c | 2 +- src/lxc/lxc_process.c | 4 +- src/qemu/libvirtd_qemu.aug | 3 ++ src/qemu/qemu.conf.in | 26 +++++++++ src/qemu/qemu_conf.c | 31 +++++++++++ src/qemu/qemu_conf.h | 2 + src/qemu/qemu_domain.c | 7 ++- src/qemu/qemu_extdevice.c | 2 +- src/qemu/qemu_migration.c | 72 +++++++++++++++++++++---- src/qemu/qemu_security.c | 85 +++++++++++++++++++++++------- src/qemu/qemu_tpm.c | 38 +++++++------ src/qemu/qemu_tpm.h | 10 ++-- src/qemu/test_libvirtd_qemu.aug.in | 5 ++ src/security/security_apparmor.c | 8 ++- src/security/security_dac.c | 50 ++++++++++++++---- src/security/security_driver.h | 8 ++- src/security/security_manager.c | 33 +++++++++--- src/security/security_manager.h | 9 +++- src/security/security_nop.c | 5 ++ src/security/security_selinux.c | 59 ++++++++++++++++----- src/security/security_stack.c | 32 ++++++++--- src/util/virfile.c | 63 ++++++++++++++++++++-- src/util/virfile.h | 5 +- tests/securityselinuxlabeltest.c | 2 +- tests/virfiletest.c | 2 +- 29 files changed, 472 insertions(+), 107 deletions(-) -- 2.45.2

2 13

[PATCH 0/2] qemu: Strip <acpi/> from configs on s390
by Peter Krempa 01 Aug '24

01 Aug '24

See patch 1 for the rationale. Peter Krempa (2): qemu_domain: Strip <acpi/> from s390(x) definitions qemuxmlconftest: Add tests for the ACPI stripping hack on s390 src/qemu/qemu_domain.c | 94 +++++++++++++++++++ .../aarch64-nousb-acpi.aarch64-latest.err | 1 + tests/qemuxmlconfdata/aarch64-nousb-acpi.xml | 18 ++++ ...ngarch64-virt-acpi.loongarch64-latest.args | 31 ++++++ ...ongarch64-virt-acpi.loongarch64-latest.xml | 26 +++++ .../qemuxmlconfdata/loongarch64-virt-acpi.xml | 15 +++ .../misc-acpi.x86_64-latest.args | 34 ------- .../misc-acpi.x86_64-latest.xml | 41 -------- tests/qemuxmlconfdata/misc-acpi.xml | 33 ------- .../riscv64-virt-acpi.riscv64-latest.args | 33 +++++++ .../riscv64-virt-acpi.riscv64-latest.xml | 36 +++++++ tests/qemuxmlconfdata/riscv64-virt-acpi.xml | 15 +++ .../s390x-ccw-acpi.s390x-latest.args | 32 +++++++ .../s390x-ccw-acpi.s390x-latest.xml | 27 ++++++ tests/qemuxmlconfdata/s390x-ccw-acpi.xml | 15 +++ .../x86_64-q35-acpi.x86_64-latest.args | 38 ++++++++ .../x86_64-q35-acpi.x86_64-latest.xml | 53 +++++++++++ tests/qemuxmlconfdata/x86_64-q35-acpi.xml | 15 +++ tests/qemuxmlconftest.c | 13 ++- 19 files changed, 461 insertions(+), 109 deletions(-) create mode 100644 tests/qemuxmlconfdata/aarch64-nousb-acpi.aarch64-latest.err create mode 100644 tests/qemuxmlconfdata/aarch64-nousb-acpi.xml create mode 100644 tests/qemuxmlconfdata/loongarch64-virt-acpi.loongarch64-latest.args create mode 100644 tests/qemuxmlconfdata/loongarch64-virt-acpi.loongarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/loongarch64-virt-acpi.xml delete mode 100644 tests/qemuxmlconfdata/misc-acpi.x86_64-latest.args delete mode 100644 tests/qemuxmlconfdata/misc-acpi.x86_64-latest.xml delete mode 100644 tests/qemuxmlconfdata/misc-acpi.xml create mode 100644 tests/qemuxmlconfdata/riscv64-virt-acpi.riscv64-latest.args create mode 100644 tests/qemuxmlconfdata/riscv64-virt-acpi.riscv64-latest.xml create mode 100644 tests/qemuxmlconfdata/riscv64-virt-acpi.xml create mode 100644 tests/qemuxmlconfdata/s390x-ccw-acpi.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390x-ccw-acpi.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390x-ccw-acpi.xml create mode 100644 tests/qemuxmlconfdata/x86_64-q35-acpi.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/x86_64-q35-acpi.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/x86_64-q35-acpi.xml -- 2.45.2

3 11

[PATCH v2 for v10.6.0 0/2] Two pstore related fixes
by Michal Privoznik 31 Jul '24

31 Jul '24

This is a v2 of the following patch: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/PP4W… NB, 1/2 from the original series is pushed already. diff to v1: - adjusted args to ftruncate() - empty line cleanup - new patch 2/2 (thanks Andrea for testing!) Michal Prívozník (2): qemu: Pre-create pstore device file security: Allow RW access to pstore device src/qemu/qemu_process.c | 45 +++++++++++++++++++++++++++++++++ src/security/security_selinux.c | 2 +- 2 files changed, 46 insertions(+), 1 deletion(-) -- 2.44.2

2 3

[PATCH] qemu_domain: tolerate ACPI feature on S390
by Boris Fiuczynski 31 Jul '24

31 Jul '24

Migrations of S390 domains from hosts with QEMU supporting ACPI and a libvirt version prior 9.1.0 fail when the destination host runs a QEMU not supporting ACPI and a libvirt version 9.1.0 or older. Actually S390 never supported ACPI but domains were allowed to have the feature ACPI enabled and it was silently tolerated. To allow migration from libvirt versions prior 9.1.0 which allowed the ACPI feature to be used on S390 tolerate ACPI by setting it to absent if specified and QEMU does not support it. Resolves: https://issues.redhat.com/browse/RHEL-49516 Signed-off-by: Boris Fiuczynski <fiuczy(a)linux.ibm.com> --- src/qemu/qemu_domain.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 198ab99aef..fbc336ac66 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -4499,6 +4499,16 @@ qemuDomainDefEnableDefaultFeatures(virDomainDef *def, * capabilities, we still want to enable this */ def->features[VIR_DOMAIN_FEATURE_GIC] = VIR_TRISTATE_SWITCH_ON; } + + /* To support migration from libvirt versions prio 9.1.0 which allowed + * the ACPI feature to be used on S390 tolerate ACPI by setting it to + * absent if specified and QEMU does not support it */ + if (ARCH_IS_S390(def->os.arch) && + def->features[VIR_DOMAIN_FEATURE_ACPI] != VIR_TRISTATE_SWITCH_ABSENT && + virQEMUCapsMachineSupportsACPI(qemuCaps, def->virtType, def->os.machine) == VIR_TRISTATE_BOOL_NO) { + VIR_DEBUG("Tolerate ACPI on S390 by removing the ACPI feature"); + def->features[VIR_DOMAIN_FEATURE_ACPI] = VIR_TRISTATE_SWITCH_ABSENT; + } } -- 2.45.0

2 1

[PATCH RESEND] crypto: add support for sm4 without key length suffix and remove the restriction about ciper name in xml
by luzhipeng 31 Jul '24

31 Jul '24

qemu add sm4 in release 9, but the name of sm4 doesn't have the key length suffix, So set size to 0, construct cipher name without key length as suffix. In order to support the snapshot of encrypted disks, it remove the restrictions about cipher names in XML Signed-off-by: luzhipeng <luzhipeng(a)cestc.cn> --- docs/formatstorageencryption.rst | 8 +++++--- src/conf/domain_validate.c | 12 ------------ src/qemu/qemu_block.c | 10 +++++++--- 3 files changed, 12 insertions(+), 18 deletions(-) diff --git a/docs/formatstorageencryption.rst b/docs/formatstorageencryption.rst index 066d285090..6cb8cf024c 100644 --- a/docs/formatstorageencryption.rst +++ b/docs/formatstorageencryption.rst @@ -75,11 +75,13 @@ initialization vector generation. ``name`` The name of the cipher algorithm used for data encryption, such as 'aes', - 'des', 'cast5', 'serpent', 'twofish', etc. Support of the specific + 'des', 'cast5', 'serpent', 'twofish', 'sm4', etc. Support of the specific algorithm is storage driver implementation dependent. ``size`` - The size of the cipher in bits, such as '256', '192', '128', etc. Support - of the specific size for a specific cipher is hypervisor dependent. + The size of the cipher in bits, such as '256', '192', '128', '0', etc. + '0' indicates that the encryption algorithm name doesn't have key length + suffix. Support of the specific size for a specific cipher is hypervisor + dependent. ``mode`` An optional cipher algorithm mode such as 'cbc', 'xts', 'ecb', etc. Support of the specific cipher mode is hypervisor dependent. diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c index 39b8d67928..b70edcaaa0 100644 B --- a/src/conf/domain_validate.c +++ b/src/conf/domain_validate.c @@ -529,18 +529,6 @@ virDomainDiskDefValidateSourceChainOne(const virStorageSource *src) } } - if (src->encryption) { - virStorageEncryption *encryption = src->encryption; - - if (encryption->format == VIR_STORAGE_ENCRYPTION_FORMAT_LUKS && - encryption->encinfo.cipher_name) { - - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("supplying <cipher> for domain disk definition is unnecessary")); - return -1; - } - } - /* internal snapshots and config files are currently supported only with rbd: */ if (virStorageSourceGetActualType(src) != VIR_STORAGE_TYPE_NETWORK && src->protocol != VIR_STORAGE_NET_PROTOCOL_RBD) { diff --git a/src/qemu/qemu_block.c b/src/qemu/qemu_block.c index d6cdf521c4..ac55c077e9 100644 --- a/src/qemu/qemu_block.c +++ b/src/qemu/qemu_block.c @@ -2137,9 +2137,13 @@ qemuBlockStorageSourceCreateGetEncryptionLUKS(virStorageSource *src, if (src->encryption) { if (src->encryption->encinfo.cipher_name) { - cipheralg = g_strdup_printf("%s-%u", - src->encryption->encinfo.cipher_name, - src->encryption->encinfo.cipher_size); + if (src->encryption->encinfo.cipher_size) { + cipheralg = g_strdup_printf("%s-%u", + src->encryption->encinfo.cipher_name, + src->encryption->encinfo.cipher_size); + } else { + cipheralg = g_strdup_printf("%s", src->encryption->encinfo.cipher_name); + } } if (virJSONValueObjectAdd(&props, -- 2.34.0.windows.1

1 0

[PATCH] crypto: add support for sm4 without key length suffix and remove the restriction about ciper name in xml
by luzhipeng 31 Jul '24

31 Jul '24

qemu add sm4 in release 9, but the name of sm4 doesn't have the key length suffix, So set size to 0, construct cipher name without key length as suffix. In order to support the snapshot of encrypted disks, it remove the restrictions about cipher names in XML Signed-off-by: luzhipeng <luzhipeng(a)cestc.cn> --- docs/formatstorageencryption.rst | 8 +++++--- src/conf/domain_validate.c | 12 ------------ src/qemu/qemu_block.c | 10 +++++++--- 3 files changed, 12 insertions(+), 18 deletions(-) diff --git a/docs/formatstorageencryption.rst b/docs/formatstorageencryption.rst index 066d285090..6cb8cf024c 100644 --- a/docs/formatstorageencryption.rst +++ b/docs/formatstorageencryption.rst @@ -75,11 +75,13 @@ initialization vector generation. ``name`` The name of the cipher algorithm used for data encryption, such as 'aes', - 'des', 'cast5', 'serpent', 'twofish', etc. Support of the specific + 'des', 'cast5', 'serpent', 'twofish', 'sm4', etc. Support of the specific algorithm is storage driver implementation dependent. ``size`` - The size of the cipher in bits, such as '256', '192', '128', etc. Support - of the specific size for a specific cipher is hypervisor dependent. + The size of the cipher in bits, such as '256', '192', '128', '0', etc. + '0' indicates that the encryption algorithm name doesn't have key length + suffix. Support of the specific size for a specific cipher is hypervisor + dependent. ``mode`` An optional cipher algorithm mode such as 'cbc', 'xts', 'ecb', etc. Support of the specific cipher mode is hypervisor dependent. diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c index 39b8d67928..b70edcaaa0 100644 --- a/src/conf/domain_validate.c +++ b/src/conf/domain_validate.c @@ -529,18 +529,6 @@ virDomainDiskDefValidateSourceChainOne(const virStorageSource *src) } } - if (src->encryption) { - virStorageEncryption *encryption = src->encryption; - - if (encryption->format == VIR_STORAGE_ENCRYPTION_FORMAT_LUKS && - encryption->encinfo.cipher_name) { - - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("supplying <cipher> for domain disk definition is unnecessary")); - return -1; - } - } - /* internal snapshots and config files are currently supported only with rbd: */ if (virStorageSourceGetActualType(src) != VIR_STORAGE_TYPE_NETWORK && src->protocol != VIR_STORAGE_NET_PROTOCOL_RBD) { diff --git a/src/qemu/qemu_block.c b/src/qemu/qemu_block.c index d6cdf521c4..ac55c077e9 100644 --- a/src/qemu/qemu_block.c +++ b/src/qemu/qemu_block.c @@ -2137,9 +2137,13 @@ qemuBlockStorageSourceCreateGetEncryptionLUKS(virStorageSource *src, if (src->encryption) { if (src->encryption->encinfo.cipher_name) { - cipheralg = g_strdup_printf("%s-%u", - src->encryption->encinfo.cipher_name, - src->encryption->encinfo.cipher_size); + if (src->encryption->encinfo.cipher_size) { + cipheralg = g_strdup_printf("%s-%u", + src->encryption->encinfo.cipher_name, + src->encryption->encinfo.cipher_size); + } else { + cipheralg = g_strdup_printf("%s", src->encryption->encinfo.cipher_name) + } } if (virJSONValueObjectAdd(&props, -- 2.34.0.windows.1

1 0