- Devel - libvirt List Archives

[RFC PATCH 0/2] logging: add service to cleanup internal log files
by Nikolay Shirokovskiy 24 Feb '22

24 Feb '22

Hi, all. This is a RFC for cleanup service suggested in [1]. I argumented there that logrotate is not suitable in current form to cooperate with virtlogd and only peform cleanup function. There I thought we need to have file locking for cleanup service to cooperate nicely with virtlogd. In this patch series I used timestamps for that purpuse which seems to be more simple/reliable technique. The idea is to keep logs for active VMs fresh by touching them periodically for the case when log is not actually written for a long time. This is an RFC and so it misses a lot of pieces: - we only need to touch internal log files (and not log files of serial devices for example) - openrc support is missing - spec bits are missing I guess service itself need to be written in C. For a couple of reasons: - not sure if we have a policy not to use shell scripts in deployments (we still have libvirt-guests.sh) - cleaner time complexity in this version is O(N^2). It is not a big deal to write a O(N) version but looks like it will be ugly looking in shell script - I'd like to make at least max age to be configurable parameter in virtlogd.conf. And we have conf parser in C already. As a side note I'm not sure if we should make cleanup invocation period and touching period to be configurable (both are 1 day currently) There is also a need for drivers to add their cleanup paths to cleanup service configuration. I guess we can - add "cleanup_paths = []" to virtlogd.conf - drivers can add conf files to virtlogd.d/. For example qemu drivers will have in virtlogd.d/qemu.conf: cleanup_paths += "/var/log/libvirt/qemu/" On this way we need to support configure directories and += syntax for lists. [1] Re: removing VMs logs https://listman.redhat.com/archives/libvir-list/2022-February/msg00425.html Nikolay Shirokovskiy (2): logging: touch opened files periodically logging: add virtlogcleaner service src/logging/log_handler.c | 113 ++++++++++++++++++++++---- src/logging/meson.build | 15 ++++ src/logging/virtlogcleaner.service.in | 7 ++ src/logging/virtlogcleaner.sh | 9 ++ src/logging/virtlogcleaner.timer | 8 ++ src/logging/virtlogd.service.in | 1 + 6 files changed, 138 insertions(+), 15 deletions(-) create mode 100644 src/logging/virtlogcleaner.service.in create mode 100755 src/logging/virtlogcleaner.sh create mode 100644 src/logging/virtlogcleaner.timer -- 2.31.1

1 2

Virtqemud wants to unlink /dev/urandom
by Nikola Knazekova 24 Feb '22

24 Feb '22

Hi, when I am creating virtual machine on system with new SELinux policy for Libvirt, I am getting this error message: Unable to complete install: 'Unable to create device /dev/urandom: File exists' Traceback (most recent call last): File "/usr/share/virt-manager/virtManager/asyncjob.py", line 65, in cb_wrapper callback(asyncjob, *args, **kwargs) File "/usr/share/virt-manager/virtManager/createvm.py", line 2001, in _do_async_install installer.start_install(guest, meter=meter) File "/usr/share/virt-manager/virtinst/install/installer.py", line 701, in start_install domain = self._create_guest( File "/usr/share/virt-manager/virtinst/install/installer.py", line 649, in _create_guest domain = self.conn.createXML(install_xml or final_xml, 0) File "/usr/lib64/python3.10/site-packages/libvirt.py", line 4393, in createXML raise libvirtError('virDomainCreateXML() failed') libvirt.libvirtError: Unable to create device /dev/urandom: File exists And SELinux denial, where SELinux prevents virtqemud to unlink character device /dev/urandom: time->Wed Feb 23 19:30:33 2022 type=PROCTITLE msg=audit(1645662633.819:930): proctitle=2F7573722F7362696E2F7669727471656D7564002D2D74696D656F757400313230 type=PATH msg=audit(1645662633.819:930): item=1 name="/dev/urandom" inode=6 dev=00:44 mode=020666 ouid=0 ogid=0 rdev=01:09 obj=system_u:object_r:urandom_device_t:s0 nametype=DELETE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(1645662633.819:930): item=0 name="/dev/" inode=1 dev=00:44 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:tmpfs_t:s0 nametype=PARENT cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(1645662633.819:930): cwd="/" type=SYSCALL msg=audit(1645662633.819:930): arch=c000003e syscall=87 success=no exit=-13 a0=7f9418064f50 a1=7f943909c930 a2=7f941d0ef6d4 a3=0 items=2 ppid=6722 pid=7196 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rpc-worker" exe="/usr/sbin/virtqemud" subj=system_u:system_r:virtqemud_t:s0 key=(null) type=AVC msg=audit(1645662633.819:930): avc: denied { unlink } for pid=7196 comm="rpc-worker" name="urandom" dev="tmpfs" ino=6 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file permissive=0 Is this expected behavior? Thanks, Nikola

2 1

[PATCH] tests: don't use auto-generated NVRAM path in tests
by Daniel P. Berrangé 23 Feb '22

23 Feb '22

By using the auto-generated NVRAM path in test data files, we won't see bugs where a user specified path gets accidentally overwritten by a post-parse callback, or VM startup. For example, this caused us to miss the bug fixed by: commit 24adb6c7a6cbd8ce5f9de67e6af5d89e0e57c270 Author: Michal Prívozník <mprivozn(a)redhat.com> Date: Wed Feb 23 08:50:44 2022 +0100 qemu: Don't regenerate NVRAM path if parsed from domain XML Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- tests/qemuxml2argvdata/aarch64-acpi-uefi.args | 2 +- tests/qemuxml2argvdata/aarch64-acpi-uefi.xml | 2 +- tests/qemuxml2argvdata/aarch64-noacpi-uefi.args | 2 +- tests/qemuxml2argvdata/aarch64-noacpi-uefi.xml | 2 +- .../qemuxml2argvdata/aarch64-virt-graphics.aarch64-latest.args | 2 +- tests/qemuxml2argvdata/aarch64-virt-graphics.xml | 2 +- .../qemuxml2argvdata/aarch64-virt-headless.aarch64-latest.args | 2 +- tests/qemuxml2argvdata/aarch64-virt-headless.xml | 2 +- tests/qemuxml2argvdata/bios-nvram-os-interleave.xml | 2 +- tests/qemuxml2argvdata/bios-nvram-secure.args | 2 +- tests/qemuxml2argvdata/bios-nvram-secure.xml | 2 +- tests/qemuxml2argvdata/bios-nvram.args | 2 +- tests/qemuxml2argvdata/bios-nvram.xml | 2 +- tests/qemuxml2argvdata/hvf-aarch64-virt-headless.args | 2 +- tests/qemuxml2argvdata/hvf-aarch64-virt-headless.xml | 2 +- tests/qemuxml2argvdata/os-firmware-bios.xml | 2 +- .../qemuxml2argvdata/os-firmware-efi-secboot.x86_64-latest.args | 2 +- tests/qemuxml2argvdata/os-firmware-efi-secboot.xml | 2 +- tests/qemuxml2argvdata/os-firmware-efi.x86_64-latest.args | 2 +- tests/qemuxml2argvdata/os-firmware-efi.xml | 2 +- tests/qemuxml2argvdata/q35-acpi-uefi.args | 2 +- tests/qemuxml2argvdata/q35-acpi-uefi.xml | 2 +- tests/qemuxml2argvdata/q35-noacpi-uefi.xml | 2 +- .../qemuxml2xmloutdata/aarch64-virt-graphics.aarch64-latest.xml | 2 +- .../qemuxml2xmloutdata/aarch64-virt-headless.aarch64-latest.xml | 2 +- tests/qemuxml2xmloutdata/bios-nvram-os-interleave.xml | 2 +- tests/qemuxml2xmloutdata/bios-nvram.xml | 2 +- tests/qemuxml2xmloutdata/hvf-aarch64-virt-headless.xml | 2 +- tests/qemuxml2xmloutdata/os-firmware-bios.x86_64-latest.xml | 2 +- .../os-firmware-efi-secboot.x86_64-latest.xml | 2 +- tests/qemuxml2xmloutdata/os-firmware-efi.x86_64-latest.xml | 2 +- 31 files changed, 31 insertions(+), 31 deletions(-) diff --git a/tests/qemuxml2argvdata/aarch64-acpi-uefi.args b/tests/qemuxml2argvdata/aarch64-acpi-uefi.args index a92f22744d..21ee68be07 100644 --- a/tests/qemuxml2argvdata/aarch64-acpi-uefi.args +++ b/tests/qemuxml2argvdata/aarch64-acpi-uefi.args @@ -15,7 +15,7 @@ QEMU_AUDIO_DRV=none \ -accel tcg \ -cpu cortex-a57 \ -drive file=/usr/share/AAVMF/AAVMF_CODE.fd,if=pflash,format=raw,unit=0,readonly=on \ --drive file=/var/lib/libvirt/qemu/nvram/guest_VARS.fd,if=pflash,format=raw,unit=1 \ +-drive file=/some/user/nvram/path/guest_VARS.fd,if=pflash,format=raw,unit=1 \ -m 1024 \ -realtime mlock=off \ -smp 1,sockets=1,cores=1,threads=1 \ diff --git a/tests/qemuxml2argvdata/aarch64-acpi-uefi.xml b/tests/qemuxml2argvdata/aarch64-acpi-uefi.xml index 5de2eb5d3c..ef95ba5c17 100644 --- a/tests/qemuxml2argvdata/aarch64-acpi-uefi.xml +++ b/tests/qemuxml2argvdata/aarch64-acpi-uefi.xml @@ -6,7 +6,7 @@ <os> <type arch='aarch64' machine='virt'>hvm</type> <loader readonly='yes' type='pflash'>/usr/share/AAVMF/AAVMF_CODE.fd</loader> - <nvram>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> </os> <features> <acpi/> diff --git a/tests/qemuxml2argvdata/aarch64-noacpi-uefi.args b/tests/qemuxml2argvdata/aarch64-noacpi-uefi.args index 4ffbad8188..4382f0736c 100644 --- a/tests/qemuxml2argvdata/aarch64-noacpi-uefi.args +++ b/tests/qemuxml2argvdata/aarch64-noacpi-uefi.args @@ -15,7 +15,7 @@ QEMU_AUDIO_DRV=none \ -accel tcg \ -cpu cortex-a57 \ -drive file=/usr/share/AAVMF/AAVMF_CODE.fd,if=pflash,format=raw,unit=0,readonly=on \ --drive file=/var/lib/libvirt/qemu/nvram/guest_VARS.fd,if=pflash,format=raw,unit=1 \ +-drive file=/some/user/nvram/path/guest_VARS.fd,if=pflash,format=raw,unit=1 \ -m 1024 \ -realtime mlock=off \ -smp 1,sockets=1,cores=1,threads=1 \ diff --git a/tests/qemuxml2argvdata/aarch64-noacpi-uefi.xml b/tests/qemuxml2argvdata/aarch64-noacpi-uefi.xml index e66b805da4..c36ce824ac 100644 --- a/tests/qemuxml2argvdata/aarch64-noacpi-uefi.xml +++ b/tests/qemuxml2argvdata/aarch64-noacpi-uefi.xml @@ -6,7 +6,7 @@ <os> <type arch='aarch64' machine='virt'>hvm</type> <loader readonly='yes' type='pflash'>/usr/share/AAVMF/AAVMF_CODE.fd</loader> - <nvram>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> </os> <cpu mode='custom'> <model>cortex-a57</model> diff --git a/tests/qemuxml2argvdata/aarch64-virt-graphics.aarch64-latest.args b/tests/qemuxml2argvdata/aarch64-virt-graphics.aarch64-latest.args index 2e311adf33..6604d1e5bd 100644 --- a/tests/qemuxml2argvdata/aarch64-virt-graphics.aarch64-latest.args +++ b/tests/qemuxml2argvdata/aarch64-virt-graphics.aarch64-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-guest/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/tmp/lib/domain--1-guest/master-key.aes"}' \ -blockdev '{"driver":"file","filename":"/usr/share/AAVMF/AAVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ --blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"file","filename":"/some/user/nvram/path/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"raw","file":"libvirt-pflash1-storage"}' \ -machine virt,usb=off,dump-guest-core=off,gic-version=2,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,memory-backend=mach-virt.ram \ -accel tcg \ diff --git a/tests/qemuxml2argvdata/aarch64-virt-graphics.xml b/tests/qemuxml2argvdata/aarch64-virt-graphics.xml index e908d24ac2..b1b5e87c22 100644 --- a/tests/qemuxml2argvdata/aarch64-virt-graphics.xml +++ b/tests/qemuxml2argvdata/aarch64-virt-graphics.xml @@ -12,7 +12,7 @@ <os> <type arch='aarch64' machine='virt'>hvm</type> <loader readonly='yes' type='pflash'>/usr/share/AAVMF/AAVMF_CODE.fd</loader> - <nvram>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxml2argvdata/aarch64-virt-headless.aarch64-latest.args b/tests/qemuxml2argvdata/aarch64-virt-headless.aarch64-latest.args index 3ca8409e35..0f78840cb3 100644 --- a/tests/qemuxml2argvdata/aarch64-virt-headless.aarch64-latest.args +++ b/tests/qemuxml2argvdata/aarch64-virt-headless.aarch64-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-guest/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/tmp/lib/domain--1-guest/master-key.aes"}' \ -blockdev '{"driver":"file","filename":"/usr/share/AAVMF/AAVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ --blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"file","filename":"/some/user/nvram/path/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"raw","file":"libvirt-pflash1-storage"}' \ -machine virt,usb=off,dump-guest-core=off,gic-version=2,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,memory-backend=mach-virt.ram \ -accel tcg \ diff --git a/tests/qemuxml2argvdata/aarch64-virt-headless.xml b/tests/qemuxml2argvdata/aarch64-virt-headless.xml index 7e4fe64b43..27825e9a55 100644 --- a/tests/qemuxml2argvdata/aarch64-virt-headless.xml +++ b/tests/qemuxml2argvdata/aarch64-virt-headless.xml @@ -12,7 +12,7 @@ <os> <type arch='aarch64' machine='virt'>hvm</type> <loader readonly='yes' type='pflash'>/usr/share/AAVMF/AAVMF_CODE.fd</loader> - <nvram>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxml2argvdata/bios-nvram-os-interleave.xml b/tests/qemuxml2argvdata/bios-nvram-os-interleave.xml index 8e2286e519..d6c86c661c 100644 --- a/tests/qemuxml2argvdata/bios-nvram-os-interleave.xml +++ b/tests/qemuxml2argvdata/bios-nvram-os-interleave.xml @@ -6,7 +6,7 @@ <vcpu placement='static'>1</vcpu> <os> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> - <nvram>/usr/share/OVMF/OVMF_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> <type arch='x86_64' machine='pc'>hvm</type> <boot dev='hd'/> <bootmenu enable='yes'/> diff --git a/tests/qemuxml2argvdata/bios-nvram-secure.args b/tests/qemuxml2argvdata/bios-nvram-secure.args index f0799bec3c..e5595d3de7 100644 --- a/tests/qemuxml2argvdata/bios-nvram-secure.args +++ b/tests/qemuxml2argvdata/bios-nvram-secure.args @@ -15,7 +15,7 @@ QEMU_AUDIO_DRV=none \ -accel tcg \ -global driver=cfi.pflash01,property=secure,value=on \ -drive file=/usr/share/OVMF/OVMF_CODE.secboot.fd,if=pflash,format=raw,unit=0,readonly=on \ --drive file=/usr/share/OVMF/OVMF_VARS.fd,if=pflash,format=raw,unit=1 \ +-drive file=/some/user/nvram/path/guest_VARS.fd,if=pflash,format=raw,unit=1 \ -m 1024 \ -realtime mlock=off \ -smp 1,sockets=1,cores=1,threads=1 \ diff --git a/tests/qemuxml2argvdata/bios-nvram-secure.xml b/tests/qemuxml2argvdata/bios-nvram-secure.xml index 0788bb9b03..fb5ca4c48d 100644 --- a/tests/qemuxml2argvdata/bios-nvram-secure.xml +++ b/tests/qemuxml2argvdata/bios-nvram-secure.xml @@ -7,7 +7,7 @@ <os> <type arch='x86_64' machine='q35'>hvm</type> <loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader> - <nvram>/usr/share/OVMF/OVMF_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> <boot dev='hd'/> <bootmenu enable='yes'/> </os> diff --git a/tests/qemuxml2argvdata/bios-nvram.args b/tests/qemuxml2argvdata/bios-nvram.args index bfbe29a63e..e5f4e2bc4c 100644 --- a/tests/qemuxml2argvdata/bios-nvram.args +++ b/tests/qemuxml2argvdata/bios-nvram.args @@ -14,7 +14,7 @@ QEMU_AUDIO_DRV=none \ -machine pc,usb=off,dump-guest-core=off \ -accel tcg \ -drive file=/usr/share/OVMF/OVMF_CODE.fd,if=pflash,format=raw,unit=0,readonly=on \ --drive file=/usr/share/OVMF/OVMF_VARS.fd,if=pflash,format=raw,unit=1 \ +-drive file=/some/user/nvram/path/guest_VARS.fd,if=pflash,format=raw,unit=1 \ -m 1024 \ -realtime mlock=off \ -smp 1,sockets=1,cores=1,threads=1 \ diff --git a/tests/qemuxml2argvdata/bios-nvram.xml b/tests/qemuxml2argvdata/bios-nvram.xml index 9cc7853e48..329d510e95 100644 --- a/tests/qemuxml2argvdata/bios-nvram.xml +++ b/tests/qemuxml2argvdata/bios-nvram.xml @@ -7,7 +7,7 @@ <os> <type arch='x86_64' machine='pc'>hvm</type> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> - <nvram>/usr/share/OVMF/OVMF_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> <boot dev='hd'/> <bootmenu enable='yes'/> </os> diff --git a/tests/qemuxml2argvdata/hvf-aarch64-virt-headless.args b/tests/qemuxml2argvdata/hvf-aarch64-virt-headless.args index 0f1eed66c2..840ece3893 100644 --- a/tests/qemuxml2argvdata/hvf-aarch64-virt-headless.args +++ b/tests/qemuxml2argvdata/hvf-aarch64-virt-headless.args @@ -14,7 +14,7 @@ QEMU_AUDIO_DRV=none \ -machine virt,usb=off,dump-guest-core=off,gic-version=2 \ -accel hvf \ -drive file=/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.raw,if=pflash,format=raw,unit=0,readonly=on \ --drive file=/var/lib/libvirt/qemu/nvram/test_VARS.fd,if=pflash,format=raw,unit=1 \ +-drive file=/some/user/nvram/path/guest_VARS.fd,if=pflash,format=raw,unit=1 \ -m 4096 \ -realtime mlock=off \ -smp 2,sockets=2,cores=1,threads=1 \ diff --git a/tests/qemuxml2argvdata/hvf-aarch64-virt-headless.xml b/tests/qemuxml2argvdata/hvf-aarch64-virt-headless.xml index ef13820e17..01997b9731 100644 --- a/tests/qemuxml2argvdata/hvf-aarch64-virt-headless.xml +++ b/tests/qemuxml2argvdata/hvf-aarch64-virt-headless.xml @@ -7,7 +7,7 @@ <os> <type arch='aarch64' machine='virt'>hvm</type> <loader readonly='yes' type='pflash'>/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.raw</loader> - <nvram>/var/lib/libvirt/qemu/nvram/test_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxml2argvdata/os-firmware-bios.xml b/tests/qemuxml2argvdata/os-firmware-bios.xml index 63886666dd..18ceafa948 100644 --- a/tests/qemuxml2argvdata/os-firmware-bios.xml +++ b/tests/qemuxml2argvdata/os-firmware-bios.xml @@ -7,7 +7,7 @@ <os firmware='bios'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> <loader secure='no'/> - <nvram>/var/lib/libvirt/qemu/nvram/fedora_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> <boot dev='hd'/> <bootmenu enable='yes'/> </os> diff --git a/tests/qemuxml2argvdata/os-firmware-efi-secboot.x86_64-latest.args b/tests/qemuxml2argvdata/os-firmware-efi-secboot.x86_64-latest.args index fdbf8deabe..1bf6ec65bd 100644 --- a/tests/qemuxml2argvdata/os-firmware-efi-secboot.x86_64-latest.args +++ b/tests/qemuxml2argvdata/os-firmware-efi-secboot.x86_64-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-fedora/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/tmp/lib/domain--1-fedora/master-key.aes"}' \ -blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ --blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/fedora_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"file","filename":"/some/user/nvram/path/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"raw","file":"libvirt-pflash1-storage"}' \ -machine pc-q35-4.0,usb=off,smm=on,dump-guest-core=off,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,memory-backend=pc.ram \ -accel kvm \ diff --git a/tests/qemuxml2argvdata/os-firmware-efi-secboot.xml b/tests/qemuxml2argvdata/os-firmware-efi-secboot.xml index a285e06334..67c93fdbb9 100644 --- a/tests/qemuxml2argvdata/os-firmware-efi-secboot.xml +++ b/tests/qemuxml2argvdata/os-firmware-efi-secboot.xml @@ -7,7 +7,7 @@ <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> <loader secure='yes'/> - <nvram>/var/lib/libvirt/qemu/nvram/fedora_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> <boot dev='hd'/> <bootmenu enable='yes'/> </os> diff --git a/tests/qemuxml2argvdata/os-firmware-efi.x86_64-latest.args b/tests/qemuxml2argvdata/os-firmware-efi.x86_64-latest.args index 470fe31256..16eb08078c 100644 --- a/tests/qemuxml2argvdata/os-firmware-efi.x86_64-latest.args +++ b/tests/qemuxml2argvdata/os-firmware-efi.x86_64-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-fedora/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/tmp/lib/domain--1-fedora/master-key.aes"}' \ -blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ --blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/fedora_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"file","filename":"/some/user/nvram/path/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"raw","file":"libvirt-pflash1-storage"}' \ -machine pc-q35-4.0,usb=off,smm=on,dump-guest-core=off,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,memory-backend=pc.ram \ -accel kvm \ diff --git a/tests/qemuxml2argvdata/os-firmware-efi.xml b/tests/qemuxml2argvdata/os-firmware-efi.xml index 46a7b1b780..8109e227c0 100644 --- a/tests/qemuxml2argvdata/os-firmware-efi.xml +++ b/tests/qemuxml2argvdata/os-firmware-efi.xml @@ -7,7 +7,7 @@ <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> <loader secure='no'/> - <nvram>/var/lib/libvirt/qemu/nvram/fedora_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> <boot dev='hd'/> <bootmenu enable='yes'/> </os> diff --git a/tests/qemuxml2argvdata/q35-acpi-uefi.args b/tests/qemuxml2argvdata/q35-acpi-uefi.args index 60da1e282a..52d902612b 100644 --- a/tests/qemuxml2argvdata/q35-acpi-uefi.args +++ b/tests/qemuxml2argvdata/q35-acpi-uefi.args @@ -15,7 +15,7 @@ QEMU_AUDIO_DRV=none \ -accel tcg \ -cpu Haswell \ -drive file=/usr/share/OVMF/OVMF_CODE.fd,if=pflash,format=raw,unit=0,readonly=on \ --drive file=/var/lib/libvirt/qemu/nvram/guest_VARS.fd,if=pflash,format=raw,unit=1 \ +-drive file=/some/user/nvram/path/guest_VARS.fd,if=pflash,format=raw,unit=1 \ -m 1024 \ -realtime mlock=off \ -smp 1,sockets=1,cores=1,threads=1 \ diff --git a/tests/qemuxml2argvdata/q35-acpi-uefi.xml b/tests/qemuxml2argvdata/q35-acpi-uefi.xml index 4eb5a466e9..7e3fa48e9d 100644 --- a/tests/qemuxml2argvdata/q35-acpi-uefi.xml +++ b/tests/qemuxml2argvdata/q35-acpi-uefi.xml @@ -6,7 +6,7 @@ <os> <type arch='x86_64' machine='q35'>hvm</type> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> - <nvram>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> </os> <features> <acpi/> diff --git a/tests/qemuxml2argvdata/q35-noacpi-uefi.xml b/tests/qemuxml2argvdata/q35-noacpi-uefi.xml index 91c83c808c..4e4d6fa3d1 100644 --- a/tests/qemuxml2argvdata/q35-noacpi-uefi.xml +++ b/tests/qemuxml2argvdata/q35-noacpi-uefi.xml @@ -6,7 +6,7 @@ <os> <type arch='x86_64' machine='q35'>hvm</type> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> - <nvram>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> </os> <cpu mode='custom'> <model>Haswell</model> diff --git a/tests/qemuxml2xmloutdata/aarch64-virt-graphics.aarch64-latest.xml b/tests/qemuxml2xmloutdata/aarch64-virt-graphics.aarch64-latest.xml index a3571c62d7..b4e7e0a944 100644 --- a/tests/qemuxml2xmloutdata/aarch64-virt-graphics.aarch64-latest.xml +++ b/tests/qemuxml2xmloutdata/aarch64-virt-graphics.aarch64-latest.xml @@ -12,7 +12,7 @@ <os> <type arch='aarch64' machine='virt'>hvm</type> <loader readonly='yes' type='pflash'>/usr/share/AAVMF/AAVMF_CODE.fd</loader> - <nvram>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxml2xmloutdata/aarch64-virt-headless.aarch64-latest.xml b/tests/qemuxml2xmloutdata/aarch64-virt-headless.aarch64-latest.xml index 4f1e9cc18b..3a7961df10 100644 --- a/tests/qemuxml2xmloutdata/aarch64-virt-headless.aarch64-latest.xml +++ b/tests/qemuxml2xmloutdata/aarch64-virt-headless.aarch64-latest.xml @@ -12,7 +12,7 @@ <os> <type arch='aarch64' machine='virt'>hvm</type> <loader readonly='yes' type='pflash'>/usr/share/AAVMF/AAVMF_CODE.fd</loader> - <nvram>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxml2xmloutdata/bios-nvram-os-interleave.xml b/tests/qemuxml2xmloutdata/bios-nvram-os-interleave.xml index 0a2f718faa..6a40866b0b 100644 --- a/tests/qemuxml2xmloutdata/bios-nvram-os-interleave.xml +++ b/tests/qemuxml2xmloutdata/bios-nvram-os-interleave.xml @@ -7,7 +7,7 @@ <os> <type arch='x86_64' machine='pc'>hvm</type> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> - <nvram>/usr/share/OVMF/OVMF_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> <boot dev='hd'/> <bootmenu enable='yes'/> </os> diff --git a/tests/qemuxml2xmloutdata/bios-nvram.xml b/tests/qemuxml2xmloutdata/bios-nvram.xml index 17f15fd00b..7049f5e9c5 100644 --- a/tests/qemuxml2xmloutdata/bios-nvram.xml +++ b/tests/qemuxml2xmloutdata/bios-nvram.xml @@ -7,7 +7,7 @@ <os> <type arch='x86_64' machine='pc'>hvm</type> <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader> - <nvram>/usr/share/OVMF/OVMF_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> <boot dev='hd'/> <bootmenu enable='yes'/> </os> diff --git a/tests/qemuxml2xmloutdata/hvf-aarch64-virt-headless.xml b/tests/qemuxml2xmloutdata/hvf-aarch64-virt-headless.xml index b5193a02b4..16e8c23a79 100644 --- a/tests/qemuxml2xmloutdata/hvf-aarch64-virt-headless.xml +++ b/tests/qemuxml2xmloutdata/hvf-aarch64-virt-headless.xml @@ -7,7 +7,7 @@ <os> <type arch='aarch64' machine='virt'>hvm</type> <loader readonly='yes' type='pflash'>/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.raw</loader> - <nvram>/var/lib/libvirt/qemu/nvram/test_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> <boot dev='hd'/> </os> <features> diff --git a/tests/qemuxml2xmloutdata/os-firmware-bios.x86_64-latest.xml b/tests/qemuxml2xmloutdata/os-firmware-bios.x86_64-latest.xml index df6f61421a..e6704fb7de 100644 --- a/tests/qemuxml2xmloutdata/os-firmware-bios.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/os-firmware-bios.x86_64-latest.xml @@ -7,7 +7,7 @@ <os firmware='bios'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> <loader secure='no'/> - <nvram>/var/lib/libvirt/qemu/nvram/fedora_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> <boot dev='hd'/> <bootmenu enable='yes'/> </os> diff --git a/tests/qemuxml2xmloutdata/os-firmware-efi-secboot.x86_64-latest.xml b/tests/qemuxml2xmloutdata/os-firmware-efi-secboot.x86_64-latest.xml index c383546cc6..35ee0a61b0 100644 --- a/tests/qemuxml2xmloutdata/os-firmware-efi-secboot.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/os-firmware-efi-secboot.x86_64-latest.xml @@ -7,7 +7,7 @@ <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> <loader secure='yes'/> - <nvram>/var/lib/libvirt/qemu/nvram/fedora_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> <boot dev='hd'/> <bootmenu enable='yes'/> </os> diff --git a/tests/qemuxml2xmloutdata/os-firmware-efi.x86_64-latest.xml b/tests/qemuxml2xmloutdata/os-firmware-efi.x86_64-latest.xml index 04d57860e7..ca323482f8 100644 --- a/tests/qemuxml2xmloutdata/os-firmware-efi.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/os-firmware-efi.x86_64-latest.xml @@ -7,7 +7,7 @@ <os firmware='efi'> <type arch='x86_64' machine='pc-q35-4.0'>hvm</type> <loader secure='no'/> - <nvram>/var/lib/libvirt/qemu/nvram/fedora_VARS.fd</nvram> + <nvram>/some/user/nvram/path/guest_VARS.fd</nvram> <boot dev='hd'/> <bootmenu enable='yes'/> </os> -- 2.34.1

2 1

[PATCH] qemu: honour user's nvram path when undefining VM
by Daniel P. Berrangé 23 Feb '22

23 Feb '22

When undefining a VM, we must optionally delete any NVRAM that might exist. When using firmware auto-select we always check the generated path, ignoring any user specified path. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/qemu/qemu_driver.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index e417d358cd..b74b0375a7 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6615,11 +6615,10 @@ qemuDomainUndefineFlags(virDomainPtr dom, } } - if (vm->def->os.firmware == VIR_DOMAIN_OS_DEF_FIRMWARE_EFI) { + if (vm->def->os.loader->nvram) { + nvram_path = g_strdup(vm->def->os.loader->nvram); + } else if (vm->def->os.firmware == VIR_DOMAIN_OS_DEF_FIRMWARE_EFI) { qemuDomainNVRAMPathFormat(cfg, vm->def, &nvram_path); - } else { - if (vm->def->os.loader) - nvram_path = g_strdup(vm->def->os.loader->nvram); } if (nvram_path && virFileExists(nvram_path)) { -- 2.34.1

2 1

[libvirt PATCH] qemu: support parsing firmware descriptor flash 'mode' for optional NVRAM
by Daniel P. Berrangé 23 Feb '22

23 Feb '22

Currently the 'nvram_template' entry is mandatory when parsing the firmware descriptor based on flash. QEMU is extending the firmware descriptor spec to make the 'nvram_template' optional, depending on the value of a new 'mode' field: - "split" * "executable" contains read-only CODE * "nvram_template" contains read-write VARS - "combined" * "executable" contains read-write CODE and VARs * "nvram_template" not present, as the "executable" is effectively the template on its own - "stateless" * "executable" contains read-only CODE and VARs * "nvram_template" not present In the latter case, the guest OS can write vars but the firmware will make no attempt to persist them, so any changes will be lost at poweroff. For now we parse this new 'mode' but discard any firmware which is not 'mode=split' when matching for a domain. This is the minimum required to have libvirt not break when seeing the new firmware descriptors. Future changes will support the new modes. In the tests we have a mixture of files with and without the mode attribute. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/qemu/qemu_firmware.c | 79 ++++++++++++++++--- .../share/qemu/firmware/50-ovmf-sb-keys.json | 33 ++++++++ .../out/usr/share/qemu/firmware/61-ovmf.json | 31 ++++++++ .../out/usr/share/qemu/firmware/70-aavmf.json | 28 +++++++ .../qemu/firmware/45-ovmf-sev-stateless.json | 31 ++++++++ .../qemu/firmware/55-ovmf-sb-combined.json | 33 ++++++++ .../usr/share/qemu/firmware/60-ovmf-sb.json | 1 + tests/qemufirmwaretest.c | 31 ++++++-- 8 files changed, 246 insertions(+), 21 deletions(-) create mode 100644 tests/qemufirmwaredata/out/usr/share/qemu/firmware/50-ovmf-sb-keys.json create mode 100644 tests/qemufirmwaredata/out/usr/share/qemu/firmware/61-ovmf.json create mode 100644 tests/qemufirmwaredata/out/usr/share/qemu/firmware/70-aavmf.json create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/45-ovmf-sev-stateless.json create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/55-ovmf-sb-combined.json diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index ff364996b8..e403ee98e4 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -59,6 +59,22 @@ VIR_ENUM_IMPL(qemuFirmwareOSInterface, ); +typedef enum { + QEMU_FIRMWARE_FLASH_MODE_SPLIT, + QEMU_FIRMWARE_FLASH_MODE_COMBINED, + QEMU_FIRMWARE_FLASH_MODE_STATELESS, + + QEMU_FIRMWARE_FLASH_MODE_LAST, +} qemuFirmwareFlashMode; + +VIR_ENUM_DECL(qemuFirmwareFlashMode); +VIR_ENUM_IMPL(qemuFirmwareFlashMode, + QEMU_FIRMWARE_FLASH_MODE_LAST, + "split", + "combined", + "stateless", +); + typedef struct _qemuFirmwareFlashFile qemuFirmwareFlashFile; struct _qemuFirmwareFlashFile { char *filename; @@ -68,6 +84,7 @@ struct _qemuFirmwareFlashFile { typedef struct _qemuFirmwareMappingFlash qemuFirmwareMappingFlash; struct _qemuFirmwareMappingFlash { + qemuFirmwareFlashMode mode; qemuFirmwareFlashFile executable; qemuFirmwareFlashFile nvram_template; }; @@ -359,9 +376,31 @@ qemuFirmwareMappingFlashParse(const char *path, virJSONValue *doc, qemuFirmwareMappingFlash *flash) { + virJSONValue *mode; virJSONValue *executable; virJSONValue *nvram_template; + if (!(mode = virJSONValueObjectGet(doc, "mode"))) { + /* Historical default */ + flash->mode = QEMU_FIRMWARE_FLASH_MODE_SPLIT; + } else { + const char *modestr = virJSONValueGetString(mode); + int modeval; + if (!modestr) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Firmware flash mode value was malformed")); + return -1; + } + modeval = qemuFirmwareFlashModeTypeFromString(modestr); + if (modeval < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Firmware flash mode value '%s' unexpected"), + modestr); + return -1; + } + flash->mode = modeval; + } + if (!(executable = virJSONValueObjectGet(doc, "executable"))) { virReportError(VIR_ERR_INTERNAL_ERROR, _("missing 'executable' in '%s'"), @@ -372,15 +411,17 @@ qemuFirmwareMappingFlashParse(const char *path, if (qemuFirmwareFlashFileParse(path, executable, &flash->executable) < 0) return -1; - if (!(nvram_template = virJSONValueObjectGet(doc, "nvram-template"))) { - virReportError(VIR_ERR_INTERNAL_ERROR, - _("missing 'nvram-template' in '%s'"), - path); - return -1; - } + if (flash->mode == QEMU_FIRMWARE_FLASH_MODE_SPLIT) { + if (!(nvram_template = virJSONValueObjectGet(doc, "nvram-template"))) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("missing 'nvram-template' in '%s'"), + path); + return -1; + } - if (qemuFirmwareFlashFileParse(path, nvram_template, &flash->nvram_template) < 0) - return -1; + if (qemuFirmwareFlashFileParse(path, nvram_template, &flash->nvram_template) < 0) + return -1; + } return 0; } @@ -693,10 +734,12 @@ qemuFirmwareMappingFlashFormat(virJSONValue *mapping, g_autoptr(virJSONValue) executable = NULL; g_autoptr(virJSONValue) nvram_template = NULL; - if (!(executable = qemuFirmwareFlashFileFormat(flash->executable))) + if (virJSONValueObjectAppendString(mapping, + "mode", + qemuFirmwareFlashModeTypeToString(flash->mode)) < 0) return -1; - if (!(nvram_template = qemuFirmwareFlashFileFormat(flash->nvram_template))) + if (!(executable = qemuFirmwareFlashFileFormat(flash->executable))) return -1; if (virJSONValueObjectAppend(mapping, @@ -704,11 +747,15 @@ qemuFirmwareMappingFlashFormat(virJSONValue *mapping, &executable) < 0) return -1; + if (flash->mode == QEMU_FIRMWARE_FLASH_MODE_SPLIT) { + if (!(nvram_template = qemuFirmwareFlashFileFormat(flash->nvram_template))) + return -1; - if (virJSONValueObjectAppend(mapping, + if (virJSONValueObjectAppend(mapping, "nvram-template", - &nvram_template) < 0) - return -1; + &nvram_template) < 0) + return -1; + } return 0; } @@ -1070,6 +1117,12 @@ qemuFirmwareMatchDomain(const virDomainDef *def, return false; } + if (fw->mapping.device == QEMU_FIRMWARE_DEVICE_FLASH && + fw->mapping.data.flash.mode != QEMU_FIRMWARE_FLASH_MODE_SPLIT) { + VIR_DEBUG("Discarding loader without split flash"); + return false; + } + if (def->sec) { switch ((virDomainLaunchSecurity) def->sec->sectype) { case VIR_DOMAIN_LAUNCH_SECURITY_SEV: diff --git a/tests/qemufirmwaredata/out/usr/share/qemu/firmware/50-ovmf-sb-keys.json b/tests/qemufirmwaredata/out/usr/share/qemu/firmware/50-ovmf-sb-keys.json new file mode 100644 index 0000000000..c251682cd9 --- /dev/null +++ b/tests/qemufirmwaredata/out/usr/share/qemu/firmware/50-ovmf-sb-keys.json @@ -0,0 +1,33 @@ +{ + "interface-types": [ + "uefi" + ], + "mapping": { + "device": "flash", + "mode": "split", + "executable": { + "filename": "/usr/share/OVMF/OVMF_CODE.secboot.fd", + "format": "raw" + }, + "nvram-template": { + "filename": "/usr/share/OVMF/OVMF_VARS.secboot.fd", + "format": "raw" + } + }, + "targets": [ + { + "architecture": "x86_64", + "machines": [ + "pc-q35-*" + ] + } + ], + "features": [ + "acpi-s3", + "amd-sev", + "enrolled-keys", + "requires-smm", + "secure-boot", + "verbose-dynamic" + ] +} diff --git a/tests/qemufirmwaredata/out/usr/share/qemu/firmware/61-ovmf.json b/tests/qemufirmwaredata/out/usr/share/qemu/firmware/61-ovmf.json new file mode 100644 index 0000000000..2a9aa23efb --- /dev/null +++ b/tests/qemufirmwaredata/out/usr/share/qemu/firmware/61-ovmf.json @@ -0,0 +1,31 @@ +{ + "interface-types": [ + "uefi" + ], + "mapping": { + "device": "flash", + "mode": "split", + "executable": { + "filename": "/usr/share/OVMF/OVMF_CODE.fd", + "format": "raw" + }, + "nvram-template": { + "filename": "/usr/share/OVMF/OVMF_VARS.fd", + "format": "raw" + } + }, + "targets": [ + { + "architecture": "x86_64", + "machines": [ + "pc-i440fx-*", + "pc-q35-*" + ] + } + ], + "features": [ + "acpi-s3", + "amd-sev", + "verbose-dynamic" + ] +} diff --git a/tests/qemufirmwaredata/out/usr/share/qemu/firmware/70-aavmf.json b/tests/qemufirmwaredata/out/usr/share/qemu/firmware/70-aavmf.json new file mode 100644 index 0000000000..9bd5ac2868 --- /dev/null +++ b/tests/qemufirmwaredata/out/usr/share/qemu/firmware/70-aavmf.json @@ -0,0 +1,28 @@ +{ + "interface-types": [ + "uefi" + ], + "mapping": { + "device": "flash", + "mode": "split", + "executable": { + "filename": "/usr/share/AAVMF/AAVMF_CODE.fd", + "format": "raw" + }, + "nvram-template": { + "filename": "/usr/share/AAVMF/AAVMF_VARS.fd", + "format": "raw" + } + }, + "targets": [ + { + "architecture": "aarch64", + "machines": [ + "virt-*" + ] + } + ], + "features": [ + + ] +} diff --git a/tests/qemufirmwaredata/usr/share/qemu/firmware/45-ovmf-sev-stateless.json b/tests/qemufirmwaredata/usr/share/qemu/firmware/45-ovmf-sev-stateless.json new file mode 100644 index 0000000000..5a619f3ab0 --- /dev/null +++ b/tests/qemufirmwaredata/usr/share/qemu/firmware/45-ovmf-sev-stateless.json @@ -0,0 +1,31 @@ +{ + "description": "OVMF for x86_64, with SEV, without SB, without SMM, with NO varstore", + "interface-types": [ + "uefi" + ], + "mapping": { + "device": "flash", + "mode": "stateless", + "executable": { + "filename": "/usr/share/OVMF/OVMF.sev.fd", + "format": "raw" + } + }, + "targets": [ + { + "architecture": "x86_64", + "machines": [ + "pc-q35-*" + ] + } + ], + "features": [ + "acpi-s3", + "amd-sev", + "amd-sev-es", + "verbose-dynamic" + ], + "tags": [ + + ] +} diff --git a/tests/qemufirmwaredata/usr/share/qemu/firmware/55-ovmf-sb-combined.json b/tests/qemufirmwaredata/usr/share/qemu/firmware/55-ovmf-sb-combined.json new file mode 100644 index 0000000000..eb3332e4ab --- /dev/null +++ b/tests/qemufirmwaredata/usr/share/qemu/firmware/55-ovmf-sb-combined.json @@ -0,0 +1,33 @@ +{ + "description": "OVMF with SB+SMM, SB enabled, MS certs enrolled", + "interface-types": [ + "uefi" + ], + "mapping": { + "device": "flash", + "mode": "combined", + "executable": { + "filename": "/usr/share/OVMF/OVMF.secboot.fd", + "format": "raw" + } + }, + "targets": [ + { + "architecture": "x86_64", + "machines": [ + "pc-q35-*" + ] + } + ], + "features": [ + "acpi-s3", + "amd-sev", + "enrolled-keys", + "requires-smm", + "secure-boot", + "verbose-dynamic" + ], + "tags": [ + + ] +} diff --git a/tests/qemufirmwaredata/usr/share/qemu/firmware/60-ovmf-sb.json b/tests/qemufirmwaredata/usr/share/qemu/firmware/60-ovmf-sb.json index 5e8a94ae78..a5273a5e8b 100644 --- a/tests/qemufirmwaredata/usr/share/qemu/firmware/60-ovmf-sb.json +++ b/tests/qemufirmwaredata/usr/share/qemu/firmware/60-ovmf-sb.json @@ -5,6 +5,7 @@ ], "mapping": { "device": "flash", + "mode": "split", "executable": { "filename": "/usr/share/OVMF/OVMF_CODE.secboot.fd", "format": "raw" diff --git a/tests/qemufirmwaretest.c b/tests/qemufirmwaretest.c index cad4b6d383..fc3416b2ae 100644 --- a/tests/qemufirmwaretest.c +++ b/tests/qemufirmwaretest.c @@ -17,22 +17,31 @@ static int testParseFormatFW(const void *opaque) { const char *filename = opaque; - g_autofree char *path = NULL; + g_autofree char *inpath = NULL; + g_autofree char *outpath = NULL; g_autoptr(qemuFirmware) fw = NULL; - g_autofree char *buf = NULL; g_autoptr(virJSONValue) json = NULL; g_autofree char *expected = NULL; g_autofree char *actual = NULL; + g_autofree char *buf = NULL; - path = g_strdup_printf("%s/qemufirmwaredata/%s", abs_srcdir, filename); + inpath = g_strdup_printf("%s/qemufirmwaredata/%s", abs_srcdir, filename); + outpath = g_strdup_printf("%s/qemufirmwaredata/out/%s", abs_srcdir, filename); - if (!(fw = qemuFirmwareParse(path))) + if (!(fw = qemuFirmwareParse(inpath))) return -1; - if (virFileReadAll(path, - 1024 * 1024, /* 1MiB */ - &buf) < 0) - return -1; + if (virFileExists(outpath)) { + if (virFileReadAll(outpath, + 1024 * 1024, /* 1MiB */ + &buf) < 0) + return -1; + } else { + if (virFileReadAll(inpath, + 1024 * 1024, /* 1MiB */ + &buf) < 0) + return -1; + } if (!(json = virJSONValueFromString(buf))) return -1; @@ -60,7 +69,9 @@ testFWPrecedence(const void *opaque G_GNUC_UNUSED) const char *expected[] = { PREFIX "/share/qemu/firmware/40-bios.json", SYSCONFDIR "/qemu/firmware/40-ovmf-sb-keys.json", + PREFIX "/share/qemu/firmware/45-ovmf-sev-stateless.json", PREFIX "/share/qemu/firmware/50-ovmf-sb-keys.json", + PREFIX "/share/qemu/firmware/55-ovmf-sb-combined.json", PREFIX "/share/qemu/firmware/61-ovmf.json", PREFIX "/share/qemu/firmware/70-aavmf.json", NULL @@ -218,7 +229,9 @@ mymain(void) } while (0) DO_PARSE_TEST("usr/share/qemu/firmware/40-bios.json"); + DO_PARSE_TEST("usr/share/qemu/firmware/45-ovmf-sev-stateless.json"); DO_PARSE_TEST("usr/share/qemu/firmware/50-ovmf-sb-keys.json"); + DO_PARSE_TEST("usr/share/qemu/firmware/55-ovmf-sb-combined.json"); DO_PARSE_TEST("usr/share/qemu/firmware/60-ovmf-sb.json"); DO_PARSE_TEST("usr/share/qemu/firmware/61-ovmf.json"); DO_PARSE_TEST("usr/share/qemu/firmware/70-aavmf.json"); @@ -250,6 +263,8 @@ mymain(void) DO_SUPPORTED_TEST("pc-q35-3.1", VIR_ARCH_X86_64, true, "/usr/share/seabios/bios-256k.bin:NULL:" "/usr/share/OVMF/OVMF_CODE.secboot.fd:/usr/share/OVMF/OVMF_VARS.secboot.fd:" + "/usr/share/OVMF/OVMF.sev.fd:NULL:" + "/usr/share/OVMF/OVMF.secboot.fd:NULL:" "/usr/share/OVMF/OVMF_CODE.fd:/usr/share/OVMF/OVMF_VARS.fd", VIR_DOMAIN_OS_DEF_FIRMWARE_BIOS, VIR_DOMAIN_OS_DEF_FIRMWARE_EFI); -- 2.34.1

2 2

[PATCH] qemu: block copy: Propagate 'detect_zeroes' properly into mirror definition
by Peter Krempa 23 Feb '22

23 Feb '22

'qemuDomainPrepareDiskSourceData' propagates 'detect_zeroes' only for the disk source image, but the mirror destination has the ambition to replace the disk source when the job is finished, so we need to propagate the 'detect_zeroes' setting also in that case. Unfortunately it would become very hairy to either set 'disk->mirror' sooner or propagate that we want this done into 'qemuDomainPrepareDiskSourceData', so the most straightforward solution is to do the propagation inside 'qemuDomainBlockCopyCommon'. Closes: https://gitlab.com/libvirt/libvirt/-/issues/277 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_driver.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index e417d358cd..4fc998cde5 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -14977,6 +14977,14 @@ qemuDomainBlockCopyCommon(virDomainObj *vm, if (qemuDomainPrepareStorageSourceBlockdev(disk, n, priv, cfg) < 0) goto endjob; } + + /* 'qemuDomainPrepareStorageSourceBlockdev' calls + * 'qemuDomainPrepareDiskSourceData' which propagates 'detect_zeroes' + * into the topmost virStorage source of the disk chain. + * Since 'mirror' has the ambition to replace it we need to propagate + * it into the mirror too. We do it directly as otherwise we'd need + * to modify all callers of 'qemuDomainPrepareStorageSourceBlockdev' */ + mirror->detect_zeroes = disk->detect_zeroes; } /* If reusing an external image that includes a backing file but the user -- 2.35.1

2 1

[PATCH] qemu: blockjob: Avoid spurious log errors when cancelling a shallow copy with reused images
by Peter Krempa 23 Feb '22

23 Feb '22

In case when a user starts a block copy operation with VIR_DOMAIN_BLOCK_COPY_SHALLOW and VIR_DOMAIN_BLOCK_COPY_REUSE_EXT and both the reused image and the original disk have a backing image libvirt specifically does not insert the backing image until after the job is asked to be completed via virBlockJobAbort with VIR_DOMAIN_BLOCK_JOB_ABORT_PIVOT. This is so that management applications can copy the backing image on the background. Now when a user aborts the block job instead of cancelling it we'd ignore the fact that we didn't insert the backing image yet and the cancellation would result into a 'blockdev-del' of a invalid node name and thus an 'error' severity entry in the log. To solve this issue we use the same conditions when the backing image addition is avoided to remove the internal state for them prior to the call to unplug the mirror destination. Reported-by: Kashyap Chamarthy <kchamart(a)redhat.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_blockjob.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/src/qemu/qemu_blockjob.c b/src/qemu/qemu_blockjob.c index 726df95067..2442865b9b 100644 --- a/src/qemu/qemu_blockjob.c +++ b/src/qemu/qemu_blockjob.c @@ -1406,6 +1406,8 @@ qemuBlockJobProcessEventConcludedCopyAbort(virQEMUDriver *driver, qemuBlockJobData *job, qemuDomainAsyncJob asyncJob) { + qemuDomainObjPrivate *priv = vm->privateData; + VIR_DEBUG("copy job '%s' on VM '%s' aborted", job->name, vm->def->name); /* mirror may be NULL for copy job corresponding to migration */ @@ -1413,6 +1415,21 @@ qemuBlockJobProcessEventConcludedCopyAbort(virQEMUDriver *driver, !job->disk->mirror) return; + if (!job->jobflagsmissing) { + bool shallow = job->jobflags & VIR_DOMAIN_BLOCK_COPY_SHALLOW; + bool reuse = job->jobflags & VIR_DOMAIN_BLOCK_COPY_REUSE_EXT; + + /* In the special case of a shallow copy with reused image we don't + * hotplug the full chain when QEMU_CAPS_BLOCKDEV_SNAPSHOT_ALLOW_WRITE_ONLY + * is supported. Attempting to delete it would thus result in spurious + * errors as we'd attempt to blockdev-del images which were not added + * yet */ + if (reuse && shallow && + virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_BLOCKDEV_SNAPSHOT_ALLOW_WRITE_ONLY) && + virStorageSourceHasBacking(job->disk->mirror)) + g_clear_pointer(&job->disk->mirror->backingStore, virObjectUnref); + } + /* activeWrite bitmap is removed automatically here */ qemuBlockJobEventProcessConcludedRemoveChain(driver, vm, asyncJob, job->disk->mirror); g_clear_pointer(&job->disk->mirror, virObjectUnref); -- 2.35.1

3 4

[libvirt PATCH] util: Fix machined servicename
by Martin Kletzander 23 Feb '22

23 Feb '22

Commit 4e42686adef8 wrongly assumed how g_variant_new_parsed() works and broke starting of domains on systems with systemd (machined). Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- src/util/virsystemd.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/util/virsystemd.c b/src/util/virsystemd.c index 0554884811a7..18bf2932a426 100644 --- a/src/util/virsystemd.c +++ b/src/util/virsystemd.c @@ -360,6 +360,7 @@ int virSystemdCreateMachine(const char *name, g_autofree char *creatorname = NULL; g_autofree char *slicename = NULL; g_autofree char *scopename = NULL; + g_autofree char *servicename = NULL; static int hasCreateWithNetwork = 1; if ((rc = virSystemdHasMachined()) < 0) @@ -369,6 +370,7 @@ int virSystemdCreateMachine(const char *name, return -1; creatorname = g_strdup_printf("libvirt-%s", drivername); + servicename = g_strdup_printf("virt%sd.service", drivername); if (partition) { if (!(slicename = virSystemdMakeSliceName(partition))) @@ -440,11 +442,10 @@ int virSystemdCreateMachine(const char *name, gnicindexes = g_variant_new_fixed_array(G_VARIANT_TYPE("i"), nicindexes, nnicindexes, sizeof(int)); gprops = g_variant_new_parsed("[('Slice', <%s>)," - " ('After', <['libvirtd.service']>)," - " ('After', <['virt%sd.service']>)," + " ('After', <['libvirtd.service', %s]>)," " ('Before', <['virt-guest-shutdown.target']>)]", slicename, - drivername); + servicename); message = g_variant_new("(s@ayssus@ai@a(sv))", name, guuid, @@ -490,11 +491,10 @@ int virSystemdCreateMachine(const char *name, guuid = g_variant_new_fixed_array(G_VARIANT_TYPE("y"), uuid, 16, sizeof(unsigned char)); gprops = g_variant_new_parsed("[('Slice', <%s>)," - " ('After', <['libvirtd.service']>)," - " ('After', <['virt%sd.service']>)," + " ('After', <['libvirtd.service', %s]>)," " ('Before', <['virt-guest-shutdown.target']>)]", slicename, - drivername); + servicename); message = g_variant_new("(s@ayssus@a(sv))", name, guuid, -- 2.35.1

3 3

[PATCH] qemu: Don't regenerate NVRAM path if parsed from domain XML
by Michal Privoznik 23 Feb '22

23 Feb '22

After v8.0.0-466-g08101bde5d we unconditionally regenerate per domain NVRAM path even though it might have been parsed earlier from domain XML. The way we do that leads to a memleak: 43 bytes in 1 blocks are definitely lost in loss record 330 of 682 at 0x483F7E5: malloc (vg_replace_malloc.c:381) by 0x50D5B18: g_malloc (in /usr/lib64/libglib-2.0.so.0.7000.2) by 0x50EFA4F: g_strdup (in /usr/lib64/libglib-2.0.so.0.7000.2) by 0x49E774E: virXPathString (virxml.c:88) by 0x4A3F0E4: virDomainDefParseBootLoaderOptions (domain_conf.c:18226) by 0x4A3F49C: virDomainDefParseBootOptions (domain_conf.c:18298) by 0x4A448C3: virDomainDefParseXML (domain_conf.c:19598) by 0x4A487A1: virDomainDefParseNode (domain_conf.c:20404) by 0x117FCF: testCompareXMLToArgv (qemuxml2argvtest.c:726) by 0x142124: virTestRun (testutils.c:142) by 0x1423D4: virTestRunLog (testutils.c:197) by 0x140A76: mymain (qemuxml2argvtest.c:3406) If we parsed NVRAM path from domain XML we must refrain from generating new path. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_firmware.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index 4b02cb2802..59dc76fec4 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -1139,7 +1139,8 @@ qemuFirmwareEnableFeatures(virQEMUDriver *driver, VIR_FREE(def->os.loader->nvramTemplate); def->os.loader->nvramTemplate = g_strdup(flash->nvram_template.filename); - qemuDomainNVRAMPathFormat(cfg, def, &def->os.loader->nvram); + if (!def->os.loader->nvram) + qemuDomainNVRAMPathFormat(cfg, def, &def->os.loader->nvram); VIR_DEBUG("decided on firmware '%s' template '%s' NVRAM '%s'", def->os.loader->path, -- 2.34.1

4 6

[PATCH v2 00/29] ppc64 PowerNV machines support
by Daniel Henrique Barboza 22 Feb '22

22 Feb '22

Hi, This v2 has changes proposed by Peter and Daniel on the v1 review. Peter's reviewed-by tags were kept when applicable. The usability change made is that, now, we'll fail to launch powernv domains that has a pnv-phb* device and it's running a QEMU version that doesn't support these devices to be user creatable. Trying to run the 'powernv8-basic' domain with a QEMU 6.2.0 binary will result in an error: $ sudo ./run tools/virsh define ../tests/qemuxml2argvdata/powernv8-basic.xml error: Failed to define domain from ../tests/qemuxml2argvdata/powernv8-basic.xml error: unsupported configuration: The 'pnv-phb3' device is not supported by this QEMU binary Using the current QEMU upstream will allow the domain to be defined and started. Changes from v1: - all tests are now using CAPS_LATEST; - QEMU_CAPS_DEVICE_PNV_PHB3_ROOT_PORT is no longer being used. Capability for the pnv-phb3-root-port is infered to exist if the capabilitity for its PHB (QEMU_CAPS_DEVICE_PNV_PHB3) is present. Same thing for the case of QEMU_CAPS_DEVICE_PNV_PHB4_ROOT_PORT and QEMU_CAPS_DEVICE_PNV_PHB4; - QEMU_CAPS_DEVICE_PNV_PHB3 and QEMU_CAPS_DEVICE_PNV_PHB4 are no longer being probed. They are being set by hand after checking for QEMU version in virQEMUCapsInitQMPVersionCaps(); - patch 01 (QEMU ppc64 capabilities for qemu 7.0): * dropped since it's already upstream - patch 09 (forbid powernv domains migration): * removed. This will be handled on QEMU side - patch 14 (new): * added documentation of the different semantics 'targetIndex' will have for PowerNV PHBs - several other minor changes suggested by Peter - v1 link: https://listman.redhat.com/archives/libvir-list/2022-January/msg00902.html Daniel Henrique Barboza (29): qemu_domain.c: add PowerNV machine helpers qemu_capabilities.c: use 'MachineIsPowerPC' in DeviceDiskCaps qemu_domain: turn qemuDomainMachineIsPSeries() static qemu_validate.c: use qemuDomainIsPowerPC() in qemuValidateDomainChrDef() qemu_domain.c: define ISA as default PowerNV serial qemu_validate.c: enhance 'machine type not supported' message qemu_domain.c: disable default devices for PowerNV machines tests: add basic PowerNV8 test qemu: introduce QEMU_CAPS_DEVICE_PNV_PHB3 conf, qemu: add 'pnv-phb3-root-port' PCI controller model name conf, qemu: add 'pnv-phb3' PCI controller model name domain_conf.c: fix identation in virDomainControllerDefParseXML() conf: parse and format <target chip-id='...'/> formatdomain.rst: add 'index' semantics for PowerNV domains introduce virDomainControllerIsPowerNVPHB conf, qemu: add default 'chip-id' value for pnv-phb3 controllers conf, qemu: add default 'targetIndex' value for pnv-phb3 devs qemu_command.c: add command line for the pnv-phb3 device qemu_domain_address.c: change pnv-phb3 minimal downstream slot domain_conf: format pnv-phb3-root-port empty addr tests: add pnv-phb3-root-port test domain_validate.c: allow targetIndex 0 out of idx 0 for PowerNV PHBs domain_conf.c: reject duplicated pnv-phb3 devices qemu: introduce QEMU_CAPS_DEVICE_PNV_PHB4 conf, qemu: add 'pnv-phb4-root-port' PCI controller model name domain_conf.c: add phb4-root-port to IsPowerNVRootPort() conf, qemu: add 'pnv-phb4' controller model name domain_conf.c: add pnv-phb4 to ControllerIsPowerNVPHB() tests: add PowerNV9 tests docs/formatdomain.rst | 12 +- docs/schemas/domaincommon.rng | 10 ++ src/conf/domain_conf.c | 157 ++++++++++++++---- src/conf/domain_conf.h | 8 + src/conf/domain_validate.c | 5 +- src/libvirt_private.syms | 1 + src/qemu/qemu_capabilities.c | 28 +++- src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_command.c | 21 ++- src/qemu/qemu_domain.c | 56 ++++++- src/qemu/qemu_domain.h | 4 +- src/qemu/qemu_domain_address.c | 64 ++++++- src/qemu/qemu_validate.c | 62 ++++++- .../qemucapabilitiesdata/caps_7.0.0.ppc64.xml | 2 + .../powernv8-basic.ppc64-latest.args | 34 ++++ tests/qemuxml2argvdata/powernv8-basic.xml | 16 ++ tests/qemuxml2argvdata/powernv8-dupPHBs.err | 1 + .../powernv8-dupPHBs.ppc64-latest.err | 1 + tests/qemuxml2argvdata/powernv8-dupPHBs.xml | 27 +++ .../powernv8-root-port.ppc64-latest.args | 35 ++++ tests/qemuxml2argvdata/powernv8-root-port.xml | 17 ++ .../powernv8-two-sockets.ppc64-latest.args | 35 ++++ .../qemuxml2argvdata/powernv8-two-sockets.xml | 26 +++ .../powernv9-dupPHBs.ppc64-latest.err | 1 + tests/qemuxml2argvdata/powernv9-dupPHBs.xml | 27 +++ .../powernv9-root-port.ppc64-latest.args | 35 ++++ tests/qemuxml2argvdata/powernv9-root-port.xml | 17 ++ tests/qemuxml2argvtest.c | 7 + .../powernv8-basic.ppc64-latest.xml | 34 ++++ .../powernv8-root-port.ppc64-latest.xml | 39 +++++ .../powernv8-two-sockets.ppc64-latest.xml | 39 +++++ .../powernv9-root-port.ppc64-latest.xml | 39 +++++ .../qemuxml2xmloutdata/powernv9-root-port.xml | 36 ++++ tests/qemuxml2xmltest.c | 5 + 34 files changed, 855 insertions(+), 48 deletions(-) create mode 100644 tests/qemuxml2argvdata/powernv8-basic.ppc64-latest.args create mode 100644 tests/qemuxml2argvdata/powernv8-basic.xml create mode 100644 tests/qemuxml2argvdata/powernv8-dupPHBs.err create mode 100644 tests/qemuxml2argvdata/powernv8-dupPHBs.ppc64-latest.err create mode 100644 tests/qemuxml2argvdata/powernv8-dupPHBs.xml create mode 100644 tests/qemuxml2argvdata/powernv8-root-port.ppc64-latest.args create mode 100644 tests/qemuxml2argvdata/powernv8-root-port.xml create mode 100644 tests/qemuxml2argvdata/powernv8-two-sockets.ppc64-latest.args create mode 100644 tests/qemuxml2argvdata/powernv8-two-sockets.xml create mode 100644 tests/qemuxml2argvdata/powernv9-dupPHBs.ppc64-latest.err create mode 100644 tests/qemuxml2argvdata/powernv9-dupPHBs.xml create mode 100644 tests/qemuxml2argvdata/powernv9-root-port.ppc64-latest.args create mode 100644 tests/qemuxml2argvdata/powernv9-root-port.xml create mode 100644 tests/qemuxml2xmloutdata/powernv8-basic.ppc64-latest.xml create mode 100644 tests/qemuxml2xmloutdata/powernv8-root-port.ppc64-latest.xml create mode 100644 tests/qemuxml2xmloutdata/powernv8-two-sockets.ppc64-latest.xml create mode 100644 tests/qemuxml2xmloutdata/powernv9-root-port.ppc64-latest.xml create mode 100644 tests/qemuxml2xmloutdata/powernv9-root-port.xml -- 2.34.1

2 59