- Devel - libvirt List Archives

[libvirt PATCH] qemu: snapshot: delete disk image only if parent snapshot is external
by Pavel Hrdina 10 Jan '25

10 Jan '25

When we are deleting external snapshot that is not active we only need to delete overlay disk image of the parent snapshot. This works correctly even if parent snapshot is external and active as it will have another overlay created when user reverted to that snapshot. In case the parent snapshot is internal there are no overlay disk images created as everything is stored internally within the disk image. In this case we would delete the actual disk image storing internal snapshots and most likely the original disk image as well resulting in data loss once the VM is shutoff. Fixes: https://gitlab.com/libvirt/libvirt/-/issues/734 Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/qemu/qemu_snapshot.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c index 18b2e478f6..80cd54bf33 100644 --- a/src/qemu/qemu_snapshot.c +++ b/src/qemu/qemu_snapshot.c @@ -3144,6 +3144,8 @@ qemuSnapshotDeleteExternalPrepareData(virDomainObj *vm, return -1; } + data->parentSnap = qemuSnapshotFindParentSnapForDisk(snap, data->snapDisk); + if (data->merge) { virStorageSource *snapDiskSrc = NULL; @@ -3185,8 +3187,6 @@ qemuSnapshotDeleteExternalPrepareData(virDomainObj *vm, qemuSnapshotGetDisksWithBackingStore(vm, snap, data); } - data->parentSnap = qemuSnapshotFindParentSnapForDisk(snap, data->snapDisk); - if (data->parentSnap && !virDomainSnapshotIsExternal(data->parentSnap)) { virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", _("deleting external snapshot that has internal snapshot as parent not supported")); @@ -3642,10 +3642,12 @@ qemuSnapshotDiscardExternal(virDomainObj *vm, if (!data->job) goto error; } else { - if (virStorageSourceInit(data->parentDomDisk->src) < 0 || - virStorageSourceUnlink(data->parentDomDisk->src) < 0) { - VIR_WARN("Failed to remove snapshot image '%s'", - data->snapDisk->name); + if (data->parentSnap && virDomainSnapshotIsExternal(data->parentSnap)) { + if (virStorageSourceInit(data->parentDomDisk->src) < 0 || + virStorageSourceUnlink(data->parentDomDisk->src) < 0) { + VIR_WARN("Failed to remove snapshot image '%s'", + data->snapDisk->name); + } } } } -- 2.47.1

2 2

[PATCH 0/1] RFC: Add Arm CCA support for getting capability information and running Realm VM
by Akio Kakuno 10 Jan '25

10 Jan '25

Hi, all. - This patch adds Arm CCA support to qemu driver for aarch64 system. CCA is an abbreviation for Arm Confidential Compute Architecture feature, it enhances the virtualization capabilities of the platform by separating the management of resources from access to those resources. - We are not yet at the stage where we can merge this patch as host linux/qemu suppor is no yet merged, but I would like to receive reviews and comments on the overall direction. [summary] - At this stage, all you can do is getting the CCA capability with the virsh domcapabilities command and start the CCA VM with the virsh create command. - capability info uses qemu QMP to query qemu options. The option that exists now is for selecting a hash algorithm. [Capability example] - Execution results of 'virsh domcapability" on qemu <domaincapabilities> ... <features> ... </sgx> <cca supported='yes'> <enum name='measurement-algo'> <value>sha256</value> <value>sha512</value> </enum> </cca> <hyperv supported='yes'> ... </features> </domaincapabilities> [XML example] <domain> ... <launchsecurity type='cca'> <measurement-algo>sha256</measurement-algo> </launchsecurity> ... </domain> [limitations/tests] - To obtain capability info, it is necessary to support the qemu QMP command, which qemu does not yet support. Therefore, I put a hack in the code at hand and only confirmed the communication. Also, I think we should check whether CPUFW supports CCA or not in qemu_firmware.c, but it is not yet implemented. - Verified that the CCA VM can be started from virsh create command. [software version] - I followed the steps in Linaro's blog below. https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/Building+an… - The Qemu used was based on Linaro's qemu(9.1.91). https://git.codelinaro.org/linaro/dcap/qemu/-/tree/cca/v3?ref_type=heads Signed-off-by: Akio Kakuno <fj3333bs(a)fujitsu.com> Best Regards. Akio Kakuno (1): RFC: Add Arm CCA support for getting capability information and running Realm VM docs/formatdomain.rst | 28 ++++++ docs/formatdomaincaps.rst | 26 ++++- src/conf/domain_capabilities.c | 41 ++++++++ src/conf/domain_capabilities.h | 12 +++ src/conf/domain_conf.c | 13 +++ src/conf/domain_conf.h | 7 ++ src/conf/schemas/domaincaps.rng | 14 +++ src/conf/schemas/domaincommon.rng | 14 +++ src/conf/virconftypes.h | 2 + src/libvirt_private.syms | 1 + src/qemu/qemu_capabilities.c | 156 ++++++++++++++++++++++++++++++ src/qemu/qemu_capabilities.h | 4 + src/qemu/qemu_cgroup.c | 2 + src/qemu/qemu_command.c | 32 ++++++ src/qemu/qemu_driver.c | 2 + src/qemu/qemu_monitor.c | 10 ++ src/qemu/qemu_monitor.h | 3 + src/qemu/qemu_monitor_json.c | 104 ++++++++++++++++++++ src/qemu/qemu_monitor_json.h | 4 + src/qemu/qemu_namespace.c | 2 + src/qemu/qemu_process.c | 4 + src/qemu/qemu_validate.c | 7 ++ 22 files changed, 487 insertions(+), 1 deletion(-) -- 2.34.1

3 3

[PATCH] Passing a domain XML to a polkit rule engine
by Takuya Nakaike 09 Jan '25

09 Jan '25

This patch is a draft implementation to pass a domain XML to a polkit access driver. With this new feature, a polkit rule can verify the domain XML to be deployed on a host, and thus protect deploying a malicious VM. There is a discussion about this new feature in the following issue. https://gitlab.com/libvirt/libvirt/-/issues/719 Any question, comment, and suggestion are welcome. Thanks, Signed-off-by: Takuya Nakaike <nakaike(a)jp.ibm.com> --- src/access/viraccessdriverpolkit.c | 2 ++ src/access/viraccessmanager.c | 22 ++++++++++++++++++++++ src/access/viraccessmanager.h | 3 +++ src/libvirt_private.syms | 1 + src/qemu/qemu_driver.c | 3 +++ 5 files changed, 31 insertions(+) diff --git a/src/access/viraccessdriverpolkit.c b/src/access/viraccessdriverpolkit.c index 83381183a5..56457010e0 100644 --- a/src/access/viraccessdriverpolkit.c +++ b/src/access/viraccessdriverpolkit.c @@ -177,10 +177,12 @@ virAccessDriverPolkitCheckDomain(virAccessManager *manager, virAccessPermDomain perm) { char uuidstr[VIR_UUID_STRING_BUFLEN]; + char *xml = virAccessManagerGetXMLDesc(domain); const char *attrs[] = { "connect_driver", driverName, "domain_name", domain->name, "domain_uuid", uuidstr, + "xml", xml != NULL ? xml : "", NULL, }; virUUIDFormat(domain->uuid, uuidstr); diff --git a/src/access/viraccessmanager.c b/src/access/viraccessmanager.c index 6d9fdee5f1..7be31eb19a 100644 --- a/src/access/viraccessmanager.c +++ b/src/access/viraccessmanager.c @@ -44,11 +44,13 @@ struct _virAccessManager { virObjectLockable parent; virAccessDriver *drv; + virDomainXMLOption *xmlopt; void *privateData; }; static virClass *virAccessManagerClass; static virAccessManager *virAccessManagerDefault; +static virDomainXMLOption *virAccessManagerXMLOption = NULL; static void virAccessManagerDispose(void *obj); @@ -376,3 +378,23 @@ int virAccessManagerCheckStorageVol(virAccessManager *manager, return virAccessManagerSanitizeError(ret, driverName); } + +virDomainXMLOption *virAccessManagerGetXMLOption(void) +{ + return virAccessManagerXMLOption; +} + +void virAccessManagerSetXMLOption(virDomainXMLOption *xmlopt) +{ + virObjectUnref(virAccessManagerXMLOption); + + virAccessManagerXMLOption = virObjectRef(xmlopt); +} + +char *virAccessManagerGetXMLDesc(virDomainDef *domain) +{ + if (virAccessManagerGetXMLOption() != NULL) { + return virDomainDefFormat(domain, virAccessManagerGetXMLOption(), 0); + } + return NULL; +} diff --git a/src/access/viraccessmanager.h b/src/access/viraccessmanager.h index 2050ac9b85..3516f4f8e4 100644 --- a/src/access/viraccessmanager.h +++ b/src/access/viraccessmanager.h @@ -94,3 +94,6 @@ int virAccessManagerCheckStorageVol(virAccessManager *manager, virStoragePoolDef *pool, virStorageVolDef *vol, virAccessPermStorageVol perm); +virDomainXMLOption *virAccessManagerGetXMLOption(void); +void virAccessManagerSetXMLOption(virDomainXMLOption *xmlopt); +char *virAccessManagerGetXMLDesc(virDomainDef *domain); diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 33b93cbd3e..8bcbc9c478 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -19,6 +19,7 @@ virAccessManagerGetDefault; virAccessManagerNew; virAccessManagerNewStack; virAccessManagerSetDefault; +virAccessManagerSetXMLOption; # access/viraccessperm.h diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index d2eddbd9ae..f9880f8ee3 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -105,6 +105,7 @@ #include "virdomaincheckpointobjlist.h" #include "virutil.h" #include "backup_conf.h" +#include "viraccessmanager.h" #define VIR_FROM_THIS VIR_FROM_QEMU @@ -835,6 +836,8 @@ qemuStateInitialize(bool privileged, defsecmodel))) goto error; + virAccessManagerSetXMLOption(qemu_driver->xmlopt); + qemu_driver->nbdkitCapsCache = qemuNbdkitCapsCacheNew(cfg->cacheDir); /* If hugetlbfs is present, then we need to create a sub-directory within -- 2.43.5

2 1

[PATCH 0/2] storage_file: De-modularize the 'fs' backend
by Peter Krempa 09 Jan '25

09 Jan '25

See 1/2 for rationale. Peter Krempa (2): storage_file: de-modularize the local file backend NEWS: Mention de-modularization of the 'fs' storage file backend NEWS.rst | 9 +++++++++ libvirt.spec.in | 1 - src/storage_file/meson.build | 16 ---------------- src/storage_file/storage_file_backend.c | 11 ++++++----- 4 files changed, 15 insertions(+), 22 deletions(-) -- 2.47.1

2 4

[PATCH] docs: Clarify documentation of host-model CPU mode
by Jiri Denemark 09 Jan '25

09 Jan '25

The host-model CPU mode was described as similar to copying the host CPU definition from capabilities, which has not been the case for ages. The host-model definition from domain capabilities is used instead. Only the first sentence changed, but it required reformatting essentially the whole paragraph so I used this as an opportunity to reformat it a little bit more and split the long paragraph into several smaller ones for better readability. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- docs/formatdomain.rst | 68 ++++++++++++++++++++++++------------------- 1 file changed, 38 insertions(+), 30 deletions(-) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index 02c5361905..00acf7aa91 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -1482,38 +1482,46 @@ In case no restrictions need to be put on CPU model and its features, a simpler presented to the guest. This is the default when no ``mode`` attribute is specified. This mode makes it so that a persistent guest will see the same hardware no matter what host the guest is booted on. + ``host-model`` - The ``host-model`` mode is essentially a shortcut to copying host CPU - definition from capabilities XML into domain XML. Since the CPU definition - is copied just before starting a domain, exactly the same XML can be used - on different hosts while still providing the best guest CPU each host - supports. The ``match`` attribute can't be used in this mode. Specifying - CPU model is not supported either, but ``model``'s ``fallback`` attribute - may still be used. Using the ``feature`` element, specific flags may be - enabled or disabled specifically in addition to the host model. This may - be used to fine tune features that can be emulated. :since:`(Since 1.1.1)` - . Libvirt does not model every aspect of each CPU so the guest CPU will - not match the host CPU exactly. On the other hand, the ABI provided to the + The ``host-model`` mode is essentially a shortcut to copying host-model + CPU definition from `domain capabilities XML + <formatdomaincaps.html#cpu-configuration>`__ into domain XML. Since the + CPU definition is copied just before starting a domain, exactly the same + XML can be used on different hosts while still providing the best guest + CPU each host supports. The ``match`` attribute can't be used in this + mode. Specifying CPU model is not supported either, but ``model``'s + ``fallback`` attribute may still be used. Using the ``feature`` element, + specific flags may be enabled or disabled specifically in addition to the + host model. This may be used to fine tune features that can be emulated. + :since:`(Since 1.1.1)` + + Libvirt does not model every aspect of each CPU so the guest CPU will not + match the host CPU exactly. On the other hand, the ABI provided to the guest is reproducible. During migration, complete CPU model definition is - transferred to the destination host so the migrated guest will see exactly - the same CPU model for the running instance of the guest, even if the - destination host contains more capable CPUs or newer kernel; but shutting - down and restarting the guest may present different hardware to the guest - according to the capabilities of the new host. Prior to libvirt 3.2.0 and - QEMU 2.9.0 detection of the host CPU model via QEMU is not supported. Thus - the CPU configuration created using ``host-model`` may not work as - expected. :since:`Since 3.2.0 and QEMU 2.9.0` this mode works the way it - was designed and it is indicated by the ``fallback`` attribute set to - ``forbid`` in the host-model CPU definition advertised in `domain - capabilities XML <formatdomaincaps.html#cpu-configuration>`__. When - ``fallback`` attribute is set to ``allow`` in the domain capabilities - XML, it is recommended to use ``custom`` mode with just the CPU model - from the host capabilities XML. :since:`Since 1.2.11` PowerISA allows - processors to run VMs in binary compatibility mode supporting an older - version of ISA. Libvirt on PowerPC architecture uses the ``host-model`` - to signify a guest mode CPU running in binary compatibility mode. - Example: When a user needs a power7 VM to run in compatibility mode on a - Power8 host, this can be described in XML as follows : + transferred to the destination host so the migrated guest will see + exactly the same CPU model for the running instance of the guest, even if + the destination host contains more capable CPUs or newer kernel; but + shutting down and restarting the guest may present different hardware to + the guest according to the capabilities of the new host. + + Prior to libvirt 3.2.0 and QEMU 2.9.0 detection of the host CPU model via + QEMU is not supported. Thus the CPU configuration created using + ``host-model`` may not work as expected. :since:`Since 3.2.0 and QEMU + 2.9.0` this mode works the way it was designed and it is indicated by the + ``fallback`` attribute set to ``forbid`` in the host-model CPU definition + advertised in `domain capabilities XML + <formatdomaincaps.html#cpu-configuration>`__. When ``fallback`` attribute + is set to ``allow`` in the domain capabilities XML, it is recommended to + use ``custom`` mode with just the CPU model from the host capabilities + XML. + + :since:`Since 1.2.11` PowerISA allows processors to run VMs in binary + compatibility mode supporting an older version of ISA. Libvirt on + PowerPC architecture uses the ``host-model`` to signify a guest mode CPU + running in binary compatibility mode. Example: When a user needs a power7 + VM to run in compatibility mode on a Power8 host, this can be described + in XML as follows: :: -- 2.47.1

2 1

[PATCH] spec: Disable ch driver on RHEL
by Jiri Denemark 09 Jan '25

09 Jan '25

Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- libvirt.spec.in | 1 + 1 file changed, 1 insertion(+) diff --git a/libvirt.spec.in b/libvirt.spec.in index eb8b35da76..2bc8dfd323 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -133,6 +133,7 @@ %define with_libxl 0 %define with_hyperv 0 %define with_lxc 0 + %define with_ch 0 %endif %define with_firewalld_zone 0%{!?_without_firewalld_zone:1} -- 2.47.1

2 1

[PATCH] rpc: log details of OS signals received by daemon
by Daniel P. Berrangé 09 Jan '25

09 Jan '25

When debugging it is useful to know what signals are being received and metadata related to them. Log this data before calling the signal handling callbacks. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/rpc/virnetdaemon.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/rpc/virnetdaemon.c b/src/rpc/virnetdaemon.c index e4c6261536..94c23e973f 100644 --- a/src/rpc/virnetdaemon.c +++ b/src/rpc/virnetdaemon.c @@ -562,6 +562,10 @@ virNetDaemonSignalEvent(int watch, virNetDaemonSignalFunc func = dmn->signals[i]->func; void *funcopaque = dmn->signals[i]->opaque; virObjectUnlock(dmn); + VIR_DEBUG("Dispatch signal num=%d errno=%d code=%d pid=%llu uid=%llu status=%d", + siginfo.si_signo, siginfo.si_errno, siginfo.si_code, + (unsigned long long)siginfo.si_pid, (unsigned long long)siginfo.si_uid, + siginfo.si_status); func(dmn, &siginfo, funcopaque); return; } -- 2.47.1

2 1

[PATCH] util: don't attempt to acquire logind inhibitor if not requested
by Daniel P. Berrangé 09 Jan '25

09 Jan '25

When VIR_INHIBITOR_WHAT_NONE is passed to virInhibitorNew, it is an indication that daemon shutdown should be inhibited, but no OS level inhibitors acquired. This is done by the virtnetworkd daemon, for example, to prevent shutdown while running virtual machines are present, without blocking / delaying OS shutdown. Unfortunately the code forgot to skip the DBus call in this case, resulting in errors being logged. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/util/virinhibitor.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/util/virinhibitor.c b/src/util/virinhibitor.c index 647bdc9fbb..a95021de5a 100644 --- a/src/util/virinhibitor.c +++ b/src/util/virinhibitor.c @@ -152,7 +152,7 @@ virInhibitor *virInhibitorNew(virInhibitorWhat what, virInhibitor *inhibitor = g_new0(virInhibitor, 1); inhibitor->fd = -1; - inhibitor->what = virInhibitorWhatFormat(what); + inhibitor->what = what ? virInhibitorWhatFormat(what) : NULL; inhibitor->who = g_strdup(who); inhibitor->why = g_strdup(why); inhibitor->mode = virInhibitorModeTypeToString(mode); @@ -171,7 +171,8 @@ void virInhibitorHold(virInhibitor *inhibitor) inhibitor->action(true, inhibitor->actionData); } #ifdef G_OS_UNIX - if (virInhibitorAcquire( + if (inhibitor->what && + virInhibitorAcquire( inhibitor->what, inhibitor->who, inhibitor->why, inhibitor->mode, &inhibitor->fd) < 0) { VIR_ERROR(_("Failed to acquire inhibitor: %1$s"), -- 2.47.1

2 1

[PATCH v5 0/4] iproute2 bridge vlan support
by Leigh Brown 09 Jan '25

09 Jan '25

Very sorry, I blindly fixed the lack of braces on the multiline if statements pointed out by Laine, but didn't check for others. I have now fixed up the remaining ones. Description ----------- The iproute2 bridge command supports the capability for VLAN filtering that allows each interface connected to a standard linux bridge to be configured to use one or more VLANs. For simple setups, this capability is enough to allow virtual machines or containers to be put onto separate VLANs without creating multiple bridges and VLANs on the host. The first patch adds a new function virNetDevBridgeVlanFilterSet that allows a VLAN filter to be added or removed from an interface associated with a bridge. The second patch adds virNetDevBridgeSetupVlans that will, given a virNetDevVlan structure, call virNetDevBridgeVlanFilterSet to apply the required VLAN filtering for the given interface. The third patch adjusts the domain and network validation to permit standard linux bridges to allow VLAN configuration and updates calls to virNetDevBridgeAddPort to pass the VLAN configuration. The fourth patch updates documentation to match the new capability. Changes since v4 ---------------- - Fix the remaining examples of missing braces in virNetDevBridgeSetupVlans. Changes since v3 ---------------- - Update patch series description. - Fix coding style. - Add G_GNUC_UNUSED annotation to virNetDevBridgeAddPort for MacOS. Changes since v2 ---------------- - Convert to use netlink rather than executing bridge vlan commands. - Add unsupported on this platform error message on FreeBSD. Changes since v1 ---------------- - Fix bug in virNetDevSetupVlans where bridge port has no native vlan. - Update bridge network validation to permit vlan configuration. - Update documentation to match the functionality. - Tweak some of the commit descriptions for clarity. Usage example ------------- Configure the host with systemd-networkd as follows: /etc/systemd/network/br0.netdev (br0.network not shown) [NetDev] Name=br0 Kind=bridge MACAddress=xx:xx:xx:xx:xx:xx [Bridge] VLANFiltering=on /etc/systemd/network/eno1.network [Match] Name=eno1 [Network] Bridge=br0 [Link] MTUBytes=9000 [BridgeVLAN] VLAN=40 [BridgeVLAN] VLAN=60 Then add <vlan> tags into the lxc or qemu config: lxc interface definition: <interface type='bridge'> <mac address='xx:xx:xx:xx:xx:xx'/> <source bridge='br0'/> <vlan> <tag id='40'/> </vlan> </interface> qemu interface definition: <interface type='network'> <mac address='xx:xx:xx:xx:xx:xx'/> <source network='br0'/> <vlan> <tag id='60'/> </vlan> <model type='virtio'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </interface> Then, after starting them, you will see the following $ sudo bridge vlan port vlan-id eno1 1 PVID Egress Untagged 40 60 br0 1 PVID Egress Untagged vnet0 60 PVID Egress Untagged vnet1 40 PVID Egress Untagged Regards, Leigh Brown (4): util: add netlink bridge vlan filtering util: Add vlan support to virNetDevBridgeAddPort Enable vlan support for standard linux bridges docs: standard linux bridges now support vlans docs/formatdomain.rst | 37 +++++++++--------- docs/formatnetwork.rst | 45 +++++++++++----------- src/conf/domain_validate.c | 3 +- src/lxc/lxc_process.c | 2 +- src/network/bridge_driver.c | 13 ++++--- src/util/virnetdevbridge.c | 77 +++++++++++++++++++++++++++++++++++-- src/util/virnetdevbridge.h | 4 +- src/util/virnetdevtap.c | 2 +- src/util/virnetlink.c | 66 +++++++++++++++++++++++++++++++ src/util/virnetlink.h | 7 ++++ 10 files changed, 203 insertions(+), 53 deletions(-) -- 2.39.5

2 5

[PATCH v2] spec: Enable ch driver
by Praveen K Paladugu 08 Jan '25

08 Jan '25

Enabling building and packaging ch driver in the spec file. Signed-off-by: Praveen K Paladugu <praveenkpaladugu(a)gmail.com> --- libvirt.spec.in | 67 ++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 64 insertions(+), 3 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 3d5164b534..eb8b35da76 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -35,6 +35,7 @@ %define with_lxc 0%{!?_without_lxc:1} %define with_libxl 0%{!?_without_libxl:1} %define with_vbox 0%{!?_without_vbox:1} +%define with_ch 0%{!?_without_ch:1} %ifarch %{arches_qemu_kvm} %define with_qemu_kvm %{with_qemu} @@ -317,6 +318,9 @@ Obsoletes: libvirt-daemon-uml <= 5.0.0 %if %{with_vbox} Requires: libvirt-daemon-driver-vbox = %{version}-%{release} %endif +%if %{with_ch} +Requires: libvirt-daemon-driver-ch = %{version}-%{release} +%endif Requires: libvirt-daemon-driver-nwfilter = %{version}-%{release} Requires: libvirt-daemon-driver-interface = %{version}-%{release} Requires: libvirt-daemon-driver-secret = %{version}-%{release} @@ -1026,6 +1030,20 @@ Server side daemon and driver required to manage the virtualization capabilities of VirtualBox %endif + %if %{with_ch} +%package daemon-driver-ch +Summary: Cloud-Hypervisor driver plugin for libvirtd daemon +Requires: libvirt-daemon-common = %{version}-%{release} +Requires: libvirt-daemon-log = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} + +%description daemon-driver-ch +The ch driver plugin for the libvirtd daemon, providing +an implementation of the hypervisor driver APIs by +Cloud-Hypervisor + %endif + + %package client Summary: Client side utilities of the libvirt library Requires: libvirt-libs = %{version}-%{release} @@ -1188,9 +1206,15 @@ exit 1 %endif %if %{with_esx} - %define arg_esx -Ddriver_esx=enabled -Dcurl=enabled + %define arg_esx -Ddriver_esx=enabled +%else + %define arg_esx -Ddriver_esx=disabled +%endif + +%if %{with_esx} || %{with_ch} + %define arg_curl -Dcurl=enabled %else - %define arg_esx -Ddriver_esx=disabled -Dcurl=disabled + %define arg_curl -Dcurl=disabled %endif %if %{with_hyperv} @@ -1205,6 +1229,12 @@ exit 1 %define arg_vmware -Ddriver_vmware=disabled %endif +%if %{with_ch} + %define arg_ch -Ddriver_ch=enabled +%else + %define arg_ch -Ddriver_ch=disabled +%endif + %if %{with_storage_rbd} %define arg_storage_rbd -Dstorage_rbd=enabled %else @@ -1335,11 +1365,12 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec) -Ddriver_remote=enabled \ -Ddriver_test=enabled \ %{?arg_esx} \ + %{?arg_curl} \ %{?arg_hyperv} \ %{?arg_vmware} \ + %{?arg_ch} \ -Ddriver_vz=disabled \ -Ddriver_bhyve=disabled \ - -Ddriver_ch=disabled \ %{?arg_remote_mode} \ -Ddriver_interface=enabled \ -Ddriver_network=enabled \ @@ -1541,6 +1572,10 @@ rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/libvirtd.libxl rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/libvirtd_libxl.aug rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_libxl.aug %endif + %if ! %{with_ch} +rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/libvirtd_ch.aug +rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_ch.aug + %endif # Copied into libvirt-docs subpackage eventually mv $RPM_BUILD_ROOT%{_datadir}/doc/libvirt libvirt-docs @@ -1940,6 +1975,19 @@ exit 0 %libvirt_systemd_unix_preun virtxend %endif + %if %{with_ch} +%pre daemon-driver-ch +%libvirt_sysconfig_pre virtchd +%libvirt_systemd_unix_pre virtchd + +%posttrans daemon-driver-ch +%libvirt_sysconfig_posttrans virtchd +%libvirt_systemd_unix_posttrans virtchd + +%preun daemon-driver-ch +%libvirt_systemd_unix_preun virtchd + %endif + %pre daemon-config-network %libvirt_systemd_config_pre libvirtd %libvirt_systemd_config_pre virtnetworkd @@ -2405,6 +2453,19 @@ exit 0 %attr(0755, root, root) %{_libexecdir}/libvirt_sanlock_helper %endif + %if %{with_ch} +%files daemon-driver-ch +%attr(0755, root, root) %{_sbindir}/virtchd +%config(noreplace) %{_sysconfdir}/libvirt/virtchd.conf +%{_datadir}/augeas/lenses/virtchd.aug +%{_datadir}/augeas/lenses/tests/test_virtchd.aug +%{_unitdir}/virtchd-admin.socket +%{_unitdir}/virtchd-ro.socket +%{_unitdir}/virtchd.service +%{_unitdir}/virtchd.socket +%{_libdir}/libvirt/connection-driver/libvirt_driver_ch.so + %endif + %files client %{_mandir}/man1/virsh.1* %{_mandir}/man1/virt-xml-validate.1* -- 2.47.0

2 1

[PATCH] spec: Enable ch driver
by Praveen K Paladugu 08 Jan '25

08 Jan '25

Enabling building and packaging ch driver in the spec file. Signed-off-by: Praveen K Paladugu <praveenkpaladugu(a)gmail.com> --- libvirt.spec.in | 51 ++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 48 insertions(+), 3 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 3d5164b534..303d7cb34a 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -35,6 +35,7 @@ %define with_lxc 0%{!?_without_lxc:1} %define with_libxl 0%{!?_without_libxl:1} %define with_vbox 0%{!?_without_vbox:1} +%define with_ch 0%{!?_without_ch:1} %ifarch %{arches_qemu_kvm} %define with_qemu_kvm %{with_qemu} @@ -1026,6 +1027,20 @@ Server side daemon and driver required to manage the virtualization capabilities of VirtualBox %endif + %if %{with_ch} +%package daemon-driver-ch +Summary: Cloud-Hypervisor driver plugin for libvirtd daemon +Requires: libvirt-daemon-common = %{version}-%{release} +Requires: libvirt-daemon-log = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} + +%description daemon-driver-ch +The ch driver plugin for the libvirtd daemon, providing +an implementation of the hypervisor driver APIs by +Cloud-Hypervisor + %endif + + %package client Summary: Client side utilities of the libvirt library Requires: libvirt-libs = %{version}-%{release} @@ -1188,9 +1203,15 @@ exit 1 %endif %if %{with_esx} - %define arg_esx -Ddriver_esx=enabled -Dcurl=enabled + %define arg_esx -Ddriver_esx=enabled +%else + %define arg_esx -Ddriver_esx=disabled +%endif + +%if %{with_esx} || %{with_ch} + %define arg_curl -Dcurl=enabled %else - %define arg_esx -Ddriver_esx=disabled -Dcurl=disabled + %define arg_curl -Dcurl=disabled %endif %if %{with_hyperv} @@ -1205,6 +1226,12 @@ exit 1 %define arg_vmware -Ddriver_vmware=disabled %endif +%if %{with_ch} + %define arg_ch -Ddriver_ch=enabled +%else + %define arg_ch -Ddriver_ch=disabled +%endif + %if %{with_storage_rbd} %define arg_storage_rbd -Dstorage_rbd=enabled %else @@ -1335,11 +1362,12 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec) -Ddriver_remote=enabled \ -Ddriver_test=enabled \ %{?arg_esx} \ + %{?arg_curl} \ %{?arg_hyperv} \ %{?arg_vmware} \ + %{?arg_ch} \ -Ddriver_vz=disabled \ -Ddriver_bhyve=disabled \ - -Ddriver_ch=disabled \ %{?arg_remote_mode} \ -Ddriver_interface=enabled \ -Ddriver_network=enabled \ @@ -1541,6 +1569,10 @@ rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/libvirtd.libxl rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/libvirtd_libxl.aug rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_libxl.aug %endif + %if ! %{with_ch} +rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/libvirtd_ch.aug +rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_ch.aug + %endif # Copied into libvirt-docs subpackage eventually mv $RPM_BUILD_ROOT%{_datadir}/doc/libvirt libvirt-docs @@ -2405,6 +2437,19 @@ exit 0 %attr(0755, root, root) %{_libexecdir}/libvirt_sanlock_helper %endif + %if %{with_ch} +%files daemon-driver-ch +%attr(0755, root, root) %{_sbindir}/virtchd +%config(noreplace) %{_sysconfdir}/libvirt/virtchd.conf +%{_datadir}/augeas/lenses/virtchd.aug +%{_datadir}/augeas/lenses/tests/test_virtchd.aug +%{_unitdir}/virtchd-admin.socket +%{_unitdir}/virtchd-ro.socket +%{_unitdir}/virtchd.service +%{_unitdir}/virtchd.socket +%{_libdir}/libvirt/connection-driver/libvirt_driver_ch.so + %endif + %files client %{_mandir}/man1/virsh.1* %{_mandir}/man1/virt-xml-validate.1* -- 2.47.0

2 2

[PATCH] meson: Drop devmapper_dep for libvirt_admin_lib
by Michal Privoznik 08 Jan '25

08 Jan '25

Nothing inside libvirt-admin library calls devmapper nor it should. This is a historic artefact that was just copied over from autotools era. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- NB, I think there are more deps that can be dropped. I've built successfully with capng_dep, gnutls_dep, json_c_dep, libssh2_dep, libssh_dep and sasl_dep removed. Those libraries are required by libvirt.so which libvirt_admin.so links with. src/meson.build | 1 - 1 file changed, 1 deletion(-) diff --git a/src/meson.build b/src/meson.build index cce89fac27..74fbe43667 100644 --- a/src/meson.build +++ b/src/meson.build @@ -556,7 +556,6 @@ if conf.has('WITH_REMOTE') ], dependencies: [ capng_dep, - devmapper_dep, gnutls_dep, json_c_dep, libssh2_dep, -- 2.45.2

3 2

[PATCH] tools: fix ordering mistake in virt-admin daemon-set-timeout code
by Daniel P. Berrangé 08 Jan '25

08 Jan '25

Most of the impl for the 'daemon-set-timeout' command was ordered under the heading for the 'daemon-log-filters' command. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- tools/virt-admin.c | 67 +++++++++++++++++++++++----------------------- 1 file changed, 34 insertions(+), 33 deletions(-) diff --git a/tools/virt-admin.c b/tools/virt-admin.c index 3eb4f0f3fd..325b7aa827 100644 --- a/tools/virt-admin.c +++ b/tools/virt-admin.c @@ -1005,27 +1005,38 @@ static const vshCmdInfo info_daemon_log_outputs = { "daemon."), }; -static const vshCmdOptDef opts_daemon_timeout[] = { - {.name = "timeout", - .type = VSH_OT_INT, - .required = true, +static const vshCmdOptDef opts_daemon_log_outputs[] = { + {.name = "outputs", + .type = VSH_OT_STRING, .positional = true, - .help = N_("number of seconds the daemon will run without any active connection"), + .help = N_("redefine the existing set of logging outputs"), + .allowEmpty = true }, {.name = NULL} }; static bool -cmdDaemonTimeout(vshControl *ctl, const vshCmd *cmd) +cmdDaemonLogOutputs(vshControl *ctl, const vshCmd *cmd) { vshAdmControl *priv = ctl->privData; - unsigned int timeout = 0; - if (vshCommandOptUInt(ctl, cmd, "timeout", &timeout) < 0) - return false; + if (vshCommandOptBool(cmd, "outputs")) { + const char *outputs = NULL; + if ((vshCommandOptString(ctl, cmd, "outputs", &outputs) < 0 || + virAdmConnectSetLoggingOutputs(priv->conn, outputs, 0) < 0)) { + vshError(ctl, _("Unable to change daemon logging settings")); + return false; + } + } else { + g_autofree char *outputs = NULL; + if (virAdmConnectGetLoggingOutputs(priv->conn, &outputs, 0) < 0) { + vshError(ctl, _("Unable to get daemon logging outputs information")); + return false; + } - if (virAdmConnectSetDaemonTimeout(priv->conn, timeout, 0) < 0) - return false; + vshPrintExtra(ctl, " %-15s", _("Logging outputs: ")); + vshPrint(ctl, "%s\n", NULLSTR_EMPTY(outputs)); + } return true; } @@ -1040,42 +1051,32 @@ static const vshCmdInfo info_daemon_timeout = { .desc = N_("set the auto shutdown timeout of the daemon"), }; -static const vshCmdOptDef opts_daemon_log_outputs[] = { - {.name = "outputs", - .type = VSH_OT_STRING, +static const vshCmdOptDef opts_daemon_timeout[] = { + {.name = "timeout", + .type = VSH_OT_INT, + .required = true, .positional = true, - .help = N_("redefine the existing set of logging outputs"), - .allowEmpty = true + .help = N_("number of seconds the daemon will run without any active connection"), }, {.name = NULL} }; static bool -cmdDaemonLogOutputs(vshControl *ctl, const vshCmd *cmd) +cmdDaemonTimeout(vshControl *ctl, const vshCmd *cmd) { vshAdmControl *priv = ctl->privData; + unsigned int timeout = 0; - if (vshCommandOptBool(cmd, "outputs")) { - const char *outputs = NULL; - if ((vshCommandOptString(ctl, cmd, "outputs", &outputs) < 0 || - virAdmConnectSetLoggingOutputs(priv->conn, outputs, 0) < 0)) { - vshError(ctl, _("Unable to change daemon logging settings")); - return false; - } - } else { - g_autofree char *outputs = NULL; - if (virAdmConnectGetLoggingOutputs(priv->conn, &outputs, 0) < 0) { - vshError(ctl, _("Unable to get daemon logging outputs information")); - return false; - } + if (vshCommandOptUInt(ctl, cmd, "timeout", &timeout) < 0) + return false; - vshPrintExtra(ctl, " %-15s", _("Logging outputs: ")); - vshPrint(ctl, "%s\n", NULLSTR_EMPTY(outputs)); - } + if (virAdmConnectSetDaemonTimeout(priv->conn, timeout, 0) < 0) + return false; return true; } + static void * vshAdmConnectionHandler(vshControl *ctl) { -- 2.47.1

2 1

[PATCH] conf: Restrict model type to enum members
by Adam Julis 08 Jan '25

08 Jan '25

Historically, we supported any string as the model type for network devices. This approach allowed us to stay up-to-date with QEMU's frequent introduction of new model types. However, this solution now causes more problems than benefits. A clearly nonsensical model name can pass validation but result in a QEMU internal error when the VM is started. This patch restricts model types to members of the 'virDomainNetModelType' enum. The enum has been extended to include all model types currently supported by QEMU. If QEMU introduces new models in the future, the enum must be updated to support them. Resolves: https://issues.redhat.com/browse/RHEL-72082 Signed-off-by: Adam Julis <ajulis(a)redhat.com> --- I'm not sure if the virtio-net-pci should be in this enum, since its not located in qemu repo in hw/net/ but in hw/virtio/. When I manually tested it, the qemu this option supported. The last two members have not been supported for several years but I wanted to keep backward compatibility. src/conf/domain_conf.c | 23 +++++++++++++++++++++++ src/conf/domain_conf.h | 23 +++++++++++++++++++++++ src/conf/domain_validate.c | 7 +++++++ 3 files changed, 53 insertions(+) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index af88d0bcfd..5e8ca0015d 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -613,6 +613,29 @@ VIR_ENUM_IMPL(virDomainNetModel, "82540EM", "82545EM", "82543GC", + "dp8393x", + "eepro100", + "ftgmac100", + "igbvf", + "lasi_i82596", + "mcf_fec", + "mipsnet", + "ne2000-isa", + "ne2000-pci", + "npcm7xx_emc", + "npcm_gmac", + "opencores_eth", + "pcnet-pci", + "rocker", + "spapr_llan", + "sungem", + "sunhme", + "tulip", + "virtio-net", + "xen_nic", + "virtio-net-pci", + "etraxfs_eth", + "milkymist-minimac2", ); VIR_ENUM_IMPL(virDomainNetDriver, diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 9f7c28343f..d7f0073ba5 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -951,6 +951,29 @@ typedef enum { VIR_DOMAIN_NET_MODEL_82540EM, VIR_DOMAIN_NET_MODEL_82545EM, VIR_DOMAIN_NET_MODEL_82543GC, + VIR_DOMAIN_NET_MODEL_DP8393X, + VIR_DOMAIN_NET_MODEL_EEPRO100, + VIR_DOMAIN_NET_MODEL_FTGMAC100, + VIR_DOMAIN_NET_MODEL_IGBVF, + VIR_DOMAIN_NET_MODEL_LASI_I82596, + VIR_DOMAIN_NET_MODEL_MCF_FEC, + VIR_DOMAIN_NET_MODEL_MIPSNET, + VIR_DOMAIN_NET_MODEL_NE2000_ISA, + VIR_DOMAIN_NET_MODEL_NE2000_PCI, + VIR_DOMAIN_NET_MODEL_NPCM7XX_EMC, + VIR_DOMAIN_NET_MODEL_NPCM_GMAC, + VIR_DOMAIN_NET_MODEL_OPENCORES_ETH, + VIR_DOMAIN_NET_MODEL_PCNET_PCI, + VIR_DOMAIN_NET_MODEL_ROCKER, + VIR_DOMAIN_NET_MODEL_SPARP_LLAN, + VIR_DOMAIN_NET_MODEL_SUNGEM, + VIR_DOMAIN_NET_MODEL_SUNHME, + VIR_DOMAIN_NET_MODEL_TULIP, + VIR_DOMAIN_NET_MODEL_VIRTIO_NET, + VIR_DOMAIN_NET_MODEL_XEN_NIC, + VIR_DOMAIN_NET_MODEL_VIRTIO_NET_PCI, + VIR_DOMAIN_NET_MODEL_ETRAXFS_ETH, + VIR_DOMAIN_NET_MODEL_MILKYMIST_MINIMAC2, VIR_DOMAIN_NET_MODEL_LAST } virDomainNetModelType; diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c index 1034bb57f5..fed013835d 100644 --- a/src/conf/domain_validate.c +++ b/src/conf/domain_validate.c @@ -2218,6 +2218,13 @@ virDomainNetDefValidate(const virDomainNetDef *net) break; case VIR_DOMAIN_NET_TYPE_NETWORK: + if (net->modelstr) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("Unsupported model type '%s'"), + net->modelstr); + return -1; + } + break; case VIR_DOMAIN_NET_TYPE_VDPA: case VIR_DOMAIN_NET_TYPE_BRIDGE: case VIR_DOMAIN_NET_TYPE_CLIENT: -- 2.47.1

2 1

[RFC v3 PATCH 0/4] iproute2 bridge vlan support
by Leigh Brown 08 Jan '25

08 Jan '25

As requested by Laine, I have converted the code to use netlink rather than executing bridge vlan commands. I have also checked it compiles under FreeBSD. Description ----------- The iproute2 bridge command supports the capability for VLAN filtering that allows each interface connected to a standard linux bridge to be configured to use one or more VLANs. For simple setups, this capability is enough to allow virtual machines or containers to be put onto separate VLANs without creating multiple bridges and VLANs on the host. The first patch adds a new function virNetDevBridgeSetupVlans() that will, given a virNetDevVlan structure, execute the required bridge vlan commands to configure the given interface accordingly. The second patch updates the virNetDevBridgeAddPort() function to allow a virNetDevVlan parameter to be passed, and to call the virNetDevBridgeSetupVlans() function. The third patch updates the lxc and tap code to pass the virNetDevLan parameter from the configuration and to update the XML domain and network validation to permit the VLAN-related tags for standard bridges. The fourth patch updates documentation to match the new capability. Changes since v2 ---------------- - Convert to use netlink rather than executing bridge vlan commands. - Add unsupported on this platform error message on FreeBSD. Changes since v1 ---------------- - Fix bug in virNetDevSetupVlans where bridge port has no native vlan. - Update bridge network validation to permit vlan configuration. - Update documentation to match the functionality. - Tweak some of the commit descriptions for clarity. Usage example ------------- Configure the host with systemd-networkd as follows: /etc/systemd/network/br0.netdev (br0.network not shown) [NetDev] Name=br0 Kind=bridge MACAddress=xx:xx:xx:xx:xx:xx [Bridge] VLANFiltering=on /etc/systemd/network/eno1.network [Match] Name=eno1 [Network] Bridge=br0 [Link] MTUBytes=9000 [BridgeVLAN] VLAN=40 [BridgeVLAN] VLAN=60 Then add <vlan> tags into the lxc or qemu config: lxc interface definition: <interface type='bridge'> <mac address='xx:xx:xx:xx:xx:xx'/> <source bridge='br0'/> <vlan> <tag id='40'/> </vlan> </interface> qemu interface definition: <interface type='network'> <mac address='xx:xx:xx:xx:xx:xx'/> <source network='br0'/> <vlan> <tag id='60'/> </vlan> <model type='virtio'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </interface> Then, after starting them, you will see the following $ sudo bridge vlan port vlan-id eno1 1 PVID Egress Untagged 40 60 br0 1 PVID Egress Untagged vnet0 60 PVID Egress Untagged vnet1 40 PVID Egress Untagged Regards, Leigh Brown (4): util: add netlink bridge vlan filtering util: Add vlan support to virNetDevBridgeAddPort Enable vlan support for standard linux bridges docs: standard linux bridges now support vlans docs/formatdomain.rst | 37 +++++++++--------- docs/formatnetwork.rst | 45 +++++++++++----------- src/conf/domain_validate.c | 3 +- src/lxc/lxc_process.c | 3 +- src/network/bridge_driver.c | 13 ++++--- src/util/virnetdevbridge.c | 75 +++++++++++++++++++++++++++++++++++-- src/util/virnetdevbridge.h | 4 +- src/util/virnetdevtap.c | 2 +- src/util/virnetlink.c | 66 ++++++++++++++++++++++++++++++++ src/util/virnetlink.h | 7 ++++ 10 files changed, 202 insertions(+), 53 deletions(-) -- 2.39.5

3 11

[PATCH] qemu: allow migration of guest with mdev vGPU to VF vGPU
by Laine Stump 08 Jan '25

08 Jan '25

GPU vendors are moving away from using mdev to create virtual GPUs towards using SRIOV VFs that are vGPUs. In both cases, once created the vGPUs are assigned to guests via <hostdev> (i.e. VFIO device assignment), and inside the guest the devices look identical, but mdev vGPUs are located by QEMU/VFIO using a uuid, while VF vGPUs are located with a PCI address. So although we generally require the device on the source host to exactly match the device on the destination host, in the case of mdev-created vGPU vs. VF vGPU migration *can* potentially work, except that libvirt has a hard-coded check that prevents us from even trying. This patch loosens up that check so that we will allow attempts to migrate a guest from a source host that has mdev-created vGPUs to a destination host that has VF vGPUs (and vice versa). The expectation is that if this doesn't actually work then QEMU will fail and generate an error that we can report. Based-on-patch-by: Zhiyi Guo <zhguo(a)redhat.com> Signed-off-by: Laine Stump <laine(a)redhat.com> --- Zhiyi's original patch removed the check for subsys type completely, and this worked. My modified patch keeps the check in place, but allows it to pass if the src type is pci and dst is mdev, or vice versa. src/conf/domain_conf.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 4ad8289b89..9d5fda0469 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -20647,13 +20647,27 @@ virDomainHostdevDefCheckABIStability(virDomainHostdevDef *src, return false; } - if (src->mode == VIR_DOMAIN_HOSTDEV_MODE_SUBSYS && - src->source.subsys.type != dst->source.subsys.type) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, - _("Target host device subsystem %1$s does not match source %2$s"), - virDomainHostdevSubsysTypeToString(dst->source.subsys.type), - virDomainHostdevSubsysTypeToString(src->source.subsys.type)); - return false; + if (src->mode == VIR_DOMAIN_HOSTDEV_MODE_SUBSYS) { + virDomainHostdevSubsysType srcType = src->source.subsys.type; + virDomainHostdevSubsysType dstType = dst->source.subsys.type; + + /* If the source and destination subsys types aren't the same, + * then migration can't be supported, *except* that it might + * be supported to migrate from subsys type 'pci' to 'mdev' + * and vice versa. (libvirt can't know for certain whether or + * not it will actually work, so we have to just allow it and + * count on QEMU to provide us with an error if it fails) + */ + + if (srcType != dstType + && ((srcType != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI && srcType != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_MDEV) + || (dstType != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI && dstType != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_MDEV))) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("Target host device subsystem type %1$s is not compatible with source subsystem type %2$s"), + virDomainHostdevSubsysTypeToString(dstType), + virDomainHostdevSubsysTypeToString(srcType)); + return false; + } } if (!virDomainDeviceInfoCheckABIStability(src->info, dst->info)) -- 2.47.1

2 2

[PATCH] util: fix off-by-1 in inhibitor constants
by Daniel P. Berrangé 07 Jan '25

07 Jan '25

The inhibitor constant values were off-by-1, so when converted into string format, we picked the wrong names Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/util/virinhibitor.h | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/src/util/virinhibitor.h b/src/util/virinhibitor.h index 0a1c445d41..49cf32fbeb 100644 --- a/src/util/virinhibitor.h +++ b/src/util/virinhibitor.h @@ -26,13 +26,13 @@ typedef struct _virInhibitor virInhibitor; typedef enum { VIR_INHIBITOR_WHAT_NONE = 0, - VIR_INHIBITOR_WHAT_SLEEP = (1 << 1), - VIR_INHIBITOR_WHAT_SHUTDOWN = (1 << 2), - VIR_INHIBITOR_WHAT_IDLE = (1 << 3), - VIR_INHIBITOR_WHAT_POWER_KEY = (1 << 4), - VIR_INHIBITOR_WHAT_SUSPEND_KEY = (1 << 5), - VIR_INHIBITOR_WHAT_HIBERNATE_KEY = (1 << 6), - VIR_INHIBITOR_WHAT_LID_SWITCH = (1 << 7), + VIR_INHIBITOR_WHAT_SLEEP = (1 << 0), + VIR_INHIBITOR_WHAT_SHUTDOWN = (1 << 1), + VIR_INHIBITOR_WHAT_IDLE = (1 << 2), + VIR_INHIBITOR_WHAT_POWER_KEY = (1 << 3), + VIR_INHIBITOR_WHAT_SUSPEND_KEY = (1 << 4), + VIR_INHIBITOR_WHAT_HIBERNATE_KEY = (1 << 5), + VIR_INHIBITOR_WHAT_LID_SWITCH = (1 << 6), } virInhibitorWhat; typedef enum { -- 2.47.1

2 1

[PATCH] qemu: Add audit entries for suspend and resume
by Jim Fehlig 07 Jan '25

07 Jan '25

We recently received a request from certification auditors to provide audit entries for suspend and resume. This small patch uses the existing virtDomainAudit{Start,Stop} functions with new reasons "suspended" and "resumed". Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- For suspend, I initially wrote the following virDomainAuditStart(vm, virDomainPausedReasonTypeToString(reason), true); but I'm not sure it makes sense in resume, where we have reasons such as VIR_DOMAIN_CRASHED_PANICKED. For symmetry, it seemed best to go with "suspended" and "resumed". src/qemu/qemu_driver.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index f1a633fdd3..c670bb681e 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -1682,6 +1682,7 @@ static int qemuDomainSuspend(virDomainPtr dom) goto endjob; } qemuDomainSaveStatus(vm); + virDomainAuditStart(vm, "suspended", true); ret = 0; endjob: @@ -1738,6 +1739,7 @@ static int qemuDomainResume(virDomainPtr dom) } } qemuDomainSaveStatus(vm); + virDomainAuditStop(vm, "resumed"); ret = 0; endjob: -- 2.43.0

3 4

[PATCH v2 0/4] fix AppArmor policy restore for runtime rules
by Georgia Garcia 07 Jan '25

07 Jan '25

Some rules are generated dynamically during boot and added to the AppArmor policy. An example of that is macvtap devices that call the AppArmorSetFDLabel hook to add a rule for the tap device path. Since this information is dynamic, it is not available in the xml config, therefore whenever a "Restore" hook is called, the entire profile is regenerated by virt-aa-helper based only the information from the VM definition, so the dynamic/runtime information is lost. This patchset fixes that by storing these rules in a different file called libvirt-uuid.runtime_files, which is included by libvirt-uuid.files that already exists. It also includes other fixes like memory leaks, adoption of the GLib API in the apparmor files and a fix on the AppArmor policy that incorrectly applies apparmor policy syntax. Georgia Garcia (4): security_apparmor: fix memleaks in AppArmorSetFDLabel security: replace uses of label and VIR_FREE by g_autofree apparmor: fix UUID specification virt-aa-helper: store dynamically generated rules .../usr.lib.libvirt.virt-aa-helper.in | 5 +- src/security/apparmor/usr.sbin.libvirtd.in | 7 +- src/security/security_apparmor.c | 83 +++++----- src/security/virt-aa-helper.c | 145 +++++++++--------- 4 files changed, 120 insertions(+), 120 deletions(-) -- 2.34.1

4 11

[PATCH] meson: remove unneeded dependency on libdevmapper for storage_disk
by Stefan Hellermann 07 Jan '25

07 Jan '25

In commit dfa0e11 the last direct usage of devmapper for storage_disk was removed. There is one stale include remaining, which is unused even longer since df1011ca. Remove the include and change meson.build so we can use storage_disk without devmapper. I'm running it right now with a stripped-down config on a small arm64 router with openwrt. Signed-off-by: Stefan Hellermann <stefan(a)the2masters.de> --- meson.build | 4 ++-- src/storage/parthelper.c | 1 - 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/meson.build b/meson.build index ca1b915737..ffe91dbd46 100644 --- a/meson.build +++ b/meson.build @@ -1787,11 +1787,11 @@ if conf.has('WITH_LIBVIRTD') conf.set('WITH_STORAGE_DIR', 1) endif - if not get_option('storage_disk').disabled() and devmapper_dep.found() and libparted_dep.found() + if not get_option('storage_disk').disabled() and libparted_dep.found() use_storage = true conf.set('WITH_STORAGE_DISK', 1) elif get_option('storage_disk').enabled() - error('You must install libparted and libdevmapper to compile libvirt with disk storage driver') + error('You must install libparted to compile libvirt with disk storage driver') endif if not get_option('storage_fs').disabled() diff --git a/src/storage/parthelper.c b/src/storage/parthelper.c index ee07ba41bb..1169ebfb64 100644 --- a/src/storage/parthelper.c +++ b/src/storage/parthelper.c @@ -31,7 +31,6 @@ #include <config.h> #include <parted/parted.h> -#include <libdevmapper.h> #include <sys/types.h> #include <sys/stat.h> #include <unistd.h> -- 2.47.1

2 1

[PATCH] virtiofs: allow read only mode
by Adam Julis 07 Jan '25

07 Jan '25

Resolves: https://issues.redhat.com/browse/RHEL-72192 Signed-off-by: Adam Julis <ajulis(a)redhat.com> --- docs/formatdomain.rst | 2 +- src/qemu/qemu_validate.c | 11 ----- src/qemu/qemu_virtiofs.c | 3 ++ .../vhost-user-fs-readonly.x86_64-latest.args | 34 ++++++++++++++ .../vhost-user-fs-readonly.x86_64-latest.err | 1 - .../vhost-user-fs-readonly.x86_64-latest.xml | 45 +++++++++++++++++++ .../vhost-user-fs-readonly.xml | 1 + tests/qemuxmlconftest.c | 2 +- 8 files changed, 85 insertions(+), 14 deletions(-) create mode 100644 tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.args delete mode 100644 tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.xml diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index 8d787ef59a..e8e8336708 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -3824,7 +3824,7 @@ A directory on the host that can be accessed directly from the guest. :since:`Since 10.0.0` ``readonly`` Enables exporting filesystem as a readonly mount for guest, by default - read-write access is given (currently only works for QEMU/KVM driver; not + read-write access is given (works for QEMU/KVM driver and :since:`Since 11.0.0` with virtiofs). ``space_hard_limit`` Maximum space available to this guest's filesystem. :since:`Since 0.9.13` diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c index aaa056379e..086c66b602 100644 --- a/src/qemu/qemu_validate.c +++ b/src/qemu/qemu_validate.c @@ -4540,11 +4540,6 @@ qemuValidateDomainDeviceDefFS(virDomainFSDef *fs, case VIR_DOMAIN_FS_DRIVER_TYPE_VIRTIOFS: if (!fs->sock) { - if (fs->readonly) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("virtiofs does not yet support read-only mode")); - return -1; - } if (fs->accessmode != VIR_DOMAIN_FS_ACCESSMODE_PASSTHROUGH) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("virtiofs only supports passthrough accessmode")); @@ -4557,12 +4552,6 @@ qemuValidateDomainDeviceDefFS(virDomainFSDef *fs, } } - if (fs->readonly) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("virtiofs does not support read-only access")); - return -1; - } - if (fs->model != VIR_DOMAIN_FS_MODEL_DEFAULT) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("virtiofs does not support model")); diff --git a/src/qemu/qemu_virtiofs.c b/src/qemu/qemu_virtiofs.c index 87226be288..dd3e0dd9fe 100644 --- a/src/qemu/qemu_virtiofs.c +++ b/src/qemu/qemu_virtiofs.c @@ -228,6 +228,9 @@ qemuVirtioFSBuildCommandLine(virQEMUDriverConfig *cfg, fs->idmap.gidmap[i].count); } + if (fs->readonly) + virCommandAddArg(cmd, "--readonly"); + return g_steal_pointer(&cmd); } diff --git a/tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.args b/tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.args new file mode 100644 index 0000000000..d3c71544f8 --- /dev/null +++ b/tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.args @@ -0,0 +1,34 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-x86_64 \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-machine pc,usb=off,dump-guest-core=off,acpi=off \ +-accel kvm \ +-cpu qemu64 \ +-m size=14680064k \ +-overcommit mem-lock=off \ +-smp 2,sockets=2,cores=1,threads=1 \ +-object '{"qom-type":"memory-backend-file","id":"ram-node0","mem-path":"/var/lib/libvirt/qemu/ram/-1-guest/ram-node0","share":true,"size":15032385536}' \ +-numa node,nodeid=0,cpus=0-1,memdev=ram-node0 \ +-uuid 126f2720-6f8e-45ab-a886-ec9277079a67 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-chardev socket,id=chr-vu-fs0,path=/var/lib/libvirt/qemu/domain--1-guest/fs0-fs.sock \ +-device '{"driver":"vhost-user-fs-pci","id":"fs0","chardev":"chr-vu-fs0","queue-size":1024,"tag":"mount_tag","bus":"pci.0","addr":"0x2"}' \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.err b/tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.err deleted file mode 100644 index fff45fac4b..0000000000 --- a/tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.err +++ /dev/null @@ -1 +0,0 @@ -unsupported configuration: virtiofs does not yet support read-only mode diff --git a/tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.xml b/tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.xml new file mode 100644 index 0000000000..c9c1e5c3d2 --- /dev/null +++ b/tests/qemuxmlconfdata/vhost-user-fs-readonly.x86_64-latest.xml @@ -0,0 +1,45 @@ +<domain type='kvm'> + <name>guest</name> + <uuid>126f2720-6f8e-45ab-a886-ec9277079a67</uuid> + <memory unit='KiB'>14680064</memory> + <currentMemory unit='KiB'>14680064</currentMemory> + <memoryBacking> + <source type='file'/> + <access mode='shared'/> + </memoryBacking> + <vcpu placement='static'>2</vcpu> + <os> + <type arch='x86_64' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + <numa> + <cell id='0' cpus='0-1' memory='14680064' unit='KiB' memAccess='shared'/> + </numa> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' index='0' model='none'/> + <controller type='pci' index='0' model='pci-root'/> + <filesystem type='mount' accessmode='passthrough'> + <driver type='virtiofs' queue='1024'/> + <binary path='/usr/libexec/virtiofsd' xattr='on'> + <cache mode='always'/> + <lock posix='off' flock='off'/> + </binary> + <source dir='/path'/> + <target dir='mount_tag'/> + <readonly/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </filesystem> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/vhost-user-fs-readonly.xml b/tests/qemuxmlconfdata/vhost-user-fs-readonly.xml index 003ed41eb3..c9c1e5c3d2 100644 --- a/tests/qemuxmlconfdata/vhost-user-fs-readonly.xml +++ b/tests/qemuxmlconfdata/vhost-user-fs-readonly.xml @@ -39,6 +39,7 @@ </filesystem> <input type='mouse' bus='ps2'/> <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> <memballoon model='none'/> </devices> </domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 21b56dc94e..6a46bfc7a3 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -2880,7 +2880,7 @@ mymain(void) DO_TEST_CAPS_LATEST("vhost-user-fs-fd-memory"); DO_TEST_CAPS_LATEST("vhost-user-fs-fd-openfiles"); DO_TEST_CAPS_LATEST("vhost-user-fs-hugepages"); - DO_TEST_CAPS_LATEST_PARSE_ERROR("vhost-user-fs-readonly"); + DO_TEST_CAPS_LATEST("vhost-user-fs-readonly"); DO_TEST_CAPS_ARCH_LATEST("vhost-user-fs-ccw", "s390x"); DO_TEST_CAPS_ARCH_LATEST_PARSE_ERROR("vhost-user-fs-ccw-bootindex", "s390x"); -- 2.47.1

2 1

Plans for 11.0.0 release (freeze on Thursday 09 Jan)
by Jiri Denemark 07 Jan '25

07 Jan '25

We are getting close to 11.0.0 release of libvirt. To aim for the release on Wednesday 15 Jan I suggest entering the freeze on Thursday 09 Jan and tagging RC2 on Monday 13 Jan. I hope this works for everyone. Jirka

1 0

[libvirt PATCH v2 0/2] conf: Adjust hyperv tlbflush formatting
by Ján Tomko 07 Jan '25

07 Jan '25

Including the refactor. Ján Tomko (1): conf: refactor hyperv features formatting Martin Kletzander (1): conf: Adjust hyperv tlbflush formatting src/conf/domain_conf.c | 57 ++++++++++--------- .../qemuxmlconfdata/hyperv.x86_64-latest.xml | 5 +- 2 files changed, 33 insertions(+), 29 deletions(-) -- 2.47.0

2 3

[PATCH] security: apparmor: Remove hardcoded "libvirtd" profile name
by Jim Fehlig 06 Jan '25

06 Jan '25

The apparmor driver probe function checks for an active profile matching the full path of the running daemon binary. If not found, it checks for a profile named "libvirtd". This works fine when the running daemon is the old monolithic libvirtd, but fails with modular daemons. Remove the check for a hardcoded "libvirtd" profile and replace with the basename of the running daemon binary. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- src/security/security_apparmor.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index c8e77c6cd2..eed0f265d6 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -239,7 +239,9 @@ use_apparmor(void) */ rc = profile_status(libvirt_daemon, 1); if (rc < 0) { - rc = profile_status("libvirtd", 1); + g_autofree char *basename = g_path_get_basename(libvirt_daemon); + + rc = profile_status(basename, 1); /* Error or unconfined should all result in -1 */ if (rc < 0) rc = -1; -- 2.43.0

2 1

[PATCH] conf: Adjust hyperv tlbflush formatting
by Martin Kletzander 06 Jan '25

06 Jan '25

Commi 247357cc292a added support for direct and extended modes for tlbflush, but forgot to do the formatting as well. Instead of rewriting the whole hyperv feature formatting to use yet another attribute and child buffers, just fix it in a way the other features are and leave the refactoring to later. One reason for that is that we should fix this ASAP since without this patch the features will be stripped when formatting the XML on the disk and lost after next daemon reload. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- src/conf/domain_conf.c | 20 ++++++++++++++++++- .../qemuxmlconfdata/hyperv.x86_64-latest.xml | 5 ++++- 2 files changed, 23 insertions(+), 2 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 785eb0e539b4..ae56b292ad1e 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -27972,7 +27972,6 @@ virDomainDefFormatFeatures(virBuffer *buf, case VIR_DOMAIN_HYPERV_RESET: case VIR_DOMAIN_HYPERV_FREQUENCIES: case VIR_DOMAIN_HYPERV_REENLIGHTENMENT: - case VIR_DOMAIN_HYPERV_TLBFLUSH: case VIR_DOMAIN_HYPERV_IPI: case VIR_DOMAIN_HYPERV_EVMCS: case VIR_DOMAIN_HYPERV_AVIC: @@ -28016,6 +28015,25 @@ virDomainDefFormatFeatures(virBuffer *buf, def->hyperv_vendor_id); break; + case VIR_DOMAIN_HYPERV_TLBFLUSH: + if (def->hyperv_features[j] != VIR_TRISTATE_SWITCH_ON) { + virBufferAddLit(&childBuf, "/>\n"); + break; + } + if (def->hyperv_tlbflush_direct == VIR_TRISTATE_SWITCH_ON || + def->hyperv_tlbflush_extended == VIR_TRISTATE_SWITCH_ON) { + virBufferAddLit(&childBuf, ">\n"); + virBufferAdjustIndent(&childBuf, 2); + if (def->hyperv_tlbflush_direct == VIR_TRISTATE_SWITCH_ON) + virBufferAddLit(&childBuf, "<direct state='on'/>\n"); + if (def->hyperv_tlbflush_extended == VIR_TRISTATE_SWITCH_ON) + virBufferAddLit(&childBuf, "<extended state='on'/>\n"); + virBufferAdjustIndent(&childBuf, -2); + virBufferAddLit(&childBuf, "</tlbflush>\n"); + } else { + virBufferAddLit(&childBuf, "/>\n"); + } + case VIR_DOMAIN_HYPERV_LAST: break; } diff --git a/tests/qemuxmlconfdata/hyperv.x86_64-latest.xml b/tests/qemuxmlconfdata/hyperv.x86_64-latest.xml index 36d9161fa811..49537188af3f 100644 --- a/tests/qemuxmlconfdata/hyperv.x86_64-latest.xml +++ b/tests/qemuxmlconfdata/hyperv.x86_64-latest.xml @@ -22,7 +22,10 @@ <vendor_id state='on' value='KVM Hv'/> <frequencies state='on'/> <reenlightenment state='on'/> - <tlbflush state='on'/> + <tlbflush state='on'> + <direct state='on'/> + <extended state='on'/> + </tlbflush> <ipi state='on'/> <evmcs state='on'/> <avic state='on'/> -- 2.47.1

2 1

[PATCH v2 1/3] Revert "qemu: explicit swtpm state locking"
by marcandre.lureau＠redhat.com 06 Jan '25

06 Jan '25

From: Marc-André Lureau <marcandre.lureau(a)redhat.com> This reverts commit bb5e26749fe5b5856a3541be2cbe147701e6e121. swtpm-setup doesn't have "tpmstate-lock", only swtpm. Signed-off-by: Marc-André Lureau <marcandre.lureau(a)redhat.com> --- src/qemu/qemu_tpm.c | 11 ++--------- src/util/virtpm.c | 1 - src/util/virtpm.h | 1 - tests/testutilsqemu.c | 1 - 4 files changed, 2 insertions(+), 12 deletions(-) diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index f5e0184e54..476e3dd224 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -344,23 +344,16 @@ static char * qemuTPMGetSwtpmSetupStateArg(const virDomainTPMSourceType source_type, const char *source_path) { - const char *lock = ",lock"; - - if (!virTPMSwtpmSetupCapsGet(VIR_TPM_SWTPM_SETUP_FEATURE_TPMSTATE_OPT_LOCK)) { - VIR_WARN("This swtpm version doesn't support explicit locking"); - lock = ""; - } - switch (source_type) { case VIR_DOMAIN_TPM_SOURCE_TYPE_FILE: /* the file:// prefix is supported since swtpm_setup 0.7.0 */ /* assume the capability check for swtpm is redundant. */ - return g_strdup_printf("file://%s%s", source_path, lock); + return g_strdup_printf("file://%s", source_path); case VIR_DOMAIN_TPM_SOURCE_TYPE_DIR: case VIR_DOMAIN_TPM_SOURCE_TYPE_DEFAULT: case VIR_DOMAIN_TPM_SOURCE_TYPE_LAST: default: - return g_strdup_printf("%s%s", source_path, lock); + return g_strdup_printf("%s", source_path); } } diff --git a/src/util/virtpm.c b/src/util/virtpm.c index 4016ad8fc4..f90839debe 100644 --- a/src/util/virtpm.c +++ b/src/util/virtpm.c @@ -53,7 +53,6 @@ VIR_ENUM_IMPL(virTPMSwtpmSetupFeature, "cmdarg-reconfigure-pcr-banks", "tpm-1.2", "tpm-2.0", - "tpmstate-opt-lock", "cmdarg-profile", ); diff --git a/src/util/virtpm.h b/src/util/virtpm.h index 03fb92629a..4119a903e5 100644 --- a/src/util/virtpm.h +++ b/src/util/virtpm.h @@ -45,7 +45,6 @@ typedef enum { VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_RECONFIGURE_PCR_BANKS, VIR_TPM_SWTPM_SETUP_FEATURE_TPM_1_2, VIR_TPM_SWTPM_SETUP_FEATURE_TPM_2_0, - VIR_TPM_SWTPM_SETUP_FEATURE_TPMSTATE_OPT_LOCK, VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_PROFILE, VIR_TPM_SWTPM_SETUP_FEATURE_LAST diff --git a/tests/testutilsqemu.c b/tests/testutilsqemu.c index 5caccbc6b4..abc425b9b7 100644 --- a/tests/testutilsqemu.c +++ b/tests/testutilsqemu.c @@ -71,7 +71,6 @@ virTPMSwtpmSetupCapsGet(virTPMSwtpmSetupFeature cap) case VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_CREATE_CONFIG_FILES: case VIR_TPM_SWTPM_SETUP_FEATURE_TPM12_NOT_NEED_ROOT: case VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_RECONFIGURE_PCR_BANKS: - case VIR_TPM_SWTPM_SETUP_FEATURE_TPMSTATE_OPT_LOCK: case VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_PROFILE: case VIR_TPM_SWTPM_SETUP_FEATURE_LAST: break; -- 2.47.0

4 6

[PATCH] apparmor: Allow running loongarch64 VMs on Debian 12
by Xianglai Li 06 Jan '25

06 Jan '25

Allows to load firmware in the qemu-efi-loongarch64 directory Allows the binary qemu-system-loongarch64 to be run This makes it impossible to run loongarch64 VMs when AppArmor is enabled Signed-off-by: Xianglai Li <lixianglai(a)loongson.cn> --- src/security/apparmor/libvirt-qemu.in | 1 + src/security/virt-aa-helper.c | 1 + 2 files changed, 2 insertions(+) diff --git a/src/security/apparmor/libvirt-qemu.in b/src/security/apparmor/libvirt-qemu.in index 694da26dea..c63077574e 100644 --- a/src/security/apparmor/libvirt-qemu.in +++ b/src/security/apparmor/libvirt-qemu.in @@ -144,6 +144,7 @@ /usr/bin/qemu-system-hppa rmix, /usr/bin/qemu-system-i386 rmix, /usr/bin/qemu-system-lm32 rmix, + /usr/bin/qemu-system-loongarch64 rmix, /usr/bin/qemu-system-m68k rmix, /usr/bin/qemu-system-microblaze rmix, /usr/bin/qemu-system-microblazeel rmix, diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 1cf9d7ad3d..94a28bf331 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -481,6 +481,7 @@ valid_path(const char *path, const bool readonly) "/usr/share/AAVMF/", "/usr/share/qemu-efi/", /* for AAVMF images */ "/usr/share/qemu-efi-aarch64/", + "/usr/share/qemu-efi-loongarch64/", "/usr/share/qemu-efi-riscv64/", "/usr/share/qemu/", /* SUSE path for OVMF and AAVMF images */ "/usr/lib/u-boot/", -- 2.39.1

3 5

[PATCH] hyperv: Introduce and export 'facility' variable.
by Michal Privoznik 06 Jan '25

06 Jan '25

In its upstream commit [1] openwsman dropped 'facility' variable which is documented as: * all processes that use the libu must define a "facility" variable somewhere * to satisfy this external linkage reference. * * Such variable will be used as the syslog(3) facility argument. Well, prior to that commit, openwsman itself declared the variable (and set it to LOG_DAEMON). Now it's up to us. Yeah, the variable naming is terrible and also I we are not using libu directly, but apparently libwsman.so requires it anyway: $ objdump -T /usr/lib64/libwsman.so | grep facility 0000000000000000 D *UND* 0000000000000000 Base facility 1: https://github.com/Openwsman/openwsman/commit/d72c51f21b9c85a773b7955ac587d… Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/hyperv/hyperv_wmi.c | 3 +++ src/libvirt_hyperv.syms | 11 +++++++++++ src/meson.build | 6 ++++++ 3 files changed, 20 insertions(+) create mode 100644 src/libvirt_hyperv.syms diff --git a/src/hyperv/hyperv_wmi.c b/src/hyperv/hyperv_wmi.c index 0b82f1f131..040bcfec11 100644 --- a/src/hyperv/hyperv_wmi.c +++ b/src/hyperv/hyperv_wmi.c @@ -28,6 +28,7 @@ #include <wsman-soap.h> #include <wsman-xml.h> #include <wsman-xml-binding.h> +#include <u/syslog.h> #include "internal.h" #include "virerror.h" @@ -47,6 +48,8 @@ VIR_LOG_INIT("hyperv.hyperv_wmi"); +int facility = LOG_DAEMON; + int hypervGetWmiClassList(hypervPrivate *priv, hypervWmiClassInfo *wmiInfo, virBuffer *query, hypervObject **wmiClass) diff --git a/src/libvirt_hyperv.syms b/src/libvirt_hyperv.syms new file mode 100644 index 0000000000..60e98db473 --- /dev/null +++ b/src/libvirt_hyperv.syms @@ -0,0 +1,11 @@ +# +# HyperV-specific symbols +# + +# hyperv/hyperv_wmi.c +facility; + +# Let emacs know we want case-insensitive sorting +# Local Variables: +# sort-fold-case: t +# End: diff --git a/src/meson.build b/src/meson.build index b53ea2a71f..cce89fac27 100644 --- a/src/meson.build +++ b/src/meson.build @@ -125,6 +125,12 @@ else sym_files += 'libvirt_libssh2.syms' endif +if conf.has('WITH_HYPERV') + used_sym_files += 'libvirt_hyperv.syms' +else + sym_files += 'libvirt_hyperv.syms' +endif + # variables filled by subdirectories libvirt_libs = [] -- 2.45.2

2 1

[PATCH v2 0/3] po: handle translation of polkit policy file strings
by Daniel P. Berrangé 06 Jan '25

06 Jan '25

There was a proposal https://gitlab.com/libvirt/libvirt/-/merge_requests/387 to add translations for the polkit files. In reviewing this we came to the conclusion the approach was undesirable. After getting misled by a Debian/Ubuntu specific downstream only patch to polkit which auto-translated polkit files at runtime, this implements the manual approach of merging translations into the polkit files at build time. Changed in v2: - Fix introduction of 'polkitactionsdir' - Also introduce 'polkitrulesdir' - Fix syntax check rules for POFILES with generated polkit - Remove incorrect 'install: true' rule for policy.in file Daniel P. Berrangé (3): po: add its rules for translating polkit file strings meson: remove duplication of polkit dirs construction remote: apply translations to polkit files build-aux/syntax-check.mk | 5 +++-- meson.build | 6 ++++++ po/POTFILES | 2 ++ po/its/polkit.its | 8 ++++++++ po/its/polkit.loc | 6 ++++++ po/meson.build | 5 ++--- src/access/meson.build | 20 +++++++++++++++---- .../{libvirtd.policy => libvirtd.policy.in} | 0 src/remote/meson.build | 15 ++++++++------ 9 files changed, 52 insertions(+), 15 deletions(-) create mode 100644 po/its/polkit.its create mode 100644 po/its/polkit.loc rename src/remote/{libvirtd.policy => libvirtd.policy.in} (100%) -- 2.47.1

2 4

[PATCH] Remove the deprecated "-runas" command line option
by Thomas Huth 03 Jan '25

03 Jan '25

It has been marked as deprecated two releases ago, so it should be fine now to remove this command line option. Signed-off-by: Thomas Huth <thuth(a)redhat.com> --- docs/about/deprecated.rst | 6 ------ docs/about/removed-features.rst | 6 ++++++ system/vl.c | 9 --------- qemu-options.hx | 15 +-------------- 4 files changed, 7 insertions(+), 29 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index d6809f94ea..63b46fd520 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -74,12 +74,6 @@ configurations (e.g. -smp drawers=1,books=1,clusters=1 for x86 PC machine) is marked deprecated since 9.0, users have to ensure that all the topology members described with -smp are supported by the target machine. -``-runas`` (since 9.1) -'''''''''''''''''''''' - -Use ``-run-with user=..`` instead. - - User-mode emulator command line arguments ----------------------------------------- diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst index cb1388049a..c6616ce05e 100644 --- a/docs/about/removed-features.rst +++ b/docs/about/removed-features.rst @@ -555,6 +555,12 @@ to produce an odd effect (rotating input but not display output). But this was never intended or documented behaviour, so we have dropped the options along with the machine models they were intended for. +``-runas`` (removed in 10.0) +'''''''''''''''''''''''''''' + +Use ``-run-with user=..`` instead. + + User-mode emulator command line arguments ----------------------------------------- diff --git a/system/vl.c b/system/vl.c index 0843b7ab49..3c5bd36d7d 100644 --- a/system/vl.c +++ b/system/vl.c @@ -3611,15 +3611,6 @@ void qemu_init(int argc, char **argv) /* Nothing to be parsed here. Especially, do not error out below. */ break; #if defined(CONFIG_POSIX) - case QEMU_OPTION_runas: - warn_report("-runas is deprecated, use '-run-with user=...' instead"); - if (!os_set_runas(optarg)) { - error_report("User \"%s\" doesn't exist" - " (and is not <uid>:<gid>)", - optarg); - exit(1); - } - break; case QEMU_OPTION_daemonize: os_set_daemonize(true); break; diff --git a/qemu-options.hx b/qemu-options.hx index cc694d3b89..7090d59f6f 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -4976,19 +4976,6 @@ SRST ``-nodefaults`` option will disable all those default devices. ERST -#ifndef _WIN32 -DEF("runas", HAS_ARG, QEMU_OPTION_runas, \ - "-runas user change to user id user just before starting the VM\n" \ - " user can be numeric uid:gid instead\n", - QEMU_ARCH_ALL) -#endif -SRST -``-runas user`` - Immediately before starting guest execution, drop root privileges, - switching to the specified user. This option is deprecated, use - ``-run-with user=...`` instead. -ERST - DEF("prom-env", HAS_ARG, QEMU_OPTION_prom_env, "-prom-env variable=value\n" " set OpenBIOS nvram variables\n", @@ -5176,7 +5163,7 @@ SRST ``chroot=dir`` can be used for doing a chroot to the specified directory immediately before starting the guest execution. This is especially useful - in combination with -runas. + in combination with ``user=...``. ``user=username`` or ``user=uid:gid`` can be used to drop root privileges before starting guest execution. QEMU will use the ``setuid`` and ``setgid`` -- 2.47.1

2 1

[PATCH 0/2] po: handle translatin of polkit policy file strings
by Daniel P. Berrangé 03 Jan '25

03 Jan '25

There was a proposal https://gitlab.com/libvirt/libvirt/-/merge_requests/387 to add translations for the polkit files. In reviewing this we came to the conclusion the approach was undesirable. After getting misled by a Debian/Ubuntu specific downstream only patch to polkit which auto-translated polkit files at runtime, this implements the manual approach of merging translations into the polkit files at build time. Daniel P. Berrangé (2): po: add its rules for translating polkit file strings remote: apply translations to polkit files meson.build | 5 +++++ po/POTFILES | 2 ++ po/its/polkit.its | 8 ++++++++ po/its/polkit.loc | 6 ++++++ po/meson.build | 3 +-- src/access/meson.build | 18 ++++++++++++++---- .../{libvirtd.policy => libvirtd.policy.in} | 0 src/remote/meson.build | 13 ++++++++----- 8 files changed, 44 insertions(+), 11 deletions(-) create mode 100644 po/its/polkit.its create mode 100644 po/its/polkit.loc rename src/remote/{libvirtd.policy => libvirtd.policy.in} (100%) -- 2.46.0

2 4

[PATCH 00/19] hw/microblaze: Allow running cross-endian vCPUs
by Philippe Mathieu-Daudé 02 Jan '25

02 Jan '25

Make machines endianness-agnostic, allowing to run a big-endian vCPU on the little-endian 'qemu-system-microblazeel' binary, and a little endian one on the big-endian 'qemu-system-microblaze' binary. Tests added, following combinations covered: - little-endian vCPU using little-endian binary (in-tree) - little-endian vCPU using big-endian binary (new) - big-endian vCPU using little-endian binary (new) - big-endian vCPU using big-endian binary (in-tree) Deprecate untested big-endian machines, likely build on the big endian binary by mistake: - petalogix-ml605 - xlnx-zynqmp-pmu To make a target endian-agnostic we need to remove the MO_TE uses. In order to do that, we propagate the MemOp from earlier in the call stack, or we extract it from the vCPU env (on MicroBlaze the CPU endianness is exposed by the 'ENDI' bit). Note, since vCPU can run in any endianness, the MemoryRegionOps::endianness should not be DEVICE_NATIVE_ENDIAN anymore, because this definition expand to the binary endianness, swapping data regardless how the vcpu access it. See adjust_endianness() -> devend_memop(). Something to keep in mind, possibly requiring further work and optimizations (avoid double-swap). Next step: Look at unifying binaries. Please review, Phil. Philippe Mathieu-Daudé (19): target/microblaze: Rename CPU endianness property as 'little-endian' hw/microblaze: Deprecate big-endian petalogix-ml605 & xlnx-zynqmp-pmu hw/microblaze/s3adsp1800: Explicit CPU endianness hw/microblaze/s3adsp1800: Rename unimplemented MMIO region as xps_gpio hw/microblaze/s3adsp1800: Declare machine type using DEFINE_TYPES macro hw/microblaze: Fix MemoryRegionOps coding style hw/microblaze: Restrict MemoryRegionOps are implemented as 32-bit hw/microblaze: Propagate CPU endianness to microblaze_load_kernel() hw/intc/xilinx_intc: Only expect big-endian accesses hw/timer/xilinx_timer: Only expect big-endian accesses hw/timer/xilinx_timer: Allow down to 8-bit memory access hw/net/xilinx_ethlite: Only expect big-endian accesses target/microblaze: Explode MO_TExx -> MO_TE | MO_xx target/microblaze: Set MO_TE once in do_load() / do_store() target/microblaze: Introduce mo_endian() helper target/microblaze: Consider endianness while translating code hw/microblaze: Support various endianness for s3adsp1800 machines tests/functional: Explicit endianness of microblaze assets tests/functional: Add microblaze cross-endianness tests docs/about/deprecated.rst | 6 ++ .../devices/microblaze-softmmu/default.mak | 2 - .../devices/microblazeel-softmmu/default.mak | 5 +- hw/microblaze/boot.h | 4 +- target/microblaze/cpu.h | 7 ++ hw/char/xilinx_uartlite.c | 8 ++- hw/intc/xilinx_intc.c | 23 +++++-- hw/microblaze/boot.c | 8 +-- hw/microblaze/petalogix_ml605_mmu.c | 11 ++- hw/microblaze/petalogix_s3adsp1800_mmu.c | 67 +++++++++++++++++-- hw/microblaze/xlnx-zynqmp-pmu.c | 12 ++-- hw/net/xilinx_ethlite.c | 28 ++++++-- hw/timer/xilinx_timer.c | 15 +++-- target/microblaze/cpu.c | 2 +- target/microblaze/translate.c | 49 ++++++++------ .../functional/test_microblaze_s3adsp1800.py | 27 +++++++- .../test_microblazeel_s3adsp1800.py | 25 ++++++- 17 files changed, 236 insertions(+), 63 deletions(-) -- 2.45.2

7 71

[PATCH] docs: Clarify what source and name attributes of TPM profile describe
by Stefan Berger 30 Dec '24

30 Dec '24

Clarify what source and name attributes of TPM profile describe and update the version placeholder to the libvirt version when profiles were first supported, v10.10. Also mention that profiles with prefix 'custom:' in their name can be modified. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- docs/formatdomain.rst | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index 60bee8bd4f..0a56a96ea4 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -8303,27 +8303,32 @@ Example: usage of external TPM emulator :since:`Since 9.0.0` ``profile`` The ``profile`` node is used to set a profile for a TPM 2.0 given in the - source attribute. This profile will be set when the TPM is initially - created and after that cannot be changed anymore. Once a profile has been - set the name attribute will be updated with the name of the profile that - is running. If no profile is provided, then swtpm will use the latest - built-in 'default' profile or the default profile set in swtpm_setup.conf. - Otherwise swtpm_setup will search for a profile with the given name with - appended .json suffix in a configurable local and then in a distro - directory. If none could be found in either, it will fall back trying to - use a built-in one. + ``source`` attribute. This attribute describes the name of the file under + which the profile is stored, e.g. 'local:restricted' describes a locally + created profile with name 'restricted.json' that is found in the directory + pointed to by swtpm_setup.conf's local_profiles_dir. This profile will be set + when the TPM is initially created and after that the profile cannot be + changed anymore. Once a profile has been set, the ``name`` attribute will be + updated with the profile's name from its JSON description, for example + 'custom:restricted'. If no profile is provided, then swtpm will use the + latest built-in 'default' profile or the default profile set in + swtpm_setup.conf. Otherwise swtpm_setup will search for a profile with the + given name with appended .json suffix in a configurable local and then in a + distro directory. If none could be found in either, it will fall back trying + to use a built-in one. The built-in 'null' profile provides backwards compatibility with libtpms v0.9 but also restricts the user to use only TPM features that were - available at the time of libtpms v0.9. The built-in 'custom' profile is the - only profile that a user can modify and where the ``removeDisabled`` + available at the time of libtpms v0.9. The built-in 'custom' profile, or + those with the prefix 'custom:' in the name, are the + only profiles that a user can modify and where the ``removeDisabled`` attribute has any effect. This attribute is particularly useful when a host is running in FIPS mode and therefore some crypto algorithms (camellia, tdes, unpadded RSA encryption, 1024-bit RSA keys, and others) are disabled. When it is set to ``check`` (recommended) then only those algorithms that are currently disabled will automatically be removed from the 'custom' profile, while when it is set to ``fips-host`` then all - potentially disabled algorithms will be removed. :since:`Since 10.??.0` + potentially disabled algorithms will be removed. :since:`Since 10.10.0` TPM profiles provided by a distro can be referenced with the 'distro:' prefix. Locally created TPM profiles can be referenced with the -- 2.47.1

2 1

[PATCH 0/1] RFC: Add Arm CCA support for getting capability information and running Realm VM
by Akio Kakuno 27 Dec '24

27 Dec '24

Hi, all. - This patch adds Arm CCA support to qemu driver for aarch64 system. CCA is an abbreviation for Arm Confidential Compute Architecture feature, it enhances the virtualization capabilities of the platform by separating the management of resources from access to those resources. - We are not yet at the stage where we can merge this patch as host linux/qemu suppor is no yet merged, but I would like to receive reviews and comments on the overall direction. [summary] - At this stage, all you can do is getting the CCA capability with the virsh domcapabilities command and start the CCA VM with the virsh create command. - capability info uses qemu QMP to query qemu options. The option that exists now is for selecting a hash algorithm. [Capability example] - Execution results of 'virsh domcapability" on qemu <domaincapabilities> ... <features> ... </sgx> <cca supported='yes'> <enum name='measurement-algo'> <value>sha256</value> <value>sha512</value> </enum> </cca> <hyperv supported='yes'> ... </features> </domaincapabilities> [XML example] <domain> ... <launchsecurity type='cca'> <measurement-algo>sha256</measurement-algo> </launchsecurity> ... </domain> [limitations/tests] - To obtain capability info, it is necessary to support the qemu QMP command, which qemu does not yet support. Therefore, I put a hack in the code at hand and only confirmed the communication. Also, I think we should check whether CPUFW supports CCA or not in qemu_firmware.c, but it is not yet implemented. - Verified that the CCA VM can be started from virsh create command. [software version] - I followed the steps in Linaro's blog below. https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/Building+an… - The Qemu used was based on Linaro's qemu(9.1.91). https://git.codelinaro.org/linaro/dcap/qemu/-/tree/cca/v3?ref_type=heads Signed-off-by: Akio Kakuno <fj3333bs(a)fujitsu.com> Best Regards. Akio Kakuno (1): RFC: Add Arm CCA support for getting capability information and running Realm VM docs/formatdomain.rst | 28 ++++++ docs/formatdomaincaps.rst | 26 ++++- src/conf/domain_capabilities.c | 41 ++++++++ src/conf/domain_capabilities.h | 12 +++ src/conf/domain_conf.c | 13 +++ src/conf/domain_conf.h | 7 ++ src/conf/schemas/domaincaps.rng | 14 +++ src/conf/schemas/domaincommon.rng | 14 +++ src/conf/virconftypes.h | 2 + src/libvirt_private.syms | 1 + src/qemu/qemu_capabilities.c | 156 ++++++++++++++++++++++++++++++ src/qemu/qemu_capabilities.h | 4 + src/qemu/qemu_cgroup.c | 2 + src/qemu/qemu_command.c | 32 ++++++ src/qemu/qemu_driver.c | 2 + src/qemu/qemu_monitor.c | 10 ++ src/qemu/qemu_monitor.h | 3 + src/qemu/qemu_monitor_json.c | 104 ++++++++++++++++++++ src/qemu/qemu_monitor_json.h | 4 + src/qemu/qemu_namespace.c | 2 + src/qemu/qemu_process.c | 4 + src/qemu/qemu_validate.c | 7 ++ 22 files changed, 487 insertions(+), 1 deletion(-) -- I previously posted this on the 25th, but it appears it didn't reach the mailing list. Apologies for any duplication. 2.34.1

1 1

[PATCH 0/3] docs: Trivial cleanups
by Philippe Mathieu-Daudé 22 Dec '24

22 Dec '24

Philippe Mathieu-Daudé (3): docs: Correct '-runas' and '-fsdev/-virtfs proxy' indentation docs: Correct release of TCG trace-events removal docs: Replace 'since' -> 'removed in' in removed-features.rst docs/about/deprecated.rst | 2 +- docs/about/removed-features.rst | 24 ++++++++++++------------ 2 files changed, 13 insertions(+), 13 deletions(-) -- 2.47.1

3 7

[RFC v2 PATCH 0/4] iproute2 bridge vlan support
by Leigh Brown 22 Dec '24

22 Dec '24

I have not had any feedback, but have been using this myself and it works very nicely for me. I have updated the patch series to allow vlans to be specified in network/portgroup definitions and that functionality is working well. All feedback gratefully received. Description ----------- The iproute2 bridge command supports the capability for VLAN filtering that allows each interface connected to a standard linux bridge to be configured to use one or more VLANs. For simple setups, this capability is enough to allow virtual machines or containers to be put onto separate VLANs without creating multiple bridges and VLANs on the host. The first patch adds a new function virNetDevBridgeSetupVlans() that will, given a virNetDevVlan structure, execute the required bridge vlan commands to configure the given interface accordingly. The second patch updates the virNetDevBridgeAddPort() function to allow a virNetDevVlan parameter to be passed, and to call the virNetDevBridgeSetupVlans() function. The third patch updates the lxc and tap code to pass the virNetDevLan parameter from the configuration and to update the XML domain and network validation to permit the VLAN-related tags for standard bridges. The fourth patch updates documentation to match the new capability. Changes since v1 ---------------- - Fix bug in virNetDevSetupVlans where bridge port has no native vlan. - Update bridge network validation to permit vlan configuration. - Update documentation to match the functionality. - Tweak some of the commit descriptions for clarity. Usage example ------------- Configure the host with systemd-networkd as follows: /etc/systemd/network/br0.netdev (br0.network not shown) [NetDev] Name=br0 Kind=bridge MACAddress=xx:xx:xx:xx:xx:xx [Bridge] VLANFiltering=on /etc/systemd/network/eno1.network [Match] Name=eno1 [Network] Bridge=br0 [Link] MTUBytes=9000 [BridgeVLAN] VLAN=40 [BridgeVLAN] VLAN=60 Then add <vlan> tags into the lxc or qemu config: lxc interface definition: <interface type='bridge'> <mac address='xx:xx:xx:xx:xx:xx'/> <source bridge='br0'/> <vlan> <tag id='40'/> </vlan> </interface> qemu interface definition: <interface type='network'> <mac address='xx:xx:xx:xx:xx:xx'/> <source network='br0'/> <vlan> <tag id='60'/> </vlan> <model type='virtio'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </interface> Then, after starting them, you will see the following $ sudo bridge vlan port vlan-id eno1 1 PVID Egress Untagged 40 60 br0 1 PVID Egress Untagged vnet0 60 PVID Egress Untagged vnet1 40 PVID Egress Untagged Regards, Leigh Brown (4): util: Add virNetDevBridgeSetupVlans function util: Add vlan support to virNetDevBridgeAddPort Enable vlan support for standard linux bridges docs: standard linux bridges now support vlans docs/formatdomain.rst | 37 ++++++++++---------- docs/formatnetwork.rst | 45 ++++++++++++------------ meson.build | 1 + src/conf/domain_validate.c | 3 +- src/lxc/lxc_process.c | 3 +- src/network/bridge_driver.c | 13 ++++--- src/util/virnetdevbridge.c | 68 ++++++++++++++++++++++++++++++++++--- src/util/virnetdevbridge.h | 4 ++- src/util/virnetdevtap.c | 2 +- 9 files changed, 123 insertions(+), 53 deletions(-) -- 2.39.5

2 5

[PATCH 00/10] Enabling logging for ch guests
by Praveen K Paladugu 20 Dec '24

20 Dec '24

LogContext management is now moved from Qemu driver to hypervisor. After migrating Qemu to use domain_logcontext, I extended ch driver to use also use domain_logcontext to capture early boot failures within domain specific log files. Changes in V2: * refactored the patches to ensure all of them build. Praveen K Paladugu (10): hypervisor: copy qemu log context mgmt to hypervisor hypervisor: rename reference to qemu in domain_logcontext hypervisor: drop qemu specific args in domainLogContextNew hypervisor: Build domain_logcontext libvirt_private: export symbols from domain_logcontext qemu: Modify qemu driver to use domainLogContext qemu: delete qemu_logcontext files ch: Enable logging for ch domains ch: move curl_data and curl_callback definitions ch: Enable logging curl responses from ch po/POTFILES | 2 +- src/ch/ch_conf.h | 2 + src/ch/ch_monitor.c | 84 ++++++++++++------- src/ch/ch_monitor.h | 6 +- src/ch/ch_process.c | 36 ++++++-- .../domain_logcontext.c} | 78 +++++++++-------- src/hypervisor/domain_logcontext.h | 45 ++++++++++ src/hypervisor/meson.build | 1 + src/libvirt_private.syms | 6 ++ src/qemu/meson.build | 1 - src/qemu/qemu_domain.c | 28 +++---- src/qemu/qemu_domain.h | 12 +-- src/qemu/qemu_logcontext.h | 41 --------- src/qemu/qemu_nbdkit.c | 12 ++- src/qemu/qemu_process.c | 45 +++++----- 15 files changed, 235 insertions(+), 164 deletions(-) rename src/{qemu/qemu_logcontext.c => hypervisor/domain_logcontext.c} (79%) create mode 100644 src/hypervisor/domain_logcontext.h delete mode 100644 src/qemu/qemu_logcontext.h -- 2.47.0

2 12

[PATCH 0/2] Add more hyperv tlbflush features
by Martin Kletzander 20 Dec '24

20 Dec '24

That's about it... Martin Kletzander (2): conf, docs: Add support for direct and extended tlbflush features qemu: Add support for direct and extended tlbflush features docs/formatdomain.rst | 13 ++++++---- src/conf/domain_conf.c | 26 ++++++++++++++++++- src/conf/domain_conf.h | 2 ++ src/conf/schemas/domaincommon.rng | 21 ++++++++++++++- src/cpu/cpu_x86.c | 7 +++++ src/cpu/cpu_x86_data.h | 2 ++ src/qemu/qemu_command.c | 6 +++++ src/qemu/qemu_process.c | 24 +++++++++++++++++ .../qemuxmlconfdata/hyperv.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/hyperv.xml | 5 +++- 10 files changed, 99 insertions(+), 9 deletions(-) -- 2.47.1

2 3

[RFC PATCH 00/10] hw/misc/vmcoreinfo: Convert from QDev to plain Object
by Philippe Mathieu-Daudé 20 Dec '24

20 Dec '24

No reason for vmcoreinfo to be based on QDev, since it doesn't use any QDev API. Demote to plain Object. Since we can only register one type, introduce a new one for object: 'vmcore-info' (dash separator), keeping 'vmcoreinfo' device during the deprecation period. Philippe Mathieu-Daudé (10): hw/misc/vmcoreinfo: Declare QOM type using DEFINE_TYPES macro hw/misc/vmcoreinfo: Rename opaque pointer as 'opaque' hw/misc/vmcoreinfo: Un-inline vmcoreinfo_find() hw/misc/vmcoreinfo: Rename VMCOREINFO_DEVICE -> TYPE_VMCOREINFO_DEVICE hw/misc/vmcoreinfo: Convert to three-phase reset interface hw/misc/vmcoreinfo: Move vmstate_vmcoreinfo[] around hw/misc/vmcoreinfo: Factor vmcoreinfo_device_realize() out hw/misc/vmcoreinfo: Implement 'vmcore-info' object hw/misc/vmcoreinfo: Deprecate '-device vmcoreinfo' hw/misc/vmcoreinfo: Remove legacy '-device vmcoreinfo' docs/about/removed-features.rst | 5 + include/hw/misc/vmcoreinfo.h | 26 ++--- hw/misc/vmcoreinfo.c | 167 +++++++++++++++++++------------- 3 files changed, 116 insertions(+), 82 deletions(-) -- 2.47.1

4 21

[PATCH] qemu_capabilities: Avoid memleak in virQEMUCapsProbeFullDeprecatedProperties()
by Michal Privoznik 18 Dec '24

18 Dec '24

As one of its arguments, the virQEMUCapsProbeFullDeprecatedProperties() gets a pointer to GStrv (a string list), which it may eventually replace. It's single caller (virQEMUCapsProbeQMPHostCPU()) passes a string list indeed. Now, when replacing one string list with another plain g_free() is not enough as we need to free individual strings too. ==13573== 34 bytes in 8 blocks are definitely lost in loss record 271 of 576 ==13573== at 0x4844878: malloc (vg_replace_malloc.c:446) ==13573== by 0x51789D1: g_malloc (in /usr/lib64/libglib-2.0.so.0.7800.6) ==13573== by 0x5193E82: g_strdup (in /usr/lib64/libglib-2.0.so.0.7800.6) ==13573== by 0x4997F73: g_strdup_inline (gstrfuncs.h:321) ==13573== by 0x4997F73: virJSONValueArrayToStringList (virjson.c:1296) ==13573== by 0x5027CF7: qemuMonitorJSONParseCPUModelExpansion (qemu_monitor_json.c:5139) ==13573== by 0x50281C9: qemuMonitorJSONGetCPUModelExpansion (qemu_monitor_json.c:5245) ==13573== by 0x501044F: qemuMonitorGetCPUModelExpansion (qemu_monitor.c:3261) ==13573== by 0x4F190D0: virQEMUCapsProbeQMPHostCPU (qemu_capabilities.c:3227) ==13573== by 0x4F2145E: virQEMUCapsInitQMPMonitor (qemu_capabilities.c:5758) ==13573== by 0x10FFF8: testQemuCaps (qemucapabilitiestest.c:111) ==13573== by 0x110B53: virTestRun (testutils.c:143) ==13573== by 0x11063E: doCapsTest (qemucapabilitiestest.c:200) Fixes: 51c098347d7f2af9b4386ac0adc4431997d06f3d Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_capabilities.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index eda3e6a4df..27a283cff6 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -3176,7 +3176,7 @@ virQEMUCapsProbeFullDeprecatedProperties(qemuMonitor *mon, return -1; if (propsInfo && propsInfo->deprecated_props) { - g_free(*props); + g_strfreev(*props); *props = g_steal_pointer(&propsInfo->deprecated_props); } -- 2.45.2

2 1

[PATCH 0/3] src: fix virtnetworkd blocking (delaying) system shutdown
by Daniel P. Berrangé 18 Dec '24

18 Dec '24

We recently wired up inhibitors in the network driver to prevent auto-shutdown of libvirtd/virtnetworkd when virtual networks are active. This is to prevent the repeated re-creation of firewall rules which happens on daemon startup. Unfortunately we forgot that an inhibition on libvirt daemon shutdown *also* gets unconditionally turned into an inhibition on OS shutdown :-( In fixing this I realized this is actually the second such mistakes, because a few years ago we made the virtsecretd daemon inhibit when ephemeral secrets are present, and that really has no justification for blocking system shutdown either. Daniel P. Berrangé (3): util: introduce object for holding a system inhibitor lock src: convert drivers over to new virInhibitor APIs rpc: remove logind support for virNetDaemon po/POTFILES | 1 + src/libvirt_private.syms | 7 + src/libxl/libxl_conf.h | 9 +- src/libxl/libxl_domain.c | 6 +- src/libxl/libxl_driver.c | 15 ++- src/lxc/lxc_conf.h | 9 +- src/lxc/lxc_driver.c | 13 +- src/lxc/lxc_process.c | 9 +- src/network/bridge_driver.c | 20 +-- src/network/bridge_driver_conf.h | 9 +- src/qemu/qemu_conf.h | 9 +- src/qemu/qemu_driver.c | 12 +- src/qemu/qemu_process.c | 9 +- src/rpc/virnetdaemon.c | 78 ----------- src/secret/secret_driver.c | 46 +++---- src/util/meson.build | 1 + src/util/virinhibitor.c | 214 +++++++++++++++++++++++++++++++ src/util/virinhibitor.h | 58 +++++++++ 18 files changed, 361 insertions(+), 164 deletions(-) create mode 100644 src/util/virinhibitor.c create mode 100644 src/util/virinhibitor.h -- 2.46.0

2 5

[PATCH] qemu: Enable I/O APIC even more frequently
by Michal Privoznik 18 Dec '24

18 Dec '24

In my previous commit v10.10.0-48-g2d222ecf6e I've made us enable I/O APIC when there is an IOMMU with EIM. This works well. What does not work is case when there's just an IOMMU without EIM but with 256+ vCPUS. Problem is that post parsing happens in two stages: general domain post parse (where qemuDomainDefEnableDefaultFeatures() is called) and then per device post parse (where qemuDomainIOMMUDefPostParse() is called). Now, in aforementioned case it is the device post parse phase where EIM is enabled but the code that would enable VIR_DOMAIN_FEATURE_IOAPIC has already run. To resolve this, make the domain post parse callback "foresee" the future enabling of EIM so that it can turn on I/O APIC beforehand. Resolves: https://issues.redhat.com/browse/RHEL-65844 Fixes: 2d222ecf6e73614a400b830ac56e9aaa1bc55ecc Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_postparse.c | 21 +++++++++--- ...m-autoadd-v2.x86_64-latest.abi-update.args | 1 + ...im-autoadd-v2.x86_64-latest.abi-update.xml | 1 + .../intel-iommu-eim-autoadd-v2.xml | 32 +++++++++++++++++++ tests/qemuxmlconftest.c | 1 + 5 files changed, 51 insertions(+), 5 deletions(-) create mode 120000 tests/qemuxmlconfdata/intel-iommu-eim-autoadd-v2.x86_64-latest.abi-update.args create mode 120000 tests/qemuxmlconfdata/intel-iommu-eim-autoadd-v2.x86_64-latest.abi-update.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-eim-autoadd-v2.xml diff --git a/src/qemu/qemu_postparse.c b/src/qemu/qemu_postparse.c index 4fbd849ebf..34b95ece1b 100644 --- a/src/qemu/qemu_postparse.c +++ b/src/qemu/qemu_postparse.c @@ -783,6 +783,15 @@ qemuDomainPstoreDefPostParse(virDomainPstoreDef *pstore, } +static bool +qemuDomainNeedsIOMMUWithEIM(const virDomainDef *def) +{ + return ARCH_IS_X86(def->os.arch) && + virDomainDefGetVcpusMax(def) > QEMU_MAX_VCPUS_WITHOUT_EIM && + qemuDomainIsQ35(def); +} + + static int qemuDomainIOMMUDefPostParse(virDomainIOMMUDef *iommu, const virDomainDef *def, @@ -793,9 +802,7 @@ qemuDomainIOMMUDefPostParse(virDomainIOMMUDef *iommu, * (EIM) is not explicitly turned off, let's enable it. If we didn't then * guest will have troubles with interrupts. */ if (parseFlags & VIR_DOMAIN_DEF_PARSE_ABI_UPDATE && - ARCH_IS_X86(def->os.arch) && - virDomainDefGetVcpusMax(def) > QEMU_MAX_VCPUS_WITHOUT_EIM && - qemuDomainIsQ35(def) && + qemuDomainNeedsIOMMUWithEIM(def) && iommu && iommu->model == VIR_DOMAIN_IOMMU_MODEL_INTEL) { /* eim requires intremap. */ @@ -1548,9 +1555,13 @@ qemuDomainDefEnableDefaultFeatures(virDomainDef *def, def->features[VIR_DOMAIN_FEATURE_GIC] = VIR_TRISTATE_SWITCH_ON; } - /* IOMMU with intremap requires split I/O APIC */ + /* IOMMU with intremap requires split I/O APIC. But it may happen that + * domain already has IOMMU without inremap. This will be fixed in + * qemuDomainIOMMUDefPostParse() but there domain definition can't be + * modified so change it now. */ if (def->iommu && - def->iommu->intremap == VIR_TRISTATE_SWITCH_ON && + (def->iommu->intremap == VIR_TRISTATE_SWITCH_ON || + qemuDomainNeedsIOMMUWithEIM(def)) && def->features[VIR_DOMAIN_FEATURE_IOAPIC] == VIR_DOMAIN_IOAPIC_NONE) { def->features[VIR_DOMAIN_FEATURE_IOAPIC] = VIR_DOMAIN_IOAPIC_QEMU; } diff --git a/tests/qemuxmlconfdata/intel-iommu-eim-autoadd-v2.x86_64-latest.abi-update.args b/tests/qemuxmlconfdata/intel-iommu-eim-autoadd-v2.x86_64-latest.abi-update.args new file mode 120000 index 0000000000..a7fdee3d71 --- /dev/null +++ b/tests/qemuxmlconfdata/intel-iommu-eim-autoadd-v2.x86_64-latest.abi-update.args @@ -0,0 +1 @@ +intel-iommu-eim-autoadd.x86_64-latest.abi-update.args \ No newline at end of file diff --git a/tests/qemuxmlconfdata/intel-iommu-eim-autoadd-v2.x86_64-latest.abi-update.xml b/tests/qemuxmlconfdata/intel-iommu-eim-autoadd-v2.x86_64-latest.abi-update.xml new file mode 120000 index 0000000000..928ea1b4c8 --- /dev/null +++ b/tests/qemuxmlconfdata/intel-iommu-eim-autoadd-v2.x86_64-latest.abi-update.xml @@ -0,0 +1 @@ +intel-iommu-eim-autoadd.x86_64-latest.abi-update.xml \ No newline at end of file diff --git a/tests/qemuxmlconfdata/intel-iommu-eim-autoadd-v2.xml b/tests/qemuxmlconfdata/intel-iommu-eim-autoadd-v2.xml new file mode 100644 index 0000000000..b39ee55786 --- /dev/null +++ b/tests/qemuxmlconfdata/intel-iommu-eim-autoadd-v2.xml @@ -0,0 +1,32 @@ +<domain type='kvm'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>288</vcpu> + <os> + <type arch='x86_64' machine='q35'>hvm</type> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='pci' index='0' model='pcie-root'/> + <controller type='usb' index='0' model='none'/> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/> + </controller> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <iommu model="intel"/> + <audio id='1' type='none'/> + <watchdog model='itco' action='reset'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 23f1d9eab7..21b56dc94e 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -2774,6 +2774,7 @@ mymain(void) DO_TEST_CAPS_LATEST("intel-iommu-dma-translation"); DO_TEST_CAPS_LATEST_PARSE_ERROR("intel-iommu-wrong-machine"); DO_TEST_CAPS_LATEST_ABI_UPDATE("intel-iommu-eim-autoadd"); + DO_TEST_CAPS_LATEST_ABI_UPDATE("intel-iommu-eim-autoadd-v2"); DO_TEST_CAPS_ARCH_LATEST("iommu-smmuv3", "aarch64"); DO_TEST_CAPS_LATEST("virtio-iommu-x86_64"); DO_TEST_CAPS_VER_PARSE_ERROR("virtio-iommu-x86_64", "6.1.0"); -- 2.45.2

2 1

[PATCH 0/7] Add missing CPU features and GraniteRapids-v2 model supported by QEMU 9.2.0
by Jiri Denemark 18 Dec '24

18 Dec '24

Jiri Denemark (7): cpu_map: Add avx10* CPU features cpu_map: Add GraniteRapids-v2 CPU model cpu_map: Add sha512, sm3, and sm4 CPU features cpu_map: Add fdp-excptn-only CPU feature cpu_map: Add zero-fcs-fds CPU feature cpu_map: Add ibpb-brtype CPU feature cpu_map: Add missing CPU features src/cpu_map/index.xml | 1 + src/cpu_map/meson.build | 1 + src/cpu_map/x86_GraniteRapids-v2.xml | 206 ++++++++++++++++++ src/cpu_map/x86_features.xml | 70 ++++++ .../x86_64-cpuid-Atom-P5362-disabled.xml | 2 +- .../x86_64-cpuid-Atom-P5362-guest.xml | 2 + .../x86_64-cpuid-Atom-P5362-host.xml | 2 + .../x86_64-cpuid-Cooperlake-disabled.xml | 2 +- .../x86_64-cpuid-Cooperlake-guest.xml | 2 + .../x86_64-cpuid-Cooperlake-host.xml | 2 + .../x86_64-cpuid-Core-i5-4670T-disabled.xml | 2 +- .../x86_64-cpuid-Core-i5-4670T-guest.xml | 1 + .../x86_64-cpuid-Core-i5-4670T-host.xml | 1 + .../x86_64-cpuid-Core-i5-6600-disabled.xml | 2 +- .../x86_64-cpuid-Core-i5-6600-guest.xml | 1 + .../x86_64-cpuid-Core-i5-6600-host.xml | 1 + .../x86_64-cpuid-Core-i7-4510U-disabled.xml | 1 + .../x86_64-cpuid-Core-i7-4510U-guest.xml | 1 + .../x86_64-cpuid-Core-i7-4510U-host.xml | 1 + .../x86_64-cpuid-Core-i7-4600U-disabled.xml | 1 + .../x86_64-cpuid-Core-i7-4600U-guest.xml | 1 + .../x86_64-cpuid-Core-i7-4600U-host.xml | 1 + ...6_64-cpuid-Core-i7-5600U-arat-disabled.xml | 2 +- .../x86_64-cpuid-Core-i7-5600U-arat-guest.xml | 1 + .../x86_64-cpuid-Core-i7-5600U-arat-host.xml | 1 + .../x86_64-cpuid-Core-i7-5600U-disabled.xml | 2 +- .../x86_64-cpuid-Core-i7-5600U-guest.xml | 1 + .../x86_64-cpuid-Core-i7-5600U-host.xml | 1 + ...6_64-cpuid-Core-i7-5600U-ibrs-disabled.xml | 2 +- .../x86_64-cpuid-Core-i7-5600U-ibrs-guest.xml | 1 + .../x86_64-cpuid-Core-i7-5600U-ibrs-host.xml | 1 + .../x86_64-cpuid-Core-i7-7600U-disabled.xml | 2 +- .../x86_64-cpuid-Core-i7-7600U-guest.xml | 1 + .../x86_64-cpuid-Core-i7-7600U-host.xml | 1 + .../x86_64-cpuid-Core-i7-7700-disabled.xml | 2 +- .../x86_64-cpuid-Core-i7-7700-guest.xml | 1 + .../x86_64-cpuid-Core-i7-7700-host.xml | 1 + .../x86_64-cpuid-Core-i7-8550U-disabled.xml | 2 +- .../x86_64-cpuid-Core-i7-8550U-guest.xml | 1 + .../x86_64-cpuid-Core-i7-8550U-host.xml | 1 + .../x86_64-cpuid-Core-i7-8700-disabled.xml | 2 +- .../x86_64-cpuid-Core-i7-8700-guest.xml | 1 + .../x86_64-cpuid-Core-i7-8700-host.xml | 1 + .../x86_64-cpuid-Ice-Lake-Server-disabled.xml | 2 +- .../x86_64-cpuid-Ice-Lake-Server-guest.xml | 2 + .../x86_64-cpuid-Ice-Lake-Server-host.xml | 2 + .../x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml | 2 +- .../x86_64-cpuid-Xeon-E3-1225-v5-guest.xml | 1 + .../x86_64-cpuid-Xeon-E3-1225-v5-host.xml | 1 + .../x86_64-cpuid-Xeon-E3-1245-v5-disabled.xml | 2 +- .../x86_64-cpuid-Xeon-E3-1245-v5-guest.xml | 1 + .../x86_64-cpuid-Xeon-E3-1245-v5-host.xml | 1 + .../x86_64-cpuid-Xeon-E5-2609-v3-disabled.xml | 2 +- .../x86_64-cpuid-Xeon-E5-2609-v3-guest.xml | 1 + .../x86_64-cpuid-Xeon-E5-2609-v3-host.xml | 1 + .../x86_64-cpuid-Xeon-E5-2623-v4-disabled.xml | 2 +- .../x86_64-cpuid-Xeon-E5-2623-v4-guest.xml | 1 + .../x86_64-cpuid-Xeon-E5-2623-v4-host.xml | 1 + .../x86_64-cpuid-Xeon-E5-2630-v3-disabled.xml | 2 +- .../x86_64-cpuid-Xeon-E5-2630-v3-guest.xml | 1 + .../x86_64-cpuid-Xeon-E5-2630-v3-host.xml | 1 + .../x86_64-cpuid-Xeon-E5-2630-v4-disabled.xml | 2 +- .../x86_64-cpuid-Xeon-E5-2630-v4-guest.xml | 1 + .../x86_64-cpuid-Xeon-E5-2630-v4-host.xml | 1 + .../x86_64-cpuid-Xeon-E5-2650-v3-disabled.xml | 2 +- .../x86_64-cpuid-Xeon-E5-2650-v3-guest.xml | 1 + .../x86_64-cpuid-Xeon-E5-2650-v3-host.xml | 1 + .../x86_64-cpuid-Xeon-E5-2650-v4-disabled.xml | 2 +- .../x86_64-cpuid-Xeon-E5-2650-v4-guest.xml | 1 + .../x86_64-cpuid-Xeon-E5-2650-v4-host.xml | 1 + .../x86_64-cpuid-Xeon-E7-8890-v3-disabled.xml | 2 +- .../x86_64-cpuid-Xeon-E7-8890-v3-guest.xml | 1 + .../x86_64-cpuid-Xeon-E7-8890-v3-host.xml | 1 + .../x86_64-cpuid-Xeon-Gold-5115-disabled.xml | 2 +- .../x86_64-cpuid-Xeon-Gold-5115-guest.xml | 2 + .../x86_64-cpuid-Xeon-Gold-5115-host.xml | 2 + .../x86_64-cpuid-Xeon-Gold-6130-disabled.xml | 2 +- .../x86_64-cpuid-Xeon-Gold-6130-guest.xml | 2 + .../x86_64-cpuid-Xeon-Gold-6130-host.xml | 2 + .../x86_64-cpuid-Xeon-Gold-6148-disabled.xml | 2 +- .../x86_64-cpuid-Xeon-Gold-6148-guest.xml | 2 + .../x86_64-cpuid-Xeon-Gold-6148-host.xml | 2 + ...6_64-cpuid-Xeon-Platinum-8268-disabled.xml | 2 +- .../x86_64-cpuid-Xeon-Platinum-8268-guest.xml | 2 + .../x86_64-cpuid-Xeon-Platinum-8268-host.xml | 2 + ...6_64-cpuid-Xeon-Platinum-9242-disabled.xml | 2 +- .../x86_64-cpuid-Xeon-Platinum-9242-guest.xml | 2 + .../x86_64-cpuid-Xeon-Platinum-9242-host.xml | 2 + .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 58 +++++ .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 47 ++++ tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 58 +++++ ...host-model-fallback-kvm.x86_64-latest.args | 2 +- ...cpu-host-model-features.x86_64-latest.args | 2 +- .../cpu-host-model-kvm.x86_64-latest.args | 2 +- ...st-model-nofallback-kvm.x86_64-latest.args | 2 +- 95 files changed, 545 insertions(+), 30 deletions(-) create mode 100644 src/cpu_map/x86_GraniteRapids-v2.xml -- 2.47.1

2 8

[PATCH 0/3] qemu: Call migrate-incoming with exit-on-error=false
by Jiri Denemark 18 Dec '24

18 Dec '24

See 3/3 for details. Jiri Denemark (3): qemu: Detect exit-on-error argument of migrate-incoming qemu: Replace qemuDomainCheckMonitor with qemuMigrationJobCheckStatus qemu: Call migrate-incoming with exit-on-error=false src/qemu/qemu_capabilities.c | 4 ++++ src/qemu/qemu_capabilities.h | 3 +++ src/qemu/qemu_domain.c | 18 ------------------ src/qemu/qemu_domain.h | 3 --- src/qemu/qemu_migration.c | 16 ++++++++++++---- src/qemu/qemu_monitor.c | 16 +++++----------- src/qemu/qemu_monitor.h | 4 ++-- src/qemu/qemu_monitor_json.c | 4 +++- src/qemu/qemu_monitor_json.h | 3 ++- .../caps_9.1.0_riscv64.xml | 1 + .../qemucapabilitiesdata/caps_9.1.0_s390x.xml | 1 + .../qemucapabilitiesdata/caps_9.1.0_x86_64.xml | 1 + .../qemucapabilitiesdata/caps_9.2.0_s390x.xml | 1 + .../qemucapabilitiesdata/caps_9.2.0_x86_64.xml | 1 + 14 files changed, 36 insertions(+), 40 deletions(-) -- 2.47.1

2 4

[PATCH] src: drop obsolete checks for virDomainConfigFile failure
by Daniel P. Berrangé 18 Dec '24

18 Dec '24

This cannot ever return NULL Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/bhyve/bhyve_driver.c | 6 ++---- src/conf/domain_conf.c | 7 ++----- src/conf/virdomainobjlist.c | 9 +++------ src/libxl/libxl_driver.c | 6 ++---- src/lxc/lxc_controller.c | 4 +--- src/lxc/lxc_driver.c | 10 ++-------- src/qemu/qemu_driver.c | 22 ++++++---------------- 7 files changed, 18 insertions(+), 46 deletions(-) diff --git a/src/bhyve/bhyve_driver.c b/src/bhyve/bhyve_driver.c index 2bd1e4c387..8f97ac032c 100644 --- a/src/bhyve/bhyve_driver.c +++ b/src/bhyve/bhyve_driver.c @@ -364,10 +364,8 @@ bhyveDomainSetAutostart(virDomainPtr domain, int autostart) autostart = (autostart != 0); if (vm->autostart != autostart) { - if ((configFile = virDomainConfigFile(BHYVE_CONFIG_DIR, vm->def->name)) == NULL) - goto cleanup; - if ((autostartLink = virDomainConfigFile(BHYVE_AUTOSTART_DIR, vm->def->name)) == NULL) - goto cleanup; + configFile = virDomainConfigFile(BHYVE_CONFIG_DIR, vm->def->name); + autostartLink = virDomainConfigFile(BHYVE_AUTOSTART_DIR, vm->def->name); if (autostart) { if (g_mkdir_with_parents(BHYVE_AUTOSTART_DIR, 0777) < 0) { diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 4ad8289b89..cae5ba9df1 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -29060,11 +29060,8 @@ virDomainDeleteConfig(const char *configDir, g_autofree char *configFile = NULL; g_autofree char *autostartLink = NULL; - if ((configFile = virDomainConfigFile(configDir, dom->def->name)) == NULL) - return -1; - if ((autostartLink = virDomainConfigFile(autostartDir, - dom->def->name)) == NULL) - return -1; + configFile = virDomainConfigFile(configDir, dom->def->name); + autostartLink = virDomainConfigFile(autostartDir, dom->def->name); /* Not fatal if this doesn't work */ unlink(autostartLink); diff --git a/src/conf/virdomainobjlist.c b/src/conf/virdomainobjlist.c index 166bbc5cfd..72207450c5 100644 --- a/src/conf/virdomainobjlist.c +++ b/src/conf/virdomainobjlist.c @@ -492,16 +492,14 @@ virDomainObjListLoadConfig(virDomainObjList *doms, int autostart; g_autoptr(virDomainDef) oldDef = NULL; - if ((configFile = virDomainConfigFile(configDir, name)) == NULL) - return NULL; + configFile = virDomainConfigFile(configDir, name); if (!(def = virDomainDefParseFile(configFile, xmlopt, NULL, VIR_DOMAIN_DEF_PARSE_INACTIVE | VIR_DOMAIN_DEF_PARSE_SKIP_VALIDATE | VIR_DOMAIN_DEF_PARSE_ALLOW_POST_PARSE_FAIL))) return NULL; - if ((autostartLink = virDomainConfigFile(autostartDir, name)) == NULL) - return NULL; + autostartLink = virDomainConfigFile(autostartDir, name); autostart = virFileLinkPointsTo(autostartLink, configFile); @@ -529,8 +527,7 @@ virDomainObjListLoadStatus(virDomainObjList *doms, virDomainObj *obj = NULL; char uuidstr[VIR_UUID_STRING_BUFLEN]; - if ((statusFile = virDomainConfigFile(statusDir, name)) == NULL) - goto error; + statusFile = virDomainConfigFile(statusDir, name); if (!(obj = virDomainObjParseFile(statusFile, xmlopt, VIR_DOMAIN_DEF_PARSE_STATUS | diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index e72553603d..b8f721351c 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -4651,10 +4651,8 @@ libxlDomainSetAutostart(virDomainPtr dom, int autostart) autostart = (autostart != 0); if (vm->autostart != autostart) { - if (!(configFile = virDomainConfigFile(cfg->configDir, vm->def->name))) - goto endjob; - if (!(autostartLink = virDomainConfigFile(cfg->autostartDir, vm->def->name))) - goto endjob; + configFile = virDomainConfigFile(cfg->configDir, vm->def->name); + autostartLink = virDomainConfigFile(cfg->autostartDir, vm->def->name); if (autostart) { if (g_mkdir_with_parents(cfg->autostartDir, 0777) < 0) { diff --git a/src/lxc/lxc_controller.c b/src/lxc/lxc_controller.c index 7b432a1160..fb7f8e0bc2 100644 --- a/src/lxc/lxc_controller.c +++ b/src/lxc/lxc_controller.c @@ -196,9 +196,7 @@ static virLXCController *virLXCControllerNew(const char *name) if (!(driver = virLXCControllerDriverNew())) goto error; - if ((configFile = virDomainConfigFile(LXC_STATE_DIR, - ctrl->name)) == NULL) - goto error; + configFile = virDomainConfigFile(LXC_STATE_DIR, ctrl->name); if ((ctrl->vm = virDomainObjParseFile(configFile, driver->xmlopt, diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index 2488940feb..b1a355794c 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -2430,14 +2430,8 @@ static int lxcDomainSetAutostart(virDomainPtr dom, goto endjob; } - configFile = virDomainConfigFile(cfg->configDir, - vm->def->name); - if (configFile == NULL) - goto endjob; - autostartLink = virDomainConfigFile(cfg->autostartDir, - vm->def->name); - if (autostartLink == NULL) - goto endjob; + configFile = virDomainConfigFile(cfg->configDir, vm->def->name); + autostartLink = virDomainConfigFile(cfg->autostartDir, vm->def->name); if (autostart) { if (g_mkdir_with_parents(cfg->autostartDir, 0777) < 0) { diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 672b42b44e..72d6b627f9 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -7784,12 +7784,8 @@ static int qemuDomainSetAutostart(virDomainPtr dom, if (virDomainObjBeginJob(vm, VIR_JOB_MODIFY) < 0) goto cleanup; - if (!(configFile = virDomainConfigFile(cfg->configDir, vm->def->name))) - goto endjob; - - if (!(autostartLink = virDomainConfigFile(cfg->autostartDir, - vm->def->name))) - goto endjob; + configFile = virDomainConfigFile(cfg->configDir, vm->def->name); + autostartLink = virDomainConfigFile(cfg->autostartDir, vm->def->name); if (autostart) { if (g_mkdir_with_parents(cfg->autostartDir, 0777) < 0) { @@ -18339,21 +18335,15 @@ qemuDomainRenameCallback(virDomainObj *vm, new_dom_name = g_strdup(new_name); - if (!(new_dom_cfg_file = virDomainConfigFile(cfg->configDir, - new_dom_name)) || - !(old_dom_cfg_file = virDomainConfigFile(cfg->configDir, - vm->def->name))) - return -1; + new_dom_cfg_file = virDomainConfigFile(cfg->configDir, new_dom_name); + old_dom_cfg_file = virDomainConfigFile(cfg->configDir, vm->def->name); if (qemuDomainNamePathsCleanup(cfg, new_name, false) < 0) goto cleanup; if (vm->autostart) { - if (!(new_dom_autostart_link = virDomainConfigFile(cfg->autostartDir, - new_dom_name)) || - !(old_dom_autostart_link = virDomainConfigFile(cfg->autostartDir, - vm->def->name))) - return -1; + new_dom_autostart_link = virDomainConfigFile(cfg->autostartDir, new_dom_name); + old_dom_autostart_link = virDomainConfigFile(cfg->autostartDir, vm->def->name); if (symlink(new_dom_cfg_file, new_dom_autostart_link) < 0) { virReportSystemError(errno, -- 2.46.0

2 1

[PATCH 0/3] Addng POWER11 cpu support
by Narayana Murty N 17 Dec '24

17 Dec '24

This patch series includes the changes needed to support POWER11 cpu and POWER11 host on libvirt. Patch also adds and updates the qemu caps with the latest qemu for the caps tests to include POWER11. Patch 0001: Add POWER11 cpu model support. Patch 0002: Add POWER11 host model support. Patch 0003: Add qemu and domain test capabilities test support. The respective patches for linux kernel and qemu already in upstream and links are provided below. Linux kernel patches: 1. Linux P11 support: commit id c2ed087ed35c ("powerpc: Add Power11 architected and raw mode") 2. Linux P11 KVM support: commit id 96e266e3bcd6 ("KVM: PPC: Book3S HV: Add Power11 capability support for Nested PAPR guests") Qemu patches: 3. Qemu P11 support: commit id 273db89bcaf4 ("ppc/pseries: Add Power11 cpu type) 4. Qemu P11 DD02.0 support: commit id c0d964076c3e (target/ppc: Add Power11 DD2.0 processor) Signed-off-by: Narayana Murty N <nnmlinux(a)linux.vnet.ibm.com> Narayana Murty N (3): cpu_map: Add POWER11 cpu model support cpu_ppc64: Add POWER11 host-model support tests: Qemu and domain capabilities tests for Power11 src/cpu/cpu_ppc64.c | 8 +- src/cpu_map/index.xml | 1 + src/cpu_map/meson.build | 1 + src/cpu_map/ppc64_POWER11.xml | 6 + tests/domaincapsdata/qemu_9.2.0.ppc64.xml | 183 + .../caps_9.2.0_ppc64.replies | 38704 ++++++++++++++++ .../qemucapabilitiesdata/caps_9.2.0_ppc64.xml | 1077 + ...eries-cpu-compat-power11.ppc64-latest.args | 31 + ...series-cpu-compat-power11.ppc64-latest.err | 1 + ...series-cpu-compat-power11.ppc64-latest.xml | 29 + .../pseries-cpu-compat-power11.xml | 19 + tests/qemuxmlconftest.c | 4 + tests/testutilshostcpus.h | 11 + tests/testutilsqemu.c | 4 + tests/testutilsqemu.h | 1 + 15 files changed, 40076 insertions(+), 4 deletions(-) create mode 100644 src/cpu_map/ppc64_POWER11.xml create mode 100644 tests/domaincapsdata/qemu_9.2.0.ppc64.xml create mode 100644 tests/qemucapabilitiesdata/caps_9.2.0_ppc64.replies create mode 100644 tests/qemucapabilitiesdata/caps_9.2.0_ppc64.xml create mode 100644 tests/qemuxmlconfdata/pseries-cpu-compat-power11.ppc64-latest.args create mode 100644 tests/qemuxmlconfdata/pseries-cpu-compat-power11.ppc64-latest.err create mode 100644 tests/qemuxmlconfdata/pseries-cpu-compat-power11.ppc64-latest.xml create mode 100644 tests/qemuxmlconfdata/pseries-cpu-compat-power11.xml -- 2.47.1

2 4

[PATCH v3 0/7] Allow Guest CPU Model with Deprecated Features Disabled
by Collin Walling 17 Dec '24

17 Dec '24

# Changelog v3 - added reviewed-by's on appropriate patches - split patch #4 into three: - domain API (libvirt-domain: introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES) - qemu (qemu_capabilities: filter deprecated features if requested) - virsh (virsh: add --disable-deprecated-features flag to domcapabilities) - Note: no functional change, patches were split based on changes to certain files - @Jiri, let me know if this is what you had in mind, I found it difficult to find a good reference - fixed deprecated_props array missing +1 in qemuJSONMonitor* functions - condensed cputypes schema for deprecated_features - added validation in qemu_process to check if QEMU cap is present - added qemuxmlconf tests - updated version tags to 11.0.0 v2 - rebased on latest master changes # Description Add support for libvirt to query and cache an array of deprecated CPU features (aka CPU properties) for the host-model. This data is queried via a full query-cpu-model-expansion and cached in the QEMU capabilities file. This model expansion will depend on the availability of the "deprecated-props" field resulting from a query-cpu-model-expansion command. Currently, only s390x supports this field. The purpose of these patches is to make it easy for users to create guests with a CPU model that will be compatible & migratable with future hardware. An updated host CPU model with deprecated features paired with the policy "disable" may be visable via an update to the virsh domcapabilities command with the --disable-deprecated-features flag. An example is shown below. Note: other CPU model queries (e.g. baseline and comparison) currently do not consider deprecated features, as their outputs do not consider feature policy. If implementation is desired, it will require a discussion on how these commands should report policies. Examples: virsh domcapabilities --disable-deprecated-features e.g. output (trimmed): <mode name='host-model' supported='yes'> <model fallback='forbid'>z14.2-base</model> <feature policy='require' name='aen'/> <feature policy='require' name='cmmnt'/> <feature policy='require' name='aefsi'/> <feature policy='require' name='diag318'/> <feature policy='require' name='mepoch'/> <feature policy='require' name='msa8'/> <feature policy='require' name='msa7'/> <feature policy='require' name='msa6'/> <feature policy='require' name='msa5'/> <feature policy='require' name='msa4'/> <feature policy='require' name='msa3'/> <feature policy='require' name='msa2'/> <feature policy='require' name='msa1'/> <feature policy='require' name='sthyi'/> <feature policy='require' name='edat'/> <feature policy='require' name='ri'/> <feature policy='require' name='edat2'/> <feature policy='require' name='etoken'/> <feature policy='require' name='vx'/> <feature policy='require' name='ipter'/> <feature policy='require' name='mepochptff'/> <feature policy='require' name='ap'/> <feature policy='require' name='vxeh'/> <feature policy='require' name='vxpd'/> <feature policy='require' name='esop'/> <feature policy='require' name='apqi'/> <feature policy='require' name='apft'/> <feature policy='require' name='els'/> <feature policy='require' name='iep'/> <feature policy='require' name='apqci'/> <feature policy='disable' name='cte'/> <feature policy='require' name='ais'/> <feature policy='disable' name='bpb'/> <feature policy='require' name='ctop'/> <feature policy='require' name='gs'/> <feature policy='require' name='ppa15'/> <feature policy='require' name='zpci'/> <feature policy='require' name='sea_esop2'/> <feature policy='disable' name='te'/> <feature policy='require' name='cmm'/> <feature policy='disable' name='csske'/> </mode> A domain may be defined with a new <cpu> XML attribute, deprecated_features='on|off': <cpu mode='host-model' check='partial' deprecated_features='off'/> e.g. after guest has started (trimmed): <cpu mode='custom' match='exact' check='partial' deprecated_features='off'> <model fallback='forbid'>z14.2-base</model> <feature policy='require' name='aen'/> <feature policy='require' name='cmmnt'/> <feature policy='require' name='aefsi'/> <feature policy='require' name='diag318'/> <feature policy='require' name='mepoch'/> <feature policy='require' name='msa8'/> <feature policy='require' name='msa7'/> <feature policy='require' name='msa6'/> <feature policy='require' name='msa5'/> <feature policy='require' name='msa4'/> <feature policy='require' name='msa3'/> <feature policy='require' name='msa2'/> <feature policy='require' name='msa1'/> <feature policy='require' name='sthyi'/> <feature policy='require' name='edat'/> <feature policy='require' name='ri'/> <feature policy='require' name='edat2'/> <feature policy='require' name='etoken'/> <feature policy='require' name='vx'/> <feature policy='require' name='ipter'/> <feature policy='require' name='mepochptff'/> <feature policy='require' name='ap'/> <feature policy='require' name='vxeh'/> <feature policy='require' name='vxpd'/> <feature policy='require' name='esop'/> <feature policy='require' name='apqi'/> <feature policy='require' name='apft'/> <feature policy='require' name='els'/> <feature policy='require' name='iep'/> <feature policy='require' name='apqci'/> <feature policy='disable' name='cte'/> <feature policy='require' name='ais'/> <feature policy='disable' name='bpb'/> <feature policy='require' name='ctop'/> <feature policy='require' name='gs'/> <feature policy='require' name='ppa15'/> <feature policy='require' name='zpci'/> <feature policy='require' name='sea_esop2'/> <feature policy='disable' name='te'/> <feature policy='require' name='cmm'/> <feature policy='disable' name='csske'/> </cpu> Collin Walling (7): qemuMonitorJSONGetCPUModelExpansion: refactor parsing functions qemu: parse deprecated-props from query-cpu-model-expansion response qemu_capabilities: query deprecated features for host-model libvirt-domain: introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES qemu_capabilities: filter deprecated features if requested virsh: add --disable-deprecated-features flag to domcapabilities conf: add deprecated_features attribute docs/manpages/virsh.rst | 6 + include/libvirt/libvirt-domain.h | 12 + src/conf/cpu_conf.c | 11 + src/conf/cpu_conf.h | 1 + src/conf/schemas/cputypes.rng | 5 + src/libvirt-domain.c | 2 +- src/qemu/qemu_capabilities.c | 89 +++++ src/qemu/qemu_capabilities.h | 4 + src/qemu/qemu_driver.c | 8 +- src/qemu/qemu_monitor.c | 7 + src/qemu/qemu_monitor.h | 1 + src/qemu/qemu_monitor_json.c | 64 +++- src/qemu/qemu_process.c | 11 + .../caps_9.1.0_s390x.replies | 348 +++++++++++++++++- .../qemucapabilitiesdata/caps_9.1.0_s390x.xml | 13 + .../caps_9.2.0_s390x.replies | 348 +++++++++++++++++- .../qemucapabilitiesdata/caps_9.2.0_s390x.xml | 13 + ...el-deprecated-features-off.s390x-8.2.0.err | 1 + ...el-deprecated-features-off.s390x-8.2.0.xml | 25 ++ ...-deprecated-features-off.s390x-latest.args | 32 ++ ...l-deprecated-features-off.s390x-latest.xml | 25 ++ .../cpu-model-deprecated-features-off.xml | 15 + tests/qemuxmlconftest.c | 3 + tools/virsh-host.c | 9 +- 24 files changed, 1039 insertions(+), 14 deletions(-) create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-8.2.0.err create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-8.2.0.xml create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-off.xml -- 2.47.1

2 10

[PATCH] Fix a few typos in error messages
by Jiri Denemark 17 Dec '24

17 Dec '24

Fixes: https://gitlab.com/libvirt/libvirt/-/issues/722 Reported-by: Göran Uddeborg <goeran(a)uddeborg.se> Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/esx/esx_vi.c | 2 +- src/network/bridge_driver_conf.c | 2 +- src/qemu/qemu_postparse.c | 2 +- src/security/security_apparmor.c | 2 +- src/vz/vz_sdk.c | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/esx/esx_vi.c b/src/esx/esx_vi.c index 3ecd406e1d..e2589aa69a 100644 --- a/src/esx/esx_vi.c +++ b/src/esx/esx_vi.c @@ -370,7 +370,7 @@ esxVI_CURL_Download(esxVI_CURL *curl, const char *url, char **content, */ if (*length > INT32_MAX / 2) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("Download length it too large")); + _("Download length is too large")); return -1; } diff --git a/src/network/bridge_driver_conf.c b/src/network/bridge_driver_conf.c index 4e40286ee3..738652390f 100644 --- a/src/network/bridge_driver_conf.c +++ b/src/network/bridge_driver_conf.c @@ -97,7 +97,7 @@ virNetworkLoadDriverConfig(virNetworkDriverConfig *cfg G_GNUC_UNUSED, if (fwBackends[0] < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, - _("unrecognized 'firewall_backend = '%1$s' set in network driver config file %2$s"), + _("unrecognized firewall_backend = '%1$s' set in network driver config file %2$s"), fwBackendStr, filename); return -1; } diff --git a/src/qemu/qemu_postparse.c b/src/qemu/qemu_postparse.c index f48f172c37..4fbd849ebf 100644 --- a/src/qemu/qemu_postparse.c +++ b/src/qemu/qemu_postparse.c @@ -1643,7 +1643,7 @@ qemuDomainDefVcpusPostParse(virDomainDef *def) /* they can be ordered only at the beginning */ if (prevvcpu->hotpluggable == VIR_TRISTATE_BOOL_YES) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("online non-hotpluggable vcpus need to be ordered prior to hotplugable vcpus")); + _("online non-hotpluggable vcpus need to be ordered prior to hotpluggable vcpus")); return -1; } diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index 07e95ec81d..c8e77c6cd2 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -374,7 +374,7 @@ AppArmorGenSecurityLabel(virSecurityManager *mgr G_GNUC_UNUSED, if (secdef->baselabel) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, - "%s", _("Cannot set a base label with AppArmour")); + "%s", _("Cannot set a base label with AppArmor")); return -1; } diff --git a/src/vz/vz_sdk.c b/src/vz/vz_sdk.c index ce4586a3f5..b20d454fb8 100644 --- a/src/vz/vz_sdk.c +++ b/src/vz/vz_sdk.c @@ -2703,7 +2703,7 @@ static int prlsdkCheckVideoUnsupportedParams(virDomainDef *def) return 0; } else { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("Video adapters are not supported int containers.")); + _("Video adapters are not supported in containers.")); return -1; } } else { -- 2.47.1

2 1

[PATCH] rpm: ensure we own directories we might create
by Daniel P. Berrangé 17 Dec '24

17 Dec '24

An RPM must own any directories its creates, unless it can guarantee a dependancy has ownership. Two packages owning the same directory is fine if permissions are consistent. We don't require augeas as a dep in most packages, so we must own the augeas lens directories. Likewise for systemtap tapset dirs. Our own cpu map dir also needs ownership. A few files are re-sorted, so that the files are listed immediately adjacent to the %dir that contains them. https://bugzilla.redhat.com/show_bug.cgi?id=2280979 Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 9c1d0a423d..3d5164b534 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -2027,7 +2027,9 @@ exit 0 %config(noreplace) %{_sysconfdir}/libvirt/libvirtd.conf %config(noreplace) %{_prefix}/lib/sysctl.d/60-libvirtd.conf %config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd +%dir %{_datadir}/augeas/lenses %{_datadir}/augeas/lenses/libvirtd.aug +%dir %{_datadir}/augeas/lenses/tests %{_datadir}/augeas/lenses/tests/test_libvirtd.aug %attr(0755, root, root) %{_sbindir}/libvirtd %{_mandir}/man8/libvirtd.8* @@ -2433,15 +2435,17 @@ exit 0 %{_libdir}/libvirt-lxc.so.* %{_libdir}/libvirt-admin.so.* %dir %{_datadir}/libvirt/ +%{_datadir}/libvirt/test-screenshot.png %dir %{_datadir}/libvirt/schemas/ +%{_datadir}/libvirt/schemas/*.rng +%dir %{_datadir}/systemtap/tapset/ %{_datadir}/systemtap/tapset/libvirt_probes*.stp %{_datadir}/systemtap/tapset/libvirt_functions.stp %if %{with_qemu} %{_datadir}/systemtap/tapset/libvirt_qemu_probes*.stp %endif -%{_datadir}/libvirt/schemas/*.rng +%dir %{_datadir}/libvirt/cpu_map %{_datadir}/libvirt/cpu_map/*.xml -%{_datadir}/libvirt/test-screenshot.png %if %{with_wireshark} %files wireshark -- 2.46.0

2 1

[PATCH] qemu: Enable I/O APIC if needed
by Michal Privoznik 16 Dec '24

16 Dec '24

This is a follow up of my previous commits. If the number of vCPUs exceeds some arbitrary value (255) then QEMU requires IOMMU with EIM and interemap enabled. But in turn, intremap IOMMU requires split I/O APIC (per virDomainDefIOMMUValidate()). Since after my previous commits (e.g. v10.10.0-rc1~183) IOMMU is added automagically, the I/O APIC can be also enabled automagically. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_postparse.c | 7 +++++++ tests/qemuxmlconfdata/intel-iommu-eim-autoadd.xml | 3 --- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_postparse.c b/src/qemu/qemu_postparse.c index 03b5ef825a..f48f172c37 100644 --- a/src/qemu/qemu_postparse.c +++ b/src/qemu/qemu_postparse.c @@ -1547,6 +1547,13 @@ qemuDomainDefEnableDefaultFeatures(virDomainDef *def, * capabilities, we still want to enable this */ def->features[VIR_DOMAIN_FEATURE_GIC] = VIR_TRISTATE_SWITCH_ON; } + + /* IOMMU with intremap requires split I/O APIC */ + if (def->iommu && + def->iommu->intremap == VIR_TRISTATE_SWITCH_ON && + def->features[VIR_DOMAIN_FEATURE_IOAPIC] == VIR_DOMAIN_IOAPIC_NONE) { + def->features[VIR_DOMAIN_FEATURE_IOAPIC] = VIR_DOMAIN_IOAPIC_QEMU; + } } diff --git a/tests/qemuxmlconfdata/intel-iommu-eim-autoadd.xml b/tests/qemuxmlconfdata/intel-iommu-eim-autoadd.xml index fa3aaf0d44..5abc40e566 100644 --- a/tests/qemuxmlconfdata/intel-iommu-eim-autoadd.xml +++ b/tests/qemuxmlconfdata/intel-iommu-eim-autoadd.xml @@ -8,9 +8,6 @@ <type arch='x86_64' machine='q35'>hvm</type> <boot dev='hd'/> </os> - <features> - <ioapic driver='qemu'/> - </features> <cpu mode='custom' match='exact' check='none'> <model fallback='forbid'>qemu64</model> </cpu> -- 2.45.2

3 3

[PATCH] util: Change return type of functions that never fail to void
by Alexander Kuznetsov 16 Dec '24

16 Dec '24

These functions return value is invariant since 18f3771, so change its type and remove all dependent checks. Found by Linux Verification Center (linuxtesting.org) with Svace. Reported-by: Pavel Nekrasov <p.nekrasov(a)fobos-nt.ru> Signed-off-by: Alexander Kuznetsov <kuznetsovam(a)altlinux.org> --- src/hypervisor/virhostdev.c | 21 +++++++-------------- src/logging/log_daemon.c | 8 ++------ src/logging/log_daemon_config.c | 4 +--- src/logging/log_daemon_config.h | 2 +- src/util/virpci.c | 4 +--- src/util/virpci.h | 2 +- src/util/virscsi.c | 4 +--- src/util/virscsi.h | 2 +- src/util/virscsivhost.c | 6 ++---- src/util/virscsivhost.h | 2 +- tests/virscsitest.c | 6 ++---- 11 files changed, 20 insertions(+), 41 deletions(-) diff --git a/src/hypervisor/virhostdev.c b/src/hypervisor/virhostdev.c index db94a2e056..037842c8a1 100644 --- a/src/hypervisor/virhostdev.c +++ b/src/hypervisor/virhostdev.c @@ -1131,8 +1131,7 @@ virHostdevUpdateActivePCIDevices(virHostdevManager *mgr, if (!actual) continue; - if (virPCIDeviceSetUsedBy(actual, drv_name, dom_name) < 0) - goto cleanup; + virPCIDeviceSetUsedBy(actual, drv_name, dom_name); /* Setup the original states for the PCI device */ virPCIDeviceSetUnbindFromStub(actual, virBitmapIsBitSet(orig, VIR_DOMAIN_HOSTDEV_PCI_ORIGSTATE_UNBIND)); @@ -1213,11 +1212,9 @@ virHostdevUpdateActiveSCSIHostDevices(virHostdevManager *mgr, return -1; if ((tmp = virSCSIDeviceListFind(mgr->activeSCSIHostdevs, scsi))) { - if (virSCSIDeviceSetUsedBy(tmp, drv_name, dom_name) < 0) - return -1; + virSCSIDeviceSetUsedBy(tmp, drv_name, dom_name); } else { - if (virSCSIDeviceSetUsedBy(scsi, drv_name, dom_name) < 0 || - virSCSIDeviceListAdd(mgr->activeSCSIHostdevs, scsi) < 0) + if (virSCSIDeviceListAdd(mgr->activeSCSIHostdevs, scsi) < 0) return -1; scsi = NULL; } @@ -1598,11 +1595,9 @@ virHostdevPrepareSCSIDevices(virHostdevManager *mgr, goto error; } - if (virSCSIDeviceSetUsedBy(tmp, drv_name, dom_name) < 0) - goto error; + virSCSIDeviceSetUsedBy(tmp, drv_name, dom_name); } else { - if (virSCSIDeviceSetUsedBy(scsi, drv_name, dom_name) < 0) - goto error; + virSCSIDeviceSetUsedBy(scsi, drv_name, dom_name); VIR_DEBUG("Adding %s to activeSCSIHostdevs", virSCSIDeviceGetName(scsi)); @@ -1671,8 +1666,7 @@ virHostdevPrepareSCSIVHostDevices(virHostdevManager *mgr, if (!(host = virSCSIVHostDeviceNew(hostsrc->wwpn))) return -1; - if (virSCSIVHostDeviceSetUsedBy(host, drv_name, dom_name) < 0) - return -1; + virSCSIVHostDeviceSetUsedBy(host, drv_name, dom_name); if (virSCSIVHostDeviceListAdd(list, host) < 0) return -1; @@ -2480,8 +2474,7 @@ virHostdevUpdateActiveNVMeDevices(virHostdevManager *hostdev_mgr, /* We must restore some attributes that were lost on daemon restart. */ virPCIDeviceSetUnbindFromStub(actual, true); - if (virPCIDeviceSetUsedBy(actual, drv_name, dom_name) < 0) - goto rollback; + virPCIDeviceSetUsedBy(actual, drv_name, dom_name); if (virPCIDeviceListAddCopy(hostdev_mgr->activePCIHostdevs, actual) < 0) goto rollback; diff --git a/src/logging/log_daemon.c b/src/logging/log_daemon.c index daf7ef4b2f..5a9be4a44e 100644 --- a/src/logging/log_daemon.c +++ b/src/logging/log_daemon.c @@ -692,14 +692,10 @@ int main(int argc, char **argv) { exit(EXIT_FAILURE); } - /* No explicit config, so try and find a default one */ + /* No explicit config, so find a default one */ if (remote_config_file == NULL) { implicit_conf = true; - if (virLogDaemonConfigFilePath(privileged, - &remote_config_file) < 0) { - VIR_ERROR(_("Can't determine config path")); - exit(EXIT_FAILURE); - } + virLogDaemonConfigFilePath(privileged, &remote_config_file); } /* Read the config file if it exists */ diff --git a/src/logging/log_daemon_config.c b/src/logging/log_daemon_config.c index 248bd927d3..60c424ad84 100644 --- a/src/logging/log_daemon_config.c +++ b/src/logging/log_daemon_config.c @@ -33,7 +33,7 @@ VIR_LOG_INIT("logging.log_daemon_config"); -int +void virLogDaemonConfigFilePath(bool privileged, char **configfile) { if (privileged) { @@ -45,8 +45,6 @@ virLogDaemonConfigFilePath(bool privileged, char **configfile) *configfile = g_strdup_printf("%s/virtlogd.conf", configdir); } - - return 0; } diff --git a/src/logging/log_daemon_config.h b/src/logging/log_daemon_config.h index 43922feedf..5c10cc50d7 100644 --- a/src/logging/log_daemon_config.h +++ b/src/logging/log_daemon_config.h @@ -39,7 +39,7 @@ struct _virLogDaemonConfig { }; -int virLogDaemonConfigFilePath(bool privileged, char **configfile); +void virLogDaemonConfigFilePath(bool privileged, char **configfile); virLogDaemonConfig *virLogDaemonConfigNew(bool privileged); void virLogDaemonConfigFree(virLogDaemonConfig *data); int virLogDaemonConfigLoadFile(virLogDaemonConfig *data, diff --git a/src/util/virpci.c b/src/util/virpci.c index 289c0b330b..90617e69c6 100644 --- a/src/util/virpci.c +++ b/src/util/virpci.c @@ -2049,7 +2049,7 @@ virPCIDeviceSetReprobe(virPCIDevice *dev, bool reprobe) dev->reprobe = reprobe; } -int +void virPCIDeviceSetUsedBy(virPCIDevice *dev, const char *drv_name, const char *dom_name) @@ -2058,8 +2058,6 @@ virPCIDeviceSetUsedBy(virPCIDevice *dev, VIR_FREE(dev->used_by_domname); dev->used_by_drvname = g_strdup(drv_name); dev->used_by_domname = g_strdup(dom_name); - - return 0; } void diff --git a/src/util/virpci.h b/src/util/virpci.h index ba5e0ae6f1..c5dcf9d37f 100644 --- a/src/util/virpci.h +++ b/src/util/virpci.h @@ -136,7 +136,7 @@ void virPCIDeviceSetStubDriverName(virPCIDevice *dev, const char *driverName); const char *virPCIDeviceGetStubDriverName(virPCIDevice *dev); virPCIDeviceAddress *virPCIDeviceGetAddress(virPCIDevice *dev); -int virPCIDeviceSetUsedBy(virPCIDevice *dev, +void virPCIDeviceSetUsedBy(virPCIDevice *dev, const char *drv_name, const char *dom_name); void virPCIDeviceGetUsedBy(virPCIDevice *dev, diff --git a/src/util/virscsi.c b/src/util/virscsi.c index 3d2c77e3b8..6899958e21 100644 --- a/src/util/virscsi.c +++ b/src/util/virscsi.c @@ -243,7 +243,7 @@ virSCSIDeviceFree(virSCSIDevice *dev) g_free(dev); } -int +void virSCSIDeviceSetUsedBy(virSCSIDevice *dev, const char *drvname, const char *domname) @@ -255,8 +255,6 @@ virSCSIDeviceSetUsedBy(virSCSIDevice *dev, copy->domname = g_strdup(domname); VIR_APPEND_ELEMENT(dev->used_by, dev->n_used_by, copy); - - return 0; } bool diff --git a/src/util/virscsi.h b/src/util/virscsi.h index ec34303bdc..d76ee13bcc 100644 --- a/src/util/virscsi.h +++ b/src/util/virscsi.h @@ -50,7 +50,7 @@ virSCSIDevice *virSCSIDeviceNew(const char *sysfs_prefix, bool shareable); void virSCSIDeviceFree(virSCSIDevice *dev); -int virSCSIDeviceSetUsedBy(virSCSIDevice *dev, +void virSCSIDeviceSetUsedBy(virSCSIDevice *dev, const char *drvname, const char *domname); bool virSCSIDeviceIsAvailable(virSCSIDevice *dev); diff --git a/src/util/virscsivhost.c b/src/util/virscsivhost.c index 15024d7106..05b89e58d6 100644 --- a/src/util/virscsivhost.c +++ b/src/util/virscsivhost.c @@ -193,7 +193,7 @@ virSCSIVHostDeviceListNew(void) } -int +void virSCSIVHostDeviceSetUsedBy(virSCSIVHostDevice *dev, const char *drvname, const char *domname) @@ -202,8 +202,6 @@ virSCSIVHostDeviceSetUsedBy(virSCSIVHostDevice *dev, VIR_FREE(dev->used_by_domname); dev->used_by_drvname = g_strdup(drvname); dev->used_by_domname = g_strdup(domname); - - return 0; } @@ -214,7 +212,7 @@ virSCSIVHostDeviceGetUsedBy(virSCSIVHostDevice *dev, { *drv_name = dev->used_by_drvname; *dom_name = dev->used_by_domname; - } +} int diff --git a/src/util/virscsivhost.h b/src/util/virscsivhost.h index a7299382db..caaac26328 100644 --- a/src/util/virscsivhost.h +++ b/src/util/virscsivhost.h @@ -50,7 +50,7 @@ void virSCSIVHostDeviceListDel(virSCSIVHostDeviceList *list, virSCSIVHostDevice *dev); virSCSIVHostDeviceList *virSCSIVHostDeviceListNew(void); virSCSIVHostDevice *virSCSIVHostDeviceNew(const char *name); -int virSCSIVHostDeviceSetUsedBy(virSCSIVHostDevice *dev, +void virSCSIVHostDeviceSetUsedBy(virSCSIVHostDevice *dev, const char *drvname, const char *domname); void virSCSIVHostDeviceGetUsedBy(virSCSIVHostDevice *dev, diff --git a/tests/virscsitest.c b/tests/virscsitest.c index c96699e157..2c3b599c7a 100644 --- a/tests/virscsitest.c +++ b/tests/virscsitest.c @@ -87,14 +87,12 @@ test2(const void *data G_GNUC_UNUSED) if (!virSCSIDeviceIsAvailable(dev)) goto cleanup; - if (virSCSIDeviceSetUsedBy(dev, "QEMU", "fc18") < 0) - goto cleanup; + virSCSIDeviceSetUsedBy(dev, "QEMU", "fc18"); if (virSCSIDeviceIsAvailable(dev)) goto cleanup; - if (virSCSIDeviceSetUsedBy(dev, "QEMU", "fc20") < 0) - goto cleanup; + virSCSIDeviceSetUsedBy(dev, "QEMU", "fc20"); if (virSCSIDeviceIsAvailable(dev)) goto cleanup; -- 2.42.2

3 24

[PATCH v4 00/11] swtpm: Add support for profiles
by Stefan Berger 16 Dec '24

16 Dec '24

Upcoming libtpms v0.10 and swtpm v0.10 will have TPM profile support that allows to restrict a TPM's provided set of crypto algorithms and commands and through which backwards compatibility and migration from newer versions of libtpms to older ones (up to libtpms v0.9) is supported. For the latter to work it is necessary that the user chooses the right ('null') profile. This series adds support for passing a profile choice to swtpm_setup by setting it in the domain XML using the <profile/> XML node. An optional attribute 'remove_disabled' can be set in this node and accepts two values: "check": test a few crypto algorithms (tdes, camellia, unpadded encryption, and others) for whether they are currently disabled due to FIPS mode on the host and remove these algorithms in the 'custom' profile if they are disabled; "fips-host": do not test but remove all the possibly disabled crypto algorithms (from list above) Also extend the documentation but point the user to swtpm and libtpms documentation for further details. Follow Deniel's suggestions there's now a PR for swtpm_setup to support searching for profiles though a configurable local directory, distro directory and if no profile could be found there (with appended ".json" suffix) it will fall back to try to use a built-in profile by the provided name: https://github.com/stefanberger/swtpm/pull/918 Stefan v4: - Renamed previous 'name' attribute in profile XML node to 'source' to indicate that the profile was created from some sort of 'source'. The 'name' is now set from the name of the profile read from the swtpm instance's state once it has been created. v3: - 2/10: Adjustments to due rebase - Applied Marc-André's R-b tags - 10/10: Read back profile name from swtpm and adjust it in emulator defs Stefan Berger (11): conf: Move TPM emulator parameters into own struct qemu: Pass virQEMUDriverConfig rather than some of its fields util: Add parsing support for swtpm_setup's cmdarg-profile capability conf: Define enum virDomainTPMProfileRemoveDisabled schema: Extend schema for TPM emulator profile node conf: Add support for profile parameter on TPM emulator in domain XML docs: Add documentation for the TPM backend profile node qemu: Extend swtpm_setup command line to set a profile by its name qemu: Move adding of keys to swtpm command line into own function qemu: Move adding --tpmstate to swtpm command line into own function qemu: Read back the profile name after creation of a TPM instance docs/formatdomain.rst | 32 +++ src/conf/domain_conf.c | 47 ++++ src/conf/domain_conf.h | 38 ++-- src/conf/domain_validate.c | 7 + src/conf/schemas/domaincommon.rng | 32 +++ src/conf/virconftypes.h | 2 + src/qemu/qemu_extdevice.c | 5 +- src/qemu/qemu_tpm.c | 344 ++++++++++++++++++++---------- src/qemu/qemu_tpm.h | 3 +- src/util/virtpm.c | 2 + src/util/virtpm.h | 2 + tests/testutilsqemu.c | 1 + 12 files changed, 386 insertions(+), 129 deletions(-) -- 2.47.0

3 22

[PATCH safe for 10.10.0] qemu: re-use existing ActualNetDef for more interface types during update-device
by Laine Stump 13 Dec '24

13 Dec '24

For the full history behind this patch, look at the following: https://issues.redhat.com/browse/RHEL-7036 commit v10.7.0-101-ga37bd2a15b commit v10.8.0-rc2-8-gbcd5ae4e73 Summary: original problem was unexpected failure of update-device when the user hadn't changed anything other than online status of the guest NIC (which should always be allowed). The first commit "fixed" this by avoiding the allocation of a new ActualNetDef (i.e. creating a new networkport) for *all* network device updates (because that was inappropriately changing which ethernet physdev should be used for a macvtap connection, which by design can't be handled in an update-device). But this commit caused a regression for update-device of bridge-based network devices (because some the updates of certain attributes *do* require the ActualNetDef be re-allocated), so... The 2nd commit narrowed the list of network types that get the "don't allocate new ActualNetDef" treatment (so that only interfaces connected to a network that uses a pool of ethernet VFs *being used in passthrough mode* qualify). But then it was pointed out that this re-broke simple updates of devices that used a direct/macvtap network in "bridge" mode (because it's possible to list multiple physdevs to use for bridge mode, in which case the network driver attempts to "load balance" (and so a new allocation might have a different ethernet physdev which, again, can't be supported in a device-update). So this (single line of code) patch *widens* the list of network types that don't allocate a new ActualNetDef to also include the other direct (macvtap) modes, e.g. bridge, private, etc. Signed-off-by: Laine Stump <laine(a)redhat.com> --- There is a more comprehensive fix that also, e.g., makes updating the bandwidth or vlan info of a direct interface work correctly, but that is much more invasive (and also isn't done yet). This patch fixes the case of updating a direct interface's online status (for example) without breaking anything else. src/qemu/qemu_hotplug.c | 38 +++++++++++++++++++++----------------- 1 file changed, 21 insertions(+), 17 deletions(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 3c18af6b0c..ff8c1263c6 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -3935,25 +3935,29 @@ qemuDomainChangeNet(virQEMUDriver *driver, if (newdev->type == VIR_DOMAIN_NET_TYPE_NETWORK) { if (olddev->type == VIR_DOMAIN_NET_TYPE_NETWORK && oldType == VIR_DOMAIN_NET_TYPE_DIRECT && - virDomainNetGetActualDirectMode(olddev) == VIR_NETDEV_MACVLAN_MODE_PASSTHRU && STREQ(olddev->data.network.name, newdev->data.network.name)) { /* old and new are type='network', and the network name - * hasn't changed *and* this is a network where each - * connection is allocated exclusive use of a VF - * device. In this case we *don't* want to get a new port - * ("actual device") from the network because attempting - * to allocate a new device would also allocate a - * new/different VF, causing the update to fail. And - * anyway we can use olddev's actualNetDef (since it - * hasn't changed). - * - * So instead we just duplicate *the pointer to* the - * actualNetDef from olddev to newdev so that comparisons - * of actualNetDef will show no change. If the update is - * successful, we will clear the actualNetDef pointer from - * olddev before destroying it (or if the update fails, - * then we need to clear the pointer from newdev before - * destroying it) + * hasn't changed *and* this is a "direct" network (a pool + * of 1 or more host ethernet devices where each guest + * interface is allocated one device that it connects to + * via macvtap. In this case we *don't* want to get a new + * port ("actual device") from the network because + * attempting to allocate a new device would also allocate + * a new/different ethernet, causing the update to fail + * (because the physical device of a macvtap-based + * interface can't be changed without completely + * unplugging and re-plugging the guest NIC). + + + * We can work around this issue by just re-using olddev's + * actualNetDef (since it hasn't changed) rather than + * allocating a new one. We just duplicate *the pointer + * to* the actualNetDef from olddev to newdev so that + * comparisons of actualNetDef will show no change. If the + * update is successful, we will clear the actualNetDef + * pointer from olddev before destroying it (or if the + * update fails, then we need to clear the pointer from + * newdev before destroying it) */ newdev->data.network.actual = olddev->data.network.actual; memcpy(newdev->data.network.portid, olddev->data.network.portid, -- 2.47.0

2 2

[PATCH] Change return type of functions that use VIR_EXPAND_N and never fail to void
by Alexander Kuznetsov 13 Dec '24

13 Dec '24

These functions return value is invariant since VIR_EXPAND_N check removal in 7d2fd6e, so change its type and remove all dependent checks. Found by Linux Verification Center (linuxtesting.org) with Svace. Reported-by: Pavel Nekrasov <p.nekrasov(a)fobos-nt.ru> Signed-off-by: Alexander Kuznetsov <kuznetsovam(a)altlinux.org> --- src/access/viraccessdriverstack.c | 4 +--- src/access/viraccessdriverstack.h | 2 +- src/access/viraccessmanager.c | 5 +---- src/admin/admin_remote.c | 3 +-- src/hyperv/hyperv_wmi.c | 13 ++++------- src/locking/lock_daemon.c | 10 ++------- src/locking/lock_driver_lockd.c | 3 +-- src/logging/log_daemon.c | 10 ++------- src/logging/log_manager.c | 3 +-- src/lxc/lxc_monitor.c | 4 +--- src/remote/remote_daemon.c | 20 ++++------------- src/remote/remote_driver.c | 17 +++++--------- src/rpc/gendispatch.pl | 5 +---- src/rpc/virnetclient.c | 6 ++--- src/rpc/virnetclient.h | 4 ++-- src/rpc/virnetserver.c | 3 +-- src/rpc/virnetserver.h | 2 +- src/util/virsysinfo.c | 37 ++++++++++--------------------- 18 files changed, 43 insertions(+), 108 deletions(-) diff --git a/src/access/viraccessdriverstack.c b/src/access/viraccessdriverstack.c index fb9ea71665..9d6a0d4d1b 100644 --- a/src/access/viraccessdriverstack.c +++ b/src/access/viraccessdriverstack.c @@ -32,7 +32,7 @@ struct _virAccessDriverStackPrivate { }; -int virAccessDriverStackAppend(virAccessManager *manager, +void virAccessDriverStackAppend(virAccessManager *manager, virAccessManager *child) { virAccessDriverStackPrivate *priv = virAccessManagerGetPrivateData(manager); @@ -40,8 +40,6 @@ int virAccessDriverStackAppend(virAccessManager *manager, VIR_EXPAND_N(priv->managers, priv->managersLen, 1); priv->managers[priv->managersLen-1] = child; - - return 0; } diff --git a/src/access/viraccessdriverstack.h b/src/access/viraccessdriverstack.h index abcfc30ec3..f878ef1989 100644 --- a/src/access/viraccessdriverstack.h +++ b/src/access/viraccessdriverstack.h @@ -23,7 +23,7 @@ #include "access/viraccessdriver.h" -int virAccessDriverStackAppend(virAccessManager *manager, +void virAccessDriverStackAppend(virAccessManager *manager, virAccessManager *child); extern virAccessDriver accessDriverStack; diff --git a/src/access/viraccessmanager.c b/src/access/viraccessmanager.c index 481528c3b9..6d9fdee5f1 100644 --- a/src/access/viraccessmanager.c +++ b/src/access/viraccessmanager.c @@ -164,10 +164,7 @@ virAccessManager *virAccessManagerNewStack(const char **names) if (!child) goto error; - if (virAccessDriverStackAppend(manager, child) < 0) { - virObjectUnref(child); - goto error; - } + virAccessDriverStackAppend(manager, child); } return manager; diff --git a/src/admin/admin_remote.c b/src/admin/admin_remote.c index 3291a1e965..5c4913a76e 100644 --- a/src/admin/admin_remote.c +++ b/src/admin/admin_remote.c @@ -214,8 +214,7 @@ remoteAdminPrivNew(const char *sock_path) NULL, 0, NULL))) goto error; - if (virNetClientAddProgram(priv->client, priv->program) < 0) - goto error; + virNetClientAddProgram(priv->client, priv->program); return priv; error: diff --git a/src/hyperv/hyperv_wmi.c b/src/hyperv/hyperv_wmi.c index 8bc376e22f..0b82f1f131 100644 --- a/src/hyperv/hyperv_wmi.c +++ b/src/hyperv/hyperv_wmi.c @@ -184,14 +184,12 @@ hypervFreeInvokeParams(hypervInvokeParamsList *params) } -static inline int +static inline void hypervCheckParams(hypervInvokeParamsList *params) { if (params->nbParams + 1 > params->nbAvailParams) { VIR_EXPAND_N(params->params, params->nbAvailParams, 5); } - - return 0; } @@ -212,8 +210,7 @@ hypervAddSimpleParam(hypervInvokeParamsList *params, const char *name, { hypervParam *p = NULL; - if (hypervCheckParams(params) < 0) - return -1; + hypervCheckParams(params); p = &params->params[params->nbParams]; p->type = HYPERV_SIMPLE_PARAM; @@ -245,8 +242,7 @@ hypervAddEprParam(hypervInvokeParamsList *params, { hypervParam *p = NULL; - if (hypervCheckParams(params) < 0) - return -1; + hypervCheckParams(params); p = &params->params[params->nbParams]; p->type = HYPERV_EPR_PARAM; @@ -333,8 +329,7 @@ hypervAddEmbeddedParam(hypervInvokeParamsList *params, { hypervParam *p = NULL; - if (hypervCheckParams(params) < 0) - return -1; + hypervCheckParams(params); p = &params->params[params->nbParams]; p->type = HYPERV_EMBEDDED_PARAM; diff --git a/src/locking/lock_daemon.c b/src/locking/lock_daemon.c index ba52ce7d77..0b86300b43 100644 --- a/src/locking/lock_daemon.c +++ b/src/locking/lock_daemon.c @@ -1066,10 +1066,7 @@ int main(int argc, char **argv) { goto cleanup; } - if (virNetServerAddProgram(lockSrv, lockProgram) < 0) { - ret = VIR_DAEMON_ERR_INIT; - goto cleanup; - } + virNetServerAddProgram(lockSrv, lockProgram); if (adminSrv != NULL) { if (!(adminProgram = virNetServerProgramNew(ADMIN_PROGRAM, @@ -1079,10 +1076,7 @@ int main(int argc, char **argv) { ret = VIR_DAEMON_ERR_INIT; goto cleanup; } - if (virNetServerAddProgram(adminSrv, adminProgram) < 0) { - ret = VIR_DAEMON_ERR_INIT; - goto cleanup; - } + virNetServerAddProgram(adminSrv, adminProgram); } /* Disable error func, now logging is setup */ diff --git a/src/locking/lock_driver_lockd.c b/src/locking/lock_driver_lockd.c index d75302dd0a..0b6c720477 100644 --- a/src/locking/lock_driver_lockd.c +++ b/src/locking/lock_driver_lockd.c @@ -213,8 +213,7 @@ static virNetClient *virLockManagerLockDaemonConnectionNew(bool privileged, NULL))) goto error; - if (virNetClientAddProgram(client, *prog) < 0) - goto error; + virNetClientAddProgram(client, *prog); return client; diff --git a/src/logging/log_daemon.c b/src/logging/log_daemon.c index 5a9be4a44e..16a5dcea9a 100644 --- a/src/logging/log_daemon.c +++ b/src/logging/log_daemon.c @@ -864,10 +864,7 @@ int main(int argc, char **argv) { ret = VIR_DAEMON_ERR_INIT; goto cleanup; } - if (virNetServerAddProgram(logSrv, logProgram) < 0) { - ret = VIR_DAEMON_ERR_INIT; - goto cleanup; - } + virNetServerAddProgram(logSrv, logProgram); if (adminSrv != NULL) { if (!(adminProgram = virNetServerProgramNew(ADMIN_PROGRAM, @@ -877,10 +874,7 @@ int main(int argc, char **argv) { ret = VIR_DAEMON_ERR_INIT; goto cleanup; } - if (virNetServerAddProgram(adminSrv, adminProgram) < 0) { - ret = VIR_DAEMON_ERR_INIT; - goto cleanup; - } + virNetServerAddProgram(adminSrv, adminProgram); } /* Disable error func, now logging is setup */ diff --git a/src/logging/log_manager.c b/src/logging/log_manager.c index d8490f4e5a..19e23d65c5 100644 --- a/src/logging/log_manager.c +++ b/src/logging/log_manager.c @@ -88,8 +88,7 @@ virLogManagerConnect(bool privileged, NULL))) goto error; - if (virNetClientAddProgram(client, *prog) < 0) - goto error; + virNetClientAddProgram(client, *prog); VIR_FREE(daemonPath); VIR_FREE(logdpath); diff --git a/src/lxc/lxc_monitor.c b/src/lxc/lxc_monitor.c index 811d6685e5..cf2fd1897f 100644 --- a/src/lxc/lxc_monitor.c +++ b/src/lxc/lxc_monitor.c @@ -169,9 +169,7 @@ virLXCMonitor *virLXCMonitorNew(virDomainObj *vm, mon))) goto error; - if (virNetClientAddProgram(mon->client, - mon->program) < 0) - goto error; + virNetClientAddProgram(mon->client, mon->program); mon->vm = virObjectRef(vm); memcpy(&mon->cb, cb, sizeof(mon->cb)); diff --git a/src/remote/remote_daemon.c b/src/remote/remote_daemon.c index 9e82132654..1d079c7e4b 100644 --- a/src/remote/remote_daemon.c +++ b/src/remote/remote_daemon.c @@ -1063,10 +1063,7 @@ int main(int argc, char **argv) { ret = VIR_DAEMON_ERR_INIT; goto cleanup; } - if (virNetServerAddProgram(srv, remoteProgram) < 0) { - ret = VIR_DAEMON_ERR_INIT; - goto cleanup; - } + virNetServerAddProgram(srv, remoteProgram); if (!(lxcProgram = virNetServerProgramNew(LXC_PROGRAM, LXC_PROTOCOL_VERSION, @@ -1075,10 +1072,7 @@ int main(int argc, char **argv) { ret = VIR_DAEMON_ERR_INIT; goto cleanup; } - if (virNetServerAddProgram(srv, lxcProgram) < 0) { - ret = VIR_DAEMON_ERR_INIT; - goto cleanup; - } + virNetServerAddProgram(srv, lxcProgram); if (!(qemuProgram = virNetServerProgramNew(QEMU_PROGRAM, QEMU_PROTOCOL_VERSION, @@ -1087,10 +1081,7 @@ int main(int argc, char **argv) { ret = VIR_DAEMON_ERR_INIT; goto cleanup; } - if (virNetServerAddProgram(srv, qemuProgram) < 0) { - ret = VIR_DAEMON_ERR_INIT; - goto cleanup; - } + virNetServerAddProgram(srv, qemuProgram); if (!(srvAdm = virNetServerNew("admin", 1, config->admin_min_workers, @@ -1120,10 +1111,7 @@ int main(int argc, char **argv) { ret = VIR_DAEMON_ERR_INIT; goto cleanup; } - if (virNetServerAddProgram(srvAdm, adminProgram) < 0) { - ret = VIR_DAEMON_ERR_INIT; - goto cleanup; - } + virNetServerAddProgram(srvAdm, adminProgram); if (timeout > 0) { if (virNetDaemonAutoShutdown(dmn, timeout) < 0) diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index e76d9e9ba4..307f9ca945 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -1160,10 +1160,9 @@ doRemoteOpen(virConnectPtr conn, conn))) goto error; - if (virNetClientAddProgram(priv->client, priv->remoteProgram) < 0 || - virNetClientAddProgram(priv->client, priv->lxcProgram) < 0 || - virNetClientAddProgram(priv->client, priv->qemuProgram) < 0) - goto error; + virNetClientAddProgram(priv->client, priv->remoteProgram); + virNetClientAddProgram(priv->client, priv->lxcProgram); + virNetClientAddProgram(priv->client, priv->qemuProgram); /* Try and authenticate with server */ VIR_DEBUG("Trying authentication"); @@ -5664,10 +5663,7 @@ remoteDomainMigratePrepareTunnel3(virConnectPtr dconn, false))) return -1; - if (virNetClientAddStream(priv->client, netst) < 0) { - virObjectUnref(netst); - return -1; - } + virNetClientAddStream(priv->client, netst); st->driver = &remoteStreamDrv; st->privateData = netst; @@ -6433,10 +6429,7 @@ remoteDomainMigratePrepareTunnel3Params(virConnectPtr dconn, false))) goto cleanup; - if (virNetClientAddStream(priv->client, netst) < 0) { - virObjectUnref(netst); - goto cleanup; - } + virNetClientAddStream(priv->client, netst); st->driver = &remoteStreamDrv; st->privateData = netst; diff --git a/src/rpc/gendispatch.pl b/src/rpc/gendispatch.pl index c5842dc796..724a6aed6e 100755 --- a/src/rpc/gendispatch.pl +++ b/src/rpc/gendispatch.pl @@ -1822,10 +1822,7 @@ elsif ($mode eq "client") { print " if (!(netst = virNetClientStreamNew(priv->remoteProgram, $call->{constname}, priv->counter, sparse)))\n"; print " goto cleanup;\n"; print "\n"; - print " if (virNetClientAddStream(priv->client, netst) < 0) {\n"; - print " virObjectUnref(netst);\n"; - print " goto cleanup;\n"; - print " }"; + print " virNetClientAddStream(priv->client, netst);\n"; print "\n"; print " st->driver = &remoteStreamDrv;\n"; print " st->privateData = netst;\n"; diff --git a/src/rpc/virnetclient.c b/src/rpc/virnetclient.c index 6d424eb599..39ccbd739c 100644 --- a/src/rpc/virnetclient.c +++ b/src/rpc/virnetclient.c @@ -1053,7 +1053,7 @@ bool virNetClientIsOpen(virNetClient *client) } -int virNetClientAddProgram(virNetClient *client, +void virNetClientAddProgram(virNetClient *client, virNetClientProgram *prog) { virObjectLock(client); @@ -1062,11 +1062,10 @@ int virNetClientAddProgram(virNetClient *client, client->programs[client->nprograms-1] = virObjectRef(prog); virObjectUnlock(client); - return 0; } -int virNetClientAddStream(virNetClient *client, +void virNetClientAddStream(virNetClient *client, virNetClientStream *st) { virObjectLock(client); @@ -1075,7 +1074,6 @@ int virNetClientAddStream(virNetClient *client, client->streams[client->nstreams-1] = virObjectRef(st); virObjectUnlock(client); - return 0; } diff --git a/src/rpc/virnetclient.h b/src/rpc/virnetclient.h index 1647a6cc71..29099791a0 100644 --- a/src/rpc/virnetclient.h +++ b/src/rpc/virnetclient.h @@ -117,10 +117,10 @@ int virNetClientDupFD(virNetClient *client, bool cloexec); bool virNetClientHasPassFD(virNetClient *client); -int virNetClientAddProgram(virNetClient *client, +void virNetClientAddProgram(virNetClient *client, virNetClientProgram *prog); -int virNetClientAddStream(virNetClient *client, +void virNetClientAddStream(virNetClient *client, virNetClientStream *st); void virNetClientRemoveStream(virNetClient *client, diff --git a/src/rpc/virnetserver.c b/src/rpc/virnetserver.c index a6c6443c55..91219c3eed 100644 --- a/src/rpc/virnetserver.c +++ b/src/rpc/virnetserver.c @@ -768,7 +768,7 @@ virNetServerAddServiceUNIX(virNetServer *srv, } -int +void virNetServerAddProgram(virNetServer *srv, virNetServerProgram *prog) { @@ -776,7 +776,6 @@ virNetServerAddProgram(virNetServer *srv, VIR_EXPAND_N(srv->programs, srv->nprograms, 1); srv->programs[srv->nprograms-1] = virObjectRef(prog); - return 0; } diff --git a/src/rpc/virnetserver.h b/src/rpc/virnetserver.h index 7756a1dd6c..c14d8bd10f 100644 --- a/src/rpc/virnetserver.h +++ b/src/rpc/virnetserver.h @@ -84,7 +84,7 @@ int virNetServerAddServiceUNIX(virNetServer *srv, size_t max_queued_clients, size_t nrequests_client_max); -int virNetServerAddProgram(virNetServer *srv, +void virNetServerAddProgram(virNetServer *srv, virNetServerProgram *prog); int virNetServerSetTLSContext(virNetServer *srv, diff --git a/src/util/virsysinfo.c b/src/util/virsysinfo.c index dbcbca62ed..3575669ac3 100644 --- a/src/util/virsysinfo.c +++ b/src/util/virsysinfo.c @@ -263,7 +263,7 @@ virSysinfoParsePPCSystem(const char *base, virSysinfoSystemDef **sysdef) return ret; } -static int +static void virSysinfoParsePPCProcessor(const char *base, virSysinfoDef *ret) { const char *cur; @@ -303,8 +303,6 @@ virSysinfoParsePPCProcessor(const char *base, virSysinfoDef *ret) } } - - return 0; } /* virSysinfoRead for PowerPC @@ -325,8 +323,7 @@ virSysinfoReadPPC(void) ret->nprocessor = 0; ret->processor = NULL; - if (virSysinfoParsePPCProcessor(outbuf, ret) < 0) - return NULL; + virSysinfoParsePPCProcessor(outbuf, ret); if (virSysinfoParsePPCSystem(outbuf, &ret->system) < 0) return NULL; @@ -383,7 +380,7 @@ virSysinfoParseARMSystem(const char *base, virSysinfoSystemDef **sysdef) return ret; } -static int +static void virSysinfoParseARMProcessor(const char *base, virSysinfoDef *ret) { const char *cur; @@ -393,7 +390,7 @@ virSysinfoParseARMProcessor(const char *base, virSysinfoDef *ret) if (!(tmp_base = strstr(base, "model name")) && !(tmp_base = strstr(base, "Processor"))) - return 0; + return; eol = strchr(tmp_base, '\n'); cur = strchr(tmp_base, ':') + 1; @@ -420,7 +417,7 @@ virSysinfoParseARMProcessor(const char *base, virSysinfoDef *ret) } VIR_FREE(processor_type); - return 0; + return; } /* virSysinfoRead for ARMv7 @@ -451,8 +448,7 @@ virSysinfoReadARM(void) ret->nprocessor = 0; ret->processor = NULL; - if (virSysinfoParseARMProcessor(outbuf, ret) < 0) - return NULL; + virSysinfoParseARMProcessor(outbuf, ret); if (virSysinfoParseARMSystem(outbuf, &ret->system) < 0) return NULL; @@ -753,7 +749,7 @@ virSysinfoParseX86System(const char *base, virSysinfoSystemDef **sysdef) return ret; } -static int +static void virSysinfoParseX86BaseBoard(const char *base, virSysinfoBaseBoardDef **baseBoard, size_t *nbaseBoard) @@ -827,7 +823,6 @@ virSysinfoParseX86BaseBoard(const char *base, *nbaseBoard = nboards; *baseBoard = g_steal_pointer(&boards); - return 0; } @@ -1006,7 +1001,7 @@ virSysinfoParseOEMStrings(const char *base, } -static int +static void virSysinfoParseX86Processor(const char *base, virSysinfoDef *ret) { const char *cur, *tmp_base; @@ -1102,11 +1097,9 @@ virSysinfoParseX86Processor(const char *base, virSysinfoDef *ret) base += strlen("Processor Information"); } - - return 0; } -static int +static void virSysinfoParseX86Memory(const char *base, virSysinfoDef *ret) { const char *cur, *tmp_base; @@ -1197,8 +1190,6 @@ virSysinfoParseX86Memory(const char *base, virSysinfoDef *ret) next: base += strlen("Memory Device"); } - - return 0; } virSysinfoDef * @@ -1223,8 +1214,7 @@ virSysinfoReadDMI(void) if (virSysinfoParseX86System(outbuf, &ret->system) < 0) return NULL; - if (virSysinfoParseX86BaseBoard(outbuf, &ret->baseBoard, &ret->nbaseBoard) < 0) - return NULL; + virSysinfoParseX86BaseBoard(outbuf, &ret->baseBoard, &ret->nbaseBoard); if (virSysinfoParseX86Chassis(outbuf, &ret->chassis) < 0) return NULL; @@ -1234,13 +1224,10 @@ virSysinfoReadDMI(void) ret->nprocessor = 0; ret->processor = NULL; - if (virSysinfoParseX86Processor(outbuf, ret) < 0) - return NULL; - + virSysinfoParseX86Processor(outbuf, ret); ret->nmemory = 0; ret->memory = NULL; - if (virSysinfoParseX86Memory(outbuf, ret) < 0) - return NULL; + virSysinfoParseX86Memory(outbuf, ret); return g_steal_pointer(&ret); } -- 2.42.2

3 17

Re: [PATCH v5 00/18] *** qemu: block: Support block disk along with throttle filters ***
by Harikumar R 13 Dec '24

13 Dec '24

Hi Team, Can we fix all unfixed version numbers and submit new patch v7, or can we wait till the reviews are complete? Thanks & Regards, Harikumar R

2 1

Exception in thread "main" java.lang.UnsatisfiedLinkError: Unable to load library 'virt': The specified module could not be found.
by sujith.a_S1＠dell.com 13 Dec '24

13 Dec '24

trying to write a simple java program to connect to KVM, but getting the error CODE ---------------------------------------------------------------------------------------------------- package com.poc.kvm_connection; import org.libvirt.Connect; import org.libvirt.ConnectAuth; import org.libvirt.ConnectAuthDefault; import org.libvirt.LibvirtException; public class KvmConnectionApplication { public static void main(String[] args) throws Exception { KvmConnectionApplication application = new KvmConnectionApplication(); application.testConnection(); } public void testConnection() throws LibvirtException { ConnectAuth defaultAuth = new ConnectAuthDefault(); Connect conn = new Connect("qemu+tcp://10.230.211.237/system", defaultAuth, 0); } } ERROR -------------------------------------------------------------------------------------------------------------------- Exception in thread "main" java.lang.UnsatisfiedLinkError: Unable to load library 'virt': The specified module could not be found. at com.sun.jna.NativeLibrary.loadLibrary(NativeLibrary.java:169) at com.sun.jna.NativeLibrary.getInstance(NativeLibrary.java:242) at com.sun.jna.Library$Handler.<init>(Library.java:140) at com.sun.jna.Native.loadLibrary(Native.java:368) at com.sun.jna.Native.loadLibrary(Native.java:353) at org.libvirt.jna.Libvirt.<clinit>(Unknown Source) at org.libvirt.Connect.<clinit>(Unknown Source)

1 0

[PATCH 0/8] Enabling logging for ch guests
by Praveen K Paladugu 12 Dec '24

12 Dec '24

LogContext management is now moved from Qemu driver to hypervisor. After migrating Qemu to use domain_logcontext, I extended ch driver to use also use logcontext to capture early boot failures in domain specific log file. I broke up the migration of logcontext from qemu to hypevisor into multiple patches. Due to this breakup, patches 1,2,3 fail to build. Only after applying patch4 does this patchset successfully build. Praveen K Paladugu (8): domain: move logcontext mgmt from qemu to hypervisor hypervisor: drop hypervisor specific args in domainLogContextNew qemu: Fix domainLogContextNew invocations in qemu driver libvirt_private: export symbols from domain_logcontext po: Update POTFILES ch: Enable logging for ch domains ch: move curl_data and curl_callback definitions ch: Enable logging curl responses from ch po/POTFILES | 2 +- src/ch/ch_conf.h | 2 + src/ch/ch_monitor.c | 84 ++++++++++++------- src/ch/ch_monitor.h | 6 +- src/ch/ch_process.c | 36 ++++++-- .../domain_logcontext.c} | 78 +++++++++-------- src/hypervisor/domain_logcontext.h | 45 ++++++++++ src/hypervisor/meson.build | 1 + src/libvirt_private.syms | 6 ++ src/qemu/meson.build | 1 - src/qemu/qemu_domain.c | 28 +++---- src/qemu/qemu_domain.h | 12 +-- src/qemu/qemu_logcontext.h | 41 --------- src/qemu/qemu_nbdkit.c | 12 ++- src/qemu/qemu_process.c | 45 +++++----- 15 files changed, 235 insertions(+), 164 deletions(-) rename src/{qemu/qemu_logcontext.c => hypervisor/domain_logcontext.c} (79%) create mode 100644 src/hypervisor/domain_logcontext.h delete mode 100644 src/qemu/qemu_logcontext.h -- 2.47.0

2 10

[PATCH] qemu: Grab a QUERY job when formatting domain XML
by Michal Privoznik 12 Dec '24

12 Dec '24

It may happen that, for instance after daemon restart, that one thread is still in qemuProcessReconnect(), i.e. filling in runtime information by talking to QEMU on monitor. If another thread then tries to format domain XML (which is currently guarded by plain mutex on virDomainObj) it'll produce incomplete and misleading information (e.g. current size of virtio-mem). This happens because the reconnecting thread talks to QEMU on monitor and thus unlocks the domain object frequently allowing the XML formatting thread to acquire the mutex meanwhile. Resolves: https://issues.redhat.com/browse/RHEL-71042 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_driver.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 09f7edda7d..f1a633fdd3 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6163,6 +6163,9 @@ static char if (virDomainGetXMLDescEnsureACL(dom->conn, vm->def, flags) < 0) goto cleanup; + if (virDomainObjBeginJob(vm, VIR_JOB_QUERY) < 0) + goto cleanup; + qemuDomainUpdateCurrentMemorySize(vm); if ((flags & VIR_DOMAIN_XML_MIGRATABLE)) @@ -6177,6 +6180,8 @@ static char ret = qemuDomainFormatXML(driver, vm, flags); + virDomainObjEndJob(vm); + cleanup: virDomainObjEndAPI(&vm); return ret; -- 2.45.2

2 1

[PATCH v2 00/25] cpu_map: Add missing -v1 models
by Jiri Denemark 12 Dec '24

12 Dec '24

CPU models that do not have a list of versions attached are still advertised as aliases to corresponding -v1 variants. We should add the missing variants to the CPU map. Available on gitlab: git fetch https://gitlab.com/jirkade/libvirt.git cpu-versions Version 2: - Add -v1 for all models including ancient ones Jiri Denemark (25): cpu_map: Sort data files in meson.build sync_qemu_models_i386: Update meson.build sync_qemu_models_i386: Generate missing -v1 variants cpu_map: Add 486-v1 CPU model cpu_map: Add pentium-v1 CPU model cpu_map: Add pentium2-v1 CPU model cpu_map: Add pentium3-v1 CPU model cpu_map: Add coreduo-v1 CPU model cpu_map: Add n270-v1 CPU model cpu_map: Add core2duo-v1 CPU model cpu_map: Add qemu32-v1 CPU model cpu_map: Add kvm32-v1 CPU model cpu_map: Add qemu64-v1 CPU model cpu_map: Add kvm64-v1 CPU model cpu_map: Add Conroe-v1 CPU model cpu_map: Add Penryn-v1 CPU model cpu_map: Add KnightsMill-v1 CPU model cpu_map: Add athlon-v1 CPU model cpu_map: Add phenom-v1 CPU model cpu_map: Add Opteron_G1-v1 CPU model cpu_map: Add Opteron_G2-v1 CPU model cpu_map: Add Opteron_G3-v1 CPU model cpu_map: Add Opteron_G4-v1 CPU model cpu_map: Add Opteron_G5-v1 CPU model cpu_map: Add EPYC-Genoa-v1 CPU model src/cpu_map/index.xml | 22 +++ src/cpu_map/meson.build | 38 +++-- src/cpu_map/sync_qemu_models_i386.py | 30 ++++ src/cpu_map/x86_486-v1.xml | 6 + src/cpu_map/x86_Conroe-v1.xml | 6 + src/cpu_map/x86_EPYC-Genoa-v1.xml | 6 + src/cpu_map/x86_KnightsMill-v1.xml | 6 + src/cpu_map/x86_Opteron_G1-v1.xml | 6 + src/cpu_map/x86_Opteron_G2-v1.xml | 6 + src/cpu_map/x86_Opteron_G3-v1.xml | 6 + src/cpu_map/x86_Opteron_G4-v1.xml | 6 + src/cpu_map/x86_Opteron_G5-v1.xml | 6 + src/cpu_map/x86_Penryn-v1.xml | 6 + src/cpu_map/x86_athlon-v1.xml | 6 + src/cpu_map/x86_core2duo-v1.xml | 6 + src/cpu_map/x86_coreduo-v1.xml | 6 + src/cpu_map/x86_kvm32-v1.xml | 6 + src/cpu_map/x86_kvm64-v1.xml | 6 + src/cpu_map/x86_n270-v1.xml | 6 + src/cpu_map/x86_pentium-v1.xml | 6 + src/cpu_map/x86_pentium2-v1.xml | 6 + src/cpu_map/x86_pentium3-v1.xml | 6 + src/cpu_map/x86_phenom-v1.xml | 6 + src/cpu_map/x86_qemu32-v1.xml | 6 + src/cpu_map/x86_qemu64-v1.xml | 6 + .../x86_64-cpuid-A10-5800K-host.xml | 2 +- .../x86_64-cpuid-Atom-D510-host.xml | 2 +- .../x86_64-cpuid-Atom-N450-host.xml | 2 +- .../x86_64-cpuid-Core2-E6850-host.xml | 2 +- .../x86_64-cpuid-Core2-Q9500-host.xml | 2 +- .../cputestdata/x86_64-cpuid-FX-8150-host.xml | 2 +- .../x86_64-cpuid-Opteron-1352-host.xml | 2 +- .../x86_64-cpuid-Opteron-2350-host.xml | 2 +- .../x86_64-cpuid-Opteron-6234-host.xml | 2 +- .../x86_64-cpuid-Opteron-6282-host.xml | 2 +- .../x86_64-cpuid-Pentium-P6100-host.xml | 2 +- .../x86_64-cpuid-Phenom-B95-host.xml | 2 +- .../x86_64-cpuid-Xeon-5110-host.xml | 2 +- .../x86_64-cpuid-Xeon-X5460-host.xml | 2 +- .../domaincapsdata/qemu_5.2.0-q35.x86_64.xml | 100 ++++++++++--- .../domaincapsdata/qemu_5.2.0-tcg.x86_64.xml | 105 +++++++++++--- tests/domaincapsdata/qemu_5.2.0.x86_64.xml | 100 ++++++++++--- .../domaincapsdata/qemu_6.0.0-q35.x86_64.xml | 100 ++++++++++--- .../domaincapsdata/qemu_6.0.0-tcg.x86_64.xml | 105 +++++++++++--- tests/domaincapsdata/qemu_6.0.0.x86_64.xml | 100 ++++++++++--- .../domaincapsdata/qemu_6.1.0-q35.x86_64.xml | 100 ++++++++++--- .../domaincapsdata/qemu_6.1.0-tcg.x86_64.xml | 105 +++++++++++--- tests/domaincapsdata/qemu_6.1.0.x86_64.xml | 100 ++++++++++--- .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 100 ++++++++++--- .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 105 +++++++++++--- tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 100 ++++++++++--- .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 100 ++++++++++--- .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 105 +++++++++++--- tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 100 ++++++++++--- .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 100 ++++++++++--- .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 105 +++++++++++--- tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 100 ++++++++++--- .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 100 ++++++++++--- .../qemu_7.2.0-tcg.x86_64+hvf.xml | 97 ++++++++++--- .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 97 ++++++++++--- tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 100 ++++++++++--- .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 100 ++++++++++--- .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 97 ++++++++++--- tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 100 ++++++++++--- .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 132 ++++++++++++++--- .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 135 +++++++++++++++--- tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 132 ++++++++++++++--- .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 132 ++++++++++++++--- .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 134 ++++++++++++++--- tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 132 ++++++++++++++--- .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 132 ++++++++++++++--- .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 133 ++++++++++++++--- tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 132 ++++++++++++++--- .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 132 ++++++++++++++--- .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 133 ++++++++++++++--- tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 132 ++++++++++++++--- .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 132 ++++++++++++++--- .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 133 ++++++++++++++--- tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 132 ++++++++++++++--- 79 files changed, 3882 insertions(+), 877 deletions(-) create mode 100644 src/cpu_map/x86_486-v1.xml create mode 100644 src/cpu_map/x86_Conroe-v1.xml create mode 100644 src/cpu_map/x86_EPYC-Genoa-v1.xml create mode 100644 src/cpu_map/x86_KnightsMill-v1.xml create mode 100644 src/cpu_map/x86_Opteron_G1-v1.xml create mode 100644 src/cpu_map/x86_Opteron_G2-v1.xml create mode 100644 src/cpu_map/x86_Opteron_G3-v1.xml create mode 100644 src/cpu_map/x86_Opteron_G4-v1.xml create mode 100644 src/cpu_map/x86_Opteron_G5-v1.xml create mode 100644 src/cpu_map/x86_Penryn-v1.xml create mode 100644 src/cpu_map/x86_athlon-v1.xml create mode 100644 src/cpu_map/x86_core2duo-v1.xml create mode 100644 src/cpu_map/x86_coreduo-v1.xml create mode 100644 src/cpu_map/x86_kvm32-v1.xml create mode 100644 src/cpu_map/x86_kvm64-v1.xml create mode 100644 src/cpu_map/x86_n270-v1.xml create mode 100644 src/cpu_map/x86_pentium-v1.xml create mode 100644 src/cpu_map/x86_pentium2-v1.xml create mode 100644 src/cpu_map/x86_pentium3-v1.xml create mode 100644 src/cpu_map/x86_phenom-v1.xml create mode 100644 src/cpu_map/x86_qemu32-v1.xml create mode 100644 src/cpu_map/x86_qemu64-v1.xml -- 2.47.0

2 26

[PATCH] virsh: Fix --timeout option of migrate command
by Jiri Denemark 12 Dec '24

12 Dec '24

When starting a migration with --timeout, we create a thread to call the migration API and in parallel setup a timer for the timeout. The description of --timeout says: "run action specified by --timeout-* option (suspend by default) if live migration exceeds timeout", which is not really the way this feature was implemented. Before live migration starts we first need to contact the source to get the domain definition and send it to the destination where a new QEMU process has to be started. This can take some (unpredictably long) time while the timeout timer is already running. If a very short timeout is set (which doesn't really make sense, but it's allowed), we may even end up taking the timeout action before the actual migration had a chance to start. With this patch the timeout is started only after we get non-zero dataTotal from virDomainGetJobInfo, which means the migration (of either storage or memory) really started. https://issues.redhat.com/browse/RHEL-41264 Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- tools/virsh-domain.c | 55 ++++++++++++++++++++++++++++---------------- 1 file changed, 35 insertions(+), 20 deletions(-) diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c index e4923284af..546db955a9 100644 --- a/tools/virsh-domain.c +++ b/tools/virsh-domain.c @@ -4237,7 +4237,10 @@ typedef void (*jobWatchTimeoutFunc)(vshControl *ctl, virDomainPtr dom, struct virshWatchData { vshControl *ctl; virDomainPtr dom; + GMainContext *context; jobWatchTimeoutFunc timeout_func; + int timeout_secs; + GSource *timeout_src; void *opaque; const char *label; GIOChannel *stdin_ioc; @@ -4259,6 +4262,20 @@ virshWatchTimeout(gpointer opaque) } +static void +virshWatchSetTimeout(struct virshWatchData *data) +{ + vshDebug(data->ctl, VSH_ERR_DEBUG, + "watchJob: setting timeout of %d secs\n", data->timeout_secs); + + data->timeout_src = g_timeout_source_new_seconds(data->timeout_secs); + g_source_set_callback(data->timeout_src, + virshWatchTimeout, + data, NULL); + g_source_attach(data->timeout_src, data->context); +} + + static gboolean virshWatchProgress(gpointer opaque) { @@ -4290,10 +4307,17 @@ virshWatchProgress(gpointer opaque) jobinfo.type == VIR_DOMAIN_JOB_UNBOUNDED)) { vshTTYDisableInterrupt(data->ctl); data->jobStarted = true; + vshDebug(data->ctl, VSH_ERR_DEBUG, + "watchJob: job started\n"); + } - if (!data->verbose) { + if (data->jobStarted) { + if (data->timeout_secs > 0 && !data->timeout_src) { + if (jobinfo.dataTotal > 0) + virshWatchSetTimeout(data); + } else if (!data->verbose) { vshDebug(data->ctl, VSH_ERR_DEBUG, - "watchJob: job started, disabling callback\n"); + "watchJob: disabling callback\n"); return G_SOURCE_REMOVE; } } @@ -4356,13 +4380,15 @@ virshWatchJob(vshControl *ctl, struct sigaction sig_action; struct sigaction old_sig_action; #endif /* !WIN32 */ - g_autoptr(GSource) timeout_src = NULL; g_autoptr(GSource) progress_src = NULL; g_autoptr(GSource) stdin_src = NULL; struct virshWatchData data = { .ctl = ctl, .dom = dom, + .context = g_main_loop_get_context(eventLoop), .timeout_func = timeout_func, + .timeout_secs = timeout_secs, + .timeout_src = NULL, .opaque = opaque, .label = label, .stdin_ioc = NULL, @@ -4391,27 +4417,14 @@ virshWatchJob(vshControl *ctl, g_source_set_callback(stdin_src, (GSourceFunc)virshWatchInterrupt, &data, NULL); - g_source_attach(stdin_src, - g_main_loop_get_context(eventLoop)); - } - - if (timeout_secs) { - vshDebug(ctl, VSH_ERR_DEBUG, - "watchJob: setting timeout of %d secs\n", timeout_secs); - timeout_src = g_timeout_source_new_seconds(timeout_secs); - g_source_set_callback(timeout_src, - virshWatchTimeout, - &data, NULL); - g_source_attach(timeout_src, - g_main_loop_get_context(eventLoop)); + g_source_attach(stdin_src, data.context); } progress_src = g_timeout_source_new(500); g_source_set_callback(progress_src, virshWatchProgress, &data, NULL); - g_source_attach(progress_src, - g_main_loop_get_context(eventLoop)); + g_source_attach(progress_src, data.context); g_main_loop_run(eventLoop); @@ -4420,8 +4433,10 @@ virshWatchJob(vshControl *ctl, if (*job_err == 0 && verbose) /* print [100 %] */ virshPrintJobProgress(label, 0, 1); - if (timeout_src) - g_source_destroy(timeout_src); + if (data.timeout_src) { + g_source_destroy(data.timeout_src); + g_source_unref(data.timeout_src); + } g_source_destroy(progress_src); if (stdin_src) g_source_destroy(stdin_src); -- 2.47.0

2 1

[PATCH] ch: Enable user aliases
by Praveen K Paladugu 12 Dec '24

12 Dec '24

Enable parsing user aliases in ch driver. Signed-off-by: Praveen K Paladugu <praveenkpaladugu(a)gmail.com> --- src/ch/ch_domain.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/ch/ch_domain.c b/src/ch/ch_domain.c index bfccabed49..4f5966adce 100644 --- a/src/ch/ch_domain.c +++ b/src/ch/ch_domain.c @@ -284,7 +284,8 @@ virDomainDefParserConfig virCHDriverDomainDefParserConfig = { .domainPostParseBasicCallback = virCHDomainDefPostParseBasic, .domainPostParseCallback = virCHDomainDefPostParse, .deviceValidateCallback = chValidateDomainDeviceDef, - .features = VIR_DOMAIN_DEF_FEATURE_NO_STUB_CONSOLE, + .features = VIR_DOMAIN_DEF_FEATURE_NO_STUB_CONSOLE | + VIR_DOMAIN_DEF_FEATURE_USER_ALIAS, }; virCHMonitor * -- 2.47.0

2 1

[PATCH v4 0/5] ch: handle events from cloud-hypervisor
by Purna Pavan Chandra Aekkaladevi 11 Dec '24

11 Dec '24

changes from v3->v4: * Don't abort; instead kill the VM and exit * use g_clear_pointer along with g_free * Fix possible memory leak * Rebase on latest master changes from v2->v3: * Remove patch 'utils: Implement virFileIsNamedPipe' as it is no more needed. * Remove the eventmonitorpath only if it exists * Added domain name as a prefix to logs from ch_events.c. This will make debugging easier. * Simplified event parsing logic by reserving a byte for null char. changes from v1->v2: * Rebase on latest master * Use /* */ for comments * Remove fifo file if already exists * Address other comments from Praveen Paladugu cloud-hypervisor raises various events, including VM lifecylce operations such as boot, shutdown, pause, resume, etc. Libvirt will now read these events and take the necessary actions, such as correctly updating the domain state. A FIFO file is passed to `--event-monitor` option of cloud-hypervisor. Libvirt creates a new thread that acts as the reader of the fifo file and continuously monitors for new events. Currently, shutdown events are handled by updating the domain state appropriately. Purna Pavan Chandra Aekkaladevi (5): ch: pass --event-monitor option to cloud-hypervisor ch: start a new thread for handling ch events ch: events: Read and parse cloud-hypervisor events ch: events: facilitate lifecycle events handling NEWS: Mention event handling support in ch driver NEWS.rst | 7 + po/POTFILES | 1 + src/ch/ch_events.c | 331 ++++++++++++++++++++++++++++++++++++++++++++ src/ch/ch_events.h | 54 ++++++++ src/ch/ch_monitor.c | 52 ++++++- src/ch/ch_monitor.h | 11 ++ src/ch/meson.build | 2 + 7 files changed, 451 insertions(+), 7 deletions(-) create mode 100644 src/ch/ch_events.c create mode 100644 src/ch/ch_events.h -- 2.34.1

2 9

[libvirt PATCH v3] qemu: tpm: do not update profile name for transient domains
by Ján Tomko 11 Dec '24

11 Dec '24

If we do not have a persistent definition, there's no point in looking for it since we cannot store it. Also skip the update if the tpm device(s) in the persistent definition are different. This fixes the crash when starting a transient domain. https://issues.redhat.com/browse/RHEL-69774 Fixes: d79542eec669eb9c449bb8228179e7a87e768017 Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/qemu/qemu_extdevice.c | 13 ++++++++++++- src/qemu/qemu_tpm.c | 2 +- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_extdevice.c b/src/qemu/qemu_extdevice.c index a6f31f9773..954cb323a4 100644 --- a/src/qemu/qemu_extdevice.c +++ b/src/qemu/qemu_extdevice.c @@ -190,7 +190,18 @@ qemuExtDevicesStart(virQEMUDriver *driver, for (i = 0; i < def->ntpms; i++) { virDomainTPMDef *tpm = def->tpms[i]; - virDomainTPMDef *persistentTPMDef = persistentDef->tpms[i]; + virDomainTPMDef *persistentTPMDef = NULL; + + if (persistentDef) { + /* do not try to update the profile in the persistent definition + * if the device does not match */ + if (persistentDef->ntpms == def->ntpms) + persistentTPMDef = persistentDef->tpms[i]; + if (persistentTPMDef && + (persistentTPMDef->type != tpm->type || + persistentTPMDef->model != tpm->model)) + persistentTPMDef = NULL; + } if (tpm->type == VIR_DOMAIN_TPM_TYPE_EMULATOR && qemuExtTPMStart(driver, vm, tpm, persistentTPMDef, diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index f223dcb9ae..f5e0184e54 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -773,7 +773,7 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm, incomingMigration) < 0) goto error; - if (run_setup && !incomingMigration && + if (run_setup && !incomingMigration && persistentTPMDef && qemuTPMEmulatorUpdateProfileName(&tpm->data.emulator, persistentTPMDef, cfg, saveDef) < 0) goto error; -- 2.47.0

4 3

[libvirt PATCH v2] qemu: tpm: do not update profile name for transient domains
by Ján Tomko 11 Dec '24

11 Dec '24

If we do not have a persistent definition, there's no point in looking for it since we cannot store it. Also skip the update if the tpm device(s) in the persistent definition are different. This fixes the crash when starting a transient domain. https://issues.redhat.com/browse/RHEL-69774 Fixes: d79542eec669eb9c449bb8228179e7a87e768017 Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/qemu/qemu_extdevice.c | 12 +++++++++++- src/qemu/qemu_tpm.c | 2 +- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_extdevice.c b/src/qemu/qemu_extdevice.c index a6f31f9773..21db01a361 100644 --- a/src/qemu/qemu_extdevice.c +++ b/src/qemu/qemu_extdevice.c @@ -190,7 +190,17 @@ qemuExtDevicesStart(virQEMUDriver *driver, for (i = 0; i < def->ntpms; i++) { virDomainTPMDef *tpm = def->tpms[i]; - virDomainTPMDef *persistentTPMDef = persistentDef->tpms[i]; + virDomainTPMDef *persistentTPMDef = NULL; + + if (persistentDef) { + /* do not try to update the profile in the persistent definition + * if the device does not match */ + if (persistentDef->ntpms == def->ntpms) + persistentTPMDef = persistentDef->tpms[i]; + if (persistentTPMDef->type != tpm->type || + persistentTPMDef->model != tpm->model) + persistentTPMDef = NULL; + } if (tpm->type == VIR_DOMAIN_TPM_TYPE_EMULATOR && qemuExtTPMStart(driver, vm, tpm, persistentTPMDef, diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index f223dcb9ae..f5e0184e54 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -773,7 +773,7 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm, incomingMigration) < 0) goto error; - if (run_setup && !incomingMigration && + if (run_setup && !incomingMigration && persistentTPMDef && qemuTPMEmulatorUpdateProfileName(&tpm->data.emulator, persistentTPMDef, cfg, saveDef) < 0) goto error; -- 2.47.0

3 4

libvirt-gusts blocking boots sequence and usb recovery and others
by "Justin Lanouette (“Anarchsun”)" 11 Dec '24

11 Dec '24

im stuck in a loop because libvirt-service is configured not to start any guests on boot but i need boot options to access grub boot menu or usb boot refi nothing loads not grub nor do r boot option or alt boot nothing works not boot or shift boot noting except target disk mode… its a 2009 iMac on Ubuntu but i must of played with root access or something but i never configured libvirt to block everything and local defi boot gets stuck in a loop because of missing guests i guess...

1 0

Re: [PATCH v5 00/18] *** qemu: block: Support block disk along with throttle filters ***
by Harikumar R 10 Dec '24

10 Dec '24

Hi Team, I hope the v5 reviews are completed. I addressed the review comments and submitted PATCH v6 as link below. PATCH v6 -> https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/DWVJ… Thanks & Regards, Harikumar R

2 1

[PATCH 1/1] virt-aa-helper: allow riscv64 EDK II
by Heinrich Schuchardt 10 Dec '24

10 Dec '24

Debian has packaged EDK II for 64-bit RISC-V in directory /usr/share/qemu-efi-riscv64/. For usage with libvirt update the AppArmor helper. Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt(a)canonical.com> --- src/security/virt-aa-helper.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index e82b5de2b4..1cf9d7ad3d 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -481,6 +481,7 @@ valid_path(const char *path, const bool readonly) "/usr/share/AAVMF/", "/usr/share/qemu-efi/", /* for AAVMF images */ "/usr/share/qemu-efi-aarch64/", + "/usr/share/qemu-efi-riscv64/", "/usr/share/qemu/", /* SUSE path for OVMF and AAVMF images */ "/usr/lib/u-boot/", "/usr/lib/riscv64-linux-gnu/opensbi", -- 2.45.2

2 1

[PATCH pushed] qemuDomainDiskChangeSupportedIothreads: Change error wording to fix grammar
by Peter Krempa 10 Dec '24

10 Dec '24

Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_domain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 1fc4e2f33f..3366346624 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -6676,7 +6676,7 @@ qemuDomainDiskChangeSupportedIothreads(virDomainDiskDef *disk, fail: virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", - _("cannot modify field '<iothreads>' (or it's parts) of the disk")); + _("cannot modify '<iothreads>' configuration of the disk")); return false; } -- 2.47.0

1 0

[PATCH v2 0/5] Allow Guest CPU Model with Deprecated Features Disabled
by Collin Walling 09 Dec '24

09 Dec '24

# Changelog v2 - rebased on latest master changes # Description Add support for libvirt to query and cache an array of deprecated CPU features (aka CPU properties) for the host-model. This data is queried via a full query-cpu-model-expansion and cached in the QEMU capabilities file. This model expansion will depend on the availability of the "deprecated-props" field resulting from a query-cpu-model-expansion command. Currently, only s390x supports this field. The purpose of these patches is to make it easy for users to create guests with a CPU model that will be compatible & migratable with future hardware. An updated host CPU model with deprecated features paired with the policy "disable" may be visable via an update to the virsh domcapabilities command with the --disable-deprecated-features flag. An example is shown below. Note: other CPU model queries (e.g. baseline and comparison) currently do not consider deprecated features, as their outputs do not consider feature policy. If implementation is desired, it will require a discussion on how these commands should report policies. Examples: virsh domcapabilities --disable-deprecated-features e.g. output (trimmed): <mode name='host-model' supported='yes'> <model fallback='forbid'>z14.2-base</model> <feature policy='require' name='aen'/> <feature policy='require' name='cmmnt'/> <feature policy='require' name='aefsi'/> <feature policy='require' name='diag318'/> <feature policy='require' name='mepoch'/> <feature policy='require' name='msa8'/> <feature policy='require' name='msa7'/> <feature policy='require' name='msa6'/> <feature policy='require' name='msa5'/> <feature policy='require' name='msa4'/> <feature policy='require' name='msa3'/> <feature policy='require' name='msa2'/> <feature policy='require' name='msa1'/> <feature policy='require' name='sthyi'/> <feature policy='require' name='edat'/> <feature policy='require' name='ri'/> <feature policy='require' name='edat2'/> <feature policy='require' name='etoken'/> <feature policy='require' name='vx'/> <feature policy='require' name='ipter'/> <feature policy='require' name='mepochptff'/> <feature policy='require' name='ap'/> <feature policy='require' name='vxeh'/> <feature policy='require' name='vxpd'/> <feature policy='require' name='esop'/> <feature policy='require' name='apqi'/> <feature policy='require' name='apft'/> <feature policy='require' name='els'/> <feature policy='require' name='iep'/> <feature policy='require' name='apqci'/> <feature policy='disable' name='cte'/> <feature policy='require' name='ais'/> <feature policy='disable' name='bpb'/> <feature policy='require' name='ctop'/> <feature policy='require' name='gs'/> <feature policy='require' name='ppa15'/> <feature policy='require' name='zpci'/> <feature policy='require' name='sea_esop2'/> <feature policy='disable' name='te'/> <feature policy='require' name='cmm'/> <feature policy='disable' name='csske'/> </mode> A domain may be defined with a new <cpu> XML attribute, deprecated_features='on|off': <cpu mode='host-model' check='partial' deprecated_features='off'/> e.g. after guest has started (trimmed): <cpu mode='custom' match='exact' check='partial' deprecated_features='off'> <model fallback='forbid'>z14.2-base</model> <feature policy='require' name='aen'/> <feature policy='require' name='cmmnt'/> <feature policy='require' name='aefsi'/> <feature policy='require' name='diag318'/> <feature policy='require' name='mepoch'/> <feature policy='require' name='msa8'/> <feature policy='require' name='msa7'/> <feature policy='require' name='msa6'/> <feature policy='require' name='msa5'/> <feature policy='require' name='msa4'/> <feature policy='require' name='msa3'/> <feature policy='require' name='msa2'/> <feature policy='require' name='msa1'/> <feature policy='require' name='sthyi'/> <feature policy='require' name='edat'/> <feature policy='require' name='ri'/> <feature policy='require' name='edat2'/> <feature policy='require' name='etoken'/> <feature policy='require' name='vx'/> <feature policy='require' name='ipter'/> <feature policy='require' name='mepochptff'/> <feature policy='require' name='ap'/> <feature policy='require' name='vxeh'/> <feature policy='require' name='vxpd'/> <feature policy='require' name='esop'/> <feature policy='require' name='apqi'/> <feature policy='require' name='apft'/> <feature policy='require' name='els'/> <feature policy='require' name='iep'/> <feature policy='require' name='apqci'/> <feature policy='disable' name='cte'/> <feature policy='require' name='ais'/> <feature policy='disable' name='bpb'/> <feature policy='require' name='ctop'/> <feature policy='require' name='gs'/> <feature policy='require' name='ppa15'/> <feature policy='require' name='zpci'/> <feature policy='require' name='sea_esop2'/> <feature policy='disable' name='te'/> <feature policy='require' name='cmm'/> <feature policy='disable' name='csske'/> </cpu> Collin Walling (5): qemuMonitorJSONGetCPUModelExpansion: refactor parsing functions qemu: parse deprecated-props from query-cpu-model-expansion response qemu_capabilities: query deprecated features for host-model virsh: add --disable-deprecated-features flag to domcapabilities conf: add deprecated_features attribute docs/manpages/virsh.rst | 6 + include/libvirt/libvirt-domain.h | 12 + src/conf/cpu_conf.c | 10 + src/conf/cpu_conf.h | 1 + src/conf/schemas/cputypes.rng | 12 + src/libvirt-domain.c | 2 +- src/qemu/qemu_capabilities.c | 89 +++++ src/qemu/qemu_capabilities.h | 4 + src/qemu/qemu_driver.c | 8 +- src/qemu/qemu_monitor.c | 10 + src/qemu/qemu_monitor.h | 1 + src/qemu/qemu_monitor_json.c | 64 +++- src/qemu/qemu_process.c | 4 + .../caps_9.1.0_s390x.replies | 348 +++++++++++++++++- .../qemucapabilitiesdata/caps_9.1.0_s390x.xml | 13 + .../caps_9.2.0_s390x.replies | 348 +++++++++++++++++- .../qemucapabilitiesdata/caps_9.2.0_s390x.xml | 13 + tools/virsh-host.c | 9 +- 18 files changed, 940 insertions(+), 14 deletions(-) -- 2.45.1

3 16

[PATCH v6 00/18] *** qemu: block: Support block disk along with throttle filters ***
by Harikumar R 09 Dec '24

09 Dec '24

*** Support block disk along with throttle filters *** Chun Feng Wu (17): schema: Add new domain elements to support multiple throttle groups schema: Add new domain elements to support multiple throttle filters config: Introduce ThrottleGroup and corresponding XML parsing config: Introduce ThrottleFilter and corresponding XML parsing qemu: monitor: Add support for ThrottleGroup operations tests: Test qemuMonitorJSONGetThrottleGroup and qemuMonitorJSONUpdateThrottleGroup remote: New APIs for ThrottleGroup lifecycle management qemu: Refactor qemuDomainSetBlockIoTune to extract common methods qemu: Implement qemu driver for throttle API qemu: helper: throttle filter nodename and preparation processing qemu: block: Support block disk along with throttle filters config: validate: Verify iotune, throttle group and filter qemuxmlconftest: Add 'throttlefilter' tests test_driver: Test throttle group lifecycle APIs virsh: Refactor iotune options for re-use virsh: Add support for throttle group operations virsh: Add option "throttle-groups" to "attach_disk" Harikumar R (1): tests: Test qemuxmlactivetestThrottleGroup docs/formatdomain.rst | 47 ++ docs/manpages/virsh.rst | 135 +++- include/libvirt/libvirt-domain.h | 21 + src/conf/domain_conf.c | 405 +++++++++++ src/conf/domain_conf.h | 45 ++ src/conf/domain_validate.c | 119 ++- src/conf/schemas/domaincommon.rng | 293 ++++---- src/conf/virconftypes.h | 4 + src/driver-hypervisor.h | 22 + src/libvirt-domain.c | 174 +++++ src/libvirt_private.syms | 8 + src/libvirt_public.syms | 7 + src/qemu/qemu_block.c | 136 ++++ src/qemu/qemu_block.h | 49 ++ src/qemu/qemu_command.c | 180 +++++ src/qemu/qemu_command.h | 6 + src/qemu/qemu_domain.c | 73 +- src/qemu/qemu_driver.c | 619 +++++++++++++--- src/qemu/qemu_hotplug.c | 33 + src/qemu/qemu_monitor.c | 34 + src/qemu/qemu_monitor.h | 14 + src/qemu/qemu_monitor_json.c | 134 ++++ src/qemu/qemu_monitor_json.h | 14 + src/remote/remote_daemon_dispatch.c | 44 ++ src/remote/remote_driver.c | 40 ++ src/remote/remote_protocol.x | 48 +- src/remote_protocol-structs | 28 + src/test/test_driver.c | 452 ++++++++---- tests/qemumonitorjsontest.c | 86 +++ .../throttlefilter-in.xml | 392 ++++++++++ .../throttlefilter-out.xml | 393 ++++++++++ tests/qemuxmlactivetest.c | 1 + .../throttlefilter-invalid.x86_64-latest.err | 1 + .../throttlefilter-invalid.xml | 89 +++ .../throttlefilter.x86_64-latest.args | 55 ++ .../throttlefilter.x86_64-latest.xml | 105 +++ tests/qemuxmlconfdata/throttlefilter.xml | 95 +++ tests/qemuxmlconftest.c | 2 + tools/virsh-completer-domain.c | 82 +++ tools/virsh-completer-domain.h | 16 + tools/virsh-domain.c | 680 ++++++++++++++---- 41 files changed, 4656 insertions(+), 525 deletions(-) create mode 100644 tests/qemustatusxml2xmldata/throttlefilter-in.xml create mode 100644 tests/qemustatusxml2xmldata/throttlefilter-out.xml create mode 100644 tests/qemuxmlconfdata/throttlefilter-invalid.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/throttlefilter-invalid.xml create mode 100644 tests/qemuxmlconfdata/throttlefilter.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/throttlefilter.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/throttlefilter.xml -- 2.39.5 (Apple Git-154)

1 18

[PATCH 1/1] virt-aa-helper: allow riscv64 EDK II
by Heinrich Schuchardt 09 Dec '24

09 Dec '24

Debian has packaged EDK II for 64-bit RISC-V in directory /usr/share/qemu-efi-riscv64/. For usage with libvirt update the AppArmor helper. Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt(a)canonical.com> --- src/security/virt-aa-helper.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index e82b5de2b4..1cf9d7ad3d 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -481,6 +481,7 @@ valid_path(const char *path, const bool readonly) "/usr/share/AAVMF/", "/usr/share/qemu-efi/", /* for AAVMF images */ "/usr/share/qemu-efi-aarch64/", + "/usr/share/qemu-efi-riscv64/", "/usr/share/qemu/", /* SUSE path for OVMF and AAVMF images */ "/usr/lib/u-boot/", "/usr/lib/riscv64-linux-gnu/opensbi", -- 2.45.2

1 0

[PATCH 0/5] cpu_map: Add missing -v1 models
by Jiri Denemark 05 Dec '24

05 Dec '24

CPU models that do not have a list of versions attached are still advertised as aliases to corresponding -v1 variants. We should add the missing variants to the CPU map. Available on gitlab: git fetch https://gitlab.com/jirkade/libvirt.git cpu-versions Pipeline: https://gitlab.com/jirkade/libvirt/-/pipelines/1564399375 Jiri Denemark (5): cpu_map: Sort data files in meson.build sync_qemu_models_i386: Update meson.build sync_qemu_models_i386: Ignore old models sync_qemu_models_i386: Generate missing -v1 variants cpu_map: Add missing -v1 models src/cpu_map/index.xml | 2 + src/cpu_map/meson.build | 18 +++--- src/cpu_map/sync_qemu_models_i386.py | 58 +++++++++++++++++++ src/cpu_map/x86_EPYC-Genoa-v1.xml | 6 ++ src/cpu_map/x86_KnightsMill-v1.xml | 6 ++ .../domaincapsdata/qemu_5.2.0-q35.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_5.2.0-tcg.x86_64.xml | 20 ++++++- tests/domaincapsdata/qemu_5.2.0.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_6.0.0-q35.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_6.0.0-tcg.x86_64.xml | 20 ++++++- tests/domaincapsdata/qemu_6.0.0.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_6.1.0-q35.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_6.1.0-tcg.x86_64.xml | 20 ++++++- tests/domaincapsdata/qemu_6.1.0.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 20 ++++++- tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 20 ++++++- tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 20 ++++++- tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 14 ++++- .../qemu_7.2.0-tcg.x86_64+hvf.xml | 16 ++++- .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 16 ++++- tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 16 ++++- tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 14 ++++- .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 46 ++++++++++++++- .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 56 +++++++++++++++++- tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 46 ++++++++++++++- .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 46 ++++++++++++++- .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 55 +++++++++++++++++- tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 46 ++++++++++++++- .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 46 ++++++++++++++- .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 54 ++++++++++++++++- tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 46 ++++++++++++++- .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 46 ++++++++++++++- .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 54 ++++++++++++++++- tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 46 ++++++++++++++- .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 46 ++++++++++++++- .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 54 ++++++++++++++++- tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 46 ++++++++++++++- 45 files changed, 1152 insertions(+), 63 deletions(-) create mode 100644 src/cpu_map/x86_EPYC-Genoa-v1.xml create mode 100644 src/cpu_map/x86_KnightsMill-v1.xml -- 2.47.0

3 10

[libvirt PATCH] lxc: remove no longer working netns check
by Leigh Brown 05 Dec '24

05 Dec '24

Since iproute2 v6.12.0, the command "ip link set lo netns -1" can no longer be used to check for netns support, as it now validates PIDs are not less than zero. Since every kernel we care about has the support, just remove the check. Signed-off-by: Leigh Brown <leigh(a)solinno.co.uk> --- src/lxc/lxc_conf.h | 1 - src/lxc/lxc_driver.c | 36 ------------------------------------ 2 files changed, 37 deletions(-) diff --git a/src/lxc/lxc_conf.h b/src/lxc/lxc_conf.h index c0967ac63b..a639e3989f 100644 --- a/src/lxc/lxc_conf.h +++ b/src/lxc/lxc_conf.h @@ -49,7 +49,6 @@ struct _virLXCDriverConfig { char *stateDir; char *logDir; bool log_libvirtd; - int have_netns; char *securityDriverName; bool securityDefaultConfined; diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index d682e7168a..2488940feb 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -422,12 +422,6 @@ lxcDomainDefineXMLFlags(virConnectPtr conn, const char *xml, unsigned int flags) if (virSecurityManagerVerify(driver->securityManager, def) < 0) goto cleanup; - if ((def->nets != NULL) && !(cfg->have_netns)) { - virReportError(VIR_ERR_OPERATION_INVALID, - "%s", _("System lacks NETNS support")); - goto cleanup; - } - if (!(vm = virDomainObjListAdd(driver->domains, &def, driver->xmlopt, 0, &oldDef))) @@ -974,12 +968,6 @@ static int lxcDomainCreateWithFiles(virDomainPtr dom, if (virDomainCreateWithFilesEnsureACL(dom->conn, vm->def) < 0) goto cleanup; - if ((vm->def->nets != NULL) && !(cfg->have_netns)) { - virReportError(VIR_ERR_OPERATION_INVALID, - "%s", _("System lacks NETNS support")); - goto cleanup; - } - if (virDomainObjBeginJob(vm, VIR_JOB_MODIFY) < 0) goto cleanup; @@ -1088,13 +1076,6 @@ lxcDomainCreateXMLWithFiles(virConnectPtr conn, if (virSecurityManagerVerify(driver->securityManager, def) < 0) goto cleanup; - if ((def->nets != NULL) && !(cfg->have_netns)) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, - "%s", _("System lacks NETNS support")); - goto cleanup; - } - - if (!(vm = virDomainObjListAdd(driver->domains, &def, driver->xmlopt, VIR_DOMAIN_OBJ_LIST_ADD_LIVE | @@ -1386,22 +1367,6 @@ lxcDomainDestroy(virDomainPtr dom) return lxcDomainDestroyFlags(dom, 0); } -static int lxcCheckNetNsSupport(void) -{ - g_autoptr(virCommand) cmd = virCommandNewArgList("ip", "link", "set", "lo", - "netns", "-1", NULL); - int ip_rc; - - if (virCommandRun(cmd, &ip_rc) < 0 || ip_rc == 255) - return 0; - - if (virProcessNamespaceAvailable(VIR_PROCESS_NAMESPACE_NET) < 0) - return 0; - - return 1; -} - - static virSecurityManager * lxcSecurityInit(virLXCDriverConfig *cfg) { @@ -1481,7 +1446,6 @@ lxcStateInitialize(bool privileged, goto cleanup; cfg->log_libvirtd = false; /* by default log to container logfile */ - cfg->have_netns = lxcCheckNetNsSupport(); /* Call function to load lxc driver configuration information */ if (virLXCLoadDriverConfig(cfg, SYSCONFDIR "/libvirt/lxc.conf") < 0) -- 2.39.5

2 1

[PATCH] rpm: replace 'git' with 'git-core'
by Daniel P. Berrangé 04 Dec '24

04 Dec '24

We don't need the full git package, git-core is sufficient and a smaller build root install. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 901ed9c464..9c1d0a423d 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -331,7 +331,7 @@ Requires: libvirt-libs = %{version}-%{release} BuildRequires: python3-docutils BuildRequires: meson >= 0.56.0 BuildRequires: ninja-build -BuildRequires: git +BuildRequires: git-core BuildRequires: perl-interpreter BuildRequires: python3 BuildRequires: python3-pytest -- 2.46.0

2 1

[PATCH] util: Fix typo in virNetDevOpenvswitchInterfaceSetQos
by Jiri Denemark 04 Dec '24

04 Dec '24

The typo is causing virtqemud to crash when starting a domain with ovs bridge interface and QOS. https://issues.redhat.com/browse/RHEL-69840 Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/util/virnetdevopenvswitch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/virnetdevopenvswitch.c b/src/util/virnetdevopenvswitch.c index a1bd9f3d5b..0f5d23b794 100644 --- a/src/util/virnetdevopenvswitch.c +++ b/src/util/virnetdevopenvswitch.c @@ -958,7 +958,7 @@ virNetDevOpenvswitchInterfaceSetQos(const char *ifname, } if (rx) { - if (rx->peak && tx->peak != rx->average) { + if (rx->peak && rx->peak != rx->average) { VIR_WARN("Setting different 'peak' value than 'average' for QoS for OVS interface %s might have unexpected results", ifname); } -- 2.47.0

2 1

[RFC PATCH 0/3] iproute2 bridge vlan support
by Leigh Brown 04 Dec '24

04 Dec '24

The iproute2 bridge command supports the capability for VLAN filtering that allows each interface connected to a bridge to be configured to use one or more VLANs. For simple setups, this capability is enough to allow virtual machines or containers to be put onto separate VLANs without creating multiple bridges and VLANs on the host. The first patch adds a new function virNetDevBridgeSetupVlans() that will, given a virNetDevVlan structure, execute the required bridge vlan commands to configure the given interface accordingly. The second patch updates the virNetDevBridgeAddPort() function to allow a virNetDevVlan parameter to be passed, and to call the virNetDevBridgeSetupVlans() function. The third patch updates the lxc and tap code to pass the virNetDevLan parameter from the configuration and to update the XML validation to permit the VLAN-related tags for standard bridges. Usage example ============= Configure the host with systemd-networkd as follows: /etc/systemd/network/br0.netdev (br0.network not shown) [NetDev] Name=br0 Kind=bridge MACAddress=xx:xx:xx:xx:xx:xx [Bridge] VLANFiltering=on /etc/systemd/network/eno1.network [Match] Name=eno1 [Network] Bridge=br0 [Link] MTUBytes=9000 [BridgeVLAN] VLAN=40 [BridgeVLAN] VLAN=60 Then add <vlan> tags into the lxc or qemu config: lxc interface definition: <interface type='bridge'> <mac address='xx:xx:xx:xx:xx:xx'/> <source bridge='br0'/> <vlan> <tag id='40'/> </vlan> </interface> qemu interface definition: <interface type='network'> <mac address='xx:xx:xx:xx:xx:xx'/> <source network='br0'/> <vlan> <tag id='60'/> </vlan> <model type='virtio'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </interface> Then, after starting them, you will see the following $ sudo bridge vlan port vlan-id eno1 1 PVID Egress Untagged 40 60 br0 1 PVID Egress Untagged vnet0 60 PVID Egress Untagged vnet1 40 PVID Egress Untagged This is an RFC because I am not very familiar with the code, but all feedback is welcome! Regards, Leigh. Leigh Brown (3): util: bridge: add virNetDevBridgeSetupVlans() util: bridge: virNetDevBridgeAddPort vlan support util: bridge: enable bridge vlan support meson.build | 1 + src/conf/domain_validate.c | 3 +- src/lxc/lxc_process.c | 3 +- src/util/virnetdevbridge.c | 65 +++++++++++++++++++++++++++++++++++--- src/util/virnetdevbridge.h | 4 ++- src/util/virnetdevtap.c | 2 +- 6 files changed, 70 insertions(+), 8 deletions(-) -- 2.39.5

1 3

[PATCH v3 0/5] ch: handle events from cloud-hypervisor
by Purna Pavan Chandra Aekkaladevi 03 Dec '24

03 Dec '24

changes from v2->v3: * Remove patch 'utils: Implement virFileIsNamedPipe' as it is no more needed. * Remove the eventmonitorpath only if it exists * Added domain name as a prefix to logs from ch_events.c. This will make debugging easier. * Simplified event parsing logic by reserving a byte for null char. changes from v1->v2: * Rebase on latest master * Use /* */ for comments * Remove fifo file if already exists * Address other comments from Praveen Paladugu cloud-hypervisor raises various events, including VM lifecylce operations such as boot, shutdown, pause, resume, etc. Libvirt will now read these events and take the necessary actions, such as correctly updating the domain state. A FIFO file is passed to `--event-monitor` option of cloud-hypervisor. Libvirt creates a new thread that acts as the reader of the fifo file and continuously monitors for new events. Currently, shutdown events are handled by updating the domain state appropriately. Purna Pavan Chandra Aekkaladevi (5): ch: pass --event-monitor option to cloud-hypervisor ch: start a new thread for handling ch events ch: events: Read and parse cloud-hypervisor events ch: events: facilitate lifecycle events handling NEWS: Mention event handling support in ch driver NEWS.rst | 7 + po/POTFILES | 1 + src/ch/ch_events.c | 329 ++++++++++++++++++++++++++++++++++++++++++++ src/ch/ch_events.h | 54 ++++++++ src/ch/ch_monitor.c | 52 ++++++- src/ch/ch_monitor.h | 11 ++ src/ch/meson.build | 2 + 7 files changed, 449 insertions(+), 7 deletions(-) create mode 100644 src/ch/ch_events.c create mode 100644 src/ch/ch_events.h -- 2.34.1

3 14

[libvirt PATCH] qemu: tpm: do not update profile name for transient domains
by Ján Tomko 03 Dec '24

03 Dec '24

If we do not have a persistent definition, there's no point in looking for it since we cannot store it. This fixes the crash when starting a transient domain. https://issues.redhat.com/browse/RHEL-69774 Fixes: d79542eec669eb9c449bb8228179e7a87e768017 Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/qemu/qemu_extdevice.c | 5 ++++- src/qemu/qemu_tpm.c | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_extdevice.c b/src/qemu/qemu_extdevice.c index a6f31f9773..d4b6e11e0b 100644 --- a/src/qemu/qemu_extdevice.c +++ b/src/qemu/qemu_extdevice.c @@ -190,7 +190,10 @@ qemuExtDevicesStart(virQEMUDriver *driver, for (i = 0; i < def->ntpms; i++) { virDomainTPMDef *tpm = def->tpms[i]; - virDomainTPMDef *persistentTPMDef = persistentDef->tpms[i]; + virDomainTPMDef *persistentTPMDef = NULL; + + if (persistentDef) + persistentTPMDef = persistentDef->tpms[i]; if (tpm->type == VIR_DOMAIN_TPM_TYPE_EMULATOR && qemuExtTPMStart(driver, vm, tpm, persistentTPMDef, diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index f223dcb9ae..f5e0184e54 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -773,7 +773,7 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm, incomingMigration) < 0) goto error; - if (run_setup && !incomingMigration && + if (run_setup && !incomingMigration && persistentTPMDef && qemuTPMEmulatorUpdateProfileName(&tpm->data.emulator, persistentTPMDef, cfg, saveDef) < 0) goto error; -- 2.47.0

3 2

Release of libvirt-10.10.0
by Jiri Denemark 02 Dec '24

02 Dec '24

The 10.10.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * New features * qemu: add multi boot device support on s390x For classical mainframe guests (i.e. LPAR or z/VM installations), you always have to explicitly specify the disk where you want to boot from (or "IPL" from, in s390x-speak -- IPL means "Initial Program Load"). In the past QEMU only used the first device in the boot order to IPL from. With the new multi boot device support on s390x that is available with QEMU version 9.2 and newer, this limitation is lifted. If the IPL fails for the first device with the lowest boot index, the device with the second lowest boot index will be tried and so on until IPL is successful or there are no remaining boot devices to try. Limitation: The s390x BIOS will try to IPL up to 8 total devices, any number of which may be disks or network devices. * qemu: Add support for versioned CPU models Updates to QEMU CPU models with -vN suffix can now be used in libvirt just like any other CPU model. * qemu: Support for the 'data-file' QCOW2 image feature The QEMU hypervisor driver now supports QCOW2 images with 'data-file' feature present (both when probing form the image itself and when specified explicitly via ``<dataStore>`` element). This can be useful when it's required to keep data "raw" on disk, but the use case requires features of the QCOW2 format such as incremental backups. * swtpm: Add support for profiles Upcoming swtpm release will have TPM profile support that allows to restrict a TPM's provided set of crypto algorithms and commands. Users can now select profile by using ``<profile/>`` in their TPM XML definition. * Improvements * qemu: Support UEFI NVRAM images on block storage Libvirt now allows users to use block storage as backend for UEFI NVRAM images and allows them to be in format different than the template. When qcow2 is used as the format, the images are now also auto-populated from the template. * qemu: Automatically add IOMMU when needed When domain of 'qemu' or 'kvm' type has more than 255 vCPUs IOMMU with EIM mode is required. Starting with this release libvirt automatically adds one (or turns on the EIM mode if there's IOMMU without it). * ch: allow hostdevs in domain definition The Cloud Hypervisor driver (ch) now supports ``<hostdev/>``-s. * ch: Enable callbacks for ch domain events The Cloud Hypervisor driver (ch) now supports emitting events on domain define, undefine, start, boot, stop and destroy. * Bug fixes * qemu: Fix reversion and inactive deletion of internal snapshots with UEFI NVRAM In `v10.9.0 (2024-11-01)`_ creation of internal snapshots of VMs with UEFI firmware was allowed, but certain operations such as reversion or inactive deletion didn't work properly as they didn't consider the NVRAM qcow2 file. * virnetdevopenvswitch: Warn on unsupported QoS settings For OpenVSwitch vNICs libivrt does not set QoS directly using 'tc' but offloads setting to OVS. But OVS is not as feature full as libvirt in this regard and setting different 'peak' than 'average' results in vNIC always sticking with 'peak'. Produce a warning if that's the case. Enjoy. Jirka

1 0

[PATCH] qemu:qemu_snapshot: Fix a libvirtd cransh when delete snapshot
by jungle man 29 Nov '24

29 Nov '24

qemuDomainDiskByName() can return a NULL pointer on failure, but this returned value in qemuSnapshotDeleteValidate is not checked. It will make libvirtd crash. diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c index 5b3aadcbf0..52312b4a7b 100644 --- a/src/qemu/qemu_snapshot.c +++ b/src/qemu/qemu_snapshot.c @@ -4235,8 +4235,11 @@ qemuSnapshotDeleteValidate(virDomainObj *vm, virDomainDiskDef *vmdisk = NULL; virDomainDiskDef *disk = NULL; - vmdisk = qemuDomainDiskByName(vm->def, snapDisk->name); - disk = qemuDomainDiskByName(snapdef->parent.dom, snapDisk->name); + if (!(vmdisk = qemuDomainDiskByName(vm->def, snapDisk->name))) + return -1; + + if (!(disk = qemuDomainDiskByName(snapdef->parent.dom, snapDisk->name))) + return -1; if (!virStorageSourceIsSameLocation(vmdisk->src, disk->src)) { virReportError(VIR_ERR_OPERATION_UNSUPPORTED,

2 2

[PATCH] qemu: enable QEMU core dump by default on Linux
by Daniel P. Berrangé 29 Nov '24

29 Nov '24

The Linux MADV_DONTDUMP flag was added to Linux kernels > 3.3, back in 2012, and the dump-guest-core flag was added to QEMU > 1.0 at the same time. IOW, on Linux we have long been able to assume that QEMU core dumps will exclude guest memory, unless the user has overridden the host level defaults in the domain XML. It is desirable to permit QEMU core dumps out of the box to make it easier for users to report crashes to their OS vendor without having to reconfigure and restart libvirt daemons and their running guests. While there is a risk that an admin may have set 'dump_guest_core' to true, while leaving 'max_core' to 0, on balance the benefits of easier troubleshooting outweigh the risk of changing the defaults to permit core dumps. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/qemu/qemu.conf.in | 8 +++++--- src/qemu/qemu_conf.c | 10 +++++++--- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/src/qemu/qemu.conf.in b/src/qemu/qemu.conf.in index 89c9b6b913..d853136f10 100644 --- a/src/qemu/qemu.conf.in +++ b/src/qemu/qemu.conf.in @@ -709,7 +709,9 @@ # As a special case it can be set to the string "unlimited" to # to allow arbitrarily sized core dumps. # -# By default the core dump size is set to 0 disabling all dumps +# By default the core dump size is set to unlimited on +# Linux where 'dump_guest_core' defaults to false, and +# is set to 0 on other platforms, disabling all dumps # # Size is a positive integer specifying bytes or the # string "unlimited" @@ -717,8 +719,8 @@ #max_core = "unlimited" # Determine if guest RAM is included in QEMU core dumps. By -# default guest RAM will be excluded if a new enough QEMU is -# present and host kernel supports it. Setting this to '1' will +# default guest RAM will be excluded on Linux platforms, +# and included on all other patforms. Setting this to '1' will # force guest RAM to always be included in QEMU core dumps. # # This setting will be ignored if the guest XML has set the diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 7c15c521c7..8b9fe4e381 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -291,10 +291,14 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privileged, cfg->deprecationBehavior = g_strdup("none"); cfg->storageUseNbdkit = USE_NBDKIT_DEFAULT; -#ifndef MADV_DONTDUMP +#ifdef MADV_DONTDUMP + cfg->maxCore = ULLONG_MAX; +#else /* QEMU uses Linux extensions to madvise() (MADV_DODUMP/MADV_DONTDUMP) to - * include/exclude guest memory from core dump. These might be unavailable - * on some systems. Provide sane default. */ + * include/exclude guest memory from core dump. On non-Linux systems + * core dumps will unavoidably include all guest RAM, so toggle the + * default to reflect this and warn the admin. + */ VIR_INFO("Host kernel doesn't support MADV_DONTDUMP. Enabling dump_guest_core"); cfg->dumpGuestCore = true; #endif -- 2.46.0

2 1

[PATCH] docs: Document how to enable coredumps for session qemu
by Richard W.M. Jones 29 Nov '24

29 Nov '24

Thanks: Daniel P. Berrangé Signed-off-by: Richard W.M. Jones <rjones(a)redhat.com> --- docs/kbase/qemu-core-dump.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/kbase/qemu-core-dump.rst b/docs/kbase/qemu-core-dump.rst index 5c3781cf90..4bd3ff0b9d 100644 --- a/docs/kbase/qemu-core-dump.rst +++ b/docs/kbase/qemu-core-dump.rst @@ -53,6 +53,13 @@ that may get interrupted. In particular long running jobs like live migration or block device copy jobs may abort. It is thus wise to check that the host is mostly idle before restarting the daemons. +Session mode qemu +================= + +For session mode (non-root) qemu, you have to create a new file called +``$HOME/.config/libvirt/qemu.conf``, add the line(s) above, and kill +the user ``virtqemud`` instance. + Guest core dump configuration ============================= -- 2.46.0

1 0

Entering freeze for libvirt-10.10.0
by Jiri Denemark 28 Nov '24

28 Nov '24

I have just tagged v10.10.0-rc1 in the repository and pushed signed tarballs to https://download.libvirt.org/ Please give the release candidate some testing and in case you find a serious issue which should have a fix in the upcoming release, feel free to reply to this thread to make sure the issue is more visible. If you have not done so yet, please update NEWS.rst to document any significant change you made since the last release. Thanks, Jirka

1 1

[PATCH] NEWS: Document features/improvements/bug fixes I've participated in
by Michal Privoznik 28 Nov '24

28 Nov '24

There are some features/improvements/bug fixes I've either contributed or reviewed/merged. Document them for upcoming release. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- NEWS.rst | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 4b7f4e8244..65e21c4299 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -46,6 +46,12 @@ v10.10.0 (unreleased) required to keep data "raw" on disk, but the use case requires features of the QCOW2 format such as incremental backups. + * swtpm: Add support for profiles + + Upcoming swtpm release will have TPM profile support that allows to + restrict a TPM's provided set of crypto algorithms and commands. Users can + now select profile by using ``<profile/>`` in their TPM XML definition. + * **Improvements** * qemu: Support UEFI NVRAM images on block storage @@ -55,6 +61,21 @@ v10.10.0 (unreleased) qcow2 is used as the format, the images are now also auto-populated from the template. + * qemu: Automatically add IOMMU when needed + + When domain of 'qemu' or 'kvm' type has more than 255 vCPUs IOMMU with EIM + mode is required. Starting with this release libvirt automatically adds one + (or turns on the EIM mode if there's IOMMU without it). + + * ch: allow hostdevs in domain definition + + The Cloud Hypervisor driver (ch) now supports ``<hostdev/>``-s. + + * ch: Enable callbacks for ch domain events + + The Cloud Hypervisor driver (ch) now supports emitting events on domain + define, undefine, start, boot, stop and destroy. + * **Bug fixes** * qemu: Fix reversion and inactive deletion of internal snapshots with UEFI NVRAM @@ -63,6 +84,13 @@ v10.10.0 (unreleased) firmware was allowed, but certain operations such as reversion or inactive deletion didn't work properly as they didn't consider the NVRAM qcow2 file. + * virnetdevopenvswitch: Warn on unsupported QoS settings + + For OpenVSwitch vNICs libivrt does not set QoS directly using 'tc' but + offloads setting to OVS. But OVS is not as feature full as libvirt in this + regard and setting different 'peak' than 'average' results in vNIC always + sticking with 'peak'. Produce a warning if that's the case. + v10.9.0 (2024-11-01) ==================== -- 2.45.2

2 1

[PATCH 0/8] qemu: fixes for blockjobs with <dataStore>
by Peter Krempa 28 Nov '24

28 Nov '24

Couple fixes for the <dataStore> feature when used with blockjobs: - fixes for qemuBlockReopenAccess (code driving 'blockdev-reopen' in qemu) for bugs noticed during testing of <dataStore> - the 'auto-read-only' qemu feature doesn't apply od the 'data-file' blockdevs, thus libvirt needs to handle them explicitly - lookup of the node name associated with the <dataStore> volume in the chains (for block threshold event handling) Peter Krempa (8): qemuBlockReopenAccess: Add debug log entry about state of the image qemuBlockReopenAccess: Fix update of 'readonly' state qemuBlockReopenAccess: Don't require backing chain terminator for non-chained images qemu: block: Ensure that <dataStore> is in appropriate state qemu: snapshot: Change 'data-file' to read-only after snapshot qemuDomainVirStorageSourceFindByNodeName: Extract nodename matching qemuDomainVirStorageSourceFindByNodeName: Match also '<dataStore>' sources qemuDomainGetStorageSourceByDevstr: Lookup also '<dataStore>' src/qemu/qemu_block.c | 60 +++++++++++++++++++++++++++++++--------- src/qemu/qemu_blockjob.c | 16 ++++++++++- src/qemu/qemu_domain.c | 38 +++++++++++++++++++++---- src/qemu/qemu_snapshot.c | 12 ++++++-- 4 files changed, 105 insertions(+), 21 deletions(-) -- 2.47.0

2 14

[PATCH for 10.10.0 0/5] Fix broken XML schemas and 'virschematest'
by Peter Krempa 28 Nov '24

28 Nov '24

'virschematest' didn't test the majority of files for some time so some schema problems snuck in. Peter Krempa (5): schemas: domain: Make <identity> subelement of NFS disk source optional schemas: domaincaps: Add schema for 'panic' device schemas: domaincaps: Add schema for 'canonical' cpu model name schemas: domaincaps: Add schema for CPU 'blockers' virschematest: Don't skip all "directory" tests src/conf/schemas/domaincaps.rng | 29 +++++++++++++++++++++++++++++ src/conf/schemas/domaincommon.rng | 26 ++++++++++++++------------ tests/virschematest.c | 9 +++++---- 3 files changed, 48 insertions(+), 16 deletions(-) -- 2.47.0

2 7

[PATCH] NEWS: Mention qcow2 'data-file', block NVRAM, and internal snapshot reversion
by Peter Krempa 27 Nov '24

27 Nov '24

Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- NEWS.rst | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 185880d0e8..4b7f4e8244 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -38,10 +38,31 @@ v10.10.0 (unreleased) Updates to QEMU CPU models with -vN suffix can now be used in libvirt just like any other CPU model. + * qemu: Support for the 'data-file' QCOW2 image feature + + The QEMU hypervisor driver now supports QCOW2 images with 'data-file' + feature present (both when probing form the image itself and when specified + explicitly via ``<dataStore>`` element). This can be useful when it's + required to keep data "raw" on disk, but the use case requires features + of the QCOW2 format such as incremental backups. + * **Improvements** + * qemu: Support UEFI NVRAM images on block storage + + Libvirt now allows users to use block storage as backend for UEFI NVRAM + images and allows them to be in format different than the template. When + qcow2 is used as the format, the images are now also auto-populated from the + template. + * **Bug fixes** + * qemu: Fix reversion and inactive deletion of internal snapshots with UEFI NVRAM + + In `v10.9.0 (2024-11-01)`_ creation of internal snapshots of VMs with UEFI + firmware was allowed, but certain operations such as reversion or inactive + deletion didn't work properly as they didn't consider the NVRAM qcow2 file. + v10.9.0 (2024-11-01) ==================== -- 2.47.0

2 1

[PATCH] qemu: Validate QoS values in qemuDomainSetInterfaceParameters()
by Michal Privoznik 27 Nov '24

27 Nov '24

This is similar to one of my previous commits (v10.7.0-rc1~22) which introduce a check that <bandwidth/> values fit into certain limits. My original commit validated values when parsing <bandwidth/> XML, but completely missed the case when values are set over virDomainSetInterfaceParameters() API. Solution is simple - just perform validation after bandwidth structure is reconstructed from arguments passed to the API. Resolves: https://issues.redhat.com/browse/RHEL-65372 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_driver.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index d1b32de56a..09f7edda7d 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -9883,6 +9883,9 @@ qemuDomainSetInterfaceParameters(virDomainPtr dom, if (!bandwidth->out->average) VIR_FREE(bandwidth->out); + if (!virNetDevBandwidthValidate(bandwidth)) + goto endjob; + if (net) { newBandwidth = g_new0(virNetDevBandwidth, 1); -- 2.45.2

2 1

[PATCH] NEWS: Document support for versioned CPU models
by Jiri Denemark 27 Nov '24

27 Nov '24

Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- NEWS.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 88ac38834a..557c5b18d3 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -33,6 +33,11 @@ v10.10.0 (unreleased) Limitation: The s390x BIOS will try to IPL up to 8 total devices, any number of which may be disks or network devices. + * qemu: Add support for versioned CPU models + + Updates to QEMU CPU models with -vN suffix can now be used in libvirt just + like any other CPU model. + * **Improvements** * **Bug fixes** -- 2.47.0

2 1

[PATCH] cpu: Check blockers in virCPUCompareUnusable only if they exist
by Jiri Denemark 27 Nov '24

27 Nov '24

virCPUCompareUnusable can be called with blockers == NULL in case the CPU model itself is usable (i.e., QEMU reports an empty list of blockers), but the CPU definition contains some additional features which have to be checked. Fixes: v10.8.0-129-g5f8abbb7d0 Reported-by: Han Han <hhan(a)redhat.com> Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/cpu/cpu.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/src/cpu/cpu.c b/src/cpu/cpu.c index 2b0d641e78..58fba3781c 100644 --- a/src/cpu/cpu.c +++ b/src/cpu/cpu.c @@ -201,11 +201,13 @@ virCPUCompareUnusable(virArch arch, char **blocker; size_t i; - for (blocker = blockers; *blocker; blocker++) { - if (!(feat = virCPUDefFindFeature(cpu, *blocker)) || - feat->policy != VIR_CPU_FEATURE_DISABLE) { - virBufferAddStr(&features, *blocker); - virBufferAddLit(&features, ", "); + if (blockers) { + for (blocker = blockers; *blocker; blocker++) { + if (!(feat = virCPUDefFindFeature(cpu, *blocker)) || + feat->policy != VIR_CPU_FEATURE_DISABLE) { + virBufferAddStr(&features, *blocker); + virBufferAddLit(&features, ", "); + } } } -- 2.47.0

3 2

[PATCH v2 00/36] Add support for versioned CPU models
by Jiri Denemark 27 Nov '24

27 Nov '24

Each CPU model with -v* suffix is defined as a standalone model copying all attributes of the previous version although CPU model versions with an alias are handled differently. The full definition is used for the alias and the versioned model is created as an identical copy of the alias. To avoid breaking migration compatibility of host-model CPUs all versioned models are marked with <decode guest='off'/> so that they are ignored when selecting candidates for host-model. It's not ideal but not doing so would break almost all host-model CPUs as the new versioned CPU models have all vmx-* features included since their introduction while existing CPU models were updated later. This meas existing models would be accompanied with a long list of vmx-* features to properly describe a host CPU while the newly added CPU models would have those features enabled implicitly and their list of features would be significantly shorter. Thus the new models would always be better candidates for host-model than the existing models. Version 2: - removed patches - cpu_x86: Copy added and removed features from ancestor - qemu: Canonicalize CPU models - new patches - cpu_x86: Annotate virCPUx86Model fields - cpu_x86: Promote added/removed from ancestor - cpu_x86: Record relations between CPU models - cpu: Introduce virCPUGetCanonicalModel - domain_capabilities: Report canonical names of CPU models - cpu_map: Add Denverton CPU model - cpu_map: Add KnightsMill CPU model - make -v? variants linked to their corresponding non-versioned models (such as -noTSX, -IBRS, etc.) - all -v? variants are marked with <decode host='on' guest='off'/> - do not add absolute path to CPU model XMLs to index.xml - use <group name='...'> for all groups rather than a strange mix of <group name='...'> and <group vendor='...'> Jiri Denemark (36): cpu_x86: Annotate virCPUx86Model fields cpu_x86: Promote added/removed from ancestor sync_qemu_features_i386: Add some removed features back sync_qemu_models_i386: Use f-strings sync_qemu_models_i386: Do not overwrite existing models sync_qemu_models_i386: Do not require full path to QEMU's cpu.c sync_qemu_models_i386: Add support for versioned CPU models sync_qemu_models_i386: Store extra info in a separate file sync_qemu_models_i386: Switch to lxml cpu_map: Properly group models in index.xml sync_qemu_models_i386: Update index.xml sync_qemu_models_i386: Copy signatures from base model cpu_x86: Record relations between CPU models cpu: Introduce virCPUGetCanonicalModel domain_capabilities: Report canonical names of CPU models cpu_map: Add versions of SierraForest CPU model cpu_map: Add versions of GraniteRapids CPU model cpu_map: Add versions of SapphireRapids CPU model cpu_map: Add versions of Snowridge CPU model cpu_map: Add versions of Cooperlake CPU model cpu_map: Add versions of Icelake-Server CPU model cpu_map: Add versions of Cascadelake-Server CPU model cpu_map: Add versions of Skylake-Server CPU model cpu_map: Add versions of Skylake-Client CPU model cpu_map: Add versions of Broadwell CPU model cpu_map: Add versions of Haswell CPU model cpu_map: Add versions of IvyBridge CPU model cpu_map: Add versions of SandyBridge CPU model cpu_map: Add versions of Westmere CPU model cpu_map: Add versions of Nehalem CPU model cpu_map: Add versions of EPYC-Milan CPU model cpu_map: Add versions of EPYC-Rome CPU model cpu_map: Add versions of EPYC CPU model cpu_map: Add versions of Dhyana CPU model cpu_map: Add Denverton CPU model cpu_map: Add KnightsMill CPU model docs/formatdomaincaps.rst | 8 +- src/conf/domain_capabilities.c | 11 +- src/conf/domain_capabilities.h | 4 +- src/cpu/cpu.c | 25 + src/cpu/cpu.h | 8 + src/cpu/cpu_map.c | 2 +- src/cpu/cpu_x86.c | 88 +- src/cpu_map/index.xml | 291 ++-- src/cpu_map/meson.build | 60 + src/cpu_map/sync_qemu_features_i386.py | 3 + src/cpu_map/sync_qemu_models_i386.py | 184 +- src/cpu_map/x86_Broadwell-v1.xml | 6 + src/cpu_map/x86_Broadwell-v2.xml | 6 + src/cpu_map/x86_Broadwell-v3.xml | 6 + src/cpu_map/x86_Broadwell-v4.xml | 6 + src/cpu_map/x86_Cascadelake-Server-v1.xml | 6 + src/cpu_map/x86_Cascadelake-Server-v2.xml | 157 ++ src/cpu_map/x86_Cascadelake-Server-v3.xml | 6 + src/cpu_map/x86_Cascadelake-Server-v4.xml | 156 ++ src/cpu_map/x86_Cascadelake-Server-v5.xml | 158 ++ src/cpu_map/x86_Cooperlake-v1.xml | 6 + src/cpu_map/x86_Cooperlake-v2.xml | 164 ++ src/cpu_map/x86_Denverton-v1.xml | 6 + src/cpu_map/x86_Denverton-v2.xml | 137 ++ src/cpu_map/x86_Denverton-v3.xml | 139 ++ src/cpu_map/x86_Denverton.xml | 138 ++ src/cpu_map/x86_Dhyana-v1.xml | 6 + src/cpu_map/x86_Dhyana-v2.xml | 73 + src/cpu_map/x86_EPYC-Milan-v1.xml | 6 + src/cpu_map/x86_EPYC-Milan-v2.xml | 99 ++ src/cpu_map/x86_EPYC-Rome-v1.xml | 6 + src/cpu_map/x86_EPYC-Rome-v2.xml | 86 + src/cpu_map/x86_EPYC-Rome-v3.xml | 86 + src/cpu_map/x86_EPYC-Rome-v4.xml | 85 + src/cpu_map/x86_EPYC-v1.xml | 6 + src/cpu_map/x86_EPYC-v2.xml | 6 + src/cpu_map/x86_EPYC-v3.xml | 79 + src/cpu_map/x86_EPYC-v4.xml | 79 + src/cpu_map/x86_GraniteRapids-v1.xml | 6 + src/cpu_map/x86_Haswell-v1.xml | 6 + src/cpu_map/x86_Haswell-v2.xml | 6 + src/cpu_map/x86_Haswell-v3.xml | 6 + src/cpu_map/x86_Haswell-v4.xml | 6 + src/cpu_map/x86_Icelake-Server-v1.xml | 6 + src/cpu_map/x86_Icelake-Server-v2.xml | 6 + src/cpu_map/x86_Icelake-Server-v3.xml | 165 ++ src/cpu_map/x86_Icelake-Server-v4.xml | 172 ++ src/cpu_map/x86_Icelake-Server-v5.xml | 174 ++ src/cpu_map/x86_Icelake-Server-v6.xml | 175 ++ src/cpu_map/x86_Icelake-Server-v7.xml | 177 ++ src/cpu_map/x86_IvyBridge-v1.xml | 6 + src/cpu_map/x86_IvyBridge-v2.xml | 6 + src/cpu_map/x86_KnightsMill.xml | 71 + src/cpu_map/x86_Nehalem-v1.xml | 6 + src/cpu_map/x86_Nehalem-v2.xml | 6 + src/cpu_map/x86_SandyBridge-v1.xml | 6 + src/cpu_map/x86_SandyBridge-v2.xml | 6 + src/cpu_map/x86_SapphireRapids-v1.xml | 6 + src/cpu_map/x86_SapphireRapids-v2.xml | 193 +++ src/cpu_map/x86_SapphireRapids-v3.xml | 198 +++ src/cpu_map/x86_SierraForest-v1.xml | 6 + src/cpu_map/x86_Skylake-Client-v1.xml | 6 + src/cpu_map/x86_Skylake-Client-v2.xml | 6 + src/cpu_map/x86_Skylake-Client-v3.xml | 6 + src/cpu_map/x86_Skylake-Client-v4.xml | 141 ++ src/cpu_map/x86_Skylake-Server-v1.xml | 6 + src/cpu_map/x86_Skylake-Server-v2.xml | 6 + src/cpu_map/x86_Skylake-Server-v3.xml | 6 + src/cpu_map/x86_Skylake-Server-v4.xml | 148 ++ src/cpu_map/x86_Skylake-Server-v5.xml | 150 ++ src/cpu_map/x86_Snowridge-v1.xml | 6 + src/cpu_map/x86_Snowridge-v2.xml | 143 ++ src/cpu_map/x86_Snowridge-v3.xml | 145 ++ src/cpu_map/x86_Snowridge-v4.xml | 143 ++ src/cpu_map/x86_Westmere-v1.xml | 6 + src/cpu_map/x86_Westmere-v2.xml | 6 + src/libvirt_private.syms | 1 + src/qemu/qemu_capabilities.c | 10 +- tests/cputest.c | 5 +- .../x86_64-cpuid-Atom-P5362-host.xml | 2 +- .../x86_64-cpuid-Cooperlake-host.xml | 2 +- .../x86_64-cpuid-Core-i5-2500-host.xml | 2 +- .../x86_64-cpuid-Core-i5-2540M-host.xml | 2 +- .../x86_64-cpuid-Core-i5-4670T-host.xml | 2 +- .../x86_64-cpuid-Core-i5-650-host.xml | 2 +- .../x86_64-cpuid-Core-i5-6600-host.xml | 2 +- .../x86_64-cpuid-Core-i7-2600-host.xml | 2 +- ...86_64-cpuid-Core-i7-2600-xsaveopt-host.xml | 2 +- .../x86_64-cpuid-Core-i7-3520M-host.xml | 2 +- .../x86_64-cpuid-Core-i7-3740QM-host.xml | 2 +- .../x86_64-cpuid-Core-i7-3770-host.xml | 2 +- .../x86_64-cpuid-Core-i7-4510U-host.xml | 2 +- .../x86_64-cpuid-Core-i7-4600U-host.xml | 2 +- .../x86_64-cpuid-Core-i7-5600U-arat-host.xml | 2 +- .../x86_64-cpuid-Core-i7-5600U-host.xml | 2 +- .../x86_64-cpuid-Core-i7-5600U-ibrs-host.xml | 2 +- .../x86_64-cpuid-Core-i7-7600U-host.xml | 2 +- .../x86_64-cpuid-Core-i7-7700-host.xml | 2 +- .../x86_64-cpuid-Core-i7-8550U-host.xml | 2 +- .../x86_64-cpuid-Core-i7-8700-host.xml | 2 +- .../x86_64-cpuid-EPYC-7502-32-Core-host.xml | 5 +- .../x86_64-cpuid-EPYC-7601-32-Core-host.xml | 2 +- ...6_64-cpuid-EPYC-7601-32-Core-ibpb-host.xml | 8 +- ...6_64-cpuid-Hygon-C86-7185-32-core-host.xml | 5 +- .../x86_64-cpuid-Ice-Lake-Server-host.xml | 2 +- ...64-cpuid-Ryzen-7-1800X-Eight-Core-host.xml | 2 +- ...86_64-cpuid-Ryzen-9-3900X-12-Core-host.xml | 2 +- .../x86_64-cpuid-Xeon-E3-1225-v5-host.xml | 2 +- .../x86_64-cpuid-Xeon-E3-1245-v5-host.xml | 2 +- .../x86_64-cpuid-Xeon-E5-2609-v3-host.xml | 2 +- .../x86_64-cpuid-Xeon-E5-2623-v4-host.xml | 2 +- .../x86_64-cpuid-Xeon-E5-2630-v3-host.xml | 2 +- .../x86_64-cpuid-Xeon-E5-2630-v4-host.xml | 2 +- .../x86_64-cpuid-Xeon-E5-2650-host.xml | 2 +- .../x86_64-cpuid-Xeon-E5-2650-v3-host.xml | 2 +- .../x86_64-cpuid-Xeon-E5-2650-v4-host.xml | 2 +- .../x86_64-cpuid-Xeon-E7-4820-host.xml | 2 +- .../x86_64-cpuid-Xeon-E7-4830-host.xml | 2 +- .../x86_64-cpuid-Xeon-E7-8890-v3-host.xml | 2 +- .../x86_64-cpuid-Xeon-E7540-host.xml | 2 +- .../x86_64-cpuid-Xeon-Gold-5115-host.xml | 2 +- .../x86_64-cpuid-Xeon-Gold-6130-host.xml | 2 +- .../x86_64-cpuid-Xeon-Gold-6148-host.xml | 2 +- .../x86_64-cpuid-Xeon-Platinum-8268-host.xml | 2 +- .../x86_64-cpuid-Xeon-Platinum-9242-host.xml | 2 +- .../x86_64-cpuid-Xeon-W3520-host.xml | 2 +- .../domaincapsdata/qemu_5.2.0-q35.x86_64.xml | 462 ++++- .../domaincapsdata/qemu_5.2.0-tcg.x86_64.xml | 836 +++++++++- tests/domaincapsdata/qemu_5.2.0.x86_64.xml | 462 ++++- .../domaincapsdata/qemu_6.0.0-q35.x86_64.xml | 477 +++++- .../domaincapsdata/qemu_6.0.0-tcg.x86_64.xml | 896 +++++++++- tests/domaincapsdata/qemu_6.0.0.x86_64.xml | 477 +++++- .../domaincapsdata/qemu_6.1.0-q35.x86_64.xml | 576 ++++++- .../domaincapsdata/qemu_6.1.0-tcg.x86_64.xml | 1458 +++++++++++++--- tests/domaincapsdata/qemu_6.1.0.x86_64.xml | 576 ++++++- .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 583 ++++++- .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 1461 +++++++++++++--- tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 583 ++++++- .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 609 ++++++- .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 1485 ++++++++++++++--- tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 609 ++++++- .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 609 ++++++- .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 1425 +++++++++++++--- tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 609 ++++++- .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 609 ++++++- .../qemu_7.2.0-tcg.x86_64+hvf.xml | 979 ++++++++++- .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 979 ++++++++++- tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 609 ++++++- .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 652 +++++++- .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 1015 ++++++++++- tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 652 +++++++- .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 815 ++++++++- .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 1063 +++++++++++- tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 815 ++++++++- .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 815 ++++++++- .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 959 ++++++++++- tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 815 ++++++++- .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 815 ++++++++- .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 915 +++++++++- tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 815 ++++++++- .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 922 +++++++++- .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 1139 +++++++++++-- tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 922 +++++++++- .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 922 +++++++++- .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 1139 +++++++++++-- tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 922 +++++++++- 166 files changed, 35711 insertions(+), 2629 deletions(-) create mode 100644 src/cpu_map/x86_Broadwell-v1.xml create mode 100644 src/cpu_map/x86_Broadwell-v2.xml create mode 100644 src/cpu_map/x86_Broadwell-v3.xml create mode 100644 src/cpu_map/x86_Broadwell-v4.xml create mode 100644 src/cpu_map/x86_Cascadelake-Server-v1.xml create mode 100644 src/cpu_map/x86_Cascadelake-Server-v2.xml create mode 100644 src/cpu_map/x86_Cascadelake-Server-v3.xml create mode 100644 src/cpu_map/x86_Cascadelake-Server-v4.xml create mode 100644 src/cpu_map/x86_Cascadelake-Server-v5.xml create mode 100644 src/cpu_map/x86_Cooperlake-v1.xml create mode 100644 src/cpu_map/x86_Cooperlake-v2.xml create mode 100644 src/cpu_map/x86_Denverton-v1.xml create mode 100644 src/cpu_map/x86_Denverton-v2.xml create mode 100644 src/cpu_map/x86_Denverton-v3.xml create mode 100644 src/cpu_map/x86_Denverton.xml create mode 100644 src/cpu_map/x86_Dhyana-v1.xml create mode 100644 src/cpu_map/x86_Dhyana-v2.xml create mode 100644 src/cpu_map/x86_EPYC-Milan-v1.xml create mode 100644 src/cpu_map/x86_EPYC-Milan-v2.xml create mode 100644 src/cpu_map/x86_EPYC-Rome-v1.xml create mode 100644 src/cpu_map/x86_EPYC-Rome-v2.xml create mode 100644 src/cpu_map/x86_EPYC-Rome-v3.xml create mode 100644 src/cpu_map/x86_EPYC-Rome-v4.xml create mode 100644 src/cpu_map/x86_EPYC-v1.xml create mode 100644 src/cpu_map/x86_EPYC-v2.xml create mode 100644 src/cpu_map/x86_EPYC-v3.xml create mode 100644 src/cpu_map/x86_EPYC-v4.xml create mode 100644 src/cpu_map/x86_GraniteRapids-v1.xml create mode 100644 src/cpu_map/x86_Haswell-v1.xml create mode 100644 src/cpu_map/x86_Haswell-v2.xml create mode 100644 src/cpu_map/x86_Haswell-v3.xml create mode 100644 src/cpu_map/x86_Haswell-v4.xml create mode 100644 src/cpu_map/x86_Icelake-Server-v1.xml create mode 100644 src/cpu_map/x86_Icelake-Server-v2.xml create mode 100644 src/cpu_map/x86_Icelake-Server-v3.xml create mode 100644 src/cpu_map/x86_Icelake-Server-v4.xml create mode 100644 src/cpu_map/x86_Icelake-Server-v5.xml create mode 100644 src/cpu_map/x86_Icelake-Server-v6.xml create mode 100644 src/cpu_map/x86_Icelake-Server-v7.xml create mode 100644 src/cpu_map/x86_IvyBridge-v1.xml create mode 100644 src/cpu_map/x86_IvyBridge-v2.xml create mode 100644 src/cpu_map/x86_KnightsMill.xml create mode 100644 src/cpu_map/x86_Nehalem-v1.xml create mode 100644 src/cpu_map/x86_Nehalem-v2.xml create mode 100644 src/cpu_map/x86_SandyBridge-v1.xml create mode 100644 src/cpu_map/x86_SandyBridge-v2.xml create mode 100644 src/cpu_map/x86_SapphireRapids-v1.xml create mode 100644 src/cpu_map/x86_SapphireRapids-v2.xml create mode 100644 src/cpu_map/x86_SapphireRapids-v3.xml create mode 100644 src/cpu_map/x86_SierraForest-v1.xml create mode 100644 src/cpu_map/x86_Skylake-Client-v1.xml create mode 100644 src/cpu_map/x86_Skylake-Client-v2.xml create mode 100644 src/cpu_map/x86_Skylake-Client-v3.xml create mode 100644 src/cpu_map/x86_Skylake-Client-v4.xml create mode 100644 src/cpu_map/x86_Skylake-Server-v1.xml create mode 100644 src/cpu_map/x86_Skylake-Server-v2.xml create mode 100644 src/cpu_map/x86_Skylake-Server-v3.xml create mode 100644 src/cpu_map/x86_Skylake-Server-v4.xml create mode 100644 src/cpu_map/x86_Skylake-Server-v5.xml create mode 100644 src/cpu_map/x86_Snowridge-v1.xml create mode 100644 src/cpu_map/x86_Snowridge-v2.xml create mode 100644 src/cpu_map/x86_Snowridge-v3.xml create mode 100644 src/cpu_map/x86_Snowridge-v4.xml create mode 100644 src/cpu_map/x86_Westmere-v1.xml create mode 100644 src/cpu_map/x86_Westmere-v2.xml -- 2.47.0

3 56

Re: [PATCH v2 4/5] virsh: add --disable-deprecated-features flag to domcapabilities
by Boris Fiuczynski 26 Nov '24

26 Nov '24

On 11/26/24 16:14, Boris Fiuczynski wrote: > Reviewed-by: Boris Fiuczynski <fiuczy(a)linux.ibm.com> > > On 11/25/24 20:46, Collin Walling wrote: >> Add a new flag, --disable-deprecated-features, to the domcapabilities >> command. This will modify the output to show the 'host-model' CPU >> with features flagged as deprecated paired with the 'disable' policy. >> >> virsh domcapabilities --disable-deprecated-features >> >> Signed-off-by: Collin Walling <walling(a)linux.ibm.com> >> --- >> docs/manpages/virsh.rst | 6 ++++++ >> include/libvirt/libvirt-domain.h | 12 ++++++++++++ >> src/libvirt-domain.c | 2 +- >> src/qemu/qemu_capabilities.c | 20 ++++++++++++++++++++ >> src/qemu/qemu_capabilities.h | 3 +++ >> src/qemu/qemu_driver.c | 8 +++++++- >> tools/virsh-host.c | 9 ++++++++- >> 7 files changed, 57 insertions(+), 3 deletions(-) >> >> diff --git a/docs/manpages/virsh.rst b/docs/manpages/virsh.rst >> index 2e525d3fac..d3b8ff4e1c 100644 >> --- a/docs/manpages/virsh.rst >> +++ b/docs/manpages/virsh.rst >> @@ -568,6 +568,7 @@ domcapabilities >> domcapabilities [virttype] [emulatorbin] [arch] [machine] >> [--xpath EXPRESSION] [--wrap] >> + [--disabled-deprecated-features] >> Print an XML document describing the domain capabilities for the >> @@ -609,6 +610,11 @@ a standalone document, however, for ease of >> additional processing, >> the **--wrap** argument will cause the matching node to be wrapped >> in a common root node. >> +The **--disabled-deprecated-features** argument will modify the contents >> +of host-model CPU XML, updating the features list with any features >> +flagged as deprecated for the CPU model by the hypervisor. These >> +features will be paired with the "disable" policy. >> + >> pool-capabilities >> ----------------- >> diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/ >> libvirt-domain.h >> index d4f1573954..0d7e54a3dc 100644 >> --- a/include/libvirt/libvirt-domain.h >> +++ b/include/libvirt/libvirt-domain.h >> @@ -1491,6 +1491,18 @@ int virDomainMigrateGetMaxSpeed(virDomainPtr >> domain, >> int virDomainMigrateStartPostCopy(virDomainPtr domain, >> unsigned int flags); >> +/** >> + * virConnectGetDomainCapabilitiesFlags: >> + * >> + * Domain capabilities flags. >> + * >> + * Since: 10.10.0 >> + */ >> +typedef enum { >> + /* Report host model with deprecated features disabled. (Since: >> 10.10.0) */ >> + VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES = >> (1 << 0), >> +} virConnectGetDomainCapabilitiesFlags; >> + >> char * virConnectGetDomainCapabilities(virConnectPtr conn, >> const char *emulatorbin, >> const char *arch, >> diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c >> index 7c6b93963c..e8e5379672 100644 >> --- a/src/libvirt-domain.c >> +++ b/src/libvirt-domain.c >> @@ -12166,7 +12166,7 @@ virDomainSetUserPassword(virDomainPtr dom, >> * @arch: domain architecture >> * @machine: machine type >> * @virttype: virtualization type >> - * @flags: extra flags; not used yet, so callers should always pass 0 >> + * @flags: extra flags; bitwise-OR of >> virConnectGetDomainCapabilitiesFlags >> * >> * Prior creating a domain (for instance via virDomainCreateXML >> * or virDomainDefineXML) it may be suitable to know what the >> diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c >> index 50905750fb..0701b2f4b0 100644 >> --- a/src/qemu/qemu_capabilities.c >> +++ b/src/qemu/qemu_capabilities.c >> @@ -3326,6 +3326,26 @@ virQEMUCapsGetCPUFeatures(virQEMUCaps *qemuCaps, >> } >> +void >> +virQEMUCapsUpdateCPUDeprecatedFeatures(virQEMUCaps *qemuCaps, >> + virDomainVirtType virtType, >> + virCPUDef *cpu) >> +{ >> + qemuMonitorCPUModelInfo *modelInfo; >> + size_t i; >> + >> + modelInfo = virQEMUCapsGetCPUModelInfo(qemuCaps, virtType); >> + >> + if (!modelInfo || !modelInfo->deprecated_props) >> + return; >> + >> + for (i = 0; i < g_strv_length(modelInfo->deprecated_props); i++) { >> + virCPUDefUpdateFeature(cpu, modelInfo->deprecated_props[i], >> + VIR_CPU_FEATURE_DISABLE); >> + } >> +} >> + >> + >> struct tpmTypeToCaps { >> int type; >> virQEMUCapsFlags caps; >> diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h >> index 8347fd7fbb..6bfe99fce4 100644 >> --- a/src/qemu/qemu_capabilities.h >> +++ b/src/qemu/qemu_capabilities.h >> @@ -764,6 +764,9 @@ int virQEMUCapsGetCPUFeatures(virQEMUCaps *qemuCaps, >> virDomainVirtType virtType, >> bool migratable, >> char ***features); >> +void virQEMUCapsUpdateCPUDeprecatedFeatures(virQEMUCaps *qemuCaps, >> + virDomainVirtType virtType, >> + virCPUDef *cpu); >> virDomainVirtType virQEMUCapsGetVirtType(virQEMUCaps *qemuCaps); >> diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c >> index 5b9c55f704..86ab0bd39a 100644 >> --- a/src/qemu/qemu_driver.c >> +++ b/src/qemu/qemu_driver.c >> @@ -16521,7 +16521,8 @@ qemuConnectGetDomainCapabilities(virConnectPtr >> conn, >> virDomainVirtType virttype; >> g_autoptr(virDomainCaps) domCaps = NULL; >> - virCheckFlags(0, NULL); >> + >> virCheckFlags(VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES, >> + NULL); >> if (virConnectGetDomainCapabilitiesEnsureACL(conn) < 0) >> return NULL; >> @@ -16540,6 +16541,11 @@ >> qemuConnectGetDomainCapabilities(virConnectPtr conn, >> arch, >> virttype))) >> return NULL; >> + if (flags & >> VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES) { >> + virQEMUCapsUpdateCPUDeprecatedFeatures(qemuCaps, virttype, >> + domCaps->cpu.hostModel); >> + } >> + >> return virDomainCapsFormat(domCaps); >> } >> diff --git a/tools/virsh-host.c b/tools/virsh-host.c >> index 2fe64e415f..f4e7324f42 100644 >> --- a/tools/virsh-host.c >> +++ b/tools/virsh-host.c >> @@ -114,6 +114,10 @@ static const vshCmdOptDef opts_domcapabilities[] = { >> .type = VSH_OT_BOOL, >> .help = N_("wrap xpath results in an common root element"), >> }, >> + {.name = "disable-deprecated-features", >> + .type = VSH_OT_BOOL, >> + .help = N_("report host CPU model with deprecated features >> disabled"), >> + }, >> {.name = NULL} >> }; >> @@ -126,10 +130,13 @@ cmdDomCapabilities(vshControl *ctl, const vshCmd >> *cmd) >> const char *arch = NULL; >> const char *machine = NULL; >> const char *xpath = NULL; >> - const unsigned int flags = 0; /* No flags so far */ >> + unsigned int flags = 0; >> bool wrap = vshCommandOptBool(cmd, "wrap"); >> virshControl *priv = ctl->privData; >> + if (vshCommandOptBool(cmd, "disable-deprecated-features")) >> + flags |= >> VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES; >> + >> if (vshCommandOptString(ctl, cmd, "virttype", &virttype) < 0 || >> vshCommandOptString(ctl, cmd, "emulatorbin", &emulatorbin) < >> 0 || >> vshCommandOptString(ctl, cmd, "arch", &arch) < 0 || > > -- Mit freundlichen Grüßen/Kind regards Boris Fiuczynski IBM Deutschland Research & Development GmbH Vorsitzender des Aufsichtsrats: Wolfgang Wendt Geschäftsführung: David Faller Sitz der Gesellschaft: Böblingen Registergericht: Amtsgericht Stuttgart, HRB 243294

1 0

[PATCH v2 0/6] network: fix dhcp response packet checksums on virtual networks
by Laine Stump 26 Nov '24

26 Nov '24

Patch 6/6 explains the problem and how these patches fix it. Assuming no problems are found (none so far) this should go into 10.10.0, as it solves a regression caused by switching the network driver to the nftables backend. There was a prior attempt at fixing this that was accepted, pushed, bugs were discovered, and it was reverted (see Patch 6/6 for details). This will hopefully be the final attempt. The differences from V1 are: * use a single "flags" argument rather than 3 bools when calling virNetDevBandwidthSet() (Patch 1/5 turned into 1/6 & 2/6) * be more lenient about what constitutes a "match" when looking at the output of "tc qdisc show" (Patch 3/5 turned into 4/6 * call the new virFirewall layer "tc" rather than "raw", making it specific to "tc" (Patch 4/5 turned into 5/6) There may still be some disagreement about putting the tc commands in the virFirewall, but I wanted to get this sent to save time in case my argument was convincing :-) Laine Stump (6): util: use a single flags arg for virNetDevBandwidthSet(), not multiple bools util: make it optional to clear existing tc qdiscs/filters in virNetDevBandwidthSet() util: put the command that adds a tx filter qdisc into a separate function util: don't re-add the qdisc used for tx filters if it already exists util: add new "tc" layer for virFirewallCmd objects network: add tc filter rule to nftables backend to fix checksum of DHCP responses src/libvirt_private.syms | 1 + src/lxc/lxc_driver.c | 8 +- src/lxc/lxc_process.c | 8 +- src/network/bridge_driver.c | 10 +- src/network/network_nftables.c | 69 +++++++++++ src/qemu/qemu_command.c | 11 +- src/qemu/qemu_driver.c | 29 ++--- src/qemu/qemu_hotplug.c | 22 +++- src/util/virfirewall.c | 66 +++++++---- src/util/virfirewall.h | 1 + src/util/virfirewalld.c | 1 + src/util/virnetdevbandwidth.c | 110 ++++++++++++++---- src/util/virnetdevbandwidth.h | 15 ++- .../forward-dev-linux.nftables | 40 +++++++ .../isolated-linux.nftables | 40 +++++++ .../nat-default-linux.nftables | 40 +++++++ .../nat-ipv6-linux.nftables | 40 +++++++ .../nat-ipv6-masquerade-linux.nftables | 40 +++++++ .../nat-many-ips-linux.nftables | 40 +++++++ .../nat-no-dhcp-linux.nftables | 40 +++++++ .../nat-port-range-ipv6-linux.nftables | 40 +++++++ .../nat-port-range-linux.nftables | 40 +++++++ .../nat-tftp-linux.nftables | 40 +++++++ .../route-default-linux.nftables | 40 +++++++ tests/virnetdevbandwidthtest.c | 12 +- 25 files changed, 724 insertions(+), 79 deletions(-) -- 2.47.0

2 12

[PATCH 0/5] network: fix dhcp response packet checksums on virtual networks
by Laine Stump 26 Nov '24

26 Nov '24

Patch 4/4 explains the problem and how these patches fix it. Assuming no problems are found (none so far) this should go into 10.10.0, as it solves a regression caused by switching the network driver to the nftables backend. There was a prior attempt at fixing this that was accepted, pushed, bugs were discovered, and it was reverted (see Patch 4/4 for details). This will hopefully be the final attempt. Please test with as many different guests as possible, both with nftables backend and iptables backend, and using different guest interface types, etc. Laine Stump (5): util: make it optional to clear existing tc qdiscs/filters in virNetDevBandwidthSet() util: put the command that adds a tx filter qdisc into a separate function util: don't re-add the qdisc used for tx filters if it already exists util: add new "raw" layer for virFirewallCmd objects network: add tc filter rule to nftables backend to fix checksum of DHCP responses src/libvirt_private.syms | 1 + src/lxc/lxc_driver.c | 2 +- src/lxc/lxc_process.c | 2 +- src/network/bridge_driver.c | 4 +- src/network/network_nftables.c | 69 +++++++++++++++++ src/qemu/qemu_command.c | 2 +- src/qemu/qemu_driver.c | 3 +- src/qemu/qemu_hotplug.c | 4 +- src/util/virfirewall.c | 74 ++++++++++++------- src/util/virfirewall.h | 1 + src/util/virfirewalld.c | 1 + src/util/virnetdevbandwidth.c | 70 ++++++++++++++++-- src/util/virnetdevbandwidth.h | 4 + .../forward-dev-linux.nftables | 40 ++++++++++ .../isolated-linux.nftables | 40 ++++++++++ .../nat-default-linux.nftables | 40 ++++++++++ .../nat-ipv6-linux.nftables | 40 ++++++++++ .../nat-ipv6-masquerade-linux.nftables | 40 ++++++++++ .../nat-many-ips-linux.nftables | 40 ++++++++++ .../nat-no-dhcp-linux.nftables | 40 ++++++++++ .../nat-port-range-ipv6-linux.nftables | 40 ++++++++++ .../nat-port-range-linux.nftables | 40 ++++++++++ .../nat-tftp-linux.nftables | 40 ++++++++++ .../route-default-linux.nftables | 40 ++++++++++ tests/virnetdevbandwidthtest.c | 5 +- 25 files changed, 639 insertions(+), 43 deletions(-) -- 2.47.0

4 15

[PATCH v3 00/15] Implement support for QCOW2 data files
by Nikolai Barybin 25 Nov '24

25 Nov '24

Hello everyone! With help of Peter's comprehensive review I finally present 3rd version of this series. Changes since last revision: - minor code improvements including memory leaks fixes - splitted and regrouped some patches for more logical structure - fixed issue with erroneous disk with data file detatch - completely rewritten tests - added some piece of documentation Nikolai Barybin (15): conf: add data-file feature and related fields to virStorageSource Add VIR_STORAGE_FILE_FEATURE_DATA_FILE to virStorageFileFeature enum conf: schemas: add data-file store to domain rng schema conf: implement XML parsing/formating for dataFileStore storage file: add getDataFile function to FileTypeInfo storage file: add qcow2 data-file path parsing from header storage file: fill in src->dataFileStore during file probe security: DAC: handle qcow2 data-file on image label set/restore security: selinux: handle qcow2 data-file on image label set/restore security: apparmor: handle qcow2 data-file qemu: put data-file path to VM's cgroup and namespace qemu: factor out qemuDomainPrepareStorageSource() qemu: enable basic qcow2 data-file feature support tests: add qcow2 data-file tests docs: formatdomain: describe dataFileStore element of disk docs/formatdomain.rst | 45 +++++++- src/conf/domain_conf.c | 100 ++++++++++++++++++ src/conf/domain_conf.h | 13 +++ src/conf/schemas/domaincommon.rng | 15 +++ src/conf/storage_source_conf.c | 11 ++ src/conf/storage_source_conf.h | 5 + src/qemu/qemu_block.c | 14 +++ src/qemu/qemu_cgroup.c | 13 ++- src/qemu/qemu_command.c | 5 + src/qemu/qemu_domain.c | 50 ++++++--- src/qemu/qemu_namespace.c | 7 ++ src/security/security_dac.c | 27 ++++- src/security/security_selinux.c | 27 ++++- src/security/virt-aa-helper.c | 4 + src/storage_file/storage_file_probe.c | 78 ++++++++++---- src/storage_file/storage_source.c | 39 +++++++ src/storage_file/storage_source.h | 4 + .../qcow2-data-file-in.xml | 86 +++++++++++++++ .../qcow2-data-file-out.xml | 86 +++++++++++++++ tests/qemuxmlactivetest.c | 2 + ...sk-qcow2-datafile-store.x86_64-latest.args | 51 +++++++++ ...isk-qcow2-datafile-store.x86_64-latest.xml | 81 ++++++++++++++ .../disk-qcow2-datafile-store.xml | 67 ++++++++++++ tests/qemuxmlconftest.c | 1 + tests/virstoragetest.c | 98 +++++++++++++++++ tests/virstoragetestdata/out/qcow2-data_file | 20 ++++ .../out/qcow2-qcow2_qcow2-qcow2-data_file | 31 ++++++ 27 files changed, 941 insertions(+), 39 deletions(-) create mode 100644 tests/qemustatusxml2xmldata/qcow2-data-file-in.xml create mode 100644 tests/qemustatusxml2xmldata/qcow2-data-file-out.xml create mode 100644 tests/qemuxmlconfdata/disk-qcow2-datafile-store.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/disk-qcow2-datafile-store.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/disk-qcow2-datafile-store.xml create mode 100644 tests/virstoragetestdata/out/qcow2-data_file create mode 100644 tests/virstoragetestdata/out/qcow2-qcow2_qcow2-qcow2-data_file -- 2.43.5

2 37

[PATCH] docs: formatsecret: Fix an example of secret-set-value
by Han Han 25 Nov '24

25 Nov '24

The previous example will cause the error like: error: Options --file and --base64 are mutually exclusive Reported-by: Yanqiu Zhang <yanqzhan(a)redhat.com> Signed-off-by: Han Han <hhan(a)redhat.com> --- docs/formatsecret.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/formatsecret.rst b/docs/formatsecret.rst index aeeb67610d..606a9cc587 100644 --- a/docs/formatsecret.rst +++ b/docs/formatsecret.rst @@ -318,7 +318,7 @@ be omitted if the file contents are base64-encoded. :: - # virsh secret-set-value 6dd3e4a5-1d76-44ce-961f-f119f5aad935 --file --plain secretinfile + # virsh secret-set-value 6dd3e4a5-1d76-44ce-961f-f119f5aad935 --file secretinfile --plain Secret value set **WARNING** The following approach is **insecure** and deprecated. The secret -- 2.47.0

2 1

Container build failures for cross-builds on debian-11
by Martin Kletzander 25 Nov '24

25 Nov '24

Weekly container builds fail for almost 2 months now (last passed container build was on 2nd of September) due to debian-11 being probably broken when installing cross-arch packages. Debian 12 was released at the 10th of June 2023, so we support debian-11 for 7 more months. But the cross-builds are probably going to fail for all those 7 months. Since that spoils the view of the pipelines I would suggest we remove the cross-architecture builds for debian-11 since we're still testing them on debian-12 and that works nicely. We would still keep x86_64 and i686 debian-11 builds there of course. Is anyone opposed to that or is there any clear issue with the above suggestion?

1 0

test branch of patches that use a "tc" filter to fixup UDP checksums
by Laine Stump 22 Nov '24

22 Nov '24

This branch uses tc to fixup the checksum. It's appearing to work with the few guests I've tested so far, but there is an issue when a network has <bandwidth> configured, and I don't want to post the patches for review until I figure that out. In the meantime anyone who wants to test with a non-<bandwidth> network, please do :-) https://gitlab.com/lainestump/libvirt/-/tree/network-freebsd-checksum-fix-t…

3 4

[PATCH 00/32] Add support for versioned CPU models
by Jiri Denemark 21 Nov '24

21 Nov '24

When parsing a domain XML which uses a non-versioned CPU model we want to replace it with the appropriate version variant similarly to what we do with machine types. Theoretically QEMU supports per machine type specification of a version with which a non-versioned CPU model is replaced, but this is always 1 for all machine types and the query-machines QMP command does not even report the value. Luckily after talking to Igor, having a single number per machine type does not really allow for setting it to anything but 1 as CPU models have different number of versions. Each machine type would need to define a specific version for each CPU model, which would be a maintenance nightmare. For this reason there's no desire to ever resolve non-versioned CPU models to anything but v1 in QEMU and the per machine type setting will most likely even be removed completely. Thus it is safe for us to always use v1 as the canonical CPU model. Some non-versioned CPU models, however, are actually aliases to specific versions of a base model rather than being base models themselves. These are the old CPU model variants before model versions were introduced, e.g., -noTSX, -IBRS, etc. The mapping of these names to versions is hardcoded and will never change. We do not translate such CPU models to the corresponding versioned names. This allows us to introduce the corresponding -v* variants that match the QEMU models rather than the existing definitions in our CPU map. The guest CPU will be the same either way, but the way libvirt checks the CPU model compatibility with the host will be different. The old "partial" check done by libvirt using the definition from CPU map will still be used for the old names (we can't change this for compatibility reasons), but the corresponding versioned variants (as well as all other versions that do not have a non-versioned alias) will benefit from the recently introduced new "partial" check which uses only the information we get from QEMU to check whether a specific CPU definition is usable on the host. Other I considered were: - replace -noTSX, -IBRS, ... models with their versioned variants - we'd need to translate them back for migration (just what we do for -v1) for backward compatibility - I found the benefit of new partial checking when explicitly using the versioned variants quite appealing and dropped the relevant changes in progress - do not translate anything, i.e., not even base models to -v1 - the idea behind translating was to make sure QEMU suddenly doesn't start translating the base CPU model to a different version (this does not happen with -noTSX etc. as they are hardcoded aliases); Igor said they will never do that so is this still valid? - not translating would bring the same benefit of explicitly using -v1 vs non-versioned name I guess the current mix does not look very consistent (i.e., it's not either all or nothing), but it makes sense to me. The question is whether it also makes sense to others :-) Jiri Denemark (32): cpu_x86: Copy added and removed features from ancestor sync_qemu_features_i386: Add some removed features back sync_qemu_models_i386: Use f-strings sync_qemu_models_i386: Do not overwrite existing models sync_qemu_models_i386: Do not require full path to QEMU's cpu.c sync_qemu_models_i386: Add support for versioned CPU models sync_qemu_models_i386: Store extra info in a separate file sync_qemu_models_i386: Switch to lxml cpu_map: Group models in index.xml sync_qemu_models_i386: Update index.xml sync_qemu_models_i386: Copy signatures from base model cpu: Introduce virCPUCheckModel qemu: Canonicalize CPU models cpu_map: Add versions of SierraForest CPU model cpu_map: Add versions of GraniteRapids CPU model cpu_map: Add versions of SapphireRapids CPU model cpu_map: Add versions of Snowridge CPU model cpu_map: Add versions of Cooperlake CPU model cpu_map: Add versions of Icelake-Server CPU model cpu_map: Add versions of Cascadelake-Server CPU model cpu_map: Add versions of Skylake-Server CPU model cpu_map: Add versions of Skylake-Client CPU model cpu_map: Add versions of Broadwell CPU model cpu_map: Add versions of Haswell CPU model cpu_map: Add versions of IvyBridge CPU model cpu_map: Add versions of SandyBridge CPU model cpu_map: Add versions of Westmere CPU model cpu_map: Add versions of Nehalem CPU model cpu_map: Add versions of EPYC-Milan CPU model cpu_map: Add versions of EPYC-Rome CPU model cpu_map: Add versions of EPYC CPU model cpu_map: Add versions of Dhyana CPU model src/cpu/cpu.c | 25 + src/cpu/cpu.h | 8 + src/cpu/cpu_map.c | 2 +- src/cpu/cpu_x86.c | 40 +- src/cpu_map/index.xml | 286 ++-- src/cpu_map/meson.build | 60 + src/cpu_map/sync_qemu_features_i386.py | 3 + src/cpu_map/sync_qemu_models_i386.py | 178 ++- src/cpu_map/x86_Broadwell-v1.xml | 6 + src/cpu_map/x86_Broadwell-v2.xml | 140 ++ src/cpu_map/x86_Broadwell-v3.xml | 143 ++ src/cpu_map/x86_Broadwell-v4.xml | 141 ++ src/cpu_map/x86_Cascadelake-Server-v1.xml | 6 + src/cpu_map/x86_Cascadelake-Server-v2.xml | 157 +++ src/cpu_map/x86_Cascadelake-Server-v3.xml | 155 +++ src/cpu_map/x86_Cascadelake-Server-v4.xml | 156 +++ src/cpu_map/x86_Cascadelake-Server-v5.xml | 158 +++ src/cpu_map/x86_Cooperlake-v1.xml | 6 + src/cpu_map/x86_Cooperlake-v2.xml | 164 +++ src/cpu_map/x86_Dhyana-v1.xml | 6 + src/cpu_map/x86_Dhyana-v2.xml | 73 ++ src/cpu_map/x86_EPYC-Milan-v1.xml | 6 + src/cpu_map/x86_EPYC-Milan-v2.xml | 99 ++ src/cpu_map/x86_EPYC-Rome-v1.xml | 6 + src/cpu_map/x86_EPYC-Rome-v2.xml | 86 ++ src/cpu_map/x86_EPYC-Rome-v3.xml | 86 ++ src/cpu_map/x86_EPYC-Rome-v4.xml | 85 ++ src/cpu_map/x86_EPYC-v1.xml | 6 + src/cpu_map/x86_EPYC-v2.xml | 75 ++ src/cpu_map/x86_EPYC-v3.xml | 79 ++ src/cpu_map/x86_EPYC-v4.xml | 79 ++ src/cpu_map/x86_GraniteRapids-v1.xml | 6 + src/cpu_map/x86_Haswell-v1.xml | 6 + src/cpu_map/x86_Haswell-v2.xml | 134 ++ src/cpu_map/x86_Haswell-v3.xml | 137 ++ src/cpu_map/x86_Haswell-v4.xml | 135 ++ src/cpu_map/x86_Icelake-Server-v1.xml | 6 + src/cpu_map/x86_Icelake-Server-v2.xml | 158 +++ src/cpu_map/x86_Icelake-Server-v3.xml | 165 +++ src/cpu_map/x86_Icelake-Server-v4.xml | 172 +++ src/cpu_map/x86_Icelake-Server-v5.xml | 174 +++ src/cpu_map/x86_Icelake-Server-v6.xml | 175 +++ src/cpu_map/x86_Icelake-Server-v7.xml | 177 +++ src/cpu_map/x86_IvyBridge-v1.xml | 6 + src/cpu_map/x86_IvyBridge-v2.xml | 119 ++ src/cpu_map/x86_Nehalem-v1.xml | 6 + src/cpu_map/x86_Nehalem-v2.xml | 101 ++ src/cpu_map/x86_SandyBridge-v1.xml | 6 + src/cpu_map/x86_SandyBridge-v2.xml | 110 ++ src/cpu_map/x86_SapphireRapids-v1.xml | 6 + src/cpu_map/x86_SapphireRapids-v2.xml | 193 +++ src/cpu_map/x86_SapphireRapids-v3.xml | 198 +++ src/cpu_map/x86_SierraForest-v1.xml | 6 + src/cpu_map/x86_Skylake-Client-v1.xml | 6 + src/cpu_map/x86_Skylake-Client-v2.xml | 141 ++ src/cpu_map/x86_Skylake-Client-v3.xml | 139 ++ src/cpu_map/x86_Skylake-Client-v4.xml | 141 ++ src/cpu_map/x86_Skylake-Server-v1.xml | 6 + src/cpu_map/x86_Skylake-Server-v2.xml | 149 +++ src/cpu_map/x86_Skylake-Server-v3.xml | 147 +++ src/cpu_map/x86_Skylake-Server-v4.xml | 148 +++ src/cpu_map/x86_Skylake-Server-v5.xml | 150 +++ src/cpu_map/x86_Snowridge-v1.xml | 6 + src/cpu_map/x86_Snowridge-v2.xml | 143 ++ src/cpu_map/x86_Snowridge-v3.xml | 145 +++ src/cpu_map/x86_Snowridge-v4.xml | 143 ++ src/cpu_map/x86_Westmere-v1.xml | 6 + src/cpu_map/x86_Westmere-v2.xml | 105 ++ src/libvirt_private.syms | 1 + src/qemu/qemu_capabilities.c | 53 + src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_domain.c | 6 + src/qemu/qemu_postparse.c | 19 + .../x86_64-cpuid-Atom-P5362-json.xml | 75 +- .../x86_64-cpuid-Core-i7-8550U-json.xml | 72 +- .../x86_64-cpuid-EPYC-7502-32-Core-host.xml | 5 +- .../x86_64-cpuid-EPYC-7601-32-Core-guest.xml | 9 +- ...6_64-cpuid-EPYC-7601-32-Core-ibpb-host.xml | 8 +- .../x86_64-cpuid-EPYC-7601-32-Core-json.xml | 6 +- ..._64-cpuid-Hygon-C86-7185-32-core-guest.xml | 5 +- ...6_64-cpuid-Hygon-C86-7185-32-core-host.xml | 5 +- ...6_64-cpuid-Hygon-C86-7185-32-core-json.xml | 6 +- ...4-cpuid-Ryzen-7-1800X-Eight-Core-guest.xml | 9 +- ...64-cpuid-Ryzen-7-1800X-Eight-Core-json.xml | 6 +- .../x86_64-cpuid-Xeon-Platinum-9242-json.xml | 79 +- ...-cpuid-baseline-Cooperlake+Cascadelake.xml | 84 +- .../x86_64-cpuid-baseline-EPYC+Rome.xml | 6 +- .../x86_64-cpuid-baseline-Ryzen+Rome.xml | 6 +- .../domaincapsdata/qemu_5.2.0-q35.x86_64.xml | 369 ++++++ .../domaincapsdata/qemu_5.2.0-tcg.x86_64.xml | 740 ++++++++++- tests/domaincapsdata/qemu_5.2.0.x86_64.xml | 369 ++++++ .../domaincapsdata/qemu_6.0.0-q35.x86_64.xml | 382 ++++++ .../domaincapsdata/qemu_6.0.0-tcg.x86_64.xml | 798 +++++++++++- tests/domaincapsdata/qemu_6.0.0.x86_64.xml | 382 ++++++ .../domaincapsdata/qemu_6.1.0-q35.x86_64.xml | 476 +++++++ .../domaincapsdata/qemu_6.1.0-tcg.x86_64.xml | 1003 +++++++++++++- tests/domaincapsdata/qemu_6.1.0.x86_64.xml | 476 +++++++ .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 483 +++++++ .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 1008 +++++++++++++- tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 483 +++++++ .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 509 ++++++++ .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 1018 ++++++++++++++- tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 509 ++++++++ .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 509 ++++++++ .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 1154 +++++++++++++++-- tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 509 ++++++++ .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 509 ++++++++ .../qemu_7.2.0-tcg.x86_64+hvf.xml | 830 +++++++++++- .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 830 +++++++++++- tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 509 ++++++++ .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 550 ++++++++ .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 862 +++++++++++- tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 550 ++++++++ .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 711 +++++++++- .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 864 +++++++++++- tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 711 +++++++++- .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 711 +++++++++- .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 848 +++++++++++- tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 711 +++++++++- .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 711 +++++++++- .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 811 +++++++++++- tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 711 +++++++++- .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 816 +++++++++++- .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 1099 ++++++++++++++-- tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 816 +++++++++++- .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 816 +++++++++++- .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 1099 ++++++++++++++-- tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 816 +++++++++++- .../cpu-Haswell.x86_64-latest.args | 2 +- .../cpu-Haswell.x86_64-latest.xml | 2 +- .../cpu-Haswell2.x86_64-latest.args | 2 +- .../cpu-Haswell2.x86_64-latest.xml | 2 +- .../cpu-Haswell3.x86_64-latest.args | 2 +- .../cpu-Haswell3.x86_64-latest.xml | 2 +- ...-Icelake-Server-pconfig.x86_64-latest.args | 2 +- ...u-Icelake-Server-pconfig.x86_64-latest.xml | 2 +- .../cpu-fallback.x86_64-8.0.0.args | 2 +- .../cpu-fallback.x86_64-8.0.0.xml | 2 +- ...-host-model-fallback-kvm.x86_64-8.1.0.args | 2 +- ...host-model-fallback-kvm.x86_64-latest.args | 2 +- ...host-model-fallback-tcg.x86_64-latest.args | 2 +- ...cpu-host-model-features.x86_64-latest.args | 2 +- .../cpu-host-model-kvm.x86_64-8.1.0.args | 2 +- .../cpu-host-model-kvm.x86_64-latest.args | 2 +- ...ost-model-nofallback-kvm.x86_64-8.1.0.args | 2 +- ...st-model-nofallback-kvm.x86_64-latest.args | 2 +- ...st-model-nofallback-tcg.x86_64-latest.args | 2 +- .../cpu-host-model-tcg.x86_64-latest.args | 2 +- .../cpu-nofallback.x86_64-8.0.0.args | 2 +- .../cpu-nofallback.x86_64-8.0.0.xml | 2 +- .../cpu-strict1.x86_64-latest.args | 2 +- .../cpu-strict1.x86_64-latest.xml | 2 +- .../cpu-translation.x86_64-latest.args | 2 +- .../cpu-translation.x86_64-latest.xml | 2 +- 154 files changed, 33779 insertions(+), 1095 deletions(-) create mode 100644 src/cpu_map/x86_Broadwell-v1.xml create mode 100644 src/cpu_map/x86_Broadwell-v2.xml create mode 100644 src/cpu_map/x86_Broadwell-v3.xml create mode 100644 src/cpu_map/x86_Broadwell-v4.xml create mode 100644 src/cpu_map/x86_Cascadelake-Server-v1.xml create mode 100644 src/cpu_map/x86_Cascadelake-Server-v2.xml create mode 100644 src/cpu_map/x86_Cascadelake-Server-v3.xml create mode 100644 src/cpu_map/x86_Cascadelake-Server-v4.xml create mode 100644 src/cpu_map/x86_Cascadelake-Server-v5.xml create mode 100644 src/cpu_map/x86_Cooperlake-v1.xml create mode 100644 src/cpu_map/x86_Cooperlake-v2.xml create mode 100644 src/cpu_map/x86_Dhyana-v1.xml create mode 100644 src/cpu_map/x86_Dhyana-v2.xml create mode 100644 src/cpu_map/x86_EPYC-Milan-v1.xml create mode 100644 src/cpu_map/x86_EPYC-Milan-v2.xml create mode 100644 src/cpu_map/x86_EPYC-Rome-v1.xml create mode 100644 src/cpu_map/x86_EPYC-Rome-v2.xml create mode 100644 src/cpu_map/x86_EPYC-Rome-v3.xml create mode 100644 src/cpu_map/x86_EPYC-Rome-v4.xml create mode 100644 src/cpu_map/x86_EPYC-v1.xml create mode 100644 src/cpu_map/x86_EPYC-v2.xml create mode 100644 src/cpu_map/x86_EPYC-v3.xml create mode 100644 src/cpu_map/x86_EPYC-v4.xml create mode 100644 src/cpu_map/x86_GraniteRapids-v1.xml create mode 100644 src/cpu_map/x86_Haswell-v1.xml create mode 100644 src/cpu_map/x86_Haswell-v2.xml create mode 100644 src/cpu_map/x86_Haswell-v3.xml create mode 100644 src/cpu_map/x86_Haswell-v4.xml create mode 100644 src/cpu_map/x86_Icelake-Server-v1.xml create mode 100644 src/cpu_map/x86_Icelake-Server-v2.xml create mode 100644 src/cpu_map/x86_Icelake-Server-v3.xml create mode 100644 src/cpu_map/x86_Icelake-Server-v4.xml create mode 100644 src/cpu_map/x86_Icelake-Server-v5.xml create mode 100644 src/cpu_map/x86_Icelake-Server-v6.xml create mode 100644 src/cpu_map/x86_Icelake-Server-v7.xml create mode 100644 src/cpu_map/x86_IvyBridge-v1.xml create mode 100644 src/cpu_map/x86_IvyBridge-v2.xml create mode 100644 src/cpu_map/x86_Nehalem-v1.xml create mode 100644 src/cpu_map/x86_Nehalem-v2.xml create mode 100644 src/cpu_map/x86_SandyBridge-v1.xml create mode 100644 src/cpu_map/x86_SandyBridge-v2.xml create mode 100644 src/cpu_map/x86_SapphireRapids-v1.xml create mode 100644 src/cpu_map/x86_SapphireRapids-v2.xml create mode 100644 src/cpu_map/x86_SapphireRapids-v3.xml create mode 100644 src/cpu_map/x86_SierraForest-v1.xml create mode 100644 src/cpu_map/x86_Skylake-Client-v1.xml create mode 100644 src/cpu_map/x86_Skylake-Client-v2.xml create mode 100644 src/cpu_map/x86_Skylake-Client-v3.xml create mode 100644 src/cpu_map/x86_Skylake-Client-v4.xml create mode 100644 src/cpu_map/x86_Skylake-Server-v1.xml create mode 100644 src/cpu_map/x86_Skylake-Server-v2.xml create mode 100644 src/cpu_map/x86_Skylake-Server-v3.xml create mode 100644 src/cpu_map/x86_Skylake-Server-v4.xml create mode 100644 src/cpu_map/x86_Skylake-Server-v5.xml create mode 100644 src/cpu_map/x86_Snowridge-v1.xml create mode 100644 src/cpu_map/x86_Snowridge-v2.xml create mode 100644 src/cpu_map/x86_Snowridge-v3.xml create mode 100644 src/cpu_map/x86_Snowridge-v4.xml create mode 100644 src/cpu_map/x86_Westmere-v1.xml create mode 100644 src/cpu_map/x86_Westmere-v2.xml -- 2.47.0

2 56

[libvirt PATCH] docs: document external swtpm
by Ján Tomko 21 Nov '24

21 Nov '24

When external swtpm support was added back in 9.0.0, I omitted the update of the XML docs. Add it now, especially since the 'emulator' backend can now also use the <source> element. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- docs/formatdomain.rst | 43 ++++++++++++++++++++++++++++++++++++------- 1 file changed, 36 insertions(+), 7 deletions(-) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index b3f9f453aa..a5510e82f5 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -8140,6 +8140,20 @@ Example: usage of the TPM Emulator </devices> ... +Example: usage of external TPM emulator :since:`Since 9.0.0` + +:: + + ... + <devices> + <tpm model='tpm-tis'> + <backend type='external'> + <source type='unix' mode='connect' path='/tmp/path.sock'/> + </backend> + </tpm> + </devices> + ... + ``model`` The ``model`` attribute specifies what device model QEMU provides to the guest. If no model name is provided, ``tpm-tis`` will automatically be chosen @@ -8178,6 +8192,12 @@ Example: usage of the TPM Emulator parameter can be used to enable logging in the emulator backend, and accepts non-zero integer values. + ``external`` + For this backend, libvirt expects the TPM emulator to be started externally. + The path to the unix socket where the emulator is listening is passed + via the ``source`` element. Other ``backend`` sub-elements do not apply + in these case, since they are controlled by the emulator command line. + ``version`` The ``version`` attribute indicates the version of the TPM. This attribute only works with the ``emulator`` backend. The following versions are @@ -8190,8 +8210,13 @@ Example: usage of the TPM Emulator architecture, TPM model and backend. ``source`` - The ``source`` element specifies the location of the TPM state storage . This - element only works with the ``emulator`` backend. + For the ``emulator`` backend, the ``source`` element specifies the location + of the TPM state storage. :since:`Since v10.10.0` + + For the ``external`` backend, it specifies the socket of the externally + run TPM emulator. :since:`Since v9.0.0` + + This element does not work with the ``passthrough`` backend. When specified, it is the user's responsability to prevent files from being used by multiple VMs or emulators (swtpm will also use advisory locking). If @@ -8202,14 +8227,18 @@ Example: usage of the TPM Emulator The following attributes are supported: ``type`` - The type of storage. It's possible to provide "file" to utilize a single - file or block device where the TPM state will be stored, or "dir" for the - directory where the files will be stored. + For ``external`` backend, only type ``unix`` is supported. + For ``emulator`` backend, it's possible to provide ``file`` to utilize + a single file or block device where the TPM state will be stored, + or ``dir`` for the directory where the files will be stored. + + ``mode`` + Connection mode for the ``unix`` socket. Only ``connect`` is supported. + Can be omitted. ``path`` - The path to the TPM state storage. + The path to the TPM state storage, or the unix socket. - :since:`Since v10.10.0` ``persistent_state`` The ``persistent_state`` attribute indicates whether 'swtpm' TPM state is -- 2.47.0

2 1