- Devel - libvirt List Archives

[PATCH] qemu: snapshot: Restructure control flow to detect errors sooner and work around compiler
by Peter Krempa 09 Jan '23

09 Jan '23

Some compilers aren't happy when an automatically freed variable is used just to free something (thus it's only assigned in the code): When compiling qemuSnapshotDelete after recent commits they complain: ../src/qemu/qemu_snapshot.c:3153:61: error: variable 'delData' set but not used [-Werror,-Wunused-but-set-variable] g_autoslist(qemuSnapshotDeleteExternalData) delData = NULL; ^ To work around the issue we can restructure the code which also has the following semantic implications: - since qemuSnapshotDeleteExternalPrepare does validation we error out sooner than attempting to start the VM - we read the temporary variable at least in one code path Fixes: 4a4d89a9252 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_snapshot.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c index 32f7011cbe..b8416808b3 100644 --- a/src/qemu/qemu_snapshot.c +++ b/src/qemu/qemu_snapshot.c @@ -3146,12 +3146,13 @@ qemuSnapshotDelete(virDomainObj *vm, if (virDomainSnapshotIsExternal(snap) && !(flags & (VIR_DOMAIN_SNAPSHOT_DELETE_CHILDREN | VIR_DOMAIN_SNAPSHOT_DELETE_CHILDREN_ONLY))) { + g_autoslist(qemuSnapshotDeleteExternalData) tmpData = NULL; - externalData = qemuSnapshotDeleteExternalPrepare(vm, snap); + /* this also serves as validation whether the snapshot can be deleted */ + if (!(tmpData = qemuSnapshotDeleteExternalPrepare(vm, snap))) + goto endjob; if (!virDomainObjIsActive(vm)) { - g_autoslist(qemuSnapshotDeleteExternalData) delData = NULL; - if (qemuProcessStart(NULL, driver, vm, NULL, VIR_ASYNC_JOB_SNAPSHOT, NULL, -1, NULL, NULL, VIR_NETDEV_VPORT_PROFILE_OP_CREATE, @@ -3163,20 +3164,19 @@ qemuSnapshotDelete(virDomainObj *vm, /* Call the prepare again as some data require that the VM is * running to get everything we need. */ - delData = g_steal_pointer(&externalData); - externalData = qemuSnapshotDeleteExternalPrepare(vm, snap); + if (!(externalData = qemuSnapshotDeleteExternalPrepare(vm, snap))) + goto endjob; } else { qemuDomainJobPrivate *jobPriv = vm->job->privateData; + externalData = g_steal_pointer(&tmpData); + /* If the VM is running we need to indicate that the async snapshot * job is snapshot delete job. */ jobPriv->snapshotDelete = true; qemuDomainSaveStatus(vm); } - - if (!externalData) - goto endjob; } } -- 2.38.1

2 1

[PATCH V4 00/11] spec: Decompose the daemon subpackage
by Jim Fehlig 09 Jan '23

09 Jan '23

This is V4 of https://listman.redhat.com/archives/libvir-list/2022-December/236427.html The end goal is to remove the libvirt-dameon dependency on the various libvirt-daemon-driver-foo subpackages, allowing installation of a modular daemon configuration without the traditional monolithic libvirtd. Changes from V3: - Address review comments, some of which I overlooked from V2 review Jim Fehlig (11): spec: Move virtlockd to a new subpackage libvirt-daemon-lock spec: Move virtlogd to a new subpackage libvirt-daemon-log spec: Move virtproxyd to a new subpackage libvirt-daemon-proxy spec: Move lockd plugin to a new subpackage spec: Rename the libvirt-lock-sanlock subpackage spec: Move common files and dependencies to libvirt-daemon-common spec: Add module-init-tools dependency to nodedev and lxc drivers spec: Add numad dependency to qemu and lxc drivers spec: Remove libvirt-daemon dependency from drivers spec: Remove libvirt-daemon dependency from hypervisor subpackages kbase: Update rpm-deployment.rst with new subpackages docs/kbase/rpm-deployment.rst | 51 ++++-- libvirt.spec.in | 334 ++++++++++++++++++++++++---------- 2 files changed, 276 insertions(+), 109 deletions(-) -- 2.38.1

3 26

[libvirt PATCH] ci: Refresh and add Fedora 37 target
by Erik Skultety 09 Jan '23

09 Jan '23

This patch pulls in latest lcitool changes mainly though moves onto Fedora 37 over Fedora 35 which is dropped. Test pipeline (ignore non-Fedora 37 stuff): https://gitlab.com/eskultety/libvirt/-/pipelines/741518165 Signed-off-by: Erik Skultety <eskultet(a)redhat.com> --- ...-mingw32.sh => fedora-37-cross-mingw32.sh} | 0 ...-mingw64.sh => fedora-37-cross-mingw64.sh} | 0 ci/buildenv/{fedora-35.sh => fedora-37.sh} | 1 - ci/cirrus/macos-12.vars | 10 +- ...ile => fedora-37-cross-mingw32.Dockerfile} | 2 +- ...ile => fedora-37-cross-mingw64.Dockerfile} | 2 +- ...ora-35.Dockerfile => fedora-37.Dockerfile} | 3 +- ci/gitlab/builds.yml | 76 ++++++------- ci/gitlab/containers.yml | 22 ++-- ci/integration.yml | 104 +++++++++--------- ci/manifest.yml | 16 +-- 11 files changed, 117 insertions(+), 119 deletions(-) rename ci/buildenv/{fedora-36-cross-mingw32.sh => fedora-37-cross-mingw32.sh} (100%) rename ci/buildenv/{fedora-36-cross-mingw64.sh => fedora-37-cross-mingw64.sh} (100%) rename ci/buildenv/{fedora-35.sh => fedora-37.sh} (99%) rename ci/containers/{fedora-36-cross-mingw32.Dockerfile => fedora-37-cross-mingw32.Dockerfile} (98%) rename ci/containers/{fedora-36-cross-mingw64.Dockerfile => fedora-37-cross-mingw64.Dockerfile} (98%) rename ci/containers/{fedora-35.Dockerfile => fedora-37.Dockerfile} (97%) diff --git a/ci/buildenv/fedora-36-cross-mingw32.sh b/ci/buildenv/fedora-37-cross-mingw32.sh similarity index 100% rename from ci/buildenv/fedora-36-cross-mingw32.sh rename to ci/buildenv/fedora-37-cross-mingw32.sh diff --git a/ci/buildenv/fedora-36-cross-mingw64.sh b/ci/buildenv/fedora-37-cross-mingw64.sh similarity index 100% rename from ci/buildenv/fedora-36-cross-mingw64.sh rename to ci/buildenv/fedora-37-cross-mingw64.sh diff --git a/ci/buildenv/fedora-35.sh b/ci/buildenv/fedora-37.sh similarity index 99% rename from ci/buildenv/fedora-35.sh rename to ci/buildenv/fedora-37.sh index 2ee8c901e5..23886ae77c 100644 --- a/ci/buildenv/fedora-35.sh +++ b/ci/buildenv/fedora-37.sh @@ -58,7 +58,6 @@ function install_buildenv() { lvm2 \ make \ meson \ - netcf-devel \ nfs-utils \ ninja-build \ numactl-devel \ diff --git a/ci/cirrus/macos-12.vars b/ci/cirrus/macos-12.vars index a5afb4eb4d..8ecc9c4450 100644 --- a/ci/cirrus/macos-12.vars +++ b/ci/cirrus/macos-12.vars @@ -4,13 +4,13 @@ # # https://gitlab.com/libvirt/libvirt-ci -CCACHE='/usr/local/bin/ccache' +CCACHE='/opt/homebrew/bin/ccache' CPAN_PKGS='' CROSS_PKGS='' -MAKE='/usr/local/bin/gmake' -NINJA='/usr/local/bin/ninja' +MAKE='/opt/homebrew/bin/gmake' +NINJA='/opt/homebrew/bin/ninja' PACKAGING_COMMAND='brew' -PIP3='/usr/local/bin/pip3' +PIP3='/opt/homebrew/bin/pip3' PKGS='augeas bash-completion ccache codespell cppi curl diffutils docutils flake8 gettext git glib gnu-sed gnutls grep libiscsi libpcap libssh libssh2 libxml2 libxslt make meson ninja perl pkg-config python3 qemu readline rpcgen scrub yajl' PYPI_PKGS='' -PYTHON='/usr/local/bin/python3' +PYTHON='/opt/homebrew/bin/python3' diff --git a/ci/containers/fedora-36-cross-mingw32.Dockerfile b/ci/containers/fedora-37-cross-mingw32.Dockerfile similarity index 98% rename from ci/containers/fedora-36-cross-mingw32.Dockerfile rename to ci/containers/fedora-37-cross-mingw32.Dockerfile index 24b2760c18..14fb25a17e 100644 --- a/ci/containers/fedora-36-cross-mingw32.Dockerfile +++ b/ci/containers/fedora-37-cross-mingw32.Dockerfile @@ -4,7 +4,7 @@ # # https://gitlab.com/libvirt/libvirt-ci -FROM registry.fedoraproject.org/fedora:36 +FROM registry.fedoraproject.org/fedora:37 RUN dnf install -y nosync && \ echo -e '#!/bin/sh\n\ diff --git a/ci/containers/fedora-36-cross-mingw64.Dockerfile b/ci/containers/fedora-37-cross-mingw64.Dockerfile similarity index 98% rename from ci/containers/fedora-36-cross-mingw64.Dockerfile rename to ci/containers/fedora-37-cross-mingw64.Dockerfile index a3369209da..c468dd7a6c 100644 --- a/ci/containers/fedora-36-cross-mingw64.Dockerfile +++ b/ci/containers/fedora-37-cross-mingw64.Dockerfile @@ -4,7 +4,7 @@ # # https://gitlab.com/libvirt/libvirt-ci -FROM registry.fedoraproject.org/fedora:36 +FROM registry.fedoraproject.org/fedora:37 RUN dnf install -y nosync && \ echo -e '#!/bin/sh\n\ diff --git a/ci/containers/fedora-35.Dockerfile b/ci/containers/fedora-37.Dockerfile similarity index 97% rename from ci/containers/fedora-35.Dockerfile rename to ci/containers/fedora-37.Dockerfile index f517cf9443..17f586af59 100644 --- a/ci/containers/fedora-35.Dockerfile +++ b/ci/containers/fedora-37.Dockerfile @@ -4,7 +4,7 @@ # # https://gitlab.com/libvirt/libvirt-ci -FROM registry.fedoraproject.org/fedora:35 +FROM registry.fedoraproject.org/fedora:37 RUN dnf install -y nosync && \ echo -e '#!/bin/sh\n\ @@ -69,7 +69,6 @@ exec "$@"' > /usr/bin/nosync && \ lvm2 \ make \ meson \ - netcf-devel \ nfs-utils \ ninja-build \ numactl-devel \ diff --git a/ci/gitlab/builds.yml b/ci/gitlab/builds.yml index 0e2daebe97..89c15fa28d 100644 --- a/ci/gitlab/builds.yml +++ b/ci/gitlab/builds.yml @@ -193,32 +193,6 @@ x86_64-debian-sid-local-env: NAME: debian-sid -x86_64-fedora-35-prebuilt-env: - extends: .native_build_job_prebuilt_env - needs: - - job: x86_64-fedora-35-container - optional: true - allow_failure: false - variables: - NAME: fedora-35 - artifacts: - expire_in: 1 day - paths: - - libvirt-rpms - -x86_64-fedora-35-local-env: - extends: .native_build_job_local_env - needs: [] - allow_failure: false - variables: - IMAGE: registry.fedoraproject.org/fedora:35 - NAME: fedora-35 - artifacts: - expire_in: 1 day - paths: - - libvirt-rpms - - x86_64-fedora-36-prebuilt-env: extends: .native_build_job_prebuilt_env needs: @@ -245,6 +219,32 @@ x86_64-fedora-36-local-env: - libvirt-rpms +x86_64-fedora-37-prebuilt-env: + extends: .native_build_job_prebuilt_env + needs: + - job: x86_64-fedora-37-container + optional: true + allow_failure: false + variables: + NAME: fedora-37 + artifacts: + expire_in: 1 day + paths: + - libvirt-rpms + +x86_64-fedora-37-local-env: + extends: .native_build_job_local_env + needs: [] + allow_failure: false + variables: + IMAGE: registry.fedoraproject.org/fedora:37 + NAME: fedora-37 + artifacts: + expire_in: 1 day + paths: + - libvirt-rpms + + x86_64-fedora-rawhide-prebuilt-env: extends: .native_build_job_prebuilt_env needs: @@ -746,46 +746,46 @@ s390x-debian-sid-local-env: NAME: debian-sid -mingw32-fedora-36-prebuilt-env: +mingw32-fedora-37-prebuilt-env: extends: .cross_build_job_prebuilt_env needs: - - job: mingw32-fedora-36-container + - job: mingw32-fedora-37-container optional: true allow_failure: false variables: CROSS: mingw32 JOB_OPTIONAL: 1 - NAME: fedora-36 + NAME: fedora-37 -mingw32-fedora-36-local-env: +mingw32-fedora-37-local-env: extends: .cross_build_job_local_env needs: [] allow_failure: false variables: CROSS: mingw32 - IMAGE: registry.fedoraproject.org/fedora:36 + IMAGE: registry.fedoraproject.org/fedora:37 JOB_OPTIONAL: 1 - NAME: fedora-36 + NAME: fedora-37 -mingw64-fedora-36-prebuilt-env: +mingw64-fedora-37-prebuilt-env: extends: .cross_build_job_prebuilt_env needs: - - job: mingw64-fedora-36-container + - job: mingw64-fedora-37-container optional: true allow_failure: false variables: CROSS: mingw64 - NAME: fedora-36 + NAME: fedora-37 -mingw64-fedora-36-local-env: +mingw64-fedora-37-local-env: extends: .cross_build_job_local_env needs: [] allow_failure: false variables: CROSS: mingw64 - IMAGE: registry.fedoraproject.org/fedora:36 - NAME: fedora-36 + IMAGE: registry.fedoraproject.org/fedora:37 + NAME: fedora-37 mingw32-fedora-rawhide-prebuilt-env: diff --git a/ci/gitlab/containers.yml b/ci/gitlab/containers.yml index 1b7f63955b..fa426bd3a6 100644 --- a/ci/gitlab/containers.yml +++ b/ci/gitlab/containers.yml @@ -56,13 +56,6 @@ x86_64-debian-sid-container: NAME: debian-sid -x86_64-fedora-35-container: - extends: .container_job - allow_failure: false - variables: - NAME: fedora-35 - - x86_64-fedora-36-container: extends: .container_job allow_failure: false @@ -70,6 +63,13 @@ x86_64-fedora-36-container: NAME: fedora-36 +x86_64-fedora-37-container: + extends: .container_job + allow_failure: false + variables: + NAME: fedora-37 + + x86_64-fedora-rawhide-container: extends: .container_job allow_failure: true @@ -235,19 +235,19 @@ s390x-debian-sid-container: NAME: debian-sid-cross-s390x -mingw32-fedora-36-container: +mingw32-fedora-37-container: extends: .container_job allow_failure: false variables: JOB_OPTIONAL: 1 - NAME: fedora-36-cross-mingw32 + NAME: fedora-37-cross-mingw32 -mingw64-fedora-36-container: +mingw64-fedora-37-container: extends: .container_job allow_failure: false variables: - NAME: fedora-36-cross-mingw64 + NAME: fedora-37-cross-mingw64 mingw32-fedora-rawhide-container: diff --git a/ci/integration.yml b/ci/integration.yml index b79d2e0f40..2bdda1d3c1 100644 --- a/ci/integration.yml +++ b/ci/integration.yml @@ -81,46 +81,6 @@ centos-stream-9-tests-local-env: artifacts: true -.fedora-35-tests: - variables: - # needed by libvirt-gitlab-executor - DISTRO: fedora-35 - # can be overridden in forks to set a different runner tag - LIBVIRT_CI_INTEGRATION_RUNNER_TAG: redhat-vm-host - tags: - - $LIBVIRT_CI_INTEGRATION_RUNNER_TAG - -fedora-35-tests-prebuilt-env: - extends: - - .integration_tests_prebuilt_env - - .fedora-35-tests - needs: - - x86_64-fedora-35-prebuilt-env - - project: libvirt/libvirt-perl - job: x86_64-fedora-35-prebuilt-env - ref: master - artifacts: true - - project: libvirt/libvirt-python - job: x86_64-fedora-35-prebuilt-env - ref: master - artifacts: true - -fedora-35-tests-local-env: - extends: - - .integration_tests_local_env - - .fedora-35-tests - needs: - - x86_64-fedora-35-local-env - - project: libvirt/libvirt-perl - job: x86_64-fedora-35-prebuilt-env - ref: master - artifacts: true - - project: libvirt/libvirt-python - job: x86_64-fedora-35-prebuilt-env - ref: master - artifacts: true - - .fedora-36-tests: variables: # needed by libvirt-gitlab-executor @@ -161,41 +121,81 @@ fedora-36-tests-local-env: artifacts: true -.fedora-36-upstream-qemu-tests: +.fedora-37-tests: variables: # needed by libvirt-gitlab-executor - DISTRO: fedora-36 + DISTRO: fedora-37 # can be overridden in forks to set a different runner tag LIBVIRT_CI_INTEGRATION_RUNNER_TAG: redhat-vm-host tags: - $LIBVIRT_CI_INTEGRATION_RUNNER_TAG -fedora-36-upstream-qemu-tests-prebuilt-env: +fedora-37-tests-prebuilt-env: extends: - .integration_tests_prebuilt_env - - .fedora-36-upstream-qemu-tests + - .fedora-37-tests needs: - - x86_64-fedora-36-prebuilt-env + - x86_64-fedora-37-prebuilt-env - project: libvirt/libvirt-perl - job: x86_64-fedora-36-prebuilt-env + job: x86_64-fedora-37-prebuilt-env ref: master artifacts: true - project: libvirt/libvirt-python - job: x86_64-fedora-36-prebuilt-env + job: x86_64-fedora-37-prebuilt-env ref: master artifacts: true -fedora-36-upstream-qemu-tests-local-env: +fedora-37-tests-local-env: extends: - .integration_tests_local_env - - .fedora-36-upstream-qemu-tests + - .fedora-37-tests needs: - - x86_64-fedora-36-local-env + - x86_64-fedora-37-local-env - project: libvirt/libvirt-perl - job: x86_64-fedora-36-prebuilt-env + job: x86_64-fedora-37-prebuilt-env ref: master artifacts: true - project: libvirt/libvirt-python - job: x86_64-fedora-36-prebuilt-env + job: x86_64-fedora-37-prebuilt-env + ref: master + artifacts: true + + +.fedora-37-upstream-qemu-tests: + variables: + # needed by libvirt-gitlab-executor + DISTRO: fedora-37 + # can be overridden in forks to set a different runner tag + LIBVIRT_CI_INTEGRATION_RUNNER_TAG: redhat-vm-host + tags: + - $LIBVIRT_CI_INTEGRATION_RUNNER_TAG + +fedora-37-upstream-qemu-tests-prebuilt-env: + extends: + - .integration_tests_prebuilt_env + - .fedora-37-upstream-qemu-tests + needs: + - x86_64-fedora-37-prebuilt-env + - project: libvirt/libvirt-perl + job: x86_64-fedora-37-prebuilt-env + ref: master + artifacts: true + - project: libvirt/libvirt-python + job: x86_64-fedora-37-prebuilt-env + ref: master + artifacts: true + +fedora-37-upstream-qemu-tests-local-env: + extends: + - .integration_tests_local_env + - .fedora-37-upstream-qemu-tests + needs: + - x86_64-fedora-37-local-env + - project: libvirt/libvirt-perl + job: x86_64-fedora-37-prebuilt-env + ref: master + artifacts: true + - project: libvirt/libvirt-python + job: x86_64-fedora-37-prebuilt-env ref: master artifacts: true diff --git a/ci/manifest.yml b/ci/manifest.yml index 2aec92dd26..2aa9ce9952 100644 --- a/ci/manifest.yml +++ b/ci/manifest.yml @@ -116,14 +116,6 @@ targets: containers: false builds: false - fedora-35: - jobs: - - arch: x86_64 - artifacts: - expire_in: 1 day - paths: - - libvirt-rpms - fedora-36: jobs: - arch: x86_64 @@ -132,6 +124,14 @@ targets: paths: - libvirt-rpms + fedora-37: + jobs: + - arch: x86_64 + artifacts: + expire_in: 1 day + paths: + - libvirt-rpms + - arch: mingw32 builds: false -- 2.39.0

2 1

[PATCH] virNWFilterSnoopLeaseFileLoad: Don't typecast 'ipl.timeout'
by Peter Krempa 09 Jan '23

09 Jan '23

Use a temporary variable to avoid memory alignment issues on ARM: ../src/nwfilter/nwfilter_dhcpsnoop.c: In function ‘virNWFilterSnoopLeaseFileLoad’: ../src/nwfilter/nwfilter_dhcpsnoop.c:1745:20: error: cast increases required alignment of target type [-Werror=cast-align] 1745 | (unsigned long long *) &ipl.timeout, | Fixes: 0d278aa089bf3a00bf2d6e56d2f01ea4677190a7 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- Corresponding job: https://gitlab.com/pipo.sk/libvirt/-/jobs/3565653957 src/nwfilter/nwfilter_dhcpsnoop.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/nwfilter/nwfilter_dhcpsnoop.c b/src/nwfilter/nwfilter_dhcpsnoop.c index e604d67b96..20afc1b2d4 100644 --- a/src/nwfilter/nwfilter_dhcpsnoop.c +++ b/src/nwfilter/nwfilter_dhcpsnoop.c @@ -1733,6 +1733,8 @@ virNWFilterSnoopLeaseFileLoad(void) fp = fopen(LEASEFILE, "r"); time(&now); while (fp && fgets(line, sizeof(line), fp)) { + unsigned long long timeout; + if (line[strlen(line)-1] != '\n') { virReportError(VIR_ERR_INTERNAL_ERROR, _("virNWFilterSnoopLeaseFileLoad lease file " @@ -1742,13 +1744,13 @@ virNWFilterSnoopLeaseFileLoad(void) ln++; /* key len 54 = "VMUUID"+'-'+"MAC" */ if (sscanf(line, "%llu %54s %15s %15s", - (unsigned long long *) &ipl.timeout, - ifkey, ipstr, srvstr) < 4) { + &timeout, ifkey, ipstr, srvstr) < 4) { virReportError(VIR_ERR_INTERNAL_ERROR, _("virNWFilterSnoopLeaseFileLoad lease file " "line %d corrupt"), ln); break; } + ipl.timeout = timeout; if (ipl.timeout && ipl.timeout < now) continue; req = virNWFilterSnoopReqGetByIFKey(ifkey); -- 2.38.1

2 1

[PATCH v2 00/17] Add support for passing FDs to access disk images
by Peter Krempa 09 Jan '23

09 Jan '23

v2: - fixed uninitialized value usage when reading image header Peter Krempa (17): lib: Introduce virDomainFDAssociate API virsh: Introduce 'dom-fd-associate' for invoking virDomainFDAssociate() conf: storage_source: Introduce type for storing FDs associated for storage qemu: Implement qemuDomainFDAssociate qemuxml2argvtest: Add support for populating 'fds' in private data conf: Add 'fdgroup' attribute for 'file' disks qemu: domain: Introduce qemuDomainStartupCleanup conf: storage_source: Introduce virStorageSourceIsFD qemu: Prepare data for FD-passed disk image sources qemu: block: Add support for passing FDs of disk images secuirity: DAC: Don't relabel FD-passed virStorageSource images security: selinux: Handle security labelling of FD-passed images qemu: Prepare storage backing chain traversal code for FD passed images qemu: driver: Don't allow certain operations with FD-passed disks qemu: cgroup: Don't setup cgroups for FD-passed images qemu: Enable support for FD passed disk sources qemuxml2*test: Enable testing of disks with 'fdgroup' docs/formatdomain.rst | 8 ++ docs/manpages/virsh.rst | 19 +++ include/libvirt/libvirt-domain.h | 20 +++ src/conf/domain_conf.c | 2 + src/conf/domain_conf.h | 1 + src/conf/domain_postparse.c | 9 ++ src/conf/schemas/domaincommon.rng | 3 + src/conf/storage_source_conf.c | 57 ++++++++ src/conf/storage_source_conf.h | 27 ++++ src/driver-hypervisor.h | 8 ++ src/libvirt-domain.c | 80 +++++++++++ src/libvirt_private.syms | 2 + src/libvirt_public.syms | 5 + src/qemu/qemu_block.c | 31 ++++- src/qemu/qemu_cgroup.c | 4 +- src/qemu/qemu_command.c | 22 +++ src/qemu/qemu_domain.c | 129 ++++++++++++++++-- src/qemu/qemu_domain.h | 11 +- src/qemu/qemu_driver.c | 89 ++++++++++++ src/qemu/qemu_hotplug.c | 1 + src/qemu/qemu_process.c | 2 +- src/remote/remote_daemon_dispatch.c | 40 ++++++ src/remote/remote_driver.c | 27 ++++ src/remote/remote_protocol.x | 14 +- src/remote_protocol-structs | 6 + src/security/security_dac.c | 16 ++- src/security/security_selinux.c | 32 ++++- src/security/virt-aa-helper.c | 3 +- src/storage_file/storage_source.c | 15 ++ .../disk-source-fd.x86_64-latest.args | 49 +++++++ tests/qemuxml2argvdata/disk-source-fd.xml | 40 ++++++ tests/qemuxml2argvtest.c | 9 ++ .../disk-source-fd.x86_64-latest.xml | 52 +++++++ tests/qemuxml2xmltest.c | 2 + tests/testutilsqemu.c | 33 +++++ tests/testutilsqemu.h | 2 + tools/virsh-domain.c | 76 +++++++++++ 37 files changed, 923 insertions(+), 23 deletions(-) create mode 100644 tests/qemuxml2argvdata/disk-source-fd.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-source-fd.xml create mode 100644 tests/qemuxml2xmloutdata/disk-source-fd.x86_64-latest.xml -- 2.38.1

2 18

[libvirt PATCH v3 00/32] introduce external snapshot delete support
by Pavel Hrdina 09 Jan '23

09 Jan '23

This implements virDomainSnapshotDelete API to support external snapshots. The support doesn't include flags VIR_DOMAIN_SNAPSHOT_DELETE_CHILDREN and VIR_DOMAIN_SNAPSHOT_DELETE_CHILDREN_ONLY as it would add more complexity and IMHO these flags should not existed at all. Gitlab repo with the patches: https://gitlab.com/phrdina/libvirt/-/commits/snapshot-delete-external Changes in v3: - added new patch to store snapshotDelete in status XML - fixed aborting jobs when daemon is restarted only when snapshot delete was previously stared Changes in v2: - qemuBlockCommit properly unrefs job by calling qemuBlockJobStartupFinalize - added comment to various functions - renamed some functions as suggested in review of v1 patches - improved error messages - introduced virStorageSourceChainLookupBySource() - use virStorageSourceIsBacking() - properly cleanup qemuSnapshotDeleteExternalData - don't allow deleting snapshot if there is another block job Pavel Hrdina (32): libvirt: introduce VIR_DOMAIN_JOB_OPERATION_SNAPSHOT_DELETE qemu_block: extract block commit code to separate function qemu_block: move qemuDomainBlockPivot out of qemu_driver qemu_block: add async domain job support to qemuBlockCommit qemu_block: add async domain job support to qemuBlockPivot qemu_monitor: introduce qemuMonitorJobFinalize qemu_monitor_json: allow configuring autofinalize for block commit qemu_block: allow configuring autofinalize for block commit qemu_block: introduce qemuBlockFinalize qemu_block: change qemuBlockCommit to return job pointer qemu_blockjob: process QEMU_MONITOR_JOB_STATUS_PENDING signal storage_source: introduce virStorageSourceChainLookupBySource qemu_snapshot: refactor qemuSnapshotDelete qemu_snapshot: introduce qemuSnapshotDeleteSingle qemu_snapshot: introduce qemuSnapshotDeleteChildren qemu_snapshot: rework snapshot children deletion qemu_snapshot: move snapshot discard out of qemu_domain.c qemu_snapshot: move snapshot metadata reparent code qemu_snapshot: introduce qemuSnapshotDiscardMetadata qemu_snapshot: introduce qemuSnapshotDeleteValidate function qemu_snapshot: refactor validation of snapshot delete qemu_snapshot: error out when deleting internal snapshot on non-active disk qemu_snapshot: convert snapshot delete to async domain job qemu_snapshot: prepare data for external snapshot deletion qemu_snapshot: implement deletion of external snapshot qemu_snapshot: update metadata when deleting snapshots qemu_snapshot: when deleting snapshot invalidate parent snapshot qemu_domain: store snapshotDelete in qemuDomainJobPrivate qemu_process: abort snapshot delete when daemon starts qemu_snapshot: enable deletion of external snapshots api: document support for external snapshot deletion NEWS: document support for external snapshot deletion NEWS.rst | 6 + include/libvirt/libvirt-domain.h | 1 + src/conf/snapshot_conf.c | 8 + src/conf/snapshot_conf.h | 1 + src/libvirt-domain-snapshot.c | 7 + src/libvirt_private.syms | 1 + src/qemu/qemu_backup.c | 1 + src/qemu/qemu_block.c | 364 +++++++++++ src/qemu/qemu_block.h | 22 + src/qemu/qemu_blockjob.c | 21 +- src/qemu/qemu_blockjob.h | 1 + src/qemu/qemu_domain.c | 118 +--- src/qemu/qemu_domain.h | 11 +- src/qemu/qemu_driver.c | 292 +-------- src/qemu/qemu_monitor.c | 21 +- src/qemu/qemu_monitor.h | 8 +- src/qemu/qemu_monitor_json.c | 26 +- src/qemu/qemu_monitor_json.h | 8 +- src/qemu/qemu_process.c | 37 ++ src/qemu/qemu_snapshot.c | 981 +++++++++++++++++++++++++++--- src/qemu/qemu_snapshot.h | 4 + src/storage_file/storage_source.c | 40 ++ src/storage_file/storage_source.h | 6 + tests/qemumonitorjsontest.c | 4 +- tools/virsh-domain.c | 1 + 25 files changed, 1514 insertions(+), 476 deletions(-) -- 2.39.0

2 33

[PATCH] cpu_map: Add -noMPX models for x86 Icelake Server
by Lena Voytek 09 Jan '23

09 Jan '23

Intel has removed MPX capabilities from 10nm Icelake CPUs[1], which is reflected by the new models through the line marking mpx as removed. The original Icelake Server models have been left alone to avoid regressions. This adds: -Icelake-Server-noMPX -Icelake-Server-noTSX-noMPX References: [1] Memory Protection Extensions support removal https://www.intel.com/content/www/us/en/support/articles/000059823/processo… Fixes: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1978064 https://gitlab.com/libvirt/libvirt/-/issues/304 Signed-off-by: Lena Voytek <lena.voytek(a)canonical.com> --- src/cpu_map/index.xml | 2 + src/cpu_map/x86_Icelake-Server-noMPX.xml | 93 +++++++++++++++++++ .../x86_Icelake-Server-noTSX-noMPX.xml | 91 ++++++++++++++++++ 3 files changed, 186 insertions(+) create mode 100644 src/cpu_map/x86_Icelake-Server-noMPX.xml create mode 100644 src/cpu_map/x86_Icelake-Server-noTSX-noMPX.xml diff --git a/src/cpu_map/index.xml b/src/cpu_map/index.xml index 351c2ae4fa..62c3d44a5c 100644 --- a/src/cpu_map/index.xml +++ b/src/cpu_map/index.xml @@ -54,6 +54,8 @@ <include filename='x86_Icelake-Client-noTSX.xml'/> <include filename='x86_Icelake-Server.xml'/> <include filename='x86_Icelake-Server-noTSX.xml'/> + <include filename='x86_Icelake-Server-noMPX.xml'/> + <include filename='x86_Icelake-Server-noTSX-noMPX.xml'/> <include filename='x86_Cooperlake.xml'/> <include filename='x86_Snowridge.xml'/> diff --git a/src/cpu_map/x86_Icelake-Server-noMPX.xml b/src/cpu_map/x86_Icelake-Server-noMPX.xml new file mode 100644 index 0000000000..feaf21f91f --- /dev/null +++ b/src/cpu_map/x86_Icelake-Server-noMPX.xml @@ -0,0 +1,93 @@ +<cpus> + <model name='Icelake-Server-noMPX'> + <decode host='on' guest='on'/> + <signature family='6' model='106'/>  + <vendor name='Intel'/> + <feature name='3dnowprefetch'/> + <feature name='abm'/> + <feature name='adx'/> + <feature name='aes'/> + <feature name='apic'/> + <feature name='arat'/> + <feature name='avx'/> + <feature name='avx2'/> + <feature name='avx512-vpopcntdq'/> + <feature name='avx512bitalg'/> + <feature name='avx512bw'/> + <feature name='avx512cd'/> + <feature name='avx512dq'/> + <feature name='avx512f'/> + <feature name='avx512vbmi'/> + <feature name='avx512vbmi2'/> + <feature name='avx512vl'/> + <feature name='avx512vnni'/> + <feature name='bmi1'/> + <feature name='bmi2'/> + <feature name='clflush'/> + <feature name='clflushopt'/> + <feature name='clwb'/> + <feature name='cmov'/> + <feature name='cx16'/> + <feature name='cx8'/> + <feature name='de'/> + <feature name='erms'/> + <feature name='f16c'/> + <feature name='fma'/> + <feature name='fpu'/> + <feature name='fsgsbase'/> + <feature name='fxsr'/> + <feature name='gfni'/> + <feature name='hle'/> + <feature name='intel-pt' removed='yes'/> + <feature name='invpcid'/> + <feature name='la57'/> + <feature name='lahf_lm'/> + <feature name='lm'/> + <feature name='mca'/> + <feature name='mce'/> + <feature name='mmx'/> + <feature name='movbe'/> + <feature name='mpx' removed='yes'/> + <feature name='msr'/> + <feature name='mtrr'/> + <feature name='nx'/> + <feature name='pae'/> + <feature name='pat'/> + <feature name='pcid'/> + <feature name='pclmuldq'/> + <feature name='pdpe1gb'/> + <feature name='pge'/> + <feature name='pku'/> + <feature name='pni'/> + <feature name='popcnt'/> + <feature name='pse'/> + <feature name='pse36'/> + <feature name='rdrand'/> + <feature name='rdseed'/> + <feature name='rdtscp'/> + <feature name='rtm'/> + <feature name='sep'/> + <feature name='smap'/> + <feature name='smep'/> + <feature name='spec-ctrl'/> + <feature name='ssbd'/> + <feature name='sse'/> + <feature name='sse2'/> + <feature name='sse4.1'/> + <feature name='sse4.2'/> + <feature name='ssse3'/> + <feature name='syscall'/> + <feature name='tsc'/> + <feature name='tsc-deadline'/> + <feature name='umip'/> + <feature name='vaes'/> + <feature name='vme'/> + <feature name='vpclmulqdq'/> + <feature name='wbnoinvd'/> + <feature name='x2apic'/> + <feature name='xgetbv1'/> + <feature name='xsave'/> + <feature name='xsavec'/> + <feature name='xsaveopt'/> + </model> +</cpus> diff --git a/src/cpu_map/x86_Icelake-Server-noTSX-noMPX.xml b/src/cpu_map/x86_Icelake-Server-noTSX-noMPX.xml new file mode 100644 index 0000000000..e55da83ddf --- /dev/null +++ b/src/cpu_map/x86_Icelake-Server-noTSX-noMPX.xml @@ -0,0 +1,91 @@ +<cpus> + <model name='Icelake-Server-noTSX-noMPX'> + <decode host='on' guest='off'/> + <signature family='6' model='106'/>  + <vendor name='Intel'/> + <feature name='3dnowprefetch'/> + <feature name='abm'/> + <feature name='adx'/> + <feature name='aes'/> + <feature name='apic'/> + <feature name='arat'/> + <feature name='avx'/> + <feature name='avx2'/> + <feature name='avx512-vpopcntdq'/> + <feature name='avx512bitalg'/> + <feature name='avx512bw'/> + <feature name='avx512cd'/> + <feature name='avx512dq'/> + <feature name='avx512f'/> + <feature name='avx512vbmi'/> + <feature name='avx512vbmi2'/> + <feature name='avx512vl'/> + <feature name='avx512vnni'/> + <feature name='bmi1'/> + <feature name='bmi2'/> + <feature name='clflush'/> + <feature name='clflushopt'/> + <feature name='clwb'/> + <feature name='cmov'/> + <feature name='cx16'/> + <feature name='cx8'/> + <feature name='de'/> + <feature name='erms'/> + <feature name='f16c'/> + <feature name='fma'/> + <feature name='fpu'/> + <feature name='fsgsbase'/> + <feature name='fxsr'/> + <feature name='gfni'/> + <feature name='intel-pt' removed='yes'/> + <feature name='invpcid'/> + <feature name='la57'/> + <feature name='lahf_lm'/> + <feature name='lm'/> + <feature name='mca'/> + <feature name='mce'/> + <feature name='mmx'/> + <feature name='movbe'/> + <feature name='mpx' removed='yes'/> + <feature name='msr'/> + <feature name='mtrr'/> + <feature name='nx'/> + <feature name='pae'/> + <feature name='pat'/> + <feature name='pcid'/> + <feature name='pclmuldq'/> + <feature name='pdpe1gb'/> + <feature name='pge'/> + <feature name='pku'/> + <feature name='pni'/> + <feature name='popcnt'/> + <feature name='pse'/> + <feature name='pse36'/> + <feature name='rdrand'/> + <feature name='rdseed'/> + <feature name='rdtscp'/> + <feature name='sep'/> + <feature name='smap'/> + <feature name='smep'/> + <feature name='spec-ctrl'/> + <feature name='ssbd'/> + <feature name='sse'/> + <feature name='sse2'/> + <feature name='sse4.1'/> + <feature name='sse4.2'/> + <feature name='ssse3'/> + <feature name='syscall'/> + <feature name='tsc'/> + <feature name='tsc-deadline'/> + <feature name='umip'/> + <feature name='vaes'/> + <feature name='vme'/> + <feature name='vpclmulqdq'/> + <feature name='wbnoinvd'/> + <feature name='x2apic'/> + <feature name='xgetbv1'/> + <feature name='xsave'/> + <feature name='xsavec'/> + <feature name='xsaveopt'/> + </model> +</cpus> -- 2.34.1

5 10

[PATCH 0/2] define g_autoptr for virNWFilterDef and virNWFilterRuleDef
by Jiang Jiacheng 09 Jan '23

09 Jan '23

Define and use g_autoptr() for virNWFilterDef and virNWFilterRuleDef, and remove unnecessary label. Jiang Jiacheng (2): conf: define g_autoptr for virNWFilterDef and virNWFilterRuleDef src/tests: use g_autoptr for virNWFilterDef and virNWFilterRuleDef src/conf/nwfilter_conf.c | 44 ++++++++++++++-------------------- src/conf/nwfilter_conf.h | 2 ++ src/conf/virnwfilterobj.c | 19 +++++++-------- src/nwfilter/nwfilter_driver.c | 7 +++--- tests/nwfilterxml2xmltest.c | 22 +++++++---------- 5 files changed, 39 insertions(+), 55 deletions(-) -- 2.33.0

2 4

[PATCH V2 0/9] use g_autofree
by Jiang Jiacheng 09 Jan '23

09 Jan '23

Use g_autofree more often and remove unnecessary cleanup/error labels. diff to v1: * use g_autofree for uuid in 'virNWFilterDefParseXML' * remove unused rc in security_apparmor.c Jiang Jiacheng (9): conf: use g_autofree and remove unnecessary label interface: use g_autofree and remove unnecessary label locking: use g_autofree and remove unnecessary label remote: use g_autofree and remove unnecessary label rpc: use g_autofree and remove unnecessary label security: use g_autofree and remove unnecessary label util: use g_autofree and remove unnecessary label vmware: use g_autofree and remove unnecessary label vz: use g_autofree and remove unnecessary label src/conf/domain_audit.c | 121 ++++++++----------------- src/conf/node_device_util.c | 49 ++++------ src/conf/nwfilter_conf.c | 55 ++++------- src/conf/virnetworkobj.c | 85 ++++++----------- src/conf/virnetworkportdef.c | 12 +-- src/conf/virnwfilterbindingobj.c | 22 ++--- src/conf/virnwfilterobj.c | 19 +--- src/conf/virstorageobj.c | 23 ++--- src/interface/interface_backend_udev.c | 22 ++--- src/locking/lock_driver_lockd.c | 36 +++----- src/locking/lock_driver_sanlock.c | 46 ++++------ src/remote/remote_driver.c | 22 ++--- src/rpc/virnetclientprogram.c | 6 +- src/rpc/virnettlscontext.c | 16 +--- src/security/security_apparmor.c | 94 +++++++------------ src/util/virconf.c | 27 ++---- src/vmware/vmware_conf.c | 28 ++---- src/vz/vz_utils.c | 18 ++-- 18 files changed, 239 insertions(+), 462 deletions(-) -- 2.33.0

2 11

[PATCH] security_selinux: Set and restore /dev/sgx_* labels
by Michal Privoznik 09 Jan '23

09 Jan '23

For SGX type of memory, QEMU needs to open and talk to /dev/sgx_vepc and /dev/sgx_provision files. But we do not set nor restore SELinux labels on these files when starting a guest. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/security/security_dac.c | 3 --- src/security/security_manager.h | 4 ++++ src/security/security_selinux.c | 24 ++++++++++++++++++++++-- 3 files changed, 26 insertions(+), 5 deletions(-) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 917fcf76a3..abfc07218e 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -47,9 +47,6 @@ VIR_LOG_INIT("security.security_dac"); #define SECURITY_DAC_NAME "dac" -#define DEV_SEV "/dev/sev" -#define DEV_SGX_VEPC "/dev/sgx_vepc" -#define DEV_SGX_PROVISION "/dev/sgx_provision" typedef struct _virSecurityDACData virSecurityDACData; struct _virSecurityDACData { diff --git a/src/security/security_manager.h b/src/security/security_manager.h index 60597ffc0a..4afdcc167b 100644 --- a/src/security/security_manager.h +++ b/src/security/security_manager.h @@ -23,6 +23,10 @@ #include "domain_conf.h" #include "vircommand.h" +#define DEV_SEV "/dev/sev" +#define DEV_SGX_VEPC "/dev/sgx_vepc" +#define DEV_SGX_PROVISION "/dev/sgx_provision" + typedef struct _virSecurityManager virSecurityManager; typedef enum { diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 93cc12407a..c4832e1bfc 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -1577,10 +1577,21 @@ virSecuritySELinuxSetMemoryLabel(virSecurityManager *mgr, return -1; break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: + seclabel = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME); + if (!seclabel || !seclabel->relabel) + return 0; + + if (virSecuritySELinuxSetFilecon(mgr, DEV_SGX_VEPC, + seclabel->imagelabel, true) < 0 || + virSecuritySELinuxSetFilecon(mgr, DEV_SGX_PROVISION, + seclabel->imagelabel, true) < 0) + return -1; + break; + case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_DIMM: case VIR_DOMAIN_MEMORY_MODEL_VIRTIO_MEM: - case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; } @@ -1607,9 +1618,18 @@ virSecuritySELinuxRestoreMemoryLabel(virSecurityManager *mgr, ret = virSecuritySELinuxRestoreFileLabel(mgr, mem->nvdimmPath, true); break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: + seclabel = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME); + if (!seclabel || !seclabel->relabel) + return 0; + + ret = virSecuritySELinuxRestoreFileLabel(mgr, DEV_SGX_VEPC, true); + if (virSecuritySELinuxRestoreFileLabel(mgr, DEV_SGX_PROVISION, true) < 0) + ret = -1; + break; + case VIR_DOMAIN_MEMORY_MODEL_DIMM: case VIR_DOMAIN_MEMORY_MODEL_VIRTIO_MEM: - case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: ret = 0; -- 2.38.2

2 1

[PATCH 0/7] Support crypto device
by zhenwei pi 07 Jan '23

07 Jan '23

Hi, This series supports crypto device, also add support for QEMU. The basic xml schema looks like: <crypto model='virtio' type='qemu'> <backend model='builtin' queues='1'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x0a' function='0x0'/> </crypto> <crypto model='virtio' type='qemu'> <backend model='lkcf'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x0b' function='0x0'/> </crypto> Each patch has been tested by 'ninja -C build test', and launch a QEMU with crypto devices, it works fine. zhenwei pi (7): docs: introduce crypto device conf: support crypto device domain_capabilities: define capabilities for crypto qemu_capabilities: support crypto qemu: alias: support crypto device qemu: command: support crypto device NEWS: Document 'crypto' device NEWS.rst | 3 + docs/formatdomain.rst | 21 ++ src/conf/domain_capabilities.c | 15 ++ src/conf/domain_capabilities.h | 12 ++ src/conf/domain_conf.c | 191 ++++++++++++++++++ src/conf/domain_conf.h | 40 ++++ src/conf/domain_postparse.c | 1 + src/conf/domain_validate.c | 18 ++ src/conf/schemas/domaincaps.rng | 10 + src/conf/virconftypes.h | 2 + src/libvirt_private.syms | 1 + src/qemu/qemu_alias.c | 23 +++ src/qemu/qemu_capabilities.c | 32 +++ src/qemu/qemu_capabilities.h | 8 + src/qemu/qemu_command.c | 109 ++++++++++ src/qemu/qemu_domain.c | 3 + src/qemu/qemu_domain_address.c | 26 +++ src/qemu/qemu_driver.c | 5 + src/qemu/qemu_hotplug.c | 3 + src/qemu/qemu_validate.c | 22 ++ .../domaincapsdata/qemu_4.2.0-q35.x86_64.xml | 11 + .../domaincapsdata/qemu_4.2.0-tcg.x86_64.xml | 11 + .../qemu_4.2.0-virt.aarch64.xml | 11 + tests/domaincapsdata/qemu_4.2.0.aarch64.xml | 11 + tests/domaincapsdata/qemu_4.2.0.ppc64.xml | 11 + tests/domaincapsdata/qemu_4.2.0.s390x.xml | 11 + tests/domaincapsdata/qemu_4.2.0.x86_64.xml | 11 + .../domaincapsdata/qemu_5.0.0-q35.x86_64.xml | 11 + .../domaincapsdata/qemu_5.0.0-tcg.x86_64.xml | 11 + .../qemu_5.0.0-virt.aarch64.xml | 11 + tests/domaincapsdata/qemu_5.0.0.aarch64.xml | 11 + tests/domaincapsdata/qemu_5.0.0.ppc64.xml | 11 + tests/domaincapsdata/qemu_5.0.0.x86_64.xml | 11 + .../domaincapsdata/qemu_5.1.0-q35.x86_64.xml | 11 + .../domaincapsdata/qemu_5.1.0-tcg.x86_64.xml | 11 + tests/domaincapsdata/qemu_5.1.0.sparc.xml | 9 + tests/domaincapsdata/qemu_5.1.0.x86_64.xml | 11 + .../domaincapsdata/qemu_5.2.0-q35.x86_64.xml | 11 + .../domaincapsdata/qemu_5.2.0-tcg.x86_64.xml | 11 + .../qemu_5.2.0-virt.aarch64.xml | 11 + tests/domaincapsdata/qemu_5.2.0.aarch64.xml | 11 + tests/domaincapsdata/qemu_5.2.0.ppc64.xml | 11 + tests/domaincapsdata/qemu_5.2.0.s390x.xml | 11 + tests/domaincapsdata/qemu_5.2.0.x86_64.xml | 11 + .../domaincapsdata/qemu_6.0.0-q35.x86_64.xml | 11 + .../domaincapsdata/qemu_6.0.0-tcg.x86_64.xml | 11 + .../qemu_6.0.0-virt.aarch64.xml | 11 + tests/domaincapsdata/qemu_6.0.0.aarch64.xml | 11 + tests/domaincapsdata/qemu_6.0.0.s390x.xml | 11 + tests/domaincapsdata/qemu_6.0.0.x86_64.xml | 11 + .../domaincapsdata/qemu_6.1.0-q35.x86_64.xml | 11 + .../domaincapsdata/qemu_6.1.0-tcg.x86_64.xml | 11 + tests/domaincapsdata/qemu_6.1.0.x86_64.xml | 11 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 11 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 11 + .../qemu_6.2.0-virt.aarch64.xml | 11 + tests/domaincapsdata/qemu_6.2.0.aarch64.xml | 11 + tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 11 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 11 + .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 11 + .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 11 + .../qemu_7.0.0-virt.aarch64.xml | 11 + tests/domaincapsdata/qemu_7.0.0.aarch64.xml | 11 + tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 11 + tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 11 + .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 11 + .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 11 + tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 11 + tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 11 + .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 12 ++ .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 12 ++ tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 12 ++ .../caps_4.2.0.aarch64.xml | 2 + .../qemucapabilitiesdata/caps_4.2.0.ppc64.xml | 2 + .../qemucapabilitiesdata/caps_4.2.0.s390x.xml | 2 + .../caps_4.2.0.x86_64.xml | 2 + .../caps_5.0.0.aarch64.xml | 2 + .../qemucapabilitiesdata/caps_5.0.0.ppc64.xml | 2 + .../caps_5.0.0.riscv64.xml | 2 + .../caps_5.0.0.x86_64.xml | 2 + .../qemucapabilitiesdata/caps_5.1.0.sparc.xml | 1 + .../caps_5.1.0.x86_64.xml | 2 + .../caps_5.2.0.aarch64.xml | 2 + .../qemucapabilitiesdata/caps_5.2.0.ppc64.xml | 2 + .../caps_5.2.0.riscv64.xml | 2 + .../qemucapabilitiesdata/caps_5.2.0.s390x.xml | 2 + .../caps_5.2.0.x86_64.xml | 2 + .../caps_6.0.0.aarch64.xml | 2 + .../qemucapabilitiesdata/caps_6.0.0.s390x.xml | 2 + .../caps_6.0.0.x86_64.xml | 2 + .../caps_6.1.0.x86_64.xml | 2 + .../caps_6.2.0.aarch64.xml | 2 + .../qemucapabilitiesdata/caps_6.2.0.ppc64.xml | 2 + .../caps_6.2.0.x86_64.xml | 2 + .../caps_7.0.0.aarch64.xml | 2 + .../qemucapabilitiesdata/caps_7.0.0.ppc64.xml | 2 + .../caps_7.0.0.x86_64.xml | 2 + .../qemucapabilitiesdata/caps_7.1.0.ppc64.xml | 2 + .../caps_7.1.0.x86_64.xml | 2 + .../caps_7.2.0.x86_64.xml | 3 + 100 files changed, 1174 insertions(+) -- 2.34.1

2 13

[libvirt PATCH 0/4] qemu: Fix post-copy recovery after dest domain gets paused
by Jiri Denemark 06 Jan '23

06 Jan '23

See 3/4 for details. Jiri Denemark (4): conf: Drop virDomainJobOperation parameter from virDomainObjIsPostcopy conf: Add job parameter to virDomainObjIsFailedPostcopy qemu: Remember failed post-copy migration in job virDomainObjGetState: Promote VIR_DOMAIN_PAUSED_POSTCOPY_FAILED src/conf/domain_conf.c | 41 +++++++++++++++------------- src/conf/domain_conf.h | 5 ++-- src/conf/virdomainjob.c | 1 + src/conf/virdomainjob.h | 1 + src/qemu/qemu_domainjob.c | 9 +++++++ src/qemu/qemu_driver.c | 4 +-- src/qemu/qemu_migration.c | 56 ++++++++++++++++++++++++--------------- src/qemu/qemu_process.c | 23 +++++++++++++--- 8 files changed, 92 insertions(+), 48 deletions(-) -- 2.39.0

2 6

[PATCH 00/36] Add support for passing FDs to access disk images
by Peter Krempa 06 Jan '23

06 Jan '23

First part of the series refactors close callbacks to allow having more of them and then implements new API virDomainFDAssociate and plumbs it to pass to qemu. Peter Krempa (36): datatypes: Simplify error path of 'virGetDomain' datatypes: Clean up whitespace in definition of struct _virConnect conf: virdomainobjlist: Convert header to contemporary style conf: virdomainobjlist: Introduce 'virDomainObjListCollectAll' conf: virdomainobjlist: Remove return value from virDomainObjListCollect conf: domain: Add helper infrastructure for new connection close callbacks virclosecallbacks: Add new close callbacks APIs lxc: Use new connection close callbacks API bhyve: Use new connection close callbacks API qemu: Use new connection close callbacks API qemuMigrationSrcIsAllowed: Remove unused 'driver' argument qemuMigrationSrcBeginResumePhase: Remove unused 'driver' argument virclosecallbacks: Remove old close callbacks code gendispatch: Add 'G_GNUC_WARN_UNUSED_RESULT' to output of 'aclheader' remote_driver: Return 'virLockGuard' from 'remoteDriverLock' remote_driver: Refactor few functions as example of auto-locking virStorageSourceIsSameLocation: Use switch statement for individual storage types qemuxml2argvtest: Add seclabels in <backingStore> to disk-backing-chains-(no)index qemuxml2xmltest: Remove 'disk-backing-chain' case and output files lib: Introduce virDomainFDAssociate API virsh: Introduce 'dom-fd-associate' for invoking virDomainFDAssociate() conf: storage_source: Introduce type for storing FDs associated for storage qemu: Implement qemuDomainFDAssociate qemuxml2argvtest: Add support for populating 'fds' in private data conf: Add 'fdgroup' attribute for 'file' disks qemu: domain: Introduce qemuDomainStartupCleanup conf: storage_source: Introduce virStorageSourceIsFD qemu: Prepare data for FD-passed disk image sources qemu: block: Add support for passing FDs of disk images secuirity: DAC: Don't relabel FD-passed virStorageSource images security: selinux: Handle security labelling of FD-passed images qemu: Prepare storage backing chain traversal code for FD passed images qemu: driver: Don't allow certain operations with FD-passed disks qemu: cgroup: Don't setup cgroups for FD-passed images qemu: Enable support for FD passed disk sources qemuxml2*test: Enable testing of disks with 'fdgroup' docs/formatdomain.rst | 8 + docs/manpages/virsh.rst | 22 + include/libvirt/libvirt-domain.h | 22 + po/POTFILES | 1 - src/bhyve/bhyve_domain.c | 15 +- src/bhyve/bhyve_driver.c | 6 +- src/bhyve/bhyve_process.c | 9 +- src/bhyve/bhyve_utils.h | 2 - src/conf/domain_conf.c | 15 + src/conf/domain_conf.h | 26 + src/conf/domain_postparse.c | 9 + src/conf/schemas/domaincommon.rng | 3 + src/conf/storage_source_conf.c | 80 ++- src/conf/storage_source_conf.h | 27 ++ src/conf/virdomainobjlist.c | 39 +- src/conf/virdomainobjlist.h | 160 +++--- src/datatypes.c | 14 +- src/datatypes.h | 5 +- src/driver-hypervisor.h | 8 + src/hypervisor/virclosecallbacks.c | 454 ++++++++++-------- src/hypervisor/virclosecallbacks.h | 37 +- src/libvirt-domain.c | 82 ++++ src/libvirt_private.syms | 14 +- src/libvirt_public.syms | 5 + src/lxc/lxc_conf.c | 15 +- src/lxc/lxc_conf.h | 3 - src/lxc/lxc_driver.c | 8 +- src/lxc/lxc_process.c | 8 +- src/qemu/qemu_block.c | 31 +- src/qemu/qemu_cgroup.c | 4 +- src/qemu/qemu_command.c | 22 + src/qemu/qemu_conf.c | 17 +- src/qemu/qemu_conf.h | 3 - src/qemu/qemu_domain.c | 129 ++++- src/qemu/qemu_domain.h | 11 +- src/qemu/qemu_driver.c | 108 ++++- src/qemu/qemu_hotplug.c | 1 + src/qemu/qemu_migration.c | 54 +-- src/qemu/qemu_migration.h | 3 +- src/qemu/qemu_process.c | 37 +- src/qemu/qemu_process.h | 11 +- src/qemu/qemu_snapshot.c | 4 +- src/remote/remote_daemon_dispatch.c | 40 ++ src/remote/remote_driver.c | 70 ++- src/remote/remote_protocol.x | 14 +- src/remote_protocol-structs | 6 + src/rpc/gendispatch.pl | 2 +- src/security/security_dac.c | 16 +- src/security/security_selinux.c | 32 +- src/security/virt-aa-helper.c | 3 +- src/storage_file/storage_source.c | 14 + src/test/test_driver.c | 4 +- src/vz/vz_driver.c | 7 +- .../disk-backing-chains-index.xml | 6 +- .../disk-backing-chains-noindex.xml | 6 +- .../qemuxml2argvdata/disk-backing-chains.xml | 98 ---- .../disk-source-fd.x86_64-latest.args | 49 ++ tests/qemuxml2argvdata/disk-source-fd.xml | 40 ++ tests/qemuxml2argvtest.c | 9 + .../disk-backing-chains-active.xml | 110 ----- .../disk-backing-chains-inactive.xml | 110 ----- .../disk-backing-chains-index-active.xml | 6 +- .../disk-backing-chains-index-inactive.xml | 6 +- .../disk-backing-chains-noindex.xml | 6 +- .../disk-source-fd.x86_64-latest.xml | 52 ++ tests/qemuxml2xmltest.c | 3 +- tests/testutilsqemu.c | 33 ++ tests/testutilsqemu.h | 2 + tools/virsh-domain.c | 83 ++++ 69 files changed, 1512 insertions(+), 847 deletions(-) delete mode 100644 tests/qemuxml2argvdata/disk-backing-chains.xml create mode 100644 tests/qemuxml2argvdata/disk-source-fd.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-source-fd.xml delete mode 100644 tests/qemuxml2xmloutdata/disk-backing-chains-active.xml delete mode 100644 tests/qemuxml2xmloutdata/disk-backing-chains-inactive.xml create mode 100644 tests/qemuxml2xmloutdata/disk-source-fd.x86_64-latest.xml -- 2.38.1

3 83

[libvirt PATCH v2 00/31] introduce external snapshot delete support
by Pavel Hrdina 06 Jan '23

06 Jan '23

This implements virDomainSnapshotDelete API to support external snapshots. The support doesn't include flags VIR_DOMAIN_SNAPSHOT_DELETE_CHILDREN and VIR_DOMAIN_SNAPSHOT_DELETE_CHILDREN_ONLY as it would add more complexity and IMHO these flags should not existed at all. Gitlab repo with the patches: https://gitlab.com/phrdina/libvirt/-/commits/snapshot-delete-external Changes in v2: - qemuBlockCommit properly unrefs job by calling qemuBlockJobStartupFinalize - added comment to various functions - renamed some functions as suggested in review of v1 patches - improved error messages - introduced virStorageSourceChainLookupBySource() - use virStorageSourceIsBacking() - properly cleanup qemuSnapshotDeleteExternalData - don't allow deleting snapshot if there is another block job Pavel Hrdina (31): libvirt: introduce VIR_DOMAIN_JOB_OPERATION_SNAPSHOT_DELETE qemu_block: extract block commit code to separate function qemu_block: move qemuDomainBlockPivot out of qemu_driver qemu_block: add async domain job support to qemuBlockCommit qemu_block: add async domain job support to qemuBlockPivot qemu_monitor: introduce qemuMonitorJobFinalize qemu_monitor_json: allow configuring autofinalize for block commit qemu_block: allow configuring autofinalize for block commit qemu_block: introduce qemuBlockFinalize qemu_block: change qemuBlockCommit to return job pointer qemu_blockjob: process QEMU_MONITOR_JOB_STATUS_PENDING signal storage_source: introduce virStorageSourceChainLookupBySource qemu_snapshot: refactor qemuSnapshotDelete qemu_snapshot: introduce qemuSnapshotDeleteSingle qemu_snapshot: introduce qemuSnapshotDeleteChildren qemu_snapshot: rework snapshot children deletion qemu_snapshot: move snapshot discard out of qemu_domain.c qemu_snapshot: move snapshot metadata reparent code qemu_snapshot: introduce qemuSnapshotDiscardMetadata qemu_snapshot: introduce qemuSnapshotDeleteValidate function qemu_snapshot: refactor validation of snapshot delete qemu_snapshot: error out when deleting internal snapshot on non-active disk qemu_snapshot: convert snapshot delete to async domain job qemu_snapshot: prepare data for external snapshot deletion qemu_snapshot: implement deletion of external snapshot qemu_snapshot: update metadata when deleting snapshots qemu_snapshot: when deleting snapshot invalidate parent snapshot qemu_process: abort snapshot delete when daemon starts qemu_snapshot: enable deletion of external snapshots api: document support for external snapshot deletion NEWS: document support for external snapshot deletion NEWS.rst | 6 + include/libvirt/libvirt-domain.h | 1 + src/conf/snapshot_conf.c | 8 + src/conf/snapshot_conf.h | 1 + src/libvirt-domain-snapshot.c | 7 + src/libvirt_private.syms | 1 + src/qemu/qemu_backup.c | 1 + src/qemu/qemu_block.c | 364 +++++++++++ src/qemu/qemu_block.h | 22 + src/qemu/qemu_blockjob.c | 21 +- src/qemu/qemu_blockjob.h | 1 + src/qemu/qemu_domain.c | 95 +-- src/qemu/qemu_domain.h | 9 - src/qemu/qemu_driver.c | 292 +-------- src/qemu/qemu_monitor.c | 21 +- src/qemu/qemu_monitor.h | 8 +- src/qemu/qemu_monitor_json.c | 26 +- src/qemu/qemu_monitor_json.h | 8 +- src/qemu/qemu_process.c | 32 + src/qemu/qemu_snapshot.c | 973 +++++++++++++++++++++++++++--- src/qemu/qemu_snapshot.h | 4 + src/storage_file/storage_source.c | 39 ++ src/storage_file/storage_source.h | 6 + tests/qemumonitorjsontest.c | 4 +- tools/virsh-domain.c | 1 + 25 files changed, 1475 insertions(+), 476 deletions(-) -- 2.39.0

2 37

[PATCH 1/1] nwfilter: use time_t for timeout for consistency
by Shaleen Bathla 06 Jan '23

06 Jan '23

Coverity scan reports: "A time_t value is stored in an integer with too few bits to accommodate it. The expression timeout is cast to unsigned int" We are already casting and storing time_t timeout variable into unsigned int. We can use time_t for timeout and cast it to unsigned long (should be big enough) instead of unsigned int in sscanf, g_strdup_printf as required. Signed-off-by: Shaleen Bathla <shaleen.bathla(a)oracle.com> --- src/nwfilter/nwfilter_dhcpsnoop.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/nwfilter/nwfilter_dhcpsnoop.c b/src/nwfilter/nwfilter_dhcpsnoop.c index a10a14cfc16d..62586be35dfb 100644 --- a/src/nwfilter/nwfilter_dhcpsnoop.c +++ b/src/nwfilter/nwfilter_dhcpsnoop.c @@ -146,7 +146,7 @@ struct _virNWFilterSnoopIPLease { virSocketAddr ipAddress; virSocketAddr ipServer; virNWFilterSnoopReq * snoopReq; - unsigned int timeout; + time_t timeout; /* timer list */ virNWFilterSnoopIPLease *prev; virNWFilterSnoopIPLease *next; @@ -1580,7 +1580,7 @@ virNWFilterSnoopLeaseFileWrite(int lfd, const char *ifkey, return -1; /* time intf ip dhcpserver */ - lbuf = g_strdup_printf("%u %s %s %s\n", ipl->timeout, ifkey, ipstr, dhcpstr); + lbuf = g_strdup_printf("%lu %s %s %s\n", ipl->timeout, ifkey, ipstr, dhcpstr); len = strlen(lbuf); if (safewrite(lfd, lbuf, len) != len) { @@ -1739,7 +1739,7 @@ virNWFilterSnoopLeaseFileLoad(void) } ln++; /* key len 54 = "VMUUID"+'-'+"MAC" */ - if (sscanf(line, "%u %54s %15s %15s", &ipl.timeout, + if (sscanf(line, "%lu %54s %15s %15s", &ipl.timeout, ifkey, ipstr, srvstr) < 4) { virReportError(VIR_ERR_INTERNAL_ERROR, _("virNWFilterSnoopLeaseFileLoad lease file " -- 2.31.1

2 1

[libvirt PATCH 0/2] qemu: Always check nodeset provided to numatune
by Andrea Bolognani 06 Jan '23

06 Jan '23

Behave more consistently when presented with an invalid configuration. Andrea Bolognani (2): tests: Add cases for numatune with unavailable nodes qemu: Always check nodeset provided to numatune src/qemu/qemu_command.c | 6 ++++-- ...-unavailable-restrictive.x86_64-latest.err | 1 + ...matune-memnode-unavailable-restrictive.xml | 20 +++++++++++++++++++ ...mnode-unavailable-strict.x86_64-latest.err | 1 + .../numatune-memnode-unavailable-strict.xml | 20 +++++++++++++++++++ tests/qemuxml2argvtest.c | 2 ++ 6 files changed, 48 insertions(+), 2 deletions(-) create mode 100644 tests/qemuxml2argvdata/numatune-memnode-unavailable-restrictive.x86_64-latest.err create mode 100644 tests/qemuxml2argvdata/numatune-memnode-unavailable-restrictive.xml create mode 100644 tests/qemuxml2argvdata/numatune-memnode-unavailable-strict.x86_64-latest.err create mode 100644 tests/qemuxml2argvdata/numatune-memnode-unavailable-strict.xml -- 2.39.0

2 3

[PATCH] qemu: fix several codecheck in qemu_monitor.c
by Jiang Jiacheng 06 Jan '23

06 Jan '23

1.clear passwd in debug log 2.alignment 3.use the same variable name for function definition and declaration Signed-off-by: Jiang Jiacheng <jiangjiacheng(a)huawei.com> --- src/qemu/qemu_monitor.c | 8 ++++---- src/qemu/qemu_monitor.h | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index 80f262cec7..de9a1b26f6 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -943,7 +943,7 @@ qemuMonitorInitBalloonObjectPath(qemuMonitor *mon, case VIR_DOMAIN_MEMBALLOON_MODEL_XEN: case VIR_DOMAIN_MEMBALLOON_MODEL_NONE: virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("invalid model for virtio-balloon-pci")); + _("invalid model for virtio-balloon-pci")); return; case VIR_DOMAIN_MEMBALLOON_MODEL_LAST: default: @@ -2053,8 +2053,8 @@ qemuMonitorSetPassword(qemuMonitor *mon, if (!protocol) return -1; - VIR_DEBUG("protocol=%s, password=%p, action_if_connected=%s", - protocol, password, action_if_connected); + VIR_DEBUG("protocol=%s, action_if_connected=%s", + protocol, action_if_connected); QEMU_CHECK_MONITOR(mon); @@ -3485,7 +3485,7 @@ qemuMonitorBlockExportAdd(qemuMonitor *mon, int qemuMonitorGetTPMModels(qemuMonitor *mon, - char ***tpmmodels) + char ***tpmmodels) { VIR_DEBUG("tpmmodels=%p", tpmmodels); diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h index c690fc3655..7278f2e706 100644 --- a/src/qemu/qemu_monitor.h +++ b/src/qemu/qemu_monitor.h @@ -627,8 +627,8 @@ struct _qemuMonitorCPUInfo { }; typedef struct _qemuMonitorCPUInfo qemuMonitorCPUInfo; -void qemuMonitorCPUInfoFree(qemuMonitorCPUInfo *list, - size_t nitems); +void qemuMonitorCPUInfoFree(qemuMonitorCPUInfo *cpus, + size_t ncpus); int qemuMonitorGetCPUInfo(qemuMonitor *mon, qemuMonitorCPUInfo **vcpus, size_t maxvcpus, @@ -1184,7 +1184,7 @@ int qemuMonitorNBDServerAdd(qemuMonitor *mon, const char *export, bool writable, const char *bitmap); -int qemuMonitorNBDServerStop(qemuMonitor *); +int qemuMonitorNBDServerStop(qemuMonitor *mon); int qemuMonitorBlockExportAdd(qemuMonitor *mon, virJSONValue **props); -- 2.33.0

2 1

[PATCH] qemu: Fix Commnad -> Command typo
by Martin Kletzander 06 Jan '23

06 Jan '23

Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- Pushed as 'trivial'. src/qemu/qemu_command.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index ee2e873b9562..74069587bfea 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -9843,11 +9843,11 @@ typedef enum { QEMU_COMMAND_DEPRECATION_BEHAVIOR_CRASH, QEMU_COMMAND_DEPRECATION_BEHAVIOR_LAST -} qemuCommnadDeprecationBehavior; +} qemuCommandDeprecationBehavior; -VIR_ENUM_DECL(qemuCommnadDeprecationBehavior); -VIR_ENUM_IMPL(qemuCommnadDeprecationBehavior, +VIR_ENUM_DECL(qemuCommandDeprecationBehavior); +VIR_ENUM_IMPL(qemuCommandDeprecationBehavior, QEMU_COMMAND_DEPRECATION_BEHAVIOR_LAST, "none", "omit", @@ -9863,7 +9863,7 @@ qemuBuildCompatDeprecatedCommandLine(virCommand *cmd, g_autoptr(virJSONValue) props = NULL; g_autofree char *propsstr = NULL; qemuDomainXmlNsDef *nsdata = def->namespaceData; - qemuCommnadDeprecationBehavior behavior = QEMU_COMMAND_DEPRECATION_BEHAVIOR_NONE; + qemuCommandDeprecationBehavior behavior = QEMU_COMMAND_DEPRECATION_BEHAVIOR_NONE; const char *behaviorStr = cfg->deprecationBehavior; int tmp; const char *deprecatedOutput = NULL; @@ -9872,7 +9872,7 @@ qemuBuildCompatDeprecatedCommandLine(virCommand *cmd, if (nsdata && nsdata->deprecationBehavior) behaviorStr = nsdata->deprecationBehavior; - if ((tmp = qemuCommnadDeprecationBehaviorTypeFromString(behaviorStr)) < 0) { + if ((tmp = qemuCommandDeprecationBehaviorTypeFromString(behaviorStr)) < 0) { VIR_WARN("Unsupported deprecation behavior '%s' for VM '%s'", behaviorStr, def->name); return; -- 2.39.0

1 0

[PATCH 0/3] fix some coding issues
by Jiang Jiacheng 06 Jan '23

06 Jan '23

Jiang Jiacheng (3): qemu:fix a misspelling in log remote: fix misspelling in the documation of 'daemonCreateClientStream' storage/util: replace unnecessary while loop by if src/qemu/qemu_process.c | 2 +- src/remote/remote_daemon_stream.c | 4 ++-- src/storage/storage_util.c | 4 +--- src/util/virutil.c | 6 +----- 4 files changed, 5 insertions(+), 11 deletions(-) -- 2.33.0

2 5

[PATCH 0/9] use g_autofree
by Jiang Jiacheng 06 Jan '23

06 Jan '23

Use g_autofree more often and remove unnecessary cleanup/error labels. Jiang Jiacheng (9): conf: use g_autofree and remove unnecessary label interface: use g_autofree and remove unnecessary label locking: use g_autofree and remove unnecessary label remote: use g_autofree and remove unnecessary label rpc: use g_autofree and remove unnecessary label security: use g_autofree and remove unnecessary label util: use g_autofree and remove unnecessary label vmware: use g_autofree and remove unnecessary label vz: use g_autofree and remove unnecessary label src/conf/domain_audit.c | 121 ++++++++----------------- src/conf/node_device_util.c | 49 ++++------ src/conf/nwfilter_conf.c | 51 ++++------- src/conf/virnetworkobj.c | 85 ++++++----------- src/conf/virnetworkportdef.c | 12 +-- src/conf/virnwfilterbindingobj.c | 22 ++--- src/conf/virnwfilterobj.c | 14 +-- src/conf/virstorageobj.c | 23 ++--- src/interface/interface_backend_udev.c | 22 ++--- src/locking/lock_driver_lockd.c | 36 +++----- src/locking/lock_driver_sanlock.c | 46 ++++------ src/remote/remote_driver.c | 22 ++--- src/rpc/virnetclientprogram.c | 6 +- src/rpc/virnettlscontext.c | 16 +--- src/security/security_apparmor.c | 91 +++++++------------ src/util/virconf.c | 27 ++---- src/vmware/vmware_conf.c | 28 ++---- src/vz/vz_utils.c | 18 ++-- 18 files changed, 237 insertions(+), 452 deletions(-) -- 2.33.0

2 14

[PATCH] qemu_namespace: Move umount() call into #fdef __linux__
by Michal Privoznik 05 Jan '23

05 Jan '23

In a recent commit I've introduced an umount() call. But the function where the call lives is compiled on all OSes, not just Linux. But umount() is Linux specific. Other OSes have unmount (FreeBSD), or maybe something else. But since namespaces are Linux specific, we can wrap the call in #ifdef __linux__ and not care about other OSes. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_namespace.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/qemu/qemu_namespace.c b/src/qemu/qemu_namespace.c index fc348c043e..5769a4dfe0 100644 --- a/src/qemu/qemu_namespace.c +++ b/src/qemu/qemu_namespace.c @@ -776,10 +776,12 @@ qemuDomainUnshareNamespace(virQEMUDriverConfig *cfg, goto cleanup; } +#if defined(__linux__) if (umount("/dev") < 0) { virReportSystemError(errno, "%s", _("failed to umount devfs on /dev")); return -1; } +#endif /* !defined(__linux__) */ if (virFileMoveMount(devPath, "/dev") < 0) goto cleanup; -- 2.38.2

2 1

[PATCH v2] virQEMUDriverGetDomainCapabilities: Validate arguments
by Michal Privoznik 05 Jan '23

05 Jan '23

When calling virConnectGetDomainCapabilities() (exposed as virsh domcapabilities) users have option to specify whatever sub-set of { emulatorbin, arch, machine, virttype } they want. Then we have a logic (hidden in virQEMUCapsCacheLookupDefault()) that picks qemuCaps that satisfy values passed by user. And whatever was not specified is then set to the default value as specified by picked qemuCaps. For instance: if no machine type was provided but emulatorbin was, then the machine type is set to the default one as defined by the emulatorbin. Or, when just virttype was set then the remaining three values are set to their respective defaults. Except, we have a crasher in this case: # virsh domcapabilities --virttype hvf error: Disconnected from qemu:///system due to end of file error: failed to get emulator capabilities error: End of file while reading data: Input/output error This is because for 'hvf' virttype (at least my) QEMU does not have any machine type. Therefore, @machine is set to NULL and the rest of the code does not expect that. What we can do about this is to validate all arguments. Well, except for the emulatorbin which is obtained from passed qemuCaps. This also fixes the issue when domcapabilities for a virttype of a different driver are requested, or a different arch. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- v2 of: https://listman.redhat.com/archives/libvir-list/2022-December/236460.html diff to v1: - validate @arch, @virttype as well, not just @machine src/qemu/qemu_conf.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index ae5bbcd138..6760bef14c 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -1454,6 +1454,27 @@ virQEMUDriverGetDomainCapabilities(virQEMUDriver *driver, g_autoptr(virDomainCaps) domCaps = NULL; const char *path = virQEMUCapsGetBinary(qemuCaps); + if (!virQEMUCapsIsArchSupported(qemuCaps, arch)) { + virReportError(VIR_ERR_INVALID_ARG, + _("Emulator '%s' does not support arch '%s'"), + path, virArchToString(arch)); + return NULL; + } + + if (!virQEMUCapsIsVirtTypeSupported(qemuCaps, virttype)) { + virReportError(VIR_ERR_INVALID_ARG, + _("Emulator '%s' does not support virt type '%s'"), + path, virDomainVirtTypeToString(virttype)); + return NULL; + } + + if (!virQEMUCapsIsMachineSupported(qemuCaps, virttype, machine)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("Emulator '%s' does not support machine type '%s'"), + path, NULLSTR(machine)); + return NULL; + } + if (!(domCaps = virDomainCapsNew(path, machine, arch, virttype))) return NULL; -- 2.38.2

2 1

[PATCH v2 0/7] qemu_capabilities: Report Hyper-V Enlightenments in domcapabilities
by Michal Privoznik 05 Jan '23

05 Jan '23

v2 of: https://listman.redhat.com/archives/libvir-list/2022-December/236464.html diff to v1: - Merged some cleanup patches from v1 - Store capabilities in cache - More cleanup patches Michal Prívozník (7): virDomainCapsEnumFormat: Switch to virXMLFormatElement() virDomainCapsEnumFormat: Retrun void domain_capabilities: Expose Hyper-V Enlightenments qemuMonitorJSONMakeCPUModel: Introduce @hv_passthrough argument qemuMonitorJSONGetCPUModelExpansion: Introduce @hv_passthrough argument qemu_capabilities: Query for Hyper-V Enlightenments qemu_capabilities: Report Hyper-V Enlightenments in domcapabilities docs/formatdomaincaps.rst | 15 + src/conf/domain_capabilities.c | 38 +- src/conf/domain_capabilities.h | 8 + src/conf/schemas/domaincaps.rng | 10 + src/qemu/qemu_capabilities.c | 178 ++++++- src/qemu/qemu_driver.c | 3 +- src/qemu/qemu_monitor.c | 5 +- src/qemu/qemu_monitor.h | 1 + src/qemu/qemu_monitor_json.c | 21 +- src/qemu/qemu_monitor_json.h | 1 + tests/cputest.c | 2 +- tests/domaincapsdata/empty.xml | 1 + tests/domaincapsdata/libxl-xenfv.xml | 1 + tests/domaincapsdata/libxl-xenpv.xml | 1 + .../domaincapsdata/qemu_4.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_4.2.0-tcg.x86_64.xml | 1 + .../qemu_4.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_4.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.0.0-tcg.x86_64.xml | 1 + .../qemu_5.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_5.1.0.sparc.xml | 1 + tests/domaincapsdata/qemu_5.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.2.0-tcg.x86_64.xml | 1 + .../qemu_5.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_5.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_5.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.0.0-tcg.x86_64.xml | 1 + .../qemu_6.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_6.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_6.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_6.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_6.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 1 + .../qemu_6.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 1 + .../qemu_7.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 18 + .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 18 + tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 18 + .../caps_4.2.0.aarch64.replies | 45 ++ .../caps_4.2.0.aarch64.xml | 1 + .../caps_4.2.0.x86_64.replies | 317 ++++++++++++ .../caps_4.2.0.x86_64.xml | 1 + .../caps_5.0.0.aarch64.replies | 46 ++ .../caps_5.0.0.aarch64.xml | 1 + .../caps_5.0.0.x86_64.replies | 318 ++++++++++++ .../caps_5.0.0.x86_64.xml | 1 + .../caps_5.1.0.x86_64.replies | 323 ++++++++++++ .../caps_5.1.0.x86_64.xml | 1 + .../caps_5.2.0.aarch64.replies | 47 ++ .../caps_5.2.0.aarch64.xml | 1 + .../caps_5.2.0.x86_64.replies | 324 +++++++++++++ .../caps_5.2.0.x86_64.xml | 1 + .../caps_6.0.0.aarch64.replies | 47 ++ .../caps_6.0.0.aarch64.xml | 1 + .../caps_6.0.0.x86_64.replies | 336 +++++++++++++ .../caps_6.0.0.x86_64.xml | 1 + .../caps_6.1.0.x86_64.replies | 338 +++++++++++++ .../caps_6.1.0.x86_64.xml | 1 + .../caps_6.2.0.aarch64.replies | 47 ++ .../caps_6.2.0.aarch64.xml | 1 + .../caps_6.2.0.x86_64.replies | 348 +++++++++++++ .../caps_6.2.0.x86_64.xml | 1 + .../caps_7.0.0.aarch64.replies | 48 ++ .../caps_7.0.0.aarch64.xml | 1 + .../caps_7.0.0.x86_64.replies | 352 ++++++++++++++ .../caps_7.0.0.x86_64.xml | 1 + .../caps_7.1.0.x86_64.replies | 353 ++++++++++++++ .../caps_7.1.0.x86_64.xml | 1 + .../caps_7.2.0.x86_64.replies | 353 ++++++++++++++ .../caps_7.2.0.x86_64.xml | 1 + .../caps_8.0.0.x86_64.replies | 458 ++++++++++++++++++ .../caps_8.0.0.x86_64.xml | 16 + 103 files changed, 4495 insertions(+), 28 deletions(-) -- 2.38.2

2 12

Plans for the next release
by Jiri Denemark 04 Jan '23

04 Jan '23

We are getting close to the next release of libvirt. To aim for the release on Jan 16 I suggest entering the freeze on Tuesday Jan 10 and tagging RC2 on Thursday Jan 12. I hope this works for everyone. Jirka

1 0

[PATCH] virQEMUCapsLoadCache: Parse <selfvers/> properly
by Michal Privoznik 04 Jan '23

04 Jan '23

In a recent commit, when ditching virXPathULong() the parsing of <selfvers/> was changed. But it was changed to virXMLPropUInt() which is not correct because the value we're interested in is not in an attribute but element itself. Fixes: a3c7426839df25f4026707c5877be75f2461f5e9 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_capabilities.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index e6024a2d75..0c16366f21 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -4533,8 +4533,8 @@ virQEMUCapsLoadCache(virArch hostArch, } qemuCaps->libvirtCtime = (time_t)l; - if (virXMLPropUInt(ctxt->node, "selfvers", 10, VIR_XML_PROP_NONE, - &qemuCaps->libvirtVersion) < 0) + if (virXPathUInt("string(./selfvers)", ctxt, + &qemuCaps->libvirtVersion) < 0) return -1; if (!skipInvalidation && -- 2.38.2

2 1

[PATCH] qemu_namespace: Fix detection of nested mount points
by Michal Privoznik 03 Jan '23

03 Jan '23

When deciding whether to bind mount a path in domain's namespace, we look at the QEMU mount table (/proc/$pid/mounts) and try to match prefix of given path with one of mount points. Well, we do that in a bit clumsy way. For instance, if there's "/dev/hugepages" already mounted inside the namespace and we are deciding whether to bind mount "/dev/hugepages1G/..." we decide to skip over the path and NOT bind mount it. This is because plain STRPREFIX() is used and yes, the former is prefix of the latter. What we need to check also is whether the next character after the prefix is slash. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_namespace.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_namespace.c b/src/qemu/qemu_namespace.c index fb79460109..fc348c043e 100644 --- a/src/qemu/qemu_namespace.c +++ b/src/qemu/qemu_namespace.c @@ -1264,9 +1264,11 @@ qemuNamespacePrepareOneItem(qemuNamespaceMknodData *data, bool found = false; for (n = devMountsPath; n && *n; n++) { + const char *p; + if (STREQ(*n, "/dev")) continue; - if (STRPREFIX(item.file, *n)) { + if ((p = STRSKIP(item.file, *n)) && *p == '/') { found = true; break; } -- 2.38.2

2 1

[PATCH v1 0/7] qemu_capabilities: Report Hyper-V Enlightenments in domcapabilities
by Michal Privoznik 03 Jan '23

03 Jan '23

Michal Prívozník (7): domain_capabilities: s/qemuDomainCapsFeatureFormatSimple/virDomainCapsFeatureFormatSimple/ qemu_capabilities: Decrease scope of @hash in virQEMUCapsProbeQMPHostCPU() qemuMonitorJSONMakeCPUModel: Introduce @hv_passthrough argument qemuMonitorJSONGetCPUModelExpansion: Introduce @hv_passthrough argument qemu_capabilities: Query for Hyper-V Enlightenments domain_capabilities: Expose Hyper-V Enlightenments qemu_capabilities: Report Hyper-V Enlightenments in domcapabilities docs/formatdomaincaps.rst | 15 + src/conf/domain_capabilities.c | 28 +- src/conf/domain_capabilities.h | 8 + src/conf/schemas/domaincaps.rng | 10 + src/qemu/qemu_capabilities.c | 86 ++++- src/qemu/qemu_driver.c | 3 +- src/qemu/qemu_monitor.c | 5 +- src/qemu/qemu_monitor.h | 1 + src/qemu/qemu_monitor_json.c | 21 +- src/qemu/qemu_monitor_json.h | 1 + tests/cputest.c | 2 +- .../domaincapsdata/qemu_4.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_4.2.0-tcg.x86_64.xml | 1 + .../qemu_4.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_4.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.0.0-tcg.x86_64.xml | 1 + .../qemu_5.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_5.1.0.sparc.xml | 1 + tests/domaincapsdata/qemu_5.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.2.0-tcg.x86_64.xml | 1 + .../qemu_5.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_5.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_5.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.0.0-tcg.x86_64.xml | 1 + .../qemu_6.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_6.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_6.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_6.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_6.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 1 + .../qemu_6.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 1 + .../qemu_7.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 1 + .../caps_4.2.0.aarch64.replies | 45 +++ .../caps_4.2.0.x86_64.replies | 317 ++++++++++++++++ .../caps_5.0.0.aarch64.replies | 46 +++ .../caps_5.0.0.x86_64.replies | 318 ++++++++++++++++ .../caps_5.1.0.x86_64.replies | 323 ++++++++++++++++ .../caps_5.2.0.aarch64.replies | 47 +++ .../caps_5.2.0.x86_64.replies | 324 ++++++++++++++++ .../caps_6.0.0.aarch64.replies | 47 +++ .../caps_6.0.0.x86_64.replies | 336 +++++++++++++++++ .../caps_6.1.0.x86_64.replies | 338 +++++++++++++++++ .../caps_6.2.0.aarch64.replies | 47 +++ .../caps_6.2.0.x86_64.replies | 348 +++++++++++++++++ .../caps_7.0.0.aarch64.replies | 48 +++ .../caps_7.0.0.x86_64.replies | 352 +++++++++++++++++ .../caps_7.1.0.x86_64.replies | 353 ++++++++++++++++++ .../caps_7.2.0.x86_64.replies | 353 ++++++++++++++++++ 79 files changed, 3850 insertions(+), 24 deletions(-) -- 2.38.2

2 12

[PATCH 0/7] qemu: Cleanup code around TPM seclabels
by Michal Privoznik 03 Jan '23

03 Jan '23

*** BLURB HERE *** Michal Prívozník (7): qemu_security: Rework qemuSecurityCleanupTPMEmulator() qemu_security: Rename qemuSecurityCleanupTPMEmulator() qemu_security: Introduce qemuSecuritySetTPMLabels() qemu_tpm: Restore TPM labels on failed start qemu_tpm: Open code qemuSecurityStartTPMEmulator() qemu_security: Drop qemuSecurityStartTPMEmulator() docs: Recommend static seclabels for migration on shared storage docs/drvqemu.rst | 7 ++++ src/qemu/qemu_security.c | 90 ++++++++++------------------------------ src/qemu/qemu_security.h | 17 +++----- src/qemu/qemu_tpm.c | 15 ++++--- 4 files changed, 43 insertions(+), 86 deletions(-) -- 2.38.2

2 14

[PATCH v2] i386: Deprecate the -no-hpet QEMU command line option
by Thomas Huth 03 Jan '23

03 Jan '23

The HPET setting has been turned into a machine property a while ago already, so we should finally do the next step and deprecate the legacy CLI option, too. Signed-off-by: Thomas Huth <thuth(a)redhat.com> --- v2: - Rebased to current version from master branch / adjusted version info - Dropped the descrpition in hw/i386/pc.c (already done via another patch) Note: The "hpet" property should now show up in the output of the "query-command-line-options" QMP command since commit 2f129fc107b4a, so it should be feasible for libvirt now to properly probe for the property . docs/about/deprecated.rst | 6 ++++++ softmmu/vl.c | 1 + qemu-options.hx | 2 +- 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 93affe3669..2ae6a79b21 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -114,6 +114,12 @@ form is preferred. Using ``-drive if=none`` to configure the OTP device of the sifive_u RISC-V machine is deprecated. Use ``-drive if=pflash`` instead. +``-no-hpet`` (since 8.0) +'''''''''''''''''''''''' + +The HPET setting has been turned into a machine property. +Use ``-machine hpet=off`` instead. + QEMU Machine Protocol (QMP) commands ------------------------------------ diff --git a/softmmu/vl.c b/softmmu/vl.c index 798e1dc933..9bd0e52d01 100644 --- a/softmmu/vl.c +++ b/softmmu/vl.c @@ -3259,6 +3259,7 @@ void qemu_init(int argc, char **argv) qdict_put_str(machine_opts_dict, "acpi", "off"); break; case QEMU_OPTION_no_hpet: + warn_report("-no-hpet is deprecated, use '-machine hpet=off' instead"); qdict_put_str(machine_opts_dict, "hpet", "off"); break; case QEMU_OPTION_no_reboot: diff --git a/qemu-options.hx b/qemu-options.hx index 7f99d15b23..a3adb4163e 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -2542,7 +2542,7 @@ DEF("no-hpet", 0, QEMU_OPTION_no_hpet, "-no-hpet disable HPET\n", QEMU_ARCH_I386) SRST ``-no-hpet`` - Disable HPET support. + Disable HPET support. Deprecated, use '-machine hpet=off' instead. ERST DEF("acpitable", HAS_ARG, QEMU_OPTION_acpitable, -- 2.31.1

4 3

[PATCH 0/3] qemu: Add caps test data for qemu-8.0 cycle and prepare for deprecation of -no-hpet
by Peter Krempa 03 Jan '23

03 Jan '23

Peter Krempa (3): tests: qemucapabilitiesdata: Add test data for the qemu-8.0 dev cycle qemu: capabilities: Introduce QEMU_CAPS_MACHINE_HPET capability qemu: Use '-machine hpet=off' instead of '-no-hpet' src/qemu/qemu_capabilities.c | 9 + src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_command.c | 29 +- .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 253 + .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 252 + tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 253 + .../caps_8.0.0.x86_64.replies | 39227 ++++++++++++++++ .../caps_8.0.0.x86_64.xml | 3253 ++ .../q35-virt-manager-basic.x86_64-latest.args | 3 +- .../x86_64-pc-graphics.x86_64-latest.args | 3 +- .../x86_64-pc-headless.x86_64-latest.args | 3 +- .../x86_64-q35-graphics.x86_64-latest.args | 3 +- .../x86_64-q35-headless.x86_64-latest.args | 3 +- 13 files changed, 43283 insertions(+), 11 deletions(-) create mode 100644 tests/domaincapsdata/qemu_8.0.0-q35.x86_64.xml create mode 100644 tests/domaincapsdata/qemu_8.0.0-tcg.x86_64.xml create mode 100644 tests/domaincapsdata/qemu_8.0.0.x86_64.xml create mode 100644 tests/qemucapabilitiesdata/caps_8.0.0.x86_64.replies create mode 100644 tests/qemucapabilitiesdata/caps_8.0.0.x86_64.xml -- 2.38.1

3 6

[PATCH 0/4] Check that max_clients is not less than max_anonymous_clients
by Martin Kletzander 02 Jan '23

02 Jan '23

One check is there, but there ought to be more. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2033879 Martin Kletzander (4): Fix test case to actually test something tests: Check error message in virnetdaemontest rpc: Fix error message in virNetServerSetClientLimits rpc: Check client limits in more places src/rpc/virnetserver.c | 19 ++++++++++-- ...nput-data-client-auth-pending-failure.json | 4 +-- ...nput-data-invalid-max-clients-failure.json | 31 +++++++++++++++++++ .../output-data-anon-clients.err | 1 + ...utput-data-client-auth-pending-failure.err | 1 + ...utput-data-invalid-max-clients-failure.err | 1 + tests/virnetdaemontest.c | 20 +++++++----- 7 files changed, 64 insertions(+), 13 deletions(-) create mode 100644 tests/virnetdaemondata/input-data-invalid-max-clients-failure.json create mode 100644 tests/virnetdaemondata/output-data-anon-clients.err create mode 100644 tests/virnetdaemondata/output-data-client-auth-pending-failure.err create mode 100644 tests/virnetdaemondata/output-data-invalid-max-clients-failure.err -- 2.39.0

2 5

Re: [PATCH] qemu: fix several codecheck in qemu_monitor.c
by Jiang Jiacheng 24 Dec '22

24 Dec '22

Ping... On 2022/12/8 20:49, Jiang Jiacheng wrote: > 1.clear passwd in debug log > 2.alignment > 3.use the same variable name for function definition and declaration > > Signed-off-by: Jiang Jiacheng <jiangjiacheng(a)huawei.com> > --- > src/qemu/qemu_monitor.c | 8 ++++---- > src/qemu/qemu_monitor.h | 6 +++--- > 2 files changed, 7 insertions(+), 7 deletions(-) > > diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c > index 80f262cec7..de9a1b26f6 100644 > --- a/src/qemu/qemu_monitor.c > +++ b/src/qemu/qemu_monitor.c > @@ -943,7 +943,7 @@ qemuMonitorInitBalloonObjectPath(qemuMonitor *mon, > case VIR_DOMAIN_MEMBALLOON_MODEL_XEN: > case VIR_DOMAIN_MEMBALLOON_MODEL_NONE: > virReportError(VIR_ERR_INTERNAL_ERROR, "%s", > - _("invalid model for virtio-balloon-pci")); > + _("invalid model for virtio-balloon-pci")); > return; > case VIR_DOMAIN_MEMBALLOON_MODEL_LAST: > default: > @@ -2053,8 +2053,8 @@ qemuMonitorSetPassword(qemuMonitor *mon, > if (!protocol) > return -1; > > - VIR_DEBUG("protocol=%s, password=%p, action_if_connected=%s", > - protocol, password, action_if_connected); > + VIR_DEBUG("protocol=%s, action_if_connected=%s", > + protocol, action_if_connected); > > QEMU_CHECK_MONITOR(mon); > > @@ -3485,7 +3485,7 @@ qemuMonitorBlockExportAdd(qemuMonitor *mon, > > int > qemuMonitorGetTPMModels(qemuMonitor *mon, > - char ***tpmmodels) > + char ***tpmmodels) > { > VIR_DEBUG("tpmmodels=%p", tpmmodels); > > diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h > index c690fc3655..7278f2e706 100644 > --- a/src/qemu/qemu_monitor.h > +++ b/src/qemu/qemu_monitor.h > @@ -627,8 +627,8 @@ struct _qemuMonitorCPUInfo { > }; > typedef struct _qemuMonitorCPUInfo qemuMonitorCPUInfo; > > -void qemuMonitorCPUInfoFree(qemuMonitorCPUInfo *list, > - size_t nitems); > +void qemuMonitorCPUInfoFree(qemuMonitorCPUInfo *cpus, > + size_t ncpus); > int qemuMonitorGetCPUInfo(qemuMonitor *mon, > qemuMonitorCPUInfo **vcpus, > size_t maxvcpus, > @@ -1184,7 +1184,7 @@ int qemuMonitorNBDServerAdd(qemuMonitor *mon, > const char *export, > bool writable, > const char *bitmap); > -int qemuMonitorNBDServerStop(qemuMonitor *); > +int qemuMonitorNBDServerStop(qemuMonitor *mon); > > int qemuMonitorBlockExportAdd(qemuMonitor *mon, > virJSONValue **props);

1 0

Re: [PATCH] conf: check vhost-user queues with vcpus
by Jiang Jiacheng 24 Dec '22

24 Dec '22

Ping... On 2022/12/8 20:49, Jiang Jiacheng wrote: > With kernel without the ref patch, if queues > vcpus, interrupts > will be centralized on one vcpu affecting guest performance. After > the ref patch merged, the queues whose number is greater than the > number of vcpus will not be used. > > Considering the above, it's better to check the counts of vhost-user > queues and vcpus. > > ref: > https://patchwork.kernel.org/project/linux-scsi/cover/1553682995-5682-1-git… > > Signed-off-by: Jiang Jiacheng <jiangjiacheng(a)huawei.com> > --- > src/conf/domain_validate.c | 10 ++++++++-- > 1 file changed, 8 insertions(+), 2 deletions(-) > > diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c > index 95b8d9b419..6106e79999 100644 > --- a/src/conf/domain_validate.c > +++ b/src/conf/domain_validate.c > @@ -308,7 +308,7 @@ virSecurityDeviceLabelDefValidate(virSecurityDeviceLabelDef **seclabels, > > > static int > -virDomainDiskVhostUserValidate(const virDomainDiskDef *disk) > +virDomainDiskVhostUserValidate(const virDomainDef *def, const virDomainDiskDef *disk) > { > if (disk->bus != VIR_DOMAIN_DISK_BUS_VIRTIO) { > virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", > @@ -465,6 +465,12 @@ virDomainDiskVhostUserValidate(const virDomainDiskDef *disk) > return -1; > } > > + if (disk->queues > virDomainDefGetVcpus(def)) { > + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", > + _("vhost-user disk queues must <= vcpus")); > + return -1; > + } > + > return 0; > } > > @@ -807,7 +813,7 @@ virDomainDiskDefValidate(const virDomainDef *def, > } > > if (disk->src->type == VIR_STORAGE_TYPE_VHOST_USER && > - virDomainDiskVhostUserValidate(disk) < 0) { > + virDomainDiskVhostUserValidate(def, disk) < 0) { > return -1; > } >

1 0

[PATCH V3 0/7] qemu: support updating device's bootindex
by Jiang Jiacheng 24 Dec '22

24 Dec '22

Support updating device's(support cdrom, disk and network) bootindex online in virDomainUpdateDeviceFlags. The new bootindex will take effect after guest rebooting. Enable bootindex can be set to 0, it means cancel the device's bootindex. To use this feature, we need to get the device's xml first and modify the boot order in the xml, then use 'virsh update-device <domain> <xml> --flag' to update the bootindex. Note that the flag should be --config or --persistent if the vm is running. Jiang Jiacheng (7): qemu: Introduce qemuDomainChangeBootIndex to update device's bootindex qemu: Marking a device's bootindex can be changed qemu: check the bootIndex could be changed or not qemu: Support update disk's bootindex qemu: Support update net's bootindex qemu: Support set bootindex to 0 to cancel bootindex setting test: add a test for bootIndex = 0 provided by the user diff to v2: * improve function description and commit message * move functions in qemu_conf.c to qemu_domain.c * add a test for bootindex = 0 provided by user * fix a bug in logical of checking bootindex src/conf/device_conf.h | 3 + src/conf/domain_conf.c | 10 ++- src/conf/domain_postparse.c | 8 ++- src/conf/schemas/domaincommon.rng | 2 +- src/qemu/qemu_conf.c | 41 +++++++++++ src/qemu/qemu_conf.h | 5 ++ src/qemu/qemu_domain.c | 69 +++++++++++++++++- src/qemu/qemu_domain.h | 9 +++ src/qemu/qemu_driver.c | 32 +++++++++ src/qemu/qemu_hotplug.c | 17 +++-- src/qemu/qemu_monitor.c | 12 ++++ src/qemu/qemu_monitor.h | 6 ++ src/qemu/qemu_monitor_json.c | 22 ++++++ src/qemu/qemu_monitor_json.h | 6 ++ tests/qemuxml2argvdata/boot-order-set-0.xml | 72 +++++++++++++++++++ tests/qemuxml2xmloutdata/boot-order-set-0.xml | 72 +++++++++++++++++++ tests/qemuxml2xmltest.c | 1 + 17 files changed, 376 insertions(+), 11 deletions(-) create mode 100644 tests/qemuxml2argvdata/boot-order-set-0.xml create mode 100644 tests/qemuxml2xmloutdata/boot-order-set-0.xml -- 2.33.0

1 7

[PATCH] qemu: implement QEMU NBD source reconnect delay attribute
by Christian Nautze 23 Dec '22

23 Dec '22

Currently it's only possible to set this parameter during domain creation via QEMU commandline passthrough feature. With the new delay attribute it's also possible to set this parameter if you want to attach a new NBD disk using "virsh attach-device domain device.xml" e.g.: <disk type='network' device='disk'> <driver name='qemu' type='raw'/> <source protocol='nbd' name='foo'> <host name='example.org' port='6000'/> <reconnect enabled='yes' delay='10'/> </source> <target dev='vdb' bus='virtio'/> </disk> Signed-off-by: Christian Nautze <christian.nautze(a)exoscale.ch> --- docs/formatdomain.rst | 10 ++++++-- src/conf/domain_conf.c | 19 +++++++++++++++ src/conf/schemas/domaincommon.rng | 3 +++ src/conf/schemas/storagecommon.rng | 5 ++++ src/conf/storage_source_conf.c | 1 + src/conf/storage_source_conf.h | 4 ++++ src/qemu/qemu_block.c | 4 +++- src/qemu/qemu_domain.c | 9 ++++++++ .../disk-network-nbd.x86_64-latest.args | 23 +++++++++++-------- tests/qemuxml2argvdata/disk-network-nbd.xml | 8 +++++++ tests/qemuxml2xmloutdata/disk-network-nbd.xml | 9 ++++++++ 11 files changed, 82 insertions(+), 13 deletions(-) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index d7fffc6e0b..3fbeba644a 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -2938,13 +2938,19 @@ paravirtualized driver is specified via the ``disk`` element. are intended to be default, then the entire element may be omitted. ``reconnect`` For disk type ``vhostuser`` configures reconnect timeout if the connection - is lost. It has two mandatory attributes: + is lost. This is set with the two mandatory attributes ``enabled`` and + ``timeout``. For disk type ``network`` and protocol ``nbd`` the QEMU NBD + reconnect delay can be set via the mandatory attributes ``enabled`` + and ``delay``: ``enabled`` If the reconnect feature is enabled, accepts ``yes`` and ``no`` ``timeout`` The amount of seconds after which hypervisor tries to reconnect. - + ``delay`` + The amount of seconds during which all requests are paused and will be rerun + after a successful reconnect. After that time, any delayed requests and all + future requests before a successful reconnect will immediately fail. For a "file" or "volume" disk type which represents a cdrom or floppy (the ``device`` attribute), it is possible to define policy what to do with the diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 6c088ff295..909c78ef28 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -7024,6 +7024,22 @@ virDomainDiskSourceNetworkParse(xmlNodePtr node, src->tlsFromConfig = !!value; } + if (src->protocol == VIR_STORAGE_NET_PROTOCOL_NBD) { + xmlNodePtr cur; + if ((cur = virXPathNode("./reconnect", ctxt))) { + virTristateBool enabled; + if (virXMLPropTristateBool(cur, "enabled", VIR_XML_PROP_NONE, + &enabled) < 0) + return -1; + + if (enabled == VIR_TRISTATE_BOOL_YES) { + if (virXMLPropUInt(cur, "delay", 10, VIR_XML_PROP_REQUIRED, + &src->reconnectDelay) < 0) + return -1; + } + } + } + /* for historical reasons we store the volume and image name in one XML * element although it complicates thing when attempting to access them. */ if (src->path && @@ -21729,6 +21745,9 @@ virDomainDiskSourceFormatNetwork(virBuffer *attrBuf, virBufferAddLit(childBuf, "/>\n"); } + if (src->reconnectDelay) { + virBufferAsprintf(childBuf, "<reconnect enabled='yes' delay='%u'/>\n", src->reconnectDelay); + } virBufferEscapeString(childBuf, "<snapshot name='%s'/>\n", src->snapshot); virBufferEscapeString(childBuf, "<config file='%s'/>\n", src->configFile); diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng index c588a48fd2..72587416fe 100644 --- a/src/conf/schemas/domaincommon.rng +++ b/src/conf/schemas/domaincommon.rng @@ -2184,6 +2184,9 @@ </optional> <ref name="diskSourceCommon"/> <ref name="diskSourceNetworkHost"/> + <optional> + <ref name="reconnect"/> + </optional> <optional> <ref name="encryption"/> </optional> diff --git a/src/conf/schemas/storagecommon.rng b/src/conf/schemas/storagecommon.rng index 76714c9aad..2842376e78 100644 --- a/src/conf/schemas/storagecommon.rng +++ b/src/conf/schemas/storagecommon.rng @@ -61,6 +61,11 @@ <ref name="unsignedInt"/> </attribute> </optional> + <optional> + <attribute name="delay"> + <ref name="unsignedInt"/> + </attribute> + </optional> </element> </define> diff --git a/src/conf/storage_source_conf.c b/src/conf/storage_source_conf.c index 2b4cf5e241..edfd17c77c 100644 --- a/src/conf/storage_source_conf.c +++ b/src/conf/storage_source_conf.c @@ -810,6 +810,7 @@ virStorageSourceCopy(const virStorageSource *src, def->sslverify = src->sslverify; def->readahead = src->readahead; def->timeout = src->timeout; + def->reconnectDelay = src->reconnectDelay; def->metadataCacheMaxSize = src->metadataCacheMaxSize; /* storage driver metadata are not copied */ diff --git a/src/conf/storage_source_conf.h b/src/conf/storage_source_conf.h index f2440cec6a..b60a4b3346 100644 --- a/src/conf/storage_source_conf.h +++ b/src/conf/storage_source_conf.h @@ -290,6 +290,10 @@ struct _virStorageSource { unsigned long long readahead; /* size of the readahead buffer in bytes */ unsigned long long timeout; /* connection timeout in seconds */ + /* NBD QEMU reconnect-delay option, + * 0 as default value */ + unsigned int reconnectDelay; + virStorageSourceNVMeDef *nvme; /* type == VIR_STORAGE_TYPE_NVME */ virDomainChrSourceDef *vhostuser; /* type == VIR_STORAGE_TYPE_VHOST_USER */ diff --git a/src/qemu/qemu_block.c b/src/qemu/qemu_block.c index 8a6f601b29..6913c380a0 100644 --- a/src/qemu/qemu_block.c +++ b/src/qemu/qemu_block.c @@ -530,6 +530,7 @@ qemuBlockStorageSourceGetNBDProps(virStorageSource *src, "S:export", src->path, "S:tls-creds", tlsAlias, "S:tls-hostname", tlsHostname, + "p:reconnect-delay", src->reconnectDelay, NULL) < 0) return NULL; @@ -1817,7 +1818,8 @@ qemuBlockGetBackingStoreString(virStorageSource *src, src->ncookies == 0 && src->sslverify == VIR_TRISTATE_BOOL_ABSENT && src->timeout == 0 && - src->readahead == 0) { + src->readahead == 0 && + src->reconnectDelay == 0) { switch ((virStorageNetProtocol) src->protocol) { case VIR_STORAGE_NET_PROTOCOL_NBD: diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 5c05032ce3..840d857f78 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -4927,6 +4927,15 @@ qemuDomainValidateStorageSource(virStorageSource *src, } } + if (src->reconnectDelay > 0) { + if (actualType != VIR_STORAGE_TYPE_NETWORK || + src->protocol != VIR_STORAGE_NET_PROTOCOL_NBD) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("reconnect delay is supported only with NBD protocol")); + return -1; + } + } + if (src->query && (actualType != VIR_STORAGE_TYPE_NETWORK || (src->protocol != VIR_STORAGE_NET_PROTOCOL_HTTPS && diff --git a/tests/qemuxml2argvdata/disk-network-nbd.x86_64-latest.args b/tests/qemuxml2argvdata/disk-network-nbd.x86_64-latest.args index 21e619af3e..e8d13b0bd4 100644 --- a/tests/qemuxml2argvdata/disk-network-nbd.x86_64-latest.args +++ b/tests/qemuxml2argvdata/disk-network-nbd.x86_64-latest.args @@ -28,21 +28,24 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \ -no-acpi \ -boot strict=on \ -device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \ --blockdev '{"driver":"nbd","server":{"type":"inet","host":"example.org","port":"6000"},"node-name":"libvirt-5-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"nbd","server":{"type":"inet","host":"example.org","port":"6000"},"node-name":"libvirt-6-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"node-name":"libvirt-6-format","read-only":false,"driver":"raw","file":"libvirt-6-storage"}' \ +-device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x2","drive":"libvirt-6-format","id":"virtio-disk0","bootindex":1}' \ +-blockdev '{"driver":"nbd","server":{"type":"inet","host":"example.org","port":"6000"},"export":"bar","node-name":"libvirt-5-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-5-format","read-only":false,"driver":"raw","file":"libvirt-5-storage"}' \ --device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x2","drive":"libvirt-5-format","id":"virtio-disk0","bootindex":1}' \ --blockdev '{"driver":"nbd","server":{"type":"inet","host":"example.org","port":"6000"},"export":"bar","node-name":"libvirt-4-storage","auto-read-only":true,"discard":"unmap"}' \ +-device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x3","drive":"libvirt-5-format","id":"virtio-disk1"}' \ +-blockdev '{"driver":"nbd","server":{"type":"inet","host":"::1","port":"6000"},"node-name":"libvirt-4-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-4-format","read-only":false,"driver":"raw","file":"libvirt-4-storage"}' \ --device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x3","drive":"libvirt-4-format","id":"virtio-disk1"}' \ --blockdev '{"driver":"nbd","server":{"type":"inet","host":"::1","port":"6000"},"node-name":"libvirt-3-storage","auto-read-only":true,"discard":"unmap"}' \ +-device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x4","drive":"libvirt-4-format","id":"virtio-disk2"}' \ +-blockdev '{"driver":"nbd","server":{"type":"inet","host":"::1","port":"6000"},"export":"bar","node-name":"libvirt-3-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-3-format","read-only":false,"driver":"raw","file":"libvirt-3-storage"}' \ --device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x4","drive":"libvirt-3-format","id":"virtio-disk2"}' \ --blockdev '{"driver":"nbd","server":{"type":"inet","host":"::1","port":"6000"},"export":"bar","node-name":"libvirt-2-storage","auto-read-only":true,"discard":"unmap"}' \ +-device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x5","drive":"libvirt-3-format","id":"virtio-disk3"}' \ +-blockdev '{"driver":"nbd","server":{"type":"unix","path":"/var/run/nbdsock"},"export":"bar","node-name":"libvirt-2-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-2-format","read-only":false,"driver":"raw","file":"libvirt-2-storage"}' \ --device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x5","drive":"libvirt-2-format","id":"virtio-disk3"}' \ --blockdev '{"driver":"nbd","server":{"type":"unix","path":"/var/run/nbdsock"},"export":"bar","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \ +-device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x6","drive":"libvirt-2-format","id":"virtio-disk4"}' \ +-blockdev '{"driver":"nbd","server":{"type":"inet","host":"example.org","port":"6000"},"export":"foo","reconnect-delay":10,"node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \ -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \ --device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x6","drive":"libvirt-1-format","id":"virtio-disk4"}' \ +-device '{"driver":"virtio-blk-pci","bus":"pci.0","addr":"0x7","drive":"libvirt-1-format","id":"virtio-disk5"}' \ -audiodev '{"id":"audio1","driver":"none"}' \ -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ -msg timestamp=on diff --git a/tests/qemuxml2argvdata/disk-network-nbd.xml b/tests/qemuxml2argvdata/disk-network-nbd.xml index 8ac6cc3b7b..243ffeb1ed 100644 --- a/tests/qemuxml2argvdata/disk-network-nbd.xml +++ b/tests/qemuxml2argvdata/disk-network-nbd.xml @@ -49,6 +49,14 @@ </source> <target dev='vde' bus='virtio'/> </disk> + <disk type='network' device='disk'> + <driver name='qemu' type='raw'/> + <source protocol='nbd' name='foo'> + <host name='example.org' port='6000'/> + <reconnect enabled='yes' delay='10'/> + </source> + <target dev='vdf' bus='virtio'/> + </disk> <controller type='usb' index='0'/> <controller type='ide' index='0'/> <controller type='pci' index='0' model='pci-root'/> diff --git a/tests/qemuxml2xmloutdata/disk-network-nbd.xml b/tests/qemuxml2xmloutdata/disk-network-nbd.xml index f8dcca4bab..ed0c760d5b 100644 --- a/tests/qemuxml2xmloutdata/disk-network-nbd.xml +++ b/tests/qemuxml2xmloutdata/disk-network-nbd.xml @@ -54,6 +54,15 @@ <target dev='vde' bus='virtio'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> </disk> + <disk type='network' device='disk'> + <driver name='qemu' type='raw'/> + <source protocol='nbd' name='foo'> + <host name='example.org' port='6000'/> + <reconnect enabled='yes' delay='10'/> + </source> + <target dev='vdf' bus='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </disk> <controller type='usb' index='0'> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> </controller> -- 2.34.1

1 0

[PATCH] qemumonitortestutils: Fix line counting in qemuMonitorTestProcessFileEntries()
by Michal Privoznik 23 Dec '22

23 Dec '22

It just so happens that our JSON snippets in qemucapabilitiesdata/*.replies files are separated by an empty line. These empty lines are then overwritten to make a single line JSON. Nevertheless, the line counter @line is not incremented which then leads to a misleading numbers in errors: Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tests/qemumonitortestutils.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/qemumonitortestutils.c b/tests/qemumonitortestutils.c index 46791931b0..4e99c4b54e 100644 --- a/tests/qemumonitortestutils.c +++ b/tests/qemumonitortestutils.c @@ -1302,6 +1302,9 @@ qemuMonitorTestProcessFileEntries(char *inputstr, continue; } + /* We've seen a new line, increment the counter */ + line++; + /* Cut off a single reply. */ *(tmp + 1) = '\0'; -- 2.38.2

2 1

[PATCH 0/3] Introduce and use virDirOpenSorted()
by Michal Privoznik 23 Dec '22

23 Dec '22

Whiles working on Hyper-V patches I've posted yesterday I ran domaincapstest occasionally and was puzzled for a moment that qemu-7.2.0 wasn't tested. Well it is, but it's harder to see immediately because individual test cases are in 'random' order: 11) qemu_7.2.0.x86_64 ... OK .... 46) qemu_5.1.0.sparc ... OK 47) qemu_6.1.0.x86_64 ... OK 48) qemu_6.1.0-q35.x86_64 ... OK 49) qemu_6.1.0-tcg.x86_64 ... OK 50) qemu_7.0.0.ppc64 ... OK 51) qemu_6.2.0.x86_64 ... OK 52) qemu_6.2.0-q35.x86_64 ... OK 53) qemu_6.2.0-tcg.x86_64 ... OK Huge thanks to Martin, who helped me realize (in 2/3) that 'struct dirent' while declared as 'char d_name[256]' is rather peculiar and a little dance is needed to copy it properly. Michal Prívozník (3): util: Introduce a wrapper struct around DIR util: Introduce virDirOpenSorted() tests: Use virDirOpenSorted() build-aux/syntax-check.mk | 2 +- src/bhyve/bhyve_capabilities.c | 2 +- src/bhyve/bhyve_firmware.c | 2 +- src/conf/capabilities.c | 8 +- src/conf/virdomainobjlist.c | 2 +- src/conf/virnetworkobj.c | 8 +- src/conf/virnwfilterbindingobjlist.c | 2 +- src/conf/virnwfilterobj.c | 2 +- src/conf/virsecretobj.c | 2 +- src/conf/virstorageobj.c | 4 +- src/libvirt_private.syms | 1 + src/node_device/node_device_udev.c | 2 +- src/openvz/openvz_conf.c | 2 +- src/qemu/qemu_domain.c | 2 +- src/qemu/qemu_driver.c | 4 +- src/qemu/qemu_interop_config.c | 2 +- src/security/security_selinux.c | 4 +- src/storage/storage_backend_iscsi.c | 2 +- src/storage/storage_util.c | 10 +- src/util/vircgroup.c | 4 +- src/util/vircgroupv1.c | 2 +- src/util/vircommand.c | 2 +- src/util/virdevmapper.c | 2 +- src/util/virfile.c | 146 ++++++++++++++++++++++----- src/util/virfile.h | 16 +-- src/util/virhook.c | 4 +- src/util/virhostcpu.c | 6 +- src/util/virmdev.c | 4 +- src/util/virnetdev.c | 2 +- src/util/virnuma.c | 2 +- src/util/virpci.c | 8 +- src/util/virprocess.c | 2 +- src/util/virresctrl.c | 8 +- src/util/virscsi.c | 4 +- src/util/virscsihost.c | 2 +- src/util/virusb.c | 2 +- src/util/virutil.c | 4 +- src/util/virvhba.c | 6 +- tests/testutilsqemu.c | 8 +- tests/virschematest.c | 4 +- tools/virt-host-validate-common.c | 2 +- 41 files changed, 201 insertions(+), 102 deletions(-) -- 2.38.2

2 4

[PATCH] virQEMUDriverGetDomainCapabilities: Validate machine type
by Michal Privoznik 22 Dec '22

22 Dec '22

When calling virConnectGetDomainCapabilities() (exposed as virsh domcapabilities) users have option to specify whatever sub-set of { emulatorbin, arch, machine, virttype } they want. Then we have a logic (hidden in virQEMUCapsCacheLookupDefault()) that picks qemuCaps that satisfy values passed by user. And whatever was not specified is then set to the default value as specified by picked qemuCaps. For instance: if no machine type was provided but emulatorbin was, then the machine type is set to the default one as defined by the emulatorbin. Or, when just virttype was set then the remaining three values are set to their respective defaults. Except, we have a crasher in this case: # virsh domcapabilities --virttype hvf error: Disconnected from qemu:///system due to end of file error: failed to get emulator capabilities error: End of file while reading data: Input/output error This is because for 'hvf' virttype (at least my) QEMU does not have any machine type. Therefore, @machine is set to NULL and the rest of the code does not expect that. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_conf.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index ae5bbcd138..cbd339f594 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -1454,6 +1454,13 @@ virQEMUDriverGetDomainCapabilities(virQEMUDriver *driver, g_autoptr(virDomainCaps) domCaps = NULL; const char *path = virQEMUCapsGetBinary(qemuCaps); + if (!virQEMUCapsIsMachineSupported(qemuCaps, virttype, machine)) { + virReportError(VIR_ERR_INVALID_ARG, + _("the machine '%s' is not supported by emulator '%s'"), + NULLSTR(machine), path); + return NULL; + } + if (!(domCaps = virDomainCapsNew(path, machine, arch, virttype))) return NULL; -- 2.38.2

2 1

[PATCH v2] MIPS: remove support for trap and emulate KVM
by Philippe Mathieu-Daudé 22 Dec '22

22 Dec '22

From: Paolo Bonzini <pbonzini(a)redhat.com> This support was limited to the Malta board, drop it. I do not have a machine that can run VZ KVM, so I am assuming that it works for -M malta as well. Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd(a)linaro.org> --- Since Paolo's v1: - Remove cpu_mips_kvm_um_phys_to_kseg0() declaration in "cpu.h" - Remove unused KVM_KSEG0_BASE/KVM_KSEG2_BASE definitions - Use USEG_LIMIT/KSEG0_BASE instead of magic values /* Check where the kernel has been linked */ - if (!(kernel_entry & 0x80000000ll)) { - error_report("CONFIG_KVM_GUEST kernels are not supported"); + if (kernel_entry <= USEG_LIMIT) { + error_report("Trap-and-Emul kernels (Linux CONFIG_KVM_GUEST)" + " are not supported"); - env->CP0_EBase = (cs->cpu_index & 0x3FF) | (int32_t)0x80000000; + env->CP0_EBase = KSEG0_BASE | (cs->cpu_index & 0x3FF); --- docs/about/deprecated.rst | 9 ------- docs/about/removed-features.rst | 9 +++++++ hw/mips/malta.c | 46 +++++---------------------------- target/mips/cpu.c | 7 +---- target/mips/cpu.h | 3 --- target/mips/internal.h | 3 --- target/mips/kvm.c | 11 +------- target/mips/sysemu/addr.c | 17 ------------ target/mips/sysemu/physaddr.c | 13 ---------- 9 files changed, 18 insertions(+), 100 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 93affe3669..b28f50b22f 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -199,15 +199,6 @@ deprecated. Use ``sections`` instead. Member ``section-size`` in return value elements with meta-type ``uint64`` is deprecated. Use ``sections`` instead. -System accelerators -------------------- - -MIPS ``Trap-and-Emul`` KVM support (since 6.0) -'''''''''''''''''''''''''''''''''''''''''''''' - -The MIPS ``Trap-and-Emul`` KVM host and guest support has been removed -from Linux upstream kernel, declare it deprecated. - Host Architectures ------------------ diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst index 63df9848fd..22b4b5d128 100644 --- a/docs/about/removed-features.rst +++ b/docs/about/removed-features.rst @@ -617,6 +617,15 @@ x86 ``Icelake-Client`` CPU (removed in 7.1) There isn't ever Icelake Client CPU, it is some wrong and imaginary one. Use ``Icelake-Server`` instead. +System accelerators +------------------- + +MIPS "Trap-and-Emulate" KVM support (removed in 8.0) +'''''''''''''''''''''''''''''''''''''''''''''''''''' + +The MIPS "Trap-and-Emulate" KVM host and guest support was removed +from Linux in 2021, and is not supported anymore by QEMU either. + System emulator machines ------------------------ diff --git a/hw/mips/malta.c b/hw/mips/malta.c index e5050ecd3c..fed8b65f1e 100644 --- a/hw/mips/malta.c +++ b/hw/mips/malta.c @@ -58,6 +58,7 @@ #include "semihosting/semihost.h" #include "hw/mips/cps.h" #include "hw/qdev-clock.h" +#include "target/mips/internal.h" #define ENVP_PADDR 0x2000 #define ENVP_VADDR cpu_mips_phys_to_kseg0(NULL, ENVP_PADDR) @@ -870,7 +871,6 @@ static uint64_t load_kernel(void) uint32_t *prom_buf; long prom_size; int prom_index = 0; - uint64_t (*xlate_to_kseg0) (void *opaque, uint64_t addr); uint8_t rng_seed[32]; char rng_seed_hex[sizeof(rng_seed) * 2 + 1]; size_t rng_seed_prom_offset; @@ -894,19 +894,10 @@ static uint64_t load_kernel(void) } /* Check where the kernel has been linked */ - if (kernel_entry & 0x80000000ll) { - if (kvm_enabled()) { - error_report("KVM guest kernels must be linked in useg. " - "Did you forget to enable CONFIG_KVM_GUEST?"); - exit(1); - } - - xlate_to_kseg0 = cpu_mips_phys_to_kseg0; - } else { - /* if kernel entry is in useg it is probably a KVM T&E kernel */ - mips_um_ksegs_enable(); - - xlate_to_kseg0 = cpu_mips_kvm_um_phys_to_kseg0; + if (kernel_entry <= USEG_LIMIT) { + error_report("Trap-and-Emul kernels (Linux CONFIG_KVM_GUEST)" + " are not supported"); + exit(1); } /* load initrd */ @@ -947,7 +938,7 @@ static uint64_t load_kernel(void) if (initrd_size > 0) { prom_set(prom_buf, prom_index++, "rd_start=0x%" PRIx64 " rd_size=%" PRId64 " %s", - xlate_to_kseg0(NULL, initrd_offset), + cpu_mips_phys_to_kseg0(NULL, initrd_offset), initrd_size, loaderparams.kernel_cmdline); } else { prom_set(prom_buf, prom_index++, "%s", loaderparams.kernel_cmdline); @@ -1039,11 +1030,6 @@ static void main_cpu_reset(void *opaque) } malta_mips_config(cpu); - - if (kvm_enabled()) { - /* Start running from the bootloader we wrote to end of RAM */ - env->active_tc.PC = 0x40000000 + loaderparams.ram_low_size; - } } static void create_cpu_without_cps(MachineState *ms, MaltaState *s, @@ -1177,13 +1163,7 @@ void mips_malta_init(MachineState *machine) fl_idx++; if (kernel_filename) { ram_low_size = MIN(ram_size, 256 * MiB); - /* For KVM we reserve 1MB of RAM for running bootloader */ - if (kvm_enabled()) { - ram_low_size -= 0x100000; - bootloader_run_addr = cpu_mips_kvm_um_phys_to_kseg0(NULL, ram_low_size); - } else { - bootloader_run_addr = cpu_mips_phys_to_kseg0(NULL, RESET_ADDRESS); - } + bootloader_run_addr = cpu_mips_phys_to_kseg0(NULL, RESET_ADDRESS); /* Write a small bootloader to the flash location. */ loaderparams.ram_size = ram_size; @@ -1200,20 +1180,8 @@ void mips_malta_init(MachineState *machine) write_bootloader_nanomips(memory_region_get_ram_ptr(bios), bootloader_run_addr, kernel_entry); } - if (kvm_enabled()) { - /* Write the bootloader code @ the end of RAM, 1MB reserved */ - write_bootloader(memory_region_get_ram_ptr(ram_low_preio) + - ram_low_size, - bootloader_run_addr, kernel_entry); - } } else { target_long bios_size = FLASH_SIZE; - /* The flash region isn't executable from a KVM guest */ - if (kvm_enabled()) { - error_report("KVM enabled but no -kernel argument was specified. " - "Booting from flash is not supported with KVM."); - exit(1); - } /* Load firmware from flash. */ if (!dinfo) { /* Load a BIOS image. */ diff --git a/target/mips/cpu.c b/target/mips/cpu.c index 17bbcbf5ff..f8c8e0ba39 100644 --- a/target/mips/cpu.c +++ b/target/mips/cpu.c @@ -291,12 +291,7 @@ static void mips_cpu_reset_hold(Object *obj) env->tlb->tlb_in_use = env->tlb->nb_tlb; env->CP0_Wired = 0; env->CP0_GlobalNumber = (cs->cpu_index & 0xFF) << CP0GN_VPId; - env->CP0_EBase = (cs->cpu_index & 0x3FF); - if (mips_um_ksegs_enabled()) { - env->CP0_EBase |= 0x40000000; - } else { - env->CP0_EBase |= (int32_t)0x80000000; - } + env->CP0_EBase = KSEG0_BASE | (cs->cpu_index & 0x3FF); if (env->CP0_Config3 & (1 << CP0C3_CMGCR)) { env->CP0_CMGCRBase = 0x1fbf8000 >> 4; } diff --git a/target/mips/cpu.h b/target/mips/cpu.h index 0a085643a3..caf2b06911 100644 --- a/target/mips/cpu.h +++ b/target/mips/cpu.h @@ -1296,11 +1296,8 @@ void cpu_set_exception_base(int vp_index, target_ulong address); uint64_t cpu_mips_kseg0_to_phys(void *opaque, uint64_t addr); uint64_t cpu_mips_phys_to_kseg0(void *opaque, uint64_t addr); -uint64_t cpu_mips_kvm_um_phys_to_kseg0(void *opaque, uint64_t addr); uint64_t cpu_mips_kseg1_to_phys(void *opaque, uint64_t addr); uint64_t cpu_mips_phys_to_kseg1(void *opaque, uint64_t addr); -bool mips_um_ksegs_enabled(void); -void mips_um_ksegs_enable(void); #if !defined(CONFIG_USER_ONLY) diff --git a/target/mips/internal.h b/target/mips/internal.h index 57b312689a..4b0031d10d 100644 --- a/target/mips/internal.h +++ b/target/mips/internal.h @@ -99,9 +99,6 @@ int mips_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg); #define KSEG2_BASE ((target_ulong)(int32_t)0xC0000000UL) #define KSEG3_BASE ((target_ulong)(int32_t)0xE0000000UL) -#define KVM_KSEG0_BASE ((target_ulong)(int32_t)0x40000000UL) -#define KVM_KSEG2_BASE ((target_ulong)(int32_t)0x60000000UL) - #if !defined(CONFIG_USER_ONLY) enum { diff --git a/target/mips/kvm.c b/target/mips/kvm.c index bcb8e06b2c..c14e8f550f 100644 --- a/target/mips/kvm.c +++ b/target/mips/kvm.c @@ -1268,25 +1268,16 @@ int kvm_arch_msi_data_to_gsi(uint32_t data) int mips_kvm_type(MachineState *machine, const char *vm_type) { -#if defined(KVM_CAP_MIPS_VZ) || defined(KVM_CAP_MIPS_TE) +#if defined(KVM_CAP_MIPS_VZ) int r; KVMState *s = KVM_STATE(machine->accelerator); -#endif -#if defined(KVM_CAP_MIPS_VZ) r = kvm_check_extension(s, KVM_CAP_MIPS_VZ); if (r > 0) { return KVM_VM_MIPS_VZ; } #endif -#if defined(KVM_CAP_MIPS_TE) - r = kvm_check_extension(s, KVM_CAP_MIPS_TE); - if (r > 0) { - return KVM_VM_MIPS_TE; - } -#endif - return -1; } diff --git a/target/mips/sysemu/addr.c b/target/mips/sysemu/addr.c index 86f1c129c9..4f025be44a 100644 --- a/target/mips/sysemu/addr.c +++ b/target/mips/sysemu/addr.c @@ -23,8 +23,6 @@ #include "qemu/osdep.h" #include "cpu.h" -static int mips_um_ksegs; - uint64_t cpu_mips_kseg0_to_phys(void *opaque, uint64_t addr) { return addr & 0x1fffffffll; @@ -35,11 +33,6 @@ uint64_t cpu_mips_phys_to_kseg0(void *opaque, uint64_t addr) return addr | ~0x7fffffffll; } -uint64_t cpu_mips_kvm_um_phys_to_kseg0(void *opaque, uint64_t addr) -{ - return addr | 0x40000000ll; -} - uint64_t cpu_mips_kseg1_to_phys(void *opaque, uint64_t addr) { return addr & 0x1fffffffll; @@ -49,13 +42,3 @@ uint64_t cpu_mips_phys_to_kseg1(void *opaque, uint64_t addr) { return (addr & 0x1fffffffll) | 0xffffffffa0000000ll; } - -bool mips_um_ksegs_enabled(void) -{ - return mips_um_ksegs; -} - -void mips_um_ksegs_enable(void) -{ - mips_um_ksegs = 1; -} diff --git a/target/mips/sysemu/physaddr.c b/target/mips/sysemu/physaddr.c index 1918633aa1..2970df8a09 100644 --- a/target/mips/sysemu/physaddr.c +++ b/target/mips/sysemu/physaddr.c @@ -130,19 +130,6 @@ int get_physical_address(CPUMIPSState *env, hwaddr *physical, /* effective address (modified for KVM T&E kernel segments) */ target_ulong address = real_address; - if (mips_um_ksegs_enabled()) { - /* KVM T&E adds guest kernel segments in useg */ - if (real_address >= KVM_KSEG0_BASE) { - if (real_address < KVM_KSEG2_BASE) { - /* kseg0 */ - address += KSEG0_BASE - KVM_KSEG0_BASE; - } else if (real_address <= USEG_LIMIT) { - /* kseg2/3 */ - address += KSEG2_BASE - KVM_KSEG2_BASE; - } - } - } - if (address <= USEG_LIMIT) { /* useg */ uint16_t segctl; -- 2.38.1

2 2

[PATCH v2 1/2] libxl: add validation if sound device is supported
by Marek Marczykowski-Górecki 21 Dec '22

21 Dec '22

Xen supports only subset of libvirt's sound devices, and starting with Xen 4.17 it is enforced by libxl. Verify it early. Signed-off-by: Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com> --- src/libxl/libxl_domain.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/src/libxl/libxl_domain.c b/src/libxl/libxl_domain.c index 2d53250895..6507e34469 100644 --- a/src/libxl/libxl_domain.c +++ b/src/libxl/libxl_domain.c @@ -312,6 +312,27 @@ libxlDomainDefValidate(const virDomainDef *def, return -1; } + if (def->nsounds > 0) { + virDomainSoundDef *snd = def->sounds[0]; + switch (snd->model) { + case VIR_DOMAIN_SOUND_MODEL_ICH6: + case VIR_DOMAIN_SOUND_MODEL_ES1370: + case VIR_DOMAIN_SOUND_MODEL_AC97: + case VIR_DOMAIN_SOUND_MODEL_SB16: + break; + default: + case VIR_DOMAIN_SOUND_MODEL_PCSPK: + case VIR_DOMAIN_SOUND_MODEL_ICH7: + case VIR_DOMAIN_SOUND_MODEL_USB: + case VIR_DOMAIN_SOUND_MODEL_ICH9: + case VIR_DOMAIN_SOUND_MODEL_LAST: + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("unsupported audio model %s"), + virDomainSoundModelTypeToString(snd->model)); + return -1; + } + } + return 0; } -- 2.37.3

2 3

[PATCH V3 00/11] spec: Decompose the daemon subpackage
by Jim Fehlig 21 Dec '22

21 Dec '22

This is V3 of https://listman.redhat.com/archives/libvir-list/2022-December/236337.html The end goal is to remove the libvirt-dameon dependency on the various libvirt-daemon-driver-foo subpackages, allowing installation of a modular daemon configuration without the traditional monolithic libvirtd. Changes from V2: * Move more files and dependencies to the libvirt-daemon-common package * Address many more review comments Jim Fehlig (11): spec: Move virtlockd to a new subpackage libvirt-daemon-lock spec: Move virtlogd to a new subpackage libvirt-daemon-log spec: Move virtproxyd to a new subpackage libvirt-daemon-proxy spec: Move lockd plugin to a new subpackage spec: Rename the libvirt-lock-sanlock subpackage spec: Move common files and dependencies to libvirt-daemon-common spec: Add module-init-tools dependency to nodedev and lxc drivers spec: Add numad dependency to qemu and lxc drivers spec: Remove libvirt-daemon dependency from drivers spec: Remove libvirt-daemon dependency from hypervisor subpackages kbase: Update rpm-deployment.rst with new subpackages docs/kbase/rpm-deployment.rst | 50 ++++-- libvirt.spec.in | 329 ++++++++++++++++++++++++---------- 2 files changed, 267 insertions(+), 112 deletions(-) -- 2.38.1

2 16

[PATCH] libxl: adjust 'ich6' sound card name
by Marek Marczykowski-Górecki 20 Dec '22

20 Dec '22

Xen 4.17 has strict parsing of 'soundhw' option that allows only specific values (instead of passing through any value directly to qemu's -soundhw option, it uses -device now). For 'intel-hda' audio device, it requires "hda" string. "hda" works with older libxl too. Other supported models are the same as in libvirt XML. Signed-off-by: Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com> --- src/libxl/libxl_conf.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/src/libxl/libxl_conf.c b/src/libxl/libxl_conf.c index d13e48abb2..b84257bc12 100644 --- a/src/libxl/libxl_conf.c +++ b/src/libxl/libxl_conf.c @@ -593,7 +593,26 @@ libxlMakeDomBuildInfo(virDomainDef *def, */ virDomainSoundDef *snd = def->sounds[0]; - b_info->u.hvm.soundhw = g_strdup(virDomainSoundModelTypeToString(snd->model)); + switch (snd->model) { + case VIR_DOMAIN_SOUND_MODEL_ICH6: + b_info->u.hvm.soundhw = g_strdup("hda"); + break; + case VIR_DOMAIN_SOUND_MODEL_ES1370: + case VIR_DOMAIN_SOUND_MODEL_AC97: + case VIR_DOMAIN_SOUND_MODEL_SB16: + b_info->u.hvm.soundhw = g_strdup(virDomainSoundModelTypeToString(snd->model)); + break; + default: + case VIR_DOMAIN_SOUND_MODEL_PCSPK: + case VIR_DOMAIN_SOUND_MODEL_ICH7: + case VIR_DOMAIN_SOUND_MODEL_USB: + case VIR_DOMAIN_SOUND_MODEL_ICH9: + case VIR_DOMAIN_SOUND_MODEL_LAST: + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("unsupported audio model %s"), + virDomainSoundModelTypeToString(snd->model)); + return -1; + } } for (i = 0; i < def->os.nBootDevs; i++) { -- 2.37.3

2 1

[PATCH 0/2] util: qemu: Perform the 'skipKey' handling only on the top level object
by Peter Krempa 20 Dec '22

20 Dec '22

Semantically we need to handle one of the keys in the top level object spearately, thus skipping it in nested objects doesn't make sense. Peter Krempa (2): virqemu: Don't strip the requested key from nested objects util: qemu: Remove 'skipKey' argument from virQEMUBuildCommandLineJSONArrayFormatFunc prototype src/util/virqemu.c | 21 +++++++++------------ src/util/virqemu.h | 12 ++++-------- 2 files changed, 13 insertions(+), 20 deletions(-) -- 2.38.1

2 3

[RFC PATCH 0/1] secret: Inhibit shutdown for ephemeral secrets
by Michal Privoznik 20 Dec '22

20 Dec '22

I'm kind of convinced that we want to do this, but also it's a significant change in the behaviour of the daemon, hence RFC prefix. This stemmed from a discussion with a user who wants us to use something more secure than base64 encoded secret values stored on a disk. They suggested storing the values in TPM and while that might sound like a good idea, I suggested using ephemeral secrets for the time being. Well, because of '--timeout 120', ephemeral secrets are short lived, indeed. Meanwhile, let me see if there's a library we could use to talk to TPM. Michal Prívozník (1): secret: Inhibit shutdown for ephemeral secrets src/secret/secret_driver.c | 35 +++++++++++++++++++++++++++++++++-- 1 file changed, 33 insertions(+), 2 deletions(-) -- 2.38.2

2 3

[PATCH V2 0/9] spec: Decompose the daemon subpackage
by Jim Fehlig 19 Dec '22

19 Dec '22

This is a V2 of: https://listman.redhat.com/archives/libvir-list/2022-December/236073.html Original RFC: https://listman.redhat.com/archives/libvir-list/2022-November/235924.html The end goal is to remove the libvirt-dameon dependency on the various libvirt-daemon-driver-foo subpackages, allowing installation of a modular daemon configuration without the traditional monolithic libvirtd. Change from V1: - Change name of new subpackage libvirt-daemon-client to libvirt-daemon-common - Rename the libvirt-lock-sanlock package to libvirt-daemon-plugin-sanlock - Update rpm-deployment kbase article - Misc review comments addressed Jim Fehlig (9): spec: Move virtlockd to a new subpackage libvirt-daemon-lock spec: Move virtlogd to a new subpackage libvirt-daemon-log spec: Move virtproxyd to a new subpackage libvirt-daemon-proxy spec: Move lockd plugin to a new subpackage spec: Rename the libvirt-lock-sanlock subpackage spec: Move common files to a new subpackage libvirt-daemon-common spec: Remove libvirt-daemon dependency from drivers spec: Remove libvirt-daemon dependency from hypervisor subpackages kbase: Update rpm-deployment.rst with new subpackages docs/kbase/rpm-deployment.rst | 38 ++++- libvirt.spec.in | 294 +++++++++++++++++++++++----------- 2 files changed, 235 insertions(+), 97 deletions(-) -- 2.38.1

3 35

Setting SELinux label on TPM state during migration
by Michal Prívozník 19 Dec '22

19 Dec '22

Stefan, as you saw, I'm trying to implement support for migration with TPM state on a shared volume. I mean, it is working when the shared volume is an NFS mount point because NFS does not really propagate SELinux labels, but rather has this 'virt_use_nfs' sebool which effectivelly allows all svirt_t processes to access NFS (thus including swtpm). But things get trickier when a distributed FS that knows SELinux properly (e.g. ceph) is used instead. What I am currently struggling with is - finding the sweet spot when the source swtpm has let go of the state and the destination has not accessed it (because if it did it would get EPERM). Bottom line - the SELinux label is generated dynamically on each guest startup (to ensure its uniqueness on the system). Therefore, the label on the destination is different to the one on the source. The behavior I'm seeing now is: 1) the source starts migration: {"execute":"migrate","arguments":{"detach":true,"resume":false,"uri":"fd:migrate"},"id":"libvirt-428"} 2) the destination does not touch the swtpm state right away, but when the TPM state comes in the migration stream, it is touched. Partial logs from the destination: -> {"execute":"migrate-incoming","arguments":{"uri":"tcp:[::]:49152"},"id":"libvirt-415"} <- {"timestamp": {"seconds": 1671449778, "microseconds": 500164}, "event": "MIGRATION", "data": {"status": "setup"}}] <- {"return": {}, "id": "libvirt-415"} <- {"timestamp": {"seconds": 1671449778, "microseconds": 732358}, "event": "MIGRATION", "data": {"status": "active"}} Now, before QEMU sends MIGRATION status:completed, I can see QEMU accessing the TPM state: Thread 1 "qemu-kvm" hit Breakpoint 1, tpm_emulator_set_state_blob (tpm_emu=0x5572af389cb0, type=1, tsb=0x5572af389db0, flags=0) at ../backends/tpm/tpm_emulator.c:796 796 { (gdb) bt #0 tpm_emulator_set_state_blob (tpm_emu=0x5572af389cb0, type=1, tsb=0x5572af389db0, flags=0) at ../backends/tpm/tpm_emulator.c:796 #1 0x00005572acf21fe5 in tpm_emulator_post_load (opaque=0x5572af389cb0, version_id=<optimized out>) at ../backends/tpm/tpm_emulator.c:868 #2 0x00005572acf25497 in vmstate_load_state (f=0x5572af512a10, vmsd=0x5572ad7743b8 <vmstate_tpm_emulator>, opaque=0x5572af389cb0, version_id=1) at ../migration/vmstate.c:162 #3 0x00005572acf45753 in qemu_loadvm_state_main (f=0x5572af512a10, mis=0x5572af39b4e0) at ../migration/savevm.c:876 #4 0x00005572acf47591 in qemu_loadvm_state (f=0x5572af512a10) at ../migration/savevm.c:2712 #5 0x00005572acf301f6 in process_incoming_migration_co (opaque=<optimized out>) at ../migration/migration.c:591 #6 0x00005572ad400976 in coroutine_trampoline (i0=<optimized out>, i1=<optimized out>) at ../util/coroutine-ucontext.c:177 #7 0x00007f64ca22a360 in ?? () from target:/lib64/libc.so.6 #8 0x00007f64c948cbc0 in ?? () #9 0x0000000000000000 in ?? () This in turn means that swtpm on the destination is going to CMD_INIT itself while the source is still using it. I wonder what we can do about this. Perhaps - postpone init until the time the vCPUs on the destination are resumed? That way libvirt on the source could restore labels (effectively cut the source swtpm process off the TPM state), then libvirtd on the destination could set the label and 'cont'. If 'cont' fails for whatever reason then the source libvirtd would just set the label on the TPM state and everything is back to normal. Corresponding BZ link: https://bugzilla.redhat.com/show_bug.cgi?id=2130192 Michal

3 2

Libvirt support for qemu reconnect flag
by Miguel Ping 19 Dec '22

19 Dec '22

Hello, Qemu has support for reconnect-delay parameter, that allows for the qemu nbd client to retry failed NBD operations. This is useful if you are running a custom NBD server and want to update the server without failing requests. Unfortunately, the only way to supply these flags is at domain creation via qemu commandline passthrough feature [1]; there is no way to supply them when eg hotpluggin a disk via eg: "virsh attach-device ..." Is there interest in libvirt for a patch that supports qemu "reconnect delay" param? What would be the best way to move forward with such a patch? I think the param can be supported in either the device definition (eg: the <reconnect enabled='yes' timeout='10'/> option already exists for disk type="vhostuser"), or globally via the qemu.conf configuration file. Thank you for your time [1] https://libvirt.org/kbase/qemu-passthrough-security.html#xml-document-addit…

1 0

[PATCH v2 0/3] More work on deprecation/removal of clear text passwords
by Daniel P. Berrangé 16 Dec '22

16 Dec '22

This deprecates the -iscsi clear text 'password' option and deletes the previously deprecated -spice 'password' option. Changed in v2: * Fixed section placement for iscsi deprecation docs * Fixed missing brackets in -iscsi help * Write in past tense for -spice password removal docs Daniel P. Berrangé (3): block: mention 'password-secret' option for -iscsi block: deprecate iSCSI 'password' in favour of 'password-secret' ui: remove deprecated 'password' option for SPICE block/iscsi.c | 3 +++ docs/about/deprecated.rst | 16 ++++++++-------- docs/about/removed-features.rst | 7 +++++++ qemu-options.hx | 13 +++---------- ui/spice-core.c | 15 --------------- 5 files changed, 21 insertions(+), 33 deletions(-) -- 2.38.1

2 6

[PATCH 0/3] More work on deprecation/removal of clear text passwords
by Daniel P. Berrangé 16 Dec '22

16 Dec '22

This deprecates the -iscsi clear text 'password' option and deletes the previously deprecated -spice 'password' option. Daniel P. Berrangé (3): block: mention 'password-secret' option for -iscsi block: deprecate iSCSI 'password' in favour of 'password-secret' ui: remove deprecated 'password' option for SPICE block/iscsi.c | 3 +++ docs/about/deprecated.rst | 19 +++++++++++-------- docs/about/removed-features.rst | 7 +++++++ qemu-options.hx | 11 ++--------- ui/spice-core.c | 15 --------------- 5 files changed, 23 insertions(+), 32 deletions(-) -- 2.38.1

3 7

[libvirt PATCHv2 0/2] add external backend for tpm
by Ján Tomko 16 Dec '22

16 Dec '22

v2: add more chardev-like attributes to the source https://bugzilla.redhat.com/show_bug.cgi?id=2063723 Ján Tomko (2): qemu: add external backend for tpm qemu: add tests for external swtpm src/conf/domain_audit.c | 11 +++++ src/conf/domain_conf.c | 35 ++++++++++++++++ src/conf/domain_conf.h | 4 ++ src/conf/domain_validate.c | 15 +++++++ src/conf/schemas/domaincommon.rng | 22 ++++++++++ src/qemu/qemu_capabilities.c | 4 +- src/qemu/qemu_cgroup.c | 1 + src/qemu/qemu_command.c | 11 ++++- src/qemu/qemu_domain.c | 4 ++ src/qemu/qemu_namespace.c | 1 + src/qemu/qemu_tpm.c | 2 + src/security/security_dac.c | 2 + src/security/security_selinux.c | 2 + .../domaincapsdata/qemu_4.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_4.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.0.0-tcg.x86_64.xml | 1 + .../qemu_5.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_5.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.2.0-tcg.x86_64.xml | 1 + .../qemu_5.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_5.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.0.0-tcg.x86_64.xml | 1 + .../qemu_6.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_6.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_6.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_6.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 1 + .../qemu_6.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 1 + .../qemu_7.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 1 + .../tpm-external.x86_64-latest.args | 36 +++++++++++++++++ tests/qemuxml2argvdata/tpm-external.xml | 40 +++++++++++++++++++ tests/qemuxml2argvtest.c | 1 + .../tpm-external.x86_64-latest.xml | 1 + tests/qemuxml2xmltest.c | 1 + 63 files changed, 236 insertions(+), 2 deletions(-) create mode 100644 tests/qemuxml2argvdata/tpm-external.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/tpm-external.xml create mode 120000 tests/qemuxml2xmloutdata/tpm-external.x86_64-latest.xml -- 2.38.1

2 4

[libvirt PATCH] qemu: tpm: fix spacing
by Ján Tomko 15 Dec '22

15 Dec '22

Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- Pushed as trivial src/qemu/qemu_tpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index 0939f64e4e..36d5beb202 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -213,7 +213,7 @@ qemuTPMEmulatorCreateStorage(virDomainTPMDef *tpm, static void qemuTPMEmulatorDeleteStorage(virDomainTPMDef *tpm) { - g_autofree char *path = g_path_get_dirname(tpm->data.emulator.storagepath); + g_autofree char *path = g_path_get_dirname(tpm->data.emulator.storagepath); ignore_value(virFileDeleteTree(path)); } -- 2.38.1

1 0

[libvirt PATCH 0/2] kbase: Reorder contents for rpm-deployment
by Andrea Bolognani 15 Dec '22

15 Dec '22

Andrea Bolognani (2): kbase: Reorder sections kbase: Reorder deployments docs/kbase/rpm-deployment.rst | 134 +++++++++++++++++----------------- 1 file changed, 67 insertions(+), 67 deletions(-) -- 2.38.1

2 4

[libvirt PATCH 0/2] spec: List more directories
by Andrea Bolognani 14 Dec '22

14 Dec '22

%blurb Andrea Bolognani (2): spec: Add trailing backslash spec: List more directories libvirt.spec.in | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.38.1

2 7

[libvirt PATCH 00/30] introduce external snapshot delete support
by Pavel Hrdina 14 Dec '22

14 Dec '22

This implements virDomainSnapshotDelete API to support external snapshots. The support doesn't include flags VIR_DOMAIN_SNAPSHOT_DELETE_CHILDREN and VIR_DOMAIN_SNAPSHOT_DELETE_CHILDREN_ONLY as it would add more complexity and IMHO these flags should not existed at all. Gitlab repo with the patches: https://gitlab.com/phrdina/libvirt/-/commits/snapshot-delete-external Pavel Hrdina (30): libvirt: introduce VIR_DOMAIN_JOB_OPERATION_SNAPSHOT_DELETE qemu_block: extract block commit code to separate function qemu_block: move qemuDomainBlockPivot out of qemu_driver qemu_block: add async domain job support to qemuBlockCommit qemu_block: add async domain job support to qemuBlockPivot qemu_monitor: introduce qemuMonitorJobFinalize qemu_monitor_json: allow configuring autofinalize for block commit qemu_block: allow configuring autofinalize for block commit qemu_block: introduce qemuBlockFinalize qemu_block: change qemuBlockCommit to return job pointer qemu_blockjob: process QEMU_MONITOR_JOB_STATUS_PENDING signal qemu_snapshot: refactor qemuSnapshotDelete qemu_snapshot: introduce qemuSnapshotDeleteSingle qemu_snapshot: introduce qemuSnapshotDeleteChildren qemu_snapshot: rework snapshot children deletion qemu_snapshot: move snapshot discard out of qemu_domain.c qemu_snapshot: move snapshot metadata reparent code qemu_snapshot: introduce qemuSnapshotDiscardMetadata qemu_snapshot: introduce qemuSnapshotDeleteValidate function qemu_snapshot: refactor validation of snapshot delete qemu_snapshot: error out when deleting internal snapshot on non-active disk qemu_snapshot: convert snapshot delete to async domain job qemu_snapshot: prepare data for external snapshot deletion qemu_snapshot: implement deletion of external snapshot qemu_snapshot: update metadata when deleting snapshots qemu_snapshot: when deleting snapshot invalidate parent snapshot qemu_process: abort snapshot delete when daemon starts qemu_snapshot: enable deletion of external snapshots api: document support for external snapshot deletion NEWS: document support for external snapshot deletion NEWS.rst | 6 + include/libvirt/libvirt-domain.h | 1 + src/conf/snapshot_conf.c | 6 + src/conf/snapshot_conf.h | 1 + src/libvirt-domain-snapshot.c | 7 + src/qemu/qemu_backup.c | 1 + src/qemu/qemu_block.c | 336 +++++++++++ src/qemu/qemu_block.h | 22 + src/qemu/qemu_blockjob.c | 20 +- src/qemu/qemu_blockjob.h | 1 + src/qemu/qemu_domain.c | 95 +-- src/qemu/qemu_domain.h | 9 - src/qemu/qemu_driver.c | 292 +--------- src/qemu/qemu_monitor.c | 21 +- src/qemu/qemu_monitor.h | 8 +- src/qemu/qemu_monitor_json.c | 26 +- src/qemu/qemu_monitor_json.h | 8 +- src/qemu/qemu_process.c | 32 ++ src/qemu/qemu_snapshot.c | 956 ++++++++++++++++++++++++++++--- src/qemu/qemu_snapshot.h | 4 + tests/qemumonitorjsontest.c | 4 +- tools/virsh-domain.c | 1 + 22 files changed, 1381 insertions(+), 476 deletions(-) -- 2.38.1

2 61

[PATCH] virnuma: Allow multiple nodes for preferred policy
by Michal Privoznik 14 Dec '22

14 Dec '22

In the past, the preferred policy (VIR_DOMAIN_NUMATUNE_MEM_PREFERRED) required exactly one (host) NUMA node. This made sense because: 1) the libnuma API - numa_set_preferred() allowed exactly one node, because 2) corresponding kernel syscall (__NR_set_mempolicy) accepted exactly one node (for MPOL_PREFERRED mode). But things have changed since then. Firstly, kernel introduced new MPOL_PREFERRED_MANY mode (v5.15-rc1~107^2~21) which was then exposed in libnuma as numa_set_preferred_many() (v2.0.15~24). Fortunately, libnuma also exposes numa_has_preferred_many() which returns whether the kernel has support for the new mode (1) or not (0). Putting this all together, we can lift our check for sufficiently new kernel and libnuma. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2151064 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- meson.build | 3 +++ src/util/virnuma.c | 25 +++++++++++++++++++++++-- 2 files changed, 26 insertions(+), 2 deletions(-) diff --git a/meson.build b/meson.build index f9834a36c2..c26778a68d 100644 --- a/meson.build +++ b/meson.build @@ -1103,6 +1103,9 @@ endif numactl_dep = cc.find_library('numa', required: get_option('numactl')) if numactl_dep.found() conf.set('WITH_NUMACTL', 1) + if cc.has_function('numa_set_preferred_many', dependencies: numactl_dep) + conf.set('WITH_NUMACTL_SET_PREFERRED_MANY', 1) + endif endif openwsman_version = '2.6.3' diff --git a/src/util/virnuma.c b/src/util/virnuma.c index 2306ab0cb1..43e299f4bb 100644 --- a/src/util/virnuma.c +++ b/src/util/virnuma.c @@ -93,7 +93,6 @@ virNumaSetupMemoryPolicy(virDomainNumatuneMemMode mode, virBitmap *nodeset) { nodemask_t mask; - int node = -1; int bit = 0; size_t i; int maxnode = 0; @@ -128,7 +127,19 @@ virNumaSetupMemoryPolicy(virDomainNumatuneMemMode mode, case VIR_DOMAIN_NUMATUNE_MEM_PREFERRED: { +# ifdef WITH_NUMACTL_SET_PREFERRED_MANY + struct bitmask *bitmask = NULL; +# endif + int G_GNUC_UNUSED node = -1; int nnodes = 0; + bool has_preferred_many = false; + +# ifdef WITH_NUMACTL_SET_PREFERRED_MANY + if (numa_has_preferred_many() > 0) { + has_preferred_many = true; + } +# endif + for (i = 0; i < NUMA_NUM_NODES; i++) { if (nodemask_isset(&mask, i)) { node = i; @@ -136,15 +147,25 @@ virNumaSetupMemoryPolicy(virDomainNumatuneMemMode mode, } } - if (nnodes != 1) { + if (!has_preferred_many && nnodes != 1) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("NUMA memory tuning in 'preferred' mode " "only supports single node")); return -1; } + /* The following automatically sets MPOL_PREFERRED_MANY + * whenever possible, so no need to special case it. */ numa_set_bind_policy(0); + +# ifdef WITH_NUMACTL_SET_PREFERRED_MANY + bitmask = numa_bitmask_alloc(maxnode + 1); + copy_nodemask_to_bitmask(&mask, bitmask); + numa_set_preferred_many(bitmask); + numa_bitmask_free(bitmask); +# else numa_set_preferred(node); +# endif } break; -- 2.37.4

2 1

[libvirt PATCH] docs: replace footer link to the bird site with mastodon
by Daniel P. Berrangé 14 Dec '22

14 Dec '22

Since the takeover of the bird site, the bulk of tech people who want a more friendly and inclusive media site have jumped over to Mastodon. With its decentralized nature, there's no one replacement that captures everything, but the fosstodon.org site is a topic relevant choice. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- docs/page.xsl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/page.xsl b/docs/page.xsl index 1414d90b89..548d5a11c4 100644 --- a/docs/page.xsl +++ b/docs/page.xsl @@ -179,7 +179,7 @@ <div id="community"> <h3>Community</h3> <ul> - <li><a href="https://twitter.com/hashtag/libvirt">twitter</a></li> + <li><a href="https://fosstodon.org/tags/libvirt">fosstodon</a></li> <li><a href="https://stackoverflow.com/questions/tagged/libvirt">stackoverflow</a></li> <li><a href="https://serverfault.com/questions/tagged/libvirt">serverfault</a></li> </ul> -- 2.38.1

2 1

[PATCH] tests: qemucapabilitiesdata: Final update of qemu-7.2 capabilities on x86
by Peter Krempa 14 Dec '22

14 Dec '22

QEMU 7.2 was released, update the capabilities data to the final state. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- tests/qemucapabilitiesdata/caps_7.2.0.x86_64.replies | 6 +++--- tests/qemucapabilitiesdata/caps_7.2.0.x86_64.xml | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.replies b/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.replies index 47203b8923..18f70a5a3f 100644 --- a/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.replies +++ b/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.replies @@ -17,11 +17,11 @@ { "return": { "qemu": { - "micro": 91, - "minor": 1, + "micro": 0, + "minor": 2, "major": 7 }, - "package": "v7.2.0-rc1" + "package": "v7.2.0" }, "id": "libvirt-2" } diff --git a/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.xml index 6bc739065f..821fcd3199 100644 --- a/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.xml @@ -201,10 +201,10 @@ <flag name='query-stats-schemas'/> <flag name='thread-context'/> <flag name='screenshot-format-png'/> - <version>7001091</version> + <version>7002000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100245</microcodeVersion> - <package>v7.2.0-rc1</package> + <package>v7.2.0</package> <arch>x86_64</arch> <hostCPU type='kvm' model='base' migratability='yes'> <property name='vmx-entry-load-rtit-ctl' type='boolean' value='false'/> -- 2.38.1

2 1

[PATCH 0/7] spec: Decompose the daemon subpackage
by Jim Fehlig 14 Dec '22

14 Dec '22

This is a V1 of my previous RFC to decompose the libvirt-daemon package https://listman.redhat.com/archives/libvir-list/2022-November/235924.html The end goal is to remove the libvirt-dameon dependency on the various libvirt-daemon-driver-foo subpackages, allowing installation of a modular daemon configuration without the traditional monolithic libvirtd. Change from V1: - Patches1-3 handled separate from this series since they are unrelated - virtlockd, virtlogd, and virtproxyd are moved to their own subpackages - lockd plugin moved to its own subpackage - virt-admin, virt-host-validate, and others moved to new subpackage TODO: The libvirt-daemon package still contains the following files, which likely need to move somewhere since they are needed by the modular daemons too. %{_unitdir}/virt-guest-shutdown.target I thought of moving this to the libs package, but that would be a change for installations with only libvirt-client. AFAICT, it's used by libvirt-guests and the qemu and lxc drivers. %config(noreplace) %{_sysconfdir}/sasl2/libvirt.conf Another file related to remote access. Should it go to libvirt-libs? %ghost %dir %{_rundir}/libvirt/ %ghost %dir %{_rundir}/libvirt/common/ %dir %attr(0755, root, root) %{_localstatedir}/lib/libvirt/ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/images/ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/filesystems/ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/boot/ %dir %attr(0711, root, root) %{_localstatedir}/cache/libvirt/ %dir %attr(0755, root, root) %{_libdir}/libvirt/ %dir %attr(0755, root, root) %{_libdir}/libvirt/connection-driver/ These files and directories are needed by the modular daemons as well, right? Where should they go? libvirt-daemon-<hypervisor> or libvirt-daemon-driver-<hypervisor>? %{_datadir}/polkit-1/actions/org.libvirt.unix.policy %{_datadir}/polkit-1/actions/org.libvirt.api.policy %{_datadir}/polkit-1/rules.d/50-libvirt.rules More files related to access. libvirt-libs? Jim Fehlig (7): spec: Move virtlockd to a new subpackage libvirt-daemon-lock spec: Move virtlogd to a new subpackage libvirt-daemon-log spec: Move virtproxyd to a new subpackage libvirt-daemon-proxy spec: Move lockd plugin to a new subpackage libvirt-daemon-plugin-lockd spec: Move common files to a new subpackage libvirt-daemon-client spec: Remove libvirt-daemon dependecy from drivers spec: Remove libvirt-daemon dependency from hypervisor subpackages libvirt.spec.in | 274 ++++++++++++++++++++++++++++++++---------------- 1 file changed, 183 insertions(+), 91 deletions(-) -- 2.38.1

3 30

[PATCH] qemu_process: add tray changed event to queue in refresh disks
by Kristina Hanicova 13 Dec '22

13 Dec '22

There are some cases when the internal state of disks can change without qemu sending events about it (e.g. a disk can close during reset). In case this happens, we should emit an event about the modified disk. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1824722#c20 Signed-off-by: Kristina Hanicova <khanicov(a)redhat.com> --- src/qemu/qemu_process.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 5de55435d2..601e9694b6 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -8675,6 +8675,7 @@ qemuProcessRefreshDisks(virDomainObj *vm, qemuDomainObjPrivate *priv = vm->privateData; g_autoptr(GHashTable) table = NULL; size_t i; + virQEMUDriver *driver = QEMU_DOMAIN_PRIVATE(vm)->driver; if (qemuDomainObjEnterMonitorAsync(vm, asyncJob) == 0) { table = qemuMonitorGetBlockInfo(priv->mon); @@ -8697,14 +8698,26 @@ qemuProcessRefreshDisks(virDomainObj *vm, continue; if (info->removable) { + virObjectEvent *event = NULL; + int reason; + if (info->empty) virDomainDiskEmptySource(disk); if (info->tray) { - if (info->tray_open) + if (info->tray_open == disk->tray_status) + continue; + + if (info->tray_open) { + reason = VIR_DOMAIN_EVENT_TRAY_CHANGE_OPEN; disk->tray_status = VIR_DOMAIN_DISK_TRAY_OPEN; - else + } else { + reason = VIR_DOMAIN_EVENT_TRAY_CHANGE_CLOSE; disk->tray_status = VIR_DOMAIN_DISK_TRAY_CLOSED; + } + + event = virDomainEventTrayChangeNewFromObj(vm, disk->info.alias, reason); + virObjectEventStateQueue(driver->domainEventState, event); } } -- 2.38.1

2 1

[libvirt PATCH 0/2] qemu_migration: Fix p2p post-copy recovery
by Jiri Denemark 13 Dec '22

13 Dec '22

Jiri Denemark (2): qemu_migration: Move qemuMigrationSrcPerformResume up qemu_migration: Fix p2p post-copy recovery src/qemu/qemu_migration.c | 129 ++++++++++++++++++++------------------ 1 file changed, 68 insertions(+), 61 deletions(-) -- 2.39.0

2 4

[libvirt PATCH v3 00/18] Use nbdkit for http/ftp/ssh network drives in libvirt
by Jonathon Jongsma 13 Dec '22

13 Dec '22

This is the third version of this patch series. See https://bugzilla.redhat.com/show_bug.cgi?id=2016527 for more information about the goal, but the summary is that RHEL does not want to ship the qemu storage plugins for curl and ssh. Handling them outside of the qemu process provides several advantages such as reduced attack surface and stability. A quick summary of the code: - at startup I query to see whether nbdkit exists on the host and if so, I query which plugins/filters are installed. These capabilities are cached and stored in the qemu driver - When the driver prepares the domain, we go through each disk source and determine whether the nbdkit capabilities allow us to support this disk via nbdkit, and if so, we allocate a qemuNbdkitProcess object and stash it in the private data of the virStorageSource. - The presence or absence of this qemuNbdkitProcess data then indicates whether this disk will be served to qemu indirectly via nbdkit or directly - When we launch the qemuProcess, as part of the "external device start" step, I launch a ndkit process for each disk that is supported by nbdkit. - for devices which are served by an intermediate ndkit process, I change the qemu commandline in the following ways: - I no longer pass auth/cookie secrets to qemu (those are handled by nbdkit) - I replace the actual network URL of the remote disk source with the path to the nbdkit unix socket - We create a 'monitor' for the nbdkit process that watches to see whether the process exits. If it does, we pause the domain, attempt to restart nbdkit, and then resume the domain. Open questions - I think selinux will work once we add a policy for the /usr/sbin/nbdkit binary to allow it to be executed by libvirt, but for now it fails to execute nbdkit in enforcing mode. The current context for nbdkit (on fedora) is "system_u:object_r:bin_t:s0". When I temporarily change the context to something like qemu_exec_t, I am able to start nbdkit and the domain launches. Known shortcomings - creating disks (in ssh) still isn't supported. Changes in v3: - Various formatting fixes - Don't kill process in qemuNbdkitProcessFree() since we want the nbdkit daemon to continue running even if libvirt restarts. - Better detection and error reporting when starting the nbdkit process - Add monitoring for nbdkit process so that it can be restarted if if ever exits unexpectedly. Changes in v2: - split into multiple patches - added a build option for nbdkit_moddir - don't instantiate any secret / cookie props for disks that are being served by nbdkit since we don't send secrets to qemu anymore - ensure that nbdkit processes are started/stopped for the entire backing chain - switch to virFileCache-based capabilities for nbdkit so that we don't need to requery every time - switch to using pipes for communicating sensitive data to nbdkit - use pidfile support built into virCommand rather than nbdkit's --pidfile argument - added significantly more tests Jonathon Jongsma (18): schema: allow 'ssh' as a protocol for network disks qemu: Add functions for determining nbdkit availability qemu: expand nbdkit capabilities util: Allow virFileCache data to be any GObject qemu: implement basic virFileCache for nbdkit caps qemu: implement persistent file cache for nbdkit caps qemu: use file cache for nbdkit caps qemu: Add qemuNbdkitProcess qemu: add functions to start and stop nbdkit tests: add ability to test various nbdkit capabilities qemu: split qemuDomainSecretStorageSourcePrepare qemu: include nbdkit state in private xml qemu: use nbdkit to serve network disks if available tests: add tests for nbdkit invocation util: make virCommandSetSendBuffer testable qemu: pass sensitive data to nbdkit via pipe qemu: add test for authenticating a https network disk qemu: Monitor nbdkit process for exit build-aux/syntax-check.mk | 4 +- meson.build | 9 + meson_options.txt | 1 + po/POTFILES | 1 + src/conf/schemas/domaincommon.rng | 1 + src/libvirt_private.syms | 1 + src/qemu/meson.build | 1 + src/qemu/qemu_block.c | 162 ++- src/qemu/qemu_conf.c | 23 + src/qemu/qemu_conf.h | 7 + src/qemu/qemu_domain.c | 180 ++- src/qemu/qemu_domain.h | 4 + src/qemu/qemu_driver.c | 4 + src/qemu/qemu_extdevice.c | 48 + src/qemu/qemu_nbdkit.c | 1243 +++++++++++++++++ src/qemu/qemu_nbdkit.h | 120 ++ src/qemu/qemu_nbdkitpriv.h | 31 + src/qemu/qemu_process.c | 13 + src/util/vircommand.c | 19 +- src/util/vircommand.h | 8 + src/util/vircommandpriv.h | 4 + src/util/virfilecache.c | 14 +- src/util/virfilecache.h | 2 +- src/util/virutil.h | 2 +- tests/meson.build | 1 + .../disk-cdrom-network.args.disk0 | 7 + .../disk-cdrom-network.args.disk1 | 9 + .../disk-cdrom-network.args.disk1.pipe.1778 | 1 + .../disk-cdrom-network.args.disk2 | 9 + .../disk-cdrom-network.args.disk2.pipe.1780 | 1 + .../disk-network-http.args.disk0 | 7 + .../disk-network-http.args.disk1 | 6 + .../disk-network-http.args.disk2 | 7 + .../disk-network-http.args.disk2.pipe.1778 | 1 + .../disk-network-http.args.disk3 | 8 + .../disk-network-http.args.disk3.pipe.1780 | 1 + ...work-source-curl-nbdkit-backing.args.disk0 | 8 + ...e-curl-nbdkit-backing.args.disk0.pipe.1778 | 1 + .../disk-network-source-curl.args.1.pipe.1 | 1 + .../disk-network-source-curl.args.disk0 | 8 + ...k-network-source-curl.args.disk0.pipe.1778 | 1 + .../disk-network-source-curl.args.disk1 | 10 + ...k-network-source-curl.args.disk1.pipe.1780 | 1 + ...k-network-source-curl.args.disk1.pipe.1782 | 1 + ...isk-network-source-curl.args.disk1.pipe.49 | 1 + .../disk-network-source-curl.args.disk2 | 8 + ...k-network-source-curl.args.disk2.pipe.1782 | 1 + ...k-network-source-curl.args.disk2.pipe.1784 | 1 + ...isk-network-source-curl.args.disk2.pipe.51 | 1 + .../disk-network-source-curl.args.disk3 | 7 + .../disk-network-source-curl.args.disk4 | 7 + .../disk-network-ssh.args.disk0 | 7 + tests/qemunbdkittest.c | 294 ++++ ...sk-cdrom-network-nbdkit.x86_64-latest.args | 42 + .../disk-cdrom-network-nbdkit.xml | 1 + ...isk-network-http-nbdkit.x86_64-latest.args | 45 + .../disk-network-http-nbdkit.xml | 1 + ...rce-curl-nbdkit-backing.x86_64-latest.args | 38 + ...isk-network-source-curl-nbdkit-backing.xml | 45 + ...work-source-curl-nbdkit.x86_64-latest.args | 50 + .../disk-network-source-curl-nbdkit.xml | 1 + ...isk-network-source-curl.x86_64-latest.args | 54 + .../disk-network-source-curl.xml | 74 + ...disk-network-ssh-nbdkit.x86_64-latest.args | 36 + .../disk-network-ssh-nbdkit.xml | 1 + .../disk-network-ssh.x86_64-latest.args | 36 + tests/qemuxml2argvdata/disk-network-ssh.xml | 31 + tests/qemuxml2argvtest.c | 18 + tests/testutilsqemu.c | 27 + tests/testutilsqemu.h | 5 + 70 files changed, 2707 insertions(+), 116 deletions(-) create mode 100644 src/qemu/qemu_nbdkit.c create mode 100644 src/qemu/qemu_nbdkit.h create mode 100644 src/qemu/qemu_nbdkitpriv.h create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk1 create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk1.pipe.1778 create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk2 create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk2.pipe.1780 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk1 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk2 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk2.pipe.1778 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk3 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk3.pipe.1780 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl-nbdkit-backing.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl-nbdkit-backing.args.disk0.pipe.1778 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.1.pipe.1 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk0.pipe.1778 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk1 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk1.pipe.1780 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk1.pipe.1782 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk1.pipe.49 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk2 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk2.pipe.1782 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk2.pipe.1784 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk2.pipe.51 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk3 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk4 create mode 100644 tests/qemunbdkitdata/disk-network-ssh.args.disk0 create mode 100644 tests/qemunbdkittest.c create mode 100644 tests/qemuxml2argvdata/disk-cdrom-network-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-cdrom-network-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-http-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-network-http-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl-nbdkit-backing.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl-nbdkit-backing.xml create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-network-source-curl-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl.xml create mode 100644 tests/qemuxml2argvdata/disk-network-ssh-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-network-ssh-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-ssh.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-network-ssh.xml -- 2.37.3

5 46

[libvirt PATCH] qemu: Don't warn when releasing a released job
by Jiri Denemark 13 Dec '22

13 Dec '22

When qemuDomainObjReleaseAsyncJob is called when the current async job is already released we emit quite useless warning which was implemented to warn about releasing a job owned by another thread. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/qemu/qemu_domainjob.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_domainjob.c b/src/qemu/qemu_domainjob.c index 4d320f075e..8d958b9d21 100644 --- a/src/qemu/qemu_domainjob.c +++ b/src/qemu/qemu_domainjob.c @@ -647,7 +647,8 @@ qemuDomainObjReleaseAsyncJob(virDomainObj *obj) VIR_DEBUG("Releasing ownership of '%s' async job", virDomainAsyncJobTypeToString(obj->job->asyncJob)); - if (obj->job->asyncOwner != virThreadSelfID()) { + if (obj->job->asyncOwner != 0 && + obj->job->asyncOwner != virThreadSelfID()) { VIR_WARN("'%s' async job is owned by thread %llu", virDomainAsyncJobTypeToString(obj->job->asyncJob), obj->job->asyncOwner); -- 2.39.0

2 1

[libvirt PATCH] cpu: Improve debug message in virCPUGetVendorForModel
by Jiri Denemark 13 Dec '22

13 Dec '22

Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/cpu/cpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/cpu/cpu.c b/src/cpu/cpu.c index 7f3caf7a27..c5de9fc95c 100644 --- a/src/cpu/cpu.c +++ b/src/cpu/cpu.c @@ -936,7 +936,7 @@ virCPUGetVendorForModel(virArch arch, { struct cpuArchDriver *driver; - VIR_DEBUG("arch=%s", virArchToString(arch)); + VIR_DEBUG("arch=%s model=%s", virArchToString(arch), model); if (!(driver = cpuGetSubDriver(arch))) return NULL; -- 2.39.0

2 1

[libvirt PATCH] qemu: Fix warning in qemuMigrationDstPostcopyFailed
by Jiri Denemark 13 Dec '22

13 Dec '22

The function is called even if QEMU reports migration as postcopy-paused, i.e., it's not migrating anymore. And while changing the warning, we can drop the part about unattended migration to make the warning shorter and consistent with qemuMigrationSrcPostcopyFailed. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/qemu/qemu_migration.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 81bb08c029..2e87db883e 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -1704,9 +1704,8 @@ qemuMigrationDstPostcopyFailed(virDomainObj *vm) reason == VIR_DOMAIN_RUNNING_POSTCOPY_FAILED) return; - VIR_WARN("Migration protocol failed during incoming migration of domain " - "%s, but QEMU keeps migrating; leaving the domain running, the " - "migration will be handled as unattended", vm->def->name); + VIR_WARN("Incoming migration of domain %s failed during post-copy; " + "leaving the domain running", vm->def->name); virDomainObjSetState(vm, VIR_DOMAIN_RUNNING, VIR_DOMAIN_RUNNING_POSTCOPY_FAILED); -- 2.39.0

2 1

[PATCH] meson: Provide default values for nonexistent xenlight pkgconfig vars
by Michal Privoznik 12 Dec '22

12 Dec '22

It may happen that xenlight pkgconfig file does not contain 'xenfirmwaredir' and/or 'libexec_bin' variables, which is okay and we have code that deals with this situation. But that code is executed when the queried value is an empty string. This may not always be the case and we should specifically set 'default_value' so that the empty string is returned if pkgconfig variable doesn't exist. Fixes: 968479adcfa5c49b29b7b6680dcaffde1408f044 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- meson.build | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/meson.build b/meson.build index f9834a36c2..3d870d77db 100644 --- a/meson.build +++ b/meson.build @@ -1478,8 +1478,8 @@ if not get_option('driver_libxl').disabled() and conf.has('WITH_LIBVIRTD') libxl_dep = dependency('xenlight', version: '>=' + libxl_version, required: get_option('driver_libxl')) if libxl_dep.found() - libxl_firmware_dir = libxl_dep.get_variable(pkgconfig : 'xenfirmwaredir') - libxl_execbin = libxl_dep.get_variable(pkgconfig : 'libexec_bin') + libxl_firmware_dir = libxl_dep.get_variable(pkgconfig : 'xenfirmwaredir', default_value: '') + libxl_execbin = libxl_dep.get_variable(pkgconfig : 'libexec_bin', default_value: '') if libxl_firmware_dir != '' conf.set_quoted('LIBXL_FIRMWARE_DIR', libxl_firmware_dir) endif -- 2.37.4

2 1

[PATCH 00/11] Remove secure clearing of memory where it doesn't make sense
by Peter Krempa 12 Dec '22

12 Dec '22

In certain cases we tried to clear stuff which isn't secure and in other cases we clear the pointer but then pass the secret on the commandline. Remove the security theatre. Additionally all other instances which pass secret via RPC can be theoreticlaly removed as the secret is copied to/from and non-sanitized RPC buffer. We'd have to clear all RPC buffers though for this to be "properly" handled and not just security theater. Peter Krempa (11): virCryptoEncryptDataAESgnutls: Don't secure erase gnutls_datum_t structs virCryptoEncryptDataAESgnutls: Properly initialize data structures virCryptoEncryptDataAESgnutls: Restructure control flow virStorageBackendISCSISetAuth: Don't bother securely erasing password virStorageBackendISCSISetAuth: Use g_strndup to '\0' terminate data virStorageBackendISCSISetAuth: Refactor cleanup libxlMakeNetworkDiskSrc: Don't bother with secure erase of secrets libxlMakeNetworkDiskSrc: Refactor cleanup virStorageBackendRBDOpenRADOSConn: Don't log the RBD key datatypes: Register autoptr cleanup for virSecret virSecretGetSecretString: Refactor cleanup src/datatypes.h | 1 + src/libxl/libxl_conf.c | 24 +++++----------- src/storage/storage_backend_iscsi.c | 22 +++++---------- src/storage/storage_backend_rbd.c | 24 ++++++++++++---- src/util/vircrypto.c | 43 ++++++++++------------------- src/util/virsecret.c | 19 ++++--------- 6 files changed, 53 insertions(+), 80 deletions(-) -- 2.38.1

3 20

[libvirt PATCH] rpm: switch to using %mingw_find_lang
by Daniel P. Berrangé 12 Dec '22

12 Dec '22

We currently list the locale file paths via a wildcard in %files, but the normal pattern for mingw RPMs in Fedora is to use %mingw_find_lang. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 562baea52e..31ff8ea01e 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1355,6 +1355,8 @@ rm -rf $RPM_BUILD_ROOT%{mingw64_libexecdir}/libvirt-guests.sh %mingw_debug_install_post +%mingw_find_lang %{name} + %endif %check @@ -2181,7 +2183,7 @@ exit 0 %{_datadir}/libvirt/api/libvirt-lxc-api.xml %if %{with_mingw} -%files -n mingw32-libvirt +%files -n mingw32-libvirt -f mingw32-libvirt.lang %dir %{mingw32_sysconfdir}/libvirt/ %config(noreplace) %{mingw32_sysconfdir}/libvirt/libvirt.conf %config(noreplace) %{mingw32_sysconfdir}/libvirt/libvirt-admin.conf @@ -2212,7 +2214,6 @@ exit 0 %{mingw32_datadir}/libvirt/api/libvirt-admin-api.xml %{mingw32_datadir}/libvirt/cpu_map/*.xml %{mingw32_datadir}/libvirt/test-screenshot.png -%{mingw32_datadir}/locale/*/LC_MESSAGES/libvirt.mo %dir %{mingw32_includedir}/libvirt %{mingw32_includedir}/libvirt/libvirt.h %{mingw32_includedir}/libvirt/libvirt-common.h @@ -2239,7 +2240,7 @@ exit 0 %{mingw32_mandir}/man1/virt-pki-validate.1* %{mingw32_mandir}/man7/virkey*.7* -%files -n mingw64-libvirt +%files -n mingw64-libvirt -f mingw64-libvirt.lang %dir %{mingw64_sysconfdir}/libvirt/ %config(noreplace) %{mingw64_sysconfdir}/libvirt/libvirt.conf %config(noreplace) %{mingw64_sysconfdir}/libvirt/libvirt-admin.conf @@ -2270,7 +2271,6 @@ exit 0 %{mingw64_datadir}/libvirt/api/libvirt-admin-api.xml %{mingw64_datadir}/libvirt/cpu_map/*.xml %{mingw64_datadir}/libvirt/test-screenshot.png -%{mingw64_datadir}/locale/*/LC_MESSAGES/libvirt.mo %dir %{mingw64_includedir}/libvirt %{mingw64_includedir}/libvirt/libvirt.h %{mingw64_includedir}/libvirt/libvirt-common.h -- 2.38.1

2 1

[libvirt PATCH 0/3] Actually do secure erase with explicit_bzero
by Daniel P. Berrangé 12 Dec '22

12 Dec '22

If we're going to have a virSecureErase function, we might as well make it do secure erasure with currently available explicit_bzero in FreeBSD/Linux. While we're here, we should use it from the RPC code. The remaining hole in the RPC code is xdr_free which does not securely erase buffers. That's not easily fixed without dropping the RPC impl in favour of a custom one. Daniel P. Berrangé (3): util: implement secure erase with explicit_bzero rpc: fix buffer offset updates after decoding payload rpc: securely erase the message buffers meson.build | 1 + src/rpc/virnetmessage.c | 4 +++- src/util/virsecureerase.c | 6 ++++++ 3 files changed, 10 insertions(+), 1 deletion(-) -- 2.38.1

2 4

[PATCH] formatcaps: Update capabilities example
by Michal Privoznik 12 Dec '22

12 Dec '22

In the formatcaps.rst we give an example output of capabilities. Well, there are couple of issues with it: 1) We show <features/> nested under /capabilities/host/cpu. There's no such element and never was. 2) The ordering of elements is corrupted. 3) There is plenty of elements missing. Fix these by showing an actual output of 'virsh capabilities' as obtained on my machine. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- docs/formatcaps.rst | 230 +++++++++++++++++++++++++++++++++----------- 1 file changed, 176 insertions(+), 54 deletions(-) diff --git a/docs/formatcaps.rst b/docs/formatcaps.rst index 39b1fb78ac..f7e5342654 100644 --- a/docs/formatcaps.rst +++ b/docs/formatcaps.rst @@ -143,60 +143,182 @@ capabilities enabled in the chip and BIOS you will see: :: - <capabilities> - <host> - <cpu> - <arch>x86_64</arch> - <features> - <vmx/> - </features> - <model>core2duo</model> - <vendor>Intel</vendor> - <topology sockets="1" dies="1" cores="2" threads="1"/> - <feature name="lahf_lm"/> - <feature name='xtpr'/> - <pages unit='KiB' size='4'/> - <pages unit='KiB' size='2048'/> - <pages unit='KiB' size='1048576'/> - <microcode version='36'/> - <maxphysaddr mode='emulate' bits='46'/> - ... - </cpu> - <power_management> - <suspend_mem/> - <suspend_disk/> - <suspend_hybrid/> - </power_management> - </host> + <capabilities> -  - <guest> - <os_type>xen</os_type> - <arch name="x86_64"> - <wordsize>64</wordsize> - <domain type="xen"></domain> - <emulator>/usr/lib64/xen/bin/qemu-dm</emulator> - </arch> - <features> - </features> - </guest> + <host> + <uuid>7b55704c-29f4-11b2-a85c-9dc6ff50623f</uuid> + <cpu> + <arch>x86_64</arch> + <model>Skylake-Client-noTSX-IBRS</model> + <vendor>Intel</vendor> + <microcode version='236'/> + <signature family='6' model='142' stepping='12'/> + <counter name='tsc' frequency='2303997000' scaling='no'/> + <topology sockets='1' dies='1' cores='4' threads='2'/> + <maxphysaddr mode='emulate' bits='39'/> + <feature name='ds'/> + <feature name='acpi'/> + <feature name='ss'/> + <feature name='ht'/> + <feature name='tm'/> + <feature name='pbe'/> + <feature name='dtes64'/> + <feature name='monitor'/> + <feature name='ds_cpl'/> + <feature name='vmx'/> + <feature name='smx'/> + <feature name='est'/> + <feature name='tm2'/> + <feature name='xtpr'/> + <feature name='pdcm'/> + <feature name='osxsave'/> + <feature name='tsc_adjust'/> + <feature name='sgx'/> + <feature name='clflushopt'/> + <feature name='intel-pt'/> + <feature name='md-clear'/> + <feature name='stibp'/> + <feature name='arch-capabilities'/> + <feature name='ssbd'/> + <feature name='xsaves'/> + <feature name='sgx1'/> + <feature name='sgx-debug'/> + <feature name='sgx-mode64'/> + <feature name='sgx-provisionkey'/> + <feature name='sgx-tokenkey'/> + <feature name='pdpe1gb'/> + <feature name='invtsc'/> + <feature name='rdctl-no'/> + <feature name='ibrs-all'/> + <feature name='skip-l1dfl-vmentry'/> + <feature name='mds-no'/> + <feature name='tsx-ctrl'/> + <pages unit='KiB' size='4'/> + <pages unit='KiB' size='2048'/> + <pages unit='KiB' size='1048576'/> + </cpu> + <power_management> + <suspend_mem/> + </power_management> + <iommu support='yes'/> + <migration_features> + <live/> + <uri_transports> + <uri_transport>tcp</uri_transport> + <uri_transport>rdma</uri_transport> + </uri_transports> + </migration_features> + <topology> + <cells num='1'> + <cell id='0'> + <memory unit='KiB'>32498112</memory> + <pages unit='KiB' size='4'>6813808</pages> + <pages unit='KiB' size='2048'>2048</pages> + <pages unit='KiB' size='1048576'>1</pages> + <distances> + <sibling id='0' value='10'/> + </distances> + <cpus num='8'> + <cpu id='0' socket_id='0' die_id='0' core_id='0' siblings='0,4'/> + <cpu id='1' socket_id='0' die_id='0' core_id='1' siblings='1,5'/> + <cpu id='2' socket_id='0' die_id='0' core_id='2' siblings='2,6'/> + <cpu id='3' socket_id='0' die_id='0' core_id='3' siblings='3,7'/> + <cpu id='4' socket_id='0' die_id='0' core_id='0' siblings='0,4'/> + <cpu id='5' socket_id='0' die_id='0' core_id='1' siblings='1,5'/> + <cpu id='6' socket_id='0' die_id='0' core_id='2' siblings='2,6'/> + <cpu id='7' socket_id='0' die_id='0' core_id='3' siblings='3,7'/> + </cpus> + </cell> + </cells> + </topology> + <cache> + <bank id='0' level='3' type='both' size='8' unit='MiB' cpus='0-7'/> + </cache> + <secmodel> + <model>none</model> + <doi>0</doi> + </secmodel> + <secmodel> + <model>dac</model> + <doi>0</doi> + <baselabel type='kvm'>+77:+77</baselabel> + <baselabel type='qemu'>+77:+77</baselabel> + </secmodel> + </host> -  - <guest> - <os_type>hvm</os_type> - <arch name="i686"> - <wordsize>32</wordsize> - <domain type="xen"></domain> - <emulator>/usr/lib/xen/bin/qemu-dm</emulator> - <machine>pc</machine> - <machine>isapc</machine> - <loader>/usr/lib/xen/boot/hvmloader</loader> - </arch> - <features> - <cpuselection/> - <deviceboot/> - </features> - </guest> + <guest> + <os_type>hvm</os_type> + <arch name='x86_64'> + <wordsize>64</wordsize> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <machine maxCpus='255'>pc-i440fx-7.1</machine> + <machine canonical='pc-i440fx-7.1' maxCpus='255'>pc</machine> + <machine maxCpus='288'>pc-q35-5.2</machine> + <machine maxCpus='255'>pc-i440fx-2.12</machine> + <machine maxCpus='255'>pc-i440fx-2.0</machine> + <machine maxCpus='255'>pc-i440fx-6.2</machine> + <machine maxCpus='288'>pc-q35-4.2</machine> + <machine maxCpus='255'>pc-i440fx-2.5</machine> + <machine maxCpus='255'>pc-i440fx-4.2</machine> + <machine maxCpus='255'>pc-i440fx-5.2</machine> + <machine maxCpus='255' deprecated='yes'>pc-i440fx-1.5</machine> + <machine maxCpus='255'>pc-q35-2.7</machine> + <machine maxCpus='288'>pc-q35-7.1</machine> + <machine canonical='pc-q35-7.1' maxCpus='288'>q35</machine> + <machine maxCpus='255'>pc-i440fx-2.2</machine> + <machine maxCpus='255'>pc-i440fx-2.7</machine> + <machine maxCpus='288'>pc-q35-6.1</machine> + <machine maxCpus='255'>pc-q35-2.4</machine> + <machine maxCpus='288'>pc-q35-2.10</machine> + <machine maxCpus='1'>x-remote</machine> + <machine maxCpus='288'>pc-q35-5.1</machine> + <machine maxCpus='255' deprecated='yes'>pc-i440fx-1.7</machine> + <machine maxCpus='288'>pc-q35-2.9</machine> + <machine maxCpus='255'>pc-i440fx-2.11</machine> + <machine maxCpus='288'>pc-q35-3.1</machine> + <machine maxCpus='255'>pc-i440fx-6.1</machine> + <machine maxCpus='288'>pc-q35-4.1</machine> + <machine maxCpus='255'>pc-i440fx-2.4</machine> + <machine maxCpus='255'>pc-i440fx-4.1</machine> + <machine maxCpus='255'>pc-i440fx-5.1</machine> + <machine maxCpus='255'>pc-i440fx-2.9</machine> + <machine maxCpus='1'>isapc</machine> + <machine maxCpus='255' deprecated='yes'>pc-i440fx-1.4</machine> + <machine maxCpus='255'>pc-q35-2.6</machine> + <machine maxCpus='255'>pc-i440fx-3.1</machine> + <machine maxCpus='288'>pc-q35-2.12</machine> + <machine maxCpus='288'>pc-q35-7.0</machine> + <machine maxCpus='255'>pc-i440fx-2.1</machine> + <machine maxCpus='288'>pc-q35-6.0</machine> + <machine maxCpus='255'>pc-i440fx-2.6</machine> + <machine maxCpus='288'>pc-q35-4.0.1</machine> + <machine maxCpus='255'>pc-i440fx-7.0</machine> + <machine maxCpus='255' deprecated='yes'>pc-i440fx-1.6</machine> + <machine maxCpus='288'>pc-q35-5.0</machine> + <machine maxCpus='288'>pc-q35-2.8</machine> + <machine maxCpus='255'>pc-i440fx-2.10</machine> + <machine maxCpus='288'>pc-q35-3.0</machine> + <machine maxCpus='255'>pc-i440fx-6.0</machine> + <machine maxCpus='288'>pc-q35-4.0</machine> + <machine maxCpus='288'>microvm</machine> + <machine maxCpus='255'>pc-i440fx-2.3</machine> + <machine maxCpus='255'>pc-i440fx-4.0</machine> + <machine maxCpus='255'>pc-i440fx-5.0</machine> + <machine maxCpus='255'>pc-i440fx-2.8</machine> + <machine maxCpus='288'>pc-q35-6.2</machine> + <machine maxCpus='255'>pc-q35-2.5</machine> + <machine maxCpus='255'>pc-i440fx-3.0</machine> + <machine maxCpus='288'>pc-q35-2.11</machine> + <domain type='qemu'/> + <domain type='kvm'/> + </arch> + <features> + <acpi default='on' toggle='yes'/> + <apic default='on' toggle='no'/> + <cpuselection/> + <deviceboot/> + <disksnapshot default='on' toggle='no'/> + </features> + </guest> - ... - </capabilities> + </capabilities> -- 2.37.4

2 1

[PATCH] docs: Add missing elements to formatcaps.rst
by Nobuhiro MIKI 12 Dec '22

12 Dec '22

Signed-off-by: Nobuhiro MIKI <nmiki(a)yahoo-corp.jp> --- docs/formatcaps.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/formatcaps.rst b/docs/formatcaps.rst index 9d7932a6a8..39b1fb78ac 100644 --- a/docs/formatcaps.rst +++ b/docs/formatcaps.rst @@ -155,6 +155,11 @@ capabilities enabled in the chip and BIOS you will see: <topology sockets="1" dies="1" cores="2" threads="1"/> <feature name="lahf_lm"/> <feature name='xtpr'/> + <pages unit='KiB' size='4'/> + <pages unit='KiB' size='2048'/> + <pages unit='KiB' size='1048576'/> + <microcode version='36'/> + <maxphysaddr mode='emulate' bits='46'/> ... </cpu> <power_management> -- 2.38.1

2 1

[PATCH RFC 0/6] spec: Decompose the daemon subpackage
by Jim Fehlig 11 Dec '22

11 Dec '22

Currently it is not possible to install a modular daemon subpackage without also installing the monolithic daemon https://listman.redhat.com/archives/libvir-list/2022-September/234554.html This series is an initial attempt at moving common daemons, utilities, and files from the daemon subpackage to a new daemon-core subpackage. The monolithic and modular daemons can then depend on the new subpackage. libvirt-guests is moved to a new libvirt-guests subpackage, which is recommended by the daemon subpackage to provide smoother upgrade. I've likely overlooked several items, but before continuing down this path too far I first wanted to gauge interest and see if this work is worth pursuing. If so, any comments on the RFC are appreciated! Note that patches 1-3 are things I noticed while working on the others and could be pushed independently. Jim Fehlig (6): spec: Remove redundant with_libxl spec: Use more %{name} macro spec: Remove daemon postun trigger spec: Move common daemons to a separate subpackage spec: Move more files to the daemon-core subpackage spec: Move libvirt-guests to guests subpackage libvirt.spec.in | 406 ++++++++++++++++++++++++++---------------------- 1 file changed, 219 insertions(+), 187 deletions(-) -- 2.37.3

3 14

[PATCH v2 0/2] virnetdevtap.c: Disallow pre-existing TAP devices
by Michal Privoznik 08 Dec '22

08 Dec '22

v2 of: https://listman.redhat.com/archives/libvir-list/2022-December/236197.html diff to v1: - Check for existing device iff virNetDevGenerateName() returned early (per Laine's suggestion). Michal Prívozník (2): virnetdev: Make virNetDevGenerateName() return 1 if no name was generated virnetdevtap.c: Disallow pre-existing TAP devices src/qemu/qemu_interface.c | 2 ++ src/util/virnetdev.c | 6 ++++-- src/util/virnetdevtap.c | 23 +++++++++++++++++++++-- src/util/virnetdevtap.h | 2 ++ 4 files changed, 29 insertions(+), 4 deletions(-) -- 2.37.4

2 3

[libvirt PATCH] tools: Fix style issues in virt-qemu-sev-validate
by Andrea Bolognani 08 Dec '22

08 Dec '22

The script had an incorrect interpreter line until commit f6a19d7264bb, so the flake8 check would not realize it needed to pick it up and these issues, some of which were present it the very first version that was committed, were not being reported. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- tools/virt-qemu-sev-validate | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/virt-qemu-sev-validate b/tools/virt-qemu-sev-validate index 46a92aa7a0..3d8b292fef 100755 --- a/tools/virt-qemu-sev-validate +++ b/tools/virt-qemu-sev-validate @@ -849,7 +849,7 @@ class ConfidentialVM(abc.ABC): secret64 = b64encode(secret_table_ciphertext).decode('utf8') log.debug("Header: %s (%d bytes)", header64, len(header)) log.debug("Secret: %s (%d bytes)", - secret64, len(secret_table_ciphertext)) + secret64, len(secret_table_ciphertext)) return header64, secret64 @@ -955,7 +955,7 @@ class LibvirtConfidentialVM(ConfidentialVM): self.dom = self.conn.lookupByName(id_name_uuid) log.debug("VM: id=%d name=%s uuid=%s", - self.dom.ID(), self.dom.name(), self.dom.UUIDString()) + self.dom.ID(), self.dom.name(), self.dom.UUIDString()) if not self.dom.isActive(): raise InvalidStateException( @@ -1331,5 +1331,6 @@ def main(): print("ERROR: %s" % e, file=sys.stderr) sys.exit(6) + if __name__ == "__main__": main() -- 2.38.1

3 3

[PATCH] virnetdevtap.c: Disallow pre-existing TAP devices
by Michal Privoznik 08 Dec '22

08 Dec '22

When starting a guest with <interface/> which has the target device name set (i.e. not generated by us), it may happen that the TAP device already exists. This then may lead to all sorts of problems. For instance: for <interface type='network'/> the TAP device is plugged into the network's bridge, but since the TAP device is persistent it remains plugged there even after the guest is shut off. We don't have a code that unplugs TAP devices from the bridge because TAP devices we create are transient, i.e. are removed automatically when QEMU closes their FD. The only exception is <interface type='ethernet'/> with <target managed='no'/> where we specifically want to let users use pre-created TAP device and basically not touch it at all. There's another reason for denying to use a pre-created TAP devices: if we ever have bug in TAP name generation, we may re-use a TAP device from another domain. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2144738 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_interface.c | 2 ++ src/util/virnetdevtap.c | 31 ++++++++++++++++++++++++++++++- src/util/virnetdevtap.h | 2 ++ 3 files changed, 34 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_interface.c b/src/qemu/qemu_interface.c index 4cc76e07a5..264d5e060c 100644 --- a/src/qemu/qemu_interface.c +++ b/src/qemu/qemu_interface.c @@ -461,6 +461,8 @@ qemuInterfaceEthernetConnect(virDomainDef *def, if (!net->ifname) template_ifname = true; + tap_create_flags |= VIR_NETDEV_TAP_CREATE_ALLOW_EXISTING; + if (virNetDevTapCreate(&net->ifname, tunpath, tapfd, tapfdSize, tap_create_flags) < 0) { goto cleanup; diff --git a/src/util/virnetdevtap.c b/src/util/virnetdevtap.c index 112a1e8b99..406339c583 100644 --- a/src/util/virnetdevtap.c +++ b/src/util/virnetdevtap.c @@ -148,12 +148,15 @@ virNetDevTapGetRealDeviceName(char *ifname G_GNUC_UNUSED) * @tunpath: path to the tun device (if NULL, /dev/net/tun is used) * @tapfds: array of file descriptors return value for the new tap device * @tapfdSize: number of file descriptors in @tapfd - * @flags: OR of virNetDevTapCreateFlags. Only one flag is recognized: + * @flags: OR of virNetDevTapCreateFlags. Only the following flags are + * recognized: * * VIR_NETDEV_TAP_CREATE_VNET_HDR * - Enable IFF_VNET_HDR on the tap device * VIR_NETDEV_TAP_CREATE_PERSIST * - The device will persist after the file descriptor is closed + * VIR_NETDEV_TAP_CREATE_ALLOW_EXISTING + * - The device creation fails if @ifname already exists * * Creates a tap interface. The caller must use virNetDevTapDelete to * remove a persistent TAP device when it is no longer needed. In case @@ -182,6 +185,19 @@ int virNetDevTapCreate(char **ifname, if (virNetDevGenerateName(ifname, VIR_NET_DEV_GEN_NAME_VNET) < 0) return -1; + if (!(flags & VIR_NETDEV_TAP_CREATE_ALLOW_EXISTING)) { + int rc = virNetDevExists(*ifname); + + if (rc < 0) { + return -1; + } else if (rc > 0) { + virReportError(VIR_ERR_OPERATION_INVALID, + _("The %s interface already exists"), + *ifname); + return -1; + } + } + if (!tunpath) tunpath = "/dev/net/tun"; @@ -319,6 +335,19 @@ int virNetDevTapCreate(char **ifname, if (virNetDevGenerateName(ifname, VIR_NET_DEV_GEN_NAME_VNET) < 0) return -1; + if (!(flags & VIR_NETDEV_TAP_CREATE_ALLOW_EXISTING)) { + int rc = virNetDevExists(*ifname); + + if (rc < 0) { + return -1; + } else if (rc > 0) { + virReportError(VIR_ERR_OPERATION_INVALID, + _("The %s interface already exists"), + *ifname); + return -1; + } + } + /* As FreeBSD determines interface type by name, * we have to create 'tap' interface first and * then rename it to 'vnet' diff --git a/src/util/virnetdevtap.h b/src/util/virnetdevtap.h index 197ea10f94..c9d29c0384 100644 --- a/src/util/virnetdevtap.h +++ b/src/util/virnetdevtap.h @@ -56,6 +56,8 @@ typedef enum { VIR_NETDEV_TAP_CREATE_USE_MAC_FOR_BRIDGE = 1 << 2, /* The device will persist after the file descriptor is closed */ VIR_NETDEV_TAP_CREATE_PERSIST = 1 << 3, + /* The device is allowed to exist before creation */ + VIR_NETDEV_TAP_CREATE_ALLOW_EXISTING = 1 << 4, } virNetDevTapCreateFlags; int -- 2.37.4

2 1

[libvirt PATCH 00/21] meson: remove many obsolete checks
by Daniel P. Berrangé 08 Dec '22

08 Dec '22

We have alot of checks for Linux kernel features that are obsolete since our supported platform matrix lets us assume new enough kernel versions. Removing the checks will speed up the meson phase and reduce the tangle of #ifdefs in the code. I thought I could remove the check for linux/kvm.h but for some reason our code in virhostpcu.c / cpu_x86.c is enabling the codebases even on FreeBSD, which I find kind of odd. Does FreeBSD really ship a linux/kvm.h ? Daniel P. Berrangé (21): meson: remove obsolete check for LOOP_CTL_GET_FREE meson: remove obsolete check for EPOLL_CLOEXEC meson: remove obsolete check for LO_FLAGS_AUTOCLEAR meson: drop check for unshare() netdev: simplify check for ethtool functionality meson: remove obsolete check for ETHTOOL_GGSO meson: remove obsolete check for ETHTOOL_GGRO meson: remove obsolete check for ETHTOOL_GFLAGS meson: remove obsolete check for ETH_FLAG_LRO meson: remove obsolete check for ETH_FLAG_TXVLAN/RXVLAN meson: remove obsolete check for ETH_FLAG_NTUPLE meson: remove obsolete check for ETH_FLAG_RXHASH meson: remove obsolete check for ETHTOOL_GFEATURES meson: remove obsolete check for ETHTOOL_GCOALESCE meson: remove obsolete check for GET_VLAN_VID_CMD meson: simplify check for virnetdevbridge.c headers meson: remove obsolete check for DEVLINK_CMD_ESWITCH_GET meson: remove obsolete check for linux/magic.h meson: remove obsolete check for VHOST_VSOCK_SET_GUEST_CID meson: remove obsolete check for BPF_PROG_QUERY meson: remove obsolete check for BPF_CGROUP_DEVICE meson.build | 82 +++-------------------------------- src/util/virbpf.c | 6 +-- src/util/virbpf.h | 6 +-- src/util/vircgroupv2devices.c | 10 ++--- src/util/virfile.c | 15 ++----- src/util/virnetdev.c | 65 ++++----------------------- src/util/virvsock.c | 4 +- tests/securityselinuxhelper.c | 4 +- tests/virfilemock.c | 2 +- 9 files changed, 32 insertions(+), 162 deletions(-) -- 2.38.1

3 25

[libvirt PATCH 0/2] virt-qemu-sev-validate: A couple of small fixes
by Andrea Bolognani 08 Dec '22

08 Dec '22

Andrea Bolognani (2): docs: Fix typo in virt-qemu-sev-validate(1) tools: Fix interpreter for virt-qemu-sev-validate docs/manpages/virt-qemu-sev-validate.rst | 2 +- tools/virt-qemu-sev-validate | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) -- 2.38.1

2 3

RFC: New APIs for delegation of privileged operations
by Andrea Bolognani 08 Dec '22

08 Dec '22

Hi, this is a proposal for introducing a new family of APIs in libvirt, with the goal of improving integration with management applications. KubeVirt is intended to be the primary consumer of these APIs. Background ---------- KubeVirt makes it possible to run VMs on a Kubernetes cluster, side by side with containers. It does so by running QEMU and libvirtd themselves inside a container. The architecture is explained in more detail at https://kubevirt.io/user-guide/architecture/ but for the purpose of this discussion we only need to keep in mind two components: * virt-launcher - runs in the same container as QEMU and libvirtd - one instance per VM * virt-handler - runs in a separate container - one instance per node Conceptually, these two components roughly map to QEMU processes and libvirtd respectively. >From a security perspective, there is a strong push in Kubernetes to run workloads under unprivileged user accounts and without additional capabilities. Again, this is similar to how libvirtd itself runs as root but the QEMU processes it starts are under the unprivileged "qemu" account. KubeVirt has been working towards the goal of running VMs as completely unprivileged workloads and made excellent progress so far. Some of the operations needed for running a VM, however, inherently require elevated privilege. In KubeVirt, the conundrum is solved by having virt-handler (a privileged component) take care of those operations, making it possible for virt-launcher (as well as QEMU and libvirtd) to run in an unprivileged context. Examples -------- Here are a few examples of how KubeVirt has been able to reduce the privilege required by virt-launcher by selectively handing over responsibilities to virt-handler: * Remove SYS_RESOURCE capability from launcher pod https://github.com/kubevirt/kubevirt/pull/2584 * Drop SYS_RESOURCE capability https://github.com/kubevirt/kubevirt/pull/5558 * Housekeeping cgroup https://github.com/kubevirt/kubevirt/pull/8233 * Real time VMs fail to change vCPU scheduler and priority in non-root deployments https://github.com/kubevirt/kubevirt/pull/8750 * virt-launcher: Drop SYS_PTRACE capability https://github.com/kubevirt/kubevirt/pull/8842 The pattern we can see is that, initially, libvirt just assumes that it can perform a certain privileged operation. This fails in the context of KubeVirt, where libvirtd runs with significantly reduced privileges. As a consequence, libvirt is patched to be more resilient to such lack of privilege: for example, instead of attempting to create a file and erroring out due to lack of permissions, it will instead first check whether the file already exists and, if it does, assume that it has been prepared ahead of time by an external entity. Limitations ----------- This approach works fine, but only for the privileged operations that would be performed by libvirt before the VM starts running. Looking at the "housekeeping cgroup" PR in particular, we notice that the VM is initially created in paused state: this is necessary in order to create a point in time in which all the VM threads already exist but, crucially, none of the vCPUs have stated running yet. This is the only opportunity to move threads across cgroups without invalidating the expectations of a real time workload. When it comes to live migration, however, there is no way to create similar conditions, since the VM is running on the destination host right out of the gate. As a consequence, live migration has to be blocked when the housekeeping cgroup is in use, which is an unfortunate limitation. Moreover, there's an overall sense of fragility surrounding these interactions: both KubeVirt and, to some extent, libvirt need to be acutely aware of what the other component is going to do, but there is never an explicit handover and the whole thing only works if you just so happen to do everything with the exact right order and timing. Proposal -------- In order to address the issues outlined above, I propose that we introduce a new set of APIs in libvirt. These APIs would expose some of the inner workings of libvirt, and as such would come with *massively reduced* stability guarantees compared to the rest of our public API. The idea is that applications such as KubeVirt, which track libvirt fairly closely and stay pinned to specific versions, would be able to adapt to changes in these APIs relatively painlessly. More traditional management applications such as virt-manager would simply not opt into using the new APIs and maintain the status quo. Using memlock as an example, the new API could look like typedef int (*virInternalSetMaxMemLockHandler)(pid_t pid, unsigned long long bytes); int virInternalSetProcessSetMaxMemLockHandler(virConnectPtr conn, virInternalSetMaxMemLockHandler handler); The application-provided handler would be responsible for performing the privileged operation (in this case raising the memlock limit for a process). For KubeVirt, virt-launcher would have to pass the baton to virt-handler. If such an handler is installed, libvirt would invoke it (and likely go through some sanity checks afterwards); if not, it would attempt to perform the privileged operation itself, as it does today. This would make the interaction between libvirt and the management application explicit rather than implicit. Not having to stick to our usual API stability guarantees would make it possible to be more liberal in exposing the internals of libvirt as interaction points. Scope ----- I think we should initially limit the new APIs to the scenarios that have already been identified, then gradually expand the scope as needed. In other words, we shouldn't comb through the codebase looking for potential adopters. Since the intended consumers of these APIs are those that can adopt a new libvirt release fairly quickly, this shouldn't be a problem. Once the pattern has been established, we might consider introducing support for it at the same time as a new feature that might benefit from it is added. Caveats ------- libvirt is all about stable API, so introducing an API that is unstable *by design* is completely uncharted territory. To ensure that the new APIs are 100% opt-in, we could define them in a separate <libvirt/libvirt-internal.h> header. Furthermore, we could have a separate libvirt-internal.so shared library for the symbols and a corresponding libvirt-internal.pc pkg-config file. We could even go as far as requiring a preprocessor symbol such as VIR_INTERNAL_UNSTABLE_API_OPT_IN to be defined before the entry points are visible to the compiler. Whatever the mechanism, we would need to make sure that it's usable from language bindings as well. Internal APIs are amendable to not only come and go, but also change semantics between versions. We should make sure that such changes are clearly exposed to the user, for example by requiring them to pass a version number to the function and erroring out immediately if the value doesn't match our expectations. KubeVirt has a massive suite of functional tests, so this kind of change would immediately be spotted when a new version of libvirt is imported, with no risk of an incompatibility lingering in the codebase until it affects users. Disclaimer ---------- This proposal is intentionally vague on several of the details. Before attempting to nail those down, I want to gather feedback on the high-level idea, both from the libvirt and KubeVirt side. Credits ------- Thanks to Michal and Martin for helping shape and polish the idea from its initial rough state. -- Andrea Bolognani / Red Hat / Virtualization

7 15

[PATCH] tools: Fix install_mode for some scripts
by Michal Privoznik 08 Dec '22

08 Dec '22

Scripts from the following list were installed with group write bit set: virt-xml-validate, virt-pki-validate, virt-sanlock-cleanup, libvirt-guests.sh. This is very unusual and in contrast with the way other scripts/binaries are installed. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2151202 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tools/meson.build | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/meson.build b/tools/meson.build index c41c619af4..fad7f202ad 100644 --- a/tools/meson.build +++ b/tools/meson.build @@ -249,7 +249,7 @@ configure_file( configuration: tools_conf, install: true, install_dir: bindir, - install_mode: 'rwxrwxr-x', + install_mode: 'rwxr-xr-x', ) configure_file( @@ -258,7 +258,7 @@ configure_file( configuration: tools_conf, install: true, install_dir: bindir, - install_mode: 'rwxrwxr-x', + install_mode: 'rwxr-xr-x', ) executable( @@ -295,7 +295,7 @@ if conf.has('WITH_SANLOCK') configuration: tools_conf, install: true, install_dir: sbindir, - install_mode: 'rwxrwxr-x', + install_mode: 'rwxr-xr-x', ) endif @@ -311,7 +311,7 @@ if conf.has('WITH_LIBVIRTD') configuration: tools_conf, install: true, install_dir: libexecdir, - install_mode: 'rwxrwxr-x', + install_mode: 'rwxr-xr-x', ) if init_script == 'systemd' -- 2.37.4

3 2

Release of libvirt-php-0.5.7
by Michal Prívozník 07 Dec '22

07 Dec '22

The 0.5.7 release of libvirt-php is tagged and tarball is available at: https://libvirt.org/sources/php/ Notable changes: * Dropped support for PHP-6.0 and older * Fixed libvirt_connect_get_machine_types() with PHP-7.0 and newer * Dropped imagick dependency * Bug fixes Thanks to everybody who helped with this release. Michal

1 0

[PATCH v4] virsh: Add message to terminal when running snapshot-revert
by Haruka Ohata 07 Dec '22

07 Dec '22

When running virsh snapshot-* command, such as snapshot-create-as / snapshot-delete, it prints a result message. On the other hand virsh snapshot-revert command doesn't print a result message. So, This patch fixes to add message when running virsh snapshot-revert command. --- # virsh snapshot-create-as vm1 test1 Domain snapshot test01 created # virsh snapshot-revert vm1 test1 # virsh snapshot-delete vm1 test1 Domain snapshot test01 deleted # --- Signed-off-by: Haruka Ohata <ohata.haruka(a)fujitsu.com> --- tests/virsh-snapshot | 3 +++ tools/virsh-snapshot.c | 4 ++++ 2 files changed, 7 insertions(+) diff --git a/tests/virsh-snapshot b/tests/virsh-snapshot index 4c64bb537b..b09273917b 100755 --- a/tests/virsh-snapshot +++ b/tests/virsh-snapshot @@ -100,11 +100,14 @@ Domain snapshot s1 created Domain snapshot s3 created Domain snapshot s2 created +Domain snapshot s3 reverted Domain snapshot s6 created Domain snapshot s5 created +Domain snapshot s6 reverted Domain snapshot s4 created +Domain snapshot s1 reverted Domain snapshot s7 created Domain snapshot s8 created diff --git a/tools/virsh-snapshot.c b/tools/virsh-snapshot.c index 8fa64ba903..68908cd10a 100644 --- a/tools/virsh-snapshot.c +++ b/tools/virsh-snapshot.c @@ -1783,6 +1783,10 @@ cmdDomainSnapshotRevert(vshControl *ctl, const vshCmd *cmd) result = virDomainRevertToSnapshot(snapshot, flags); } + if (result < 0) + vshError(ctl, _("Failed to revert snapshot %s"), name); + else + vshPrintExtra(ctl, _("Domain snapshot %s reverted\n"), name); return result >= 0; } -- 2.38.1

2 1

[PATCH 0/5] qemu: Prefer PNG for domain screenshots
by Michal Privoznik 07 Dec '22

07 Dec '22

Whilst preparing for libvirt-php release, I want to ditch its imagick dependency which is needed to convert PPM to PNG. But I've learned that QEMU is able to return PNG already which looks more versatile than PPM anyways. Michal Prívozník (5): qemu_caps: Introduce QEMU_CAPS_SCREENSHOT_FORMAT_PNG qemu_monitor: Debug print all arguments in qemuMonitorScreendump() qemu_monitor: Extend qemuMonitorScreendump() for @format qemu: Prefer PNG for domain screenshots NEWS: Document change of screenshot format for QEMU NEWS.rst | 4 ++++ src/qemu/qemu_capabilities.c | 2 ++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_driver.c | 13 +++++++++++-- src/qemu/qemu_monitor.c | 6 ++++-- src/qemu/qemu_monitor.h | 1 + src/qemu/qemu_monitor_json.c | 2 ++ src/qemu/qemu_monitor_json.h | 1 + tests/qemucapabilitiesdata/caps_7.1.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_7.1.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_7.2.0.x86_64.xml | 1 + tests/qemumonitorjsontest.c | 2 +- 12 files changed, 30 insertions(+), 5 deletions(-) -- 2.37.4

3 8

[libvirt PATCH v3] tools: add virt-qemu-qmp-proxy for proxying QMP via libvirt QEMU guests
by Daniel P. Berrangé 06 Dec '22

06 Dec '22

Libvirt provides QMP passthrough APIs for the QEMU driver and these are exposed in virsh. It is not especially pleasant, however, using the raw QMP JSON syntax. QEMU has a tool 'qmp-shell' which can speak QMP and exposes a human friendly interactive shell. It is not possible to use this with libvirt managed guest, however, since only one client can attach to the QMP socket at any point in time. While it would be possible to configure a second QMP socket for a VM, it may not be an known requirement at the time the guest is provisioned. The virt-qmp-proxy tool aims to solve this problem. It opens a UNIX socket and listens for incoming client connections, speaking QMP on the connected socket. It will forward any QMP commands received onto the running libvirt QEMU guest, and forward any replies back to the QMP client. It will also forward back events. $ virsh start demo $ virt-qmp-proxy demo demo.qmp & $ qmp-shell demo.qmp Welcome to the QMP low-level shell! Connected to QEMU 6.2.0 (QEMU) query-kvm { "return": { "enabled": true, "present": true } } Note this tool of course has the same risks as the raw libvirt QMP passthrough. It is safe to run query commands to fetch information but commands which change the QEMU state risk disrupting libvirt's management of QEMU, potentially resulting in data loss/corruption in the worst case. Any use of this tool will cause the guest to be marked as tainted as an warning that it could be in an unexpected state. Since this tool introduces a python dependency it is not desirable to include it in any of the existing RPMs in libvirt. This tool is also QEMU specific, so isn't appropriate to bundle with the generic tools. Thus a new RPM is introduced 'libvirt-clients-qemu', to contain additional QEMU specific tools, with extra external deps. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- In v3: - Added to libvirt-clients-qemu RPM - Renamed to virt-qemu-qmp-proxy docs/manpages/meson.build | 1 + docs/manpages/virt-qemu-qmp-proxy.rst | 120 +++++++++ libvirt.spec.in | 15 ++ tools/meson.build | 5 + tools/virt-qemu-qmp-proxy | 360 ++++++++++++++++++++++++++ 5 files changed, 501 insertions(+) create mode 100644 docs/manpages/virt-qemu-qmp-proxy.rst create mode 100755 tools/virt-qemu-qmp-proxy diff --git a/docs/manpages/meson.build b/docs/manpages/meson.build index ba673cf472..83933227d9 100644 --- a/docs/manpages/meson.build +++ b/docs/manpages/meson.build @@ -18,6 +18,7 @@ docs_man_files = [ { 'name': 'virt-pki-query-dn', 'section': '1', 'install': true }, { 'name': 'virt-pki-validate', 'section': '1', 'install': true }, { 'name': 'virt-qemu-run', 'section': '1', 'install': conf.has('WITH_QEMU') }, + { 'name': 'virt-qemu-qmp-proxy', 'section': '1', 'install': conf.has('WITH_QEMU') }, { 'name': 'virt-xml-validate', 'section': '1', 'install': true }, { 'name': 'libvirt-guests', 'section': '8', 'install': conf.has('WITH_LIBVIRTD') }, diff --git a/docs/manpages/virt-qemu-qmp-proxy.rst b/docs/manpages/virt-qemu-qmp-proxy.rst new file mode 100644 index 0000000000..b387474b19 --- /dev/null +++ b/docs/manpages/virt-qemu-qmp-proxy.rst @@ -0,0 +1,120 @@ +=================== +virt-qemu-qmp-proxy +=================== + +-------------------------------------------------- +Expose a QMP proxy server for a libvirt QEMU guest +-------------------------------------------------- + +:Manual section: 1 +:Manual group: Virtualization Support + +.. contents:: + + +SYNOPSIS +======== + +``virt-qemu-qmp-proxy`` [*OPTION*]... *DOMAIN* *QMP-SOCKET-PATH* + + +DESCRIPTION +=========== + +This tool provides a way to expose a QMP proxy server that communicates +with a QEMU guest managed by libvirt. This enables standard QMP client +tools to interact with libvirt managed guests. + +**NOTE: use of this tool will result in the running QEMU guest being +marked as tainted.** It is strongly recommended that this tool *only be +used to send commands which query information* about the running guest. +If this tool is used to make changes to the state of the guest, this +may have negative interactions with the QEMU driver, resulting in an +inability to manage the guest operation thereafter, and in the worst +case **potentially lead to data loss or corruption**. + +The ``virt-qemu-qmp-proxy`` program will listen on a UNIX socket for incoming +client connections, and run the QMP protocol over the connection. Any +commands received will be sent to the running libvirt guest, and replies +sent back. + +The ``virt-qemu-qmp-proxy`` program may be interrupted (eg Ctrl-C) when it +is no longer required. The libvirt QEMU guest will continue running. + + +OPTIONS +======= + +*DOMAIN* + +The ID or UUID or Name of the libvirt QEMU guest. + +*QMP-SOCKET-PATH* + +The filesystem path at which to run the QMP server, listening for +incoming connections. + +``-c`` *CONNECTION-URI* +``--connect``\ =\ *CONNECTION-URI* + +The URI for the connection to the libvirt QEMU driver. If omitted, +a URI will be auto-detected. + +``-v``, ``--verbose`` + +Run in verbose mode, printing all QMP commands and replies that +are handled. + +``-h``, ``--help`` + +Display the command line help. + + +EXIT STATUS +=========== + +Upon successful shutdown, an exit status of 0 will be set. Upon +failure a non-zero status will be set. + + +AUTHOR +====== + +Daniel P. Berrangé + + +BUGS +==== + +Please report all bugs you discover. This should be done via either: + +#. the mailing list + + `https://libvirt.org/contact.html <https://libvirt.org/contact.html>`_ + +#. the bug tracker + + `https://libvirt.org/bugs.html <https://libvirt.org/bugs.html>`_ + +Alternatively, you may report bugs to your software distributor / vendor. + +COPYRIGHT +========= + +Copyright (C) 2022 by Red Hat, Inc. + + +LICENSE +======= + +``virt-qemu-qmp-proxy`` is distributed under the terms of the GNU LGPL v2+. +This is free software; see the source for copying conditions. There +is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR +PURPOSE + + +SEE ALSO +======== + +virsh(1), `https://libvirt.org/ <https://libvirt.org/>`_, +`QMP reference <https://www.qemu.org/docs/master/interop/qemu-qmp-ref.html>`_ diff --git a/libvirt.spec.in b/libvirt.spec.in index 950c5a3b6d..3082285dc0 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -899,6 +899,15 @@ Obsoletes: libvirt-bash-completion < 7.3.0 The client binaries needed to access the virtualization capabilities of recent versions of Linux (and other OSes). +%package client-qemu +Summary: Additional client side utilities for QEMU +Requires: %{name}-libs = %{version}-%{release} +Requires: python3-libvirt >= %{version}-%{release} + +%description client-qemu +The additional client binaries are used to interact +with some QEMU specific features of libvirt. + %package libs Summary: Client side libraries # So remote clients can access libvirt over SSH tunnel @@ -2159,6 +2168,12 @@ exit 0 %{_datadir}/bash-completion/completions/virsh +%if %{with_qemu} +%files client-qemu +%{_mandir}/man1/virt-qemu-qmp-proxy.1* +%{_bindir}/virt-qemu-qmp-proxy +%endif + %files libs -f %{name}.lang %license COPYING COPYING.LESSER %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/ diff --git a/tools/meson.build b/tools/meson.build index bb28a904dc..20509906af 100644 --- a/tools/meson.build +++ b/tools/meson.build @@ -320,6 +320,11 @@ if conf.has('WITH_LIBVIRTD') endif endif +if conf.has('WITH_QEMU') + install_data('virt-qemu-qmp-proxy', + install_dir: bindir) +endif + if bash_completion_dep.found() subdir('bash-completion') endif diff --git a/tools/virt-qemu-qmp-proxy b/tools/virt-qemu-qmp-proxy new file mode 100755 index 0000000000..d85342bd2b --- /dev/null +++ b/tools/virt-qemu-qmp-proxy @@ -0,0 +1,360 @@ +#!/usr/bin/env python3 + +import argparse +import array +import libvirt +import libvirt_qemu +import os +import re +import socket +import sys +import traceback +import json +import fcntl + + +debug = False + +def get_domain(uri, domstr): + conn = libvirt.open(uri) + + dom = None + saveex = None + + def try_lookup(cb): + try: + return cb() + except libvirt.libvirtError as ex: + nonlocal saveex + if saveex is None: + saveex = ex + + if re.match(r'^\d+$', domstr): + dom = try_lookup(lambda: conn.lookupByID(int(domstr))) + + if dom is None and re.match(r'^[-a-f0-9]{36}|[a-f0-9]{32}$', domstr): + dom = try_lookup(lambda: conn.lookupByUUIDString(domstr)) + + if dom is None: + dom = try_lookup(lambda: conn.lookupByName(domstr)) + + if dom is None: + raise saveex + + if not dom.isActive(): + raise Exception("Domain must be running to use QMP") + + return conn, dom + + +class QMPProxy(object): + + def __init__(self, conn, dom, serversock, verbose): + self.conn = conn + self.dom = dom + self.verbose = verbose + + self.serversock = serversock + self.serverwatch = 0 + + self.clientsock = None + self.clientwatch = 0 + + self.api2sock = bytes([]) + self.api2sockfds = [] + + self.sock2api = bytes([]) + self.sock2apifds = [] + + self.serverwatch = libvirt.virEventAddHandle( + self.serversock.fileno(), libvirt.VIR_EVENT_HANDLE_READABLE, + self.handle_server_io, self) + + libvirt_qemu.qemuMonitorEventRegister(self.conn, self.dom, + None, + self.handle_qmp_event, + self) + + + @staticmethod + def handle_qmp_event(conn, dom, event, secs, usecs, details, self): + evdoc = { + "event": event, + "timestamp": {"seconds": secs, "microseconds": usecs } + } + if details is not None: + evdoc["data"] = details + + ev = json.dumps(evdoc) + if self.verbose: + print(ev) + ev += "\r\n" + self.api2sock += ev.encode("utf-8") + self.update_client_events() + + + def recv_with_fds(self): + # Match VIR_NET_MESSAGE_NUM_FDS_MAX in virnetprotocol.x + maxfds = 32 + fds = array.array('i') + cmsgdatalen = socket.CMSG_LEN(maxfds * fds.itemsize) + + data, cmsgdata, flags, addr = self.clientsock.recvmsg(1024, + cmsgdatalen) + for cmsg_level, cmsg_type, cmsg_data in cmsgdata: + if (cmsg_level == socket.SOL_SOCKET and + cmsg_type == socket.SCM_RIGHTS): + fds.frombytes(cmsg_data[:len(cmsg_data) - + (len(cmsg_data) % fds.itemsize)]) + else: + raise Exception("Unexpected CMSGDATA level %d type %d" % ( + cmsg_level, cmsg_type)) + + return data, [self.make_file(fd) for fd in fds] + + + def send_with_fds(self, data, fds): + cfds = [fd.fileno() for fd in fds] + + cmsgdata = [(socket.SOL_SOCKET, socket.SCM_RIGHTS, + array.array("i", cfds))] + + return self.clientsock.sendmsg([data], cmsgdata) + + + @staticmethod + def make_file(fd): + flags = fcntl.fcntl(fd, fcntl.F_GETFL) + + mask = os.O_RDONLY | os.O_WRONLY | os.O_RDWR | os.O_APPEND + flags = flags & mask + mode = "" + if flags == os.O_RDONLY: + mode = "rb" + elif flags == os.O_WRONLY: + mode = "wb" + elif flags == os.O_RDWR: + mode = "r+b" + elif flags == (os.O_WRONLY | os.O_APPEND): + mode = "ab" + elif flags == (os.O_RDWR | os.O_APPEND): + mode = "a+b" + + return os.fdopen(fd, mode) + + + def add_client(self, sock): + ver = self.conn.getVersion() + major = int(ver / 1000000) % 1000 + minor = int(ver / 1000) % 1000 + micro = ver % 1000 + + greetingobj = { + "QMP": { + "version": { + "qemu": { + "major": major, + "minor": minor, + "micro": micro, + }, + "package": f"qemu-{major}.{minor}.{micro}", + }, + "capabilities": [ + "oob" + ], + } + } + greeting = json.dumps(greetingobj) + if self.verbose: + print(greeting) + greeting += "\r\n" + + self.clientsock = sock + self.clientwatch = libvirt.virEventAddHandle( + self.clientsock.fileno(), libvirt.VIR_EVENT_HANDLE_WRITABLE, + self.handle_client_io, self) + self.api2sock += greeting.encode("utf-8") + self.update_server_events() + + + def remove_client(self): + libvirt.virEventRemoveHandle(self.clientwatch) + self.clientsock.close() + self.clientsock = None + self.clientwatch = 0 + self.update_server_events() + + self.api2sock = bytes([]) + self.api2sockfds = [] + + self.sock2api = bytes([]) + self.sock2apifds = [] + + + def update_client_events(self): + # For simplicity of tracking distinct QMP cmds and their passed FDs + # we don't try to support "pipelining", only a single cmd may be + # inflight + if len(self.api2sock) > 0: + events = libvirt.VIR_EVENT_HANDLE_WRITABLE + else: + events = libvirt.VIR_EVENT_HANDLE_READABLE + + libvirt.virEventUpdateHandle(self.clientwatch, events) + + + def update_server_events(self): + if self.clientsock is not None: + libvirt.virEventUpdateHandle(self.serverwatch, 0) + else: + libvirt.virEventUpdateHandle(self.serverwatch, + libvirt.VIR_EVENT_HANDLE_READABLE) + + + def try_command(self): + try: + cmdstr = self.sock2api.decode("utf-8") + cmd = json.loads(cmdstr) + + if self.verbose: + cmdstr = cmdstr.strip() + print(cmdstr) + except Exception as ex: + if debug: + print("Incomplete %s: %s" % ( self.sock2api, ex)) + return + + id = None + if "id" in cmd: + id = cmd["id"] + del cmd["id"] + + if cmd.get("execute", "") == "qmp_capabilities": + resobj = { + "return": {}, + } + resfds = [] + else: + if hasattr(libvirt_qemu, "qemuMonitorCommandWithFiles"): + res, resfds = libvirt_qemu.qemuMonitorCommandWithFiles( + self.dom, json.dumps(cmd), [f.fileno() for f in self.sock2apifds]) + resobj = json.loads(res) + else: + if len(self.sock2apifds) > 0: + raise Exception("FD passing not supported") + res = libvirt_qemu.qemuMonitorCommand( + self.dom, json.dumps(cmd)) + resfds = [] + resobj = json.loads(res) + + if "id" in resobj: + del resobj["id"] + if id is not None: + resobj["id"] = id + + res = json.dumps(resobj) + if self.verbose: + print(res) + res += "\r\n" + + self.sock2api = bytes([]) + self.sock2apifds = [] + self.api2sock += res.encode("utf-8") + self.api2sockfds = resfds + + + @staticmethod + def handle_client_io(watch, fd, events, self): + error = False + try: + if events & libvirt.VIR_EVENT_HANDLE_WRITABLE: + done = self.send_with_fds(self.api2sock, self.api2sockfds) + if done > 0: + self.api2sock = self.api2sock[done:] + self.api2sockfds = [] + elif events & libvirt.VIR_EVENT_HANDLE_READABLE: + data, fds = self.recv_with_fds() + if len(data) == 0: + error = True + else: + self.sock2api += data + if len(fds): + self.sock2apifds += fds + + self.try_command() + else: + error = True + except Exception as e: + global debug + if debug: + print("%s: %s" % (sys.argv[0], str(e))) + print(traceback.format_exc()) + error = True + + if error: + self.remove_client() + else: + self.update_client_events() + + + @staticmethod + def handle_server_io(watch, fd, events, self): + if self.clientsock is None: + sock, addr = self.serversock.accept() + self.add_client(sock) + else: + self.update_server_events() + + +def parse_commandline(): + parser = argparse.ArgumentParser(description="Libvirt QMP proxy") + parser.add_argument("--connect", "-c", + help="Libvirt QEMU driver connection URI") + parser.add_argument("--debug", "-d", action='store_true', + help="Display debugging information") + parser.add_argument("--verbose", "-v", action='store_true', + help="Display QMP traffic") + parser.add_argument("domain", metavar="DOMAIN", + help="Libvirt guest domain ID/UUID/Name") + parser.add_argument("sockpath", metavar="QMP-SOCK-PATH", + help="UNIX socket path for QMP server") + + return parser.parse_args() + + +def main(): + args = parse_commandline() + global debug + debug = args.debug + + if not debug: + libvirt.registerErrorHandler(lambda opaque, error: None, None) + + libvirt.virEventRegisterDefaultImpl() + + conn, dom = get_domain(args.connect, args.domain) + + if conn.getType() != "QEMU": + raise Exception("QMP proxy requires a QEMU driver connection not %s" % + conn.getType()) + + sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) + if os.path.exists(args.sockpath): + os.unlink(args.sockpath) + sock.bind(args.sockpath) + sock.listen(1) + + proxy = QMPProxy(conn, dom, sock, args.verbose) + + while True: + libvirt.virEventRunDefaultImpl() + + +try: + main() + sys.exit(0) +except Exception as e: + print("%s: %s" % (sys.argv[0], str(e))) + if debug: + print(traceback.format_exc()) + sys.exit(1) -- 2.37.3

3 6

[PATCH] spec: Remove extra blank lines
by Jim Fehlig 06 Dec '22

06 Dec '22

The spec file contains inconsistent use of blank lines. While trying to make significant changes to the file, I found it hurts both readability and maintainability. Remove blank lines that interrupt the overall flow and consistency. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- libvirt.spec.in | 91 ------------------------------------------------- 1 file changed, 91 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index d07a43c721..562baea52e 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -138,7 +138,6 @@ %define with_netcf 0%{!?_without_netcf:1} %endif - # fuse is used to provide virtualized /proc for LXC %if %{with_lxc} %define with_fuse 0%{!?_without_fuse:1} @@ -258,7 +257,6 @@ Obsoletes: libvirt-daemon-uml <= 5.0.0 Requires: libvirt-daemon-driver-vbox = %{version}-%{release} %endif Requires: libvirt-daemon-driver-nwfilter = %{version}-%{release} - Requires: libvirt-daemon-driver-interface = %{version}-%{release} Requires: libvirt-daemon-driver-secret = %{version}-%{release} Requires: libvirt-daemon-driver-storage = %{version}-%{release} @@ -358,33 +356,25 @@ BuildRequires: libwsman-devel >= 2.6.3 BuildRequires: audit-libs-devel # we need /usr/sbin/dtrace BuildRequires: systemtap-sdt-devel - # For mount/umount in FS driver BuildRequires: util-linux # For showmount in FS driver (netfs discovery) BuildRequires: nfs-utils - # Fedora build root suckage BuildRequires: gawk - # For storage wiping with different algorithms BuildRequires: scrub - %if %{with_numad} BuildRequires: numad %endif - %if %{with_wireshark} BuildRequires: wireshark-devel %endif - %if %{with_libssh} BuildRequires: libssh-devel >= 0.8.1 %endif - BuildRequires: rpcgen BuildRequires: libtirpc-devel - # Needed for the firewalld_reload macro %if %{with_firewalld_zone} BuildRequires: firewalld-filesystem @@ -404,7 +394,6 @@ BuildRequires: mingw32-portablexdr BuildRequires: mingw32-dlfcn BuildRequires: mingw32-libssh2 BuildRequires: mingw32-curl - BuildRequires: mingw64-filesystem BuildRequires: mingw64-gcc BuildRequires: mingw64-binutils @@ -440,28 +429,23 @@ Summary: Server side daemon and supporting files for libvirt library # The client side, i.e. shared libs are in a subpackage Requires: libvirt-libs = %{version}-%{release} - # The libvirt-guests.sh script requires virsh from libvirt-client subpackage, # but not every deployment wants to use libvirt-guests service. Using # Recommends here will install libvirt-client by default (if available), but # RPM won't complain if the package is unavailable, masked, or removed later. Recommends: libvirt-client = %{version}-%{release} - # netcat is needed on the server side so that clients that have # libvirt < 6.9.0 can connect, but newer versions will prefer # virt-ssh-helper. Making this a Recommends means that it gets # installed by default, but can still be removed if compatibility # with old clients is not required Recommends: /usr/bin/nc - # for modprobe of pci devices Requires: module-init-tools - # for /sbin/ip Requires: iproute # for /sbin/tc Requires: iproute-tc - Requires: polkit >= 0.112 %if %{with_dmidecode} # For virConnectGetSysinfo @@ -523,7 +507,6 @@ The network driver plugin for the libvirtd daemon, providing an implementation of the virtual network APIs using the Linux bridge capabilities. - %package daemon-driver-nwfilter Summary: Nwfilter driver plugin for the libvirtd daemon Requires: libvirt-daemon = %{version}-%{release} @@ -536,7 +519,6 @@ The nwfilter driver plugin for the libvirtd daemon, providing an implementation of the firewall APIs using the ebtables, iptables and ip6tables capabilities - %package daemon-driver-nodedev Summary: Nodedev driver plugin for the libvirtd daemon Requires: libvirt-daemon = %{version}-%{release} @@ -551,7 +533,6 @@ The nodedev driver plugin for the libvirtd daemon, providing an implementation of the node device APIs using the udev capabilities. - %package daemon-driver-interface Summary: Interface driver plugin for the libvirtd daemon Requires: libvirt-daemon = %{version}-%{release} @@ -604,7 +585,6 @@ Requires: lvm2 The storage driver backend adding implementation of the storage APIs for block volumes using lvm. - %package daemon-driver-storage-disk Summary: Storage driver plugin for disk Requires: libvirt-daemon-driver-storage-core = %{version}-%{release} @@ -616,7 +596,6 @@ Requires: device-mapper The storage driver backend adding implementation of the storage APIs for block volumes using the host disks. - %package daemon-driver-storage-scsi Summary: Storage driver plugin for local scsi devices Requires: libvirt-daemon-driver-storage-core = %{version}-%{release} @@ -626,7 +605,6 @@ Requires: libvirt-libs = %{version}-%{release} The storage driver backend adding implementation of the storage APIs for scsi host devices. - %package daemon-driver-storage-iscsi Summary: Storage driver plugin for iscsi Requires: libvirt-daemon-driver-storage-core = %{version}-%{release} @@ -637,7 +615,6 @@ Requires: iscsi-initiator-utils The storage driver backend adding implementation of the storage APIs for iscsi volumes using the host iscsi stack. - %if %{with_storage_iscsi_direct} %package daemon-driver-storage-iscsi-direct Summary: Storage driver plugin for iscsi-direct @@ -649,7 +626,6 @@ The storage driver backend adding implementation of the storage APIs for iscsi volumes using libiscsi direct connection. %endif - %package daemon-driver-storage-mpath Summary: Storage driver plugin for multipath volumes Requires: libvirt-daemon-driver-storage-core = %{version}-%{release} @@ -660,7 +636,6 @@ Requires: device-mapper The storage driver backend adding implementation of the storage APIs for multipath storage using device mapper. - %if %{with_storage_gluster} %package daemon-driver-storage-gluster Summary: Storage driver plugin for gluster @@ -678,7 +653,6 @@ The storage driver backend adding implementation of the storage APIs for gluster volumes using libgfapi. %endif - %if %{with_storage_rbd} %package daemon-driver-storage-rbd Summary: Storage driver plugin for rbd @@ -690,7 +664,6 @@ The storage driver backend adding implementation of the storage APIs for rbd volumes using the ceph protocol. %endif - %if %{with_storage_zfs} %package daemon-driver-storage-zfs Summary: Storage driver plugin for ZFS @@ -705,7 +678,6 @@ The storage driver backend adding implementation of the storage APIs for ZFS volumes. %endif - %package daemon-driver-storage Summary: Storage driver plugin including all backends for the libvirtd daemon Requires: libvirt-daemon-driver-storage-core = %{version}-%{release} @@ -732,7 +704,6 @@ The storage driver plugin for the libvirtd daemon, providing an implementation of the storage APIs using LVM, iSCSI, parted and more. - %if %{with_qemu} %package daemon-driver-qemu Summary: QEMU driver plugin for the libvirtd daemon @@ -753,7 +724,6 @@ an implementation of the hypervisor driver APIs using QEMU %endif - %if %{with_lxc} %package daemon-driver-lxc Summary: LXC driver plugin for the libvirtd daemon @@ -769,7 +739,6 @@ an implementation of the hypervisor driver APIs using the Linux kernel %endif - %if %{with_vbox} %package daemon-driver-vbox Summary: VirtualBox driver plugin for the libvirtd daemon @@ -782,7 +751,6 @@ an implementation of the hypervisor driver APIs using VirtualBox %endif - %if %{with_libxl} %package daemon-driver-libxl Summary: Libxl driver plugin for the libvirtd daemon @@ -796,8 +764,6 @@ an implementation of the hypervisor driver APIs using Libxl %endif - - %if %{with_qemu_tcg} %package daemon-qemu Summary: Server side daemon & driver required to run QEMU guests @@ -817,7 +783,6 @@ Server side daemon and driver required to manage the virtualization capabilities of the QEMU TCG emulators %endif - %if %{with_qemu_kvm} %package daemon-kvm Summary: Server side daemon & driver required to run KVM guests @@ -837,7 +802,6 @@ Server side daemon and driver required to manage the virtualization capabilities of the KVM hypervisor %endif - %if %{with_lxc} %package daemon-lxc Summary: Server side daemon & driver required to run LXC guests @@ -856,7 +820,6 @@ Server side daemon and driver required to manage the virtualization capabilities of LXC %endif - %if %{with_libxl} %package daemon-xen Summary: Server side daemon & driver required to run XEN guests @@ -998,7 +961,6 @@ MinGW Windows libvirt virtualization library. %endif %prep - %autosetup -S git_am %build @@ -1152,7 +1114,6 @@ exit 1 %define who %{?packager}%{!?packager:Unknown} %define arg_packager -Dpackager="%{who}, %{when}, %{where}" %define arg_packager_version -Dpackager_version="%{release}" - %define arg_selinux_mount -Dselinux_mount="/sys/fs/selinux" # place macros above and build commands below this comment @@ -1396,7 +1357,6 @@ rm -rf $RPM_BUILD_ROOT%{mingw64_libexecdir}/libvirt-guests.sh %endif - %check # Building on slow archs, like emulated s390x in Fedora copr, requires # raising the test timeout @@ -1435,7 +1395,6 @@ fi \ # libvirtd. The uid number is irrelevant, so we use dynamic allocation # described at the above link. getent group libvirt >/dev/null || groupadd -r libvirt - exit 0 %post daemon @@ -1446,14 +1405,11 @@ exit 0 %else %libvirt_daemon_systemd_post_inet libvirtd %endif - %systemd_post libvirt-guests.service - %libvirt_daemon_schedule_restart libvirtd %preun daemon %systemd_preun libvirt-guests.service - %libvirt_daemon_systemd_preun_inet libvirtd %libvirt_daemon_systemd_preun_inet virtproxyd %libvirt_daemon_systemd_preun_priv virtlogd @@ -1499,7 +1455,6 @@ then /bin/systemctl start libvirtd.service >/dev/null 2>&1 || : fi fi - %libvirt_daemon_finish_restart libvirtd %pre daemon-driver-network @@ -1591,7 +1546,6 @@ fi %libvirt_sysconfig_posttrans virtsecretd %libvirt_daemon_perform_restart virtsecretd - %pre daemon-driver-storage-core %libvirt_sysconfig_pre virtstoraged @@ -1608,7 +1562,6 @@ fi %libvirt_sysconfig_posttrans virtstoraged %libvirt_daemon_perform_restart virtstoraged - %if %{with_qemu} %pre daemon-driver-qemu %libvirt_sysconfig_pre virtqemud @@ -1640,7 +1593,6 @@ exit 0 %libvirt_daemon_perform_restart virtqemud %endif - %if %{with_lxc} %pre daemon-driver-lxc %libvirt_sysconfig_pre virtlxcd @@ -1659,7 +1611,6 @@ exit 0 %libvirt_daemon_perform_restart virtlxcd %endif - %if %{with_vbox} %post daemon-driver-vbox %if %{with_modular_daemons} @@ -1678,7 +1629,6 @@ exit 0 %libvirt_daemon_perform_restart virtvboxd %endif - %if %{with_libxl} %post daemon-driver-libxl %if %{with_modular_daemons} @@ -1697,7 +1647,6 @@ exit 0 %libvirt_daemon_perform_restart virtxend %endif - %post daemon-config-network if test $1 -eq 1 && test ! -f %{_sysconfdir}/libvirt/qemu/networks/default.xml ; then # see if the network used by default network creates a conflict, @@ -1773,7 +1722,6 @@ exit 0 %doc libvirt-docs/* %files daemon - %{_unitdir}/libvirtd.service %{_unitdir}/libvirtd.socket %{_unitdir}/libvirtd-ro.socket @@ -1800,25 +1748,19 @@ exit 0 %config(noreplace) %{_sysconfdir}/libvirt/virtlockd.conf %config(noreplace) %{_sysconfdir}/sasl2/libvirt.conf %config(noreplace) %{_prefix}/lib/sysctl.d/60-libvirtd.conf - %config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd %dir %{_datadir}/libvirt/ - %ghost %dir %{_rundir}/libvirt/ %ghost %dir %{_rundir}/libvirt/common/ - %dir %attr(0755, root, root) %{_localstatedir}/lib/libvirt/ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/images/ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/filesystems/ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/boot/ %dir %attr(0711, root, root) %{_localstatedir}/cache/libvirt/ - - %dir %attr(0755, root, root) %{_libdir}/libvirt/ %dir %attr(0755, root, root) %{_libdir}/libvirt/connection-driver/ %dir %attr(0755, root, root) %{_libdir}/libvirt/lock-driver %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/lockd.so - %{_datadir}/augeas/lenses/libvirtd.aug %{_datadir}/augeas/lenses/tests/test_libvirtd.aug %{_datadir}/augeas/lenses/virtlogd.aug @@ -1831,23 +1773,17 @@ exit 0 %if %{with_qemu} %{_datadir}/augeas/lenses/tests/test_libvirt_lockd.aug %endif - %{_datadir}/polkit-1/actions/org.libvirt.unix.policy %{_datadir}/polkit-1/actions/org.libvirt.api.policy %{_datadir}/polkit-1/rules.d/50-libvirt.rules - %dir %attr(0700, root, root) %{_localstatedir}/log/libvirt/ - %attr(0755, root, root) %{_libexecdir}/libvirt_iohelper - %attr(0755, root, root) %{_bindir}/virt-ssh-helper - %attr(0755, root, root) %{_sbindir}/libvirtd %attr(0755, root, root) %{_sbindir}/virtproxyd %attr(0755, root, root) %{_sbindir}/virtlogd %attr(0755, root, root) %{_sbindir}/virtlockd %attr(0755, root, root) %{_libexecdir}/libvirt-guests.sh - %{_mandir}/man1/virt-admin.1* %{_mandir}/man1/virt-host-validate.1* %{_mandir}/man8/virt-ssh-helper.8* @@ -1856,7 +1792,6 @@ exit 0 %{_mandir}/man8/virtlogd.8* %{_mandir}/man8/virtlockd.8* %{_mandir}/man8/virtproxyd.8* - %{_bindir}/virt-host-validate %{_bindir}/virt-admin %{_datadir}/bash-completion/completions/virt-admin @@ -1903,7 +1838,6 @@ exit 0 %attr(0755, root, root) %{_libexecdir}/libvirt_leaseshelper %{_libdir}/libvirt/connection-driver/libvirt_driver_network.so %{_mandir}/man8/virtnetworkd.8* - %if %{with_firewalld_zone} %{_prefix}/lib/firewalld/zones/libvirt.xml %{_prefix}/lib/firewalld/zones/libvirt-routed.xml @@ -2165,7 +2099,6 @@ exit 0 %{_bindir}/virt-xml-validate %{_bindir}/virt-pki-query-dn %{_bindir}/virt-pki-validate - %{_datadir}/bash-completion/completions/virsh %if %{with_qemu} @@ -2187,17 +2120,13 @@ exit 0 %{_libdir}/libvirt-admin.so.* %dir %{_datadir}/libvirt/ %dir %{_datadir}/libvirt/schemas/ - %{_datadir}/systemtap/tapset/libvirt_probes*.stp %{_datadir}/systemtap/tapset/libvirt_functions.stp %if %{with_qemu} %{_datadir}/systemtap/tapset/libvirt_qemu_probes*.stp %endif - %{_datadir}/libvirt/schemas/*.rng - %{_datadir}/libvirt/cpu_map/*.xml - %{_datadir}/libvirt/test-screenshot.png %if %{with_wireshark} @@ -2245,7 +2174,6 @@ exit 0 %{_libdir}/pkgconfig/libvirt-admin.pc %{_libdir}/pkgconfig/libvirt-qemu.pc %{_libdir}/pkgconfig/libvirt-lxc.pc - %dir %{_datadir}/libvirt/api/ %{_datadir}/libvirt/api/libvirt-api.xml %{_datadir}/libvirt/api/libvirt-admin-api.xml @@ -2257,7 +2185,6 @@ exit 0 %dir %{mingw32_sysconfdir}/libvirt/ %config(noreplace) %{mingw32_sysconfdir}/libvirt/libvirt.conf %config(noreplace) %{mingw32_sysconfdir}/libvirt/libvirt-admin.conf - %{mingw32_bindir}/libvirt-0.dll %{mingw32_bindir}/virsh.exe %{mingw32_bindir}/virt-admin.exe @@ -2267,7 +2194,6 @@ exit 0 %{mingw32_bindir}/libvirt-lxc-0.dll %{mingw32_bindir}/libvirt-qemu-0.dll %{mingw32_bindir}/libvirt-admin-0.dll - %{mingw32_libdir}/libvirt.dll.a %{mingw32_libdir}/pkgconfig/libvirt.pc %{mingw32_libdir}/pkgconfig/libvirt-qemu.pc @@ -2276,23 +2202,17 @@ exit 0 %{mingw32_libdir}/libvirt-lxc.dll.a %{mingw32_libdir}/libvirt-qemu.dll.a %{mingw32_libdir}/libvirt-admin.dll.a - %dir %{mingw32_datadir}/libvirt/ %dir %{mingw32_datadir}/libvirt/schemas/ %{mingw32_datadir}/libvirt/schemas/*.rng - %dir %{mingw32_datadir}/libvirt/api/ %{mingw32_datadir}/libvirt/api/libvirt-api.xml %{mingw32_datadir}/libvirt/api/libvirt-lxc-api.xml %{mingw32_datadir}/libvirt/api/libvirt-qemu-api.xml %{mingw32_datadir}/libvirt/api/libvirt-admin-api.xml - %{mingw32_datadir}/libvirt/cpu_map/*.xml - %{mingw32_datadir}/libvirt/test-screenshot.png - %{mingw32_datadir}/locale/*/LC_MESSAGES/libvirt.mo - %dir %{mingw32_includedir}/libvirt %{mingw32_includedir}/libvirt/libvirt.h %{mingw32_includedir}/libvirt/libvirt-common.h @@ -2312,7 +2232,6 @@ exit 0 %{mingw32_includedir}/libvirt/libvirt-lxc.h %{mingw32_includedir}/libvirt/libvirt-qemu.h %{mingw32_includedir}/libvirt/libvirt-admin.h - %{mingw32_mandir}/man1/virsh.1* %{mingw32_mandir}/man1/virt-admin.1* %{mingw32_mandir}/man1/virt-xml-validate.1* @@ -2320,12 +2239,10 @@ exit 0 %{mingw32_mandir}/man1/virt-pki-validate.1* %{mingw32_mandir}/man7/virkey*.7* - %files -n mingw64-libvirt %dir %{mingw64_sysconfdir}/libvirt/ %config(noreplace) %{mingw64_sysconfdir}/libvirt/libvirt.conf %config(noreplace) %{mingw64_sysconfdir}/libvirt/libvirt-admin.conf - %{mingw64_bindir}/libvirt-0.dll %{mingw64_bindir}/virsh.exe %{mingw64_bindir}/virt-admin.exe @@ -2335,7 +2252,6 @@ exit 0 %{mingw64_bindir}/libvirt-lxc-0.dll %{mingw64_bindir}/libvirt-qemu-0.dll %{mingw64_bindir}/libvirt-admin-0.dll - %{mingw64_libdir}/libvirt.dll.a %{mingw64_libdir}/pkgconfig/libvirt.pc %{mingw64_libdir}/pkgconfig/libvirt-qemu.pc @@ -2344,23 +2260,17 @@ exit 0 %{mingw64_libdir}/libvirt-lxc.dll.a %{mingw64_libdir}/libvirt-qemu.dll.a %{mingw64_libdir}/libvirt-admin.dll.a - %dir %{mingw64_datadir}/libvirt/ %dir %{mingw64_datadir}/libvirt/schemas/ %{mingw64_datadir}/libvirt/schemas/*.rng - %dir %{mingw64_datadir}/libvirt/api/ %{mingw64_datadir}/libvirt/api/libvirt-api.xml %{mingw64_datadir}/libvirt/api/libvirt-lxc-api.xml %{mingw64_datadir}/libvirt/api/libvirt-qemu-api.xml %{mingw64_datadir}/libvirt/api/libvirt-admin-api.xml - %{mingw64_datadir}/libvirt/cpu_map/*.xml - %{mingw64_datadir}/libvirt/test-screenshot.png - %{mingw64_datadir}/locale/*/LC_MESSAGES/libvirt.mo - %dir %{mingw64_includedir}/libvirt %{mingw64_includedir}/libvirt/libvirt.h %{mingw64_includedir}/libvirt/libvirt-common.h @@ -2380,7 +2290,6 @@ exit 0 %{mingw64_includedir}/libvirt/libvirt-lxc.h %{mingw64_includedir}/libvirt/libvirt-qemu.h %{mingw64_includedir}/libvirt/libvirt-admin.h - %{mingw64_mandir}/man1/virsh.1* %{mingw64_mandir}/man1/virt-admin.1* %{mingw64_mandir}/man1/virt-xml-validate.1* -- 2.38.1

2 1

[libvirt PATCH 0/2] examples: Install amd-sev-es-vmsa.stp
by Andrea Bolognani 06 Dec '22

06 Dec '22

Andrea Bolognani (2): examples: Sort list examples: Install amd-sev-es-vmsa.stp examples/systemtap/meson.build | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) -- 2.38.1

2 3

[PATCH v2 0/2] qemu: refresh state after reset
by Kristina Hanicova 06 Dec '22

06 Dec '22

v1: https://listman.redhat.com/archives/libvir-list/2022-November/235913.html diff to v1: * calling refresh state unconditionally (suggested by Martin) * improved commit message Kristina Hanicova (2): qemu: refresh internal domain state after reset qemu: refresh state after reboot initiated from the guest src/qemu/qemu_domain.c | 1 + src/qemu/qemu_domain.h | 1 + src/qemu/qemu_driver.c | 19 +++++++++++++++++++ src/qemu/qemu_process.c | 2 ++ 4 files changed, 23 insertions(+) -- 2.38.1

2 3

[PATCH 0/7] qemu: support updating device's bootindex
by Jiang Jiacheng 06 Dec '22

06 Dec '22

Support updating device's(support cdrom, disk and network) bootindex online in virDomainUpdateDeviceFlags. The new bootindex will take effect after guest rebooting. Enable bootindex can be set to 0, it means cancel the device's bootindex. To use this feature, we need to get the device's xml first and modify the boot order in the xml, then use 'virsh update-device <domain> <xml> --flag' to update the bootindex. Note that the flag should be --config or --persistent if the vm is running. diff to v1: * add a bool bootIndexSpecified in device info to indicates that the bootorder of the device can be set. * use boot order = '0' to cancel the previous bootorder instead of '-1' Jiang Jiacheng (7): qemu: Introduce qemuDomainChangeBootIndex API qemu: Add bootIndexSpecified and support set bootIndex to '0' qemu: Introduce qemuCheckBootIndex and qemuChangeDiskBootIndex API qemu: Support update disk's bootindex qemu: Support update net's bootindex qemu: Support add bootindex = 0 to boothash when its bootIndexSpecified is true qemu: Reserve bootIndexSpecified when update device src/conf/device_conf.h | 3 + src/conf/domain_conf.c | 9 ++- src/conf/domain_postparse.c | 8 +- src/qemu/qemu_conf.c | 140 +++++++++++++++++++++++++++++++++++ src/qemu/qemu_conf.h | 16 ++++ src/qemu/qemu_domain.c | 3 +- src/qemu/qemu_driver.c | 35 +++++++++ src/qemu/qemu_hotplug.c | 17 +++-- src/qemu/qemu_monitor.c | 20 +++++ src/qemu/qemu_monitor.h | 6 ++ src/qemu/qemu_monitor_json.c | 33 +++++++++ src/qemu/qemu_monitor_json.h | 6 ++ 12 files changed, 286 insertions(+), 10 deletions(-) -- 2.33.0

2 21

Re: Call for FOSDEM presentations on QEMU, KVM, and rust-vmm
by Kashyap Chamarthy 05 Dec '22

05 Dec '22

(Cc also: libvirt upstream maling list) Gentle reminder ... tl;dr: please submit the proposals by *10th Dec 2022* On Tue, Nov 08, 2022 at 10:45:33AM -0500, Stefan Hajnoczi wrote: > Hi, > The yearly FOSDEM open source conference is now accepting talk > proposals. FOSDEM '23 will be held in Brussels, Belgium on 4 & 5 > February. > > FOSDEM is a huge free conference about all things open source and an > opportunity for anyone to present QEMU or KVM topics. Both in-person > and pre-recorded talks are being accepted this year. > > Please consider submitting your talks to the following devrooms: > > Emulator Development Room: > https://blackbeard334.github.io/fosdem23-emulator-devroom-cfp/ > > Virtualization and IaaS devroom: > https://fosdem.org/2023/schedule/track/virtualization_and_iaas/ > > Rust devroom: > https://rust-fosdem.github.io/ (I've re-posted the official announcement[0] along the way, I manually fixed the broken text formatting, a URL, and moved the "important dates" section to the top. [0] https://lists.fosdem.org/pipermail/fosdem/2022q4/003473.html) ----------------------------------------------------------------------- We are excited to announce that the call for proposals is now open for the Virtualization & IaaS devroom at the upcoming FOSDEM 2023, to be hosted on February 4th 2023. This devroom is a collaborative effort, and is organized by dedicated folks from projects such as OpenStack, Xen Project, KubeVirt, QEMU, KVM, and Foreman. We would like to invite all those who are involved in these fields to submit your proposals by December 10th, 2022. Important Dates --------------- Submission deadline: 10th December 2022 Acceptance notifications: 15th December 2022 Final schedule announcement: 20th December 2022 Conference devroom: first half of 4th February 2023 About the Devroom ----------------- The Virtualization & IaaS devroom will feature session topics such as open source hypervisors or virtual machine managers such as Xen Project, KVM, bhyve and VirtualBox as well as Infrastructure-as-a-Service projects such as KubeVirt, Apache CloudStack, OpenStack, QEMU and OpenNebula. This devroom will host presentations that focus on topics of shared interest, such as KVM; libvirt; shared storage; virtualized networking; cloud security; clustering and high availability; interfacing with multiple hypervisors; hyperconverged deployments; and scaling across hundreds or thousands of servers. Presentations in this devroom will be aimed at developers working on these platforms who are looking to collaborate and improve shared infrastructure or solve common problems. We seek topics that encourage dialog between projects and continued work post-FOSDEM. Submit Your Proposal -------------------- All submissions must be made via the Pentabarf event planning site[1]. If you have not used Pentabarf before, you will need to create an account. If you submitted proposals for FOSDEM in previous years, you can use your existing account. After creating the account, select Create Event to start the submission process. Make sure to select Virtualization and IaaS devroom from the Track list. Please fill out all the required fields, and provide a meaningful abstract and description of your proposed session. Submission Guidelines --------------------- We expect more proposals than we can possibly accept, so it is vitally important that you submit your proposal on or before the deadline. Late submissions are unlikely to be considered. All presentation slots are 30 minutes, with 20 minutes planned for presentations, and 10 minutes for Q&A. All presentations will be recorded and made available under Creative Commons licenses. In the Submission notes field, please indicate that you agree that your presentation will be licensed under the CC-By-SA-4.0 or CC-By-4.0 license and that you agree to have your presentation recorded. For example: "If my presentation is accepted for FOSDEM, I hereby agree to license all recordings, slides, and other associated materials under the Creative Commons Attribution Share-Alike 4.0 International License. Sincerely, <NAME>." In the Submission notes field, please also confirm that if your talk is accepted, you will be able to attend FOSDEM and deliver your presentation. We will not consider proposals from prospective speakers who are unsure whether they will be able to secure funds for travel and lodging to attend FOSDEM. (Sadly, we are not able to offer travel funding for prospective speakers.) Submission Guidelines --------------------- Mentored presentations will have 25-minute slots, where 20 minutes will include the presentation and 5 minutes will be reserved for questions. The number of newcomer session slots is limited, so we will probably not be able to accept all applications. You must submit your talk and abstract to apply for the mentoring program, our mentors are volunteering their time and will happily provide feedback but won't write your presentation for you! If you are experiencing problems with Pentabarf, the proposal submission interface, or have other questions, you can email our devroom mailing list[2] and we will try to help you. How to Apply ------------ In addition to agreeing to video recording and confirming that you can attend FOSDEM in case your session is accepted, please write "speaker mentoring program application" in the "Submission notes" field, and list any prior speaking experience or other relevant information for your application. Code of Conduct --------------- Following the release of the updated code of conduct for FOSDEM, we'd like to remind all speakers and attendees that all of the presentations and discussions in our devroom are held under the guidelines set in the CoC and we expect attendees, speakers, and volunteers to follow the CoC at all times. If you submit a proposal and it is accepted, you will be required to confirm that you accept the FOSDEM CoC. If you have any questions about the CoC or wish to have one of the devroom organizers review your presentation slides or any other content for CoC compliance, please email us and we will do our best to assist you. Call for Volunteers ------------------- We are also looking for volunteers to help run the devroom. We need assistance watching time for the speakers, and helping with video for the devroom. Please contact devroom mailing list[2] for more information. Questions? ---------- If you have any questions about this devroom, please send your questions to our devroom mailing list. You can also subscribe to the list to receive updates about important dates, session announcements, and to connect with other attendees. See you all at FOSDEM! [1] https://penta.fosdem.org/submission [2] iaas-virt-devroom at lists.fosdem.org ----------------------------------------------------------------------- -- /kashyap

1 0

[PATCH 0/4] qemu: Init ext devices paths on reconnect
by Michal Privoznik 05 Dec '22

05 Dec '22

*** BLURB HERE *** Michal Prívozník (4): qemu_process: Document qemuProcessPrepare{Domain,Host}() order qemu_extdevice: Init paths in qemuExtDevicesPrepareDomain() qemu_extdevice: Expose qemuExtDevicesInitPaths() qemu: Init ext devices paths on reconnect src/qemu/qemu_extdevice.c | 8 ++++---- src/qemu/qemu_extdevice.h | 5 +++++ src/qemu/qemu_process.c | 7 +++++++ 3 files changed, 16 insertions(+), 4 deletions(-) -- 2.37.4

2 5

[PATCH 0/7] Sanitize logic to get live/config device definitions for unplug/update
by Peter Krempa 05 Dec '22

05 Dec '22

Convert code *DomainUpdateDeviceFlags/*DomainDetachDeviceLiveAndConfig to avoid use of virDomainDeviceDefCopy. We have the original XML string from the user so it doesn't make sense to parse it and then copy it (whcih involves formatting and parsing back), when we can simply parse it twice, saving the extra formatting step. Peter Krempa (7): qemu: driver: Fix formatting of function headers around qemuDomainAttachDevice qemuDomainUpdateDeviceFlags: Parse XML twice rather than use virDomainDeviceDefCopy qemuDomainDetachDeviceLiveAndConfig: Parse XML twice rather than use virDomainDeviceDefCopy qemuDomainDetachDeviceLiveAndConfig: Refactor cleanup lxcDomainAttachDeviceFlags: Parse XML twice rather than use virDomainDeviceDefCopy lxcDomainDetachDeviceFlags: Parse XML twice rather than use virDomainDeviceDefCopy conf: domain: Remove virDomainDeviceDefCopy src/conf/domain_conf.c | 121 --------------------------------------- src/conf/domain_conf.h | 4 -- src/libvirt_private.syms | 1 - src/lxc/lxc_driver.c | 75 ++++++++++-------------- src/qemu/qemu_driver.c | 97 +++++++++++++------------------ 5 files changed, 70 insertions(+), 228 deletions(-) -- 2.37.3

2 8

[PATCH v3] qemu: Don't report spurious errors from vCPU tid validation on hotunplug timeout
by Peter Krempa 05 Dec '22

05 Dec '22

From: Shaleen Bathla <shaleen.bathla(a)oracle.com> Use of qemuDomainValidateVcpuInfo in the helpers for hotplug and unplug of vCPUs can lead to spurious errors reported such as: internal error: qemu didn't report thread id for vcpu 'XX'" The reason for this is that qemuDomainValidateVcpuInfo validates the state of all vCPUs against the expected state of vCPUs. If an unplug operation completed before libvirt was unable to process it yet the expected state could not reflect the current state. To avoid spurious errors the qemuDomainHotplugAddVcpu and qemuDomainRemoveVcpu functions are modified to do localized validation only for the vCPUs they actually modify. We also now ensure that the cgroups are modified before bailing out on error for any vCPUs which passed validation. Additionally in order for qemuDomainRemoveVcpuAlias to be able to find the unplugged vCPU we must ensure that qemuDomainRefreshVcpuInfo does not clear out the alias in case when the vCPU is no longer reported by qemu. Co-authored-by: Partha Satapathy <partha.satapathy(a)oracle.com> Signed-off-by: Shaleen Bathla <shaleen.bathla(a)oracle.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- v3 addresses my review feedback of the original patch, as well as rewrites the commit message for more clarity. src/qemu/qemu_domain.c | 6 +++-- src/qemu/qemu_hotplug.c | 53 ++++++++++++++++++++++++----------------- 2 files changed, 35 insertions(+), 24 deletions(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index ef1a9c8c74..64ebec626c 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -9795,8 +9795,10 @@ qemuDomainRefreshVcpuInfo(virDomainObj *vm, vcpupriv->vcpus = info[i].vcpus; VIR_FREE(vcpupriv->type); vcpupriv->type = g_steal_pointer(&info[i].type); - VIR_FREE(vcpupriv->alias); - vcpupriv->alias = g_steal_pointer(&info[i].alias); + if (info[i].alias) { + VIR_FREE(vcpupriv->alias); + vcpupriv->alias = g_steal_pointer(&info[i].alias); + } virJSONValueFree(vcpupriv->props); vcpupriv->props = g_steal_pointer(&info[i].props); vcpupriv->enable_id = info[i].id; diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index da92ced2f4..6e300f547c 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -6088,38 +6088,37 @@ qemuDomainRemoveVcpu(virDomainObj *vm, qemuDomainVcpuPrivate *vcpupriv = QEMU_DOMAIN_VCPU_PRIVATE(vcpuinfo); int oldvcpus = virDomainDefGetVcpus(vm->def); unsigned int nvcpus = vcpupriv->vcpus; - virErrorPtr save_error = NULL; size_t i; + ssize_t offlineVcpuWithTid = -1; if (qemuDomainRefreshVcpuInfo(vm, VIR_ASYNC_JOB_NONE, false) < 0) return -1; - /* validation requires us to set the expected state prior to calling it */ for (i = vcpu; i < vcpu + nvcpus; i++) { vcpuinfo = virDomainDefGetVcpu(vm->def, i); - vcpuinfo->online = false; + vcpupriv = QEMU_DOMAIN_VCPU_PRIVATE(vcpuinfo); + + if (vcpupriv->tid == 0) { + vcpuinfo->online = false; + /* Clear the alias as VCPU is now unplugged */ + VIR_FREE(vcpupriv->alias); + ignore_value(virCgroupDelThread(priv->cgroup, VIR_CGROUP_THREAD_VCPU, i)); + } else { + if (offlineVcpuWithTid == -1) + offlineVcpuWithTid = i; + } } - if (qemuDomainValidateVcpuInfo(vm) < 0) { - /* rollback vcpu count if the setting has failed */ + if (offlineVcpuWithTid != -1) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("qemu reported thread id for inactive vcpu '%zu'"), + offlineVcpuWithTid); virDomainAuditVcpu(vm, oldvcpus, oldvcpus - nvcpus, "update", false); - - for (i = vcpu; i < vcpu + nvcpus; i++) { - vcpuinfo = virDomainDefGetVcpu(vm->def, i); - vcpuinfo->online = true; - } return -1; } virDomainAuditVcpu(vm, oldvcpus, oldvcpus - nvcpus, "update", true); - virErrorPreserveLast(&save_error); - - for (i = vcpu; i < vcpu + nvcpus; i++) - ignore_value(virCgroupDelThread(priv->cgroup, VIR_CGROUP_THREAD_VCPU, i)); - - virErrorRestore(&save_error); - return 0; } @@ -6141,6 +6140,9 @@ qemuDomainRemoveVcpuAlias(virDomainObj *vm, return; } } + + VIR_DEBUG("vcpu '%s' not found in vcpulist of domain '%s'", + alias, vm->def->name); } @@ -6209,6 +6211,7 @@ qemuDomainHotplugAddVcpu(virQEMUDriver *driver, int rc; int oldvcpus = virDomainDefGetVcpus(vm->def); size_t i; + bool vcpuTidMissing = false; if (!qemuDomainSupportsNewVcpuHotplug(vm)) { virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", @@ -6238,20 +6241,26 @@ qemuDomainHotplugAddVcpu(virQEMUDriver *driver, if (qemuDomainRefreshVcpuInfo(vm, VIR_ASYNC_JOB_NONE, false) < 0) return -1; - /* validation requires us to set the expected state prior to calling it */ for (i = vcpu; i < vcpu + nvcpus; i++) { vcpuinfo = virDomainDefGetVcpu(vm->def, i); vcpupriv = QEMU_DOMAIN_VCPU_PRIVATE(vcpuinfo); vcpuinfo->online = true; - if (vcpupriv->tid > 0 && - qemuProcessSetupVcpu(vm, i, true) < 0) - return -1; + if (vcpupriv->tid > 0) { + if (qemuProcessSetupVcpu(vm, i, true) < 0) { + return -1; + } + } else { + vcpuTidMissing = true; + } } - if (qemuDomainValidateVcpuInfo(vm) < 0) + if (vcpuTidMissing && qemuDomainHasVcpuPids(vm)) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("qemu didn't report thread id for vcpu '%zu'"), i); return -1; + } qemuDomainVcpuPersistOrder(vm->def); -- 2.37.3

3 3

[PATCH 0/3] qemu_tpm: Set log file label on migration
by Michal Privoznik 02 Dec '22

02 Dec '22

See 3/3 for explanation. Michal Prívozník (3): security: Extend TPM label APIs qemu_tpm: Extend start/stop APIs qemu_tpm: Set log file label on migration src/qemu/qemu_security.c | 13 +++++++---- src/qemu/qemu_security.h | 4 +++- src/qemu/qemu_tpm.c | 22 +++++++++--------- src/security/security_driver.h | 6 +++-- src/security/security_manager.c | 10 +++++---- src/security/security_manager.h | 6 +++-- src/security/security_selinux.c | 40 +++++++++++++++++++++------------ src/security/security_stack.c | 12 +++++----- 8 files changed, 71 insertions(+), 42 deletions(-) -- 2.37.4

2 4

[PATCH 00/13] virsh: Don't reimplement virXPathNodeSet
by Peter Krempa 02 Dec '22

02 Dec '22

This series converts open-coded virXPathNodeSet to the proper helper use and also adds --print-xml option to commands using xmlXpathEval which didn't have it. Peter Krempa (13): virsh: Add --print-xml option for 'detach-interface' virshDomainDetachInterface: Use virXPathNodeSet instead of xmlXpathEval virsh: Add --print-xml option for 'domif-setlink' virsh: cmdDomIfSetLink: Use virXPathNodeSet instead of xmlXpathEval virsh: Refactor cleanup in 'cmdVolClone' virsh: Add --print-xml flag for 'vol-clone' command virsh: virshMakeCloneXML: Use virXPathNode instead of xmlXPathEval virsh: cmdDetachDisk: Refactor cleanup virsh: cmdChangeMedia: Refactor cleanup virshFindDisk: Use virXPathNodeSet instead of xmlXPathEval virshFindDisk: Sanitize removable media check util: xml: Introduce virXMLNodeGetSubelement virshFindDisk: Sanitize use of 'tmp' variable docs/manpages/virsh.rst | 15 +- src/libvirt_private.syms | 1 + src/util/virxml.c | 23 +++ src/util/virxml.h | 5 + tools/virsh-domain.c | 298 ++++++++++++++++++--------------------- tools/virsh-volume.c | 61 ++++---- 6 files changed, 207 insertions(+), 196 deletions(-) -- 2.38.1

2 16

[PATCH] spec: Remove use of %{name} macro
by Jim Fehlig 02 Dec '22

02 Dec '22

The spec file uses both "libvirt" and "%{name}", but in reality the expanded value of %{name} will never change. Drop the macro in favor of the explicit and more readable "libvirt". Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- libvirt.spec.in | 66 ++++++++++++++++++++++++------------------------- 1 file changed, 33 insertions(+), 33 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index fa94cda3c5..d07a43c721 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -439,13 +439,13 @@ Summary: Server side daemon and supporting files for libvirt library # for subpackages are listed later in those subpackages) # The client side, i.e. shared libs are in a subpackage -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} # The libvirt-guests.sh script requires virsh from libvirt-client subpackage, # but not every deployment wants to use libvirt-guests service. Using # Recommends here will install libvirt-client by default (if available), but # RPM won't complain if the package is unavailable, masked, or removed later. -Recommends: %{name}-client = %{version}-%{release} +Recommends: libvirt-client = %{version}-%{release} # netcat is needed on the server side so that clients that have # libvirt < 6.9.0 can connect, but newer versions will prefer @@ -896,7 +896,7 @@ capabilities of VirtualBox %package client Summary: Client side utilities of the libvirt library -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} # Needed by virt-pki-validate script. Requires: gnutls-utils @@ -909,7 +909,7 @@ capabilities of recent versions of Linux (and other OSes). %package client-qemu Summary: Additional client side utilities for QEMU -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} Requires: python3-libvirt >= 3.7.0 %description client-qemu @@ -931,7 +931,7 @@ Shared libraries for accessing the libvirt daemon. %package wireshark Summary: Wireshark dissector plugin for libvirt RPC transactions Requires: wireshark -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} %description wireshark Wireshark dissector plugin for better analysis of libvirt RPC traffic. @@ -940,7 +940,7 @@ Wireshark dissector plugin for better analysis of libvirt RPC traffic. %if %{with_lxc} %package login-shell Summary: Login shell for connecting users to an LXC container -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} %description login-shell Provides the set-uid virt-login-shell binary that is used to @@ -950,7 +950,7 @@ namespaces. %package devel Summary: Libraries, includes, etc. to compile with the libvirt library -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} Requires: pkgconfig %description devel @@ -962,8 +962,8 @@ Summary: Sanlock lock manager plugin for QEMU driver Requires: sanlock >= 2.4 #for virt-sanlock-cleanup require augeas Requires: augeas -Requires: %{name}-daemon = %{version}-%{release} -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-daemon = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} %description lock-sanlock Includes the Sanlock lock manager plugin for the QEMU @@ -1157,7 +1157,7 @@ exit 1 # place macros above and build commands below this comment -export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/%{name}.spec) +export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec) %meson \ -Drunstatedir=%{_rundir} \ @@ -1312,7 +1312,7 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/%{name}.spec) %install rm -fr %{buildroot} -export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/%{name}.spec) +export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec) %meson_install @@ -1882,7 +1882,7 @@ exit 0 %{_unitdir}/virtinterfaced-admin.socket %attr(0755, root, root) %{_sbindir}/virtinterfaced %ghost %dir %{_rundir}/libvirt/interface/ -%{_libdir}/%{name}/connection-driver/libvirt_driver_interface.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_interface.so %{_mandir}/man8/virtinterfaced.8* %files daemon-driver-network @@ -1901,7 +1901,7 @@ exit 0 %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/network/ %dir %attr(0755, root, root) %{_localstatedir}/lib/libvirt/dnsmasq/ %attr(0755, root, root) %{_libexecdir}/libvirt_leaseshelper -%{_libdir}/%{name}/connection-driver/libvirt_driver_network.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_network.so %{_mandir}/man8/virtnetworkd.8* %if %{with_firewalld_zone} @@ -1922,7 +1922,7 @@ exit 0 %{_unitdir}/virtnodedevd-admin.socket %attr(0755, root, root) %{_sbindir}/virtnodedevd %ghost %dir %{_rundir}/libvirt/nodedev/ -%{_libdir}/%{name}/connection-driver/libvirt_driver_nodedev.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_nodedev.so %{_mandir}/man8/virtnodedevd.8* %files daemon-driver-nwfilter @@ -1938,7 +1938,7 @@ exit 0 %ghost %dir %{_rundir}/libvirt/network/ %ghost %dir %{_rundir}/libvirt/nwfilter-binding/ %ghost %dir %{_rundir}/libvirt/nwfilter/ -%{_libdir}/%{name}/connection-driver/libvirt_driver_nwfilter.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_nwfilter.so %{_mandir}/man8/virtnwfilterd.8* %files daemon-driver-secret @@ -1952,7 +1952,7 @@ exit 0 %attr(0755, root, root) %{_sbindir}/virtsecretd %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/secrets/ %ghost %dir %{_rundir}/libvirt/secrets/ -%{_libdir}/%{name}/connection-driver/libvirt_driver_secret.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_secret.so %{_mandir}/man8/virtsecretd.8* %files daemon-driver-storage @@ -1970,45 +1970,45 @@ exit 0 %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/storage/ %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/storage/autostart/ %ghost %dir %{_rundir}/libvirt/storage/ -%{_libdir}/%{name}/connection-driver/libvirt_driver_storage.so -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_fs.so -%{_libdir}/%{name}/storage-file/libvirt_storage_file_fs.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_storage.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_fs.so +%{_libdir}/libvirt/storage-file/libvirt_storage_file_fs.so %{_mandir}/man8/virtstoraged.8* %files daemon-driver-storage-disk -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_disk.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_disk.so %files daemon-driver-storage-logical -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_logical.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_logical.so %files daemon-driver-storage-scsi -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_scsi.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_scsi.so %files daemon-driver-storage-iscsi -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_iscsi.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_iscsi.so %if %{with_storage_iscsi_direct} %files daemon-driver-storage-iscsi-direct -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_iscsi-direct.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_iscsi-direct.so %endif %files daemon-driver-storage-mpath -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_mpath.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_mpath.so %if %{with_storage_gluster} %files daemon-driver-storage-gluster -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_gluster.so -%{_libdir}/%{name}/storage-file/libvirt_storage_file_gluster.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_gluster.so +%{_libdir}/libvirt/storage-file/libvirt_storage_file_gluster.so %endif %if %{with_storage_rbd} %files daemon-driver-storage-rbd -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_rbd.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_rbd.so %endif %if %{with_storage_zfs} %files daemon-driver-storage-zfs -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_zfs.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_zfs.so %endif %if %{with_qemu} @@ -2044,7 +2044,7 @@ exit 0 %dir %attr(0750, root, root) %{_localstatedir}/cache/libvirt/qemu/ %{_datadir}/augeas/lenses/libvirtd_qemu.aug %{_datadir}/augeas/lenses/tests/test_libvirtd_qemu.aug -%{_libdir}/%{name}/connection-driver/libvirt_driver_qemu.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_qemu.so %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/swtpm/ %dir %attr(0730, tss, tss) %{_localstatedir}/log/swtpm/libvirt/qemu/ %{_bindir}/virt-qemu-run @@ -2072,7 +2072,7 @@ exit 0 %{_datadir}/augeas/lenses/libvirtd_lxc.aug %{_datadir}/augeas/lenses/tests/test_libvirtd_lxc.aug %attr(0755, root, root) %{_libexecdir}/libvirt_lxc -%{_libdir}/%{name}/connection-driver/libvirt_driver_lxc.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_lxc.so %{_mandir}/man8/virtlxcd.8* %endif @@ -2100,7 +2100,7 @@ exit 0 %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/libxl/channel/target/ %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/libxl/dump/ %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/libxl/save/ -%{_libdir}/%{name}/connection-driver/libvirt_driver_libxl.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_libxl.so %{_mandir}/man8/virtxend.8* %endif @@ -2114,7 +2114,7 @@ exit 0 %{_unitdir}/virtvboxd-ro.socket %{_unitdir}/virtvboxd-admin.socket %attr(0755, root, root) %{_sbindir}/virtvboxd -%{_libdir}/%{name}/connection-driver/libvirt_driver_vbox.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_vbox.so %{_mandir}/man8/virtvboxd.8* %endif -- 2.38.1

2 1

[PATCH 00/12] JSON monitor handling cleanups and spurious error bug fix
by Peter Krempa 02 Dec '22

02 Dec '22

First half introduces qemuMonitorJSONGetReply and uses it in our code base, second half introduces virJSONValueArrayToStringList, uses it to fix a bug and refactor the rest of the usage. Peter Krempa (12): qemu: monitor: Introduce qemuMonitorJSONGetReply, a better qemuMonitorJSONCheckReply qemu: monitor: Use qemuMonitorJSONGetReply for VIR_JSON_TYPE_OBJECT qemu: monitor: Use qemuMonitorJSONGetReply for VIR_JSON_TYPE_ARRAY qemu: monitor: Use qemuMonitorJSONGetReply when the value is extracted directly qemu: monitor: Unify and refactor 'PTY' case in qemuMonitorJSONAttachCharDev util: json: Split out array->strinlist conversion from virJSONValueObjectGetStringArray qemuAgentGetDisks: Don't use virJSONValueObjectGetStringArray for optional data qemuMonitorJSONGetCPUDefinitions: Rework lookup of 'unavailable-features' qemuMonitorJSONGetCPUDefinitions: Avoid double lookup of object qemu: monitor: Use qemuMonitorJSONGetReply in conjunction with virJSONValueArrayToStringList qemuAgentSSHGetAuthorizedKeys: Convert last use ofvirJSONValueObjectGetStringArray util: json: Remove unused virJSONValueObjectGetStringArray wrapper src/libvirt_private.syms | 2 +- src/qemu/qemu_agent.c | 13 ++- src/qemu/qemu_monitor_json.c | 189 +++++++++++++++-------------------- src/util/virjson.c | 44 +++----- src/util/virjson.h | 3 +- 5 files changed, 106 insertions(+), 145 deletions(-) -- 2.38.1

2 13

[PATCH] commandtest: Comply with FreeBSD poll()
by Michal Privoznik 01 Dec '22

01 Dec '22

In one of recent commits I've introduced a new test case to commandtest. In the test case I'm using poll() to wait for data on a pipe (the write end is passed to commandhelper). However, on FreeBSD the POLLIN semantic is a bit different: POLLIN Data other than high priority data may be read without blocking. Well, the pipe is non-blocking, so even if there's no data to be read the flag is set (and subsequent read() returns 0). On the other hand, POLLHUP is set too, BUT, if the commandhelper manages to write everything into the pipe and die right after we'd get both POLLIN and POLLHUP after the very first time poll() returns. That's very unfortunate, but okay - we can just check whether read() returned zero and break from the reading loop. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tests/commandtest.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/commandtest.c b/tests/commandtest.c index 62275ba96d..688cf59160 100644 --- a/tests/commandtest.c +++ b/tests/commandtest.c @@ -1205,6 +1205,9 @@ test29(const void *unused G_GNUC_UNUSED) goto cleanup; } + if (rc == 0) + break; + outactual = g_renew(char, outactual, outactuallen + rc + 1); memcpy(outactual + outactuallen, buf, rc); outactuallen += rc; -- 2.37.4

2 1

Release of libvirt-8.10.0
by Jiri Denemark 01 Dec '22

01 Dec '22

The 8.10.0 release of both libvirt and libvirt-python is tagged and signed tarballs and source RPMs are available at https://libvirt.org/sources/ https://libvirt.org/sources/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * New features * Tool for validating SEV firmware boot measurement of QEMU VMs The ``virt-qemu-sev-validate`` program will compare a reported SEV/SEV-ES domain launch measurement, to a computed launch measurement. This determines whether the domain has been tampered with during launch. * Support for SGX EPC (enclave page cache) Users can add a ``<memory model='sgx-epc'>`` device to lauch a VM with ``Intel Software Guard Extensions``. * Support migration of vTPM state of QEMU vms on shared storage Pass ``--migration`` option if appropriate in order for ``swtpm`` to properly migrate on shared storage. * Improvements * Mark close callback (un-)register API as high priority High priority APIs use a separate thread pool thus can help in eliminating problems with stuck VMs. Marking the close callback API as high priority allows ``virsh`` to properly connect to the daemon in case the normal priority workers are stuck allowing other high priority API usage. * Updated x86 CPU features The following features for the x86 platform were added: ``v-vmsave-vmload``, ``vgif``, ``avx512-vp2intersect``, ``avx512-fp16``, ``serialize``, ``tsx-ldtrk``, ``arch-lbr``, ``xfd``, ``intel-pt-lip``, ``avic``, ``sgx``, ``sgxlc``, ``sgx-exinfo``, ``sgx1``, ``sgx2``, ``sgx-debug``, ``sgx-mode64``, ``sgx-provisionkey``, ``sgx-tokenkey``, ``sgx-kss``, ``bus-lock-detect``, ``pks``, ``amx``. * Add support for ``hv-avic`` Hyper-V enlightenment ``qemu-6.2`` introduced support for the ``hv-avic`` enlightenment which allows to use Hyper-V SynIC with hardware APICv/AVIC enabled. * qemu: Run memory preallocation with numa-pinned threads Run the thread allocating memory in the proper NUMA node to reduce overhead. * RPM packaging changes - add optional dependancy of ``libvirt-daemon`` on ``libvirt-client`` The ``libvirt-guests.`` tool requires the ``virsh`` client to work properly, but we don't want to require the installation of the daemon if the tool is not used. - relax required ``python3-libvirt`` version for ``libvirt-client-qemu`` The ``virt-qemu-qmp-proxy`` tool requires python but doesn't strictly need the newest version. Remove the strict versioning requirement in order to prevent cyclic dependency when building. * Bug fixes * Skip initialization of ``cache`` capabilities if host doesn't support them Hypervisor drivers would fail to initialize on ``aarch64`` hosts with following error :: virStateInitialize:657 : Initialisation of cloud-hypervisor state driver failed: no error which prevented the startup of the daemon. * Allow incoming connections to guests on routed networks w/firewalld A change in handling of implicit rules in ``firewalld 1.0.0`` broke incomming connections to VMs when using ``routed`` network. This is fixed by adding a new ``libvirt-routed`` zone configured to once again allow incoming sessions to guests on routed networks. * Fix infinite loop in nodedev driver Certain udev entries might be of a size that makes libudev emit EINVAL which caused a busy loop burning CPU. Fix it by ignoring the return code. Enjoy. Jirka

1 0

[PATCH 0/9] Couple of virCommand related improvements
by Michal Privoznik 30 Nov '22

30 Nov '22

Found these on a abandoned branch, but they are still worth merging. Polished them a bit though. Michal Prívozník (9): vircommand: Document virCommandSetSendBuffer() behaviour wrt daemonize virCommandDoAsyncIO: Drop misleading statement about main event loop commandtest: Use unsigned char in test27() virCommandSetSendBuffer: Take double pointer of @buffer commandtest: Test virCommandSetSendBuffer() with virCommandDoAsyncIO() commandtest: Use virTestCompareToFile() in checkoutput() virbuftest: Cleanup code around virTestDifference() tests: Don't wrap virTestDifference() arguments in NULLSTR() tests: Use virTestCompareToString() more src/qemu/qemu_tpm.c | 2 +- src/util/vircommand.c | 11 ++- src/util/vircommand.h | 2 +- tests/commanddata/test29.log | 20 ++++ tests/commandtest.c | 152 +++++++++++++++++++++++-------- tests/esxutilstest.c | 10 +- tests/nwfilterebiptablestest.c | 21 ++--- tests/openvzutilstest.c | 6 +- tests/sockettest.c | 3 +- tests/utiltest.c | 3 +- tests/vboxsnapshotxmltest.c | 3 +- tests/virbuftest.c | 25 ++--- tests/virfirewalltest.c | 30 ++---- tests/virjsontest.c | 6 +- tests/virkmodtest.c | 3 +- tests/virnetdevbandwidthtest.c | 5 +- tests/virnetdevopenvswitchtest.c | 10 +- tests/virnetsockettest.c | 3 +- tests/virshtest.c | 3 +- 19 files changed, 182 insertions(+), 136 deletions(-) create mode 100644 tests/commanddata/test29.log -- 2.37.4

2 10

[libvirt PATCH] apparmor: Allow running /usr/libexec/qemu-kvm
by Andrea Bolognani 30 Nov '22

30 Nov '22

Distros that use AppArmor, such as Debian and Ubuntu, install QEMU under /usr/bin/qemu-system-*, and our AppArmor profile is written with that assumption in mind. If you try to run the RHEL or CentOS version of libvirt and QEMU inside a privileged container on such distros, however, that will result in an error, because the path /usr/libexec/qemu-kvm is used instead. In particular, this prevents upstream KubeVirt releases (which are based on CentOS) from running on Debian/Ubuntu nodes. See https://github.com/kubevirt/kubevirt/pull/8692 and the issues referenced therein for additional details. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- src/security/apparmor/usr.sbin.libvirtd.in | 4 ++++ src/security/apparmor/usr.sbin.virtqemud.in | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/src/security/apparmor/usr.sbin.libvirtd.in b/src/security/apparmor/usr.sbin.libvirtd.in index 886f1ad518..2994de5ec9 100644 --- a/src/security/apparmor/usr.sbin.libvirtd.in +++ b/src/security/apparmor/usr.sbin.libvirtd.in @@ -99,6 +99,10 @@ profile libvirtd @sbindir@/libvirtd flags=(attach_disconnected) { # read and run an ebtables script. /var/lib/libvirt/virtd* ixr, + # Needed when running the RHEL/CentOS version of libvirt and QEMU + # inside a privileged container on a Debian/Ubuntu host + /usr/libexec/qemu-kvm PUx, + # force the use of virt-aa-helper audit deny /{usr/,}sbin/apparmor_parser rwxl, audit deny /etc/apparmor.d/libvirt/** wxl, diff --git a/src/security/apparmor/usr.sbin.virtqemud.in b/src/security/apparmor/usr.sbin.virtqemud.in index 3de03d49fc..b3f33b9471 100644 --- a/src/security/apparmor/usr.sbin.virtqemud.in +++ b/src/security/apparmor/usr.sbin.virtqemud.in @@ -94,6 +94,10 @@ profile virtqemud @sbindir@/virtqemud flags=(attach_disconnected) { # read and run an ebtables script. /var/lib/libvirt/virtd* ixr, + # Needed when running the RHEL/CentOS version of libvirt and QEMU + # inside a privileged container on a Debian/Ubuntu host + /usr/libexec/qemu-kvm PUx, + # force the use of virt-aa-helper audit deny /{usr/,}sbin/apparmor_parser rwxl, audit deny /etc/apparmor.d/libvirt/** wxl, -- 2.38.1

4 12

[PATCH v4 0/7] qemu: tpm: Add support for migration across shared storage
by Stefan Berger 30 Nov '22

30 Nov '22

This series of patches adds support for migrating vTPMs across hosts whose storage has been set up to share the directory structure holding the state of the TPM (swtpm). The existence of share storage influences the management of the directory structure holding the TPM state, which for example is only removed when a domain is undefined and not when a VM is removed on the migration source host. Further, when shared storage is used then security labeling on the destination side is skipped assuming that the labeling was already done on the source side. I have tested this with an NFS setup where I had to turn SELinux off on the hosts since the SELinux MLS range labeling is not supported by NFS. For shared storage support to work properly both sides of the migration need to be clients of the shared storage setup, meaning that they both have to have /var/lib/libvirt/swtpm mounted as shared storage, because other- wise the virFileIsSharedFS() may not detect shared storage and in the worst case may cause the TPM emulator (swtpm) to malfunction if for example the source side removed the TPM state directory structure. Shared storage migration requires (upcoming) swtpm v0.8. Stefan v4: - Fixed long-standing bug regarding offline migration that now blocks if no shared storage is set up - Addressed Michal's concerns v3: - Relying entirely on virFileIsSharedFS() on migration source and destination sides to detect whether shared storage is set up between hosts; no more hint about shared storage from user via flag - Added support for virDomainTPMPrivate structure to store and persist TPM-related private data Stefan Berger (7): util: Add parsing support for swtpm's cmdarg-migration capability qemu: tpm: Allow offline migration with TPM_EMULATOR only with shared storage qemu: tpm: Conditionally create storage on incoming migration qemu: tpm: Add support for storing private TPM-related data qemu: tpm: Pass --migration option to swtpm if supported and needed qemu: tpm: Avoid security labels on incoming migration with shared storage qemu: tpm: Never remove state on outgoing migration and shared storage src/conf/domain_conf.c | 63 ++++++++++++++++++-- src/conf/domain_conf.h | 9 +++ src/qemu/qemu_domain.c | 85 ++++++++++++++++++++++++-- src/qemu/qemu_domain.h | 17 +++++- src/qemu/qemu_driver.c | 20 +++---- src/qemu/qemu_extdevice.c | 10 ++-- src/qemu/qemu_extdevice.h | 6 +- src/qemu/qemu_migration.c | 28 +++++++-- src/qemu/qemu_process.c | 9 ++- src/qemu/qemu_snapshot.c | 4 +- src/qemu/qemu_tpm.c | 122 ++++++++++++++++++++++++++++++++++---- src/qemu/qemu_tpm.h | 14 ++++- src/util/virtpm.c | 1 + src/util/virtpm.h | 1 + 14 files changed, 339 insertions(+), 50 deletions(-) -- 2.37.3

2 18

[libvirt PATCH 0/3] qemu: A few qemuMigrationCookieParse cleanups
by Jiri Denemark 30 Nov '22

30 Nov '22

Jiri Denemark (3): qemu: Reorder qemuMigrationCookieParse arguments qemu: Replace priv with qemuCaps in qemuMigrationCookieParse qemu: Reindent qemuMigrationCookieParse prototype arguments src/qemu/qemu_migration.c | 35 ++++++++++++++++-------------- src/qemu/qemu_migration_cookie.c | 12 ++++------ src/qemu/qemu_migration_cookie.h | 14 ++++++------ tests/qemumigrationcookiexmltest.c | 6 ++--- 4 files changed, 33 insertions(+), 34 deletions(-) -- 2.38.1

2 4