- Devel - libvirt List Archives

[libvirt] [PATCH] qemu: aquire job in qemuDomainDefineXMLFlags
by Nikolay Shirokovskiy 28 May '19

28 May '19

The function updates vm->newDef and frees previous pesistent definition which can be used by in different thread by some API that unlocks domain to communicate to qemu. So we have an access to freed memory in that thread. Let's acquire job condition when changing persistent xml. Signed-off-by: Nikolay Shirokovskiy <nshirokovskiy(a)virtuozzo.com> --- A bug example (some downstream version of libvirt, nevertheless): (gdb) bt #0 0x00007f3bb77a0533 in virDomainDefHasVcpusOffline (def=def@entry=0x7f3b7802a830) at conf/domain_conf.c:1637 #1 0x00007f3bb77cb32f in virDomainCpuDefFormat (def=0x7f3b7802a830, buf=0x7f3ba7308940) at conf/domain_conf.c:27503 #2 virDomainDefFormatInternal (def=def@entry=0x7f3b7802a830, caps=0x7f3b70000ae0, flags=3, flags@entry=1, buf=buf@entry=0x7f3ba7308940, xmlopt=xmlopt@entry=0x0) at conf/domain_conf.c:27850 #3 0x00007f3bb77ced46 in virDomainDefFormat (def=def@entry=0x7f3b7802a830, caps=<optimized out>, flags=flags@entry=1) at conf/domain_conf.c:28564 #4 0x00007f3bb77d23f9 in virDomainSaveConfig (configDir=0x7f3b981227e0 "/etc/libvirt/qemu", caps=<optimized out>, def=0x7f3b7802a830) at conf/domain_conf.c:28776 #5 0x00007f3ba086b617 in qemuDomainSetMemoryStatsPeriod (dom=<optimized out>, period=30, flags=<optimized out>) at qemu/qemu_driver.c:4839 #6 0x00007f3bb7905613 in virDomainSetMemoryStatsPeriod (domain=domain@entry=0x7f3b74006200, period=30, flags=3) at libvirt-domain.c:2087 (gdb) f 5 #5 0x00007f3ba086b617 in qemuDomainSetMemoryStatsPeriod (dom=<optimized out>, period=30, flags=<optimized out>) at qemu/qemu_driver.c:4839 4839 ret = virDomainSaveConfig(cfg->configDir, driver->caps, persistentDef); (gdb) p vm->def $8 = (virDomainDefPtr) 0x7f3b8400c6f0 (gdb) p vm->newDef $9 = (virDomainDefPtr) 0x7f3b7001de20 (gdb) p persistentDef $10 = (virDomainDefPtr) 0x7f3b7802a830 src/qemu/qemu_driver.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 42b1ce2..683dcaa 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -7626,6 +7626,7 @@ qemuDomainDefineXMLFlags(virConnectPtr conn, virCapsPtr caps = NULL; unsigned int parse_flags = VIR_DOMAIN_DEF_PARSE_INACTIVE | VIR_DOMAIN_DEF_PARSE_ABI_UPDATE; + bool job = false; virCheckFlags(VIR_DOMAIN_DEFINE_VALIDATE, NULL); @@ -7647,6 +7648,10 @@ qemuDomainDefineXMLFlags(virConnectPtr conn, if (virDomainDefineXMLFlagsEnsureACL(conn, def) < 0) goto cleanup; + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0) + goto cleanup; + job = true; + if (!(vm = virDomainObjListAdd(driver->domains, def, driver->xmlopt, 0, &oldDef))) @@ -7685,6 +7690,9 @@ qemuDomainDefineXMLFlags(virConnectPtr conn, dom = virGetDomain(conn, vm->def->name, vm->def->uuid, vm->def->id); cleanup: + if (job) + qemuDomainObjEndJob(driver, vm); + virDomainDefFree(oldDef); virDomainDefFree(def); virDomainObjEndAPI(&vm); -- 1.8.3.1

3 3

[libvirt] Plans for next release
by Daniel Veillard 28 May '19

28 May '19

We should enter freeze for 5.4.0 beginning of next week, maybe Monday evening or Tuesday morning, then plan for RC2 around Wed - Thur for a w.e. release. Hope this works for everybody, thanks, Daniel -- Daniel Veillard | Red Hat Developers Tools http://developer.redhat.com/ veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

1 1

[libvirt] [PATCH] vz: fixes: snapshot: s/parent/parent_name/ as prep for virObject
by Nikolay Shirokovskiy 28 May '19

28 May '19

Apply renaming of 36603bc56 for the vz driver. Signed-off-by: Nikolay Shirokovskiy <nshirokovskiy(a)virtuozzo.com> --- Pushed as build breaker/trivial. src/vz/vz_driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/vz/vz_driver.c b/src/vz/vz_driver.c index dfd49e7..2286f9a 100644 --- a/src/vz/vz_driver.c +++ b/src/vz/vz_driver.c @@ -2460,14 +2460,14 @@ vzDomainSnapshotGetParent(virDomainSnapshotPtr snapshot, unsigned int flags) if (!(snap = vzSnapObjFromSnapshot(snapshots, snapshot))) goto cleanup; - if (!snap->def->parent) { + if (!snap->def->parent_name) { virReportError(VIR_ERR_NO_DOMAIN_SNAPSHOT, _("snapshot '%s' does not have a parent"), snap->def->name); goto cleanup; } - parent = virGetDomainSnapshot(snapshot->domain, snap->def->parent); + parent = virGetDomainSnapshot(snapshot->domain, snap->def->parent_name); cleanup: virDomainSnapshotObjListFree(snapshots); -- 1.8.3.1

1 0

[libvirt] [PATCH 00/16] examples: Install more files and tidy up
by Andrea Bolognani 28 May '19

28 May '19

This series changes our install procedure so that we install all available examples on the target system; in the process, it also removes all custom shell code from the installation procedure, replacing it with standard autotools usage, and fixes a few admittedly very minor issues. Andrea Bolognani (16): spec: Don't install libvirt-api.xml as documentation examples: Drop object_events_event_test_CFLAGS examples: Reformat $(AM_CPPFLAGS) and $(LDADDS) examples: Remove $(WARN_CFLAGS) from $(LDADD) examples: Don't look for headers in $(top_srcdir) examples: Move $(STATIC_BINARIES) to $(AM_LDFLAGS) examples: Move $(WARN_CFLAGS) to $(AM_CFLAGS) examples: Drop unnecessary $(mkinstalldirs) call examples: Install nwfilters without shell scripting examples: Install Polkit examples examples: Install SystemTap examples examples: Install remaining XML examples examples: Move and install shell examples examples: Organize C examples into categories examples: Rework C examples installation examples: Group all C programs together .gitignore | 30 +-- examples/Makefile.am | 192 ++++++++++-------- examples/{ => c}/admin/client_close.c | 0 examples/{ => c}/admin/client_info.c | 0 examples/{ => c}/admin/client_limits.c | 0 examples/{ => c}/admin/list_clients.c | 0 examples/{ => c}/admin/list_servers.c | 0 examples/{ => c}/admin/logging.c | 0 examples/{ => c}/admin/threadpool_params.c | 0 .../{dommigrate => c/domain}/dommigrate.c | 0 examples/{domtop => c/domain}/domtop.c | 0 examples/{dominfo => c/domain}/info1.c | 0 examples/{rename => c/domain}/rename.c | 0 examples/{domsuspend => c/domain}/suspend.c | 0 .../{object-events => c/misc}/event-test.c | 0 .../{hellolibvirt => c/misc}/hellolibvirt.c | 0 examples/{openauth => c/misc}/openauth.c | 0 examples/{lxcconvert => sh}/virt-lxc-convert | 0 libvirt.spec.in | 4 - 19 files changed, 123 insertions(+), 103 deletions(-) rename examples/{ => c}/admin/client_close.c (100%) rename examples/{ => c}/admin/client_info.c (100%) rename examples/{ => c}/admin/client_limits.c (100%) rename examples/{ => c}/admin/list_clients.c (100%) rename examples/{ => c}/admin/list_servers.c (100%) rename examples/{ => c}/admin/logging.c (100%) rename examples/{ => c}/admin/threadpool_params.c (100%) rename examples/{dommigrate => c/domain}/dommigrate.c (100%) rename examples/{domtop => c/domain}/domtop.c (100%) rename examples/{dominfo => c/domain}/info1.c (100%) rename examples/{rename => c/domain}/rename.c (100%) rename examples/{domsuspend => c/domain}/suspend.c (100%) rename examples/{object-events => c/misc}/event-test.c (100%) rename examples/{hellolibvirt => c/misc}/hellolibvirt.c (100%) rename examples/{openauth => c/misc}/openauth.c (100%) rename examples/{lxcconvert => sh}/virt-lxc-convert (100%) -- 2.21.0

2 17

[libvirt] [ocaml PATCH] build: build with CAML_NAME_SPACE
by Pino Toscano 28 May '19

28 May '19

This way no non-namespaced OCaml C symbols are used, reducing the risk of clashes with other code. Signed-off-by: Pino Toscano <ptoscano(a)redhat.com> --- libvirt/Makefile.in | 1 + 1 file changed, 1 insertion(+) diff --git a/libvirt/Makefile.in b/libvirt/Makefile.in index 3a68aed..77462c7 100644 --- a/libvirt/Makefile.in +++ b/libvirt/Makefile.in @@ -19,6 +19,7 @@ WIN32 = @WIN32@ CFLAGS = @CFLAGS@ \ @LIBVIRT_CFLAGS@ \ + -DCAML_NAME_SPACE \ -I.. \ -I"$(shell ocamlc -where)" \ @DEBUG@ @WARNINGS@ @CFLAGS_FPIC@ -- 2.21.0

2 1

[libvirt] [PATCH] test_driver: implement virDomainMemoryPeek
by Ilias Stamatis 27 May '19

27 May '19

Begins by writing a @start byte in the first position of @buffer and then for every next byte it stores the value of its previous one incremented by one. Behaves the same for both supported flags. Signed-off-by: Ilias Stamatis <stamatis.iliass(a)gmail.com> --- Initially I thought about checking whether start+size exceeds the available physical or virtual memory. However I noticed that even when I pass -1 as @start the qemu driver doesn't complain and it fills the buffer with data. So I left it as is, without performing any additional checks. src/test/test_driver.c | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/src/test/test_driver.c b/src/test/test_driver.c index a4c17ef0df..04fdf7a4b8 100644 --- a/src/test/test_driver.c +++ b/src/test/test_driver.c @@ -6000,6 +6000,42 @@ testDomainManagedSaveRemove(virDomainPtr dom, unsigned int flags) return 0; } +static int +testDomainMemoryPeek(virDomainPtr dom, + unsigned long long start, + size_t size, + void *buffer, + unsigned int flags) +{ + int ret = -1; + size_t i; + unsigned char b = start; + virDomainObjPtr vm = NULL; + + virCheckFlags(VIR_MEMORY_VIRTUAL | VIR_MEMORY_PHYSICAL, -1); + + if (flags != VIR_MEMORY_VIRTUAL && flags != VIR_MEMORY_PHYSICAL) { + virReportError(VIR_ERR_INVALID_ARG, + "%s", _("flags parameter must be VIR_MEMORY_VIRTUAL or VIR_MEMORY_PHYSICAL")); + goto cleanup; + } + + if (!(vm = testDomObjFromDomain(dom))) + goto cleanup; + + if (virDomainObjCheckActive(vm) < 0) + goto cleanup; + + for (i = 0; i < size; i++) + ((unsigned char *) buffer)[i] = b++; + + ret = 0; + + cleanup: + virDomainObjEndAPI(&vm); + return ret; +} + /* * Snapshot APIs @@ -6897,6 +6933,7 @@ static virHypervisorDriver testHypervisorDriver = { .domainManagedSave = testDomainManagedSave, /* 1.1.4 */ .domainHasManagedSaveImage = testDomainHasManagedSaveImage, /* 1.1.4 */ .domainManagedSaveRemove = testDomainManagedSaveRemove, /* 1.1.4 */ + .domainMemoryPeek = testDomainMemoryPeek, /* 5.4.0 */ .domainSnapshotNum = testDomainSnapshotNum, /* 1.1.4 */ .domainSnapshotListNames = testDomainSnapshotListNames, /* 1.1.4 */ -- 2.21.0

2 3

[libvirt] [PATCH 0/2] qemu: Fix for emulatorsched
by Martin Kletzander 27 May '19

27 May '19

Partially-related-to: https://bugzilla.redhat.com/show_bug.cgi?id=1712781 Martin Kletzander (2): qemu: Set emulator thread scheduler only after QEMU starts docs: Add emulatorsched fix info to news.xml docs/news.xml | 12 ++++++++++++ src/qemu/qemu_process.c | 10 +++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) -- 2.21.0

2 3

[libvirt] [glib PATCH v2 0/2] Simplify autogen.sh & get rid of our own gtk-doc.make
by Fabiano Fidêncio 27 May '19

27 May '19

Let's use a similiar autogen.sh as the one used by libosinfo and, with the change, let's also drop our own crafted gtk-doc.make (as we'll be using gtkdocize to generate the file). Changes since v1: - Do not remove the "--system" shortcut v1: https://www.redhat.com/archives/libvir-list/2019-May/msg00748.html Fabiano Fidêncio (2): autogen.sh: Simplify autogen.sh gtk-doc.make: Remove the file .gitignore | 4 + autogen.sh | 58 +++++------- gtk-doc.make | 256 --------------------------------------------------- 3 files changed, 29 insertions(+), 289 deletions(-) delete mode 100644 gtk-doc.make -- 2.21.0

3 6

[libvirt] [PATCH] qemu: Get default hugepage size only if needed
by Michal Privoznik 27 May '19

27 May '19

Fixes: 6864d8f740e2502dc7625bdf18ffde4465b14f69 Hugepages don't work in session mode but when building memory part of command line we query for the default size anyway. This breaks creating domains under session daemon. Query the page size only if it's clear we need hugepages. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- As a penance, I'll backport this onto v5.3-main branch too. src/qemu/qemu_command.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 73f570c419..5bf6c704e0 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -3573,7 +3573,7 @@ qemuBuildMemoryBackendProps(virJSONValuePtr *backendProps, pagesize = 0; needHugepage = false; useHugepage = false; - } else if (pagesize == 0) { + } else if (useHugepage && pagesize == 0) { if (qemuBuildMemoryGetDefaultPagesize(cfg, &pagesize) < 0) goto cleanup; } -- 2.21.0

2 1

[libvirt] [PATCH] spec: Improve handling for default network
by Andrea Bolognani 27 May '19

27 May '19

This is exactly how we already treat nwfilters, which require the same kind of care (aka nasty hacks) as the default network, because in both cases the UUID is generated and written to disk the first time libvirtd is started after installing the corresponding subpackage. After this patch, RPM will be aware of the fact that the libvirt-daemon-config-network subpackage owns the default network. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- libvirt.spec.in | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index b159c50d8f..94691c38fb 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1250,8 +1250,8 @@ install -d -m 0755 $RPM_BUILD_ROOT%{_datadir}/lib/libvirt/dnsmasq/ install -d -m 0755 $RPM_BUILD_ROOT%{_datadir}/libvirt/networks/ cp $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/default.xml \ $RPM_BUILD_ROOT%{_datadir}/libvirt/networks/default.xml -rm -f $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/default.xml -rm -f $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/autostart/default.xml +# libvirt saves this file with mode 0600 +chmod 0600 $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/default.xml # nwfilter files are installed in /usr/share/libvirt and copied to /etc in %post # to avoid verification errors on changed files in /etc @@ -1427,6 +1427,8 @@ if test $1 -eq 1 && test ! -f %{_sysconfdir}/libvirt/qemu/networks/default.xml ; < %{_datadir}/libvirt/networks/default.xml \ > %{_sysconfdir}/libvirt/qemu/networks/default.xml ln -s ../default.xml %{_sysconfdir}/libvirt/qemu/networks/autostart/default.xml + # libvirt saves this file with mode 0600 + chmod 0600 %{_sysconfdir}/libvirt/qemu/networks/default.xml # Make sure libvirt picks up the new network defininiton mkdir -p %{_localstatedir}/lib/rpm-state/libvirt || : @@ -1577,6 +1579,8 @@ exit 0 %files daemon-config-network %dir %{_datadir}/libvirt/networks/ %{_datadir}/libvirt/networks/default.xml +%ghost %{_sysconfdir}/libvirt/qemu/networks/default.xml +%ghost %{_sysconfdir}/libvirt/qemu/networks/autostart/default.xml %files daemon-config-nwfilter %dir %{_datadir}/libvirt/nwfilter/ -- 2.21.0

2 1

[libvirt] [PATCH] spec: Fix permissions of nwfilter XMLs
by Jiri Denemark 27 May '19

27 May '19

The nwfilter XML files stored in /etc/libvirt/nwfilter are copied in a %post scriptlet from /usr/share/libvirt/nwfilter/*.xml. While the files in /usr/share are created with mode 0644, libvirt creates the files in /etc/libvirt/nwfilter with mode 0600. Since 0600 is also stored in the RPM database, we need to chmod the files copied from /usr/share to make sure RPM verification does not complain about changed permissions. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- libvirt.spec.in | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libvirt.spec.in b/libvirt.spec.in index 5bd3e30509..970d2742ac 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1441,6 +1441,8 @@ rm -rf %{_localstatedir}/lib/rpm-state/libvirt || : %post daemon-config-nwfilter cp %{_datadir}/libvirt/nwfilter/*.xml %{_sysconfdir}/libvirt/nwfilter/ +# libvirt saves these files with mode 600 +chmod 600 %{_sysconfdir}/libvirt/nwfilter/*.xml # Make sure libvirt picks up the new nwfilter defininitons mkdir -p %{_localstatedir}/lib/rpm-state/libvirt || : touch %{_localstatedir}/lib/rpm-state/libvirt/restart || : -- 2.21.0

2 4

[libvirt] [PATCH 0/5] Support embedding the QEMU driver in client apps directly
by Daniel P. Berrangé 27 May '19

27 May '19

This patch series proposes a new way to build a "libvirt QEMU shim" which supports more use cases than the previous approach from last year, as well as being vastly simpler to implement. Specifically - We can use this to embed the QEMU driver in unit tests allowing the full range of odriver functionality to be exercised during *unit* testing without interfering with the host OS libvirtd. - Apps like libguestfs can embed the QEMU driver to allow them to spawn VMs that are immediate children of their app, thus inheriting process context, as well as hiding these "service VM" from the main libvirtd. This would avoid a common irritation where libguestfs VMs suddenly appear & disappear in virt-manager's VM list. - Apps like kubevirt could use this to eliminate the need to use the RPC layer for libvirt. It can directly embed the QEMU driver giving it more direct control over how it is run & again inheriting process state. This is useful for kubevirt's one VM per container model where Kubernetes itself provides the aggregated view, thus making libvirtd's aggregated view redundant - The previous shim was very much one shim == one QEMU process. This new embed approach supports that of course, but there's also the option to run multiple VMs if desired. - Using a virtual root directory for QEMU driver state meams we do not need to solve the hard refactoring problem of getting the main libvirtd to detect the VMs launched via the shim. They can safely live independantly. - Thanks to the driver refactoring work it is still possible for the embedded drivers to talk to main libvirtd to use the secondary drivers for storage/network/etc if needed. Ideally we would allow those secondary drivers to be embedded too but that's not implemented here. Most important would be the secrets driver. Other drivers are much less important. Daniel P. Berrangé (5): access: report an error if no access manager is present libvirt: pass a root directory path into drivers qemu: honour the root parameter during driver initialization libvirt: support an "embed" URI path selector for QEMU driver qemu: introduce a new style libvirt_qemu_shim program src/access/viraccessmanager.c | 5 ++ src/driver-state.h | 1 + src/interface/interface_backend_netcf.c | 1 + src/interface/interface_backend_udev.c | 1 + src/libvirt.c | 41 ++++++++++++++- src/libvirt_internal.h | 1 + src/libxl/libxl_driver.c | 1 + src/lxc/lxc_driver.c | 2 + src/network/bridge_driver.c | 1 + src/node_device/node_device_hal.c | 1 + src/node_device/node_device_udev.c | 1 + src/nwfilter/nwfilter_driver.c | 1 + src/qemu/Makefile.inc.am | 7 +++ src/qemu/qemu_conf.c | 41 +++++++++------ src/qemu/qemu_conf.h | 3 +- src/qemu/qemu_driver.c | 9 ++-- src/qemu/qemu_shim.c | 70 +++++++++++++++++++++++++ src/remote/remote_daemon.c | 1 + src/remote/remote_driver.c | 8 +++ src/secret/secret_driver.c | 1 + src/storage/storage_driver.c | 1 + src/vz/vz_driver.c | 1 + 22 files changed, 179 insertions(+), 20 deletions(-) create mode 100644 src/qemu/qemu_shim.c -- 2.21.0

3 11

[libvirt] [glib PATCH 0/2] Simplify autogen.sh & get rid of our own gtk-doc.make
by Fabiano Fidêncio 25 May '19

25 May '19

Let's use a similiar autogen.sh as the one used by libosinfo and, with the change, let's also drop our own crafted gtk-doc.make (as we'll be using gtkdocize to generate the file). Fabiano Fidêncio (2): autogen.sh: Simplify autogen.sh gtk-doc.make: Remove the file .gitignore | 4 + autogen.sh | 70 +++++--------- gtk-doc.make | 256 --------------------------------------------------- 3 files changed, 29 insertions(+), 301 deletions(-) delete mode 100644 gtk-doc.make -- 2.21.0

2 3

[libvirt] [glib PATCH] docs: explicitly link against libvirt-g{config, lib, object}
by Fabiano Fidêncio 24 May '19

24 May '19

Let's explicitly link against the built libvirt-gconfig, libvirt-glib, and libvirt-gobject libtool files for introspecting the gobjects. In case it's *not* done we can run into some issues when where we try to link against installed library, causing failures related to undefined reference of the new symbols. Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> --- This issue was caught by libvirt-jenkins-ci on a debian-9 machine only. However, it's easily reproducible with other distros. https://ci.centos.org/job/libvirt-glib-build/systems=libvirt-debian-9/445/c… --- docs/libvirt-gconfig/Makefile.am | 5 ++++- docs/libvirt-glib/Makefile.am | 5 ++++- docs/libvirt-gobject/Makefile.am | 5 ++++- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/docs/libvirt-gconfig/Makefile.am b/docs/libvirt-gconfig/Makefile.am index 6a3df37..7d02354 100644 --- a/docs/libvirt-gconfig/Makefile.am +++ b/docs/libvirt-gconfig/Makefile.am @@ -34,6 +34,9 @@ GTKDOC_CFLAGS= \ GTKDOC_LIBS = \ $(GOBJECT2_LIBS) \ $(LIBXML2_LIBS) \ - $(top_builddir)/libvirt-gconfig/libvirt-gconfig-1.0.la + $(top_builddir)/libvirt-glib/libvirt-glib-1.0.la \ + $(top_builddir)/libvirt-gconfig/libvirt-gconfig-1.0.la \ + $(top_builddir)/libvirt-gobject/libvirt-gobject-1.0.la \ + $(NULL) include $(top_srcdir)/gtk-doc.make diff --git a/docs/libvirt-glib/Makefile.am b/docs/libvirt-glib/Makefile.am index 186f8ff..e3445b9 100644 --- a/docs/libvirt-glib/Makefile.am +++ b/docs/libvirt-glib/Makefile.am @@ -36,7 +36,10 @@ GTKDOC_LIBS = \ $(LIBVIRT_LIBS) \ $(GLIB2_LIBS) \ $(GTHREAD2_LIBS) \ - $(top_builddir)/libvirt-glib/libvirt-glib-1.0.la + $(top_builddir)/libvirt-glib/libvirt-glib-1.0.la \ + $(top_builddir)/libvirt-gconfig/libvirt-gconfig-1.0.la \ + $(top_builddir)/libvirt-gobject/libvirt-gobject-1.0.la \ + $(NULL) include $(top_srcdir)/gtk-doc.make diff --git a/docs/libvirt-gobject/Makefile.am b/docs/libvirt-gobject/Makefile.am index c068a96..f54c389 100644 --- a/docs/libvirt-gobject/Makefile.am +++ b/docs/libvirt-gobject/Makefile.am @@ -36,6 +36,9 @@ GTKDOC_LIBS = \ $(LIBVIRT_LIBS) \ $(GOBJECT2_LIBS) \ $(GIO2_LIBS) \ - $(top_builddir)/libvirt-gobject/libvirt-gobject-1.0.la + $(top_builddir)/libvirt-glib/libvirt-glib-1.0.la \ + $(top_builddir)/libvirt-gconfig/libvirt-gconfig-1.0.la \ + $(top_builddir)/libvirt-gobject/libvirt-gobject-1.0.la \ + $(NULL) include $(top_srcdir)/gtk-doc.make -- 2.21.0

2 1

[libvirt] [PATCH] docs: Link the relevant SEV formatdomain section from formatdomaincaps
by Erik Skultety 24 May '19

24 May '19

formatdomaincaps.html provides explanation of SEV fields, but doesn't link to the domain XML docs to show how it can be actually used in libvirt. Signed-off-by: Erik Skultety <eskultet(a)redhat.com> --- docs/formatdomaincaps.html.in | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/docs/formatdomaincaps.html.in b/docs/formatdomaincaps.html.in index b31b1729f4..432d7aed5e 100644 --- a/docs/formatdomaincaps.html.in +++ b/docs/formatdomaincaps.html.in @@ -514,10 +514,19 @@ encrypted with a key unique to that VM.</p> <p> - For more details on SEV feature see: - <a href="https://support.amd.com/TechDocs/55766_SEV-KM_API_Specification.pdf"> - SEV API spec</a> and <a href="http://amd-dev.wpengine.netdna-cdn.com/wordpress/media/2013/12/AMD_Memory_E…"> - SEV White Paper</a> + For more details on the SEV feature and how to use it with libvirt have + a look at the following resources: + <dl> + <dd> + <a href="https://support.amd.com/TechDocs/55766_SEV-KM_API_Specification.pdf">SEV API spec</a> + </dd> + <dd> + <a href="http://amd-dev.wpengine.netdna-cdn.com/wordpress/media/2013/12/AMD_Memory_E…">SEV White Paper</a> + </dd> + <dd> + <a href="formatdomain.html#launchSecurity">SEV in domain XML</a> + </dd> + </dl> </p> <dl> -- 2.20.1

2 1

[libvirt] [PATCH] nodesuspend: report unsupported if systemd & pm-utils aren't available
by Daniel P. Berrangé 24 May '19

24 May '19

When libvirtd is run inside a container it is normal that neither systemd nor pm-utils will be available. In this case there is no way to suspend the host, so libvirt should just report the feature unsupported instead of raising an error. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/util/virnodesuspend.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/util/virnodesuspend.c b/src/util/virnodesuspend.c index 0af0908e4a..3fc5b93ac7 100644 --- a/src/util/virnodesuspend.c +++ b/src/util/virnodesuspend.c @@ -330,11 +330,10 @@ virNodeSuspendSupportsTarget(unsigned int target, bool *supported) if (ret == -2) ret = virNodeSuspendSupportsTargetPMUtils(target, supported); - /* If still unavailable, then report error */ + /* If still unavailable, then report unsupported */ if (ret == -2) { - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("Cannot probe for supported suspend types")); - ret = -1; + *supported = false; + ret = 0; } return ret; -- 2.21.0

2 1

[libvirt] [PATCH] spec: Unconditionally set ownership of /var/lib/libvirt/sanlock
by Jiri Denemark 24 May '19

24 May '19

The libvirt-lock-sanlock subpackage requires sanlock to be installed first and the sanlock package creates the sanlock group on all distros we care about in the spec file (Fedora and RHEL >= 7). Thus instead of setting the ownership and permissions in a post scriptlet only when the sanlock group exists we can just install the directory with the appropriate metadata. https://bugzilla.redhat.com/show_bug.cgi?id=1702758 Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- libvirt.spec.in | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index b159c50d8f..5bd3e30509 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1479,14 +1479,6 @@ exit 0 %postun client %systemd_postun libvirt-guests.service -%if %{with_sanlock} -%post lock-sanlock -if getent group sanlock > /dev/null ; then - chmod 0770 %{_localstatedir}/lib/libvirt/sanlock - chown root:sanlock %{_localstatedir}/lib/libvirt/sanlock -fi -%endif - %if %{with_lxc} %pre login-shell getent group virtlogin >/dev/null || groupadd -r virtlogin @@ -1739,7 +1731,7 @@ exit 0 %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/sanlock.so %{_datadir}/augeas/lenses/libvirt_sanlock.aug %{_datadir}/augeas/lenses/tests/test_libvirt_sanlock.aug -%dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/sanlock +%dir %attr(0770, root, sanlock) %{_localstatedir}/lib/libvirt/sanlock %{_sbindir}/virt-sanlock-cleanup %{_mandir}/man8/virt-sanlock-cleanup.8* %attr(0755, root, root) %{_libexecdir}/libvirt_sanlock_helper -- 2.21.0

2 1

[libvirt] [PATCH] driver: test: Fix the mingw build caused by wrong printf format specifier
by Erik Skultety 24 May '19

24 May '19

Caused by commit 326c3f54. Signed-off-by: Erik Skultety <eskultet(a)redhat.com> --- Travis build: https://travis-ci.org/eskultety/libvirt/builds/536736446 Pushed under the build breaker rule. src/test/test_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/test/test_driver.c b/src/test/test_driver.c index b29fd12903..7fd06fcfa8 100644 --- a/src/test/test_driver.c +++ b/src/test/test_driver.c @@ -3268,7 +3268,7 @@ testDomainInterfaceAddresses(virDomainPtr dom, iface->addrs[0].type = VIR_IP_ADDR_TYPE_IPV4; iface->addrs[0].prefix = 24; - if (virAsprintf(&iface->addrs[0].addr, "192.168.0.%ld", 1 + i) < 0) + if (virAsprintf(&iface->addrs[0].addr, "192.168.0.%zu", 1 + i) < 0) goto cleanup; iface->naddrs = 1; -- 2.20.1

1 0

[libvirt] [PATCH] spec: Fix permissions of /var/run/libvirt/qemu
by Jiri Denemark 24 May '19

24 May '19

While libvirtd creates this directory with the default 0755 mode, the spec file stores 0700 in the RPM database. Thus RPM verification always complains about this directory. Let's fix the spec file to match reality. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- Notes: Alternatively, we could change libvirt to create the directory with 0700 (instead of 0755), but all other drivers use 0755 (both in reality and in the spec file) and 0700 wouldn't really enhance security anyway. libvirt.spec.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 970d2742ac..dc69920d75 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1661,7 +1661,7 @@ exit 0 %config(noreplace) %{_sysconfdir}/libvirt/qemu.conf %config(noreplace) %{_sysconfdir}/libvirt/qemu-lockd.conf %config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd.qemu -%ghost %dir %attr(0700, root, root) %{_localstatedir}/run/libvirt/qemu/ +%ghost %dir %{_localstatedir}/run/libvirt/qemu/ %dir %attr(0751, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/ %dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/cache/libvirt/qemu/ %{_datadir}/augeas/lenses/libvirtd_qemu.aug -- 2.21.0

2 1

[libvirt] [PATCH v2 0/2] test_driver: add a guest inf and implement virDomainInterfaceAddresses
by Ilias Stamatis 24 May '19

24 May '19

Ilias Stamatis (2): test_driver: implement virDomainInterfaceAddresses test_driver: add a guest interface in the default config src/test/test_driver.c | 73 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) -- 2.21.0

2 4

[libvirt] Increasing TasksMax when creating machines via systemd
by Jim Fehlig 23 May '19

23 May '19

Hi All, I recently received an internal bug report of VM "crashing" due to hitting thread limits. Seems there was an assert in pthread_create within the VM when hitting the limit enforced by pids controller on the host Apr 28 07:45:46 lpcomp02007 kernel: cgroup: fork rejected by pids controller in /machine.slice/machine-qemu\x2d90028\x2dinstance\x2d0000634b.scope The user has TasksMax set to infinity in machine.slice, but apparently that is not inherited by child scopes and appears to be hardcoded to 16384 https://github.com/systemd/systemd/blob/51aba17b88617515e037e8985d3a4ea871a… The TasksMax property can be set when creating the machine as is done in the attached proof of concept patch. Question is whether this should be a tunable? My initial thought when seeing the report was TasksMax could be calculated based on number of vcpus, iothreads, emulator threads, etc. But it appears that could be quite tricky. The following mail thread describes the basic scenario encountered by my user http://lists.ceph.com/pipermail/ceph-users-ceph.com/2016-March/008174.html As you can see, many rbd images attached to a VM can result in an awful lot of threads. 300 images could result in 720K threads! We could punt and set the limit to infinity, but it exists for a reason - fork bomb prevention. A potential compromise between a hardcoded value and per-VM tunable is a driver tunable in qemu.conf. If a per-VM tunable is preferred, suggestions on where to place it and what to call it would be much appreciated :-). Regards, Jim

2 2

[libvirt] [PATCH v5 00/24] network: refactor to decouple virt drivers from network driver
by Daniel P. Berrangé 23 May '19

23 May '19

An update to v1: https://www.redhat.com/archives/libvir-list/2018-December/msg00681.html v2: https://www.redhat.com/archives/libvir-list/2019-February/msg01581.html v3: https://www.redhat.com/archives/libvir-list/2019-March/msg01259.html v4: https://www.redhat.com/archives/libvir-list/2019-April/msg01186.html Currently the network driver registers a set of callbacks with the virt driver in order to handle allocating/releasing network ports associated with guest NICs. This series introduces a virNetworkPortPtr object and associated XML that describes a network port. The virt drivers now call public APIs associated with this new object to create/delete ports for guest NICs. Changed in v5: - Separately track ports with type=network vs type=bridge to deal with fallout after reverting patches which merged them - Add RNG schema and XML format docs - Change to use classID attr on <bandwidth> isntead of of separate <class id="xx"/> element - Drop obsolete driver deps from RPM spec - Other misc bug fixes found during testing Changed in v4: - Merged the ACKd patches which didn't depend on other un-acked parts - Improve bandwidth error messages - Ensure we set floor sum to zero when starting network - Misc fixes for previous review comments NB, I have not added missing docs for the new XML doc format yet. This is work in progress. Changed in v3: - Remove unused API symbol - Fix dist of test data files Changed in v2: - Fix many bugs related to upgrades with running VMs - Convert over bandwidth controls to the new APIs - Handle reconnecting VIFs to bridges during startup - Much much more that I can't remember Daniel P. Berrangé (24): conf: allow bandwidth parsing / formatting to include class ID conf: introduce virNetworkPortDefPtr struct and XML support network: make networkLogAllocation independent of domain conf conf: add APIs to convert virDomainNetDef to virNetworkPortDef network: convert networkAllocateActualDevice to virNetworkPortDef network: convert networkNotifyActualDevice to virNetworkPortDef network: convert networkReleaseActualDevice to virNetworkPortDef network: convert hook script to take a network port XML network: remove the virDomainNetBandwidthChangeAllowed callback network: introduce networkAllocatePort network: introduce networkNotifyPort network: introduce networkReleasePort network: introduce networkUpdatePortBandwidth network: add public APIs for network port object access: add permissions for network port objects remote: add support for new network port APIs virsh: add support for network port APIs conf: support recording ports against virNetworkObjPtr network: add implementation of network port APIs lxc, libxl: notify network driver of NICs during reconnect lxc, libxl: save domain status after reconnect conf: record a portid against the domain conf conf: switch over to use network port APIs for virt drivers rpm: remove dependancy from qemu to network/storage drivers docs/docs.html.in | 1 + docs/formatdomain.html.in | 8 + docs/formatnetworkport.html.in | 212 +++ docs/hooks.html.in | 24 +- docs/schemas/domaincommon.rng | 5 + docs/schemas/networkport.rng | 165 +++ include/libvirt/libvirt-network.h | 122 ++ include/libvirt/virterror.h | 3 + libvirt.spec.in | 3 - src/access/genpolkit.pl | 2 +- src/access/viraccessdriver.h | 6 + src/access/viraccessdrivernop.c | 11 + src/access/viraccessdriverpolkit.c | 26 + src/access/viraccessdriverstack.c | 25 + src/access/viraccessmanager.c | 16 + src/access/viraccessmanager.h | 6 + src/access/viraccessperm.c | 6 + src/access/viraccessperm.h | 44 + src/conf/Makefile.inc.am | 2 + src/conf/domain_conf.c | 531 +++++++- src/conf/domain_conf.h | 49 +- src/conf/netdev_bandwidth_conf.c | 30 +- src/conf/netdev_bandwidth_conf.h | 2 + src/conf/network_conf.c | 8 +- src/conf/virnetworkobj.c | 303 +++++ src/conf/virnetworkobj.h | 34 + src/conf/virnetworkportdef.c | 509 +++++++ src/conf/virnetworkportdef.h | 113 ++ src/datatypes.c | 60 + src/datatypes.h | 41 + src/driver-network.h | 41 + src/libvirt-network.c | 444 +++++++ src/libvirt_private.syms | 23 +- src/libvirt_public.syms | 15 + src/libxl/libxl_driver.c | 33 + src/lxc/lxc_process.c | 35 + src/network/bridge_driver.c | 1182 ++++++++++------- src/qemu/qemu_driver.c | 8 +- src/remote/remote_daemon_dispatch.c | 73 + src/remote/remote_driver.c | 69 + src/remote/remote_protocol.x | 124 +- src/remote_protocol-structs | 69 + src/rpc/gendispatch.pl | 18 +- src/util/virerror.c | 9 + src/util/virhook.c | 4 +- src/util/virhook.h | 4 +- tests/Makefile.am | 7 + .../net-virtio-network-portgroup.xml | 6 +- tests/virnetdevbandwidthtest.c | 1 + .../plug-bridge-mactbl.xml | 9 + .../virnetworkportxml2xmldata/plug-bridge.xml | 15 + .../virnetworkportxml2xmldata/plug-direct.xml | 12 + .../plug-hostdev-pci.xml | 12 + .../plug-network.xml | 16 + tests/virnetworkportxml2xmldata/plug-none.xml | 8 + tests/virnetworkportxml2xmltest.c | 104 ++ tests/virschematest.c | 1 + tools/virsh-completer.c | 50 + tools/virsh-completer.h | 4 + tools/virsh-network.c | 399 +++++- tools/virsh-network.h | 5 + 61 files changed, 4506 insertions(+), 661 deletions(-) create mode 100644 docs/formatnetworkport.html.in create mode 100644 docs/schemas/networkport.rng create mode 100644 src/conf/virnetworkportdef.c create mode 100644 src/conf/virnetworkportdef.h create mode 100644 tests/virnetworkportxml2xmldata/plug-bridge-mactbl.xml create mode 100644 tests/virnetworkportxml2xmldata/plug-bridge.xml create mode 100644 tests/virnetworkportxml2xmldata/plug-direct.xml create mode 100644 tests/virnetworkportxml2xmldata/plug-hostdev-pci.xml create mode 100644 tests/virnetworkportxml2xmldata/plug-network.xml create mode 100644 tests/virnetworkportxml2xmldata/plug-none.xml create mode 100644 tests/virnetworkportxml2xmltest.c -- 2.21.0

2 36

[libvirt] [PATCH] virDomainDefPostParse: use DOMAIN_DEVICE_ITERATE_MISSING_INFO
by Ján Tomko 23 May '19

23 May '19

Apart from virDomainDefValidate, virDomainDefPostParse is another place where operating on info-less devices makes sense. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/conf/domain_conf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 926c2139b7..006920e954 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -5803,7 +5803,8 @@ virDomainDefPostParse(virDomainDefPtr def, /* iterate the devices */ ret = virDomainDeviceInfoIterateInternal(def, virDomainDefPostParseDeviceIterator, - DOMAIN_DEVICE_ITERATE_ALL_CONSOLES, + DOMAIN_DEVICE_ITERATE_ALL_CONSOLES | + DOMAIN_DEVICE_ITERATE_MISSING_INFO, &data); if (virDomainDefPostParseCheckFailure(def, parseFlags, ret) < 0) -- 2.19.2

2 1

[libvirt] [PATCH 0/2] Introduce virDomainDeviceIterate
by Ján Tomko 23 May '19

23 May '19

A function for iterating over all devices [0] instead of just the ones with DeviceInfo. [0] Terms and conditions apply. Leases might be included as well. Ján Tomko (2): Introduce virDomainDeviceIterate Introduce DOMAIN_DEVICE_ITERATE_MISSING_INFO src/conf/domain_conf.c | 47 ++++++++++++++++++++++++++++++------------ src/conf/domain_conf.h | 3 +++ 2 files changed, 37 insertions(+), 13 deletions(-) -- 2.19.2

2 5

[libvirt] [PATCH] docs: Change the 'Launch Security' section id to "launchSecurity"
by Erik Skultety 23 May '19

23 May '19

Although there's currently only support for SEV, it's likely other solutions will appear, so we should not refer to the documentation section simply with 'sev'. Signed-off-by: Erik Skultety <eskultet(a)redhat.com> --- docs/formatdomain.html.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index e1da878fcc..c843b1d667 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -8924,7 +8924,7 @@ qemu-kvm -net nic,model=? /dev/null <p>Note: DEA/TDEA is synonymous with DES/TDES.</p> - <h3><a id="sev">Launch Security</a></h3> + <h3><a id="launchSecurity">Launch Security</a></h3> <p> The contents of the <code><launchSecurity type='sev'></code> element -- 2.20.1

1 1

[libvirt] [PATCH] misc: Drop useless checks from *Dispose() functions
by Michal Privoznik 23 May '19

23 May '19

Due to the way that our virObjectUnref() is written it's not possible that a NULL is passed into *Dispose() function. However, some functions check for that regardless. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/conf/domain_conf.c | 3 --- src/conf/virstorageobj.c | 9 --------- src/rpc/virnetsshsession.c | 3 --- src/util/virhostdev.c | 3 --- 4 files changed, 18 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index a3a514136b..732d37329f 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -2602,9 +2602,6 @@ virDomainChrSourceDefDispose(void *obj) virDomainChrSourceDefPtr def = obj; size_t i; - if (!def) - return; - virDomainChrSourceDefClear(def); virObjectUnref(def->privateData); diff --git a/src/conf/virstorageobj.c b/src/conf/virstorageobj.c index cdd9863eb8..31b5af8e9e 100644 --- a/src/conf/virstorageobj.c +++ b/src/conf/virstorageobj.c @@ -156,9 +156,6 @@ virStorageVolObjDispose(void *opaque) { virStorageVolObjPtr obj = opaque; - if (!obj) - return; - virStorageVolDefFree(obj->voldef); } @@ -190,9 +187,6 @@ virStorageVolObjListDispose(void *opaque) { virStorageVolObjListPtr vols = opaque; - if (!vols) - return; - virHashFree(vols->objsKey); virHashFree(vols->objsName); virHashFree(vols->objsPath); @@ -362,9 +356,6 @@ virStoragePoolObjDispose(void *opaque) { virStoragePoolObjPtr obj = opaque; - if (!obj) - return; - virStoragePoolObjClearVols(obj); virObjectUnref(obj->volumes); diff --git a/src/rpc/virnetsshsession.c b/src/rpc/virnetsshsession.c index 324b35b675..04b720014d 100644 --- a/src/rpc/virnetsshsession.c +++ b/src/rpc/virnetsshsession.c @@ -135,9 +135,6 @@ virNetSSHSessionDispose(void *obj) virNetSSHSessionPtr sess = obj; VIR_DEBUG("sess=0x%p", sess); - if (!sess) - return; - if (sess->channel) { libssh2_channel_send_eof(sess->channel); libssh2_channel_close(sess->channel); diff --git a/src/util/virhostdev.c b/src/util/virhostdev.c index 19ae001971..fe176f35e4 100644 --- a/src/util/virhostdev.c +++ b/src/util/virhostdev.c @@ -131,9 +131,6 @@ virHostdevManagerDispose(void *obj) { virHostdevManagerPtr hostdevMgr = obj; - if (!hostdevMgr) - return; - virObjectUnref(hostdevMgr->activePCIHostdevs); virObjectUnref(hostdevMgr->inactivePCIHostdevs); virObjectUnref(hostdevMgr->activeUSBHostdevs); -- 2.21.0

2 1

[libvirt] [PATCH 0/3] network: Delay creating private chains until starting network
by Daniel P. Berrangé 22 May '19

22 May '19

This is an series to delay creating libvirt firewall chains if nothing needs them during startup. Daniel P. Berrangé (3): network: pull global chain init into separate method network: add more debugging of firewall chain creation network: delay global firewall setup if no networks are running src/network/bridge_driver.c | 2 +- src/network/bridge_driver_linux.c | 99 +++++++++++++++++++++---- src/network/bridge_driver_nop.c | 3 +- src/network/bridge_driver_platform.h | 2 +- tests/networkxml2firewalldata/base.args | 34 +++++++++ tests/networkxml2firewalltest.c | 36 +++++++-- 6 files changed, 152 insertions(+), 24 deletions(-) create mode 100644 tests/networkxml2firewalldata/base.args -- 2.21.0

3 7

[libvirt] [PATCH 0/8] Refactor Intel IOMMU support
by Andrea Bolognani 22 May '19

22 May '19

Another prerequisite for vSMMUv3 support. Well, technically I could go ahead and implement that without refactoring Intel IOMMU support first, but I'd rather not add more validation code to qemu_command. Andrea Bolognani (8): tests: Simplify Intel IOMMU testing tests: Use DO_TEST_CAPS_*() for Intel IOMMU tests: Add negative test for Intel IOMMU conf: Allow NULL for virDomainDeviceInfoCallback conf: Drop DOMAIN_DEVICE_ITERATE_GRAPHICS conf: Add IOMMU support to virDomainDeviceInfoIterate() qemu: Introduce qemuDomainDeviceDefValidateIOMMU() qemu: Tweak Intel IOMMU command line generation src/bhyve/bhyve_device.c | 4 ++ src/conf/domain_addr.c | 9 +++ src/conf/domain_conf.c | 59 ++++++++++++---- src/libxl/libxl_driver.c | 3 + src/qemu/qemu_command.c | 69 +++---------------- src/qemu/qemu_domain.c | 66 +++++++++++++++++- src/qemu/qemu_domain_address.c | 36 +++++++++- src/qemu/qemu_hotplug.c | 3 + ...tel-iommu-caching-mode.x86_64-latest.args} | 15 ++-- .../intel-iommu-caching-mode.xml | 23 +------ ...tel-iommu-device-iotlb.x86_64-latest.args} | 22 +++--- .../intel-iommu-device-iotlb.xml | 1 + ...rgs => intel-iommu-eim.x86_64-latest.args} | 15 ++-- tests/qemuxml2argvdata/intel-iommu-eim.xml | 1 + ... => intel-iommu-machine.x86_64-2.6.0.args} | 9 ++- .../qemuxml2argvdata/intel-iommu-machine.xml | 3 +- ...hine.xml => intel-iommu-wrong-machine.xml} | 8 +-- ...ne.args => intel-iommu.x86_64-latest.args} | 18 +++-- tests/qemuxml2argvdata/intel-iommu.xml | 1 + tests/qemuxml2argvtest.c | 34 ++------- ...ntel-iommu-caching-mode.x86_64-latest.xml} | 0 ...ntel-iommu-device-iotlb.x86_64-latest.xml} | 0 ....xml => intel-iommu-eim.x86_64-latest.xml} | 0 ...l => intel-iommu-machine.x86_64-2.6.0.xml} | 0 ...ommu.xml => intel-iommu.x86_64-latest.xml} | 0 tests/qemuxml2xmltest.c | 15 ++-- 26 files changed, 242 insertions(+), 172 deletions(-) rename tests/qemuxml2argvdata/{intel-iommu-device-iotlb.args => intel-iommu-caching-mode.x86_64-latest.args} (61%) rename tests/qemuxml2argvdata/{intel-iommu-caching-mode.args => intel-iommu-device-iotlb.x86_64-latest.args} (53%) rename tests/qemuxml2argvdata/{intel-iommu-eim.args => intel-iommu-eim.x86_64-latest.args} (62%) rename tests/qemuxml2argvdata/{intel-iommu.args => intel-iommu-machine.x86_64-2.6.0.args} (73%) copy tests/qemuxml2argvdata/{intel-iommu-machine.xml => intel-iommu-wrong-machine.xml} (71%) rename tests/qemuxml2argvdata/{intel-iommu-machine.args => intel-iommu.x86_64-latest.args} (55%) rename tests/qemuxml2xmloutdata/{intel-iommu-caching-mode.xml => intel-iommu-caching-mode.x86_64-latest.xml} (100%) rename tests/qemuxml2xmloutdata/{intel-iommu-device-iotlb.xml => intel-iommu-device-iotlb.x86_64-latest.xml} (100%) rename tests/qemuxml2xmloutdata/{intel-iommu-eim.xml => intel-iommu-eim.x86_64-latest.xml} (100%) rename tests/qemuxml2xmloutdata/{intel-iommu-machine.xml => intel-iommu-machine.x86_64-2.6.0.xml} (100%) rename tests/qemuxml2xmloutdata/{intel-iommu.xml => intel-iommu.x86_64-latest.xml} (100%) -- 2.21.0

4 26

[libvirt] (Dropping) OOM Handling in libvirt
by Daniel P. Berrangé 22 May '19

22 May '19

This is a long mail about ENOMEM (OOM) handling in libvirt. The executive summary is that it is not worth the maint cost because: - this code will almost never run on Linux hosts - if it does run it will likely have bad behaviour silently dropping data or crashing the process - apps using libvirt often do so via a non-C language that aborts/exits the app on OOM regardless, or use other C libraries that abort - we can build a system that is more reliable when OOM happens by not catching OOM, instead simply letting apps exit, restart and carry on where they left off The long answer follows... The background ============== Since the first commit libvirt has attempted to handle out of memory (OOM) errors in the same way it does for any other problem. Namely, a virError will be raised, and the method will jump to its cleanup/error label. The error bubbles up the stack and in theory someone or something will catch this and do something sensible/useful. This has long been considered "best practice" for most C libraries, especially those used for system services. This mail makes the argument that it is in fact /not/ "best practice" to try to handle OOM. OOM handling is very difficult to get correct because it is something that developers almost never encounter and thus the code paths are rarely run. We designed our memory allocation APIs such that we get compile time errors if code forgets to check the return value for failure. This is good as it eliminates an entire class of bugs. Our error handling goto label pattern tries to align OOM handling with other general error handling which is more commonly tested. We have code in the allocators which lets us run unit tests simulating the failure of any allocation that is made during the test. Executing this is extraordinarily time consuming as some of our unit tests have many 1000's or even 10's of 1000's of allocations. The running time to simulate OOM for each allocation is O(N^2) which does not scale well. As a result we've probably only run these OOM tests a handful of times over the years. The tests show we generally do remarkly well at OOM handling, but none the less we have *always* found bugs in our handling where we fail to report the OOM (as in, continue to run but with missing data), or we crash when cleaning up from OOM. Our unit tests don't cover anywhere near all of our codebase though. We have great coverage of XML parsing/formatting, and sporadic coverage of everything else. IOW, despite our clever API designs & coding patterns designed to improve our OOM handling, we can not have confidence that we will actually operate correctly in an OOM scenario. Of course this applies to all error conditions that may arise, but OOM should be considered special. With other error conditions from syscalls or API calls, the effects are largely isolated to the site of the call. With OOM, the OOM condition may well persist and so during cleanup we will hit further OOM problems. We may well fail to even allocate the memory needed for raise a virErrorPtr. All threads can see the OOM concurrently so the effect spreads across the whole process very quickly. Who benefits from OOM handling ============================== Lets pretend for a minute though that our OOM handling is perfect and instead ask who/what is benefitting from it ? Libvirt's own processes. aka libvirtd, virtlockd, virtlogd ---------------------------------------------------------- For libvirtd we have essentially zero confidence that it will handle OOM at all. It is running all virt driver code over which we have massively inadequate unit testing cover to have any confidence that OOM will be well handled. Even if OOM is handled in a worker thread, every iteration of the event loop does an allocation to hold the poll FD array, so we can easily see the event loop hitting OOM which will make the entire process shutdown, or worse, hang during cleanup as worker threads block waiting for the event loop todo something despite not being running anymore. We already expect that bugs will cause libvirtd to crash and so have designed the drivers to be robust such that it can restart and attempt to carry on as normal afterwards. So arguably it would be fine to handle OOM by simply doing an abort and let systemd restart the daemon. For virtlockd and virtlogd we again have little confidence that they will handle OOM correctly. They are, however, more critical processes that we badly need to stay running at all times. We go to great effort to make it possible to re-exec on upgrades keeping state open. For virtlogd we could potentially change the way we deal with stdout/err for QEMU. Instead of using an anonymous pipe, we could create a named fifo on disk for each QEMU process. stdout/err would be connected to one end, and virtlogd to the other end. This would enable us to have virtlogd restarted and re-open the stdout/err for QEMU. This would mean we no longer need the re-exec logic either, which is good as that's another thing that's rarely tested. This would make abort on OOM acceptable. For virtlockd we have the hardest problem. It fundamentally has to keep open the FDs in order to maintain active locks. If it does crash / abort, then all open locks are lost. It would have to manually re-acquire locks when it starts up again, provided it had a record of which locks it was supposed to have. In theory nothing bad should happen in this window where virtlockd is dead, as if libvirtd tries to start another VM it will trigger auto-start of virtlockd via its systemd socket unit, which could then cause it to reacquire previous locks it had. IOW, it should be possible to make virtlockd robust enough that doing abort on OOM is tolerable. We really need this robustness regardless, because virtlockd can of course already crash due to code bugs. If we make it robust to all crashes, then by implication it will be robust enough for aborton OOM. Clients of libvirt. aka oVirt, OpenStack, KubeVirt, virt-manager, cockpit ------------------------------------------------------------------------- Clients of libvirt can consume it via a number of different APIs, all eventually calling into libvirt.so - Core C API aka libvirt.so Catches and propagates OOM to callers. virsh just reports it as it would any other error. In single shot mode it will be exiting regardles with error code. In interactive mode, in theory it can carry on with processing the next command. In practice its CLI parsing will probably then hit OOM anyway causing it to exit. virt-viewer links to GTK and this already has abort-on-OOM behaviour via GLib. So in all liklihood, even if it catches the OOM from libvirt, it will none the less abort on OOM in a GTK/GLib call. libvirt-dbus is written using glib, so again even if it catches the OOM from libvirt it will none the less abort on OOM in a GLib call. - Python binding Python bindings will raise a MemoryError exception which propagates back up to the python code. In theory the app can catch this and take some behaviour. This mostly only works though if the cause was a single huge allocation, such that most other "normal" sized allocations continue working. In a true OOM scenario where arbitrary allocs start failing, the python interpretor will fail too. - Perl binding It is hard to find clear info about Perl behaviour during ENOMEM. The libvirt bindings assume the Perl allocation functions won't ever fail, so if they do we're going to reference a NULL pointer. If normal Perl code gets OOM, the interpretor will raise an error. In theory this can be caught, but in practice few, if any, apps will try so the process will likely quit. - Go binding Errors from libvirt are all turned into Golang errors and propagated to the caller. If the Go runtime gets an OOM from an allocation it will panic the process which can't be caught, so it will exit with stack trace. - Java binding The JVM tends to allocate a fixed size heap for its own use. So Java code can see OOM exceptions even if the OS has plenty of memory. If the OS does run out of memory, assuming the JVM heap was already fully allocated it shouldn't immediately be affect, but might suffer collatoral damage. But in theory libvirt OOM could get turned into a Java exception that an app can catch & handle nicely. There are other bindings, but the above captures the most important usage of libvirt. The complication of Linux ========================= Note that all of the above discussion had the implicit assumption that malloc will actually return ENOMEM when memory is exhausted. On Linux at least this is not the case in a default install. Linux tends to enable memory overcommit causing the kernel to satisfy malloc requests even if it exceeds available RAM + Swap. The allocated memory won't even be paged in to physical RAM until the page is written to. If there is insufficient to make a page resident in RAM, then the OOM killer is set free. Some poor victim will get killed off. It is possible to disable RAM overcommit and also disable or deprioritize the OOM killer. This might make it possible to actually see ENOMEM from an allocation, but few if any developers or applications run in this scenario so it should be considered untested in reality. With cgroups it is possible to RAM and swap usage limits. In theory you can disable the OOM killer per-cgroup and this will cause ENOMEM to the app. In my testing with a trivial C program that simply mallocs a massive array and them memsets it, it is hard to get ENOMEM to happen reliably. Sometimes the app ends up just hanging when testing this. Other operating systems have different behaviour and so are more likely to really report ENOMEM to application code, but even if you can get ENOMEM on other OS the earlier points illustrate that its not worth worrying about. The conclusion ============== To repeat the top of this document, attempts to handle OOM are not worth the maint cost they incur: - this code will almost never run on Linux hosts - if it does run it will likely have bad behaviour silently dropping data or crashing the process - apps using libvirt often do so via a non-C language that aborts/exits the app on OOM regardless, or use other C libraries that abort - we can build a system that is more reliable when OOM happens by not catching OOM, instead simply letting apps exit, restart and carry on where they left off. The proposal is thus to change all libvirt code (ie both client and server side), to abort on OOM. This will allow us to simplify the control flow in many methods eliminating ~1500 checks for memory failure, their associated goto jumps, and many of the cleanup/error labels. This makes the code easier to follow & maintain and opens up new avenues for improving libvirt's future development. The main blocking prequisite to making the change is to address the needs for reliable restart of virtlockd and virtlogd daemons. As a point of reference libguestfs has had abort-on-oom behaviour forever and no one has complained about this behaviour. Apps using libvirt often also use libguestfs in the same process. The implementation ================== Assuming a decision to abort on OOM, libvirt can nwo follow QEMU's lead and make use of the GLib library. The initial impl would thus be to just link to GLib and switch VIR_ALLOC related APIs to use g_new/g_malloc & friends internally. Over time code can be changed to use g_new/g_malloc directly thus removing the error handling incrementally. Use of GLib brings a number of other significant opportunities / advantages to ongoing development - Access to many standard data structures (hash tables, linked lists, queues, growable arrays, growable strings). - Access to platform portability APIs for threads, event loops, file I/O, filename parsing and more. - Access to GObject to replace our own virObject clone with something that is far more feature rich. This is especially true of its callback facility via signal handlers. - Access to GIO to replace much of our socket I/O portability wrappers, and DBus client APIs. - Opens the possibility of calling to code in a non-C language via the GObject introspection bindings for GObject & other helper APIs. - Ability to drop use of gnulib once we use GLib for all portability problems we currently rely on gnulib for, once a critical set of functionality is ported to the GLib APIs. Most important is the sockets / event loop stuff due to Windows portability. - Ability to drop use of autoconf/automake in favour of a more maintainable option like meson/ninja, once we eliminate use of gnulib. Ultimately the big picture benefit is that we can spend less time working on low level generic code related to platform portability, data structures, or system services. Note this is not claiming that all GLib's APIs are better than stuff we have implemented in libvirt already. The belief is that even if some of the GLib APIs are worse, it is still a benefit to the project to use them, as it will reduce the code we maintain ourselves. This in turns lets us spend more time working on high level code directly related to virtualization features and be more productive when doing so. Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

8 17

[libvirt] Why virsh domxml-to-native qemu-argv cut VN name
by Tal Attaly 21 May '19

21 May '19

Hi, I think there is a bug when running virsh domxml-to-native qemu-argv with VM with long name, it getting cut - .. -name guest=l-dev-vrt-140-022-RH-7.0-Tal,debug-threads=on -object secret,id=masterKey0,format=raw,file=/var/lib/libvirt/qemu/domain--1-l-dev-vrt-140-022-RH/master-key.aes -machine pc-i440fx-2.12,accel=kvm,usb=off,dump-guest-core=off -m 8192 -realtime mlock=off -smp 2,sockets=2,cores=1,threads=1 -uuid cb48f75c-40f6-432d-964b-906ee0bdcf48 -no-user-config -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/domain--1-l-dev-vrt-140-022-RH/monitor.sock,server,nowait .. -name is ok, but -object and -chardev are cut, which cause QEMU to file on - qemu-system-x86_64: -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/do main--1-l-dev-vrt-140-022-RH/monitor.sock,server,nowait: Failed to bind socket to /var/lib/libvirt/qemu/doma in--1-l-dev-vrt-140-022-RH/monitor.sock: No such file or directory Libvirt version is 3.9.0, here is the full domain XML - <domain type='kvm' xmlns:qemu='http://libvirt.org/schemas/domain/qemu/1.0'> <name>l-dev-vrt-140-022-RH-7.0-Tal</name> <uuid>cb48f75c-40f6-432d-964b-906ee0bdcf48</uuid> <memory unit='KiB'>8388608</memory> <currentMemory unit='KiB'>4194304</currentMemory> <vcpu placement='static'>2</vcpu> <os> <type arch='x86_64' machine='pc-i440fx-2.12'>hvm</type> <boot dev='hd'/> </os> <features> <acpi/> <apic/> <pae/> </features> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>restart</on_crash> <devices> <emulator>x86_64-softmmu/qemu-system-x86_64</emulator> <disk type='file' device='disk'> <driver name='qemu' type='qcow2' cache='none'/> <source file='/images/l-dev-vrt-140-022/l-dev-vrt-140-022.img'/> <target dev='hda' bus='ide'/> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> <controller type='usb' index='0'> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> </controller> <controller type='ide' index='0'> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/> </controller> <controller type='pci' index='0' model='pci-root'/> <interface type='bridge'> <mac address='00:50:56:18:8c:16'/> <source bridge='br0:'/> <model type='e1000'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </interface> <serial type='pty'> <target type='isa-serial' port='0'> <model name='isa-serial'/> </target> </serial> <console type='pty'> <target type='serial' port='0'/> </console> <input type='mouse' bus='ps2'/> <input type='keyboard' bus='ps2'/> <graphics type='vnc' port='-1' autoport='yes'> <listen type='address'/> </graphics> <video> <model type='cirrus' vram='16384' heads='1' primary='yes'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </video> <memballoon model='virtio'> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> </memballoon> </devices> </domain> Thanks, Tal

2 1

[libvirt] [PATCH 0/3] docs: hacking: Discourage some patterns to help code readability
by Peter Krempa 21 May '19

21 May '19

Peter Krempa (3): docs: hacking: Document few practices for creating error messages docs: hacking: Add good practices for shortening conditional expressions docs: hacking: Discourage use of the ternary operator and ban it's abuse docs/hacking.html.in | 61 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) -- 2.21.0

3 7

[libvirt] [PATCH 0/3] Fix access controls for virtlockd/virtlogd sockets
by Daniel P. Berrangé 21 May '19

21 May '19

This series fixes CVE-2019-10132 It is pushed to master as it was reviewed on the security list ahead of time. Daniel P. Berrangé (3): admin: reject clients unless their UID matches the current UID locking: restrict sockets to mode 0600 logging: restrict sockets to mode 0600 src/admin/admin_server_dispatch.c | 22 ++++++++++++++++++++++ src/locking/virtlockd-admin.socket.in | 1 + src/locking/virtlockd.socket.in | 1 + src/logging/virtlogd-admin.socket.in | 1 + src/logging/virtlogd.socket.in | 1 + 5 files changed, 26 insertions(+) -- 2.21.0

1 3

[libvirt] [PATCH v2 for 5.3.0] storage_backend_rbd: Ignore rbd_diff_iterate error() if needed
by Michal Privoznik 21 May '19

21 May '19

When cloning an RBD volume we try to find a snapshot which is not different to the image we're trying to clone. This boils down to calling rbd_diff_iterate() or rbd_diff_iterate2() on systems with newer ceph. These two are passed a callback - virStorageBackendRBDIterateCb() which sets @diff to 1 and returns -1. The idea is to stop iterating as soon as possible (i.e. we're iterating over a snapshot with some deltas). Unfortunately, returning a negative value from the callback means that iterate() function fails and thus we report an error: virsh # vol-clone --pool rbd_image_root coreos_2023 coreos00.disk error: Failed to clone vol from coreos_2023 error: failed to iterate RBD snapshot coreos_2023@base: Operation not permitted Therefore, report an error if and only if it doesn't originates in the callback. Reported on libvirt-users list: https://www.redhat.com/archives/libvirt-users/2019-April/msg00060.html Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- diff to v1: - Ignore error as suggested by Jason as it allows us to exit iteration early. src/storage/storage_backend_rbd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/storage/storage_backend_rbd.c b/src/storage/storage_backend_rbd.c index f8c968e682..69f4fa2117 100644 --- a/src/storage/storage_backend_rbd.c +++ b/src/storage/storage_backend_rbd.c @@ -1101,7 +1101,9 @@ virStorageBackendRBDSnapshotFindNoDiff(rbd_image_t image, virStorageBackendRBDIterateCb, (void *)&diff); #endif - if (r < 0) { + /* We care for errors only if the callback wasn't called at all. If it + * was, rbd_diff_iterate() returns an error which we have to ignore. */ + if (r < 0 && diff == 0) { virReportSystemError(-r, _("failed to iterate RBD snapshot %s@%s"), imgname, snaps[i].name); goto cleanup; -- 2.21.0

2 1

[libvirt] [PATCH 0/4] qemu: Don't use API flags in monitor code (blockdev-add saga)
by Peter Krempa 21 May '19

21 May '19

Peter Krempa (4): qemu: migration: Don't pass around flags for different API qemu: monitor: Don't pass full flags to qemuMonitorJSONBlockdevMirror qemu: monitor: Don't pass full flags to qemuMonitorJSONDriveMirror qemu: monitor: Use VIR_AUTOPTR in qemuMonitorJSON(Drive/Blockdev)Mirror src/qemu/qemu_driver.c | 4 +- src/qemu/qemu_migration.c | 21 ++++------ src/qemu/qemu_monitor.c | 17 ++++---- src/qemu/qemu_monitor.h | 5 ++- src/qemu/qemu_monitor_json.c | 79 ++++++++++++++---------------------- src/qemu/qemu_monitor_json.h | 5 ++- tests/qemumonitorjsontest.c | 6 +-- 7 files changed, 60 insertions(+), 77 deletions(-) -- 2.21.0

2 8

[libvirt] [PATCH 00/12] qemu: cleanups and improvements of blockjob handling (blockdev-add saga)
by Peter Krempa 21 May '19

21 May '19

Peter Krempa (12): qemu: blockjob: Remove 'started' from struct _qemuBlockJobData qemu: blockjob: Fix documentation for 'newstate' of _qemuBlockJobData qemu: driver: Don't try to update blockjob status in qemuDomainGetBlockJobInfo qemu: driver: Set mirror state after successful command qemu: Modernize memory cleaning in qemuDomainBlockCopyCommon qemu: Modernize memory cleaning in qemuDomainBlockPullCommon qemu: Modernize memory cleaning in qemuDomainBlockCommit qemu: Remove unecessary error keeping in qemuDomainBlockCopyCommon qemu: Remove unnecessary calls to qemuDomainStorageSourceAccessRevoke qemu: Validate backing store of 'mirror' for block copy qemu: Simplify allowing access to storage file for block copy qemu: blockcopy: sanitize permission handling for 'mirror' src/qemu/qemu_blockjob.h | 3 +- src/qemu/qemu_driver.c | 185 ++++++++++++++++++++------------------- 2 files changed, 97 insertions(+), 91 deletions(-) -- 2.21.0

2 24

[libvirt] [PATCH] i18n: simplify mini po generation
by Marty E. Plummer 21 May '19

21 May '19

If you pass --for-msgfmt to msgmerge it will automatically do most of what you had the perl script doing. Signed-off-by: Marty E. Plummer <hanetzer(a)startmail.com> --- The only downside I can see is the loss of the comment headers with the copyright year and such. A global note in the README.md or so may be an acceptable change. Makefile.am | 1 - build-aux/minimize-po.pl | 37 ------------------------------------- po/Makefile.am | 8 +++----- 3 files changed, 3 insertions(+), 43 deletions(-) delete mode 100755 build-aux/minimize-po.pl diff --git a/Makefile.am b/Makefile.am index dedd8d2ff8..ca7e012512 100644 --- a/Makefile.am +++ b/Makefile.am @@ -46,7 +46,6 @@ EXTRA_DIST = \ build-aux/check-spacing.pl \ build-aux/gitlog-to-changelog \ build-aux/header-ifdef.pl \ - build-aux/minimize-po.pl \ build-aux/mock-noinline.pl \ build-aux/prohibit-duplicate-header.pl \ build-aux/useless-if-before-free \ diff --git a/build-aux/minimize-po.pl b/build-aux/minimize-po.pl deleted file mode 100755 index 497533a836..0000000000 --- a/build-aux/minimize-po.pl +++ /dev/null @@ -1,37 +0,0 @@ -#!/usr/bin/perl - -my @block; -my $msgstr = 0; -my $empty = 0; -my $unused = 0; -my $fuzzy = 0; -while (<>) { - if (/^$/) { - if (!$empty && !$unused && !$fuzzy) { - print @block; - } - @block = (); - $msgstr = 0; - $fuzzy = 0; - push @block, $_; - } else { - if (/^msgstr/) { - $msgstr = 1; - $empty = 1; - } - if (/^#.*fuzzy/) { - $fuzzy = 1; - } - if (/^#~ msgstr/) { - $unused = 1; - } - if ($msgstr && /".+"/) { - $empty = 0; - } - push @block, $_; - } -} - -if (@block && !$empty && !$unused) { - print @block; -} diff --git a/po/Makefile.am b/po/Makefile.am index da117edbd5..9ac0bf3357 100644 --- a/po/Makefile.am +++ b/po/Makefile.am @@ -55,11 +55,9 @@ update-gmo: $(GMOFILES) update-mini-po: $(POTFILE) for lang in $(LANGS); do \ echo "Minimizing $$lang content" && \ - $(MSGMERGE) --no-location --no-fuzzy-matching --sort-output \ - $$lang.po $(POTFILE) | \ - $(SED) $(SED_PO_FIXUP_ARGS) | \ - $(PERL) $(top_srcdir)/build-aux/minimize-po.pl > \ - $(srcdir)/$$lang.mini.po ; \ + $(MSGMERGE) --for-msgfmt --sort-output \ + $$lang.po $(POTFILE) \ + -o $(srcdir)/$$lang.mini.po ; \ done push-pot: $(POTFILE) -- 2.21.0

2 3

[libvirt] [PATCH] virt-xml-validate: Allow input to be read from stdin
by Johannes Holmberg 21 May '19

21 May '19

--- Hello, This is an updated version of a patch I submitted on 2015-06-10. I got some feedback on it but then moved on to a different project and forgot about it. Anyway, I've updated the patch according to the feedback so if you are still interested, here it is! :) /Johannes tools/virt-xml-validate.in | 44 ++++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 11 deletions(-) diff --git a/tools/virt-xml-validate.in b/tools/virt-xml-validate.in index 64aeaaaa33..2d2afb74ec 100644 --- a/tools/virt-xml-validate.in +++ b/tools/virt-xml-validate.in @@ -16,6 +16,16 @@ set -e +TMPFILE= + +cleanup() { + if [ $TMPFILE ]; then + rm -f $TMPFILE + fi +} + +trap cleanup EXIT + case $1 in -h | --h | --he | --hel | --help) cat <<EOF @@ -34,7 +44,7 @@ $0 (libvirt) @VERSION@ EOF exit ;; --) shift ;; - -*) + -?*) echo "$0: unrecognized option '$1'" >&2 exit 1 ;; esac @@ -42,18 +52,27 @@ esac XMLFILE="$1" TYPE="$2" -if [ -z "$XMLFILE" ]; then - echo "syntax: $0 XMLFILE [TYPE]" >&2 - exit 1 -fi +if [ "$XMLFILE" = "-" ]; then + TMPFILE=`mktemp --tmpdir virt-xml.XXXX` + cat > $TMPFILE +else + if [ -z "$XMLFILE" ]; then + echo "syntax: $0 XMLFILE [TYPE]" >&2 + exit 1 + fi -if [ ! -f "$XMLFILE" ]; then - echo "$0: document $XMLFILE does not exist" >&2 - exit 2 + if [ ! -f "$XMLFILE" ]; then + echo "$0: document $XMLFILE does not exist" >&2 + exit 2 + fi fi if [ -z "$TYPE" ]; then - ROOT=`xmllint --stream --debug "$XMLFILE" 2>/dev/null | grep "^0 1 " | awk '{ print $3 }'` + if [ $TMPFILE ]; then + ROOT=`xmllint --stream --debug - < "$TMPFILE" 2>/dev/null | grep "^0 1 " | awk '{ print $3 }'` + else + ROOT=`xmllint --stream --debug "$XMLFILE" 2>/dev/null | grep "^0 1 " | awk '{ print $3 }'` + fi case "$ROOT" in *domainsnapshot*) # Must come first, since *domain* is a substring TYPE="domainsnapshot" @@ -101,6 +120,9 @@ if [ ! -f "$SCHEMA" ]; then exit 4 fi -xmllint --noout --relaxng "$SCHEMA" "$XMLFILE" - +if [ $TMPFILE ]; then + xmllint --noout --relaxng "$SCHEMA" - < "$TMPFILE" +else + xmllint --noout --relaxng "$SCHEMA" "$XMLFILE" +fi exit -- 2.17.1

3 5

[libvirt] [PATCH 0/6] networkStartNetworkVirtual: Cleanup error labels
by Michal Privoznik 21 May '19

21 May '19

*** BLURB HERE *** Michal Prívozník (6): networkStartNetworkVirtual: s/err5/error networkStartNetworkVirtual: Dissolve 'err4' label in 'error' networkStartNetworkVirtual: Dissolve 'err3' label in 'error' networkStartNetworkVirtual: Dissolve 'err2' label in 'error' networkStartNetworkVirtual: Dissolve 'err1' label in 'error' networkStartNetworkVirtual: Dissolve 'err0' label in 'error' src/network/bridge_driver.c | 73 +++++++++++++++++-------------------- 1 file changed, 33 insertions(+), 40 deletions(-) -- 2.21.0

2 7

[libvirt] [PATCH] Revert "qemu: Do not override config XML in case of snapshot revert"
by Michal Privoznik 20 May '19

20 May '19

This reverts commit dfd70ca1ebc623fcda788c414a472107b37b2bb8. Pushed by a mistake, sorry. There's still some discussion going on upstream. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- /me needs to learn to clean branches before pushing some stuff. Sorry for the noise. Pushed now. src/qemu/qemu_driver.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 06d8cb2471..9c0796b0a4 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -16243,7 +16243,6 @@ qemuDomainRevertToSnapshot(virDomainSnapshotPtr snapshot, qemuDomainObjPrivatePtr priv; int rc; virDomainDefPtr config = NULL; - virDomainDefPtr inactiveConfig = NULL; virQEMUDriverConfigPtr cfg = NULL; virCapsPtr caps = NULL; bool was_stopped = false; @@ -16458,7 +16457,7 @@ qemuDomainRevertToSnapshot(virDomainSnapshotPtr snapshot, goto endjob; } if (config) { - virDomainObjAssignDef(vm, config, false, &inactiveConfig); + virDomainObjAssignDef(vm, config, false, NULL); virCPUDefFree(priv->origCPU); VIR_STEAL_PTR(priv->origCPU, origCPU); } @@ -16467,7 +16466,7 @@ qemuDomainRevertToSnapshot(virDomainSnapshotPtr snapshot, load: was_stopped = true; if (config) - virDomainObjAssignDef(vm, config, false, &inactiveConfig); + virDomainObjAssignDef(vm, config, false, NULL); /* No cookie means libvirt which saved the domain was too old to * mess up the CPU definitions. @@ -16526,9 +16525,6 @@ qemuDomainRevertToSnapshot(virDomainSnapshotPtr snapshot, detail); } } - if (inactiveConfig) - VIR_STEAL_PTR(vm->newDef, inactiveConfig); - break; case VIR_DOMAIN_SNAPSHOT_SHUTDOWN: @@ -16556,11 +16552,8 @@ qemuDomainRevertToSnapshot(virDomainSnapshotPtr snapshot, qemuProcessEndJob(driver, vm); goto cleanup; } - if (config) { - virDomainObjAssignDef(vm, config, false, &inactiveConfig); - if (inactiveConfig) - VIR_STEAL_PTR(vm->newDef, inactiveConfig); - } + if (config) + virDomainObjAssignDef(vm, config, false, NULL); if (flags & (VIR_DOMAIN_SNAPSHOT_REVERT_RUNNING | VIR_DOMAIN_SNAPSHOT_REVERT_PAUSED)) { -- 2.21.0

2 1

[libvirt] [glib PATCH 00/16] Update libvirt-glib python examples
by Fabiano Fidêncio 20 May '19

20 May '19

This series contains a bunch of trivial fixes for our python examples, including: - Not using ";" at the end of the lines; - Ensuring that the right version of the libraries are imported; - Change the scripts so they're python3 compatible - Update the sha-bang lines to use python3 Fabiano Fidêncio (16): config-demo: Don't use ";" in the end of lines config-demo: Ensure the right LibvirtGConfig version gets loaded config-demo: Use print() in a py3 compatible way config-demo: Use octal when setting mode config-demo: Change she-bang line to use python3 conn-test: Don't use ";" in the end of lines conn-test: Ensure the right versions of LibvirtGObject and Gtk get loaded conn-test: Use print() in a py3 compatible way conn-test: Handle exceptions in a py3 compatible way conn-test: Change sha-bang line to use python3 event-test: LibvirtGLib.init() takes (at maximum) 1 argment event-test: Don't use ";" in the end of lines event-test: Ensure the right versions of LibvirtGLib and Gtk get loaded event-test: Use print() in a py3 compatible way event-test: Handle exceptions in a py3 compatible way event-test: Change sha-bang line to use python3 examples/config-demo.py | 15 +++++++++------ examples/conn-test.py | 20 ++++++++++++-------- examples/event-test.py | 28 ++++++++++++++++------------ 3 files changed, 37 insertions(+), 26 deletions(-) -- 2.21.0

3 28

[libvirt] [PATCH v1] qemu: migration: Convert to virErrorRestore/virErrorPreserveLast
by Syed Humaid 20 May '19

20 May '19

Replaced usages of virSaveLastError and virSetError/virFreeError with virErrorPreserveLast and virErrorRestore respectively. Signed-off-by: Syed Humaid <syedhumaidbinharoon(a)gmail.com> --- src/qemu/qemu_migration.c | 75 +++++++++++++-------------------------- 1 file changed, 24 insertions(+), 51 deletions(-) diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index e3ad4e52a7..b1fe79aed9 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -722,7 +722,7 @@ qemuMigrationSrcNBDCopyCancel(virQEMUDriverPtr driver, if (rv != 0) { if (rv < 0) { if (!err) - err = virSaveLastError(); + virErrorPreserveLast(&err); failed = true; } qemuBlockJobSyncEnd(vm, job, asyncJob); @@ -747,7 +747,7 @@ qemuMigrationSrcNBDCopyCancel(virQEMUDriverPtr driver, } if (failed && !err) - err = virSaveLastError(); + virErrorPreserveLast(&err); if (virDomainObjWait(vm) < 0) goto cleanup; @@ -769,10 +769,7 @@ qemuMigrationSrcNBDCopyCancel(virQEMUDriverPtr driver, ret = failed ? -1 : 0; cleanup: - if (err) { - virSetError(err); - virFreeError(err); - } + virErrorRestore(&err); return ret; } @@ -3189,16 +3186,13 @@ static void qemuMigrationSrcIOFunc(void *arg) return; abrt: - err = virSaveLastError(); + virErrorPreserveLast(&err); if (err && err->code == VIR_ERR_OK) { virFreeError(err); err = NULL; } virStreamAbort(data->st); - if (err) { - virSetError(err); - virFreeError(err); - } + virErrorRestore(&err); error: /* Let the source qemu know that the transfer cant continue anymore. @@ -3685,15 +3679,12 @@ qemuMigrationSrcRun(virQEMUDriverPtr driver, if (events) priv->signalIOError = false; - if (orig_err) { - virSetError(orig_err); - virFreeError(orig_err); - } + virErrorRestore(&orig_err); return ret; error: - orig_err = virSaveLastError(); + virErrorPreserveLast(&orig_err); if (virDomainObjIsActive(vm)) { if (cancel && @@ -3948,7 +3939,7 @@ qemuMigrationSrcPerformPeer2Peer2(virQEMUDriverPtr driver, virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("domainMigratePrepare2 did not set uri")); cancelled = true; - orig_err = virSaveLastError(); + virErrorPreserveLast(&orig_err); goto finish; } @@ -3971,7 +3962,7 @@ qemuMigrationSrcPerformPeer2Peer2(virQEMUDriverPtr driver, /* Perform failed. Make sure Finish doesn't overwrite the error */ if (ret < 0) - orig_err = virSaveLastError(); + virErrorPreserveLast(&orig_err); /* If Perform returns < 0, then we need to cancel the VM * startup on the destination @@ -4004,10 +3995,7 @@ qemuMigrationSrcPerformPeer2Peer2(virQEMUDriverPtr driver, virObjectUnref(st); - if (orig_err) { - virSetError(orig_err); - virFreeError(orig_err); - } + virErrorRestore(&orig_err); VIR_FREE(uri_out); VIR_FREE(cookie); @@ -4181,13 +4169,13 @@ qemuMigrationSrcPerformPeer2Peer3(virQEMUDriverPtr driver, if (useParams && virTypedParamsReplaceString(&params, &nparams, VIR_MIGRATE_PARAM_URI, uri_out) < 0) { - orig_err = virSaveLastError(); + virErrorPreserveLast(&orig_err); goto finish; } } else if (!uri && !(flags & VIR_MIGRATE_TUNNELLED)) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("domainMigratePrepare3 did not set uri")); - orig_err = virSaveLastError(); + virErrorPreserveLast(&orig_err); goto finish; } @@ -4220,7 +4208,7 @@ qemuMigrationSrcPerformPeer2Peer3(virQEMUDriverPtr driver, /* Perform failed. Make sure Finish doesn't overwrite the error */ if (ret < 0) { - orig_err = virSaveLastError(); + virErrorPreserveLast(&orig_err); } else { qemuMigrationJobSetPhase(driver, vm, QEMU_MIGRATION_PHASE_PERFORM3_DONE); @@ -4312,7 +4300,7 @@ qemuMigrationSrcPerformPeer2Peer3(virQEMUDriverPtr driver, * one we need to preserve it in case confirm3 overwrites */ if (!orig_err) - orig_err = virSaveLastError(); + virErrorPreserveLast(&orig_err); /* * If cancelled, then src VM will be restarted, else @@ -4344,10 +4332,7 @@ qemuMigrationSrcPerformPeer2Peer3(virQEMUDriverPtr driver, virObjectUnref(st); - if (orig_err) { - virSetError(orig_err); - virFreeError(orig_err); - } + virErrorRestore(&orig_err); VIR_FREE(uri_out); VIR_FREE(cookiein); VIR_FREE(cookieout); @@ -4523,15 +4508,12 @@ qemuMigrationSrcPerformPeer2Peer(virQEMUDriverPtr driver, } cleanup: - orig_err = virSaveLastError(); + virErrorPreserveLast(&orig_err); qemuDomainObjEnterRemote(vm); virConnectUnregisterCloseCallback(dconn, qemuMigrationSrcConnectionClosed); virObjectUnref(dconn); ignore_value(qemuDomainObjExitRemote(vm, false)); - if (orig_err) { - virSetError(orig_err); - virFreeError(orig_err); - } + virErrorRestore(&orig_err); virObjectUnref(cfg); return ret; } @@ -4619,7 +4601,7 @@ qemuMigrationSrcPerformJob(virQEMUDriverPtr driver, endjob: if (ret < 0) - orig_err = virSaveLastError(); + virErrorPreserveLast(&orig_err); /* v2 proto has no confirm phase so we need to reset migration parameters * here @@ -4639,10 +4621,7 @@ qemuMigrationSrcPerformJob(virQEMUDriverPtr driver, qemuDomainRemoveInactiveJob(driver, vm); } - if (orig_err) { - virSetError(orig_err); - virFreeError(orig_err); - } + virErrorRestore(&orig_err); cleanup: virObjectEventStateQueue(driver->domainEventState, event); @@ -5052,7 +5031,7 @@ qemuMigrationDstFinish(virQEMUDriverPtr driver, /* Need to save the current error, in case shutting * down the process overwrites it */ - orig_err = virSaveLastError(); + virErrorPreserveLast(&orig_err); /* * In v3 protocol, the source VM is still available to @@ -5181,10 +5160,7 @@ qemuMigrationDstFinish(virQEMUDriverPtr driver, VIR_FREE(priv->origname); virDomainObjEndAPI(&vm); qemuMigrationCookieFree(mig); - if (orig_err) { - virSetError(orig_err); - virFreeError(orig_err); - } + virErrorRestore(&orig_err); virObjectUnref(cfg); /* Set a special error if Finish is expected to return NULL as a result of @@ -5289,7 +5265,7 @@ qemuMigrationSrcToFile(virQEMUDriverPtr driver, virDomainObjPtr vm, if (rc < 0) { if (rc == -2) { - orig_err = virSaveLastError(); + virErrorPreserveLast(&orig_err); virCommandAbort(cmd); if (virDomainObjIsActive(vm) && qemuDomainObjEnterMonitorAsync(driver, vm, asyncJob) == 0) { @@ -5308,7 +5284,7 @@ qemuMigrationSrcToFile(virQEMUDriverPtr driver, virDomainObjPtr vm, cleanup: if (ret < 0 && !orig_err) - orig_err = virSaveLastError(); + virErrorPreserveLast(&orig_err); /* Restore max migration bandwidth */ if (virDomainObjIsActive(vm) && @@ -5326,10 +5302,7 @@ qemuMigrationSrcToFile(virQEMUDriverPtr driver, virDomainObjPtr vm, virCommandFree(cmd); } - if (orig_err) { - virSetError(orig_err); - virFreeError(orig_err); - } + virErrorRestore(&orig_err); return ret; } -- 2.20.1

2 1

[libvirt] [PATCH v1] qemu: Convert to virErrorPreserveLast/virErrorRestore
by Syed Humaid 20 May '19

20 May '19

Replaced usage of virSaveLastError and virSetError/virFreeError with virErrorPreserveLast and virErrorRestore respectively. Signed-off-by: Syed Humaid <syedhumaidbinharoon(a)gmail.com> --- src/qemu/qemu_cgroup.c | 7 ++----- src/qemu/qemu_command.c | 2 +- src/qemu/qemu_domain.c | 2 +- src/qemu/qemu_driver.c | 28 ++++++++-------------------- 4 files changed, 12 insertions(+), 27 deletions(-) diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c index ca76c4fdfa..c8d9ae4808 100644 --- a/src/qemu/qemu_cgroup.c +++ b/src/qemu/qemu_cgroup.c @@ -1123,10 +1123,7 @@ qemuSetupCgroupVcpuBW(virCgroupPtr cgroup, if (period) { virErrorPtr saved = virSaveLastError(); ignore_value(virCgroupSetCpuCfsPeriod(cgroup, old_period)); - if (saved) { - virSetError(saved); - virFreeError(saved); - } + virErrorRestore(&saved); } return -1; @@ -1334,7 +1331,7 @@ qemuCgroupEmulatorAllNodesRestore(qemuCgroupEmulatorAllNodesDataPtr data) if (!data) return; - err = virSaveLastError(); + virErrorPreserveLast(&err); virCgroupSetCpusetMems(data->emulatorCgroup, data->emulatorMemMask); virSetError(err); virFreeError(err); diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 1425d97b1e..9772e4f9af 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -9119,7 +9119,7 @@ qemuBuildNetCommandLine(virQEMUDriverPtr driver, error: /* free up any resources in the network driver * but don't overwrite the original error */ - originalError = virSaveLastError(); + virErrorPreserveLast(&originalError); for (i = 0; last_good_net != -1 && i <= last_good_net; i++) virDomainConfNWFilterTeardown(def->nets[i]); virSetError(originalError); diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 960aaff3c7..dff1d7b1a5 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -8042,7 +8042,7 @@ void qemuDomainObjTaint(virQEMUDriverPtr driver, /* We don't care about errors logging taint info, so * preserve original error, and clear any error that * is raised */ - orig_err = virSaveLastError(); + virErrorPreserveLast(&orig_err); if (!(timestamp = virTimeStringNow())) goto cleanup; diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index f48d9256e4..51b16f5aa1 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6844,7 +6844,7 @@ qemuDomainSaveImageStartVM(virConnectPtr conn, * must manually kill it and ignore any error related to * the process */ - orig_err = virSaveLastError(); + virErrorPreserveLast(&orig_err); VIR_FORCE_CLOSE(intermediatefd); VIR_FORCE_CLOSE(*fd); } @@ -6855,10 +6855,7 @@ qemuDomainSaveImageStartVM(virConnectPtr conn, } VIR_DEBUG("Decompression binary stderr: %s", NULLSTR(errbuf)); - if (orig_err) { - virSetError(orig_err); - virFreeError(orig_err); - } + virErrorRestore(&orig_err); } VIR_FORCE_CLOSE(intermediatefd); @@ -14398,7 +14395,7 @@ qemuDomainSnapshotFSThaw(virQEMUDriverPtr driver ATTRIBUTE_UNUSED, agent = qemuDomainObjEnterAgent(vm); if (!report) - err = virSaveLastError(); + virErrorPreserveLast(&err); thawed = qemuAgentFSThaw(agent); if (!report) virSetError(err); @@ -15308,7 +15305,7 @@ qemuDomainSnapshotCreateDiskActive(virQEMUDriverPtr driver, error: if (ret < 0) { - orig_err = virSaveLastError(); + virErrorPreserveLast(&orig_err); for (i = 0; i < snapdef->ndisks; i++) { if (!diskdata[i].src) continue; @@ -15351,10 +15348,7 @@ qemuDomainSnapshotCreateDiskActive(virQEMUDriverPtr driver, virJSONValueFree(actions); virObjectUnref(cfg); - if (orig_err) { - virSetError(orig_err); - virFreeError(orig_err); - } + virErrorRestore(&orig_err); return ret; } @@ -17773,7 +17767,7 @@ qemuDomainBlockCopyCommon(virDomainObjPtr vm, if (qemuDomainObjExitMonitor(driver, vm) < 0) ret = -1; if (ret < 0) { - monitor_error = virSaveLastError(); + virErrorPreserveLast(&monitor_error); qemuDomainDiskChainElementRevoke(driver, vm, mirror); goto endjob; } @@ -17795,10 +17789,7 @@ qemuDomainBlockCopyCommon(virDomainObjPtr vm, VIR_WARN("%s", _("unable to remove just-created copy target")); virStorageFileDeinit(mirror); qemuDomainObjEndJob(driver, vm); - if (monitor_error) { - virSetError(monitor_error); - virFreeError(monitor_error); - } + virErrorRestore(&monitor_error); qemuBlockJobStartupFinalize(job); cleanup: @@ -18196,10 +18187,7 @@ qemuDomainBlockCommit(virDomainPtr dom, if (top_parent && top_parent != disk->src) qemuDomainDiskChainElementPrepare(driver, vm, top_parent, true, false); - if (orig_err) { - virSetError(orig_err); - virFreeError(orig_err); - } + virErrorRestore(&orig_err); } qemuBlockJobStartupFinalize(job); qemuDomainObjEndJob(driver, vm); -- 2.20.1

2 1

[libvirt] [PATCH] qemuProcessReconnect: ensure vm xml integrity when save status
by Wang King 20 May '19

20 May '19

From: Dingzhong Weng <wengdingzhong(a)huawei.com> libvirtd starts qemuProcessReconnect threads when libvirtd is starting and there are live vm on the host. but as qemuProcessReconnect threads are simply side job done by libvirtd upon start and are only called for existing vm. these threads are not managed like that of worker threads and event pool. once libvirtd receives SIGTERM signal or any similar command right after it starts, these qemuProcessReconnect threads might still be running and libvirtd goes to clean up and frees qemu_driver and its components. In this short window, qemuProcessReconnect threads might have a NULL qemu_driver->xmlopt.format, skip this function, and only partial vm status can be saved to disk. As a result, vm may fail to recover with missing information. this patch increases qemu_driver->xmlopt ref count during the lifecycle of qemuProcessReconnect so that libvirtd will not release this resource until qemuProcessReconnect threads finish using it. thus make sure all of vm status information can be formatted and thus maintain its integrity in virDomainSaveStatus. no vm is killed in this patch. Signed-off-by: Dingzhong Weng <wengdingzhong(a)huawei.com> --- src/qemu/qemu_process.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 90466771cd..36b9b5fd03 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -8000,6 +8000,7 @@ qemuProcessReconnect(void *opaque) struct qemuProcessReconnectData *data = opaque; virQEMUDriverPtr driver = data->driver; virDomainObjPtr obj = data->obj; + virDomainXMLOptionPtr xmlopt = NULL; qemuDomainObjPrivatePtr priv; qemuDomainJobObj oldjob; int state; @@ -8023,6 +8024,9 @@ qemuProcessReconnect(void *opaque) cfg = virQEMUDriverGetConfig(driver); priv = obj->privateData; + /* need xmlopt later to save status, do not free */ + xmlopt = virObjectRef(driver->xmlopt); + if (!(caps = virQEMUDriverGetCapabilities(driver, false))) goto error; @@ -8218,7 +8222,7 @@ qemuProcessReconnect(void *opaque) } /* update domain state XML with possibly updated state in virDomainObj */ - if (virDomainSaveStatus(driver->xmlopt, cfg->stateDir, obj, driver->caps) < 0) + if (virDomainSaveStatus(xmlopt, cfg->stateDir, obj, driver->caps) < 0) goto error; /* Run an hook to allow admins to do some magic */ @@ -8253,6 +8257,7 @@ qemuProcessReconnect(void *opaque) virDomainObjEndAPI(&obj); virObjectUnref(cfg); virObjectUnref(caps); + virObjectUnref(xmlopt); virNWFilterUnlockFilterUpdates(); virIdentitySetCurrent(NULL); return; -- 2.18.0.windows.1

2 2

[libvirt] [PATCH v2] qemu: Add entry for balloon stats stat-htlb-pgalloc and stat-htlb-pgfail
by Han Han 20 May '19

20 May '19

Qemu added reporting of virtio balloon new statistics stat-htlb-pgalloc and stat-htlb-pgfail since qemu-3.0 commit b7b12644297. The value of stat-htlb-pgalloc represents the number of successful hugetlb page allocations while stat-htlb-pgfail represents the number of failed ones. Add this statistics reporting to libvirt. To enable this feature for vm, guest kenel >= 4.17 is required because the exporting hugetlb page allocation for virtio balloon is introduced since 6c64fe7f. Signed-off-by: Han Han <hhan(a)redhat.com> --- include/libvirt/libvirt-domain.h | 14 +++++++++++++- src/libvirt-domain.c | 5 ++++- src/qemu/qemu_driver.c | 2 ++ src/qemu/qemu_monitor_json.c | 5 +++++ tools/virsh-domain-monitor.c | 4 ++++ tools/virsh.pod | 2 ++ 6 files changed, 30 insertions(+), 2 deletions(-) diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-domain.h index 7d36820b5a..192d25c1db 100644 --- a/include/libvirt/libvirt-domain.h +++ b/include/libvirt/libvirt-domain.h @@ -636,11 +636,23 @@ typedef enum { */ VIR_DOMAIN_MEMORY_STAT_DISK_CACHES = 10, + /* + * The amount of successful hugetlb(Huge Page Tables) allocations via + * virtio balloon. + */ + VIR_DOMAIN_MEMORY_STAT_HUGETLB_PGALLOC = 11, + + /* + * The amount of failed hugetlb(Huge Page Tables) allocations via + * virtio balloon. + */ + VIR_DOMAIN_MEMORY_STAT_HUGETLB_PGFAIL = 12, + /* * The number of statistics supported by this version of the interface. * To add new statistics, add them to the enum and increase this value. */ - VIR_DOMAIN_MEMORY_STAT_NR = 11, + VIR_DOMAIN_MEMORY_STAT_NR = 13, # ifdef VIR_ENUM_SENTINELS VIR_DOMAIN_MEMORY_STAT_LAST = VIR_DOMAIN_MEMORY_STAT_NR diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c index 80284a99f0..a95690e8a4 100644 --- a/src/libvirt-domain.c +++ b/src/libvirt-domain.c @@ -5734,7 +5734,10 @@ virDomainGetInterfaceParameters(virDomainPtr domain, * VIR_DOMAIN_MEMORY_STAT_DISK_CACHES * Memory that can be reclaimed without additional I/O, typically disk * caches (in kb). - * + * VIR_DOMAIN_MEMORY_STAT_HUGETLB_PGALLOC + * The amount of successful hugetlb(Huge Page Tables) allocations + * VIR_DOMAIN_MEMORY_STAT_HUGETLB_PGFAIL + * The amount of failed hugetlb(Huge Page Tables) allocations * Returns: The number of stats provided or -1 in case of failure. */ int diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index f48d9256e4..2d849beac8 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -20245,6 +20245,8 @@ qemuDomainGetStatsBalloon(virQEMUDriverPtr driver, STORE_MEM_RECORD(LAST_UPDATE, "last-update") STORE_MEM_RECORD(USABLE, "usable") STORE_MEM_RECORD(DISK_CACHES, "disk_caches") + STORE_MEM_RECORD(HUGETLB_PGALLOC, "hugetlb_pgalloc") + STORE_MEM_RECORD(HUGETLB_PGFAIL, "hugetlb_pgfail") } #undef STORE_MEM_RECORD diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index 908967f46c..5e3df5e759 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -2150,6 +2150,11 @@ int qemuMonitorJSONGetMemoryStats(qemuMonitorPtr mon, VIR_DOMAIN_MEMORY_STAT_LAST_UPDATE, 1); GET_BALLOON_STATS(statsdata, "stat-disk-caches", VIR_DOMAIN_MEMORY_STAT_DISK_CACHES, 1024); + GET_BALLOON_STATS(statsdata, "stat-htlb-pgalloc", + VIR_DOMAIN_MEMORY_STAT_HUGETLB_PGALLOC, 1); + GET_BALLOON_STATS(statsdata, "stat-htlb-pgfail", + VIR_DOMAIN_MEMORY_STAT_HUGETLB_PGFAIL, 1); + ret = got; cleanup: virJSONValueFree(cmd); diff --git a/tools/virsh-domain-monitor.c b/tools/virsh-domain-monitor.c index d87475f6f6..0092a9786e 100644 --- a/tools/virsh-domain-monitor.c +++ b/tools/virsh-domain-monitor.c @@ -376,6 +376,10 @@ cmdDomMemStat(vshControl *ctl, const vshCmd *cmd) vshPrint(ctl, "last_update %llu\n", stats[i].val); if (stats[i].tag == VIR_DOMAIN_MEMORY_STAT_DISK_CACHES) vshPrint(ctl, "disk_caches %llu\n", stats[i].val); + if (stats[i].tag == VIR_DOMAIN_MEMORY_STAT_HUGETLB_PGALLOC) + vshPrint(ctl, "hugetlb_pgalloc %llu\n", stats[i].val); + if (stats[i].tag == VIR_DOMAIN_MEMORY_STAT_HUGETLB_PGFAIL) + vshPrint(ctl, "hugetlb_pgfail %llu\n", stats[i].val); } ret = true; diff --git a/tools/virsh.pod b/tools/virsh.pod index afc1684db0..ef27c527d6 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -938,6 +938,8 @@ without causing host swapping (in KiB) last-update - Timestamp of the last update of statistics (in seconds) disk_caches - The amount of memory that can be reclaimed without additional I/O, typically disk caches (in KiB) + hugetlb_pgalloc - The number of successful huge page table allocations + hugetlb_pgfail - The number of failed huge page table allocations For QEMU/KVM with a memory balloon, setting the optional I<--period> to a value larger than 0 in seconds will allow the balloon driver to return -- 2.20.1

2 3

[libvirt] [glib PATCH 0/8] Add machinery forsetting firmware attribute to <os/>
by Fabiano Fidêncio 20 May '19

20 May '19

This series consists in two different things that, together, are needed to set <os firmware="efi|bios"/> as part of libvirt domain's XML. The first patch simply changes the XML adding the bit mentioned above. All the other patches, on the other hand, add enough (and nothing more than that) infra for consumers to check which are the supported firmwares (the ones listed by virConnectGetDomainCapabilities()). Fabiano Fidêncio (8): gconfig: Add _domain_os_set_firmware() gobject: Use the proper return type in _connection_get_capabilities_finish() gconfig: Add GVirConfigDomainCapabilities gconfig: Add GVirConfigDomainCapabilitiesOs gconfig: Add _domain_capabilities_get_os() gconfig: Add _domain_capabilities_os_get_firmwares() tests: Add basic test for domain capabilities gobject: Wrap virConnectGetDomainCapabilities() libvirt-gconfig/Makefile.am | 4 + .../libvirt-gconfig-domain-capabilities-os.c | 115 ++++++++++++ .../libvirt-gconfig-domain-capabilities-os.h | 66 +++++++ .../libvirt-gconfig-domain-capabilities.c | 94 ++++++++++ .../libvirt-gconfig-domain-capabilities.h | 68 +++++++ libvirt-gconfig/libvirt-gconfig-domain-os.c | 17 ++ libvirt-gconfig/libvirt-gconfig-domain-os.h | 7 + libvirt-gconfig/libvirt-gconfig.h | 2 + libvirt-gconfig/libvirt-gconfig.sym | 8 + libvirt-gobject/libvirt-gobject-connection.c | 170 +++++++++++++++++- libvirt-gobject/libvirt-gobject-connection.h | 22 +++ libvirt-gobject/libvirt-gobject.sym | 8 + tests/test-gconfig.c | 34 ++++ tests/xml/gconfig-domain-capabilities-os.xml | 23 +++ tests/xml/gconfig-domain-os.xml | 2 +- 15 files changed, 638 insertions(+), 2 deletions(-) create mode 100644 libvirt-gconfig/libvirt-gconfig-domain-capabilities-os.c create mode 100644 libvirt-gconfig/libvirt-gconfig-domain-capabilities-os.h create mode 100644 libvirt-gconfig/libvirt-gconfig-domain-capabilities.c create mode 100644 libvirt-gconfig/libvirt-gconfig-domain-capabilities.h create mode 100644 tests/xml/gconfig-domain-capabilities-os.xml -- 2.21.0

2 12

[libvirt] [PATCH 0/7] x86: Multi-key Total Memory Encryption (Intel)
by Larkins Carvalho 17 May '19

17 May '19

This patch series provides support for launching an encrypted guest using Intel's Multi-key Total Memory Encryption (MKTME) feature. The purpose of this review is to get initial feedback and to get on par with libvirt development process. Considering we have not added tests, this is a preliminary patch and based on the community feedback, we expect more updates to follow. Total Memory Encryption (TME) provides the capability to encrypt the entirety of the physical memory of a system. MKTME builds on TME and adds support for multiple encryption keys. High Level flow: 1. Management tool calls virConnectGetDomainCapabilities which calls virNodeGetMKTMEInfo. This returns an XML document that includes the following: <feature> ... <mktme supported='yes'> <keys_supported> </keys_supported> </mktme> </feature> 2. If MKTME is supported management tool requests to start a guest calling virCreateXML(). The xml would include: <launchSecurity type='mktme'> <id>m0</id> <key_type>user</key_type> <key>samplekey</key> <encryption_algorithm>aes-xts-128</encryption_algorithm> </launchSecurity> 3. Libvirt makes system call with the provided information to generate a key handle using linux keyring services. Qemu uses the key handle to launch the workload. 4. Libvirt generate the QEMU cli arg to enable the MKTME feature, a typical args looks like this: # Qemu ...\ -machine pc,memory-encryption=m0 -object mktme-guest,id=m0,handle=${serial} Intel MKTME spec: https://software.intel.com/sites/default/files/managed/a5/16/Multi-Key-Tota… TODO: Add tests for launch security of type mktme. WIP: Qemu and KVM patch to support Intel MKTME are in the process of upstreaming. The complete git tree is available at: https://github.com/larkinscarvalho/libvirt/tree/intel-mktme-patch-series Larkins Carvalho (7): qemu: provide support to query the MKTME capability conf: Add MKTME feature in domain capabilities libvirt: add new public API to get MKTME Info remote: implement the remote protocol for virNodeMKTMEInfo() qemu: Add support to get the MKTME info conf: introduce launchSecurity element type mktme in domain qemu: add support to launch MKTME guest docs/formatdomain.html.in | 64 +- docs/formatdomaincaps.html.in | 20 + docs/schemas/domaincaps.rng | 14 + docs/schemas/domaincommon.rng | 87 +- include/libvirt/libvirt-host.h | 18 + src/conf/domain_capabilities.c | 30 + src/conf/domain_capabilities.h | 12 + src/conf/domain_conf.c | 112 +- src/conf/domain_conf.h | 14 + src/conf/virconftypes.h | 3 + src/driver-hypervisor.h | 7 + src/libvirt-host.c | 49 + src/libvirt_private.syms | 4 + src/libvirt_public.syms | 5 + src/qemu/qemu_capabilities.c | 140 +- src/qemu/qemu_capabilities.h | 4 + src/qemu/qemu_capspriv.h | 4 + src/qemu/qemu_command.c | 40 + src/qemu/qemu_driver.c | 63 + src/qemu/qemu_monitor.c | 10 + src/qemu/qemu_monitor.h | 3 + src/qemu/qemu_monitor_json.c | 61 + src/qemu/qemu_monitor_json.h | 3 + src/remote/remote_daemon_dispatch.c | 44 + src/remote/remote_driver.c | 41 +- src/remote/remote_protocol.x | 21 +- src/remote_protocol-structs | 12 + src/util/Makefile.inc.am | 2 + src/util/virmktme.c | 127 ++ src/util/virmktme.h | 34 + .../bhyve_basic.x86_64.xml | 1 + .../bhyve_fbuf.x86_64.xml | 1 + .../bhyve_uefi.x86_64.xml | 1 + tests/domaincapsschemadata/empty.xml | 1 + tests/domaincapsschemadata/libxl-xenfv.xml | 1 + tests/domaincapsschemadata/libxl-xenpv.xml | 1 + .../qemu_1.7.0.x86_64.xml | 1 + .../qemu_2.12.0-virt.aarch64.xml | 1 + .../qemu_2.12.0.ppc64.xml | 1 + .../qemu_2.12.0.s390x.xml | 1 + .../qemu_2.12.0.x86_64.xml | 1 + .../qemu_2.6.0-virt.aarch64.xml | 1 + .../qemu_2.6.0.aarch64.xml | 1 + .../domaincapsschemadata/qemu_2.6.0.ppc64.xml | 1 + .../qemu_2.6.0.x86_64.xml | 1 + .../domaincapsschemadata/qemu_2.7.0.s390x.xml | 1 + .../qemu_2.8.0-tcg.x86_64.xml | 1 + .../domaincapsschemadata/qemu_2.8.0.s390x.xml | 1 + .../qemu_2.8.0.x86_64.xml | 1 + .../qemu_2.9.0-q35.x86_64.xml | 1 + .../qemu_2.9.0-tcg.x86_64.xml | 1 + .../qemu_2.9.0.x86_64.xml | 1 + .../domaincapsschemadata/qemu_3.0.0.s390x.xml | 1 + .../qemu_3.1.0.x86_64.xml | 1 + .../domaincapsschemadata/qemu_4.0.0.s390x.xml | 1 + .../qemu_4.0.0.x86_64.xml | 1 + .../qemu_5.3.0.x86_64.xml | 164 ++ tests/domaincapstest.c | 5 + .../caps_5.3.0.x86_64.xml | 1377 +++++++++++++++++ 59 files changed, 2579 insertions(+), 41 deletions(-) create mode 100644 src/util/virmktme.c create mode 100644 src/util/virmktme.h create mode 100644 tests/domaincapsschemadata/qemu_5.3.0.x86_64.xml create mode 100644 tests/qemucapabilitiesdata/caps_5.3.0.x86_64.xml

1 7

[libvirt] [PATCH] rpm: remove dependancy from qemu to network/storage drivers
by Daniel P. Berrangé 17 May '19

17 May '19

The libvirt-daemon-driver-qemu RPM has historically had a hard dependency on the libvirt-daemon-driver-network and libvirt-daemon-driver-storage-core packages. This was because the QEMU driver would directly call into APIs that were part of these drivers. The dependency to the storage driver was eliminated in commit 064fec69be4a4673e0df17b007bf781026c3b4b2 Author: Daniel P. Berrangé <berrange(a)redhat.com> Date: Thu Jan 25 09:35:46 2018 +0000 storage: move storage file backend framework into util directory The dependency to the network driver was eliminated in commit 5b13570ab8b43ec3c590399ec5a7644d91082149 Author: Daniel P. Berrangé <berrange(a)redhat.com> Date: Thu Jan 25 09:35:47 2018 +0000 conf: introduce callback registration for domain net device allocation Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- Previously sent as patch of the the network refactor but it can in fact be merged now as it doesn't depend on it directly. libvirt.spec.in | 3 --- 1 file changed, 3 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 5c27a44fc5..b159c50d8f 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -720,9 +720,6 @@ parted and more. Summary: QEMU driver plugin for the libvirtd daemon Requires: libvirt-daemon = %{version}-%{release} Requires: libvirt-libs = %{version}-%{release} -# There really is a hard cross-driver dependency here -Requires: libvirt-daemon-driver-network = %{version}-%{release} -Requires: libvirt-daemon-driver-storage-core = %{version}-%{release} Requires: /usr/bin/qemu-img # For image compression Requires: gzip -- 2.21.0

2 1

[libvirt] [PATCH] lib: Avoid double free when passing FDs with virCommandPassFD()
by Michal Privoznik 17 May '19

17 May '19

If an FD is passed into a child using: virCommandPassFD(cmd, fd, VIR_COMMAND_PASS_FD_CLOSE_PARENT); then the parent should refrain from touching @fd thereafter. This is even documented in virCommandPassFD() comment. The reason is that either at virCommandRun()/virCommandRunAsync() or virCommandFree() time the @fd will be closed. Closing it earlier, e.g. right after virCommandPassFD() call might result in undesired results. Another thread might open a file and receive the same FD which is then unexpectedly closed by virCommandFree() or virCommandRun(). Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_command.c | 10 ++++++---- src/util/virpolkit.c | 1 + tests/commandtest.c | 2 +- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index bf1fb539b1..92bd1524db 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -8978,17 +8978,19 @@ qemuBuildInterfaceCommandLine(virQEMUDriverPtr driver, if (qemuSecuritySetTapFDLabel(driver->securityManager, def, tapfd[i]) < 0) goto cleanup; - virCommandPassFD(cmd, tapfd[i], - VIR_COMMAND_PASS_FD_CLOSE_PARENT); if (virAsprintf(&tapfdName[i], "%d", tapfd[i]) < 0) goto cleanup; + virCommandPassFD(cmd, tapfd[i], + VIR_COMMAND_PASS_FD_CLOSE_PARENT); + tapfd[i] = -1; } for (i = 0; i < vhostfdSize; i++) { - virCommandPassFD(cmd, vhostfd[i], - VIR_COMMAND_PASS_FD_CLOSE_PARENT); if (virAsprintf(&vhostfdName[i], "%d", vhostfd[i]) < 0) goto cleanup; + virCommandPassFD(cmd, vhostfd[i], + VIR_COMMAND_PASS_FD_CLOSE_PARENT); + vhostfd[i] = -1; } if (chardev) diff --git a/src/util/virpolkit.c b/src/util/virpolkit.c index 25eaad2c63..634b46e82b 100644 --- a/src/util/virpolkit.c +++ b/src/util/virpolkit.c @@ -187,6 +187,7 @@ virPolkitAgentCreate(void) virCommandSetOutputFD(agent->cmd, &outfd); virCommandSetErrorFD(agent->cmd, &errfd); virCommandPassFD(agent->cmd, pipe_fd[1], VIR_COMMAND_PASS_FD_CLOSE_PARENT); + pipe_fd[1] = -1; if (virCommandRunAsync(agent->cmd, NULL) < 0) goto error; diff --git a/tests/commandtest.c b/tests/commandtest.c index 816a70860f..146cc4c1bf 100644 --- a/tests/commandtest.c +++ b/tests/commandtest.c @@ -1024,6 +1024,7 @@ static int test24(const void *unused ATTRIBUTE_UNUSED) virCommandDaemonize(cmd); virCommandPassFD(cmd, newfd2, VIR_COMMAND_PASS_FD_CLOSE_PARENT); virCommandPassFD(cmd, newfd3, VIR_COMMAND_PASS_FD_CLOSE_PARENT); + newfd2 = newfd3 = -1; virCommandPassListenFDs(cmd); if (virCommandRun(cmd, NULL) < 0) { @@ -1053,7 +1054,6 @@ static int test24(const void *unused ATTRIBUTE_UNUSED) VIR_FREE(prefix); virCommandFree(cmd); VIR_FORCE_CLOSE(newfd1); - /* coverity[double_close] */ VIR_FORCE_CLOSE(newfd2); VIR_FORCE_CLOSE(newfd3); return ret; -- 2.21.0

2 1

[libvirt] [PATCH] examples: Fix installation on Windows
by Andrea Bolognani 17 May '19

17 May '19

We can't rely on $(noinst_PROGRAMS) retaining its original value, so let's use a separate $(EXAMPLES) variable instead. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- examples/Makefile.am | 35 ++++++++++++++++++++++++++++------- 1 file changed, 28 insertions(+), 7 deletions(-) diff --git a/examples/Makefile.am b/examples/Makefile.am index c7688c7c3d..11c9f44917 100644 --- a/examples/Makefile.am +++ b/examples/Makefile.am @@ -34,11 +34,32 @@ LDADD = $(STATIC_BINARIES) $(WARN_CFLAGS) \ $(top_builddir)/src/libvirt.la \ $(top_builddir)/src/libvirt-admin.la -noinst_PROGRAMS=dominfo/info1 dommigrate/dommigrate domsuspend/suspend \ - domtop/domtop hellolibvirt/hellolibvirt object-events/event-test \ - openauth/openauth rename/rename admin/list_servers admin/list_clients \ - admin/threadpool_params admin/client_limits admin/client_info \ - admin/client_close admin/logging +# List of example programs. We need to list them here instead of using +# $(noinst_PROGRAMS) directly because we want to have access to the +# unmodified list during (un)installation, but at the same time automake +# might tweak $(noinst_PROGRAMS) to eg. automatically add the .exe file +# extension when targeting Windows. +EXAMPLES = \ + admin/client_close \ + admin/client_info \ + admin/client_limits \ + admin/list_clients \ + admin/list_servers \ + admin/logging \ + admin/threadpool_params \ + dominfo/info1 \ + dommigrate/dommigrate \ + domsuspend/suspend \ + domtop/domtop \ + hellolibvirt/hellolibvirt \ + object-events/event-test \ + openauth/openauth \ + rename/rename \ + $(NULL) + +noinst_PROGRAMS = \ + $(EXAMPLES) \ + $(NULL) dominfo_info1_SOURCES = dominfo/info1.c dommigrate_dommigrate_SOURCES = dommigrate/dommigrate.c @@ -88,13 +109,13 @@ examplesdir = $(docdir)/examples install-data-local: $(INSTALL_DATA_LOCAL) $(mkinstalldirs) $(DESTDIR)$(examplesdir) - for p in $(noinst_PROGRAMS); do \ + for p in $(EXAMPLES); do \ d=$$(dirname $$p); \ $(mkinstalldirs) $(DESTDIR)$(examplesdir)/$$d; \ $(INSTALL_DATA) $(srcdir)/$${p}.c $(DESTDIR)$(examplesdir)/$$d/; \ done uninstall-local: $(UNINSTALL_LOCAL) - for p in $(noinst_PROGRAMS); do \ + for p in $(EXAMPLES); do \ rm -f $(DESTDIR)$(examplesdir)/$${p}.c; \ done -- 2.21.0

2 6

[libvirt] [PATCH 0/4] virutil: Rework how 'udevadm settle' is called
by Michal Privoznik 17 May '19

17 May '19

Apparently, some build systems have a very minimalistic approach to their default build root. Not even udevadm is there. This renders our virWaitForDevices() to be no-op. But with this rework we can still run udevadm settle just fine with no extra build dependency added. Michal Prívozník (4): virWaitForDevices: Drop untrue part of comment lib: Drop UDEVSETTLE m4: Provide default value fore UDEVADM m4: Drop needless string checks m4/virt-external-programs.m4 | 26 +++++++------------------- src/util/virutil.c | 20 ++++++-------------- 2 files changed, 13 insertions(+), 33 deletions(-) -- 2.21.0

2 8

[libvirt] [PATCH 0/6] qemu: Rework the way we probe machine type properties
by Andrea Bolognani 17 May '19

17 May '19

This is a prerequisite for vSMMUv3 support, which I'm currently working on, but I'm posting it separately because it still makes perfect sense as a standalone series and I think it's a nice cleanup in its own right. Unfortunately there's quite a bit of test suite churn associated with these changes, but hopefully that should be for the most part compensated by the *lack* of test suite churn when I introduce vSMMUv3 support. Andrea Bolognani (6): qemu: Introduce virQEMUCapsProbeQMPMachineProps() qemu: Add -machine suffix automatically qemu: Move call to virQEMUCapsProbeQMPMachineProps() qemu: Probe canonicalized machine type tests: Refresh capabilities for QEMU on ppc64 qemu: Only probe available machine types src/qemu/qemu_capabilities.c | 63 +++- .../caps_2.12.0.aarch64.replies | 48 +-- .../caps_2.12.0.ppc64.replies | 290 ++++++++-------- .../caps_2.12.0.s390x.replies | 52 +-- .../caps_2.12.0.x86_64.replies | 64 ++-- .../caps_3.0.0.ppc64.replies | 300 ++++++++-------- .../caps_3.0.0.riscv32.replies | 40 +-- .../caps_3.0.0.riscv64.replies | 40 +-- .../caps_3.0.0.s390x.replies | 52 +-- .../caps_3.0.0.x86_64.replies | 64 ++-- .../caps_3.1.0.ppc64.replies | 315 +++++++++-------- .../caps_3.1.0.x86_64.replies | 64 ++-- .../caps_4.0.0.aarch64.replies | 48 +-- .../caps_4.0.0.ppc64.replies | 328 ++++++++++-------- .../caps_4.0.0.riscv32.replies | 40 +-- .../caps_4.0.0.riscv64.replies | 40 +-- .../caps_4.0.0.s390x.replies | 52 +-- .../caps_4.0.0.x86_64.replies | 64 ++-- 18 files changed, 938 insertions(+), 1026 deletions(-) -- 2.21.0

2 12

[libvirt] [PATCH] qemu: blockjob: Fix saving of inactive XML after completed legacy blockjob
by Peter Krempa 17 May '19

17 May '19

Commit 0ba9afc6b28 introduced a logic bug where we will never save the inactive XML after a blockjob as the variable which was determining whether to do so is cleared right before. Thus even if we correctly modify the inactive state it will be rolled back when libvirtd is restarted. Reported-by: Thomas Stein <hello(a)himbee.re> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_blockjob.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_blockjob.c b/src/qemu/qemu_blockjob.c index fa7e4c8625..f105632a09 100644 --- a/src/qemu/qemu_blockjob.c +++ b/src/qemu/qemu_blockjob.c @@ -363,7 +363,7 @@ qemuBlockJobEventProcessLegacy(virQEMUDriverPtr driver, if (virDomainSaveStatus(driver->xmlopt, cfg->stateDir, vm, driver->caps) < 0) VIR_WARN("Unable to save status on vm %s after block job", vm->def->name); - if (job->newstate == VIR_DOMAIN_BLOCK_JOB_COMPLETED && vm->newDef) { + if (job->state == VIR_DOMAIN_BLOCK_JOB_COMPLETED && vm->newDef) { if (virDomainSaveConfig(cfg->configDir, driver->caps, vm->newDef) < 0) VIR_WARN("Unable to update persistent definition on vm %s " "after block job", vm->def->name); -- 2.21.0

3 2

[libvirt] [PATCH v2] src: don't statically link code that's already in libvirt.so
by Daniel P. Berrangé 17 May '19

17 May '19

Various binaries are statically linking to libvirt_util.la and other intermediate libraries we build. These intermediate libs all get built into the main libvirt.so shared library eventually, so we can dynamically link to that instead and reduce the on disk footprint. In libvirt-daemon RPM: virtlockd: 1.6 MB -> 153 KB virtlogd: 1.6 MB -> 157 KB libvirt_iohelper: 937 KB -> 23 KB In libvirt-daemon-driver-network RPM: libvirt_leaseshelper: 940 KB -> 26 KB In libvirt-daemon-driver-storage-core RPM: libvirt_parthelper: 926 KB -> 21 KB IOW, about 5.6 MB total space saving Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/Makefile.am | 2 +- src/libvirt_remote.syms | 1 + src/locking/Makefile.inc.am | 4 +--- src/logging/Makefile.inc.am | 4 +--- src/network/Makefile.inc.am | 2 +- src/security/Makefile.inc.am | 2 -- src/storage/Makefile.inc.am | 2 +- 7 files changed, 6 insertions(+), 11 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index 7d452a9490..0b562dc250 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -851,7 +851,7 @@ libvirt_iohelper_LDFLAGS = \ $(PIE_LDFLAGS) \ $(NULL) libvirt_iohelper_LDADD = \ - libvirt_util.la \ + libvirt.la \ ../gnulib/lib/libgnu.la if WITH_DTRACE_PROBES libvirt_iohelper_LDADD += libvirt_probes.lo diff --git a/src/libvirt_remote.syms b/src/libvirt_remote.syms index 98586d1584..3d68f6ce0a 100644 --- a/src/libvirt_remote.syms +++ b/src/libvirt_remote.syms @@ -176,6 +176,7 @@ virNetServerClientSetAuthLocked; virNetServerClientSetAuthPendingLocked; virNetServerClientSetCloseHook; virNetServerClientSetDispatcher; +virNetServerClientSetQuietEOF; virNetServerClientSetReadonly; virNetServerClientStartKeepAlive; virNetServerClientWantCloseLocked; diff --git a/src/locking/Makefile.inc.am b/src/locking/Makefile.inc.am index da26fab91f..46ab11c2a9 100644 --- a/src/locking/Makefile.inc.am +++ b/src/locking/Makefile.inc.am @@ -145,10 +145,8 @@ virtlockd_LDFLAGS = \ $(NO_UNDEFINED_LDFLAGS) \ $(NULL) virtlockd_LDADD = \ + libvirt.la \ libvirt_driver_admin.la \ - libvirt-net-rpc-server.la \ - libvirt-net-rpc.la \ - libvirt_util.la \ ../gnulib/lib/libgnu.la \ $(CYGWIN_EXTRA_LIBADD) \ $(NULL) diff --git a/src/logging/Makefile.inc.am b/src/logging/Makefile.inc.am index f5eba2a4f7..d57394cbde 100644 --- a/src/logging/Makefile.inc.am +++ b/src/logging/Makefile.inc.am @@ -80,9 +80,7 @@ virtlogd_LDFLAGS = \ $(NULL) virtlogd_LDADD = \ libvirt_driver_admin.la \ - libvirt-net-rpc-server.la \ - libvirt-net-rpc.la \ - libvirt_util.la \ + libvirt.la \ ../gnulib/lib/libgnu.la \ $(CYGWIN_EXTRA_LIBADD) \ $(NULL) diff --git a/src/network/Makefile.inc.am b/src/network/Makefile.inc.am index 3fed59c13b..52270049d5 100644 --- a/src/network/Makefile.inc.am +++ b/src/network/Makefile.inc.am @@ -56,7 +56,7 @@ libvirt_leaseshelper_LDFLAGS = \ $(PIE_LDFLAGS) \ $(NULL) libvirt_leaseshelper_LDADD = \ - libvirt_util.la \ + libvirt.la \ ../gnulib/lib/libgnu.la if WITH_DTRACE_PROBES libvirt_leaseshelper_LDADD += libvirt_probes.lo diff --git a/src/security/Makefile.inc.am b/src/security/Makefile.inc.am index 7fb6d8cc4f..64e0f46857 100644 --- a/src/security/Makefile.inc.am +++ b/src/security/Makefile.inc.am @@ -72,8 +72,6 @@ virt_aa_helper_LDFLAGS = \ $(NULL) virt_aa_helper_LDADD = \ libvirt.la \ - libvirt_conf.la \ - libvirt_util.la \ libvirt_driver_storage_impl.la \ ../gnulib/lib/libgnu.la \ $(NULL) diff --git a/src/storage/Makefile.inc.am b/src/storage/Makefile.inc.am index ea4681f70e..538709256d 100644 --- a/src/storage/Makefile.inc.am +++ b/src/storage/Makefile.inc.am @@ -378,7 +378,7 @@ libvirt_parthelper_LDFLAGS = \ $(NULL) libvirt_parthelper_LDADD = \ $(LIBPARTED_LIBS) \ - libvirt_util.la \ + libvirt.la \ ../gnulib/lib/libgnu.la \ $(NULL) if WITH_DTRACE_PROBES -- 2.21.0

2 1

[libvirt] surprising <backingStore type='file'> setting in domain.xml
by Thomas Stein 17 May '19

17 May '19

Hello all. My currently used versions: libvirt-5.2.0 and qemu-4.0.0. Here is my problem. I'm struggeling since a few weeks with a strange behaviour by either qemu or libvirt. After a reboot of the hardware node the $domain.xml contains suddenly a backingStore setting which was not there before reboot. Something like that: <devices> <emulator>/usr/bin/qemu-system-x86_64</emulator> <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/var/lib/libvirt/shinymail/shinymail_weekly.qcow2-2019-05-15'/> <backingStore type='file'> <format type='qcow2'/> <source file='/var/lib/libvirt/images/shinymail.qcow2'/> </backingStore> <target dev='vda' bus='virtio'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> </disk> ... This obviousely happens after a backup has been running. The Backup Script looks like this: <snip> virsh snapshot-create-as --domain shinymail weekly --diskspec vda,file=/var/lib/libvirt/shinymail/shinymail_weekly.qcow2-$(date +%Y-%m-%d) --disk-only --atomic --no-metadata cp ... virsh blockcommit shinymail vda --active --verbose --pivot <snip> So after that "dmblklist shinymail" does show the right source file but after a reboot it tries to use the weekly snapshot again which leads to filesystem errors. Someone has an idea what could cause such a behaviour? cheers t.

3 4

[libvirt] [PATCH 0/2] build: bump minimum udev version to 219
by Ján Tomko 16 May '19

16 May '19

Inspired-by: Pavel Hrdina <phardina(a)redhat.com> Ján Tomko (2): build: bump minimum udev version to 219 build: drop check for udev_monitor_set_receive_buffer_size m4/virt-udev.m4 | 14 ++------------ src/node_device/node_device_udev.c | 2 -- 2 files changed, 2 insertions(+), 14 deletions(-) -- 2.19.2

2 3

[libvirt] [PATCH] src: don't statically link code that's already in libvirt.so
by Daniel P. Berrangé 16 May '19

16 May '19

virtlockd and virtlogd statically link to libvirt-net-rpc-server.la libvirt-net-rpc.la and libvirt_util.la. libvirt-iohelper statically links to libvirt_util.la. All this code is all already built into the main libvirt.so, so we should dynamically link all these pieces. This reduces the size of the libvirt-daemon RPM from 5.4 MB down to 1.2 MB which is useful for container installs seeking minimal disk footprint. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/Makefile.am | 2 +- src/libvirt_remote.syms | 1 + src/locking/Makefile.inc.am | 4 +--- src/logging/Makefile.inc.am | 4 +--- 4 files changed, 4 insertions(+), 7 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index 7d452a9490..0b562dc250 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -851,7 +851,7 @@ libvirt_iohelper_LDFLAGS = \ $(PIE_LDFLAGS) \ $(NULL) libvirt_iohelper_LDADD = \ - libvirt_util.la \ + libvirt.la \ ../gnulib/lib/libgnu.la if WITH_DTRACE_PROBES libvirt_iohelper_LDADD += libvirt_probes.lo diff --git a/src/libvirt_remote.syms b/src/libvirt_remote.syms index 98586d1584..3d68f6ce0a 100644 --- a/src/libvirt_remote.syms +++ b/src/libvirt_remote.syms @@ -176,6 +176,7 @@ virNetServerClientSetAuthLocked; virNetServerClientSetAuthPendingLocked; virNetServerClientSetCloseHook; virNetServerClientSetDispatcher; +virNetServerClientSetQuietEOF; virNetServerClientSetReadonly; virNetServerClientStartKeepAlive; virNetServerClientWantCloseLocked; diff --git a/src/locking/Makefile.inc.am b/src/locking/Makefile.inc.am index da26fab91f..46ab11c2a9 100644 --- a/src/locking/Makefile.inc.am +++ b/src/locking/Makefile.inc.am @@ -145,10 +145,8 @@ virtlockd_LDFLAGS = \ $(NO_UNDEFINED_LDFLAGS) \ $(NULL) virtlockd_LDADD = \ + libvirt.la \ libvirt_driver_admin.la \ - libvirt-net-rpc-server.la \ - libvirt-net-rpc.la \ - libvirt_util.la \ ../gnulib/lib/libgnu.la \ $(CYGWIN_EXTRA_LIBADD) \ $(NULL) diff --git a/src/logging/Makefile.inc.am b/src/logging/Makefile.inc.am index f5eba2a4f7..d57394cbde 100644 --- a/src/logging/Makefile.inc.am +++ b/src/logging/Makefile.inc.am @@ -80,9 +80,7 @@ virtlogd_LDFLAGS = \ $(NULL) virtlogd_LDADD = \ libvirt_driver_admin.la \ - libvirt-net-rpc-server.la \ - libvirt-net-rpc.la \ - libvirt_util.la \ + libvirt.la \ ../gnulib/lib/libgnu.la \ $(CYGWIN_EXTRA_LIBADD) \ $(NULL) -- 2.21.0

2 2

[libvirt] [PATCH] virt-aa-helper: clean old reference to libvirt-sandbox
by Christian Ehrhardt 16 May '19

16 May '19

It came up that libvirt-sandbox is a failed (and removed) experiment. Let us clean up and remove it from the virt-aa-helper source as well. Signed-off-by: Christian Ehrhardt <christian.ehrhardt(a)canonical.com> --- src/security/virt-aa-helper.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index ad9a7dda94..fea4da80dc 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -511,8 +511,7 @@ valid_path(const char *path, const bool readonly) /* override the above with these */ const char * const override[] = { "/sys/devices/pci", /* for hostdev pci devices */ - "/sys/kernel/config/target/vhost", /* for hostdev vhost_scsi devices */ - "/etc/libvirt-sandbox/services/" /* for virt-sandbox service config */ + "/sys/kernel/config/target/vhost" /* for hostdev vhost_scsi devices */ }; const int nropaths = ARRAY_CARDINALITY(restricted); -- 2.21.0

2 2

[libvirt] [PATCH v2] test_driver: implement virDomainGetDiskErrors
by Ilias Stamatis 16 May '19

16 May '19

Return the number of disks present in the configuration of the test domain when called with @errors as NULL and @maxerrors as 0. Otherwise report an error for every second disk, assigning available error codes in a cyclic order. Signed-off-by: Ilias Stamatis <stamatis.iliass(a)gmail.com> --- src/test/test_driver.c | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/src/test/test_driver.c b/src/test/test_driver.c index a06d1fc402..527c2f5d3b 100644 --- a/src/test/test_driver.c +++ b/src/test/test_driver.c @@ -3046,6 +3046,47 @@ static int testDomainSetAutostart(virDomainPtr domain, return 0; } +static int testDomainGetDiskErrors(virDomainPtr dom, + virDomainDiskErrorPtr errors, + unsigned int maxerrors, + unsigned int flags) +{ + virDomainObjPtr vm = NULL; + int ret = -1; + size_t i; + int n = 0; + int codes[] = {VIR_DOMAIN_DISK_ERROR_UNSPEC, VIR_DOMAIN_DISK_ERROR_NO_SPACE}; + size_t ncodes = sizeof(codes) / sizeof(codes[0]); + + virCheckFlags(0, -1); + + if (!(vm = testDomObjFromDomain(dom))) + goto cleanup; + + if (virDomainObjCheckActive(vm) < 0) + goto cleanup; + + if (!errors) { + ret = vm->def->ndisks; + } else { + for (i = 1; i < vm->def->ndisks && n < maxerrors; i += 2) { + if (VIR_STRDUP(errors[n].disk, vm->def->disks[i]->dst) < 0) + goto cleanup; + errors[n].error = codes[n % ncodes]; + n++; + } + ret = n; + } + + cleanup: + virDomainObjEndAPI(&vm); + if (ret < 0) { + for (i = 0; i < n; i++) + VIR_FREE(errors[i].disk); + } + return ret; +} + static char *testDomainGetSchedulerType(virDomainPtr domain ATTRIBUTE_UNUSED, int *nparams) { @@ -6832,6 +6873,7 @@ static virHypervisorDriver testHypervisorDriver = { .domainUndefineFlags = testDomainUndefineFlags, /* 0.9.4 */ .domainGetAutostart = testDomainGetAutostart, /* 0.3.2 */ .domainSetAutostart = testDomainSetAutostart, /* 0.3.2 */ + .domainGetDiskErrors = testDomainGetDiskErrors, /* 5.4.0 */ .domainGetSchedulerType = testDomainGetSchedulerType, /* 0.3.2 */ .domainGetSchedulerParameters = testDomainGetSchedulerParameters, /* 0.3.2 */ .domainGetSchedulerParametersFlags = testDomainGetSchedulerParametersFlags, /* 0.9.2 */ -- 2.21.0

4 11

[libvirt] [PATCH] virt-aa-helper: allow sysfs path used for vhost-scsi
by Christian Ehrhardt 16 May '19

16 May '19

When a vhost scsi device is hotplugged virt-aa-helper is called to add the respective path. For example the config: <hostdev mode='subsystem' type='scsi_host' managed='no'> <source protocol='vhost' wwpn='naa.50014059de6fba4f'/> </hostdev> Will call it to add: /sys/kernel/config/target/vhost//naa.50014059de6fba4f But in general /sys paths are filtered in virt-aa-helper.c:valid_path To allow the path used for vhost-scsi we need to add it to the list of known and accepted overrides. Fixes: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1829223 Signed-off-by: Christian Ehrhardt <christian.ehrhardt(a)canonical.com> --- src/security/virt-aa-helper.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index d0fe86cefc..ad9a7dda94 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -510,8 +510,9 @@ valid_path(const char *path, const bool readonly) }; /* override the above with these */ const char * const override[] = { - "/sys/devices/pci", /* for hostdev pci devices */ - "/etc/libvirt-sandbox/services/" /* for virt-sandbox service config */ + "/sys/devices/pci", /* for hostdev pci devices */ + "/sys/kernel/config/target/vhost", /* for hostdev vhost_scsi devices */ + "/etc/libvirt-sandbox/services/" /* for virt-sandbox service config */ }; const int nropaths = ARRAY_CARDINALITY(restricted); -- 2.21.0

2 2

[libvirt] [PATCH] qemu: Do not override config XML in case of snapshot revert
by Maxiwell S. Garcia 15 May '19

15 May '19

Snapshot create operation saves the live XML and uses it to replace the domain definition in case of revert. But the VM config XML is not saved and the revert operation does not address this issue. This commit prevents the config XML from being overridden by snapshot definition. An active domain stores both current and new definitions. The current definition (vm->def) stores the live XML and the new definition (vm->newDef) stores the config XML. In an inactive domain, only the config XML is persistent, and it's saved in vm->def. The revert operation uses the virDomainObjAssignDef() to set the snapshot definition in vm->newDef, if domain is active, or in vm->def otherwise. But before that, it saves the old value to return to caller. This return is used here to restore the config XML after all snapshot startup process finish. Signed-off-by: Maxiwell S. Garcia <maxiwell(a)linux.ibm.com> --- src/qemu/qemu_driver.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index b2ac737d1f..a73122454a 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -16251,6 +16251,7 @@ qemuDomainRevertToSnapshot(virDomainSnapshotPtr snapshot, qemuDomainObjPrivatePtr priv; int rc; virDomainDefPtr config = NULL; + virDomainDefPtr inactiveConfig = NULL; virQEMUDriverConfigPtr cfg = NULL; virCapsPtr caps = NULL; bool was_stopped = false; @@ -16465,7 +16466,7 @@ qemuDomainRevertToSnapshot(virDomainSnapshotPtr snapshot, goto endjob; } if (config) { - virDomainObjAssignDef(vm, config, false, NULL); + virDomainObjAssignDef(vm, config, false, &inactiveConfig); virCPUDefFree(priv->origCPU); VIR_STEAL_PTR(priv->origCPU, origCPU); } @@ -16474,7 +16475,7 @@ qemuDomainRevertToSnapshot(virDomainSnapshotPtr snapshot, load: was_stopped = true; if (config) - virDomainObjAssignDef(vm, config, false, NULL); + virDomainObjAssignDef(vm, config, false, &inactiveConfig); /* No cookie means libvirt which saved the domain was too old to * mess up the CPU definitions. @@ -16533,6 +16534,9 @@ qemuDomainRevertToSnapshot(virDomainSnapshotPtr snapshot, detail); } } + if (inactiveConfig) + VIR_STEAL_PTR(vm->newDef, inactiveConfig); + break; case VIR_DOMAIN_SNAPSHOT_SHUTDOWN: @@ -16560,8 +16564,11 @@ qemuDomainRevertToSnapshot(virDomainSnapshotPtr snapshot, qemuProcessEndJob(driver, vm); goto cleanup; } - if (config) - virDomainObjAssignDef(vm, config, false, NULL); + if (config) { + virDomainObjAssignDef(vm, config, false, &inactiveConfig); + if (inactiveConfig) + VIR_STEAL_PTR(vm->newDef, inactiveConfig); + } if (flags & (VIR_DOMAIN_SNAPSHOT_REVERT_RUNNING | VIR_DOMAIN_SNAPSHOT_REVERT_PAUSED)) { -- 2.20.1

4 9

[libvirt] [PATCH 0/2] introduction of version attribute for VFIO live migration
by Yan Zhao 15 May '19

15 May '19

This patchset introduces a version attribute under sysfs of VFIO Mediated devices. This version attribute is used by user space software like libvirt to determine whether two mdev devices are compatible for live migration before starting live migration. Patch 1 defines version attribute as mandatory for VFIO live migration. It means if version attribute is missing or it returns errno, the corresponding mdev device is regarded as not supporting live migration. samples for vfio-mdev are modified to demonstrate it. Patch 2 uses GVT as an example to show how to expose version attribute and check device compatibility in vendor driver. Yan Zhao (2): vfio/mdev: add version field as mandatory attribute for mdev device drm/i915/gvt: export mdev device version to sysfs for Intel vGPU Documentation/vfio-mediated-device.txt | 36 +++++++++ drivers/gpu/drm/i915/gvt/Makefile | 2 +- drivers/gpu/drm/i915/gvt/device_version.c | 94 +++++++++++++++++++++++ drivers/gpu/drm/i915/gvt/gvt.c | 55 +++++++++++++ drivers/gpu/drm/i915/gvt/gvt.h | 6 ++ samples/vfio-mdev/mbochs.c | 17 ++++ samples/vfio-mdev/mdpy.c | 16 ++++ samples/vfio-mdev/mtty.c | 16 ++++ 8 files changed, 241 insertions(+), 1 deletion(-) create mode 100644 drivers/gpu/drm/i915/gvt/device_version.c -- 2.17.1

8 33

[libvirt] [PATCH 0/2] Avoid issues due to qemu dropping osxsave and ospke
by Christian Ehrhardt 15 May '19

15 May '19

Hi, this series tries to address a drop of commandline options by qemu in regard to osxsave [1] and ospke [2]. This was already discussed in [3] late last year but got forgotten afterwards. The Ubuntu bug is at [4] and an older Fedora bug is at [5]. TL;DR: - osxsave/ospke features were never really configurable - KVM never returned the bits on GET_SUPPORTED_CPUID - very rare to be seen in the wild - avoid issues with newer qemu and old/odd XMLs to be sure Details: I checked various use cases from virt-install to openstack and some in between. The only cases I found that would define osxsave/ospke is virt-install pior to version 2.0 and even there only when used with --cpu=host-model or --cpu=host-copy. If you ever really enabled the feature you'd have got: error: the CPU is incompatible with host CPU: Host CPU does not provide required features: ospke The problem lies in domain XMLs that explicitly disable it. That would be <feature policy='disable' name='osxsave'/> But due to almost (or actually none) no host exposing this the following also triggers: <feature policy='optional' name='ospke'/> This will make libvirt add it to the qemu commandline like: -cpu ...,osxsave=off,ospke=off And that will crash when qemu starts with: error: internal error: process exited while connecting to monitor: 2019-04-25T12:12:01.698646Z qemu-system-x86_64: can't apply global core2duo-x86_64-cpu.osxsave=off: Property '.osxsave' not found There are much more long term discussions about demoting and dropping qemu features and I'd like to avoid those discussions being mixed. The reason to drop it more or less without notice was that it never did anything to begin with. Due to that our solution might in a similar fashion be more trivial - just stop defining those two features to qemu commandline. [1]: https://git.qemu.org/?p=qemu.git;a=commit;h=f1a23522b03a569f13aad49294bb4c4… [2]: https://git.qemu.org/?p=qemu.git;a=commit;h=9ccb9784b57804f5c74434ad6ccb666… [3]: https://www.mail-archive.com/qemu-devel@nongnu.org/msg561877.html [4]: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1825195 [5]: https://bugzilla.redhat.com/show_bug.cgi?id=1644848 Christian Ehrhardt (2): qemu: do not define known no-op features qemuxml2argvtest: add test for remove cpu features src/qemu/qemu_command.c | 23 +++++++++++++++ .../qemuxml2argvdata/cpu-host-model-cmt.args | 2 +- .../cpu-no-removed-features.args | 29 +++++++++++++++++++ .../cpu-no-removed-features.xml | 23 +++++++++++++++ tests/qemuxml2argvdata/cpu-tsc-frequency.args | 4 +-- tests/qemuxml2argvtest.c | 1 + 6 files changed, 79 insertions(+), 3 deletions(-) create mode 100644 tests/qemuxml2argvdata/cpu-no-removed-features.args create mode 100644 tests/qemuxml2argvdata/cpu-no-removed-features.xml -- 2.17.1

2 11

[libvirt] [PATCH 0/2] Mitigation for Microarchitectural Data Sampling CPU flaws
by Jiri Denemark 14 May '19

14 May '19

This series introduces the libvirt side of mitigations for Microarchitectural Data Sampling microprocessor flaws (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091) which were published earlier today. To protect your system against possible attacks exploiting these flaws updates to the CPU microcode, Linux kernel, and virtualization stack (QEMU, libvirt, and higher management apps) are required. See https://access.redhat.com/security/vulnerabilities/mds for more details and additional links. Both patches have already been pushed. Jiri Denemark (2): cputest: Add data for Intel(R) Xeon(R) CPU E3-1225 v5 cpu_map: Define md-clear CPUID bit src/cpu_map/x86_features.xml | 3 + tests/cputest.c | 1 + .../x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml | 7 + .../x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml | 8 + .../x86_64-cpuid-Xeon-E3-1225-v5-guest.xml | 29 + .../x86_64-cpuid-Xeon-E3-1225-v5-host.xml | 30 + .../x86_64-cpuid-Xeon-E3-1225-v5-json.xml | 12 + .../x86_64-cpuid-Xeon-E3-1225-v5.json | 652 ++++++++++++++++++ .../x86_64-cpuid-Xeon-E3-1225-v5.sig | 4 + .../x86_64-cpuid-Xeon-E3-1225-v5.xml | 47 ++ .../x86_64-cpuid-Xeon-Platinum-8268-guest.xml | 1 + .../x86_64-cpuid-Xeon-Platinum-8268-host.xml | 1 + 12 files changed, 795 insertions(+) create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml -- 2.21.0

2 3

[libvirt] [PATCH] qemuDomainSnapshotCreateXML: Don't leak parsed snapshot definition
by Michal Privoznik 14 May '19

14 May '19

This function gets snapshot XML (provided by used) as an argument. It parses it into a local variable @def and then sets some more members (e.g. it creates a copy of live domain XML). Then it proceeds to checking if snapshot XML is valid (e.g. it contains as many disks as currently in the domain). If this fails then the control jumps to endjob label and subsequently return from the function. This is where AUTOFREE function for @def is ran. Well, because the code says to run plain VIR_FREE() we leak some memory because @def is actually an object and therefore it should have been declared as AUTOUNREF. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index f01282a037..0a425b82e5 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -15563,7 +15563,7 @@ qemuDomainSnapshotCreateXML(virDomainPtr domain, virCapsPtr caps = NULL; qemuDomainObjPrivatePtr priv; virDomainSnapshotState state; - VIR_AUTOFREE(virDomainSnapshotDefPtr) def = NULL; + VIR_AUTOUNREF(virDomainSnapshotDefPtr) def = NULL; virCheckFlags(VIR_DOMAIN_SNAPSHOT_CREATE_REDEFINE | VIR_DOMAIN_SNAPSHOT_CREATE_CURRENT | -- 2.21.0

3 2

[libvirt] [PATCH 0/4] Couple of allocation fixes
by Michal Privoznik 14 May '19

14 May '19

These stem from me playing with OOM testing. I've discovered more bugs, but they're mostly in tests themselves, e.g. use without check. Michal Prívozník (4): virstorageobj: Don't clear vols if they weren't initialized virNetServerPreExecRestart: Check for retval of virJSONValueNewArray() virCommand: Make virCommandPassFDGetFDIndex fail if passed command is in error state storagepoolxml2argvtest: Avoid double free src/conf/virstorageobj.c | 6 ++++-- src/rpc/virnetserver.c | 8 ++++++-- src/util/vircommand.c | 3 +++ tests/storagepoolxml2argvtest.c | 1 - 4 files changed, 13 insertions(+), 5 deletions(-) -- 2.21.0

3 9

[libvirt] [PATCH 0/2] node device cleanup
by Pavel Hrdina 13 May '19

13 May '19

Pavel Hrdina (2): node_device_udev: remove deprecated logging function src: remove HAL node device driver configure.ac | 3 +- docs/drvnodedev.html.in | 3 +- docs/hvsupport.pl | 2 +- libvirt.spec.in | 1 - m4/virt-hal.m4 | 10 +- m4/virt-udev.m4 | 5 - po/POTFILES | 1 - src/node_device/Makefile.inc.am | 12 - src/node_device/node_device_driver.c | 10 +- src/node_device/node_device_driver.h | 5 - src/node_device/node_device_hal.c | 804 --------------------------- src/node_device/node_device_hal.h | 22 - src/node_device/node_device_udev.c | 41 -- 13 files changed, 9 insertions(+), 910 deletions(-) delete mode 100644 src/node_device/node_device_hal.c delete mode 100644 src/node_device/node_device_hal.h -- 2.21.0

3 4

[libvirt] [PATCH] virsh: Don't leak disk targets in cmdDomBlkError
by Michal Privoznik 13 May '19

13 May '19

The virDomainGetDiskErrors() API copies disk targets into @disks array that we allocate. But we forgot to free it: ==140828== 16 bytes in 4 blocks are definitely lost in loss record 41 of 242 ==140828== at 0x4C2F08F: malloc (vg_replace_malloc.c:299) ==140828== by 0x8C406D9: strdup (in /lib64/libc-2.28.so) ==140828== by 0x5377DD3: virStrdup (virstring.c:966) ==140828== by 0x54C112F: testDomainGetDiskErrors (test_driver.c:3068) ==140828== by 0x55C863D: virDomainGetDiskErrors (libvirt-domain.c:10988) ==140828== by 0x15D1FA: cmdDomBlkError (virsh-domain-monitor.c:1215) ==140828== by 0x17F1A8: vshCommandRun (vsh.c:1335) ==140828== by 0x13489E: main (virsh.c:920) Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Pushed under trivial rule. tools/virsh-domain-monitor.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tools/virsh-domain-monitor.c b/tools/virsh-domain-monitor.c index d87475f6f6..d2b7e5a059 100644 --- a/tools/virsh-domain-monitor.c +++ b/tools/virsh-domain-monitor.c @@ -1229,6 +1229,8 @@ cmdDomBlkError(vshControl *ctl, const vshCmd *cmd) ret = true; cleanup: + for (i = 0; i < count; i++) + VIR_FREE(disks[i].disk); VIR_FREE(disks); virshDomainFree(dom); return ret; -- 2.21.0

1 0

[libvirt] [PATCH 0/4] docs: Ship and install a few more files
by Andrea Bolognani 13 May '19

13 May '19

Our handling of documentation is far from perfect, and a few issues in particular are causing me quite a bit of grief on the Debian packaging side of things. This series takes care of the more pressing matters; I have further cleanups planned for later. Andrea Bolognani (4): docs: Introduce $(modules) docs: Introduce $(devhelphtml_generated) docs: Install documentation under $(docdir) examples: Install under $(docdir) configure.ac | 13 ------------- docs/Makefile.am | 38 ++++++++++++++++++++++++-------------- examples/Makefile.am | 11 +++++++++++ libvirt.spec.in | 14 +------------- 4 files changed, 36 insertions(+), 40 deletions(-) -- 2.20.1

3 7

[libvirt] [PATCH] util: fix a bug found in sorting cache monitor results
by Wang Huaqiang 13 May '19

13 May '19

From: Huaqiang <huaqiang.wang(a)intel.com> The qsort element is a pointer of virResctrlMonitorStats, and the comparing function's arguments have a type of pointer of virResctrlMonitorStatsPtr. Signed-off-by: Huaqiang <huaqiang.wang(a)intel.com> --- src/util/virresctrl.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/util/virresctrl.c b/src/util/virresctrl.c index b845f36..a190977 100644 --- a/src/util/virresctrl.c +++ b/src/util/virresctrl.c @@ -2659,8 +2659,8 @@ static int virResctrlMonitorStatsSorter(const void *a, const void *b) { - return ((virResctrlMonitorStatsPtr)a)->id - - ((virResctrlMonitorStatsPtr)b)->id; + return (*(virResctrlMonitorStatsPtr *)a)->id + - (*(virResctrlMonitorStatsPtr *)b)->id; } @@ -2758,7 +2758,7 @@ virResctrlMonitorGetStats(virResctrlMonitorPtr monitor, /* Sort in id's ascending order */ if (*nstats) - qsort(*stats, *nstats, sizeof(*stat), virResctrlMonitorStatsSorter); + qsort(*stats, *nstats, sizeof(stat), virResctrlMonitorStatsSorter); ret = 0; cleanup: -- 2.7.4

3 2

[libvirt] [PATCH RFC] network: Delay creating private chains until starting network
by Jim Fehlig 13 May '19

13 May '19

Automated performance tests found that network-centric workloads suffered a 20 percent decrease when the host libvirt was updated from 5.0.0 to 5.1.0. On the test hosts libvirtd is enabled to start at boot and the "default" network is defined, but it is not set to autostart. libvirt 5.1.0 introduced private firewall chains with commit 5f1e6a7d. The chains are created at libvirtd start, which triggers loading the conntrack kernel module. Subsequent tracking and processing of connections resulted in the performance hit. Prior to commit 5f1e6a7d the conntrack module would not be loaded until starting a network, when libvirt added rules to the builtin chains. Restore the behavior of previous libvirt versions by delaying the creation of private chains until the first network is started. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- I briefly discussed this issue with Daniel on IRC and just now finding time to bring it to the list for broader discussion. The adjustment to the test file feels hacky. The whole approach might by hacky, hence the RFC. src/network/bridge_driver_linux.c | 64 +++------- .../nat-default-linux.args | 116 ++++++++++++++++++ 2 files changed, 131 insertions(+), 49 deletions(-) diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_linux.c index f2827543ca..a3a09caeba 100644 --- a/src/network/bridge_driver_linux.c +++ b/src/network/bridge_driver_linux.c @@ -35,44 +35,10 @@ VIR_LOG_INIT("network.bridge_driver_linux"); #define PROC_NET_ROUTE "/proc/net/route" -static virErrorPtr errInitV4; -static virErrorPtr errInitV6; +static bool pvtChainsCreated; void networkPreReloadFirewallRules(bool startup) { - bool created = false; - int rc; - - /* We create global rules upfront as we don't want - * the perf hit of conditionally figuring out whether - * to create them each time a network is started. - * - * Any errors here are saved to be reported at time - * of starting the network though as that makes them - * more likely to be seen by a human - */ - rc = iptablesSetupPrivateChains(VIR_FIREWALL_LAYER_IPV4); - if (rc < 0) { - errInitV4 = virSaveLastError(); - virResetLastError(); - } else { - virFreeError(errInitV4); - errInitV4 = NULL; - } - if (rc) - created = true; - - rc = iptablesSetupPrivateChains(VIR_FIREWALL_LAYER_IPV6); - if (rc < 0) { - errInitV6 = virSaveLastError(); - virResetLastError(); - } else { - virFreeError(errInitV6); - errInitV6 = NULL; - } - if (rc) - created = true; - /* * If this is initial startup, and we just created the * top level private chains we either @@ -86,8 +52,8 @@ void networkPreReloadFirewallRules(bool startup) * rules will be present. Thus we can safely just tell it * to always delete from the builin chain */ - if (startup && created) - iptablesSetDeletePrivate(false); + if (startup) + iptablesSetDeletePrivate(true); } @@ -701,19 +667,19 @@ int networkAddFirewallRules(virNetworkDefPtr def) virFirewallPtr fw = NULL; int ret = -1; - if (errInitV4 && - (virNetworkDefGetIPByIndex(def, AF_INET, 0) || - virNetworkDefGetRouteByIndex(def, AF_INET, 0))) { - virSetError(errInitV4); - return -1; - } + if (!pvtChainsCreated) { + if (iptablesSetupPrivateChains(VIR_FIREWALL_LAYER_IPV4) < 0 && + (virNetworkDefGetIPByIndex(def, AF_INET, 0) || + virNetworkDefGetRouteByIndex(def, AF_INET, 0))) + return -1; - if (errInitV6 && - (virNetworkDefGetIPByIndex(def, AF_INET6, 0) || - virNetworkDefGetRouteByIndex(def, AF_INET6, 0) || - def->ipv6nogw)) { - virSetError(errInitV6); - return -1; + if (iptablesSetupPrivateChains(VIR_FIREWALL_LAYER_IPV6) < 0 && + (virNetworkDefGetIPByIndex(def, AF_INET6, 0) || + virNetworkDefGetRouteByIndex(def, AF_INET6, 0) || + def->ipv6nogw)) + return -1; + + pvtChainsCreated = true; } if (def->bridgeZone) { diff --git a/tests/networkxml2firewalldata/nat-default-linux.args b/tests/networkxml2firewalldata/nat-default-linux.args index c9d523d043..61d620b592 100644 --- a/tests/networkxml2firewalldata/nat-default-linux.args +++ b/tests/networkxml2firewalldata/nat-default-linux.args @@ -1,5 +1,121 @@ iptables \ --table filter \ +--list-rules +iptables \ +--table nat \ +--list-rules +iptables \ +--table mangle \ +--list-rules +iptables \ +--table filter \ +--new-chain LIBVIRT_INP +iptables \ +--table filter \ +--insert INPUT \ +--jump LIBVIRT_INP +iptables \ +--table filter \ +--new-chain LIBVIRT_OUT +iptables \ +--table filter \ +--insert OUTPUT \ +--jump LIBVIRT_OUT +iptables \ +--table filter \ +--new-chain LIBVIRT_FWO +iptables \ +--table filter \ +--insert FORWARD \ +--jump LIBVIRT_FWO +iptables \ +--table filter \ +--new-chain LIBVIRT_FWI +iptables \ +--table filter \ +--insert FORWARD \ +--jump LIBVIRT_FWI +iptables \ +--table filter \ +--new-chain LIBVIRT_FWX +iptables \ +--table filter \ +--insert FORWARD \ +--jump LIBVIRT_FWX +iptables \ +--table nat \ +--new-chain LIBVIRT_PRT +iptables \ +--table nat \ +--insert POSTROUTING \ +--jump LIBVIRT_PRT +iptables \ +--table mangle \ +--new-chain LIBVIRT_PRT +iptables \ +--table mangle \ +--insert POSTROUTING \ +--jump LIBVIRT_PRT +ip6tables \ +--table filter \ +--list-rules +ip6tables \ +--table nat \ +--list-rules +ip6tables \ +--table mangle \ +--list-rules +ip6tables \ +--table filter \ +--new-chain LIBVIRT_INP +ip6tables \ +--table filter \ +--insert INPUT \ +--jump LIBVIRT_INP +ip6tables \ +--table filter \ +--new-chain LIBVIRT_OUT +ip6tables \ +--table filter \ +--insert OUTPUT \ +--jump LIBVIRT_OUT +ip6tables \ +--table filter \ +--new-chain LIBVIRT_FWO +ip6tables \ +--table filter \ +--insert FORWARD \ +--jump LIBVIRT_FWO +ip6tables \ +--table filter \ +--new-chain LIBVIRT_FWI +ip6tables \ +--table filter \ +--insert FORWARD \ +--jump LIBVIRT_FWI +ip6tables \ +--table filter \ +--new-chain LIBVIRT_FWX +ip6tables \ +--table filter \ +--insert FORWARD \ +--jump LIBVIRT_FWX +ip6tables \ +--table nat \ +--new-chain LIBVIRT_PRT +ip6tables \ +--table nat \ +--insert POSTROUTING \ +--jump LIBVIRT_PRT +ip6tables \ +--table mangle \ +--new-chain LIBVIRT_PRT +ip6tables \ +--table mangle \ +--insert POSTROUTING \ +--jump LIBVIRT_PRT +iptables \ +--table filter \ --insert LIBVIRT_INP \ --in-interface virbr0 \ --protocol tcp \ -- 2.21.0

3 4

[libvirt] [PATCH] qemu: Fix regression with undefine --snapshots-metadata
by Eric Blake 10 May '19

10 May '19

In refactoring the snapshot code to prepare for checkpoints, I changed qemuDomainMomentDiscardAll to take a callback that would handle the cleanup of either a snapshot or a checkpoint, but failed to set the callback on one of the two snapshot callers. As a result, 'virsh undefine $dom --snapshots-metadata' crashed on a NULL function dereference. Fixes: a487890d371b8cc3662c1717dfe07eea3f1ef1c0 Signed-off-by: Eric Blake <eblake(a)redhat.com> --- src/qemu/qemu_domain.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 2af17816c6..3290c5d490 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -8664,7 +8664,8 @@ qemuDomainSnapshotDiscardAllMetadata(virQEMUDriverPtr driver, virQEMUMomentRemove rem = { .driver = driver, .vm = vm, - .metadata_only = true + .metadata_only = true, + .momentDiscard = qemuDomainSnapshotDiscard, }; virDomainSnapshotForEach(vm->snapshots, qemuDomainMomentDiscardAll, &rem); -- 2.20.1

2 1

[libvirt] Running libvirtd out of source directory connection reset error
by Peter P. 10 May '19

10 May '19

Hi all, I'm getting started with hacking around with libvirt and am trying to familiarize myself with launching and running an instance of libvirtd I built from source on Centos 7.6. Following the instructions from https://libvirt.org/compiling.html to launch my built versions of libvirtd and virsh, I get the following error with no other context when trying to start a domain using "virsh start mydomain": error: Cannot recv data: Connection reset by peer Despite this error, I am able to run commands list virsh list. Are there additional parameters needed to launch libvirtd or additional services I need to start up alongside it? Thanks, Peter

2 2

[libvirt] [PATCH RFC] iohelper: Introduces a small sleep do avoid hunging other tasks
by Leonardo Bras 10 May '19

10 May '19

While dumping very large VMs (over 128GB), iohelper seems to cause very intense IO usage on the disk, and it causes some processes (like journald) to hung, and depending on kernel configuration, to panic. This change creates a time window, after every 10GB written, so this processes can write to the disk, and avoid hunging. Signed-off-by: Leonardo Bras <leonardo(a)linux.ibm.com> --- src/util/iohelper.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/util/iohelper.c b/src/util/iohelper.c index ddc338b7c7..164c1e2085 100644 --- a/src/util/iohelper.c +++ b/src/util/iohelper.c @@ -52,6 +52,8 @@ runIO(const char *path, int fd, int oflags) unsigned long long total = 0; bool direct = O_DIRECT && ((oflags & O_DIRECT) != 0); off_t end = 0; + const unsigned long long sleep_step = (long long)10*1024*1024*1024; + unsigned long long next_sleep = sleep_step; #if HAVE_POSIX_MEMALIGN if (posix_memalign(&base, alignMask + 1, buflen)) { @@ -128,6 +130,12 @@ runIO(const char *path, int fd, int oflags) total += got; + /* sleeps for a while to avoid hunging other tasks */ + if (total > next_sleep) { + next_sleep += sleep_step; + usleep(100*1000); + } + /* handle last write size align in direct case */ if (got < buflen && direct && fdout == fd) { ssize_t aligned_got = (got + alignMask) & ~alignMask; -- 2.20.1

3 3

[libvirt] [PATCH v2] Add support for podman in Makefile.ci
by Martin Kletzander 10 May '19

10 May '19

This way more users can run our CI builds locally. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- Makefile.ci | 91 ++++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 70 insertions(+), 21 deletions(-) diff --git a/Makefile.ci b/Makefile.ci index 12a62167cc67..241c58d2d4e9 100644 --- a/Makefile.ci +++ b/Makefile.ci @@ -17,7 +17,7 @@ CI_GIT_ROOT = $(shell git rev-parse --show-toplevel) CI_HOST_SRCDIR = $(CI_SCRATCHDIR)/src # The directory holding the source inside the -# container. ie where we told Docker to expose +# container, i.e. where we want to expose # the $(CI_HOST_SRCDIR) directory from the host CI_CONT_SRCDIR = /src @@ -46,14 +46,13 @@ CI_CONFIGURE_ARGS = # cloning them CI_SUBMODULES = $(shell git submodule | awk '{ print $$2 }') -# Location of the Docker images we're going to pull +# Location of the container images we're going to pull # Can be useful to overridde to use a locally built # image instead CI_IMAGE_PREFIX = quay.io/libvirt/buildenv- -# Docker defaults to pulling the ':latest' tag but -# if the Docker repo above uses different conventions -# this can override it +# The default tag is ':latest' but if the container +# repo above uses different conventions this can override it CI_IMAGE_TAG = :master # We delete the virtual root after completion, set @@ -71,15 +70,23 @@ CI_REUSE = 0 CI_UID = $(shell id -u) CI_GID = $(shell id -g) -# Docker doesn't require the IDs you run as to exist in +CI_ENGINE = auto +# Container engine we are going to use, can be overridden per make +# invocation, if it is not we try podman and then default to docker. +ifeq ($(CI_ENGINE),auto) + override CI_ENGINE = $(shell podman version >/dev/null 2>&1 && echo podman || echo docker) +endif + +# IDs you run as do not need to exist in # the container's /etc/passwd & /etc/group files, but -# if they do not, then libvirt's 'make check' will fail +# if they do not, then libvirt's 'make check' will fail # many tests. -# + # We do not directly mount /etc/{passwd,group} as Docker # is liable to mess with SELinux labelling which will -# then prevent the host accessing them. Copying them -# first is safer. +# then prevent the host accessing them. And podman cannot +# relabel the files due to it running rootless. So +# copying them first is safer and error-prone. CI_PWDB_MOUNTS = \ --volume $(CI_SCRATCHDIR)/group:/etc/group:ro,z \ --volume $(CI_SCRATCHDIR)/passwd:/etc/passwd:ro,z \ @@ -90,6 +97,46 @@ CI_PWDB_MOUNTS = \ # libvirt very slow at exec'ing programs. CI_ULIMIT_FILES = 1024 +ifeq ($(CI_ENGINE),podman) + # Podman cannot reuse host namespace when running non-root containers. Until + # support for --keep-uid is added we can just create another mapping that will + # do that for us. Beware, that in {uid,git}map=container_id:host_id:range, + # the host_id does actually refer to the uid in the first mapping where 0 + # (root) is mapped to the current user and rest is offset. + + # In order to set up this mapping, we need to keep all the user IDs to prevent + # possible errors as some images might expect UIDs up to 90000 (looking at you + # fedora), so we don't want the overflowuid to be used for them. For mapping + # all the other users properly ther eneeds to be some math done. Don't worry, + # it's just addition and subtraction. + + # 65536 ought to be enough (tm), but for really rare cases the maximums might + # need to be higher, but that only happens when your /etc/sub{u,g}id allow + # users to have more IDs. Unless --keep-uid is supported, let's do this in a + # way that should work for everyone. + CI_MAX_UID = $(shell sed -n "s/^$USER:[^:]\+://p" /etc/subuid) + CI_MAX_GID = $(shell sed -n "s/^$USER:[^:]\+://p" /etc/subgid) + ifeq ($(CI_MAX_UID),) + CI_MAX_UID = 65536 + endif + ifeq ($(CI_MAX_GID),) + CI_MAX_GID = 65536 + endif + CI_UID_OTHER = $(shell echo $$(($(CI_UID)+1))) + CI_GID_OTHER = $(shell echo $$(($(CI_GID)+1))) + CI_UID_OTHER_RANGE = $(shell echo $$(($(CI_MAX_UID)-$(CI_UID)))) + CI_GID_OTHER_RANGE = $(shell echo $$(($(CI_MAX_GID)-$(CI_GID)))) + + CI_PODMAN_ARGS = \ + --uidmap 0:1:$(CI_UID) \ + --uidmap $(CI_UID):0:1 \ + --uidmap $(CI_UID_OTHER):$(CI_UID_OTHER):$(CI_UID_OTHER_RANGE) \ + --gidmap 0:1:$(CI_GID) \ + --gidmap $(CI_GID):0:1 \ + --gidmap $(CI_GID_OTHER):$(CI_GID_OTHER):$(CI_GID_OTHER_RANGE) \ + $(NULL) +endif + # Args to use when cloning a git repo. # -c stop it complaining about checking out a random hash # -q stop it displaying progress info for local clone @@ -100,7 +147,7 @@ CI_GIT_ARGS = \ --local \ $(NULL) -# Args to use when running the Docker env +# Args to use when running the container # --rm stop inactive containers getting left behind # --user we execute as the same user & group account # as dev so that file ownership matches host @@ -110,22 +157,23 @@ CI_GIT_ARGS = \ # --ulimit lower files limit for performance reasons # --interactive # --tty Ensure we have ability to Ctrl-C the build -CI_DOCKER_ARGS = \ +CI_ENGINE_ARGS = \ --rm \ --user $(CI_UID):$(CI_GID) \ --interactive \ --tty \ + $(CI_PODMAN_ARGS) \ $(CI_PWDB_MOUNTS) \ --volume $(CI_HOST_SRCDIR):$(CI_CONT_SRCDIR):z \ --workdir $(CI_CONT_SRCDIR) \ --ulimit nofile=$(CI_ULIMIT_FILES):$(CI_ULIMIT_FILES) \ $(NULL) -ci-check-docker: - @echo -n "Checking if Docker is available and running..." && \ - docker version 1>/dev/null && echo "yes" +ci-check-engine: + @echo -n "Checking if $(CI_ENGINE) is available..." && \ + $(CI_ENGINE) version 1>/dev/null && echo "yes" -ci-prepare-tree: ci-check-docker +ci-prepare-tree: ci-check-engine @test "$(CI_REUSE)" != "1" && rm -rf $(CI_SCRATCHDIR) || : @if ! test -d $(CI_SCRATCHDIR) ; then \ mkdir -p $(CI_SCRATCHDIR); \ @@ -150,7 +198,7 @@ ci-prepare-tree: ci-check-docker # gl_public_submodule_commit= to disable gnulib's submodule check # which breaks due to way we clone the submodules ci-build@%: ci-prepare-tree - docker run $(CI_DOCKER_ARGS) $(CI_IMAGE_PREFIX)$*$(CI_IMAGE_TAG) \ + $(CI_ENGINE) run $(CI_ENGINE_ARGS) $(CI_IMAGE_PREFIX)$*$(CI_IMAGE_TAG) \ /bin/bash -c '\ mkdir -p $(CI_CONT_BUILDDIR) || exit 1 ; \ cd $(CI_CONT_BUILDDIR) ; \ @@ -179,11 +227,11 @@ ci-check@%: $(MAKE) -f $(CI_MAKEFILE) ci-build@$* CI_MAKE_ARGS="check" ci-shell@%: ci-prepare-tree - docker run $(CI_DOCKER_ARGS) $(CI_IMAGE_PREFIX)$*$(CI_IMAGE_TAG) /bin/bash + $(CI_ENGINE) run $(CI_ENGINE_ARGS) $(CI_IMAGE_PREFIX)$*$(CI_IMAGE_TAG) /bin/bash @test "$(CI_CLEAN)" = "1" && rm -rf $(CI_SCRATCHDIR) || : ci-help: - @echo "Build libvirt inside Docker containers used for CI" + @echo "Build libvirt inside containers used for CI" @echo @echo "Available targets:" @echo @@ -215,6 +263,7 @@ ci-help: @echo @echo "Available make variables:" @echo - @echo " CI_CLEAN=0 - do not delete '$(CI_SCRATCHDIR)' after completion" - @echo " CI_REUSE=1 - re-use existing '$(CI_SCRATCHDIR)' content" + @echo " CI_CLEAN=0 - do not delete '$(CI_SCRATCHDIR)' after completion" + @echo " CI_REUSE=1 - re-use existing '$(CI_SCRATCHDIR)' content" + @echo " CI_ENGINE=auto - container engine to use (podman, docker)" @echo -- 2.21.0

2 1

[libvirt] [jenkins-ci PATCH 0/6] Add support for gtk-vnc builds
by Daniel P. Berrangé 10 May '19

10 May '19

Support gtk-vnc and make virt-viewer depend on it Daniel P. Berrangé (6): mappings: add libgcrypt native & mingw packages mappings: add pulseaudio libs for native packages projects: add gtk-vnc project projects: make virt-viewer depend on gtk-vnc jobs mappings: remove gtk-vnc2 native and mingw packages jobs: allow test-suite.log to exist anywhere guests/host_vars/libvirt-centos-7/main.yml | 1 + guests/host_vars/libvirt-debian-9/main.yml | 1 + guests/host_vars/libvirt-debian-sid/main.yml | 1 + guests/host_vars/libvirt-fedora-29/main.yml | 1 + guests/host_vars/libvirt-fedora-30/main.yml | 1 + .../host_vars/libvirt-fedora-rawhide/main.yml | 3 +++ guests/host_vars/libvirt-freebsd-11/main.yml | 1 + guests/host_vars/libvirt-freebsd-12/main.yml | 1 + .../libvirt-freebsd-current/main.yml | 1 + guests/host_vars/libvirt-ubuntu-18/main.yml | 1 + .../build/jobs/autotools-check-job.yml | 2 +- guests/playbooks/build/jobs/defaults.yml | 3 +++ .../build/projects/gtk-vnc+mingw32.yml | 12 +++++++++ .../build/projects/gtk-vnc+mingw64.yml | 12 +++++++++ guests/playbooks/build/projects/gtk-vnc.yml | 12 +++++++++ guests/vars/mappings.yml | 27 ++++++++++--------- guests/vars/projects/gtk-vnc+mingw32.yml | 6 +++++ guests/vars/projects/gtk-vnc+mingw64.yml | 6 +++++ guests/vars/projects/gtk-vnc.yml | 11 ++++++++ guests/vars/projects/virt-viewer+mingw32.yml | 1 - guests/vars/projects/virt-viewer+mingw64.yml | 1 - guests/vars/projects/virt-viewer.yml | 1 - jenkins/jobs/autotools.yaml | 2 +- jenkins/jobs/defaults.yaml | 3 +++ jenkins/projects/gtk-vnc+mingw32.yaml | 11 ++++++++ jenkins/projects/gtk-vnc+mingw64.yaml | 11 ++++++++ jenkins/projects/gtk-vnc.yaml | 15 +++++++++++ jenkins/projects/virt-viewer+mingw32.yaml | 4 ++- jenkins/projects/virt-viewer+mingw64.yaml | 4 ++- jenkins/projects/virt-viewer.yaml | 4 ++- 30 files changed, 140 insertions(+), 20 deletions(-) create mode 100644 guests/playbooks/build/projects/gtk-vnc+mingw32.yml create mode 100644 guests/playbooks/build/projects/gtk-vnc+mingw64.yml create mode 100644 guests/playbooks/build/projects/gtk-vnc.yml create mode 100644 guests/vars/projects/gtk-vnc+mingw32.yml create mode 100644 guests/vars/projects/gtk-vnc+mingw64.yml create mode 100644 guests/vars/projects/gtk-vnc.yml create mode 100644 jenkins/projects/gtk-vnc+mingw32.yaml create mode 100644 jenkins/projects/gtk-vnc+mingw64.yaml create mode 100644 jenkins/projects/gtk-vnc.yaml -- 2.21.0

2 16

[libvirt] [PATCHv2] build: restore support for libyajl 2.0.1
by Ján Tomko 10 May '19

10 May '19

Commit 105756660f944e7db02de3b55b98bb7c11cd03bf was too eager and did not consider SLE 12 which still has 2.0.1 that does not ship a pkg-config file. Similar to how we check for readline, prefer pkg-config if available and fall back to the old detection code if not found. NB: this is not a clean revert because we're not reintroducing support for YAJL 1. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> Reported-by: Olaf Hering <olaf(a)aepfle.de> --- m4/virt-yajl.m4 | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/m4/virt-yajl.m4 b/m4/virt-yajl.m4 index 494e722963..3caf0c5d07 100644 --- a/m4/virt-yajl.m4 +++ b/m4/virt-yajl.m4 @@ -24,7 +24,19 @@ AC_DEFUN([LIBVIRT_ARG_YAJL],[ AC_DEFUN([LIBVIRT_CHECK_YAJL],[ dnl YAJL JSON library http://lloyd.github.com/yajl/ - LIBVIRT_CHECK_PKG([YAJL], [yajl], [2.0.3]) + PKG_CHECK_EXISTS([readline], [use_pkgconfig=1], [use_pkgconfig=0]) + + if test $use_pkgconfig = 1; then + dnl 2.0.3 was the version where the pkg-config file was first added + LIBVIRT_CHECK_PKG([YAJL], [yajl], [2.0.3]) + else + dnl SUSE SLE 12 and OpenSUSE Leap 42.3 still use 2.0.1 + dnl TODO: delete this in July 2020 + LIBVIRT_CHECK_LIB([YAJL], [yajl], + [yajl_tree_parse], [yajl/yajl_common.h]) + + fi + ]) AC_DEFUN([LIBVIRT_RESULT_YAJL],[ -- 2.19.2

3 3

[libvirt] [PATCH 0/2] Support more container engines in Makefile.ci
by Martin Kletzander 10 May '19

10 May '19

Maybe someone can add support for libvirt-lxc later on =) Martin Kletzander (2): Don't include Makefile.ci in Makefile.am Add support for podman in Makefile.ci Makefile.am | 4 +- Makefile.ci | 125 ++++++++++++++++++++++++++++++++++++++-------------- 2 files changed, 96 insertions(+), 33 deletions(-) -- 2.21.0

3 9

[libvirt] [PATCH 0/3] virSysinfo: Try dmidecode on aarch64
by Michal Privoznik 10 May '19

10 May '19

Turns out some aarch64 machines provide SMBIOS and thus we can use dmidecode to get the sysinfo. Currently, we're parsing /proc/cpuinfo which is very sparse on ARMs. Yes, ideally everything would be exposed somewhere in sysfs, and libvirt would ditch dmidecode in favor of sysfs, but how realistic is that? Michal Prívozník (3): virSysinfoRead: Simplify #ifdef underbush virSysinfoParseX86BaseBoard: Free memory upfront if no board detected virSysinfoReadARM: Try reading DMI table src/util/virsysinfo.c | 43 +++++++++++++++++++++++++++++++------------ 1 file changed, 31 insertions(+), 12 deletions(-) -- 2.21.0

3 8

[libvirt] [PATCH] test_driver: implement virDomainGetDiskErrors
by Ilias Stamatis 10 May '19

10 May '19

Return the number of disks present in the configuration of the fake driver when called with @errors as NULL and @maxerrors as 0. Otherwise return 0 as the number of errors encountered. Signed-off-by: Ilias Stamatis <stamatis.iliass(a)gmail.com> --- src/test/test_driver.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/src/test/test_driver.c b/src/test/test_driver.c index 460c896ef6..5fa9ab30f1 100644 --- a/src/test/test_driver.c +++ b/src/test/test_driver.c @@ -3046,6 +3046,32 @@ static int testDomainSetAutostart(virDomainPtr domain, return 0; } +static int testDomainGetDiskErrors(virDomainPtr dom, + virDomainDiskErrorPtr errors, + unsigned int maxerrors ATTRIBUTE_UNUSED, + unsigned int flags) +{ + int ret = -1; + virDomainObjPtr vm = NULL; + + virCheckFlags(0, -1); + + if (!(vm = testDomObjFromDomain(dom))) + goto cleanup; + + if (virDomainObjCheckActive(vm) < 0) + goto cleanup; + + if (!errors) + ret = vm->def->ndisks; + else + ret = 0; + + cleanup: + virDomainObjEndAPI(&vm); + return ret; +} + static char *testDomainGetSchedulerType(virDomainPtr domain ATTRIBUTE_UNUSED, int *nparams) { @@ -6833,6 +6859,7 @@ static virHypervisorDriver testHypervisorDriver = { .domainUndefineFlags = testDomainUndefineFlags, /* 0.9.4 */ .domainGetAutostart = testDomainGetAutostart, /* 0.3.2 */ .domainSetAutostart = testDomainSetAutostart, /* 0.3.2 */ + .domainGetDiskErrors = testDomainGetDiskErrors, /* 5.4.0 */ .domainGetSchedulerType = testDomainGetSchedulerType, /* 0.3.2 */ .domainGetSchedulerParameters = testDomainGetSchedulerParameters, /* 0.3.2 */ .domainGetSchedulerParametersFlags = testDomainGetSchedulerParametersFlags, /* 0.9.2 */ -- 2.21.0

2 3

[libvirt] [PATCH] build: restore support for libyajl 2.0.1
by Ján Tomko 09 May '19

09 May '19

Commit 105756660f944e7db02de3b55b98bb7c11cd03bf was too eager and did not consider SLE 12 which still has 2.0.1 that does not ship a pkg-config file. Similar to how we check for readline, prefer pkg-config if available and fall back to the old detection code if not found. NB: this is not a clean revert because we're not reintroducing support for YAJL 1. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> Reported-by: Olaf Hering <olaf(a)aepfle.de> --- m4/virt-yajl.m4 | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/m4/virt-yajl.m4 b/m4/virt-yajl.m4 index 494e722963..05a8f8b9bd 100644 --- a/m4/virt-yajl.m4 +++ b/m4/virt-yajl.m4 @@ -24,7 +24,19 @@ AC_DEFUN([LIBVIRT_ARG_YAJL],[ AC_DEFUN([LIBVIRT_CHECK_YAJL],[ dnl YAJL JSON library http://lloyd.github.com/yajl/ - LIBVIRT_CHECK_PKG([YAJL], [yajl], [2.0.3]) + PKG_CHECK_EXISTS([readline], [use_pkgconfig=1], [use_pkgconfig=0]) + + if test $use_pkgconfig = 1; then + dnl 2.0.3 was the version where the pkg-config file was first added + LIBVIRT_CHECK_PKG([YAJL], [yajl], [2.0.3]) + else + dnl SUSE SLE 12 and OpenSUSE Leap 42.3 still use 2.0.1 + dnl TODO: delete this in July 2020 + LIBVIRT_CHECK_LIB_ALT([YAJL], [yajl], + [yajl_tree_parse], [yajl/yajl_common.h]) + + fi + ]) AC_DEFUN([LIBVIRT_RESULT_YAJL],[ -- 2.19.2

4 3

[libvirt] [jenkins-ci PATCH 0/4] guests: Introduce package_manager
by Andrea Bolognani 09 May '19

09 May '19

As mentioned in [1] and detailed in [2], Fedora is planning to drop the 'yum' command and require users to call 'dnf' exclusively. In fact, it looks like this change has already been implemented in Rawhide, so we need to adapt sooner rather than later. The first two patches address the actual compatibility issue, while the remaining ones perform some cleanups which are either made much easier by the previous changes or I just happened to stumble upon while working on this :) [1] https://www.redhat.com/archives/libvir-list/2019-May/msg00043.html [2] https://fedoraproject.org/wiki/Changes/Retire_YUM_3 Andrea Bolognani (4): guests: Introduce package_manager guests: Use package_manager everywhere guests: Don't call out to the shell twice lcitool: Fix Dockerfile alignment guests/host_vars/libvirt-centos-7/main.yml | 1 + guests/host_vars/libvirt-debian-9/main.yml | 1 + guests/host_vars/libvirt-debian-sid/main.yml | 1 + guests/host_vars/libvirt-fedora-29/main.yml | 1 + guests/host_vars/libvirt-fedora-30/main.yml | 1 + .../host_vars/libvirt-fedora-rawhide/main.yml | 1 + guests/host_vars/libvirt-freebsd-11/main.yml | 1 + guests/host_vars/libvirt-freebsd-12/main.yml | 1 + .../libvirt-freebsd-current/main.yml | 1 + guests/host_vars/libvirt-ubuntu-18/main.yml | 1 + guests/lcitool | 48 ++++++++++--------- guests/playbooks/update/tasks/base.yml | 19 ++------ guests/playbooks/update/tasks/bootstrap.yml | 16 +------ 13 files changed, 42 insertions(+), 51 deletions(-) -- 2.20.1

2 9

[libvirt] [PATCH 00/12] qemu: Refactor image permission/lock setting (blockdev-add saga)
by Peter Krempa 09 May '19

09 May '19

With new blockjob handling we'll need to modify permissions for chains and individual images. The individual image code was universally accessible but the chain setting code reimplemented it mostly only in qemu_hotplug.h. Refactor the handling by moving the code to qemu_domain.c and making it universal. Peter Krempa (12): qemu: Rename qemuDomainDiskChainElement(Revoke|Prepare) qemu: Move and rename qemuHotplugPrepareDiskSourceAccess qemu: Split entry points to qemuDomainStorageSourceChainAccessPrepare qemu: domain: Rename qemuDomainStorageSourceChainAccessPrepare qemu: Convert boolean flags to enum flags in qemuDomainStorageSourceAccessModify qemu: Allow using qemuDomainStorageSourceAccessModify on singe images qemu: Refactor/simplify qemuDomainStorageSourceAccessRevoke qemu: Allow forcing read-only mode in qemuDomainStorageSourceAccessModify qemu: Use bools rather than labels in qemuDomainStorageSourceAccessModify qemu: Allow skipping the revoke step in qemuDomainStorageSourceAccessModify qemu: Mark when modifying access to existing source in qemuDomainStorageSourceAccessModify qemu: Refactor/simplify qemuDomainStorageSourceAccessAllow src/qemu/qemu_domain.c | 212 +++++++++++++++++++++++++++++++--------- src/qemu/qemu_domain.h | 23 +++-- src/qemu/qemu_driver.c | 24 ++--- src/qemu/qemu_hotplug.c | 80 ++------------- 4 files changed, 200 insertions(+), 139 deletions(-) -- 2.20.1

3 27

[libvirt] [PATCH 0/4] virObject for snapshot def [incremental backup saga]
by Eric Blake 09 May '19

09 May '19

Peter rightly complained that my attempt to leave a todo in virdomainmomentobjlist.c about not being polymorphic enough gives no incentive to get it fixed later once incremental backups are in, so instead fix it now. My v9 backup patches will be changed similarly to the changes to snapshot shown here. Eric Blake (4): snapshot: s/parent/parent_name/ as prep for virObject snapshot: s/current/parent/ as prep for virObject snapshot: Add virDomainSnapshotDefNew snapshot: Make virDomainSnapshotDef a virObject src/conf/moment_conf.h | 7 +- src/conf/snapshot_conf.h | 4 +- cfg.mk | 2 - src/conf/moment_conf.c | 30 ++++- src/conf/snapshot_conf.c | 164 ++++++++++++++++------------ src/conf/virdomainmomentobjlist.c | 7 +- src/conf/virdomainsnapshotobjlist.c | 2 +- src/esx/esx_driver.c | 19 ++-- src/libvirt_private.syms | 2 +- src/qemu/qemu_domain.c | 10 +- src/qemu/qemu_driver.c | 29 +++-- src/test/test_driver.c | 25 ++--- src/vbox/vbox_common.c | 95 ++++++++-------- src/vz/vz_driver.c | 5 +- src/vz/vz_sdk.c | 10 +- tests/domainsnapshotxml2xmltest.c | 3 +- 16 files changed, 230 insertions(+), 184 deletions(-) -- 2.20.1

2 8

[libvirt] [PATCH] spec: Bump minimum supported Fedora version to 29
by Andrea Bolognani 09 May '19

09 May '19

Fedora 30 is out, which means that Fedora 28 is going to be EOL very soon. Let's get ahead of the game and drop support for it right now. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- libvirt.spec.in | 2 +- mingw-libvirt.spec.in | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 876b2f0897..e07041c0b9 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -4,7 +4,7 @@ # that's still supported by the vendor. It may work on other distros # or versions, but no effort will be made to ensure that going forward. %define min_rhel 7 -%define min_fedora 28 +%define min_fedora 29 %if (0%{?fedora} && 0%{?fedora} >= %{min_fedora}) || (0%{?rhel} && 0%{?rhel} >= %{min_rhel}) %define supported_platform 1 diff --git a/mingw-libvirt.spec.in b/mingw-libvirt.spec.in index 8a96ea914c..9add033669 100644 --- a/mingw-libvirt.spec.in +++ b/mingw-libvirt.spec.in @@ -3,7 +3,7 @@ # This spec file assumes you are building on a Fedora version # that's still supported by the vendor. It may work on other distros # or versions, but no effort will be made to ensure that going forward. -%define min_fedora 28 +%define min_fedora 29 %if 0%{?fedora} && 0%{?fedora} >= %{min_fedora} %define supported_platform 1 -- 2.20.1

2 1

[libvirt] [jenkins-ci PATCH 0/4] Add Fedora 30, drop Fedora 28
by Andrea Bolognani 09 May '19

09 May '19

I guess it's been six months already. Andrea Bolognani (4): guests: Add Fedora 30 Start building on Fedora 30 Stop building on Fedora 28 guests: Drop Fedora 28 guests/host_vars/libvirt-fedora-28/docker.yml | 2 - guests/host_vars/libvirt-fedora-30/docker.yml | 2 + .../install.yml | 2 +- .../main.yml | 2 +- guests/inventory | 2 +- guests/playbooks/build/jobs/defaults.yml | 4 +- .../playbooks/build/projects/libvirt-dbus.yml | 6 +- .../build/projects/libvirt-go-xml.yml | 2 +- .../playbooks/build/projects/libvirt-go.yml | 2 +- .../build/projects/libvirt-ocaml.yml | 2 +- .../build/projects/libvirt-sandbox.yml | 4 +- .../playbooks/build/projects/libvirt-tck.yml | 4 +- guests/playbooks/build/projects/libvirt.yml | 2 +- .../build/projects/osinfo-db-tools.yml | 2 +- guests/playbooks/build/projects/osinfo-db.yml | 2 +- .../playbooks/build/projects/virt-manager.yml | 6 +- .../playbooks/build/projects/virt-viewer.yml | 2 +- guests/vars/mappings.yml | 1 - guests/vars/vault.yml | 74 +++++++++---------- jenkins/jobs/defaults.yaml | 4 +- jenkins/projects/libvirt-dbus.yaml | 6 +- jenkins/projects/libvirt-go-xml.yaml | 2 +- jenkins/projects/libvirt-go.yaml | 2 +- jenkins/projects/libvirt-ocaml.yaml | 2 +- jenkins/projects/libvirt-sandbox.yaml | 4 +- jenkins/projects/libvirt-tck.yaml | 4 +- jenkins/projects/libvirt.yaml | 2 +- jenkins/projects/osinfo-db-tools.yaml | 2 +- jenkins/projects/osinfo-db.yaml | 2 +- jenkins/projects/virt-manager.yaml | 6 +- jenkins/projects/virt-viewer.yaml | 2 +- 31 files changed, 80 insertions(+), 81 deletions(-) delete mode 100644 guests/host_vars/libvirt-fedora-28/docker.yml create mode 100644 guests/host_vars/libvirt-fedora-30/docker.yml rename guests/host_vars/{libvirt-fedora-28 => libvirt-fedora-30}/install.yml (66%) rename guests/host_vars/{libvirt-fedora-28 => libvirt-fedora-30}/main.yml (95%) -- 2.20.1

2 8

[libvirt] [PATCH v6] tests: perform cross compiler builds on GitLab CI
by Daniel P. Berrangé 09 May '19

09 May '19

GitLab CI provides some shared build runners that use Docker containers. This resource can usefully run cross-compiled builds since all other CI build testing is currently x86 only, and Travis CI is already very busy testing native builds. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- .gitlab-ci.yml | 46 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 .gitlab-ci.yml Changed in v6: - Run jobs half & half on 9 vs sid diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml new file mode 100644 index 0000000000..a8a8581d9e --- /dev/null +++ b/.gitlab-ci.yml @@ -0,0 +1,46 @@ +.job_template: &job_definition + script: + - mkdir vpath + - cd vpath + - ../autogen.sh $CONFIGURE_OPTS + - make -j $(getconf _NPROCESSORS_ONLN) + +# We could run every arch on both versions, but it is a little +# overkill. Instead we run half the jobs on 9 and half the jobs +# on sid to give reasonable cross-coverage. + +debian-9-cross-armv6l: + <<: *job_definition + image: quay.io/libvirt/buildenv-debian-9-cross-armv6l:master + +debian-9-cross-mipsel: + <<: *job_definition + image: quay.io/libvirt/buildenv-debian-9-cross-mipsel:master + +debian-9-cross-ppc64le: + <<: *job_definition + image: quay.io/libvirt/buildenv-debian-9-cross-ppc64le:master + +debian-9-cross-s390x: + <<: *job_definition + image: quay.io/libvirt/buildenv-debian-9-cross-s390x:master + +debian-sid-cross-aarch64: + <<: *job_definition + image: quay.io/libvirt/buildenv-debian-sid-cross-aarch64:master + +debian-sid-cross-armv7l: + <<: *job_definition + image: quay.io/libvirt/buildenv-debian-sid-cross-armv7l:master + +debian-sid-cross-i686: + <<: *job_definition + image: quay.io/libvirt/buildenv-debian-sid-cross-i686:master + +debian-sid-cross-mips64el: + <<: *job_definition + image: quay.io/libvirt/buildenv-debian-sid-cross-mips64el:master + +debian-sid-cross-mips: + <<: *job_definition + image: quay.io/libvirt/buildenv-debian-sid-cross-mips:master -- 2.20.1

2 2

[libvirt] [PATCH 00/10] build: drop some old libs and relax GNU strictness
by Ján Tomko 09 May '19

09 May '19

While testing these changes I found that the build is broken with old rbd on (unsupported) Debian 8. Fix the build by dropping support for old rbd. Ján Tomko (10): rbd: depend on diff_iterate2 rbd: drop support for ceph 0.94 build: drop check for SASL1 build: require yajl >= 2.0.3 json: assume WITH_YAJL2 build: remove WITH_YAJL2 virJSONValueToString: bail out early on error configure: split AM_INIT_AUTOMAKE into multiple lines configure.ac: drop -Wno-obsolete from AM_INIT_AUTOMAKE configure.ac: add foreign to AM_INIT_AUTOMAKE config-post.h | 1 - configure.ac | 12 ++++-- m4/virt-driver-qemu.m4 | 2 +- m4/virt-sasl.m4 | 5 +-- m4/virt-storage-rbd.m4 | 2 +- m4/virt-yajl.m4 | 5 +-- src/storage/storage_backend_rbd.c | 39 ------------------- src/util/virjson.c | 63 +++---------------------------- 8 files changed, 19 insertions(+), 110 deletions(-) -- 2.19.2

5 30

[libvirt] [PATCH] tests: Move tools under tests/tools/
by Michal Privoznik 07 May '19

07 May '19

There are some scripts/binaries that are not tests themselves but rather fulfill support purpose. Separate them from the rest of the tests. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- .gitignore | 2 +- Makefile.am | 2 +- cfg.mk | 4 +- configure.ac | 1 + tests/Makefile.am | 22 +----- tests/qemucapabilitiestest.c | 4 +- tests/testutils.c | 2 +- tests/{ => tools}/.valgrind.supp | 0 tests/tools/Makefile.am | 85 +++++++++++++++++++++ tests/{ => tools}/check-file-access.pl | 0 tests/{ => tools}/file_access_whitelist.txt | 0 tests/{ => tools}/group-qemu-caps.pl | 0 tests/{ => tools}/oomtrace.pl | 0 tests/{ => tools}/qemucapsprobe.c | 0 tests/{ => tools}/qemucapsprobemock.c | 0 tests/{ => tools}/test-wrap-argv.pl | 2 +- 16 files changed, 98 insertions(+), 26 deletions(-) rename tests/{ => tools}/.valgrind.supp (100%) create mode 100644 tests/tools/Makefile.am rename tests/{ => tools}/check-file-access.pl (100%) rename tests/{ => tools}/file_access_whitelist.txt (100%) rename tests/{ => tools}/group-qemu-caps.pl (100%) rename tests/{ => tools}/oomtrace.pl (100%) rename tests/{ => tools}/qemucapsprobe.c (100%) rename tests/{ => tools}/qemucapsprobemock.c (100%) rename tests/{ => tools}/test-wrap-argv.pl (98%) diff --git a/.gitignore b/.gitignore index 16eb4a3e2e..c231d394f3 100644 --- a/.gitignore +++ b/.gitignore @@ -170,7 +170,7 @@ /tests/*.trs /tests/*test /tests/commandhelper -/tests/qemucapsprobe +/tests/tools/qemucapsprobe !/tests/virsh-self-test !/tests/virt-aa-helper-test !/tests/virt-admin-self-test diff --git a/Makefile.am b/Makefile.am index eba5916352..875c0fa997 100644 --- a/Makefile.am +++ b/Makefile.am @@ -17,7 +17,7 @@ ## <http://www.gnu.org/licenses/>. SUBDIRS = . gnulib/lib include/libvirt src tools docs gnulib/tests \ - tests po examples + tests tests/tools po examples XZ_OPT ?= -v -T0 export XZ_OPT diff --git a/cfg.mk b/cfg.mk index b785089910..5e055023ee 100644 --- a/cfg.mk +++ b/cfg.mk @@ -1169,10 +1169,10 @@ header-ifdef: test-wrap-argv: $(AM_V_GEN)$(VC_LIST) | $(GREP) -E '\.(ldargs|args)' | xargs \ - $(PERL) $(top_srcdir)/tests/test-wrap-argv.pl --check + $(PERL) $(top_srcdir)/tests/tools/test-wrap-argv.pl --check group-qemu-caps: - $(AM_V_GEN)$(PERL) $(top_srcdir)/tests/group-qemu-caps.pl --check $(top_srcdir)/ + $(AM_V_GEN)$(PERL) $(top_srcdir)/tests/tools/group-qemu-caps.pl --check $(top_srcdir)/ # sc_po_check can fail if generated files are not built first sc_po_check: \ diff --git a/configure.ac b/configure.ac index fabec815db..893d0db17a 100644 --- a/configure.ac +++ b/configure.ac @@ -925,6 +925,7 @@ AC_CONFIG_FILES([\ include/libvirt/libvirt-common.h \ examples/Makefile \ tests/Makefile \ + tests/tools/Makefile \ tools/Makefile]) AC_OUTPUT diff --git a/tests/Makefile.am b/tests/Makefile.am index 46d94d2236..0f5a5c231e 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -75,7 +75,6 @@ MOCKLIBS_LIBS = \ ../src/libvirt.la EXTRA_DIST = \ - .valgrind.supp \ bhyvexml2argvdata \ bhyveargv2xmldata \ bhyvexml2xmloutdata \ @@ -107,7 +106,6 @@ EXTRA_DIST = \ nwfilterxml2firewalldata \ nwfilterxml2xmlin \ nwfilterxml2xmlout \ - oomtrace.pl \ qemuagentdata \ qemuargv2xmldata \ qemublocktestdata \ @@ -285,12 +283,10 @@ test_programs += qemuxml2argvtest qemuxml2xmltest \ qemusecuritytest \ qemufirmwaretest \ $(NULL) -test_helpers += qemucapsprobe test_libraries += libqemumonitortestutils.la \ libqemutestdriver.la \ qemuxml2argvmock.la \ qemucaps2xmlmock.la \ - qemucapsprobemock.la \ qemucpumock.la \ $(NULL) endif WITH_QEMU @@ -442,15 +438,15 @@ EXTRA_DIST += $(test_scripts) if WITH_LINUX check-access: file-access-clean VIR_TEST_FILE_ACCESS=1 $(MAKE) $(AM_MAKEFLAGS) check - $(PERL) check-file-access.pl | sort -u + $(PERL) tools/check-file-access.pl | sort -u file-access-clean: > test_file_access.txt endif WITH_LINUX EXTRA_DIST += \ - check-file-access.pl \ - file_access_whitelist.txt + tools/check-file-access.pl \ + tools/file_access_whitelist.txt if WITH_TESTS noinst_PROGRAMS = $(test_programs) $(test_helpers) @@ -478,7 +474,7 @@ TESTS_ENVIRONMENT = \ VALGRIND = valgrind --quiet --leak-check=full --trace-children=yes \ --trace-children-skip="*/tools/virsh","*/tests/commandhelper" \ - --suppressions=$(abs_srcdir)/.valgrind.supp + --suppressions=$(abs_srcdir)/tools/.valgrind.supp valgrind: $(MAKE) check VG="$(LIBTOOL) --mode=execute $(VALGRIND)" @@ -603,16 +599,6 @@ qemucapabilitiestest_SOURCES = \ qemucapabilitiestest_LDADD = libqemumonitortestutils.la \ $(qemu_LDADDS) $(LDADDS) -qemucapsprobe_SOURCES = \ - qemucapsprobe.c -qemucapsprobe_LDADD = \ - libqemutestdriver.la $(LDADDS) - -qemucapsprobemock_la_SOURCES = \ - qemucapsprobemock.c -qemucapsprobemock_la_LDFLAGS = $(MOCKLIBS_LDFLAGS) -qemucapsprobemock_la_LIBADD = $(MOCKLIBS_LIBS) - qemucommandutiltest_SOURCES = \ qemucommandutiltest.c \ testutils.c testutils.h \ diff --git a/tests/qemucapabilitiestest.c b/tests/qemucapabilitiestest.c index ac9ab6bfce..48363326f4 100644 --- a/tests/qemucapabilitiestest.c +++ b/tests/qemucapabilitiestest.c @@ -225,11 +225,11 @@ mymain(void) return EXIT_FAILURE; /* - * Run "tests/qemucapsprobe /path/to/qemu/binary >foo.replies" + * Run "tests/tools/qemucapsprobe /path/to/qemu/binary >foo.replies" * to generate updated or new *.replies data files. * * If you manually edit replies files you can run - * "tests/qemucapsfixreplies foo.replies" to fix the replies ids. + * "tests/tools/qemucapsfixreplies foo.replies" to fix the replies ids. * * Once a replies file has been generated and tweaked if necessary, * you can drop it into tests/qemucapabilitiesdata/ (with a sensible diff --git a/tests/testutils.c b/tests/testutils.c index 245b1832f6..080a1ccda2 100644 --- a/tests/testutils.c +++ b/tests/testutils.c @@ -533,7 +533,7 @@ virTestRewrapFile(const char *filename) return -1; } - if (virAsprintf(&script, "%s/test-wrap-argv.pl", abs_srcdir) < 0) + if (virAsprintf(&script, "%s/tools/test-wrap-argv.pl", abs_srcdir) < 0) goto cleanup; cmd = virCommandNewArgList(perl, script, "--in-place", filename, NULL); diff --git a/tests/.valgrind.supp b/tests/tools/.valgrind.supp similarity index 100% rename from tests/.valgrind.supp rename to tests/tools/.valgrind.supp diff --git a/tests/tools/Makefile.am b/tests/tools/Makefile.am new file mode 100644 index 0000000000..8a34b4a84f --- /dev/null +++ b/tests/tools/Makefile.am @@ -0,0 +1,85 @@ +# vim: filetype=automake + +AM_CPPFLAGS = \ + -I$(top_srcdir)/tests/ \ + -I$(top_builddir) -I$(top_srcdir) \ + -I$(top_builddir)/gnulib/lib -I$(top_srcdir)/gnulib/lib \ + -I$(top_builddir)/include -I$(top_srcdir)/include \ + -I$(top_builddir)/src -I$(top_srcdir)/src \ + -I$(top_srcdir)/src/util \ + -I$(top_srcdir)/src/conf \ + $(NULL) + +WARN_CFLAGS += $(RELAXED_FRAME_LIMIT_CFLAGS) + +AM_CFLAGS = \ + -Dabs_builddir="\"$(abs_builddir)\"" \ + -Dabs_top_builddir="\"$(abs_top_builddir)\"" \ + -Dabs_srcdir="\"$(abs_srcdir)\"" \ + -Dabs_top_srcdir="\"$(abs_top_srcdir)\"" \ + $(LIBXML_CFLAGS) \ + $(LIBNL_CFLAGS) \ + $(GNUTLS_CFLAGS) \ + $(SASL_CFLAGS) \ + $(SELINUX_CFLAGS) \ + $(APPARMOR_CFLAGS) \ + $(YAJL_CFLAGS) \ + $(XDR_CFLAGS) \ + $(WARN_CFLAGS) + +AM_LDFLAGS = \ + -export-dynamic + +MOCKLIBS_LDFLAGS = -module -avoid-version \ + -rpath /evil/libtool/hack/to/force/shared/lib/creation \ + $(MINGW_EXTRA_LDFLAGS) + +GNULIB_LIBS = \ + ../../gnulib/lib/libgnu.la + +MOCKLIBS_LIBS = \ + $(GNULIB_LIBS) \ + ../../src/libvirt.la + +PROBES_O = +if WITH_DTRACE_PROBES +PROBES_O += ../../src/libvirt_probes.lo +endif WITH_DTRACE_PROBES + +LDADDS = \ + $(NO_INDIRECT_LDFLAGS) \ + $(PROBES_O) \ + $(GNULIB_LIBS) \ + ../../src/libvirt.la + +test_helpers = +test_libraries = + +if WITH_QEMU +test_helpers += qemucapsprobe +test_libraries += qemucapsprobemock.la + +qemucapsprobe_SOURCES = \ + qemucapsprobe.c \ + ../testutils.h +qemucapsprobe_LDADD = \ + ../libqemutestdriver.la $(LDADDS) + +qemucapsprobemock_la_SOURCES = \ + qemucapsprobemock.c +qemucapsprobemock_la_LDFLAGS = $(MOCKLIBS_LDFLAGS) +qemucapsprobemock_la_LIBADD = $(MOCKLIBS_LIBS) +endif WITH_QEMU + + +if WITH_TESTS +noinst_PROGRAMS = $(test_helpers) +noinst_LTLIBRARIES = $(test_libraries) +else ! WITH_TESTS +check_PROGRAMS = $(test_helpers) +check_LTLIBRARIES = $(test_libraries) +endif ! WITH_TESTS + +EXTRA_DIST = \ + .valgrind.supp \ + oomtrace.pl diff --git a/tests/check-file-access.pl b/tests/tools/check-file-access.pl similarity index 100% rename from tests/check-file-access.pl rename to tests/tools/check-file-access.pl diff --git a/tests/file_access_whitelist.txt b/tests/tools/file_access_whitelist.txt similarity index 100% rename from tests/file_access_whitelist.txt rename to tests/tools/file_access_whitelist.txt diff --git a/tests/group-qemu-caps.pl b/tests/tools/group-qemu-caps.pl similarity index 100% rename from tests/group-qemu-caps.pl rename to tests/tools/group-qemu-caps.pl diff --git a/tests/oomtrace.pl b/tests/tools/oomtrace.pl similarity index 100% rename from tests/oomtrace.pl rename to tests/tools/oomtrace.pl diff --git a/tests/qemucapsprobe.c b/tests/tools/qemucapsprobe.c similarity index 100% rename from tests/qemucapsprobe.c rename to tests/tools/qemucapsprobe.c diff --git a/tests/qemucapsprobemock.c b/tests/tools/qemucapsprobemock.c similarity index 100% rename from tests/qemucapsprobemock.c rename to tests/tools/qemucapsprobemock.c diff --git a/tests/test-wrap-argv.pl b/tests/tools/test-wrap-argv.pl similarity index 98% rename from tests/test-wrap-argv.pl rename to tests/tools/test-wrap-argv.pl index 7867e9d719..4a28ee9d46 100755 --- a/tests/test-wrap-argv.pl +++ b/tests/tools/test-wrap-argv.pl @@ -94,7 +94,7 @@ sub rewrap { close DIFF; print STDERR "Incorrect line wrapping in $file\n"; - print STDERR "Use test-wrap-argv.pl to wrap test data files\n"; + print STDERR "Use tests/tools/test-wrap-argv.pl to wrap test data files\n"; return -1; } } else { -- 2.21.0

5 8

[libvirt] [PATCH v2] tests: Move tools under tests/tools/
by Michal Privoznik 07 May '19

07 May '19

There are some scripts/binaries that are not tests themselves but rather fulfill support purpose. Separate them from the rest of the tests. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- diff to v1: - Found a way to generate a binary into a subdir. So no new Makefile.am is introduced .gitignore | 2 +- cfg.mk | 4 ++-- tests/Makefile.am | 22 +++----------------- tests/qemucapabilitiestest.c | 4 ++-- tests/testutils.c | 2 +- tests/{ => tools}/.valgrind.supp | 0 tests/tools/Makefile.inc.am | 23 +++++++++++++++++++++ tests/{ => tools}/check-file-access.pl | 2 +- tests/{ => tools}/file_access_whitelist.txt | 0 tests/{ => tools}/group-qemu-caps.pl | 0 tests/{ => tools}/oomtrace.pl | 0 tests/{ => tools}/qemucapsprobe.c | 2 +- tests/{ => tools}/qemucapsprobemock.c | 0 tests/{ => tools}/test-wrap-argv.pl | 2 +- 14 files changed, 35 insertions(+), 28 deletions(-) rename tests/{ => tools}/.valgrind.supp (100%) create mode 100644 tests/tools/Makefile.inc.am rename tests/{ => tools}/check-file-access.pl (98%) rename tests/{ => tools}/file_access_whitelist.txt (100%) rename tests/{ => tools}/group-qemu-caps.pl (100%) rename tests/{ => tools}/oomtrace.pl (100%) rename tests/{ => tools}/qemucapsprobe.c (96%) rename tests/{ => tools}/qemucapsprobemock.c (100%) rename tests/{ => tools}/test-wrap-argv.pl (98%) diff --git a/.gitignore b/.gitignore index 16eb4a3e2e..c231d394f3 100644 --- a/.gitignore +++ b/.gitignore @@ -170,7 +170,7 @@ /tests/*.trs /tests/*test /tests/commandhelper -/tests/qemucapsprobe +/tests/tools/qemucapsprobe !/tests/virsh-self-test !/tests/virt-aa-helper-test !/tests/virt-admin-self-test diff --git a/cfg.mk b/cfg.mk index b785089910..5e055023ee 100644 --- a/cfg.mk +++ b/cfg.mk @@ -1169,10 +1169,10 @@ header-ifdef: test-wrap-argv: $(AM_V_GEN)$(VC_LIST) | $(GREP) -E '\.(ldargs|args)' | xargs \ - $(PERL) $(top_srcdir)/tests/test-wrap-argv.pl --check + $(PERL) $(top_srcdir)/tests/tools/test-wrap-argv.pl --check group-qemu-caps: - $(AM_V_GEN)$(PERL) $(top_srcdir)/tests/group-qemu-caps.pl --check $(top_srcdir)/ + $(AM_V_GEN)$(PERL) $(top_srcdir)/tests/tools/group-qemu-caps.pl --check $(top_srcdir)/ # sc_po_check can fail if generated files are not built first sc_po_check: \ diff --git a/tests/Makefile.am b/tests/Makefile.am index 46d94d2236..c63e8a6e70 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -75,7 +75,6 @@ MOCKLIBS_LIBS = \ ../src/libvirt.la EXTRA_DIST = \ - .valgrind.supp \ bhyvexml2argvdata \ bhyveargv2xmldata \ bhyvexml2xmloutdata \ @@ -107,7 +106,6 @@ EXTRA_DIST = \ nwfilterxml2firewalldata \ nwfilterxml2xmlin \ nwfilterxml2xmlout \ - oomtrace.pl \ qemuagentdata \ qemuargv2xmldata \ qemublocktestdata \ @@ -285,12 +283,10 @@ test_programs += qemuxml2argvtest qemuxml2xmltest \ qemusecuritytest \ qemufirmwaretest \ $(NULL) -test_helpers += qemucapsprobe test_libraries += libqemumonitortestutils.la \ libqemutestdriver.la \ qemuxml2argvmock.la \ qemucaps2xmlmock.la \ - qemucapsprobemock.la \ qemucpumock.la \ $(NULL) endif WITH_QEMU @@ -442,15 +438,13 @@ EXTRA_DIST += $(test_scripts) if WITH_LINUX check-access: file-access-clean VIR_TEST_FILE_ACCESS=1 $(MAKE) $(AM_MAKEFLAGS) check - $(PERL) check-file-access.pl | sort -u + $(PERL) tools/check-file-access.pl | sort -u file-access-clean: > test_file_access.txt endif WITH_LINUX -EXTRA_DIST += \ - check-file-access.pl \ - file_access_whitelist.txt +include tools/Makefile.inc.am if WITH_TESTS noinst_PROGRAMS = $(test_programs) $(test_helpers) @@ -478,7 +472,7 @@ TESTS_ENVIRONMENT = \ VALGRIND = valgrind --quiet --leak-check=full --trace-children=yes \ --trace-children-skip="*/tools/virsh","*/tests/commandhelper" \ - --suppressions=$(abs_srcdir)/.valgrind.supp + --suppressions=$(abs_srcdir)/tools/.valgrind.supp valgrind: $(MAKE) check VG="$(LIBTOOL) --mode=execute $(VALGRIND)" @@ -603,16 +597,6 @@ qemucapabilitiestest_SOURCES = \ qemucapabilitiestest_LDADD = libqemumonitortestutils.la \ $(qemu_LDADDS) $(LDADDS) -qemucapsprobe_SOURCES = \ - qemucapsprobe.c -qemucapsprobe_LDADD = \ - libqemutestdriver.la $(LDADDS) - -qemucapsprobemock_la_SOURCES = \ - qemucapsprobemock.c -qemucapsprobemock_la_LDFLAGS = $(MOCKLIBS_LDFLAGS) -qemucapsprobemock_la_LIBADD = $(MOCKLIBS_LIBS) - qemucommandutiltest_SOURCES = \ qemucommandutiltest.c \ testutils.c testutils.h \ diff --git a/tests/qemucapabilitiestest.c b/tests/qemucapabilitiestest.c index ac9ab6bfce..48363326f4 100644 --- a/tests/qemucapabilitiestest.c +++ b/tests/qemucapabilitiestest.c @@ -225,11 +225,11 @@ mymain(void) return EXIT_FAILURE; /* - * Run "tests/qemucapsprobe /path/to/qemu/binary >foo.replies" + * Run "tests/tools/qemucapsprobe /path/to/qemu/binary >foo.replies" * to generate updated or new *.replies data files. * * If you manually edit replies files you can run - * "tests/qemucapsfixreplies foo.replies" to fix the replies ids. + * "tests/tools/qemucapsfixreplies foo.replies" to fix the replies ids. * * Once a replies file has been generated and tweaked if necessary, * you can drop it into tests/qemucapabilitiesdata/ (with a sensible diff --git a/tests/testutils.c b/tests/testutils.c index 245b1832f6..080a1ccda2 100644 --- a/tests/testutils.c +++ b/tests/testutils.c @@ -533,7 +533,7 @@ virTestRewrapFile(const char *filename) return -1; } - if (virAsprintf(&script, "%s/test-wrap-argv.pl", abs_srcdir) < 0) + if (virAsprintf(&script, "%s/tools/test-wrap-argv.pl", abs_srcdir) < 0) goto cleanup; cmd = virCommandNewArgList(perl, script, "--in-place", filename, NULL); diff --git a/tests/.valgrind.supp b/tests/tools/.valgrind.supp similarity index 100% rename from tests/.valgrind.supp rename to tests/tools/.valgrind.supp diff --git a/tests/tools/Makefile.inc.am b/tests/tools/Makefile.inc.am new file mode 100644 index 0000000000..ffc38a93f7 --- /dev/null +++ b/tests/tools/Makefile.inc.am @@ -0,0 +1,23 @@ +# vim: filetype=automake + +if WITH_QEMU +test_helpers += tools/qemucapsprobe +test_libraries += tools/qemucapsprobemock.la + +tools_qemucapsprobe_SOURCES = \ + tools/qemucapsprobe.c \ + testutils.h +tools_qemucapsprobe_LDADD = \ + libqemutestdriver.la $(LDADDS) + +tools_qemucapsprobemock_la_SOURCES = \ + tools/qemucapsprobemock.c +tools_qemucapsprobemock_la_LDFLAGS = $(MOCKLIBS_LDFLAGS) +tools_qemucapsprobemock_la_LIBADD = $(MOCKLIBS_LIBS) +endif WITH_QEMU + +EXTRA_DIST += \ + tools/.valgrind.supp \ + tools/check-file-access.pl \ + tools/file_access_whitelist.txt \ + tools/oomtrace.pl diff --git a/tests/check-file-access.pl b/tests/tools/check-file-access.pl similarity index 98% rename from tests/check-file-access.pl rename to tests/tools/check-file-access.pl index ea0b7a18a2..2f1796b0f3 100755 --- a/tests/check-file-access.pl +++ b/tests/tools/check-file-access.pl @@ -25,7 +25,7 @@ use strict; use warnings; my $access_file = "test_file_access.txt"; -my $whitelist_file = "file_access_whitelist.txt"; +my $whitelist_file = "tools/file_access_whitelist.txt"; my @known_actions = ("open", "fopen", "access", "stat", "lstat", "connect"); diff --git a/tests/file_access_whitelist.txt b/tests/tools/file_access_whitelist.txt similarity index 100% rename from tests/file_access_whitelist.txt rename to tests/tools/file_access_whitelist.txt diff --git a/tests/group-qemu-caps.pl b/tests/tools/group-qemu-caps.pl similarity index 100% rename from tests/group-qemu-caps.pl rename to tests/tools/group-qemu-caps.pl diff --git a/tests/oomtrace.pl b/tests/tools/oomtrace.pl similarity index 100% rename from tests/oomtrace.pl rename to tests/tools/oomtrace.pl diff --git a/tests/qemucapsprobe.c b/tests/tools/qemucapsprobe.c similarity index 96% rename from tests/qemucapsprobe.c rename to tests/tools/qemucapsprobe.c index 14c0ecad97..7a5018676c 100644 --- a/tests/qemucapsprobe.c +++ b/tests/tools/qemucapsprobe.c @@ -47,7 +47,7 @@ main(int argc, char **argv) virThread thread; virQEMUCapsPtr caps; - VIR_TEST_PRELOAD(abs_builddir "/.libs/qemucapsprobemock.so"); + VIR_TEST_PRELOAD(abs_builddir "/tools/.libs/qemucapsprobemock.so"); if (argc != 2) { fprintf(stderr, "%s QEMU_binary\n", argv[0]); diff --git a/tests/qemucapsprobemock.c b/tests/tools/qemucapsprobemock.c similarity index 100% rename from tests/qemucapsprobemock.c rename to tests/tools/qemucapsprobemock.c diff --git a/tests/test-wrap-argv.pl b/tests/tools/test-wrap-argv.pl similarity index 98% rename from tests/test-wrap-argv.pl rename to tests/tools/test-wrap-argv.pl index 7867e9d719..4a28ee9d46 100755 --- a/tests/test-wrap-argv.pl +++ b/tests/tools/test-wrap-argv.pl @@ -94,7 +94,7 @@ sub rewrap { close DIFF; print STDERR "Incorrect line wrapping in $file\n"; - print STDERR "Use test-wrap-argv.pl to wrap test data files\n"; + print STDERR "Use tests/tools/test-wrap-argv.pl to wrap test data files\n"; return -1; } } else { -- 2.21.0

1 0

[libvirt] [PATCH] x86: Multi-key Total Memory Encryption (Intel)
by Larkins Carvalho 07 May '19

07 May '19

From: llcarval <larkins.l.carvalho(a)intel.com> Total Memory Encryption (TME) – provides the capability to encrypt the entirety of the physical memory of a system. MKTME builds on TME and adds support for multiple encryption keys. High Level flow: 1. Management tool calls virNodeGetMKTMEInfo. This returns an XML document that includes the following <feature> ... <mktme supported='yes'> <keys_supported> </keys_supported> </mktme> </feature> 2. Management tool requests to start a guest calling virCreateXML(). The xml would include <launchsecurity type='mktme'> <id>m0</id> <key_type>user</key_type> <key>samplekey</key> <encryption_algorithm>aes-xts-128</encryption_algorithm> </launchSecurity> 3. Libvirt makes system call with the provided information to generate a key handle using linux keyring services. Qemu uses the key handle to launch the workload. 4. Libvirt generate the QEMU cli arg to enable the MKTME feature, a typical args looks like this: -machine memory-encryption=m0 \ -object mktme-guest,id=m0,handle=${serial} Intel MKTME spec: https://software.intel.com/sites/default/files/managed/a5/16/Multi-Key-Tota… WIP: Qemu and KVM patch to support Intel MKTME are in the process of development and community approval. The purpose of this initial review is to get on par with libvirt development and the proposed Intel MKTME feature in libvirt. Considering we have not added tests, this is a preliminary patch and based on the community feedback, we expect more updates to follow. TODO: Add tests for launch security of type mktme. Update domaincommon.rng to add attribute of type mktme. --- docs/formatdomain.html.in | 62 +- docs/formatdomaincaps.html.in | 18 + docs/schemas/domaincaps.rng | 14 + include/libvirt/libvirt-host.h | 18 + src/conf/domain_capabilities.c | 29 + src/conf/domain_capabilities.h | 12 + src/conf/domain_conf.c | 114 +- src/conf/domain_conf.h | 13 + src/conf/virconftypes.h | 3 + src/driver-hypervisor.h | 7 + src/libvirt-host.c | 48 + src/libvirt_private.syms | 5 + src/libvirt_public.syms | 5 + src/qemu/qemu_capabilities.c | 130 +- src/qemu/qemu_capabilities.h | 4 + src/qemu/qemu_capspriv.h | 4 + src/qemu/qemu_command.c | 40 + src/qemu/qemu_driver.c | 63 + src/qemu/qemu_monitor.c | 9 + src/qemu/qemu_monitor.h | 5 + src/qemu/qemu_monitor_json.c | 52 + src/qemu/qemu_monitor_json.h | 3 + src/remote/remote_daemon_dispatch.c | 43 + src/remote/remote_driver.c | 40 +- src/remote/remote_protocol.x | 21 +- src/remote_protocol-structs | 12 + src/util/Makefile.inc.am | 2 + src/util/virmktme.c | 112 ++ src/util/virmktme.h | 33 + .../bhyve_basic.x86_64.xml | 1 + .../bhyve_fbuf.x86_64.xml | 1 + .../bhyve_uefi.x86_64.xml | 1 + tests/domaincapsschemadata/empty.xml | 1 + tests/domaincapsschemadata/libxl-xenfv.xml | 1 + tests/domaincapsschemadata/libxl-xenpv.xml | 1 + .../qemu_1.7.0.x86_64.xml | 1 + .../qemu_2.12.0-virt.aarch64.xml | 1 + .../qemu_2.12.0.ppc64.xml | 1 + .../qemu_2.12.0.s390x.xml | 1 + .../qemu_2.12.0.x86_64.xml | 1 + .../qemu_2.6.0-virt.aarch64.xml | 1 + .../qemu_2.6.0.aarch64.xml | 1 + .../domaincapsschemadata/qemu_2.6.0.ppc64.xml | 1 + .../qemu_2.6.0.x86_64.xml | 1 + .../domaincapsschemadata/qemu_2.7.0.s390x.xml | 1 + .../qemu_2.8.0-tcg.x86_64.xml | 1 + .../domaincapsschemadata/qemu_2.8.0.s390x.xml | 1 + .../qemu_2.8.0.x86_64.xml | 1 + .../qemu_2.9.0-q35.x86_64.xml | 1 + .../qemu_2.9.0-tcg.x86_64.xml | 1 + .../qemu_2.9.0.x86_64.xml | 1 + .../domaincapsschemadata/qemu_3.0.0.s390x.xml | 1 + .../qemu_3.1.0.x86_64.xml | 1 + .../qemu_4.0.0.x86_64.xml | 1 + .../qemu_5.0.0.x86_64.xml | 164 ++ tests/domaincapstest.c | 4 + .../caps_5.0.0.x86_64.xml | 1389 +++++++++++++++++ 57 files changed, 2490 insertions(+), 13 deletions(-) create mode 100644 src/util/virmktme.c create mode 100644 src/util/virmktme.h create mode 100644 tests/domaincapsschemadata/qemu_5.0.0.x86_64.xml create mode 100644 tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index e1da878fcc..e96186aba9 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -8924,13 +8924,16 @@ qemu-kvm -net nic,model=? /dev/null <p>Note: DEA/TDEA is synonymous with DES/TDES.</p> - <h3><a id="sev">Launch Security</a></h3> + <h3><a id="launchsecurity">Launch Security</a></h3> <p> - The contents of the <code><launchSecurity type='sev'></code> element + The contents of the <code>launchSecurity</code> element is used to provide the guest owners input used for creating an encrypted - VM using the AMD SEV feature (Secure Encrypted Virtualization). - + VM using the AMD SEV feature (Secure Encrypted Virtualization) + and Intel MKTME (Multi-Key Total Memory Encryption). + </p> + <h4><a id="sev">SEV</a></h4> + <p> SEV is an extension to the AMD-V architecture which supports running encrypted virtual machine (VMs) under the control of KVM. Encrypted VMs have their pages (code and data) secured such that only the guest @@ -8942,7 +8945,7 @@ qemu-kvm -net nic,model=? /dev/null For more information see various input parameters and its format see the <a href="https://support.amd.com/TechDocs/55766_SEV-KM_API_Specification.pdf">SEV API spec</a> <span class="since">Since 4.4.0</span> - </p> + </p> <pre> <domain> ... @@ -9039,6 +9042,55 @@ qemu-kvm -net nic,model=? /dev/null </dd> </dl> + <h4><a id="mktme">MKTME</a></h4> + <p> + Total Memory Encryption (TME) – provides the capability to encrypt the + entirety of the physical memory of a system. MKTME builds on TME and + adds support for multiple encryption keys. + + By default MKTME uses the TME encryption key unless explicitly specified + by software. In addition to supporting a CPU generated ephemeral + key (not accessible by software or by using external interfaces to an SOC), + MKTME also supports software provided keys. Software provided keys are + particularly useful when used with nonvolatile memory or when combined + with attestation mechanisms and/or used with key provisioning services. + + For more information see + <a href="https://support.amd.com/TechDocs/55766_SEV-KM_API_Specification.pdf">MKTME spec</a> + <span class="since">Since 5.3.0</span> + </p> + <pre> +<domain> + ... + <launchSecurity type='mktme'> + <id>mktme-0</id> + <key_type>samplekey</key_type> + <type>user</type> + <encryption_algorithm>aes-xts-128</encryption_algorithm> + </launchSecurity> + ... +</domain> +</pre> + <dl> + <dt><code>id</code></dt> + <dd>The required <code>id</code> element provides ability to map the key handle. + If the id exists system returns the same mapped key handle which can be used to + encrpyt a different guest. + </dd> + <dt><code>key_type</code></dt> + <dd>MKTME supports user and cpu generated keys. The required <code>key_type</code> + element provides the type of key used for the encryption. + </dd> + <dt><code>key</code></dt> + <dd>The optional <code>key</code> element provides the key used for the encryption. + Required only when the key type is of user. + </dd> + <dt><code>encryption_algorithm</code></dt> + <dd>The required <code>encyption_algorithm</code> element provides the type of + encryption algorithm. Currently, MKTME supports aes-xts-128 only. + </dd> + </dl> + <h2><a id="examples">Example configs</a></h2> <p> diff --git a/docs/formatdomaincaps.html.in b/docs/formatdomaincaps.html.in index b31b1729f4..ece891fa67 100644 --- a/docs/formatdomaincaps.html.in +++ b/docs/formatdomaincaps.html.in @@ -530,5 +530,23 @@ address space. The number of bits we lose is hypervisor dependent.</dd> </dl> + <h4><a id="elementsMKTME">MKTME capabilities</a></h4> + + <p>Intel Multi-Key Total Memory Encryption (MKTME) capabilities are exposed under + the <code>mktme</code> element. + Total Memory Encryption (TME) – provides the capability to encrypt the + entirety of the physical memory of a system. MKTME builds on TME and + adds support for multiple encryption keys.</p> + + <p> + For more details on MKTME feature see: + <a href="https://software.intel.com/sites/default/files/managed/a5/16/Multi-Key-Tota…">MKTME spec</a> + </p> + + <dl> + <dt><code>keys_supported</code></dt> + <dd>When mktme is enabled, keys_supported information is avaiable</dd> + </dl> + </body> </html> diff --git a/docs/schemas/domaincaps.rng b/docs/schemas/domaincaps.rng index e629d6431f..a399e4348f 100644 --- a/docs/schemas/domaincaps.rng +++ b/docs/schemas/domaincaps.rng @@ -200,6 +200,9 @@ <optional> <ref name='sev'/> </optional> + <optional> + <ref name='mktme'/> + </optional> </element> </define> @@ -236,6 +239,17 @@ </element> </define> + <define name='mktme'> + <element name='mktme'> + <ref name='supported'/> + <optional> + <element name='keys_supported'> + <data type='unsignedInt'/> + </element> + </optional> + </element> + </define> + <define name='value'> <zeroOrMore> <element name='value'> diff --git a/include/libvirt/libvirt-host.h b/include/libvirt/libvirt-host.h index 7debb5f829..10d2e4d2f3 100644 --- a/include/libvirt/libvirt-host.h +++ b/include/libvirt/libvirt-host.h @@ -473,6 +473,24 @@ int virNodeGetSEVInfo (virConnectPtr conn, int *nparams, unsigned int flags); +/** +* +* MKTME Parameters +*/ + +/** +* VIR_NODE_MKTME_KEYS_SUPPORTED: +* +* Macro represents the number of keys supported, when MKTME is enabled in the guest. +*/ +# define VIR_NODE_MKTME_KEYS_SUPPORTED "keys_supported" + +int virNodeGetMKTMEInfo(virConnectPtr conn, + virTypedParameterPtr *params, + int *nparams, + unsigned int flags); + + /** * virConnectFlags * diff --git a/src/conf/domain_capabilities.c b/src/conf/domain_capabilities.c index 2e7e1c206b..1115fc26fc 100644 --- a/src/conf/domain_capabilities.c +++ b/src/conf/domain_capabilities.c @@ -78,6 +78,15 @@ virSEVCapabilitiesFree(virSEVCapability *cap) VIR_FREE(cap); } +void +virMKTMECapabilitiesFree(virMKTMECapability *cap) +{ + if (!cap) + return; + + VIR_FREE(cap); +} + static void virDomainCapsDispose(void *obj) @@ -89,6 +98,7 @@ virDomainCapsDispose(void *obj) virObjectUnref(caps->cpu.custom); virCPUDefFree(caps->cpu.hostModel); virSEVCapabilitiesFree(caps->sev); + virMKTMECapabilitiesFree(caps->mktme); virDomainCapsStringValuesFree(&caps->os.loader.values); } @@ -593,6 +603,24 @@ virDomainCapsFeatureSEVFormat(virBufferPtr buf, return; } +static void +virDomainCapsFeatureMKTMEFormat(virBufferPtr buf, + virMKTMECapabilityPtr const mktme) +{ + if (!mktme) { + virBufferAddLit(buf, "<mktme supported='no'/>\n"); + } + else { + virBufferAddLit(buf, "<mktme supported='yes'>\n"); + virBufferAdjustIndent(buf, 2); + virBufferAsprintf(buf, "<keys_supported>%d</keys_supported>\n", mktme->keys_supported); + virBufferAdjustIndent(buf, -2); + virBufferAddLit(buf, "</mktme>\n"); + } + + return; +} + char * virDomainCapsFormat(virDomainCapsPtr const caps) @@ -636,6 +664,7 @@ virDomainCapsFormat(virDomainCapsPtr const caps) FORMAT_SINGLE("vmcoreinfo", caps->vmcoreinfo); FORMAT_SINGLE("genid", caps->genid); virDomainCapsFeatureSEVFormat(&buf, caps->sev); + virDomainCapsFeatureMKTMEFormat(&buf, caps->mktme); virBufferAdjustIndent(&buf, -2); virBufferAddLit(&buf, "</features>\n"); diff --git a/src/conf/domain_capabilities.h b/src/conf/domain_capabilities.h index cd09d50cee..56a73546c0 100644 --- a/src/conf/domain_capabilities.h +++ b/src/conf/domain_capabilities.h @@ -150,6 +150,12 @@ struct _virSEVCapability { unsigned int reduced_phys_bits; }; +typedef struct _virMKTMECapability virMKTMECapability; +typedef virMKTMECapability *virMKTMECapabilityPtr; +struct _virMKTMECapability { + unsigned int keys_supported; +}; + struct _virDomainCaps { virObjectLockable parent; @@ -174,6 +180,7 @@ struct _virDomainCaps { virTristateBool vmcoreinfo; virTristateBool genid; virSEVCapabilityPtr sev; + virMKTMECapabilityPtr mktme; /* add new domain features here */ }; @@ -222,4 +229,9 @@ virSEVCapabilitiesFree(virSEVCapability *capabilities); VIR_DEFINE_AUTOPTR_FUNC(virSEVCapability, virSEVCapabilitiesFree); +void +virMKTMECapabilitiesFree(virMKTMECapability *capabilities); + +VIR_DEFINE_AUTOPTR_FUNC(virMKTMECapability, virMKTMECapabilitiesFree); + #endif /* LIBVIRT_DOMAIN_CAPABILITIES_H */ diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index b4fb6cf981..e563840479 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -1233,6 +1233,7 @@ VIR_ENUM_IMPL(virDomainLaunchSecurity, VIR_DOMAIN_LAUNCH_SECURITY_LAST, "", "sev", + "mktme", ); static virClassPtr virDomainObjClass; @@ -3281,6 +3282,22 @@ virDomainSEVDefFree(virDomainSEVDefPtr def) VIR_FREE(def); } +static void +virDomainMKTMEDefFree(virDomainMKTMEDefPtr def) +{ + if (!def) + return; + + VIR_FREE(def->id); + VIR_FREE(def->key_type); + VIR_FREE(def->key); + VIR_FREE(def->encryption_algorithm); + + + VIR_FREE(def); +} + + void virDomainDefFree(virDomainDefPtr def) { @@ -3466,6 +3483,7 @@ void virDomainDefFree(virDomainDefPtr def) (def->ns.free)(def->namespaceData); virDomainSEVDefFree(def->sev); + virDomainMKTMEDefFree(def->mktme); xmlFreeNode(def->metadata); @@ -15939,6 +15957,21 @@ virDomainMemoryTargetDefParseXML(xmlNodePtr node, return ret; } +static int +virDomainGetLaunchSecurityType(xmlNodePtr node) +{ + VIR_AUTOFREE(char *) type = NULL; + + if (!(type = virXMLPropString(node, "type"))) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("missing launch security type")); + return -1; + } + + return virDomainLaunchSecurityTypeFromString(type); + +} + static virDomainSEVDefPtr virDomainSEVDefParseXML(xmlNodePtr sevNode, @@ -15965,6 +15998,7 @@ virDomainSEVDefParseXML(xmlNodePtr sevNode, case VIR_DOMAIN_LAUNCH_SECURITY_SEV: break; case VIR_DOMAIN_LAUNCH_SECURITY_NONE: + case VIR_DOMAIN_LAUNCH_SECURITY_MKTME: case VIR_DOMAIN_LAUNCH_SECURITY_LAST: default: virReportError(VIR_ERR_XML_ERROR, @@ -16005,6 +16039,28 @@ virDomainSEVDefParseXML(xmlNodePtr sevNode, goto cleanup; } +static virDomainMKTMEDefPtr +virDomainMKTMEDefParseXML(xmlNodePtr mktmeNode, + xmlXPathContextPtr ctxt) +{ + VIR_XPATH_NODE_AUTORESTORE(ctxt); + virDomainMKTMEDefPtr def; + + if (VIR_ALLOC(def) < 0) + return NULL; + + ctxt->node = mktmeNode; + + def->sectype = VIR_DOMAIN_LAUNCH_SECURITY_MKTME; + + def->id = virXPathString("string(./id)", ctxt); + def->key_type = virXPathString("string(./key_type)", ctxt); + def->key = virXPathString("string(./key)", ctxt); + def->encryption_algorithm = virXPathString("string(./encryption_algorithm)", ctxt); + + return def; +} + static virDomainMemoryDefPtr virDomainMemoryDefParseXML(virDomainXMLOptionPtr xmlopt, xmlNodePtr memdevNode, @@ -21127,11 +21183,33 @@ virDomainDefParseXML(xmlDocPtr xml, ctxt->node = node; VIR_FREE(nodes); - /* Check for SEV feature */ + /* Check for launch security (MKTME/SEV) feature */ if ((node = virXPathNode("./launchSecurity", ctxt)) != NULL) { - def->sev = virDomainSEVDefParseXML(node, ctxt); - if (!def->sev) - goto error; + int sectype = virDomainGetLaunchSecurityType(node); + + if (sectype < 0) + goto error; + + switch ((virDomainLaunchSecurity) sectype) { + case VIR_DOMAIN_LAUNCH_SECURITY_SEV: + def->sev = virDomainSEVDefParseXML(node, ctxt); + if (!def->sev) + goto error; + break; + case VIR_DOMAIN_LAUNCH_SECURITY_MKTME: + def->mktme = virDomainMKTMEDefParseXML(node, ctxt); + if (!def->mktme) + goto error; + break; + case VIR_DOMAIN_LAUNCH_SECURITY_NONE: + case VIR_DOMAIN_LAUNCH_SECURITY_LAST: + default: + virReportError(VIR_ERR_XML_ERROR, + _("unsupported launch security type '%s'"), + virXMLPropString(node, "type")); + goto error; + } + } /* analysis of memory devices */ @@ -27263,6 +27341,33 @@ virDomainSEVDefFormat(virBufferPtr buf, virDomainSEVDefPtr sev) virBufferAddLit(buf, "</launchSecurity>\n"); } +static void +virDomainMKTMEDefFormat(virBufferPtr buf, virDomainMKTMEDefPtr mktme) +{ + if (!mktme) + return; + + virBufferAsprintf(buf, "<launchSecurity type='%s'>\n", + virDomainLaunchSecurityTypeToString(mktme->sectype)); + virBufferAdjustIndent(buf, 2); + + if (mktme->id) + virBufferEscapeString(buf, "<id>%s</id>\n", mktme->id); + + if (mktme->key_type) + virBufferEscapeString(buf, "<key_type>%s</key_type>\n", mktme->key_type); + + if (mktme->key) + virBufferEscapeString(buf, "<key>%s</key>\n", mktme->key); + + if (mktme->encryption_algorithm) + virBufferEscapeString(buf, "<encryption_algorithm>%s</encryption_algorithm>\n", mktme->encryption_algorithm); + + + virBufferAdjustIndent(buf, -2); + virBufferAddLit(buf, "</launchSecurity>\n"); +} + static void virDomainPerfDefFormat(virBufferPtr buf, virDomainPerfDefPtr perf) @@ -28636,6 +28741,7 @@ virDomainDefFormatInternal(virDomainDefPtr def, virDomainKeyWrapDefFormat(buf, def->keywrap); virDomainSEVDefFormat(buf, def->sev); + virDomainMKTMEDefFormat(buf, def->mktme); virBufferAdjustIndent(buf, -2); virBufferAddLit(buf, "</domain>\n"); diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 01c22d8cc3..5d08759de9 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -2279,6 +2279,7 @@ struct _virDomainKeyWrapDef { typedef enum { VIR_DOMAIN_LAUNCH_SECURITY_NONE, VIR_DOMAIN_LAUNCH_SECURITY_SEV, + VIR_DOMAIN_LAUNCH_SECURITY_MKTME, VIR_DOMAIN_LAUNCH_SECURITY_LAST, } virDomainLaunchSecurity; @@ -2332,6 +2333,15 @@ struct _virDomainVirtioOptions { virTristateSwitch ats; }; +struct _virDomainMKTMEDef { + int sectype; /* enum virDomainLaunchSecurity */ + char *id; + char *key_type; + char *key; + char *encryption_algorithm; + int key_handle; +}; + /* * Guest VM main configuration * @@ -2491,6 +2501,9 @@ struct _virDomainDef { /* SEV-specific domain */ virDomainSEVDefPtr sev; + /* MKTME- domain info*/ + virDomainMKTMEDefPtr mktme; + /* Application-specific custom metadata */ xmlNodePtr metadata; diff --git a/src/conf/virconftypes.h b/src/conf/virconftypes.h index 6a8267c422..a71ee462a0 100644 --- a/src/conf/virconftypes.h +++ b/src/conf/virconftypes.h @@ -346,4 +346,7 @@ typedef virDomainXMLPrivateDataCallbacks *virDomainXMLPrivateDataCallbacksPtr; typedef struct _virDomainXenbusControllerOpts virDomainXenbusControllerOpts; typedef virDomainXenbusControllerOpts *virDomainXenbusControllerOptsPtr; +typedef struct _virDomainMKTMEDef virDomainMKTMEDef; +typedef virDomainMKTMEDef *virDomainMKTMEDefPtr; + #endif /* LIBVIRT_VIRCONFTYPES_H */ diff --git a/src/driver-hypervisor.h b/src/driver-hypervisor.h index 5315e33dde..1d26381cb4 100644 --- a/src/driver-hypervisor.h +++ b/src/driver-hypervisor.h @@ -1322,6 +1322,12 @@ typedef int int *nparams, unsigned int flags); +typedef int +(*virDrvNodeGetMKTMEInfo)(virConnectPtr conn, + virTypedParameterPtr *params, + int *nparams, + unsigned int flags); + typedef int (*virDrvDomainGetLaunchSecurityInfo)(virDomainPtr domain, virTypedParameterPtr *params, @@ -1579,6 +1585,7 @@ struct _virHypervisorDriver { virDrvConnectCompareHypervisorCPU connectCompareHypervisorCPU; virDrvConnectBaselineHypervisorCPU connectBaselineHypervisorCPU; virDrvNodeGetSEVInfo nodeGetSEVInfo; + virDrvNodeGetMKTMEInfo nodeGetMKTMEInfo; virDrvDomainGetLaunchSecurityInfo domainGetLaunchSecurityInfo; }; diff --git a/src/libvirt-host.c b/src/libvirt-host.c index e20d6ee250..6696fb9998 100644 --- a/src/libvirt-host.c +++ b/src/libvirt-host.c @@ -1688,3 +1688,51 @@ virNodeGetSEVInfo(virConnectPtr conn, virDispatchError(conn); return -1; } + +/* + * virNodeGetMKTMEInfo: + * @conn: pointer to the hypervisor connection + * @params: where to store mktme information + * @nparams: pointer to number of MKTME parameters returned in @params + * @flags: extra flags; not used yet, so callers should always pass 0 + * + * If hypervisor supports Intel's MKTME feature, then @params will contain various + * platform specific information like number of keys supported. Caller is + * responsible for freeing @params. + * + * Returns 0 in case of success, and -1 in case of failure. + */ +int +virNodeGetMKTMEInfo(virConnectPtr conn, + virTypedParameterPtr *params, + int *nparams, + unsigned int flags) +{ + VIR_DEBUG("conn=%p, params=%p, nparams=%p, flags=0x%x", + conn, params, nparams, flags); + + virResetLastError(); + + virCheckConnectReturn(conn, -1); + virCheckNonNullArgGoto(nparams, error); + virCheckNonNegativeArgGoto(*nparams, error); + virCheckReadOnlyGoto(conn->flags, error); + + if (VIR_DRV_SUPPORTS_FEATURE(conn->driver, conn, + VIR_DRV_FEATURE_TYPED_PARAM_STRING)) + flags |= VIR_TYPED_PARAM_STRING_OKAY; + + if (conn->driver->nodeGetMKTMEInfo) { + int ret; + ret = conn->driver->nodeGetMKTMEInfo(conn, params, nparams, flags); + if (ret < 0) + goto error; + return ret; + } + + virReportUnsupportedError(); + +error: + virDispatchError(conn); + return -1; +} diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index a03cf0b645..afa6925715 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -189,6 +189,7 @@ virDomainCapsEnumClear; virDomainCapsEnumSet; virDomainCapsFormat; virDomainCapsNew; +virMKTMECapabilitiesFree; virSEVCapabilitiesFree; @@ -2352,6 +2353,9 @@ virMediatedDeviceSetUsedBy; virMediatedDeviceTypeFree; virMediatedDeviceTypeReadAttrs; +# util/virmktme.h +virGetMktmeKeyHandle; +virMktmeIsEnabled; # util/virmodule.h virModuleLoad; @@ -3315,6 +3319,7 @@ virXPathULongHex; virXPathULongLong; + # Let emacs know we want case-insensitive sorting # Local Variables: # sort-fold-case: t diff --git a/src/libvirt_public.syms b/src/libvirt_public.syms index dbce3336d5..d106f36db2 100644 --- a/src/libvirt_public.syms +++ b/src/libvirt_public.syms @@ -819,4 +819,9 @@ LIBVIRT_5.2.0 { virConnectGetStoragePoolCapabilities; } LIBVIRT_4.10.0; +LIBVIRT_5.3.0 { + global: + virNodeGetMKTMEInfo; +} LIBVIRT_5.2.0; + # .... define new API here using predicted next version number .... diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index a0b2ca73fb..c127d61a1d 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -525,6 +525,7 @@ VIR_ENUM_IMPL(virQEMUCaps, "virtio-pci-non-transitional", "overcommit", "query-current-machine", + "mktme-guest" ); @@ -595,6 +596,8 @@ struct _virQEMUCaps { virSEVCapability *sevCapabilities; + virMKTMECapability *mktmeCapabilities; + virQEMUCapsHostCPUData kvmCPU; virQEMUCapsHostCPUData tcgCPU; }; @@ -1090,6 +1093,7 @@ struct virQEMUCapsStringFlags virQEMUCapsObjectTypes[] = { { "vhost-vsock-device", QEMU_CAPS_DEVICE_VHOST_VSOCK }, { "mch", QEMU_CAPS_DEVICE_MCH }, { "sev-guest", QEMU_CAPS_SEV_GUEST }, + { "mktme-guest", QEMU_CAPS_MKTME_GUEST }, { "vfio-ap", QEMU_CAPS_DEVICE_VFIO_AP }, { "zpci", QEMU_CAPS_DEVICE_ZPCI }, { "memory-backend-memfd", QEMU_CAPS_OBJECT_MEMORY_MEMFD }, @@ -1541,6 +1545,22 @@ virQEMUCapsSEVInfoCopy(virSEVCapabilityPtr *dst, return 0; } +static int +virQEMUCapsMKTMEInfoCopy(virMKTMECapabilityPtr *dst, + virMKTMECapabilityPtr src) +{ + VIR_AUTOPTR(virMKTMECapability) tmp = NULL; + + if (VIR_ALLOC(tmp) < 0 ) + return -1; + + tmp->keys_supported = src->keys_supported; + + VIR_STEAL_PTR(*dst, tmp); + return 0; +} + + virQEMUCapsPtr virQEMUCapsNewCopy(virQEMUCapsPtr qemuCaps) { @@ -1612,6 +1632,12 @@ virQEMUCapsPtr virQEMUCapsNewCopy(virQEMUCapsPtr qemuCaps) qemuCaps->sevCapabilities) < 0) goto error; + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_MKTME_GUEST) && + virQEMUCapsMKTMEInfoCopy(&ret->mktmeCapabilities, + qemuCaps->mktmeCapabilities) < 0) + goto error; + + return ret; error: @@ -1643,6 +1669,7 @@ void virQEMUCapsDispose(void *obj) VIR_FREE(qemuCaps->gicCapabilities); virSEVCapabilitiesFree(qemuCaps->sevCapabilities); + virMKTMECapabilitiesFree(qemuCaps->mktmeCapabilities); virQEMUCapsHostCPUDataClear(&qemuCaps->kvmCPU); virQEMUCapsHostCPUDataClear(&qemuCaps->tcgCPU); @@ -2099,6 +2126,12 @@ virQEMUCapsGetSEVCapabilities(virQEMUCapsPtr qemuCaps) return qemuCaps->sevCapabilities; } +virMKTMECapabilityPtr +virQEMUCapsGetMKTMECapabilities(virQEMUCapsPtr qemuCaps) +{ + return qemuCaps->mktmeCapabilities; +} + static int virQEMUCapsProbeQMPCommands(virQEMUCapsPtr qemuCaps, @@ -2768,6 +2801,30 @@ virQEMUCapsProbeQMPSEVCapabilities(virQEMUCapsPtr qemuCaps, return 0; } +/* Returns -1 on error, 0 if MKTME is not supported, 1 if MKTME is supported */ +static int +virQEMUCapsProbeQMPMKTMECapabilities(virQEMUCapsPtr qemuCaps, + qemuMonitorPtr mon) +{ + int rc = -1; + virMKTMECapability *caps = NULL; + + if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_MKTME_GUEST)) + return 0; + if ((rc = qemuMonitorGetMKTMECapabilities(mon, &caps)) < 0) + return -1; + + /* MKTME isn't actually supported */ + if (rc == 0) { + virQEMUCapsClear(qemuCaps, QEMU_CAPS_MKTME_GUEST); + return 0; + } + + virMKTMECapabilitiesFree(qemuCaps->mktmeCapabilities); + qemuCaps->mktmeCapabilities = caps; + return 0; +} + bool virQEMUCapsCPUFilterFeatures(const char *name, @@ -3397,6 +3454,35 @@ virQEMUCapsParseSEVInfo(virQEMUCapsPtr qemuCaps, xmlXPathContextPtr ctxt) return 0; } +static int +virQEMUCapsParseMKTMEInfo(virQEMUCapsPtr qemuCaps, xmlXPathContextPtr ctxt) +{ + VIR_AUTOPTR(virMKTMECapability) mktme = NULL; + + if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_MKTME_GUEST)) + return 0; + + if (virXPathBoolean("boolean(./mktme)", ctxt) == 0) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("missing MKTME platform data in QEMU " + "capabilities cache")); + return -1; + } + + if (VIR_ALLOC(mktme) < 0) + return -1; + + if (virXPathUInt("string(./mktme/keys_supported)", ctxt, &mktme->keys_supported) < 0) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("missing or malformed MKTME keys_supported information " + "in QEMU capabilities cache")); + return -1; + } + + VIR_STEAL_PTR(qemuCaps->mktmeCapabilities, mktme); + return 0; +} + /* * Parsing a doc that looks like @@ -3650,6 +3736,10 @@ virQEMUCapsLoadCache(virArch hostArch, if (virQEMUCapsParseSEVInfo(qemuCaps, ctxt) < 0) goto cleanup; + if (virQEMUCapsParseMKTMEInfo(qemuCaps, ctxt) < 0) + goto cleanup; + + virQEMUCapsInitHostCPUModel(qemuCaps, hostArch, VIR_DOMAIN_VIRT_KVM); virQEMUCapsInitHostCPUModel(qemuCaps, hostArch, VIR_DOMAIN_VIRT_QEMU); @@ -3786,6 +3876,17 @@ virQEMUCapsFormatSEVInfo(virQEMUCapsPtr qemuCaps, virBufferPtr buf) virBufferAddLit(buf, "</sev>\n"); } +static void +virQEMUCapsFormatMKTMEInfo(virQEMUCapsPtr qemuCaps, virBufferPtr buf) +{ + virMKTMECapabilityPtr mktme = virQEMUCapsGetMKTMECapabilities(qemuCaps); + + virBufferAddLit(buf, "<mktme>\n"); + virBufferAdjustIndent(buf, 2); + virBufferAsprintf(buf, "<keys_supported>%u</keys_supported>\n", mktme->keys_supported); + virBufferAdjustIndent(buf, -2); + virBufferAddLit(buf, "</mktme>\n"); +} char * virQEMUCapsFormatCache(virQEMUCapsPtr qemuCaps) @@ -3806,7 +3907,7 @@ virQEMUCapsFormatCache(virQEMUCapsPtr qemuCaps) for (i = 0; i < QEMU_CAPS_LAST; i++) { if (virQEMUCapsGet(qemuCaps, i)) { - virBufferAsprintf(&buf, "<flag name='%s'/>\n", + virBufferAsprintf(&buf, "<flag name='%s'/>\n", virQEMUCapsTypeToString(i)); } } @@ -3871,6 +3972,9 @@ virQEMUCapsFormatCache(virQEMUCapsPtr qemuCaps) if (qemuCaps->sevCapabilities) virQEMUCapsFormatSEVInfo(qemuCaps, &buf); + if (qemuCaps->mktmeCapabilities) + virQEMUCapsFormatMKTMEInfo(qemuCaps, &buf); + if (qemuCaps->kvmSupportsNesting) virBufferAddLit(&buf, "<kvmSupportsNesting/>\n"); @@ -4373,6 +4477,8 @@ virQEMUCapsInitQMPMonitor(virQEMUCapsPtr qemuCaps, return -1; if (virQEMUCapsProbeQMPSEVCapabilities(qemuCaps, mon) < 0) return -1; + if (virQEMUCapsProbeQMPMKTMECapabilities(qemuCaps, mon) < 0) + return -1; virQEMUCapsInitProcessCaps(qemuCaps); @@ -5325,6 +5431,25 @@ virQEMUCapsFillDomainFeatureSEVCaps(virQEMUCapsPtr qemuCaps, return 0; } +static int +virQEMUCapsFillDomainFeatureMKTMECaps(virQEMUCapsPtr qemuCaps, + virDomainCapsPtr domCaps) +{ + virMKTMECapability *cap = qemuCaps->mktmeCapabilities; + VIR_AUTOPTR(virMKTMECapability) mktme = NULL; + + if (!cap) + return 0; + + if (VIR_ALLOC(mktme) < 0) + return -1; + + mktme->keys_supported = cap->keys_supported; + VIR_STEAL_PTR(domCaps->mktme, mktme); + + return 0; +} + int virQEMUCapsFillDomainCaps(virCapsPtr caps, @@ -5370,7 +5495,8 @@ virQEMUCapsFillDomainCaps(virCapsPtr caps, virQEMUCapsFillDomainDeviceVideoCaps(qemuCaps, video) < 0 || virQEMUCapsFillDomainDeviceHostdevCaps(qemuCaps, hostdev) < 0 || virQEMUCapsFillDomainFeatureGICCaps(qemuCaps, domCaps) < 0 || - virQEMUCapsFillDomainFeatureSEVCaps(qemuCaps, domCaps) < 0) + virQEMUCapsFillDomainFeatureSEVCaps(qemuCaps, domCaps) < 0 || + virQEMUCapsFillDomainFeatureMKTMECaps(qemuCaps, domCaps) < 0) return -1; return 0; diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 67c8e80462..5614479617 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -507,6 +507,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */ QEMU_CAPS_VIRTIO_PCI_TRANSITIONAL, /* virtio *-pci-{non-}transitional devices */ QEMU_CAPS_OVERCOMMIT, /* -overcommit */ QEMU_CAPS_QUERY_CURRENT_MACHINE, /* query-current-machine command */ + QEMU_CAPS_MKTME_GUEST, /* -object mktme-guest,... */ QEMU_CAPS_LAST /* this must always be the last item */ } virQEMUCapsFlags; @@ -644,6 +645,9 @@ bool virQEMUCapsCPUFilterFeatures(const char *name, virSEVCapabilityPtr virQEMUCapsGetSEVCapabilities(virQEMUCapsPtr qemuCaps); +virMKTMECapabilityPtr +virQEMUCapsGetMKTMECapabilities(virQEMUCapsPtr qemuCaps); + virArch virQEMUCapsArchFromString(const char *arch); const char *virQEMUCapsArchToString(virArch arch); diff --git a/src/qemu/qemu_capspriv.h b/src/qemu/qemu_capspriv.h index 2d059bee8c..2c44c7a38c 100644 --- a/src/qemu/qemu_capspriv.h +++ b/src/qemu/qemu_capspriv.h @@ -95,6 +95,10 @@ void virQEMUCapsSetSEVCapabilities(virQEMUCapsPtr qemuCaps, virSEVCapability *capabilities); +void +virQEMUCapsSetMKTMECapabilities(virQEMUCapsPtr qemuCaps, + virMKTMECapability *capabilities); + int virQEMUCapsProbeQMPCPUDefinitions(virQEMUCapsPtr qemuCaps, qemuMonitorPtr mon, diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 50b4205267..ad193a5b4c 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -59,6 +59,7 @@ #include "virgic.h" #include "virmdev.h" #include "virdomainsnapshotobjlist.h" +#include "virmktme.h" #if defined(__linux__) # include <linux/capability.h> #endif @@ -7765,6 +7766,10 @@ qemuBuildMachineCommandLine(virCommandPtr cmd, if (def->sev) virBufferAddLit(&buf, ",memory-encryption=sev0"); + if (def->mktme) + virBufferAddLit(&buf, ",memory-encryption=m0"); + + virCommandAddArgBuffer(cmd, &buf); ret = 0; @@ -10266,6 +10271,37 @@ qemuBuildSEVCommandLine(virDomainObjPtr vm, virCommandPtr cmd, return ret; } +static int +qemuBuildMKTMECommandLine(virCommandPtr cmd, + virDomainMKTMEDefPtr mktme) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + int ret = -1; + + if (!mktme) + return 0; + + if ((mktme->key_handle = virGetMktmeKeyHandle(mktme->id, mktme->key_type, + mktme->key, mktme->encryption_algorithm)) < 0) + { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Failed to get MKTME key handle id %s"), mktme->id); + return -1; + + } + VIR_DEBUG("id=%s key_type=%s key_handle=0x%x", + mktme->id, mktme->key_type, mktme->key_handle); + + virBufferAsprintf(&buf, "mktme-guest,id=m0,handle=%d", mktme->key_handle); + + virCommandAddArg(cmd, "-object"); + virCommandAddArgBuffer(cmd, &buf); + ret = 0; + virBufferFreeAndReset(&buf); + return ret; +} + + static int qemuBuildVMCoreInfoCommandLine(virCommandPtr cmd, const virDomainDef *def, @@ -10886,6 +10922,10 @@ qemuBuildCommandLine(virQEMUDriverPtr driver, if (qemuBuildSEVCommandLine(vm, cmd, def->sev) < 0) goto error; + if (qemuBuildMKTMECommandLine(cmd, def->mktme) < 0) + goto error; + + if (snapshot) virCommandAddArgList(cmd, "-loadvm", snapshot->def->name, NULL); diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index b2ac737d1f..ef62c15a26 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -22266,6 +22266,68 @@ qemuNodeGetSEVInfo(virConnectPtr conn, } +static int +qemuGetMKTMEInfoToParams(virQEMUCapsPtr qemuCaps, + virTypedParameterPtr *params, + int *nparams, + unsigned int flags) +{ + int maxpar = 0; + int n = 0; + virMKTMECapabilityPtr mktme = virQEMUCapsGetMKTMECapabilities(qemuCaps); + virTypedParameterPtr mktmeParams = NULL; + + virCheckFlags(VIR_TYPED_PARAM_STRING_OKAY, -1); + + if (virTypedParamsAddUInt(&mktmeParams, &n, &maxpar, + VIR_NODE_MKTME_KEYS_SUPPORTED, mktme->keys_supported) < 0) + goto cleanup; + + VIR_STEAL_PTR(*params, mktmeParams); + *nparams = n; + return 0; + +cleanup: + virTypedParamsFree(mktmeParams, n); + return -1; +} + + +static int +qemuNodeGetMKTMEInfo(virConnectPtr conn, + virTypedParameterPtr *params, + int *nparams, + unsigned int flags) +{ + virQEMUDriverPtr driver = conn->privateData; + virQEMUCapsPtr qemucaps = NULL; + int ret = -1; + + if (virNodeGetMktmeInfoEnsureACL(conn) < 0) + return ret; + + qemucaps = virQEMUCapsCacheLookupByArch(driver->qemuCapsCache, + virArchFromHost()); + if (!qemucaps) + goto cleanup; + + if (!virQEMUCapsGet(qemucaps, QEMU_CAPS_MKTME_GUEST)) { + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", + _("QEMU does not support MKTME guest")); + goto cleanup; + } + + if (qemuGetMKTMEInfoToParams(qemucaps, params, nparams, flags) < 0) + goto cleanup; + + ret = 0; + +cleanup: + virObjectUnref(qemucaps); + return ret; +} + + static int qemuDomainGetSEVMeasurement(virQEMUDriverPtr driver, virDomainObjPtr vm, @@ -22560,6 +22622,7 @@ static virHypervisorDriver qemuHypervisorDriver = { .connectBaselineHypervisorCPU = qemuConnectBaselineHypervisorCPU, /* 4.4.0 */ .nodeGetSEVInfo = qemuNodeGetSEVInfo, /* 4.5.0 */ .domainGetLaunchSecurityInfo = qemuDomainGetLaunchSecurityInfo, /* 4.5.0 */ + .nodeGetMKTMEInfo = qemuNodeGetMKTMEInfo /* 5.3.0 */ }; diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index e1fcbac13f..ea06e09f95 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -3921,6 +3921,15 @@ qemuMonitorGetSEVCapabilities(qemuMonitorPtr mon, return qemuMonitorJSONGetSEVCapabilities(mon, capabilities); } +int +qemuMonitorGetMKTMECapabilities(qemuMonitorPtr mon, + virMKTMECapability **capabilities) +{ + QEMU_CHECK_MONITOR(mon); + + return qemuMonitorJSONGetMKTMECapabilities(mon, capabilities); +} + int qemuMonitorNBDServerStart(qemuMonitorPtr mon, diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h index 9242d37407..2b39e54625 100644 --- a/src/qemu/qemu_monitor.h +++ b/src/qemu/qemu_monitor.h @@ -761,6 +761,11 @@ int qemuMonitorGetGICCapabilities(qemuMonitorPtr mon, int qemuMonitorGetSEVCapabilities(qemuMonitorPtr mon, virSEVCapability **capabilities); + +int qemuMonitorGetMKTMECapabilities(qemuMonitorPtr mon, + virMKTMECapability **capabilities); + + typedef enum { QEMU_MONITOR_MIGRATE_BACKGROUND = 1 << 0, QEMU_MONITOR_MIGRATE_NON_SHARED_DISK = 1 << 1, /* migration with non-shared storage with full disk copy */ diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index 908967f46c..708d483942 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -6654,6 +6654,58 @@ qemuMonitorJSONGetSEVCapabilities(qemuMonitorPtr mon, return ret; } +int +qemuMonitorJSONGetMKTMECapabilities(qemuMonitorPtr mon, + virMKTMECapability **capabilities) +{ + int ret = -1; + virJSONValuePtr cmd; + virJSONValuePtr reply = NULL; + virJSONValuePtr caps; + unsigned int keys_supported; + VIR_AUTOPTR(virMKTMECapability) capability = NULL; + + *capabilities = NULL; + + /* Query may change*/ + if (!(cmd = qemuMonitorJSONMakeCommand("query-mktme-capabilities", + NULL))) + return -1; + + if (qemuMonitorJSONCommand(mon, cmd, &reply) < 0) + goto cleanup; + + if (qemuMonitorJSONHasError(reply, "GenericError")) { + ret = 0; + goto cleanup; + } + + if (qemuMonitorJSONCheckError(cmd, reply) < 0) + goto cleanup; + + caps = virJSONValueObjectGetObject(reply, "return"); + + if (virJSONValueObjectGetNumberUint(caps, "keys_supported", &keys_supported) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("query-mktme-capabilities reply was missing" + " 'keys_supported' field")); + goto cleanup; + } + + if (VIR_ALLOC(capability) < 0) + goto cleanup; + + capability->keys_supported = keys_supported; + VIR_STEAL_PTR(*capabilities, capability); + ret = 1; +cleanup: + virJSONValueFree(cmd); + virJSONValueFree(reply); + + return ret; +} + + static virJSONValuePtr qemuMonitorJSONBuildInetSocketAddress(const char *host, const char *port) diff --git a/src/qemu/qemu_monitor_json.h b/src/qemu/qemu_monitor_json.h index 746b7072ca..e9316564ba 100644 --- a/src/qemu/qemu_monitor_json.h +++ b/src/qemu/qemu_monitor_json.h @@ -158,6 +158,9 @@ int qemuMonitorJSONGetGICCapabilities(qemuMonitorPtr mon, int qemuMonitorJSONGetSEVCapabilities(qemuMonitorPtr mon, virSEVCapability **capabilities); +int qemuMonitorJSONGetMKTMECapabilities(qemuMonitorPtr mon, + virMKTMECapability **capabilities); + int qemuMonitorJSONMigrate(qemuMonitorPtr mon, unsigned int flags, const char *uri); diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c index df28259042..f42686bfa9 100644 --- a/src/remote/remote_daemon_dispatch.c +++ b/src/remote/remote_daemon_dispatch.c @@ -5229,6 +5229,49 @@ remoteDispatchNodeGetSevInfo(virNetServerPtr server ATTRIBUTE_UNUSED, return rv; } +static int +remoteDispatchNodeGetMktmeInfo(virNetServerPtr server ATTRIBUTE_UNUSED, + virNetServerClientPtr client ATTRIBUTE_UNUSED, + virNetMessagePtr msg ATTRIBUTE_UNUSED, + virNetMessageErrorPtr rerr, + remote_node_get_mktme_info_args *args, + remote_node_get_mktme_info_ret *ret) +{ + virTypedParameterPtr params = NULL; + int nparams = 0; + int rv = -1; + struct daemonClientPrivate *priv = + virNetServerClientGetPrivateData(client); + + if (!priv->conn) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("connection not open")); + goto cleanup; + } + + if (virNodeGetMKTMEInfo(priv->conn, &params, &nparams, args->flags) < 0) + goto cleanup; + + if (nparams > REMOTE_NODE_MKTME_INFO_MAX) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large")); + goto cleanup; + } + + + if (virTypedParamsSerialize(params, nparams, + (virTypedParameterRemotePtr *)&ret->params.params_val, + &ret->params.params_len, + args->flags) < 0) + goto cleanup; + + rv = 0; + +cleanup: + if (rv < 0) + virNetMessageSaveError(rerr); + virTypedParamsFree(params, nparams); + return rv; +} + static int remoteDispatchNodeGetMemoryParameters(virNetServerPtr server ATTRIBUTE_UNUSED, diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 5c4dd41227..507ce0f917 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -6824,6 +6824,43 @@ remoteNodeGetSEVInfo(virConnectPtr conn, return rv; } +static int +remoteNodeGetMKTMEInfo(virConnectPtr conn, + virTypedParameterPtr *params, + int *nparams, + unsigned int flags) +{ + int rv = -1; + remote_node_get_mktme_info_args args; + remote_node_get_mktme_info_ret ret; + struct private_data *priv = conn->privateData; + + remoteDriverLock(priv); + + args.flags = flags; + + memset(&ret, 0, sizeof(ret)); + if (call(conn, priv, 0, REMOTE_PROC_NODE_GET_MKTME_INFO, + (xdrproc_t)xdr_remote_node_get_mktme_info_args, (char *)&args, + (xdrproc_t)xdr_remote_node_get_mktme_info_ret, (char *)&ret) == -1) + goto done; + + if (virTypedParamsDeserialize((virTypedParameterRemotePtr)ret.params.params_val, + ret.params.params_len, + REMOTE_NODE_MKTME_INFO_MAX, + params, + nparams) < 0) + goto cleanup; + + rv = 0; + +cleanup: + xdr_free((xdrproc_t)xdr_remote_node_get_mktme_info_ret, (char *)&ret); +done: + remoteDriverUnlock(priv); + return rv; +} + static int remoteNodeGetCPUMap(virConnectPtr conn, @@ -8516,7 +8553,8 @@ static virHypervisorDriver hypervisor_driver = { .connectCompareHypervisorCPU = remoteConnectCompareHypervisorCPU, /* 4.4.0 */ .connectBaselineHypervisorCPU = remoteConnectBaselineHypervisorCPU, /* 4.4.0 */ .nodeGetSEVInfo = remoteNodeGetSEVInfo, /* 4.5.0 */ - .domainGetLaunchSecurityInfo = remoteDomainGetLaunchSecurityInfo /* 4.5.0 */ + .domainGetLaunchSecurityInfo = remoteDomainGetLaunchSecurityInfo, /* 4.5.0 */ + .nodeGetMKTMEInfo = remoteNodeGetMKTMEInfo /* 5.3.0 */ }; static virNetworkDriver network_driver = { diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index 11f44ee267..b7806f42fa 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -260,6 +260,9 @@ const REMOTE_DOMAIN_IOTHREAD_PARAMS_MAX = 64; /* Upper limit on number of SEV parameters */ const REMOTE_NODE_SEV_INFO_MAX = 64; +/* Upper limit on number of MKTME parameters */ +const REMOTE_NODE_MKTME_INFO_MAX = 64; + /* Upper limit on number of launch security information entries */ const REMOTE_DOMAIN_LAUNCH_SECURITY_INFO_PARAMS_MAX = 64; @@ -3573,6 +3576,16 @@ struct remote_connect_get_storage_pool_capabilities_ret { remote_nonnull_string capabilities; }; +struct remote_node_get_mktme_info_args { + int nparams; + unsigned int flags; +}; + +struct remote_node_get_mktme_info_ret { + remote_typed_param params<REMOTE_NODE_MKTME_INFO_MAX>; + int nparams; +}; + /*----- Protocol. -----*/ /* Define the program number, protocol version and procedure numbers here. */ @@ -6342,5 +6355,11 @@ enum remote_procedure { * @generate: both * @acl: connect:read */ - REMOTE_PROC_CONNECT_GET_STORAGE_POOL_CAPABILITIES = 403 + REMOTE_PROC_CONNECT_GET_STORAGE_POOL_CAPABILITIES = 403, + + /** + * @generate: none + * @acl: connect:read + */ + REMOTE_PROC_NODE_GET_MKTME_INFO = 404 }; diff --git a/src/remote_protocol-structs b/src/remote_protocol-structs index 768189c573..0f469d68a1 100644 --- a/src/remote_protocol-structs +++ b/src/remote_protocol-structs @@ -2981,6 +2981,17 @@ struct remote_connect_get_storage_pool_capabilities_args { struct remote_connect_get_storage_pool_capabilities_ret { remote_nonnull_string capabilities; }; +struct remote_node_get_mktme_info_args { + int nparams; + u_int flags; +}; +struct remote_node_get_mktme_info_ret { + struct { + u_int params_len; + remote_typed_param * params_val; + } params; + int nparams; +}; enum remote_procedure { REMOTE_PROC_CONNECT_OPEN = 1, REMOTE_PROC_CONNECT_CLOSE = 2, @@ -3385,4 +3396,5 @@ enum remote_procedure { REMOTE_PROC_CONNECT_LIST_ALL_NWFILTER_BINDINGS = 401, REMOTE_PROC_DOMAIN_SET_IOTHREAD_PARAMS = 402, REMOTE_PROC_CONNECT_GET_STORAGE_POOL_CAPABILITIES = 403, + REMOTE_PROC_NODE_GET_MKTME_INFO = 404, }; diff --git a/src/util/Makefile.inc.am b/src/util/Makefile.inc.am index c757f5a6ae..ad4aa89873 100644 --- a/src/util/Makefile.inc.am +++ b/src/util/Makefile.inc.am @@ -228,6 +228,8 @@ UTIL_SOURCES = \ util/virmdev.h \ util/virfilecache.c \ util/virfilecache.h \ + util/virmktme.c \ + util/virmktme.h \ $(NULL) diff --git a/src/util/virmktme.c b/src/util/virmktme.c new file mode 100644 index 0000000000..714f4e8a2e --- /dev/null +++ b/src/util/virmktme.c @@ -0,0 +1,112 @@ +/* +* virmktme.c: interaction with processes +* +* Copyright (C) 2010-2015 Red Hat, Inc. +* +* This library is free software; you can redistribute it and/or +* modify it under the terms of the GNU Lesser General Public +* License as published by the Free Software Foundation; either +* version 2.1 of the License, or (at your option) any later version. +* +* This library is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public +* License along with this library. If not, see +* <http://www.gnu.org/licenses/>. +* +*/ +#ifdef __linux__ +#include <config.h> +#include <stdio.h> +#include <string.h> +#include <errno.h> +#include <asm/unistd.h> +#include <linux/keyctl.h> +#endif +#include "virerror.h" +#include "virlog.h" +#include "viraudit.h" +#include "virfile.h" +#include "viralloc.h" +#include "virutil.h" +#include "virstring.h" +#include "virmktme.h" + +VIR_LOG_INIT("util.mktme"); +// Libvirt thread specific dest keyring +#define VIR_FROM_THIS VIR_FROM_NONE + +/** +* virGetMktmeKey: +* @id: mktme id-string +* @type : mktme key type +* @key : user key value +* @encyption_algorithm : encryption algorithm +* +* returns mktme key-handle , this handle is used to encrypt the memory +* return -1 in case of failue +*/ + +#ifdef __linux__ +#define GET_MKTME_DEST_RING() \ +{ \ + destringid = syscall(__NR_request_key,"keyring", \ + LIBVIRT_MKTME_KEY_RING_NAME, KEY_SPEC_PROCESS_KEYRING); \ +} +#else +#define GET_MKTME_DEST_RING() +#endif + +int +virGetMktmeKeyHandle(const char* id, + const char* type, + const char* key, + const char *algorithm) +{ + char *callout = NULL; + int destringid = -1; + + int ret = -1; + + if (!id || !type || !algorithm ) + return -1; + + GET_MKTME_DEST_RING(); + if(destringid < 0) + return -1; + + if (key) { + if (virAsprintf(&callout, "type=%s algorithm=%s key=%s", + type, algorithm, key) < 0) + return -1; + } + else { + if (virAsprintf(&callout, "type=%s algorithm=%s", type, algorithm) < 0) + return -1; + } + +#ifdef __linux__ + ret = syscall(__NR_request_key,"mktme", id, callout, destringid); + VIR_FREE(callout); +#endif + return ret; +} + +/** +* virMktmeIsEnabled: +* +* Returns MKTME initialization status +*/ +int +virMktmeIsEnabled(void) +{ + int destringid = -1; + GET_MKTME_DEST_RING(); + if(destringid < 0) + return 0; + + return 1; +} diff --git a/src/util/virmktme.h b/src/util/virmktme.h new file mode 100644 index 0000000000..d698f6bfe4 --- /dev/null +++ b/src/util/virmktme.h @@ -0,0 +1,33 @@ +/* +* virmktme.h: MKTME kernel calls +* +* Copyright (C) 2016 Red Hat, Inc. +* +* This library is free software; you can redistribute it and/or +* modify it under the terms of the GNU Lesser General Public +* License as published by the Free Software Foundation; either +* version 2.1 of the License, or (at your option) any later version. +* +* This library is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +* Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public +* License along with this library. If not, see +* <http://www.gnu.org/licenses/>. +*/ + + +#ifndef LIBVIRT_VIRMKTME_H +#define LIBVIRT_VIRMKTME_H + +int +virGetMktmeKeyHandle(const char* id, const char* type, + const char* key, const char *algorithm); + +int +virMktmeIsEnabled(void); + +#define LIBVIRT_MKTME_KEY_RING_NAME "mktme_key_ring_service" +#endif diff --git a/tests/domaincapsschemadata/bhyve_basic.x86_64.xml b/tests/domaincapsschemadata/bhyve_basic.x86_64.xml index bdf2c4eee8..8db3340b38 100644 --- a/tests/domaincapsschemadata/bhyve_basic.x86_64.xml +++ b/tests/domaincapsschemadata/bhyve_basic.x86_64.xml @@ -32,5 +32,6 @@ <vmcoreinfo supported='no'/> <genid supported='no'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/bhyve_fbuf.x86_64.xml b/tests/domaincapsschemadata/bhyve_fbuf.x86_64.xml index f998c457c1..397c7c7ae2 100644 --- a/tests/domaincapsschemadata/bhyve_fbuf.x86_64.xml +++ b/tests/domaincapsschemadata/bhyve_fbuf.x86_64.xml @@ -49,5 +49,6 @@ <vmcoreinfo supported='no'/> <genid supported='no'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/bhyve_uefi.x86_64.xml b/tests/domaincapsschemadata/bhyve_uefi.x86_64.xml index 18f90023d5..f5c2c67fd8 100644 --- a/tests/domaincapsschemadata/bhyve_uefi.x86_64.xml +++ b/tests/domaincapsschemadata/bhyve_uefi.x86_64.xml @@ -41,5 +41,6 @@ <vmcoreinfo supported='no'/> <genid supported='no'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/empty.xml b/tests/domaincapsschemadata/empty.xml index 6c3f5f54fd..2ebefe8a05 100644 --- a/tests/domaincapsschemadata/empty.xml +++ b/tests/domaincapsschemadata/empty.xml @@ -12,5 +12,6 @@ </devices> <features> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/libxl-xenfv.xml b/tests/domaincapsschemadata/libxl-xenfv.xml index 4efc137c97..09c04374b9 100644 --- a/tests/domaincapsschemadata/libxl-xenfv.xml +++ b/tests/domaincapsschemadata/libxl-xenfv.xml @@ -75,5 +75,6 @@ <vmcoreinfo supported='no'/> <genid supported='no'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/libxl-xenpv.xml b/tests/domaincapsschemadata/libxl-xenpv.xml index 70e598fe9e..aac2a2cba6 100644 --- a/tests/domaincapsschemadata/libxl-xenpv.xml +++ b/tests/domaincapsschemadata/libxl-xenpv.xml @@ -65,5 +65,6 @@ <vmcoreinfo supported='no'/> <genid supported='no'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_1.7.0.x86_64.xml b/tests/domaincapsschemadata/qemu_1.7.0.x86_64.xml index 06908cc61e..8e55093e39 100644 --- a/tests/domaincapsschemadata/qemu_1.7.0.x86_64.xml +++ b/tests/domaincapsschemadata/qemu_1.7.0.x86_64.xml @@ -122,5 +122,6 @@ <vmcoreinfo supported='no'/> <genid supported='no'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_2.12.0-virt.aarch64.xml b/tests/domaincapsschemadata/qemu_2.12.0-virt.aarch64.xml index 5983a60887..ff0d410846 100644 --- a/tests/domaincapsschemadata/qemu_2.12.0-virt.aarch64.xml +++ b/tests/domaincapsschemadata/qemu_2.12.0-virt.aarch64.xml @@ -130,5 +130,6 @@ <vmcoreinfo supported='yes'/> <genid supported='no'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_2.12.0.ppc64.xml b/tests/domaincapsschemadata/qemu_2.12.0.ppc64.xml index 42c67623f4..158827f607 100644 --- a/tests/domaincapsschemadata/qemu_2.12.0.ppc64.xml +++ b/tests/domaincapsschemadata/qemu_2.12.0.ppc64.xml @@ -90,5 +90,6 @@ <vmcoreinfo supported='no'/> <genid supported='no'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_2.12.0.s390x.xml b/tests/domaincapsschemadata/qemu_2.12.0.s390x.xml index 4804c13329..71beea4258 100644 --- a/tests/domaincapsschemadata/qemu_2.12.0.s390x.xml +++ b/tests/domaincapsschemadata/qemu_2.12.0.s390x.xml @@ -182,5 +182,6 @@ <vmcoreinfo supported='no'/> <genid supported='no'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_2.12.0.x86_64.xml b/tests/domaincapsschemadata/qemu_2.12.0.x86_64.xml index f5f54cb484..559bbdda0b 100644 --- a/tests/domaincapsschemadata/qemu_2.12.0.x86_64.xml +++ b/tests/domaincapsschemadata/qemu_2.12.0.x86_64.xml @@ -158,5 +158,6 @@ <cbitpos>47</cbitpos> <reducedPhysBits>1</reducedPhysBits> </sev> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_2.6.0-virt.aarch64.xml b/tests/domaincapsschemadata/qemu_2.6.0-virt.aarch64.xml index 99ee16e4bb..30f70cd80d 100644 --- a/tests/domaincapsschemadata/qemu_2.6.0-virt.aarch64.xml +++ b/tests/domaincapsschemadata/qemu_2.6.0-virt.aarch64.xml @@ -127,5 +127,6 @@ <vmcoreinfo supported='no'/> <genid supported='no'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_2.6.0.aarch64.xml b/tests/domaincapsschemadata/qemu_2.6.0.aarch64.xml index 61fdae009a..293dd3d4f5 100644 --- a/tests/domaincapsschemadata/qemu_2.6.0.aarch64.xml +++ b/tests/domaincapsschemadata/qemu_2.6.0.aarch64.xml @@ -121,5 +121,6 @@ <vmcoreinfo supported='no'/> <genid supported='no'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_2.6.0.ppc64.xml b/tests/domaincapsschemadata/qemu_2.6.0.ppc64.xml index a33960a2af..dedd4ed799 100644 --- a/tests/domaincapsschemadata/qemu_2.6.0.ppc64.xml +++ b/tests/domaincapsschemadata/qemu_2.6.0.ppc64.xml @@ -94,5 +94,6 @@ <vmcoreinfo supported='no'/> <genid supported='no'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_2.6.0.x86_64.xml b/tests/domaincapsschemadata/qemu_2.6.0.x86_64.xml index 94fe08bc92..a5fc6d46ee 100644 --- a/tests/domaincapsschemadata/qemu_2.6.0.x86_64.xml +++ b/tests/domaincapsschemadata/qemu_2.6.0.x86_64.xml @@ -129,5 +129,6 @@ <vmcoreinfo supported='no'/> <genid supported='no'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_2.7.0.s390x.xml b/tests/domaincapsschemadata/qemu_2.7.0.s390x.xml index 1057573681..ea51c0aee9 100644 --- a/tests/domaincapsschemadata/qemu_2.7.0.s390x.xml +++ b/tests/domaincapsschemadata/qemu_2.7.0.s390x.xml @@ -87,5 +87,6 @@ <vmcoreinfo supported='no'/> <genid supported='no'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_2.8.0-tcg.x86_64.xml b/tests/domaincapsschemadata/qemu_2.8.0-tcg.x86_64.xml index 39f3bd6d9f..2505bfe316 100644 --- a/tests/domaincapsschemadata/qemu_2.8.0-tcg.x86_64.xml +++ b/tests/domaincapsschemadata/qemu_2.8.0-tcg.x86_64.xml @@ -130,5 +130,6 @@ <vmcoreinfo supported='no'/> <genid supported='no'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_2.8.0.s390x.xml b/tests/domaincapsschemadata/qemu_2.8.0.s390x.xml index 9ae9a1a8bc..fa7e0d2fb5 100644 --- a/tests/domaincapsschemadata/qemu_2.8.0.s390x.xml +++ b/tests/domaincapsschemadata/qemu_2.8.0.s390x.xml @@ -168,5 +168,6 @@ <vmcoreinfo supported='no'/> <genid supported='no'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_2.8.0.x86_64.xml b/tests/domaincapsschemadata/qemu_2.8.0.x86_64.xml index 1770c81fdb..deb8210590 100644 --- a/tests/domaincapsschemadata/qemu_2.8.0.x86_64.xml +++ b/tests/domaincapsschemadata/qemu_2.8.0.x86_64.xml @@ -130,5 +130,6 @@ <vmcoreinfo supported='no'/> <genid supported='no'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_2.9.0-q35.x86_64.xml b/tests/domaincapsschemadata/qemu_2.9.0-q35.x86_64.xml index e2ec30fda7..89d3038557 100644 --- a/tests/domaincapsschemadata/qemu_2.9.0-q35.x86_64.xml +++ b/tests/domaincapsschemadata/qemu_2.9.0-q35.x86_64.xml @@ -139,5 +139,6 @@ <vmcoreinfo supported='no'/> <genid supported='yes'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_2.9.0-tcg.x86_64.xml b/tests/domaincapsschemadata/qemu_2.9.0-tcg.x86_64.xml index 65226ee284..9aaa3e41c8 100644 --- a/tests/domaincapsschemadata/qemu_2.9.0-tcg.x86_64.xml +++ b/tests/domaincapsschemadata/qemu_2.9.0-tcg.x86_64.xml @@ -162,5 +162,6 @@ <vmcoreinfo supported='no'/> <genid supported='yes'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_2.9.0.x86_64.xml b/tests/domaincapsschemadata/qemu_2.9.0.x86_64.xml index 0093877a0b..0f9d1400a1 100644 --- a/tests/domaincapsschemadata/qemu_2.9.0.x86_64.xml +++ b/tests/domaincapsschemadata/qemu_2.9.0.x86_64.xml @@ -139,5 +139,6 @@ <vmcoreinfo supported='no'/> <genid supported='yes'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_3.0.0.s390x.xml b/tests/domaincapsschemadata/qemu_3.0.0.s390x.xml index c8efefc5ba..af2217f05b 100644 --- a/tests/domaincapsschemadata/qemu_3.0.0.s390x.xml +++ b/tests/domaincapsschemadata/qemu_3.0.0.s390x.xml @@ -188,5 +188,6 @@ <vmcoreinfo supported='no'/> <genid supported='no'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_3.1.0.x86_64.xml b/tests/domaincapsschemadata/qemu_3.1.0.x86_64.xml index ca3baab88c..e00c816980 100644 --- a/tests/domaincapsschemadata/qemu_3.1.0.x86_64.xml +++ b/tests/domaincapsschemadata/qemu_3.1.0.x86_64.xml @@ -157,5 +157,6 @@ <vmcoreinfo supported='yes'/> <genid supported='yes'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_4.0.0.x86_64.xml b/tests/domaincapsschemadata/qemu_4.0.0.x86_64.xml index 42d8949e61..53d1663368 100644 --- a/tests/domaincapsschemadata/qemu_4.0.0.x86_64.xml +++ b/tests/domaincapsschemadata/qemu_4.0.0.x86_64.xml @@ -157,5 +157,6 @@ <vmcoreinfo supported='yes'/> <genid supported='yes'/> <sev supported='no'/> + <mktme supported='no'/> </features> </domainCapabilities> diff --git a/tests/domaincapsschemadata/qemu_5.0.0.x86_64.xml b/tests/domaincapsschemadata/qemu_5.0.0.x86_64.xml new file mode 100644 index 0000000000..3d0c70faab --- /dev/null +++ b/tests/domaincapsschemadata/qemu_5.0.0.x86_64.xml @@ -0,0 +1,164 @@ +<domainCapabilities> + <path>/usr/bin/qemu-system-x86_64</path> + <domain>kvm</domain> + <machine>pc-i440fx-4.0</machine> + <arch>x86_64</arch> + <vcpu max='255'/> + <iothreads supported='yes'/> + <os supported='yes'> + <enum name='firmware'> + <value>bios</value> + <value>efi</value> + </enum> + <loader supported='yes'> + <value>/usr/share/AAVMF/AAVMF_CODE.fd</value> + <value>/usr/share/AAVMF/AAVMF32_CODE.fd</value> + <value>/usr/share/OVMF/OVMF_CODE.fd</value> + <enum name='type'> + <value>rom</value> + <value>pflash</value> + </enum> + <enum name='readonly'> + <value>yes</value> + <value>no</value> + </enum> + <enum name='secure'> + <value>no</value> + </enum> + </loader> + </os> + <cpu> + <mode name='host-passthrough' supported='yes'/> + <mode name='host-model' supported='yes'> + <model fallback='forbid'>Skylake-Client-IBRS</model> + <vendor>Intel</vendor> + <feature policy='require' name='ss'/> + <feature policy='require' name='hypervisor'/> + <feature policy='require' name='tsc_adjust'/> + <feature policy='require' name='clflushopt'/> + <feature policy='require' name='umip'/> + <feature policy='require' name='arch-capabilities'/> + <feature policy='require' name='ssbd'/> + <feature policy='require' name='xsaves'/> + <feature policy='require' name='pdpe1gb'/> + <feature policy='require' name='invtsc'/> + </mode> + <mode name='custom' supported='yes'> + <model usable='yes'>qemu64</model> + <model usable='yes'>qemu32</model> + <model usable='no'>phenom</model> + <model usable='yes'>pentium3</model> + <model usable='yes'>pentium2</model> + <model usable='yes'>pentium</model> + <model usable='yes'>n270</model> + <model usable='yes'>kvm64</model> + <model usable='yes'>kvm32</model> + <model usable='yes'>coreduo</model> + <model usable='yes'>core2duo</model> + <model usable='no'>athlon</model> + <model usable='yes'>Westmere-IBRS</model> + <model usable='yes'>Westmere</model> + <model usable='no'>Skylake-Server-IBRS</model> + <model usable='no'>Skylake-Server</model> + <model usable='yes'>Skylake-Client-IBRS</model> + <model usable='yes'>Skylake-Client</model> + <model usable='yes'>SandyBridge-IBRS</model> + <model usable='yes'>SandyBridge</model> + <model usable='yes'>Penryn</model> + <model usable='no'>Opteron_G5</model> + <model usable='no'>Opteron_G4</model> + <model usable='no'>Opteron_G3</model> + <model usable='yes'>Opteron_G2</model> + <model usable='yes'>Opteron_G1</model> + <model usable='yes'>Nehalem-IBRS</model> + <model usable='yes'>Nehalem</model> + <model usable='yes'>IvyBridge-IBRS</model> + <model usable='yes'>IvyBridge</model> + <model usable='no'>Icelake-Server</model> + <model usable='no'>Icelake-Client</model> + <model usable='yes'>Haswell-noTSX-IBRS</model> + <model usable='yes'>Haswell-noTSX</model> + <model usable='yes'>Haswell-IBRS</model> + <model usable='yes'>Haswell</model> + <model usable='no'>EPYC-IBPB</model> + <model usable='no'>EPYC</model> + <model usable='yes'>Conroe</model> + <model usable='no'>Cascadelake-Server</model> + <model usable='yes'>Broadwell-noTSX-IBRS</model> + <model usable='yes'>Broadwell-noTSX</model> + <model usable='yes'>Broadwell-IBRS</model> + <model usable='yes'>Broadwell</model> + <model usable='yes'>486</model> + </mode> + </cpu> + <devices> + <disk supported='yes'> + <enum name='diskDevice'> + <value>disk</value> + <value>cdrom</value> + <value>floppy</value> + <value>lun</value> + </enum> + <enum name='bus'> + <value>ide</value> + <value>fdc</value> + <value>scsi</value> + <value>virtio</value> + <value>usb</value> + <value>sata</value> + </enum> + <enum name='model'> + <value>virtio</value> + <value>virtio-transitional</value> + <value>virtio-non-transitional</value> + </enum> + </disk> + <graphics supported='yes'> + <enum name='type'> + <value>sdl</value> + <value>vnc</value> + <value>spice</value> + </enum> + </graphics> + <video supported='yes'> + <enum name='modelType'> + <value>vga</value> + <value>cirrus</value> + <value>vmvga</value> + <value>qxl</value> + <value>virtio</value> + </enum> + </video> + <hostdev supported='yes'> + <enum name='mode'> + <value>subsystem</value> + </enum> + <enum name='startupPolicy'> + <value>default</value> + <value>mandatory</value> + <value>requisite</value> + <value>optional</value> + </enum> + <enum name='subsysType'> + <value>usb</value> + <value>pci</value> + <value>scsi</value> + </enum> + <enum name='capsType'/> + <enum name='pciBackend'> + <value>default</value> + <value>kvm</value> + <value>vfio</value> + </enum> + </hostdev> + </devices> + <features> + <gic supported='no'/> + <vmcoreinfo supported='yes'/> + <genid supported='yes'/> + <sev supported='no'/> + <mktme supported='yes'> + <keys_supported>15</keys_supported> + </mktme> + </features> +</domainCapabilities> diff --git a/tests/domaincapstest.c b/tests/domaincapstest.c index f87a1d63fb..dc6eb9ba07 100644 --- a/tests/domaincapstest.c +++ b/tests/domaincapstest.c @@ -449,6 +449,10 @@ mymain(void) DO_TEST_QEMU("4.0.0", "caps_4.0.0", "/usr/bin/qemu-system-x86_64", NULL, "x86_64", VIR_DOMAIN_VIRT_KVM); + + DO_TEST_QEMU("5.0.0", "caps_5.0.0", + "/usr/bin/qemu-system-x86_64", NULL, + "x86_64", VIR_DOMAIN_VIRT_KVM); virObjectUnref(cfg); virFileWrapperClearPrefixes(); diff --git a/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml new file mode 100644 index 0000000000..4bd9209147 --- /dev/null +++ b/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml @@ -0,0 +1,1389 @@ +<qemuCaps> + <qemuctime>0</qemuctime> + <selfctime>0</selfctime> + <selfvers>0</selfvers> + <flag name='kvm'/> + <flag name='no-hpet'/> + <flag name='spice'/> + <flag name='hda-duplex'/> + <flag name='ccid-emulated'/> + <flag name='ccid-passthru'/> + <flag name='virtio-tx-alg'/> + <flag name='virtio-blk-pci.ioeventfd'/> + <flag name='sga'/> + <flag name='virtio-blk-pci.event_idx'/> + <flag name='virtio-net-pci.event_idx'/> + <flag name='piix3-usb-uhci'/> + <flag name='piix4-usb-uhci'/> + <flag name='usb-ehci'/> + <flag name='ich9-usb-ehci1'/> + <flag name='vt82c686b-usb-uhci'/> + <flag name='pci-ohci'/> + <flag name='usb-redir'/> + <flag name='usb-hub'/> + <flag name='ich9-ahci'/> + <flag name='no-acpi'/> + <flag name='virtio-blk-pci.scsi'/> + <flag name='scsi-disk.channel'/> + <flag name='scsi-block'/> + <flag name='hda-micro'/> + <flag name='dump-guest-memory'/> + <flag name='nec-usb-xhci'/> + <flag name='lsi'/> + <flag name='virtio-scsi-pci'/> + <flag name='blockio'/> + <flag name='disable-s3'/> + <flag name='disable-s4'/> + <flag name='usb-redir.filter'/> + <flag name='ide-drive.wwn'/> + <flag name='scsi-disk.wwn'/> + <flag name='seccomp-sandbox'/> + <flag name='reboot-timeout'/> + <flag name='vnc'/> + <flag name='qxl'/> + <flag name='VGA'/> + <flag name='cirrus-vga'/> + <flag name='vmware-svga'/> + <flag name='device-video-primary'/> + <flag name='usb-serial'/> + <flag name='nbd-server'/> + <flag name='virtio-rng'/> + <flag name='rng-random'/> + <flag name='rng-egd'/> + <flag name='megasas'/> + <flag name='tpm-passthrough'/> + <flag name='tpm-tis'/> + <flag name='pci-bridge'/> + <flag name='vfio-pci'/> + <flag name='mem-merge'/> + <flag name='drive-discard'/> + <flag name='dmi-to-pci-bridge'/> + <flag name='i440fx-pci-hole64-size'/> + <flag name='q35-pci-hole64-size'/> + <flag name='usb-storage'/> + <flag name='usb-storage.removable'/> + <flag name='ich9-intel-hda'/> + <flag name='kvm-pit-lost-tick-policy'/> + <flag name='boot-strict'/> + <flag name='pvpanic'/> + <flag name='spice-file-xfer-disable'/> + <flag name='usb-kbd'/> + <flag name='msg-timestamp'/> + <flag name='active-commit'/> + <flag name='change-backing-file'/> + <flag name='memory-backend-ram'/> + <flag name='numa'/> + <flag name='memory-backend-file'/> + <flag name='usb-audio'/> + <flag name='rtc-reset-reinjection'/> + <flag name='splash-timeout'/> + <flag name='iothread'/> + <flag name='migrate-rdma'/> + <flag name='drive-iotune-max'/> + <flag name='VGA.vgamem_mb'/> + <flag name='vmware-svga.vgamem_mb'/> + <flag name='qxl.vgamem_mb'/> + <flag name='pc-dimm'/> + <flag name='machine-vmport-opt'/> + <flag name='aes-key-wrap'/> + <flag name='dea-key-wrap'/> + <flag name='pci-serial'/> + <flag name='vhost-user-multiqueue'/> + <flag name='migration-event'/> + <flag name='ioh3420'/> + <flag name='x3130-upstream'/> + <flag name='xio3130-downstream'/> + <flag name='rtl8139'/> + <flag name='e1000'/> + <flag name='virtio-net'/> + <flag name='gic-version'/> + <flag name='incoming-defer'/> + <flag name='virtio-gpu'/> + <flag name='virtio-gpu.virgl'/> + <flag name='virtio-keyboard'/> + <flag name='virtio-mouse'/> + <flag name='virtio-tablet'/> + <flag name='virtio-input-host'/> + <flag name='chardev-file-append'/> + <flag name='ich9-disable-s3'/> + <flag name='ich9-disable-s4'/> + <flag name='vserport-change-event'/> + <flag name='virtio-balloon-pci.deflate-on-oom'/> + <flag name='mptsas1068'/> + <flag name='spice-gl'/> + <flag name='qxl.vram64_size_mb'/> + <flag name='chardev-logfile'/> + <flag name='debug-threads'/> + <flag name='secret'/> + <flag name='pxb'/> + <flag name='pxb-pcie'/> + <flag name='nec-usb-xhci-ports'/> + <flag name='virtio-scsi-pci.iothread'/> + <flag name='name-guest'/> + <flag name='qxl.max_outputs'/> + <flag name='spice-unix'/> + <flag name='drive-detect-zeroes'/> + <flag name='tls-creds-x509'/> + <flag name='intel-iommu'/> + <flag name='smm'/> + <flag name='virtio-pci-disable-legacy'/> + <flag name='query-hotpluggable-cpus'/> + <flag name='virtio-net.rx_queue_size'/> + <flag name='virtio-vga'/> + <flag name='drive-iotune-max-length'/> + <flag name='ivshmem-plain'/> + <flag name='ivshmem-doorbell'/> + <flag name='query-qmp-schema'/> + <flag name='gluster.debug_level'/> + <flag name='vhost-scsi'/> + <flag name='drive-iotune-group'/> + <flag name='query-cpu-model-expansion'/> + <flag name='virtio-net.host_mtu'/> + <flag name='spice-rendernode'/> + <flag name='nvdimm'/> + <flag name='pcie-root-port'/> + <flag name='query-cpu-definitions'/> + <flag name='block-write-threshold'/> + <flag name='query-named-block-nodes'/> + <flag name='cpu-cache'/> + <flag name='qemu-xhci'/> + <flag name='kernel-irqchip'/> + <flag name='kernel-irqchip.split'/> + <flag name='intel-iommu.intremap'/> + <flag name='intel-iommu.caching-mode'/> + <flag name='intel-iommu.eim'/> + <flag name='intel-iommu.device-iotlb'/> + <flag name='virtio.iommu_platform'/> + <flag name='virtio.ats'/> + <flag name='loadparm'/> + <flag name='vnc-multi-servers'/> + <flag name='virtio-net.tx_queue_size'/> + <flag name='chardev-reconnect'/> + <flag name='virtio-gpu.max_outputs'/> + <flag name='vxhs'/> + <flag name='virtio-blk.num-queues'/> + <flag name='vmcoreinfo'/> + <flag name='numa.dist'/> + <flag name='disk-share-rw'/> + <flag name='iscsi.password-secret'/> + <flag name='isa-serial'/> + <flag name='dump-completed'/> + <flag name='qcow2-luks'/> + <flag name='pcie-pci-bridge'/> + <flag name='seccomp-blacklist'/> + <flag name='query-cpus-fast'/> + <flag name='disk-write-cache'/> + <flag name='nbd-tls'/> + <flag name='tpm-crb'/> + <flag name='pr-manager-helper'/> + <flag name='qom-list-properties'/> + <flag name='memory-backend-file.discard-data'/> + <flag name='sdl-gl'/> + <flag name='screendump_device'/> + <flag name='hda-output'/> + <flag name='blockdev-del'/> + <flag name='vmgenid'/> + <flag name='vhost-vsock'/> + <flag name='chardev-fd-pass'/> + <flag name='tpm-emulator'/> + <flag name='mch'/> + <flag name='mch.extended-tseg-mbytes'/> + <flag name='usb-storage.werror'/> + <flag name='egl-headless'/> + <flag name='vfio-pci.display'/> + <flag name='memory-backend-memfd'/> + <flag name='memory-backend-memfd.hugetlb'/> + <flag name='iothread.poll-max-ns'/> + <flag name='egl-headless.rendernode'/> + <flag name='memory-backend-file.align'/> + <flag name='memory-backend-file.pmem'/> + <flag name='nvdimm.unarmed'/> + <flag name='scsi-disk.device_id'/> + <flag name='virtio-pci-non-transitional'/> + <flag name='overcommit'/> + <flag name='mktme-guest'/> + <version>3001050</version> + <kvmVersion>0</kvmVersion> + <microcodeVersion>43100758</microcodeVersion> + <package>v3.1.0-1445-ga61faa3d02</package> + <arch>x86_64</arch> + <hostCPU type='kvm' model='base' migratability='yes'> + <property name='phys-bits' type='number' value='0'/> + <property name='core-id' type='number' value='-1'/> + <property name='xlevel' type='number' value='2147483656'/> + <property name='cmov' type='boolean' value='true' migratable='yes'/> + <property name='ia64' type='boolean' value='false'/> + <property name='ssb-no' type='boolean' value='false'/> + <property name='aes' type='boolean' value='true' migratable='yes'/> + <property name='mmx' type='boolean' value='true' migratable='yes'/> + <property name='rdpid' type='boolean' value='false'/> + <property name='arat' type='boolean' value='true' migratable='yes'/> + <property name='gfni' type='boolean' value='false'/> + <property name='ibrs-all' type='boolean' value='false'/> + <property name='pause-filter' type='boolean' value='false'/> + <property name='xsavec' type='boolean' value='true' migratable='yes'/> + <property name='intel-pt' type='boolean' value='false'/> + <property name='hv-frequencies' type='boolean' value='false'/> + <property name='tsc-frequency' type='number' value='0'/> + <property name='xd' type='boolean' value='true' migratable='yes'/> + <property name='hv-vendor-id' type='string' value=''/> + <property name='kvm-asyncpf' type='boolean' value='true' migratable='yes'/> + <property name='kvm_asyncpf' type='boolean' value='true' migratable='yes'/> + <property name='perfctr_core' type='boolean' value='false'/> + <property name='perfctr-core' type='boolean' value='false'/> + <property name='mpx' type='boolean' value='true' migratable='yes'/> + <property name='pbe' type='boolean' value='false'/> + <property name='decodeassists' type='boolean' value='false'/> + <property name='avx512cd' type='boolean' value='false'/> + <property name='sse4_1' type='boolean' value='true' migratable='yes'/> + <property name='sse4.1' type='boolean' value='true' migratable='yes'/> + <property name='sse4-1' type='boolean' value='true' migratable='yes'/> + <property name='family' type='number' value='6'/> + <property name='legacy-cache' type='boolean' value='true' migratable='yes'/> + <property name='host-phys-bits-limit' type='number' value='0'/> + <property name='vmware-cpuid-freq' type='boolean' value='true' migratable='yes'/> + <property name='wbnoinvd' type='boolean' value='false'/> + <property name='avx512f' type='boolean' value='false'/> + <property name='msr' type='boolean' value='true' migratable='yes'/> + <property name='mce' type='boolean' value='true' migratable='yes'/> + <property name='mca' type='boolean' value='true' migratable='yes'/> + <property name='hv-runtime' type='boolean' value='false'/> + <property name='xcrypt' type='boolean' value='false'/> + <property name='thread-id' type='number' value='-1'/> + <property name='min-level' type='number' value='13'/> + <property name='xgetbv1' type='boolean' value='true' migratable='yes'/> + <property name='cid' type='boolean' value='false'/> + <property name='hv-relaxed' type='boolean' value='false'/> + <property name='hv-crash' type='boolean' value='false'/> + <property name='ds' type='boolean' value='false'/> + <property name='fxsr' type='boolean' value='true' migratable='yes'/> + <property name='xsaveopt' type='boolean' value='true' migratable='yes'/> + <property name='xtpr' type='boolean' value='false'/> + <property name='hv-evmcs' type='boolean' value='false'/> + <property name='avx512vl' type='boolean' value='false'/> + <property name='avx512-vpopcntdq' type='boolean' value='false'/> + <property name='phe' type='boolean' value='false'/> + <property name='extapic' type='boolean' value='false'/> + <property name='3dnowprefetch' type='boolean' value='true' migratable='yes'/> + <property name='avx512vbmi2' type='boolean' value='false'/> + <property name='cr8legacy' type='boolean' value='false'/> + <property name='stibp' type='boolean' value='false'/> + <property name='cpuid-0xb' type='boolean' value='true' migratable='yes'/> + <property name='xcrypt-en' type='boolean' value='false'/> + <property name='kvm_pv_eoi' type='boolean' value='true' migratable='yes'/> + <property name='apic-id' type='number' value='4294967295'/> + <property name='rsba' type='boolean' value='false'/> + <property name='pn' type='boolean' value='false'/> + <property name='dca' type='boolean' value='false'/> + <property name='vendor' type='string' value='GenuineIntel'/> + <property name='hv-ipi' type='boolean' value='false'/> + <property name='pku' type='boolean' value='false'/> + <property name='smx' type='boolean' value='false'/> + <property name='cmp_legacy' type='boolean' value='false'/> + <property name='cmp-legacy' type='boolean' value='false'/> + <property name='node-id' type='number' value='-1'/> + <property name='avx512-4fmaps' type='boolean' value='false'/> + <property name='vmcb_clean' type='boolean' value='false'/> + <property name='vmcb-clean' type='boolean' value='false'/> + <property name='3dnowext' type='boolean' value='false'/> + <property name='amd-no-ssb' type='boolean' value='false'/> + <property name='hle' type='boolean' value='true' migratable='yes'/> + <property name='npt' type='boolean' value='false'/> + <property name='rdctl-no' type='boolean' value='false'/> + <property name='memory' type='string' value='/machine/unattached/system[0]'/> + <property name='clwb' type='boolean' value='false'/> + <property name='lbrv' type='boolean' value='false'/> + <property name='adx' type='boolean' value='true' migratable='yes'/> + <property name='ss' type='boolean' value='true' migratable='yes'/> + <property name='pni' type='boolean' value='true' migratable='yes'/> + <property name='svm_lock' type='boolean' value='false'/> + <property name='svm-lock' type='boolean' value='false'/> + <property name='pfthreshold' type='boolean' value='false'/> + <property name='smep' type='boolean' value='true' migratable='yes'/> + <property name='smap' type='boolean' value='true' migratable='yes'/> + <property name='x2apic' type='boolean' value='true' migratable='yes'/> + <property name='avx512vbmi' type='boolean' value='false'/> + <property name='avx512vnni' type='boolean' value='false'/> + <property name='hv-stimer' type='boolean' value='false'/> + <property name='x-hv-synic-kvm-only' type='boolean' value='false'/> + <property name='i64' type='boolean' value='true' migratable='yes'/> + <property name='flushbyasid' type='boolean' value='false'/> + <property name='f16c' type='boolean' value='true' migratable='yes'/> + <property name='ace2-en' type='boolean' value='false'/> + <property name='pat' type='boolean' value='true' migratable='yes'/> + <property name='pae' type='boolean' value='true' migratable='yes'/> + <property name='sse' type='boolean' value='true' migratable='yes'/> + <property name='phe-en' type='boolean' value='false'/> + <property name='kvm_nopiodelay' type='boolean' value='true' migratable='yes'/> + <property name='kvm-nopiodelay' type='boolean' value='true' migratable='yes'/> + <property name='tm' type='boolean' value='false'/> + <property name='kvmclock-stable-bit' type='boolean' value='true' migratable='yes'/> + <property name='hypervisor' type='boolean' value='true' migratable='yes'/> + <property name='socket-id' type='number' value='-1'/> + <property name='pcommit' type='boolean' value='false'/> + <property name='syscall' type='boolean' value='true' migratable='yes'/> + <property name='level' type='number' value='13'/> + <property name='avx512dq' type='boolean' value='false'/> + <property name='x-migrate-smi-count' type='boolean' value='true' migratable='yes'/> + <property name='svm' type='boolean' value='false'/> + <property name='full-cpuid-auto-level' type='boolean' value='true' migratable='yes'/> + <property name='hv-reset' type='boolean' value='false'/> + <property name='invtsc' type='boolean' value='true' migratable='no'/> + <property name='sse3' type='boolean' value='true' migratable='yes'/> + <property name='sse2' type='boolean' value='true' migratable='yes'/> + <property name='ssbd' type='boolean' value='true' migratable='yes'/> + <property name='est' type='boolean' value='false'/> + <property name='avx512ifma' type='boolean' value='false'/> + <property name='tm2' type='boolean' value='false'/> + <property name='kvm-pv-ipi' type='boolean' value='true' migratable='yes'/> + <property name='kvm-pv-eoi' type='boolean' value='true' migratable='yes'/> + <property name='cx8' type='boolean' value='true' migratable='yes'/> + <property name='cldemote' type='boolean' value='false'/> + <property name='hv-reenlightenment' type='boolean' value='false'/> + <property name='kvm_mmu' type='boolean' value='false'/> + <property name='kvm-mmu' type='boolean' value='false'/> + <property name='sse4_2' type='boolean' value='true' migratable='yes'/> + <property name='sse4.2' type='boolean' value='true' migratable='yes'/> + <property name='sse4-2' type='boolean' value='true' migratable='yes'/> + <property name='pge' type='boolean' value='true' migratable='yes'/> + <property name='fill-mtrr-mask' type='boolean' value='true' migratable='yes'/> + <property name='avx512bitalg' type='boolean' value='false'/> + <property name='nodeid_msr' type='boolean' value='false'/> + <property name='pdcm' type='boolean' value='false'/> + <property name='movbe' type='boolean' value='true' migratable='yes'/> + <property name='model' type='number' value='94'/> + <property name='nrip_save' type='boolean' value='false'/> + <property name='nrip-save' type='boolean' value='false'/> + <property name='kvm_pv_unhalt' type='boolean' value='true' migratable='yes'/> + <property name='ssse3' type='boolean' value='true' migratable='yes'/> + <property name='sse4a' type='boolean' value='false'/> + <property name='invpcid' type='boolean' value='true' migratable='yes'/> + <property name='pdpe1gb' type='boolean' value='true' migratable='yes'/> + <property name='tsc-deadline' type='boolean' value='true' migratable='yes'/> + <property name='skip-l1dfl-vmentry' type='boolean' value='true' migratable='yes'/> + <property name='fma' type='boolean' value='true' migratable='yes'/> + <property name='cx16' type='boolean' value='true' migratable='yes'/> + <property name='de' type='boolean' value='true' migratable='yes'/> + <property name='pconfig' type='boolean' value='false'/> + <property name='enforce' type='boolean' value='false'/> + <property name='stepping' type='number' value='3'/> + <property name='xsave' type='boolean' value='true' migratable='yes'/> + <property name='clflush' type='boolean' value='true' migratable='yes'/> + <property name='skinit' type='boolean' value='false'/> + <property name='tsc' type='boolean' value='true' migratable='yes'/> + <property name='tce' type='boolean' value='false'/> + <property name='fpu' type='boolean' value='true' migratable='yes'/> + <property name='ibs' type='boolean' value='false'/> + <property name='ds_cpl' type='boolean' value='false'/> + <property name='ds-cpl' type='boolean' value='false'/> + <property name='host-phys-bits' type='boolean' value='false'/> + <property name='fma4' type='boolean' value='false'/> + <property name='la57' type='boolean' value='false'/> + <property name='osvw' type='boolean' value='false'/> + <property name='check' type='boolean' value='true' migratable='yes'/> + <property name='hv-spinlocks' type='number' value='-1'/> + <property name='pmu' type='boolean' value='false'/> + <property name='pmm' type='boolean' value='false'/> + <property name='apic' type='boolean' value='true' migratable='yes'/> + <property name='spec-ctrl' type='boolean' value='true' migratable='yes'/> + <property name='min-xlevel2' type='number' value='0'/> + <property name='tsc-adjust' type='boolean' value='true' migratable='yes'/> + <property name='tsc_adjust' type='boolean' value='true' migratable='yes'/> + <property name='kvm-steal-time' type='boolean' value='true' migratable='yes'/> + <property name='kvm_steal_time' type='boolean' value='true' migratable='yes'/> + <property name='kvmclock' type='boolean' value='true' migratable='yes'/> + <property name='l3-cache' type='boolean' value='true' migratable='yes'/> + <property name='lwp' type='boolean' value='false'/> + <property name='amd-ssbd' type='boolean' value='false'/> + <property name='ibpb' type='boolean' value='false'/> + <property name='xop' type='boolean' value='false'/> + <property name='avx' type='boolean' value='true' migratable='yes'/> + <property name='movdiri' type='boolean' value='false'/> + <property name='ace2' type='boolean' value='false'/> + <property name='avx512bw' type='boolean' value='false'/> + <property name='acpi' type='boolean' value='false'/> + <property name='hv-vapic' type='boolean' value='false'/> + <property name='fsgsbase' type='boolean' value='true' migratable='yes'/> + <property name='ht' type='boolean' value='false'/> + <property name='nx' type='boolean' value='true' migratable='yes'/> + <property name='pclmulqdq' type='boolean' value='true' migratable='yes'/> + <property name='mmxext' type='boolean' value='false'/> + <property name='vaes' type='boolean' value='false'/> + <property name='popcnt' type='boolean' value='true' migratable='yes'/> + <property name='xsaves' type='boolean' value='true' migratable='yes'/> + <property name='movdir64b' type='boolean' value='false'/> + <property name='tcg-cpuid' type='boolean' value='true' migratable='yes'/> + <property name='lm' type='boolean' value='true' migratable='yes'/> + <property name='umip' type='boolean' value='true' migratable='yes'/> + <property name='pse' type='boolean' value='true' migratable='yes'/> + <property name='avx2' type='boolean' value='true' migratable='yes'/> + <property name='sep' type='boolean' value='true' migratable='yes'/> + <property name='pclmuldq' type='boolean' value='true' migratable='yes'/> + <property name='virt-ssbd' type='boolean' value='false'/> + <property name='x-hv-max-vps' type='number' value='-1'/> + <property name='nodeid-msr' type='boolean' value='false'/> + <property name='kvm' type='boolean' value='true' migratable='yes'/> + <property name='misalignsse' type='boolean' value='false'/> + <property name='min-xlevel' type='number' value='2147483656'/> + <property name='kvm-pv-unhalt' type='boolean' value='true' migratable='yes'/> + <property name='bmi2' type='boolean' value='true' migratable='yes'/> + <property name='bmi1' type='boolean' value='true' migratable='yes'/> + <property name='realized' type='boolean' value='false'/> + <property name='tsc_scale' type='boolean' value='false'/> + <property name='tsc-scale' type='boolean' value='false'/> + <property name='topoext' type='boolean' value='false'/> + <property name='hv-vpindex' type='boolean' value='false'/> + <property name='xlevel2' type='number' value='0'/> + <property name='clflushopt' type='boolean' value='true' migratable='yes'/> + <property name='kvm-no-smi-migration' type='boolean' value='false'/> + <property name='monitor' type='boolean' value='false'/> + <property name='avx512er' type='boolean' value='false'/> + <property name='pmm-en' type='boolean' value='false'/> + <property name='pcid' type='boolean' value='true' migratable='yes'/> + <property name='arch-capabilities' type='boolean' value='true' migratable='no'/> + <property name='3dnow' type='boolean' value='false'/> + <property name='erms' type='boolean' value='true' migratable='yes'/> + <property name='lahf-lm' type='boolean' value='true' migratable='yes'/> + <property name='lahf_lm' type='boolean' value='true' migratable='yes'/> + <property name='vpclmulqdq' type='boolean' value='false'/> + <property name='fxsr-opt' type='boolean' value='false'/> + <property name='hv-synic' type='boolean' value='false'/> + <property name='xstore' type='boolean' value='false'/> + <property name='fxsr_opt' type='boolean' value='false'/> + <property name='kvm-hint-dedicated' type='boolean' value='false'/> + <property name='rtm' type='boolean' value='true' migratable='yes'/> + <property name='lmce' type='boolean' value='true' migratable='yes'/> + <property name='hv-time' type='boolean' value='false'/> + <property name='perfctr-nb' type='boolean' value='false'/> + <property name='perfctr_nb' type='boolean' value='false'/> + <property name='ffxsr' type='boolean' value='false'/> + <property name='hv-tlbflush' type='boolean' value='false'/> + <property name='rdrand' type='boolean' value='true' migratable='yes'/> + <property name='rdseed' type='boolean' value='true' migratable='yes'/> + <property name='avx512-4vnniw' type='boolean' value='false'/> + <property name='vmx' type='boolean' value='false'/> + <property name='vme' type='boolean' value='true' migratable='yes'/> + <property name='dtes64' type='boolean' value='false'/> + <property name='mtrr' type='boolean' value='true' migratable='yes'/> + <property name='rdtscp' type='boolean' value='true' migratable='yes'/> + <property name='pse36' type='boolean' value='true' migratable='yes'/> + <property name='kvm-pv-tlb-flush' type='boolean' value='true' migratable='yes'/> + <property name='tbm' type='boolean' value='false'/> + <property name='wdt' type='boolean' value='false'/> + <property name='pause_filter' type='boolean' value='false'/> + <property name='sha-ni' type='boolean' value='false'/> + <property name='model-id' type='string' value='Intel(R) Xeon(R) CPU E3-1245 v5 @ 3.50GHz'/> + <property name='abm' type='boolean' value='true' migratable='yes'/> + <property name='avx512pf' type='boolean' value='false'/> + <property name='xstore-en' type='boolean' value='false'/> + </hostCPU> + <hostCPU type='tcg' model='base' migratability='yes'> + <property name='phys-bits' type='number' value='0'/> + <property name='core-id' type='number' value='-1'/> + <property name='xlevel' type='number' value='2147483658'/> + <property name='cmov' type='boolean' value='true' migratable='yes'/> + <property name='ia64' type='boolean' value='false'/> + <property name='ssb-no' type='boolean' value='false'/> + <property name='aes' type='boolean' value='true' migratable='yes'/> + <property name='mmx' type='boolean' value='true' migratable='yes'/> + <property name='rdpid' type='boolean' value='false'/> + <property name='arat' type='boolean' value='true' migratable='yes'/> + <property name='gfni' type='boolean' value='false'/> + <property name='ibrs-all' type='boolean' value='false'/> + <property name='pause-filter' type='boolean' value='false'/> + <property name='xsavec' type='boolean' value='false'/> + <property name='intel-pt' type='boolean' value='false'/> + <property name='hv-frequencies' type='boolean' value='false'/> + <property name='tsc-frequency' type='number' value='0'/> + <property name='xd' type='boolean' value='true' migratable='yes'/> + <property name='hv-vendor-id' type='string' value=''/> + <property name='kvm-asyncpf' type='boolean' value='false'/> + <property name='kvm_asyncpf' type='boolean' value='false'/> + <property name='perfctr_core' type='boolean' value='false'/> + <property name='perfctr-core' type='boolean' value='false'/> + <property name='mpx' type='boolean' value='true' migratable='yes'/> + <property name='pbe' type='boolean' value='false'/> + <property name='decodeassists' type='boolean' value='false'/> + <property name='avx512cd' type='boolean' value='false'/> + <property name='sse4_1' type='boolean' value='true' migratable='yes'/> + <property name='sse4.1' type='boolean' value='true' migratable='yes'/> + <property name='sse4-1' type='boolean' value='true' migratable='yes'/> + <property name='family' type='number' value='6'/> + <property name='legacy-cache' type='boolean' value='true' migratable='yes'/> + <property name='host-phys-bits-limit' type='number' value='0'/> + <property name='vmware-cpuid-freq' type='boolean' value='true' migratable='yes'/> + <property name='wbnoinvd' type='boolean' value='false'/> + <property name='avx512f' type='boolean' value='false'/> + <property name='msr' type='boolean' value='true' migratable='yes'/> + <property name='mce' type='boolean' value='true' migratable='yes'/> + <property name='mca' type='boolean' value='true' migratable='yes'/> + <property name='hv-runtime' type='boolean' value='false'/> + <property name='xcrypt' type='boolean' value='false'/> + <property name='thread-id' type='number' value='-1'/> + <property name='min-level' type='number' value='13'/> + <property name='xgetbv1' type='boolean' value='true' migratable='yes'/> + <property name='cid' type='boolean' value='false'/> + <property name='hv-relaxed' type='boolean' value='false'/> + <property name='hv-crash' type='boolean' value='false'/> + <property name='ds' type='boolean' value='false'/> + <property name='fxsr' type='boolean' value='true' migratable='yes'/> + <property name='xsaveopt' type='boolean' value='true' migratable='yes'/> + <property name='xtpr' type='boolean' value='false'/> + <property name='hv-evmcs' type='boolean' value='false'/> + <property name='avx512vl' type='boolean' value='false'/> + <property name='avx512-vpopcntdq' type='boolean' value='false'/> + <property name='phe' type='boolean' value='false'/> + <property name='extapic' type='boolean' value='false'/> + <property name='3dnowprefetch' type='boolean' value='false'/> + <property name='avx512vbmi2' type='boolean' value='false'/> + <property name='cr8legacy' type='boolean' value='true' migratable='yes'/> + <property name='stibp' type='boolean' value='false'/> + <property name='cpuid-0xb' type='boolean' value='true' migratable='yes'/> + <property name='xcrypt-en' type='boolean' value='false'/> + <property name='kvm_pv_eoi' type='boolean' value='false'/> + <property name='apic-id' type='number' value='4294967295'/> + <property name='rsba' type='boolean' value='false'/> + <property name='pn' type='boolean' value='false'/> + <property name='dca' type='boolean' value='false'/> + <property name='vendor' type='string' value='AuthenticAMD'/> + <property name='hv-ipi' type='boolean' value='false'/> + <property name='pku' type='boolean' value='true' migratable='yes'/> + <property name='smx' type='boolean' value='false'/> + <property name='cmp_legacy' type='boolean' value='false'/> + <property name='cmp-legacy' type='boolean' value='false'/> + <property name='node-id' type='number' value='-1'/> + <property name='avx512-4fmaps' type='boolean' value='false'/> + <property name='vmcb_clean' type='boolean' value='false'/> + <property name='vmcb-clean' type='boolean' value='false'/> + <property name='3dnowext' type='boolean' value='true' migratable='yes'/> + <property name='amd-no-ssb' type='boolean' value='false'/> + <property name='hle' type='boolean' value='false'/> + <property name='npt' type='boolean' value='true' migratable='yes'/> + <property name='rdctl-no' type='boolean' value='false'/> + <property name='memory' type='string' value='/machine/unattached/system[0]'/> + <property name='clwb' type='boolean' value='true' migratable='yes'/> + <property name='lbrv' type='boolean' value='false'/> + <property name='adx' type='boolean' value='true' migratable='yes'/> + <property name='ss' type='boolean' value='true' migratable='yes'/> + <property name='pni' type='boolean' value='true' migratable='yes'/> + <property name='svm_lock' type='boolean' value='false'/> + <property name='svm-lock' type='boolean' value='false'/> + <property name='pfthreshold' type='boolean' value='false'/> + <property name='smep' type='boolean' value='true' migratable='yes'/> + <property name='smap' type='boolean' value='true' migratable='yes'/> + <property name='x2apic' type='boolean' value='false'/> + <property name='avx512vbmi' type='boolean' value='false'/> + <property name='avx512vnni' type='boolean' value='false'/> + <property name='hv-stimer' type='boolean' value='false'/> + <property name='x-hv-synic-kvm-only' type='boolean' value='false'/> + <property name='i64' type='boolean' value='true' migratable='yes'/> + <property name='flushbyasid' type='boolean' value='false'/> + <property name='f16c' type='boolean' value='false'/> + <property name='ace2-en' type='boolean' value='false'/> + <property name='pat' type='boolean' value='true' migratable='yes'/> + <property name='pae' type='boolean' value='true' migratable='yes'/> + <property name='sse' type='boolean' value='true' migratable='yes'/> + <property name='phe-en' type='boolean' value='false'/> + <property name='kvm_nopiodelay' type='boolean' value='false'/> + <property name='kvm-nopiodelay' type='boolean' value='false'/> + <property name='tm' type='boolean' value='false'/> + <property name='kvmclock-stable-bit' type='boolean' value='false'/> + <property name='hypervisor' type='boolean' value='true' migratable='yes'/> + <property name='socket-id' type='number' value='-1'/> + <property name='pcommit' type='boolean' value='true' migratable='yes'/> + <property name='syscall' type='boolean' value='true' migratable='yes'/> + <property name='level' type='number' value='13'/> + <property name='avx512dq' type='boolean' value='false'/> + <property name='x-migrate-smi-count' type='boolean' value='true' migratable='yes'/> + <property name='svm' type='boolean' value='true' migratable='yes'/> + <property name='full-cpuid-auto-level' type='boolean' value='true' migratable='yes'/> + <property name='hv-reset' type='boolean' value='false'/> + <property name='invtsc' type='boolean' value='false'/> + <property name='sse3' type='boolean' value='true' migratable='yes'/> + <property name='sse2' type='boolean' value='true' migratable='yes'/> + <property name='ssbd' type='boolean' value='false'/> + <property name='est' type='boolean' value='false'/> + <property name='avx512ifma' type='boolean' value='false'/> + <property name='tm2' type='boolean' value='false'/> + <property name='kvm-pv-ipi' type='boolean' value='false'/> + <property name='kvm-pv-eoi' type='boolean' value='false'/> + <property name='cx8' type='boolean' value='true' migratable='yes'/> + <property name='cldemote' type='boolean' value='false'/> + <property name='hv-reenlightenment' type='boolean' value='false'/> + <property name='kvm_mmu' type='boolean' value='false'/> + <property name='kvm-mmu' type='boolean' value='false'/> + <property name='sse4_2' type='boolean' value='true' migratable='yes'/> + <property name='sse4.2' type='boolean' value='true' migratable='yes'/> + <property name='sse4-2' type='boolean' value='true' migratable='yes'/> + <property name='pge' type='boolean' value='true' migratable='yes'/> + <property name='fill-mtrr-mask' type='boolean' value='true' migratable='yes'/> + <property name='avx512bitalg' type='boolean' value='false'/> + <property name='nodeid_msr' type='boolean' value='false'/> + <property name='pdcm' type='boolean' value='false'/> + <property name='movbe' type='boolean' value='true' migratable='yes'/> + <property name='model' type='number' value='6'/> + <property name='nrip_save' type='boolean' value='false'/> + <property name='nrip-save' type='boolean' value='false'/> + <property name='kvm_pv_unhalt' type='boolean' value='false'/> + <property name='ssse3' type='boolean' value='true' migratable='yes'/> + <property name='sse4a' type='boolean' value='true' migratable='yes'/> + <property name='invpcid' type='boolean' value='false'/> + <property name='pdpe1gb' type='boolean' value='true' migratable='yes'/> + <property name='tsc-deadline' type='boolean' value='false'/> + <property name='skip-l1dfl-vmentry' type='boolean' value='false'/> + <property name='fma' type='boolean' value='false'/> + <property name='cx16' type='boolean' value='true' migratable='yes'/> + <property name='de' type='boolean' value='true' migratable='yes'/> + <property name='pconfig' type='boolean' value='false'/> + <property name='enforce' type='boolean' value='false'/> + <property name='stepping' type='number' value='3'/> + <property name='xsave' type='boolean' value='true' migratable='yes'/> + <property name='clflush' type='boolean' value='true' migratable='yes'/> + <property name='skinit' type='boolean' value='false'/> + <property name='tsc' type='boolean' value='true' migratable='yes'/> + <property name='tce' type='boolean' value='false'/> + <property name='fpu' type='boolean' value='true' migratable='yes'/> + <property name='ibs' type='boolean' value='false'/> + <property name='ds_cpl' type='boolean' value='false'/> + <property name='ds-cpl' type='boolean' value='false'/> + <property name='host-phys-bits' type='boolean' value='false'/> + <property name='fma4' type='boolean' value='false'/> + <property name='la57' type='boolean' value='true' migratable='yes'/> + <property name='osvw' type='boolean' value='false'/> + <property name='check' type='boolean' value='true' migratable='yes'/> + <property name='hv-spinlocks' type='number' value='-1'/> + <property name='pmu' type='boolean' value='false'/> + <property name='pmm' type='boolean' value='false'/> + <property name='apic' type='boolean' value='true' migratable='yes'/> + <property name='spec-ctrl' type='boolean' value='false'/> + <property name='min-xlevel2' type='number' value='0'/> + <property name='tsc-adjust' type='boolean' value='false'/> + <property name='tsc_adjust' type='boolean' value='false'/> + <property name='kvm-steal-time' type='boolean' value='false'/> + <property name='kvm_steal_time' type='boolean' value='false'/> + <property name='kvmclock' type='boolean' value='false'/> + <property name='l3-cache' type='boolean' value='true' migratable='yes'/> + <property name='lwp' type='boolean' value='false'/> + <property name='amd-ssbd' type='boolean' value='false'/> + <property name='ibpb' type='boolean' value='false'/> + <property name='xop' type='boolean' value='false'/> + <property name='avx' type='boolean' value='false'/> + <property name='movdiri' type='boolean' value='false'/> + <property name='ace2' type='boolean' value='false'/> + <property name='avx512bw' type='boolean' value='false'/> + <property name='acpi' type='boolean' value='true' migratable='yes'/> + <property name='hv-vapic' type='boolean' value='false'/> + <property name='fsgsbase' type='boolean' value='true' migratable='yes'/> + <property name='ht' type='boolean' value='false'/> + <property name='nx' type='boolean' value='true' migratable='yes'/> + <property name='pclmulqdq' type='boolean' value='true' migratable='yes'/> + <property name='mmxext' type='boolean' value='true' migratable='yes'/> + <property name='vaes' type='boolean' value='false'/> + <property name='popcnt' type='boolean' value='true' migratable='yes'/> + <property name='xsaves' type='boolean' value='false'/> + <property name='movdir64b' type='boolean' value='false'/> + <property name='tcg-cpuid' type='boolean' value='true' migratable='yes'/> + <property name='lm' type='boolean' value='true' migratable='yes'/> + <property name='umip' type='boolean' value='false'/> + <property name='pse' type='boolean' value='true' migratable='yes'/> + <property name='avx2' type='boolean' value='false'/> + <property name='sep' type='boolean' value='true' migratable='yes'/> + <property name='pclmuldq' type='boolean' value='true' migratable='yes'/> + <property name='virt-ssbd' type='boolean' value='false'/> + <property name='x-hv-max-vps' type='number' value='-1'/> + <property name='nodeid-msr' type='boolean' value='false'/> + <property name='kvm' type='boolean' value='true' migratable='yes'/> + <property name='misalignsse' type='boolean' value='false'/> + <property name='min-xlevel' type='number' value='2147483658'/> + <property name='kvm-pv-unhalt' type='boolean' value='false'/> + <property name='bmi2' type='boolean' value='true' migratable='yes'/> + <property name='bmi1' type='boolean' value='true' migratable='yes'/> + <property name='realized' type='boolean' value='false'/> + <property name='tsc_scale' type='boolean' value='false'/> + <property name='tsc-scale' type='boolean' value='false'/> + <property name='topoext' type='boolean' value='false'/> + <property name='hv-vpindex' type='boolean' value='false'/> + <property name='xlevel2' type='number' value='0'/> + <property name='clflushopt' type='boolean' value='true' migratable='yes'/> + <property name='kvm-no-smi-migration' type='boolean' value='false'/> + <property name='monitor' type='boolean' value='true' migratable='yes'/> + <property name='avx512er' type='boolean' value='false'/> + <property name='pmm-en' type='boolean' value='false'/> + <property name='pcid' type='boolean' value='false'/> + <property name='arch-capabilities' type='boolean' value='false'/> + <property name='3dnow' type='boolean' value='true' migratable='yes'/> + <property name='erms' type='boolean' value='true' migratable='yes'/> + <property name='lahf-lm' type='boolean' value='true' migratable='yes'/> + <property name='lahf_lm' type='boolean' value='true' migratable='yes'/> + <property name='vpclmulqdq' type='boolean' value='false'/> + <property name='fxsr-opt' type='boolean' value='false'/> + <property name='hv-synic' type='boolean' value='false'/> + <property name='xstore' type='boolean' value='false'/> + <property name='fxsr_opt' type='boolean' value='false'/> + <property name='kvm-hint-dedicated' type='boolean' value='false'/> + <property name='rtm' type='boolean' value='false'/> + <property name='lmce' type='boolean' value='false'/> + <property name='hv-time' type='boolean' value='false'/> + <property name='perfctr-nb' type='boolean' value='false'/> + <property name='perfctr_nb' type='boolean' value='false'/> + <property name='ffxsr' type='boolean' value='false'/> + <property name='hv-tlbflush' type='boolean' value='false'/> + <property name='rdrand' type='boolean' value='false'/> + <property name='rdseed' type='boolean' value='false'/> + <property name='avx512-4vnniw' type='boolean' value='false'/> + <property name='vmx' type='boolean' value='false'/> + <property name='vme' type='boolean' value='false'/> + <property name='dtes64' type='boolean' value='false'/> + <property name='mtrr' type='boolean' value='true' migratable='yes'/> + <property name='rdtscp' type='boolean' value='true' migratable='yes'/> + <property name='pse36' type='boolean' value='true' migratable='yes'/> + <property name='kvm-pv-tlb-flush' type='boolean' value='false'/> + <property name='tbm' type='boolean' value='false'/> + <property name='wdt' type='boolean' value='false'/> + <property name='pause_filter' type='boolean' value='false'/> + <property name='sha-ni' type='boolean' value='false'/> + <property name='model-id' type='string' value='QEMU TCG CPU version 2.5+'/> + <property name='abm' type='boolean' value='true' migratable='yes'/> + <property name='avx512pf' type='boolean' value='false'/> + <property name='xstore-en' type='boolean' value='false'/> + </hostCPU> + <cpu type='kvm' name='max' usable='yes'/> + <cpu type='kvm' name='host' usable='yes'/> + <cpu type='kvm' name='base' usable='yes'/> + <cpu type='kvm' name='qemu64' usable='yes'/> + <cpu type='kvm' name='qemu32' usable='yes'/> + <cpu type='kvm' name='phenom' usable='no'> + <blocker name='mmxext'/> + <blocker name='fxsr-opt'/> + <blocker name='3dnowext'/> + <blocker name='3dnow'/> + <blocker name='sse4a'/> + <blocker name='npt'/> + </cpu> + <cpu type='kvm' name='pentium3' usable='yes'/> + <cpu type='kvm' name='pentium2' usable='yes'/> + <cpu type='kvm' name='pentium' usable='yes'/> + <cpu type='kvm' name='n270' usable='yes'/> + <cpu type='kvm' name='kvm64' usable='yes'/> + <cpu type='kvm' name='kvm32' usable='yes'/> + <cpu type='kvm' name='coreduo' usable='yes'/> + <cpu type='kvm' name='core2duo' usable='yes'/> + <cpu type='kvm' name='athlon' usable='no'> + <blocker name='mmxext'/> + <blocker name='3dnowext'/> + <blocker name='3dnow'/> + </cpu> + <cpu type='kvm' name='Westmere-IBRS' usable='yes'/> + <cpu type='kvm' name='Westmere' usable='yes'/> + <cpu type='kvm' name='Skylake-Server-IBRS' usable='no'> + <blocker name='avx512f'/> + <blocker name='avx512dq'/> + <blocker name='clwb'/> + <blocker name='avx512cd'/> + <blocker name='avx512bw'/> + <blocker name='avx512vl'/> + <blocker name='pku'/> + <blocker name='avx512f'/> + <blocker name='avx512f'/> + <blocker name='avx512f'/> + <blocker name='pku'/> + </cpu> + <cpu type='kvm' name='Skylake-Server' usable='no'> + <blocker name='avx512f'/> + <blocker name='avx512dq'/> + <blocker name='clwb'/> + <blocker name='avx512cd'/> + <blocker name='avx512bw'/> + <blocker name='avx512vl'/> + <blocker name='pku'/> + <blocker name='avx512f'/> + <blocker name='avx512f'/> + <blocker name='avx512f'/> + <blocker name='pku'/> + </cpu> + <cpu type='kvm' name='Skylake-Client-IBRS' usable='yes'/> + <cpu type='kvm' name='Skylake-Client' usable='yes'/> + <cpu type='kvm' name='SandyBridge-IBRS' usable='yes'/> + <cpu type='kvm' name='SandyBridge' usable='yes'/> + <cpu type='kvm' name='Penryn' usable='yes'/> + <cpu type='kvm' name='Opteron_G5' usable='no'> + <blocker name='sse4a'/> + <blocker name='misalignsse'/> + <blocker name='xop'/> + <blocker name='fma4'/> + <blocker name='tbm'/> + <blocker name='npt'/> + <blocker name='nrip-save'/> + </cpu> + <cpu type='kvm' name='Opteron_G4' usable='no'> + <blocker name='sse4a'/> + <blocker name='misalignsse'/> + <blocker name='xop'/> + <blocker name='fma4'/> + <blocker name='npt'/> + <blocker name='nrip-save'/> + </cpu> + <cpu type='kvm' name='Opteron_G3' usable='no'> + <blocker name='sse4a'/> + <blocker name='misalignsse'/> + </cpu> + <cpu type='kvm' name='Opteron_G2' usable='yes'/> + <cpu type='kvm' name='Opteron_G1' usable='yes'/> + <cpu type='kvm' name='Nehalem-IBRS' usable='yes'/> + <cpu type='kvm' name='Nehalem' usable='yes'/> + <cpu type='kvm' name='KnightsMill' usable='no'> + <blocker name='avx512f'/> + <blocker name='avx512pf'/> + <blocker name='avx512er'/> + <blocker name='avx512cd'/> + <blocker name='avx512-vpopcntdq'/> + <blocker name='avx512-4vnniw'/> + <blocker name='avx512-4fmaps'/> + <blocker name='avx512f'/> + <blocker name='avx512f'/> + <blocker name='avx512f'/> + </cpu> + <cpu type='kvm' name='IvyBridge-IBRS' usable='yes'/> + <cpu type='kvm' name='IvyBridge' usable='yes'/> + <cpu type='kvm' name='Icelake-Server' usable='no'> + <blocker name='avx512f'/> + <blocker name='avx512dq'/> + <blocker name='clwb'/> + <blocker name='intel-pt'/> + <blocker name='avx512cd'/> + <blocker name='avx512bw'/> + <blocker name='avx512vl'/> + <blocker name='avx512vbmi'/> + <blocker name='pku'/> + <blocker name=''/> + <blocker name='avx512vbmi2'/> + <blocker name='gfni'/> + <blocker name='vaes'/> + <blocker name='vpclmulqdq'/> + <blocker name='avx512vnni'/> + <blocker name='avx512bitalg'/> + <blocker name='avx512-vpopcntdq'/> + <blocker name='la57'/> + <blocker name='pconfig'/> + <blocker name='wbnoinvd'/> + <blocker name='avx512f'/> + <blocker name='avx512f'/> + <blocker name='avx512f'/> + <blocker name='pku'/> + </cpu> + <cpu type='kvm' name='Icelake-Client' usable='no'> + <blocker name='intel-pt'/> + <blocker name='avx512vbmi'/> + <blocker name='pku'/> + <blocker name=''/> + <blocker name='avx512vbmi2'/> + <blocker name='gfni'/> + <blocker name='vaes'/> + <blocker name='vpclmulqdq'/> + <blocker name='avx512vnni'/> + <blocker name='avx512bitalg'/> + <blocker name='avx512-vpopcntdq'/> + <blocker name='wbnoinvd'/> + <blocker name='pku'/> + </cpu> + <cpu type='kvm' name='Haswell-noTSX-IBRS' usable='yes'/> + <cpu type='kvm' name='Haswell-noTSX' usable='yes'/> + <cpu type='kvm' name='Haswell-IBRS' usable='yes'/> + <cpu type='kvm' name='Haswell' usable='yes'/> + <cpu type='kvm' name='EPYC-IBPB' usable='no'> + <blocker name='sha-ni'/> + <blocker name='mmxext'/> + <blocker name='fxsr-opt'/> + <blocker name='cr8legacy'/> + <blocker name='sse4a'/> + <blocker name='misalignsse'/> + <blocker name='osvw'/> + <blocker name='ibpb'/> + <blocker name='npt'/> + <blocker name='nrip-save'/> + </cpu> + <cpu type='kvm' name='EPYC' usable='no'> + <blocker name='sha-ni'/> + <blocker name='mmxext'/> + <blocker name='fxsr-opt'/> + <blocker name='cr8legacy'/> + <blocker name='sse4a'/> + <blocker name='misalignsse'/> + <blocker name='osvw'/> + <blocker name='npt'/> + <blocker name='nrip-save'/> + </cpu> + <cpu type='kvm' name='Conroe' usable='yes'/> + <cpu type='kvm' name='Cascadelake-Server' usable='no'> + <blocker name='avx512f'/> + <blocker name='avx512dq'/> + <blocker name='clwb'/> + <blocker name='intel-pt'/> + <blocker name='avx512cd'/> + <blocker name='avx512bw'/> + <blocker name='avx512vl'/> + <blocker name='pku'/> + <blocker name=''/> + <blocker name='avx512vnni'/> + <blocker name='avx512f'/> + <blocker name='avx512f'/> + <blocker name='avx512f'/> + <blocker name='pku'/> + </cpu> + <cpu type='kvm' name='Broadwell-noTSX-IBRS' usable='yes'/> + <cpu type='kvm' name='Broadwell-noTSX' usable='yes'/> + <cpu type='kvm' name='Broadwell-IBRS' usable='yes'/> + <cpu type='kvm' name='Broadwell' usable='yes'/> + <cpu type='kvm' name='486' usable='yes'/> + <cpu type='tcg' name='max' usable='yes'/> + <cpu type='tcg' name='host' usable='no'> + <blocker name='kvm'/> + </cpu> + <cpu type='tcg' name='base' usable='yes'/> + <cpu type='tcg' name='qemu64' usable='yes'/> + <cpu type='tcg' name='qemu32' usable='yes'/> + <cpu type='tcg' name='phenom' usable='no'> + <blocker name='fxsr-opt'/> + </cpu> + <cpu type='tcg' name='pentium3' usable='yes'/> + <cpu type='tcg' name='pentium2' usable='yes'/> + <cpu type='tcg' name='pentium' usable='yes'/> + <cpu type='tcg' name='n270' usable='yes'/> + <cpu type='tcg' name='kvm64' usable='yes'/> + <cpu type='tcg' name='kvm32' usable='yes'/> + <cpu type='tcg' name='coreduo' usable='yes'/> + <cpu type='tcg' name='core2duo' usable='yes'/> + <cpu type='tcg' name='athlon' usable='yes'/> + <cpu type='tcg' name='Westmere-IBRS' usable='no'> + <blocker name='spec-ctrl'/> + </cpu> + <cpu type='tcg' name='Westmere' usable='yes'/> + <cpu type='tcg' name='Skylake-Server-IBRS' usable='no'> + <blocker name='fma'/> + <blocker name='pcid'/> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='hle'/> + <blocker name='avx2'/> + <blocker name='invpcid'/> + <blocker name='rtm'/> + <blocker name='avx512f'/> + <blocker name='avx512dq'/> + <blocker name='rdseed'/> + <blocker name='avx512cd'/> + <blocker name='avx512bw'/> + <blocker name='avx512vl'/> + <blocker name='spec-ctrl'/> + <blocker name='3dnowprefetch'/> + <blocker name='xsavec'/> + </cpu> + <cpu type='tcg' name='Skylake-Server' usable='no'> + <blocker name='fma'/> + <blocker name='pcid'/> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='hle'/> + <blocker name='avx2'/> + <blocker name='invpcid'/> + <blocker name='rtm'/> + <blocker name='avx512f'/> + <blocker name='avx512dq'/> + <blocker name='rdseed'/> + <blocker name='avx512cd'/> + <blocker name='avx512bw'/> + <blocker name='avx512vl'/> + <blocker name='3dnowprefetch'/> + <blocker name='xsavec'/> + </cpu> + <cpu type='tcg' name='Skylake-Client-IBRS' usable='no'> + <blocker name='fma'/> + <blocker name='pcid'/> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='hle'/> + <blocker name='avx2'/> + <blocker name='invpcid'/> + <blocker name='rtm'/> + <blocker name='rdseed'/> + <blocker name='spec-ctrl'/> + <blocker name='3dnowprefetch'/> + <blocker name='xsavec'/> + </cpu> + <cpu type='tcg' name='Skylake-Client' usable='no'> + <blocker name='fma'/> + <blocker name='pcid'/> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='hle'/> + <blocker name='avx2'/> + <blocker name='invpcid'/> + <blocker name='rtm'/> + <blocker name='rdseed'/> + <blocker name='3dnowprefetch'/> + <blocker name='xsavec'/> + </cpu> + <cpu type='tcg' name='SandyBridge-IBRS' usable='no'> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='spec-ctrl'/> + </cpu> + <cpu type='tcg' name='SandyBridge' usable='no'> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + </cpu> + <cpu type='tcg' name='Penryn' usable='yes'/> + <cpu type='tcg' name='Opteron_G5' usable='no'> + <blocker name='fma'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='misalignsse'/> + <blocker name='3dnowprefetch'/> + <blocker name='xop'/> + <blocker name='fma4'/> + <blocker name='tbm'/> + <blocker name='nrip-save'/> + </cpu> + <cpu type='tcg' name='Opteron_G4' usable='no'> + <blocker name='avx'/> + <blocker name='misalignsse'/> + <blocker name='3dnowprefetch'/> + <blocker name='xop'/> + <blocker name='fma4'/> + <blocker name='nrip-save'/> + </cpu> + <cpu type='tcg' name='Opteron_G3' usable='no'> + <blocker name='misalignsse'/> + </cpu> + <cpu type='tcg' name='Opteron_G2' usable='yes'/> + <cpu type='tcg' name='Opteron_G1' usable='yes'/> + <cpu type='tcg' name='Nehalem-IBRS' usable='no'> + <blocker name='spec-ctrl'/> + </cpu> + <cpu type='tcg' name='Nehalem' usable='yes'/> + <cpu type='tcg' name='KnightsMill' usable='no'> + <blocker name='fma'/> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='avx2'/> + <blocker name='avx512f'/> + <blocker name='rdseed'/> + <blocker name='avx512pf'/> + <blocker name='avx512er'/> + <blocker name='avx512cd'/> + <blocker name='avx512-vpopcntdq'/> + <blocker name='avx512-4vnniw'/> + <blocker name='avx512-4fmaps'/> + <blocker name='3dnowprefetch'/> + </cpu> + <cpu type='tcg' name='IvyBridge-IBRS' usable='no'> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='spec-ctrl'/> + </cpu> + <cpu type='tcg' name='IvyBridge' usable='no'> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + </cpu> + <cpu type='tcg' name='Icelake-Server' usable='no'> + <blocker name='fma'/> + <blocker name='pcid'/> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='hle'/> + <blocker name='avx2'/> + <blocker name='invpcid'/> + <blocker name='rtm'/> + <blocker name='avx512f'/> + <blocker name='avx512dq'/> + <blocker name='rdseed'/> + <blocker name='intel-pt'/> + <blocker name='avx512cd'/> + <blocker name='avx512bw'/> + <blocker name='avx512vl'/> + <blocker name='avx512vbmi'/> + <blocker name='umip'/> + <blocker name=''/> + <blocker name='avx512vbmi2'/> + <blocker name='gfni'/> + <blocker name='vaes'/> + <blocker name='vpclmulqdq'/> + <blocker name='avx512vnni'/> + <blocker name='avx512bitalg'/> + <blocker name='avx512-vpopcntdq'/> + <blocker name='pconfig'/> + <blocker name='spec-ctrl'/> + <blocker name='ssbd'/> + <blocker name='3dnowprefetch'/> + <blocker name='wbnoinvd'/> + <blocker name='xsavec'/> + </cpu> + <cpu type='tcg' name='Icelake-Client' usable='no'> + <blocker name='fma'/> + <blocker name='pcid'/> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='hle'/> + <blocker name='avx2'/> + <blocker name='invpcid'/> + <blocker name='rtm'/> + <blocker name='rdseed'/> + <blocker name='intel-pt'/> + <blocker name='avx512vbmi'/> + <blocker name='umip'/> + <blocker name=''/> + <blocker name='avx512vbmi2'/> + <blocker name='gfni'/> + <blocker name='vaes'/> + <blocker name='vpclmulqdq'/> + <blocker name='avx512vnni'/> + <blocker name='avx512bitalg'/> + <blocker name='avx512-vpopcntdq'/> + <blocker name='spec-ctrl'/> + <blocker name='ssbd'/> + <blocker name='3dnowprefetch'/> + <blocker name='wbnoinvd'/> + <blocker name='xsavec'/> + </cpu> + <cpu type='tcg' name='Haswell-noTSX-IBRS' usable='no'> + <blocker name='fma'/> + <blocker name='pcid'/> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='avx2'/> + <blocker name='invpcid'/> + <blocker name='spec-ctrl'/> + </cpu> + <cpu type='tcg' name='Haswell-noTSX' usable='no'> + <blocker name='fma'/> + <blocker name='pcid'/> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='avx2'/> + <blocker name='invpcid'/> + </cpu> + <cpu type='tcg' name='Haswell-IBRS' usable='no'> + <blocker name='fma'/> + <blocker name='pcid'/> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='hle'/> + <blocker name='avx2'/> + <blocker name='invpcid'/> + <blocker name='rtm'/> + <blocker name='spec-ctrl'/> + </cpu> + <cpu type='tcg' name='Haswell' usable='no'> + <blocker name='fma'/> + <blocker name='pcid'/> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='hle'/> + <blocker name='avx2'/> + <blocker name='invpcid'/> + <blocker name='rtm'/> + </cpu> + <cpu type='tcg' name='EPYC-IBPB' usable='no'> + <blocker name='fma'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='avx2'/> + <blocker name='rdseed'/> + <blocker name='sha-ni'/> + <blocker name='fxsr-opt'/> + <blocker name='misalignsse'/> + <blocker name='3dnowprefetch'/> + <blocker name='osvw'/> + <blocker name='topoext'/> + <blocker name='ibpb'/> + <blocker name='nrip-save'/> + <blocker name='xsavec'/> + </cpu> + <cpu type='tcg' name='EPYC' usable='no'> + <blocker name='fma'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='avx2'/> + <blocker name='rdseed'/> + <blocker name='sha-ni'/> + <blocker name='fxsr-opt'/> + <blocker name='misalignsse'/> + <blocker name='3dnowprefetch'/> + <blocker name='osvw'/> + <blocker name='topoext'/> + <blocker name='nrip-save'/> + <blocker name='xsavec'/> + </cpu> + <cpu type='tcg' name='Conroe' usable='yes'/> + <cpu type='tcg' name='Cascadelake-Server' usable='no'> + <blocker name='fma'/> + <blocker name='pcid'/> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='hle'/> + <blocker name='avx2'/> + <blocker name='invpcid'/> + <blocker name='rtm'/> + <blocker name='avx512f'/> + <blocker name='avx512dq'/> + <blocker name='rdseed'/> + <blocker name='intel-pt'/> + <blocker name='avx512cd'/> + <blocker name='avx512bw'/> + <blocker name='avx512vl'/> + <blocker name=''/> + <blocker name='avx512vnni'/> + <blocker name='spec-ctrl'/> + <blocker name='ssbd'/> + <blocker name='3dnowprefetch'/> + <blocker name='xsavec'/> + </cpu> + <cpu type='tcg' name='Broadwell-noTSX-IBRS' usable='no'> + <blocker name='fma'/> + <blocker name='pcid'/> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='avx2'/> + <blocker name='invpcid'/> + <blocker name='rdseed'/> + <blocker name='spec-ctrl'/> + <blocker name='3dnowprefetch'/> + </cpu> + <cpu type='tcg' name='Broadwell-noTSX' usable='no'> + <blocker name='fma'/> + <blocker name='pcid'/> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='avx2'/> + <blocker name='invpcid'/> + <blocker name='rdseed'/> + <blocker name='3dnowprefetch'/> + </cpu> + <cpu type='tcg' name='Broadwell-IBRS' usable='no'> + <blocker name='fma'/> + <blocker name='pcid'/> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='hle'/> + <blocker name='avx2'/> + <blocker name='invpcid'/> + <blocker name='rtm'/> + <blocker name='rdseed'/> + <blocker name='spec-ctrl'/> + <blocker name='3dnowprefetch'/> + </cpu> + <cpu type='tcg' name='Broadwell' usable='no'> + <blocker name='fma'/> + <blocker name='pcid'/> + <blocker name='x2apic'/> + <blocker name='tsc-deadline'/> + <blocker name='avx'/> + <blocker name='f16c'/> + <blocker name='rdrand'/> + <blocker name='hle'/> + <blocker name='avx2'/> + <blocker name='invpcid'/> + <blocker name='rtm'/> + <blocker name='rdseed'/> + <blocker name='3dnowprefetch'/> + </cpu> + <cpu type='tcg' name='486' usable='yes'/> + <machine name='pc-i440fx-4.0' alias='pc' hotplugCpus='yes' maxCpus='255' default='yes'/> + <machine name='isapc' hotplugCpus='yes' maxCpus='1'/> + <machine name='pc-1.1' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-1.2' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-1.3' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-i440fx-2.8' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-1.0' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-i440fx-2.9' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-i440fx-2.6' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-i440fx-2.7' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-i440fx-2.3' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-i440fx-2.4' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-i440fx-2.5' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-i440fx-2.1' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-i440fx-2.2' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-q35-3.1' hotplugCpus='yes' maxCpus='288'/> + <machine name='pc-i440fx-2.0' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-q35-2.11' hotplugCpus='yes' maxCpus='288'/> + <machine name='pc-q35-2.12' hotplugCpus='yes' maxCpus='288'/> + <machine name='pc-q35-3.0' hotplugCpus='yes' maxCpus='288'/> + <machine name='pc-q35-2.10' hotplugCpus='yes' maxCpus='288'/> + <machine name='pc-i440fx-1.7' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-q35-2.9' hotplugCpus='yes' maxCpus='288'/> + <machine name='pc-0.15' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-i440fx-1.5' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-q35-2.7' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-i440fx-1.6' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-i440fx-2.11' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-q35-2.8' hotplugCpus='yes' maxCpus='288'/> + <machine name='pc-0.13' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-i440fx-2.12' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-0.14' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-i440fx-3.0' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-i440fx-3.1' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-q35-2.4' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-q35-2.5' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-q35-2.6' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-i440fx-2.10' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-i440fx-1.4' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-0.12' hotplugCpus='yes' maxCpus='255'/> + <machine name='pc-q35-4.0' alias='q35' hotplugCpus='yes' maxCpus='288'/> + <mktme> + <keys_supported>15</keys_supported> + </mktme> +</qemuCaps> -- 2.21.0.windows.1

4 3

[libvirt] [PATCH 0/3] Trivial fixes mocking fixes
by Michal Privoznik 07 May '19

07 May '19

I'm not pushing these just yet. I'm leaving some time for our grammar enthusiasts to fix my grammar. Michal Prívozník (3): virfilemock: Init symbols in canonicalize_file_name() virtestmock: Initialize symbols from stat() and its friends lib: Build sources before running 'check-access' Makefile.am | 2 +- tests/virfilemock.c | 3 +++ tests/virtestmock.c | 4 +++- 3 files changed, 7 insertions(+), 2 deletions(-) -- 2.21.0

2 6

[libvirt] [PATCH 0/4] tests: Add capabilities for s390x
by Boris Fiuczynski 07 May '19

07 May '19

This series adds the capabilities of QEMU 3.1.0 and 4.0.0 on s390x. Boris Fiuczynski (4): tests: Add capabilities for QEMU 3.1.0 on s390x tests: domaincaps: Add QEMU 3.1.0 for s390x tests: Add capabilities for QEMU 4.0.0 on s390x tests: domaincaps: Add QEMU 4.0.0 for s390x .../domaincapsschemadata/qemu_3.1.0.s390x.xml | 196 + .../domaincapsschemadata/qemu_4.0.0.s390x.xml | 198 + tests/domaincapstest.c | 8 + .../caps_3.1.0.s390x.replies | 20893 +++++++++++++++ .../qemucapabilitiesdata/caps_3.1.0.s390x.xml | 2728 ++ .../caps_4.0.0.s390x.replies | 21514 ++++++++++++++++ .../qemucapabilitiesdata/caps_4.0.0.s390x.xml | 2894 +++ ...othreads-virtio-scsi-ccw.s390x-latest.args | 6 +- .../s390x-ccw-graphics.s390x-latest.args | 2 +- .../s390x-ccw-headless.s390x-latest.args | 2 +- .../vhost-vsock-ccw-auto.s390x-latest.args | 2 +- .../vhost-vsock-ccw.s390x-latest.args | 2 +- 12 files changed, 48438 insertions(+), 7 deletions(-) create mode 100644 tests/domaincapsschemadata/qemu_3.1.0.s390x.xml create mode 100644 tests/domaincapsschemadata/qemu_4.0.0.s390x.xml create mode 100644 tests/qemucapabilitiesdata/caps_3.1.0.s390x.replies create mode 100644 tests/qemucapabilitiesdata/caps_3.1.0.s390x.xml create mode 100644 tests/qemucapabilitiesdata/caps_4.0.0.s390x.replies create mode 100644 tests/qemucapabilitiesdata/caps_4.0.0.s390x.xml -- 2.17.0

2 10

[libvirt] [PATCH 0/5] tests: Refresh/add capabilities for QEMU 4.0.0
by Andrea Bolognani 06 May '19

06 May '19

Now that it's officially out, we can refresh existing capabilities created from git snapshots and introduce them for the architectures where they were missing altogether. This series covers all architectures except for s390x, to which I don't have convenient access: Pino promised me he'd take care of that one in a few days. As usual for this kind of series, most patches have been snipped with extreme prejudice in order to make them small enough that they wouldn't end up in the moderation queue: the unabridged version can be found at https://github.com/andreabolognani/libvirt in the 'qemucaps-4.0.0' branch. It'd be great if we could sneak these in during the freeze so that I won't have to possibly regenerate them again after the post-release merge flood ;) Andrea Bolognani (5): tests: Refresh capabilities for QEMU 4.0.0 on x86_64 tests: Refresh capabilities for QEMU 4.0.0 on riscv32 tests: Refresh capabilities for QEMU 4.0.0 on riscv64 tests: Add capabilities for QEMU 4.0.0 on aarch64 tests: Add capabilities for QEMU 4.0.0 on ppc64 .../qemu_4.0.0.x86_64.xml | 3 +- ...v32.replies => caps_4.0.0.aarch64.replies} | 6997 ++-- .../caps_4.0.0.aarch64.xml | 310 + ...scv32.replies => caps_4.0.0.ppc64.replies} | 29886 ++++++++++------ .../qemucapabilitiesdata/caps_4.0.0.ppc64.xml | 1077 + .../caps_4.0.0.riscv32.replies | 10 +- .../caps_4.0.0.riscv32.xml | 4 +- .../caps_4.0.0.riscv64.replies | 10 +- .../caps_4.0.0.riscv64.xml | 4 +- .../caps_4.0.0.x86_64.replies | 3331 +- .../caps_4.0.0.x86_64.xml | 38 +- ...arch64-os-firmware-efi.aarch64-latest.args | 2 +- .../aarch64-virt-graphics.aarch64-latest.args | 2 +- .../aarch64-virt-headless.aarch64-latest.args | 2 +- 14 files changed, 25862 insertions(+), 15814 deletions(-) copy tests/qemucapabilitiesdata/{caps_4.0.0.riscv32.replies => caps_4.0.0.aarch64.replies} (86%) create mode 100644 tests/qemucapabilitiesdata/caps_4.0.0.aarch64.xml copy tests/qemucapabilitiesdata/{caps_4.0.0.riscv32.replies => caps_4.0.0.ppc64.replies} (71%) create mode 100644 tests/qemucapabilitiesdata/caps_4.0.0.ppc64.xml -- 2.20.1

4 16

[libvirt] [PATCH 0/3] Couple of virBuffer fixes
by Michal Privoznik 06 May '19

06 May '19

Almost trivial. Michal Prívozník (3): virbuffer: Don't leak memory in virBufferAddBuffer virbuffer: Use signed integer for storing error virBuffer: Try harder to free buffer src/util/virbuffer.c | 7 +++---- src/util/virbuffer.h | 2 +- tests/virbuftest.c | 32 ++++++++++++++++++++++++++++++++ 3 files changed, 36 insertions(+), 5 deletions(-) -- 2.21.0

3 13

[libvirt] RElease of libvirt-5.3.0
by Daniel Veillard 04 May '19

04 May '19

A bit late, sorry I was in vacations, but the release is now tagged in git and I pushed the signed tarball and rpms to the normal place: https://libvirt.org/sources/ Please note that following discussion on last release the FTP server will soon be shutdown. I also pushed the related libvirt-python release that you can find in git and at https://libvirt.org/sources/python/ This is a balanced release, one thing to note is the removal of the support for the old 4.x VirtualBox releases New feature: - qemu: Add support for setting the emulator scheduler parameters I/O threads and vCPU threads already support setting schedulers, but until now it was impossible to do so for the main QEMU thread (emulator thread in the libvirt naming). This is, however, requested for some very specific scenarios, for example when vCPU threads are running at such priority that could starve the main thread. Removed feature: - vbox: Drop support for VirtualBox 4.x releases Support for all the 4.x releases was ended by VirtualBox maintainers in December 2015. Therefore, libvirt support for these releases is dropped. Improvements: - qemu: Use PCI by default for RISC-V guests PCI support for RISC-V guests was already available in libvirt 5.1.0, but it required the user to opt-in by manually assigning PCI addresses: with this release, RISC-V guests will use PCI automatically when running against a recent enough (4.0.0+) QEMU release. - qemu: Advertise firmware autoselection in domain capabilities The firmware autoselection feature is now exposed in domain capabilities and management applications can query for accepted values, i.e. values that are accepted and for which libvirt found firmware descriptor files. Firmware Secure Boot support is also advertised. - Drop YAJL 1 support YAJL 2 is widely adopted and maintaining side by side support for two versions is unnecessary. Bug fixes: - rpc: cleanup in virNetTLSContextNew Failed new gnutls context allocations in virNetTLSContextNew function results in double free and segfault. Occasional memory leaks may also occur. - virsh: various completers fixes There were some possible crashers, memory leaks, etc. which are now fixed. - qemu: Make hugepages work with memfd backend Due to a bug in command line generation libvirt did not honor hugepages setting with memfd backend. - Enforce ACL write permission for getting guest time & hostname Getting the guest time and hostname both require use of guest agent commands. These must not be allowed for read-only users, so the permissions check must validate "write" permission not "read". Thanks everybody for your help bringing this release up, Daniel -- Daniel Veillard | Red Hat Developers Tools http://developer.redhat.com/ veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] [jenkins-ci PATCH v2] lcitool: check for virt-install / ansible-playbook in $PATH
by Daniel P. Berrangé 03 May '19

03 May '19

This improves error reporting: $ ./lcitool install libvirt-fedora-29 ./lcitool: Failed to install 'libvirt-fedora-29': [Errno 2] No such file or directory To $ ./lcitool install libvirt-fedora-29 ./lcitool: Cannot find virt-install in $PATH Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- guests/lcitool | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/guests/lcitool b/guests/lcitool index 0f60704..d3937be 100755 --- a/guests/lcitool +++ b/guests/lcitool @@ -17,6 +17,7 @@ # with this program. If not, see <https://www.gnu.org/licenses/>. import argparse +import distutils.spawn import fnmatch import json import os @@ -461,8 +462,12 @@ class Application: "git_branch": git_branch, }) + ap_path = distutils.spawn.find_executable("ansible-playbook") + if ap_path is None: + raise Exception("Cannot find ansible-playbook in $PATH") + cmd = [ - "ansible-playbook", + ap_path, "--limit", ansible_hosts, "--extra-vars", extra_vars, ] @@ -534,8 +539,12 @@ class Application: # a kernel argument extra_arg = "console=ttyS0 ks=file:/{}".format(install_config) + vi_path = distutils.spawn.find_executable("virt-install") + if vi_path is None: + raise Exception("Cannot find virt-install in $PATH") + cmd = [ - "virt-install", + vi_path, "--name", host, "--location", facts["install_url"], "--virt-type", facts["install_virt_type"], -- 2.21.0

2 3

[libvirt] [jenkins-ci PATCH] lcitool: use yaml.safe_load instead of load
by Daniel P. Berrangé 03 May '19

03 May '19

The yaml.load() method is historically unsafe as it allowed for arbitrary code execution: ./lcitool:323: YAMLLoadWarning: calling yaml.load() without Loader=... is deprecated, as the default Loader is unsafe. Please read https://msg.pyyaml.org/load for full details. The PyYAML >= 5.1 is now safe by default, but has none the less deprecated the plain load() method to avoid risk for people running their app on older versions. For our needs safe_load() suffices and is compatible with RHEL-7 Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- guests/lcitool | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/guests/lcitool b/guests/lcitool index 1c18b5a..30b6430 100755 --- a/guests/lcitool +++ b/guests/lcitool @@ -257,7 +257,7 @@ class Inventory: @staticmethod def _add_facts_from_file(facts, yaml_path): with open(yaml_path, "r") as infile: - some_facts = yaml.load(infile) + some_facts = yaml.safe_load(infile) for fact in some_facts: facts[fact] = some_facts[fact] @@ -301,7 +301,7 @@ class Projects: try: with open(mappings_path, "r") as infile: - mappings = yaml.load(infile) + mappings = yaml.safe_load(infile) self._mappings = mappings["mappings"] except Exception as ex: raise Exception("Can't load mappings: {}".format(ex)) @@ -320,7 +320,7 @@ class Projects: try: with open(yaml_path, "r") as infile: - packages = yaml.load(infile) + packages = yaml.safe_load(infile) self._packages[project] = packages["packages"] except Exception as ex: raise Exception( -- 2.21.0

2 1

[libvirt] [jenkins-ci PATCH] lcitool: don't use SafeConfigParser under Python3
by Daniel P. Berrangé 03 May '19

03 May '19

Since Python 3.2 the SafeConfigParser class is renamed to just ConfigParser. The SafeConfigParser alias is targetted for deletion. ./lcitool:224: DeprecationWarning: The SafeConfigParser class has been renamed to ConfigParser in Python 3.2. This alias will be removed in future versions. Use ConfigParser directly instead. This switches to use ConfigParser all the time on Py3. Technically this is wrong on 3.0 and 3.1, but in reality no one will still be using those, only more modern 3.x versions, or the legacy 2.7. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- guests/lcitool | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/guests/lcitool b/guests/lcitool index d3937be..1c18b5a 100755 --- a/guests/lcitool +++ b/guests/lcitool @@ -31,9 +31,9 @@ import yaml # This is necessary to maintain Python 2.7 compatibility try: - import configparser + from configparser import ConfigParser except ImportError: - import ConfigParser as configparser + from ConfigParser import SafeConfigParser as ConfigParser class Util: @@ -221,7 +221,7 @@ class Inventory: ansible_cfg_path = os.path.join(base, "ansible.cfg") try: - parser = configparser.SafeConfigParser() + parser = ConfigParser() parser.read(ansible_cfg_path) inventory_path = parser.get("defaults", "inventory") except Exception as ex: -- 2.21.0

2 1

[libvirt] [dockerfiles PATCH 0/3] Refresh, add Fedora 30, drop Fedora 28
by Andrea Bolognani 03 May '19

03 May '19

Pushed under the Dockerfile refresh rule. Andrea Bolognani (3): Refresh after adding ncurses for libvirt Add Fedora 30 Drop Fedora 28 buildenv-centos-7.Dockerfile | 1 + buildenv-debian-9-cross-aarch64.Dockerfile | 1 + buildenv-debian-9-cross-armv6l.Dockerfile | 1 + buildenv-debian-9-cross-armv7l.Dockerfile | 1 + buildenv-debian-9-cross-mips.Dockerfile | 1 + buildenv-debian-9-cross-mips64el.Dockerfile | 1 + buildenv-debian-9-cross-mipsel.Dockerfile | 1 + buildenv-debian-9-cross-ppc64le.Dockerfile | 1 + buildenv-debian-9-cross-s390x.Dockerfile | 1 + buildenv-debian-9.Dockerfile | 1 + buildenv-debian-sid-cross-aarch64.Dockerfile | 1 + buildenv-debian-sid-cross-armv6l.Dockerfile | 1 + buildenv-debian-sid-cross-armv7l.Dockerfile | 1 + buildenv-debian-sid-cross-i686.Dockerfile | 1 + buildenv-debian-sid-cross-mips.Dockerfile | 1 + buildenv-debian-sid-cross-mips64el.Dockerfile | 1 + buildenv-debian-sid-cross-mipsel.Dockerfile | 1 + buildenv-debian-sid-cross-ppc64le.Dockerfile | 1 + buildenv-debian-sid-cross-s390x.Dockerfile | 1 + buildenv-debian-sid.Dockerfile | 1 + buildenv-fedora-29.Dockerfile | 1 + buildenv-fedora-28.Dockerfile => buildenv-fedora-30.Dockerfile | 3 ++- buildenv-fedora-rawhide.Dockerfile | 1 + buildenv-ubuntu-18.Dockerfile | 1 + 24 files changed, 25 insertions(+), 1 deletion(-) rename buildenv-fedora-28.Dockerfile => buildenv-fedora-30.Dockerfile (98%) -- 2.20.1

2 5

[libvirt] [PATCH] RFC: use a slirp helper process
by marcandre.lureau＠redhat.com 03 May '19

03 May '19

From: Marc-André Lureau <marcandre.lureau(a)redhat.com> I am throwing this away for discussions, and early feedback. With the upcoming release of libslirp[1], we have an opportunity to run SLIRP networking in a separate process. This will allow for stricter security policies for both qemu & slirp, as slirp is notoriously not very safe (discussed on ML, various CVEs, and even the code says so explicitly in the comments), yet people rely on it regularly. For network type "user", libvirt could spawn an helper process (an experimental version is [2]). It would setup a socket pair between qemu and the helper and use -net socket. qemu could then be built without libslirp! (imho, qemu should deprecate built-in -net user support, and doesn't need to grow its own sub-process handling) This libvirt patch is a bit rough, I am not sure where things should go. In particular, how to manage the subprocesses properly (security aspects, and lifecycle etc), and how to deal with migration (prevent migrating from non-helper to helper version etc). It seems guestfwd has been non-functional for a while. This is also something that the current experimental helper doesn't support atm. Doing all the various "channel" types that libvirt/qemu support would be tedious, and probably unnecessary. But the underlying libslirp library support redirections the same way qemu does today, so it could be added if necessary. At this point, the slirp-helper doesn't handle migration. But is it really worth it? From a guest POV, it would look like packet lost or disconnection. Adding migration handling is possible, to avoid a disconnection event. How should it be done? via a libvirt provided socket for storage? via its own file transferred by libvirt? via qemu somehow (qemu wouldn't really know about the external process but would copy around the migration bits?). Does the helper need to have a "standard" & capabilities, similar to what is proposed for vhost-user [3]? This would allow for easier competing implementation to emerge (I have plans in mind, not using libslirp). Thanks for the feedback! [1] https://gitlab.freedesktop.org/slirp/libslirp [2] https://github.com/elmarco/libslirp-rs [3] https://git.qemu.org/?p=qemu.git;a=blob;f=docs/interop/vhost-user.json Signed-off-by: Marc-André Lureau <marcandre.lureau(a)redhat.com> --- m4/virt-driver-qemu.m4 | 5 ++ src/qemu/libvirtd_qemu.aug | 1 + src/qemu/qemu.conf | 3 ++ src/qemu/qemu_capabilities.c | 6 +++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 38 +++++++++++--- src/qemu/qemu_command.h | 3 +- src/qemu/qemu_conf.c | 7 ++- src/qemu/qemu_conf.h | 1 + src/qemu/qemu_domain.c | 11 ++++ src/qemu/qemu_domain.h | 3 ++ src/qemu/qemu_hotplug.c | 5 +- src/qemu/qemu_interface.c | 80 ++++++++++++++++++++++++++++++ src/qemu/qemu_interface.h | 6 +++ src/qemu/test_libvirtd_qemu.aug.in | 1 + 15 files changed, 161 insertions(+), 10 deletions(-) diff --git a/m4/virt-driver-qemu.m4 b/m4/virt-driver-qemu.m4 index a1d05bbd7f..705b1f592b 100644 --- a/m4/virt-driver-qemu.m4 +++ b/m4/virt-driver-qemu.m4 @@ -105,6 +105,11 @@ AC_DEFUN([LIBVIRT_DRIVER_CHECK_QEMU], [ [/usr/bin:/usr/libexec]) AC_DEFINE_UNQUOTED([QEMU_PR_HELPER], ["$QEMU_PR_HELPER"], [QEMU PR helper]) + AC_PATH_PROG([SLIRP_HELPER], [slirp-helper], + [/usr/bin/slirp-helper], + [/usr/bin:/usr/libexec]) + AC_DEFINE_UNQUOTED([SLIRP_HELPER], ["$SLIRP_HELPER"], + [slirp helper]) ]) AC_DEFUN([LIBVIRT_DRIVER_RESULT_QEMU], [ diff --git a/src/qemu/libvirtd_qemu.aug b/src/qemu/libvirtd_qemu.aug index b311f02da6..15206454e0 100644 --- a/src/qemu/libvirtd_qemu.aug +++ b/src/qemu/libvirtd_qemu.aug @@ -88,6 +88,7 @@ module Libvirtd_qemu = | bool_entry "clear_emulator_capabilities" | str_entry "bridge_helper" | str_entry "pr_helper" + | str_entry "slirp_helper" | bool_entry "set_process_name" | int_entry "max_processes" | int_entry "max_files" diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index 334b4cd4ee..725ae791c5 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -810,6 +810,9 @@ # used whenever <reservations/> are enabled for SCSI LUN devices. #pr_helper = "/usr/bin/qemu-pr-helper" +# Path to the SLIRP networking helper. +#slirp_helper = "/usr/bin/slirp-helper" + # User for the swtpm TPM Emulator # # Default is 'tss'; this is the same user that tcsd (TrouSerS) installs diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index f8ea66b577..86cef7b9ab 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -524,6 +524,7 @@ VIR_ENUM_IMPL(virQEMUCaps, "scsi-disk.device_id", "virtio-pci-non-transitional", "overcommit", + "net-socket-dgram", ); @@ -4212,6 +4213,11 @@ virQEMUCapsInitQMPVersionCaps(virQEMUCapsPtr qemuCaps) ARCH_IS_PPC64(qemuCaps->arch)) { virQEMUCapsSet(qemuCaps, QEMU_CAPS_MACHINE_PSERIES_MAX_CPU_COMPAT); } + + /* -net socket,fd= with dgram socket (for ex, with slirp helper) */ + if (qemuCaps->version >= 3001092) { + virQEMUCapsSet(qemuCaps, QEMU_CAPS_NET_SOCKET_DGRAM); + } } diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 23ecef8c63..9db4c1bf2d 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -506,6 +506,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */ QEMU_CAPS_SCSI_DISK_DEVICE_ID, /* 'device_id' property of scsi disk */ QEMU_CAPS_VIRTIO_PCI_TRANSITIONAL, /* virtio *-pci-{non-}transitional devices */ QEMU_CAPS_OVERCOMMIT, /* -overcommit */ + QEMU_CAPS_NET_SOCKET_DGRAM, QEMU_CAPS_LAST /* this must always be the last item */ } virQEMUCapsFlags; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 9df7b7e8ea..6a047fa8f9 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -4066,7 +4066,8 @@ qemuBuildHostNetStr(virDomainNetDefPtr net, char **tapfd, size_t tapfdSize, char **vhostfd, - size_t vhostfdSize) + size_t vhostfdSize, + char *slirpfd) { bool is_tap = false; virBuffer buf = VIR_BUFFER_INITIALIZER; @@ -4137,6 +4138,12 @@ qemuBuildHostNetStr(virDomainNetDefPtr net, break; case VIR_DOMAIN_NET_TYPE_USER: + if (slirpfd) { + virBufferAsprintf(&buf, "socket,fd=%s,", + slirpfd); + break; + } + virBufferAddLit(&buf, "user,"); for (i = 0; i < net->guestIP.nips; i++) { const virNetDevIPAddr *ip = net->guestIP.ips[i]; @@ -8721,10 +8728,10 @@ qemuInterfaceVhostuserConnect(virQEMUDriverPtr driver, static int qemuBuildInterfaceCommandLine(virQEMUDriverPtr driver, + virDomainObjPtr vm, virLogManagerPtr logManager, virSecurityManagerPtr secManager, virCommandPtr cmd, - virDomainDefPtr def, virDomainNetDefPtr net, virQEMUCapsPtr qemuCaps, unsigned int bootindex, @@ -8733,6 +8740,7 @@ qemuBuildInterfaceCommandLine(virQEMUDriverPtr driver, size_t *nnicindexes, int **nicindexes) { + virDomainDefPtr def = vm->def; int ret = -1; char *nic = NULL; char *host = NULL; @@ -8743,12 +8751,13 @@ qemuBuildInterfaceCommandLine(virQEMUDriverPtr driver, size_t vhostfdSize = 0; char **tapfdName = NULL; char **vhostfdName = NULL; + int slirpfd = -1; + char *slirpfdName = NULL; virDomainNetType actualType = virDomainNetGetActualType(net); virNetDevBandwidthPtr actualBandwidth; bool requireNicdev = false; size_t i; - if (!bootindex) bootindex = net->info.bootIndex; @@ -8971,6 +8980,18 @@ qemuBuildInterfaceCommandLine(virQEMUDriverPtr driver, goto cleanup; } + if (actualType == VIR_DOMAIN_NET_TYPE_USER && + virQEMUCapsGet(qemuCaps, QEMU_CAPS_NET_SOCKET_DGRAM) && + !standalone) { + if (qemuInterfaceOpenSlirp(driver, vm, net, &slirpfd) < 0) { + goto cleanup; + } + virCommandPassFD(cmd, slirpfd, + VIR_COMMAND_PASS_FD_CLOSE_PARENT); + if (virAsprintf(&slirpfdName, "%d", slirpfd) < 0) + goto cleanup; + } + for (i = 0; i < tapfdSize; i++) { if (qemuSecuritySetTapFDLabel(driver->securityManager, def, tapfd[i]) < 0) @@ -8993,7 +9014,8 @@ qemuBuildInterfaceCommandLine(virQEMUDriverPtr driver, if (!(host = qemuBuildHostNetStr(net, driver, tapfdName, tapfdSize, - vhostfdName, vhostfdSize))) + vhostfdName, vhostfdSize, + slirpfdName))) goto cleanup; virCommandAddArgList(cmd, "-netdev", host, NULL); @@ -9032,6 +9054,7 @@ qemuBuildInterfaceCommandLine(virQEMUDriverPtr driver, virSetError(saved_err); virFreeError(saved_err); } + VIR_FREE(slirpfdName); for (i = 0; vhostfd && i < vhostfdSize && vhostfd[i] >= 0; i++) { if (ret < 0) VIR_FORCE_CLOSE(vhostfd[i]); @@ -9061,10 +9084,10 @@ qemuBuildInterfaceCommandLine(virQEMUDriverPtr driver, */ static int qemuBuildNetCommandLine(virQEMUDriverPtr driver, + virDomainObjPtr vm, virLogManagerPtr logManager, virSecurityManagerPtr secManager, virCommandPtr cmd, - virDomainDefPtr def, virQEMUCapsPtr qemuCaps, virNetDevVPortProfileOp vmop, bool standalone, @@ -9075,6 +9098,7 @@ qemuBuildNetCommandLine(virQEMUDriverPtr driver, size_t i; int last_good_net = -1; virErrorPtr originalError = NULL; + virDomainDefPtr def = vm->def; if (def->nnets) { unsigned int bootNet = 0; @@ -9090,7 +9114,7 @@ qemuBuildNetCommandLine(virQEMUDriverPtr driver, for (i = 0; i < def->nnets; i++) { virDomainNetDefPtr net = def->nets[i]; - if (qemuBuildInterfaceCommandLine(driver, logManager, secManager, cmd, def, net, + if (qemuBuildInterfaceCommandLine(driver, vm, logManager, secManager, cmd, net, qemuCaps, bootNet, vmop, standalone, nnicindexes, nicindexes) < 0) @@ -10818,7 +10842,7 @@ qemuBuildCommandLine(virQEMUDriverPtr driver, if (qemuBuildFSDevCommandLine(cmd, def, qemuCaps) < 0) goto error; - if (qemuBuildNetCommandLine(driver, logManager, secManager, cmd, def, + if (qemuBuildNetCommandLine(driver, vm, logManager, secManager, cmd, qemuCaps, vmop, standalone, nnicindexes, nicindexes, &bootHostdevNet) < 0) goto error; diff --git a/src/qemu/qemu_command.h b/src/qemu/qemu_command.h index 9565a7a377..93696cb8d0 100644 --- a/src/qemu/qemu_command.h +++ b/src/qemu/qemu_command.h @@ -88,7 +88,8 @@ char *qemuBuildHostNetStr(virDomainNetDefPtr net, char **tapfd, size_t tapfdSize, char **vhostfd, - size_t vhostfdSize); + size_t vhostfdSize, + char *slirpfd); /* Current, best practice */ char *qemuBuildNicDevStr(virDomainDefPtr def, diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index daea11dacb..e3cc0921a6 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -297,7 +297,8 @@ virQEMUDriverConfigPtr virQEMUDriverConfigNew(bool privileged) } if (VIR_STRDUP(cfg->bridgeHelperName, QEMU_BRIDGE_HELPER) < 0 || - VIR_STRDUP(cfg->prHelperName, QEMU_PR_HELPER) < 0) + VIR_STRDUP(cfg->prHelperName, QEMU_PR_HELPER) < 0 || + VIR_STRDUP(cfg->slirpHelperName, SLIRP_HELPER) < 0) goto error; cfg->clearEmulatorCapabilities = true; @@ -387,6 +388,7 @@ static void virQEMUDriverConfigDispose(void *obj) VIR_FREE(cfg->hugetlbfs); VIR_FREE(cfg->bridgeHelperName); VIR_FREE(cfg->prHelperName); + VIR_FREE(cfg->slirpHelperName); VIR_FREE(cfg->saveImageFormat); VIR_FREE(cfg->dumpImageFormat); @@ -681,6 +683,9 @@ virQEMUDriverConfigLoadProcessEntry(virQEMUDriverConfigPtr cfg, if (virConfGetValueString(conf, "pr_helper", &cfg->prHelperName) < 0) return -1; + if (virConfGetValueString(conf, "slirp_helper", &cfg->slirpHelperName) < 0) + return -1; + if (virConfGetValueBool(conf, "set_process_name", &cfg->setProcessName) < 0) return -1; if (virConfGetValueUInt(conf, "max_processes", &cfg->maxProcesses) < 0) diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index 983e74a3cf..7ae09f8f8c 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -160,6 +160,7 @@ struct _virQEMUDriverConfig { char *bridgeHelperName; char *prHelperName; + char *slirpHelperName; bool macFilter; diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index f9f5ffc22b..626702c3ed 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -2345,6 +2345,15 @@ qemuDomainObjPrivateXMLFormatPR(virBufferPtr buf, } +static void +qemuDomainObjPrivateXMLFormatSlirp(virBufferPtr buf, + qemuDomainObjPrivatePtr priv) +{ + if (priv->slirpPid) + virBufferAddLit(buf, "<Slirp/>\n"); +} + + static int qemuDomainObjPrivateXMLFormatNBDMigrationSource(virBufferPtr buf, virStorageSourcePtr src, @@ -2555,6 +2564,8 @@ qemuDomainObjPrivateXMLFormat(virBufferPtr buf, qemuDomainObjPrivateXMLFormatPR(buf, priv); + qemuDomainObjPrivateXMLFormatSlirp(buf, priv); + if (virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_BLOCKDEV)) virBufferAsprintf(buf, "<nodename index='%llu'/>\n", priv->nodenameindex); diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h index 06640a9510..f7937bf436 100644 --- a/src/qemu/qemu_domain.h +++ b/src/qemu/qemu_domain.h @@ -365,6 +365,9 @@ struct _qemuDomainObjPrivate { /* true if qemu-pr-helper process is running for the domain */ bool prDaemonRunning; + /* todo: list of running slirp processes */ + pid_t slirpPid; + /* counter for generating node names for qemu disks */ unsigned long long nodenameindex; diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index a4f7d111b1..f6ee9815ab 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1355,6 +1355,7 @@ qemuDomainAttachNetDevice(virQEMUDriverPtr driver, qemuDomainObjPrivatePtr priv = vm->privateData; virDomainDeviceDef dev = { VIR_DOMAIN_DEVICE_NET, { .net = net } }; virErrorPtr originalError = NULL; + char *slirpfdName = NULL; char **tapfdName = NULL; int *tapfd = NULL; size_t tapfdSize = 0; @@ -1592,7 +1593,8 @@ qemuDomainAttachNetDevice(virQEMUDriverPtr driver, if (!(netstr = qemuBuildHostNetStr(net, driver, tapfdName, tapfdSize, - vhostfdName, vhostfdSize))) + vhostfdName, vhostfdSize, + slirpfdName))) goto cleanup; qemuDomainObjEnterMonitor(driver, vm); @@ -1720,6 +1722,7 @@ qemuDomainAttachNetDevice(virQEMUDriverPtr driver, VIR_FREE(vhostfdName); VIR_FREE(charDevAlias); virObjectUnref(conn); + VIR_FREE(slirpfdName); virDomainCCWAddressSetFree(ccwaddrs); return ret; diff --git a/src/qemu/qemu_interface.c b/src/qemu/qemu_interface.c index c8effa68f4..55423d6895 100644 --- a/src/qemu/qemu_interface.c +++ b/src/qemu/qemu_interface.c @@ -603,6 +603,86 @@ qemuInterfaceBridgeConnect(virDomainDefPtr def, } +/** + * qemuInterfaceOpenSlirp: + * @net: network definition + * @slirpfd: slirp connection + * + * Returns: 0 on success + * -1 on failure + */ +int +qemuInterfaceOpenSlirp(virQEMUDriverPtr driver, + virDomainObjPtr vm, + virDomainNetDefPtr net, + int *slirpfd) +{ + int i, pair[2] = { -1, -1 }; + VIR_AUTOPTR(virCommand) cmd = NULL; + VIR_AUTOFREE(char *) cmdstr = NULL; + VIR_AUTOFREE(char *) addr = NULL; + virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(driver); + qemuDomainObjPrivatePtr priv = vm->privateData; + + if (socketpair(AF_UNIX, SOCK_DGRAM, 0, pair) < 0) { + virReportSystemError(errno, "%s", _("failed to create socket")); + goto error; + } + + cmd = virCommandNew(cfg->slirpHelperName); + virCommandAddArgFormat(cmd, "--fd=%d", pair[1]); + virCommandPassFD(cmd, pair[1], + VIR_COMMAND_PASS_FD_CLOSE_PARENT); + + for (i = 0; i < net->guestIP.nips; i++) { + const virNetDevIPAddr *ip = net->guestIP.ips[i]; + const char *opt = ""; + + if (!(addr = virSocketAddrFormat(&ip->address))) + goto error; + + if (VIR_SOCKET_ADDR_IS_FAMILY(&ip->address, AF_INET)) + opt = "--net"; + if (VIR_SOCKET_ADDR_IS_FAMILY(&ip->address, AF_INET6)) + opt = "--prefix-ipv6"; + + virCommandAddArgFormat(cmd, "%s=%s", opt, addr); + VIR_FREE(addr); + + if (ip->prefix) { + if (VIR_SOCKET_ADDR_IS_FAMILY(&ip->address, AF_INET)) { + virSocketAddr netmask; + VIR_AUTOFREE(char *) netmaskStr = NULL; + + if (virSocketAddrPrefixToNetmask(ip->prefix, &netmask, AF_INET) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Failed to translate prefix %d to netmask"), + ip->prefix); + goto error; + } + if (!(netmaskStr = virSocketAddrFormat(&netmask))) + goto error; + virCommandAddArgFormat(cmd, "--mask=%s", netmaskStr); + } + if (VIR_SOCKET_ADDR_IS_FAMILY(&ip->address, AF_INET6)) + virCommandAddArgFormat(cmd, "--prefix-length-ipv6=%u", ip->prefix); + } + } + + virCommandClearCaps(cmd); + if (virCommandRunAsync(cmd, &priv->slirpPid) < 0) { + goto error; + } + + *slirpfd = pair[0]; + return 0; + +error: + VIR_FORCE_CLOSE(pair[0]); + return -1; +} + + /** * qemuInterfaceOpenVhostNet: * @def: domain definition diff --git a/src/qemu/qemu_interface.h b/src/qemu/qemu_interface.h index f3ec540eda..de6195462b 100644 --- a/src/qemu/qemu_interface.h +++ b/src/qemu/qemu_interface.h @@ -55,4 +55,10 @@ int qemuInterfaceOpenVhostNet(virDomainDefPtr def, virDomainNetDefPtr net, int *vhostfd, size_t *vhostfdSize); + +int qemuInterfaceOpenSlirp(virQEMUDriverPtr driver, + virDomainObjPtr vm, + virDomainNetDefPtr net, + int *slirpfd); + #endif /* LIBVIRT_QEMU_INTERFACE_H */ diff --git a/src/qemu/test_libvirtd_qemu.aug.in b/src/qemu/test_libvirtd_qemu.aug.in index fea1d308b7..5796e5d1eb 100644 --- a/src/qemu/test_libvirtd_qemu.aug.in +++ b/src/qemu/test_libvirtd_qemu.aug.in @@ -102,5 +102,6 @@ module Test_libvirtd_qemu = } { "memory_backing_dir" = "/var/lib/libvirt/qemu/ram" } { "pr_helper" = "/usr/bin/qemu-pr-helper" } +{ "slirp_helper" = "/usr/bin/slirp-helper" } { "swtpm_user" = "tss" } { "swtpm_group" = "tss" } -- 2.21.0.313.ge35b8cb8e2

5 4