- Devel - libvirt List Archives

[PATCH] security: apparmor: Allow QEMU read /proc/sys/vm/max_map_count
by Michal Privoznik 20 Aug '24

20 Aug '24

In its commit v9.0.0-rc0~1^2 QEMU started to read /proc/sys/vm/max_map_count file to set up coroutine limits better (something about VMAs, mmap(), see the commit for more info). Allow the file in apparmor profile. Resolves: https://gitlab.com/libvirt/libvirt/-/issues/660 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/security/apparmor/libvirt-qemu.in | 1 + 1 file changed, 1 insertion(+) diff --git a/src/security/apparmor/libvirt-qemu.in b/src/security/apparmor/libvirt-qemu.in index 8b92915281..8f17256554 100644 --- a/src/security/apparmor/libvirt-qemu.in +++ b/src/security/apparmor/libvirt-qemu.in @@ -34,6 +34,7 @@ # only modify its comm value or those in its thread group. owner @{PROC}/@{pid}/task/@{tid}/comm rw, @{PROC}/sys/kernel/cap_last_cap r, + @{PROC}/sys/vm/max_map_count r, @{PROC}/sys/vm/overcommit_memory r, # detect hardware capabilities via qemu_getauxval owner @{PROC}/*/auxv r, -- 2.44.2

2 1

New features tests fails
by Anthony Harivel 20 Aug '24

20 Aug '24

Hi, I'm trying to implement the libvirt part of a new feature that has landed in QEMU staging [1]. The current draft of this implementations is the following [2]. It compiles on top of master. But when I want to run the tests suites, I hit an issue I don't managed to find the problem. It runs until: [...] 278/279 libvirt:bin / qemuxmlconftest FAIL 8.63s exit status 1 [...] then it tells me to run the following to understand the issue: VIR_TEST_DEBUG=1 VIR_TEST_RANGE=850-851,854-855 /home/aharivel/work/libvirt/build/tests/qemuxmlconftest It outputs this: [...] 850) QEMU XML def -> XML kvm-features.x86_64-latest ... In '/home/aharivel/work/libvirt/tests/qemuxmlconfdata/kvm-features.x86_64-latest.xml': Offset 533 Expect [ socket='/run/qemu-vmsr-helper.sock'/] Actual [/] ... FAILED 851) QEMU XML OUT -> XML kvm-features.x86_64-latest ... In '/home/aharivel/work/libvirt/tests/qemuxmlconfdata/kvm-features.x86_64-latest.xml': Offset 533 Expect [ socket='/run/qemu-vmsr-helper.sock'/] Actual [/] ... FAILED 854) QEMU XML def -> XML kvm-features-off.x86_64-latest ... In '/home/aharivel/work/libvirt/tests/qemuxmlconfdata/kvm-features-off.x86_64-latest.xml': Offset 527 Expect [/] Actual [ socket='(null)'/] ... FAILED 855) QEMU XML OUT -> XML kvm-features-off.x86_64-latest ... In '/home/aharivel/work/libvirt/tests/qemuxmlconfdata/kvm-features-off.x86_64-latest.xml': Offset 527 Expect [/] Actual [ socket='(null)'/] [...] ... FAILED I certainly did something wrong in the implementation but I don't figure it out. I understand the Expect / Actual tests. I'm guessing the issue is that it needs to run the QEMU version where the feature is possible but I don't see how can tell the test to run this particular version. Any advise would be greatly appreciate. Thanks Regards, Anthony [1] : https://gitlab.com/qemu-project/qemu/-/commit/0418f90809aea5b375c859e744c8e… [2] : https://github.com/aharivel/libvirt/commit/153a4489f095e063f3c7e0470a8f925a…

2 4

[PATCH 0/3] Fix ARP table parsing over netlink messages
by Martin Kletzander 19 Aug '24

19 Aug '24

Somehow it happened that some kernels (I noticed this with 6.10.0 and 6.10.2 on various machines) started sending NLMSG_DONE message (as they probably should've even before), but our check for it could've never worked and now `virsh domifaddr --source arp` sometimes fails with "wrong nlmsg len". So I set out on a quest to tame the netlink beast and though fierceful debugging and... Oh, I forgot, nobody reads cover letters. Never mind. Martin Kletzander (3): virarptable: Properly calculate rtattr length virarptable: Fix check for message length virarptable: End parsing earlier in case of NLMSG_DONE src/util/virarptable.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) -- 2.46.0

2 10

[PATCH 0/2] virsh: Simplify vshTableRowAppend() calling in cmdList()
by Michal Privoznik 19 Aug '24

19 Aug '24

*** BLURB HERE *** Michal Prívozník (2): virsh: Simplify vshTableRowAppend() calling in cmdList(), part one virsh: Simplify vshTableRowAppend() calling in cmdList(), part two tools/virsh-domain-monitor.c | 52 +++++++++++++++--------------------- 1 file changed, 21 insertions(+), 31 deletions(-) -- 2.44.2

2 4

[PATCH 0/3] Implement support for QCOW2 data files
by Nikolai Barybin 19 Aug '24

19 Aug '24

There are use cases when the existing disks (i.e. LVM) are wanted to be used with advanced features. For this purpose QEMU allows data-file feature for qcow2 files: metadata is kept in the qcow2 file like usual, but guest data is written to an external file. These patches enable support for this feature in libvirt. Nikolai Barybin (3): conf: add data-file feature and related fields to virStorageSource storage: add qcow2 filename parsing from header qemu: enable qcow2 data-file attach to VM on start src/conf/storage_source_conf.c | 8 ++++ src/conf/storage_source_conf.h | 5 ++ src/qemu/qemu_block.c | 45 ++++++++++++++++++ src/qemu/qemu_cgroup.c | 3 ++ src/qemu/qemu_namespace.c | 6 +++ src/storage_file/storage_file_probe.c | 66 +++++++++++++++++++++++---- src/storage_file/storage_source.c | 38 ++++++++++++++- 7 files changed, 160 insertions(+), 11 deletions(-) -- 2.43.5

3 12

Shared LVM and starting/stopping volumes
by dajester2005＠gmail.com 19 Aug '24

19 Aug '24

Ran into a situation using a shared LVM2 volume group, where if there were volumes locked by a server, the pool could not be started on another server due to "vgchange -aly" not being able to acquire locks on all volumes in the pool. This was referenced in issue #38 on gitlab. Long story short, I've experimented with adding APIs for starting/stopping individual volumes in a storage pool, and implementing that API in the logical backend driver. I'm not a C developer by trade, but all the existing tests pass. I'd like to submit this for some feedback, and see what would be needed to incorporate this, or similar API: https://gitlab.com/dajester2013/libvirt/-/tree/shared-lvm-storage-mods

1 0

Plans for 10.7.0 release (freeze on Tuesday 27 Aug)
by Jiri Denemark 19 Aug '24

19 Aug '24

We are getting close to 10.7.0 release of libvirt. To aim for the release on Monday 02 Sep I suggest entering the freeze on Tuesday 27 Aug and tagging RC2 on Thursday 29 Aug. I hope this works for everyone. Jirka

1 0

[PATCH] lib: Use NULLSTR family of macros more
by Michal Privoznik 19 Aug '24

19 Aug '24

There is a family of convenient macros: NULLSTR, NULLSTR_EMPTY, NULLSTR_STAR, NULLSTR_MINUS which hides ternary operator. Generated using the following spatch (and its obvious variants): @@ expression s; @@ <+... - s ? s : "<null>" + NULLSTR(s) ...+> Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/libvirt.c | 2 +- src/network/network_iptables.c | 4 ++-- src/network/network_nftables.c | 4 ++-- src/qemu/qemu_firmware.c | 2 +- src/util/virnetdevip.c | 8 ++++---- tools/virsh-checkpoint.c | 2 +- tools/virsh-domain-monitor.c | 8 ++++---- tools/virsh-nodedev.c | 2 +- 8 files changed, 16 insertions(+), 16 deletions(-) diff --git a/src/libvirt.c b/src/libvirt.c index 26c3fe454f..1d37696d6f 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -168,7 +168,7 @@ virConnectAuthCallbackDefault(virConnectCredentialPtr cred, } if (cred[i].type != VIR_CRED_EXTERNAL) { - cred[i].result = bufptr ? bufptr : g_strdup(cred[i].defresult ? cred[i].defresult : ""); + cred[i].result = bufptr ? bufptr : g_strdup(NULLSTR_EMPTY(cred[i].defresult)); cred[i].resultlen = strlen(cred[i].result); } } diff --git a/src/network/network_iptables.c b/src/network/network_iptables.c index f774176b3d..e8da15426e 100644 --- a/src/network/network_iptables.c +++ b/src/network/network_iptables.c @@ -867,10 +867,10 @@ iptablesForwardMasquerade(virFirewall *fw, if (addrStartStr && addrStartStr[0]) { if (addrEndStr && addrEndStr[0]) { natRangeStr = g_strdup_printf("%s-%s%s", addrStartStr, addrEndStr, - portRangeStr ? portRangeStr : ""); + NULLSTR_EMPTY(portRangeStr)); } else { natRangeStr = g_strdup_printf("%s%s", addrStartStr, - portRangeStr ? portRangeStr : ""); + NULLSTR_EMPTY(portRangeStr)); } virFirewallCmdAddArgList(fw, fwCmd, diff --git a/src/network/network_nftables.c b/src/network/network_nftables.c index 268d1f12ca..f8b5ab665d 100644 --- a/src/network/network_nftables.c +++ b/src/network/network_nftables.c @@ -588,10 +588,10 @@ nftablesAddForwardMasquerade(virFirewall *fw, if (addrStartStr && addrStartStr[0]) { if (addrEndStr && addrEndStr[0]) { natRangeStr = g_strdup_printf("%s-%s%s", addrStartStr, addrEndStr, - portRangeStr ? portRangeStr : ""); + NULLSTR_EMPTY(portRangeStr)); } else { natRangeStr = g_strdup_printf("%s%s", addrStartStr, - portRangeStr ? portRangeStr : ""); + NULLSTR_EMPTY(portRangeStr)); } virFirewallCmdAddArgList(fw, fwCmd, "counter", "snat", "to", natRangeStr, NULL); diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index 08ca99e1ac..914f8596bd 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -1090,7 +1090,7 @@ qemuFirmwareEnsureNVRAM(virDomainDef *def, loader->nvram->path = g_strdup_printf("%s/%s_VARS%s", cfg->nvramDir, def->name, - ext ? ext : ""); + NULLSTR_EMPTY(ext)); } diff --git a/src/util/virnetdevip.c b/src/util/virnetdevip.c index 3b02fe0cec..f365c1999c 100644 --- a/src/util/virnetdevip.c +++ b/src/util/virnetdevip.c @@ -188,8 +188,8 @@ virNetDevIPAddrAdd(const char *ifname, VIR_DEBUG("Adding IP address %s/%d%s%s%s%s to %s", NULLSTR(ipStr), prefix, - peerStr ? " peer " : "", peerStr ? peerStr : "", - bcastStr ? " bcast " : "", bcastStr ? bcastStr : "", + peerStr ? " peer " : "", NULLSTR_EMPTY(peerStr), + bcastStr ? " bcast " : "", NULLSTR_EMPTY(bcastStr), ifname); if (!(nlmsg = virNetDevCreateNetlinkAddressMessage(RTM_NEWADDR, ifname, @@ -206,8 +206,8 @@ virNetDevIPAddrAdd(const char *ifname, virReportError(VIR_ERR_SYSTEM_ERROR, _("Failed to add IP address %1$s/%2$d%3$s%4$s%5$s%6$s to %7$s"), ipStr, prefix, - peerStr ? " peer " : "", peerStr ? peerStr : "", - bcastStr ? " bcast " : "", bcastStr ? bcastStr : "", + peerStr ? " peer " : "", NULLSTR_EMPTY(peerStr), + bcastStr ? " bcast " : "", NULLSTR_EMPTY(bcastStr), ifname); return -1; } diff --git a/tools/virsh-checkpoint.c b/tools/virsh-checkpoint.c index 972b2f979c..a0ac0d7f71 100644 --- a/tools/virsh-checkpoint.c +++ b/tools/virsh-checkpoint.c @@ -455,7 +455,7 @@ cmdCheckpointInfo(vshControl *ctl, _("unexpected problem querying checkpoint state")); return false; } - vshPrint(ctl, "%-15s %s\n", _("Parent:"), parent ? parent : "-"); + vshPrint(ctl, "%-15s %s\n", _("Parent:"), NULLSTR_MINUS(parent)); /* Children, Descendants. */ flags = 0; diff --git a/tools/virsh-domain-monitor.c b/tools/virsh-domain-monitor.c index 74deca2f94..37184baa69 100644 --- a/tools/virsh-domain-monitor.c +++ b/tools/virsh-domain-monitor.c @@ -712,11 +712,11 @@ cmdDomiflist(vshControl *ctl, const vshCmd *cmd) mac = virXPathString("string(./mac/@address)", ctxt); if (vshTableRowAppend(table, - target ? target : "-", + NULLSTR_MINUS(target), type, - source ? source : "-", - model ? model : "-", - mac ? mac : "-", + NULLSTR_MINUS(source), + NULLSTR_MINUS(model), + NULLSTR_MINUS(mac), NULL) < 0) return false; } diff --git a/tools/virsh-nodedev.c b/tools/virsh-nodedev.c index 910eaefc9e..145faff3e7 100644 --- a/tools/virsh-nodedev.c +++ b/tools/virsh-nodedev.c @@ -1233,7 +1233,7 @@ cmdNodeDeviceInfo(vshControl *ctl, const vshCmd *cmd) parent = virNodeDeviceGetParent(device); vshPrint(ctl, "%-15s %s\n", _("Name:"), virNodeDeviceGetName(device)); - vshPrint(ctl, "%-15s %s\n", _("Parent:"), parent ? parent : ""); + vshPrint(ctl, "%-15s %s\n", _("Parent:"), NULLSTR_EMPTY(parent)); vshPrint(ctl, "%-15s %s\n", _("Active:"), virNodeDeviceIsActive(device) ? _("yes") : _("no")); vshPrint(ctl, "%-15s %s\n", _("Persistent:"), -- 2.44.2

2 1

[PATCH 0/1] virsh: allow both --table and --uuid at the same time
by Nikolai Barybin 19 Aug '24

19 Aug '24

For now virsh does not provide a set of options to print all info about domain: --all does not print uuid, combination of --id --name --uuid does not have '--state' option. I think we should address this issue and allow user to get all available info with one command. The easiest way to do that is to allow combining --table and --uuid (the same way it now works with --title). Thus, the most diverse info would look like that: # virsh list --table --title --uuid Id Name State Title UUID ----------------------------------- Nikolai Barybin (1): virsh: allow both --table and --uuid at the same time docs/manpages/virsh.rst | 14 +++++++------- tools/virsh-domain-monitor.c | 37 ++++++++++++++++++++++++++++++++---- 2 files changed, 40 insertions(+), 11 deletions(-) -- 2.43.5

2 2

Re: [PATCH v2 4/4] virtio-net: Add support for USO features
by Thomas Huth 19 Aug '24

19 Aug '24

On 26/07/2024 08.08, Michael S. Tsirkin wrote: > On Thu, Jul 25, 2024 at 06:18:20PM -0400, Peter Xu wrote: >> On Tue, Aug 01, 2023 at 01:31:48AM +0300, Yuri Benditovich wrote: >>> USO features of virtio-net device depend on kernel ability >>> to support them, for backward compatibility by default the >>> features are disabled on 8.0 and earlier. >>> >>> Signed-off-by: Yuri Benditovich <yuri.benditovich(a)daynix.com> >>> Signed-off-by: Andrew Melnychecnko <andrew(a)daynix.com> >> >> Looks like this patch broke migration when the VM starts on a host that has >> USO supported, to another host that doesn't.. > > This was always the case with all offloads. The answer at the moment is, > don't do this. May I ask for my understanding: "don't do this" = don't automatically enable/disable virtio features in QEMU depending on host kernel features, or "don't do this" = don't try to migrate between machines that have different host kernel features? > Long term, we need to start exposing management APIs > to discover this, and management has to disable unsupported features. Ack, this likely needs some treatments from the libvirt side, too. Thomas

8 93