- Devel - libvirt List Archives

[libvirt PATCH 0/3] qemu: Fix firmware selection backwards compatibility
by Andrea Bolognani 28 Mar '23

28 Mar '23

Andrea Bolognani (3): tests: Introduce DO_TEST_CAPS_ARCH_LATEST_ABI_UPDATE() tests: Add firmware-auto-efi-abi-update-aarch64 test case qemu: Default to raw firmware for existing domains src/qemu/qemu_domain.c | 17 +++++++++++++++++ ...irmware-auto-efi-aarch64.aarch64-latest.args | 8 ++++---- ...-efi-abi-update-aarch64.aarch64-latest.args} | 0 .../firmware-auto-efi-abi-update-aarch64.xml | 17 +++++++++++++++++ .../pvpanic-pci-aarch64.aarch64-latest.args | 8 ++++---- ...c-pci-no-address-aarch64.aarch64-latest.args | 8 ++++---- .../virtio-iommu-aarch64.aarch64-latest.args | 8 ++++---- tests/qemuxml2argvtest.c | 6 ++++++ ...firmware-auto-efi-aarch64.aarch64-latest.xml | 4 ++-- ...o-efi-abi-update-aarch64.aarch64-latest.xml} | 0 .../pvpanic-pci-aarch64.aarch64-latest.xml | 4 ++-- ...ic-pci-no-address-aarch64.aarch64-latest.xml | 4 ++-- .../virtio-iommu-aarch64.aarch64-latest.xml | 4 ++-- tests/qemuxml2xmltest.c | 6 ++++++ 14 files changed, 70 insertions(+), 24 deletions(-) copy tests/qemuxml2argvdata/{firmware-auto-efi-aarch64.aarch64-latest.args => firmware-auto-efi-abi-update-aarch64.aarch64-latest.args} (100%) create mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-abi-update-aarch64.xml copy tests/qemuxml2xmloutdata/{firmware-auto-efi-aarch64.aarch64-latest.xml => firmware-auto-efi-abi-update-aarch64.aarch64-latest.xml} (100%) -- 2.39.2

2 7

[PATCH] virauth: Report error on empty auth result
by Michal Privoznik 28 Mar '23

28 Mar '23

When opening a connection, it may be necessary to provide user credentials, or some additional info (e.g. whether to trust an ssh key). We have a special API for that: virConnectOpenAuth() where and additional callback can be passed. This callback is then called with _virConnectCredential struct filled partially and it's callback's responsibility to get desired data (e.g. by prompting user) and store it into .result member of the struct. But we document the callback behaviour as: If an interaction cannot be filled, fill in NULL and 0. (meaning fill in NULL and return 0) But this does not really fly with the way callback is called. So far, we have three places where the callback is called: 1) remoteAuthInteract() 2) virAuthGetUsernamePath() 3) virAuthAskCredential() Now, 1) just grabs whatever the client side provided and sends it to the other side via RPC. All interesting work takes place at 2) and 3). And the usual pattern in which these two are called is: if (!(cred = wrapper())) return -1; where wrapper() is a function that firstly tries to get data from a config file or URI itself. The wrappers are named virAuthGetUsername() for virAuthGetUsernamePath() and virAuthGetPassword() for virAuthAskCredential(). All wrappers do report error on failure. Except, when the user provided callback set the struct member to NULL. Then they both return NULL without setting any error. This then leads to the generic error message: error : An error occurred, but the cause is unknown Since we failed to get desired credential data, we can't proceed (what data should we pass down to the auth layer, say ssh?) and have to fail. But, we can produce an error message that'll hopefully point users in the right direction. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2181235 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/util/virauth.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/util/virauth.c b/src/util/virauth.c index 7b4a1bd8a5..d1f32f8e6d 100644 --- a/src/util/virauth.c +++ b/src/util/virauth.c @@ -176,7 +176,8 @@ virAuthGetUsernamePath(const char *path, cred.result = NULL; cred.resultlen = 0; - if ((*(auth->cb))(&cred, 1, auth->cbdata) < 0) { + if ((*(auth->cb))(&cred, 1, auth->cbdata) < 0 || + !cred.result) { virReportError(VIR_ERR_AUTH_FAILED, "%s", _("Username request failed")); VIR_FREE(cred.result); @@ -310,7 +311,8 @@ virAuthAskCredential(virConnectAuthPtr auth, ret->prompt = prompt; - if (auth->cb(ret, 1, auth->cbdata) < 0) { + if (auth->cb(ret, 1, auth->cbdata) < 0 || + !ret->result) { virReportError(VIR_ERR_OPERATION_FAILED, "%s", _("failed to retrieve user response for authentication callback")); return NULL; -- 2.39.2

2 1

[RFC] Seeking advice on support for generic vDPA device
by jiangdongxu 28 Mar '23

28 Mar '23

vDPA devices allow high-performance devices in a virtual machine by providing a wire-speed data path. These devices require a vendor-specific host driver but the data path follows the virtio specification. The support for generic-vdpa device was recently added to qemu in v8.0.0-rc version. https://gitlab.com/qemu-project/qemu/-/commit/b430a2bd2303b9940cc80ec746887… This allows libvirt to support these deviecs regardless of device type. Currently, libvirt supports vDPA network devices, We need a new solution to support generic-vdpa devices. At present, we have considered several options. Solution A: Add type vdpa under the hostdev device，the device xml looks like <devices> <hostdev mode='subsystem' type='vdpa'> <source dev='/dev/vhost-vdpa-0'/> </hostdev> </devices> This solution is recommended. This configuration requires only that the device supports the vDPA framework, easy for future expansion and same as the qemu solution design idea. Solution B: The current libvirt mode is used to add vDPA devices under different devices. device xml looks like: network: <devices> <interface type='generic-vdpa'> <source dev='/dev/vhost-vdpa-0'/> </interface> </devices> storage: <devices> <disk type='generic-vdpa’> <source dev='/dev/vhost-vdpa-0'/> </disk> </devices> The network interface has the vdpa type. Therefore, a new type is required to distinguish the "generic-vdpa" type. However, this method differentiates device types, which is not convenient for the expansion of other types of vDPA devices. Not recommended. Solution C: Referring to PCI passthrough, Add the driver type (appropriate vendor-specific driver) to the driver of the PCI device. The unbind/bind of the vDPA device driver and the creation of VDPA device are implemented by libvirt. device xml looks like: <devices> <hostdev mode='subsystem' type='pci' managed='yes'> <driver name='vp-vdpa'/> <source> <address domain='0x0000' bus='0x04' slot='0x01' function='0x01'/> </source> </hostdev> </devices> This solution is related to the vendor-specific driver and supports only the vdpa created by the PCI device. vdpa devices created in vduse mode are not supported. This solution is not universal and is not recommended. What's your proposal?

2 1

Possible Bug in Libvirt::StorageVol in ruby-libvirt?
by dateirunner 27 Mar '23

27 Mar '23

Dear Support Team I want to kindly ask for help I am running almalinux with the packages libvirt libvirt-devel I installed the gem 'libvirt-ruby' When running the following script the execution breaks with: ./libvirt-test.rb:25:in `name': Expected Connection object (ArgumentError) from ./libvirt-test.rb:25:in `<main>' #!/usr/bin/env ruby require 'bundler/inline' gemfile do source 'https://rubygems.org' gem 'ruby-libvirt' end require 'libvirt' #Starts connection #works conn = Libvirt::open() # Lists all pools #works pools = conn.list_all_storage_pools # Saves all volumes of all pools # volumes = pools.map {|p| p.list_all_volumes}.flatten # Gets first volume first_volume = volumes.first puts volumes.first #Breaks Should return the name of the volume as string first_volume.name #Breaks Should return the path of the volume as string first_volume.path -------------- Can someone confirm this issue? Is there a possible fix or did I misread the documentation? Thank you for your help Regards R. Koch

1 0

[PATCH v1 0/4] Introduce virsh hypervisor-cpu-models
by Collin Walling 27 Mar '23

27 Mar '23

Allows for the query of hypervisor-known CPU models via the simple command: virsh hypervisor-cpu-models. For the QEMU driver, the models are queried via the capabilities file. Each model is printed to the terminal on its own line similar to the cpu-models command, and there is no order to the listing. The models "qemu", "host", and "max" have been excluded from this list since they are not architecture specific. The code can be easily modified to include them if desired. Collin Walling (4): Introduce virConnectGetHypervisorCPUNames public API remote: Implement virConnectGetHypervisorCPUNames virsh: Introduce new hypervisor-cpu-models command qemu_driver: Implement qemuConnectGetHypervisorCPUNames docs/manpages/virsh.rst | 20 ++++++++++ include/libvirt/libvirt-host.h | 6 +++ src/driver-hypervisor.h | 9 +++++ src/libvirt-host.c | 54 ++++++++++++++++++++++++++ src/libvirt_public.syms | 5 +++ src/qemu/qemu_driver.c | 62 ++++++++++++++++++++++++++++++ src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 20 +++++++++- src/remote_protocol-structs | 11 ++++++ tools/virsh-host.c | 70 ++++++++++++++++++++++++++++++++++ 10 files changed, 257 insertions(+), 1 deletion(-) -- 2.39.0

4 11

[libvirt PATCH] NEWS: document my user-visible bugfixes
by Ján Tomko 27 Mar '23

27 Mar '23

Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- NEWS.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index c187d35d3b..cc32fb948e 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -60,6 +60,17 @@ v9.2.0 (unreleased) so, as affinity to NUMA nodes inaccessible to emulator thread might have been requested. + * rpc: fix typo in admin code generation + + Fix the bug in the remote `virt-admin` code generator, that resulted + in a crash. Introduced in libvirt 9.1.0. + + * qemu: relax shared memory check for vhostuser daemons + + Fix hotplug of virtiofs `filesystem` after restarting libvirtd. + Before, libvirtd would incorrectly complain about missing shared + memory. + v9.1.0 (2023-03-01) =================== -- 2.39.2

2 1

[libvirt PATCH] qemu_snapshot: external: don't error out when updating metadata
by Pavel Hrdina 27 Mar '23

27 Mar '23

Attaching disk into running VM the offilne definition may not be updated and we will end up with that disk existing only in live definition. Creating snapshot with this state saves both live and offline definition into snapshot metadata. When we are deleting an external snapshot we are updating these definitions in the snapshot metadata so we should just skip over non-existing disks instead of reporting error. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2174700 Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/qemu/qemu_snapshot.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c index 14353c6f0d..e36d6288ac 100644 --- a/src/qemu/qemu_snapshot.c +++ b/src/qemu/qemu_snapshot.c @@ -2464,8 +2464,8 @@ qemuSnapshotUpdateDisksSingle(virDomainMomentObj *snap, { virDomainDiskDef *disk = NULL; - if (!(disk = qemuDomainDiskByName(def, snapDisk->name))) - return -1; + if (!(disk = virDomainDiskByName(def, snapDisk->name, true))) + return 0; if (virDomainSnapshotIsExternal(snap)) { virDomainDiskDef *parentDisk = NULL; -- 2.39.2

2 1

libvirt-shim: libvirt to run qemu in a different container
by Itamar Holder 27 Mar '23

27 Mar '23

Hey all, I'm Itamar Holder, a Kubevirt developer. Lately we came across a problem w.r.t. properly supporting VMs with dedicated CPUs on Kubernetes. The full details can be seen in this PR <https://github.com/kubevirt/kubevirt/pull/8869> [1], but to make a very long story short, we would like to use two different containers in the virt-launcher pod that is responsible to run a VM: - "Managerial container": would be allocated with a shared cpuset. Would run all of the virtualization infrastructure, such as libvirtd and its dependencies. - "Emulator container": would be allocated with a dedicated cpuset. Would run the qemu process. There are many reasons for choosing this design, but in short, the main reasons are that it's impossible to allocate both shared and dedicated cpus to a single container, and that it would allow finer-grained control and isolation for the different containers. Since there is no way to start the qemu process in a different container, I tried to start qemu in the "managerial" container, then move it into the "emulator" container. This fails however, since libvirt uses sched_setaffinity to pin the vcpus into the dedicated cpuset, which is not allocated to the managerial container, resulting in an EINVAL error. Therefore, I thought about discussing a new approach - introducing a small shim that could communicate with libvirtd in order to start and control the qemu process that would run on a different container. As I see it, the main workflow could be described as follows: - The emulator container would start with the shim. - libvirtd, running in the managerial container, would ask for some information from the target, e.g. cpuset. - libvirtd would create the domain xml and would transfer to the shim everything needed in order to launch the guest. - The shim, running in the emulator container, would run the qemu-process. What do you think? Feedback is much appreciated. Best Regards, Itamar Holder. [1] https://github.com/kubevirt/kubevirt/pull/8869

3 2

Entering freeze for libvirt-9.2.0
by Jiri Denemark 27 Mar '23

27 Mar '23

I have just tagged v9.2.0-rc1 in the repository and pushed signed tarballs and source RPMs to https://libvirt.org/sources/ Please give the release candidate some testing and in case you find a serious issue which should have a fix in the upcoming release, feel free to reply to this thread to make sure the issue is more visible. If you have not done so yet, please update NEWS.rst to document any significant change you made since the last release. Thanks, Jirka

1 0

[PATCH] Revert "ci: Disable optimization on macos-12"
by Martin Kletzander 24 Mar '23

24 Mar '23

This reverts commit 1f76b5365ec78b1e9a36038db8e13ec0025bbe7a. There were two issues with this commit. First is the missing propagation of CFLAGS into the build environment and second is the fact that this is not enough to disable the check for -fsemantic-interposition. The proper fix would require setting MESON_OPTS or similar and also add the propagation of such variable into the cirrus builds etc., but at this point I burned so much time on this trivial piece of rubbish that I think it's easier to just wait for macos to gain a newer clang =D Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- ci/gitlab/builds.yml | 1 - ci/manifest.yml | 2 -- 2 files changed, 3 deletions(-) diff --git a/ci/gitlab/builds.yml b/ci/gitlab/builds.yml index f070db637c80..545478d3516d 100644 --- a/ci/gitlab/builds.yml +++ b/ci/gitlab/builds.yml @@ -865,7 +865,6 @@ aarch64-macos-12: needs: [] allow_failure: false variables: - CFLAGS: -O0 CIRRUS_VM_IMAGE_NAME: ghcr.io/cirruslabs/macos-monterey-base:latest CIRRUS_VM_IMAGE_SELECTOR: image CIRRUS_VM_INSTANCE_TYPE: macos_instance diff --git a/ci/manifest.yml b/ci/manifest.yml index 2f631376b24b..b68c7361abb4 100644 --- a/ci/manifest.yml +++ b/ci/manifest.yml @@ -179,8 +179,6 @@ targets: variables: PATH_EXTRA: /usr/local/opt/ccache/libexec:/usr/local/opt/gettext/bin:/usr/local/opt/libpcap/bin:/usr/local/opt/libxslt/bin:/usr/local/opt/rpcgen/bin PKG_CONFIG_PATH: /usr/local/opt/curl/lib/pkgconfig:/usr/local/opt/libpcap/lib/pkgconfig:/usr/local/opt/libxml2/lib/pkgconfig:/usr/local/opt/ncurses/lib/pkgconfig:/usr/local/opt/readline/lib/pkgconfig - # Remove once macos has clang with -fsemantic-interposition - CFLAGS: -O0 ubuntu-2004: jobs: -- 2.40.0

2 1

[PATCH] virt-host-validate: Detect SMMU support on ARMs
by Michal Privoznik 24 Mar '23

24 Mar '23

In vir-host-validate we do two checks related to IOMMU: 1) hardware support, and 2) kernel support. While users are usually interested in the latter, the former also makes sense. And for the former (hardware support) we have this huge if-else block for nearly every architecture, except ARM. Now, IOMMU is called SMMU in ARM world, and while there's certainly a definitive way of detecting SMMU support (e.g. via dumping some registers in asm), we can work around this - just like we do for Intel and AMD - and check for an ACPI table presence. In ARM world, there's I/O Remapping Table (IORT) which describes SMMU capabilities on given host and is exposed in sysfs (regardless of arm_smmu module). Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2178885 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tools/virt-host-validate-common.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/tools/virt-host-validate-common.c b/tools/virt-host-validate-common.c index a41bb346d2..49d3c4083b 100644 --- a/tools/virt-host-validate-common.c +++ b/tools/virt-host-validate-common.c @@ -388,6 +388,15 @@ int virHostValidateIOMMU(const char *hvname, return VIR_HOST_VALIDATE_FAILURE(VIR_HOST_VALIDATE_NOTE); } virHostMsgPass(); + } else if (ARCH_IS_ARM(arch)) { + if (access("/sys/firmware/acpi/tables/IORT", F_OK) == 0) { + virHostMsgPass(); + } else { + virHostMsgFail(level, + "No ACPI IORT table found, IOMMU not " + "supported by this hardware platform"); + return VIR_HOST_VALIDATE_FAILURE(level); + } } else { virHostMsgFail(level, "Unknown if this platform has IOMMU support"); -- 2.39.2

2 1

[PATCH] ci: Disable optimization on macos-12
by Martin Kletzander 24 Mar '23

24 Mar '23

This enables our CI to run tests on on macos-12 after commit 7944700b4037. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- The pipeline can be seen here: https://gitlab.com/nertpinx/libvirt/-/pipelines/816876889 ci/gitlab/builds.yml | 1 + ci/manifest.yml | 2 ++ 2 files changed, 3 insertions(+) diff --git a/ci/gitlab/builds.yml b/ci/gitlab/builds.yml index 545478d3516d..f070db637c80 100644 --- a/ci/gitlab/builds.yml +++ b/ci/gitlab/builds.yml @@ -865,6 +865,7 @@ aarch64-macos-12: needs: [] allow_failure: false variables: + CFLAGS: -O0 CIRRUS_VM_IMAGE_NAME: ghcr.io/cirruslabs/macos-monterey-base:latest CIRRUS_VM_IMAGE_SELECTOR: image CIRRUS_VM_INSTANCE_TYPE: macos_instance diff --git a/ci/manifest.yml b/ci/manifest.yml index b68c7361abb4..2f631376b24b 100644 --- a/ci/manifest.yml +++ b/ci/manifest.yml @@ -179,6 +179,8 @@ targets: variables: PATH_EXTRA: /usr/local/opt/ccache/libexec:/usr/local/opt/gettext/bin:/usr/local/opt/libpcap/bin:/usr/local/opt/libxslt/bin:/usr/local/opt/rpcgen/bin PKG_CONFIG_PATH: /usr/local/opt/curl/lib/pkgconfig:/usr/local/opt/libpcap/lib/pkgconfig:/usr/local/opt/libxml2/lib/pkgconfig:/usr/local/opt/ncurses/lib/pkgconfig:/usr/local/opt/readline/lib/pkgconfig + # Remove once macos has clang with -fsemantic-interposition + CFLAGS: -O0 ubuntu-2004: jobs: -- 2.40.0

2 1

[PATCH] esx: Change the default username when connecting to VCenter
by Michal Privoznik 24 Mar '23

24 Mar '23

While it's true that the default username is: administrator@${SSO-Domain} in majority of cases the ${SSO-Domain} is "vsphere.local". But our code (and what virsh displays then) says it's just "administrator". This is wrong also from a different POV: the username must contain the suffix no matter what and our default suggests otherwise. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2181234 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/esx/esx_driver.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c index 9dc5489411..2443e6e88a 100644 --- a/src/esx/esx_driver.c +++ b/src/esx/esx_driver.c @@ -701,7 +701,8 @@ esxConnectToVCenter(esxPrivate *priv, if (conn->uri->user) { username = g_strdup(conn->uri->user); } else { - if (!(username = virAuthGetUsername(conn, auth, "esx", "administrator", + if (!(username = virAuthGetUsername(conn, auth, "esx", + "administrator(a)vsphere.local", hostname))) return -1; } -- 2.39.2

2 1

Re: [PATCH] vfio/pci: Propagate ACPI notifications to the user-space
by Alex Williamson 24 Mar '23

24 Mar '23

[Cc +libvir-list] On Wed, 8 Mar 2023 12:41:24 +0100 Grzegorz Jaszczyk <jaz(a)semihalf.com> wrote: > śr., 8 mar 2023 o 00:42 Alex Williamson <alex.williamson(a)redhat.com> napisał(a): > > > > On Tue, 7 Mar 2023 22:05:53 +0000 > > Grzegorz Jaszczyk <jaz(a)semihalf.com> wrote: > > > > > From: Dominik Behr <dbehr(a)chromium.org> > > > > > > Hitherto there was no support for propagating ACPI notifications to the > > > guest drivers. In order to provide such support, install a handler for > > > notifications on an ACPI device during vfio-pci device registration. The > > > handler role is to propagate such ACPI notifications to the user-space > > > via acpi netlink events, which allows VMM to receive and propagate them > > > further to the VMs. > > > > > > Thanks to the above, the actual driver for the pass-through device, > > > which belongs to the guest, can receive and react to device specific > > > notifications. > > > What consumes these events? > > Those events are consumed by the VMM, which can have a built-in ACPI > event listener. > > > Has this been proposed to any VM management tools like libvirt? > > This patch was evaluated and tested with crosvm VMM (but since the > kernel part is not in the tree the implementation is marked as WIP). Adding libvirt folks. This intentionally designs the interface in a way that requires a privileged intermediary to monitor netlink on the host, associate messages to VMs based on an attached device, and re-inject the event to the VMM. Why wouldn't we use a channel associated with the device for such events, such that the VMM has direct access? The netlink path seems like it has more moving pieces, possibly scalability issues, and maybe security issues? > > What sort of ACPI events are we expecting to see here and what does user space do with them? > > With this patch we are expecting to see and propagate any device > specific notifications, which are aimed to notify the proper device > (driver) which belongs to the guest. > > Here is the description how propagating such notification could be > implemented by VMM: > > 1) VMM could upfront generate proper virtual ACPI description for > guest per vfio-pci device (more precisely it could be e.g. ACPI GPE > handler, which aim is only to notify relevant device): The proposed interface really has no introspection, how does the VMM know which devices need ACPI tables added "upfront"? How do these events factor into hotplug device support, where we may not be able to dynamically inject ACPI code into the VM? > > Scope (_GPE) > { > Method (_E00, 0, NotSerialized) // _Exx: Edge-Triggered > GPE, xx=0x00-0xFF > { > Local0 = \_SB.PC00.PE08.NOTY > Notify (\_SB.PC00.PE08, Local0) > } > } > > 2) Now, when the VMM receives ACPI netlink event (thanks to VMM > builtin ACPI event listener, which is able to receive any event > generated through acpi_bus_generate_netlink_event) VMM classifies it > based on device_class ("vfio_pci" in this case) and parses it further > to get device name and the notification value for it. This > notification value is stored in a virtual register and VMM triggers > GPE associated with the pci-vfio device. Each VMM is listening for netlink events and sees all the netlink traffic from the host, including events destined for other VMMs? This doesn't seem terribly acceptable from a security perspective. > 3) Guest kernel upon handling GPE, thanks to generated AML (ad 1.), > triggers Notify on required pass-through device and therefore > replicates the ACPI Notification on the guest side (Accessing > \_SB.PC00.PE08.NOTY from above example, result with trap to VMM, which > returns previously stored notify value). The acpi_bus_generate_netlink_event() below really only seems to form a u8 event type from the u32 event. Is this something that could be provided directly from the vfio device uAPI with an ioeventfd, thus providing introspection that a device supports ACPI event notifications and the ability for the VMM to exclusively monitor those events, and only those events for the device, without additional privileges? Thanks, Alex > With above the ACPI notifications are actually replicated on the guest > side and from a guest driver perspective they don't differ from native > ones. > > > > > > Signed-off-by: Dominik Behr <dbehr(a)chromium.org> > > > Co-developed-by: Grzegorz Jaszczyk <jaz(a)semihalf.com> > > > Signed-off-by: Grzegorz Jaszczyk <jaz(a)semihalf.com> > > > --- > > > drivers/vfio/pci/vfio_pci_core.c | 33 ++++++++++++++++++++++++++++++++ > > > 1 file changed, 33 insertions(+) > > > > > > diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c > > > index a5ab416cf476..92b8ed8d087c 100644 > > > --- a/drivers/vfio/pci/vfio_pci_core.c > > > +++ b/drivers/vfio/pci/vfio_pci_core.c > > > @@ -10,6 +10,7 @@ > > > > > > #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt > > > > > > +#include <linux/acpi.h> > > > #include <linux/aperture.h> > > > #include <linux/device.h> > > > #include <linux/eventfd.h> > > > @@ -2120,10 +2121,20 @@ void vfio_pci_core_release_dev(struct vfio_device *core_vdev) > > > } > > > EXPORT_SYMBOL_GPL(vfio_pci_core_release_dev); > > > > > > +static void vfio_pci_core_acpi_notify(acpi_handle handle, u32 event, void *data) > > > +{ > > > + struct vfio_pci_core_device *vdev = (struct vfio_pci_core_device *)data; > > > + struct device *dev = &vdev->pdev->dev; > > > + > > > + acpi_bus_generate_netlink_event("vfio_pci", dev_name(dev), event, 0); > > > > Who listens to this? Should there be an in-band means to provide > > notifies related to the device? How does a userspace driver know to > > look for netlink events for a particular device? > > VMM which has implemented logic responsible for listening on acpi > netlink events. This netlink message already passes the device name so > VMM will associate it with a particular device. I've elaborated a bit > more in my previous answer. > > > > > > +} > > > + > > > int vfio_pci_core_register_device(struct vfio_pci_core_device *vdev) > > > { > > > + acpi_status status; > > > struct pci_dev *pdev = vdev->pdev; > > > struct device *dev = &pdev->dev; > > > + struct acpi_device *adev = ACPI_COMPANION(&pdev->dev); > > > int ret; > > > > > > /* Drivers must set the vfio_pci_core_device to their drvdata */ > > > @@ -2201,8 +2212,24 @@ int vfio_pci_core_register_device(struct vfio_pci_core_device *vdev) > > > ret = vfio_register_group_dev(&vdev->vdev); > > > if (ret) > > > goto out_power; > > > + > > > + if (!adev) { > > > + pci_info(pdev, "No ACPI companion"); > > > > This would be a log message generated for 99.99% of devices. > > Sure - I will remove that. > > > > > > + return 0; > > > + } > > > + > > > + status = acpi_install_notify_handler(adev->handle, ACPI_DEVICE_NOTIFY, > > > + vfio_pci_core_acpi_notify, (void *)vdev); > > > > vfio-pci supports non-ACPI platforms, I don't see any !CONFIG_ACPI > > prototypes for this function. Thanks, > > Good point, I will address this in the next version. > > Thank you, > Grzegorz > > > > > Alex > > > > > + > > > + if (ACPI_FAILURE(status)) { > > > + pci_err(pdev, "Failed to install notify handler"); > > > + goto out_group_register; > > > + } > > > + > > > return 0; > > > > > > +out_group_register: > > > + vfio_unregister_group_dev(&vdev->vdev); > > > out_power: > > > if (!disable_idle_d3) > > > pm_runtime_get_noresume(dev); > > > @@ -2216,6 +2243,12 @@ EXPORT_SYMBOL_GPL(vfio_pci_core_register_device); > > > > > > void vfio_pci_core_unregister_device(struct vfio_pci_core_device *vdev) > > > { > > > + struct acpi_device *adev = ACPI_COMPANION(&vdev->pdev->dev); > > > + > > > + if (adev) > > > + acpi_remove_notify_handler(adev->handle, ACPI_DEVICE_NOTIFY, > > > + vfio_pci_core_acpi_notify); > > > + > > > vfio_pci_core_sriov_configure(vdev, 0); > > > > > > vfio_unregister_group_dev(&vdev->vdev); > > >

5 10

[PATCH] ci: Refresh CI files with current lcitool
by Martin Kletzander 24 Mar '23

24 Mar '23

This updates to FreeBSD 12.4 which has clang that supports -fsemantic-interposition, plus of course updates the system. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- ci/gitlab/builds.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci/gitlab/builds.yml b/ci/gitlab/builds.yml index d982824b65ad..545478d3516d 100644 --- a/ci/gitlab/builds.yml +++ b/ci/gitlab/builds.yml @@ -837,7 +837,7 @@ x86_64-freebsd-12: needs: [] allow_failure: false variables: - CIRRUS_VM_IMAGE_NAME: freebsd-12-3 + CIRRUS_VM_IMAGE_NAME: freebsd-12-4 CIRRUS_VM_IMAGE_SELECTOR: image_family CIRRUS_VM_INSTANCE_TYPE: freebsd_instance INSTALL_COMMAND: pkg install -y -- 2.40.0

2 1

[PATCH] meson: Don't build tests when CLang lacks -fsemantic-interposition
by Michal Privoznik 24 Mar '23

24 Mar '23

There are some CLang versions that do not support -fsemantic-interposition. If that's the case, the code is optimized so much that our mocking no longer works. Therefore, disable tests and produce a warning. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Technically, this is a v2 of: https://listman.redhat.com/archives/libvir-list/2023-March/238943.html but a different approach is implemented, so I'm sending it anew. meson.build | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/meson.build b/meson.build index a0682e8d0b..c15003ce02 100644 --- a/meson.build +++ b/meson.build @@ -2035,8 +2035,18 @@ subdir('src') subdir('tools') -build_tests = not get_option('tests').disabled() -if build_tests +build_tests = [ not get_option('tests').disabled() ] +if build_tests[0] and \ + cc.get_id() == 'clang' and \ + not supported_cc_flags.contains('-fsemantic-interposition') \ + and get_option('optimization') != '0' + # If CLang doesn't support -fsemantic-interposition then our + # mocking doesn't work. The best we can do is to not run the + # test suite. + build_tests = [ false, '!!! Forcibly disabling tests because CLang lacks -fsemantic-interposition. Update CLang or disable optimization !!!' ] +endif + +if build_tests[0] subdir('tests') endif -- 2.39.2

3 3

[PATCH] ci: Add OpenSUSE leap 15.4 job
by Peter Krempa 23 Mar '23

23 Mar '23

As a precursor to dropping the EOL OpenSUSE 15.3 job add first the definitions for the replacement version. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- Posting this one separately so that we validate that the container images can be built successfully before converting any jobs. I've witnessed some failures in the libvirt-ci repo regarding building the 15.4 container. ci/buildenv/opensuse-leap-154.sh | 96 +++++++++++++++++++++ ci/containers/opensuse-leap-154.Dockerfile | 97 ++++++++++++++++++++++ ci/gitlab/builds.yml | 20 +++++ ci/gitlab/containers.yml | 7 ++ ci/manifest.yml | 6 ++ 5 files changed, 226 insertions(+) create mode 100644 ci/buildenv/opensuse-leap-154.sh create mode 100644 ci/containers/opensuse-leap-154.Dockerfile diff --git a/ci/buildenv/opensuse-leap-154.sh b/ci/buildenv/opensuse-leap-154.sh new file mode 100644 index 0000000000..93cb99c83b --- /dev/null +++ b/ci/buildenv/opensuse-leap-154.sh @@ -0,0 +1,96 @@ +# THIS FILE WAS AUTO-GENERATED +# +# $ lcitool manifest ci/manifest.yml +# +# https://gitlab.com/libvirt/libvirt-ci + +function install_buildenv() { + zypper update -y + zypper install -y \ + audit-devel \ + augeas \ + augeas-lenses \ + bash-completion \ + ca-certificates \ + ccache \ + clang \ + codespell \ + cpp \ + cppi \ + cyrus-sasl-devel \ + device-mapper-devel \ + diffutils \ + dwarves \ + ebtables \ + fuse-devel \ + gcc \ + gettext-runtime \ + git \ + glib2-devel \ + glibc-devel \ + glibc-locale \ + glusterfs-devel \ + grep \ + iproute2 \ + iptables \ + kmod \ + libacl-devel \ + libapparmor-devel \ + libattr-devel \ + libblkid-devel \ + libcap-ng-devel \ + libcurl-devel \ + libgnutls-devel \ + libiscsi-devel \ + libnl3-devel \ + libnuma-devel \ + libpcap-devel \ + libpciaccess-devel \ + librbd-devel \ + libselinux-devel \ + libssh-devel \ + libssh2-devel \ + libtirpc-devel \ + libudev-devel \ + libwsman-devel \ + libxml2 \ + libxml2-devel \ + libxslt \ + libyajl-devel \ + lvm2 \ + make \ + meson \ + nfs-utils \ + ninja \ + numad \ + open-iscsi \ + parted-devel \ + perl-base \ + pkgconfig \ + polkit \ + python3-base \ + python3-docutils \ + python3-flake8 \ + qemu-tools \ + readline-devel \ + rpcgen \ + rpm-build \ + sanlock-devel \ + scrub \ + sed \ + systemd-rpm-macros \ + systemtap-sdt-devel \ + wireshark-devel \ + xen-devel + rpm -qa | sort > /packages.txt + mkdir -p /usr/libexec/ccache-wrappers + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc +} + +export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers" +export LANG="en_US.UTF-8" +export MAKE="/usr/bin/make" +export NINJA="/usr/bin/ninja" +export PYTHON="/usr/bin/python3" diff --git a/ci/containers/opensuse-leap-154.Dockerfile b/ci/containers/opensuse-leap-154.Dockerfile new file mode 100644 index 0000000000..ca11edf808 --- /dev/null +++ b/ci/containers/opensuse-leap-154.Dockerfile @@ -0,0 +1,97 @@ +# THIS FILE WAS AUTO-GENERATED +# +# $ lcitool manifest ci/manifest.yml +# +# https://gitlab.com/libvirt/libvirt-ci + +FROM registry.opensuse.org/opensuse/leap:15.4 + +RUN zypper update -y && \ + zypper install -y \ + audit-devel \ + augeas \ + augeas-lenses \ + bash-completion \ + ca-certificates \ + ccache \ + clang \ + codespell \ + cpp \ + cppi \ + cyrus-sasl-devel \ + device-mapper-devel \ + diffutils \ + dwarves \ + ebtables \ + fuse-devel \ + gcc \ + gettext-runtime \ + git \ + glib2-devel \ + glibc-devel \ + glibc-locale \ + glusterfs-devel \ + grep \ + iproute2 \ + iptables \ + kmod \ + libacl-devel \ + libapparmor-devel \ + libattr-devel \ + libblkid-devel \ + libcap-ng-devel \ + libcurl-devel \ + libgnutls-devel \ + libiscsi-devel \ + libnl3-devel \ + libnuma-devel \ + libpcap-devel \ + libpciaccess-devel \ + librbd-devel \ + libselinux-devel \ + libssh-devel \ + libssh2-devel \ + libtirpc-devel \ + libudev-devel \ + libwsman-devel \ + libxml2 \ + libxml2-devel \ + libxslt \ + libyajl-devel \ + lvm2 \ + make \ + meson \ + nfs-utils \ + ninja \ + numad \ + open-iscsi \ + parted-devel \ + perl-base \ + pkgconfig \ + polkit \ + python3-base \ + python3-docutils \ + python3-flake8 \ + qemu-tools \ + readline-devel \ + rpcgen \ + rpm-build \ + sanlock-devel \ + scrub \ + sed \ + systemd-rpm-macros \ + systemtap-sdt-devel \ + wireshark-devel \ + xen-devel && \ + zypper clean --all && \ + rpm -qa | sort > /packages.txt && \ + mkdir -p /usr/libexec/ccache-wrappers && \ + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \ + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang && \ + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc + +ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers" +ENV LANG "en_US.UTF-8" +ENV MAKE "/usr/bin/make" +ENV NINJA "/usr/bin/ninja" +ENV PYTHON "/usr/bin/python3" diff --git a/ci/gitlab/builds.yml b/ci/gitlab/builds.yml index 89c15fa28d..0f60ba89ce 100644 --- a/ci/gitlab/builds.yml +++ b/ci/gitlab/builds.yml @@ -305,6 +305,26 @@ x86_64-opensuse-leap-153-local-env: RPM: skip +x86_64-opensuse-leap-154-prebuilt-env: + extends: .native_build_job_prebuilt_env + needs: + - job: x86_64-opensuse-leap-154-container + optional: true + allow_failure: false + variables: + NAME: opensuse-leap-154 + RPM: skip + +x86_64-opensuse-leap-154-local-env: + extends: .native_build_job_local_env + needs: [] + allow_failure: false + variables: + IMAGE: registry.opensuse.org/opensuse/leap:15.4 + NAME: opensuse-leap-154 + RPM: skip + + x86_64-opensuse-tumbleweed-prebuilt-env: extends: .native_build_job_prebuilt_env needs: diff --git a/ci/gitlab/containers.yml b/ci/gitlab/containers.yml index fa426bd3a6..241475b5e3 100644 --- a/ci/gitlab/containers.yml +++ b/ci/gitlab/containers.yml @@ -84,6 +84,13 @@ x86_64-opensuse-leap-153-container: NAME: opensuse-leap-153 +x86_64-opensuse-leap-154-container: + extends: .container_job + allow_failure: false + variables: + NAME: opensuse-leap-154 + + x86_64-opensuse-tumbleweed-container: extends: .container_job allow_failure: true diff --git a/ci/manifest.yml b/ci/manifest.yml index 2aa9ce9952..3270be85fe 100644 --- a/ci/manifest.yml +++ b/ci/manifest.yml @@ -166,6 +166,12 @@ targets: variables: RPM: skip + opensuse-leap-154: + jobs: + - arch: x86_64 + variables: + RPM: skip + opensuse-tumbleweed: jobs: - arch: x86_64 -- 2.39.2

2 1

[PATCH] ci: Switch to OpenSUSE leap 15.4
by Peter Krempa 23 Mar '23

23 Mar '23

The '15.3' version is EOL now: https://get.opensuse.org/leap/15.3/ Also switch the 'codestyle' job to the appropriate container image. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- .gitlab-ci.yml | 8 ++++---- .../{opensuse-leap-153.sh => opensuse-leap-154.sh} | 5 +---- ...p-153.Dockerfile => opensuse-leap-154.Dockerfile} | 8 ++------ ci/gitlab/builds.yml | 12 ++++++------ ci/gitlab/containers.yml | 4 ++-- ci/manifest.yml | 2 +- 6 files changed, 16 insertions(+), 23 deletions(-) rename ci/buildenv/{opensuse-leap-153.sh => opensuse-leap-154.sh} (95%) rename ci/containers/{opensuse-leap-153.Dockerfile => opensuse-leap-154.Dockerfile} (93%) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 1b72ebc493..8bf6e5c6b0 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -118,18 +118,18 @@ codestyle_prebuilt_env: - .codestyle_job - .gitlab_native_build_job_prebuilt_env needs: - - job: x86_64-opensuse-leap-153-container + - job: x86_64-opensuse-leap-154-container optional: true variables: - NAME: opensuse-leap-153 + NAME: opensuse-leap-154 codestyle_local_env: extends: - .codestyle_job - .gitlab_native_build_job_local_env variables: - IMAGE: registry.opensuse.org/opensuse/leap:15.3 - NAME: opensuse-leap-153 + IMAGE: registry.opensuse.org/opensuse/leap:15.4 + NAME: opensuse-leap-154 # This artifact published by this job is downloaded to push to Weblate diff --git a/ci/buildenv/opensuse-leap-153.sh b/ci/buildenv/opensuse-leap-154.sh similarity index 95% rename from ci/buildenv/opensuse-leap-153.sh rename to ci/buildenv/opensuse-leap-154.sh index b78382470c..93cb99c83b 100644 --- a/ci/buildenv/opensuse-leap-153.sh +++ b/ci/buildenv/opensuse-leap-154.sh @@ -59,6 +59,7 @@ function install_buildenv() { libyajl-devel \ lvm2 \ make \ + meson \ nfs-utils \ ninja \ numad \ @@ -70,9 +71,6 @@ function install_buildenv() { python3-base \ python3-docutils \ python3-flake8 \ - python3-pip \ - python3-setuptools \ - python3-wheel \ qemu-tools \ readline-devel \ rpcgen \ @@ -89,7 +87,6 @@ function install_buildenv() { ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc - /usr/bin/pip3 install meson==0.56.0 } export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers" diff --git a/ci/containers/opensuse-leap-153.Dockerfile b/ci/containers/opensuse-leap-154.Dockerfile similarity index 93% rename from ci/containers/opensuse-leap-153.Dockerfile rename to ci/containers/opensuse-leap-154.Dockerfile index 49e0c98c8a..ca11edf808 100644 --- a/ci/containers/opensuse-leap-153.Dockerfile +++ b/ci/containers/opensuse-leap-154.Dockerfile @@ -4,7 +4,7 @@ # # https://gitlab.com/libvirt/libvirt-ci -FROM registry.opensuse.org/opensuse/leap:15.3 +FROM registry.opensuse.org/opensuse/leap:15.4 RUN zypper update -y && \ zypper install -y \ @@ -60,6 +60,7 @@ RUN zypper update -y && \ libyajl-devel \ lvm2 \ make \ + meson \ nfs-utils \ ninja \ numad \ @@ -71,9 +72,6 @@ RUN zypper update -y && \ python3-base \ python3-docutils \ python3-flake8 \ - python3-pip \ - python3-setuptools \ - python3-wheel \ qemu-tools \ readline-devel \ rpcgen \ @@ -92,8 +90,6 @@ RUN zypper update -y && \ ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang && \ ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc -RUN /usr/bin/pip3 install meson==0.56.0 - ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers" ENV LANG "en_US.UTF-8" ENV MAKE "/usr/bin/make" diff --git a/ci/gitlab/builds.yml b/ci/gitlab/builds.yml index 89c15fa28d..d982824b65 100644 --- a/ci/gitlab/builds.yml +++ b/ci/gitlab/builds.yml @@ -285,23 +285,23 @@ x86_64-fedora-rawhide-clang-local-env: RPM: skip -x86_64-opensuse-leap-153-prebuilt-env: +x86_64-opensuse-leap-154-prebuilt-env: extends: .native_build_job_prebuilt_env needs: - - job: x86_64-opensuse-leap-153-container + - job: x86_64-opensuse-leap-154-container optional: true allow_failure: false variables: - NAME: opensuse-leap-153 + NAME: opensuse-leap-154 RPM: skip -x86_64-opensuse-leap-153-local-env: +x86_64-opensuse-leap-154-local-env: extends: .native_build_job_local_env needs: [] allow_failure: false variables: - IMAGE: registry.opensuse.org/opensuse/leap:15.3 - NAME: opensuse-leap-153 + IMAGE: registry.opensuse.org/opensuse/leap:15.4 + NAME: opensuse-leap-154 RPM: skip diff --git a/ci/gitlab/containers.yml b/ci/gitlab/containers.yml index fa426bd3a6..150df26519 100644 --- a/ci/gitlab/containers.yml +++ b/ci/gitlab/containers.yml @@ -77,11 +77,11 @@ x86_64-fedora-rawhide-container: NAME: fedora-rawhide -x86_64-opensuse-leap-153-container: +x86_64-opensuse-leap-154-container: extends: .container_job allow_failure: false variables: - NAME: opensuse-leap-153 + NAME: opensuse-leap-154 x86_64-opensuse-tumbleweed-container: diff --git a/ci/manifest.yml b/ci/manifest.yml index 2aa9ce9952..b68c7361ab 100644 --- a/ci/manifest.yml +++ b/ci/manifest.yml @@ -160,7 +160,7 @@ targets: freebsd-13: x86_64 - opensuse-leap-153: + opensuse-leap-154: jobs: - arch: x86_64 variables: -- 2.39.2

3 2

[PATCH] virnettlscontext: allow client/server cert chains
by matoro_mailinglist_libvirt＠matoro.tk 22 Mar '23

22 Mar '23

From: matoro <11910244-matoro3(a)users.noreply.gitlab.com> The existing implementation assumes that client/server certificates are single individual certificates. If using publicly-issued certificates, or internal CAs that use an intermediate issuer, this is unlikely to be the case, and they will instead be certificate chains. While this can be worked around by moving the intermediate certificates to the CA certificate, which DOES currently support multiple certificates, this instead allows the issued certificate chains to be used as-is, without requiring the overhead of shuffling certificates around. See: https://gitlab.com/libvirt/libvirt/-/merge_requests/222 Signed-off-by: matoro <matoro_github(a)matoro.tk> --- src/rpc/virnettlscontext.c | 97 +++++++++++++----------------------- tests/virnettlscontexttest.c | 72 +++++++++++++++++++++++++- 2 files changed, 104 insertions(+), 65 deletions(-) diff --git a/src/rpc/virnettlscontext.c b/src/rpc/virnettlscontext.c index cfd26f0701..78b4b0f187 100644 --- a/src/rpc/virnettlscontext.c +++ b/src/rpc/virnettlscontext.c @@ -424,7 +424,8 @@ static int virNetTLSContextCheckCert(gnutls_x509_crt_t cert, } -static int virNetTLSContextCheckCertPair(gnutls_x509_crt_t cert, +static int virNetTLSContextCheckCertPair(gnutls_x509_crt_t *certs, + size_t ncerts, const char *certFile, gnutls_x509_crt_t *cacerts, size_t ncacerts, @@ -433,7 +434,7 @@ static int virNetTLSContextCheckCertPair(gnutls_x509_crt_t cert, { unsigned int status; - if (gnutls_x509_crt_list_verify(&cert, 1, + if (gnutls_x509_crt_list_verify(certs, ncerts, cacerts, ncacerts, NULL, 0, 0, &status) < 0) { @@ -469,57 +470,18 @@ static int virNetTLSContextCheckCertPair(gnutls_x509_crt_t cert, } -static gnutls_x509_crt_t virNetTLSContextLoadCertFromFile(const char *certFile, - bool isServer) -{ - gnutls_datum_t data; - gnutls_x509_crt_t cert = NULL; - g_autofree char *buf = NULL; - int ret = -1; - - VIR_DEBUG("isServer %d certFile %s", - isServer, certFile); - - if (gnutls_x509_crt_init(&cert) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, "%s", - _("Unable to initialize certificate")); - goto cleanup; - } - - if (virFileReadAll(certFile, (1<<16), &buf) < 0) - goto cleanup; - - data.data = (unsigned char *)buf; - data.size = strlen(buf); - - if (gnutls_x509_crt_import(cert, &data, GNUTLS_X509_FMT_PEM) < 0) { - virReportError(VIR_ERR_SYSTEM_ERROR, isServer ? - _("Unable to import server certificate %s") : - _("Unable to import client certificate %s"), - certFile); - goto cleanup; - } - - ret = 0; - - cleanup: - if (ret != 0) { - g_clear_pointer(&cert, gnutls_x509_crt_deinit); - } - return cert; -} - - -static int virNetTLSContextLoadCACertListFromFile(const char *certFile, - gnutls_x509_crt_t *certs, - unsigned int certMax, - size_t *ncerts) +static int virNetTLSContextLoadCertListFromFile(const char *certFile, + gnutls_x509_crt_t *certs, + unsigned int certMax, + size_t *ncerts, + bool isServer, + bool isCA) { gnutls_datum_t data; g_autofree char *buf = NULL; *ncerts = 0; - VIR_DEBUG("certFile %s", certFile); + VIR_DEBUG("isCA %d isServer %d certFile %s", isCA, isServer, certFile); if (virFileReadAll(certFile, (1<<16), &buf) < 0) return -1; @@ -527,9 +489,13 @@ static int virNetTLSContextLoadCACertListFromFile(const char *certFile, data.data = (unsigned char *)buf; data.size = strlen(buf); - if (gnutls_x509_crt_list_import(certs, &certMax, &data, GNUTLS_X509_FMT_PEM, 0) < 0) { + if (gnutls_x509_crt_list_import(certs, &certMax, &data, GNUTLS_X509_FMT_PEM, + isCA ? GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED : + GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED | GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, - _("Unable to import CA certificate list %s"), + isCA ? _("Unable to import CA certificate list %s") : + (isServer ? _("Unable to import server certificate %s") : + _("Unable to import client certificate %s")), certFile); return -1; } @@ -539,44 +505,49 @@ static int virNetTLSContextLoadCACertListFromFile(const char *certFile, } -#define MAX_CERTS 16 +// Limited by frame size of 4096 bytes. +// Typical system CA bundle contains 140-ish CAs. +#define MAX_CERTS 200 static int virNetTLSContextSanityCheckCredentials(bool isServer, const char *cacertFile, const char *certFile) { - gnutls_x509_crt_t cert = NULL; + gnutls_x509_crt_t certs[MAX_CERTS]; gnutls_x509_crt_t cacerts[MAX_CERTS]; - size_t ncacerts = 0; + size_t ncerts = 0, ncacerts = 0; size_t i; int ret = -1; + memset(certs, 0, sizeof(certs)); memset(cacerts, 0, sizeof(cacerts)); if ((access(certFile, R_OK) == 0) && - !(cert = virNetTLSContextLoadCertFromFile(certFile, isServer))) + virNetTLSContextLoadCertListFromFile(certFile, certs, + MAX_CERTS, &ncerts, isServer, false) < 0) goto cleanup; if ((access(cacertFile, R_OK) == 0) && - virNetTLSContextLoadCACertListFromFile(cacertFile, cacerts, - MAX_CERTS, &ncacerts) < 0) + virNetTLSContextLoadCertListFromFile(cacertFile, cacerts, + MAX_CERTS, &ncacerts, isServer, true) < 0) goto cleanup; - if (cert && - virNetTLSContextCheckCert(cert, certFile, isServer, false) < 0) - goto cleanup; + for (i = 0; i < ncerts; i++) { + if (virNetTLSContextCheckCert(certs[i], certFile, isServer, (i != 0)) < 0) + goto cleanup; + } for (i = 0; i < ncacerts; i++) { if (virNetTLSContextCheckCert(cacerts[i], cacertFile, isServer, true) < 0) goto cleanup; } - if (cert && ncacerts && - virNetTLSContextCheckCertPair(cert, certFile, cacerts, ncacerts, cacertFile, isServer) < 0) + if (ncerts && ncacerts && + virNetTLSContextCheckCertPair(certs, ncerts, certFile, cacerts, ncacerts, cacertFile, isServer) < 0) goto cleanup; ret = 0; cleanup: - if (cert) - gnutls_x509_crt_deinit(cert); + for (i = 0; i < ncerts; i++) + gnutls_x509_crt_deinit(certs[i]); for (i = 0; i < ncacerts; i++) gnutls_x509_crt_deinit(cacerts[i]); return ret; diff --git a/tests/virnettlscontexttest.c b/tests/virnettlscontexttest.c index 2311524db8..918ff04134 100644 --- a/tests/virnettlscontexttest.c +++ b/tests/virnettlscontexttest.c @@ -517,6 +517,12 @@ mymain(void) true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); + TLS_ROOT_REQ(someotherrootreq, + "UK", "some other random CA", NULL, NULL, NULL, NULL, + true, true, true, + true, true, GNUTLS_KEY_KEY_CERT_SIGN, + false, false, NULL, NULL, + 0, 0); TLS_CERT_REQ(cacertlevel1areq, cacertrootreq, "UK", "libvirt level 1a", NULL, NULL, NULL, NULL, true, true, true, @@ -555,15 +561,72 @@ mymain(void) cacertlevel2areq.crt, }; + gnutls_x509_crt_t cabundle[] = { + someotherrootreq.crt, + cacertrootreq.crt, + }; + + gnutls_x509_crt_t servercertchain[] = { + servercertlevel3areq.crt, + cacertlevel2areq.crt, + cacertlevel1areq.crt, + }; + + gnutls_x509_crt_t servercertchain_incomplete[] = { + servercertlevel3areq.crt, + cacertlevel2areq.crt, + }; + + gnutls_x509_crt_t servercertchain_unsorted[] = { + servercertlevel3areq.crt, + cacertlevel1areq.crt, + cacertlevel2areq.crt, + }; + + gnutls_x509_crt_t clientcertchain[] = { + clientcertlevel2breq.crt, + cacertlevel1breq.crt, + }; + testTLSWriteCertChain("cacertchain-ctx.pem", certchain, G_N_ELEMENTS(certchain)); - VIR_WARNINGS_RESET - DO_CTX_TEST(true, "cacertchain-ctx.pem", servercertlevel3areq.filename, false); DO_CTX_TEST(false, "cacertchain-ctx.pem", clientcertlevel2breq.filename, false); + testTLSWriteCertChain("servercertchain-ctx.pem", + servercertchain, + G_N_ELEMENTS(servercertchain)); + + DO_CTX_TEST(true, cacertrootreq.filename, "servercertchain-ctx.pem", false); + + testTLSWriteCertChain("cabundle-ctx.pem", + cabundle, + G_N_ELEMENTS(cabundle)); + + DO_CTX_TEST(true, "cabundle-ctx.pem", "servercertchain-ctx.pem", false); + + testTLSWriteCertChain("servercertchain_incomplete-ctx.pem", + servercertchain_incomplete, + G_N_ELEMENTS(servercertchain_incomplete)); + + DO_CTX_TEST(true, cacertrootreq.filename, "servercertchain_incomplete-ctx.pem", true); + + testTLSWriteCertChain("servercertchain_unsorted-ctx.pem", + servercertchain_unsorted, + G_N_ELEMENTS(servercertchain_unsorted)); + + DO_CTX_TEST(true, cacertrootreq.filename, "servercertchain_unsorted-ctx.pem", true); + + testTLSWriteCertChain("clientcertchain-ctx.pem", + clientcertchain, + G_N_ELEMENTS(clientcertchain)); + + VIR_WARNINGS_RESET + + DO_CTX_TEST(false, cacertrootreq.filename, "clientcertchain-ctx.pem", false); + DO_CTX_TEST(false, "cacertdoesnotexist.pem", "servercertdoesnotexist.pem", true); testTLSDiscardCert(&cacertreq); @@ -620,7 +683,12 @@ mymain(void) testTLSDiscardCert(&cacertlevel2areq); testTLSDiscardCert(&servercertlevel3areq); testTLSDiscardCert(&clientcertlevel2breq); + testTLSDiscardCert(&someotherrootreq); unlink("cacertchain-ctx.pem"); + unlink("servercertchain-ctx.pem"); + unlink("servercertchain_incomplete-ctx.pem"); + unlink("servercertchain_unsorted-ctx.pem"); + unlink("clientcertchain.pem"); testTLSCleanup(KEYFILE); -- 2.39.1

2 1

[PATCH] qemu_domain: Drop ATTRIBUTE_NONNULL() for non-existent arguments
by Michal Privoznik 22 Mar '23

22 Mar '23

After cleanup done in v8.2.0-rc1~47 the qemuDomainObjExitMonitor() and after v8.7.0-rc1~176 the qemuDomainObjEnterMonitor() lost the @driver argument. But corresponding ATTRIBUTE_NONNULL() annotation was not removed and both functions are still annotated as ATTRIBUTE_NONNULL(2) even though they accept just one argument (@obj). Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_domain.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h index c716e64ccc..eaa75de3e5 100644 --- a/src/qemu/qemu_domain.h +++ b/src/qemu/qemu_domain.h @@ -579,9 +579,9 @@ void qemuDomainEventFlush(int timer, void *opaque); qemuMonitor *qemuDomainGetMonitor(virDomainObj *vm) ATTRIBUTE_NONNULL(1); void qemuDomainObjEnterMonitor(virDomainObj *obj) - ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2); + ATTRIBUTE_NONNULL(1); void qemuDomainObjExitMonitor(virDomainObj *obj) - ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2); + ATTRIBUTE_NONNULL(1); int qemuDomainObjEnterMonitorAsync(virDomainObj *obj, virDomainAsyncJob asyncJob) ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) G_GNUC_WARN_UNUSED_RESULT; -- 2.39.2

2 1

[PATCH] qemu_shim: Require absolute path for root directory
by Michal Privoznik 22 Mar '23

22 Mar '23

The virConnectOpen(), well virConnectOpenInternal() reports an error if embed root is not an absolute path. This is a fair requirement, but our qemu_shim doesn't check this requirement and instead mkdir()-s passed path only to fail later on, leaving the empty directory behind: $ ls -d asd ls: cannot access 'asd': No such file or directory $ virt-qemu-run -r asd whatever.xml virt-qemu-run: cannot open qemu:///embed?root=asd: unsupported configuration: root path must be absolute $ ls -d asd asd Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_shim.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_shim.c b/src/qemu/qemu_shim.c index 7b58583074..33a6aa7d94 100644 --- a/src/qemu/qemu_shim.c +++ b/src/qemu/qemu_shim.c @@ -209,10 +209,18 @@ int main(int argc, char **argv) } tmproot = true; - } else if (g_mkdir_with_parents(root, 0755) < 0) { - g_printerr("%s: cannot create dir: %s\n", - argv[0], g_strerror(errno)); - goto cleanup; + } else { + if (!g_path_is_absolute(root)) { + g_printerr("%s: the root directory must be an absolute path\n", + argv[0]); + goto cleanup; + } + + if (g_mkdir_with_parents(root, 0755) < 0) { + g_printerr("%s: cannot create dir: %s\n", + argv[0], g_strerror(errno)); + goto cleanup; + } } if (chmod(root, 0755) < 0) { -- 2.39.2

2 1

[libvirt PATCH] qemu_shim: set system identity
by Ján Tomko 22 Mar '23

22 Mar '23

Otherwise looking up a secret fails when we try to elevate the identity in qemuDomainSecretInfoSetupFromSecret. https://bugzilla.redhat.com/show_bug.cgi?id=2000410 Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/qemu/qemu_shim.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/qemu/qemu_shim.c b/src/qemu/qemu_shim.c index 7b58583074..b642f6175a 100644 --- a/src/qemu/qemu_shim.c +++ b/src/qemu/qemu_shim.c @@ -26,6 +26,7 @@ #include "virfile.h" #include "virgettext.h" +#include "viridentity.h" #include "virthread.h" #define VIR_FROM_THIS VIR_FROM_QEMU @@ -133,6 +134,7 @@ qemuShimQuench(void *userData G_GNUC_UNUSED, int main(int argc, char **argv) { + g_autoptr(virIdentity) sysident = NULL; GThread *eventLoopThread = NULL; virConnectPtr conn = NULL; virConnectPtr sconn = NULL; @@ -191,6 +193,9 @@ int main(int argc, char **argv) virSetErrorFunc(NULL, qemuShimQuench); + sysident = virIdentityGetSystem(); + virIdentitySetCurrent(sysident); + if (verbose) g_printerr("%s: %lld: initializing signal handlers\n", argv[0], deltams()); -- 2.39.2

2 1

[PATCH v2 0/6] Introduce active RBD disk snapshot support
by Or Ozeri 22 Mar '23

22 Mar '23

Internal disk snapshots are currently only supported on non-active VMs. For RBD disks only, this patch series extends this support for active VMs running with qemu. We also add the option to set a name for each RBD snapshot, and allow taking them alongside other external disk snapshots (mixing). Deletion and reverting to snapshots containing RBD snapshots is not allowed, and is validated. Note that taking RBD snapshots on a non-active VM is still unsupported. Changes in v2: - reduce patch to RBD use-case only (e.g. not including qcow2 internal snapshots) - add validation to disallow RBD snapshots deletion / reverting Or Ozeri (6): conf: Add snapshotName attribute for internal disk snapshot qemu: Block deletion and reverting on non-full internal snapshots qemu: Add internal support for active disk internal snapshots qemu: Allow active disk snapshots for RBD disks qemu: Allow setting per-disk snapshot name for RBD disks qemu: Allow mixing active internal and external active disk snapshots docs/formatsnapshot.rst | 5 + src/conf/schemas/domainsnapshot.rng | 4 + src/conf/snapshot_conf.c | 56 ++++++++++ src/conf/snapshot_conf.h | 5 + src/libvirt_private.syms | 1 + src/qemu/qemu_monitor.c | 9 ++ src/qemu/qemu_monitor.h | 5 + src/qemu/qemu_monitor_json.c | 14 +++ src/qemu/qemu_monitor_json.h | 5 + src/qemu/qemu_snapshot.c | 105 ++++++++++++------ .../disk_snapshot.xml | 2 +- .../disk_snapshot.xml | 2 +- .../disk_snapshot_redefine.xml | 2 +- tests/qemumonitorjsontest.c | 1 + 14 files changed, 181 insertions(+), 35 deletions(-) -- 2.25.1

3 14

[libvirt PATCH 0/1] qemu: Fix memory leaks in firmware selection code
by Andrea Bolognani 22 Mar '23

22 Mar '23

Reported when building with gcc and clang both. ==10909==ERROR: LeakSanitizer: detected memory leaks Direct leak of 128 byte(s) in 4 object(s) allocated from: #0 0x7f191d4a2808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144 #1 0x7f191987ae98 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57e98) SUMMARY: AddressSanitizer: 128 byte(s) leaked in 4 allocation(s). This patch is a requirement for pushing my recent improvements to firmware selection[1] without further degrading the CI pipeline. [1] https://listman.redhat.com/archives/libvir-list/2023-March/238890.html Andrea Bolognani (1): qemu: Fix memory leaks in firmware selection code src/qemu/qemu_firmware.c | 4 ++++ 1 file changed, 4 insertions(+) -- 2.39.2

2 2

[libvirt PATCH 00/15] qemu: Further improvements to firmware selection
by Andrea Bolognani 22 Mar '23

22 Mar '23

More information in the commit message for 11/15. Ideally this would make it into 9.2.0 along with the other changes to firmware selection I've made in this cycle[1]. [1] https://listman.redhat.com/archives/libvir-list/2023-February/237806.html Andrea Bolognani (15): tests: Rename a few firmware tests tests: Fix firmware-auto-efi-loader-path-nonstandard tests: Add firmware-auto-efi-loader-path tests: Add more tests for manual Secure Boot configuration tests: Fix firmware descriptor masking test qemu: Introduce qemuFirmwareMatchesPaths() qemu: Discard requires-smm firmware when loader.secure=no qemu: Always go through firmware autoselection conf: Remove some firmware validation checks conf: Don't format firmware type/features when migrating qemu: Don't drop firmware type/features information qemu: Automatically add firmware type/features information conf: Don't explicitly set the secure-boot feature conf: Move validation check out of postparse qemu: Move validation check out of postparse src/conf/domain_conf.c | 5 +- src/conf/domain_postparse.c | 16 -- src/conf/domain_validate.c | 42 +--- src/qemu/qemu_domain.c | 6 - src/qemu/qemu_firmware.c | 186 +++++++++++++----- src/qemu/qemu_validate.c | 6 + .../{60-ovmf-sb.json => 42-masked.json} | 0 .../usr/share/qemu/firmware/42-masked.json | 37 ++++ tests/qemufirmwaretest.c | 2 + ...to-efi-loader-insecure.x86_64-latest.args} | 0 ...auto-efi-loader-insecure.x86_64-latest.err | 1 - ...-loader-path-nonstandard.x86_64-latest.err | 1 + ...ware-auto-efi-loader-path-nonstandard.xml} | 2 +- ...e-auto-efi-loader-path.x86_64-latest.args} | 0 ...are-auto-efi-loader-path.x86_64-latest.err | 1 - .../firmware-auto-efi-loader-path.xml | 2 +- ...to-efi-no-enrolled-keys.x86_64-latest.args | 5 +- ...nual-efi-loader-no-path.x86_64-latest.err} | 0 ...=> firmware-manual-efi-loader-no-path.xml} | 0 ...nual-efi-loader-secure.x86_64-latest.args} | 0 ... => firmware-manual-efi-loader-secure.xml} | 0 ...l-efi-no-enrolled-keys.x86_64-latest.args} | 0 ... firmware-manual-efi-no-enrolled-keys.xml} | 2 +- ...-manual-efi-no-secboot.x86_64-latest.args} | 4 +- ...xml => firmware-manual-efi-no-secboot.xml} | 5 +- ...are-manual-efi-secboot.x86_64-latest.args} | 0 ...re.xml => firmware-manual-efi-secboot.xml} | 2 +- tests/qemuxml2argvtest.c | 12 +- ...ware-auto-bios-stateless.x86_64-latest.xml | 6 +- .../firmware-auto-bios.x86_64-latest.xml | 6 +- ...rmware-auto-efi-aarch64.aarch64-latest.xml | 6 +- ...e-auto-efi-enrolled-keys.x86_64-latest.xml | 6 +- ...-efi-format-loader-qcow2.x86_64-latest.xml | 6 +- ...o-efi-format-loader-raw.aarch64-latest.xml | 6 +- ...-nvram-qcow2-network-nbd.x86_64-latest.xml | 5 +- ...-format-nvram-qcow2-path.x86_64-latest.xml | 6 +- ...o-efi-format-nvram-qcow2.x86_64-latest.xml | 6 +- ...uto-efi-loader-insecure.x86_64-latest.xml} | 8 +- ...loader-path-nonstandard.x86_64-latest.xml} | 4 +- ...re-auto-efi-loader-path.x86_64-latest.xml} | 6 +- ...e-auto-efi-loader-secure.x86_64-latest.xml | 6 +- ...uto-efi-no-enrolled-keys.x86_64-latest.xml | 9 +- ...ware-auto-efi-no-secboot.x86_64-latest.xml | 6 +- ...ware-auto-efi-nvram-file.x86_64-latest.xml | 6 +- ...-efi-nvram-network-iscsi.x86_64-latest.xml | 5 +- ...to-efi-nvram-network-nbd.x86_64-latest.xml | 5 +- .../firmware-auto-efi-nvram.x86_64-latest.xml | 6 +- ...irmware-auto-efi-secboot.x86_64-latest.xml | 6 +- ...irmware-auto-efi-smm-off.x86_64-latest.xml | 6 +- ...mware-auto-efi-stateless.x86_64-latest.xml | 6 +- .../firmware-auto-efi.x86_64-latest.xml | 6 +- ...manual-efi-acpi-aarch64.aarch64-latest.xml | 6 +- ...ware-manual-efi-acpi-q35.x86_64-latest.xml | 6 +- ...anual-efi-loader-secure.x86_64-latest.xml} | 6 +- ...al-efi-no-enrolled-keys.x86_64-latest.xml} | 8 +- ...e-manual-efi-no-secboot.x86_64-latest.xml} | 6 +- ...nual-efi-noacpi-aarch64.aarch64-latest.xml | 6 +- ...re-manual-efi-nvram-file.x86_64-latest.xml | 6 +- ...-efi-nvram-network-iscsi.x86_64-latest.xml | 5 +- ...al-efi-nvram-network-nbd.x86_64-latest.xml | 5 +- ...anual-efi-nvram-template.x86_64-latest.xml | 6 +- ...ware-manual-efi-secboot.x86_64-latest.xml} | 6 +- .../firmware-manual-efi.x86_64-latest.xml | 6 +- .../pvpanic-pci-aarch64.aarch64-latest.xml | 6 +- ...-pci-no-address-aarch64.aarch64-latest.xml | 6 +- .../virtio-iommu-aarch64.aarch64-latest.xml | 6 +- tests/qemuxml2xmltest.c | 8 +- 67 files changed, 409 insertions(+), 164 deletions(-) rename tests/qemufirmwaredata/etc/qemu/firmware/{60-ovmf-sb.json => 42-masked.json} (100%) create mode 100644 tests/qemufirmwaredata/usr/share/qemu/firmware/42-masked.json copy tests/qemuxml2argvdata/{firmware-auto-efi-no-enrolled-keys.x86_64-latest.args => firmware-auto-efi-loader-insecure.x86_64-latest.args} (100%) delete mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-loader-insecure.x86_64-latest.err create mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-loader-path-nonstandard.x86_64-latest.err copy tests/qemuxml2argvdata/{firmware-auto-efi-loader-path.xml => firmware-auto-efi-loader-path-nonstandard.xml} (86%) copy tests/qemuxml2argvdata/{firmware-auto-efi-no-enrolled-keys.x86_64-latest.args => firmware-auto-efi-loader-path.x86_64-latest.args} (100%) delete mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-loader-path.x86_64-latest.err rename tests/qemuxml2argvdata/{firmware-manual-efi-no-path.x86_64-latest.err => firmware-manual-efi-loader-no-path.x86_64-latest.err} (100%) rename tests/qemuxml2argvdata/{firmware-manual-efi-no-path.xml => firmware-manual-efi-loader-no-path.xml} (100%) copy tests/qemuxml2argvdata/{firmware-manual-efi-secure.x86_64-latest.args => firmware-manual-efi-loader-secure.x86_64-latest.args} (100%) copy tests/qemuxml2argvdata/{firmware-manual-efi-secure.xml => firmware-manual-efi-loader-secure.xml} (100%) copy tests/qemuxml2argvdata/{firmware-manual-efi-secure.x86_64-latest.args => firmware-manual-efi-no-enrolled-keys.x86_64-latest.args} (100%) copy tests/qemuxml2argvdata/{firmware-manual-efi-secure.xml => firmware-manual-efi-no-enrolled-keys.xml} (87%) copy tests/qemuxml2argvdata/{firmware-auto-efi-no-enrolled-keys.x86_64-latest.args => firmware-manual-efi-no-secboot.x86_64-latest.args} (90%) copy tests/qemuxml2argvdata/{firmware-manual-efi-secure.xml => firmware-manual-efi-no-secboot.xml} (72%) rename tests/qemuxml2argvdata/{firmware-manual-efi-secure.x86_64-latest.args => firmware-manual-efi-secboot.x86_64-latest.args} (100%) rename tests/qemuxml2argvdata/{firmware-manual-efi-secure.xml => firmware-manual-efi-secboot.xml} (86%) copy tests/qemuxml2xmloutdata/{firmware-auto-efi-no-enrolled-keys.x86_64-latest.xml => firmware-auto-efi-loader-insecure.x86_64-latest.xml} (82%) copy tests/qemuxml2xmloutdata/{firmware-auto-bios-stateless.x86_64-latest.xml => firmware-auto-efi-loader-path-nonstandard.x86_64-latest.xml} (92%) copy tests/qemuxml2xmloutdata/{firmware-auto-efi-no-enrolled-keys.x86_64-latest.xml => firmware-auto-efi-loader-path.x86_64-latest.xml} (89%) copy tests/qemuxml2xmloutdata/{firmware-manual-efi-secure.x86_64-latest.xml => firmware-manual-efi-loader-secure.x86_64-latest.xml} (89%) copy tests/qemuxml2xmloutdata/{firmware-manual-efi-secure.x86_64-latest.xml => firmware-manual-efi-no-enrolled-keys.x86_64-latest.xml} (83%) copy tests/qemuxml2xmloutdata/{firmware-manual-efi-acpi-q35.x86_64-latest.xml => firmware-manual-efi-no-secboot.x86_64-latest.xml} (89%) rename tests/qemuxml2xmloutdata/{firmware-manual-efi-secure.x86_64-latest.xml => firmware-manual-efi-secboot.x86_64-latest.xml} (89%) -- 2.39.2

2 17