- Devel - libvirt List Archives

[PATCH V2 0/9] spec: Decompose the daemon subpackage
by Jim Fehlig 19 Dec '22

19 Dec '22

This is a V2 of: https://listman.redhat.com/archives/libvir-list/2022-December/236073.html Original RFC: https://listman.redhat.com/archives/libvir-list/2022-November/235924.html The end goal is to remove the libvirt-dameon dependency on the various libvirt-daemon-driver-foo subpackages, allowing installation of a modular daemon configuration without the traditional monolithic libvirtd. Change from V1: - Change name of new subpackage libvirt-daemon-client to libvirt-daemon-common - Rename the libvirt-lock-sanlock package to libvirt-daemon-plugin-sanlock - Update rpm-deployment kbase article - Misc review comments addressed Jim Fehlig (9): spec: Move virtlockd to a new subpackage libvirt-daemon-lock spec: Move virtlogd to a new subpackage libvirt-daemon-log spec: Move virtproxyd to a new subpackage libvirt-daemon-proxy spec: Move lockd plugin to a new subpackage spec: Rename the libvirt-lock-sanlock subpackage spec: Move common files to a new subpackage libvirt-daemon-common spec: Remove libvirt-daemon dependency from drivers spec: Remove libvirt-daemon dependency from hypervisor subpackages kbase: Update rpm-deployment.rst with new subpackages docs/kbase/rpm-deployment.rst | 38 ++++- libvirt.spec.in | 294 +++++++++++++++++++++++----------- 2 files changed, 235 insertions(+), 97 deletions(-) -- 2.38.1

3 35

Setting SELinux label on TPM state during migration
by Michal Prívozník 19 Dec '22

19 Dec '22

Stefan, as you saw, I'm trying to implement support for migration with TPM state on a shared volume. I mean, it is working when the shared volume is an NFS mount point because NFS does not really propagate SELinux labels, but rather has this 'virt_use_nfs' sebool which effectivelly allows all svirt_t processes to access NFS (thus including swtpm). But things get trickier when a distributed FS that knows SELinux properly (e.g. ceph) is used instead. What I am currently struggling with is - finding the sweet spot when the source swtpm has let go of the state and the destination has not accessed it (because if it did it would get EPERM). Bottom line - the SELinux label is generated dynamically on each guest startup (to ensure its uniqueness on the system). Therefore, the label on the destination is different to the one on the source. The behavior I'm seeing now is: 1) the source starts migration: {"execute":"migrate","arguments":{"detach":true,"resume":false,"uri":"fd:migrate"},"id":"libvirt-428"} 2) the destination does not touch the swtpm state right away, but when the TPM state comes in the migration stream, it is touched. Partial logs from the destination: -> {"execute":"migrate-incoming","arguments":{"uri":"tcp:[::]:49152"},"id":"libvirt-415"} <- {"timestamp": {"seconds": 1671449778, "microseconds": 500164}, "event": "MIGRATION", "data": {"status": "setup"}}] <- {"return": {}, "id": "libvirt-415"} <- {"timestamp": {"seconds": 1671449778, "microseconds": 732358}, "event": "MIGRATION", "data": {"status": "active"}} Now, before QEMU sends MIGRATION status:completed, I can see QEMU accessing the TPM state: Thread 1 "qemu-kvm" hit Breakpoint 1, tpm_emulator_set_state_blob (tpm_emu=0x5572af389cb0, type=1, tsb=0x5572af389db0, flags=0) at ../backends/tpm/tpm_emulator.c:796 796 { (gdb) bt #0 tpm_emulator_set_state_blob (tpm_emu=0x5572af389cb0, type=1, tsb=0x5572af389db0, flags=0) at ../backends/tpm/tpm_emulator.c:796 #1 0x00005572acf21fe5 in tpm_emulator_post_load (opaque=0x5572af389cb0, version_id=<optimized out>) at ../backends/tpm/tpm_emulator.c:868 #2 0x00005572acf25497 in vmstate_load_state (f=0x5572af512a10, vmsd=0x5572ad7743b8 <vmstate_tpm_emulator>, opaque=0x5572af389cb0, version_id=1) at ../migration/vmstate.c:162 #3 0x00005572acf45753 in qemu_loadvm_state_main (f=0x5572af512a10, mis=0x5572af39b4e0) at ../migration/savevm.c:876 #4 0x00005572acf47591 in qemu_loadvm_state (f=0x5572af512a10) at ../migration/savevm.c:2712 #5 0x00005572acf301f6 in process_incoming_migration_co (opaque=<optimized out>) at ../migration/migration.c:591 #6 0x00005572ad400976 in coroutine_trampoline (i0=<optimized out>, i1=<optimized out>) at ../util/coroutine-ucontext.c:177 #7 0x00007f64ca22a360 in ?? () from target:/lib64/libc.so.6 #8 0x00007f64c948cbc0 in ?? () #9 0x0000000000000000 in ?? () This in turn means that swtpm on the destination is going to CMD_INIT itself while the source is still using it. I wonder what we can do about this. Perhaps - postpone init until the time the vCPUs on the destination are resumed? That way libvirt on the source could restore labels (effectively cut the source swtpm process off the TPM state), then libvirtd on the destination could set the label and 'cont'. If 'cont' fails for whatever reason then the source libvirtd would just set the label on the TPM state and everything is back to normal. Corresponding BZ link: https://bugzilla.redhat.com/show_bug.cgi?id=2130192 Michal

3 2

Libvirt support for qemu reconnect flag
by Miguel Ping 19 Dec '22

19 Dec '22

Hello, Qemu has support for reconnect-delay parameter, that allows for the qemu nbd client to retry failed NBD operations. This is useful if you are running a custom NBD server and want to update the server without failing requests. Unfortunately, the only way to supply these flags is at domain creation via qemu commandline passthrough feature [1]; there is no way to supply them when eg hotpluggin a disk via eg: "virsh attach-device ..." Is there interest in libvirt for a patch that supports qemu "reconnect delay" param? What would be the best way to move forward with such a patch? I think the param can be supported in either the device definition (eg: the <reconnect enabled='yes' timeout='10'/> option already exists for disk type="vhostuser"), or globally via the qemu.conf configuration file. Thank you for your time [1] https://libvirt.org/kbase/qemu-passthrough-security.html#xml-document-addit…

1 0

[PATCH v2 0/3] More work on deprecation/removal of clear text passwords
by Daniel P. Berrangé 16 Dec '22

16 Dec '22

This deprecates the -iscsi clear text 'password' option and deletes the previously deprecated -spice 'password' option. Changed in v2: * Fixed section placement for iscsi deprecation docs * Fixed missing brackets in -iscsi help * Write in past tense for -spice password removal docs Daniel P. Berrangé (3): block: mention 'password-secret' option for -iscsi block: deprecate iSCSI 'password' in favour of 'password-secret' ui: remove deprecated 'password' option for SPICE block/iscsi.c | 3 +++ docs/about/deprecated.rst | 16 ++++++++-------- docs/about/removed-features.rst | 7 +++++++ qemu-options.hx | 13 +++---------- ui/spice-core.c | 15 --------------- 5 files changed, 21 insertions(+), 33 deletions(-) -- 2.38.1

2 6

[PATCH 0/3] More work on deprecation/removal of clear text passwords
by Daniel P. Berrangé 16 Dec '22

16 Dec '22

This deprecates the -iscsi clear text 'password' option and deletes the previously deprecated -spice 'password' option. Daniel P. Berrangé (3): block: mention 'password-secret' option for -iscsi block: deprecate iSCSI 'password' in favour of 'password-secret' ui: remove deprecated 'password' option for SPICE block/iscsi.c | 3 +++ docs/about/deprecated.rst | 19 +++++++++++-------- docs/about/removed-features.rst | 7 +++++++ qemu-options.hx | 11 ++--------- ui/spice-core.c | 15 --------------- 5 files changed, 23 insertions(+), 32 deletions(-) -- 2.38.1

3 7

[libvirt PATCHv2 0/2] add external backend for tpm
by Ján Tomko 16 Dec '22

16 Dec '22

v2: add more chardev-like attributes to the source https://bugzilla.redhat.com/show_bug.cgi?id=2063723 Ján Tomko (2): qemu: add external backend for tpm qemu: add tests for external swtpm src/conf/domain_audit.c | 11 +++++ src/conf/domain_conf.c | 35 ++++++++++++++++ src/conf/domain_conf.h | 4 ++ src/conf/domain_validate.c | 15 +++++++ src/conf/schemas/domaincommon.rng | 22 ++++++++++ src/qemu/qemu_capabilities.c | 4 +- src/qemu/qemu_cgroup.c | 1 + src/qemu/qemu_command.c | 11 ++++- src/qemu/qemu_domain.c | 4 ++ src/qemu/qemu_namespace.c | 1 + src/qemu/qemu_tpm.c | 2 + src/security/security_dac.c | 2 + src/security/security_selinux.c | 2 + .../domaincapsdata/qemu_4.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_4.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.0.0-tcg.x86_64.xml | 1 + .../qemu_5.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_5.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.2.0-tcg.x86_64.xml | 1 + .../qemu_5.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_5.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.0.0-tcg.x86_64.xml | 1 + .../qemu_6.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_6.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_6.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_6.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 1 + .../qemu_6.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 1 + .../qemu_7.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 1 + .../tpm-external.x86_64-latest.args | 36 +++++++++++++++++ tests/qemuxml2argvdata/tpm-external.xml | 40 +++++++++++++++++++ tests/qemuxml2argvtest.c | 1 + .../tpm-external.x86_64-latest.xml | 1 + tests/qemuxml2xmltest.c | 1 + 63 files changed, 236 insertions(+), 2 deletions(-) create mode 100644 tests/qemuxml2argvdata/tpm-external.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/tpm-external.xml create mode 120000 tests/qemuxml2xmloutdata/tpm-external.x86_64-latest.xml -- 2.38.1

2 4

[libvirt PATCH] qemu: tpm: fix spacing
by Ján Tomko 15 Dec '22

15 Dec '22

Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- Pushed as trivial src/qemu/qemu_tpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index 0939f64e4e..36d5beb202 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -213,7 +213,7 @@ qemuTPMEmulatorCreateStorage(virDomainTPMDef *tpm, static void qemuTPMEmulatorDeleteStorage(virDomainTPMDef *tpm) { - g_autofree char *path = g_path_get_dirname(tpm->data.emulator.storagepath); + g_autofree char *path = g_path_get_dirname(tpm->data.emulator.storagepath); ignore_value(virFileDeleteTree(path)); } -- 2.38.1

1 0

[libvirt PATCH 0/2] kbase: Reorder contents for rpm-deployment
by Andrea Bolognani 15 Dec '22

15 Dec '22

Andrea Bolognani (2): kbase: Reorder sections kbase: Reorder deployments docs/kbase/rpm-deployment.rst | 134 +++++++++++++++++----------------- 1 file changed, 67 insertions(+), 67 deletions(-) -- 2.38.1

2 4

[libvirt PATCH 0/2] spec: List more directories
by Andrea Bolognani 14 Dec '22

14 Dec '22

%blurb Andrea Bolognani (2): spec: Add trailing backslash spec: List more directories libvirt.spec.in | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.38.1

2 7

[libvirt PATCH 00/30] introduce external snapshot delete support
by Pavel Hrdina 14 Dec '22

14 Dec '22

This implements virDomainSnapshotDelete API to support external snapshots. The support doesn't include flags VIR_DOMAIN_SNAPSHOT_DELETE_CHILDREN and VIR_DOMAIN_SNAPSHOT_DELETE_CHILDREN_ONLY as it would add more complexity and IMHO these flags should not existed at all. Gitlab repo with the patches: https://gitlab.com/phrdina/libvirt/-/commits/snapshot-delete-external Pavel Hrdina (30): libvirt: introduce VIR_DOMAIN_JOB_OPERATION_SNAPSHOT_DELETE qemu_block: extract block commit code to separate function qemu_block: move qemuDomainBlockPivot out of qemu_driver qemu_block: add async domain job support to qemuBlockCommit qemu_block: add async domain job support to qemuBlockPivot qemu_monitor: introduce qemuMonitorJobFinalize qemu_monitor_json: allow configuring autofinalize for block commit qemu_block: allow configuring autofinalize for block commit qemu_block: introduce qemuBlockFinalize qemu_block: change qemuBlockCommit to return job pointer qemu_blockjob: process QEMU_MONITOR_JOB_STATUS_PENDING signal qemu_snapshot: refactor qemuSnapshotDelete qemu_snapshot: introduce qemuSnapshotDeleteSingle qemu_snapshot: introduce qemuSnapshotDeleteChildren qemu_snapshot: rework snapshot children deletion qemu_snapshot: move snapshot discard out of qemu_domain.c qemu_snapshot: move snapshot metadata reparent code qemu_snapshot: introduce qemuSnapshotDiscardMetadata qemu_snapshot: introduce qemuSnapshotDeleteValidate function qemu_snapshot: refactor validation of snapshot delete qemu_snapshot: error out when deleting internal snapshot on non-active disk qemu_snapshot: convert snapshot delete to async domain job qemu_snapshot: prepare data for external snapshot deletion qemu_snapshot: implement deletion of external snapshot qemu_snapshot: update metadata when deleting snapshots qemu_snapshot: when deleting snapshot invalidate parent snapshot qemu_process: abort snapshot delete when daemon starts qemu_snapshot: enable deletion of external snapshots api: document support for external snapshot deletion NEWS: document support for external snapshot deletion NEWS.rst | 6 + include/libvirt/libvirt-domain.h | 1 + src/conf/snapshot_conf.c | 6 + src/conf/snapshot_conf.h | 1 + src/libvirt-domain-snapshot.c | 7 + src/qemu/qemu_backup.c | 1 + src/qemu/qemu_block.c | 336 +++++++++++ src/qemu/qemu_block.h | 22 + src/qemu/qemu_blockjob.c | 20 +- src/qemu/qemu_blockjob.h | 1 + src/qemu/qemu_domain.c | 95 +-- src/qemu/qemu_domain.h | 9 - src/qemu/qemu_driver.c | 292 +--------- src/qemu/qemu_monitor.c | 21 +- src/qemu/qemu_monitor.h | 8 +- src/qemu/qemu_monitor_json.c | 26 +- src/qemu/qemu_monitor_json.h | 8 +- src/qemu/qemu_process.c | 32 ++ src/qemu/qemu_snapshot.c | 956 ++++++++++++++++++++++++++++--- src/qemu/qemu_snapshot.h | 4 + tests/qemumonitorjsontest.c | 4 +- tools/virsh-domain.c | 1 + 22 files changed, 1381 insertions(+), 476 deletions(-) -- 2.38.1

2 61

[PATCH] virnuma: Allow multiple nodes for preferred policy
by Michal Privoznik 14 Dec '22

14 Dec '22

In the past, the preferred policy (VIR_DOMAIN_NUMATUNE_MEM_PREFERRED) required exactly one (host) NUMA node. This made sense because: 1) the libnuma API - numa_set_preferred() allowed exactly one node, because 2) corresponding kernel syscall (__NR_set_mempolicy) accepted exactly one node (for MPOL_PREFERRED mode). But things have changed since then. Firstly, kernel introduced new MPOL_PREFERRED_MANY mode (v5.15-rc1~107^2~21) which was then exposed in libnuma as numa_set_preferred_many() (v2.0.15~24). Fortunately, libnuma also exposes numa_has_preferred_many() which returns whether the kernel has support for the new mode (1) or not (0). Putting this all together, we can lift our check for sufficiently new kernel and libnuma. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2151064 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- meson.build | 3 +++ src/util/virnuma.c | 25 +++++++++++++++++++++++-- 2 files changed, 26 insertions(+), 2 deletions(-) diff --git a/meson.build b/meson.build index f9834a36c2..c26778a68d 100644 --- a/meson.build +++ b/meson.build @@ -1103,6 +1103,9 @@ endif numactl_dep = cc.find_library('numa', required: get_option('numactl')) if numactl_dep.found() conf.set('WITH_NUMACTL', 1) + if cc.has_function('numa_set_preferred_many', dependencies: numactl_dep) + conf.set('WITH_NUMACTL_SET_PREFERRED_MANY', 1) + endif endif openwsman_version = '2.6.3' diff --git a/src/util/virnuma.c b/src/util/virnuma.c index 2306ab0cb1..43e299f4bb 100644 --- a/src/util/virnuma.c +++ b/src/util/virnuma.c @@ -93,7 +93,6 @@ virNumaSetupMemoryPolicy(virDomainNumatuneMemMode mode, virBitmap *nodeset) { nodemask_t mask; - int node = -1; int bit = 0; size_t i; int maxnode = 0; @@ -128,7 +127,19 @@ virNumaSetupMemoryPolicy(virDomainNumatuneMemMode mode, case VIR_DOMAIN_NUMATUNE_MEM_PREFERRED: { +# ifdef WITH_NUMACTL_SET_PREFERRED_MANY + struct bitmask *bitmask = NULL; +# endif + int G_GNUC_UNUSED node = -1; int nnodes = 0; + bool has_preferred_many = false; + +# ifdef WITH_NUMACTL_SET_PREFERRED_MANY + if (numa_has_preferred_many() > 0) { + has_preferred_many = true; + } +# endif + for (i = 0; i < NUMA_NUM_NODES; i++) { if (nodemask_isset(&mask, i)) { node = i; @@ -136,15 +147,25 @@ virNumaSetupMemoryPolicy(virDomainNumatuneMemMode mode, } } - if (nnodes != 1) { + if (!has_preferred_many && nnodes != 1) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("NUMA memory tuning in 'preferred' mode " "only supports single node")); return -1; } + /* The following automatically sets MPOL_PREFERRED_MANY + * whenever possible, so no need to special case it. */ numa_set_bind_policy(0); + +# ifdef WITH_NUMACTL_SET_PREFERRED_MANY + bitmask = numa_bitmask_alloc(maxnode + 1); + copy_nodemask_to_bitmask(&mask, bitmask); + numa_set_preferred_many(bitmask); + numa_bitmask_free(bitmask); +# else numa_set_preferred(node); +# endif } break; -- 2.37.4

2 1

[libvirt PATCH] docs: replace footer link to the bird site with mastodon
by Daniel P. Berrangé 14 Dec '22

14 Dec '22

Since the takeover of the bird site, the bulk of tech people who want a more friendly and inclusive media site have jumped over to Mastodon. With its decentralized nature, there's no one replacement that captures everything, but the fosstodon.org site is a topic relevant choice. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- docs/page.xsl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/page.xsl b/docs/page.xsl index 1414d90b89..548d5a11c4 100644 --- a/docs/page.xsl +++ b/docs/page.xsl @@ -179,7 +179,7 @@ <div id="community"> <h3>Community</h3> <ul> - <li><a href="https://twitter.com/hashtag/libvirt">twitter</a></li> + <li><a href="https://fosstodon.org/tags/libvirt">fosstodon</a></li> <li><a href="https://stackoverflow.com/questions/tagged/libvirt">stackoverflow</a></li> <li><a href="https://serverfault.com/questions/tagged/libvirt">serverfault</a></li> </ul> -- 2.38.1

2 1

[PATCH] tests: qemucapabilitiesdata: Final update of qemu-7.2 capabilities on x86
by Peter Krempa 14 Dec '22

14 Dec '22

QEMU 7.2 was released, update the capabilities data to the final state. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- tests/qemucapabilitiesdata/caps_7.2.0.x86_64.replies | 6 +++--- tests/qemucapabilitiesdata/caps_7.2.0.x86_64.xml | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.replies b/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.replies index 47203b8923..18f70a5a3f 100644 --- a/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.replies +++ b/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.replies @@ -17,11 +17,11 @@ { "return": { "qemu": { - "micro": 91, - "minor": 1, + "micro": 0, + "minor": 2, "major": 7 }, - "package": "v7.2.0-rc1" + "package": "v7.2.0" }, "id": "libvirt-2" } diff --git a/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.xml index 6bc739065f..821fcd3199 100644 --- a/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.xml @@ -201,10 +201,10 @@ <flag name='query-stats-schemas'/> <flag name='thread-context'/> <flag name='screenshot-format-png'/> - <version>7001091</version> + <version>7002000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100245</microcodeVersion> - <package>v7.2.0-rc1</package> + <package>v7.2.0</package> <arch>x86_64</arch> <hostCPU type='kvm' model='base' migratability='yes'> <property name='vmx-entry-load-rtit-ctl' type='boolean' value='false'/> -- 2.38.1

2 1

[PATCH 0/7] spec: Decompose the daemon subpackage
by Jim Fehlig 14 Dec '22

14 Dec '22

This is a V1 of my previous RFC to decompose the libvirt-daemon package https://listman.redhat.com/archives/libvir-list/2022-November/235924.html The end goal is to remove the libvirt-dameon dependency on the various libvirt-daemon-driver-foo subpackages, allowing installation of a modular daemon configuration without the traditional monolithic libvirtd. Change from V1: - Patches1-3 handled separate from this series since they are unrelated - virtlockd, virtlogd, and virtproxyd are moved to their own subpackages - lockd plugin moved to its own subpackage - virt-admin, virt-host-validate, and others moved to new subpackage TODO: The libvirt-daemon package still contains the following files, which likely need to move somewhere since they are needed by the modular daemons too. %{_unitdir}/virt-guest-shutdown.target I thought of moving this to the libs package, but that would be a change for installations with only libvirt-client. AFAICT, it's used by libvirt-guests and the qemu and lxc drivers. %config(noreplace) %{_sysconfdir}/sasl2/libvirt.conf Another file related to remote access. Should it go to libvirt-libs? %ghost %dir %{_rundir}/libvirt/ %ghost %dir %{_rundir}/libvirt/common/ %dir %attr(0755, root, root) %{_localstatedir}/lib/libvirt/ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/images/ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/filesystems/ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/boot/ %dir %attr(0711, root, root) %{_localstatedir}/cache/libvirt/ %dir %attr(0755, root, root) %{_libdir}/libvirt/ %dir %attr(0755, root, root) %{_libdir}/libvirt/connection-driver/ These files and directories are needed by the modular daemons as well, right? Where should they go? libvirt-daemon-<hypervisor> or libvirt-daemon-driver-<hypervisor>? %{_datadir}/polkit-1/actions/org.libvirt.unix.policy %{_datadir}/polkit-1/actions/org.libvirt.api.policy %{_datadir}/polkit-1/rules.d/50-libvirt.rules More files related to access. libvirt-libs? Jim Fehlig (7): spec: Move virtlockd to a new subpackage libvirt-daemon-lock spec: Move virtlogd to a new subpackage libvirt-daemon-log spec: Move virtproxyd to a new subpackage libvirt-daemon-proxy spec: Move lockd plugin to a new subpackage libvirt-daemon-plugin-lockd spec: Move common files to a new subpackage libvirt-daemon-client spec: Remove libvirt-daemon dependecy from drivers spec: Remove libvirt-daemon dependency from hypervisor subpackages libvirt.spec.in | 274 ++++++++++++++++++++++++++++++++---------------- 1 file changed, 183 insertions(+), 91 deletions(-) -- 2.38.1

3 30

[PATCH] qemu_process: add tray changed event to queue in refresh disks
by Kristina Hanicova 13 Dec '22

13 Dec '22

There are some cases when the internal state of disks can change without qemu sending events about it (e.g. a disk can close during reset). In case this happens, we should emit an event about the modified disk. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1824722#c20 Signed-off-by: Kristina Hanicova <khanicov(a)redhat.com> --- src/qemu/qemu_process.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 5de55435d2..601e9694b6 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -8675,6 +8675,7 @@ qemuProcessRefreshDisks(virDomainObj *vm, qemuDomainObjPrivate *priv = vm->privateData; g_autoptr(GHashTable) table = NULL; size_t i; + virQEMUDriver *driver = QEMU_DOMAIN_PRIVATE(vm)->driver; if (qemuDomainObjEnterMonitorAsync(vm, asyncJob) == 0) { table = qemuMonitorGetBlockInfo(priv->mon); @@ -8697,14 +8698,26 @@ qemuProcessRefreshDisks(virDomainObj *vm, continue; if (info->removable) { + virObjectEvent *event = NULL; + int reason; + if (info->empty) virDomainDiskEmptySource(disk); if (info->tray) { - if (info->tray_open) + if (info->tray_open == disk->tray_status) + continue; + + if (info->tray_open) { + reason = VIR_DOMAIN_EVENT_TRAY_CHANGE_OPEN; disk->tray_status = VIR_DOMAIN_DISK_TRAY_OPEN; - else + } else { + reason = VIR_DOMAIN_EVENT_TRAY_CHANGE_CLOSE; disk->tray_status = VIR_DOMAIN_DISK_TRAY_CLOSED; + } + + event = virDomainEventTrayChangeNewFromObj(vm, disk->info.alias, reason); + virObjectEventStateQueue(driver->domainEventState, event); } } -- 2.38.1

2 1

[libvirt PATCH 0/2] qemu_migration: Fix p2p post-copy recovery
by Jiri Denemark 13 Dec '22

13 Dec '22

Jiri Denemark (2): qemu_migration: Move qemuMigrationSrcPerformResume up qemu_migration: Fix p2p post-copy recovery src/qemu/qemu_migration.c | 129 ++++++++++++++++++++------------------ 1 file changed, 68 insertions(+), 61 deletions(-) -- 2.39.0

2 4

[libvirt PATCH v3 00/18] Use nbdkit for http/ftp/ssh network drives in libvirt
by Jonathon Jongsma 13 Dec '22

13 Dec '22

This is the third version of this patch series. See https://bugzilla.redhat.com/show_bug.cgi?id=2016527 for more information about the goal, but the summary is that RHEL does not want to ship the qemu storage plugins for curl and ssh. Handling them outside of the qemu process provides several advantages such as reduced attack surface and stability. A quick summary of the code: - at startup I query to see whether nbdkit exists on the host and if so, I query which plugins/filters are installed. These capabilities are cached and stored in the qemu driver - When the driver prepares the domain, we go through each disk source and determine whether the nbdkit capabilities allow us to support this disk via nbdkit, and if so, we allocate a qemuNbdkitProcess object and stash it in the private data of the virStorageSource. - The presence or absence of this qemuNbdkitProcess data then indicates whether this disk will be served to qemu indirectly via nbdkit or directly - When we launch the qemuProcess, as part of the "external device start" step, I launch a ndkit process for each disk that is supported by nbdkit. - for devices which are served by an intermediate ndkit process, I change the qemu commandline in the following ways: - I no longer pass auth/cookie secrets to qemu (those are handled by nbdkit) - I replace the actual network URL of the remote disk source with the path to the nbdkit unix socket - We create a 'monitor' for the nbdkit process that watches to see whether the process exits. If it does, we pause the domain, attempt to restart nbdkit, and then resume the domain. Open questions - I think selinux will work once we add a policy for the /usr/sbin/nbdkit binary to allow it to be executed by libvirt, but for now it fails to execute nbdkit in enforcing mode. The current context for nbdkit (on fedora) is "system_u:object_r:bin_t:s0". When I temporarily change the context to something like qemu_exec_t, I am able to start nbdkit and the domain launches. Known shortcomings - creating disks (in ssh) still isn't supported. Changes in v3: - Various formatting fixes - Don't kill process in qemuNbdkitProcessFree() since we want the nbdkit daemon to continue running even if libvirt restarts. - Better detection and error reporting when starting the nbdkit process - Add monitoring for nbdkit process so that it can be restarted if if ever exits unexpectedly. Changes in v2: - split into multiple patches - added a build option for nbdkit_moddir - don't instantiate any secret / cookie props for disks that are being served by nbdkit since we don't send secrets to qemu anymore - ensure that nbdkit processes are started/stopped for the entire backing chain - switch to virFileCache-based capabilities for nbdkit so that we don't need to requery every time - switch to using pipes for communicating sensitive data to nbdkit - use pidfile support built into virCommand rather than nbdkit's --pidfile argument - added significantly more tests Jonathon Jongsma (18): schema: allow 'ssh' as a protocol for network disks qemu: Add functions for determining nbdkit availability qemu: expand nbdkit capabilities util: Allow virFileCache data to be any GObject qemu: implement basic virFileCache for nbdkit caps qemu: implement persistent file cache for nbdkit caps qemu: use file cache for nbdkit caps qemu: Add qemuNbdkitProcess qemu: add functions to start and stop nbdkit tests: add ability to test various nbdkit capabilities qemu: split qemuDomainSecretStorageSourcePrepare qemu: include nbdkit state in private xml qemu: use nbdkit to serve network disks if available tests: add tests for nbdkit invocation util: make virCommandSetSendBuffer testable qemu: pass sensitive data to nbdkit via pipe qemu: add test for authenticating a https network disk qemu: Monitor nbdkit process for exit build-aux/syntax-check.mk | 4 +- meson.build | 9 + meson_options.txt | 1 + po/POTFILES | 1 + src/conf/schemas/domaincommon.rng | 1 + src/libvirt_private.syms | 1 + src/qemu/meson.build | 1 + src/qemu/qemu_block.c | 162 ++- src/qemu/qemu_conf.c | 23 + src/qemu/qemu_conf.h | 7 + src/qemu/qemu_domain.c | 180 ++- src/qemu/qemu_domain.h | 4 + src/qemu/qemu_driver.c | 4 + src/qemu/qemu_extdevice.c | 48 + src/qemu/qemu_nbdkit.c | 1243 +++++++++++++++++ src/qemu/qemu_nbdkit.h | 120 ++ src/qemu/qemu_nbdkitpriv.h | 31 + src/qemu/qemu_process.c | 13 + src/util/vircommand.c | 19 +- src/util/vircommand.h | 8 + src/util/vircommandpriv.h | 4 + src/util/virfilecache.c | 14 +- src/util/virfilecache.h | 2 +- src/util/virutil.h | 2 +- tests/meson.build | 1 + .../disk-cdrom-network.args.disk0 | 7 + .../disk-cdrom-network.args.disk1 | 9 + .../disk-cdrom-network.args.disk1.pipe.1778 | 1 + .../disk-cdrom-network.args.disk2 | 9 + .../disk-cdrom-network.args.disk2.pipe.1780 | 1 + .../disk-network-http.args.disk0 | 7 + .../disk-network-http.args.disk1 | 6 + .../disk-network-http.args.disk2 | 7 + .../disk-network-http.args.disk2.pipe.1778 | 1 + .../disk-network-http.args.disk3 | 8 + .../disk-network-http.args.disk3.pipe.1780 | 1 + ...work-source-curl-nbdkit-backing.args.disk0 | 8 + ...e-curl-nbdkit-backing.args.disk0.pipe.1778 | 1 + .../disk-network-source-curl.args.1.pipe.1 | 1 + .../disk-network-source-curl.args.disk0 | 8 + ...k-network-source-curl.args.disk0.pipe.1778 | 1 + .../disk-network-source-curl.args.disk1 | 10 + ...k-network-source-curl.args.disk1.pipe.1780 | 1 + ...k-network-source-curl.args.disk1.pipe.1782 | 1 + ...isk-network-source-curl.args.disk1.pipe.49 | 1 + .../disk-network-source-curl.args.disk2 | 8 + ...k-network-source-curl.args.disk2.pipe.1782 | 1 + ...k-network-source-curl.args.disk2.pipe.1784 | 1 + ...isk-network-source-curl.args.disk2.pipe.51 | 1 + .../disk-network-source-curl.args.disk3 | 7 + .../disk-network-source-curl.args.disk4 | 7 + .../disk-network-ssh.args.disk0 | 7 + tests/qemunbdkittest.c | 294 ++++ ...sk-cdrom-network-nbdkit.x86_64-latest.args | 42 + .../disk-cdrom-network-nbdkit.xml | 1 + ...isk-network-http-nbdkit.x86_64-latest.args | 45 + .../disk-network-http-nbdkit.xml | 1 + ...rce-curl-nbdkit-backing.x86_64-latest.args | 38 + ...isk-network-source-curl-nbdkit-backing.xml | 45 + ...work-source-curl-nbdkit.x86_64-latest.args | 50 + .../disk-network-source-curl-nbdkit.xml | 1 + ...isk-network-source-curl.x86_64-latest.args | 54 + .../disk-network-source-curl.xml | 74 + ...disk-network-ssh-nbdkit.x86_64-latest.args | 36 + .../disk-network-ssh-nbdkit.xml | 1 + .../disk-network-ssh.x86_64-latest.args | 36 + tests/qemuxml2argvdata/disk-network-ssh.xml | 31 + tests/qemuxml2argvtest.c | 18 + tests/testutilsqemu.c | 27 + tests/testutilsqemu.h | 5 + 70 files changed, 2707 insertions(+), 116 deletions(-) create mode 100644 src/qemu/qemu_nbdkit.c create mode 100644 src/qemu/qemu_nbdkit.h create mode 100644 src/qemu/qemu_nbdkitpriv.h create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk1 create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk1.pipe.1778 create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk2 create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk2.pipe.1780 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk1 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk2 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk2.pipe.1778 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk3 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk3.pipe.1780 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl-nbdkit-backing.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl-nbdkit-backing.args.disk0.pipe.1778 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.1.pipe.1 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk0.pipe.1778 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk1 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk1.pipe.1780 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk1.pipe.1782 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk1.pipe.49 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk2 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk2.pipe.1782 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk2.pipe.1784 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk2.pipe.51 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk3 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk4 create mode 100644 tests/qemunbdkitdata/disk-network-ssh.args.disk0 create mode 100644 tests/qemunbdkittest.c create mode 100644 tests/qemuxml2argvdata/disk-cdrom-network-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-cdrom-network-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-http-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-network-http-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl-nbdkit-backing.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl-nbdkit-backing.xml create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-network-source-curl-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl.xml create mode 100644 tests/qemuxml2argvdata/disk-network-ssh-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-network-ssh-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-ssh.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-network-ssh.xml -- 2.37.3

5 46

[libvirt PATCH] qemu: Don't warn when releasing a released job
by Jiri Denemark 13 Dec '22

13 Dec '22

When qemuDomainObjReleaseAsyncJob is called when the current async job is already released we emit quite useless warning which was implemented to warn about releasing a job owned by another thread. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/qemu/qemu_domainjob.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_domainjob.c b/src/qemu/qemu_domainjob.c index 4d320f075e..8d958b9d21 100644 --- a/src/qemu/qemu_domainjob.c +++ b/src/qemu/qemu_domainjob.c @@ -647,7 +647,8 @@ qemuDomainObjReleaseAsyncJob(virDomainObj *obj) VIR_DEBUG("Releasing ownership of '%s' async job", virDomainAsyncJobTypeToString(obj->job->asyncJob)); - if (obj->job->asyncOwner != virThreadSelfID()) { + if (obj->job->asyncOwner != 0 && + obj->job->asyncOwner != virThreadSelfID()) { VIR_WARN("'%s' async job is owned by thread %llu", virDomainAsyncJobTypeToString(obj->job->asyncJob), obj->job->asyncOwner); -- 2.39.0

2 1

[libvirt PATCH] cpu: Improve debug message in virCPUGetVendorForModel
by Jiri Denemark 13 Dec '22

13 Dec '22

Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/cpu/cpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/cpu/cpu.c b/src/cpu/cpu.c index 7f3caf7a27..c5de9fc95c 100644 --- a/src/cpu/cpu.c +++ b/src/cpu/cpu.c @@ -936,7 +936,7 @@ virCPUGetVendorForModel(virArch arch, { struct cpuArchDriver *driver; - VIR_DEBUG("arch=%s", virArchToString(arch)); + VIR_DEBUG("arch=%s model=%s", virArchToString(arch), model); if (!(driver = cpuGetSubDriver(arch))) return NULL; -- 2.39.0

2 1

[libvirt PATCH] qemu: Fix warning in qemuMigrationDstPostcopyFailed
by Jiri Denemark 13 Dec '22

13 Dec '22

The function is called even if QEMU reports migration as postcopy-paused, i.e., it's not migrating anymore. And while changing the warning, we can drop the part about unattended migration to make the warning shorter and consistent with qemuMigrationSrcPostcopyFailed. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/qemu/qemu_migration.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 81bb08c029..2e87db883e 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -1704,9 +1704,8 @@ qemuMigrationDstPostcopyFailed(virDomainObj *vm) reason == VIR_DOMAIN_RUNNING_POSTCOPY_FAILED) return; - VIR_WARN("Migration protocol failed during incoming migration of domain " - "%s, but QEMU keeps migrating; leaving the domain running, the " - "migration will be handled as unattended", vm->def->name); + VIR_WARN("Incoming migration of domain %s failed during post-copy; " + "leaving the domain running", vm->def->name); virDomainObjSetState(vm, VIR_DOMAIN_RUNNING, VIR_DOMAIN_RUNNING_POSTCOPY_FAILED); -- 2.39.0

2 1

[PATCH] meson: Provide default values for nonexistent xenlight pkgconfig vars
by Michal Privoznik 12 Dec '22

12 Dec '22

It may happen that xenlight pkgconfig file does not contain 'xenfirmwaredir' and/or 'libexec_bin' variables, which is okay and we have code that deals with this situation. But that code is executed when the queried value is an empty string. This may not always be the case and we should specifically set 'default_value' so that the empty string is returned if pkgconfig variable doesn't exist. Fixes: 968479adcfa5c49b29b7b6680dcaffde1408f044 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- meson.build | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/meson.build b/meson.build index f9834a36c2..3d870d77db 100644 --- a/meson.build +++ b/meson.build @@ -1478,8 +1478,8 @@ if not get_option('driver_libxl').disabled() and conf.has('WITH_LIBVIRTD') libxl_dep = dependency('xenlight', version: '>=' + libxl_version, required: get_option('driver_libxl')) if libxl_dep.found() - libxl_firmware_dir = libxl_dep.get_variable(pkgconfig : 'xenfirmwaredir') - libxl_execbin = libxl_dep.get_variable(pkgconfig : 'libexec_bin') + libxl_firmware_dir = libxl_dep.get_variable(pkgconfig : 'xenfirmwaredir', default_value: '') + libxl_execbin = libxl_dep.get_variable(pkgconfig : 'libexec_bin', default_value: '') if libxl_firmware_dir != '' conf.set_quoted('LIBXL_FIRMWARE_DIR', libxl_firmware_dir) endif -- 2.37.4

2 1

[PATCH 00/11] Remove secure clearing of memory where it doesn't make sense
by Peter Krempa 12 Dec '22

12 Dec '22

In certain cases we tried to clear stuff which isn't secure and in other cases we clear the pointer but then pass the secret on the commandline. Remove the security theatre. Additionally all other instances which pass secret via RPC can be theoreticlaly removed as the secret is copied to/from and non-sanitized RPC buffer. We'd have to clear all RPC buffers though for this to be "properly" handled and not just security theater. Peter Krempa (11): virCryptoEncryptDataAESgnutls: Don't secure erase gnutls_datum_t structs virCryptoEncryptDataAESgnutls: Properly initialize data structures virCryptoEncryptDataAESgnutls: Restructure control flow virStorageBackendISCSISetAuth: Don't bother securely erasing password virStorageBackendISCSISetAuth: Use g_strndup to '\0' terminate data virStorageBackendISCSISetAuth: Refactor cleanup libxlMakeNetworkDiskSrc: Don't bother with secure erase of secrets libxlMakeNetworkDiskSrc: Refactor cleanup virStorageBackendRBDOpenRADOSConn: Don't log the RBD key datatypes: Register autoptr cleanup for virSecret virSecretGetSecretString: Refactor cleanup src/datatypes.h | 1 + src/libxl/libxl_conf.c | 24 +++++----------- src/storage/storage_backend_iscsi.c | 22 +++++---------- src/storage/storage_backend_rbd.c | 24 ++++++++++++---- src/util/vircrypto.c | 43 ++++++++++------------------- src/util/virsecret.c | 19 ++++--------- 6 files changed, 53 insertions(+), 80 deletions(-) -- 2.38.1

3 20

[libvirt PATCH] rpm: switch to using %mingw_find_lang
by Daniel P. Berrangé 12 Dec '22

12 Dec '22

We currently list the locale file paths via a wildcard in %files, but the normal pattern for mingw RPMs in Fedora is to use %mingw_find_lang. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 562baea52e..31ff8ea01e 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1355,6 +1355,8 @@ rm -rf $RPM_BUILD_ROOT%{mingw64_libexecdir}/libvirt-guests.sh %mingw_debug_install_post +%mingw_find_lang %{name} + %endif %check @@ -2181,7 +2183,7 @@ exit 0 %{_datadir}/libvirt/api/libvirt-lxc-api.xml %if %{with_mingw} -%files -n mingw32-libvirt +%files -n mingw32-libvirt -f mingw32-libvirt.lang %dir %{mingw32_sysconfdir}/libvirt/ %config(noreplace) %{mingw32_sysconfdir}/libvirt/libvirt.conf %config(noreplace) %{mingw32_sysconfdir}/libvirt/libvirt-admin.conf @@ -2212,7 +2214,6 @@ exit 0 %{mingw32_datadir}/libvirt/api/libvirt-admin-api.xml %{mingw32_datadir}/libvirt/cpu_map/*.xml %{mingw32_datadir}/libvirt/test-screenshot.png -%{mingw32_datadir}/locale/*/LC_MESSAGES/libvirt.mo %dir %{mingw32_includedir}/libvirt %{mingw32_includedir}/libvirt/libvirt.h %{mingw32_includedir}/libvirt/libvirt-common.h @@ -2239,7 +2240,7 @@ exit 0 %{mingw32_mandir}/man1/virt-pki-validate.1* %{mingw32_mandir}/man7/virkey*.7* -%files -n mingw64-libvirt +%files -n mingw64-libvirt -f mingw64-libvirt.lang %dir %{mingw64_sysconfdir}/libvirt/ %config(noreplace) %{mingw64_sysconfdir}/libvirt/libvirt.conf %config(noreplace) %{mingw64_sysconfdir}/libvirt/libvirt-admin.conf @@ -2270,7 +2271,6 @@ exit 0 %{mingw64_datadir}/libvirt/api/libvirt-admin-api.xml %{mingw64_datadir}/libvirt/cpu_map/*.xml %{mingw64_datadir}/libvirt/test-screenshot.png -%{mingw64_datadir}/locale/*/LC_MESSAGES/libvirt.mo %dir %{mingw64_includedir}/libvirt %{mingw64_includedir}/libvirt/libvirt.h %{mingw64_includedir}/libvirt/libvirt-common.h -- 2.38.1

2 1

[libvirt PATCH 0/3] Actually do secure erase with explicit_bzero
by Daniel P. Berrangé 12 Dec '22

12 Dec '22

If we're going to have a virSecureErase function, we might as well make it do secure erasure with currently available explicit_bzero in FreeBSD/Linux. While we're here, we should use it from the RPC code. The remaining hole in the RPC code is xdr_free which does not securely erase buffers. That's not easily fixed without dropping the RPC impl in favour of a custom one. Daniel P. Berrangé (3): util: implement secure erase with explicit_bzero rpc: fix buffer offset updates after decoding payload rpc: securely erase the message buffers meson.build | 1 + src/rpc/virnetmessage.c | 4 +++- src/util/virsecureerase.c | 6 ++++++ 3 files changed, 10 insertions(+), 1 deletion(-) -- 2.38.1

2 4

[PATCH] formatcaps: Update capabilities example
by Michal Privoznik 12 Dec '22

12 Dec '22

In the formatcaps.rst we give an example output of capabilities. Well, there are couple of issues with it: 1) We show <features/> nested under /capabilities/host/cpu. There's no such element and never was. 2) The ordering of elements is corrupted. 3) There is plenty of elements missing. Fix these by showing an actual output of 'virsh capabilities' as obtained on my machine. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- docs/formatcaps.rst | 230 +++++++++++++++++++++++++++++++++----------- 1 file changed, 176 insertions(+), 54 deletions(-) diff --git a/docs/formatcaps.rst b/docs/formatcaps.rst index 39b1fb78ac..f7e5342654 100644 --- a/docs/formatcaps.rst +++ b/docs/formatcaps.rst @@ -143,60 +143,182 @@ capabilities enabled in the chip and BIOS you will see: :: - <capabilities> - <host> - <cpu> - <arch>x86_64</arch> - <features> - <vmx/> - </features> - <model>core2duo</model> - <vendor>Intel</vendor> - <topology sockets="1" dies="1" cores="2" threads="1"/> - <feature name="lahf_lm"/> - <feature name='xtpr'/> - <pages unit='KiB' size='4'/> - <pages unit='KiB' size='2048'/> - <pages unit='KiB' size='1048576'/> - <microcode version='36'/> - <maxphysaddr mode='emulate' bits='46'/> - ... - </cpu> - <power_management> - <suspend_mem/> - <suspend_disk/> - <suspend_hybrid/> - </power_management> - </host> + <capabilities> -  - <guest> - <os_type>xen</os_type> - <arch name="x86_64"> - <wordsize>64</wordsize> - <domain type="xen"></domain> - <emulator>/usr/lib64/xen/bin/qemu-dm</emulator> - </arch> - <features> - </features> - </guest> + <host> + <uuid>7b55704c-29f4-11b2-a85c-9dc6ff50623f</uuid> + <cpu> + <arch>x86_64</arch> + <model>Skylake-Client-noTSX-IBRS</model> + <vendor>Intel</vendor> + <microcode version='236'/> + <signature family='6' model='142' stepping='12'/> + <counter name='tsc' frequency='2303997000' scaling='no'/> + <topology sockets='1' dies='1' cores='4' threads='2'/> + <maxphysaddr mode='emulate' bits='39'/> + <feature name='ds'/> + <feature name='acpi'/> + <feature name='ss'/> + <feature name='ht'/> + <feature name='tm'/> + <feature name='pbe'/> + <feature name='dtes64'/> + <feature name='monitor'/> + <feature name='ds_cpl'/> + <feature name='vmx'/> + <feature name='smx'/> + <feature name='est'/> + <feature name='tm2'/> + <feature name='xtpr'/> + <feature name='pdcm'/> + <feature name='osxsave'/> + <feature name='tsc_adjust'/> + <feature name='sgx'/> + <feature name='clflushopt'/> + <feature name='intel-pt'/> + <feature name='md-clear'/> + <feature name='stibp'/> + <feature name='arch-capabilities'/> + <feature name='ssbd'/> + <feature name='xsaves'/> + <feature name='sgx1'/> + <feature name='sgx-debug'/> + <feature name='sgx-mode64'/> + <feature name='sgx-provisionkey'/> + <feature name='sgx-tokenkey'/> + <feature name='pdpe1gb'/> + <feature name='invtsc'/> + <feature name='rdctl-no'/> + <feature name='ibrs-all'/> + <feature name='skip-l1dfl-vmentry'/> + <feature name='mds-no'/> + <feature name='tsx-ctrl'/> + <pages unit='KiB' size='4'/> + <pages unit='KiB' size='2048'/> + <pages unit='KiB' size='1048576'/> + </cpu> + <power_management> + <suspend_mem/> + </power_management> + <iommu support='yes'/> + <migration_features> + <live/> + <uri_transports> + <uri_transport>tcp</uri_transport> + <uri_transport>rdma</uri_transport> + </uri_transports> + </migration_features> + <topology> + <cells num='1'> + <cell id='0'> + <memory unit='KiB'>32498112</memory> + <pages unit='KiB' size='4'>6813808</pages> + <pages unit='KiB' size='2048'>2048</pages> + <pages unit='KiB' size='1048576'>1</pages> + <distances> + <sibling id='0' value='10'/> + </distances> + <cpus num='8'> + <cpu id='0' socket_id='0' die_id='0' core_id='0' siblings='0,4'/> + <cpu id='1' socket_id='0' die_id='0' core_id='1' siblings='1,5'/> + <cpu id='2' socket_id='0' die_id='0' core_id='2' siblings='2,6'/> + <cpu id='3' socket_id='0' die_id='0' core_id='3' siblings='3,7'/> + <cpu id='4' socket_id='0' die_id='0' core_id='0' siblings='0,4'/> + <cpu id='5' socket_id='0' die_id='0' core_id='1' siblings='1,5'/> + <cpu id='6' socket_id='0' die_id='0' core_id='2' siblings='2,6'/> + <cpu id='7' socket_id='0' die_id='0' core_id='3' siblings='3,7'/> + </cpus> + </cell> + </cells> + </topology> + <cache> + <bank id='0' level='3' type='both' size='8' unit='MiB' cpus='0-7'/> + </cache> + <secmodel> + <model>none</model> + <doi>0</doi> + </secmodel> + <secmodel> + <model>dac</model> + <doi>0</doi> + <baselabel type='kvm'>+77:+77</baselabel> + <baselabel type='qemu'>+77:+77</baselabel> + </secmodel> + </host> -  - <guest> - <os_type>hvm</os_type> - <arch name="i686"> - <wordsize>32</wordsize> - <domain type="xen"></domain> - <emulator>/usr/lib/xen/bin/qemu-dm</emulator> - <machine>pc</machine> - <machine>isapc</machine> - <loader>/usr/lib/xen/boot/hvmloader</loader> - </arch> - <features> - <cpuselection/> - <deviceboot/> - </features> - </guest> + <guest> + <os_type>hvm</os_type> + <arch name='x86_64'> + <wordsize>64</wordsize> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <machine maxCpus='255'>pc-i440fx-7.1</machine> + <machine canonical='pc-i440fx-7.1' maxCpus='255'>pc</machine> + <machine maxCpus='288'>pc-q35-5.2</machine> + <machine maxCpus='255'>pc-i440fx-2.12</machine> + <machine maxCpus='255'>pc-i440fx-2.0</machine> + <machine maxCpus='255'>pc-i440fx-6.2</machine> + <machine maxCpus='288'>pc-q35-4.2</machine> + <machine maxCpus='255'>pc-i440fx-2.5</machine> + <machine maxCpus='255'>pc-i440fx-4.2</machine> + <machine maxCpus='255'>pc-i440fx-5.2</machine> + <machine maxCpus='255' deprecated='yes'>pc-i440fx-1.5</machine> + <machine maxCpus='255'>pc-q35-2.7</machine> + <machine maxCpus='288'>pc-q35-7.1</machine> + <machine canonical='pc-q35-7.1' maxCpus='288'>q35</machine> + <machine maxCpus='255'>pc-i440fx-2.2</machine> + <machine maxCpus='255'>pc-i440fx-2.7</machine> + <machine maxCpus='288'>pc-q35-6.1</machine> + <machine maxCpus='255'>pc-q35-2.4</machine> + <machine maxCpus='288'>pc-q35-2.10</machine> + <machine maxCpus='1'>x-remote</machine> + <machine maxCpus='288'>pc-q35-5.1</machine> + <machine maxCpus='255' deprecated='yes'>pc-i440fx-1.7</machine> + <machine maxCpus='288'>pc-q35-2.9</machine> + <machine maxCpus='255'>pc-i440fx-2.11</machine> + <machine maxCpus='288'>pc-q35-3.1</machine> + <machine maxCpus='255'>pc-i440fx-6.1</machine> + <machine maxCpus='288'>pc-q35-4.1</machine> + <machine maxCpus='255'>pc-i440fx-2.4</machine> + <machine maxCpus='255'>pc-i440fx-4.1</machine> + <machine maxCpus='255'>pc-i440fx-5.1</machine> + <machine maxCpus='255'>pc-i440fx-2.9</machine> + <machine maxCpus='1'>isapc</machine> + <machine maxCpus='255' deprecated='yes'>pc-i440fx-1.4</machine> + <machine maxCpus='255'>pc-q35-2.6</machine> + <machine maxCpus='255'>pc-i440fx-3.1</machine> + <machine maxCpus='288'>pc-q35-2.12</machine> + <machine maxCpus='288'>pc-q35-7.0</machine> + <machine maxCpus='255'>pc-i440fx-2.1</machine> + <machine maxCpus='288'>pc-q35-6.0</machine> + <machine maxCpus='255'>pc-i440fx-2.6</machine> + <machine maxCpus='288'>pc-q35-4.0.1</machine> + <machine maxCpus='255'>pc-i440fx-7.0</machine> + <machine maxCpus='255' deprecated='yes'>pc-i440fx-1.6</machine> + <machine maxCpus='288'>pc-q35-5.0</machine> + <machine maxCpus='288'>pc-q35-2.8</machine> + <machine maxCpus='255'>pc-i440fx-2.10</machine> + <machine maxCpus='288'>pc-q35-3.0</machine> + <machine maxCpus='255'>pc-i440fx-6.0</machine> + <machine maxCpus='288'>pc-q35-4.0</machine> + <machine maxCpus='288'>microvm</machine> + <machine maxCpus='255'>pc-i440fx-2.3</machine> + <machine maxCpus='255'>pc-i440fx-4.0</machine> + <machine maxCpus='255'>pc-i440fx-5.0</machine> + <machine maxCpus='255'>pc-i440fx-2.8</machine> + <machine maxCpus='288'>pc-q35-6.2</machine> + <machine maxCpus='255'>pc-q35-2.5</machine> + <machine maxCpus='255'>pc-i440fx-3.0</machine> + <machine maxCpus='288'>pc-q35-2.11</machine> + <domain type='qemu'/> + <domain type='kvm'/> + </arch> + <features> + <acpi default='on' toggle='yes'/> + <apic default='on' toggle='no'/> + <cpuselection/> + <deviceboot/> + <disksnapshot default='on' toggle='no'/> + </features> + </guest> - ... - </capabilities> + </capabilities> -- 2.37.4

2 1