- Devel - libvirt List Archives

[PATCH] docs: Add missing elements to formatcaps.rst
by Nobuhiro MIKI 12 Dec '22

12 Dec '22

Signed-off-by: Nobuhiro MIKI <nmiki(a)yahoo-corp.jp> --- docs/formatcaps.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/formatcaps.rst b/docs/formatcaps.rst index 9d7932a6a8..39b1fb78ac 100644 --- a/docs/formatcaps.rst +++ b/docs/formatcaps.rst @@ -155,6 +155,11 @@ capabilities enabled in the chip and BIOS you will see: <topology sockets="1" dies="1" cores="2" threads="1"/> <feature name="lahf_lm"/> <feature name='xtpr'/> + <pages unit='KiB' size='4'/> + <pages unit='KiB' size='2048'/> + <pages unit='KiB' size='1048576'/> + <microcode version='36'/> + <maxphysaddr mode='emulate' bits='46'/> ... </cpu> <power_management> -- 2.38.1

2 1

[PATCH RFC 0/6] spec: Decompose the daemon subpackage
by Jim Fehlig 11 Dec '22

11 Dec '22

Currently it is not possible to install a modular daemon subpackage without also installing the monolithic daemon https://listman.redhat.com/archives/libvir-list/2022-September/234554.html This series is an initial attempt at moving common daemons, utilities, and files from the daemon subpackage to a new daemon-core subpackage. The monolithic and modular daemons can then depend on the new subpackage. libvirt-guests is moved to a new libvirt-guests subpackage, which is recommended by the daemon subpackage to provide smoother upgrade. I've likely overlooked several items, but before continuing down this path too far I first wanted to gauge interest and see if this work is worth pursuing. If so, any comments on the RFC are appreciated! Note that patches 1-3 are things I noticed while working on the others and could be pushed independently. Jim Fehlig (6): spec: Remove redundant with_libxl spec: Use more %{name} macro spec: Remove daemon postun trigger spec: Move common daemons to a separate subpackage spec: Move more files to the daemon-core subpackage spec: Move libvirt-guests to guests subpackage libvirt.spec.in | 406 ++++++++++++++++++++++++++---------------------- 1 file changed, 219 insertions(+), 187 deletions(-) -- 2.37.3

3 14

[PATCH v2 0/2] virnetdevtap.c: Disallow pre-existing TAP devices
by Michal Privoznik 08 Dec '22

08 Dec '22

v2 of: https://listman.redhat.com/archives/libvir-list/2022-December/236197.html diff to v1: - Check for existing device iff virNetDevGenerateName() returned early (per Laine's suggestion). Michal Prívozník (2): virnetdev: Make virNetDevGenerateName() return 1 if no name was generated virnetdevtap.c: Disallow pre-existing TAP devices src/qemu/qemu_interface.c | 2 ++ src/util/virnetdev.c | 6 ++++-- src/util/virnetdevtap.c | 23 +++++++++++++++++++++-- src/util/virnetdevtap.h | 2 ++ 4 files changed, 29 insertions(+), 4 deletions(-) -- 2.37.4

2 3

[libvirt PATCH] tools: Fix style issues in virt-qemu-sev-validate
by Andrea Bolognani 08 Dec '22

08 Dec '22

The script had an incorrect interpreter line until commit f6a19d7264bb, so the flake8 check would not realize it needed to pick it up and these issues, some of which were present it the very first version that was committed, were not being reported. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- tools/virt-qemu-sev-validate | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/virt-qemu-sev-validate b/tools/virt-qemu-sev-validate index 46a92aa7a0..3d8b292fef 100755 --- a/tools/virt-qemu-sev-validate +++ b/tools/virt-qemu-sev-validate @@ -849,7 +849,7 @@ class ConfidentialVM(abc.ABC): secret64 = b64encode(secret_table_ciphertext).decode('utf8') log.debug("Header: %s (%d bytes)", header64, len(header)) log.debug("Secret: %s (%d bytes)", - secret64, len(secret_table_ciphertext)) + secret64, len(secret_table_ciphertext)) return header64, secret64 @@ -955,7 +955,7 @@ class LibvirtConfidentialVM(ConfidentialVM): self.dom = self.conn.lookupByName(id_name_uuid) log.debug("VM: id=%d name=%s uuid=%s", - self.dom.ID(), self.dom.name(), self.dom.UUIDString()) + self.dom.ID(), self.dom.name(), self.dom.UUIDString()) if not self.dom.isActive(): raise InvalidStateException( @@ -1331,5 +1331,6 @@ def main(): print("ERROR: %s" % e, file=sys.stderr) sys.exit(6) + if __name__ == "__main__": main() -- 2.38.1

3 3

[PATCH] virnetdevtap.c: Disallow pre-existing TAP devices
by Michal Privoznik 08 Dec '22

08 Dec '22

When starting a guest with <interface/> which has the target device name set (i.e. not generated by us), it may happen that the TAP device already exists. This then may lead to all sorts of problems. For instance: for <interface type='network'/> the TAP device is plugged into the network's bridge, but since the TAP device is persistent it remains plugged there even after the guest is shut off. We don't have a code that unplugs TAP devices from the bridge because TAP devices we create are transient, i.e. are removed automatically when QEMU closes their FD. The only exception is <interface type='ethernet'/> with <target managed='no'/> where we specifically want to let users use pre-created TAP device and basically not touch it at all. There's another reason for denying to use a pre-created TAP devices: if we ever have bug in TAP name generation, we may re-use a TAP device from another domain. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2144738 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_interface.c | 2 ++ src/util/virnetdevtap.c | 31 ++++++++++++++++++++++++++++++- src/util/virnetdevtap.h | 2 ++ 3 files changed, 34 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_interface.c b/src/qemu/qemu_interface.c index 4cc76e07a5..264d5e060c 100644 --- a/src/qemu/qemu_interface.c +++ b/src/qemu/qemu_interface.c @@ -461,6 +461,8 @@ qemuInterfaceEthernetConnect(virDomainDef *def, if (!net->ifname) template_ifname = true; + tap_create_flags |= VIR_NETDEV_TAP_CREATE_ALLOW_EXISTING; + if (virNetDevTapCreate(&net->ifname, tunpath, tapfd, tapfdSize, tap_create_flags) < 0) { goto cleanup; diff --git a/src/util/virnetdevtap.c b/src/util/virnetdevtap.c index 112a1e8b99..406339c583 100644 --- a/src/util/virnetdevtap.c +++ b/src/util/virnetdevtap.c @@ -148,12 +148,15 @@ virNetDevTapGetRealDeviceName(char *ifname G_GNUC_UNUSED) * @tunpath: path to the tun device (if NULL, /dev/net/tun is used) * @tapfds: array of file descriptors return value for the new tap device * @tapfdSize: number of file descriptors in @tapfd - * @flags: OR of virNetDevTapCreateFlags. Only one flag is recognized: + * @flags: OR of virNetDevTapCreateFlags. Only the following flags are + * recognized: * * VIR_NETDEV_TAP_CREATE_VNET_HDR * - Enable IFF_VNET_HDR on the tap device * VIR_NETDEV_TAP_CREATE_PERSIST * - The device will persist after the file descriptor is closed + * VIR_NETDEV_TAP_CREATE_ALLOW_EXISTING + * - The device creation fails if @ifname already exists * * Creates a tap interface. The caller must use virNetDevTapDelete to * remove a persistent TAP device when it is no longer needed. In case @@ -182,6 +185,19 @@ int virNetDevTapCreate(char **ifname, if (virNetDevGenerateName(ifname, VIR_NET_DEV_GEN_NAME_VNET) < 0) return -1; + if (!(flags & VIR_NETDEV_TAP_CREATE_ALLOW_EXISTING)) { + int rc = virNetDevExists(*ifname); + + if (rc < 0) { + return -1; + } else if (rc > 0) { + virReportError(VIR_ERR_OPERATION_INVALID, + _("The %s interface already exists"), + *ifname); + return -1; + } + } + if (!tunpath) tunpath = "/dev/net/tun"; @@ -319,6 +335,19 @@ int virNetDevTapCreate(char **ifname, if (virNetDevGenerateName(ifname, VIR_NET_DEV_GEN_NAME_VNET) < 0) return -1; + if (!(flags & VIR_NETDEV_TAP_CREATE_ALLOW_EXISTING)) { + int rc = virNetDevExists(*ifname); + + if (rc < 0) { + return -1; + } else if (rc > 0) { + virReportError(VIR_ERR_OPERATION_INVALID, + _("The %s interface already exists"), + *ifname); + return -1; + } + } + /* As FreeBSD determines interface type by name, * we have to create 'tap' interface first and * then rename it to 'vnet' diff --git a/src/util/virnetdevtap.h b/src/util/virnetdevtap.h index 197ea10f94..c9d29c0384 100644 --- a/src/util/virnetdevtap.h +++ b/src/util/virnetdevtap.h @@ -56,6 +56,8 @@ typedef enum { VIR_NETDEV_TAP_CREATE_USE_MAC_FOR_BRIDGE = 1 << 2, /* The device will persist after the file descriptor is closed */ VIR_NETDEV_TAP_CREATE_PERSIST = 1 << 3, + /* The device is allowed to exist before creation */ + VIR_NETDEV_TAP_CREATE_ALLOW_EXISTING = 1 << 4, } virNetDevTapCreateFlags; int -- 2.37.4

2 1

[libvirt PATCH 00/21] meson: remove many obsolete checks
by Daniel P. Berrangé 08 Dec '22

08 Dec '22

We have alot of checks for Linux kernel features that are obsolete since our supported platform matrix lets us assume new enough kernel versions. Removing the checks will speed up the meson phase and reduce the tangle of #ifdefs in the code. I thought I could remove the check for linux/kvm.h but for some reason our code in virhostpcu.c / cpu_x86.c is enabling the codebases even on FreeBSD, which I find kind of odd. Does FreeBSD really ship a linux/kvm.h ? Daniel P. Berrangé (21): meson: remove obsolete check for LOOP_CTL_GET_FREE meson: remove obsolete check for EPOLL_CLOEXEC meson: remove obsolete check for LO_FLAGS_AUTOCLEAR meson: drop check for unshare() netdev: simplify check for ethtool functionality meson: remove obsolete check for ETHTOOL_GGSO meson: remove obsolete check for ETHTOOL_GGRO meson: remove obsolete check for ETHTOOL_GFLAGS meson: remove obsolete check for ETH_FLAG_LRO meson: remove obsolete check for ETH_FLAG_TXVLAN/RXVLAN meson: remove obsolete check for ETH_FLAG_NTUPLE meson: remove obsolete check for ETH_FLAG_RXHASH meson: remove obsolete check for ETHTOOL_GFEATURES meson: remove obsolete check for ETHTOOL_GCOALESCE meson: remove obsolete check for GET_VLAN_VID_CMD meson: simplify check for virnetdevbridge.c headers meson: remove obsolete check for DEVLINK_CMD_ESWITCH_GET meson: remove obsolete check for linux/magic.h meson: remove obsolete check for VHOST_VSOCK_SET_GUEST_CID meson: remove obsolete check for BPF_PROG_QUERY meson: remove obsolete check for BPF_CGROUP_DEVICE meson.build | 82 +++-------------------------------- src/util/virbpf.c | 6 +-- src/util/virbpf.h | 6 +-- src/util/vircgroupv2devices.c | 10 ++--- src/util/virfile.c | 15 ++----- src/util/virnetdev.c | 65 ++++----------------------- src/util/virvsock.c | 4 +- tests/securityselinuxhelper.c | 4 +- tests/virfilemock.c | 2 +- 9 files changed, 32 insertions(+), 162 deletions(-) -- 2.38.1

3 25

[libvirt PATCH 0/2] virt-qemu-sev-validate: A couple of small fixes
by Andrea Bolognani 08 Dec '22

08 Dec '22

Andrea Bolognani (2): docs: Fix typo in virt-qemu-sev-validate(1) tools: Fix interpreter for virt-qemu-sev-validate docs/manpages/virt-qemu-sev-validate.rst | 2 +- tools/virt-qemu-sev-validate | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) -- 2.38.1

2 3

RFC: New APIs for delegation of privileged operations
by Andrea Bolognani 08 Dec '22

08 Dec '22

Hi, this is a proposal for introducing a new family of APIs in libvirt, with the goal of improving integration with management applications. KubeVirt is intended to be the primary consumer of these APIs. Background ---------- KubeVirt makes it possible to run VMs on a Kubernetes cluster, side by side with containers. It does so by running QEMU and libvirtd themselves inside a container. The architecture is explained in more detail at https://kubevirt.io/user-guide/architecture/ but for the purpose of this discussion we only need to keep in mind two components: * virt-launcher - runs in the same container as QEMU and libvirtd - one instance per VM * virt-handler - runs in a separate container - one instance per node Conceptually, these two components roughly map to QEMU processes and libvirtd respectively. >From a security perspective, there is a strong push in Kubernetes to run workloads under unprivileged user accounts and without additional capabilities. Again, this is similar to how libvirtd itself runs as root but the QEMU processes it starts are under the unprivileged "qemu" account. KubeVirt has been working towards the goal of running VMs as completely unprivileged workloads and made excellent progress so far. Some of the operations needed for running a VM, however, inherently require elevated privilege. In KubeVirt, the conundrum is solved by having virt-handler (a privileged component) take care of those operations, making it possible for virt-launcher (as well as QEMU and libvirtd) to run in an unprivileged context. Examples -------- Here are a few examples of how KubeVirt has been able to reduce the privilege required by virt-launcher by selectively handing over responsibilities to virt-handler: * Remove SYS_RESOURCE capability from launcher pod https://github.com/kubevirt/kubevirt/pull/2584 * Drop SYS_RESOURCE capability https://github.com/kubevirt/kubevirt/pull/5558 * Housekeeping cgroup https://github.com/kubevirt/kubevirt/pull/8233 * Real time VMs fail to change vCPU scheduler and priority in non-root deployments https://github.com/kubevirt/kubevirt/pull/8750 * virt-launcher: Drop SYS_PTRACE capability https://github.com/kubevirt/kubevirt/pull/8842 The pattern we can see is that, initially, libvirt just assumes that it can perform a certain privileged operation. This fails in the context of KubeVirt, where libvirtd runs with significantly reduced privileges. As a consequence, libvirt is patched to be more resilient to such lack of privilege: for example, instead of attempting to create a file and erroring out due to lack of permissions, it will instead first check whether the file already exists and, if it does, assume that it has been prepared ahead of time by an external entity. Limitations ----------- This approach works fine, but only for the privileged operations that would be performed by libvirt before the VM starts running. Looking at the "housekeeping cgroup" PR in particular, we notice that the VM is initially created in paused state: this is necessary in order to create a point in time in which all the VM threads already exist but, crucially, none of the vCPUs have stated running yet. This is the only opportunity to move threads across cgroups without invalidating the expectations of a real time workload. When it comes to live migration, however, there is no way to create similar conditions, since the VM is running on the destination host right out of the gate. As a consequence, live migration has to be blocked when the housekeeping cgroup is in use, which is an unfortunate limitation. Moreover, there's an overall sense of fragility surrounding these interactions: both KubeVirt and, to some extent, libvirt need to be acutely aware of what the other component is going to do, but there is never an explicit handover and the whole thing only works if you just so happen to do everything with the exact right order and timing. Proposal -------- In order to address the issues outlined above, I propose that we introduce a new set of APIs in libvirt. These APIs would expose some of the inner workings of libvirt, and as such would come with *massively reduced* stability guarantees compared to the rest of our public API. The idea is that applications such as KubeVirt, which track libvirt fairly closely and stay pinned to specific versions, would be able to adapt to changes in these APIs relatively painlessly. More traditional management applications such as virt-manager would simply not opt into using the new APIs and maintain the status quo. Using memlock as an example, the new API could look like typedef int (*virInternalSetMaxMemLockHandler)(pid_t pid, unsigned long long bytes); int virInternalSetProcessSetMaxMemLockHandler(virConnectPtr conn, virInternalSetMaxMemLockHandler handler); The application-provided handler would be responsible for performing the privileged operation (in this case raising the memlock limit for a process). For KubeVirt, virt-launcher would have to pass the baton to virt-handler. If such an handler is installed, libvirt would invoke it (and likely go through some sanity checks afterwards); if not, it would attempt to perform the privileged operation itself, as it does today. This would make the interaction between libvirt and the management application explicit rather than implicit. Not having to stick to our usual API stability guarantees would make it possible to be more liberal in exposing the internals of libvirt as interaction points. Scope ----- I think we should initially limit the new APIs to the scenarios that have already been identified, then gradually expand the scope as needed. In other words, we shouldn't comb through the codebase looking for potential adopters. Since the intended consumers of these APIs are those that can adopt a new libvirt release fairly quickly, this shouldn't be a problem. Once the pattern has been established, we might consider introducing support for it at the same time as a new feature that might benefit from it is added. Caveats ------- libvirt is all about stable API, so introducing an API that is unstable *by design* is completely uncharted territory. To ensure that the new APIs are 100% opt-in, we could define them in a separate <libvirt/libvirt-internal.h> header. Furthermore, we could have a separate libvirt-internal.so shared library for the symbols and a corresponding libvirt-internal.pc pkg-config file. We could even go as far as requiring a preprocessor symbol such as VIR_INTERNAL_UNSTABLE_API_OPT_IN to be defined before the entry points are visible to the compiler. Whatever the mechanism, we would need to make sure that it's usable from language bindings as well. Internal APIs are amendable to not only come and go, but also change semantics between versions. We should make sure that such changes are clearly exposed to the user, for example by requiring them to pass a version number to the function and erroring out immediately if the value doesn't match our expectations. KubeVirt has a massive suite of functional tests, so this kind of change would immediately be spotted when a new version of libvirt is imported, with no risk of an incompatibility lingering in the codebase until it affects users. Disclaimer ---------- This proposal is intentionally vague on several of the details. Before attempting to nail those down, I want to gather feedback on the high-level idea, both from the libvirt and KubeVirt side. Credits ------- Thanks to Michal and Martin for helping shape and polish the idea from its initial rough state. -- Andrea Bolognani / Red Hat / Virtualization

7 15

[PATCH] tools: Fix install_mode for some scripts
by Michal Privoznik 08 Dec '22

08 Dec '22

Scripts from the following list were installed with group write bit set: virt-xml-validate, virt-pki-validate, virt-sanlock-cleanup, libvirt-guests.sh. This is very unusual and in contrast with the way other scripts/binaries are installed. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2151202 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tools/meson.build | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/meson.build b/tools/meson.build index c41c619af4..fad7f202ad 100644 --- a/tools/meson.build +++ b/tools/meson.build @@ -249,7 +249,7 @@ configure_file( configuration: tools_conf, install: true, install_dir: bindir, - install_mode: 'rwxrwxr-x', + install_mode: 'rwxr-xr-x', ) configure_file( @@ -258,7 +258,7 @@ configure_file( configuration: tools_conf, install: true, install_dir: bindir, - install_mode: 'rwxrwxr-x', + install_mode: 'rwxr-xr-x', ) executable( @@ -295,7 +295,7 @@ if conf.has('WITH_SANLOCK') configuration: tools_conf, install: true, install_dir: sbindir, - install_mode: 'rwxrwxr-x', + install_mode: 'rwxr-xr-x', ) endif @@ -311,7 +311,7 @@ if conf.has('WITH_LIBVIRTD') configuration: tools_conf, install: true, install_dir: libexecdir, - install_mode: 'rwxrwxr-x', + install_mode: 'rwxr-xr-x', ) if init_script == 'systemd' -- 2.37.4

3 2

Release of libvirt-php-0.5.7
by Michal Prívozník 07 Dec '22

07 Dec '22

The 0.5.7 release of libvirt-php is tagged and tarball is available at: https://libvirt.org/sources/php/ Notable changes: * Dropped support for PHP-6.0 and older * Fixed libvirt_connect_get_machine_types() with PHP-7.0 and newer * Dropped imagick dependency * Bug fixes Thanks to everybody who helped with this release. Michal

1 0

[PATCH v4] virsh: Add message to terminal when running snapshot-revert
by Haruka Ohata 07 Dec '22

07 Dec '22

When running virsh snapshot-* command, such as snapshot-create-as / snapshot-delete, it prints a result message. On the other hand virsh snapshot-revert command doesn't print a result message. So, This patch fixes to add message when running virsh snapshot-revert command. --- # virsh snapshot-create-as vm1 test1 Domain snapshot test01 created # virsh snapshot-revert vm1 test1 # virsh snapshot-delete vm1 test1 Domain snapshot test01 deleted # --- Signed-off-by: Haruka Ohata <ohata.haruka(a)fujitsu.com> --- tests/virsh-snapshot | 3 +++ tools/virsh-snapshot.c | 4 ++++ 2 files changed, 7 insertions(+) diff --git a/tests/virsh-snapshot b/tests/virsh-snapshot index 4c64bb537b..b09273917b 100755 --- a/tests/virsh-snapshot +++ b/tests/virsh-snapshot @@ -100,11 +100,14 @@ Domain snapshot s1 created Domain snapshot s3 created Domain snapshot s2 created +Domain snapshot s3 reverted Domain snapshot s6 created Domain snapshot s5 created +Domain snapshot s6 reverted Domain snapshot s4 created +Domain snapshot s1 reverted Domain snapshot s7 created Domain snapshot s8 created diff --git a/tools/virsh-snapshot.c b/tools/virsh-snapshot.c index 8fa64ba903..68908cd10a 100644 --- a/tools/virsh-snapshot.c +++ b/tools/virsh-snapshot.c @@ -1783,6 +1783,10 @@ cmdDomainSnapshotRevert(vshControl *ctl, const vshCmd *cmd) result = virDomainRevertToSnapshot(snapshot, flags); } + if (result < 0) + vshError(ctl, _("Failed to revert snapshot %s"), name); + else + vshPrintExtra(ctl, _("Domain snapshot %s reverted\n"), name); return result >= 0; } -- 2.38.1

2 1

[PATCH 0/5] qemu: Prefer PNG for domain screenshots
by Michal Privoznik 07 Dec '22

07 Dec '22

Whilst preparing for libvirt-php release, I want to ditch its imagick dependency which is needed to convert PPM to PNG. But I've learned that QEMU is able to return PNG already which looks more versatile than PPM anyways. Michal Prívozník (5): qemu_caps: Introduce QEMU_CAPS_SCREENSHOT_FORMAT_PNG qemu_monitor: Debug print all arguments in qemuMonitorScreendump() qemu_monitor: Extend qemuMonitorScreendump() for @format qemu: Prefer PNG for domain screenshots NEWS: Document change of screenshot format for QEMU NEWS.rst | 4 ++++ src/qemu/qemu_capabilities.c | 2 ++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_driver.c | 13 +++++++++++-- src/qemu/qemu_monitor.c | 6 ++++-- src/qemu/qemu_monitor.h | 1 + src/qemu/qemu_monitor_json.c | 2 ++ src/qemu/qemu_monitor_json.h | 1 + tests/qemucapabilitiesdata/caps_7.1.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_7.1.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_7.2.0.x86_64.xml | 1 + tests/qemumonitorjsontest.c | 2 +- 12 files changed, 30 insertions(+), 5 deletions(-) -- 2.37.4

3 8

[libvirt PATCH v3] tools: add virt-qemu-qmp-proxy for proxying QMP via libvirt QEMU guests
by Daniel P. Berrangé 06 Dec '22

06 Dec '22

Libvirt provides QMP passthrough APIs for the QEMU driver and these are exposed in virsh. It is not especially pleasant, however, using the raw QMP JSON syntax. QEMU has a tool 'qmp-shell' which can speak QMP and exposes a human friendly interactive shell. It is not possible to use this with libvirt managed guest, however, since only one client can attach to the QMP socket at any point in time. While it would be possible to configure a second QMP socket for a VM, it may not be an known requirement at the time the guest is provisioned. The virt-qmp-proxy tool aims to solve this problem. It opens a UNIX socket and listens for incoming client connections, speaking QMP on the connected socket. It will forward any QMP commands received onto the running libvirt QEMU guest, and forward any replies back to the QMP client. It will also forward back events. $ virsh start demo $ virt-qmp-proxy demo demo.qmp & $ qmp-shell demo.qmp Welcome to the QMP low-level shell! Connected to QEMU 6.2.0 (QEMU) query-kvm { "return": { "enabled": true, "present": true } } Note this tool of course has the same risks as the raw libvirt QMP passthrough. It is safe to run query commands to fetch information but commands which change the QEMU state risk disrupting libvirt's management of QEMU, potentially resulting in data loss/corruption in the worst case. Any use of this tool will cause the guest to be marked as tainted as an warning that it could be in an unexpected state. Since this tool introduces a python dependency it is not desirable to include it in any of the existing RPMs in libvirt. This tool is also QEMU specific, so isn't appropriate to bundle with the generic tools. Thus a new RPM is introduced 'libvirt-clients-qemu', to contain additional QEMU specific tools, with extra external deps. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- In v3: - Added to libvirt-clients-qemu RPM - Renamed to virt-qemu-qmp-proxy docs/manpages/meson.build | 1 + docs/manpages/virt-qemu-qmp-proxy.rst | 120 +++++++++ libvirt.spec.in | 15 ++ tools/meson.build | 5 + tools/virt-qemu-qmp-proxy | 360 ++++++++++++++++++++++++++ 5 files changed, 501 insertions(+) create mode 100644 docs/manpages/virt-qemu-qmp-proxy.rst create mode 100755 tools/virt-qemu-qmp-proxy diff --git a/docs/manpages/meson.build b/docs/manpages/meson.build index ba673cf472..83933227d9 100644 --- a/docs/manpages/meson.build +++ b/docs/manpages/meson.build @@ -18,6 +18,7 @@ docs_man_files = [ { 'name': 'virt-pki-query-dn', 'section': '1', 'install': true }, { 'name': 'virt-pki-validate', 'section': '1', 'install': true }, { 'name': 'virt-qemu-run', 'section': '1', 'install': conf.has('WITH_QEMU') }, + { 'name': 'virt-qemu-qmp-proxy', 'section': '1', 'install': conf.has('WITH_QEMU') }, { 'name': 'virt-xml-validate', 'section': '1', 'install': true }, { 'name': 'libvirt-guests', 'section': '8', 'install': conf.has('WITH_LIBVIRTD') }, diff --git a/docs/manpages/virt-qemu-qmp-proxy.rst b/docs/manpages/virt-qemu-qmp-proxy.rst new file mode 100644 index 0000000000..b387474b19 --- /dev/null +++ b/docs/manpages/virt-qemu-qmp-proxy.rst @@ -0,0 +1,120 @@ +=================== +virt-qemu-qmp-proxy +=================== + +-------------------------------------------------- +Expose a QMP proxy server for a libvirt QEMU guest +-------------------------------------------------- + +:Manual section: 1 +:Manual group: Virtualization Support + +.. contents:: + + +SYNOPSIS +======== + +``virt-qemu-qmp-proxy`` [*OPTION*]... *DOMAIN* *QMP-SOCKET-PATH* + + +DESCRIPTION +=========== + +This tool provides a way to expose a QMP proxy server that communicates +with a QEMU guest managed by libvirt. This enables standard QMP client +tools to interact with libvirt managed guests. + +**NOTE: use of this tool will result in the running QEMU guest being +marked as tainted.** It is strongly recommended that this tool *only be +used to send commands which query information* about the running guest. +If this tool is used to make changes to the state of the guest, this +may have negative interactions with the QEMU driver, resulting in an +inability to manage the guest operation thereafter, and in the worst +case **potentially lead to data loss or corruption**. + +The ``virt-qemu-qmp-proxy`` program will listen on a UNIX socket for incoming +client connections, and run the QMP protocol over the connection. Any +commands received will be sent to the running libvirt guest, and replies +sent back. + +The ``virt-qemu-qmp-proxy`` program may be interrupted (eg Ctrl-C) when it +is no longer required. The libvirt QEMU guest will continue running. + + +OPTIONS +======= + +*DOMAIN* + +The ID or UUID or Name of the libvirt QEMU guest. + +*QMP-SOCKET-PATH* + +The filesystem path at which to run the QMP server, listening for +incoming connections. + +``-c`` *CONNECTION-URI* +``--connect``\ =\ *CONNECTION-URI* + +The URI for the connection to the libvirt QEMU driver. If omitted, +a URI will be auto-detected. + +``-v``, ``--verbose`` + +Run in verbose mode, printing all QMP commands and replies that +are handled. + +``-h``, ``--help`` + +Display the command line help. + + +EXIT STATUS +=========== + +Upon successful shutdown, an exit status of 0 will be set. Upon +failure a non-zero status will be set. + + +AUTHOR +====== + +Daniel P. Berrangé + + +BUGS +==== + +Please report all bugs you discover. This should be done via either: + +#. the mailing list + + `https://libvirt.org/contact.html <https://libvirt.org/contact.html>`_ + +#. the bug tracker + + `https://libvirt.org/bugs.html <https://libvirt.org/bugs.html>`_ + +Alternatively, you may report bugs to your software distributor / vendor. + +COPYRIGHT +========= + +Copyright (C) 2022 by Red Hat, Inc. + + +LICENSE +======= + +``virt-qemu-qmp-proxy`` is distributed under the terms of the GNU LGPL v2+. +This is free software; see the source for copying conditions. There +is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR +PURPOSE + + +SEE ALSO +======== + +virsh(1), `https://libvirt.org/ <https://libvirt.org/>`_, +`QMP reference <https://www.qemu.org/docs/master/interop/qemu-qmp-ref.html>`_ diff --git a/libvirt.spec.in b/libvirt.spec.in index 950c5a3b6d..3082285dc0 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -899,6 +899,15 @@ Obsoletes: libvirt-bash-completion < 7.3.0 The client binaries needed to access the virtualization capabilities of recent versions of Linux (and other OSes). +%package client-qemu +Summary: Additional client side utilities for QEMU +Requires: %{name}-libs = %{version}-%{release} +Requires: python3-libvirt >= %{version}-%{release} + +%description client-qemu +The additional client binaries are used to interact +with some QEMU specific features of libvirt. + %package libs Summary: Client side libraries # So remote clients can access libvirt over SSH tunnel @@ -2159,6 +2168,12 @@ exit 0 %{_datadir}/bash-completion/completions/virsh +%if %{with_qemu} +%files client-qemu +%{_mandir}/man1/virt-qemu-qmp-proxy.1* +%{_bindir}/virt-qemu-qmp-proxy +%endif + %files libs -f %{name}.lang %license COPYING COPYING.LESSER %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/ diff --git a/tools/meson.build b/tools/meson.build index bb28a904dc..20509906af 100644 --- a/tools/meson.build +++ b/tools/meson.build @@ -320,6 +320,11 @@ if conf.has('WITH_LIBVIRTD') endif endif +if conf.has('WITH_QEMU') + install_data('virt-qemu-qmp-proxy', + install_dir: bindir) +endif + if bash_completion_dep.found() subdir('bash-completion') endif diff --git a/tools/virt-qemu-qmp-proxy b/tools/virt-qemu-qmp-proxy new file mode 100755 index 0000000000..d85342bd2b --- /dev/null +++ b/tools/virt-qemu-qmp-proxy @@ -0,0 +1,360 @@ +#!/usr/bin/env python3 + +import argparse +import array +import libvirt +import libvirt_qemu +import os +import re +import socket +import sys +import traceback +import json +import fcntl + + +debug = False + +def get_domain(uri, domstr): + conn = libvirt.open(uri) + + dom = None + saveex = None + + def try_lookup(cb): + try: + return cb() + except libvirt.libvirtError as ex: + nonlocal saveex + if saveex is None: + saveex = ex + + if re.match(r'^\d+$', domstr): + dom = try_lookup(lambda: conn.lookupByID(int(domstr))) + + if dom is None and re.match(r'^[-a-f0-9]{36}|[a-f0-9]{32}$', domstr): + dom = try_lookup(lambda: conn.lookupByUUIDString(domstr)) + + if dom is None: + dom = try_lookup(lambda: conn.lookupByName(domstr)) + + if dom is None: + raise saveex + + if not dom.isActive(): + raise Exception("Domain must be running to use QMP") + + return conn, dom + + +class QMPProxy(object): + + def __init__(self, conn, dom, serversock, verbose): + self.conn = conn + self.dom = dom + self.verbose = verbose + + self.serversock = serversock + self.serverwatch = 0 + + self.clientsock = None + self.clientwatch = 0 + + self.api2sock = bytes([]) + self.api2sockfds = [] + + self.sock2api = bytes([]) + self.sock2apifds = [] + + self.serverwatch = libvirt.virEventAddHandle( + self.serversock.fileno(), libvirt.VIR_EVENT_HANDLE_READABLE, + self.handle_server_io, self) + + libvirt_qemu.qemuMonitorEventRegister(self.conn, self.dom, + None, + self.handle_qmp_event, + self) + + + @staticmethod + def handle_qmp_event(conn, dom, event, secs, usecs, details, self): + evdoc = { + "event": event, + "timestamp": {"seconds": secs, "microseconds": usecs } + } + if details is not None: + evdoc["data"] = details + + ev = json.dumps(evdoc) + if self.verbose: + print(ev) + ev += "\r\n" + self.api2sock += ev.encode("utf-8") + self.update_client_events() + + + def recv_with_fds(self): + # Match VIR_NET_MESSAGE_NUM_FDS_MAX in virnetprotocol.x + maxfds = 32 + fds = array.array('i') + cmsgdatalen = socket.CMSG_LEN(maxfds * fds.itemsize) + + data, cmsgdata, flags, addr = self.clientsock.recvmsg(1024, + cmsgdatalen) + for cmsg_level, cmsg_type, cmsg_data in cmsgdata: + if (cmsg_level == socket.SOL_SOCKET and + cmsg_type == socket.SCM_RIGHTS): + fds.frombytes(cmsg_data[:len(cmsg_data) - + (len(cmsg_data) % fds.itemsize)]) + else: + raise Exception("Unexpected CMSGDATA level %d type %d" % ( + cmsg_level, cmsg_type)) + + return data, [self.make_file(fd) for fd in fds] + + + def send_with_fds(self, data, fds): + cfds = [fd.fileno() for fd in fds] + + cmsgdata = [(socket.SOL_SOCKET, socket.SCM_RIGHTS, + array.array("i", cfds))] + + return self.clientsock.sendmsg([data], cmsgdata) + + + @staticmethod + def make_file(fd): + flags = fcntl.fcntl(fd, fcntl.F_GETFL) + + mask = os.O_RDONLY | os.O_WRONLY | os.O_RDWR | os.O_APPEND + flags = flags & mask + mode = "" + if flags == os.O_RDONLY: + mode = "rb" + elif flags == os.O_WRONLY: + mode = "wb" + elif flags == os.O_RDWR: + mode = "r+b" + elif flags == (os.O_WRONLY | os.O_APPEND): + mode = "ab" + elif flags == (os.O_RDWR | os.O_APPEND): + mode = "a+b" + + return os.fdopen(fd, mode) + + + def add_client(self, sock): + ver = self.conn.getVersion() + major = int(ver / 1000000) % 1000 + minor = int(ver / 1000) % 1000 + micro = ver % 1000 + + greetingobj = { + "QMP": { + "version": { + "qemu": { + "major": major, + "minor": minor, + "micro": micro, + }, + "package": f"qemu-{major}.{minor}.{micro}", + }, + "capabilities": [ + "oob" + ], + } + } + greeting = json.dumps(greetingobj) + if self.verbose: + print(greeting) + greeting += "\r\n" + + self.clientsock = sock + self.clientwatch = libvirt.virEventAddHandle( + self.clientsock.fileno(), libvirt.VIR_EVENT_HANDLE_WRITABLE, + self.handle_client_io, self) + self.api2sock += greeting.encode("utf-8") + self.update_server_events() + + + def remove_client(self): + libvirt.virEventRemoveHandle(self.clientwatch) + self.clientsock.close() + self.clientsock = None + self.clientwatch = 0 + self.update_server_events() + + self.api2sock = bytes([]) + self.api2sockfds = [] + + self.sock2api = bytes([]) + self.sock2apifds = [] + + + def update_client_events(self): + # For simplicity of tracking distinct QMP cmds and their passed FDs + # we don't try to support "pipelining", only a single cmd may be + # inflight + if len(self.api2sock) > 0: + events = libvirt.VIR_EVENT_HANDLE_WRITABLE + else: + events = libvirt.VIR_EVENT_HANDLE_READABLE + + libvirt.virEventUpdateHandle(self.clientwatch, events) + + + def update_server_events(self): + if self.clientsock is not None: + libvirt.virEventUpdateHandle(self.serverwatch, 0) + else: + libvirt.virEventUpdateHandle(self.serverwatch, + libvirt.VIR_EVENT_HANDLE_READABLE) + + + def try_command(self): + try: + cmdstr = self.sock2api.decode("utf-8") + cmd = json.loads(cmdstr) + + if self.verbose: + cmdstr = cmdstr.strip() + print(cmdstr) + except Exception as ex: + if debug: + print("Incomplete %s: %s" % ( self.sock2api, ex)) + return + + id = None + if "id" in cmd: + id = cmd["id"] + del cmd["id"] + + if cmd.get("execute", "") == "qmp_capabilities": + resobj = { + "return": {}, + } + resfds = [] + else: + if hasattr(libvirt_qemu, "qemuMonitorCommandWithFiles"): + res, resfds = libvirt_qemu.qemuMonitorCommandWithFiles( + self.dom, json.dumps(cmd), [f.fileno() for f in self.sock2apifds]) + resobj = json.loads(res) + else: + if len(self.sock2apifds) > 0: + raise Exception("FD passing not supported") + res = libvirt_qemu.qemuMonitorCommand( + self.dom, json.dumps(cmd)) + resfds = [] + resobj = json.loads(res) + + if "id" in resobj: + del resobj["id"] + if id is not None: + resobj["id"] = id + + res = json.dumps(resobj) + if self.verbose: + print(res) + res += "\r\n" + + self.sock2api = bytes([]) + self.sock2apifds = [] + self.api2sock += res.encode("utf-8") + self.api2sockfds = resfds + + + @staticmethod + def handle_client_io(watch, fd, events, self): + error = False + try: + if events & libvirt.VIR_EVENT_HANDLE_WRITABLE: + done = self.send_with_fds(self.api2sock, self.api2sockfds) + if done > 0: + self.api2sock = self.api2sock[done:] + self.api2sockfds = [] + elif events & libvirt.VIR_EVENT_HANDLE_READABLE: + data, fds = self.recv_with_fds() + if len(data) == 0: + error = True + else: + self.sock2api += data + if len(fds): + self.sock2apifds += fds + + self.try_command() + else: + error = True + except Exception as e: + global debug + if debug: + print("%s: %s" % (sys.argv[0], str(e))) + print(traceback.format_exc()) + error = True + + if error: + self.remove_client() + else: + self.update_client_events() + + + @staticmethod + def handle_server_io(watch, fd, events, self): + if self.clientsock is None: + sock, addr = self.serversock.accept() + self.add_client(sock) + else: + self.update_server_events() + + +def parse_commandline(): + parser = argparse.ArgumentParser(description="Libvirt QMP proxy") + parser.add_argument("--connect", "-c", + help="Libvirt QEMU driver connection URI") + parser.add_argument("--debug", "-d", action='store_true', + help="Display debugging information") + parser.add_argument("--verbose", "-v", action='store_true', + help="Display QMP traffic") + parser.add_argument("domain", metavar="DOMAIN", + help="Libvirt guest domain ID/UUID/Name") + parser.add_argument("sockpath", metavar="QMP-SOCK-PATH", + help="UNIX socket path for QMP server") + + return parser.parse_args() + + +def main(): + args = parse_commandline() + global debug + debug = args.debug + + if not debug: + libvirt.registerErrorHandler(lambda opaque, error: None, None) + + libvirt.virEventRegisterDefaultImpl() + + conn, dom = get_domain(args.connect, args.domain) + + if conn.getType() != "QEMU": + raise Exception("QMP proxy requires a QEMU driver connection not %s" % + conn.getType()) + + sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) + if os.path.exists(args.sockpath): + os.unlink(args.sockpath) + sock.bind(args.sockpath) + sock.listen(1) + + proxy = QMPProxy(conn, dom, sock, args.verbose) + + while True: + libvirt.virEventRunDefaultImpl() + + +try: + main() + sys.exit(0) +except Exception as e: + print("%s: %s" % (sys.argv[0], str(e))) + if debug: + print(traceback.format_exc()) + sys.exit(1) -- 2.37.3

3 6

[PATCH] spec: Remove extra blank lines
by Jim Fehlig 06 Dec '22

06 Dec '22

The spec file contains inconsistent use of blank lines. While trying to make significant changes to the file, I found it hurts both readability and maintainability. Remove blank lines that interrupt the overall flow and consistency. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- libvirt.spec.in | 91 ------------------------------------------------- 1 file changed, 91 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index d07a43c721..562baea52e 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -138,7 +138,6 @@ %define with_netcf 0%{!?_without_netcf:1} %endif - # fuse is used to provide virtualized /proc for LXC %if %{with_lxc} %define with_fuse 0%{!?_without_fuse:1} @@ -258,7 +257,6 @@ Obsoletes: libvirt-daemon-uml <= 5.0.0 Requires: libvirt-daemon-driver-vbox = %{version}-%{release} %endif Requires: libvirt-daemon-driver-nwfilter = %{version}-%{release} - Requires: libvirt-daemon-driver-interface = %{version}-%{release} Requires: libvirt-daemon-driver-secret = %{version}-%{release} Requires: libvirt-daemon-driver-storage = %{version}-%{release} @@ -358,33 +356,25 @@ BuildRequires: libwsman-devel >= 2.6.3 BuildRequires: audit-libs-devel # we need /usr/sbin/dtrace BuildRequires: systemtap-sdt-devel - # For mount/umount in FS driver BuildRequires: util-linux # For showmount in FS driver (netfs discovery) BuildRequires: nfs-utils - # Fedora build root suckage BuildRequires: gawk - # For storage wiping with different algorithms BuildRequires: scrub - %if %{with_numad} BuildRequires: numad %endif - %if %{with_wireshark} BuildRequires: wireshark-devel %endif - %if %{with_libssh} BuildRequires: libssh-devel >= 0.8.1 %endif - BuildRequires: rpcgen BuildRequires: libtirpc-devel - # Needed for the firewalld_reload macro %if %{with_firewalld_zone} BuildRequires: firewalld-filesystem @@ -404,7 +394,6 @@ BuildRequires: mingw32-portablexdr BuildRequires: mingw32-dlfcn BuildRequires: mingw32-libssh2 BuildRequires: mingw32-curl - BuildRequires: mingw64-filesystem BuildRequires: mingw64-gcc BuildRequires: mingw64-binutils @@ -440,28 +429,23 @@ Summary: Server side daemon and supporting files for libvirt library # The client side, i.e. shared libs are in a subpackage Requires: libvirt-libs = %{version}-%{release} - # The libvirt-guests.sh script requires virsh from libvirt-client subpackage, # but not every deployment wants to use libvirt-guests service. Using # Recommends here will install libvirt-client by default (if available), but # RPM won't complain if the package is unavailable, masked, or removed later. Recommends: libvirt-client = %{version}-%{release} - # netcat is needed on the server side so that clients that have # libvirt < 6.9.0 can connect, but newer versions will prefer # virt-ssh-helper. Making this a Recommends means that it gets # installed by default, but can still be removed if compatibility # with old clients is not required Recommends: /usr/bin/nc - # for modprobe of pci devices Requires: module-init-tools - # for /sbin/ip Requires: iproute # for /sbin/tc Requires: iproute-tc - Requires: polkit >= 0.112 %if %{with_dmidecode} # For virConnectGetSysinfo @@ -523,7 +507,6 @@ The network driver plugin for the libvirtd daemon, providing an implementation of the virtual network APIs using the Linux bridge capabilities. - %package daemon-driver-nwfilter Summary: Nwfilter driver plugin for the libvirtd daemon Requires: libvirt-daemon = %{version}-%{release} @@ -536,7 +519,6 @@ The nwfilter driver plugin for the libvirtd daemon, providing an implementation of the firewall APIs using the ebtables, iptables and ip6tables capabilities - %package daemon-driver-nodedev Summary: Nodedev driver plugin for the libvirtd daemon Requires: libvirt-daemon = %{version}-%{release} @@ -551,7 +533,6 @@ The nodedev driver plugin for the libvirtd daemon, providing an implementation of the node device APIs using the udev capabilities. - %package daemon-driver-interface Summary: Interface driver plugin for the libvirtd daemon Requires: libvirt-daemon = %{version}-%{release} @@ -604,7 +585,6 @@ Requires: lvm2 The storage driver backend adding implementation of the storage APIs for block volumes using lvm. - %package daemon-driver-storage-disk Summary: Storage driver plugin for disk Requires: libvirt-daemon-driver-storage-core = %{version}-%{release} @@ -616,7 +596,6 @@ Requires: device-mapper The storage driver backend adding implementation of the storage APIs for block volumes using the host disks. - %package daemon-driver-storage-scsi Summary: Storage driver plugin for local scsi devices Requires: libvirt-daemon-driver-storage-core = %{version}-%{release} @@ -626,7 +605,6 @@ Requires: libvirt-libs = %{version}-%{release} The storage driver backend adding implementation of the storage APIs for scsi host devices. - %package daemon-driver-storage-iscsi Summary: Storage driver plugin for iscsi Requires: libvirt-daemon-driver-storage-core = %{version}-%{release} @@ -637,7 +615,6 @@ Requires: iscsi-initiator-utils The storage driver backend adding implementation of the storage APIs for iscsi volumes using the host iscsi stack. - %if %{with_storage_iscsi_direct} %package daemon-driver-storage-iscsi-direct Summary: Storage driver plugin for iscsi-direct @@ -649,7 +626,6 @@ The storage driver backend adding implementation of the storage APIs for iscsi volumes using libiscsi direct connection. %endif - %package daemon-driver-storage-mpath Summary: Storage driver plugin for multipath volumes Requires: libvirt-daemon-driver-storage-core = %{version}-%{release} @@ -660,7 +636,6 @@ Requires: device-mapper The storage driver backend adding implementation of the storage APIs for multipath storage using device mapper. - %if %{with_storage_gluster} %package daemon-driver-storage-gluster Summary: Storage driver plugin for gluster @@ -678,7 +653,6 @@ The storage driver backend adding implementation of the storage APIs for gluster volumes using libgfapi. %endif - %if %{with_storage_rbd} %package daemon-driver-storage-rbd Summary: Storage driver plugin for rbd @@ -690,7 +664,6 @@ The storage driver backend adding implementation of the storage APIs for rbd volumes using the ceph protocol. %endif - %if %{with_storage_zfs} %package daemon-driver-storage-zfs Summary: Storage driver plugin for ZFS @@ -705,7 +678,6 @@ The storage driver backend adding implementation of the storage APIs for ZFS volumes. %endif - %package daemon-driver-storage Summary: Storage driver plugin including all backends for the libvirtd daemon Requires: libvirt-daemon-driver-storage-core = %{version}-%{release} @@ -732,7 +704,6 @@ The storage driver plugin for the libvirtd daemon, providing an implementation of the storage APIs using LVM, iSCSI, parted and more. - %if %{with_qemu} %package daemon-driver-qemu Summary: QEMU driver plugin for the libvirtd daemon @@ -753,7 +724,6 @@ an implementation of the hypervisor driver APIs using QEMU %endif - %if %{with_lxc} %package daemon-driver-lxc Summary: LXC driver plugin for the libvirtd daemon @@ -769,7 +739,6 @@ an implementation of the hypervisor driver APIs using the Linux kernel %endif - %if %{with_vbox} %package daemon-driver-vbox Summary: VirtualBox driver plugin for the libvirtd daemon @@ -782,7 +751,6 @@ an implementation of the hypervisor driver APIs using VirtualBox %endif - %if %{with_libxl} %package daemon-driver-libxl Summary: Libxl driver plugin for the libvirtd daemon @@ -796,8 +764,6 @@ an implementation of the hypervisor driver APIs using Libxl %endif - - %if %{with_qemu_tcg} %package daemon-qemu Summary: Server side daemon & driver required to run QEMU guests @@ -817,7 +783,6 @@ Server side daemon and driver required to manage the virtualization capabilities of the QEMU TCG emulators %endif - %if %{with_qemu_kvm} %package daemon-kvm Summary: Server side daemon & driver required to run KVM guests @@ -837,7 +802,6 @@ Server side daemon and driver required to manage the virtualization capabilities of the KVM hypervisor %endif - %if %{with_lxc} %package daemon-lxc Summary: Server side daemon & driver required to run LXC guests @@ -856,7 +820,6 @@ Server side daemon and driver required to manage the virtualization capabilities of LXC %endif - %if %{with_libxl} %package daemon-xen Summary: Server side daemon & driver required to run XEN guests @@ -998,7 +961,6 @@ MinGW Windows libvirt virtualization library. %endif %prep - %autosetup -S git_am %build @@ -1152,7 +1114,6 @@ exit 1 %define who %{?packager}%{!?packager:Unknown} %define arg_packager -Dpackager="%{who}, %{when}, %{where}" %define arg_packager_version -Dpackager_version="%{release}" - %define arg_selinux_mount -Dselinux_mount="/sys/fs/selinux" # place macros above and build commands below this comment @@ -1396,7 +1357,6 @@ rm -rf $RPM_BUILD_ROOT%{mingw64_libexecdir}/libvirt-guests.sh %endif - %check # Building on slow archs, like emulated s390x in Fedora copr, requires # raising the test timeout @@ -1435,7 +1395,6 @@ fi \ # libvirtd. The uid number is irrelevant, so we use dynamic allocation # described at the above link. getent group libvirt >/dev/null || groupadd -r libvirt - exit 0 %post daemon @@ -1446,14 +1405,11 @@ exit 0 %else %libvirt_daemon_systemd_post_inet libvirtd %endif - %systemd_post libvirt-guests.service - %libvirt_daemon_schedule_restart libvirtd %preun daemon %systemd_preun libvirt-guests.service - %libvirt_daemon_systemd_preun_inet libvirtd %libvirt_daemon_systemd_preun_inet virtproxyd %libvirt_daemon_systemd_preun_priv virtlogd @@ -1499,7 +1455,6 @@ then /bin/systemctl start libvirtd.service >/dev/null 2>&1 || : fi fi - %libvirt_daemon_finish_restart libvirtd %pre daemon-driver-network @@ -1591,7 +1546,6 @@ fi %libvirt_sysconfig_posttrans virtsecretd %libvirt_daemon_perform_restart virtsecretd - %pre daemon-driver-storage-core %libvirt_sysconfig_pre virtstoraged @@ -1608,7 +1562,6 @@ fi %libvirt_sysconfig_posttrans virtstoraged %libvirt_daemon_perform_restart virtstoraged - %if %{with_qemu} %pre daemon-driver-qemu %libvirt_sysconfig_pre virtqemud @@ -1640,7 +1593,6 @@ exit 0 %libvirt_daemon_perform_restart virtqemud %endif - %if %{with_lxc} %pre daemon-driver-lxc %libvirt_sysconfig_pre virtlxcd @@ -1659,7 +1611,6 @@ exit 0 %libvirt_daemon_perform_restart virtlxcd %endif - %if %{with_vbox} %post daemon-driver-vbox %if %{with_modular_daemons} @@ -1678,7 +1629,6 @@ exit 0 %libvirt_daemon_perform_restart virtvboxd %endif - %if %{with_libxl} %post daemon-driver-libxl %if %{with_modular_daemons} @@ -1697,7 +1647,6 @@ exit 0 %libvirt_daemon_perform_restart virtxend %endif - %post daemon-config-network if test $1 -eq 1 && test ! -f %{_sysconfdir}/libvirt/qemu/networks/default.xml ; then # see if the network used by default network creates a conflict, @@ -1773,7 +1722,6 @@ exit 0 %doc libvirt-docs/* %files daemon - %{_unitdir}/libvirtd.service %{_unitdir}/libvirtd.socket %{_unitdir}/libvirtd-ro.socket @@ -1800,25 +1748,19 @@ exit 0 %config(noreplace) %{_sysconfdir}/libvirt/virtlockd.conf %config(noreplace) %{_sysconfdir}/sasl2/libvirt.conf %config(noreplace) %{_prefix}/lib/sysctl.d/60-libvirtd.conf - %config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd %dir %{_datadir}/libvirt/ - %ghost %dir %{_rundir}/libvirt/ %ghost %dir %{_rundir}/libvirt/common/ - %dir %attr(0755, root, root) %{_localstatedir}/lib/libvirt/ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/images/ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/filesystems/ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/boot/ %dir %attr(0711, root, root) %{_localstatedir}/cache/libvirt/ - - %dir %attr(0755, root, root) %{_libdir}/libvirt/ %dir %attr(0755, root, root) %{_libdir}/libvirt/connection-driver/ %dir %attr(0755, root, root) %{_libdir}/libvirt/lock-driver %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/lockd.so - %{_datadir}/augeas/lenses/libvirtd.aug %{_datadir}/augeas/lenses/tests/test_libvirtd.aug %{_datadir}/augeas/lenses/virtlogd.aug @@ -1831,23 +1773,17 @@ exit 0 %if %{with_qemu} %{_datadir}/augeas/lenses/tests/test_libvirt_lockd.aug %endif - %{_datadir}/polkit-1/actions/org.libvirt.unix.policy %{_datadir}/polkit-1/actions/org.libvirt.api.policy %{_datadir}/polkit-1/rules.d/50-libvirt.rules - %dir %attr(0700, root, root) %{_localstatedir}/log/libvirt/ - %attr(0755, root, root) %{_libexecdir}/libvirt_iohelper - %attr(0755, root, root) %{_bindir}/virt-ssh-helper - %attr(0755, root, root) %{_sbindir}/libvirtd %attr(0755, root, root) %{_sbindir}/virtproxyd %attr(0755, root, root) %{_sbindir}/virtlogd %attr(0755, root, root) %{_sbindir}/virtlockd %attr(0755, root, root) %{_libexecdir}/libvirt-guests.sh - %{_mandir}/man1/virt-admin.1* %{_mandir}/man1/virt-host-validate.1* %{_mandir}/man8/virt-ssh-helper.8* @@ -1856,7 +1792,6 @@ exit 0 %{_mandir}/man8/virtlogd.8* %{_mandir}/man8/virtlockd.8* %{_mandir}/man8/virtproxyd.8* - %{_bindir}/virt-host-validate %{_bindir}/virt-admin %{_datadir}/bash-completion/completions/virt-admin @@ -1903,7 +1838,6 @@ exit 0 %attr(0755, root, root) %{_libexecdir}/libvirt_leaseshelper %{_libdir}/libvirt/connection-driver/libvirt_driver_network.so %{_mandir}/man8/virtnetworkd.8* - %if %{with_firewalld_zone} %{_prefix}/lib/firewalld/zones/libvirt.xml %{_prefix}/lib/firewalld/zones/libvirt-routed.xml @@ -2165,7 +2099,6 @@ exit 0 %{_bindir}/virt-xml-validate %{_bindir}/virt-pki-query-dn %{_bindir}/virt-pki-validate - %{_datadir}/bash-completion/completions/virsh %if %{with_qemu} @@ -2187,17 +2120,13 @@ exit 0 %{_libdir}/libvirt-admin.so.* %dir %{_datadir}/libvirt/ %dir %{_datadir}/libvirt/schemas/ - %{_datadir}/systemtap/tapset/libvirt_probes*.stp %{_datadir}/systemtap/tapset/libvirt_functions.stp %if %{with_qemu} %{_datadir}/systemtap/tapset/libvirt_qemu_probes*.stp %endif - %{_datadir}/libvirt/schemas/*.rng - %{_datadir}/libvirt/cpu_map/*.xml - %{_datadir}/libvirt/test-screenshot.png %if %{with_wireshark} @@ -2245,7 +2174,6 @@ exit 0 %{_libdir}/pkgconfig/libvirt-admin.pc %{_libdir}/pkgconfig/libvirt-qemu.pc %{_libdir}/pkgconfig/libvirt-lxc.pc - %dir %{_datadir}/libvirt/api/ %{_datadir}/libvirt/api/libvirt-api.xml %{_datadir}/libvirt/api/libvirt-admin-api.xml @@ -2257,7 +2185,6 @@ exit 0 %dir %{mingw32_sysconfdir}/libvirt/ %config(noreplace) %{mingw32_sysconfdir}/libvirt/libvirt.conf %config(noreplace) %{mingw32_sysconfdir}/libvirt/libvirt-admin.conf - %{mingw32_bindir}/libvirt-0.dll %{mingw32_bindir}/virsh.exe %{mingw32_bindir}/virt-admin.exe @@ -2267,7 +2194,6 @@ exit 0 %{mingw32_bindir}/libvirt-lxc-0.dll %{mingw32_bindir}/libvirt-qemu-0.dll %{mingw32_bindir}/libvirt-admin-0.dll - %{mingw32_libdir}/libvirt.dll.a %{mingw32_libdir}/pkgconfig/libvirt.pc %{mingw32_libdir}/pkgconfig/libvirt-qemu.pc @@ -2276,23 +2202,17 @@ exit 0 %{mingw32_libdir}/libvirt-lxc.dll.a %{mingw32_libdir}/libvirt-qemu.dll.a %{mingw32_libdir}/libvirt-admin.dll.a - %dir %{mingw32_datadir}/libvirt/ %dir %{mingw32_datadir}/libvirt/schemas/ %{mingw32_datadir}/libvirt/schemas/*.rng - %dir %{mingw32_datadir}/libvirt/api/ %{mingw32_datadir}/libvirt/api/libvirt-api.xml %{mingw32_datadir}/libvirt/api/libvirt-lxc-api.xml %{mingw32_datadir}/libvirt/api/libvirt-qemu-api.xml %{mingw32_datadir}/libvirt/api/libvirt-admin-api.xml - %{mingw32_datadir}/libvirt/cpu_map/*.xml - %{mingw32_datadir}/libvirt/test-screenshot.png - %{mingw32_datadir}/locale/*/LC_MESSAGES/libvirt.mo - %dir %{mingw32_includedir}/libvirt %{mingw32_includedir}/libvirt/libvirt.h %{mingw32_includedir}/libvirt/libvirt-common.h @@ -2312,7 +2232,6 @@ exit 0 %{mingw32_includedir}/libvirt/libvirt-lxc.h %{mingw32_includedir}/libvirt/libvirt-qemu.h %{mingw32_includedir}/libvirt/libvirt-admin.h - %{mingw32_mandir}/man1/virsh.1* %{mingw32_mandir}/man1/virt-admin.1* %{mingw32_mandir}/man1/virt-xml-validate.1* @@ -2320,12 +2239,10 @@ exit 0 %{mingw32_mandir}/man1/virt-pki-validate.1* %{mingw32_mandir}/man7/virkey*.7* - %files -n mingw64-libvirt %dir %{mingw64_sysconfdir}/libvirt/ %config(noreplace) %{mingw64_sysconfdir}/libvirt/libvirt.conf %config(noreplace) %{mingw64_sysconfdir}/libvirt/libvirt-admin.conf - %{mingw64_bindir}/libvirt-0.dll %{mingw64_bindir}/virsh.exe %{mingw64_bindir}/virt-admin.exe @@ -2335,7 +2252,6 @@ exit 0 %{mingw64_bindir}/libvirt-lxc-0.dll %{mingw64_bindir}/libvirt-qemu-0.dll %{mingw64_bindir}/libvirt-admin-0.dll - %{mingw64_libdir}/libvirt.dll.a %{mingw64_libdir}/pkgconfig/libvirt.pc %{mingw64_libdir}/pkgconfig/libvirt-qemu.pc @@ -2344,23 +2260,17 @@ exit 0 %{mingw64_libdir}/libvirt-lxc.dll.a %{mingw64_libdir}/libvirt-qemu.dll.a %{mingw64_libdir}/libvirt-admin.dll.a - %dir %{mingw64_datadir}/libvirt/ %dir %{mingw64_datadir}/libvirt/schemas/ %{mingw64_datadir}/libvirt/schemas/*.rng - %dir %{mingw64_datadir}/libvirt/api/ %{mingw64_datadir}/libvirt/api/libvirt-api.xml %{mingw64_datadir}/libvirt/api/libvirt-lxc-api.xml %{mingw64_datadir}/libvirt/api/libvirt-qemu-api.xml %{mingw64_datadir}/libvirt/api/libvirt-admin-api.xml - %{mingw64_datadir}/libvirt/cpu_map/*.xml - %{mingw64_datadir}/libvirt/test-screenshot.png - %{mingw64_datadir}/locale/*/LC_MESSAGES/libvirt.mo - %dir %{mingw64_includedir}/libvirt %{mingw64_includedir}/libvirt/libvirt.h %{mingw64_includedir}/libvirt/libvirt-common.h @@ -2380,7 +2290,6 @@ exit 0 %{mingw64_includedir}/libvirt/libvirt-lxc.h %{mingw64_includedir}/libvirt/libvirt-qemu.h %{mingw64_includedir}/libvirt/libvirt-admin.h - %{mingw64_mandir}/man1/virsh.1* %{mingw64_mandir}/man1/virt-admin.1* %{mingw64_mandir}/man1/virt-xml-validate.1* -- 2.38.1

2 1

[libvirt PATCH 0/2] examples: Install amd-sev-es-vmsa.stp
by Andrea Bolognani 06 Dec '22

06 Dec '22

Andrea Bolognani (2): examples: Sort list examples: Install amd-sev-es-vmsa.stp examples/systemtap/meson.build | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) -- 2.38.1

2 3

[PATCH v2 0/2] qemu: refresh state after reset
by Kristina Hanicova 06 Dec '22

06 Dec '22

v1: https://listman.redhat.com/archives/libvir-list/2022-November/235913.html diff to v1: * calling refresh state unconditionally (suggested by Martin) * improved commit message Kristina Hanicova (2): qemu: refresh internal domain state after reset qemu: refresh state after reboot initiated from the guest src/qemu/qemu_domain.c | 1 + src/qemu/qemu_domain.h | 1 + src/qemu/qemu_driver.c | 19 +++++++++++++++++++ src/qemu/qemu_process.c | 2 ++ 4 files changed, 23 insertions(+) -- 2.38.1

2 3

[PATCH 0/7] qemu: support updating device's bootindex
by Jiang Jiacheng 06 Dec '22

06 Dec '22

Support updating device's(support cdrom, disk and network) bootindex online in virDomainUpdateDeviceFlags. The new bootindex will take effect after guest rebooting. Enable bootindex can be set to 0, it means cancel the device's bootindex. To use this feature, we need to get the device's xml first and modify the boot order in the xml, then use 'virsh update-device <domain> <xml> --flag' to update the bootindex. Note that the flag should be --config or --persistent if the vm is running. diff to v1: * add a bool bootIndexSpecified in device info to indicates that the bootorder of the device can be set. * use boot order = '0' to cancel the previous bootorder instead of '-1' Jiang Jiacheng (7): qemu: Introduce qemuDomainChangeBootIndex API qemu: Add bootIndexSpecified and support set bootIndex to '0' qemu: Introduce qemuCheckBootIndex and qemuChangeDiskBootIndex API qemu: Support update disk's bootindex qemu: Support update net's bootindex qemu: Support add bootindex = 0 to boothash when its bootIndexSpecified is true qemu: Reserve bootIndexSpecified when update device src/conf/device_conf.h | 3 + src/conf/domain_conf.c | 9 ++- src/conf/domain_postparse.c | 8 +- src/qemu/qemu_conf.c | 140 +++++++++++++++++++++++++++++++++++ src/qemu/qemu_conf.h | 16 ++++ src/qemu/qemu_domain.c | 3 +- src/qemu/qemu_driver.c | 35 +++++++++ src/qemu/qemu_hotplug.c | 17 +++-- src/qemu/qemu_monitor.c | 20 +++++ src/qemu/qemu_monitor.h | 6 ++ src/qemu/qemu_monitor_json.c | 33 +++++++++ src/qemu/qemu_monitor_json.h | 6 ++ 12 files changed, 286 insertions(+), 10 deletions(-) -- 2.33.0

2 21

Re: Call for FOSDEM presentations on QEMU, KVM, and rust-vmm
by Kashyap Chamarthy 05 Dec '22

05 Dec '22

(Cc also: libvirt upstream maling list) Gentle reminder ... tl;dr: please submit the proposals by *10th Dec 2022* On Tue, Nov 08, 2022 at 10:45:33AM -0500, Stefan Hajnoczi wrote: > Hi, > The yearly FOSDEM open source conference is now accepting talk > proposals. FOSDEM '23 will be held in Brussels, Belgium on 4 & 5 > February. > > FOSDEM is a huge free conference about all things open source and an > opportunity for anyone to present QEMU or KVM topics. Both in-person > and pre-recorded talks are being accepted this year. > > Please consider submitting your talks to the following devrooms: > > Emulator Development Room: > https://blackbeard334.github.io/fosdem23-emulator-devroom-cfp/ > > Virtualization and IaaS devroom: > https://fosdem.org/2023/schedule/track/virtualization_and_iaas/ > > Rust devroom: > https://rust-fosdem.github.io/ (I've re-posted the official announcement[0] along the way, I manually fixed the broken text formatting, a URL, and moved the "important dates" section to the top. [0] https://lists.fosdem.org/pipermail/fosdem/2022q4/003473.html) ----------------------------------------------------------------------- We are excited to announce that the call for proposals is now open for the Virtualization & IaaS devroom at the upcoming FOSDEM 2023, to be hosted on February 4th 2023. This devroom is a collaborative effort, and is organized by dedicated folks from projects such as OpenStack, Xen Project, KubeVirt, QEMU, KVM, and Foreman. We would like to invite all those who are involved in these fields to submit your proposals by December 10th, 2022. Important Dates --------------- Submission deadline: 10th December 2022 Acceptance notifications: 15th December 2022 Final schedule announcement: 20th December 2022 Conference devroom: first half of 4th February 2023 About the Devroom ----------------- The Virtualization & IaaS devroom will feature session topics such as open source hypervisors or virtual machine managers such as Xen Project, KVM, bhyve and VirtualBox as well as Infrastructure-as-a-Service projects such as KubeVirt, Apache CloudStack, OpenStack, QEMU and OpenNebula. This devroom will host presentations that focus on topics of shared interest, such as KVM; libvirt; shared storage; virtualized networking; cloud security; clustering and high availability; interfacing with multiple hypervisors; hyperconverged deployments; and scaling across hundreds or thousands of servers. Presentations in this devroom will be aimed at developers working on these platforms who are looking to collaborate and improve shared infrastructure or solve common problems. We seek topics that encourage dialog between projects and continued work post-FOSDEM. Submit Your Proposal -------------------- All submissions must be made via the Pentabarf event planning site[1]. If you have not used Pentabarf before, you will need to create an account. If you submitted proposals for FOSDEM in previous years, you can use your existing account. After creating the account, select Create Event to start the submission process. Make sure to select Virtualization and IaaS devroom from the Track list. Please fill out all the required fields, and provide a meaningful abstract and description of your proposed session. Submission Guidelines --------------------- We expect more proposals than we can possibly accept, so it is vitally important that you submit your proposal on or before the deadline. Late submissions are unlikely to be considered. All presentation slots are 30 minutes, with 20 minutes planned for presentations, and 10 minutes for Q&A. All presentations will be recorded and made available under Creative Commons licenses. In the Submission notes field, please indicate that you agree that your presentation will be licensed under the CC-By-SA-4.0 or CC-By-4.0 license and that you agree to have your presentation recorded. For example: "If my presentation is accepted for FOSDEM, I hereby agree to license all recordings, slides, and other associated materials under the Creative Commons Attribution Share-Alike 4.0 International License. Sincerely, <NAME>." In the Submission notes field, please also confirm that if your talk is accepted, you will be able to attend FOSDEM and deliver your presentation. We will not consider proposals from prospective speakers who are unsure whether they will be able to secure funds for travel and lodging to attend FOSDEM. (Sadly, we are not able to offer travel funding for prospective speakers.) Submission Guidelines --------------------- Mentored presentations will have 25-minute slots, where 20 minutes will include the presentation and 5 minutes will be reserved for questions. The number of newcomer session slots is limited, so we will probably not be able to accept all applications. You must submit your talk and abstract to apply for the mentoring program, our mentors are volunteering their time and will happily provide feedback but won't write your presentation for you! If you are experiencing problems with Pentabarf, the proposal submission interface, or have other questions, you can email our devroom mailing list[2] and we will try to help you. How to Apply ------------ In addition to agreeing to video recording and confirming that you can attend FOSDEM in case your session is accepted, please write "speaker mentoring program application" in the "Submission notes" field, and list any prior speaking experience or other relevant information for your application. Code of Conduct --------------- Following the release of the updated code of conduct for FOSDEM, we'd like to remind all speakers and attendees that all of the presentations and discussions in our devroom are held under the guidelines set in the CoC and we expect attendees, speakers, and volunteers to follow the CoC at all times. If you submit a proposal and it is accepted, you will be required to confirm that you accept the FOSDEM CoC. If you have any questions about the CoC or wish to have one of the devroom organizers review your presentation slides or any other content for CoC compliance, please email us and we will do our best to assist you. Call for Volunteers ------------------- We are also looking for volunteers to help run the devroom. We need assistance watching time for the speakers, and helping with video for the devroom. Please contact devroom mailing list[2] for more information. Questions? ---------- If you have any questions about this devroom, please send your questions to our devroom mailing list. You can also subscribe to the list to receive updates about important dates, session announcements, and to connect with other attendees. See you all at FOSDEM! [1] https://penta.fosdem.org/submission [2] iaas-virt-devroom at lists.fosdem.org ----------------------------------------------------------------------- -- /kashyap

1 0

[PATCH 0/4] qemu: Init ext devices paths on reconnect
by Michal Privoznik 05 Dec '22

05 Dec '22

*** BLURB HERE *** Michal Prívozník (4): qemu_process: Document qemuProcessPrepare{Domain,Host}() order qemu_extdevice: Init paths in qemuExtDevicesPrepareDomain() qemu_extdevice: Expose qemuExtDevicesInitPaths() qemu: Init ext devices paths on reconnect src/qemu/qemu_extdevice.c | 8 ++++---- src/qemu/qemu_extdevice.h | 5 +++++ src/qemu/qemu_process.c | 7 +++++++ 3 files changed, 16 insertions(+), 4 deletions(-) -- 2.37.4

2 5

[PATCH 0/7] Sanitize logic to get live/config device definitions for unplug/update
by Peter Krempa 05 Dec '22

05 Dec '22

Convert code *DomainUpdateDeviceFlags/*DomainDetachDeviceLiveAndConfig to avoid use of virDomainDeviceDefCopy. We have the original XML string from the user so it doesn't make sense to parse it and then copy it (whcih involves formatting and parsing back), when we can simply parse it twice, saving the extra formatting step. Peter Krempa (7): qemu: driver: Fix formatting of function headers around qemuDomainAttachDevice qemuDomainUpdateDeviceFlags: Parse XML twice rather than use virDomainDeviceDefCopy qemuDomainDetachDeviceLiveAndConfig: Parse XML twice rather than use virDomainDeviceDefCopy qemuDomainDetachDeviceLiveAndConfig: Refactor cleanup lxcDomainAttachDeviceFlags: Parse XML twice rather than use virDomainDeviceDefCopy lxcDomainDetachDeviceFlags: Parse XML twice rather than use virDomainDeviceDefCopy conf: domain: Remove virDomainDeviceDefCopy src/conf/domain_conf.c | 121 --------------------------------------- src/conf/domain_conf.h | 4 -- src/libvirt_private.syms | 1 - src/lxc/lxc_driver.c | 75 ++++++++++-------------- src/qemu/qemu_driver.c | 97 +++++++++++++------------------ 5 files changed, 70 insertions(+), 228 deletions(-) -- 2.37.3

2 8

[PATCH v3] qemu: Don't report spurious errors from vCPU tid validation on hotunplug timeout
by Peter Krempa 05 Dec '22

05 Dec '22

From: Shaleen Bathla <shaleen.bathla(a)oracle.com> Use of qemuDomainValidateVcpuInfo in the helpers for hotplug and unplug of vCPUs can lead to spurious errors reported such as: internal error: qemu didn't report thread id for vcpu 'XX'" The reason for this is that qemuDomainValidateVcpuInfo validates the state of all vCPUs against the expected state of vCPUs. If an unplug operation completed before libvirt was unable to process it yet the expected state could not reflect the current state. To avoid spurious errors the qemuDomainHotplugAddVcpu and qemuDomainRemoveVcpu functions are modified to do localized validation only for the vCPUs they actually modify. We also now ensure that the cgroups are modified before bailing out on error for any vCPUs which passed validation. Additionally in order for qemuDomainRemoveVcpuAlias to be able to find the unplugged vCPU we must ensure that qemuDomainRefreshVcpuInfo does not clear out the alias in case when the vCPU is no longer reported by qemu. Co-authored-by: Partha Satapathy <partha.satapathy(a)oracle.com> Signed-off-by: Shaleen Bathla <shaleen.bathla(a)oracle.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- v3 addresses my review feedback of the original patch, as well as rewrites the commit message for more clarity. src/qemu/qemu_domain.c | 6 +++-- src/qemu/qemu_hotplug.c | 53 ++++++++++++++++++++++++----------------- 2 files changed, 35 insertions(+), 24 deletions(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index ef1a9c8c74..64ebec626c 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -9795,8 +9795,10 @@ qemuDomainRefreshVcpuInfo(virDomainObj *vm, vcpupriv->vcpus = info[i].vcpus; VIR_FREE(vcpupriv->type); vcpupriv->type = g_steal_pointer(&info[i].type); - VIR_FREE(vcpupriv->alias); - vcpupriv->alias = g_steal_pointer(&info[i].alias); + if (info[i].alias) { + VIR_FREE(vcpupriv->alias); + vcpupriv->alias = g_steal_pointer(&info[i].alias); + } virJSONValueFree(vcpupriv->props); vcpupriv->props = g_steal_pointer(&info[i].props); vcpupriv->enable_id = info[i].id; diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index da92ced2f4..6e300f547c 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -6088,38 +6088,37 @@ qemuDomainRemoveVcpu(virDomainObj *vm, qemuDomainVcpuPrivate *vcpupriv = QEMU_DOMAIN_VCPU_PRIVATE(vcpuinfo); int oldvcpus = virDomainDefGetVcpus(vm->def); unsigned int nvcpus = vcpupriv->vcpus; - virErrorPtr save_error = NULL; size_t i; + ssize_t offlineVcpuWithTid = -1; if (qemuDomainRefreshVcpuInfo(vm, VIR_ASYNC_JOB_NONE, false) < 0) return -1; - /* validation requires us to set the expected state prior to calling it */ for (i = vcpu; i < vcpu + nvcpus; i++) { vcpuinfo = virDomainDefGetVcpu(vm->def, i); - vcpuinfo->online = false; + vcpupriv = QEMU_DOMAIN_VCPU_PRIVATE(vcpuinfo); + + if (vcpupriv->tid == 0) { + vcpuinfo->online = false; + /* Clear the alias as VCPU is now unplugged */ + VIR_FREE(vcpupriv->alias); + ignore_value(virCgroupDelThread(priv->cgroup, VIR_CGROUP_THREAD_VCPU, i)); + } else { + if (offlineVcpuWithTid == -1) + offlineVcpuWithTid = i; + } } - if (qemuDomainValidateVcpuInfo(vm) < 0) { - /* rollback vcpu count if the setting has failed */ + if (offlineVcpuWithTid != -1) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("qemu reported thread id for inactive vcpu '%zu'"), + offlineVcpuWithTid); virDomainAuditVcpu(vm, oldvcpus, oldvcpus - nvcpus, "update", false); - - for (i = vcpu; i < vcpu + nvcpus; i++) { - vcpuinfo = virDomainDefGetVcpu(vm->def, i); - vcpuinfo->online = true; - } return -1; } virDomainAuditVcpu(vm, oldvcpus, oldvcpus - nvcpus, "update", true); - virErrorPreserveLast(&save_error); - - for (i = vcpu; i < vcpu + nvcpus; i++) - ignore_value(virCgroupDelThread(priv->cgroup, VIR_CGROUP_THREAD_VCPU, i)); - - virErrorRestore(&save_error); - return 0; } @@ -6141,6 +6140,9 @@ qemuDomainRemoveVcpuAlias(virDomainObj *vm, return; } } + + VIR_DEBUG("vcpu '%s' not found in vcpulist of domain '%s'", + alias, vm->def->name); } @@ -6209,6 +6211,7 @@ qemuDomainHotplugAddVcpu(virQEMUDriver *driver, int rc; int oldvcpus = virDomainDefGetVcpus(vm->def); size_t i; + bool vcpuTidMissing = false; if (!qemuDomainSupportsNewVcpuHotplug(vm)) { virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", @@ -6238,20 +6241,26 @@ qemuDomainHotplugAddVcpu(virQEMUDriver *driver, if (qemuDomainRefreshVcpuInfo(vm, VIR_ASYNC_JOB_NONE, false) < 0) return -1; - /* validation requires us to set the expected state prior to calling it */ for (i = vcpu; i < vcpu + nvcpus; i++) { vcpuinfo = virDomainDefGetVcpu(vm->def, i); vcpupriv = QEMU_DOMAIN_VCPU_PRIVATE(vcpuinfo); vcpuinfo->online = true; - if (vcpupriv->tid > 0 && - qemuProcessSetupVcpu(vm, i, true) < 0) - return -1; + if (vcpupriv->tid > 0) { + if (qemuProcessSetupVcpu(vm, i, true) < 0) { + return -1; + } + } else { + vcpuTidMissing = true; + } } - if (qemuDomainValidateVcpuInfo(vm) < 0) + if (vcpuTidMissing && qemuDomainHasVcpuPids(vm)) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("qemu didn't report thread id for vcpu '%zu'"), i); return -1; + } qemuDomainVcpuPersistOrder(vm->def); -- 2.37.3

3 3

[PATCH 0/3] qemu_tpm: Set log file label on migration
by Michal Privoznik 02 Dec '22

02 Dec '22

See 3/3 for explanation. Michal Prívozník (3): security: Extend TPM label APIs qemu_tpm: Extend start/stop APIs qemu_tpm: Set log file label on migration src/qemu/qemu_security.c | 13 +++++++---- src/qemu/qemu_security.h | 4 +++- src/qemu/qemu_tpm.c | 22 +++++++++--------- src/security/security_driver.h | 6 +++-- src/security/security_manager.c | 10 +++++---- src/security/security_manager.h | 6 +++-- src/security/security_selinux.c | 40 +++++++++++++++++++++------------ src/security/security_stack.c | 12 +++++----- 8 files changed, 71 insertions(+), 42 deletions(-) -- 2.37.4

2 4

[PATCH 00/13] virsh: Don't reimplement virXPathNodeSet
by Peter Krempa 02 Dec '22

02 Dec '22

This series converts open-coded virXPathNodeSet to the proper helper use and also adds --print-xml option to commands using xmlXpathEval which didn't have it. Peter Krempa (13): virsh: Add --print-xml option for 'detach-interface' virshDomainDetachInterface: Use virXPathNodeSet instead of xmlXpathEval virsh: Add --print-xml option for 'domif-setlink' virsh: cmdDomIfSetLink: Use virXPathNodeSet instead of xmlXpathEval virsh: Refactor cleanup in 'cmdVolClone' virsh: Add --print-xml flag for 'vol-clone' command virsh: virshMakeCloneXML: Use virXPathNode instead of xmlXPathEval virsh: cmdDetachDisk: Refactor cleanup virsh: cmdChangeMedia: Refactor cleanup virshFindDisk: Use virXPathNodeSet instead of xmlXPathEval virshFindDisk: Sanitize removable media check util: xml: Introduce virXMLNodeGetSubelement virshFindDisk: Sanitize use of 'tmp' variable docs/manpages/virsh.rst | 15 +- src/libvirt_private.syms | 1 + src/util/virxml.c | 23 +++ src/util/virxml.h | 5 + tools/virsh-domain.c | 298 ++++++++++++++++++--------------------- tools/virsh-volume.c | 61 ++++---- 6 files changed, 207 insertions(+), 196 deletions(-) -- 2.38.1

2 16

[PATCH] spec: Remove use of %{name} macro
by Jim Fehlig 02 Dec '22

02 Dec '22

The spec file uses both "libvirt" and "%{name}", but in reality the expanded value of %{name} will never change. Drop the macro in favor of the explicit and more readable "libvirt". Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- libvirt.spec.in | 66 ++++++++++++++++++++++++------------------------- 1 file changed, 33 insertions(+), 33 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index fa94cda3c5..d07a43c721 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -439,13 +439,13 @@ Summary: Server side daemon and supporting files for libvirt library # for subpackages are listed later in those subpackages) # The client side, i.e. shared libs are in a subpackage -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} # The libvirt-guests.sh script requires virsh from libvirt-client subpackage, # but not every deployment wants to use libvirt-guests service. Using # Recommends here will install libvirt-client by default (if available), but # RPM won't complain if the package is unavailable, masked, or removed later. -Recommends: %{name}-client = %{version}-%{release} +Recommends: libvirt-client = %{version}-%{release} # netcat is needed on the server side so that clients that have # libvirt < 6.9.0 can connect, but newer versions will prefer @@ -896,7 +896,7 @@ capabilities of VirtualBox %package client Summary: Client side utilities of the libvirt library -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} # Needed by virt-pki-validate script. Requires: gnutls-utils @@ -909,7 +909,7 @@ capabilities of recent versions of Linux (and other OSes). %package client-qemu Summary: Additional client side utilities for QEMU -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} Requires: python3-libvirt >= 3.7.0 %description client-qemu @@ -931,7 +931,7 @@ Shared libraries for accessing the libvirt daemon. %package wireshark Summary: Wireshark dissector plugin for libvirt RPC transactions Requires: wireshark -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} %description wireshark Wireshark dissector plugin for better analysis of libvirt RPC traffic. @@ -940,7 +940,7 @@ Wireshark dissector plugin for better analysis of libvirt RPC traffic. %if %{with_lxc} %package login-shell Summary: Login shell for connecting users to an LXC container -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} %description login-shell Provides the set-uid virt-login-shell binary that is used to @@ -950,7 +950,7 @@ namespaces. %package devel Summary: Libraries, includes, etc. to compile with the libvirt library -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} Requires: pkgconfig %description devel @@ -962,8 +962,8 @@ Summary: Sanlock lock manager plugin for QEMU driver Requires: sanlock >= 2.4 #for virt-sanlock-cleanup require augeas Requires: augeas -Requires: %{name}-daemon = %{version}-%{release} -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-daemon = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} %description lock-sanlock Includes the Sanlock lock manager plugin for the QEMU @@ -1157,7 +1157,7 @@ exit 1 # place macros above and build commands below this comment -export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/%{name}.spec) +export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec) %meson \ -Drunstatedir=%{_rundir} \ @@ -1312,7 +1312,7 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/%{name}.spec) %install rm -fr %{buildroot} -export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/%{name}.spec) +export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec) %meson_install @@ -1882,7 +1882,7 @@ exit 0 %{_unitdir}/virtinterfaced-admin.socket %attr(0755, root, root) %{_sbindir}/virtinterfaced %ghost %dir %{_rundir}/libvirt/interface/ -%{_libdir}/%{name}/connection-driver/libvirt_driver_interface.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_interface.so %{_mandir}/man8/virtinterfaced.8* %files daemon-driver-network @@ -1901,7 +1901,7 @@ exit 0 %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/network/ %dir %attr(0755, root, root) %{_localstatedir}/lib/libvirt/dnsmasq/ %attr(0755, root, root) %{_libexecdir}/libvirt_leaseshelper -%{_libdir}/%{name}/connection-driver/libvirt_driver_network.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_network.so %{_mandir}/man8/virtnetworkd.8* %if %{with_firewalld_zone} @@ -1922,7 +1922,7 @@ exit 0 %{_unitdir}/virtnodedevd-admin.socket %attr(0755, root, root) %{_sbindir}/virtnodedevd %ghost %dir %{_rundir}/libvirt/nodedev/ -%{_libdir}/%{name}/connection-driver/libvirt_driver_nodedev.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_nodedev.so %{_mandir}/man8/virtnodedevd.8* %files daemon-driver-nwfilter @@ -1938,7 +1938,7 @@ exit 0 %ghost %dir %{_rundir}/libvirt/network/ %ghost %dir %{_rundir}/libvirt/nwfilter-binding/ %ghost %dir %{_rundir}/libvirt/nwfilter/ -%{_libdir}/%{name}/connection-driver/libvirt_driver_nwfilter.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_nwfilter.so %{_mandir}/man8/virtnwfilterd.8* %files daemon-driver-secret @@ -1952,7 +1952,7 @@ exit 0 %attr(0755, root, root) %{_sbindir}/virtsecretd %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/secrets/ %ghost %dir %{_rundir}/libvirt/secrets/ -%{_libdir}/%{name}/connection-driver/libvirt_driver_secret.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_secret.so %{_mandir}/man8/virtsecretd.8* %files daemon-driver-storage @@ -1970,45 +1970,45 @@ exit 0 %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/storage/ %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/storage/autostart/ %ghost %dir %{_rundir}/libvirt/storage/ -%{_libdir}/%{name}/connection-driver/libvirt_driver_storage.so -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_fs.so -%{_libdir}/%{name}/storage-file/libvirt_storage_file_fs.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_storage.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_fs.so +%{_libdir}/libvirt/storage-file/libvirt_storage_file_fs.so %{_mandir}/man8/virtstoraged.8* %files daemon-driver-storage-disk -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_disk.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_disk.so %files daemon-driver-storage-logical -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_logical.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_logical.so %files daemon-driver-storage-scsi -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_scsi.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_scsi.so %files daemon-driver-storage-iscsi -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_iscsi.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_iscsi.so %if %{with_storage_iscsi_direct} %files daemon-driver-storage-iscsi-direct -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_iscsi-direct.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_iscsi-direct.so %endif %files daemon-driver-storage-mpath -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_mpath.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_mpath.so %if %{with_storage_gluster} %files daemon-driver-storage-gluster -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_gluster.so -%{_libdir}/%{name}/storage-file/libvirt_storage_file_gluster.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_gluster.so +%{_libdir}/libvirt/storage-file/libvirt_storage_file_gluster.so %endif %if %{with_storage_rbd} %files daemon-driver-storage-rbd -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_rbd.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_rbd.so %endif %if %{with_storage_zfs} %files daemon-driver-storage-zfs -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_zfs.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_zfs.so %endif %if %{with_qemu} @@ -2044,7 +2044,7 @@ exit 0 %dir %attr(0750, root, root) %{_localstatedir}/cache/libvirt/qemu/ %{_datadir}/augeas/lenses/libvirtd_qemu.aug %{_datadir}/augeas/lenses/tests/test_libvirtd_qemu.aug -%{_libdir}/%{name}/connection-driver/libvirt_driver_qemu.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_qemu.so %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/swtpm/ %dir %attr(0730, tss, tss) %{_localstatedir}/log/swtpm/libvirt/qemu/ %{_bindir}/virt-qemu-run @@ -2072,7 +2072,7 @@ exit 0 %{_datadir}/augeas/lenses/libvirtd_lxc.aug %{_datadir}/augeas/lenses/tests/test_libvirtd_lxc.aug %attr(0755, root, root) %{_libexecdir}/libvirt_lxc -%{_libdir}/%{name}/connection-driver/libvirt_driver_lxc.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_lxc.so %{_mandir}/man8/virtlxcd.8* %endif @@ -2100,7 +2100,7 @@ exit 0 %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/libxl/channel/target/ %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/libxl/dump/ %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/libxl/save/ -%{_libdir}/%{name}/connection-driver/libvirt_driver_libxl.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_libxl.so %{_mandir}/man8/virtxend.8* %endif @@ -2114,7 +2114,7 @@ exit 0 %{_unitdir}/virtvboxd-ro.socket %{_unitdir}/virtvboxd-admin.socket %attr(0755, root, root) %{_sbindir}/virtvboxd -%{_libdir}/%{name}/connection-driver/libvirt_driver_vbox.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_vbox.so %{_mandir}/man8/virtvboxd.8* %endif -- 2.38.1

2 1

[PATCH 00/12] JSON monitor handling cleanups and spurious error bug fix
by Peter Krempa 02 Dec '22

02 Dec '22

First half introduces qemuMonitorJSONGetReply and uses it in our code base, second half introduces virJSONValueArrayToStringList, uses it to fix a bug and refactor the rest of the usage. Peter Krempa (12): qemu: monitor: Introduce qemuMonitorJSONGetReply, a better qemuMonitorJSONCheckReply qemu: monitor: Use qemuMonitorJSONGetReply for VIR_JSON_TYPE_OBJECT qemu: monitor: Use qemuMonitorJSONGetReply for VIR_JSON_TYPE_ARRAY qemu: monitor: Use qemuMonitorJSONGetReply when the value is extracted directly qemu: monitor: Unify and refactor 'PTY' case in qemuMonitorJSONAttachCharDev util: json: Split out array->strinlist conversion from virJSONValueObjectGetStringArray qemuAgentGetDisks: Don't use virJSONValueObjectGetStringArray for optional data qemuMonitorJSONGetCPUDefinitions: Rework lookup of 'unavailable-features' qemuMonitorJSONGetCPUDefinitions: Avoid double lookup of object qemu: monitor: Use qemuMonitorJSONGetReply in conjunction with virJSONValueArrayToStringList qemuAgentSSHGetAuthorizedKeys: Convert last use ofvirJSONValueObjectGetStringArray util: json: Remove unused virJSONValueObjectGetStringArray wrapper src/libvirt_private.syms | 2 +- src/qemu/qemu_agent.c | 13 ++- src/qemu/qemu_monitor_json.c | 189 +++++++++++++++-------------------- src/util/virjson.c | 44 +++----- src/util/virjson.h | 3 +- 5 files changed, 106 insertions(+), 145 deletions(-) -- 2.38.1

2 13