- Devel - libvirt List Archives

[libvirt PATCH] Fix some typos
by Tim Wiederhake 15 Dec '21

15 Dec '21

Signed-off-by: Tim Wiederhake <twiederh(a)redhat.com> --- docs/manpages/virsh.rst | 2 +- src/qemu/qemu_domain.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/manpages/virsh.rst b/docs/manpages/virsh.rst index 275f416090..265725d214 100644 --- a/docs/manpages/virsh.rst +++ b/docs/manpages/virsh.rst @@ -3203,7 +3203,7 @@ host. By default only non-shared non-readonly images are transferred. Use *--migrate-disks* to explicitly specify a list of disk targets to transfer via the comma separated ``disk-list`` argument. With *--copy-storage-synchronous-writes* flag used the disk data migration will -synchronously handle guest disk writes to both the original soure and the +synchronously handle guest disk writes to both the original source and the destination to ensure that the disk migration converges at the price of possibly decreased burst performance. diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h index 5474d1dccc..6586411919 100644 --- a/src/qemu/qemu_domain.h +++ b/src/qemu/qemu_domain.h @@ -344,7 +344,7 @@ struct _qemuDomainChrSourcePrivate { int fd; /* file descriptor of the chardev source */ int logfd; /* file descriptor of the logging source */ - bool wait; /* wait for incomming connections on chardev */ + bool wait; /* wait for incoming connections on chardev */ char *tlsCertPath; /* path to certificates if TLS is requested */ bool tlsVerify; /* whether server should verify client certificates */ -- 2.31.1

2 1

[libvirt PATCH 0/2] qemu: Add support for return-path migration capability
by Jiri Denemark 15 Dec '21

15 Dec '21

See 2/2 for more details about the capability. Jiri Denemark (2): qemu: Support enabling migration caps unless a flag is used qemu: Add support for return-path migration capability src/qemu/qemu_migration_params.c | 39 ++++++++++++++++++++++++-------- src/qemu/qemu_migration_params.h | 1 + 2 files changed, 31 insertions(+), 9 deletions(-) -- 2.34.1

2 4

[PATCH] rpm: don't start/stop -ro.socket units for virtlockd/virtlogd
by Daniel P. Berrangé 14 Dec '21

14 Dec '21

These daemons do not have any support for unprivileged readonly access, so we must not reference -ro.socket units in scripts. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 97030be407..e672fcc3a5 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1279,14 +1279,18 @@ then \ fi \ %libvirt_daemon_finish_restart %1 +# For daemons with only UNIX sockets %define libvirt_daemon_systemd_post() %systemd_post %1.socket %1-ro.socket %1-admin.socket %1.service - -%define libvirt_daemon_systemd_post_inet() %systemd_post %1.socket %1-ro.socket %1-admin.socket %1-tls.socket %1-tcp.socket %1.service - %define libvirt_daemon_systemd_preun() %systemd_preun %1.service %1-ro.socket %1-admin.socket %1.socket +# For daemons with UNIX and INET sockets +%define libvirt_daemon_systemd_post_inet() %systemd_post %1.socket %1-ro.socket %1-admin.socket %1-tls.socket %1-tcp.socket %1.service %define libvirt_daemon_systemd_preun_inet() %systemd_preun %1.service %1-ro.socket %1-admin.socket %1-tls.socket %1-tcp.socket %1.socket +# For daemons with only UNIX sockets and no unprivileged read-only access +%define libvirt_daemon_systemd_post_priv() %systemd_post %1.socket %1-admin.socket %1.service +%define libvirt_daemon_systemd_preun_priv() %systemd_preun %1.service %1-admin.socket %1.socket + %pre daemon # 'libvirt' group is just to allow password-less polkit access to # libvirtd. The uid number is irrelevant, so we use dynamic allocation @@ -1296,8 +1300,8 @@ getent group libvirt >/dev/null || groupadd -r libvirt exit 0 %post daemon -%libvirt_daemon_systemd_post virtlogd -%libvirt_daemon_systemd_post virtlockd +%libvirt_daemon_systemd_post_priv virtlogd +%libvirt_daemon_systemd_post_priv virtlockd %if %{with_modular_daemons} %libvirt_daemon_systemd_post_inet virtproxyd %else @@ -1313,8 +1317,8 @@ exit 0 %libvirt_daemon_systemd_preun_inet libvirtd %libvirt_daemon_systemd_preun_inet virtproxyd -%libvirt_daemon_systemd_preun virtlogd -%libvirt_daemon_systemd_preun virtlockd +%libvirt_daemon_systemd_preun_priv virtlogd +%libvirt_daemon_systemd_preun_priv virtlockd %postun daemon /bin/systemctl daemon-reload >/dev/null 2>&1 || : -- 2.33.1

2 1

[PATCH] rpm: fix typo in daemon name in %post/%preun scripts
by Daniel P. Berrangé 14 Dec '21

14 Dec '21

Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 32b4243d0a..97030be407 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1297,7 +1297,7 @@ exit 0 %post daemon %libvirt_daemon_systemd_post virtlogd -%libvirt_daemon_systemd_post virtlockdd +%libvirt_daemon_systemd_post virtlockd %if %{with_modular_daemons} %libvirt_daemon_systemd_post_inet virtproxyd %else @@ -1314,7 +1314,7 @@ exit 0 %libvirt_daemon_systemd_preun_inet libvirtd %libvirt_daemon_systemd_preun_inet virtproxyd %libvirt_daemon_systemd_preun virtlogd -%libvirt_daemon_systemd_preun virtlockdd +%libvirt_daemon_systemd_preun virtlockd %postun daemon /bin/systemctl daemon-reload >/dev/null 2>&1 || : -- 2.33.1

2 1

[libvirt PATCH 00/10] Enable hyperv-passthrough
by Tim Wiederhake 14 Dec '21

14 Dec '21

This series enables "hv-passthrough" in libvirt. See https://bugzilla.redhat.com/show_bug.cgi?id=1851249. Example usage in VM definition: <features> <hyperv mode='passthrough'/> </features> Tim Wiederhake (10): schema: Wrap hyperv element in choice and group schema: Add optional "mode" attribute to hyperv conf: domain: Define enum for HyperV mode virDomainFeaturesHyperVDefParse: Read attribute "mode" of element "hyperv" virDomainDefFormatFeatures: Write attribute "mode" of element "hyperv" docs: domain: Add documentation for "hyperv"'s new "mode" attribute conf: domain: Add hyperv passthrough mode schema: hyperv: Add mode "passthrough" tests: Add tests for hyperv-passthrough docs: domain: Add documentation for hyperv passthrough mode docs/formatdomain.rst | 13 +- docs/schemas/domaincommon.rng | 172 ++++++++++-------- src/conf/domain_conf.c | 23 ++- src/conf/domain_conf.h | 8 + src/qemu/qemu_command.c | 18 +- src/qemu/qemu_validate.c | 2 +- .../hyperv-passthrough.x86_64-6.1.0.args | 32 ++++ .../hyperv-passthrough.x86_64-latest.args | 32 ++++ tests/qemuxml2argvdata/hyperv-passthrough.xml | 27 +++ tests/qemuxml2argvtest.c | 2 + tests/qemuxml2xmloutdata/hyperv-off.xml | 2 +- .../qemuxml2xmloutdata/hyperv-passthrough.xml | 31 ++++ .../hyperv-stimer-direct.xml | 2 +- tests/qemuxml2xmloutdata/hyperv.xml | 2 +- tests/qemuxml2xmltest.c | 1 + 15 files changed, 277 insertions(+), 90 deletions(-) create mode 100644 tests/qemuxml2argvdata/hyperv-passthrough.x86_64-6.1.0.args create mode 100644 tests/qemuxml2argvdata/hyperv-passthrough.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/hyperv-passthrough.xml create mode 100644 tests/qemuxml2xmloutdata/hyperv-passthrough.xml -- 2.31.1

3 14

[libvirt PATCH 0/5] use g_auto for virCommand (Episode II.V: Goodbye, Galaxy!)
by Ján Tomko 14 Dec '21

14 Dec '21

Fear not, the end is near. Ján Tomko (5): docs: use g_auto in virCommand example util: dnsmasq: refactor CapsRefresh util: iscsi: use two vars in CreateIfaceIQN util: refactor virNodeSuspendSetNodeWakeup util: use g_auto in virNodeSuspendHelper docs/internals/command.html.in | 12 +++-------- src/util/virdnsmasq.c | 37 +++++++++++++++------------------- src/util/viriscsi.c | 34 +++++++++++++++---------------- src/util/virnodesuspend.c | 16 +++------------ 4 files changed, 39 insertions(+), 60 deletions(-) -- 2.31.1

3 7

[PATCH] libxl: Implement domainGetMessages API
by Jim Fehlig 14 Dec '21

14 Dec '21

Since commit 46783e6307a, the 'virsh dominfo' command calls virDomainGetMessages to report any messages from the domain. Hypervisors not implementing the API now get the following log message when clients invoke 'virsh dominfo' this function is not supported by the connection driver: virDomainGetMessages Although libxl currently does not support any tainting or deprecation messages, provide an implementation to squelch the previously unseen error message when collecting dominfo. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- src/libxl/libxl_driver.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index bc8598ea96..2d9385654c 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -6385,6 +6385,29 @@ libxlDomainGetMetadata(virDomainPtr dom, return ret; } +static int +libxlDomainGetMessages(virDomainPtr dom, + char ***msgs, + unsigned int flags) +{ + virDomainObj *vm = NULL; + int ret = -1; + + virCheckFlags(0, -1); + + if (!(vm = libxlDomObjFromDomain(dom))) + return -1; + + if (virDomainGetMessagesEnsureACL(dom->conn, vm->def) < 0) + goto cleanup; + + ret = virDomainObjGetMessages(vm, msgs, flags); + + cleanup: + virDomainObjEndAPI(&vm); + return ret; +} + static virHypervisorDriver libxlHypervisorDriver = { .name = LIBXL_DRIVER_EXTERNAL_NAME, .connectURIProbe = libxlConnectURIProbe, @@ -6498,6 +6521,7 @@ static virHypervisorDriver libxlHypervisorDriver = { .connectBaselineCPU = libxlConnectBaselineCPU, /* 2.3.0 */ .domainSetMetadata = libxlDomainSetMetadata, /* 5.7.0 */ .domainGetMetadata = libxlDomainGetMetadata, /* 5.7.0 */ + .domainGetMessages = libxlDomainGetMessages, /* 8.0.0 */ }; -- 2.34.1

4 6

[libvirt PATCH v3 00/13] Improve AMD SEV support
by Daniel P. Berrangé 14 Dec '21

14 Dec '21

This addresses a few issues in the AMD SEV support - Neither host or domain level SEV metadata is exposed in virsh commands - The domain launch security parameters don't expose enough info to validate the measurement - Support verified direct kernel boot - Report max SEV/SEV-ES guest counts The second point was the initial purpose of my work. Per the SEV API guide to calculate the measurement we need measurement = HMAC(0x04 || API_MAJOR || API_MINOR || BUILD || GCTX.POLICY || GCTX.LD || MNONCE; GCTX.TIK) The API_MINOR, API_MAJOR, BUILD values are things that are available from 'query-sev' QMP command and libvirt does not expose this info. This patch series adds them to virDomainGetLaunchSecurityParams alongside the measurement that we already report. So now the client can fetch this info and calculate an expected measurement to compare with the actual measurement they got. They will thus know if the guest is safe to inject secrets into, which is where Jim's recent patches come into play. In v3: - Refactor CPUID code so and mock it in test suite Daniel P. Berrangé (13): include: add new launch security parameters qemu: report error querying launch params for inactive guest qemu: add monitor APIs for query-sev qemu: report new launch security parameters tools: add 'domlaunchsecinfo' virsh command tools: add 'nodesevinfo' virsh command conf: extend domain capabilities for max SEV guest count include: define parameters for reporting SEV guest limits util: pull CPUID helper function out of CPU driver qemu: report max number of SEV guests conf: add support for setting SEV kernel hashes qemu: probe for sev-guest.kernel-hashes property qemu: format sev-guest.kernel-hashes property docs/formatdomain.rst | 7 +- docs/formatdomaincaps.html.in | 6 + docs/manpages/virsh.rst | 31 +++++ docs/schemas/domaincaps.rng | 6 + docs/schemas/domaincommon.rng | 5 + include/libvirt/libvirt-domain.h | 32 +++++ include/libvirt/libvirt-host.h | 16 +++ src/conf/domain_capabilities.c | 4 + src/conf/domain_capabilities.h | 2 + src/conf/domain_conf.c | 8 ++ src/conf/domain_conf.h | 1 + src/cpu/cpu_x86.c | 34 +----- src/libvirt_private.syms | 1 + src/qemu/qemu_capabilities.c | 47 ++++++++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 1 + src/qemu/qemu_driver.c | 59 ++++++++-- src/qemu/qemu_monitor.c | 13 +++ src/qemu/qemu_monitor.h | 9 ++ src/qemu/qemu_monitor_json.c | 46 ++++++++ src/qemu/qemu_monitor_json.h | 9 ++ src/qemu/qemu_validate.c | 7 ++ src/util/virhostcpu.c | 58 ++++++++++ src/util/virhostcpu.h | 7 ++ .../domaincapsdata/qemu_2.12.0-q35.x86_64.xml | 2 + .../domaincapsdata/qemu_2.12.0-tcg.x86_64.xml | 2 + tests/domaincapsdata/qemu_2.12.0.x86_64.xml | 2 + .../domaincapsdata/qemu_6.0.0-q35.x86_64.xml | 2 + .../domaincapsdata/qemu_6.0.0-tcg.x86_64.xml | 2 + tests/domaincapsdata/qemu_6.0.0.x86_64.xml | 2 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 7 +- .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 7 +- tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 7 +- .../caps_2.12.0.x86_64.replies | 97 ++++++++++++---- .../caps_3.0.0.x86_64.replies | 97 ++++++++++++---- .../caps_3.1.0.x86_64.replies | 97 ++++++++++++---- .../caps_4.0.0.x86_64.replies | 97 ++++++++++++---- .../caps_4.1.0.x86_64.replies | 89 ++++++++++---- .../caps_4.2.0.x86_64.replies | 89 ++++++++++---- .../caps_5.0.0.x86_64.replies | 89 ++++++++++---- .../caps_5.1.0.x86_64.replies | 89 ++++++++++---- .../caps_5.2.0.x86_64.replies | 89 ++++++++++---- .../caps_6.0.0.x86_64.replies | 89 ++++++++++---- .../caps_6.1.0.x86_64.replies | 89 ++++++++++---- .../caps_6.2.0.x86_64.replies | 109 ++++++++++++++---- .../caps_6.2.0.x86_64.xml | 8 ++ tests/qemumonitorjsontest.c | 43 +++++++ ...unch-security-sev-direct.x86_64-6.2.0.args | 40 +++++++ .../launch-security-sev-direct.xml | 39 +++++++ tests/qemuxml2argvtest.c | 1 + tests/testutilsqemu.c | 21 ++++ tools/virsh-domain.c | 53 +++++++++ tools/virsh-host.c | 45 ++++++++ 53 files changed, 1514 insertions(+), 299 deletions(-) create mode 100644 tests/qemuxml2argvdata/launch-security-sev-direct.x86_64-6.2.0.args create mode 100644 tests/qemuxml2argvdata/launch-security-sev-direct.xml -- 2.33.1

2 21

[PATCH v7 0/2] Dirty Ring support (Libvirt)
by huangy81＠chinatelecom.cn 14 Dec '21

14 Dec '21

From: "Hyman Huang(黄勇)" <huangy81(a)chinatelecom.cn> v7 - rebase on master - modify the following points according to the advice given by Peter 1. skip the -accel switch and reuse the existing commit d20ebdda2 'qemu: Switch to -accel' 2. remove the post-parse function and do the parse work in virDomainFeaturesKVMDefParse once for all 3. throw an error if "size" not specified when kvm-dirty-ring feature enabled in xml 4. fix the memory leak when parsing xml 5. use macro VIR_ROUND_UP_POWER_OF_TWO to check power-of-two 6. put error messages in one line 7. squash the last 2 commit into 1 8. add test for kvm-dirty-ring feature Thanks for the careful reviews made by Peter. Please review, Thanks! Hyman Ping for this series. I still keep thinking the dirty ring feature is something good to have for libvirt. qemu-6.1 has supported dirty ring feature and followed up with the commit 0e21bf24 "support dirtyrate at the granualrity of vcpu", which is a typical usage scenario of dirty ring. another usage scenario may be the implementation of per-vcpu auto-converge during live migration which is already being reviewed. so we can make full use of dirty ring feature if libvirt supports. and any corrections and comments about this series would be very appreciated. Please review, Thanks! Hyman v6 - rebase on master v5,v4: blank, just make v6 be the the latest version. v3 - rebase master and fix the confilict when apply "conf: introduce dirty_ring_size in struct "_virDomainDef" to current master. v2 - split patchset into 4 patches - leave out the tcg case when building commandline. - handle the VIR_DOMAIN_KVM_DIRTY_RING case independently in , virDomainFeatureDefParse and virDomainDefFeaturesCheckABIStability, do not integrate it with other cases... - add dirty ring size check in virDomainDefFeaturesCheckABIStability - modify zero checks on integers of dirty ring size in a explicit way. - set the default value of dirty ring size in a post-parser callback. - check the absence of kvm_feature in a explicit way. - code clean of virTristateSwitchTypeToString function. this version's modification base on Peter's advices mostly, thanks a lot, please review ! v1 since qemu has introduced a dirty ring feature in 6.1.0, may be it's the right time to introduce dirty ring in libvirt meanwhile. this patch add feature named 'dirty-ring', which enable dirty ring feature when starting vm. to try this out, three things has done in this patchset: - introduce QEMU_CAPS_ACCEL so the the libvirt can use it to select the right option when specifying the accelerator type. - switch the option "-machine accel=xxx" to "-accel xxx" when specifying accelerator type once libvirt build QEMU command line, so that dirty-ring-size property can be passed to qemu when start vm. - introduce dirty_ring_size to hold the ring size configured by user and pass dirty_ring_size when building qemu commandline if dirty ring feature enabled. though dirty ring is per-cpu logically, the size of dirty ring is registered by 'struct kvm' in QEMU. so we would like to place the dirty_ring_size as a property of vm in Libvirt as the QEMU do. the dirty ring feature is disabled by default, and if enabled, the default value of ring size if 4096 if size not configured. for more details about dirty ring and "-accel" option, please refer to: https://lore.kernel.org/qemu-devel/20210108165050.406906-10-peterx@redhat.c… https://lore.kernel.org/qemu-devel/3aa73987-40e8-3619-0723-9f17f73850bd@red… please review, Thanks! Best Regards ! Hyman Huang(黄勇) (2): qemu: support dirty ring feature tests: add test for kvm-dirty-ring feature docs/formatdomain.rst | 18 ++++--- docs/schemas/domaincommon.rng | 10 ++++ src/conf/domain_conf.c | 54 +++++++++++++++++++ src/conf/domain_conf.h | 4 ++ src/qemu/qemu_command.c | 12 +++++ tests/qemuxml2argvdata/kvm-features-off.xml | 1 + tests/qemuxml2argvdata/kvm-features.args | 2 +- tests/qemuxml2argvdata/kvm-features.xml | 1 + tests/qemuxml2xmloutdata/kvm-features-off.xml | 1 + tests/qemuxml2xmloutdata/kvm-features.xml | 1 + 10 files changed, 95 insertions(+), 9 deletions(-) -- 2.27.0

4 8

[libvirt][PATCH v8 0/5] Support query and use SGX
by Haibin Huang 14 Dec '21

14 Dec '21

This patch series provides support for enabling Intel's Software Guard Extensions (SGX) feature in guest VM. Giving the SGX support in QEMU be accepted and will be merged in two days Intel Software Guard Extensions (Intel SGX) is a set of instructions that increases the security of application code and data, giving them more protection from disclosure or modification. Developers can partition sensitive information into enclaves, which are areas of execution in memory with more security protection. The typical flow looks below at very high level: 1. Calls virConnectGetDomainCapabilities API to domain capabilities that includes the following SGX information. <feature> ... <sgx supported='yes'> <epc_size unit='KiB'>N</epc_size> </sgx> </feature> 2. User requests to start a guest calling virCreateXML() with SGX requirement. It should contain <devices> ... <memory model='sgx-epc'> <target> <size unit='KiB'>N</size> </target> </memory> ... </devices> Haibin Huang (2): Get SGX Capabilities from QEMU Transfer Qemu SGX Capabilities to XML Lin Yang (3): conf: Introduce SGX EPC element into device memory xml qemu: Add command-line to generate SGX EPC memory backend Add unit tests for guest VM creation command with SGX EPC docs/schemas/domaincaps.rng | 22 ++- docs/schemas/domaincommon.rng | 1 + src/conf/domain_capabilities.c | 29 ++++ src/conf/domain_capabilities.h | 13 ++ src/conf/domain_conf.c | 6 + src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 1 + src/libvirt_private.syms | 1 + src/qemu/qemu_alias.c | 6 +- src/qemu/qemu_capabilities.c | 143 +++++++++++++++++- src/qemu/qemu_capabilities.h | 4 + src/qemu/qemu_command.c | 41 ++++- src/qemu/qemu_domain.c | 12 +- src/qemu/qemu_domain_address.c | 6 + src/qemu/qemu_driver.c | 1 + src/qemu/qemu_monitor.c | 10 ++ src/qemu/qemu_monitor.h | 3 + src/qemu/qemu_monitor_json.c | 83 ++++++++++ src/qemu/qemu_monitor_json.h | 3 + src/qemu/qemu_process.c | 2 + src/qemu/qemu_validate.c | 8 + src/security/security_apparmor.c | 1 + src/security/security_dac.c | 2 + src/security/security_selinux.c | 2 + tests/domaincapsdata/bhyve_basic.x86_64.xml | 1 + tests/domaincapsdata/bhyve_fbuf.x86_64.xml | 1 + tests/domaincapsdata/bhyve_uefi.x86_64.xml | 1 + tests/domaincapsdata/empty.xml | 1 + tests/domaincapsdata/libxl-xenfv.xml | 1 + tests/domaincapsdata/libxl-xenpv.xml | 1 + .../domaincapsdata/qemu_2.11.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.11.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.11.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.11.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.12.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.12.0-tcg.x86_64.xml | 1 + .../qemu_2.12.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.12.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.12.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_2.12.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.12.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.4.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.4.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.4.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.5.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.5.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.5.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.6.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.6.0-tcg.x86_64.xml | 1 + .../qemu_2.6.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.6.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.6.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_2.6.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.7.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.7.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.7.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.7.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.8.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.8.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.8.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.8.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.9.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.9.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.9.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_2.9.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.9.0.x86_64.xml | 1 + .../domaincapsdata/qemu_3.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_3.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_3.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_3.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_3.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_3.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_3.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_3.1.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_3.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_4.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_4.0.0-tcg.x86_64.xml | 1 + .../qemu_4.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_4.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_4.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_4.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_4.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_4.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_4.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_4.2.0-tcg.x86_64.xml | 1 + .../qemu_4.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_4.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.0.0-tcg.x86_64.xml | 1 + .../qemu_5.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_5.1.0.sparc.xml | 1 + tests/domaincapsdata/qemu_5.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.2.0-tcg.x86_64.xml | 1 + .../qemu_5.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_5.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_5.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.0.0-tcg.x86_64.xml | 1 + .../qemu_6.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_6.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_6.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_6.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_6.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 4 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 4 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 4 + .../caps_6.2.0.x86_64.replies | 22 ++- .../caps_6.2.0.x86_64.xml | 5 + .../sgx-epc.x86_64-6.2.0.args | 37 +++++ tests/qemuxml2argvdata/sgx-epc.xml | 36 +++++ tests/qemuxml2argvtest.c | 2 + 126 files changed, 597 insertions(+), 12 deletions(-) create mode 100644 tests/qemuxml2argvdata/sgx-epc.x86_64-6.2.0.args create mode 100644 tests/qemuxml2argvdata/sgx-epc.xml -- 2.17.1

3 9

[libvirt PATCH 00/20] use g_auto for virCommand (Episode II: The Sequel)
by Ján Tomko 14 Dec '21

14 Dec '21

TBD: docs/ and src/util Ján Tomko (20): openvz: refactor openvzExtractVersionInfo openvz: refactor openvzLoadDomains openvz: refactor openvzGetVEID openvz: refactor openvzDomainDefineCmd openvz: refactor openvzSetInitialConfig openvz: refactor openvzSetDiskQuota openvz: refactor openvzDomainSetNetwork openvz: refactor openvzConnectListDomains openvz: refactor openvzConnectListDefinedDomains openvz: refactor openvzDomainGetBarrierLimit openvz: refactor openvzDomainSetBarrierLimit openvz: refactor openvzGetVEStatus openvz: use g_auto in openvzDomainMigratePerform3Params openvz: refactor openvzVEGetStringParam vz: utils: use g_auto for virCommand vmware: refactor vmwareUpdateVMStatus vmware: use g_auto in vmwareLoadDomains vmware: refactor vmwareExtractVersion tests: use g_auto in testCompareXMLToConfFiles tests: storagevolxml2argvtest: do not reuse cmd src/openvz/openvz_conf.c | 62 ++++------- src/openvz/openvz_driver.c | 197 +++++++++++++-------------------- src/openvz/openvz_util.c | 23 ++-- src/vmware/vmware_conf.c | 33 ++---- src/vmware/vmware_driver.c | 19 +--- src/vz/vz_utils.c | 3 +- tests/networkxml2conftest.c | 5 +- tests/storagevolxml2argvtest.c | 4 +- 8 files changed, 125 insertions(+), 221 deletions(-) -- 2.31.1

2 21

[PATCH] conf: Turn virDomainDef.kvm_features into a struct
by Michal Privoznik 14 Dec '21

14 Dec '21

In future commits we will need to store not just an array of VIR_TRISTATE_SWITCH_* but also an additional integer. Follow the example of TCG and introduce a structure where both the array an integer can live. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/conf/domain_conf.c | 20 +++++++++++++------- src/conf/domain_conf.h | 7 ++++++- src/qemu/qemu_command.c | 8 ++++---- 3 files changed, 23 insertions(+), 12 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index b6249aa76f..07cbfa24bc 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -3713,6 +3713,7 @@ void virDomainDefFree(virDomainDef *def) g_free(def->emulator); g_free(def->description); g_free(def->title); + g_free(def->kvm_features); g_free(def->hyperv_vendor_id); g_free(def->tcg_features); @@ -17532,7 +17533,9 @@ static int virDomainFeaturesKVMDefParse(virDomainDef *def, xmlNodePtr node) { - def->features[VIR_DOMAIN_FEATURE_KVM] = VIR_TRISTATE_SWITCH_ON; + g_autofree virDomainFeatureKVM *kvm = NULL; + + kvm = g_new0(virDomainFeatureKVM, 1); node = xmlFirstElementChild(node); while (node) { @@ -17551,11 +17554,14 @@ virDomainFeaturesKVMDefParse(virDomainDef *def, &value) < 0) return -1; - def->kvm_features[feature] = value; + kvm->features[feature] = value; node = xmlNextElementSibling(node); } + def->features[VIR_DOMAIN_FEATURE_KVM] = VIR_TRISTATE_SWITCH_ON; + def->kvm_features = g_steal_pointer(&kvm); + return 0; } @@ -21803,13 +21809,13 @@ virDomainDefFeaturesCheckABIStability(virDomainDef *src, case VIR_DOMAIN_KVM_DEDICATED: case VIR_DOMAIN_KVM_POLLCONTROL: case VIR_DOMAIN_KVM_PVIPI: - if (src->kvm_features[i] != dst->kvm_features[i]) { + if (src->kvm_features->features[i] != dst->kvm_features->features[i]) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("State of KVM feature '%s' differs: " "source: '%s', destination: '%s'"), virDomainKVMTypeToString(i), - virTristateSwitchTypeToString(src->kvm_features[i]), - virTristateSwitchTypeToString(dst->kvm_features[i])); + virTristateSwitchTypeToString(src->kvm_features->features[i]), + virTristateSwitchTypeToString(dst->kvm_features->features[i])); return false; } @@ -27873,11 +27879,11 @@ virDomainDefFormatFeatures(virBuffer *buf, case VIR_DOMAIN_KVM_DEDICATED: case VIR_DOMAIN_KVM_POLLCONTROL: case VIR_DOMAIN_KVM_PVIPI: - if (def->kvm_features[j]) + if (def->kvm_features->features[j]) virBufferAsprintf(&childBuf, "<%s state='%s'/>\n", virDomainKVMTypeToString(j), virTristateSwitchTypeToString( - def->kvm_features[j])); + def->kvm_features->features[j])); break; case VIR_DOMAIN_KVM_LAST: diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index b410922f68..5613d621bb 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -2263,6 +2263,11 @@ typedef enum { VIR_ENUM_DECL(virDomainIBS); +typedef struct _virDomainFeatureKVM virDomainFeatureKVM; +struct _virDomainFeatureKVM { + int features[VIR_DOMAIN_KVM_LAST]; +}; + typedef struct _virDomainFeatureTCG virDomainFeatureTCG; struct _virDomainFeatureTCG { unsigned long long tb_cache; /* Stored in KiB */ @@ -2819,7 +2824,7 @@ struct _virDomainDef { int features[VIR_DOMAIN_FEATURE_LAST]; int caps_features[VIR_DOMAIN_PROCES_CAPS_FEATURE_LAST]; int hyperv_features[VIR_DOMAIN_HYPERV_LAST]; - int kvm_features[VIR_DOMAIN_KVM_LAST]; + virDomainFeatureKVM *kvm_features; int msrs_features[VIR_DOMAIN_MSRS_LAST]; int xen_features[VIR_DOMAIN_XEN_LAST]; virDomainXenPassthroughMode xen_passthrough_mode; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index ce22372749..7cdec9f910 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -6765,22 +6765,22 @@ qemuBuildCpuCommandLine(virCommand *cmd, for (i = 0; i < VIR_DOMAIN_KVM_LAST; i++) { switch ((virDomainKVM) i) { case VIR_DOMAIN_KVM_HIDDEN: - if (def->kvm_features[i] == VIR_TRISTATE_SWITCH_ON) + if (def->kvm_features->features[i] == VIR_TRISTATE_SWITCH_ON) virBufferAddLit(&buf, ",kvm=off"); break; case VIR_DOMAIN_KVM_DEDICATED: - if (def->kvm_features[i] == VIR_TRISTATE_SWITCH_ON) + if (def->kvm_features->features[i] == VIR_TRISTATE_SWITCH_ON) virBufferAddLit(&buf, ",kvm-hint-dedicated=on"); break; case VIR_DOMAIN_KVM_POLLCONTROL: - if (def->kvm_features[i] == VIR_TRISTATE_SWITCH_ON) + if (def->kvm_features->features[i] == VIR_TRISTATE_SWITCH_ON) virBufferAddLit(&buf, ",kvm-poll-control=on"); break; case VIR_DOMAIN_KVM_PVIPI: - if (def->kvm_features[i] == VIR_TRISTATE_SWITCH_OFF) + if (def->kvm_features->features[i] == VIR_TRISTATE_SWITCH_OFF) virBufferAddLit(&buf, ",kvm-pv-ipi=off"); break; -- 2.32.0

2 1

[libvirt PATCH] examples: hellolibvirt: fix argc check
by Ján Tomko 14 Dec '21

14 Dec '21

https://gitlab.com/libvirt/libvirt/-/issues/255 Reported-by: Jeremy Alcim Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- Pushed as trivial. examples/c/misc/hellolibvirt.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/examples/c/misc/hellolibvirt.c b/examples/c/misc/hellolibvirt.c index a598e01be2..39cefe934c 100644 --- a/examples/c/misc/hellolibvirt.c +++ b/examples/c/misc/hellolibvirt.c @@ -107,11 +107,12 @@ main(int argc, char *argv[]) { int ret = 0; virConnectPtr conn; - char *uri; + char *uri = NULL; printf("Attempting to connect to hypervisor\n"); - uri = (argc > 0 ? argv[1] : NULL); + if (argc > 1) + uri = argv[1]; /* virConnectOpenAuth is called here with all default parameters, * except, possibly, the URI of the hypervisor. */ -- 2.31.1

1 0

[PATCH v3 0/4] Introduce TCG domain features
by Michal Privoznik 13 Dec '21

13 Dec '21

v3 of: https://listman.redhat.com/archives/libvir-list/2021-November/msg00194.html Note, patches 1/4 and 2/4 from v2 were pushed already. diff to v2: - Split feature validation into a separate patch - Validate that the size is a multiple of MiB, because that's QEMU's granularity - Remembered to write NEWS entry - Worked in Peter's comments from v2 (mostly to make code more future proof) Michal Prívozník (4): conf: Introduce TCG domain features qemu: Validate TCG feature is enabled only for TCG domains qemu: Generate command line for tb-cache feature NEWS: Document TCG features NEWS.rst | 5 ++ docs/formatdomain.rst | 11 ++++ docs/schemas/domaincommon.rng | 15 ++++- src/conf/domain_conf.c | 58 ++++++++++++++++++- src/conf/domain_conf.h | 7 +++ src/qemu/qemu_command.c | 5 ++ src/qemu/qemu_validate.c | 17 ++++++ ...efault-cpu-tcg-features.x86_64-latest.args | 36 ++++++++++++ .../x86_64-default-cpu-tcg-features.xml | 56 ++++++++++++++++++ tests/qemuxml2argvtest.c | 1 + ...default-cpu-tcg-features.x86_64-latest.xml | 1 + tests/qemuxml2xmltest.c | 1 + 12 files changed, 210 insertions(+), 3 deletions(-) create mode 100644 tests/qemuxml2argvdata/x86_64-default-cpu-tcg-features.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/x86_64-default-cpu-tcg-features.xml create mode 120000 tests/qemuxml2xmloutdata/x86_64-default-cpu-tcg-features.x86_64-latest.xml -- 2.32.0

2 7

[libvirt PATCH 00/14] use g_auto for virCommand (Episode I: The End)
by Ján Tomko 13 Dec '21

13 Dec '21

A partial cleanup. The rest is in progress (TM) Ján Tomko (14): bhyve: refactor virBhyveProbeGrubCaps bhyve: refactor bhyveProbeCapsDeviceHelper bhyve: refactor bhyveProbeCapsFromHelp bhyve: refactor bhyveConnectDomainXMLToNative bhyve: use g_auto in virBhyveProcessStartImpl bhyve: use g_auto in virBhyveProcessStop bhyve: refactor virBhyveProcessBuildBhyveCmd lxc: use g_auto in lxcContainerChild lxc: refactor virLXCProcessBuildControllerCmd lxc: use g_auto for virCommand in virLXCProcessEnsureRootFS storage: logical: use two cmd vars in GetPoolSources storage: util: steal cmd in CreateQemuImgCmdFromVol security: apparmor: use automatic cleanup in load_profile qemu: use automatic cleanup for virCommand src/bhyve/bhyve_capabilities.c | 57 ++++++++++----------------- src/bhyve/bhyve_command.c | 36 ++++++++--------- src/bhyve/bhyve_driver.c | 28 ++++++------- src/bhyve/bhyve_process.c | 25 ++++-------- src/lxc/lxc_container.c | 3 +- src/lxc/lxc_process.c | 14 ++----- src/qemu/qemu_driver.c | 3 +- src/qemu/qemu_interface.c | 3 +- src/qemu/qemu_tpm.c | 4 +- src/security/security_apparmor.c | 15 ++----- src/storage/storage_backend_logical.c | 18 ++++----- src/storage/storage_util.c | 5 +-- 12 files changed, 78 insertions(+), 133 deletions(-) -- 2.31.1

2 15

[PATCH 0/3] split daemon: Support sparse streams
by Michal Privoznik 13 Dec '21

13 Dec '21

See 3/3 for explanation. Michal Prívozník (3): virStreamInData: Allow callback to not rewind the stream rpc: Introduce virNetClientStreamInData() remote_driver: Implement virStreamInData() callback src/libvirt-stream.c | 9 ++++- src/libvirt_remote.syms | 1 + src/remote/remote_daemon_stream.c | 8 ++-- src/remote/remote_driver.c | 26 +++++++++++++ src/rpc/virnetclientstream.c | 61 +++++++++++++++++++++++++++++++ src/rpc/virnetclientstream.h | 4 ++ 6 files changed, 105 insertions(+), 4 deletions(-) -- 2.32.0

3 11

[libvirt PATCH 0/8] Use g_auto for virCaps and LXCDriverConfig (glib chronicles)
by Ján Tomko 13 Dec '21

13 Dec '21

Pipeline in progress: https://gitlab.com/janotomko/libvirt/-/pipelines/427100328 Ján Tomko (8): lxc: fix error value of lxcNodeGetSecurityModel Use g_auto for freeing virCaps Use g_auto for stealing virCaps lxc: define cleanup function for virLXCDriverConfig lxc: use g_auto for virLXCDriverGetConfig lxc: remove cleanup from lxcNodeGetSecurityModel bhyve: bhyveConnectCompareCPU: remove cleanup label Remove empty cleanup sections src/bhyve/bhyve_driver.c | 46 ++++++---------- src/ch/ch_conf.c | 14 ++--- src/ch/ch_driver.c | 3 +- src/hyperv/hyperv_driver.c | 10 ++-- src/libxl/libxl_capabilities.c | 14 ++--- src/libxl/libxl_conf.c | 11 ++-- src/libxl/xen_common.c | 8 +-- src/libxl/xen_xl.c | 32 ++++------- src/lxc/lxc_conf.c | 18 +++---- src/lxc/lxc_conf.h | 2 + src/lxc/lxc_container.c | 12 ++--- src/lxc/lxc_driver.c | 97 ++++++++++++---------------------- src/lxc/lxc_native.c | 41 +++++--------- src/lxc/lxc_process.c | 44 +++++---------- src/test/test_driver.c | 14 ++--- src/util/vircgroup.c | 12 ++--- src/util/virfirmware.c | 18 +++---- src/vmware/vmware_conf.c | 5 +- src/vz/vz_driver.c | 20 +++---- tests/qemucaps2xmltest.c | 14 ++--- tests/testutilsxen.c | 5 +- tests/vboxsnapshotxmltest.c | 8 +-- tests/virconftest.c | 24 ++++----- tests/virfiletest.c | 14 ++--- tests/virstringtest.c | 16 +++--- 25 files changed, 174 insertions(+), 328 deletions(-) -- 2.31.1

2 10

[libvirt PATCH] qemu: qemuBuildChardevCommand: use chrSourcePriv unconditionally
by Ján Tomko 13 Dec '21

13 Dec '21

In the QEMU driver, we allocate private source data unconditionally for every chardev and the rest of the function just assumes it's there. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- Pointed out by Coverity. src/qemu/qemu_command.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 613f7a5d2a..0017cf6ca7 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -1493,7 +1493,7 @@ qemuBuildChardevCommand(virCommand *cmd, * secinfo is added only to a TCP serial device during * qemuDomainSecretChardevPrepare. Subsequently called * functions can just check the config fields */ - if (chrSourcePriv && chrSourcePriv->secinfo) { + if (chrSourcePriv->secinfo) { if (qemuBuildObjectSecretCommandLine(cmd, chrSourcePriv->secinfo, qemuCaps) < 0) -- 2.31.1

2 1

[libvirt PATCH v2 00/12] Improve AMD SEV support
by Daniel P. Berrangé 13 Dec '21

13 Dec '21

This addresses a few issues in the AMD SEV support - Neither host or domain level SEV metadata is exposed in virsh commands - The domain launch security parameters don't expose enough info to validate the measurement - Support verified direct kernel boot - Report max SEV/SEV-ES guest counts The second point was the initial purpose of my work. Per the SEV API guide to calculate the measurement we need measurement = HMAC(0x04 || API_MAJOR || API_MINOR || BUILD || GCTX.POLICY || GCTX.LD || MNONCE; GCTX.TIK) The API_MINOR, API_MAJOR, BUILD values are things that are available from 'query-sev' QMP command and libvirt does not expose this info. This patch series adds them to virDomainGetLaunchSecurityParams alongside the measurement that we already report. So now the client can fetch this info and calculate an expected measurement to compare with the actual measurement they got. They will thus know if the guest is safe to inject secrets into, which is where Jim's recent patches come into play. Daniel P. Berrangé (12): include: add new launch security parameters qemu: report error querying launch params for inactive guest qemu: add monitor APIs for query-sev qemu: report new launch security parameters tools: add 'domlaunchsecinfo' virsh command tools: add 'nodesevinfo' virsh command conf: extend domain capabilities for max SEV guest count include: define parameters for reporting SEV guest limits qemu: report max number of SEV guests conf: add support for setting SEV kernel hashes qemu: probe for sev-guest.kernel-hashes property qemu: format sev-guest.kernel-hashes property docs/formatdomain.rst | 7 +- docs/formatdomaincaps.html.in | 6 + docs/manpages/virsh.rst | 31 +++++ docs/schemas/domaincaps.rng | 6 + docs/schemas/domaincommon.rng | 5 + include/libvirt/libvirt-domain.h | 32 +++++ include/libvirt/libvirt-host.h | 16 +++ src/conf/domain_capabilities.c | 4 + src/conf/domain_capabilities.h | 2 + src/conf/domain_conf.c | 8 ++ src/conf/domain_conf.h | 1 + src/qemu/qemu_capabilities.c | 46 ++++++++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 7 ++ src/qemu/qemu_driver.c | 59 ++++++++-- src/qemu/qemu_monitor.c | 13 +++ src/qemu/qemu_monitor.h | 9 ++ src/qemu/qemu_monitor_json.c | 46 ++++++++ src/qemu/qemu_monitor_json.h | 9 ++ src/qemu/qemu_validate.c | 8 ++ .../domaincapsdata/qemu_2.12.0-q35.x86_64.xml | 2 + .../domaincapsdata/qemu_2.12.0-tcg.x86_64.xml | 2 + tests/domaincapsdata/qemu_2.12.0.x86_64.xml | 2 + .../domaincapsdata/qemu_6.0.0-q35.x86_64.xml | 2 + .../domaincapsdata/qemu_6.0.0-tcg.x86_64.xml | 2 + tests/domaincapsdata/qemu_6.0.0.x86_64.xml | 2 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 7 +- .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 7 +- tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 7 +- .../caps_2.12.0.x86_64.replies | 97 ++++++++++++---- .../caps_3.0.0.x86_64.replies | 97 ++++++++++++---- .../caps_3.1.0.x86_64.replies | 97 ++++++++++++---- .../caps_4.0.0.x86_64.replies | 97 ++++++++++++---- .../caps_4.1.0.x86_64.replies | 89 ++++++++++---- .../caps_4.2.0.x86_64.replies | 89 ++++++++++---- .../caps_5.0.0.x86_64.replies | 89 ++++++++++---- .../caps_5.1.0.x86_64.replies | 89 ++++++++++---- .../caps_5.2.0.x86_64.replies | 89 ++++++++++---- .../caps_6.0.0.x86_64.replies | 89 ++++++++++---- .../caps_6.1.0.x86_64.replies | 89 ++++++++++---- .../caps_6.2.0.x86_64.replies | 109 ++++++++++++++---- .../caps_6.2.0.x86_64.xml | 8 ++ tests/qemumonitorjsontest.c | 43 +++++++ ...unch-security-sev-direct.x86_64-6.2.0.args | 40 +++++++ .../launch-security-sev-direct.xml | 39 +++++++ tests/qemuxml2argvtest.c | 1 + tools/virsh-domain.c | 53 +++++++++ tools/virsh-host.c | 45 ++++++++ 48 files changed, 1427 insertions(+), 271 deletions(-) create mode 100644 tests/qemuxml2argvdata/launch-security-sev-direct.x86_64-6.2.0.args create mode 100644 tests/qemuxml2argvdata/launch-security-sev-direct.xml -- 2.33.1

2 24

[PATCH] qemuProcessPrepareHost: Create domain private dirs as early as possible
by Michal Privoznik 13 Dec '21

13 Dec '21

As of ff024b60cc3 we are opening chardevs before starting QEMU. However, we also doing that before domain private directories are created. This leaves us impossible to create guest agent socket which lives under priv->channelTargetDir. While creating the dirs can be moved just before qemuProcessPrepareHostBackendChardev() it's better to do it as the very first step so that this kind of error is prevented in future. Fixes: ff024b60cc39d5d41b1e68728a00a47e103ec4dd Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_process.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 4963ce383f..82d0af5549 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -7024,6 +7024,14 @@ qemuProcessPrepareHost(virQEMUDriver *driver, qemuDomainObjPrivate *priv = vm->privateData; g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver); + /* + * Create all per-domain directories in order to make sure domain + * with any possible seclabels can access it. + */ + if (qemuProcessMakeDir(driver, vm, priv->libDir) < 0 || + qemuProcessMakeDir(driver, vm, priv->channelTargetDir) < 0) + return -1; + if (qemuPrepareNVRAM(driver, vm) < 0) return -1; @@ -7085,14 +7093,6 @@ qemuProcessPrepareHost(virQEMUDriver *driver, return -1; } - /* - * Create all per-domain directories in order to make sure domain - * with any possible seclabels can access it. - */ - if (qemuProcessMakeDir(driver, vm, priv->libDir) < 0 || - qemuProcessMakeDir(driver, vm, priv->channelTargetDir) < 0) - return -1; - VIR_DEBUG("Write domain masterKey"); if (qemuDomainWriteMasterKeyFile(driver, vm) < 0) return -1; -- 2.32.0

4 3

[libvirt PATCH] nss: Use shared_library() for nss_libvirt_lib
by Andrea Bolognani 13 Dec '21

13 Dec '21

shared_module() is intended for shared objects that are loaded at runtime using dlopen() whereas NSS plugins need to be full-fledged shared libraries with, among other things, a proper SONAME. Meson seems to have become more strict about this recently, because libnss_libvirt.so.2 gets a SONAME when I build it with Meson 0.59.4 on Fedora 34 but doesn't when I use Meson 0.60.2 on Debian testing instead. Either way, shared_library() was always the right function to use for NSS plugins. Fixes: 36780c931900555706fd6db9fc2ce2b4cabf9045 Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- tools/nss/meson.build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/nss/meson.build b/tools/nss/meson.build index 198936f3d4..f77309ebca 100644 --- a/tools/nss/meson.build +++ b/tools/nss/meson.build @@ -59,7 +59,7 @@ nss_libvirt_guest_syms = '@0@@1@'.format( meson.current_source_dir() / nss_guest_sym_file, ) -nss_libvirt_lib = shared_module( +nss_libvirt_lib = shared_library( 'nss_libvirt', name_prefix: nss_prefix, name_suffix: 'so.@0@'.format(nss_so_ver), -- 2.31.1

3 2

[PATCH 00/24] chardev handling cleanups (chardev refactors part 2)
by Peter Krempa 13 Dec '21

13 Dec '21

In this part I'm cleaning up the command line generators and unifying them. Until now there were multiple custom -chardev generators in places where it was simpler to use it than the common code. This series fixes the common code to have sane API and refactors virtiofs, vhost-user-blk vhost-user-gpu and TPM code to use it. After this series we are left with 3 distinct generators for chardev properties: - commandline - commandline for capabilties probing - QMP After the refactors here we can finally also add DO_TEST_CAPS_LATEST of chardev tests without actually touching the host as part of the testsuite which was impossible before. In further parts the generators will be put into one place and prepared for upcoming qemu refactors. Peter Krempa (24): virDomainDeviceInfoIterateFlags: Export the symbol qemu: domain: Introduce helpers for initializing chardev backend of devices qemu: Move creation and opening of chardev backend FDs to host prepare step qemu: command: Remove unused QEMU_BUILD_CHARDEV_FILE_LOGD and QEMU_BUILD_CHARDEV_UNIX_FD_PASS qemu: command: remove the unused 'chardevStdioLogd' argument/variable qemu: domain: Refactor chardev definition preparing qemu: Store chardev 'wait' flag in chardev source private data qemuBuildChrChardevStr: Remove 'cdevflags' argument qemuBuildChrChardevStr: Remove unused arguments and clean up callers qemuxml2argvtest: Add DO_TEST_CAPS_LATEST versions for all character device tests qemuxml2argvtest: Add _LATEST version for 'name-escape' case qemuBuildConsoleCommandLine: Remove identical code qemuBuildChrChardevStr: Directly generate command line qemuBuildChardevCommand: Move earlier qemuBuildChardevCommand: Don't prefix alias qemuBuildChardevCommand: Split creation of the command and setup of other objects qemu: Store TLS config options for chardevs in qemuDomainChrSourcePrivate qemuBuildChardevCommand: Remove unused 'cfg' parameter qemu: Implement chardev source setup for disk qemu: Use qemuBuildChrChardevCommand for vhost-user disk backend qemu: Use qemuBuildChrChardevCommand for virtiofs backend chardev qemu: Use qemuBuildChrChardevCommand for vhost-user-gpu backend chardev qemu: Implement chardev source setup for tpm qemu: command: Use 'qemuBuildChrChardevCommand' to build TPM backend src/libvirt_private.syms | 1 + src/qemu/qemu_block.c | 1 - src/qemu/qemu_block.h | 1 - src/qemu/qemu_command.c | 1095 +++++++---------- src/qemu/qemu_command.h | 2 - src/qemu/qemu_domain.c | 258 +++- src/qemu/qemu_domain.h | 38 +- src/qemu/qemu_driver.c | 8 + src/qemu/qemu_hotplug.c | 3 - src/qemu/qemu_process.c | 264 +++- .../aarch64-tpm.aarch64-latest.args | 2 +- .../console-compat-auto.x86_64-latest.args | 39 + .../console-compat-chardev.x86_64-latest.args | 39 + .../console-compat.x86_64-latest.args | 38 + .../name-escape.x86_64-latest.args | 51 + ...arallel-parport-chardev.x86_64-latest.args | 39 + .../parallel-tcp-chardev.x86_64-latest.args | 39 + .../pci-serial-dev-chardev.x86_64-latest.args | 39 + .../ppc64-tpmproxy-with-tpm.ppc64-latest.args | 2 +- ...rial-dev-chardev-iobase.x86_64-latest.args | 39 + .../serial-dev-chardev.x86_64-latest.args | 39 + .../serial-file-chardev.x86_64-latest.args | 40 + .../serial-file-log.x86_64-latest.args | 40 + .../serial-many-chardev.x86_64-latest.args | 42 + .../serial-pty-chardev.x86_64-latest.args | 39 + ...erial-spiceport-nospice.x86_64-latest.args | 37 + .../serial-spiceport.x86_64-latest.args | 41 + .../serial-tcp-chardev.x86_64-latest.args | 39 + ...rial-tcp-telnet-chardev.x86_64-latest.args | 39 + ...p-tlsx509-chardev-notls.x86_64-latest.args | 41 + ...-tlsx509-chardev-verify.x86_64-latest.args | 42 + ...ial-tcp-tlsx509-chardev.x86_64-latest.args | 42 + ...-tlsx509-secret-chardev.x86_64-latest.args | 43 + .../serial-udp-chardev.x86_64-latest.args | 41 + ...rial-unix-missing-source.x86_64-latest.err | 1 + .../serial-vc-chardev.x86_64-latest.args | 39 + .../tpm-emulator-spapr.ppc64-latest.args | 2 +- .../tpm-emulator-tpm2-enc.x86_64-latest.args | 2 +- ...pm-emulator-tpm2-pstate.x86_64-latest.args | 2 +- .../tpm-emulator-tpm2.x86_64-latest.args | 2 +- .../tpm-emulator.x86_64-latest.args | 2 +- ...host-user-gpu-secondary.x86_64-latest.args | 2 +- ...irtio-options-video-ats.x86_64-latest.args | 2 +- ...tio-options-video-iommu.x86_64-latest.args | 2 +- ...io-options-video-packed.x86_64-latest.args | 2 +- tests/qemuxml2argvtest.c | 114 ++ 46 files changed, 1959 insertions(+), 776 deletions(-) create mode 100644 tests/qemuxml2argvdata/console-compat-auto.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/console-compat-chardev.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/console-compat.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/name-escape.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/parallel-parport-chardev.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/parallel-tcp-chardev.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/pci-serial-dev-chardev.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/serial-dev-chardev-iobase.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/serial-dev-chardev.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/serial-file-chardev.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/serial-file-log.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/serial-many-chardev.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/serial-pty-chardev.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/serial-spiceport-nospice.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/serial-spiceport.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/serial-tcp-chardev.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/serial-tcp-telnet-chardev.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/serial-tcp-tlsx509-chardev-notls.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/serial-tcp-tlsx509-chardev-verify.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/serial-tcp-tlsx509-chardev.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/serial-tcp-tlsx509-secret-chardev.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/serial-udp-chardev.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/serial-unix-missing-source.x86_64-latest.err create mode 100644 tests/qemuxml2argvdata/serial-vc-chardev.x86_64-latest.args -- 2.31.1

3 29

[libvirt PATCH 00/12] Clean up cruft in firewall/iptables code (in preparation for nftables)
by Laine Stump 13 Dec '21

13 Dec '21

These patches make no functional change, they just remove a bunch of cruft that accumulated over the years and is no longer needed. This is all in advance of adding support for native nftable support, but there is nothing nftables-specific being added here; I just wanted to get these cleanups out of way now so that the eventual nftables support patchset is smaller and less complicated. (NB: the concept of a "firewall backend" is being removed here, implying that it will no longer exist. This is not true, but the way that it will exist in the future will be different (per-firewall object rather than per-process) so almost all of the existing code won't be applicable anyway.) Laine Stump (12): network: eliminate code that uses default iptables chains util: rename/move iptablesFormatNetwork to virSocketAddrFormatWithPrefix util: rename iptables operators to something less generic tests: remove firewalld backend tests from virfirewalltest.c tests: remove unnecessary ret variables and cleanup labels tests: document why virgdbus must be mocked in networkxml2firewalltest.c util: eliminate pointless switch in virFirewallApplyRule util: simplify virFirewallBackendSynchronize() util: move and rename virFirewallBackendSynchronize() util: remove check for iptables binary during virFirewallInit util: remove currentBackend from virfirewall.c util: remove virFirewallOnceInit() src/libvirt_private.syms | 5 +- src/network/bridge_driver_linux.c | 37 +-- src/util/virfirewall.c | 143 +---------- src/util/virfirewall.h | 2 - src/util/virfirewalld.c | 43 ++++ src/util/virfirewalld.h | 2 + src/util/virfirewallpriv.h | 37 --- src/util/viriptables.c | 207 +++++++--------- src/util/viriptables.h | 2 - src/util/virsocketaddr.c | 44 ++++ src/util/virsocketaddr.h | 3 + tests/networkxml2firewalltest.c | 14 +- tests/nwfilterebiptablestest.c | 7 - tests/nwfilterxml2firewalltest.c | 8 +- tests/virfirewalltest.c | 390 ++++-------------------------- 15 files changed, 247 insertions(+), 697 deletions(-) delete mode 100644 src/util/virfirewallpriv.h -- 2.33.1

2 13

[PATCH] Fixes: #253
by JorhsonDeng 13 Dec '21

13 Dec '21

To resolve the bug: #253. The restore method should call the qemuProcessRefreshState method to refreash the state of the devices. --- src/qemu/qemu_process.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 6b83a571b9..ebd60a7b84 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -7703,14 +7703,11 @@ qemuProcessStart(virConnectPtr conn, if (incoming->deferredURI && qemuMigrationDstRun(driver, vm, incoming->deferredURI, asyncJob) < 0) goto stop; - } else { - /* Refresh state of devices from QEMU. During migration this happens - * in qemuMigrationDstFinish to ensure that state information is fully - * transferred. */ - if (qemuProcessRefreshState(driver, vm, asyncJob) < 0) - goto stop; } + if (qemuProcessRefreshState(driver, vm, asyncJob) < 0) + goto stop; + if (qemuProcessFinishStartup(driver, vm, asyncJob, !(flags & VIR_QEMU_PROCESS_START_PAUSED), incoming ? -- 2.27.0

3 2

[libvirt PATCH 0/6] Improve usage information and manual pages
by Andrea Bolognani 10 Dec '21

10 Dec '21

Each of the tools we ship as part of libvirt should display reasonable usage information when called without arguments and have an associated manual page. Andrea Bolognani (6): virt-ssh-helper: Don't use optind virt-ssh-helper: Improve usage information virt-ssh-helper: Add manual page virt-qemu-run: Improve usage information virt-qemu-run: Improve manual page virt-pki-query-dn: Add manual page docs/manpages/meson.build | 2 + docs/manpages/virt-pki-query-dn.rst | 91 +++++++++++++++++++++++++++ docs/manpages/virt-qemu-run.rst | 53 +++++++++------- docs/manpages/virt-ssh-helper.rst | 96 +++++++++++++++++++++++++++++ libvirt.spec.in | 2 + src/qemu/qemu_shim.c | 2 +- src/remote/remote_ssh_helper.c | 18 +++--- 7 files changed, 234 insertions(+), 30 deletions(-) create mode 100644 docs/manpages/virt-pki-query-dn.rst create mode 100644 docs/manpages/virt-ssh-helper.rst -- 2.31.1

2 15