- Devel - libvirt List Archives

[libvirt PATCH] tests: Fix typos
by Tim Wiederhake 25 Aug '21

25 Aug '21

Signed-off-by: Tim Wiederhake <twiederh(a)redhat.com> --- tests/qemuxml2argvtest.c | 2 +- tests/testutilsqemu.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 0cc4e8a73b..aa2afd878b 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -2093,7 +2093,7 @@ mymain(void) DO_TEST_CAPS_VER("cpu-host-model", "6.0.0"); DO_TEST_CAPS_VER("cpu-host-model", "6.1.0"); - /* For this specific test we accept the increased likelyhood of changes + /* For this specific test we accept the increased likelihood of changes * if qemu updates the CPU model */ DO_TEST_CAPS_LATEST("cpu-host-model"); diff --git a/tests/testutilsqemu.c b/tests/testutilsqemu.c index ea9a283297..164d601613 100644 --- a/tests/testutilsqemu.c +++ b/tests/testutilsqemu.c @@ -750,7 +750,7 @@ testQemuInfoInitArgs(struct testQemuInfo *info) info->args.newargs = false; if (info->args.invalidarg) { - fprintf(stderr, "Invalid agument encountered by 'testQemuInfoSetArgs'\n"); + fprintf(stderr, "Invalid argument encountered by 'testQemuInfoSetArgs'\n"); return -1; } -- 2.31.1

2 1

[PATCH 0/4] Appease Clang
by Michal Privoznik 25 Aug '21

25 Aug '21

With its recent update Clang-13.0.1-rc1 started to report spurious warnings. Basically it is concerned about our use of g_auto*: g_autofree char *var = NULL; var = func(); It fails to see that @var is there to automatically free retval of func(). I've reported the bug here: https://bugs.llvm.org/show_bug.cgi?id=36627 But there are few places where we can change the code and appease Clang. The rest, where our code is correct - I'm "fixing" those places in patch 4/4 which exists only to show that after the problematic pattern is broken the build passes again: https://gitlab.com/MichalPrivoznik/libvirt/-/jobs/1532513684 Michal Prívozník (4): virpci: Avoid Clang false positive test: Drop unused @cfg from qemu*test virscsi: Drop @tmp from virSCSIDeviceListDel DO NOT MERGE src/rpc/virnetclient.c | 9 ++++++--- src/util/viridentity.c | 3 ++- src/util/virpci.c | 4 ++-- src/util/virscsi.c | 3 +-- tests/qemumigrationcookiexmltest.c | 2 -- tests/qemustatusxml2xmltest.c | 2 -- 6 files changed, 11 insertions(+), 12 deletions(-) -- 2.31.1

2 7

[PATCH] qemu: snapshot: Translate 'volume' disks before attempting offline snapshot manipulation
by Peter Krempa 25 Aug '21

25 Aug '21

When the VM is inactive the 'virStorageSource' struct doesn't have the necessary data pointing to the actual storage. This is a problem for inactive snapshot operations on VMs which use disk type='volume'. Add the translation steps for reversion and deletion of snapshots. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1977155 Resolves: https://gitlab.com/libvirt/libvirt/-/issues/202 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_domain.c | 6 ++++++ src/qemu/qemu_snapshot.c | 7 +++++++ 2 files changed, 13 insertions(+) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 50a921c80d..962343cb2d 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -7088,6 +7088,7 @@ qemuDomainSnapshotDiscard(virQEMUDriver *driver, if (!metadata_only) { if (!virDomainObjIsActive(vm)) { + size_t i; /* Ignore any skipped disks */ /* Prefer action on the disks in use at the time the snapshot was @@ -7098,6 +7099,11 @@ qemuDomainSnapshotDiscard(virQEMUDriver *driver, if (!def) def = vm->def; + for (i = 0; i < def->ndisks; i++) { + if (virDomainDiskTranslateSourcePool(def->disks[i]) < 0) + return -1; + } + if (qemuDomainSnapshotForEachQcow2(driver, def, snap, "-d", true) < 0) return -1; } else { diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c index 4e74ddd7f8..fa1f9ce973 100644 --- a/src/qemu/qemu_snapshot.c +++ b/src/qemu/qemu_snapshot.c @@ -1813,6 +1813,8 @@ qemuSnapshotRevertInactive(virQEMUDriver *driver, virDomainObj *vm, virDomainMomentObj *snap) { + size_t i; + /* Prefer action on the disks in use at the time the snapshot was * created; but fall back to current definition if dealing with a * snapshot created prior to libvirt 0.9.5. */ @@ -1821,6 +1823,11 @@ qemuSnapshotRevertInactive(virQEMUDriver *driver, if (!def) def = vm->def; + for (i = 0; i < def->ndisks; i++) { + if (virDomainDiskTranslateSourcePool(def->disks[i]) < 0) + return -1; + } + /* Try all disks, but report failure if we skipped any. */ if (qemuDomainSnapshotForEachQcow2(driver, def, snap, "-a", true) != 0) return -1; -- 2.31.1

2 1

[PATCH 1/5] conf: Introduce SGX EPC element into device memory xml
by Haibin Huang 25 Aug '21

25 Aug '21

From: Lin Yang <lin.a.yang(a)intel.com> <devices> ... <memory model='sgx-epc'> <target> <size unit='KiB'>512</size> </target> </memory> ... </devices> --- docs/schemas/domaincommon.rng | 1 + src/conf/domain_conf.c | 5 +++++ src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 1 + src/qemu/qemu_alias.c | 3 +++ src/qemu/qemu_command.c | 1 + src/qemu/qemu_domain.c | 1 + src/qemu/qemu_domain_address.c | 4 ++++ src/qemu/qemu_process.c | 2 ++ src/qemu/qemu_validate.c | 8 ++++++++ src/security/security_apparmor.c | 1 + src/security/security_dac.c | 2 ++ src/security/security_selinux.c | 2 ++ 13 files changed, 32 insertions(+) diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index 11fa24f398..a03cb4b388 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -6595,6 +6595,7 @@ <value>dimm</value> <value>nvdimm</value> <value>virtio-pmem</value> + <value>sgx-epc</value> </choice> </attribute> <optional> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 10effdce69..6b0c847037 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -1392,6 +1392,7 @@ VIR_ENUM_IMPL(virDomainMemoryModel, "dimm", "nvdimm", "virtio-pmem", + "sgx-epc", ); VIR_ENUM_IMPL(virDomainShmemModel, @@ -5494,6 +5495,7 @@ virDomainMemoryDefPostParse(virDomainMemoryDef *mem, break; case VIR_DOMAIN_MEMORY_MODEL_DIMM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; @@ -14682,6 +14684,7 @@ virDomainMemorySourceDefParseXML(xmlNodePtr node, def->nvdimmPath = virXPathString("string(./path)", ctxt); break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; @@ -16513,6 +16516,7 @@ virDomainMemoryFindByDefInternal(virDomainDef *def, continue; break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; @@ -25806,6 +25810,7 @@ virDomainMemorySourceDefFormat(virBuffer *buf, virBufferEscapeString(&childBuf, "<path>%s</path>\n", def->nvdimmPath); break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index c7e6df7981..095e80cf18 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -2472,6 +2472,7 @@ typedef enum { VIR_DOMAIN_MEMORY_MODEL_DIMM, /* dimm hotpluggable memory device */ VIR_DOMAIN_MEMORY_MODEL_NVDIMM, /* nvdimm memory device */ VIR_DOMAIN_MEMORY_MODEL_VIRTIO_PMEM, /* virtio-pmem memory device */ + VIR_DOMAIN_MEMORY_MODEL_SGX_EPC, /* SGX enclave page cache */ VIR_DOMAIN_MEMORY_MODEL_LAST } virDomainMemoryModel; diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c index 60f7ccdddd..ab0be2649f 100644 --- a/src/conf/domain_validate.c +++ b/src/conf/domain_validate.c @@ -1977,6 +1977,7 @@ virDomainMemoryDefValidate(const virDomainMemoryDef *mem, } case VIR_DOMAIN_MEMORY_MODEL_DIMM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: break; case VIR_DOMAIN_MEMORY_MODEL_NONE: diff --git a/src/qemu/qemu_alias.c b/src/qemu/qemu_alias.c index ed47fa335a..5990fc5f87 100644 --- a/src/qemu/qemu_alias.c +++ b/src/qemu/qemu_alias.c @@ -522,6 +522,9 @@ qemuAssignDeviceMemoryAlias(virDomainDef *def, case VIR_DOMAIN_MEMORY_MODEL_VIRTIO_PMEM: prefix = "virtiopmem"; break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: + prefix = "epc"; + break; case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: default: diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 2756f46b51..24572d03d7 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -3317,6 +3317,7 @@ qemuBuildMemoryDeviceStr(const virDomainDef *def, device = "virtio-pmem-pci"; break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: default: diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 9baa4b5d90..8e151d1fd5 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -9042,6 +9042,7 @@ qemuDomainDefValidateMemoryHotplugDevice(const virDomainMemoryDef *mem, needsNuma = false; break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: return -1; diff --git a/src/qemu/qemu_domain_address.c b/src/qemu/qemu_domain_address.c index 392368bd38..c8d93f5413 100644 --- a/src/qemu/qemu_domain_address.c +++ b/src/qemu/qemu_domain_address.c @@ -1015,6 +1015,7 @@ qemuDomainDeviceCalculatePCIConnectFlags(virDomainDeviceDef *dev, case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_DIMM: case VIR_DOMAIN_MEMORY_MODEL_NVDIMM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_LAST: return 0; } @@ -3037,6 +3038,7 @@ qemuDomainAssignMemoryDeviceSlot(virQEMUDriver *driver, return qemuDomainEnsurePCIAddress(vm, &dev, driver); break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; @@ -3062,6 +3064,7 @@ qemuDomainReleaseMemoryDeviceSlot(virDomainObj *vm, qemuDomainReleaseDeviceAddress(vm, &mem->info); break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; @@ -3095,6 +3098,7 @@ qemuDomainAssignMemorySlots(virDomainDef *def) case VIR_DOMAIN_MEMORY_MODEL_VIRTIO_PMEM: /* handled in qemuDomainAssignPCIAddresses() */ break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 77da9992f4..d2cccfc586 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -3802,6 +3802,7 @@ qemuProcessDomainMemoryDefNeedHugepagesPath(const virDomainMemoryDef *mem, case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_NVDIMM: case VIR_DOMAIN_MEMORY_MODEL_VIRTIO_PMEM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_LAST: /* None of these can be backed by hugepages. */ return false; @@ -3875,6 +3876,7 @@ qemuProcessNeedMemoryBackingPath(virDomainDef *def, case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_NVDIMM: case VIR_DOMAIN_MEMORY_MODEL_VIRTIO_PMEM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_LAST: /* Backed by user provided path. Not stored in memory * backing dir anyway. */ diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c index e5c4e3af26..545af727f7 100644 --- a/src/qemu/qemu_validate.c +++ b/src/qemu/qemu_validate.c @@ -4929,6 +4929,14 @@ qemuValidateDomainDeviceDefMemory(virDomainMemoryDef *mem, } break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: + if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_SGX_EPC)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("sgx epc isn't supported by this QEMU binary")); + return -1; + } + break; + case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index 84363015dc..46fbadb97a 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -693,6 +693,7 @@ AppArmorSetMemoryLabel(virSecurityManager *mgr, return reload_profile(mgr, def, mem->nvdimmPath, true); case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_DIMM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; } diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 04b9ecf028..64b6fabb7d 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -1849,6 +1849,7 @@ virSecurityDACRestoreMemoryLabel(virSecurityManager *mgr, break; case VIR_DOMAIN_MEMORY_MODEL_DIMM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_LAST: case VIR_DOMAIN_MEMORY_MODEL_NONE: ret = 0; @@ -2033,6 +2034,7 @@ virSecurityDACSetMemoryLabel(virSecurityManager *mgr, break; case VIR_DOMAIN_MEMORY_MODEL_DIMM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_LAST: case VIR_DOMAIN_MEMORY_MODEL_NONE: ret = 0; diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 0e5ea0366d..0034ad4495 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -1582,6 +1582,7 @@ virSecuritySELinuxSetMemoryLabel(virSecurityManager *mgr, case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_DIMM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; } @@ -1609,6 +1610,7 @@ virSecuritySELinuxRestoreMemoryLabel(virSecurityManager *mgr, break; case VIR_DOMAIN_MEMORY_MODEL_DIMM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: ret = 0; -- 2.17.1

1 4

[PATCH 0/4] storage pool define: add support for validation against schema
by Kristina Hanicova 25 Aug '21

25 Aug '21

Kristina Hanicova (4): api: add virStoragePoolDefineFlags storage_conf: add validation against schema in pool define storage_driver & test_driver: allow VIR_STORAGE_POOL_DEFINE_VALIDATE flag virsh: add support for '--validate' option in define storage pool docs/manpages/virsh.rst | 4 +++- include/libvirt/libvirt-storage.h | 4 ++++ src/conf/domain_conf.c | 2 +- src/conf/storage_conf.c | 13 ++++++++----- src/conf/storage_conf.h | 3 ++- src/libvirt-storage.c | 2 +- src/storage/storage_driver.c | 6 +++--- src/test/test_driver.c | 6 +++--- tools/virsh-pool.c | 11 +++++++++-- 9 files changed, 34 insertions(+), 17 deletions(-) -- 2.31.1

2 5

[PATCH] lxcxml2xmltest: Substitute 'inactive' variable with 'active'
by Kristina Hanicova 25 Aug '21

25 Aug '21

I removed negation from the name of a variable to make the code more readable. Signed-off-by: Kristina Hanicova <khanicov(a)redhat.com> --- tests/lxcxml2xmltest.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/tests/lxcxml2xmltest.c b/tests/lxcxml2xmltest.c index 00341ad695..69c333b9b5 100644 --- a/tests/lxcxml2xmltest.c +++ b/tests/lxcxml2xmltest.c @@ -21,7 +21,7 @@ static virLXCDriver *driver; struct testInfo { const char *name; int different; - bool inactive_only; + bool active_only; unsigned int parse_flags; }; @@ -40,7 +40,7 @@ testCompareXMLToXMLHelper(const void *data) ret = testCompareDomXML2XMLFiles(driver->caps, driver->xmlopt, xml_in, info->different ? xml_out : xml_in, - !info->inactive_only, + info->active_only, info->parse_flags, TEST_COMPARE_DOM_XML2XML_RESULT_SUCCESS); VIR_FREE(xml_in); @@ -57,9 +57,9 @@ mymain(void) if (!(driver = testLXCDriverInit())) return EXIT_FAILURE; -# define DO_TEST_FULL(name, is_different, inactive, parse_flags) \ +# define DO_TEST_FULL(name, is_different, active, parse_flags) \ do { \ - const struct testInfo info = {name, is_different, inactive, \ + const struct testInfo info = {name, is_different, active, \ parse_flags}; \ if (virTestRun("LXC XML-2-XML " name, \ testCompareXMLToXMLHelper, &info) < 0) \ @@ -67,10 +67,10 @@ mymain(void) } while (0) # define DO_TEST(name) \ - DO_TEST_FULL(name, 0, false, 0) + DO_TEST_FULL(name, 0, true, 0) # define DO_TEST_DIFFERENT(name) \ - DO_TEST_FULL(name, 1, false, 0) + DO_TEST_FULL(name, 1, true, 0) /* Unset or set all envvars here that are copied in lxcdBuildCommandLine * using ADD_ENV_COPY, otherwise these tests may fail due to unexpected -- 2.31.1

2 2

[libvirt PATCH 0/6] qemu: capabilities: use g_auto (glib chronicles)
by Ján Tomko 24 Aug '21

24 Aug '21

This is not a cover letter. Ján Tomko (6): qemu: refactor virQEMUCapsNewForBinaryInternal qemu: refactor virQEMUCapsLoadFile qemu: refactor virQEMUCapsInit qemu: refactor virQEMUCapsNewCopy qemu: capabilities: use g_auto qemu: capabilities: remove pointless labels src/qemu/qemu_capabilities.c | 134 ++++++++++++----------------------- 1 file changed, 45 insertions(+), 89 deletions(-) -- 2.31.1

4 10

[PATCHv2 0/2] Support VM core dump to block device
by Simon Rowe 24 Aug '21

24 Aug '21

When the destination of a VM core dump is a block device (e.g. NBD) avoid file operations that are unnecessary. Simon Rowe (2): iohelper: skip lseek() and ftruncate() on block devices qemu: check unlink hint from virQEMUFileOpenAs() src/qemu/qemu_driver.c | 8 +++----- src/util/iohelper.c | 10 ++++++++-- 2 files changed, 11 insertions(+), 7 deletions(-) -- 2.22.3

2 6

[libvirt PATCH 0/1] Add a PCI/PCIe device VPD Capability
by Dmitrii Shcherbakov 24 Aug '21

24 Aug '21

Add support for deserializing the binary PCI/PCIe VPD format and exposing VPD resources as XML elements in a new nested capability of PCI/PCIe devices called 'vpd'. The VPD format is specified in "I.3. VPD Definitions" in PCI specs (2.2+) and "6.28.1 VPD Format" PCIe 4.0. As section 6.28 in PCIe 4.0 notes, the PCI Local Bus and PCIe VPD formats are binary compatible and PCIe 4.0 merely started incorporating what was already present in PCI specs. Linux kernel exposes a binary blob in the VPD format via sysfs since v2.6.26 (commit 94e6108803469a37ee1e3c92dafdd1d59298602f) which requires a parser to interpret. There are usage scenarios where information such as the board serial number needs to be retrieved from PCI(e) VPD. Projects like Nova can utilize this information for cases which involve virtual interface plugging on SmartNIC DPUs but there may be other scenarios and types of information useful to retrieve from VPD. The fact that the format is binary requires proper parsing instead of substring searching hence the full parser is proposed. Likewise, checksum validation requires proper parsing as well. The patch follows a prior discussion on the mailing list which has additional context about the use-case but a narrower proposal: https://listman.redhat.com/archives/libvir-list/2021-May/msg00873.html https://www.mail-archive.com/libvir-list@redhat.com/msg218165.html The new functionality is mostly contained in virpcivpd with a couple of new functions added to virpci. Additionally, the necessary XML serialization/deserialization and glue code is added to expose the VPD capability to external clients as XML. A new capability flag is added along with a new capability in order to allow for filtering of PCI devices with the VPD capability using virsh: virsh nodedev-list --cap vpd sudo virsh nodedev-dumpxml --device pci_dddd_bb_ss_f In this example having the root uid is required in order to access the vpd sysfs entry, therefore, the nodedev XML output will only contain the VPD capability if virsh is run as root. The capability is treated as dynamic due to the presence of read-write sections in the VPD format per PCI/PCIe specs (the idea being that read-write resource fields may potentially be altered by the DPU OS over time independently from the host OS). Unit tests cover the parser functionality (including many possible invalid cases), in-memory representation as well as XML serialization and deserialization. Manual functional testing was performed with 2 DPUs and several other NIC models which expose PCI(e) VPD. Testing have also been performed for devices that do not have VPD or those that expose a VPD capability but exhibit invalid behavior (I/O errors while reading a sysfs entry). Per the existing guidelines, the implementation relies heavily on glib for various purposes. https://libvirt.org/glib-adoption.html Dmitrii Shcherbakov (1): Add a PCI/PCIe device VPD Capability build-aux/syntax-check.mk | 4 +- docs/drvnodedev.html.in | 46 ++ docs/formatnode.html.in | 24 +- docs/schemas/nodedev.rng | 40 + include/libvirt/libvirt-nodedev.h | 1 + po/POTFILES.in | 1 + src/conf/node_device_conf.c | 258 ++++++ src/conf/node_device_conf.h | 6 +- src/conf/virnodedeviceobj.c | 7 +- src/libvirt_private.syms | 17 + src/node_device/node_device_driver.c | 2 + src/node_device/node_device_udev.c | 2 + src/util/meson.build | 1 + src/util/virpci.c | 60 ++ src/util/virpci.h | 3 + src/util/virpcivpd.c | 771 +++++++++++++++++ src/util/virpcivpd.h | 106 +++ src/util/virpcivpdpriv.h | 42 + tests/meson.build | 1 + .../pci_0000_42_00_0_vpd.xml | 33 + .../pci_0000_42_00_0_vpd.xml | 1 + tests/nodedevxml2xmltest.c | 1 + tests/testutils.c | 51 ++ tests/testutils.h | 6 + tests/virpcitest.c | 3 + tests/virpcivpdtest.c | 777 ++++++++++++++++++ tools/virsh-nodedev.c | 3 + 27 files changed, 2262 insertions(+), 5 deletions(-) create mode 100644 src/util/virpcivpd.c create mode 100644 src/util/virpcivpd.h create mode 100644 src/util/virpcivpdpriv.h create mode 100644 tests/nodedevschemadata/pci_0000_42_00_0_vpd.xml create mode 120000 tests/nodedevxml2xmlout/pci_0000_42_00_0_vpd.xml create mode 100644 tests/virpcivpdtest.c -- 2.30.2

1 1

[PATCH 0/7] network define: add support for validation against schema
by Kristina Hanicova 24 Aug '21

24 Aug '21

Kristina Hanicova (7): api: add public virNetworkDefineXMLFlags() and remote protocol vbox_network: add flags to vboxNetworkDefineCreateXML() src: add driver support for networkDefineXMLFlags() api: add virNetworkDefineFlags src & network_conf: add validation against schema in define network: allow VIR_NETWORK_DEFINE_VALIDATE flag virsh: add support for '--validate' option in define network docs/manpages/virsh.rst | 4 ++- include/libvirt/libvirt-network.h | 7 ++++++ src/conf/domain_conf.c | 2 +- src/conf/network_conf.c | 15 ++++++----- src/conf/network_conf.h | 3 ++- src/driver-network.h | 6 +++++ src/esx/esx_network_driver.c | 16 ++++++++++-- src/libvirt-network.c | 41 +++++++++++++++++++++++++++++++ src/libvirt_public.syms | 1 + src/network/bridge_driver.c | 22 +++++++++++++---- src/qemu/qemu_process.c | 2 +- src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 19 +++++++++++++- src/remote_protocol-structs | 8 ++++++ src/test/test_driver.c | 20 ++++++++++++--- src/vbox/vbox_network.c | 18 +++++++++++--- tools/virsh-network.c | 13 +++++++++- 17 files changed, 171 insertions(+), 27 deletions(-) -- 2.31.1

2 8

[libvirt PATCH] qemu: simplify machine-type check for implicit floppy controller
by Ján Tomko 24 Aug '21

24 Aug '21

Q35 machine types 2.3 and older had an integrated floppy controller. Support for these machine types was removed by QEMU commit commit 86165b499edf8b03bb2d0e926d116c2f12a95bfe q35: Remove old machine versions git describe: v2.5.0-1530-g86165b499e contains: v2.6.0-rc0~76^2~4 In libvirt, we have bumped the minimum QEMU version to 2.11: commit b4cbdbe90bbf85eaf687f532d5a52a11e664b781 qemu: Formally deprecate support for qemu < 2.11 git describe: v7.3.0-13-gb4cbdbe90b contains: v7.4.0-rc1~300 Since this QEMU version only supports Q35 machine versions 2.4+, remove the code dealing with older ones. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/qemu/qemu_domain.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 9baa4b5d90..50a921c80d 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -8823,22 +8823,12 @@ static bool qemuDomainMachineNeedsFDC(const char *machine, const virArch arch) { - const char *p = STRSKIP(machine, "pc-q35-"); - if (!ARCH_IS_X86(arch)) return false; - if (!p) + if (!STRPREFIX(machine, "pc-q35-")) return false; - if (STRPREFIX(p, "1.") || - STREQ(p, "2.0") || - STREQ(p, "2.1") || - STREQ(p, "2.2") || - STREQ(p, "2.3")) { - return false; - } - return true; } -- 2.31.1

2 1

[libvirt PATCHv2] API: discourage usage of non-ListAll APIs
by Ján Tomko 24 Aug '21

24 Aug '21

They require the caller to provide the maximum number of array elements upfront, leading to either incomplete results or violations of the zero-one-infinity rule. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/libvirt-domain-snapshot.c | 12 ++++++++---- src/libvirt-domain.c | 8 ++++---- src/libvirt-interface.c | 6 ++++-- src/libvirt-network.c | 6 ++++-- src/libvirt-nodedev.c | 3 ++- src/libvirt-nwfilter.c | 3 +++ src/libvirt-secret.c | 3 +++ src/libvirt-storage.c | 9 ++++++--- 8 files changed, 34 insertions(+), 16 deletions(-) diff --git a/src/libvirt-domain-snapshot.c b/src/libvirt-domain-snapshot.c index 15bf4d8634..4a79e95704 100644 --- a/src/libvirt-domain-snapshot.c +++ b/src/libvirt-domain-snapshot.c @@ -381,8 +381,10 @@ virDomainSnapshotNum(virDomainPtr domain, unsigned int flags) * snapshots were listed if the return is less than @nameslen. Likewise, * you should be prepared for virDomainSnapshotLookupByName() to fail when * converting a name from this call into a snapshot object, if another - * connection deletes the snapshot in the meantime. For more control over - * the results, see virDomainListAllSnapshots(). + * connection deletes the snapshot in the meantime. + * + * The use of this function is discouraged. Instead, use + * virDomainListAllSnapshots(). * * Returns the number of domain snapshots found or -1 in case of error. * The caller is responsible to call free() for each member of the array. @@ -582,8 +584,10 @@ virDomainSnapshotNumChildren(virDomainSnapshotPtr snapshot, unsigned int flags) * snapshots were listed if the return is less than @nameslen. Likewise, * you should be prepared for virDomainSnapshotLookupByName() to fail when * converting a name from this call into a snapshot object, if another - * connection deletes the snapshot in the meantime. For more control over - * the results, see virDomainSnapshotListAllChildren(). + * connection deletes the snapshot in the meantime. + * + * The use of this function is discouraged. Instead, use + * virDomainSnapshotListAllChildren(). * * Returns the number of domain snapshots found or -1 in case of error. * The caller is responsible to call free() for each member of the array. diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c index 3c4204e563..a8a386e839 100644 --- a/src/libvirt-domain.c +++ b/src/libvirt-domain.c @@ -41,8 +41,8 @@ VIR_LOG_INIT("libvirt.domain"); * * Collect the list of active domains, and store their IDs in array @ids * - * For inactive domains, see virConnectListDefinedDomains(). For more - * control over the results, see virConnectListAllDomains(). + * The use of this function is discouraged. Instead, use + * virConnectListAllDomains(). * * Returns the number of domains found or -1 in case of error. Note that * this command is inherently racy; a domain can be started between a @@ -6526,8 +6526,8 @@ virConnectNumOfDefinedDomains(virConnectPtr conn) * list the defined but inactive domains, stores the pointers to the names * in @names * - * For active domains, see virConnectListDomains(). For more control over - * the results, see virConnectListAllDomains(). + * The use of this function is discouraged. Instead, use + * virConnectListAllDomains(). * * Returns the number of names provided in the array or -1 in case of error. * Note that this command is inherently racy; a domain can be defined between diff --git a/src/libvirt-interface.c b/src/libvirt-interface.c index 2af86291d3..e4e8178ba9 100644 --- a/src/libvirt-interface.c +++ b/src/libvirt-interface.c @@ -150,7 +150,8 @@ virConnectNumOfInterfaces(virConnectPtr conn) * Collect the list of active physical host interfaces, * and store their names in @names * - * For more control over the results, see virConnectListAllInterfaces(). + * The use of this function is discouraged. Instead, use + * virConnectListAllInterfaces(). * * Returns the number of interfaces found or -1 in case of error. Note that * this command is inherently racy; a interface can be started between a call @@ -227,7 +228,8 @@ virConnectNumOfDefinedInterfaces(virConnectPtr conn) * Collect the list of defined (inactive) physical host interfaces, * and store their names in @names. * - * For more control over the results, see virConnectListAllInterfaces(). + * The use of this function is discouraged. Instead, use + * virConnectListAllInterfaces(). * * Returns the number of names provided in the array or -1 in case of error. * Note that this command is inherently racy; a interface can be defined between diff --git a/src/libvirt-network.c b/src/libvirt-network.c index 145487d599..2cecbf6c12 100644 --- a/src/libvirt-network.c +++ b/src/libvirt-network.c @@ -159,7 +159,8 @@ virConnectNumOfNetworks(virConnectPtr conn) * * Collect the list of active networks, and store their names in @names * - * For more control over the results, see virConnectListAllNetworks(). + * The use of this function is discouraged. Instead, use + * virConnectListAllNetworks(). * * Returns the number of networks found or -1 in case of error. Note that * this command is inherently racy; a network can be started between a call @@ -235,7 +236,8 @@ virConnectNumOfDefinedNetworks(virConnectPtr conn) * * list the inactive networks, stores the pointers to the names in @names * - * For more control over the results, see virConnectListAllNetworks(). + * The use of this function is discouraged. Instead, use + * virConnectListAllNetworks(). * * Returns the number of names provided in the array or -1 in case of error. * Note that this command is inherently racy; a network can be defined between diff --git a/src/libvirt-nodedev.c b/src/libvirt-nodedev.c index e416c12534..ce0f30e958 100644 --- a/src/libvirt-nodedev.c +++ b/src/libvirt-nodedev.c @@ -128,7 +128,8 @@ virConnectListAllNodeDevices(virConnectPtr conn, * * Collect the list of node devices, and store their names in @names * - * For more control over the results, see virConnectListAllNodeDevices(). + * The use of this function is discouraged. Instead, use + * virConnectListAllNodeDevices(). * * If the optional 'cap' argument is non-NULL, then the count * will be restricted to devices with the specified capability diff --git a/src/libvirt-nwfilter.c b/src/libvirt-nwfilter.c index 7b857d1422..8d09270296 100644 --- a/src/libvirt-nwfilter.c +++ b/src/libvirt-nwfilter.c @@ -117,6 +117,9 @@ virConnectListAllNWFilters(virConnectPtr conn, * * Collect the list of network filters, and store their names in @names * + * The use of this function is discouraged. Instead, use + * virConnectListAllNWFilters(). + * * Returns the number of network filters found or -1 in case of error */ int diff --git a/src/libvirt-secret.c b/src/libvirt-secret.c index d3626ed561..d2a3a4bd9d 100644 --- a/src/libvirt-secret.c +++ b/src/libvirt-secret.c @@ -156,6 +156,9 @@ virConnectListAllSecrets(virConnectPtr conn, * * List UUIDs of defined secrets, store pointers to names in uuids. * + * The use of this function is discouraged. Instead, use + * virConnectListAllSecrets(). + * * Returns the number of UUIDs provided in the array, or -1 on failure. */ int diff --git a/src/libvirt-storage.c b/src/libvirt-storage.c index 2a7cdca234..4badb13f04 100644 --- a/src/libvirt-storage.c +++ b/src/libvirt-storage.c @@ -179,7 +179,8 @@ virConnectNumOfStoragePools(virConnectPtr conn) * If there are more than maxnames, the remaining names will be silently * ignored. * - * For more control over the results, see virConnectListAllStoragePools(). + * The use of this function is discouraged. Instead, use + * virConnectListAllStoragePools(). * * Returns the number of pools found or -1 in case of error. Note that * this command is inherently racy; a pool can be started between a call to @@ -259,7 +260,8 @@ virConnectNumOfDefinedStoragePools(virConnectPtr conn) * If there are more than maxnames, the remaining names will be silently * ignored. * - * For more control over the results, see virConnectListAllStoragePools(). + * The use of this function is discouraged. Instead, use + * virConnectListAllStoragePools(). * * Returns the number of names provided in the array or -1 in case of error. * Note that this command is inherently racy; a pool can be defined between @@ -1254,7 +1256,8 @@ virStoragePoolNumOfVolumes(virStoragePoolPtr pool) * Fetch list of storage volume names, limiting to * at most maxnames. * - * To list the volume objects directly, see virStoragePoolListAllVolumes(). + * The use of this function is discouraged. Instead, use + * virStoragePoolListAllVolumes(). * * Returns the number of names fetched, or -1 on error */ -- 2.31.1

2 1

[PATCH V2] qemu: Set label on vhostuser net device when hotplugging
by Jim Fehlig 24 Aug '21

24 Aug '21

Attaching a newly created vhostuser port to a VM fails due to an apparmor denial internal error: unable to execute QEMU command 'chardev-add': Failed to bind socket to /run/openvswitch/vhu838c4d29-c9: Permission denied In the case of a net device type VIR_DOMAIN_NET_TYPE_VHOSTUSER, the underlying chardev is not labeled in qemuDomainAttachNetDevice prior to calling qemuMonitorAttachCharDev. A simple fix would be to call qemuSecuritySetChardevLabel using the embedded virDomainChrSourceDef in the virDomainNetDef vhostuser data, but this incurs the risk of incorrectly restoring the label. E.g. consider the DAC driver behavior with a vhostuser net device, which uses a socket for the chardev backend. The DAC driver uses XATTRS to store original labelling information, but XATTRS are not compatible with sockets. Without the original labelling information, the socket labels will be restored with root ownership, preventing other less-privileged processes from connecting to the socket. This patch avoids overloading chardev labelling with vhostuser net devices by introducing virSecurityManager{Set,Restore}NetdevLabel, which is currently only implemented for the apparmor driver. The new APIs are then used to set and restore labels for the vhostuser net devices. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- V2 of: https://listman.redhat.com/archives/libvir-list/2021-August/msg00373.html Changes since V1: Introduce and use new APIs for labeling net devices Don't perform labelling while executing monitor commands Restore labels if hotplug fails src/libvirt_private.syms | 2 ++ src/qemu/qemu_hotplug.c | 13 +++++++ src/qemu/qemu_security.c | 59 ++++++++++++++++++++++++++++++ src/qemu/qemu_security.h | 8 +++++ src/security/security_apparmor.c | 61 ++++++++++++++++++++++++++++++++ src/security/security_driver.h | 9 +++++ src/security/security_manager.c | 38 ++++++++++++++++++++ src/security/security_manager.h | 8 +++++ src/security/security_stack.c | 52 +++++++++++++++++++++++++++ 9 files changed, 250 insertions(+) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index fcb02c21b1..9d3e0421c0 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1687,6 +1687,7 @@ virSecurityManagerRestoreHostdevLabel; virSecurityManagerRestoreImageLabel; virSecurityManagerRestoreInputLabel; virSecurityManagerRestoreMemoryLabel; +virSecurityManagerRestoreNetdevLabel; virSecurityManagerRestoreSavedStateLabel; virSecurityManagerRestoreTPMLabels; virSecurityManagerSetAllLabel; @@ -1698,6 +1699,7 @@ virSecurityManagerSetImageFDLabel; virSecurityManagerSetImageLabel; virSecurityManagerSetInputLabel; virSecurityManagerSetMemoryLabel; +virSecurityManagerSetNetdevLabel; virSecurityManagerSetProcessLabel; virSecurityManagerSetSavedStateLabel; virSecurityManagerSetSocketLabel; diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index c3c49fe080..77dbf69845 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1203,6 +1203,7 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver, g_autofree char *netdev_name = NULL; g_autoptr(virConnect) conn = NULL; virErrorPtr save_err = NULL; + bool teardownlabel = false; /* If appropriate, grab a physical device from the configured * network's pool of devices, or resolve bridge device name @@ -1343,6 +1344,9 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver, &net->ifname) < 0) goto cleanup; + if (qemuSecuritySetNetdevLabel(driver, vm, net) < 0) + goto cleanup; + teardownlabel = true; break; case VIR_DOMAIN_NET_TYPE_USER: @@ -1559,6 +1563,10 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver, qemuDomainNetDeviceVportRemove(net); } + if (teardownlabel && + qemuSecurityRestoreNetdevLabel(driver, vm, net) < 0) + VIR_WARN("Unable to restore network device labelling on hotplug fail"); + /* we had potentially pre-added the device to the domain * device lists, if so we need to remove it (from def->nets * and/or def->hostdevs) on failure @@ -4763,6 +4771,11 @@ qemuDomainRemoveNetDevice(virQEMUDriver *driver, cfg->stateDir)); } + if (actualType == VIR_DOMAIN_NET_TYPE_VHOSTUSER) { + if (qemuSecurityRestoreNetdevLabel(driver, vm, net) < 0) + VIR_WARN("Unable to restore security label on vhostuser char device"); + } + qemuDomainNetDeviceVportRemove(net); if (net->type == VIR_DOMAIN_NET_TYPE_NETWORK) { diff --git a/src/qemu/qemu_security.c b/src/qemu/qemu_security.c index e582a66071..19d957dd4b 100644 --- a/src/qemu/qemu_security.c +++ b/src/qemu/qemu_security.c @@ -439,6 +439,65 @@ qemuSecurityRestoreChardevLabel(virQEMUDriver *driver, return ret; } +int +qemuSecuritySetNetdevLabel(virQEMUDriver *driver, + virDomainObj *vm, + virDomainNetDef *net) +{ + int ret = -1; + qemuDomainObjPrivate *priv = vm->privateData; + pid_t pid = -1; + + if (qemuDomainNamespaceEnabled(vm, QEMU_DOMAIN_NS_MOUNT)) + pid = vm->pid; + + if (virSecurityManagerTransactionStart(driver->securityManager) < 0) + goto cleanup; + + if (virSecurityManagerSetNetdevLabel(driver->securityManager, + vm->def, net) < 0) + goto cleanup; + + if (virSecurityManagerTransactionCommit(driver->securityManager, + pid, priv->rememberOwner) < 0) + goto cleanup; + + ret = 0; + cleanup: + virSecurityManagerTransactionAbort(driver->securityManager); + return ret; +} + + +int +qemuSecurityRestoreNetdevLabel(virQEMUDriver *driver, + virDomainObj *vm, + virDomainNetDef *net) +{ + int ret = -1; + qemuDomainObjPrivate *priv = vm->privateData; + pid_t pid = -1; + + if (qemuDomainNamespaceEnabled(vm, QEMU_DOMAIN_NS_MOUNT)) + pid = vm->pid; + + if (virSecurityManagerTransactionStart(driver->securityManager) < 0) + goto cleanup; + + if (virSecurityManagerRestoreNetdevLabel(driver->securityManager, + vm->def, net) < 0) + goto cleanup; + + if (virSecurityManagerTransactionCommit(driver->securityManager, + pid, priv->rememberOwner) < 0) + goto cleanup; + + ret = 0; + cleanup: + virSecurityManagerTransactionAbort(driver->securityManager); + return ret; +} + /* * qemuSecurityStartVhostUserGPU: diff --git a/src/qemu/qemu_security.h b/src/qemu/qemu_security.h index 4c3d81e4b5..8b26ea3f99 100644 --- a/src/qemu/qemu_security.h +++ b/src/qemu/qemu_security.h @@ -79,6 +79,14 @@ int qemuSecurityRestoreChardevLabel(virQEMUDriver *driver, virDomainObj *vm, virDomainChrDef *chr); +int qemuSecuritySetNetdevLabel(virQEMUDriver *driver, + virDomainObj *vm, + virDomainNetDef *net); + +int qemuSecurityRestoreNetdevLabel(virQEMUDriver *driver, + virDomainObj *vm, + virDomainNetDef *net); + int qemuSecurityStartVhostUserGPU(virQEMUDriver *driver, virDomainObj *vm, virCommand *cmd, diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index 84363015dc..d942ea5005 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -1053,6 +1053,64 @@ AppArmorRestoreChardevLabel(virSecurityManager *mgr, return reload_profile(mgr, def, NULL, false); } +static int +AppArmorSetNetdevLabel(virSecurityManager *mgr, + virDomainDef *def, + virDomainNetDef *net) +{ + int ret = -1; + virSecurityLabelDef *secdef; + virDomainChrSourceDef *dev_source; + virDomainNetType actualType; + + secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_APPARMOR_NAME); + if (!secdef) + return 0; + + actualType = virDomainNetGetActualType(net); + if (actualType != VIR_DOMAIN_NET_TYPE_VHOSTUSER) + return 0; + + dev_source = net->data.vhostuser; + switch ((virDomainChrType)dev_source->type) { + case VIR_DOMAIN_CHR_TYPE_UNIX: + ret = reload_profile(mgr, def, dev_source->data.file.path, true); + break; + + case VIR_DOMAIN_CHR_TYPE_DEV: + case VIR_DOMAIN_CHR_TYPE_FILE: + case VIR_DOMAIN_CHR_TYPE_PTY: + case VIR_DOMAIN_CHR_TYPE_PIPE: + case VIR_DOMAIN_CHR_TYPE_SPICEPORT: + case VIR_DOMAIN_CHR_TYPE_NULL: + case VIR_DOMAIN_CHR_TYPE_VC: + case VIR_DOMAIN_CHR_TYPE_STDIO: + case VIR_DOMAIN_CHR_TYPE_UDP: + case VIR_DOMAIN_CHR_TYPE_TCP: + case VIR_DOMAIN_CHR_TYPE_SPICEVMC: + case VIR_DOMAIN_CHR_TYPE_NMDM: + case VIR_DOMAIN_CHR_TYPE_LAST: + ret = 0; + break; + } + + return ret; +} + +static int +AppArmorRestoreNetdevLabel(virSecurityManager *mgr, + virDomainDef *def, + virDomainNetDef *net G_GNUC_UNUSED) +{ + virSecurityLabelDef *secdef; + + secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_APPARMOR_NAME); + if (!secdef) + return 0; + + return reload_profile(mgr, def, NULL, false); +} + static int AppArmorSetPathLabel(virSecurityManager *mgr, virDomainDef *def, @@ -1168,6 +1226,9 @@ virSecurityDriver virAppArmorSecurityDriver = { .domainSetSecurityChardevLabel = AppArmorSetChardevLabel, .domainRestoreSecurityChardevLabel = AppArmorRestoreChardevLabel, + .domainSetSecurityNetdevLabel = AppArmorSetNetdevLabel, + .domainRestoreSecurityNetdevLabel = AppArmorRestoreNetdevLabel, + .domainSetSecurityImageFDLabel = AppArmorSetFDLabel, .domainSetSecurityTapFDLabel = AppArmorSetFDLabel, diff --git a/src/security/security_driver.h b/src/security/security_driver.h index 07f8def3d3..a1fc23be38 100644 --- a/src/security/security_driver.h +++ b/src/security/security_driver.h @@ -157,6 +157,12 @@ typedef int (*virSecurityDomainSetTPMLabels) (virSecurityManager *mgr, virDomainDef *def); typedef int (*virSecurityDomainRestoreTPMLabels) (virSecurityManager *mgr, virDomainDef *def); +typedef int (*virSecurityDomainSetNetdevLabel) (virSecurityManager *mgr, + virDomainDef *def, + virDomainNetDef *net); +typedef int (*virSecurityDomainRestoreNetdevLabel) (virSecurityManager *mgr, + virDomainDef *def, + virDomainNetDef *net); struct _virSecurityDriver { @@ -224,6 +230,9 @@ struct _virSecurityDriver { virSecurityDomainSetTPMLabels domainSetSecurityTPMLabels; virSecurityDomainRestoreTPMLabels domainRestoreSecurityTPMLabels; + + virSecurityDomainSetNetdevLabel domainSetSecurityNetdevLabel; + virSecurityDomainRestoreNetdevLabel domainRestoreSecurityNetdevLabel; }; virSecurityDriver *virSecurityDriverLookup(const char *name, diff --git a/src/security/security_manager.c b/src/security/security_manager.c index 9906c1691d..d8a03a19cb 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -1297,6 +1297,44 @@ virSecurityManagerRestoreTPMLabels(virSecurityManager *mgr, } +int +virSecurityManagerSetNetdevLabel(virSecurityManager *mgr, + virDomainDef *vm, + virDomainNetDef *net) +{ + int ret; + + if (mgr->drv->domainSetSecurityNetdevLabel) { + virObjectLock(mgr); + ret = mgr->drv->domainSetSecurityNetdevLabel(mgr, vm, net); + virObjectUnlock(mgr); + + return ret; + } + + return 0; +} + + +int +virSecurityManagerRestoreNetdevLabel(virSecurityManager *mgr, + virDomainDef *vm, + virDomainNetDef *net) +{ + int ret; + + if (mgr->drv->domainRestoreSecurityNetdevLabel) { + virObjectLock(mgr); + ret = mgr->drv->domainRestoreSecurityNetdevLabel(mgr, vm, net); + virObjectUnlock(mgr); + + return ret; + } + + return 0; +} + + static int cmpstringp(const void *p1, const void *p2) { diff --git a/src/security/security_manager.h b/src/security/security_manager.h index 57047ccb13..59020b1475 100644 --- a/src/security/security_manager.h +++ b/src/security/security_manager.h @@ -220,6 +220,14 @@ int virSecurityManagerSetTPMLabels(virSecurityManager *mgr, int virSecurityManagerRestoreTPMLabels(virSecurityManager *mgr, virDomainDef *vm); +int virSecurityManagerSetNetdevLabel(virSecurityManager *mgr, + virDomainDef *vm, + virDomainNetDef *net); + +int virSecurityManagerRestoreNetdevLabel(virSecurityManager *mgr, + virDomainDef *vm, + virDomainNetDef *net); + typedef struct _virSecurityManagerMetadataLockState virSecurityManagerMetadataLockState; struct _virSecurityManagerMetadataLockState { size_t nfds; /* Captures size of both @fds and @paths */ diff --git a/src/security/security_stack.c b/src/security/security_stack.c index f7a9ed1e33..3c2239910a 100644 --- a/src/security/security_stack.c +++ b/src/security/security_stack.c @@ -963,6 +963,55 @@ virSecurityStackRestoreTPMLabels(virSecurityManager *mgr, } +static int +virSecurityStackDomainSetNetdevLabel(virSecurityManager *mgr, + virDomainDef *def, + virDomainNetDef *net) +{ + virSecurityStackData *priv = virSecurityManagerGetPrivateData(mgr); + virSecurityStackItem *item = priv->itemsHead; + + for (; item; item = item->next) { + if (virSecurityManagerSetNetdevLabel(item->securityManager, def, net) < 0) + goto rollback; + } + + return 0; + + rollback: + for (item = item->prev; item; item = item->prev) { + if (virSecurityManagerRestoreNetdevLabel(item->securityManager, + def, net) < 0) { + VIR_WARN("Unable to restore netdev label after failed set label " + "call virDriver=%s driver=%s domain=%s", + virSecurityManagerGetVirtDriver(mgr), + virSecurityManagerGetDriver(item->securityManager), + def->name); + } + } + return -1; +} + + +static int +virSecurityStackDomainRestoreNetdevLabel(virSecurityManager *mgr, + virDomainDef *def, + virDomainNetDef *net) +{ + virSecurityStackData *priv = virSecurityManagerGetPrivateData(mgr); + virSecurityStackItem *item = priv->itemsHead; + int rc = 0; + + for (; item; item = item->next) { + if (virSecurityManagerRestoreNetdevLabel(item->securityManager, + def, net) < 0) + rc = -1; + } + + return rc; +} + + virSecurityDriver virSecurityDriverStack = { .privateDataLen = sizeof(virSecurityStackData), .name = "stack", @@ -1028,4 +1077,7 @@ virSecurityDriver virSecurityDriverStack = { .domainSetSecurityTPMLabels = virSecurityStackSetTPMLabels, .domainRestoreSecurityTPMLabels = virSecurityStackRestoreTPMLabels, + + .domainSetSecurityNetdevLabel = virSecurityStackDomainSetNetdevLabel, + .domainRestoreSecurityNetdevLabel = virSecurityStackDomainRestoreNetdevLabel, }; -- 2.32.0

2 1

[PATCH 0/2] Support VM core dump to block device
by Simon Rowe 23 Aug '21

23 Aug '21

When the destination of a VM core dump is a block device (e.g. NBD) avoid file operations that are unnecessary. Simon Rowe (2): iohelper: skip lseek() and ftruncate() on block devices qemu: never unlink() the core dump output file src/qemu/qemu_driver.c | 2 -- src/util/iohelper.c | 10 ++++++++-- 2 files changed, 8 insertions(+), 4 deletions(-) -- 2.22.3

2 10

[PATCH] vbox_network: fix possible memory leak in vboxNetworkDefineCreateXML()
by Kristina Hanicova 23 Aug '21

23 Aug '21

virNetworkDef was not freed if the function failed in the first two ifs, causing a possible memory leak. Signed-off-by: Kristina Hanicova <khanicov(a)redhat.com> --- src/vbox/vbox_network.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/vbox/vbox_network.c b/src/vbox/vbox_network.c index afd2acbb03..d97f571d1b 100644 --- a/src/vbox/vbox_network.c +++ b/src/vbox/vbox_network.c @@ -375,7 +375,7 @@ vboxNetworkDefineCreateXML(virConnectPtr conn, const char *xml, bool start) PRUnichar *networkNameUtf16 = NULL; char *networkNameUtf8 = NULL; IHostNetworkInterface *networkInterface = NULL; - virNetworkDef *def = virNetworkDefParseString(xml, NULL); + virNetworkDef *def = NULL; virNetworkIPDef *ipdef = NULL; unsigned char uuid[VIR_UUID_BUFLEN]; vboxIID vboxnetiid; @@ -394,7 +394,7 @@ vboxNetworkDefineCreateXML(virConnectPtr conn, const char *xml, bool start) VBOX_IID_INITIALIZE(&vboxnetiid); - if ((!def) || + if (!(def = virNetworkDefParseString(xml, NULL)) || (def->forward.type != VIR_NETWORK_FORWARD_NONE) || (def->nips == 0 || !def->ips)) goto cleanup; -- 2.31.1

2 1

[PATCH] qemu: Label vhostuser net device
by Jim Fehlig 23 Aug '21

23 Aug '21

Attaching a newly created vhostuser port to a VM fails due to an apparmor denial internal error: unable to execute QEMU command 'chardev-add': Failed to bind socket to /run/openvswitch/vhu838c4d29-c9: Permission denied In the case of a net device type VIR_DOMAIN_NET_TYPE_VHOSTUSER, the underlying chardev is not labeled in qemuDomainAttachNetDevice prior to calling qemuMonitorAttachCharDev. Label the chardev before calling qemuMonitorAttachCharDev, and restore the label when removing the net device. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- src/qemu/qemu_hotplug.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index c00e8a7852..42e7997112 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1467,6 +1467,11 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver, } if (actualType == VIR_DOMAIN_NET_TYPE_VHOSTUSER) { + virDomainChrDef chr = { .source = net->data.vhostuser }; + + if (qemuSecuritySetChardevLabel(driver, vm, &chr) < 0) + goto cleanup; + if (qemuMonitorAttachCharDev(priv->mon, charDevAlias, net->data.vhostuser) < 0) { ignore_value(qemuDomainObjExitMonitor(driver, vm)); virDomainAuditNet(vm, NULL, net, "attach", false); @@ -4692,6 +4697,8 @@ qemuDomainRemoveNetDevice(virQEMUDriver *driver, } if (actualType == VIR_DOMAIN_NET_TYPE_VHOSTUSER) { + virDomainChrDef chr = { .source = net->data.vhostuser }; + /* vhostuser has a chardev too */ if (qemuMonitorDetachCharDev(priv->mon, charDevAlias) < 0) { /* well, this is a messy situation. Guest visible PCI device has @@ -4699,6 +4706,8 @@ qemuDomainRemoveNetDevice(virQEMUDriver *driver, * to just ignore the error and carry on. */ } + if (qemuSecurityRestoreChardevLabel(driver, vm, &chr) < 0) + VIR_WARN("Unable to restore security label on vhostuser char device"); } else if (actualType == VIR_DOMAIN_NET_TYPE_VDPA) { int vdpafdset = -1; g_autoptr(qemuMonitorFdsets) fdsets = NULL; -- 2.32.0

5 9

[PATCH] conf: snapshot/checkpoint: Rewrite 'AlignDisk' logic to appease clang
by Peter Krempa 23 Aug '21

23 Aug '21

New clang has a false-positive about value of 'olddisks' being unused after being set. This is clearly wrong because we want to use 'g_autofree' to clear it later. While I'm against modifying good code for the sake of bad static analysis in this case it's not obvious that we depend on the lifetime of 'olddisks' being needed until the end of the function as we store pointers into it into the hash table and later copy them out. Rewrite the code by assigning to 'olddisks' earlier and then using 'olddisks' in the loop, so it's clear where the lifetime of the objects ends, and this should also silence the warning. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/conf/checkpoint_conf.c | 14 ++++++++------ src/conf/snapshot_conf.c | 14 ++++++++------ 2 files changed, 16 insertions(+), 12 deletions(-) diff --git a/src/conf/checkpoint_conf.c b/src/conf/checkpoint_conf.c index 4731f21aba..175a95fed7 100644 --- a/src/conf/checkpoint_conf.c +++ b/src/conf/checkpoint_conf.c @@ -265,6 +265,7 @@ virDomainCheckpointAlignDisks(virDomainCheckpointDef *chkdef) virDomainDef *domdef = chkdef->parent.dom; g_autoptr(GHashTable) map = virHashNew(NULL); g_autofree virDomainCheckpointDiskDef *olddisks = NULL; + size_t oldndisks; size_t i; int checkpoint_default = VIR_DOMAIN_CHECKPOINT_TYPE_NONE; @@ -292,9 +293,14 @@ virDomainCheckpointAlignDisks(virDomainCheckpointDef *chkdef) if (!chkdef->ndisks) checkpoint_default = VIR_DOMAIN_CHECKPOINT_TYPE_BITMAP; + olddisks = g_steal_pointer(&chkdef->disks); + oldndisks = chkdef->ndisks; + chkdef->disks = g_new0(virDomainCheckpointDiskDef, domdef->ndisks); + chkdef->ndisks = domdef->ndisks; + /* Double check requested disks. */ - for (i = 0; i < chkdef->ndisks; i++) { - virDomainCheckpointDiskDef *chkdisk = &chkdef->disks[i]; + for (i = 0; i < oldndisks; i++) { + virDomainCheckpointDiskDef *chkdisk = &olddisks[i]; virDomainDiskDef *domdisk = virDomainDiskByName(domdef, chkdisk->name, false); if (!domdisk) { @@ -328,10 +334,6 @@ virDomainCheckpointAlignDisks(virDomainCheckpointDef *chkdef) } } - olddisks = g_steal_pointer(&chkdef->disks); - chkdef->disks = g_new0(virDomainCheckpointDiskDef, domdef->ndisks); - chkdef->ndisks = domdef->ndisks; - for (i = 0; i < domdef->ndisks; i++) { virDomainDiskDef *domdisk = domdef->disks[i]; virDomainCheckpointDiskDef *chkdisk = chkdef->disks + i; diff --git a/src/conf/snapshot_conf.c b/src/conf/snapshot_conf.c index c765e4c815..fc6f0a859d 100644 --- a/src/conf/snapshot_conf.c +++ b/src/conf/snapshot_conf.c @@ -636,6 +636,7 @@ virDomainSnapshotAlignDisks(virDomainSnapshotDef *snapdef, virDomainDef *domdef = snapdef->parent.dom; g_autoptr(GHashTable) map = virHashNew(NULL); g_autofree virDomainSnapshotDiskDef *olddisks = NULL; + size_t oldndisks; size_t i; if (!domdef) { @@ -654,9 +655,14 @@ virDomainSnapshotAlignDisks(virDomainSnapshotDef *snapdef, if (!domdef->ndisks) return 0; + olddisks = g_steal_pointer(&snapdef->disks); + oldndisks = snapdef->ndisks; + snapdef->disks = g_new0(virDomainSnapshotDiskDef, domdef->ndisks); + snapdef->ndisks = domdef->ndisks; + /* Double check requested disks. */ - for (i = 0; i < snapdef->ndisks; i++) { - virDomainSnapshotDiskDef *snapdisk = &snapdef->disks[i]; + for (i = 0; i < oldndisks; i++) { + virDomainSnapshotDiskDef *snapdisk = &olddisks[i]; virDomainDiskDef *domdisk = virDomainDiskByName(domdef, snapdisk->name, false); if (!domdisk) { @@ -708,10 +714,6 @@ virDomainSnapshotAlignDisks(virDomainSnapshotDef *snapdef, } } - olddisks = g_steal_pointer(&snapdef->disks); - snapdef->disks = g_new0(virDomainSnapshotDiskDef, domdef->ndisks); - snapdef->ndisks = domdef->ndisks; - for (i = 0; i < domdef->ndisks; i++) { virDomainDiskDef *domdisk = domdef->disks[i]; virDomainSnapshotDiskDef *snapdisk = snapdef->disks + i; -- 2.31.1

2 1

[PATCH] virsh-snapshot: Don't leak @then in cmdSnapshotList()
by Michal Privoznik 23 Aug '21

23 Aug '21

The variable is used inside a loop in which it' allocated in each iteration. Bring it inside the loop so that g_autoptr() kicks in each iteration. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tools/virsh-snapshot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/virsh-snapshot.c b/tools/virsh-snapshot.c index ee99d0e061..e08ecb6910 100644 --- a/tools/virsh-snapshot.c +++ b/tools/virsh-snapshot.c @@ -1439,7 +1439,6 @@ cmdSnapshotList(vshControl *ctl, const vshCmd *cmd) size_t i; virDomainSnapshotPtr snapshot = NULL; long long creation_longlong; - g_autoptr(GDateTime) then = NULL; bool tree = vshCommandOptBool(cmd, "tree"); bool name = vshCommandOptBool(cmd, "name"); bool from = vshCommandOptBool(cmd, "from"); @@ -1533,6 +1532,7 @@ cmdSnapshotList(vshControl *ctl, const vshCmd *cmd) } for (i = 0; i < snaplist->nsnaps; i++) { + g_autoptr(GDateTime) then = NULL; g_autofree gchar *thenstr = NULL; g_autoptr(xmlDoc) xml = NULL; g_autoptr(xmlXPathContext) ctxt = NULL; -- 2.31.1

2 1

[PATCH 0/5] Allow freepage/allocpages on numactl-less builds
by Michal Privoznik 23 Aug '21

23 Aug '21

See 3/5 for explanation. Michal Prívozník (5): conf: Introduce virCapabilitiesHostNUMAGetMaxNode() virhostmem: Let caller pass max NUMA node to virHostMemGetFreePages virhostmem: Let caller pass max NUMA node to virHostMemAllocPages virhostmem: Handle numactl-less build in hugepages allocation/reporting rpm: Enable numactl on s390x libvirt.spec.in | 2 +- src/conf/capabilities.c | 9 +++++++++ src/conf/capabilities.h | 2 ++ src/libvirt_private.syms | 1 + src/lxc/lxc_driver.c | 23 +++++++++++++++++++++-- src/qemu/qemu_driver.c | 23 +++++++++++++++++++++-- src/util/virhostmem.c | 24 ++++++++++++++++++------ src/util/virhostmem.h | 2 ++ src/vbox/vbox_common.c | 20 +++++++++++++++++--- 9 files changed, 92 insertions(+), 14 deletions(-) -- 2.31.1

2 6

[PATCH v2 0/3] docs/about: some documentation clean-up/fix
by Yanan Wang 23 Aug '21

23 Aug '21

This series makes some clean-up and fix for docs/about, including removing the duplicated section, unifying the subject format, and adding the missed release record in the subject. v1->v2: - update the commit message, combined with Cornelia's comment - add the missing release record in the subject (patch #3) - v1: https://lore.kernel.org/qemu-devel/20210820015628.173532-1-wangyanan55@huaw… Yanan Wang (3): docs/about: Remove the duplicated doc docs/about: Unify the subject format docs/about: Add the missing release record in the subject docs/about/deprecated.rst | 56 ++++++++++++++++----------------- docs/about/removed-features.rst | 45 ++++++++++---------------- 2 files changed, 44 insertions(+), 57 deletions(-) -- 2.19.1

3 9

[libvirt][PATCH v6 0/6] Support query and use SGX
by Haibin Huang 23 Aug '21

23 Aug '21

This patch series provides support for enabling Intel's Software Guard Extensions (SGX) feature in guest VM. Giving the SGX support in QEMU is still pending for reviewing, this patch series is not submmited for code review, but only describe the SGX enabling solution design that contains changes to virConnectGetDomainCapabilities API response and domain definition. All comments/suggestions would be highly appreciated. Intel Software Guard Extensions (Intel® SGX) is a set of instructions that increases the security of application code and data, giving them more protection from disclosure or modification. Developers can partition sensitive information into enclaves, which are areas of execution in memory with more security protection. The typical flow looks below at very high level: 1. Calls virConnectGetDomainCapabilities API to domain capabilities that includes the following SGX information. <feature> ... <sgx supported='yes'> <epc_size unit=’KiB’>N</epc_size> </sgx> </feature> 2. User requests to start a guest calling virCreateXML() with SGX requirement. It should contain <devices> ... <memory model='sgx-epc'> <target> <size unit='KiB'>N</size> </target> </memory> ... </devices> Haibin Huang (3): Support to query SGX capability Add dommaincaps unit test add qemu capabilities version 5.2.0 Lin Yang (3): conf: Introduce SGX EPC element into device memory xml qemu: Add command-line to generate SGX EPC memory backend Add unit tests for guest VM creation command with SGX EPC docs/schemas/domaincaps.rng | 17 + docs/schemas/domaincommon.rng | 1 + src/conf/domain_capabilities.c | 29 + src/conf/domain_capabilities.h | 13 + src/conf/domain_conf.c | 4 + src/conf/domain_conf.h | 1 + src/libvirt_private.syms | 2 +- src/qemu/qemu_alias.c | 8 +- src/qemu/qemu_capabilities.c | 146 + src/qemu/qemu_capabilities.h | 6 + src/qemu/qemu_command.c | 42 +- src/qemu/qemu_domain.c | 10 +- src/qemu/qemu_monitor.c | 10 + src/qemu/qemu_monitor.h | 3 + src/qemu/qemu_monitor_json.c | 91 + src/qemu/qemu_monitor_json.h | 3 + src/security/security_apparmor.c | 1 + src/security/security_dac.c | 2 + src/security/security_selinux.c | 2 + tests/domaincapsdata/bhyve_basic.x86_64.xml | 1 + tests/domaincapsdata/bhyve_fbuf.x86_64.xml | 1 + tests/domaincapsdata/bhyve_uefi.x86_64.xml | 1 + tests/domaincapsdata/empty.xml | 1 + tests/domaincapsdata/libxl-xenfv.xml | 1 + tests/domaincapsdata/libxl-xenpv.xml | 1 + .../domaincapsdata/qemu_1.5.3-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_1.5.3-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_1.5.3.x86_64.xml | 1 + .../domaincapsdata/qemu_1.6.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_1.6.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_1.6.0.x86_64.xml | 1 + .../domaincapsdata/qemu_1.7.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_1.7.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_1.7.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.1.1-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.1.1-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.1.1.x86_64.xml | 1 + .../domaincapsdata/qemu_2.10.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.10.0-tcg.x86_64.xml | 1 + .../qemu_2.10.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.10.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.10.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_2.10.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.10.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.11.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.11.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.11.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.11.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.12.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.12.0-tcg.x86_64.xml | 1 + .../qemu_2.12.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.12.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.12.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_2.12.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.12.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.4.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.4.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.4.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.5.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.5.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.5.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.6.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.6.0-tcg.x86_64.xml | 1 + .../qemu_2.6.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.6.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_2.6.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_2.6.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.7.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.7.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.7.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.7.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.8.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.8.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.8.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.8.0.x86_64.xml | 1 + .../domaincapsdata/qemu_2.9.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_2.9.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_2.9.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_2.9.0.s390x.xml | 1 + tests/domaincapsdata/qemu_2.9.0.x86_64.xml | 1 + .../domaincapsdata/qemu_3.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_3.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_3.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_3.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_3.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_3.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_3.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_3.1.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_3.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_4.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_4.0.0-tcg.x86_64.xml | 1 + .../qemu_4.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_4.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_4.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_4.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_4.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_4.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_4.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_4.2.0-tcg.x86_64.xml | 1 + .../qemu_4.2.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_4.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_4.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.0.0-tcg.x86_64.xml | 1 + .../qemu_5.0.0-virt.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.aarch64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.ppc64.xml | 1 + tests/domaincapsdata/qemu_5.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_5.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_5.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_5.2.0-q35.x86_64.xml | 207 + .../domaincapsdata/qemu_5.2.0-tcg.x86_64.xml | 201 + tests/domaincapsdata/qemu_5.2.0.x86_64.xml | 207 + .../caps_5.2.0.x86_64.replies | 29649 ++++++++++++++++ .../caps_5.2.0.x86_64.xml | 3189 ++ .../sgx-epc.x86_64-5.1.0.args | 41 + tests/qemuxml2argvdata/sgx-epc.xml | 40 + tests/qemuxml2argvtest.c | 1 + 123 files changed, 34013 insertions(+), 9 deletions(-) create mode 100644 tests/domaincapsdata/qemu_5.2.0-q35.x86_64.xml create mode 100644 tests/domaincapsdata/qemu_5.2.0-tcg.x86_64.xml create mode 100644 tests/domaincapsdata/qemu_5.2.0.x86_64.xml create mode 100644 tests/qemucapabilitiesdata/caps_5.2.0.x86_64.replies create mode 100644 tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml create mode 100644 tests/qemuxml2argvdata/sgx-epc.x86_64-5.1.0.args create mode 100644 tests/qemuxml2argvdata/sgx-epc.xml -- 2.17.1

3 11

Questions about the ownership of /var/cache/libvirt/qemu
by Peng Liang 23 Aug '21

23 Aug '21

Hi all, When we change the user for QEMU process (change "user" and "group" in /etc/libvirt/qemu.conf) to a normal user, we found that libvirtd will also change the ownership of /var/cache/libvirt/qemu but will keep the ownership of /var/cache/libvirt/qemu/capabilities as root. Is it secure to put files/directories owned by root in a directory owned by a normal user? Could the normal user replace the root's file with a new one? Does it need to set sticky bit on /var/cache/libvirt/qemu or keep the ownership of /var/cache/libvirt/qemu as root?

2 2

[PATCH 0/2] docs/about: some documentation clean-up
by Yanan Wang 23 Aug '21

23 Aug '21

These two patches (one of which has been reviewed) originally come from [1]. Here resend them separately as a short doc clean-up series. [1] https://lore.kernel.org/qemu-devel/20210819031027.41104-1-wangyanan55@huawe… Yanan Wang (2): docs/about: Remove the duplicated doc docs/about: Unify the subject format docs/about/deprecated.rst | 56 ++++++++++++++++----------------- docs/about/removed-features.rst | 41 +++++++++--------------- 2 files changed, 42 insertions(+), 55 deletions(-) -- 2.19.1

3 4

[libvirt PATCH 0/9] tests: cputest: use g_auto more (glib chronicles)
by Ján Tomko 20 Aug '21

20 Aug '21

Also improve the compilation times (unoptimized optimization routines take too long when there are too many branches in a function, which is the case of cputest's main) and switch qemuxml2* to use the same approach. Ján Tomko (9): qemu: monitor: define cleanup function for qemuMonitorCPUModelInfo tests: use g_auto in cpuTestMakeQEMUCaps tests: cputest: use g_auto for virQEMUCaps tests: cputest: use g_auto for virCPUData tests: cputest: use g_auto for virCPUDef tests: cputest: use g_autofree tests: cputest: remove unnecessary labels tests: cputests: introduce and use virTestRunLog tests: qemuxml2*test: switch to virRunTestLog src/qemu/qemu_monitor.h | 1 + tests/cputest.c | 239 +++++++++++----------------------- tests/qemustatusxml2xmltest.c | 3 +- tests/qemuxml2argvtest.c | 10 +- tests/qemuxml2xmltest.c | 9 +- tests/testutils.c | 30 +++++ tests/testutils.h | 4 + tests/testutilsqemu.h | 1 - 8 files changed, 114 insertions(+), 183 deletions(-) -- 2.31.1

2 10

[libvirt PATCH 0/5] virnetdevopenvswitch: fix overindented label (glib chronicles)
by Ján Tomko 20 Aug '21

20 Aug '21

By removing it, of course. Patch 1/5 also has the potential to fix the build on FreeBSD, but it failed with an internal server error for me. Ján Tomko (5): build: only build virnetdevopenvswitchtest on Linux tests: virnetdevopenvswitch: use g_auto tests: virnetdevbandwidthtest: use g_auto tests: introduce testVirNetDevBandwidthParse tests: virnetdev*: remove unnecessary labels tests/meson.build | 6 ++- tests/virnetdevbandwidthtest.c | 56 ++++++++++++------------- tests/virnetdevopenvswitchtest.c | 70 ++++++++++++++------------------ 3 files changed, 61 insertions(+), 71 deletions(-) -- 2.31.1

2 6