- Devel - libvirt List Archives

[libvirt PATCH v2 00/10] make internal only secrets work with split daemons
by Daniel P. Berrangé 10 May '21

10 May '21

If you define a secret with private="yes", then libvirt won't let any client query the secret value after it is set. Only other libvirt drivers inside the daemon can query it by passing a special internal only flag to the virSecretGetValue API. The remote driver/daemon refuses to let this internal flag go over the wire preventing normal clients from using it This doesn't work with the split daemons because the virSecretGetValue API done by virqemud / virtstoraged has to go over the wire to reach the virsecretd. We need to come up with an alternative way to "prove" that the caller of virSecretGetValue is a libvirt daemon, as opposed to a general libvirt client. Note with if only traditional POSIX DAC permissions are in effect then we could consider it pointless trying to restrict access to clients running the same user/group as the libvirt daemon. We ought to take into account that the client might be confined by SELinux though, so the "private secret" concept isn't entirely pointless. Thus doing a simple uid of client == uid of daemon check is a bit too weak. The UID check might also not fly if the modular daemons are run inside containers with user namespaces, as the container for virtsecretd and virtqemud might have different user mappings in theory. This series adds a concept of a "token" which is known only to the libvirt daemons. The first daemon to use it writes a random hex string to /var/run/libvirt/common/system.token. Other daemons can read and compare this. Unless a MAC system is present this is still largely security theatre, but that's not really worse than the historical behaviour. When an API call is made the virIdentity by default reflects the identity of the UNIX process that initiated it. When connecting to virtproxyd, the client apps' identity is forwarded to the next virtNNNNd daemon. When libvirt drivers, however, initiate an API call we never set any identity. With monolithic libvirtd, they'd inherit the current client identity automagically since it was all in the same thread local. With modular daemons the othe driver would see the identity of the other libvirt daemon which is bad as this gives elevated privileges in the ACL check. Thus we fix the code which drivers use to open a connection to other daemons, such that it applies the current caller's identity. It does this using an "elevated" identity though, which means, we have added in the system token. Thus the virtsecretd daemon getting the call virSecretGetValue sees the virIdentity reflecting the client application which originally called the virDomainCreate() API, but with the system token set. Thus virsecretd can see that the virSecretGetValue was invoked by another daemon, not a libvirt client app. Changed in v2... We can't set the elevated identity only when opening the virConnect for the secret driver. This works for modular daemons, as the identity is passed to the virsecretd at time of opening and thus applies to the later virSecretGetValue call on that connection. For monolithic daemon, the identity present at virConnectOpen is irrelevant. The virSecretGetValue call will just directly query the current thread's identity. IOW, to work in both deployment scenarios we need to have the elevated identity set across both virConnectOpen and virSecretGetValue Daniel P. Berrangé (10): util: add virRandomToken API util: introduce concept of a system token into identities util: generate a persistent system token util: set system token for system identity util: add API for copying identity objects util: helper to temporary elevate privileges of the current identity src: add API to determine if current identity is a system identity src: set identity when opening secondary drivers src: elevate current identity privilege when fetching secret secret: rework handling of private secrets src/driver-secret.h | 9 +- src/driver.c | 27 +++ src/libvirt-secret.c | 2 +- src/libvirt_private.syms | 7 + src/libxl/libxl_conf.c | 5 + src/qemu/qemu_domain.c | 11 +- src/qemu/qemu_tpm.c | 5 + src/remote/remote_driver.c | 8 +- src/secret/secret_driver.c | 34 ++- src/storage/storage_backend_iscsi.c | 5 + src/storage/storage_backend_iscsi_direct.c | 5 + src/storage/storage_backend_rbd.c | 5 + src/storage/storage_util.c | 5 + src/util/viridentity.c | 239 +++++++++++++++++++++ src/util/viridentity.h | 11 + src/util/virrandom.c | 18 ++ src/util/virrandom.h | 1 + src/util/virsecret.c | 3 +- tests/qemuxml2argvtest.c | 3 +- 19 files changed, 375 insertions(+), 28 deletions(-) -- 2.31.1

3 15

[PATCH] Introduce a new virDomainReloadTlsCertificates API
by Zheng Yan 10 May '21

10 May '21

The new virDomainReloadTlsCertificates API is used to notify domain reload its certificates without restart, and avoid service interruption. Currently, only QEMU VNC TLS certificates are supported, but parameters and flags are also reserved for subsequent scenarios. Take reload QEMU VNC TLS certificates as an example, we can call: virDomainReloadTlsCertificates(domain, VIR_DOMAIN_TLS_CERT_GRAPHICS_VNC, NULL, 0, 0); Then the specified QMP message would be send to QEMU: {"execute": "display-reload", "arguments":{"type": "vnc", "tls-certs": true}} Refers: https://gitlab.com/qemu-project/qemu/-/commit/9cc07651655ee86eca41059f5ead8… --- include/libvirt/libvirt-domain.h | 20 +++++++++++ src/driver-hypervisor.h | 8 +++++ src/libvirt-domain.c | 58 ++++++++++++++++++++++++++++++++ src/libvirt_public.syms | 5 +++ src/qemu/qemu_driver.c | 40 ++++++++++++++++++++++ src/qemu/qemu_hotplug.c | 17 ++++++++++ src/qemu/qemu_hotplug.h | 4 +++ src/qemu/qemu_monitor.c | 27 +++++++++++++++ src/qemu/qemu_monitor.h | 3 ++ src/qemu/qemu_monitor_json.c | 27 +++++++++++++++ src/qemu/qemu_monitor_json.h | 4 +++ src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 15 ++++++++- src/remote_protocol-structs | 10 ++++++ 14 files changed, 238 insertions(+), 1 deletion(-) diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-domain.h index e99bfb7654..357d3598a6 100644 --- a/include/libvirt/libvirt-domain.h +++ b/include/libvirt/libvirt-domain.h @@ -5152,4 +5152,24 @@ int virDomainStartDirtyRateCalc(virDomainPtr domain, int seconds, unsigned int flags); +/** + * virDomainTlsCertificateType: + * the used scene of TLS certificates for doamin + */ +typedef enum { + VIR_DOMAIN_TLS_CERT_GRAPHICS_VNC = 0, + VIR_DOMAIN_TLS_CERT_GRAPHICS_SPICE = 1, + +# ifdef VIR_ENUM_SENTINELS + VIR_DOMAIN_TLS_CERT_LAST +# endif +} virDomainTlsCertificateType; + +int +virDomainReloadTlsCertificates(virDomainPtr domain, + unsigned int type, + virTypedParameterPtr params, + int nparams, + unsigned int flags); + #endif /* LIBVIRT_DOMAIN_H */ diff --git a/src/driver-hypervisor.h b/src/driver-hypervisor.h index d642af8a37..d0d4976441 100644 --- a/src/driver-hypervisor.h +++ b/src/driver-hypervisor.h @@ -1410,6 +1410,13 @@ typedef int int seconds, unsigned int flags); +typedef int +(*virDrvDomainReloadTlsCertificates)(virDomainPtr domain, + unsigned int type, + virTypedParameterPtr params, + int nparams, + unsigned int flags); + typedef struct _virHypervisorDriver virHypervisorDriver; /** @@ -1676,4 +1683,5 @@ struct _virHypervisorDriver { virDrvDomainAuthorizedSSHKeysSet domainAuthorizedSSHKeysSet; virDrvDomainGetMessages domainGetMessages; virDrvDomainStartDirtyRateCalc domainStartDirtyRateCalc; + virDrvDomainReloadTlsCertificates domainReloadTlsCertificates; }; diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c index 42c75f6cc5..1b6889ab49 100644 --- a/src/libvirt-domain.c +++ b/src/libvirt-domain.c @@ -13218,3 +13218,61 @@ virDomainStartDirtyRateCalc(virDomainPtr domain, virDispatchError(conn); return -1; } + +/** + * virDomainReloadTlsCertificates: + * @domain: a domain object. + * @type: a value of virDomainTlsCertificateType + * @params: pointer to TLS Certs parameter objects, must be NULL if not used + * @nparams: number of TLS Certs parameter objects, must be 0 if not used + * @flags: extra flags; not used yet, so callers should always pass 0 + * + * Notify domain reload its certificates with specified 'type' + * + * Returns 0 in case of success, -1 otherwise. + */ +int +virDomainReloadTlsCertificates(virDomainPtr domain, + unsigned int type, + virTypedParameterPtr params, + int nparams, + unsigned int flags) +{ + virConnectPtr conn; + + VIR_DOMAIN_DEBUG(domain, "certificate type=%u, params=%p, nparams=%d, flags=%x", + type, params, nparams, flags); + + virResetLastError(); + + virCheckDomainReturn(domain, -1); + conn = domain->conn; + + virCheckReadOnlyGoto(conn->flags, error); + virCheckNonNegativeArgGoto(nparams, error); + + if (type >= VIR_DOMAIN_TLS_CERT_LAST) { + virReportInvalidArg(type, + _("type must be less than %d"), + VIR_DOMAIN_TLS_CERT_LAST); + goto error; + } + + if (conn->driver->domainReloadTlsCertificates) { + int ret; + ret = conn->driver->domainReloadTlsCertificates(domain, + type, + params, + nparams, + flags); + if (ret < 0) + goto error; + return ret; + } + + virReportUnsupportedError(); + + error: + virDispatchError(domain->conn); + return -1; +} diff --git a/src/libvirt_public.syms b/src/libvirt_public.syms index 5678a13cda..30ff012958 100644 --- a/src/libvirt_public.syms +++ b/src/libvirt_public.syms @@ -896,4 +896,9 @@ LIBVIRT_7.3.0 { virNodeDeviceCreate; } LIBVIRT_7.2.0; +LIBVIRT_7.4.0 { + global: + virDomainReloadTlsCertificates; +} LIBVIRT_7.3.0; + # .... define new API here using predicted next version number .... diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index c90d52edc0..422a350c65 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -20449,6 +20449,45 @@ qemuDomainStartDirtyRateCalc(virDomainPtr dom, return ret; } +static int +qemuDomainReloadTlsCertificates(virDomainPtr domain, + unsigned int type, + virTypedParameterPtr params, + int nparams, + unsigned int flags) +{ + int ret = -1; + virQEMUDriver *driver = domain->conn->privateData; + virDomainObj *vm = qemuDomObjFromDomain(domain); + + if (!vm) + goto cleanup; + + virCheckNonNullArgGoto(params, cleanup); + if (nparams != 0) { + virReportInvalidZeroArg(nparams); + goto cleanup; + } + virCheckFlagsGoto(0, cleanup); + + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0) + goto cleanup; + + if (!virDomainObjIsActive(vm)) { + virReportError(VIR_ERR_OPERATION_INVALID, + "%s", _("domain is not running")); + goto endjob; + } + + ret = qemuDomainReloadTLSCerts(driver, vm, type); + + endjob: + qemuDomainObjEndJob(driver, vm); + + cleanup: + virDomainObjEndAPI(&vm); + return ret; +} static virHypervisorDriver qemuHypervisorDriver = { .name = QEMU_DRIVER_NAME, @@ -20693,6 +20732,7 @@ static virHypervisorDriver qemuHypervisorDriver = { .domainAuthorizedSSHKeysSet = qemuDomainAuthorizedSSHKeysSet, /* 6.10.0 */ .domainGetMessages = qemuDomainGetMessages, /* 7.1.0 */ .domainStartDirtyRateCalc = qemuDomainStartDirtyRateCalc, /* 7.2.0 */ + .domainReloadTlsCertificates = qemuDomainReloadTlsCertificates, /* 7.4.0 */ }; diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index a64cddb9e7..34dc035d73 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -6704,3 +6704,20 @@ qemuDomainSetVcpuInternal(virQEMUDriver *driver, virBitmapFree(livevcpus); return ret; } + +int qemuDomainReloadTLSCerts(virQEMUDriverPtr driver, + virDomainObjPtr vm, + unsigned int type) +{ + int ret = -1; + qemuDomainObjPrivate *priv = vm->privateData; + + qemuDomainObjEnterMonitor(driver, vm); + + ret = qemuMonitorDisplayReloadTLSCerts(priv->mon, type); + + if (qemuDomainObjExitMonitor(driver, vm) < 0) + ret = -1; + + return ret; +} diff --git a/src/qemu/qemu_hotplug.h b/src/qemu/qemu_hotplug.h index df8f76f8d6..411741a688 100644 --- a/src/qemu/qemu_hotplug.h +++ b/src/qemu/qemu_hotplug.h @@ -160,3 +160,7 @@ int qemuHotplugAttachDBusVMState(virQEMUDriver *driver, int qemuHotplugRemoveDBusVMState(virQEMUDriver *driver, virDomainObj *vm, qemuDomainAsyncJob asyncJob); + +int qemuDomainReloadTLSCerts(virQEMUDriverPtr driver, + virDomainObjPtr vm, + unsigned int type); diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index 1e6f892e08..11f8cc8670 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -4746,3 +4746,30 @@ qemuMonitorQueryDirtyRate(qemuMonitor *mon, return qemuMonitorJSONQueryDirtyRate(mon, info); } + +static const char * +qemuMonitorTLSCertificateTypeToString(unsigned int type) +{ + switch (type) { + /* for now, only VNC is supported */ + case VIR_DOMAIN_TLS_CERT_GRAPHICS_VNC: + return "vnc"; + default: + virReportError(VIR_ERR_INVALID_ARG, + _("unsupported qemu certificate type %u"), + type); + return NULL; + } +} + +int +qemuMonitorDisplayReloadTLSCerts(qemuMonitorPtr mon, unsigned int type) +{ + const char *certType = qemuMonitorTLSCertificateTypeToString(type); + if (!certType) + return -1; + + QEMU_CHECK_MONITOR(mon); + + return qemuMonitorJSONDisplayReload(mon, certType, true); +} diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h index 6a25def78b..f26f92fb51 100644 --- a/src/qemu/qemu_monitor.h +++ b/src/qemu/qemu_monitor.h @@ -1496,3 +1496,6 @@ struct _qemuMonitorDirtyRateInfo { int qemuMonitorQueryDirtyRate(qemuMonitor *mon, qemuMonitorDirtyRateInfo *info); + +int qemuMonitorDisplayReloadTLSCerts(qemuMonitorPtr mon, + unsigned int type); diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index 46aa3330a8..9934613cc2 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -9446,3 +9446,30 @@ qemuMonitorJSONQueryDirtyRate(qemuMonitor *mon, return qemuMonitorJSONExtractDirtyRateInfo(data, info); } + +int qemuMonitorJSONDisplayReload(qemuMonitorPtr mon, + const char *type, + bool tlsCerts) +{ + int ret = -1; + virJSONValuePtr reply = NULL; + virJSONValuePtr cmd = qemuMonitorJSONMakeCommand("display-reload", + "s:type", type, + "b:tls-certs", tlsCerts, + NULL); + if (!cmd) + return -1; + + if (qemuMonitorJSONCommand(mon, cmd, &reply) < 0) + goto cleanup; + + if (qemuMonitorJSONCheckError(cmd, reply) < 0) + goto cleanup; + + ret = 0; + + cleanup: + virJSONValueFree(cmd); + virJSONValueFree(reply); + return ret; +} diff --git a/src/qemu/qemu_monitor_json.h b/src/qemu/qemu_monitor_json.h index 01a3ba25f1..73761d54f8 100644 --- a/src/qemu/qemu_monitor_json.h +++ b/src/qemu/qemu_monitor_json.h @@ -706,3 +706,7 @@ qemuMonitorJSONStartDirtyRateCalc(qemuMonitor *mon, int qemuMonitorJSONQueryDirtyRate(qemuMonitor *mon, qemuMonitorDirtyRateInfo *info); + +int qemuMonitorJSONDisplayReload(qemuMonitorPtr mon, + const char *type, + bool tlsCerts); diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 0c72d69933..0e6e4e3007 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -8566,6 +8566,7 @@ static virHypervisorDriver hypervisor_driver = { .domainAuthorizedSSHKeysSet = remoteDomainAuthorizedSSHKeysSet, /* 6.10.0 */ .domainGetMessages = remoteDomainGetMessages, /* 7.1.0 */ .domainStartDirtyRateCalc = remoteDomainStartDirtyRateCalc, /* 7.2.0 */ + .domainReloadTlsCertificates = remoteDomainReloadTlsCertificates, /* 7.4.0 */ }; static virNetworkDriver network_driver = { diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index de69704b68..c13b3e1f5c 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -286,6 +286,8 @@ const REMOTE_DOMAIN_AUTHORIZED_SSH_KEYS_MAX = 2048; /* Upper limit on number of messages */ const REMOTE_DOMAIN_MESSAGES_MAX = 2048; +/* Upper limit on list of TLS certificate parameters */ +const REMOTE_DOMAIN_RELOAD_TLS_CERT_PARAMETERS_MAX = 16; /* UUID. VIR_UUID_BUFLEN definition comes from libvirt.h */ typedef opaque remote_uuid[VIR_UUID_BUFLEN]; @@ -3836,6 +3838,12 @@ struct remote_domain_start_dirty_rate_calc_args { unsigned int flags; }; +struct remote_domain_reload_tls_certificates_args { + remote_nonnull_domain dom; + unsigned int type; + remote_typed_param params<REMOTE_DOMAIN_RELOAD_TLS_CERT_PARAMETERS_MAX>; + unsigned int flags; +}; /*----- Protocol. -----*/ @@ -6784,6 +6792,11 @@ enum remote_procedure { * @priority: high * @acl: node_device:start */ - REMOTE_PROC_NODE_DEVICE_CREATE = 430 + REMOTE_PROC_NODE_DEVICE_CREATE = 430, + /** + * @generate: both + * @acl: domain:write + */ + REMOTE_PROC_DOMAIN_RELOAD_TLS_CERTIFICATES = 431 }; diff --git a/src/remote_protocol-structs b/src/remote_protocol-structs index 6b46328adc..799a8596ea 100644 --- a/src/remote_protocol-structs +++ b/src/remote_protocol-structs @@ -3192,6 +3192,15 @@ struct remote_domain_start_dirty_rate_calc_args { int seconds; u_int flags; }; +struct remote_domain_reload_tls_certificates_args { + remote_nonnull_domain dom; + u_int type; + struct { + u_int params_len; + remote_typed_param * params_val; + } params; + u_int flags; +}; enum remote_procedure { REMOTE_PROC_CONNECT_OPEN = 1, REMOTE_PROC_CONNECT_CLOSE = 2, @@ -3623,4 +3632,5 @@ enum remote_procedure { REMOTE_PROC_NODE_DEVICE_DEFINE_XML = 428, REMOTE_PROC_NODE_DEVICE_UNDEFINE = 429, REMOTE_PROC_NODE_DEVICE_CREATE = 430, + REMOTE_PROC_DOMAIN_RELOAD_TLS_CERTIFICATES = 431, }; -- 2.25.1

2 1

[PATCH] securityselinuxhelper: Fix retval of setcon_raw() and security_disable()
by Michal Privoznik 10 May '21

10 May '21

The securityselinuxhelper is a mock that's replacing libselinux APIs with our own implementation to achieve deterministic results. Our implementation uses env vars (among other things) to hold internal state. For instance, "FAKE_SELINUX_CONTEXT" and "FAKE_SELINUX_DISABLED" variables are used. However, as we were switching from setenv() to g_setenv() we also changed the set of possible retvals from setcon_raw() and security_disable(). Previously, the retval of setenv() was used directly which returns 0 on success and -1 on error. But g_setenv() has different retval semantics: it returns 1 on success and 0 on error. This discrepancy can be observed by running viridentitytest where case #2 reports an error ("!") - because setcon_raw() returns 1. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tests/securityselinuxhelper.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/securityselinuxhelper.c b/tests/securityselinuxhelper.c index b308ef5095..c3d6505ef2 100644 --- a/tests/securityselinuxhelper.c +++ b/tests/securityselinuxhelper.c @@ -140,7 +140,7 @@ int setcon_raw(const char *context) errno = EINVAL; return -1; } - return g_setenv("FAKE_SELINUX_CONTEXT", context, TRUE); + return g_setenv("FAKE_SELINUX_CONTEXT", context, TRUE) == TRUE ? 0 : -1; } int setcon(const char *context) @@ -219,7 +219,7 @@ int security_disable(void) return -1; } - return g_setenv("FAKE_SELINUX_DISABLED", "1", TRUE); + return g_setenv("FAKE_SELINUX_DISABLED", "1", TRUE) == TRUE ? 0 : -1; } int security_getenforce(void) -- 2.26.3

2 1

[libvirt PATCH v3 0/8] cleanup meson checks for runtime binaries
by Pavel Hrdina 10 May '21

10 May '21

Recent attempt to add a lot of meson options to specify different runtime paths motivated me enough to cleanup this from meson. Changes in v3: - some patches were already pushed - removed patch that moved virFindFileInPath from testutilsqemu.c Changes in v2: - split and rework patch 16/17 to address review comments - added a new patch to cleanup libvirt.spec.in file Pavel Hrdina (8): virfile: introduce virFindFileInPathFull() qemu_conf: use virFindFileInPathFull for runtime binaries meson: drop check for runtime binary dependencies meson: move iscsiadm check into storage_iscsi condition meson: stop setting runtime binaries defines during compilation meson: use runtime binaries to only resolve features with "auto" value meson: optional_programs should be used only for building libvirt libvirt.spec: drop no longer required build dependencies libvirt.spec.in | 31 ---- meson.build | 214 +++++++++---------------- src/bhyve/bhyve_command.c | 4 + src/libvirt_private.syms | 2 +- src/locking/lock_driver_lockd.c | 12 +- src/network/bridge_driver.c | 2 + src/node_device/node_device_driver.c | 2 + src/qemu/qemu_conf.c | 23 ++- src/storage/storage_backend_logical.c | 13 ++ src/storage/storage_backend_sheepdog.c | 2 + src/storage/storage_backend_zfs.c | 3 + src/storage/storage_util.c | 2 + src/storage/storage_util.h | 6 + src/util/virdnsmasq.c | 1 + src/util/virfile.c | 16 +- src/util/virfile.h | 5 +- src/util/virfirewall.h | 4 + src/util/viriscsi.h | 2 + src/util/virkmod.h | 3 + src/util/virnetdevbandwidth.h | 2 + src/util/virnetdevip.c | 2 + src/util/virnetdevmidonet.c | 2 + src/util/virnetdevopenvswitch.c | 2 + src/util/virnuma.c | 1 + src/util/virsysinfo.c | 1 + src/util/virutil.c | 2 + tests/testutilsqemu.c | 3 +- tests/virfirewallmock.c | 3 +- 28 files changed, 173 insertions(+), 192 deletions(-) -- 2.30.2

1 9

[PATCH v3 0/1] qemu: add support for max-ram-below-4g option
by Zhiyong Ye 10 May '21

10 May '21

For background, see: https://listman.redhat.com/archives/libvir-list/2021-April/msg01196.html V3 to V2: * Fix conflicts created by git pull V2 to V1: * Change the 'below4g' attribute to not share the 'unit' argument with actual memory size, and let its unit default to KiB * Add docs and test changes * Add check in the ABI stability checker code Zhiyong Ye (1): qemu: add support for max-ram-below-4g option docs/formatdomain.rst | 10 ++++++-- docs/schemas/domaincommon.rng | 5 ++++ src/conf/domain_conf.c | 15 ++++++++++++ src/conf/domain_conf.h | 3 +++ src/conf/domain_validate.c | 13 ++++++++++ src/qemu/qemu_command.c | 4 ++++ tests/qemuxml2argvdata/memory-below4g.args | 29 ++++++++++++++++++++++ tests/qemuxml2argvdata/memory-below4g.xml | 26 ++++++++++++++++++++ tests/qemuxml2argvtest.c | 1 + tests/qemuxml2xmloutdata/memory-below4g.xml | 37 +++++++++++++++++++++++++++++ tests/qemuxml2xmltest.c | 1 + 11 files changed, 142 insertions(+), 2 deletions(-) create mode 100644 tests/qemuxml2argvdata/memory-below4g.args create mode 100644 tests/qemuxml2argvdata/memory-below4g.xml create mode 100644 tests/qemuxml2xmloutdata/memory-below4g.xml -- 2.11.0

1 1

After blockcopy with pivot, a dirty-bitmap is added, but not been removed automatically.
by ChangLimin 10 May '21

10 May '21

Hi Peter, Since https://libvirt.org/git/?p=libvirt.git;a=commitdiff;h=7bfff40fdfe5410c446c1…, after blockcopy with pivot, a dirty-bitmap is added, but not been removed automatically. Is that something wrong? 0. start a vm, and switch on some traces # virsh start cirros # virsh qemu-monitor-command cirros --hmp "trace-event handle_qmp* on" # virsh qemu-monitor-command cirros --hmp "trace-event hbitmap* on" 1. cirros0.img is opened. # virsh domblklist cirros Target Source ------------------------------------ vda /vms/images1/cirros0.img 2. blockcopy and pivot to cirros1.img # virsh blockcopy cirros vda --dest /vms/images1/cirros1.img --pivot --transient-job Successfully pivoted 3. cirros1.img is opened # virsh domblklist cirros Target Source ------------------------------------ vda /vms/images1/cirros1.img 4. From qemu log, a dirty-bitmap is added @1620475221.389151 77998@1620475125.281656:handle_qmp_command mon 0x55ebd4b176b0 req: {"execute": "human-monitor-command", "arguments": {"command-line": "trace-event qmp_job* on"}, "id": "libvirt-380"} 77998@1620475125.299950:handle_qmp_command mon 0x55ebd4b176b0 req: {"execute": "human-monitor-command", "arguments": {"command-line": "trace-event mirror* on"}, "id": "libvirt-381"} 77998@1620475125.317931:handle_qmp_command mon 0x55ebd4b176b0 req: {"execute": "human-monitor-command", "arguments": {"command-line": "trace-event hbitmap* on"}, "id": "libvirt-382"} 77998@1620475217.640133:handle_qmp_command mon 0x55ebd4b176b0 req: {"execute": "query-named-block-nodes", "arguments": {"flat": true}, "id": "libvirt-383"} 77998@1620475217.642025:handle_qmp_command mon 0x55ebd4b176b0 req: {"execute": "blockdev-add", "arguments": {"node-name": "libvirt-2-storage", "driver": "file", "filename": "/vms/images1/cirros1.img", "auto-read-only": true, "aio": "native", "cache": {"no-flush": false, "direct": true}, "discard": "unmap"}, "id": "libvirt-384"} 77998@1620475217.643434:handle_qmp_command mon 0x55ebd4b176b0 req: {"execute": "blockdev-create", "arguments": {"job-id": "create-libvirt-2-format", "options": {"driver": "qcow2", "cluster-size": 65536, "size": 46137344, "file": "libvirt-2-storage"}}, "id": "libvirt-385"} 77998@1620475217.827378:handle_qmp_command mon 0x55ebd4b176b0 req: {"execute": "query-jobs", "id": "libvirt-386"} 77998@1620475217.827980:handle_qmp_command mon 0x55ebd4b176b0 req: {"execute": "job-dismiss", "arguments": {"id": "create-libvirt-2-format"}, "id": "libvirt-387"} 77998@1620475217.850802:handle_qmp_command mon 0x55ebd4b176b0 req: {"execute": "blockdev-add", "arguments": {"backing": null, "node-name": "libvirt-2-format", "driver": "qcow2", "read-only": false, "cache": {"no-flush": false, "direct": true}, "file": "libvirt-2-storage"}, "id": "libvirt-388"} 77998@1620475217.853157:handle_qmp_command mon 0x55ebd4b176b0 req: {"execute": "blockdev-mirror", "arguments": {"auto-finalize": true, "device": "libvirt-1-format", "auto-dismiss": false, "sync": "full", "job-id": "copy-vda-libvirt-1-format", "target": "libvirt-2-format"}, "id": "libvirt-389"} 77998@1620475217.871674:handle_qmp_command mon 0x55ebd4b176b0 req: {"execute": "query-block-jobs", "id": "libvirt-390"} 77998@1620475221.387625:handle_qmp_command mon 0x55ebd4b176b0 req: {"execute": "query-block-jobs", "id": "libvirt-396"} 77998@1620475221.389151:handle_qmp_command mon 0x55ebd4b176b0 req: {"execute": "transaction", "arguments": {"actions": [{"type": "block-dirty-bitmap-add", "data": {"name": "libvirt-tmp-activewrite", "persistent": false, "node": "libvirt-2-format", "disabled": false}}]}, "id": "libvirt-397"} 77998@1620475221.389755:handle_qmp_command mon 0x55ebd4b176b0 req: {"execute": "job-complete", "arguments": {"id": "copy-vda-libvirt-1-format"}, "id": "libvirt-398"} 77998@1620475221.391321:handle_qmp_command mon 0x55ebd4b176b0 req: {"execute": "query-jobs", "id": "libvirt-399"} 77998@1620475221.391926:handle_qmp_command mon 0x55ebd4b176b0 req: {"execute": "job-dismiss", "arguments": {"id": "copy-vda-libvirt-1-format"}, "id": "libvirt-400"} 77998@1620475221.393052:handle_qmp_command mon 0x55ebd4b176b0 req: {"execute": "blockdev-del", "arguments": {"node-name": "libvirt-1-format"}, "id": "libvirt-401"} 77998@1620475221.393702:handle_qmp_command mon 0x55ebd4b176b0 req: {"execute": "blockdev-del", "arguments": {"node-name": "libvirt-1-storage"}, "id": "libvirt-402"} Also there are many hbitmap_xx events. 5. I have debuged the source, in qemuBlockJobProcessEventCompletedCopyBitmaps , QEMU_CAPS_BLOCKDEV_REOPEN cap is not supported unti the latest qemu. So the bitmap is not removed. Is the QEMU_CAPS_BLOCKDEV_REOPEN cap be must? Regards, Chang Limin

1 0

[PATCH v2 0/1] qemu: add support for max-ram-below-4g option
by Zhiyong Ye 10 May '21

10 May '21

Hi all, Sorry to bother again. Since I'm new to the libvirt community, and also this is my first time to submit patches, I'm truly sorry for the format problems that I emailed before. Could you kindly help me review it again, and let me know if there is anything I need to change. For background, see: https://listman.redhat.com/archives/libvir-list/2021-April/msg01196.html Changes since V1: * Change the 'below4g' attribute to not share the 'unit' argument with actual memory size, and let its unit default to KiB * Add docs and test changes * Add check in the ABI stability checker code Best regards! Zhiyong Ye Zhiyong Ye (1): qemu: add support for max-ram-below-4g option docs/formatdomain.rst | 10 ++++++-- docs/schemas/domaincommon.rng | 5 ++++ src/conf/domain_conf.c | 15 ++++++++++++ src/conf/domain_conf.h | 3 +++ src/conf/domain_validate.c | 13 ++++++++++ src/qemu/qemu_command.c | 4 ++++ tests/qemuxml2argvdata/memory-below4g.args | 29 ++++++++++++++++++++++ tests/qemuxml2argvdata/memory-below4g.xml | 26 ++++++++++++++++++++ tests/qemuxml2argvtest.c | 1 + tests/qemuxml2xmloutdata/memory-below4g.xml | 37 +++++++++++++++++++++++++++++ tests/qemuxml2xmltest.c | 1 + 11 files changed, 142 insertions(+), 2 deletions(-) create mode 100644 tests/qemuxml2argvdata/memory-below4g.args create mode 100644 tests/qemuxml2argvdata/memory-below4g.xml create mode 100644 tests/qemuxml2xmloutdata/memory-below4g.xml -- 2.11.0

2 3

[libvirt PATCH 0/3] cpu-data.py: Add support for kcpuid
by Tim Wiederhake 07 May '21

07 May '21

Linux 5.13 introduces "kcpuid", a tool similar to cpuid, which we depend on for cpu-data collection with tests/cputestdata/cpu-data.py. This series adds support for kcpuid to cpu-data.py. See also https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/too… /arch/x86/kcpuid and https://lore.kernel.org/lkml/1614928878-86075-1-git-send-email-feng.tang@in… l.com/ Tim Wiederhake (3): cpu-data.py: Factor out cpuid parsing cpu-data.py: Parse kcpuid output cpu-data.py: Automatically adjust command line for kcpuid tests/cputestdata/cpu-data.py | 95 +++++++++++++++++++++++++++-------- 1 file changed, 75 insertions(+), 20 deletions(-) --=20 2.26.3

2 5

[libvirt PATCH 0/9] make internal only secrets work with split daemons
by Daniel P. Berrangé 07 May '21

07 May '21

If you define a secret with private="yes", then libvirt won't let any client query the secret value after it is set. Only other libvirt drivers inside the daemon can query it by passing a special internal only flag to the virSecretGetValue API. The remote driver/daemon refuses to let this internal flag go over the wire preventing normal clients from using it This doesn't work with the split daemons because the virSecretGetValue API done by virqemud / virtstoraged has to go over the wire to reach the virsecretd. We need to come up with an alternative way to "prove" that the caller of virSecretGetValue is a libvirt daemon, as opposed to a general libvirt client. Note with if only traditional POSIX DAC permissions are in effect then we could consider it pointless trying to restrict access to clients running the same user/group as the libvirt daemon. We ought to take into account that the client might be confined by SELinux though, so the "private secret" concept isn't entirely pointless. Thus doing a simple uid of client == uid of daemon check is a bit too weak. The UID check might also not fly if the modular daemons are run inside containers with user namespaces, as the container for virtsecretd and virtqemud might have different user mappings in theory. This series adds a concept of a "token" which is known only to the libvirt daemons. The first daemon to use it writes a random hex string to /var/run/libvirt/common/system.token. Other daemons can read and compare this. Unless a MAC system is present this is still largely security theatre, but that's not really worse than the historical behaviour. When an API call is made the virIdentity by default reflects the identity of the UNIX process that initiated it. When connecting to virtproxyd, the client apps' identity is forwarded to the next virtNNNNd daemon. When libvirt drivers, however, initiate an API call we never set any identity. With monolithic libvirtd, they'd inherit the current client identity automagically since it was all in the same thread local. With modular daemons the othe driver would see the identity of the other libvirt daemon which is bad as this gives elevated privileges in the ACL check. Thus we fix the code which drivers use to open a connection to other daemons, such that it applies the current caller's identity. It does this using an "elevated" identity though, which means, we have added in the system token. Thus the virtsecretd daemon getting the call virSecretGetValue sees the virIdentity reflecting the client application which originally called the virDomainCreate() API, but with the system token set. Thus virsecretd can see that the virSecretGetValue was invoked by another daemon, not a libvirt client app. Daniel P. Berrangé (9): util: add virRandomToken API util: introduce concept of a system token into identities util: generate a persistent system token src: set system token for system identity util: add API for copying identity objects util: add method for getting the current identity with system token src: add API to determine if current identity is a system identity secret: rework handling of private secrets src: set identity when opening secondary drivers src/driver-secret.h | 9 +- src/driver.c | 27 +++++ src/libvirt-secret.c | 2 +- src/libvirt_private.syms | 5 + src/remote/remote_driver.c | 8 +- src/secret/secret_driver.c | 34 ++++-- src/util/viridentity.c | 230 +++++++++++++++++++++++++++++++++++++ src/util/viridentity.h | 7 ++ src/util/virrandom.c | 18 +++ src/util/virrandom.h | 1 + src/util/virsecret.c | 3 +- tests/qemuxml2argvtest.c | 3 +- 12 files changed, 320 insertions(+), 27 deletions(-) -- 2.31.1

2 20

[libvirt PATCH 0/2] rST-ify and rewrite a couple of block layer-related docs
by Kashyap Chamarthy 07 May '21

07 May '21

I've cleaned up these two wiki articles that I wrote a while ago and turned them into rST. https://wiki.libvirt.org/page/Live-disk-backup-with-active-blockcommit https://wiki.libvirt.org/page/Live-merge-an-entire-disk-image-chain-includi… Once this series merges, I'll make the above two wiki pages point to the kbase docs. Kashyap Chamarthy (2): docs: kbase: Add a doc on live full disk backup docs: kbase: Add a doc on merging disk image chains docs/kbase/index.rst | 6 + docs/kbase/live_full_disk_backup.rst | 111 +++++++++++++ docs/kbase/merging_disk_image_chains.rst | 197 +++++++++++++++++++++++ 3 files changed, 314 insertions(+) create mode 100644 docs/kbase/live_full_disk_backup.rst create mode 100644 docs/kbase/merging_disk_image_chains.rst -- 2.30.2

3 8

[PATCH v1] Introduce virDomainReloadTLSCertificates API
by Yanzheng (A) 07 May '21

07 May '21

Introduce a new virDomainReloadTLSCertificates API for notify domain reload its certificates without restart, and avoid service interruption. Take reload QEMU VNC TLS certificates as an example, we can call: virDomainReloadTLSCertificates(dom, VIR_DOMAIN_TLS_CERT_GRAPHICS_VNC) Then the specified QMP message would be send to QEMU: {"execute": "display-reload", "arguments":{"type": "vnc", "tls-certs": true}} Refers: https://gitlab.com/qemu-project/qemu/-/commit/9cc07651655ee86eca41059f5ead8… --- include/libvirt/libvirt-domain.h | 17 ++++++++++++++++ src/driver-hypervisor.h | 5 +++++ src/libvirt-domain.c | 33 ++++++++++++++++++++++++++++++++ src/qemu/qemu_driver.c | 11 +++++++++++ src/qemu/qemu_hotplug.c | 21 ++++++++++++++++++++ src/qemu/qemu_hotplug.h | 4 ++++ src/qemu/qemu_monitor.c | 10 ++++++++++ src/qemu/qemu_monitor.h | 3 +++ src/qemu/qemu_monitor_json.c | 22 +++++++++++++++++++++ src/qemu/qemu_monitor_json.h | 3 +++ 10 files changed, 129 insertions(+) diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-domain.h index e99bfb7654..aeb33d69d9 100644 --- a/include/libvirt/libvirt-domain.h +++ b/include/libvirt/libvirt-domain.h @@ -5152,4 +5152,21 @@ int virDomainStartDirtyRateCalc(virDomainPtr domain, int seconds, unsigned int flags); +/** + * virDomainTLSCertificaType: + * + * the used scene of TLS certificates for doamin. + */ +typedef enum { + VIR_DOMAIN_TLS_CERT_GRAPHICS_VNC = 0, + VIR_DOMAIN_TLS_CERT_GRAPHICS_SPICE = 1, + + VIR_DOMAIN_TLS_CERT_LAST +} virDomainTLSCertificaType; + +int +virDomainReloadTLSCertificates(virDomainPtr domain, + unsigned int type); + + #endif /* LIBVIRT_DOMAIN_H */ diff --git a/src/driver-hypervisor.h b/src/driver-hypervisor.h index d642af8a37..8de2bc4137 100644 --- a/src/driver-hypervisor.h +++ b/src/driver-hypervisor.h @@ -1410,6 +1410,10 @@ typedef int int seconds, unsigned int flags); +typedef int +(*virDrvDomainReloadTLSCertificates)(virDomainPtr domain, + unsigned int type); + typedef struct _virHypervisorDriver virHypervisorDriver; /** @@ -1676,4 +1680,5 @@ struct _virHypervisorDriver { virDrvDomainAuthorizedSSHKeysSet domainAuthorizedSSHKeysSet; virDrvDomainGetMessages domainGetMessages; virDrvDomainStartDirtyRateCalc domainStartDirtyRateCalc; + virDrvDomainReloadTLSCertificates domainiReloadTLSCertificates; }; diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c index 42c75f6cc5..fb9e5ec2d1 100644 --- a/src/libvirt-domain.c +++ b/src/libvirt-domain.c @@ -13218,3 +13218,36 @@ virDomainStartDirtyRateCalc(virDomainPtr domain, virDispatchError(conn); return -1; } + +/** + * virDomainReloadTLSCertificates: + * @domain: a domain object. + * @type: a value of virDomainTLSCertificaType + * + * Notify domain reload its certificates with specified 'type'. + * + * Returns 0 in case of success, -1 otherwise . + */ +int +virDomainReloadTLSCertificates(virDomainPtr domain, + unsigned int type) +{ + virConnectPtr conn; + VIR_DOMAIN_DEBUG(domain, "certificate type=%d", type); + virResetLastError(); + virCheckDomainReturn(domain, -1); + conn = domain->conn; + if (type >= VIR_DOMAIN_TLS_CERT_LAST) + goto error; + if (conn->driver->domainiReloadTLSCertificates) { + int ret; + ret = conn->driver->domainiReloadTLSCertificates(domain, type); + if (ret < 0) + goto error; + return ret; + } + virReportUnsupportedError(); + error: + virDispatchError(domain->conn); + return -1; +} diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index c90d52edc0..61cd8cfa24 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -20449,6 +20449,16 @@ qemuDomainStartDirtyRateCalc(virDomainPtr dom, return ret; } +static int +qemuDomainReloadTLSCertificates(virDomainPtr domain, + unsigned int type) +{ + virQEMUDriver *driver = domain->conn->privateData; + virDomainObj *vm = qemuDomainObjFromDomain(domain); + if (!driver || !vm) + return -1; + return qemuDomainReloadTLSCerts(driver, vm, type); +} static virHypervisorDriver qemuHypervisorDriver = { .name = QEMU_DRIVER_NAME, @@ -20693,6 +20703,7 @@ static virHypervisorDriver qemuHypervisorDriver = { .domainAuthorizedSSHKeysSet = qemuDomainAuthorizedSSHKeysSet, /* 6.10.0 */ .domainGetMessages = qemuDomainGetMessages, /* 7.1.0 */ .domainStartDirtyRateCalc = qemuDomainStartDirtyRateCalc, /* 7.2.0 */ + .domainiReloadTLSCertificates = qemuDomainReloadTLSCertificates, /* 7.2.0 */ }; diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 444d89d64a..013d8728a0 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -6704,3 +6704,24 @@ qemuDomainSetVcpuInternal(virQEMUDriver *driver, virBitmapFree(livevcpus); return ret; } + +int qemuDomainReloadTLSCerts(virQEMUDriverPtr driver, + virDomainObjPtr vm, + int type) +{ + int ret = -1; + qemuDomainObjPrivate *priv = vm->privateData; + /* for now, only VNC is supported */ + if (type != VIR_DOMAIN_TLS_CERT_GRAPHICS_VNC) + virReportError(VIR_ERR_INVALID_ARG, + _("invalid certificate type=%d, only support VNC"), + type); + return ret; + } + if (qemuDomainObjEnterMonitorAsync(driver, vm, QEMU_ASYNC_JOB_NONE) < 0) + return ret; + ret = qemuMonitorReloadTLSCerts(priv->mon, type); + if (qemuDomainObjExitMonitor(driver, vm) < 0) + ret = -1; + return ret; +} diff --git a/src/qemu/qemu_hotplug.h b/src/qemu/qemu_hotplug.h index df8f76f8d6..44afe23f0a 100644 --- a/src/qemu/qemu_hotplug.h +++ b/src/qemu/qemu_hotplug.h @@ -160,3 +160,7 @@ int qemuHotplugAttachDBusVMState(virQEMUDriver *driver, int qemuHotplugRemoveDBusVMState(virQEMUDriver *driver, virDomainObj *vm, qemuDomainAsyncJob asyncJob); + +int qemuDomainReloadTLSCerts(virQEMUDriverPtr driver, + virDomainObjPtr vm, + int type); diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index 3a7f231ce0..952ef87a6b 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -4746,3 +4746,13 @@ qemuMonitorQueryDirtyRate(qemuMonitor *mon, return qemuMonitorJSONQueryDirtyRate(mon, info); } + +int +qemuMonitorReloadTLSCerts(qemuMonitorPtr mon, int type) +{ + const char *protocol = qemuMonitorTypeToProtocol(type); + if (!protocol) + return -1; + VIR_DEBUG("protocol=%s", protocol); + return qemuMonitorJSONReloadTLSCerts(mon, protocol); +} diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h index 6a25def78b..a5b702b023 100644 --- a/src/qemu/qemu_monitor.h +++ b/src/qemu/qemu_monitor.h @@ -1496,3 +1496,6 @@ struct _qemuMonitorDirtyRateInfo { int qemuMonitorQueryDirtyRate(qemuMonitor *mon, qemuMonitorDirtyRateInfo *info); + +int qemuMonitorReloadTLSCerts(qemuMonitorPtr mon, + int type); diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index 46aa3330a8..d2b06c4703 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -9446,3 +9446,25 @@ qemuMonitorJSONQueryDirtyRate(qemuMonitor *mon, return qemuMonitorJSONExtractDirtyRateInfo(data, info); } + +int qemuMonitorJSONReloadTLSCerts(qemuMonitorPtr mon, + const char *protocol) +{ + int ret = -1; + virJSONValuePtr reply = NULL; + virJSONValuePtr cmd = qemuMonitorJSONMakeCommand("display-reload", + "s:type", protocol, + "b:tls-certs", 1, + NULL); + if (!cmd) + return -1; + if (qemuMonitorJSONCommand(mon, cmd, &reply) < 0) + goto cleanup; + if (qemuMonitorJSONCheckError(cmd, reply) < 0) + goto cleanup; + ret = 0; + cleanup: + virJSONValueFree(cmd); + virJSONValueFree(reply); + return ret; +} diff --git a/src/qemu/qemu_monitor_json.h b/src/qemu/qemu_monitor_json.h index 01a3ba25f1..d9ad77e873 100644 --- a/src/qemu/qemu_monitor_json.h +++ b/src/qemu/qemu_monitor_json.h @@ -706,3 +706,6 @@ qemuMonitorJSONStartDirtyRateCalc(qemuMonitor *mon, int qemuMonitorJSONQueryDirtyRate(qemuMonitor *mon, qemuMonitorDirtyRateInfo *info); + +int qemuMonitorJSONReloadTLSCerts(qemuMonitorPtr mon, + const char *protocol); -- 2.25.1

2 2

[PATCH] virthread: Make sure virOnce() returns -1 on error
by Michal Privoznik 07 May '21

07 May '21

Since its introduction in v0.9.1~65 the virOnce() was expected to follow the usual retval logic (0 for success, a negative number for failure). However, that was never the case. On the other hand, looking into glibc and musl the pthread_once() never returns anything other than zero (uclibc-ng seems to not implement pthread_once()), therefore we never really hit any problem. But for code cleanliness (and to match POSIX documentation), let's change to code so that our retval logic is honoured. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/util/virthread.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/util/virthread.c b/src/util/virthread.c index 5ddbf7c49a..e89c1a09fb 100644 --- a/src/util/virthread.c +++ b/src/util/virthread.c @@ -39,7 +39,15 @@ int virOnce(virOnceControl *once, virOnceFunc init) { - return pthread_once(&once->once, init); + int ret; + + ret = pthread_once(&once->once, init); + if (ret != 0) { + errno = ret; + return -1; + } + + return 0; } -- 2.26.3

2 1

[PATCH v2] Add page_per_vq flag to the 'driver' element of virtio devices
by Gavi Teitz 07 May '21

07 May '21

https://bugzilla.redhat.com/show_bug.cgi?id=1925363 Add support for setting the page-per-vq flag, which is important for vdpa with vhost-user performance. Signed-off-by: Gavi Teitz <gavi(a)nvidia.com> --- docs/formatdomain.rst | 11 +++++- docs/schemas/domaincommon.rng | 5 +++ src/conf/domain_conf.c | 10 +++++ src/conf/domain_conf.h | 1 + src/qemu/qemu_command.c | 5 +++ src/qemu/qemu_hotplug.c | 1 + .../net-virtio-page-per-vq.x86_64-latest.args | 38 ++++++++++++++++++ tests/qemuxml2argvdata/net-virtio-page-per-vq.xml | 29 ++++++++++++++ tests/qemuxml2argvtest.c | 1 + .../net-virtio-page-per-vq.x86_64-latest.xml | 46 ++++++++++++++++++++++ tests/qemuxml2xmltest.c | 1 + 11 files changed, 147 insertions(+), 1 deletion(-) create mode 100644 tests/qemuxml2argvdata/net-virtio-page-per-vq.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/net-virtio-page-per-vq.xml create mode 100644 tests/qemuxml2xmloutdata/net-virtio-page-per-vq.x86_64-latest.xml diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index fa5c14f..ce7a537 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -5120,7 +5120,7 @@ Setting NIC driver-specific options <source network='default'/> <target dev='vnet1'/> <model type='virtio'/> - <driver name='vhost' txmode='iothread' ioeventfd='on' event_idx='off' queues='5' rx_queue_size='256' tx_queue_size='256'> + <driver name='vhost' txmode='iothread' ioeventfd='on' event_idx='off' queues='5' rx_queue_size='256' tx_queue_size='256' page_per_vq='on'> <host csum='off' gso='off' tso4='off' tso6='off' ecn='off' ufo='off' mrg_rxbuf='off'/> <guest csum='off' tso4='off' tso6='off' ecn='off' ufo='off'/> </driver> @@ -5215,6 +5215,15 @@ following attributes are available for the ``"virtio"`` NIC driver: only for ``vhostuser`` type. :since:`Since 3.7.0 (QEMU and KVM only)` **In general you should leave this option alone, unless you are very certain you know what you are doing.** +``page_per_vq`` + This optional attribute controls the layout of the notification capabilities + exposed to the guest. When enabled, each virtio queue will have a dedicated + page on the device BAR exposed to the guest. It is recommended to be used when + vDPA is enabled on the hypervisor, as it enables mapping the notification area + to the physical device, which is only supported in page granularity. The + default is determined by QEMU; as off. :since:`Since 7.4.0` + **In general you should leave this option alone, unless you are very certain + you know what you are doing.** virtio options For virtio interfaces, `Virtio-specific options <#elementsVirtio>`__ can also be set. ( :since:`Since 3.5.0` ) diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index a2e5c50..e61ad67 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -3463,6 +3463,11 @@ </attribute> </optional> <optional> + <attribute name="page_per_vq"> + <ref name="virOnOff"/> + </attribute> + </optional> + <optional> <attribute name="txmode"> <choice> <value>iothread</value> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index cb668d3..0e219ed 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -10948,6 +10948,12 @@ virDomainNetDefParseXML(virDomainXMLOption *xmlopt, def->driver.virtio.tx_queue_size = q; } + if ((tmpNode = virXPathNode("./driver", ctxt))) { + if (virXMLPropTristateSwitch(tmpNode, "page_per_vq", VIR_XML_PROP_NONE, + &def->driver.virtio.page_per_vq) < 0) + goto error; + } + if ((tmpNode = virXPathNode("./driver/host", ctxt))) { if (virXMLPropTristateSwitch(tmpNode, "csum", VIR_XML_PROP_NONE, &def->driver.virtio.host.csum) < 0) @@ -25221,6 +25227,10 @@ virDomainVirtioNetDriverFormat(virBuffer *buf, if (def->driver.virtio.tx_queue_size) virBufferAsprintf(buf, " tx_queue_size='%u'", def->driver.virtio.tx_queue_size); + if (def->driver.virtio.page_per_vq) { + virBufferAsprintf(buf, " page_per_vq='%s'", + virTristateSwitchTypeToString(def->driver.virtio.page_per_vq)); + } virDomainVirtioOptionsFormat(buf, def->virtio); } diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 85c318d..7aab565 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -1027,6 +1027,7 @@ struct _virDomainNetDef { virDomainNetVirtioTxModeType txmode; virTristateSwitch ioeventfd; virTristateSwitch event_idx; + virTristateSwitch page_per_vq; unsigned int queues; /* Multiqueue virtio-net */ unsigned int rx_queue_size; unsigned int tx_queue_size; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index ca2265c..3545ee9 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -3629,6 +3629,11 @@ qemuBuildNicDevStr(virDomainDef *def, if (net->driver.virtio.tx_queue_size) virBufferAsprintf(&buf, ",tx_queue_size=%u", net->driver.virtio.tx_queue_size); + if (net->driver.virtio.page_per_vq) { + virBufferAsprintf(&buf, ",page-per-vq=%s", + virTristateSwitchTypeToString(net->driver.virtio.page_per_vq)); + } + if (net->mtu) virBufferAsprintf(&buf, ",host_mtu=%u", net->mtu); diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 444d89d..a244709 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -3578,6 +3578,7 @@ qemuDomainChangeNet(virQEMUDriver *driver, olddev->driver.virtio.queues != newdev->driver.virtio.queues || olddev->driver.virtio.rx_queue_size != newdev->driver.virtio.rx_queue_size || olddev->driver.virtio.tx_queue_size != newdev->driver.virtio.tx_queue_size || + olddev->driver.virtio.page_per_vq != newdev->driver.virtio.page_per_vq || olddev->driver.virtio.host.csum != newdev->driver.virtio.host.csum || olddev->driver.virtio.host.gso != newdev->driver.virtio.host.gso || olddev->driver.virtio.host.tso4 != newdev->driver.virtio.host.tso4 || diff --git a/tests/qemuxml2argvdata/net-virtio-page-per-vq.x86_64-latest.args b/tests/qemuxml2argvdata/net-virtio-page-per-vq.x86_64-latest.args new file mode 100644 index 0000000..5a52595 --- /dev/null +++ b/tests/qemuxml2argvdata/net-virtio-page-per-vq.x86_64-latest.args @@ -0,0 +1,38 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/tmp/lib/domain--1-QEMUGuest1 \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/tmp/lib/domain--1-QEMUGuest1/.local/share \ +XDG_CACHE_HOME=/tmp/lib/domain--1-QEMUGuest1/.cache \ +XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \ +/usr/bin/qemu-system-i386 \ +-name guest=QEMUGuest1,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/tmp/lib/domain--1-QEMUGuest1/master-key.aes"}' \ +-machine pc,accel=tcg,usb=off,dump-guest-core=off,memory-backend=pc.ram \ +-cpu qemu64 \ +-m 214 \ +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-no-acpi \ +-boot strict=on \ +-device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \ +-blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \ +-device ide-hd,bus=ide.0,unit=0,drive=libvirt-1-format,id=ide0-0-0,bootindex=1 \ +-netdev user,id=hostnet0 \ +-device virtio-net-pci,page-per-vq=on,netdev=hostnet0,id=net0,mac=00:11:22:33:44:55,bus=pci.0,addr=0x2 \ +-audiodev id=audio1,driver=none \ +-device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3 \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxml2argvdata/net-virtio-page-per-vq.xml b/tests/qemuxml2argvdata/net-virtio-page-per-vq.xml new file mode 100644 index 0000000..e22ecd6 --- /dev/null +++ b/tests/qemuxml2argvdata/net-virtio-page-per-vq.xml @@ -0,0 +1,29 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='i686' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-i386</emulator> + <disk type='block' device='disk'> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='hda' bus='ide'/> + </disk> + <controller type='usb' index='0'/> + <interface type='user'> + <mac address='00:11:22:33:44:55'/> + <model type='virtio'/> + <driver page_per_vq='on'/> + </interface> + <memballoon model='virtio'/> + </devices> +</domain> diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index a9dafe2..3dc866a 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -1634,6 +1634,7 @@ mymain(void) QEMU_CAPS_VIRTIO_NET_TX_QUEUE_SIZE); DO_TEST_PARSE_ERROR("net-virtio-rxqueuesize-invalid-size", QEMU_CAPS_VIRTIO_NET_RX_QUEUE_SIZE); + DO_TEST_CAPS_LATEST("net-virtio-page-per-vq"); DO_TEST("net-virtio-teaming", QEMU_CAPS_VIRTIO_NET_FAILOVER, QEMU_CAPS_DEVICE_VFIO_PCI); diff --git a/tests/qemuxml2xmloutdata/net-virtio-page-per-vq.x86_64-latest.xml b/tests/qemuxml2xmloutdata/net-virtio-page-per-vq.x86_64-latest.xml new file mode 100644 index 0000000..34f7ee5 --- /dev/null +++ b/tests/qemuxml2xmloutdata/net-virtio-page-per-vq.x86_64-latest.xml @@ -0,0 +1,46 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='i686' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-i386</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0' model='piix3-uhci'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <controller type='pci' index='0' model='pci-root'/> + <controller type='ide' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/> + </controller> + <interface type='user'> + <mac address='00:11:22:33:44:55'/> + <model type='virtio'/> + <driver page_per_vq='on'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </interface> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </memballoon> + </devices> +</domain> diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c index 7af6f90..93f29d6 100644 --- a/tests/qemuxml2xmltest.c +++ b/tests/qemuxml2xmltest.c @@ -444,6 +444,7 @@ mymain(void) DO_TEST("net-virtio-rxtxqueuesize", QEMU_CAPS_VIRTIO_NET_RX_QUEUE_SIZE, QEMU_CAPS_VIRTIO_NET_TX_QUEUE_SIZE); + DO_TEST_CAPS_LATEST("net-virtio-page-per-vq"); DO_TEST("net-virtio-teaming", QEMU_CAPS_VIRTIO_NET_FAILOVER, QEMU_CAPS_DEVICE_VFIO_PCI); -- 1.8.3.1

4 4

[PATCH 00/17] conf: Fix and prevent uninitialized memory use with new virXMLProp* helpers
by Peter Krempa 06 May '21

06 May '21

Compilers aren't able to see that the value passed via a pointer from the new virXMLProp helpers may be uninitialized in certain cases. Fix 3 such cases, prepare the code and then ensure that the new virXMLProp* helpers always initialize the memory. CI pipeline (once it finishes) can be viewed at: https://gitlab.com/pipo.sk/libvirt/-/pipelines/298562552 Peter Krempa (17): util: xml: Extract implementation of xml property -> enum parsing to a common helper virXMLPropULongLong: Always initialize @result virDomainVcpuParse: Assign default vcpus count based on return value of virXMLPropUInt virDomainDiskDefDriverParseXML: Fix usage of virXMLPropUInt virXMLPropUInt: Always initialize @result conf: Define autoptr func for virDomainIOThreadIDDef virDomainIOThreadIDDefParseXML: Refactor cleanup virXMLPropInt: Always initialize '@result' virDomainBackupDiskDefParseXML: Fill default backup state after parsing it virXMLPropTristateBool: Always initialize '@result' conf: domain: Don't initialize virTristateBool local variables used for virXMLPropTristateBool virXMLPropTristateSwitch: Always initialize '@result' virDomainAudioCommonParse: Fix parsing of 'format' virDomainVideoDefParseXML: Fix parsing of 'backend' util: xml: Introduce virXMLPropEnumDefault conf: domain: Convert virXMLPropEnum to virXMLPropEnumDefault where we set defaults virXMLPropEnum: Always initialize '@result' src/conf/backup_conf.c | 5 +- src/conf/domain_conf.c | 176 ++++++++++++++++++++------------------- src/conf/domain_conf.h | 1 + src/libvirt_private.syms | 1 + src/util/virxml.c | 156 +++++++++++++++++++--------------- src/util/virxml.h | 14 +++- 6 files changed, 198 insertions(+), 155 deletions(-) -- 2.30.2

2 20

[libvirt PATCH 00/10] Refactor more XML parsing boilerplate code, part VIII
by Tim Wiederhake 06 May '21

06 May '21

For background, see https://listman.redhat.com/archives/libvir-list/2021-April/msg00668.html Note that patch #1 depends on https://listman.redhat.com/archives/libvir-list/2021-April/msg01260.html from part VII. Tim Wiederhake (10): virDomainRedirFilterUSBDevDefParseXML: Use g_auto* virDomainPerfEventDefParseXML: Use virXMLProp* virDomainMemoryDefParseXML: Use virXMLProp* virDomainVcpuPinDefParseXML: Use virXMLProp* virDomainIOThreadPinDefParseXML: Use virXMLProp* virDomainSchedulerParseCommonAttrs: Use virXMLProp* virDomainDef: Change type of placement_mode to virDomainCpuPlacementMode virDomainVcpuParse: Use virXMLProp* virDomainCachetuneDefParseCache: Use virXMLProp* virDomainResctrlMonDefParse: Use virXMLProp* src/conf/domain_conf.c | 300 +++++++++-------------------------------- src/conf/domain_conf.h | 2 +- 2 files changed, 63 insertions(+), 239 deletions(-) -- 2.26.3

2 11

[libvirt PATCH 00/10] Refactor more XML parsing boilerplate code, part VII
by Tim Wiederhake 06 May '21

06 May '21

For background, see https://listman.redhat.com/archives/libvir-list/2021-April/msg00668.html Tim Wiederhake (10): virDomainAudioIOCommon: Change type of format to virDomainAudioFormat virDomainAudioCommonParse: Use virXMLProp* virDomainMemballoonDef: Change type of model to virDomainMemballoonModel virDomainMemballoonDefParseXML: Use virXMLProp* virDomainShmemDef: Change type of model to virDomainShmemModel virDomainShmemDef: Change type of role to virDomainShmemRole virDomainShmemDefParseXML: Use virXMLProp* conf: domain: Register autoptr cleanup function for virDomainDeviceDef virDomainShmemDef: Use g_auto* virDomainRedirFilterUSBDevDefParseXML: Use virXMLProp* src/conf/domain_conf.c | 268 ++++++++++----------------------- src/conf/domain_conf.h | 9 +- src/libxl/libxl_conf.c | 8 +- src/qemu/qemu_command.c | 4 +- src/qemu/qemu_domain_address.c | 2 +- src/qemu/qemu_hotplug.c | 4 +- src/qemu/qemu_monitor.c | 2 +- src/qemu/qemu_validate.c | 5 + src/security/virt-aa-helper.c | 4 + 9 files changed, 100 insertions(+), 206 deletions(-) -- 2.26.3

3 22

[libvirt PATCH v3 0/4] Refactor more XML parsing boilerplate code, part VI
by Tim Wiederhake 06 May '21

06 May '21

For background, see https://listman.redhat.com/archives/libvir-list/2021-April/msg00668.html V1: https://listman.redhat.com/archives/libvir-list/2021-April/msg01184.html V2: https://listman.redhat.com/archives/libvir-list/2021-April/msg01238.html Changes since V2: * Rebased * Prepended patches to fix issues in the function * Removed superfluous "VIR_XML_PROP_NONE" Tim Wiederhake (4): virDomainFSDefParseXML: Remove unused variables virDomainGraphicsDefParseXMLSpice: Fix variable type virDomainGraphicsDefParseXMLSpice: Make name and mode mandatory virDomainGraphicsDefParseXMLSpice: Use virXMLProp* src/conf/domain_conf.c | 195 +++++++++++++++++------------------------ 1 file changed, 80 insertions(+), 115 deletions(-) -- 2.26.3

3 6

[PATCH RFC v5 00/12] Add riscv kvm accel support
by Yifei Jiang 06 May '21

06 May '21

This series adds both riscv32 and riscv64 kvm support, and implements migration based on riscv. It is based on temporarily unaccepted kvm: https://github.com/kvm-riscv/linux (lastest version v17). This series depends on above pending changes which haven't yet been accepted, so this QEMU patch series is treated as RFC patches until that dependency has been dealt with. Several steps to use this: 1. Build emulation $ ./configure --target-list=riscv64-softmmu $ make -j$(nproc) 2. Build kernel https://github.com/kvm-riscv/linux 3. Build QEMU VM Cross built in riscv toolchain. $ PKG_CONFIG_LIBDIR=<toolchain pkgconfig path> $ export PKG_CONFIG_SYSROOT_DIR=<toolchain sysroot path> $ ./configure --target-list=riscv64-softmmu --enable-kvm \ --cross-prefix=riscv64-linux-gnu- --disable-libiscsi --disable-glusterfs \ --disable-libusb --disable-usb-redir --audio-drv-list= --disable-opengl \ --disable-libxml2 $ make -j$(nproc) 4. Start emulation $ ./qemu-system-riscv64 -M virt -m 4096M -cpu rv64,x-h=true -nographic \ -name guest=riscv-hyp,debug-threads=on \ -smp 4 \ -bios ./fw_jump.bin \ -kernel ./Image \ -drive file=./hyp.img,format=raw,id=hd0 \ -device virtio-blk-device,drive=hd0 \ -append "root=/dev/vda rw console=ttyS0 earlycon=sbi" 5. Start kvm-acceled QEMU VM in emulation $ ./qemu-system-riscv64 -M virt,accel=kvm -m 1024M -cpu host -nographic \ -name guest=riscv-guset \ -smp 2 \ -bios none \ -kernel ./Image \ -drive file=./guest.img,format=raw,id=hd0 \ -device virtio-blk-device,drive=hd0 \ -append "root=/dev/vda rw console=ttyS0 earlycon=sbi" Changes since RFC v4 - Rebase on QEMU v6.0.0-rc2 and kvm-riscv linux v17. - Remove time scaling support as software solution is incomplete. Because it will cause unacceptable performance degradation. and We will post a better solution. - Revise according to Alistair's review comments. - Remove compile time XLEN checks in kvm_riscv_reg_id - Surround TYPE_RISCV_CPU_HOST definition by CONFIG_KVM and share it between RV32 and RV64. - Add kvm-stub.c for reduce unnecessary compilation checks. - Add riscv_setup_direct_kernel() to direct boot kernel for KVM. Changes since RFC v3 - Rebase on QEMU v5.2.0-rc2 and kvm-riscv linux v15. - Add time scaling support(New patches 13, 14 and 15). - Fix the bug that guest vm can't reboot. Changes since RFC v2 - Fix checkpatch error at target/riscv/sbi_ecall_interface.h. - Add riscv migration support. Changes since RFC v1 - Add separate SBI ecall interface header. - Add riscv32 kvm accel support. Yifei Jiang (12): linux-header: Update linux/kvm.h target/riscv: Add target/riscv/kvm.c to place the public kvm interface target/riscv: Implement function kvm_arch_init_vcpu target/riscv: Implement kvm_arch_get_registers target/riscv: Implement kvm_arch_put_registers target/riscv: Support start kernel directly by KVM hw/riscv: PLIC update external interrupt by KVM when kvm enabled target/riscv: Handle KVM_EXIT_RISCV_SBI exit target/riscv: Add host cpu type target/riscv: Add kvm_riscv_get/put_regs_timer target/riscv: Implement virtual time adjusting with vm state changing target/riscv: Support virtual time context synchronization hw/intc/sifive_plic.c | 29 +- hw/riscv/boot.c | 11 + hw/riscv/virt.c | 7 + include/hw/riscv/boot.h | 1 + linux-headers/linux/kvm.h | 97 +++++ meson.build | 2 + target/riscv/cpu.c | 17 + target/riscv/cpu.h | 10 + target/riscv/kvm-stub.c | 30 ++ target/riscv/kvm.c | 605 +++++++++++++++++++++++++++++ target/riscv/kvm_riscv.h | 25 ++ target/riscv/machine.c | 14 + target/riscv/meson.build | 1 + target/riscv/sbi_ecall_interface.h | 72 ++++ 14 files changed, 912 insertions(+), 9 deletions(-) create mode 100644 target/riscv/kvm-stub.c create mode 100644 target/riscv/kvm.c create mode 100644 target/riscv/kvm_riscv.h create mode 100644 target/riscv/sbi_ecall_interface.h -- 2.19.1

4 20

[PATCH 0/2] Couple of XML parsing fixes
by Michal Privoznik 05 May '21

05 May '21

Pipeline: https://gitlab.com/MichalPrivoznik/libvirt/-/pipelines/297747756 Michal Prívozník (2): virDomainChrSourceDefParseXML: Fix attribute names for nmdm type virDomainVideoDriverDefParseXML: Allow zero value for @vgaconf src/conf/domain_conf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) -- 2.26.3

2 4

[libvirt PATCH] gitlab: enable debug output for test suite
by Daniel P. Berrangé 05 May '21

05 May '21

When CI jobs fail on the test suite, we don't see much helpful information by default: stderr: TEST: bhyvexml2argvtest ......!!.............!......!........... 40 ........................!...... 71 FAIL Some tests failed. Run them using: VIR_TEST_DEBUG=1 VIR_TEST_RANGE=7-8,22,29,65 /tmp/cirrus-ci-build/build/meson-private/dist-build/tests/bhyvexml2argvtest Following the instructions to re-run the test with VIR_TEST_DEBUG=1 is great if running locally, but quite unfriendly for CI. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- Compare before: https://gitlab.com/libvirt/libvirt/-/jobs/1237988893 and after: https://gitlab.com/berrange/libvirt/-/jobs/1238324746 .gitlab-ci.yml | 2 ++ ci/cirrus/build.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 35ec626113..89f618e678 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -11,6 +11,8 @@ stages: export CCACHE_DIR="$CCACHE_BASEDIR/ccache" export CCACHE_MAXSIZE="500M" export PATH="$CCACHE_WRAPPERSDIR:$PATH" + export VIR_TEST_VERBOSE="1" + export VIR_TEST_DEBUG="1" # Common templates diff --git a/ci/cirrus/build.yml b/ci/cirrus/build.yml index 2d3c46a77c..f7ef5c2d13 100644 --- a/ci/cirrus/build.yml +++ b/ci/cirrus/build.yml @@ -9,6 +9,8 @@ env: PKG_CONFIG_PATH: "@PKG_CONFIG_PATH@" PYTHON: "@PYTHON@" MAKE: "@MAKE@" + VIR_TEST_VERBOSE: "1" + VIR_TEST_DEBUG: "1" build_task: install_script: -- 2.31.1

2 1

[PATCH] virDomainVideoDriverDefParseXML: Fix use of uninitialized variable
by Peter Krempa 05 May '21

05 May '21

Commit fc7e1b2f03cfe2a5f3fce737390548505382d8ed which refactored the video driver parse helper introduced a use of uninitialized variable, which caused test failure at least when compiled with clang. Pass 'def->vgaconf' directly to virXMLPropEnum. 'def' needs to be converted to use g_autofree to handle error scenarios. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- Pushed under the build-breaker fix rule. src/conf/domain_conf.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 64f525fc08..d5d8bd0a01 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -14313,8 +14313,7 @@ static virDomainVideoDriverDef * virDomainVideoDriverDefParseXML(xmlNodePtr node, xmlXPathContextPtr ctxt) { - virDomainVideoDriverDef *def; - unsigned int val; + g_autofree virDomainVideoDriverDef *def = NULL; xmlNodePtr driver = NULL; VIR_XPATH_NODE_AUTORESTORE(ctxt) @@ -14323,15 +14322,14 @@ virDomainVideoDriverDefParseXML(xmlNodePtr node, if (!(driver = virXPathNode("./driver", ctxt))) return NULL; + def = g_new0(virDomainVideoDriverDef, 1); + if (virXMLPropEnum(driver, "vgaconf", virDomainVideoVGAConfTypeFromString, - VIR_XML_PROP_NONZERO, &val) < 0) + VIR_XML_PROP_NONZERO, &def->vgaconf) < 0) return NULL; - def = g_new0(virDomainVideoDriverDef, 1); - def->vgaconf = val; - - return def; + return g_steal_pointer(&def); } static virDomainVideoDef * -- 2.30.2

1 0

[libvirt PATCH 0/8] ci: Refresh contents, update list of targets
by Andrea Bolognani 05 May '21

05 May '21

This brings our pipeline in sync with the current status of the libvirt-ci repository. Test pipeline: https://gitlab.com/abologna/libvirt/-/pipelines/296773363 Andrea Bolognani (8): ci: Remove Fedora Rawhide dwarf4 hack ci: Rename CentOS Stream 8 and openSUSE Leap 15.2 containers ci: Refresh contents ci: Add openSUSE Tumbleweed ci: Add FreeBSD 13 ci: Add Fedora 34 ci: Drop Fedora 32 ci: Drop CentOS 7 .gitlab-ci.yml | 88 +++++------ ci/cirrus/freebsd-12.vars | 2 +- .../{freebsd-12.vars =3D> freebsd-13.vars} | 4 +- ci/cirrus/freebsd-current.vars | 2 +- ci/cirrus/macos-11.vars | 2 +- ci/containers/centos-7.Dockerfile | 138 ------------------ ci/containers/centos-8.Dockerfile | 2 +- ....Dockerfile =3D> centos-stream-8.Dockerfile} | 10 +- .../debian-10-cross-aarch64.Dockerfile | 4 +- .../debian-10-cross-armv6l.Dockerfile | 4 +- .../debian-10-cross-armv7l.Dockerfile | 4 +- ci/containers/debian-10-cross-i686.Dockerfile | 4 +- ci/containers/debian-10-cross-mips.Dockerfile | 4 +- .../debian-10-cross-mips64el.Dockerfile | 4 +- .../debian-10-cross-mipsel.Dockerfile | 4 +- .../debian-10-cross-ppc64le.Dockerfile | 4 +- .../debian-10-cross-s390x.Dockerfile | 4 +- ci/containers/debian-10.Dockerfile | 4 +- .../debian-sid-cross-aarch64.Dockerfile | 4 +- .../debian-sid-cross-armv6l.Dockerfile | 4 +- .../debian-sid-cross-armv7l.Dockerfile | 4 +- .../debian-sid-cross-i686.Dockerfile | 4 +- .../debian-sid-cross-mips64el.Dockerfile | 4 +- .../debian-sid-cross-mipsel.Dockerfile | 4 +- .../debian-sid-cross-ppc64le.Dockerfile | 4 +- .../debian-sid-cross-s390x.Dockerfile | 4 +- ci/containers/debian-sid.Dockerfile | 4 +- ci/containers/fedora-33.Dockerfile | 4 +- ...ora-32.Dockerfile =3D> fedora-34.Dockerfile} | 8 +- .../fedora-rawhide-cross-mingw32.Dockerfile | 4 +- .../fedora-rawhide-cross-mingw64.Dockerfile | 4 +- ci/containers/fedora-rawhide.Dockerfile | 4 +- ...ockerfile =3D> opensuse-leap-152.Dockerfile} | 6 +- ...kerfile =3D> opensuse-tumbleweed.Dockerfile} | 15 +- ci/containers/ubuntu-1804.Dockerfile | 4 +- ci/containers/ubuntu-2004.Dockerfile | 4 +- 36 files changed, 117 insertions(+), 260 deletions(-) copy ci/cirrus/{freebsd-12.vars =3D> freebsd-13.vars} (79%) delete mode 100644 ci/containers/centos-7.Dockerfile rename ci/containers/{centos-stream.Dockerfile =3D> centos-stream-8.Dockerfi= le} (89%) rename ci/containers/{fedora-32.Dockerfile =3D> fedora-34.Dockerfile} (93%) copy ci/containers/{opensuse-152.Dockerfile =3D> opensuse-leap-152.Dockerfil= e} (94%) rename ci/containers/{opensuse-152.Dockerfile =3D> opensuse-tumbleweed.Docke= rfile} (88%) --=20 2.26.3

2 9

[PATCH v1 0/4] libxl: fix affinity assignment
by Olaf Hering 05 May '21

05 May '21

Olaf Hering (4): libxl: remove obsolete VIR_LIBXL_EVENT_CONST libxl: remove obsolete check for result of xc_get_max_cpus libxl: remove obsolete libxlDomainSetVcpuAffinities function libxl: set vcpu affinity during domain creation src/libxl/libxl_conf.c | 53 ++++++++++++++++++++++++++++++++++++++++ src/libxl/libxl_domain.c | 48 +----------------------------------- src/libxl/libxl_domain.h | 18 +------------- src/libxl/libxl_driver.c | 6 +---- 4 files changed, 56 insertions(+), 69 deletions(-)

2 10

[PATCH v2] docs: cputune is also supported by the xen driver
by Olaf Hering 04 May '21

04 May '21

Since commit 68c5b6fb2b5fdabce775e9f8fc761a400e16a9d3 libxl also handles a domain/cputune/vcpupin element in domU.xml. Signed-off-by: Olaf Hering <olaf(a)aepfle.de> --- docs/formatdomain.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index 282176c4f4..fa5c14febc 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -744,8 +744,8 @@ CPU Tuning of element ``vcpu`` is not specified, the vCPU is pinned to all the physical CPUs by default. It contains two required attributes, the attribute ``vcpu`` specifies vCPU id, and the attribute ``cpuset`` is same as attribute - ``cpuset`` of element ``vcpu``. (NB: Only qemu driver support) :since:`Since - 0.9.0` + ``cpuset`` of element ``vcpu``. + :since:`QEMU driver support since 0.9.0, Xen driver support since 0.9.1` ``emulatorpin`` The optional ``emulatorpin`` element specifies which of host physical CPUs the "emulator", a subset of a domain not including vCPU or iothreads will be

2 1

[PATCH v1] docs: cputune is also supported by the xen driver
by Olaf Hering 04 May '21

04 May '21

Since commit 68c5b6fb2b5fdabce775e9f8fc761a400e16a9d3 libxl also handles a domain/cputune/vcpupin element in domU.xml. Signed-off-by: Olaf Hering <olaf(a)aepfle.de> --- docs/formatdomain.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index 282176c4f4..0328fe488b 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -744,8 +744,8 @@ CPU Tuning of element ``vcpu`` is not specified, the vCPU is pinned to all the physical CPUs by default. It contains two required attributes, the attribute ``vcpu`` specifies vCPU id, and the attribute ``cpuset`` is same as attribute - ``cpuset`` of element ``vcpu``. (NB: Only qemu driver support) :since:`Since - 0.9.0` + ``cpuset`` of element ``vcpu``. (NB: Only qemu and xen driver support) + :since:`Since 0.9.0` ``emulatorpin`` The optional ``emulatorpin`` element specifies which of host physical CPUs the "emulator", a subset of a domain not including vCPU or iothreads will be

2 1