- Devel - libvirt List Archives

[libvirt PATCH] libvirt-guests: Sync time for autostarted guests
by Tim Wiederhake 23 Oct '20

23 Oct '20

From: Orion Poplawski <orion(a)nwra.com> Setting SYNC_TIME=1 does not work on autostarted guests. Signed-off-by: Tim Wiederhake <twiederh(a)redhat.com> --- tools/libvirt-guests.sh.in | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/libvirt-guests.sh.in b/tools/libvirt-guests.sh.in index d69df908d2..87f96af14d 100644 --- a/tools/libvirt-guests.sh.in +++ b/tools/libvirt-guests.sh.in @@ -206,9 +206,9 @@ start() { retval run_virsh "$uri" start $bypass "$name" \ >/dev/null && \ gettext "done"; echo - if "$sync_time"; then - run_virsh "$uri" domtime --sync "$name" >/dev/null - fi + fi + if "$sync_time"; then + run_virsh "$uri" domtime --sync "$name" >/dev/null fi fi done -- 2.26.2

2 1

[PATCH v3 0/2]support memory failure
by zhenwei pi 23 Oct '20

23 Oct '20

v2->v3: Rework patches to make each patch could be compiled, v1->v2: Seperate a 'all in one' patch into 4 patches. Use a 'flags' with bit definition instead of 'action_required' & 'recursive' for extention. Queue event directly without internal job. Add full test method in commit. v1: Since QEMU 5.2 (commit-77b285f7f6), QEMU supports 'memory failure' event, posts event to monitor if hitting a hardware memory error. zhenwei pi (2): libvirt: support memory failure event qemu: implement memory failure event include/libvirt/libvirt-domain.h | 82 +++++++++++++++++++++++++++++++++++++ src/conf/domain_event.c | 80 ++++++++++++++++++++++++++++++++++++ src/conf/domain_event.h | 12 ++++++ src/libvirt_private.syms | 2 + src/remote/remote_daemon_dispatch.c | 32 +++++++++++++++ src/remote/remote_driver.c | 32 +++++++++++++++ src/remote/remote_protocol.x | 16 +++++++- src/remote_protocol-structs | 8 ++++ examples/c/misc/event-test.c | 16 ++++++++ tools/virsh-domain.c | 40 ++++++++++++++++++ src/qemu/qemu_monitor.c | 21 +++++++++- src/qemu/qemu_monitor.h | 39 ++++++++++++++++++ src/qemu/qemu_monitor_json.c | 49 ++++++++++++++++++++++ src/qemu/qemu_process.c | 59 ++++++++++++++++++++++++++ 14 files changed, 486 insertions(+), 2 deletions(-) -- 2.11.0

2 9

[PATCH] os: deprecate the -enable-fips option and QEMU's FIPS enforcement
by Daniel P. Berrangé 22 Oct '20

22 Oct '20

The -enable-fips option was added a long time ago to prevent the use of single DES when VNC when FIPS mode is enabled. It should never have been added, because apps are supposed to unconditionally honour FIPS mode based on the '/proc/sys/crypto/fips_enabled' file contents. In addition there is more to achieving FIPS compliance than merely blocking use of certain algorithms. Those algorithms which are used need to perform self-tests at runtime. QEMU's built-in cryptography provider has no support for self-tests, and neither does the nettle library. If QEMU is required to be used in a FIPS enabled host, then it must be built with the libgcrypt library enabled, which will unconditionally enforce FIPS compliance in any algorithm usage. Thus there is no need to keep either the -enable-fips option in QEMU, or QEMU's internal FIPS checking methods. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- docs/system/deprecated.rst | 11 +++++++++++ os-posix.c | 3 +++ 2 files changed, 14 insertions(+) diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst index 905628f3a0..faa2bc49b1 100644 --- a/docs/system/deprecated.rst +++ b/docs/system/deprecated.rst @@ -158,6 +158,17 @@ devices. It is possible to use drives the board doesn't pick up with -device. This usage is now deprecated. Use ``if=none`` instead. +``--enable-fips`` (since 5.2) + +This option restricts usage of certain cryptographic algorithms when +the host is operating in FIPS mode. + +If FIPS compliance is required, QEMU should be built with the ``libgcrypt`` +library enabled as a cryptography provider. + +Neither the ``nettle`` library, or the built-in cryptography provider are +supported on FIPS enabled hosts. + QEMU Machine Protocol (QMP) commands ------------------------------------ diff --git a/os-posix.c b/os-posix.c index 1de2839554..a6846f51c1 100644 --- a/os-posix.c +++ b/os-posix.c @@ -153,6 +153,9 @@ int os_parse_cmd_args(int index, const char *optarg) break; #if defined(CONFIG_LINUX) case QEMU_OPTION_enablefips: + warn_report("-enable-fips is deprecated, please build QEMU with " + "the `libgcrypt` library as the cryptography provider " + "to enable FIPS compliance"); fips_set_state(true); break; #endif -- 2.26.2

4 7

[PATCH 00/15] util: hash: Use glib's GHashTable - preparation (part 1)
by Peter Krempa 22 Oct '20

22 Oct '20

Glib provides a hash table implementation called GHashTable. In this part of the series we'll refactor two instances of code which use non-string keys for hashtable to use GHashTable directly which simplifies the code (glib provides int hashing functions). Since GHashTable is not a direct replacement for virHashTable without code modification (glib's functions don't accept NULL hash table, ours do) the next step will be to use virHashTable as a shim to provide NULL compatibility and adapt to our slightly different style of iterators. For this step we modify the variable type for the key to be 'char *' as there's no other option left and remove various internals which won't be compatible with GHashTable. Second part (WIP, [1]) will then rewrite virHashTable internals to use GHashTable, which will be used as an intermediate step before removal which requires audit of all callers. [1]: https://gitlab.com/pipo.sk/libvirt/-/commits/glib-hash-part2 - needs auditing of all callers of virHashForeach to ensure that they don't modify the hash table itself from the callback Peter Krempa (15): virCgroupKillRecursive: Return -1 on failure condition util: virhash: Remove virHashTableSize util: cgroup: Use GHashTable instead of virHashTable virCgroupKillRecursive: Refactor cleanup conf: domain_addr: Refactor hash usage in zpci reservation code virHashAtomicNew: Remove 'size' argument conf: nwfilter: Replace 'virNWFilterHashTableCreate' with 'virHashNew' tests: hash: Prepare for replacement of virHashCreate qemuDomainObjPrivateAlloc: Use virHashNew instead of virHashCreate Replace all instances of 'virHashCreate' with 'virHashNew' util: hash: Remove virHashValueFree util: hash: Remove virHashCreateFull util: hash: Change type of hash table name/key to 'char' util: virhash: Remove key handling callbacks virHashRemoveAll: Don't return number of removed items src/conf/domain_addr.c | 125 +++-------- src/conf/domain_addr.h | 4 +- src/conf/domain_conf.c | 4 +- src/conf/domain_nwfilter.c | 2 +- src/conf/nwfilter_ipaddrmap.c | 2 +- src/conf/nwfilter_params.c | 14 +- src/conf/nwfilter_params.h | 2 +- src/conf/virchrdev.c | 4 +- src/conf/virdomainmomentobjlist.c | 8 +- src/conf/virdomainobjlist.c | 16 +- src/conf/virinterfaceobj.c | 12 +- src/conf/virnetworkobj.c | 21 +- src/conf/virnodedeviceobj.c | 20 +- src/conf/virnwfilterbindingdef.c | 2 +- src/conf/virnwfilterbindingobjlist.c | 6 +- src/conf/virsecretobj.c | 10 +- src/conf/virstorageobj.c | 32 +-- src/hyperv/hyperv_wmi.c | 2 +- src/hypervisor/virclosecallbacks.c | 4 +- src/libvirt_private.syms | 5 +- src/libxl/libxl_logger.c | 2 +- src/locking/lock_daemon.c | 10 +- src/nwfilter/nwfilter_dhcpsnoop.c | 12 +- src/nwfilter/nwfilter_ebiptables_driver.c | 4 +- src/nwfilter/nwfilter_gentech_driver.c | 14 +- src/nwfilter/nwfilter_learnipaddr.c | 4 +- src/qemu/qemu_block.c | 6 +- src/qemu/qemu_blockjob.c | 2 +- src/qemu/qemu_capabilities.c | 6 +- src/qemu/qemu_checkpoint.c | 2 +- src/qemu/qemu_domain.c | 8 +- src/qemu/qemu_domain.h | 2 +- src/qemu/qemu_driver.c | 2 +- src/qemu/qemu_interop_config.c | 2 +- src/qemu/qemu_migration.c | 2 +- src/qemu/qemu_migration_cookie.c | 2 +- src/qemu/qemu_monitor.c | 10 +- src/qemu/qemu_monitor_json.c | 2 +- src/qemu/qemu_process.c | 2 +- src/qemu/qemu_qapi.c | 2 +- src/qemu/qemu_snapshot.c | 4 +- src/rpc/virnetdaemon.c | 16 +- src/security/security_selinux.c | 4 +- src/test/test_driver.c | 6 +- src/util/vircgroup.c | 76 ++----- src/util/vircgroupbackend.h | 3 +- src/util/vircgrouppriv.h | 2 +- src/util/vircgroupv1.c | 2 +- src/util/vircgroupv2.c | 2 +- src/util/virfilecache.c | 4 +- src/util/virhash.c | 201 +++--------------- src/util/virhash.h | 94 ++------ src/util/viriptables.c | 4 +- src/util/virlockspace.c | 8 +- src/util/virmacmap.c | 6 +- src/util/virstoragefile.c | 4 +- src/util/virsystemd.c | 2 +- tests/nwfilterxml2firewalltest.c | 6 +- tests/qemumonitorjsontest.c | 12 +- tests/qemusecuritymock.c | 12 +- .../blockjob-blockdev-in.xml | 110 +++++----- tests/testutilsqemu.c | 2 +- tests/virhashtest.c | 52 ++--- 63 files changed, 340 insertions(+), 683 deletions(-) -- 2.26.2

4 39

[PATCH 0/2] parthelper: Initialize error object
by Michal Privoznik 22 Oct '20

22 Oct '20

To observe the error fixed in 1/2 apply the following patch and run parthelper under valgrind, e.g. like this: valgrind libvirt_parthelper /dev/sda -g diff --git i/src/util/virdevmapper.c w/src/util/virdevmapper.c index 4d27c9f104..fad76f35a1 100644 --- i/src/util/virdevmapper.c +++ w/src/util/virdevmapper.c @@ -57,6 +57,8 @@ virDevMapperGetMajor(unsigned int *major) VIR_AUTOSTRINGLIST lines = NULL; size_t i; + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("blah")); + if (!virFileExists(CONTROL_PATH)) return -2; Michal Prívozník (2): parthelper: Initialize error object parthelper: Don't leak @canonical_path src/storage/parthelper.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.26.2

2 3

[PATCH v11 00/13] Apply COR-filter to the block-stream permanently
by Andrey Shinkevich 22 Oct '20

22 Oct '20

The iotest case test_stream_parallel still does not pass after the COR-filter is inserted into the backing chain. As the test case may not be initialized, it does not make a sense and was removed again. v11: 04: Base node overlay is used instead of base. 05: Base node overlay is used instead of base. 06: New. 07: New. 08: New. 09: The new BDS-member 'supported_read_flags' is applied. 10: The 'base_metadata' variable renamed to 'base_unfiltered'. 11: New. 12: The backing-file argument is left in the QMP interface. Warning added. 13: The BDRV_REQ_COPY_ON_READ removed from the stream_populate(); The 'implicit' initialization moved back to COR-filter driver. Base node overlay is used instead of base. The v8 Message-Id: <1601383109-110988-1-git-send-email-andrey.shinkevich(a)virtuozzo.com> Andrey Shinkevich (13): copy-on-read: Support preadv/pwritev_part functions copy-on-read: add filter append/drop functions qapi: add filter-node-name to block-stream copy-on-read: pass overlay base node name to COR driver copy-on-read: limit COR operations to base in COR driver block: modify the comment for BDRV_REQ_PREFETCH flag block: include supported_read_flags into BDS structure copy-on-read: add support for BDRV_REQ_PREFETCH to COR-filter copy-on-read: skip non-guest reads if no copy needed stream: skip filters when writing backing file name to QCOW2 header stream: mark backing-file argument as deprecated stream: remove unused backing-file name parameter block: apply COR-filter to block-stream jobs block/copy-on-read.c | 171 ++++++++++++++++++++++++++++++++++++++--- block/copy-on-read.h | 35 +++++++++ block/io.c | 3 +- block/monitor/block-hmp-cmds.c | 4 +- block/stream.c | 112 ++++++++++++++++----------- blockdev.c | 25 +++--- docs/system/deprecated.rst | 6 ++ include/block/block.h | 7 +- include/block/block_int.h | 13 +++- qapi/block-core.json | 6 ++ tests/qemu-iotests/030 | 51 ++---------- tests/qemu-iotests/030.out | 4 +- tests/qemu-iotests/141.out | 2 +- tests/qemu-iotests/245 | 19 +++-- 14 files changed, 324 insertions(+), 134 deletions(-) create mode 100644 block/copy-on-read.h -- 1.8.3.1

3 55

[libvirt PATCH] rpm: disable LTO in Fedora 34
by Daniel P. Berrangé 21 Oct '20

21 Oct '20

A binutils change has caused breakage when linking the tests /usr/bin/ld: tests/libtest_qemu_driver.so: undefined reference to `__open_missing_mode' This is probably a regression in binutils, so disable LTO until we get more clarity on the root cause and whether binutils or libvirt will need changing. https://bugzilla.redhat.com/show_bug.cgi?id=1889763 Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libvirt.spec.in b/libvirt.spec.in index 325566f329..2a4324b974 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -990,6 +990,13 @@ Libvirt plugin for NSS for translating domain names into IP addresses. %autosetup -S git_am %build + +%if 0%{?fedora} == 34 + # binutils change in F34 broke linking of tests + # https://bugzilla.redhat.com/show_bug.cgi?id=1889763 + %define _lto_cflags %{nil} +%endif + %if ! %{supported_platform} echo "This RPM requires either Fedora >= %{min_fedora} or RHEL >= %{min_rhel}" exit 1 -- 2.26.2

2 2

[PATCH v3 0/9] more Hyper-V APIs
by Matt Coleman 21 Oct '20

21 Oct '20

This set of patches adds several new APIs and fixes several others. Changes since v2: * adapted to all of Michal's recent changes * enabled usage of g_autoptr for hypervInvokeParamsList * avoid overwriting errors from hypervGetWmiClass() * use switch statements instead of if for v1/v2 parameter differences * added a helper function for domainReboot and domainReset * removed translation for the shutdown reason * changed the name of the constant for domainManagedSave on v2 to reflect the wording in Microsoft's documentation Matt Coleman (9): hyperv: enable usage of g_autoptr for hypervInvokeParamsList hyperv: avoid overwriting errors from hypervGetWmiClass() hyperv: implement domainSetAutostart hyperv: implement nodeGetFreeMemory hyperv: implement domainReboot and domainReset hyperv: implement domainShutdown and domainShutdownFlags hyperv: fix domainSuspend and domainResume on Hyper-V V2 hyperv: fix domainManagedSave on Hyper-V V2 news: more Hyper-V APIs NEWS.rst | 7 +- src/hyperv/hyperv_driver.c | 353 ++++++++++++++++++++++---- src/hyperv/hyperv_wmi.h | 1 + src/hyperv/hyperv_wmi_classes.h | 3 + src/hyperv/hyperv_wmi_generator.input | 78 ++++++ 5 files changed, 391 insertions(+), 51 deletions(-) -- 2.27.0

2 21

[PATCH] util: fix very old bug/typo in virNetDevParseVfInfo()
by Laine Stump 21 Oct '20

21 Oct '20

When this function was recently changed to add in parsing of IFLA_VF_STATS, I noticed that the checks for existence of IFLA_VF_MAC and IFLA_VF_VLAN were looking in the *wrong array*. The array that contains the results of parsing each IFLA_VFINFO in tb[IFLA_VFINFO_LIST] is tb_vf, but we were checking for these in tb (which is the array containing the results of the toplevel parsing of the netlink message, *not* the results of parsing one of the nested IFLA_VFINFO's. This incorrect code has been here since the function was originally written in 2012. It has only worked all these years due to coincidence - the items at those indexes in tb are IFLA_ADDRESS and IFLA_BROADCAST (of the *PF*, not of any of its VFs), and those happen to always be present in the toplevel netlink message; since we are only looking in the incorrect place to check for mere existence of the attribute (but are doing the actual retrieval of the attribute from the correct place), this bug has no real consequences other than confusing anyone trying to understand the code. Signed-off-by: Laine Stump <laine(a)redhat.com> --- src/util/virnetdev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util/virnetdev.c b/src/util/virnetdev.c index e284d62233..591a73cb45 100644 --- a/src/util/virnetdev.c +++ b/src/util/virnetdev.c @@ -1691,7 +1691,7 @@ virNetDevParseVfInfo(struct nlattr **tb, int32_t vf, virMacAddrPtr mac, return rc; } - if (mac && tb[IFLA_VF_MAC]) { + if (mac && tb_vf[IFLA_VF_MAC]) { vf_mac = RTA_DATA(tb_vf[IFLA_VF_MAC]); if (vf_mac && vf_mac->vf == vf) { virMacAddrSetRaw(mac, vf_mac->mac); @@ -1699,7 +1699,7 @@ virNetDevParseVfInfo(struct nlattr **tb, int32_t vf, virMacAddrPtr mac, } } - if (vlanid && tb[IFLA_VF_VLAN]) { + if (vlanid && tb_vf[IFLA_VF_VLAN]) { vf_vlan = RTA_DATA(tb_vf[IFLA_VF_VLAN]); if (vf_vlan && vf_vlan->vf == vf) { *vlanid = vf_vlan->vlan; -- 2.26.2

2 1

[PATCH v2 0/2] qemu: stop passing -enable-fips to QEMU >= 5.2.0
by Peter Krempa 21 Oct '20

21 Oct '20

v2: - rebased patch 2 on current master - sanitized testing of -enable-fips in qemuxml2argvtest - reused existing QEMU_CAPS_ENABLE_FIPS flag with inverted logic (saves us from having to remove it later and also doesn't add new flag to new guests) - qemuxml2argvtest now tests the output, which is more obvious on qemu version bumps than qemucapabilitiestest Daniel P. Berrangé (1): qemu: stop passing -enable-fips to QEMU >= 5.2.0 Peter Krempa (1): qemuxml2argvtest: Sanitize testing of '-enable-fips' src/qemu/qemu_capabilities.c | 7 ++++ src/qemu/qemu_command.c | 12 +++++- src/qemu/qemu_command.h | 2 +- src/qemu/qemu_driver.c | 2 +- src/qemu/qemu_process.c | 2 +- .../caps_1.5.3.x86_64.xml | 1 + .../caps_1.6.0.x86_64.xml | 1 + .../caps_1.7.0.x86_64.xml | 1 + .../caps_2.1.1.x86_64.xml | 1 + .../caps_2.10.0.aarch64.xml | 1 + .../caps_2.10.0.ppc64.xml | 1 + .../caps_2.10.0.s390x.xml | 1 + .../caps_2.10.0.x86_64.xml | 1 + .../caps_2.11.0.s390x.xml | 1 + .../caps_2.11.0.x86_64.xml | 1 + .../caps_2.12.0.aarch64.xml | 1 + .../caps_2.12.0.ppc64.xml | 1 + .../caps_2.12.0.s390x.xml | 1 + .../caps_2.12.0.x86_64.xml | 1 + .../caps_2.4.0.x86_64.xml | 1 + .../caps_2.5.0.x86_64.xml | 1 + .../caps_2.6.0.aarch64.xml | 1 + .../qemucapabilitiesdata/caps_2.6.0.ppc64.xml | 1 + .../caps_2.6.0.x86_64.xml | 1 + .../qemucapabilitiesdata/caps_2.7.0.s390x.xml | 1 + .../caps_2.7.0.x86_64.xml | 1 + .../qemucapabilitiesdata/caps_2.8.0.s390x.xml | 1 + .../caps_2.8.0.x86_64.xml | 1 + .../qemucapabilitiesdata/caps_2.9.0.ppc64.xml | 1 + .../qemucapabilitiesdata/caps_2.9.0.s390x.xml | 1 + .../caps_2.9.0.x86_64.xml | 1 + .../qemucapabilitiesdata/caps_3.0.0.ppc64.xml | 1 + .../caps_3.0.0.riscv32.xml | 1 + .../caps_3.0.0.riscv64.xml | 1 + .../qemucapabilitiesdata/caps_3.0.0.s390x.xml | 1 + .../caps_3.0.0.x86_64.xml | 1 + .../qemucapabilitiesdata/caps_3.1.0.ppc64.xml | 1 + .../caps_3.1.0.x86_64.xml | 1 + .../caps_4.0.0.aarch64.xml | 1 + .../qemucapabilitiesdata/caps_4.0.0.ppc64.xml | 1 + .../caps_4.0.0.riscv32.xml | 1 + .../caps_4.0.0.riscv64.xml | 1 + .../qemucapabilitiesdata/caps_4.0.0.s390x.xml | 1 + .../caps_4.0.0.x86_64.xml | 1 + .../caps_4.1.0.x86_64.xml | 1 + .../caps_4.2.0.aarch64.xml | 1 + .../qemucapabilitiesdata/caps_4.2.0.ppc64.xml | 1 + .../qemucapabilitiesdata/caps_4.2.0.s390x.xml | 1 + .../caps_4.2.0.x86_64.xml | 1 + .../caps_5.0.0.aarch64.xml | 1 + .../qemucapabilitiesdata/caps_5.0.0.ppc64.xml | 1 + .../caps_5.0.0.riscv64.xml | 1 + .../caps_5.0.0.x86_64.xml | 1 + .../caps_5.1.0.x86_64.xml | 1 + .../caps_5.2.0.x86_64.xml | 1 + tests/qemuxml2argvdata/fips-enabled.args | 31 -------------- .../fips-enabled.x86_64-5.1.0.args | 40 ++++++++++++++++++ .../fips-enabled.x86_64-latest.args | 41 +++++++++++++++++++ tests/qemuxml2argvtest.c | 16 +++++--- tests/testutilsqemu.h | 2 +- 60 files changed, 163 insertions(+), 42 deletions(-) delete mode 100644 tests/qemuxml2argvdata/fips-enabled.args create mode 100644 tests/qemuxml2argvdata/fips-enabled.x86_64-5.1.0.args create mode 100644 tests/qemuxml2argvdata/fips-enabled.x86_64-latest.args -- 2.26.2

2 4

[libvirt PATCH] qemu: stop passing -enable-fips to QEMU >= 5.2.0
by Daniel P. Berrangé 21 Oct '20

21 Oct '20

Use of the -enable-fips option is being deprecated in QEMU >= 5.2.0. If FIPS compliance is required, QEMU must be built with libcrypt which will unconditionally enforce it. Thus there is no need for libvirt to pass -enable-fips to modern QEMU. Unfortunately there was never any way to probe for -enable-fips in the first instance, it was enabled by libvirt based on version number originally, and then later unconditionally enabled when libvirt dropped support for older QEMU. Similarly we now use a version number check to decide when to stop passing -enable-fips. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/qemu/qemu_capabilities.c | 8 ++++++++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 12 +++++++++++- src/qemu/qemu_command.h | 2 +- src/qemu/qemu_driver.c | 2 +- src/qemu/qemu_process.c | 2 +- 6 files changed, 23 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 81d9ecd886..b4271cd863 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -601,6 +601,7 @@ VIR_ENUM_IMPL(virQEMUCaps, /* 380 */ "usb-host.hostdevice", "virtio-balloon.free-page-reporting", + "fips-implied", ); @@ -5151,6 +5152,13 @@ virQEMUCapsInitQMPVersionCaps(virQEMUCapsPtr qemuCaps) /* TCG couldn't be disabled nor queried until QEMU 2.10 */ if (qemuCaps->version < 2010000) virQEMUCapsSet(qemuCaps, QEMU_CAPS_TCG); + + /* -enable-fips is deprecated in QEMU 5.2.0, and QEMU + * should be built with gcrypt to achieve FIPS compliance + * automatically / implicitly + */ + if (qemuCaps->version >= 5002000) + virQEMUCapsSet(qemuCaps, QEMU_CAPS_FIPS_IMPLIED); } diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 44c45589f0..2976879fa3 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -581,6 +581,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */ /* 380 */ QEMU_CAPS_USB_HOST_HOSTDEVICE, /* -device usb-host.hostdevice */ QEMU_CAPS_VIRTIO_BALLOON_FREE_PAGE_REPORTING, /*virtio balloon free-page-reporting */ + QEMU_CAPS_FIPS_IMPLIED, /* -enable-fips is no longer required, delegate to gcrypt */ QEMU_CAPS_LAST /* this must always be the last item */ } virQEMUCapsFlags; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 697a2db62b..a8cb608c28 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -1089,10 +1089,20 @@ qemuDiskConfigBlkdeviotuneEnabled(virDomainDiskDefPtr disk) * old QEMU new QEMU * FIPS enabled doesn't start VNC auth disabled * FIPS disabled/missing VNC auth enabled VNC auth enabled + * + * In QEMU 5.2.0, use of -enable-fips was deprecated. In scenarios + * where FIPS is required, QEMU must be built against libgcrypt + * which automatically enforces FIPS compliance. */ bool -qemuCheckFips(void) +qemuCheckFips(virDomainObjPtr vm) { + qemuDomainObjPrivatePtr priv = vm->privateData; + virQEMUCapsPtr qemuCaps = priv->qemuCaps; + + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_FIPS_IMPLIED)) + return false; + if (virFileExists("/proc/sys/crypto/fips_enabled")) { g_autofree char *buf = NULL; diff --git a/src/qemu/qemu_command.h b/src/qemu/qemu_command.h index 8a30f2852c..8d46c65fcc 100644 --- a/src/qemu/qemu_command.h +++ b/src/qemu/qemu_command.h @@ -215,7 +215,7 @@ qemuDiskConfigBlkdeviotuneEnabled(virDomainDiskDefPtr disk); bool -qemuCheckFips(void); +qemuCheckFips(virDomainObjPtr vm); virJSONValuePtr qemuBuildHotpluggableCPUProps(const virDomainVcpuDef *vcpu) ATTRIBUTE_NONNULL(1); diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 825bdd9119..53e4b9d085 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6452,7 +6452,7 @@ static char *qemuConnectDomainXMLToNative(virConnectPtr conn, } if (!(cmd = qemuProcessCreatePretendCmd(driver, vm, NULL, - qemuCheckFips(), true, false, + qemuCheckFips(vm), true, false, VIR_QEMU_PROCESS_START_COLD))) goto cleanup; diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 5bc76a75e3..db5d834b7c 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -6820,7 +6820,7 @@ qemuProcessLaunch(virConnectPtr conn, incoming ? incoming->launchURI : NULL, snapshot, vmop, false, - qemuCheckFips(), + qemuCheckFips(vm), &nnicindexes, &nicindexes, 0))) goto cleanup; -- 2.26.2

2 1

[PATCH v5 1/2] util: support PCI passthrough net device stats collection
by zhenwei pi 21 Oct '20

21 Oct '20

Collect PCI passthrough net device stats from kernel by netlink API. Currently, libvirt can not get PCI passthrough net device stats, run command: #virsh domifstat instance --interface=52:54:00:2d:b2:35 error: Failed to get interface stats instance 52:54:00:2d:b2:35 error: internal error: Interface name not provided The PCI device(usually SR-IOV virtual function device) is detached while it's used in PCI passthrough mode. And we can not parse this device from /proc/net/dev any more. In this patch, libvirt checks net device is VF of not firstly, then query virNetDevVFInterfaceStats(new API). virNetDevVFInterfaceStats gets PF name, then dumps VF stats by netlink, compares with VF index and get stats(suggest by Laine, original version is implemented by zhenwei which parses VFs info of all PFs, compares MAC address until the two MAC addresses match). address until the two MAC addresses match. '#ip -s link show' can get the same result. Instead of parsing the output result, implement this feature by libnl API. Notice that this feature depends on driver of PF. Test on Mellanox ConnectX-4 Lx, it works well. Also test on Intel Corporation 82599ES, it works, but only get 0. (ip-link command get the same result). IFLA_VF_STATS is supported since Linux-4.2, suggested by Laine, just using defined(__linux__) && WITH_LIBNL is enough. Thanks to Laine, Daniel<berrange(a)redhat.com> & DHB for suggestions. Signed-off-by: zhenwei pi <pizhenwei(a)bytedance.com> --- src/libvirt_private.syms | 1 + src/qemu/qemu_driver.c | 13 ++++++++ src/util/virnetdev.c | 82 ++++++++++++++++++++++++++++++++++++++++++++++-- src/util/virnetdev.h | 4 +++ 4 files changed, 98 insertions(+), 2 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 52e9c6313f..ae543589f1 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -2584,6 +2584,7 @@ virNetDevSetRootQDisc; virNetDevSetupControl; virNetDevSysfsFile; virNetDevValidateConfig; +virNetDevVFInterfaceStats; # util/virnetdevbandwidth.h diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 825bdd9119..519af71fc1 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -10132,6 +10132,19 @@ qemuDomainInterfaceStats(virDomainPtr dom, if (virDomainNetGetActualType(net) == VIR_DOMAIN_NET_TYPE_VHOSTUSER) { if (virNetDevOpenvswitchInterfaceStats(net->ifname, stats) < 0) goto cleanup; + } else if (virDomainNetGetActualType(net) == VIR_DOMAIN_NET_TYPE_HOSTDEV) { + virDomainHostdevDefPtr hostdev = virDomainNetGetActualHostdev(net); + virPCIDeviceAddressPtr vfAddr; + + if (!hostdev) { + virReportError(VIR_ERR_INTERNAL_ERROR, + "%s", _("hostdev interface missing hostdev data")); + goto cleanup; + } + + vfAddr = &hostdev->source.subsys.u.pci.addr; + if (virNetDevVFInterfaceStats(vfAddr, stats) < 0) + goto cleanup; } else { if (virNetDevTapInterfaceStats(net->ifname, stats, !virDomainNetTypeSharesHostView(net)) < 0) diff --git a/src/util/virnetdev.c b/src/util/virnetdev.c index 5c7660dab4..f53e1751b3 100644 --- a/src/util/virnetdev.c +++ b/src/util/virnetdev.c @@ -1514,6 +1514,17 @@ static struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = { .maxlen = sizeof(struct ifla_vf_mac) }, [IFLA_VF_VLAN] = { .type = NLA_UNSPEC, .maxlen = sizeof(struct ifla_vf_vlan) }, + [IFLA_VF_STATS] = { .type = NLA_NESTED }, +}; + + +static struct nla_policy ifla_vfstats_policy[IFLA_VF_STATS_MAX+1] = { + [IFLA_VF_STATS_RX_PACKETS] = { .type = NLA_U64 }, + [IFLA_VF_STATS_TX_PACKETS] = { .type = NLA_U64 }, + [IFLA_VF_STATS_RX_BYTES] = { .type = NLA_U64 }, + [IFLA_VF_STATS_TX_BYTES] = { .type = NLA_U64 }, + [IFLA_VF_STATS_BROADCAST] = { .type = NLA_U64 }, + [IFLA_VF_STATS_MULTICAST] = { .type = NLA_U64 }, }; @@ -1651,13 +1662,14 @@ virNetDevSetVfConfig(const char *ifname, int vf, static int virNetDevParseVfConfig(struct nlattr **tb, int32_t vf, virMacAddrPtr mac, - int *vlanid) + int *vlanid, virDomainInterfaceStatsPtr stats) { int rc = -1; struct ifla_vf_mac *vf_mac; struct ifla_vf_vlan *vf_vlan; struct nlattr *tb_vf_info = {NULL, }; struct nlattr *tb_vf[IFLA_VF_MAX+1]; + struct nlattr *tb_vf_stats[IFLA_VF_STATS_MAX+1]; int rem; if (!tb[IFLA_VFINFO_LIST]) { @@ -1693,6 +1705,26 @@ virNetDevParseVfConfig(struct nlattr **tb, int32_t vf, virMacAddrPtr mac, } } + if (stats && tb_vf[IFLA_VF_STATS] && tb_vf[IFLA_VF_MAC]) { + vf_mac = RTA_DATA(tb_vf[IFLA_VF_MAC]); + if (vf_mac && vf_mac->vf == vf) { + rc = nla_parse_nested(tb_vf_stats, IFLA_VF_STATS_MAX, + tb_vf[IFLA_VF_STATS], + ifla_vfstats_policy); + if (rc < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("error parsing IFLA_VF_STATS")); + return rc; + } + + stats->rx_bytes = nla_get_u64(tb_vf_stats[IFLA_VF_STATS_RX_BYTES]); + stats->tx_bytes = nla_get_u64(tb_vf_stats[IFLA_VF_STATS_TX_BYTES]); + stats->rx_packets = nla_get_u64(tb_vf_stats[IFLA_VF_STATS_RX_PACKETS]); + stats->tx_packets = nla_get_u64(tb_vf_stats[IFLA_VF_STATS_TX_PACKETS]); + rc = 0; + } + } + if (rc == 0) break; } @@ -1714,7 +1746,43 @@ virNetDevGetVfConfig(const char *ifname, int vf, virMacAddrPtr mac, if (virNetlinkDumpLink(ifname, ifindex, &nlData, tb, 0, 0) < 0) return -1; - return virNetDevParseVfConfig(tb, vf, mac, vlanid); + return virNetDevParseVfConfig(tb, vf, mac, vlanid, NULL); +} + + +/** + * virNetDevVFInterfaceStats: + * @vfAddr: PCI address of a VF + * @stats: returns stats of the VF interface + * + * Get the VF interface from kernel by netlink. + * Returns 0 on success, -1 on failure. + */ +int +virNetDevVFInterfaceStats(virPCIDeviceAddressPtr vfAddr, + virDomainInterfaceStatsPtr stats) +{ + g_autofree void *nlData = NULL; + struct nlattr *tb[IFLA_MAX + 1] = {NULL, }; + g_autofree char *vfSysfsPath = NULL; + g_autofree char *pfname = NULL; + int vf = -1; + + if (virPCIDeviceAddressGetSysfsFile(vfAddr, &vfSysfsPath) < 0) + return -1; + + if (!virPCIIsVirtualFunction(vfSysfsPath)) { + virReportError(VIR_ERR_INTERNAL_ERROR, _("'%s' is not a VF device"), vfSysfsPath); + return -1; + } + + if (virPCIGetVirtualFunctionInfo(vfSysfsPath, -1, &pfname, &vf) < 0) + return -1; + + if (virNetlinkDumpLink(pfname, -1, &nlData, tb, 0, 0) < 0) + return -1; + + return virNetDevParseVfConfig(tb, vf, NULL, NULL, stats); } @@ -2330,6 +2398,16 @@ virNetDevSetNetConfig(const char *linkdev G_GNUC_UNUSED, } +int +virNetDevVFInterfaceStats(virPCIDeviceAddressPtr vfAddr G_GNUC_UNUSED, + virDomainInterfaceStatsPtr stats G_GNUC_UNUSED) +{ + virReportSystemError(ENOSYS, "%s", + _("Unable to get VF net device stats on this platform")); + return -1; +} + + #endif /* defined(WITH_LIBNL) */ VIR_ENUM_IMPL(virNetDevIfState, diff --git a/src/util/virnetdev.h b/src/util/virnetdev.h index dfef49938f..53e606c61c 100644 --- a/src/util/virnetdev.h +++ b/src/util/virnetdev.h @@ -316,4 +316,8 @@ int virNetDevSetRootQDisc(const char *ifname, const char *qdisc) G_GNUC_NO_INLINE; +int virNetDevVFInterfaceStats(virPCIDeviceAddressPtr vfAddr, + virDomainInterfaceStatsPtr stats) +ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2); + G_DEFINE_AUTOPTR_CLEANUP_FUNC(virNetDevRxFilter, virNetDevRxFilterFree); -- 2.11.0

2 3

[PATCH v2] Remove deprecated -no-kvm option
by Thomas Huth 21 Oct '20

21 Oct '20

The option has never been mentioned in our documentation, it's been deprecated since years, it's marked with QEMU_ARCH_I386 (which does not make sense anymore since KVM is available on other architectures, too), it does not do anything by default in upstream QEMU (since TCG is the default here anyway), and we're spending too much precious time each year discussing whether it makes sense to keep this option as a nice suger or not... let's finally put an end on this and remove it. Signed-off-by: Thomas Huth <thuth(a)redhat.com> --- v2: Mention the parameter in the "removed feature" section (thanks Paolo!) docs/system/deprecated.rst | 11 ++++++----- qemu-options.hx | 3 --- softmmu/vl.c | 4 ---- 3 files changed, 6 insertions(+), 12 deletions(-) diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst index 905628f3a0..9bae13bc01 100644 --- a/docs/system/deprecated.rst +++ b/docs/system/deprecated.rst @@ -27,11 +27,6 @@ System emulator command line arguments The ``enforce-config-section`` parameter is replaced by the ``-global migration.send-configuration={on|off}`` option. -``-no-kvm`` (since 1.3.0) -''''''''''''''''''''''''' - -The ``-no-kvm`` argument is now a synonym for setting ``-accel tcg``. - ``-usbdevice`` (since 2.10.0) ''''''''''''''''''''''''''''' @@ -504,6 +499,12 @@ System emulator command line arguments The ``name`` parameter of the ``-net`` option was a synonym for the ``id`` parameter, which should now be used instead. +``-no-kvm`` (removed in 5.2) +'''''''''''''''''''''''''''' + +The ``-no-kvm`` argument was a synonym for setting ``-accel tcg``. + + QEMU Machine Protocol (QMP) commands ------------------------------------ diff --git a/qemu-options.hx b/qemu-options.hx index 1da52a269c..9e1ace04f7 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -4351,9 +4351,6 @@ SRST Enable FIPS 140-2 compliance mode. ERST -HXCOMM Deprecated by -accel tcg -DEF("no-kvm", 0, QEMU_OPTION_no_kvm, "", QEMU_ARCH_I386) - DEF("msg", HAS_ARG, QEMU_OPTION_msg, "-msg [timestamp[=on|off]][,guest-name=[on|off]]\n" " control error message format\n" diff --git a/softmmu/vl.c b/softmmu/vl.c index cb476aa70b..6f5b000f07 100644 --- a/softmmu/vl.c +++ b/softmmu/vl.c @@ -3502,10 +3502,6 @@ void qemu_init(int argc, char **argv, char **envp) exit(1); } break; - case QEMU_OPTION_no_kvm: - olist = qemu_find_opts("machine"); - qemu_opts_parse_noisily(olist, "accel=tcg", false); - break; case QEMU_OPTION_accel: accel_opts = qemu_opts_parse_noisily(qemu_find_opts("accel"), optarg, true); -- 2.18.2

3 2

[PATCH] Remove deprecated -no-kvm option
by Thomas Huth 20 Oct '20

20 Oct '20

The option has never been mentioned in our documentation, it's been deprecated since years, it's marked with QEMU_ARCH_I386 (which does not make sense anymore since KVM is available on other architectures, too), it does not do anything by default in upstream QEMU (since TCG is the default here anyway), and we're spending too much precious time each year discussing whether it makes sense to keep this option as a nice suger or not... let's finally put an end on this and remove it. Signed-off-by: Thomas Huth <thuth(a)redhat.com> --- docs/system/deprecated.rst | 5 ----- qemu-options.hx | 3 --- softmmu/vl.c | 4 ---- 3 files changed, 12 deletions(-) diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst index 905628f3a0..66ef89b872 100644 --- a/docs/system/deprecated.rst +++ b/docs/system/deprecated.rst @@ -27,11 +27,6 @@ System emulator command line arguments The ``enforce-config-section`` parameter is replaced by the ``-global migration.send-configuration={on|off}`` option. -``-no-kvm`` (since 1.3.0) -''''''''''''''''''''''''' - -The ``-no-kvm`` argument is now a synonym for setting ``-accel tcg``. - ``-usbdevice`` (since 2.10.0) ''''''''''''''''''''''''''''' diff --git a/qemu-options.hx b/qemu-options.hx index 1da52a269c..9e1ace04f7 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -4351,9 +4351,6 @@ SRST Enable FIPS 140-2 compliance mode. ERST -HXCOMM Deprecated by -accel tcg -DEF("no-kvm", 0, QEMU_OPTION_no_kvm, "", QEMU_ARCH_I386) - DEF("msg", HAS_ARG, QEMU_OPTION_msg, "-msg [timestamp[=on|off]][,guest-name=[on|off]]\n" " control error message format\n" diff --git a/softmmu/vl.c b/softmmu/vl.c index cb476aa70b..6f5b000f07 100644 --- a/softmmu/vl.c +++ b/softmmu/vl.c @@ -3502,10 +3502,6 @@ void qemu_init(int argc, char **argv, char **envp) exit(1); } break; - case QEMU_OPTION_no_kvm: - olist = qemu_find_opts("machine"); - qemu_opts_parse_noisily(olist, "accel=tcg", false); - break; case QEMU_OPTION_accel: accel_opts = qemu_opts_parse_noisily(qemu_find_opts("accel"), optarg, true); -- 2.18.2

2 1

[PATCH] virsh: Allow listing just domain IDs
by Michal Privoznik 20 Oct '20

20 Oct '20

Some completers for libvirt related tools might want to list domain IDs only. Just like the one I've implemented for virt-viewer [1]. I've worked around it using some awk magic, but if it was possible to just 'virsh list --id' then I could drop awk. 1: https://www.redhat.com/archives/virt-tools-list/2019-May/msg00014.html Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- I just realized that I've never sent this and it was sitting in a branch for 1.5 years. <facepalm/> tools/virsh-domain-monitor.c | 41 ++++++++++++++++++++++++------------ 1 file changed, 28 insertions(+), 13 deletions(-) diff --git a/tools/virsh-domain-monitor.c b/tools/virsh-domain-monitor.c index e0491d48ac..9e66d573e6 100644 --- a/tools/virsh-domain-monitor.c +++ b/tools/virsh-domain-monitor.c @@ -1919,6 +1919,10 @@ static const vshCmdOptDef opts_list[] = { .type = VSH_OT_BOOL, .help = N_("list domain names only") }, + {.name = "id", + .type = VSH_OT_BOOL, + .help = N_("list domain IDs only") + }, {.name = "table", .type = VSH_OT_BOOL, .help = N_("list table (default)") @@ -1945,6 +1949,7 @@ cmdList(vshControl *ctl, const vshCmd *cmd) bool optTable = vshCommandOptBool(cmd, "table"); bool optUUID = vshCommandOptBool(cmd, "uuid"); bool optName = vshCommandOptBool(cmd, "name"); + bool optID = vshCommandOptBool(cmd, "id"); size_t i; char *title; char uuid[VIR_UUID_STRING_BUFLEN]; @@ -1988,8 +1993,12 @@ cmdList(vshControl *ctl, const vshCmd *cmd) VSH_EXCLUSIVE_OPTIONS("table", "name"); VSH_EXCLUSIVE_OPTIONS("table", "uuid"); + VSH_EXCLUSIVE_OPTIONS("table", "id"); + VSH_EXCLUSIVE_OPTIONS("all", "id"); + VSH_EXCLUSIVE_OPTIONS("inactive", "id"); + VSH_EXCLUSIVE_OPTIONS("state-shutoff", "id"); - if (!optUUID && !optName) + if (!optUUID && !optName && !optID) optTable = true; if (!(list = virshDomainListCollect(ctl, flags))) @@ -2007,6 +2016,8 @@ cmdList(vshControl *ctl, const vshCmd *cmd) } for (i = 0; i < list->ndomains; i++) { + const char *sep = ""; + dom = list->domains[i]; id = virDomainGetID(dom); if (id != (unsigned int) -1) @@ -2044,20 +2055,24 @@ cmdList(vshControl *ctl, const vshCmd *cmd) goto cleanup; } - } else if (optUUID && optName) { - if (virDomainGetUUIDString(dom, uuid) < 0) { - vshError(ctl, "%s", _("Failed to get domain's UUID")); - goto cleanup; + } else { + if (optUUID) { + if (virDomainGetUUIDString(dom, uuid) < 0) { + vshError(ctl, "%s", _("Failed to get domain's UUID")); + goto cleanup; + } + vshPrint(ctl, "%s", uuid); + sep = " "; } - vshPrint(ctl, "%-36s %-30s\n", uuid, virDomainGetName(dom)); - } else if (optUUID) { - if (virDomainGetUUIDString(dom, uuid) < 0) { - vshError(ctl, "%s", _("Failed to get domain's UUID")); - goto cleanup; + if (optID) { + vshPrint(ctl, "%s%s", sep, id_buf); + sep = " "; } - vshPrint(ctl, "%s\n", uuid); - } else if (optName) { - vshPrint(ctl, "%s\n", virDomainGetName(dom)); + if (optName) { + vshPrint(ctl, "%s%s", sep, virDomainGetName(dom)); + sep = " "; + } + vshPrint(ctl, "\n"); } } -- 2.26.2

3 5

[PATCH 0/4] hyperv: Cleanup code create embedded properties
by Michal Privoznik 20 Oct '20

20 Oct '20

*** BLURB HERE *** Michal Prívozník (4): hyperv: Accept const @value in hypervSetEmbeddedProperty() hyperv: Use g_auto() for virHashTable in hypervCreateEmbeddedParam hyperv: Drop needles error label in hypervCreateEmbeddedParam() hyverv: hypervCreateEmbeddedParam: Rework items counting src/hyperv/hyperv_wmi.c | 43 ++++++++++++++++++++++++++--------------- src/hyperv/hyperv_wmi.h | 5 +++-- 2 files changed, 30 insertions(+), 18 deletions(-) -- 2.26.2

2 5

[libvirt PATCH] docs: Mention GPG key used for signing releases
by Jiri Denemark 20 Oct '20

20 Oct '20

Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- Notes: Should we also make the key available for download? docs/downloads.html.in | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docs/downloads.html.in b/docs/downloads.html.in index 43366b3694..aa0bb23d45 100644 --- a/docs/downloads.html.in +++ b/docs/downloads.html.in @@ -493,6 +493,20 @@ <li><a href="https://libvirt.org/sources/">libvirt.org HTTPS server</a></li> </ul> + <h2><a id="keys">Signing keys</a></h2> + + <p> + Source RPM packages and tarballs for libvirt and libvirt-python published + on this project site are signed with a GPG signature. You should always + verify the package signature before using the source to compile binary + packages. The following key is currently used to generate the GPG + signatures: + </p> + <pre> +pub 4096R/10084C9C 2020-07-20 Jiří Denemark <jdenemar(a)redhat.com> +Fingerprint=453B 6531 0595 5628 5547 1199 CA68 BE80 1008 4C9C +</pre> + <h2><a id="schedule">Primary release schedule</a></h2> <p> -- 2.28.0

3 3

[libvirt PATCH 0/8] build: lower maximum frame size to 1792
by Ján Tomko 20 Oct '20

20 Oct '20

Ján Tomko (8): libxl: libxlDomainStart: use g_autoptr for virDomainDef libxl: libxlDomainStart: autofree managed_save_path libxl: libxlDomainStart: use g_auto more libxl: allocate d_config esx: esxConnectOpen: use allocated buffer lxc: virLXCProcessStart: use allocated buffers remote: allocate virDomainDef for ACL check build: lower maximum frame size to 1792 meson.build | 7 +++-- src/esx/esx_driver.c | 7 ++--- src/libxl/libxl_domain.c | 40 +++++++++++++---------------- src/lxc/lxc_process.c | 19 ++++++++------ src/remote/remote_daemon_dispatch.c | 19 +++++++------- 5 files changed, 46 insertions(+), 46 deletions(-) -- 2.26.2

4 15

[PATCH v2 00/18] virschematest: Improve XML validation
by Peter Krempa 19 Oct '20

19 Oct '20

Quite a few XMLs in examples/tests are not validated, many of them actually invalid. Improve schema validation. v2: - pushed ACK'd patches - rebased - added patch for schema validation of tests/cputestdata Peter Krempa (18): virschematest: Rewrite internals to allow increasing XML test coverage virschematest: Add regex filtering for directory contents examples: xml: Fix 'pool-netfs.xml' example examples: xml: Fix 'vol-raw.xml' and 'vol-sparse.xml' virschematest: Add coverage for 'examples/xml/storage' virschematest: Add coverage for 'examples/xml/test' virschematest: Fix testing of 'nwfilter' xmls domainconfdata/getfilesystem.xml: Remove <init> element schema: nwfilter: Allow all accepted values for 'ipsetflags' schema: nwfiter: Allow leading/trailing whitespace in 'variable-name-type' nwfilterxml2firewall: Fix schema compilance of 'tcp' test case nwfilterxml2xmltest: Rename cases with XMLs not conforming to schema schema: domain: Add definition for the 'vmware' private namespace schema: domain: Allow space in XML schema for bridge source tests: vmx: Add <name> element for all domain XMLs virschematest: Add directories containing domain XMLs virschematest: Validate more XMLs virschematest: Validate schema in tests/cputestdata docs/schemas/domaincommon.rng | 17 +- docs/schemas/nwfilter.rng | 4 +- examples/xml/storage/pool-netfs.xml | 2 +- examples/xml/storage/vol-raw.xml | 3 + examples/xml/storage/vol-sparse.xml | 3 + tests/domainconfdata/getfilesystem.xml | 1 - tests/nwfilterxml2firewalldata/tcp.xml | 2 +- ...ipv6-test.xml => ah-ipv6-test-invalid.xml} | 0 ...pv6-test.xml => all-ipv6-test-invalid.xml} | 0 .../{arp-test.xml => arp-test-invalid.xml} | 0 ...est1.xml => chain_prefixtest1-invalid.xml} | 0 ...ment-test.xml => comment-test-invalid.xml} | 0 ...pv6-test.xml => esp-ipv6-test-invalid.xml} | 0 ...ata-test.xml => hex-data-test-invalid.xml} | 0 .../{icmp-test.xml => icmp-test-invalid.xml} | 0 ...cmpv6-test.xml => icmpv6-test-invalid.xml} | 0 .../{ip-test.xml => ip-test-invalid.xml} | 0 .../{ipv6-test.xml => ipv6-test-invalid.xml} | 0 .../{mac-test.xml => mac-test-invalid.xml} | 0 .../{rarp-test.xml => rarp-test-invalid.xml} | 0 ...v6-test.xml => sctp-ipv6-test-invalid.xml} | 0 .../{sctp-test.xml => sctp-test-invalid.xml} | 0 ...pv6-test.xml => tcp-ipv6-test-invalid.xml} | 0 .../{tcp-test.xml => tcp-test-invalid.xml} | 0 ...pv6-test.xml => udp-ipv6-test-invalid.xml} | 0 .../{udp-test.xml => udp-test-invalid.xml} | 0 ...test.xml => udplite-ipv6-test-invalid.xml} | 0 .../{vlan-test.xml => vlan-test-invalid.xml} | 0 tests/nwfilterxml2xmltest.c | 44 +-- tests/virschematest.c | 371 ++++++++++++------ tests/vmx2xmldata/vmx2xml-annotation.vmx | 1 + tests/vmx2xmldata/vmx2xml-annotation.xml | 1 + .../vmx2xml-case-insensitive-1.vmx | 1 + .../vmx2xml-case-insensitive-2.vmx | 1 + .../vmx2xmldata/vmx2xml-cdrom-ide-device.vmx | 1 + .../vmx2xmldata/vmx2xml-cdrom-ide-device.xml | 1 + .../vmx2xmldata/vmx2xml-cdrom-ide-empty-2.vmx | 1 + .../vmx2xmldata/vmx2xml-cdrom-ide-empty-2.xml | 1 + tests/vmx2xmldata/vmx2xml-cdrom-ide-empty.vmx | 1 + tests/vmx2xmldata/vmx2xml-cdrom-ide-empty.xml | 1 + tests/vmx2xmldata/vmx2xml-cdrom-ide-file.vmx | 1 + tests/vmx2xmldata/vmx2xml-cdrom-ide-file.xml | 1 + .../vmx2xml-cdrom-ide-raw-auto-detect.vmx | 1 + .../vmx2xml-cdrom-ide-raw-auto-detect.xml | 1 + .../vmx2xml-cdrom-ide-raw-device.vmx | 1 + .../vmx2xml-cdrom-ide-raw-device.xml | 1 + .../vmx2xmldata/vmx2xml-cdrom-scsi-device.vmx | 1 + .../vmx2xmldata/vmx2xml-cdrom-scsi-device.xml | 1 + .../vmx2xmldata/vmx2xml-cdrom-scsi-empty.vmx | 1 + .../vmx2xmldata/vmx2xml-cdrom-scsi-empty.xml | 1 + tests/vmx2xmldata/vmx2xml-cdrom-scsi-file.vmx | 1 + tests/vmx2xmldata/vmx2xml-cdrom-scsi-file.xml | 1 + .../vmx2xml-cdrom-scsi-passthru.vmx | 1 + .../vmx2xml-cdrom-scsi-passthru.xml | 1 + .../vmx2xml-cdrom-scsi-raw-auto-detect.vmx | 1 + .../vmx2xml-cdrom-scsi-raw-auto-detect.xml | 1 + .../vmx2xml-cdrom-scsi-raw-device.vmx | 1 + .../vmx2xml-cdrom-scsi-raw-device.xml | 1 + tests/vmx2xmldata/vmx2xml-datacenterpath.vmx | 1 + tests/vmx2xmldata/vmx2xml-datacenterpath.xml | 1 + .../vmx2xmldata/vmx2xml-ethernet-bridged.vmx | 1 + .../vmx2xmldata/vmx2xml-ethernet-bridged.xml | 1 + tests/vmx2xmldata/vmx2xml-ethernet-custom.vmx | 1 + tests/vmx2xmldata/vmx2xml-ethernet-custom.xml | 1 + tests/vmx2xmldata/vmx2xml-ethernet-e1000.vmx | 1 + tests/vmx2xmldata/vmx2xml-ethernet-e1000.xml | 1 + .../vmx2xml-ethernet-generated.vmx | 1 + .../vmx2xml-ethernet-generated.xml | 1 + tests/vmx2xmldata/vmx2xml-ethernet-nat.vmx | 1 + tests/vmx2xmldata/vmx2xml-ethernet-nat.xml | 1 + tests/vmx2xmldata/vmx2xml-ethernet-other.vmx | 1 + tests/vmx2xmldata/vmx2xml-ethernet-other.xml | 1 + tests/vmx2xmldata/vmx2xml-ethernet-static.vmx | 1 + tests/vmx2xmldata/vmx2xml-ethernet-static.xml | 1 + .../vmx2xmldata/vmx2xml-ethernet-vmxnet2.vmx | 1 + .../vmx2xmldata/vmx2xml-ethernet-vmxnet2.xml | 1 + tests/vmx2xmldata/vmx2xml-ethernet-vpx.vmx | 1 + tests/vmx2xmldata/vmx2xml-ethernet-vpx.xml | 1 + tests/vmx2xmldata/vmx2xml-firmware-efi.vmx | 1 + tests/vmx2xmldata/vmx2xml-firmware-efi.xml | 1 + tests/vmx2xmldata/vmx2xml-floppy-device.vmx | 1 + tests/vmx2xmldata/vmx2xml-floppy-device.xml | 1 + tests/vmx2xmldata/vmx2xml-floppy-file.vmx | 1 + tests/vmx2xmldata/vmx2xml-floppy-file.xml | 1 + tests/vmx2xmldata/vmx2xml-graphics-vnc.vmx | 1 + tests/vmx2xmldata/vmx2xml-graphics-vnc.xml | 1 + .../vmx2xmldata/vmx2xml-harddisk-ide-file.vmx | 1 + .../vmx2xmldata/vmx2xml-harddisk-ide-file.xml | 1 + .../vmx2xml-harddisk-scsi-file.vmx | 1 + .../vmx2xml-harddisk-scsi-file.xml | 1 + .../vmx2xml-harddisk-transient.vmx | 1 + .../vmx2xml-harddisk-transient.xml | 1 + tests/vmx2xmldata/vmx2xml-minimal-64bit.vmx | 1 + tests/vmx2xmldata/vmx2xml-minimal-64bit.xml | 1 + tests/vmx2xmldata/vmx2xml-minimal.vmx | 1 + tests/vmx2xmldata/vmx2xml-minimal.xml | 1 + tests/vmx2xmldata/vmx2xml-parallel-device.vmx | 1 + tests/vmx2xmldata/vmx2xml-parallel-device.xml | 1 + tests/vmx2xmldata/vmx2xml-parallel-file.vmx | 1 + tests/vmx2xmldata/vmx2xml-parallel-file.xml | 1 + tests/vmx2xmldata/vmx2xml-scsi-driver.vmx | 1 + tests/vmx2xmldata/vmx2xml-scsi-driver.xml | 1 + .../vmx2xmldata/vmx2xml-scsi-writethrough.vmx | 1 + .../vmx2xmldata/vmx2xml-scsi-writethrough.xml | 1 + tests/vmx2xmldata/vmx2xml-serial-device.vmx | 1 + tests/vmx2xmldata/vmx2xml-serial-device.xml | 1 + tests/vmx2xmldata/vmx2xml-serial-file.vmx | 1 + tests/vmx2xmldata/vmx2xml-serial-file.xml | 1 + .../vmx2xml-serial-network-client.vmx | 1 + .../vmx2xml-serial-network-client.xml | 1 + .../vmx2xml-serial-network-server.vmx | 1 + .../vmx2xml-serial-network-server.xml | 1 + .../vmx2xml-serial-pipe-client-app.vmx | 1 + .../vmx2xml-serial-pipe-client-vm.vmx | 1 + .../vmx2xml-serial-pipe-server-app.vmx | 1 + .../vmx2xml-serial-pipe-server-vm.vmx | 1 + tests/vmx2xmldata/vmx2xml-serial-pipe.xml | 1 + tests/vmx2xmldata/vmx2xml-sharedfolder.vmx | 1 + tests/vmx2xmldata/vmx2xml-sharedfolder.xml | 1 + tests/vmx2xmldata/vmx2xml-smbios.vmx | 1 + tests/vmx2xmldata/vmx2xml-smbios.xml | 1 + tests/vmx2xmldata/vmx2xml-svga.vmx | 1 + tests/vmx2xmldata/vmx2xml-svga.xml | 1 + 123 files changed, 393 insertions(+), 147 deletions(-) rename tests/nwfilterxml2xmlin/{ah-ipv6-test.xml => ah-ipv6-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{all-ipv6-test.xml => all-ipv6-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{arp-test.xml => arp-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{chain_prefixtest1.xml => chain_prefixtest1-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{comment-test.xml => comment-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{esp-ipv6-test.xml => esp-ipv6-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{hex-data-test.xml => hex-data-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{icmp-test.xml => icmp-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{icmpv6-test.xml => icmpv6-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{ip-test.xml => ip-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{ipv6-test.xml => ipv6-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{mac-test.xml => mac-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{rarp-test.xml => rarp-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{sctp-ipv6-test.xml => sctp-ipv6-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{sctp-test.xml => sctp-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{tcp-ipv6-test.xml => tcp-ipv6-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{tcp-test.xml => tcp-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{udp-ipv6-test.xml => udp-ipv6-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{udp-test.xml => udp-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{udplite-ipv6-test.xml => udplite-ipv6-test-invalid.xml} (100%) rename tests/nwfilterxml2xmlin/{vlan-test.xml => vlan-test-invalid.xml} (100%) -- 2.26.2

3 21

[PATCH] spec: Fix numad check
by Boris Fiuczynski 19 Oct '20

19 Oct '20

Fixes commit 974dc0a4c678af8ccb9224abecc834bb593e81fa which caused DEBUG: meson.build:2149:2: ERROR: Problem encountered: You must have numactl enabled for numad support. on s390x. Signed-off-by: Boris Fiuczynski <fiuczy(a)linux.ibm.com> Reviewed-by: Marc Hartmayer <mhartmay(a)linux.ibm.com> --- libvirt.spec.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 2bd4784d0f..325566f329 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -182,7 +182,7 @@ %if %{with_qemu} || %{with_lxc} # numad is used to manage the CPU and memory placement dynamically, # it's not available on many non-x86 architectures. - %ifnarch %{arches_numad} + %ifarch %{arches_numad} %define with_numad 0%{!?_without_numad:1} %endif %endif -- 2.25.1

2 1

Plans for the next release
by Jiri Denemark 19 Oct '20

19 Oct '20

We are getting close to the next release of libvirt. To aim for the release on Nov 02 I suggest entering the freeze on Monday Oct 26 and tagging RC2 on Thursday Oct 29. I hope this works for everyone. Jirka

1 0

[PATCH v2 0/7] more Hyper-V APIs
by Matt Coleman 19 Oct '20

19 Oct '20

This set of patches adds several new APIs and fixes several others. Changes since v1: * 'enabledValue' and 'disabledValue' are now static strings in hypervDomainSetAutostart() * a long virReportError() call has been split into two lines Matt Coleman (7): hyperv: implement domainSetAutostart hyperv: implement nodeGetFreeMemory hyperv: implement domainReboot and domainReset hyperv: implement domainShutdown and domainShutdownFlags hyperv: fix domainSuspend and domainResume on Hyper-V V2 hyperv: fix domainManagedSave on Hyper-V V2 news: more Hyper-V APIs NEWS.rst | 7 +- src/hyperv/hyperv_driver.c | 267 +++++++++++++++++++++++++- src/hyperv/hyperv_wmi_classes.h | 3 + src/hyperv/hyperv_wmi_generator.input | 78 ++++++++ 4 files changed, 347 insertions(+), 8 deletions(-) -- 2.27.0

4 24

[PATCH 0/5] hyperv: Make ownershipt transfer obvious
by Michal Privoznik 19 Oct '20

19 Oct '20

*** BLURB HERE *** Michal Prívozník (5): hyperv: Make it obvious that hypervInvokeMethod() consumes an argument hyperv: Reindent hypervInvokeMethod() body hyperv: Drop needless label in hypervDomainSetMemoryFlags() hyperv: Make it obvious that hypervAddEmbeddedParam() consumes an argument hyperv: Simplify @memResource freeing in hypervDomainSetMemoryFlags() src/hyperv/hyperv_driver.c | 34 ++++------ src/hyperv/hyperv_wmi.c | 129 +++++++++++++++++++++---------------- src/hyperv/hyperv_wmi.h | 12 ++-- 3 files changed, 94 insertions(+), 81 deletions(-) -- 2.26.2

3 7

Re: [PATCH 0/6] qemu: Fix cdrom as SCSI hostdev via -blockdev
by daggs 19 Oct '20

19 Oct '20

Greetings All, > Sent: Thursday, October 15, 2020 at 6:25 PM > From: "Peter Krempa" <pkrempa(a)redhat.com> > To: libvir-list(a)redhat.com > Cc: "daggs" <daggs(a)gmx.com> > Subject: [PATCH 0/6] qemu: Fix cdrom as SCSI hostdev via -blockdev > > -drive detects whether a device is a cdrom automatically but we need to > use 'host_cdrom' when using blockdev explicitly. Fix the hostdev code > which was recently converted to -blockdev. > > Warning: > > I _don't_ have a box with a CDROM handy so this code is not tested in action! > > Peter Krempa (6): > qemuProcessCreatePretendCmd: Split up preparation and command building > qemu: hostdev: Prepare definition bits in qemuDomainPrepareHostdev > qemu: Prepare hostdev data which depends on the host state separately > qemuxml2argvmock: Remove mocking of 'virSCSIDeviceGetSgName' > qemu: Detect whether a SCSI hostdev is a cdrom > qemu: Add test cases for 'host_cdrom' blockdev backend via <disk> I've tested the bellow on libvirt 6.8.0, I wasn't able to get it to work, with the same entry as the example, e.g.: <hostdev mode='subsystem' type='scsi' managed='yes'> <source> <adapter name='cdrom'/> <address bus='0' target='0' unit='0'/> </source> <readonly/> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </hostdev> I get this error: error: XML error: SCSI host device doesn't support managed mode. if I mark the managed as no (like other pci pass-through devices I have in the vm), I get this error: error: internal error: Cannot parse adapter 'cdrom' looks like the commit is missing the cdrom validation at https://gitlab.com/libvirt/libvirt/-/blob/master/src/util/virscsi.c#L90 full machine xml can be found at https://dpaste.com/G32WWAJA2 Dagg.

1 0

[libvirt PATCH v2 0/4] Make SEV 'cbitpos' and 'reducedPhysBits' attributes optional
by Erik Skultety 17 Oct '20

17 Oct '20

We designed them as mandatory, but these are platform dependent and can be filled from QEMU capabilities. Resolves: https://gitlab.com/libvirt/libvirt/-/issues/57 Since v1: - moved the capability check from qemuProcessPrepareSEVGuestInput to qemuValidateDomainDef as requested Erik Skultety (4): qemu_process: sev: Drop an unused variable qemu: process: Move SEV capability check to qemuValidateDomainDef qemu: process: sev: Fill missing 'cbitpos' & 'reducedPhysBits' from caps conf: domain: sev: Make 'cbitpos' & 'reducedPhysBits' attrs optional docs/schemas/domaincommon.rng | 16 ++++--- src/conf/domain_conf.c | 46 ++++++++++++------- src/conf/domain_conf.h | 2 + src/qemu/qemu_process.c | 45 +++++++++++++----- src/qemu/qemu_validate.c | 8 ++++ ...v-missing-platform-info.x86_64-2.12.0.args | 37 +++++++++++++++ ...nch-security-sev-missing-platform-info.xml | 35 ++++++++++++++ tests/qemuxml2argvtest.c | 1 + 8 files changed, 157 insertions(+), 33 deletions(-) create mode 100644 tests/qemuxml2argvdata/launch-security-sev-missing-platfo= rm-info.x86_64-2.12.0.args create mode 100644 tests/qemuxml2argvdata/launch-security-sev-missing-platfo= rm-info.xml --=20 2.26.2

2 6