- Devel - libvirt List Archives

[libvirt] [PATCH v8 0/9] x86: Secure Encrypted Virtualization (AMD)
by Brijesh Singh 07 Jun '18

07 Jun '18

This patch series provides support for launching an encrypted guest using AMD's new Secure Encrypted Virtualization (SEV) feature. SEV is an extension to the AMD-V architecture which supports running multiple VMs under the control of a hypervisor. When enabled, SEV feature allows the memory contents of a virtual machine (VM) to be transparently encrypted with a key unique to the guest VM. At very high level the flow looks this: 1. mgmt tool calls virConnectGetDomainCapabilities. This returns an XML document that includes the following <feature> ... <sev supported='yes'> <cbitpos> </cbitpos> <reduced-phys-bits> </reduced-phys-bits> </sev> </feature> If <sev> is provided then we indicate that hypervisor is capable of launching SEV guest. mgmt tool can call virNodeGetSEVCapabilities() to get the additional informations like PDH and certificate chain etc. 2. (optional) mgmt tool can provide the PDH and Cert-chain to guest owner in case if guest owner wish to establish a secure connection with SEV firmware to negotiate a key used for validating the measurement. 3. mgmt tool requests to start a guest calling virCreateXML(), passing \ VIR_DOMAIN_START_PAUSED. The xml would include <launch-security type='sev'> <cbitpos>47</cbitpos> <reduced-phys-bits>1</reduced-phys-bits> <policy>0x1</policy> (optional) <dh-cert> </dh-cert> /* Guest owners Diffie-Hellman key */ <session> </session> /* Guest owners Session blob */ </launch-security> 4. Libvirt generate the QEMU cli arg to enable the SEV feature, a typical args looks like this: # $QEMU .. -machine memory-encryption=sev0 \ -object sev-guest,id=sev0,dh-cert-file=<file>.... 5. Libvirt generates lifecycle VIR_DOMAIN_EVENT_SUSPENDED_PAUSED event 6. mgmt tool gets the VIR_DOMAIN_EVENT_SUSPENDED_PAUSED and calls \ virDomainGetLaunchSecretInfo() to retrieve the measurement of encrypted memory. 7. (optional) mgmt tool can provide the measurement value to guest owner, which can validate the measurement and gives GO/NO-GO answer. If mgmt tool gets GO then it resumes the guest otherwise it calls destroy() to kill the guest. 8. mgmt tool resumes the guest TODO: * SEV guest require to use DMA apis for the virtio devices. In order to use the DMA apis the virtio devices must have this tag <driver iommu=on ats=on> It is a bit unclear to me where these changes need to go. Do we need to modify the libvirt to automatically add these when SEV is enabled or we ask mgmt tool to make sure that it creates XML with right tag to enable the DMA APIs for virtio devices. I am looking for some suggestions. Using these patches we have succesfully booted and tested a guest both with and without SEV enabled. SEV Firmware API spec is available at: https://support.amd.com/TechDocs/55766_SEV-KM%20API_Specification.pdf Change since v7: * rename virNodeSEVCapability() -> virNodeSEVInfo() * rebase the series Changes since v6: * add API to get SEV PDH and Certificate chain data * drop virsh command changes. We can revisit this later when we have more visibility on setter. Change since v5: * drop the seperate test patch and merge the code with other patches. * rename the xml from sev -> launch-security-sev * make policy field mandatory * address multiple feedback from previous reviews. Changes since v4: * add /dev/sev in shared device list Changes since v3: * rename QEMU_CAPS_SEV -> QEMU_CAPS_SEV_GUEST * update caps_2.12.0.x86_64.replies to include query-sev-capabilities data Changes since v2: * make cbitpos, policy and reduced-phys-bits as unsigned int * update virDomainGetLaunchSecurityInfo to accept virTypedParameterPtr *params instead of virTypedParameterPtr params. Changes since v1: * rename <sev> -> <launch-security> for domain * add more information about policy and other fields in domaincaps.html * split the domain_conf support in two patches * add virDomainGetLaunchInfo() to retrieve the SEV measurement * extend virsh command to show the domain's launch security information * add test cases to validate newly added <launch-security> element * fix issues reported with 'make check' and 'make syntax-check' The complete git tree is available at: https://github.com/codomania/libvirt/tree/v8 Brijesh Singh (11): qemu: provide support to query the SEV capability conf: expose SEV feature in domain capabilities libvirt: add new public API to get SEV Info remote: implement the remote protocol for virNodeSEVInfo() qemu: Add support to get the SEV info conf: introduce launch-security element in domain qemu/cgroup: add /dev/sev in shared devices list qemu: add support to launch SEV guest libvirt: add new public API to get launch security info remote: implement the remote protocol for launch security qemu: Add support to launch security info docs/drvqemu.html.in | 1 + docs/formatdomain.html.in | 115 +++++++++++++++ docs/formatdomaincaps.html.in | 30 ++++ docs/schemas/domaincaps.rng | 14 ++ docs/schemas/domaincommon.rng | 37 +++++ include/libvirt/libvirt-domain.h | 17 +++ include/libvirt/libvirt-host.h | 42 ++++++ src/conf/domain_capabilities.c | 31 +++- src/conf/domain_capabilities.h | 17 +++ src/conf/domain_conf.c | 133 +++++++++++++++++ src/conf/domain_conf.h | 27 ++++ src/driver-hypervisor.h | 14 ++ src/libvirt-domain.c | 48 +++++++ src/libvirt-host.c | 47 ++++++ src/libvirt_private.syms | 2 +- src/libvirt_public.syms | 2 + src/qemu/qemu.conf | 2 +- src/qemu/qemu_capabilities.c | 90 +++++++++++- src/qemu/qemu_capabilities.h | 4 + src/qemu/qemu_capspriv.h | 4 + src/qemu/qemu_cgroup.c | 2 +- src/qemu/qemu_command.c | 41 ++++++ src/qemu/qemu_driver.c | 160 +++++++++++++++++++++ src/qemu/qemu_monitor.c | 18 +++ src/qemu/qemu_monitor.h | 6 + src/qemu/qemu_monitor_json.c | 121 ++++++++++++++++ src/qemu/qemu_monitor_json.h | 5 + src/qemu/qemu_process.c | 62 ++++++++ src/qemu/test_libvirtd_qemu.aug.in | 1 + src/remote/remote_daemon_dispatch.c | 91 ++++++++++++ src/remote/remote_driver.c | 80 +++++++++++ src/remote/remote_protocol.x | 39 ++++- src/remote_protocol-structs | 24 ++++ tests/genericxml2xmlindata/launch-security-sev.xml | 24 ++++ tests/genericxml2xmltest.c | 2 + .../caps_2.12.0.x86_64.replies | 10 ++ tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml | 3 +- tests/qemuxml2argvdata/launch-security-sev.args | 29 ++++ tests/qemuxml2argvdata/launch-security-sev.xml | 37 +++++ tests/qemuxml2argvtest.c | 4 + 40 files changed, 1429 insertions(+), 7 deletions(-) create mode 100644 tests/genericxml2xmlindata/launch-security-sev.xml create mode 100644 tests/qemuxml2argvdata/launch-security-sev.args create mode 100644 tests/qemuxml2argvdata/launch-security-sev.xml -- 2.7.4

3 25

[libvirt] [PATCH v9 00/17] Add support for TPM emulator
by Stefan Berger 07 Jun '18

07 Jun '18

This series of patches adds support for the TPM emulator backend that is available in QEMU and based on swtpm + libtpms. It allows to attach a TPM 1.2 or 2.0 to a QEMU VM. sVirt labels are used for labeling the swtpm process, its Unix socket, and log file with the same label that the QEMU process gets. Besides that swtpm is added to the emulator cgroup to restrict its CPU usage. The device XML can be changed from a TPM 1.2 to a TPM 2.0 and back to a TPM 1.2. The device state is not removed during those changes but only when the domain is undefined. The swtpm needs persistent storage to store its state. For that I am using the uuid of the VM as part of the path since the name of the VM can be changed. Logfiles, PID files, and socket names are based on the name of the VM, though. Stefan v8->v9: - changed TPM 2 to 2.0 and version='2' in XML to version='2.0' - squashed v8 15/18 patch into v9 10/17. - Followed Ján Tomko's suggestions - updated AppArmor related patch v7->v8: - Delaying this series for 4.5; adjusted references to 4.4 - Fixed a test case since version='1.2' is now formatted as well - Appended patches for AppArmor and auditing - Appended patches that improve / fix existing code - patch for validating the TPM configuration rather than overwriting it; a particular case is the CRB interface does not work with a TPM 1.2 - swtpm_setup can be run for a TPM 2 in unprivileged mode as well v6->v7: - followed Jan Tomko's suggestion with resulting changing to patch 10/12. - re-added missing parts related to swtpm_setup and TPM that got lost in v4 v5->v6: - Addressed John Ferlan's comments - rebased on latest tip - Added patch 12. v4->v5: - Addressed John Ferlan's, Boris Fiuczysnki's and Marc Hartmayer's comments - rebased on latest tip v3->v4: - Addressed John Ferlan's comments - Fixed bugs I found while testing - rebased on latest tip Stefan Berger (17): conf: Add support for external swtpm TPM emulator to domain XML qemu: Extend QEMU capabilities with 'tpm-emulator' util: Implement virFileChownFiles() security: Add DAC and SELinux security for tpm-emulator qemu: Extend qemu_conf with tpm-emulator support qemu: Extend QEMU with external TPM support qemu: Add support for external swtpm TPM emulator tests: Add test cases for external swtpm TPM emulator security: Label the external swtpm with SELinux labels conf: Add support for choosing emulation of a TPM 2.0 qemu: Add swtpm to emulator cgroup news: Update news with new TPM emulator feature security: Add swtpm paths to the domain's AppArmor profile qemu: Run swtpm_setup in unprivileged mode for a TPM 2.0 conf: Audit TPM emulator device at domain startup conf: Use resrc=tpm in case of TPM passthrough following docs conf: Use virDomainChrSourceDefClear() rather than VIR_FREE() docs/auditlog.html.in | 2 +- docs/formatdomain.html.in | 47 +- docs/news.xml | 13 + docs/schemas/domaincommon.rng | 17 + examples/apparmor/libvirt-qemu | 3 + libvirt.spec.in | 2 + src/conf/domain_audit.c | 20 +- src/conf/domain_conf.c | 56 +- src/conf/domain_conf.h | 16 + src/libvirt_private.syms | 3 + src/qemu/Makefile.inc.am | 10 + src/qemu/libvirtd_qemu.aug | 5 + src/qemu/qemu.conf | 8 + src/qemu/qemu_capabilities.c | 5 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_cgroup.c | 36 + src/qemu/qemu_cgroup.h | 2 + src/qemu/qemu_command.c | 34 +- src/qemu/qemu_conf.c | 43 + src/qemu/qemu_conf.h | 6 + src/qemu/qemu_domain.c | 36 +- src/qemu/qemu_extdevice.c | 180 ++++ src/qemu/qemu_extdevice.h | 59 ++ src/qemu/qemu_process.c | 16 + src/qemu/qemu_security.c | 69 ++ src/qemu/qemu_security.h | 11 + src/qemu/qemu_tpm.c | 925 +++++++++++++++++++++ src/qemu/qemu_tpm.h | 56 ++ src/qemu/test_libvirtd_qemu.aug.in | 2 + src/security/security_dac.c | 7 + src/security/security_driver.h | 7 + src/security/security_manager.c | 36 + src/security/security_manager.h | 6 + src/security/security_selinux.c | 172 ++++ src/security/security_stack.c | 40 + src/security/virt-aa-helper.c | 45 + src/util/virfile.c | 55 ++ src/util/virfile.h | 3 + tests/qemucapabilitiesdata/caps_2.11.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml | 1 + .../tpm-emulator-tpm2.x86_64-latest.args | 33 + tests/qemuxml2argvdata/tpm-emulator-tpm2.xml | 30 + .../tpm-emulator.x86_64-latest.args | 33 + tests/qemuxml2argvdata/tpm-emulator.xml | 30 + tests/qemuxml2argvtest.c | 16 +- tests/qemuxml2xmloutdata/tpm-emulator-tpm2.xml | 34 + tests/qemuxml2xmloutdata/tpm-emulator.xml | 34 + tests/qemuxml2xmltest.c | 1 + 51 files changed, 2251 insertions(+), 19 deletions(-) create mode 100644 src/qemu/qemu_extdevice.c create mode 100644 src/qemu/qemu_extdevice.h create mode 100644 src/qemu/qemu_tpm.c create mode 100644 src/qemu/qemu_tpm.h create mode 100644 tests/qemuxml2argvdata/tpm-emulator-tpm2.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/tpm-emulator-tpm2.xml create mode 100644 tests/qemuxml2argvdata/tpm-emulator.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/tpm-emulator.xml create mode 100644 tests/qemuxml2xmloutdata/tpm-emulator-tpm2.xml create mode 100644 tests/qemuxml2xmloutdata/tpm-emulator.xml -- 2.14.3

1 19

[libvirt] [PATCH 0/4] travis: Various cleanups
by Andrea Bolognani 07 Jun '18

07 Jun '18

Just getting rid of some useless stuff and making the whole thing simpler and more consistent. Andrea Bolognani (4): travis: Skip macOS upgrade travis: Don't duplicate Docker invocation travis: Introduce MACOS_CMD travis: Rename DOCKER_CMD to LINUX_CMD .travis.yml | 65 ++++++++++++++++++++++++----------------------------- 1 file changed, 29 insertions(+), 36 deletions(-) -- 2.17.1

1 4

[libvirt] [PATCH] docs: remove git snapshot download links
by Daniel P. Berrangé 07 Jun '18

07 Jun '18

The process used to build the snapshots no longer works because the box it runs on is outdated. Analysing the web logs shows the majority of traffic to these links is from search engine bots. With those removed, there is about 1 hit per day from (probable) humans. Most users needing a tarball are better served by using official releases. Those needing latest code are better served by using git checkout. The tarball snapshots are not compelling enough to invest time in fixing the script that produces them. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- NB when pushing this, I would delete the existing files from the download location so we aren't left with stale files, and disable the (now broken) cronjob. docs/downloads.html.in | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/docs/downloads.html.in b/docs/downloads.html.in index 2956a4f60e..657cd6a6f8 100644 --- a/docs/downloads.html.in +++ b/docs/downloads.html.in @@ -433,21 +433,6 @@ <li><a href="https://libvirt.org/sources/">libvirt.org HTTPS server</a></li> </ul> - <h2><a id="hourly">Hourly development snapshots</a></h2> - - <p> - Once an hour, an automated snapshot is made from the git server - source tree. These snapshots should be usable, but we make no guarantees - about their stability; furthermore, they should NOT be - considered formal releases, and they may have transient security - problems that will not be assigned a CVE. - </p> - - <ul> - <li><a href="ftp://libvirt.org/libvirt/libvirt-git-snapshot.tar.xz">libvirt.org FTP server</a></li> - <li><a href="https://libvirt.org/sources/libvirt-git-snapshot.tar.xz">libvirt.org HTTP server</a></li> - </ul> - <h2><a id="schedule">Primary release schedule</a></h2> <p> -- 2.17.0

2 1

[libvirt] [PATCH] travis: Whitespace fixes
by Andrea Bolognani 07 Jun '18

07 Jun '18

Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- Pushed as embarrassingly trivial. .travis.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.travis.yml b/.travis.yml index 771cd93604..ac0d48a606 100644 --- a/.travis.yml +++ b/.travis.yml @@ -3,7 +3,7 @@ language: generic branches: except: - - /^.*-maint$/ + - /^.*-maint$/ matrix: include: @@ -59,7 +59,6 @@ matrix: - find -name test-suite.log | xargs cat - echo '=== LOG FILE(S) END ===' - git: submodules: true -- 2.17.1

1 0

[libvirt] [PATCH v3] travis: switch to using Ubuntu 16.04 and 18.04
by Daniel P. Berrangé 07 Jun '18

07 Jun '18

The container images provided by Travis only support Ubuntu 14.04, however, Travis has ability to run docker, which allows the build script to use arbitrary OS images. This takes advantage of that to convert the build over to Ubuntu 16.04 and 18.04 This is using the official Ubuntu provided images and installing extra build deps required, as we previously did with Travis container images. With the switch to Docker though, this can be improved, by building custom Docker images with all the deps pre-installed which will cut down build time. This can be driven from the package lists in libvirt-jenkins-ci repo, to remove the duplication. This work for future improvement though, this just does the minimal conversion to match what we already do, but with newer distro. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- .travis.yml | 214 +++++++++++++++++++++++++++++----------------------- 1 file changed, 118 insertions(+), 96 deletions(-) diff --git a/.travis.yml b/.travis.yml index c71411dcae..771cd93604 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,6 +1,5 @@ -sudo: false -language: c -cache: ccache +sudo: required +language: generic branches: except: @@ -8,17 +7,38 @@ branches: matrix: include: - - compiler: gcc - dist: trusty + - services: + - docker env: - - PYTHON=$(which python2) - - DISTCHECK_CONFIGURE_FLAGS="--with-init-script=upstart" - - compiler: clang - dist: trusty - env: - - PYTHON=$(which python3) + - IMAGE=ubuntu:18.04 - DISTCHECK_CONFIGURE_FLAGS="--with-init-script=systemd" + script: + - docker run + --privileged + -v $(pwd):/build + -w /build + -e VIR_TEST_DEBUG="$VIR_TEST_DEBUG" + -e PACKAGES="$PACKAGES" + -e DISTCHECK_CONFIGURE_FLAGS="$DISTCHECK_CONFIGURE_FLAGS" + "$IMAGE" + /bin/sh -xc "$DOCKER_CMD" + - services: + - docker + env: + - IMAGE=ubuntu:16.04 + - DISTCHECK_CONFIGURE_FLAGS="--with-init-script=upstart" + script: + - docker run + --privileged + -v $(pwd):/build + -w /build + -e VIR_TEST_DEBUG="$VIR_TEST_DEBUG" + -e PACKAGES="$PACKAGES" + -e DISTCHECK_CONFIGURE_FLAGS="$DISTCHECK_CONFIGURE_FLAGS" + "$IMAGE" + /bin/sh -xc "$DOCKER_CMD" - compiler: clang + language: c os: osx env: - PATH="/usr/local/opt/gettext/bin:/usr/local/opt/ccache/libexec:/usr/local/opt/rpcgen/bin:$PATH" @@ -27,80 +47,18 @@ matrix: - brew update - brew upgrade - brew install python ccache rpcgen yajl + before_script: + - ./autogen.sh --prefix=$(pwd)/install-root script: # We can't run make distcheck/syntax-check because they # fail on macOS, but doing 'install' and 'dist' gives us # some useful coverage - make -j3 && make -j3 install && make -j3 dist + after_failure: + - echo '=== LOG FILE(S) START ===' + - find -name test-suite.log | xargs cat + - echo '=== LOG FILE(S) END ===' -addons: - apt: - # Please keep this list sorted alphabetically - packages: - - augeas-tools - - autoconf - - automake - - autopoint - - bash-completion - - ccache - - dnsmasq-base - - dwarves - - ebtables - - gcc - - gettext - - glusterfs-client - - libacl1-dev - - libapparmor-dev - - libattr1-dev - - libaudit-dev - - libavahi-client-dev - - libblkid-dev - - libc6-dev - - libcap-ng-dev - - libc-dev-bin - - libcurl4-gnutls-dev - - libdbus-1-dev - - libdevmapper-dev - - libfuse-dev - - libgnutls-dev - - libnetcf-dev - - libnl-3-dev - - libnl-route-3-dev - - libnuma-dev - - libopenwsman-dev - - libparted-dev - - libpcap-dev - - libpciaccess-dev - - librbd-dev - - libreadline-dev - - libsanlock-dev - - libsasl2-dev - - libselinux1-dev - - libssh2-1-dev - - libssh-dev - - libtirpc-dev - - libtool - - libudev-dev - - libxen-dev - - libxml2-dev - - libxml2-utils - - libyajl-dev - - lvm2 - - make -# - nfs-common # broken on trusty since build #807 (2018-01-09) - - open-iscsi - - parted - - patch - - perl - - pkgconf - - policykit-1 - - qemu-utils - - radvd - - scrub - - sheepdog - - systemtap-sdt-dev - - xsltproc - - zfs-fuse git: submodules: true @@ -108,23 +66,87 @@ git: env: global: - VIR_TEST_DEBUG=1 - -before_script: - - ./autogen.sh --prefix=$(pwd)/install-root - -script: - - make -j3 && make -j3 syntax-check && make -j3 distcheck DISTCHECK_CONFIGURE_FLAGS=$DISTCHECK_CONFIGURE_FLAGS - -after_failure: - - echo '============================================================================' - - 'ver=$(sed -n "s/AC_INIT(\[libvirt\], \[$[0-9.]*$\],.*/\1/p" configure.ac); - if [ -f $(pwd)/tests/test-suite.log ]; then - cat $(pwd)/tests/test-suite.log; - elif [ -f libvirt-$ver/_build/tests/test-suite.log ]; then - cat libvirt-$ver/_build/tests/test-suite.log; - else - echo "=== NO LOG FILE FOUND ==="; - fi' + - DOCKER_CMD=" + apt-get update && + apt-get install -y \$PACKAGES && + ./autogen.sh && + make -j3 && + make -j3 syntax-check && + make -j3 distcheck DISTCHECK_CONFIGURE_FLAGS=\"\$DISTCHECK_CONFIGURE_FLAGS\" || + ( + echo '=== LOG FILE(S) START ===' + find -name test-suite.log | xargs cat + echo '=== LOG FILE(S) END ===' + exit 1 + ) + " + # Please keep this list sorted alphabetically + - PACKAGES=" + augeas-tools + autoconf + automake + autopoint + bash-completion + ccache + dnsmasq-base + dwarves + ebtables + gcc + gettext + git + glusterfs-client + libacl1-dev + libapparmor-dev + libattr1-dev + libaudit-dev + libavahi-client-dev + libblkid-dev + libc6-dev + libcap-ng-dev + libc-dev-bin + libdbus-1-dev + libdevmapper-dev + libfuse-dev + libgnutls28-dev + libnetcf-dev + libnl-3-dev + libnl-route-3-dev + libnuma-dev + libopenwsman-dev + libparted-dev + libpcap-dev + libpciaccess-dev + librbd-dev + libreadline-dev + libsanlock-dev + libsasl2-dev + libselinux1-dev + libssh2-1-dev + libssh-dev + libtirpc-dev + libtool + libudev-dev + libxen-dev + libxml2-dev + libxml2-utils + libyajl-dev + lvm2 + make + nfs-common + open-iscsi + parted + patch + perl + pkgconf + policykit-1 + qemu-utils + radvd + scrub + sheepdog + systemtap-sdt-dev + xsltproc + zfs-fuse + " notifications: irc: -- 2.17.0

2 2

[libvirt] [PATCH] util: Implement and use virFileIsRegular() rather than d_type
by Stefan Berger 07 Jun '18

07 Jun '18

The dirent's d_type field is not portable to all platforms. So we have to use stat() to determine the type of file for the functions that need to be cross-platform. Fix virFileChownFiles() by calling the new virFileIsRegular() function. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- src/libvirt_private.syms | 1 + src/util/virfile.c | 17 +++++++++++++---- src/util/virfile.h | 1 + 3 files changed, 15 insertions(+), 4 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 43bbdef8f1..b4ab1f3629 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1796,6 +1796,7 @@ virFileIsDir; virFileIsExecutable; virFileIsLink; virFileIsMountPoint; +virFileIsRegular; virFileIsSharedFS; virFileIsSharedFSType; virFileLength; diff --git a/src/util/virfile.c b/src/util/virfile.c index e41881f6c9..12b41a64e0 100644 --- a/src/util/virfile.c +++ b/src/util/virfile.c @@ -1851,6 +1851,15 @@ virFileIsDir(const char *path) return (stat(path, &s) == 0) && S_ISDIR(s.st_mode); } + +bool +virFileIsRegular(const char *path) +{ + struct stat s; + return (stat(path, &s) == 0) && S_ISREG(s.st_mode); +} + + /** * virFileExists: Check for presence of file * @path: Path of file to check @@ -3005,12 +3014,13 @@ int virFileChownFiles(const char *name, return -1; while ((direrr = virDirRead(dir, &ent, name)) > 0) { - if (ent->d_type != DT_REG) - continue; - + VIR_FREE(path); if (virAsprintf(&path, "%s/%s", name, ent->d_name) < 0) goto cleanup; + if (!virFileIsRegular(path)) + continue; + if (chown(path, uid, gid) < 0) { virReportSystemError(errno, _("cannot chown '%s' to (%u, %u)"), @@ -3018,7 +3028,6 @@ int virFileChownFiles(const char *name, (unsigned int) gid); goto cleanup; } - VIR_FREE(path); } if (direrr < 0) diff --git a/src/util/virfile.h b/src/util/virfile.h index c7a32c30a8..59c14b97a6 100644 --- a/src/util/virfile.h +++ b/src/util/virfile.h @@ -194,6 +194,7 @@ off_t virFileLength(const char *path, int fd) ATTRIBUTE_NONNULL(1); bool virFileIsDir (const char *file) ATTRIBUTE_NONNULL(1); bool virFileExists(const char *file) ATTRIBUTE_NONNULL(1) ATTRIBUTE_NOINLINE; bool virFileIsExecutable(const char *file) ATTRIBUTE_NONNULL(1); +bool virFileIsRegular(const char *file) ATTRIBUTE_NONNULL(1); enum { VIR_FILE_SHFS_NFS = (1 << 0), -- 2.14.4

3 4

[libvirt] [PATCH] qemu_tpm: Drop needles include of cap-ng.h
by Michal Privoznik 07 Jun '18

07 Jun '18

qemu_tpm.c is not calling any capng_* functions. Let's drop this include then. This also fixes a build failure without capng. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Pushed under build breaker and trivial rules. src/qemu/qemu_tpm.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index 2349fa92d9..278b262c48 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -25,7 +25,6 @@ #include <sys/types.h> #include <unistd.h> #include <fcntl.h> -#include <cap-ng.h> #include "qemu_extdevice.h" #include "qemu_domain.h" -- 2.16.4

1 1

[libvirt] Mystery of qemu being unable to open NBD Unix domain socket in current directory
by Richard W.M. Jones 07 Jun '18

07 Jun '18

I'm chasing down a very frustrating bug which only happens on i686 & Koji during the nbdkit tests and seemingly nowhere else. Anyway this is what I've been able to put together: The libguestfs appliance (guest) is created with this XML snippet: <disk device="disk" type="network"> <source protocol="nbd"> <host transport="unix" socket="cow.sock"/> </source> <target dev="sda" bus="scsi"/> <driver name="qemu" type="raw" cache="writeback"/> <address type="drive" controller="0" bus="0" target="0" unit="0"/> </disk> It fails to start with the error: internal error: process exited while connecting to monitor: 2018-06-06T17:02:54.450507Z qemu-system-i386: -drive file=nbd+unix://?socket=cow.sock,format=raw,if=none,id=drive-scsi0-0-0-0,cache=writeback: Failed to connect socket cow.sock: No such file or directory [code=1 int1=-1] The socket definitely exists in the directory of the program running libvirt. I verified that by adding ls -l commands to the build: srwxr-xr-x. 1 mockbuild mockbuild 0 Jun 6 17:02 cow.sock Permissions on the containing directories are fine (the whole lot is running as mockbuild): + pwd /builddir/build/BUILD/nbdkit-1.3.1/tests + ls -ld /builddir drwx------. 5 mockbuild mockbuild 4096 Jun 6 17:00 /builddir + ls -ld /builddir/build drwxr-xr-x. 9 mockbuild mockbuild 4096 Jun 6 16:57 /builddir/build + ls -ld /builddir/build/BUILD drwxrwxr-x. 3 mockbuild 1000 4096 Jun 6 16:59 /builddir/build/BUILD + ls -ld /builddir/build/BUILD/nbdkit-1.3.1 drwxr-xr-x. 11 mockbuild mockbuild 4096 Jun 6 17:00 /builddir/build/BUILD/nbdkit-1.3.1 + ls -ld /builddir/build/BUILD/nbdkit-1.3.1/tests drwxr-xr-x. 4 mockbuild mockbuild 4096 Jun 6 17:02 /builddir/build/BUILD/nbdkit-1.3.1/tests The qemu log doesn't give any clues: 2018-06-06 17:02:54.412+0000: starting up libvirt version: 4.4.0, package: 1.fc29 (Fedora Project, 2018-06-05-11:53:38, buildvm-12.phx2.fedoraproject.org) qemu version: 2.12.0qemu-2.12.0-2.fc29, kernel: 4.16.8-300.fc28.x86_64, hostname: buildhw-10.phx2.fedoraproject.org LC_ALL=C PATH=/builddir/build/BUILD/nbdkit-1.3.1:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/sbin HOME=/builddir USER=mockbuild LOGNAME=mockbuild QEMU_AUDIO_DRV=none TMPDIR=/var/tmp /usr/bin/qemu-system-i386 -name guest=guestfs-62ak9dzrjxfoctua,debug-threads=on -S -object secret,id=masterKey0,format=raw,file=/builddir/.config/libvirt/qemu/lib/domain-3-guestfs-62ak9dzrjxfo/master-key.aes -machine pc-i440fx-2.12,accel=tcg,usb=off,dump-guest-core=off -m 500 -realtime mlock=off -smp 1,sockets=1,cores=1,threads=1 -uuid 6094da49-2def-4256-b901-e4fe5f1409c8 -display none -no-user-config -nodefaults -device sga -chardev socket,id=charmonitor,path=/builddir/.config/libvirt/qemu/lib/domain-3-guestfs-62ak9dzrjxfo/monitor.sock,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc,driftfix=slew -global kvm-pit.lost_tick_policy=delay -no-hpet -no-reboot -no-acpi -boot strict=on -kernel /var/tmp/.guestfs-1000/appliance.d/kernel -initrd /var/tmp/.guestfs-1000/appliance.d/initrd -append 'panic=1 noapic console=ttyS0 edd=off udevtimeout=6000 udev.event-timeout=6000 no_timer_check printk.time=1 cgroup_disable=memory usbcore.nousb cryptomgr.notests tsc=reliable 8250.nr_uarts=1 root=/dev/sdb selinux=0 guestfs_verbose=1 TERM=vt100' -device virtio-scsi-pci,id=scsi0,bus=pci.0,addr=0x2 -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x3 -drive 'file=nbd+unix://?socket=cow.sock,format=raw,if=none,id=drive-scsi0-0-0-0,cache=writeback' -device scsi-hd,bus=scsi0.0,channel=0,scsi-id=0,lun=0,drive=drive-scsi0-0-0-0,id=scsi0-0-0-0,bootindex=1,write-cache=on -drive file=/tmp/libguestfsprC4lc/overlay1.qcow2,format=qcow2,if=none,id=drive-scsi0-0-1-0,cache=unsafe -device scsi-hd,bus=scsi0.0,channel=0,scsi-id=1,lun=0,drive=drive-scsi0-0-1-0,id=scsi0-0-1-0,write-cache=on -chardev socket,id=charserial0,path=/tmp/libguestfsj35K6W/console.sock -device isa-serial,chardev=charserial0,id=serial0 -chardev socket,id=charchannel0,path=/tmp/libguestfsj35K6W/guestfsd.sock -device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=org.libguestfs.channel.0 -object rng-random,id=objrng0,filename=/dev/urandom -device virtio-rng-pci,rng=objrng0,id=rng0,bus=pci.0,addr=0x4 -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny -msg timestamp=on 2018-06-06 17:02:54.412+0000: Domain id=3 is tainted: custom-argv 2018-06-06T17:02:54.450507Z qemu-system-i386: -drive file=nbd+unix://?socket=cow.sock,format=raw,if=none,id=drive-scsi0-0-0-0,cache=writeback: Failed to connect socket cow.sock: No such file or directory 2018-06-06 17:02:54.453+0000: shutting down, reason=failed At this point I don't really have any ideas. Does libvirt now run qemu in a different directory? Does the error message mean something else apart from the file not existing? Also the nbd+unix syntax doesn't appear to be documented in qemu. Is this a new thing? Normally we use nbd:unix:... Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com virt-p2v converts physical machines to virtual machines. Boot with a live CD or over the network (PXE) and turn machines into KVM guests. http://libguestfs.org/virt-v2v

3 5

Re: [libvirt] [PATCH v9 06/17] qemu: Extend QEMU with external TPM support
by bushuanshuan 07 Jun '18

07 Jun '18

... > +static int > +qemuExtTPMStartEmulator(virQEMUDriverPtr driver, > + virDomainDefPtr def, > + qemuDomainLogContextPtr logCtxt) > +{ ... > + if (!(cmd = qemuTPMEmulatorBuildCommand(tpm, def->name, def->uuid, > + driver->privileged, > + cfg->swtpm_user, > + cfg->swtpm_group))) > + goto cleanup; > + > + if (qemuExtDeviceLogCommand(logCtxt, cmd, "TPM Emulator") < 0) > + goto cleanup; > + > + virCommandSetErrorBuffer(cmd, &errbuf); > + > + if (virCommandRun(cmd, &exitstatus) < 0 || exitstatus != 0) { > + virReportError(VIR_ERR_INTERNAL_ERROR, > + _("Could not start 'swtpm'. exitstatus: %d, " > + "error: %s"), exitstatus, errbuf); > + goto cleanup; > + } Now that the sensitive data in NVRAM need to be protected, it might be a feasible way that swtpm uses the 'key' to encrypt it when VM shutdown. I wonder why don't use the key when swtpm process is launched here. Of course, we should avoid to let the key exposed in system log when we design the encryption scheme. Another question is: where we can store the key securely. Maybe physical TPM can help this. What do you think about this question? ... Thanks, Shuanshuan Bu

2 1

[libvirt] [PATCH] travis: switch to using Ubuntu 16.04 and 18.04
by Daniel P. Berrangé 07 Jun '18

07 Jun '18

The container images provided by Travis only support Ubuntu 14.04, however, Travis has ability to run docker, which allows the build script to use arbitrary OS images. This takes advantage of that to convert the build over to Ubuntu 16.04 and 18.04 This is using the official Ubuntu provided images and installing extra build deps required, as we previously did with Travis container images. With the switch to Docker though, this can be improved, by building custom Docker images with all the deps pre-installed which will cut down build time. This can be driven from the package lists in libvirt-jenkins-ci repo, to remove the duplication. This work for future improvement though, this just does the minimal conversion to match what we already do, but with newer distro. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- .travis.yml | 212 ++++++++++++++++++++++++++++------------------------ 1 file changed, 116 insertions(+), 96 deletions(-) diff --git a/.travis.yml b/.travis.yml index c71411dcae..15b5e933e9 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,6 +1,5 @@ -sudo: false -language: c -cache: ccache +sudo: required +language: generic branches: except: @@ -8,17 +7,38 @@ branches: matrix: include: - - compiler: gcc - dist: trusty + - services: + - docker env: - - PYTHON=$(which python2) - - DISTCHECK_CONFIGURE_FLAGS="--with-init-script=upstart" - - compiler: clang - dist: trusty + - DISTCHECK_FLAGS="--with-init-script=upstart" + before_install: + - docker pull berrange/test + - docker run + --privileged + -v `pwd`:/build + -w /build + -e VIR_TEST_DEBUG="$VIR_TEST_DEBUG" + -e PACKAGES="$PACKAGES" + -e DISTCHECK_FLAGS="$DISTCHECK_FLAGS" + ubuntu:18.04 + /bin/sh -c "$DOCKER_CMD" + - services: + - docker env: - - PYTHON=$(which python3) - - DISTCHECK_CONFIGURE_FLAGS="--with-init-script=systemd" + - DISTCHECK_FLAGS="--with-init-script=upstart" + before_install: + - docker pull berrange/test + - docker run + --privileged + -v `pwd`:/build + -w /build + -e VIR_TEST_DEBUG="$VIR_TEST_DEBUG" + -e PACKAGES="$PACKAGES" + -e DISTCHECK_FLAGS="$DISTCHECK_FLAGS" + ubuntu:16.04 + /bin/sh -c "$DOCKER_CMD" - compiler: clang + language: c os: osx env: - PATH="/usr/local/opt/gettext/bin:/usr/local/opt/ccache/libexec:/usr/local/opt/rpcgen/bin:$PATH" @@ -27,80 +47,18 @@ matrix: - brew update - brew upgrade - brew install python ccache rpcgen yajl + before_script: + - ./autogen.sh --prefix=$(pwd)/install-root script: # We can't run make distcheck/syntax-check because they # fail on macOS, but doing 'install' and 'dist' gives us # some useful coverage - make -j3 && make -j3 install && make -j3 dist + after_failure: + - echo '=== LOG FILE(S) START ===' + - find -name test-suite.log | xargs cat + - echo '=== LOG FILE(S) END ===' -addons: - apt: - # Please keep this list sorted alphabetically - packages: - - augeas-tools - - autoconf - - automake - - autopoint - - bash-completion - - ccache - - dnsmasq-base - - dwarves - - ebtables - - gcc - - gettext - - glusterfs-client - - libacl1-dev - - libapparmor-dev - - libattr1-dev - - libaudit-dev - - libavahi-client-dev - - libblkid-dev - - libc6-dev - - libcap-ng-dev - - libc-dev-bin - - libcurl4-gnutls-dev - - libdbus-1-dev - - libdevmapper-dev - - libfuse-dev - - libgnutls-dev - - libnetcf-dev - - libnl-3-dev - - libnl-route-3-dev - - libnuma-dev - - libopenwsman-dev - - libparted-dev - - libpcap-dev - - libpciaccess-dev - - librbd-dev - - libreadline-dev - - libsanlock-dev - - libsasl2-dev - - libselinux1-dev - - libssh2-1-dev - - libssh-dev - - libtirpc-dev - - libtool - - libudev-dev - - libxen-dev - - libxml2-dev - - libxml2-utils - - libyajl-dev - - lvm2 - - make -# - nfs-common # broken on trusty since build #807 (2018-01-09) - - open-iscsi - - parted - - patch - - perl - - pkgconf - - policykit-1 - - qemu-utils - - radvd - - scrub - - sheepdog - - systemtap-sdt-dev - - xsltproc - - zfs-fuse git: submodules: true @@ -108,23 +66,85 @@ git: env: global: - VIR_TEST_DEBUG=1 - -before_script: - - ./autogen.sh --prefix=$(pwd)/install-root - -script: - - make -j3 && make -j3 syntax-check && make -j3 distcheck DISTCHECK_CONFIGURE_FLAGS=$DISTCHECK_CONFIGURE_FLAGS - -after_failure: - - echo '============================================================================' - - 'ver=$(sed -n "s/AC_INIT(\[libvirt\], \[$[0-9.]*$\],.*/\1/p" configure.ac); - if [ -f $(pwd)/tests/test-suite.log ]; then - cat $(pwd)/tests/test-suite.log; - elif [ -f libvirt-$ver/_build/tests/test-suite.log ]; then - cat libvirt-$ver/_build/tests/test-suite.log; - else - echo "=== NO LOG FILE FOUND ==="; - fi' + - DOCKER_CMD=" + apt-get update && + apt-get install -y \$PACKAGES && + ./autogen.sh --prefix=/build/install-root && + make -j 3 && + make -j 3 syntax-check && + make -j 3 distcheck DISTCHECK_CONFIGURE_FLAGS=\$DISTCHECK_FLAGS || + ( + echo '=== LOG FILE(S) START ===' + find -name test-suite.log | xargs cat + echo '=== LOG FILE(S) END ===' + exit 1 + ) + " + - PACKAGES=" + augeas-tools + autoconf + automake + autopoint + bash-completion + ccache + dnsmasq-base + dwarves + ebtables + gcc + gettext + git + glusterfs-client + libacl1-dev + libapparmor-dev + libattr1-dev + libaudit-dev + libavahi-client-dev + libblkid-dev + libc6-dev + libcap-ng-dev + libc-dev-bin + libdbus-1-dev + libdevmapper-dev + libfuse-dev + libgnutls28-dev + libnetcf-dev + libnl-3-dev + libnl-route-3-dev + libnuma-dev + libopenwsman-dev + libparted-dev + libpcap-dev + libpciaccess-dev + librbd-dev + libreadline-dev + libsanlock-dev + libsasl2-dev + libselinux1-dev + libssh2-1-dev + libssh-dev + libtirpc-dev + libtool + libudev-dev + libxen-dev + libxml2-dev + libxml2-utils + libyajl-dev + lvm2 + make + nfs-common + open-iscsi + parted + patch + perl + pkgconf + policykit-1 + qemu-utils + radvd + scrub + sheepdog + systemtap-sdt-dev + xsltproc + zfs-fuse" notifications: irc: -- 2.17.0

3 6

[libvirt] [PATCH] schema: remove reference to brctl
by Ján Tomko 07 Jun '18

07 Jun '18

ip(8) is the contemporary way of configuring bridges. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- docs/schemas/interface.rng | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/schemas/interface.rng b/docs/schemas/interface.rng index 4bb08e96a4..a4fddaaedc 100644 --- a/docs/schemas/interface.rng +++ b/docs/schemas/interface.rng @@ -130,7 +130,8 @@ <ref name="virOnOff"/> </attribute> </optional> -  +  <optional v:since="2"> <attribute name="delay"><ref name="timeval"/></attribute> </optional> -- 2.13.6

2 1

[libvirt] [PATCH] Don't use enums in TPM struct fields
by Daniel P. Berrangé 07 Jun '18

07 Jun '18

When using an enum in a struct field, the compiler is free to decide to make it an unsigned type if it desires. This in turn leads to bugs when code does if ((def->foo = virDomainFooTypeFromString(str)) < 0) ... because 'def->foo' can't technically have an unsigned value from the compiler's POV. While it is possible to add (int) casts in the code example above, this is not desirable because it is easy to miss out such casts. eg the code fixed here caused an error with clang builds ../../src/conf/domain_conf.c:12838:73: error: comparison of unsigned enum expression < 0 is always false [-Werror,-Wtautological-compare] if ((def->version = virDomainTPMVersionTypeFromString(version)) < 0) { ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~ Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/conf/domain_conf.c | 4 ++-- src/conf/domain_conf.h | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) Pushed as a FreeBSD build fix diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index c1f2583c29..5be773cda4 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -12795,7 +12795,7 @@ virDomainTPMDefParseXML(virDomainXMLOptionPtr xmlopt, model = virXMLPropString(node, "model"); if (model != NULL && - (int)(def->model = virDomainTPMModelTypeFromString(model)) < 0) { + (def->model = virDomainTPMModelTypeFromString(model)) < 0) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Unknown TPM frontend model '%s'"), model); goto error; @@ -12824,7 +12824,7 @@ virDomainTPMDefParseXML(virDomainXMLOptionPtr xmlopt, goto error; } - if ((int)(def->type = virDomainTPMBackendTypeFromString(backend)) < 0) { + if ((def->type = virDomainTPMBackendTypeFromString(backend)) < 0) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Unknown TPM backend type '%s'"), backend); diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 5f8960d90b..8a8121bf83 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -1307,10 +1307,10 @@ typedef enum { # define VIR_DOMAIN_TPM_DEFAULT_DEVICE "/dev/tpm0" struct _virDomainTPMDef { - virDomainTPMBackendType type; + int type; /* virDomainTPMBackendType */ virDomainDeviceInfo info; - virDomainTPMModel model; - virDomainTPMVersion version; + int model; /* virDomainTPMModel */ + int version; /* virDomainTPMVersion */ union { struct { virDomainChrSourceDef source; -- 2.17.0

3 5

[libvirt] [PATCH] storage: minor fix in luks encrypted volume creation
by Katerina Koukiou 07 Jun '18

07 Jun '18

This patch fixes the case when creating a luks encrypted volume via an xml file without 'secret' element. libvirtd was receiving SIGSEGV, now proper error is reported for the missing element. (see bz 1468422) Signed-off-by: Katerina Koukiou <kkoukiou(a)redhat.com> --- src/storage/storage_util.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/storage/storage_util.c b/src/storage/storage_util.c index 554fc757ed..18414ddb89 100644 --- a/src/storage/storage_util.c +++ b/src/storage/storage_util.c @@ -1277,6 +1277,13 @@ storageBackendCreateQemuImgSecretPath(virStoragePoolObjPtr pool, return NULL; } + if (!enc->secrets) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("A single <secret type='passphrase'...> " + "element is expected in encryption description")); + return NULL; + } + conn = virGetConnectSecret(); if (!conn) return NULL; -- 2.15.0

3 7

[libvirt] [PATCH v2] travis: switch to using Ubuntu 16.04 and 18.04
by Daniel P. Berrangé 07 Jun '18

07 Jun '18

The container images provided by Travis only support Ubuntu 14.04, however, Travis has ability to run docker, which allows the build script to use arbitrary OS images. This takes advantage of that to convert the build over to Ubuntu 16.04 and 18.04 This is using the official Ubuntu provided images and installing extra build deps required, as we previously did with Travis container images. With the switch to Docker though, this can be improved, by building custom Docker images with all the deps pre-installed which will cut down build time. This can be driven from the package lists in libvirt-jenkins-ci repo, to remove the duplication. This work for future improvement though, this just does the minimal conversion to match what we already do, but with newer distro. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- .travis.yml | 217 +++++++++++++++++++++++++++++----------------------- 1 file changed, 121 insertions(+), 96 deletions(-) diff --git a/.travis.yml b/.travis.yml index c71411dcae..1e2f946352 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,6 +1,5 @@ -sudo: false -language: c -cache: ccache +sudo: required +language: generic branches: except: @@ -8,17 +7,41 @@ branches: matrix: include: - - compiler: gcc - dist: trusty + - services: + - docker env: - - PYTHON=$(which python2) - - DISTCHECK_CONFIGURE_FLAGS="--with-init-script=upstart" - - compiler: clang - dist: trusty - env: - - PYTHON=$(which python3) + - IMAGE_NAME=ubuntu:18.04 + - PYTHON=python3 - DISTCHECK_CONFIGURE_FLAGS="--with-init-script=systemd" + before_script: + - docker run + --privileged + -v $(pwd):/build + -w /build + -e VIR_TEST_DEBUG="$VIR_TEST_DEBUG" + -e PACKAGES="$PACKAGES" + -e DISTCHECK_FLAGS="$DISTCHECK_CONFIGURE_FLAGS" + $IMAGE_NAME + /bin/sh -c "$DOCKER_CMD" + - services: + - docker + env: + - IMAGE_NAME=ubuntu:16.04 + - PYTHON=python2 + - DISTCHECK_CONFIGURE_FLAGS="--with-init-script=upstart" + before_script: + - docker pull berrange/test + - docker run + --privileged + -v $(pwd):/build + -w /build + -e VIR_TEST_DEBUG="$VIR_TEST_DEBUG" + -e PACKAGES="$PACKAGES" + -e DISTCHECK_FLAGS="$DISTCHECK_CONFIGURE_FLAGS" + $IMAGE_NAME + /bin/sh -c "$DOCKER_CMD" - compiler: clang + language: c os: osx env: - PATH="/usr/local/opt/gettext/bin:/usr/local/opt/ccache/libexec:/usr/local/opt/rpcgen/bin:$PATH" @@ -27,80 +50,18 @@ matrix: - brew update - brew upgrade - brew install python ccache rpcgen yajl + before_script: + - ./autogen.sh --prefix=$(pwd)/install-root script: # We can't run make distcheck/syntax-check because they # fail on macOS, but doing 'install' and 'dist' gives us # some useful coverage - make -j3 && make -j3 install && make -j3 dist + after_failure: + - echo '=== LOG FILE(S) START ===' + - find -name test-suite.log | xargs cat + - echo '=== LOG FILE(S) END ===' -addons: - apt: - # Please keep this list sorted alphabetically - packages: - - augeas-tools - - autoconf - - automake - - autopoint - - bash-completion - - ccache - - dnsmasq-base - - dwarves - - ebtables - - gcc - - gettext - - glusterfs-client - - libacl1-dev - - libapparmor-dev - - libattr1-dev - - libaudit-dev - - libavahi-client-dev - - libblkid-dev - - libc6-dev - - libcap-ng-dev - - libc-dev-bin - - libcurl4-gnutls-dev - - libdbus-1-dev - - libdevmapper-dev - - libfuse-dev - - libgnutls-dev - - libnetcf-dev - - libnl-3-dev - - libnl-route-3-dev - - libnuma-dev - - libopenwsman-dev - - libparted-dev - - libpcap-dev - - libpciaccess-dev - - librbd-dev - - libreadline-dev - - libsanlock-dev - - libsasl2-dev - - libselinux1-dev - - libssh2-1-dev - - libssh-dev - - libtirpc-dev - - libtool - - libudev-dev - - libxen-dev - - libxml2-dev - - libxml2-utils - - libyajl-dev - - lvm2 - - make -# - nfs-common # broken on trusty since build #807 (2018-01-09) - - open-iscsi - - parted - - patch - - perl - - pkgconf - - policykit-1 - - qemu-utils - - radvd - - scrub - - sheepdog - - systemtap-sdt-dev - - xsltproc - - zfs-fuse git: submodules: true @@ -108,23 +69,87 @@ git: env: global: - VIR_TEST_DEBUG=1 - -before_script: - - ./autogen.sh --prefix=$(pwd)/install-root - -script: - - make -j3 && make -j3 syntax-check && make -j3 distcheck DISTCHECK_CONFIGURE_FLAGS=$DISTCHECK_CONFIGURE_FLAGS - -after_failure: - - echo '============================================================================' - - 'ver=$(sed -n "s/AC_INIT(\[libvirt\], \[$[0-9.]*$\],.*/\1/p" configure.ac); - if [ -f $(pwd)/tests/test-suite.log ]; then - cat $(pwd)/tests/test-suite.log; - elif [ -f libvirt-$ver/_build/tests/test-suite.log ]; then - cat libvirt-$ver/_build/tests/test-suite.log; - else - echo "=== NO LOG FILE FOUND ==="; - fi' + - DOCKER_CMD=" + apt-get update && + apt-get install -y \$PACKAGES && + ./autogen.sh --prefix=$(pwd)/install-root && + make -j3 && + make -j3 syntax-check && + make -j3 distcheck DISTCHECK_CONFIGURE_FLAGS=\"\$DISTCHECK_FLAGS\" || + ( + echo '=== LOG FILE(S) START ===' + find -name test-suite.log | xargs cat + echo '=== LOG FILE(S) END ===' + exit 1 + ) + " + # Please keep this list sorted alphabetically + - PACKAGES=" + augeas-tools + autoconf + automake + autopoint + bash-completion + ccache + dnsmasq-base + dwarves + ebtables + gcc + gettext + git + glusterfs-client + libacl1-dev + libapparmor-dev + libattr1-dev + libaudit-dev + libavahi-client-dev + libblkid-dev + libc6-dev + libcap-ng-dev + libc-dev-bin + libdbus-1-dev + libdevmapper-dev + libfuse-dev + libgnutls28-dev + libnetcf-dev + libnl-3-dev + libnl-route-3-dev + libnuma-dev + libopenwsman-dev + libparted-dev + libpcap-dev + libpciaccess-dev + librbd-dev + libreadline-dev + libsanlock-dev + libsasl2-dev + libselinux1-dev + libssh2-1-dev + libssh-dev + libtirpc-dev + libtool + libudev-dev + libxen-dev + libxml2-dev + libxml2-utils + libyajl-dev + lvm2 + make + nfs-common + open-iscsi + parted + patch + perl + pkgconf + policykit-1 + qemu-utils + radvd + scrub + sheepdog + systemtap-sdt-dev + xsltproc + zfs-fuse + " notifications: irc: -- 2.17.0

2 1

[libvirt] [Bug] To long backingchain does not work (3 and more...)
by Xen Mann 07 Jun '18

07 Jun '18

Hey there! I'm experiencing a strange behavior with libvirt and backing chains. Getting higher than the first overlay results in a permission denied to the base image and I can't start any machine. # Results while attempting to start machine (after every attemt the whole files from ./houseBackup are restored) Base.img (ok - Win 10 Installation starting) FirstFloor.ovl (ok - Win 10 Installation starting) SecondFloor.ovl (permission denied -> Base.img) => assumed Bug Roof.ovl (permission denied -> Base.img) => assumed Bug The bug is described in detail here together with a minimal example. But maybe I'm still doing something wrong and somebody can give me a heads up =). https://bugzilla.redhat.com/show_bug.cgi?id=1588373 Thx, yours Xensemann!

2 1

[libvirt] [PATCH] virsh: fix help for detach-disk --print-xml
by Ján Tomko 07 Jun '18

07 Jun '18

The help message was copied from attach-interface. Introduced by commit <431e736>. https://bugzilla.redhat.com/show_bug.cgi?id=1588295 Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- Pushed as trivial. tools/virsh-domain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c index b555d746c5..6aa79f11b9 100644 --- a/tools/virsh-domain.c +++ b/tools/virsh-domain.c @@ -12296,7 +12296,7 @@ static const vshCmdOptDef opts_detach_disk[] = { VIRSH_COMMON_OPT_DOMAIN_CURRENT, {.name = "print-xml", .type = VSH_OT_BOOL, - .help = N_("print XML document rather than attach the interface") + .help = N_("print XML document rather than detach the disk") }, {.name = NULL} }; -- 2.16.1

1 0

[libvirt] [PATCH v2] As qemuMonitorJSONIOProcess() will unlock the qemu monitor, there is some extreme situation, eg qemu send message to monitor twice in a short time, where the local viriable 'msg' of qemuMonitorIOProcess() could be a wild point:
by Weilun Zhu 07 Jun '18

07 Jun '18

1. qemuMonitorSend() assign mon->msg to parameter 'msg', which is alse a local variable of its caller qemuMonitorJSONCommandWithFd(), cause eventloop to send message to monitor, then wait condition. 2. qemu send message to monitor for the first time immediately. 3. qemuMonitorIOProcess() is called, then wake up the qemuMonitorSend() thread, but the qemuMonitorSend() thread stuck for a while as cpu pressure or some other reasons,, which means the qemu monitor is still unlocked. 4. qemu send event message to monitor for the second time, such as RTC_CHANGE event 5. qemuMonitorIOProcess() is called, the local viriable 'msg' is assigned to mon->msg. 6. qemuMonitorIOProcess() call qemuMonitorJSONIOProcess() to deal with the qemu event. 7. qemuMonitorJSONIOProcess() unlock the qemu monitor in the macro 'QEMU_MONITOR_CALLBACK', then qemuMonitorSend() thread get the mutex and free the mon->msg, assign mon->msg to NULL. so the local viriable 'msg' of qemuMonitorIOProcess() is a wild pointer now. AFAIK, it is not harmful to call again virCondBroadcast() while msg is a wild pointer, but just in case, we fix it in this patch. --- src/qemu/qemu_monitor.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index 43f1d2f816..4a7013367d 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -454,6 +454,14 @@ qemuMonitorIOProcess(qemuMonitorPtr mon) #if DEBUG_IO VIR_DEBUG("Process done %d used %d", (int)mon->bufferOffset, len); #endif + + /* As the monitor mutex was unlocked in qemuMonitorJSONIOProcess() + * while dealing with qemu event, mon->msg could be changed, + * thus we re-acquire the msg here */ + msg = NULL; + if (mon->msg && mon->msg->txOffset == mon->msg->txLength) { + msg = mon->msg; + if (msg && msg->finished) virCondBroadcast(&mon->notify); return len; -- 2.18.0.rc1

1 0

Re: [libvirt] [PATCH] qemu: Introduce VIRTIO_NET_F_STANDBY feature bit to virtio_net
by Samudrala, Sridhar 06 Jun '18

06 Jun '18

On 6/4/2018 7:06 PM, Jason Wang wrote: > > > On 2018年06月05日 09:41, Samudrala, Sridhar wrote: >> Ping on this patch now that the kernel patches are accepted into >> davem's net-next tree. >> https://patchwork.ozlabs.org/cover/920005/ >> >> >> On 5/7/2018 4:09 PM, Sridhar Samudrala wrote: >>> This feature bit can be used by hypervisor to indicate virtio_net >>> device to >>> act as a standby for another device with the same MAC address. >>> >>> I tested this with a small change to the patch to mark the STANDBY >>> feature 'true' >>> by default as i am using libvirt to start the VMs. >>> Is there a way to pass the newly added feature bit 'standby' to qemu >>> via libvirt >>> XML file? >>> > > Maybe you can try qemu command line passthrough: > > https://libvirt.org/drvqemu.html#qemucommand It looks like this can be used to pass command line arguments to qemu. Is it possible to specify a virtio specific attribute via this method? For ex: to say mrg_rxbuf is off we can add the following line to virtio section of the domain xml file. <host mrg_rxbuf='off'/> I think libvirt needs to be extended to to support the new 'standby' attribute via this mechanism. Adding Liane Stump and libvirt to the CC list. Michael, Can we start with getting this patch into Qemu and an update to libvirt to support the 'standby' feature so that this feature can be enabled via some scripts/orchestration layer for now. We could improve this solution by enhancing Qemu to do automatic management of the addition/deletion of the primary device based on feature negotiation as a later patch. > > The patch looks good to me. Let's see if Michael have any comment. > > Thanks > >>> Signed-off-by: Sridhar Samudrala <sridhar.samudrala(a)intel.com> >>> --- >>> hw/net/virtio-net.c | 2 ++ >>> include/standard-headers/linux/virtio_net.h | 3 +++ >>> 2 files changed, 5 insertions(+) >>> >>> diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c >>> index 90502fca7c..38b3140670 100644 >>> --- a/hw/net/virtio-net.c >>> +++ b/hw/net/virtio-net.c >>> @@ -2198,6 +2198,8 @@ static Property virtio_net_properties[] = { >>> true), >>> DEFINE_PROP_INT32("speed", VirtIONet, net_conf.speed, >>> SPEED_UNKNOWN), >>> DEFINE_PROP_STRING("duplex", VirtIONet, net_conf.duplex_str), >>> + DEFINE_PROP_BIT64("standby", VirtIONet, host_features, >>> VIRTIO_NET_F_STANDBY, >>> + false), >>> DEFINE_PROP_END_OF_LIST(), >>> }; >>> diff --git a/include/standard-headers/linux/virtio_net.h >>> b/include/standard-headers/linux/virtio_net.h >>> index e9f255ea3f..01ec09684c 100644 >>> --- a/include/standard-headers/linux/virtio_net.h >>> +++ b/include/standard-headers/linux/virtio_net.h >>> @@ -57,6 +57,9 @@ >>> * Steering */ >>> #define VIRTIO_NET_F_CTRL_MAC_ADDR 23 /* Set MAC address */ >>> +#define VIRTIO_NET_F_STANDBY 62 /* Act as standby for >>> another device >>> + * with the same MAC. >>> + */ >>> #define VIRTIO_NET_F_SPEED_DUPLEX 63 /* Device set linkspeed >>> and duplex */ >>> #ifndef VIRTIO_NET_NO_LEGACY >> >

3 3

[libvirt] [PATCH v1 00/18] use VIR_AUTOFREE in src/util
by Sukrit Bhatnagar 06 Jun '18

06 Jun '18

This series of patches modifies some files in src/util to use VIR_AUTOFREE for automatic freeing of memory and get rid of some VIR_FREE macro invocations. Sukrit Bhatnagar (18): add macros for implementing automatic cleanup functionality use VIR_AUTOFREE in src/util/virarptable.c use VIR_AUTOFREE in src/util/virauth.c use VIR_AUTOFREE in src/util/virauthconfig.c use VIR_AUTOFREE in src/util/iohelper.c use VIR_AUTOFREE in src/util/viraudit.c use VIR_AUTOFREE in src/util/virbuffer.c use VIR_AUTOFREE in src/util/vircgroup.c use VIR_AUTOFREE in src/util/virfcp.c use VIR_AUTOFREE in src/util/virdnsmasq.c use VIR_AUTOFREE in src/util/vireventpoll.c use VIR_AUTOFREE in src/util/virdbus.c use VIR_AUTOFREE in src/util/virfdstream.c use VIR_AUTOFREE in src/util/virfile.c use VIR_AUTOFREE in src/util/virconf.c use VIR_AUTOFREE in src/util/virfilecache.c use VIR_AUTOFREE in src/util/virfirewall.c use VIR_AUTOFREE in src/util/virhook.c src/util/iohelper.c | 4 +- src/util/viralloc.h | 69 +++++++ src/util/virarptable.c | 9 +- src/util/viraudit.c | 3 +- src/util/virauth.c | 60 ++---- src/util/virauthconfig.c | 34 ++- src/util/virbuffer.c | 33 ++- src/util/vircgroup.c | 526 ++++++++++++++++------------------------------- src/util/virconf.c | 42 ++-- src/util/virdbus.c | 28 +-- src/util/virdnsmasq.c | 116 ++++------- src/util/vireventpoll.c | 7 +- src/util/virfcp.c | 20 +- src/util/virfdstream.c | 3 +- src/util/virfile.c | 303 +++++++++------------------ src/util/virfilecache.c | 35 +--- src/util/virfirewall.c | 13 +- src/util/virhook.c | 16 +- 18 files changed, 487 insertions(+), 834 deletions(-) -- 1.8.3.1

2 29

[libvirt] [PATCH 0/2] cmdDomblkinfo: introduce --all to show all
by Chen Hanxiao 06 Jun '18

06 Jun '18

This series introduce --all to cmdDomblkinfo to show all block devices info in one cmd. Likes a combination of domblklist and domblkinfo. Chen Hanxiao (2): cmdDomblkinfo: introduce --all to show all block devices info news: add cmdDomblkinfo --all option docs/news.xml | 8 ++++ tools/virsh-domain-monitor.c | 82 +++++++++++++++++++++++++++--------- tools/virsh.pod | 5 ++- 3 files changed, 75 insertions(+), 20 deletions(-) -- 2.17.0

1 2

[libvirt] [perl PATCH] Blacklist virGetLastError{Code,Domain}
by Daniel P. Berrangé 06 Jun '18

06 Jun '18

These methods will not be exposed to apps, since we auto raise all errors. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- t/030-api-coverage.t | 2 ++ 1 file changed, 2 insertions(+) Pushed as a trivial build fix diff --git a/t/030-api-coverage.t b/t/030-api-coverage.t index 39d6146..15d4a77 100644 --- a/t/030-api-coverage.t +++ b/t/030-api-coverage.t @@ -69,6 +69,8 @@ virFreeError virResetLastError virSaveLastError virGetLastErrorMessage +virGetLastErrorCode +virGetLastErrorDomain virConnectAuthCallbackPtr virConnectOpen -- 2.17.0

1 0

[libvirt] [go PATCH] Blacklist virGetLastError{Code,Domain}
by Daniel P. Berrangé 06 Jun '18

06 Jun '18

These methods will not be exposed to apps, since we always return all errors. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- api_test.go | 2 ++ 1 file changed, 2 insertions(+) Pushed as a trivial build fix diff --git a/api_test.go b/api_test.go index 27f77dd..53632df 100644 --- a/api_test.go +++ b/api_test.go @@ -69,6 +69,8 @@ var ( "virCopyLastError", "virFreeError", "virGetLastErrorMessage", + "virGetLastErrorCode", + "virGetLastErrorDomain", "virResetLastError", "virSaveLastError", "virDefaultErrorFunc", -- 2.17.0

1 0

[libvirt] [python PATCH] Blacklist virGetLastError{Code,Domain}
by Daniel P. Berrangé 06 Jun '18

06 Jun '18

These methods will not be exposed to apps, since we auto raise all errors. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- sanitytest.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) Pushed as a trivial build fix diff --git a/sanitytest.py b/sanitytest.py index 190d32b..d5c23dc 100644 --- a/sanitytest.py +++ b/sanitytest.py @@ -234,7 +234,9 @@ for name in sorted(basicklassmap): "ErrorFunc", "FreeError", "SaveLastError", "ResetError"]: continue - elif func in ["GetLastError", "GetLastErrorMessage", "ResetLastError", "Initialize"]: + elif func in ["GetLastError", "GetLastErrorMessage", + "GetLastErrorCode", "GetLastErrorDomain", + "ResetLastError", "Initialize"]: func = "vir" + func elif func == "SetErrorFunc": func = "RegisterErrorHandler" -- 2.17.0

1 0

[libvirt] [PATCH v7 0/9] x86: Secure Encrypted Virtualization (AMD)
by Brijesh Singh 06 Jun '18

06 Jun '18

This patch series provides support for launching an encrypted guest using AMD's new Secure Encrypted Virtualization (SEV) feature. SEV is an extension to the AMD-V architecture which supports running multiple VMs under the control of a hypervisor. When enabled, SEV feature allows the memory contents of a virtual machine (VM) to be transparently encrypted with a key unique to the guest VM. At very high level the flow looks this: 1. mgmt tool calls virConnectGetDomainCapabilities. This returns an XML document that includes the following <feature> ... <sev supported='yes'> <cbitpos> </cbitpos> <reduced-phys-bits> </reduced-phys-bits> </sev> </feature> If <sev> is provided then we indicate that hypervisor is capable of launching SEV guest. mgmt tool can call virNodeGetSEVCapabilities() to get the additional informations like PDH and certificate chain etc. 2. (optional) mgmt tool can provide the PDH and Cert-chain to guest owner in case if guest owner wish to establish a secure connection with SEV firmware to negotiate a key used for validating the measurement. 3. mgmt tool requests to start a guest calling virCreateXML(), passing \ VIR_DOMAIN_START_PAUSED. The xml would include <launch-security type='sev'> <cbitpos>47</cbitpos> <reduced-phys-bits>1</reduced-phys-bits> <policy>0x1</policy> (optional) <dh-cert> </dh-cert> /* Guest owners Diffie-Hellman key */ <session> </session> /* Guest owners Session blob */ </launch-security> 4. Libvirt generate the QEMU cli arg to enable the SEV feature, a typical args looks like this: # $QEMU .. -machine memory-encryption=sev0 \ -object sev-guest,id=sev0,dh-cert-file=<file>.... 5. Libvirt generates lifecycle VIR_DOMAIN_EVENT_SUSPENDED_PAUSED event 6. mgmt tool gets the VIR_DOMAIN_EVENT_SUSPENDED_PAUSED and calls virDomainGetLaunchSecretInfo() to retrieve the measurement of encrypted memory. 7. (optional) mgmt tool can provide the measurement value to guest owner, which can validate the measurement and gives GO/NO-GO answer. If mgmt tool gets GO then it resumes the guest otherwise it calls destroy() to kill the guest. 8. mgmt tool resumes the guest TODO: * SEV guest require to use DMA apis for the virtio devices. In order to use the DMA apis the virtio devices must have this tag <driver iommu=on ats=on> It is a bit unclear to me where these changes need to go. Do we need to modify the libvirt to automatically add these when SEV is enabled or we ask mgmt tool to make sure that it creates XML with right tag to enable the DMA APIs for virtio devices. I am looking for some suggestions. Using these patches we have succesfully booted and tested a guest both with and without SEV enabled. SEV Firmware API spec is available at: https://support.amd.com/TechDocs/55766_SEV-KM%20API_Specification.pdf Changes since v6: * add API to get SEV PDH and Certificate chain data * drop virsh command changes. We can revisit this later when we have more visibility on setter. Change since v5: * drop the seperate test patch and merge the code with other patches. * rename the xml from sev -> launch-security-sev * make policy field mandatory * address multiple feedback from previous reviews. Changes since v4: * add /dev/sev in shared device list Changes since v3: * rename QEMU_CAPS_SEV -> QEMU_CAPS_SEV_GUEST * update caps_2.12.0.x86_64.replies to include query-sev-capabilities data Changes since v2: * make cbitpos, policy and reduced-phys-bits as unsigned int * update virDomainGetLaunchSecurityInfo to accept virTypedParameterPtr *params instead of virTypedParameterPtr params. Changes since v1: * rename <sev> -> <launch-security> for domain * add more information about policy and other fields in domaincaps.html * split the domain_conf support in two patches * add virDomainGetLaunchInfo() to retrieve the SEV measurement * extend virsh command to show the domain's launch security information * add test cases to validate newly added <launch-security> element * fix issues reported with 'make check' and 'make syntax-check' The complete git tree is available at: https://github.com/codomania/libvirt/tree/v7 Brijesh Singh (9): qemu: provide support to query the SEV capability conf: expose SEV feature in domain capabilities libvirt-host: expose virNodeGetSEVCapability API conf: introduce launch-security element in domain qemu/cgroup: add /dev/sev in shared devices list qemu: add support to launch SEV guest libvirt: add new public API to get launch security info remote: implement the remote protocol for launch security qemu: Add support to launch security info docs/drvqemu.html.in | 1 + docs/formatdomain.html.in | 115 +++++++++++++++ docs/formatdomaincaps.html.in | 30 ++++ docs/schemas/domaincaps.rng | 14 ++ docs/schemas/domaincommon.rng | 37 +++++ include/libvirt/libvirt-domain.h | 17 +++ include/libvirt/libvirt-host.h | 42 ++++++ src/conf/domain_capabilities.c | 31 +++- src/conf/domain_capabilities.h | 17 +++ src/conf/domain_conf.c | 133 +++++++++++++++++ src/conf/domain_conf.h | 27 ++++ src/driver-hypervisor.h | 14 ++ src/libvirt-domain.c | 48 +++++++ src/libvirt-host.c | 48 +++++++ src/libvirt_private.syms | 2 +- src/libvirt_public.syms | 6 + src/qemu/qemu.conf | 2 +- src/qemu/qemu_capabilities.c | 90 +++++++++++- src/qemu/qemu_capabilities.h | 4 + src/qemu/qemu_capspriv.h | 4 + src/qemu/qemu_cgroup.c | 2 +- src/qemu/qemu_command.c | 41 ++++++ src/qemu/qemu_driver.c | 160 +++++++++++++++++++++ src/qemu/qemu_monitor.c | 18 +++ src/qemu/qemu_monitor.h | 6 + src/qemu/qemu_monitor_json.c | 121 ++++++++++++++++ src/qemu/qemu_monitor_json.h | 5 + src/qemu/qemu_process.c | 62 ++++++++ src/qemu/test_libvirtd_qemu.aug.in | 1 + src/remote/remote_daemon_dispatch.c | 91 ++++++++++++ src/remote/remote_driver.c | 81 +++++++++++ src/remote/remote_protocol.x | 39 ++++- src/remote_protocol-structs | 24 ++++ tests/genericxml2xmlindata/launch-security-sev.xml | 24 ++++ tests/genericxml2xmltest.c | 2 + .../caps_2.12.0.x86_64.replies | 10 ++ tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml | 3 +- tests/qemuxml2argvdata/launch-security-sev.args | 29 ++++ tests/qemuxml2argvdata/launch-security-sev.xml | 37 +++++ tests/qemuxml2argvtest.c | 4 + 40 files changed, 1435 insertions(+), 7 deletions(-) create mode 100644 tests/genericxml2xmlindata/launch-security-sev.xml create mode 100644 tests/qemuxml2argvdata/launch-security-sev.args create mode 100644 tests/qemuxml2argvdata/launch-security-sev.xml -- 2.7.4

2 13