- Devel - libvirt List Archives

[PATCH] news: document new virt-host-validate impl
by Daniel P. Berrangé 12 Jun '24

12 Jun '24

Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- NEWS.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index f3ca29443a..bc8acc62d4 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -19,6 +19,13 @@ v10.5.0 (unreleased) * **Improvements** + * tools: virt-pki-validate has been rewritten in C + + The ``virt-pki-validate`` shell script has been rewritten as a C program, + providing an output format that matches ``virt-host-validate``, removing + the dependency on ``certtool`` and providing more comprehensive checks + of the certificate properties. + * **Bug fixes** -- 2.45.1

2 1

[PATCH 0/3] qemu: Fix missing validation of 'scsi' property support for 'virtio-blk' and update capabilites dump for qemu-9.1
by Peter Krempa 11 Jun '24

11 Jun '24

Peter Krempa (3): qemuValidateDomainDeviceDefDiskFrontend: Refactor validation of <disk type='lun'> qemu_validate: Validate support for SCSI emulation support in 'virtio-blk' devices qemucapabilitiestest: Update test data for qemu 9.1 dev cycle src/qemu/qemu_validate.c | 38 +- .../caps_9.1.0_x86_64.replies | 3210 +++++++++-------- .../caps_9.1.0_x86_64.xml | 16 +- ...test.args => virtio-lun.x86_64-9.0.0.args} | 2 +- ...latest.xml => virtio-lun.x86_64-9.0.0.xml} | 2 +- .../virtio-lun.x86_64-latest.err | 1 + tests/qemuxmlconftest.c | 3 +- 7 files changed, 1716 insertions(+), 1556 deletions(-) rename tests/qemuxmlconfdata/{virtio-lun.x86_64-latest.args => virtio-lun.x86_64-9.0.0.args} (96%) rename tests/qemuxmlconfdata/{virtio-lun.x86_64-latest.xml => virtio-lun.x86_64-9.0.0.xml} (97%) create mode 100644 tests/qemuxmlconfdata/virtio-lun.x86_64-latest.err -- 2.45.2

2 5

[PATCH] meson: fix missing use of unitdir for systemd directory
by Daniel P. Berrangé 11 Jun '24

11 Jun '24

This conversion was missed in the previous commit: commit a7eb7de53171b4cdabc3d36524c468abfe2590fa Author: Daniel P. Berrangé <berrange(a)redhat.com> Date: Thu Jun 6 12:57:08 2024 +0100 meson: allow systemd unitdir to be changed Reported-by: Yaakov Selkowitz <yselkowi(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- tools/meson.build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/meson.build b/tools/meson.build index 1bb84be0be..07f8c1bf28 100644 --- a/tools/meson.build +++ b/tools/meson.build @@ -322,7 +322,7 @@ if conf.has('WITH_LIBVIRTD') output: '@BASENAME@', configuration: tools_conf, install: true, - install_dir: prefix / 'lib' / 'systemd' / 'system', + install_dir: unitdir, ) endif endif -- 2.43.0

2 1

[PATCH 0/9] tools: rewrite virt-pki-validate in C
by Daniel P. Berrangé 11 Jun '24

11 Jun '24

This was driven by the complaint that libvirt pulls in gnutls-utils https://src.fedoraproject.org/rpms/virt-viewer/pull-request/4 but also it lets us remove more usage of Shell code from libvirt, as well as improving the consistency of certificate checks vs the runtime checks we do. Daniel P. Berrangé (9): rpc: split out helpers for TLS cert path location rpc: refactor method for checking session certificates rpc: split TLS cert validation into separate file docs: fix author credit for virt-pki-validate tool tools: split off common helpers for host validate tool tools: drop unused --version argument tools: stop checking init scripts & iptables config tools: reimplement virt-pki-validate in C tools: support validating user/custom PKI certs docs/manpages/virt-pki-validate.rst | 9 +- libvirt.spec.in | 2 - po/POTFILES | 3 + src/rpc/meson.build | 7 +- src/rpc/virnettlscert.c | 553 ++++++++++++++++++++++++++ src/rpc/virnettlscert.h | 42 ++ src/rpc/virnettlsconfig.c | 202 ++++++++++ src/rpc/virnettlsconfig.h | 68 ++++ src/rpc/virnettlscontext.c | 586 +--------------------------- tools/meson.build | 31 +- tools/virt-host-validate-ch.c | 12 +- tools/virt-host-validate-common.c | 308 ++++++--------- tools/virt-host-validate-common.h | 48 +-- tools/virt-host-validate-lxc.c | 18 +- tools/virt-host-validate-qemu.c | 30 +- tools/virt-host-validate.c | 2 +- tools/virt-login-shell-helper.c | 2 +- tools/virt-pki-query-dn.c | 2 +- tools/virt-pki-validate.c | 424 ++++++++++++++++++++ tools/virt-pki-validate.in | 323 --------------- tools/virt-validate-common.c | 110 ++++++ tools/virt-validate-common.h | 57 +++ 22 files changed, 1670 insertions(+), 1169 deletions(-) create mode 100644 src/rpc/virnettlscert.c create mode 100644 src/rpc/virnettlscert.h create mode 100644 src/rpc/virnettlsconfig.c create mode 100644 src/rpc/virnettlsconfig.h create mode 100644 tools/virt-pki-validate.c delete mode 100644 tools/virt-pki-validate.in create mode 100644 tools/virt-validate-common.c create mode 100644 tools/virt-validate-common.h -- 2.43.0

2 14

[PATCH] virt-aa-helper: use 'include if exists' on .files
by Georgia Garcia 11 Jun '24

11 Jun '24

Change the 'include' in the AppArmor policy to use 'include if exists' when including <uuid>.files. Note that 'if exists' is only available after AppArmor 3.0, therefore a #ifdef check must be added. When the <uuid>.files is not present, there are some failures in the AppArmor tools like the following, since they expect the file to exist when using 'include': ERROR: Include file /etc/apparmor.d/libvirt/libvirt-8534a409-a460-4fab-a2dd-0e1dce4ff273.files not found Signed-off-by: Georgia Garcia <georgia.garcia(a)canonical.com> --- src/security/virt-aa-helper.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 0374581f07..402cbd9602 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1564,7 +1564,12 @@ main(int argc, char **argv) /* create the profile from TEMPLATE */ if (ctl->cmd == 'c' || purged) { char *tmp = NULL; - tmp = g_strdup_printf(" #include <libvirt/%s.files>\n", ctl->uuid); +#if defined(WITH_APPARMOR_3) + const char *ifexists = "if exists "; +#else + const char *ifexists = ""; +#endif + tmp = g_strdup_printf(" #include %s<libvirt/%s.files>\n", ifexists, ctl->uuid); if (ctl->dryrun) { vah_info(profile); -- 2.34.1

2 3

[libvirt PATCH 00/28] native support for nftables in virtual network driver
by Laine Stump 11 Jun '24

11 Jun '24

(After replying to your message, I noticed that you had sent it as a reply to a much earlier version of the nftables patches sent a year ago to the old mailing list, rather than the most recent version that was pushed, which was very different, and sent to deel(a)lists.libvirt.org, so I'm re-sending my response, but to the new mailing list :-)) On 6/10/24 2:54 PM, Roman Bogorodskiy wrote: > Laine Stump wrote: > >> This patch series enables libvirt to use nftables rules rather than >> iptables *when setting up virtual networks* (it does *not* add >> nftables support to the nwfilter driver). It accomplishes this by >> abstracting several iptables functions (from viriptables.[ch] called >> by the virtual network driver into a rudimentary "virNetfilter API" >> (in virnetfilter.[ch], having the virtual network driver call the >> virNetFilter API rather than calling the existing iptables functions >> directly, and then finally adding an equivalent virNftables backend >> that can be used instead of iptables (selected manually via a >> network.conf setting, or automatically if iptables isn't found on the >> host). > > Hi, > > Apparently, I'm late to the discussion. > > I noticed that now I cannot use the bridge driver on FreeBSD as it's > failing to initialize both iptables and nftables backends (which is > expect). Yeah, previously we wouldn't check if iptables was available until someone tried to start a network that would need to use it, and would then log an error (and just fail starting that network, but the network driver would remain running). But now we figure out which firewall backend to use immediately when the driver is loaded, and if we fail to fin a workable backend we fail the entire driver init.r How did you use the network driver before? With a <forward mode='open'/> network? Truthfully I hadn't ever considered the case of someone using it with only network types that didn't need firewall rules. I wonder if there are other platforms we support that have a usable network driver for <forward mode='open'/> (MacOS?) > > What would be a good way to address that? I see at least two options: > > 1. Add a Noop firewall driver > 2. Implement a "real" FreeBSD driver based either on pf or ipfw (that's > been on my TODO list forever, but I somehow got stuck on the very first > step on choosing between pf and ipfw). Why not both? :-) > This obviously will take much > more time. > > Maybe there are other options I'm missing. Obviously (2) would be nicest, but I guess in the short term some variation of (1) would be quicker. Another possibility could be to restore the old behavior of saving the error and only reporting it when a network requiring a firewall is loaded, but I think I remember a discussion about this during review of an earlier revision of the patches, and we agreed that it made the problem easier to find if it was reported immediately and the driver load failed. I suppose in the long run the build-time option firewall_backend_priority should be used to control which backends are included in the build (rather than just which ones are checked at runtime), so that FreeBSD could completely skip all the iptables and nftables code (and firewalld when that's done), and Linux platforms could skip pf and ipfw. > > What do you think? I'm about to be offline for 3 weeks, but in the meantime if you'd like to try making a NULL backend that is only an option if it's listed in firewall_backend_priority (you'll need to remove the compile-time check that all possible backends are accounted for - I think that is the first of the two G_STATIC_ASSERTS at the top of virNetworkLoadDriverConfig()), always initializes successfully in bridge_driver_conf.c if it is listed in the options, and then in networkAddFirewallRules add a check to log an error and fail if backend == NULL (something about attempting to start a network type that would require firewall rules, but the system not having any of the supported types of firewallbackend or something - it's too late now and my brain is too fried and sleepy to think of good wording :-)). As long as it isn't a valid selection on Linux builds that are done with firewall_backend_priority=nftables,iptables, but *is* a valid selection if the setting is "firewall_backend_priority=null" that shouldn't be *too* controversial. Later we can talk about pf and ipfw backends :-)

1 0

[PATCH v2] meson: allow systemd sysusersdir to be changed
by Daniel P. Berrangé 10 Jun '24

10 Jun '24

We currently hardcode the systemd sysusersdir, but it is desirable to be able to choose a different location in some cases. For example, Fedora flatpak builds change the RPM %_sysusersdir macro, but we can't currently honour that. Reported-by: Yaakov Selkowitz <yselkowi(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 1 + meson.build | 5 +++++ meson_options.txt | 1 + src/qemu/meson.build | 2 +- 4 files changed, 8 insertions(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 244e5e824c..347a609add 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1328,6 +1328,7 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec) -Drunstatedir=%{_rundir} \ -Dinitconfdir=%{_sysconfdir}/sysconfig \ -Dunitdir=%{_unitdir} \ + -Dsysusersdir=%{_sysusersdir} \ %{?arg_qemu} \ %{?arg_openvz} \ %{?arg_lxc} \ diff --git a/meson.build b/meson.build index 295613fd93..5c7cd7ec2e 100644 --- a/meson.build +++ b/meson.build @@ -100,6 +100,11 @@ if unitdir == '' unitdir = prefix / 'lib' / 'systemd' / 'system' endif +sysusersdir = get_option('sysusersdir') +if sysusersdir == '' + sysusersdir = prefix / 'lib' / 'sysusers.d' +endif + bindir = prefix / get_option('bindir') datadir = prefix / get_option('datadir') includedir = prefix / get_option('includedir') diff --git a/meson_options.txt b/meson_options.txt index a4f1dd769f..50d71427cb 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -5,6 +5,7 @@ option('system', type: 'boolean', value: false, description: 'Set install paths option('runstatedir', type: 'string', value: '', description: 'State directory for temporary sockets, pid files, etc') option('initconfdir', type: 'string', value: '', description: 'directory for init script configuration files') option('unitdir', type: 'string', value: '', description: 'directory for systemd unit files') +option('sysusersdir', type: 'string', value: '', description: 'directory for sysusers files') # dep:tests option('expensive_tests', type: 'feature', value: 'auto', description: 'set the default for enabling expensive tests (long timeouts)') option('test_coverage', type: 'boolean', value: false, description: 'turn on code coverage instrumentation') diff --git a/src/qemu/meson.build b/src/qemu/meson.build index 907893d431..57356451e4 100644 --- a/src/qemu/meson.build +++ b/src/qemu/meson.build @@ -163,7 +163,7 @@ if conf.has('WITH_QEMU') # Install the sysuser config for the qemu driver install_data( 'libvirt-qemu.sysusers.conf', - install_dir: prefix / 'lib' / 'sysusers.d', + install_dir: sysusersdir, rename: [ 'libvirt-qemu.conf' ], ) -- 2.43.0

2 1

[PATCH 0/5] Introduce pstore device
by Michal Privoznik 10 Jun '24

10 Jun '24

*** BLURB HERE *** Michal Prívozník (5): qemu_capabilities: Introduce QEMU_CAPS_DEVICE_ACPI_ERST conf: Introduce pstore device qemu: Build cmd line for pstore device security: Set seclabels for pstore device NEWS: Document pstore device addition NEWS.rst | 7 + docs/formatdomain.rst | 32 ++++ src/ch/ch_domain.c | 1 + src/conf/domain_conf.c | 153 ++++++++++++++++++ src/conf/domain_conf.h | 19 +++ src/conf/domain_postparse.c | 1 + src/conf/domain_validate.c | 30 ++++ src/conf/schemas/domaincommon.rng | 25 +++ src/conf/virconftypes.h | 2 + src/hyperv/hyperv_driver.c | 1 + src/libvirt_private.syms | 2 + src/libxl/libxl_driver.c | 6 + src/lxc/lxc_driver.c | 6 + src/qemu/qemu_alias.c | 10 ++ src/qemu/qemu_capabilities.c | 4 + src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_command.c | 52 ++++++ src/qemu/qemu_domain.c | 3 + src/qemu/qemu_domain_address.c | 11 ++ src/qemu/qemu_driver.c | 3 + src/qemu/qemu_hotplug.c | 5 + src/qemu/qemu_validate.c | 26 +++ src/security/security_dac.c | 10 ++ src/security/security_selinux.c | 9 ++ src/security/virt-aa-helper.c | 4 + .../caps_7.0.0_aarch64+hvf.xml | 1 + .../caps_7.0.0_aarch64.xml | 1 + .../qemucapabilitiesdata/caps_7.0.0_ppc64.xml | 1 + .../caps_7.0.0_x86_64.xml | 1 + .../qemucapabilitiesdata/caps_7.1.0_ppc64.xml | 1 + .../caps_7.1.0_x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_7.2.0_ppc.xml | 1 + .../caps_7.2.0_x86_64+hvf.xml | 1 + .../caps_7.2.0_x86_64.xml | 1 + .../caps_8.0.0_x86_64.xml | 1 + .../caps_8.1.0_x86_64.xml | 1 + .../caps_8.2.0_aarch64.xml | 1 + .../caps_8.2.0_armv7l.xml | 1 + .../caps_8.2.0_loongarch64.xml | 1 + .../caps_8.2.0_x86_64.xml | 1 + .../caps_9.0.0_x86_64.xml | 1 + .../caps_9.1.0_x86_64.xml | 1 + .../pstore-acpi-erst.x86_64-latest.args | 38 +++++ .../pstore-acpi-erst.x86_64-latest.xml | 1 + tests/qemuxmlconfdata/pstore-acpi-erst.xml | 53 ++++++ tests/qemuxmlconftest.c | 1 + 46 files changed, 535 insertions(+) create mode 100644 tests/qemuxmlconfdata/pstore-acpi-erst.x86_64-latest.args create mode 120000 tests/qemuxmlconfdata/pstore-acpi-erst.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/pstore-acpi-erst.xml -- 2.44.2

1 5

[PATCH] network: allow for forward dev to be a transient interface
by Laine Stump 07 Jun '24

07 Jun '24

A user reported that if they set <forward mode='nat|route' dev='blah'> starting the network would fail if the device 'blah' didn't already exist. This is caused by using "iif" and "oif" in nftables rules to check for the forwarding device - these two commands work by saving the named interface's ifindex (an unsigned integer) when the rule is added, and comparing it to the ifindex associated with the packet's path at runtime. This works great if the interface both 1) exists when the rule is added, and 2) is never deleted and re-created after the rule is added (since it would end up with a different ifindex). When checking for the network's bridge device, it is okay for us to use "iif" and "oif", because the bridge device is created before the firewall rules are added, and will continue to exist until just after the firewall rules are deleted when the network is shutdown. But since the forward device might be deleted/re-added during the lifetime of the network's firewall rules, we must instead us "oifname" and "iifname" - these are much less efficient than "Xif" because they do a string compare of the interface's name rather than just comparing two integers (ifindex), but they don't require the interface to exist when the rule is added, and they can properly cope with the named interface being deleted and re-added later. Fixes: a4f38f6ffe6a9edc001d18890ccfc3f38e72fb94 Signed-off-by: Laine Stump <laine(a)redhat.com> --- src/network/network_nftables.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/network/network_nftables.c b/src/network/network_nftables.c index 59ab231a06..268d1f12ca 100644 --- a/src/network/network_nftables.c +++ b/src/network/network_nftables.c @@ -362,7 +362,7 @@ nftablesAddForwardAllowOut(virFirewall *fw, "iif", iface, NULL); if (physdev && physdev[0]) - virFirewallCmdAddArgList(fw, fwCmd, "oif", physdev, NULL); + virFirewallCmdAddArgList(fw, fwCmd, "oifname", physdev, NULL); virFirewallCmdAddArgList(fw, fwCmd, "counter", "accept", NULL); @@ -398,7 +398,7 @@ nftablesAddForwardAllowRelatedIn(virFirewall *fw, VIR_NFTABLES_FWD_IN_CHAIN, NULL); if (physdev && physdev[0]) - virFirewallCmdAddArgList(fw, fwCmd, "iif", physdev, NULL); + virFirewallCmdAddArgList(fw, fwCmd, "iifname", physdev, NULL); virFirewallCmdAddArgList(fw, fwCmd, "oif", iface, layerStr, "daddr", networkstr, @@ -437,7 +437,7 @@ nftablesAddForwardAllowIn(virFirewall *fw, layerStr, "daddr", networkstr, NULL); if (physdev && physdev[0]) - virFirewallCmdAddArgList(fw, fwCmd, "iif", physdev, NULL); + virFirewallCmdAddArgList(fw, fwCmd, "iifname", physdev, NULL); virFirewallCmdAddArgList(fw, fwCmd, "oif", iface, "counter", "accept", NULL); @@ -566,7 +566,7 @@ nftablesAddForwardMasquerade(virFirewall *fw, layerStr, "daddr", "!=", networkstr, NULL); if (physdev && physdev[0]) - virFirewallCmdAddArgList(fw, fwCmd, "oif", physdev, NULL); + virFirewallCmdAddArgList(fw, fwCmd, "oifname", physdev, NULL); if (protocol && protocol[0]) { if (port->start == 0 && port->end == 0) { @@ -634,7 +634,7 @@ nftablesAddDontMasquerade(virFirewall *fw, VIR_NFTABLES_NAT_POSTROUTE_CHAIN, NULL); if (physdev && physdev[0]) - virFirewallCmdAddArgList(fw, fwCmd, "oif", physdev, NULL); + virFirewallCmdAddArgList(fw, fwCmd, "oifname", physdev, NULL); virFirewallCmdAddArgList(fw, fwCmd, layerStr, "saddr", networkstr, -- 2.45.1

2 2

[PATCH] meson: allow systemd sysusersdir to be changed
by Daniel P. Berrangé 07 Jun '24

07 Jun '24

We currently hardcode the systemd sysusersdir, but it is desirable to be able to choose a different location in some cases. For example, Fedora flatpak builds change the RPM %_sysusersdir macro, but we can't currently honour that. Reported-by: Yaakov Selkowitz <yselkowi(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 1 + meson.build | 5 +++++ meson_options.txt | 1 + src/qemu/meson.build | 2 +- 4 files changed, 8 insertions(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 244e5e824c..347a609add 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1328,6 +1328,7 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec) -Drunstatedir=%{_rundir} \ -Dinitconfdir=%{_sysconfdir}/sysconfig \ -Dunitdir=%{_unitdir} \ + -Dsysusersdir=%{_sysusersdir} \ %{?arg_qemu} \ %{?arg_openvz} \ %{?arg_lxc} \ diff --git a/meson.build b/meson.build index 295613fd93..2fc9ab3e96 100644 --- a/meson.build +++ b/meson.build @@ -100,6 +100,11 @@ if unitdir == '' unitdir = prefix / 'lib' / 'systemd' / 'system' endif +sysusersdir = getoption('sysusersdir') +if sysusersdir == '' + sysusersdir = prefix / 'lib' / 'sysusers.d' +endif + bindir = prefix / get_option('bindir') datadir = prefix / get_option('datadir') includedir = prefix / get_option('includedir') diff --git a/meson_options.txt b/meson_options.txt index a4f1dd769f..50d71427cb 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -5,6 +5,7 @@ option('system', type: 'boolean', value: false, description: 'Set install paths option('runstatedir', type: 'string', value: '', description: 'State directory for temporary sockets, pid files, etc') option('initconfdir', type: 'string', value: '', description: 'directory for init script configuration files') option('unitdir', type: 'string', value: '', description: 'directory for systemd unit files') +option('sysusersdir', type: 'string', value: '', description: 'directory for sysusers files') # dep:tests option('expensive_tests', type: 'feature', value: 'auto', description: 'set the default for enabling expensive tests (long timeouts)') option('test_coverage', type: 'boolean', value: false, description: 'turn on code coverage instrumentation') diff --git a/src/qemu/meson.build b/src/qemu/meson.build index 907893d431..57356451e4 100644 --- a/src/qemu/meson.build +++ b/src/qemu/meson.build @@ -163,7 +163,7 @@ if conf.has('WITH_QEMU') # Install the sysuser config for the qemu driver install_data( 'libvirt-qemu.sysusers.conf', - install_dir: prefix / 'lib' / 'sysusers.d', + install_dir: sysusersdir, rename: [ 'libvirt-qemu.conf' ], ) -- 2.43.0

2 1

[PATCH-for-9.1 v2 0/3] rdma: Remove RDMA subsystem and pvrdma device
by Philippe Mathieu-Daudé 07 Jun '24

07 Jun '24

Since v1: - split in 3 (Thomas) - justify gluster removal Philippe Mathieu-Daudé (3): hw/rdma: Remove pvrdma device and rdmacm-mux helper migration: Remove RDMA protocol handling block/gluster: Remove RDMA protocol handling MAINTAINERS | 17 - docs/about/deprecated.rst | 9 - docs/about/removed-features.rst | 4 + docs/devel/migration/main.rst | 6 - docs/pvrdma.txt | 345 -- docs/rdma.txt | 420 -- docs/system/device-url-syntax.rst.inc | 4 +- docs/system/loongarch/virt.rst | 2 +- docs/system/qemu-block-drivers.rst.inc | 1 - meson.build | 59 - qapi/machine.json | 17 - qapi/migration.json | 31 +- qapi/qapi-schema.json | 1 - qapi/rdma.json | 38 - contrib/rdmacm-mux/rdmacm-mux.h | 61 - hw/rdma/rdma_backend.h | 129 - hw/rdma/rdma_backend_defs.h | 76 - hw/rdma/rdma_rm.h | 97 - hw/rdma/rdma_rm_defs.h | 146 - hw/rdma/rdma_utils.h | 63 - hw/rdma/trace.h | 1 - hw/rdma/vmw/pvrdma.h | 144 - hw/rdma/vmw/pvrdma_dev_ring.h | 46 - hw/rdma/vmw/pvrdma_qp_ops.h | 28 - hw/rdma/vmw/trace.h | 1 - include/hw/rdma/rdma.h | 37 - include/monitor/hmp.h | 1 - .../infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h | 685 --- .../infiniband/hw/vmw_pvrdma/pvrdma_verbs.h | 348 -- .../standard-headers/rdma/vmw_pvrdma-abi.h | 310 -- migration/migration-stats.h | 6 +- migration/migration.h | 9 - migration/options.h | 2 - migration/rdma.h | 69 - block/gluster.c | 39 - contrib/rdmacm-mux/main.c | 831 ---- hw/core/machine-qmp-cmds.c | 32 - hw/rdma/rdma.c | 30 - hw/rdma/rdma_backend.c | 1401 ------ hw/rdma/rdma_rm.c | 812 ---- hw/rdma/rdma_utils.c | 126 - hw/rdma/vmw/pvrdma_cmd.c | 815 ---- hw/rdma/vmw/pvrdma_dev_ring.c | 141 - hw/rdma/vmw/pvrdma_main.c | 735 --- hw/rdma/vmw/pvrdma_qp_ops.c | 298 -- migration/migration-stats.c | 5 +- migration/migration.c | 31 - migration/options.c | 16 - migration/qemu-file.c | 1 - migration/ram.c | 86 +- migration/rdma.c | 4184 ----------------- migration/savevm.c | 2 +- monitor/qmp-cmds.c | 1 - Kconfig.host | 3 - contrib/rdmacm-mux/meson.build | 7 - hmp-commands-info.hx | 13 - hw/Kconfig | 1 - hw/meson.build | 1 - hw/rdma/Kconfig | 3 - hw/rdma/meson.build | 12 - hw/rdma/trace-events | 31 - hw/rdma/vmw/trace-events | 17 - meson_options.txt | 4 - migration/meson.build | 1 - migration/trace-events | 68 +- qapi/meson.build | 1 - qemu-options.hx | 6 - .../org.centos/stream/8/build-environment.yml | 1 - .../ci/org.centos/stream/8/x86_64/configure | 3 - scripts/ci/setup/build-environment.yml | 4 - scripts/coverity-scan/run-coverity-scan | 2 +- scripts/meson-buildoptions.sh | 6 - scripts/update-linux-headers.sh | 27 - tests/lcitool/projects/qemu.yml | 3 - tests/migration/guestperf/engine.py | 4 +- 75 files changed, 20 insertions(+), 12997 deletions(-) delete mode 100644 docs/pvrdma.txt delete mode 100644 docs/rdma.txt delete mode 100644 qapi/rdma.json delete mode 100644 contrib/rdmacm-mux/rdmacm-mux.h delete mode 100644 hw/rdma/rdma_backend.h delete mode 100644 hw/rdma/rdma_backend_defs.h delete mode 100644 hw/rdma/rdma_rm.h delete mode 100644 hw/rdma/rdma_rm_defs.h delete mode 100644 hw/rdma/rdma_utils.h delete mode 100644 hw/rdma/trace.h delete mode 100644 hw/rdma/vmw/pvrdma.h delete mode 100644 hw/rdma/vmw/pvrdma_dev_ring.h delete mode 100644 hw/rdma/vmw/pvrdma_qp_ops.h delete mode 100644 hw/rdma/vmw/trace.h delete mode 100644 include/hw/rdma/rdma.h delete mode 100644 include/standard-headers/drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h delete mode 100644 include/standard-headers/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.h delete mode 100644 include/standard-headers/rdma/vmw_pvrdma-abi.h delete mode 100644 migration/rdma.h delete mode 100644 contrib/rdmacm-mux/main.c delete mode 100644 hw/rdma/rdma.c delete mode 100644 hw/rdma/rdma_backend.c delete mode 100644 hw/rdma/rdma_rm.c delete mode 100644 hw/rdma/rdma_utils.c delete mode 100644 hw/rdma/vmw/pvrdma_cmd.c delete mode 100644 hw/rdma/vmw/pvrdma_dev_ring.c delete mode 100644 hw/rdma/vmw/pvrdma_main.c delete mode 100644 hw/rdma/vmw/pvrdma_qp_ops.c delete mode 100644 migration/rdma.c delete mode 100644 contrib/rdmacm-mux/meson.build delete mode 100644 hw/rdma/Kconfig delete mode 100644 hw/rdma/meson.build delete mode 100644 hw/rdma/trace-events delete mode 100644 hw/rdma/vmw/trace-events -- 2.41.0

17 80

[PATCH] meson: allow systemd unitdir to be changed
by Daniel P. Berrangé 06 Jun '24

06 Jun '24

We currently hardcode the systemd unitdir, but it is desirable to be able to choose a different location in some cases. For examples, Fedora flatpak builds change the RPM %_unitdir macro, but we can't currently honour that. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 1 + meson.build | 5 +++++ meson_options.txt | 1 + src/meson.build | 8 +++----- 4 files changed, 10 insertions(+), 5 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 1d3240ee6f..0a121515b9 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1329,6 +1329,7 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec) %meson \ -Drunstatedir=%{_rundir} \ -Dinitconfdir=%{_sysconfdir}/sysconfig \ + -Dunitdir=%{_unitdir} \ %{?arg_qemu} \ %{?arg_openvz} \ %{?arg_lxc} \ diff --git a/meson.build b/meson.build index 62e49be37d..295613fd93 100644 --- a/meson.build +++ b/meson.build @@ -95,6 +95,11 @@ if initconfdir == '' endif endif +unitdir = get_option('unitdir') +if unitdir == '' + unitdir = prefix / 'lib' / 'systemd' / 'system' +endif + bindir = prefix / get_option('bindir') datadir = prefix / get_option('datadir') includedir = prefix / get_option('includedir') diff --git a/meson_options.txt b/meson_options.txt index cdc8687795..a4f1dd769f 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -4,6 +4,7 @@ option('packager_version', type: 'string', value: '', description: 'Extra packag option('system', type: 'boolean', value: false, description: 'Set install paths to system ones') option('runstatedir', type: 'string', value: '', description: 'State directory for temporary sockets, pid files, etc') option('initconfdir', type: 'string', value: '', description: 'directory for init script configuration files') +option('unitdir', type: 'string', value: '', description: 'directory for systemd unit files') # dep:tests option('expensive_tests', type: 'feature', value: 'auto', description: 'set the default for enabling expensive tests (long timeouts)') option('test_coverage', type: 'boolean', value: false, description: 'turn on code coverage instrumentation') diff --git a/src/meson.build b/src/meson.build index dd2682ec19..8cce42c7ad 100644 --- a/src/meson.build +++ b/src/meson.build @@ -812,11 +812,9 @@ endforeach if conf.has('WITH_LIBVIRTD') # Generate systemd service and socket unit files if init_script == 'systemd' - systemd_unit_dir = prefix / 'lib' / 'systemd' / 'system' - install_data( guest_unit_files, - install_dir: systemd_unit_dir, + install_dir: unitdir, ) if conf.has('WITH_POLKIT') @@ -855,7 +853,7 @@ if conf.has('WITH_LIBVIRTD') output: service_out, configuration: unit_conf, install: true, - install_dir: systemd_unit_dir, + install_dir: unitdir, ) foreach socket : unit.get('sockets', [ 'main', 'ro', 'admin' ]) @@ -881,7 +879,7 @@ if conf.has('WITH_LIBVIRTD') output: socket_out, configuration: unit_conf, install: true, - install_dir: systemd_unit_dir, + install_dir: unitdir, ) endforeach endforeach -- 2.43.0

2 1

[PATCH] rpm: drop cyrus-sasl dep
by Daniel P. Berrangé 06 Jun '24

06 Jun '24

We link to libsasl2.so, so get a dep on cyrus-sasl-libs automatically. The dep on cyrus-sasl-gssapi gets us the mechanism that matches our default config. The 'cyrus-sasl' package merely contains some man pages and the saslauthd daemon, which is not required by libvirt. This dep appears to have been redundant since we first added in commit 1b1d647439059b7e10fb94e1ade227fb695d7110 Author: Daniel P. Berrangé <berrange(a)redhat.com> Date: Wed Dec 5 15:24:15 2007 +0000 Initial integration of SASL authentication, working for Kerberos only Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 2 -- 1 file changed, 2 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 1d3240ee6f..343015ad1d 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1055,8 +1055,6 @@ with some QEMU specific features of libvirt. %package libs Summary: Client side libraries -# So remote clients can access libvirt over SSH tunnel -Requires: cyrus-sasl # Needed by default sasl.conf - no onerous extra deps, since # 100's of other things on a system already pull in krb5-libs Requires: cyrus-sasl-gssapi -- 2.43.0

2 1

Re: [PATCH] qemu_block: Validate number of hosts for iSCSI disk device
by Peter Krempa 06 Jun '24

06 Jun '24

On Thu, Jun 06, 2024 at 16:17:41 +0530, Rayhan Faizel wrote: > Hi, Hi, please *always* keep replies on-list (use reply-all). I've re-added the mailing list again. > > On Thu, Jun 6, 2024 at 4:12 PM Peter Krempa <pkrempa(a)redhat.com> wrote: > > > > On Thu, Jun 06, 2024 at 15:45:16 +0530, Rayhan Faizel wrote: > > > An iSCSI device with zero hosts will result in a segmentation fault. This patch > > > adds a check for the number of hosts, which must be one in the case of iSCSI. > > > > > > Minimal reproducing XML: > > > > > > <domain type='qemu'> > > > <name>MyGuest</name> > > > <uuid>4dea22b3-1d52-d8f3-2516-782e98ab3fa0</uuid> > > > <os> > > > <type arch='x86_64'>hvm</type> > > > </os> > > > <memory>4096</memory> > > > <devices> > > > <disk type='network'> > > > <source name='dummy' protocol='iscsi'/> > > > <target dev='vda'/> > > > </disk> > > > </devices> > > > </domain> > > > > Please transform this bit into a test case in qemuxmlconftest to see > > that it's properly rejected. > > > > I did try to add a testcase but the schema tests fail on this > particular XML because it expects one or more <hosts>. Is there a way > to exclude schema validation for certain testcases or should I just > modify the schema and change it from oneOrMore to zeroOrMore? Schema test result can be inverted by naming the file with '-invalid.xml' suffix. In such case the test will require that the XML has invalid schema. Additionally it's also possible by adding an exception in virschematest, but we have more than a few tests with the suffix in qemuxmlconftest.

1 0

[PATCH] qemu_block: Validate number of hosts for iSCSI disk device
by Rayhan Faizel 06 Jun '24

06 Jun '24

An iSCSI device with zero hosts will result in a segmentation fault. This patch adds a check for the number of hosts, which must be one in the case of iSCSI. Minimal reproducing XML: <domain type='qemu'> <name>MyGuest</name> <uuid>4dea22b3-1d52-d8f3-2516-782e98ab3fa0</uuid> <os> <type arch='x86_64'>hvm</type> </os> <memory>4096</memory> <devices> <disk type='network'> <source name='dummy' protocol='iscsi'/> <target dev='vda'/> </disk> </devices> </domain> Signed-off-by: Rayhan Faizel <rayhan.faizel(a)gmail.com> --- This crashing XML was detected by the WIP fuzzer which is being developed as part of Google Summer of Code 2024. src/qemu/qemu_block.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/qemu/qemu_block.c b/src/qemu/qemu_block.c index 738b72d7ea..d6cdf521c4 100644 --- a/src/qemu/qemu_block.c +++ b/src/qemu/qemu_block.c @@ -602,6 +602,12 @@ qemuBlockStorageSourceGetISCSIProps(virStorageSource *src, * } */ + if (src->nhosts != 1) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("iSCSI protocol accepts only one host")); + return NULL; + } + target = g_strdup(src->path); /* Separate the target and lun */ -- 2.34.1

2 1

[PATCH 0/2] lib: Annotate more functions as NULL terminated
by Michal Privoznik 06 Jun '24

06 Jun '24

I'm working on something that's calling qemuMonitorCreateObjectProps() and was getting random errors only to find out I was missing NULL sentinel. This sparked me to look at other functions that might be missing the G_GNUC_NULL_TERMINATED attribute too and found some. Michal Prívozník (2): lib: Annotate more function as NULL terminated qemumonitortestutils: Fix G_GNUC_PRINTF annotation of qemuMonitorTestAddErrorResponse() src/qemu/qemu_monitor.h | 3 ++- src/qemu/qemu_monitor_json.c | 2 +- tests/qemumigrationcookiexmltest.c | 2 +- tests/qemumonitortestutils.c | 2 +- tests/qemumonitortestutils.h | 3 ++- tests/testutils.h | 3 ++- tests/testutilsqemuschema.h | 3 ++- tools/vsh.c | 2 +- 8 files changed, 12 insertions(+), 8 deletions(-) -- 2.44.1

2 3

libvirt / Win10.qcow2
by gilada＠adamworld.biz 05 Jun '24

05 Jun '24

Hello, hope it works in German. Need some help. My problem: Windows 10 won't boot anymore, automatic repair doesn't work either. Is there a way to repair Win10 and how? Best regards Gilbert Adam

1 0

[PATCH] rpm: ensure -Werror is disabled for mingw builds
by Daniel P. Berrangé 05 Jun '24

05 Jun '24

Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 0f3c882f05..1d3240ee6f 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1485,8 +1485,9 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec) -Dtests=disabled \ -Dudev=disabled \ -Dwireshark_dissector=disabled \ - -Dyajl=disabled - %mingw_ninja + -Dyajl=disabled \ + %{?enable_werror} +%mingw_ninja %endif %install -- 2.43.0

2 1

[PATCH] rpm: fix setting of VIR_TEST_DEBUG
by Daniel P. Berrangé 05 Jun '24

05 Jun '24

The %meson_test macro expands to have a newline at the start, so rather than expanding to VIR_TEST_DEBUG=1 meson test .... we get VIR_TEST_DEBUG=1 meson test .... which has no effect, since VIR_TEST_DEBUG isn't exported. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 5ca7b95e6c..0f3c882f05 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1592,7 +1592,8 @@ rm -rf $RPM_BUILD_ROOT%{mingw64_libexecdir}/libvirt-guests.sh %if %{with_native} # Building on slow archs, like emulated s390x in Fedora copr, requires # raising the test timeout -VIR_TEST_DEBUG=1 %meson_test --no-suite syntax-check --timeout-multiplier 10 +export VIR_TEST_DEBUG=1 +%meson_test --no-suite syntax-check --timeout-multiplier 10 %endif %define libvirt_rpmstatedir %{_localstatedir}/lib/rpm-state/libvirt -- 2.45.1

2 1

[PATCH] interface: fix udev reference leak with invalid flags
by Daniel P. Berrangé 05 Jun '24

05 Jun '24

The udevInterfaceGetXMLDesc method takes a reference on the udev driver as its first action. If the virCheckFlags() condition fails, however, this reference is never released. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/interface/interface_backend_udev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c index fdf11a8318..e1a50389c9 100644 --- a/src/interface/interface_backend_udev.c +++ b/src/interface/interface_backend_udev.c @@ -1027,12 +1027,14 @@ static char * udevInterfaceGetXMLDesc(virInterfacePtr ifinfo, unsigned int flags) { - struct udev *udev = udev_ref(driver->udev); + struct udev *udev = NULL; g_autoptr(virInterfaceDef) ifacedef = NULL; char *xmlstr = NULL; virCheckFlags(VIR_INTERFACE_XML_INACTIVE, NULL); + udev = udev_ref(driver->udev); + /* Recursively build up the interface XML based on the requested * interface name */ -- 2.45.1

2 1

[PATCH 0/3] qemu: Use TPM 2.0 on RISC-V
by Andrea Bolognani 03 Jun '24

03 Jun '24

Andrea Bolognani (3): tests: Add TPM coverage to default-models tests tests: Delete some redundant test cases qemu: Only allow TPM 2.0 for RISC-V guests src/qemu/qemu_domain.c | 1 + src/qemu/qemu_validate.c | 10 +-- ...aarch64-tpm-wrong-model.aarch64-latest.err | 2 +- .../aarch64-tpm.aarch64-latest.args | 34 --------- .../aarch64-tpm.aarch64-latest.xml | 29 -------- tests/qemuxmlconfdata/aarch64-tpm.xml | 15 ---- ...ault-models.aarch64-latest.abi-update.args | 3 + ...fault-models.aarch64-latest.abi-update.xml | 3 + ...64-virt-default-models.aarch64-latest.args | 3 + ...h64-virt-default-models.aarch64-latest.xml | 3 + .../aarch64-virt-default-models.xml | 3 + .../loongarch64-virt-default-models.xml | 1 + ...efault-models.ppc64-latest.abi-update.args | 3 + ...default-models.ppc64-latest.abi-update.xml | 4 ++ ...4-pseries-default-models.ppc64-latest.args | 3 + ...64-pseries-default-models.ppc64-latest.xml | 4 ++ .../ppc64-pseries-default-models.xml | 3 + ...ault-models.riscv64-latest.abi-update.args | 3 + ...fault-models.riscv64-latest.abi-update.xml | 3 + ...64-virt-default-models.riscv64-latest.args | 3 + ...v64-virt-default-models.riscv64-latest.xml | 3 + .../riscv64-virt-default-models.xml | 3 + .../s390x-ccw-default-models.xml | 1 + .../tpm-emulator-spapr.ppc64-latest.args | 45 ------------ .../tpm-emulator-spapr.ppc64-latest.xml | 1 - tests/qemuxmlconfdata/tpm-emulator-spapr.xml | 70 ------------------- ...fault-models.x86_64-latest.abi-update.args | 3 + ...efault-models.x86_64-latest.abi-update.xml | 3 + ...86_64-pc-default-models.x86_64-latest.args | 3 + ...x86_64-pc-default-models.x86_64-latest.xml | 3 + .../x86_64-pc-default-models.xml | 3 + ...fault-models.x86_64-latest.abi-update.args | 3 + ...efault-models.x86_64-latest.abi-update.xml | 3 + ...6_64-q35-default-models.x86_64-latest.args | 3 + ...86_64-q35-default-models.x86_64-latest.xml | 3 + .../x86_64-q35-default-models.xml | 3 + tests/qemuxmlconftest.c | 2 - 37 files changed, 87 insertions(+), 201 deletions(-) delete mode 100644 tests/qemuxmlconfdata/aarch64-tpm.aarch64-latest.args delete mode 100644 tests/qemuxmlconfdata/aarch64-tpm.aarch64-latest.xml delete mode 100644 tests/qemuxmlconfdata/aarch64-tpm.xml delete mode 100644 tests/qemuxmlconfdata/tpm-emulator-spapr.ppc64-latest.args delete mode 120000 tests/qemuxmlconfdata/tpm-emulator-spapr.ppc64-latest.xml delete mode 100644 tests/qemuxmlconfdata/tpm-emulator-spapr.xml -- 2.45.1

3 9

[PATCH] qga: Remove deprecated 'blacklist' argument / config key
by Philippe Mathieu-Daudé 03 Jun '24

03 Jun '24

The 'blacklist' argument / config key are deprecated since commi 582a098e6c ("qga: Replace 'blacklist' command line and config file options by 'block-rpcs'"), time to remove them. Signed-off-by: Philippe Mathieu-Daudé <philmd(a)linaro.org> --- docs/about/deprecated.rst | 18 ------------------ docs/about/removed-features.rst | 18 ++++++++++++++++++ qga/main.c | 6 ------ 3 files changed, 18 insertions(+), 24 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 40585ca7d5..a32e0e2564 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -478,24 +478,6 @@ versions, aliases will point to newer CPU model versions depending on the machine type, so management software must resolve CPU model aliases before starting a virtual machine. -QEMU guest agent ----------------- - -``--blacklist`` command line option (since 7.2) -''''''''''''''''''''''''''''''''''''''''''''''' - -``--blacklist`` has been replaced by ``--block-rpcs`` (which is a better -wording for what this option does). The short form ``-b`` still stays -the same and thus is the preferred way for scripts that should run with -both, older and future versions of QEMU. - -``blacklist`` config file option (since 7.2) -'''''''''''''''''''''''''''''''''''''''''''' - -The ``blacklist`` config file option has been renamed to ``block-rpcs`` -(to be in sync with the renaming of the corresponding command line -option). - Migration --------- diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst index fba0cfb0b0..deca066b21 100644 --- a/docs/about/removed-features.rst +++ b/docs/about/removed-features.rst @@ -1129,4 +1129,22 @@ stable for some time and is now widely used. The command line and feature set is very close to the removed C implementation. +QEMU guest agent +---------------- + +``--blacklist`` command line option (removed in 9.1) +'''''''''''''''''''''''''''''''''''''''''''''''''''' + +``--blacklist`` has been replaced by ``--block-rpcs`` (which is a better +wording for what this option does). The short form ``-b`` still stays +the same and thus is the preferred way for scripts that should run with +both, older and future versions of QEMU. + +``blacklist`` config file option (removed in 9.1) +''''''''''''''''''''''''''''''''''''''''''''''''' + +The ``blacklist`` config file option has been renamed to ``block-rpcs`` +(to be in sync with the renaming of the corresponding command line +option). + .. _Intel discontinuance notification: https://www.intel.com/content/www/us/en/content-details/781327/intel-is-dis… diff --git a/qga/main.c b/qga/main.c index bdf5344584..f4d5f15bb3 100644 --- a/qga/main.c +++ b/qga/main.c @@ -1071,11 +1071,6 @@ static void config_load(GAConfig *config) g_key_file_get_boolean(keyfile, "general", "retry-path", &gerr); } - if (g_key_file_has_key(keyfile, "general", "blacklist", NULL)) { - g_warning("config using deprecated 'blacklist' key, should be replaced" - " with the 'block-rpcs' key."); - blockrpcs_key = "blacklist"; - } if (g_key_file_has_key(keyfile, "general", blockrpcs_key, NULL)) { config->bliststr = g_key_file_get_string(keyfile, "general", blockrpcs_key, &gerr); @@ -1190,7 +1185,6 @@ static void config_parse(GAConfig *config, int argc, char **argv) { "path", 1, NULL, 'p' }, { "daemonize", 0, NULL, 'd' }, { "block-rpcs", 1, NULL, 'b' }, - { "blacklist", 1, NULL, 'b' }, /* deprecated alias for 'block-rpcs' */ { "allow-rpcs", 1, NULL, 'a' }, #ifdef _WIN32 { "service", 1, NULL, 's' }, -- 2.41.0

2 3

[PATCH 0/2] qapi: Remove deprecated events
by Philippe Mathieu-Daudé 03 Jun '24

03 Jun '24

Remove MEM_UNPLUG_ERROR and 'vcpu' field in TRACE events, all deprecated since long enough. Philippe Mathieu-Daudé (2): hw/acpi: Remove the deprecated QAPI MEM_UNPLUG_ERROR event trace: Remove deprecated 'vcpu' field from QMP trace events docs/about/deprecated.rst | 16 ---------------- docs/about/removed-features.rst | 15 +++++++++++++++ qapi/machine.json | 28 ---------------------------- qapi/trace.json | 27 +++------------------------ hw/acpi/memory_hotplug.c | 8 -------- hw/ppc/spapr.c | 11 +---------- trace/qmp.c | 2 -- trace/trace-hmp-cmds.c | 4 ++-- 8 files changed, 21 insertions(+), 90 deletions(-) -- 2.41.0

4 6

[PATCH] rpm: Don't default to nftables on existing distros
by Andrea Bolognani 03 Jun '24

03 Jun '24

Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- libvirt.spec.in | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 4381dbe30c..5ca7b95e6c 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -205,6 +205,18 @@ %define with_modular_daemons 1 %endif +# Prefer nftables for future OS releases but keep using iptables +# for existing ones +%if 0%{?rhel} >= 10 || 0%{?fedora} >= 41 + %define prefer_nftables 1 + %define firewall_backend_priority nftables,iptables +%else + %define prefer_nftables 0 + %define firewall_backend_priority iptables,nftables +%endif + + + # Force QEMU to run as non-root %define qemu_user qemu %define qemu_group qemu @@ -592,7 +604,7 @@ Summary: Network driver plugin for the libvirtd daemon Requires: libvirt-daemon-common = %{version}-%{release} Requires: libvirt-libs = %{version}-%{release} Requires: dnsmasq >= 2.41 - %if 0%{?rhel} >= 10 || 0%{?fedora} >= 41 + %if %{prefer_nftables} Requires: nftables %else Requires: iptables @@ -1387,7 +1399,7 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec) %{?enable_werror} \ -Dexpensive_tests=enabled \ -Dinit_script=systemd \ - -Dfirewall_backend_priority=nftables,iptables \ + -Dfirewall_backend_priority=%{firewall_backend_priority} \ -Ddocs=enabled \ -Dtests=enabled \ -Drpath=disabled \ -- 2.45.1

2 1

[PATCH 0/3] meson: Improve default firewall backend configuration
by Andrea Bolognani 03 Jun '24

03 Jun '24

Test pipeline: https://gitlab.com/abologna/libvirt/-/pipelines/1308917840 See 1/3 for details. Andrea Bolognani (3): meson: Improve default firewall backend configuration meson: Include firewall backend selection in summary rpm: Configure firewall backends explicitly libvirt.spec.in | 1 + meson.build | 21 ++++++++++++++------- meson_options.txt | 3 +-- src/network/bridge_driver_conf.c | 6 +++++- src/network/meson.build | 6 ++++-- src/network/network.conf.in | 13 +++++++------ 6 files changed, 32 insertions(+), 18 deletions(-) -- 2.45.1

4 14