- Devel - libvirt List Archives

[libvirt PATCH 0/2] spec: List more directories
by Andrea Bolognani 14 Dec '22

14 Dec '22

%blurb Andrea Bolognani (2): spec: Add trailing backslash spec: List more directories libvirt.spec.in | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.38.1

2 7

[libvirt PATCH 00/30] introduce external snapshot delete support
by Pavel Hrdina 14 Dec '22

14 Dec '22

This implements virDomainSnapshotDelete API to support external snapshots. The support doesn't include flags VIR_DOMAIN_SNAPSHOT_DELETE_CHILDREN and VIR_DOMAIN_SNAPSHOT_DELETE_CHILDREN_ONLY as it would add more complexity and IMHO these flags should not existed at all. Gitlab repo with the patches: https://gitlab.com/phrdina/libvirt/-/commits/snapshot-delete-external Pavel Hrdina (30): libvirt: introduce VIR_DOMAIN_JOB_OPERATION_SNAPSHOT_DELETE qemu_block: extract block commit code to separate function qemu_block: move qemuDomainBlockPivot out of qemu_driver qemu_block: add async domain job support to qemuBlockCommit qemu_block: add async domain job support to qemuBlockPivot qemu_monitor: introduce qemuMonitorJobFinalize qemu_monitor_json: allow configuring autofinalize for block commit qemu_block: allow configuring autofinalize for block commit qemu_block: introduce qemuBlockFinalize qemu_block: change qemuBlockCommit to return job pointer qemu_blockjob: process QEMU_MONITOR_JOB_STATUS_PENDING signal qemu_snapshot: refactor qemuSnapshotDelete qemu_snapshot: introduce qemuSnapshotDeleteSingle qemu_snapshot: introduce qemuSnapshotDeleteChildren qemu_snapshot: rework snapshot children deletion qemu_snapshot: move snapshot discard out of qemu_domain.c qemu_snapshot: move snapshot metadata reparent code qemu_snapshot: introduce qemuSnapshotDiscardMetadata qemu_snapshot: introduce qemuSnapshotDeleteValidate function qemu_snapshot: refactor validation of snapshot delete qemu_snapshot: error out when deleting internal snapshot on non-active disk qemu_snapshot: convert snapshot delete to async domain job qemu_snapshot: prepare data for external snapshot deletion qemu_snapshot: implement deletion of external snapshot qemu_snapshot: update metadata when deleting snapshots qemu_snapshot: when deleting snapshot invalidate parent snapshot qemu_process: abort snapshot delete when daemon starts qemu_snapshot: enable deletion of external snapshots api: document support for external snapshot deletion NEWS: document support for external snapshot deletion NEWS.rst | 6 + include/libvirt/libvirt-domain.h | 1 + src/conf/snapshot_conf.c | 6 + src/conf/snapshot_conf.h | 1 + src/libvirt-domain-snapshot.c | 7 + src/qemu/qemu_backup.c | 1 + src/qemu/qemu_block.c | 336 +++++++++++ src/qemu/qemu_block.h | 22 + src/qemu/qemu_blockjob.c | 20 +- src/qemu/qemu_blockjob.h | 1 + src/qemu/qemu_domain.c | 95 +-- src/qemu/qemu_domain.h | 9 - src/qemu/qemu_driver.c | 292 +--------- src/qemu/qemu_monitor.c | 21 +- src/qemu/qemu_monitor.h | 8 +- src/qemu/qemu_monitor_json.c | 26 +- src/qemu/qemu_monitor_json.h | 8 +- src/qemu/qemu_process.c | 32 ++ src/qemu/qemu_snapshot.c | 956 ++++++++++++++++++++++++++++--- src/qemu/qemu_snapshot.h | 4 + tests/qemumonitorjsontest.c | 4 +- tools/virsh-domain.c | 1 + 22 files changed, 1381 insertions(+), 476 deletions(-) -- 2.38.1

2 61

[PATCH] virnuma: Allow multiple nodes for preferred policy
by Michal Privoznik 14 Dec '22

14 Dec '22

In the past, the preferred policy (VIR_DOMAIN_NUMATUNE_MEM_PREFERRED) required exactly one (host) NUMA node. This made sense because: 1) the libnuma API - numa_set_preferred() allowed exactly one node, because 2) corresponding kernel syscall (__NR_set_mempolicy) accepted exactly one node (for MPOL_PREFERRED mode). But things have changed since then. Firstly, kernel introduced new MPOL_PREFERRED_MANY mode (v5.15-rc1~107^2~21) which was then exposed in libnuma as numa_set_preferred_many() (v2.0.15~24). Fortunately, libnuma also exposes numa_has_preferred_many() which returns whether the kernel has support for the new mode (1) or not (0). Putting this all together, we can lift our check for sufficiently new kernel and libnuma. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2151064 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- meson.build | 3 +++ src/util/virnuma.c | 25 +++++++++++++++++++++++-- 2 files changed, 26 insertions(+), 2 deletions(-) diff --git a/meson.build b/meson.build index f9834a36c2..c26778a68d 100644 --- a/meson.build +++ b/meson.build @@ -1103,6 +1103,9 @@ endif numactl_dep = cc.find_library('numa', required: get_option('numactl')) if numactl_dep.found() conf.set('WITH_NUMACTL', 1) + if cc.has_function('numa_set_preferred_many', dependencies: numactl_dep) + conf.set('WITH_NUMACTL_SET_PREFERRED_MANY', 1) + endif endif openwsman_version = '2.6.3' diff --git a/src/util/virnuma.c b/src/util/virnuma.c index 2306ab0cb1..43e299f4bb 100644 --- a/src/util/virnuma.c +++ b/src/util/virnuma.c @@ -93,7 +93,6 @@ virNumaSetupMemoryPolicy(virDomainNumatuneMemMode mode, virBitmap *nodeset) { nodemask_t mask; - int node = -1; int bit = 0; size_t i; int maxnode = 0; @@ -128,7 +127,19 @@ virNumaSetupMemoryPolicy(virDomainNumatuneMemMode mode, case VIR_DOMAIN_NUMATUNE_MEM_PREFERRED: { +# ifdef WITH_NUMACTL_SET_PREFERRED_MANY + struct bitmask *bitmask = NULL; +# endif + int G_GNUC_UNUSED node = -1; int nnodes = 0; + bool has_preferred_many = false; + +# ifdef WITH_NUMACTL_SET_PREFERRED_MANY + if (numa_has_preferred_many() > 0) { + has_preferred_many = true; + } +# endif + for (i = 0; i < NUMA_NUM_NODES; i++) { if (nodemask_isset(&mask, i)) { node = i; @@ -136,15 +147,25 @@ virNumaSetupMemoryPolicy(virDomainNumatuneMemMode mode, } } - if (nnodes != 1) { + if (!has_preferred_many && nnodes != 1) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("NUMA memory tuning in 'preferred' mode " "only supports single node")); return -1; } + /* The following automatically sets MPOL_PREFERRED_MANY + * whenever possible, so no need to special case it. */ numa_set_bind_policy(0); + +# ifdef WITH_NUMACTL_SET_PREFERRED_MANY + bitmask = numa_bitmask_alloc(maxnode + 1); + copy_nodemask_to_bitmask(&mask, bitmask); + numa_set_preferred_many(bitmask); + numa_bitmask_free(bitmask); +# else numa_set_preferred(node); +# endif } break; -- 2.37.4

2 1

[libvirt PATCH] docs: replace footer link to the bird site with mastodon
by Daniel P. Berrangé 14 Dec '22

14 Dec '22

Since the takeover of the bird site, the bulk of tech people who want a more friendly and inclusive media site have jumped over to Mastodon. With its decentralized nature, there's no one replacement that captures everything, but the fosstodon.org site is a topic relevant choice. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- docs/page.xsl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/page.xsl b/docs/page.xsl index 1414d90b89..548d5a11c4 100644 --- a/docs/page.xsl +++ b/docs/page.xsl @@ -179,7 +179,7 @@ <div id="community"> <h3>Community</h3> <ul> - <li><a href="https://twitter.com/hashtag/libvirt">twitter</a></li> + <li><a href="https://fosstodon.org/tags/libvirt">fosstodon</a></li> <li><a href="https://stackoverflow.com/questions/tagged/libvirt">stackoverflow</a></li> <li><a href="https://serverfault.com/questions/tagged/libvirt">serverfault</a></li> </ul> -- 2.38.1

2 1

[PATCH] tests: qemucapabilitiesdata: Final update of qemu-7.2 capabilities on x86
by Peter Krempa 14 Dec '22

14 Dec '22

QEMU 7.2 was released, update the capabilities data to the final state. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- tests/qemucapabilitiesdata/caps_7.2.0.x86_64.replies | 6 +++--- tests/qemucapabilitiesdata/caps_7.2.0.x86_64.xml | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.replies b/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.replies index 47203b8923..18f70a5a3f 100644 --- a/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.replies +++ b/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.replies @@ -17,11 +17,11 @@ { "return": { "qemu": { - "micro": 91, - "minor": 1, + "micro": 0, + "minor": 2, "major": 7 }, - "package": "v7.2.0-rc1" + "package": "v7.2.0" }, "id": "libvirt-2" } diff --git a/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.xml index 6bc739065f..821fcd3199 100644 --- a/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_7.2.0.x86_64.xml @@ -201,10 +201,10 @@ <flag name='query-stats-schemas'/> <flag name='thread-context'/> <flag name='screenshot-format-png'/> - <version>7001091</version> + <version>7002000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100245</microcodeVersion> - <package>v7.2.0-rc1</package> + <package>v7.2.0</package> <arch>x86_64</arch> <hostCPU type='kvm' model='base' migratability='yes'> <property name='vmx-entry-load-rtit-ctl' type='boolean' value='false'/> -- 2.38.1

2 1

[PATCH 0/7] spec: Decompose the daemon subpackage
by Jim Fehlig 14 Dec '22

14 Dec '22

This is a V1 of my previous RFC to decompose the libvirt-daemon package https://listman.redhat.com/archives/libvir-list/2022-November/235924.html The end goal is to remove the libvirt-dameon dependency on the various libvirt-daemon-driver-foo subpackages, allowing installation of a modular daemon configuration without the traditional monolithic libvirtd. Change from V1: - Patches1-3 handled separate from this series since they are unrelated - virtlockd, virtlogd, and virtproxyd are moved to their own subpackages - lockd plugin moved to its own subpackage - virt-admin, virt-host-validate, and others moved to new subpackage TODO: The libvirt-daemon package still contains the following files, which likely need to move somewhere since they are needed by the modular daemons too. %{_unitdir}/virt-guest-shutdown.target I thought of moving this to the libs package, but that would be a change for installations with only libvirt-client. AFAICT, it's used by libvirt-guests and the qemu and lxc drivers. %config(noreplace) %{_sysconfdir}/sasl2/libvirt.conf Another file related to remote access. Should it go to libvirt-libs? %ghost %dir %{_rundir}/libvirt/ %ghost %dir %{_rundir}/libvirt/common/ %dir %attr(0755, root, root) %{_localstatedir}/lib/libvirt/ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/images/ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/filesystems/ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/boot/ %dir %attr(0711, root, root) %{_localstatedir}/cache/libvirt/ %dir %attr(0755, root, root) %{_libdir}/libvirt/ %dir %attr(0755, root, root) %{_libdir}/libvirt/connection-driver/ These files and directories are needed by the modular daemons as well, right? Where should they go? libvirt-daemon-<hypervisor> or libvirt-daemon-driver-<hypervisor>? %{_datadir}/polkit-1/actions/org.libvirt.unix.policy %{_datadir}/polkit-1/actions/org.libvirt.api.policy %{_datadir}/polkit-1/rules.d/50-libvirt.rules More files related to access. libvirt-libs? Jim Fehlig (7): spec: Move virtlockd to a new subpackage libvirt-daemon-lock spec: Move virtlogd to a new subpackage libvirt-daemon-log spec: Move virtproxyd to a new subpackage libvirt-daemon-proxy spec: Move lockd plugin to a new subpackage libvirt-daemon-plugin-lockd spec: Move common files to a new subpackage libvirt-daemon-client spec: Remove libvirt-daemon dependecy from drivers spec: Remove libvirt-daemon dependency from hypervisor subpackages libvirt.spec.in | 274 ++++++++++++++++++++++++++++++++---------------- 1 file changed, 183 insertions(+), 91 deletions(-) -- 2.38.1

3 30

[PATCH] qemu_process: add tray changed event to queue in refresh disks
by Kristina Hanicova 13 Dec '22

13 Dec '22

There are some cases when the internal state of disks can change without qemu sending events about it (e.g. a disk can close during reset). In case this happens, we should emit an event about the modified disk. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1824722#c20 Signed-off-by: Kristina Hanicova <khanicov(a)redhat.com> --- src/qemu/qemu_process.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 5de55435d2..601e9694b6 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -8675,6 +8675,7 @@ qemuProcessRefreshDisks(virDomainObj *vm, qemuDomainObjPrivate *priv = vm->privateData; g_autoptr(GHashTable) table = NULL; size_t i; + virQEMUDriver *driver = QEMU_DOMAIN_PRIVATE(vm)->driver; if (qemuDomainObjEnterMonitorAsync(vm, asyncJob) == 0) { table = qemuMonitorGetBlockInfo(priv->mon); @@ -8697,14 +8698,26 @@ qemuProcessRefreshDisks(virDomainObj *vm, continue; if (info->removable) { + virObjectEvent *event = NULL; + int reason; + if (info->empty) virDomainDiskEmptySource(disk); if (info->tray) { - if (info->tray_open) + if (info->tray_open == disk->tray_status) + continue; + + if (info->tray_open) { + reason = VIR_DOMAIN_EVENT_TRAY_CHANGE_OPEN; disk->tray_status = VIR_DOMAIN_DISK_TRAY_OPEN; - else + } else { + reason = VIR_DOMAIN_EVENT_TRAY_CHANGE_CLOSE; disk->tray_status = VIR_DOMAIN_DISK_TRAY_CLOSED; + } + + event = virDomainEventTrayChangeNewFromObj(vm, disk->info.alias, reason); + virObjectEventStateQueue(driver->domainEventState, event); } } -- 2.38.1

2 1

[libvirt PATCH 0/2] qemu_migration: Fix p2p post-copy recovery
by Jiri Denemark 13 Dec '22

13 Dec '22

Jiri Denemark (2): qemu_migration: Move qemuMigrationSrcPerformResume up qemu_migration: Fix p2p post-copy recovery src/qemu/qemu_migration.c | 129 ++++++++++++++++++++------------------ 1 file changed, 68 insertions(+), 61 deletions(-) -- 2.39.0

2 4

[libvirt PATCH v3 00/18] Use nbdkit for http/ftp/ssh network drives in libvirt
by Jonathon Jongsma 13 Dec '22

13 Dec '22

This is the third version of this patch series. See https://bugzilla.redhat.com/show_bug.cgi?id=2016527 for more information about the goal, but the summary is that RHEL does not want to ship the qemu storage plugins for curl and ssh. Handling them outside of the qemu process provides several advantages such as reduced attack surface and stability. A quick summary of the code: - at startup I query to see whether nbdkit exists on the host and if so, I query which plugins/filters are installed. These capabilities are cached and stored in the qemu driver - When the driver prepares the domain, we go through each disk source and determine whether the nbdkit capabilities allow us to support this disk via nbdkit, and if so, we allocate a qemuNbdkitProcess object and stash it in the private data of the virStorageSource. - The presence or absence of this qemuNbdkitProcess data then indicates whether this disk will be served to qemu indirectly via nbdkit or directly - When we launch the qemuProcess, as part of the "external device start" step, I launch a ndkit process for each disk that is supported by nbdkit. - for devices which are served by an intermediate ndkit process, I change the qemu commandline in the following ways: - I no longer pass auth/cookie secrets to qemu (those are handled by nbdkit) - I replace the actual network URL of the remote disk source with the path to the nbdkit unix socket - We create a 'monitor' for the nbdkit process that watches to see whether the process exits. If it does, we pause the domain, attempt to restart nbdkit, and then resume the domain. Open questions - I think selinux will work once we add a policy for the /usr/sbin/nbdkit binary to allow it to be executed by libvirt, but for now it fails to execute nbdkit in enforcing mode. The current context for nbdkit (on fedora) is "system_u:object_r:bin_t:s0". When I temporarily change the context to something like qemu_exec_t, I am able to start nbdkit and the domain launches. Known shortcomings - creating disks (in ssh) still isn't supported. Changes in v3: - Various formatting fixes - Don't kill process in qemuNbdkitProcessFree() since we want the nbdkit daemon to continue running even if libvirt restarts. - Better detection and error reporting when starting the nbdkit process - Add monitoring for nbdkit process so that it can be restarted if if ever exits unexpectedly. Changes in v2: - split into multiple patches - added a build option for nbdkit_moddir - don't instantiate any secret / cookie props for disks that are being served by nbdkit since we don't send secrets to qemu anymore - ensure that nbdkit processes are started/stopped for the entire backing chain - switch to virFileCache-based capabilities for nbdkit so that we don't need to requery every time - switch to using pipes for communicating sensitive data to nbdkit - use pidfile support built into virCommand rather than nbdkit's --pidfile argument - added significantly more tests Jonathon Jongsma (18): schema: allow 'ssh' as a protocol for network disks qemu: Add functions for determining nbdkit availability qemu: expand nbdkit capabilities util: Allow virFileCache data to be any GObject qemu: implement basic virFileCache for nbdkit caps qemu: implement persistent file cache for nbdkit caps qemu: use file cache for nbdkit caps qemu: Add qemuNbdkitProcess qemu: add functions to start and stop nbdkit tests: add ability to test various nbdkit capabilities qemu: split qemuDomainSecretStorageSourcePrepare qemu: include nbdkit state in private xml qemu: use nbdkit to serve network disks if available tests: add tests for nbdkit invocation util: make virCommandSetSendBuffer testable qemu: pass sensitive data to nbdkit via pipe qemu: add test for authenticating a https network disk qemu: Monitor nbdkit process for exit build-aux/syntax-check.mk | 4 +- meson.build | 9 + meson_options.txt | 1 + po/POTFILES | 1 + src/conf/schemas/domaincommon.rng | 1 + src/libvirt_private.syms | 1 + src/qemu/meson.build | 1 + src/qemu/qemu_block.c | 162 ++- src/qemu/qemu_conf.c | 23 + src/qemu/qemu_conf.h | 7 + src/qemu/qemu_domain.c | 180 ++- src/qemu/qemu_domain.h | 4 + src/qemu/qemu_driver.c | 4 + src/qemu/qemu_extdevice.c | 48 + src/qemu/qemu_nbdkit.c | 1243 +++++++++++++++++ src/qemu/qemu_nbdkit.h | 120 ++ src/qemu/qemu_nbdkitpriv.h | 31 + src/qemu/qemu_process.c | 13 + src/util/vircommand.c | 19 +- src/util/vircommand.h | 8 + src/util/vircommandpriv.h | 4 + src/util/virfilecache.c | 14 +- src/util/virfilecache.h | 2 +- src/util/virutil.h | 2 +- tests/meson.build | 1 + .../disk-cdrom-network.args.disk0 | 7 + .../disk-cdrom-network.args.disk1 | 9 + .../disk-cdrom-network.args.disk1.pipe.1778 | 1 + .../disk-cdrom-network.args.disk2 | 9 + .../disk-cdrom-network.args.disk2.pipe.1780 | 1 + .../disk-network-http.args.disk0 | 7 + .../disk-network-http.args.disk1 | 6 + .../disk-network-http.args.disk2 | 7 + .../disk-network-http.args.disk2.pipe.1778 | 1 + .../disk-network-http.args.disk3 | 8 + .../disk-network-http.args.disk3.pipe.1780 | 1 + ...work-source-curl-nbdkit-backing.args.disk0 | 8 + ...e-curl-nbdkit-backing.args.disk0.pipe.1778 | 1 + .../disk-network-source-curl.args.1.pipe.1 | 1 + .../disk-network-source-curl.args.disk0 | 8 + ...k-network-source-curl.args.disk0.pipe.1778 | 1 + .../disk-network-source-curl.args.disk1 | 10 + ...k-network-source-curl.args.disk1.pipe.1780 | 1 + ...k-network-source-curl.args.disk1.pipe.1782 | 1 + ...isk-network-source-curl.args.disk1.pipe.49 | 1 + .../disk-network-source-curl.args.disk2 | 8 + ...k-network-source-curl.args.disk2.pipe.1782 | 1 + ...k-network-source-curl.args.disk2.pipe.1784 | 1 + ...isk-network-source-curl.args.disk2.pipe.51 | 1 + .../disk-network-source-curl.args.disk3 | 7 + .../disk-network-source-curl.args.disk4 | 7 + .../disk-network-ssh.args.disk0 | 7 + tests/qemunbdkittest.c | 294 ++++ ...sk-cdrom-network-nbdkit.x86_64-latest.args | 42 + .../disk-cdrom-network-nbdkit.xml | 1 + ...isk-network-http-nbdkit.x86_64-latest.args | 45 + .../disk-network-http-nbdkit.xml | 1 + ...rce-curl-nbdkit-backing.x86_64-latest.args | 38 + ...isk-network-source-curl-nbdkit-backing.xml | 45 + ...work-source-curl-nbdkit.x86_64-latest.args | 50 + .../disk-network-source-curl-nbdkit.xml | 1 + ...isk-network-source-curl.x86_64-latest.args | 54 + .../disk-network-source-curl.xml | 74 + ...disk-network-ssh-nbdkit.x86_64-latest.args | 36 + .../disk-network-ssh-nbdkit.xml | 1 + .../disk-network-ssh.x86_64-latest.args | 36 + tests/qemuxml2argvdata/disk-network-ssh.xml | 31 + tests/qemuxml2argvtest.c | 18 + tests/testutilsqemu.c | 27 + tests/testutilsqemu.h | 5 + 70 files changed, 2707 insertions(+), 116 deletions(-) create mode 100644 src/qemu/qemu_nbdkit.c create mode 100644 src/qemu/qemu_nbdkit.h create mode 100644 src/qemu/qemu_nbdkitpriv.h create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk1 create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk1.pipe.1778 create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk2 create mode 100644 tests/qemunbdkitdata/disk-cdrom-network.args.disk2.pipe.1780 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk1 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk2 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk2.pipe.1778 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk3 create mode 100644 tests/qemunbdkitdata/disk-network-http.args.disk3.pipe.1780 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl-nbdkit-backing.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl-nbdkit-backing.args.disk0.pipe.1778 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.1.pipe.1 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk0 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk0.pipe.1778 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk1 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk1.pipe.1780 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk1.pipe.1782 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk1.pipe.49 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk2 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk2.pipe.1782 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk2.pipe.1784 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk2.pipe.51 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk3 create mode 100644 tests/qemunbdkitdata/disk-network-source-curl.args.disk4 create mode 100644 tests/qemunbdkitdata/disk-network-ssh.args.disk0 create mode 100644 tests/qemunbdkittest.c create mode 100644 tests/qemuxml2argvdata/disk-cdrom-network-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-cdrom-network-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-http-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-network-http-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl-nbdkit-backing.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl-nbdkit-backing.xml create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-network-source-curl-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-network-source-curl.xml create mode 100644 tests/qemuxml2argvdata/disk-network-ssh-nbdkit.x86_64-latest.args create mode 120000 tests/qemuxml2argvdata/disk-network-ssh-nbdkit.xml create mode 100644 tests/qemuxml2argvdata/disk-network-ssh.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/disk-network-ssh.xml -- 2.37.3

5 46

[libvirt PATCH] qemu: Don't warn when releasing a released job
by Jiri Denemark 13 Dec '22

13 Dec '22

When qemuDomainObjReleaseAsyncJob is called when the current async job is already released we emit quite useless warning which was implemented to warn about releasing a job owned by another thread. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/qemu/qemu_domainjob.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_domainjob.c b/src/qemu/qemu_domainjob.c index 4d320f075e..8d958b9d21 100644 --- a/src/qemu/qemu_domainjob.c +++ b/src/qemu/qemu_domainjob.c @@ -647,7 +647,8 @@ qemuDomainObjReleaseAsyncJob(virDomainObj *obj) VIR_DEBUG("Releasing ownership of '%s' async job", virDomainAsyncJobTypeToString(obj->job->asyncJob)); - if (obj->job->asyncOwner != virThreadSelfID()) { + if (obj->job->asyncOwner != 0 && + obj->job->asyncOwner != virThreadSelfID()) { VIR_WARN("'%s' async job is owned by thread %llu", virDomainAsyncJobTypeToString(obj->job->asyncJob), obj->job->asyncOwner); -- 2.39.0

2 1

[libvirt PATCH] cpu: Improve debug message in virCPUGetVendorForModel
by Jiri Denemark 13 Dec '22

13 Dec '22

Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/cpu/cpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/cpu/cpu.c b/src/cpu/cpu.c index 7f3caf7a27..c5de9fc95c 100644 --- a/src/cpu/cpu.c +++ b/src/cpu/cpu.c @@ -936,7 +936,7 @@ virCPUGetVendorForModel(virArch arch, { struct cpuArchDriver *driver; - VIR_DEBUG("arch=%s", virArchToString(arch)); + VIR_DEBUG("arch=%s model=%s", virArchToString(arch), model); if (!(driver = cpuGetSubDriver(arch))) return NULL; -- 2.39.0

2 1

[libvirt PATCH] qemu: Fix warning in qemuMigrationDstPostcopyFailed
by Jiri Denemark 13 Dec '22

13 Dec '22

The function is called even if QEMU reports migration as postcopy-paused, i.e., it's not migrating anymore. And while changing the warning, we can drop the part about unattended migration to make the warning shorter and consistent with qemuMigrationSrcPostcopyFailed. Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/qemu/qemu_migration.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 81bb08c029..2e87db883e 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -1704,9 +1704,8 @@ qemuMigrationDstPostcopyFailed(virDomainObj *vm) reason == VIR_DOMAIN_RUNNING_POSTCOPY_FAILED) return; - VIR_WARN("Migration protocol failed during incoming migration of domain " - "%s, but QEMU keeps migrating; leaving the domain running, the " - "migration will be handled as unattended", vm->def->name); + VIR_WARN("Incoming migration of domain %s failed during post-copy; " + "leaving the domain running", vm->def->name); virDomainObjSetState(vm, VIR_DOMAIN_RUNNING, VIR_DOMAIN_RUNNING_POSTCOPY_FAILED); -- 2.39.0

2 1

[PATCH] meson: Provide default values for nonexistent xenlight pkgconfig vars
by Michal Privoznik 12 Dec '22

12 Dec '22

It may happen that xenlight pkgconfig file does not contain 'xenfirmwaredir' and/or 'libexec_bin' variables, which is okay and we have code that deals with this situation. But that code is executed when the queried value is an empty string. This may not always be the case and we should specifically set 'default_value' so that the empty string is returned if pkgconfig variable doesn't exist. Fixes: 968479adcfa5c49b29b7b6680dcaffde1408f044 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- meson.build | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/meson.build b/meson.build index f9834a36c2..3d870d77db 100644 --- a/meson.build +++ b/meson.build @@ -1478,8 +1478,8 @@ if not get_option('driver_libxl').disabled() and conf.has('WITH_LIBVIRTD') libxl_dep = dependency('xenlight', version: '>=' + libxl_version, required: get_option('driver_libxl')) if libxl_dep.found() - libxl_firmware_dir = libxl_dep.get_variable(pkgconfig : 'xenfirmwaredir') - libxl_execbin = libxl_dep.get_variable(pkgconfig : 'libexec_bin') + libxl_firmware_dir = libxl_dep.get_variable(pkgconfig : 'xenfirmwaredir', default_value: '') + libxl_execbin = libxl_dep.get_variable(pkgconfig : 'libexec_bin', default_value: '') if libxl_firmware_dir != '' conf.set_quoted('LIBXL_FIRMWARE_DIR', libxl_firmware_dir) endif -- 2.37.4

2 1

[PATCH 00/11] Remove secure clearing of memory where it doesn't make sense
by Peter Krempa 12 Dec '22

12 Dec '22

In certain cases we tried to clear stuff which isn't secure and in other cases we clear the pointer but then pass the secret on the commandline. Remove the security theatre. Additionally all other instances which pass secret via RPC can be theoreticlaly removed as the secret is copied to/from and non-sanitized RPC buffer. We'd have to clear all RPC buffers though for this to be "properly" handled and not just security theater. Peter Krempa (11): virCryptoEncryptDataAESgnutls: Don't secure erase gnutls_datum_t structs virCryptoEncryptDataAESgnutls: Properly initialize data structures virCryptoEncryptDataAESgnutls: Restructure control flow virStorageBackendISCSISetAuth: Don't bother securely erasing password virStorageBackendISCSISetAuth: Use g_strndup to '\0' terminate data virStorageBackendISCSISetAuth: Refactor cleanup libxlMakeNetworkDiskSrc: Don't bother with secure erase of secrets libxlMakeNetworkDiskSrc: Refactor cleanup virStorageBackendRBDOpenRADOSConn: Don't log the RBD key datatypes: Register autoptr cleanup for virSecret virSecretGetSecretString: Refactor cleanup src/datatypes.h | 1 + src/libxl/libxl_conf.c | 24 +++++----------- src/storage/storage_backend_iscsi.c | 22 +++++---------- src/storage/storage_backend_rbd.c | 24 ++++++++++++---- src/util/vircrypto.c | 43 ++++++++++------------------- src/util/virsecret.c | 19 ++++--------- 6 files changed, 53 insertions(+), 80 deletions(-) -- 2.38.1

3 20

[libvirt PATCH] rpm: switch to using %mingw_find_lang
by Daniel P. Berrangé 12 Dec '22

12 Dec '22

We currently list the locale file paths via a wildcard in %files, but the normal pattern for mingw RPMs in Fedora is to use %mingw_find_lang. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 562baea52e..31ff8ea01e 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1355,6 +1355,8 @@ rm -rf $RPM_BUILD_ROOT%{mingw64_libexecdir}/libvirt-guests.sh %mingw_debug_install_post +%mingw_find_lang %{name} + %endif %check @@ -2181,7 +2183,7 @@ exit 0 %{_datadir}/libvirt/api/libvirt-lxc-api.xml %if %{with_mingw} -%files -n mingw32-libvirt +%files -n mingw32-libvirt -f mingw32-libvirt.lang %dir %{mingw32_sysconfdir}/libvirt/ %config(noreplace) %{mingw32_sysconfdir}/libvirt/libvirt.conf %config(noreplace) %{mingw32_sysconfdir}/libvirt/libvirt-admin.conf @@ -2212,7 +2214,6 @@ exit 0 %{mingw32_datadir}/libvirt/api/libvirt-admin-api.xml %{mingw32_datadir}/libvirt/cpu_map/*.xml %{mingw32_datadir}/libvirt/test-screenshot.png -%{mingw32_datadir}/locale/*/LC_MESSAGES/libvirt.mo %dir %{mingw32_includedir}/libvirt %{mingw32_includedir}/libvirt/libvirt.h %{mingw32_includedir}/libvirt/libvirt-common.h @@ -2239,7 +2240,7 @@ exit 0 %{mingw32_mandir}/man1/virt-pki-validate.1* %{mingw32_mandir}/man7/virkey*.7* -%files -n mingw64-libvirt +%files -n mingw64-libvirt -f mingw64-libvirt.lang %dir %{mingw64_sysconfdir}/libvirt/ %config(noreplace) %{mingw64_sysconfdir}/libvirt/libvirt.conf %config(noreplace) %{mingw64_sysconfdir}/libvirt/libvirt-admin.conf @@ -2270,7 +2271,6 @@ exit 0 %{mingw64_datadir}/libvirt/api/libvirt-admin-api.xml %{mingw64_datadir}/libvirt/cpu_map/*.xml %{mingw64_datadir}/libvirt/test-screenshot.png -%{mingw64_datadir}/locale/*/LC_MESSAGES/libvirt.mo %dir %{mingw64_includedir}/libvirt %{mingw64_includedir}/libvirt/libvirt.h %{mingw64_includedir}/libvirt/libvirt-common.h -- 2.38.1

2 1

[libvirt PATCH 0/3] Actually do secure erase with explicit_bzero
by Daniel P. Berrangé 12 Dec '22

12 Dec '22

If we're going to have a virSecureErase function, we might as well make it do secure erasure with currently available explicit_bzero in FreeBSD/Linux. While we're here, we should use it from the RPC code. The remaining hole in the RPC code is xdr_free which does not securely erase buffers. That's not easily fixed without dropping the RPC impl in favour of a custom one. Daniel P. Berrangé (3): util: implement secure erase with explicit_bzero rpc: fix buffer offset updates after decoding payload rpc: securely erase the message buffers meson.build | 1 + src/rpc/virnetmessage.c | 4 +++- src/util/virsecureerase.c | 6 ++++++ 3 files changed, 10 insertions(+), 1 deletion(-) -- 2.38.1

2 4

[PATCH] formatcaps: Update capabilities example
by Michal Privoznik 12 Dec '22

12 Dec '22

In the formatcaps.rst we give an example output of capabilities. Well, there are couple of issues with it: 1) We show <features/> nested under /capabilities/host/cpu. There's no such element and never was. 2) The ordering of elements is corrupted. 3) There is plenty of elements missing. Fix these by showing an actual output of 'virsh capabilities' as obtained on my machine. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- docs/formatcaps.rst | 230 +++++++++++++++++++++++++++++++++----------- 1 file changed, 176 insertions(+), 54 deletions(-) diff --git a/docs/formatcaps.rst b/docs/formatcaps.rst index 39b1fb78ac..f7e5342654 100644 --- a/docs/formatcaps.rst +++ b/docs/formatcaps.rst @@ -143,60 +143,182 @@ capabilities enabled in the chip and BIOS you will see: :: - <capabilities> - <host> - <cpu> - <arch>x86_64</arch> - <features> - <vmx/> - </features> - <model>core2duo</model> - <vendor>Intel</vendor> - <topology sockets="1" dies="1" cores="2" threads="1"/> - <feature name="lahf_lm"/> - <feature name='xtpr'/> - <pages unit='KiB' size='4'/> - <pages unit='KiB' size='2048'/> - <pages unit='KiB' size='1048576'/> - <microcode version='36'/> - <maxphysaddr mode='emulate' bits='46'/> - ... - </cpu> - <power_management> - <suspend_mem/> - <suspend_disk/> - <suspend_hybrid/> - </power_management> - </host> + <capabilities> -  - <guest> - <os_type>xen</os_type> - <arch name="x86_64"> - <wordsize>64</wordsize> - <domain type="xen"></domain> - <emulator>/usr/lib64/xen/bin/qemu-dm</emulator> - </arch> - <features> - </features> - </guest> + <host> + <uuid>7b55704c-29f4-11b2-a85c-9dc6ff50623f</uuid> + <cpu> + <arch>x86_64</arch> + <model>Skylake-Client-noTSX-IBRS</model> + <vendor>Intel</vendor> + <microcode version='236'/> + <signature family='6' model='142' stepping='12'/> + <counter name='tsc' frequency='2303997000' scaling='no'/> + <topology sockets='1' dies='1' cores='4' threads='2'/> + <maxphysaddr mode='emulate' bits='39'/> + <feature name='ds'/> + <feature name='acpi'/> + <feature name='ss'/> + <feature name='ht'/> + <feature name='tm'/> + <feature name='pbe'/> + <feature name='dtes64'/> + <feature name='monitor'/> + <feature name='ds_cpl'/> + <feature name='vmx'/> + <feature name='smx'/> + <feature name='est'/> + <feature name='tm2'/> + <feature name='xtpr'/> + <feature name='pdcm'/> + <feature name='osxsave'/> + <feature name='tsc_adjust'/> + <feature name='sgx'/> + <feature name='clflushopt'/> + <feature name='intel-pt'/> + <feature name='md-clear'/> + <feature name='stibp'/> + <feature name='arch-capabilities'/> + <feature name='ssbd'/> + <feature name='xsaves'/> + <feature name='sgx1'/> + <feature name='sgx-debug'/> + <feature name='sgx-mode64'/> + <feature name='sgx-provisionkey'/> + <feature name='sgx-tokenkey'/> + <feature name='pdpe1gb'/> + <feature name='invtsc'/> + <feature name='rdctl-no'/> + <feature name='ibrs-all'/> + <feature name='skip-l1dfl-vmentry'/> + <feature name='mds-no'/> + <feature name='tsx-ctrl'/> + <pages unit='KiB' size='4'/> + <pages unit='KiB' size='2048'/> + <pages unit='KiB' size='1048576'/> + </cpu> + <power_management> + <suspend_mem/> + </power_management> + <iommu support='yes'/> + <migration_features> + <live/> + <uri_transports> + <uri_transport>tcp</uri_transport> + <uri_transport>rdma</uri_transport> + </uri_transports> + </migration_features> + <topology> + <cells num='1'> + <cell id='0'> + <memory unit='KiB'>32498112</memory> + <pages unit='KiB' size='4'>6813808</pages> + <pages unit='KiB' size='2048'>2048</pages> + <pages unit='KiB' size='1048576'>1</pages> + <distances> + <sibling id='0' value='10'/> + </distances> + <cpus num='8'> + <cpu id='0' socket_id='0' die_id='0' core_id='0' siblings='0,4'/> + <cpu id='1' socket_id='0' die_id='0' core_id='1' siblings='1,5'/> + <cpu id='2' socket_id='0' die_id='0' core_id='2' siblings='2,6'/> + <cpu id='3' socket_id='0' die_id='0' core_id='3' siblings='3,7'/> + <cpu id='4' socket_id='0' die_id='0' core_id='0' siblings='0,4'/> + <cpu id='5' socket_id='0' die_id='0' core_id='1' siblings='1,5'/> + <cpu id='6' socket_id='0' die_id='0' core_id='2' siblings='2,6'/> + <cpu id='7' socket_id='0' die_id='0' core_id='3' siblings='3,7'/> + </cpus> + </cell> + </cells> + </topology> + <cache> + <bank id='0' level='3' type='both' size='8' unit='MiB' cpus='0-7'/> + </cache> + <secmodel> + <model>none</model> + <doi>0</doi> + </secmodel> + <secmodel> + <model>dac</model> + <doi>0</doi> + <baselabel type='kvm'>+77:+77</baselabel> + <baselabel type='qemu'>+77:+77</baselabel> + </secmodel> + </host> -  - <guest> - <os_type>hvm</os_type> - <arch name="i686"> - <wordsize>32</wordsize> - <domain type="xen"></domain> - <emulator>/usr/lib/xen/bin/qemu-dm</emulator> - <machine>pc</machine> - <machine>isapc</machine> - <loader>/usr/lib/xen/boot/hvmloader</loader> - </arch> - <features> - <cpuselection/> - <deviceboot/> - </features> - </guest> + <guest> + <os_type>hvm</os_type> + <arch name='x86_64'> + <wordsize>64</wordsize> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <machine maxCpus='255'>pc-i440fx-7.1</machine> + <machine canonical='pc-i440fx-7.1' maxCpus='255'>pc</machine> + <machine maxCpus='288'>pc-q35-5.2</machine> + <machine maxCpus='255'>pc-i440fx-2.12</machine> + <machine maxCpus='255'>pc-i440fx-2.0</machine> + <machine maxCpus='255'>pc-i440fx-6.2</machine> + <machine maxCpus='288'>pc-q35-4.2</machine> + <machine maxCpus='255'>pc-i440fx-2.5</machine> + <machine maxCpus='255'>pc-i440fx-4.2</machine> + <machine maxCpus='255'>pc-i440fx-5.2</machine> + <machine maxCpus='255' deprecated='yes'>pc-i440fx-1.5</machine> + <machine maxCpus='255'>pc-q35-2.7</machine> + <machine maxCpus='288'>pc-q35-7.1</machine> + <machine canonical='pc-q35-7.1' maxCpus='288'>q35</machine> + <machine maxCpus='255'>pc-i440fx-2.2</machine> + <machine maxCpus='255'>pc-i440fx-2.7</machine> + <machine maxCpus='288'>pc-q35-6.1</machine> + <machine maxCpus='255'>pc-q35-2.4</machine> + <machine maxCpus='288'>pc-q35-2.10</machine> + <machine maxCpus='1'>x-remote</machine> + <machine maxCpus='288'>pc-q35-5.1</machine> + <machine maxCpus='255' deprecated='yes'>pc-i440fx-1.7</machine> + <machine maxCpus='288'>pc-q35-2.9</machine> + <machine maxCpus='255'>pc-i440fx-2.11</machine> + <machine maxCpus='288'>pc-q35-3.1</machine> + <machine maxCpus='255'>pc-i440fx-6.1</machine> + <machine maxCpus='288'>pc-q35-4.1</machine> + <machine maxCpus='255'>pc-i440fx-2.4</machine> + <machine maxCpus='255'>pc-i440fx-4.1</machine> + <machine maxCpus='255'>pc-i440fx-5.1</machine> + <machine maxCpus='255'>pc-i440fx-2.9</machine> + <machine maxCpus='1'>isapc</machine> + <machine maxCpus='255' deprecated='yes'>pc-i440fx-1.4</machine> + <machine maxCpus='255'>pc-q35-2.6</machine> + <machine maxCpus='255'>pc-i440fx-3.1</machine> + <machine maxCpus='288'>pc-q35-2.12</machine> + <machine maxCpus='288'>pc-q35-7.0</machine> + <machine maxCpus='255'>pc-i440fx-2.1</machine> + <machine maxCpus='288'>pc-q35-6.0</machine> + <machine maxCpus='255'>pc-i440fx-2.6</machine> + <machine maxCpus='288'>pc-q35-4.0.1</machine> + <machine maxCpus='255'>pc-i440fx-7.0</machine> + <machine maxCpus='255' deprecated='yes'>pc-i440fx-1.6</machine> + <machine maxCpus='288'>pc-q35-5.0</machine> + <machine maxCpus='288'>pc-q35-2.8</machine> + <machine maxCpus='255'>pc-i440fx-2.10</machine> + <machine maxCpus='288'>pc-q35-3.0</machine> + <machine maxCpus='255'>pc-i440fx-6.0</machine> + <machine maxCpus='288'>pc-q35-4.0</machine> + <machine maxCpus='288'>microvm</machine> + <machine maxCpus='255'>pc-i440fx-2.3</machine> + <machine maxCpus='255'>pc-i440fx-4.0</machine> + <machine maxCpus='255'>pc-i440fx-5.0</machine> + <machine maxCpus='255'>pc-i440fx-2.8</machine> + <machine maxCpus='288'>pc-q35-6.2</machine> + <machine maxCpus='255'>pc-q35-2.5</machine> + <machine maxCpus='255'>pc-i440fx-3.0</machine> + <machine maxCpus='288'>pc-q35-2.11</machine> + <domain type='qemu'/> + <domain type='kvm'/> + </arch> + <features> + <acpi default='on' toggle='yes'/> + <apic default='on' toggle='no'/> + <cpuselection/> + <deviceboot/> + <disksnapshot default='on' toggle='no'/> + </features> + </guest> - ... - </capabilities> + </capabilities> -- 2.37.4

2 1

[PATCH] docs: Add missing elements to formatcaps.rst
by Nobuhiro MIKI 12 Dec '22

12 Dec '22

Signed-off-by: Nobuhiro MIKI <nmiki(a)yahoo-corp.jp> --- docs/formatcaps.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/formatcaps.rst b/docs/formatcaps.rst index 9d7932a6a8..39b1fb78ac 100644 --- a/docs/formatcaps.rst +++ b/docs/formatcaps.rst @@ -155,6 +155,11 @@ capabilities enabled in the chip and BIOS you will see: <topology sockets="1" dies="1" cores="2" threads="1"/> <feature name="lahf_lm"/> <feature name='xtpr'/> + <pages unit='KiB' size='4'/> + <pages unit='KiB' size='2048'/> + <pages unit='KiB' size='1048576'/> + <microcode version='36'/> + <maxphysaddr mode='emulate' bits='46'/> ... </cpu> <power_management> -- 2.38.1

2 1

[PATCH RFC 0/6] spec: Decompose the daemon subpackage
by Jim Fehlig 11 Dec '22

11 Dec '22

Currently it is not possible to install a modular daemon subpackage without also installing the monolithic daemon https://listman.redhat.com/archives/libvir-list/2022-September/234554.html This series is an initial attempt at moving common daemons, utilities, and files from the daemon subpackage to a new daemon-core subpackage. The monolithic and modular daemons can then depend on the new subpackage. libvirt-guests is moved to a new libvirt-guests subpackage, which is recommended by the daemon subpackage to provide smoother upgrade. I've likely overlooked several items, but before continuing down this path too far I first wanted to gauge interest and see if this work is worth pursuing. If so, any comments on the RFC are appreciated! Note that patches 1-3 are things I noticed while working on the others and could be pushed independently. Jim Fehlig (6): spec: Remove redundant with_libxl spec: Use more %{name} macro spec: Remove daemon postun trigger spec: Move common daemons to a separate subpackage spec: Move more files to the daemon-core subpackage spec: Move libvirt-guests to guests subpackage libvirt.spec.in | 406 ++++++++++++++++++++++++++---------------------- 1 file changed, 219 insertions(+), 187 deletions(-) -- 2.37.3

3 14

[PATCH v2 0/2] virnetdevtap.c: Disallow pre-existing TAP devices
by Michal Privoznik 08 Dec '22

08 Dec '22

v2 of: https://listman.redhat.com/archives/libvir-list/2022-December/236197.html diff to v1: - Check for existing device iff virNetDevGenerateName() returned early (per Laine's suggestion). Michal Prívozník (2): virnetdev: Make virNetDevGenerateName() return 1 if no name was generated virnetdevtap.c: Disallow pre-existing TAP devices src/qemu/qemu_interface.c | 2 ++ src/util/virnetdev.c | 6 ++++-- src/util/virnetdevtap.c | 23 +++++++++++++++++++++-- src/util/virnetdevtap.h | 2 ++ 4 files changed, 29 insertions(+), 4 deletions(-) -- 2.37.4

2 3

[libvirt PATCH] tools: Fix style issues in virt-qemu-sev-validate
by Andrea Bolognani 08 Dec '22

08 Dec '22

The script had an incorrect interpreter line until commit f6a19d7264bb, so the flake8 check would not realize it needed to pick it up and these issues, some of which were present it the very first version that was committed, were not being reported. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- tools/virt-qemu-sev-validate | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/virt-qemu-sev-validate b/tools/virt-qemu-sev-validate index 46a92aa7a0..3d8b292fef 100755 --- a/tools/virt-qemu-sev-validate +++ b/tools/virt-qemu-sev-validate @@ -849,7 +849,7 @@ class ConfidentialVM(abc.ABC): secret64 = b64encode(secret_table_ciphertext).decode('utf8') log.debug("Header: %s (%d bytes)", header64, len(header)) log.debug("Secret: %s (%d bytes)", - secret64, len(secret_table_ciphertext)) + secret64, len(secret_table_ciphertext)) return header64, secret64 @@ -955,7 +955,7 @@ class LibvirtConfidentialVM(ConfidentialVM): self.dom = self.conn.lookupByName(id_name_uuid) log.debug("VM: id=%d name=%s uuid=%s", - self.dom.ID(), self.dom.name(), self.dom.UUIDString()) + self.dom.ID(), self.dom.name(), self.dom.UUIDString()) if not self.dom.isActive(): raise InvalidStateException( @@ -1331,5 +1331,6 @@ def main(): print("ERROR: %s" % e, file=sys.stderr) sys.exit(6) + if __name__ == "__main__": main() -- 2.38.1

3 3

[PATCH] virnetdevtap.c: Disallow pre-existing TAP devices
by Michal Privoznik 08 Dec '22

08 Dec '22

When starting a guest with <interface/> which has the target device name set (i.e. not generated by us), it may happen that the TAP device already exists. This then may lead to all sorts of problems. For instance: for <interface type='network'/> the TAP device is plugged into the network's bridge, but since the TAP device is persistent it remains plugged there even after the guest is shut off. We don't have a code that unplugs TAP devices from the bridge because TAP devices we create are transient, i.e. are removed automatically when QEMU closes their FD. The only exception is <interface type='ethernet'/> with <target managed='no'/> where we specifically want to let users use pre-created TAP device and basically not touch it at all. There's another reason for denying to use a pre-created TAP devices: if we ever have bug in TAP name generation, we may re-use a TAP device from another domain. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2144738 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_interface.c | 2 ++ src/util/virnetdevtap.c | 31 ++++++++++++++++++++++++++++++- src/util/virnetdevtap.h | 2 ++ 3 files changed, 34 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_interface.c b/src/qemu/qemu_interface.c index 4cc76e07a5..264d5e060c 100644 --- a/src/qemu/qemu_interface.c +++ b/src/qemu/qemu_interface.c @@ -461,6 +461,8 @@ qemuInterfaceEthernetConnect(virDomainDef *def, if (!net->ifname) template_ifname = true; + tap_create_flags |= VIR_NETDEV_TAP_CREATE_ALLOW_EXISTING; + if (virNetDevTapCreate(&net->ifname, tunpath, tapfd, tapfdSize, tap_create_flags) < 0) { goto cleanup; diff --git a/src/util/virnetdevtap.c b/src/util/virnetdevtap.c index 112a1e8b99..406339c583 100644 --- a/src/util/virnetdevtap.c +++ b/src/util/virnetdevtap.c @@ -148,12 +148,15 @@ virNetDevTapGetRealDeviceName(char *ifname G_GNUC_UNUSED) * @tunpath: path to the tun device (if NULL, /dev/net/tun is used) * @tapfds: array of file descriptors return value for the new tap device * @tapfdSize: number of file descriptors in @tapfd - * @flags: OR of virNetDevTapCreateFlags. Only one flag is recognized: + * @flags: OR of virNetDevTapCreateFlags. Only the following flags are + * recognized: * * VIR_NETDEV_TAP_CREATE_VNET_HDR * - Enable IFF_VNET_HDR on the tap device * VIR_NETDEV_TAP_CREATE_PERSIST * - The device will persist after the file descriptor is closed + * VIR_NETDEV_TAP_CREATE_ALLOW_EXISTING + * - The device creation fails if @ifname already exists * * Creates a tap interface. The caller must use virNetDevTapDelete to * remove a persistent TAP device when it is no longer needed. In case @@ -182,6 +185,19 @@ int virNetDevTapCreate(char **ifname, if (virNetDevGenerateName(ifname, VIR_NET_DEV_GEN_NAME_VNET) < 0) return -1; + if (!(flags & VIR_NETDEV_TAP_CREATE_ALLOW_EXISTING)) { + int rc = virNetDevExists(*ifname); + + if (rc < 0) { + return -1; + } else if (rc > 0) { + virReportError(VIR_ERR_OPERATION_INVALID, + _("The %s interface already exists"), + *ifname); + return -1; + } + } + if (!tunpath) tunpath = "/dev/net/tun"; @@ -319,6 +335,19 @@ int virNetDevTapCreate(char **ifname, if (virNetDevGenerateName(ifname, VIR_NET_DEV_GEN_NAME_VNET) < 0) return -1; + if (!(flags & VIR_NETDEV_TAP_CREATE_ALLOW_EXISTING)) { + int rc = virNetDevExists(*ifname); + + if (rc < 0) { + return -1; + } else if (rc > 0) { + virReportError(VIR_ERR_OPERATION_INVALID, + _("The %s interface already exists"), + *ifname); + return -1; + } + } + /* As FreeBSD determines interface type by name, * we have to create 'tap' interface first and * then rename it to 'vnet' diff --git a/src/util/virnetdevtap.h b/src/util/virnetdevtap.h index 197ea10f94..c9d29c0384 100644 --- a/src/util/virnetdevtap.h +++ b/src/util/virnetdevtap.h @@ -56,6 +56,8 @@ typedef enum { VIR_NETDEV_TAP_CREATE_USE_MAC_FOR_BRIDGE = 1 << 2, /* The device will persist after the file descriptor is closed */ VIR_NETDEV_TAP_CREATE_PERSIST = 1 << 3, + /* The device is allowed to exist before creation */ + VIR_NETDEV_TAP_CREATE_ALLOW_EXISTING = 1 << 4, } virNetDevTapCreateFlags; int -- 2.37.4

2 1

[libvirt PATCH 00/21] meson: remove many obsolete checks
by Daniel P. Berrangé 08 Dec '22

08 Dec '22

We have alot of checks for Linux kernel features that are obsolete since our supported platform matrix lets us assume new enough kernel versions. Removing the checks will speed up the meson phase and reduce the tangle of #ifdefs in the code. I thought I could remove the check for linux/kvm.h but for some reason our code in virhostpcu.c / cpu_x86.c is enabling the codebases even on FreeBSD, which I find kind of odd. Does FreeBSD really ship a linux/kvm.h ? Daniel P. Berrangé (21): meson: remove obsolete check for LOOP_CTL_GET_FREE meson: remove obsolete check for EPOLL_CLOEXEC meson: remove obsolete check for LO_FLAGS_AUTOCLEAR meson: drop check for unshare() netdev: simplify check for ethtool functionality meson: remove obsolete check for ETHTOOL_GGSO meson: remove obsolete check for ETHTOOL_GGRO meson: remove obsolete check for ETHTOOL_GFLAGS meson: remove obsolete check for ETH_FLAG_LRO meson: remove obsolete check for ETH_FLAG_TXVLAN/RXVLAN meson: remove obsolete check for ETH_FLAG_NTUPLE meson: remove obsolete check for ETH_FLAG_RXHASH meson: remove obsolete check for ETHTOOL_GFEATURES meson: remove obsolete check for ETHTOOL_GCOALESCE meson: remove obsolete check for GET_VLAN_VID_CMD meson: simplify check for virnetdevbridge.c headers meson: remove obsolete check for DEVLINK_CMD_ESWITCH_GET meson: remove obsolete check for linux/magic.h meson: remove obsolete check for VHOST_VSOCK_SET_GUEST_CID meson: remove obsolete check for BPF_PROG_QUERY meson: remove obsolete check for BPF_CGROUP_DEVICE meson.build | 82 +++-------------------------------- src/util/virbpf.c | 6 +-- src/util/virbpf.h | 6 +-- src/util/vircgroupv2devices.c | 10 ++--- src/util/virfile.c | 15 ++----- src/util/virnetdev.c | 65 ++++----------------------- src/util/virvsock.c | 4 +- tests/securityselinuxhelper.c | 4 +- tests/virfilemock.c | 2 +- 9 files changed, 32 insertions(+), 162 deletions(-) -- 2.38.1

3 25

[libvirt PATCH 0/2] virt-qemu-sev-validate: A couple of small fixes
by Andrea Bolognani 08 Dec '22

08 Dec '22

Andrea Bolognani (2): docs: Fix typo in virt-qemu-sev-validate(1) tools: Fix interpreter for virt-qemu-sev-validate docs/manpages/virt-qemu-sev-validate.rst | 2 +- tools/virt-qemu-sev-validate | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) -- 2.38.1

2 3

RFC: New APIs for delegation of privileged operations
by Andrea Bolognani 08 Dec '22

08 Dec '22

Hi, this is a proposal for introducing a new family of APIs in libvirt, with the goal of improving integration with management applications. KubeVirt is intended to be the primary consumer of these APIs. Background ---------- KubeVirt makes it possible to run VMs on a Kubernetes cluster, side by side with containers. It does so by running QEMU and libvirtd themselves inside a container. The architecture is explained in more detail at https://kubevirt.io/user-guide/architecture/ but for the purpose of this discussion we only need to keep in mind two components: * virt-launcher - runs in the same container as QEMU and libvirtd - one instance per VM * virt-handler - runs in a separate container - one instance per node Conceptually, these two components roughly map to QEMU processes and libvirtd respectively. >From a security perspective, there is a strong push in Kubernetes to run workloads under unprivileged user accounts and without additional capabilities. Again, this is similar to how libvirtd itself runs as root but the QEMU processes it starts are under the unprivileged "qemu" account. KubeVirt has been working towards the goal of running VMs as completely unprivileged workloads and made excellent progress so far. Some of the operations needed for running a VM, however, inherently require elevated privilege. In KubeVirt, the conundrum is solved by having virt-handler (a privileged component) take care of those operations, making it possible for virt-launcher (as well as QEMU and libvirtd) to run in an unprivileged context. Examples -------- Here are a few examples of how KubeVirt has been able to reduce the privilege required by virt-launcher by selectively handing over responsibilities to virt-handler: * Remove SYS_RESOURCE capability from launcher pod https://github.com/kubevirt/kubevirt/pull/2584 * Drop SYS_RESOURCE capability https://github.com/kubevirt/kubevirt/pull/5558 * Housekeeping cgroup https://github.com/kubevirt/kubevirt/pull/8233 * Real time VMs fail to change vCPU scheduler and priority in non-root deployments https://github.com/kubevirt/kubevirt/pull/8750 * virt-launcher: Drop SYS_PTRACE capability https://github.com/kubevirt/kubevirt/pull/8842 The pattern we can see is that, initially, libvirt just assumes that it can perform a certain privileged operation. This fails in the context of KubeVirt, where libvirtd runs with significantly reduced privileges. As a consequence, libvirt is patched to be more resilient to such lack of privilege: for example, instead of attempting to create a file and erroring out due to lack of permissions, it will instead first check whether the file already exists and, if it does, assume that it has been prepared ahead of time by an external entity. Limitations ----------- This approach works fine, but only for the privileged operations that would be performed by libvirt before the VM starts running. Looking at the "housekeeping cgroup" PR in particular, we notice that the VM is initially created in paused state: this is necessary in order to create a point in time in which all the VM threads already exist but, crucially, none of the vCPUs have stated running yet. This is the only opportunity to move threads across cgroups without invalidating the expectations of a real time workload. When it comes to live migration, however, there is no way to create similar conditions, since the VM is running on the destination host right out of the gate. As a consequence, live migration has to be blocked when the housekeeping cgroup is in use, which is an unfortunate limitation. Moreover, there's an overall sense of fragility surrounding these interactions: both KubeVirt and, to some extent, libvirt need to be acutely aware of what the other component is going to do, but there is never an explicit handover and the whole thing only works if you just so happen to do everything with the exact right order and timing. Proposal -------- In order to address the issues outlined above, I propose that we introduce a new set of APIs in libvirt. These APIs would expose some of the inner workings of libvirt, and as such would come with *massively reduced* stability guarantees compared to the rest of our public API. The idea is that applications such as KubeVirt, which track libvirt fairly closely and stay pinned to specific versions, would be able to adapt to changes in these APIs relatively painlessly. More traditional management applications such as virt-manager would simply not opt into using the new APIs and maintain the status quo. Using memlock as an example, the new API could look like typedef int (*virInternalSetMaxMemLockHandler)(pid_t pid, unsigned long long bytes); int virInternalSetProcessSetMaxMemLockHandler(virConnectPtr conn, virInternalSetMaxMemLockHandler handler); The application-provided handler would be responsible for performing the privileged operation (in this case raising the memlock limit for a process). For KubeVirt, virt-launcher would have to pass the baton to virt-handler. If such an handler is installed, libvirt would invoke it (and likely go through some sanity checks afterwards); if not, it would attempt to perform the privileged operation itself, as it does today. This would make the interaction between libvirt and the management application explicit rather than implicit. Not having to stick to our usual API stability guarantees would make it possible to be more liberal in exposing the internals of libvirt as interaction points. Scope ----- I think we should initially limit the new APIs to the scenarios that have already been identified, then gradually expand the scope as needed. In other words, we shouldn't comb through the codebase looking for potential adopters. Since the intended consumers of these APIs are those that can adopt a new libvirt release fairly quickly, this shouldn't be a problem. Once the pattern has been established, we might consider introducing support for it at the same time as a new feature that might benefit from it is added. Caveats ------- libvirt is all about stable API, so introducing an API that is unstable *by design* is completely uncharted territory. To ensure that the new APIs are 100% opt-in, we could define them in a separate <libvirt/libvirt-internal.h> header. Furthermore, we could have a separate libvirt-internal.so shared library for the symbols and a corresponding libvirt-internal.pc pkg-config file. We could even go as far as requiring a preprocessor symbol such as VIR_INTERNAL_UNSTABLE_API_OPT_IN to be defined before the entry points are visible to the compiler. Whatever the mechanism, we would need to make sure that it's usable from language bindings as well. Internal APIs are amendable to not only come and go, but also change semantics between versions. We should make sure that such changes are clearly exposed to the user, for example by requiring them to pass a version number to the function and erroring out immediately if the value doesn't match our expectations. KubeVirt has a massive suite of functional tests, so this kind of change would immediately be spotted when a new version of libvirt is imported, with no risk of an incompatibility lingering in the codebase until it affects users. Disclaimer ---------- This proposal is intentionally vague on several of the details. Before attempting to nail those down, I want to gather feedback on the high-level idea, both from the libvirt and KubeVirt side. Credits ------- Thanks to Michal and Martin for helping shape and polish the idea from its initial rough state. -- Andrea Bolognani / Red Hat / Virtualization

7 15

[PATCH] tools: Fix install_mode for some scripts
by Michal Privoznik 08 Dec '22

08 Dec '22

Scripts from the following list were installed with group write bit set: virt-xml-validate, virt-pki-validate, virt-sanlock-cleanup, libvirt-guests.sh. This is very unusual and in contrast with the way other scripts/binaries are installed. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2151202 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tools/meson.build | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/meson.build b/tools/meson.build index c41c619af4..fad7f202ad 100644 --- a/tools/meson.build +++ b/tools/meson.build @@ -249,7 +249,7 @@ configure_file( configuration: tools_conf, install: true, install_dir: bindir, - install_mode: 'rwxrwxr-x', + install_mode: 'rwxr-xr-x', ) configure_file( @@ -258,7 +258,7 @@ configure_file( configuration: tools_conf, install: true, install_dir: bindir, - install_mode: 'rwxrwxr-x', + install_mode: 'rwxr-xr-x', ) executable( @@ -295,7 +295,7 @@ if conf.has('WITH_SANLOCK') configuration: tools_conf, install: true, install_dir: sbindir, - install_mode: 'rwxrwxr-x', + install_mode: 'rwxr-xr-x', ) endif @@ -311,7 +311,7 @@ if conf.has('WITH_LIBVIRTD') configuration: tools_conf, install: true, install_dir: libexecdir, - install_mode: 'rwxrwxr-x', + install_mode: 'rwxr-xr-x', ) if init_script == 'systemd' -- 2.37.4

3 2

Release of libvirt-php-0.5.7
by Michal Prívozník 07 Dec '22

07 Dec '22

The 0.5.7 release of libvirt-php is tagged and tarball is available at: https://libvirt.org/sources/php/ Notable changes: * Dropped support for PHP-6.0 and older * Fixed libvirt_connect_get_machine_types() with PHP-7.0 and newer * Dropped imagick dependency * Bug fixes Thanks to everybody who helped with this release. Michal

1 0

[PATCH v4] virsh: Add message to terminal when running snapshot-revert
by Haruka Ohata 07 Dec '22

07 Dec '22

When running virsh snapshot-* command, such as snapshot-create-as / snapshot-delete, it prints a result message. On the other hand virsh snapshot-revert command doesn't print a result message. So, This patch fixes to add message when running virsh snapshot-revert command. --- # virsh snapshot-create-as vm1 test1 Domain snapshot test01 created # virsh snapshot-revert vm1 test1 # virsh snapshot-delete vm1 test1 Domain snapshot test01 deleted # --- Signed-off-by: Haruka Ohata <ohata.haruka(a)fujitsu.com> --- tests/virsh-snapshot | 3 +++ tools/virsh-snapshot.c | 4 ++++ 2 files changed, 7 insertions(+) diff --git a/tests/virsh-snapshot b/tests/virsh-snapshot index 4c64bb537b..b09273917b 100755 --- a/tests/virsh-snapshot +++ b/tests/virsh-snapshot @@ -100,11 +100,14 @@ Domain snapshot s1 created Domain snapshot s3 created Domain snapshot s2 created +Domain snapshot s3 reverted Domain snapshot s6 created Domain snapshot s5 created +Domain snapshot s6 reverted Domain snapshot s4 created +Domain snapshot s1 reverted Domain snapshot s7 created Domain snapshot s8 created diff --git a/tools/virsh-snapshot.c b/tools/virsh-snapshot.c index 8fa64ba903..68908cd10a 100644 --- a/tools/virsh-snapshot.c +++ b/tools/virsh-snapshot.c @@ -1783,6 +1783,10 @@ cmdDomainSnapshotRevert(vshControl *ctl, const vshCmd *cmd) result = virDomainRevertToSnapshot(snapshot, flags); } + if (result < 0) + vshError(ctl, _("Failed to revert snapshot %s"), name); + else + vshPrintExtra(ctl, _("Domain snapshot %s reverted\n"), name); return result >= 0; } -- 2.38.1

2 1

[PATCH 0/5] qemu: Prefer PNG for domain screenshots
by Michal Privoznik 07 Dec '22

07 Dec '22

Whilst preparing for libvirt-php release, I want to ditch its imagick dependency which is needed to convert PPM to PNG. But I've learned that QEMU is able to return PNG already which looks more versatile than PPM anyways. Michal Prívozník (5): qemu_caps: Introduce QEMU_CAPS_SCREENSHOT_FORMAT_PNG qemu_monitor: Debug print all arguments in qemuMonitorScreendump() qemu_monitor: Extend qemuMonitorScreendump() for @format qemu: Prefer PNG for domain screenshots NEWS: Document change of screenshot format for QEMU NEWS.rst | 4 ++++ src/qemu/qemu_capabilities.c | 2 ++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_driver.c | 13 +++++++++++-- src/qemu/qemu_monitor.c | 6 ++++-- src/qemu/qemu_monitor.h | 1 + src/qemu/qemu_monitor_json.c | 2 ++ src/qemu/qemu_monitor_json.h | 1 + tests/qemucapabilitiesdata/caps_7.1.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_7.1.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_7.2.0.x86_64.xml | 1 + tests/qemumonitorjsontest.c | 2 +- 12 files changed, 30 insertions(+), 5 deletions(-) -- 2.37.4

3 8

[libvirt PATCH v3] tools: add virt-qemu-qmp-proxy for proxying QMP via libvirt QEMU guests
by Daniel P. Berrangé 06 Dec '22

06 Dec '22

Libvirt provides QMP passthrough APIs for the QEMU driver and these are exposed in virsh. It is not especially pleasant, however, using the raw QMP JSON syntax. QEMU has a tool 'qmp-shell' which can speak QMP and exposes a human friendly interactive shell. It is not possible to use this with libvirt managed guest, however, since only one client can attach to the QMP socket at any point in time. While it would be possible to configure a second QMP socket for a VM, it may not be an known requirement at the time the guest is provisioned. The virt-qmp-proxy tool aims to solve this problem. It opens a UNIX socket and listens for incoming client connections, speaking QMP on the connected socket. It will forward any QMP commands received onto the running libvirt QEMU guest, and forward any replies back to the QMP client. It will also forward back events. $ virsh start demo $ virt-qmp-proxy demo demo.qmp & $ qmp-shell demo.qmp Welcome to the QMP low-level shell! Connected to QEMU 6.2.0 (QEMU) query-kvm { "return": { "enabled": true, "present": true } } Note this tool of course has the same risks as the raw libvirt QMP passthrough. It is safe to run query commands to fetch information but commands which change the QEMU state risk disrupting libvirt's management of QEMU, potentially resulting in data loss/corruption in the worst case. Any use of this tool will cause the guest to be marked as tainted as an warning that it could be in an unexpected state. Since this tool introduces a python dependency it is not desirable to include it in any of the existing RPMs in libvirt. This tool is also QEMU specific, so isn't appropriate to bundle with the generic tools. Thus a new RPM is introduced 'libvirt-clients-qemu', to contain additional QEMU specific tools, with extra external deps. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- In v3: - Added to libvirt-clients-qemu RPM - Renamed to virt-qemu-qmp-proxy docs/manpages/meson.build | 1 + docs/manpages/virt-qemu-qmp-proxy.rst | 120 +++++++++ libvirt.spec.in | 15 ++ tools/meson.build | 5 + tools/virt-qemu-qmp-proxy | 360 ++++++++++++++++++++++++++ 5 files changed, 501 insertions(+) create mode 100644 docs/manpages/virt-qemu-qmp-proxy.rst create mode 100755 tools/virt-qemu-qmp-proxy diff --git a/docs/manpages/meson.build b/docs/manpages/meson.build index ba673cf472..83933227d9 100644 --- a/docs/manpages/meson.build +++ b/docs/manpages/meson.build @@ -18,6 +18,7 @@ docs_man_files = [ { 'name': 'virt-pki-query-dn', 'section': '1', 'install': true }, { 'name': 'virt-pki-validate', 'section': '1', 'install': true }, { 'name': 'virt-qemu-run', 'section': '1', 'install': conf.has('WITH_QEMU') }, + { 'name': 'virt-qemu-qmp-proxy', 'section': '1', 'install': conf.has('WITH_QEMU') }, { 'name': 'virt-xml-validate', 'section': '1', 'install': true }, { 'name': 'libvirt-guests', 'section': '8', 'install': conf.has('WITH_LIBVIRTD') }, diff --git a/docs/manpages/virt-qemu-qmp-proxy.rst b/docs/manpages/virt-qemu-qmp-proxy.rst new file mode 100644 index 0000000000..b387474b19 --- /dev/null +++ b/docs/manpages/virt-qemu-qmp-proxy.rst @@ -0,0 +1,120 @@ +=================== +virt-qemu-qmp-proxy +=================== + +-------------------------------------------------- +Expose a QMP proxy server for a libvirt QEMU guest +-------------------------------------------------- + +:Manual section: 1 +:Manual group: Virtualization Support + +.. contents:: + + +SYNOPSIS +======== + +``virt-qemu-qmp-proxy`` [*OPTION*]... *DOMAIN* *QMP-SOCKET-PATH* + + +DESCRIPTION +=========== + +This tool provides a way to expose a QMP proxy server that communicates +with a QEMU guest managed by libvirt. This enables standard QMP client +tools to interact with libvirt managed guests. + +**NOTE: use of this tool will result in the running QEMU guest being +marked as tainted.** It is strongly recommended that this tool *only be +used to send commands which query information* about the running guest. +If this tool is used to make changes to the state of the guest, this +may have negative interactions with the QEMU driver, resulting in an +inability to manage the guest operation thereafter, and in the worst +case **potentially lead to data loss or corruption**. + +The ``virt-qemu-qmp-proxy`` program will listen on a UNIX socket for incoming +client connections, and run the QMP protocol over the connection. Any +commands received will be sent to the running libvirt guest, and replies +sent back. + +The ``virt-qemu-qmp-proxy`` program may be interrupted (eg Ctrl-C) when it +is no longer required. The libvirt QEMU guest will continue running. + + +OPTIONS +======= + +*DOMAIN* + +The ID or UUID or Name of the libvirt QEMU guest. + +*QMP-SOCKET-PATH* + +The filesystem path at which to run the QMP server, listening for +incoming connections. + +``-c`` *CONNECTION-URI* +``--connect``\ =\ *CONNECTION-URI* + +The URI for the connection to the libvirt QEMU driver. If omitted, +a URI will be auto-detected. + +``-v``, ``--verbose`` + +Run in verbose mode, printing all QMP commands and replies that +are handled. + +``-h``, ``--help`` + +Display the command line help. + + +EXIT STATUS +=========== + +Upon successful shutdown, an exit status of 0 will be set. Upon +failure a non-zero status will be set. + + +AUTHOR +====== + +Daniel P. Berrangé + + +BUGS +==== + +Please report all bugs you discover. This should be done via either: + +#. the mailing list + + `https://libvirt.org/contact.html <https://libvirt.org/contact.html>`_ + +#. the bug tracker + + `https://libvirt.org/bugs.html <https://libvirt.org/bugs.html>`_ + +Alternatively, you may report bugs to your software distributor / vendor. + +COPYRIGHT +========= + +Copyright (C) 2022 by Red Hat, Inc. + + +LICENSE +======= + +``virt-qemu-qmp-proxy`` is distributed under the terms of the GNU LGPL v2+. +This is free software; see the source for copying conditions. There +is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR +PURPOSE + + +SEE ALSO +======== + +virsh(1), `https://libvirt.org/ <https://libvirt.org/>`_, +`QMP reference <https://www.qemu.org/docs/master/interop/qemu-qmp-ref.html>`_ diff --git a/libvirt.spec.in b/libvirt.spec.in index 950c5a3b6d..3082285dc0 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -899,6 +899,15 @@ Obsoletes: libvirt-bash-completion < 7.3.0 The client binaries needed to access the virtualization capabilities of recent versions of Linux (and other OSes). +%package client-qemu +Summary: Additional client side utilities for QEMU +Requires: %{name}-libs = %{version}-%{release} +Requires: python3-libvirt >= %{version}-%{release} + +%description client-qemu +The additional client binaries are used to interact +with some QEMU specific features of libvirt. + %package libs Summary: Client side libraries # So remote clients can access libvirt over SSH tunnel @@ -2159,6 +2168,12 @@ exit 0 %{_datadir}/bash-completion/completions/virsh +%if %{with_qemu} +%files client-qemu +%{_mandir}/man1/virt-qemu-qmp-proxy.1* +%{_bindir}/virt-qemu-qmp-proxy +%endif + %files libs -f %{name}.lang %license COPYING COPYING.LESSER %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/ diff --git a/tools/meson.build b/tools/meson.build index bb28a904dc..20509906af 100644 --- a/tools/meson.build +++ b/tools/meson.build @@ -320,6 +320,11 @@ if conf.has('WITH_LIBVIRTD') endif endif +if conf.has('WITH_QEMU') + install_data('virt-qemu-qmp-proxy', + install_dir: bindir) +endif + if bash_completion_dep.found() subdir('bash-completion') endif diff --git a/tools/virt-qemu-qmp-proxy b/tools/virt-qemu-qmp-proxy new file mode 100755 index 0000000000..d85342bd2b --- /dev/null +++ b/tools/virt-qemu-qmp-proxy @@ -0,0 +1,360 @@ +#!/usr/bin/env python3 + +import argparse +import array +import libvirt +import libvirt_qemu +import os +import re +import socket +import sys +import traceback +import json +import fcntl + + +debug = False + +def get_domain(uri, domstr): + conn = libvirt.open(uri) + + dom = None + saveex = None + + def try_lookup(cb): + try: + return cb() + except libvirt.libvirtError as ex: + nonlocal saveex + if saveex is None: + saveex = ex + + if re.match(r'^\d+$', domstr): + dom = try_lookup(lambda: conn.lookupByID(int(domstr))) + + if dom is None and re.match(r'^[-a-f0-9]{36}|[a-f0-9]{32}$', domstr): + dom = try_lookup(lambda: conn.lookupByUUIDString(domstr)) + + if dom is None: + dom = try_lookup(lambda: conn.lookupByName(domstr)) + + if dom is None: + raise saveex + + if not dom.isActive(): + raise Exception("Domain must be running to use QMP") + + return conn, dom + + +class QMPProxy(object): + + def __init__(self, conn, dom, serversock, verbose): + self.conn = conn + self.dom = dom + self.verbose = verbose + + self.serversock = serversock + self.serverwatch = 0 + + self.clientsock = None + self.clientwatch = 0 + + self.api2sock = bytes([]) + self.api2sockfds = [] + + self.sock2api = bytes([]) + self.sock2apifds = [] + + self.serverwatch = libvirt.virEventAddHandle( + self.serversock.fileno(), libvirt.VIR_EVENT_HANDLE_READABLE, + self.handle_server_io, self) + + libvirt_qemu.qemuMonitorEventRegister(self.conn, self.dom, + None, + self.handle_qmp_event, + self) + + + @staticmethod + def handle_qmp_event(conn, dom, event, secs, usecs, details, self): + evdoc = { + "event": event, + "timestamp": {"seconds": secs, "microseconds": usecs } + } + if details is not None: + evdoc["data"] = details + + ev = json.dumps(evdoc) + if self.verbose: + print(ev) + ev += "\r\n" + self.api2sock += ev.encode("utf-8") + self.update_client_events() + + + def recv_with_fds(self): + # Match VIR_NET_MESSAGE_NUM_FDS_MAX in virnetprotocol.x + maxfds = 32 + fds = array.array('i') + cmsgdatalen = socket.CMSG_LEN(maxfds * fds.itemsize) + + data, cmsgdata, flags, addr = self.clientsock.recvmsg(1024, + cmsgdatalen) + for cmsg_level, cmsg_type, cmsg_data in cmsgdata: + if (cmsg_level == socket.SOL_SOCKET and + cmsg_type == socket.SCM_RIGHTS): + fds.frombytes(cmsg_data[:len(cmsg_data) - + (len(cmsg_data) % fds.itemsize)]) + else: + raise Exception("Unexpected CMSGDATA level %d type %d" % ( + cmsg_level, cmsg_type)) + + return data, [self.make_file(fd) for fd in fds] + + + def send_with_fds(self, data, fds): + cfds = [fd.fileno() for fd in fds] + + cmsgdata = [(socket.SOL_SOCKET, socket.SCM_RIGHTS, + array.array("i", cfds))] + + return self.clientsock.sendmsg([data], cmsgdata) + + + @staticmethod + def make_file(fd): + flags = fcntl.fcntl(fd, fcntl.F_GETFL) + + mask = os.O_RDONLY | os.O_WRONLY | os.O_RDWR | os.O_APPEND + flags = flags & mask + mode = "" + if flags == os.O_RDONLY: + mode = "rb" + elif flags == os.O_WRONLY: + mode = "wb" + elif flags == os.O_RDWR: + mode = "r+b" + elif flags == (os.O_WRONLY | os.O_APPEND): + mode = "ab" + elif flags == (os.O_RDWR | os.O_APPEND): + mode = "a+b" + + return os.fdopen(fd, mode) + + + def add_client(self, sock): + ver = self.conn.getVersion() + major = int(ver / 1000000) % 1000 + minor = int(ver / 1000) % 1000 + micro = ver % 1000 + + greetingobj = { + "QMP": { + "version": { + "qemu": { + "major": major, + "minor": minor, + "micro": micro, + }, + "package": f"qemu-{major}.{minor}.{micro}", + }, + "capabilities": [ + "oob" + ], + } + } + greeting = json.dumps(greetingobj) + if self.verbose: + print(greeting) + greeting += "\r\n" + + self.clientsock = sock + self.clientwatch = libvirt.virEventAddHandle( + self.clientsock.fileno(), libvirt.VIR_EVENT_HANDLE_WRITABLE, + self.handle_client_io, self) + self.api2sock += greeting.encode("utf-8") + self.update_server_events() + + + def remove_client(self): + libvirt.virEventRemoveHandle(self.clientwatch) + self.clientsock.close() + self.clientsock = None + self.clientwatch = 0 + self.update_server_events() + + self.api2sock = bytes([]) + self.api2sockfds = [] + + self.sock2api = bytes([]) + self.sock2apifds = [] + + + def update_client_events(self): + # For simplicity of tracking distinct QMP cmds and their passed FDs + # we don't try to support "pipelining", only a single cmd may be + # inflight + if len(self.api2sock) > 0: + events = libvirt.VIR_EVENT_HANDLE_WRITABLE + else: + events = libvirt.VIR_EVENT_HANDLE_READABLE + + libvirt.virEventUpdateHandle(self.clientwatch, events) + + + def update_server_events(self): + if self.clientsock is not None: + libvirt.virEventUpdateHandle(self.serverwatch, 0) + else: + libvirt.virEventUpdateHandle(self.serverwatch, + libvirt.VIR_EVENT_HANDLE_READABLE) + + + def try_command(self): + try: + cmdstr = self.sock2api.decode("utf-8") + cmd = json.loads(cmdstr) + + if self.verbose: + cmdstr = cmdstr.strip() + print(cmdstr) + except Exception as ex: + if debug: + print("Incomplete %s: %s" % ( self.sock2api, ex)) + return + + id = None + if "id" in cmd: + id = cmd["id"] + del cmd["id"] + + if cmd.get("execute", "") == "qmp_capabilities": + resobj = { + "return": {}, + } + resfds = [] + else: + if hasattr(libvirt_qemu, "qemuMonitorCommandWithFiles"): + res, resfds = libvirt_qemu.qemuMonitorCommandWithFiles( + self.dom, json.dumps(cmd), [f.fileno() for f in self.sock2apifds]) + resobj = json.loads(res) + else: + if len(self.sock2apifds) > 0: + raise Exception("FD passing not supported") + res = libvirt_qemu.qemuMonitorCommand( + self.dom, json.dumps(cmd)) + resfds = [] + resobj = json.loads(res) + + if "id" in resobj: + del resobj["id"] + if id is not None: + resobj["id"] = id + + res = json.dumps(resobj) + if self.verbose: + print(res) + res += "\r\n" + + self.sock2api = bytes([]) + self.sock2apifds = [] + self.api2sock += res.encode("utf-8") + self.api2sockfds = resfds + + + @staticmethod + def handle_client_io(watch, fd, events, self): + error = False + try: + if events & libvirt.VIR_EVENT_HANDLE_WRITABLE: + done = self.send_with_fds(self.api2sock, self.api2sockfds) + if done > 0: + self.api2sock = self.api2sock[done:] + self.api2sockfds = [] + elif events & libvirt.VIR_EVENT_HANDLE_READABLE: + data, fds = self.recv_with_fds() + if len(data) == 0: + error = True + else: + self.sock2api += data + if len(fds): + self.sock2apifds += fds + + self.try_command() + else: + error = True + except Exception as e: + global debug + if debug: + print("%s: %s" % (sys.argv[0], str(e))) + print(traceback.format_exc()) + error = True + + if error: + self.remove_client() + else: + self.update_client_events() + + + @staticmethod + def handle_server_io(watch, fd, events, self): + if self.clientsock is None: + sock, addr = self.serversock.accept() + self.add_client(sock) + else: + self.update_server_events() + + +def parse_commandline(): + parser = argparse.ArgumentParser(description="Libvirt QMP proxy") + parser.add_argument("--connect", "-c", + help="Libvirt QEMU driver connection URI") + parser.add_argument("--debug", "-d", action='store_true', + help="Display debugging information") + parser.add_argument("--verbose", "-v", action='store_true', + help="Display QMP traffic") + parser.add_argument("domain", metavar="DOMAIN", + help="Libvirt guest domain ID/UUID/Name") + parser.add_argument("sockpath", metavar="QMP-SOCK-PATH", + help="UNIX socket path for QMP server") + + return parser.parse_args() + + +def main(): + args = parse_commandline() + global debug + debug = args.debug + + if not debug: + libvirt.registerErrorHandler(lambda opaque, error: None, None) + + libvirt.virEventRegisterDefaultImpl() + + conn, dom = get_domain(args.connect, args.domain) + + if conn.getType() != "QEMU": + raise Exception("QMP proxy requires a QEMU driver connection not %s" % + conn.getType()) + + sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) + if os.path.exists(args.sockpath): + os.unlink(args.sockpath) + sock.bind(args.sockpath) + sock.listen(1) + + proxy = QMPProxy(conn, dom, sock, args.verbose) + + while True: + libvirt.virEventRunDefaultImpl() + + +try: + main() + sys.exit(0) +except Exception as e: + print("%s: %s" % (sys.argv[0], str(e))) + if debug: + print(traceback.format_exc()) + sys.exit(1) -- 2.37.3

3 6

[PATCH] spec: Remove extra blank lines
by Jim Fehlig 06 Dec '22

06 Dec '22

The spec file contains inconsistent use of blank lines. While trying to make significant changes to the file, I found it hurts both readability and maintainability. Remove blank lines that interrupt the overall flow and consistency. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- libvirt.spec.in | 91 ------------------------------------------------- 1 file changed, 91 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index d07a43c721..562baea52e 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -138,7 +138,6 @@ %define with_netcf 0%{!?_without_netcf:1} %endif - # fuse is used to provide virtualized /proc for LXC %if %{with_lxc} %define with_fuse 0%{!?_without_fuse:1} @@ -258,7 +257,6 @@ Obsoletes: libvirt-daemon-uml <= 5.0.0 Requires: libvirt-daemon-driver-vbox = %{version}-%{release} %endif Requires: libvirt-daemon-driver-nwfilter = %{version}-%{release} - Requires: libvirt-daemon-driver-interface = %{version}-%{release} Requires: libvirt-daemon-driver-secret = %{version}-%{release} Requires: libvirt-daemon-driver-storage = %{version}-%{release} @@ -358,33 +356,25 @@ BuildRequires: libwsman-devel >= 2.6.3 BuildRequires: audit-libs-devel # we need /usr/sbin/dtrace BuildRequires: systemtap-sdt-devel - # For mount/umount in FS driver BuildRequires: util-linux # For showmount in FS driver (netfs discovery) BuildRequires: nfs-utils - # Fedora build root suckage BuildRequires: gawk - # For storage wiping with different algorithms BuildRequires: scrub - %if %{with_numad} BuildRequires: numad %endif - %if %{with_wireshark} BuildRequires: wireshark-devel %endif - %if %{with_libssh} BuildRequires: libssh-devel >= 0.8.1 %endif - BuildRequires: rpcgen BuildRequires: libtirpc-devel - # Needed for the firewalld_reload macro %if %{with_firewalld_zone} BuildRequires: firewalld-filesystem @@ -404,7 +394,6 @@ BuildRequires: mingw32-portablexdr BuildRequires: mingw32-dlfcn BuildRequires: mingw32-libssh2 BuildRequires: mingw32-curl - BuildRequires: mingw64-filesystem BuildRequires: mingw64-gcc BuildRequires: mingw64-binutils @@ -440,28 +429,23 @@ Summary: Server side daemon and supporting files for libvirt library # The client side, i.e. shared libs are in a subpackage Requires: libvirt-libs = %{version}-%{release} - # The libvirt-guests.sh script requires virsh from libvirt-client subpackage, # but not every deployment wants to use libvirt-guests service. Using # Recommends here will install libvirt-client by default (if available), but # RPM won't complain if the package is unavailable, masked, or removed later. Recommends: libvirt-client = %{version}-%{release} - # netcat is needed on the server side so that clients that have # libvirt < 6.9.0 can connect, but newer versions will prefer # virt-ssh-helper. Making this a Recommends means that it gets # installed by default, but can still be removed if compatibility # with old clients is not required Recommends: /usr/bin/nc - # for modprobe of pci devices Requires: module-init-tools - # for /sbin/ip Requires: iproute # for /sbin/tc Requires: iproute-tc - Requires: polkit >= 0.112 %if %{with_dmidecode} # For virConnectGetSysinfo @@ -523,7 +507,6 @@ The network driver plugin for the libvirtd daemon, providing an implementation of the virtual network APIs using the Linux bridge capabilities. - %package daemon-driver-nwfilter Summary: Nwfilter driver plugin for the libvirtd daemon Requires: libvirt-daemon = %{version}-%{release} @@ -536,7 +519,6 @@ The nwfilter driver plugin for the libvirtd daemon, providing an implementation of the firewall APIs using the ebtables, iptables and ip6tables capabilities - %package daemon-driver-nodedev Summary: Nodedev driver plugin for the libvirtd daemon Requires: libvirt-daemon = %{version}-%{release} @@ -551,7 +533,6 @@ The nodedev driver plugin for the libvirtd daemon, providing an implementation of the node device APIs using the udev capabilities. - %package daemon-driver-interface Summary: Interface driver plugin for the libvirtd daemon Requires: libvirt-daemon = %{version}-%{release} @@ -604,7 +585,6 @@ Requires: lvm2 The storage driver backend adding implementation of the storage APIs for block volumes using lvm. - %package daemon-driver-storage-disk Summary: Storage driver plugin for disk Requires: libvirt-daemon-driver-storage-core = %{version}-%{release} @@ -616,7 +596,6 @@ Requires: device-mapper The storage driver backend adding implementation of the storage APIs for block volumes using the host disks. - %package daemon-driver-storage-scsi Summary: Storage driver plugin for local scsi devices Requires: libvirt-daemon-driver-storage-core = %{version}-%{release} @@ -626,7 +605,6 @@ Requires: libvirt-libs = %{version}-%{release} The storage driver backend adding implementation of the storage APIs for scsi host devices. - %package daemon-driver-storage-iscsi Summary: Storage driver plugin for iscsi Requires: libvirt-daemon-driver-storage-core = %{version}-%{release} @@ -637,7 +615,6 @@ Requires: iscsi-initiator-utils The storage driver backend adding implementation of the storage APIs for iscsi volumes using the host iscsi stack. - %if %{with_storage_iscsi_direct} %package daemon-driver-storage-iscsi-direct Summary: Storage driver plugin for iscsi-direct @@ -649,7 +626,6 @@ The storage driver backend adding implementation of the storage APIs for iscsi volumes using libiscsi direct connection. %endif - %package daemon-driver-storage-mpath Summary: Storage driver plugin for multipath volumes Requires: libvirt-daemon-driver-storage-core = %{version}-%{release} @@ -660,7 +636,6 @@ Requires: device-mapper The storage driver backend adding implementation of the storage APIs for multipath storage using device mapper. - %if %{with_storage_gluster} %package daemon-driver-storage-gluster Summary: Storage driver plugin for gluster @@ -678,7 +653,6 @@ The storage driver backend adding implementation of the storage APIs for gluster volumes using libgfapi. %endif - %if %{with_storage_rbd} %package daemon-driver-storage-rbd Summary: Storage driver plugin for rbd @@ -690,7 +664,6 @@ The storage driver backend adding implementation of the storage APIs for rbd volumes using the ceph protocol. %endif - %if %{with_storage_zfs} %package daemon-driver-storage-zfs Summary: Storage driver plugin for ZFS @@ -705,7 +678,6 @@ The storage driver backend adding implementation of the storage APIs for ZFS volumes. %endif - %package daemon-driver-storage Summary: Storage driver plugin including all backends for the libvirtd daemon Requires: libvirt-daemon-driver-storage-core = %{version}-%{release} @@ -732,7 +704,6 @@ The storage driver plugin for the libvirtd daemon, providing an implementation of the storage APIs using LVM, iSCSI, parted and more. - %if %{with_qemu} %package daemon-driver-qemu Summary: QEMU driver plugin for the libvirtd daemon @@ -753,7 +724,6 @@ an implementation of the hypervisor driver APIs using QEMU %endif - %if %{with_lxc} %package daemon-driver-lxc Summary: LXC driver plugin for the libvirtd daemon @@ -769,7 +739,6 @@ an implementation of the hypervisor driver APIs using the Linux kernel %endif - %if %{with_vbox} %package daemon-driver-vbox Summary: VirtualBox driver plugin for the libvirtd daemon @@ -782,7 +751,6 @@ an implementation of the hypervisor driver APIs using VirtualBox %endif - %if %{with_libxl} %package daemon-driver-libxl Summary: Libxl driver plugin for the libvirtd daemon @@ -796,8 +764,6 @@ an implementation of the hypervisor driver APIs using Libxl %endif - - %if %{with_qemu_tcg} %package daemon-qemu Summary: Server side daemon & driver required to run QEMU guests @@ -817,7 +783,6 @@ Server side daemon and driver required to manage the virtualization capabilities of the QEMU TCG emulators %endif - %if %{with_qemu_kvm} %package daemon-kvm Summary: Server side daemon & driver required to run KVM guests @@ -837,7 +802,6 @@ Server side daemon and driver required to manage the virtualization capabilities of the KVM hypervisor %endif - %if %{with_lxc} %package daemon-lxc Summary: Server side daemon & driver required to run LXC guests @@ -856,7 +820,6 @@ Server side daemon and driver required to manage the virtualization capabilities of LXC %endif - %if %{with_libxl} %package daemon-xen Summary: Server side daemon & driver required to run XEN guests @@ -998,7 +961,6 @@ MinGW Windows libvirt virtualization library. %endif %prep - %autosetup -S git_am %build @@ -1152,7 +1114,6 @@ exit 1 %define who %{?packager}%{!?packager:Unknown} %define arg_packager -Dpackager="%{who}, %{when}, %{where}" %define arg_packager_version -Dpackager_version="%{release}" - %define arg_selinux_mount -Dselinux_mount="/sys/fs/selinux" # place macros above and build commands below this comment @@ -1396,7 +1357,6 @@ rm -rf $RPM_BUILD_ROOT%{mingw64_libexecdir}/libvirt-guests.sh %endif - %check # Building on slow archs, like emulated s390x in Fedora copr, requires # raising the test timeout @@ -1435,7 +1395,6 @@ fi \ # libvirtd. The uid number is irrelevant, so we use dynamic allocation # described at the above link. getent group libvirt >/dev/null || groupadd -r libvirt - exit 0 %post daemon @@ -1446,14 +1405,11 @@ exit 0 %else %libvirt_daemon_systemd_post_inet libvirtd %endif - %systemd_post libvirt-guests.service - %libvirt_daemon_schedule_restart libvirtd %preun daemon %systemd_preun libvirt-guests.service - %libvirt_daemon_systemd_preun_inet libvirtd %libvirt_daemon_systemd_preun_inet virtproxyd %libvirt_daemon_systemd_preun_priv virtlogd @@ -1499,7 +1455,6 @@ then /bin/systemctl start libvirtd.service >/dev/null 2>&1 || : fi fi - %libvirt_daemon_finish_restart libvirtd %pre daemon-driver-network @@ -1591,7 +1546,6 @@ fi %libvirt_sysconfig_posttrans virtsecretd %libvirt_daemon_perform_restart virtsecretd - %pre daemon-driver-storage-core %libvirt_sysconfig_pre virtstoraged @@ -1608,7 +1562,6 @@ fi %libvirt_sysconfig_posttrans virtstoraged %libvirt_daemon_perform_restart virtstoraged - %if %{with_qemu} %pre daemon-driver-qemu %libvirt_sysconfig_pre virtqemud @@ -1640,7 +1593,6 @@ exit 0 %libvirt_daemon_perform_restart virtqemud %endif - %if %{with_lxc} %pre daemon-driver-lxc %libvirt_sysconfig_pre virtlxcd @@ -1659,7 +1611,6 @@ exit 0 %libvirt_daemon_perform_restart virtlxcd %endif - %if %{with_vbox} %post daemon-driver-vbox %if %{with_modular_daemons} @@ -1678,7 +1629,6 @@ exit 0 %libvirt_daemon_perform_restart virtvboxd %endif - %if %{with_libxl} %post daemon-driver-libxl %if %{with_modular_daemons} @@ -1697,7 +1647,6 @@ exit 0 %libvirt_daemon_perform_restart virtxend %endif - %post daemon-config-network if test $1 -eq 1 && test ! -f %{_sysconfdir}/libvirt/qemu/networks/default.xml ; then # see if the network used by default network creates a conflict, @@ -1773,7 +1722,6 @@ exit 0 %doc libvirt-docs/* %files daemon - %{_unitdir}/libvirtd.service %{_unitdir}/libvirtd.socket %{_unitdir}/libvirtd-ro.socket @@ -1800,25 +1748,19 @@ exit 0 %config(noreplace) %{_sysconfdir}/libvirt/virtlockd.conf %config(noreplace) %{_sysconfdir}/sasl2/libvirt.conf %config(noreplace) %{_prefix}/lib/sysctl.d/60-libvirtd.conf - %config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd %dir %{_datadir}/libvirt/ - %ghost %dir %{_rundir}/libvirt/ %ghost %dir %{_rundir}/libvirt/common/ - %dir %attr(0755, root, root) %{_localstatedir}/lib/libvirt/ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/images/ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/filesystems/ %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/boot/ %dir %attr(0711, root, root) %{_localstatedir}/cache/libvirt/ - - %dir %attr(0755, root, root) %{_libdir}/libvirt/ %dir %attr(0755, root, root) %{_libdir}/libvirt/connection-driver/ %dir %attr(0755, root, root) %{_libdir}/libvirt/lock-driver %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/lockd.so - %{_datadir}/augeas/lenses/libvirtd.aug %{_datadir}/augeas/lenses/tests/test_libvirtd.aug %{_datadir}/augeas/lenses/virtlogd.aug @@ -1831,23 +1773,17 @@ exit 0 %if %{with_qemu} %{_datadir}/augeas/lenses/tests/test_libvirt_lockd.aug %endif - %{_datadir}/polkit-1/actions/org.libvirt.unix.policy %{_datadir}/polkit-1/actions/org.libvirt.api.policy %{_datadir}/polkit-1/rules.d/50-libvirt.rules - %dir %attr(0700, root, root) %{_localstatedir}/log/libvirt/ - %attr(0755, root, root) %{_libexecdir}/libvirt_iohelper - %attr(0755, root, root) %{_bindir}/virt-ssh-helper - %attr(0755, root, root) %{_sbindir}/libvirtd %attr(0755, root, root) %{_sbindir}/virtproxyd %attr(0755, root, root) %{_sbindir}/virtlogd %attr(0755, root, root) %{_sbindir}/virtlockd %attr(0755, root, root) %{_libexecdir}/libvirt-guests.sh - %{_mandir}/man1/virt-admin.1* %{_mandir}/man1/virt-host-validate.1* %{_mandir}/man8/virt-ssh-helper.8* @@ -1856,7 +1792,6 @@ exit 0 %{_mandir}/man8/virtlogd.8* %{_mandir}/man8/virtlockd.8* %{_mandir}/man8/virtproxyd.8* - %{_bindir}/virt-host-validate %{_bindir}/virt-admin %{_datadir}/bash-completion/completions/virt-admin @@ -1903,7 +1838,6 @@ exit 0 %attr(0755, root, root) %{_libexecdir}/libvirt_leaseshelper %{_libdir}/libvirt/connection-driver/libvirt_driver_network.so %{_mandir}/man8/virtnetworkd.8* - %if %{with_firewalld_zone} %{_prefix}/lib/firewalld/zones/libvirt.xml %{_prefix}/lib/firewalld/zones/libvirt-routed.xml @@ -2165,7 +2099,6 @@ exit 0 %{_bindir}/virt-xml-validate %{_bindir}/virt-pki-query-dn %{_bindir}/virt-pki-validate - %{_datadir}/bash-completion/completions/virsh %if %{with_qemu} @@ -2187,17 +2120,13 @@ exit 0 %{_libdir}/libvirt-admin.so.* %dir %{_datadir}/libvirt/ %dir %{_datadir}/libvirt/schemas/ - %{_datadir}/systemtap/tapset/libvirt_probes*.stp %{_datadir}/systemtap/tapset/libvirt_functions.stp %if %{with_qemu} %{_datadir}/systemtap/tapset/libvirt_qemu_probes*.stp %endif - %{_datadir}/libvirt/schemas/*.rng - %{_datadir}/libvirt/cpu_map/*.xml - %{_datadir}/libvirt/test-screenshot.png %if %{with_wireshark} @@ -2245,7 +2174,6 @@ exit 0 %{_libdir}/pkgconfig/libvirt-admin.pc %{_libdir}/pkgconfig/libvirt-qemu.pc %{_libdir}/pkgconfig/libvirt-lxc.pc - %dir %{_datadir}/libvirt/api/ %{_datadir}/libvirt/api/libvirt-api.xml %{_datadir}/libvirt/api/libvirt-admin-api.xml @@ -2257,7 +2185,6 @@ exit 0 %dir %{mingw32_sysconfdir}/libvirt/ %config(noreplace) %{mingw32_sysconfdir}/libvirt/libvirt.conf %config(noreplace) %{mingw32_sysconfdir}/libvirt/libvirt-admin.conf - %{mingw32_bindir}/libvirt-0.dll %{mingw32_bindir}/virsh.exe %{mingw32_bindir}/virt-admin.exe @@ -2267,7 +2194,6 @@ exit 0 %{mingw32_bindir}/libvirt-lxc-0.dll %{mingw32_bindir}/libvirt-qemu-0.dll %{mingw32_bindir}/libvirt-admin-0.dll - %{mingw32_libdir}/libvirt.dll.a %{mingw32_libdir}/pkgconfig/libvirt.pc %{mingw32_libdir}/pkgconfig/libvirt-qemu.pc @@ -2276,23 +2202,17 @@ exit 0 %{mingw32_libdir}/libvirt-lxc.dll.a %{mingw32_libdir}/libvirt-qemu.dll.a %{mingw32_libdir}/libvirt-admin.dll.a - %dir %{mingw32_datadir}/libvirt/ %dir %{mingw32_datadir}/libvirt/schemas/ %{mingw32_datadir}/libvirt/schemas/*.rng - %dir %{mingw32_datadir}/libvirt/api/ %{mingw32_datadir}/libvirt/api/libvirt-api.xml %{mingw32_datadir}/libvirt/api/libvirt-lxc-api.xml %{mingw32_datadir}/libvirt/api/libvirt-qemu-api.xml %{mingw32_datadir}/libvirt/api/libvirt-admin-api.xml - %{mingw32_datadir}/libvirt/cpu_map/*.xml - %{mingw32_datadir}/libvirt/test-screenshot.png - %{mingw32_datadir}/locale/*/LC_MESSAGES/libvirt.mo - %dir %{mingw32_includedir}/libvirt %{mingw32_includedir}/libvirt/libvirt.h %{mingw32_includedir}/libvirt/libvirt-common.h @@ -2312,7 +2232,6 @@ exit 0 %{mingw32_includedir}/libvirt/libvirt-lxc.h %{mingw32_includedir}/libvirt/libvirt-qemu.h %{mingw32_includedir}/libvirt/libvirt-admin.h - %{mingw32_mandir}/man1/virsh.1* %{mingw32_mandir}/man1/virt-admin.1* %{mingw32_mandir}/man1/virt-xml-validate.1* @@ -2320,12 +2239,10 @@ exit 0 %{mingw32_mandir}/man1/virt-pki-validate.1* %{mingw32_mandir}/man7/virkey*.7* - %files -n mingw64-libvirt %dir %{mingw64_sysconfdir}/libvirt/ %config(noreplace) %{mingw64_sysconfdir}/libvirt/libvirt.conf %config(noreplace) %{mingw64_sysconfdir}/libvirt/libvirt-admin.conf - %{mingw64_bindir}/libvirt-0.dll %{mingw64_bindir}/virsh.exe %{mingw64_bindir}/virt-admin.exe @@ -2335,7 +2252,6 @@ exit 0 %{mingw64_bindir}/libvirt-lxc-0.dll %{mingw64_bindir}/libvirt-qemu-0.dll %{mingw64_bindir}/libvirt-admin-0.dll - %{mingw64_libdir}/libvirt.dll.a %{mingw64_libdir}/pkgconfig/libvirt.pc %{mingw64_libdir}/pkgconfig/libvirt-qemu.pc @@ -2344,23 +2260,17 @@ exit 0 %{mingw64_libdir}/libvirt-lxc.dll.a %{mingw64_libdir}/libvirt-qemu.dll.a %{mingw64_libdir}/libvirt-admin.dll.a - %dir %{mingw64_datadir}/libvirt/ %dir %{mingw64_datadir}/libvirt/schemas/ %{mingw64_datadir}/libvirt/schemas/*.rng - %dir %{mingw64_datadir}/libvirt/api/ %{mingw64_datadir}/libvirt/api/libvirt-api.xml %{mingw64_datadir}/libvirt/api/libvirt-lxc-api.xml %{mingw64_datadir}/libvirt/api/libvirt-qemu-api.xml %{mingw64_datadir}/libvirt/api/libvirt-admin-api.xml - %{mingw64_datadir}/libvirt/cpu_map/*.xml - %{mingw64_datadir}/libvirt/test-screenshot.png - %{mingw64_datadir}/locale/*/LC_MESSAGES/libvirt.mo - %dir %{mingw64_includedir}/libvirt %{mingw64_includedir}/libvirt/libvirt.h %{mingw64_includedir}/libvirt/libvirt-common.h @@ -2380,7 +2290,6 @@ exit 0 %{mingw64_includedir}/libvirt/libvirt-lxc.h %{mingw64_includedir}/libvirt/libvirt-qemu.h %{mingw64_includedir}/libvirt/libvirt-admin.h - %{mingw64_mandir}/man1/virsh.1* %{mingw64_mandir}/man1/virt-admin.1* %{mingw64_mandir}/man1/virt-xml-validate.1* -- 2.38.1

2 1

[libvirt PATCH 0/2] examples: Install amd-sev-es-vmsa.stp
by Andrea Bolognani 06 Dec '22

06 Dec '22

Andrea Bolognani (2): examples: Sort list examples: Install amd-sev-es-vmsa.stp examples/systemtap/meson.build | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) -- 2.38.1

2 3

[PATCH v2 0/2] qemu: refresh state after reset
by Kristina Hanicova 06 Dec '22

06 Dec '22

v1: https://listman.redhat.com/archives/libvir-list/2022-November/235913.html diff to v1: * calling refresh state unconditionally (suggested by Martin) * improved commit message Kristina Hanicova (2): qemu: refresh internal domain state after reset qemu: refresh state after reboot initiated from the guest src/qemu/qemu_domain.c | 1 + src/qemu/qemu_domain.h | 1 + src/qemu/qemu_driver.c | 19 +++++++++++++++++++ src/qemu/qemu_process.c | 2 ++ 4 files changed, 23 insertions(+) -- 2.38.1

2 3

[PATCH 0/7] qemu: support updating device's bootindex
by Jiang Jiacheng 06 Dec '22

06 Dec '22

Support updating device's(support cdrom, disk and network) bootindex online in virDomainUpdateDeviceFlags. The new bootindex will take effect after guest rebooting. Enable bootindex can be set to 0, it means cancel the device's bootindex. To use this feature, we need to get the device's xml first and modify the boot order in the xml, then use 'virsh update-device <domain> <xml> --flag' to update the bootindex. Note that the flag should be --config or --persistent if the vm is running. diff to v1: * add a bool bootIndexSpecified in device info to indicates that the bootorder of the device can be set. * use boot order = '0' to cancel the previous bootorder instead of '-1' Jiang Jiacheng (7): qemu: Introduce qemuDomainChangeBootIndex API qemu: Add bootIndexSpecified and support set bootIndex to '0' qemu: Introduce qemuCheckBootIndex and qemuChangeDiskBootIndex API qemu: Support update disk's bootindex qemu: Support update net's bootindex qemu: Support add bootindex = 0 to boothash when its bootIndexSpecified is true qemu: Reserve bootIndexSpecified when update device src/conf/device_conf.h | 3 + src/conf/domain_conf.c | 9 ++- src/conf/domain_postparse.c | 8 +- src/qemu/qemu_conf.c | 140 +++++++++++++++++++++++++++++++++++ src/qemu/qemu_conf.h | 16 ++++ src/qemu/qemu_domain.c | 3 +- src/qemu/qemu_driver.c | 35 +++++++++ src/qemu/qemu_hotplug.c | 17 +++-- src/qemu/qemu_monitor.c | 20 +++++ src/qemu/qemu_monitor.h | 6 ++ src/qemu/qemu_monitor_json.c | 33 +++++++++ src/qemu/qemu_monitor_json.h | 6 ++ 12 files changed, 286 insertions(+), 10 deletions(-) -- 2.33.0

2 21

Re: Call for FOSDEM presentations on QEMU, KVM, and rust-vmm
by Kashyap Chamarthy 05 Dec '22

05 Dec '22

(Cc also: libvirt upstream maling list) Gentle reminder ... tl;dr: please submit the proposals by *10th Dec 2022* On Tue, Nov 08, 2022 at 10:45:33AM -0500, Stefan Hajnoczi wrote: > Hi, > The yearly FOSDEM open source conference is now accepting talk > proposals. FOSDEM '23 will be held in Brussels, Belgium on 4 & 5 > February. > > FOSDEM is a huge free conference about all things open source and an > opportunity for anyone to present QEMU or KVM topics. Both in-person > and pre-recorded talks are being accepted this year. > > Please consider submitting your talks to the following devrooms: > > Emulator Development Room: > https://blackbeard334.github.io/fosdem23-emulator-devroom-cfp/ > > Virtualization and IaaS devroom: > https://fosdem.org/2023/schedule/track/virtualization_and_iaas/ > > Rust devroom: > https://rust-fosdem.github.io/ (I've re-posted the official announcement[0] along the way, I manually fixed the broken text formatting, a URL, and moved the "important dates" section to the top. [0] https://lists.fosdem.org/pipermail/fosdem/2022q4/003473.html) ----------------------------------------------------------------------- We are excited to announce that the call for proposals is now open for the Virtualization & IaaS devroom at the upcoming FOSDEM 2023, to be hosted on February 4th 2023. This devroom is a collaborative effort, and is organized by dedicated folks from projects such as OpenStack, Xen Project, KubeVirt, QEMU, KVM, and Foreman. We would like to invite all those who are involved in these fields to submit your proposals by December 10th, 2022. Important Dates --------------- Submission deadline: 10th December 2022 Acceptance notifications: 15th December 2022 Final schedule announcement: 20th December 2022 Conference devroom: first half of 4th February 2023 About the Devroom ----------------- The Virtualization & IaaS devroom will feature session topics such as open source hypervisors or virtual machine managers such as Xen Project, KVM, bhyve and VirtualBox as well as Infrastructure-as-a-Service projects such as KubeVirt, Apache CloudStack, OpenStack, QEMU and OpenNebula. This devroom will host presentations that focus on topics of shared interest, such as KVM; libvirt; shared storage; virtualized networking; cloud security; clustering and high availability; interfacing with multiple hypervisors; hyperconverged deployments; and scaling across hundreds or thousands of servers. Presentations in this devroom will be aimed at developers working on these platforms who are looking to collaborate and improve shared infrastructure or solve common problems. We seek topics that encourage dialog between projects and continued work post-FOSDEM. Submit Your Proposal -------------------- All submissions must be made via the Pentabarf event planning site[1]. If you have not used Pentabarf before, you will need to create an account. If you submitted proposals for FOSDEM in previous years, you can use your existing account. After creating the account, select Create Event to start the submission process. Make sure to select Virtualization and IaaS devroom from the Track list. Please fill out all the required fields, and provide a meaningful abstract and description of your proposed session. Submission Guidelines --------------------- We expect more proposals than we can possibly accept, so it is vitally important that you submit your proposal on or before the deadline. Late submissions are unlikely to be considered. All presentation slots are 30 minutes, with 20 minutes planned for presentations, and 10 minutes for Q&A. All presentations will be recorded and made available under Creative Commons licenses. In the Submission notes field, please indicate that you agree that your presentation will be licensed under the CC-By-SA-4.0 or CC-By-4.0 license and that you agree to have your presentation recorded. For example: "If my presentation is accepted for FOSDEM, I hereby agree to license all recordings, slides, and other associated materials under the Creative Commons Attribution Share-Alike 4.0 International License. Sincerely, <NAME>." In the Submission notes field, please also confirm that if your talk is accepted, you will be able to attend FOSDEM and deliver your presentation. We will not consider proposals from prospective speakers who are unsure whether they will be able to secure funds for travel and lodging to attend FOSDEM. (Sadly, we are not able to offer travel funding for prospective speakers.) Submission Guidelines --------------------- Mentored presentations will have 25-minute slots, where 20 minutes will include the presentation and 5 minutes will be reserved for questions. The number of newcomer session slots is limited, so we will probably not be able to accept all applications. You must submit your talk and abstract to apply for the mentoring program, our mentors are volunteering their time and will happily provide feedback but won't write your presentation for you! If you are experiencing problems with Pentabarf, the proposal submission interface, or have other questions, you can email our devroom mailing list[2] and we will try to help you. How to Apply ------------ In addition to agreeing to video recording and confirming that you can attend FOSDEM in case your session is accepted, please write "speaker mentoring program application" in the "Submission notes" field, and list any prior speaking experience or other relevant information for your application. Code of Conduct --------------- Following the release of the updated code of conduct for FOSDEM, we'd like to remind all speakers and attendees that all of the presentations and discussions in our devroom are held under the guidelines set in the CoC and we expect attendees, speakers, and volunteers to follow the CoC at all times. If you submit a proposal and it is accepted, you will be required to confirm that you accept the FOSDEM CoC. If you have any questions about the CoC or wish to have one of the devroom organizers review your presentation slides or any other content for CoC compliance, please email us and we will do our best to assist you. Call for Volunteers ------------------- We are also looking for volunteers to help run the devroom. We need assistance watching time for the speakers, and helping with video for the devroom. Please contact devroom mailing list[2] for more information. Questions? ---------- If you have any questions about this devroom, please send your questions to our devroom mailing list. You can also subscribe to the list to receive updates about important dates, session announcements, and to connect with other attendees. See you all at FOSDEM! [1] https://penta.fosdem.org/submission [2] iaas-virt-devroom at lists.fosdem.org ----------------------------------------------------------------------- -- /kashyap

1 0

[PATCH 0/4] qemu: Init ext devices paths on reconnect
by Michal Privoznik 05 Dec '22

05 Dec '22

*** BLURB HERE *** Michal Prívozník (4): qemu_process: Document qemuProcessPrepare{Domain,Host}() order qemu_extdevice: Init paths in qemuExtDevicesPrepareDomain() qemu_extdevice: Expose qemuExtDevicesInitPaths() qemu: Init ext devices paths on reconnect src/qemu/qemu_extdevice.c | 8 ++++---- src/qemu/qemu_extdevice.h | 5 +++++ src/qemu/qemu_process.c | 7 +++++++ 3 files changed, 16 insertions(+), 4 deletions(-) -- 2.37.4

2 5

[PATCH 0/7] Sanitize logic to get live/config device definitions for unplug/update
by Peter Krempa 05 Dec '22

05 Dec '22

Convert code *DomainUpdateDeviceFlags/*DomainDetachDeviceLiveAndConfig to avoid use of virDomainDeviceDefCopy. We have the original XML string from the user so it doesn't make sense to parse it and then copy it (whcih involves formatting and parsing back), when we can simply parse it twice, saving the extra formatting step. Peter Krempa (7): qemu: driver: Fix formatting of function headers around qemuDomainAttachDevice qemuDomainUpdateDeviceFlags: Parse XML twice rather than use virDomainDeviceDefCopy qemuDomainDetachDeviceLiveAndConfig: Parse XML twice rather than use virDomainDeviceDefCopy qemuDomainDetachDeviceLiveAndConfig: Refactor cleanup lxcDomainAttachDeviceFlags: Parse XML twice rather than use virDomainDeviceDefCopy lxcDomainDetachDeviceFlags: Parse XML twice rather than use virDomainDeviceDefCopy conf: domain: Remove virDomainDeviceDefCopy src/conf/domain_conf.c | 121 --------------------------------------- src/conf/domain_conf.h | 4 -- src/libvirt_private.syms | 1 - src/lxc/lxc_driver.c | 75 ++++++++++-------------- src/qemu/qemu_driver.c | 97 +++++++++++++------------------ 5 files changed, 70 insertions(+), 228 deletions(-) -- 2.37.3

2 8

[PATCH v3] qemu: Don't report spurious errors from vCPU tid validation on hotunplug timeout
by Peter Krempa 05 Dec '22

05 Dec '22

From: Shaleen Bathla <shaleen.bathla(a)oracle.com> Use of qemuDomainValidateVcpuInfo in the helpers for hotplug and unplug of vCPUs can lead to spurious errors reported such as: internal error: qemu didn't report thread id for vcpu 'XX'" The reason for this is that qemuDomainValidateVcpuInfo validates the state of all vCPUs against the expected state of vCPUs. If an unplug operation completed before libvirt was unable to process it yet the expected state could not reflect the current state. To avoid spurious errors the qemuDomainHotplugAddVcpu and qemuDomainRemoveVcpu functions are modified to do localized validation only for the vCPUs they actually modify. We also now ensure that the cgroups are modified before bailing out on error for any vCPUs which passed validation. Additionally in order for qemuDomainRemoveVcpuAlias to be able to find the unplugged vCPU we must ensure that qemuDomainRefreshVcpuInfo does not clear out the alias in case when the vCPU is no longer reported by qemu. Co-authored-by: Partha Satapathy <partha.satapathy(a)oracle.com> Signed-off-by: Shaleen Bathla <shaleen.bathla(a)oracle.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- v3 addresses my review feedback of the original patch, as well as rewrites the commit message for more clarity. src/qemu/qemu_domain.c | 6 +++-- src/qemu/qemu_hotplug.c | 53 ++++++++++++++++++++++++----------------- 2 files changed, 35 insertions(+), 24 deletions(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index ef1a9c8c74..64ebec626c 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -9795,8 +9795,10 @@ qemuDomainRefreshVcpuInfo(virDomainObj *vm, vcpupriv->vcpus = info[i].vcpus; VIR_FREE(vcpupriv->type); vcpupriv->type = g_steal_pointer(&info[i].type); - VIR_FREE(vcpupriv->alias); - vcpupriv->alias = g_steal_pointer(&info[i].alias); + if (info[i].alias) { + VIR_FREE(vcpupriv->alias); + vcpupriv->alias = g_steal_pointer(&info[i].alias); + } virJSONValueFree(vcpupriv->props); vcpupriv->props = g_steal_pointer(&info[i].props); vcpupriv->enable_id = info[i].id; diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index da92ced2f4..6e300f547c 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -6088,38 +6088,37 @@ qemuDomainRemoveVcpu(virDomainObj *vm, qemuDomainVcpuPrivate *vcpupriv = QEMU_DOMAIN_VCPU_PRIVATE(vcpuinfo); int oldvcpus = virDomainDefGetVcpus(vm->def); unsigned int nvcpus = vcpupriv->vcpus; - virErrorPtr save_error = NULL; size_t i; + ssize_t offlineVcpuWithTid = -1; if (qemuDomainRefreshVcpuInfo(vm, VIR_ASYNC_JOB_NONE, false) < 0) return -1; - /* validation requires us to set the expected state prior to calling it */ for (i = vcpu; i < vcpu + nvcpus; i++) { vcpuinfo = virDomainDefGetVcpu(vm->def, i); - vcpuinfo->online = false; + vcpupriv = QEMU_DOMAIN_VCPU_PRIVATE(vcpuinfo); + + if (vcpupriv->tid == 0) { + vcpuinfo->online = false; + /* Clear the alias as VCPU is now unplugged */ + VIR_FREE(vcpupriv->alias); + ignore_value(virCgroupDelThread(priv->cgroup, VIR_CGROUP_THREAD_VCPU, i)); + } else { + if (offlineVcpuWithTid == -1) + offlineVcpuWithTid = i; + } } - if (qemuDomainValidateVcpuInfo(vm) < 0) { - /* rollback vcpu count if the setting has failed */ + if (offlineVcpuWithTid != -1) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("qemu reported thread id for inactive vcpu '%zu'"), + offlineVcpuWithTid); virDomainAuditVcpu(vm, oldvcpus, oldvcpus - nvcpus, "update", false); - - for (i = vcpu; i < vcpu + nvcpus; i++) { - vcpuinfo = virDomainDefGetVcpu(vm->def, i); - vcpuinfo->online = true; - } return -1; } virDomainAuditVcpu(vm, oldvcpus, oldvcpus - nvcpus, "update", true); - virErrorPreserveLast(&save_error); - - for (i = vcpu; i < vcpu + nvcpus; i++) - ignore_value(virCgroupDelThread(priv->cgroup, VIR_CGROUP_THREAD_VCPU, i)); - - virErrorRestore(&save_error); - return 0; } @@ -6141,6 +6140,9 @@ qemuDomainRemoveVcpuAlias(virDomainObj *vm, return; } } + + VIR_DEBUG("vcpu '%s' not found in vcpulist of domain '%s'", + alias, vm->def->name); } @@ -6209,6 +6211,7 @@ qemuDomainHotplugAddVcpu(virQEMUDriver *driver, int rc; int oldvcpus = virDomainDefGetVcpus(vm->def); size_t i; + bool vcpuTidMissing = false; if (!qemuDomainSupportsNewVcpuHotplug(vm)) { virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", @@ -6238,20 +6241,26 @@ qemuDomainHotplugAddVcpu(virQEMUDriver *driver, if (qemuDomainRefreshVcpuInfo(vm, VIR_ASYNC_JOB_NONE, false) < 0) return -1; - /* validation requires us to set the expected state prior to calling it */ for (i = vcpu; i < vcpu + nvcpus; i++) { vcpuinfo = virDomainDefGetVcpu(vm->def, i); vcpupriv = QEMU_DOMAIN_VCPU_PRIVATE(vcpuinfo); vcpuinfo->online = true; - if (vcpupriv->tid > 0 && - qemuProcessSetupVcpu(vm, i, true) < 0) - return -1; + if (vcpupriv->tid > 0) { + if (qemuProcessSetupVcpu(vm, i, true) < 0) { + return -1; + } + } else { + vcpuTidMissing = true; + } } - if (qemuDomainValidateVcpuInfo(vm) < 0) + if (vcpuTidMissing && qemuDomainHasVcpuPids(vm)) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("qemu didn't report thread id for vcpu '%zu'"), i); return -1; + } qemuDomainVcpuPersistOrder(vm->def); -- 2.37.3

3 3

[PATCH 0/3] qemu_tpm: Set log file label on migration
by Michal Privoznik 02 Dec '22

02 Dec '22

See 3/3 for explanation. Michal Prívozník (3): security: Extend TPM label APIs qemu_tpm: Extend start/stop APIs qemu_tpm: Set log file label on migration src/qemu/qemu_security.c | 13 +++++++---- src/qemu/qemu_security.h | 4 +++- src/qemu/qemu_tpm.c | 22 +++++++++--------- src/security/security_driver.h | 6 +++-- src/security/security_manager.c | 10 +++++---- src/security/security_manager.h | 6 +++-- src/security/security_selinux.c | 40 +++++++++++++++++++++------------ src/security/security_stack.c | 12 +++++----- 8 files changed, 71 insertions(+), 42 deletions(-) -- 2.37.4

2 4

[PATCH 00/13] virsh: Don't reimplement virXPathNodeSet
by Peter Krempa 02 Dec '22

02 Dec '22

This series converts open-coded virXPathNodeSet to the proper helper use and also adds --print-xml option to commands using xmlXpathEval which didn't have it. Peter Krempa (13): virsh: Add --print-xml option for 'detach-interface' virshDomainDetachInterface: Use virXPathNodeSet instead of xmlXpathEval virsh: Add --print-xml option for 'domif-setlink' virsh: cmdDomIfSetLink: Use virXPathNodeSet instead of xmlXpathEval virsh: Refactor cleanup in 'cmdVolClone' virsh: Add --print-xml flag for 'vol-clone' command virsh: virshMakeCloneXML: Use virXPathNode instead of xmlXPathEval virsh: cmdDetachDisk: Refactor cleanup virsh: cmdChangeMedia: Refactor cleanup virshFindDisk: Use virXPathNodeSet instead of xmlXPathEval virshFindDisk: Sanitize removable media check util: xml: Introduce virXMLNodeGetSubelement virshFindDisk: Sanitize use of 'tmp' variable docs/manpages/virsh.rst | 15 +- src/libvirt_private.syms | 1 + src/util/virxml.c | 23 +++ src/util/virxml.h | 5 + tools/virsh-domain.c | 298 ++++++++++++++++++--------------------- tools/virsh-volume.c | 61 ++++---- 6 files changed, 207 insertions(+), 196 deletions(-) -- 2.38.1

2 16

[PATCH] spec: Remove use of %{name} macro
by Jim Fehlig 02 Dec '22

02 Dec '22

The spec file uses both "libvirt" and "%{name}", but in reality the expanded value of %{name} will never change. Drop the macro in favor of the explicit and more readable "libvirt". Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- libvirt.spec.in | 66 ++++++++++++++++++++++++------------------------- 1 file changed, 33 insertions(+), 33 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index fa94cda3c5..d07a43c721 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -439,13 +439,13 @@ Summary: Server side daemon and supporting files for libvirt library # for subpackages are listed later in those subpackages) # The client side, i.e. shared libs are in a subpackage -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} # The libvirt-guests.sh script requires virsh from libvirt-client subpackage, # but not every deployment wants to use libvirt-guests service. Using # Recommends here will install libvirt-client by default (if available), but # RPM won't complain if the package is unavailable, masked, or removed later. -Recommends: %{name}-client = %{version}-%{release} +Recommends: libvirt-client = %{version}-%{release} # netcat is needed on the server side so that clients that have # libvirt < 6.9.0 can connect, but newer versions will prefer @@ -896,7 +896,7 @@ capabilities of VirtualBox %package client Summary: Client side utilities of the libvirt library -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} # Needed by virt-pki-validate script. Requires: gnutls-utils @@ -909,7 +909,7 @@ capabilities of recent versions of Linux (and other OSes). %package client-qemu Summary: Additional client side utilities for QEMU -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} Requires: python3-libvirt >= 3.7.0 %description client-qemu @@ -931,7 +931,7 @@ Shared libraries for accessing the libvirt daemon. %package wireshark Summary: Wireshark dissector plugin for libvirt RPC transactions Requires: wireshark -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} %description wireshark Wireshark dissector plugin for better analysis of libvirt RPC traffic. @@ -940,7 +940,7 @@ Wireshark dissector plugin for better analysis of libvirt RPC traffic. %if %{with_lxc} %package login-shell Summary: Login shell for connecting users to an LXC container -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} %description login-shell Provides the set-uid virt-login-shell binary that is used to @@ -950,7 +950,7 @@ namespaces. %package devel Summary: Libraries, includes, etc. to compile with the libvirt library -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} Requires: pkgconfig %description devel @@ -962,8 +962,8 @@ Summary: Sanlock lock manager plugin for QEMU driver Requires: sanlock >= 2.4 #for virt-sanlock-cleanup require augeas Requires: augeas -Requires: %{name}-daemon = %{version}-%{release} -Requires: %{name}-libs = %{version}-%{release} +Requires: libvirt-daemon = %{version}-%{release} +Requires: libvirt-libs = %{version}-%{release} %description lock-sanlock Includes the Sanlock lock manager plugin for the QEMU @@ -1157,7 +1157,7 @@ exit 1 # place macros above and build commands below this comment -export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/%{name}.spec) +export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec) %meson \ -Drunstatedir=%{_rundir} \ @@ -1312,7 +1312,7 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/%{name}.spec) %install rm -fr %{buildroot} -export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/%{name}.spec) +export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec) %meson_install @@ -1882,7 +1882,7 @@ exit 0 %{_unitdir}/virtinterfaced-admin.socket %attr(0755, root, root) %{_sbindir}/virtinterfaced %ghost %dir %{_rundir}/libvirt/interface/ -%{_libdir}/%{name}/connection-driver/libvirt_driver_interface.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_interface.so %{_mandir}/man8/virtinterfaced.8* %files daemon-driver-network @@ -1901,7 +1901,7 @@ exit 0 %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/network/ %dir %attr(0755, root, root) %{_localstatedir}/lib/libvirt/dnsmasq/ %attr(0755, root, root) %{_libexecdir}/libvirt_leaseshelper -%{_libdir}/%{name}/connection-driver/libvirt_driver_network.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_network.so %{_mandir}/man8/virtnetworkd.8* %if %{with_firewalld_zone} @@ -1922,7 +1922,7 @@ exit 0 %{_unitdir}/virtnodedevd-admin.socket %attr(0755, root, root) %{_sbindir}/virtnodedevd %ghost %dir %{_rundir}/libvirt/nodedev/ -%{_libdir}/%{name}/connection-driver/libvirt_driver_nodedev.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_nodedev.so %{_mandir}/man8/virtnodedevd.8* %files daemon-driver-nwfilter @@ -1938,7 +1938,7 @@ exit 0 %ghost %dir %{_rundir}/libvirt/network/ %ghost %dir %{_rundir}/libvirt/nwfilter-binding/ %ghost %dir %{_rundir}/libvirt/nwfilter/ -%{_libdir}/%{name}/connection-driver/libvirt_driver_nwfilter.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_nwfilter.so %{_mandir}/man8/virtnwfilterd.8* %files daemon-driver-secret @@ -1952,7 +1952,7 @@ exit 0 %attr(0755, root, root) %{_sbindir}/virtsecretd %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/secrets/ %ghost %dir %{_rundir}/libvirt/secrets/ -%{_libdir}/%{name}/connection-driver/libvirt_driver_secret.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_secret.so %{_mandir}/man8/virtsecretd.8* %files daemon-driver-storage @@ -1970,45 +1970,45 @@ exit 0 %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/storage/ %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/storage/autostart/ %ghost %dir %{_rundir}/libvirt/storage/ -%{_libdir}/%{name}/connection-driver/libvirt_driver_storage.so -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_fs.so -%{_libdir}/%{name}/storage-file/libvirt_storage_file_fs.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_storage.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_fs.so +%{_libdir}/libvirt/storage-file/libvirt_storage_file_fs.so %{_mandir}/man8/virtstoraged.8* %files daemon-driver-storage-disk -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_disk.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_disk.so %files daemon-driver-storage-logical -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_logical.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_logical.so %files daemon-driver-storage-scsi -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_scsi.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_scsi.so %files daemon-driver-storage-iscsi -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_iscsi.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_iscsi.so %if %{with_storage_iscsi_direct} %files daemon-driver-storage-iscsi-direct -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_iscsi-direct.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_iscsi-direct.so %endif %files daemon-driver-storage-mpath -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_mpath.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_mpath.so %if %{with_storage_gluster} %files daemon-driver-storage-gluster -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_gluster.so -%{_libdir}/%{name}/storage-file/libvirt_storage_file_gluster.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_gluster.so +%{_libdir}/libvirt/storage-file/libvirt_storage_file_gluster.so %endif %if %{with_storage_rbd} %files daemon-driver-storage-rbd -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_rbd.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_rbd.so %endif %if %{with_storage_zfs} %files daemon-driver-storage-zfs -%{_libdir}/%{name}/storage-backend/libvirt_storage_backend_zfs.so +%{_libdir}/libvirt/storage-backend/libvirt_storage_backend_zfs.so %endif %if %{with_qemu} @@ -2044,7 +2044,7 @@ exit 0 %dir %attr(0750, root, root) %{_localstatedir}/cache/libvirt/qemu/ %{_datadir}/augeas/lenses/libvirtd_qemu.aug %{_datadir}/augeas/lenses/tests/test_libvirtd_qemu.aug -%{_libdir}/%{name}/connection-driver/libvirt_driver_qemu.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_qemu.so %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/swtpm/ %dir %attr(0730, tss, tss) %{_localstatedir}/log/swtpm/libvirt/qemu/ %{_bindir}/virt-qemu-run @@ -2072,7 +2072,7 @@ exit 0 %{_datadir}/augeas/lenses/libvirtd_lxc.aug %{_datadir}/augeas/lenses/tests/test_libvirtd_lxc.aug %attr(0755, root, root) %{_libexecdir}/libvirt_lxc -%{_libdir}/%{name}/connection-driver/libvirt_driver_lxc.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_lxc.so %{_mandir}/man8/virtlxcd.8* %endif @@ -2100,7 +2100,7 @@ exit 0 %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/libxl/channel/target/ %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/libxl/dump/ %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/libxl/save/ -%{_libdir}/%{name}/connection-driver/libvirt_driver_libxl.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_libxl.so %{_mandir}/man8/virtxend.8* %endif @@ -2114,7 +2114,7 @@ exit 0 %{_unitdir}/virtvboxd-ro.socket %{_unitdir}/virtvboxd-admin.socket %attr(0755, root, root) %{_sbindir}/virtvboxd -%{_libdir}/%{name}/connection-driver/libvirt_driver_vbox.so +%{_libdir}/libvirt/connection-driver/libvirt_driver_vbox.so %{_mandir}/man8/virtvboxd.8* %endif -- 2.38.1

2 1

[PATCH 00/12] JSON monitor handling cleanups and spurious error bug fix
by Peter Krempa 02 Dec '22

02 Dec '22

First half introduces qemuMonitorJSONGetReply and uses it in our code base, second half introduces virJSONValueArrayToStringList, uses it to fix a bug and refactor the rest of the usage. Peter Krempa (12): qemu: monitor: Introduce qemuMonitorJSONGetReply, a better qemuMonitorJSONCheckReply qemu: monitor: Use qemuMonitorJSONGetReply for VIR_JSON_TYPE_OBJECT qemu: monitor: Use qemuMonitorJSONGetReply for VIR_JSON_TYPE_ARRAY qemu: monitor: Use qemuMonitorJSONGetReply when the value is extracted directly qemu: monitor: Unify and refactor 'PTY' case in qemuMonitorJSONAttachCharDev util: json: Split out array->strinlist conversion from virJSONValueObjectGetStringArray qemuAgentGetDisks: Don't use virJSONValueObjectGetStringArray for optional data qemuMonitorJSONGetCPUDefinitions: Rework lookup of 'unavailable-features' qemuMonitorJSONGetCPUDefinitions: Avoid double lookup of object qemu: monitor: Use qemuMonitorJSONGetReply in conjunction with virJSONValueArrayToStringList qemuAgentSSHGetAuthorizedKeys: Convert last use ofvirJSONValueObjectGetStringArray util: json: Remove unused virJSONValueObjectGetStringArray wrapper src/libvirt_private.syms | 2 +- src/qemu/qemu_agent.c | 13 ++- src/qemu/qemu_monitor_json.c | 189 +++++++++++++++-------------------- src/util/virjson.c | 44 +++----- src/util/virjson.h | 3 +- 5 files changed, 106 insertions(+), 145 deletions(-) -- 2.38.1

2 13

[PATCH] commandtest: Comply with FreeBSD poll()
by Michal Privoznik 01 Dec '22

01 Dec '22

In one of recent commits I've introduced a new test case to commandtest. In the test case I'm using poll() to wait for data on a pipe (the write end is passed to commandhelper). However, on FreeBSD the POLLIN semantic is a bit different: POLLIN Data other than high priority data may be read without blocking. Well, the pipe is non-blocking, so even if there's no data to be read the flag is set (and subsequent read() returns 0). On the other hand, POLLHUP is set too, BUT, if the commandhelper manages to write everything into the pipe and die right after we'd get both POLLIN and POLLHUP after the very first time poll() returns. That's very unfortunate, but okay - we can just check whether read() returned zero and break from the reading loop. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tests/commandtest.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/commandtest.c b/tests/commandtest.c index 62275ba96d..688cf59160 100644 --- a/tests/commandtest.c +++ b/tests/commandtest.c @@ -1205,6 +1205,9 @@ test29(const void *unused G_GNUC_UNUSED) goto cleanup; } + if (rc == 0) + break; + outactual = g_renew(char, outactual, outactuallen + rc + 1); memcpy(outactual + outactuallen, buf, rc); outactuallen += rc; -- 2.37.4

2 1

Release of libvirt-8.10.0
by Jiri Denemark 01 Dec '22

01 Dec '22

The 8.10.0 release of both libvirt and libvirt-python is tagged and signed tarballs and source RPMs are available at https://libvirt.org/sources/ https://libvirt.org/sources/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * New features * Tool for validating SEV firmware boot measurement of QEMU VMs The ``virt-qemu-sev-validate`` program will compare a reported SEV/SEV-ES domain launch measurement, to a computed launch measurement. This determines whether the domain has been tampered with during launch. * Support for SGX EPC (enclave page cache) Users can add a ``<memory model='sgx-epc'>`` device to lauch a VM with ``Intel Software Guard Extensions``. * Support migration of vTPM state of QEMU vms on shared storage Pass ``--migration`` option if appropriate in order for ``swtpm`` to properly migrate on shared storage. * Improvements * Mark close callback (un-)register API as high priority High priority APIs use a separate thread pool thus can help in eliminating problems with stuck VMs. Marking the close callback API as high priority allows ``virsh`` to properly connect to the daemon in case the normal priority workers are stuck allowing other high priority API usage. * Updated x86 CPU features The following features for the x86 platform were added: ``v-vmsave-vmload``, ``vgif``, ``avx512-vp2intersect``, ``avx512-fp16``, ``serialize``, ``tsx-ldtrk``, ``arch-lbr``, ``xfd``, ``intel-pt-lip``, ``avic``, ``sgx``, ``sgxlc``, ``sgx-exinfo``, ``sgx1``, ``sgx2``, ``sgx-debug``, ``sgx-mode64``, ``sgx-provisionkey``, ``sgx-tokenkey``, ``sgx-kss``, ``bus-lock-detect``, ``pks``, ``amx``. * Add support for ``hv-avic`` Hyper-V enlightenment ``qemu-6.2`` introduced support for the ``hv-avic`` enlightenment which allows to use Hyper-V SynIC with hardware APICv/AVIC enabled. * qemu: Run memory preallocation with numa-pinned threads Run the thread allocating memory in the proper NUMA node to reduce overhead. * RPM packaging changes - add optional dependancy of ``libvirt-daemon`` on ``libvirt-client`` The ``libvirt-guests.`` tool requires the ``virsh`` client to work properly, but we don't want to require the installation of the daemon if the tool is not used. - relax required ``python3-libvirt`` version for ``libvirt-client-qemu`` The ``virt-qemu-qmp-proxy`` tool requires python but doesn't strictly need the newest version. Remove the strict versioning requirement in order to prevent cyclic dependency when building. * Bug fixes * Skip initialization of ``cache`` capabilities if host doesn't support them Hypervisor drivers would fail to initialize on ``aarch64`` hosts with following error :: virStateInitialize:657 : Initialisation of cloud-hypervisor state driver failed: no error which prevented the startup of the daemon. * Allow incoming connections to guests on routed networks w/firewalld A change in handling of implicit rules in ``firewalld 1.0.0`` broke incomming connections to VMs when using ``routed`` network. This is fixed by adding a new ``libvirt-routed`` zone configured to once again allow incoming sessions to guests on routed networks. * Fix infinite loop in nodedev driver Certain udev entries might be of a size that makes libudev emit EINVAL which caused a busy loop burning CPU. Fix it by ignoring the return code. Enjoy. Jirka

1 0

[PATCH 0/9] Couple of virCommand related improvements
by Michal Privoznik 30 Nov '22

30 Nov '22

Found these on a abandoned branch, but they are still worth merging. Polished them a bit though. Michal Prívozník (9): vircommand: Document virCommandSetSendBuffer() behaviour wrt daemonize virCommandDoAsyncIO: Drop misleading statement about main event loop commandtest: Use unsigned char in test27() virCommandSetSendBuffer: Take double pointer of @buffer commandtest: Test virCommandSetSendBuffer() with virCommandDoAsyncIO() commandtest: Use virTestCompareToFile() in checkoutput() virbuftest: Cleanup code around virTestDifference() tests: Don't wrap virTestDifference() arguments in NULLSTR() tests: Use virTestCompareToString() more src/qemu/qemu_tpm.c | 2 +- src/util/vircommand.c | 11 ++- src/util/vircommand.h | 2 +- tests/commanddata/test29.log | 20 ++++ tests/commandtest.c | 152 +++++++++++++++++++++++-------- tests/esxutilstest.c | 10 +- tests/nwfilterebiptablestest.c | 21 ++--- tests/openvzutilstest.c | 6 +- tests/sockettest.c | 3 +- tests/utiltest.c | 3 +- tests/vboxsnapshotxmltest.c | 3 +- tests/virbuftest.c | 25 ++--- tests/virfirewalltest.c | 30 ++---- tests/virjsontest.c | 6 +- tests/virkmodtest.c | 3 +- tests/virnetdevbandwidthtest.c | 5 +- tests/virnetdevopenvswitchtest.c | 10 +- tests/virnetsockettest.c | 3 +- tests/virshtest.c | 3 +- 19 files changed, 182 insertions(+), 136 deletions(-) create mode 100644 tests/commanddata/test29.log -- 2.37.4

2 10

[libvirt PATCH] apparmor: Allow running /usr/libexec/qemu-kvm
by Andrea Bolognani 30 Nov '22

30 Nov '22

Distros that use AppArmor, such as Debian and Ubuntu, install QEMU under /usr/bin/qemu-system-*, and our AppArmor profile is written with that assumption in mind. If you try to run the RHEL or CentOS version of libvirt and QEMU inside a privileged container on such distros, however, that will result in an error, because the path /usr/libexec/qemu-kvm is used instead. In particular, this prevents upstream KubeVirt releases (which are based on CentOS) from running on Debian/Ubuntu nodes. See https://github.com/kubevirt/kubevirt/pull/8692 and the issues referenced therein for additional details. Signed-off-by: Andrea Bolognani <abologna(a)redhat.com> --- src/security/apparmor/usr.sbin.libvirtd.in | 4 ++++ src/security/apparmor/usr.sbin.virtqemud.in | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/src/security/apparmor/usr.sbin.libvirtd.in b/src/security/apparmor/usr.sbin.libvirtd.in index 886f1ad518..2994de5ec9 100644 --- a/src/security/apparmor/usr.sbin.libvirtd.in +++ b/src/security/apparmor/usr.sbin.libvirtd.in @@ -99,6 +99,10 @@ profile libvirtd @sbindir@/libvirtd flags=(attach_disconnected) { # read and run an ebtables script. /var/lib/libvirt/virtd* ixr, + # Needed when running the RHEL/CentOS version of libvirt and QEMU + # inside a privileged container on a Debian/Ubuntu host + /usr/libexec/qemu-kvm PUx, + # force the use of virt-aa-helper audit deny /{usr/,}sbin/apparmor_parser rwxl, audit deny /etc/apparmor.d/libvirt/** wxl, diff --git a/src/security/apparmor/usr.sbin.virtqemud.in b/src/security/apparmor/usr.sbin.virtqemud.in index 3de03d49fc..b3f33b9471 100644 --- a/src/security/apparmor/usr.sbin.virtqemud.in +++ b/src/security/apparmor/usr.sbin.virtqemud.in @@ -94,6 +94,10 @@ profile virtqemud @sbindir@/virtqemud flags=(attach_disconnected) { # read and run an ebtables script. /var/lib/libvirt/virtd* ixr, + # Needed when running the RHEL/CentOS version of libvirt and QEMU + # inside a privileged container on a Debian/Ubuntu host + /usr/libexec/qemu-kvm PUx, + # force the use of virt-aa-helper audit deny /{usr/,}sbin/apparmor_parser rwxl, audit deny /etc/apparmor.d/libvirt/** wxl, -- 2.38.1

4 12

[PATCH v4 0/7] qemu: tpm: Add support for migration across shared storage
by Stefan Berger 30 Nov '22

30 Nov '22

This series of patches adds support for migrating vTPMs across hosts whose storage has been set up to share the directory structure holding the state of the TPM (swtpm). The existence of share storage influences the management of the directory structure holding the TPM state, which for example is only removed when a domain is undefined and not when a VM is removed on the migration source host. Further, when shared storage is used then security labeling on the destination side is skipped assuming that the labeling was already done on the source side. I have tested this with an NFS setup where I had to turn SELinux off on the hosts since the SELinux MLS range labeling is not supported by NFS. For shared storage support to work properly both sides of the migration need to be clients of the shared storage setup, meaning that they both have to have /var/lib/libvirt/swtpm mounted as shared storage, because other- wise the virFileIsSharedFS() may not detect shared storage and in the worst case may cause the TPM emulator (swtpm) to malfunction if for example the source side removed the TPM state directory structure. Shared storage migration requires (upcoming) swtpm v0.8. Stefan v4: - Fixed long-standing bug regarding offline migration that now blocks if no shared storage is set up - Addressed Michal's concerns v3: - Relying entirely on virFileIsSharedFS() on migration source and destination sides to detect whether shared storage is set up between hosts; no more hint about shared storage from user via flag - Added support for virDomainTPMPrivate structure to store and persist TPM-related private data Stefan Berger (7): util: Add parsing support for swtpm's cmdarg-migration capability qemu: tpm: Allow offline migration with TPM_EMULATOR only with shared storage qemu: tpm: Conditionally create storage on incoming migration qemu: tpm: Add support for storing private TPM-related data qemu: tpm: Pass --migration option to swtpm if supported and needed qemu: tpm: Avoid security labels on incoming migration with shared storage qemu: tpm: Never remove state on outgoing migration and shared storage src/conf/domain_conf.c | 63 ++++++++++++++++++-- src/conf/domain_conf.h | 9 +++ src/qemu/qemu_domain.c | 85 ++++++++++++++++++++++++-- src/qemu/qemu_domain.h | 17 +++++- src/qemu/qemu_driver.c | 20 +++---- src/qemu/qemu_extdevice.c | 10 ++-- src/qemu/qemu_extdevice.h | 6 +- src/qemu/qemu_migration.c | 28 +++++++-- src/qemu/qemu_process.c | 9 ++- src/qemu/qemu_snapshot.c | 4 +- src/qemu/qemu_tpm.c | 122 ++++++++++++++++++++++++++++++++++---- src/qemu/qemu_tpm.h | 14 ++++- src/util/virtpm.c | 1 + src/util/virtpm.h | 1 + 14 files changed, 339 insertions(+), 50 deletions(-) -- 2.37.3

2 18

[libvirt PATCH 0/3] qemu: A few qemuMigrationCookieParse cleanups
by Jiri Denemark 30 Nov '22

30 Nov '22

Jiri Denemark (3): qemu: Reorder qemuMigrationCookieParse arguments qemu: Replace priv with qemuCaps in qemuMigrationCookieParse qemu: Reindent qemuMigrationCookieParse prototype arguments src/qemu/qemu_migration.c | 35 ++++++++++++++++-------------- src/qemu/qemu_migration_cookie.c | 12 ++++------ src/qemu/qemu_migration_cookie.h | 14 ++++++------ tests/qemumigrationcookiexmltest.c | 6 ++--- 4 files changed, 33 insertions(+), 34 deletions(-) -- 2.38.1

2 4

[PATCH] node_device_conf: Avoid memleak in virNodeDeviceGetPCIVPDDynamicCap()
by Michal Privoznik 30 Nov '22

30 Nov '22

The virNodeDeviceGetPCIVPDDynamicCap() function is called from virNodeDeviceGetPCIDynamicCaps() and therefore has to be a wee bit more clever about adding VPD capability. Namely, it has to remove the old one before adding a new one. This is how other functions called from virNodeDeviceGetPCIDynamicCaps() behave as well. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2143235 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/conf/node_device_conf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c index 83e66b85e3..af331baaf3 100644 --- a/src/conf/node_device_conf.c +++ b/src/conf/node_device_conf.c @@ -3068,6 +3068,9 @@ virNodeDeviceGetPCIVPDDynamicCap(virNodeDevCapPCIDev *devCapPCIDev) virPCIDeviceAddress devAddr = { 0 }; g_autoptr(virPCIVPDResource) res = NULL; + g_clear_pointer(&devCapPCIDev->vpd, virPCIVPDResourceFree); + devCapPCIDev->flags &= ~VIR_NODE_DEV_CAP_FLAG_PCI_VPD; + devAddr.domain = devCapPCIDev->domain; devAddr.bus = devCapPCIDev->bus; devAddr.slot = devCapPCIDev->slot; @@ -3081,8 +3084,6 @@ virNodeDeviceGetPCIVPDDynamicCap(virNodeDevCapPCIDev *devCapPCIDev) if ((res = virPCIDeviceGetVPD(pciDev))) { devCapPCIDev->flags |= VIR_NODE_DEV_CAP_FLAG_PCI_VPD; devCapPCIDev->vpd = g_steal_pointer(&res); - } else { - virPCIVPDResourceFree(g_steal_pointer(&devCapPCIDev->vpd)); } } return 0; -- 2.37.4

2 1

[libvirt PATCH] qemu: Pass vm to qemuMigrationCookieParse if it exists
by Jiri Denemark 30 Nov '22

30 Nov '22

The vm object is used inside qemuMigrationCookieParse based on the flags passed to qemuMigrationCookieParse and the content of the cookie. The callers should not just blindly guess and pass NULL if they (incorrectly) think the vm object is not needed. We should always pass the vm object unless it does not exist yet. This fixes a bug when statistics of a completed migration reported "Unknown" operation instead of "Incoming migration" on the destination host. https://bugzilla.redhat.com/show_bug.cgi?id=2137298 Fixes: v8.7.0-79-g0150f7a8c1 Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/qemu/qemu_migration.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index bef06f4caf..6d3810c79c 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -4775,7 +4775,7 @@ qemuMigrationSrcRun(virQEMUDriver *driver, QEMU_MIGRATION_COOKIE_GRAPHICS | QEMU_MIGRATION_COOKIE_CAPS | QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS, - NULL); + vm); if (!mig) goto error; @@ -6459,7 +6459,7 @@ qemuMigrationDstFinishOffline(virQEMUDriver *driver, g_autoptr(qemuMigrationCookie) mig = NULL; if (!(mig = qemuMigrationCookieParse(driver, vm->def, priv->origname, priv, - cookiein, cookieinlen, cookie_flags, NULL))) + cookiein, cookieinlen, cookie_flags, vm))) return NULL; if (qemuMigrationDstPersist(driver, vm, mig, false) < 0) @@ -6655,7 +6655,7 @@ qemuMigrationDstFinishActive(virQEMUDriver *driver, vm, flags, retcode); if (!(mig = qemuMigrationCookieParse(driver, vm->def, priv->origname, priv, - cookiein, cookieinlen, cookie_flags, NULL))) + cookiein, cookieinlen, cookie_flags, vm))) goto error; if (retcode != 0) { -- 2.38.1

2 1