- Devel - libvirt List Archives

RBD encryption support in libvirt
by Or Ozeri 05 Sep '21

05 Sep '21

Hi, I wanted to get your advice on a patch I'm preparing for libvirt. It touches the code-path that allows using LUKS encryption on top of an RBD image. We recently added LUKS and LUKS2 encryption support in Ceph's librbd. We exposed this in qemu in a recent patch by adding new optional "encrypt" member to BlockdevOptionsRbd. This patch was included in the recent release of qemu 6.1. To enable libvirt users to use librbd encryption, we need libvirt to use this new "encrypt" when it builds the blockdev options for RBD. The interesting question is how to define the libvirt XML syntax that will trigger the use of librbd encryption. My thought was to use the already existing <encryption> tag. In that case, we just need to add a new format VIR_STORAGE_ENCRYPTION_FORMAT_LUKS2 to the enum virStorageEncryptionFormatType. This type will be checked in qemuBlockStorageSourceGetRBDProps. The problem with this approach is that it only works for LUKS2. librbd encryption also supports LUKS1. We want to allow the user to choose between the qemu LUKS implementation and the librbd one. One reason to keep support both is that on the one hand librbd only supports XTS mode. On the other hand, qemu implementation will not support a chain of uniquely encrypted RBD images (each serving as a backing store for the previous one). So we need a way in the XML API to support both implementations. Our current thought is to add a new "engine" attribute to the encryption tag. By default, encryption will use the QEMU LUKS implementation, unless <encryption engine='rbd' ...> is specified. To make this more general, we can have engine='backend' instead of engine='rbd' to denote that the encryption is to be delegated to the backend storage properties (instead of the format properties). This way, the encryption tag will only be parsed in the flow of qemuBlockStorageSourceGetBackendProps, instead of in qemuBlockStorageSourceGetBlockdevProps We'll appreciate any feedback you have on this. Thanks, Or

3 4

[PULL 21/22] docs/deprecated: deprecate passing plugin args through `arg=`
by Alex Bennée 03 Sep '21

03 Sep '21

From: Mahmoud Mandour <ma.mandourr(a)gmail.com> Signed-off-by: Mahmoud Mandour <ma.mandourr(a)gmail.com> Message-Id: <20210802134414.52037-1-ma.mandourr(a)gmail.com> Reviewed-by: Alex Bennée <alex.bennee(a)linaro.org> [AJB: fixed up move of deprecated.rst] Signed-off-by: Alex Bennée <alex.bennee(a)linaro.org> diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 1e1a5e96ad..6e88a84bba 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -139,6 +139,18 @@ The ``-no-quit`` is a synonym for ``-display ...,window-close=off`` which should be used instead. +Plugin argument passing through ``arg=<string>`` (since 6.1) +'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +Passing TCG plugins arguments through ``arg=`` is redundant is makes the +command-line less readable, especially when the argument itself consist of a +name and a value, e.g. ``-plugin plugin_name,arg="arg_name=arg_value"``. +Therefore, the usage of ``arg`` is redundant. Single-word arguments are treated +as short-form boolean values, and passed to plugins as ``arg_name=on``. +However, short-form booleans are deprecated and full explicit ``arg_name=on`` +form is preferred. + + QEMU Machine Protocol (QMP) commands ------------------------------------ -- 2.30.2

1 0

[PATCH 0/6] network create: add support for validation against schema
by Kristina Hanicova 02 Sep '21

02 Sep '21

Kristina Hanicova (6): api: add public virNetworkCreateXMLFlags() and remote protocol src: add driver support for networkCreateXMLFlags() api: add virNetworkCreateFlags network_conf: add validation against schema in create network: allow VIR_NETWORK_CREATE_VALIDATE flag virsh: add support for '--validate' option in create network docs/manpages/virsh.rst | 4 ++- include/libvirt/libvirt-network.h | 7 ++++++ src/conf/network_conf.c | 3 ++- src/driver-network.h | 6 +++++ src/libvirt-network.c | 41 +++++++++++++++++++++++++++++++ src/libvirt_public.syms | 5 ++++ src/network/bridge_driver.c | 20 ++++++++++++--- src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 18 +++++++++++++- src/remote_protocol-structs | 8 ++++++ src/test/test_driver.c | 15 +++++++++-- src/vbox/vbox_network.c | 10 +++++++- tools/virsh-network.c | 13 +++++++++- 13 files changed, 140 insertions(+), 11 deletions(-) -- 2.31.1

3 12

[PATCH 0/4] nwfilter-binding create: add support for validation against schema
by Kristina Hanicova 02 Sep '21

02 Sep '21

Kristina Hanicova (4): api: add virNWFilterBindingCreateFlags conf: virnwfilterbindingdef: add validation against schema in create nwfilter_driver: allow VIR_NWFILTER_BINDING_CREATE_VALIDATE flag virsh: add support for '--validate' option in create nwfilter-binding docs/manpages/virsh.rst | 5 ++++- include/libvirt/libvirt-nwfilter.h | 5 +++++ src/conf/virnwfilterbindingdef.c | 14 +++++++++----- src/conf/virnwfilterbindingdef.h | 3 ++- src/libvirt-nwfilter.c | 2 +- src/nwfilter/nwfilter_driver.c | 4 ++-- tools/virsh-nwfilter.c | 10 +++++++++- 7 files changed, 32 insertions(+), 11 deletions(-) -- 2.31.1

2 5

[PATCH 0/4] network port create: add support for validation against schema
by Kristina Hanicova 02 Sep '21

02 Sep '21

Kristina Hanicova (4): api: add VIR_NETWORK_PORT_CREATE_VALIDATE flag conf: virnetworkportdef: add validation against schema in network port create bridge_driver: allow VIR_NETWORK_PORT_CREATE_VALIDATE flag virsh: add support for '--validate' option in create network port docs/manpages/virsh.rst | 4 +++- include/libvirt/libvirt-network.h | 1 + src/conf/domain_conf.c | 2 +- src/conf/virnetworkportdef.c | 14 +++++++++----- src/conf/virnetworkportdef.h | 3 ++- src/libvirt-network.c | 2 +- src/network/bridge_driver.c | 5 +++-- tools/virsh-network.c | 10 +++++++++- 8 files changed, 29 insertions(+), 12 deletions(-) -- 2.31.1

2 5

[PATCH v3 0/5] Implement some job related APIs for test driver
by Luke Yue 02 Sep '21

02 Sep '21

v3: - Fix virDomainGetJobStats when use completed flags - Introduce testDomainSetDummyData - Add and refine some tests Luke Yue (5): test_driver: Implement virDomainGetJobInfo test_driver: Implement virDomainGetJobStats test_driver: Implement virDomainAbortJob test_driver: Introduce testDomainSetDummyData virshtest: add test for domjobinfo and domjobabort src/test/test_driver.c | 274 +++++++++++++++++++++++++++++++++++++++++ tests/virshtest.c | 89 +++++++++++++ 2 files changed, 363 insertions(+) -- 2.32.0

1 6

[libvirt PATCH v2 0/1] Add a PCI/PCIe device VPD Capability
by Dmitrii Shcherbakov 02 Sep '21

02 Sep '21

Add support for deserializing the binary PCI/PCIe VPD format and exposing VPD resources as XML elements in a new nested capability of PCI/PCIe devices called 'vpd'. The VPD format is specified in "I.3. VPD Definitions" in PCI specs (2.2+) and "6.28.1 VPD Format" PCIe 4.0. As section 6.28 in PCIe 4.0 notes, the PCI Local Bus and PCIe VPD formats are binary compatible and PCIe 4.0 merely started incorporating what was already present in PCI specs. Linux kernel exposes a binary blob in the VPD format via sysfs since v2.6.26 (commit 94e6108803469a37ee1e3c92dafdd1d59298602f) which requires a parser to interpret. There are usage scenarios where information such as the board serial number needs to be retrieved from PCI(e) VPD. Projects like Nova can utilize this information for cases which involve virtual interface plugging on SmartNIC DPUs but there may be other scenarios and types of information useful to retrieve from VPD. The fact that the format is binary requires proper parsing instead of substring searching hence the full parser is proposed. Likewise, checksum validation requires proper parsing as well. The patch follows a prior discussion on the mailing list which has additional context about the use-case but a narrower proposal: https://listman.redhat.com/archives/libvir-list/2021-May/msg00873.html https://www.mail-archive.com/libvir-list@redhat.com/msg218165.html The new functionality is mostly contained in virpcivpd with a couple of new functions added to virpci. Additionally, the necessary XML serialization/deserialization and glue code is added to expose the VPD capability to external clients as XML. A new capability flag is added along with a new capability in order to allow for filtering of PCI devices with the VPD capability using virsh: virsh nodedev-list --cap vpd sudo virsh nodedev-dumpxml --device pci_dddd_bb_ss_f In this example having the root uid is required in order to access the vpd sysfs entry, therefore, the nodedev XML output will only contain the VPD capability if virsh is run as root. The capability is treated as dynamic due to the presence of read-write sections in the VPD format per PCI/PCIe specs (the idea being that read-write resource fields may potentially be altered by the DPU OS over time independently from the host OS). Unit tests cover the parser functionality (including many possible invalid cases), in-memory representation as well as XML serialization and deserialization. Manual functional testing was performed with 2 DPUs and several other NIC models which expose PCI(e) VPD. Testing have also been performed for devices that do not have VPD or those that expose a VPD capability but exhibit invalid behavior (I/O errors while reading a sysfs entry). Per the existing guidelines, the implementation relies heavily on glib for various purposes. https://libvirt.org/glib-adoption.html The v2 of the patch is rebased on top of Libvirt 7.7.0 and fixes a couple of minor typos. Dmitrii Shcherbakov (1): Add a PCI/PCIe device VPD Capability build-aux/syntax-check.mk | 4 +- docs/drvnodedev.html.in | 46 ++ docs/formatnode.html.in | 24 +- docs/schemas/nodedev.rng | 40 + include/libvirt/libvirt-nodedev.h | 1 + po/POTFILES.in | 1 + src/conf/node_device_conf.c | 258 ++++++ src/conf/node_device_conf.h | 6 +- src/conf/virnodedeviceobj.c | 7 +- src/libvirt_private.syms | 17 + src/node_device/node_device_driver.c | 2 + src/node_device/node_device_udev.c | 2 + src/util/meson.build | 1 + src/util/virpci.c | 60 ++ src/util/virpci.h | 3 + src/util/virpcivpd.c | 771 +++++++++++++++++ src/util/virpcivpd.h | 106 +++ src/util/virpcivpdpriv.h | 42 + tests/meson.build | 1 + .../pci_0000_42_00_0_vpd.xml | 33 + .../pci_0000_42_00_0_vpd.xml | 1 + tests/nodedevxml2xmltest.c | 1 + tests/testutils.c | 51 ++ tests/testutils.h | 6 + tests/virpcitest.c | 3 + tests/virpcivpdtest.c | 777 ++++++++++++++++++ tools/virsh-nodedev.c | 3 + 27 files changed, 2262 insertions(+), 5 deletions(-) create mode 100644 src/util/virpcivpd.c create mode 100644 src/util/virpcivpd.h create mode 100644 src/util/virpcivpdpriv.h create mode 100644 tests/nodedevschemadata/pci_0000_42_00_0_vpd.xml create mode 120000 tests/nodedevxml2xmlout/pci_0000_42_00_0_vpd.xml create mode 100644 tests/virpcivpdtest.c -- 2.30.2

1 1

[PATCH v3 0/8] ch: Add Console support
by William Douglas 02 Sep '21

02 Sep '21

This series enables console support in the cloud-hypervisor driver. Cloud-hypervisor only supports a single console or serial device at a time, hence the checks to ensure the domain configuration is only passing one or the other. Changes since v2: * Squashed an additional patch. Changes since v1: * Added missing patch to add the virChrdev device * Added handling for multiple curl WRITEFUNCTION call backs * Added missing free for data.content * Removed redundant console configuration check * Improved handling of pty JSON data to make use of g_autoptr * Squashed two patches William Douglas (8): ch_domain: Add virChrdevs for console support ch_monitor: Make unused function static ch_monitor: Update virCHMonitorGet to handle accept a response ch_monitor: Use virCHMonitorGet to access cloud-hypervisor API ch_monitor: Add pty json builder function ch_process: Handle enabled console devices ch_domain: Allow controller and chr devices ch_driver: Add handler for console API src/ch/ch_domain.c | 11 ++++- src/ch/ch_domain.h | 3 ++ src/ch/ch_driver.c | 78 +++++++++++++++++++++++++++++ src/ch/ch_monitor.c | 118 ++++++++++++++++++++++++++++++++++++++++++-- src/ch/ch_monitor.h | 3 ++ src/ch/ch_process.c | 67 +++++++++++++++++++++++++ 6 files changed, 274 insertions(+), 6 deletions(-) -- 2.31.1

3 19

[PATCH v2 1/2] qemu: process: Split out the statement to handle the qemu is allowed to reboot
by Masayoshi Mizuma 01 Sep '21

01 Sep '21

From: Masayoshi Mizuma <m.mizuma(a)jp.fujitsu.com> Split out the statement to handle whether the qemu is allowed to reboot or not. So that it gets available for the later patch. Signed-off-by: Masayoshi Mizuma <m.mizuma(a)jp.fujitsu.com> --- src/qemu/qemu_process.c | 17 +++++++++++++---- src/qemu/qemu_process.h | 2 ++ 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 3b4af61bf8..f4e67c70ad 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -6360,6 +6360,18 @@ qemuProcessPrepareHostHostdevs(virDomainObj *vm) return 0; } +bool +qemuProcessRebootAllowed(const virDomainDef *def) +{ + if (def->onReboot == VIR_DOMAIN_LIFECYCLE_ACTION_DESTROY && + def->onPoweroff == VIR_DOMAIN_LIFECYCLE_ACTION_DESTROY && + (def->onCrash == VIR_DOMAIN_LIFECYCLE_ACTION_DESTROY || + def->onCrash == VIR_DOMAIN_LIFECYCLE_ACTION_COREDUMP_DESTROY)) { + return false; + } else { + return true; + } +} static void qemuProcessPrepareAllowReboot(virDomainObj *vm) @@ -6375,10 +6387,7 @@ qemuProcessPrepareAllowReboot(virDomainObj *vm) if (priv->allowReboot != VIR_TRISTATE_BOOL_ABSENT) return; - if (def->onReboot == VIR_DOMAIN_LIFECYCLE_ACTION_DESTROY && - def->onPoweroff == VIR_DOMAIN_LIFECYCLE_ACTION_DESTROY && - (def->onCrash == VIR_DOMAIN_LIFECYCLE_ACTION_DESTROY || - def->onCrash == VIR_DOMAIN_LIFECYCLE_ACTION_COREDUMP_DESTROY)) { + if (!qemuProcessRebootAllowed(def)) { priv->allowReboot = VIR_TRISTATE_BOOL_NO; } else { priv->allowReboot = VIR_TRISTATE_BOOL_YES; diff --git a/src/qemu/qemu_process.h b/src/qemu/qemu_process.h index 93103eb530..f9fa140e6d 100644 --- a/src/qemu/qemu_process.h +++ b/src/qemu/qemu_process.h @@ -242,3 +242,5 @@ void qemuProcessQMPFree(qemuProcessQMP *proc); G_DEFINE_AUTOPTR_CLEANUP_FUNC(qemuProcessQMP, qemuProcessQMPFree); int qemuProcessQMPStart(qemuProcessQMP *proc); + +bool qemuProcessRebootAllowed(const virDomainDef *def); -- 2.27.0

2 4

[libvirt PATCH v2] meson: avoid bogus warnings from clang and g_autoptr
by Daniel P. Berrangé 01 Sep '21

01 Sep '21

Clang has previously had trouble with G_DEFINE_AUTOPTR_CLEANUP_FUNC generated code, thinking it was unused. We turn off -Wunused-function to avoid tripping up on that with CLang. New Clang has started having trouble with g_autoptr now too. In usage scenarios where the variable is set, but never again read, it thinks it is unused not realizing the destructor has useful side effects. For this we have to skip -Wunused-but-set-variable on CLang. Reviewed-by: Pavel Hrdina <phrdina(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- build-aux/syntax-check.mk | 2 +- meson.build | 21 +++++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/build-aux/syntax-check.mk b/build-aux/syntax-check.mk index 2058af0b77..5c5a2a8771 100644 --- a/build-aux/syntax-check.mk +++ b/build-aux/syntax-check.mk @@ -1589,7 +1589,7 @@ exclude_file_name_regexp--sc_prohibit_canonicalize_file_name = \ ^(build-aux/syntax-check\.mk|tests/virfilemock\.c)$$ exclude_file_name_regexp--sc_prohibit_raw_allocation = \ - ^(docs/advanced-tests\.rst|src/util/viralloc\.[ch]|examples/.*|tests/(securityselinuxhelper|(vircgroup|nss)mock|commandhelper)\.c|tools/wireshark/src/packet-libvirt\.c|tools/nss/libvirt_nss(_leases|_macs)?\.c)$$ + ^(meson\.build|docs/advanced-tests\.rst|src/util/viralloc\.[ch]|examples/.*|tests/(securityselinuxhelper|(vircgroup|nss)mock|commandhelper)\.c|tools/wireshark/src/packet-libvirt\.c|tools/nss/libvirt_nss(_leases|_macs)?\.c)$$ exclude_file_name_regexp--sc_prohibit_readlink = \ ^src/(util/virutil|lxc/lxc_container)\.c$$ diff --git a/meson.build b/meson.build index 5af09d319a..ae2e672c1d 100644 --- a/meson.build +++ b/meson.build @@ -470,6 +470,27 @@ if get_option('warning_level') == '2' supported_cc_flags += [ '-Wno-unused-function' ] endif + if supported_cc_flags.contains('-Wunused-but-set-variable') + # Clang complains about unused variables in many scenarios related + # to attribute((cleanup)) aka g_auto* + w_unused_but_set_var_args = [ '-Wunused-but-set-variable', '-Werror' ] + w_unused_but_set_var_code = ''' + static inline void free_pointer (void *p) { + void **pp = (void**)p; + free (*pp); + } + + int main(void) { + __attribute__((cleanup(free_pointer))) char *buffer = 0x0; + buffer = 0x1; + } + ''' + # We previously turned on unused-but-set-variable, so we must turn + # it off again explicitly now. + if not cc.compiles(w_unused_but_set_var_code, args: w_unused_but_set_var_args) + supported_cc_flags += [ '-Wno-unused-but-set-variable' ] + endif + endif endif add_project_arguments(supported_cc_flags, language: 'c') -- 2.31.1

2 1

Release of libvirt-7.7.0
by Jiri Denemark 01 Sep '21

01 Sep '21

The 7.7.0 release of both libvirt and libvirt-python is tagged and signed tarballs and source RPMs are available at https://libvirt.org/sources/ https://libvirt.org/sources/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing any other feedback. Your work is greatly appreciated. * New features * Add support for Fibre Channel VMID New VM element ``<fibrechannel appid=''/>`` was added to allow users to set their ``appid`` for each VM which will be used by kernel to create Fibre Channel VMID. This allows various QoS levels, access control or collecting telemetry data per VM. * Improvements * virsh: Allow XML validation for define of: storage pool, network, secret, nwfilter, interface * Add flag ``VIR_STORAGE_POOL_DEFINE_VALIDATE`` to validate storage pool input xml. For virsh, users can use it as ``virsh pool-define --validate``. * Add flag ``VIR_NETWORK_DEFINE_VALIDATE`` to validate network input xml. For virsh, users can use it as ``net-define --validate``. * Add flag ``VIR_SECRET_DEFINE_VALIDATE`` to validate secret input xml. For virsh, users can use it as ``secret-define --validate``. * Add flag ``VIR_NWFILTER_DEFINE_VALIDATE`` to validate nwfilter input xml. For virsh, users can use it as ``nwfilter-define --validate``. * Add flag ``VIR_INTERFACE_DEFINE_VALIDATE`` to validate interface input xml. For virsh, users can use it as ``iface-define --validate``. * Add SecurityManager APIs for labeling network devices New ``virSecurityManagerSetNetdevLabel`` and ``virSecurityManagerSetNetdevLabel`` APIs are introduced and implemented in the Apparmor security driver. The qemu driver uses the APIs to label vhostuser ports on hotplug and restore labeling on unplug. * vmx: Parse vm.genid and support super wide SCSI bus The genid attribute is now reported for VMX guests. Libvirt can now properly process super wide SCSI bus (64 units). * qemu: Lifecycle action (``on_poweroff``/``on_reboot``) handling improvements The handling of lifecycle actions was fixed and improved in multiple ways: - ``restart-rename`` action was forbidden The action was never properly implemented in the qemu driver and didn't actually result in a restart of the VM but rather termination. The qemu driver now rejects such configurations. - ``preserve`` action was forbidden Similarly to the previous case this never worked as the intended semantics of the actions dictate. It's better to not allow it at all until there's a proper implementation - ``reboot`` action of ``on_poweroff`` now actually works The guest OS is now rebooted instead of terminating the VM when the ``reboot`` action is used and the guest OS powers down. Note that it's incompatible with ``on_reboot`` set to ``destroy``. - Changes in action action of ``on_reboot`` are now updated with qemu Libvirtd can now properly update the ``on_reboot`` action in qemu which allows proper handling when changing between ``reboot`` and ``destroy`` actions. In addition, switching from ``reboot`` to ``destroy`` was forbidden for older qemus which don't support the update API as the guest could still reboot and execute some instructions until it was terminated. * Bug fixes * qemu: Open chardev logfile on behalf of QEMU Guests with a logfile configured for their chardevs are now able to start even when no virtlogd is configured. * virhostmem: Handle numactl-less build in hugepages allocation/reporting Some architectures don't have notion of NUMA (e.g. s390x) but do support hugepages. Libvirt silently ignored requests to allocate/report hugepage pool when built without numactl. This is now fixed and the pool can be allocated/reported on properly. * qemu: Record proper ``backing`` format for overlays of qcow2+luks images Libvirt would record ``luks`` instead of ``qcow2`` into the metadata. In practice this is a problem only when inspecting images manually via ``qemu-img`` as with libvirt users must use full specification of the backing chain in the domain XML which supersedes information recorded in the image metadata. Enjoy. Jirka

1 0

[PATCH v3 0/2] hw/arm/raspi: Remove deprecated raspi2/raspi3 aliases
by Philippe Mathieu-Daudé 31 Aug '21

31 Aug '21

Since v2: - updated "Since 6.1" -> "Since 6.2" Peter reported CI failure [*] but I can't reproduce: https://gitlab.com/philmd/qemu/-/pipelines/360227279 Since v1: - renamed tests (Peter) [*] https://lore.kernel.org/qemu-devel/CAFEAcA8PLvMUEzyu=sN4bn4mU30w1aajU+T+i__… Philippe Mathieu-Daudé (2): tests: Remove uses of deprecated raspi2/raspi3 machine names hw/arm/raspi: Remove deprecated raspi2/raspi3 aliases docs/about/deprecated.rst | 7 ----- docs/about/removed-features.rst | 7 +++++ docs/devel/qgraph.rst | 38 ++++++++++++------------- tests/qtest/libqos/qgraph.h | 6 ++-- tests/qtest/libqos/qgraph_internal.h | 2 +- hw/arm/raspi.c | 2 -- tests/qtest/boot-serial-test.c | 2 +- tests/qtest/libqos/arm-raspi2-machine.c | 8 +++--- tests/unit/test-qgraph.c | 2 +- tests/acceptance/boot_linux_console.py | 6 ++-- 10 files changed, 39 insertions(+), 41 deletions(-) -- 2.31.1

4 5

[libvirt PATCH] meson: avoid bogus warnings from clang and g_autoptr
by Daniel P. Berrangé 31 Aug '21

31 Aug '21

Clang has previously had trouble with G_DEFINE_AUTOPTR_CLEANUP_FUNC generated code, thinking it was unused. We turn off -Wunused-function to avoid tripping up on that with CLang. New CLang has started having trouble with g_autoptr now too. In usage scenarios where the variable is set, but never again read, it thinks it is unused not realizing the destructor has useful side effects. For this we have to skip -Wunused-but-set-variable on CLang. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- meson.build | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/meson.build b/meson.build index 5af09d319a..dbd70b6483 100644 --- a/meson.build +++ b/meson.build @@ -470,6 +470,26 @@ if get_option('warning_level') == '2' supported_cc_flags += [ '-Wno-unused-function' ] endif + # Clang complains about unused variables in many scenarios arelated + # to attribute((cleanup)) aka g_auto* + w_unused_but_set_var_args = [ '-Wunused-but-set-variable', '-Werror' ] + w_unused_but_set_var_code = ''' + static inline void free_pointer (void *p) { + void **pp = (void**)p; + free (*pp); + } + + int main(void) { + __attribute__((cleanup(free_pointer))) char *buffer = 0x0; + buffer = 0x1; + } + ''' + # We previously turned on unused-but-set-variable, so we must turn + # it off again explicitly now. + if not cc.compiles(w_unused_but_set_var_code, args: w_unused_but_set_var_args) + supported_cc_flags += [ '-Wno-unused-but-set-variable' ] + endif + endif add_project_arguments(supported_cc_flags, language: 'c') -- 2.31.1

2 2

[libvirt PATCH] tests: virstoragetest: remove tests without backing type
by Ján Tomko 31 Aug '21

31 Aug '21

As of qemu commit: commit 497a30dbb065937d67f6c43af6dd78492e1d6f6d qemu-img: Require -F with -b backing image creating images with backing images requires specifying the format. Remove tests which do not pass the backing format on the command line. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- tests/virstoragetest.c | 33 --------------------------------- 1 file changed, 33 deletions(-) diff --git a/tests/virstoragetest.c b/tests/virstoragetest.c index 1b211b60e6..b80818bc7b 100644 --- a/tests/virstoragetest.c +++ b/tests/virstoragetest.c @@ -638,30 +638,6 @@ mymain(void) }; TEST_CHAIN(abswrap, VIR_STORAGE_FILE_QCOW2, (&wrap, &qcow2, &raw), EXP_PASS); - /* Rewrite qcow2 and wrap file to omit backing file type */ - virCommandFree(cmd); - cmd = virCommandNewArgList(qemuimg, "rebase", "-u", "-f", "qcow2", - "-b", absraw, "qcow2", NULL); - if (virCommandRun(cmd, NULL) < 0) - ret = -1; - - virCommandFree(cmd); - cmd = virCommandNewArgList(qemuimg, "rebase", "-u", "-f", "qcow2", - "-b", absqcow2, "wrap", NULL); - if (virCommandRun(cmd, NULL) < 0) - ret = -1; - - /* Qcow2 file with raw as absolute backing, backing format omitted */ - testFileData wrap_as_raw = { - .expBackingStoreRaw = absqcow2, - .expCapacity = 1024, - .path = abswrap, - .type = VIR_STORAGE_TYPE_FILE, - .format = VIR_STORAGE_FILE_QCOW2, - }; - TEST_CHAIN(abswrap, VIR_STORAGE_FILE_QCOW2, - (&wrap_as_raw, &qcow2_as_raw), EXP_FAIL); - /* Rewrite qcow2 to a missing backing file, with backing type */ virCommandFree(cmd); cmd = virCommandNewArgList(qemuimg, "rebase", "-u", "-f", "qcow2", @@ -674,15 +650,6 @@ mymain(void) /* Qcow2 file with missing backing file but specified type */ TEST_CHAIN(absqcow2, VIR_STORAGE_FILE_QCOW2, (&qcow2), EXP_FAIL); - /* Rewrite qcow2 to a missing backing file, without backing type */ - virCommandFree(cmd); - cmd = virCommandNewArgList(qemuimg, "rebase", "-u", "-f", "qcow2", - "-b", datadir "/bogus", "qcow2", NULL); - if (virCommandRun(cmd, NULL) < 0) - ret = -1; - - /* Qcow2 file with missing backing file and no specified type */ - TEST_CHAIN(absqcow2, VIR_STORAGE_FILE_QCOW2, (&qcow2), EXP_FAIL); /* Rewrite qcow2 to use an nbd: protocol as backend */ virCommandFree(cmd); -- 2.31.1

3 2

[libvirt PATCH] news: add FC VMID entry
by Pavel Hrdina 31 Aug '21

31 Aug '21

Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- NEWS.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 200256c299..72b63a19ea 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -17,6 +17,13 @@ v7.7.0 (unreleased) * **New features** + * Add support for Fibre Channel VMID + + New VM element ``<fibrechannel appid=''/>`` was added to allow users set + their ``appid`` for each VM which will be used by kernel to create Fibre + Channel VMID. This allows various QoS levels, access control or collecting + telemetry data per VM. + * **Improvements** * virsh: Allow XML validation for define of: storage pool, network, secret, -- 2.31.1

2 1

[PATCH 1/2] qemu: probe for virtio-blk-pci discard option support
by yuxiating 31 Aug '21

31 Aug '21

Signed-off-by: yuxiating <yuxiating(a)huawei.com> --- src/qemu/qemu_capabilities.c | 2 ++ src/qemu/qemu_capabilities.h | 1 + tests/qemucapabilitiesdata/caps_4.0.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_4.0.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_4.0.0.riscv32.xml | 1 + tests/qemucapabilitiesdata/caps_4.0.0.riscv64.xml | 1 + tests/qemucapabilitiesdata/caps_4.0.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_4.0.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_4.1.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_4.2.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_4.2.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_4.2.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_4.2.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_5.0.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_5.0.0.riscv64.xml | 1 + tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_5.2.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_5.2.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_5.2.0.riscv64.xml | 1 + tests/qemucapabilitiesdata/caps_5.2.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_6.0.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_6.0.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_6.1.0.x86_64.xml | 1 + 27 files changed, 28 insertions(+) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 70c3ec2f0c..78ec31f807 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -638,6 +638,7 @@ VIR_ENUM_IMPL(virQEMUCaps, "query-display-options", /* QEMU_CAPS_QUERY_DISPLAY_OPTIONS */ "s390-pv-guest", /* QEMU_CAPS_S390_PV_GUEST */ "set-action", /* QEMU_CAPS_SET_ACTION */ + "virtio-blk-pci.discard", /* QEMU_CAPS_DEVICE_DISCARD */ ); @@ -1406,6 +1407,7 @@ static struct virQEMUCapsDevicePropsFlags virQEMUCapsDevicePropsVirtioBlk[] = { { "werror", QEMU_CAPS_STORAGE_WERROR, NULL }, { "packed", QEMU_CAPS_VIRTIO_PACKED_QUEUES, NULL }, { "acpi-index", QEMU_CAPS_ACPI_INDEX, NULL }, + { "discard", QEMU_CAPS_DEVICE_DISCARD, NULL }, }; static struct virQEMUCapsDevicePropsFlags virQEMUCapsDevicePropsVirtioNet[] = { diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index bc762d1916..a05c98b71d 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -618,6 +618,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */ QEMU_CAPS_QUERY_DISPLAY_OPTIONS, /* 'query-display-options' qmp command present */ QEMU_CAPS_S390_PV_GUEST, /* -object s390-pv-guest,... */ QEMU_CAPS_SET_ACTION, /* 'set-action' QMP command */ + QEMU_CAPS_DEVICE_DISCARD, /* -device virtio-blk-pci,discard=on/off */ QEMU_CAPS_LAST /* this must always be the last item */ } virQEMUCapsFlags; diff --git a/tests/qemucapabilitiesdata/caps_4.0.0.aarch64.xml b/tests/qemucapabilitiesdata/caps_4.0.0.aarch64.xml index efb891fa01..8603c8a78d 100644 --- a/tests/qemucapabilitiesdata/caps_4.0.0.aarch64.xml +++ b/tests/qemucapabilitiesdata/caps_4.0.0.aarch64.xml @@ -174,6 +174,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>4000000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>61700240</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_4.0.0.ppc64.xml b/tests/qemucapabilitiesdata/caps_4.0.0.ppc64.xml index 1e2b7c7fe6..67c7409176 100644 --- a/tests/qemucapabilitiesdata/caps_4.0.0.ppc64.xml +++ b/tests/qemucapabilitiesdata/caps_4.0.0.ppc64.xml @@ -181,6 +181,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>4000000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>42900240</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_4.0.0.riscv32.xml b/tests/qemucapabilitiesdata/caps_4.0.0.riscv32.xml index 5872ecd491..ed906e4bb3 100644 --- a/tests/qemucapabilitiesdata/caps_4.0.0.riscv32.xml +++ b/tests/qemucapabilitiesdata/caps_4.0.0.riscv32.xml @@ -173,6 +173,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>4000000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>0</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_4.0.0.riscv64.xml b/tests/qemucapabilitiesdata/caps_4.0.0.riscv64.xml index bb76faae2b..66888f597b 100644 --- a/tests/qemucapabilitiesdata/caps_4.0.0.riscv64.xml +++ b/tests/qemucapabilitiesdata/caps_4.0.0.riscv64.xml @@ -173,6 +173,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>4000000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>0</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_4.0.0.s390x.xml b/tests/qemucapabilitiesdata/caps_4.0.0.s390x.xml index 51074b4f37..66ad9021e1 100644 --- a/tests/qemucapabilitiesdata/caps_4.0.0.s390x.xml +++ b/tests/qemucapabilitiesdata/caps_4.0.0.s390x.xml @@ -137,6 +137,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>4000000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>39100240</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_4.0.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_4.0.0.x86_64.xml index 19b8a49394..d349e3e3c8 100644 --- a/tests/qemucapabilitiesdata/caps_4.0.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_4.0.0.x86_64.xml @@ -219,6 +219,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>4000000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100240</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_4.1.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_4.1.0.x86_64.xml index 841b753518..66916fdc67 100644 --- a/tests/qemucapabilitiesdata/caps_4.1.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_4.1.0.x86_64.xml @@ -226,6 +226,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>4001000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100241</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_4.2.0.aarch64.xml b/tests/qemucapabilitiesdata/caps_4.2.0.aarch64.xml index 8116624181..2f2b19d3fa 100644 --- a/tests/qemucapabilitiesdata/caps_4.2.0.aarch64.xml +++ b/tests/qemucapabilitiesdata/caps_4.2.0.aarch64.xml @@ -189,6 +189,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>4001050</version> <kvmVersion>0</kvmVersion> <microcodeVersion>61700242</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_4.2.0.ppc64.xml b/tests/qemucapabilitiesdata/caps_4.2.0.ppc64.xml index d37c9b3426..e6b592a193 100644 --- a/tests/qemucapabilitiesdata/caps_4.2.0.ppc64.xml +++ b/tests/qemucapabilitiesdata/caps_4.2.0.ppc64.xml @@ -188,6 +188,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>4001050</version> <kvmVersion>0</kvmVersion> <microcodeVersion>42900242</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_4.2.0.s390x.xml b/tests/qemucapabilitiesdata/caps_4.2.0.s390x.xml index 258e382232..81754d504d 100644 --- a/tests/qemucapabilitiesdata/caps_4.2.0.s390x.xml +++ b/tests/qemucapabilitiesdata/caps_4.2.0.s390x.xml @@ -150,6 +150,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>4002000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>39100242</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_4.2.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_4.2.0.x86_64.xml index 6e3aa7f5d9..871807ebcb 100644 --- a/tests/qemucapabilitiesdata/caps_4.2.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_4.2.0.x86_64.xml @@ -237,6 +237,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>4002000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100242</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml b/tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml index 4ce8244540..3e6e36eff3 100644 --- a/tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml +++ b/tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml @@ -199,6 +199,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>5000000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>61700241</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_5.0.0.ppc64.xml b/tests/qemucapabilitiesdata/caps_5.0.0.ppc64.xml index 07e00008ee..5b4567ba36 100644 --- a/tests/qemucapabilitiesdata/caps_5.0.0.ppc64.xml +++ b/tests/qemucapabilitiesdata/caps_5.0.0.ppc64.xml @@ -207,6 +207,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>5000000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>42900241</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_5.0.0.riscv64.xml b/tests/qemucapabilitiesdata/caps_5.0.0.riscv64.xml index 1bbb9b98cd..27df3095b5 100644 --- a/tests/qemucapabilitiesdata/caps_5.0.0.riscv64.xml +++ b/tests/qemucapabilitiesdata/caps_5.0.0.riscv64.xml @@ -193,6 +193,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>5000000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>0</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml index 0c28645f69..a79331ee05 100644 --- a/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml @@ -244,6 +244,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>5000000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100241</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml index fd77d9bbc9..e06ec38082 100644 --- a/tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml @@ -246,6 +246,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>5001000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100242</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_5.2.0.aarch64.xml b/tests/qemucapabilitiesdata/caps_5.2.0.aarch64.xml index 4e31d8245e..255319da48 100644 --- a/tests/qemucapabilitiesdata/caps_5.2.0.aarch64.xml +++ b/tests/qemucapabilitiesdata/caps_5.2.0.aarch64.xml @@ -203,6 +203,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>5002000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>61700243</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_5.2.0.ppc64.xml b/tests/qemucapabilitiesdata/caps_5.2.0.ppc64.xml index ac81364857..056ac9795c 100644 --- a/tests/qemucapabilitiesdata/caps_5.2.0.ppc64.xml +++ b/tests/qemucapabilitiesdata/caps_5.2.0.ppc64.xml @@ -209,6 +209,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>5002000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>42900243</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_5.2.0.riscv64.xml b/tests/qemucapabilitiesdata/caps_5.2.0.riscv64.xml index 21a1a5c3dd..64c5eb2fcd 100644 --- a/tests/qemucapabilitiesdata/caps_5.2.0.riscv64.xml +++ b/tests/qemucapabilitiesdata/caps_5.2.0.riscv64.xml @@ -195,6 +195,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>5002000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>0</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_5.2.0.s390x.xml b/tests/qemucapabilitiesdata/caps_5.2.0.s390x.xml index 13caca9626..81779831a2 100644 --- a/tests/qemucapabilitiesdata/caps_5.2.0.s390x.xml +++ b/tests/qemucapabilitiesdata/caps_5.2.0.s390x.xml @@ -157,6 +157,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>5002000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>39100243</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml index 234ac8f7ef..8db0ec48c1 100644 --- a/tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml @@ -247,6 +247,7 @@ <flag name='rotation-rate'/> <flag name='input-linux'/> <flag name='query-display-options'/> + <flag name='virtio-blk-pci.discard'/> <version>5002000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100243</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_6.0.0.aarch64.xml b/tests/qemucapabilitiesdata/caps_6.0.0.aarch64.xml index dcc41ed067..9776b2dfd1 100644 --- a/tests/qemucapabilitiesdata/caps_6.0.0.aarch64.xml +++ b/tests/qemucapabilitiesdata/caps_6.0.0.aarch64.xml @@ -211,6 +211,7 @@ <flag name='confidential-guest-support'/> <flag name='query-display-options'/> <flag name='set-action'/> + <flag name='virtio-blk-pci.discard'/> <version>6000000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>61700242</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_6.0.0.s390x.xml b/tests/qemucapabilitiesdata/caps_6.0.0.s390x.xml index ebcca6e114..a7b8b8b805 100644 --- a/tests/qemucapabilitiesdata/caps_6.0.0.s390x.xml +++ b/tests/qemucapabilitiesdata/caps_6.0.0.s390x.xml @@ -165,6 +165,7 @@ <flag name='query-display-options'/> <flag name='s390-pv-guest'/> <flag name='set-action'/> + <flag name='virtio-blk-pci.discard'/> <version>6000000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>39100242</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml index 4951644354..bc45540def 100644 --- a/tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml @@ -255,6 +255,7 @@ <flag name='confidential-guest-support'/> <flag name='query-display-options'/> <flag name='set-action'/> + <flag name='virtio-blk-pci.discard'/> <version>6000000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100242</microcodeVersion> diff --git a/tests/qemucapabilitiesdata/caps_6.1.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_6.1.0.x86_64.xml index eca9facf80..7b2efe0aee 100644 --- a/tests/qemucapabilitiesdata/caps_6.1.0.x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_6.1.0.x86_64.xml @@ -257,6 +257,7 @@ <flag name='confidential-guest-support'/> <flag name='query-display-options'/> <flag name='set-action'/> + <flag name='virtio-blk-pci.discard'/> <version>6001000</version> <kvmVersion>0</kvmVersion> <microcodeVersion>43100243</microcodeVersion> -- 2.27.0

1 0

[libvirt PATCH] qemu, xen: add missing deps on virtlockd/virtlogd sockets
by Daniel P. Berrangé 31 Aug '21

31 Aug '21

The QEMU driver uses both virtlogd and virtlockd, while the Xen driver uses virtlockd. The libvirtd.service unit contains deps on the socket units for these services, but these deps were missed in the modular daemons. As a result the virtlockd/virtlogd sockets are not started when the virtqemud/virtxend daemons are started. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/libxl/virtxend.service.in | 2 ++ src/qemu/virtqemud.service.in | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/src/libxl/virtxend.service.in b/src/libxl/virtxend.service.in index a863917467..19b19ce3e6 100644 --- a/src/libxl/virtxend.service.in +++ b/src/libxl/virtxend.service.in @@ -1,6 +1,7 @@ [Unit] Description=Virtualization xen daemon Conflicts=libvirtd.service +Requires=virtlockd.socket Requires=virtxend.socket Requires=virtxend-ro.socket Requires=virtxend-admin.socket @@ -25,6 +26,7 @@ KillMode=process [Install] WantedBy=multi-user.target +Also=virtlockd.socket Also=virtxend.socket Also=virtxend-ro.socket Also=virtxend-admin.socket diff --git a/src/qemu/virtqemud.service.in b/src/qemu/virtqemud.service.in index 8abc9d3a7f..20e1b43a6e 100644 --- a/src/qemu/virtqemud.service.in +++ b/src/qemu/virtqemud.service.in @@ -1,6 +1,8 @@ [Unit] Description=Virtualization qemu daemon Conflicts=libvirtd.service +Requires=virtlogd.socket +Requires=virtlockd.socket Requires=virtqemud.socket Requires=virtqemud-ro.socket Requires=virtqemud-admin.socket @@ -42,6 +44,8 @@ LimitMEMLOCK=64M [Install] WantedBy=multi-user.target +Also=virtlogd.socket +Also=virtlockd.socket Also=virtqemud.socket Also=virtqemud-ro.socket Also=virtqemud-admin.socket -- 2.31.1

2 1

[libvirt PATCH] rpm: fix typo in post transaction scriptlet name
by Daniel P. Berrangé 31 Aug '21

31 Aug '21

Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index b01379d242..624b0e0302 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1441,7 +1441,7 @@ fi %preun daemon-driver-secret %libvirt_daemon_systemd_preun virtsecretd -%posttranstrans daemon-driver-secret +%posttrans daemon-driver-secret %libvirt_daemon_perform_restart virtsecretd -- 2.31.1

3 2

[PATCH 0/1] qemu: add virtio-blk queue-size option
by Hiroki Narukawa 31 Aug '21

31 Aug '21

Hello, The option "queue-size" in virtio-blk was added in qemu-2.12.0, and default value increased from qemu-5.0.0. However, increasing this value may lead to drop of random access performance. This is configurable value, so we want to use it via libvirt. Could you review this patch? Hiroki Narukawa (1): qemu: add virtio-blk queue-size option docs/schemas/domaincommon.rng | 5 +++ src/conf/domain_conf.c | 6 ++++ src/conf/domain_conf.h | 1 + src/qemu/qemu_capabilities.c | 5 +++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 3 ++ src/qemu/qemu_validate.c | 7 ++++ .../caps_2.12.0.aarch64.xml | 1 + .../caps_2.12.0.s390x.xml | 1 + .../qemucapabilitiesdata/caps_3.0.0.ppc64.xml | 1 + .../caps_3.0.0.riscv32.xml | 1 + .../caps_3.0.0.riscv64.xml | 1 + .../qemucapabilitiesdata/caps_3.0.0.s390x.xml | 1 + .../caps_3.0.0.x86_64.xml | 1 + .../qemucapabilitiesdata/caps_3.1.0.ppc64.xml | 1 + .../caps_3.1.0.x86_64.xml | 1 + .../caps_4.0.0.aarch64.xml | 1 + .../qemucapabilitiesdata/caps_4.0.0.ppc64.xml | 1 + .../caps_4.0.0.riscv32.xml | 1 + .../caps_4.0.0.riscv64.xml | 1 + .../qemucapabilitiesdata/caps_4.0.0.s390x.xml | 1 + .../caps_4.0.0.x86_64.xml | 1 + .../caps_4.1.0.x86_64.xml | 1 + .../caps_4.2.0.aarch64.xml | 1 + .../qemucapabilitiesdata/caps_4.2.0.ppc64.xml | 1 + .../qemucapabilitiesdata/caps_4.2.0.s390x.xml | 1 + .../caps_4.2.0.x86_64.xml | 1 + .../caps_5.0.0.aarch64.xml | 1 + .../qemucapabilitiesdata/caps_5.0.0.ppc64.xml | 1 + .../caps_5.0.0.riscv64.xml | 1 + .../caps_5.0.0.x86_64.xml | 1 + .../qemucapabilitiesdata/caps_5.1.0.sparc.xml | 1 + .../caps_5.1.0.x86_64.xml | 1 + .../caps_5.2.0.aarch64.xml | 1 + .../qemucapabilitiesdata/caps_5.2.0.ppc64.xml | 1 + .../caps_5.2.0.riscv64.xml | 1 + .../qemucapabilitiesdata/caps_5.2.0.s390x.xml | 1 + .../caps_5.2.0.x86_64.xml | 1 + .../caps_6.0.0.aarch64.xml | 1 + .../qemucapabilitiesdata/caps_6.0.0.s390x.xml | 1 + .../caps_6.0.0.x86_64.xml | 1 + .../caps_6.1.0.x86_64.xml | 1 + .../disk-virtio-queue-size.args | 29 +++++++++++++++ .../disk-virtio-queue-size.xml | 35 +++++++++++++++++++ tests/qemuxml2argvtest.c | 2 ++ .../disk-virtio-queue-size.xml | 35 +++++++++++++++++++ tests/qemuxml2xmltest.c | 1 + 47 files changed, 165 insertions(+) create mode 100644 tests/qemuxml2argvdata/disk-virtio-queue-size.args create mode 100644 tests/qemuxml2argvdata/disk-virtio-queue-size.xml create mode 100644 tests/qemuxml2xmloutdata/disk-virtio-queue-size.xml -- 2.17.1

1 1

[PATCH] qemuProcessSetupDisksTransientHotplug: Add checking set-action capability
by Masayoshi Mizuma 31 Aug '21

31 Aug '21

From: Masayoshi Mizuma <m.mizuma(a)jp.fujitsu.com> The VM is terminated abnormally when <transient shareBacking='yes'/> is set to the disk option and the qemu doesn't have set-action capability. # virsh start guest01 error: Failed to start domain 'guest01' error: internal error: qemu unexpectedly closed the monitor # Add checking the capability before system_reset QMP command is sent so that the VM can stop correctly when the qemu doesn't have the cap. Signed-off-by: Masayoshi Mizuma <m.mizuma(a)jp.fujitsu.com> --- src/qemu/qemu_process.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 3b4af61bf8..4bedd04679 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -7010,6 +7010,9 @@ qemuProcessSetupDisksTransientHotplug(virDomainObj *vm, if (hasHotpluggedDisk) { int rc; + if (!(virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_SET_ACTION))) + return -1; + if (qemuDomainObjEnterMonitorAsync(priv->driver, vm, asyncJob) < 0) return -1; -- 2.27.0

3 3

Entering freeze for libvirt-7.7.0
by Jiri Denemark 30 Aug '21

30 Aug '21

I have just tagged v7.7.0-rc1 in the repository and pushed signed tarballs and source RPMs to https://libvirt.org/sources/ Please give the release candidate some testing and in case you find a serious issue which should have a fix in the upcoming release, feel free to reply to this thread to make sure the issue is more visible. If you have not done so yet, please update NEWS.rst to document any significant change you made since the last release. Thanks, Jirka

2 2

[PATCH] qemu: fix iothread residual when qemuProcessSetupIOThread failed
by Wang Xin 30 Aug '21

30 Aug '21

From: Lei Yang <yanglei209(a)huawei.com> In process of iothread hotplug, qemuDomainHotplugAddIOThread() calls qemuProcessSetupIOThread(). When qemuProcessSetupIOThread() returned a failure, only the cgroup directory 'iothread' was cleaned up within the function. Right after that qemuDomainHotplugAddIOThread() would return failure directly without rolling back the livedef and iothread process that created previously. Further, when 'virsh schedinfo domain --live' requires schedinfo of such machine, the interface will always return a failure print as follows: 'Failed to create v1 controller cpu for group: No such file or directory'. The reason is qemuGetIOThreadsBWLive() using member vm->def->iothreadids[0]->iothread_id to findout the corresponding cgroup dircetory. In case mentioned previously, iothreadids[0] was not been cleaned up while whose cgroup directroy has already been removed. This patch rolls back the livedef and iothread process after qemuProcessSetupIOThread() returned a failure. Of course we are not limited to this function, we also perform the same rolling back after any exception proecss in qemuDomainHotplugAddIOThread(). Signed-off-by: Lei Yang <yanglei209(a)huawei.com> Signed-off-by: Wang Xin <wangxinxin.wang(a)huawei.com> diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c old mode 100644 new mode 100755 index f1f961c51c..4f09e82a13 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5293,6 +5293,7 @@ qemuDomainHotplugAddIOThread(virQEMUDriver *driver, qemuMonitorIOThreadInfo **new_iothreads = NULL; virDomainIOThreadIDDef *iothrid; virJSONValue *props = NULL; + bool objectHasAdded = false; if (!(alias = g_strdup_printf("iothread%u", iothread_id))) return -1; @@ -5305,6 +5306,8 @@ qemuDomainHotplugAddIOThread(virQEMUDriver *driver, if (qemuMonitorAddObject(priv->mon, &props, NULL) < 0) goto exit_monitor; + objectHasAdded = true; + exp_niothreads++; /* After hotplugging the IOThreads we need to re-detect the @@ -5352,6 +5355,13 @@ qemuDomainHotplugAddIOThread(virQEMUDriver *driver, ret = 0; cleanup: + if (ret < 0 && objectHasAdded) { + qemuDomainObjEnterMonitor(driver, vm); + if (qemuMonitorDelObject(priv->mon, alias, true) < 0) + VIR_WARN("del iothread %d of %s failed when cleanup", iothread_id, vm->def->name); + ignore_value(qemuDomainObjExitMonitor(driver, vm)); + } + if (new_iothreads) { for (idx = 0; idx < new_niothreads; idx++) VIR_FREE(new_iothreads[idx]); @@ -5360,6 +5370,8 @@ qemuDomainHotplugAddIOThread(virQEMUDriver *driver, virDomainAuditIOThread(vm, orig_niothreads, new_niothreads, "update", ret == 0); virJSONValueFree(props); + if (ret < 0) + virDomainIOThreadIDDel(vm->def, iothread_id); return ret; exit_monitor: -- 2.26.0.windows.1

1 0

[PATCH v3 0/4] Dirty Ring support (Libvirt)
by huangy81＠chinatelecom.cn 30 Aug '21

30 Aug '21

From: Hyman Huang(黄勇) <huangy81(a)chinatelecom.cn> v3 - rebase master and fix the confilict when apply "conf: introduce dirty_ring_size in struct "_virDomainDef" to current master. v2 - split patchset into 4 patches - leave out the tcg case when building commandline. - handle the VIR_DOMAIN_KVM_DIRTY_RING case independently in , virDomainFeatureDefParse and virDomainDefFeaturesCheckABIStability, do not integrate it with other cases... - add dirty ring size check in virDomainDefFeaturesCheckABIStability - modify zero checks on integers of dirty ring size in a explicit way. - set the default value of dirty ring size in a post-parser callback. - check the absence of kvm_feature in a explicit way. - code clean of virTristateSwitchTypeToString function. this version's modification base on Peter's advices mostly, thanks a lot, please review ! Best Regards ! Hyman Huang(黄勇) v1 since qemu has introduced a dirty ring feature in 6.1.0, may be it's the right time to introduce dirty ring in libvirt meanwhile. this patch add feature named 'dirty-ring', which enable dirty ring feature when starting vm. to try this out, three things has done in this patchset: - introduce QEMU_CAPS_ACCEL so the the libvirt can use it to select the right option when specifying the accelerator type. - switch the option "-machine accel=xxx" to "-accel xxx" when specifying accelerator type once libvirt build QEMU command line, so that dirty-ring-size property can be passed to qemu when start vm. - introduce dirty_ring_size to hold the ring size configured by user and pass dirty_ring_size when building qemu commandline if dirty ring feature enabled. though dirty ring is per-cpu logically, the size of dirty ring is registered by 'struct kvm' in QEMU. so we would like to place the dirty_ring_size as a property of vm in Libvirt as the QEMU do. the dirty ring feature is disabled by default, and if enabled, the default value of ring size if 4096 if size not configured. for more details about dirty ring and "-accel" option, please refer to: https://lore.kernel.org/qemu-devel/20210108165050.406906-10-peterx@redhat.c… https://lore.kernel.org/qemu-devel/3aa73987-40e8-3619-0723-9f17f73850bd@red… please review, Thanks! Best Regards ! Hyman Huang(黄勇) (4): qemu_capabilities: introduce QEMU_CAPS_ACCEL qemu_command: switch accelerator option to new style conf: introduce dirty_ring_size in struct "_virDomainDef" qemu: support dirty ring feature docs/formatdomain.rst | 16 +++-- docs/schemas/domaincommon.rng | 10 +++ src/conf/domain_conf.c | 74 +++++++++++++++++++++- src/conf/domain_conf.h | 4 ++ src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 40 +++++++++++- tests/qemucapabilitiesdata/caps_2.11.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.11.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_3.0.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_3.0.0.riscv32.xml | 1 + tests/qemucapabilitiesdata/caps_3.0.0.riscv64.xml | 1 + tests/qemucapabilitiesdata/caps_3.0.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_3.0.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_3.1.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_3.1.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_4.0.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_4.0.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_4.0.0.riscv32.xml | 1 + tests/qemucapabilitiesdata/caps_4.0.0.riscv64.xml | 1 + tests/qemucapabilitiesdata/caps_4.0.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_4.0.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_4.1.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_4.2.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_4.2.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_4.2.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_4.2.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_5.0.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_5.0.0.riscv64.xml | 1 + tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_5.1.0.sparc.xml | 1 + tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_5.2.0.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_5.2.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_5.2.0.riscv64.xml | 1 + tests/qemucapabilitiesdata/caps_5.2.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_6.0.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_6.1.0.x86_64.xml | 1 + ...64-default-cpu-kvm-virt-4.2.aarch64-latest.args | 3 +- .../aarch64-features-sve.aarch64-latest.args | 3 +- .../channel-unix-guestfwd.x86_64-latest.args | 3 +- .../clock-timer-armvtimer.aarch64-latest.args | 3 +- .../console-virtio-unix.x86_64-latest.args | 3 +- .../cpu-Icelake-Server-pconfig.x86_64-3.1.0.args | 3 +- .../cpu-Icelake-Server-pconfig.x86_64-latest.args | 3 +- .../cpu-tsc-frequency.x86_64-4.0.0.args | 3 +- .../cpu-tsc-high-frequency.x86_64-latest.args | 3 +- .../default-video-type-aarch64.aarch64-latest.args | 3 +- .../default-video-type-ppc64.ppc64-latest.args | 3 +- .../default-video-type-s390x.s390x-latest.args | 3 +- .../disk-cdrom-network.x86_64-2.12.0.args | 3 +- .../disk-cdrom-network.x86_64-latest.args | 3 +- .../disk-network-http.x86_64-latest.args | 3 +- .../hugepages-memaccess3.x86_64-latest.args | 3 +- .../intel-iommu-aw-bits.x86_64-latest.args | 3 +- .../intel-iommu-caching-mode.x86_64-latest.args | 3 +- .../intel-iommu-device-iotlb.x86_64-latest.args | 3 +- .../intel-iommu-eim.x86_64-latest.args | 3 +- ...ty-sev-missing-platform-info.x86_64-2.12.0.args | 3 +- .../launch-security-sev.x86_64-2.12.0.args | 3 +- .../launch-security-sev.x86_64-6.0.0.args | 3 +- ...emfd-memory-default-hugepage.x86_64-latest.args | 3 +- .../memfd-memory-numa.x86_64-latest.args | 3 +- .../memory-hotplug-virtio-pmem.x86_64-5.2.0.args | 3 +- .../memory-hotplug-virtio-pmem.x86_64-latest.args | 3 +- .../os-firmware-bios.x86_64-latest.args | 3 +- ...irmware-efi-no-enrolled-keys.x86_64-latest.args | 3 +- .../os-firmware-efi-secboot.x86_64-latest.args | 3 +- .../os-firmware-efi.x86_64-latest.args | 3 +- .../parallel-unix-chardev.x86_64-latest.args | 3 +- ...4-default-cpu-kvm-pseries-2.7.ppc64-latest.args | 3 +- ...4-default-cpu-kvm-pseries-3.1.ppc64-latest.args | 3 +- ...4-default-cpu-kvm-pseries-4.2.ppc64-latest.args | 3 +- ...efault-cpu-kvm-ccw-virtio-2.7.s390x-latest.args | 3 +- ...efault-cpu-kvm-ccw-virtio-4.2.s390x-latest.args | 3 +- .../smartcard-passthrough-unix.x86_64-latest.args | 3 +- .../usb-redir-unix.x86_64-latest.args | 3 +- .../vhost-user-fs-fd-memory.x86_64-latest.args | 3 +- .../virtio-rng-builtin.x86_64-5.2.0.args | 3 +- .../virtio-rng-builtin.x86_64-latest.args | 3 +- .../virtio-rng-egd-unix.x86_64-5.2.0.args | 3 +- .../virtio-rng-egd-unix.x86_64-latest.args | 3 +- ...86_64-default-cpu-kvm-pc-4.2.x86_64-latest.args | 3 +- ...6_64-default-cpu-kvm-q35-4.2.x86_64-latest.args | 3 +- 91 files changed, 268 insertions(+), 55 deletions(-) -- 1.8.3.1

2 5

[PATCH] NEWS: Move my contributions to correct release
by Michal Privoznik 27 Aug '21

27 Aug '21

In previous commit I've documented my contributions for upcoming 7.7.0 release. But unfortunately I've placed the lines into wrong release (7.6.0). Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- NEWS.rst | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/NEWS.rst b/NEWS.rst index e8a1f70788..1af934e068 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -40,8 +40,25 @@ v7.7.0 (unreleased) The qemu driver uses the APIs to label vhostuser ports on hotplug and restore labeling on unplug. + * vmx: Parse vm.genid and support super wide SCSI bus + + The genid attribute is now reported for VMX guests. Libvirt can now + properly process super wide SCSI bus (64 units). + * **Bug fixes** + * qemu: Open chardev logfile on behalf of QEMU + + Guests with a logfile configured for their chardevs are now able to start + even when no virtlogd is configured. + + * virhostmem: Handle numactl-less build in hugepages allocation/reporting + + Some architectures don't have notion of NUMA (e.g. s390x) but do support + hugepages. Libvirt silently ignored requests to allocate/report hugepage + pool when built without numactl. This is now fixed and the pool can be + allocated/reported on properly. + v7.6.0 (2021-08-02) =================== @@ -126,11 +143,6 @@ v7.5.0 (2021-07-01) Since it's impossible to fix it without running into further regressions the documentation was improved to document the intricacies. - * vmx: Parse vm.genid and support super wide SCSI bus - - The genid attribute is now reported for VMX guests. Libvirt can now - properly process super wide SCSI bus (64 units). - * **Bug fixes** * qemu: Fixed validation of disk ``iothread`` configuration @@ -139,18 +151,6 @@ v7.5.0 (2021-07-01) it caused bogus errors when address wasn't allocated when hotplugging a disk. The check is now removed as it wasn't actually necessary at all. - * qemu: Open chardev logfile on behalf of QEMU - - Guests with a logfile configured for their chardevs are now able to start - even when no virtlogd is configured. - - * virhostmem: Handle numactl-less build in hugepages allocation/reporting - - Some architectures don't have notion of NUMA (e.g. s390x) but do support - hugepages. Libvirt silently ignored requests to allocate/report hugepage - pool when built without numactl. This is now fixed and the pool can be - allocated/reported on properly. - v7.4.0 (2021-06-01) =================== -- 2.31.1

2 1

[PATCH] NEWS: Document new '--validate' option for virsh define commands
by Kristina Hanicova 27 Aug '21

27 Aug '21

Signed-off-by: Kristina Hanicova <khanicov(a)redhat.com> --- NEWS.rst | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 21df0e1602..b9edb7dc68 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -19,6 +19,20 @@ v7.7.0 (unreleased) * **Improvements** + * virsh: Allow XML validation for define of: storage pool, network, secret, + nwfilter, interface + + * Add flag ``VIR_STORAGE_POOL_DEFINE_VALIDATE`` to validate storage pool + input xml. For virsh, users can use it as ``virsh pool-define --validate``. + * Add flag ``VIR_NETWORK_DEFINE_VALIDATE`` to validate network input xml. For + virsh, users can use it as ``net-define --validate``. + * Add flag ``VIR_SECRET_DEFINE_VALIDATE`` to validate secret input xml. For + virsh, users can use it as ``secret-define --validate``. + * Add flag ``VIR_NWFILTER_DEFINE_VALIDATE`` to validate nwfilter input xml. + For virsh, users can use it as ``nwfilter-define --validate``. + * Add flag ``VIR_INTERFACE_DEFINE_VALIDATE`` to validate interface input xml. + For virsh, users can use it as ``iface-define --validate``. + * **Bug fixes** -- 2.31.1

2 1

[PATCH 0/2] NEWS updates for the upcoming release
by Peter Krempa 27 Aug '21

27 Aug '21

Note that the changes described in 2/2 are not pushed yet. Peter Krempa (2): NEWS: Mention bug with incorrect format recorded for qcow2+luks overlays NEWS: Update with description of changes to lifecycle action handling NEWS.rst | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) -- 2.31.1

2 3

[PATCH] NEWS: Mention new SecurityManager APIs for labeling network devices
by Jim Fehlig 27 Aug '21

27 Aug '21

Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- NEWS.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 21df0e1602..744f445319 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -19,6 +19,13 @@ v7.7.0 (unreleased) * **Improvements** + * Add SecurityManager APIs for labeling network devices + + New ``virSecurityManagerSetNetdevLabel`` and ``virSecurityManagerSetNetdevLabel`` + APIs are introduced and implemented in the Apparmor security driver. + The qemu driver uses the APIs to label vhostuser ports on hotplug and + restore labeling on unplug. + * **Bug fixes** -- 2.32.0

2 1

[PATCH] NEWS: Document my contributions for the upcoming release
by Michal Privoznik 27 Aug '21

27 Aug '21

Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- NEWS.rst | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 21df0e1602..1a8abb56f4 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -105,6 +105,11 @@ v7.5.0 (2021-07-01) Since it's impossible to fix it without running into further regressions the documentation was improved to document the intricacies. + * vmx: Parse vm.genid and support super wide SCSI bus + + The genid attribute is now reported for VMX guests. Libvirt can now + properly process super wide SCSI bus (64 units). + * **Bug fixes** * qemu: Fixed validation of disk ``iothread`` configuration @@ -113,6 +118,18 @@ v7.5.0 (2021-07-01) it caused bogus errors when address wasn't allocated when hotplugging a disk. The check is now removed as it wasn't actually necessary at all. + * qemu: Open chardev logfile on behalf of QEMU + + Guests with a logfile configured for their chardevs are now able to start + when even no virtlogd is configured. + + * virhostmem: Handle numactl-less build in hugepages allocation/reporting + + Some architectures don't have notion of NUMA (e.g. s390x) but do support + hugepages. Libvirt silently ignored requests to allocate/report hugepage + pool when built without numactl. This is now fixed and the pool can be + allocated/reported on properly. + v7.4.0 (2021-06-01) =================== -- 2.31.1

2 1

[libvirt PATCH 00/11] Automatic mutex management
by Tim Wiederhake 27 Aug '21

27 Aug '21

libvirt currently manages mutexes manually. Manual mutex management suffers from the same drawbacks as manual memory management, and at least one lock-unlock mismatch exists currently in the code base, see https://listman.redhat.com/archives/libvir-list/2021-August/msg00125.html. This series lays the ground work for automatic mutex management in libvirt. Later series will continue to replace calls to virMutex{Lock,Unlock} and virObject{Lock,Unlock}. Patches 1 - 3 deal with a bug in clang (see patch 1 for explanation), patches 4 - 6 introduce a new type, virLockGuard, that handles the automatic mutex management, and patches 7-11 demonstrate the application of this new type. Patches that eliminate the majority of calls to virMutex{Lock,Unlock} are on stand-by, as well as patches that provide virLockGuard support for virObject and will be send once this series is accepted. Regards, Tim Tim Wiederhake (11): glibcompat: Add wrapper for g_auto* VIR_XPATH_NODE_AUTORESTORE: Add semicolon virxml: Simplify VIR_XPATH_NODE_AUTORESTORE internal: Add CONCAT macro virthread: Introduce virLockGuard virthread: Introduce WITH_VIR_MUTEX_LOCK_GUARD virChrdevFDStreamCloseCb: Use virLockGuard virChrdevFree: Use virLockGuard virChrdevOpen: Use virLockGuard networkBridgeNameValidate: Use virLockGuard networkBridgeNameValidate: Cleanup src/conf/backup_conf.c | 2 +- src/conf/checkpoint_conf.c | 2 +- src/conf/cpu_conf.c | 2 +- src/conf/domain_conf.c | 140 ++++++++++++++--------------- src/conf/interface_conf.c | 8 +- src/conf/netdev_vlan_conf.c | 2 +- src/conf/network_conf.c | 14 +-- src/conf/networkcommon_conf.c | 2 +- src/conf/node_device_conf.c | 42 ++++----- src/conf/numa_conf.c | 6 +- src/conf/snapshot_conf.c | 2 +- src/conf/storage_adapter_conf.c | 2 +- src/conf/storage_conf.c | 4 +- src/conf/storage_encryption_conf.c | 4 +- src/conf/storage_source_conf.c | 2 +- src/conf/virchrdev.c | 26 ++---- src/conf/virsavecookie.c | 2 +- src/cpu/cpu_map.c | 4 +- src/cpu/cpu_x86.c | 2 +- src/internal.h | 3 + src/libvirt_private.syms | 3 + src/lxc/lxc_domain.c | 2 +- src/network/bridge_driver.c | 11 +-- src/qemu/qemu_capabilities.c | 2 +- src/qemu/qemu_domain.c | 8 +- src/qemu/qemu_domainjob.c | 2 +- src/qemu/qemu_migration_cookie.c | 8 +- src/util/glibcompat.h | 20 +++++ src/util/virthread.c | 26 ++++++ src/util/virthread.h | 30 +++++++ src/util/virxml.h | 6 +- 31 files changed, 228 insertions(+), 161 deletions(-) -- 2.31.1

4 18

[libvirt PATCH] src: fix generation of default resource partition
by Pavel Hrdina 26 Aug '21

26 Aug '21

Now that resource structure can have appid as well we need to adapt code that creates default resource partition if not provided by user. Otherwise starting a VM with appid defined would fail with following error: error: unsupported configuration: Resource partition '(null)' must start with '/' Fixes: 38b5f4faabccf681439d99e5394954c6ef7a5a40 Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/lxc/lxc_process.c | 10 ++++------ src/qemu/qemu_cgroup.c | 12 ++++-------- 2 files changed, 8 insertions(+), 14 deletions(-) diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c index cfa009f14e..d262128a50 100644 --- a/src/lxc/lxc_process.c +++ b/src/lxc/lxc_process.c @@ -1258,13 +1258,11 @@ int virLXCProcessStart(virConnectPtr conn, return -1; } - if (!vm->def->resource) { - virDomainResourceDef *res = g_new0(virDomainResourceDef, 1); + if (!vm->def->resource) + vm->def->resource = g_new0(virDomainResourceDef, 1); - res->partition = g_strdup("/machine"); - - vm->def->resource = res; - } + if (!vm->def->resource->partition) + vm->def->resource->partition = g_strdup("/machine"); logfile = g_strdup_printf("%s/%s.log", cfg->logDir, vm->def->name); diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c index 42dba1750d..6d4a82b3cd 100644 --- a/src/qemu/qemu_cgroup.c +++ b/src/qemu/qemu_cgroup.c @@ -949,15 +949,11 @@ qemuInitCgroup(virDomainObj *vm, virCgroupFree(priv->cgroup); priv->cgroup = NULL; - if (!vm->def->resource) { - virDomainResourceDef *res; + if (!vm->def->resource) + vm->def->resource = g_new0(virDomainResourceDef, 1); - res = g_new0(virDomainResourceDef, 1); - - res->partition = g_strdup("/machine"); - - vm->def->resource = res; - } + if (!vm->def->resource->partition) + vm->def->resource->partition = g_strdup("/machine"); if (!g_path_is_absolute(vm->def->resource->partition)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, -- 2.31.1

2 1

[libvirt PATCH 00/13] selinux: introduce sVirt policy and build
by Daniel P. Berrangé 26 Aug '21

26 Aug '21

This is an extension of https://listman.redhat.com/archives/libvir-list/2021-July/msg00167.html The original patches from that series are unchanged apart from the commit message, and tweak to the min fedora version in the RPM. I then include various refactors/cleanups. On Fedora 34 I notice the following: ../src/security/selinux/virt.te:579: Warning: fs_rw_anon_inodefs_files(virtd_t) has been deprecated. All calls can be safely removed. ../src/security/selinux/virt.te:580: Warning: fs_list_inotifyfs(virtd_t) has been deprecated. All calls can be safely removed. ../src/security/selinux/virt.te:985: Warning: fs_rw_anon_inodefs_files(virt_domain) has been deprecated. All calls can be safely removed. ../src/security/selinux/virt.te:1520: Warning: fs_list_inotifyfs(svirt_sandbox_domain) has been deprecated. All calls can be safely removed. assuming those warnings are correct, we can delete a few things from the policy, but that's not done here. Daniel P. Berrangé (10): selinux: remove redundant use of 'set_variable' function selinux: move selinux policy build helper to scripts directory selinux: don't hardcode paths to selinux tools selinux: don't hardcode policy include files directory rpm: move logic for setting selinux policy variables rpm: rename selinux variables to improve clarity selinux: introduce meson option for selinux policy install selinux: remove duplicate sources list for policy scripts: use variables for cli args in selinux helper scripts: factor repeated path joins from selinux helper Nikola Knazekova (1): security: add SELinux policy for virt Vit Mojzis (2): selinux: introduce build, install, packaging for selinux policy Install selinux-policy-devel in test environment ci/containers/centos-8.Dockerfile | 1 + ci/containers/centos-stream-8.Dockerfile | 1 + ci/containers/fedora-33.Dockerfile | 1 + ci/containers/fedora-34.Dockerfile | 1 + .../fedora-rawhide-cross-mingw32.Dockerfile | 1 + .../fedora-rawhide-cross-mingw64.Dockerfile | 1 + ci/containers/fedora-rawhide.Dockerfile | 1 + libvirt.spec.in | 100 + meson.build | 1 + meson_options.txt | 2 + scripts/meson.build | 1 + scripts/selinux-compile-policy.py | 156 ++ src/security/meson.build | 2 + src/security/selinux/mcs/meson.build | 17 + src/security/selinux/meson.build | 45 + src/security/selinux/mls/meson.build | 17 + src/security/selinux/virt.fc | 111 + src/security/selinux/virt.if | 1984 ++++++++++++++++ src/security/selinux/virt.te | 2078 +++++++++++++++++ 19 files changed, 4521 insertions(+) create mode 100755 scripts/selinux-compile-policy.py create mode 100644 src/security/selinux/mcs/meson.build create mode 100644 src/security/selinux/meson.build create mode 100644 src/security/selinux/mls/meson.build create mode 100644 src/security/selinux/virt.fc create mode 100644 src/security/selinux/virt.if create mode 100644 src/security/selinux/virt.te -- 2.31.1

3 23

[RFC 0/7] introduce support for live appid updates
by Pavel Hrdina 25 Aug '21

25 Aug '21

I'm posting this as an RFC mainly because I'm not sure how to model the new API. This patches introduce a new naive API that will change only the APPID and nothing else. Currently there are no other known features related to Fibre Channel resources so this non-extendable API will be sufficient, however the appid lives in <resource> element in the XML where we currently have root cgroup partition. Even though changing the partition will not be supported and we don't know about anything else that could be placed here it doesn't mean it will not happen in the future. In that case we would have to add new API as well. So I'm wondering if we should create a more generic API that would take typed parameters as arguments: int virDomainSetResource(virDomainPtr domain, virTypedParameterPtr params, int nparams, unsigned int flags) Any ideas? Pavel Hrdina (7): conf: extract appid validation to virDomainDefResourceAppidValidate cgroup: extract setting fibre channel appid into virCgroupSetFCAppid virCgroupSetFCAppid: properly handle when appid is NULL src: introduce virDomainSetFibreChannelAppid API remote: add RPC support for the virDomainSetFibreChannelAppid API qemu: implement virDomainSetFibreChannelAppid API tools: introduce virsh setappid command docs/manpages/virsh.rst | 14 ++++++ include/libvirt/libvirt-domain.h | 4 ++ src/conf/domain_validate.c | 42 ++++++++++-------- src/conf/domain_validate.h | 2 + src/driver-hypervisor.h | 6 +++ src/libvirt-domain.c | 44 +++++++++++++++++++ src/libvirt_private.syms | 2 + src/libvirt_public.syms | 1 + src/qemu/qemu_cgroup.c | 17 +------- src/qemu/qemu_driver.c | 75 ++++++++++++++++++++++++++++++++ src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 14 +++++- src/remote_protocol-structs | 6 +++ src/util/vircgroup.c | 24 ++++++++++ src/util/vircgroup.h | 3 ++ tools/virsh-domain.c | 65 +++++++++++++++++++++++++++ 16 files changed, 286 insertions(+), 34 deletions(-) -- 2.31.1

1 7

[libvirt PATCH 00/11] Attempt to rewrite group-qemu-caps.py in Python
by Ján Tomko 25 Aug '21

25 Aug '21

Disclaimer: I don't really know Python Ján Tomko (11): scripts: group-qemu-caps: read file separately in load_caps_flags scripts: group-qemu-caps: store paths in helper variables scripts: group-qemu-caps: remove cryptic bool from load_caps_flags scripts: group-qemu-caps: remove unnecessary regexes scripts: group-qemu-caps: split lines in regroup_caps scripts: group-qemu-caps: introduce load_file scripts: group-qemu-caps: introduce find_markers scripts: group-qemu-caps: introduce check_wrapping scripts: group-qemu-caps: only pass relevant lines to regroup_caps scripts: group-qemu-caps: reorder arguments scripts: group-qemu-caps: remove Errs variable scripts/group-qemu-caps.py | 172 +++++++++++++++++++------------------ 1 file changed, 90 insertions(+), 82 deletions(-) -- 2.31.1

3 14

[libvirt PATCH] tests: Fix typos
by Tim Wiederhake 25 Aug '21

25 Aug '21

Signed-off-by: Tim Wiederhake <twiederh(a)redhat.com> --- tests/qemuxml2argvtest.c | 2 +- tests/testutilsqemu.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 0cc4e8a73b..aa2afd878b 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -2093,7 +2093,7 @@ mymain(void) DO_TEST_CAPS_VER("cpu-host-model", "6.0.0"); DO_TEST_CAPS_VER("cpu-host-model", "6.1.0"); - /* For this specific test we accept the increased likelyhood of changes + /* For this specific test we accept the increased likelihood of changes * if qemu updates the CPU model */ DO_TEST_CAPS_LATEST("cpu-host-model"); diff --git a/tests/testutilsqemu.c b/tests/testutilsqemu.c index ea9a283297..164d601613 100644 --- a/tests/testutilsqemu.c +++ b/tests/testutilsqemu.c @@ -750,7 +750,7 @@ testQemuInfoInitArgs(struct testQemuInfo *info) info->args.newargs = false; if (info->args.invalidarg) { - fprintf(stderr, "Invalid agument encountered by 'testQemuInfoSetArgs'\n"); + fprintf(stderr, "Invalid argument encountered by 'testQemuInfoSetArgs'\n"); return -1; } -- 2.31.1

2 1

[PATCH 0/4] Appease Clang
by Michal Privoznik 25 Aug '21

25 Aug '21

With its recent update Clang-13.0.1-rc1 started to report spurious warnings. Basically it is concerned about our use of g_auto*: g_autofree char *var = NULL; var = func(); It fails to see that @var is there to automatically free retval of func(). I've reported the bug here: https://bugs.llvm.org/show_bug.cgi?id=36627 But there are few places where we can change the code and appease Clang. The rest, where our code is correct - I'm "fixing" those places in patch 4/4 which exists only to show that after the problematic pattern is broken the build passes again: https://gitlab.com/MichalPrivoznik/libvirt/-/jobs/1532513684 Michal Prívozník (4): virpci: Avoid Clang false positive test: Drop unused @cfg from qemu*test virscsi: Drop @tmp from virSCSIDeviceListDel DO NOT MERGE src/rpc/virnetclient.c | 9 ++++++--- src/util/viridentity.c | 3 ++- src/util/virpci.c | 4 ++-- src/util/virscsi.c | 3 +-- tests/qemumigrationcookiexmltest.c | 2 -- tests/qemustatusxml2xmltest.c | 2 -- 6 files changed, 11 insertions(+), 12 deletions(-) -- 2.31.1

2 7

[PATCH] qemu: snapshot: Translate 'volume' disks before attempting offline snapshot manipulation
by Peter Krempa 25 Aug '21

25 Aug '21

When the VM is inactive the 'virStorageSource' struct doesn't have the necessary data pointing to the actual storage. This is a problem for inactive snapshot operations on VMs which use disk type='volume'. Add the translation steps for reversion and deletion of snapshots. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1977155 Resolves: https://gitlab.com/libvirt/libvirt/-/issues/202 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_domain.c | 6 ++++++ src/qemu/qemu_snapshot.c | 7 +++++++ 2 files changed, 13 insertions(+) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 50a921c80d..962343cb2d 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -7088,6 +7088,7 @@ qemuDomainSnapshotDiscard(virQEMUDriver *driver, if (!metadata_only) { if (!virDomainObjIsActive(vm)) { + size_t i; /* Ignore any skipped disks */ /* Prefer action on the disks in use at the time the snapshot was @@ -7098,6 +7099,11 @@ qemuDomainSnapshotDiscard(virQEMUDriver *driver, if (!def) def = vm->def; + for (i = 0; i < def->ndisks; i++) { + if (virDomainDiskTranslateSourcePool(def->disks[i]) < 0) + return -1; + } + if (qemuDomainSnapshotForEachQcow2(driver, def, snap, "-d", true) < 0) return -1; } else { diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c index 4e74ddd7f8..fa1f9ce973 100644 --- a/src/qemu/qemu_snapshot.c +++ b/src/qemu/qemu_snapshot.c @@ -1813,6 +1813,8 @@ qemuSnapshotRevertInactive(virQEMUDriver *driver, virDomainObj *vm, virDomainMomentObj *snap) { + size_t i; + /* Prefer action on the disks in use at the time the snapshot was * created; but fall back to current definition if dealing with a * snapshot created prior to libvirt 0.9.5. */ @@ -1821,6 +1823,11 @@ qemuSnapshotRevertInactive(virQEMUDriver *driver, if (!def) def = vm->def; + for (i = 0; i < def->ndisks; i++) { + if (virDomainDiskTranslateSourcePool(def->disks[i]) < 0) + return -1; + } + /* Try all disks, but report failure if we skipped any. */ if (qemuDomainSnapshotForEachQcow2(driver, def, snap, "-a", true) != 0) return -1; -- 2.31.1

2 1

[PATCH 1/5] conf: Introduce SGX EPC element into device memory xml
by Haibin Huang 25 Aug '21

25 Aug '21

From: Lin Yang <lin.a.yang(a)intel.com> <devices> ... <memory model='sgx-epc'> <target> <size unit='KiB'>512</size> </target> </memory> ... </devices> --- docs/schemas/domaincommon.rng | 1 + src/conf/domain_conf.c | 5 +++++ src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 1 + src/qemu/qemu_alias.c | 3 +++ src/qemu/qemu_command.c | 1 + src/qemu/qemu_domain.c | 1 + src/qemu/qemu_domain_address.c | 4 ++++ src/qemu/qemu_process.c | 2 ++ src/qemu/qemu_validate.c | 8 ++++++++ src/security/security_apparmor.c | 1 + src/security/security_dac.c | 2 ++ src/security/security_selinux.c | 2 ++ 13 files changed, 32 insertions(+) diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index 11fa24f398..a03cb4b388 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -6595,6 +6595,7 @@ <value>dimm</value> <value>nvdimm</value> <value>virtio-pmem</value> + <value>sgx-epc</value> </choice> </attribute> <optional> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 10effdce69..6b0c847037 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -1392,6 +1392,7 @@ VIR_ENUM_IMPL(virDomainMemoryModel, "dimm", "nvdimm", "virtio-pmem", + "sgx-epc", ); VIR_ENUM_IMPL(virDomainShmemModel, @@ -5494,6 +5495,7 @@ virDomainMemoryDefPostParse(virDomainMemoryDef *mem, break; case VIR_DOMAIN_MEMORY_MODEL_DIMM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; @@ -14682,6 +14684,7 @@ virDomainMemorySourceDefParseXML(xmlNodePtr node, def->nvdimmPath = virXPathString("string(./path)", ctxt); break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; @@ -16513,6 +16516,7 @@ virDomainMemoryFindByDefInternal(virDomainDef *def, continue; break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; @@ -25806,6 +25810,7 @@ virDomainMemorySourceDefFormat(virBuffer *buf, virBufferEscapeString(&childBuf, "<path>%s</path>\n", def->nvdimmPath); break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index c7e6df7981..095e80cf18 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -2472,6 +2472,7 @@ typedef enum { VIR_DOMAIN_MEMORY_MODEL_DIMM, /* dimm hotpluggable memory device */ VIR_DOMAIN_MEMORY_MODEL_NVDIMM, /* nvdimm memory device */ VIR_DOMAIN_MEMORY_MODEL_VIRTIO_PMEM, /* virtio-pmem memory device */ + VIR_DOMAIN_MEMORY_MODEL_SGX_EPC, /* SGX enclave page cache */ VIR_DOMAIN_MEMORY_MODEL_LAST } virDomainMemoryModel; diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c index 60f7ccdddd..ab0be2649f 100644 --- a/src/conf/domain_validate.c +++ b/src/conf/domain_validate.c @@ -1977,6 +1977,7 @@ virDomainMemoryDefValidate(const virDomainMemoryDef *mem, } case VIR_DOMAIN_MEMORY_MODEL_DIMM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: break; case VIR_DOMAIN_MEMORY_MODEL_NONE: diff --git a/src/qemu/qemu_alias.c b/src/qemu/qemu_alias.c index ed47fa335a..5990fc5f87 100644 --- a/src/qemu/qemu_alias.c +++ b/src/qemu/qemu_alias.c @@ -522,6 +522,9 @@ qemuAssignDeviceMemoryAlias(virDomainDef *def, case VIR_DOMAIN_MEMORY_MODEL_VIRTIO_PMEM: prefix = "virtiopmem"; break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: + prefix = "epc"; + break; case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: default: diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 2756f46b51..24572d03d7 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -3317,6 +3317,7 @@ qemuBuildMemoryDeviceStr(const virDomainDef *def, device = "virtio-pmem-pci"; break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: default: diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 9baa4b5d90..8e151d1fd5 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -9042,6 +9042,7 @@ qemuDomainDefValidateMemoryHotplugDevice(const virDomainMemoryDef *mem, needsNuma = false; break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: return -1; diff --git a/src/qemu/qemu_domain_address.c b/src/qemu/qemu_domain_address.c index 392368bd38..c8d93f5413 100644 --- a/src/qemu/qemu_domain_address.c +++ b/src/qemu/qemu_domain_address.c @@ -1015,6 +1015,7 @@ qemuDomainDeviceCalculatePCIConnectFlags(virDomainDeviceDef *dev, case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_DIMM: case VIR_DOMAIN_MEMORY_MODEL_NVDIMM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_LAST: return 0; } @@ -3037,6 +3038,7 @@ qemuDomainAssignMemoryDeviceSlot(virQEMUDriver *driver, return qemuDomainEnsurePCIAddress(vm, &dev, driver); break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; @@ -3062,6 +3064,7 @@ qemuDomainReleaseMemoryDeviceSlot(virDomainObj *vm, qemuDomainReleaseDeviceAddress(vm, &mem->info); break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; @@ -3095,6 +3098,7 @@ qemuDomainAssignMemorySlots(virDomainDef *def) case VIR_DOMAIN_MEMORY_MODEL_VIRTIO_PMEM: /* handled in qemuDomainAssignPCIAddresses() */ break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 77da9992f4..d2cccfc586 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -3802,6 +3802,7 @@ qemuProcessDomainMemoryDefNeedHugepagesPath(const virDomainMemoryDef *mem, case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_NVDIMM: case VIR_DOMAIN_MEMORY_MODEL_VIRTIO_PMEM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_LAST: /* None of these can be backed by hugepages. */ return false; @@ -3875,6 +3876,7 @@ qemuProcessNeedMemoryBackingPath(virDomainDef *def, case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_NVDIMM: case VIR_DOMAIN_MEMORY_MODEL_VIRTIO_PMEM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_LAST: /* Backed by user provided path. Not stored in memory * backing dir anyway. */ diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c index e5c4e3af26..545af727f7 100644 --- a/src/qemu/qemu_validate.c +++ b/src/qemu/qemu_validate.c @@ -4929,6 +4929,14 @@ qemuValidateDomainDeviceDefMemory(virDomainMemoryDef *mem, } break; + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: + if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_SGX_EPC)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("sgx epc isn't supported by this QEMU binary")); + return -1; + } + break; + case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index 84363015dc..46fbadb97a 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -693,6 +693,7 @@ AppArmorSetMemoryLabel(virSecurityManager *mgr, return reload_profile(mgr, def, mem->nvdimmPath, true); case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_DIMM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; } diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 04b9ecf028..64b6fabb7d 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -1849,6 +1849,7 @@ virSecurityDACRestoreMemoryLabel(virSecurityManager *mgr, break; case VIR_DOMAIN_MEMORY_MODEL_DIMM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_LAST: case VIR_DOMAIN_MEMORY_MODEL_NONE: ret = 0; @@ -2033,6 +2034,7 @@ virSecurityDACSetMemoryLabel(virSecurityManager *mgr, break; case VIR_DOMAIN_MEMORY_MODEL_DIMM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_LAST: case VIR_DOMAIN_MEMORY_MODEL_NONE: ret = 0; diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 0e5ea0366d..0034ad4495 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -1582,6 +1582,7 @@ virSecuritySELinuxSetMemoryLabel(virSecurityManager *mgr, case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_DIMM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_LAST: break; } @@ -1609,6 +1610,7 @@ virSecuritySELinuxRestoreMemoryLabel(virSecurityManager *mgr, break; case VIR_DOMAIN_MEMORY_MODEL_DIMM: + case VIR_DOMAIN_MEMORY_MODEL_SGX_EPC: case VIR_DOMAIN_MEMORY_MODEL_NONE: case VIR_DOMAIN_MEMORY_MODEL_LAST: ret = 0; -- 2.17.1

1 4

[PATCH 0/4] storage pool define: add support for validation against schema
by Kristina Hanicova 25 Aug '21

25 Aug '21

Kristina Hanicova (4): api: add virStoragePoolDefineFlags storage_conf: add validation against schema in pool define storage_driver & test_driver: allow VIR_STORAGE_POOL_DEFINE_VALIDATE flag virsh: add support for '--validate' option in define storage pool docs/manpages/virsh.rst | 4 +++- include/libvirt/libvirt-storage.h | 4 ++++ src/conf/domain_conf.c | 2 +- src/conf/storage_conf.c | 13 ++++++++----- src/conf/storage_conf.h | 3 ++- src/libvirt-storage.c | 2 +- src/storage/storage_driver.c | 6 +++--- src/test/test_driver.c | 6 +++--- tools/virsh-pool.c | 11 +++++++++-- 9 files changed, 34 insertions(+), 17 deletions(-) -- 2.31.1

2 5

[PATCH] lxcxml2xmltest: Substitute 'inactive' variable with 'active'
by Kristina Hanicova 25 Aug '21

25 Aug '21

I removed negation from the name of a variable to make the code more readable. Signed-off-by: Kristina Hanicova <khanicov(a)redhat.com> --- tests/lxcxml2xmltest.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/tests/lxcxml2xmltest.c b/tests/lxcxml2xmltest.c index 00341ad695..69c333b9b5 100644 --- a/tests/lxcxml2xmltest.c +++ b/tests/lxcxml2xmltest.c @@ -21,7 +21,7 @@ static virLXCDriver *driver; struct testInfo { const char *name; int different; - bool inactive_only; + bool active_only; unsigned int parse_flags; }; @@ -40,7 +40,7 @@ testCompareXMLToXMLHelper(const void *data) ret = testCompareDomXML2XMLFiles(driver->caps, driver->xmlopt, xml_in, info->different ? xml_out : xml_in, - !info->inactive_only, + info->active_only, info->parse_flags, TEST_COMPARE_DOM_XML2XML_RESULT_SUCCESS); VIR_FREE(xml_in); @@ -57,9 +57,9 @@ mymain(void) if (!(driver = testLXCDriverInit())) return EXIT_FAILURE; -# define DO_TEST_FULL(name, is_different, inactive, parse_flags) \ +# define DO_TEST_FULL(name, is_different, active, parse_flags) \ do { \ - const struct testInfo info = {name, is_different, inactive, \ + const struct testInfo info = {name, is_different, active, \ parse_flags}; \ if (virTestRun("LXC XML-2-XML " name, \ testCompareXMLToXMLHelper, &info) < 0) \ @@ -67,10 +67,10 @@ mymain(void) } while (0) # define DO_TEST(name) \ - DO_TEST_FULL(name, 0, false, 0) + DO_TEST_FULL(name, 0, true, 0) # define DO_TEST_DIFFERENT(name) \ - DO_TEST_FULL(name, 1, false, 0) + DO_TEST_FULL(name, 1, true, 0) /* Unset or set all envvars here that are copied in lxcdBuildCommandLine * using ADD_ENV_COPY, otherwise these tests may fail due to unexpected -- 2.31.1

2 2

[libvirt PATCH 0/6] qemu: capabilities: use g_auto (glib chronicles)
by Ján Tomko 24 Aug '21

24 Aug '21

This is not a cover letter. Ján Tomko (6): qemu: refactor virQEMUCapsNewForBinaryInternal qemu: refactor virQEMUCapsLoadFile qemu: refactor virQEMUCapsInit qemu: refactor virQEMUCapsNewCopy qemu: capabilities: use g_auto qemu: capabilities: remove pointless labels src/qemu/qemu_capabilities.c | 134 ++++++++++++----------------------- 1 file changed, 45 insertions(+), 89 deletions(-) -- 2.31.1

4 10

[PATCHv2 0/2] Support VM core dump to block device
by Simon Rowe 24 Aug '21

24 Aug '21

When the destination of a VM core dump is a block device (e.g. NBD) avoid file operations that are unnecessary. Simon Rowe (2): iohelper: skip lseek() and ftruncate() on block devices qemu: check unlink hint from virQEMUFileOpenAs() src/qemu/qemu_driver.c | 8 +++----- src/util/iohelper.c | 10 ++++++++-- 2 files changed, 11 insertions(+), 7 deletions(-) -- 2.22.3

2 6

[libvirt PATCH 0/1] Add a PCI/PCIe device VPD Capability
by Dmitrii Shcherbakov 24 Aug '21

24 Aug '21

Add support for deserializing the binary PCI/PCIe VPD format and exposing VPD resources as XML elements in a new nested capability of PCI/PCIe devices called 'vpd'. The VPD format is specified in "I.3. VPD Definitions" in PCI specs (2.2+) and "6.28.1 VPD Format" PCIe 4.0. As section 6.28 in PCIe 4.0 notes, the PCI Local Bus and PCIe VPD formats are binary compatible and PCIe 4.0 merely started incorporating what was already present in PCI specs. Linux kernel exposes a binary blob in the VPD format via sysfs since v2.6.26 (commit 94e6108803469a37ee1e3c92dafdd1d59298602f) which requires a parser to interpret. There are usage scenarios where information such as the board serial number needs to be retrieved from PCI(e) VPD. Projects like Nova can utilize this information for cases which involve virtual interface plugging on SmartNIC DPUs but there may be other scenarios and types of information useful to retrieve from VPD. The fact that the format is binary requires proper parsing instead of substring searching hence the full parser is proposed. Likewise, checksum validation requires proper parsing as well. The patch follows a prior discussion on the mailing list which has additional context about the use-case but a narrower proposal: https://listman.redhat.com/archives/libvir-list/2021-May/msg00873.html https://www.mail-archive.com/libvir-list@redhat.com/msg218165.html The new functionality is mostly contained in virpcivpd with a couple of new functions added to virpci. Additionally, the necessary XML serialization/deserialization and glue code is added to expose the VPD capability to external clients as XML. A new capability flag is added along with a new capability in order to allow for filtering of PCI devices with the VPD capability using virsh: virsh nodedev-list --cap vpd sudo virsh nodedev-dumpxml --device pci_dddd_bb_ss_f In this example having the root uid is required in order to access the vpd sysfs entry, therefore, the nodedev XML output will only contain the VPD capability if virsh is run as root. The capability is treated as dynamic due to the presence of read-write sections in the VPD format per PCI/PCIe specs (the idea being that read-write resource fields may potentially be altered by the DPU OS over time independently from the host OS). Unit tests cover the parser functionality (including many possible invalid cases), in-memory representation as well as XML serialization and deserialization. Manual functional testing was performed with 2 DPUs and several other NIC models which expose PCI(e) VPD. Testing have also been performed for devices that do not have VPD or those that expose a VPD capability but exhibit invalid behavior (I/O errors while reading a sysfs entry). Per the existing guidelines, the implementation relies heavily on glib for various purposes. https://libvirt.org/glib-adoption.html Dmitrii Shcherbakov (1): Add a PCI/PCIe device VPD Capability build-aux/syntax-check.mk | 4 +- docs/drvnodedev.html.in | 46 ++ docs/formatnode.html.in | 24 +- docs/schemas/nodedev.rng | 40 + include/libvirt/libvirt-nodedev.h | 1 + po/POTFILES.in | 1 + src/conf/node_device_conf.c | 258 ++++++ src/conf/node_device_conf.h | 6 +- src/conf/virnodedeviceobj.c | 7 +- src/libvirt_private.syms | 17 + src/node_device/node_device_driver.c | 2 + src/node_device/node_device_udev.c | 2 + src/util/meson.build | 1 + src/util/virpci.c | 60 ++ src/util/virpci.h | 3 + src/util/virpcivpd.c | 771 +++++++++++++++++ src/util/virpcivpd.h | 106 +++ src/util/virpcivpdpriv.h | 42 + tests/meson.build | 1 + .../pci_0000_42_00_0_vpd.xml | 33 + .../pci_0000_42_00_0_vpd.xml | 1 + tests/nodedevxml2xmltest.c | 1 + tests/testutils.c | 51 ++ tests/testutils.h | 6 + tests/virpcitest.c | 3 + tests/virpcivpdtest.c | 777 ++++++++++++++++++ tools/virsh-nodedev.c | 3 + 27 files changed, 2262 insertions(+), 5 deletions(-) create mode 100644 src/util/virpcivpd.c create mode 100644 src/util/virpcivpd.h create mode 100644 src/util/virpcivpdpriv.h create mode 100644 tests/nodedevschemadata/pci_0000_42_00_0_vpd.xml create mode 120000 tests/nodedevxml2xmlout/pci_0000_42_00_0_vpd.xml create mode 100644 tests/virpcivpdtest.c -- 2.30.2

1 1

[PATCH 0/7] network define: add support for validation against schema
by Kristina Hanicova 24 Aug '21

24 Aug '21

Kristina Hanicova (7): api: add public virNetworkDefineXMLFlags() and remote protocol vbox_network: add flags to vboxNetworkDefineCreateXML() src: add driver support for networkDefineXMLFlags() api: add virNetworkDefineFlags src & network_conf: add validation against schema in define network: allow VIR_NETWORK_DEFINE_VALIDATE flag virsh: add support for '--validate' option in define network docs/manpages/virsh.rst | 4 ++- include/libvirt/libvirt-network.h | 7 ++++++ src/conf/domain_conf.c | 2 +- src/conf/network_conf.c | 15 ++++++----- src/conf/network_conf.h | 3 ++- src/driver-network.h | 6 +++++ src/esx/esx_network_driver.c | 16 ++++++++++-- src/libvirt-network.c | 41 +++++++++++++++++++++++++++++++ src/libvirt_public.syms | 1 + src/network/bridge_driver.c | 22 +++++++++++++---- src/qemu/qemu_process.c | 2 +- src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 19 +++++++++++++- src/remote_protocol-structs | 8 ++++++ src/test/test_driver.c | 20 ++++++++++++--- src/vbox/vbox_network.c | 18 +++++++++++--- tools/virsh-network.c | 13 +++++++++- 17 files changed, 171 insertions(+), 27 deletions(-) -- 2.31.1

2 8

[libvirt PATCH] qemu: simplify machine-type check for implicit floppy controller
by Ján Tomko 24 Aug '21

24 Aug '21

Q35 machine types 2.3 and older had an integrated floppy controller. Support for these machine types was removed by QEMU commit commit 86165b499edf8b03bb2d0e926d116c2f12a95bfe q35: Remove old machine versions git describe: v2.5.0-1530-g86165b499e contains: v2.6.0-rc0~76^2~4 In libvirt, we have bumped the minimum QEMU version to 2.11: commit b4cbdbe90bbf85eaf687f532d5a52a11e664b781 qemu: Formally deprecate support for qemu < 2.11 git describe: v7.3.0-13-gb4cbdbe90b contains: v7.4.0-rc1~300 Since this QEMU version only supports Q35 machine versions 2.4+, remove the code dealing with older ones. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/qemu/qemu_domain.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 9baa4b5d90..50a921c80d 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -8823,22 +8823,12 @@ static bool qemuDomainMachineNeedsFDC(const char *machine, const virArch arch) { - const char *p = STRSKIP(machine, "pc-q35-"); - if (!ARCH_IS_X86(arch)) return false; - if (!p) + if (!STRPREFIX(machine, "pc-q35-")) return false; - if (STRPREFIX(p, "1.") || - STREQ(p, "2.0") || - STREQ(p, "2.1") || - STREQ(p, "2.2") || - STREQ(p, "2.3")) { - return false; - } - return true; } -- 2.31.1

2 1

[libvirt PATCHv2] API: discourage usage of non-ListAll APIs
by Ján Tomko 24 Aug '21

24 Aug '21

They require the caller to provide the maximum number of array elements upfront, leading to either incomplete results or violations of the zero-one-infinity rule. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/libvirt-domain-snapshot.c | 12 ++++++++---- src/libvirt-domain.c | 8 ++++---- src/libvirt-interface.c | 6 ++++-- src/libvirt-network.c | 6 ++++-- src/libvirt-nodedev.c | 3 ++- src/libvirt-nwfilter.c | 3 +++ src/libvirt-secret.c | 3 +++ src/libvirt-storage.c | 9 ++++++--- 8 files changed, 34 insertions(+), 16 deletions(-) diff --git a/src/libvirt-domain-snapshot.c b/src/libvirt-domain-snapshot.c index 15bf4d8634..4a79e95704 100644 --- a/src/libvirt-domain-snapshot.c +++ b/src/libvirt-domain-snapshot.c @@ -381,8 +381,10 @@ virDomainSnapshotNum(virDomainPtr domain, unsigned int flags) * snapshots were listed if the return is less than @nameslen. Likewise, * you should be prepared for virDomainSnapshotLookupByName() to fail when * converting a name from this call into a snapshot object, if another - * connection deletes the snapshot in the meantime. For more control over - * the results, see virDomainListAllSnapshots(). + * connection deletes the snapshot in the meantime. + * + * The use of this function is discouraged. Instead, use + * virDomainListAllSnapshots(). * * Returns the number of domain snapshots found or -1 in case of error. * The caller is responsible to call free() for each member of the array. @@ -582,8 +584,10 @@ virDomainSnapshotNumChildren(virDomainSnapshotPtr snapshot, unsigned int flags) * snapshots were listed if the return is less than @nameslen. Likewise, * you should be prepared for virDomainSnapshotLookupByName() to fail when * converting a name from this call into a snapshot object, if another - * connection deletes the snapshot in the meantime. For more control over - * the results, see virDomainSnapshotListAllChildren(). + * connection deletes the snapshot in the meantime. + * + * The use of this function is discouraged. Instead, use + * virDomainSnapshotListAllChildren(). * * Returns the number of domain snapshots found or -1 in case of error. * The caller is responsible to call free() for each member of the array. diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c index 3c4204e563..a8a386e839 100644 --- a/src/libvirt-domain.c +++ b/src/libvirt-domain.c @@ -41,8 +41,8 @@ VIR_LOG_INIT("libvirt.domain"); * * Collect the list of active domains, and store their IDs in array @ids * - * For inactive domains, see virConnectListDefinedDomains(). For more - * control over the results, see virConnectListAllDomains(). + * The use of this function is discouraged. Instead, use + * virConnectListAllDomains(). * * Returns the number of domains found or -1 in case of error. Note that * this command is inherently racy; a domain can be started between a @@ -6526,8 +6526,8 @@ virConnectNumOfDefinedDomains(virConnectPtr conn) * list the defined but inactive domains, stores the pointers to the names * in @names * - * For active domains, see virConnectListDomains(). For more control over - * the results, see virConnectListAllDomains(). + * The use of this function is discouraged. Instead, use + * virConnectListAllDomains(). * * Returns the number of names provided in the array or -1 in case of error. * Note that this command is inherently racy; a domain can be defined between diff --git a/src/libvirt-interface.c b/src/libvirt-interface.c index 2af86291d3..e4e8178ba9 100644 --- a/src/libvirt-interface.c +++ b/src/libvirt-interface.c @@ -150,7 +150,8 @@ virConnectNumOfInterfaces(virConnectPtr conn) * Collect the list of active physical host interfaces, * and store their names in @names * - * For more control over the results, see virConnectListAllInterfaces(). + * The use of this function is discouraged. Instead, use + * virConnectListAllInterfaces(). * * Returns the number of interfaces found or -1 in case of error. Note that * this command is inherently racy; a interface can be started between a call @@ -227,7 +228,8 @@ virConnectNumOfDefinedInterfaces(virConnectPtr conn) * Collect the list of defined (inactive) physical host interfaces, * and store their names in @names. * - * For more control over the results, see virConnectListAllInterfaces(). + * The use of this function is discouraged. Instead, use + * virConnectListAllInterfaces(). * * Returns the number of names provided in the array or -1 in case of error. * Note that this command is inherently racy; a interface can be defined between diff --git a/src/libvirt-network.c b/src/libvirt-network.c index 145487d599..2cecbf6c12 100644 --- a/src/libvirt-network.c +++ b/src/libvirt-network.c @@ -159,7 +159,8 @@ virConnectNumOfNetworks(virConnectPtr conn) * * Collect the list of active networks, and store their names in @names * - * For more control over the results, see virConnectListAllNetworks(). + * The use of this function is discouraged. Instead, use + * virConnectListAllNetworks(). * * Returns the number of networks found or -1 in case of error. Note that * this command is inherently racy; a network can be started between a call @@ -235,7 +236,8 @@ virConnectNumOfDefinedNetworks(virConnectPtr conn) * * list the inactive networks, stores the pointers to the names in @names * - * For more control over the results, see virConnectListAllNetworks(). + * The use of this function is discouraged. Instead, use + * virConnectListAllNetworks(). * * Returns the number of names provided in the array or -1 in case of error. * Note that this command is inherently racy; a network can be defined between diff --git a/src/libvirt-nodedev.c b/src/libvirt-nodedev.c index e416c12534..ce0f30e958 100644 --- a/src/libvirt-nodedev.c +++ b/src/libvirt-nodedev.c @@ -128,7 +128,8 @@ virConnectListAllNodeDevices(virConnectPtr conn, * * Collect the list of node devices, and store their names in @names * - * For more control over the results, see virConnectListAllNodeDevices(). + * The use of this function is discouraged. Instead, use + * virConnectListAllNodeDevices(). * * If the optional 'cap' argument is non-NULL, then the count * will be restricted to devices with the specified capability diff --git a/src/libvirt-nwfilter.c b/src/libvirt-nwfilter.c index 7b857d1422..8d09270296 100644 --- a/src/libvirt-nwfilter.c +++ b/src/libvirt-nwfilter.c @@ -117,6 +117,9 @@ virConnectListAllNWFilters(virConnectPtr conn, * * Collect the list of network filters, and store their names in @names * + * The use of this function is discouraged. Instead, use + * virConnectListAllNWFilters(). + * * Returns the number of network filters found or -1 in case of error */ int diff --git a/src/libvirt-secret.c b/src/libvirt-secret.c index d3626ed561..d2a3a4bd9d 100644 --- a/src/libvirt-secret.c +++ b/src/libvirt-secret.c @@ -156,6 +156,9 @@ virConnectListAllSecrets(virConnectPtr conn, * * List UUIDs of defined secrets, store pointers to names in uuids. * + * The use of this function is discouraged. Instead, use + * virConnectListAllSecrets(). + * * Returns the number of UUIDs provided in the array, or -1 on failure. */ int diff --git a/src/libvirt-storage.c b/src/libvirt-storage.c index 2a7cdca234..4badb13f04 100644 --- a/src/libvirt-storage.c +++ b/src/libvirt-storage.c @@ -179,7 +179,8 @@ virConnectNumOfStoragePools(virConnectPtr conn) * If there are more than maxnames, the remaining names will be silently * ignored. * - * For more control over the results, see virConnectListAllStoragePools(). + * The use of this function is discouraged. Instead, use + * virConnectListAllStoragePools(). * * Returns the number of pools found or -1 in case of error. Note that * this command is inherently racy; a pool can be started between a call to @@ -259,7 +260,8 @@ virConnectNumOfDefinedStoragePools(virConnectPtr conn) * If there are more than maxnames, the remaining names will be silently * ignored. * - * For more control over the results, see virConnectListAllStoragePools(). + * The use of this function is discouraged. Instead, use + * virConnectListAllStoragePools(). * * Returns the number of names provided in the array or -1 in case of error. * Note that this command is inherently racy; a pool can be defined between @@ -1254,7 +1256,8 @@ virStoragePoolNumOfVolumes(virStoragePoolPtr pool) * Fetch list of storage volume names, limiting to * at most maxnames. * - * To list the volume objects directly, see virStoragePoolListAllVolumes(). + * The use of this function is discouraged. Instead, use + * virStoragePoolListAllVolumes(). * * Returns the number of names fetched, or -1 on error */ -- 2.31.1

2 1

[PATCH V2] qemu: Set label on vhostuser net device when hotplugging
by Jim Fehlig 24 Aug '21

24 Aug '21

Attaching a newly created vhostuser port to a VM fails due to an apparmor denial internal error: unable to execute QEMU command 'chardev-add': Failed to bind socket to /run/openvswitch/vhu838c4d29-c9: Permission denied In the case of a net device type VIR_DOMAIN_NET_TYPE_VHOSTUSER, the underlying chardev is not labeled in qemuDomainAttachNetDevice prior to calling qemuMonitorAttachCharDev. A simple fix would be to call qemuSecuritySetChardevLabel using the embedded virDomainChrSourceDef in the virDomainNetDef vhostuser data, but this incurs the risk of incorrectly restoring the label. E.g. consider the DAC driver behavior with a vhostuser net device, which uses a socket for the chardev backend. The DAC driver uses XATTRS to store original labelling information, but XATTRS are not compatible with sockets. Without the original labelling information, the socket labels will be restored with root ownership, preventing other less-privileged processes from connecting to the socket. This patch avoids overloading chardev labelling with vhostuser net devices by introducing virSecurityManager{Set,Restore}NetdevLabel, which is currently only implemented for the apparmor driver. The new APIs are then used to set and restore labels for the vhostuser net devices. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- V2 of: https://listman.redhat.com/archives/libvir-list/2021-August/msg00373.html Changes since V1: Introduce and use new APIs for labeling net devices Don't perform labelling while executing monitor commands Restore labels if hotplug fails src/libvirt_private.syms | 2 ++ src/qemu/qemu_hotplug.c | 13 +++++++ src/qemu/qemu_security.c | 59 ++++++++++++++++++++++++++++++ src/qemu/qemu_security.h | 8 +++++ src/security/security_apparmor.c | 61 ++++++++++++++++++++++++++++++++ src/security/security_driver.h | 9 +++++ src/security/security_manager.c | 38 ++++++++++++++++++++ src/security/security_manager.h | 8 +++++ src/security/security_stack.c | 52 +++++++++++++++++++++++++++ 9 files changed, 250 insertions(+) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index fcb02c21b1..9d3e0421c0 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1687,6 +1687,7 @@ virSecurityManagerRestoreHostdevLabel; virSecurityManagerRestoreImageLabel; virSecurityManagerRestoreInputLabel; virSecurityManagerRestoreMemoryLabel; +virSecurityManagerRestoreNetdevLabel; virSecurityManagerRestoreSavedStateLabel; virSecurityManagerRestoreTPMLabels; virSecurityManagerSetAllLabel; @@ -1698,6 +1699,7 @@ virSecurityManagerSetImageFDLabel; virSecurityManagerSetImageLabel; virSecurityManagerSetInputLabel; virSecurityManagerSetMemoryLabel; +virSecurityManagerSetNetdevLabel; virSecurityManagerSetProcessLabel; virSecurityManagerSetSavedStateLabel; virSecurityManagerSetSocketLabel; diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index c3c49fe080..77dbf69845 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1203,6 +1203,7 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver, g_autofree char *netdev_name = NULL; g_autoptr(virConnect) conn = NULL; virErrorPtr save_err = NULL; + bool teardownlabel = false; /* If appropriate, grab a physical device from the configured * network's pool of devices, or resolve bridge device name @@ -1343,6 +1344,9 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver, &net->ifname) < 0) goto cleanup; + if (qemuSecuritySetNetdevLabel(driver, vm, net) < 0) + goto cleanup; + teardownlabel = true; break; case VIR_DOMAIN_NET_TYPE_USER: @@ -1559,6 +1563,10 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver, qemuDomainNetDeviceVportRemove(net); } + if (teardownlabel && + qemuSecurityRestoreNetdevLabel(driver, vm, net) < 0) + VIR_WARN("Unable to restore network device labelling on hotplug fail"); + /* we had potentially pre-added the device to the domain * device lists, if so we need to remove it (from def->nets * and/or def->hostdevs) on failure @@ -4763,6 +4771,11 @@ qemuDomainRemoveNetDevice(virQEMUDriver *driver, cfg->stateDir)); } + if (actualType == VIR_DOMAIN_NET_TYPE_VHOSTUSER) { + if (qemuSecurityRestoreNetdevLabel(driver, vm, net) < 0) + VIR_WARN("Unable to restore security label on vhostuser char device"); + } + qemuDomainNetDeviceVportRemove(net); if (net->type == VIR_DOMAIN_NET_TYPE_NETWORK) { diff --git a/src/qemu/qemu_security.c b/src/qemu/qemu_security.c index e582a66071..19d957dd4b 100644 --- a/src/qemu/qemu_security.c +++ b/src/qemu/qemu_security.c @@ -439,6 +439,65 @@ qemuSecurityRestoreChardevLabel(virQEMUDriver *driver, return ret; } +int +qemuSecuritySetNetdevLabel(virQEMUDriver *driver, + virDomainObj *vm, + virDomainNetDef *net) +{ + int ret = -1; + qemuDomainObjPrivate *priv = vm->privateData; + pid_t pid = -1; + + if (qemuDomainNamespaceEnabled(vm, QEMU_DOMAIN_NS_MOUNT)) + pid = vm->pid; + + if (virSecurityManagerTransactionStart(driver->securityManager) < 0) + goto cleanup; + + if (virSecurityManagerSetNetdevLabel(driver->securityManager, + vm->def, net) < 0) + goto cleanup; + + if (virSecurityManagerTransactionCommit(driver->securityManager, + pid, priv->rememberOwner) < 0) + goto cleanup; + + ret = 0; + cleanup: + virSecurityManagerTransactionAbort(driver->securityManager); + return ret; +} + + +int +qemuSecurityRestoreNetdevLabel(virQEMUDriver *driver, + virDomainObj *vm, + virDomainNetDef *net) +{ + int ret = -1; + qemuDomainObjPrivate *priv = vm->privateData; + pid_t pid = -1; + + if (qemuDomainNamespaceEnabled(vm, QEMU_DOMAIN_NS_MOUNT)) + pid = vm->pid; + + if (virSecurityManagerTransactionStart(driver->securityManager) < 0) + goto cleanup; + + if (virSecurityManagerRestoreNetdevLabel(driver->securityManager, + vm->def, net) < 0) + goto cleanup; + + if (virSecurityManagerTransactionCommit(driver->securityManager, + pid, priv->rememberOwner) < 0) + goto cleanup; + + ret = 0; + cleanup: + virSecurityManagerTransactionAbort(driver->securityManager); + return ret; +} + /* * qemuSecurityStartVhostUserGPU: diff --git a/src/qemu/qemu_security.h b/src/qemu/qemu_security.h index 4c3d81e4b5..8b26ea3f99 100644 --- a/src/qemu/qemu_security.h +++ b/src/qemu/qemu_security.h @@ -79,6 +79,14 @@ int qemuSecurityRestoreChardevLabel(virQEMUDriver *driver, virDomainObj *vm, virDomainChrDef *chr); +int qemuSecuritySetNetdevLabel(virQEMUDriver *driver, + virDomainObj *vm, + virDomainNetDef *net); + +int qemuSecurityRestoreNetdevLabel(virQEMUDriver *driver, + virDomainObj *vm, + virDomainNetDef *net); + int qemuSecurityStartVhostUserGPU(virQEMUDriver *driver, virDomainObj *vm, virCommand *cmd, diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index 84363015dc..d942ea5005 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -1053,6 +1053,64 @@ AppArmorRestoreChardevLabel(virSecurityManager *mgr, return reload_profile(mgr, def, NULL, false); } +static int +AppArmorSetNetdevLabel(virSecurityManager *mgr, + virDomainDef *def, + virDomainNetDef *net) +{ + int ret = -1; + virSecurityLabelDef *secdef; + virDomainChrSourceDef *dev_source; + virDomainNetType actualType; + + secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_APPARMOR_NAME); + if (!secdef) + return 0; + + actualType = virDomainNetGetActualType(net); + if (actualType != VIR_DOMAIN_NET_TYPE_VHOSTUSER) + return 0; + + dev_source = net->data.vhostuser; + switch ((virDomainChrType)dev_source->type) { + case VIR_DOMAIN_CHR_TYPE_UNIX: + ret = reload_profile(mgr, def, dev_source->data.file.path, true); + break; + + case VIR_DOMAIN_CHR_TYPE_DEV: + case VIR_DOMAIN_CHR_TYPE_FILE: + case VIR_DOMAIN_CHR_TYPE_PTY: + case VIR_DOMAIN_CHR_TYPE_PIPE: + case VIR_DOMAIN_CHR_TYPE_SPICEPORT: + case VIR_DOMAIN_CHR_TYPE_NULL: + case VIR_DOMAIN_CHR_TYPE_VC: + case VIR_DOMAIN_CHR_TYPE_STDIO: + case VIR_DOMAIN_CHR_TYPE_UDP: + case VIR_DOMAIN_CHR_TYPE_TCP: + case VIR_DOMAIN_CHR_TYPE_SPICEVMC: + case VIR_DOMAIN_CHR_TYPE_NMDM: + case VIR_DOMAIN_CHR_TYPE_LAST: + ret = 0; + break; + } + + return ret; +} + +static int +AppArmorRestoreNetdevLabel(virSecurityManager *mgr, + virDomainDef *def, + virDomainNetDef *net G_GNUC_UNUSED) +{ + virSecurityLabelDef *secdef; + + secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_APPARMOR_NAME); + if (!secdef) + return 0; + + return reload_profile(mgr, def, NULL, false); +} + static int AppArmorSetPathLabel(virSecurityManager *mgr, virDomainDef *def, @@ -1168,6 +1226,9 @@ virSecurityDriver virAppArmorSecurityDriver = { .domainSetSecurityChardevLabel = AppArmorSetChardevLabel, .domainRestoreSecurityChardevLabel = AppArmorRestoreChardevLabel, + .domainSetSecurityNetdevLabel = AppArmorSetNetdevLabel, + .domainRestoreSecurityNetdevLabel = AppArmorRestoreNetdevLabel, + .domainSetSecurityImageFDLabel = AppArmorSetFDLabel, .domainSetSecurityTapFDLabel = AppArmorSetFDLabel, diff --git a/src/security/security_driver.h b/src/security/security_driver.h index 07f8def3d3..a1fc23be38 100644 --- a/src/security/security_driver.h +++ b/src/security/security_driver.h @@ -157,6 +157,12 @@ typedef int (*virSecurityDomainSetTPMLabels) (virSecurityManager *mgr, virDomainDef *def); typedef int (*virSecurityDomainRestoreTPMLabels) (virSecurityManager *mgr, virDomainDef *def); +typedef int (*virSecurityDomainSetNetdevLabel) (virSecurityManager *mgr, + virDomainDef *def, + virDomainNetDef *net); +typedef int (*virSecurityDomainRestoreNetdevLabel) (virSecurityManager *mgr, + virDomainDef *def, + virDomainNetDef *net); struct _virSecurityDriver { @@ -224,6 +230,9 @@ struct _virSecurityDriver { virSecurityDomainSetTPMLabels domainSetSecurityTPMLabels; virSecurityDomainRestoreTPMLabels domainRestoreSecurityTPMLabels; + + virSecurityDomainSetNetdevLabel domainSetSecurityNetdevLabel; + virSecurityDomainRestoreNetdevLabel domainRestoreSecurityNetdevLabel; }; virSecurityDriver *virSecurityDriverLookup(const char *name, diff --git a/src/security/security_manager.c b/src/security/security_manager.c index 9906c1691d..d8a03a19cb 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -1297,6 +1297,44 @@ virSecurityManagerRestoreTPMLabels(virSecurityManager *mgr, } +int +virSecurityManagerSetNetdevLabel(virSecurityManager *mgr, + virDomainDef *vm, + virDomainNetDef *net) +{ + int ret; + + if (mgr->drv->domainSetSecurityNetdevLabel) { + virObjectLock(mgr); + ret = mgr->drv->domainSetSecurityNetdevLabel(mgr, vm, net); + virObjectUnlock(mgr); + + return ret; + } + + return 0; +} + + +int +virSecurityManagerRestoreNetdevLabel(virSecurityManager *mgr, + virDomainDef *vm, + virDomainNetDef *net) +{ + int ret; + + if (mgr->drv->domainRestoreSecurityNetdevLabel) { + virObjectLock(mgr); + ret = mgr->drv->domainRestoreSecurityNetdevLabel(mgr, vm, net); + virObjectUnlock(mgr); + + return ret; + } + + return 0; +} + + static int cmpstringp(const void *p1, const void *p2) { diff --git a/src/security/security_manager.h b/src/security/security_manager.h index 57047ccb13..59020b1475 100644 --- a/src/security/security_manager.h +++ b/src/security/security_manager.h @@ -220,6 +220,14 @@ int virSecurityManagerSetTPMLabels(virSecurityManager *mgr, int virSecurityManagerRestoreTPMLabels(virSecurityManager *mgr, virDomainDef *vm); +int virSecurityManagerSetNetdevLabel(virSecurityManager *mgr, + virDomainDef *vm, + virDomainNetDef *net); + +int virSecurityManagerRestoreNetdevLabel(virSecurityManager *mgr, + virDomainDef *vm, + virDomainNetDef *net); + typedef struct _virSecurityManagerMetadataLockState virSecurityManagerMetadataLockState; struct _virSecurityManagerMetadataLockState { size_t nfds; /* Captures size of both @fds and @paths */ diff --git a/src/security/security_stack.c b/src/security/security_stack.c index f7a9ed1e33..3c2239910a 100644 --- a/src/security/security_stack.c +++ b/src/security/security_stack.c @@ -963,6 +963,55 @@ virSecurityStackRestoreTPMLabels(virSecurityManager *mgr, } +static int +virSecurityStackDomainSetNetdevLabel(virSecurityManager *mgr, + virDomainDef *def, + virDomainNetDef *net) +{ + virSecurityStackData *priv = virSecurityManagerGetPrivateData(mgr); + virSecurityStackItem *item = priv->itemsHead; + + for (; item; item = item->next) { + if (virSecurityManagerSetNetdevLabel(item->securityManager, def, net) < 0) + goto rollback; + } + + return 0; + + rollback: + for (item = item->prev; item; item = item->prev) { + if (virSecurityManagerRestoreNetdevLabel(item->securityManager, + def, net) < 0) { + VIR_WARN("Unable to restore netdev label after failed set label " + "call virDriver=%s driver=%s domain=%s", + virSecurityManagerGetVirtDriver(mgr), + virSecurityManagerGetDriver(item->securityManager), + def->name); + } + } + return -1; +} + + +static int +virSecurityStackDomainRestoreNetdevLabel(virSecurityManager *mgr, + virDomainDef *def, + virDomainNetDef *net) +{ + virSecurityStackData *priv = virSecurityManagerGetPrivateData(mgr); + virSecurityStackItem *item = priv->itemsHead; + int rc = 0; + + for (; item; item = item->next) { + if (virSecurityManagerRestoreNetdevLabel(item->securityManager, + def, net) < 0) + rc = -1; + } + + return rc; +} + + virSecurityDriver virSecurityDriverStack = { .privateDataLen = sizeof(virSecurityStackData), .name = "stack", @@ -1028,4 +1077,7 @@ virSecurityDriver virSecurityDriverStack = { .domainSetSecurityTPMLabels = virSecurityStackSetTPMLabels, .domainRestoreSecurityTPMLabels = virSecurityStackRestoreTPMLabels, + + .domainSetSecurityNetdevLabel = virSecurityStackDomainSetNetdevLabel, + .domainRestoreSecurityNetdevLabel = virSecurityStackDomainRestoreNetdevLabel, }; -- 2.32.0

2 1

[PATCH 0/2] Support VM core dump to block device
by Simon Rowe 23 Aug '21

23 Aug '21

When the destination of a VM core dump is a block device (e.g. NBD) avoid file operations that are unnecessary. Simon Rowe (2): iohelper: skip lseek() and ftruncate() on block devices qemu: never unlink() the core dump output file src/qemu/qemu_driver.c | 2 -- src/util/iohelper.c | 10 ++++++++-- 2 files changed, 8 insertions(+), 4 deletions(-) -- 2.22.3

2 10

[PATCH] vbox_network: fix possible memory leak in vboxNetworkDefineCreateXML()
by Kristina Hanicova 23 Aug '21

23 Aug '21

virNetworkDef was not freed if the function failed in the first two ifs, causing a possible memory leak. Signed-off-by: Kristina Hanicova <khanicov(a)redhat.com> --- src/vbox/vbox_network.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/vbox/vbox_network.c b/src/vbox/vbox_network.c index afd2acbb03..d97f571d1b 100644 --- a/src/vbox/vbox_network.c +++ b/src/vbox/vbox_network.c @@ -375,7 +375,7 @@ vboxNetworkDefineCreateXML(virConnectPtr conn, const char *xml, bool start) PRUnichar *networkNameUtf16 = NULL; char *networkNameUtf8 = NULL; IHostNetworkInterface *networkInterface = NULL; - virNetworkDef *def = virNetworkDefParseString(xml, NULL); + virNetworkDef *def = NULL; virNetworkIPDef *ipdef = NULL; unsigned char uuid[VIR_UUID_BUFLEN]; vboxIID vboxnetiid; @@ -394,7 +394,7 @@ vboxNetworkDefineCreateXML(virConnectPtr conn, const char *xml, bool start) VBOX_IID_INITIALIZE(&vboxnetiid); - if ((!def) || + if (!(def = virNetworkDefParseString(xml, NULL)) || (def->forward.type != VIR_NETWORK_FORWARD_NONE) || (def->nips == 0 || !def->ips)) goto cleanup; -- 2.31.1

2 1

[PATCH] qemu: Label vhostuser net device
by Jim Fehlig 23 Aug '21

23 Aug '21

Attaching a newly created vhostuser port to a VM fails due to an apparmor denial internal error: unable to execute QEMU command 'chardev-add': Failed to bind socket to /run/openvswitch/vhu838c4d29-c9: Permission denied In the case of a net device type VIR_DOMAIN_NET_TYPE_VHOSTUSER, the underlying chardev is not labeled in qemuDomainAttachNetDevice prior to calling qemuMonitorAttachCharDev. Label the chardev before calling qemuMonitorAttachCharDev, and restore the label when removing the net device. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- src/qemu/qemu_hotplug.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index c00e8a7852..42e7997112 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1467,6 +1467,11 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver, } if (actualType == VIR_DOMAIN_NET_TYPE_VHOSTUSER) { + virDomainChrDef chr = { .source = net->data.vhostuser }; + + if (qemuSecuritySetChardevLabel(driver, vm, &chr) < 0) + goto cleanup; + if (qemuMonitorAttachCharDev(priv->mon, charDevAlias, net->data.vhostuser) < 0) { ignore_value(qemuDomainObjExitMonitor(driver, vm)); virDomainAuditNet(vm, NULL, net, "attach", false); @@ -4692,6 +4697,8 @@ qemuDomainRemoveNetDevice(virQEMUDriver *driver, } if (actualType == VIR_DOMAIN_NET_TYPE_VHOSTUSER) { + virDomainChrDef chr = { .source = net->data.vhostuser }; + /* vhostuser has a chardev too */ if (qemuMonitorDetachCharDev(priv->mon, charDevAlias) < 0) { /* well, this is a messy situation. Guest visible PCI device has @@ -4699,6 +4706,8 @@ qemuDomainRemoveNetDevice(virQEMUDriver *driver, * to just ignore the error and carry on. */ } + if (qemuSecurityRestoreChardevLabel(driver, vm, &chr) < 0) + VIR_WARN("Unable to restore security label on vhostuser char device"); } else if (actualType == VIR_DOMAIN_NET_TYPE_VDPA) { int vdpafdset = -1; g_autoptr(qemuMonitorFdsets) fdsets = NULL; -- 2.32.0

5 9

[PATCH] conf: snapshot/checkpoint: Rewrite 'AlignDisk' logic to appease clang
by Peter Krempa 23 Aug '21

23 Aug '21

New clang has a false-positive about value of 'olddisks' being unused after being set. This is clearly wrong because we want to use 'g_autofree' to clear it later. While I'm against modifying good code for the sake of bad static analysis in this case it's not obvious that we depend on the lifetime of 'olddisks' being needed until the end of the function as we store pointers into it into the hash table and later copy them out. Rewrite the code by assigning to 'olddisks' earlier and then using 'olddisks' in the loop, so it's clear where the lifetime of the objects ends, and this should also silence the warning. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/conf/checkpoint_conf.c | 14 ++++++++------ src/conf/snapshot_conf.c | 14 ++++++++------ 2 files changed, 16 insertions(+), 12 deletions(-) diff --git a/src/conf/checkpoint_conf.c b/src/conf/checkpoint_conf.c index 4731f21aba..175a95fed7 100644 --- a/src/conf/checkpoint_conf.c +++ b/src/conf/checkpoint_conf.c @@ -265,6 +265,7 @@ virDomainCheckpointAlignDisks(virDomainCheckpointDef *chkdef) virDomainDef *domdef = chkdef->parent.dom; g_autoptr(GHashTable) map = virHashNew(NULL); g_autofree virDomainCheckpointDiskDef *olddisks = NULL; + size_t oldndisks; size_t i; int checkpoint_default = VIR_DOMAIN_CHECKPOINT_TYPE_NONE; @@ -292,9 +293,14 @@ virDomainCheckpointAlignDisks(virDomainCheckpointDef *chkdef) if (!chkdef->ndisks) checkpoint_default = VIR_DOMAIN_CHECKPOINT_TYPE_BITMAP; + olddisks = g_steal_pointer(&chkdef->disks); + oldndisks = chkdef->ndisks; + chkdef->disks = g_new0(virDomainCheckpointDiskDef, domdef->ndisks); + chkdef->ndisks = domdef->ndisks; + /* Double check requested disks. */ - for (i = 0; i < chkdef->ndisks; i++) { - virDomainCheckpointDiskDef *chkdisk = &chkdef->disks[i]; + for (i = 0; i < oldndisks; i++) { + virDomainCheckpointDiskDef *chkdisk = &olddisks[i]; virDomainDiskDef *domdisk = virDomainDiskByName(domdef, chkdisk->name, false); if (!domdisk) { @@ -328,10 +334,6 @@ virDomainCheckpointAlignDisks(virDomainCheckpointDef *chkdef) } } - olddisks = g_steal_pointer(&chkdef->disks); - chkdef->disks = g_new0(virDomainCheckpointDiskDef, domdef->ndisks); - chkdef->ndisks = domdef->ndisks; - for (i = 0; i < domdef->ndisks; i++) { virDomainDiskDef *domdisk = domdef->disks[i]; virDomainCheckpointDiskDef *chkdisk = chkdef->disks + i; diff --git a/src/conf/snapshot_conf.c b/src/conf/snapshot_conf.c index c765e4c815..fc6f0a859d 100644 --- a/src/conf/snapshot_conf.c +++ b/src/conf/snapshot_conf.c @@ -636,6 +636,7 @@ virDomainSnapshotAlignDisks(virDomainSnapshotDef *snapdef, virDomainDef *domdef = snapdef->parent.dom; g_autoptr(GHashTable) map = virHashNew(NULL); g_autofree virDomainSnapshotDiskDef *olddisks = NULL; + size_t oldndisks; size_t i; if (!domdef) { @@ -654,9 +655,14 @@ virDomainSnapshotAlignDisks(virDomainSnapshotDef *snapdef, if (!domdef->ndisks) return 0; + olddisks = g_steal_pointer(&snapdef->disks); + oldndisks = snapdef->ndisks; + snapdef->disks = g_new0(virDomainSnapshotDiskDef, domdef->ndisks); + snapdef->ndisks = domdef->ndisks; + /* Double check requested disks. */ - for (i = 0; i < snapdef->ndisks; i++) { - virDomainSnapshotDiskDef *snapdisk = &snapdef->disks[i]; + for (i = 0; i < oldndisks; i++) { + virDomainSnapshotDiskDef *snapdisk = &olddisks[i]; virDomainDiskDef *domdisk = virDomainDiskByName(domdef, snapdisk->name, false); if (!domdisk) { @@ -708,10 +714,6 @@ virDomainSnapshotAlignDisks(virDomainSnapshotDef *snapdef, } } - olddisks = g_steal_pointer(&snapdef->disks); - snapdef->disks = g_new0(virDomainSnapshotDiskDef, domdef->ndisks); - snapdef->ndisks = domdef->ndisks; - for (i = 0; i < domdef->ndisks; i++) { virDomainDiskDef *domdisk = domdef->disks[i]; virDomainSnapshotDiskDef *snapdisk = snapdef->disks + i; -- 2.31.1

2 1