- Devel - libvirt List Archives

[libvirt PATCH] docs: document external swtpm
by Ján Tomko 21 Nov '24

21 Nov '24

When external swtpm support was added back in 9.0.0, I omitted the update of the XML docs. Add it now, especially since the 'emulator' backend can now also use the <source> element. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- docs/formatdomain.rst | 43 ++++++++++++++++++++++++++++++++++++------- 1 file changed, 36 insertions(+), 7 deletions(-) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index b3f9f453aa..a5510e82f5 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -8140,6 +8140,20 @@ Example: usage of the TPM Emulator </devices> ... +Example: usage of external TPM emulator :since:`Since 9.0.0` + +:: + + ... + <devices> + <tpm model='tpm-tis'> + <backend type='external'> + <source type='unix' mode='connect' path='/tmp/path.sock'/> + </backend> + </tpm> + </devices> + ... + ``model`` The ``model`` attribute specifies what device model QEMU provides to the guest. If no model name is provided, ``tpm-tis`` will automatically be chosen @@ -8178,6 +8192,12 @@ Example: usage of the TPM Emulator parameter can be used to enable logging in the emulator backend, and accepts non-zero integer values. + ``external`` + For this backend, libvirt expects the TPM emulator to be started externally. + The path to the unix socket where the emulator is listening is passed + via the ``source`` element. Other ``backend`` sub-elements do not apply + in these case, since they are controlled by the emulator command line. + ``version`` The ``version`` attribute indicates the version of the TPM. This attribute only works with the ``emulator`` backend. The following versions are @@ -8190,8 +8210,13 @@ Example: usage of the TPM Emulator architecture, TPM model and backend. ``source`` - The ``source`` element specifies the location of the TPM state storage . This - element only works with the ``emulator`` backend. + For the ``emulator`` backend, the ``source`` element specifies the location + of the TPM state storage. :since:`Since v10.10.0` + + For the ``external`` backend, it specifies the socket of the externally + run TPM emulator. :since:`Since v9.0.0` + + This element does not work with the ``passthrough`` backend. When specified, it is the user's responsability to prevent files from being used by multiple VMs or emulators (swtpm will also use advisory locking). If @@ -8202,14 +8227,18 @@ Example: usage of the TPM Emulator The following attributes are supported: ``type`` - The type of storage. It's possible to provide "file" to utilize a single - file or block device where the TPM state will be stored, or "dir" for the - directory where the files will be stored. + For ``external`` backend, only type ``unix`` is supported. + For ``emulator`` backend, it's possible to provide ``file`` to utilize + a single file or block device where the TPM state will be stored, + or ``dir`` for the directory where the files will be stored. + + ``mode`` + Connection mode for the ``unix`` socket. Only ``connect`` is supported. + Can be omitted. ``path`` - The path to the TPM state storage. + The path to the TPM state storage, or the unix socket. - :since:`Since v10.10.0` ``persistent_state`` The ``persistent_state`` attribute indicates whether 'swtpm' TPM state is -- 2.47.0

2 1

[PATCH] QEMU: allow to hot plugging virtio-serial-pci device
by shenjiatong 21 Nov '24

21 Nov '24

Virtio-serial-pci device is hot pluggable, losen the restriction and allow user to hot plug it. --- src/qemu/qemu_hotplug.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index bddd553c88..55512476e4 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -837,7 +837,8 @@ qemuDomainAttachControllerDevice(virDomainObj *vm, { .controller = controller } }; bool releaseaddr = false; - if (controller->type != VIR_DOMAIN_CONTROLLER_TYPE_SCSI) { + if (controller->type != VIR_DOMAIN_CONTROLLER_TYPE_SCSI && \ + controller->type != VIR_DOMAIN_CONTROLLER_TYPE_VIRTIO_SERIAL) { virReportError(VIR_ERR_OPERATION_UNSUPPORTED, _("'%1$s' controller cannot be hot plugged."), virDomainControllerTypeToString(controller->type)); -- 2.43.0

3 3

[PATCH 0/4] qemu: Adapt to deprecation of 'reconnect' field for 'stream 'netdevs' and update qemu capablities
by Peter Krempa 19 Nov '24

19 Nov '24

Peter Krempa (4): qemu: capabilities: Restore grouping in 'virQEMUCapsQMPSchemaQueries' qemu: capabilities: Introduce QEMU_CAPS_NETDEV_STREAM_RECONNECT_MILISECONDS qemu: passt: Use 'reconnect-ms' instead of 'reconnect' with new qemus tests: qemucapabilitiesdata: Update 'x86_64' capabilities for the qemu-9.2 dev cycle src/qemu/qemu_capabilities.c | 18 +- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_passt.c | 14 +- .../qemucapabilitiesdata/caps_9.2.0_s390x.xml | 1 + .../caps_9.2.0_x86_64.replies | 4407 +++++++++-------- .../caps_9.2.0_x86_64.xml | 310 +- .../net-user-passt.x86_64-latest.args | 2 +- 7 files changed, 2523 insertions(+), 2230 deletions(-) -- 2.47.0

2 6

[PATCH 0/4] Add news for recent features and CVEs
by Han Han 19 Nov '24

19 Nov '24

Han Han (4): NEWS: qemu: Add support for hyperv enlightenments features NEWS: cpu_map: Add the EPYC-Genoa cpu mode NEWS: Add the news for CVE-2024-2494 NEWS: Add the news for CVE-2024-4418 NEWS.rst | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) -- 2.47.0

2 5

[PATCH v2] qemuDomainDiskChangeSupported: Add missing iothreads check
by Peter Krempa 19 Nov '24

19 Nov '24

From: Adam Julis <ajulis(a)redhat.com> GSList of iothreads is not allowed to be changed while the virtual machine is running. Resolves: https://issues.redhat.com/browse/RHEL-23607 Signed-off-by: Adam Julis <ajulis(a)redhat.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- Changes to v1: - extrac to separate function - improve readability of loops and handling of error - fix possibility of infinitely looping if first queue of both queue lists matches src/qemu/qemu_domain.c | 46 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 66ab4baa8b..153bd56e86 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -6591,6 +6591,49 @@ qemuDomainStorageSourceAccessAllow(virQEMUDriver *driver, } +static bool +qemuDomainDiskChangeSupportedIothreads(virDomainDiskDef *disk, + virDomainDiskDef *orig_disk) +{ + GSList *old = orig_disk->iothreads; + GSList *new = disk->iothreads; + + while (true) { + virDomainDiskIothreadDef *old_def; + virDomainDiskIothreadDef *new_def; + size_t i; + + /* match - both empty or both at the end */ + if (!old && !new) + return true; + + /* mismatched length of lists */ + if (!old || !new) + goto fail; + + old_def = old->data; + new_def = new->data; + + if (old_def->id != new_def->id || + old_def->nqueues != new_def->nqueues) + goto fail; + + for (i = 0; i < old_def->nqueues; i++) { + if (old_def->queues[i] != new_def->queues[i]) + goto fail; + } + + new = new->next; + old = old->next; + } + + fail: + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", + _("cannot modify field '<iothreads>' (or it's parts) of the disk")); + return false; +} + + /* * Makes sure the @disk differs from @orig_disk only by the source * path and nothing else. Fields that are being checked and the @@ -6735,6 +6778,9 @@ qemuDomainDiskChangeSupported(virDomainDiskDef *disk, CHECK_EQ(discard, "discard", true); CHECK_EQ(iothread, "iothread", true); + if (!qemuDomainDiskChangeSupportedIothreads(disk, orig_disk)) + return false; + CHECK_STREQ_NULLABLE(domain_name, "backenddomain"); -- 2.47.0

2 1

Plans for 10.10.0 release (freeze on Tuesday 26 Nov)
by Jiri Denemark 19 Nov '24

19 Nov '24

We are getting close to 10.10.0 release of libvirt. To aim for the release on Monday 02 Dec I suggest entering the freeze on Tuesday 26 Nov and tagging RC2 on Thursday 28 Nov. I hope this works for everyone. Jirka

1 0

[PATCH] qemuDomainDiskChangeSupported: Add missing iothreads check
by Adam Julis 18 Nov '24

18 Nov '24

GSList of iothreads is not allowed to be changed while the virtual machine is running. Resolves: https://issues.redhat.com/browse/RHEL-23607 Signed-off-by: Adam Julis <ajulis(a)redhat.com> --- While the qemuDomainDiskChangeSupported() design primarily uses its macros (CHECK_EQ and CHECK_STREQ_NULLABLE), the logic for comparing 2 GSList of iothreads could perhaps be extracted into a separate function (e.g. IothreadsGslistCompare(GSList *first, GSList *second)). I am absolutely not sure about this idea so feel free to comment. src/qemu/qemu_domain.c | 53 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 298f4bfb9e..2b5222c685 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -8505,6 +8505,59 @@ qemuDomainDiskChangeSupported(virDomainDiskDef *disk, CHECK_EQ(discard, "discard", true); CHECK_EQ(iothread, "iothread", true); + /* compare list of iothreads, no change allowed */ + if (orig_disk->iothreads != disk->iothreads) { + GSList *old; + GSList *new = disk->iothreads; + bool print_err = true; + + for (old = orig_disk->iothreads; old; old = old->next) { + virDomainDiskIothreadDef *orig = old->data; + virDomainDiskIothreadDef *update; + print_err = false; + + if (new == NULL) { + print_err = true; + break; + } + + update = new->data; + + if (orig->id != update->id) { + print_err = true; + break; + } + + if (orig->nqueues != update->nqueues) { + print_err = true; + break; + } + + if (orig->nqueues != 0) { + ssize_t i = 0; + + while (i < orig->nqueues) { + if (orig->queues[i] != update->queues[i]) { + print_err = true; + break; + } + } + } + + new = new->next; + if (new) + print_err = true; + } + + if (print_err) { + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, + _("cannot modify field '%1$s' (or it's parts) of the disk"), + "iothreads"); + return false; + } + } + + CHECK_STREQ_NULLABLE(domain_name, "backenddomain"); -- 2.45.2

3 2

[PATCH 0/3] migration: Fix attempt to fix use of VIR_MIGRATE_PARAM_DEST_XML with VIR_MIGRATE_PERSIST_DEST
by Peter Krempa 18 Nov '24

18 Nov '24

Revert the code, document the quirks. Peter Krempa (3): Revert "qemu: migration: Improve handling of VIR_MIGRATE_PARAM_DEST_XML with VIR_MIGRATE_PERSIST_DEST" API: migration: Warn about use of VIR_MIGRATE_PERSIST_DEST with VIR_MIGRATE_PARAM_DEST_XML manpage: virsh: Add warning about 'migrate' with '--persistent' together with '--xml' docs/manpages/virsh.rst | 22 +++++++++++++-------- include/libvirt/libvirt-domain.h | 13 +++++++++++++ src/qemu/qemu_migration.c | 33 ++++++++++---------------------- 3 files changed, 37 insertions(+), 31 deletions(-) -- 2.47.0

2 4

[PATCH] vmx: Get the VMware boolean uefi.secureBoot.enabled
by Richard W.M. Jones 18 Nov '24

18 Nov '24

Some VMware guests have a boolean uefi.secureBoot.enabled. If found, and it's set to "TRUE", and if it's a UEFI guest, then add this clause into the domain XML: <os firmware='efi'> <firmware> <feature enabled='yes' name='enrolled-keys'/> <feature enabled='yes' name='secure-boot'/> </firmware> </os> This approximates the meaning of this VMware flag. Signed-off-by: Richard W.M. Jones <rjones(a)redhat.com> Fixes: https://issues.redhat.com/browse/RHEL-67836 --- src/vmx/vmx.c | 22 ++++++++++++++++++++++ tests/vmx2xmldata/esx-in-the-wild-12.xml | 4 ++++ 2 files changed, 26 insertions(+) diff --git a/src/vmx/vmx.c b/src/vmx/vmx.c index 132e54e15f..23a8a35360 100644 --- a/src/vmx/vmx.c +++ b/src/vmx/vmx.c @@ -1387,6 +1387,7 @@ virVMXParseConfig(virVMXContext *ctx, char *sched_cpu_shares = NULL; char *guestOS = NULL; bool smbios_reflecthost = false; + bool uefi_secureboot = false; int controller; int bus; int port; @@ -1963,6 +1964,27 @@ virVMXParseConfig(virVMXContext *ctx, } } + /* vmx:uefi.secureBoot.enabled */ + if (virVMXGetConfigBoolean(conf, "uefi.secureBoot.enabled", + &uefi_secureboot, false, true) < 0) { + goto cleanup; + } + if (uefi_secureboot && + def->os.firmware == VIR_DOMAIN_OS_DEF_FIRMWARE_EFI) { + int *features = def->os.firmwareFeatures; + + if (!features) { + features = g_new0(int, VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_LAST); + def->os.firmwareFeatures = features; + } + /* Just set both to true, as VMware doesn't have any concept + * of the two features separately. + */ + features[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_SECURE_BOOT] = + features[VIR_DOMAIN_OS_DEF_FIRMWARE_FEATURE_ENROLLED_KEYS] = + VIR_TRISTATE_BOOL_YES; + } + if (virDomainDefPostParse(def, VIR_DOMAIN_DEF_PARSE_ABI_UPDATE, xmlopt, NULL) < 0) goto cleanup; diff --git a/tests/vmx2xmldata/esx-in-the-wild-12.xml b/tests/vmx2xmldata/esx-in-the-wild-12.xml index 42184501d0..c5aad90677 100644 --- a/tests/vmx2xmldata/esx-in-the-wild-12.xml +++ b/tests/vmx2xmldata/esx-in-the-wild-12.xml @@ -9,6 +9,10 @@ </cputune> <os firmware='efi'> <type arch='x86_64'>hvm</type> + <firmware> + <feature enabled='yes' name='enrolled-keys'/> + <feature enabled='yes' name='secure-boot'/> + </firmware> </os> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> -- 2.46.0

2 1

[PATCH v2] ch: Enable callbacks for ch domain events
by Praveen K Paladugu 18 Nov '24

18 Nov '24

From: Praveen K Paladugu <prapal(a)linux.microsoft.com> Enable callbacks for define, undefine, started, booted, stopped, destroyed events of ch guests. Signed-off-by: Praveen K Paladugu <praveenkpaladugu(a)gmail.com> --- src/ch/ch_conf.h | 4 +++ src/ch/ch_driver.c | 82 ++++++++++++++++++++++++++++++++++++++++++++-- 2 files changed, 84 insertions(+), 2 deletions(-) diff --git a/src/ch/ch_conf.h b/src/ch/ch_conf.h index a77cad7a2a..97c6c24aa5 100644 --- a/src/ch/ch_conf.h +++ b/src/ch/ch_conf.h @@ -24,6 +24,7 @@ #include "virthread.h" #include "ch_capabilities.h" #include "virebtables.h" +#include "object_event.h" #define CH_DRIVER_NAME "CH" #define CH_CMD "cloud-hypervisor" @@ -75,6 +76,9 @@ struct _virCHDriver * then lockless thereafter */ virCHDriverConfig *config; + /* Immutable pointer, self-locking APIs */ + virObjectEventState *domainEventState; + /* pid file FD, ensures two copies of the driver can't use the same root */ int lockFD; diff --git a/src/ch/ch_driver.c b/src/ch/ch_driver.c index dab025edc1..d18f266387 100644 --- a/src/ch/ch_driver.c +++ b/src/ch/ch_driver.c @@ -28,6 +28,7 @@ #include "ch_monitor.h" #include "ch_process.h" #include "domain_cgroup.h" +#include "domain_event.h" #include "datatypes.h" #include "driver.h" #include "viraccessapicheck.h" @@ -263,6 +264,7 @@ chDomainCreateWithFlags(virDomainPtr dom, unsigned int flags) virCHDriver *driver = dom->conn->privateData; virDomainObj *vm; virCHDomainObjPrivate *priv; + virObjectEvent *event; g_autofree char *managed_save_path = NULL; int ret = -1; @@ -304,6 +306,14 @@ chDomainCreateWithFlags(virDomainPtr dom, unsigned int flags) ret = virCHProcessStart(driver, vm, VIR_DOMAIN_RUNNING_BOOTED); } + if (ret == 0) { + event = virDomainEventLifecycleNewFromObj(vm, + VIR_DOMAIN_EVENT_STARTED, + VIR_DOMAIN_EVENT_STARTED_BOOTED); + if (event) + virObjectEventStateQueue(driver->domainEventState, event); + } + endjob: virDomainObjEndJob(vm); @@ -323,8 +333,10 @@ chDomainDefineXMLFlags(virConnectPtr conn, const char *xml, unsigned int flags) { virCHDriver *driver = conn->privateData; g_autoptr(virDomainDef) vmdef = NULL; + g_autoptr(virDomainDef) oldDef = NULL; virDomainObj *vm = NULL; virDomainPtr dom = NULL; + virObjectEvent *event = NULL; g_autofree char *managed_save_path = NULL; unsigned int parse_flags = VIR_DOMAIN_DEF_PARSE_INACTIVE; @@ -345,7 +357,7 @@ chDomainDefineXMLFlags(virConnectPtr conn, const char *xml, unsigned int flags) if (!(vm = virDomainObjListAdd(driver->domains, &vmdef, driver->xmlopt, - 0, NULL))) + 0, &oldDef))) goto cleanup; /* cleanup if there's any stale managedsave dir */ @@ -358,11 +370,17 @@ chDomainDefineXMLFlags(virConnectPtr conn, const char *xml, unsigned int flags) } vm->persistent = 1; - + event = virDomainEventLifecycleNewFromObj(vm, + VIR_DOMAIN_EVENT_DEFINED, + !oldDef ? + VIR_DOMAIN_EVENT_DEFINED_ADDED : + VIR_DOMAIN_EVENT_DEFINED_UPDATED); dom = virGetDomain(conn, vm->def->name, vm->def->uuid, vm->def->id); cleanup: virDomainObjEndAPI(&vm); + virObjectEventStateQueue(driver->domainEventState, event); + return dom; } @@ -378,6 +396,7 @@ chDomainUndefineFlags(virDomainPtr dom, { virCHDriver *driver = dom->conn->privateData; virDomainObj *vm; + virObjectEvent *event = NULL; int ret = -1; virCheckFlags(0, -1); @@ -393,6 +412,9 @@ chDomainUndefineFlags(virDomainPtr dom, "%s", _("Cannot undefine transient domain")); goto cleanup; } + event = virDomainEventLifecycleNewFromObj(vm, + VIR_DOMAIN_EVENT_UNDEFINED, + VIR_DOMAIN_EVENT_UNDEFINED_REMOVED); vm->persistent = 0; if (!virDomainObjIsActive(vm)) { @@ -403,6 +425,8 @@ chDomainUndefineFlags(virDomainPtr dom, cleanup: virDomainObjEndAPI(&vm); + virObjectEventStateQueue(driver->domainEventState, event); + return ret; } @@ -643,6 +667,7 @@ chDomainDestroyFlags(virDomainPtr dom, unsigned int flags) { virCHDriver *driver = dom->conn->privateData; virDomainObj *vm; + virObjectEvent *event = NULL; int ret = -1; virCheckFlags(0, -1); @@ -662,6 +687,9 @@ chDomainDestroyFlags(virDomainPtr dom, unsigned int flags) if (virCHProcessStop(driver, vm, VIR_DOMAIN_SHUTOFF_DESTROYED) < 0) goto endjob; + event = virDomainEventLifecycleNewFromObj(vm, + VIR_DOMAIN_EVENT_STOPPED, + VIR_DOMAIN_EVENT_STOPPED_DESTROYED); virCHDomainRemoveInactive(driver, vm); ret = 0; @@ -670,6 +698,8 @@ chDomainDestroyFlags(virDomainPtr dom, unsigned int flags) cleanup: virDomainObjEndAPI(&vm); + virObjectEventStateQueue(driver->domainEventState, event); + return ret; } @@ -1365,6 +1395,7 @@ static int chStateCleanup(void) virObjectUnref(ch_driver->xmlopt); virObjectUnref(ch_driver->caps); virObjectUnref(ch_driver->domains); + virObjectUnref(ch_driver->domainEventState); virMutexDestroy(&ch_driver->lock); g_clear_pointer(&ch_driver, g_free); @@ -1414,6 +1445,9 @@ chStateInitialize(bool privileged, if (!(ch_driver->config = virCHDriverConfigNew(privileged))) goto cleanup; + if (!(ch_driver->domainEventState = virObjectEventStateNew())) + goto cleanup; + if ((rv = chExtractVersion(ch_driver)) < 0) { if (rv == -2) ret = VIR_DRV_STATE_INIT_SKIPPED; @@ -2205,6 +2239,48 @@ chDomainSetNumaParameters(virDomainPtr dom, return ret; } +static int +chConnectDomainEventRegisterAny(virConnectPtr conn, + virDomainPtr dom, + int eventID, + virConnectDomainEventGenericCallback callback, + void *opaque, + virFreeCallback freecb) +{ + virCHDriver *driver = conn->privateData; + int ret = -1; + + if (virConnectDomainEventRegisterAnyEnsureACL(conn) < 0) + return -1; + + if (virDomainEventStateRegisterID(conn, + driver->domainEventState, + dom, eventID, + callback, opaque, freecb, &ret) < 0) + ret = -1; + + return ret; +} + + +static int +chConnectDomainEventDeregisterAny(virConnectPtr conn, + int callbackID) +{ + virCHDriver *driver = conn->privateData; + + if (virConnectDomainEventDeregisterAnyEnsureACL(conn) < 0) + return -1; + + if (virObjectEventStateDeregisterID(conn, + driver->domainEventState, + callbackID, true) < 0) + return -1; + + return 0; +} + + /* Function Tables */ static virHypervisorDriver chHypervisorDriver = { .name = "CH", @@ -2262,6 +2338,8 @@ static virHypervisorDriver chHypervisorDriver = { .domainHasManagedSaveImage = chDomainHasManagedSaveImage, /* 10.2.0 */ .domainRestore = chDomainRestore, /* 10.2.0 */ .domainRestoreFlags = chDomainRestoreFlags, /* 10.2.0 */ + .connectDomainEventRegisterAny = chConnectDomainEventRegisterAny, /* 10.8.0 */ + .connectDomainEventDeregisterAny = chConnectDomainEventDeregisterAny, /* 10.8.0 */ }; static virConnectDriver chConnectDriver = { -- 2.44.0

2 4