Re: [libvirt PATCH 0/4] qemu/security: start passt process with correct SELinux label

2023-03-08 Thread Laine Stump
On 3/8/23 11:49 PM, Laine Stump wrote: All the necessary explanation is in Path 3/4 We may want to turn on this same behavior for some other external processes, but right now the one we need it for is passt. Resolves: https://bugzilla.redhat.com/2172267 I forgot to mention that proper

[libvirt PATCH 4/4] qemu: set SELinux label of passt process to its own binary's label

2023-03-08 Thread Laine Stump
set useBinarySpecificLabel = true when calling qemuSecurityCommandRun for the passt process, so that the new process context will include the binary-specific label that should be used for passt (passt_t) rather than svirt_t (as would happen if useBinarySpecificLabel was false). (The MCS part of

[libvirt PATCH 3/4] security: make it possible to set SELinux label of child process from its binary

2023-03-08 Thread Laine Stump
Normally when a child process is started by libvirt, the SELinux label of that process is set to virtd_t (plus an MCS range). In at least one case (passt) we need for the SELinux label of a child process label to match the label that the binary would have transitioned to automatically if it had

[libvirt PATCH 1/4] util: add an API to retrieve the resolved path to a virCommand's binary

2023-03-08 Thread Laine Stump
The binary to be exec'ed by virExec() is stored in virCommand::args[0], and is resolved to a full absolute path (stored in a local of virExec() just prior to execve(). Since we will have another use for the full absolute path, lets make an API to resolve/retrieve the absolute path, and cache it

[libvirt PATCH 2/4] security: make args to virSecuritySELinuxContextAddRange() const

2023-03-08 Thread Laine Stump
Neither of these are modified anywhere in the function, and the function will soon be called with an arg that actually is a const. Signed-off-by: Laine Stump --- src/security/security_selinux.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git

[libvirt PATCH 0/4] qemu/security: start passt process with correct SELinux label

2023-03-08 Thread Laine Stump
All the necessary explanation is in Path 3/4 We may want to turn on this same behavior for some other external processes, but right now the one we need it for is passt. Resolves: https://bugzilla.redhat.com/2172267 Laine Stump (4): util: add an API to retrieve the resolved path to a

Re: [PATCH] vfio/pci: Propagate ACPI notifications to the user-space

2023-03-08 Thread Alex Williamson
On Wed, 8 Mar 2023 14:44:28 -0800 Dominik Behr wrote: > On Wed, Mar 8, 2023 at 12:06 PM Alex Williamson > wrote: > > > > On Wed, 8 Mar 2023 10:45:51 -0800 > > Dominik Behr wrote: > > > > > It is the same interface as other ACPI events like AC adapter LID etc > > > are forwarded to

Re: [PATCH] vfio/pci: Propagate ACPI notifications to the user-space

2023-03-08 Thread Alex Williamson
On Wed, 8 Mar 2023 10:45:51 -0800 Dominik Behr wrote: > On Wed, Mar 8, 2023 at 9:49 AM Alex Williamson > wrote: > > > Adding libvirt folks. This intentionally designs the interface in a > > way that requires a privileged intermediary to monitor netlink on the > > host, associate messages to

Re: [PATCH] vfio/pci: Propagate ACPI notifications to the user-space

2023-03-08 Thread Alex Williamson
[Cc +libvir-list] On Wed, 8 Mar 2023 12:41:24 +0100 Grzegorz Jaszczyk wrote: > śr., 8 mar 2023 o 00:42 Alex Williamson > napisał(a): > > > > On Tue, 7 Mar 2023 22:05:53 + > > Grzegorz Jaszczyk wrote: > > > > > From: Dominik Behr > > > > > > Hitherto there was no support for

Re: [libvirt PATCH] apparmor: Enable passt support

2023-03-08 Thread Daniel P . Berrangé
On Wed, Mar 08, 2023 at 09:23:19AM -0800, Andrea Bolognani wrote: > On Tue, Mar 07, 2023 at 01:28:41PM -0800, Andrea Bolognani wrote: > > On Tue, Mar 07, 2023 at 07:04:25PM +, Daniel P. Berrangé wrote: > > > On Tue, Mar 07, 2023 at 08:02:37PM +0100, Andrea Bolognani wrote: > > > > + # support

Re: [libvirt PATCH] apparmor: Enable passt support

2023-03-08 Thread Andrea Bolognani
On Tue, Mar 07, 2023 at 01:28:41PM -0800, Andrea Bolognani wrote: > On Tue, Mar 07, 2023 at 07:04:25PM +, Daniel P. Berrangé wrote: > > On Tue, Mar 07, 2023 at 08:02:37PM +0100, Andrea Bolognani wrote: > > > + # support for passt network back-end > > > + /usr/bin/passt Cx -> passt, > > > + >

[PATCH 00/16] Farewell rpcgen

2023-03-08 Thread Daniel P . Berrangé
This series something I was hacking on a little while back in an attempt to make our RPC layer more maintainable. There are many aspects I'm unhappy about with current code * When serializing a message we have no clue how big it will be, but xdrmem_create wants a fixed size, so we have to

[PATCH 15/16] remote: use g_auto for client RPC return parameters

2023-03-08 Thread Daniel P . Berrangé
Currently some, but not all, methods have a call to the xdr_free function, for the 'ret' variable. This is done on methods where there are complex structs containing allocated memory. In other cases the structs contain allocated memory, but the pointer is stolen, so xdr_free is not called. In

[PATCH 02/16] build-aux: skip E203 and W503 flake8 checks

2023-03-08 Thread Daniel P . Berrangé
The flake8 check W503 does not want a line break before binary operator. This is contrary to the style that the 'black' formatting tool wants to use. Defer to 'black' as it is intended to be an opinionated formatting tool standardizing python code style, and thus not to be customized per project.

[PATCH 07/16] rpcgen: define a visitor API for XDR protocol specs

2023-03-08 Thread Daniel P . Berrangé
The visitor API defines an interface for visiting each element in the XDR protocol spec abstract syntax tree. Signed-off-by: Daniel P. Berrangé --- scripts/rpcgen/rpcgen/visitor.py | 156 +++ 1 file changed, 156 insertions(+) create mode 100644

[PATCH 13/16] rpc: use g_auto for client RPC return parameters

2023-03-08 Thread Daniel P . Berrangé
Currently some, but not all, methods have a call to the xdr_free function, for the 'ret' variable. This is done on methods where there are complex structs containing allocated memory. In other cases the structs contain allocated memory, but the pointer is stolen, so xdr_free is not called. In

[PATCH 16/16] rpc: add helpers for XDR type serialization

2023-03-08 Thread Daniel P . Berrangé
As preparation for eliminating the use of the XDR library, introduce helpers for (de)serializing XDR types from/to the virNetMessage object. In contrast to the XDR APIs, when encoding data our helpers can dynamically resize the virNetMessage buffer. Our decode helpers also exhibit delayed error

[PATCH 09/16] rpcgen: add test case for XDR serialization

2023-03-08 Thread Daniel P . Berrangé
Test the serialization done by libtirpc, so that when we later switch to our own code, we can prove wire compatibility. Signed-off-by: Daniel P. Berrangé --- build-aux/syntax-check.mk | 11 +- scripts/rpcgen/tests/demo.x | 1 -

[PATCH 11/16] build: switch over to new rpc generator code

2023-03-08 Thread Daniel P . Berrangé
This replaces use of 'rpcgen' with our new python impl of the RPC code generator. Since the new impl generates code that matches our style/coding rules, and does not contain long standing bugs, we no longer need to post-process the output. Signed-off-by: Daniel P. Berrangé --- libvirt.spec.in

[PATCH 06/16] rpcgen: add an XDR protocol parser

2023-03-08 Thread Daniel P . Berrangé
This adds a parser capable of handling the XDR protocol files. The parsing grammar requirements are detailed in https://www.rfc-editor.org/rfc/rfc4506#section-6.3 Signed-off-by: Daniel P. Berrangé --- scripts/rpcgen/rpcgen/parser.py | 497

[PATCH 14/16] admin: use g_auto for client RPC return parameters

2023-03-08 Thread Daniel P . Berrangé
Currently some, but not all, methods have a call to the xdr_free function, for the 'ret' variable. This is done on methods where there are complex structs containing allocated memory. In other cases the structs contain allocated memory, but the pointer is stolen, so xdr_free is not called. In

[PATCH 01/16] rpcgen: drop type-puning workarounds

2023-03-08 Thread Daniel P . Berrangé
The current RPC code is post-processed to introduce an intermediate variable, rather than casting directly to char ** at time of use. This is said to be a workaround for type-puning warnings that the compiler emitted. Neither GCC or CLang emit any warnings for the code in question today, across

[PATCH 12/16] rpcgen: add g_auto function support

2023-03-08 Thread Daniel P . Berrangé
This will eliminate the need to call xdr_free to clear pointers from data structures. Signed-off-by: Daniel P. Berrangé --- build-aux/syntax-check.mk | 2 +- scripts/rpcgen/main.py | 4 + scripts/rpcgen/rpcgen/generator.py | 64 +--

[PATCH 08/16] rpcgen: add a C code generator for XDR protocol specs

2023-03-08 Thread Daniel P . Berrangé
This implements a C code generator that emits code that is (almost) identical to the classic 'rpcgen' program. The key differences are: - Skip inlining of calls for struct fields - Skip K style function prototypes in headers - Use int64_t instead of quad_t for OS portability - Saner

[PATCH 05/16] rpcgen: add an XDR protocol abstract syntax tree

2023-03-08 Thread Daniel P . Berrangé
This introduces classes needed to form an abstract syntax tree representing the XDR protocol language. The syntax requirements are detailed in https://www.rfc-editor.org/rfc/rfc4506#section-6.3 Signed-off-by: Daniel P. Berrangé --- scripts/rpcgen/rpcgen/ast.py | 270

[PATCH 10/16] rpcgen: define entrypoint for running new rpcgen impl

2023-03-08 Thread Daniel P . Berrangé
The new program takes the form rpcgen [--mode source|header|repr] \ [--header include] \ xdr-file output-file If '--mode' is not given it parses the XDR file but does not generate anything, which is useful as a syntax check. The 'source' mode gives the '.c' file content,

[PATCH 04/16] rpcgen: add an XDR protocol lexer

2023-03-08 Thread Daniel P . Berrangé
This adds a lexer capable of handling the XDR protocol files. The lexical rquirements are detailed in https://www.rfc-editor.org/rfc/rfc4506#section-6.2 pytest is introduced as a build dependancy for testing python code. Signed-off-by: Daniel P. Berrangé --- libvirt.spec.in

[PATCH 03/16] build-aux: introduce 'black' tool for python formatting

2023-03-08 Thread Daniel P . Berrangé
The 'black' tool is intended to be an opinionated formatting tool for python code. It is complementary to flake8 which validates coding bad practices, but (mostly) ignores code layout issues. Signed-off-by: Daniel P. Berrangé --- build-aux/Makefile.in | 1 + build-aux/meson.build | 5

RE: [PATCH v2 5/6] qemu: Allow setting per-disk snapshot name for RBD disks

2023-03-08 Thread Or Ozeri
> -Original Message- > From: Peter Krempa > Sent: Monday, 20 February 2023 16:13 > To: Or Ozeri > Cc: libvir-list@redhat.com; Danny Harnik > Subject: [EXTERNAL] Re: [PATCH v2 5/6] qemu: Allow setting per-disk > snapshot name for RBD disks > > > diff --git a/src/qemu/qemu_snapshot.c

[libvirt PATCH 3/3] domainsnapshot: add snapshotDeleteInProgress to RNG schema

2023-03-08 Thread Pavel Hrdina
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2174397 Fixes: 565bcb5d79dddaf1d0d14cffe1f3ae78d76b10a0 Signed-off-by: Pavel Hrdina --- src/conf/schemas/domainsnapshot.rng | 10 ++ 1 file changed, 10 insertions(+) diff --git a/src/conf/schemas/domainsnapshot.rng

RE: [PATCH v2 3/6] qemu: Add internal support for active disk internal snapshots

2023-03-08 Thread Or Ozeri
> -Original Message- > From: Peter Krempa > Sent: Monday, 20 February 2023 16:00 > To: Or Ozeri > Cc: libvir-list@redhat.com; Danny Harnik > Subject: [EXTERNAL] Re: [PATCH v2 3/6] qemu: Add internal support for > active disk internal snapshots > > This modification is done to a

[libvirt PATCH 2/3] qemu_snapshot: fix external snapshot deletion for non-active snapshots

2023-03-08 Thread Pavel Hrdina
For shutoff VMs we don't have the storage source backing chain populated so it will fail this check and error out. Move it to part that is done only when VM is running. Signed-off-by: Pavel Hrdina --- src/qemu/qemu_snapshot.c | 24 1 file changed, 12 insertions(+), 12

[libvirt PATCH 0/3] external snapshot delete fixes

2023-03-08 Thread Pavel Hrdina
Pavel Hrdina (3): qemu_snapshot: properly ignore disks with manual snapshot qemu_snapshot: fix external snapshot deletion for non-active snapshots domainsnapshot: add snapshotDeleteInProgress to RNG schema src/conf/schemas/domainsnapshot.rng | 10 ++ src/qemu/qemu_snapshot.c

[libvirt PATCH 1/3] qemu_snapshot: properly ignore disks with manual snapshot

2023-03-08 Thread Pavel Hrdina
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2173142 Signed-off-by: Pavel Hrdina --- src/qemu/qemu_snapshot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c index cfa531edef..7207b5879a 100644 ---

[PATCH 09/14] qemu: Fix qemuDomainGetEmulatorPinInfo()

2023-03-08 Thread Michal Privoznik
The order of pinning priority (at least for emulator thread) was set by v1.2.15-rc1~58 (for cgroup code). But later, when automatic placement was implemented into qemuDomainGetEmulatorPinInfo(), the priority was not honored. Now that we have this priority code in a separate function, we can just

[PATCH 07/14] qemuxml2argvmock: Drop virNuma* mocks

2023-03-08 Thread Michal Privoznik
Since qemuxml2argvtest is now using virnumamock, there's no need for qemuxml2argvmock to offer reimplementation of virNuma*() functions. Also, the comment about CLang and FreeBSD (introduced in v4.3.0-40-g77ac204d14) is no longer true. Looks like noinline attribute was the missing culprit.

[PATCH 11/14] qemu: Add @nodemask argument to qemuBuildThreadContextProps()

2023-03-08 Thread Michal Privoznik
When building a thread-context object (inside of qemuBuildThreadContextProps()) we look at given memory-backend-* object and look for .host-nodes attribute. This works, as long as we need to just copy the attribute value into another thread-context attribute. But soon we will need to adjust it.

[PATCH 10/14] qemu: Add @nodemaskRet argument to qemuBuildMemoryBackendProps()

2023-03-08 Thread Michal Privoznik
While it's true that anybody who's interested in getting .host-nodes attribute value can just use virJSONValueObjectGetArray() (and that's exactly what qemuBuildThreadContextProps() is doing, btw), it somebody is interested in getting the actual virBitmap, they would have to parse the JSON array.

[PATCH 00/14] qemuBuildThreadContextProps: Prune .node-afinity wrt

2023-03-08 Thread Michal Privoznik
See 12/14 for explanation and seeing the fix in action. Michal Prívozník (14): virnuma: Move virNumaNodesetToCPUset() our of WITH_NUMACTL virnuma: Introduce virNumaCPUSetToNodeset() virnumamock: Introduce virNumaGetNodeOfCPU() mock qemuxml2argvtest: Use virnuma mock qemuxml2argvdata:

[PATCH 03/14] virnumamock: Introduce virNumaGetNodeOfCPU() mock

2023-03-08 Thread Michal Privoznik
Introduce a mock of virNumaGetNodeOfCPU() because soon we will need virNumaCPUSetToNodeset() to return predictable results. Also, fill in missing symlinks in vircaps2xmldata/. Signed-off-by: Michal Privoznik --- src/util/virnuma.h| 2 +-

[PATCH 05/14] qemuxml2argvdata: Adjust maximum NUMA node used

2023-03-08 Thread Michal Privoznik
We have couple of qemuxml2argvtest cases where up to 8 NUMA nodes are assumed. These are used to check whether disjoint ranges of host-nodes= is generated properly. Without prejudice to the generality, we can rewrite corresponding XML files to use up to 4 NUMA nodes and still have disjoint ranges.

[PATCH 12/14] qemuBuildThreadContextProps: Prune .node-afinity wrt

2023-03-08 Thread Michal Privoznik
When a thread-context object is specified on the cmd line, then QEMU spawns a thread and sets its affinity to the list of NUMA nodes specified in .node-affinity attribute. And this works just fine, until the main QEMU thread itself is not restricted. Because of v5.3.0-rc1~18 we restrict the main

[PATCH 01/14] virnuma: Move virNumaNodesetToCPUset() our of WITH_NUMACTL

2023-03-08 Thread Michal Privoznik
Technically, there's nothing libnuma specific about virNumaNodesetToCPUset(). It just implements a generic algorithm over virNumaGetNodeCPUs() (which is then libnuma dependant). Nevertheless, there's no need to have this function living inside WITH_NUMACTL block. Any error returned from

[PATCH 04/14] qemuxml2argvtest: Use virnuma mock

2023-03-08 Thread Michal Privoznik
While no part of cmd line building process currently depends on a host NUMA configuration, this will change soon. Use freshly changed virnumamock from qemuxml2argvtest and make the mock read NUMA data from vircaps2xmldata which seems to have the most rich NUMA configuration. This also means, we

[PATCH 13/14] docs: Document memory allocation and emulator pinning limitation

2023-03-08 Thread Michal Privoznik
Signed-off-by: Michal Privoznik --- docs/formatdomain.rst | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index c4077c6868..206875d68e 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -1117,7 +1117,9 @@

[PATCH 02/14] virnuma: Introduce virNumaCPUSetToNodeset()

2023-03-08 Thread Michal Privoznik
So far, we have a function that expands given list of NUMA nodes into list of CPUs. But soon, we are going to need the inverse - expand list of CPUs into list of NUMA nodes. Introduce virNumaCPUSetToNodeset() for that. Signed-off-by: Michal Privoznik --- src/libvirt_private.syms | 2 ++

[PATCH 08/14] qemu: Move cpuset preference evaluation into a separate function

2023-03-08 Thread Michal Privoznik
The set of if()-s that determines the preference in cpumask used for setting things like emulatorpin, vcpupin, etc. is going to be re-used. Separate it out into a function. You may think that this changes behaviour, but qemuProcessPrepareDomainNUMAPlacement() ensures that priv->autoCpuset is set

[PATCH 14/14] NEWS: Document recent thread-context bug fix

2023-03-08 Thread Michal Privoznik
Signed-off-by: Michal Privoznik --- NEWS.rst | 7 +++ 1 file changed, 7 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 089ad733f2..29239950c1 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -42,6 +42,13 @@ v9.2.0 (unreleased) Due to a logic bug introduced in libvirt 9.0.0, VM

[PATCH 06/14] qemuxml2argvdata: Extend vCPUs placement in memory-hotplug-dimm-addr.xml

2023-03-08 Thread Michal Privoznik
So far, the memory-hotplug-dimm-addr.xml test case pins its vCPUs onto CPUs 0-1 which correspond to NUMA node #0 (per tests/vircaps2xmldata/linux-basic/system/node/node0). Place vCPUs onto nodes #1 and #2 too so that DIMM device can continue using thread-context after future patches. This

Re: [PATCH] rpc: genprotocol: Always apply fixups to rpcgen's output

2023-03-08 Thread Ján Tomko
On a Wednesday in 2023, Peter Krempa wrote: The platform check which determines when to apply the fixups mentions all officially supported build targets (per docs/platforms.rst) thus it's not really necessary. Additionally while not explicitly written as supported the check does not work

Re: [PATCH 0/4] virscsihost: Couple of cleanups and fixes

2023-03-08 Thread Ján Tomko
On a Wednesday in 2023, Michal Privoznik wrote: *** BLURB HERE *** Michal Prívozník (4): virscsihost: use g_autofree more virSCSIHostFindByPCI: Decrease scope of some variables virscsihost: Drop needless labels virSCSIHostFindByPCI: Fix link detection src/util/virscsihost.c | 48

Re: [PATCH 4/4] virSCSIHostFindByPCI: Fix link detection

2023-03-08 Thread Ján Tomko
On a Wednesday in 2023, Michal Privoznik wrote: Inside of virSCSIHostFindByPCI() there's a loop which iterates of entries of "/sys/class/scsi_host" directory trying to identify all symlinks (which then point to a SCSI device, but that's not important right now). But the way virFileIsLink() is

[PATCH] rpc: genprotocol: Always apply fixups to rpcgen's output

2023-03-08 Thread Peter Krempa
The platform check which determines when to apply the fixups mentions all officially supported build targets (per docs/platforms.rst) thus it's not really necessary. Additionally while not explicitly written as supported the check does not work properly when building with the MinGW toolchain on

Re: [libvirt PATCH v3] qemu: implement QEMU NBD source reconnect delay attribute

2023-03-08 Thread Christian Nautze
Hi, I know everyone is drowning in work but perhaps someone could review this patch? I think this is also a useful feature for others to configure the reconnect delay while attaching a NBD disk to a running VM. Thanks! Christian On Mon, 27 Feb 2023 at 12:15, Christian Nautze wrote: >

[PATCH 3/4] virscsihost: Drop needless labels

2023-03-08 Thread Michal Privoznik
After previous cleanups, we're left with a couple of needless labels, that contain nothing but a return statement. Drop those. Signed-off-by: Michal Privoznik --- src/util/virscsihost.c | 16 ++-- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/src/util/virscsihost.c

[PATCH 2/4] virSCSIHostFindByPCI: Decrease scope of some variables

2023-03-08 Thread Michal Privoznik
Inside of virSCSIHostFindByPCI() there're some variables that are used from a while() loop exclusively. Bring their declaration into the loop. Signed-off-by: Michal Privoznik --- src/util/virscsihost.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git

[PATCH 1/4] virscsihost: use g_autofree more

2023-03-08 Thread Michal Privoznik
Remove some obvious uses of VIR_FREE() in favor of automatic cleanup. This also means, that some variables affected are brought into the inner most block, so that automatic cleanup is effective. Signed-off-by: Michal Privoznik --- src/util/virscsihost.c | 24 ++-- 1 file

[PATCH 4/4] virSCSIHostFindByPCI: Fix link detection

2023-03-08 Thread Michal Privoznik
Inside of virSCSIHostFindByPCI() there's a loop which iterates of entries of "/sys/class/scsi_host" directory trying to identify all symlinks (which then point to a SCSI device, but that's not important right now). But the way virFileIsLink() is called can never return a truthful reply - because

[PATCH 0/4] virscsihost: Couple of cleanups and fixes

2023-03-08 Thread Michal Privoznik
*** BLURB HERE *** Michal Prívozník (4): virscsihost: use g_autofree more virSCSIHostFindByPCI: Decrease scope of some variables virscsihost: Drop needless labels virSCSIHostFindByPCI: Fix link detection src/util/virscsihost.c | 48 ++ 1 file