Commit Graph

8597 Commits

Author SHA1 Message Date
Peter Krempa
156ddb43b1 storage_file_probe: Treat qcow2 images with protocol drivers in backing store field as raw
qemu allows and in some cases uses protocol driver names ('file',
'host_device', 'nbd', ...) in the 'backing file format' field of a qcow
to denote a image where the dummy 'raw' driver was not used on top.

Adapt our backing store parser for such cases. The examples added in
previous patch show the difference in behaviour.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-11-27 10:12:34 +01:00
Peter Krempa
6fe9e35610 virstoragetest: Add test cases for QCOW2 files with a protocol name as backing file format
QEMU allows and in cases where you omit the not-strictly-needed 'raw'
driver on top of raw images automatically uses the protocol name inside
of the 'backing file format' field of the qcow2 image.

Libvirt expects only format names in that field.

Add example images showing this scenario, which will be fixed later.

The qcow2 image files in this commit were formatted as:

  qemu-img create -f qcow2 -F nbd -b  nbd+tcp://example.org:6000/blah -u qcow2-protocol-backing-nbd.qcow2 10M

and

  qemu-img create -f qcow2 -F file -b raw  qcow2-protocol-backing-file.qcow2

thus using 'nbd' and 'file' as backing format respectively.

(note that '-b raw' refers to the file in the example image folder)

To satisfy the test, note that the NBD image is also rejected as we
can't probe it, thus such configuration would not work.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-11-27 10:12:34 +01:00
Peter Krempa
7e158006b6 virstoragetest: Format detected/unprocessed backing store format into output files
Compare also the detected format of the backing file
('backingStoreRawFormat' field) into the output data for comparison with
others. Since the ToString function can't convert VIR_STORAGE_FILE_AUTO
use also the numeric value.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-11-27 10:12:34 +01:00
Peter Krempa
bc54376f09 virstoragetest: Use strings for storage type and format in output data
Make it easier for the humans to read/compare the outputs.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-11-27 10:12:34 +01:00
Michal Privoznik
10594bb311 qemu: Generate cmd line for pipewire audio backend
This is mostly straightforward, except for a teensy-weensy
detail: usually, there's no system wide daemon running, no system
wide available socket that anybody could connect to. PipeWire
uses a per user daemon approach instead. But this in turn means,
that the socket location floats between various locations and is
derived from various environment variables (just like the actual
socket name) and thus we must pass the variables to QEMU.

Resolves: https://gitlab.com/libvirt/libvirt/-/issues/560
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-11-24 17:49:20 +01:00
Michal Privoznik
c472ce024b conf: Introduce pipewire audio backend
QEMU gained support for PipeWire audio backend (see QEMU commit
of v8.0.0-403-gc2d3d1c294). Its configuration knobs are basically
the same as pulseaudio's, except for PA's server name. Therefore,
a lot of code is copied over from pulseadio and fixed by
s/Pulse/Pipewire/ or s/pulseaudio/pipewire/.

There's one ley difference to PA though: pipewire daemon is
usually on per user basis (just like our qemu:///session).
Therefore, introduce this 'runtimeDir' attribute, which allows
specifying path to pipewire daemon socket (useful for
qemu:///system for instance).

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-11-24 17:49:02 +01:00
Tim Wiederhake
784a63c189 Fix cpu-host-model test data
This was broken by the recent addition of vmx-* features.

Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
2023-11-24 11:05:13 +01:00
Tim Wiederhake
6562669388 cpu_map: Add missing vmx features from MSR 0x491
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
2023-11-24 10:47:05 +01:00
Tim Wiederhake
a155693a40 cpu_map: Add missing vmx features from MSR 0x490
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
2023-11-24 10:47:02 +01:00
Tim Wiederhake
2e49a26158 cpu_map: Add missing vmx features from MSR 0x48F
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
2023-11-24 10:47:00 +01:00
Tim Wiederhake
848e2d0949 cpu_map: Add missing vmx features from MSR 0x48E
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
2023-11-24 10:46:58 +01:00
Tim Wiederhake
23f509c102 cpu_map: Add missing vmx features from MSR 0x48D
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
2023-11-24 10:46:55 +01:00
Tim Wiederhake
102f6335b9 cpu_map: Add missing vmx features from MSR 0x48C
Differences from qemu:

* "vmx-ept-uc" (bit 8) and "vmx-ept-wb" (bit 14) are not added to
qemu's list of named features yet, but used in several qemu cpu
models never the less. Add to libvirt regardless.

* "vmx-invvpid-single-context" (bit 41) is erroneously called
"vmx-invept-single-context" in qemu. This is the name of the
feature associated with bit 25 in both libvirt and qemu.

* "vmx-invvpid-single-context-noglobals" (bit 43) is erroneously
called "vmx-invept-single-context-noglobals". Use the correct name.

Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
2023-11-24 10:46:50 +01:00
Tim Wiederhake
94eacd5a5f cpu_map: Add missing vmx features from MSR 0x48B
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
2023-11-24 10:46:47 +01:00
Tim Wiederhake
a1862e3de2 cpu_map: Add missing vmx features from MSR 0x485
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
2023-11-24 10:46:44 +01:00
Tim Wiederhake
3590bb344e cpu_map: Add missing vmx features from MSR 0x480
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
2023-11-24 10:46:40 +01:00
Tim Wiederhake
20c4a99fc5 cpu_map: Add missing feature "gds-no"
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
2023-11-24 10:46:21 +01:00
Michal Privoznik
cfcbba4c2b lib: Replace qsort() with g_qsort_with_data()
While glibc provides qsort(), which usually is just a mergesort,
until sorting arrays so huge that temporary array used by
mergesort would not fit into physical memory (which in our case
is never), we are not guaranteed it'll use mergesort. The
advantage of mergesort is clear - it's stable. IOW, if we have an
array of values parsed from XML, qsort() it and produce some
output based on those values, we can then compare the output with
some expected output, line by line.

But with newer glibc this is all history. After [1], qsort() is
no longer mergesort but introsort instead, which is not stable.
This is suboptimal, because in some cases we want to preserve
order of equal items. For instance, in ebiptablesApplyNewRules(),
nwfilter rules are sorted by their priority. But if two rules
have the same priority, we want to keep them in the order they
appear in the XML. Since it's hard/needless work to identify
places where stable or unstable sorting is needed, let's just
play it safe and use stable sorting everywhere.

Fortunately, glib provides g_qsort_with_data() which indeed
implement mergesort and it's a drop in replacement for qsort(),
almost. It accepts fifth argument (pointer to opaque data), that
is passed to comparator function, which then accepts three
arguments.

We have to keep one occurance of qsort() though - in NSS module
which deliberately does not link with glib.

1: https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=03bf8357e8291857a435afcc3048e0b697b6cc04
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
2023-11-24 09:53:14 +01:00
Peter Krempa
658a024127 qemucapabilitiestest: Update capabilities data for 8.2 dev cycle on x86_64
Update to v8.1.0-3111-gad6ef0a42e

Notable changes:
 - migration:
    - multichannel migration added
        - 'channels' array argument of migrate/migrate-incomming added
    - legacy block migration deprecated
        - 'blk', 'inc' arguments of 'migrate' command
        - 'block' migration capability
        - 'block-incremental' migration parameter
    - legacy migration compression deprecated
        - 'compress' migration capability
        - 'compress-level', 'compress-threads', 'compress-wait-thread',
          'decompress-threads' migration paramters
    - migration parameter 'mode' with 'normal' and 'cpr-reboot' options
      added

 - new formats for 'dump-guest-memory'
    - 'dump-raw-lzo', 'kdump-raw-snappy', 'kdump-raw-zlib' added

 - 'block-job-change' command added

 - 'HV_BALLOON_STATUS_REPORT' event and
   'query-hv-balloon-status-report' command added

 - deprecated old i440fx machine types:
    - 'pc-i440fx-2.0', 'pc-i440fx-2.1', 'pc-i440fx-2.2', 'pc-i440fx-2.3'

 - 'sha-ni' and few other ring 0 instruction are now exposed to tcg
   guests

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-11-10 10:04:04 +01:00
Peter Krempa
bdb516901c qemuxml2argvtest: Add '8.1.0' variants of 'cpu-host-model*' tests
Upcoming test bump will cause some changes thus preserve the existing
state.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-11-10 10:04:04 +01:00
Peter Krempa
f90675087f qemuxml2argvtest: Add complementary 'kvm/tcg' test cases for cpu-host-model*
CPU host model expansion depends on the CPU data from the capabilities
and can change based on emulation type. Add complementary tests to the
ones we already have to ensure full coverage.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-11-10 10:04:04 +01:00
Peter Krempa
3b1e855505 qemuxml2argvtest: Rename 'cpu-host-model' tests according to emulation type
The cpu-host-model.xml test case uses 'kvm' whereas the
fallback/nofallback cases use tcg in the definition. Rename them
accordingly so that the complement cases can be added later.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-11-10 10:04:04 +01:00
Peter Krempa
c0ed248b78 tests: qemumigparamsdata: Drop deprecated fields
Migration compression parameters 'compress-level', 'compress-threads',
'decompress-threads' were deprecated by qemu. Drop them from the tests.

Note that the migration code automatically checks whether given
capability is supported by qemu and thus we don't need to add any
further code to prepare for the legacy compression to be dropped.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-11-10 10:04:04 +01:00
Peter Krempa
f0643a5759 qemumigrationcookiexmltest: Don't crash when parsing of status XML fails
Some sub-tests dereference 'data->vm' even when it is NULL.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-11-10 10:04:04 +01:00
Laine Stump
9231566146 build: suppress "ignoring duplicate libraries" warning on macOS
Xcode 15, which provides the compiler toolchain for building libvirt
on macOS has switched to a new linker that warns about duplicated
"-lblah" options on the ld commandline. In practice this is impossible
to prevent in a large project, and also harmless.

Fortunately the new ld command also has an option,
-no_warn_duplicate_libraries, that supresses this harmless/pointless
warning, meson has a simple way to check if that option is supported,
and libvirt's meson.build files already have examples of adding an
option to the ld commandline if it's available.

Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
2023-11-03 15:56:37 -04:00
Laine Stump
3d9019e64f tests: ignore $__CF_USER_TEXT_ENCODING in env during commandtest
This environment variable is supposedly set according to the contents
of ~/.CFUserTextEncoding, and certainly on MacOS 14 (Sonoma) it is set
in the environment of child processes created by execve() (used by
virCommand()), causing commandtest to fail. (However, the value that is
shown in $__CF_USER_TEXT_ENCODING during the test 1) is not in the
environment of the shell the test is run from, and 2) doesn't match
the contents of ~/.CFUserTextEncoding.)

It is true, though, that filtering out this environment setting from
the test results permits commandtest to pass on macOS 14 (Sonoma).

Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
2023-11-03 13:31:26 -04:00
Peter Krempa
47ee78048c qemu: block: Remove unused flags QEMU_BLOCK_STORAGE_SOURCE_BACKEND_PROPS_ flags
QEMU_BLOCK_STORAGE_SOURCE_BACKEND_PROPS_SKIP_UNMAP is no longer
referenced inside the code.

QEMU_BLOCK_STORAGE_SOURCE_BACKEND_PROPS_AUTO_READONLY is passed from
various code paths to the qemuBlockStorageSourceGetBackendProps helper,
but it's no longer used.

Both thus can be removed.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-11-02 15:32:43 +01:00
Peter Krempa
80494dfb74 qemu: block: Use qemuBlockStorageSourceAddBlockdevCommonProps for storage slice
Use the new helper in qemuBlockStorageSourceGetBlockdevStorageSliceProps
to format the common bits.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-11-02 15:31:40 +01:00
Peter Krempa
84df50dc87 qemuBlockStorageSourceGetBackendProps: Unify ordering of fields
Use the same ordering of the relevant fields as we do for the format
layer -blockdev so that later they can be refactored without test
fallout.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-11-02 15:31:10 +01:00
Peter Krempa
197fc3723f qemublocktest: testBackingXMLjsonXML: Drop 'legacy' mode
Legacy mode used to be needed for use with -drive, which was almost
completely deleted. We now have qemuxml2argvtest test cases checking a
few cases and the rest uses the modern mode only. Thus we don't need to
test the legacy mode any more.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-10-27 15:04:20 +02:00
Peter Krempa
35815b1e75 qemublocktest: Fix logical bug in TEST_JSON_FORMAT macro
Condition handling failure of the first virTestRun was lacking the 'ret
= -1' line thus the subsequent line was taken as it's body rendering the
first invocation useless.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-10-27 15:04:20 +02:00
Peter Krempa
eda1649752 qemublocktest: Drop 'sheepdog' and 'vxhs' test cases
QEMU deprecated and removed support for those protocols, but due to a
logic bug in the tests it was not caught. Remove the test cases first.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-10-27 15:04:20 +02:00
Peter Krempa
49e613bf50 qemucapabilitiestest: Update capabilities data for 8.2 dev cycle on x86_64
Update to v8.1.0-2161-ga95260486a

Notable changes:
 - new CPU topology parameters: 'books', 'drawers'
 - new migration parameter 'avail-switchover-bandwidth'
 - new s390x CPU properties: 'dedicated', 'entitlement'
 - new 'hostmem' parameter for 'virtio-gpu'
 - new device 'piix4-isa'
 - new property 'dynamic-memslots' of 'virtio-mem' device
 - new 'gsi*' parameters of 'ICH9-LPC'
 - new experimental 'x-south-bridge' machine option

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
2023-10-27 15:04:09 +02:00
Andrea Bolognani
3653eb5dcf tests: Fix some test cases on macOS
Test cases that depend on duplicating fds are using fairly big
values as targets.

This works fine on Linux, where RLIMIT_NOFILE is 1024 by
default, but fails on macOS which uses 256 as the default.

Decrease the values so that they're valid across all platforms.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
2023-10-26 11:31:06 +02:00
Peter Krempa
b9a5541b49 qemublocktest: Use "target only" mode in 'testJSONtoJSON' and 'testBackingXMLjsonXML'
Both tests pass a disk source definition which didn't go through the
preparation steps and thus contains only the target information that
were originally present, thus we should be using the
QEMU_BLOCK_STORAGE_SOURCE_BACKEND_PROPS_TARGET_ONLY flag.

For the same reason QEMU_BLOCK_STORAGE_SOURCE_BACKEND_PROPS_AUTO_READONLY
used in 'testJSONtoJSON' doesn't make sense.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-10-26 09:02:23 +02:00
Peter Krempa
829d9ed829 qemuxml2(argv|xml)test: Add network backed disk type='sd'
Add a few examples of SD cards backed with network storage to capture
the current state as the formatter code is about to be refactored.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-10-26 09:02:23 +02:00
Peter Krempa
d63221a889 tests: Use 'format' layer nodename accessors in test code
The test code cares mostly about the actual layer nodenames thus,
appropriate accessors are used.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-10-17 14:16:17 +02:00
Peter Krempa
4f78275f89 tests: Use 'storage' layer nodename accessors in tests
Convert all places in tests to use the 'storage' layer nodename
accessors instead of (virStorageSource)->nodestorage.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-10-17 14:16:15 +02:00
Peter Krempa
2568e9d29e qemu: block: Rename qemuBlockStorageSourceGetBlockdevProps
Use qemuBlockStorageSourceGetFormatProps as it formats the properties of
the 'format' driver in qemu. Adjust the comment which was hinting
otherwise.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-10-17 14:16:15 +02:00
Peter Krempa
8bc0d3fb7a qemu: domain: Identify blockjobs by storage nodename in VM status XML
Use the node name of the storage access driver to identify the block job
volumes. This will prepare the blockjob code for the possibility that the
format layer may be missing. Our lookup code can find either of them,
thus we can safely switch.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-10-17 14:16:15 +02:00
Peter Krempa
37d5a141b6 tests: qemucapabilitiesdata: Add test data for qemu-8.2 dev cycle on x86_64
Add the test data based on v8.1.0-1639-g63011373ad

Notable changes in comparison with qemu-8.1 release:
 - new 8.2 machine types added
 - removed machine types: 'pc-i440fx-1.4', 'pc-i440fx-1.5', 'pc-i440fx-1.6', 'pc-i440fx-1.7'
 - 'rom' parameter for 'memory-backend-file' added
 - 'qemu-text-console', 'qemu-graphic-console',
   'qemu-fixed-text-console' QOM types added
 - 'qemu-console' -object removed
 - 'ufs-lu', 'ufs' devices added
 - 'sd-card-spi' device added
 - 'cryptodev-backend-lkcf' added
 - 'calc-dirty-rate' paramters 'calc-time-unit' added
 - 'guest_uso4', 'guest_uso6' 'host_uso' options for 'virtio-net-pci' added
 - new cpu flags: 'vmx-any-errcode', 'gds-no', 'vmx-complex',
   'vmx-enable-user-wait-pause'

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-10-17 14:16:15 +02:00
Peter Krempa
9f49bd6452 qemustatusxml2xmltest: Demonstrate use of VIR_DOMAIN_DEF_(PARSE|FORMAT)_VOLUME_TRANSLATED
Enable the flags in the status xml2xmtest and add an exaple to the test
data.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-10-17 14:16:14 +02:00
Pavel Hrdina
b5becaea31 capabilities: report full external snapshot support
Now that deleting and reverting external snapshots is implemented we can
report that in capabilities so management applications can use that
information and start using external snapshots.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2023-10-09 15:06:59 +02:00
Michal Privoznik
3fd64fb0e2 virDomainMemoryDefValidate: Check for overlapping memory devices
As of v9.4.0-rc2~5 it is possible to specify guest address where
a virtio-mem/virtio-pmem memory device is mapped to. What that
commit forgot to introduce was a check for overlaps.

And yes, this is technically an O(n^2) algorithm, as
virDomainMemoryDefValidate() is called over each memory device
and after this, virDomainMemoryDefValidate() also iterates over
each memory device. But given there's usually only a handful of
such devices, and this runs only when parsing domain XML I guess
code readability wins over some less obvious solution.

Resolves: https://issues.redhat.com/browse/RHEL-4452
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2023-09-22 16:37:10 +02:00
Andrea Bolognani
1839c5c46e qemu: Improve error message for failed firmware autoselection
The current message can be misleading, because it seems to suggest
that no firmware of the requested type is available on the system.

What actually happens most of the time, however, is that despite
having multiple firmwares of the right type to choose from, none
of them is suitable because of lacking some specific feature or
being incompatible with some setting that the user has explicitly
enabled.

Providing an error message that describes exactly the problem is
not feasible, since we would have to list each candidate along
with the reason why we rejected it, which would get out of hand
quickly.

As a small but hopefully helpful improvement over the current
situation, reword the error message to make it clearer that the
culprit is not necessarily the firmware type, but rather the
overall domain configuration.

Suggested-by: Michael Kjörling <7d1340278307@ewoof.net>
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2023-09-22 15:50:35 +02:00
Jonathon Jongsma
3310b12d52 qemu: implement ssh-agent auth for ssh disks with nbdkit
It's not possible to use password-protected ssh keys directly with
libvirt because libvirt doesn't have any way to prompt a user for the
password. To accomodate password-protected key files, an administrator
can add these keys to an ssh agent and then configure the domain with
the path to the ssh-agent socket.

Note that this requires an administrator or management app to
configure the ssh-agent with an appropriate socket path and add the
necessary keys to it. In addition, it does not currently work with
selinux enabled. The ssh-agent socket would need a label that libvirt
would be allowed to access rather than unconfined_t.

Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2023-09-19 14:28:50 -05:00
Jonathon Jongsma
68599168ea qemu: implement keyfile auth for ssh disks with nbdkit
For ssh disks that are served by nbdkit, we can support logging in with
an ssh key file. Pass the path to the configured key file and the
username to the nbdkit process.

Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2023-09-19 14:28:50 -05:00
Jonathon Jongsma
21b377a31b qemu: implement knownHosts for ssh disks with nbdkit
For ssh disks that are served by nbdkit, use the configured value for
knownHosts and pass it to the nbdkit process.

Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2023-09-19 14:28:50 -05:00
Jonathon Jongsma
36f591402f qemu: implement password auth for ssh disks with nbdkit
For ssh disks that are served by nbdkit, lookup the password from the
configured secret and securely pass it to the nbdkit process using fd
passing.

Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2023-09-19 14:28:50 -05:00
Jonathon Jongsma
447e09dfdb qemu: Monitor nbdkit process for exit
Adds the ability to monitor the nbdkit process so that we can take
action in case the child exits unexpectedly.

When the nbdkit process exits, we pause the vm, restart nbdkit, and then
resume the vm. This allows the vm to continue working in the event of a
nbdkit failure.

Eventually we may want to generalize this functionality since we may
need something similar for e.g. qemu-storage-daemon, etc.

The process is monitored with the pidfd_open() syscall if it exists
(since linux 5.3). Otherwise it resorts to checking whether the process
is alive once a second. The one-second time period was chosen somewhat
arbitrarily.

Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2023-09-19 14:28:50 -05:00