Commit Graph

25745 Commits

Author SHA1 Message Date
John Ferlan
9c286868b1 conf: Split up virStoragePoolSourceAdapter
Create typedef'd substructures and rework typedef to utilize.

Signed-off-by: John Ferlan <jferlan@redhat.com>
2017-03-15 21:17:47 -04:00
John Ferlan
5e0af53512 conf: Extract SCSI adapter type processing into their own helpers
Rather than have lots of ugly inline code, create helpers to try and
make things more readable. While creating the helpers realign the code
as necessary.

Signed-off-by: John Ferlan <jferlan@redhat.com>
2017-03-15 21:17:47 -04:00
John Ferlan
698d5df448 conf: Extract FCHost adapter type processing into their own helpers
Rather than have lots of ugly inline code, create helpers to try and
make things more readable. While creating the helpers realign the code
as necessary.

Signed-off-by: John Ferlan <jferlan@redhat.com>
2017-03-15 21:17:47 -04:00
John Ferlan
1e21c04054 conf: Rename API's in storage_adapter_conf
Rename the API's to remove the storage pool source pieces

Signed-off-by: John Ferlan <jferlan@redhat.com>
2017-03-15 21:17:47 -04:00
John Ferlan
f632e017c0 conf: Introduce storage_adapter_conf
Move code from storage_conf into storage_adapter_conf

Pure code motion

Signed-off-by: John Ferlan <jferlan@redhat.com>
2017-03-15 21:17:47 -04:00
John Ferlan
2dd9b94531 conf: Rework parsing in virStoragePoolDefParseSourceAdapter
Rather than use virXPathString, pass along an virXPathNode and alter
the parsing to use virXMLPropString.

Signed-off-by: John Ferlan <jferlan@redhat.com>
2017-03-15 21:17:47 -04:00
John Ferlan
86e7c59f80 conf: Split out storage pool source adapter helpers
Split out the code that munges through the storage pool adapter into
helpers - it's about to be moved into it's own source file.

This is purely code motion at this point.

Signed-off-by: John Ferlan <jferlan@redhat.com>
2017-03-15 21:17:47 -04:00
John Ferlan
2077ea849b conf: Add missing validate for fchost search fields
Commit id 'bb74a7ffe' added some new fields to search for a fchost by
parent wwnn/wwpn or parent_fabric_name, but neglected to validate that
the data within the fields was valid at parse time. This could lead to
eventual failure at run time, so rather than have the failure then, let's
validate now.

Signed-off-by: John Ferlan <jferlan@redhat.com>
2017-03-15 21:17:47 -04:00
John Ferlan
d21fc70938 conf: Ensure both parent_wwnn/parent_wwpn provided
https://bugzilla.redhat.com/show_bug.cgi?id=1428209

Commit id 'bb74a7ffe' neglected to check that both the parent_wwnn
parent_wwpn are in the XML if one or the other is similar to how
the node device code checked (commit id '2b13361bc').

If only one is provided, the "default" is to use a vHBA capable
adapter (see commit id '78be2e8b'), so the vHBA could start, but
perhaps not on the expected adapter.

Signed-off-by: John Ferlan <jferlan@redhat.com>
2017-03-15 21:17:47 -04:00
Daniel P. Berrange
3c647ee4bb Switch to GSSAPI (kerberos) instead of the insecure DIGEST-MD5
RFC 6331 documents a number of serious security weaknesses in
the SASL DIGEST-MD5 mechanism. As such, libvirtd should not
by using it as a default mechanism. GSSAPI is the only other
viable SASL mechanism that can provide secure session encryption
so enable that by defalt as the replacement.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-03-15 18:14:51 +00:00
Michal Privoznik
7b89f857d9 qemu: Namespaces for NVDIMM
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-15 17:04:33 +01:00
Michal Privoznik
6e95abb446 qemu: Allow nvdimm in devices CGroups
Some users might want to pass a blockdev or a chardev as a
backend for NVDIMM. In fact, this is expected to be the mostly
used configuration. Therefore libvirt should allow the device in
devices CGroup then.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-15 16:55:30 +01:00
Michal Privoznik
78612aa597 qemu_hotplug: Relabel memdev
Now that we have APIs for relabel memdevs on hotplug, fill in the
missing implementation in qemu hotplug code.

The qemuSecurity wrappers might look like overkill for now,
because qemu namespace code does not deal with the nvdimms yet.
Nor does our cgroup code.  But hey, there's cgroup_device_acl
variable in qemu.conf. If users add their /dev/pmem* device in
there, the device is allowed in cgroups and created in the
namespace so they can successfully passthrough it to the domain.
It doesn't look like overkill after all, does it?

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-15 16:55:23 +01:00
Michal Privoznik
679bf50120 secdrivers: Implement memdev relabel APIs
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-15 16:48:24 +01:00
Michal Privoznik
0064c4e2bc security: Introduce internal APIs for memdev labelling
These APIs will be used whenever we are hot (un-)plugging a
memdev.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-15 16:45:53 +01:00
Michal Privoznik
cde8e31938 security_selinux: Label host side of NVDIMM
When domain is being started up, we ought to relabel the host
side of NVDIMM so qemu has access to it.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-15 16:45:42 +01:00
Michal Privoznik
ea416faf74 security_dac: Label host side of NVDIMM
When domain is being started up, we ought to relabel the host
side of NVDIMM so qemu has access to it.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-15 14:39:53 +01:00
Michal Privoznik
e433546bef qemu: Introduce label-size for NVDIMMs
For NVDIMM devices it is optionally possible to specify the size
of internal storage for namespaces. Namespaces are a feature that
allows users to partition the NVDIMM for different uses.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-15 14:39:22 +01:00
Michal Privoznik
04dc668a31 qemu: Implement @access for <memory/> banks
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-15 14:20:18 +01:00
Michal Privoznik
80af11d3dd conf: Introduce @access to <memory/>
Now that NVDIMM has found its way into libvirt, users might want
to fine tune some settings for each module separately. One such
setting is 'share=on|off' for the memory-backend-file object.
This setting - just like its name suggest already - enables
sharing the nvdimm module with other applications. Under the hood
it controls whether qemu mmaps() the file as MAP_PRIVATE or
MAP_SHARED.

Yet again, we have such config knob in domain XML, but it's just
an attribute to numa <cell/>. This does not give fine enough
tuning on per-memdevice basis so we need to have the attribute
for each device too.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-15 14:18:58 +01:00
Michal Privoznik
1bc173199e qemu: Implement NVDIMM
So, majority of the code is just ready as-is. Well, with one
slight change: differentiate between dimm and nvdimm in places
like device alias generation, generating the command line and so
on.

Speaking of the command line, we also need to append 'nvdimm=on'
to the '-machine' argument so that the nvdimm feature is
advertised in the ACPI tables properly.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-15 14:16:32 +01:00
Michal Privoznik
e21250dee8 qemu: Introduce QEMU_CAPS_DEVICE_NVDIMM
Introduce a qemu capability for -device nvdimm.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-15 13:33:48 +01:00
Michal Privoznik
b4e8a49f8d Introduce NVDIMM memory model
NVDIMM is new type of memory introduced into QEMU 2.6. The idea
is that we have a Non-Volatile memory module that keeps the data
persistent across domain reboots.

At the domain XML level, we already have some representation of
'dimm' modules. Long story short, NVDIMM will utilize the
existing <memory/> element that lives under <devices/> by adding
a new attribute 'nvdimm' to the existing @model and introduce a
new <path/> element for <source/> while reusing other fields. The
resulting XML would appear as:

    <memory model='nvdimm'>
      <source>
        <path>/tmp/nvdimm</path>
      </source>
      <target>
        <size unit='KiB'>523264</size>
        <node>0</node>
      </target>
      <address type='dimm' slot='0'/>
    </memory>

So far, this is just a XML parser/formatter extension. QEMU
driver implementation is in the next commit.

For more info on NVDIMM visit the following web page:

    http://pmem.io/

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-15 13:30:58 +01:00
Michal Privoznik
8cbdd2ca48 qemuBuildMemoryBackendStr: Reorder args and update comment
Frankly, this function is one big mess. A lot of arguments,
complicated behaviour. It's really surprising that arguments were
in random order (input and output arguments were mixed together),
the documentation was outdated, the description of return values
was bogus.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-15 10:49:19 +01:00
Michal Privoznik
8b277ae247 qemuBuildMemoryBackendStr: Pass virDomainMemoryDefPtr
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-15 10:49:19 +01:00
Michal Privoznik
cce282fe87 qemuBuildMemoryBackendStr: Check for @memAccess properly
Even though this variable contains just values from an enum where
zero has the usual meaning, it's enum after all and we should
check it as such.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-15 10:49:19 +01:00
Michal Privoznik
4346c9eb97 qemuBuildMemoryBackendStr: Don't overwrite @force
This is an input argument. We should not overwrite it.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-15 10:49:19 +01:00
Roman Bogorodskiy
32b675456e bhyve: add config file support
Introduce config file support for the bhyve driver. The only available
setting at present is 'firmware_dir' for specifying a directory with
UEFI firmware files.
2017-03-14 20:46:05 +04:00
Alexander Vasilenko
0765c3e3f7 docs: Move 'timestamps' and 'encryption' sub-element description
The description should be in the target for a volume not a pool.
2017-03-14 11:12:31 -04:00
Jiri Denemark
065564c840 cputest: New test for Intel Core i7-4510U
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2017-03-13 23:49:57 +01:00
Jiri Denemark
e958fb5b15 qemu: Report better host-model CPUs in domain caps
One of the main reasons for introducing host-model CPU definition in a
domain capabilities XML was the inability to express disabled features
in a host capabilities XML. That is, when a host CPU is, e.g., Haswell
without x2apic support, host capabilities XML will have to report it as
Westmere + a bunch of additional features., but we really want to use
Haswell - x2apic when creating a host-model CPU.

Unfortunately, I somehow forgot to do the last step and the code would
just copy the CPU definition found in the host capabilities XML. This
changed recently for new QEMU versions which allow us to query host CPU,
but any slightly older QEMU will not benefit from any change I did. This
patch makes sure the right CPU model is filled in the domain
capabilities even with old QEMU.

The issue was reported in
https://bugzilla.redhat.com/show_bug.cgi?id=1426456

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2017-03-13 23:49:57 +01:00
Jiri Denemark
4f23862f46 qemu: Refactor virQEMUCapsInitCPU
The function is now called virQEMUCapsProbeHostCPU. Both the refactoring
and the change of the name is done for consistency with a new function
which will be introduced in the following commit.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2017-03-13 23:49:57 +01:00
Jiri Denemark
79a78c13ec cpu: Add list of allowed CPU models to virCPUGetHost
When creating host CPU definition usable with a given emulator, the CPU
should not be defined using an unsupported CPU model. The new @models
and @nmodels parameters can be used to limit CPU models which can be
used in the result.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2017-03-13 23:49:57 +01:00
Jiri Denemark
5677b9b336 cpu: Add virCPUType parameter to virCPUGetHost
The parameter can be used to request either VIR_CPU_TYPE_HOST (which has
been assumed so far) or VIR_CPU_TYPE_GUEST definition.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2017-03-13 23:49:57 +01:00
Jiri Denemark
23a3f5f50c cpu: Replace cpuNodeData with virCPUGetHost
cpuNodeData has always been followed by cpuDecode as no hypervisor
driver is really interested in raw CPUID data for a host CPU. Let's
create a new CPU driver API which returns virCPUDefPtr directly.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2017-03-13 23:49:57 +01:00
Jiri Denemark
5cbc247e0d Do not format <arch> in guest CPU XML
This element is only allowed for host CPUs.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2017-03-13 23:49:57 +01:00
Roman Bogorodskiy
8793133c11 docs: document virt-host-validate bhyve support
Add an entry about virt-host-validate bhyve support and
update the driver's page.
2017-03-13 20:26:26 +04:00
Michal Privoznik
290a00e41d qemuDomainBuildNamespace: Handle file mount points
https://bugzilla.redhat.com/show_bug.cgi?id=1431112

Yeah, that's right. A mount point doesn't have to be a directory.
It can be a file too. However, the code that tries to preserve
mount points under /dev for new namespace for qemu does not count
with that option.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-13 13:32:45 +01:00
Jiri Denemark
fafe9d7c74 Enable forgotten VIR_CONNECT_LIST_STORAGE_POOLS_* flags
VIR_CONNECT_LIST_STORAGE_POOLS_VSTORAGE and
VIR_CONNECT_LIST_STORAGE_POOLS_ZFS were added to libvirt but the listing
API was not properly updated to use them.

https://bugzilla.redhat.com/show_bug.cgi?id=1431543

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2017-03-13 09:29:37 +01:00
Roman Bogorodskiy
b17bb82838 bhyve: test cases for VNC
Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
2017-03-11 23:31:01 +04:00
Fabian Freyer
04664327c6 bhyve: add video support
bhyve supports 'gop' video device that allows clients to connect
to VMs using VNC clients. This commit adds support for that to
the bhyve driver:

 - Introducr 'gop' video device type
 - Add capabilities probing for the 'fbuf' device that's
   responsible for graphics
 - Update command builder routines to let users configure
   domain's VNC via gop graphics.

Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
2017-03-11 23:30:56 +04:00
Fabian Freyer
58b49d0c19 bhyve: enumerate UEFI firmwares
Extend domain capabilities XML with the information about
available UEFI firmware files. It searches in the location
that the sysutils/bhyve-firmware FreeBSD port installs
files to.

Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
2017-03-11 23:09:33 +04:00
Fabian Freyer
42f58ff699 bhyve: test cases for UEFI bhyvexml2argvtest
Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
2017-03-11 23:02:12 +04:00
Fabian Freyer
d3b9a61172 bhyve: add support for booting from UEFI
Allow to boot using UEFI rather than using an external boot loader
such as bhyveload or grub-bhyve.

Also, make LPC PCI-ISA bridge handling more flexible as now it's
needed not only for serial ports, but for bootrom as well.

Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
2017-03-11 22:40:57 +04:00
Fabian Freyer
b6ae129534 bhyve: virBhyveProbeCaps: BHYVE_CAP_LPC_BOOTROM
Implement the BHACE_CAP_LPC_BOOTROM capability by checking the stderr
output of 'bhyve -l bootrom'. If the bootrom option is unsupported, this
will contain the following output:

    bhyve: invalid lpc device configuration 'bootrom'

On newer bhyve versions that do support specifying a bootrom image, the
standard help will be printed.
2017-03-11 22:31:32 +04:00
Roman Bogorodskiy
321ff4087c virt-host-validate: add bhyve support
Add bhyve support to virt-host-validate(1). It checks for the
essential kernel modules to be available so that user can actually
start VMs, have networking and console access.

It uses the kldnext(2)/kldstat(2) routines to retrieve modules list.
As bhyve is only available on FreeBSD and these routines were available
long before bhyve appeared, not adding any specific configure checks
for that.

Also, update tools/Makefile.am to add
virt-host-validate-$driver.[hc] to the build only if the
appropriate driver is enabled.
2017-03-11 21:22:58 +04:00
John Ferlan
0623945c40 tests: Add createVHBAByStoragePool-by-parent to fchosttest
Add a new test to fchosttest in order to test creation of our vHBA
via the Storage Pool logic.  Unlike the real code, we cannot yet use
the virVHBA* API's because they (currently) traverse the file system
in order to get the parent vport capable scsi_host. Besides there's
no "real" NPIV device here - so we have to take some liberties, at
least for now.

Instead, we'll follow the node device tests partially in order to
create and destroy the vHBA with the test node devices.

Signed-off-by: John Ferlan <jferlan@redhat.com>
2017-03-10 14:57:38 -05:00
Michal Privoznik
e915942b05 qemuProcessHandleMonitorEOF: Disable namespace for domain
https://bugzilla.redhat.com/show_bug.cgi?id=1430634

If a qemu process has died, we get EOF on its monitor. At this
point, since qemu process was the only one running in the
namespace kernel has already cleaned the namespace up. Any
attempt of ours to enter it has to fail.

This really happened in the bug linked above. We've tried to
attach a disk to qemu and while we were in the monitor talking to
qemu it just died. Therefore our code tried to do some roll back
(e.g. deny the device in cgroups again, restore labels, etc.).
However, during the roll back (esp. when restoring labels) we
still thought that domain has a namespace. So we used secdriver's
transactions. This failed as there is no namespace to enter.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-10 16:02:34 +01:00
Daniel P. Berrange
33feb66608 Document preferred naming conventions
This documents the preferred conventions for naming files,
structs, enums, typedefs and functions.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-03-10 11:28:56 +00:00
Michal Privoznik
887ffbce43 qemuxml2argvtest: Don't overwrite driver stateDir
This is a very historic artefact. Back in the old days of
830ba76c3e when we had macros to add arguments onto qemu command
line (!) we thought it was a good idea to let qemu write out the
PID file. So we passed -pidfile $stateDir/$domName onto the
command line. Thus, in order for tests to work we needed stable
stateDir in the qemu driver. Unfortunately, after 16efa11aa6
where stateDir is mkdtemp()-d, this approach lead to a leak of
temp dir.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-03-10 09:55:43 +01:00