Commit Graph

37148 Commits

Author SHA1 Message Date
Marek Marczykowski-Górecki
34077c1b8b tests: check e820_host option handling
Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Reviewed-by: Jim Fehlig <jfehlig@suse.com>
2020-04-21 09:06:09 -06:00
Marek Marczykowski-Górecki
f3ef7dafc8 xenconfig: parse e820_host option
Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Reviewed-by: Jim Fehlig <jfehlig@suse.com>
2020-04-21 09:06:09 -06:00
Marek Marczykowski-Górecki
5749395bfd libxl: make use of e820_host feature
Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Reviewed-by: Jim Fehlig <jfehlig@suse.com>
2020-04-21 09:06:09 -06:00
Marek Marczykowski-Górecki
b7d6648d43 conf: add xen specific feature: e820_host
e820_host is a Xen-specific option, only available for PV domains, that
provides the domain a virtual e820 memory map based on the host one. It
is enabled with a new Xen hypervisor feature, e.g.

  <features>
    <xen>
      <e820_host state='on'/>
    </xen>
  </features>

e820_host is required when using PCI passthrough and is generally
considered safe for any PV kernel. e820_host is silently ignored if set
in HVM domain configuration. See xl.cfg(5) man page in the Xen
documentation for more details.

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Reviewed-by: Jim Fehlig <jfehlig@suse.com>
2020-04-21 09:01:55 -06:00
Andrea Bolognani
de011c60a1 README: Add GitLab CI badge
We've moved most of our CI jobs to GitLab, so we should display
the corresponding badge prominently.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-04-20 18:02:07 +02:00
Andrea Bolognani
c7aad5de46 CONTRIBUTING: Include in release archives
The file, added with commit

  commit 874952f80c
  Author: Andrea Bolognani <abologna@redhat.com>
  Date:   Mon Apr 6 11:56:58 2020 +0200

    CONTRIBUTING: Add entry point for new contributors

should be included in release archives.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-04-20 18:01:55 +02:00
Mark Asselstine
72d99b094b Avoid unnecessary error messages handling udev events
The udev monitor thread "udevEventHandleThread()" will lag the
actual/real view of devices in sysfs as it serially processes udev
monitor events. So for instance if you were to run the following cmd
to create a new veth pair and rename one of the veth endpoints

you might see the following monitor events and real world that looks like

                                     time
			              |    create v0 sysfs entry
wake udevEventHandleThread            |    create v1 sysfs entry
udev_monitor_receive_device(v1-add)   |    move v0 sysfs to v2
udevHandleOneDevice(v1)               |
udev_monitor_receive_device(v0-add)   |
udevHandleOneDevice(v0)               | <--- error msgs in virNetDevGetLinkInfo()
udev_monitor_receive_device(v2-move)  |      as v0 no longer exists
udevHandleOneDevice(v2)               |
                                     \/

As you can see the changes in sysfs can take place well before we get
to act on the events in the udevEventHandleThread(), so by the time we
get around to processing the v0 add event, the sysfs entry has been
moved to v2.

To work around this we check if the sysfs entry is valid before
attempting to read it and don't bother trying to read link info if
not. This is safe since we will never read sysfs entries earlier than
it existing, ie. if the entry is not there it has either been removed
in the time since we enumerated the device or something bigger is
busted, in either case, no sysfs entry, no link info. In the case
described above we will eventually get the link info as we work
through the queue of monitor events and get to the 'move' event.

https://bugzilla.redhat.com/show_bug.cgi?id=1557902

Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com>
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-04-20 15:25:52 +02:00
Mark Asselstine
abbd3a3184 node_device_udev: handle move events
It is possible and common to rename some devices, this is especially
true for ethernet devices such as veth pairs.

In the udevEventHandleThread() we will be notified of this change but
currently we only process "add", "change" and "remove"
events. Renaming a device such as above results in a "move" event, not
a "remove" followed by and "add" or vise versa. This change will add
the new/destination device to our records but unfortunately there is
no usable mechanism to identify the old/source device to remove it
from the records. So this is admittedly only a partial fix.

Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-04-20 15:25:52 +02:00
Philipp Hahn
a7f0a3a272 doc/python: Update to Python 3
Convert the simple example to Python 3 syntax:
- print() is a function
- do not use bare except
- libvirt.open*() does not return None but raises an exception

The referenced source for the example was removed with
5bb2a245ab

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Philipp Hahn <hahn@univention.de>
2020-04-20 14:06:25 +01:00
Daniel P. Berrangé
67edcb32a3 docs: add news about virtualbox version support changes
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2020-04-20 11:34:59 +01:00
Daniel P. Berrangé
622c5e4099 vbox: add support for version 6.1 SDK
Changes in the API:

 - APIs related to the graphics adapter are no longer on the
   IMachine interface, but on a IGraphicsAdapter interface
 - The LaunchVMProcess method takes a list of env variables
   instead of a single variable containing a concatenated
   list. Since we only ever pass a single env variable, we
   can simply stuff it straight into a list.
 - The DHCP server start method no longer needs the network
   name

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2020-04-20 11:34:59 +01:00
Daniel P. Berrangé
a030a78c69 vbox: add version 6.1 CAPI header
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2020-04-20 11:34:59 +01:00
Daniel P. Berrangé
d9253a0214 vbox: add support for version 6.0 SDK
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2020-04-20 11:34:59 +01:00
Daniel P. Berrangé
20b8658166 vbox: add version 6.0 CAPI header
Changes in the API:

 - The CreatedSharedFolder method now accepts a target mount
   point. Since we don't request automount, we're just passing
   NULL. We could, however, use this to pass the desired
   mount target from the XML config in future.

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2020-04-20 11:34:59 +01:00
Daniel P. Berrangé
681fd17782 vbox: remove unused support for Windows MSCOM
Long ago we switched the vbox driver to run inside libvirtd to avoid
libvirt.so being polluted with GPLv2-only code. Since libvirtd is not
built on Windows, we disabled vbox on Windows builds. Thus the MSCOM
glue code is not required.

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2020-04-20 11:34:59 +01:00
Daniel P. Berrangé
c838c7bfc8 vbox: remove version 5.1 CAPI header
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2020-04-20 11:34:59 +01:00
Daniel P. Berrangé
e91a6d8e22 vbox: remove support for version 5.1 API
This is no longer supported since 2018/04

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2020-04-20 11:34:59 +01:00
Daniel P. Berrangé
fb750a17fb vbox: remove version 5.0 CAPI header
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2020-04-20 11:34:59 +01:00
Daniel P. Berrangé
118d386464 vbox: remove support for version 5.0 API
This is no longer supported since 2017/05

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2020-04-20 11:34:59 +01:00
Michal Privoznik
281f445b6f virnetdev.c: Use g_auto*()
While I'm at it, use more g_autofree and g_autoptr() in this
file. This also fixes a possible mem-leak in
virNetDevGetVirtualFunctions().

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-04-20 11:30:43 +02:00
Michal Privoznik
423664a6e9 virNetDevSwitchdevFeature: Make failure to get 'family_id' non-fatal
I've just got a new machine and I'm still converging on the
kernel config. Anyway, since I don't have enabled any of SRIO-V
drivers, my kernel doesn't have NET_DEVLINK enabled (i.e.
virNetDevGetFamilyId() returns 0). But this makes nodedev driver
ignore all interfaces, because when enumerating all devices via
udev, the control reaches virNetDevSwitchdevFeature() eventually
and subsequently virNetDevGetFamilyId() which 'fails'. Well, it's
not really a failure - the virNetDevSwitchdevFeature() stub
simply returns 0.

Also, move the call a few lines below, just around the place
where it's needed.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-04-20 11:30:37 +02:00
Michal Privoznik
ca61627433 virNetDevGetFamilyId: Change signature
Introduced in v3.8.0-rc1~96, the virNetDevGetFamilyId() gets
netlink family ID for passed family name (even though it's used
only for getting "devlink" ID). Nevertheless, the function
returns 0 on an error or if no family ID was found. This makes it
harder for a caller to distinguish these two. Change the retval
so that a negative value is returned upon error, zero is no ID
found (but no error encountered) and a positive value is returned
on successful translation.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-04-20 11:30:33 +02:00
Jiri Denemark
ee62b98e01 util: Do not include sys/wait.h on Win32
This fixes build on mingw broken by my previous commit 36e125296a.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2020-04-17 21:30:10 +02:00
Michal Privoznik
28fdfd20f2 qemu: Label restore path outside of secdriver transactions
As explained in the previous commit, we need to relabel the file
we are restoring the domain from. That is the FD that is passed
to QEMU. If the file is not under /dev then the file inside the
namespace is the very same as the one in the host. And regardless
of using transactions, the file will be relabeled. But, if the
file is under /dev then when using transactions only the copy
inside the namespace is relabeled and the one in the host is not.
But QEMU is reading from the one in the host, actually.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1772838

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2020-04-17 16:24:30 +02:00
Michal Privoznik
55cbb94e2e security: Introduce virSecurityManagerDomainSetPathLabelRO
This API allows drivers to separate out handling of @stdin_path
of virSecurityManagerSetAllLabel(). The thing is, the QEMU driver
uses transactions for virSecurityManagerSetAllLabel() which
relabels devices from inside of domain's namespace. This is what
we usually want. Except when resuming domain from a file. The
file is opened before any namespace is set up and the FD is
passed to QEMU to read the migration stream from. Because of
this, the file lives outside of the namespace and if it so
happens that the file is a block device (i.e. it lives under
/dev) its copy will be created in the namespace. But the FD that
is passed to QEMU points to the original living in the host and
not in the namespace. So relabeling the file inside the namespace
helps nothing.

But if we have a separate API for relabeling the restore file
then the QEMU driver can continue calling
virSecurityManagerSetAllLabel() with transactions enabled and
call this new API without transactions.

We already have an API for relabeling a single file
(virSecurityManagerDomainSetPathLabel()) but in case of SELinux
it uses @imagelabel (which allows RW access) and we want to use
@content_context (which allows RO access).

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2020-04-17 16:24:30 +02:00
Jiri Denemark
36e125296a util: Fix virDaemonForkIntoBackground
This commit partially reverts

    commit c360ea28dc
    Refs: v6.2.0-rc1-1-gc360ea28dc
    Author:     Rafael Fonseca <r4f4rfs@gmail.com>
    AuthorDate: Fri Mar 27 18:40:47 2020 +0100
    Commit:     Michal Prívozník <mprivozn@redhat.com>
    CommitDate: Mon Mar 30 09:48:22 2020 +0200

    util: virdaemon: fix compilation on mingw

    The daemons are not supported on Win32 and therefore were not compiled
    in that platform. However, with the daemon code sharing, all the code in
    utils *is* compiled and it failed because `waitpid`, `fork`, and
    `setsid` are not available. So, as before, let's not build them on
    Win32 and make the code more portable by using existing vir* wrappers.

Not compiling virDaemonForkIntoBackground on Win32 is good, but the
second part of the original patch incorrectly replaced waitpid and fork
with our virProcessWait and virFork APIs. These APIs are more than just
simple wrappers and we don't want any of the extra functionality.
Especially virFork would reset any setup made before
virDaemonForkIntoBackground is called, such as logging, signal handling,
etc.

As a result of the change the additional fix in v6.2.0-67-ga87e4788d2
(util: virdaemon: fix waiting for child processes) is no longer
needed and it is effectively reverted by this commit.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-04-17 15:53:57 +02:00
Boris Fiuczynski
e94ddeac06 docs: Improve zPCI section in pci-addresses.rst
Improving the zPCI example by choosing more distinct values and
adding explanation for fid.

Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
2020-04-17 15:06:04 +02:00
Andrea Bolognani
c889b2d614 docs: Update introduction in pci-addresses.rst
Changing the introduction to bring the idea of this document better across.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
2020-04-17 15:05:54 +02:00
Andrea Bolognani
52b51b55a2 docs: Add section about code blocks to styleguide.rst
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2020-04-16 18:58:07 +02:00
Daniel P. Berrangé
d2c5d975a5 docs: fix mistaken description of the read-only socket units
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2020-04-16 16:26:13 +01:00
Daniel P. Berrangé
116800ed9f docs: remove old unused favicon file
The use of 32favicon.png was removed when the new favicons were
introduced in

  commit 40cb5581c4
  Author: Daniel P. Berrangé <berrange@redhat.com>
  Date:   Wed Jul 26 18:22:11 2017 +0100

    docs: add full set of "favicon" files to support modern clients

Reviewed-by: Laine Stump <laine@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2020-04-16 16:26:11 +01:00
Daniel P. Berrangé
a6e39ab241 docs: add missing files to static asset list
The various favicon files were missing from the favicon list, so never
installed, as was an example code diagram.

Reviewed-by: Laine Stump <laine@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2020-04-16 16:26:07 +01:00
Daniel P. Berrangé
9e2160bef0 docs: fix handling of static assets in build dir
We previously added a hack to symlink CSS files from the source dir into
the build dir, to allow the website to be browsed locally. We should
have also done this for any images.

This change merges several variables into one "$(assets)" so that we
treat all static files in the root dir the same way.

Reviewed-by: Laine Stump <laine@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2020-04-16 16:25:57 +01:00
Daniel P. Berrangé
b85a8f2288 bhyve: add missing param to virDomainPCIAddressBusSetModel
Fixes build error introduced in

  commit aa15e9259f
  Author: Laine Stump <laine@redhat.com>
  Date:   Sun Apr 5 22:40:37 2020 -0400

    qemu/conf: set HOTPLUGGABLE connect flag during PCI address set init

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2020-04-16 15:49:28 +01:00
Leonid Bloch
5ccd6ae586 conf: Trivial comment fix
Trivial comment fix, reflecting the changes in
4ee2b31804.

Signed-off-by: Leonid Bloch <lb.workbox@gmail.com>
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
2020-04-16 16:38:07 +02:00
Michal Privoznik
67b973b510 qemuDomainDefPostParse: Fail if unable to fill machine type
Previously, we used virCapabilitiesDomainDataLookup() to fill
machine type in post parse callback if none was provided in the
domain XML. If machine type couldn't be filled in an error was
reported. After 4a4132b462 we've changed it to
virQEMUCapsGetPreferredMachine() which returns NULL, but we no
longer report an error and proceed with the post parse callbacks
processing. This may lead to a crash because the code later on
assumes def->os.machine is not NULL.

Fixes: 4a4132b462

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Pavel Mores <pmores@redhat.com>
2020-04-16 16:14:05 +02:00
Michal Privoznik
67e19fc99a qemu: Revoke access to mirror on failed blockcopy
When preparing to do a blockcopy, the mirror image is modified so
that QEMU can access it. For instance, the mirror has seclabels
set, if it is a NVMe disk it is detached from the host and so on.
And usually, the restore is done upon successful finish of the
blockcopy operation. But, if something fails then we need to
explicitly revoke the access to the mirror image (and thus
reattach NVMe disk back to the host).

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1822538

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Pavel Mores <pmores@redhat.com>
2020-04-16 16:12:41 +02:00
Andrea Bolognani
8fb7c0c506 docs: Remove one example from pci-addresses.rst
The idea behind this document is to show, with actual examples,
that users should not expect PCI addresses in the domain XML and
in the guest OS to match.

The first zPCI example already serves this purpose perfectly, so
in the interest of keeping the page as brief and easy to digest
as possible the second one is removed.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
2020-04-16 11:12:46 +02:00
Andrea Bolognani
253b94710b docs: Remove MAC addresses from pci-addresses.rst
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
2020-04-16 11:12:43 +02:00
Andrea Bolognani
5590fe160b docs: Move sections around in pci-addresses.rst
The section about VFIO devices is kept separate from the rest
because it's less about domain XML and guest OS disagreeing on the
PCI address of a device, and more about which of the two PCI
addresses in the domain XML is even relevant to the guest OS.

The section on zPCI addresses, on the other hand, falls squarely
in the "more complex cases" category, so it should live in the
corresponding section.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
2020-04-16 11:12:41 +02:00
Andrea Bolognani
db9c6d47d8 docs: Use consistent style in pci-addresses.rst
Indent all code snippets by the same number of spaces, and don't
embed the :: marker in the line preceding a code block.

This commit is best viewed with 'git show -w'.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
2020-04-16 11:12:33 +02:00
Lin Ma
93b15ba0f2 qemu: fix hang in p2p + xbzrle compression + parallel migration
When we do parallel migration, The multifd-channels migration parameter
needs to be set on the destination side as well before incoming migration
URI, unless we accept the default number of connections(2).

Usually, This can be correctly handled by libvirtd. But in this case if
we use p2p + xbzrle compression without parameter '--comp-xbzrle-cache',
qemuMigrationParamsDump returns too early, The corresponding migration
parameter will not be set on the destination side, It results QEMU hangs.

Reproducer:
virsh migrate --live --p2p --comp-methods xbzrle \
--parallel --parallel-connections 3 GUEST qemu+ssh://dsthost/system

or

virsh migrate --live --p2p --compressed \
--parallel --parallel-connections 3 GUEST qemu+ssh://dsthost/system

Signed-off-by: Lin Ma <lma@suse.com>
Message-Id: <20200416044451.21134-1-lma@suse.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
2020-04-16 09:53:04 +02:00
Andrea Bolognani
a158eb5c8e gitlab: Enable improved ccache usage
Setting CC="ccache cc" works in most cases, but sometimes it will
break the build: in particular, we have experienced issues in the
past with that approach when using cgo to build our Go bindings.

A more robust approach is to have a directory containing symlinks
from the compiler name to the ccache binary: in that case, ccache
itself will invoke the compiler, and the build system will be none
the wiser.

Since libvirt-ci commit 2563aebb6c5c, container images contain a
suitable symlink directory, so all that's needed to enable the new
approach is to add this directory to $PATH.

Since we're touching this anyway, we make a few more changes:
$CCACHE_DIR is no longer created manually, because ccache will
take care of creating it for us if it doesn't already exist; the
ccache setup is moved out of the job template and into
script_variables, removing unnecessary duplication; a limit is
set on the size of the cache (500 MB, which is twice the amount
used by a fresh build on my Fedora 31 machine).

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2020-04-15 17:50:49 +02:00
Andrea Bolognani
29e09694bc gitlab: Don't define $MAKE
Since libvirt-ci commit 27cfddee8835, paths to build tools such as
ninja and make are exported in the container's environment and can
be used directly.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2020-04-15 17:50:27 +02:00
Cornelia Huck
53f687bbab docs: add zpci information to pci-addresses.rst
Add some information on how pci address work on s390x.

Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-04-15 13:02:24 +02:00
Andrea Bolognani
e767f509b2 docs: Fix word repetition in pci-addresses.rst
Fixes: 2923e7a3dd
Reported-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2020-04-15 10:49:42 +02:00
Christian Ehrhardt
8f61fd6bf2
apparmor: avoid denials on libpmem initialization
With libpmem support compiled into qemu it will trigger the following
denials on every startup.
  apparmor="DENIED" operation="open" name="/"
  apparmor="DENIED" operation="open" name="/sys/bus/nd/devices/"

This is due to [1] that tries to auto-detect if the platform supports
auto flush for all region.

Once we know all the paths that are potentially needed if this feature
is really used we can add them conditionally in virt-aa-helper and labelling
calls in case </pmem> is enabled.

But until then the change here silences the denial warnings seen above.

[1]: https://github.com/pmem/pmdk/blob/master/src/libpmem2/auto_flush_linux.c#L131

Bug: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1871354

Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
Acked-by: Jamie Strandboge <jamie@canonical.com>
2020-04-15 10:33:23 +02:00
Andrea Bolognani
2923e7a3dd docs: Add pci-addresses.rst
This document describes the relationship between PCI addresses as
seen in the domain XML and by the guest OS, which is a topic that
people get confused by time and time again.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Laine Stump <laine@redhat.com>
2020-04-15 09:47:49 +02:00
Peter Krempa
a7db0b757d backup: Allow 'encryption' of backups and scratch images
Add the appropriate entries into the schema to allow encryption of the
backup or scratch image. Since we use blockdev internals for everything
no changes to the code are actually necessary.

https://bugzilla.redhat.com/show_bug.cgi?id=1811906

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-04-14 18:49:41 +02:00
Peter Krempa
30d2491d8b docs: backup: Remove references to push backup to network disk
It was never implemented and for now I don't think there's demand to do
it. Remove the reference.

https://bugzilla.redhat.com/show_bug.cgi?id=1812100

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2020-04-14 18:48:57 +02:00