Commit Graph

7254 Commits

Author SHA1 Message Date
Daniel P. Berrange
a018c0b910 Fix check of virKillProcess return status
The error code for virKillProcess is returned in the errno variable
not the return value. THis mistake caused the logs to be filled with
errors when shutting down QEMU processes

* src/qemu/qemu_process.c: Fix process kill check.
2011-06-04 07:26:07 -04:00
Matthias Bolte
eb2664cbe6 vbox: Fix version extraction on Windows for newer VirtualBox versions
VirtualBox 4.0.8 changed the registry key layout. Before the version
number was in a Version key. Now the Version key contains %VER% and
the actual version number is in VersionExt now.

Move value lookup code into its own function: vboxLookupRegistryValue.
2011-06-04 10:50:36 +02:00
Eric Blake
33d90bafe7 API: consolidate common unreleased enums
This commit is safe precisely because there has been no release
for any of the enum values being deleted (they were added post-0.9.1).

After the 0.9.2 release, we can then take advantage of
virDomainModificationImpact in more places.

* include/libvirt/libvirt.h.in (virDomainModificationImpact): New
enum.
(virDomainSchedParameterFlags, virMemoryParamFlags): Delete, since
these were never released, and the new enum works fine here.
* src/libvirt.c	(virDomainGetMemoryParameters)
(virDomainSetMemoryParameters)
(virDomainGetSchedulerParametersFlags)
(virDomainSetSchedulerParametersFlags): Update documentation.
* src/qemu/qemu_driver.c (qemuDomainSetMemoryParameters)
(qemuDomainGetMemoryParameters, qemuSetSchedulerParametersFlags)
(qemuSetSchedulerParameters, qemuGetSchedulerParametersFlags)
(qemuGetSchedulerParameters): Adjust clients.
* tools/virsh.c (cmdSchedinfo, cmdMemtune): Likewise.
Based on ideas by Daniel Veillard and Hu Tao.
2011-06-04 09:58:53 +02:00
Jiri Denemark
aeed51f775 qemu: Avoid use after free in qemuCaps parsing 2011-06-03 19:58:43 +02:00
Jiri Denemark
4e3a1c3021 virsh: Document nodeinfo output 2011-06-03 19:57:04 +02:00
Laine Stump
62ed801c13 security driver: ignore EINVAL when chowning an image file
This fixes:

  https://bugzilla.redhat.com/show_bug.cgi?id=702044
  https://bugzilla.redhat.com/show_bug.cgi?id=709454

Both of these complain of a failure to use an image file that resides
on a read-only NFS volume. The function in the DAC security driver
that chowns image files to the qemu user:group before using them
already has special cases to ignore failure of chown on read-only file
systems, and in a few other cases, but it hadn't been checking for
EINVAL, which is what is returned if the qemu user doesn't even exist
on the NFS server.

Since the explanation of EINVAL in the chown man page almost exactly
matches the log message already present for the case of EOPNOTSUPP,
I've just added EINVAL to that same conditional.
2011-06-03 12:27:05 -04:00
Matthias Bolte
6b5c589d84 Make dlopen usage in lock manager conditional
This fixes a build failure on MinGW, due to MinGW not supporting dlopen.
2011-06-03 16:46:09 +02:00
Neil Wilson
5b8d2e6d92 Correct 'cputune' documentation example.
Signed-off-by: Neil Wilson <neil@aldur.co.uk>
2011-06-03 08:40:51 -06:00
Eric Blake
32ce66f5ea build: silence coverity false positive
Coverity couldn't see that priv is NULL on failure.  But on failure,
we might as well guarantee that callers don't try to free uninitialized
memory.

* src/remote/remote_driver.c (remoteGenericOpen): Even on failure,
pass priv back to caller.
2011-06-03 08:23:32 -06:00
Eric Blake
89e651fa76 build: silence coverity false positive
Coverity complained that infd could be -1 at the point where it is
passed to write, when in reality, this code can only be reached if
infd is non-negative.

* src/util/command.c (virCommandProcessIO): Help out coverity.
2011-06-03 08:23:29 -06:00
Eric Blake
d391661ae4 migrate: detect xml incompatibility
Detected by Coverity.  Bug introduced in 08106e2044 (unreleased).

* src/conf/domain_conf.c (virDomainChannelDefCheckABIStability):
Use correct sizeof operand.
2011-06-03 08:23:28 -06:00
Eric Blake
278a050a52 event: avoid memory leak on cleanup
Detected by Coverity.  Introduced in commit aaf2b70, and turned into
a regression in the next few commits through 4e6e6672 (unreleased).

* src/conf/domain_event.c (virDomainEventStateFree): Free object,
per documentation.
2011-06-03 08:11:43 -06:00
Eric Blake
2834d57175 qemu: avoid memory leak on vcpupin
Detected by Coverity.  This leaked a cpumap on every iteration
of the loop.  Leak introduced in commit 1cc4d02 (v0.9.0).

* src/qemu/qemu_process.c (qemuProcessSetVcpuAffinites): Plug
leak, and hoist allocation outside loop.
2011-06-03 08:11:43 -06:00
Eric Blake
c0e65ae5b2 remote: avoid leak on failure
Detected by Coverity.  Only possible in OOM situations.

* daemon/remote.c (remoteDispatchDomainScreenshot): Plug leak.
2011-06-03 08:11:43 -06:00
Eric Blake
0a41733c13 lock: avoid leak on failure
Detected by Coverity.  Only possible on OOM situations.

* src/locking/lock_manager.c (virLockManagerPluginNew): Plug leak.
2011-06-03 08:11:43 -06:00
Eric Blake
f515bab78d storage: avoid memory leak on stat failure
Spotted by coverity.  Triggers on failed stat, although I'm not sure
how easy that condition is, so I'm not sure if this is a runtime
memory hog.  Regression introduced in commit 8077d64 (unreleased).

* src/util/storage_file.c (virStorageFileGetMetadataFromFD):
Reduce need for malloc, avoiding a leak.
2011-06-03 08:11:42 -06:00
Eric Blake
9892f7bca0 storage: avoid memory leak
Coverity detected that options was being set by strdup but never
freed.  But why even bother with an options variable?  The options
parameter never changes!  Leak present since commit 44948f5b (0.7.0).

This function could probably be rewritten to take better advantage
of virCommand, but that is more invasive.

* src/storage/storage_backend_fs.c
(virStorageBackendFileSystemMount): Avoid wasted strdup, and
guarantee proper cleanup on all paths.
2011-06-03 08:11:42 -06:00
Eric Blake
ef21bedaf9 libvirtd: avoid leak on failure
Spotted by Coverity.  Only possible on an OOM condition, so
unlikely to bite in the wild.

* daemon/libvirtd.c (qemudSetLogging): Don't leak memory.
2011-06-03 08:11:42 -06:00
Eric Blake
bb8895290c command: avoid leak on failure
Detected by Coverity.  While it is possible on OOM condition, as
well as with bad code that passes binary == NULL, it is unlikely
to be encountered in the wild.

* src/util/command.c (virCommandNewArgList): Don't leak memory.
2011-06-03 08:11:42 -06:00
Daniel P. Berrange
6d68e0df72 Explicitly set VM state to paused after migration completes
In v3 migration, once migration is completed, the VM needs
to be left in a paused state until after Finish3 has been
executed on the target. Only then will the VM be killed
off. When using non-JSON QEMU monitor though, we don't
receive any 'STOP' event from QEMU, so we need to manually
set our state offline & thus release lock manager leases.
It doesn't hurt to run this on the JSON case too, just in
case the event gets lost somehow

* src/qemu/qemu_migration.c: Explicitly set VM state to
  paused when migration completes
2011-06-03 09:59:47 -04:00
Daniel P. Berrange
2027e184c5 Fix regressions BlockStats/Info APIs in QEMU driver
The change 18c2a59206 caused
some regressions in behaviour of virDomainBlockStats
and virDomainBlockInfo in the QEMU driver.

The virDomainBlockInfo API stopped working for inactive
guests if querying a block device.

The virDomainBlockStats API did not promptly report
an error if the guest was not running in some cases.

* src/qemu/qemu_driver.c: Fix inactive guest handling
  in BlockStats/Info APIs
2011-06-03 14:55:11 +01:00
Jim Fehlig
9a76e737fc Fix minor issues in libxenlight managed save
There were a few minor issues in commit 5b6c961e
- leak managed save path
- leak managed save fd
- functions that open an fd should also close it
2011-06-02 15:41:13 -06:00
Heath Petersen
39b59dbdb4 uml: correct command line networking parameters
I have been finding that some UML command line networking parameters are
being generated incorrectly.

For more information, see
https://bugzilla.redhat.com/show_bug.cgi?id=706295 .
2011-06-02 13:52:26 -06:00
Eric Blake
72519f7331 docs: document iface-* commands
I intentionally set things up so 'virsh help interface' lists
commands in alphabetical order, but 'man virsh' lists them in
topical order; this matches our practice on some other commands.

* tools/virsh.pod: Document all iface commands.
* tools/virsh.c (ifaceCmds): Sort.
2011-06-02 13:29:12 -06:00
Daniel P. Berrange
020342e68d Fix auditing of disk hotunplug operations
The qemuAuditDisk calls in disk hotunplug operations were being
passed 'ret >= 0', but the code which sets ret to 0 was not yet
executed, and the error path had already jumped to the 'cleanup'
label. This meant hotunplug failures were never audited, and
hotunplug success was audited as a failure

* src/qemu/qemu_hotplug.c: Fix auditing of hotunplug
2011-06-02 17:23:45 +01:00
Daniel P. Berrange
eb661ce3ee Avoid crash on NULL pointer in lock driver impls during hotplug
When virLockDriverAcquire is invoked during hotplug the state
parameter will be left as NULL.

* src/locking/lock_driver_nop.c,
  src/locking/lock_driver_sanlock.c: Don't reference NULL state
  parameter
2011-06-02 17:23:45 +01:00
Daniel P. Berrange
09240ef13b Fix return value in lock manager hotplug methods
Refactoring of the lock manager hotplug methods lost the
ret = 0 assignment for successful return path

* src/locking/domain_lock.c: Add missing ret = 0 assignments
2011-06-02 17:23:44 +01:00
Daniel P. Berrange
13488f55c5 Make sure virDomainSave/virDomainManagedSave reset id to -1
After successfull virDomainSave/virDomainManagedSave calls
the guest will no longer be active, so the domain ID must
be reset to -1

* daemon/remote_generator.pl: Special case virDomainSave &
  virDomainManagedSave for same reason as virDomainDestroy
2011-06-02 17:23:44 +01:00
Daniel P. Berrange
43917db3f9 Fix handling of VIR_EVENT_HANDLE_ERROR in QEMU monitor
Commit 4454a9efc7 introduced bad
behaviour on the VIR_EVENT_HANDLE_ERROR condition. This condition
is only hit when an invalid FD is used in poll() (typically due
to a double-close bug). The QEMU monitor code was treating this
condition as non-fatal, and thus libvirt would poll() in a fast
loop forever burning 100% CPU. VIR_EVENT_HANDLE_ERROR must be
handled in the same way as VIR_EVENT_HANDLE_HANGUP, killing the
QEMU instance.

* src/qemu/qemu_monitor.c: Treat VIR_EVENT_HANDLE_ERROR as EOF
2011-06-02 17:23:44 +01:00
Daniel P. Berrange
ebfb8c4243 Add call to sanlock_restrict() in QEMU lock driver
In between fork and exec, a connection to sanlock is acquired
and the socket file descriptor is intionally leaked to the
child process. sanlock watches this FD for POLL_HANGUP to
detect when QEMU has exited. We don't want a rogus/compromised
QEMU from issuing sanlock RPC calls on the leaked FD though,
since that could be used to DOS other guests. By calling
sanlock_restrict() on the socket before exec() we can lock
it down.

* configure.ac: Check for sanlock_restrict API
* src/locking/domain_lock.c: Restrict lock acquired in
  process startup phase
* src/locking/lock_driver.h: Add VIR_LOCK_MANAGER_ACQUIRE_RESTRICT
* src/locking/lock_driver_sanlock.c: Add call to sanlock_restrict
  when requested by VIR_LOCK_MANAGER_ACQUIRE_RESTRICT flag
2011-06-02 17:23:44 +01:00
Eric Blake
a2f9bd5b80 build: fix VPATH build break from previous patch
Partial revert of commit c3c30d4de9.

* docs/Makefile.am (internals/%.html.tmp): Restore MKDIR_P; it is
needed for intermediate file after all.
Reported by Daniel P. Berrange.
2011-06-02 08:18:26 -06:00
Michal Privoznik
3ef7350c42 screenshot: Expose the new API in virsh
* tools/virsh.c: Add screenshot command
* tools/virsh.pod: Document new command
* src/libvirt.c: Fix off-be-one error
2011-06-02 14:57:00 +02:00
Daniel Veillard
4cc4aee680 libxl : fix the version for the managed save APIs 2011-06-02 20:39:40 +08:00
Markus Groß
5b6c961ef2 libxl: adds managed save and restore support
Based on the equivalent qemu driver code

* src/libxl/libxl_driver.c: refactor the Start save and restore
  routines of the driver and adds the new entry points for
  managed saves handling
2011-06-02 20:24:30 +08:00
Markus Groß
47370d5a0b libxl: get maximum memory of running domain
* src/libxl/libxl_driver.c: fix the libxlDomainGetInfo to return the
  maximum memory for running domain
2011-06-02 20:16:32 +08:00
Daniel P. Berrange
9f135031ff Add a plugin for the 'sanlock' project
Sanlock is a project that implements a disk-paxos locking
algorithm. This is suitable for cluster deployments with
shared storage.

* src/Makefile.am: Add dlopen plugin for sanlock
* src/locking/lock_driver_sanlock.c: Sanlock driver
* configure.ac: Check for sanlock
* libvirt.spec.in: Add a libvirt-lock-sanlock RPM
2011-06-02 10:54:01 +01:00
Daniel P. Berrange
30ffe7bceb Allow leases to be hotpluged with QEMU guests
* src/conf/domain_conf.c, src/conf/domain_conf.h: APIs for
  inserting/finding/removing virDomainLeaseDefPtr instances
* src/qemu/qemu_driver.c: Wire up hotplug/unplug for leases
* src/qemu/qemu_hotplug.h, src/qemu/qemu_hotplug.c: Support
  for hotplug and unplug of leases
2011-06-02 10:54:01 +01:00
Daniel P. Berrange
7474560bef Support passing QEMU lock state to dest during migration
Some lock managers associate state with leases, allowing a process
to temporarily release its leases, and re-acquire them later, safe
in the knowledge that no other process has acquired + released the
leases in between.

This is already used between suspend/resume operations, and must
also be used across migration. This passes the lockstate in the
migration cookie. If the lock manager uses lockstate, then it
becomes compulsory to use the migration v3 protocol to get the
cookie support.

* src/qemu/qemu_driver.c: Validate that migration v2 protocol is
  not used if lock manager needs state transfer
* src/qemu/qemu_migration.c: Transfer lock state in migration
  cookie XML
2011-06-02 10:54:01 +01:00
Daniel P. Berrange
12317957ec Integrate the QEMU driver with the lock manager infrastructure
The QEMU integrates with the lock manager instructure in a number
of key places

 * During startup, a lock is acquired in between the fork & exec
 * During startup, the libvirtd process acquires a lock before
   setting file labelling
 * During shutdown, the libvirtd process acquires a lock
   before restoring file labelling
 * During hotplug, unplug & media change the libvirtd process
   holds a lock while setting/restoring labels

The main content lock is only ever held by the QEMU child process,
or libvirtd during VM shutdown. The rest of the operations only
require libvirtd to hold the metadata locks, relying on the active
QEMU still holding the content lock.

* src/qemu/qemu_conf.c, src/qemu/qemu_conf.h,
  src/qemu/libvirtd_qemu.aug, src/qemu/test_libvirtd_qemu.aug:
  Add config parameter for configuring lock managers
* src/qemu/qemu_driver.c: Add calls to the lock manager
2011-06-02 10:54:01 +01:00
Daniel P. Berrange
395793a8ec Add initial docs about the lock managers 2011-06-02 10:54:01 +01:00
Daniel P. Berrange
ad73a937ff Add higher level lock API for domain objects
To facilitate use of the locking plugins from hypervisor drivers,
introduce a higher level API for locking virDomainObjPtr instances.
In includes APIs targetted to VM startup, and hotplug/unplug

* src/Makefile.am: Add domain lock API
* src/locking/domain_lock.c, src/locking/domain_lock.h: High
  level API for domain locking
2011-06-02 10:54:01 +01:00
Daniel P. Berrange
db98851c24 Add a 'nop' lock driver implementation.
To allow hypervisor drivers to assume that a lock driver impl
will be guaranteed to exist, provide a 'nop' impl that is
compiled into the library

* src/Makefile.am: Add nop driver
* src/locking/lock_driver_nop.c, src/locking/lock_driver_nop.h:
  Nop lock driver implementation
* src/locking/lock_manager.c: Enable direct access of 'nop'
  driver, instead of dlopen()ing it.
2011-06-02 10:54:00 +01:00
Daniel P. Berrange
6a943419c5 Basic framework for lock manager plugins
Define the basic framework lock manager plugins. The
basic plugin API for 3rd parties to implemented is
defined in

  src/locking/lock_driver.h

This allows dlopen()able modules for alternative locking
schemes, however, we do not install the header. This
requires lock plugins to be in-tree allowing changing of
the lock manager plugin API in future.

The libvirt code for loading & calling into plugins
is in

  src/locking/lock_manager.{c,h}

* include/libvirt/virterror.h, src/util/virterror.c: Add
  VIR_FROM_LOCKING
* src/locking/lock_driver.h: API for lock driver plugins
  to implement
* src/locking/lock_manager.c, src/locking/lock_manager.h:
  Internal API for managing locking
* src/Makefile.am: Add locking code
2011-06-02 10:54:00 +01:00
Daniel P. Berrange
1ea83207c8 Support leases in guest XML and lock manager
A lock manager may operate in various modes. The direct mode of
operation is to obtain locks based on the resources associated
with devices in the XML. The indirect mode is where the app
creating the domain provides explicit leases for each resource
that needs to be locked. This XML extension allows for listing
resources in the XML

  <devices>
     ...
     <lease>
       <lockspace>somearea</lockspace>
       <key>thequickbrownfoxjumpsoverthelazydog</key>
       <target path='/some/lease/path' offset='23432'/>
     </lease>
     ...
  </devices>

The 'lockspace' is a unique identifier for the lockspace which
the lease is associated

The 'key' is a unique identifier for the resource associated
with the lease.

The 'target' is the file on disk where the leases are held.

* docs/schemas/domain.rng: Add lease schema
* src/conf/domain_conf.c, src/conf/domain_conf.h: parsing and
  formatting for leases
* tests/qemuxml2argvdata/qemuxml2argv-lease.args,
  tests/qemuxml2argvdata/qemuxml2argv-lease.xml,
  tests/qemuxml2xmltest.c: Test XML handling for leases
2011-06-02 10:54:00 +01:00
Daniel P. Berrange
285c2fdf0f Allow handshake with child process during startup
Allow the parent process to perform a bi-directional handshake
with the child process during fork/exec. The child process
will fork and do its initial setup. Immediately prior to the
exec(), it will stop & wait for a handshake from the parent
process. The parent process will spawn the child and wait
until the child reaches the handshake point. It will do
whatever extra setup work is required, before signalling the
child to continue.

The implementation of this is done using two pairs of blocking
pipes. The first pair is used to block the parent, until the
child writes a single byte. Then the second pair pair is used
to block the child, until the parent confirms with another
single byte.

* src/util/command.c, src/util/command.h,
  src/libvirt_private.syms: Add APIs to perform a handshake
2011-06-02 10:53:58 +01:00
Eric Blake
b598ac555c security: plug regression introduced in disk probe logic
Regression introduced in commit d6623003 (v0.8.8) - using the
wrong sizeof operand meant that security manager private data
was overlaying the allowDiskFormatProbing member of struct
_virSecurityManager.  This reopens disk probing, which was
supposed to be prevented by the solution to CVE-2010-2238.

* src/security/security_manager.c
(virSecurityManagerGetPrivateData): Use correct offset.
2011-06-01 17:05:24 -06:00
Eric Blake
b43e78f76b tests: really fix QEMU XML-2-ARGV graphics-spice-timeout test
Alas, /usr/bin/kvm is also not directly supported by testutilsqemu.c.

In fact, _any_ test that uses <cpu match=...> has to use our faked
qemu.sh in order to properly answer the 'qemu -cpu ?' probe done
during qemu command line building.

* tests/qemuxml2argvdata/*graphics-spice-timeout*: Switch emulator, again.
2011-06-01 15:41:24 -06:00
Eric Blake
c3c30d4de9 build: avoid corrupting / in RHEL 5
I noticed this while building from libvirt.git on RHEL 5.6:

Generating internals/command.html.tmp
mkdir: cannot create directory `/internals': Permission denied

If I had been building as root instead, this pollutes /.

Older autoconf lacks $(builddir), but it is rigorously equal to '.'
in newer autoconf, so we could use '$(MKDIR_P) internals' instead.

However, since internals/command.html is part of the tarball, we
_already_ build it in $(srcdir), not $(builddir) during VPATH
builds, so the mkdir is wasted effort!

* docs/Makefile.am (internals/%.html.tmp): Drop unused mkdir.
2011-06-01 15:26:13 -06:00
Jiri Denemark
f5534a135e tests: Add a test for correct disk device ordering 2011-06-01 19:14:08 +02:00
Jiri Denemark
c1a98d8825 Fix order of disks and controllers
Commit 2d6adabd53 replaced qsorting disk
and controller devices with inserting them at the right position. That
was to fix unnecessary reordering of devices. However, when parsing
domain XML devices are just taken in the order in which they appear in
the XML since. Use the correct insertion algorithm to honor device
target.
2011-06-01 19:11:58 +02:00