Commit Graph

135 Commits

Author SHA1 Message Date
Michal Privoznik
0377177c78 qemu_process.c: Propagate hugetlbfs mounts on reconnect
When reconnecting to a running QEMU process, we construct the
per-domain path in all hugetlbfs mounts. This is a relict from
the past (v3.4.0-100-g5b24d25062) where we switched to a
per-domain path and we want to create those paths when libvirtd
restarts on upgrade.

And with namespaces enabled there is one corner case where the
path is not created. In fact an error is reported and the
reconnect fails. Ideally, all mount events are propagated into
the QEMU's namespace. And they probably are, except when the
target path does not exist inside the namespace. Now, it's pretty
common for users to mount hugetlbfs under /dev (e.g.
/dev/hugepages), but if domain is started without hugepages (or
more specifically - private hugetlbfs path wasn't created on
domain startup), then the reconnect code tries to create it.
But it fails to do so, well, it fails to set seclabels on the
path because, because the path does not exist in the private
namespace. And it doesn't exist because we specifically create
only a subset of all possible /dev nodes. Therefore, the mount
event, whilst propagated, is not successful and hence the
filesystem is not mounted. We have to do it ourselves.

If hugetlbfs is mount anywhere else there's no problem and this
is effectively a dead code.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2123196
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
2022-09-23 16:33:48 +02:00
Michal Privoznik
d3397885d5 kbase: Document QEMU private mount NS limitations
There are two points I've taken for granted:

  1) the mount points are set before starting a guest,
  2) the / and its submounts are marked as shared, so that mount
     events propagate into child namespaces when assumption 1) is
     not held.

But what's obvious to me might not be obvious to our users.
Document these known limitations.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2123196
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
2022-09-12 12:05:07 +02:00
Kristina Hanicova
4435c026b7 qemu & conf: move BeginAsyncJob & EndAsyncJob into src/conf
Signed-off-by: Kristina Hanicova <khanicov@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2022-09-07 12:15:06 +02:00
Kristina Hanicova
421f1e749f qemu & conf: move BeginAgentJob & EndAgentJob into src/conf/virdomainjob
Although these and functions in the following two patches are for
now just being used by the qemu driver, it makes sense to have all
begin job functions in the same file.

Signed-off-by: Kristina Hanicova <khanicov@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2022-09-07 12:14:43 +02:00
Kristina Hanicova
9085ccbfb4 qemu: use virDomainObjEndJob()
This patch moves qemuDomainObjEndJob() into
src/conf/virdomainjob as universal virDomainObjEndJob().

Signed-off-by: Kristina Hanicova <khanicov@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2022-09-07 12:14:07 +02:00
Kristina Hanicova
0d22febfc6 qemu: use virDomainObjBeginJob()
This patch moves qemuDomainObjBeginJob() into
src/conf/virdomainjob as universal virDomainObjBeginJob().

Signed-off-by: Kristina Hanicova <khanicov@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2022-09-07 12:13:30 +02:00
Peter Krempa
c8ee79346a spec: Drop libvirt-daemon-driver-storage-sheepdog package
Upstream will be dropping the sheepdog storage backend, so we need to
stop building the package and obsolete it.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-09-01 13:11:09 +02:00
Andrea Bolognani
550bf7682d kbase: Document how to disable Secure Boot entirely
In most cases, disabling the secure-boot or the enrolled-keys
firmware feature will achieve the same result: allowing an
unsigned operating system to run.

Right now we're only documenting the latter configuration. Add
the former as well, and explain the difference between the two.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2022-08-04 14:39:18 +02:00
Andrea Bolognani
18249f278a kbase: Always explicitly enable secure-boot firmware feature
It should be enough to enable or disable the enrolled-keys feature
to control whether Secure Boot is enforced, but there's a slight
complication: many distro packages for edk2 include, in addition
to general purpose firmware images, builds that are targeting the
Confidential Computing use case.

For those, the firmware descriptor will not advertise the
enrolled-keys feature, which will technically make them suitable
for satisfying a configuration such as

  <os firmware='efi'>
    <firmware>
      <feature state='off' name='enrolled-keys'/>
    </firmware>
  </os>

In practice, users will expect the general purpose build to be
used in this case. Explicitly asking for the secure-boot feature
to be enabled achieves that result at the cost of some slight
additional verbosity.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2022-08-04 14:39:11 +02:00
Daniel P. Berrangé
c748000cd1 docs: replace ARRAY_CARDINALITY with G_N_ELEMENTS
Fix docs illustrating call with an obsolete macro.

Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-07-13 12:18:06 +01:00
Peter Krempa
c37ebda93a kbase: debuglogs: Add a note about auto-shutdown of daemons
When using runtime setting of logging with 'virt-admin' it can be
confusing that the settings are discarded when the shutdown timeout of a
daemon is reached.

Add a note about this behaviour along with a suggestion to use
virt-admin to disable the behaviour if needed.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-07-07 14:35:30 +02:00
Tim Wiederhake
58e6bb8be8 Fix spelling
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
2022-07-04 10:07:47 +02:00
Andrea Bolognani
7d285059f4 docs: Add kbase page for Secure Boot
Provide simple recipes for the most common high-level tasks.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-07-01 15:10:43 +02:00
Peter Krempa
f5c5b16d5d kbase: launch_security_sev: Break up overly long line
Standard text is aligned to 80 colums in all .rst files.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
2022-06-13 16:09:32 +02:00
Cole Robinson
d823f27597 docs: kbase/launch_security_sev: QEMU 6.0+ sets iommu=on for us
Reviewed-by: Erik Skultety <eskultet@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2022-06-13 09:12:35 -04:00
Peter Krempa
5aa78876e0 docs: kbase/tlscerts: Fix links
Most of the links were broken by moving the article into kbase, but in
this case we need to also fix the anchor names.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-06-01 12:27:10 +02:00
Peter Krempa
ce2426baff docs: kbase/kvm-realtime: Fix few links
Certain links were missing the '../' prefix to reach files in the parent
directory from the time the page was introduced.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-06-01 12:27:10 +02:00
Peter Krempa
34aa8abda7 docs: Fix links in kbase/internals
The links were broken when the documentation was moved into the
'internals' subdirectory.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-06-01 12:27:10 +02:00
Peter Krempa
0ad7ed199e docs: rpc: Fix broken headings
Remove what seems like links from some headings. This error predates the
conversion to RST where an '<a href' was used instead of '<a id' in the
source document.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-06-01 12:27:10 +02:00
Peter Krempa
f97e769b63 docs: domainstatecapture: Fix broken links
Some links didn't exit the 'kbase/' directory and 'virDomainBackupEnd'
API never existed.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-06-01 12:27:10 +02:00
Peter Krempa
a781f7980c docs: formatdomain: Remove 'launchSecurity' anchor
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-06-01 12:27:10 +02:00
Peter Krempa
fa5124bdbb docs: formatdomain: Remove 'elementsMemory' anchor
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-06-01 12:27:10 +02:00
Peter Krempa
4fbaa15362 docs: formatdomain: Remove 'elementsFeatures' anchor
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-06-01 12:27:09 +02:00
Peter Krempa
2f36b98a42 docs: formatdomain: Remove 'elementsEvents' anchor
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-06-01 12:27:09 +02:00
Peter Krempa
456a710290 docs: formatdomain: Remove 'elementsCPU' anchor
Reworded documentation around the local link.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-06-01 12:27:09 +02:00
Peter Krempa
e1f9c35220 docs: formatdomain: Remove 'elementsMemoryBacking' anchor
Reworded documentation around one of the local links.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-06-01 12:27:09 +02:00
Peter Krempa
19bdd5d3d5 docs: formatdomain: Remove 'elementsCPUTuning' anchor
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-06-01 12:27:09 +02:00
Peter Krempa
6fee44f3f5 docs: formatdomain: Remove 'elementsCPUAllocation' anchor
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-06-01 12:27:09 +02:00
Peter Krempa
e04acdf39d qemu: EVENTHANDLERS.txt: Move to kbase and rSTisze
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-05-17 19:31:07 +02:00
Peter Krempa
1095803ffa qemu: MIGRATION.txt: Move to kbase and rSTisze
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-05-17 19:31:07 +02:00
Peter Krempa
b414c4a00a qemu: THREADS.txt: rSTize and move to knowledge-base
Move the internal documentation about qemu threading to the knowledge
base.

The conversion included rstizing of the text document, mainly just
fixing of the headline and enclosing function names and code examples
into code block sections.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-05-17 19:31:07 +02:00
Peter Krempa
eefe52b8f0 docs: Convert 'remote' page to rst
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-04-25 16:33:01 +02:00
Peter Krempa
5b1eb476a4 docs: kbase/tlscerts: Fix local anchor links
Original conversion didn't properly convert local links. Fix them by
pointing to the section name. In certain cases this requires
reformulation of the text.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-04-19 16:19:48 +02:00
Peter Krempa
ffef3fcd7b docs: kbase/launch_security_sev: Fix local anchor links
Original conversion didn't properly convert local links. Fix them by
pointing to the section name. In certain cases this requires
reformulation of the text.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-04-19 16:19:48 +02:00
Peter Krempa
a89b17c2a7 docs: kbase: internals: Make 'overview' page useful and link to it
While the content is slightly outdated it's still a good primer on how
an API call traverses through the client library and to the remote
driver.

To make the page useful, this commit:
 - removes the paragraphs which were intended to serve as a directory
   page for the 'internals' subdirectory
 - adds a note saying that some facts might not be up to date
 - adds linking to this page from the kbase directory page
 - adds more monospace formatting around function names

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-04-12 12:53:32 +02:00
Peter Krempa
b51afd97e5 docs: Convert 'internals' to RST and move it to 'kbase/internal/overview.rst'
Note that this document was not referenced from any top level page. This
patch does a straight conversion and leaves it unreferenced.

Next patch will then modify it to serve as an overview (hence the new
name) of how an API call happens.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-04-12 12:53:32 +02:00
Peter Krempa
2356b07424 docs: Convert 'internals/rpc' page to RST and move it to 'kbase/internals'
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-04-12 12:53:32 +02:00
Peter Krempa
d838439794 docs: Convert 'internals/locking' page to rst and move it to 'kbase/internals'
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-04-12 12:53:32 +02:00
Peter Krempa
dc57ae6fe1 docs: Convert 'internals/eventloop' page to rst and move it to 'kbase/internals'
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-04-12 12:53:32 +02:00
Peter Krempa
879546fdd4 docs: Convert 'internals/command' to rst and move it to 'kbase/internals'
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-04-12 12:53:32 +02:00
Peter Krempa
fca82f4e28 docs: kbase: Section of 'internals' documents into a subfolder
Add an 'internals' subfolder to 'docs/kbase' to house all the documents
under internals. The output files are still under 'docs/kbase'.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-04-12 12:53:32 +02:00
Peter Krempa
98ffd82060 docs: Simplify passing of 'href_base' XSL variable
Historically we had two top level XSL files for top level and nested
documents which only differ in what they pass for 'href_base' to the
main 'page.xsl' file.

We can instead pass the variable as argument from the build system so
that we have just one XSL file and also allow for more nested document
trees in the future.

The '404' page is special even with the current XSL way so we add a
special case for it.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-04-12 12:53:32 +02:00
Peter Krempa
c72249674d kbase: index: Split off 'internals' section
Add a separate column of documents regarding internals of libvirt and
move the 'migrationinternals' and 'incrementalbackupinternals' pages
under the new heading.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-04-12 12:53:32 +02:00
Peter Krempa
9c54820eb5 docs: Convert 'formatdomaincaps' to rST
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2022-04-07 17:15:52 +02:00
Peter Krempa
b74d418b03 docs: Move 'tlscerts' page to 'kbase/'
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2022-04-07 15:10:26 +02:00
Han Han
fd57b7bfe1 kbase: Fix the syntax of the snapshot link in index.rst
Signed-off-by: Han Han <hhan@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2022-03-25 09:00:45 +01:00
Peter Krempa
ccffb60a9d kbase: Introduce 'snapshots' page and describe the new 'manual' snapshot
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-22 10:32:43 +01:00
Peter Krempa
463af62c2c kbase: debuglogs: Add note about sensitive information in the logs
Outline information commonly logged which users could consider
sensitive.

Add a note that VNC/SPICE passwords are logged in plaintext.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-02-01 13:18:35 +01:00
Tim Wiederhake
088bb9cebe docs: Fix spelling
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
2022-01-24 09:41:44 +01:00
Peter Krempa
a4402c5253 kbase: debuglogs: Fix for modular daemons
Modular daemons are now the default in many new installations, thus we
need to include steps how to determine that modular daemons are used and
modular-daemon specific locations for the config files and admin URIs.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2022-01-21 13:40:11 +01:00