Commit Graph

20519 Commits

Author SHA1 Message Date
Jiri Denemark
27e5633724 qemu: Generalize APPEND macro in qemuMonitorJSONSetMigrationParams
The APPEND macro is now be usable for any type.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-11-02 22:14:18 +01:00
Jiri Denemark
7ddcab891e qemu: Use macro for parsing ull migration parameters
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-11-02 22:14:18 +01:00
Jiri Denemark
4fabc0caa0 qemu: Use macro for parsing string migration parameters
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-11-02 22:14:18 +01:00
Jiri Denemark
c04fbbd9c9 qemu: Generalize PARSE macro in qemuMonitorJSONGetMigrationParams
The macro (now called PARSE_SET) is now usable for any type which needs
a *_set bool for indicating a valid value.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-11-02 22:14:18 +01:00
Jiri Denemark
3b2674ff63 cpu_map: Add cqm alternative name for cmt
Linux kernel shows our "cmt" feature as "cqm". Let's mention the name in
the cpu_map.xml to make it easier to find.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-11-02 21:44:29 +01:00
Michal Privoznik
bc8a99ef06 virNetDevSupportBandwidth: Enable QoS for vhostuser
Since vhostuser type is really a tap that is just plugged into
different type of bridge, supporting QoS is trivial.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-10-27 14:59:29 +02:00
Michal Privoznik
98696fd170 qemuDomainSetInterfaceParameters: Explicitly reject unsupported net types
For instance, NET_TYPE_MCAST doesn't support setting QoS. Instead
of claiming success and doing nothing, we should be explicit
about that and report an error.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-10-27 14:59:29 +02:00
John Ferlan
c9f7a04e28 qemu.conf: Clarify the various _tls_x509_cert_dir descriptions
https://bugzilla.redhat.com/show_bug.cgi?id=1458630

Apparantly commit id 'dc4c2f75a' wasn't specific enough, so here's
a few more clarifications.
2017-10-27 05:53:45 -04:00
John Ferlan
2518fd3b6a storage: Allow creation of a LUKS using logical volume
https://bugzilla.redhat.com/show_bug.cgi?id=1427049

Use virStorageBackendCreateVolUsingQemuImg to apply the LUKS information
to the logical volume just created.  As part of the processing of the
lvcreate command add 2MB to the capacity to account for the LUKS header
when it's determined that the volume desires to use encryption.
2017-10-27 05:46:35 -04:00
John Ferlan
29c5c7d27e storage: Introduce virStorageBackendCreateVolUsingQemuImg
Create a shim that will allow other backends to make use of qemu-img
functionality to create or possibly modify the volume.
2017-10-27 05:46:35 -04:00
John Ferlan
e32a9ef420 storage: Extract out the LVCREATE
Refactor to extract out the LVCREATE command.  This also removes the
need for the local @created since the error path can now only be reached
after the creation of the logical volume.

Signed-off-by: John Ferlan <jferlan@redhat.com>
2017-10-27 05:46:35 -04:00
John Ferlan
becb383a63 storage: Properly resize a local volume using LUKS
https://bugzilla.redhat.com/show_bug.cgi?id=1490279

Turns out the virStorageBackendVolResizeLocal did not differentiate
whether the target volume was a LUKS volume or not and just blindly
did the ftruncate() on the target volume.

Follow the volume creation logic (in general) and create a qemu-img
resize command to resize the target volume for LUKS ensuring that
the --object secret is provided as well as the '--image-opts' used
by the qemu-img resize logic to describe the path and secret ensuring
that it's using the luks driver on the volume of course.
2017-10-27 05:34:36 -04:00
John Ferlan
03984ae543 storage: Alter storageBackendCreateQemuImgSecretObject args
Since all that was really needed was a couple of fields and building
the object can be more generic, let's alter the args a bit. This will
be useful shortly for adding the secret object for a volume resize
operation on a luks volume that will need a secret object.
2017-10-27 05:31:19 -04:00
John Ferlan
07731f9917 storage: Add error path for virStorageBackendCreateQemuImgCmdFromVol
Rather than inline the various free's and return NULL, just create
an error label.
2017-10-27 05:31:19 -04:00
John Ferlan
ae94084b76 storage: Alter args to storageBackendResizeQemuImg
Rather than passing just the path, pass the virStorageVolDefPtr as we're
going to need it shortly.

Also fix the order of code and stack variables in the calling function
virStorageBackendVolResizeLocal.
2017-10-27 05:31:19 -04:00
Christian Ehrhardt
a150b86c4c virt-aa-helper: apparmor wildcards to forbidden chars
Some globbing chars in the domain name could be used to break out of
apparmor rules, so lets forbid these when in virt-aa-helper.

Also adding a test to ensure all those cases were detected as bad char.

Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
2017-10-27 10:32:02 +02:00
Marc Hartmayer
a50b45a297 qemu: Fix memory leak in virQEMUCapsLoadCPUModels
Don't leak @blockNodes in the loop.

==226576== 7,120 bytes in 60 blocks are definitely lost in loss record 122 of 125
==226576==    at 0x4835214: calloc (vg_replace_malloc.c:711)
==226576==    by 0x4950D7B: virAllocN (viralloc.c:191)
==226576==    by 0x49EB5BB: virXPathNodeSet (virxml.c:676)
==226576==    by 0x104DB67: virQEMUCapsLoadCPUModels (qemu_capabilities.c:3738)
==226576==    by 0x105510D: virQEMUCapsLoadCache (qemu_capabilities.c:3929)
==226576==    by 0x104459F: qemuTestParseCapabilities (testutilsqemu.c:498)
==226576==    by 0x1040DC9: testQemuCapsCopy (qemucapabilitiestest.c:105)
==226576==    by 0x1041F07: virTestRun (testutils.c:180)
==226576==    by 0x1040B45: mymain (qemucapabilitiestest.c:181)
==226576==    by 0x104320F: virTestMain (testutils.c:1119)
==226576==    by 0x1041149: main (qemucapabilitiestest.c:193)

Signed-off-by: Marc Hartmayer <mhartmay@linux.vnet.ibm.com>
Reviewed-by: Bjoern Walk <bwalk@linux.vnet.ibm.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.vnet.ibm.com>
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2017-10-27 10:13:43 +02:00
Christian Ehrhardt
07fc5c9c06 virt-aa-helper: grant locking permission on -f
Hot-adding disks does not parse the full XML to generate apparmor rules.
Instead it uses -f <PATH> to append a generic rule for that file path.

580cdaa7: "virt-aa-helper: locking disk files for qemu 2.10" implemented
the qemu 2.10 requirement to allow locking on disks images that are part of
the domain xml.

But on attach-device a user will still trigger an apparmor deny by going
through virt-aa-helper -f, to fix that add the lock "k" permission to the
append file case of virt-aa-helper.

Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
2017-10-26 12:48:32 +02:00
Jiri Denemark
8def32157a conf: Avoid leaking blockers from virDomainCapsCPUModel
When adding CPU usability blockers I forgot to properly free them when
in virDomainCapsCPUModelsDispose.

Reported-by: Marc Hartmayer <mhartmay@linux.vnet.ibm.com>
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-26 12:45:34 +02:00
Christian Ehrhardt
3080834fcd Increase default file handle limits for virtlockd
The assumption so far was an average of 4 disks per guest.
But some architectures, like s390x, still often use plenty of smaller disks.

To include those in the considerations an assumption of an average of 10
disks is more reasonable.

Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
2017-10-26 12:29:28 +02:00
Christian Ehrhardt
d744476475 Increase default file handle limits for virtlogd
The initial assumption was ~2 files per guest, but some common setups
like Openstack drive up to 4 files per guest.

E.g. on Arm where the following XML leads to 4 file handles:
    <serial type='file'>
      <source path='/var/lib/nova/instances/7c0dcd78-.../console.log'/>
      <target port='0'/>
      <alias name='serial0'/>
    </serial>
    <console type='file'>
      <source path='/var/lib/nova/instances/7c0dcd78-.../console.log'/>
      <target type='serial' port='0'/>
      <alias name='serial0'/>
    </console>

With that in mind and the target to support 4k guests by default we
should raise the limit to 16k.

Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
2017-10-26 12:29:28 +02:00
Jiri Denemark
32c29f10db qemu: Enabled pause-before-switchover migration capability
QEMU identified a race condition between the device state serialization
and the end of storage migration. Both QEMU and libvirt needs to be
updated to fix this.

Our migration work flow is modified so that after starting the migration
we to wait for QEMU to enter "pre-switchover", "postcopy-active", or
"completed" state. Once there, we cancel all block jobs as usual. But if
QEMU is in "pre-switchover", we need to resume the migration afterwards
and wait again for the real end (either "postcopy-active" or
"completed" state).

Old QEMU will just enter either "postcopy-active" or "completed"
directly, which is still correctly handled even by new libvirt. The
"pre-switchover" state will only be entered if QEMU supports it and the
pause-before-switchover capability was enabled. Thus all combinations of
libvirt and QEMU will work, but only new QEMU with new libvirt will
avoid the race condition.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2017-10-26 10:36:02 +02:00
Jiri Denemark
6addde24be qemu: Add pause-before-switchover migration capability
This new capability enables a pause before device state serialization so
that we can finish all block jobs without racing with the end of the
migration. The pause is indicated by "pre-switchover" state. Once we're
done QEMU enters "device" migration state.

This patch just defines the new capability and QEMU migration states and
their mapping to our job states.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2017-10-26 10:36:02 +02:00
Jiri Denemark
b5ec33b832 qemu: Add support for migrate-continue QMP command
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2017-10-26 10:36:02 +02:00
Dawid Zamirski
55223c2b16 vbox: Read runtime RDP port and handle autoport
VirutalBox has a IVRDEServerInfo structure available that
gives the effective runtime port that the VM is using when it's
running. This is useful when the "TCP/Ports" VBox property was set to
port range (e.g. via autoport = "yes" or via VBoxManage) in which
case it would be impossible to get the "active" port otherwise.
2017-10-26 01:03:18 -04:00
Dawid Zamirski
380815f8ef vbox: Make autoport set RDP port range.
Originally autoport in vbox driver was setting the port to default value
(3389) which caused multiple VM instances use the same port. Since
libvirt XML does not allow to set port ranges, this patch changes the
"autoport" behavior to set VBox's "TCP/Ports" property to an arbitrary
port range (3389-3689) to avoid that issue.
2017-10-25 11:14:21 -04:00
Dawid Zamirski
32845fd656 vbox: Remove old unflexible macros
The VBOX_SESSION_OPEN/CLOSE macros are only called in
_vboxDomainSnapshotRestore and they are unflexible because:

* assume the caller will have variable named "data"
* can only create Write lock type

As per above, it's not that hard to simply use the VBOX API directly.
2017-10-25 11:14:21 -04:00
Jiri Denemark
f26636887f qemu: Reset hasManagedSave after removing a corrupted image
When starting a domain with managed save image, we try to restore it
first. If the image is corrupted, we silently unlink it and just
normally start the domain. At this point the domain has no managed save
image, yet we did not reset the hasManagedSave flag.

https://bugzilla.redhat.com/show_bug.cgi?id=1460962

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2017-10-24 11:07:10 +02:00
Nikolay Shirokovskiy
05021e727d iohelper: use saferead if later write with O_DIRECT
One of the usecases of iohelper is to read from pipe and write
to file with O_DIRECT. As we read from pipe we can have partial
read and then we fail to write this data because output file
is open with O_DIRECT and buffer size is not aligned.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2017-10-24 10:53:18 +02:00
Jiri Denemark
55ac6a5d44 qemu: Set correct job status when qemuMigrationRun fails
Instead of enumerating all states which need to be turned into
QEMU_DOMAIN_JOB_STATUS_FAILED (and failing to add all of them), it's
better to mention just the one which needs to be left alone.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-23 10:08:29 +02:00
Jiri Denemark
73a352263c qemu: Consistently use exit_monitor in qemuMigrationRun
Almost every failure in qemuMigrationRun while we are talking to QEMU
monitor results in a jump to exit_monitor label. The only exception is
removed by this patch.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-23 10:08:29 +02:00
Jiri Denemark
af32e57f8e qemu: Don't misuse "ret" in qemuMigrationRun
The "ret" variable is used for storing the return value of a function
and should not be used as a temporary variable.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-23 10:08:29 +02:00
Jiri Denemark
7d2fbabcaf qemu: Unite error handling in qemuMigrationRun
Merge cancel and cancelPostCopy sections with the generic error section,
where we can easily decide whether canceling the ongoing migration is
required.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-23 10:08:29 +02:00
Jiri Denemark
c1a643b68f qemu: Split cleanup and error code in qemuMigrationRun
Let cleanup only do things common to both failure and success paths and
move error handling code inside the new "error" section.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-23 10:08:29 +02:00
Jiri Denemark
f8ede9cc23 qemu: Refactor qemuMigrationRun a bit
Some code which was supposed to be executed only when migration
succeeded was buried inside the cleanup code.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-23 10:08:29 +02:00
Jiri Denemark
9603262377 qemu: Use switch in qemuMigrationCompleted
When adding a new job state it's useful to let the compiler complain
about places where we need to think about what to do with the new
state.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-23 10:08:29 +02:00
Michal Privoznik
f3bc68e221 qemu: Parse alias from inactive XMLs
https://bugzilla.redhat.com/show_bug.cgi?id=1434451

This way users can uniquely identify devices at define time.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-10-23 09:01:46 +02:00
Michal Privoznik
0429e52f19 conf: Format alias even for inactive XMLs
We need to format alias even for inactive XMLs since that's the
way how users are going to identify their devices.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-10-23 08:56:55 +02:00
Michal Privoznik
92f41b3297 qemuDomainABIStabilityCheck: Check for memory aliases too
Since we will be allowing users to set device aliases and memory
devices are fragile when it comes to aliases we have to make sure
they won't change during migration. Other devices should be fine.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-10-23 08:52:08 +02:00
Michal Privoznik
e2797e3256 conf: Validate user supplied aliases
They have to be unique within the domain. As usual, backwards
compatibility takes its price. In this particular situation we
have a device that is represented twice in a domain and so is its
alias.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-10-23 08:52:01 +02:00
Michal Privoznik
c14f1ed206 conf: Parse user supplied aliases
If driver that is calling the parse supports user supplied
aliases, they can be parsed even for inactive XMLs. However, to
avoid any clashes with aliases that libvirt generates, the user
ones have to have "ua-" prefix.

Note, that some drivers don't have notion of device aliases at
all. Also, in order to support user supplied aliases some extra
checks need to be done (e.g. during hotplug). Therefore we can't
just enable this feature for all the drivers. Thus we need a flag
that drivers set to tell parsing code that they can handle user
supplied device aliases.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-10-22 13:49:46 +02:00
Michal Privoznik
ad30f069d1 qemu_alias: Be more tolerant if alias don't follow our format
When assigning alias to a device we usually iterate over other
devices of its kind trying to find next index. We do this by
stripping down the prefix and then parsing number at the end,
Usually, if the prefix doesn't match the one we are expecting, we
just continue with next iteration. Except for couple of
functions: qemuGetNextChrDevIndex(),
qemuAssignDeviceRedirdevAlias() and qemuAssignDeviceShmemAlias().

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-10-22 13:49:46 +02:00
John Ferlan
08d4e16f88 conf: Rename [n]macs and maxmacs to [n]names and maxnames
To avoid further confusion - rename the array elements to what they are.
2017-10-20 14:48:23 -04:00
Pavel Hrdina
727238de25 conf: duplicate interface name instead of MAC provided to lookup the interface
Introduced by 6094d6ec7f.
Found by running libvirt-perl tests.

Reviewed-by: Andrea Bolognani <abologna@redhat.com>
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-20 16:28:38 +02:00
Julio Faracco
89622ebfad util: Missing 'removeTimeoutImpl' check variable inside virEventRegisterImpl() function.
The function virEventRegisterImpl() checks the attempt to replace the
registered events. But there is a duplicate variable inside the IF statement.
The variable 'removeHandleImpl' was wrongly repeated. One of them needs to be
replaced by 'removeTimeoutImpl'.

Signed-off-by: Julio Faracco <jcfaracco@gmail.com>
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
2017-10-20 15:15:35 +02:00
Jiri Denemark
58c1e16951 qemu: Enhance debug message in qemuMonitorSetMigrationCapability
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-20 13:37:03 +02:00
Jiri Denemark
38b0e4f58f qemu: Drop qemuMonitorGetMigrationCapability
The only remaining user of qemuMonitorGetMigrationCapability is our test
suite. Let's replace qemuMonitorGetMigrationCapability with
qemuMonitorGetMigrationCapabilities there and drop the unused function.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-20 13:37:03 +02:00
Jiri Denemark
310287b1c9 qemu: Use bitmap with migration capabilities
All calls to qemuMonitorGetMigrationCapability in QEMU driver are
replaced with qemuMigrationCapsGet.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-20 13:37:03 +02:00
Jiri Denemark
765d9b1245 qemu: Store supported migration capabilities in a bitmap
Each time we need to check whether a given migration capability is
supported by QEMU, we call query-migrate-capabilities QMP command and
lookup the capability in the returned list. Asking for the list of
supported capabilities once when we connect to QEMU and storing the
result in a bitmap is much better and we don't need to enter a monitor
just to check whether a migration capability is supported.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-20 13:36:56 +02:00
Jiri Denemark
19bade7ad9 qemu: Create a wrapper around qemuMonitorSetCapabilities
The new function is called qemuProcessInitMonitor and it will enter/exit
the monitor so that the caller doesn't have to deal with this.

The goal of this patch is to simplify the code in qemuConnectMonitor
which would otherwise be a bit hairy after the following patch.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-20 09:08:45 +02:00
John Ferlan
6094d6ec7f interfaces: Convert virInterfaceObjList to virObjectRWLockable
Rather than a forward linked list, let's use the virHashTable in
order to manage the objsName data.

Requires numerous changes from List to Object management similar to
many other drivers/vir*obj.c modules
2017-10-19 15:42:47 -04:00
John Ferlan
4102e22864 interface: Make _virInterfaceObjList virObjectRWLockable
Modify the allocation to be a real RWLockable object and add the
various RWLock{Read|Write} and RWUnlock calls to process the list
of interfaces.
2017-10-19 15:39:44 -04:00
John Ferlan
37537a7c64 conf: Add/Allow parsing the encryption in the disk source
Since the virStorageEncryptionPtr encryption; is a member of
 _virStorageSource it really should be allowed to be a subelement
of the disk <source> for various disk formats:

   Source{File|Dir|Block|Volume}
   SourceProtocol{RBD|ISCSI|NBD|Gluster|Simple|HTTP}

NB: Simple includes sheepdog, ftp, ftps, tftp

That way we can set up to allow the <encryption> element to be
formatted within the disk source, but we still need to be wary
from whence the element was read - see keep track and when it
comes to format the data, ensure it's written in the correct place.

Modify the qemuxml2argvtest to add a parse failure when there is an
<encryption> as a child of <disk> *and* an <encryption> as a child
of <source>.

The virschematest will read the new test files and validate from a
RNG viewpoint things are fine.
2017-10-19 15:32:50 -04:00
John Ferlan
8002d3cb1b conf: Add/Allow parsing the auth in the disk source
Since the virStorageAuthDefPtr auth; is a member of _virStorageSource
it really should be allowed to be a subelement of the disk <source>
for the RBD and iSCSI prototcols. That way we can set up to allow
the <auth> element to be formatted within the disk source.

Since we've allowed the <auth> to be a child of <disk>, we'll need
to keep track of how it was read so that when writing out we'll know
whether to format as child of <disk> or <source>. For the argv2xml
parsing, let's format under <source> as a preference. Do not allow
<auth> to be both a child of <disk> and <source>.

Modify the qemuxml2argvtest to add a parse failure when there is an
<auth> as a child of <disk> *and* an <auth> as a child of <source>.

Add tests to validate that if the <auth> was found in <source>, then
the resulting xml2xml and xml2arg works just fine.  The two new .args
file are exact copies of the non "-source" version of the file.

The virschematest will read the new test files and validate from a
RNG viewpoint things are fine

Update the virstoragefile, virstoragetest, and args2xml file to show
the "preference" to place <auth> as a child of <source>.
2017-10-19 15:26:49 -04:00
John Ferlan
0e2e22485e qemu: Move encinfo from private disk to private disk src
Since the encryption information can also be disk source specific
move it from qemuDomainDiskPrivate to qemuDomainStorageSourcePrivate

Since the last allocated element from qemuDomainDiskPrivate is
removed, that means we no longer need qemuDomainDiskPrivateDispose.

Signed-off-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
2017-10-19 18:20:30 +02:00
John Ferlan
ab0e32fbdf qemu: Relocate qemuDomainSecretInfoPtr to qemuDomainStorageSourcePrivate
Since the secret information is really virStorageSource specific
piece of data, let's manage the privateData from there instead of
at the Disk level.

Signed-off-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
2017-10-19 18:20:30 +02:00
John Ferlan
3ff3eb70c7 qemu: Introduce privateData object for virStorageSource
Add the object definition and helpers to store security-related private
data for virStorageSources.

Signed-off-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
2017-10-19 18:20:30 +02:00
John Ferlan
1f38445e43 util: storage: Introduce privateData for _virStorageSource
Introduce the bare necessities to add privateData to _virStorageSource.

Signed-off-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
2017-10-19 18:20:30 +02:00
John Ferlan
76a5ca62fb qemu: Add missing encinfo cleanup
When commit id 'da86c6c22' added support for diskPriv->encinfo in
qemuDomainSecretDiskPrepare a change to qemuDomainSecretDiskDestroy
to was missed. Although qemuDomainDiskPrivateDispose probably would
do the trick.

Signed-off-by: John Ferlan <jferlan@redhat.com>
2017-10-19 18:20:30 +02:00
Michal Privoznik
4f15707202 qemu-ns: Detect /dev/* mount point duplicates better
https://bugzilla.redhat.com/show_bug.cgi?id=1495511

When creating new /dev for domain ran in namespace we try to
preserve all sub-mounts of /dev. Well, not quite all. For
instance if /dev/foo/bar and /dev/foo are both mount points, only
/dev/foo needs preserving. /dev/foo/bar is preserved with it too.
Now, to identify such cases like this one STRPREFIX() is used.
That is not good enough. While it works for [/dev/foo/bar;
/dev/foo] case, it fails for [/dev/prefix; /dev/prefix2] where
the strings share the same prefix but are in fact two different
paths. The solution is to use STRSKIP().

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2017-10-19 17:33:31 +02:00
Michal Privoznik
eebfdcb41e conf: Pass xmlopt down to virDomainDeviceInfoParseXML
This function is going to make decisions based on the features
set per each driver. For that we need the virDomainXMLOption
object.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-10-19 17:33:29 +02:00
Michal Privoznik
6bc4a371cf qemu: Be tolerant to preexisting aliases
In the future, some aliases might be already parsed therefore we
should avoid overwriting them.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-10-19 17:33:27 +02:00
Michal Privoznik
215ab7aa03 qemu: Move device alias assignment to separate functions
Let's move all the virAsprintf()-s into separate functions for
better structure of the code. Later, when somebody wants to
generate a device alias, all they need is to expose the function.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-10-19 17:32:50 +02:00
Michal Privoznik
16bb5a710e qemuAssignDeviceAliases: Use qemuAssignDeviceRNGAlias for assigning RNG aliases
We have a special function for assigning aliases to RNG devices.
Use that instead of plain virAsprintf().

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-10-19 17:28:56 +02:00
Michal Privoznik
93ef9cf21d virDomainObjGetOneDefState: Fix error message
It looks like the error message was copied from virsh, because
that's where we have @ctl. Nevertheless, it's @flags which is
invalid, not @ctl.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-10-19 17:28:56 +02:00
Peter Krempa
05d4323989 qemu: hotplug: Reuse qemuDomainAttachDiskGeneric in qemuDomainAttachUSBMassStorageDevice
Apart from killing a lot of code this also "implements" authentication
and encryption for USB disks.
2017-10-19 15:04:00 +02:00
Peter Krempa
4e6ac368a5 qemu: hotplug: Reuse qemuDomainAttachDiskGeneric in qemuDomainAttachSCSIDisk
Get rid of the first copy of the mess.
2017-10-19 15:02:44 +02:00
Peter Krempa
5b0dc7fdfd qemu: hotplug: extract disk hotplug worker code
This horrible piece of spaghetti code is copy-past(ae)d in the SCSI and
USB disk hotplug code with minimal changes. Extract it for further
reuse.
2017-10-19 15:00:58 +02:00
Peter Krempa
3c437ebf40 qemu: hotplug: Use disk target in debug/warning messages where appropriate
Some messages deal with the disk itself thus using the disk target is
better than using the disk source name which can be NULL in some cases.
2017-10-19 14:50:50 +02:00
Peter Krempa
c01a2e057f qemu: hotplug: Remove wrong check for empty disks
The check if the disk is empty is wrong and would spuriously reject NBD
sources. Remove it.
2017-10-19 14:50:50 +02:00
Peter Krempa
a4bac46c96 qemu: address: Remove dead code when un-reserving PCI address
The code can't fail so having error handling is pointless.
2017-10-19 14:50:50 +02:00
Ján Tomko
537e86f031 fix error message spacing in qemuDomainDetachNetDevice
Move the space after the colon.
2017-10-19 14:46:13 +02:00
Ján Tomko
311f4069f9 qemu: remove pointless address validation on hot unplug
Back in the times of using 'pci_del', unplugging a device without
a PCI address was not wired up.

After completely removing support for qemu without QEMU_CAPS_DEVICE,
aliases are used to uniquely identify devices in all cases.

Remove the pointless validation of data that was already present
in the domain definition.
2017-10-19 14:45:15 +02:00
Ján Tomko
8a0d84e25b qemuIsMultiFunctionDevice: return early for non-PCI addresses
There is no point in iterating over all devices if none of them
could possibly match.
2017-10-19 14:45:15 +02:00
Ján Tomko
67486bb295 qemu: implement input device hotunplug
Allow unplugging USB and virtio USB devices.

https://bugzilla.redhat.com/show_bug.cgi?id=1379603
2017-10-19 14:43:22 +02:00
Ján Tomko
bc9ffafcc7 qemu: implement input device hotplug
For both virtio input devices and USB input devices.

https://bugzilla.redhat.com/show_bug.cgi?id=1379603
2017-10-19 14:43:22 +02:00
Ján Tomko
c547a5f8d8 Introduce qemuBuildInputDevStr
A function that builds the -device string for input devices.
2017-10-19 14:43:22 +02:00
Ján Tomko
d059b24aea split out qemuAssignDeviceInputAlias
Move assignment of input device alias into a separate function,
for reuse on hotplug.
2017-10-19 14:43:20 +02:00
Ján Tomko
513a8d4588 qemu: allow cold unplugging of input devices
https://bugzilla.redhat.com/show_bug.cgi?id=1379603
2017-10-19 14:42:10 +02:00
Ján Tomko
ba589d88bc qemu: allow coldplugging input devices
https://bugzilla.redhat.com/show_bug.cgi?id=1379603
2017-10-19 14:42:10 +02:00
Ján Tomko
f0cab974af Use qemuDomainEnsureVirtioAddress where possible
There are two more cases where we set an S390/CCW/PCI address
type based on the machine type.

Reuse qemuDomainEnsureVirtioAddress to reduce repetition.
2017-10-19 14:41:55 +02:00
Ján Tomko
f16600ff91 Split out qemuDomainEnsureVirtioAddress
Split out the common code responsible for reserving/assigning
PCI/CCW addresses for virtio disks into a helper function
for reuse by other virtio devices.
2017-10-19 14:41:51 +02:00
Ján Tomko
5ec76b0cb4 Move qemuCheckCCWS390AddressSupport to qemu_domain
Let it be reused in qemu_domain_address.
2017-10-19 14:39:05 +02:00
Ján Tomko
fef2855366 qemuDomainAttachRNGDevice: do not access source.file randomly
We pass the source.file to qemuCheckCCWS390AddressSupport for
the purpose of reporting an error message without actually checking
that the rng device is of type VIR_DOMAIN_RNG_BACKEND_RANDOM.

Change it to a hardcoded "rng" string, which also avoids
referring to the device by a host-side attribute.
2017-10-19 14:34:21 +02:00
Ján Tomko
7afaaa934b qemuDomainAttachControllerDevice: remove dead code
After a successful attach, the device address has already been set.
Remove the pointless assignment.
2017-10-19 14:34:21 +02:00
Ján Tomko
2690b5b930 conf: audit passthrough input devices at domain startup
Introduce virDomainAuditInput and use it to log the evdev passed
to the guest.
2017-10-19 14:34:21 +02:00
Pavel Hrdina
d66fc71d31 qemu: implement virDomainSetLifecycleAction() API
There is one limitation for using this API, when the guest is started
with all actions set to "destroy" we put "-no-reboot" on the QEMU
command line.  That cannot be changed while QEMU is running and
the QEMU process is always terminated no matter what is configured
for any action.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1460677

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-19 11:52:38 +02:00
Pavel Hrdina
e859da6f42 qemu: send allowReboot in migration cookie
We need to send allowReboot in the migration cookie to ensure the same
behavior of the virDomainSetLifecycleAction() API on the destination.

Consider this scenario:

    1. On the source the domain is started with:
        <on_poweroff>destroy</on_poweroff>
        <on_reboot>restart</on_reboot>
        <on_crash>destroy</on_crash>

    2. User calls an API to set "destroy" for <on_reboot>:
        <on_poweroff>destroy</on_poweroff>
        <on_reboot>destroy</on_reboot>
        <on_crash>destroy</on_crash>

    3. The guest is migrated to a different host

    4a. Without the allowReboot in the migration cookie the QEMU
        process on destination would be started with -no-reboot
        which would prevent using the virDomainSetLifecycleAction() API
        for the rest of the guest lifetime.

    4b. With the allowReboot in the migration cookie the QEMU process
        on destination is started without -no-reboot like it was started
        on the source host and the virDomainSetLifecycleAction() API
        continues to work.

The following patch adds a QEMU implementation of the
virDomainSetLifecycleAction() API and that implementation disallows
using the API if all actions are set to "destroy" because we add
"-no-reboot" on the QEMU command line.  Changing the lifecycle action
is in this case pointless because the QEMU process is always terminated.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-19 11:52:34 +02:00
Pavel Hrdina
a9d637e71e qemu: move detection whether to use -no-reboot to qemu_domain
This will be used later on in implementation of new API
virDomainSetLifecycleAction().  In order to use it, we need to store
the value in status XML to not lose the information if libvirtd is
restarted.

If some guest was started by old libvirt where it was not possible
to change the lifecycle action for running guest, we can safely
detect it based on the current actions from the status XML.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-19 11:52:30 +02:00
Pavel Hrdina
1a2f34e363 lib: introduce virDomainSetLifecycleAction() API
Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-19 11:52:26 +02:00
Pavel Hrdina
17f1a647a0 qemu: pass priv data instead of qemuCaps and autoNodeset
Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-19 11:52:24 +02:00
Pavel Hrdina
2dfef1240a qemu: pass priv data to qemuBuildMasterKeyCommandLine
Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-19 11:52:21 +02:00
Pavel Hrdina
ebf3abb166 qemu: pass priv data to qemuBuildPMCommandLine
Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-19 11:52:19 +02:00
Pavel Hrdina
b569ef0a76 qemu: pass priv data to qemuBuildMonitorCommandLine
Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-19 11:52:16 +02:00
Pavel Hrdina
e54d4d5e98 qemu: pass virDomainObjPtr to qemuBuildCommandLine
Extract the required data inside a function instead of passing it
all as arguments.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-19 11:52:13 +02:00
Pavel Hrdina
8c85b1ed4a conf: merge virDomainLifecycleCrashAction with virDomainLifecycleAction
There is no need to have two different enums where one has the same
values as the other one with some additions.

Currently for on_poweroff and on_reboot we allow only subset of actions
that are allowed for on_crash.  This was covered in parse time using
two different enums.  Now to make sure that we don't allow setting
actions that are not supported we need to check it while validating
domain config.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-19 11:52:09 +02:00
Pavel Hrdina
1ccf35b4f2 conf: introduce virDomainLifecycle enum to list all lifecycle types
Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-19 11:52:06 +02:00
Pavel Hrdina
55c63295b2 conf: rename virDomainLifecycleAction enum functions
Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-19 11:52:04 +02:00
Pavel Hrdina
21068580d6 conf: rename lifecycle enum values to correspond with typedef keyword
Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-19 11:51:53 +02:00
Jiri Denemark
86fde4d2b2 bhyve: Fix build
Commit v3.8.0-95-gfd885a06a dropped nmodels parameter from several APIs
in src/cpu/cpu.h, but failed to update all callers.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2017-10-19 11:13:54 +02:00
Erik Skultety
1af4580408 nodedev: udev: Hook up virFileWaitForAccess to work around uevent race
If we find ourselves in the situation that the 'add' uevent has been
fired earlier than the sysfs tree for a device was created, we should
use the best-effort approach and give kernel some predetermined amount
of time, thus waiting for the attributes to be ready rather than
discarding the device from our device list forever. If those don't appear
in the given time frame, we need to move on, since libvirt can't wait
indefinitely.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1463285

Signed-off-by: Erik Skultety <eskultet@redhat.com>
2017-10-19 08:54:53 +02:00
Erik Skultety
caf26412b6 util: Introduce virFileWaitForExists
Since we have a number of places where we workaround timing issues with
devices, attributes (files in general) not being available at the time
of processing them by calling usleep in a loop for a fixed number of
tries, we could as well have a utility function that would do that.
Therefore we won't have to duplicate this ugly workaround even more.

Signed-off-by: Erik Skultety <eskultet@redhat.com>
2017-10-19 08:54:53 +02:00
Erik Skultety
cdbe13329a nodedev: udev: Convert udevEventHandleThread to an actual thread routine
Adjust udevEventHandleThread to be a proper thread routine running in an
infinite loop handling devices. The handler thread pulls all available
data from the udev monitor and only then waits until a wakeup signal for
new incoming data has been emitted by udevEventHandleCallback.

Signed-off-by: Erik Skultety <eskultet@redhat.com>
2017-10-19 08:54:53 +02:00
Erik Skultety
5a47baaf44 nodedev: udev: Split udevEventHandleCallback in two functions
This patch splits udevEventHandleCallback in two (introduces
udevEventHandleThread) in order to be later able to refactor the latter
to actually become a normal thread which will wait some time for the
kernel to create the whole sysfs tree for a device as we cannot do that
in the event loop directly.

Signed-off-by: Erik Skultety <eskultet@redhat.com>
2017-10-19 08:54:53 +02:00
Erik Skultety
6215b036e7 nodedev: udev: Unlock the private data before setting up 'system' node
udevSetupSystemDev only needs the udev data lock to be locked because of
calling udevGetDMIData which accesses some protected structure members,
but it can do that on its own just fine, no need to hold the lock the
whole time.

Signed-off-by: Erik Skultety <eskultet@redhat.com>
2017-10-19 08:54:53 +02:00
Erik Skultety
37e02f68d0 nodedev: udev: Remove driver locks from stateInitialize and stateCleanup
The driver locks are unnecessary here, since currently the cleanup is
only called from the main daemon thread, so we can't race here. Moreover
@devs and @privateData are self-lockable objects, so no problem there
either.

Signed-off-by: Erik Skultety <eskultet@redhat.com>
2017-10-19 08:54:53 +02:00
Erik Skultety
365553645c nodedev: udev: Convert udev private data to a lockable object
Since there's going to be a worker thread which needs to have some data
protected by a lock, the whole code would just simply get unnecessary
complex, since two sets of locks would be necessary, driver lock (for
udev monitor and event handle) and a mutex protecting thread-local data.
Given the future thread will need to access the udev monitor socket as
well, why not protect everything with a single lock, even better, by
converting the driver's private data to a lockable object, we get the
automatic object disposal feature for free.

Signed-off-by: Erik Skultety <eskultet@redhat.com>
2017-10-19 08:54:53 +02:00
Erik Skultety
c6a16d3c64 nodedev: udev: Introduce udevEventMonitorSanityCheck helper function
We need to perform a sanity check on the udev monitor before every
use so that we know nothing has changed in the meantime. The reason for
moving the code to a separate helper is to enhance readability and shift
the focus on the important stuff within the udevEventHandleCallback
handler.

Signed-off-by: Erik Skultety <eskultet@redhat.com>
2017-10-19 08:54:53 +02:00
Erik Skultety
643c74abff nodedev: Move privileged flag from udev private data to driver's state
Even though hal doesn't make use of it, the privileged flag is related
to the daemon/driver rather than the backend actually used.
While at it, get rid of some tab indentation in the driver state struct.

Signed-off-by: Erik Skultety <eskultet@redhat.com>
2017-10-19 08:54:52 +02:00
Erik Skultety
15a37cdf88 maint: Remove not-so-much informative block commentaries
There were a bunch of commentary blocks that were literally useless in
terms of describing what the code following them does, since most of
them were documenting "the obvious" or it just wouldn't help at all.

Signed-off-by: Erik Skultety <eskultet@redhat.com>
2017-10-18 13:38:59 +02:00
Erik Skultety
b08017ca54 maint: Replace tabs with spaces in all source files in repo
So we have a syntax-check rule to catch all tab indents but it naturally
can't catch tab spacing, i.e. as a delimiter. This patch is a result of
running 'vim -en +retab +wq'
(using tabstop=8 softtabstop=4 shiftwidth=4 expandtab) on each file from
a list generated by the following:
find . -regextype gnu-awk \
         -regex ".*\.(rng|syms|html|s?[ch]|py|pl|php(\.code)?)(\.in)?" \
         | xargs git grep -lP "\t"

Signed-off-by: Erik Skultety <eskultet@redhat.com>
2017-10-18 13:25:10 +02:00
Peter Krempa
4a5cbba4bc util: storagefile: Track whether a virStorageSource was auto-detected
When formatting an inactive or migratable XML we will need to suppress
backing chain members which were detected from the disk to keep
semantics straight. This means we need to record, whether a
virStorageSource originates from autodetection.
2017-10-18 09:44:29 +02:00
Peter Krempa
bf75ed463c qemu: block: Add support for file/block/dir storage to JSON disk src generator
qemuBlockStorageSourceGetBackendProps now is able to format the JSON
definition for regular storage too.
2017-10-18 09:43:49 +02:00
Peter Krempa
5e24a36e0d qemu: command: Separate wrapping of disk backend props to 'file' object
The file object is needed when formatting the command line, but it makes
nesting of the objects less easy for use with blockdev. Separate the
wrapping into the 'file' object into a helper used specifically for disk
sources in the old code path.
2017-10-18 09:43:49 +02:00
Kothapally Madhu Pavan
7702cc1f80 qemu: Move qemuFreeKeywords into qemu_parse_command.c
Move qemuFreeKeywords into qemu_parse_command.c as
qemuParseKeywordsFree and call it rather than inline code
in multiple places.

Signed-off-by: Kothapally Madhu Pavan <kmp@linux.vnet.ibm.com>
2017-10-17 18:52:47 -04:00
Jiri Denemark
c1a63a5f7b qemu: Parse CPU stepping from query-cpu-model-expansion
Even though only family and model are used for matching CPUID data with
CPU models from cpu_map.xml, stepping is used by x86DataFilterTSX which
is supposed to disable TSX on CPU models with broken TSX support. Thus
we need to start parsing stepping from QEMU to make sure we don't
disable TSX on CPUs which provide working TSX implementation. See the
following patch for a real world example of such CPU.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-17 22:37:04 +02:00
Nikolay Shirokovskiy
921d61575d conf: fix use of uninitialized variable
If same boot order is specified twice (or more) in domain xml
we call free for uninitiaziled loadparm on cleanup in virDomainDeviceBootParseXML
and SIGABRT (or similar) as a result.
2017-10-17 15:49:25 -04:00
Nikolay Shirokovskiy
1071592e65 vz: fix typo for 0d3d020b 2017-10-17 21:27:05 +03:00
Nikolay Shirokovskiy
62d6de46fd vz: missing pieces for fd885a06 for vz driver 2017-10-17 21:27:05 +03:00
Jiri Denemark
6a6f6b91e0 qemu: Fix CPU model broken by older libvirt
When libvirt older than 3.9.0 reconnected to a running domain started by
old libvirt it could have messed up the expansion of host-model by
adding features QEMU does not support (such as cmt). Thus whenever we
reconnect to a running domain, revert to an active snapshot, or restore
a saved domain we need to check the guest CPU model and remove the
CPU features unknown to QEMU. We can do this because we know the domain
was successfully started, which means the CPU did not contain the
features when libvirt started the domain.

https://bugzilla.redhat.com/show_bug.cgi?id=1495171

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-17 15:08:05 +02:00
Jiri Denemark
e26cc8f82f qemu: Filter CPU features when using host CPU
When reconnecting to a domain started with a host-model CPU which was
started by old libvirt that did not replace host-model with the real CPU
definition, libvirt replaces the host-model CPU with the CPU from
capabilities (because this is what the old libvirt did when it started
the domain). Without this patch libvirt could use features unknown to
QEMU in the CPU definition which replaced the original host-model CPU.
Such domain would keep running just fine, but any attempt to migrate it
will fail and once the domain is saved or snapshotted, restoring it
would fail too.

In other words whenever we want to use the CPU definition from host
capabilities as a guest CPU definition, we have to filter the unknown
features.

https://bugzilla.redhat.com/show_bug.cgi?id=1495171

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-17 15:08:05 +02:00
Jiri Denemark
3276416904 conf: Introduce virCPUDefFindFeature
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-17 15:08:05 +02:00
Jiri Denemark
4b87b3675f qemu: Separate CPU updating code from qemuProcessReconnect
The new function is called qemuProcessRefreshCPU.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-17 15:08:05 +02:00
Jiri Denemark
e1ca8ecb46 qemu: Check QEMU error on failed migration
When migration fails, QEMU may provide a description of the error in
the reply to query-migrate QMP command. We can fetch this error and use
it instead of the generic "unexpectedly failed" message.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2017-10-17 10:41:45 +02:00
Peter Krempa
a693fdba01 Terminate backing chains explicitly
Express a properly terminated backing chain by putting a
virStorageSource of type VIR_STORAGE_TYPE_NONE in the chain. The newly
used helpers simplify this greatly.

The change fixes a bug as formatting an incomplete backing chain and
parsing it back would end up in expressing a terminated chain since
src->backingStoreRaw was not populated. By relying on the terminator
object this can be now processed appropriately.
2017-10-17 06:19:18 +02:00
Peter Krempa
0a294a8e28 util: storagefile: Add helpers to check presence of backing store
Add helpers that will simplify checking if a backing file is valid or
whether it has backing store. The helper virStorageSourceIsBacking
returns true if the given virStorageSource is a valid backing store
member. virStorageSourceHasBacking returns true if the virStorageSource
has a backing store child.

Adding these functions creates a central points for further refactors.
2017-10-17 06:19:18 +02:00
Peter Krempa
ee4d2df87d storage: Fill in 'type' field for virStorageSource in storage driver
Storage driver uses virStorageSource only partially to store it's
configuration but fully when parsing backing files of storage volumes.
This patch sets the 'type' field to a value other than
VIR_STORAGE_TYPE_NONE so that further patches can add a terminator
element to backing chains without breaking iteration.
2017-10-17 06:19:18 +02:00
Peter Krempa
e3fb414e77 util: storagefile: Tolerate NULL path when looking up volume in chain
chain->path may be NULL e.g. for NBD drives, so the check needs to avoid
dereferencing the path in such case
2017-10-17 06:19:18 +02:00
Peter Krempa
9cc8d6ee9e util: storage: use stored index to lookup disks
We can now use the backing store ID directly rather than counting the
number of images seen while looking up images.
2017-10-17 06:19:18 +02:00
Peter Krempa
c6231a6a6c util: storage: Store backing chain index in virStorageSource
The backing store indexes were not bound to the storage sources in any
way. To allow us to bind a given alias to a given storage source we need
to save the index in virStorageSource. The backing store ids are now
generated when detecting the backing chain.

Since we don't re-detect the backing chain after snapshots, the
numbering needs to be fixed there.
2017-10-17 06:19:18 +02:00
Peter Krempa
8b13c37f0b conf: domain: Simplify return from backing store parser
Use VIR_STEAL_PTR to remove conditional cleanup.
2017-10-17 06:19:18 +02:00
Kothapally Madhu Pavan
67a52f709a qemu: argv: parse qemu commandline memory arguments
Existing qemuParseCommandLineMem() will parse "-m 4G" format string.
This patch allows it to parse "-m size=8126464k,slots=32,maxmem=33554432k"
format along with existing format. And adds a testcase to validate the changes.

Signed-off-by: Kothapally Madhu Pavan <kmp@linux.vnet.ibm.com>
2017-10-16 11:18:25 -04:00
Ladi Prosek
a765e3094d hyperv: Map Limit to max_memory and VirtualQuantity to cur_balloon
Hyper-V uses its own specific memory management so no mapping is going to
be perfect. However, it is more correct to map Limit to max_memory (it
really is the upper limit of what the VM may potentially use) and keep
cur_balloon equal to total_memory.

The typical value returned from Hyper-V in Limit is 1 TiB, which is not
really going to work if interpreted as "startup memory" to be ballooned
away later.

Signed-off-by: Ladi Prosek <lprosek@redhat.com>
2017-10-16 10:29:32 -04:00
Ladi Prosek
5ae2d9c259 hyperv: Escape WQL queries
The code was vulnerable to SQL injection. Likely not a security issue due to
WMI SQL and other constraints but still lame. For example:

  virsh # dominfo \"
  error: failed to get domain '"'
  error: internal error: SOAP fault during enumeration: code 's:Sender', subcode
  'n:CannotProcessFilter', reason 'The data source could not process the filter.
  The filter might be missing or it might be invalid. Change the filter and try
  the request again.  ', detail 'The WS-Management service cannot process the
  request. The WQL query is invalid. '

This commit fixes the Hyper-V driver by escaping all WMI SQL string parameters.

The same command with the fix:

  virsh # dominfo \"
  error: failed to get domain '"'
  error: Domain not found: No domain with name "

Signed-off-by: Ladi Prosek <lprosek@redhat.com>
2017-10-16 10:29:32 -04:00
Ladi Prosek
bb8c2a76ca hyperv: Fix hypervInitConnection error reporting
"%s is not a Hyper-V server" is not a correct generalization of all possible
error conditions of hypervEnumAndPull. For example:

  $ virsh --connect hyperv://localhost/?transport=http
  Enter username for localhost [administrator]:
  Enter administrator's password for localhost: <enters incorrect password>
  error: failed to connect to the hypervisor
  error: internal error: localhost is not a Hyper-V server

This commit removes the general virReportError from hypervInitConnection and
also the "Invalid query" virReportError from hypervSerializeEprParam, which
does not correctly describe the error either (virBufferCheckError has
already set a meaningful error message at that point).

The same scenario with the fix:

  $ virsh --connect hyperv://localhost/?transport=http
  Enter username for localhost [administrator]:
  Enter administrator's password for localhost: <enters incorrect password>
  error: failed to connect to the hypervisor
  error: internal error: Transport error during enumeration: User, password or
  similar was not accepted (26)

Signed-off-by: Ladi Prosek <lprosek@redhat.com>
2017-10-16 10:29:32 -04:00
Daniel P. Berrange
441d3eb6d1 qemu: ensure TLS clients always verify the server certificate
The default_tls_x509_verify (and related) parameters in qemu.conf
control whether the QEMU TLS servers request & verify certificates
from clients. This works as a simple access control system for
servers by requiring the CA to issue certs to permitted clients.
This use of client certificates is disabled by default, since it
requires extra work to issue client certificates.

Unfortunately the code was using this configuration parameter when
setting up both TLS clients and servers in QEMU. The result was that
TLS clients for character devices and disk devices had verification
turned off, meaning they would ignore errors while validating the
server certificate.

This allows for trivial MITM attacks between client and server,
as any certificate returned by the attacker will be accepted by
the client.

This is assigned CVE-2017-1000256  / LSN-2017-0002

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16 12:54:43 +01:00
Daniel P. Berrange
e371b3bf41 Use https:// links for most sites
This adds a rule to require https links for the libvirt, qemu
and kvm websites.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16 10:22:34 +01:00
Ján Tomko
d007ec3344 qemu: reserve PCI addresses for implicit i440fx devices
Somewhere around commit 9ff9d9f reserving entire PCI slots was
eliminated, as demonstrated by commit 6cc2014.

Reserve the functions required by the implicit devices:
00:01.0 ISA Bridge
00:01.1 IDE Controller
00:01.2 USB Controller (unless USB is disabled)
00:01.3 Bridge

https://bugzilla.redhat.com/show_bug.cgi?id=1460143
2017-10-16 09:53:34 +02:00
Jiri Denemark
7bca16937a cputest: Test CPU usability blockers
Gather query-cpu-definitions results and use them for testing CPU model
usability blockers in CPUID to virCPUDef translation.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-16 09:23:20 +02:00
Jiri Denemark
9c9620af1d cpu_x86: Disable blockers from unusable CPU models
When decoding CPUID data to virCPUDef we need to be careful about using
a CPU model which cannot be directly used on the current host. Normally,
libvirt would notice the features which prevent the model from being
usable and it would disable them in the computed virCPUDef, but this
won't work in case the definition of the CPU model in QEMU contains more
features than what we have in cpu_map.xml. We need to count with the
usability blockers we got from QEMU and explicitly disable all of them
to make the computed virCPUDef usable.

https://bugzilla.redhat.com/show_bug.cgi?id=1464832

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-16 09:23:20 +02:00
Jiri Denemark
722ef4ff38 cpu_x86: Move x86FeatureFind* to avoid forward prototypes
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-16 09:23:20 +02:00
Jiri Denemark
20664ec779 conf: Introduce virDomainCapsCPUModelsGet
This internal API can be used to find a specific CPU model in
virDomainCapsCPUModels list.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-16 09:23:17 +02:00
Jiri Denemark
a62dca833e cpu: Drop unused parameter from cpuDecode
The "preferred" parameter is not used by any caller of cpuDecode
anymore. It's only used internally in cpu_x86 to implement cpuBaseline.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-16 09:21:52 +02:00
Jiri Denemark
fd885a06a0 cpu: Use virDomainCapsCPUModelsPtr in cpu driver APIs
All APIs which expect a list of CPU models supported by hypervisors were
switched from char **models and int models to just accept a pointer to
virDomainCapsCPUModels object stored in domain capabilities. This avoids
the need to transform virDomainCapsCPUModelsPtr into a NULL-terminated
list of model names and also allows the various cpu driver APIs to
access additional details (such as its usability) about each CPU model.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-16 09:21:52 +02:00
Jiri Denemark
e9f8e1b8e6 qemu: Parse unavailable features for CPU models
query-cpu-definitions QMP command returns a list of unavailable features
which prevent CPU models from being usable on the current host. So far
we only checked whether the list was empty to mark CPU models as
(un)usable. This patch parses all unavailable features for each CPU
model and stores them in virDomainCapsCPUModel as a list of usability
blockers.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-16 09:21:52 +02:00
Jiri Denemark
1255fa877a qemu: Store CPU usability blockers in caps cache
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-16 09:21:51 +02:00
Jiri Denemark
0861080f0e conf: Add usability blockers to virDomainCapsCPUModel
When a hypervisor marks a CPU model as unusable on the current host, it
may also give us a list of features which prevent the model from being
usable. Storing this list in virDomainCapsCPUModel will help the CPU
driver with creating a host-model CPU configuration.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-16 09:21:51 +02:00
Jiri Denemark
ef04596d76 util: Introduce virStringListCopy
The API makes a deep copy of a NULL-terminated string list.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2017-10-16 09:21:51 +02:00
Michal Privoznik
02555bfe5c virDomainDeviceInfoParseXML: Clear whole @info on failure
Currently, if parsing of device info fails info->alias is freed.
It doesn't make much sense to leave the rest of the struct
behind.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-10-13 17:55:41 -07:00
Michal Privoznik
83a517cfe6 virDomainDeviceInfoParseXML: Separate address parsing into separate func
There's one 'return' in the middle of the function body. It's
very easy to miss and so it makes adding new code harder. Also
the function doesn't follow our style 100%.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-10-13 17:55:41 -07:00