Commit Graph

24142 Commits

Author SHA1 Message Date
Jiri Denemark
2eea67a98e cpu_x86: Make x86cpuidMatchMasked more general
The function is renamed as virCPUx86DataItemMatchMasked to reflect the
change in parameter types.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 22:53:39 +02:00
Jiri Denemark
da1efddfa6 cpu_x86: Make x86cpuidAndBits more general
The function now works on virCPUx86DataItem and it's renamed as
virCPUx86DataItemAndBits.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 22:53:39 +02:00
Jiri Denemark
4e3cab2d00 cpu_x86: Make x86cpuidClearBits more general
The parameters changed from virCPUx86CPUID to virCPUx86DataItem and the
function is now called virCPUx86DataItemClearBits.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 22:53:39 +02:00
Jiri Denemark
9c6f00fc33 cpu_x86: Make x86cpuidSetBits more general
The function is renamed as virCPUx86DataItemSetBits and it works on
virCPUx86DataItem now.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 22:53:39 +02:00
Jiri Denemark
559ccd7815 cpu_x86: Introduce virCPUx86DataCmp
virCPUx86DataSorter already compares two virCPUx86DataItem structs.
Let's add a tiny wrapper around it called virCPUx86DataCmp and use it
instead of open coded comparisons.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 22:53:39 +02:00
Jiri Denemark
0fdc0ad84c cpu_x86: Simplify x86DataAdd
The while loop just copied half of virCPUx86DataAddItem.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 22:53:39 +02:00
Jiri Denemark
3eff71a2d5 cpu_x86: Rename virCPUx86VendorToCPUID
Renamed as virCPUx86VendorToData.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 22:53:39 +02:00
Jiri Denemark
8f1a8ce397 cpu_x86: Rename virCPUx86DataAddCPUID
It's called virCPUx86DataAdd now.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 22:53:39 +02:00
Jiri Denemark
ce42042577 cpu_x86: Rename virCPUx86DataAddCPUIDInt
The new name is virCPUx86DataAddItem.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 22:53:39 +02:00
Jiri Denemark
95accfa7fa cpu_x86: Rename virCPUx86CPUIDSorter
It is called virCPUx86DataSorter since the function will work on any CPU
data type.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 22:53:39 +02:00
Jiri Denemark
609f467f13 cpu_x86: Rename x86DataCpuid
It is now called virCPUx86DataGet.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 22:53:39 +02:00
Jiri Denemark
5655b83139 cpu_x86: Rename x86DataCpuidNext function
The function is now called virCPUx86DataNext to reflect its purpose: it
is an iterator over CPU data (both CPUID and MSR in the near future).

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 22:53:39 +02:00
Jiri Denemark
6c22b329d5 cpu_x86: Rename virCPUx86DataItem variables
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 22:53:39 +02:00
Jiri Denemark
c02d70d52e cpu_x86: Rename virCPUx86Vendor.cpuid
Although vendor string is always reported by CPUID, the container struct
is used for consistency and thus "cpuid" name is not a good fit anymore.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 22:53:39 +02:00
Jiri Denemark
3673269e3a cpu_x86: Introduce virCPUx86DataItem container struct
The following patches introduce CPU features read from MSR in addition
to those queried via CPUID instruction. Let's introduce a container
struct which will be able to describe either feature type.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 22:53:39 +02:00
Jiri Denemark
2878278c74 cpu_map: Add Cascadelake-Server CPU model
Introduced in QEMU 3.1.0 by commit
c7a88b52f62b30c04158eeb07f73e3f72221b6a8

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 22:53:39 +02:00
Andrea Bolognani
03a07357e1 maint: Add filetype annotations to Makefile.inc.am
Vim has trouble figuring out the filetype automatically because
the name doesn't follow existing conventions; annotations like
the ones we already have in Makefile.ci help it out.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2019-04-12 16:55:38 +02:00
Michal Privoznik
51f17c98f6 lib: Don't use virReportSystemError() if virCommandRun() fails
Firstly, virCommandRun() does report an error on failure (which
in most cases is more accurate than what we overwrite it with).
Secondly, usually errno is not set (or gets overwritten in the
cleanup code) which makes virReportSystemError() report useless
error messages. Drop all virReportSystemError() calls in cases
like this (I've found three occurrences).

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2019-04-12 15:56:28 +02:00
Andrea Bolognani
5aefd1362f conf: Fix typo enconding -> encoding
Introduced-by: e0fae78ad5
Spotted-by: Lintian
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2019-04-12 14:33:42 +02:00
Michal Privoznik
e8c2c8bd07 qemu_command: Prefer '-overcommit mem-lock' over -realtime mlock'
The latter is deprecated and will be removed soon. The advised
replacement is '-overcommit mem-lock=on|off'.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 14:13:45 +02:00
Michal Privoznik
be51feff69 qemu_capabilities: Introduce QEMU_CAPS_OVERCOMMIT
Added in QEMU commit of v3.0.0-rc0~48^2~9 (then fixed by
v3.1.0-rc0~119^2~37) QEMU is replacing '-realtime mlock' with
'-overcommit mem-lock'. Add a capability to tell if we're dealing
new new enough qemu to use the replacement.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 13:42:39 +02:00
Michal Privoznik
a08c4b3741 qemu: Always assume QEMU_CAPS_REALTIME_MLOCK
The '-realtime mlock' cmd line argument was introduced in QEMU
commit v1.5.0-rc0~190 which matches minimal QEMU version we
require. Therefore, the capability will always be present.

Apparently, nearly none of our xml2argv test cases had the
capability hence slightly bigger change under qemuxml2argvdata/.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-12 13:39:42 +02:00
Pavel Hrdina
e3c4befef4 virresctrl: fix MBA memory leak
The 'bandwidths' variable is allocated using VIR_RESIZE_N so it has to
be freed as well.

==118315== 8 bytes in 1 blocks are definitely lost in loss record 299 of 2,401
==118315==    at 0x4C29DAD: malloc (vg_replace_malloc.c:308)
==118315==    by 0x4C2C100: realloc (vg_replace_malloc.c:836)
==118315==    by 0x52C3FAF: virReallocN (viralloc.c:245)
==118315==    by 0x52C4079: virExpandN (viralloc.c:294)
==118315==    by 0x532BBA8: virResctrlAllocParseProcessMemoryBandwidth (virresctrl.c:1156)
==118315==    by 0x532BBA8: virResctrlAllocParseMemoryBandwidthLine (virresctrl.c:1211)
==118315==    by 0x532BBA8: virResctrlAllocParse (virresctrl.c:1414)
==118315==    by 0x532BBA8: virResctrlAllocGetGroup (virresctrl.c:1446)
==118315==    by 0x532C11D: virResctrlAllocGetDefault (virresctrl.c:1464)
==118315==    by 0x532D15E: virResctrlAllocAssign (virresctrl.c:1923)
==118315==    by 0x532D15E: virResctrlAllocCreate (virresctrl.c:2042)
==118315==    by 0x31E1ABEE: qemuProcessResctrlCreate (qemu_process.c:2596)
==118315==    by 0x31E1ABEE: qemuProcessLaunch (qemu_process.c:6444)
==118315==    by 0x31E1E341: qemuProcessStart (qemu_process.c:6721)
==118315==    by 0x31E81315: qemuDomainObjStart.constprop.50 (qemu_driver.c:7288)
==118315==    by 0x31E81A65: qemuDomainCreateWithFlags (qemu_driver.c:7341)
==118315==    by 0x54DDB4B: virDomainCreate (libvirt-domain.c:6534)

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2019-04-12 12:39:42 +02:00
Andrea Bolognani
4637048f8d src: Include SASL_CFLAGS where appropriate
A bunch of files include src/rpc/virnetsaslcontext.h, which
in turn includes <sasl/sasl.h>, and without the corresponding
CFLAGS the compiler can't locate the latter if it happens to
be installed outside of the default include path as is the
case, for example, on FreeBSD.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2019-04-12 09:16:02 +02:00
Cole Robinson
1d31526b52 Always put _LAST enums on second line of VIR_ENUM_IMPL
Standardize on putting the _LAST enum value on the second line
of VIR_ENUM_IMPL invocations. Later patches that add string labels
to VIR_ENUM_IMPL will push most of these to the second line anyways,
so this saves some noise.

Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-04-11 12:47:23 -04:00
Daniel P. Berrangé
ae076bb40e remote: enforce ACL write permission for getting guest time & hostname
Getting the guest time and hostname both require use of guest agent
commands. These must not be allowed for read-only users, so the
permissions check must validate "write" permission not "read".

Fixes CVE-2019-3886
Reviewed-by: Jim Fehlig <jfehlig@suse.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2019-04-11 15:21:53 +01:00
Daniel P. Berrangé
2a07c990bd api: disallow virDomainGetHostname for read-only connections
The virDomainGetHostname API is fetching guest information and this may
involve use of an untrusted guest agent. As such its use must be
forbidden on a read-only connection to libvirt.

Fixes CVE-2019-3886
Reviewed-by: Jim Fehlig <jfehlig@suse.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2019-04-11 15:21:48 +01:00
Daniel P. Berrangé
d5cbf85f1a build-aux: ensure all scripts are included in EXTRA_DIST
Few of the scripts in build-aux are included in EXTRA_DIST. This is not
a serious problem since they are primarily tools intended for developers
upstream, and downstream builds won't need them. Having them missing,
however, complicates downstream patching because it means patches that
are auto-exported from git will fail to apply if they include a change
to a file in build-aux/.  By bundling all these scripts in the dist we
make patching more straightforward.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2019-04-11 15:20:17 +01:00
Pavel Hrdina
6d82b979d0 libvirtd.conf: remove extra # after log_outputs line
The only place where we have extra empty comment line.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2019-04-11 15:04:55 +02:00
Peter Krempa
17f160b288 util: json: Use VIR_APPEND_ELEMENT in virJSONValueObjectAppend
The function open-codes addition into an array. Use the helper instead.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 16:34:57 +02:00
Peter Krempa
0ef161c88f qemu: block: Use VIR_RETURN_PTR
Demonstrate how VIR_RETURN_PTR is used by refactoring qemu_block.c

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 16:34:57 +02:00
Peter Krempa
267f1e6da5 internal: Introduce VIR_RETURN_PTR
With the introduction of more and more internal data types which support
VIR_AUTOPTR it's becoming common to see the following pattern:

  VIR_AUTOPTR(virSomething) some = NULL
  virSomethingPtr ret = NULL;

  ... (ret is not touched ) ...

  VIR_STEAL_PTR(ret, some);
  return ret;

This patch introduces a macro named VIR_RETURN_PTR which returns the
pointer directly without the need for an explicitly defined return
variable and use of VIR_STEAL_PTR. Internally obviously a temporary
pointer is created to allow setting the original pointer to NULL so that
the VIR_AUTOPTR function does not free the memory which we want to
actually return.

The name of the temporary variable is deliberately long and complex to
minimize the possibility of collision.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 16:34:57 +02:00
Peter Krempa
c9cec6a8b0 qemu: block: Remove unneeded cleanup jumps
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 16:34:57 +02:00
Peter Krempa
6542fbe2d5 qemu: block: Add and use AUTOPTR func for qemuBlockNodeNameBackingChainData
This is a locally used helper struct but we can make use of automatic
freeing for it.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 16:34:57 +02:00
Peter Krempa
7141bdd5bf qemu: block: Use VIR_AUTOFREE for char *
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 16:34:57 +02:00
Peter Krempa
ae0c36ecbb qemu: block: Use VIR_AUTOPTR for virHashTablePtr
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 16:34:57 +02:00
Peter Krempa
bc6eabbec3 qemu: block: Use VIR_AUTOPTR for virURIPtr
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 16:34:57 +02:00
Peter Krempa
46bd9ee7d7 util: uri: Introduce VIR_AUTOPTR freeing function
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 16:34:57 +02:00
Peter Krempa
e8ef1dd174 qemu: block: Use VIR_AUTOPTR for virJSONValue
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 16:34:57 +02:00
Peter Krempa
1d2eb86682 qemu: block: Introduce and use AUTOPTR func for qemuBlockStorageSourceAttachDataPtr
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 16:34:57 +02:00
Ján Tomko
e0befb78b1 qemuHotplugDiskSourceDataFree: also free backends
Also free the backends array, not just its members.

Fixes: d3f9dda2c9

Signed-off-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 16:28:50 +02:00
Ján Tomko
c264cb1b1c qemu: remove qemuGetDomainDefaultHugepath
It is no longer used.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 16:24:33 +02:00
Ján Tomko
07c6738460 qemu: do not fill in default pagesize in qemuGetDomainHupageMemPath
Commit 6864d8f740 moved this one level up
for qemuBuildMemoryBackendProps but left qemuBuildMemPathStr intact.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 16:24:33 +02:00
Ján Tomko
b261c9c3a0 qemu: rename function for getting the default hugepage size
Use qemuBuildMemoryGetDefaultPagesize.

Fixes: 6864d8f740
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 16:24:33 +02:00
Michal Privoznik
5b9819eedc domain capabilities: Expose firmware auto selection feature
If a management application wants to use firmware auto selection
feature it can't currently know if the libvirtd it's talking to
support is or not. Moreover, it doesn't know which values that
are accepted for the @firmware attribute of <os/> when parsing
will allow successful start of the domain later, i.e. if the mgmt
application wants to use 'bios' whether there exists a FW
descriptor in the system that describes bios.

This commit then adds 'firmware' enum to <os/> element in
<domainCapabilities/> XML like this:

  <enum name='firmware'>
    <value>bios</value>
    <value>efi</value>
  </enum>

We can see both 'bios' and 'efi' listed which means that there
are descriptors for both found in the system (matched with the
machine type and architecture reported in the domain capabilities
earlier and not shown here).

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
2019-04-10 13:58:51 +02:00
Michal Privoznik
9c0d73bf49 qemu_firmware: Introduce qemuFirmwareGetSupported
The point of this API is to fetch all FW descriptors, parse them
and return list of supported interfaces and SMM feature for given
combination of machine type and guest architecture.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
2019-04-10 13:58:30 +02:00
Michal Privoznik
2337309e04 qemu_firmware: Separate machine and arch matching into a function
This part of the code will be reused later.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
2019-04-10 13:54:07 +02:00
Michal Privoznik
15e0b76480 qemu_firmware: Separate firmware loading into a function
This piece of code will be reused later.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
2019-04-10 13:45:51 +02:00
Peter Krempa
f785318187 Revert "Include unistd.h directly by files using it"
This reverts commit a5e1602090.

Getting rid of unistd.h from our headers will require more work than
just fixing the broken mingw build. Revert it until I have a more
complete proposal.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
2019-04-10 12:26:32 +02:00
Peter Krempa
a5e1602090 Include unistd.h directly by files using it
util/virutil.h bogously included unistd.h. Drop it and replace it by
including it directly where needed.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 09:12:04 +02:00
Peter Krempa
285c5f28c4 util: Move enum convertors into virenum.(c|h)
virutil.(c|h) is a very gross collection of random code. Remove the enum
handlers from there so we can limit the scope where virtutil.h is used.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 09:12:04 +02:00
Peter Krempa
c0abcca417 util: Don't include 'viralloc.h' into other header files
'viralloc.h' does not provide any type or macro which would be necessary
in headers. Prevent leakage of the inclusion.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 09:12:04 +02:00
Peter Krempa
a4bfc2521f util: Move the VIR_AUTO(CLEAN|PTR) helper macros into a separate header
Keeping them with viralloc.h forcibly pulls in the other stuff from
viralloc.h into other header files. This in turn creates a mess
as more and more headers pull in the 'viral' header file.

If we want to make 'viralloc.h' omnipresent we should pick a different
approach.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-10 09:12:03 +02:00
Han Han
9895f00126 vmx: Define VMX_CONFIG_FORMAT_ARGV
Define VMX_CONFIG_FORMAT_ARGV to replace the hardcoded 'vmware-vmx'
string used by the domxml-X-native APIs. This follows the pattern used
by other drivers.

Reviewed-by: Cole Robinson <crobinso@redhat.com>
Signed-off-by: Han Han <hhan@redhat.com>
2019-04-09 15:30:04 -04:00
Peter Krempa
c3e1275b60 rpc: Refactor cleanup paths in virNetLibsshAuthenticatePassword
Now that the memory disposal is handled automatically we can simplify
the cleanup paths. In this case it's not as simple as sometimes the
value of the called function is returned.

While at it fix the initialization value of the returned variable.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-09 16:22:19 +02:00
Pavel Hrdina
99582f2403 cpu_map: rename x86_EPYC-IBRS file to x86_EPYC-IBPB
The later is the correct CPU model name.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
2019-04-09 13:12:51 +02:00
Julio Faracco
692400f446 util: Fix uninitalized variable to avoid garbage
This commit fixes an unitialized variable to avoid garbage value
when virNetDevBridgeGet method returns error. When, that method fails
before initialize 'val' variable, it can cause problems related to
that.

Signed-off-by: Julio Faracco <jcfaracco@gmail.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2019-04-09 10:23:09 +02:00
Eric Blake
f66f70acbe snapshot: Fix use-after-free during snapshot delete
Commit b647d2195 introduced a use-after-free situation when the caller
is trying to delete a snapshot and its children: if the callback
function deletes the parent, it is no longer safe to query the parent
to learn which children also need to be deleted (where we previously
saved deleting the parent for last).  To fix the problem, while still
maintaining support for topological visits of callback functions, we
have to stash off any information needed for later traversal prior to
using a callback function (virDomainMomentForEachChild already does
this, it is only virDomainMomentActOnDescendant that was running into
problems).

Sadly, the testsuite did not cover the problem at the time. Worse,
even though I later added commit 280a2b41e to catch problems like
this, and even though that test is indeed sufficient to detect the
problem when run under valgrind or suitable MALLOC_PERTURB_ settings,
I'm guilty of not running the test in such an environment.  Thus,
v5.2.0 has a regression that could have been prevented had we used the
testsuite to its full power. On the bright side, deleting snapshots
requires ACL domain:snapshot, which is arguably as powerful as
domain:write, so I don't think this use-after-free forms a security
hole.

At some point, it would be nice to convert virDomainMomentObj into a
virObject, at which point, the solution is even simpler: add
virObjectRef/Unref around the callback. But as that will require
auditing even more places in the code, I went with the simplest patch
for the regression fix.

Fixes: b647d2195
Reported-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
Tested-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
2019-04-08 14:19:18 -05:00
Jiri Denemark
dbc04114f3 cpu_x86: Require <cpuid> within <feature> in CPU map
A feature with no cpuid element is invalid and it should not be silently
treated as a feature with all CPUID bits set to zero.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-08 15:28:59 +02:00
Jiri Denemark
be46f61326 cpu_x86: Do not cache microcode version
The microcode version checks are used to invalidate cached CPU data we
get from QEMU. To minimize /proc/cpuinfo parsing the microcode version
was only read when libvirtd started and cached for the daemon's
lifetime. However, the CPU microcode can change anytime (updating the
microcode package can automatically upload it to the CPU) and we need to
stop caching it to avoid using stale CPU model data.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-08 15:28:47 +02:00
Peter Krempa
5cd017d563 util: Move VIR_AUTOUNREF definition to virobject.h
This helper has solely to do with virObjects. Move it together with
other virObject stuff.

This also avoids the potential problem where VIR_AUTOUNREF uses
virObjectAutoUnref which is defined in virobject.h.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-05 18:07:51 +02:00
Cole Robinson
ce5346292a vircgrouppriv.h: Use #pragma once
Acked-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-04-04 18:42:10 -04:00
Cole Robinson
ba32be8467 node_device_hal.h: Use #pragma once
Acked-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-04-04 18:42:10 -04:00
Cole Robinson
c12f687999 node_device_udev.h: Use #pragma once
Acked-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-04-04 18:42:09 -04:00
Cole Robinson
23bda3b782 node_device_driver.h: Use #pragma once
Acked-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-04-04 18:42:09 -04:00
Andrea Bolognani
5ee5ebf453 qemu: Unify address assignment for virt guests
The rules are the same for all virt guests, regardless of the
architecture.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-04-04 09:52:20 +02:00
Andrea Bolognani
20011d01d9 qemu: Require PCIe Root Port for PCI by default on ARM virt
Our PCIe topology depends on the availability of PCIe Root Ports,
so if none of the suitable devices (pcie-root-port, ioh3420) is
compiled into QEMU we should fall back to virtio-mmio rather than
trying to use PCI addresses only to fail immediately afterwards
when we realize we can't use the necessary controllers.

Note that this additional check is basically moot for ARM virt
guests, because PCIe Root Ports were enabled in QEMU builds for
the architecture well before guest OS support had been widely
available; however, the opposite is true for RISC-V, and tweaking
the code this way will allow us to share it between architectures.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-04-04 09:52:14 +02:00
Nikolay Shirokovskiy
e3389d830c qemu: Don't duplicate suspend events and state changes
Since the STOP event handler can use the pausedReason as sent to
qemuProcessStopCPUs, we no longer need to send duplicate suspended
lifecycle events because we know what caused the stop along with extra
details. This processing allows us to also remove the duplicated state
change from qemuProcessStopCPUs.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Nikolay Shirokovskiy <nshirokovskiy@virtuozzo.com>
2019-04-04 10:36:04 +03:00
Nikolay Shirokovskiy
ab2eaa1492 qemu: Map suspended state reason to suspended event detail
Map is based on existing cases in code where we send suspended
event after changing domain state to paused.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Nikolay Shirokovskiy <nshirokovskiy@virtuozzo.com>
2019-04-04 10:36:03 +03:00
Nikolay Shirokovskiy
93c7d13eec qemu: Pass stop reason from qemuProcessStopCPUs to stop handler
Similar to commit [1] which saves and passes the running reason to
the RESUME event handler, during qemuProcessStopCPUs let's save and pass
the pause reason in the domain private data so that the STOP event
handler can use it.

[1] 5dab984ed : qemu: Pass running reason to RESUME event handler

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Nikolay Shirokovskiy <nshirokovskiy@virtuozzo.com>
2019-04-04 10:36:03 +03:00
Michal Privoznik
b701e45be5 virNWFilterBindingObjListAddLocked: Produce better error message than 'Duplicate key'
If there are two concurrent threads, one of which is removing an
nwfilter from the list and the other is trying to add it back they
may serialize in the following order:

1) obj->removing is set and @obj is unlocked.
2) The tread that's trying to add the nwfilter onto the list locks
   the list and tries to find, if the nwfilter already exists.
3) Our lookup functions say it doesn't, so the thread proceeds to
   virHashAddEntry() which fails with 'Duplicate key' error.

This is obviously not helpful error message at all.

The problem lies in our lookup function
(virNWFilterBindingObjListFindByPortDevLocked()) which return
NULL even if the object is still on the list. They do this so
that the object is not mistakenly looked up by some API. The fix
consists of moving 'removing' check one level up and thus
allowing virNWFilterBindingObjListAddLocked() to produce
meaningful error message.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-04-04 09:16:24 +02:00
Michal Privoznik
a5c71129bf virDomainObjListAddLocked: Produce better error message than 'Duplicate key'
If there are two concurrent threads, one of which is removing a
domain from the list and the other is trying to add it back they
may serialize in the following order:

1) vm->removing is set and @vm is unlocked.
2) The tread that's trying to add the domain onto the list locks
   the list and tries to find, if the domain already exists.
3) Our lookup functions say it doesn't, so the thread proceeds to
   virHashAddEntry() which fails with 'Duplicate key' error.

This is obviously not helpful error message at all.

The problem lies in our lookup functions
(virDomainObjListFindByUUIDLocked() and
virDomainObjListFindByNameLocked()) which return NULL even if the
object is still on the list. They do this so that the object is
not mistakenly looked up by some driver. The fix consists of
moving 'removing' check one level up and thus allowing
virDomainObjListAddLocked() to produce meaningful error message.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-04-04 09:16:24 +02:00
Peter Krempa
e26712d35b util: Remove virParseNumber
We have more modern replacements.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-03 16:51:02 +02:00
Peter Krempa
29a7c2e5d8 rpc: ssh: Use virStrToLong_i instead of virParseNumber
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-03 16:51:02 +02:00
Peter Krempa
5857a63519 vmx: Refactor number parsing in virVMXParseConfig
Parsing of the cpu affinity list was using virParseNumber. Modernize it
to get rid of the virParseNumber call.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-03 16:51:02 +02:00
Peter Krempa
c0dae62e02 vmx: Remove unused variable in virVMXParseConfig
'cpumasklen' is only written to since ee7d23ba4b.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-03 16:51:02 +02:00
Peter Krempa
1bb063f69c util: Remove virPipeReadUntilEOF
Unused since 3c269b51a6

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-03 16:51:02 +02:00
Michal Privoznik
6864d8f740 qemuBuildMemoryBackendProps: Get pagesize early
https://bugzilla.redhat.com/show_bug.cgi?id=1693066

Up until memfd introduction (in 24b74d187c) we did not need to
know @pagesize because qemuGetDomainHupageMemPath() could deal
with it being zero (value of zero means use the default hugetlbfs
mount). But since for memfd we are not passing a path to
hugetlbfs mount rather the page size value we need to know its
value upfront.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-03 16:37:19 +02:00
Michal Privoznik
465df4771a virfile: Introduce and use virFileGetDefaultHugepage
This helper returns the default hugetlbfs mount point from given
array of mount points.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-03 16:37:19 +02:00
Ján Tomko
8753865c76 virjson: drop compatibility macros
Since commit 66460e3 dropped support for YAJL 1, we no longer need
these.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Peter Krempa <pkrempa@redhat.com>
2019-04-03 15:19:02 +02:00
Ján Tomko
650e62e034 rbd: fix build with LIBRBD_VERSION_CODE <= 265
Add ATTRIBUTE_UNUSED to the volStorageBackendRBDGetFlags stub.

Fixes: 21deeaf02f

Signed-off-by: Ján Tomko <jtomko@redhat.com>
2019-04-03 13:36:44 +02:00
Ján Tomko
f01a34f04c virJSONValueToString: bail out early on error
Now that we do not need to cater to YAJL 1, move the check for the
return value of yajl_gen_alloc earlier, so that we can assume it
was successful in later code.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2019-04-03 13:30:47 +02:00
Ján Tomko
66460e32e6 json: assume WITH_YAJL2
Now that we require YAJL2, drop the code dealing with YAJL 1.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2019-04-03 13:30:47 +02:00
Nikolay Shirokovskiy
cae45f2cdd qemu: fix domain unlock/unref in qemuMigrationSrcPerform
qemuMigrationSrcPerform callers expect it to call virDomainObjEndAPI
in any case so on error paths we miss the virDomainObjEndAPI call.
To fix this let's make qemuMigrationSrcPerform callers responsible
for the virDomainObjEndAPI call.

ACKed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Nikolay Shirokovskiy <nshirokovskiy@virtuozzo.com>
2019-04-03 13:46:26 +03:00
Daniel P. Berrangé
c1ac1e4637 security: avoid use of dirent d_type field
The d_type field cannot be assumed to be filled. Some filesystems, such
as older XFS, will simply report DT_UNKNOWN.

Even if the d_type is filled in, the use of it in the SELinux functions
is dubious. If labelling all files in a directory there's no reason to
skip things which are not regular files. We merely need to skip "." and
"..", which is done by virDirRead() already.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2019-04-03 11:31:38 +01:00
Daniel P. Berrangé
ebe9c6eab7 qemu: don't rely on the non-portable d_type field in dirent
d_type is a non-portable extension to the struct dirent and even if it
exists, its value may be DT_UNKNOWN if the filesystem doesn't support
it. This is common with older versions of XFS which have ftype=0
feature.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2019-04-03 11:31:38 +01:00
Peter Krempa
ac21141ce4 qemu: monitor: Avoid unnecessary copies of command string
Use virJSONValueToBuffer so that we can append the command terminator
string without copying of the string again. Also avoid a 'strlen' as we
can query the buffer use size.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Laine Stump <laine@laine.org>
2019-04-03 11:58:10 +02:00
Peter Krempa
d8306dce0f qemu: monitor: Remove few debug statements
The internal qemu machinery already logs the sent message via the PROBE
point in qemuMonitorSend and the monitor receive function. Those are way
better as they are easy grepable. Remove the additional ones from the
monitor code which just duplicate the sent data.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Laine Stump <laine@laine.org>
2019-04-03 11:58:10 +02:00
Peter Krempa
a2a04524be util: json: Export virJSONValueToBuffer
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Laine Stump <laine@laine.org>
2019-04-03 11:58:10 +02:00
Peter Krempa
cfe6cecdca util: json: Don't bother logging output string in virJSONValueToString
We have tests that validate the XML formatter. Additionally almost every
guide tells users to disable JSON logging. Drop logging of output string
in virJSONValueToString.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Laine Stump <laine@laine.org>
2019-04-03 11:58:10 +02:00
Peter Krempa
6a604f759d util: json: Use virBuffer in JSON->string conversion
The last step of the conversion involves copying of the generated JSON
into a separate string. We can use a virBuffer to do this as this will
also allow to subsequently use the buffer when we actually need to do
some other formatting of the string.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Laine Stump <laine@laine.org>
2019-04-03 11:58:10 +02:00
Peter Krempa
29ad523018 util: buffer: Use 'size_t' for buffer size variables
Use size_t for all sizes. The '*' modifier unfortunately does require an
int so a temporary variable is necessary in the tests.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Laine Stump <laine@laine.org>
2019-04-03 11:58:10 +02:00
Peter Krempa
14f7030f95 util: buffer: Remove struct member munging
This was meant to stop abusing the members directly, but we don't do
this for other internal structs. Additionally this did not stop the
test from touching the members. Remove the header obscurization.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Laine Stump <laine@laine.org>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-03 11:58:10 +02:00
Peter Krempa
fb59497484 Use VIR_AUTODISPOSE_STR instead of VIR_DISPOSE_STRING where possible
Refactor code paths which clear strings on cleanup paths to use the
automatic helper.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-03 11:58:10 +02:00
Peter Krempa
a9b3afabcd util: alloc: Add automatic cleanup/disposal of strings
VIR_AUTODISPOSE_STR is similar to VIR_AUTOFREE(char *) but uses
virDispose for clearing of the stored string.

This patch also refactors VIR_DISPOSE to use the new helper which is
used for the new macro.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-03 11:58:10 +02:00
Peter Krempa
c358adc571 qemu: capabilities: Always assume disk snapshot caps
'blockdev-snapshot-sync' is present in QEMU since v0.14.0-rc0 and
'transaction' since v1.1.0 (52e7c241ac766406f05fa)

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-03 11:58:10 +02:00
Peter Krempa
72e88ca0a2 qemu: capabilities: Always assume QEMU_CAPS_DRIVE_MIRROR
qemu added the 'drive-mirror' command in v1.3.0 (d9b902db3fb71fdc)

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-03 11:58:10 +02:00
Peter Krempa
852afb2dc4 qemu: capabilities: Always assume QEMU_CAPS_BLOCK_COMMIT
qemu added the 'block-commit' command in v1.3.0 (ed61fc10e8c8d2)

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-03 11:58:10 +02:00
Peter Krempa
f1a0d2277c qemu: domain: drop qemuDomainSupportsBlockJobs
It always returns true.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-03 11:58:10 +02:00
Peter Krempa
d5654a7537 qemu: capabilities: Always assume QEMU_CAPS_BLOCKJOB_ASYNC
This was detected by the presence of 'block-stream' which is present in
qemu since v1.1 (db58f9c0605fa151b8c4)

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-04-03 11:58:09 +02:00