Commit Graph

11871 Commits

Author SHA1 Message Date
Laine Stump
bc5b270c44 network: fix indentation of networkDnsmasqConfContents
Somehow I managed to push the changes to this file with improper
indentation. This patch just re-indents, reformats the comment lines,
and re-groups a couple of multi-line strings so that they fit within
80 columns. The resulting binary should be identical.
2012-12-17 15:08:54 -05:00
Cole Robinson
ff93b865cd .gitignore: add tests/sysinfotest 2012-12-17 14:40:48 -05:00
Cole Robinson
2628ad8368 hostusb: Move USB_DEVFS define to hostusb.h to fix the build 2012-12-17 14:37:11 -05:00
Cole Robinson
96a108c993 daemon: Preface polkit error output with 'polkit:'
There's been a few bugs about an expected error from polkit:

https://bugzilla.redhat.com/show_bug.cgi?id=873799
https://bugzilla.redhat.com/show_bug.cgi?id=872166

The error is:

Authorization requires authentication but no agent is available.

The error means that polkit needs a password, but there is no polkit
agent registered in your session. Polkit agents are the bit of UI that
pop up and actually ask for your password.

Preface the error with the string 'polkit:' so folks can hopefully
make more sense of it.
2012-12-17 13:37:53 -05:00
Daniel P. Berrange
4ad6a01330 Add support for hotplug/unplug of host misc devices in LXC
Wire up the attach/detach device drivers in LXC to support the
hotplug/unplug of host misc devices.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:52 +00:00
Daniel P. Berrange
a5efb31909 Add support for hotplug/unplug of host storage devices in LXC
Wire up the attach/detach device drivers in LXC to support the
hotplug/unplug of host storage devices.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:51 +00:00
Daniel P. Berrange
ed77abc58b Add support for hotplug/unplug of USB host devices in LXC
Wire up the attach/detach device drivers in LXC to support the
hotplug/unplug of USB host devices.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:51 +00:00
Daniel P. Berrange
af7ab7fc5d Add support for hotplug/unplug of NIC devices in LXC
Wire up the attach/detach device drivers in LXC to support the
hotplug/unplug of NICs.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:51 +00:00
Daniel P. Berrange
de858e3fa7 Add support for hotplug/unplug of disk devices in LXC
Wire up the attach/detach device drivers in LXC to support the
hotplug/unplug of disks.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:51 +00:00
Daniel P. Berrange
986c270dac Add support for attach/detach/update hostdev devices in config for LXC
Wire up the attach/detach/update device APIs to support changing
of hostdevs in the persistent config file

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:51 +00:00
Daniel P. Berrange
8cacd8b4ea Add support for attach/detach/update disk devices in config for LXC
Wire up the attach/detach/update device APIs to support changing
of disks in the persistent config file

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:51 +00:00
Daniel P. Berrange
74a909fef1 Add support for attach/detach/update net devices in config for LXC
Wire up the attach/detach/update device APIs to support changing
of network interfaces in the persistent config file

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:51 +00:00
Daniel P. Berrange
d4e5359a1c Add basic driver API framework for device attach/detach support in LXC
This wires up the LXC driver to support the domain device attach/
detach/update APIs, following the same code design as used in
the QEMU driver. No actual changes are possible with this commit,
it is only providing the framework

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:51 +00:00
Daniel P. Berrange
83a9c93807 Add support for misc host device passthrough with LXC
This extends support for host device passthrough with LXC to
cover misc devices. In this case all we need todo is a
mknod in the container's /dev and whitelist the device in
cgroups

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:51 +00:00
Daniel P. Berrange
313669d1c1 Add support for storage host device passthrough with LXC
This extends support for host device passthrough with LXC to
cover storage devices. In this case all we need todo is a
mknod in the container's /dev and whitelist the device in
cgroups

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:51 +00:00
Daniel P. Berrange
95fef5f407 Add support for USB host device passthrough with LXC
This adds support for host device passthrough with the
LXC driver. Since there is only a single kernel image,
it doesn't make sense to pass through PCI devices, but
USB devices are fine. For the latter we merely need to
make the /dev/bus/usb/NNN/MMM character device exist
in the container's /dev

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:51 +00:00
Daniel P. Berrange
368e341ac1 Add support for disks with LXC
Currently LXC guests can be given arbitrary pre-mounted
filesystems, however, for some usecases it is more appropriate
to provide block devices which the container can mount itself.
This first impl only allows for <disk type='block'>, in other
words exposing a host disk device to a container. Since LXC
does not have device namespace virtualization, we are cheating
a little bit. If the XML specifies /dev/sdc4 to be given to
the container as /dev/sda1, when we do the mknod /dev/sda1
in the container's /dev, we actually use the major:minor
number of /dev/sdc4, not /dev/sda1.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:51 +00:00
Daniel P. Berrange
a6cbdd7b81 Add support for SELinux labelling of hostdev storage/misc devices
The SELinux security driver needs to learn to label storage/misc
hostdev devices for LXC

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:51 +00:00
Daniel P. Berrange
570ad09ef9 Refactor SELinux security driver hostdev labelling
Prepare to support different types of hostdevs by refactoring
the current SELinux security driver code

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:51 +00:00
Daniel P. Berrange
df5928ea56 Allow passing a vroot into security manager hostdev labelling
When LXC labels USB devices during hotplug, it is running in
host context, so it needs to pass in a vroot path to the
container root.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:51 +00:00
Daniel P. Berrange
89c5a9d0e8 Skip bulk relabelling of resources in SELinux driver when used with LXC
The virSecurityManager{Set,Restore}AllLabel methods are invoked
at domain startup/shutdown to relabel resources associated with
a domain. This works fine with QEMU, but with LXC they are in
fact both currently no-ops since LXC does not support disks,
hostdevs, or kernel/initrd files. Worse, when LXC gains support
for disks/hostdevs, they will do the wrong thing, since they
run in host context, not container context. Thus this patch
turns then into a formal no-op when used with LXC. The LXC
controller will call out to specific security manager labelling
APIs as required during startup.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:51 +00:00
Daniel P. Berrange
e89c68b8bb Refactor LXC NIC creation to allow reuse by hotplug code
The code for creating veth/macvlan devices is part of the
LXC process startup code. Refactor this a little and export
the methods to the rest of the LXC driver. This allows them
to be reused for NIC hotplug code

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:51 +00:00
Daniel P. Berrange
aae0fc2a92 Add support for <hostdev mode="capabilities">
The <hostdev> device type has long had a redundant "mode"
attribute, which has always been "subsys". This finally
introduces a new mode "capabilities", which will be used
by the LXC driver for device assignment. Since container
based virtualization uses a single kernel, the idea of
assigning physical PCI devices doesn't make sense. It is
still reasonable to assign USB devices, but for assigning
arbitrary nodes in /dev, the new 'capabilities' mode is
to be used.

The first capability support is 'storage', which is for
assignment of block devices. Functionally this is really
pretty similar to the <disk> support. The only difference
is the device node name is identical in both host and
container namespaces.

    <hostdev mode='capabilities' type='storage'>
      <source>
        <block>/dev/sdf1</block>
      </source>
    </hostdev>

The second capability support is 'misc', which is for
assignment of character devices. There is no existing
parallel to this. Again the device node is the same
inside & outside the container.

    <hostdev mode='capabilities' type='misc'>
      <source>
        <char>/dev/input/event3</char>
      </source>
    </hostdev>

The reason for keeping the char & storage devices
separate in the domain XML, is to mirror the split
in the node device XML. NB the node device XML does
not yet report character devices, but that's another
new patch to come

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 17:50:50 +00:00
Viktor Mihajlovski
347a712ab1 tests: Add tests for sysinfo
Test cases for virSysinfoRead. Initially, there are tests for
x86 (DMI based) and s390 (/proc/... based).
In lack of PPC data, I have stubbed out the test for it, but it
can be added with a minimal effort.

Signed-off-by: Viktor Mihajlovski <mihajlov@linux.vnet.ibm.com>
2012-12-17 17:37:17 +00:00
Viktor Mihajlovski
cab938c993 S390: Fix virSysinfoRead memory corruption
There was a double free issue caused by virSysinfoRead on s390,
as the same manufacturer string instance was assigned to more
than one processor record.
Cleaned up other potential memory issues and restructured the sysinfo
parsing code by moving repeating patterns into a helper function.

The restructuring made it necessary to conditionally disable
-Wlogical-op for some older GCC versions, using pragma GCC diagnostic.
This is a GCC specific pragma, which is acceptable, since we're
using it to work around a GCC specific bug.

Finally, added a function virSysinfoSetup to configure the sysinfo
data source files/script during run time, to facilitate writing test
programs. This function is not published in sysinfo.h and only
there for testing.

Signed-off-by: Viktor Mihajlovski <mihajlov@linux.vnet.ibm.com>
2012-12-17 17:36:58 +00:00
Viktor Mihajlovski
8b8fcdea6e build: Check for broken GCC -Wlogical-op in configure
Some older versions of GCC report a false positive on code like
  char * haystack, needle;
  strchr(haystack, needle);

Added an extra check in configure.ac which will
  #define BROKEN_GCC_WLOGICALOP 1
in this case, allowing to special handle "offending" code.

Signed-off-by: Viktor Mihajlovski <mihajlov@linux.vnet.ibm.com>
2012-12-17 17:36:56 +00:00
Peter Krempa
41bd91f8ad conf: cpu: Break some long lines 2012-12-17 17:28:04 +01:00
Peter Krempa
4a9c179325 conf: cpu: Refactor parsing of vendor_id and fallback attributes
This patch simplifies the code that parses the fallback and vendor_id
attributes from the domain xml cpu definition.

Changes done:
- free temp variables in the cleanup section instead of local use
- remove checking for presence of the attribute to directly getting the
value (saving call to virXPathBoolean)
- replace loop used to check for ',' in the vendor_id string with strchr
2012-12-17 17:27:56 +01:00
Peter Krempa
fb49ffc3bb conf: cpu: Fix memory leak when specifying cpu vendor_id manually
The field was not freed from the cpu definition.
2012-12-17 16:55:54 +01:00
Ken ICHIKAWA
1190a82469 conf: cpu: Fix parsing of vendor_id
This patch fixes a problem that vendor_id attribute can not be defined
when fallback attribute is not defined.

If I define domain xml like below:
<domain>
  <cpu>
    <model vendor_id='aaaabbbbcccc'>core2duo</model>
  </cpu>
</domain>

In dumpxml, vendor_id is not reflected:
<domain>
  <cpu mode='custom' match='exact'>
    <model fallback='allow'>core2duo</model>
  </cpu>
</domain>

The expected output is:
<domain>
  <cpu mode='custom' match='exact'>
    <model fallback='allow' vendor_id='aaaabbbbcccc'>core2duo</model>
  </cpu>
</domain>

If the fallback attribute and vendor_id attribute is defined at the same
time, it's reflected as expected.

Signed-off-by: Ken ICHIKAWA <ichikawa.ken@jp.fujitsu.com>
2012-12-17 16:55:54 +01:00
Daniel P. Berrange
77d3a80974 Support custom 'svirt_tcg_t' context for TCG based guests
The current SELinux policy only works for KVM guests, since
TCG requires the 'execmem' privilege. There is a 'virt_use_execmem'
boolean to turn this on globally, but that is unpleasant for users.
This changes libvirt to automatically use a new 'svirt_tcg_t'
context for TCG based guests. This obsoletes the previous
boolean tunable and makes things 'just work(tm)'

Since we can't assume we run with new enough policy, I also
make us log a warning message (once only) if we find the policy
lacks support. In this case we fallback to the normal label and
expect users to set the boolean tunable

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-12-17 11:22:36 +00:00
Peter Krempa
c17b16d1be docs: Replace </br> with <br/> in docs/news.html.in 2012-12-17 11:02:23 +01:00
Guannan Ren
ed6fc41b9c tests: add one -device video device testcase
The testcase is for testing non-fixed PCI address for primary
video device and using video args to -deivce qemu option.
2012-12-17 14:02:58 +08:00
Guannan Ren
aa51202b72 qemu: use newer -device video device in qemu commandline
'-device VGA' maps to '-vga std'
'-device cirrus-vga' maps to '-vga cirrus'
'-device qxl-vga' maps to '-vga qxl'
             (there is also '-device qxl' for secondary devices)
'-device vmware-svga' maps to '-vga vmware'

For qemu(>=1.2), we can use -device to replace -vga for video
device. For the primary video device, the patch tries to use 0x2
slot for matching old qemu. If the 0x2 slot is allocated already,
the addr property could help for using any available slot.
For qemu(< 1.2), we keep using -vga for primary device.
2012-12-17 14:02:50 +08:00
Guannan Ren
09938bb3b0 conf: add optional attribte primary to video <model> element
If there are multiple video devices
primary = 'yes' marks this video device as the primary one.
The rest are secondary video devices. No more than one could be
mark as primary. If none of them has primary attribute, the first
one will be the primary by default like what it was.
The reason of this changing is that for qemu, only one primary video
device is permitted which can be of any type. For secondary video
devices, only qxl is allowd. Primary attribute removes the restriction
that the first have to be the primary one.

We always put the primary video device into the first position of
video device structure array after parsing.
2012-12-17 14:01:20 +08:00
Guannan Ren
4c993d8ab5 qemu: add qemu vga devices caps and one cap to mark them usable
QEMU_CAPS_DEVICE_QXL          -device qxl
QEMU_CAPS_DEVICE_VGA          -device VGA
QEMU_CAPS_DEVICE_CIRRUS_VGA   -device cirrus-vga
QEMU_CAPS_DEVICE_VMWARE_SVGA  -device vmware-svga

QEMU_CAPS_DEVICE_VIDEO_PRIMARY  /* safe to use -device XXX
                                 for primary video device */

Fix a typo in qemuCapsObjectTypes, the string 'qxl' here
should be -device qxl rather than -vga [...|qxl|..]
2012-12-17 13:55:50 +08:00
Daniel Veillard
34ca568497 Release of libvirt-1.0.1
- configure.ac docs/news.html.in: update for the release
- po/*.po: updated from transifex
2012-12-17 11:36:37 +08:00
Eric Blake
70743daeec build: minor build fixes for BSD
Noticed these while building on FreeBSD.

* src/qemu/qemu_monitor.c (qemuMonitorBlockInfoLookup): Rename
variable to avoid 'devname' collision.
* src/qemu/qemu_driver.c (qemuDomainInterfaceStats): Mark unused
variable.
2012-12-14 12:14:52 -07:00
Roman Bogorodskiy
0c94357f9d Socket identity support for FreeBSD.
This adds an implementation of virNetSocketGetUNIXIdentity()
using LOCAL_PEERCRED socket option and xucred struct, defined
in <sys/ucred.h> on systems that have it.
2012-12-14 11:49:31 -07:00
Laine Stump
e3802e13df network: fix (non)update of dnsmasq config during virDomainUpdateDeviceFlags
A forgotten "!" in recently-modified code at the top of
networkRefreshDaemon() meant an improper early return, which led to 1)
dnsmasq config files not being updated from the newly modified config,
and 2) dnsmasq not being sent a SIGHUP so that it could learn about
the changes to the config.

virNetworkDefGetIpByIndex() returns NULL if there are no ip objects of
the requested type, and if there are no IP elements, then dnsmasq
shouldn't be running, so we can return early. Otherwise we should
rewrite the config files and send a SIGHUP.
2012-12-14 13:37:17 -05:00
Guido Günther
238dba0f9c Require SANLK_INQ_WAIT for inq_lockspace support
since compilation breaks otherwise with older libsanlock.
2012-12-14 18:03:49 +01:00
Eric Blake
9821f8f6cf docs: fix some typos in examples
As detected in https://bugzilla.redhat.com/show_bug.cgi?id=887187

* docs/formatdomain.html.in: Fix XML typos.
2012-12-14 08:28:57 -07:00
Michal Privoznik
11cfa28850 sanlock: Re-add lockspace unconditionally
Currently, if sanlock is already registering a lockspace other
libvirtd instances (from other hosts) obtain -EINPROGRESS. On
sufficiently new sanlock, sanlock_inq_lockspace() is called,
which suspend execution until lockspace state is changed. With
current libvirt implementation, we fail to retry adding the
lockspace again but continue in error path. Therefore we produce
meaningless error message:

virLockManagerSanlockSetupLockspace:363 : Unable to add lockspace
/var/lib/libvirt/sanlock/__LIBVIRT__DISKS__: Success
qemudLoadDriverConfig:558 : Failed to load lock manager sanlock

We should try to re-add the lockspace after its state change to
be sure it was added successfully. In fact, with sufficiently new
sanlock we can just avoid dummy usleep() which is used if there's
no inquire API.
2012-12-14 15:01:03 +01:00
Eric Blake
8d59a025bb install: fix virtlockd installation
The virtlockd daemon scripts were lousy, when compared to their
counterparts in daemon/Makefile.am.  In particular, when init
scripts were selected, this resulted in 'make distcheck' failing
due to failure to clean up src/virtlockd.init.

* src/Makefile.am (install-systemd): Fix dependencies.  Use MKDIR_P.
(uninstall-systemd): Remove empty directory.  Use fewer processes.
(install-init, install-sysconfig): Use MKDIR_P.
(uninstall-init): Remove correct file, and also empty directory.
(uninstall-sysconfig): Remove empty directory.
(DISTCLEANFILES): Clean up trivially built sources.
2012-12-14 06:27:10 -07:00
Michał Łomnicki
c86f53d5b2 docs: Fix location of libvirt.conf and auth.conf
For a unprivileged user libvirt.conf and auth.conf are looked up in
$XDG_CONFIG_HOME but the docs incorrectly state that it's $XDG_CONFIG_DIR.
2012-12-14 13:35:03 +01:00
Laine Stump
9cf8734e7c qemu: don't fail update netdev on bridge detach failure
When a network device's bridge connection is changed by
virDomainUpdateDevice, libvirt first removes the netdev's tap from its
old bridge, then adds it to the new bridge. Sometimes, due to a
network being destroyed while a guest device is still attached, the
tap may already be "removed" from the old bridge (or the old bridge
may not even exist any more); the existing code was needlessly failing
the update when this happened, making it impossible to recover from
the situation without completely detaching (i.e. removing) the netdev
from the guest and re-attaching.

Instead of failing the entire operation when removal of the tap from
the old bridge fails, this patch changes qemuDomainChangeNetBridge to
just log a warning and continue, allowing a reasonable recover from
the situation.

(you'll appreciate this change if you ever accidentally destroy a
network while your guests are still using it).
2012-12-14 07:14:10 -05:00
Jiri Denemark
b4f20d07e2 spec: Include lockd files in libvirt-daemon package 2012-12-14 11:59:37 +01:00
Jiri Denemark
2e59e1207a build: Install both qemu-lockd.conf and qemu-sanlock.conf
With sanlock enabled, only one of those files was installed.
2012-12-14 11:59:37 +01:00
Eric Blake
c0a8056ee2 build: use fewer cat processes
* src/Makefile.am (libvirt.syms): Let cat loop for us.
2012-12-13 15:45:40 -07:00
Ján Tomko
b28fb61fd7 selinux: fix NULL dereference in GetSecurityMountOptions
In the case of an OOM error in virDomainDefGetSecurityLabelDef, secdef
is set to NULL, then dereferenced while printing the debug message.
2012-12-13 15:41:44 -07:00