Commit Graph

14818 Commits

Author SHA1 Message Date
Daniel P. Berrange
66f2db7311 Fix leak in virDomainDefParseXML parsing vcpupin
If virBitmapNew fails due to OOM, the 'vcpupin' variable
is leaked.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-25 15:49:12 +01:00
Daniel P. Berrange
d9bae31250 Fix leak in virDomainVcpuPinDefParseXML parsing cpumask
If the virBitmapParse method fails due to OOM, we leak
the 'tmp' variable string.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-25 15:49:12 +01:00
Daniel P. Berrange
1fff45cca9 Avoid leak if virDomainSoundCodecDefParseXML return error
If virDomainSoundCodecDefParseXML returns an error (eg due
to OOM), then the xml nodeset codecNodes is leaked.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-25 15:49:12 +01:00
Daniel P. Berrange
fbf8e1c314 Fix leak in virDomainVcpuPinDefArrayFree
If virDomainVcpuPinDefArrayFree is called with def != NULL,
but nvcpupin == 0, then it leaks memory for 'def'. This is
an unusual scenario, but it hits when cleaning up after an
OOM during parsing of XML.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-25 15:49:12 +01:00
Laine Stump
386ebb47a5 qemu: prefer to put a Q35 machine's dmi-to-pci-bridge at 00:1E.0
This resolves one of the issues listed in:

   https://bugzilla.redhat.com/show_bug.cgi?id=1003983

00:1E.0 is the location of this controller on at least some actual Q35
hardware, so we try to replicate the placement. The bridge should work
just as well in any other location though, so if 00:1E.0 isn't
available, just allow it to be auto-assigned anywhere appropriate.
2013-09-25 10:39:23 -04:00
Laine Stump
c484fe16cb qemu: turn if into switch in qemuDomainValidateDevicePCISlotsQ35
This will make it simpler to add checks for other types of
controllers.

This is a prerequisite for patches to resolve:

   https://bugzilla.redhat.com/show_bug.cgi?id=1003983
2013-09-25 10:38:50 -04:00
Laine Stump
b83d26f6c4 qemu: support ich9-intel-hda audio device
This resolves one of the issues in:

   https://bugzilla.redhat.com/show_bug.cgi?id=1003983

This device is identical to qemu's "intel-hda" device (known as "ich6"
in libvirt), but has a different PCI device ID (which matches the ID
of the hda audio built into the ich9 chipset, of course). It's not
supported in earlier versions of qemu, so it requires a capability
bit.
2013-09-25 10:38:02 -04:00
Laine Stump
8e0dab3a8e qemu: replace multiple strcmps with a switch on an enum
I'm not sure why this code was written to compare the strings that it
had just retrieved from an enum->string conversion, rather than just
look at the original enum values, but this yields the same results,
and is much more efficient (especially as you add more devices).

This is a prerequisite for patches to resolve:

   https://bugzilla.redhat.com/show_bug.cgi?id=1003983
2013-09-25 10:37:33 -04:00
Laine Stump
07af519298 qemu: allow some PCI devices to be attached to PCIe slots
Part of the resolution to:

   https://bugzilla.redhat.com/show_bug.cgi?id=1003983

Although most devices available in qemu area defined as PCI devices,
and strictly speaking should only be attached via a PCI slot, in
practice qemu allows them to be attached to a PCIe slot and sometimes
this makes sense.

For example, The UHCI and EHCI USB controllers are usually attached
directly to the PCIe "root complex" (i.e. PCIe slots) on real
hardware, so that should be possible for a Q35-based qemu virtual
machine as well.

We still want to prefer a standard PCI slot when auto-assigning
addresses, though, and in general to disallow attaching PCI devices
via PCIe slots.

This patch makes that possible by adding a new
QEMU_PCI_CONNECT_TYPE_EITHER_IF_CONFIG flag. Three things are done
with this flag:

1) It is set for the "pcie-root" controller

2) qemuCollectPCIAddress() now has a set of nested switches that set
this "EITHER" flag for devices that we want to allow connecting to
pcie-root when specifically requested in the config.

3) qemuDomainPCIAddressFlagsCompatible() adds this new flag to the
"flagsMatchMask" if the address being checked came from config rather
than being newly auto-allocated by libvirt (this knowledge is
conveniently already available in the "fromConfig" arg).

Now any device having the EITHER flag set can be connected to
pcie-root if explicitly requested, but auto-allocated addresses for
those devices will still be standard PCI slots instead.

This patch only loosens the restrictions on devices that have been
specifically requested, but the setup is such that it should be fairly
easy to add new devices.
2013-09-25 10:36:45 -04:00
Laine Stump
fbd9be484c qemu: eliminate redundant if clauses in qemuCollectPCIAddress
Replace them with switch cases. This will make it more efficient when
we add exceptions for more controller types, and other device types.

This is a prerequisite for patches to resolve:

   https://bugzilla.redhat.com/show_bug.cgi?id=1003983
2013-09-25 10:35:49 -04:00
Laszlo Ersek
51e184e982 bridge driver: don't masquerade local subnet broadcast/multicast packets
Packets sent by guests on virbrN, *or* by dnsmasq on the same, to
- 255.255.255.255/32 (netmask-independent local network broadcast
  address), or to
- 224.0.0.0/24 (local subnetwork multicast range)
are never forwarded, hence it is not necessary to masquerade them.

In fact we must not masquerade them: translating their source addresses or
source ports (where applicable) may confuse receivers on virbrN.

One example is the DHCP client in OVMF (= UEFI firmware for virtual
machines):

  http://thread.gmane.org/gmane.comp.bios.tianocore.devel/1506/focus=2640

It expects DHCP replies to arrive from remote source port 67. Even though
dnsmasq conforms to that, the destination address (255.255.255.255) and
the source address (eg. 192.168.122.1) in the reply allow the UDP
masquerading rule to match, which rewrites the source port to or above
1024. This prevents the DHCP client in OVMF from accepting the packet.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=709418

Signed-off-by: Laszlo Ersek <lersek@redhat.com>
2013-09-25 08:31:50 -04:00
Laszlo Ersek
ccca5dc3a2 util/viriptables: add/remove rules that short-circuit masquerading
The functions
- iptablesAddForwardDontMasquerade(),
- iptablesRemoveForwardDontMasquerade
handle exceptions in the masquerading implemented in the POSTROUTING chain
of the "nat" table. Such exceptions should be added as chronologically
latest, logically top-most rules.

The bridge driver will call these functions beginning with the next patch:
some special destination IP addresses always refer to the local
subnetwork, even though they don't match any practical subnetwork's
netmask. Packets from virbrN targeting such IP addresses are never routed
outwards, but the current rules treat them as non-virbrN-destined packets
and masquerade them. This causes problems for some receivers on virbrN.

Signed-off-by: Laszlo Ersek <lersek@redhat.com>
2013-09-25 08:24:09 -04:00
Peter Krempa
ef29de14c3 qemu: Wire up better early error reporting
The previous patches added infrastructure to report better errors from
monitor in some cases. This patch finalizes this "feature" by enabling
this enhanced error reporting on early phases of VM startup. In these
phases the possibility of qemu producing a useful error message is
really high compared to running it during the whole life cycle. After
the start up is complete, the feature is disabled to provide the usual
error messages so that users are not confused by possibly irrelevant
messages that may be in the domain log.

The original motivation to do this enhancement is to capture errors when
using VFIO device passthrough, where qemu reports errors after the
monitor is initialized and the existing error catching code couldn't
catch this producing a unhelpful message:

 # virsh start test
 error: Failed to start domain test
 error: Unable to read from monitor: Connection reset by peer

With this change, the message is changed to:

 # virsh start test
 error: Failed to start domain test
 error: internal error: early end of file from monitor: possible problem:
 qemu-system-x86_64: -device vfio-pci,host=00:1a.0,id=hostdev0,bus=pci.0,addr=0x5: vfio: error, group 8 is not viable, please ensure all devices within the iommu_group are bound to their vfio bus driver.
 qemu-system-x86_64: -device vfio-pci,host=00:1a.0,id=hostdev0,bus=pci.0,addr=0x5: vfio: failed to get group 8
 qemu-system-x86_64: -device vfio-pci,host=00:1a.0,id=hostdev0,bus=pci.0,addr=0x5: Device 'vfio-pci' could not be initialized
2013-09-25 13:50:57 +02:00
Peter Krempa
90139a6236 qemu: monitor: Produce better errors on monitor hangup
Change the monitor error code to add the ability to access the qemu log
file using a file descriptor so that we can dig in it for a more useful
error message. The error is now logged on monitor hangups and overwrites
a possible lesser error. A hangup on the monitor usualy means that qemu
has crashed and there's a significant chance it produced a useful error
message.

The functionality will be latent until the next patch.
2013-09-25 13:50:56 +02:00
Peter Krempa
8519e9ecdc qemu: monitor: Add infrastructure to access VM logs for better err msgs
Early VM startup errors usually produce a better error message in the
machine log file. Currently we were accessing it only when the process
exited during certain phases of startup. This will help adding a more
comprehensive error extraction for early qemu startup phases.

This patch adds infrastructure to keep a file descriptor for the machine
log file that will be used in case an error happens.
2013-09-25 13:50:56 +02:00
Peter Krempa
310651a5e3 qemu_process: Make qemuProcessReadLog() more versatile and reusable
Teach the function to skip character device definitions printed by qemu
at startup in addition to libvirt log messages and make it usable from
outside of qemu_process.c. Also add documentation about the func.
2013-09-25 13:50:56 +02:00
Daniel P. Berrange
cba4868ad8 Check return value of virDomainControllerInsert when parsing QEMU args
The parsing of '-usb' did not check for failure of the
virDomainControllerInsert method. As a result on OOM, the
parser mistakenly attached USB disks to the IDE controller.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-24 16:58:32 +01:00
Daniel P. Berrange
b81f30566b Honour error returned by virBitmapFormat
The code formatting NUMA args was ignoring the return value
of virBitmapFormat, so on OOM, it would silently drop the
NUMA cpumask arg.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-24 16:58:27 +01:00
Daniel P. Berrange
a4b0c75ce8 Add missing check for OOM when building boot menu args
When building boot menu args, if OOM occurred the CLI args
would end up containing  'order=(null)' due to a missing
call to 'virBufferError'.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-24 16:58:23 +01:00
Daniel P. Berrange
de87497fd1 Fix format specifier for OOM test fprintfs
The testutils.c file had some fprintfs which had not been
converted from %d to %zu, when 'testCounter' change to be
a size_t. This was a build breaker if --enable-test-oom
was enabled

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-24 16:56:53 +01:00
Eric Blake
21114ce9c2 maint: update to latest gnulib
Since we're about to freeze, it's time to pick up the latest
upstream gnulib.  Among other changes, gnulib now guarantees the
use of some -f flags that we were previously manually adding.

* .gnulib: Update to latest, in part for warning improvements.
* m4/virt-compile-warnings.m4 (LIBVIRT_COMPILE_WARNINGS): Drop
flags that are now guaranteed by gnulib.
* bootstrap: Resync to gnulib.

Signed-off-by: Eric Blake <eblake@redhat.com>
2013-09-24 06:53:07 -06:00
Claudio Bley
9f219dca48 Always open files in binary mode in virFDStreamOpenFileInternal
On win32, using text mode for binary files might result in short
reads since ASCII character 0x1A is interpreted as EOF. Also, it
could lead to problems using the seek functions because of the \r
handling.

Signed-off-by: Claudio Bley <cbley@av-test.de>
2013-09-24 14:27:41 +02:00
Claudio Bley
291edf708b test: fix call to virFDStreamOpenFile in testDomainScreenshot
N.B.  This had no ill effects as long as O_RDONLY is defined to
      to be 0, such that the expression (O_RDONLY < 0) yielded 0
      again.

Signed-off-by: Claudio Bley <cbley@av-test.de>
2013-09-24 14:27:41 +02:00
Daniel P. Berrange
6912cf4faa Don't ignore allocation failure in virCommandAddEnvPassCommon
The virCommandAddEnvPassCommon method ignored the failure to
pre-allocate the env variable array with VIR_RESIZE_N. While
this is harmless, it confuses the test harness which is trying
to validate OOM handling of every individual allocation call.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-24 10:52:58 +01:00
Daniel P. Berrange
ecd2ba6893 Fix reporting of errors in OOM injection code
When the various viralloc.c functions were changed to use the
normal error reporting code, the OOM injection code paths
were not updated to report errors.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-24 10:52:26 +01:00
Daniel P. Berrange
5dd3b5e32a Fix missing OOM check in qemuParseCommandLine when splitting strings
The qemuParseCommandLine method did not check the return value of
virStringSplit to see if OOM had occurred. This lead to dereference
of a NULL pointer on OOM.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-24 10:52:26 +01:00
Daniel P. Berrange
5923ea67b1 Fix error checking of qemuParseKeywords return status
Most callers of qemuParseKeywords were assigning its return
value to a 'size_t' variable. Then then also checked '< 0'
for error condition, but this will never be true with the
unsigned size_t variable. Rather than using 'ssize_t', change
qemuParseKeywords so that the element count is returned via
an output parameter, leaving the return value solely as an
error indicator.

This avoids a crash accessing beyond the end of an error
upon OOM.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-24 10:52:26 +01:00
Daniel P. Berrange
150c1db52b Fix allocation of arglist in qemuStringToArgvEnv
In

  commit 41b5505679
  Author: Eric Blake <eblake@redhat.com>
  Date:   Wed Aug 28 15:01:23 2013 -0600

    qemu: simplify list cleanup

The qemuStringToArgvEnv method was changed to use virStringFreeList
to free the 'arglist' array. This method assumes the string list
array is NULL terminated, however, qemuStringToArgvEnv was not
ensuring this when populating 'arglist'. This caused an out of
bounds access by virStringFreeList when OOM occured in the initial
loop of qemuStringToArgvEnv

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-24 10:52:26 +01:00
Daniel P. Berrange
0bea528a33 Fix crash on OOM in qemuAddRBDHost
When parsing the RBD hosts, it increments the 'nhosts' counter
before increasing the 'hosts' array allocation. If an OOM then
occurs when increasing the array allocation, the cleanup block
will attempt to access beyond the end of the array. Switch
to using VIR_EXPAND_N instead of VIR_REALLOC_N to protect against
this mistake

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-24 10:52:26 +01:00
Daniel P. Berrange
ba19783d9b Fix crash on OOM in qemuDomainCCWAddressSetCreate()
If OOM occurs in qemuDomainCCWAddressSetCreate, it jumps to
a cleanup block and frees the partially initialized object.
It then mistakenly returns the address of the just free'd
pointer instead of NULL.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-24 10:52:21 +01:00
Daniel P. Berrange
f27490b705 Fix crash if OOM occurs when creating virConnectPtr
If a OOM error occurs in virGetConnect, this may cause the
virConnectDispose method to de-reference a NULL pointer,
since the close callback will not have been initialized.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-24 10:51:28 +01:00
Daniel P. Berrange
182d5ed331 Fix crash on OOM in parsing CPU mask in domain XML
The virDomainDefParseXML method did not check the return value
of the virBitmapNew API call for NULL. This lead to a crash on
OOM

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-24 10:51:28 +01:00
Daniel P. Berrange
a50de5d827 Fix crash on OOM when parsing disk security label
If an OOM error occurs in virSecurityDeviceLabelDefParseXML the
cleanup code may free an uninitialized pointer, causing a crash

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-24 10:51:28 +01:00
lawrancejing
e9f5f2e749 conf: Fix virNetworkAssignDef's comment. 2013-09-24 17:02:19 +08:00
Daniel P. Berrange
6fdafe278d Add test case for virNetServerClient object identity code
Start a test case for the virNetServerClient object, which
initially checks the creation of a virIdentityPtr object.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-24 09:37:26 +01:00
Daniel P. Berrange
199679585b Add a virNetSocketNewConnectSockFD method
To allow creation of a virNetSocketPtr instance from a pre-opened
socketpair FD, add a virNetSocketNewConnectSockFD method.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-24 09:37:26 +01:00
Giuseppe Scrivano
de51dc9c9a python: add bindings for virConnectGetCPUModelNames
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
2013-09-23 16:59:39 -06:00
Giuseppe Scrivano
ea45b23cfc virsh: add function to get the CPU models for an arch
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
2013-09-23 16:42:10 -06:00
Giuseppe Scrivano
dda4548c7b virConnectGetCPUModelNames: add the support for the test protocol
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
2013-09-23 16:40:30 -06:00
Giuseppe Scrivano
cbcecd7ab1 virConnectGetCPUModelNames: add the support for qemu
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
2013-09-23 15:52:14 -06:00
Giuseppe Scrivano
fd69544965 virConnectGetCPUModelNames: implement the remote protocol
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
2013-09-23 15:50:35 -06:00
Giuseppe Scrivano
36cc09420a cpu: add function to get the models for an arch
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
2013-09-23 15:50:30 -06:00
Giuseppe Scrivano
f90857b32a libvirt: add new public API virConnectGetCPUModelNames
The new function virConnectGetCPUModelNames allows to retrieve the list
of CPU models known by the hypervisor for a specific architecture.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
2013-09-23 15:41:50 -06:00
Eric Blake
b0d9207bc6 build: ensure 'make check' sees up-to-date config.h
Nehal J. Wani reported on IRC a rather interesting build failure:

In file included from util/virnetdevbridge.c:53:0:
/usr/include/linux/in6.h:30:8: error: redefinition of 'struct in6_addr'
 struct in6_addr {
        ^

I traced it to the fact that he ran 'git pull; make check' across
commit e62e0094.  What happened is that the configure changes
result in a new variable that was set to be defined on his system,
but config.h was not regenerated to contain the value of that
variable.  Running 'make' instead of 'make check' cleaned up the
problem.  A bit more investigation, and I see that in Makefile.am,
automake sticks rules that rebuild config.h as part of 'make all',
and that we also had a dependency 'check-local: all'; BUT the
rule for check-local is run only at the point when the top-level
directory is visited.  Automake documents that SUBDIRS should
contain an explicit '.' at the point the top-level should be
visited (defaulting to last, if it doesn't appear).  Sure enough,
with this patch, 'make check' now does the top-level 'all' rules,
which regenerates 'config.h' BEFORE compiling any code that might
depend on changed content of that file.

* Makefile.am (SUBDIRS): Put '.' first, not last.

Signed-off-by: Eric Blake <eblake@redhat.com>
2013-09-23 15:18:24 -06:00
Daniel P. Berrange
e4697b92ab Fix typo in identity code which is pre-requisite for CVE-2013-4311
The fix for CVE-2013-4311 had a pre-requisite enhancement
to the identity code

  commit db7a5688c0
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Thu Aug 22 16:00:01 2013 +0100

    Also store user & group ID values in virIdentity

This had a typo which caused the group ID to overwrite the
user ID string. This meant any checks using this would have
the wrong ID value. This only affected the ACL code, not the
initial polkit auth. It also leaked memory.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-23 14:07:55 -06:00
Jiri Denemark
0543e0d212 docs: Load libvirt_access*.xml from build dir
The xml files are generated in build directory and thus docs/newapi.xsl
was not able to find them in a VPATH build.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2013-09-23 14:16:45 +02:00
Chen Hanxiao
9a08e2cbc6 LXC: Check the existence of dir before resolving symlinks
If a dir does not exist, raise an immediate error in logs
rather than letting virFileResolveAllLinks fail, since this
gives better error reporting to the user.

Signed-off-by: Chen Hanxiao <chenhanxiao@cn.fujitsu.com>
2013-09-23 11:22:17 +01:00
Chen Hanxiao
0e618c6aff LXC: follow the unit style of /proc/meminfo
When FUSE is enabled, the LXC container is setup with
a custom /proc/meminfo file. This file uses "KB" as a
suffix, rather than "kB" which is the kernel's style.
Fix this inconsistency to avoid confusing apps.

Signed-off-by: Chen Hanxiao <chenhanxiao@cn.fujitsu.com>
2013-09-23 11:01:07 +01:00
Peter Krempa
5702c014b2 conf: Do better job when comparing features ABI compatibility
The ABI compatibility check for domain features didn't check the
expanded HyperV and APIC EOI values, thus possibly allowing change in
guest ABI.

Add the check and use typecasted switch statement to warn developers
when adding a new HyperV feature.
2013-09-22 19:24:38 +02:00
Daniel P. Berrange
49a5262d2f Fix potential use of uninitialized value in virDomainGetVcpuPinInfo
The virDomainGetVcpuPinInfo python wrapper had a potential use of
uninitialized values

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-09-20 17:22:39 +01:00