Commit Graph

31884 Commits

Author SHA1 Message Date
Daniel P. Berrangé
5f1e6a7d48 util: create private chains for virtual network firewall rules
Historically firewall rules for virtual networks were added straight
into the base chains. This works but has a number of bugs and design
limitations:

  - It is inflexible for admins wanting to add extra rules ahead
    of libvirt's rules, via hook scripts.

  - It is not clear to the admin that the rules were created by
    libvirt

  - Each rule must be deleted by libvirt individually since they
    are all directly in the builtin chains

  - The ordering of rules in the forward chain is incorrect
    when multiple networks are created, allowing traffic to
    mistakenly flow between networks in one direction.

To address all of these problems, libvirt needs to move to creating
rules in its own private chains. In the top level builtin chains,
libvirt will add links to its own private top level chains.

Addressing the traffic ordering bug requires some extra steps. With
everything going into the FORWARD chain there was interleaving of rules
for outbound traffic and inbound traffic for each network:

  -A FORWARD -d 192.168.3.0/24 -o virbr1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  -A FORWARD -s 192.168.3.0/24 -i virbr1 -j ACCEPT
  -A FORWARD -i virbr1 -o virbr1 -j ACCEPT
  -A FORWARD -o virbr1 -j REJECT --reject-with icmp-port-unreachable
  -A FORWARD -i virbr1 -j REJECT --reject-with icmp-port-unreachable
  -A FORWARD -d 192.168.2.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  -A FORWARD -s 192.168.2.0/24 -i virbr0 -j ACCEPT
  -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
  -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
  -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable

The rule allowing outbound traffic from virbr1 would mistakenly
allow packets from virbr1 to virbr0, before the rule denying input
to virbr0 gets a chance to run.

What we really need todo is group the forwarding rules into three
distinct sets:

 * Cross rules - LIBVIRT_FWX

  -A FORWARD -i virbr1 -o virbr1 -j ACCEPT
  -A FORWARD -i virbr0 -o virbr0 -j ACCEPT

 * Incoming rules - LIBVIRT_FWI

  -A FORWARD -d 192.168.3.0/24 -o virbr1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  -A FORWARD -o virbr1 -j REJECT --reject-with icmp-port-unreachable
  -A FORWARD -d 192.168.2.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable

 * Outgoing rules - LIBVIRT_FWO

  -A FORWARD -s 192.168.3.0/24 -i virbr1 -j ACCEPT
  -A FORWARD -i virbr1 -j REJECT --reject-with icmp-port-unreachable
  -A FORWARD -s 192.168.2.0/24 -i virbr0 -j ACCEPT
  -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable

There is thus no risk of outgoing rules for one network mistakenly
allowing incoming traffic for another network, as all incoming rules
are evalated first.

With this in mind, we'll thus need three distinct chains linked from
the FORWARD chain, so we end up with:

        INPUT --> LIBVIRT_INP   (filter)

       OUTPUT --> LIBVIRT_OUT   (filter)

      FORWARD +-> LIBVIRT_FWX   (filter)
              +-> LIBVIRT_FWO
              \-> LIBVIRT_FWI

  POSTROUTING --> LIBVIRT_PRT   (nat & mangle)

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2019-01-29 13:35:58 +00:00
Daniel P. Berrangé
b092a4357d util: pass layer into firewall query callback
Some of the query callbacks want to know the firewall layer that was
being used for triggering the query to avoid duplicating that data.

Reviewed-by: Laine Stump <laine@laine.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2019-01-29 13:35:58 +00:00
Daniel P. Berrangé
0fc746aa54 network: add platform driver callbacks around firewall reload
Allow the platform driver impls to run logic before and after the
firewall reload process.

Reviewed-by: Laine Stump <laine@laine.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2019-01-29 13:35:58 +00:00
Peter Krempa
f04bdf5368 qemu: Don't double-free disk->mirror if block commit initialization fails
disk->mirror would not be cleared while the local pointer was freed in
qemuDomainBlockCommit if qemuDomainObjExitMonitor or qemuBlockJobDiskNew
would return a failure.

Since block job handling is executed in the separate handler which needs
a qemu job, we don't need to pre-set the mirror state prior to starting
the job. Similarly the block copy job does not do that.

Move the setting of the data after starting the job so that we avoid
this problem.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2019-01-29 13:41:16 +01:00
Peter Krempa
06fa3366c6 qemu: Clear block copy mirror state explicitly
While this should not be necessary as we clear it in the event handler,
let's be sure and clear it prior to starting the job.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2019-01-29 13:41:16 +01:00
Peter Krempa
c6db273082 qemu: blockjob: Mark job as started only when it's new
Switching a block job to some states (e.g. QEMU_BLOCKJOB_STATE_READY)
might not require a job, thus if it will become ready asynchronously we
should not overwrite the state any more.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2019-01-29 13:41:16 +01:00
Peter Krempa
8d5df64449 qemu: blockjob: Make sure that internal states are not reported as event
While the callers should make sure that they don't call
qemuBlockJobEmitEvents for any internal state or job, let's add checks
that prevents us from emitting wrong events altogether.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2019-01-29 13:41:16 +01:00
Peter Krempa
3355edd6f0 lib: Fix docs generated for enum virDomainBlockJobType
Mixing documentation strings trailing the enum value and preceeding the
enum value ends in a big mixup. Fix docs string for
VIR_DOMAIN_BLOCK_JOB_TYPE_UNKNOWN so that it's not squished together
with the next one.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2019-01-29 13:41:16 +01:00
Michal Privoznik
6dd2a2ae63 virfile: Detect ceph as shared FS
https://bugzilla.redhat.com/show_bug.cgi?id=1665553

Ceph can be mounted just like any other filesystem and in fact is
a shared and cluster filesystem. The filesystem magic constant
was taken from kernel sources as it is not in magic.h yet.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2019-01-28 14:56:21 +01:00
Michal Privoznik
5772885d28 lib: Use more of VIR_STEAL_PTR()
We have this very handy macro called VIR_STEAL_PTR() which steals
one pointer into the other and sets the other to NULL. The
following coccinelle patch was used to create this commit:

  @ rule1 @
  identifier a, b;
  @@

  - b = a;
    ...
  - a = NULL;
  + VIR_STEAL_PTR(b, a);

Some places were clean up afterwards to make syntax-check happy
(e.g. some curly braces were removed where the body become a one
liner).

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2019-01-28 14:46:58 +01:00
Roman Bogorodskiy
7c700108d6 news: document bhyve custom commandline support
Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2019-01-27 15:07:18 +04:00
Roman Bogorodskiy
0ffe70a929 docs: bhyve: document commandline element
Document the <bhyve:commandline> element which allows
to inject custom command line arguments for bhyve.

Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2019-01-27 15:07:11 +04:00
Roman Bogorodskiy
0c8df11071 bhyve: implement support for commandline args
Implement support for passing custom command line arguments
to bhyve using the 'bhyve:commandline' element:

  <bhyve:commandline>
    <bhyve:arg value='-newarg'/>
  </bhyve:commandline>

 * Define virDomainXMLNamespace for the bhyve driver, which
   at this point supports only the 'commandline' element
   described above,
 * Update command generation code to inject these command line
   arguments between driver-generated arguments and the vmname
   positional argument.

Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2019-01-27 14:54:52 +04:00
Laine Stump
001495909b docs: add forgotten mentions of forward mode "open"
A couple places in the docs didn't get updated when the forward mode
"open" was added.

Signed-off-by: Laine Stump <laine@laine.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2019-01-25 11:04:29 -05:00
Laine Stump
43be65a481 network: remove stale function
networkMigrateStateFiles was added nearly 5 years ago when the network
state directory was moved from /var/lib/libvirt to /var/run/libvirt
just prior to libvirt-1.2.4). It was only required to maintain proper
state information for networks that were active during an upgrade that
didn't involve rebooting the host. At this point the likelyhood of
anyone upgrading their libvirt from pre-1.2.4 directly to 5.0.0 or
later *without rebooting the host* is probably so close to 0 that no
properly informed bookie would take *any* odds on it happening, so it
seems appropriate to remove this pointless code.

Signed-off-by: Laine Stump <laine@laine.org>
Reviewed-by: Andrea Bolognani <abologna@redhat.com>
2019-01-25 11:01:05 -05:00
Eric Blake
484370dcf1 virjson: add convenience wrapper for appending string to array
Upcoming patches need an array of strings for use in QMP
block-dirty-bitmap-merge.  A convenience wrapper cuts down
on the verbosity of creating the array, similar to the
existing virJSONValueObjectAppendString().

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-01-25 09:21:24 -06:00
Eric Blake
4ea5a41e16 virjson: always raise vir error on append failures
A function that returns -1 for multiple possible failures, but only
raises a libvirt error for some of those failures, can be hard to
use correctly. Yet both of our JSON object/array appenders fall in
that pattern.  True, the silent errors represent coding bugs that
none of the callers should ever trigger, while the noisy errors
represent memory failures that can happen anywhere, so we happened
to never end up failing without an error. But it is better to
either use the _QUIET memory allocation variants, and make callers
decide to report failure; or make all failure paths noisy. This
patch takes the latter approach.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-01-25 09:21:24 -06:00
Michal Privoznik
2707d4f8bc tools: Document completer callback
Strictly speaking, this should go near vshCompleter typedef
declaration. However, I find it more useful near actual completer
implementations.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2019-01-25 15:44:36 +01:00
Ján Tomko
49ec5769c9 qemuBuildControllersCommandLine: use i instead of j as the counter
Now that the nested loop is gone.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-01-25 14:58:43 +01:00
Ján Tomko
a6d3357c8b rename qemuBuildControllerDevCommandLine
Use qemuBuildControllersCommandLine since it builds the command line
for (nearly) all controllers, not just one.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-01-25 14:58:43 +01:00
Ján Tomko
fc1c16bccd qemuBuildControllersByTypeCommandLine: free devstr in the cleanup
section

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-01-25 14:58:43 +01:00
Ján Tomko
c7e03df8c0 qemu: format CCID controllers after USB hubs
Since they go on the USB bus, format them after USB hubs.

https://bugzilla.redhat.com/show_bug.cgi?id=1375402

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-01-25 14:58:35 +01:00
Ján Tomko
421e0eeec7 qemu: Introduce qemuBuildControllersByTypeCommandLine
Now that the inner loop does not require any other variables,
it can be easily separated. Apart from reducing the indentation
level this will allow it to be called from different code paths.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-01-25 14:54:51 +01:00
Ján Tomko
75ecfd2521 qemuBuildControllerDevStr: remove nusbcontroller argument
Now that it's no longer needed, remove the argument.
This removes the last helper variable in
qemuBuildControllerDevCommandLine.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-01-25 14:54:51 +01:00
Ján Tomko
8f5e50e003 qemu: separate counting of USB controllers
qemuBuildLegacyUSBControllerCommandLine is the only place where
we need to count the USB controllers.

Count them again instead of keeping track in a variable passed to
qemuBuildControllerDevStr.

This removes the need for another variable in the loop in
qemuBuildControllerDevCommandLine.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-01-25 14:54:51 +01:00
Ján Tomko
dab3d5d350 qemu: separate counting of legacy USB controllers
Count them in qemuBuildLegacyUSBControllerCommandLine to remove
yet another variable accessed from the loop in
qemuBuildControllerDevCommandLine.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-01-25 14:54:51 +01:00
Ján Tomko
95049d7054 Add qemuBuildDomainForbidLegacyUSBController
Shorten some long conditions.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-01-25 14:54:50 +01:00
Ján Tomko
79c7cbaf46 qemu: exit early if USB_CONTROLLER_MODEL_NONE is present
This removes the need to mark it in the 'usbcontroller' variable.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-01-25 14:54:50 +01:00
Ján Tomko
a98c0a2fef qemu: move out legacy USB controller formatting
Move out the code formatting "-usb" on the QEMU command line.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-01-25 14:54:50 +01:00
Ján Tomko
c2a8256991 virPortAllocatorSetUsed: ignore port 0
Similar to what commit 86dba8f3 did for virPortAllocatorRelease,
ignore port 0 in virPortAllocatorSetUsed.

For all the reasonable use cases the callers already check that
the port is non-zero, however if the port from the XML overflows
unsigned short and turns into 0, it can be set as used by
virPortAllocatorSetUsed but not released by virPortAllocatorRelease.

Also skip port '0' in virPortAllocatorSetUsed to make this behavior
symmetric.

The serenity was disturbed by commit 5dbda5e9 which started using
virPortAllocatorRelease instead of virPortAllocatorSetUsed (false).

https://bugzilla.redhat.com/show_bug.cgi?id=1591645

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-01-25 14:50:05 +01:00
Thomas Huth
872b15dea6 docs/governance: Clarify the version number of the LGPL
There is no "GNU Lesser General Public License, version 2",
only version 2.1 and later. In "version 2", the license was
still called "Library" instead of "Lesser". So assume that
version 2.1 is meant here.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2019-01-25 14:04:20 +01:00
Thomas Huth
803a73980a tools/virt-xml-validate: Fix GPL information
The tools/virt-xml-validate.in file is licensed under the terms of
the GPL, but then says "You should have received a copy of the
GNU *Lesser* General Public License". Thus scratch the "Lesser" here.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2019-01-25 14:04:19 +01:00
Thomas Huth
70d9c1a768 bootstrap.conf: Fix LGPL information
The bootstrap.conf is licensed under the terms of the LGPL, but then
suggests to "See the GNU General Public License for more details".
That should be the "GNU Lesser General Public License" instead, of
course.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2019-01-25 14:04:19 +01:00
Cole Robinson
429f5454d5 qemu: command: Make BuildVirtioDevStr more generic
Switch qemuBuildVirtioDevStr to use virDomainDeviceSetData: callers
pass in the virDomainDeviceType and the void * DefPtr. This will
save us from having to repeatedly extend the function argument
list in subsequent patches.

Reviewed-by: Andrea Bolognani <abologna@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-01-24 18:59:38 -05:00
Cole Robinson
4a4c418110 conf: Add virDomainDeviceSetData
This is essentially a wrapper for easily setting the variable
name in virDomainDeviceDef that matches its associated
VIR_DOMAIN_DEVICE_TYPE.

Reviewed-by: Andrea Bolognani <abologna@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-01-24 18:59:38 -05:00
Cole Robinson
028f9a6886 qemu: command: Convert vhost-{vsock,scsi} to qemuBuildVirtioDevStr
Current code essentially duplicates the same logic, but misses
some cases (like vhost-vsock-device).

Reviewed-by: Andrea Bolognani <abologna@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-01-24 18:59:38 -05:00
Cole Robinson
5ac9889a69 qemu: command: Make vhost-scsi device string depend on address
The vhost-scsi device string should depend on the requested
address type, not strictly on the emulated arch. This is the
same logic used by qemuBuildVirtioDevStr, and this particular
path is already tested in the hostdev-scsi-vhost-scsi-ccw tests

Reviewed-by: Andrea Bolognani <abologna@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-01-24 18:59:38 -05:00
Cole Robinson
0ba9786d8a qemu: Move <rng> validation out of qemu_command.c
Move the rng->model == VIRTIO check to parse time. This also
allows us to remove similar checks throughout the qemu driver

Reviewed-by: Andrea Bolognani <abologna@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-01-24 18:59:38 -05:00
Cole Robinson
6427bfc8b3 qemu: Move <memballoon> validation out of qemu_command.c
If we validate that memballoon is NONE|VIRTIO at parse time,
we can drop similar checks elsewhere in the qemu driver

Reviewed-by: Andrea Bolognani <abologna@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-01-24 18:59:38 -05:00
Cole Robinson
ea72bc65df conf: Add virDomainNetIsVirtioModel
This will be extended in the future, so let's simplify things by
centralizing the checks.

Reviewed-by: Andrea Bolognani <abologna@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-01-24 18:59:38 -05:00
Cole Robinson
cf09ef6cda conf: Set net->model earlier
So later code can more easily access def->model

Reviewed-by: Andrea Bolognani <abologna@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-01-24 18:59:38 -05:00
John Ferlan
6bf28f3860 docs: Add more iscsi-direct references to storage pages
Found that it was missing in formatstorage and had a few typos
in the storage driver page.

Signed-off-by: John Ferlan <jferlan@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-01-24 18:07:33 -05:00
Cheng Lin
d2edbec2bf conf: Add check to avoid a NULL compare for SysfsPath
If the two sysfs_path are both NULL, there may be an incorrect
object returned for virNodeDeviceObjListFindBySysfsPath().

This check exists in old interface virNodeDeviceFindBySysfsPath().
e.g.
virNodeDeviceFindBySysfsPath(virNodeDeviceObjListPtr devs,
                             const char *sysfs_path)
{
    ...
        if ((devs->objs[i]->def->sysfs_path != NULL) &&
            (STREQ(devs->objs[i]->def->sysfs_path, sysfs_path))) {
    ...
}

Reviewed-by: Cole Robinson <crobinso@redhat.com>
Signed-off-by: Cheng Lin <cheng.lin130@zte.com.cn>
2019-01-24 17:31:32 -05:00
Michal Privoznik
ca768886d8 domain_conf: Free egl render node in virDomainGraphicsDefFree
13 bytes in 1 blocks are definitely lost in loss record 44 of 179
    at 0x4C2EE6F: malloc (vg_replace_malloc.c:299)
    by 0x9514A69: strdup (in /lib64/libc-2.27.so)
    by 0x5E60C0B: virStrdup (virstring.c:956)
    by 0x54C856F: virHostGetDRMRenderNode (qemuxml2argvmock.c:190)
    by 0x57CB4E3: qemuProcessGraphicsSetupRenderNode (qemu_process.c:4860)
    by 0x57CB571: qemuProcessSetupGraphics (qemu_process.c:4881)
    by 0x57CE01B: qemuProcessPrepareDomain (qemu_process.c:6040)
    by 0x57D102E: qemuProcessCreatePretendCmd (qemu_process.c:6975)
    by 0x114C1C: testCompareXMLToArgv (qemuxml2argvtest.c:611)
    by 0x134B90: virTestRun (testutils.c:174)
    by 0x123478: mymain (qemuxml2argvtest.c:1697)
    by 0x136BFA: virTestMain (testutils.c:1112)

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2019-01-24 10:11:52 +01:00
Michal Privoznik
f2476cac74 virpci: Fix memleak in virPCIDeviceIterDevices
This partially reverts 00dc991ca1.

 2,030 (1,456 direct, 574 indirect) bytes in 14 blocks are definitely lost in loss record 77 of 80
    at 0x4C30E96: calloc (vg_replace_malloc.c:711)
    by 0x50F83AA: virAlloc (viralloc.c:143)
    by 0x5178DFA: virPCIDeviceNew (virpci.c:1753)
    by 0x51753E9: virPCIDeviceIterDevices (virpci.c:468)
    by 0x5175EB5: virPCIDeviceGetParent (virpci.c:759)
    by 0x517AB55: virPCIDeviceIsBehindSwitchLackingACS (virpci.c:2476)
    by 0x517AC24: virPCIDeviceIsAssignable (virpci.c:2494)
    by 0x10BF27: testVirPCIDeviceIsAssignable (virpcitest.c:229)
    by 0x10D14C: virTestRun (testutils.c:174)
    by 0x10C535: mymain (virpcitest.c:422)
    by 0x10F1B6: virTestMain (testutils.c:1112)
    by 0x10CF93: main (virpcitest.c:455)

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2019-01-24 10:11:27 +01:00
Michal Privoznik
6a8c174902 virPCIGetNetName: Initialize @netname to NULL
This is a return argument that is to be compared against NULL on
successful return. However, it is not initialized and therefore
relies on callers setting it to NULL prior calling the function.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2019-01-24 10:02:31 +01:00
Eric Blake
7b6116fb89 qemu: improve compile-time check of qemuBlockjobState mapping
Asserting the value we set four lines earlier in qemuBlockjobState
doesn't buy us any safety (if the public header adds a value, we end
up skipping that value without the compiler warning us of our gap);
what we really want is to assert that the value auto-assigned by the
compiler matches the actual last value in the public headers (as was
done below for qemuBlockJobType).  Add useful comments while at it.

Signed-off-by: Eric Blake <eblake@redhat.com>
ACKed-by: Peter Krempa <pkrempa@redhat.com>
2019-01-23 16:20:25 -06:00
Jim Fehlig
a3ab6d42d8 apparmor: convert libvirtd profile to a named profile
Signed-off-by: Jim Fehlig <jfehlig@suse.com>
2019-01-23 11:10:15 -07:00
Jim Fehlig
70c2933da2 apparmor: Add support for named profiles
Upstream apparmor is switching to named profiles. In short,

/usr/sbin/dnsmasq {

becomes

profile dnsmasq /usr/sbin/dnsmasq {

Consequently, any profiles that reference profiles in a peer= condition
need to be updated if the referenced profile switches to a named profile.
Apparmor commit 9ab45d81 switched dnsmasq to a named profile. ATM it is
the only named profile switch that has affected libvirt. Add rules to the
libvirtd profile to reference dnsmasq in peer= conditions by profile name.

Signed-off-by: Jim Fehlig <jfehlig@suse.com>
2019-01-23 11:10:15 -07:00
Jim Fehlig
11c8aca938 libxl: Set current memory value after successful balloon
The libxl driver does not set the new memory value in the active domain def
after a successful balloon. This results in the old memory value in
<currentMemory>. E.g.

virsh dumpxml test | grep currentMemory
  <currentMemory unit='KiB'>20971520</currentMemory>
virsh setmem test 16777216 --live
virsh dumpxml test | grep currentMemory
  <currentMemory unit='KiB'>20971520</currentMemory>

Set the new memory value in active domain def after a successful call to
libxl_set_memory_target().

Signed-off-by: Jim Fehlig <jfehlig@suse.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-01-23 10:50:05 -07:00