Commit Graph

34765 Commits

Author SHA1 Message Date
Cole Robinson
f57336358c storagefile: Don't access backingStoreRaw directly in FromBackingRelative
For the only usage, the rel == parent->backingStoreRaw, so drop
the direct access

Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 14:25:59 -04:00
Cole Robinson
556f7c68a0 storagefile: Fill in meta->externalDataStoreRaw
Call qcow2GetExtensions to actually fill in the virStorageSource
externalDataStoreRaw member

Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 14:25:59 -04:00
Cole Robinson
b50adb40b2 storagefile: Add externalDataStoreRaw member
Add the plumbing to track a qcow2 external data file path in
virStorageSource

Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 14:25:59 -04:00
Cole Robinson
9f0d364755 storagefile: Fix backing format \0 check
From qemu.git docs/interop/qcow2.txt

  == String header extensions ==

  Some header extensions (such as the backing file format name and
  the external data file name) are just a single string. In this case,
  the header extension length is the string length and the string is
  not '\0' terminated. (The header extension padding can make it look
  like a string is '\0' terminated, but neither is padding always
  necessary nor is there a guarantee that zero bytes are used
  for padding.)

So we shouldn't be checking for a \0 byte at the end of the backing
format section. I think in practice there always is a \0 but we
shouldn't depend on that.

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 14:25:53 -04:00
Cole Robinson
c87784be89 storagefile: Rename qcow2GetExtensions 'format' argument
To backingFormat, which makes it more clear. Move it to the end of
the argument list which will scale nicer with future patches

Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 13:41:22 -04:00
Cole Robinson
125dbad3af storagefile: Rename qcow2GetBackingStoreFormat
...to qcow2GetExtensions. We will extend it for more extension
parsing in future patches

Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 13:41:22 -04:00
Cole Robinson
16fffd8257 storagefile: Push extension_end calc to qcow2GetBackingStoreFormat
This is a step towards making this qcow2GetBackingStoreFormat into
a generic qcow2 extensions parser

Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 13:41:22 -04:00
Cole Robinson
bd6b4646c7 storagefile: Push 'start' into qcow2GetBackingStoreFormat
This is a step towards making this qcow2GetBackingStoreFormat into
a generic qcow2 extensions parser

Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 13:41:22 -04:00
Cole Robinson
242e7ac590 storagefile: Use qcowXGetBackingStore directly
The qcow1 and qcow2 variants are identical, so remove the wrappers

Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 13:41:22 -04:00
Cole Robinson
6017e7b3b8 storagefile: Drop now unused isQCow2 argument
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 13:41:21 -04:00
Cole Robinson
253f2cae4a storagefile: Check version to determine if qcow2 or not
Rather than require a boolean to be passed in

Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 13:41:21 -04:00
Cole Robinson
8699899692 storagefile: qcow1: Let qcowXGetBackingStore fill in format
Letting qcowXGetBackingStore fill in format gives the same behavior
we were opencoding in qcow1GetBackingStore

Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 13:41:21 -04:00
Cole Robinson
b00616870b storagefile: qcow1: Fix check for empty backing file
From f772b3d91f the intention of this code seems to be to set
format=NONE when the image does not have a backing file. However
'buf' here is the whole qcow1 file header. What we want to be
checking is 'res' which is the parsed backing file path.
qcowXGetBackingStore sets this to NULL when there's no backing file.

Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 13:41:21 -04:00
Cole Robinson
9f508ec7ca storagefile: qcow1: Check for BACKING_STORE_OK
Check explicitly for BACKING_STORE_OK and not its 0 value

Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 13:41:21 -04:00
Cole Robinson
285adba549 storagefile: Make GetMetadataInternal static
It is only used in virstoragefile.c

Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 13:41:21 -04:00
Daniel Henrique Barboza
65ec10e83f tests: add a test for driver.c:virConnectValidateURIPath()
Reviewed-by: Cole Robinson <crobinso@redhat.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2019-10-11 12:20:08 -04:00
Michal Privoznik
4e95cdcbb3 security: Don't remember labels for TPM
https://bugzilla.redhat.com/show_bug.cgi?id=1755803

The /dev/tpmN file can be opened only once, as implemented in
drivers/char/tpm/tpm-dev.c:tpm_open() from the kernel's tree. Any
other attempt to open the file fails. And since we're opening the
file ourselves and passing the FD to qemu we will not succeed
opening the file again when locking it for seclabel remembering.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 17:05:55 +02:00
Michal Privoznik
2b44cf8c32 security_dac: Allow selective remember/recall for chardevs
While in most cases we want to remember/recall label for a
chardev, there are some special ones (like /dev/tpm0) where we
don't want to remember the seclabel nor recall it. See next
commit for rationale behind.

While the easiest way to implement this would be to just add new
argument to virSecurityDACSetChardevLabel() this one is also a
callback for virSecurityManagerSetChardevLabel() and thus has
more or less stable set of arguments. Therefore, the current
virSecurityDACSetChardevLabel() is renamed to
virSecurityDACSetChardevLabelHelper() and the original function
is set to call the new one.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 17:05:41 +02:00
Michal Privoznik
1a84a1ced1 security: Try to lock only paths with remember == true
So far all items on the chown/setfilecon list have the same
.remember value.  But this will change shortly. Therefore, don't
try to lock paths which we won't manipulate XATTRs for.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 17:01:08 +02:00
Cole Robinson
4dfc4d525e security: apparmor: Allow RO /usr/share/edk2/
On Fedora, already whitelisted paths to AAVMF and OVMF binaries
are symlinks to binaries under /usr/share/edk2/. Add that directory
to the RO whitelist so virt-aa-helper-test passes

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-11 10:52:54 -04:00
Andrea Bolognani
4d95f557d6 tests: Add capabilities for QEMU 4.2.0 on aarch64
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
2019-10-11 09:37:33 +02:00
Andrea Bolognani
c5330fcefa tests: Add capabilities for QEMU 4.2.0 on ppc64
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
2019-10-11 09:37:25 +02:00
Marek Marczykowski-Górecki
668dc9fe8c libxl: add slic_table <-> acpi_firmware conversion
This isn't exactly equivalent setting (acpi_firmware may point to
non-SLIC ACPI table), but it's the most behavior preserving option.

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
2019-10-10 21:02:09 -06:00
Marek Marczykowski-Górecki
f2899e44d9 tests: libxl: ACPI slic table test
Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
2019-10-10 21:02:03 -06:00
Ivan Kardykov
03e98a52d2 libxl: add acpi slic table support
Libxl driver did not support setup additional acpi firmware to xen
guest. It is necessary to activate OEM Windows installs. This patch
allow to define in OS section acpi table param (which supported domain
common schema).

Signed-off-by: Ivan Kardykov <kardykov@tabit.pro>
[added info to docs/formatdomain.html.in]
Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
2019-10-10 21:01:54 -06:00
Daniel Henrique Barboza
37b565c000 src/driver.c: remove duplicated code in virGetConnect* functions
All the 6 virGetConnect* functions in driver.c shares the
same code base. This patch creates a new static function
virGetConnectGeneric() that contains the common code to
be used with all other virGetConnect*.

Reviewed-by: Cole Robinson <crobinso@redhat.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2019-10-10 13:51:18 -04:00
Daniel P. Berrangé
fd3b8fe7ad tests: delete objectlocking test code
The object locking test code is not run by any CI tests and has
bitrotted to the point where it isn't worth the effort to try to
fix it.

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2019-10-10 12:49:52 +01:00
Michal Privoznik
b626e652a6 qemu_process: Initialize domain definition for QMP query
When constructing QMP capabilities we allocate a dummy domain
object to pass to qemuMonitorOpen(). However, after 75dd595861
the function also expects domain definition to be allocated for
the domain object. The referenced commit already fixed
qemumonitortestutils.c but forgot to fix the other caller:
qemuProcessQMPConnectMonitor().

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2019-10-10 09:50:08 +02:00
Daniel Henrique Barboza
8958b47fab news: Update for the ccf-assist pSeries feature
Reviewed-by: Cole Robinson <crobinso@redhat.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2019-10-09 17:51:47 -04:00
Daniel Henrique Barboza
cab3ea2303 qemu: Implement the ccf-assist pSeries feature
This patch adds the implementation of the ccf-assist pSeries
feature, based on the QEMU_CAPS_MACHINE_PSERIES_CAP_CCF_ASSIST
capability that was added in the previous patch.

Reviewed-by: Cole Robinson <crobinso@redhat.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2019-10-09 17:51:47 -04:00
Daniel Henrique Barboza
86a8e5a84c qemu: Add capability for the ccf-assist pSeries feature
Linux kernel 5.1 added a new PPC KVM capability named
KVM_PPC_CPU_CHAR_BCCTR_FLUSH_ASSIST, which is exposed to the QEMU guest
since QEMU commit 8ff43ee404d under a new sPAPR capability called
SPAPR_CAP_CCF_ASSIST. This cap indicates whether the processor supports
hardware acceleration for the count cache flush workaround, which
is a software workaround that flushes the count cache on context
switch. If the processor has this hardware acceleration, the software
flush can be shortened, resulting in performance gain.

This hardware acceleration is defaulted to 'off' in QEMU. The reason
is that earlier versions of the Power 9 processor didn't support
it (it is available on Power 9 DD2.3 and newer), and defaulting this
option to 'on' would break migration compatibility between the Power 9
processor class.

However, the user running a P9 DD2.3+ hypervisor might want to create
guests with ccf-assist=on, accepting the downside of only being able
to migrate them only between other P9 DD2.3+ hosts running upstream
kernel 5.1+, to get a performance boost.

This patch adds this new capability to Libvirt, with the name of
QEMU_CAPS_MACHINE_PSERIES_CAP_CCF_ASSIST.

Reviewed-by: Cole Robinson <crobinso@redhat.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2019-10-09 17:45:09 -04:00
Jonathon Jongsma
fd03d0e692 qemu: add a new video device model 'ramfb'
This device is a very simple framebuffer device supported by qemu that
is mostly intended to use as a boot framebuffer in conjunction with a
vgpu. However, there is also a standalone ramfb device that can be used
as a primary display device and is useful for e.g. aarch64 guests where
different memory mappings between the host and guest can prevent use of
other devices with framebuffers such as virtio-vga.

https://bugzilla.redhat.com/show_bug.cgi?id=1679680 describes the
issues in more detail.

Reviewed-by: Cole Robinson <crobinso@redhat.com>
Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
2019-10-09 14:52:49 -04:00
Jonathon Jongsma
9bfcf0f62d qemu: add ramfb capability
Add a qemu capbility to see if the standalone ramfb device is available.

Reviewed-by: Cole Robinson <crobinso@redhat.com>
Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
2019-10-09 14:46:30 -04:00
Jonathon Jongsma
f2fd684849 qemu: validate bochs-display capability
When the bochs display type was added, the capability was never checked.
Add that check in the same place as the other video device capability
checks.

Reviewed-by: Cole Robinson <crobinso@redhat.com>
Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
2019-10-09 14:45:42 -04:00
Cole Robinson
3a15c47253 security: apparmor: Make storage_source_add_files recursively callable
This will simplify adding support for qcow2 external data_file

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-09 14:17:16 -04:00
Cole Robinson
b2b003db74 security: apparmor: Use only virStorageSource for disk paths
This is closer to what security_selinux.c does, and will help add
support for qcow2 external data_files

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-09 14:17:16 -04:00
Cole Robinson
c7eea3f559 security: apparmor: Push virStorageSource checks to add_file_path
This mirrors the code layout in security_selinux.c. It will also make
it easier to share the checks for qcow2 external data_file support
eventually

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-09 14:17:16 -04:00
Cole Robinson
7c0bf48bc9 security: apparmor: Pass virStorageSource to add_file_path
The virStorageSource must have everything it needs

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-09 14:17:16 -04:00
Cole Robinson
488fce1220 security: apparmor: Drop disk_foreach_iterator
There's only one caller, so open code the file_add_path behavior

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-09 14:17:16 -04:00
Cole Robinson
780f8c94ca security: apparmor: Remove unused ignoreOpenFailure
true is always passed here, so delete the unused code path and
adjust the associated comment

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-09 14:17:14 -04:00
Cole Robinson
cb757f9d32 conf: Move -virDomainDiskDefForeachPath to virt-aa-helper
It is the only user. Rename it to match the local style

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-10-09 14:16:53 -04:00
Daniel P. Berrangé
22d8e27ccd build: merge all syntax-check logic into one file
The gnulib syntax-check rules are spread across GNUmakefile, cfg.mk and
maint.mk. This made sense when we were getting two of the files from the
gnulib submodule. Now that we own all files though, we can at least
merge maint.mk and cfg.mk together. GNUmakefile can be eliminated when
we switch to meson.

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2019-10-09 13:36:54 +01:00
Daniel P. Berrangé
1b4217b995 build: delete all syntax check rules we're skipping
If we've marked rules as skipped, there's no sense keeping them in the
maint.mk file.

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2019-10-09 13:36:48 +01:00
Daniel P. Berrangé
2931761f27 build: remove all logic unrelated to syntax-check
The standard maint.mk from gnulib provides alot more than just the
'syntax-check' target. This can all be purged to give a more minimal
file.

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2019-10-09 13:36:46 +01:00
Daniel P. Berrangé
de744894bb build: move syntax-check code into build-aux directory
The syntax-check rules are the one bit of make usage that will
stay around for a while after the meson conversion. Move them
into the build-aux directory in preparation for refactoring
to make them independent from automake.

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2019-10-09 13:36:43 +01:00
Daniel P. Berrangé
56bd0665c7 build: import gnulib's syntax-check make rules
We're going to be eliminating autotools and gnulib, but we still wish to
have the 'make syntax-check' functionality.

This imports the minimal set of gnulib files required to keep this
working.

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2019-10-09 13:36:29 +01:00
Michal Privoznik
8e4aa7c560 Revert "qemu: Obtain reference on monConfig"
This reverts commit a5a777a8ba.

After previous commit the domain won't disappear while connecting
to monitor. There's no need to ref monitor config then.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2019-10-09 10:38:05 +02:00
Michal Privoznik
75dd595861 qemu: Fix @vm locking issue when connecting to the monitor
When connecting to qemu's monitor the @vm object is unlocked.
This is justified - connecting may take a long time and we don't
want to wait with the domain object locked. However, just before
the domain object is locked again, the monitor's FD is registered
in the event loop. Therefore, there is a small window where the
event loop has a chance to call a handler for an event that
occurred on the monitor FD but vm is not initalized properly just
yet (i.e. priv->mon is not set). For instance, if there's an
incoming migration, qemu creates its socket but then fails to
initialize (for various reasons, I'm reproducing this by using
hugepages but leaving the HP pool empty) then the following may
happen:

1) qemuConnectMonitor() unlocks @vm

2) qemuMonitorOpen() connects to the monitor socket and by
   calling qemuMonitorOpenInternal() which subsequently calls
   qemuMonitorRegister() the event handler is installed

3) qemu fails to initialize and exit()-s, which closes the
   monitor

4) The even loop sees EOF on the monitor and the control gets to
   qemuProcessEventHandler() which locks @vm and calls
   processMonitorEOFEvent() which then calls
   qemuMonitorLastError(priv->mon). But priv->mon is not set just
   yet.

5) qemuMonitorLastError() dereferences NULL pointer

The solution is to unlock the domain object for a shorter time
and most importantly, register event handler with domain object
locked so that any possible event processing is done only after
@vm's private data was properly initialized.

This issue is also mentioned in v4.2.0-99-ga5a777a8ba.

Since we are unlocking @vm and locking it back, another thread
might have destroyed the domain meanwhile. Therefore we have to
check if domain is still active, and we have to do it at the
same place where domain lock is acquired back, i.e. in
qemuMonitorOpen(). This creates a small problem for our test
suite which calls qemuMonitorOpen() directly and passes @vm which
has no definition. This makes virDomainObjIsActive() call crash.
Fortunately, allocating empty domain definition is sufficient.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2019-10-09 10:32:13 +02:00
Jiri Denemark
db873ab3bc qemu: Adapt to changed ppc64 CPU model names
QEMU 2.11 for ppc64 changed all CPU model names to lower case. Since
libvirt can't change the model names for compatibility reasons, we need
to translate the matching lower case models to the names known by
libvirt.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-10-09 09:53:41 +02:00
Jiri Denemark
b979ec355d Revert "domcaps: Treat host models as case-insensitive strings"
This reverts commit 2d8721e260.

This fix was both incomplete and too general. It only fixed domain
startup, but libvirt would still report empty list of supported CPU
models with recent QEMU for ppc64. On the other hand, while ppc64 QEMU
ignores case when looking up CPU model names, x86_64 QEMU does case
sensitive lookup. Without reverting this patch, libvirt could happily
accept CPU model names which are not supported by QEMU.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2019-10-09 09:53:41 +02:00