https://bugzilla.redhat.com/show_bug.cgi?id=1025108

So far qemuSetupHostdevCGroup was called very early during hotplug, even
before we knew the device we were about to hotplug was actually
available. By calling the function later, we make sure QEMU won't be
allowed to access devices used by other domains.

Another important effect of this change is that hopluging USB devices
specified by vendor and product (but not by their USB address) works
again. This was broken since v1.0.5-171-g7d763aca, when the call to
qemuFindHostdevUSBDevice was moved after the call to
qemuSetupHostdevCGroup, which then used an uninitialized USB address.

https://bugzilla.redhat.com/show_bug.cgi?id=1018267

The aim of virObject refing and urefing is to tell where the object is
to be used and when is no longer needed. Hence any object shouldn't be
used after it has been unrefed, as we might be the last to hold the
reference. The better way is to call virObjectUnref() *after* the last
object usage. In this specific case, the monitor EOF handler was called
after the qemuMonitorIO called virObjectUnref. Not only that @mon was
disposed (which is not used in the handler anyway) but the @mon->vm
which is causing a SIGSEGV:

2013-11-15 10:17:54.425+0000: 20110: error : qemuMonitorIO:688 : internal error: early end of file from monitor: possible problem:
qemu-kvm: -incoming tcp:01.01.01.0:49152: Failed to bind socket: Cannot assign requested address

Program received signal SIGSEGV, Segmentation fault.
qemuProcessHandleMonitorEOF (mon=<optimized out>, vm=0x7fb728004170) at qemu/qemu_process.c:299
299         if (priv->beingDestroyed) {
(gdb) p *priv
Cannot access memory at address 0x0
(gdb) p vm
$1 = (virDomainObj *) 0x7fb728004170
(gdb) p *vm
$2 = {parent = {parent = {magic = 3735928559, refs = 0, klass = 0xdeadbeef}, lock = {lock = {__data = {__lock = 2, __count = 0, __owner = 20110, __nusers = 1, __kind = 0, __spins = 0, __list = {__prev = 0x0,
            __next = 0x0}}, __size = "\002\000\000\000\000\000\000\000\216N\000\000\001", '\000' <repeats 26 times>, __align = 2}}}, pid = 0, state = {state = 0, reason = 0}, autostart = 0, persistent = 0,
  updated = 0, def = 0x0, newDef = 0x0, snapshots = 0x0, current_snapshot = 0x0, hasManagedSave = false, privateData = 0x0, privateDataFreeFunc = 0x0, taint = 304}
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>

In the qemuProcessReconnectHelper() a new thread that does all the
interesting work is spawned. The rationale is to not block the daemon
startup process in case of unresponsive qemu. However, the thread
handler is a local variable which gets lost once the control goes out of
scope. Hence the thread gets leaked. We can avoid this if the thread
isn't made joinable.
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>

The @list->callbacks is an array that is inflated whenever a new event
is added, e.g. via virDomainEventCallbackListAddID(). However, when we
are freeing the array, we free the items within it but forgot to
actually free it.
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>

These two chunks had to be part of df4283a5. But for some unclear
reason, the weren't. Anyway, these two variables are not used anywhere
within function. They're initialized to NULL and then VIR_FREE()-d. And
there's no reason do do two NOPs, right?
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>

Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>

While trying to compare netfs against my new gluster pool, I
discovered two things:

virt-xml-validate chokes on valid xml produced by 'virsh pool-dumpxml'
[yet another reason that ALL patches that add new xml should be adding
corresponding tests]

When using glusterfs FUSE mounts, you cannot access a subdirectory
of a gluster volume.  The recommended workaround in the gluster
community is to mount the volume to an intermediate location, then
bind-mount the desired subdirectory to the final location.  Maybe
we should teach libvirt to do bind-mounting, but for now I chose to
just document the limitation.

* docs/storage.html.in: Improve documentation.
* docs/schemas/storagepool.rng (sourcefmtnetfs): Allow all
formats, and drop redundant info-vendor.
* tests/storagepoolxml2xmltest.c (mymain): New test.
* tests/storagepoolxml2xmlin/pool-netfs-gluster.xml: New file.
* tests/storagepoolxml2xmlout/pool-netfs-gluster.xml: Likewise.
Signed-off-by: NEric Blake <eblake@redhat.com>

Before:

$ virsh secret-list
UUID                                 Usage
-----------------------------------------------------------
0a81f5b2-8403-7b23-c8d6-21ccc2f80d6f volume /var/lib/libvirt/images/puppyname.img
0a81f5b2-8403-7b23-c8d6-2deadbeefd6f Unused

After:

$ virsh secret-list
 UUID                                  Usage
--------------------------------------------------------------------------------
 0a81f5b2-8403-7b23-c8d6-21ccc2f80d6f  volume /var/lib/libvirt/images/puppyname.img
 0a81f5b2-8403-7b23-c8d6-2deadbeefd6f  Unused

Before:

$ virsh iface-list
Name                 State      MAC Address
--------------------------------------------
br0                  active     f0:de:f1:dc:b8:b0
virbr2               active     52:54:00:61:78:0c

After:

$ virsh iface-list
 Name                 State      MAC Address
---------------------------------------------------
 br0                  active     f0:de:f1:dc:b8:b0
 virbr2               active     52:54:00:61:78:0c

Before:
$ virsh nwfilter-list
UUID                                  Name
----------------------------------------------------------------
651d902c-165c-4bcc-8d73-41319af1e6bc  allow-arp
9ae11362-df6b-407f-8864-3bdf5125bf77  allow-dhcp
53b5a9ed-7d46-480f-a201-6d8a503d6533  allow-dhcp-server

After:
$ virsh nwfilter-list
 UUID                                  Name
------------------------------------------------------------------
 651d902c-165c-4bcc-8d73-41319af1e6bc  allow-arp
 9ae11362-df6b-407f-8864-3bdf5125bf77  allow-dhcp
 53b5a9ed-7d46-480f-a201-6d8a503d6533  allow-dhcp-server

Change the alignment to match the domain listing function.

Before:

$ virsh pool-list
Name                 State      Autostart
-----------------------------------------
boot-scratch         active     no
default              active     no
glusterpool          active     no

$ virsh pool-list --details
Name          State    Autostart  Persistent    Capacity  Allocation  Available
-------------------------------------------------------------------------------
boot-scratch  running  no         yes         117.99 GiB  101.40 GiB  16.60 GiB
default       running  no         yes         117.99 GiB  101.40 GiB  16.60 GiB
glusterpool   running  no         yes          29.40 GiB   44.23 MiB  29.36 GiB

After:

$ virsh pool-list
 Name                 State      Autostart
-------------------------------------------
 boot-scratch         active     no
 default              active     no
 glusterpool          active     no

$ virsh pool-list --details
 Name          State    Autostart  Persistent    Capacity  Allocation  Available
---------------------------------------------------------------------------------
 boot-scratch  running  no         yes         117.99 GiB  101.40 GiB  16.60 GiB
 default       running  no         yes         117.99 GiB  101.40 GiB  16.60 GiB
 glusterpool   running  no         yes          29.40 GiB   44.23 MiB  29.36 GiB

When opening a new connection to the driver, nwfilterOpen
only succeeds if the driverState has been allocated.

Move the privilege check in driver initialization before
the state allocation to disable the driver.

This changes the nwfilter-define error from:
error: cannot create config directory (null): Bad address
To:
this function is not supported by the connection driver:
virNWFilterDefineXML

https://bugzilla.redhat.com/show_bug.cgi?id=1029266

ifdef LIBXL_HAVE_DOMAIN_CREATE_RESTORE_PARAMS hides a multi-line body
for a brace-less else.  Add braces to ensure proper logic is applied.

Without this fix, new domains cannot be started.  Both
libxl_domain_create_new and libxl_domain_create_restore are called when
starting a new domain leading to this error:
libxl: error: libxl.c:324:libxl__domain_rename: domain with name "guest" already exists.
libxl: error: libxl_create.c:800:initiate_domain_create: cannot make domain: -6

The QOM path in qemu that contains the CPUID registers of a running VM
may not be present (introduced in QEMU 1.5).

Since commit d94b7817 we have a regression with QEMU that don't
support reporting of the CPUID register state via the monitor as the
process startup code expects the path to exist.

This patch adds code that checks with the monitor if the requested path
already exists and uses it only in this case.

To allow returning more granular errors, change the error type to an
integer.

There were two separate places with that were stringifying type of a
volume. One of the places was out of sync with types implemented
upstream.

To avoid such problems in the future, this patch adds a common function
to convert the type to string and reuses it across the two said places.

Add an extra space before the first column as we have when listing
domains.

Previous output:

$ virsh vol-list glusterpool
Name                 Path
-----------------------------------------
asdf                 gluster://gluster-node-1/gv0/asdf
c                    gluster://gluster-node-1/gv0/c
cd                   gluster://gluster-node-1/gv0/cd

$ virsh vol-list glusterpool --details
Name  Path                               Type     Capacity  Allocation
----------------------------------------------------------------------
asdf  gluster://gluster-node-1/gv0/asdf  unknown    0.00 B      0.00 B
c     gluster://gluster-node-1/gv0/c     unknown   16.00 B     16.00 B
cd    gluster://gluster-node-1/gv0/cd    unknown    0.00 B      0.00 B

New output:

$ virsh vol-list glusterpool
 Name                 Path
------------------------------------------------------------------------------
 asdf                 gluster://gluster-node-1/gv0/asdf
 c                    gluster://gluster-node-1/gv0/c
 cd                   gluster://gluster-node-1/gv0/cd

$ virsh vol-list glusterpool --details
 Name  Path                               Type     Capacity  Allocation
------------------------------------------------------------------------
 asdf  gluster://gluster-node-1/gv0/asdf  unknown    0.00 B      0.00 B
 c     gluster://gluster-node-1/gv0/c     unknown   16.00 B     16.00 B
 cd    gluster://gluster-node-1/gv0/cd    unknown    0.00 B      0.00 B

As of libvirt 1.1.1 and systemd 205, the cgroups layout used by
libvirt has some changes. Update the 'cgroups.html' file from
the website to describe how it works in a systemd world.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

If the host side of an LXC container console disconnected
and the guest side continued to write data, until the PTY
buffer filled up, the LXC controller would busy wait. It
would repeatedly see POLLHUP from poll() and not disable
the watch.

This was due to some bogus logic detecting blocking
conditions. Upon seeing a POLLHUP we must disable all
reading & writing from the PTY, and setup the epoll to
wake us up again when the connection comes back.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The 'none' machine type is something only intended for use
by libvirt probing capabilities. It isn't something that
is useful for running real VM instances. As such it should
not be exposed to users in the capabilities.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The virQEMUCapsProbeQMPMachineTypes method iterates over machine
types copying them into the qemuCapsPtr object. It only updates
the qemuCaps->nmachinetypes value at the end though. So if OOM
occurs in the middle, the destructor of qemuCapsPtr will not
free the partially initialized machine types.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

Now that the function is separate clean out a few ugly places and fix up
error messages.

The function destroys only the contents not the object itself thus it
should be called Clear.

To avoid code duplication between snapshot configuration code that
parses the disk source too we need to split out this code that will be
reused later on.

This patch tries to be code movement, some aspects of this function will
be refactored later.

If the managedsave image is corrupted, e.g. the XML part is, we fail to
parse it and throw an error, e.g.:

error: Failed to start domain jms8
error: XML error: missing security model when using multiple labels

This is okay, as we can't really start the machine and avoid undefined
qemu behaviour. On the other hand, the error message doesn't give a
clue to users what should they do. The consensus here would be to thrown
a warning to logs saying "Hey, you've got a corrupted file".
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>

s/repersents/represents
Signed-off-by: NChen Hanxiao <chenhanxiao@cn.fujitsu.com>

https://bugzilla.redhat.com/show_bug.cgi?id=1027096

If there's the following snippet in the domain XML, the domain will be
lost upon the daemon restart (if the domain is started prior restart):

    <seclabel type='dynamic' relabel='yes'/>

The problem is, the 'label', 'imagelabel' and 'baselabel' are parsed
whenever the VIR_DOMAIN_XML_INACTIVE is *not* present or the label is
static. The latter is not our case, obviously. So, when libvirtd starts
up, it finds domain state xml and parse it. During parsing, many XML
flags are enabled but VIR_DOMAIN_XML_INACTIVE. Hence, our parser tries
to extract 'label', 'imagelabel' and 'baselabel' from the XML which
fails for model='none'. Err, this model - even though not specified in
XML - can be taken from qemu wide config file: /etc/libvirtd/qemu.conf.

However, in order to know we are dealing with model='none' the code in
question must be moved forward a bit. Then a new check must be
introduced. This is what the first two chunks are doing.

But this alone is not sufficient. The domain state XML won't contain the
model attribute without slight modification. The model should be
inserted into the XML even if equal to 'none' and the state XML is being
generated - what if the origin (the @security_driver variable in
qemu.conf) changes during libvirtd restarts?

At the end, a test to catch this scenario is introduced.
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>

The 'vcpucount' command is a getter command for the vCPUu count. When
one or more of the filtering flags are specified the command returns the
value only for the selected combination. In this case the --live and
--config combination isn't valid. This however didn't cause errors as
the combination of flags was rejected by the libvirt API but then the
fallback code kicked in and requested the count in a way where the clash
of the flags didn't matter.

Mark the flag combination mutually exclusive so that users aren't
confused.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1024245

In virDomainRestoreFlags with VIR_DOMAIN_SAVE_BYPASS_CACHE, it risks
slowing restores from NFS, but not saves to NFS.
Signed-off-by: NWang Yufei <james.wangyufei@huawei.com>

Fix some user-visible wording from commits 72aafe9c and 1606d89c.

* src/qemu/qemu.conf (migration_address): Better wording.
* include/libvirt/libvirt.h.in (VIR_MIGRATE_PARAM_LISTEN_ADDRESS):
Likewise.
Signed-off-by: NEric Blake <eblake@redhat.com>

This patch moves some code in the qemuDomainAttachSCSIDisk
function. The check for the existence of a PCI address assigned
to the SCSI controller was moved in order to be executed only
when needed. The PCI address of a controller is not necessary
if QEMU_CAPS_DEVICE is supported.

This fixes issues with the hotplug of SCSI disks on pseries guests.

This resolves:

  https://bugzilla.redhat.com/show_bug.cgi?id=1025397

When virPCIGetVirtualFunctions created the list of an SRIOV Physical
Function's (PF) Virtual Functions (VF), it had assumed that the order
of "virtfn*" links returned by readdir() from the PF's sysfs directory
was already in the correct order. Experience has shown that this is
not always the case - it can be in alphabetical order (which would
e.g. place virtfn11 before virtfn2) or even some seemingly random
order (see the example in the bugzilla report)

This results in 1) incorrect assumptions made by consumers of the
output of the virt_functions list of virsh nodedev-dumpxml, and 2)
setting MAC address and vlan tag on the wrong VF (since libvirt uses
netlink to set mac address and vlan tag, netlink requires the VF#, and
the function virPCIGetVirtualFunctionIndex() returns the wrong index
due to the improperly ordered VF list).

The solution provided by this patch is for virPCIGetVirtualFunctions
to no longer scan the entire device directory in its natural order,
but instead to check for links individually by name "virtfn%d" where
%d starts at 0 and increases with each success. Since VFs are created
contiguously by the kernel, this will guarantee that all VFs are
found, and placed in the arry in the correct order.

One note of use to the uninitiated is that VIR_APPEND_ELEMENT always
either increments *num_virtual_functions or fails, so no this isn't an
endless loop.

(NB: the SRIOV_* defines at the top of virpci.c were removed
because they are unnecessary and/or not used.)

This is a prerequisite to the fix for the fix to:

  https://bugzilla.redhat.com/show_bug.cgi?id=1025397

num_virtual_functions needs to be size_t in order to use the
VIR_APPEND_ELEMENT macro.

When adding support for Q35 guests, the code to assign a PCI address
to the primary video card was moved into Q35 and i440fx(PIIX3)
specific functions, but no fallback was kept for other machine types
that might have a video card.

This patch remedies that by assigning a PCI address to the primary
video card if it does not have any kind of address.  In particular,
this fixes issues with pseries guests.
Signed-off-by: NVitor de Lima <vitor.lima@eldorado.org.br>
Signed-off-by: NLaine Stump <laine@laine.org>

When supported, ask iptables to wait rather than fail if it is in use
by another caller (like ufw).

(See https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1245322)
Signed-off-by: NSerge Hallyn <serge.hallyn@ubuntu.com>

When starting a VM the qemu process may filter out some requested
features of a domain as it's not supported either by the host or by
qemu. Libvirt didn't check if this happened which might end up in
changing of the guest ABI when migrating.

The proof of concept implementation adds the check for the recently
introduced kvm_pv_unhalt cpuid feature bit. This feature depends on both
qemu and host kernel support and thus increase the possibility of guest
ABI breakage.

The linux kernel recently added support for paravirtual spinlock
handling to avoid performance regressions on overcomitted hosts. This
feature needs to be turned in the hypervisor so that the guest OS is
notified about the possible support.

This patch adds a new feature "paravirt-spinlock" to the XML and
supporting code to enable the "kvm_pv_unhalt" pseudo CPU feature in
qemu.

https://bugzilla.redhat.com/show_bug.cgi?id=1008989

Currently we were storing domain feature flags in a bit field as the
they were either enabled or disabled. New features such as paravirtual
spinlocks however can be tri-state as the default option may depend on
hypervisor version.

To allow storing tri-state feature state in the same place instead of
having to declare dedicated variables for each feature this patch
refactors the bit field to an array.

Some of the emulator features are presented in the <features> element in
the domain XML although they are virtual CPUID feature bits when
presented to the guest. To avoid confusing the users with these
features, as they are not configurable via the <cpu> element, this patch
adds an internal array where those can be stored privately instead of
exposing them in the XML.

Additionaly KVM feature bits are added as example usage of this code.

The qemu monitor supports retrieval of actual CPUID bits presented to
the guest using QMP monitor. Add APIs to extract these information and
tests for them.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>