- 22 11月, 2019 1 次提交
-
-
由 Peter Krempa 提交于
Commit 5751a0b6 added a helper function called virDomainCapsFeaturesInitUnsupported which initialized all domain capability features as unsupported. When adding a new feature this would initialize it as unsupported also for hypervisor drivers which the original author possibly didn't intend to modify. To prevent accidental wrong value being reported in such case revert back to initializing individual features in the hypervisor drivers themselves. This is not a straight revert as additonal patches modified how we store the capabilities. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NCole Robinson <crobinso@redhat.com> Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>
-
- 21 11月, 2019 2 次提交
-
-
由 Jiri Denemark 提交于
Both virDomainCapsCPUModelsAdd and virDomainCapsCPUModelsAddSteal are so simple we can just squash the code in a single function. Signed-off-by: NJiri Denemark <jdenemar@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Jiri Denemark 提交于
Signed-off-by: NJiri Denemark <jdenemar@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
- 15 11月, 2019 9 次提交
-
-
由 Pavel Hrdina 提交于
Device rules are stored in BPF map that is a hash type, this function will create a key based on major and minor id of device. Signed-off-by: NPavel Hrdina <phrdina@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Pavel Hrdina 提交于
Signed-off-by: NPavel Hrdina <phrdina@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Pavel Hrdina 提交于
We need to close our FD that we have for BPF program and map in order to let kernel remove all resources once the cgroup is removed as well. Signed-off-by: NPavel Hrdina <phrdina@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Pavel Hrdina 提交于
This function will be called for every virCgroup(Allow|Deny)* API in order to prepare BPF program for guest. Since libvirtd can be restarted at any point we will first try to detect existing progam, if there is none we will create a new empty BPF program and lastly if we don't have any space left in the existing BPF map we will create a new copy of the BPF map with more space and attach a new program with that map into the guest cgroup. This solution allows us to start with reasonably small BPF map consuming only small amount of memory and if needed we can easily extend the BPF map if there is a lot of host devices used in guest or if user wants to hot-plug a lot of devices once the guest is running. Since there is no way how to reallocate existing BPF map we need to create a new copy if we run out of space in current BPF map. This overcomes all the limitations in BPF: - map used in program has to be created before the program is loaded into kernel - once map is created you cannot change its size - you cannot replace map in existing program - you cannot use an array of maps because it can store FD to maps of one specific size so we would not be able to use it to overcome the second issue Signed-off-by: NPavel Hrdina <phrdina@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Pavel Hrdina 提交于
This function creates new BPF program with new empty BPF map with the default size and attaches it to the guest cgroup. Signed-off-by: NPavel Hrdina <phrdina@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Pavel Hrdina 提交于
This function will be called if libvirtd was restarted while some domains were running. It will try to detect existing programs attached to the guest cgroup. Signed-off-by: NPavel Hrdina <phrdina@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Pavel Hrdina 提交于
This function loads the BPF prog with prepared map into kernel and attaches it into guest cgroup. It can be also used to replace existing program in the cgroup if we need to resize BPF map to store more rules for devices. The old program will be closed and removed from kernel. There are two possible ways how to create BPF program: - One way is to write simple C-like code which can by compiled into BPF object file which can be loaded into kernel using elfutils. - The second way is to define macros which look like assembler instructions and can be used directly to create BPF program that can be directly loaded into kernel. Since the program is not too complex we can use the second option. If there is no program, all devices are allowed, if there is some program it is executed and based on the exit status the access is denied for 0 and allowed for 1. Our program will follow these rules: - first it will try to look for the specific key using major and minor to see if there is any rule for that specific device - if there is no specific rule it will try to look for any rule that matches only major of the device - if there is no match with major it will try the same but with minor of the device - as the last attempt it will try to look for rule for all devices and if there is no match it will return 0 to deny that access Signed-off-by: NPavel Hrdina <phrdina@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Pavel Hrdina 提交于
There is no exact way how to figure out whether BPF devices support is compiled into kernel. One way is to check kernel configure options but this is not reliable as it may not be available. Let's try to do syscall to which will list BPF cgroup device programs. Signed-off-by: NPavel Hrdina <phrdina@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Pavel Hrdina 提交于
In order to implement devices controller with cgroup v2 we need to add support for BPF programs, cgroup v2 doesn't have devices controller. This introduces required helpers wrapping linux syscalls. Signed-off-by: NPavel Hrdina <phrdina@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
- 14 11月, 2019 2 次提交
-
-
由 Peter Krempa 提交于
For future extensions of the domain caps it's useful to have a single point that initializes all capabilities as unsupported by a driver. The driver then can enable specific ones. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
The function is unused so we can remove it. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
- 13 11月, 2019 1 次提交
-
-
由 Peter Krempa 提交于
Remove the need to pass around strings and switch to the enum values instead. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
- 12 11月, 2019 3 次提交
-
-
由 Michal Privoznik 提交于
Now that function is no longer used, it can be dropped. Signed-off-by: NMichal Privoznik <mprivozn@redhat.com> Reviewed-by: NDaniel Henrique Barboza <danielhb413@gmail.com>
-
由 Michal Privoznik 提交于
Now that function is no longer used, it can be dropped. Signed-off-by: NMichal Privoznik <mprivozn@redhat.com> Reviewed-by: NDaniel Henrique Barboza <danielhb413@gmail.com>
-
由 Peter Krempa 提交于
The enum name sounds too generic. It in fact describes the capabilities of the process, thus add 'Process' to the name. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
- 25 10月, 2019 3 次提交
-
-
由 Peter Krempa 提交于
The function now does not return an error so we can drop it fully. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
The function now does not return an error so we can drop it fully. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
The function basically does two very distinct things depending on a bool. As a first step of conversion split out the case when @dynamic is true and implement it as a new function and convert all callers. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
- 21 10月, 2019 7 次提交
-
-
由 Peter Krempa 提交于
Add a helper that checks whether an entry with given name exists but does not touch the userdata. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> ACKed-by: NEric Blake <eblake@redhat.com>
-
由 Peter Krempa 提交于
Add a simpler constructor for hash tables which specifically does not require specifying the initial hash size and uses simpler freeing function. The initial hash table size usually is not important as the hash table is growing when it reaches certain number of entries in one bucket. Additionally many callers pass in a random small number for ad-hoc table use so using a central one will simplify things. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> ACKed-by: NEric Blake <eblake@redhat.com>
-
由 Peter Krempa 提交于
Previous commit removed last use of this function so we can get rid of it. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NDaniel Henrique Barboza <danielhb413@gmail.com>
-
由 Peter Krempa 提交于
Introduce a simpler replacement for virDomainDiskByName when looking up by disk target. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NDaniel Henrique Barboza <danielhb413@gmail.com>
-
由 Peter Krempa 提交于
Last use was removed in 29682196. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NDaniel Henrique Barboza <danielhb413@gmail.com>
-
由 Michal Privoznik 提交于
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com> Reviewed-by: NCole Robinson <crobinso@redhat.com>
-
由 Michal Privoznik 提交于
In some places we need to check if a hostdev has VFIO backend. Because of how complicated virDomainHostdevDef structure is, the check consists of three lines. Move them to a function and replace all checks with the function call. Signed-off-by: NMichal Privoznik <mprivozn@redhat.com> Reviewed-by: NCole Robinson <crobinso@redhat.com>
-
- 19 10月, 2019 1 次提交
-
-
由 Malina Salina 提交于
While the default iptables setup used by Fedora/RHEL distros only restricts traffic on the INPUT and/or FORWARD rules, some users might have custom firewalls that restrict the OUTPUT rules too. These can prevent DHCP/DNS/TFTP responses from dnsmasq from reaching the guest VMs. We should thus whitelist these protocols in the OUTPUT chain, as well as the INPUT chain. Signed-off-by: NMalina Salina <malina.salina@protonmail.com> Initial patch then modified to add unit tests and IPv6 support Reviewed-by: NMichal Privoznik <mprivozn@redhat.com> Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com>
-
- 18 10月, 2019 1 次提交
-
-
由 Michal Privoznik 提交于
These functions don't really abort() on OOM. The fix was merged upstream, but not in the minimal version we require. Provide our own implementation which can be removed once we bump the minimal version. Signed-off-by: NMichal Privoznik <mprivozn@redhat.com> Reviewed-by: NDaniel P. Berrangé <berrange@redhat.com>
-
- 16 10月, 2019 1 次提交
-
-
由 Ján Tomko 提交于
Signed-off-by: NJán Tomko <jtomko@redhat.com> Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>
-
- 14 10月, 2019 1 次提交
-
-
由 Daniel P. Berrangé 提交于
Replace use of the gnulib base64 module with glib's own base64 API family. Reviewed-by: NJán Tomko <jtomko@redhat.com> Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com>
-
- 12 10月, 2019 1 次提交
-
-
由 Cole Robinson 提交于
It is only used in virstoragefile.c Reviewed-by: NDaniel Henrique Barboza <danielhb413@gmail.com> Reviewed-by: NMichal Privoznik <mprivozn@redhat.com> Signed-off-by: NCole Robinson <crobinso@redhat.com>
-
- 10 10月, 2019 1 次提交
-
-
由 Cole Robinson 提交于
It is the only user. Rename it to match the local style Reviewed-by: NMichal Privoznik <mprivozn@redhat.com> Signed-off-by: NCole Robinson <crobinso@redhat.com>
-
- 08 10月, 2019 1 次提交
-
-
由 Michal Privoznik 提交于
Some of objects we manage can be autostarted on libvirtd startup (e.g. domains, network, storage pools). The idea was that when the host is started up these objects are started too without need of user intervention. However, with the latest daemon split and switch to socket activated, short lived daemons (we put --timeout 120 onto each daemon's command line) this doesn't do what we want it to. The problem is not new though, we already had the session daemon come and go and we circumvented this problem by documenting it (see v4.10.0-92-g61b4e8aa). But now that we meet the same problem at all fronts it's time to deal with it. The solution implemented in this commit is to have a file (one per each driver) that: 1) if doesn't exist, is created and autostart is allowed for given driver, 2) if it does exist, then autostart is suppressed for given driver. All the files live in a location that doesn't survive host reboots (/var/run/ for instance) and thus the file is automatically not there on fresh host boot. Signed-off-by: NMichal Privoznik <mprivozn@redhat.com> Reviewed-by: NDaniel P. Berrangé <berrange@redhat.com>
-
- 07 10月, 2019 1 次提交
-
-
由 Collin Walling 提交于
Implement an XML to virCPUDefPtr helper that handles the ctxt prerequisite for virCPUDefParseXML. This does not alter any functionality. Signed-off-by: NCollin Walling <walling@linux.ibm.com> Reviewed-by: NBjoern Walk <bwalk@linux.ibm.com> Reviewed-by: NDaniel Henrique Barboza <danielh413@gmail.com> Message-Id: <1568924706-2311-14-git-send-email-walling@linux.ibm.com> Reviewed-by: NJiri Denemark <jdenemar@redhat.com>
-
- 27 9月, 2019 2 次提交
-
-
由 Daniel Henrique Barboza 提交于
The code to validate the URI path is repeated across several files. This patch creates a common validation code to be used across all of them. Reviewed-by: NCole Robinson <crobinso@redhat.com> Suggested-by: NCole Robinson <crobinso@redhat.com> Signed-off-by: NDaniel Henrique Barboza <danielhb413@gmail.com>
-
由 Laine Stump 提交于
A virDomainNetDef object in a domain's nets array might contain a virDomainHostdevDef, and when this is the case, the domain's hostdevs array will also have a pointer to this embedded hostdev (this is done so that internal functions that need to perform some operation on all hostdevs won't leave out the type='hostdev' network interfaces). When a network device was updated with virDomainUpdateDeviceFlags(), we were replacing the entry in the nets array (and free'ing the original) but forgetting about the pointer in the hostdevs array (which would then point to the now-free'd hostdev contained in the old net object.) This often resulted in a libvirtd crash. The solution is to add a function, virDomainNetUpdate(), called by qemuDomainUpdateDeviceConfig(), that updates the hostdevs array appropriately along with the nets array. Resolves: https://bugzilla.redhat.com/1558934Signed-off-by: NLaine Stump <laine@redhat.com> Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>
-
- 25 9月, 2019 2 次提交
-
-
由 Peter Krempa 提交于
Introduce a new set of helpers including a new data structure which simplifies keeping and construction of lists of typed parameters. The use of VIR_RESIZE_N in the virTypedParamsAdd API has performance benefits but requires passing around 3 arguments. Use of them lead to a set of macros with embedded jumps used in the qemu statistics code. This patch introduces 'virTypedParamList' type which aggregates the necessary list-keeping variables and also a new set of functions to add new typed parameters to a list. These new helpers use printf-like format string and arguments to format the argument name as the stats code often uses indexed typed parameters. The accessor function then allows extracting the typed parameter list in the same format as virTypedParamsAdd* functions would do. One additional benefit is also that the list function can easily be used with VIR_AUTOPTR. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
The function is only used as a helper in virTypedParamsAddFromString. Make it static and move it to virtypedparam-public.c. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-