After some discussion on and off the linux-audit mailing list, we
should use different fields for the audit messages.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1218603Signed-off-by: NMartin Kletzander <mkletzan@redhat.com>

Add cache resource control into capabilities for CAT without CDP:

  <cache>
    <bank id='0' level='3' type='unified' size='15360' unit='KiB' cpus='0-5'>
      <control min='768' unit='KiB' scope='both' max_allocation='4'/>
    </bank>
  </cache>

and with CDP:

  <cache>
    <bank id='0' level='3' type='unified' size='15360' unit='KiB' cpus='0-5'>
      <control min='768' unit='KiB' scope='code' max_allocation='4'/>
      <control min='768' unit='KiB' scope='data' max_allocation='4'/>
    </bank>
  </cache>

Also add new test cases for vircaps2xmltest.
Signed-off-by: NEli Qiao <liyong.qiao@intel.com>

While checking for ABI stability, drivers might pose additional
checks that are not valid for general case. For instance, qemu
driver might check some memory backing attributes because of how
qemu works. But those attributes may work well in other drivers.
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>

It was only ever used in node_device_hal.c which really never used it
anyway since the NODE_DEV_UDI was never referenced.  Remove free_udi()
and @privData as well as the references to obj->privateData & obj->privateFree.
Signed-off-by: NJohn Ferlan <jferlan@redhat.com>

In preparation for privatizing the virNodeDeviceObj - create an accessor
for the @def field and then use it for various callers.
Signed-off-by: NJohn Ferlan <jferlan@redhat.com>

In order to ensure that whenever something is added to virNodeDevCapType
that both functions are considered for processing of a new capability,
change the if-then-else construct into a switch statement.
Signed-off-by: NJohn Ferlan <jferlan@redhat.com>

When searching for an NPIV capable fc_host, not only does there need to
be an "fc_host" capability with the specified wwnn/wwpn or fabric_wwn,
but that scsi_host must be vport capable; otherwise, one could end up
picking an exising vHBA/NPIV which wouldn't be good.

Currently not a problem since scsi_hosts are in an as found forward linked
list and the vport capable scsi_hosts will always appear before a vHBA by
definition. However, in the near term future a hash table will be used to
lookup the devices and that could cause problems for these algorithms.
Signed-off-by: NJohn Ferlan <jferlan@redhat.com>

Alter the algorithm to return a list of matching names rather than a
list of match virInterfaceObjPtr which are then just dereferenced
extracting the def->name and def->mac. Since the def->mac would be
the same as the passed @mac, just return a list of names and as long
as there's only one, extract the [0] entry from the passed list.
Also alter the error message on failure to include the mac that wasn't
found.
Signed-off-by: NJohn Ferlan <jferlan@redhat.com>

Prefix should have been virInterfaceObjList since the API is operating
on the list of interfaces.
Signed-off-by: NJohn Ferlan <jferlan@redhat.com>

Move the structs into virinterfaceobj.c, create necessary accessors, and
initializers.

This also includes reworking virInterfaceObjListClone to handle receiving
a source interfaces list pointer, creating the destination interfaces object,
and copying everything from source into dest.
Signed-off-by: NJohn Ferlan <jferlan@redhat.com>

Move the struct into virinterfaceobj.c, create necessary accessors, and
initializers.
Signed-off-by: NJohn Ferlan <jferlan@redhat.com>

We're about to make the obj much more private, so make it easier to
see future changes which will require accessors for the obj->def

This also includes modifying some interfaces->objs[i]->X references to be
obj = interfaces->objs[i]; and then def = obj->def
Signed-off-by: NJohn Ferlan <jferlan@redhat.com>

Alter variable names to be obj rather than 'iface' and/or 'obj'.
Signed-off-by: NJohn Ferlan <jferlan@redhat.com>

The @cpus is allocated by virFileReadValueBitmap() but never
freed:

==21274== 40 (32 direct, 8 indirect) bytes in 1 blocks are definitely lost in loss record 808 of 1,004
==21274==    at 0x4C2E080: calloc (vg_replace_malloc.c:711)
==21274==    by 0x54BA561: virAlloc (viralloc.c:144)
==21274==    by 0x54BC604: virBitmapNewEmpty (virbitmap.c:126)
==21274==    by 0x54BD059: virBitmapParseUnlimited (virbitmap.c:570)
==21274==    by 0x54EECE9: virFileReadValueBitmap (virfile.c:4113)
==21274==    by 0x5563132: virCapabilitiesInitCaches (capabilities.c:1548)
==21274==    by 0x2BB86E59: virQEMUCapsInit (qemu_capabilities.c:1132)
==21274==    by 0x2BBEC067: virQEMUDriverCreateCapabilities (qemu_conf.c:928)
==21274==    by 0x2BC3DEAA: qemuStateInitialize (qemu_driver.c:845)
==21274==    by 0x5625AAC: virStateInitialize (libvirt.c:770)
==21274==    by 0x124519: daemonRunStateInit (libvirtd.c:881)
==21274==    by 0x554C927: virThreadHelper (virthread.c:206)
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>

Similar to scsi_host and fc_host, there is a relation between a
scsi_target and its transport specific fc_remote_port. Let's expose this
relation and relevant information behind it.

An example for a virsh nodedev-dumpxml:

    virsh # nodedev-dumpxml scsi_target0_0_0
    <device>
      <name>scsi_target0_0_0</name>
      <path>/sys/devices/[...]/host0/rport-0:0-0/target0:0:0</path>
      <parent>scsi_host0</parent>
      <capability type='scsi_target'>
        <target>target0:0:0</target>
        <capability type='fc_remote_port'>
          <rport>rport-0:0-0</rport>
          <wwpn>0x9d73bc45f0e21a86</wwpn>
        </capability>
      </capability>
    </device>
Reviewed-by: NBoris Fiuczynski <fiuczy@linux.vnet.ibm.com>
Signed-off-by: NBjoern Walk <bwalk@linux.vnet.ibm.com>

Now that the node_device driver is aware of CCW devices, let's hook up
virsh so that we can filter them properly.
Reviewed-by: NBoris Fiuczynski <fiuczy@linux.vnet.ibm.com>
Reviewed-by: NMarc Hartmayer <mhartmay@linux.vnet.ibm.com>
Signed-off-by: NBjoern Walk <bwalk@linux.vnet.ibm.com>

Make CCW devices available to the node_device driver. The devices are
already seen by udev so let's implement necessary code for detecting
them properly.

Topologically, CCW devices are similar to PCI devices, e.g.:

    +- ccw_0_0_1a2b
        |
        +- scsi_host0
            |
            +- scsi_target0_0_0
                |
                +- scsi_0_0_0_0
Reviewed-by: NBoris Fiuczynski <fiuczy@linux.vnet.ibm.com>
Signed-off-by: NBjoern Walk <bwalk@linux.vnet.ibm.com>

Add an attribute to control extended interrupt mode.

https://bugzilla.redhat.com/show_bug.cgi?id=1451282Reviewed-by: NAndrea Bolognani <abologna@redhat.com>

The checks are scattered all over the place. Move them into a
single function.
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>

https://bugzilla.redhat.com/show_bug.cgi?id=1420740

Testing found an inventive way to cause an error at shutdown by providing the
parent name for the fc host creation using the "same name" as the HBA. Since
the code thus assumed the parent host name provided was the parent HBA and
just extracted out the host number and sent that along to the vport_destroy
this avoided checks made for equality.

So just add the equality check to that path to resolve.

Signed-off-by: NPavel Hrdina <phrdina@redhat.com>

If the first console is just a copy of the first serial device we
don't need to iterate over the same device twice in order to perform
actions like security labeling, cgroup configuring, etc.

Currently only security SELinux manager was aware of this fact.
Signed-off-by: NPavel Hrdina <phrdina@redhat.com>

To every virDirOpen we must have VIR_DIR_CLOSE otherwise FD is
leaked.
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>
Reviewed-by: NPavel Hrdina <phrdina@redhat.com>

Enums are unsigned, so it's impossible to check whether the helper
returned -1 for invalid conversions.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1452454

Start discovering the mediated devices on the host system and format the
attributes for the mediated device into the XML. Compared to the parent
device which reports generic information about the abstract mediated
devices types, a child device only reports the type name it has been
instantiated from and the IOMMU group number, since that's device
specific compared to the rest of the info that can be gathered about
mediated devices at the moment.
This patch introduces both the formatting and parsing routines, updates
nodedev.rng schema, adding a testcase as well.

The resulting mdev child device XML:
<device>
  <name>mdev_4b20d080_1b54_4048_85b3_a6a62d165c01</name>
  <path>/sys/devices/.../4b20d080-1b54-4048-85b3-a6a62d165c01</path>
  <parent>pci_0000_06_00_0</parent>
  <driver>
    <name>vfio_mdev</name>
  </driver>
  <capability type='mdev'>
    <type id='vendor_supplied_type_id'/>
    <iommuGroup number='NUM'/>
  <capability/>
<device/>

https://bugzilla.redhat.com/show_bug.cgi?id=1452072Signed-off-by: NErik Skultety <eskultet@redhat.com>

The parent device needs to report the generic stuff about the supported
mediated devices types, like device API, available instances, type name,
etc. Therefore this patch introduces a new nested capability element of
type 'mdev_types' with the resulting XML of the following format:

<device>
  ...
  <capability type='pci'>
    ...
    <capability type='mdev_types'>
      <type id='vendor_supplied_id'>
        <name>optional_vendor_supplied_codename</name>
        <deviceAPI>vfio-pci</deviceAPI>
        <availableInstances>NUM</availableInstances>
      </type>
        ...
      <type>
        ...
      </type>
    </capability>
  </capability>
  ...
</device>

https://bugzilla.redhat.com/show_bug.cgi?id=1452072Signed-off-by: NErik Skultety <eskultet@redhat.com>

The reason for introducing two capabilities, one for the device itself
(cap 'mdev') and one for the parent device listing the available types
('mdev_types'), is that we should be able to do
'virsh nodedev-list --cap' not only for existing mdev devices but also
for devices that support creation of mdev devices, since one day libvirt
might be actually able to create the mdev devices in an automated way
(just like we do for NPIV/vHBA).

https://bugzilla.redhat.com/show_bug.cgi?id=1452072Signed-off-by: NErik Skultety <eskultet@redhat.com>

Since there's at least SRIOV and MDEV sub-capabilities to be parsed,
let's make the code more readable by splitting it to several logical
blocks.
Signed-off-by: NErik Skultety <eskultet@redhat.com>

https://bugzilla.redhat.com/show_bug.cgi?id=1427005

Add a new attribute to control the caching mode.

https://bugzilla.redhat.com/show_bug.cgi?id=1427005

Add a new attribute to control interrupt remapping.

https://bugzilla.redhat.com/show_bug.cgi?id=1427005

Add a new <ioapic> element with a driver attribute.

Possible values are qemu and kvm. With 'qemu', the I/O
APIC can be put in the userspace even for KVM domains.

https://bugzilla.redhat.com/show_bug.cgi?id=1427005

The @type from virFileReadValueString needs to be VIR_FREE each time
through the loop since it's not saved and since cleanup can be reached
prior to decoding it for @kernel_type amd bank->type, the cleanup code
needs to also have a VIR_FREE

Found by Coverity

Signed-off-by: NJiri Denemark <jdenemar@redhat.com>
Reviewed-by: NDaniel P. Berrange <berrange@redhat.com>

We're only adding only info about L3 caches, we can add more
later (just by changing one line), but for now that's more than enough
without overwhelming anyone.

XML snippet of how this should look like (also seen as part of the commit):

  <cache>
    <bank id='0' level='3' type='both' size='8192' unit='KiB' cpus='0-7'/>
  </cache>
Signed-off-by: NMartin Kletzander <mkletzan@redhat.com>

It is no longer needed thanks to the great virfilewrapper.c.  And this
way we don't have to add a new set of functions for each prefixed
path.

While on that, add two functions that weren't there before, string and
scaled integer reading ones.  Also increase the length of the string
being read by one to accompany for the optional newline at the
end (i.e. change INT_STRLEN_BOUND to INT_BUFSIZE_BOUND).
Signed-off-by: NMartin Kletzander <mkletzan@redhat.com>

When adding a nwfilter onto the list in
virNWFilterObjListAssignDef() this array is re-allocated to match
demand for new size. However, it is never freed leading to a
leak:

==26535== 136 bytes in 1 blocks are definitely lost in loss record 1,079 of 1,250
==26535==    at 0x4C2E2BE: realloc (vg_replace_malloc.c:785)
==26535==    by 0x54BA28E: virReallocN (viralloc.c:245)
==26535==    by 0x54BA384: virExpandN (viralloc.c:294)
==26535==    by 0x54BA657: virInsertElementsN (viralloc.c:436)
==26535==    by 0x55DB011: virNWFilterObjListAssignDef (virnwfilterobj.c:362)
==26535==    by 0x55DB530: virNWFilterObjListLoadConfig (virnwfilterobj.c:503)
==26535==    by 0x55DB635: virNWFilterObjListLoadAllConfigs (virnwfilterobj.c:539)
==26535==    by 0x2AC5A28B: nwfilterStateInitialize (nwfilter_driver.c:250)
==26535==    by 0x5621C64: virStateInitialize (libvirt.c:770)
==26535==    by 0x124379: daemonRunStateInit (libvirtd.c:881)
==26535==    by 0x554AC78: virThreadHelper (virthread.c:206)
==26535==    by 0x8F5F493: start_thread (in /lib64/libpthread-2.23.so)
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>
Reviewed-by: NJohn Ferlan <jferlan@redhat.com>

... with VIR_NET_GENERATED_MACV???_PREFIX, which is defined in
util/virnetdevmacvlan.h.

Since VIR_NET_GENERATED_PREFIX is used for plain tap devices, it is
renamed to VIR_NET_GENERATED_TAP_PREFIX and moved to virnetdev.h

The parser had been clearing out *all* suggested device names for
type='direct' (aka macvtap) interfaces. All of the code implementing
macvtap allows for a user-specified device name, so we should allow
it. In the case that an interface name starts with "macvtap" or
"macvlan" though, we do still clear it out, just as we do with "vnet"
(which is the prefix used for automatically generated tap device
names), since those are the prefixes for the names we autogenerate for
macvtap and macvlan devices.

Resolves: https://bugzilla.redhat.com/1335798