For virtio disks and interfaces, qemu allows users to enable or disable
ioeventfd feature. This means, qemu can execute domain code, while
another thread waits for I/O event. Basically, in some cases it is win,
in some loss. This feature is available via 'ioeventfd' attribute in disk
and interface <driver> element. It accepts 'on' and 'off'. Leaving this
attribute out defaults to hypervisor decision.

Example XML:

<numatune>
  <memory mode="strict" nodeset="0-10,^4"/>
</numatune>

Please enter the commit message for your changes. Lines starting

From a security pov copy and paste between the guest and the client is not
always desirable. So we need to be able to enable/disable this. The best place
to do this from an administration pov is on the hypervisor, so the qemu cmdline
is getting a spice disable-copy-paste option, see bug 693645. Example qemu
invocation:
qemu -spice port=5932,disable-ticketing,disable-copy-paste

https://bugzilla.redhat.com/show_bug.cgi?id=693661

Added:
* Virt ruby bindings
* Foreman for provisioning and webui.

For backwards compatibility, if no <video> is set but there is a
<graphics> tag, then we add a default <video> according to the
guest type. Add docs to tell the user about this to not make
them confused. Especially if they remove the video (such as via
"virsh edit"), it will be surprised for them to see the video
element is still in domain XML.

Annotate the ESX device driver dummy.

Refactor the udev and hal device driver strcuts to match the
common annotation pattern.

* configure.ac docs/news.html.in libvirt.spec.in: update for release
* po/*.po*: updated translations and regenerated

Signed-off-by: NNeil Wilson <neil@aldur.co.uk>

Partial revert of commit c3c30d4d.

* docs/Makefile.am (internals/%.html.tmp): Restore MKDIR_P; it is
needed for intermediate file after all.
Reported by Daniel P. Berrange.

A lock manager may operate in various modes. The direct mode of
operation is to obtain locks based on the resources associated
with devices in the XML. The indirect mode is where the app
creating the domain provides explicit leases for each resource
that needs to be locked. This XML extension allows for listing
resources in the XML

  <devices>
     ...
     <lease>
       <lockspace>somearea</lockspace>
       <key>thequickbrownfoxjumpsoverthelazydog</key>
       <target path='/some/lease/path' offset='23432'/>
     </lease>
     ...
  </devices>

The 'lockspace' is a unique identifier for the lockspace which
the lease is associated

The 'key' is a unique identifier for the resource associated
with the lease.

The 'target' is the file on disk where the leases are held.

* docs/schemas/domain.rng: Add lease schema
* src/conf/domain_conf.c, src/conf/domain_conf.h: parsing and
  formatting for leases
* tests/qemuxml2argvdata/qemuxml2argv-lease.args,
  tests/qemuxml2argvdata/qemuxml2argv-lease.xml,
  tests/qemuxml2xmltest.c: Test XML handling for leases

I noticed this while building from libvirt.git on RHEL 5.6:

Generating internals/command.html.tmp
mkdir: cannot create directory `/internals': Permission denied

If I had been building as root instead, this pollutes /.

Older autoconf lacks $(builddir), but it is rigorously equal to '.'
in newer autoconf, so we could use '$(MKDIR_P) internals' instead.

However, since internals/command.html is part of the tarball, we
_already_ build it in $(srcdir), not $(builddir) during VPATH
builds, so the mkdir is wasted effort!

* docs/Makefile.am (internals/%.html.tmp): Drop unused mkdir.

New APIs have to use long long instead of long.

Also make apibuild errors fatal.

This fixes this three warnings from the parser by allowing the parser
to ignore some macros in the same way as it can ignore functions.

Parsing ./../include/libvirt/libvirt.h
Misformatted macro comment for _virSchedParameter
 Expecting '* _virSchedParameter:' got '* virSchedParameter:'
Misformatted macro comment for _virBlkioParameter
 Expecting '* _virBlkioParameter:' got '* virBlkioParameter:'
Misformatted macro comment for _virMemoryParameter
 Expecting '* _virMemoryParameter:' got '* virMemoryParameter:'

In a parallel make, HTML validation tries to run before
hvsupport.html.in has been built.

* docs/Makefile.am: List hvsupport.html.in as a built source

We support this in code, but forgot to add this to RNG schema as well.
According to documentation, the value match the dateTime type.

Since -vnc uses ':' to separate the address from the port, raw
IPv6 addresses need to be escaped like [addr]:port

* src/qemu/qemu_command.c: Escape raw IPv6 addresses with []
* tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc.args,
  tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc.xml: Tweak
  to test Ipv6 escaping
* docs/schemas/domain.rng: Allow Ipv6 addresses, or hostnames
  in <graphics> listen attributes

This adds a streaming-video=filter|all|off attribute. It is used to change
the behavior of video stream detection in spice, the default is filter (the
default for libvirt is not to specify it - the actual default is defined in
libspice-server.so).

Usage:

    <graphics type='spice' autoport='yes'>
      <streaming mode='off'/>
    </graphics>

Tested with the above and with tests/qemuxml2argvtest.
Signed-off-by: NAlon Levy <alevy@redhat.com>

This patch enables filtering of gratuitous ARP packets using the following XML:

<rule action='accept' direction='in' priority='425'>
<arp gratuitous='true'/>
</rule>

Lacks of "/", push this directly in trivial rule.

starting with kernel 2.6.38 macvtap supports a 'passthru' mode for
attaching virtual functions of a SRIOV capable network card directly to a VM.
This patch adds the capability to configure such a device.
Signed-off-by: NDirk Herrendoerfer <d.herrendoerfer@herrendoerfer.name>

* docs/hvsupport.pl: Add execute bit.

Migration just seems to go from bad to worse. We already had to
introduce a second migration protocol when adding the QEMU driver,
since the one from Xen was insufficiently flexible to cope with
passing the data the QEMU driver required.

It turns out that this protocol still has some flaws that we
need to address. The current sequence is

 *  Src: DumpXML
          - Generate XML to pass to dst

 *  Dst: Prepare
          - Get ready to accept incoming VM
          - Generate optional cookie to pass to src

 *  Src: Perform
          - Start migration and wait for send completion
          - Kill off VM if successful, resume if failed

 *  Dst: Finish
          - Wait for recv completion and check status
          - Kill off VM if unsuccessful

The problems with this are:

 - Since the first step is a generic 'DumpXML' call, we can't
   add in other migration specific data. eg, we can't include
   any VM lease data from lock manager plugins
 - Since the first step is a generic 'DumpXML' call, we can't
   emit any 'migration begin' event on the source, or have
   any hook that runs right at the start of the process
 - Since there is no final step on the source, if the Finish
   method fails to receive all migration data & has to kill
   the VM, then there's no way to resume the original VM
   on the source

This patch attempts to introduce a version 3 that uses the
improved 5 step sequence

 *  Src: Begin
          - Generate XML to pass to dst
          - Generate optional cookie to pass to dst

 *  Dst: Prepare
          - Get ready to accept incoming VM
          - Generate optional cookie to pass to src

 *  Src: Perform
          - Start migration and wait for send completion
          - Generate optional cookie to pass to dst

 *  Dst: Finish
          - Wait for recv completion and check status
          - Kill off VM if failed, resume if success
          - Generate optional cookie to pass to src

 *  Src: Confirm
          - Kill off VM if success, resume if failed

The API is designed to allow both input and output cookies
in all methods where applicable. This lets us pass around
arbitrary extra driver specific data between src & dst during
migration. Combined with the extra 'Begin' method this lets
us pass lease information from source to dst at the start of
migration

Moving the killing of the source VM out of Perform and
into Confirm, means we can now recover if the dst host
can't successfully Finish receiving migration data.

The hvsupport.html.in file is forever out of date. By annotating
the driver struct tables in each driver with version information,
we can auto-generate the hvsupport.html.in file. Annotating the
drivers will be mandatory for new patches, ensuring hvsupport.html.in
is never out of date again.

* docs/hvsupport.html.in: Delete
* hvsupport.pl: Script to generate hvsupport.html.in
* Makefile.am: Autogenerate hvsupport.html.in

This re-adds the example section originally written by Osier Yang,
and indicates the version in which the cputune parameters became
available in libvirt.
Signed-off-by: NIgor Serebryany <igor47@moomers.org>

* docs/testsuites.html.in: Keep 'make syntax-check' happy.

Create a new top level entry, add a new page listing the 3
test suites, and then one page for the TCK and one page for
libvirt-test-API

Update the documentation to mention that the CA certificate and the
client cert/key pair can come from the user's location or the global
location independent of each other.
Signed-off-by: NDoug Goldstein <cardoe@gentoo.org>

We already have virAsprintf, so picking a similar name helps for
seeing a similar purpose.  Furthermore, the prefix V before printf
generally implies 'va_list', even though this variant was '...', and
the old name got in the way of adding a new va_list version.

global rename performed with:

$ git grep -l virBufferVSprintf \
  | xargs -L1 sed -i 's/virBufferVSprintf/virBufferAsprintf/g'

then revert the changes in ChangeLog-old.

* configure.ac libvirt.spec.in docs/news.html.in: update and document
  the release
* po/*.po*: update localizations for german, polish, spanish, ukrainian
  and vietnamese coming from transifex, regenerate

For IEEE 802.1Qbg, it is necessary to use a VLAN interface.
vepa itself does not require a VLAN interface.

Signed-off-by: Gerhard Stenzel <stenzel at de.ibm.com>

Tried to dredge through old changelogs and commits to come up with it, so
may not be completely accurate.

v2:
Drop ambiguous 'containers'
Use same mail archive for all links

Ebtables filtering doesn't work on macvtap device. Remove support for direct type of interface.

This extends the SPICE XML to allow variable compression settings for audio,
images and streaming:
    <graphics type='spice' port='5901' tlsPort='-1' autoport='yes'>
        <image compression='auto_glz'/>
        <jpeg compression='auto'/>
        <zlib compression='auto'/>
        <playback compression='on'/>
    </graphics>

All new elements are optional.

Reported by Igor Galić

Jim Meyering recently improved gnulib to catch various grammar
errors during 'make syntax-check'.

* .gnulib: Update to latest, for syntax-check improvements.
* include/libvirt/libvirt.h.in (virConnectAuthCallbackPtr): Use
cannot rather than two words.
* src/driver.c: Likewise.
* src/driver.h (VIR_SECRET_GET_VALUE_INTERNAL_CALL): Likewise.
* src/remote/remote_driver.c (initialize_gnutls): Likewise.
* src/util/pci.c (pciBindDeviceToStub): Likewise.
* src/storage/storage_backend.c (virStorageBackendCreateQemuImg):
Likewise.
(virStorageBackendUpdateVolTargetInfoFD): Avoid doubled word.
* docs/formatdomain.html.in: Likewise.
* src/qemu/qemu_process.c (qemuProcessStart): Likewise.
* cfg.mk (exclude_file_name_regexp--sc_prohibit_can_not)
(exclude_file_name_regexp--sc_prohibit_doubled_word): Exclude
existing translation problems.

This patch adds support for the evaluation of TCP flags in nwfilters.

It adds documentation to the web page and extends the tests as well.
Also, the nwfilter schema is extended.

The following are some example for rules using the tcp flags:

<rule action='accept' direction='in'>
    <tcp state='NONE' flags='SYN/ALL' dsptportstart='80'/>
</rule>
<rule action='drop' direction='in'>
    <tcp state='NONE' flags='SYN/ALL'/>
</rule>

It was just pointed out that, although I added documentation for the
IPv6 additions to the network XML, I neglected to use those additions
in the examples. This patch adds an IPv6 address to each of the
examples except for the "default" network, since that is a faithful
reproduction of the default network config that's automatically
installed, which doesn't include any IPv6 address (for good reason -
because there is no such thing as IPv6 NAT, there is no one IPv6
address that would work for all installations).