Add a new element to the <os> block:

  <bootmenu enable="yes|no"/>

Which maps to -boot,menu=on|off on the QEMU command line.

I decided to use an explicit 'enable' attribute rather than just make the
bootmenu element boolean. This allows us to treat lack of a bootmenu element
as 'use hypervisor default'.

Since DV recommended keeping the build instructions distributed with the
source, move them from the old FAQ to the downloads page.

Throw an explicit error if multiple graphics devices are specified, or
an unsupported type is specified (rdp).

When only client parts of libvirt are installed (i.e., no libvirtd
daemon), libvirt-guests init script in its default configuration would
throw seriously looking errors during host shutdown:

Running guests on default URI: error: unable to connect to
'/var/run/libvirt/libvirt-sock', libvirtd may need to be started: No
such file or directory
error: failed to connect to the hypervisor

This patch changes the script to print rather harmless message in that
situation:

Running guests on default URI: libvirtd not installed; skipping this
URI.

Some buggy PCI devices actually support FLR, but
forget to advertise that fact in their PCI config space.
However, Virtual Functions on SR-IOV devices are
*required* to support FLR by the spec, so force has_flr
on if this is a virtual function.
Signed-off-by: NChris Lalancette <clalance@redhat.com>

After the recent libvirt-qemu library addition, VPATH builds fail with:

  CC     libvirt_qemu_la-libvirt-qemu.lo
In file included from ../../src/libvirt-qemu.c:29:
../../include/libvirt/libvirt-qemu.h:17:22: error: libvirt.h: No such file or directory
...
  CCLD   libvirt-qmeu.la
/usr/bin/ld: cannot open linker script file libvirt_qemu.syms: No such file or directory

This fixes both issues (there are still some documentation VPATH issues,
but those don't show up with 'make check').

* configure.ac (LIBVIRT_QEMU_SYMBOL_FILE): While libvirt.syms is
generated and lives in $(builddir), libvirt_qemu.syms is static
and lives in $(srcdir).
* include/libvirt/libvirt-qemu.h (includes): Pull in libvirt.h via
the public location, since this is a public header.

When doing a PCI secondary bus reset, we must be sure that there are no
active devices on the same bus segment.  The active device tracking is
designed to only track host devices that are active in use by guests.
This ignores host devices that are actively in use by the host.  So the
current logic will reset host devices.

Switch this logic around and allow sbus reset when we are assigning all
devices behind a bridge to the same guest at guest startup or as a result
of a single attach-device command.

* src/util/pci.h: change signature of pciResetDevice to add an
  inactive devices list
* src/qemu/qemu_driver.c src/xen/xen_driver.c: use (or not) the new
  functionality of pciResetDevice() depending on the place of use
* src/util/pci.c: implement the interface and logic changes

- src/qemu/qemu_driver.c: Eliminate code duplication by using the new
  helpers qemuPrepareHostdevPCIDevices and qemuDomainReAttachHostdevDevices.
  This reduces the number of open coded calls to pciResetDevice.

- src/qemu/qemu_driver.c: These new helpers take hostdev list and count
  directly rather than getting them indirectly from domain definition.
  This will allow reuse for the attach-device case.

- src/qemu/qemu_driver.c: Update qemuGetPciHostDeviceList to take a
  hostdev list and count directly, rather than getting this indirectly
  from domain definition. This will allow reuse for the attach-device case.

Also accept version > 4.1, but output a warning.

Add a pointer to the primary context of a connection and use it in all
driver functions that don't dependent on the context type. This includes
almost all functions that deal with a virDomianPtr. Therefore, using
a vpx:// connection allows you to perform all the usual domain related
actions like start, destroy, suspend, resume, dumpxml etc.

Some functions that require an explicitly specified ESX server don't work
yet. This includes the host UUID, the hostname, the general node info, the
max vCPU count and the free memory. Also not working yet are migration and
defining new domains.

Since 070f6100 the vcenter query
parameter has been ignored, because the refactoring to use
esxUtil_ParseQuery was incomplete. This effectively broke migration,
because the vcenter query parameter is essential for a migration.

This works for file-backed SCSI disk device with a datastore
related source path.

Since 68719c4b virSecurityDriverStartup
takes and additional parameter to control disk format probing.

Pass false as third parameter.

Commit 68719c4b added the disk format
probing option. This makes virt-aa-helper-test fail because the domain
config didn't specifiy the disk format and it didn't pass '-p 1' to
virt-aa-helper to allow disk format probing.

Specify the disk format in the domain config. Pass the '-p 1' option
to virt-aa-helper for the test case with two disks. This way this test
also covers this new option.

Commit 68719c4b added the
p option to control disk format probing, but it wasn't added
to the getopt_long optstring parameter.

Add the p option to the getopt_long optstring parameter.

Commit a8853344 added this
function and wrapped vah_add_file in it. vah_add_file may
return -1, 0, 1. It returns 1 in case the call to valid_path
detects a restricted file. The original code treated a return
value != 0 as error. The refactored code treats a return
value < 0 as error. This triggers segfault in virt-aa-helper
and breaks virt-aa-helper-test for the restricted file tests.

Make sure that add_file_path returns -1 on error.

virt-aa-helper used to ignore errors when opening files.
Commit a8853344 refactored
the related code and changed this behavior. virt-aa-helper
didn't ignore open errors anymore and virt-aa-helper-test
fails.

Make sure that virt-aa-helper ignores open errors again.

* src/remote_protocol-structs: Tweak to match intentional type
change (with no ABI change) in remote protocol.

Thanks to DV for knocking together the Relax-NG changes
quickly for me.

Changes since v1:
 - Change the domain.rng to correspond to the new schema
 - Don't allocate caps->ns in testQemuCapsInit since it is a static table

Changes since v2:
 - Change domain.rng to add restrictions on allowed environment names

Changes since v3:
 - Remove a bogus comment in the tests
Signed-off-by: NChris Lalancette <clalance@redhat.com>

Since we are adding a new "per-hypervisor" protocol, we
make it so that the qemu remote protocol uses a new
PROTOCOL and PROGRAM number.  This allows us to easily
distinguish it from the normal REMOTE protocol.

This necessitates changing the proc in remote_message_header
from a "remote_procedure" to an "unsigned", which should
be the same size (and thus preserve the on-wire protocol).

Changes since v1:
 - Fixed up a couple of script problems in remote_generate_stubs.pl
 - Switch an int flag to a bool in dispatch.c

Changes since v2:
 - None

Changes since v3:
 - Change unsigned proc to signed proc, to conform to spec
Signed-off-by: NChris Lalancette <clalance@redhat.com>

Implement the qemu driver's virDomainQemuMonitorCommand
and hook it into the API entry point.

Changes since v1:
 - Rename the (external) qemuMonitorCommand to qemuDomainMonitorCommand
 - Add virCheckFlags to qemuDomainMonitorCommand

Changes since v2:
 - Drop ATTRIBUTE_UNUSED from the flags

Changes since v3:
 - Add a flag to priv so we only print out monitor command warning once.  Note
   that this has not been plumbed into qemuDomainObjPrivateXMLFormat or
   qemuDomainObjPrivateXMLParse, which means that if you run a monitor command,
   restart libvirtd, and then run another monitor command, you may get an
   an erroneous VIR_INFO.  It's a pretty minor matter, and I didn't think it
   warranted the additional code.
 - Add BeginJob/EndJob calls around EnterMonitor/ExitMonitor
Signed-off-by: NChris Lalancette <clalance@redhat.com>

Add the library entry point for the new virDomainQemuMonitorCommand()
entry point.  Because this is not part of the "normal" libvirt API,
it gets its own header file, library file, and will eventually
get its own over-the-wire protocol later in the series.

Changes since v1:
 - Go back to using the virDriver table for qemuDomainMonitorCommand, due to
   linking issues
 - Added versioning information to the libvirt-qemu.so

Changes since v2:
 - None

Changes since v3:
 - Add LGPL header to libvirt-qemu.c
 - Make virLibConnError and virLibDomainError macros instead of function calls

Changes since v4:
 - Move exported symbols to libvirt_qemu.syms
Signed-off-by: NChris Lalancette <clalance@redhat.com>

Now that we have the ability to specify arbitrary qemu
command-line parameters in the XML, use it to handle unknown
command-line parameters when doing a native-to-xml conversion.

Changes since v1:
 - Rename num_extra to num_args
 - Fix up a memory leak on an error path

Changes since v2:
 - Add a VIR_WARN when adding the argument via qemu:arg

Changes since v3:
 - None
Signed-off-by: NChris Lalancette <clalance@redhat.com>

Implement the qemu hooks for XML namespace data.  This
allows us to specify a qemu XML namespace, and then
specify:

<qemu:commandline>
 <qemu:arg value='arg'/>
 <qemu:env name='name' value='value'/>
</qemu:commandline>

In the domain XML.

Changes since v1:
 - Change the <qemu:arg>arg</qemu:arg> XML to <qemu:arg value='arg'/> XML
 - Fix up some memory leaks in qemuDomainDefNamespaceParse
 - Rename num_extra and extra to num_args and args, respectively
 - Fixed up some error messages
 - Make sure to escape user-provided data in qemuDomainDefNamespaceFormatXML

Changes since v2:
 - Add checking to ensure environment variable names are valid
 - Invert the logic in qemuDomainDefNamespaceFormatXML to return early

Changes since v3:
 - Change strspn() to c_isalpha() check of first letter of environment variable
Signed-off-by: NChris Lalancette <clalance@redhat.com>

This patch adds namespace XML parsers to be hooked into
the main domain parser.  This allows for individual hypervisor
drivers to add per-namespace XML into the main domain XML.

Changes since v1:
 - Use a statically declared table for caps->ns, removing the need to
   allocate/free it.

Changes since v2:
 - None

Changes since v3:
 - None
Signed-off-by: NChris Lalancette <clalance@redhat.com>

When the last callback is removed using domainEventDeregister(), the
events dispatcher is deregistered from the C-library, but
domainEventsCallbacks is still an empty list.
On shutdown __del__() deregisters the dispatacher again, which SEGVs

	# You need the event-loop implementation from the Python examples;
	# give the file a name which is importable by Python.
	ln examples/domain-events/events-python/event-test.py eloop.py
	python -c 'from eloop import *
	import sys

	def dump(*args): print " ".join(map(str, args))

	virEventLoopPureStart()
	c = libvirt.open("xen:///")
	c.domainEventRegister(dump, None)
	c.domainEventDeregister(dump)
	sys.exit(0)'

domainEventDeregister() needs to delete domainEventCallbacks so subsequent
calls to __del__() and domainEventRegister() choose the right code paths.
Setting it to None is not enough, since calling domainEventRegiser() again
would trigger an TypeError.
Signed-off-by: NPhilipp Hahn <hahn@univention.de>

The first conditional is always true which means the iterator will
never find another device on the same bus.

    if (dev->domain != check->domain ||
        dev->bus != check->bus ||
  ----> (check->slot == check->slot &&
         check->function == check->function)) <-----

The goal of that check is to verify that the device is either:

  in a different pci domain
  on a different bus
  is the same identical device

This means libvirt may issue a secondary bus reset when there are
devices
on that bus that actively in use by the host or another guest.

* src/util/pci.c: fix a bogus test in pciSharesBusWithActive()

The remote driver is using the wrong privateData field in
a couple of functions. THis is harmless for stateful
drivers like QEMU/UML/LXC, but will crash with Xen

* src/remote/remote_driver.c: Fix use of privateData field

A Linux software bridge will assume the MAC address of the enslaved
interface with the numerically lowest MAC addr. When the bridge
changes MAC address there is a period of network blackout, so a
change should be avoided. The kernel gives TAP devices a completely
random MAC address. Occassionally the random TAP device MAC is lower
than that of the physical interface (eth0, eth1etc) that is enslaved,
causing the bridge to change its MAC.

This change sets an explicit MAC address for all TAP devices created
using the configured MAC from the XML, but with the high byte set
to 0xFE. This should ensure TAP device MACs are higher than any
physical interface MAC.

* src/qemu/qemu_conf.c, src/uml/uml_conf.c: Pass in a MAC addr
  for the TAP device with high byte set to 0xFE
* src/util/bridge.c, src/util/bridge.h: Set a MAC when creating
  the TAP device to override random MAC

The PCI slot 1 must be reserved at all times, since PIIX3 is
always present, even if no IDE device is in use for guest disks

* src/qemu/qemu_conf.c: Always reserve slot 1 for PIIX3

Init process may remain after sending SIGTERM for some reason.
For example, if original init program is used, it is definitely
not killed by SIGTERM.

* src/lxc/lxc_controller.c: kill with SIGKILL if SIGTERM wasn't
  sufficient

One error exit in virStorageBackendCreateBlockFrom was setting the
return value to errno. The convention for volume build functions is to
return 0 on success or -1 on failure. Not only was it not necessary to
set the return value (it defaults to -1, and is set to 0 when
everything has been successfully completed), in the case that some
caller were checking for < 0 rather than != 0, they would incorrectly
believe that it completed successfully.

virDirCreate also previously returned 0 on success and errno on
failure. This makes it fit the recommended convention of returning 0
on success, -errno (ie a negative number) on failure.

Previously virStorageBackendCopyToFD would simply return -1 on
error. This made the error return from one of its callers inconsistent
(createRawFileOpHook is supposed to return -errno, but if
virStorageBackendCopyToFD failed, createRawFileOpHook would just
return -1). Since there is a useful errno in every case of error
return from virStorageBackendCopyToFD, and since the other uses of
that function ignore the return code (beyond simply checking to see if
it is < 0), this is a safe change.

virFileOperation previously returned 0 on success, or the value of
errno on failure. Although there are other functions in libvirt that
use this convention, the preferred (and more common) convention is to
return 0 on success and -errno (or simply -1 in some cases) on
failure. This way the check for failure is always (ret < 0).

* src/util/util.c - change virFileOperation and virFileOperationNoFork to
                    return -errno on failure.

* src/storage/storage_backend.c, src/qemu/qemu_driver.c
  - change the hook functions passed to virFileOperation to return
    -errno on failure.

* formatdomain.html.in: Document <memballoon> element