When start a guest with --pass-fd, if the argument of --pass-fd is invalid,
virsh will exit, but doesn't free the variable 'dom'.

The valgrind said:
...
==24569== 63 (56 direct, 7 indirect) bytes in 1 blocks are definitely lost in loss record 130 of 234
==24569==    at 0x4C2A1D4: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==24569==    by 0x4E879A4: virAllocVar (viralloc.c:544)
==24569==    by 0x4EBD625: virObjectNew (virobject.c:190)
==24569==    by 0x4F3A18A: virGetDomain (datatypes.c:226)
==24569==    by 0x4F9311F: remoteDomainLookupByName (remote_driver.c:6636)
==24569==    by 0x4F44F20: virDomainLookupByName (libvirt.c:2277)
==24569==    by 0x12F616: vshCommandOptDomainBy (virsh-domain.c:105)
==24569==    by 0x131C79: cmdStart (virsh-domain.c:3330)
==24569==    by 0x12C4AB: vshCommandRun (virsh.c:1752)
==24569==    by 0x127001: main (virsh.c:3218)

https://bugzilla.redhat.com/show_bug.cgi?id=1067338Signed-off-by: NJincheng Miao <jmiao@redhat.com>
Signed-off-by: NEric Blake <eblake@redhat.com>

Destroying a suspended domain needs special action.
We cannot simply terminate all process because they are frozen.
Do deal with that we send them SIGKILL and thaw them.
Upon wakeup the process sees the pending signal and dies immediately.
Signed-off-by: NRichard Weinberger <richard@nod.at>

IN6ADDR_ANY_INIT does not seem to be working as expected on MinGW:
error: missing braces around initializer [-Werror=missing-braces]
         .sin6_addr = IN6ADDR_ANY_INIT,

Use the in6addr_any variable instead.

Reported by Daniel P. Berrange.

Currently, networkRunHook() is called in networkAllocateActualDevice and
friends. These functions, however, doesn't necessarily work on networks,
For example, if domain's interface is defined in this fashion:

    <interface type='bridge'>
      <mac address='52:54:00:0b:3b:16'/>
      <source bridge='virbr1'/>
      <model type='rtl8139'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x09' function='0x0'/>
    </interface>

The networkAllocateActualDevice jumps directly onto 'validate' label as
the interface is not type of 'network'. Hence, @network is left
initialized to NULL and networkRunHook(network, ...) is called. One of
the things that the hook function does is dereference @network. Soupir.
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>

Modify operation that needs to wait in the queue of modify jobs.
Signed-off-by: NJim Fehlig <jfehlig@suse.com>

Setting autostart is a modify operation that needs to wait in the
queue of modify jobs.
Signed-off-by: NJim Fehlig <jfehlig@suse.com>

These operations aren't necessarily time consuming, but need to
wait in the queue of modify jobs.
Signed-off-by: NJim Fehlig <jfehlig@suse.com>

These operations aren't necessarily time consuming, but need to
wait in the queue of modify jobs.
Signed-off-by: NJim Fehlig <jfehlig@suse.com>

Dumping a domain's core can take considerable time.  Use the
recently added job functions and unlock the virDomainObj while
dumping core.
Signed-off-by: NJim Fehlig <jfehlig@suse.com>

Saving domain memory and cpu state can take considerable time.
Use the recently added job functions and unlock the virDomainObj
while saving the domain.
Signed-off-by: NJim Fehlig <jfehlig@suse.com>

When explicitly destroying a domain (libxlDomainDestroyFlags), or
handling an out-of-band domain shutdown event, cleanup the domain
in the context of a job.  Introduce libxlVmCleanupJob to wrap
libxlVmCleanup in a job block.

These operations aren't necessarily time consuming, but need to
wait in the queue of modify jobs.
Signed-off-by: NJim Fehlig <jfehlig@suse.com>

Large balloon operation can be time consuming.  Use the recently
added job functions and unlock the virDomainObj while ballooning.
Signed-off-by: NJim Fehlig <jfehlig@suse.com>

Creating a large domain could potentially be time consuming.  Use the
recently added job functions and unlock the virDomainObj while
the create operation is in progress.
Signed-off-by: NJim Fehlig <jfehlig@suse.com>

Follows the pattern used in the QEMU driver for managing multiple,
simultaneous jobs within the driver.
Signed-off-by: NJim Fehlig <jfehlig@suse.com>

This function, which only has five call sites, simply calls
libxl_domain_destroy and libxlVmCleanup.  Call those functions
directly at the call sites, allowing more control over how a
domain is destroyed and cleaned up.  This patch maintains the
existing semantic, leaving changes to a subsequent patch.
Signed-off-by: NJim Fehlig <jfehlig@suse.com>

Once a domain has reached the shutdown state, set its ID to -1.
Signed-off-by: NJim Fehlig <jfehlig@suse.com>

This patch changes network device type used by default from rtl8139
to virtio when architecture type is aarch64 and machine type is virt.
Qemu doesn't support any other machine types for aarch64 right now and
we can't make any other aarch64-specific tuning in this function yet.
Signed-off-by: NOleg Strikov <oleg.strikov@canonical.com>

At this point it has a limited functionality and is highly
experimental. Supported domain operations are:

  * define
  * start
  * destroy
  * dumpxml
  * dominfo

It's only possible to have only one disk device and only one
network, which should be of type bridge.

There is no keyboard working on PPC64 and PS2 mouse is only for X86
when graphics are enabled.

Add a USB keyboard and USB mouse for PPC64 when graphics are enabled.
Signed-off-by: NLi Zhang <zhlcindy@linux.vnet.ibm.com>
Signed-off-by: NJán Tomko <jtomko@redhat.com>

Signed-off-by: NLi Zhang <zhlcindy@linux.vnet.ibm.com>
Signed-off-by: NJán Tomko <jtomko@redhat.com>

Format qemu command line for USB keyboard
and add test cases for it.
Signed-off-by: NLi Zhang <zhlcindy@linux.vnet.ibm.com>
Signed-off-by: NJán Tomko <jtomko@redhat.com>

Add USB keyboard capability probing and test cases.
Signed-off-by: NLi Zhang <zhlcindy@linux.vnet.ibm.com>
Signed-off-by: NJán Tomko <jtomko@redhat.com>

PS2 devices only work on X86 platform, other platforms may need
USB devices instead. Athough it doesn't influence the QEMU command line,
it's not right to add PS2 mouse/keyboard for non-X86 platform.
Signed-off-by: NLi Zhang <zhlcindy@linux.vnet.ibm.com>
Signed-off-by: NJán Tomko <jtomko@redhat.com>

There is no keyboard support currently in libvirt.

For some platforms (PPC64 QEMU) this makes graphics unusable,
since the keyboard is not implicit and it can't be added via libvirt.
Signed-off-by: NLi Zhang <zhlcindy@linux.vnet.ibm.com>
Signed-off-by: NJán Tomko <jtomko@redhat.com>

Use it for the default mouse.
Signed-off-by: NLi Zhang <zhlcindy@linux.vnet.ibm.com>
Signed-off-by: NJán Tomko <jtomko@redhat.com>

The networkNotifyActualDevice function is accepting two arguments, not
one:

qemu/qemu_process.c: In function 'qemuProcessNotifyNets':
qemu/qemu_process.c:2776:47: error: macro "networkNotifyActualDevice" passed 2 arguments, but takes just 1
         if (networkNotifyActualDevice(def, net) < 0)
                                               ^
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>

aebbcdd3 didn't change the non-linux definition of the function,
breaking the build on FreeBSD:

../../src/util/virinitctl.c:164: error: conflicting types for
'virInitctlSetRunLevel'
../../src/util/virinitctl.h:40: error: previous declaration of
'virInitctlSetRunLevel' was here

Basically, the idea is copied from domain code, where tainting
exists for a while. Currently, only one taint reason exists -
VIR_NETWORK_TAINT_HOOK to mark those networks which caused invoking
of hook script.
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>

There might be some use cases, where user wants to prepare the host or
its environment prior to starting a network and do some cleanup after
the network has been shut down. Consider all the functionality that
libvirt doesn't currently have as an example what a hook script can
possibly do.
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>

In the next patch I'm going to need the network format function that
takes virBuffer as argument. However, slightly change of name is more
appropriate then: virNetworkDefFormatBuf to match the rest of functions
that format an object to buffer.
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>

Rewrite multiple hotunplug functions to to use the
virProcessRunInMountNamespace helper. This avoids
risk of a malicious guest replacing /dev with an absolute
symlink, tricking the driver into changing the host OS
filesystem.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

Rewrite lxcDomainAttachDeviceHostdevMiscLive function
to use the virProcessRunInMountNamespace helper. This avoids
risk of a malicious guest replacing /dev with a absolute
symlink, tricking the driver into changing the host OS
filesystem.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

Rewrite lxcDomainAttachDeviceHostdevStorageLive function
to use the virProcessRunInMountNamespace helper. This avoids
risk of a malicious guest replacing /dev with a absolute
symlink, tricking the driver into changing the host OS
filesystem.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

Rewrite lxcDomainAttachDeviceHostdevSubsysUSBLive function
to use the virProcessRunInMountNamespace helper. This avoids
risk of a malicious guest replacing /dev with a absolute
symlink, tricking the driver into changing the host OS
filesystem.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

Rewrite lxcDomainAttachDeviceDiskLive function to use the
virProcessRunInMountNamespace helper. This avoids risk of
a malicious guest replacing /dev with a absolute symlink,
tricking the driver into changing the host OS filesystem.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

Use helper virProcessRunInMountNamespace in lxcDomainShutdownFlags and
lxcDomainReboot.  Otherwise, a malicious guest could use symlinks
to force the host to manipulate the wrong file in the host's namespace.

Idea by Dan Berrange, based on an initial report by Reco
<recoverym4n@gmail.com> at
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=732394Signed-off-by: NEric Blake <eblake@redhat.com>

Implement virProcessRunInMountNamespace, which runs callback of type
virProcessNamespaceCallback in a container namespace. This uses a
child process to run the callback, since you can't change the mount
namespace of a thread. This implies that callbacks have to be careful
about what code they run due to async safety rules.

Idea by Dan Berrange, based on an initial report by Reco
<recoverym4n@gmail.com> at
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=732394Signed-off-by: NDaniel Berrange <berrange@redhat.com>
Signed-off-by: NEric Blake <eblake@redhat.com>

Add a helper function which takes a file path and ensures
that all directory components leading up to the file exist.
IOW, it strips the filename part of the path and passes
the result to virFileMakePath.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The check for whether the cgroup devices ACL is available is
done quite late during LXC hotplug - in fact after the device
node is already created in the container in some cases. Better
to do it upfront so we fail immediately.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>