Commit 0472f39f plugged a leak, but introduced another bug:

Actually looks like physfndev is conditionally allocated in getPhysfnDev
Its better to modify getPhysfnDev to allocate physfndev every time.

A few people have attempted to use the new forwarding modes with older
versions of libvirt. The docs where the modes are described have
always stated the minimum required libvirt version, but the examples
at the end didn't, which I believe is what has caused the confusion.

Similarly, the section on portgroups now has a version tag added at
the beginning.

I also noticed that there was no example of defining a <dns> hostname,
so I added one, as well as making the domain name example more
recognizable (by adding ".com" to the domain).

Explicitly disallow conflicts between domain name from dxml and dname.

When failing on starting a domain, it tries to reattach all the PCI
devices defined in the domain conf, regardless of whether the devices
are still used by other domain. This will cause the devices to be deleted
from the list qemu_driver->activePciHostdevs, thus the devices will be
thought as usable even if it's not true. And following commands
nodedev-{reattach,reset} will be successful.

How to reproduce:
  1) Define two domains with same PCI device defined in the confs.
  2) # virsh start domain1
  3) # virsh start domain2
  4) # virsh nodedev-reattach $pci_device

You will see the device will be reattached to host successfully.
As pciDeviceReattach just check if the device is still used by
other domain via checking if the device is in list driver->activePciHostdevs,
however, the device is deleted from the list by step 2).

This patch is to prohibit the bug by:
  1) Prohibit a domain starting or device attachment right at
     preparation period (qemuPrepareHostdevPCIDevices) if the
     device is in list driver->activePciHostdevs, which means
     it's used by other domain.

  2) Introduces a new field for struct _pciDevice, (const char *used_by),
     it will be set as the domain name at preparation period,
     (qemuPrepareHostdevPCIDevices). Thus we can prohibit deleting
     the device from driver->activePciHostdevs if it's still used by
     other domain when stopping the domain process.

* src/pci.h (define two internal functions, pciDeviceSetUsedBy and
    pciDevceGetUsedBy)
* src/pci.c (new field "const char *used_by" for struct _pciDevice,
    implementations for the two new functions)
* src/libvirt_private.syms (Add the two new internal functions)
* src/qemu_hostdev.h (Modify the definition of functions
    qemuPrepareHostdevPCIDevices, and qemuDomainReAttachHostdevDevices)
* src/qemu_hostdev.c (Prohibit preparation and don't delete the
    device from activePciHostdevs list if it's still used by other domain)
* src/qemu_hotplug.c (Update function usage, as the definitions are
    changed)
Signed-off-by: NEric Blake <eblake@redhat.com>

virInitialize() → xenRegister() → xenhypervisorInit() determines the
version of the Hypervisor. This breaks xencapstest when building as root
on a dom0 system, since xenHypervisorBuildCapabilities() adds the "hap"
and "viridian" features based on the detected version.

Add an optional parameter to xenhypervisorInit() to disable automatic
detection of the Hypervisor version. The passed in arguments are used
instead.
Signed-off-by: NPhilipp Hahn <hahn@univention.de>

Calling virInitialize() → xenRegister() → xenhypervisorInit() directly
opens a connection to the Xen Hypervisor, which breaks some unit tests.

Move all static variables into a struct to make it easier to override
them when testing.
Signed-off-by: NPhilipp Hahn <hahn@univention.de>

Coverity detected that the only way to get to the cleanup label
is if objectSpec had been successfully allocated, so the null
check was dead code.

* src/esx/esx_vi.c (esxVI_LookupObjectContentByType): Drop
redundant null check.

When defining macros, you can't put comments on the end of the
line because they will get included in the macro definition

* mingw32-libvirt.spec.in: Fix comment about hyperv

Detected by Coverity.  Leak present since commit ca3b22bb.

* src/util/macvtap.c (doPortProfileOp8021Qbh): Release device name.

Detected by Coverity.  Leak introduced in commit 72de0d28.

* src/qemu/qemu_migration.c (qemuMigrationCookieGraphicsXMLParse):
Clean up on success.

Detected by Coverity.  Leak present since commit 874e65aa; and
while commit d50bb45b tried to fix the issue, it missed a path.

* src/conf/domain_conf.c (virDomainDefParseBootXML): Always clean
up useserial.

to escape the netcat command since it's passed to the shell. Adjust
expected test case output accordingly.

Escape strings so they're safe to pass to the shell. It's based on
virsh's cmdEcho.

Based on a patch by Marc Deslauriers <marc.deslauriers@ubuntu.com>

RH: https://bugzilla.redhat.com/show_bug.cgi?id=562176
Ubuntu: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/517478
Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=573172

Detected by Coverity.  Present since commit 82c1740a.

* src/storage/storage_backend_logical.c
(virStorageBackendLogicalMakeVol): Fix leak.

Setting a hostname that cannot be resolved is not the best configuration
but since virGetHostname only calls getaddrinfo to get host's canonical
name and we do not fail if the returned canonical name is NULL or
"localhost", there is no reason why we should fail if getaddrinfo itself
fails.

Otherwise we can end up with a dangling job that can only be cleared by
restarting libvirtd.

Log debug messages anytime we call *BeginJob* or *EndJob* so that it's
easier to spot incorrect usage of domain job APIs.

Detected by Coverity.  p (the pointer to the string) is always true;
when in reality, we wanted to know whether the integer value of the
just-parsed string is '0' or '1'.  Logic bug since commit b1b5b51a.

* src/qemu/qemu_monitor_text.c (qemuMonitorTextGetBlockInfo): Set
results to proper value.

Detected by Coverity.  If, for some reason, our text monitor input
does not match our assumptions, we end up incrementing p while it
is NULL, then dereferencing the pointer 0x1, which will fault.

* src/qemu/qemu_monitor_text.c
(qemuMonitorTextGetBlockStatsParamsNumber): Rewrite to avoid
deref of strchr failure.  Fix indentation.

Detected by Coverity.  Introduced in commit b1b5b51a.

* src/qemu/qemu_monitor_json.c (qemuMonitorJSONGetBlockInfo):
Avoid null dereference.

Coverity complained that most, but not all, clients of virUUIDParse
were checking for errors.  Silence those coverity warnings by
explicitly marking the cases where we trust the input, and fixing
one instance that really should have been checking.  In particular,
this silences a rather large percentage of the warnings I saw on my
most recent Coverity analysis run.

* src/util/uuid.h (virUUIDParse): Enforce rules.
* src/util/uuid.c (virUUIDParse): Drop impossible check; at least
Coverity will detect if we break rules and pass NULL.
* src/xenapi/xenapi_driver.c (xenapiDomainCreateXML)
(xenapiDomainLookupByID, xenapiDomainLookupByName)
(xenapiDomainDefineXML): Ignore return when we trust data source.
* src/vbox/vbox_tmpl.c (nsIDtoChar, vboxIIDToUUID_v3_x)
(vboxCallbackOnMachineStateChange)
(vboxCallbackOnMachineRegistered, vboxStoragePoolLookupByName):
Likewise.
* src/node_device/node_device_hal.c (gather_system_cap): Likewise.
* src/xenxs/xen_sxpr.c (xenParseSxpr): Check for errors.

In virFDStreamOpenFileInternal(), a errfd pipe is opened by
virCommandRunAsync() and given to virFDStreamOpenInternal().

It seems virFDStream should close errfd, just like the other
fd it is given.

This fixes screenshots leaking FDs:
http://bugzilla.redhat.com/show_bug.cgi?id=745761

virCommandTransferFD promises that the fd is no longer owned by
the caller.  Normally, we want the fd to remain open until the
child runs, but in error situations, we must close it earlier.

* src/util/command.c (virCommandTransferFD): Close fd now if we
can't track it to close later.
(virCommandKeepFD): Adjust helper to make this easier.

s/Mouting/Mounting.
Signed-off-by: NSerge Hallyn <serge.hallyn@canonical.com>

* libvirt.spec.in (%configure): Drop unused %{one} macro.
* mingw32-libvirt.spec.in (%{rhel}): Compile ESX but not HyperV on
mingw build for RHEL.
(%build): Make configure honor spec conditionals.  Reorder to
match libvirt.spec.
* autobuild.sh (mingw): Update list to match.
Suggested by Daniel P. Berrange.

358 changes; most probably have no impact on libvirt, but we
might as well stay current.

* .gnulib: Update to latest.

As this is needed. Although some functions check for domain
being active before obtaining job, we need to check it after,
because obtaining job unlocks domain object, during which
a state of domain can be changed.

Currently, push & pop from event queue (both server & client side)
rely on lock from higher levels, e.g. on driver lock (qemu),
private_data (remote), ...; This alone is not sufficient as not
every function that interacts with this queue can/does lock,
esp. in client where we have a different approach, "passing
the buck".

Therefore we need a separate lock just to protect event queue.

For more info see:
https://bugzilla.redhat.com/show_bug.cgi?id=743817

This patch extends qemudDomainCoreDump so it supports new VIR_DUMP_RESET
flag. If this flag is set, domain is reset on successful dump. However,
this is needed to be done after we start CPUs.

This flag is intended to allow user to do so called system reset
after dump, instead of sending ACPI reboot event.

Add support for enabling debug output via command line option.
Allow to toggle the loop implementation between pure-Python and
native-C.
Signed-off-by: NPhilipp Hahn <hahn@univention.de>

When --help is requested, print usage() to stdout.
When an illegal option is passed, print usage to stderr.
Signed-off-by: NPhilipp Hahn <hahn@univention.de>

sys.argv contains the original command line arguments, while args only
contains the arguments not handled by getopt(). Currently this is no
problem since --help is the only command line option passable, which
terminates the process, so the code is never reached. Any option added
in the future will reveal the bug.
Signed-off-by: NPhilipp Hahn <hahn@univention.de>

With the recent refactoring of qemu snapshot relationships, it
is now trivial to filter on leaves.

* src/conf/domain_conf.c (virDomainSnapshotObjListCount)
(virDomainSnapshotObjListCopyNames): Handle new flag.
* src/qemu/qemu_driver.c (qemuDomainSnapshotListNames)
(qemuDomainSnapshotNum, qemuDomainSnapshotListChildrenNames)
(qemuDomainSnapshotNumChildren): Pass new flag through.

Counterpart to --roots.

* include/libvirt/libvirt.h.in (VIR_DOMAIN_SNAPSHOT_LIST_LEAVES):
New flag.
* src/libvirt.c (virDomainSnapshotNum, virDomainSnapshotListNames)
(virDomainSnapshotNumChildren)
(virDomainSnapshotListChildrenNames): Document it.
* tools/virsh.c (cmdSnapshotList): Expose it.
* tools/virsh.pod (snapshot-list): Document --leaves.

For some versions of Xen the difference between "tap" and "tap2" is
important. When converting back from xen-sxpr to libvirt-xml, that
information is lost, which breaks re-defining the domain using that
data.

Explicitly return "tap2" for disks defined as "device/tap2".
Signed-off-by: NPhilipp Hahn <hahn@univention.de>

When PyGrub is used as the bootloader in Xen, it gets passed the first
bootable disk. Xend supports a "bootable"-flag for this, which isn't
explicitly supported by libvirt.
When converting libvirt-xml to xen-sxpr the "bootable"-flag gets
implicitly set by xen.xend.XenConfig.device_add() for the first disk
(marked as "Compat hack -- mark first disk bootable").
When converting back xen-sxpr to libvirt-xml, the disks are returned in
the internal order used by Xend ignoring the "bootable"-flag, which
loses the original order. When the domain is then re-defined, the order
of disks is changed, which breaks PyGrub, since a different disk gets
passed.

When converting xen-sxpr to libvirt-xml, use the "bootable"-flag to
determine the first disk.

This isn't perfect, since several disks can be marked as bootable using
the Xend-API, but that is not supported by libvirt. In all known cases
relevant to libvirt exactly one disk is marked as bootable.
Signed-off-by: NPhilipp Hahn <hahn@univention.de>

AM_TESTS has support for skipping tests, while the C-implementation
virtTestRun() does not support that feature.

Print "_" or "SKIP" in verbose mode for tests returning EXIT_AM_SKIP=77.
Signed-off-by: NPhilipp Hahn <hahn@univention.de>