To enable the CPU XML from the capabilities to be pasted directly
into the guest XML with no editing, pick a sensible default for
match and feature policy. The CPU match will be exact and the
feature policy will be require. This should ensure safety for
migration and give DWIM semantics for users

* src/conf/cpu_conf.c: Default to exact match and require policy
* docs/formatdomain.html.in: Document new defaults

This adds a script to generate the todo item page from
bugzilla. This requires a valid username+password for
bugzilla, so it is intended that this only be run on
the libvirt.org website via cron. Normal usage will just
generate an empty stub page.

* docs/todo.pl: Script to extract todo items from bugzilla
* docs/todo.cfg-example: Example config file
* docs/sitemap.html.in: Add todo page
* docs/Makefile.am: Generation rules for todo items

According to API documentation virDomain{At,De}tachDevice calls are
supposed to only work on active guests for device hotplug. For anything
beyond that, their *Flags variants have to be used.

Despite the variant which was acked on libvirt mailing list
(https://www.redhat.com/archives/libvir-list/2010-January/msg00385.html)
commit ed9c14a7 (by Jim Fehlig)
introduced automagic behavior of these API calls for xen driver. Since
January, these calls always change persistent configuration of a guest
and if the guest is currently active, they also hot(un)plug the device.

That change didn't follow API documentation and also broke device
hot(un)plug for older xend implementations which do not support changing
persistent configuration of a guest and hot(un)plugging in one step.

This patch should not break anything for active guests. On the other
hand, changing inactive guests is not supported any more.

xenXMDomain*DeviceFlags() silently ignores requests to modify live
configuration of an active guest while still touching its persistent
configuration.

When a user calls to virDomain{Attach,Detach,Update}DeviceFlags() with
flags == VIR_DOMAIN_DEVICE_MODIFY_LIVE on an inactive guest running on
an old Xen hypervisor (such as RHEL-5) xend_internal driver reports:

    Xend version does not support modifying persistent config

which is pretty confusing since no-one requested to modify persistent
config.

to avoid long timeouts waiting for DNS servers

This patch adds another example to the nwfilter html page and provides 2 solutions for how to write a filter meeting the given requirements using newly added features.

I am adding a row with information about the newly supported state
attribute to each of the tables describing supported attributes of protocols.

Extend the nwfilter.rng schema to accept state attribute.

This patch adds a test case for testing the XML parser's and instantiator's
support of the state attribute. The other test case tests existing
capabilities. Both test cases will be used in TCK again.

In this patch I am extending the rule instantiator to create the state
match according to the state attribute in the XML. Only one iptables
rule in the incoming or outgoing direction will be created for a rule
in direction 'in' or 'out' respectively. A rule in direction 'inout' does
get iptables rules in both directions.

The patch below extends the XML parser and generator so that every l3 protocol
now can have a state attribute.

* .gnulib: Update to latest, for bootstrap fixes.
* bootstrap: Synchronize with upstream.
* bootstrap.conf: Add pkg-config pre-requisite.
* autogen.sh: Tweak wording message.
Reported by Justin Clift, and with feedback from Bruno Haible.

The xm internal xen driver only supports disk and network devices to be
added to a guest. On an attempt to attach any other device the xm driver
used VIR_ERR_XML_ERROR which resulted in a completely bogus error
message:

error: Failed to attach device from pci.xml
error: XML description for unknown device is not well formed or invalid

Disabling these two drivers on MacOS X, where they are known to
not work, allows libvirt (including the daemon) to compile without
any further changes.

Fixing memory leak shown by valgrind and freeing buffer in two more places.

Since version 4.1 ESX(i) can expose virtual serial devices over TCP.

Add support in the VMX handling code for this, add test cases to cover
it and add links to some documentation.

ESX supports two additional protocols: TELNETS and TLS. Add them to
the list of serial-over-TCP protocols.

The <vcpu cpuset=...> attribute has been available since commit
e193b5dd, but without documentation or RNG validation.

* docs/schemas/domain.rng (vcpu): Further validate cpuset.
* docs/formatdomain.html.in: Document it.
* src/conf/domain_conf.c: Fix typos.

phypBuildLpar expects that at least one disk element is provided.

Don't cat | sed, just sed.  Suggested by Eric Blake.

Description: Implement AppArmorSetSecurityHostdevLabel() and
AppArmorRestoreSecurityHostdevLabel() for hostdev and pcidev attach.

virt-aa-helper also has to be adjusted because *FileIterate() is used for pci
and usb devices and the corresponding XML for hot attached hostdev and pcidev
is not in the XML passed to virt-aa-helper. The new '-F filename' option is
added to append a rule to the profile as opposed to the existing '-f
filename', which rewrites the libvirt-<uuid>.files file anew. This new '-F'
option will append a rule to an existing libvirt-<uuid>.files if it exists,
otherwise it acts the same as '-f'.

load_profile() and reload_profile() have been adjusted to add an 'append'
argument, which when true will use '-F' instead of '-f' when executing
virt-aa-helper.

All existing calls to load_profile() and reload_profile() have been adjusted
to use the old behavior (ie append==false) except AppArmorSetSavedStateLabel()
where it made sense to use the new behavior.

This patch also adds tests for '-F'.

Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/640993

This patch adds a test case for testing the XML parser's and instantiator's
support of the comment attribute.

I am adding a row with information about the newly supported comment
attribute to each of the tables describing supported attributes of protocols.

Extend the nwfilter.rng schema to accept comment attributes for all protocol
types.

In this patch I am extending the rule instantiator to create the comment
node where supported, which is the case for iptables and ip6tables.

Since commands are written in the format

cmd='iptables ...-m comment --comment \"\" '

certain characters ('`) in the comment need to be escaped to
prevent comments from becoming commands themselves or cause other
forms of (bash) substitutions. I have tested this with various input and in
my tests the input made it straight into the comment. A test case for TCK
will be provided separately that tests this.

The patch below extends the XML parser and generator so that every protocol
now can have a comment node. Comments are limited to 256 characters.

Partial reversion of commit 76d87a59, now that bootstrap is smarter.

* .gnulib: Update to latest, for poll and bootstrap fixes.
* bootstrap: Resync from gnulib.
* autogen.sh: Drop redundant tool checks; bootstrap does them
better, by honoring environment variables.
* examples/domain-events/events-c/Makefile.am (INCLUDES)
(event_test_LDADD): Use gnulib library during build.
* bootstrap.conf (gnulib_tool_option_extras): Revert --libtool
addition, now that updated bootstrap does it for us.
Reported by Justin Clift.

When creating a new gust, the function phypBuildLpar() was not
checking for NULL values

src/phyp/phyp_driver.c: check the definition arguments to avoid a segmentation
  fault in phypBuildLpar()

This fixes a small logic bug, where passing --without-macvtap
on the configure line, or otherwise indicating a lack of
support for macvtap, causes configure to bail.

The configure script was breaking on MacOS X unless passed:

  --without-storage-mpath

This patch leverages Stefan Bergers earlier work for nwfilter,
so non-linux systems don't even attempt to build multipath.

In this patch I am reworking the logic around detecting virtual port support and requiring the libnl dependency.

- It requires --with-macvtap and displays an error in case of --without-macvtap --with-virtualport.
- It tests for availability of certain data in include files and displays an error in case the include file is not at the correct level and --with-virtualport was chosen
- displays 'checking' messages for macvtap and virtualport support and results
- libnl support is required when macvtap is found or requested; if libnl is not there, please supply without-macvtap

Prior to this patch, the ChangeLog generation was hard coded to use
"awk", when it should have been using the AWK variable set by our
build system.

This breaks compilation on a newly installed OS X system, where the
default path has the Mac (non GNU) awk in the default search PATH
before any installed GNU awk (gawk).

This reverses commit 04c3704e, which added a define to nwfilter to
allow libvirtd compilation on Mac OS X.  Stefan Bergers commit, 2e7294df,
is the proper solution, removing the requirement for nwfilter on non-Linux.

Mac OS X provides an "/Applications" folder, not an "/Application" folder,
so installed VirtualBox wasn't being detected by default.

This 1 character patch fixes this.

Since 554d82a2, conn is unused. Let's
drop it - but keep the signature of the constructor for backward
compatibility.

Don't compile the nwfilter driver (instantiating the rules) on other systems than Linux.

The nwfilter code uses ETH_ALEN, which isn't defined on MacOS X.
This is a simple workaround, to add it when missing.

The patch below reports a warning in the log if the generated ip(6)tables rules would not be effective due to the proc filesystem entries

    /proc/sys/net/bridge/bridge-nf-call-iptables
    /proc/sys/net/bridge/bridge-nf-call-ip6tables

containing a '0'. The warning tells the user what to do. I am rate-limiting the warning message to appear only every 10 seconds.