When qemuMonitorCloseFileHandle is called in error path, we need to
preserve the original error since a possible further error when running
closefd monitor command is not very useful to users.

When creating new qemu process we saved domain status XML only after the
process was fully setup and running. In case libvirtd was killed before
the whole process finished, once libvirtd started again it didn't know
anything about the new process and we end up with an orphaned qemu
process. Let's save the domain status XML as soon as we know the PID so
that libvirtd can kill the process on restart.

The compiler might optimize based on our declaration that something
is unused.  Putting that declaration in the header risks getting
out of sync with the actual implementation, so it belongs better
only in the .c files.  We were mostly compliant, and a new syntax
check will help us in the future.

* cfg.mk (sc_avoid_attribute_unused_in_header): New syntax check.
* src/nodeinfo.h (nodeGetCPUStats, nodeGetMemoryStats): Delete
attribute already present in .c file.
* src/qemu/qemu_domain.h (qemuDomainEventFlush): Likewise.
* src/util/virterror_internal.h (virReportErrorHelper): Parameters
are actually used by .c file.
* src/xenxs/xen_sxpr.h (xenFormatSxprDisk): Adjust prototype.
* src/xenxs/xen_sxpr.c (xenFormatSxprDisk): Delete unused argument.
(xenFormatSxpr): Adjust caller.
* src/xen/xend_internal.c (xenDaemonAttachDeviceFlags)
(xenDaemonUpdateDeviceFlags): Likewise.
Suggested by Daniel Veillard.

* src/remote/remote_driver.c (call, remoteOpenSecondaryDriver):
Prefer unsigned flags.

For static functions not used as callbacks, there's no need to
keep an unused parameter.

* src/conf/domain_conf.c (virDomainChrDefParseTargetXML)
(virDomainTimerDefParseXML, virDomainHostdevSubsysUsbDefParseXML)
(virDomainVcpuPinDefParseXML): Drop unused parameter.
(virDomainChrDefParseXML, virDomainDefParseXML)
(virDomainHostdevDefParseXML): Update callers.
(virDomainNetDefParseXML): Mark flags used.

In 2f4d2496 I didn't notice that one
part of virFileOpenAs doesn't actually call to virFileOpenAsNoFork but
rather includes a copy of the code from there.

No need to repeat common code.

* bootstrap.conf (gnulib_modules): Import calloc-posix.
* src/util/bridge.c (brInit): Use virSetCloseExec.
(brSetInterfaceUp): Adjust flags name.
* src/uml/uml_driver.c (umlSetCloseExec): Delete.
(umlStartVMDaemon): Use util version instead.

* src/conf/cpu_conf.h (virCPUDefFormat, virCPUDefFormatBuf):
Change flags type.
* src/conf/cpu_conf.c (virCPUDefFormat, virCPUDefFormatBuf):
Likewise.
* src/conf/storage_conf.c (_virStoragePoolOptions): Likewise.
* src/datatypes.h (_virConnect, _virStream): Likewise.

'unsigned a' and 'unsigned int a' are synonyms, but we generally
always spell out the 'int' in that case.  Fixing this will avoid
a false positive in the next syntax-check commit.

* src/conf/node_device_conf.h (pci_config_address)
(_virNodeDevCapsDef): Prefer 'unsigned int' over 'unsigned'.

* src/xenapi/xenapi_driver.c (xenapiOpen, xenapiDomainReboot):
Reject unknown flags.
(xenapiDomainGetXMLDesc): Likewise, and pass known flags through
to XML generation.

* src/vmware/vmware_driver.c (vmwareOpen, vmwareDomainReboot)
(vmwareDomainCreateXML, vmwareDomainCreateWithFlags): Reject
unknown flags.

* src/vbox/vbox_driver.c (vboxOpenDummy): Reject unknown flags.
* src/vbox/vbox_tmpl.c (vboxOpen, vboxDomainReboot)
(vboxNetworkOpen, vboxNetworkGetXMLDesc, vboxStorageOpen)
(vboxStorageVolCreateXML, vboxStorageVolDelete)
(vboxStorageVolGetXMLDesc, vboxDomainScreenshot): Likewise.

* src/uml/uml_driver.c (umlOpen, umlDomainGetXMLDesc)
(umlDomainBlockPeek): Reject unknown flags.

* src/test/test_driver.c (testOpen, testDomainCoreDump)
(testOpenNetwork, testNetworkGetXMLDesc, testOpenInterface)
(testInterfaceChangeBegin, testInterfaceChangeCommit)
(testInterfaceChangeRollback, testInterfaceGetXMLDesc)
(testInterfaceDefineXML, testInterfaceCreate)
(testInterfaceDestroy, testStorageOpen, testStoragePoolStart)
(testStorageFindPoolSources, testStoragePoolCreate)
(testStoragePoolDefine, testStoragePoolBuild)
(testStoragePoolDelete, testStoragePoolRefresh)
(testStoragePoolGetXMLDesc, testStorageVolumeCreateXML)
(testStorageVolumeCreateXMLFrom, testStorageVolumeDelete)
(testStorageVolumeGetXMLDesc, testDevMonOpen)
(testNodeNumOfDevices, testNodeListDevices)
(testNodeDeviceGetXMLDesc, testNodeDeviceCreateXML)
(testSecretOpen, testNWFilterOpen): Reject unknown flags.

* src/qemu/qemu_driver.c (qemudOpen, qemuDomainScreenshot)
(qemuDomainXMLFromNative, qemuDomainXMLToNative)
(qemudDomainBlockPeek, qemuCPUCompare, qemuCPUBaseline): Reject
unknown flags.
* src/qemu/qemu_migration.c (qemuMigrationConfirm): Likewise.
(_qemuMigrationCookie, qemuMigrationCookieXMLParse)
(qemuMigrationCookieXMLParseStr, qemuMigrationBakeCookie)
(qemuMigrationEatCookie): Make flags unsigned.
* src/qemu/qemu_domain.h: (qemuDomainDefFormatXML)
(qemuDomainFormatXML): Prefer unsigned flags.
* src/qemu/qemu_domain.c (qemuDomainDefFormatXML)
(qemuDomainFormatXML): Likewise.
(qemuDomainOpenLogHelper, qemuDomainCreateLog): Rename variable.

* src/phyp/phyp_driver.c (phypOpen, phypDomainReboot)
(phypVIOSDriverOpen): Reject unknown flags.

* src/openvz/openvz_driver.c (openvzDomainReboot, openvzOpen):
Reject unknown flags.

* src/lxc/lxc_driver.c (lxcOpen, lxcDomainSetMemoryParameters)
(lxcDomainGetMemoryParameters): Reject unknown flags.
* src/lxc/lxc_container.c (lxcContainerStart): Rename flags to
cflags to reflect that it is not tied to libvirt.

* src/libxl/libxl_driver.c (libxlOpen, libxlDomainReboot)
(libxlDomainXMLFromNative, libxlDomainXMLToNative)
(libxlDomainCreateWithFlags): Reject unknown flags.

While compiling on F15 build crashed (probably because of new GCC).

* src/storage/storage_backend.c (virStorageBackendCreateBlockFrom)
(virStorageBackendCreateQemuImg)
(virStorageBackendCreateQcowCreate): Reject unknown flags.
* src/storage/storage_backend_disk.c (virStorageBackendDiskBuildPool)
(virStorageBackendDiskDeleteVol): Likewise.
* src/storage/storage_backend_fs.c
(virStorageBackendFileSystemNetFindPoolSources)
(virStorageBackendFileSystemBuild)
(virStorageBackendFileSystemDelete, createFileDir)
(virStorageBackendFileSystemVolBuildFrom)
(virStorageBackendFileSystemVolDelete): Likewise.
* src/storage/storage_backend_iscsi.c
(virStorageBackendISCSIFindPoolSources): Likewise.
* src/storage/storage_backend_logical.c
(virStorageBackendLogicalFindPoolSources)
(virStorageBackendLogicalBuildPool)
(virStorageBackendLogicalDeletePool)
(virStorageBackendLogicalDeleteVol): Likewise.
* src/storage/storage_driver.c (storageOpen, storagePoolCreate)
(storagePoolDefine, storagePoolRefresh, storagePoolGetXMLDesc)
(storageVolumeCreateXML, storageVolumeCreateXMLFrom)
(storageVolumeGetXMLDesc): Likewise.

* src/node_device/node_device_driver.c (nodeNumOfDevices)
(nodeListDevices, nodeDeviceGetXMLDesc, nodeDeviceCreateXML):
Reject unknown flags.
* src/node_device/node_device_hal.c (halNodeDrvOpen): Likewise.
* src/node_device/node_device_udev.c (udevNodeDrvOpen): Likewise.

Silently ignored flags get in the way of new features that
use those flags.  Also, an upcoming syntax check will favor
unsigned flags.

* src/nodeinfo.h (nodeGetCPUStats, nodeGetMemoryStats): Drop
unused attribute.
* src/interface/netcf_driver.c (interfaceOpenInterface)
(interfaceDefineXML, interfaceCreate, interfaceDestroy): Reject
unknown flags.
* src/network/bridge_driver.c (networkOpenNetwork)
(networkGetXMLDesc): Likewise.
* src/nwfilter/nwfilter_driver.c (nwfilterOpen): Likewise.
* src/secret/secret_driver.c (secretOpen, secretDefineXML)
(secretGetXMLDesc, secretSetValue): Likewise.
* src/util/logging.c (virLogDefineFilter, virLogDefineOutput)
(virLogMessage): Likewise; also use unsigned flags.
* src/util/logging.h (virLogDefineFilter, virLogDefineOutput)
(virLogMessage): Change signature.
* src/util/command.c (virExecWithHook): Likewise.

Like commit 1740c381, but for libvirt-qemu.

* src/remote/qemu_protocol.x (qemu_monitor_command_args): Adjust
type to match API.
* src/qemu_protocol-structs: Update accordingly.

Continuation of commit 313ac7fd, and enforce things with a syntax
check.

Technically, virNetServerClientCalculateHandleMode is not printing
a mode_t, but rather a collection of VIR_EVENT_HANDLE_* bits;
however, these bits are < 8, so there is no different in the
output, and that was the easiest way to silence the new syntax check.

* cfg.mk (sc_flags_debug): New syntax check.
(exclude_file_name_regexp--sc_flags_debug): Add exemptions.
* src/fdstream.c (virFDStreamOpenFileInternal): Print flags in
hex, mode_t in octal.
* src/libvirt-qemu.c (virDomainQemuMonitorCommand)
(virDomainQemuAttach): Likewise.
* src/locking/lock_driver_nop.c (virLockManagerNopInit): Likewise.
* src/locking/lock_driver_sanlock.c (virLockManagerSanlockInit):
Likewise.
* src/locking/lock_manager.c: Likewise.
* src/qemu/qemu_migration.c: Likewise.
* src/qemu/qemu_monitor.c: Likewise.
* src/rpc/virnetserverclient.c
(virNetServerClientCalculateHandleMode): Print mode with %o.

I got bit in a debugging session on an uninstalled libvirtd; the
code tried to call out to the installed $LIBEXECDIR/libvirt_iohelper
instead of my just-built version.  So I set a breakpoint and altered
the binary name to be "./src/libvirt_iohelper", and it still failed
because I don't have "." on my PATH.

According to POSIX, execvp only searches PATH if the name does
not contain a slash.  Since we are trying to mimic that behavior,
an anchored name should be relative to the current working dir.

This tightens existing behavior, but most callers already pass
an absolute name or a name with no slashes, so it probably won't
be noticeable.

* src/util/util.c (virFindFileInPath): Anchored relative names do
not invoke a PATH search.

When replacing the default SEGV/ABORT/BUS signal handlers you
can't rely on the process being terminated after your custom
handler runs. It is neccessary to manually restore the default
handler and then re-raise the signal

* src/rpc/virnetserver.c: Restore default handler and raise
  signal

* src/rpc/virnetserverprogram.h: Remove unused typedef for
  virNetServerProgramErrorHander function callback
* daemon/remote.h: Remove decl for non-existant variables

When monitor is entered with qemuDomainObjEnterMonitorWithDriver, the
correct method for leaving and unlocking the monitor is
qemuDomainObjExitMonitorWithDriver.

Most of the code in these two functions is supposed to be identical but
currently it isn't (which is natural since the code is duplicated).
Let's move common parts of these functions into qemuMigrationPrepareAny.

This also fixes qemuMigrationPrepareTunnel which didn't store received
lockState in the domain object.

Asynchronous jobs may take long time to finish and may consist of
several phases which we need to now about to help with recovery/rollback
after libvirtd restarts.

Detect and react on situations when libvirtd was restarted or killed
when a job was active.

If libvirtd is restarted when a job is running, the new libvirtd process
needs to know about that to be able to recover and rollback the
operation.

Query commands are safe to be called during long running jobs (such as
migration). This patch makes them all work without the need to
special-case every single one of them.

The patch introduces new job.asyncCond condition and associated
job.asyncJob which are dedicated to asynchronous (from qemu monitor
point of view) jobs that can take arbitrarily long time to finish while
qemu monitor is still usable for other commands.

The existing job.active (and job.cond condition) is used all other
synchronous jobs (including the commands run during async job).

Locking schema is changed to use these two conditions. While asyncJob is
active, only allowed set of synchronous jobs is allowed (the set can be
different according to a particular asyncJob) so any method that
communicates to qemu monitor needs to check if it is allowed to be
executed during current asyncJob (if any). Once the check passes, the
method needs to normally acquire job.cond to ensure no other command is
running. Since domain object lock is released during that time, asyncJob
could have been started in the meantime so the method needs to recheck
the first condition. Then, normal jobs set job.active and asynchronous
jobs set job.asyncJob and optionally change the list of allowed job
groups.

Since asynchronous jobs only set job.asyncJob, other allowed commands
can still be run when domain object is unlocked (when communicating to
remote libvirtd or sleeping). To protect its own internal synchronous
commands, the asynchronous job needs to start a special nested job
before entering qemu monitor. The nested job doesn't check asyncJob, it
only acquires job.cond and sets job.active to block other jobs.

EnterMonitor and ExitMonitor methods are very similar to their
*WithDriver variants; consolidate them into EnterMonitorInternal and
ExitMonitorInternal to avoid (mainly future) code duplication.

This avoids code duplication and also avoids relying on good luck that
ignore_value(virDomainObjUnref(obj)) doesn't set errno.

The UML inotify handler would kill off guests when certain
conditions arise, but it forgot to remove transient guests
from the list of domains

* src/uml/uml_driver.c: Cleanup transient guests

* src/uml/uml_driver.c: Add audit hooks

* src/lxc/lxc_driver.c: Add auditing hooks