The libvirt BlockPull API supports the use of an initial bandwidth limit but the
qemu block_stream API does not.  To get the desired behavior we use the two APIs
strung together: first BlockPull, then BlockJobSetSpeed.  We can do this at the
driver level to avoid duplicated code in each monitor path.
Signed-off-by: NAdam Litke <agl@us.ibm.com>

Due to an unfortunate precedent in qemu, the units for the bandwidth parameter
to block_job_set_speed are different between the text monitor and the qmp
monitor.  While the qmp monitor uses bytes/s, the text monitor expects MB/s.

Correct the units for the text interface.
Signed-off-by: NAdam Litke <agl@us.ibm.com>

On systems with many pcpus, the sexpr returned by xend can be quite
large for dom0 when it is configured to have #vcpus = #pcpus (default).
E.g. on a 80 pcpu system, where dom0 had 80 vcpus, the sexpr details
for dom0 was 73817 bytes!  Increase maximum buffer size to 256k.

xenDaemonDomainFetch() was overwriting errors reported by
xend_get() and xend_req().  E.g. without patch

error: failed Xen syscall xenDaemonDomainFetch failed to find this domain

with patch

error: internal error Xend returned HTTP Content-Length of 73817, which exceeds
maximum of 65536

I'd like to change my primary email address to jfehlig@suse.com.
This patch changes it in AUTHORS and .mailmap.

The 'virsh man' description of send-key was incomplete and used the
old style (literal 'optional name' instead of '[name]' metasyntax).
Meanwhile, none of the other virsh help texts include examples, so
I moved it out of virsh help and into the man page.

* tools/virsh.pod (send-key): Give better details.
* tools/virsh.c (info_send_key): Drop example from here.

Managed save was added in 0.8.0, virDomainCreateWithFlags in 0.8.2,
and FORCE_BOOT in 0.9.5.  The virsh flag is more useful if we
emulate it for all older servers (note that if a hypervisor fails
the query for a managed save image, then it does not have one to
be removed, so the flag can be safely ignored).

* tools/virsh.c (cmdStart): Add emulation for new flag.

* tools/virsh.c: fix memory leak on cmdVolCreateAs function.

* Detected in valgrind run:

==4746==
==4746== 48 (40 direct, 8 indirect) bytes in 1 blocks are definitely lost in loss record 26 of 52
==4746==    at 0x4A04A28: calloc (vg_replace_malloc.c:467)
==4746==    by 0x4C76E51: virAlloc (memory.c:101)
==4746==    by 0x4CD9418: virGetStoragePool (datatypes.c:592)
==4746==    by 0x4D21367: remoteStoragePoolLookupByName (remote_driver.c:4126)
==4746==    by 0x4CE42B0: virStoragePoolLookupByName (libvirt.c:10232)
==4746==    by 0x40C276: vshCommandOptPoolBy (virsh.c:13660)
==4746==    by 0x40CA37: cmdVolCreateAs (virsh.c:8094)
==4746==    by 0x412AF2: vshCommandRun (virsh.c:13770)
==4746==    by 0x422F11: main (virsh.c:15127)
==4746==
==4746== 1,011 bytes in 1 blocks are definitely lost in loss record 45 of 52
==4746==    at 0x4A05FDE: malloc (vg_replace_malloc.c:236)
==4746==    by 0x4A06167: realloc (vg_replace_malloc.c:525)
==4746==    by 0x4C76ECB: virReallocN (memory.c:161)
==4746==    by 0x4C60319: virBufferGrow (buf.c:72)
==4746==    by 0x4C606AA: virBufferAdd (buf.c:106)
==4746==    by 0x40CB37: cmdVolCreateAs (virsh.c:8118)
==4746==    by 0x412AF2: vshCommandRun (virsh.c:13770)
==4746==    by 0x422F11: main (virsh.c:15127)
==4746==
==4746== LEAK SUMMARY:
==4746==    definitely lost: 1,051 bytes in 2 blocks
==4746==    indirectly lost: 8 bytes in 1 blocks
==4746==      possibly lost: 0 bytes in 0 blocks
==4746==    still reachable: 390,767 bytes in 1,373 blocks
==4746==         suppressed: 0 bytes in 0 blocks

* How to reproduce?

% valgrind -v --leak-check=full virsh vol-create-as default foo.img 10M \
  --allocation 0 --format qcow2 --backing-vol bar.img

Notes: bar.img doesn't exist.
Signed-off-by: NAlex Jia <ajia@redhat.com>

Problem introduced by commit b12354be.

* src/remote_protocol-structs: Remove spurious blank line.

Includes impl of python binding since the generator was not
able to cope.

Note: Requires gendispatch.pl patch from Matthias Bolte

https://www.redhat.com/archives/libvir-list/2011-August/msg01367.html

virsh had some leftover 'int flags', and even an 'int flag'
declaration, compared to our preferred style of 'unsigned int flags'.

* tools/virsh.c (cmdUndefine, cmdSave, cmdSaveImageDumpxml)
(cmdSaveImageEdit, cmdManagedSave, cmdRestore, cmdDump)
(cmdVcpuPin, cmdSetvcpus, cmdSetmem, cmdSetmaxmem, cmdDumpXML)
(cmdDomXMLFromNative, cmdDomXMLToNative, doMigrate)
(cmdInterfaceEdit, cmdInterfaceDumpXML, cmdEdit): Match coding
style for flags.
(struct vshComdOptDef): Rename field member.
(vshCmddefOptParse, vshCmddefHelp): Adjust clients.

Commit 2c85644b attempted to
fix a problem with tracking RPC messages from streams by doing

-            if (msg->header.type == VIR_NET_REPLY) {
+            if (msg->header.type == VIR_NET_REPLY ||
+                (msg->header.type == VIR_NET_STREAM &&
+                 msg->header.status != VIR_NET_CONTINUE)) {
                 client->nrequests--;

In other words any stream packet, with status NET_OK or NET_ERROR
would cause nrequests to be decremented. This is great if the
packet from from a synchronous virStreamFinish or virStreamAbort
API call, but wildly wrong if from a server initiated abort.
The latter resulted in 'nrequests' being decremented below zero.
This then causes all I/O for that client to be stopped.

Instead of trying to infer whether we need to decrement the
nrequests field, from the message type/status, introduce an
explicit 'bool tracked' field to mark whether the virNetMessagePtr
object is subject to tracking.

Also add a virNetMessageClear function to allow a message
contents to be cleared out, without adversely impacting the
'tracked' field as a naive memset() would do

* src/rpc/virnetmessage.c, src/rpc/virnetmessage.h: Add
  a 'bool tracked' field and virNetMessageClear() API
* daemon/remote.c, daemon/stream.c, src/rpc/virnetclientprogram.c,
  src/rpc/virnetclientstream.c, src/rpc/virnetserverclient.c,
  src/rpc/virnetserverprogram.c: Switch over to use
  virNetMessageClear() and pass in the 'bool tracked' value
  when creating messages.

When sending outbound stream RPC messages, a callback is
used to re-enable stream data transmission. If the stream
aborts while one of these messages is outstanding, the
stream may have been free'd by the time it is invoked. This
results in a use-after-free error

* daemon/stream.c: Ref-count streams to avoid use-after-free

Parted does not report disk size in 512 byte units, but
rather the disks' logical sector size, which with modern
drives might be 4k.

* src/storage/parthelper.c: Remove hardcoded 512 byte sector
  size

* src/qemu/qemu_driver.c - qemuDomainSaveInternal: Return directly
will keep the domain object locked, introduced by 173015be.

This reverts commit 172214bd.

Commit 0376f4a6 intended to fix incorrect use of VIR_ERR_NO_SUPPORT,
but replacing it with VIR_ERR_OPERATION_INVALID is not proper either.

Introduced by d4b53ef6. For "no internalFlags support", the
error code is changed into INTERNAL_ERROR.

Introduced by 5e495c8b, except the ones for checking if numa
is supported by host, all the NO_SUPPORT are changed back. For
the ones about numa checking, change them into INTERNAL_ERROR.

Fix incorrect changes introduced by commit 6ac47762.

If the libxl driver is compiled in, then everytime libvirtd
starts up on a non-Xen Dom0 host, it logs a error message.
Since this is an expected condition, we should not log at
'error' level, only 'info'.

* src/libxl/libxl_driver.c: Lower log level for certain
  expected errors during driver init

* src/conf/domain_conf.c: Free the 'relabel' attribute

When dispatching domain events we will create an XDR struct
containing the event info. Some of this data may be allocated
on the heap and so must be freed. The graphics event dispatcher
had a broken attempt to free one field, but missed others. All
the events have a dom->name string that needs freeing. The code
should have used the xdr_free() procedure for doing all this

* daemon/remote.c: Use xdr_free after dispatching events

It is possible (expected/likely in Fedora 15) for a cgroup controller
to be mounted in multiple locations at the same time, due to bind
mounts. Currently we leak memory if this happens, because we overwrite
the previous 'mountPoint' string. Instead just accept the first match
we find.

* src/util/cgroup.c: Only accept first match for a cgroup
  controller mount

Regression introduced in commit 18338388.

* src/libvirt_private.syms (security_manager.h): Drop deleted
symbol. Detected by build-bot.

    *daemon/stream.c: remove virNetServerClientRef()

The virSecurityManagerSetProcessFDLabel method was introduced
after a mis-understanding from a conversation about SELinux
socket labelling. The virSecurityManagerSetSocketLabel method
should have been used for all such scenarios.

* src/security/security_apparmor.c, src/security/security_apparmor.c,
  src/security/security_driver.h, src/security/security_manager.c,
  src/security/security_manager.h, src/security/security_selinux.c,
  src/security/security_stack.c: Remove SetProcessFDLabel driver

It is not possible to change the label of a TCP socket once it
has been opened. When creating a TCP socket care must be taken
to ensure the socket creation label is set & then cleared.
Remove the bogus call to virSecurityManagerSetProcessFDLabel
from the lock driver guest setup code and instead make use of
virSecurityManagerSetSocketLabel

The code for creating a sanlock lockspace accidentally used
SANLK_NAME_LEN instead of SANLK_PATH_LEN for a size check.
This meant disk paths were limited to 48 bytes !

* src/locking/lock_driver_sanlock.c: Fix disk path length
  check

There is no reason to forbid pausing an autodestroy domain
(not to mention that 'virsh start --paused --autodestroy'
succeeds in creating a paused autodestroy domain).

Meanwhile, qemu was failing to enforce the API documentation that
autodestroy domains cannot be saved.  And while the original
documentation only mentioned save/restore, snapshots are another
form of saving that are close enough in semantics as to make no
sense on one-shot domains.

* src/qemu/qemu_driver.c (qemudDomainSuspend): Drop bogus check.
(qemuDomainSaveInternal, qemuDomainSnapshotCreateXML): Forbid
saves of autodestroy domains.
* src/libvirt.c (virDomainCreateWithFlags, virDomainCreateXML):
Document snapshot interaction.

According to qemu-kvm/qerror.c all messages start with a capital
"Device ", but the current code only scans for the lower case "device ".
This results in "virDomainUpdateDeviceFlags()" to not detect locked
CD-ROMs and reporting success even in the case of a failure:
	# virsh qemu-monitor-command "$VM" change\ drive-ide0-0-0\ \"/var/lib/libvirt/images/ucs_2.4-0-sec4-20110714145916-dvd-amd64.iso\"
	Device 'drive-ide0-0-0' is locked
	# virsh update-device "$VM" /dev/stdin <<<"<disk type='file' device='cdrom'><driver name='qemu' type='raw'/><source file='/var/lib/libvirt/images/ucs_2.4-0-sec4-20110714145916-dvd-amd64.iso'/><target dev='hda' bus='ide'/><readonly/><alias name='ide0-0-0'/><address type='drive' controller='0' bus='0' unit='0'/></disk>"
	Device updated successfully
Signed-off-by: NPhilipp Hahn <hahn@univention.de>

There have been several instances of people having problems with
a broken managed save file, and not aware that they could use
'virsh managedsave-remove dom' to fix things.  Making it possible
to do this as part of starting a domain makes the same functionality
easier to find, and one less API call.

* include/libvirt/libvirt.h.in (VIR_DOMAIN_START_FORCE_BOOT): New
flag.
* src/libvirt.c (virDomainCreateWithFlags): Document it.
* src/qemu/qemu_driver.c (qemuDomainObjStart): Alter signature.
(qemuAutostartDomain, qemuDomainStartWithFlags): Update callers.
* tools/virsh.c (cmdStart): Expose it in virsh.
* tools/virsh.pod (start): Document it.

Back in 2008 when this line of util.h was written, gnulib's verify
module didn't allow the use of multiple verify() in one file
in combination with our choice of gcc -W options.  But that has
since been fixed in gnulib, and newer gnulib even maps verify()
to the C1x feature of _Static_assert, which gives even nicer
diagnostics with a new enough compiler, so we might as well go
with the simpler verify().

* src/util/util.h (VIR_ENUM_IMPL): Use simpler verify, now that
gnulib module is smarter.

Commit 32617617 made it possible to use pipes instead of sockets
for outgoing tunneled migration; however, it caused a regression
because the pipe was never given a SELinux label.

* src/qemu/qemu_migration.c (doTunnelMigrate): Label outgoing pipe.

The bufferOffset has been initialized to zero in virNetMessageEncodePayloadRaw(),
so, we use bufferLength to represent the length of message which is going to be
sent to client side.

* docs/drvqemu.html.in: Fix typo.
* src/libvirt.c (virDomainCreateXML, virDomainCreateWithFlags):
Likewise.

From: Matthias Bolte <matthias.bolte@googlemail.com>
Tested-by: NJim Fehlig <jfehlig@novell.com>

Matthias provided this patch to fix an issue I encountered in the
generator with APIs containing call-by-ref long type, e.g.

int virDomainMigrateGetMaxSpeed(virDomainPtr domain,
                                unsigned long *bandwidth,
                                unsigned int flags);