Don't require iptables-ipv6 on >= F17 and RHEL >= 7

We only need ip6tables, which is now a part of the iptables package:
http://pkgs.fedoraproject.org/cgit/iptables.git/commit/?h=1392835

This needlessly pulls in iptables-services:
https://bugzilla.redhat.com/show_bug.cgi?id=1101510
which can conflict with firewalld:
https://bugzilla.redhat.com/show_bug.cgi?id=1101484
Fix the indentation in libvirt.spec.in

Over 66% of my last commit 66e7061 was not indented properly.
properly indent virSecurityLabelDefsParseXML() parameters

Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
maint: update to latest gnulib

When run under an environment that inherits an ignored SIGPIPE
(hello, annoying buildbots), a syntax-check was producing quite
a bit of noise, such as:

> prohibit_argmatch_without_use
> grep: write error
> grep: write error
> /bin/sed: couldn't write 25 items to stdout: Broken pipe
> sed: couldn't write 1 item to stdout: Broken pipe
> 0.46 prohibit_argmatch_without_use

This has been fixed upstream in gnulib.  There are several other
portability improvements in our regular submodule update.

* .gnulib: Update to latest, in part for quieter syntax-check.

Signed-off-by: Eric Blake <eblake@redhat.com>
qemu: raise an eror when using aio=native without cache=none

Qemu will fallback to aio=threads when the cache mode doesn't use
O_DIRECT, even if aio=native was explictly set.

Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1086704

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
LXC: fix an improper comments for lxcDomainDestroyFlags

Currently @flag is not used yet.

Signed-off-by: Chen Hanxiao <chenhanxiao@cn.fujitsu.com>
libxl: rename goto label

In libxlDomainMigrationPrepare(), the cleanup label handles error
conditions and should be renamed as such for clarity.
libxl: remove domain when migration prepare fails

In libxlDomainMigrationPrepare(), a new virDomainObj is created
from the incoming domain def and added to the driver's domain
list, but never removed if there are subsequent failures during
the prepare phase.

targethost# virsh list --all

sourcehost# virsh migrate --live dom xen+ssh://targethost/system
   error: operation failed: Fail to create socket for incoming migration.

targethost# virsh list --all
error: Failed to list domains
error: name in virGetDomain must not be NULL

After adding code to remove the domain on prepare failure, noticed
that libvirtd crashed due to double free of the virDomainDef.  Similar
to the qemu driver, pass a pointer to virDomainDefPtr so it can be set
to NULL once a virDomainObj is created from it.
libxl: acquire job though begin phase only

During migration, the libxl driver starts a modify job in the
begin phase, ending the job in the confirm phase.  This is
essentially VIR_MIGRATE_CHANGE_PROTECTION semantics, but the
driver does not support that flag.  Without CHANGE_PROTECTION
support, the job would never be terminated in error conditions
where migrate confirm phase is not executed.  Further attempts
to modify the domain would result in failure to acquire a job
after LIBXL_JOB_WAIT_TIME.

Similar to the qemu driver, end the job in the begin phase.
Protecting the domain object across all phases of migration can
be done in a future patch adding CHANGE_PROTECTION support.
libxl: fix crash in migrate confirm for transient domains

In libxlDomainMigrationConfirm(), a transient domain is removed
from the domain list after successful migration.  Later in cleanup,
the domain object is unlocked, resulting in a crash

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fb4208ed700 (LWP 12044)]
0x00007fb4267251e6 in virClassIsDerivedFrom (klass=0xdeadbeef,
  parent=0x7fb42830d0c0) at util/virobject.c:169
169	        if (klass->magic == parent->magic)
(gdb) bt
0  0x00007fb4267251e6 in virClassIsDerivedFrom (klass=0xdeadbeef,
  parent=0x7fb42830d0c0) at util/virobject.c:169
1  0x00007fb42672591b in virObjectIsClass (anyobj=0x7fb4100082b0,
  klass=0x7fb42830d0c0) at util/virobject.c:365
2  0x00007fb42672583c in virObjectUnlock (anyobj=0x7fb4100082b0)
  at util/virobject.c:338
3  0x00007fb41a8c7d7a in libxlDomainMigrationConfirm (driver=0x7fb4100404c0,
  vm=0x7fb4100082b0, flags=1, cancelled=0) at libxl/libxl_migration.c:583

Fix by setting the virDomainObjPtr to NULL after removing it from
the domain list.
Actually fix the spec file

There was a '%' missing before the last {rhel}.
Tested on RHEL-7 this time.
Document the need to free vir*Ptr objects

https://bugzilla.redhat.com/show_bug.cgi?id=994731
Document the need to free vir*Ptr objects per-function

Another patch for
https://bugzilla.redhat.com/show_bug.cgi?id=994731
Allow updating names in DHCP hosts by matching IPs.

Also fix the error message if an IPv6 host with no MAC
is not found.

https://bugzilla.redhat.com/show_bug.cgi?id=991290
util: cgroup: Fix build on non-cgroup platforms

Commit a48f44510098cead629ede9a49ea4e840a28ccca introduced a helper
function to convert cgroup device mode to string. The function was only
conditionally compiled on platforms that support cgroup. This broke the
build when attempting to export the symbol:

  CCLD     libvirt.la
  Cannot export virCgroupGetDevicePermsString: symbol not defined

Move the function out of the ifdef, as it doesn't really depend on the
cgroup code being present.
util: XML: Avoid forward function declaration

Recursive functions apparently don't need them, but I originally thought
they do.
virEventPollDispatchHandles: Honour array boundaries

When dispatching events from the event loop, the array of registered
handles is searched to see what handles happened an event on. However,
the array is searched in weird way: the check for the array boundaries
is at the end, so we may touch the elements after the end of the
array:

==10434== Invalid read of size 4
==10434==    at 0x52D06B6: virEventPollDispatchHandles (vireventpoll.c:486)
==10434==    by 0x52D10E4: virEventPollRunOnce (vireventpoll.c:660)
==10434==    by 0x52CF207: virEventRunDefaultImpl (virevent.c:308)
==10434==    by 0x1639D1: virNetServerRun (virnetserver.c:1139)
==10434==    by 0x1220DC: main (libvirtd.c:1507)
==10434==  Address 0xc11ff04 is 4 bytes after a block of size 960 alloc'd
==10434==    at 0x4C2CA5E: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==10434==    by 0x52AD378: virReallocN (viralloc.c:245)
==10434==    by 0x52AD46E: virExpandN (viralloc.c:294)
==10434==    by 0x52AD5B1: virResizeN (viralloc.c:352)
==10434==    by 0x52CF2EC: virEventPollAddHandle (vireventpoll.c:116)
==10434==    by 0x52CEF5B: virEventAddHandle (virevent.c:78)
==10434==    by 0x11F69A90: nodeStateInitialize (node_device_udev.c:1797)
==10434==    by 0x53C3C89: virStateInitialize (libvirt.c:743)
==10434==    by 0x120563: daemonRunStateInit (libvirtd.c:919)
==10434==    by 0x5317719: virThreadHelper (virthread.c:197)
==10434==    by 0x8376F39: start_thread (in /lib64/libpthread-2.17.so)
==10434==    by 0x8A7F9FC: clone (in /lib64/libc-2.17.so)

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
qemu: cgroup: Add functions to set cgroup image stuff on individual imgs

Add functions that will allow to set all the required cgroup stuff on
individual images taking a virStorageSourcePtr. Also convert functions
designed to setup whole backing chain to take advantage of the change.
qemu: cgroup: Setup only the top level disk image for read-write access

Only the top level gets writes, so the rest of the backing chain
requires only read-only access.
locking: Add APIs to lock individual image files

Add helper APIs to manage individual image files rather than disks. To
simplify the addition some parts of the code were refactored in this
patch.