qemu: add separate rerror_policy for disk errors

Previously libvirt's disk device XML only had a single attribute,
error_policy, to control both read and write error policy, but qemu
has separate options for controlling read and write. In one case
(enospc) a policy is allowed for write errors but not read errors.

This patch adds a separate attribute that sets only the read error
policy. If just error_policy is set, it will apply to both read and
write error policy (previous behavior), but if the new rerror_policy
attribute is set, it will override error_policy for read errors only.
Possible values for rerror_policy are "stop", "report", and "ignore"
("report" is the qemu-controlled default for rerror_policy when
error_policy isn't specified).

For consistency, the value "report" has been added to the possible
values for error_policy as well.

docs/formatdomain.html.in

@@ -1008,9 +1008,21 @@
           </li>
           <li>
             The optional <code>error_policy</code> attribute controls
-            how the hypervisor will behave on an error, possible
-            values are "stop", "ignore", and "enospace".
-            <span class="since">Since 0.8.0</span>
+            how the hypervisor will behave on a disk read or write
+            error, possible values are "stop", "report", "ignore", and
+            "enospace".<span class="since">Since 0.8.0, "report" since
+            0.9.7</span> The default setting of error_policy is "report".
+            There is also an
+            optional <code>rerror_policy</code> that controls behavior
+            for read errors only. <span class="since">Since
+            0.9.7</space>. If no rerror_policy is given, error_policy
+            is used for both read and write errors. If rerror_policy
+            is given, it overrides the <code>error_policy</code> for
+            read errors. Also note that "enospace" is not a valid
+            policy for read errors, so if <code>error_policy</code> is
+            set to "enospace" and no <code>rerror_policy</code> is
+            given, the read error policy will be left at its default,
+            which is "report".
           </li>
           <li>
             The optional <code>io</code> attribute controls specific

docs/schemas/domaincommon.rng

@@ -819,6 +819,9 @@
       <optional>
         <ref name="driverErrorPolicy"/>
       </optional>
+      <optional>
+        <ref name="driverRerrorPolicy"/>
+      </optional>
       <optional>
         <ref name="driverIO"/>
       </optional>
@@ -856,11 +859,21 @@
     <attribute name="error_policy">
       <choice>
         <value>stop</value>
+        <value>report</value>
         <value>ignore</value>
         <value>enospace</value>
       </choice>
     </attribute>
   </define>
+  <define name="driverRerrorPolicy">
+    <attribute name="rerror_policy">
+      <choice>
+        <value>stop</value>
+        <value>report</value>
+        <value>ignore</value>
+      </choice>
+    </attribute>
+  </define>
   <define name="driverIO">
     <attribute name="io">
       <choice>