Rebased to version 0.9.6.4

CVE-2013-0170 libvirt: use-after-free in virNetMessageFree() (bz #893450, bz #905173)

libvirt-0.8.8-Requires-gettext-for-client-package.patch

@@ -1,40 +0,0 @@
-From e03899ff772cb753f02ecc99c81776a95c8e3d59 Mon Sep 17 00:00:00 2001
-From: Osier Yang <jyang@redhat.com>
-Date: Fri, 18 Feb 2011 13:45:13 +0800
-Subject: [PATCH 2/6] Requires gettext for client package
-
-https://bugzilla.redhat.com/show_bug.cgi?id=680270
-libvirt-client is missing some dependencies
-
-libvirt-guests invokes functions in gettext.sh, so we need to
-require gettext package in spec file.
-
-Demo with the fix:
-% rpm -q gettext
-package gettext is not installed
-
-% rpm -ivh libvirt-client-0.8.8-1.fc14.x86_64.rpm
-error: Failed dependencies:
-	gettext is needed by libvirt-client-0.8.8-1.fc14.x86_64
-
-* libvirt.spec.in
----
- libvirt.spec.in |    2 ++
- 1 files changed, 2 insertions(+), 0 deletions(-)
-
-diff --git a/libvirt.spec.in b/libvirt.spec.in
-index d4208e8..c08b186 100644
---- a/libvirt.spec.in
-+++ b/libvirt.spec.in
-@@ -415,6 +415,8 @@ Requires: ncurses
- # So remote clients can access libvirt over SSH tunnel
- # (client invokes 'nc' against the UNIX socket on the server)
- Requires: nc
-+# Needed by libvirt-guests init script.
-+Requires: gettext
- %if %{with_sasl}
- Requires: cyrus-sasl
- # Not technically required, but makes 'out-of-box' config
--- 
-1.7.3.4
-

libvirt-0.8.8-avoid-resetting-errors.patch

@@ -1,51 +0,0 @@
-From 2c2ae4c48c7e57fd233f1b9475fb6ecbab04804a Mon Sep 17 00:00:00 2001
-From: Jiri Denemark <jdenemar@redhat.com>
-Date: Fri, 25 Mar 2011 16:45:45 +0100
-Subject: [PATCH 2/2] daemon: Avoid resetting errors before they are reported
-
-https://bugzilla.redhat.com/show_bug.cgi?id=690733
-
-Commit f44bfb7 was supposed to make sure no additional libvirt API (esp.
-*Free) is called before remoteDispatchConnError() is called on error.
-However, the patch missed two instances.
-(cherry picked from commit 55cc591fc18e87b29febf78dc5b424b7c12f7349)
----
- daemon/remote.c |    6 ++++--
- 1 files changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/daemon/remote.c b/daemon/remote.c
-index 554e75e..159430e 100644
---- a/daemon/remote.c
-+++ b/daemon/remote.c
-@@ -4868,12 +4868,13 @@ remoteDispatchStoragePoolListVolumes (struct qemud_server *server ATTRIBUTE_UNUS
-     ret->names.names_len =
-         virStoragePoolListVolumes (pool,
-                                    ret->names.names_val, args->maxnames);
--    virStoragePoolFree(pool);
-     if (ret->names.names_len == -1) {
-         VIR_FREE(ret->names.names_val);
-         remoteDispatchConnError(rerr, conn);
-+        virStoragePoolFree(pool);
-         return -1;
-     }
-+    virStoragePoolFree(pool);
- 
-     return 0;
- }
-@@ -4897,11 +4898,12 @@ remoteDispatchStoragePoolNumOfVolumes (struct qemud_server *server ATTRIBUTE_UNU
-     }
- 
-     ret->num = virStoragePoolNumOfVolumes (pool);
--    virStoragePoolFree(pool);
-     if (ret->num == -1) {
-         remoteDispatchConnError(rerr, conn);
-+        virStoragePoolFree(pool);
-         return -1;
-     }
-+    virStoragePoolFree(pool);
- 
-     return 0;
- }
--- 
-1.7.3.4
-

libvirt-0.8.8-build-add-dependency-on-gnutls-utils.patch

@@ -1,30 +0,0 @@
-From 29680e00f67bad9145387022ea0d3c307465d3dc Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Mon, 21 Feb 2011 10:43:29 -0700
-Subject: [PATCH 4/6] build: add dependency on gnutls-utils
-
-https://bugzilla.redhat.com/show_bug.cgi?id=680270
-libvirt-client is missing some dependencies
-
-* libvirt.spec.in (Requires): Add gnutls-utils, for virt-pki-validate.
-Suggested by Daniel P. Berrange.
----
- libvirt.spec.in |    2 ++
- 1 files changed, 2 insertions(+), 0 deletions(-)
-
-diff --git a/libvirt.spec.in b/libvirt.spec.in
-index c08b186..23f4525 100644
---- a/libvirt.spec.in
-+++ b/libvirt.spec.in
-@@ -417,6 +417,8 @@ Requires: ncurses
- Requires: nc
- # Needed by libvirt-guests init script.
- Requires: gettext
-+# Needed by virt-pki-validate script.
-+Requires: gnutls-utils
- %if %{with_sasl}
- Requires: cyrus-sasl
- # Not technically required, but makes 'out-of-box' config
--- 
-1.7.3.4
-

libvirt-0.8.8-kernel-boot-index.patch

@@ -1,27 +0,0 @@
-commit efc2594b4e0cbcdd6947fafeeed41accd5b611e0
-Author: Jim Fehlig <jfehlig@novell.com>
-Date:   Thu Feb 17 14:22:55 2011 -0700
-
-    Do not add drive 'boot=on' param when a kernel is specified
-    
-    libvirt-tck was failing several domain tests [1] with qemu 0.14, which
-    is now less tolerable of specifying 2 bootroms with the same boot index [2].
-    
-    Drop the 'boot=on' param if kernel has been specfied.
-    
-    [1] https://www.redhat.com/archives/libvir-list/2011-February/msg00559.html
-    [2] http://lists.nongnu.org/archive/html/qemu-devel/2011-02/msg01892.html
-
-diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
-index 371a7ed..0db2843 100644
---- a/src/qemu/qemu_command.c
-+++ b/src/qemu/qemu_command.c
-@@ -3173,7 +3173,7 @@ qemuBuildCommandLine(virConnectPtr conn,
-         int bootCD = 0, bootFloppy = 0, bootDisk = 0;
- 
-         /* If QEMU supports boot=on for -drive param... */
--        if (qemuCmdFlags & QEMUD_CMD_FLAG_DRIVE_BOOT) {
-+        if (qemuCmdFlags & QEMUD_CMD_FLAG_DRIVE_BOOT && !def->os.kernel) {
-             for (i = 0 ; i < def->os.nBootDevs ; i++) {
-                 switch (def->os.bootDevs[i]) {
-                 case VIR_DOMAIN_BOOT_CDROM:

libvirt-0.8.8-make-commandtest-more-robust.patch

@@ -1,32 +0,0 @@
-From 12509c09a55bd2ab171f9fa029fb94f297adc0a0 Mon Sep 17 00:00:00 2001
-From: Daniel P. Berrange <berrange@redhat.com>
-Date: Thu, 24 Feb 2011 12:12:27 +0000
-Subject: [PATCH] Make commandtest more robust wrt its execution environment
-
-When executed from cron, commandtest would fail to correctly
-identify daemon processes. Set session ID and process group
-IDs at startup to ensure we have a consistent environment to
-run in.
-
-* tests/commandtest.c: Call setsid() and setpgid()
----
- tests/commandtest.c |    3 +++
- 1 files changed, 3 insertions(+), 0 deletions(-)
-
-diff --git a/tests/commandtest.c b/tests/commandtest.c
-index 7157c51..dc2f8a1 100644
---- a/tests/commandtest.c
-+++ b/tests/commandtest.c
-@@ -730,6 +730,9 @@ mymain(int argc, char **argv)
-     if (chdir("/tmp") < 0)
-         return(EXIT_FAILURE);
- 
-+    setpgid(0, 0);
-+    setsid();
-+
-     /* Kill off any inherited fds that might interfere with our
-      * testing.  */
-     fd = 3;
--- 
-1.7.3.4
-

libvirt-0.8.8-read-only-checks.patch

@@ -1,95 +0,0 @@
-From: Guido Günther <agx@sigxcpu.org>
-Date: Mon, 14 Mar 2011 02:56:28 +0000 (+0800)
-Subject: Add missing checks for read only connections
-X-Git-Url: http://libvirt.org/git/?p=libvirt.git;a=commitdiff_plain;h=71753cb7f7a16ff800381c0b5ee4e99eea92fed3;hp=13c00dde3171b3a38d23cceb3f9151cb6cac3dad
-
-Add missing checks for read only connections
-
-As pointed on CVE-2011-1146, some API forgot to check the read-only
-status of the connection for entry point which modify the state
-of the system or may lead to a remote execution using user data.
-The entry points concerned are:
-  - virConnectDomainXMLToNative
-  - virNodeDeviceDettach
-  - virNodeDeviceReAttach
-  - virNodeDeviceReset
-  - virDomainRevertToSnapshot
-  - virDomainSnapshotDelete
-
-* src/libvirt.c: fix the above set of entry points to error on read-only
-                 connections
----
-
-diff --git a/src/libvirt.c b/src/libvirt.c
-index caa109d..713291f 100644
---- a/src/libvirt.c
-+++ b/src/libvirt.c
-@@ -3321,6 +3321,10 @@ char *virConnectDomainXMLToNative(virConnectPtr conn,
-         virDispatchError(NULL);
-         return NULL;
-     }
-+    if (conn->flags & VIR_CONNECT_RO) {
-+        virLibDomainError(VIR_ERR_OPERATION_DENIED, __FUNCTION__);
-+        goto error;
-+    }
- 
-     if (nativeFormat == NULL || domainXml == NULL) {
-         virLibConnError(VIR_ERR_INVALID_ARG, __FUNCTION__);
-@@ -9748,6 +9752,11 @@ virNodeDeviceDettach(virNodeDevicePtr dev)
-         return -1;
-     }
- 
-+    if (dev->conn->flags & VIR_CONNECT_RO) {
-+        virLibConnError(VIR_ERR_OPERATION_DENIED, __FUNCTION__);
-+        goto error;
-+    }
-+
-     if (dev->conn->driver->nodeDeviceDettach) {
-         int ret;
-         ret = dev->conn->driver->nodeDeviceDettach (dev);
-@@ -9791,6 +9800,11 @@ virNodeDeviceReAttach(virNodeDevicePtr dev)
-         return -1;
-     }
- 
-+    if (dev->conn->flags & VIR_CONNECT_RO) {
-+        virLibConnError(VIR_ERR_OPERATION_DENIED, __FUNCTION__);
-+        goto error;
-+    }
-+
-     if (dev->conn->driver->nodeDeviceReAttach) {
-         int ret;
-         ret = dev->conn->driver->nodeDeviceReAttach (dev);
-@@ -9836,6 +9850,11 @@ virNodeDeviceReset(virNodeDevicePtr dev)
-         return -1;
-     }
- 
-+    if (dev->conn->flags & VIR_CONNECT_RO) {
-+        virLibConnError(VIR_ERR_OPERATION_DENIED, __FUNCTION__);
-+        goto error;
-+    }
-+
-     if (dev->conn->driver->nodeDeviceReset) {
-         int ret;
-         ret = dev->conn->driver->nodeDeviceReset (dev);
-@@ -13131,6 +13150,10 @@ virDomainRevertToSnapshot(virDomainSnapshotPtr snapshot,
-     }
- 
-     conn = snapshot->domain->conn;
-+    if (conn->flags & VIR_CONNECT_RO) {
-+        virLibConnError(VIR_ERR_OPERATION_DENIED, __FUNCTION__);
-+        goto error;
-+    }
- 
-     if (conn->driver->domainRevertToSnapshot) {
-         int ret = conn->driver->domainRevertToSnapshot(snapshot, flags);
-@@ -13177,6 +13200,10 @@ virDomainSnapshotDelete(virDomainSnapshotPtr snapshot,
-     }
- 
-     conn = snapshot->domain->conn;
-+    if (conn->flags & VIR_CONNECT_RO) {
-+        virLibConnError(VIR_ERR_OPERATION_DENIED, __FUNCTION__);
-+        goto error;
-+    }
- 
-     if (conn->driver->domainSnapshotDelete) {
-         int ret = conn->driver->domainSnapshotDelete(snapshot, flags);

libvirt-0.8.8-remote-protect-against-integer-overflow.patch

@@ -1,115 +0,0 @@
-From 9388aeabcbb06ec93845b6d066148ad4cfe1dd9e Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Fri, 24 Jun 2011 12:16:05 -0600
-Subject: [PATCH 6/6] remote: protect against integer overflow
-
-https://bugzilla.redhat.com/show_bug.cgi?id=717204
-CVE-2011-2511 - integer overflow in VirDomainGetVcpus
-
-Integer overflow and remote code are never a nice mix.
-
-This has existed since commit 56cd414.
-
-* src/libvirt.c (virDomainGetVcpus): Reject overflow up front.
-* src/remote/remote_driver.c (remoteDomainGetVcpus): Avoid overflow
-  on sending rpc.
-* daemon/remote.c (remoteDispatchDomainGetVcpus): Avoid overflow on
-  receiving rpc.
-
-(cherry picked from commit 774b21c163845170c9ffa873f5720d318812eaf6)
-
-Conflicts:
-
-	daemon/remote.c
-	src/remote/remote_driver.c
-
-Change to internal.h required to avoid backporting 89d994ad.
----
- daemon/remote.c            |    3 ++-
- src/internal.h             |   17 +++++++++++++++++
- src/libvirt.c              |    5 +++--
- src/remote/remote_driver.c |    3 ++-
- 4 files changed, 24 insertions(+), 4 deletions(-)
-
-diff --git a/daemon/remote.c b/daemon/remote.c
-index 159430e..b707326 100644
---- a/daemon/remote.c
-+++ b/daemon/remote.c
-@@ -1722,7 +1722,8 @@ remoteDispatchDomainGetVcpus (struct qemud_server *server ATTRIBUTE_UNUSED,
-         return -1;
-     }
- 
--    if (args->maxinfo * args->maplen > REMOTE_CPUMAPS_MAX) {
-+    if (INT_MULTIPLY_OVERFLOW(args->maxinfo, args->maplen) ||
-+        args->maxinfo * args->maplen > REMOTE_CPUMAPS_MAX) {
-         virDomainFree(dom);
-         remoteDispatchFormatError (rerr, "%s", _("maxinfo * maplen > REMOTE_CPUMAPS_MAX"));
-         return -1;
-diff --git a/src/internal.h b/src/internal.h
-index e263684..f47b842 100644
---- a/src/internal.h
-+++ b/src/internal.h
-@@ -232,6 +232,23 @@
-         }                                                               \
-     } while (0)
- 
-+/* branch-specific: we don't want to update gnulib on the branch, so this
-+ * backports just one required macro from newer gnulib's intprops.h.
-+ * This version requires that both a and b are 'int', rather than
-+ * the fully type-generic version from gnulib.  */
-+# define INT_MULTIPLY_OVERFLOW(a, b)            \
-+    ((b) < 0                                    \
-+     ? ((a) < 0                                 \
-+        ? (a) < INT_MAX / (b)                   \
-+        : (b) == -1                             \
-+        ? 0                                     \
-+        : INT_MIN / (b) < (a))                  \
-+     : (b) == 0                                 \
-+     ? 0                                        \
-+     : ((a) < 0                                 \
-+        ? (a) < INT_MIN / (b)                   \
-+        : INT_MAX / (b) < (a)))
-+
- /* divide value by size, rounding up */
- # define VIR_DIV_UP(value, size) (((value) + (size) - 1) / (size))
- 
-diff --git a/src/libvirt.c b/src/libvirt.c
-index 8c70a1f..d8ab8f8 100644
---- a/src/libvirt.c
-+++ b/src/libvirt.c
-@@ -40,6 +40,7 @@
- #include "util.h"
- #include "memory.h"
- #include "configmake.h"
-+#include "intprops.h"
- 
- #ifndef WITH_DRIVER_MODULES
- # ifdef WITH_TEST
-@@ -5363,8 +5364,8 @@ virDomainGetVcpus(virDomainPtr domain, virVcpuInfoPtr info, int maxinfo,
- 
-     /* Ensure that domainGetVcpus (aka remoteDomainGetVcpus) does not
-        try to memcpy anything into a NULL pointer.  */
--    if ((cpumaps == NULL && maplen != 0)
--        || (cpumaps && maplen <= 0)) {
-+    if (!cpumaps ? maplen != 0
-+        : (maplen <= 0 || INT_MULTIPLY_OVERFLOW(maxinfo, maplen))) {
-         virLibDomainError(VIR_ERR_INVALID_ARG, __FUNCTION__);
-         goto error;
-     }
-diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c
-index 4ca0d3b..c73452e 100644
---- a/src/remote/remote_driver.c
-+++ b/src/remote/remote_driver.c
-@@ -2850,7 +2850,8 @@ remoteDomainGetVcpus (virDomainPtr domain,
-                     maxinfo, REMOTE_VCPUINFO_MAX);
-         goto done;
-     }
--    if (maxinfo * maplen > REMOTE_CPUMAPS_MAX) {
-+    if (INT_MULTIPLY_OVERFLOW(maxinfo, maplen) ||
-+        maxinfo * maplen > REMOTE_CPUMAPS_MAX) {
-         remoteError(VIR_ERR_RPC,
-                     _("vCPU map buffer length exceeds maximum: %d > %d"),
-                     maxinfo * maplen, REMOTE_CPUMAPS_MAX);
--- 
-1.7.3.4
-

libvirt-0.8.8-rpm-add-missing-dependencies.patch

@@ -1,99 +0,0 @@
-From 775581ead9c0b6435e8a0dad2a6838909638e7b6 Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Wed, 23 Mar 2011 10:30:49 -0600
-Subject: [PATCH 5/6] rpm: add missing dependencies
-
-manually adapted from upstream 206fc979b1656722b254e683d89b3e9fc4480c63
-
-Among others, the missing radvd dependency showed up as:
-
-error: Failed to start network ipv6net
-error: Cannot find radvd - Possibly the package isn't installed: No such file
-or directory
-
-even when radvd was installed, because the RADVD preprocessor
-symbol was missing at configure time.
-
-* libvirt.spec.in (with_network): Add Build and BuildRequires for radvd
-    (BuildRequires): Add libxslt and augeas for docs and test.
-    (with_libvirtd): Add module-init-tools for modprobe.
-    (with_nwfilter): Add BuildRequires for ebtables.
----
- libvirt.spec.in |   26 ++++++++++++++++++++++++--
- 1 files changed, 24 insertions(+), 2 deletions(-)
-
-diff --git a/libvirt.spec.in b/libvirt.spec.in
-index 23f4525..8ffb757 100644
---- a/libvirt.spec.in
-+++ b/libvirt.spec.in
-@@ -219,15 +219,21 @@ Requires: %{name}-client = %{version}-%{release}
- # daemon is present
- %if %{with_libvirtd}
- Requires: bridge-utils
-+# for modprobe of pci devices
-+Requires: module-init-tools
-+# for /sbin/ip
-+Requires: iproute
- %endif
- %if %{with_network}
- Requires: dnsmasq >= 2.41
-+Requires: radvd
-+%endif
-+%if %{with_network} || %{with_nwfilter}
- Requires: iptables
-+Requires: iptables-ipv6
- %endif
- %if %{with_nwfilter}
- Requires: ebtables
--Requires: iptables
--Requires: iptables-ipv6
- %endif
- # needed for device enumeration
- %if %{with_hal}
-@@ -295,10 +301,15 @@ BuildRequires: xmlrpc-c-devel >= 1.14.0
- %endif
- BuildRequires: libxml2-devel
- BuildRequires: xhtml1-dtds
-+BuildRequires: libxslt
- BuildRequires: readline-devel
- BuildRequires: ncurses-devel
- BuildRequires: gettext
- BuildRequires: gnutls-devel
-+%if 0%{?fedora} >= 12 || 0%{?rhel} >= 6
-+# for augparse, optionally used in testing
-+BuildRequires: augeas
-+%endif
- %if %{with_hal}
- BuildRequires: hal-devel
- %endif
-@@ -323,8 +334,15 @@ BuildRequires: libselinux-devel
- %endif
- %if %{with_network}
- BuildRequires: dnsmasq >= 2.41
-+BuildRequires: iptables
-+BuildRequires: iptables-ipv6
-+BuildRequires: radvd
-+%endif
-+%if %{with_nwfilter}
-+BuildRequires: ebtables
- %endif
- BuildRequires: bridge-utils
-+BuildRequires: module-init-tools
- %if %{with_sasl}
- BuildRequires: cyrus-sasl-devel
- %endif
-@@ -388,7 +406,11 @@ BuildRequires: libssh2-devel
- BuildRequires: netcf-devel >= 0.1.4
- %endif
- %if %{with_esx}
-+%if 0%{?fedora} >= 9 || 0%{?rhel} >= 6
- BuildRequires: libcurl-devel
-+%else
-+BuildRequires: curl-devel
-+%endif
- %endif
- %if %{with_audit}
- BuildRequires: audit-libs-devel
--- 
-1.7.3.4
-

libvirt-0.8.8-security-plug-regression-introduced-in-disk-probe-lo.patch

@@ -1,40 +0,0 @@
-From c2d77ade37ee917ca258cb24ffb130fc07bb95b4 Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Thu, 26 May 2011 08:18:46 -0600
-Subject: [PATCH 1/6] security: plug regression introduced in disk probe logic
-
-This patch resolves:
-
-  https://bugzilla.redhat.com/show_bug.cgi?id=709775
-  CVE-2011-2178 - regression introduced in disk probe logic
-
-Regression introduced in commit d6623003 (v0.8.8) - using the
-wrong sizeof operand meant that security manager private data
-was overlaying the allowDiskFormatProbing member of struct
-_virSecurityManager.  This reopens disk probing, which was
-supposed to be prevented by the solution to CVE-2010-2238.
-
-* src/security/security_manager.c
-(virSecurityManagerGetPrivateData): Use correct offset.
----
- src/security/security_manager.c |    4 +++-
- 1 files changed, 3 insertions(+), 1 deletions(-)
-
-diff --git a/src/security/security_manager.c b/src/security/security_manager.c
-index 0246dd8..6f0becd 100644
---- a/src/security/security_manager.c
-+++ b/src/security/security_manager.c
-@@ -107,7 +107,9 @@ virSecurityManagerPtr virSecurityManagerNew(const char *name,
- 
- void *virSecurityManagerGetPrivateData(virSecurityManagerPtr mgr)
- {
--    return ((char*)mgr) + sizeof(mgr);
-+    /* This accesses the memory just beyond mgr, which was allocated
-+     * via VIR_ALLOC_VAR earlier.  */
-+    return mgr + 1;
- }
- 
- 
--- 
-1.7.3.4
-

libvirt-0.8.8-virt-pki-validate-behave-when-CERTTOOL-is-missing.patch

@@ -1,27 +0,0 @@
-From 9679cde15cabf95c7538c3b6929893ec68552d23 Mon Sep 17 00:00:00 2001
-From: Dan Kenigsberg <danken@redhat.com>
-Date: Sun, 20 Feb 2011 22:29:25 +0200
-Subject: [PATCH 3/6] virt-pki-validate: behave when CERTTOOL is missing
-
-https://bugzilla.redhat.com/show_bug.cgi?id=680270
-libvirt-client is missing some dependencies
----
- tools/virt-pki-validate.in |    2 +-
- 1 files changed, 1 insertions(+), 1 deletions(-)
-
-diff --git a/tools/virt-pki-validate.in b/tools/virt-pki-validate.in
-index 207fa76..96659cf 100755
---- a/tools/virt-pki-validate.in
-+++ b/tools/virt-pki-validate.in
-@@ -14,7 +14,7 @@ PORT=16514
- # First get certtool
- #
- CERTOOL=`which certtool 2>/dev/null`
--if [ ! -x $CERTOOL ]
-+if [ ! -x "$CERTOOL" ]
- then
-     echo "Could not locate the certtool program"
-     echo "make sure the gnutls-utils (or gnutls-bin) package is installed"
--- 
-1.7.3.4
-

libvirt-add-default-spice-channel.patch

@@ -0,0 +1,184 @@
+From a9311c363defcba7479fdabfb4862bcf851a6b7c Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Tue, 8 May 2012 20:42:44 +0300
+Subject: [PATCH] domain_conf: add "default" to list of valid spice channels
+
+qemu's behavior in this case is to change the spice server behavior to
+require secure connection to any channel not otherwise specified as
+being in plaintext mode. libvirt doesn't currently allow requesting this
+(via plaintext-channel=<channel name>).
+
+RHBZ: 819499
+
+Signed-off-by: Alon Levy <alevy@redhat.com>
+(cherry picked from commit ba97e4edc6aa439a4f1e70855cf4503181efdb7f)
+
+Conflicts:
+
+	src/conf/domain_conf.c
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ docs/formatdomain.html.in                          |    7 +++++++
+ docs/schemas/domaincommon.rng                      |    9 +++++++++
+ src/conf/domain_conf.c                             |   20 ++++++++++++++++++++
+ src/conf/domain_conf.h                             |    1 +
+ src/qemu/qemu_command.c                            |   13 +++++++++++++
+ .../qemuxml2argv-graphics-spice.args               |    2 +-
+ .../qemuxml2argv-graphics-spice.xml                |    2 +-
+ 7 files changed, 52 insertions(+), 2 deletions(-)
+
+diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
+index d082697..db5fa9b 100644
+--- a/docs/formatdomain.html.in
++++ b/docs/formatdomain.html.in
+@@ -2308,6 +2308,13 @@ qemu-kvm -net nic,model=? /dev/null
+               <span class="since">Since 0.9.3</span>
+               NB, this may not be supported by all hypervisors.
+               <span class="since">"spice" since 0.8.6</span>.
++              The <code>defaultMode</code> attribute sets the default channel
++              security policy, valid values are <code>secure</code>,
++              <code>insecure</code> and the default <code>any</code>
++              (which is secure if possible, but falls back to insecure
++              rather than erroring out if no secure path is
++              available). <span class="since">"defaultMode" since
++              0.9.12</span>.
+             </p>
+             <p>
+               When SPICE has both a normal and TLS secured TCP port
+diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
+index fe81c26..0d6edc8 100644
+--- a/docs/schemas/domaincommon.rng
++++ b/docs/schemas/domaincommon.rng
+@@ -1388,6 +1388,15 @@
+               </choice>
+             </attribute>
+           </optional>
++          <optional>
++            <attribute name="defaultMode">
++              <choice>
++                <value>any</value>
++                <value>secure</value>
++                <value>insecure</value>
++              </choice>
++            </attribute>
++          </optional>
+           <interleave>
+             <ref name="listenElements"/>
+             <zeroOrMore>
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index 9cc1644..963768e 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -4689,6 +4689,8 @@ virDomainGraphicsDefParseXML(xmlNodePtr node,
+         char *port = virXMLPropString(node, "port");
+         char *tlsPort;
+         char *autoport;
++        char *defaultMode;
++        int defaultModeVal;
+ 
+         if (port) {
+             if (virStrToLong_i(port, NULL, 10, &def->data.spice.port) < 0) {
+@@ -4726,6 +4728,20 @@ virDomainGraphicsDefParseXML(xmlNodePtr node,
+             VIR_FREE(autoport);
+         }
+ 
++        def->data.spice.defaultMode = VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_ANY;
++
++        if ((defaultMode = virXMLPropString(node, "defaultMode")) != NULL) {
++            if ((defaultModeVal = virDomainGraphicsSpiceChannelModeTypeFromString(defaultMode)) < 0) {
++                virDomainReportError(VIR_ERR_INTERNAL_ERROR,
++                                     _("unknown default spice channel mode %s"),
++                                     defaultMode);
++                VIR_FREE(defaultMode);
++                goto error;
++            }
++            def->data.spice.defaultMode = defaultModeVal;
++            VIR_FREE(defaultMode);
++        }
++
+         def->data.spice.keymap = virXMLPropString(node, "keymap");
+ 
+         if (virDomainGraphicsAuthDefParseXML(node, &def->data.spice.auth,
+@@ -10311,6 +10327,10 @@ virDomainGraphicsDefFormat(virBufferPtr buf,
+             virBufferEscapeString(buf, " keymap='%s'",
+                                   def->data.spice.keymap);
+ 
++        if (def->data.spice.defaultMode != VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_ANY)
++            virBufferAsprintf(buf, " defaultMode='%s'",
++              virDomainGraphicsSpiceChannelModeTypeToString(def->data.spice.defaultMode));
++
+         virDomainGraphicsAuthDefFormatAttr(buf, &def->data.spice.auth, flags);
+         break;
+ 
+diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
+index d40fda6..f6df0ea 100644
+--- a/src/conf/domain_conf.h
++++ b/src/conf/domain_conf.h
+@@ -921,6 +921,7 @@ struct _virDomainGraphicsDef {
+             virDomainGraphicsAuthDef auth;
+             unsigned int autoport :1;
+             int channels[VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_LAST];
++            int defaultMode; /* enum virDomainGraphicsSpiceChannelMode */
+             int image;
+             int jpeg;
+             int zlib;
+diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
+index 366913b..ee192d3 100644
+--- a/src/qemu/qemu_command.c
++++ b/src/qemu/qemu_command.c
+@@ -4720,6 +4720,7 @@ qemuBuildCommandLine(virConnectPtr conn,
+         const char *listenAddr = NULL;
+         char *netAddr = NULL;
+         int ret;
++        int defaultMode = def->graphics[0]->data.spice.defaultMode;
+ 
+         if (!qemuCapsGet(qemuCaps, QEMU_CAPS_SPICE)) {
+             qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+@@ -4781,6 +4782,18 @@ qemuBuildCommandLine(virConnectPtr conn,
+             virBufferAsprintf(&opt, ",x509-dir=%s",
+                               driver->spiceTLSx509certdir);
+ 
++        switch (defaultMode) {
++        case VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_SECURE:
++            virBufferAsprintf(&opt, ",tls-channel=default");
++            break;
++        case VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_INSECURE:
++            virBufferAsprintf(&opt, ",plaintext-channel=default");
++            break;
++        case VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_ANY:
++            /* nothing */
++            break;
++        }
++
+         for (i = 0 ; i < VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_LAST ; i++) {
+             int mode = def->graphics[0]->data.spice.channels[i];
+             switch (mode) {
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args
+index c9fdb99..698e39c 100644
+--- a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args
++++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args
+@@ -2,7 +2,7 @@ LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=spice \
+ /usr/bin/qemu -S -M pc -m 214 -smp 1 -nodefaults -monitor \
+ unix:/tmp/test-monitor,server,nowait -no-acpi -boot c -hda \
+ /dev/HostVG/QEMUGuest1 -usb -spice port=5903,tls-port=5904,addr=127.0.0.1,\
+-x509-dir=/etc/pki/libvirt-spice,tls-channel=main,plaintext-channel=inputs,\
++x509-dir=/etc/pki/libvirt-spice,tls-channel=default,tls-channel=main,plaintext-channel=inputs,\
+ image-compression=auto_glz,jpeg-wan-compression=auto,zlib-glz-wan-compression=auto,\
+ playback-compression=on,streaming-video=filter,disable-copy-paste -vga \
+ qxl -global qxl.vram_size=18874368 -device qxl,id=video1,vram_size=33554432,bus=pci.0,addr=0x4 \
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml
+index 5313b3a..29f20ab 100644
+--- a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml
++++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml
+@@ -21,7 +21,7 @@
+     </disk>
+     <controller type='ide' index='0'/>
+     <input type='mouse' bus='ps2'/>
+-    <graphics type='spice' port='5903' tlsPort='5904' autoport='no' listen='127.0.0.1'>
++    <graphics type='spice' port='5903' tlsPort='5904' autoport='no' listen='127.0.0.1' defaultMode='secure'>
+       <listen type='address' address='127.0.0.1'/>
+       <channel name='main' mode='secure'/>
+       <channel name='inputs' mode='insecure'/>
+-- 
+1.7.7.6
+

libvirt-add-usbredir-spice-channel.patch

@@ -0,0 +1,196 @@
+From b8c86d80df4ba6c682f05974892f5d7ab8f317a9 Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Tue, 8 May 2012 16:00:28 +0300
+Subject: [PATCH] domain_conf: add "usbredir" to list of valid spice channels
+
+Add "usbredir" channel to list of recognized spice channels.
+
+RHBZ: 819498
+
+Signed-off-by: Alon Levy <alevy@redhat.com>
+(cherry picked from commit 4e78ffb63489071c4100678ed88d3111284555e8)
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ docs/formatdomain.html.in                          |    8 ++-
+ docs/schemas/domaincommon.rng                      |    1 +
+ src/conf/domain_conf.c                             |    3 +-
+ src/conf/domain_conf.h                             |    1 +
+ .../qemuxml2argv-graphics-spice-usb-redir.args     |   16 ++++++
+ .../qemuxml2argv-graphics-spice-usb-redir.xml      |   53 ++++++++++++++++++++
+ tests/qemuxml2argvtest.c                           |    6 ++
+ 7 files changed, 84 insertions(+), 4 deletions(-)
+ create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.args
+ create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml
+
+diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
+index 390476d..d082697 100644
+--- a/docs/formatdomain.html.in
++++ b/docs/formatdomain.html.in
+@@ -2317,9 +2317,11 @@ qemu-kvm -net nic,model=? /dev/null
+               main &lt;graphics&gt; element. Valid channel names
+               include <code>main</code>, <code>display</code>,
+               <code>inputs</code>, <code>cursor</code>,
+-              <code>playback</code>, <code>record</code>;
+-              and <span class="since">since
+-              0.8.8</span>: <code>smartcard</code>.
++              <code>playback</code>, <code>record</code>
++              (all <span class="since"> since 0.8.6</span>);
++              <code>smartcard</code> (<span class="since">since
++              0.8.8</span>); and <code>usbredir</code>
++              (<span class="since">since 0.9.12</span>).
+             </p>
+             <pre>
+   &lt;graphics type='spice' port='-1' tlsPort='-1' autoport='yes'&gt;
+diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
+index 9f8d292..fe81c26 100644
+--- a/docs/schemas/domaincommon.rng
++++ b/docs/schemas/domaincommon.rng
+@@ -1401,6 +1401,7 @@
+                     <value>playback</value>
+                     <value>record</value>
+                     <value>smartcard</value>
++                    <value>usbredir</value>
+                   </choice>
+                 </attribute>
+                 <attribute name="mode">
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index 2f9da71..9cc1644 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -389,7 +389,8 @@ VIR_ENUM_IMPL(virDomainGraphicsSpiceChannelName,
+               "cursor",
+               "playback",
+               "record",
+-              "smartcard");
++              "smartcard",
++              "usbredir");
+ 
+ VIR_ENUM_IMPL(virDomainGraphicsSpiceChannelMode,
+               VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_LAST,
+diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
+index f2cd8eb..d40fda6 100644
+--- a/src/conf/domain_conf.h
++++ b/src/conf/domain_conf.h
+@@ -797,6 +797,7 @@ enum virDomainGraphicsSpiceChannelName {
+     VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_PLAYBACK,
+     VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_RECORD,
+     VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_SMARTCARD,
++    VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_USBREDIR,
+ 
+     VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_LAST
+ };
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.args b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.args
+new file mode 100644
+index 0000000..35e51a7
+--- /dev/null
++++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.args
+@@ -0,0 +1,16 @@
++LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=spice /usr/bin/qemu -S -M pc -m 214 -smp 1 -nodefconfig -nodefaults -chardev socket,id=charmonitor,path=/tmp/test-monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=readline -no-acpi -boot c \
++-device ich9-usb-ehci1,id=usb,bus=pci.0,addr=0x4.0x7 \
++-device ich9-usb-uhci1,masterbus=usb.0,firstport=0,bus=pci.0,multifunction=on,addr=0x4 \
++-device ich9-usb-uhci2,masterbus=usb.0,firstport=2,bus=pci.0,addr=0x4.0x1 \
++-device ich9-usb-uhci3,masterbus=usb.0,firstport=4,bus=pci.0,addr=0x4.0x2 \
++-spice port=5903,tls-port=5904,addr=127.0.0.1,\
++x509-dir=/etc/pki/libvirt-spice,tls-channel=main,plaintext-channel=inputs,\
++tls-channel=usbredir,\
++image-compression=auto_glz,jpeg-wan-compression=auto,zlib-glz-wan-compression=auto,\
++playback-compression=on,streaming-video=filter,disable-copy-paste \
++-vga cirrus \
++-chardev socket,id=charredir0,host=localhost,port=4000 \
++-device usb-redir,chardev=charredir0,id=redir0 \
++-chardev spicevmc,id=charredir1,name=usbredir \
++-device usb-redir,chardev=charredir1,id=redir1,bus=usb.0,port=4 \
++-device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml
+new file mode 100644
+index 0000000..1dc23bd
+--- /dev/null
++++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml
+@@ -0,0 +1,53 @@
++<domain type='qemu'>
++  <name>QEMUGuest1</name>
++  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
++  <memory unit='KiB'>219136</memory>
++  <currentMemory unit='KiB'>219136</currentMemory>
++  <vcpu>1</vcpu>
++  <os>
++    <type arch='i686' machine='pc'>hvm</type>
++    <boot dev='hd'/>
++  </os>
++  <clock offset='utc'/>
++  <on_poweroff>destroy</on_poweroff>
++  <on_reboot>restart</on_reboot>
++  <on_crash>destroy</on_crash>
++  <devices>
++    <emulator>/usr/bin/qemu</emulator>
++    <graphics type='spice' port='5903' tlsPort='5904' autoport='no' listen='127.0.0.1'>
++      <listen type='address' address='127.0.0.1'/>
++      <channel name='main' mode='secure'/>
++      <channel name='inputs' mode='insecure'/>
++      <channel name='usbredir' mode='secure'/>
++      <image compression='auto_glz'/>
++      <jpeg compression='auto'/>
++      <zlib compression='auto'/>
++      <playback compression='on'/>
++      <streaming mode='filter'/>
++      <clipboard copypaste='no'/>
++    </graphics>
++    <controller type='usb' index='0' model='ich9-ehci1'>
++      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x7'/>
++    </controller>
++    <controller type='usb' index='0' model='ich9-uhci1'>
++      <master startport='0'/>
++      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0' multifunction='on'/>
++    </controller>
++    <controller type='usb' index='0' model='ich9-uhci2'>
++      <master startport='2'/>
++      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x1'/>
++    </controller>
++    <controller type='usb' index='0' model='ich9-uhci3'>
++      <master startport='4'/>
++      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x2'/>
++    </controller>
++    <redirdev bus='usb' type='tcp'>
++      <source mode='connect' host='localhost' service='4000'/>
++      <protocol type='raw'/>
++    </redirdev>
++    <redirdev bus='usb' type='spicevmc'>
++      <address type='usb' bus='0' port='4'/>
++    </redirdev>
++    <memballoon model='virtio'/>
++  </devices>
++</domain>
+diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
+index 1dc6a01..d5475c5 100644
+--- a/tests/qemuxml2argvtest.c
++++ b/tests/qemuxml2argvtest.c
+@@ -405,6 +405,12 @@ mymain(void)
+             QEMU_CAPS_VGA, QEMU_CAPS_VGA_QXL,
+             QEMU_CAPS_DEVICE, QEMU_CAPS_SPICE,
+             QEMU_CAPS_DEVICE_QXL_VGA);
++    DO_TEST("graphics-spice-usb-redir", false,
++            QEMU_CAPS_VGA, QEMU_CAPS_SPICE,
++            QEMU_CAPS_CHARDEV, QEMU_CAPS_DEVICE, QEMU_CAPS_NODEFCONFIG,
++            QEMU_CAPS_PCI_MULTIFUNCTION, QEMU_CAPS_USB_HUB,
++            QEMU_CAPS_ICH9_USB_EHCI1, QEMU_CAPS_USB_REDIR,
++            QEMU_CAPS_CHARDEV_SPICEVMC);
+ 
+     DO_TEST("input-usbmouse", false, NONE);
+     DO_TEST("input-usbtablet", false, NONE);
+-- 
+1.7.7.6
+
+diff -rup libvirt-0.9.6.1/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml foo/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml
+--- libvirt-0.9.6.1/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml	2012-06-15 17:10:09.086979189 -0400
++++ foo/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml	2012-06-15 17:21:08.788770706 -0400
+@@ -1,8 +1,8 @@
+ <domain type='qemu'>
+   <name>QEMUGuest1</name>
+   <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+-  <memory unit='KiB'>219136</memory>
+-  <currentMemory unit='KiB'>219136</currentMemory>
++  <memory>219136</memory>
++  <currentMemory>219136</currentMemory>
+   <vcpu>1</vcpu>
+   <os>
+     <type arch='i686' machine='pc'>hvm</type>

libvirt-emit-spice-events.patch

@@ -0,0 +1,136 @@
+From 57f08fb47b0938a9e8969b857380926fa6966ca8 Mon Sep 17 00:00:00 2001
+From: Laine Stump <laine@laine.org>
+Date: Wed, 14 Mar 2012 01:41:35 -0400
+Subject: [PATCH] Emit graphics events when a SPICE client
+ connects/disconnects
+
+Wire up the domain graphics event notifications for SPICE. Adapted
+from a RHEL-only patch written by Dan Berrange that used custom
+__com.redhat_SPICE events - equivalent events are now available in
+upstream QEMU (including a SPICE_CONNECTED event, which was missing in
+the __COM.redhat_SPICE version).
+
+* src/qemu/qemu_monitor_json.c: Wire up SPICE graphics events
+(cherry picked from commit 89ae6a5a30bd91cfb2365544f9dd2e6c2a36ecca)
+
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ src/qemu/qemu_monitor_json.c |   56 +++++++++++++++++++++++++++++++++++++++---
+ 1 files changed, 52 insertions(+), 4 deletions(-)
+
+diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
+index e38c2ed..d4a3b7b 100644
+--- a/src/qemu/qemu_monitor_json.c
++++ b/src/qemu/qemu_monitor_json.c
+@@ -57,6 +57,9 @@ static void qemuMonitorJSONHandleVNCConnect(qemuMonitorPtr mon, virJSONValuePtr
+ static void qemuMonitorJSONHandleVNCInitialize(qemuMonitorPtr mon, virJSONValuePtr data);
+ static void qemuMonitorJSONHandleVNCDisconnect(qemuMonitorPtr mon, virJSONValuePtr data);
+ static void qemuMonitorJSONHandleBlockJob(qemuMonitorPtr mon, virJSONValuePtr data);
++static void qemuMonitorJSONHandleSPICEConnect(qemuMonitorPtr mon, virJSONValuePtr data);
++static void qemuMonitorJSONHandleSPICEInitialize(qemuMonitorPtr mon, virJSONValuePtr data);
++static void qemuMonitorJSONHandleSPICEDisconnect(qemuMonitorPtr mon, virJSONValuePtr data);
+ 
+ struct {
+     const char *type;
+@@ -73,6 +76,9 @@ struct {
+     { "VNC_INITIALIZED", qemuMonitorJSONHandleVNCInitialize, },
+     { "VNC_DISCONNECTED", qemuMonitorJSONHandleVNCDisconnect, },
+     { "BLOCK_JOB_COMPLETED", qemuMonitorJSONHandleBlockJob, },
++    { "SPICE_CONNECTED", qemuMonitorJSONHandleSPICEConnect, },
++    { "SPICE_INITIALIZED", qemuMonitorJSONHandleSPICEInitialize, },
++    { "SPICE_DISCONNECTED", qemuMonitorJSONHandleSPICEDisconnect, },
+ };
+ 
+ 
+@@ -617,7 +623,7 @@ VIR_ENUM_DECL(qemuMonitorGraphicsAddressFamily)
+ VIR_ENUM_IMPL(qemuMonitorGraphicsAddressFamily, VIR_DOMAIN_EVENT_GRAPHICS_ADDRESS_IPV6 + 1,
+               "ipv4", "ipv6");
+ 
+-static void qemuMonitorJSONHandleVNC(qemuMonitorPtr mon, virJSONValuePtr data, int phase)
++static void qemuMonitorJSONHandleGraphics(qemuMonitorPtr mon, virJSONValuePtr data, int phase)
+ {
+     const char *localNode, *localService, *localFamily;
+     const char *remoteNode, *remoteService, *remoteFamily;
+@@ -636,14 +642,38 @@ static void qemuMonitorJSONHandleVNC(qemuMonitorPtr mon, virJSONValuePtr data, i
+     }
+ 
+     authScheme = virJSONValueObjectGetString(server, "auth");
++    if (!authScheme) {
++        VIR_WARN("missing auth scheme in graphics event");
++        return;
++    }
+ 
+     localFamily = virJSONValueObjectGetString(server, "family");
++    if (!localFamily) {
++        VIR_WARN("missing local address family in graphics event");
++        return;
++    }
+     localNode = virJSONValueObjectGetString(server, "host");
++    if (!localNode) {
++        VIR_WARN("missing local hostname in graphics event");
++        return;
++    }
+     localService = virJSONValueObjectGetString(server, "service");
++    if (!localService)
++        localService = ""; /* Spice has multiple ports, so this isn't provided */
+ 
+     remoteFamily = virJSONValueObjectGetString(client, "family");
++    if (!remoteFamily) {
++        VIR_WARN("missing remote address family in graphics event");
++        return;
++    }
+     remoteNode = virJSONValueObjectGetString(client, "host");
++    if (!remoteNode) {
++        VIR_WARN("missing remote hostname in graphics event");
++        return;
++    }
+     remoteService = virJSONValueObjectGetString(client, "service");
++    if (!remoteService)
++        remoteService = ""; /* Spice has multiple ports, so this isn't provided */
+ 
+     saslUsername = virJSONValueObjectGetString(client, "sasl_username");
+     x509dname = virJSONValueObjectGetString(client, "x509_dname");
+@@ -665,19 +695,37 @@ static void qemuMonitorJSONHandleVNC(qemuMonitorPtr mon, virJSONValuePtr data, i
+ 
+ static void qemuMonitorJSONHandleVNCConnect(qemuMonitorPtr mon, virJSONValuePtr data)
+ {
+-    qemuMonitorJSONHandleVNC(mon, data, VIR_DOMAIN_EVENT_GRAPHICS_CONNECT);
++    qemuMonitorJSONHandleGraphics(mon, data, VIR_DOMAIN_EVENT_GRAPHICS_CONNECT);
+ }
+ 
+ 
+ static void qemuMonitorJSONHandleVNCInitialize(qemuMonitorPtr mon, virJSONValuePtr data)
+ {
+-    qemuMonitorJSONHandleVNC(mon, data, VIR_DOMAIN_EVENT_GRAPHICS_INITIALIZE);
++    qemuMonitorJSONHandleGraphics(mon, data, VIR_DOMAIN_EVENT_GRAPHICS_INITIALIZE);
+ }
+ 
+ 
+ static void qemuMonitorJSONHandleVNCDisconnect(qemuMonitorPtr mon, virJSONValuePtr data)
+ {
+-    qemuMonitorJSONHandleVNC(mon, data, VIR_DOMAIN_EVENT_GRAPHICS_DISCONNECT);
++    qemuMonitorJSONHandleGraphics(mon, data, VIR_DOMAIN_EVENT_GRAPHICS_DISCONNECT);
++}
++
++
++static void qemuMonitorJSONHandleSPICEConnect(qemuMonitorPtr mon, virJSONValuePtr data)
++{
++    qemuMonitorJSONHandleGraphics(mon, data, VIR_DOMAIN_EVENT_GRAPHICS_CONNECT);
++}
++
++
++static void qemuMonitorJSONHandleSPICEInitialize(qemuMonitorPtr mon, virJSONValuePtr data)
++{
++    qemuMonitorJSONHandleGraphics(mon, data, VIR_DOMAIN_EVENT_GRAPHICS_INITIALIZE);
++}
++
++
++static void qemuMonitorJSONHandleSPICEDisconnect(qemuMonitorPtr mon, virJSONValuePtr data)
++{
++    qemuMonitorJSONHandleGraphics(mon, data, VIR_DOMAIN_EVENT_GRAPHICS_DISCONNECT);
+ }
+ 
+ static void qemuMonitorJSONHandleBlockJob(qemuMonitorPtr mon, virJSONValuePtr data)
+-- 
+1.7.7.6
+

libvirt-qemu-replace-deprecated-fedora-13-machine.patch

@@ -0,0 +1,156 @@
+From eaf056bf995558ecf6620ce031287f3aa81b66de Mon Sep 17 00:00:00 2001
+From: Laine Stump <laine@laine.org>
+Date: Tue, 6 Dec 2011 12:47:28 -0500
+Subject: [PATCH 1/2] qemu: replace deprecated fedora-13 machine type with
+ pc-0.14
+
+This addresses https://bugzilla.redhat.com/show_bug.cgi?id=754772 .
+It should only be applied to Fedora builds of libvirt, F15 and
+later, so there is no upstream equivalent patch.
+
+Background:
+
+During the lifetime of Fedora 13, some features were backported into
+the F13 build of qemu-kvm from upstream. These features were part of
+the functionality of machine type "pc-0.13" in upstream qemu-kvm, so a
+special "fedora-13" machine type was created for the F13 qemu-kvm.
+Since "fedora-13" became the new "canonical machine type", all new
+domains created with F13 libvirt tools by default contained that
+machine type in their configuration file.
+
+In Fedora 14, a patch was made to qemu to treat the fedora-13 machine
+type as equivalent to "pc-0.13". When Fedora 15 was released, this was
+inadvertently changed to make it equivalent to "pc-0.14".
+
+With the release of Fedora 16, qemu-kvm initially removed support for
+this machine type, which caused failure of many guest configurations
+to start. qemu-kvm subsequently re-added the patch to support
+fedora-13 (as equivalent to pc-0.14), but with the promise that they
+could remove it with the release of Fedora 17. (see
+https://bugzilla.redhat.com/show_bug.cgi?id=748218 ).
+
+Solution:
+
+In order to create a repeat of the recent problems, prior to F17
+existing guest configurations need to be updated to change fedora-13
+to pc-0.14 (which has been determined to be equivalent for all
+practical purposes in both F15 and F16). That's what this patch does:
+
+1) Each time libvirtd is started, it calls virDomainLoadAllConfigs()
+which calls virDomainLoadConfig(); this function has been modified to
+check for os.machine == "fedora-13", and change it to "pc-0.14" then
+write the updated config back to disk.
+
+2) Also, any other time a domain definition is parsed, the parsed
+version in memory is changed to turn "fedora-13" into "pc-0.14". This
+handles domains that had been saved to disk prior to the upgrade, and
+are subsequently restarted.
+
+3) Finally, whenever a domain definition is formatted into a string,
+any occurrence of fedora-13 is replaced with pc-0.14 *directly in the
+virDomainDef* (to avoid multiple warning messages for the same object
+when it's formatted multiple times). This should deal with those cases
+where a domain was running at the time of upgrade, and is later
+saved/snapshotted.
+
+I had considered doing this with some sed commands in the specfile,
+but that wouldn't do anything to help the xml saved in image files.
+
+(Also, one of the xml tests was using the machine type "fedora-13",
+and since that machine type is treated specially by the rest of this
+patch, it was failing. That has been changed in a separate patch,
+which must be applied with this patch, and which *is* also upstream).
+---
+ src/conf/domain_conf.c |   62 +++++++++++++++++++++++++++++++++++++++++++++--
+ 1 files changed, 59 insertions(+), 3 deletions(-)
+
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index 318f523..7906bb8 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -7500,7 +7500,25 @@ virDomainDefPtr virDomainDefParseString(virCapsPtr caps,
+                                         unsigned int expectedVirtTypes,
+                                         unsigned int flags)
+ {
+-    return virDomainDefParse(xmlStr, NULL, caps, expectedVirtTypes, flags);
++    virDomainDefPtr def
++        = virDomainDefParse(xmlStr, NULL, caps, expectedVirtTypes, flags);
++
++    /* Fedora-specific HACK - treat fedora-13 and pc-0.14 as equivalent.
++     * This handles the case of domains that had been saved to an image file
++     * prior to upgrade (save or snapshot), then restarted/reverted.
++     */
++    if (def && STREQ_NULLABLE(def->os.machine, "fedora-13")) {
++        VIR_FREE(def->os.machine);
++        if (!(def->os.machine = strdup("pc-0.14"))) {
++            virReportOOMError();
++            virDomainDefFree(def);
++            def = NULL;
++        } else {
++            VIR_WARN("Replacing deprecated 'fedora-13' machine type "
++                     "with equivalent 'pc-0.14' in domain %s xml", def->name);
++        }
++   }
++    return def;
+ }
+ 
+ virDomainDefPtr virDomainDefParseFile(virCapsPtr caps,
+@@ -10648,8 +10666,30 @@ virDomainDefFormatInternal(virDomainDefPtr def,
+     virBufferAddLit(buf, "    <type");
+     if (def->os.arch)
+         virBufferAsprintf(buf, " arch='%s'", def->os.arch);
+-    if (def->os.machine)
+-        virBufferAsprintf(buf, " machine='%s'", def->os.machine);
++    if (def->os.machine) {
++        /* Fedora-specific HACK - replace "fedora-13" with "pc-0.14"
++         * (in the original DomainDef as well as in the xml output).
++         * This will catch XML being written to save/migration images
++         * of domains that were running when libvirtd was restarted at
++         * the time of upgrade.
++         */
++        if (STREQ_NULLABLE(def->os.machine, "fedora-13")) {
++            virBufferAddLit(buf, " machine='pc-0.14'");
++            VIR_WARN("substituting machine type 'fedora-13' with 'pc-0.14' "
++                     "in domain %s", def->name);
++            /* It's not exactly nice to modify the source object,
++             * but sometimes virDomainFormat is called > 100 times for the
++             * same object, which would result in far too many warning logs.
++             */
++            VIR_FREE(def->os.machine);
++            if (!(def->os.machine = strdup("pc-0.14"))) {
++                virReportOOMError();
++                goto cleanup;
++            }
++        } else {
++            virBufferAsprintf(buf, " machine='%s'", def->os.machine);
++        }
++    }
+     /*
+      * HACK: For xen driver we previously used bogus 'linux' as the
+      * os type for paravirt, whereas capabilities declare it to
+@@ -11100,6 +11140,22 @@ static virDomainObjPtr virDomainLoadConfig(virCapsPtr caps,
+                                       VIR_DOMAIN_XML_INACTIVE)))
+         goto error;
+ 
++    /* Fedora-specific HACK - replace "fedora-13" with "pc-0.14".
++     * This updates all config files at the first restart of libvirt
++     * after upgrade.
++     */
++    if (STREQ_NULLABLE(def->os.machine, "fedora-13")) {
++        VIR_FREE(def->os.machine);
++        if (!(def->os.machine = strdup("pc-0.14"))) {
++            virReportOOMError();
++            goto error;
++        }
++        VIR_WARN("Replacing deprecated 'fedora-13' machine type "
++                 "with equivalent 'pc-0.14' in domain %s configuration file", name);
++        if (virDomainSaveConfig(configDir, def) < 0)
++            goto error;
++    }
++
+     if ((autostartLink = virDomainConfigFile(autostartDir, name)) == NULL)
+         goto error;
+ 
+-- 
+1.7.7.4
+

libvirt.spec

@@ -1,5 +1,21 @@
 # -*- rpm-spec -*-
 
+# If neither fedora nor rhel was defined, try to guess them from %{dist}
+%if !0%{?rhel} && !0%{?fedora}
+%{expand:%(echo "%{?dist}" | \
+  sed -ne 's/^\.el\([0-9]\+\).*/%%define rhel \1/p')}
+%{expand:%(echo "%{?dist}" | \
+  sed -ne 's/^\.fc\?\([0-9]\+\).*/%%define fedora \1/p')}
+%endif
+
+# Default to skipping autoreconf.  Distros can change just this one line
+# (or provide a command-line override) if they backport any patches that
+# touch configure.ac or Makefile.am.
+# (Fedora 16 has to turn this on because changes have been made to
+# configure.ac and Makefile.am for the addition of the virtime internal
+# api)
+%{!?enable_autotools:%define enable_autotools 1}
+
 # A client only build will create a libvirt.so only containing
 # the generic RPC driver, and test driver and no libvirtd
 # Default to a full server + client build
@@ -36,14 +52,14 @@
 %define with_lxc           0%{!?_without_lxc:%{server_drivers}}
 %define with_vbox          0%{!?_without_vbox:%{server_drivers}}
 %define with_uml           0%{!?_without_uml:%{server_drivers}}
-%define with_xenapi        0%{!?_without_xenapi:%{server_drivers}}
-# XXX this shouldn't be here, but it mistakenly links into libvirtd
-%define with_one           0%{!?_without_one:%{server_drivers}}
+%define with_libxl         0%{!?_without_libxl:%{server_drivers}}
+%define with_vmware        0%{!?_without_vmware:%{server_drivers}}
 
 # Then the hypervisor drivers that talk a native remote protocol
 %define with_phyp          0%{!?_without_phyp:1}
 %define with_esx           0%{!?_without_esx:1}
-%define with_vmware        0%{!?_without_vmware:1}
+%define with_hyperv        0%{!?_without_hyperv:1}
+%define with_xenapi        0%{!?_without_xenapi:1}
 
 # Then the secondary host drivers
 %define with_network       0%{!?_without_network:%{server_drivers}}
@@ -69,6 +85,7 @@
 %define with_audit         0%{!?_without_audit:0}
 %define with_dtrace        0%{!?_without_dtrace:0}
 %define with_cgconfig      0%{!?_without_cgconfig:0}
+%define with_sanlock       0%{!?_without_sanlock:0}
 
 # Non-server/HV driver defaults which are always enabled
 %define with_python        0%{!?_without_python:1}
@@ -80,6 +97,7 @@
 # Xen is available only on i386 x86_64 ia64
 %ifnarch i386 i586 i686 x86_64 ia64
 %define with_xen 0
+%define with_libxl 0
 %endif
 
 # Numactl is not available on s390[x] and ARM
@@ -87,16 +105,18 @@
 %define with_numactl 0
 %endif
 
-# RHEL doesn't ship OpenVZ, VBox, UML, OpenNebula, PowerHypervisor,
-# VMWare, or libxenserver (xenapi)
+# RHEL doesn't ship OpenVZ, VBox, UML, PowerHypervisor,
+# VMWare, libxenserver (xenapi), libxenlight (Xen 4.1 and newer),
+# or HyperV.
 %if 0%{?rhel}
 %define with_openvz 0
 %define with_vbox 0
 %define with_uml 0
-%define with_one 0
 %define with_phyp 0
 %define with_vmware 0
 %define with_xenapi 0
+%define with_libxl 0
+%define with_hyperv 0
 %endif
 
 # RHEL-5 has restricted QEMU to x86_64 only and is too old for LXC
@@ -123,6 +143,11 @@
 %endif
 %endif
 
+# Fedora doesn't have new enough Xen for libxl until F16
+%if 0%{?fedora} && 0%{?fedora} < 16
+%define with_libxl 0
+%endif
+
 # PolicyKit was introduced in Fedora 8 / RHEL-6 or newer
 %if 0%{?fedora} >= 8 || 0%{?rhel} >= 6
 %define with_polkit    0%{!?_without_polkit:1}
@@ -150,6 +175,27 @@
 %define with_yajl     0%{!?_without_yajl:%{server_drivers}}
 %endif
 
+# Enable sanlock library for lock management with QEMU
+%if 0%{?fedora} >= 16 || 0%{?rhel} >= 6
+%define with_sanlock  0%{!?_without_sanlock:%{server_drivers}}
+%endif
+
+# Disable some drivers when building without libvirt daemon.
+# The logic is the same as in configure.ac
+%if ! %{with_libvirtd}
+%define with_network 0
+%define with_qemu 0
+%define with_lxc 0
+%define with_uml 0
+%define with_hal 0
+%define with_udev 0
+%define with_storage_fs 0
+%define with_storage_lvm 0
+%define with_storage_iscsi 0
+%define with_storage_mpath 0
+%define with_storage_disk 0
+%endif
+
 # Enable libpcap library
 %if %{with_qemu}
 %define with_nwfilter 0%{!?_without_nwfilter:%{server_drivers}}
@@ -194,35 +240,35 @@
 %define with_rhel5  0
 %endif
 
-
-# there's no use compiling the network driver without
-# the libvirt daemon
-%if ! %{with_libvirtd}
-%define with_network 0
-%endif
-
 Summary: Library providing a simple virtualization API
 Name: libvirt
-Version: 0.8.8
-Release: 7%{?dist}%{?extra_release}
+Version: 0.9.6.4
+Release: 1%{?dist}%{?extra_release}
 License: LGPLv2+
 Group: Development/Libraries
-Source: http://libvirt.org/sources/libvirt-%{version}.tar.gz
-Patch1: %{name}-%{version}-kernel-boot-index.patch
-Patch2: %{name}-%{version}-read-only-checks.patch
-# Patches 5, 6  CVE-2011-1486
-Patch3: %{name}-%{version}-threadsafe-libvirtd-error-reporting.patch
-Patch4: %{name}-%{version}-avoid-resetting-errors.patch
-Patch5: %{name}-%{version}-security-plug-regression-introduced-in-disk-probe-lo.patch
-Patch6: %{name}-%{version}-Requires-gettext-for-client-package.patch
-Patch7: %{name}-%{version}-virt-pki-validate-behave-when-CERTTOOL-is-missing.patch
-Patch8: %{name}-%{version}-build-add-dependency-on-gnutls-utils.patch
-Patch9: %{name}-%{version}-rpm-add-missing-dependencies.patch
-Patch10: %{name}-%{version}-remote-protect-against-integer-overflow.patch
-Patch11: %{name}-%{version}-make-commandtest-more-robust.patch
+
+%if %(echo %{version} | grep -o \\. | wc -l) == 3
+%define mainturl stable_updates/
+%endif
+Source: http://libvirt.org/sources/%{?mainturl}libvirt-%{version}.tar.gz
+# Replace fedora-13->pc-0.14 to prep for qemu removal (bz 754772)
+# keep: keeping this for the lifetime of F17, gone for newer releases
+Patch1: libvirt-qemu-replace-deprecated-fedora-13-machine.patch
+# Emit spice graphics events (bz 784813)
+# keep: F16 feature backport that won't hit 0.9.6 maint
+Patch2: libvirt-emit-spice-events.patch
+# Add usbredir spice channel (bz 821469)
+# keep: fedora feature backport that won't hit 0.9.11 maint
+Patch3: libvirt-add-usbredir-spice-channel.patch
+# Add default spice channel (bz 821474)
+# keep: fedora feature backport that won't hit 0.9.11 maint
+Patch4: libvirt-add-default-spice-channel.patch
+
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
 URL: http://libvirt.org/
-BuildRequires: python-devel
+
+# All runtime requirements for the libvirt package (runtime requrements
+# for subpackages are listed later in those subpackages)
 
 # The client side, i.e. shared libs and virsh are in a subpackage
 Requires: %{name}-client = %{version}-%{release}
@@ -233,7 +279,7 @@ Requires: %{name}-client = %{version}-%{release}
 Requires: bridge-utils
 # for modprobe of pci devices
 Requires: module-init-tools
-# for /sbin/ip
+# for /sbin/ip & /sbin/tc
 Requires: iproute
 %endif
 %if %{with_network}
@@ -262,11 +308,11 @@ Requires: PolicyKit >= 0.6
 %endif
 %endif
 %if %{with_storage_fs}
-# For mount/umount in FS driver
-BuildRequires: util-linux
-# For showmount in FS driver (netfs discovery)
-BuildRequires: nfs-utils
 Requires: nfs-utils
+# For mkfs
+Requires: util-linux-ng
+# For pool-build probing for existing pools
+BuildRequires: libblkid-devel >= 2.17
 # For glusterfs
 %if 0%{?fedora} >= 11
 Requires: glusterfs-client >= 2.0.1
@@ -297,6 +343,7 @@ Requires: iscsi-initiator-utils
 %if %{with_storage_disk}
 # For disk driver
 Requires: parted
+Requires: device-mapper
 %endif
 %if %{with_storage_mpath}
 # For multipath support
@@ -305,11 +352,24 @@ Requires: device-mapper
 %if %{with_cgconfig}
 Requires: libcgroup
 %endif
+# For virConnectGetSysinfo
+Requires: dmidecode
+
+# All build-time requirements
+%if 0%{?enable_autotools}
+BuildRequires: autoconf
+BuildRequires: automake
+BuildRequires: gettext-devel
+BuildRequires: libtool
+%endif
+BuildRequires: python-devel
+
 %if %{with_xen}
 BuildRequires: xen-devel
+# temporary explicit requireent missing from xen-4.1.0
+%if %{with_libxl}
+BuildRequires: libuuid-devel
 %endif
-%if %{with_one}
-BuildRequires: xmlrpc-c-devel >= 1.14.0
 %endif
 BuildRequires: libxml2-devel
 BuildRequires: xhtml1-dtds
@@ -317,6 +377,7 @@ BuildRequires: libxslt
 BuildRequires: readline-devel
 BuildRequires: ncurses-devel
 BuildRequires: gettext
+BuildRequires: libtasn1-devel
 BuildRequires: gnutls-devel
 %if 0%{?fedora} >= 12 || 0%{?rhel} >= 6
 # for augparse, optionally used in testing
@@ -332,6 +393,9 @@ BuildRequires: libpciaccess-devel >= 0.10.9
 %if %{with_yajl}
 BuildRequires: yajl-devel
 %endif
+%if %{with_sanlock}
+BuildRequires: sanlock-devel >= 1.8
+%endif
 %if %{with_libpcap}
 BuildRequires: libpcap-devel
 %endif
@@ -415,8 +479,12 @@ BuildRequires: libcap-ng-devel >= 0.5.0
 BuildRequires: libssh2-devel
 %endif
 %if %{with_netcf}
+%if 0%{?fedora} >= 16 || 0%{?rhel} >= 6
+BuildRequires: netcf-devel >= 0.1.8
+%else
 BuildRequires: netcf-devel >= 0.1.4
 %endif
+%endif
 %if %{with_esx}
 %if 0%{?fedora} >= 9 || 0%{?rhel} >= 6
 BuildRequires: libcurl-devel
@@ -424,6 +492,9 @@ BuildRequires: libcurl-devel
 BuildRequires: curl-devel
 %endif
 %endif
+%if %{with_hyperv}
+BuildRequires: libwsman-devel >= 2.2.3
+%endif
 %if %{with_audit}
 BuildRequires: audit-libs-devel
 %endif
@@ -432,6 +503,12 @@ BuildRequires: audit-libs-devel
 BuildRequires: systemtap-sdt-devel
 %endif
 
+%if %{with_storage_fs}
+# For mount/umount in FS driver
+BuildRequires: util-linux
+# For showmount in FS driver (netfs discovery)
+BuildRequires: nfs-utils
+%endif
 
 # Fedora build root suckage
 BuildRequires: gawk
@@ -477,6 +554,20 @@ Requires: xen-devel
 Includes and documentations for the C library providing an API to use
 the virtualization capabilities of recent versions of Linux (and other OSes).
 
+%if %{with_sanlock}
+%package lock-sanlock
+Summary: Sanlock lock manager plugin for QEMU driver
+Group: Development/Libraries
+Requires: sanlock >= 1.8
+#for virt-sanlock-cleanup require augeas
+Requires: augeas
+Requires: %{name} = %{version}-%{release}
+
+%description lock-sanlock
+Includes the Sanlock lock manager plugin for the QEMU
+driver
+%endif
+
 %if %{with_python}
 %package python
 Summary: Python bindings for the libvirt library
@@ -496,13 +587,6 @@ of recent versions of Linux (and other OSes).
 %patch2 -p1
 %patch3 -p1
 %patch4 -p1
-%patch5 -p1
-%patch6 -p1
-%patch7 -p1
-%patch8 -p1
-%patch9 -p1
-%patch10 -p1
-%patch11 -p1
 
 %build
 %if ! %{with_xen}
@@ -529,6 +613,10 @@ of recent versions of Linux (and other OSes).
 %define _without_xenapi --without-xenapi
 %endif
 
+%if ! %{with_libxl}
+%define _without_libxl --without-libxl
+%endif
+
 %if ! %{with_sasl}
 %define _without_sasl --without-sasl
 %endif
@@ -545,6 +633,10 @@ of recent versions of Linux (and other OSes).
 %define _without_esx --without-esx
 %endif
 
+%if ! %{with_hyperv}
+%define _without_hyperv --without-hyperv
+%endif
+
 %if ! %{with_vmware}
 %define _without_vmware --without-vmware
 %endif
@@ -565,10 +657,6 @@ of recent versions of Linux (and other OSes).
 %define _without_uml --without-uml
 %endif
 
-%if ! %{with_one}
-%define _without_one --without-one
-%endif
-
 %if %{with_rhel5}
 %define _with_rhel5_api --with-rhel5-api
 %endif
@@ -625,6 +713,10 @@ of recent versions of Linux (and other OSes).
 %define _without_yajl --without-yajl
 %endif
 
+%if ! %{with_sanlock}
+%define _without_sanlock --without-sanlock
+%endif
+
 %if ! %{with_libpcap}
 %define _without_libpcap --without-libpcap
 %endif
@@ -648,6 +740,9 @@ of recent versions of Linux (and other OSes).
 %define with_packager_version --with-packager-version="%{release}"
 
 
+%if 0%{?enable_autotools}
+autoreconf -if
+%endif
 %configure %{?_without_xen} \
            %{?_without_qemu} \
            %{?_without_openvz} \
@@ -663,6 +758,7 @@ of recent versions of Linux (and other OSes).
            %{?_without_one} \
            %{?_without_phyp} \
            %{?_without_esx} \
+           %{?_without_hyperv} \
            %{?_without_vmware} \
            %{?_without_network} \
            %{?_with_rhel5_api} \
@@ -678,6 +774,7 @@ of recent versions of Linux (and other OSes).
            %{?_without_hal} \
            %{?_without_udev} \
            %{?_without_yajl} \
+           %{?_without_sanlock} \
            %{?_without_libpcap} \
            %{?_without_macvtap} \
            %{?_without_audit} \
@@ -703,6 +800,8 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
 rm -f $RPM_BUILD_ROOT%{_libdir}/*.a
 rm -f $RPM_BUILD_ROOT%{_libdir}/python*/site-packages/*.la
 rm -f $RPM_BUILD_ROOT%{_libdir}/python*/site-packages/*.a
+rm -f $RPM_BUILD_ROOT%{_libdir}/libvirt/lock-driver/*.la
+rm -f $RPM_BUILD_ROOT%{_libdir}/libvirt/lock-driver/*.a
 
 %if %{with_network}
 install -d -m 0755 $RPM_BUILD_ROOT%{_datadir}/lib/libvirt/dnsmasq/
@@ -790,8 +889,7 @@ getent passwd qemu >/dev/null || \
 # We want to install the default network for initial RPM installs
 # or on the first upgrade from a non-network aware libvirt only.
 # We check this by looking to see if the daemon is already installed
-/sbin/chkconfig --list libvirtd 1>/dev/null 2>&1
-if test $? != 0 && test ! -f %{_sysconfdir}/libvirt/qemu/networks/default.xml
+if ! /sbin/chkconfig libvirtd && test ! -f %{_sysconfdir}/libvirt/qemu/networks/default.xml
 then
     UUID=`/usr/bin/uuidgen`
     sed -e "s,</name>,</name>\n  <uuid>$UUID</uuid>," \
@@ -799,13 +897,57 @@ then
          > %{_sysconfdir}/libvirt/qemu/networks/default.xml
     ln -s ../default.xml %{_sysconfdir}/libvirt/qemu/networks/autostart/default.xml
 fi
+
+# All newly defined networks will have a mac address for the bridge
+# auto-generated, but networks already existing at the time of upgrade
+# will not. We need to go through all the network configs, look for
+# those that don't have a mac address, and add one.
+
+network_files=$( (cd %{_localstatedir}/lib/libvirt/network && \
+                  grep -L "mac address" *.xml; \
+                  cd %{_sysconfdir}/libvirt/qemu/networks && \
+                  grep -L "mac address" *.xml) 2>/dev/null \
+                | sort -u)
+
+for file in $network_files
+do
+   # each file exists in either the config or state directory (or both) and
+   # does not have a mac address specified in either. We add the same mac
+   # address to both files (or just one, if the other isn't there)
+
+   mac4=`printf '%X' $(($RANDOM % 256))`
+   mac5=`printf '%X' $(($RANDOM % 256))`
+   mac6=`printf '%X' $(($RANDOM % 256))`
+   for dir in %{_localstatedir}/lib/libvirt/network \
+              %{_sysconfdir}/libvirt/qemu/networks
+   do
+      if test -f $dir/$file
+      then
+         sed -i.orig -e \
+           "s|\(<bridge.*$\)|\0\n  <mac address='52:54:00:$mac4:$mac5:$mac6'/>|" \
+           $dir/$file
+         if test $? != 0
+         then
+             echo "failed to add <mac address='52:54:00:$mac4:$mac5:$mac6'/>" \
+                  "to $dir/$file"
+             mv -f $dir/$file.orig $dir/$file
+         else
+             rm -f $dir/$file.orig
+         fi
+      fi
+   done
+done
 %endif
 
 %if %{with_cgconfig}
+# Starting with Fedora 16, systemd automounts all cgroups, and cgconfig is
+# no longer a necessary service.
+%if 0%{?rhel} || (0%{?fedora} && 0%{?fedora} < 16)
 if [ "$1" -eq "1" ]; then
 /sbin/chkconfig cgconfig on
 fi
 %endif
+%endif
 
 /sbin/chkconfig --add libvirtd
 if [ "$1" -ge "1" ]; then
@@ -834,7 +976,7 @@ fi
 /sbin/chkconfig --add libvirt-guests
 if [ $1 -ge 1 ]; then
     level=$(/sbin/runlevel | /bin/cut -d ' ' -f 2)
-    if /sbin/chkconfig --list libvirt-guests | /bin/grep -q $level:on ; then
+    if /sbin/chkconfig --level $level libvirt-guests; then
         # this doesn't do anything but allowing for libvirt-guests to be
         # stopped on the first shutdown
         /sbin/service libvirt-guests start > /dev/null 2>&1 || true
@@ -860,15 +1002,20 @@ fi
 %{_sysconfdir}/libvirt/nwfilter/*.xml
 
 %{_sysconfdir}/rc.d/init.d/libvirtd
+%doc daemon/libvirtd.upstart
 %config(noreplace) %{_sysconfdir}/sysconfig/libvirtd
 %config(noreplace) %{_sysconfdir}/libvirt/libvirtd.conf
 %if %{with_dtrace}
-%{_datadir}/systemtap/tapsets/libvirtd.stp
+%{_datadir}/systemtap/tapset/libvirtd.stp
 %endif
 %dir %attr(0700, root, root) %{_localstatedir}/log/libvirt/qemu/
 %dir %attr(0700, root, root) %{_localstatedir}/log/libvirt/lxc/
 %dir %attr(0700, root, root) %{_localstatedir}/log/libvirt/uml/
+%if %{with_libxl}
+%dir %attr(0700, root, root) %{_localstatedir}/log/libvirt/libxl/
+%endif
 
+%config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd
 %if %{with_qemu}
 %config(noreplace) %{_sysconfdir}/libvirt/qemu.conf
 %config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd.qemu
@@ -888,27 +1035,31 @@ fi
 %{_datadir}/libvirt/networks/default.xml
 %endif
 
-%dir %{_localstatedir}/run/libvirt/
+%ghost %dir %{_localstatedir}/run/libvirt/
 
 %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/images/
 %dir %attr(0711, root, root) %{_localstatedir}/lib/libvirt/boot/
-%dir %attr(0700, root, root) %{_localstatedir}/cache/libvirt/
+%dir %attr(0711, root, root) %{_localstatedir}/cache/libvirt/
 
 %if %{with_qemu}
-%dir %attr(0700, root, root) %{_localstatedir}/run/libvirt/qemu/
+%ghost %dir %attr(0700, root, root) %{_localstatedir}/run/libvirt/qemu/
 %dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/
 %dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/cache/libvirt/qemu/
 %endif
 %if %{with_lxc}
-%dir %{_localstatedir}/run/libvirt/lxc/
+%ghost %dir %{_localstatedir}/run/libvirt/lxc/
 %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/lxc/
 %endif
 %if %{with_uml}
-%dir %{_localstatedir}/run/libvirt/uml/
+%ghost %dir %{_localstatedir}/run/libvirt/uml/
 %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/uml/
 %endif
+%if %{with_libxl}
+%ghost %dir %{_localstatedir}/run/libvirt/libxl/
+%dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/libxl/
+%endif
 %if %{with_network}
-%dir %{_localstatedir}/run/libvirt/network/
+%ghost %dir %{_localstatedir}/run/libvirt/network/
 %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/network/
 %dir %attr(0755, root, root) %{_localstatedir}/lib/libvirt/dnsmasq/
 %endif
@@ -940,7 +1091,11 @@ fi
 %attr(0755, root, root) %{_libexecdir}/libvirt_lxc
 %endif
 
+%if %{with_storage_disk}
 %attr(0755, root, root) %{_libexecdir}/libvirt_parthelper
+%endif
+
+%attr(0755, root, root) %{_libexecdir}/libvirt_iohelper
 %attr(0755, root, root) %{_sbindir}/libvirtd
 
 %{_mandir}/man8/libvirtd.8*
@@ -948,6 +1103,20 @@ fi
 %doc docs/*.xml
 %endif
 
+%if %{with_sanlock}
+%files lock-sanlock
+%defattr(-, root, root)
+%if %{with_qemu}
+%config(noreplace) %{_sysconfdir}/libvirt/qemu-sanlock.conf
+%endif
+%attr(0755, root, root) %{_libdir}/libvirt/lock-driver/sanlock.so
+%{_datadir}/augeas/lenses/libvirt_sanlock.aug
+%{_datadir}/augeas/lenses/tests/test_libvirt_sanlock.aug
+%dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/sanlock
+%{_sbindir}/virt-sanlock-cleanup
+%{_mandir}/man8/virt-sanlock-cleanup.8*
+%endif
+
 %files client -f %{name}.lang
 %defattr(-, root, root)
 %doc AUTHORS ChangeLog.gz NEWS README COPYING.LIB TODO
@@ -963,17 +1132,20 @@ fi
 %dir %{_datadir}/libvirt/
 %dir %{_datadir}/libvirt/schemas/
 
-%{_datadir}/libvirt/schemas/domain.rng
-%{_datadir}/libvirt/schemas/domainsnapshot.rng
-%{_datadir}/libvirt/schemas/network.rng
-%{_datadir}/libvirt/schemas/storagepool.rng
-%{_datadir}/libvirt/schemas/storagevol.rng
-%{_datadir}/libvirt/schemas/nodedev.rng
+%{_datadir}/libvirt/schemas/basictypes.rng
 %{_datadir}/libvirt/schemas/capability.rng
+%{_datadir}/libvirt/schemas/domain.rng
+%{_datadir}/libvirt/schemas/domaincommon.rng
+%{_datadir}/libvirt/schemas/domainsnapshot.rng
 %{_datadir}/libvirt/schemas/interface.rng
+%{_datadir}/libvirt/schemas/network.rng
+%{_datadir}/libvirt/schemas/networkcommon.rng
+%{_datadir}/libvirt/schemas/nodedev.rng
+%{_datadir}/libvirt/schemas/nwfilter.rng
 %{_datadir}/libvirt/schemas/secret.rng
 %{_datadir}/libvirt/schemas/storageencryption.rng
-%{_datadir}/libvirt/schemas/nwfilter.rng
+%{_datadir}/libvirt/schemas/storagepool.rng
+%{_datadir}/libvirt/schemas/storagevol.rng
 
 %{_datadir}/libvirt/cpu_map.xml
 
@@ -998,6 +1170,10 @@ fi
 %doc %{_datadir}/gtk-doc/html/libvirt/*.png
 %doc %{_datadir}/gtk-doc/html/libvirt/*.css
 
+%dir %{_datadir}/libvirt/api/
+%{_datadir}/libvirt/api/libvirt-api.xml
+%{_datadir}/libvirt/api/libvirt-qemu-api.xml
+
 %doc docs/*.html docs/html docs/*.gif
 %doc docs/libvirt-api.xml
 %doc examples/hellolibvirt
@@ -1014,6 +1190,7 @@ fi
 
 %doc AUTHORS NEWS README COPYING.LIB
 %{_libdir}/python*/site-packages/libvirt.py*
+%{_libdir}/python*/site-packages/libvirt_qemu.py*
 %{_libdir}/python*/site-packages/libvirtmod*
 %doc python/tests/*.py
 %doc python/TODO
@@ -1022,26 +1199,157 @@ fi
 %endif
 
 %changelog
-* Wed Jul  5 2011 Laine Stump <laine@redhat.com> - 0.8.8-7
-- Make commandtest more robust.
+* Mon Jan 28 2013 Cole Robinson <crobinso@redhat.com> - 0.9.6.4-1
+- Rebased to version 0.9.6.4
+- CVE-2013-0170 libvirt: use-after-free in virNetMessageFree() (bz #893450, bz
+  #905173)
 
-* Wed Jul  5 2011 Peter Robinson <pbrobinson@gmail.com> - 0.8.8-6
-- Add ARM to NUMA excludes
+* Sun Oct 07 2012 Cole Robinson <crobinso@redhat.com> - 0.9.6.3-1
+- Rebased to version 0.9.6.3
+- CVE-2012-4423 Fix null dereference (bz #857135, bz #857133)
 
-* Tue Jul  5 2011 Laine Stump <laine@redhat.com> 0.8.8-5
-- Fix for CVE-2011-2178, regression introduced in disk probe logic,
-  Bug 709775
-- Fix for CVE-2011-2511, integer overflow in VirDomainGetVcpus,
-  Bug 717204
-- Add several build and runtime dependencies to specfile
-  Bug 680270
+* Mon Aug 13 2012 Cole Robinson <crobinso@redhat.com> - 0.9.6.2-1
+- Rebased to version 0.9.6.2
+- Fix crash in virTypedParameterArrayClear (bz 844745, bz 844734)
 
-* Tue Apr  5 2011 Laine Stump <laine@redhat.com> 0.8.8-4
-- Fix for CVE-2011-1486, error reporting in libvirtd is not thread safe,
-  bug 693457
+* Fri Jun 15 2012 Cole Robinson <crobinso@redhat.com> - 0.9.6.1-1
+- Rebased to version 0.9.6.1
+- Emit spice graphics events (bz 784813)
+- Add usbredir spice channel (bz 821469)
+- Add default spice channel (bz 821474)
+- Various stream fixes and improvements (bz 743900)
+- Fix state syncing when xen domain shuts down (bz 746007)
+- Don't show <console> for xen dom0 (bz 752271)
+- Fix selinux denial on /usr/libexec/pt_chown from LXC (bz 785411)
+- Don't flood LXC log file (bz 785431)
+- Fix several double close bugs (bz 827127)
+- Fix PCI assignment for USB2.0 controllers (bz 822160)
 
-* Tue Mar 15 2011 Daniel Veillard <veillard@redhat.com> - 0.8.8-3
-- fix a lack of API check on read-only connections 683655
+* Fri Mar 30 2012 Osier Yang <jyang@redhat.com> - 0.9.6-6
+- fix typo in chkconfig commandline for specfile - Bug 786890
+
+* Sun Mar 04 2012 Cole Robinson <crobinso@redhat.com> - 0.9.6-5
+- Fix crash when migrating many guests with vdsm (bz 785789)
+- Fix libvirtd hang in vmware guest (bz 796451)
+- Don't start HAL in init script (bz 789234)
+- Fix storage lookup errors with empty lvm pool (bz 782261)
+- Fix test failures with new gnutls
+
+* Mon Dec 19 2011 Laine Stump <laine@redhat.com> - 0.9.6-4
+- replace "fedora-13" machine type with "pc-0.14" to prepare
+  systems for removal of "fedora-13" from qemu - Bug 754772
+- don't add iptables rules for externally managed networks
+  - Buf 765964 / CVE-2011-4600
+- specfile changes
+  - Bug 761329 don't use chkconfig --list
+  - Bug 758896 mark directories in /var/run as ghosts
+  - Bug 738725 fix logic bug in deciding to turn on cgconfig
+  - Bug 754909 add dmidecode as a prerequisite
+- new async-safe time API + make logging async signal sage wrt.
+  time stamp generation - Bug 757382 (this required
+  enabling autoconf during the build)
+
+* Tue Oct 11 2011 Dan Horák <dan[at]danny.cz> - 0.9.6-3
+- xenlight available only on Xen arches (#745020)
+
+* Mon Oct  3 2011 Laine Stump <laine@redhat.com> - 0.9.6-2
+- Make PCI multifunction support more manual - Bug 742836
+- F15 build still uses cgconfig - Bug 738725
+
+* Thu Sep 22 2011 Daniel Veillard <veillard@redhat.com> - 0.9.6-1
+- Fix the qemu reboot bug and a few others bug fixes
+
+* Tue Sep 20 2011 Daniel Veillard <veillard@redhat.com> - 0.9.5-1
+- many snapshot improvements (Eric Blake)
+- latency: Define new public API and structure (Osier Yang)
+- USB2 and various USB improvements (Marc-André Lureau)
+- storage: Add fs pool formatting (Osier Yang)
+- Add public API for getting migration speed (Jim Fehlig)
+- Add basic driver for Microsoft Hyper-V (Matthias Bolte)
+- many improvements and bug fixes
+
+* Wed Aug  3 2011 Daniel Veillard <veillard@redhat.com> - 0.9.4-1
+- network bandwidth QoS control
+- Add new API virDomainBlockPull*
+- save: new API to manipulate save file images
+- CPU bandwidth limits support
+- allow to send NMI and key event to guests
+- new API virDomainUndefineFlags
+- Implement code to attach to external QEMU instances
+- bios: Add support for SGA
+- various missing python binding
+- many improvements and bug fixes
+
+* Sat Jul 30 2011 Dan Hor?k <dan[at]danny.cz> - 0.9.3-3
+- xenlight available only on Xen arches
+
+* Wed Jul  5 2011 Peter Robinson <pbrobinson@gmail.com> - 0.9.3-2
+- Add ARM to NUMA platform excludes
+
+* Mon Jul  4 2011 Daniel Veillard <veillard@redhat.com> - 0.9.3-1
+- new API virDomainGetVcpupinInfo
+- Add TXT record support for virtual DNS service
+- Support reboots with the QEMU driver
+- New API virDomainGetControlInfo API
+- New API virNodeGetMemoryStats
+- New API virNodeGetCPUTime
+- New API for send-key
+- New API virDomainPinVcpuFlags
+- support multifunction PCI device
+- lxc: various improvements
+- many improvements and bug fixes
+
+* Wed Jun 29 2011 Richard W.M. Jones <rjones@redhat.com> - 0.9.2-3
+- Rebuild because of libparted soname bump (libparted.so.0 -> libparted.so.1).
+
+* Tue Jun 21 2011 Laine Stump <laine@redhat.com> - 0.9.2-2
+- add rule to require netcf-0.1.8 during build so that new transactional
+  network change APIs are included.
+- document that CVE-2011-2178 has been fixed (by virtue of rebase
+  to 0.9.2 - see https://bugzilla.redhat.com/show_bug.cgi?id=709777)
+
+* Mon Jun  6 2011 Daniel Veillard <veillard@redhat.com> - 0.9.2-1
+- Framework for lock manager plugins
+- API for network config change transactions
+- flags for setting memory parameters
+- virDomainGetState public API
+- qemu: allow blkstat/blkinfo calls during migration
+- Introduce migration v3 API
+- Defining the Screenshot public API
+- public API for NMI injection
+- Various improvements and bug fixes
+
+* Wed May 25 2011 Richard W.M. Jones <rjones@redhat.com> - 0.9.1-3
+- Add upstream patches:
+    0001-json-Avoid-passing-large-positive-64-bit-integers-to.patch
+    0001-qemudDomainMemoryPeek-change-ownership-selinux-label.patch
+    0002-remote-remove-bogus-virDomainFree.patch
+  so that users can try out virt-dmesg.
+- Change /var/cache mode to 0711.
+
+* Thu May  5 2011 Daniel Veillard <veillard@redhat.com> - 0.9.1-1
+- support various persistent domain updates
+- improvements on memory APIs
+- Add virDomainEventRebootNew
+- various improvements to libxl driver
+- Spice: support audio, images and stream compression
+- Various improvements and bug fixes
+
+* Thu Apr  7 2011 Daniel Veillard <veillard@redhat.com> - 0.9.0-1
+- Support cputune cpu usage tuning
+- Add public APIs for storage volume upload/download
+- Add public API for setting migration speed on the fly
+- Add libxenlight driver
+- qemu: support migration to fd
+- libvirt: add virDomain{Get,Set}BlkioParameters
+- setmem: introduce a new libvirt API (virDomainSetMemoryFlags)
+- Expose event loop implementation as a public API
+- Dump the debug buffer to libvirtd.log on fatal signal
+- Audit support
+- Various improvements and bug fixes
+
+* Mon Mar 14 2011 Daniel Veillard <veillard@redhat.com> - 0.8.8-3
+- fix a lack of API check on read-only connections
 - CVE-2011-1146
 
 * Mon Feb 21 2011 Daniel P. Berrange <berrange@redhat.com> - 0.8.8-2

sources

@@ -1 +1 @@
-ac9235576352b84b8cb17df7456bbdfc  libvirt-0.8.8.tar.gz
+c374a6f0426e787576d8e5d3fcc3c7a1  libvirt-0.9.6.4.tar.gz