Rebuild for wireshark soname change rhbz#2031322

Now with missing patches

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

.abignore

@@ -0,0 +1,31 @@
+[suppress_function]
+symbol_version_regexp = LIBVIRT_PRIVATE.*
+soname_regexp = libvirt\\.so.*
+
+[suppress_function]
+symbol_version_regexp = LIBVIRT_ADMIN_PRIVATE.*
+soname_regexp = libvirt-admin\\.so.*
+
+[suppress_variable]
+symbol_version_regexp = LIBVIRT_PRIVATE.*
+soname_regexp = libvirt\\.so.*
+
+[suppress_variable]
+symbol_version_regexp = LIBVIRT_ADMIN_PRIVATE.*
+soname_regexp = libvirt-admin\\.so.*
+
+[suppress_function]
+symbol_version_regexp = .*
+soname_regexp = libvirt_storage_.*\\.so.*
+
+[suppress_variable]
+symbol_version_regexp = .*
+soname_regexp = libvirt_storage_.*\\.so.*
+
+[suppress_function]
+symbol_version_regexp = .*
+soname_regexp = libvirt_driver_.*\\.so.*
+
+[suppress_variable]
+symbol_version_regexp = .*
+soname_regexp = libvirt_driver_.*\\.so.*

.gitignore

@@ -2,4 +2,4 @@
 *.rpm
 i686
 x86_64
-libvirt-*.tar.gz
+libvirt-*.tar.xz

0001-build-support-explicitly-disabling-netcf.patch

@@ -0,0 +1,56 @@
+From: Laine Stump <laine@redhat.com>
+Date: Thu, 21 Jan 2021 16:01:06 -0500
+Subject: [PATCH] build: support explicitly disabling netcf
+
+placing "-Dnetcf=disabled" on the meson commandline was ignored,
+meaning that even with that option the build would get WITH_NETCF if
+the netcf-devel package was found - the only way to disable it was to
+uninstall netcf-devel.
+
+This patch adds the small bit of logic to check the netcf meson
+commandline option (in addition to whether netcf-devel is installed)
+before defining WITH_NETCF.
+
+Signed-off-by: Laine Stump <laine@redhat.com>
+Reviewed-by: Neal Gompa <ngompa13@gmail.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 06169a115d46d8870a96d293c2faf6ea87e71020)
+---
+ meson.build | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index b5164f68ed..e9d6d9f82e 100644
+--- a/meson.build
++++ b/meson.build
+@@ -1155,8 +1155,10 @@ libm_dep = cc.find_library('m', required : false)
+ 
+ netcf_version = '0.1.8'
+ netcf_dep = dependency('netcf', version: '>=' + netcf_version, required: get_option('netcf'))
+-if netcf_dep.found()
+-  conf.set('WITH_NETCF', 1)
++if not get_option('netcf').disabled()
++  if netcf_dep.found()
++    conf.set('WITH_NETCF', 1)
++  endif
+ endif
+ 
+ have_gnu_gettext_tools = false
+@@ -1550,7 +1552,7 @@ elif get_option('driver_hyperv').enabled()
+   error('openwsman is required for the Hyper-V driver')
+ endif
+ 
+-if not get_option('driver_interface').disabled() and conf.has('WITH_LIBVIRTD') and (udev_dep.found() or netcf_dep.found())
++if not get_option('driver_interface').disabled() and conf.has('WITH_LIBVIRTD') and (udev_dep.found() or conf.has('WITH_NETCF'))
+   conf.set('WITH_INTERFACE', 1)
+ elif get_option('driver_interface').enabled()
+   error('Requested the Interface driver without netcf or udev and libvirtd support')
+@@ -2362,7 +2364,7 @@ libs_summary = {
+   'libssh': libssh_dep.found(),
+   'libssh2': libssh2_dep.found(),
+   'libutil': libutil_dep.found(),
+-  'netcf': netcf_dep.found(),
++  'netcf': conf.has('WITH_NETCF'),
+   'NLS': have_gnu_gettext_tools,
+   'numactl': numactl_dep.found(),
+   'openwsman': openwsman_dep.found(),

0001-qemu_command-Split-qemuBuildCpuArgStr.patch

@@ -1,291 +0,0 @@
-From 96a7f7fa1953707e1eb9f0f638baf213507a5cb2 Mon Sep 17 00:00:00 2001
-From: Cole Robinson <crobinso@redhat.com>
-Date: Tue, 23 Sep 2014 11:35:57 -0400
-Subject: [PATCH] qemu_command: Split qemuBuildCpuArgStr
-
-Move the CPU mode/model handling to its own function. This is just
-code movement and re-indentation.
-
-(cherry picked from commit e1d872dc77c80d43036f928f83f560f2e9286148)
----
- src/qemu/qemu_command.c | 226 ++++++++++++++++++++++++++----------------------
- 1 file changed, 122 insertions(+), 104 deletions(-)
-
-diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
-index eb72451..db5ea35 100644
---- a/src/qemu/qemu_command.c
-+++ b/src/qemu/qemu_command.c
-@@ -6140,139 +6140,162 @@ qemuBuildClockArgStr(virDomainClockDefPtr def)
-     return NULL;
- }
- 
--
- static int
--qemuBuildCpuArgStr(virQEMUDriverPtr driver,
--                   const virDomainDef *def,
--                   const char *emulator,
--                   virQEMUCapsPtr qemuCaps,
--                   virArch hostarch,
--                   char **opt,
--                   bool *hasHwVirt,
--                   bool migrating)
-+qemuBuildCpuModelArgStr(virQEMUDriverPtr driver,
-+                        const virDomainDef *def,
-+                        virBufferPtr buf,
-+                        virQEMUCapsPtr qemuCaps,
-+                        bool *hasHwVirt,
-+                        bool migrating)
- {
-+    int ret = -1;
-+    size_t i;
-     virCPUDefPtr host = NULL;
-     virCPUDefPtr guest = NULL;
-     virCPUDefPtr cpu = NULL;
-     size_t ncpus = 0;
-     char **cpus = NULL;
--    const char *default_model;
-     virCPUDataPtr data = NULL;
--    bool have_cpu = false;
-     char *compare_msg = NULL;
--    int ret = -1;
--    virBuffer buf = VIR_BUFFER_INITIALIZER;
--    size_t i;
-+    virCPUCompareResult cmp;
-+    const char *preferred;
-     virCapsPtr caps = NULL;
- 
--    *hasHwVirt = false;
--
-     if (!(caps = virQEMUDriverGetCapabilities(driver, false)))
-         goto cleanup;
- 
-     host = caps->host.cpu;
- 
--    if (def->os.arch == VIR_ARCH_I686)
--        default_model = "qemu32";
--    else
--        default_model = "qemu64";
-+    if (!host ||
-+        !host->model ||
-+        (ncpus = virQEMUCapsGetCPUDefinitions(qemuCaps, &cpus)) == 0) {
-+        virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
-+                       _("CPU specification not supported by hypervisor"));
-+        goto cleanup;
-+    }
- 
--    if (def->cpu &&
--        (def->cpu->mode != VIR_CPU_MODE_CUSTOM || def->cpu->model)) {
--        virCPUCompareResult cmp;
--        const char *preferred;
-+    if (!(cpu = virCPUDefCopy(def->cpu)))
-+        goto cleanup;
-+
-+    if (cpu->mode != VIR_CPU_MODE_CUSTOM &&
-+        !migrating &&
-+        cpuUpdate(cpu, host) < 0)
-+        goto cleanup;
- 
--        if (!host ||
--            !host->model ||
--            (ncpus = virQEMUCapsGetCPUDefinitions(qemuCaps, &cpus)) == 0) {
-+    cmp = cpuGuestData(host, cpu, &data, &compare_msg);
-+    switch (cmp) {
-+    case VIR_CPU_COMPARE_INCOMPATIBLE:
-+        if (compare_msg) {
-+            virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
-+                           _("guest and host CPU are not compatible: %s"),
-+                           compare_msg);
-+        } else {
-             virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
--                           _("CPU specification not supported by hypervisor"));
--            goto cleanup;
-+                           _("guest CPU is not compatible with host CPU"));
-         }
-+        /* fall through */
-+    case VIR_CPU_COMPARE_ERROR:
-+        goto cleanup;
- 
--        if (!(cpu = virCPUDefCopy(def->cpu)))
-+    default:
-+        break;
-+    }
-+
-+    /* Only 'svm' requires --enable-nesting. The nested
-+     * 'vmx' patches now simply hook off the CPU features
-+     */
-+    if (def->os.arch == VIR_ARCH_X86_64 ||
-+        def->os.arch == VIR_ARCH_I686) {
-+        int hasSVM = cpuHasFeature(data, "svm");
-+        if (hasSVM < 0)
-             goto cleanup;
-+        *hasHwVirt = hasSVM > 0 ? true : false;
-+    }
- 
--        if (cpu->mode != VIR_CPU_MODE_CUSTOM &&
--            !migrating &&
--            cpuUpdate(cpu, host) < 0)
-+    if (cpu->mode == VIR_CPU_MODE_HOST_PASSTHROUGH) {
-+        const char *mode = virCPUModeTypeToString(cpu->mode);
-+        if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_CPU_HOST)) {
-+            virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
-+                           _("CPU mode '%s' is not supported by QEMU"
-+                             " binary"), mode);
-+            goto cleanup;
-+        }
-+        if (def->virtType != VIR_DOMAIN_VIRT_KVM) {
-+            virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
-+                           _("CPU mode '%s' is only supported with kvm"),
-+                           mode);
-+            goto cleanup;
-+        }
-+        virBufferAddLit(buf, "host");
-+    } else {
-+        if (VIR_ALLOC(guest) < 0)
-+            goto cleanup;
-+        if (VIR_STRDUP(guest->vendor_id, cpu->vendor_id) < 0)
-             goto cleanup;
- 
--        cmp = cpuGuestData(host, cpu, &data, &compare_msg);
--        switch (cmp) {
--        case VIR_CPU_COMPARE_INCOMPATIBLE:
--            if (compare_msg) {
--                virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
--                               _("guest and host CPU are not compatible: %s"),
--                               compare_msg);
--            } else {
--                virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
--                               _("guest CPU is not compatible with host CPU"));
--            }
--            /* fall through */
--        case VIR_CPU_COMPARE_ERROR:
-+        guest->arch = host->arch;
-+        if (cpu->match == VIR_CPU_MATCH_MINIMUM)
-+            preferred = host->model;
-+        else
-+            preferred = cpu->model;
-+
-+        guest->type = VIR_CPU_TYPE_GUEST;
-+        guest->fallback = cpu->fallback;
-+        if (cpuDecode(guest, data, (const char **)cpus, ncpus, preferred) < 0)
-             goto cleanup;
- 
--        default:
--            break;
--        }
-+        virBufferAdd(buf, guest->model, -1);
-+        if (guest->vendor_id)
-+            virBufferAsprintf(buf, ",vendor=%s", guest->vendor_id);
-+        for (i = 0; i < guest->nfeatures; i++) {
-+            char sign;
-+            if (guest->features[i].policy == VIR_CPU_FEATURE_DISABLE)
-+                sign = '-';
-+            else
-+                sign = '+';
- 
--        /* Only 'svm' requires --enable-nesting. The nested
--         * 'vmx' patches now simply hook off the CPU features
--         */
--        if (def->os.arch == VIR_ARCH_X86_64 ||
--            def->os.arch == VIR_ARCH_I686) {
--            int hasSVM = cpuHasFeature(data, "svm");
--            if (hasSVM < 0)
--                goto cleanup;
--            *hasHwVirt = hasSVM > 0 ? true : false;
-+            virBufferAsprintf(buf, ",%c%s", sign, guest->features[i].name);
-         }
-+    }
- 
--        if (cpu->mode == VIR_CPU_MODE_HOST_PASSTHROUGH) {
--            const char *mode = virCPUModeTypeToString(cpu->mode);
--            if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_CPU_HOST)) {
--                virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
--                               _("CPU mode '%s' is not supported by QEMU"
--                                 " binary"), mode);
--                goto cleanup;
--            }
--            if (def->virtType != VIR_DOMAIN_VIRT_KVM) {
--                virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
--                               _("CPU mode '%s' is only supported with kvm"),
--                               mode);
--                goto cleanup;
--            }
--            virBufferAddLit(&buf, "host");
--        } else {
--            if (VIR_ALLOC(guest) < 0)
--                goto cleanup;
--            if (VIR_STRDUP(guest->vendor_id, cpu->vendor_id) < 0)
--                goto cleanup;
-+    ret = 0;
-+cleanup:
-+    virObjectUnref(caps);
-+    VIR_FREE(compare_msg);
-+    cpuDataFree(data);
-+    virCPUDefFree(guest);
-+    virCPUDefFree(cpu);
-+    return ret;
-+}
- 
--            guest->arch = host->arch;
--            if (cpu->match == VIR_CPU_MATCH_MINIMUM)
--                preferred = host->model;
--            else
--                preferred = cpu->model;
-+static int
-+qemuBuildCpuArgStr(virQEMUDriverPtr driver,
-+                   const virDomainDef *def,
-+                   const char *emulator,
-+                   virQEMUCapsPtr qemuCaps,
-+                   virArch hostarch,
-+                   char **opt,
-+                   bool *hasHwVirt,
-+                   bool migrating)
-+{
-+    const char *default_model;
-+    bool have_cpu = false;
-+    int ret = -1;
-+    virBuffer buf = VIR_BUFFER_INITIALIZER;
-+    size_t i;
- 
--            guest->type = VIR_CPU_TYPE_GUEST;
--            guest->fallback = cpu->fallback;
--            if (cpuDecode(guest, data, (const char **)cpus, ncpus, preferred) < 0)
--                goto cleanup;
-+    *hasHwVirt = false;
- 
--            virBufferAdd(&buf, guest->model, -1);
--            if (guest->vendor_id)
--                virBufferAsprintf(&buf, ",vendor=%s", guest->vendor_id);
--            for (i = 0; i < guest->nfeatures; i++) {
--                char sign;
--                if (guest->features[i].policy == VIR_CPU_FEATURE_DISABLE)
--                    sign = '-';
--                else
--                    sign = '+';
-+    if (def->os.arch == VIR_ARCH_I686)
-+        default_model = "qemu32";
-+    else
-+        default_model = "qemu64";
- 
--                virBufferAsprintf(&buf, ",%c%s", sign, guest->features[i].name);
--            }
--        }
-+    if (def->cpu &&
-+        (def->cpu->mode != VIR_CPU_MODE_CUSTOM || def->cpu->model)) {
-+        if (qemuBuildCpuModelArgStr(driver, def, &buf, qemuCaps,
-+                                    hasHwVirt, migrating) < 0)
-+            goto cleanup;
-         have_cpu = true;
-     } else {
-         /*
-@@ -6398,11 +6421,6 @@ qemuBuildCpuArgStr(virQEMUDriverPtr driver,
-     ret = 0;
- 
-  cleanup:
--    VIR_FREE(compare_msg);
--    cpuDataFree(data);
--    virCPUDefFree(guest);
--    virCPUDefFree(cpu);
--    virObjectUnref(caps);
-     return ret;
- }
- 

0002-node_device_udev-Serialize-access-to-pci_get_strings.patch

@@ -0,0 +1,72 @@
+From: wangjian <wangjian161@huawei.com>
+Date: Fri, 26 Mar 2021 11:21:16 +0800
+Subject: [PATCH] node_device_udev: Serialize access to pci_get_strings)_
+
+Since the functions provided by libpciaccess are not thread-safe,
+when the udev-event and nodedev-init threads of libvirt call the
+pci_get_strings function provided by libpaciaccess at the same
+time the following can happen:
+
+nodedev-init thread:
+nodeStateInitializeEnumerate ->
+  udevEnumerateDevices->
+    udevProcessDeviceListEntry ->
+      udevAddOneDevice ->
+        udevGetDeviceDetails->
+          udevProcessPCI ->
+            udevTranslatePCIIds ->
+              pci_get_strings -> (libpciaccess)
+                find_device_name ->
+                  populate_vendor ->
+                    d = realloc( vend->devices, (vend->num_devices + 1), * sizeof( struct pci_device_leaf ) );
+                    vend->num_devices++;
+
+udev-event thread:
+udevEventHandleThread ->
+  udevHandleOneDevice ->
+    udevAddOneDevice->
+      udevGetDeviceDetails->
+        udevProcessPCI ->
+          udevTranslatePCIIds ->
+            pci_get_strings -> (libpciaccess)
+              find_device_name ->
+                populate_vendor ->
+                  d = realloc( vend->devices, (vend->num_devices + 1), * sizeof( struct pci_device_leaf ) );
+                  vend->num_devices++;
+
+Signed-off-by: WangJian <wangjian161@huawei.com>
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 59788a5caea5f292c86e07a31ee2b853d68db87e)
+---
+ src/node_device/node_device_udev.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c
+index 55a2731681..6f0defe908 100644
+--- a/src/node_device/node_device_udev.c
++++ b/src/node_device/node_device_udev.c
+@@ -328,6 +328,7 @@ udevGenerateDeviceName(struct udev_device *device,
+     return 0;
+ }
+ 
++static virMutex pciaccessMutex = VIR_MUTEX_INITIALIZER;
+ 
+ static int
+ udevTranslatePCIIds(unsigned int vendor,
+@@ -346,12 +347,14 @@ udevTranslatePCIIds(unsigned int vendor,
+     m.device_class_mask = 0;
+     m.match_data = 0;
+ 
+-    /* pci_get_strings returns void */
++    /* pci_get_strings returns void and unfortunately is not thread safe. */
++    virMutexLock(&pciaccessMutex);
+     pci_get_strings(&m,
+                     &device_name,
+                     &vendor_name,
+                     NULL,
+                     NULL);
++    virMutexUnlock(&pciaccessMutex);
+ 
+     *vendor_string = g_strdup(vendor_name);
+     *product_string = g_strdup(device_name);

0002-qemu-Don-t-compare-CPU-against-host-for-TCG.patch

@@ -1,536 +0,0 @@
-From bbdbfbfc03494f5cbba4ee869149cca37c1fd53c Mon Sep 17 00:00:00 2001
-From: Cole Robinson <crobinso@redhat.com>
-Date: Tue, 23 Sep 2014 13:07:09 -0400
-Subject: [PATCH] qemu: Don't compare CPU against host for TCG
-
-Right now when building the qemu command line, we try to do various
-unconditional validations of the guest CPU against the host CPU. However
-this checks are overly applied. The only time we should use the checks
-are:
-
-- The user requests host-model/host-passthrough, or
-
-- When KVM is requsted. CPU features requested in TCG mode are always
-  emulated by qemu and are independent of the host CPU, so no host CPU
-  checks should be performed.
-
-Right now if trying to specify a CPU for arm on an x86 host, it attempts
-to do non-sensical validation and falls over.
-
-Switch all the test cases that were intending to test CPU validation to
-use KVM, so they continue to test the intended code.
-
-Amend some aarch64 XML tests with a CPU model, to ensure things work
-correctly.
-
-(cherry picked from commit cf7fce8f2fd1c930f357fd4ff93ac35f38eb30c6)
----
- src/qemu/qemu_command.c                            | 68 +++++++++++++---------
- .../qemuxml2argv-aarch64-virt-default-nic.args     |  3 +-
- .../qemuxml2argv-aarch64-virt-default-nic.xml      |  3 +
- .../qemuxml2argv-aarch64-virt-virtio.args          |  3 +-
- .../qemuxml2argv-aarch64-virt-virtio.xml           |  3 +
- .../qemuxml2argvdata/qemuxml2argv-cpu-exact1.args  |  2 +-
- tests/qemuxml2argvdata/qemuxml2argv-cpu-exact1.xml |  4 +-
- .../qemuxml2argv-cpu-exact2-nofallback.args        |  2 +-
- .../qemuxml2argv-cpu-exact2-nofallback.xml         |  4 +-
- .../qemuxml2argvdata/qemuxml2argv-cpu-exact2.args  |  2 +-
- tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2.xml |  4 +-
- .../qemuxml2argv-cpu-fallback.args                 |  2 +-
- .../qemuxml2argvdata/qemuxml2argv-cpu-fallback.xml |  4 +-
- .../qemuxml2argv-cpu-minimum1.args                 |  2 +-
- .../qemuxml2argvdata/qemuxml2argv-cpu-minimum1.xml |  4 +-
- .../qemuxml2argv-cpu-minimum2.args                 |  2 +-
- .../qemuxml2argvdata/qemuxml2argv-cpu-minimum2.xml |  4 +-
- .../qemuxml2argv-cpu-nofallback.xml                |  2 +-
- .../qemuxml2argvdata/qemuxml2argv-cpu-strict1.args |  2 +-
- .../qemuxml2argvdata/qemuxml2argv-cpu-strict1.xml  |  4 +-
- .../qemuxml2argv-graphics-spice-timeout.args       |  2 +-
- .../qemuxml2argv-graphics-spice-timeout.xml        |  4 +-
- .../qemuxml2argv-pseries-cpu-exact.args            |  4 +-
- tests/qemuxml2argvtest.c                           | 21 +++----
- .../qemuxml2xmlout-graphics-spice-timeout.xml      |  4 +-
- 25 files changed, 90 insertions(+), 69 deletions(-)
-
-diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
-index db5ea35..cd34445 100644
---- a/src/qemu/qemu_command.c
-+++ b/src/qemu/qemu_command.c
-@@ -6160,6 +6160,8 @@ qemuBuildCpuModelArgStr(virQEMUDriverPtr driver,
-     virCPUCompareResult cmp;
-     const char *preferred;
-     virCapsPtr caps = NULL;
-+    bool compareAgainstHost = (def->virtType == VIR_DOMAIN_VIRT_KVM ||
-+        def->cpu->mode != VIR_CPU_MODE_CUSTOM);
- 
-     if (!(caps = virQEMUDriverGetCapabilities(driver, false)))
-         goto cleanup;
-@@ -6182,30 +6184,33 @@ qemuBuildCpuModelArgStr(virQEMUDriverPtr driver,
-         cpuUpdate(cpu, host) < 0)
-         goto cleanup;
- 
--    cmp = cpuGuestData(host, cpu, &data, &compare_msg);
--    switch (cmp) {
--    case VIR_CPU_COMPARE_INCOMPATIBLE:
--        if (compare_msg) {
--            virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
--                           _("guest and host CPU are not compatible: %s"),
--                           compare_msg);
--        } else {
--            virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
--                           _("guest CPU is not compatible with host CPU"));
--        }
--        /* fall through */
--    case VIR_CPU_COMPARE_ERROR:
--        goto cleanup;
-+    /* For non-KVM, CPU features are emulated, so host compat doesn't matter */
-+    if (compareAgainstHost) {
-+        cmp = cpuGuestData(host, cpu, &data, &compare_msg);
-+        switch (cmp) {
-+        case VIR_CPU_COMPARE_INCOMPATIBLE:
-+            if (compare_msg) {
-+                virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
-+                               _("guest and host CPU are not compatible: %s"),
-+                               compare_msg);
-+            } else {
-+                virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
-+                               _("guest CPU is not compatible with host CPU"));
-+            }
-+            /* fall through */
-+        case VIR_CPU_COMPARE_ERROR:
-+            goto cleanup;
- 
--    default:
--        break;
-+        default:
-+            break;
-+        }
-     }
- 
-     /* Only 'svm' requires --enable-nesting. The nested
-      * 'vmx' patches now simply hook off the CPU features
-      */
--    if (def->os.arch == VIR_ARCH_X86_64 ||
--        def->os.arch == VIR_ARCH_I686) {
-+    if ((def->os.arch == VIR_ARCH_X86_64 || def->os.arch == VIR_ARCH_I686) &&
-+         compareAgainstHost) {
-         int hasSVM = cpuHasFeature(data, "svm");
-         if (hasSVM < 0)
-             goto cleanup;
-@@ -6233,16 +6238,23 @@ qemuBuildCpuModelArgStr(virQEMUDriverPtr driver,
-         if (VIR_STRDUP(guest->vendor_id, cpu->vendor_id) < 0)
-             goto cleanup;
- 
--        guest->arch = host->arch;
--        if (cpu->match == VIR_CPU_MATCH_MINIMUM)
--            preferred = host->model;
--        else
--            preferred = cpu->model;
-+        if (compareAgainstHost) {
-+            guest->arch = host->arch;
-+            if (cpu->match == VIR_CPU_MATCH_MINIMUM)
-+                preferred = host->model;
-+            else
-+                preferred = cpu->model;
- 
--        guest->type = VIR_CPU_TYPE_GUEST;
--        guest->fallback = cpu->fallback;
--        if (cpuDecode(guest, data, (const char **)cpus, ncpus, preferred) < 0)
--            goto cleanup;
-+            guest->type = VIR_CPU_TYPE_GUEST;
-+            guest->fallback = cpu->fallback;
-+            if (cpuDecode(guest, data,
-+                          (const char **)cpus, ncpus, preferred) < 0)
-+                goto cleanup;
-+        } else {
-+            guest->arch = def->os.arch;
-+            if (VIR_STRDUP(guest->model, cpu->model) < 0)
-+                goto cleanup;
-+        }
- 
-         virBufferAdd(buf, guest->model, -1);
-         if (guest->vendor_id)
-@@ -6259,7 +6271,7 @@ qemuBuildCpuModelArgStr(virQEMUDriverPtr driver,
-     }
- 
-     ret = 0;
--cleanup:
-+ cleanup:
-     virObjectUnref(caps);
-     VIR_FREE(compare_msg);
-     cpuDataFree(data);
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-aarch64-virt-default-nic.args b/tests/qemuxml2argvdata/qemuxml2argv-aarch64-virt-default-nic.args
-index d4d403b..8cb57c5 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-aarch64-virt-default-nic.args
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-aarch64-virt-default-nic.args
-@@ -1,5 +1,6 @@
- LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
--/usr/bin/qemu-system-aarch64 -S -M virt -m 1024 -smp 1 -nographic \
-+/usr/bin/qemu-system-aarch64 -S -M virt -cpu cortex-a53 \
-+-m 1024 -smp 1 -nographic \
- -nodefconfig -nodefaults -monitor unix:/tmp/test-monitor,server,nowait \
- -boot c -kernel /aarch64.kernel -initrd /aarch64.initrd -append console=ttyAMA0 \
- -usb -device virtio-net-device,vlan=0,id=net0,mac=52:54:00:09:a4:37 \
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-aarch64-virt-default-nic.xml b/tests/qemuxml2argvdata/qemuxml2argv-aarch64-virt-default-nic.xml
-index 868de94..3a6f098 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-aarch64-virt-default-nic.xml
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-aarch64-virt-default-nic.xml
-@@ -7,6 +7,9 @@
-   <features>
-     <acpi/>
-   </features>
-+  <cpu match='exact'>
-+    <model>cortex-a53</model>
-+  </cpu>
-   <os>
-     <type arch="aarch64" machine="virt">hvm</type>
-     <kernel>/aarch64.kernel</kernel>
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-aarch64-virt-virtio.args b/tests/qemuxml2argvdata/qemuxml2argv-aarch64-virt-virtio.args
-index afd6e41..05f3629 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-aarch64-virt-virtio.args
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-aarch64-virt-virtio.args
-@@ -1,5 +1,6 @@
- LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
--/usr/bin/qemu-system-aarch64 -S -M virt -m 1024 -smp 1 -nographic \
-+/usr/bin/qemu-system-aarch64 -S -M virt -cpu cortex-a53 \
-+-m 1024 -smp 1 -nographic \
- -nodefconfig -nodefaults -monitor unix:/tmp/test-monitor,server,nowait \
- -boot c -kernel /aarch64.kernel -initrd /aarch64.initrd -append \
- 'earlyprintk console=ttyAMA0,115200n8 rw root=/dev/vda rootwait' \
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-aarch64-virt-virtio.xml b/tests/qemuxml2argvdata/qemuxml2argv-aarch64-virt-virtio.xml
-index 184b62c..ad34615 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-aarch64-virt-virtio.xml
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-aarch64-virt-virtio.xml
-@@ -16,6 +16,9 @@
-     <apic/>
-     <pae/>
-   </features>
-+  <cpu match='exact'>
-+    <model>cortex-a53</model>
-+  </cpu>
-   <clock offset="utc"/>
-   <on_poweroff>destroy</on_poweroff>
-   <on_reboot>restart</on_reboot>
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact1.args b/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact1.args
-index 76c2c48..0a58616 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact1.args
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact1.args
-@@ -1,5 +1,5 @@
- LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
--/usr/bin/qemu -S -M pc \
-+/usr/bin/qemu-kvm -S -M pc \
- -cpu qemu64,-svm,-lm,-nx,-syscall,-clflush,-pse36,-mca -m 214 -smp 6 \
- -nographic -monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot n -usb -net \
- none -serial none -parallel none
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact1.xml b/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact1.xml
-index ddd9d5a..1d1e815 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact1.xml
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact1.xml
-@@ -1,4 +1,4 @@
--<domain type='qemu'>
-+<domain type='kvm'>
-   <name>QEMUGuest1</name>
-   <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
-   <memory unit='KiB'>219100</memory>
-@@ -23,6 +23,6 @@
-   <on_reboot>restart</on_reboot>
-   <on_crash>destroy</on_crash>
-   <devices>
--      <emulator>/usr/bin/qemu</emulator>
-+      <emulator>/usr/bin/qemu-kvm</emulator>
-   </devices>
- </domain>
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2-nofallback.args b/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2-nofallback.args
-index 0e37379..e46527b 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2-nofallback.args
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2-nofallback.args
-@@ -1,5 +1,5 @@
- LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
--/usr/bin/qemu -S -M pc \
-+/usr/bin/qemu-kvm -S -M pc \
- -cpu core2duo,+lahf_lm,+3dnowext,+xtpr,+ds_cpl,+tm,+ht,+ds,-nx -m 214 -smp 6 \
- -nographic -monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot n -usb -net \
- none -serial none -parallel none
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2-nofallback.xml b/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2-nofallback.xml
-index de4c8d2..6b9b7d4 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2-nofallback.xml
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2-nofallback.xml
-@@ -1,4 +1,4 @@
--<domain type='qemu'>
-+<domain type='kvm'>
-   <name>QEMUGuest1</name>
-   <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
-   <memory unit='KiB'>219100</memory>
-@@ -30,6 +30,6 @@
-   <on_reboot>restart</on_reboot>
-   <on_crash>destroy</on_crash>
-   <devices>
--      <emulator>/usr/bin/qemu</emulator>
-+      <emulator>/usr/bin/qemu-kvm</emulator>
-   </devices>
- </domain>
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2.args b/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2.args
-index 0e37379..e46527b 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2.args
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2.args
-@@ -1,5 +1,5 @@
- LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
--/usr/bin/qemu -S -M pc \
-+/usr/bin/qemu-kvm -S -M pc \
- -cpu core2duo,+lahf_lm,+3dnowext,+xtpr,+ds_cpl,+tm,+ht,+ds,-nx -m 214 -smp 6 \
- -nographic -monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot n -usb -net \
- none -serial none -parallel none
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2.xml b/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2.xml
-index e027e6f..eaea564 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2.xml
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2.xml
-@@ -1,4 +1,4 @@
--<domain type='qemu'>
-+<domain type='kvm'>
-   <name>QEMUGuest1</name>
-   <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
-   <memory unit='KiB'>219100</memory>
-@@ -30,6 +30,6 @@
-   <on_reboot>restart</on_reboot>
-   <on_crash>destroy</on_crash>
-   <devices>
--      <emulator>/usr/bin/qemu</emulator>
-+      <emulator>/usr/bin/qemu-kvm</emulator>
-   </devices>
- </domain>
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-cpu-fallback.args b/tests/qemuxml2argvdata/qemuxml2argv-cpu-fallback.args
-index 4ee8391..ead561f 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-cpu-fallback.args
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-cpu-fallback.args
-@@ -3,7 +3,7 @@ PATH=/bin \
- HOME=/home/test \
- USER=test \
- LOGNAME=test QEMU_AUDIO_DRV=none \
--/usr/bin/qemu \
-+/usr/bin/qemu-kvm \
- -S \
- -M pc \
- -cpu Penryn,-sse4.1 \
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-cpu-fallback.xml b/tests/qemuxml2argvdata/qemuxml2argv-cpu-fallback.xml
-index 6125f41..85642e9 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-cpu-fallback.xml
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-cpu-fallback.xml
-@@ -1,4 +1,4 @@
--<domain type='qemu'>
-+<domain type='kvm'>
-   <name>QEMUGuest1</name>
-   <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
-   <memory unit='KiB'>219100</memory>
-@@ -20,6 +20,6 @@
-   <on_reboot>restart</on_reboot>
-   <on_crash>destroy</on_crash>
-   <devices>
--      <emulator>/usr/bin/qemu</emulator>
-+      <emulator>/usr/bin/qemu-kvm</emulator>
-   </devices>
- </domain>
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum1.args b/tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum1.args
-index 0630ef4..d8207e7 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum1.args
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum1.args
-@@ -1,5 +1,5 @@
- LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
--/usr/bin/qemu -S -M pc \
-+/usr/bin/qemu-kvm -S -M pc \
- -cpu core2duo,+lahf_lm,+xtpr,+cx16,+tm2,+est,+vmx,+ds_cpl,+pbe,+tm,+ht,+ss,\
- +acpi,+ds -m 214 -smp 6 -nographic -monitor unix:/tmp/test-monitor,server,\
- nowait -no-acpi -boot n -usb -net none -serial none -parallel none
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum1.xml b/tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum1.xml
-index 4ba5d0b..5879d35 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum1.xml
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum1.xml
-@@ -1,4 +1,4 @@
--<domain type='qemu'>
-+<domain type='kvm'>
-   <name>QEMUGuest1</name>
-   <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
-   <memory unit='KiB'>219100</memory>
-@@ -16,6 +16,6 @@
-   <on_reboot>restart</on_reboot>
-   <on_crash>destroy</on_crash>
-   <devices>
--      <emulator>/usr/bin/qemu</emulator>
-+      <emulator>/usr/bin/qemu-kvm</emulator>
-   </devices>
- </domain>
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum2.args b/tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum2.args
-index 830994f..17ba256 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum2.args
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum2.args
-@@ -1,5 +1,5 @@
- LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
--/usr/bin/qemu -S -M pc \
-+/usr/bin/qemu-kvm -S -M pc \
- -cpu core2duo,+lahf_lm,+xtpr,+cx16,+tm2,+est,+vmx,+ds_cpl,+pbe,+tm,+ht,+ss,\
- +acpi,+ds,-lm,-nx,-syscall -m 214 -smp 6 -nographic -monitor \
- unix:/tmp/test-monitor,server,nowait -no-acpi -boot n -usb -net none -serial none \
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum2.xml b/tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum2.xml
-index c43bf4f..b8bbf25 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum2.xml
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum2.xml
-@@ -1,4 +1,4 @@
--<domain type='qemu'>
-+<domain type='kvm'>
-   <name>QEMUGuest1</name>
-   <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
-   <memory unit='KiB'>219100</memory>
-@@ -20,6 +20,6 @@
-   <on_reboot>restart</on_reboot>
-   <on_crash>destroy</on_crash>
-   <devices>
--      <emulator>/usr/bin/qemu</emulator>
-+      <emulator>/usr/bin/qemu-kvm</emulator>
-   </devices>
- </domain>
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-cpu-nofallback.xml b/tests/qemuxml2argvdata/qemuxml2argv-cpu-nofallback.xml
-index 4ae0be8..abb0e9c 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-cpu-nofallback.xml
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-cpu-nofallback.xml
-@@ -1,4 +1,4 @@
--<domain type='qemu'>
-+<domain type='kvm'>
-   <name>QEMUGuest1</name>
-   <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
-   <memory unit='KiB'>219100</memory>
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-cpu-strict1.args b/tests/qemuxml2argvdata/qemuxml2argv-cpu-strict1.args
-index 8b545a7..c500ef7 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-cpu-strict1.args
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-cpu-strict1.args
-@@ -1,5 +1,5 @@
- LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
--/usr/bin/qemu -S -M pc \
-+/usr/bin/qemu-kvm -S -M pc \
- -cpu core2duo,+lahf_lm,+3dnowext,+xtpr,+est,+vmx,+ds_cpl,+tm,+ht,+acpi,+ds,-nx \
- -m 214 -smp 6 -nographic -monitor unix:/tmp/test-monitor,server,nowait \
- -no-acpi -boot n -usb -net none -serial none -parallel none
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-cpu-strict1.xml b/tests/qemuxml2argvdata/qemuxml2argv-cpu-strict1.xml
-index 935f46f..a9fc9c5 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-cpu-strict1.xml
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-cpu-strict1.xml
-@@ -1,4 +1,4 @@
--<domain type='qemu'>
-+<domain type='kvm'>
-   <name>QEMUGuest1</name>
-   <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
-   <memory unit='KiB'>219100</memory>
-@@ -33,6 +33,6 @@
-   <on_reboot>restart</on_reboot>
-   <on_crash>destroy</on_crash>
-   <devices>
--      <emulator>/usr/bin/qemu</emulator>
-+      <emulator>/usr/bin/qemu-kvm</emulator>
-   </devices>
- </domain>
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-timeout.args b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-timeout.args
-index 48744b2..8b5d9ee 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-timeout.args
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-timeout.args
-@@ -1,5 +1,5 @@
- LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=spice \
--/usr/bin/qemu -S -M pc -cpu core2duo,+lahf_lm,+xtpr,+cx16,+tm2,\
-+/usr/bin/qemu-kvm -S -M pc -cpu core2duo,+lahf_lm,+xtpr,+cx16,+tm2,\
- +est,+vmx,+ds_cpl,+pbe,+tm,+ht,+ss,+acpi,+ds \
- -m 1024 -smp 2 -nodefaults -monitor unix:/tmp/test-monitor,server,nowait \
- -boot dc -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x6 \
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-timeout.xml b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-timeout.xml
-index e6ecbed..3ed864c 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-timeout.xml
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-timeout.xml
-@@ -1,4 +1,4 @@
--<domain type='qemu'>
-+<domain type='kvm'>
-   <name>f14</name>
-   <uuid>553effab-b5e1-2d80-dfe3-da4344826c43</uuid>
-   <memory unit='KiB'>1048576</memory>
-@@ -38,7 +38,7 @@
-   <on_reboot>restart</on_reboot>
-   <on_crash>restart</on_crash>
-   <devices>
--    <emulator>/usr/bin/qemu</emulator>
-+    <emulator>/usr/bin/qemu-kvm</emulator>
-     <disk type='file' device='disk'>
-       <driver name='qemu' type='qcow2'/>
-       <source file='/var/lib/libvirt/images/f14.img'/>
-diff --git a/tests/qemuxml2argvdata/qemuxml2argv-pseries-cpu-exact.args b/tests/qemuxml2argvdata/qemuxml2argv-pseries-cpu-exact.args
-index 1e09680..9927294 100644
---- a/tests/qemuxml2argvdata/qemuxml2argv-pseries-cpu-exact.args
-+++ b/tests/qemuxml2argvdata/qemuxml2argv-pseries-cpu-exact.args
-@@ -1,6 +1,6 @@
- LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test \
--/usr/bin/qemu-system-ppc64 -S -M pseries -cpu POWER7_v2.3 -m 512 -smp 1 -nographic \
---nodefconfig -nodefaults \
-+QEMU_AUDIO_DRV=none /usr/bin/qemu-system-ppc64 -S -M pseries -cpu POWER7_v2.3 \
-+-m 512 -smp 1 -nographic -nodefconfig -nodefaults \
- -chardev socket,id=charmonitor,path=/tmp/test-monitor,server,nowait \
- -mon chardev=charmonitor,id=monitor,mode=readline -no-acpi -boot c -usb \
- -chardev pty,id=charserial0 \
-diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
-index b380fd8..483ca90 100644
---- a/tests/qemuxml2argvtest.c
-+++ b/tests/qemuxml2argvtest.c
-@@ -933,7 +933,7 @@ mymain(void)
-             QEMU_CAPS_DEVICE, QEMU_CAPS_SPICE,
-             QEMU_CAPS_DEVICE_QXL);
-     DO_TEST("graphics-spice-timeout",
--            QEMU_CAPS_DRIVE,
-+            QEMU_CAPS_KVM, QEMU_CAPS_DRIVE,
-             QEMU_CAPS_VGA, QEMU_CAPS_VGA_QXL,
-             QEMU_CAPS_DEVICE, QEMU_CAPS_SPICE,
-             QEMU_CAPS_DEVICE_QXL_VGA);
-@@ -1208,14 +1208,14 @@ mymain(void)
-     DO_TEST("cpu-topology1", QEMU_CAPS_SMP_TOPOLOGY);
-     DO_TEST("cpu-topology2", QEMU_CAPS_SMP_TOPOLOGY);
-     DO_TEST("cpu-topology3", NONE);
--    DO_TEST("cpu-minimum1", NONE);
--    DO_TEST("cpu-minimum2", NONE);
--    DO_TEST("cpu-exact1", NONE);
--    DO_TEST("cpu-exact2", NONE);
--    DO_TEST("cpu-exact2-nofallback", NONE);
--    DO_TEST("cpu-fallback", NONE);
--    DO_TEST_FAILURE("cpu-nofallback", NONE);
--    DO_TEST("cpu-strict1", NONE);
-+    DO_TEST("cpu-minimum1", QEMU_CAPS_KVM);
-+    DO_TEST("cpu-minimum2", QEMU_CAPS_KVM);
-+    DO_TEST("cpu-exact1", QEMU_CAPS_KVM);
-+    DO_TEST("cpu-exact2", QEMU_CAPS_KVM);
-+    DO_TEST("cpu-exact2-nofallback", QEMU_CAPS_KVM);
-+    DO_TEST("cpu-fallback", QEMU_CAPS_KVM);
-+    DO_TEST_FAILURE("cpu-nofallback", QEMU_CAPS_KVM);
-+    DO_TEST("cpu-strict1", QEMU_CAPS_KVM);
-     DO_TEST("cpu-numa1", NONE);
-     DO_TEST("cpu-numa2", QEMU_CAPS_SMP_TOPOLOGY);
-     DO_TEST_PARSE_ERROR("cpu-numa3", NONE);
-@@ -1303,7 +1303,8 @@ mymain(void)
-     DO_TEST("pseries-usb-kbd", QEMU_CAPS_PCI_OHCI,
-             QEMU_CAPS_DEVICE_USB_KBD, QEMU_CAPS_CHARDEV,
-             QEMU_CAPS_DEVICE, QEMU_CAPS_NODEFCONFIG);
--    DO_TEST_FAILURE("pseries-cpu-exact", QEMU_CAPS_CHARDEV, QEMU_CAPS_DEVICE, QEMU_CAPS_NODEFCONFIG);
-+    DO_TEST("pseries-cpu-exact", QEMU_CAPS_CHARDEV, QEMU_CAPS_DEVICE,
-+            QEMU_CAPS_NODEFCONFIG);
-     DO_TEST("disk-ide-drive-split",
-             QEMU_CAPS_DRIVE, QEMU_CAPS_DEVICE, QEMU_CAPS_NODEFCONFIG,
-             QEMU_CAPS_IDE_CD);
-diff --git a/tests/qemuxml2xmloutdata/qemuxml2xmlout-graphics-spice-timeout.xml b/tests/qemuxml2xmloutdata/qemuxml2xmlout-graphics-spice-timeout.xml
-index 44c4cf7..73ebcab 100644
---- a/tests/qemuxml2xmloutdata/qemuxml2xmlout-graphics-spice-timeout.xml
-+++ b/tests/qemuxml2xmloutdata/qemuxml2xmlout-graphics-spice-timeout.xml
-@@ -1,4 +1,4 @@
--<domain type='qemu'>
-+<domain type='kvm'>
-   <name>f14</name>
-   <uuid>553effab-b5e1-2d80-dfe3-da4344826c43</uuid>
-   <memory unit='KiB'>1048576</memory>
-@@ -38,7 +38,7 @@
-   <on_reboot>restart</on_reboot>
-   <on_crash>restart</on_crash>
-   <devices>
--    <emulator>/usr/bin/qemu</emulator>
-+    <emulator>/usr/bin/qemu-kvm</emulator>
-     <disk type='file' device='disk'>
-       <driver name='qemu' type='qcow2'/>
-       <source file='/var/lib/libvirt/images/f14.img'/>

0003-security_selinux-Don-t-relabel-dev-net-tun.patch

@@ -1,81 +0,0 @@
-From 1c20d4a0a608d65d02953b360c6f10397d3c4069 Mon Sep 17 00:00:00 2001
-From: Michal Privoznik <mprivozn@redhat.com>
-Date: Tue, 7 Oct 2014 16:22:17 +0200
-Subject: [PATCH] security_selinux: Don't relabel /dev/net/tun
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1147057
-
-The code for relabelling the TAP FD is there due to a race. When
-libvirt creates a /dev/tapN device it's labeled as
-'system_u:object_r:device_t:s0' by default. Later, when
-udev/systemd reacts to this device, it's relabelled to the
-expected label 'system_u:object_r:tun_tap_device_t:s0'. Hence, we
-have a code that relabels the device, to cut the race down. For
-more info see ae368ebfcc4.
-
-But the problem is, the relabel function is called on all TUN/TAP
-devices. Yes, on /dev/net/tun too. This is however a special kind
-of device - other processes uses it too. We shouldn't touch it's
-label then.
-
-Ideally, there would an API in SELinux that would label just the
-passed FD and not the underlying path. That way, we wouldn't need
-to care as we would be not labeling /dev/net/tun but the FD
-passed to the domain. Unfortunately, there's no such API so we
-have to workaround until then.
-
-Tested-by: Richard W.M. Jones <rjones@redhat.com>
-Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
-(cherry picked from commit ebc05263960f41065fa7d882959ea754b9281ab1)
----
- src/security/security_selinux.c | 23 +++++++++++++++++++++--
- 1 file changed, 21 insertions(+), 2 deletions(-)
-
-diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
-index b7c1015..352f1ab 100644
---- a/src/security/security_selinux.c
-+++ b/src/security/security_selinux.c
-@@ -2352,7 +2352,7 @@ virSecuritySELinuxSetTapFDLabel(virSecurityManagerPtr mgr,
-     struct stat buf;
-     security_context_t fcon = NULL;
-     virSecurityLabelDefPtr secdef;
--    char *str = NULL;
-+    char *str = NULL, *proc = NULL, *fd_path = NULL;
-     int rc = -1;
- 
-     secdef = virDomainDefGetSecurityLabelDef(def, SECURITY_SELINUX_NAME);
-@@ -2370,7 +2370,24 @@ virSecuritySELinuxSetTapFDLabel(virSecurityManagerPtr mgr,
-         goto cleanup;
-     }
- 
--    if (getContext(mgr, "/dev/tap.*", buf.st_mode, &fcon) < 0) {
-+    /* Label /dev/tap.* devices only. Leave /dev/net/tun alone! */
-+    if (virAsprintf(&proc, "/proc/self/fd/%d", fd) == -1)
-+        goto cleanup;
-+
-+    if (virFileResolveLink(proc, &fd_path) < 0) {
-+        virReportSystemError(errno,
-+                             _("Unable to resolve link: %s"), proc);
-+        goto cleanup;
-+    }
-+
-+    if (!STRPREFIX(fd_path, "/dev/tap")) {
-+        VIR_DEBUG("fd=%d points to %s not setting SELinux label",
-+                  fd, fd_path);
-+        rc = 0;
-+        goto cleanup;
-+    }
-+
-+    if (getContext(mgr, "/dev/tap*", buf.st_mode, &fcon) < 0) {
-         virReportError(VIR_ERR_INTERNAL_ERROR,
-                        _("cannot lookup default selinux label for tap fd %d"), fd);
-         goto cleanup;
-@@ -2384,6 +2401,8 @@ virSecuritySELinuxSetTapFDLabel(virSecurityManagerPtr mgr,
- 
-  cleanup:
-     freecon(fcon);
-+    VIR_FREE(fd_path);
-+    VIR_FREE(proc);
-     VIR_FREE(str);
-     return rc;
- }

0003-virSetUIDGIDWithCaps-Don-t-drop-CAP_SETPCAP-right-aw.patch

@@ -0,0 +1,53 @@
+From: Michal Privoznik <mprivozn@redhat.com>
+Date: Thu, 24 Jun 2021 16:58:09 +0200
+Subject: [PATCH] virSetUIDGIDWithCaps: Don't drop CAP_SETPCAP right away
+
+There are few cases where we execute a virCommand with all caps
+cleared (virCommandClearCaps()). For instance
+dnsmasqCapsRefreshInternal() does just that. This means, that
+after fork() and before exec() the virSetUIDGIDWithCaps() is
+called. But since the caller did not want to change anything,
+just drop capabilities, these are the values of arguments:
+
+  virSetUIDGIDWithCaps (uid=-1, gid=-1, groups=0x0, ngroups=0,
+                        capBits=0, clearExistingCaps=true)
+
+This means that indeed all capabilities will be dropped,
+including CAP_SETPCAP. But this capability controls whether
+capabilities can be set, IOW whether capng_apply() succeeds.
+
+There are two calls of capng_apply() in the function. The
+CAP_SETPCAP is dropped after the first call and thus the other
+call (capng_apply(CAPNG_SELECT_BOUNDS);) fails.
+
+The solution is to keep the capability for as long as needed
+(just like CAP_SETGID and CAP_SETUID) and drop it only at the
+very end (just like CAP_SETGID and CAP_SETUID).
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1949388
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit 438b50dda8a863fdc988e9ab612f097cc1626e8a)
+---
+ src/util/virutil.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/src/util/virutil.c b/src/util/virutil.c
+index a0cd0f1bcd..7ae23a7061 100644
+--- a/src/util/virutil.c
++++ b/src/util/virutil.c
+@@ -1202,12 +1202,10 @@ virSetUIDGIDWithCaps(uid_t uid, gid_t gid, gid_t *groups, int ngroups,
+     }
+ # ifdef PR_CAPBSET_DROP
+     /* If newer kernel, we need also need setpcap to change the bounding set */
+-    if ((capBits || need_setgid || need_setuid) &&
+-        !capng_have_capability(CAPNG_EFFECTIVE, CAP_SETPCAP)) {
++    if (!capng_have_capability(CAPNG_EFFECTIVE, CAP_SETPCAP)) {
+         need_setpcap = true;
+-    }
+-    if (need_setpcap)
+         capng_update(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, CAP_SETPCAP);
++    }
+ # endif
+ 
+     /* Tell system we want to keep caps across uid change */

0004-qemu-x86_64-is-good-enough-for-i686.patch

@@ -1,53 +0,0 @@
-From cd1b72fdd821d1fb4d08198833ea782651760e01 Mon Sep 17 00:00:00 2001
-Message-Id: <cd1b72fdd821d1fb4d08198833ea782651760e01.1414680021.git.crobinso@redhat.com>
-From: Lubomir Rintel <lkundrak@v3.sk>
-Date: Thu, 16 Oct 2014 21:28:00 +0200
-Subject: [PATCH 4/5] qemu: x86_64 is good enough for i686
-
-virt-manager on Fedora sets up i686 hosts with "/usr/bin/qemu-kvm" emulator,
-which in turn unconditionally execs qemu-system-x86_64 querying capabilities
-then fails:
-
-Error launching details: invalid argument: architecture from emulator 'x86_64' doesn't match given architecture 'i686'
-
-Traceback (most recent call last):
-  File "/usr/share/virt-manager/virtManager/engine.py", line 748, in _show_vm_helper
-    details = self._get_details_dialog(uri, vm.get_connkey())
-  File "/usr/share/virt-manager/virtManager/engine.py", line 726, in _get_details_dialog
-    obj = vmmDetails(conn.get_vm(connkey))
-  File "/usr/share/virt-manager/virtManager/details.py", line 399, in __init__
-    self.init_details()
-  File "/usr/share/virt-manager/virtManager/details.py", line 784, in init_details
-    domcaps = self.vm.get_domain_capabilities()
-  File "/usr/share/virt-manager/virtManager/domain.py", line 518, in get_domain_capabilities
-    self.get_xmlobj().os.machine, self.get_xmlobj().type)
-  File "/usr/lib/python2.7/site-packages/libvirt.py", line 3492, in getDomainCapabilities
-    if ret is None: raise libvirtError ('virConnectGetDomainCapabilities() failed', conn=self)
-libvirtError: invalid argument: architecture from emulator 'x86_64' doesn't match given architecture 'i686'
-
-Journal:
-
-Oct 16 21:08:26 goatlord.localdomain libvirtd[1530]: invalid argument: architecture from emulator 'x86_64' doesn't match given architecture 'i686'
-
-(cherry picked from commit afe8f4200f6e80d2510731165dd2cdae741bd9fb)
----
- src/qemu/qemu_driver.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
-index e873d45..d379c1f 100644
---- a/src/qemu/qemu_driver.c
-+++ b/src/qemu/qemu_driver.c
-@@ -17572,7 +17572,8 @@ qemuConnectGetDomainCapabilities(virConnectPtr conn,
- 
-         arch_from_caps = virQEMUCapsGetArch(qemuCaps);
- 
--        if (arch_from_caps != arch) {
-+        if (arch_from_caps != arch &&
-+            (arch_from_caps != VIR_ARCH_X86_64 || arch != VIR_ARCH_I686)) {
-             virReportError(VIR_ERR_INVALID_ARG,
-                            _("architecture from emulator '%s' doesn't "
-                              "match given architecture '%s'"),
--- 
-2.1.0
-

0004-security-fix-SELinux-label-generation-logic.patch

@@ -0,0 +1,51 @@
+From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
+Date: Mon, 28 Jun 2021 13:09:04 +0100
+Subject: [PATCH] security: fix SELinux label generation logic
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+A process can access a file if the set of MCS categories
+for the file is equal-to *or* a subset-of, the set of
+MCS categories for the process.
+
+If there are two VMs:
+
+  a) svirt_t:s0:c117
+  b) svirt_t:s0:c117,c720
+
+Then VM (b) is able to access files labelled for VM (a).
+
+IOW, we must discard case where the categories are equal
+because that is a subset of many other valid category pairs.
+
+Fixes: https://gitlab.com/libvirt/libvirt/-/issues/153
+CVE-2021-3631
+Reviewed-by: Peter Krempa <pkrempa@redhat.com>
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+(cherry picked from commit 15073504dbb624d3f6c911e85557019d3620fdb2)
+---
+ src/security/security_selinux.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
+index 2fc6ef2616..61a871ec3d 100644
+--- a/src/security/security_selinux.c
++++ b/src/security/security_selinux.c
+@@ -389,7 +389,15 @@ virSecuritySELinuxMCSFind(virSecurityManagerPtr mgr,
+         VIR_DEBUG("Try cat %s:c%d,c%d", sens, c1 + catMin, c2 + catMin);
+ 
+         if (c1 == c2) {
+-            mcs = g_strdup_printf("%s:c%d", sens, catMin + c1);
++            /*
++             * A process can access a file if the set of MCS categories
++             * for the file is equal-to *or* a subset-of, the set of
++             * MCS categories for the process.
++             *
++             * IOW, we must discard case where the categories are equal
++             * because that is a subset of other category pairs.
++             */
++            continue;
+         } else {
+             if (c1 > c2) {
+                 int t = c1;

0005-util-Prepare-URI-formatting-for-libxml2-2.9.2.patch

@@ -1,50 +0,0 @@
-From f4d5340ba116befaa965e14537f42c2ead17d486 Mon Sep 17 00:00:00 2001
-Message-Id: <f4d5340ba116befaa965e14537f42c2ead17d486.1414680854.git.crobinso@redhat.com>
-From: Martin Kletzander <mkletzan@redhat.com>
-Date: Fri, 3 Oct 2014 18:27:01 +0200
-Subject: [PATCH] util: Prepare URI formatting for libxml2 >= 2.9.2
-
-Since commit 8eb55d782a2b9afacc7938694891cc6fad7b42a5 libxml2 removes
-two slashes from the URI when there is no server part.  This is fixed
-with beb7281055dbf0ed4d041022a67c6c5cfd126f25, but only if the calling
-application calls xmlSaveUri() on URI that xmlURIParse() parsed.  And
-that is not the case in virURIFormat().  virURIFormat() accepts
-virURIPtr that can be created without parsing it and we do that when we
-format network storage paths for gluster for example.  Even though
-virStorageSourceParseBackingURI() uses virURIParse(), it throws that data
-structure right away.
-
-Since we want to format URIs as URIs and not absolute URIs or opaque
-URIs (see RFC 3986), we can specify that with a special hack thanks to
-commit beb7281055dbf0ed4d041022a67c6c5cfd126f25, by setting port to -1.
-
-This fixes qemuxml2argvtest test where the disk-drive-network-gluster
-case was failing.
-
-Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
-(cherry picked from commit 8f17d0eaae7ee2fa3e214b79b188fc14ed5aa1eb)
----
- src/util/viruri.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/src/util/viruri.c b/src/util/viruri.c
-index 69e7649..23d86c5 100644
---- a/src/util/viruri.c
-+++ b/src/util/viruri.c
-@@ -254,6 +254,13 @@ virURIFormat(virURIPtr uri)
-         xmluri.server = tmpserver;
-     }
- 
-+    /*
-+     * This helps libxml2 deal with the difference
-+     * between uri:/absolute/path and uri:///absolute/path.
-+     */
-+    if (!xmluri.server && !xmluri.port)
-+        xmluri.port = -1;
-+
-     ret = (char *)xmlSaveUri(&xmluri);
-     if (!ret) {
-         virReportOOMError();
--- 
-2.1.0
-

0005-virSetUIDGIDWithCaps-Set-bounding-capabilities-only-.patch

@@ -0,0 +1,43 @@
+From: Michal Privoznik <mprivozn@redhat.com>
+Date: Thu, 22 Jul 2021 14:26:00 +0200
+Subject: [PATCH] virSetUIDGIDWithCaps: Set bounding capabilities only with
+ CAP_SETPCAP
+
+In one of my previous patches I've tried to postpone dropping
+CAP_SETPCAP until the very end because it's needed for
+capng_apply(). What I did not realize back then was that we might
+not have the capability to begin with. Because of unknown reasons
+capng_apply() pollutes logs only for CAPNG_SELECT_BOUNDS and not
+for CAPNG_SELECT_CAPS.
+
+Reproducer is really simple: run libvirtd as a regular user.
+During its initialization, libvirtd will spawn some binaries
+(dnsmasq, qemu-*, etc.) and while doing so it will try to drop
+capabilities.
+
+Anyway, let's call capng_apply(CAPNG_SELECT_BOUNDS) only if we
+have the CAP_SETPCAP (which is tracked in need_setpcap variable).
+
+Fixes: 438b50dda8a863fdc988e9ab612f097cc1626e8a
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1924218
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Cole Robinson <crobinso@redhat.com>
+(cherry picked from commit a2476f37a7789eb9315b77bb451f4754ef4ef15b)
+---
+ src/util/virutil.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/util/virutil.c b/src/util/virutil.c
+index 7ae23a7061..333f99e91d 100644
+--- a/src/util/virutil.c
++++ b/src/util/virutil.c
+@@ -1269,7 +1269,8 @@ virSetUIDGIDWithCaps(uid_t uid, gid_t gid, gid_t *groups, int ngroups,
+      * do this if we failed to get the capability above, so ignore the
+      * return value.
+      */
+-    capng_apply(CAPNG_SELECT_BOUNDS);
++    if (!need_setpcap)
++        capng_apply(CAPNG_SELECT_BOUNDS);
+ 
+     /* Drop the caps that allow setuid/gid (unless they were requested) */
+     if (need_setgid)

0006-qemu_firmware-don-t-error-out-for-unknown-firmware-f.patch

@@ -0,0 +1,57 @@
+From: Pavel Hrdina <phrdina@redhat.com>
+Date: Mon, 10 May 2021 15:07:09 +0200
+Subject: [PATCH] qemu_firmware: don't error out for unknown firmware features
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When QEMU introduces new firmware features libvirt will fail until we
+list that feature in our code as well which doesn't sound right.
+
+We should simply ignore the new feature until we add a proper support
+for it.
+
+Reported-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
+Reviewed-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+(cherry picked from commit 61d95a1073833ec4323c1ef28e71e913c55aa7b9)
+---
+ src/qemu/qemu_firmware.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
+index 639cff7459..e602de22e3 100644
+--- a/src/qemu/qemu_firmware.c
++++ b/src/qemu/qemu_firmware.c
+@@ -573,6 +573,7 @@ qemuFirmwareFeatureParse(const char *path,
+     virJSONValuePtr featuresJSON;
+     g_autoptr(qemuFirmwareFeature) features = NULL;
+     size_t nfeatures;
++    size_t nparsed = 0;
+     size_t i;
+ 
+     if (!(featuresJSON = virJSONValueObjectGetArray(doc, "features"))) {
+@@ -592,17 +593,16 @@ qemuFirmwareFeatureParse(const char *path,
+         int tmp;
+ 
+         if ((tmp = qemuFirmwareFeatureTypeFromString(tmpStr)) <= 0) {
+-            virReportError(VIR_ERR_INTERNAL_ERROR,
+-                           _("unknown feature %s"),
+-                           tmpStr);
+-            return -1;
++            VIR_DEBUG("ignoring unknown QEMU firmware feature '%s'", tmpStr);
++            continue;
+         }
+ 
+-        features[i] = tmp;
++        features[nparsed] = tmp;
++        nparsed++;
+     }
+ 
+     fw->features = g_steal_pointer(&features);
+-    fw->nfeatures = nfeatures;
++    fw->nfeatures = nparsed;
+     return 0;
+ }
+ 

0007-storage_driver-Unlock-object-on-ACL-fail-in-storageP.patch

@@ -0,0 +1,33 @@
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Wed, 21 Jul 2021 11:22:25 +0200
+Subject: [PATCH] storage_driver: Unlock object on ACL fail in
+ storagePoolLookupByTargetPath
+
+'virStoragePoolObjListSearch' returns a locked and refed object, thus we
+must release it on ACL permission failure.
+
+Fixes: 7aa0e8c0cb8
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1984318
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87)
+---
+ src/storage/storage_driver.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/storage/storage_driver.c b/src/storage/storage_driver.c
+index 16bc53aa46..2787c1671b 100644
+--- a/src/storage/storage_driver.c
++++ b/src/storage/storage_driver.c
+@@ -1739,8 +1739,10 @@ storagePoolLookupByTargetPath(virConnectPtr conn,
+                                            storagePoolLookupByTargetPathCallback,
+                                            cleanpath))) {
+         def = virStoragePoolObjGetDef(obj);
+-        if (virStoragePoolLookupByTargetPathEnsureACL(conn, def) < 0)
++        if (virStoragePoolLookupByTargetPathEnsureACL(conn, def) < 0) {
++            virStoragePoolObjEndAPI(&obj);
+             return NULL;
++        }
+ 
+         pool = virGetStoragePool(conn, def->name, def->uuid, NULL, NULL);
+         virStoragePoolObjEndAPI(&obj);

0008-wireshark-Switch-to-tvb_bytes_to_str.patch

@@ -0,0 +1,81 @@
+From 7e299ba649b1288d529c7595c0e6060c9ae0ff2a Mon Sep 17 00:00:00 2001
+From: Michal Privoznik <mprivozn@redhat.com>
+Date: Mon, 29 Nov 2021 09:57:49 +0100
+Subject: [PATCH 1/2] wireshark: Switch to tvb_bytes_to_str()
+
+When the dissector sees a byte sequence that is either an opaque
+data (xdr_opaque) or a byte sequence (xdr_bytes) it formats the
+bytes as a hex numbers using our own implementation. But
+wireshark already provides a function for it: tvb_bytes_to_str().
+NB, the reason why it returns a const string is so that callers
+don't try to free it - the string is allocated using an allocator
+which will decide when to free it.
+
+The wireshark formatter was introduced in wireshark commit of
+v1.99.2~479 and thus is present in the version we require at
+least (2.6.0).
+
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
+---
+ tools/wireshark/src/packet-libvirt.c | 30 ++++++++--------------------
+ 1 file changed, 8 insertions(+), 22 deletions(-)
+
+diff --git a/tools/wireshark/src/packet-libvirt.c b/tools/wireshark/src/packet-libvirt.c
+index f43919b05d..cb922b8070 100644
+--- a/tools/wireshark/src/packet-libvirt.c
++++ b/tools/wireshark/src/packet-libvirt.c
+@@ -158,24 +158,6 @@ dissect_xdr_string(tvbuff_t *tvb, proto_tree *tree, XDR *xdrs, int hf,
+     }
+ }
+ 
+-static const gchar *
+-format_xdr_bytes(guint8 *bytes, guint32 length)
+-{
+-    gchar *buf;
+-    guint32 i;
+-
+-    if (length == 0)
+-        return "";
+-    buf = wmem_alloc(wmem_packet_scope(), length*2 + 1);
+-    for (i = 0; i < length; i++) {
+-        /* We know that buf has enough size to contain
+-           2 * length + '\0' characters. */
+-        g_snprintf(buf, 2*(length - i) + 1, "%02x", bytes[i]);
+-        buf += 2;
+-    }
+-    return buf - length*2;
+-}
+-
+ static gboolean
+ dissect_xdr_opaque(tvbuff_t *tvb, proto_tree *tree, XDR *xdrs, int hf,
+                    guint32 size)
+@@ -187,8 +169,10 @@ dissect_xdr_opaque(tvbuff_t *tvb, proto_tree *tree, XDR *xdrs, int hf,
+     val = g_malloc(size);
+     start = xdr_getpos(xdrs);
+     if ((rc = xdr_opaque(xdrs, (caddr_t)val, size))) {
+-        proto_tree_add_bytes_format_value(tree, hf, tvb, start, xdr_getpos(xdrs) - start,
+-                                          NULL, "%s", format_xdr_bytes(val, size));
++        gint len = xdr_getpos(xdrs) - start;
++        const char *s = tvb_bytes_to_str(wmem_packet_scope(), tvb, start, len);
++
++        proto_tree_add_bytes_format_value(tree, hf, tvb, start, len, NULL, "%s", s);
+     } else {
+         proto_tree_add_item(tree, hf_libvirt_unknown, tvb, start, -1, ENC_NA);
+     }
+@@ -207,8 +191,10 @@ dissect_xdr_bytes(tvbuff_t *tvb, proto_tree *tree, XDR *xdrs, int hf,
+ 
+     start = xdr_getpos(xdrs);
+     if (xdr_bytes(xdrs, (char **)&val, &length, maxlen)) {
+-        proto_tree_add_bytes_format_value(tree, hf, tvb, start, xdr_getpos(xdrs) - start,
+-                                          NULL, "%s", format_xdr_bytes(val, length));
++        gint len = xdr_getpos(xdrs) - start;
++        const char *s = tvb_bytes_to_str(wmem_packet_scope(), tvb, start, len);
++
++        proto_tree_add_bytes_format_value(tree, hf, tvb, start, len, NULL, "%s", s);
+         /* Seems I can't call xdr_free() for this case.
+            It will raises SEGV by referencing out of bounds call stack */
+         free(val);
+-- 
+2.33.1
+

0009-wireshark-Drop-needless-comment-in-dissect_xdr_bytes.patch

@@ -0,0 +1,33 @@
+From 010613cfd8dae6d85602a84c5c95b2d441e1b3d1 Mon Sep 17 00:00:00 2001
+From: Michal Privoznik <mprivozn@redhat.com>
+Date: Mon, 29 Nov 2021 10:20:05 +0100
+Subject: [PATCH 2/2] wireshark: Drop needless comment in dissect_xdr_bytes()
+
+In the dissect_xdr_bytes() there's a comment that the string
+allocated by xdr_bytes() can't be freed using xdr_free(). Well,
+that is expected because xdr_bytes() used plain calloc() AND the
+string is not an XDR struct but plain 'char *' type. Passing it
+to xdr_free() must result in weird things happening.
+
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
+---
+ tools/wireshark/src/packet-libvirt.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/tools/wireshark/src/packet-libvirt.c b/tools/wireshark/src/packet-libvirt.c
+index cb922b8070..eeacbcdf0e 100644
+--- a/tools/wireshark/src/packet-libvirt.c
++++ b/tools/wireshark/src/packet-libvirt.c
+@@ -195,8 +195,6 @@ dissect_xdr_bytes(tvbuff_t *tvb, proto_tree *tree, XDR *xdrs, int hf,
+         const char *s = tvb_bytes_to_str(wmem_packet_scope(), tvb, start, len);
+ 
+         proto_tree_add_bytes_format_value(tree, hf, tvb, start, len, NULL, "%s", s);
+-        /* Seems I can't call xdr_free() for this case.
+-           It will raises SEGV by referencing out of bounds call stack */
+         free(val);
+         return TRUE;
+     } else {
+-- 
+2.33.1
+

Makefile

@@ -1,21 +0,0 @@
-# Makefile for source rpm: libvirt
-# $Id$
-NAME := libvirt
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attempt a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)

sources

@@ -1 +1 @@
-f017075995062ff1d15577b0b093d02e  libvirt-1.2.9.tar.gz
+SHA512 (libvirt-7.0.0.tar.xz) = dd6db5ec4971cf4c6059795fd81d5a3a889b10740e34c3c92271eda1c683c99df2c8f923398065d8a7c4f987a20eb1da617d5297ba8ea5a31f154412af50c343