libvirt-6.1.0-4

Fix libxl driver startup crash (bz #1842318)

.abignore

@@ -0,0 +1,31 @@
+[suppress_function]
+symbol_version_regexp = LIBVIRT_PRIVATE.*
+soname_regexp = libvirt\\.so.*
+
+[suppress_function]
+symbol_version_regexp = LIBVIRT_ADMIN_PRIVATE.*
+soname_regexp = libvirt-admin\\.so.*
+
+[suppress_variable]
+symbol_version_regexp = LIBVIRT_PRIVATE.*
+soname_regexp = libvirt\\.so.*
+
+[suppress_variable]
+symbol_version_regexp = LIBVIRT_ADMIN_PRIVATE.*
+soname_regexp = libvirt-admin\\.so.*
+
+[suppress_function]
+symbol_version_regexp = .*
+soname_regexp = libvirt_storage_.*\\.so.*
+
+[suppress_variable]
+symbol_version_regexp = .*
+soname_regexp = libvirt_storage_.*\\.so.*
+
+[suppress_function]
+symbol_version_regexp = .*
+soname_regexp = libvirt_driver_.*\\.so.*
+
+[suppress_variable]
+symbol_version_regexp = .*
+soname_regexp = libvirt_driver_.*\\.so.*

0001-systemd-directly-notify-systemd-instead-of-using-sd_.patch

@@ -1,242 +0,0 @@
-From c0bc172383c2c955394589e5808457935ae06f1d Mon Sep 17 00:00:00 2001
-From: "Daniel P. Berrange" <berrange@redhat.com>
-Date: Mon, 6 Jun 2016 15:03:27 +0100
-Subject: [PATCH] systemd: directly notify systemd instead of using sd_notify
-
-The sd_notify method is used to tell systemd when libvirtd
-has finished starting up. All it does is send a datagram
-containing the string parameter to systemd on a UNIX socket
-named in the NOTIFY_SOCKET environment variable. Rather than
-pulling in the systemd libraries for this, just code the
-notification directly in libvirt as this is a stable ABI
-from systemd's POV which explicitly allows independant
-implementations:
-
-See "Reimplementable Independently" column in the
-"$NOTIFY_SOCKET Daemon Notifications" row:
-
-https://www.freedesktop.org/wiki/Software/systemd/InterfacePortabilityAndStabilityChart/
-
-Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1314881
-
-Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
----
- configure.ac              |  2 --
- libvirt.spec.in           | 12 -----------
- m4/virt-systemd-daemon.m4 | 34 ------------------------------
- src/Makefile.am           |  4 ++--
- src/util/virsystemd.c     | 53 ++++++++++++++++++++++++++++++++++++++++++-----
- 5 files changed, 50 insertions(+), 55 deletions(-)
- delete mode 100644 m4/virt-systemd-daemon.m4
-
-diff --git a/configure.ac b/configure.ac
-index f2554a4..12eb3b3 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -256,7 +256,6 @@ LIBVIRT_CHECK_SANLOCK
- LIBVIRT_CHECK_SASL
- LIBVIRT_CHECK_SELINUX
- LIBVIRT_CHECK_SSH2
--LIBVIRT_CHECK_SYSTEMD_DAEMON
- LIBVIRT_CHECK_UDEV
- LIBVIRT_CHECK_WIRESHARK
- LIBVIRT_CHECK_NSS
-@@ -2787,7 +2786,6 @@ LIBVIRT_RESULT_SANLOCK
- LIBVIRT_RESULT_SASL
- LIBVIRT_RESULT_SELINUX
- LIBVIRT_RESULT_SSH2
--LIBVIRT_RESULT_SYSTEMD_DAEMON
- LIBVIRT_RESULT_UDEV
- LIBVIRT_RESULT_WIRESHARK
- LIBVIRT_RESULT_NSS
-diff --git a/libvirt.spec.in b/libvirt.spec.in
-index 8b88eef..b93a53c 100644
---- a/libvirt.spec.in
-+++ b/libvirt.spec.in
-@@ -79,7 +79,6 @@
- %define with_firewalld     0%{!?_without_firewalld:0}
- %define with_libssh2       0%{!?_without_libssh2:0}
- %define with_wireshark     0%{!?_without_wireshark:0}
--%define with_systemd_daemon 0%{!?_without_systemd_daemon:0}
- %define with_pm_utils      1
- 
- # Finally set the OS / architecture specific special cases
-@@ -133,7 +132,6 @@
- # Fedora has systemd, libvirt still used sysvinit there.
- %if 0%{?fedora} || 0%{?rhel} >= 7
-     %define with_systemd 1
--    %define with_systemd_daemon 1
-     %define with_pm_utils 0
- %endif
- 
-@@ -268,9 +266,6 @@ BuildRequires: python
- %if %{with_systemd}
- BuildRequires: systemd-units
- %endif
--%if %{with_systemd_daemon}
--BuildRequires: systemd-devel
--%endif
- %if %{with_xen} || %{with_libxl}
- BuildRequires: xen-devel
- %endif
-@@ -1061,12 +1056,6 @@ rm -rf .git
-     %define arg_wireshark --without-wireshark-dissector
- %endif
- 
--%if %{with_systemd_daemon}
--    %define arg_systemd_daemon --with-systemd-daemon
--%else
--    %define arg_systemd_daemon --without-systemd-daemon
--%endif
--
- %if %{with_pm_utils}
-     %define arg_pm_utils --with-pm-utils
- %else
-@@ -1157,7 +1146,6 @@ rm -f po/stamp-po
-            --with-driver-modules \
-            %{?arg_firewalld} \
-            %{?arg_wireshark} \
--           %{?arg_systemd_daemon} \
-            %{?arg_pm_utils} \
-            --with-nss-plugin \
-            %{arg_packager} \
-diff --git a/m4/virt-systemd-daemon.m4 b/m4/virt-systemd-daemon.m4
-deleted file mode 100644
-index 8516e41..0000000
---- a/m4/virt-systemd-daemon.m4
-+++ /dev/null
-@@ -1,34 +0,0 @@
--dnl The libsystemd-daemon.so library
--dnl
--dnl Copyright (C) 2012-2013 Red Hat, Inc.
--dnl
--dnl This library is free software; you can redistribute it and/or
--dnl modify it under the terms of the GNU Lesser General Public
--dnl License as published by the Free Software Foundation; either
--dnl version 2.1 of the License, or (at your option) any later version.
--dnl
--dnl This library is distributed in the hope that it will be useful,
--dnl but WITHOUT ANY WARRANTY; without even the implied warranty of
--dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
--dnl Lesser General Public License for more details.
--dnl
--dnl You should have received a copy of the GNU Lesser General Public
--dnl License along with this library.  If not, see
--dnl <http://www.gnu.org/licenses/>.
--dnl
--
--AC_DEFUN([LIBVIRT_CHECK_SYSTEMD_DAEMON],[
--  LIBVIRT_CHECK_PKG([SYSTEMD_DAEMON], [libsystemd-daemon], [0.27.1])
--
--    old_CFLAGS="$CFLAGS"
--    old_LIBS="$LIBS"
--    CFLAGS="$CFLAGS $SYSTEMD_DAEMON_CFLAGS"
--    LIBS="$LIBS $SYSTEMD_DAEMON_LIBS"
--    AC_CHECK_FUNCS([sd_notify])
--    CFLAGS="$old_CFLAGS"
--    LIBS="$old_LIBS"
--])
--
--AC_DEFUN([LIBVIRT_RESULT_SYSTEMD_DAEMON],[
--  LIBVIRT_RESULT_LIB([SYSTEMD_DAEMON])
--])
-diff --git a/src/Makefile.am b/src/Makefile.am
-index f3c9a14..f020b92 100644
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -1107,12 +1107,12 @@ libvirt_util_la_SOURCES =					\
- libvirt_util_la_CFLAGS = $(CAPNG_CFLAGS) $(YAJL_CFLAGS) $(LIBNL_CFLAGS) \
- 		$(AM_CFLAGS) $(AUDIT_CFLAGS) $(DEVMAPPER_CFLAGS) \
- 		$(DBUS_CFLAGS) $(LDEXP_LIBM) $(NUMACTL_CFLAGS)	\
--		$(SYSTEMD_DAEMON_CFLAGS) $(POLKIT_CFLAGS) $(GNUTLS_CFLAGS) \
-+		$(POLKIT_CFLAGS) $(GNUTLS_CFLAGS) \
- 		-I$(srcdir)/conf
- libvirt_util_la_LIBADD = $(CAPNG_LIBS) $(YAJL_LIBS) $(LIBNL_LIBS) \
- 		$(THREAD_LIBS) $(AUDIT_LIBS) $(DEVMAPPER_LIBS) \
- 		$(LIB_CLOCK_GETTIME) $(DBUS_LIBS) $(MSCOM_LIBS) $(LIBXML_LIBS) \
--		$(SECDRIVER_LIBS) $(NUMACTL_LIBS) $(SYSTEMD_DAEMON_LIBS) \
-+		$(SECDRIVER_LIBS) $(NUMACTL_LIBS) \
- 		$(POLKIT_LIBS)
- 
- 
-diff --git a/src/util/virsystemd.c b/src/util/virsystemd.c
-index 4883f94..871db7e 100644
---- a/src/util/virsystemd.c
-+++ b/src/util/virsystemd.c
-@@ -21,8 +21,9 @@
- 
- #include <config.h>
- 
--#ifdef WITH_SYSTEMD_DAEMON
--# include <systemd/sd-daemon.h>
-+#include <sys/socket.h>
-+#ifdef HAVE_SYS_UN_H
-+# include <sys/un.h>
- #endif
- 
- #include "virsystemd.h"
-@@ -34,6 +35,7 @@
- #include "virutil.h"
- #include "virlog.h"
- #include "virerror.h"
-+#include "virfile.h"
- 
- #define VIR_FROM_THIS VIR_FROM_SYSTEMD
- 
-@@ -480,9 +482,50 @@ int virSystemdTerminateMachine(const char *name)
- void
- virSystemdNotifyStartup(void)
- {
--#ifdef WITH_SYSTEMD_DAEMON
--    sd_notify(0, "READY=1");
--#endif
-+#ifdef HAVE_SYS_UN_H
-+    const char *path;
-+    const char *msg = "READY=1";
-+    int fd;
-+    struct sockaddr_un un = {
-+        .sun_family = AF_UNIX,
-+    };
-+    struct iovec iov = {
-+        .iov_base = (char *)msg,
-+        .iov_len = strlen(msg),
-+    };
-+    struct msghdr mh = {
-+        .msg_name = &un,
-+        .msg_namelen = sizeof(un),
-+        .msg_iov = &iov,
-+        .msg_iovlen = 1,
-+    };
-+
-+    if (!(path = virGetEnvBlockSUID("NOTIFY_SOCKET"))) {
-+        VIR_DEBUG("Skipping systemd notify, not requested");
-+        return;
-+    }
-+
-+    /* NB sun_path field is *not* NUL-terminated, hence >, not >= */
-+    if (strlen(path) > sizeof(un.sun_path)) {
-+        VIR_WARN("Systemd notify socket path '%s' too long", path);
-+        return;
-+    }
-+
-+    memcpy(un.sun_path, path, strlen(path));
-+    if (un.sun_path[0] == '@')
-+        un.sun_path[0] = '\0';
-+
-+    fd = socket(AF_UNIX, SOCK_DGRAM, 0);
-+    if (fd < 0) {
-+        VIR_WARN("Unable to create socket FD");
-+        return;
-+    }
-+
-+    if (sendmsg(fd, &mh, MSG_NOSIGNAL) < 0)
-+        VIR_WARN("Failed to notify systemd");
-+
-+    VIR_FORCE_CLOSE(fd);
-+#endif /* HAVE_SYS_UN_H */
- }
- 
- static int
--- 
-2.5.5
-

0001-virDomainDiskTranslateSourcePool-Check-for-disk-type.patch

@@ -0,0 +1,36 @@
+From: Michal Privoznik <mprivozn@redhat.com>
+Date: Mon, 9 Mar 2020 16:40:57 +0100
+Subject: [PATCH] virDomainDiskTranslateSourcePool: Check for disk type
+ correctly
+
+When rewriting the virDomainDiskTranslateSourcePool() function in
+v6.1.0-rc1~184 a typo was introduced. Previously, we allowed
+startup policy only for those volumes which translated to
+VIR_STORAGE_TYPE_FILE. But starting with the referenced commit,
+the value we checked for was changed to VIR_STORAGE_VOL_FILE
+which comes from a different enum and has a different value too.
+This is wrong, because virStorageSourceGetActualType() returns a
+value from the original enum.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1811728
+
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Peter Krempa <pkrempa@redhat.com>
+(cherry picked from commit 3918dbd84e4951b43f93fbf50ef52be00274850c)
+---
+ src/conf/domain_conf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index 17867eeece..fd2e8f4eb5 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -31746,7 +31746,7 @@ virDomainDiskTranslateSourcePool(virDomainDiskDefPtr def)
+     }
+ 
+     if (def->startupPolicy != 0 &&
+-        virStorageSourceGetActualType(def->src) != VIR_STORAGE_VOL_FILE) {
++        virStorageSourceGetActualType(def->src) != VIR_STORAGE_TYPE_FILE) {
+         virReportError(VIR_ERR_XML_ERROR, "%s",
+                        _("'startupPolicy' is only valid for "
+                          "'file' type volume"));

0002-network-make-it-safe-to-call-networkSetupPrivateChai.patch

@@ -0,0 +1,55 @@
+From: Laine Stump <laine@redhat.com>
+Date: Thu, 7 May 2020 22:32:59 -0400
+Subject: [PATCH] network: make it safe to call networkSetupPrivateChains()
+ multiple times
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+networkSetupPrivateChains() is currently called only once per run of
+libvirtd, so it can assume that errInitV4 and errInitV6 are empty/null
+when it is called. In preparation for potentially calling this
+function multiple times during one run, this patch moves the reset of
+errInitV[46] to the top of the function, to assure no memory is
+leaked.
+
+Signed-off-by: Laine Stump <laine@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+(cherry picked from commit de110f110fb917a31b9f33ad8e4b3c1d3284766a)
+---
+ src/network/bridge_driver_linux.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_linux.c
+index 7bbde5c6a9..80bd2409e1 100644
+--- a/src/network/bridge_driver_linux.c
++++ b/src/network/bridge_driver_linux.c
+@@ -48,6 +48,10 @@ static void networkSetupPrivateChains(void)
+     VIR_DEBUG("Setting up global firewall chains");
+ 
+     createdChains = false;
++    virFreeError(errInitV4);
++    errInitV4 = NULL;
++    virFreeError(errInitV6);
++    errInitV6 = NULL;
+ 
+     rc = iptablesSetupPrivateChains(VIR_FIREWALL_LAYER_IPV4);
+     if (rc < 0) {
+@@ -56,8 +60,6 @@ static void networkSetupPrivateChains(void)
+         errInitV4 = virSaveLastError();
+         virResetLastError();
+     } else {
+-        virFreeError(errInitV4);
+-        errInitV4 = NULL;
+         if (rc) {
+             VIR_DEBUG("Created global IPv4 chains");
+             createdChains = true;
+@@ -73,8 +75,6 @@ static void networkSetupPrivateChains(void)
+         errInitV6 = virSaveLastError();
+         virResetLastError();
+     } else {
+-        virFreeError(errInitV6);
+-        errInitV6 = NULL;
+         if (rc) {
+             VIR_DEBUG("Created global IPv6 chains");
+             createdChains = true;

0003-network-force-re-creation-of-iptables-private-chains.patch

@@ -0,0 +1,265 @@
+From: Laine Stump <laine@redhat.com>
+Date: Thu, 7 May 2020 21:54:39 -0400
+Subject: [PATCH] network: force re-creation of iptables private chains on
+ firewalld restart
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When firewalld is stopped, it removes *all* iptables rules and chains,
+including those added by libvirt. Since restarting firewalld means
+stopping and then starting it, any time it is restarted, libvirt needs
+to recreate all the private iptables chains it uses, along with all
+the rules it adds.
+
+We already have code in place to call networkReloadFirewallRules() any
+time we're notified of a firewalld start, and
+networkReloadFirewallRules() will call
+networkPreReloadFirewallRules(), which calls
+networkSetupPrivateChains(); unfortunately that last call is called
+using virOnce(), meaning that it will only be called the first time
+through networkPreReloadFirewallRules() after libvirtd starts - so of
+course when firewalld is later restarted, the call to
+networkSetupPrivateChains() is skipped.
+
+The neat and tidy way to fix this would be if there was a standard way
+to reset a pthread_once_t object so that the next time virOnce was
+called, it would think the function hadn't been called, and call it
+again. Unfortunately, there isn't any official way of doing that (we
+*could* just fill it with 0 and hope for the best, but that doesn't
+seem very safe.
+
+So instead, this patch just adds a static variable called
+chainInitDone, which is set to true after networkSetupPrivateChains()
+is called for the first time, and then during calls to
+networkPreReloadFirewallRules(), if chainInitDone is set, we call
+networkSetupPrivateChains() directly instead of via virOnce().
+
+It may seem unsafe to directly call a function that is meant to be
+called only once, but I think in this case we're safe - there's
+nothing in the function that is inherently "once only" - it doesn't
+initialize anything that can't safely be re-initialized (as long as
+two threads don't try to do it at the same time), and it only happens
+when responding to a dbus message that firewalld has been started (and
+I don't think it's possible for us to be processing two of those at
+once), and even then only if the initial call to the function has
+already been completed (so we're safe if we receive a firewalld
+restart call at a time when we haven't yet called it, or even if
+another thread is already in the process of executing it. The only
+problematic bit I can think of is if another thread is in the process
+of adding an iptable rule at the time we're executing this function,
+but 1) none of those threads will be trying to add chains, and 2) if
+there was a concurrency problem with other threads adding iptables
+rules while firewalld was being restarted, it would still be a problem
+even without this change.
+
+This is yet another patch that fixes an occurrence of this error:
+
+COMMAND_FAILED: '/usr/sbin/iptables -w10 -w --table filter --insert LIBVIRT_INP --in-interface virbr0 --protocol tcp --destination-port 67 --jump ACCEPT' failed: iptables: No chain/target/match by that name.
+
+In particular, this resolves: https://bugzilla.redhat.com/1813830
+
+Signed-off-by: Laine Stump <laine@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+(cherry picked from commit f5418b427e7d2f26803880309478de9103680826)
+---
+ src/network/bridge_driver.c          | 16 ++++---
+ src/network/bridge_driver_linux.c    | 69 ++++++++++++++++++----------
+ src/network/bridge_driver_nop.c      |  3 +-
+ src/network/bridge_driver_platform.h |  2 +-
+ 4 files changed, 58 insertions(+), 32 deletions(-)
+
+diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
+index 369e80a889..aaf14defe4 100644
+--- a/src/network/bridge_driver.c
++++ b/src/network/bridge_driver.c
+@@ -273,7 +273,9 @@ static int
+ networkShutdownNetworkExternal(virNetworkObjPtr obj);
+ 
+ static void
+-networkReloadFirewallRules(virNetworkDriverStatePtr driver, bool startup);
++networkReloadFirewallRules(virNetworkDriverStatePtr driver,
++                           bool startup,
++                           bool force);
+ 
+ static void
+ networkRefreshDaemons(virNetworkDriverStatePtr driver);
+@@ -689,7 +691,7 @@ firewalld_dbus_filter_bridge(DBusConnection *connection G_GNUC_UNUSED,
+ 
+     if (reload) {
+         VIR_DEBUG("Reload in bridge_driver because of firewalld.");
+-        networkReloadFirewallRules(driver, false);
++        networkReloadFirewallRules(driver, false, true);
+     }
+ 
+     return DBUS_HANDLER_RESULT_NOT_YET_HANDLED;
+@@ -798,7 +800,7 @@ networkStateInitialize(bool privileged,
+     virNetworkObjListPrune(network_driver->networks,
+                            VIR_CONNECT_LIST_NETWORKS_INACTIVE |
+                            VIR_CONNECT_LIST_NETWORKS_TRANSIENT);
+-    networkReloadFirewallRules(network_driver, true);
++    networkReloadFirewallRules(network_driver, true, false);
+     networkRefreshDaemons(network_driver);
+ 
+     if (virDriverShouldAutostart(network_driver->stateDir, &autostart) < 0)
+@@ -868,7 +870,7 @@ networkStateReload(void)
+                                 network_driver->networkConfigDir,
+                                 network_driver->networkAutostartDir,
+                                 network_driver->xmlopt);
+-    networkReloadFirewallRules(network_driver, false);
++    networkReloadFirewallRules(network_driver, false, false);
+     networkRefreshDaemons(network_driver);
+     virNetworkObjListForEach(network_driver->networks,
+                              networkAutostartConfig,
+@@ -2236,14 +2238,16 @@ networkReloadFirewallRulesHelper(virNetworkObjPtr obj,
+ 
+ 
+ static void
+-networkReloadFirewallRules(virNetworkDriverStatePtr driver, bool startup)
++networkReloadFirewallRules(virNetworkDriverStatePtr driver,
++                           bool startup,
++                           bool force)
+ {
+     VIR_INFO("Reloading iptables rules");
+     /* Ideally we'd not even register the driver when unprivilegd
+      * but until we untangle the virt driver that's not viable */
+     if (!driver->privileged)
+         return;
+-    networkPreReloadFirewallRules(driver, startup);
++    networkPreReloadFirewallRules(driver, startup, force);
+     virNetworkObjListForEach(driver->networks,
+                              networkReloadFirewallRulesHelper,
+                              NULL);
+diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_linux.c
+index 80bd2409e1..b0bd207250 100644
+--- a/src/network/bridge_driver_linux.c
++++ b/src/network/bridge_driver_linux.c
+@@ -36,11 +36,14 @@ VIR_LOG_INIT("network.bridge_driver_linux");
+ #define PROC_NET_ROUTE "/proc/net/route"
+ 
+ static virOnceControl createdOnce;
+-static bool createdChains;
++static bool chainInitDone; /* true iff networkSetupPrivateChains was ever called */
++static bool createdChains; /* true iff networkSetupPrivateChains created chains during most recent call */
+ static virErrorPtr errInitV4;
+ static virErrorPtr errInitV6;
+ 
+-/* Only call via virOnce */
++/* Usually only called via virOnce, but can also be called directly in
++ * response to firewalld reload (if chainInitDone == true)
++ */
+ static void networkSetupPrivateChains(void)
+ {
+     int rc;
+@@ -82,6 +85,8 @@ static void networkSetupPrivateChains(void)
+             VIR_DEBUG("Global IPv6 chains already exist");
+         }
+     }
++
++    chainInitDone = true;
+ }
+ 
+ 
+@@ -111,7 +116,10 @@ networkHasRunningNetworks(virNetworkDriverStatePtr driver)
+ }
+ 
+ 
+-void networkPreReloadFirewallRules(virNetworkDriverStatePtr driver, bool startup)
++void
++networkPreReloadFirewallRules(virNetworkDriverStatePtr driver,
++                              bool startup,
++                              bool force)
+ {
+     /*
+      * If there are any running networks, we need to
+@@ -130,29 +138,42 @@ void networkPreReloadFirewallRules(virNetworkDriverStatePtr driver, bool startup
+      * of starting the network though as that makes them
+      * more likely to be seen by a human
+      */
+-    if (!networkHasRunningNetworks(driver)) {
+-        VIR_DEBUG("Delayed global rule setup as no networks are running");
+-        return;
+-    }
++    if (chainInitDone && force) {
++        /* The Private chains have already been initialized once
++         * during this run of libvirtd, so 1) we can't do it again via
++         * virOnce(), and 2) we need to re-add the private chains even
++         * if there are currently no running networks, because the
++         * next time a network is started, libvirt will expect that
++         * the chains have already been added. So we call directly
++         * instead of via virOnce().
++         */
++        networkSetupPrivateChains();
+ 
+-    ignore_value(virOnce(&createdOnce, networkSetupPrivateChains));
++    } else {
++        if (!networkHasRunningNetworks(driver)) {
++            VIR_DEBUG("Delayed global rule setup as no networks are running");
++            return;
++        }
+ 
+-    /*
+-     * If this is initial startup, and we just created the
+-     * top level private chains we either
+-     *
+-     *   - upgraded from old libvirt
+-     *   - freshly booted from clean state
+-     *
+-     * In the first case we must delete the old rules from
+-     * the built-in chains, instead of our new private chains.
+-     * In the second case it doesn't matter, since no existing
+-     * rules will be present. Thus we can safely just tell it
+-     * to always delete from the builin chain
+-     */
+-    if (startup && createdChains) {
+-        VIR_DEBUG("Requesting cleanup of legacy firewall rules");
+-        iptablesSetDeletePrivate(false);
++        ignore_value(virOnce(&createdOnce, networkSetupPrivateChains));
++
++        /*
++         * If this is initial startup, and we just created the
++         * top level private chains we either
++         *
++         *   - upgraded from old libvirt
++         *   - freshly booted from clean state
++         *
++         * In the first case we must delete the old rules from
++         * the built-in chains, instead of our new private chains.
++         * In the second case it doesn't matter, since no existing
++         * rules will be present. Thus we can safely just tell it
++         * to always delete from the builin chain
++         */
++        if (startup && createdChains) {
++            VIR_DEBUG("Requesting cleanup of legacy firewall rules");
++            iptablesSetDeletePrivate(false);
++        }
+     }
+ }
+ 
+diff --git a/src/network/bridge_driver_nop.c b/src/network/bridge_driver_nop.c
+index 08d737511f..db89c10023 100644
+--- a/src/network/bridge_driver_nop.c
++++ b/src/network/bridge_driver_nop.c
+@@ -20,7 +20,8 @@
+ #include <config.h>
+ 
+ void networkPreReloadFirewallRules(virNetworkDriverStatePtr driver G_GNUC_UNUSED,
+-                                   bool startup G_GNUC_UNUSED)
++                                   bool startup G_GNUC_UNUSED,
++                                   bool force G_GNUC_UNUSED)
+ {
+ }
+ 
+diff --git a/src/network/bridge_driver_platform.h b/src/network/bridge_driver_platform.h
+index 169417a6c0..48ab52c160 100644
+--- a/src/network/bridge_driver_platform.h
++++ b/src/network/bridge_driver_platform.h
+@@ -62,7 +62,7 @@ struct _virNetworkDriverState {
+ typedef struct _virNetworkDriverState virNetworkDriverState;
+ typedef virNetworkDriverState *virNetworkDriverStatePtr;
+ 
+-void networkPreReloadFirewallRules(virNetworkDriverStatePtr driver, bool startup);
++void networkPreReloadFirewallRules(virNetworkDriverStatePtr driver, bool startup, bool force);
+ void networkPostReloadFirewallRules(bool startup);
+ 
+ int networkCheckRouteCollision(virNetworkDefPtr def);

0004-systemd-start-libvirtd-after-firewalld-iptables-serv.patch

@@ -0,0 +1,100 @@
+From: Laine Stump <laine@redhat.com>
+Date: Fri, 1 May 2020 00:05:50 -0400
+Subject: [PATCH] systemd: start libvirtd after firewalld/iptables services
+
+When a system has enabled the iptables/ip6tables services rather than
+firewalld, there is no explicit ordering of the start of those
+services vs. libvirtd. This creates a problem when libvirtd.service is
+started before ip[6]tables, as the latter, when it finally is started,
+will remove all of the iptables rules that had previously been added
+by libvirt, including the custom chains where libvirt's rules are
+kept. This results in an error message similar to the following when a
+user subsequently tries to start a new libvirt network:
+
+ "Error while activating network: Call to virNetworkCreate failed:
+ internal error: Failed to apply firewall rules
+ /usr/sbin/ip6tables -w --table filter --insert LIBVIRT_FWO \
+   --in-interface virbr2 --jump REJECT:
+ ip6tables: No chain/target/match by that name."
+
+(Prior to logging this error, it also would have caused failure to
+forward (or block) traffic in some cases, e.g. for guests on a NATed
+network, since libvirt's rules to forward/block had all been deleted
+and libvirt didn't know about it, so it couldn't fix the problem)
+
+When this happens, the problem can be remedied by simply restarting
+libvirtd.service (which has the side-effect of reloading all
+libvirt-generated firewall rules)
+
+Instead, we can just explicitly stating in the libvirtd.service file
+that libvirtd.service should start after ip6tables.service and
+ip6tables.service, eliminating the race condition that leads to the
+error.
+
+There is also nothing (that I can see) in the systemd .service files
+to guarantee that firewalld.service will be started (if enabled) prior
+to libvirtd.service. The same error scenario given above would occur
+if libvirtd.service started before firewalld.service.  Even before
+that, though libvirtd would have detected that firewalld.service was
+disabled, and then turn off all firewalld support. So, for example,
+firewalld's libvirt zone wouldn't be used, and most likely traffic
+from guests would therefore be blocked (all with no external
+indication of the source of the problem other than a debug-level log
+when libvirtd was started saying that firewalld wasn't in use); also
+libvirtd wouldn't notice when firewalld reloaded its rules (which also
+simultaneously deletes all of libvirt's rules).
+
+I'm not aware of any reports that have been traced back to
+libvirtd.service starting before firewalld.service, but have seen that
+error reported multiple times, and also don't see an existing
+dependency that would guarantee firewalld.service starts before
+libvirtd.service, so it's possible it's been happening and we just
+haven't gotten to the bottom of it.
+
+This patch adds an After= line to the libvirtd.service file for each
+of iptables.service, ip6tables.service, and firewalld.servicee, which
+should guarantee that libvirtd.service isn't started until systemd has
+started whichever of the others is enabled.
+
+This race was diagnosed, and patch proposed, by Jason Montleon in
+https://bugzilla.redhat.com/1723698 . At the time (April 2019) danpb
+agreed with him that this change to libvirtd.service was a reasonable
+thing to do, but I guess everyone thought someone else was going to
+post a patch, so in the end nobody did.
+
+Signed-off-by: Laine Stump <laine@redhat.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 0756415f147dda15a417bd79eef9a62027d176e6)
+---
+ src/network/virtnetworkd.service.in | 3 +++
+ src/remote/libvirtd.service.in      | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/src/network/virtnetworkd.service.in b/src/network/virtnetworkd.service.in
+index 656e8b4f84..56182e1693 100644
+--- a/src/network/virtnetworkd.service.in
++++ b/src/network/virtnetworkd.service.in
+@@ -5,6 +5,9 @@ Requires=virtnetworkd.socket
+ Requires=virtnetworkd-ro.socket
+ Requires=virtnetworkd-admin.socket
+ After=network.target
++After=firewalld.service
++After=iptables.service
++After=ip6tables.service
+ After=dbus.service
+ After=apparmor.service
+ After=local-fs.target
+diff --git a/src/remote/libvirtd.service.in b/src/remote/libvirtd.service.in
+index 90b2cad5b0..cc0d4e3693 100644
+--- a/src/remote/libvirtd.service.in
++++ b/src/remote/libvirtd.service.in
+@@ -11,6 +11,9 @@ Wants=libvirtd-admin.socket
+ Wants=systemd-machined.service
+ Before=libvirt-guests.service
+ After=network.target
++After=firewalld.service
++After=iptables.service
++After=ip6tables.service
+ After=dbus.service
+ After=iscsid.service
+ After=apparmor.service

0005-libxl-fix-crash-when-initializing-driver.patch

@@ -0,0 +1,43 @@
+From: Jim Fehlig <jfehlig@suse.com>
+Date: Fri, 3 Apr 2020 15:51:48 -0600
+Subject: [PATCH] libxl: fix crash when initializing driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Commit 54a401af478 split out DriverConfigInit from DriverConfigNew, but
+then called it a bit late from libxlStateInitialize. The cfg is used in
+libxlDriverConfigLoadFile and when uninitialized results in a crash.
+Calling DriverConfigInit immediately after DriverConfigNew fixes the
+crash.
+
+Signed-off-by: Jim Fehlig <jfehlig@suse.com>
+Reviewed-by: Erik Skultety <eskultet@redhat.com>
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+(cherry picked from commit 88011ed280c4f946a7b8e7ffcea2335eb075de60)
+---
+ src/libxl/libxl_driver.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c
+index f2387e2a20..c4fb791fa0 100644
+--- a/src/libxl/libxl_driver.c
++++ b/src/libxl/libxl_driver.c
+@@ -703,14 +703,14 @@ libxlStateInitialize(bool privileged,
+     if (!(cfg = libxlDriverConfigNew()))
+         goto error;
+ 
++    if (libxlDriverConfigInit(cfg) < 0)
++        goto error;
++
+     driverConf = g_strdup_printf("%s/libxl.conf", cfg->configBaseDir);
+ 
+     if (libxlDriverConfigLoadFile(cfg, driverConf) < 0)
+         goto error;
+ 
+-    if (libxlDriverConfigInit(cfg) < 0)
+-        goto error;
+-
+     /* Register the callbacks providing access to libvirt's event loop */
+     libxl_osevent_register_hooks(cfg->ctx, &libxl_osevent_callbacks, cfg->ctx);
+ 

Makefile

@@ -1,21 +0,0 @@
-# Makefile for source rpm: libvirt
-# $Id$
-NAME := libvirt
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attempt a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)

sources

@@ -1 +1 @@
-2462e768e1518026c3105a0466b5fece  libvirt-2.2.0.tar.xz
+SHA512 (libvirt-6.1.0.tar.xz) = 17a2641f300a4a05149261bae74ac856e9a2511a259146595d2e2412c4a0601d88369b0544ba86edc80e433a47cf828317d8de38c6ec86a1b3efaca75294a606