Fix the test suite on s390x

libvirt-4.7.0-5.fc29
CVE-2019-10161: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API (bz #1722463, bz #1720115) CVE-2019-10166: virDomainManagedSaveDefineXML API exposed to readonly clients (bz #1722462, bz #1720114) CVE-2019-10167: arbitrary command execution via virConnectGetDomainCapabilities API (bz #1722464, bz #1720117) CVE-2019-10168: arbitrary command execution via virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU APIs (bz #1722466, bz #1720118) CVE-2019-3886: virsh domhostname command discloses guest hostname in readonly mode [fedora-rawhide Failed to attache NEW rbd device to guest (bz #1672620) PCI hostdev interface segfault (bz #1692053)
2019-06-20 16:45:14 -04:00 · 2019-06-20 13:02:52 -04:00 · 2019-05-21 17:06:47 +01:00 · 2019-05-14 19:45:59 +01:00 · 2019-04-02 11:57:46 -04:00
35 changed files with 1052 additions and 1130 deletions
@@ -0,0 +1,112 @@
+From: Andrea Bolognani <abologna@redhat.com>
+Date: Wed, 27 Feb 2019 18:41:35 +0100
+Subject: [PATCH] qemu: Allow creating ppc64 guests with graphics and no USB
+ mouse
+
+The existing behavior for ppc64 guests is to always add a USB
+keyboard and mouse combo if graphics are present; unfortunately,
+this means any attempt to use a USB tablet will cause both pointing
+devices to show up in the guest, which in turn will result in poor
+user experience.
+
+We can't just stop adding the USB mouse or start adding a USB tablet
+instead, because existing applications and users might rely on the
+current behavior; however, we can avoid adding the USB mouse if a USB
+tablet is already present, thus allowing users and applications to
+create guests that contain a single pointing device.
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1683681
+
+Signed-off-by: Andrea Bolognani <abologna@redhat.com>
+Reviewed-by: Cole Robinson <crobinso@redhat.com>
+(cherry picked from commit 186bb479d0f409dc75175bea48a760838c479a6c)
+---
+ src/qemu/qemu_domain.c                        | 20 ++++++++
+ .../ppc64-pseries-graphics.ppc64-latest.args  | 47 +++++++++++++++++++
+ 2 files changed, 67 insertions(+)
+ create mode 100644 tests/qemuxml2argvdata/ppc64-pseries-graphics.ppc64-latest.args
+
+diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
+index f161cf6c84..764ffacb2e 100644
+--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
+@@ -3384,6 +3384,26 @@ qemuDomainDefAddDefaultDevices(virDomainDefPtr def,
+         def->memballoon = memballoon;
+     }
+ 
+    if (addDefaultUSBMouse) {
+        bool hasUSBTablet = false;
+        size_t j;
+
+        for (j = 0; j < def->ninputs; j++) {
+            if (def->inputs[j]->type == VIR_DOMAIN_INPUT_TYPE_TABLET &&
+                def->inputs[j]->bus == VIR_DOMAIN_INPUT_BUS_USB) {
+                hasUSBTablet = true;
+                break;
+            }
+        }
+
+        /* Historically, we have automatically added USB keyboard and
+         * mouse to some guests. While the former device is generally
+         * safe to have, adding the latter is undesiderable if a USB
+         * tablet is already present in the guest */
+        if (hasUSBTablet)
+            addDefaultUSBMouse = false;
+    }
+
+     if (addDefaultUSBKBD &&
+         def->ngraphics > 0 &&
+         virDomainDefMaybeAddInput(def,
+diff --git a/tests/qemuxml2argvdata/ppc64-pseries-graphics.ppc64-latest.args b/tests/qemuxml2argvdata/ppc64-pseries-graphics.ppc64-latest.args
+new file mode 100644
+index 0000000000..b81648f078
+--- /dev/null
+++ b/tests/qemuxml2argvdata/ppc64-pseries-graphics.ppc64-latest.args
+@@ -0,0 +1,47 @@
+LC_ALL=C \
+PATH=/bin \
+HOME=/home/test \
+USER=test \
+LOGNAME=test \
+QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-ppc64 \
+-name guest=guest,debug-threads=on \
+-S \
+-object secret,id=masterKey0,format=raw,\
+file=/tmp/lib/domain--1-guest/master-key.aes \
+-machine pseries,accel=tcg,usb=off,dump-guest-core=off \
+-m 4096 \
+-realtime mlock=off \
+-smp 4,sockets=4,cores=1,threads=1 \
+-uuid b35969f7-e7cf-4d90-a9a0-4dd9000f9824 \
+-no-user-config \
+-nodefaults \
+-chardev socket,id=charmonitor,fd=1729,server,nowait \
+-mon chardev=charmonitor,id=monitor,mode=control \
+-rtc base=utc \
+-no-shutdown \
+-boot strict=on \
+-device qemu-xhci,p2=15,p3=15,id=usb,bus=pci.0,addr=0x2 \
+-device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x3 \
+-drive file=/var/lib/libvirt/images/guest.qcow2,format=qcow2,if=none,\
+id=drive-virtio-disk0 \
+-device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x4,drive=drive-virtio-disk0,\
+id=virtio-disk0,bootindex=1 \
+-netdev user,id=hostnet0 \
+-device virtio-net-pci,netdev=hostnet0,id=net0,mac=52:54:00:a2:44:92,bus=pci.0,\
+addr=0x1 \
+-chardev pty,id=charserial0 \
+-device spapr-vty,chardev=charserial0,id=serial0,reg=0x30000000 \
+-chardev socket,id=charchannel0,fd=1729,server,nowait \
+-device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,\
+id=channel0,name=org.qemu.guest_agent.0 \
+-device usb-tablet,id=input0,bus=usb.0,port=1 \
+-device usb-kbd,id=input1,bus=usb.0,port=2 \
+-vnc 127.0.0.1:0 \
+-device VGA,id=video0,vgamem_mb=16,bus=pci.0,addr=0x7 \
+-device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x5 \
+-object rng-random,id=objrng0,filename=/dev/urandom \
+-device virtio-rng-pci,rng=objrng0,id=rng0,bus=pci.0,addr=0x6 \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,\
+resourcecontrol=deny \
+-msg timestamp=on
@@ -1,145 +0,0 @@
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Mon, 18 Mar 2019 10:58:48 +0000
-Subject: [PATCH] storage: split off code for calling rbd_list
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The rbd_list method has a quite unpleasant signature returning an
-array of strings in a single buffer instead of an array. It is
-being deprecated in favour of rbd_list2. To maintain clarity of
-code when supporting both APIs in parallel, split the rbd_list
-code out into a separate method.
-
-In splitting this we now honour the rbd_list failures.
-
-Reviewed-by: Ján Tomko <jtomko@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit 28c8403ed07896d6d7e06d7726ed904027206719)
---
- src/storage/storage_backend_rbd.c | 83 +++++++++++++++++++++----------
- 1 file changed, 58 insertions(+), 25 deletions(-)
-
-diff --git a/src/storage/storage_backend_rbd.c b/src/storage/storage_backend_rbd.c
-index 2b7af1db23..0865163756 100644
--- a/src/storage/storage_backend_rbd.c
-+++ b/src/storage/storage_backend_rbd.c
-@@ -565,19 +565,68 @@ volStorageBackendRBDRefreshVolInfo(virStorageVolDefPtr vol,
-     return ret;
- }
- 
-+
-+static char **
-+virStorageBackendRBDGetVolNames(virStorageBackendRBDStatePtr ptr)
-+{
-+    char **names = NULL;
-+    size_t nnames = 0;
-+    int rc;
-+    size_t max_size = 1024;
-+    VIR_AUTOFREE(char *) namebuf = NULL;
-+    const char *name;
-+
-+    while (true) {
-+        if (VIR_ALLOC_N(namebuf, max_size) < 0)
-+            goto error;
-+
-+        rc = rbd_list(ptr->ioctx, namebuf, &max_size);
-+        if (rc >= 0)
-+            break;
-+        if (rc != -ERANGE) {
-+            virReportSystemError(-rc, "%s", _("Unable to list RBD images"));
-+            goto error;
-+        }
-+        VIR_FREE(namebuf);
-+    }
-+
-+    for (name = namebuf; name < namebuf + max_size;) {
-+        VIR_AUTOFREE(char *) namedup = NULL;
-+
-+        if (STREQ(name, ""))
-+            break;
-+
-+        if (VIR_STRDUP(namedup, name) < 0)
-+            goto error;
-+
-+        if (VIR_APPEND_ELEMENT(names, nnames, namedup) < 0)
-+            goto error;
-+
-+        name += strlen(name) + 1;
-+    }
-+
-+    if (VIR_EXPAND_N(names, nnames, 1) < 0)
-+        goto error;
-+
-+    return names;
-+
-+ error:
-+    virStringListFreeCount(names, nnames);
-+    return NULL;
-+}
-+
-+
- static int
- virStorageBackendRBDRefreshPool(virStoragePoolObjPtr pool)
- {
-    size_t max_size = 1024;
-     int ret = -1;
-    int len = -1;
-     int r = 0;
-    char *name;
-     virStoragePoolDefPtr def = virStoragePoolObjGetDef(pool);
-     virStorageBackendRBDStatePtr ptr = NULL;
-     struct rados_cluster_stat_t clusterstat;
-     struct rados_pool_stat_t poolstat;
-    VIR_AUTOFREE(char *) names = NULL;
-+    char **names = NULL;
-+    size_t i;
- 
-     if (!(ptr = virStorageBackendRBDNewState(pool)))
-         goto cleanup;
-@@ -602,33 +651,16 @@ virStorageBackendRBDRefreshPool(virStoragePoolObjPtr pool)
-               def->source.name, clusterstat.kb, clusterstat.kb_avail,
-               poolstat.num_bytes);
- 
-    while (true) {
-        if (VIR_ALLOC_N(names, max_size) < 0)
-            goto cleanup;
-
-        len = rbd_list(ptr->ioctx, names, &max_size);
-        if (len >= 0)
-            break;
-        if (len != -ERANGE) {
-            VIR_WARN("%s", "A problem occurred while listing RBD images");
-            goto cleanup;
-        }
-        VIR_FREE(names);
-    }
-+    if (!(names = virStorageBackendRBDGetVolNames(ptr)))
-+        goto cleanup;
- 
-    for (name = names; name < names + max_size;) {
-+    for (i = 0; names[i] != NULL; i++) {
-         VIR_AUTOPTR(virStorageVolDef) vol = NULL;
- 
-        if (STREQ(name, ""))
-            break;
-
-         if (VIR_ALLOC(vol) < 0)
-             goto cleanup;
- 
-        if (VIR_STRDUP(vol->name, name) < 0)
-            goto cleanup;
-
-        name += strlen(name) + 1;
-+        VIR_STEAL_PTR(vol->name, names[i]);
- 
-         r = volStorageBackendRBDRefreshVolInfo(vol, pool, ptr);
- 
-@@ -661,6 +693,7 @@ virStorageBackendRBDRefreshPool(virStoragePoolObjPtr pool)
-     ret = 0;
- 
-  cleanup:
-+    virStringListFree(names);
-     virStorageBackendRBDFreeState(&ptr);
-     return ret;
- }
@@ -0,0 +1,34 @@
+From: John Ferlan <jferlan@redhat.com>
+Date: Fri, 7 Sep 2018 16:01:27 -0400
+Subject: [PATCH] qemu: Remove duplicated qemuAgentCheckError
+
+Commit 5b3492fadb moved qemuAgentCheckError calls into
+qemuAgentCommand for various reasons; however, subsequent
+commit 0977b8aa0 adding a new command made call again
+So let's just remove the duplicitous call from
+qemuAgentGetInterfaces.
+
+Signed-off-by: John Ferlan <jferlan@redhat.com>
+ACKed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 9ed175fbc2deecfdaeabca7bc77c7e7ae33a3377)
+---
+ src/qemu/qemu_agent.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/src/qemu/qemu_agent.c b/src/qemu/qemu_agent.c
+index bf08871f18..d235c058a5 100644
+--- a/src/qemu/qemu_agent.c
+++ b/src/qemu/qemu_agent.c
+@@ -1987,10 +1987,9 @@ qemuAgentGetInterfaces(qemuAgentPtr mon,
+     if (!(cmd = qemuAgentMakeCommand("guest-network-get-interfaces", NULL)))
+         goto cleanup;
+ 
+-    if (qemuAgentCommand(mon, cmd, &reply, false, VIR_DOMAIN_QEMU_AGENT_COMMAND_BLOCK) < 0 ||
+-        qemuAgentCheckError(cmd, reply) < 0) {
+    if (qemuAgentCommand(mon, cmd, &reply, false,
+                         VIR_DOMAIN_QEMU_AGENT_COMMAND_BLOCK) < 0)
+         goto cleanup;
+-    }
+ 
+     if (!(ret_array = virJSONValueObjectGet(reply, "return"))) {
+         virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
@@ -1,92 +0,0 @@
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Mon, 18 Mar 2019 11:11:38 +0000
-Subject: [PATCH] storage: add support for new rbd_list2 method
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The rbd_list method has been deprecated in Ceph >= 14.0.0
-in favour of the new rbd_list2 method which populates an
-array of structs.
-
-Reviewed-by: Ján Tomko <jtomko@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit 3aa190f2a43a632b542a6ba751a6c3ab4d51f1dd)
---
- m4/virt-storage-rbd.m4            |  1 +
- src/storage/storage_backend_rbd.c | 43 +++++++++++++++++++++++++++++++
- 2 files changed, 44 insertions(+)
-
-diff --git a/m4/virt-storage-rbd.m4 b/m4/virt-storage-rbd.m4
-index 17e2115309..f3d9d04908 100644
--- a/m4/virt-storage-rbd.m4
-+++ b/m4/virt-storage-rbd.m4
-@@ -33,6 +33,7 @@ AC_DEFUN([LIBVIRT_STORAGE_CHECK_RBD], [
-       old_LIBS="$LIBS"
-       LIBS="$LIBS $LIBRBD_LIBS"
-       AC_CHECK_FUNCS([rbd_get_features],[],[LIBRBD_FOUND=no])
-+      AC_CHECK_FUNCS([rbd_list2])
-       LIBS="$old_LIBS"
-     fi
- 
-diff --git a/src/storage/storage_backend_rbd.c b/src/storage/storage_backend_rbd.c
-index 0865163756..bfc3419f9c 100644
--- a/src/storage/storage_backend_rbd.c
-+++ b/src/storage/storage_backend_rbd.c
-@@ -566,6 +566,48 @@ volStorageBackendRBDRefreshVolInfo(virStorageVolDefPtr vol,
- }
- 
- 
-+#ifdef HAVE_RBD_LIST2
-+static char **
-+virStorageBackendRBDGetVolNames(virStorageBackendRBDStatePtr ptr)
-+{
-+    char **names = NULL;
-+    size_t nnames = 0;
-+    int rc;
-+    rbd_image_spec_t *images = NULL;
-+    size_t nimages = 16;
-+    size_t i;
-+
-+    while (true) {
-+        if (VIR_ALLOC_N(images, nimages) < 0)
-+            goto error;
-+
-+        rc = rbd_list2(ptr->ioctx, images, &nimages);
-+        if (rc >= 0)
-+            break;
-+        if (rc != -ERANGE) {
-+            virReportSystemError(-rc, "%s", _("Unable to list RBD images"));
-+            goto error;
-+        }
-+    }
-+
-+    if (VIR_ALLOC_N(names, nimages + 1) < 0)
-+        goto error;
-+    nnames = nimages;
-+
-+    for (i = 0; i < nimages; i++)
-+        VIR_STEAL_PTR(names[i], images->name);
-+
-+    return names;
-+
-+ error:
-+    virStringListFreeCount(names, nnames);
-+    rbd_image_spec_list_cleanup(images, nimages);
-+    VIR_FREE(images);
-+    return NULL;
-+}
-+
-+#else /* ! HAVE_RBD_LIST2 */
-+
- static char **
- virStorageBackendRBDGetVolNames(virStorageBackendRBDStatePtr ptr)
- {
-@@ -614,6 +656,7 @@ virStorageBackendRBDGetVolNames(virStorageBackendRBDStatePtr ptr)
-     virStringListFreeCount(names, nnames);
-     return NULL;
- }
-+#endif /* ! HAVE_RBD_LIST2 */
- 
- 
- static int
@@ -1,133 +0,0 @@
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Mon, 18 Mar 2019 17:31:21 +0000
-Subject: [PATCH] network: improve error report when firewall chain creation
- fails
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-During startup we create some top level chains in which all
-virtual network firewall rules will be placed. The upfront
-creation is done to avoid slowing down creation of individual
-virtual networks by checking for chain existance every time.
-
-There are some factors which can cause this upfront creation
-to fail and while a message will get into the libvirtd log
-this won't be seen by users who later try to start a virtual
-network. Instead they'll just get a message saying that the
-libvirt top level chain does not exist. This message is
-accurate, but unhelpful for solving the root cause.
-
-This patch thus saves any error during daemon startup and
-reports it when trying to create a virtual network later.
-
-Reviewed-by: Andrea Bolognani <abologna@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit 9f4e35dc73ec9e940aa61bc7c140c2b800218ef3)
---
- src/network/bridge_driver.c          |  3 +--
- src/network/bridge_driver_linux.c    | 31 +++++++++++++++++++++-------
- src/network/bridge_driver_nop.c      |  3 +--
- src/network/bridge_driver_platform.h |  2 +-
- 4 files changed, 27 insertions(+), 12 deletions(-)
-
-diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
-index b3ca5b8a15..1da60f0a21 100644
--- a/src/network/bridge_driver.c
-+++ b/src/network/bridge_driver.c
-@@ -2108,8 +2108,7 @@ static void
- networkReloadFirewallRules(virNetworkDriverStatePtr driver, bool startup)
- {
-     VIR_INFO("Reloading iptables rules");
-    if (networkPreReloadFirewallRules(startup) < 0)
-        return;
-+    networkPreReloadFirewallRules(startup);
-     virNetworkObjListForEach(driver->networks,
-                              networkReloadFirewallRulesHelper,
-                              NULL);
-diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_linux.c
-index b10d0a6c4d..c899f4b6d0 100644
--- a/src/network/bridge_driver_linux.c
-+++ b/src/network/bridge_driver_linux.c
-@@ -35,11 +35,25 @@ VIR_LOG_INIT("network.bridge_driver_linux");
- 
- #define PROC_NET_ROUTE "/proc/net/route"
- 
-int networkPreReloadFirewallRules(bool startup)
-+static virErrorPtr errInit;
-+
-+void networkPreReloadFirewallRules(bool startup)
- {
-    int ret = iptablesSetupPrivateChains();
-    if (ret < 0)
-        return -1;
-+    int rc;
-+
-+    /* We create global rules upfront as we don't want
-+     * the perf hit of conditionally figuring out whether
-+     * to create them each time a network is started.
-+     *
-+     * Any errors here are saved to be reported at time
-+     * of starting the network though as that makes them
-+     * more likely to be seen by a human
-+     */
-+    rc = iptablesSetupPrivateChains();
-+    if (rc < 0) {
-+        errInit = virSaveLastError();
-+        virResetLastError();
-+    }
- 
-     /*
-      * If this is initial startup, and we just created the
-@@ -54,10 +68,8 @@ int networkPreReloadFirewallRules(bool startup)
-      * rules will be present. Thus we can safely just tell it
-      * to always delete from the builin chain
-      */
-    if (startup && ret == 1)
-+    if (startup && rc == 1)
-         iptablesSetDeletePrivate(false);
-
-    return 0;
- }
- 
- 
-@@ -671,6 +683,11 @@ int networkAddFirewallRules(virNetworkDefPtr def)
-     virFirewallPtr fw = NULL;
-     int ret = -1;
- 
-+    if (errInit) {
-+        virSetError(errInit);
-+        return -1;
-+    }
-+
-     if (def->bridgeZone) {
- 
-         /* if a firewalld zone has been specified, fail/log an error
-diff --git a/src/network/bridge_driver_nop.c b/src/network/bridge_driver_nop.c
-index a0e57012f9..ea9db338cb 100644
--- a/src/network/bridge_driver_nop.c
-+++ b/src/network/bridge_driver_nop.c
-@@ -19,9 +19,8 @@
- 
- #include <config.h>
- 
-int networkPreReloadFirewallRules(bool startup ATTRIBUTE_UNUSED)
-+void networkPreReloadFirewallRules(bool startup ATTRIBUTE_UNUSED)
- {
-    return 0;
- }
- 
- 
-diff --git a/src/network/bridge_driver_platform.h b/src/network/bridge_driver_platform.h
-index baeb22bc3e..95fd64bdc7 100644
--- a/src/network/bridge_driver_platform.h
-+++ b/src/network/bridge_driver_platform.h
-@@ -58,7 +58,7 @@ struct _virNetworkDriverState {
- typedef struct _virNetworkDriverState virNetworkDriverState;
- typedef virNetworkDriverState *virNetworkDriverStatePtr;
- 
-int networkPreReloadFirewallRules(bool startup);
-+void networkPreReloadFirewallRules(bool startup);
- void networkPostReloadFirewallRules(bool startup);
- 
- int networkCheckRouteCollision(virNetworkDefPtr def);
@@ -0,0 +1,40 @@
+From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
+Date: Fri, 4 Jan 2019 10:17:46 +0100
+Subject: [PATCH] qemu: require reply from guest agent in
+ qemuAgentGetInterfaces
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Since its introduction in commit 0977b8aa071 (released in v1.2.14)
+qemuAgentGetInterfaces calls qemuAgentCommand with needReply=false,
+which allows qemuAgentCommand to return 0 even when it did not get
+any reply from the agent.
+
+Set needReply to true, since we dereference it right after.
+
+This can be hit if libvirt is waiting for an event from the agent
+(e.g. shutdown) and the agent cannot reply in time (e.g. due to
+the guest being shut down), as reported in:
+https://bugzilla.redhat.com/show_bug.cgi?id=1663051
+
+Signed-off-by: Ján Tomko <jtomko@redhat.com>
+Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
+(cherry picked from commit 7cfd1fbb1332ae5df678b9f41a62156cb2e88c73)
+---
+ src/qemu/qemu_agent.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/qemu/qemu_agent.c b/src/qemu/qemu_agent.c
+index d235c058a5..af0c054f99 100644
+--- a/src/qemu/qemu_agent.c
+++ b/src/qemu/qemu_agent.c
+@@ -1987,7 +1987,7 @@ qemuAgentGetInterfaces(qemuAgentPtr mon,
+     if (!(cmd = qemuAgentMakeCommand("guest-network-get-interfaces", NULL)))
+         goto cleanup;
+ 
+-    if (qemuAgentCommand(mon, cmd, &reply, false,
+    if (qemuAgentCommand(mon, cmd, &reply, true,
+                          VIR_DOMAIN_QEMU_AGENT_COMMAND_BLOCK) < 0)
+         goto cleanup;
+ 
@@ -20,10 +20,10 @@ Reviewed-by: Ján Tomko <jtomko@redhat.com>
 1 file changed, 1 insertion(+), 4 deletions(-)

 diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c
-index d3a88da21d..470de83a87 100644
+index cb27550025..ce48ca6867 100644
 --- a/src/cpu/cpu_x86.c
 +++ b/src/cpu/cpu_x86.c
-@@ -165,7 +165,6 @@ struct _virCPUx86Map {
+@@ -163,7 +163,6 @@ struct _virCPUx86Map {
 };
 
 static virCPUx86MapPtr cpuMap;
@@ -31,7 +31,7 @@ index d3a88da21d..470de83a87 100644
 
 int virCPUx86DriverOnceInit(void);
 VIR_ONCE_GLOBAL_INIT(virCPUx86Driver);
-@@ -1332,8 +1331,6 @@ virCPUx86DriverOnceInit(void)
+@@ -1331,8 +1330,6 @@ virCPUx86DriverOnceInit(void)
     if (!(cpuMap = virCPUx86LoadMap()))
         return -1;
 
@@ -40,7 +40,7 @@ index d3a88da21d..470de83a87 100644
     return 0;
 }
 
-@@ -2373,7 +2370,7 @@ virCPUx86GetHost(virCPUDefPtr cpu,
+@@ -2372,7 +2369,7 @@ virCPUx86GetHost(virCPUDefPtr cpu,
         goto cleanup;
 
     ret = x86DecodeCPUData(cpu, cpuData, models);
@@ -1,149 +0,0 @@
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Mon, 18 Mar 2019 16:49:32 +0000
-Subject: [PATCH] network: split setup of ipv4 and ipv6 top level chains
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-During startup libvirtd creates top level chains for both ipv4
-and ipv6 protocols. If this fails for any reason then startup
-of virtual networks is blocked.
-
-The default virtual network, however, only requires use of ipv4
-and some servers have ipv6 disabled so it is expected that ipv6
-chain creation will fail. There could equally be servers with
-no ipv4, only ipv6.
-
-This patch thus makes error reporting a little more fine grained
-so that it works more sensibly when either ipv4 or ipv6 is
-disabled on the server. Only the protocols that are actually
-used by the virtual network have errors reported.
-
-Reviewed-by: Andrea Bolognani <abologna@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit 686803a1a2e1e0641916b1c9e2c7e3910fe598d4)
---
- src/network/bridge_driver_linux.c | 34 +++++++++++++++++++++++++------
- src/util/viriptables.c            | 14 ++++---------
- src/util/viriptables.h            |  2 +-
- 3 files changed, 33 insertions(+), 17 deletions(-)
-
-diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_linux.c
-index c899f4b6d0..50fc197134 100644
--- a/src/network/bridge_driver_linux.c
-+++ b/src/network/bridge_driver_linux.c
-@@ -35,10 +35,12 @@ VIR_LOG_INIT("network.bridge_driver_linux");
- 
- #define PROC_NET_ROUTE "/proc/net/route"
- 
-static virErrorPtr errInit;
-+static virErrorPtr errInitV4;
-+static virErrorPtr errInitV6;
- 
- void networkPreReloadFirewallRules(bool startup)
- {
-+    bool created = false;
-     int rc;
- 
-     /* We create global rules upfront as we don't want
-@@ -49,11 +51,21 @@ void networkPreReloadFirewallRules(bool startup)
-      * of starting the network though as that makes them
-      * more likely to be seen by a human
-      */
-    rc = iptablesSetupPrivateChains();
-+    rc = iptablesSetupPrivateChains(VIR_FIREWALL_LAYER_IPV4);
-     if (rc < 0) {
-        errInit = virSaveLastError();
-+        errInitV4 = virSaveLastError();
-         virResetLastError();
-     }
-+    if (rc)
-+        created = true;
-+
-+    rc = iptablesSetupPrivateChains(VIR_FIREWALL_LAYER_IPV6);
-+    if (rc < 0) {
-+        errInitV6 = virSaveLastError();
-+        virResetLastError();
-+    }
-+    if (rc)
-+        created = true;
- 
-     /*
-      * If this is initial startup, and we just created the
-@@ -68,7 +80,7 @@ void networkPreReloadFirewallRules(bool startup)
-      * rules will be present. Thus we can safely just tell it
-      * to always delete from the builin chain
-      */
-    if (startup && rc == 1)
-+    if (startup && created)
-         iptablesSetDeletePrivate(false);
- }
- 
-@@ -683,8 +695,18 @@ int networkAddFirewallRules(virNetworkDefPtr def)
-     virFirewallPtr fw = NULL;
-     int ret = -1;
- 
-    if (errInit) {
-        virSetError(errInit);
-+    if (errInitV4 &&
-+        (virNetworkDefGetIPByIndex(def, AF_INET, 0) ||
-+         virNetworkDefGetRouteByIndex(def, AF_INET, 0))) {
-+        virSetError(errInitV4);
-+        return -1;
-+    }
-+
-+    if (errInitV6 &&
-+        (virNetworkDefGetIPByIndex(def, AF_INET6, 0) ||
-+         virNetworkDefGetRouteByIndex(def, AF_INET6, 0) ||
-+         def->ipv6nogw)) {
-+        virSetError(errInitV6);
-         return -1;
-     }
- 
-diff --git a/src/util/viriptables.c b/src/util/viriptables.c
-index d67b640a3b..0e3c0ad73a 100644
--- a/src/util/viriptables.c
-+++ b/src/util/viriptables.c
-@@ -127,7 +127,7 @@ iptablesPrivateChainCreate(virFirewallPtr fw,
- 
- 
- int
-iptablesSetupPrivateChains(void)
-+iptablesSetupPrivateChains(virFirewallLayer layer)
- {
-     virFirewallPtr fw = NULL;
-     int ret = -1;
-@@ -143,17 +143,11 @@ iptablesSetupPrivateChains(void)
-     };
-     bool changed = false;
-     iptablesGlobalChainData data[] = {
-        { VIR_FIREWALL_LAYER_IPV4, "filter",
-+        { layer, "filter",
-           filter_chains, ARRAY_CARDINALITY(filter_chains), &changed },
-        { VIR_FIREWALL_LAYER_IPV4, "nat",
-+        { layer, "nat",
-           natmangle_chains, ARRAY_CARDINALITY(natmangle_chains), &changed },
-        { VIR_FIREWALL_LAYER_IPV4, "mangle",
-          natmangle_chains, ARRAY_CARDINALITY(natmangle_chains), &changed },
-        { VIR_FIREWALL_LAYER_IPV6, "filter",
-          filter_chains, ARRAY_CARDINALITY(filter_chains), &changed },
-        { VIR_FIREWALL_LAYER_IPV6, "nat",
-          natmangle_chains, ARRAY_CARDINALITY(natmangle_chains), &changed },
-        { VIR_FIREWALL_LAYER_IPV6, "mangle",
-+        { layer, "mangle",
-           natmangle_chains, ARRAY_CARDINALITY(natmangle_chains), &changed },
-     };
-     size_t i;
-diff --git a/src/util/viriptables.h b/src/util/viriptables.h
-index 903f390f89..e680407ec8 100644
--- a/src/util/viriptables.h
-+++ b/src/util/viriptables.h
-@@ -24,7 +24,7 @@
- # include "virsocketaddr.h"
- # include "virfirewall.h"
- 
-int              iptablesSetupPrivateChains      (void);
-+int              iptablesSetupPrivateChains      (virFirewallLayer layer);
- 
- void             iptablesSetDeletePrivate        (bool pvt);
- 
@@ -1,46 +0,0 @@
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Wed, 13 Mar 2019 16:21:15 +0000
-Subject: [PATCH] network: avoid trying to create global firewall rules if
- unprivileged
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The unprivileged libvirtd does not have permission to create firewall
-rules, or bridge devices, or do anything to the host network in
-general. Historically we still activate the network driver though and
-let the network start API call fail.
-
-The startup code path which reloads firewall rules on active networks
-would thus effectively be a no-op when unprivileged as it is impossible
-for there to be any active networks
-
-With the change to use a global set of firewall chains, however, we now
-have code that is run unconditionally.
-
-Ideally we would not register the network driver at all when
-unprivileged, but the entanglement with the virt drivers currently makes
-that impractical. As a temporary hack, we just make the firewall reload
-into a no-op.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit 5d010c3df6152cf5fb00f1f67d22151241f4a8a2)
---
- src/network/bridge_driver.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
-index 1da60f0a21..0e1d5efd8e 100644
--- a/src/network/bridge_driver.c
-+++ b/src/network/bridge_driver.c
-@@ -2108,6 +2108,10 @@ static void
- networkReloadFirewallRules(virNetworkDriverStatePtr driver, bool startup)
- {
-     VIR_INFO("Reloading iptables rules");
-+    /* Ideally we'd not even register the driver when unprivilegd
-+     * but until we untangle the virt driver that's not viable */
-+    if (!driver->privileged)
-+        return;
-     networkPreReloadFirewallRules(startup);
-     virNetworkObjListForEach(driver->networks,
-                              networkReloadFirewallRulesHelper,
@@ -17,6 +17,13 @@ correct microcode version while still using the old host CPU model
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit 673c62a3b7855a0685d8f116e227c402720b9ee9)
+
+Conflicts:
+        src/qemu/qemu_capabilities.c
+            - virQEMUCapsCacheLookupByArch refactoring (commits
+              7948ad4129a and 1a3de67001c) are missing
+
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 ---
 src/qemu/qemu_capabilities.c | 12 ++++++++----
 src/qemu/qemu_capabilities.h |  3 +--
@@ -25,10 +32,10 @@ Reviewed-by: Ján Tomko <jtomko@redhat.com>
 4 files changed, 11 insertions(+), 15 deletions(-)

 diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
-index b48bcbebee..e5b1c90253 100644
+index a075677421..eaf369f5b1 100644
 --- a/src/qemu/qemu_capabilities.c
 +++ b/src/qemu/qemu_capabilities.c
-@@ -4487,7 +4487,7 @@ virQEMUCapsNewData(const char *binary,
+@@ -4700,7 +4700,7 @@ virQEMUCapsNewData(const char *binary,
                                            priv->libDir,
                                            priv->runUid,
                                            priv->runGid,
@@ -37,7 +44,7 @@ index b48bcbebee..e5b1c90253 100644
                                            priv->kernelVersion);
 }
 
-@@ -4570,8 +4570,7 @@ virFileCachePtr
+@@ -4783,8 +4783,7 @@ virFileCachePtr
 virQEMUCapsCacheNew(const char *libDir,
                     const char *cacheDir,
                     uid_t runUid,
@@ -47,15 +54,15 @@ index b48bcbebee..e5b1c90253 100644
 {
     char *capsCacheDir = NULL;
     virFileCachePtr cache = NULL;
-@@ -4595,7 +4594,6 @@ virQEMUCapsCacheNew(const char *libDir,
+@@ -4808,7 +4807,6 @@ virQEMUCapsCacheNew(const char *libDir,
 
     priv->runUid = runUid;
     priv->runGid = runGid;
 -    priv->microcodeVersion = microcodeVersion;
-     priv->kvmUsable = VIR_TRISTATE_BOOL_ABSENT;
 
     if (uname(&uts) == 0 &&
-@@ -4617,8 +4615,11 @@ virQEMUCapsPtr
+         virAsprintf(&priv->kernelVersion, "%s %s", uts.release, uts.version) < 0)
+@@ -4829,8 +4827,11 @@ virQEMUCapsPtr
 virQEMUCapsCacheLookup(virFileCachePtr cache,
                        const char *binary)
 {
@@ -67,28 +74,25 @@ index b48bcbebee..e5b1c90253 100644
     ret = virFileCacheLookup(cache, binary);
 
     VIR_DEBUG("Returning caps %p for %s", ret, binary);
-@@ -4672,6 +4673,7 @@ virQEMUCapsPtr
+@@ -4876,10 +4877,13 @@ virQEMUCapsPtr
 virQEMUCapsCacheLookupByArch(virFileCachePtr cache,
                              virArch arch)
 {
 +    virQEMUCapsCachePrivPtr priv = virFileCacheGetPriv(cache);
     virQEMUCapsPtr ret = NULL;
-     const char *binaryFilters[] = {
-         "qemu-system-",
-@@ -4684,6 +4686,8 @@ virQEMUCapsCacheLookupByArch(virFileCachePtr cache,
-     size_t i;
-     size_t j;
+     virArch target;
+     struct virQEMUCapsSearchData data = { .arch = arch };
 
 +    priv->microcodeVersion = virHostCPUGetMicrocodeVersion();
 +
-     for (i = 0; i < ARRAY_CARDINALITY(binaryFilters); i++) {
-         for (j = 0; j < ARRAY_CARDINALITY(archs); j++) {
-             struct virQEMUCapsSearchData data = {
+     ret = virFileCacheLookupByFunc(cache, virQEMUCapsCompareArch, &data);
+     if (!ret) {
+         /* If the first attempt at finding capabilities has failed, try
 diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
-index ba84052bca..a6a655ac0f 100644
+index 3d3a978759..956babc7eb 100644
 --- a/src/qemu/qemu_capabilities.h
 +++ b/src/qemu/qemu_capabilities.h
-@@ -587,8 +587,7 @@ void virQEMUCapsFilterByMachineType(virQEMUCapsPtr qemuCaps,
+@@ -574,8 +574,7 @@ void virQEMUCapsFilterByMachineType(virQEMUCapsPtr qemuCaps,
 virFileCachePtr virQEMUCapsCacheNew(const char *libDir,
                                     const char *cacheDir,
                                     uid_t uid,
@@ -99,10 +103,10 @@ index ba84052bca..a6a655ac0f 100644
                                       const char *binary);
 virQEMUCapsPtr virQEMUCapsCacheLookupCopy(virFileCachePtr cache,
 diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
-index 36426cd65a..75d31efd14 100644
+index a0f7c71675..75f8699e7d 100644
 --- a/src/qemu/qemu_driver.c
 +++ b/src/qemu/qemu_driver.c
-@@ -585,8 +585,6 @@ qemuStateInitialize(bool privileged,
+@@ -592,8 +592,6 @@ qemuStateInitialize(bool privileged,
     char *hugepagePath = NULL;
     char *memoryBackingPath = NULL;
     size_t i;
@@ -111,7 +115,7 @@ index 36426cd65a..75d31efd14 100644
 
     if (VIR_ALLOC(qemu_driver) < 0)
         return -1;
-@@ -809,15 +807,10 @@ qemuStateInitialize(bool privileged,
+@@ -813,15 +811,10 @@ qemuStateInitialize(bool privileged,
         run_gid = cfg->group;
     }
 
@@ -129,10 +133,10 @@ index 36426cd65a..75d31efd14 100644
         goto error;
 
 diff --git a/tests/testutilsqemu.c b/tests/testutilsqemu.c
-index 1736bad032..e30c0599ad 100644
+index 8438613f28..4e53f03f9e 100644
 --- a/tests/testutilsqemu.c
 +++ b/tests/testutilsqemu.c
-@@ -740,7 +740,7 @@ int qemuTestDriverInit(virQEMUDriver *driver)
+@@ -707,7 +707,7 @@ int qemuTestDriverInit(virQEMUDriver *driver)
 
     /* Using /dev/null for libDir and cacheDir automatically produces errors
      * upon attempt to use any of them */
@@ -1,24 +1,33 @@
 From: Jiri Denemark <jdenemar@redhat.com>
-Date: Tue, 9 Apr 2019 12:35:51 +0200
+Date: Fri, 5 Apr 2019 11:19:30 +0200
 Subject: [PATCH] cputest: Add data for Intel(R) Xeon(R) CPU E3-1225 v5
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit

-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 (cherry picked from commit 5cd9db3ac11e88846cbcf95fad9f6fae9d880dee)
+
+CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
+
+Conflicts:
+	tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
+	tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
+            - intel-pt feature is missing
+	    - stibp feature is missing
+
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 ---
 tests/cputest.c                               |   1 +
 .../x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml |   7 +
 .../x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml  |   8 +
- .../x86_64-cpuid-Xeon-E3-1225-v5-guest.xml    |  28 +
- .../x86_64-cpuid-Xeon-E3-1225-v5-host.xml     |  29 +
- .../x86_64-cpuid-Xeon-E3-1225-v5-json.xml     |  11 +
+ .../x86_64-cpuid-Xeon-E3-1225-v5-guest.xml    |  26 +
+ .../x86_64-cpuid-Xeon-E3-1225-v5-host.xml     |  27 +
+ .../x86_64-cpuid-Xeon-E3-1225-v5-json.xml     |  10 +
 .../x86_64-cpuid-Xeon-E3-1225-v5.json         | 652 ++++++++++++++++++
 .../x86_64-cpuid-Xeon-E3-1225-v5.sig          |   4 +
 .../x86_64-cpuid-Xeon-E3-1225-v5.xml          |  47 ++
- 9 files changed, 787 insertions(+)
+ 9 files changed, 782 insertions(+)
 create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml
 create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
 create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
@@ -29,10 +38,10 @@ Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml

 diff --git a/tests/cputest.c b/tests/cputest.c
-index b75d864d8e..5866ca9edb 100644
+index baf2b3c648..fbb2a86af8 100644
 --- a/tests/cputest.c
 +++ b/tests/cputest.c
-@@ -1184,6 +1184,7 @@ mymain(void)
+@@ -1190,6 +1190,7 @@ mymain(void)
     DO_TEST_CPUID(VIR_ARCH_X86_64, "Phenom-B95", JSON_HOST);
     DO_TEST_CPUID(VIR_ARCH_X86_64, "Ryzen-7-1800X-Eight-Core", JSON_HOST);
     DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-5110", JSON_NONE);
@@ -69,10 +78,10 @@ index 0000000000..0deca9fba6
 +</cpudata>
 diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
 new file mode 100644
-index 0000000000..70a0fc3286
+index 0000000000..993db80cc9
 --- /dev/null
 +++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
-@@ -0,0 +1,28 @@
+@@ -0,0 +1,26 @@
 +<cpu mode='custom' match='exact'>
 +  <model fallback='forbid'>Skylake-Client-IBRS</model>
 +  <vendor>Intel</vendor>
@@ -94,8 +103,6 @@ index 0000000000..70a0fc3286
 +  <feature policy='require' name='osxsave'/>
 +  <feature policy='require' name='tsc_adjust'/>
 +  <feature policy='require' name='clflushopt'/>
-+  <feature policy='require' name='intel-pt'/>
-+  <feature policy='require' name='stibp'/>
 +  <feature policy='require' name='ssbd'/>
 +  <feature policy='require' name='xsaves'/>
 +  <feature policy='require' name='pdpe1gb'/>
@@ -103,10 +110,10 @@ index 0000000000..70a0fc3286
 +</cpu>
 diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
 new file mode 100644
-index 0000000000..bbdfb6aa61
+index 0000000000..074a39ba1d
 --- /dev/null
 +++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
-@@ -0,0 +1,29 @@
+@@ -0,0 +1,27 @@
 +<cpu>
 +  <arch>x86_64</arch>
 +  <model>Skylake-Client-IBRS</model>
@@ -129,8 +136,6 @@ index 0000000000..bbdfb6aa61
 +  <feature name='osxsave'/>
 +  <feature name='tsc_adjust'/>
 +  <feature name='clflushopt'/>
-+  <feature name='intel-pt'/>
-+  <feature name='stibp'/>
 +  <feature name='ssbd'/>
 +  <feature name='xsaves'/>
 +  <feature name='pdpe1gb'/>
@@ -138,10 +143,10 @@ index 0000000000..bbdfb6aa61
 +</cpu>
 diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
 new file mode 100644
-index 0000000000..1f321db273
+index 0000000000..1984bd4cf2
 --- /dev/null
 +++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
-@@ -0,0 +1,11 @@
+@@ -0,0 +1,10 @@
 +<cpu mode='custom' match='exact'>
 +  <model fallback='forbid'>Skylake-Client-IBRS</model>
 +  <vendor>Intel</vendor>
@@ -149,7 +154,6 @@ index 0000000000..1f321db273
 +  <feature policy='require' name='hypervisor'/>
 +  <feature policy='require' name='tsc_adjust'/>
 +  <feature policy='require' name='clflushopt'/>
-+  <feature policy='require' name='stibp'/>
 +  <feature policy='require' name='ssbd'/>
 +  <feature policy='require' name='pdpe1gb'/>
 +</cpu>
@@ -1,57 +0,0 @@
-From: Andrea Bolognani <abologna@redhat.com>
-Date: Wed, 27 Feb 2019 18:41:35 +0100
-Subject: [PATCH] qemu: Allow creating ppc64 guests with graphics and no USB
- mouse
-
-The existing behavior for ppc64 guests is to always add a USB
-keyboard and mouse combo if graphics are present; unfortunately,
-this means any attempt to use a USB tablet will cause both pointing
-devices to show up in the guest, which in turn will result in poor
-user experience.
-
-We can't just stop adding the USB mouse or start adding a USB tablet
-instead, because existing applications and users might rely on the
-current behavior; however, we can avoid adding the USB mouse if a USB
-tablet is already present, thus allowing users and applications to
-create guests that contain a single pointing device.
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1683681
-
-Signed-off-by: Andrea Bolognani <abologna@redhat.com>
-Reviewed-by: Cole Robinson <crobinso@redhat.com>
-(cherry picked from commit 186bb479d0f409dc75175bea48a760838c479a6c)
---
- src/qemu/qemu_domain.c | 20 ++++++++++++++++++++
- 1 file changed, 20 insertions(+)
-
-diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
-index 59fe1eb401..915795ab84 100644
--- a/src/qemu/qemu_domain.c
-+++ b/src/qemu/qemu_domain.c
-@@ -3476,6 +3476,26 @@ qemuDomainDefAddDefaultDevices(virDomainDefPtr def,
-         virQEMUCapsGet(qemuCaps, QEMU_CAPS_VIRTIO_S390) && def->memballoon)
-         def->memballoon->model = VIR_DOMAIN_MEMBALLOON_MODEL_NONE;
- 
-+    if (addDefaultUSBMouse) {
-+        bool hasUSBTablet = false;
-+        size_t j;
-+
-+        for (j = 0; j < def->ninputs; j++) {
-+            if (def->inputs[j]->type == VIR_DOMAIN_INPUT_TYPE_TABLET &&
-+                def->inputs[j]->bus == VIR_DOMAIN_INPUT_BUS_USB) {
-+                hasUSBTablet = true;
-+                break;
-+            }
-+        }
-+
-+        /* Historically, we have automatically added USB keyboard and
-+         * mouse to some guests. While the former device is generally
-+         * safe to have, adding the latter is undesiderable if a USB
-+         * tablet is already present in the guest */
-+        if (hasUSBTablet)
-+            addDefaultUSBMouse = false;
-+    }
-+
-     if (addDefaultUSBKBD &&
-         def->ngraphics > 0 &&
-         virDomainDefMaybeAddInput(def,
@@ -16,10 +16,18 @@ Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 538d873571d7a682852dc1d70e5f4478f4d64e85)

 Conflicts:
+        src/cpu_map/x86_features.xml
+            - missing pconfig feature
+
        tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml
        tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml
            - test data missing downstream

+        tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
+        tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
+            - intel-pt feature is missing
+	    - stibp feature is missing
+
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 ---
 src/cpu_map/x86_features.xml                               | 3 +++
@@ -30,18 +38,18 @@ Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 5 files changed, 7 insertions(+), 1 deletion(-)

 diff --git a/src/cpu_map/x86_features.xml b/src/cpu_map/x86_features.xml
-index 02431bea29..11479f0433 100644
+index 109c653dbc..c8ae540ccc 100644
 --- a/src/cpu_map/x86_features.xml
 +++ b/src/cpu_map/x86_features.xml
-@@ -317,6 +317,9 @@
+@@ -290,6 +290,9 @@
   <feature name='avx512-4fmaps'>
     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00000008'/>
   </feature>
 +  <feature name='md-clear'> <!-- md_clear -->
 +    <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00000400'/>
 +  </feature>
-   <feature name='pconfig'>
-     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00040000'/>
+   <feature name='spec-ctrl'>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x04000000'/>
   </feature>
 diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
 index 0deca9fba6..74763a462b 100644
@@ -57,31 +65,31 @@ index 0deca9fba6..74763a462b 100644
   <cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000121' edx='0x2c100800'/>
 </cpudata>
 diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
-index 70a0fc3286..867970d2c7 100644
+index 993db80cc9..29c1fdb80a 100644
 --- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
 +++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
-@@ -20,6 +20,7 @@
+@@ -19,6 +19,7 @@
+   <feature policy='require' name='osxsave'/>
   <feature policy='require' name='tsc_adjust'/>
   <feature policy='require' name='clflushopt'/>
-   <feature policy='require' name='intel-pt'/>
 +  <feature policy='require' name='md-clear'/>
-   <feature policy='require' name='stibp'/>
   <feature policy='require' name='ssbd'/>
   <feature policy='require' name='xsaves'/>
+   <feature policy='require' name='pdpe1gb'/>
 diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
-index bbdfb6aa61..e7ced42797 100644
+index 074a39ba1d..2003ca9ef6 100644
 --- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
 +++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
-@@ -21,6 +21,7 @@
+@@ -20,6 +20,7 @@
+   <feature name='osxsave'/>
   <feature name='tsc_adjust'/>
   <feature name='clflushopt'/>
-   <feature name='intel-pt'/>
 +  <feature name='md-clear'/>
-   <feature name='stibp'/>
   <feature name='ssbd'/>
   <feature name='xsaves'/>
+   <feature name='pdpe1gb'/>
 diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
-index 1f321db273..a5591278df 100644
+index 1984bd4cf2..d6529c59a3 100644
 --- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
 +++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
@@ -5,6 +5,7 @@
@@ -89,6 +97,6 @@ index 1f321db273..a5591278df 100644
   <feature policy='require' name='tsc_adjust'/>
   <feature policy='require' name='clflushopt'/>
 +  <feature policy='require' name='md-clear'/>
-   <feature policy='require' name='stibp'/>
   <feature policy='require' name='ssbd'/>
   <feature policy='require' name='pdpe1gb'/>
+ </cpu>
@@ -1,53 +0,0 @@
-From: Pavel Hrdina <phrdina@redhat.com>
-Date: Tue, 19 Feb 2019 15:42:51 +0100
-Subject: [PATCH] util: implement virCgroupV2(Set|Get)CpusetMems
-
-Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
-(cherry picked from commit 74e7da060543a87610b42fc6ba26a45b0a6e3974)
---
- src/util/vircgroupv2.c | 25 +++++++++++++++++++++++++
- 1 file changed, 25 insertions(+)
-
-diff --git a/src/util/vircgroupv2.c b/src/util/vircgroupv2.c
-index e0fa8e1cc0..4cfbd52f2d 100644
--- a/src/util/vircgroupv2.c
-+++ b/src/util/vircgroupv2.c
-@@ -1561,6 +1561,28 @@ virCgroupV2GetCpuacctStat(virCgroupPtr group,
- }
- 
- 
-+static int
-+virCgroupV2SetCpusetMems(virCgroupPtr group,
-+                         const char *mems)
-+{
-+    return virCgroupSetValueStr(group,
-+                                VIR_CGROUP_CONTROLLER_CPUSET,
-+                                "cpuset.mems",
-+                                mems);
-+}
-+
-+
-+static int
-+virCgroupV2GetCpusetMems(virCgroupPtr group,
-+                         char **mems)
-+{
-+    return virCgroupGetValueStr(group,
-+                                VIR_CGROUP_CONTROLLER_CPUSET,
-+                                "cpuset.mems",
-+                                mems);
-+}
-+
-+
- virCgroupBackend virCgroupV2Backend = {
-     .type = VIR_CGROUP_BACKEND_TYPE_V2,
- 
-@@ -1620,6 +1642,9 @@ virCgroupBackend virCgroupV2Backend = {
- 
-     .getCpuacctUsage = virCgroupV2GetCpuacctUsage,
-     .getCpuacctStat = virCgroupV2GetCpuacctStat,
-+
-+    .setCpusetMems = virCgroupV2SetCpusetMems,
-+    .getCpusetMems = virCgroupV2GetCpusetMems,
- };
- 
- 
@@ -20,10 +20,10 @@ Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 1 file changed, 22 insertions(+)

 diff --git a/src/admin/admin_server_dispatch.c b/src/admin/admin_server_dispatch.c
-index 85e693d76c..6e3b99f97d 100644
+index b78ff902c0..9f25813ae3 100644
 --- a/src/admin/admin_server_dispatch.c
 +++ b/src/admin/admin_server_dispatch.c
-@@ -64,6 +64,28 @@ remoteAdmClientNew(virNetServerClientPtr client ATTRIBUTE_UNUSED,
+@@ -66,6 +66,28 @@ remoteAdmClientNew(virNetServerClientPtr client ATTRIBUTE_UNUSED,
                    void *opaque)
 {
     struct daemonAdmClientPrivate *priv;
@@ -1,50 +0,0 @@
-From: Pavel Hrdina <phrdina@redhat.com>
-Date: Tue, 19 Feb 2019 15:53:34 +0100
-Subject: [PATCH] util: implement virCgroupV2(Set|Get)CpusetMemoryMigrate
-
-Cgroups v2 don't have memory_migrate interface and the migration is
-enabled by default.
-
-Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
-(cherry picked from commit 77c1cf4da2f761a91756c09fa4fd37ae1802e650)
---
- src/util/vircgroupv2.c | 19 +++++++++++++++++++
- 1 file changed, 19 insertions(+)
-
-diff --git a/src/util/vircgroupv2.c b/src/util/vircgroupv2.c
-index 4cfbd52f2d..f3aa6ebc48 100644
--- a/src/util/vircgroupv2.c
-+++ b/src/util/vircgroupv2.c
-@@ -1583,6 +1583,23 @@ virCgroupV2GetCpusetMems(virCgroupPtr group,
- }
- 
- 
-+static int
-+virCgroupV2SetCpusetMemoryMigrate(virCgroupPtr group ATTRIBUTE_UNUSED,
-+                                  bool migrate ATTRIBUTE_UNUSED)
-+{
-+    return 0;
-+}
-+
-+
-+static int
-+virCgroupV2GetCpusetMemoryMigrate(virCgroupPtr group ATTRIBUTE_UNUSED,
-+                                  bool *migrate)
-+{
-+    *migrate = true;
-+    return 0;
-+}
-+
-+
- virCgroupBackend virCgroupV2Backend = {
-     .type = VIR_CGROUP_BACKEND_TYPE_V2,
- 
-@@ -1645,6 +1662,8 @@ virCgroupBackend virCgroupV2Backend = {
- 
-     .setCpusetMems = virCgroupV2SetCpusetMems,
-     .getCpusetMems = virCgroupV2GetCpusetMems,
-+    .setCpusetMemoryMigrate = virCgroupV2SetCpusetMemoryMigrate,
-+    .getCpusetMemoryMigrate = virCgroupV2GetCpusetMemoryMigrate,
- };
- 
- 
@@ -1,52 +0,0 @@
-From: Pavel Hrdina <phrdina@redhat.com>
-Date: Tue, 19 Feb 2019 15:55:38 +0100
-Subject: [PATCH] util: implement virCgroupV2(Set|Get)CpusetCpus
-
-Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
-(cherry picked from commit 3b72c84ff1c1b8b393ba9c2ccb004f8eb1ebda95)
---
- src/util/vircgroupv2.c | 24 ++++++++++++++++++++++++
- 1 file changed, 24 insertions(+)
-
-diff --git a/src/util/vircgroupv2.c b/src/util/vircgroupv2.c
-index f3aa6ebc48..25afab1cad 100644
--- a/src/util/vircgroupv2.c
-+++ b/src/util/vircgroupv2.c
-@@ -1600,6 +1600,28 @@ virCgroupV2GetCpusetMemoryMigrate(virCgroupPtr group ATTRIBUTE_UNUSED,
- }
- 
- 
-+static int
-+virCgroupV2SetCpusetCpus(virCgroupPtr group,
-+                         const char *cpus)
-+{
-+    return virCgroupSetValueStr(group,
-+                                VIR_CGROUP_CONTROLLER_CPUSET,
-+                                "cpuset.cpus",
-+                                cpus);
-+}
-+
-+
-+static int
-+virCgroupV2GetCpusetCpus(virCgroupPtr group,
-+                         char **cpus)
-+{
-+    return virCgroupGetValueStr(group,
-+                                VIR_CGROUP_CONTROLLER_CPUSET,
-+                                "cpuset.cpus",
-+                                cpus);
-+}
-+
-+
- virCgroupBackend virCgroupV2Backend = {
-     .type = VIR_CGROUP_BACKEND_TYPE_V2,
- 
-@@ -1664,6 +1686,8 @@ virCgroupBackend virCgroupV2Backend = {
-     .getCpusetMems = virCgroupV2GetCpusetMems,
-     .setCpusetMemoryMigrate = virCgroupV2SetCpusetMemoryMigrate,
-     .getCpusetMemoryMigrate = virCgroupV2GetCpusetMemoryMigrate,
-+    .setCpusetCpus = virCgroupV2SetCpusetCpus,
-+    .getCpusetCpus = virCgroupV2GetCpusetCpus,
- };
- 
- 
@@ -1,30 +0,0 @@
-From: Pavel Hrdina <phrdina@redhat.com>
-Date: Wed, 20 Feb 2019 13:50:23 +0100
-Subject: [PATCH] util: enable cgroups v2 cpuset controller for threads
-
-When we create cgroup for qemu threads we need to enable cpuset
-controller in order to use it.
-
-Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
-(cherry picked from commit a6aedcf39bd3212a3cd624b765bb724fd36d6a8a)
---
- src/util/vircgroupv2.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/src/util/vircgroupv2.c b/src/util/vircgroupv2.c
-index 25afab1cad..4084929c5a 100644
--- a/src/util/vircgroupv2.c
-+++ b/src/util/vircgroupv2.c
-@@ -400,6 +400,12 @@ virCgroupV2MakeGroup(virCgroupPtr parent ATTRIBUTE_UNUSED,
-                                             VIR_CGROUP_CONTROLLER_CPU) < 0) {
-                 return -1;
-             }
-+
-+            if (virCgroupV2HasController(parent, VIR_CGROUP_CONTROLLER_CPUSET) &&
-+                virCgroupV2EnableController(parent,
-+                                            VIR_CGROUP_CONTROLLER_CPUSET) < 0) {
-+                return -1;
-+            }
-         } else {
-             size_t i;
-             for (i = 0; i < VIR_CGROUP_CONTROLLER_LAST; i++) {
@@ -18,32 +18,31 @@ Signed-off-by: Ján Tomko <jtomko@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit aed6a032cead4386472afb24b16196579e239580)
 ---
- src/libvirt-domain.c         | 11 ++---------
+ src/libvirt-domain.c         | 10 ++--------
 src/qemu/qemu_driver.c       |  2 +-
 src/remote/remote_protocol.x |  3 +--
- 3 files changed, 4 insertions(+), 12 deletions(-)
+ 3 files changed, 4 insertions(+), 11 deletions(-)

 diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c
-index 072b92b717..ba0aaccdc1 100644
+index ef460277f7..cda579180b 100644
 --- a/src/libvirt-domain.c
 +++ b/src/libvirt-domain.c
@@ -1073,8 +1073,7 @@ virDomainRestoreFlags(virConnectPtr conn, const char *from, const char *dxml,
  * previously by virDomainSave() or virDomainSaveFlags().
  *
  * No security-sensitive data will be included unless @flags contains
- * VIR_DOMAIN_SAVE_IMAGE_XML_SECURE; this flag is rejected on read-only
- * connections.
-+ * VIR_DOMAIN_SAVE_IMAGE_XML_SECURE.
+- * VIR_DOMAIN_XML_SECURE; this flag is rejected on read-only
+- * connections.  For this API, @flags should not contain either
+ * VIR_DOMAIN_XML_SECURE
+  * VIR_DOMAIN_XML_INACTIVE or VIR_DOMAIN_XML_UPDATE_CPU.
  *
  * Returns a 0 terminated UTF-8 encoded XML instance, or NULL in case of
-  * error.  The caller must free() the returned value.
-@@ -1090,13 +1089,7 @@ virDomainSaveImageGetXMLDesc(virConnectPtr conn, const char *file,
+@@ -1091,12 +1090,7 @@ virDomainSaveImageGetXMLDesc(virConnectPtr conn, const char *file,
 
     virCheckConnectReturn(conn, NULL);
     virCheckNonNullArgGoto(file, error);
 -
-    if ((conn->flags & VIR_CONNECT_RO) &&
-        (flags & VIR_DOMAIN_SAVE_IMAGE_XML_SECURE)) {
+-    if ((conn->flags & VIR_CONNECT_RO) && (flags & VIR_DOMAIN_XML_SECURE)) {
 -        virReportError(VIR_ERR_OPERATION_DENIED, "%s",
 -                       _("virDomainSaveImageGetXMLDesc with secure flag"));
 -        goto error;
@@ -53,10 +52,10 @@ index 072b92b717..ba0aaccdc1 100644
     if (conn->driver->domainSaveImageGetXMLDesc) {
         char *ret;
 diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
-index 75d31efd14..b4a52f87a9 100644
+index 75f8699e7d..933f71c7b8 100644
 --- a/src/qemu/qemu_driver.c
 +++ b/src/qemu/qemu_driver.c
-@@ -7083,7 +7083,7 @@ qemuDomainSaveImageGetXMLDesc(virConnectPtr conn, const char *path,
+@@ -6791,7 +6791,7 @@ qemuDomainSaveImageGetXMLDesc(virConnectPtr conn, const char *path,
     if (fd < 0)
         goto cleanup;
 
@@ -66,15 +65,15 @@ index 75d31efd14..b4a52f87a9 100644
 
     ret = qemuDomainDefFormatXML(driver, def, flags);
 diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x
-index 60cc40e04a..a67aba6131 100644
+index 28c8febabd..52b92334fa 100644
 --- a/src/remote/remote_protocol.x
 +++ b/src/remote/remote_protocol.x
-@@ -5234,8 +5234,7 @@ enum remote_procedure {
+@@ -5226,8 +5226,7 @@ enum remote_procedure {
     /**
      * @generate: both
      * @priority: high
 -     * @acl: domain:read
-     * @acl: domain:read_secure:VIR_DOMAIN_SAVE_IMAGE_XML_SECURE
+-     * @acl: domain:read_secure:VIR_DOMAIN_XML_SECURE
 +     * @acl: domain:write
      */
     REMOTE_PROC_DOMAIN_SAVE_IMAGE_GET_XML_DESC = 235,
@@ -20,10 +20,10 @@ Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 1 file changed, 1 insertion(+)

 diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c
-index ba0aaccdc1..ac7c4708b9 100644
+index cda579180b..4c0355180e 100644
 --- a/src/libvirt-domain.c
 +++ b/src/libvirt-domain.c
-@@ -9565,6 +9565,7 @@ virDomainManagedSaveDefineXML(virDomainPtr domain, const char *dxml,
+@@ -9483,6 +9483,7 @@ virDomainManagedSaveDefineXML(virDomainPtr domain, const char *dxml,
 
     virCheckDomainReturn(domain, -1);
     conn = domain->conn;
@@ -18,10 +18,10 @@ Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 1 file changed, 1 insertion(+)

 diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c
-index ac7c4708b9..f7b834dfa6 100644
+index 4c0355180e..8ecb964381 100644
 --- a/src/libvirt-domain.c
 +++ b/src/libvirt-domain.c
-@@ -11360,6 +11360,7 @@ virConnectGetDomainCapabilities(virConnectPtr conn,
+@@ -11275,6 +11275,7 @@ virConnectGetDomainCapabilities(virConnectPtr conn,
     virResetLastError();
 
     virCheckConnectReturn(conn, NULL);
@@ -18,10 +18,10 @@ Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 1 file changed, 2 insertions(+)

 diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c
-index f7b834dfa6..c9bff31af5 100644
+index 8ecb964381..cc2f61275d 100644
 --- a/src/libvirt-domain.c
 +++ b/src/libvirt-domain.c
-@@ -11025,6 +11025,8 @@ virDomainGetHostname(virDomainPtr domain, unsigned int flags)
+@@ -10940,6 +10940,8 @@ virDomainGetHostname(virDomainPtr domain, unsigned int flags)
     virCheckDomainReturn(domain, NULL);
     conn = domain->conn;
 
@@ -19,10 +19,10 @@ Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 1 file changed, 2 insertions(+), 2 deletions(-)

 diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x
-index a67aba6131..ff9e34a852 100644
+index 52b92334fa..58ab4ab039 100644
 --- a/src/remote/remote_protocol.x
 +++ b/src/remote/remote_protocol.x
-@@ -5504,7 +5504,7 @@ enum remote_procedure {
+@@ -5496,7 +5496,7 @@ enum remote_procedure {
 
     /**
      * @generate: both
@@ -31,7 +31,7 @@ index a67aba6131..ff9e34a852 100644
      */
     REMOTE_PROC_DOMAIN_GET_HOSTNAME = 277,
 
-@@ -5899,7 +5899,7 @@ enum remote_procedure {
+@@ -5891,7 +5891,7 @@ enum remote_procedure {
 
     /**
      * @generate: none
@@ -0,0 +1,75 @@
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Mon, 24 Sep 2018 16:49:01 +0200
+Subject: [PATCH] Revert "qemu: hotplug: Prepare disk source in
+ qemuDomainAttachDeviceDiskLive"
+
+Preparing the storage source prior to assigning the alias will not work
+as the names of the certain objects depend on the alias for the legacy
+hotplug case as we generate the object names for the secrets based on
+the alias.
+
+This reverts commit 192fdaa614e3800255048a8a70c1292ccf18397a.
+
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+(cherry picked from commit 9ac196997839a29486029a02d8f519df54ae0186)
+---
+ src/qemu/qemu_hotplug.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
+index 4f290b5648..421cc2c174 100644
+--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
+@@ -781,6 +781,7 @@ qemuDomainAttachDiskGeneric(virQEMUDriverPtr driver,
+     qemuDomainObjPrivatePtr priv = vm->privateData;
+     qemuHotplugDiskSourceDataPtr diskdata = NULL;
+     char *devstr = NULL;
+    virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(driver);
+ 
+     if (qemuHotplugPrepareDiskAccess(driver, vm, disk, NULL, false) < 0)
+         goto cleanup;
+@@ -788,6 +789,9 @@ qemuDomainAttachDiskGeneric(virQEMUDriverPtr driver,
+     if (qemuAssignDeviceDiskAlias(vm->def, disk, priv->qemuCaps) < 0)
+         goto error;
+ 
+    if (qemuDomainPrepareDiskSource(disk, priv, cfg) < 0)
+        goto error;
+
+     if (!(diskdata = qemuHotplugDiskSourceAttachPrepare(disk, priv->qemuCaps)))
+         goto error;
+ 
+@@ -822,6 +826,7 @@ qemuDomainAttachDiskGeneric(virQEMUDriverPtr driver,
+     qemuHotplugDiskSourceDataFree(diskdata);
+     qemuDomainSecretDiskDestroy(disk);
+     VIR_FREE(devstr);
+    virObjectUnref(cfg);
+     return ret;
+ 
+  exit_monitor:
+@@ -1062,8 +1067,6 @@ qemuDomainAttachDeviceDiskLive(virQEMUDriverPtr driver,
+                                bool forceMediaChange)
+ {
+     size_t i;
+-    virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(driver);
+-    qemuDomainObjPrivatePtr priv = vm->privateData;
+     virDomainDiskDefPtr disk = dev->data.disk;
+     virDomainDiskDefPtr orig_disk = NULL;
+     int ret = -1;
+@@ -1080,9 +1083,6 @@ qemuDomainAttachDeviceDiskLive(virQEMUDriverPtr driver,
+     if (qemuDomainDetermineDiskChain(driver, vm, disk, true) < 0)
+         goto cleanup;
+ 
+-    if (qemuDomainPrepareDiskSource(disk, priv, cfg) < 0)
+-        goto cleanup;
+-
+     switch ((virDomainDiskDevice) disk->device)  {
+     case VIR_DOMAIN_DISK_DEVICE_CDROM:
+     case VIR_DOMAIN_DISK_DEVICE_FLOPPY:
+@@ -1153,7 +1153,6 @@ qemuDomainAttachDeviceDiskLive(virQEMUDriverPtr driver,
+  cleanup:
+     if (ret != 0)
+         ignore_value(qemuRemoveSharedDevice(driver, dev, vm->def->name));
+-    virObjectUnref(cfg);
+     return ret;
+ }
+ 
@@ -0,0 +1,29 @@
+From: Radoslaw Biernacki <radoslaw.biernacki@linaro.org>
+Date: Tue, 22 Jan 2019 12:26:15 -0700
+Subject: [PATCH] util: Fixing invalid error checking from virPCIGetNetname()
+
+The @linkdev is In/Out function parameter as second order
+reference pointer so requires first order dereference for
+checking NULL which can be the result of virPCIGetNetName().
+
+Fixes: d6ee56d7237 (util: change virPCIGetNetName() to not return error if device has no net name)
+Signed-off-by: Radoslaw Biernacki <radoslaw.biernacki@linaro.org>
+Signed-off-by: dann frazier <dann.frazier@canonical.com>
+(cherry picked from commit 04983c3c6a821f67994b1c65d4d6175f3ac49d69)
+---
+ src/util/virhostdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/util/virhostdev.c b/src/util/virhostdev.c
+index ca79c37787..d9a3711386 100644
+--- a/src/util/virhostdev.c
+++ b/src/util/virhostdev.c
+@@ -319,7 +319,7 @@ virHostdevNetDevice(virDomainHostdevDefPtr hostdev,
+         if (virPCIGetNetName(sysfs_path, 0, NULL, linkdev) < 0)
+             return -1;
+ 
+-        if (!linkdev) {
+        if (!(*linkdev)) {
+             virReportError(VIR_ERR_INTERNAL_ERROR,
+                            _("The device at %s has no network device name"),
+                              sysfs_path);
@@ -0,0 +1,203 @@
+From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
+Date: Tue, 1 May 2018 11:34:51 +0100
+Subject: [PATCH] tests: merge code for UNIX and TCP socket testing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The test code for UNIX and TCP sockets will need to be rewritten and
+extended later, and will benefit from code sharing.
+
+Reviewed-by: Andrea Bolognani <abologna@redhat.com>
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+(cherry picked from commit 9e2fad87b429060842a536de26d6af61ea3d96ea)
+---
+ tests/virnetsockettest.c | 120 +++++++++++++++++----------------------
+ 1 file changed, 51 insertions(+), 69 deletions(-)
+
+diff --git a/tests/virnetsockettest.c b/tests/virnetsockettest.c
+index 9f9a243484..e463d432ff 100644
+--- a/tests/virnetsockettest.c
+++ b/tests/virnetsockettest.c
+@@ -116,38 +116,67 @@ checkProtocols(bool *hasIPv4, bool *hasIPv6,
+ }
+ 
+ 
+-struct testTCPData {
+struct testSocketData {
+     const char *lnode;
+     int port;
+     const char *cnode;
+ };
+ 
+-static int testSocketTCPAccept(const void *opaque)
+static int testSocketAccept(const void *opaque)
+ {
+     virNetSocketPtr *lsock = NULL; /* Listen socket */
+     size_t nlsock = 0, i;
+     virNetSocketPtr ssock = NULL; /* Server socket */
+     virNetSocketPtr csock = NULL; /* Client socket */
+-    const struct testTCPData *data = opaque;
+    const struct testSocketData *data = opaque;
+     int ret = -1;
+     char portstr[100];
+    char *tmpdir = NULL;
+    char *path = NULL;
+    char template[] = "/tmp/libvirt_XXXXXX";
+ 
+-    snprintf(portstr, sizeof(portstr), "%d", data->port);
+    if (!data) {
+        virNetSocketPtr usock;
+        tmpdir = mkdtemp(template);
+        if (tmpdir == NULL) {
+            VIR_WARN("Failed to create temporary directory");
+            goto cleanup;
+        }
+        if (virAsprintf(&path, "%s/test.sock", tmpdir) < 0)
+            goto cleanup;
+ 
+-    if (virNetSocketNewListenTCP(data->lnode, portstr,
+-                                 AF_UNSPEC,
+-                                 &lsock, &nlsock) < 0)
+-        goto cleanup;
+        if (virNetSocketNewListenUNIX(path, 0700, -1, getegid(), &usock) < 0)
+            goto cleanup;
+
+        if (VIR_ALLOC_N(lsock, 1) < 0) {
+            virObjectUnref(usock);
+            goto cleanup;
+        }
+
+        lsock[0] = usock;
+        nlsock = 1;
+    } else {
+        snprintf(portstr, sizeof(portstr), "%d", data->port);
+        if (virNetSocketNewListenTCP(data->lnode, portstr,
+                                     AF_UNSPEC,
+                                     &lsock, &nlsock) < 0)
+            goto cleanup;
+    }
+ 
+     for (i = 0; i < nlsock; i++) {
+         if (virNetSocketListen(lsock[i], 0) < 0)
+             goto cleanup;
+     }
+ 
+-    if (virNetSocketNewConnectTCP(data->cnode, portstr,
+-                                  AF_UNSPEC,
+-                                  &csock) < 0)
+-        goto cleanup;
+    if (!data) {
+        if (virNetSocketNewConnectUNIX(path, false, NULL, &csock) < 0)
+            goto cleanup;
+    } else {
+        if (virNetSocketNewConnectTCP(data->cnode, portstr,
+                                      AF_UNSPEC,
+                                      &csock) < 0)
+            goto cleanup;
+    }
+ 
+     virObjectUnref(csock);
+ 
+@@ -171,62 +200,15 @@ static int testSocketTCPAccept(const void *opaque)
+     for (i = 0; i < nlsock; i++)
+         virObjectUnref(lsock[i]);
+     VIR_FREE(lsock);
+-    return ret;
+-}
+-#endif
+-
+-
+-#ifndef WIN32
+-static int testSocketUNIXAccept(const void *data ATTRIBUTE_UNUSED)
+-{
+-    virNetSocketPtr lsock = NULL; /* Listen socket */
+-    virNetSocketPtr ssock = NULL; /* Server socket */
+-    virNetSocketPtr csock = NULL; /* Client socket */
+-    int ret = -1;
+-
+-    char *path = NULL;
+-    char *tmpdir;
+-    char template[] = "/tmp/libvirt_XXXXXX";
+-
+-    tmpdir = mkdtemp(template);
+-    if (tmpdir == NULL) {
+-        VIR_WARN("Failed to create temporary directory");
+-        goto cleanup;
+-    }
+-    if (virAsprintf(&path, "%s/test.sock", tmpdir) < 0)
+-        goto cleanup;
+-
+-    if (virNetSocketNewListenUNIX(path, 0700, -1, getegid(), &lsock) < 0)
+-        goto cleanup;
+-
+-    if (virNetSocketListen(lsock, 0) < 0)
+-        goto cleanup;
+-
+-    if (virNetSocketNewConnectUNIX(path, false, NULL, &csock) < 0)
+-        goto cleanup;
+-
+-    virObjectUnref(csock);
+-
+-    if (virNetSocketAccept(lsock, &ssock) != -1) {
+-        char c = 'a';
+-        if (virNetSocketWrite(ssock, &c, 1) != -1) {
+-            VIR_DEBUG("Unexpected client socket present");
+-            goto cleanup;
+-        }
+-    }
+-
+-    ret = 0;
+-
+- cleanup:
+     VIR_FREE(path);
+-    virObjectUnref(lsock);
+-    virObjectUnref(ssock);
+     if (tmpdir)
+         rmdir(tmpdir);
+     return ret;
+ }
+#endif
+ 
+ 
+#ifndef WIN32
+ static int testSocketUNIXAddrs(const void *data ATTRIBUTE_UNUSED)
+ {
+     virNetSocketPtr lsock = NULL; /* Listen socket */
+@@ -456,28 +438,28 @@ mymain(void)
+     }
+ 
+     if (hasIPv4) {
+-        struct testTCPData tcpData = { "127.0.0.1", freePort, "127.0.0.1" };
+-        if (virTestRun("Socket TCP/IPv4 Accept", testSocketTCPAccept, &tcpData) < 0)
+        struct testSocketData tcpData = { "127.0.0.1", freePort, "127.0.0.1" };
+        if (virTestRun("Socket TCP/IPv4 Accept", testSocketAccept, &tcpData) < 0)
+             ret = -1;
+     }
+     if (hasIPv6) {
+-        struct testTCPData tcpData = { "::1", freePort, "::1" };
+-        if (virTestRun("Socket TCP/IPv6 Accept", testSocketTCPAccept, &tcpData) < 0)
+        struct testSocketData tcpData = { "::1", freePort, "::1" };
+        if (virTestRun("Socket TCP/IPv6 Accept", testSocketAccept, &tcpData) < 0)
+             ret = -1;
+     }
+     if (hasIPv6 && hasIPv4) {
+-        struct testTCPData tcpData = { NULL, freePort, "127.0.0.1" };
+-        if (virTestRun("Socket TCP/IPv4+IPv6 Accept", testSocketTCPAccept, &tcpData) < 0)
+        struct testSocketData tcpData = { NULL, freePort, "127.0.0.1" };
+        if (virTestRun("Socket TCP/IPv4+IPv6 Accept", testSocketAccept, &tcpData) < 0)
+             ret = -1;
+ 
+         tcpData.cnode = "::1";
+-        if (virTestRun("Socket TCP/IPv4+IPv6 Accept", testSocketTCPAccept, &tcpData) < 0)
+        if (virTestRun("Socket TCP/IPv4+IPv6 Accept", testSocketAccept, &tcpData) < 0)
+             ret = -1;
+     }
+ #endif
+ 
+ #ifndef WIN32
+-    if (virTestRun("Socket UNIX Accept", testSocketUNIXAccept, NULL) < 0)
+    if (virTestRun("Socket UNIX Accept", testSocketAccept, NULL) < 0)
+         ret = -1;
+ 
+     if (virTestRun("Socket UNIX Addrs", testSocketUNIXAddrs, NULL) < 0)
@@ -0,0 +1,241 @@
+From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
+Date: Tue, 1 May 2018 11:55:02 +0100
+Subject: [PATCH] tests: rewrite socket to do something sensible and reliable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The current socket test is rather crazy in that it sets up a server
+listening for sockets and then runs a client connect call, relying on
+the fact that the kernel will accept this despite the application
+not having called accept() yet. It then closes the client socket and
+calls accept() on the server. On Linux accept() will always see that
+the client has gone and so skip the rest of the code. On FreeBSD,
+however, the accept sometimes succeeds, causing us to then go into
+code that attempts to read and write to the client which will fail
+aborting the test. The accept() never succeeds on FreeBSD guests
+with a single CPU, but as you add more CPUs, accept() becomes more and
+more likely to succeed, giving a 100% failure rate for the test when
+using 8 CPUs.
+
+This completely rewrites the test so that it is avoids this designed in
+race condition. We simply spawn a background thread to act as the
+client, which will read a byte from the server and write it back again.
+The main thread can now properly listen and accept the client in a
+synchronous manner avoiding any races.
+
+Reviewed-by: Andrea Bolognani <abologna@redhat.com>
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+(cherry picked from commit 39015a6f3a0d4f9ca2041b9227094f0bcc2217e9)
+---
+ tests/virnetsockettest.c | 141 +++++++++++++++++++++++++++++++++------
+ 1 file changed, 120 insertions(+), 21 deletions(-)
+
+diff --git a/tests/virnetsockettest.c b/tests/virnetsockettest.c
+index e463d432ff..cccb90d0be 100644
+--- a/tests/virnetsockettest.c
+++ b/tests/virnetsockettest.c
+@@ -115,6 +115,56 @@ checkProtocols(bool *hasIPv4, bool *hasIPv6,
+     return ret;
+ }
+ 
+struct testClientData {
+    const char *path;
+    const char *cnode;
+    const char *portstr;
+};
+
+static void
+testSocketClient(void *opaque)
+{
+    struct testClientData *data = opaque;
+    char c;
+    virNetSocketPtr csock = NULL;
+
+    if (data->path) {
+        if (virNetSocketNewConnectUNIX(data->path, false,
+                                       NULL, &csock) < 0)
+            return;
+    } else {
+        if (virNetSocketNewConnectTCP(data->cnode, data->portstr,
+                                      AF_UNSPEC,
+                                      &csock) < 0)
+            return;
+    }
+
+    virNetSocketSetBlocking(csock, true);
+
+    if (virNetSocketRead(csock, &c, 1) != 1) {
+        VIR_DEBUG("Cannot read from server");
+        goto done;
+    }
+    if (virNetSocketWrite(csock, &c, 1) != 1) {
+        VIR_DEBUG("Cannot write to server");
+        goto done;
+    }
+
+ done:
+    virObjectUnref(csock);
+}
+
+
+static void
+testSocketIncoming(virNetSocketPtr sock,
+                   int events ATTRIBUTE_UNUSED,
+                   void *opaque)
+{
+    virNetSocketPtr *retsock = opaque;
+    VIR_DEBUG("Incoming sock=%p events=%d\n", sock, events);
+    *retsock = sock;
+}
+
+ 
+ struct testSocketData {
+     const char *lnode;
+@@ -122,18 +172,25 @@ struct testSocketData {
+     const char *cnode;
+ };
+ 
+-static int testSocketAccept(const void *opaque)
+
+static int
+testSocketAccept(const void *opaque)
+ {
+     virNetSocketPtr *lsock = NULL; /* Listen socket */
+     size_t nlsock = 0, i;
+     virNetSocketPtr ssock = NULL; /* Server socket */
+-    virNetSocketPtr csock = NULL; /* Client socket */
+    virNetSocketPtr rsock = NULL; /* Incoming client socket */
+     const struct testSocketData *data = opaque;
+     int ret = -1;
+     char portstr[100];
+     char *tmpdir = NULL;
+     char *path = NULL;
+     char template[] = "/tmp/libvirt_XXXXXX";
+    virThread th;
+    struct testClientData cdata = { 0 };
+    bool goodsock = false;
+    char a = 'a';
+    char b = '\0';
+ 
+     if (!data) {
+         virNetSocketPtr usock;
+@@ -155,50 +212,90 @@ static int testSocketAccept(const void *opaque)
+ 
+         lsock[0] = usock;
+         nlsock = 1;
+
+        cdata.path = path;
+     } else {
+         snprintf(portstr, sizeof(portstr), "%d", data->port);
+         if (virNetSocketNewListenTCP(data->lnode, portstr,
+                                      AF_UNSPEC,
+                                      &lsock, &nlsock) < 0)
+             goto cleanup;
+
+        cdata.cnode = data->cnode;
+        cdata.portstr = portstr;
+     }
+ 
+     for (i = 0; i < nlsock; i++) {
+         if (virNetSocketListen(lsock[i], 0) < 0)
+             goto cleanup;
+-    }
+ 
+-    if (!data) {
+-        if (virNetSocketNewConnectUNIX(path, false, NULL, &csock) < 0)
+-            goto cleanup;
+-    } else {
+-        if (virNetSocketNewConnectTCP(data->cnode, portstr,
+-                                      AF_UNSPEC,
+-                                      &csock) < 0)
+        if (virNetSocketAddIOCallback(lsock[i],
+                                      VIR_EVENT_HANDLE_READABLE,
+                                      testSocketIncoming,
+                                      &rsock,
+                                      NULL) < 0) {
+             goto cleanup;
+        }
+     }
+ 
+-    virObjectUnref(csock);
+    if (virThreadCreate(&th, true,
+                        testSocketClient,
+                        &cdata) < 0)
+        goto cleanup;
+
+    while (rsock == NULL)
+        virEventRunDefaultImpl();
+ 
+     for (i = 0; i < nlsock; i++) {
+-        if (virNetSocketAccept(lsock[i], &ssock) != -1 && ssock) {
+-            char c = 'a';
+-            if (virNetSocketWrite(ssock, &c, 1) != -1 &&
+-                virNetSocketRead(ssock, &c, 1) != -1) {
+-                VIR_DEBUG("Unexpected client socket present");
+-                goto cleanup;
+-            }
+        if (lsock[i] == rsock) {
+            goodsock = true;
+            break;
+         }
+-        virObjectUnref(ssock);
+-        ssock = NULL;
+     }
+ 
+    if (!goodsock) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                       "Unexpected server socket seen");
+        goto join;
+    }
+
+    if (virNetSocketAccept(rsock, &ssock) < 0)
+        goto join;
+
+    if (!ssock) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                       "Client went away unexpectedly");
+        goto join;
+    }
+
+    virNetSocketSetBlocking(ssock, true);
+
+    if (virNetSocketWrite(ssock, &a, 1) < 0 ||
+        virNetSocketRead(ssock, &b, 1) < 0) {
+        goto join;
+    }
+
+    if (a != b) {
+        virReportError(VIR_ERR_INTERNAL_ERROR,
+                       "Bad data received '%x' != '%x'", a, b);
+        goto join;
+    }
+
+    virObjectUnref(ssock);
+    ssock = NULL;
+
+     ret = 0;
+ 
+ join:
+    virThreadJoin(&th);
+
+  cleanup:
+     virObjectUnref(ssock);
+-    for (i = 0; i < nlsock; i++)
+    for (i = 0; i < nlsock; i++) {
+        virNetSocketRemoveIOCallback(lsock[i]);
+        virNetSocketClose(lsock[i]);
+         virObjectUnref(lsock[i]);
+    }
+     VIR_FREE(lsock);
+     VIR_FREE(path);
+     if (tmpdir)
+@@ -431,6 +528,8 @@ mymain(void)
+ 
+     signal(SIGPIPE, SIG_IGN);
+ 
+    virEventRegisterDefaultImpl();
+
+ #ifdef HAVE_IFADDRS_H
+     if (checkProtocols(&hasIPv4, &hasIPv6, &freePort) < 0) {
+         fprintf(stderr, "Cannot identify IPv4/6 availability\n");
@@ -0,0 +1,34 @@
+From: John Ferlan <jferlan@redhat.com>
+Date: Fri, 7 Sep 2018 08:20:15 -0400
+Subject: [PATCH] test: Remove possible infinite loop in virnetsockettest
+
+Commit 39015a6f3 modified the test to be more reliable/realistic,
+but without checking the return status of virEventRunDefaultImpl
+it's possible that the test could run infinitely.
+
+Found by Coverity
+
+Signed-off-by: John Ferlan <jferlan@redhat.com>
+ACKed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit a0ba31c0069e89f178f064e724ddbc8540b64d32)
+---
+ tests/virnetsockettest.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tests/virnetsockettest.c b/tests/virnetsockettest.c
+index cccb90d0be..5927be1f80 100644
+--- a/tests/virnetsockettest.c
+++ b/tests/virnetsockettest.c
+@@ -243,8 +243,10 @@ testSocketAccept(const void *opaque)
+                         &cdata) < 0)
+         goto cleanup;
+ 
+-    while (rsock == NULL)
+-        virEventRunDefaultImpl();
+    while (rsock == NULL) {
+        if (virEventRunDefaultImpl() < 0)
+            break;
+    }
+ 
+     for (i = 0; i < nlsock; i++) {
+         if (lsock[i] == rsock) {
@@ -1,59 +0,0 @@
-From: Michal Privoznik <mprivozn@redhat.com>
-Date: Wed, 10 Apr 2019 17:14:25 +0200
-Subject: [PATCH] qemu: Set up EMULATOR thread and cpuset.mems before
- exec()-ing qemu
-
-It's funny how this went unnoticed for such a long time. Long
-story short, if a domain is configured with
-VIR_DOMAIN_NUMATUNE_MEM_STRICT libvirt doesn't really honour
-that. This is because of 7e72ac787848 after which libvirt allowed
-qemu to allocate memory just anywhere and only after that it used
-some magic involving cpuset.memory_migrate and cpuset.mems to
-move the memory to desired NUMA nodes. This was done in order to
-work around some KVM bug where KVM would fail if there wasn't a
-DMA zone available on the NUMA node. Well, while the work around
-might stopped libvirt tickling the KVM bug it also caused a bug
-on libvirt side: if there is not enough memory on configured NUMA
-node(s) then any attempt to start a domain must fail. Because of
-the way we play with guest memory domains can start just happily.
-
-The solution is to move the child we've just forked into emulator
-cgroup, set up cpuset.mems and exec() qemu only after that.
-
-This basically reverts 7e72ac787848b7434c9 which was a workaround
-for kernel bug. This bug was apparently fixed because I've tested
-this successfully with recent kernel.
-
-Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
-Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
-(cherry picked from commit 0eaa4716e1b8f6eb59d77049aed3735c3b5fbdd6)
---
- src/qemu/qemu_process.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
-index 68c670d3f2..3bcc2ebd71 100644
--- a/src/qemu/qemu_process.c
-+++ b/src/qemu/qemu_process.c
-@@ -6636,6 +6636,10 @@ qemuProcessLaunch(virConnectPtr conn,
-     if (qemuProcessInitCpuAffinity(vm) < 0)
-         goto cleanup;
- 
-+    VIR_DEBUG("Setting emulator tuning/settings");
-+    if (qemuProcessSetupEmulator(vm) < 0)
-+        goto cleanup;
-+
-     VIR_DEBUG("Setting cgroup for external devices (if required)");
-     if (qemuSetupCgroupForExtDevices(vm, driver) < 0)
-         goto cleanup;
-@@ -6727,10 +6731,6 @@ qemuProcessLaunch(virConnectPtr conn,
-     if (qemuProcessDetectIOThreadPIDs(driver, vm, asyncJob) < 0)
-         goto cleanup;
- 
-    VIR_DEBUG("Setting emulator tuning/settings");
-    if (qemuProcessSetupEmulator(vm) < 0)
-        goto cleanup;
-
-     VIR_DEBUG("Setting global CPU cgroup (if required)");
-     if (qemuSetupGlobalCpuCgroup(vm) < 0)
-         goto cleanup;
@@ -1,35 +0,0 @@
-From: Peter Krempa <pkrempa@redhat.com>
-Date: Fri, 17 May 2019 10:15:53 +0200
-Subject: [PATCH] qemu: blockjob: Fix saving of inactive XML after completed
- legacy blockjob
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Commit c257352797 introduced a logic bug where we will never save the
-inactive XML after a blockjob as the variable which was determining
-whether to do so is cleared right before. Thus even if we correctly
-modify the inactive state it will be rolled back when libvirtd is
-restarted.
-
-Reported-by: Thomas Stein <hello@himbee.re>
-Signed-off-by: Peter Krempa <pkrempa@redhat.com>
-Reviewed-by: Ján Tomko <jtomko@redhat.com>
-(cherry picked from commit 4d8cc5a07a0dcc0ac99377f66a4649d219705452)
---
- src/qemu/qemu_blockjob.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/qemu/qemu_blockjob.c b/src/qemu/qemu_blockjob.c
-index fa7e4c8625..f105632a09 100644
--- a/src/qemu/qemu_blockjob.c
-+++ b/src/qemu/qemu_blockjob.c
-@@ -363,7 +363,7 @@ qemuBlockJobEventProcessLegacy(virQEMUDriverPtr driver,
-     if (virDomainSaveStatus(driver->xmlopt, cfg->stateDir, vm, driver->caps) < 0)
-         VIR_WARN("Unable to save status on vm %s after block job", vm->def->name);
- 
-    if (job->newstate == VIR_DOMAIN_BLOCK_JOB_COMPLETED && vm->newDef) {
-+    if (job->state == VIR_DOMAIN_BLOCK_JOB_COMPLETED && vm->newDef) {
-         if (virDomainSaveConfig(cfg->configDir, driver->caps, vm->newDef) < 0)
-             VIR_WARN("Unable to update persistent definition on vm %s "
-                      "after block job", vm->def->name);
@@ -4,7 +4,7 @@
 # that's still supported by the vendor. It may work on other distros
 # or versions, but no effort will be made to ensure that going forward.
 %define min_rhel 7
-%define min_fedora 28
+%define min_fedora 26

 %if (0%{?fedora} && 0%{?fedora} >= %{min_fedora}) || (0%{?rhel} && 0%{?rhel} >= %{min_rhel})
    %define supported_platform 1
@@ -15,11 +15,12 @@
 # Default to skipping autoreconf.  Distros can change just this one line
 # (or provide a command-line override) if they backport any patches that
 # touch configure.ac or Makefile.am.
-%{!?enable_autotools:%global enable_autotools 1}
+%{!?enable_autotools:%global enable_autotools 0}

 # The hypervisor drivers that run in libvirtd
 %define with_qemu          0%{!?_without_qemu:1}
 %define with_lxc           0%{!?_without_lxc:1}
+%define with_uml           0%{!?_without_uml:1}
 %define with_libxl         0%{!?_without_libxl:1}
 %define with_vbox          0%{!?_without_vbox:1}

@@ -71,7 +72,7 @@
 %endif

 # We need a recent enough libiscsi (>= 1.18.0)
-%if 0%{?fedora} || 0%{?rhel} > 7
+%if 0%{?fedora} >= 28 || 0%{?rhel} > 7
    %define with_storage_iscsi_direct 0%{!?_without_storage_iscsi_direct:1}
 %else
    %define with_storage_iscsi_direct 0
@@ -82,7 +83,6 @@
 %define with_sanlock       0%{!?_without_sanlock:0}
 %define with_numad         0%{!?_without_numad:0}
 %define with_firewalld     0%{!?_without_firewalld:0}
-%define with_firewalld_zone 0%{!?_without_firewalld_zone:0}
 %define with_libssh2       0%{!?_without_libssh2:0}
 %define with_wireshark     0%{!?_without_wireshark:0}
 %define with_libssh        0%{!?_without_libssh:0}
@@ -100,29 +100,38 @@
    %define with_vbox 0
 %endif

-# Numactl is not available on many non-x86 archs
+# Numactl is not available on s390[x] and ARM
 %ifarch s390 s390x %{arm} riscv64
    %define with_numactl 0
 %endif

+# libgfapi is built only on x86_64 on rhel
+%ifnarch x86_64
+    %if 0%{?rhel}
+        %define with_storage_gluster 0
+    %endif
+%endif
+
+# librados and librbd are built only on x86_64 on rhel
+%ifnarch x86_64
+    %if 0%{?rhel}
+        %define with_storage_rbd 0
+    %endif
+%endif
+
 # zfs-fuse is not available on some architectures
 %ifarch s390 s390x aarch64 riscv64
    %define with_storage_zfs 0
 %endif

-# Ceph dropping support for 32-bit hosts
-%if 0%{?fedora} >= 30
-    %ifarch %{arm} %{ix86}
-        %define with_storage_rbd 0
-    %endif
-%endif

-# RHEL doesn't ship OpenVZ, VBox, PowerHypervisor,
+# RHEL doesn't ship OpenVZ, VBox, UML, PowerHypervisor,
 # VMware, libxenserver (xenapi), libxenlight (Xen 4.1 and newer),
 # or HyperV.
 %if 0%{?rhel}
    %define with_openvz 0
    %define with_vbox 0
+    %define with_uml 0
    %define with_phyp 0
    %define with_vmware 0
    %define with_xenapi 0
@@ -137,11 +146,6 @@

 %define with_firewalld 1

-%if 0%{?fedora} >= 31 || 0%{?rhel} > 7
-    %define with_firewalld_zone 0%{!?_without_firewalld_zone:1}
-%endif
-
-
 # fuse is used to provide virtualized /proc for LXC
 %if %{with_lxc}
    %define with_fuse      0%{!?_without_fuse:1}
@@ -166,7 +170,11 @@
 # Enable wireshark plugins for all distros shipping libvirt 1.2.2 or newer
 %if 0%{?fedora}
    %define with_wireshark 0%{!?_without_wireshark:1}
-    %define wireshark_plugindir %(pkg-config --variable plugindir wireshark)/epan
+%endif
+%if 0%{?fedora} || 0%{?rhel} > 7
+    %define wireshark_plugindir %(pkg-config --variable plugindir wireshark)
+%else
+    %define wireshark_plugindir %{_libdir}/wireshark/plugins
 %endif

 # Enable libssh transport for new enough distros
@@ -184,9 +192,9 @@
 %endif


-%if %{with_qemu} || %{with_lxc}
+%if %{with_qemu} || %{with_lxc} || %{with_uml}
 # numad is used to manage the CPU and memory placement dynamically,
-# it's not available on many non-x86 architectures.
+# it's not available on s390[x] and ARM.
    %ifnarch s390 s390x %{arm} riscv64
        %define with_numad    0%{!?_without_numad:1}
    %endif
@@ -206,17 +214,17 @@
    %define enable_werror --disable-werror
 %endif

-%if 0%{?rhel} == 7
-    %define tls_priority "NORMAL"
-%else
+%if 0%{?fedora}
    %define tls_priority "@LIBVIRT,SYSTEM"
+%else
+    %define tls_priority "NORMAL"
 %endif


 Summary: Library providing a simple virtualization API
 Name: libvirt
-Version: 5.1.0
-Release: 9%{?dist}
+Version: 4.7.0
+Release: 5%{?dist}%{?extra_release}
 License: LGPLv2+
 URL: https://libvirt.org/

@@ -225,53 +233,47 @@ URL: https://libvirt.org/
 %endif
 Source: https://libvirt.org/sources/%{?mainturl}libvirt-%{version}.tar.xz

-# Fix use of deprecated RBD features
-Patch0001: 0001-storage-split-off-code-for-calling-rbd_list.patch
-Patch0002: 0002-storage-add-support-for-new-rbd_list2-method.patch
-# Don't require ipv6 firewall support at startup (bz #1688968)
-Patch0003: 0003-network-improve-error-report-when-firewall-chain-cre.patch
-Patch0004: 0004-network-split-setup-of-ipv4-and-ipv6-top-level-chain.patch
-# Avoid using firewalld if unprivileged
-Patch0005: 0005-network-avoid-trying-to-create-global-firewall-rules.patch
 # Mouse cursor doubled on QEMU VNC on ppc64le (bz #1565253)
-Patch0006: 0006-qemu-Allow-creating-ppc64-guests-with-graphics-and-n.patch
-# Fix VM startup with cgroupv2 (bz #1688736)
-Patch0007: 0007-util-implement-virCgroupV2-Set-Get-CpusetMems.patch
-Patch0008: 0008-util-implement-virCgroupV2-Set-Get-CpusetMemoryMigra.patch
-Patch0009: 0009-util-implement-virCgroupV2-Set-Get-CpusetCpus.patch
-Patch0010: 0010-util-enable-cgroups-v2-cpuset-controller-for-threads.patch
+Patch0001: 0001-qemu-Allow-creating-ppc64-guests-with-graphics-and-n.patch
+# CVE-2019-3840: NULL deref after running qemuAgentGetInterfaces (bz
+# #1665229)
+Patch0002: 0002-qemu-Remove-duplicated-qemuAgentCheckError.patch
+Patch0003: 0003-qemu-require-reply-from-guest-agent-in-qemuAgentGetI.patch
 # Define md-clear CPUID bit (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130,
 # CVE-2019-11091)
-Patch0011: 0011-cpu_x86-Do-not-cache-microcode-version.patch
-Patch0012: 0012-qemu-Don-t-cache-microcode-version.patch
-Patch0013: 0013-cputest-Add-data-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch
-Patch0014: 0014-cpu_map-Define-md-clear-CPUID-bit.patch
+Patch0004: 0004-cpu_x86-Do-not-cache-microcode-version.patch
+Patch0005: 0005-qemu-Don-t-cache-microcode-version.patch
+Patch0006: 0006-cputest-Add-data-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch
+Patch0007: 0007-cpu_map-Define-md-clear-CPUID-bit.patch
 # Fix systemd socket permissions (CVE-2019-10132)
-Patch0015: 0015-admin-reject-clients-unless-their-UID-matches-the-cu.patch
-Patch0016: 0016-locking-restrict-sockets-to-mode-0600.patch
-Patch0017: 0017-logging-restrict-sockets-to-mode-0600.patch
+Patch0008: 0008-admin-reject-clients-unless-their-UID-matches-the-cu.patch
+Patch0009: 0009-locking-restrict-sockets-to-mode-0600.patch
+Patch0010: 0010-logging-restrict-sockets-to-mode-0600.patch
 # CVE-2019-10161: arbitrary file read/exec via virDomainSaveImageGetXMLDesc
 # API (bz #1722463, bz #1720115)
-Patch0018: 0018-api-disallow-virDomainSaveImageGetXMLDesc-on-read-on.patch
+Patch0011: 0011-api-disallow-virDomainSaveImageGetXMLDesc-on-read-on.patch
 # CVE-2019-10166: virDomainManagedSaveDefineXML API exposed to readonly
 # clients (bz #1722462, bz #1720114)
-Patch0019: 0019-api-disallow-virDomainManagedSaveDefineXML-on-read-o.patch
+Patch0012: 0012-api-disallow-virDomainManagedSaveDefineXML-on-read-o.patch
 # CVE-2019-10167: arbitrary command execution via
 # virConnectGetDomainCapabilities API (bz #1722464, bz #1720117)
-Patch0020: 0020-api-disallow-virConnectGetDomainCapabilities-on-read.patch
+Patch0013: 0013-api-disallow-virConnectGetDomainCapabilities-on-read.patch
 # CVE-2019-10168: arbitrary command execution via
 # virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU APIs (bz
 # #1722466, bz #1720118)
-Patch0021: 0021-api-disallow-virConnect-HypervisorCPU-on-read-only-c.patch
+Patch0014: 0014-api-disallow-virConnect-HypervisorCPU-on-read-only-c.patch
 # CVE-2019-3886: virsh domhostname command discloses guest hostname in
 # readonly mode [fedora-rawhide
-Patch0022: 0022-api-disallow-virDomainGetHostname-for-read-only-conn.patch
-Patch0023: 0023-remote-enforce-ACL-write-permission-for-getting-gues.patch
-# Cannot start VM with a CBR 2.0 TPM device (bz #1712556)
-Patch0024: 0024-qemu-Set-up-EMULATOR-thread-and-cpuset.mems-before-e.patch
-# libvirtd does not update VM .xml configurations after virsh
-# snapshot/blockcommit (bz #1722348)
-Patch0025: 0025-qemu-blockjob-Fix-saving-of-inactive-XML-after-compl.patch
+Patch0015: 0015-api-disallow-virDomainGetHostname-for-read-only-conn.patch
+Patch0016: 0016-remote-enforce-ACL-write-permission-for-getting-gues.patch
+# Failed to attache NEW rbd device to guest (bz #1672620)
+Patch0017: 0017-Revert-qemu-hotplug-Prepare-disk-source-in-qemuDomai.patch
+# PCI hostdev interface segfault (bz #1692053)
+Patch0018: 0018-util-Fixing-invalid-error-checking-from-virPCIGetNet.patch
+# Fix the test suite
+Patch0019: 0019-tests-merge-code-for-UNIX-and-TCP-socket-testing.patch
+Patch0020: 0020-tests-rewrite-socket-to-do-something-sensible-and-re.patch
+Patch0021: 0021-test-Remove-possible-infinite-loop-in-virnetsockette.patch


 Requires: libvirt-daemon = %{version}-%{release}
@@ -286,9 +288,9 @@ Requires: libvirt-daemon-driver-lxc = %{version}-%{release}
 %if %{with_qemu}
 Requires: libvirt-daemon-driver-qemu = %{version}-%{release}
 %endif
-# We had UML driver, but we've removed it.
-Obsoletes: libvirt-daemon-driver-uml <= 5.0.0
-Obsoletes: libvirt-daemon-uml <= 5.0.0
+%if %{with_uml}
+Requires: libvirt-daemon-driver-uml = %{version}-%{release}
+%endif
 %if %{with_vbox}
 Requires: libvirt-daemon-driver-vbox = %{version}-%{release}
 %endif
@@ -313,7 +315,7 @@ BuildRequires: /usr/bin/pod2man
 %endif
 BuildRequires: gcc
 BuildRequires: git
-%if 0%{?fedora} || 0%{?rhel} > 7
+%if 0%{?fedora} >= 27 || 0%{?rhel} > 7
 BuildRequires: perl-interpreter
 %else
 BuildRequires: perl
@@ -375,8 +377,6 @@ BuildRequires: libiscsi-devel
 BuildRequires: parted-devel
 # For Multipath support
 BuildRequires: device-mapper-devel
-# For XFS reflink clone support
-BuildRequires: xfsprogs-devel
 %if %{with_storage_rbd}
 BuildRequires: librados2-devel
 BuildRequires: librbd1-devel
@@ -436,22 +436,18 @@ BuildRequires: numad
 %endif

 %if %{with_wireshark}
-BuildRequires: wireshark-devel >= 2.4.0
+BuildRequires: wireshark-devel >= 2.1.0
 %endif

 %if %{with_libssh}
 BuildRequires: libssh-devel >= 0.7.0
 %endif

-%if 0%{?fedora} || 0%{?rhel} > 7
+%if 0%{?fedora} > 27 || 0%{?rhel} > 7
 BuildRequires: rpcgen
 BuildRequires: libtirpc-devel
 %endif

-%if %{with_firewalld_zone}
-BuildRequires: firewalld-filesystem
-%endif
-
 Provides: bundled(gnulib)

 %description
@@ -599,9 +595,6 @@ Requires: util-linux
 # From QEMU RPMs
 Requires: /usr/bin/qemu-img
 %endif
-%if !%{with_storage_rbd}
-Obsoletes: libvirt-daemon-driver-storage-rbd < %{version}-%{release}
-%endif

 %description daemon-driver-storage-core
 The storage driver plugin for the libvirtd daemon, providing
@@ -807,6 +800,19 @@ the Linux kernel
 %endif


+%if %{with_uml}
+%package daemon-driver-uml
+Summary: Uml driver plugin for the libvirtd daemon
+Requires: libvirt-daemon = %{version}-%{release}
+Requires: libvirt-libs = %{version}-%{release}
+
+%description daemon-driver-uml
+The UML driver plugin for the libvirtd daemon, providing
+an implementation of the hypervisor driver APIs using
+User Mode Linux
+%endif
+
+
 %if %{with_vbox}
 %package daemon-driver-vbox
 Summary: VirtualBox driver plugin for the libvirtd daemon
@@ -894,6 +900,26 @@ capabilities of LXC
 %endif


+%if %{with_uml}
+%package daemon-uml
+Summary: Server side daemon & driver required to run UML guests
+
+Requires: libvirt-daemon = %{version}-%{release}
+Requires: libvirt-daemon-driver-uml = %{version}-%{release}
+Requires: libvirt-daemon-driver-interface = %{version}-%{release}
+Requires: libvirt-daemon-driver-network = %{version}-%{release}
+Requires: libvirt-daemon-driver-nodedev = %{version}-%{release}
+Requires: libvirt-daemon-driver-nwfilter = %{version}-%{release}
+Requires: libvirt-daemon-driver-secret = %{version}-%{release}
+Requires: libvirt-daemon-driver-storage = %{version}-%{release}
+# There are no UML kernel RPMs in Fedora/RHEL to depend on.
+
+%description daemon-uml
+Server side daemon and driver required to manage the virtualization
+capabilities of UML
+%endif
+
+
 %if %{with_libxl}
 %package daemon-xen
 Summary: Server side daemon & driver required to run XEN guests
@@ -985,7 +1011,7 @@ Bash completion script stub.
 %if %{with_wireshark}
 %package wireshark
 Summary: Wireshark dissector plugin for libvirt RPC transactions
-Requires: wireshark >= 2.4.0
+Requires: wireshark >= 1.12.6-4
 Requires: %{name}-libs = %{version}-%{release}

 %description wireshark
@@ -1099,6 +1125,12 @@ exit 1
    %define arg_vmware --without-vmware
 %endif

+%if %{with_uml}
+    %define arg_uml --with-uml
+%else
+    %define arg_uml --without-uml
+%endif
+
 %if %{with_storage_rbd}
    %define arg_storage_rbd --with-storage-rbd
 %else
@@ -1153,12 +1185,6 @@ exit 1
    %define arg_firewalld --without-firewalld
 %endif

-%if %{with_firewalld_zone}
-    %define arg_firewalld_zone --with-firewalld-zone
-%else
-    %define arg_firewalld_zone --without-firewalld-zone
-%endif
-
 %if %{with_wireshark}
    %define arg_wireshark --with-wireshark-dissector
 %else
@@ -1218,6 +1244,7 @@ rm -f po/stamp-po
           --with-avahi \
           --with-polkit \
           --with-libvirtd \
+           %{?arg_uml} \
           %{?arg_phyp} \
           %{?arg_esx} \
           %{?arg_hyperv} \
@@ -1257,7 +1284,6 @@ rm -f po/stamp-po
           --with-dtrace \
           --with-driver-modules \
           %{?arg_firewalld} \
-           %{?arg_firewalld_zone} \
           %{?arg_wireshark} \
           --without-pm-utils \
           --with-nss-plugin \
@@ -1347,6 +1373,9 @@ rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/libvirtd.libxl
 rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/libvirtd_libxl.aug
 rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_libxl.aug
 %endif
+%if ! %{with_uml}
+rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/libvirtd.uml
+%endif

 # Copied into libvirt-docs subpackage eventually
 mv $RPM_BUILD_ROOT%{_datadir}/doc/libvirt-%{version} libvirt-docs
@@ -1425,16 +1454,6 @@ if [ -f %{_localstatedir}/lib/rpm-state/libvirt/restart ]; then
 fi
 rm -rf %{_localstatedir}/lib/rpm-state/libvirt || :

-%post daemon-driver-network
-%if %{with_firewalld_zone}
-    %firewalld_reload
-%endif
-
-%postun daemon-driver-network
-%if %{with_firewalld_zone}
-    %firewalld_reload
-%endif
-
 %post daemon-config-network
 if test $1 -eq 1 && test ! -f %{_sysconfdir}/libvirt/qemu/networks/default.xml ; then
    # see if the network used by default network creates a conflict,
@@ -1524,12 +1543,17 @@ exit 0
 %endif

 %preun client
+
 %systemd_preun libvirt-guests.service

 %post client
+
+/sbin/ldconfig
 %systemd_post libvirt-guests.service

 %postun client
+
+/sbin/ldconfig
 %systemd_postun libvirt-guests.service

 %triggerun client -- libvirt < 0.9.4
@@ -1668,10 +1692,6 @@ exit 0
 %attr(0755, root, root) %{_libexecdir}/libvirt_leaseshelper
 %{_libdir}/%{name}/connection-driver/libvirt_driver_network.so

-%if %{with_firewalld_zone}
-%{_prefix}/lib/firewalld/zones/libvirt.xml
-%endif
-
 %files daemon-driver-nodedev
 %{_libdir}/%{name}/connection-driver/libvirt_driver_nodedev.so

@@ -1762,6 +1782,15 @@ exit 0
 %{_libdir}/%{name}/connection-driver/libvirt_driver_lxc.so
 %endif

+%if %{with_uml}
+%files daemon-driver-uml
+%dir %attr(0700, root, root) %{_localstatedir}/log/libvirt/uml/
+%config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd.uml
+%ghost %dir %{_localstatedir}/run/libvirt/uml/
+%dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/uml/
+%{_libdir}/%{name}/connection-driver/libvirt_driver_uml.so
+%endif
+
 %if %{with_libxl}
 %files daemon-driver-libxl
 %config(noreplace) %{_sysconfdir}/libvirt/libxl.conf
@@ -1792,6 +1821,10 @@ exit 0
 %files daemon-lxc
 %endif

+%if %{with_uml}
+%files daemon-uml
+%endif
+
 %if %{with_libxl}
 %files daemon-xen
 %endif
@@ -1943,7 +1976,7 @@ exit 0


 %changelog
-* Thu Jun 20 2019 Cole Robinson <crobinso@redhat.com> - 5.1.0-9
+* Thu Jun 20 2019 Cole Robinson <crobinso@redhat.com> - 4.7.0-5
 - CVE-2019-10161: arbitrary file read/exec via virDomainSaveImageGetXMLDesc
  API (bz #1722463, bz #1720115)
 - CVE-2019-10166: virDomainManagedSaveDefineXML API exposed to readonly
@@ -1955,63 +1988,22 @@ exit 0
  #1722466, bz #1720118)
 - CVE-2019-3886: virsh domhostname command discloses guest hostname in
  readonly mode [fedora-rawhide
- Cannot start VM with a CBR 2.0 TPM device (bz #1712556)
- libvirtd does not update VM .xml configurations after virsh
-  snapshot/blockcommit (bz #1722348)
+- Failed to attache NEW rbd device to guest (bz #1672620)
+- PCI hostdev interface segfault (bz #1692053)

-* Fri May 31 2019 Adam Williamson <awilliam@redhat.com> - 5.1.0-8
- Fix scriptlet error when built without firewalld zone support
-
-* Wed May 29 2019 Adam Williamson <awilliam@redhat.com> - 5.1.0-7
- Pass --without-firewalld-zone to configure
- Resolves: rhbz #1699051
-
-* Tue May 21 2019 Daniel P. Berrangé <berrange@redhat.com> - 5.1.0-6
+* Tue May 21 2019 Daniel P. Berrangé <berrange@redhat.com> - 4.7.0-4
 - Fix systemd socket permissions
 - Resolves: rhbz #1712498 (CVE-2019-10132)

-* Tue May 14 2019 Daniel P. Berrangé <berrange@redhat.com> - 5.1.0-5
+* Tue May 14 2019 Daniel P. Berrangé <berrange@redhat.com> - 4.7.0-3
 - Define md-clear CPUID bit
 - Resolves: rhbz #1709977 (CVE-2018-12126), rhbz #1709979 (CVE-2018-12127),
  rhbz #1709997 (CVE-2018-12130), rhbz #1709984 (CVE-2019-11091)

-* Tue Apr 02 2019 Cole Robinson <crobinso@redhat.com> - 5.1.0-4
+* Tue Apr 02 2019 Cole Robinson <crobinso@redhat.com> - 4.7.0-2
 - Mouse cursor doubled on QEMU VNC on ppc64le (bz #1565253)
- Fix VM startup with cgroupv2 (bz #1688736)
-
-* Wed Mar 20 2019 Daniel P. Berrangé <berrange@redhat.com> - 5.1.0-3
- Fix upgrades for rbd on i686 (rhbz #1688121)
- Add missing xfsprogs-devel dep
- Fix use of deprecated RBD features
- Avoid using firewalld if unprivileged
- Don't require ipv6 firewall support at startup (rhbz #1688968)
-
-* Wed Mar 06 2019 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 5.1.0-2
- Remove obsolete scriptlets
-
-* Mon Mar  4 2019 Daniel P. Berrangé <berrange@redhat.com> - 5.1.0-1
- Update to 5.1.0 release
-
-* Sun Feb 17 2019 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 5.0.0-3
- Rebuild for readline 8.0
-
-* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 5.0.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Mon Jan 21 2019 Daniel P. Berrangé <berrange@redhat.com> - 5.0.0-1
- Update to 5.0.0 release
-
-* Mon Dec 10 2018 Daniel P. Berrangé <berrange@redhat.com> - 4.10.0-2
- Disable RBD on 32-bit arches (rhbz #1657928)
-
-* Mon Dec  3 2018 Daniel P. Berrangé <berrange@redhat.com> - 4.10.0-1
- Update to 4.10.0 release
-
-* Mon Nov 12 2018 Daniel P. Berrangé <berrange@redhat.com> - 4.9.0-1
- Update to 4.9.0 release
-
-* Fri Oct  5 2018 Daniel P. Berrangé <berrange@redhat.com> - 4.8.0-1
- Update to 4.8.0 release
+- CVE-2019-3840: NULL deref after running qemuAgentGetInterfaces (bz
+  #1665229)

 * Tue Sep  4 2018 Daniel P. Berrangé <berrange@redhat.com> - 4.7.0-1
 - Update to 4.7.0 release
@@ -2055,3 +2047,51 @@ exit 0

 * Fri Jan 19 2018 Daniel P. Berrange <berrange@redhat.com> - 4.0.0-1
 - Rebase to version 4.0.0
+
+* Wed Dec 20 2017 Cole Robinson <crobinso@redhat.com> - 3.10.0-2
+- Rebuild for xen 4.10
+
+* Tue Dec  5 2017 Daniel P. Berrange <berrange@redhat.com> - 3.10.0-1
+- Rebase to version 3.10.0
+
+* Fri Nov  3 2017 Daniel P. Berrange <berrange@redhat.com> - 3.9.0-1
+- Rebase to version 3.9.0
+
+* Wed Oct  4 2017 Daniel P. Berrange <berrange@redhat.com> - 3.8.0-1
+- Rebase to version 3.8.0
+
+* Mon Sep  4 2017 Daniel P. Berrange <berrange@redhat.com> - 3.7.0-1
+- Rebase to version 3.7.0
+
+* Wed Aug  2 2017 Daniel P. Berrange <berrange@redhat.com> - 3.6.0-1
+- Rebase to version 3.6.0
+
+* Sun Jul 30 2017 Florian Weimer <fweimer@redhat.com> - 3.5.0-4
+- Rebuild with binutils fix for ppc64le (#1475636)
+
+* Tue Jul 25 2017 Daniel P. Berrange <berrange@redhat.com> - 3.5.0-3
+- Disabled RBD on i386, arm, ppc64 (rhbz #1474743)
+
+* Mon Jul 17 2017 Cole Robinson <crobinso@redhat.com> - 3.5.0-2
+- Rebuild for xen 4.9
+
+* Thu Jul  6 2017 Daniel P. Berrange <berrange@redhat.com> - 3.5.0-1
+- Rebase to version 3.5.0
+
+* Fri Jun  2 2017 Daniel P. Berrange <berrange@redhat.com> - 3.4.0-1
+- Rebase to version 3.4.0
+
+* Mon May  8 2017 Daniel P. Berrange <berrange@redhat.com> - 3.3.0-1
+- Rebase to version 3.3.0
+
+* Mon Apr  3 2017 Daniel P. Berrange <berrange@redhat.com> - 3.2.0-1
+- Rebase to version 3.2.0
+
+* Fri Mar  3 2017 Daniel P. Berrange <berrange@redhat.com> - 3.1.0-1
+- Rebase to version 3.1.0
+
+* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Thu Jan 19 2017 Daniel P. Berrange <berrange@redhat.com> - 3.0.0-1
+- Rebase to version 3.0.0
@@ -1 +1 @@
-SHA512 (libvirt-5.1.0.tar.xz) = ca64d7be683614bdeb20a8865655fe80f911cf13c00aed2334db3a2e4131e1dd6fe5e9663a24e6f82161ad5aa53f1a2637cd21730eed46e4764b7eebced94f3f
+SHA512 (libvirt-4.7.0.tar.xz) = a4b320460b923508d9519c65c8be18b5013eb7ed4d581984cc5edf0d3476c34f959d69ad4ca7a0e257dac91351e11718785efc3f201d4b58fa999dbca1daac47
Author	SHA1	Message	Date
Cole Robinson	f92cc4a3a0	Fix the test suite on s390x	2019-06-20 16:45:14 -04:00
Cole Robinson	823c0cc7e3	libvirt-4.7.0-5.fc29 CVE-2019-10161: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API (bz #1722463, bz #1720115) CVE-2019-10166: virDomainManagedSaveDefineXML API exposed to readonly clients (bz #1722462, bz #1720114) CVE-2019-10167: arbitrary command execution via virConnectGetDomainCapabilities API (bz #1722464, bz #1720117) CVE-2019-10168: arbitrary command execution via virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU APIs (bz #1722466, bz #1720118) CVE-2019-3886: virsh domhostname command discloses guest hostname in readonly mode [fedora-rawhide Failed to attache NEW rbd device to guest (bz #1672620) PCI hostdev interface segfault (bz #1692053)	2019-06-20 13:02:52 -04:00
Daniel P. Berrangé	4502524d76	Fix systemd socket permissions (CVE-2019-10132) Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>	2019-05-21 17:06:47 +01:00
Daniel P. Berrangé	96dfc352ed	Define md-clear CPUID bit CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>	2019-05-14 19:45:59 +01:00
Cole Robinson	382105ed17	Mouse cursor doubled on QEMU VNC on ppc64le (bz #1565253 ) CVE-2019-3840: NULL deref after running qemuAgentGetInterfaces (bz #1665229)	2019-04-02 11:57:46 -04:00