Rebased to version 0.9.11.10

Fix launching qemu with ccid database property (bz #904692)
Don't error if disk resize isn't multiple of 512 (bz #951495)
Fix build with latest kernels (bz #959531)

.abignore

@@ -1,31 +0,0 @@
-[suppress_function]
-symbol_version_regexp = LIBVIRT_PRIVATE.*
-soname_regexp = libvirt\\.so.*
-
-[suppress_function]
-symbol_version_regexp = LIBVIRT_ADMIN_PRIVATE.*
-soname_regexp = libvirt-admin\\.so.*
-
-[suppress_variable]
-symbol_version_regexp = LIBVIRT_PRIVATE.*
-soname_regexp = libvirt\\.so.*
-
-[suppress_variable]
-symbol_version_regexp = LIBVIRT_ADMIN_PRIVATE.*
-soname_regexp = libvirt-admin\\.so.*
-
-[suppress_function]
-symbol_version_regexp = .*
-soname_regexp = libvirt_storage_.*\\.so.*
-
-[suppress_variable]
-symbol_version_regexp = .*
-soname_regexp = libvirt_storage_.*\\.so.*
-
-[suppress_function]
-symbol_version_regexp = .*
-soname_regexp = libvirt_driver_.*\\.so.*
-
-[suppress_variable]
-symbol_version_regexp = .*
-soname_regexp = libvirt_driver_.*\\.so.*

.gitignore

@@ -2,4 +2,4 @@
 *.rpm
 i686
 x86_64
-libvirt-*.tar.xz
+libvirt-*.tar.gz

0001-virarptable-Properly-calculate-rtattr-length.patch

@@ -1,29 +0,0 @@
-From: Martin Kletzander <mkletzan@redhat.com>
-Date: Fri, 16 Aug 2024 13:56:51 +0200
-Subject: [PATCH] virarptable: Properly calculate rtattr length
-Content-type: text/plain
-
-Use convenience macro which does almost the same thing we were doing,
-but also pads out the payload length to a multiple of NLMSG_ALIGNTO (4)
-bytes.
-
-Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
-Reviewed-by: Laine Stump <laine@redhat.com>
----
- src/util/virarptable.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/src/util/virarptable.c b/src/util/virarptable.c
-index 299dddd664..d8e41c5a86 100644
---- a/src/util/virarptable.c
-+++ b/src/util/virarptable.c
-@@ -102,8 +102,7 @@ virArpTableGet(void)
-             return table;
- 
-         VIR_WARNINGS_NO_CAST_ALIGN
--        parse_rtattr(tb, NDA_MAX, NDA_RTA(r),
--                     nh->nlmsg_len - NLMSG_LENGTH(sizeof(*r)));
-+        parse_rtattr(tb, NDA_MAX, NDA_RTA(r), NLMSG_PAYLOAD(nh, sizeof(*r)));
-         VIR_WARNINGS_RESET
- 
-         if (tb[NDA_DST] == NULL || tb[NDA_LLADDR] == NULL)

0002-virarptable-Fix-check-for-message-length.patch

@@ -1,34 +0,0 @@
-From: Martin Kletzander <mkletzan@redhat.com>
-Date: Fri, 16 Aug 2024 13:59:15 +0200
-Subject: [PATCH] virarptable: Fix check for message length
-Content-type: text/plain
-
-The previous check was all wrong since it calculated the how long would
-the netlink message be if the netlink header was the payload and then
-subtracted that from the whole message length, a variable that was not
-used later in the code.  This check can fail if there are no additional
-payloads, struct rtattr in particular, which we are parsing later,
-however the RTA_OK macro would've caught that anyway.
-
-Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
-Reviewed-by: Laine Stump <laine@redhat.com>
----
- src/util/virarptable.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/src/util/virarptable.c b/src/util/virarptable.c
-index d8e41c5a86..45ee76766f 100644
---- a/src/util/virarptable.c
-+++ b/src/util/virarptable.c
-@@ -81,10 +81,9 @@ virArpTableGet(void)
-     for (; NLMSG_OK(nh, msglen); nh = NLMSG_NEXT(nh, msglen)) {
-         VIR_WARNINGS_RESET
-         struct ndmsg *r = NLMSG_DATA(nh);
--        int len = nh->nlmsg_len;
-         void *addr;
- 
--        if ((len -= NLMSG_LENGTH(sizeof(*nh))) < 0) {
-+        if (nh->nlmsg_len < NLMSG_SPACE(sizeof(*r))) {
-             virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
-                            _("wrong nlmsg len"));
-             goto cleanup;

0003-virarptable-End-parsing-earlier-in-case-of-NLMSG_DON.patch

@@ -1,46 +0,0 @@
-From: Martin Kletzander <mkletzan@redhat.com>
-Date: Fri, 16 Aug 2024 14:02:48 +0200
-Subject: [PATCH] virarptable: End parsing earlier in case of NLMSG_DONE
-Content-type: text/plain
-
-Check for the last multipart message right as the first thing.  The
-presumption probably was that the last message might still contain a
-payload we want to parse.  However that cannot be true since that would
-have to be a type RTM_NEWNEIGH.  This was not caught because older
-kernels were note sending NLMSG_DONE and probably relied on the fact
-that the parsing just stops after all the messages are walked through,
-which the NLMSG_OK macro successfully did.
-
-Resolves: https://issues.redhat.com/browse/RHEL-52449
-Resolves: https://bugzilla.redhat.com/2302245
-Fixes: a176d67cdfaf5b8237a7e3a80d8be0e6bdf2d8fd
-Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
-Reviewed-by: Laine Stump <laine@redhat.com>
----
- src/util/virarptable.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/src/util/virarptable.c b/src/util/virarptable.c
-index 45ee76766f..20d11f97b0 100644
---- a/src/util/virarptable.c
-+++ b/src/util/virarptable.c
-@@ -83,6 +83,9 @@ virArpTableGet(void)
-         struct ndmsg *r = NLMSG_DATA(nh);
-         void *addr;
- 
-+        if (nh->nlmsg_type == NLMSG_DONE)
-+            break;
-+
-         if (nh->nlmsg_len < NLMSG_SPACE(sizeof(*r))) {
-             virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
-                            _("wrong nlmsg len"));
-@@ -97,9 +100,6 @@ virArpTableGet(void)
-             (!(r->ndm_state == NUD_STALE || r->ndm_state == NUD_REACHABLE)))
-             continue;
- 
--        if (nh->nlmsg_type == NLMSG_DONE)
--            return table;
--
-         VIR_WARNINGS_NO_CAST_ALIGN
-         parse_rtattr(tb, NDA_MAX, NDA_RTA(r), NLMSG_PAYLOAD(nh, sizeof(*r)));
-         VIR_WARNINGS_RESET

0004-util-use-a-single-flags-arg-for-virNetDevBandwidthSe.patch

@@ -1,315 +0,0 @@
-From 807e2670f2704c41f0a1dca81a5d2f2f9336137c Mon Sep 17 00:00:00 2001
-From: Laine Stump <laine@redhat.com>
-Date: Mon, 25 Nov 2024 22:24:44 -0500
-Subject: [PATCH 4/9] util: use a single flags arg for virNetDevBandwidthSet(),
- not multiple bools
-
-Having two bools in the arg list is on the borderline of being
-confusing to anyone trying to read the code, but we're about to add a
-3rd. This patch replaces the two bools with a single flags argument
-which will instead have one or more bits from virNetDevBandwidthFlags
-set.
-
-Signed-off-by: Laine Stump <laine@redhat.com>
-Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
-Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
----
- src/lxc/lxc_driver.c           |  8 ++++++--
- src/lxc/lxc_process.c          |  8 ++++++--
- src/network/bridge_driver.c    | 10 ++++++++--
- src/qemu/qemu_command.c        | 11 ++++++++---
- src/qemu/qemu_driver.c         | 29 ++++++++++++++-------------
- src/qemu/qemu_hotplug.c        | 22 +++++++++++++++------
- src/util/virnetdevbandwidth.c  | 36 ++++++++++++++++++++--------------
- src/util/virnetdevbandwidth.h  |  9 +++++++--
- tests/virnetdevbandwidthtest.c |  8 +++++++-
- 9 files changed, 94 insertions(+), 47 deletions(-)
-
-diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
-index 534e257f30..b693980dbb 100644
---- a/src/lxc/lxc_driver.c
-+++ b/src/lxc/lxc_driver.c
-@@ -3570,8 +3570,12 @@ lxcDomainAttachDeviceNetLive(virLXCDriver *driver,
-     actualBandwidth = virDomainNetGetActualBandwidth(net);
-     if (actualBandwidth) {
-         if (virNetDevSupportsBandwidth(actualType)) {
--            if (virNetDevBandwidthSet(net->ifname, actualBandwidth, false,
--                                      !virDomainNetTypeSharesHostView(net)) < 0)
-+            unsigned int flags = 0;
-+
-+            if (!virDomainNetTypeSharesHostView(net))
-+                flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-+
-+            if (virNetDevBandwidthSet(net->ifname, actualBandwidth, flags) < 0)
-                 goto cleanup;
-         } else {
-             VIR_WARN("setting bandwidth on interfaces of "
-diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c
-index f5eb5383ec..0e689fbb70 100644
---- a/src/lxc/lxc_process.c
-+++ b/src/lxc/lxc_process.c
-@@ -605,8 +605,12 @@ virLXCProcessSetupInterfaces(virLXCDriver *driver,
-         actualBandwidth = virDomainNetGetActualBandwidth(net);
-         if (actualBandwidth) {
-             if (virNetDevSupportsBandwidth(type)) {
--                if (virNetDevBandwidthSet(net->ifname, actualBandwidth, false,
--                                          !virDomainNetTypeSharesHostView(net)) < 0)
-+                unsigned int flags = 0;
-+
-+                if (!virDomainNetTypeSharesHostView(net))
-+                    flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-+
-+                if (virNetDevBandwidthSet(net->ifname, actualBandwidth, flags) < 0)
-                     goto cleanup;
-             } else {
-                 VIR_WARN("setting bandwidth on interfaces of "
-diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
-index 32572c755f..1c53636450 100644
---- a/src/network/bridge_driver.c
-+++ b/src/network/bridge_driver.c
-@@ -2058,8 +2058,11 @@ networkStartNetworkVirtual(virNetworkDriverState *driver,
-         }
-     }
- 
--    if (virNetDevBandwidthSet(def->bridge, def->bandwidth, true, true) < 0)
-+    if (virNetDevBandwidthSet(def->bridge, def->bandwidth,
-+                              VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS
-+                              | VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED) < 0) {
-         goto error;
-+    }
- 
-     return 0;
- 
-@@ -2141,8 +2144,11 @@ networkStartNetworkBridge(virNetworkObj *obj)
-      * type BRIDGE, is started. On failure, undo anything you've done,
-      * and return -1. On success return 0.
-      */
--    if (virNetDevBandwidthSet(def->bridge, def->bandwidth, true, true) < 0)
-+    if (virNetDevBandwidthSet(def->bridge, def->bandwidth,
-+                              VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS
-+                              | VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED) < 0) {
-         goto error;
-+    }
- 
-     if (networkStartHandleMACTableManagerMode(obj) < 0)
-         goto error;
-diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
-index f15e6bda1e..b4815e5e71 100644
---- a/src/qemu/qemu_command.c
-+++ b/src/qemu/qemu_command.c
-@@ -8840,9 +8840,14 @@ qemuBuildInterfaceCommandLine(virQEMUDriver *driver,
-                                                         def->uuid,
-                                                         !virDomainNetTypeSharesHostView(net)) < 0)
-                     goto cleanup;
--            } else if (virNetDevBandwidthSet(net->ifname, actualBandwidth, false,
--                                             !virDomainNetTypeSharesHostView(net)) < 0) {
--                goto cleanup;
-+            } else {
-+                unsigned int flags = 0;
-+
-+                if (!virDomainNetTypeSharesHostView(net))
-+                    flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-+
-+                if (virNetDevBandwidthSet(net->ifname, actualBandwidth, flags) < 0)
-+                    goto cleanup;
-             }
-         } else {
-             VIR_WARN("setting bandwidth on interfaces of "
-diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
-index 736602333e..14929616e5 100644
---- a/src/qemu/qemu_driver.c
-+++ b/src/qemu/qemu_driver.c
-@@ -9941,21 +9941,22 @@ qemuDomainSetInterfaceParameters(virDomainPtr dom,
-                 virErrorRestore(&orig_err);
-                 goto endjob;
-             }
--        } else if (virNetDevBandwidthSet(net->ifname, newBandwidth, false,
--                                         !virDomainNetTypeSharesHostView(net)) < 0) {
--            virErrorPtr orig_err;
--
--            virErrorPreserveLast(&orig_err);
--            ignore_value(virNetDevBandwidthSet(net->ifname,
--                                               net->bandwidth,
--                                               false,
--                                               !virDomainNetTypeSharesHostView(net)));
--            if (net->bandwidth) {
--                ignore_value(virDomainNetBandwidthUpdate(net,
--                                                         net->bandwidth));
-+        } else {
-+            unsigned int bwflags = 0;
-+
-+            if (!virDomainNetTypeSharesHostView(net))
-+                bwflags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-+
-+            if (virNetDevBandwidthSet(net->ifname, newBandwidth, bwflags) < 0) {
-+                virErrorPtr orig_err;
-+
-+                virErrorPreserveLast(&orig_err);
-+                ignore_value(virNetDevBandwidthSet(net->ifname, net->bandwidth, bwflags));
-+                if (net->bandwidth)
-+                    ignore_value(virDomainNetBandwidthUpdate(net, net->bandwidth));
-+                virErrorRestore(&orig_err);
-+                goto endjob;
-             }
--            virErrorRestore(&orig_err);
--            goto endjob;
-         }
- 
-         /* If the old bandwidth was cleared out, restore qdisc. */
-diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
-index 7cb1800504..d5e7e99359 100644
---- a/src/qemu/qemu_hotplug.c
-+++ b/src/qemu/qemu_hotplug.c
-@@ -1279,9 +1279,14 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver,
-                                                         vm->def->uuid,
-                                                         !virDomainNetTypeSharesHostView(net)) < 0)
-                     goto cleanup;
--            } else if (virNetDevBandwidthSet(net->ifname, actualBandwidth, false,
--                                             !virDomainNetTypeSharesHostView(net)) < 0) {
--                goto cleanup;
-+            } else {
-+                int flags = 0;
-+
-+                if (!virDomainNetTypeSharesHostView(net))
-+                    flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-+
-+                if (virNetDevBandwidthSet(net->ifname, actualBandwidth, flags) < 0)
-+                    goto cleanup;
-             }
-         } else {
-             VIR_WARN("setting bandwidth on interfaces of "
-@@ -4082,9 +4087,14 @@ qemuDomainChangeNet(virQEMUDriver *driver,
-                                                         vm->def->uuid,
-                                                         !virDomainNetTypeSharesHostView(newdev)) < 0)
-                     goto cleanup;
--            } else if (virNetDevBandwidthSet(newdev->ifname, newb, false,
--                                             !virDomainNetTypeSharesHostView(newdev)) < 0) {
--                goto cleanup;
-+            } else {
-+                int flags = 0;
-+
-+                if (!virDomainNetTypeSharesHostView(newdev))
-+                    flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-+
-+                if (virNetDevBandwidthSet(newdev->ifname, newb, flags) < 0)
-+                    goto cleanup;
-             }
-         } else {
-             if (virDomainInterfaceClearQoS(vm->def, olddev) < 0)
-diff --git a/src/util/virnetdevbandwidth.c b/src/util/virnetdevbandwidth.c
-index 2b58c58d3e..1baad849c6 100644
---- a/src/util/virnetdevbandwidth.c
-+++ b/src/util/virnetdevbandwidth.c
-@@ -173,30 +173,35 @@ virNetDevBandwidthManipulateFilter(const char *ifname,
-  * virNetDevBandwidthSet:
-  * @ifname: on which interface
-  * @bandwidth: rates to set (may be NULL)
-- * @hierarchical_class: whether to create hierarchical class
-- * @swapped: true if IN/OUT should be set contrariwise
-+ * @flags: bits indicating certain optional actions
-  *
-+
-  * This function enables QoS on specified interface
-  * and set given traffic limits for both, incoming
-- * and outgoing traffic. Any previous setting get
-- * overwritten. If @hierarchical_class is TRUE, create
-- * hierarchical class. It is used to guarantee minimal
-- * throughput ('floor' attribute in NIC).
-+ * and outgoing traffic.
-+ *
-+ * @flags bits and their meanings:
-+ *
-+ *   VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS
-+ *     whether to create a hierarchical class
-+ *     A hiearchical class structure is used to implement a minimal
-+ *     throughput guarantee ('floor' attribute in NIC).
-  *
-- * If @swapped is set, the IN part of @bandwidth is set on
-- * @ifname's TX, and vice versa. If it is not set, IN is set on
-- * RX and OUT on TX. This is because for some types of interfaces
-- * domain and the host live on the same side of the interface (so
-- * domain's RX/TX is host's RX/TX), and for some it's swapped
-- * (domain's RX/TX is hosts's TX/RX).
-+ *   VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED
-+ *     set if IN/OUT should be set backwards from what's indicated in
-+ *     the bandwidth, i.e. the IN part of @bandwidth is set on
-+ *     @ifname's TX, and the OUT part of @bandwidth is set on
-+ *     @ifname's RX.  This is needed because for some types of
-+ *     interfaces the domain and the host live on the same side of the
-+ *     interface (so domain's RX/TX is host's RX/TX), and for some
-+ *     it's swapped (domain's RX/TX is hosts's TX/RX).
-  *
-  * Return 0 on success, -1 otherwise.
-  */
- int
- virNetDevBandwidthSet(const char *ifname,
-                       const virNetDevBandwidth *bandwidth,
--                      bool hierarchical_class,
--                      bool swapped)
-+                      unsigned int flags)
- {
-     int ret = -1;
-     virNetDevBandwidthRate *rx = NULL; /* From domain POV */
-@@ -205,6 +210,7 @@ virNetDevBandwidthSet(const char *ifname,
-     char *average = NULL;
-     char *peak = NULL;
-     char *burst = NULL;
-+    bool hierarchical_class = flags & VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS;
- 
-     if (!bandwidth) {
-         /* nothing to be enabled */
-@@ -224,7 +230,7 @@ virNetDevBandwidthSet(const char *ifname,
-         return -1;
-     }
- 
--    if (swapped) {
-+    if (flags & VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED) {
-         rx = bandwidth->out;
-         tx = bandwidth->in;
-     } else {
-diff --git a/src/util/virnetdevbandwidth.h b/src/util/virnetdevbandwidth.h
-index 6d268fb119..80dc654486 100644
---- a/src/util/virnetdevbandwidth.h
-+++ b/src/util/virnetdevbandwidth.h
-@@ -39,11 +39,16 @@ void virNetDevBandwidthFree(virNetDevBandwidth *def);
- 
- G_DEFINE_AUTOPTR_CLEANUP_FUNC(virNetDevBandwidth, virNetDevBandwidthFree);
- 
-+typedef enum {
-+    VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS = (1 << 0),
-+    VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED = (1 << 1),
-+} virNetDevBandwidthSetFlags;
-+
- int virNetDevBandwidthSet(const char *ifname,
-                           const virNetDevBandwidth *bandwidth,
--                          bool hierarchical_class,
--                          bool swapped)
-+                          unsigned int flags)
-     G_GNUC_WARN_UNUSED_RESULT;
-+
- int virNetDevBandwidthClear(const char *ifname);
- int virNetDevBandwidthCopy(virNetDevBandwidth **dest,
-                            const virNetDevBandwidth *src)
-diff --git a/tests/virnetdevbandwidthtest.c b/tests/virnetdevbandwidthtest.c
-index f7c38faa2e..6529ff4026 100644
---- a/tests/virnetdevbandwidthtest.c
-+++ b/tests/virnetdevbandwidthtest.c
-@@ -82,8 +82,14 @@ testVirNetDevBandwidthSet(const void *data)
-         if (virNetDevOpenvswitchInterfaceSetQos(iface, band, info->uuid, true) < 0)
-             return -1;
-     } else {
-+        unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-+
-+        if (info->hierarchical_class)
-+            flags |= VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS;
-+
-         exp_cmd = info->exp_cmd_tc;
--        if (virNetDevBandwidthSet(iface, band, info->hierarchical_class, true) < 0)
-+
-+        if (virNetDevBandwidthSet(iface, band, flags) < 0)
-             return -1;
-     }
- 
--- 
-2.47.1
-

0005-util-make-it-optional-to-clear-existing-tc-qdiscs-fi.patch

@@ -1,185 +0,0 @@
-From 490f58382dca2a415a5f16b6133f298d853bb379 Mon Sep 17 00:00:00 2001
-From: Laine Stump <laine@redhat.com>
-Date: Mon, 25 Nov 2024 22:24:45 -0500
-Subject: [PATCH 5/9] util: make it optional to clear existing tc
- qdiscs/filters in virNetDevBandwidthSet()
-
-virNetDevBandwidthSet() always clears all existing qdiscs and their
-subordinate filters before adding all the new qdiscs/filters. This is
-normally exactly what we want, but there is one case (the network
-driver) where the Qdisc added by virNetDevBandwidthSet() may already
-be in use by the nftables backend (which will add a rule to fix the
-checksum of dhcp packets); in that case, we *don't* want
-virNetDevBandwidthSet() to clear out the qdisc that was already added
-for nftables, and none of the bandwidth filters have been added yet,
-so there already aren't any "old" filters that need to be removed
-either - it is safe to just skip virNetDevBandwidthClear() in this
-case.
-
-To allow the network driver to set bandwidth without first clearing
-it, this patch adds the flag VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL to the
-virNetDevBandwidthSetFlags enum, and recognizes it in
-virNetDevBandwidthSet() - if the flag is set, then
-virNetDevBandwidth() will call virNetDevBandwidthClear() just as it
-always has. But if the flag isn't set it *won't* call
-virNetDevBandwidthClear().
-
-As suggested above, VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL is set for all
-calls to virNetdevBandwidthSet() except for two places in the network
-driver.
-
-Signed-off-by: Laine Stump <laine@redhat.com>
-Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
----
- src/lxc/lxc_driver.c           |  2 +-
- src/lxc/lxc_process.c          |  2 +-
- src/qemu/qemu_command.c        |  2 +-
- src/qemu/qemu_driver.c         |  2 +-
- src/qemu/qemu_hotplug.c        |  4 ++--
- src/util/virnetdevbandwidth.c  | 21 ++++++++++++++++++++-
- src/util/virnetdevbandwidth.h  |  1 +
- tests/virnetdevbandwidthtest.c |  3 ++-
- 8 files changed, 29 insertions(+), 8 deletions(-)
-
-diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
-index b693980dbb..81581c74df 100644
---- a/src/lxc/lxc_driver.c
-+++ b/src/lxc/lxc_driver.c
-@@ -3570,7 +3570,7 @@ lxcDomainAttachDeviceNetLive(virLXCDriver *driver,
-     actualBandwidth = virDomainNetGetActualBandwidth(net);
-     if (actualBandwidth) {
-         if (virNetDevSupportsBandwidth(actualType)) {
--            unsigned int flags = 0;
-+            unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
- 
-             if (!virDomainNetTypeSharesHostView(net))
-                 flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c
-index 0e689fbb70..081ce03a57 100644
---- a/src/lxc/lxc_process.c
-+++ b/src/lxc/lxc_process.c
-@@ -605,7 +605,7 @@ virLXCProcessSetupInterfaces(virLXCDriver *driver,
-         actualBandwidth = virDomainNetGetActualBandwidth(net);
-         if (actualBandwidth) {
-             if (virNetDevSupportsBandwidth(type)) {
--                unsigned int flags = 0;
-+                unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
- 
-                 if (!virDomainNetTypeSharesHostView(net))
-                     flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
-index b4815e5e71..ed54fd4c5b 100644
---- a/src/qemu/qemu_command.c
-+++ b/src/qemu/qemu_command.c
-@@ -8841,7 +8841,7 @@ qemuBuildInterfaceCommandLine(virQEMUDriver *driver,
-                                                         !virDomainNetTypeSharesHostView(net)) < 0)
-                     goto cleanup;
-             } else {
--                unsigned int flags = 0;
-+                unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
- 
-                 if (!virDomainNetTypeSharesHostView(net))
-                     flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
-index 14929616e5..9549065b1f 100644
---- a/src/qemu/qemu_driver.c
-+++ b/src/qemu/qemu_driver.c
-@@ -9942,7 +9942,7 @@ qemuDomainSetInterfaceParameters(virDomainPtr dom,
-                 goto endjob;
-             }
-         } else {
--            unsigned int bwflags = 0;
-+            unsigned int bwflags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
- 
-             if (!virDomainNetTypeSharesHostView(net))
-                 bwflags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
-index d5e7e99359..ceda4119cd 100644
---- a/src/qemu/qemu_hotplug.c
-+++ b/src/qemu/qemu_hotplug.c
-@@ -1280,7 +1280,7 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver,
-                                                         !virDomainNetTypeSharesHostView(net)) < 0)
-                     goto cleanup;
-             } else {
--                int flags = 0;
-+                int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
- 
-                 if (!virDomainNetTypeSharesHostView(net))
-                     flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-@@ -4088,7 +4088,7 @@ qemuDomainChangeNet(virQEMUDriver *driver,
-                                                         !virDomainNetTypeSharesHostView(newdev)) < 0)
-                     goto cleanup;
-             } else {
--                int flags = 0;
-+                int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
- 
-                 if (!virDomainNetTypeSharesHostView(newdev))
-                     flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-diff --git a/src/util/virnetdevbandwidth.c b/src/util/virnetdevbandwidth.c
-index 1baad849c6..9c48844c5d 100644
---- a/src/util/virnetdevbandwidth.c
-+++ b/src/util/virnetdevbandwidth.c
-@@ -196,6 +196,21 @@ virNetDevBandwidthManipulateFilter(const char *ifname,
-  *     interface (so domain's RX/TX is host's RX/TX), and for some
-  *     it's swapped (domain's RX/TX is hosts's TX/RX).
-  *
-+ *   VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL
-+ *     If VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL is set, then the root
-+ *     qdisc is deleted before adding any new qdisc/class/filter,
-+ *     which causes any pre-existing filters to also be deleted. If
-+ *     not set, then it's assumed that there are no existing rules (or
-+ *     that those already there need to be kept). The caller should
-+ *     set this flag for an existing interface that is having its
-+ *     bandwidth settings modified, but can leave it unset if the
-+ *     interface was newly created and this is the first time
-+ *     bandwidth has been set, but someone else might have already
-+ *     added the qdisc (e.g. this is the case when the network driver
-+ *     is setting bandwidth for a virtual network bridge device - the
-+ *     nftables backend may have already added qdisc handle 1:0 and a
-+ *     filter, and we don't want to delete them)
-+ *
-  * Return 0 on success, -1 otherwise.
-  */
- int
-@@ -238,7 +253,11 @@ virNetDevBandwidthSet(const char *ifname,
-         tx = bandwidth->out;
-     }
- 
--    virNetDevBandwidthClear(ifname);
-+    /* Only if the caller requests, clear everything including root
-+     * qdisc and all filters before adding everything.
-+     */
-+    if (flags & VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL)
-+        virNetDevBandwidthClear(ifname);
- 
-     if (tx && tx->average) {
-         average = g_strdup_printf("%llukbps", tx->average);
-diff --git a/src/util/virnetdevbandwidth.h b/src/util/virnetdevbandwidth.h
-index 80dc654486..744aa4c826 100644
---- a/src/util/virnetdevbandwidth.h
-+++ b/src/util/virnetdevbandwidth.h
-@@ -42,6 +42,7 @@ G_DEFINE_AUTOPTR_CLEANUP_FUNC(virNetDevBandwidth, virNetDevBandwidthFree);
- typedef enum {
-     VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS = (1 << 0),
-     VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED = (1 << 1),
-+    VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL = (1 << 2),
- } virNetDevBandwidthSetFlags;
- 
- int virNetDevBandwidthSet(const char *ifname,
-diff --git a/tests/virnetdevbandwidthtest.c b/tests/virnetdevbandwidthtest.c
-index 6529ff4026..6d5c847ad7 100644
---- a/tests/virnetdevbandwidthtest.c
-+++ b/tests/virnetdevbandwidthtest.c
-@@ -82,7 +82,8 @@ testVirNetDevBandwidthSet(const void *data)
-         if (virNetDevOpenvswitchInterfaceSetQos(iface, band, info->uuid, true) < 0)
-             return -1;
-     } else {
--        unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
-+        unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED |
-+                             VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
- 
-         if (info->hierarchical_class)
-             flags |= VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS;
--- 
-2.47.1
-

0006-util-put-the-command-that-adds-a-tx-filter-qdisc-int.patch

@@ -1,98 +0,0 @@
-From faebbbbfa3b1bd4120852b3f416c8073ab82d5c5 Mon Sep 17 00:00:00 2001
-From: Laine Stump <laine@redhat.com>
-Date: Mon, 25 Nov 2024 22:24:46 -0500
-Subject: [PATCH 6/9] util: put the command that adds a tx filter qdisc into a
- separate function
-
-virNetDevBandwidthSet() adds a queue discipline (qdisc) for each
-interface that it will need to add tc transmit filters to, and the
-filters are then attached to the qdisc.
-
-There are other circumstances where some other function will need to
-add tc transmit filters to an interface (in particular an upcoming
-patch to the network driver nftables backend that will use a tc tx
-filter to fix the checksum of dhcp packets), so that function will
-also need a qdisc for the tx filter. To assure both always use exactly
-the same qdisc, this patch puts the command that adds the tx filter
-qdisc into a separate helper function that can (and will) be called
-from either place
-
-Signed-off-by: Laine Stump <laine@redhat.com>
-Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
----
- src/libvirt_private.syms      |  1 +
- src/util/virnetdevbandwidth.c | 30 +++++++++++++++++++++++++-----
- src/util/virnetdevbandwidth.h |  3 +++
- 3 files changed, 29 insertions(+), 5 deletions(-)
-
-diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
-index d15d6a6a9d..0211cee967 100644
---- a/src/libvirt_private.syms
-+++ b/src/libvirt_private.syms
-@@ -2859,6 +2859,7 @@ virNetDevVFInterfaceStats;
- 
- 
- # util/virnetdevbandwidth.h
-+virNetDevBandWidthAddTxFilterParentQdisc;
- virNetDevBandwidthClear;
- virNetDevBandwidthCopy;
- virNetDevBandwidthEqual;
-diff --git a/src/util/virnetdevbandwidth.c b/src/util/virnetdevbandwidth.c
-index 9c48844c5d..90eebe6576 100644
---- a/src/util/virnetdevbandwidth.c
-+++ b/src/util/virnetdevbandwidth.c
-@@ -266,11 +266,7 @@ virNetDevBandwidthSet(const char *ifname,
-         if (tx->burst)
-             burst = g_strdup_printf("%llukb", tx->burst);
- 
--        cmd = virCommandNew(TC);
--        virCommandAddArgList(cmd, "qdisc", "add", "dev", ifname, "root",
--                             "handle", "1:", "htb", "default",
--                             hierarchical_class ? "2" : "1", NULL);
--        if (virCommandRun(cmd, NULL) < 0)
-+        if (virNetDevBandWidthAddTxFilterParentQdisc(ifname, hierarchical_class) < 0)
-             goto cleanup;
- 
-         /* If we are creating a hierarchical class, all non guaranteed traffic
-@@ -794,3 +790,27 @@ virNetDevBandwidthSetRootQDisc(const char *ifname,
- 
-     return 0;
- }
-+
-+/**
-+ * virNetDevBandwidthAddTxFilterParentQdisc:
-+ * @ifname: name of interface that needs a qdisc to attach tx filters to
-+ * @hierarchical_class: true if hierarchical classes will be used on this interface
-+ *
-+ * Add a root Qdisc (Queueing Discipline) for attaching Tx filters to
-+ * @ifname.
-+ *
-+ * returns 0 on success, -1 on failure
-+ */
-+int
-+virNetDevBandWidthAddTxFilterParentQdisc(const char *ifname,
-+                                         bool hierarchical_class)
-+{
-+    g_autoptr(virCommand) cmd = NULL;
-+
-+    cmd = virCommandNew(TC);
-+    virCommandAddArgList(cmd, "qdisc", "add", "dev", ifname, "root",
-+                         "handle", "1:", "htb", "default",
-+                         hierarchical_class ? "2" : "1", NULL);
-+
-+    return virCommandRun(cmd, NULL);
-+}
-diff --git a/src/util/virnetdevbandwidth.h b/src/util/virnetdevbandwidth.h
-index 744aa4c826..65c1500637 100644
---- a/src/util/virnetdevbandwidth.h
-+++ b/src/util/virnetdevbandwidth.h
-@@ -84,3 +84,6 @@ int virNetDevBandwidthUpdateFilter(const char *ifname,
- int virNetDevBandwidthSetRootQDisc(const char *ifname,
-                                    const char *qdisc)
-     G_NO_INLINE;
-+
-+int virNetDevBandWidthAddTxFilterParentQdisc(const char *ifname,
-+                                             bool hierarchical_class);
--- 
-2.47.1
-

0007-util-don-t-re-add-the-qdisc-used-for-tx-filters-if-i.patch

@@ -1,107 +0,0 @@
-From 73c0fb19ce5b816ee81ede691252855c75391c9a Mon Sep 17 00:00:00 2001
-From: Laine Stump <laine@redhat.com>
-Date: Mon, 25 Nov 2024 22:24:47 -0500
-Subject: [PATCH 7/9] util: don't re-add the qdisc used for tx filters if it
- already exists
-
-There will soon be two separate users of tc on virtual networks, and
-both will use the "qdisc root handle 1: htb" to add tx filters. One or the
-other could get the first chance to add the qdisc, and then if at a
-later time the other decides to use it, we need to prevent the 2nd
-user from attempting to re-add the qdisc (because that just generates
-an error).
-
-We do this by running "tc qdisc show dev $bridge handle 1:" then
-checking if the output of that command contains both "qdisc" and " 1:
-".[*] If it does then the qdisc has already been added. If not then we
-need to add it now.
-
-[*]As of this writing, the output more exactly starts with "qdisc
-htb 1: root", but our comparison is made purposefully generous to
-increase the chances that it will continue to work properly if tc
-modifies the format of its output.
-
-Signed-off-by: Laine Stump <laine@redhat.com>
-Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
----
- src/util/virnetdevbandwidth.c  | 35 ++++++++++++++++++++++++++++------
- tests/virnetdevbandwidthtest.c |  3 +++
- 2 files changed, 32 insertions(+), 6 deletions(-)
-
-diff --git a/src/util/virnetdevbandwidth.c b/src/util/virnetdevbandwidth.c
-index 90eebe6576..5c6a65528c 100644
---- a/src/util/virnetdevbandwidth.c
-+++ b/src/util/virnetdevbandwidth.c
-@@ -805,12 +805,35 @@ int
- virNetDevBandWidthAddTxFilterParentQdisc(const char *ifname,
-                                          bool hierarchical_class)
- {
--    g_autoptr(virCommand) cmd = NULL;
-+    g_autoptr(virCommand) testCmd = NULL;
-+    g_autofree char *testResult = NULL;
- 
--    cmd = virCommandNew(TC);
--    virCommandAddArgList(cmd, "qdisc", "add", "dev", ifname, "root",
--                         "handle", "1:", "htb", "default",
--                         hierarchical_class ? "2" : "1", NULL);
-+    /* first check it the qdisc with handle 1: was already added for
-+     * this interface by someone else
-+     */
-+    testCmd = virCommandNew(TC);
-+    virCommandAddArgList(testCmd, "qdisc", "show", "dev", ifname,
-+                         "handle", "1:", NULL);
-+    virCommandSetOutputBuffer(testCmd, &testResult);
- 
--    return virCommandRun(cmd, NULL);
-+    if (virCommandRun(testCmd, NULL) < 0)
-+        return -1;
-+
-+    /* output will be something like: "qdisc htb 1: root refcnt ..."
-+     * if the qdisc was already added. We just search for "qdisc" and
-+     * " 1: " anywhere in the output to allow for tc changing its
-+     * output format.
-+     */
-+    if (!(testResult && strstr(testResult, "qdisc") && strstr(testResult, " 1: "))) {
-+        /* didn't find qdisc in output, so we need to add one */
-+        g_autoptr(virCommand) addCmd = virCommandNew(TC);
-+
-+        virCommandAddArgList(addCmd, "qdisc", "add", "dev", ifname, "root",
-+                             "handle", "1:", "htb", "default",
-+                             hierarchical_class ? "2" : "1", NULL);
-+
-+        return virCommandRun(addCmd, NULL);
-+    }
-+
-+    return 0;
- }
-diff --git a/tests/virnetdevbandwidthtest.c b/tests/virnetdevbandwidthtest.c
-index 6d5c847ad7..31aa7f469d 100644
---- a/tests/virnetdevbandwidthtest.c
-+++ b/tests/virnetdevbandwidthtest.c
-@@ -147,6 +147,7 @@ mymain(void)
-                 "</bandwidth>",
-                 TC " qdisc del dev eth0 root\n"
-                 TC " qdisc del dev eth0 ingress\n"
-+                TC " qdisc show dev eth0 handle 1:\n"
-                 TC " qdisc add dev eth0 root handle 1: htb default 1\n"
-                 TC " class add dev eth0 parent 1: classid 1:1 htb rate 1024kbps quantum 87\n"
-                 TC " qdisc add dev eth0 parent 1:1 handle 2: sfq perturb 10\n"
-@@ -177,6 +178,7 @@ mymain(void)
-                 "</bandwidth>",
-                 TC " qdisc del dev eth0 root\n"
-                 TC " qdisc del dev eth0 ingress\n"
-+                TC " qdisc show dev eth0 handle 1:\n"
-                 TC " qdisc add dev eth0 root handle 1: htb default 1\n"
-                 TC " class add dev eth0 parent 1: classid 1:1 htb rate 1kbps ceil 2kbps burst 4kb quantum 1\n"
-                 TC " qdisc add dev eth0 parent 1:1 handle 2: sfq perturb 10\n"
-@@ -199,6 +201,7 @@ mymain(void)
-                 "</bandwidth>",
-                 TC " qdisc del dev eth0 root\n"
-                 TC " qdisc del dev eth0 ingress\n"
-+                TC " qdisc show dev eth0 handle 1:\n"
-                 TC " qdisc add dev eth0 root handle 1: htb default 1\n"
-                 TC " class add dev eth0 parent 1: classid 1:1 htb rate 4294967295kbps quantum 366503875\n"
-                 TC " qdisc add dev eth0 parent 1:1 handle 2: sfq perturb 10\n"
--- 
-2.47.1
-

0008-util-add-new-tc-layer-for-virFirewallCmd-objects.patch

@@ -1,171 +0,0 @@
-From dac9cb9030ac03d18f59884864a0a253e3c9f8f1 Mon Sep 17 00:00:00 2001
-From: Laine Stump <laine@redhat.com>
-Date: Mon, 25 Nov 2024 22:24:48 -0500
-Subject: [PATCH 8/9] util: add new "tc" layer for virFirewallCmd objects
-
-If the layer of a virFirewallCmd is "tc", then the "tc" utility will
-be executed using the arguments that had been added to the
-virFirewallCmd
-
-tc layer doesn't support auto-rollback command creation (any rollback
-needs to be added manually with virFirewallAddRollbackCmd()), and also
-tc layer isn't supported by the iptables backend (it would have been
-straightforward to add, but the iptables backend doesn't need it, and
-I didn't want to take the chance of causing a regression in that
-code for no good reason).
-
-Signed-off-by: Laine Stump <laine@redhat.com>
-Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
-Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
----
- src/network/network_nftables.c |  1 +
- src/util/virfirewall.c         | 66 +++++++++++++++++++++-------------
- src/util/virfirewall.h         |  1 +
- src/util/virfirewalld.c        |  1 +
- 4 files changed, 44 insertions(+), 25 deletions(-)
-
-diff --git a/src/network/network_nftables.c b/src/network/network_nftables.c
-index 268d1f12ca..cc184105c3 100644
---- a/src/network/network_nftables.c
-+++ b/src/network/network_nftables.c
-@@ -73,6 +73,7 @@ VIR_ENUM_IMPL(nftablesLayer,
-               "",
-               "ip",
-               "ip6",
-+              "",
- );
- 
- 
-diff --git a/src/util/virfirewall.c b/src/util/virfirewall.c
-index 811b787ecc..9389bcf541 100644
---- a/src/util/virfirewall.c
-+++ b/src/util/virfirewall.c
-@@ -47,6 +47,7 @@ VIR_ENUM_IMPL(virFirewallLayer,
-               "ethernet",
-               "ipv4",
-               "ipv6",
-+              "tc",
- );
- 
- typedef struct _virFirewallGroup virFirewallGroup;
-@@ -57,6 +58,7 @@ VIR_ENUM_IMPL(virFirewallLayerCommand,
-               EBTABLES,
-               IPTABLES,
-               IP6TABLES,
-+              TC,
- );
- 
- struct _virFirewallCmd {
-@@ -591,6 +593,7 @@ virFirewallCmdIptablesApply(virFirewall *firewall,
-     case VIR_FIREWALL_LAYER_IPV6:
-         virCommandAddArg(cmd, "-w");
-         break;
-+    case VIR_FIREWALL_LAYER_TC:
-     case VIR_FIREWALL_LAYER_LAST:
-         break;
-     }
-@@ -672,39 +675,52 @@ virFirewallCmdNftablesApply(virFirewall *firewall G_GNUC_UNUSED,
-     size_t i;
-     int status;
- 
--    cmd = virCommandNew(NFT);
-+    if (fwCmd->layer == VIR_FIREWALL_LAYER_TC) {
- 
--    if ((virFirewallTransactionGetFlags(firewall) & VIR_FIREWALL_TRANSACTION_AUTO_ROLLBACK) &&
--        fwCmd->argsLen > 1) {
--        /* skip any leading options to get to command verb */
--        for (i = 0; i < fwCmd->argsLen - 1; i++) {
--            if (fwCmd->args[i][0] != '-')
--                break;
--        }
-+        /* for VIR_FIREWALL_LAYER_TC, we run the 'tc' (traffic control) command with
-+         * the supplied args.
-+         */
-+        cmd = virCommandNew(TC);
- 
--        if (i + 1 < fwCmd->argsLen &&
--            VIR_NFTABLES_ARG_IS_CREATE(fwCmd->args[i])) {
-+        /* NB: RAW commands don't support auto-rollback command creation */
- 
--            cmdIdx = i;
--            objectType = fwCmd->args[i + 1];
-+    } else {
- 
--            /* we currently only handle auto-rollback for rules,
--             * chains, and tables, and those all can be "rolled
--             * back" by a delete command using the handle that is
--             * returned when "-ae" is added to the add/insert
--             * command.
--             */
--            if (STREQ_NULLABLE(objectType, "rule") ||
--                STREQ_NULLABLE(objectType, "chain") ||
--                STREQ_NULLABLE(objectType, "table")) {
-+        cmd = virCommandNew(NFT);
- 
--                needRollback = true;
--                /* this option to nft instructs it to add the
--                 * "handle" of the created object to stdout
-+        if ((virFirewallTransactionGetFlags(firewall) & VIR_FIREWALL_TRANSACTION_AUTO_ROLLBACK) &&
-+            fwCmd->argsLen > 1) {
-+            /* skip any leading options to get to command verb */
-+            for (i = 0; i < fwCmd->argsLen - 1; i++) {
-+                if (fwCmd->args[i][0] != '-')
-+                    break;
-+            }
-+
-+            if (i + 1 < fwCmd->argsLen &&
-+                VIR_NFTABLES_ARG_IS_CREATE(fwCmd->args[i])) {
-+
-+                cmdIdx = i;
-+                objectType = fwCmd->args[i + 1];
-+
-+                /* we currently only handle auto-rollback for rules,
-+                 * chains, and tables, and those all can be "rolled
-+                 * back" by a delete command using the handle that is
-+                 * returned when "-ae" is added to the add/insert
-+                 * command.
-                  */
--                virCommandAddArg(cmd, "-ae");
-+                if (STREQ_NULLABLE(objectType, "rule") ||
-+                    STREQ_NULLABLE(objectType, "chain") ||
-+                    STREQ_NULLABLE(objectType, "table")) {
-+
-+                    needRollback = true;
-+                    /* this option to nft instructs it to add the
-+                     * "handle" of the created object to stdout
-+                     */
-+                    virCommandAddArg(cmd, "-ae");
-+                }
-             }
-         }
-+
-     }
- 
-     for (i = 0; i < fwCmd->argsLen; i++)
-diff --git a/src/util/virfirewall.h b/src/util/virfirewall.h
-index bce51259d2..d42e60884b 100644
---- a/src/util/virfirewall.h
-+++ b/src/util/virfirewall.h
-@@ -39,6 +39,7 @@ typedef enum {
-     VIR_FIREWALL_LAYER_ETHERNET,
-     VIR_FIREWALL_LAYER_IPV4,
-     VIR_FIREWALL_LAYER_IPV6,
-+    VIR_FIREWALL_LAYER_TC,
- 
-     VIR_FIREWALL_LAYER_LAST,
- } virFirewallLayer;
-diff --git a/src/util/virfirewalld.c b/src/util/virfirewalld.c
-index 827e201dbb..124523c420 100644
---- a/src/util/virfirewalld.c
-+++ b/src/util/virfirewalld.c
-@@ -43,6 +43,7 @@ VIR_LOG_INIT("util.firewalld");
- VIR_ENUM_DECL(virFirewallLayerFirewallD);
- VIR_ENUM_IMPL(virFirewallLayerFirewallD,
-               VIR_FIREWALL_LAYER_LAST,
-+              "",
-               "eb",
-               "ipv4",
-               "ipv6",
--- 
-2.47.1
-

0009-network-add-tc-filter-rule-to-nftables-backend-to-fi.patch

@@ -1,687 +0,0 @@
-From b1e2318a0d609fcdff04fcf88953ea87cdd02b95 Mon Sep 17 00:00:00 2001
-From: Laine Stump <laine@redhat.com>
-Date: Mon, 25 Nov 2024 22:24:49 -0500
-Subject: [PATCH 9/9] network: add tc filter rule to nftables backend to fix
- checksum of DHCP responses
-
-Please see the commit log for commit v10.9.0-rc1-1-g42ab0148dd for the
-history and explanation of the problem that this patch is fixing.
-
-A shorter explanation is that when a guest is connected to a libvirt
-virtual network using a virtio-net adapter with in-kernel "vhost-net"
-packet processing enabled, it will fail to acquire an IP address from
-a DHCP seever running on the host.
-
-In commit v10.9.0-rc1-1-g42ab0148dd we tried fixing this by *zeroing
-out* the checksums of these packets with an nftables rule (nftables
-can't recompute the checksum, but it can set it to 0) . This
-*appeared* to work initially, but it turned out that zeroing the
-checksum ends up breaking dhcp packets on *non* virtio/vhost-net guest
-interfaces. That attempt was reverted in commit v10.9.0-rc2.
-
-Fortunately, there is an existing way to recompute the checksum of a
-packet as it leaves an interface - the "tc" (traffic control) utility
-that libvirt already uses for bandwidth management. This patch uses a
-tc filter rule to match dhcp response packets on the bridge and
-recompute their checksum.
-
-The filter rule must be attached to a tc qdisc, which may also have a
-filter attached for bandwidth management (in the <bandwidth> element
-of the network config). Not only must we add the qdisc only once
-(which was already handled by the patch two prior to this one), but
-also the filter rule for checksum fixing and the filter rule for
-bandwidth management must be different priorities so they don't clash;
-this is solved by adding the checksum-fix filter with "priority 2",
-while the bandwidth management filter remains "priority 1" (both will
-always be evaluated anyway, it's just a matter of which is evaluated
-first).
-
-So far this method has worked with every different guest we could
-throw at it, including several that failed with the previous method.
-
-Fixes: b89c4991daa0ee9371f10937fab3b03c5ffdabc6
-Reported-by: Rich Jones <rjones@redhat.com>
-Reported-by: Andrea Bolognani <abologna@redhat.com>
-Fix-Suggested-by: Eric Garver <egarver@redhat.com>
-Fix-Suggested-by: Phil Sutter <psutter@redhat.com>
-Signed-off-by: Laine Stump <laine@redhat.com>
-Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
----
- src/network/network_nftables.c                | 68 +++++++++++++++++++
- .../forward-dev-linux.nftables                | 40 +++++++++++
- .../isolated-linux.nftables                   | 40 +++++++++++
- .../nat-default-linux.nftables                | 40 +++++++++++
- .../nat-ipv6-linux.nftables                   | 40 +++++++++++
- .../nat-ipv6-masquerade-linux.nftables        | 40 +++++++++++
- .../nat-many-ips-linux.nftables               | 40 +++++++++++
- .../nat-no-dhcp-linux.nftables                | 40 +++++++++++
- .../nat-port-range-ipv6-linux.nftables        | 40 +++++++++++
- .../nat-port-range-linux.nftables             | 40 +++++++++++
- .../nat-tftp-linux.nftables                   | 40 +++++++++++
- .../route-default-linux.nftables              | 40 +++++++++++
- 12 files changed, 508 insertions(+)
-
-diff --git a/src/network/network_nftables.c b/src/network/network_nftables.c
-index cc184105c3..748edb0273 100644
---- a/src/network/network_nftables.c
-+++ b/src/network/network_nftables.c
-@@ -29,6 +29,7 @@
- 
- #include "internal.h"
- #include "virfirewalld.h"
-+#include "vircommand.h"
- #include "virerror.h"
- #include "virlog.h"
- #include "virhash.h"
-@@ -924,6 +925,67 @@ nftablesAddIPSpecificFirewallRules(virFirewall *fw,
- }
- 
- 
-+/**
-+ * nftablesAddUdpChecksumFixWithTC:
-+ *
-+ * Add a tc filter rule to @ifname (the bridge device of this network)
-+ * that will recompute the checksum of udp packets output from @iface with
-+ * destination port @port.
-+ *
-+ * Normally the checksum should be filled by some part of the basic
-+ * network stack, but there are cases (e.g. DHCP response packets sent
-+ * from virtualization host to a QEMU guest when the guest NIC uses
-+ * vhost-net packet processing) when the host (sender) thinks that
-+ * packet checksums will be computed elsewhere (and so leaves a
-+ * partially computed checksum in the packet header) while the guest
-+ * (receiver) thinks that the checksum has already been fully
-+ * computed; in the meantime none of the code in between has actually
-+ * finished computing the checksum.
-+ *
-+ * An example of this is DHCP response packets from host to guest. If
-+ * the checksum of each of these packets isn't properly computed, then
-+ * many guests (e.g. FreeBSD) will drop them with reason BAD CHECKSUM;
-+ * this tc filter rule will fix the ip and udp checksums, and the
-+ * FreeBSD dhcp client will happily accept the packet.
-+ *
-+ * (NB: if you're wondering how the tc qdisc and filter are removed
-+ * when the network is destroyed, the answer is that the kernel
-+ * automatically (and properly) removes them for us, so we don't need
-+ * to worry about keeping track/deleting as we do with nftables rules)
-+ */
-+static int
-+nftablesAddUdpChecksumFixWithTC(virFirewall *fw,
-+                                const char *iface,
-+                                int port)
-+{
-+    g_autofree char *portstr = g_strdup_printf("%d", port);
-+
-+    /* this will add the qdisc (that the filter below is attached to)
-+     * unless it already exists
-+     */
-+    if (virNetDevBandWidthAddTxFilterParentQdisc(iface, true) < 0)
-+        return -1;
-+
-+    /* add a filter to catch all udp packets with dst "port" and
-+     * recompute their checksum
-+     */
-+    virFirewallAddCmd(fw, VIR_FIREWALL_LAYER_TC,
-+                      "filter", "add", "dev", iface,
-+                      "prio", "2", "protocol", "ip", "parent", "1:",
-+                      "u32", "match", "ip", "dport", portstr, "ffff",
-+                      "action", "csum", "ip", "and", "udp",
-+                      NULL);
-+
-+    virFirewallAddRollbackCmd(fw, VIR_FIREWALL_LAYER_TC,
-+                              "filter", "del", "dev", iface,
-+                              "prio", "2", "protocol", "ip", "parent", "1:",
-+                              "u32", "match", "ip", "dport", portstr, "ffff",
-+                              "action", "csum", "ip", "and", "udp",
-+                              NULL);
-+    return 0;
-+}
-+
-+
- /* nftablesAddFirewallrules:
-  *
-  * @def - the network that needs an nftables firewall added
-@@ -944,6 +1006,12 @@ nftablesAddFirewallRules(virNetworkDef *def, virFirewall **fwRemoval)
- 
-     virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_AUTO_ROLLBACK);
- 
-+    /* add the tc filter rule needed to fixup the checksum of dhcp
-+     * response packets going from host to guest.
-+     */
-+    if (nftablesAddUdpChecksumFixWithTC(fw, def->bridge, 68) < 0)
-+        return -1;
-+
-     nftablesAddGeneralFirewallRules(fw, def);
- 
-     for (i = 0;
-diff --git a/tests/networkxml2firewalldata/forward-dev-linux.nftables b/tests/networkxml2firewalldata/forward-dev-linux.nftables
-index 8badb74beb..6772383b37 100644
---- a/tests/networkxml2firewalldata/forward-dev-linux.nftables
-+++ b/tests/networkxml2firewalldata/forward-dev-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/isolated-linux.nftables b/tests/networkxml2firewalldata/isolated-linux.nftables
-index d1b4dac178..546a18b75a 100644
---- a/tests/networkxml2firewalldata/isolated-linux.nftables
-+++ b/tests/networkxml2firewalldata/isolated-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/nat-default-linux.nftables b/tests/networkxml2firewalldata/nat-default-linux.nftables
-index 28508292f9..08623c1381 100644
---- a/tests/networkxml2firewalldata/nat-default-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-default-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/nat-ipv6-linux.nftables b/tests/networkxml2firewalldata/nat-ipv6-linux.nftables
-index d8a9ba706d..3fd6b94eef 100644
---- a/tests/networkxml2firewalldata/nat-ipv6-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-ipv6-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables b/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables
-index a7f09cda59..2811e098d1 100644
---- a/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/nat-many-ips-linux.nftables b/tests/networkxml2firewalldata/nat-many-ips-linux.nftables
-index b826fe6134..5409d5b552 100644
---- a/tests/networkxml2firewalldata/nat-many-ips-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-many-ips-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables b/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables
-index d8a9ba706d..3fd6b94eef 100644
---- a/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables b/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables
-index ceaed6fa40..d74417cdb3 100644
---- a/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/nat-port-range-linux.nftables b/tests/networkxml2firewalldata/nat-port-range-linux.nftables
-index 1dc37a26ec..b55bb287a9 100644
---- a/tests/networkxml2firewalldata/nat-port-range-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-port-range-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/nat-tftp-linux.nftables b/tests/networkxml2firewalldata/nat-tftp-linux.nftables
-index 28508292f9..08623c1381 100644
---- a/tests/networkxml2firewalldata/nat-tftp-linux.nftables
-+++ b/tests/networkxml2firewalldata/nat-tftp-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
-diff --git a/tests/networkxml2firewalldata/route-default-linux.nftables b/tests/networkxml2firewalldata/route-default-linux.nftables
-index 282c9542a5..76d6902517 100644
---- a/tests/networkxml2firewalldata/route-default-linux.nftables
-+++ b/tests/networkxml2firewalldata/route-default-linux.nftables
-@@ -1,3 +1,43 @@
-+tc \
-+qdisc \
-+show \
-+dev \
-+virbr0 \
-+handle \
-+1:
-+tc \
-+qdisc \
-+add \
-+dev \
-+virbr0 \
-+root \
-+handle \
-+1: \
-+htb \
-+default \
-+2
-+tc \
-+filter \
-+add \
-+dev \
-+virbr0 \
-+prio \
-+2 \
-+protocol \
-+ip \
-+parent \
-+1: \
-+u32 \
-+match \
-+ip \
-+dport \
-+68 \
-+ffff \
-+action \
-+csum \
-+ip \
-+and \
-+udp
- nft \
- -ae insert \
- rule \
--- 
-2.47.1
-

0010-network-permit-forward-mode-open-when-a-network-has-.patch

@@ -1,51 +0,0 @@
-From 114c0ec656e879ab4d67919914bb24cf5993106d Mon Sep 17 00:00:00 2001
-Message-ID: <114c0ec656e879ab4d67919914bb24cf5993106d.1734201785.git.crobinso@redhat.com>
-From: Laine Stump <laine@redhat.com>
-Date: Mon, 2 Sep 2024 16:13:08 -0400
-Subject: [PATCH] network: permit <forward mode='open'/> when a network has no
- IP address
-Content-type: text/plain
-
-The whole point of <forward mode='open'/> is to supress libvirt from
-adding any firewall rules for a network, and someone might want to
-create a network with no IP address (i.e. they don't want the guests
-to have connectivity to the host via this interface) and no firewall
-rules (they don't want any, or they want to add their own). So there's
-no reason to fail when a network has <forward mode='open'/> and also
-has no IP address.
-
-Kind-of-Resolves: https://gitlab.com/libvirt/libvirt/-/issues/588
-Signed-off-by: Laine Stump <laine@redhat.com>
-Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- src/conf/network_conf.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c
-index 5cf419acf1..320e1b089a 100644
---- a/src/conf/network_conf.c
-+++ b/src/conf/network_conf.c
-@@ -1789,7 +1789,6 @@ virNetworkDefParseXML(xmlXPathContextPtr ctxt,
- 
-     case VIR_NETWORK_FORWARD_ROUTE:
-     case VIR_NETWORK_FORWARD_NAT:
--    case VIR_NETWORK_FORWARD_OPEN:
-         /* It's pointless to specify L3 forwarding without specifying
-          * the network we're on.
-          */
-@@ -1806,8 +1805,10 @@ virNetworkDefParseXML(xmlXPathContextPtr ctxt,
-                            def->name);
-             return NULL;
-         }
-+        break;
- 
--        if (def->forward.type == VIR_NETWORK_FORWARD_OPEN && def->forward.nifs) {
-+    case VIR_NETWORK_FORWARD_OPEN:
-+        if (def->forward.nifs) {
-             /* an open network by definition can't place any restrictions
-              * on what traffic is allowed or where it goes, so specifying
-              * a forwarding device is nonsensical.
--- 
-2.47.1
-

0011-qemu-snapshot-delete-disk-image-only-if-parent-snaps.patch

@@ -1,64 +0,0 @@
-From d51179fa82448f4720f1645f0b7100df80508cc4 Mon Sep 17 00:00:00 2001
-From: Pavel Hrdina <phrdina@redhat.com>
-Date: Thu, 9 Jan 2025 16:23:44 +0100
-Subject: [PATCH] qemu: snapshot: delete disk image only if parent snapshot is
- external
-Content-type: text/plain
-
-When we are deleting external snapshot that is not active we only need
-to delete overlay disk image of the parent snapshot. This works
-correctly even if parent snapshot is external and active as it will have
-another overlay created when user reverted to that snapshot.
-
-In case the parent snapshot is internal there are no overlay disk images
-created as everything is stored internally within the disk image. In
-this case we would delete the actual disk image storing internal
-snapshots and most likely the original disk image as well resulting in
-data loss once the VM is shutoff.
-
-Fixes: https://gitlab.com/libvirt/libvirt/-/issues/734
-Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
-Reviewed-by: Peter Krempa <pkrempa@redhat.com>
----
- src/qemu/qemu_snapshot.c | 14 ++++++++------
- 1 file changed, 8 insertions(+), 6 deletions(-)
-
-diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c
-index 18b2e478f6..80cd54bf33 100644
---- a/src/qemu/qemu_snapshot.c
-+++ b/src/qemu/qemu_snapshot.c
-@@ -3144,6 +3144,8 @@ qemuSnapshotDeleteExternalPrepareData(virDomainObj *vm,
-             return -1;
-         }
- 
-+        data->parentSnap = qemuSnapshotFindParentSnapForDisk(snap, data->snapDisk);
-+
-         if (data->merge) {
-             virStorageSource *snapDiskSrc = NULL;
- 
-@@ -3185,8 +3187,6 @@ qemuSnapshotDeleteExternalPrepareData(virDomainObj *vm,
-                 qemuSnapshotGetDisksWithBackingStore(vm, snap, data);
-             }
- 
--            data->parentSnap = qemuSnapshotFindParentSnapForDisk(snap, data->snapDisk);
--
-             if (data->parentSnap && !virDomainSnapshotIsExternal(data->parentSnap)) {
-                 virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s",
-                                _("deleting external snapshot that has internal snapshot as parent not supported"));
-@@ -3642,10 +3642,12 @@ qemuSnapshotDiscardExternal(virDomainObj *vm,
-             if (!data->job)
-                 goto error;
-         } else {
--            if (virStorageSourceInit(data->parentDomDisk->src) < 0 ||
--                virStorageSourceUnlink(data->parentDomDisk->src) < 0) {
--                VIR_WARN("Failed to remove snapshot image '%s'",
--                         data->snapDisk->name);
-+            if (data->parentSnap && virDomainSnapshotIsExternal(data->parentSnap)) {
-+                if (virStorageSourceInit(data->parentDomDisk->src) < 0 ||
-+                    virStorageSourceUnlink(data->parentDomDisk->src) < 0) {
-+                    VIR_WARN("Failed to remove snapshot image '%s'",
-+                             data->snapDisk->name);
-+                }
-             }
-         }
-     }

Makefile

@@ -0,0 +1,21 @@
+# Makefile for source rpm: libvirt
+# $Id$
+NAME := libvirt
+SPECFILE = $(firstword $(wildcard *.spec))
+
+define find-makefile-common
+for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
+endef
+
+MAKEFILE_COMMON := $(shell $(find-makefile-common))
+
+ifeq ($(MAKEFILE_COMMON),)
+# attempt a checkout
+define checkout-makefile-common
+test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
+endef
+
+MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
+endif
+
+include $(MAKEFILE_COMMON)

libvirt-add-default-spice-channel.patch

@@ -0,0 +1,180 @@
+From f3997733f0bca081d71848e66ca7d728b4c0a864 Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Tue, 8 May 2012 20:42:44 +0300
+Subject: [PATCH] domain_conf: add "default" to list of valid spice channels
+
+qemu's behavior in this case is to change the spice server behavior to
+require secure connection to any channel not otherwise specified as
+being in plaintext mode. libvirt doesn't currently allow requesting this
+(via plaintext-channel=<channel name>).
+
+RHBZ: 819499
+
+Signed-off-by: Alon Levy <alevy@redhat.com>
+(cherry picked from commit ba97e4edc6aa439a4f1e70855cf4503181efdb7f)
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ docs/formatdomain.html.in                          |    7 +++++++
+ docs/schemas/domaincommon.rng                      |    9 +++++++++
+ src/conf/domain_conf.c                             |   20 ++++++++++++++++++++
+ src/conf/domain_conf.h                             |    1 +
+ src/qemu/qemu_command.c                            |   13 +++++++++++++
+ .../qemuxml2argv-graphics-spice.args               |    2 +-
+ .../qemuxml2argv-graphics-spice.xml                |    2 +-
+ 7 files changed, 52 insertions(+), 2 deletions(-)
+
+diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
+index e33913f..4a70b0f 100644
+--- a/docs/formatdomain.html.in
++++ b/docs/formatdomain.html.in
+@@ -2913,6 +2913,13 @@ qemu-kvm -net nic,model=? /dev/null
+               <span class="since">Since 0.9.3</span>
+               NB, this may not be supported by all hypervisors.
+               <span class="since">"spice" since 0.8.6</span>.
++              The <code>defaultMode</code> attribute sets the default channel
++              security policy, valid values are <code>secure</code>,
++              <code>insecure</code> and the default <code>any</code>
++              (which is secure if possible, but falls back to insecure
++              rather than erroring out if no secure path is
++              available). <span class="since">"defaultMode" since
++              0.9.12</span>.
+             </p>
+             <p>
+               When SPICE has both a normal and TLS secured TCP port
+diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
+index 5bcf1b9..30ab4c6 100644
+--- a/docs/schemas/domaincommon.rng
++++ b/docs/schemas/domaincommon.rng
+@@ -1779,6 +1779,15 @@
+               </choice>
+             </attribute>
+           </optional>
++          <optional>
++            <attribute name="defaultMode">
++              <choice>
++                <value>any</value>
++                <value>secure</value>
++                <value>insecure</value>
++              </choice>
++            </attribute>
++          </optional>
+           <interleave>
+             <ref name="listenElements"/>
+             <zeroOrMore>
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index d017ea4..2b21b11 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -6069,6 +6069,8 @@ virDomainGraphicsDefParseXML(xmlNodePtr node,
+         char *port = virXMLPropString(node, "port");
+         char *tlsPort;
+         char *autoport;
++        char *defaultMode;
++        int defaultModeVal;
+ 
+         if (port) {
+             if (virStrToLong_i(port, NULL, 10, &def->data.spice.port) < 0) {
+@@ -6101,6 +6103,20 @@ virDomainGraphicsDefParseXML(xmlNodePtr node,
+             VIR_FREE(autoport);
+         }
+ 
++        def->data.spice.defaultMode = VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_ANY;
++
++        if ((defaultMode = virXMLPropString(node, "defaultMode")) != NULL) {
++            if ((defaultModeVal = virDomainGraphicsSpiceChannelModeTypeFromString(defaultMode)) < 0) {
++                virDomainReportError(VIR_ERR_INTERNAL_ERROR,
++                                     _("unknown default spice channel mode %s"),
++                                     defaultMode);
++                VIR_FREE(defaultMode);
++                goto error;
++            }
++            def->data.spice.defaultMode = defaultModeVal;
++            VIR_FREE(defaultMode);
++        }
++
+         if (def->data.spice.port == -1 && def->data.spice.tlsPort == -1) {
+             /* Legacy compat syntax, used -1 for auto-port */
+             def->data.spice.autoport = 1;
+@@ -12111,6 +12127,10 @@ virDomainGraphicsDefFormat(virBufferPtr buf,
+             virBufferEscapeString(buf, " keymap='%s'",
+                                   def->data.spice.keymap);
+ 
++        if (def->data.spice.defaultMode != VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_ANY)
++            virBufferAsprintf(buf, " defaultMode='%s'",
++              virDomainGraphicsSpiceChannelModeTypeToString(def->data.spice.defaultMode));
++
+         virDomainGraphicsAuthDefFormatAttr(buf, &def->data.spice.auth, flags);
+         break;
+ 
+diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
+index a2fea00..62eaafb 100644
+--- a/src/conf/domain_conf.h
++++ b/src/conf/domain_conf.h
+@@ -1233,6 +1233,7 @@ struct _virDomainGraphicsDef {
+             virDomainGraphicsAuthDef auth;
+             unsigned int autoport :1;
+             int channels[VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_LAST];
++            int defaultMode; /* enum virDomainGraphicsSpiceChannelMode */
+             int image;
+             int jpeg;
+             int zlib;
+diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
+index 55e772f..f411712 100644
+--- a/src/qemu/qemu_command.c
++++ b/src/qemu/qemu_command.c
+@@ -5499,6 +5499,7 @@ qemuBuildCommandLine(virConnectPtr conn,
+         const char *listenAddr = NULL;
+         char *netAddr = NULL;
+         int ret;
++        int defaultMode = def->graphics[0]->data.spice.defaultMode;
+ 
+         if (!qemuCapsGet(qemuCaps, QEMU_CAPS_SPICE)) {
+             qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+@@ -5582,6 +5583,18 @@ qemuBuildCommandLine(virConnectPtr conn,
+             virBufferAsprintf(&opt, ",x509-dir=%s",
+                               driver->spiceTLSx509certdir);
+ 
++        switch (defaultMode) {
++        case VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_SECURE:
++            virBufferAsprintf(&opt, ",tls-channel=default");
++            break;
++        case VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_INSECURE:
++            virBufferAsprintf(&opt, ",plaintext-channel=default");
++            break;
++        case VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_ANY:
++            /* nothing */
++            break;
++        }
++
+         for (i = 0 ; i < VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_LAST ; i++) {
+             int mode = def->graphics[0]->data.spice.channels[i];
+             switch (mode) {
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args
+index c9fdb99..698e39c 100644
+--- a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args
++++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args
+@@ -2,7 +2,7 @@ LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=spice \
+ /usr/bin/qemu -S -M pc -m 214 -smp 1 -nodefaults -monitor \
+ unix:/tmp/test-monitor,server,nowait -no-acpi -boot c -usb -hda \
+ /dev/HostVG/QEMUGuest1 -spice port=5903,tls-port=5904,addr=127.0.0.1,\
+-x509-dir=/etc/pki/libvirt-spice,tls-channel=main,plaintext-channel=inputs,\
++x509-dir=/etc/pki/libvirt-spice,tls-channel=default,tls-channel=main,plaintext-channel=inputs,\
+ image-compression=auto_glz,jpeg-wan-compression=auto,zlib-glz-wan-compression=auto,\
+ playback-compression=on,streaming-video=filter,disable-copy-paste -vga \
+ qxl -global qxl.vram_size=18874368 -device qxl,id=video1,vram_size=33554432,bus=pci.0,addr=0x4 \
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml
+index 8930b60..a3789f2 100644
+--- a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml
++++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml
+@@ -22,7 +22,7 @@
+     <controller type='usb' index='0'/>
+     <controller type='ide' index='0'/>
+     <input type='mouse' bus='ps2'/>
+-    <graphics type='spice' port='5903' tlsPort='5904' autoport='no' listen='127.0.0.1'>
++    <graphics type='spice' port='5903' tlsPort='5904' autoport='no' listen='127.0.0.1' defaultMode='secure'>
+       <listen type='address' address='127.0.0.1'/>
+       <channel name='main' mode='secure'/>
+       <channel name='inputs' mode='insecure'/>
+-- 
+1.7.7.6
+

libvirt-add-usbredir-spice-channel.patch

@@ -0,0 +1,182 @@
+From 3c3816ed226e766aa76624de7d159cdd1ee67913 Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Tue, 8 May 2012 16:00:28 +0300
+Subject: [PATCH] domain_conf: add "usbredir" to list of valid spice channels
+
+Add "usbredir" channel to list of recognized spice channels.
+
+RHBZ: 819498
+
+Signed-off-by: Alon Levy <alevy@redhat.com>
+(cherry picked from commit 4e78ffb63489071c4100678ed88d3111284555e8)
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ docs/formatdomain.html.in                          |    8 ++-
+ docs/schemas/domaincommon.rng                      |    1 +
+ src/conf/domain_conf.c                             |    3 +-
+ src/conf/domain_conf.h                             |    1 +
+ .../qemuxml2argv-graphics-spice-usb-redir.args     |   16 ++++++
+ .../qemuxml2argv-graphics-spice-usb-redir.xml      |   53 ++++++++++++++++++++
+ tests/qemuxml2argvtest.c                           |    6 ++
+ 7 files changed, 84 insertions(+), 4 deletions(-)
+ create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.args
+ create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml
+
+diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
+index 801e1ec..e33913f 100644
+--- a/docs/formatdomain.html.in
++++ b/docs/formatdomain.html.in
+@@ -2922,9 +2922,11 @@ qemu-kvm -net nic,model=? /dev/null
+               main &lt;graphics&gt; element. Valid channel names
+               include <code>main</code>, <code>display</code>,
+               <code>inputs</code>, <code>cursor</code>,
+-              <code>playback</code>, <code>record</code>;
+-              and <span class="since">since
+-              0.8.8</span>: <code>smartcard</code>.
++              <code>playback</code>, <code>record</code>
++              (all <span class="since"> since 0.8.6</span>);
++              <code>smartcard</code> (<span class="since">since
++              0.8.8</span>); and <code>usbredir</code>
++              (<span class="since">since 0.9.12</span>).
+             </p>
+             <pre>
+   &lt;graphics type='spice' port='-1' tlsPort='-1' autoport='yes'&gt;
+diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
+index 0cc04af..5bcf1b9 100644
+--- a/docs/schemas/domaincommon.rng
++++ b/docs/schemas/domaincommon.rng
+@@ -1792,6 +1792,7 @@
+                     <value>playback</value>
+                     <value>record</value>
+                     <value>smartcard</value>
++                    <value>usbredir</value>
+                   </choice>
+                 </attribute>
+                 <attribute name="mode">
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index d886b60..d017ea4 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -428,7 +428,8 @@ VIR_ENUM_IMPL(virDomainGraphicsSpiceChannelName,
+               "cursor",
+               "playback",
+               "record",
+-              "smartcard");
++              "smartcard",
++              "usbredir");
+ 
+ VIR_ENUM_IMPL(virDomainGraphicsSpiceChannelMode,
+               VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_LAST,
+diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
+index 1b8741e..a2fea00 100644
+--- a/src/conf/domain_conf.h
++++ b/src/conf/domain_conf.h
+@@ -1097,6 +1097,7 @@ enum virDomainGraphicsSpiceChannelName {
+     VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_PLAYBACK,
+     VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_RECORD,
+     VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_SMARTCARD,
++    VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_USBREDIR,
+ 
+     VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_LAST
+ };
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.args b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.args
+new file mode 100644
+index 0000000..35e51a7
+--- /dev/null
++++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.args
+@@ -0,0 +1,16 @@
++LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=spice /usr/bin/qemu -S -M pc -m 214 -smp 1 -nodefconfig -nodefaults -chardev socket,id=charmonitor,path=/tmp/test-monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=readline -no-acpi -boot c \
++-device ich9-usb-ehci1,id=usb,bus=pci.0,addr=0x4.0x7 \
++-device ich9-usb-uhci1,masterbus=usb.0,firstport=0,bus=pci.0,multifunction=on,addr=0x4 \
++-device ich9-usb-uhci2,masterbus=usb.0,firstport=2,bus=pci.0,addr=0x4.0x1 \
++-device ich9-usb-uhci3,masterbus=usb.0,firstport=4,bus=pci.0,addr=0x4.0x2 \
++-spice port=5903,tls-port=5904,addr=127.0.0.1,\
++x509-dir=/etc/pki/libvirt-spice,tls-channel=main,plaintext-channel=inputs,\
++tls-channel=usbredir,\
++image-compression=auto_glz,jpeg-wan-compression=auto,zlib-glz-wan-compression=auto,\
++playback-compression=on,streaming-video=filter,disable-copy-paste \
++-vga cirrus \
++-chardev socket,id=charredir0,host=localhost,port=4000 \
++-device usb-redir,chardev=charredir0,id=redir0 \
++-chardev spicevmc,id=charredir1,name=usbredir \
++-device usb-redir,chardev=charredir1,id=redir1,bus=usb.0,port=4 \
++-device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml
+new file mode 100644
+index 0000000..1dc23bd
+--- /dev/null
++++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml
+@@ -0,0 +1,53 @@
++<domain type='qemu'>
++  <name>QEMUGuest1</name>
++  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
++  <memory unit='KiB'>219136</memory>
++  <currentMemory unit='KiB'>219136</currentMemory>
++  <vcpu>1</vcpu>
++  <os>
++    <type arch='i686' machine='pc'>hvm</type>
++    <boot dev='hd'/>
++  </os>
++  <clock offset='utc'/>
++  <on_poweroff>destroy</on_poweroff>
++  <on_reboot>restart</on_reboot>
++  <on_crash>destroy</on_crash>
++  <devices>
++    <emulator>/usr/bin/qemu</emulator>
++    <graphics type='spice' port='5903' tlsPort='5904' autoport='no' listen='127.0.0.1'>
++      <listen type='address' address='127.0.0.1'/>
++      <channel name='main' mode='secure'/>
++      <channel name='inputs' mode='insecure'/>
++      <channel name='usbredir' mode='secure'/>
++      <image compression='auto_glz'/>
++      <jpeg compression='auto'/>
++      <zlib compression='auto'/>
++      <playback compression='on'/>
++      <streaming mode='filter'/>
++      <clipboard copypaste='no'/>
++    </graphics>
++    <controller type='usb' index='0' model='ich9-ehci1'>
++      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x7'/>
++    </controller>
++    <controller type='usb' index='0' model='ich9-uhci1'>
++      <master startport='0'/>
++      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0' multifunction='on'/>
++    </controller>
++    <controller type='usb' index='0' model='ich9-uhci2'>
++      <master startport='2'/>
++      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x1'/>
++    </controller>
++    <controller type='usb' index='0' model='ich9-uhci3'>
++      <master startport='4'/>
++      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x2'/>
++    </controller>
++    <redirdev bus='usb' type='tcp'>
++      <source mode='connect' host='localhost' service='4000'/>
++      <protocol type='raw'/>
++    </redirdev>
++    <redirdev bus='usb' type='spicevmc'>
++      <address type='usb' bus='0' port='4'/>
++    </redirdev>
++    <memballoon model='virtio'/>
++  </devices>
++</domain>
+diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
+index a32d4f8..b128c07 100644
+--- a/tests/qemuxml2argvtest.c
++++ b/tests/qemuxml2argvtest.c
+@@ -540,6 +540,12 @@ mymain(void)
+             QEMU_CAPS_VGA, QEMU_CAPS_VGA_QXL,
+             QEMU_CAPS_DEVICE, QEMU_CAPS_SPICE,
+             QEMU_CAPS_DEVICE_QXL_VGA);
++    DO_TEST("graphics-spice-usb-redir", false,
++            QEMU_CAPS_VGA, QEMU_CAPS_SPICE,
++            QEMU_CAPS_CHARDEV, QEMU_CAPS_DEVICE, QEMU_CAPS_NODEFCONFIG,
++            QEMU_CAPS_PCI_MULTIFUNCTION, QEMU_CAPS_USB_HUB,
++            QEMU_CAPS_ICH9_USB_EHCI1, QEMU_CAPS_USB_REDIR,
++            QEMU_CAPS_CHARDEV_SPICEVMC);
+ 
+     DO_TEST("input-usbmouse", false, NONE);
+     DO_TEST("input-usbtablet", false, NONE);
+-- 
+1.7.7.6
+

libvirt-lxc-selinux-context-error.patch

@@ -0,0 +1,22 @@
+--- libvirt-0.9.11.5.orig/src/lxc/lxc_container.c	2012-08-12 18:03:58.000000000 -0500
++++ libvirt-0.9.11.5.orig/src/lxc/lxc_container.c	2012-09-21 07:38:19.000000000 -0500
+@@ -506,7 +506,7 @@ 
+     if (pivotRoot) {
+ #if HAVE_SELINUX
+         if (getfilecon("/", &con) < 0 &&
+-            errno != ENOTSUP) {
++            errno != ENOTSUP && errno != ENODATA) {
+             virReportSystemError(errno, "%s",
+                                  _("Failed to query file context on /"));
+             goto cleanup;
+--- libvirt-0.9.11.5.orig/src/lxc/lxc_controller.c	2012-08-12 18:03:58.000000000 -0500
++++ libvirt-0.9.11.5.orig/src/lxc/lxc_controller.c	2012-09-21 07:20:41.000000000 -0500
+@@ -1480,7 +1480,7 @@ 
+ 
+ #if HAVE_SELINUX
+         if (getfilecon(root->src, &con) < 0 &&
+-            errno != ENOTSUP) {
++            errno != ENOTSUP && errno != ENODATA) {
+             virReportSystemError(errno,
+                                  _("Failed to query file context on %s"),
+                                  root->src);

libvirt-qemu-replace-deprecated-fedora-13-machine.patch

@@ -0,0 +1,155 @@
+From 7c96ce960b84ba19b9cc8e090615f54206e44ff0 Mon Sep 17 00:00:00 2001
+From: Laine Stump <laine@laine.org>
+Date: Tue, 6 Dec 2011 12:47:28 -0500
+Subject: [PATCH] qemu: replace deprecated fedora-13 machine type with pc-0.14
+
+This addresses https://bugzilla.redhat.com/show_bug.cgi?id=754772 .
+It should only be applied to Fedora builds of libvirt, F15 and
+later, so there is no upstream equivalent patch.
+
+Background:
+
+During the lifetime of Fedora 13, some features were backported into
+the F13 build of qemu-kvm from upstream. These features were part of
+the functionality of machine type "pc-0.13" in upstream qemu-kvm, so a
+special "fedora-13" machine type was created for the F13 qemu-kvm.
+Since "fedora-13" became the new "canonical machine type", all new
+domains created with F13 libvirt tools by default contained that
+machine type in their configuration file.
+
+In Fedora 14, a patch was made to qemu to treat the fedora-13 machine
+type as equivalent to "pc-0.13". When Fedora 15 was released, this was
+inadvertently changed to make it equivalent to "pc-0.14".
+
+With the release of Fedora 16, qemu-kvm initially removed support for
+this machine type, which caused failure of many guest configurations
+to start. qemu-kvm subsequently re-added the patch to support
+fedora-13 (as equivalent to pc-0.14), but with the promise that they
+could remove it with the release of Fedora 17. (see
+https://bugzilla.redhat.com/show_bug.cgi?id=748218 ).
+
+Solution:
+
+In order to create a repeat of the recent problems, prior to F17
+existing guest configurations need to be updated to change fedora-13
+to pc-0.14 (which has been determined to be equivalent for all
+practical purposes in both F15 and F16). That's what this patch does:
+
+1) Each time libvirtd is started, it calls virDomainLoadAllConfigs()
+which calls virDomainLoadConfig(); this function has been modified to
+check for os.machine == "fedora-13", and change it to "pc-0.14" then
+write the updated config back to disk.
+
+2) Also, any other time a domain definition is parsed, the parsed
+version in memory is changed to turn "fedora-13" into "pc-0.14". This
+handles domains that had been saved to disk prior to the upgrade, and
+are subsequently restarted.
+
+3) Finally, whenever a domain definition is formatted into a string,
+any occurrence of fedora-13 is replaced with pc-0.14 *directly in the
+virDomainDef* (to avoid multiple warning messages for the same object
+when it's formatted multiple times). This should deal with those cases
+where a domain was running at the time of upgrade, and is later
+saved/snapshotted.
+
+I had considered doing this with some sed commands in the specfile,
+but that wouldn't do anything to help the xml saved in image files.
+
+(Also, one of the xml tests was using the machine type "fedora-13",
+and since that machine type is treated specially by the rest of this
+patch, it was failing. That has been changed in a separate patch,
+which must be applied with this patch, and which *is* also upstream).
+---
+ src/conf/domain_conf.c |   62 +++++++++++++++++++++++++++++++++++++++++++++--
+ 1 files changed, 59 insertions(+), 3 deletions(-)
+
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index f8d0a4c..c79014b 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -8394,7 +8394,25 @@ virDomainDefPtr virDomainDefParseString(virCapsPtr caps,
+                                         unsigned int expectedVirtTypes,
+                                         unsigned int flags)
+ {
+-    return virDomainDefParse(xmlStr, NULL, caps, expectedVirtTypes, flags);
++    virDomainDefPtr def
++        = virDomainDefParse(xmlStr, NULL, caps, expectedVirtTypes, flags);
++
++    /* Fedora-specific HACK - treat fedora-13 and pc-0.14 as equivalent.
++     * This handles the case of domains that had been saved to an image file
++     * prior to upgrade (save or snapshot), then restarted/reverted.
++     */
++    if (def && STREQ_NULLABLE(def->os.machine, "fedora-13")) {
++        VIR_FREE(def->os.machine);
++        if (!(def->os.machine = strdup("pc-0.14"))) {
++            virReportOOMError();
++            virDomainDefFree(def);
++            def = NULL;
++        } else {
++            VIR_WARN("Replacing deprecated 'fedora-13' machine type "
++                     "with equivalent 'pc-0.14' in domain %s xml", def->name);
++        }
++   }
++    return def;
+ }
+ 
+ virDomainDefPtr virDomainDefParseFile(virCapsPtr caps,
+@@ -11737,8 +11755,30 @@ virDomainDefFormatInternal(virDomainDefPtr def,
+     virBufferAddLit(buf, "    <type");
+     if (def->os.arch)
+         virBufferAsprintf(buf, " arch='%s'", def->os.arch);
+-    if (def->os.machine)
+-        virBufferAsprintf(buf, " machine='%s'", def->os.machine);
++    if (def->os.machine) {
++        /* Fedora-specific HACK - replace "fedora-13" with "pc-0.14"
++         * (in the original DomainDef as well as in the xml output).
++         * This will catch XML being written to save/migration images
++         * of domains that were running when libvirtd was restarted at
++         * the time of upgrade.
++         */
++        if (STREQ_NULLABLE(def->os.machine, "fedora-13")) {
++            virBufferAddLit(buf, " machine='pc-0.14'");
++            VIR_WARN("substituting machine type 'fedora-13' with 'pc-0.14' "
++                     "in domain %s", def->name);
++            /* It's not exactly nice to modify the source object,
++             * but sometimes virDomainFormat is called > 100 times for the
++             * same object, which would result in far too many warning logs.
++             */
++            VIR_FREE(def->os.machine);
++            if (!(def->os.machine = strdup("pc-0.14"))) {
++                virReportOOMError();
++                goto cleanup;
++            }
++        } else {
++            virBufferAsprintf(buf, " machine='%s'", def->os.machine);
++        }
++    }
+     /*
+      * HACK: For xen driver we previously used bogus 'linux' as the
+      * os type for paravirt, whereas capabilities declare it to
+@@ -12149,6 +12189,22 @@ static virDomainObjPtr virDomainLoadConfig(virCapsPtr caps,
+                                       VIR_DOMAIN_XML_INACTIVE)))
+         goto error;
+ 
++    /* Fedora-specific HACK - replace "fedora-13" with "pc-0.14".
++     * This updates all config files at the first restart of libvirt
++     * after upgrade.
++     */
++    if (STREQ_NULLABLE(def->os.machine, "fedora-13")) {
++        VIR_FREE(def->os.machine);
++        if (!(def->os.machine = strdup("pc-0.14"))) {
++            virReportOOMError();
++            goto error;
++        }
++        VIR_WARN("Replacing deprecated 'fedora-13' machine type "
++                 "with equivalent 'pc-0.14' in domain %s configuration file", name);
++        if (virDomainSaveConfig(configDir, def) < 0)
++            goto error;
++    }
++
+     if ((autostartLink = virDomainConfigFile(autostartDir, name)) == NULL)
+         goto error;
+ 
+-- 
+1.7.7.6
+

libvirt-sanlock-readonly-option.patch

@@ -0,0 +1,218 @@
+commit b8012ce9312f00947c5ca7250a7a96534c85835f
+Author: David Weber <wb@munzinger.de>
+Date:   Mon May 14 09:53:02 2012 +0000
+
+    sanlock: fix locking for readonly devices
+    
+    Add ignore param for readonly and shared disk in sanlock
+
+diff --git a/src/locking/libvirt_sanlock.aug b/src/locking/libvirt_sanlock.aug
+index 5f5f8a1..d65b002 100644
+--- a/src/locking/libvirt_sanlock.aug
++++ b/src/locking/libvirt_sanlock.aug
+@@ -21,6 +21,7 @@ module Libvirt_sanlock =
+              | bool_entry "auto_disk_leases"
+              | int_entry "host_id"
+              | bool_entry "require_lease_for_disks"
++             | bool_entry "ignore_readonly_and_shared_disks"
+    let comment = [ label "#comment" . del /#[ \t]*/ "# " .  store /([^ \t\n][^\n]*)?/ . del /\n/ "\n" ]
+    let empty = [ label "#empty" . eol ]
+ 
+diff --git a/src/locking/lock_driver_sanlock.c b/src/locking/lock_driver_sanlock.c
+index d344d6a..146aefd 100644
+--- a/src/locking/lock_driver_sanlock.c
++++ b/src/locking/lock_driver_sanlock.c
+@@ -1,7 +1,7 @@
+ /*
+  * lock_driver_sanlock.c: A lock driver for Sanlock
+  *
+- * Copyright (C) 2010-2011 Red Hat, Inc.
++ * Copyright (C) 2010-2012 Red Hat, Inc.
+  *
+  * This library is free software; you can redistribute it and/or
+  * modify it under the terms of the GNU Lesser General Public
+@@ -65,6 +65,7 @@ struct _virLockManagerSanlockDriver {
+     bool requireLeaseForDisks;
+     int hostID;
+     bool autoDiskLease;
++    bool ignoreReadonlyShared;
+     char *autoDiskLeasePath;
+ };
+ 
+@@ -114,6 +115,10 @@ static int virLockManagerSanlockLoadConfig(const char *configFile)
+     CHECK_TYPE("auto_disk_leases", VIR_CONF_LONG);
+     if (p) driver->autoDiskLease = p->l;
+ 
++    p = virConfGetValue(conf, "ignore_readonly_and_shared_disks");
++    CHECK_TYPE("ignore_readonly_and_shared_disks", VIR_CONF_LONG);
++    if (p) driver->ignoreReadonlyShared = p->l;
++
+     p = virConfGetValue(conf, "disk_lease_dir");
+     CHECK_TYPE("disk_lease_dir", VIR_CONF_STRING);
+     if (p && p->str) {
+@@ -625,6 +630,12 @@ static int virLockManagerSanlockAddResource(virLockManagerPtr lock,
+         return -1;
+     }
+ 
++    if ((flags & (VIR_LOCK_MANAGER_RESOURCE_READONLY |
++                  VIR_LOCK_MANAGER_RESOURCE_SHARED)) &&
++        driver->ignoreReadonlyShared) {
++            return 0;
++    }
++
+     if (flags & VIR_LOCK_MANAGER_RESOURCE_READONLY) {
+         virLockError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                      _("Readonly leases are not supported"));
+diff --git a/src/locking/sanlock.conf b/src/locking/sanlock.conf
+index efc35ee..19ab2b3 100644
+--- a/src/locking/sanlock.conf
++++ b/src/locking/sanlock.conf
+@@ -52,3 +52,10 @@
+ # to enabled, otherwise it defaults to disabled.
+ #
+ #require_lease_for_disks = 1
++
++#
++# Enable this flag to have sanlock ignore readonly and shared disks.
++# If disabled, then this rejects attempts to share resources until
++# sanlock gains support for shared locks.
++#
++#ignore_readonly_and_shared_disks = 1
+commit acbd4965c44c4dbc676dfe89aff970052e376073
+Author: Daniel P. Berrange <berrange@redhat.com>
+Date:   Thu Jun 21 15:34:46 2012 +0100
+
+    Add support for shared sanlock leases
+    
+    A sanlock lease can be marked as shared (rather
+    than exclusive)  using SANLK_RES_SHARED flag. This
+    adds support for that flag and ensures that in auto
+    disk mode, any shared disks use shared leases. This
+    also makes any read-only disks be completely
+    ignored.
+    
+    These changes remove the need for the option
+    
+      ignore_readonly_and_shared_disks
+    
+    so that is removed
+    
+    Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
+
+diff --git a/src/locking/lock_driver_sanlock.c b/src/locking/lock_driver_sanlock.c
+index 146aefd..16941c9 100644
+--- a/src/locking/lock_driver_sanlock.c
++++ b/src/locking/lock_driver_sanlock.c
+@@ -65,7 +65,6 @@ struct _virLockManagerSanlockDriver {
+     bool requireLeaseForDisks;
+     int hostID;
+     bool autoDiskLease;
+-    bool ignoreReadonlyShared;
+     char *autoDiskLeasePath;
+ };
+ 
+@@ -115,10 +114,6 @@ static int virLockManagerSanlockLoadConfig(const char *configFile)
+     CHECK_TYPE("auto_disk_leases", VIR_CONF_LONG);
+     if (p) driver->autoDiskLease = p->l;
+ 
+-    p = virConfGetValue(conf, "ignore_readonly_and_shared_disks");
+-    CHECK_TYPE("ignore_readonly_and_shared_disks", VIR_CONF_LONG);
+-    if (p) driver->ignoreReadonlyShared = p->l;
+-
+     p = virConfGetValue(conf, "disk_lease_dir");
+     CHECK_TYPE("disk_lease_dir", VIR_CONF_STRING);
+     if (p && p->str) {
+@@ -428,7 +423,8 @@ static int virLockManagerSanlockDiskLeaseName(const char *path,
+ static int virLockManagerSanlockAddLease(virLockManagerPtr lock,
+                                          const char *name,
+                                          size_t nparams,
+-                                         virLockManagerParamPtr params)
++                                         virLockManagerParamPtr params,
++                                         bool shared)
+ {
+     virLockManagerSanlockPrivatePtr priv = lock->privateData;
+     int ret = -1;
+@@ -440,6 +436,7 @@ static int virLockManagerSanlockAddLease(virLockManagerPtr lock,
+         goto cleanup;
+     }
+ 
++    res->flags = shared ? SANLK_RES_SHARED : 0;
+     res->num_disks = 1;
+     if (!virStrcpy(res->name, name, SANLK_NAME_LEN)) {
+         virLockError(VIR_ERR_INTERNAL_ERROR,
+@@ -485,7 +482,8 @@ cleanup:
+ static int virLockManagerSanlockAddDisk(virLockManagerPtr lock,
+                                         const char *name,
+                                         size_t nparams,
+-                                        virLockManagerParamPtr params ATTRIBUTE_UNUSED)
++                                        virLockManagerParamPtr params ATTRIBUTE_UNUSED,
++                                        bool shared)
+ {
+     virLockManagerSanlockPrivatePtr priv = lock->privateData;
+     int ret = -1;
+@@ -503,6 +501,7 @@ static int virLockManagerSanlockAddDisk(virLockManagerPtr lock,
+         goto cleanup;
+     }
+ 
++    res->flags = shared ? SANLK_RES_SHARED : 0;
+     res->num_disks = 1;
+     if (virLockManagerSanlockDiskLeaseName(name, res->name, SANLK_NAME_LEN) < 0)
+         goto cleanup;
+@@ -630,27 +629,15 @@ static int virLockManagerSanlockAddResource(virLockManagerPtr lock,
+         return -1;
+     }
+ 
+-    if ((flags & (VIR_LOCK_MANAGER_RESOURCE_READONLY |
+-                  VIR_LOCK_MANAGER_RESOURCE_SHARED)) &&
+-        driver->ignoreReadonlyShared) {
+-            return 0;
+-    }
+-
+-    if (flags & VIR_LOCK_MANAGER_RESOURCE_READONLY) {
+-        virLockError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+-                     _("Readonly leases are not supported"));
+-        return -1;
+-    }
+-    if (flags & VIR_LOCK_MANAGER_RESOURCE_SHARED) {
+-        virLockError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+-                     _("Shareable leases are not supported"));
+-        return -1;
+-    }
++    /* Treat R/O resources as a no-op lock request */
++    if (flags & VIR_LOCK_MANAGER_RESOURCE_READONLY)
++        return 0;
+ 
+     switch (type) {
+     case VIR_LOCK_MANAGER_RESOURCE_TYPE_DISK:
+         if (driver->autoDiskLease) {
+-            if (virLockManagerSanlockAddDisk(lock, name, nparams, params) < 0)
++            if (virLockManagerSanlockAddDisk(lock, name, nparams, params,
++                                             !!(flags & VIR_LOCK_MANAGER_RESOURCE_SHARED)) < 0)
+                 return -1;
+ 
+             if (virLockManagerSanlockCreateLease(priv->res_args[priv->res_count-1]) < 0)
+@@ -664,7 +651,8 @@ static int virLockManagerSanlockAddResource(virLockManagerPtr lock,
+         break;
+ 
+     case VIR_LOCK_MANAGER_RESOURCE_TYPE_LEASE:
+-        if (virLockManagerSanlockAddLease(lock, name, nparams, params) < 0)
++        if (virLockManagerSanlockAddLease(lock, name, nparams, params,
++                                          !!(flags & VIR_LOCK_MANAGER_RESOURCE_SHARED)) < 0)
+             return -1;
+         break;
+ 
+diff --git a/src/locking/sanlock.conf b/src/locking/sanlock.conf
+index 19ab2b3..efc35ee 100644
+--- a/src/locking/sanlock.conf
++++ b/src/locking/sanlock.conf
+@@ -52,10 +52,3 @@
+ # to enabled, otherwise it defaults to disabled.
+ #
+ #require_lease_for_disks = 1
+-
+-#
+-# Enable this flag to have sanlock ignore readonly and shared disks.
+-# If disabled, then this rejects attempts to share resources until
+-# sanlock gains support for shared locks.
+-#
+-#ignore_readonly_and_shared_disks = 1

sources

@@ -1 +1 @@
-SHA512 (libvirt-10.6.0.tar.xz) = edec79e89669d5e9a46be35e0d6334a6ed3bbf32426679549bd998bde24cba52b0378843f41a3abb5d781ad53e2a6a54619a0bad3f168c11fb41736cc6af6568
+2d4eafc04fe52a8503acb6d42888a618  libvirt-0.9.11.10.tar.gz