Rebased to version 0.9.6.4

CVE-2013-0170 libvirt: use-after-free in virNetMessageFree() (bz #893450, bz #905173)

.cvsignore

@@ -1,18 +0,0 @@
-.build*.log
-*.rpm
-i686
-x86_64
-libvirt-*.tar.gz
-libvirt-0.6.0.tar.gz
-libvirt-0.6.1.tar.gz
-libvirt-0.6.2.tar.gz
-libvirt-0.6.3.tar.gz
-libvirt-0.6.4.tar.gz
-libvirt-0.6.5.tar.gz
-libvirt-0.7.0.tar.gz
-libvirt-0.7.1.tar.gz
-libvirt-0.7.2.tar.gz
-libvirt-0.7.3.tar.gz
-libvirt-0.7.4.tar.gz
-libvirt-0.7.5.tar.gz
-libvirt-0.7.6.tar.gz

.gitignore

@@ -0,0 +1,8 @@
+.build*.log
+*.rpm
+i686
+x86_64
+libvirt-*.tar.gz
+/libvirt-0.8.4.tar.gz
+/libvirt-0.8.5.tar.gz
+/libvirt-0.8.7.tar.gz

branch

@@ -1 +0,0 @@
-F-13

libvirt-0.7.7-fix-cdrom-change.patch

@@ -1,132 +0,0 @@
-commit c4896d378b921ba6471562d7b17641be121c19d6
-Author: Daniel P. Berrange <berrange@redhat.com>
-Date:   Thu Apr 15 11:35:07 2010 +0100
-
-    Fix CDROM media change for QEMU when using -device syntax
-    
-    Disk devices in QEMU have two parts, the guest device and the host
-    backend driver. Historically these two parts have had the same
-    "unique" name. With the switch to using -device though, they now
-    have separate names. Thus when changing CDROM media, for guests
-    using -device syntax, we need to prepend the QEMU_DRIVE_HOST_PREFIX
-    constant
-    
-    * src/qemu/qemu_conf.c, src/qemu/qemu_conf.h: Add helper function
-      qemuDeviceDriveHostAlias() for building a host backend alias
-    * src/qemu/qemu_driver.c: Use qemuDeviceDriveHostAlias() to determine
-      the host backend alias for performing eject/change commands in the
-      monitor
-
-diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c
-index 1a8b4aa..0cbedf2 100644
---- a/src/qemu/qemu_conf.c
-+++ b/src/qemu/qemu_conf.c
-@@ -1699,6 +1699,26 @@ static int qemuAssignDeviceDiskAliasLegacy(virDomainDiskDefPtr disk)
- }
- 
- 
-+char *qemuDeviceDriveHostAlias(virDomainDiskDefPtr disk,
-+                               unsigned long long qemudCmdFlags)
-+{
-+    char *ret;
-+
-+    if (qemudCmdFlags & QEMUD_CMD_FLAG_DEVICE) {
-+        if (virAsprintf(&ret, "%s%s", QEMU_DRIVE_HOST_PREFIX, disk->info.alias) < 0) {
-+            virReportOOMError();
-+            return NULL;
-+        }
-+    } else {
-+        if (!(ret = strdup(disk->info.alias))) {
-+            virReportOOMError();
-+            return NULL;
-+        }
-+    }
-+    return ret;
-+}
-+
-+
- /* Names used before -drive supported the id= option */
- static int qemuAssignDeviceDiskAliasFixed(virDomainDiskDefPtr disk)
- {
-diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h
-index 574709e..b2820f0 100644
---- a/src/qemu/qemu_conf.h
-+++ b/src/qemu/qemu_conf.h
-@@ -220,6 +220,9 @@ char * qemuBuildNicStr(virDomainNetDefPtr net,
- char * qemuBuildNicDevStr(virDomainNetDefPtr net,
-                           int vlan);
- 
-+char *qemuDeviceDriveHostAlias(virDomainDiskDefPtr disk,
-+                               unsigned long long qemudCmdFlags);
-+
- /* Both legacy & current support */
- char *qemuBuildDriveStr(virDomainDiskDefPtr disk,
-                         int bootable,
-diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
-index 0189dcf..7d2f3ef 100644
---- a/src/qemu/qemu_driver.c
-+++ b/src/qemu/qemu_driver.c
-@@ -6552,11 +6552,13 @@ cleanup:
- 
- static int qemudDomainChangeEjectableMedia(struct qemud_driver *driver,
-                                            virDomainObjPtr vm,
--                                           virDomainDiskDefPtr disk)
-+                                           virDomainDiskDefPtr disk,
-+                                           unsigned long long qemuCmdFlags)
- {
-     virDomainDiskDefPtr origdisk = NULL;
-     int i;
-     int ret;
-+    char *driveAlias = NULL;
- 
-     origdisk = NULL;
-     for (i = 0 ; i < vm->def->ndisks ; i++) {
-@@ -6594,6 +6596,9 @@ static int qemudDomainChangeEjectableMedia(struct qemud_driver *driver,
-         driver->securityDriver->domainSetSecurityImageLabel(vm, disk) < 0)
-         return -1;
- 
-+    if (!(driveAlias = qemuDeviceDriveHostAlias(origdisk, qemuCmdFlags)))
-+        goto error;
-+
-     qemuDomainObjPrivatePtr priv = vm->privateData;
-     qemuDomainObjEnterMonitorWithDriver(driver, vm);
-     if (disk->src) {
-@@ -6605,10 +6610,10 @@ static int qemudDomainChangeEjectableMedia(struct qemud_driver *driver,
-                 format = origdisk->driverType;
-         }
-         ret = qemuMonitorChangeMedia(priv->mon,
--                                     origdisk->info.alias,
-+                                     driveAlias,
-                                      disk->src, format);
-     } else {
--        ret = qemuMonitorEjectMedia(priv->mon, origdisk->info.alias);
-+        ret = qemuMonitorEjectMedia(priv->mon, driveAlias);
-     }
-     qemuDomainObjExitMonitorWithDriver(driver, vm);
- 
-@@ -6625,11 +6630,14 @@ static int qemudDomainChangeEjectableMedia(struct qemud_driver *driver,
-     disk->src = NULL;
-     origdisk->type = disk->type;
- 
-+    VIR_FREE(driveAlias);
-+
-     virDomainDiskDefFree(disk);
- 
-     return ret;
- 
- error:
-+    VIR_FREE(driveAlias);
-     if (driver->securityDriver &&
-         driver->securityDriver->domainRestoreSecurityImageLabel &&
-         driver->securityDriver->domainRestoreSecurityImageLabel(vm, disk) < 0)
-@@ -7434,7 +7442,9 @@ static int qemudDomainAttachDevice(virDomainPtr dom,
-         switch (dev->data.disk->device) {
-         case VIR_DOMAIN_DISK_DEVICE_CDROM:
-         case VIR_DOMAIN_DISK_DEVICE_FLOPPY:
--            ret = qemudDomainChangeEjectableMedia(driver, vm, dev->data.disk);
-+            ret = qemudDomainChangeEjectableMedia(driver, vm,
-+                                                  dev->data.disk,
-+                                                  qemuCmdFlags);
-             if (ret == 0)
-                 dev->data.disk = NULL;
-             break;

libvirt-0.7.7-fix-slow-dsync.patch

@@ -1,41 +0,0 @@
-From e3c36a2575bc88a16d776693dc39ea01c780b406 Mon Sep 17 00:00:00 2001
-From: Jiri Denemark <jdenemar@redhat.com>
-Date: Tue, 16 Mar 2010 16:03:59 +0100
-Subject: [PATCH] Use fsync() at the end of file allocation instead of O_DSYNC
-
-Instead of opening storage file with O_DSYNC, make sure data are written
-to a disk only before we claim allocation has finished.
----
- src/storage/storage_backend.c |    9 ++++++++-
- 1 files changed, 8 insertions(+), 1 deletions(-)
-
-diff --git a/src/storage/storage_backend.c b/src/storage/storage_backend.c
-index ec9fc43..7294a00 100644
---- a/src/storage/storage_backend.c
-+++ b/src/storage/storage_backend.c
-@@ -331,6 +331,13 @@ static int createRawFileOpHook(int fd, void *data) {
-                 goto cleanup;
-             }
-         }
-+
-+        if (fsync(fd) < 0) {
-+            ret = errno;
-+            virReportSystemError(errno, _("cannot sync data to file '%s'"),
-+                                 hdata->vol->target.path);
-+            goto cleanup;
-+        }
-     }
- 
- cleanup:
-@@ -359,7 +366,7 @@ virStorageBackendCreateRaw(virConnectPtr conn ATTRIBUTE_UNUSED,
-     gid_t gid = (vol->target.perms.gid == -1) ? getgid() : vol->target.perms.gid;
- 
-     if ((createstat = virFileOperation(vol->target.path,
--                                       O_RDWR | O_CREAT | O_EXCL | O_DSYNC,
-+                                       O_RDWR | O_CREAT | O_EXCL,
-                                        vol->target.perms.mode, uid, gid,
-                                        createRawFileOpHook, &hdata,
-                                        VIR_FILE_OP_FORCE_PERMS |
--- 
-1.6.6.1
-

libvirt-0.7.7-fix-usb-product.patch

@@ -1,233 +0,0 @@
-From 3a441522017aa9c1b8b54d2ce4569d0f0d96fa72 Mon Sep 17 00:00:00 2001
-From: Cole Robinson <crobinso@redhat.com>
-Date: Fri, 12 Mar 2010 12:36:56 -0500
-Subject: [PATCH] qemu: Add some debugging at domain startup
-
----
- src/qemu/qemu_driver.c |   24 +++++++++++++++++++++++-
- 1 files changed, 23 insertions(+), 1 deletions(-)
-
-diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
-index f8ab545..040d645 100644
---- a/src/qemu/qemu_driver.c
-+++ b/src/qemu/qemu_driver.c
-@@ -2695,6 +2695,8 @@ static int qemudStartVMDaemon(virConnectPtr conn,
- 
-     FD_ZERO(&keepfd);
- 
-+    DEBUG0("Beginning VM startup process");
-+
-     if (virDomainObjIsActive(vm)) {
-         qemuReportError(VIR_ERR_OPERATION_INVALID,
-                         "%s", _("VM is already active"));
-@@ -2703,22 +2705,27 @@ static int qemudStartVMDaemon(virConnectPtr conn,
- 
-     /* If you are using a SecurityDriver with dynamic labelling,
-        then generate a security label for isolation */
-+    DEBUG0("Generating domain security label (if required)");
-     if (driver->securityDriver &&
-         driver->securityDriver->domainGenSecurityLabel &&
-         driver->securityDriver->domainGenSecurityLabel(vm) < 0)
-         return -1;
- 
-+    DEBUG0("Generating setting domain security labels (if required)");
-     if (driver->securityDriver &&
-         driver->securityDriver->domainSetSecurityAllLabel &&
-         driver->securityDriver->domainSetSecurityAllLabel(vm) < 0)
-         goto cleanup;
- 
--    /* Ensure no historical cgroup for this VM is lieing around bogus settings */
-+    /* Ensure no historical cgroup for this VM is lying around bogus
-+     * settings */
-+    DEBUG0("Ensuring no historical cgroup is lying around");
-     qemuRemoveCgroup(driver, vm, 1);
- 
-     if ((vm->def->ngraphics == 1) &&
-         vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC &&
-         vm->def->graphics[0]->data.vnc.autoport) {
-+        DEBUG0("Determining VNC port");
-         int port = qemudNextFreeVNCPort(driver);
-         if (port < 0) {
-             qemuReportError(VIR_ERR_INTERNAL_ERROR,
-@@ -2735,6 +2742,7 @@ static int qemudStartVMDaemon(virConnectPtr conn,
-         goto cleanup;
-     }
- 
-+    DEBUG0("Creating domain log file");
-     if ((logfile = qemudLogFD(driver, vm->def->name)) < 0)
-         goto cleanup;
- 
-@@ -2751,14 +2759,17 @@ static int qemudStartVMDaemon(virConnectPtr conn,
-         goto cleanup;
-     }
- 
-+    DEBUG0("Determing emulator version");
-     if (qemudExtractVersionInfo(emulator,
-                                 NULL,
-                                 &qemuCmdFlags) < 0)
-         goto cleanup;
- 
-+    DEBUG0("Setting up domain cgroup (if required)");
-     if (qemuSetupCgroup(driver, vm) < 0)
-         goto cleanup;
- 
-+    DEBUG0("Preparing host devices");
-     if (qemuPrepareHostDevices(driver, vm->def) < 0)
-         goto cleanup;
- 
-@@ -2767,6 +2778,7 @@ static int qemudStartVMDaemon(virConnectPtr conn,
-         goto cleanup;
-     }
- 
-+    DEBUG0("Preparing monitor state");
-     if (qemuPrepareMonitorChr(driver, priv->monConfig, vm->def->name) < 0)
-         goto cleanup;
- 
-@@ -2798,6 +2810,7 @@ static int qemudStartVMDaemon(virConnectPtr conn,
-      * use in hotplug
-      */
-     if (qemuCmdFlags & QEMUD_CMD_FLAG_DEVICE) {
-+        DEBUG0("Assigning domain PCI addresses");
-         /* Populate cache with current addresses */
-         if (priv->pciaddrs) {
-             qemuDomainPCIAddressSetFree(priv->pciaddrs);
-@@ -2816,6 +2829,7 @@ static int qemudStartVMDaemon(virConnectPtr conn,
-         priv->persistentAddrs = 0;
-     }
- 
-+    DEBUG0("Building emulator command line");
-     vm->def->id = driver->nextvmid++;
-     if (qemudBuildCommandLine(conn, driver, vm->def, priv->monConfig,
-                               priv->monJSON, qemuCmdFlags, &argv, &progenv,
-@@ -2899,25 +2913,31 @@ static int qemudStartVMDaemon(virConnectPtr conn,
-     if (ret == -1) /* The VM failed to start */
-         goto cleanup;
- 
-+    DEBUG0("Waiting for monitor to show up");
-     if (qemudWaitForMonitor(driver, vm, pos) < 0)
-         goto abort;
- 
-+    DEBUG0("Detecting VCPU PIDs");
-     if (qemuDetectVcpuPIDs(driver, vm) < 0)
-         goto abort;
- 
-+    DEBUG0("Setting CPU affinity");
-     if (qemudInitCpuAffinity(vm) < 0)
-         goto abort;
- 
-+    DEBUG0("Setting any required VM passwords");
-     if (qemuInitPasswords(conn, driver, vm, qemuCmdFlags) < 0)
-         goto abort;
- 
-     /* If we have -device, then addresses are assigned explicitly.
-      * If not, then we have to detect dynamic ones here */
-     if (!(qemuCmdFlags & QEMUD_CMD_FLAG_DEVICE)) {
-+        DEBUG0("Determining domain device PCI addresses");
-         if (qemuInitPCIAddresses(driver, vm) < 0)
-             goto abort;
-     }
- 
-+    DEBUG0("Setting initial memory amount");
-     qemuDomainObjEnterMonitorWithDriver(driver, vm);
-     if (qemuMonitorSetBalloon(priv->mon, vm->def->memory) < 0) {
-         qemuDomainObjExitMonitorWithDriver(driver, vm);
-@@ -2925,6 +2945,7 @@ static int qemudStartVMDaemon(virConnectPtr conn,
-     }
- 
-     if (migrateFrom == NULL) {
-+        DEBUG0("Starting domain CPUs");
-         /* Allow the CPUS to start executing */
-         if (qemuMonitorStartCPUs(priv->mon, conn) < 0) {
-             if (virGetLastError() == NULL)
-@@ -2937,6 +2958,7 @@ static int qemudStartVMDaemon(virConnectPtr conn,
-     qemuDomainObjExitMonitorWithDriver(driver, vm);
- 
- 
-+    DEBUG0("Writing domain status to disk");
-     if (virDomainSaveStatus(driver->caps, driver->stateDir, vm) < 0)
-         goto abort;
- 
--- 
-1.6.6.1
-
-From 6d5c8a8f51db8ce97ab35ab6022dd5c94ab016b4 Mon Sep 17 00:00:00 2001
-From: Cole Robinson <crobinso@redhat.com>
-Date: Fri, 12 Mar 2010 12:37:52 -0500
-Subject: [PATCH] qemu: Fix USB by product with security enabled
-
-We need to call PrepareHostdevs to determine the USB device path before
-any security calls. PrepareHostUSBDevices was also incorrectly skipping
-all USB devices.
----
- src/qemu/qemu_driver.c |   11 ++++++-----
- 1 files changed, 6 insertions(+), 5 deletions(-)
-
-diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
-index 040d645..b17d26d 100644
---- a/src/qemu/qemu_driver.c
-+++ b/src/qemu/qemu_driver.c
-@@ -2360,7 +2360,7 @@ qemuPrepareHostUSBDevices(struct qemud_driver *driver ATTRIBUTE_UNUSED,
- 
-         if (hostdev->mode != VIR_DOMAIN_HOSTDEV_MODE_SUBSYS)
-             continue;
--        if (hostdev->source.subsys.type != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_PCI)
-+        if (hostdev->source.subsys.type != VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB)
-             continue;
- 
-         /* Resolve a vendor/product to bus/device */
-@@ -2703,6 +2703,11 @@ static int qemudStartVMDaemon(virConnectPtr conn,
-         return -1;
-     }
- 
-+    /* Must be run before security labelling */
-+    DEBUG0("Preparing host devices");
-+    if (qemuPrepareHostDevices(driver, vm->def) < 0)
-+        goto cleanup;
-+
-     /* If you are using a SecurityDriver with dynamic labelling,
-        then generate a security label for isolation */
-     DEBUG0("Generating domain security label (if required)");
-@@ -2769,10 +2774,6 @@ static int qemudStartVMDaemon(virConnectPtr conn,
-     if (qemuSetupCgroup(driver, vm) < 0)
-         goto cleanup;
- 
--    DEBUG0("Preparing host devices");
--    if (qemuPrepareHostDevices(driver, vm->def) < 0)
--        goto cleanup;
--
-     if (VIR_ALLOC(priv->monConfig) < 0) {
-         virReportOOMError();
-         goto cleanup;
--- 
-1.6.6.1
-
-From 65e97240e6e4606820dd1c42ac172319e0af4d8d Mon Sep 17 00:00:00 2001
-From: Cole Robinson <crobinso@redhat.com>
-Date: Mon, 22 Mar 2010 10:45:36 -0400
-Subject: [PATCH] security: selinux: Fix crash when releasing non-existent label
-
-This can be triggered by the qemuStartVMDaemon cleanup path if a
-VM references a non-existent USB device (by product) in the XML.
-
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- src/security/security_selinux.c |    3 ++-
- 1 files changed, 2 insertions(+), 1 deletions(-)
-
-diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
-index 975b315..6680e2d 100644
---- a/src/security/security_selinux.c
-+++ b/src/security/security_selinux.c
-@@ -632,7 +632,8 @@ SELinuxReleaseSecurityLabel(virDomainObjPtr vm)
- {
-     const virSecurityLabelDefPtr secdef = &vm->def->seclabel;
- 
--    if (secdef->type == VIR_DOMAIN_SECLABEL_STATIC)
-+    if (secdef->type == VIR_DOMAIN_SECLABEL_STATIC ||
-+        secdef->label == NULL)
-         return 0;
- 
-     context_t con = context_new(secdef->label);
--- 
-1.6.6.1
-

libvirt-0.7.7-no-secdriver-crash.patch

@@ -1,26 +0,0 @@
-commit b7a7b3365145f6e9e434a3265a58666cd2e6d8dd
-Author: Guido Günther <agx@sigxcpu.org>
-Date:   Wed Mar 17 21:04:11 2010 +0100
-
-    Don't crash without a security driver
-    
-    "virsh dominfo <vm>" crashes if there's no primary security driver set
-    since we only intialize the secmodel.model and secmodel.doi if we have
-    one. Attached patch checks for securityPrimaryDriver instead of
-    securityDriver since the later is always set in qemudSecurityInit().
-    
-    Closes: http://bugs.debian.org/574359
-
-diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
-index 1f2b11d..257f914 100644
---- a/src/qemu/qemu_driver.c
-+++ b/src/qemu/qemu_driver.c
-@@ -4979,7 +4979,7 @@ static int qemudNodeGetSecurityModel(virConnectPtr conn,
-     int ret = 0;
- 
-     qemuDriverLock(driver);
--    if (!driver->securityDriver) {
-+    if (!driver->securityPrimaryDriver) {
-         memset(secmodel, 0, sizeof (*secmodel));
-         goto cleanup;
-     }

libvirt-0.7.7-nodedev-conversions.patch

@@ -1,77 +0,0 @@
-commit 74c7a3463d18a530d6d749d0199061b5d3f17faa
-Author: Cole Robinson <crobinso@redhat.com>
-Date:   Tue May 11 14:44:34 2010 -0400
-
-    node_device: udev: Fix PCI product/vendor swappage
-    
-    Product and vendor values were swapped in the XML, which made virt-manager
-    PCI device listing kinda useless.
-
-diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c
-index bcfe991..4a9d65f 100644
---- a/src/node_device/node_device_udev.c
-+++ b/src/node_device/node_device_udev.c
-@@ -382,8 +382,8 @@ static int udevTranslatePCIIds(unsigned int vendor,
- 
-     /* pci_get_strings returns void */
-     pci_get_strings(&m,
--                    &vendor_name,
-                     &device_name,
-+                    &vendor_name,
-                     NULL,
-                     NULL);
- 
-commit 75d88455f54088f88bc7a503da0a4cd413ef7b95
-Author: Klaus Ethgen <Klaus@Ethgen.de>
-Date:   Tue Apr 27 09:20:47 2010 +0200
-
-    The base used for conversion of USB values should be 16 not 10.
-    
-    Signed-off-by: Guido Günther <agx@sigxcpu.org>
-
-diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c
-index b12a49e..3a5a7e2 100644
---- a/src/node_device/node_device_udev.c
-+++ b/src/node_device/node_device_udev.c
-@@ -548,8 +548,6 @@ out:
- }
- 
- 
--/* XXX Is 10 the correct base for the Number/Class/SubClass/Protocol
-- * conversions?  */
- static int udevProcessUSBInterface(struct udev_device *device,
-                                    virNodeDeviceDefPtr def)
- {
-@@ -559,28 +557,28 @@ static int udevProcessUSBInterface(struct udev_device *device,
-     if (udevGetUintSysfsAttr(device,
-                              "bInterfaceNumber",
-                              &data->usb_if.number,
--                             10) == PROPERTY_ERROR) {
-+                             16) == PROPERTY_ERROR) {
-         goto out;
-     }
- 
-     if (udevGetUintSysfsAttr(device,
-                              "bInterfaceClass",
-                              &data->usb_if._class,
--                             10) == PROPERTY_ERROR) {
-+                             16) == PROPERTY_ERROR) {
-         goto out;
-     }
- 
-     if (udevGetUintSysfsAttr(device,
-                              "bInterfaceSubClass",
-                              &data->usb_if.subclass,
--                             10) == PROPERTY_ERROR) {
-+                             16) == PROPERTY_ERROR) {
-         goto out;
-     }
- 
-     if (udevGetUintSysfsAttr(device,
-                              "bInterfaceProtocol",
-                              &data->usb_if.protocol,
--                             10) == PROPERTY_ERROR) {
-+                             16) == PROPERTY_ERROR) {
-         goto out;
-     }
- 

libvirt-0.7.7-pci-decimal-parsing.patch

@@ -1,50 +0,0 @@
-commit e984019688509605966c03cd77f4591d2cc222d3
-Author: Cole Robinson <crobinso@redhat.com>
-Date:   Fri Apr 30 18:14:35 2010 +0200
-
-    domain: Fix PCI address decimal parsing regression
-    
-    <hostdev> address parsing previously attempted to detect the number
-    base: currently it is hardcoded to base 16, which can break PCI
-    assignment via virt-manager. Revert to the previous behavior.
-    
-    * src/conf/domain_conf.c: virDomainDevicePCIAddressParseXML, switch to
-      virStrToLong_ui(bus, NULL, 0, ...) to autodetect base
-
-diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
-index 1607e8b..546ddf2 100644
---- a/src/conf/domain_conf.c
-+++ b/src/conf/domain_conf.c
-@@ -1079,28 +1079,28 @@ virDomainDevicePCIAddressParseXML(xmlNodePtr node,
-     function = virXMLPropString(node, "function");
- 
-     if (domain &&
--        virStrToLong_ui(domain, NULL, 16, &addr->domain) < 0) {
-+        virStrToLong_ui(domain, NULL, 0, &addr->domain) < 0) {
-         virDomainReportError(VIR_ERR_INTERNAL_ERROR, "%s",
-                              _("Cannot parse <address> 'domain' attribute"));
-         goto cleanup;
-     }
- 
-     if (bus &&
--        virStrToLong_ui(bus, NULL, 16, &addr->bus) < 0) {
-+        virStrToLong_ui(bus, NULL, 0, &addr->bus) < 0) {
-         virDomainReportError(VIR_ERR_INTERNAL_ERROR, "%s",
-                              _("Cannot parse <address> 'bus' attribute"));
-         goto cleanup;
-     }
- 
-     if (slot &&
--        virStrToLong_ui(slot, NULL, 16, &addr->slot) < 0) {
-+        virStrToLong_ui(slot, NULL, 0, &addr->slot) < 0) {
-         virDomainReportError(VIR_ERR_INTERNAL_ERROR, "%s",
-                              _("Cannot parse <address> 'slot' attribute"));
-         goto cleanup;
-     }
- 
-     if (function &&
--        virStrToLong_ui(function, NULL, 16, &addr->function) < 0) {
-+        virStrToLong_ui(function, NULL, 0, &addr->function) < 0) {
-         virDomainReportError(VIR_ERR_INTERNAL_ERROR, "%s",
-                              _("Cannot parse <address> 'function' attribute"));
-         goto cleanup;

libvirt-0.7.7-qemu-startup-output.patch

@@ -1,108 +0,0 @@
-commit 83be64034a0b530c904ceb4fd1ed1c10b5cdf4bf
-Author: Cole Robinson <crobinso@redhat.com>
-Date:   Mon May 17 10:15:53 2010 -0400
-
-    qemu: Report cmdline output if VM dies early
-    
-    qemuReadLogOutput early VM death detection is racy and won't always work.
-    Startup then errors when connecting to the VM monitor. This won't report
-    the emulator cmdline output which is typically the most useful diagnostic.
-    
-    Check if the VM has died at the very end of the monitor connection step,
-    and if so, report the cmdline output.
-    
-    See also: https://bugzilla.redhat.com/show_bug.cgi?id=581381
-
-diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
-index ab6bec8..582fdee 100644
---- a/src/qemu/qemu_driver.c
-+++ b/src/qemu/qemu_driver.c
-@@ -2034,39 +2034,47 @@ static void qemudFreePtyPath(void *payload, const char *name ATTRIBUTE_UNUSED)
-     VIR_FREE(payload);
- }
- 
-+static void
-+qemuReadLogFD(int logfd, char *buf, int maxlen, int off)
-+{
-+    int ret;
-+    char *tmpbuf = buf + off;
-+
-+    ret = saferead(logfd, tmpbuf, maxlen - off - 1);
-+    if (ret < 0) {
-+        ret = 0;
-+    }
-+
-+    tmpbuf[ret] = '\0';
-+}
-+
- static int
- qemudWaitForMonitor(struct qemud_driver* driver,
-                     virDomainObjPtr vm, off_t pos)
- {
--    char buf[4096]; /* Plenty of space to get startup greeting */
-+    char buf[4096] = ""; /* Plenty of space to get startup greeting */
-     int logfd;
-     int ret = -1;
-+    virHashTablePtr paths = NULL;
- 
--    if ((logfd = qemudLogReadFD(driver->logDir, vm->def->name, pos))
--        < 0)
-+    if ((logfd = qemudLogReadFD(driver->logDir, vm->def->name, pos)) < 0)
-         return -1;
- 
--    ret = qemudReadLogOutput(vm, logfd, buf, sizeof(buf),
--                             qemudFindCharDevicePTYs,
--                             "console", 30);
--    if (close(logfd) < 0) {
--        char ebuf[4096];
--        VIR_WARN(_("Unable to close logfile: %s"),
--                 virStrerror(errno, ebuf, sizeof ebuf));
--    }
--
--    if (ret < 0)
--        return -1;
-+    if (qemudReadLogOutput(vm, logfd, buf, sizeof(buf),
-+                           qemudFindCharDevicePTYs,
-+                           "console", 30) < 0)
-+        goto closelog;
- 
-     VIR_DEBUG("Connect monitor to %p '%s'", vm, vm->def->name);
--    if (qemuConnectMonitor(driver, vm) < 0)
--        return -1;
-+    if (qemuConnectMonitor(driver, vm) < 0) {
-+        goto cleanup;
-+    }
- 
-     /* Try to get the pty path mappings again via the monitor. This is much more
-      * reliable if it's available.
-      * Note that the monitor itself can be on a pty, so we still need to try the
-      * log output method. */
--    virHashTablePtr paths = virHashCreate(0);
-+    paths = virHashCreate(0);
-     if (paths == NULL) {
-         virReportOOMError();
-         goto cleanup;
-@@ -2087,6 +2095,23 @@ cleanup:
-         virHashFree(paths, qemudFreePtyPath);
-     }
- 
-+    if (kill(vm->pid, 0) == -1 && errno == ESRCH) {
-+        /* VM is dead, any other error raised in the interim is probably
-+         * not as important as the qemu cmdline output */
-+        qemuReadLogFD(logfd, buf, sizeof(buf), strlen(buf));
-+        qemuReportError(VIR_ERR_INTERNAL_ERROR,
-+                        _("process exited while connecting to monitor: %s"),
-+                        buf);
-+        ret = -1;
-+    }
-+
-+closelog:
-+    if (close(logfd) < 0) {
-+        char ebuf[4096];
-+        VIR_WARN(_("Unable to close logfile: %s"),
-+                 virStrerror(errno, ebuf, sizeof ebuf));
-+    }
-+
-     return ret;
- }
- 

libvirt-0.7.7-set-kernel-perms.patch

@@ -1,87 +0,0 @@
-From 3f1aa08af6580c215d973bc6bf57f505dbf8b926 Mon Sep 17 00:00:00 2001
-From: Cole Robinson <crobinso@redhat.com>
-Date: Fri, 12 Mar 2010 13:38:39 -0500
-Subject: [PATCH] security: Set permissions for kernel/initrd
-
-Fixes URL installs when running virt-install as root on Fedora.
----
- src/qemu/qemu_security_dac.c    |   21 +++++++++++++++++++++
- src/security/security_selinux.c |   16 ++++++++++++++++
- 2 files changed, 37 insertions(+), 0 deletions(-)
-
-diff --git a/src/qemu/qemu_security_dac.c b/src/qemu/qemu_security_dac.c
-index 6911f48..1883fbe 100644
---- a/src/qemu/qemu_security_dac.c
-+++ b/src/qemu/qemu_security_dac.c
-@@ -332,6 +332,15 @@ qemuSecurityDACRestoreSecurityAllLabel(virDomainObjPtr vm)
-                                                      vm->def->disks[i]) < 0)
-             rc = -1;
-     }
-+
-+    if (vm->def->os.kernel &&
-+        qemuSecurityDACRestoreSecurityFileLabel(vm->def->os.kernel) < 0)
-+        rc = -1;
-+
-+    if (vm->def->os.initrd &&
-+        qemuSecurityDACRestoreSecurityFileLabel(vm->def->os.initrd) < 0)
-+        rc = -1;
-+
-     return rc;
- }
- 
-@@ -356,6 +365,18 @@ qemuSecurityDACSetSecurityAllLabel(virDomainObjPtr vm)
-             return -1;
-     }
- 
-+    if (vm->def->os.kernel &&
-+        qemuSecurityDACSetOwnership(vm->def->os.kernel,
-+                                    driver->user,
-+                                    driver->group) < 0)
-+        return -1;
-+
-+    if (vm->def->os.initrd &&
-+        qemuSecurityDACSetOwnership(vm->def->os.initrd,
-+                                    driver->user,
-+                                    driver->group) < 0)
-+        return -1;
-+
-     return 0;
- }
- 
-diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
-index b2c8581..975b315 100644
---- a/src/security/security_selinux.c
-+++ b/src/security/security_selinux.c
-@@ -616,6 +616,14 @@ SELinuxRestoreSecurityAllLabel(virDomainObjPtr vm)
-             rc = -1;
-     }
- 
-+    if (vm->def->os.kernel &&
-+        SELinuxRestoreSecurityFileLabel(vm->def->os.kernel) < 0)
-+        rc = -1;
-+
-+    if (vm->def->os.initrd &&
-+        SELinuxRestoreSecurityFileLabel(vm->def->os.initrd) < 0)
-+        rc = -1;
-+
-     return rc;
- }
- 
-@@ -736,6 +744,14 @@ SELinuxSetSecurityAllLabel(virDomainObjPtr vm)
-             return -1;
-     }
- 
-+    if (vm->def->os.kernel &&
-+        SELinuxSetFilecon(vm->def->os.kernel, default_content_context) < 0)
-+        return -1;
-+
-+    if (vm->def->os.initrd &&
-+        SELinuxSetFilecon(vm->def->os.initrd, default_content_context) < 0)
-+        return -1;
-+
-     return 0;
- }
- 
--- 
-1.6.6.1
-

libvirt-add-default-spice-channel.patch

@@ -0,0 +1,184 @@
+From a9311c363defcba7479fdabfb4862bcf851a6b7c Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Tue, 8 May 2012 20:42:44 +0300
+Subject: [PATCH] domain_conf: add "default" to list of valid spice channels
+
+qemu's behavior in this case is to change the spice server behavior to
+require secure connection to any channel not otherwise specified as
+being in plaintext mode. libvirt doesn't currently allow requesting this
+(via plaintext-channel=<channel name>).
+
+RHBZ: 819499
+
+Signed-off-by: Alon Levy <alevy@redhat.com>
+(cherry picked from commit ba97e4edc6aa439a4f1e70855cf4503181efdb7f)
+
+Conflicts:
+
+	src/conf/domain_conf.c
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ docs/formatdomain.html.in                          |    7 +++++++
+ docs/schemas/domaincommon.rng                      |    9 +++++++++
+ src/conf/domain_conf.c                             |   20 ++++++++++++++++++++
+ src/conf/domain_conf.h                             |    1 +
+ src/qemu/qemu_command.c                            |   13 +++++++++++++
+ .../qemuxml2argv-graphics-spice.args               |    2 +-
+ .../qemuxml2argv-graphics-spice.xml                |    2 +-
+ 7 files changed, 52 insertions(+), 2 deletions(-)
+
+diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
+index d082697..db5fa9b 100644
+--- a/docs/formatdomain.html.in
++++ b/docs/formatdomain.html.in
+@@ -2308,6 +2308,13 @@ qemu-kvm -net nic,model=? /dev/null
+               <span class="since">Since 0.9.3</span>
+               NB, this may not be supported by all hypervisors.
+               <span class="since">"spice" since 0.8.6</span>.
++              The <code>defaultMode</code> attribute sets the default channel
++              security policy, valid values are <code>secure</code>,
++              <code>insecure</code> and the default <code>any</code>
++              (which is secure if possible, but falls back to insecure
++              rather than erroring out if no secure path is
++              available). <span class="since">"defaultMode" since
++              0.9.12</span>.
+             </p>
+             <p>
+               When SPICE has both a normal and TLS secured TCP port
+diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
+index fe81c26..0d6edc8 100644
+--- a/docs/schemas/domaincommon.rng
++++ b/docs/schemas/domaincommon.rng
+@@ -1388,6 +1388,15 @@
+               </choice>
+             </attribute>
+           </optional>
++          <optional>
++            <attribute name="defaultMode">
++              <choice>
++                <value>any</value>
++                <value>secure</value>
++                <value>insecure</value>
++              </choice>
++            </attribute>
++          </optional>
+           <interleave>
+             <ref name="listenElements"/>
+             <zeroOrMore>
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index 9cc1644..963768e 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -4689,6 +4689,8 @@ virDomainGraphicsDefParseXML(xmlNodePtr node,
+         char *port = virXMLPropString(node, "port");
+         char *tlsPort;
+         char *autoport;
++        char *defaultMode;
++        int defaultModeVal;
+ 
+         if (port) {
+             if (virStrToLong_i(port, NULL, 10, &def->data.spice.port) < 0) {
+@@ -4726,6 +4728,20 @@ virDomainGraphicsDefParseXML(xmlNodePtr node,
+             VIR_FREE(autoport);
+         }
+ 
++        def->data.spice.defaultMode = VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_ANY;
++
++        if ((defaultMode = virXMLPropString(node, "defaultMode")) != NULL) {
++            if ((defaultModeVal = virDomainGraphicsSpiceChannelModeTypeFromString(defaultMode)) < 0) {
++                virDomainReportError(VIR_ERR_INTERNAL_ERROR,
++                                     _("unknown default spice channel mode %s"),
++                                     defaultMode);
++                VIR_FREE(defaultMode);
++                goto error;
++            }
++            def->data.spice.defaultMode = defaultModeVal;
++            VIR_FREE(defaultMode);
++        }
++
+         def->data.spice.keymap = virXMLPropString(node, "keymap");
+ 
+         if (virDomainGraphicsAuthDefParseXML(node, &def->data.spice.auth,
+@@ -10311,6 +10327,10 @@ virDomainGraphicsDefFormat(virBufferPtr buf,
+             virBufferEscapeString(buf, " keymap='%s'",
+                                   def->data.spice.keymap);
+ 
++        if (def->data.spice.defaultMode != VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_ANY)
++            virBufferAsprintf(buf, " defaultMode='%s'",
++              virDomainGraphicsSpiceChannelModeTypeToString(def->data.spice.defaultMode));
++
+         virDomainGraphicsAuthDefFormatAttr(buf, &def->data.spice.auth, flags);
+         break;
+ 
+diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
+index d40fda6..f6df0ea 100644
+--- a/src/conf/domain_conf.h
++++ b/src/conf/domain_conf.h
+@@ -921,6 +921,7 @@ struct _virDomainGraphicsDef {
+             virDomainGraphicsAuthDef auth;
+             unsigned int autoport :1;
+             int channels[VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_LAST];
++            int defaultMode; /* enum virDomainGraphicsSpiceChannelMode */
+             int image;
+             int jpeg;
+             int zlib;
+diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
+index 366913b..ee192d3 100644
+--- a/src/qemu/qemu_command.c
++++ b/src/qemu/qemu_command.c
+@@ -4720,6 +4720,7 @@ qemuBuildCommandLine(virConnectPtr conn,
+         const char *listenAddr = NULL;
+         char *netAddr = NULL;
+         int ret;
++        int defaultMode = def->graphics[0]->data.spice.defaultMode;
+ 
+         if (!qemuCapsGet(qemuCaps, QEMU_CAPS_SPICE)) {
+             qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+@@ -4781,6 +4782,18 @@ qemuBuildCommandLine(virConnectPtr conn,
+             virBufferAsprintf(&opt, ",x509-dir=%s",
+                               driver->spiceTLSx509certdir);
+ 
++        switch (defaultMode) {
++        case VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_SECURE:
++            virBufferAsprintf(&opt, ",tls-channel=default");
++            break;
++        case VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_INSECURE:
++            virBufferAsprintf(&opt, ",plaintext-channel=default");
++            break;
++        case VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_ANY:
++            /* nothing */
++            break;
++        }
++
+         for (i = 0 ; i < VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_LAST ; i++) {
+             int mode = def->graphics[0]->data.spice.channels[i];
+             switch (mode) {
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args
+index c9fdb99..698e39c 100644
+--- a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args
++++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args
+@@ -2,7 +2,7 @@ LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=spice \
+ /usr/bin/qemu -S -M pc -m 214 -smp 1 -nodefaults -monitor \
+ unix:/tmp/test-monitor,server,nowait -no-acpi -boot c -hda \
+ /dev/HostVG/QEMUGuest1 -usb -spice port=5903,tls-port=5904,addr=127.0.0.1,\
+-x509-dir=/etc/pki/libvirt-spice,tls-channel=main,plaintext-channel=inputs,\
++x509-dir=/etc/pki/libvirt-spice,tls-channel=default,tls-channel=main,plaintext-channel=inputs,\
+ image-compression=auto_glz,jpeg-wan-compression=auto,zlib-glz-wan-compression=auto,\
+ playback-compression=on,streaming-video=filter,disable-copy-paste -vga \
+ qxl -global qxl.vram_size=18874368 -device qxl,id=video1,vram_size=33554432,bus=pci.0,addr=0x4 \
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml
+index 5313b3a..29f20ab 100644
+--- a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml
++++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml
+@@ -21,7 +21,7 @@
+     </disk>
+     <controller type='ide' index='0'/>
+     <input type='mouse' bus='ps2'/>
+-    <graphics type='spice' port='5903' tlsPort='5904' autoport='no' listen='127.0.0.1'>
++    <graphics type='spice' port='5903' tlsPort='5904' autoport='no' listen='127.0.0.1' defaultMode='secure'>
+       <listen type='address' address='127.0.0.1'/>
+       <channel name='main' mode='secure'/>
+       <channel name='inputs' mode='insecure'/>
+-- 
+1.7.7.6
+

libvirt-add-usbredir-spice-channel.patch

@@ -0,0 +1,196 @@
+From b8c86d80df4ba6c682f05974892f5d7ab8f317a9 Mon Sep 17 00:00:00 2001
+From: Alon Levy <alevy@redhat.com>
+Date: Tue, 8 May 2012 16:00:28 +0300
+Subject: [PATCH] domain_conf: add "usbredir" to list of valid spice channels
+
+Add "usbredir" channel to list of recognized spice channels.
+
+RHBZ: 819498
+
+Signed-off-by: Alon Levy <alevy@redhat.com>
+(cherry picked from commit 4e78ffb63489071c4100678ed88d3111284555e8)
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ docs/formatdomain.html.in                          |    8 ++-
+ docs/schemas/domaincommon.rng                      |    1 +
+ src/conf/domain_conf.c                             |    3 +-
+ src/conf/domain_conf.h                             |    1 +
+ .../qemuxml2argv-graphics-spice-usb-redir.args     |   16 ++++++
+ .../qemuxml2argv-graphics-spice-usb-redir.xml      |   53 ++++++++++++++++++++
+ tests/qemuxml2argvtest.c                           |    6 ++
+ 7 files changed, 84 insertions(+), 4 deletions(-)
+ create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.args
+ create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml
+
+diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
+index 390476d..d082697 100644
+--- a/docs/formatdomain.html.in
++++ b/docs/formatdomain.html.in
+@@ -2317,9 +2317,11 @@ qemu-kvm -net nic,model=? /dev/null
+               main &lt;graphics&gt; element. Valid channel names
+               include <code>main</code>, <code>display</code>,
+               <code>inputs</code>, <code>cursor</code>,
+-              <code>playback</code>, <code>record</code>;
+-              and <span class="since">since
+-              0.8.8</span>: <code>smartcard</code>.
++              <code>playback</code>, <code>record</code>
++              (all <span class="since"> since 0.8.6</span>);
++              <code>smartcard</code> (<span class="since">since
++              0.8.8</span>); and <code>usbredir</code>
++              (<span class="since">since 0.9.12</span>).
+             </p>
+             <pre>
+   &lt;graphics type='spice' port='-1' tlsPort='-1' autoport='yes'&gt;
+diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
+index 9f8d292..fe81c26 100644
+--- a/docs/schemas/domaincommon.rng
++++ b/docs/schemas/domaincommon.rng
+@@ -1401,6 +1401,7 @@
+                     <value>playback</value>
+                     <value>record</value>
+                     <value>smartcard</value>
++                    <value>usbredir</value>
+                   </choice>
+                 </attribute>
+                 <attribute name="mode">
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index 2f9da71..9cc1644 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -389,7 +389,8 @@ VIR_ENUM_IMPL(virDomainGraphicsSpiceChannelName,
+               "cursor",
+               "playback",
+               "record",
+-              "smartcard");
++              "smartcard",
++              "usbredir");
+ 
+ VIR_ENUM_IMPL(virDomainGraphicsSpiceChannelMode,
+               VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_LAST,
+diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
+index f2cd8eb..d40fda6 100644
+--- a/src/conf/domain_conf.h
++++ b/src/conf/domain_conf.h
+@@ -797,6 +797,7 @@ enum virDomainGraphicsSpiceChannelName {
+     VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_PLAYBACK,
+     VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_RECORD,
+     VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_SMARTCARD,
++    VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_USBREDIR,
+ 
+     VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_LAST
+ };
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.args b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.args
+new file mode 100644
+index 0000000..35e51a7
+--- /dev/null
++++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.args
+@@ -0,0 +1,16 @@
++LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=spice /usr/bin/qemu -S -M pc -m 214 -smp 1 -nodefconfig -nodefaults -chardev socket,id=charmonitor,path=/tmp/test-monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=readline -no-acpi -boot c \
++-device ich9-usb-ehci1,id=usb,bus=pci.0,addr=0x4.0x7 \
++-device ich9-usb-uhci1,masterbus=usb.0,firstport=0,bus=pci.0,multifunction=on,addr=0x4 \
++-device ich9-usb-uhci2,masterbus=usb.0,firstport=2,bus=pci.0,addr=0x4.0x1 \
++-device ich9-usb-uhci3,masterbus=usb.0,firstport=4,bus=pci.0,addr=0x4.0x2 \
++-spice port=5903,tls-port=5904,addr=127.0.0.1,\
++x509-dir=/etc/pki/libvirt-spice,tls-channel=main,plaintext-channel=inputs,\
++tls-channel=usbredir,\
++image-compression=auto_glz,jpeg-wan-compression=auto,zlib-glz-wan-compression=auto,\
++playback-compression=on,streaming-video=filter,disable-copy-paste \
++-vga cirrus \
++-chardev socket,id=charredir0,host=localhost,port=4000 \
++-device usb-redir,chardev=charredir0,id=redir0 \
++-chardev spicevmc,id=charredir1,name=usbredir \
++-device usb-redir,chardev=charredir1,id=redir1,bus=usb.0,port=4 \
++-device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml
+new file mode 100644
+index 0000000..1dc23bd
+--- /dev/null
++++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml
+@@ -0,0 +1,53 @@
++<domain type='qemu'>
++  <name>QEMUGuest1</name>
++  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
++  <memory unit='KiB'>219136</memory>
++  <currentMemory unit='KiB'>219136</currentMemory>
++  <vcpu>1</vcpu>
++  <os>
++    <type arch='i686' machine='pc'>hvm</type>
++    <boot dev='hd'/>
++  </os>
++  <clock offset='utc'/>
++  <on_poweroff>destroy</on_poweroff>
++  <on_reboot>restart</on_reboot>
++  <on_crash>destroy</on_crash>
++  <devices>
++    <emulator>/usr/bin/qemu</emulator>
++    <graphics type='spice' port='5903' tlsPort='5904' autoport='no' listen='127.0.0.1'>
++      <listen type='address' address='127.0.0.1'/>
++      <channel name='main' mode='secure'/>
++      <channel name='inputs' mode='insecure'/>
++      <channel name='usbredir' mode='secure'/>
++      <image compression='auto_glz'/>
++      <jpeg compression='auto'/>
++      <zlib compression='auto'/>
++      <playback compression='on'/>
++      <streaming mode='filter'/>
++      <clipboard copypaste='no'/>
++    </graphics>
++    <controller type='usb' index='0' model='ich9-ehci1'>
++      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x7'/>
++    </controller>
++    <controller type='usb' index='0' model='ich9-uhci1'>
++      <master startport='0'/>
++      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0' multifunction='on'/>
++    </controller>
++    <controller type='usb' index='0' model='ich9-uhci2'>
++      <master startport='2'/>
++      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x1'/>
++    </controller>
++    <controller type='usb' index='0' model='ich9-uhci3'>
++      <master startport='4'/>
++      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x2'/>
++    </controller>
++    <redirdev bus='usb' type='tcp'>
++      <source mode='connect' host='localhost' service='4000'/>
++      <protocol type='raw'/>
++    </redirdev>
++    <redirdev bus='usb' type='spicevmc'>
++      <address type='usb' bus='0' port='4'/>
++    </redirdev>
++    <memballoon model='virtio'/>
++  </devices>
++</domain>
+diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
+index 1dc6a01..d5475c5 100644
+--- a/tests/qemuxml2argvtest.c
++++ b/tests/qemuxml2argvtest.c
+@@ -405,6 +405,12 @@ mymain(void)
+             QEMU_CAPS_VGA, QEMU_CAPS_VGA_QXL,
+             QEMU_CAPS_DEVICE, QEMU_CAPS_SPICE,
+             QEMU_CAPS_DEVICE_QXL_VGA);
++    DO_TEST("graphics-spice-usb-redir", false,
++            QEMU_CAPS_VGA, QEMU_CAPS_SPICE,
++            QEMU_CAPS_CHARDEV, QEMU_CAPS_DEVICE, QEMU_CAPS_NODEFCONFIG,
++            QEMU_CAPS_PCI_MULTIFUNCTION, QEMU_CAPS_USB_HUB,
++            QEMU_CAPS_ICH9_USB_EHCI1, QEMU_CAPS_USB_REDIR,
++            QEMU_CAPS_CHARDEV_SPICEVMC);
+ 
+     DO_TEST("input-usbmouse", false, NONE);
+     DO_TEST("input-usbtablet", false, NONE);
+-- 
+1.7.7.6
+
+diff -rup libvirt-0.9.6.1/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml foo/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml
+--- libvirt-0.9.6.1/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml	2012-06-15 17:10:09.086979189 -0400
++++ foo/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-usb-redir.xml	2012-06-15 17:21:08.788770706 -0400
+@@ -1,8 +1,8 @@
+ <domain type='qemu'>
+   <name>QEMUGuest1</name>
+   <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+-  <memory unit='KiB'>219136</memory>
+-  <currentMemory unit='KiB'>219136</currentMemory>
++  <memory>219136</memory>
++  <currentMemory>219136</currentMemory>
+   <vcpu>1</vcpu>
+   <os>
+     <type arch='i686' machine='pc'>hvm</type>

libvirt-emit-spice-events.patch

@@ -0,0 +1,136 @@
+From 57f08fb47b0938a9e8969b857380926fa6966ca8 Mon Sep 17 00:00:00 2001
+From: Laine Stump <laine@laine.org>
+Date: Wed, 14 Mar 2012 01:41:35 -0400
+Subject: [PATCH] Emit graphics events when a SPICE client
+ connects/disconnects
+
+Wire up the domain graphics event notifications for SPICE. Adapted
+from a RHEL-only patch written by Dan Berrange that used custom
+__com.redhat_SPICE events - equivalent events are now available in
+upstream QEMU (including a SPICE_CONNECTED event, which was missing in
+the __COM.redhat_SPICE version).
+
+* src/qemu/qemu_monitor_json.c: Wire up SPICE graphics events
+(cherry picked from commit 89ae6a5a30bd91cfb2365544f9dd2e6c2a36ecca)
+
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ src/qemu/qemu_monitor_json.c |   56 +++++++++++++++++++++++++++++++++++++++---
+ 1 files changed, 52 insertions(+), 4 deletions(-)
+
+diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
+index e38c2ed..d4a3b7b 100644
+--- a/src/qemu/qemu_monitor_json.c
++++ b/src/qemu/qemu_monitor_json.c
+@@ -57,6 +57,9 @@ static void qemuMonitorJSONHandleVNCConnect(qemuMonitorPtr mon, virJSONValuePtr
+ static void qemuMonitorJSONHandleVNCInitialize(qemuMonitorPtr mon, virJSONValuePtr data);
+ static void qemuMonitorJSONHandleVNCDisconnect(qemuMonitorPtr mon, virJSONValuePtr data);
+ static void qemuMonitorJSONHandleBlockJob(qemuMonitorPtr mon, virJSONValuePtr data);
++static void qemuMonitorJSONHandleSPICEConnect(qemuMonitorPtr mon, virJSONValuePtr data);
++static void qemuMonitorJSONHandleSPICEInitialize(qemuMonitorPtr mon, virJSONValuePtr data);
++static void qemuMonitorJSONHandleSPICEDisconnect(qemuMonitorPtr mon, virJSONValuePtr data);
+ 
+ struct {
+     const char *type;
+@@ -73,6 +76,9 @@ struct {
+     { "VNC_INITIALIZED", qemuMonitorJSONHandleVNCInitialize, },
+     { "VNC_DISCONNECTED", qemuMonitorJSONHandleVNCDisconnect, },
+     { "BLOCK_JOB_COMPLETED", qemuMonitorJSONHandleBlockJob, },
++    { "SPICE_CONNECTED", qemuMonitorJSONHandleSPICEConnect, },
++    { "SPICE_INITIALIZED", qemuMonitorJSONHandleSPICEInitialize, },
++    { "SPICE_DISCONNECTED", qemuMonitorJSONHandleSPICEDisconnect, },
+ };
+ 
+ 
+@@ -617,7 +623,7 @@ VIR_ENUM_DECL(qemuMonitorGraphicsAddressFamily)
+ VIR_ENUM_IMPL(qemuMonitorGraphicsAddressFamily, VIR_DOMAIN_EVENT_GRAPHICS_ADDRESS_IPV6 + 1,
+               "ipv4", "ipv6");
+ 
+-static void qemuMonitorJSONHandleVNC(qemuMonitorPtr mon, virJSONValuePtr data, int phase)
++static void qemuMonitorJSONHandleGraphics(qemuMonitorPtr mon, virJSONValuePtr data, int phase)
+ {
+     const char *localNode, *localService, *localFamily;
+     const char *remoteNode, *remoteService, *remoteFamily;
+@@ -636,14 +642,38 @@ static void qemuMonitorJSONHandleVNC(qemuMonitorPtr mon, virJSONValuePtr data, i
+     }
+ 
+     authScheme = virJSONValueObjectGetString(server, "auth");
++    if (!authScheme) {
++        VIR_WARN("missing auth scheme in graphics event");
++        return;
++    }
+ 
+     localFamily = virJSONValueObjectGetString(server, "family");
++    if (!localFamily) {
++        VIR_WARN("missing local address family in graphics event");
++        return;
++    }
+     localNode = virJSONValueObjectGetString(server, "host");
++    if (!localNode) {
++        VIR_WARN("missing local hostname in graphics event");
++        return;
++    }
+     localService = virJSONValueObjectGetString(server, "service");
++    if (!localService)
++        localService = ""; /* Spice has multiple ports, so this isn't provided */
+ 
+     remoteFamily = virJSONValueObjectGetString(client, "family");
++    if (!remoteFamily) {
++        VIR_WARN("missing remote address family in graphics event");
++        return;
++    }
+     remoteNode = virJSONValueObjectGetString(client, "host");
++    if (!remoteNode) {
++        VIR_WARN("missing remote hostname in graphics event");
++        return;
++    }
+     remoteService = virJSONValueObjectGetString(client, "service");
++    if (!remoteService)
++        remoteService = ""; /* Spice has multiple ports, so this isn't provided */
+ 
+     saslUsername = virJSONValueObjectGetString(client, "sasl_username");
+     x509dname = virJSONValueObjectGetString(client, "x509_dname");
+@@ -665,19 +695,37 @@ static void qemuMonitorJSONHandleVNC(qemuMonitorPtr mon, virJSONValuePtr data, i
+ 
+ static void qemuMonitorJSONHandleVNCConnect(qemuMonitorPtr mon, virJSONValuePtr data)
+ {
+-    qemuMonitorJSONHandleVNC(mon, data, VIR_DOMAIN_EVENT_GRAPHICS_CONNECT);
++    qemuMonitorJSONHandleGraphics(mon, data, VIR_DOMAIN_EVENT_GRAPHICS_CONNECT);
+ }
+ 
+ 
+ static void qemuMonitorJSONHandleVNCInitialize(qemuMonitorPtr mon, virJSONValuePtr data)
+ {
+-    qemuMonitorJSONHandleVNC(mon, data, VIR_DOMAIN_EVENT_GRAPHICS_INITIALIZE);
++    qemuMonitorJSONHandleGraphics(mon, data, VIR_DOMAIN_EVENT_GRAPHICS_INITIALIZE);
+ }
+ 
+ 
+ static void qemuMonitorJSONHandleVNCDisconnect(qemuMonitorPtr mon, virJSONValuePtr data)
+ {
+-    qemuMonitorJSONHandleVNC(mon, data, VIR_DOMAIN_EVENT_GRAPHICS_DISCONNECT);
++    qemuMonitorJSONHandleGraphics(mon, data, VIR_DOMAIN_EVENT_GRAPHICS_DISCONNECT);
++}
++
++
++static void qemuMonitorJSONHandleSPICEConnect(qemuMonitorPtr mon, virJSONValuePtr data)
++{
++    qemuMonitorJSONHandleGraphics(mon, data, VIR_DOMAIN_EVENT_GRAPHICS_CONNECT);
++}
++
++
++static void qemuMonitorJSONHandleSPICEInitialize(qemuMonitorPtr mon, virJSONValuePtr data)
++{
++    qemuMonitorJSONHandleGraphics(mon, data, VIR_DOMAIN_EVENT_GRAPHICS_INITIALIZE);
++}
++
++
++static void qemuMonitorJSONHandleSPICEDisconnect(qemuMonitorPtr mon, virJSONValuePtr data)
++{
++    qemuMonitorJSONHandleGraphics(mon, data, VIR_DOMAIN_EVENT_GRAPHICS_DISCONNECT);
+ }
+ 
+ static void qemuMonitorJSONHandleBlockJob(qemuMonitorPtr mon, virJSONValuePtr data)
+-- 
+1.7.7.6
+

libvirt-qemu-replace-deprecated-fedora-13-machine.patch

@@ -0,0 +1,156 @@
+From eaf056bf995558ecf6620ce031287f3aa81b66de Mon Sep 17 00:00:00 2001
+From: Laine Stump <laine@laine.org>
+Date: Tue, 6 Dec 2011 12:47:28 -0500
+Subject: [PATCH 1/2] qemu: replace deprecated fedora-13 machine type with
+ pc-0.14
+
+This addresses https://bugzilla.redhat.com/show_bug.cgi?id=754772 .
+It should only be applied to Fedora builds of libvirt, F15 and
+later, so there is no upstream equivalent patch.
+
+Background:
+
+During the lifetime of Fedora 13, some features were backported into
+the F13 build of qemu-kvm from upstream. These features were part of
+the functionality of machine type "pc-0.13" in upstream qemu-kvm, so a
+special "fedora-13" machine type was created for the F13 qemu-kvm.
+Since "fedora-13" became the new "canonical machine type", all new
+domains created with F13 libvirt tools by default contained that
+machine type in their configuration file.
+
+In Fedora 14, a patch was made to qemu to treat the fedora-13 machine
+type as equivalent to "pc-0.13". When Fedora 15 was released, this was
+inadvertently changed to make it equivalent to "pc-0.14".
+
+With the release of Fedora 16, qemu-kvm initially removed support for
+this machine type, which caused failure of many guest configurations
+to start. qemu-kvm subsequently re-added the patch to support
+fedora-13 (as equivalent to pc-0.14), but with the promise that they
+could remove it with the release of Fedora 17. (see
+https://bugzilla.redhat.com/show_bug.cgi?id=748218 ).
+
+Solution:
+
+In order to create a repeat of the recent problems, prior to F17
+existing guest configurations need to be updated to change fedora-13
+to pc-0.14 (which has been determined to be equivalent for all
+practical purposes in both F15 and F16). That's what this patch does:
+
+1) Each time libvirtd is started, it calls virDomainLoadAllConfigs()
+which calls virDomainLoadConfig(); this function has been modified to
+check for os.machine == "fedora-13", and change it to "pc-0.14" then
+write the updated config back to disk.
+
+2) Also, any other time a domain definition is parsed, the parsed
+version in memory is changed to turn "fedora-13" into "pc-0.14". This
+handles domains that had been saved to disk prior to the upgrade, and
+are subsequently restarted.
+
+3) Finally, whenever a domain definition is formatted into a string,
+any occurrence of fedora-13 is replaced with pc-0.14 *directly in the
+virDomainDef* (to avoid multiple warning messages for the same object
+when it's formatted multiple times). This should deal with those cases
+where a domain was running at the time of upgrade, and is later
+saved/snapshotted.
+
+I had considered doing this with some sed commands in the specfile,
+but that wouldn't do anything to help the xml saved in image files.
+
+(Also, one of the xml tests was using the machine type "fedora-13",
+and since that machine type is treated specially by the rest of this
+patch, it was failing. That has been changed in a separate patch,
+which must be applied with this patch, and which *is* also upstream).
+---
+ src/conf/domain_conf.c |   62 +++++++++++++++++++++++++++++++++++++++++++++--
+ 1 files changed, 59 insertions(+), 3 deletions(-)
+
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index 318f523..7906bb8 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -7500,7 +7500,25 @@ virDomainDefPtr virDomainDefParseString(virCapsPtr caps,
+                                         unsigned int expectedVirtTypes,
+                                         unsigned int flags)
+ {
+-    return virDomainDefParse(xmlStr, NULL, caps, expectedVirtTypes, flags);
++    virDomainDefPtr def
++        = virDomainDefParse(xmlStr, NULL, caps, expectedVirtTypes, flags);
++
++    /* Fedora-specific HACK - treat fedora-13 and pc-0.14 as equivalent.
++     * This handles the case of domains that had been saved to an image file
++     * prior to upgrade (save or snapshot), then restarted/reverted.
++     */
++    if (def && STREQ_NULLABLE(def->os.machine, "fedora-13")) {
++        VIR_FREE(def->os.machine);
++        if (!(def->os.machine = strdup("pc-0.14"))) {
++            virReportOOMError();
++            virDomainDefFree(def);
++            def = NULL;
++        } else {
++            VIR_WARN("Replacing deprecated 'fedora-13' machine type "
++                     "with equivalent 'pc-0.14' in domain %s xml", def->name);
++        }
++   }
++    return def;
+ }
+ 
+ virDomainDefPtr virDomainDefParseFile(virCapsPtr caps,
+@@ -10648,8 +10666,30 @@ virDomainDefFormatInternal(virDomainDefPtr def,
+     virBufferAddLit(buf, "    <type");
+     if (def->os.arch)
+         virBufferAsprintf(buf, " arch='%s'", def->os.arch);
+-    if (def->os.machine)
+-        virBufferAsprintf(buf, " machine='%s'", def->os.machine);
++    if (def->os.machine) {
++        /* Fedora-specific HACK - replace "fedora-13" with "pc-0.14"
++         * (in the original DomainDef as well as in the xml output).
++         * This will catch XML being written to save/migration images
++         * of domains that were running when libvirtd was restarted at
++         * the time of upgrade.
++         */
++        if (STREQ_NULLABLE(def->os.machine, "fedora-13")) {
++            virBufferAddLit(buf, " machine='pc-0.14'");
++            VIR_WARN("substituting machine type 'fedora-13' with 'pc-0.14' "
++                     "in domain %s", def->name);
++            /* It's not exactly nice to modify the source object,
++             * but sometimes virDomainFormat is called > 100 times for the
++             * same object, which would result in far too many warning logs.
++             */
++            VIR_FREE(def->os.machine);
++            if (!(def->os.machine = strdup("pc-0.14"))) {
++                virReportOOMError();
++                goto cleanup;
++            }
++        } else {
++            virBufferAsprintf(buf, " machine='%s'", def->os.machine);
++        }
++    }
+     /*
+      * HACK: For xen driver we previously used bogus 'linux' as the
+      * os type for paravirt, whereas capabilities declare it to
+@@ -11100,6 +11140,22 @@ static virDomainObjPtr virDomainLoadConfig(virCapsPtr caps,
+                                       VIR_DOMAIN_XML_INACTIVE)))
+         goto error;
+ 
++    /* Fedora-specific HACK - replace "fedora-13" with "pc-0.14".
++     * This updates all config files at the first restart of libvirt
++     * after upgrade.
++     */
++    if (STREQ_NULLABLE(def->os.machine, "fedora-13")) {
++        VIR_FREE(def->os.machine);
++        if (!(def->os.machine = strdup("pc-0.14"))) {
++            virReportOOMError();
++            goto error;
++        }
++        VIR_WARN("Replacing deprecated 'fedora-13' machine type "
++                 "with equivalent 'pc-0.14' in domain %s configuration file", name);
++        if (virDomainSaveConfig(configDir, def) < 0)
++            goto error;
++    }
++
+     if ((autostartLink = virDomainConfigFile(autostartDir, name)) == NULL)
+         goto error;
+ 
+-- 
+1.7.7.4
+

sources

@@ -1 +1 @@
-5f315b0bf20e3964f7657ba1e630cd67  libvirt-0.7.7.tar.gz
+c374a6f0426e787576d8e5d3fcc3c7a1  libvirt-0.9.6.4.tar.gz