SOURCES/libvirt-conf-Make-VIR_DOMAIN_NET_TYPE_ETHERNET-not-share-host-view.patch

@@ -0,0 +1,46 @@
+From 666b68a93006c4299747d159bcacb7164b8c5d91 Mon Sep 17 00:00:00 2001
+Message-Id: <666b68a93006c4299747d159bcacb7164b8c5d91@dist-git>
+From: Michal Privoznik <mprivozn@redhat.com>
+Date: Thu, 24 Nov 2022 10:28:59 +0100
+Subject: [PATCH] conf: Make VIR_DOMAIN_NET_TYPE_ETHERNET not share 'host view'
+
+When setting up QoS for a domain <interface/>, or when reporting
+its statistics we may need to swap TX/RX values. This is all
+explained in comment to virDomainNetTypeSharesHostView().
+However, this function claims that VIR_DOMAIN_NET_TYPE_ETHERNET
+also shares the 'host view', meaning the TX/RX values must be
+swapped. But that's not true.
+
+An easy reproducer is to start a domain with two <interface/>-s:
+one type of network, the other of type ethernet and configure the
+same <bandwidth/> for both. Reversed setting can then be observed
+(e.g. via tc).
+
+Reported-by: Oleg Vasilev <oleg.vasilev@virtuozzo.com>
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
+(cherry picked from commit 0862cb3ce46253a58ca02d36b2b6a6397a60bfc7)
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2172578
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+---
+ src/conf/domain_conf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index 401ddaa1a0..427e7d1bb5 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -30472,9 +30472,9 @@ virDomainNetTypeSharesHostView(const virDomainNetDef *net)
+     virDomainNetType actualType = virDomainNetGetActualType(net);
+     switch (actualType) {
+     case VIR_DOMAIN_NET_TYPE_DIRECT:
+-    case VIR_DOMAIN_NET_TYPE_ETHERNET:
+         return true;
+     case VIR_DOMAIN_NET_TYPE_USER:
++    case VIR_DOMAIN_NET_TYPE_ETHERNET:
+     case VIR_DOMAIN_NET_TYPE_VHOSTUSER:
+     case VIR_DOMAIN_NET_TYPE_SERVER:
+     case VIR_DOMAIN_NET_TYPE_CLIENT:
+-- 
+2.39.2
+

SOURCES/libvirt-conf-adjust-method-name-virDomainDeviceCCWAddressParseXML.patch

@@ -0,0 +1,88 @@
+From 3c65b917f70d556fa1059b0400771c8159b8ca3b Mon Sep 17 00:00:00 2001
+Message-Id: <3c65b917f70d556fa1059b0400771c8159b8ca3b@dist-git>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Fri, 13 May 2022 12:31:08 +0200
+Subject: [PATCH] conf: adjust method name virDomainDeviceCCWAddressParseXML
+
+Adjust method name virDomainDeviceCCWAddressParseXML to
+virCCWDeviceAddressParseXML.
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 2d9fd19bf5d7a3d33b94e464c335252682edd623)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/conf/device_conf.c   | 4 ++--
+ src/conf/device_conf.h   | 4 ++--
+ src/conf/domain_conf.c   | 3 +--
+ src/libvirt_private.syms | 2 +-
+ 4 files changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/src/conf/device_conf.c b/src/conf/device_conf.c
+index 958e2f43cc..e93fd57341 100644
+--- a/src/conf/device_conf.c
++++ b/src/conf/device_conf.c
+@@ -259,8 +259,8 @@ virPCIDeviceAddressFormat(virBuffer *buf,
+ }
+ 
+ int
+-virDomainDeviceCCWAddressParseXML(xmlNodePtr node,
+-                                  virCCWDeviceAddress *addr)
++virCCWDeviceAddressParseXML(xmlNodePtr node,
++                            virCCWDeviceAddress *addr)
+ {
+     int cssid;
+     int ssid;
+diff --git a/src/conf/device_conf.h b/src/conf/device_conf.h
+index 01e2edccc9..910e6b7792 100644
+--- a/src/conf/device_conf.h
++++ b/src/conf/device_conf.h
+@@ -193,8 +193,8 @@ void virPCIDeviceAddressFormat(virBuffer *buf,
+                                virPCIDeviceAddress addr,
+                                bool includeTypeInAddr);
+ 
+-int virDomainDeviceCCWAddressParseXML(xmlNodePtr node,
+-                                      virCCWDeviceAddress *addr);
++int virCCWDeviceAddressParseXML(xmlNodePtr node,
++                                virCCWDeviceAddress *addr);
+ 
+ int virDomainDeviceDriveAddressParseXML(xmlNodePtr node,
+                                         virDomainDeviceDriveAddress *addr);
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index 1e1c7f01b1..401ddaa1a0 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -6630,8 +6630,7 @@ virDomainDeviceAddressParseXML(xmlNodePtr address,
+         break;
+ 
+     case VIR_DOMAIN_DEVICE_ADDRESS_TYPE_CCW:
+-        if (virDomainDeviceCCWAddressParseXML
+-                (address, &info->addr.ccw) < 0)
++        if (virCCWDeviceAddressParseXML(address, &info->addr.ccw) < 0)
+             return -1;
+         break;
+ 
+diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
+index 0d3ee4c20a..44b551fb60 100644
+--- a/src/libvirt_private.syms
++++ b/src/libvirt_private.syms
+@@ -124,6 +124,7 @@ virCPUModeTypeToString;
+ 
+ 
+ # conf/device_conf.h
++virCCWDeviceAddressParseXML;
+ virDeviceInfoPCIAddressExtensionIsPresent;
+ virDeviceInfoPCIAddressExtensionIsWanted;
+ virDeviceInfoPCIAddressIsPresent;
+@@ -131,7 +132,6 @@ virDeviceInfoPCIAddressIsWanted;
+ virDomainDeviceAddressIsValid;
+ virDomainDeviceAddressTypeToString;
+ virDomainDeviceCcidAddressParseXML;
+-virDomainDeviceCCWAddressParseXML;
+ virDomainDeviceDriveAddressParseXML;
+ virDomainDeviceInfoAddressIsEqual;
+ virDomainDeviceSpaprVioAddressParseXML;
+-- 
+2.39.1
+

SOURCES/libvirt-lib-Set-up-cpuset-controller-for-restrictive-numatune.patch

@@ -0,0 +1,77 @@
+From 08ddc711a2e6d94a0fce55fec8e012a434655d2c Mon Sep 17 00:00:00 2001
+Message-ID: <08ddc711a2e6d94a0fce55fec8e012a434655d2c.1690812875.git.jdenemar@redhat.com>
+From: Michal Privoznik <mprivozn@redhat.com>
+Date: Fri, 1 Apr 2022 14:30:05 +0200
+Subject: [PATCH] lib: Set up cpuset controller for restrictive numatune
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The aim of 'restrictive' numatune mode is to rely solely on
+CGroups to have QEMU running on configured NUMA nodes.  However,
+we were never setting the cpuset controller when a domain was
+starting up. We are doing so only when
+virDomainSetNumaParameters() is called (aka live pinning).
+
+This is obviously wrong. Fortunately, fix is simple as
+'restrictive' is similar to 'strict' - every location where
+VIR_DOMAIN_NUMATUNE_MEM_STRICT occurs can be audited and
+VIR_DOMAIN_NUMATUNE_MEM_RESTRICTIVE case can be added.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2070380
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+(cherry picked from commit 629282d8845407c1aff9a26f5dc026e15121f8cd)
+
+Conflicts:
+- src/ch/ch_process.c: The CH driver diverged because it's
+  unsupported downstream. Just drop the conflicting hunk from
+  there.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2223464
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+---
+ src/lxc/lxc_controller.c | 3 ++-
+ src/qemu/qemu_process.c  | 6 ++++--
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/src/lxc/lxc_controller.c b/src/lxc/lxc_controller.c
+index 3c930eaacd..6fd8373256 100644
+--- a/src/lxc/lxc_controller.c
++++ b/src/lxc/lxc_controller.c
+@@ -812,7 +812,8 @@ static int virLXCControllerSetupResourceLimits(virLXCController *ctrl)
+     virDomainNumatuneMemMode mode;
+ 
+     if (virDomainNumatuneGetMode(ctrl->def->numa, -1, &mode) == 0) {
+-        if (mode == VIR_DOMAIN_NUMATUNE_MEM_STRICT &&
++        if ((mode == VIR_DOMAIN_NUMATUNE_MEM_STRICT ||
++             mode == VIR_DOMAIN_NUMATUNE_MEM_RESTRICTIVE) &&
+             virCgroupControllerAvailable(VIR_CGROUP_CONTROLLER_CPUSET)) {
+             /* Use virNuma* API iff necessary. Once set and child is exec()-ed,
+              * there's no way for us to change it. Rely on cgroups (if available
+diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
+index 0fb665bc82..73d54f01cd 100644
+--- a/src/qemu/qemu_process.c
++++ b/src/qemu/qemu_process.c
+@@ -2645,7 +2645,8 @@ qemuProcessSetupPid(virDomainObj *vm,
+         virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_CPUSET)) {
+ 
+         if (virDomainNumatuneGetMode(vm->def->numa, -1, &mem_mode) == 0 &&
+-            mem_mode == VIR_DOMAIN_NUMATUNE_MEM_STRICT &&
++            (mem_mode == VIR_DOMAIN_NUMATUNE_MEM_STRICT ||
++             mem_mode == VIR_DOMAIN_NUMATUNE_MEM_RESTRICTIVE) &&
+             virDomainNumatuneMaybeFormatNodeset(vm->def->numa,
+                                                 priv->autoNodeset,
+                                                 &mem_mask, -1) < 0)
+@@ -3162,7 +3163,8 @@ static int qemuProcessHook(void *data)
+         goto cleanup;
+ 
+     if (virDomainNumatuneGetMode(h->vm->def->numa, -1, &mode) == 0) {
+-        if (mode == VIR_DOMAIN_NUMATUNE_MEM_STRICT &&
++        if ((mode == VIR_DOMAIN_NUMATUNE_MEM_STRICT ||
++             mode == VIR_DOMAIN_NUMATUNE_MEM_RESTRICTIVE) &&
+             h->cfg->cgroupControllers & (1 << VIR_CGROUP_CONTROLLER_CPUSET) &&
+             virCgroupControllerAvailable(VIR_CGROUP_CONTROLLER_CPUSET)) {
+             /* Use virNuma* API iff necessary. Once set and child is exec()-ed,
+-- 
+2.41.0

SOURCES/libvirt-node_device_conf-Avoid-memleak-in-virNodeDeviceGetPCIVPDDynamicCap.patch

@@ -0,0 +1,52 @@
+From 989a569c9c9da0fbf89aab7f292669366b2503f1 Mon Sep 17 00:00:00 2001
+Message-Id: <989a569c9c9da0fbf89aab7f292669366b2503f1@dist-git>
+From: Michal Privoznik <mprivozn@redhat.com>
+Date: Wed, 30 Nov 2022 14:53:21 +0100
+Subject: [PATCH] node_device_conf: Avoid memleak in
+ virNodeDeviceGetPCIVPDDynamicCap()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The virNodeDeviceGetPCIVPDDynamicCap() function is called from
+virNodeDeviceGetPCIDynamicCaps() and therefore has to be a wee
+bit more clever about adding VPD capability. Namely, it has to
+remove the old one before adding a new one. This is how other
+functions called from virNodeDeviceGetPCIDynamicCaps() behave
+as well.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2143235
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Peter Krempa <pkrempa@redhat.com>
+(cherry picked from commit 64d32118540aca3d42bc5ee21c8b780cafe04bfa)
+https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2023-2700
+Signed-off-by: Ján Tomko <jtomko@redhat.com>
+---
+ src/conf/node_device_conf.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c
+index 16b9497faf..eee94a3900 100644
+--- a/src/conf/node_device_conf.c
++++ b/src/conf/node_device_conf.c
+@@ -3100,6 +3100,9 @@ virNodeDeviceGetPCIVPDDynamicCap(virNodeDevCapPCIDev *devCapPCIDev)
+     virPCIDeviceAddress devAddr;
+     g_autoptr(virPCIVPDResource) res = NULL;
+ 
++    g_clear_pointer(&devCapPCIDev->vpd, virPCIVPDResourceFree);
++    devCapPCIDev->flags &= ~VIR_NODE_DEV_CAP_FLAG_PCI_VPD;
++
+     devAddr.domain = devCapPCIDev->domain;
+     devAddr.bus = devCapPCIDev->bus;
+     devAddr.slot = devCapPCIDev->slot;
+@@ -3113,8 +3116,6 @@ virNodeDeviceGetPCIVPDDynamicCap(virNodeDevCapPCIDev *devCapPCIDev)
+         if ((res = virPCIDeviceGetVPD(pciDev))) {
+             devCapPCIDev->flags |= VIR_NODE_DEV_CAP_FLAG_PCI_VPD;
+             devCapPCIDev->vpd = g_steal_pointer(&res);
+-        } else {
+-            virPCIVPDResourceFree(g_steal_pointer(&devCapPCIDev->vpd));
+         }
+     }
+     return 0;
+-- 
+2.40.1

SOURCES/libvirt-nodedev-add-optional-device-address-of-channel-device-to-css-device.patch

@@ -0,0 +1,151 @@
+From 5921eeddf0a284ccbec04896901c9bd4177de6dd Mon Sep 17 00:00:00 2001
+Message-Id: <5921eeddf0a284ccbec04896901c9bd4177de6dd@dist-git>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Fri, 13 May 2022 12:31:15 +0200
+Subject: [PATCH] nodedev: add optional device address of channel device to css
+ device
+
+Add the new introduced sysfs attribute dev_busid which provides the address
+of the device in the subchannel independent from the bound device driver.
+It is added if available in the sysfs as optional channel_dev_addr element into
+the css device capabilty providing the ccw deivce address attributes cssid,
+ssid and devno.
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 122b975e4004c83b6fc442ec6cdfd71eb5b55cc4)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ docs/schemas/nodedev.rng           |  5 +++++
+ src/conf/node_device_conf.c        | 28 ++++++++++++++++++++++++++++
+ src/conf/node_device_conf.h        |  2 ++
+ src/node_device/node_device_udev.c |  8 ++++++++
+ 4 files changed, 43 insertions(+)
+
+diff --git a/docs/schemas/nodedev.rng b/docs/schemas/nodedev.rng
+index 29515d2d7e..43f1abc247 100644
+--- a/docs/schemas/nodedev.rng
++++ b/docs/schemas/nodedev.rng
+@@ -677,6 +677,11 @@
+       <value>css</value>
+     </attribute>
+     <ref name="capccwaddress"/>
++    <optional>
++      <element name="channel_dev_addr">
++        <ref name="capccwaddress"/>
++      </element>
++    </optional>
+     <optional>
+       <ref name="mdev_types"/>
+     </optional>
+diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c
+index fcb5be24e1..16b9497faf 100644
+--- a/src/conf/node_device_conf.c
++++ b/src/conf/node_device_conf.c
+@@ -643,6 +643,17 @@ virNodeDeviceCapCSSDefFormat(virBuffer *buf,
+ 
+     virNodeDeviceCapCCWDefFormat(buf, data);
+ 
++    if (ccw_dev.channel_dev_addr) {
++        virCCWDeviceAddress *ccw = ccw_dev.channel_dev_addr;
++        virBufferAddLit(buf, "<channel_dev_addr>\n");
++        virBufferAdjustIndent(buf, 2);
++        virBufferAsprintf(buf, "<cssid>0x%x</cssid>\n", ccw->cssid);
++        virBufferAsprintf(buf, "<ssid>0x%x</ssid>\n", ccw->ssid);
++        virBufferAsprintf(buf, "<devno>0x%04x</devno>\n", ccw->devno);
++        virBufferAdjustIndent(buf, -2);
++        virBufferAddLit(buf, "</channel_dev_addr>\n");
++    }
++
+     if (ccw_dev.flags & VIR_NODE_DEV_CAP_FLAG_CSS_MDEV)
+         virNodeDeviceCapMdevTypesFormat(buf,
+                                         ccw_dev.mdev_types,
+@@ -1255,6 +1266,7 @@ virNodeDevCapCSSParseXML(xmlXPathContextPtr ctxt,
+     g_autofree xmlNodePtr *nodes = NULL;
+     int n = 0;
+     size_t i = 0;
++    xmlNodePtr channel_ddno = NULL;
+ 
+     ctxt->node = node;
+ 
+@@ -1269,6 +1281,21 @@ virNodeDevCapCSSParseXML(xmlXPathContextPtr ctxt,
+             return -1;
+     }
+ 
++    /* channel_dev_addr is optional */
++    if ((channel_ddno = virXPathNode("./channel_dev_addr[1]", ctxt))) {
++        g_autofree virCCWDeviceAddress *channel_dev = NULL;
++
++        channel_dev = g_new0(virCCWDeviceAddress, 1);
++
++        if (virNodeDevCCWDeviceAddressParseXML(ctxt,
++                                               channel_ddno,
++                                               def->name,
++                                               channel_dev) < 0)
++            return -1;
++
++        ccw_dev->channel_dev_addr = g_steal_pointer(&channel_dev);
++    }
++
+     return 0;
+ }
+ 
+@@ -2637,6 +2664,7 @@ virNodeDevCapsDefFree(virNodeDevCapsDef *caps)
+         for (i = 0; i < data->ccw_dev.nmdev_types; i++)
+             virMediatedDeviceTypeFree(data->ccw_dev.mdev_types[i]);
+         g_free(data->ccw_dev.mdev_types);
++        g_free(data->ccw_dev.channel_dev_addr);
+         break;
+     case VIR_NODE_DEV_CAP_AP_MATRIX:
+         g_free(data->ap_matrix.addr);
+diff --git a/src/conf/node_device_conf.h b/src/conf/node_device_conf.h
+index e4d1f67d53..d1751ed874 100644
+--- a/src/conf/node_device_conf.h
++++ b/src/conf/node_device_conf.h
+@@ -24,6 +24,7 @@
+ 
+ #include "internal.h"
+ #include "virbitmap.h"
++#include "virccw.h"
+ #include "virpcivpd.h"
+ #include "virscsihost.h"
+ #include "virpci.h"
+@@ -279,6 +280,7 @@ struct _virNodeDevCapCCW {
+     unsigned int flags; /* enum virNodeDevCCWCapFlags */
+     virMediatedDeviceType **mdev_types;
+     size_t nmdev_types;
++    virCCWDeviceAddress *channel_dev_addr;
+ };
+ 
+ typedef struct _virNodeDevCapVDPA virNodeDevCapVDPA;
+diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c
+index ffcb3e8640..611a2592ca 100644
+--- a/src/node_device/node_device_udev.c
++++ b/src/node_device/node_device_udev.c
+@@ -1128,6 +1128,8 @@ static int
+ udevProcessCSS(struct udev_device *device,
+                virNodeDeviceDef *def)
+ {
++    g_autofree char *dev_busid = NULL;
++
+     /* only process IO subchannel and vfio-ccw devices to keep the list sane */
+     if (!def->driver ||
+         (STRNEQ(def->driver, "io_subchannel") &&
+@@ -1139,6 +1141,12 @@ udevProcessCSS(struct udev_device *device,
+ 
+     udevGenerateDeviceName(device, def, NULL);
+ 
++    /* process optional channel devices information */
++    udevGetStringSysfsAttr(device, "dev_busid", &dev_busid);
++
++    if (dev_busid != NULL)
++        def->caps->data.ccw_dev.channel_dev_addr = virCCWDeviceAddressFromString(dev_busid);
++
+     if (virNodeDeviceGetCSSDynamicCaps(def->sysfs_path, &def->caps->data.ccw_dev) < 0)
+         return -1;
+ 
+-- 
+2.39.1
+

SOURCES/libvirt-nodedev-add-tests-for-optional-device-address-to-css-device.patch

@@ -0,0 +1,149 @@
+From ea4976de7bccfe8016950d040629a6818a58db4e Mon Sep 17 00:00:00 2001
+Message-Id: <ea4976de7bccfe8016950d040629a6818a58db4e@dist-git>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Fri, 13 May 2022 12:31:16 +0200
+Subject: [PATCH] nodedev: add tests for optional device address to css device
+
+Add nodedev schema parsing and format tests for the optional new device
+address on the css devices.
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 127fda5e84790af2c5a16b61a87e339391cccb3b)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ .../css_0_0_10000-invalid.xml                 | 10 +++++++++
+ ...s_0_0_fffe_mdev_types_channel_dev_addr.xml | 22 +++++++++++++++++++
+ .../css_0_0_ffff_channel_dev_addr-invalid.xml | 15 +++++++++++++
+ .../css_0_0_ffff_channel_dev_addr.xml         | 15 +++++++++++++
+ ...s_0_0_fffe_mdev_types_channel_dev_addr.xml |  1 +
+ .../css_0_0_ffff_channel_dev_addr.xml         |  1 +
+ tests/nodedevxml2xmltest.c                    |  2 ++
+ 7 files changed, 66 insertions(+)
+ create mode 100644 tests/nodedevschemadata/css_0_0_10000-invalid.xml
+ create mode 100644 tests/nodedevschemadata/css_0_0_fffe_mdev_types_channel_dev_addr.xml
+ create mode 100644 tests/nodedevschemadata/css_0_0_ffff_channel_dev_addr-invalid.xml
+ create mode 100644 tests/nodedevschemadata/css_0_0_ffff_channel_dev_addr.xml
+ create mode 120000 tests/nodedevxml2xmlout/css_0_0_fffe_mdev_types_channel_dev_addr.xml
+ create mode 120000 tests/nodedevxml2xmlout/css_0_0_ffff_channel_dev_addr.xml
+
+diff --git a/tests/nodedevschemadata/css_0_0_10000-invalid.xml b/tests/nodedevschemadata/css_0_0_10000-invalid.xml
+new file mode 100644
+index 0000000000..740bb489a7
+--- /dev/null
++++ b/tests/nodedevschemadata/css_0_0_10000-invalid.xml
+@@ -0,0 +1,10 @@
++<device>
++  <name>css_0_0_10000</name>
++  <path>/sys/devices/css0/0.0.10000</path>
++  <parent>computer</parent>
++  <capability type='css'>
++    <cssid>0x0</cssid>
++    <ssid>0x0</ssid>
++    <devno>0x10000</devno>
++  </capability>
++</device>
+diff --git a/tests/nodedevschemadata/css_0_0_fffe_mdev_types_channel_dev_addr.xml b/tests/nodedevschemadata/css_0_0_fffe_mdev_types_channel_dev_addr.xml
+new file mode 100644
+index 0000000000..198dcb0cb0
+--- /dev/null
++++ b/tests/nodedevschemadata/css_0_0_fffe_mdev_types_channel_dev_addr.xml
+@@ -0,0 +1,22 @@
++<device>
++  <name>css_0_0_fffe</name>
++  <path>/sys/devices/css0/0.0.fffe</path>
++  <parent>computer</parent>
++  <capability type='css'>
++    <cssid>0x0</cssid>
++    <ssid>0x0</ssid>
++    <devno>0xfffe</devno>
++    <channel_dev_addr>
++      <cssid>0x0</cssid>
++      <ssid>0x0</ssid>
++      <devno>0x0815</devno>
++    </channel_dev_addr>
++    <capability type='mdev_types'>
++      <type id='vfio_ccw-io'>
++        <name>I/O subchannel (Non-QDIO)</name>
++        <deviceAPI>vfio-ccw</deviceAPI>
++        <availableInstances>1</availableInstances>
++      </type>
++    </capability>
++  </capability>
++</device>
+diff --git a/tests/nodedevschemadata/css_0_0_ffff_channel_dev_addr-invalid.xml b/tests/nodedevschemadata/css_0_0_ffff_channel_dev_addr-invalid.xml
+new file mode 100644
+index 0000000000..3f2c5558c7
+--- /dev/null
++++ b/tests/nodedevschemadata/css_0_0_ffff_channel_dev_addr-invalid.xml
+@@ -0,0 +1,15 @@
++<device>
++  <name>css_0_0_ffff</name>
++  <path>/sys/devices/css0/0.0.ffff</path>
++  <parent>computer</parent>
++  <capability type='css'>
++    <cssid>0x0</cssid>
++    <ssid>0x0</ssid>
++    <devno>0xffff</devno>
++    <channel_dev_addr>
++      <cssid>0x0</cssid>
++      <ssid>0x0</ssid>
++      <devno>0x10000</devno>
++    </channel_dev_addr>
++  </capability>
++</device>
+diff --git a/tests/nodedevschemadata/css_0_0_ffff_channel_dev_addr.xml b/tests/nodedevschemadata/css_0_0_ffff_channel_dev_addr.xml
+new file mode 100644
+index 0000000000..17a77cb282
+--- /dev/null
++++ b/tests/nodedevschemadata/css_0_0_ffff_channel_dev_addr.xml
+@@ -0,0 +1,15 @@
++<device>
++  <name>css_0_0_ffff</name>
++  <path>/sys/devices/css0/0.0.ffff</path>
++  <parent>computer</parent>
++  <capability type='css'>
++    <cssid>0x0</cssid>
++    <ssid>0x0</ssid>
++    <devno>0xffff</devno>
++    <channel_dev_addr>
++      <cssid>0x0</cssid>
++      <ssid>0x0</ssid>
++      <devno>0x0815</devno>
++    </channel_dev_addr>
++  </capability>
++</device>
+diff --git a/tests/nodedevxml2xmlout/css_0_0_fffe_mdev_types_channel_dev_addr.xml b/tests/nodedevxml2xmlout/css_0_0_fffe_mdev_types_channel_dev_addr.xml
+new file mode 120000
+index 0000000000..65ab582ee8
+--- /dev/null
++++ b/tests/nodedevxml2xmlout/css_0_0_fffe_mdev_types_channel_dev_addr.xml
+@@ -0,0 +1 @@
++../nodedevschemadata/css_0_0_fffe_mdev_types_channel_dev_addr.xml
+\ No newline at end of file
+diff --git a/tests/nodedevxml2xmlout/css_0_0_ffff_channel_dev_addr.xml b/tests/nodedevxml2xmlout/css_0_0_ffff_channel_dev_addr.xml
+new file mode 120000
+index 0000000000..cbfe719777
+--- /dev/null
++++ b/tests/nodedevxml2xmlout/css_0_0_ffff_channel_dev_addr.xml
+@@ -0,0 +1 @@
++../nodedevschemadata/css_0_0_ffff_channel_dev_addr.xml
+\ No newline at end of file
+diff --git a/tests/nodedevxml2xmltest.c b/tests/nodedevxml2xmltest.c
+index 557347fb07..ad9562cc82 100644
+--- a/tests/nodedevxml2xmltest.c
++++ b/tests/nodedevxml2xmltest.c
+@@ -125,7 +125,9 @@ mymain(void)
+     DO_TEST("mdev_3627463d_b7f0_4fea_b468_f1da537d301b");
+     DO_TEST("ccw_0_0_ffff");
+     DO_TEST("css_0_0_ffff");
++    DO_TEST("css_0_0_ffff_channel_dev_addr");
+     DO_TEST("css_0_0_fffe_mdev_types");
++    DO_TEST("css_0_0_fffe_mdev_types_channel_dev_addr");
+     DO_TEST("ap_card07");
+     DO_TEST("ap_07_0038");
+     DO_TEST("ap_matrix");
+-- 
+2.39.1
+

SOURCES/libvirt-nodedev-fix-reported-error-msg-in-css-cap-XML-parsing.patch

@@ -0,0 +1,32 @@
+From d82e4473a66da27d2c6f41f8ecadacbd00f44430 Mon Sep 17 00:00:00 2001
+Message-Id: <d82e4473a66da27d2c6f41f8ecadacbd00f44430@dist-git>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Fri, 13 May 2022 12:31:00 +0200
+Subject: [PATCH] nodedev: fix reported error msg in css cap XML parsing
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 78094a4bd1562fec73ae99c67ddcbedd83953d5c)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/conf/node_device_conf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c
+index 0bac0fde8d..a6ebf4b66f 100644
+--- a/src/conf/node_device_conf.c
++++ b/src/conf/node_device_conf.c
+@@ -1193,7 +1193,7 @@ virNodeDevCapCCWParseXML(xmlXPathContextPtr ctxt,
+     if (virStrToLong_uip(ssid, NULL, 0, &ccw_dev->ssid) < 0) {
+         virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                        _("invalid ssid value '%s' for '%s'"),
+-                       cssid, def->name);
++                       ssid, def->name);
+         return -1;
+     }
+ 
+-- 
+2.39.1
+

SOURCES/libvirt-nodedev-prevent-internal-error-on-dev_busid-parse.patch

@@ -0,0 +1,35 @@
+From 7c60078d7a6442dc8cb5a711876d28f70d892bff Mon Sep 17 00:00:00 2001
+Message-Id: <7c60078d7a6442dc8cb5a711876d28f70d892bff@dist-git>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Mon, 23 May 2022 17:56:21 +0200
+Subject: [PATCH] nodedev: prevent internal error on dev_busid parse
+
+As "none" is a legal value represented in the sysfs attribute dev_busid
+this patch prevents libvirt from incorrectly reporting an internal error.
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Suggested-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit e37c39747be0792d03c450e56ddb3c78d08cbf3e)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/node_device/node_device_udev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c
+index 611a2592ca..b76e3de681 100644
+--- a/src/node_device/node_device_udev.c
++++ b/src/node_device/node_device_udev.c
+@@ -1144,7 +1144,7 @@ udevProcessCSS(struct udev_device *device,
+     /* process optional channel devices information */
+     udevGetStringSysfsAttr(device, "dev_busid", &dev_busid);
+ 
+-    if (dev_busid != NULL)
++    if (dev_busid != NULL && STRNEQ(dev_busid, "none"))
+         def->caps->data.ccw_dev.channel_dev_addr = virCCWDeviceAddressFromString(dev_busid);
+ 
+     if (virNodeDeviceGetCSSDynamicCaps(def->sysfs_path, &def->caps->data.ccw_dev) < 0)
+-- 
+2.39.1
+

SOURCES/libvirt-nodedev-refactor-ccw-device-address-parsing-from-XML.patch

@@ -0,0 +1,140 @@
+From ef8c30a091b5b0f08f9405878b49c21c5525dd0a Mon Sep 17 00:00:00 2001
+Message-Id: <ef8c30a091b5b0f08f9405878b49c21c5525dd0a@dist-git>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Fri, 13 May 2022 12:31:12 +0200
+Subject: [PATCH] nodedev: refactor ccw device address parsing from XML
+
+Move ccw device address XML parsing into new method for later reuse.
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 4402295d371a62ab8632d23002283b8a7721e6a7)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/conf/node_device_conf.c | 96 ++++++++++++++++++++++---------------
+ 1 file changed, 58 insertions(+), 38 deletions(-)
+
+diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c
+index 1e00f65717..8982368465 100644
+--- a/src/conf/node_device_conf.c
++++ b/src/conf/node_device_conf.c
+@@ -1141,6 +1141,58 @@ virNodeDevAPMatrixCapabilityParseXML(xmlXPathContextPtr ctxt,
+ }
+ 
+ 
++static int
++virNodeDevCCWDeviceAddressParseXML(xmlXPathContextPtr ctxt,
++                                   xmlNodePtr node,
++                                   const char *dev_name,
++                                   virCCWDeviceAddress *ccw_addr)
++{
++    VIR_XPATH_NODE_AUTORESTORE(ctxt)
++    g_autofree char *cssid = NULL;
++    g_autofree char *ssid = NULL;
++    g_autofree char *devno = NULL;
++
++    ctxt->node = node;
++
++    if (!(cssid = virXPathString("string(./cssid[1])", ctxt))) {
++        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
++                       _("missing cssid value for '%s'"), dev_name);
++        return -1;
++    }
++    if (virStrToLong_uip(cssid, NULL, 0, &ccw_addr->cssid) < 0) {
++        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
++                       _("invalid cssid value '%s' for '%s'"),
++                       cssid, dev_name);
++        return -1;
++    }
++
++    if (!(ssid = virXPathString("string(./ssid[1])", ctxt))) {
++        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
++                       _("missing ssid value for '%s'"), dev_name);
++        return -1;
++    }
++    if (virStrToLong_uip(ssid, NULL, 0, &ccw_addr->ssid) < 0) {
++        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
++                       _("invalid ssid value '%s' for '%s'"),
++                       ssid, dev_name);
++        return -1;
++    }
++
++    if (!(devno = virXPathString("string(./devno[1])", ctxt))) {
++        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
++                       _("missing devno value for '%s'"), dev_name);
++        return -1;
++    }
++    if (virStrToLong_uip(devno, NULL, 16, &ccw_addr->devno) < 0) {
++        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
++                       _("invalid devno value '%s' for '%s'"),
++                       devno, dev_name);
++        return -1;
++    }
++
++    return 0;
++}
++
+ static int
+ virNodeDevCSSCapabilityParseXML(xmlXPathContextPtr ctxt,
+                                 xmlNodePtr node,
+@@ -1178,50 +1230,18 @@ virNodeDevCapCCWParseXML(xmlXPathContextPtr ctxt,
+     g_autofree xmlNodePtr *nodes = NULL;
+     int n = 0;
+     size_t i = 0;
+-    g_autofree char *cssid = NULL;
+-    g_autofree char *ssid = NULL;
+-    g_autofree char *devno = NULL;
++    g_autofree virCCWDeviceAddress *ccw_addr = NULL;
+ 
+     ctxt->node = node;
+ 
+-    if (!(cssid = virXPathString("string(./cssid[1])", ctxt))) {
+-        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+-                       _("missing cssid value for '%s'"), def->name);
+-        return -1;
+-    }
+-
+-    if (virStrToLong_uip(cssid, NULL, 0, &ccw_dev->cssid) < 0) {
+-        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+-                       _("invalid cssid value '%s' for '%s'"),
+-                       cssid, def->name);
+-        return -1;
+-    }
+-
+-    if (!(ssid = virXPathString("string(./ssid[1])", ctxt))) {
+-        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+-                       _("missing ssid value for '%s'"), def->name);
+-        return -1;
+-    }
++    ccw_addr = g_new0(virCCWDeviceAddress, 1);
+ 
+-    if (virStrToLong_uip(ssid, NULL, 0, &ccw_dev->ssid) < 0) {
+-        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+-                       _("invalid ssid value '%s' for '%s'"),
+-                       ssid, def->name);
++    if (virNodeDevCCWDeviceAddressParseXML(ctxt, node, def->name, ccw_addr) < 0)
+         return -1;
+-    }
+ 
+-    if (!(devno = virXPathString("string(./devno[1])", ctxt))) {
+-        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+-                       _("missing devno value for '%s'"), def->name);
+-        return -1;
+-    }
+-
+-    if (virStrToLong_uip(devno, NULL, 16, &ccw_dev->devno) < 0) {
+-        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+-                       _("invalid devno value '%s' for '%s'"),
+-                       devno, def->name);
+-        return -1;
+-    }
++    ccw_dev->cssid = ccw_addr->cssid;
++    ccw_dev->ssid = ccw_addr->ssid;
++    ccw_dev->devno = ccw_addr->devno;
+ 
+     if ((n = virXPathNodeSet("./capability", ctxt, &nodes)) < 0)
+         return -1;
+-- 
+2.39.1
+

SOURCES/libvirt-nodedev-refactor-css-XML-parsing-from-ccw-XML-parsing.patch

@@ -0,0 +1,99 @@
+From 286c821eee3b682d6aa4aeaa13aad92382708803 Mon Sep 17 00:00:00 2001
+Message-Id: <286c821eee3b682d6aa4aeaa13aad92382708803@dist-git>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Fri, 13 May 2022 12:31:13 +0200
+Subject: [PATCH] nodedev: refactor css XML parsing from ccw XML parsing
+
+In preparation for easier extension later.
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 245ff2d6634b3afb0dbf0d295051e458095bfc80)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/conf/node_device_conf.c | 40 +++++++++++++++++++++++++++----------
+ 1 file changed, 30 insertions(+), 10 deletions(-)
+
+diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c
+index 8982368465..fcb5be24e1 100644
+--- a/src/conf/node_device_conf.c
++++ b/src/conf/node_device_conf.c
+@@ -1193,6 +1193,31 @@ virNodeDevCCWDeviceAddressParseXML(xmlXPathContextPtr ctxt,
+     return 0;
+ }
+ 
++
++static int
++virNodeDevCapCCWParseXML(xmlXPathContextPtr ctxt,
++                         virNodeDeviceDef *def,
++                         xmlNodePtr node,
++                         virNodeDevCapCCW *ccw_dev)
++{
++    VIR_XPATH_NODE_AUTORESTORE(ctxt)
++    g_autofree virCCWDeviceAddress *ccw_addr = NULL;
++
++    ctxt->node = node;
++
++    ccw_addr = g_new0(virCCWDeviceAddress, 1);
++
++    if (virNodeDevCCWDeviceAddressParseXML(ctxt, node, def->name, ccw_addr) < 0)
++        return -1;
++
++    ccw_dev->cssid = ccw_addr->cssid;
++    ccw_dev->ssid = ccw_addr->ssid;
++    ccw_dev->devno = ccw_addr->devno;
++
++    return 0;
++}
++
++
+ static int
+ virNodeDevCSSCapabilityParseXML(xmlXPathContextPtr ctxt,
+                                 xmlNodePtr node,
+@@ -1221,7 +1246,7 @@ virNodeDevCSSCapabilityParseXML(xmlXPathContextPtr ctxt,
+ 
+ 
+ static int
+-virNodeDevCapCCWParseXML(xmlXPathContextPtr ctxt,
++virNodeDevCapCSSParseXML(xmlXPathContextPtr ctxt,
+                          virNodeDeviceDef *def,
+                          xmlNodePtr node,
+                          virNodeDevCapCCW *ccw_dev)
+@@ -1230,19 +1255,12 @@ virNodeDevCapCCWParseXML(xmlXPathContextPtr ctxt,
+     g_autofree xmlNodePtr *nodes = NULL;
+     int n = 0;
+     size_t i = 0;
+-    g_autofree virCCWDeviceAddress *ccw_addr = NULL;
+ 
+     ctxt->node = node;
+ 
+-    ccw_addr = g_new0(virCCWDeviceAddress, 1);
+-
+-    if (virNodeDevCCWDeviceAddressParseXML(ctxt, node, def->name, ccw_addr) < 0)
++    if (virNodeDevCapCCWParseXML(ctxt, def, node, ccw_dev) < 0)
+         return -1;
+ 
+-    ccw_dev->cssid = ccw_addr->cssid;
+-    ccw_dev->ssid = ccw_addr->ssid;
+-    ccw_dev->devno = ccw_addr->devno;
+-
+     if ((n = virXPathNodeSet("./capability", ctxt, &nodes)) < 0)
+         return -1;
+ 
+@@ -2282,9 +2300,11 @@ virNodeDevCapsDefParseXML(xmlXPathContextPtr ctxt,
+         ret = virNodeDevCapMdevParseXML(ctxt, def, node, &caps->data.mdev);
+         break;
+     case VIR_NODE_DEV_CAP_CCW_DEV:
+-    case VIR_NODE_DEV_CAP_CSS_DEV:
+         ret = virNodeDevCapCCWParseXML(ctxt, def, node, &caps->data.ccw_dev);
+         break;
++    case VIR_NODE_DEV_CAP_CSS_DEV:
++        ret = virNodeDevCapCSSParseXML(ctxt, def, node, &caps->data.ccw_dev);
++        break;
+     case VIR_NODE_DEV_CAP_AP_CARD:
+         ret = virNodeDevCapAPCardParseXML(ctxt, def, node,
+                                           &caps->data.ap_card);
+-- 
+2.39.1
+

SOURCES/libvirt-nodedev-refactor-css-format-from-ccw-format-method.patch

@@ -0,0 +1,62 @@
+From d370e2e984b4501060ea0d7a10629db0bfe51ef2 Mon Sep 17 00:00:00 2001
+Message-Id: <d370e2e984b4501060ea0d7a10629db0bfe51ef2@dist-git>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Fri, 13 May 2022 12:31:11 +0200
+Subject: [PATCH] nodedev: refactor css format from ccw format method
+
+In preparation for easier extension later.
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit c5864885060b136214b4bcef25d604cc3d147014)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/conf/node_device_conf.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c
+index a6ebf4b66f..1e00f65717 100644
+--- a/src/conf/node_device_conf.c
++++ b/src/conf/node_device_conf.c
+@@ -632,10 +632,21 @@ virNodeDeviceCapCCWDefFormat(virBuffer *buf,
+                       data->ccw_dev.ssid);
+     virBufferAsprintf(buf, "<devno>0x%04x</devno>\n",
+                       data->ccw_dev.devno);
+-    if (data->ccw_dev.flags & VIR_NODE_DEV_CAP_FLAG_CSS_MDEV)
++}
++
++
++static void
++virNodeDeviceCapCSSDefFormat(virBuffer *buf,
++                             const virNodeDevCapData *data)
++{
++    virNodeDevCapCCW ccw_dev = data->ccw_dev;
++
++    virNodeDeviceCapCCWDefFormat(buf, data);
++
++    if (ccw_dev.flags & VIR_NODE_DEV_CAP_FLAG_CSS_MDEV)
+         virNodeDeviceCapMdevTypesFormat(buf,
+-                                        data->ccw_dev.mdev_types,
+-                                        data->ccw_dev.nmdev_types);
++                                        ccw_dev.mdev_types,
++                                        ccw_dev.nmdev_types);
+ }
+ 
+ 
+@@ -724,9 +735,11 @@ virNodeDeviceDefFormat(const virNodeDeviceDef *def)
+             virNodeDeviceCapMdevDefFormat(&buf, data);
+             break;
+         case VIR_NODE_DEV_CAP_CCW_DEV:
+-        case VIR_NODE_DEV_CAP_CSS_DEV:
+             virNodeDeviceCapCCWDefFormat(&buf, data);
+             break;
++        case VIR_NODE_DEV_CAP_CSS_DEV:
++            virNodeDeviceCapCSSDefFormat(&buf, data);
++            break;
+         case VIR_NODE_DEV_CAP_VDPA:
+             virNodeDeviceCapVDPADefFormat(&buf, data);
+             break;
+-- 
+2.39.1
+

SOURCES/libvirt-nodedev-update-transient-mdevs.patch

@@ -0,0 +1,79 @@
+From aebcc09c7060f6eace93821c6a782031cf107d85 Mon Sep 17 00:00:00 2001
+Message-ID: <aebcc09c7060f6eace93821c6a782031cf107d85.1687452713.git.jdenemar@redhat.com>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Mon, 8 May 2023 19:10:46 +0200
+Subject: [PATCH] nodedev: update transient mdevs
+
+Instead of updating defined mdevs only add another update for active
+devices as well to cover transient mdev devices as well.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2143158
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Jonathon Jongsma <jjongsma@redhat.com>
+
+Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2143160
+
+(cherry picked from commit 44a0f2f0c8ff5e78c238013ed297b8fce223ac5a)
+Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
+---
+ src/node_device/node_device_driver.c | 31 ++++++++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/src/node_device/node_device_driver.c b/src/node_device/node_device_driver.c
+index e6ab4bb94c..943f6121a0 100644
+--- a/src/node_device/node_device_driver.c
++++ b/src/node_device/node_device_driver.c
+@@ -1651,6 +1651,24 @@ virMdevctlListDefined(virNodeDeviceDef ***devs, char **errmsg)
+ }
+ 
+ 
++static int
++virMdevctlListActive(virNodeDeviceDef ***devs, char **errmsg)
++{
++    int status;
++    g_autofree char *output = NULL;
++    g_autoptr(virCommand) cmd = nodeDeviceGetMdevctlListCommand(false, &output, errmsg);
++
++    if (virCommandRun(cmd, &status) < 0 || status != 0) {
++        return -1;
++    }
++
++    if (!output)
++        return -1;
++
++    return nodeDeviceParseMdevctlJSON(output, devs);
++}
++
++
+ typedef struct _virMdevctlForEachData virMdevctlForEachData;
+ struct _virMdevctlForEachData {
+     int ndefs;
+@@ -1712,6 +1730,8 @@ int
+ nodeDeviceUpdateMediatedDevices(void)
+ {
+     g_autofree virNodeDeviceDef **defs = NULL;
++    g_autofree virNodeDeviceDef **act_defs = NULL;
++    int act_ndefs = 0;
+     g_autofree char *errmsg = NULL;
+     g_autofree char *mdevctl = NULL;
+     virMdevctlForEachData data = { 0, };
+@@ -1738,6 +1758,17 @@ nodeDeviceUpdateMediatedDevices(void)
+         if (nodeDeviceUpdateMediatedDevice(defs[i]) < 0)
+             return -1;
+ 
++    /* Update active/transient mdev devices */
++    if ((act_ndefs = virMdevctlListActive(&act_defs, &errmsg)) < 0) {
++        virReportError(VIR_ERR_INTERNAL_ERROR,
++                       _("failed to query mdevs from mdevctl: %1$s"), errmsg);
++        return -1;
++    }
++
++    for (i = 0; i < act_ndefs; i++)
++        if (nodeDeviceUpdateMediatedDevice(act_defs[i]) < 0)
++            return -1;
++
+     return 0;
+ }
+ 
+-- 
+2.41.0

SOURCES/libvirt-qemu-Make-struct-_qemuMonitorMessage-private.patch

@@ -0,0 +1,105 @@
+From 85b7d8295d72214b08f0fff93c473baaa88a569b Mon Sep 17 00:00:00 2001
+Message-Id: <85b7d8295d72214b08f0fff93c473baaa88a569b@dist-git>
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Mon, 14 Feb 2022 15:57:21 +0100
+Subject: [PATCH] qemu: Make 'struct _qemuMonitorMessage' private
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Move the declaration of the struct into 'qemu_monitor_priv.h' as other
+code has no business in peeking into the monitor messages.
+
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+(cherry picked from commit f9ae469a6ebb17e0990096e826f049c1c46cd760)
+https://bugzilla.redhat.com/show_bug.cgi?id=2170472
+---
+ src/qemu/qemu_monitor.h      | 14 --------------
+ src/qemu/qemu_monitor_json.c |  3 +++
+ src/qemu/qemu_monitor_priv.h | 16 ++++++++++++++++
+ tests/qemucapsprobemock.c    |  3 +++
+ 4 files changed, 22 insertions(+), 14 deletions(-)
+
+diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h
+index a4a4edf5a6..d00967d84f 100644
+--- a/src/qemu/qemu_monitor.h
++++ b/src/qemu/qemu_monitor.h
+@@ -34,21 +34,7 @@
+ #include "virenum.h"
+ 
+ typedef struct _qemuMonitor qemuMonitor;
+-
+ typedef struct _qemuMonitorMessage qemuMonitorMessage;
+-struct _qemuMonitorMessage {
+-    int txFD;
+-
+-    const char *txBuffer;
+-    int txOffset;
+-    int txLength;
+-
+-    /* Used by the JSON monitor to hold reply / error */
+-    void *rxObject;
+-
+-    /* True if rxObject is ready, or a fatal error occurred on the monitor channel */
+-    bool finished;
+-};
+ 
+ typedef enum {
+     QEMU_MONITOR_EVENT_PANIC_INFO_TYPE_NONE = 0,
+diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
+index 34a46b9b41..7d8755246f 100644
+--- a/src/qemu/qemu_monitor_json.c
++++ b/src/qemu/qemu_monitor_json.c
+@@ -44,6 +44,9 @@
+ # include "libvirt_qemu_probes.h"
+ #endif
+ 
++#define LIBVIRT_QEMU_MONITOR_PRIV_H_ALLOW
++#include "qemu_monitor_priv.h"
++
+ #define VIR_FROM_THIS VIR_FROM_QEMU
+ 
+ VIR_LOG_INIT("qemu.qemu_monitor_json");
+diff --git a/src/qemu/qemu_monitor_priv.h b/src/qemu/qemu_monitor_priv.h
+index 31bb3526b9..6115f830de 100644
+--- a/src/qemu/qemu_monitor_priv.h
++++ b/src/qemu/qemu_monitor_priv.h
+@@ -24,5 +24,21 @@
+ 
+ #include "qemu_monitor.h"
+ 
++
++struct _qemuMonitorMessage {
++    int txFD;
++
++    const char *txBuffer;
++    int txOffset;
++    int txLength;
++
++    /* Used by the JSON monitor to hold reply / error */
++    void *rxObject;
++
++    /* True if rxObject is ready, or a fatal error occurred on the monitor channel */
++    bool finished;
++};
++
++
+ void
+ qemuMonitorResetCommandID(qemuMonitor *mon);
+diff --git a/tests/qemucapsprobemock.c b/tests/qemucapsprobemock.c
+index 915036d178..2717ed5d84 100644
+--- a/tests/qemucapsprobemock.c
++++ b/tests/qemucapsprobemock.c
+@@ -25,6 +25,9 @@
+ #include "qemu/qemu_monitor.h"
+ #include "qemu/qemu_monitor_json.h"
+ 
++#define LIBVIRT_QEMU_MONITOR_PRIV_H_ALLOW
++#include "qemu/qemu_monitor_priv.h"
++
+ #define REAL_SYM(realFunc) \
+     do { \
+         if (!realFunc && !(realFunc = dlsym(RTLD_NEXT, __FUNCTION__))) { \
+-- 
+2.40.1

SOURCES/libvirt-qemu-agent-Make-fetching-of-can-offline-member-from-guest-query-vcpus-optional.patch

@@ -0,0 +1,46 @@
+From c57b31305a7fc8c2a4d11e11e7a48c4826160fa2 Mon Sep 17 00:00:00 2001
+Message-Id: <c57b31305a7fc8c2a4d11e11e7a48c4826160fa2@dist-git>
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Wed, 1 Mar 2023 16:51:42 +0100
+Subject: [PATCH] qemu: agent: Make fetching of 'can-offline' member from
+ 'guest-query-vcpus' optional
+
+The 'can-offline' member is optional according to agent's schema and in
+fact in certain cases it's not returned. Libvirt then spams the logs
+if something is polling the bulk guest stats API.
+
+Noticed when going through oVirt logs which appears to call the bulk
+stats API repeatedly.
+
+Instead of requiring it we simply reply that the vCPU can't be offlined.
+
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Laine Stump <laine@redhat.com>
+(cherry picked from commit 790ea58153b9ef1120a577d1a87a4ca2e988ee5c)
+https://bugzilla.redhat.com/show_bug.cgi?id=2174447
+---
+ src/qemu/qemu_agent.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/src/qemu/qemu_agent.c b/src/qemu/qemu_agent.c
+index db844148a6..09b7340bc8 100644
+--- a/src/qemu/qemu_agent.c
++++ b/src/qemu/qemu_agent.c
+@@ -1371,12 +1371,8 @@ qemuAgentGetVCPUs(qemuAgent *agent,
+             return -1;
+         }
+ 
+-        if (virJSONValueObjectGetBoolean(entry, "can-offline",
+-                                         &in->offlinable) < 0) {
+-            virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+-                           _("'can-offline' missing in reply of guest-get-vcpus"));
+-            return -1;
+-        }
++        in->offlinable = false;
++        ignore_value(virJSONValueObjectGetBoolean(entry, "can-offline", &in->offlinable));
+     }
+ 
+     return ndata;
+-- 
+2.39.2
+

SOURCES/libvirt-qemu-domain-Fix-logic-when-tainting-domain.patch

@@ -0,0 +1,39 @@
+From 521e9a7731ac678ca790da4b04dabe4369efb984 Mon Sep 17 00:00:00 2001
+Message-Id: <521e9a7731ac678ca790da4b04dabe4369efb984@dist-git>
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Wed, 1 Mar 2023 17:09:42 +0100
+Subject: [PATCH] qemu: domain: Fix logic when tainting domain
+
+Originally the code was skipping all repeated taints with the same taint
+flag but a logic bug introduced in commit 30626ed15b239c424ae inverted
+the condition. This caused that actually the first occurence was NOT
+logged but any subsequent was.
+
+This was noticed when going through oVirt logs as they use custom guest
+agent commands and the logs are totally spammed with this message.
+
+Fixes: 30626ed15b239c424ae891f096057a696eadd715
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Laine Stump <laine@redhat.com>
+(cherry picked from commit 9134b40d0b43a5e1a9928b0a0d948205941d9807)
+https://bugzilla.redhat.com/show_bug.cgi?id=2174447
+---
+ src/qemu/qemu_domain.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
+index c24d1e4d53..c70661fc49 100644
+--- a/src/qemu/qemu_domain.c
++++ b/src/qemu/qemu_domain.c
+@@ -6369,7 +6369,7 @@ void qemuDomainObjTaintMsg(virQEMUDriver *driver,
+     const char *extrasuffix = "";
+     va_list args;
+ 
+-    if (virDomainObjTaint(obj, taint)) {
++    if (!virDomainObjTaint(obj, taint)) {
+         /* If an extra message was given we must always
+          * emit the taint warning, otherwise it is a
+          * one-time only warning per VM
+-- 
+2.39.2
+

SOURCES/libvirt-qemu-monitor-Drop-old-monitor-fields-from-struct-_qemuMonitorMessage.patch

@@ -0,0 +1,44 @@
+From a4d8210ae9fd84740e01b96d28bfb6183f3f3270 Mon Sep 17 00:00:00 2001
+Message-Id: <a4d8210ae9fd84740e01b96d28bfb6183f3f3270@dist-git>
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Mon, 14 Feb 2022 16:02:29 +0100
+Subject: [PATCH] qemu: monitor: Drop old monitor fields from 'struct
+ _qemuMonitorMessage'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The fields are no longer used since we've deleted support for HMP-only
+qemus. The HMP command pass-through works via a QMP command.
+
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+(cherry picked from commit c5eb99a9d9af8683789e99cc904671e343580058)
+https://bugzilla.redhat.com/show_bug.cgi?id=2170472
+---
+ src/qemu/qemu_monitor.h | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h
+index d2037914be..a4a4edf5a6 100644
+--- a/src/qemu/qemu_monitor.h
++++ b/src/qemu/qemu_monitor.h
+@@ -43,15 +43,10 @@ struct _qemuMonitorMessage {
+     int txOffset;
+     int txLength;
+ 
+-    /* Used by the text monitor reply / error */
+-    char *rxBuffer;
+-    int rxLength;
+     /* Used by the JSON monitor to hold reply / error */
+     void *rxObject;
+ 
+-    /* True if rxBuffer / rxObject are ready, or a
+-     * fatal error occurred on the monitor channel
+-     */
++    /* True if rxObject is ready, or a fatal error occurred on the monitor channel */
+     bool finished;
+ };
+ 
+-- 
+2.40.1

SOURCES/libvirt-qemu-monitor-Move-declaration-of-struct-_qemuMonitor-to-qemu_monitor_priv.h.patch

@@ -0,0 +1,157 @@
+From c2ed5aeee7bf365877e0764699f032fb749630b0 Mon Sep 17 00:00:00 2001
+Message-Id: <c2ed5aeee7bf365877e0764699f032fb749630b0@dist-git>
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Mon, 14 Feb 2022 16:07:41 +0100
+Subject: [PATCH] qemu: monitor: Move declaration of struct _qemuMonitor to
+ qemu_monitor_priv.h
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+In order to mock the SCM_RIGHTS sendmsg to simulate sending
+filedescriptors to fake qemu in tests we need access to some fields of
+'struct _qemuMonitor'. Move its declaration to the private header file.
+
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+(cherry picked from commit 7c35c483eaa78eb847e0865cbb210d5355f75d7a)
+https://bugzilla.redhat.com/show_bug.cgi?id=2170472
+---
+ src/qemu/qemu_monitor.c      | 50 ---------------------------------
+ src/qemu/qemu_monitor_priv.h | 54 ++++++++++++++++++++++++++++++++++++
+ 2 files changed, 54 insertions(+), 50 deletions(-)
+
+diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c
+index 23638d3fe8..bba92592c5 100644
+--- a/src/qemu/qemu_monitor.c
++++ b/src/qemu/qemu_monitor.c
+@@ -65,56 +65,6 @@ VIR_LOG_INIT("qemu.qemu_monitor");
+  */
+ #define QEMU_MONITOR_MAX_RESPONSE (10 * 1024 * 1024)
+ 
+-struct _qemuMonitor {
+-    virObjectLockable parent;
+-
+-    virCond notify;
+-
+-    int fd;
+-
+-    GMainContext *context;
+-    GSocket *socket;
+-    GSource *watch;
+-
+-    virDomainObj *vm;
+-    char *domainName;
+-
+-    qemuMonitorCallbacks *cb;
+-    void *callbackOpaque;
+-
+-    /* If there's a command being processed this will be
+-     * non-NULL */
+-    qemuMonitorMessage *msg;
+-
+-    /* Buffer incoming data ready for Text/QMP monitor
+-     * code to process & find message boundaries */
+-    size_t bufferOffset;
+-    size_t bufferLength;
+-    char *buffer;
+-
+-    /* If anything went wrong, this will be fed back
+-     * the next monitor msg */
+-    virError lastError;
+-
+-    /* Set to true when EOF is detected on the monitor */
+-    bool goteof;
+-
+-    int nextSerial;
+-
+-    bool waitGreeting;
+-
+-    /* If found, path to the virtio memballoon driver */
+-    char *balloonpath;
+-    bool ballooninit;
+-
+-    /* Log file context of the qemu process to dig for usable info */
+-    qemuMonitorReportDomainLogError logFunc;
+-    void *logOpaque;
+-    virFreeCallback logDestroy;
+-
+-    /* true if qemu no longer wants 'props' sub-object of object-add */
+-    bool objectAddNoWrap;
+-};
+ 
+ /**
+  * QEMU_CHECK_MONITOR_FULL:
+diff --git a/src/qemu/qemu_monitor_priv.h b/src/qemu/qemu_monitor_priv.h
+index 6115f830de..606aa79fbd 100644
+--- a/src/qemu/qemu_monitor_priv.h
++++ b/src/qemu/qemu_monitor_priv.h
+@@ -24,6 +24,8 @@
+ 
+ #include "qemu_monitor.h"
+ 
++#include <gio/gio.h>
++
+ 
+ struct _qemuMonitorMessage {
+     int txFD;
+@@ -40,5 +42,57 @@ struct _qemuMonitorMessage {
+ };
+ 
+ 
++struct _qemuMonitor {
++    virObjectLockable parent;
++
++    virCond notify;
++
++    int fd;
++
++    GMainContext *context;
++    GSocket *socket;
++    GSource *watch;
++
++    virDomainObj *vm;
++    char *domainName;
++
++    qemuMonitorCallbacks *cb;
++    void *callbackOpaque;
++
++    /* If there's a command being processed this will be
++     * non-NULL */
++    qemuMonitorMessage *msg;
++
++    /* Buffer incoming data ready for Text/QMP monitor
++     * code to process & find message boundaries */
++    size_t bufferOffset;
++    size_t bufferLength;
++    char *buffer;
++
++    /* If anything went wrong, this will be fed back
++     * the next monitor msg */
++    virError lastError;
++
++    /* Set to true when EOF is detected on the monitor */
++    bool goteof;
++
++    int nextSerial;
++
++    bool waitGreeting;
++
++    /* If found, path to the virtio memballoon driver */
++    char *balloonpath;
++    bool ballooninit;
++
++    /* Log file context of the qemu process to dig for usable info */
++    qemuMonitorReportDomainLogError logFunc;
++    void *logOpaque;
++    virFreeCallback logDestroy;
++
++    /* true if qemu no longer wants 'props' sub-object of object-add */
++    bool objectAddNoWrap;
++};
++
++
+ void
+ qemuMonitorResetCommandID(qemuMonitor *mon);
+-- 
+2.40.1

SOURCES/libvirt-qemu-monitor-Store-whether-query-named-block-nodes-supports-flat-parameter.patch

@@ -0,0 +1,57 @@
+From b3ffc8876adf777c7baefb6e467d7552c0a03251 Mon Sep 17 00:00:00 2001
+Message-Id: <b3ffc8876adf777c7baefb6e467d7552c0a03251@dist-git>
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Wed, 9 Nov 2022 10:53:49 +0100
+Subject: [PATCH] qemu: monitor: Store whether 'query-named-block-nodes'
+ supports 'flat' parameter
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Rather than having callers always pass this flag store it in the
+qemuMonitor object. Following patches will convert the code to use this
+internal flag.
+
+In the future this will also simplify removal when all supported qemu
+versions will support the new mode.
+
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+(cherry picked from commit b0e4ad5263c73a926b8246028c76c552b07fca74)
+https://bugzilla.redhat.com/show_bug.cgi?id=2170472
+---
+ src/qemu/qemu_monitor.c      | 4 +++-
+ src/qemu/qemu_monitor_priv.h | 2 ++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c
+index bba92592c5..99667fdf2f 100644
+--- a/src/qemu/qemu_monitor.c
++++ b/src/qemu/qemu_monitor.c
+@@ -610,8 +610,10 @@ qemuMonitorOpenInternal(virDomainObj *vm,
+     mon->cb = cb;
+     mon->callbackOpaque = opaque;
+ 
+-    if (priv)
++    if (priv) {
+         mon->objectAddNoWrap = virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_OBJECT_JSON);
++        mon->queryNamedBlockNodesFlat = virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_QMP_QUERY_NAMED_BLOCK_NODES_FLAT);
++    }
+ 
+     if (virSetCloseExec(mon->fd) < 0) {
+         virReportError(VIR_ERR_INTERNAL_ERROR,
+diff --git a/src/qemu/qemu_monitor_priv.h b/src/qemu/qemu_monitor_priv.h
+index 606aa79fbd..e32928805f 100644
+--- a/src/qemu/qemu_monitor_priv.h
++++ b/src/qemu/qemu_monitor_priv.h
+@@ -91,6 +91,8 @@ struct _qemuMonitor {
+ 
+     /* true if qemu no longer wants 'props' sub-object of object-add */
+     bool objectAddNoWrap;
++    /* query-named-block-nodes supports the 'flat' option */
++    bool queryNamedBlockNodesFlat;
+ };
+ 
+ 
+-- 
+2.40.1

SOURCES/libvirt-qemu-qemuBlockGetNamedNodeData-Remove-pointless-error-path.patch

@@ -0,0 +1,53 @@
+From 31986239312c0e460800f5b9921f6593f1556015 Mon Sep 17 00:00:00 2001
+Message-Id: <31986239312c0e460800f5b9921f6593f1556015@dist-git>
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Wed, 9 Nov 2022 10:45:27 +0100
+Subject: [PATCH] qemu: qemuBlockGetNamedNodeData: Remove pointless error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We don't need automatic freeing for 'blockNamedNodeData' and we can
+directly return it rather than checking it for NULL-ness first.
+
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+(cherry picked from commit 3fe74ebd9037d695df906ed137d22a8d8d77e169)
+
+ Conflicts:
+	src/qemu/qemu_block.c
+
+    - qemuDomainObjEnter/ExitMonitor still needs 'driver'
+
+https://bugzilla.redhat.com/show_bug.cgi?id=2170472
+---
+ src/qemu/qemu_block.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/src/qemu/qemu_block.c b/src/qemu/qemu_block.c
+index aa566d0097..c9229d1918 100644
+--- a/src/qemu/qemu_block.c
++++ b/src/qemu/qemu_block.c
+@@ -3020,7 +3020,7 @@ qemuBlockGetNamedNodeData(virDomainObj *vm,
+ {
+     qemuDomainObjPrivate *priv = vm->privateData;
+     virQEMUDriver *driver = priv->driver;
+-    g_autoptr(GHashTable) blockNamedNodeData = NULL;
++    GHashTable *blockNamedNodeData = NULL;
+     bool supports_flat = virQEMUCapsGet(priv->qemuCaps,
+                                         QEMU_CAPS_QMP_QUERY_NAMED_BLOCK_NODES_FLAT);
+ 
+@@ -3031,10 +3031,7 @@ qemuBlockGetNamedNodeData(virDomainObj *vm,
+ 
+     qemuDomainObjExitMonitor(driver, vm);
+ 
+-    if (!blockNamedNodeData)
+-        return NULL;
+-
+-    return g_steal_pointer(&blockNamedNodeData);
++    return blockNamedNodeData;
+ }
+ 
+ 
+-- 
+2.40.1

SOURCES/libvirt-qemu-relax-shared-memory-check-for-vhostuser-daemons.patch

@@ -0,0 +1,65 @@
+From e9418cec1ba24b6cf78f85bbbef8586ed612692a Mon Sep 17 00:00:00 2001
+Message-Id: <e9418cec1ba24b6cf78f85bbbef8586ed612692a@dist-git>
+From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
+Date: Mon, 13 Mar 2023 13:56:47 +0100
+Subject: [PATCH] qemu: relax shared memory check for vhostuser daemons
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+For some vhostuser daemons, we validate that the guest memory is shared
+with the host.
+
+With earlier versions of QEMU, it was only possible to mark memory
+as shared by defining an explicit NUMA topology.  Later, QEMU exposed
+the name of the default memory backend (defaultRAMid) so we can mark
+that memory as shared.
+
+Since libvirt commit:
+  commit bff2ad5d6b1f25da02802273934d2a519159fec7
+    qemu: Relax validation for mem->access if guest has no NUMA
+we already check for the case when user requests shared memory,
+but QEMU did not expose defaultRAMid.
+
+Drop the duplicit check from vhostuser device validation, to make
+it pass on hotplug even after libvirtd restart.
+
+This avoids the need to store the defaultRAMid, since we don't really
+need it for anything after the VM has been already started.
+
+https://bugzilla.redhat.com/show_bug.cgi?id=2078693
+https://bugzilla.redhat.com/show_bug.cgi?id=2177701
+
+Signed-off-by: Ján Tomko <jtomko@redhat.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit d5c7b7870e45575f81fffcb611c2546d0e02e778)
+Signed-off-by: Ján Tomko <jtomko@redhat.com>
+---
+ src/qemu/qemu_validate.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c
+index 7bc14293d6..4069f47c12 100644
+--- a/src/qemu/qemu_validate.c
++++ b/src/qemu/qemu_validate.c
+@@ -1588,16 +1588,12 @@ qemuValidateDomainVirtioOptions(const virDomainVirtioOptions *virtio,
+ static int
+ qemuValidateDomainDefVhostUserRequireSharedMemory(const virDomainDef *def,
+                                                   const char *name,
+-                                                  virQEMUCaps *qemuCaps)
++                                                  virQEMUCaps *qemuCaps G_GNUC_UNUSED)
+ {
+-    const char *defaultRAMId = virQEMUCapsGetMachineDefaultRAMid(qemuCaps,
+-                                                                 def->virtType,
+-                                                                 def->os.machine);
+     size_t numa_nodes = virDomainNumaGetNodeCount(def->numa);
+     size_t i;
+ 
+-    if (numa_nodes == 0 &&
+-        !(defaultRAMId && def->mem.access == VIR_DOMAIN_MEMORY_ACCESS_SHARED)) {
++    if (numa_nodes == 0 && def->mem.access != VIR_DOMAIN_MEMORY_ACCESS_SHARED) {
+         virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                        _("'%s' requires shared memory"), name);
+         return -1;
+-- 
+2.40.1

SOURCES/libvirt-qemuMonitorJSONBlockStatsUpdateCapacityBlockdev-Use-flat-mode-of-query-named-block-nodes.patch

@@ -0,0 +1,41 @@
+From f20062e1fe1e7bca8b97d2383f9e8a06f0f4111a Mon Sep 17 00:00:00 2001
+Message-Id: <f20062e1fe1e7bca8b97d2383f9e8a06f0f4111a@dist-git>
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Wed, 9 Nov 2022 11:06:25 +0100
+Subject: [PATCH] qemuMonitorJSONBlockStatsUpdateCapacityBlockdev: Use 'flat'
+ mode of query-named-block-nodes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+'query-named-block-nodes' in non-flat mode returns redundantly nested
+data under the 'backing-image' field. Fortunately we don't need it when
+updating the capacity stats.
+
+This function was unfortunately not fixed originally when the support
+for flat mode was added. Use the flat cached in the monitor object to
+force flat mode if available.
+
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+(cherry picked from commit bbd4d4899391b3bd1906cce61a3634f42f4b1bdf)
+https://bugzilla.redhat.com/show_bug.cgi?id=2170472
+---
+ src/qemu/qemu_monitor_json.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
+index 7d8755246f..789554e225 100644
+--- a/src/qemu/qemu_monitor_json.c
++++ b/src/qemu/qemu_monitor_json.c
+@@ -2679,7 +2679,7 @@ qemuMonitorJSONBlockStatsUpdateCapacityBlockdev(qemuMonitor *mon,
+ {
+     g_autoptr(virJSONValue) nodes = NULL;
+ 
+-    if (!(nodes = qemuMonitorJSONQueryNamedBlockNodes(mon, false)))
++    if (!(nodes = qemuMonitorJSONQueryNamedBlockNodes(mon, mon->queryNamedBlockNodesFlat)))
+         return -1;
+ 
+     if (virJSONValueArrayForeachSteal(nodes,
+-- 
+2.40.1

SOURCES/libvirt-qemu_namespace-Don-t-leak-memory-in-qemuDomainGetPreservedMounts.patch

@@ -0,0 +1,57 @@
+From 77b0485ba92fe5f0520321385af8a7581c286df1 Mon Sep 17 00:00:00 2001
+Message-Id: <77b0485ba92fe5f0520321385af8a7581c286df1@dist-git>
+From: Michal Privoznik <mprivozn@redhat.com>
+Date: Mon, 31 Oct 2022 15:38:13 +0100
+Subject: [PATCH] qemu_namespace: Don't leak memory in
+ qemuDomainGetPreservedMounts()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The aim of qemuDomainGetPreservedMounts() is to get a list of
+filesystems mounted under /dev and optionally generate a path for
+each one where they are moved temporarily when building the
+namespace. And the function tries to be a bit clever about it.
+For instance, if /dev/shm mount point exists, there's no need to
+consider /dev/shm/a nor /dev/shm/b as preserving just 'top level'
+/dev/shm gives the same result. To achieve this, the function
+iterates over the list of filesystem as returned by
+virFileGetMountSubtree() and removes the nested ones. However, it
+does so in a bit clumsy way: plain VIR_DELETE_ELEMENT() is used
+without freeing the string itself. Therefore, if all three
+aforementioned example paths appeared on the list, /dev/shm/a and
+/dev/shm/b strings would be leaked.
+
+And when I think about it more, there's no real need to shrink
+the array down (realloc()). It's going to be free()-d when
+returning from the function. Switch to
+VIR_DELETE_ELEMENT_INPLACE() then.
+
+Fixes: cdd9205dfffa3aaed935446a41f0d2dd1357c268
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+(cherry picked from commit bca7a53333ead7c1afd178728de74c2977cd4b5e)
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2166573
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+---
+ src/qemu/qemu_namespace.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/qemu/qemu_namespace.c b/src/qemu/qemu_namespace.c
+index 74ffd6fb90..2f50087c1d 100644
+--- a/src/qemu/qemu_namespace.c
++++ b/src/qemu/qemu_namespace.c
+@@ -160,7 +160,8 @@ qemuDomainGetPreservedMounts(virQEMUDriverConfig *cfg,
+ 
+             if (c && (*c == '/' || *c == '\0')) {
+                 VIR_DEBUG("Dropping path %s because of %s", mounts[j], mounts[i]);
+-                VIR_DELETE_ELEMENT(mounts, j, nmounts);
++                VIR_FREE(mounts[j]);
++                VIR_DELETE_ELEMENT_INPLACE(mounts, j, nmounts);
+             } else {
+                 j++;
+             }
+-- 
+2.39.1
+

SOURCES/libvirt-remote-check-for-negative-array-lengths-before-allocation.patch

@@ -0,0 +1,218 @@
+From cb42cd98d347deeee7c225d8d1e9f71f232cad29 Mon Sep 17 00:00:00 2001
+Message-ID: <cb42cd98d347deeee7c225d8d1e9f71f232cad29.1712647819.git.jdenemar@redhat.com>
+From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
+Date: Fri, 15 Mar 2024 10:47:50 +0000
+Subject: [PATCH] remote: check for negative array lengths before allocation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+While the C API entry points will validate non-negative lengths
+for various parameters, the RPC server de-serialization code
+will need to allocate memory for arrays before entering the C
+API. These allocations will thus happen before the non-negative
+length check is performed.
+
+Passing a negative length to the g_new0 function will usually
+result in a crash due to the negative length being treated as
+a huge positive number.
+
+This was found and diagnosed by ALT Linux Team with AFLplusplus.
+
+CVE-2024-2494
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+Found-by: Alexandr Shashkin <dutyrok@altlinux.org>
+Co-developed-by: Alexander Kuznetsov <kuznetsovam@altlinux.org>
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+(cherry picked from commit 8a3f8d957507c1f8223fdcf25a3ff885b15557f2)
+Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
+---
+ src/remote/remote_daemon_dispatch.c | 65 +++++++++++++++++++++++++++++
+ src/rpc/gendispatch.pl              |  5 +++
+ 2 files changed, 70 insertions(+)
+
+diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c
+index 689001889e..c193227926 100644
+--- a/src/remote/remote_daemon_dispatch.c
++++ b/src/remote/remote_daemon_dispatch.c
+@@ -2306,6 +2306,10 @@ remoteDispatchDomainGetSchedulerParameters(virNetServer *server G_GNUC_UNUSED,
+     if (!conn)
+         goto cleanup;
+ 
++    if (args->nparams < 0) {
++        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++        goto cleanup;
++    }
+     if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) {
+         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+         goto cleanup;
+@@ -2354,6 +2358,10 @@ remoteDispatchDomainGetSchedulerParametersFlags(virNetServer *server G_GNUC_UNUS
+     if (!conn)
+         goto cleanup;
+ 
++    if (args->nparams < 0) {
++        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++        goto cleanup;
++    }
+     if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) {
+         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+         goto cleanup;
+@@ -2512,6 +2520,10 @@ remoteDispatchDomainBlockStatsFlags(virNetServer *server G_GNUC_UNUSED,
+         goto cleanup;
+     flags = args->flags;
+ 
++    if (args->nparams < 0) {
++        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++        goto cleanup;
++    }
+     if (args->nparams > REMOTE_DOMAIN_BLOCK_STATS_PARAMETERS_MAX) {
+         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+         goto cleanup;
+@@ -2737,6 +2749,14 @@ remoteDispatchDomainGetVcpuPinInfo(virNetServer *server G_GNUC_UNUSED,
+     if (!(dom = get_nonnull_domain(conn, args->dom)))
+         goto cleanup;
+ 
++    if (args->ncpumaps < 0) {
++        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps must be non-negative"));
++        goto cleanup;
++    }
++    if (args->maplen < 0) {
++        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be non-negative"));
++        goto cleanup;
++    }
+     if (args->ncpumaps > REMOTE_VCPUINFO_MAX) {
+         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps > REMOTE_VCPUINFO_MAX"));
+         goto cleanup;
+@@ -2831,6 +2851,11 @@ remoteDispatchDomainGetEmulatorPinInfo(virNetServer *server G_GNUC_UNUSED,
+     if (!(dom = get_nonnull_domain(conn, args->dom)))
+         goto cleanup;
+ 
++    if (args->maplen < 0) {
++        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be non-negative"));
++        goto cleanup;
++    }
++
+     /* Allocate buffers to take the results */
+     if (args->maplen > 0)
+         cpumaps = g_new0(unsigned char, args->maplen);
+@@ -2878,6 +2903,14 @@ remoteDispatchDomainGetVcpus(virNetServer *server G_GNUC_UNUSED,
+     if (!(dom = get_nonnull_domain(conn, args->dom)))
+         goto cleanup;
+ 
++    if (args->maxinfo < 0) {
++        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be non-negative"));
++        goto cleanup;
++    }
++    if (args->maplen < 0) {
++        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be non-negative"));
++        goto cleanup;
++    }
+     if (args->maxinfo > REMOTE_VCPUINFO_MAX) {
+         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo > REMOTE_VCPUINFO_MAX"));
+         goto cleanup;
+@@ -3117,6 +3150,10 @@ remoteDispatchDomainGetMemoryParameters(virNetServer *server G_GNUC_UNUSED,
+ 
+     flags = args->flags;
+ 
++    if (args->nparams < 0) {
++        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++        goto cleanup;
++    }
+     if (args->nparams > REMOTE_DOMAIN_MEMORY_PARAMETERS_MAX) {
+         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+         goto cleanup;
+@@ -3177,6 +3214,10 @@ remoteDispatchDomainGetNumaParameters(virNetServer *server G_GNUC_UNUSED,
+ 
+     flags = args->flags;
+ 
++    if (args->nparams < 0) {
++        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++        goto cleanup;
++    }
+     if (args->nparams > REMOTE_DOMAIN_NUMA_PARAMETERS_MAX) {
+         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+         goto cleanup;
+@@ -3237,6 +3278,10 @@ remoteDispatchDomainGetBlkioParameters(virNetServer *server G_GNUC_UNUSED,
+ 
+     flags = args->flags;
+ 
++    if (args->nparams < 0) {
++        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++        goto cleanup;
++    }
+     if (args->nparams > REMOTE_DOMAIN_BLKIO_PARAMETERS_MAX) {
+         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+         goto cleanup;
+@@ -3298,6 +3343,10 @@ remoteDispatchNodeGetCPUStats(virNetServer *server G_GNUC_UNUSED,
+ 
+     flags = args->flags;
+ 
++    if (args->nparams < 0) {
++        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++        goto cleanup;
++    }
+     if (args->nparams > REMOTE_NODE_CPU_STATS_MAX) {
+         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+         goto cleanup;
+@@ -3365,6 +3414,10 @@ remoteDispatchNodeGetMemoryStats(virNetServer *server G_GNUC_UNUSED,
+ 
+     flags = args->flags;
+ 
++    if (args->nparams < 0) {
++        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++        goto cleanup;
++    }
+     if (args->nparams > REMOTE_NODE_MEMORY_STATS_MAX) {
+         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+         goto cleanup;
+@@ -3545,6 +3598,10 @@ remoteDispatchDomainGetBlockIoTune(virNetServer *server G_GNUC_UNUSED,
+     if (!conn)
+         goto cleanup;
+ 
++    if (args->nparams < 0) {
++        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++        goto cleanup;
++    }
+     if (args->nparams > REMOTE_DOMAIN_BLOCK_IO_TUNE_PARAMETERS_MAX) {
+         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+         goto cleanup;
+@@ -5087,6 +5144,10 @@ remoteDispatchDomainGetInterfaceParameters(virNetServer *server G_GNUC_UNUSED,
+ 
+     flags = args->flags;
+ 
++    if (args->nparams < 0) {
++        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++        goto cleanup;
++    }
+     if (args->nparams > REMOTE_DOMAIN_INTERFACE_PARAMETERS_MAX) {
+         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+         goto cleanup;
+@@ -5307,6 +5368,10 @@ remoteDispatchNodeGetMemoryParameters(virNetServer *server G_GNUC_UNUSED,
+ 
+     flags = args->flags;
+ 
++    if (args->nparams < 0) {
++        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
++        goto cleanup;
++    }
+     if (args->nparams > REMOTE_NODE_MEMORY_PARAMETERS_MAX) {
+         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
+         goto cleanup;
+diff --git a/src/rpc/gendispatch.pl b/src/rpc/gendispatch.pl
+index 9f5bf0e316..aacab88808 100755
+--- a/src/rpc/gendispatch.pl
++++ b/src/rpc/gendispatch.pl
+@@ -1074,6 +1074,11 @@ elsif ($mode eq "server") {
+         print "\n";
+ 
+         if ($single_ret_as_list) {
++            print "    if (args->$single_ret_list_max_var < 0) {\n";
++            print "        virReportError(VIR_ERR_RPC,\n";
++            print "                       \"%s\", _(\"max$single_ret_list_name must be non-negative\"));\n";
++            print "        goto cleanup;\n";
++            print "    }\n";
+             print "    if (args->$single_ret_list_max_var > $single_ret_list_max_define) {\n";
+             print "        virReportError(VIR_ERR_RPC,\n";
+             print "                       \"%s\", _(\"max$single_ret_list_name > $single_ret_list_max_define\"));\n";
+-- 
+2.44.0

SOURCES/libvirt-rpc-Fix-memory-leak-of-fds.patch

@@ -0,0 +1,36 @@
+From 0f6009e5a8ca63388772597f3e42c71b50635a02 Mon Sep 17 00:00:00 2001
+Message-Id: <0f6009e5a8ca63388772597f3e42c71b50635a02@dist-git>
+From: Peng Liang <liangpeng10@huawei.com>
+Date: Wed, 2 Mar 2022 17:22:05 +0800
+Subject: [PATCH] rpc: Fix memory leak of fds
+
+In virSystemdActivationClaimFDs, the memory of ent->fds has been stolen
+and stored in fds, but fds is never freed, which causes a memory leak.
+Fix it by declaring fds as g_autofree.
+
+Reported-by: Jie Tang <tangjie18@huawei.com>
+Signed-off-by: Peng Liang <liangpeng10@huawei.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 8a1915c4d6c33669dcb390d0708cb6e5d651770d)
+https://bugzilla.redhat.com/show_bug.cgi?id=2165428
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+---
+ src/rpc/virnetserver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/rpc/virnetserver.c b/src/rpc/virnetserver.c
+index ad581a36dd..d9430a2cfa 100644
+--- a/src/rpc/virnetserver.c
++++ b/src/rpc/virnetserver.c
+@@ -655,7 +655,7 @@ virNetServerAddServiceActivation(virNetServer *srv,
+                                  size_t max_queued_clients,
+                                  size_t nrequests_client_max)
+ {
+-    int *fds;
++    g_autofree int *fds = NULL;
+     size_t nfds;
+ 
+     if (act == NULL)
+-- 
+2.39.1
+

SOURCES/libvirt-rpc-ensure-temporary-GSource-is-removed-from-client-event-loop.patch

@@ -0,0 +1,101 @@
+From b84d0a699f3976644d3090562ce62ede55335fbc Mon Sep 17 00:00:00 2001
+Message-ID: <b84d0a699f3976644d3090562ce62ede55335fbc.1717684031.git.jdenemar@redhat.com>
+From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
+Date: Tue, 30 Apr 2024 11:51:15 +0100
+Subject: [PATCH] rpc: ensure temporary GSource is removed from client event
+ loop
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Users are seeing periodic segfaults from libvirt client apps,
+especially thread heavy ones like virt-manager. A typical
+stack trace would end up in the virNetClientIOEventFD method,
+with illegal access to stale stack data. eg
+
+==238721==ERROR: AddressSanitizer: stack-use-after-return on address 0x75cd18709788 at pc 0x75cd3111f907 bp 0x75cd181ff550 sp 0x75cd181ff548
+WRITE of size 4 at 0x75cd18709788 thread T11
+    #0 0x75cd3111f906 in virNetClientIOEventFD /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:1634:15
+    #1 0x75cd3210d198  (/usr/lib/libglib-2.0.so.0+0x5a198) (BuildId: 0a2311dfbbc6c215dc36f4b6bdd2b4b6fbae55a2)
+    #2 0x75cd3216c3be  (/usr/lib/libglib-2.0.so.0+0xb93be) (BuildId: 0a2311dfbbc6c215dc36f4b6bdd2b4b6fbae55a2)
+    #3 0x75cd3210ddc6 in g_main_loop_run (/usr/lib/libglib-2.0.so.0+0x5adc6) (BuildId: 0a2311dfbbc6c215dc36f4b6bdd2b4b6fbae55a2)
+    #4 0x75cd3111a47c in virNetClientIOEventLoop /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:1722:9
+    #5 0x75cd3111a47c in virNetClientIO /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:2002:10
+    #6 0x75cd3111a47c in virNetClientSendInternal /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:2170:11
+    #7 0x75cd311198a8 in virNetClientSendWithReply /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:2198:11
+    #8 0x75cd31111653 in virNetClientProgramCall /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclientprogram.c:318:9
+    #9 0x75cd31241c8f in callFull /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/remote/remote_driver.c:6054:10
+    #10 0x75cd31241c8f in call /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/remote/remote_driver.c:6076:12
+    #11 0x75cd31241c8f in remoteNetworkGetXMLDesc /usr/src/debug/libvirt/libvirt-10.2.0/build/src/remote/remote_client_bodies.h:5959:9
+    #12 0x75cd31410ff7 in virNetworkGetXMLDesc /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/libvirt-network.c:952:15
+
+The root cause is a bad assumption in the virNetClientIOEventLoop
+method. This method is run by whichever thread currently owns the
+buck, and is responsible for handling I/O. Inside a for(;;) loop,
+this method creates a temporary GSource, adds it to the event loop
+and runs g_main_loop_run(). When I/O is ready, the GSource callback
+(virNetClientIOEventFD) will fire and call g_main_loop_quit(), and
+return G_SOURCE_REMOVE which results in the temporary GSource being
+destroyed. A g_autoptr() will then remove the last reference.
+
+What was overlooked, is that a second thread can come along and
+while it can't enter virNetClientIOEventLoop, it will register an
+idle source that uses virNetClientIOWakeup to interrupt the
+original thread's 'g_main_loop_run' call. When this happens the
+virNetClientIOEventFD callback never runs, and so the temporary
+GSource is not destroyed. The g_autoptr() will remove a reference,
+but by virtue of still being attached to the event context, there
+is an extra reference held causing GSource to be leaked. The
+next time 'g_main_loop_run' is called, the original GSource will
+trigger its callback, and access data that was allocated on the
+stack by the previous thread, and likely SEGV.
+
+To solve this, the thread calling 'g_main_loop_run' must call
+g_source_destroy, immediately upon return, to guarantee that
+the temporary GSource is removed.
+
+CVE-2024-4418
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+Reported-by: Martin Shirokov <shirokovmartin@gmail.com>
+Tested-by: Martin Shirokov <shirokovmartin@gmail.com>
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+(cherry picked from commit 8074d64dc2eca846d6a61efe1a9b7428a0ce1dd1)
+Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
+---
+ src/rpc/virnetclient.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/src/rpc/virnetclient.c b/src/rpc/virnetclient.c
+index f526ad89ec..b9490072c3 100644
+--- a/src/rpc/virnetclient.c
++++ b/src/rpc/virnetclient.c
+@@ -1664,7 +1664,7 @@ static int virNetClientIOEventLoop(virNetClient *client,
+ #endif /* !WIN32 */
+         int timeout = -1;
+         virNetMessage *msg = NULL;
+-        g_autoptr(GSource) G_GNUC_UNUSED source = NULL;
++        g_autoptr(GSource) source = NULL;
+         GIOCondition ev = 0;
+         struct virNetClientIOEventData data = {
+             .client = client,
+@@ -1728,6 +1728,18 @@ static int virNetClientIOEventLoop(virNetClient *client,
+ 
+         g_main_loop_run(client->eventLoop);
+ 
++        /*
++         * If virNetClientIOEventFD ran, this GSource will already be
++         * destroyed due to G_SOURCE_REMOVE. It is harmless to re-destroy
++         * it, since we still own a reference.
++         *
++         * If virNetClientIOWakeup ran, it will have interrupted the
++         * g_main_loop_run call, before virNetClientIOEventFD could
++         * run, and thus the GSource is still registered, and we need
++         * to destroy it since it is referencing stack memory for 'data'
++         */
++        g_source_destroy(source);
++
+ #ifndef WIN32
+         ignore_value(pthread_sigmask(SIG_SETMASK, &oldmask, NULL));
+ #endif /* !WIN32 */
+-- 
+2.45.1

SOURCES/libvirt-schemas-refactor-out-nodedev-ccw-address-schema.patch

@@ -0,0 +1,64 @@
+From eb17cd2553366491b54c834b00fd953e94ef0bd2 Mon Sep 17 00:00:00 2001
+Message-Id: <eb17cd2553366491b54c834b00fd953e94ef0bd2@dist-git>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Fri, 13 May 2022 12:31:14 +0200
+Subject: [PATCH] schemas: refactor out nodedev ccw address schema
+
+Refactor out nodedev ccw address schema for easy reuse later.
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit e9ba2ced0b6bdcf6ed4c4b38d8f3fc63b6fa6d59)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ docs/schemas/nodedev.rng | 22 +++++++++-------------
+ 1 file changed, 9 insertions(+), 13 deletions(-)
+
+diff --git a/docs/schemas/nodedev.rng b/docs/schemas/nodedev.rng
+index e4733f0804..29515d2d7e 100644
+--- a/docs/schemas/nodedev.rng
++++ b/docs/schemas/nodedev.rng
+@@ -653,10 +653,7 @@
+     </interleave>
+   </define>
+ 
+-  <define name="capccwdev">
+-    <attribute name="type">
+-      <value>ccw</value>
+-    </attribute>
++  <define name="capccwaddress">
+     <element name="cssid">
+       <ref name="ccwCssidRange"/>
+     </element>
+@@ -668,19 +665,18 @@
+     </element>
+   </define>
+ 
++  <define name="capccwdev">
++    <attribute name="type">
++      <value>ccw</value>
++    </attribute>
++    <ref name="capccwaddress"/>
++  </define>
++
+   <define name="capcssdev">
+     <attribute name="type">
+       <value>css</value>
+     </attribute>
+-    <element name="cssid">
+-      <ref name="ccwCssidRange"/>
+-    </element>
+-    <element name="ssid">
+-      <ref name="ccwSsidRange"/>
+-    </element>
+-    <element name="devno">
+-      <ref name="ccwDevnoRange"/>
+-    </element>
++    <ref name="capccwaddress"/>
+     <optional>
+       <ref name="mdev_types"/>
+     </optional>
+-- 
+2.39.1
+

SOURCES/libvirt-util-Fix-error-return-for-virProcessKillPainfullyDelay.patch

@@ -0,0 +1,39 @@
+From ffbae27bd15ae9475fd4f0e79b492a7e03bca93e Mon Sep 17 00:00:00 2001
+Message-ID: <ffbae27bd15ae9475fd4f0e79b492a7e03bca93e.1717684031.git.jdenemar@redhat.com>
+From: Jonathon Jongsma <jjongsma@redhat.com>
+Date: Fri, 22 Sep 2023 14:23:10 -0500
+Subject: [PATCH] util: Fix error return for virProcessKillPainfullyDelay()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Commit 93af79fb removed a cleanup label in favor of returning error
+values directly in certain cases. But the final return value was changed
+from -1 to 0. If we get to the end of the function, that means that
+we've waited for the process to exit but it still exists. So we should
+return -1. The error message was still being set correctly, but we were
+returning a success status (0).
+
+Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+(cherry picked from commit 51a074e74c6ef2fb95e6f53d41315e3f1e00be77)
+https://issues.redhat.com/browse/RHEL-36064
+---
+ src/util/virprocess.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/util/virprocess.c b/src/util/virprocess.c
+index b559a4257e..f3933a2d16 100644
+--- a/src/util/virprocess.c
++++ b/src/util/virprocess.c
+@@ -471,7 +471,7 @@ virProcessKillPainfullyDelay(pid_t pid, bool force, unsigned int extradelay, boo
+                          _("Failed to terminate process %lld with SIG%s"),
+                          (long long)pid, signame);
+ 
+-    return 0;
++    return -1;
+ }
+ 
+ 
+-- 
+2.45.1

SOURCES/libvirt-util-add-ccw-device-address-parsing-into-virccw.patch

@@ -0,0 +1,107 @@
+From 6d9fc3310cedf321f54530c0652998b67979e613 Mon Sep 17 00:00:00 2001
+Message-Id: <6d9fc3310cedf321f54530c0652998b67979e613@dist-git>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Fri, 13 May 2022 12:31:09 +0200
+Subject: [PATCH] util: add ccw device address parsing into virccw
+
+Add virCCWDeviceAddressParseFromString and use it in nodedev udev.
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 8d52f99f0b55ddfee4e0c00e756ca6c01250107d)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/libvirt_private.syms           |  1 +
+ src/node_device/node_device_udev.c |  8 +++++---
+ src/util/virccw.c                  | 18 ++++++++++++++++++
+ src/util/virccw.h                  |  5 +++++
+ 4 files changed, 29 insertions(+), 3 deletions(-)
+
+diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
+index 44b551fb60..6f1292e0c4 100644
+--- a/src/libvirt_private.syms
++++ b/src/libvirt_private.syms
+@@ -1904,6 +1904,7 @@ virCCWDeviceAddressAsString;
+ virCCWDeviceAddressEqual;
+ virCCWDeviceAddressIncrement;
+ virCCWDeviceAddressIsValid;
++virCCWDeviceAddressParseFromString;
+ 
+ 
+ # util/vircgroup.h
+diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c
+index a9e8bf10da..ffcb3e8640 100644
+--- a/src/node_device/node_device_udev.c
++++ b/src/node_device/node_device_udev.c
+@@ -36,6 +36,7 @@
+ #include "viruuid.h"
+ #include "virbuffer.h"
+ #include "virfile.h"
++#include "virccw.h"
+ #include "virpci.h"
+ #include "virpidfile.h"
+ #include "virstring.h"
+@@ -1090,9 +1091,10 @@ udevGetCCWAddress(const char *sysfs_path,
+     char *p;
+ 
+     if ((p = strrchr(sysfs_path, '/')) == NULL ||
+-        virStrToLong_ui(p + 1, &p, 16, &data->ccw_dev.cssid) < 0 || p == NULL ||
+-        virStrToLong_ui(p + 1, &p, 16, &data->ccw_dev.ssid) < 0 || p == NULL ||
+-        virStrToLong_ui(p + 1, &p, 16, &data->ccw_dev.devno) < 0) {
++        virCCWDeviceAddressParseFromString(p + 1,
++                                           &data->ccw_dev.cssid,
++                                           &data->ccw_dev.ssid,
++                                           &data->ccw_dev.devno) < 0) {
+         virReportError(VIR_ERR_INTERNAL_ERROR,
+                        _("failed to parse the CCW address from sysfs path: '%s'"),
+                        sysfs_path);
+diff --git a/src/util/virccw.c b/src/util/virccw.c
+index e2785bd9ab..33df1c2428 100644
+--- a/src/util/virccw.c
++++ b/src/util/virccw.c
+@@ -20,6 +20,7 @@
+ 
+ #include <config.h>
+ #include "virccw.h"
++#include "virstring.h"
+ 
+ 
+ bool
+@@ -60,3 +61,20 @@ virCCWDeviceAddressIncrement(virCCWDeviceAddress *addr)
+     *addr = ccwaddr;
+     return 0;
+ }
++
++int
++virCCWDeviceAddressParseFromString(const char *address,
++                                   unsigned int *cssid,
++                                   unsigned int *ssid,
++                                   unsigned int *devno)
++{
++    char *p;
++
++    if (address == NULL || virStrToLong_ui(address, &p, 16, cssid) < 0 ||
++        p == NULL || virStrToLong_ui(p + 1, &p, 16, ssid) < 0 ||
++        p == NULL || virStrToLong_ui(p + 1, &p, 16, devno) < 0) {
++        return -1;
++    }
++
++    return 0;
++}
+diff --git a/src/util/virccw.h b/src/util/virccw.h
+index aebbd4ab6d..df0273bcac 100644
+--- a/src/util/virccw.h
++++ b/src/util/virccw.h
+@@ -42,3 +42,8 @@ bool virCCWDeviceAddressEqual(virCCWDeviceAddress *addr1,
+ char* virCCWDeviceAddressAsString(virCCWDeviceAddress *addr)
+     ATTRIBUTE_NONNULL(1);
+ int virCCWDeviceAddressIncrement(virCCWDeviceAddress *addr);
++
++int virCCWDeviceAddressParseFromString(const char *address,
++                                       unsigned int *cssid,
++                                       unsigned int *ssid,
++                                       unsigned int *devno);
+-- 
+2.39.1
+

SOURCES/libvirt-util-add-virCCWDeviceAddressFromString-to-virccw.patch

@@ -0,0 +1,107 @@
+From e5e849999b1d615c6a371839aeead37275599cf0 Mon Sep 17 00:00:00 2001
+Message-Id: <e5e849999b1d615c6a371839aeead37275599cf0@dist-git>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Fri, 13 May 2022 12:31:10 +0200
+Subject: [PATCH] util: add virCCWDeviceAddressFromString to virccw
+
+Add a method to parse a ccw device address from a string.
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 9453eb458a5c3ed6687188233d7e389c3e20c266)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
+Conflicts:
+	po/POTFILES (file is called POTFILES.in in downstream)
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ po/POTFILES.in           |  1 +
+ src/libvirt_private.syms |  1 +
+ src/util/virccw.c        | 23 +++++++++++++++++++++++
+ src/util/virccw.h        |  3 +++
+ 4 files changed, 28 insertions(+)
+
+diff --git a/po/POTFILES.in b/po/POTFILES.in
+index bf0a3b3529..327e20ec11 100644
+--- a/po/POTFILES.in
++++ b/po/POTFILES.in
+@@ -246,6 +246,7 @@
+ @SRCDIR@src/util/virauth.c
+ @SRCDIR@src/util/virauthconfig.c
+ @SRCDIR@src/util/virbitmap.c
++@SRCDIR@src/util/virccw.c
+ @SRCDIR@src/util/vircgroup.c
+ @SRCDIR@src/util/vircgroupbackend.c
+ @SRCDIR@src/util/vircgroupbackend.h
+diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
+index 6f1292e0c4..7c558ad364 100644
+--- a/src/libvirt_private.syms
++++ b/src/libvirt_private.syms
+@@ -1902,6 +1902,7 @@ virBufferVasprintf;
+ # util/virccw.h
+ virCCWDeviceAddressAsString;
+ virCCWDeviceAddressEqual;
++virCCWDeviceAddressFromString;
+ virCCWDeviceAddressIncrement;
+ virCCWDeviceAddressIsValid;
+ virCCWDeviceAddressParseFromString;
+diff --git a/src/util/virccw.c b/src/util/virccw.c
+index 33df1c2428..d741743050 100644
+--- a/src/util/virccw.c
++++ b/src/util/virccw.c
+@@ -20,8 +20,11 @@
+ 
+ #include <config.h>
+ #include "virccw.h"
++#include "virerror.h"
+ #include "virstring.h"
+ 
++#define VIR_FROM_THIS VIR_FROM_NONE
++
+ 
+ bool
+ virCCWDeviceAddressIsValid(virCCWDeviceAddress *addr)
+@@ -49,6 +52,26 @@ virCCWDeviceAddressAsString(virCCWDeviceAddress *addr)
+     return g_strdup_printf(VIR_CCW_DEVICE_ADDRESS_FMT, addr->cssid, addr->ssid, addr->devno);
+ }
+ 
++virCCWDeviceAddress *
++virCCWDeviceAddressFromString(const char *address)
++{
++    g_autofree virCCWDeviceAddress *ccw = NULL;
++
++    ccw = g_new0(virCCWDeviceAddress, 1);
++
++    if (virCCWDeviceAddressParseFromString(address,
++                                           &ccw->cssid,
++                                           &ccw->ssid,
++                                           &ccw->devno) < 0) {
++        virReportError(VIR_ERR_INTERNAL_ERROR,
++                       _("Failed to parse CCW address '%s'"),
++                       address);
++        return NULL;
++    }
++
++    return g_steal_pointer(&ccw);
++}
++
+ int
+ virCCWDeviceAddressIncrement(virCCWDeviceAddress *addr)
+ {
+diff --git a/src/util/virccw.h b/src/util/virccw.h
+index df0273bcac..80cc716811 100644
+--- a/src/util/virccw.h
++++ b/src/util/virccw.h
+@@ -41,6 +41,9 @@ bool virCCWDeviceAddressEqual(virCCWDeviceAddress *addr1,
+ 
+ char* virCCWDeviceAddressAsString(virCCWDeviceAddress *addr)
+     ATTRIBUTE_NONNULL(1);
++virCCWDeviceAddress *virCCWDeviceAddressFromString(const char *address)
++    ATTRIBUTE_NONNULL(1);
++
+ int virCCWDeviceAddressIncrement(virCCWDeviceAddress *addr);
+ 
+ int virCCWDeviceAddressParseFromString(const char *address,
+-- 
+2.39.1
+

SOURCES/libvirt-util-make-reuse-of-ccw-device-address-format-constant.patch

@@ -0,0 +1,70 @@
+From 94a416e1b67c72c69c19944937acc619503484b3 Mon Sep 17 00:00:00 2001
+Message-Id: <94a416e1b67c72c69c19944937acc619503484b3@dist-git>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Fri, 13 May 2022 12:31:03 +0200
+Subject: [PATCH] util: make reuse of ccw device address format constant
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit b41163005c0874b1d4809523227cd1921f4852d2)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/conf/device_conf.h  | 1 -
+ src/qemu/qemu_command.c | 2 +-
+ src/util/virccw.c       | 2 +-
+ src/util/virccw.h       | 2 ++
+ 4 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/src/conf/device_conf.h b/src/conf/device_conf.h
+index 60d90bbf19..950d333e2e 100644
+--- a/src/conf/device_conf.h
++++ b/src/conf/device_conf.h
+@@ -202,7 +202,6 @@ int virDomainDeviceCCWAddressParseXML(xmlNodePtr node,
+                                       virCCWDeviceAddress *addr);
+ bool virDomainDeviceCCWAddressEqual(virCCWDeviceAddress *addr1,
+                                     virCCWDeviceAddress *addr2);
+-#define VIR_CCW_DEVICE_ADDRESS_FMT "%x.%x.%04x"
+ 
+ int virDomainDeviceDriveAddressParseXML(xmlNodePtr node,
+                                         virDomainDeviceDriveAddress *addr);
+diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
+index d23af97e0c..a7855d3370 100644
+--- a/src/qemu/qemu_command.c
++++ b/src/qemu/qemu_command.c
+@@ -613,7 +613,7 @@ qemuBuildDeviceAddressProps(virJSONValue *props,
+         return 0;
+ 
+     case VIR_DOMAIN_DEVICE_ADDRESS_TYPE_CCW: {
+-        g_autofree char *devno = g_strdup_printf("%x.%x.%04x",
++        g_autofree char *devno = g_strdup_printf(VIR_CCW_DEVICE_ADDRESS_FMT,
+                                                  info->addr.ccw.cssid,
+                                                  info->addr.ccw.ssid,
+                                                  info->addr.ccw.devno);
+diff --git a/src/util/virccw.c b/src/util/virccw.c
+index 409287b380..5a19d3a112 100644
+--- a/src/util/virccw.c
++++ b/src/util/virccw.c
+@@ -25,5 +25,5 @@
+ char*
+ virCCWDeviceAddressAsString(virCCWDeviceAddress *addr)
+ {
+-    return g_strdup_printf("%x.%x.%04x", addr->cssid, addr->ssid, addr->devno);
++    return g_strdup_printf(VIR_CCW_DEVICE_ADDRESS_FMT, addr->cssid, addr->ssid, addr->devno);
+ }
+diff --git a/src/util/virccw.h b/src/util/virccw.h
+index 21a03406fa..127359c299 100644
+--- a/src/util/virccw.h
++++ b/src/util/virccw.h
+@@ -22,6 +22,8 @@
+ 
+ #include "internal.h"
+ 
++#define VIR_CCW_DEVICE_ADDRESS_FMT "%x.%x.%04x"
++
+ typedef struct _virCCWDeviceAddress virCCWDeviceAddress;
+ struct _virCCWDeviceAddress {
+     unsigned int cssid;
+-- 
+2.39.1
+

SOURCES/libvirt-util-refactor-ccw-address-constants-into-virccw.patch

@@ -0,0 +1,80 @@
+From 58d2890501a5a58eefa0500e1340112bc2264a70 Mon Sep 17 00:00:00 2001
+Message-Id: <58d2890501a5a58eefa0500e1340112bc2264a70@dist-git>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Fri, 13 May 2022 12:31:04 +0200
+Subject: [PATCH] util: refactor ccw address constants into virccw
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 5fe90d471a312a5c94668f8ed4bb397fdc894c58)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/conf/device_conf.c | 6 +++---
+ src/conf/device_conf.h | 4 ----
+ src/conf/domain_addr.c | 2 +-
+ src/util/virccw.h      | 3 +++
+ 4 files changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/src/conf/device_conf.c b/src/conf/device_conf.c
+index 92b908b2e6..bdc9219f84 100644
+--- a/src/conf/device_conf.c
++++ b/src/conf/device_conf.c
+@@ -261,9 +261,9 @@ virPCIDeviceAddressFormat(virBuffer *buf,
+ bool
+ virDomainDeviceCCWAddressIsValid(virCCWDeviceAddress *addr)
+ {
+-    return addr->cssid <= VIR_DOMAIN_DEVICE_CCW_MAX_CSSID &&
+-           addr->ssid <= VIR_DOMAIN_DEVICE_CCW_MAX_SSID &&
+-           addr->devno <= VIR_DOMAIN_DEVICE_CCW_MAX_DEVNO;
++    return addr->cssid <= VIR_CCW_DEVICE_MAX_CSSID &&
++           addr->ssid <= VIR_CCW_DEVICE_MAX_SSID &&
++           addr->devno <= VIR_CCW_DEVICE_MAX_DEVNO;
+ }
+ 
+ int
+diff --git a/src/conf/device_conf.h b/src/conf/device_conf.h
+index 950d333e2e..5c4b7b2f8e 100644
+--- a/src/conf/device_conf.h
++++ b/src/conf/device_conf.h
+@@ -70,10 +70,6 @@ struct _virDomainDeviceVirtioSerialAddress {
+     unsigned int port;
+ };
+ 
+-#define VIR_DOMAIN_DEVICE_CCW_MAX_CSSID    254
+-#define VIR_DOMAIN_DEVICE_CCW_MAX_SSID       3
+-#define VIR_DOMAIN_DEVICE_CCW_MAX_DEVNO  65535
+-
+ typedef struct _virDomainDeviceCcidAddress virDomainDeviceCcidAddress;
+ struct _virDomainDeviceCcidAddress {
+     unsigned int controller;
+diff --git a/src/conf/domain_addr.c b/src/conf/domain_addr.c
+index bf51ef5e5a..655f3cc09e 100644
+--- a/src/conf/domain_addr.c
++++ b/src/conf/domain_addr.c
+@@ -1292,7 +1292,7 @@ virDomainCCWAddressIncrement(virCCWDeviceAddress *addr)
+     virCCWDeviceAddress ccwaddr = *addr;
+ 
+     /* We are not touching subchannel sets and channel subsystems */
+-    if (++ccwaddr.devno > VIR_DOMAIN_DEVICE_CCW_MAX_DEVNO)
++    if (++ccwaddr.devno > VIR_CCW_DEVICE_MAX_DEVNO)
+         return -1;
+ 
+     *addr = ccwaddr;
+diff --git a/src/util/virccw.h b/src/util/virccw.h
+index 127359c299..c3a47127f1 100644
+--- a/src/util/virccw.h
++++ b/src/util/virccw.h
+@@ -22,6 +22,9 @@
+ 
+ #include "internal.h"
+ 
++#define VIR_CCW_DEVICE_MAX_CSSID    254
++#define VIR_CCW_DEVICE_MAX_SSID       3
++#define VIR_CCW_DEVICE_MAX_DEVNO  65535
+ #define VIR_CCW_DEVICE_ADDRESS_FMT "%x.%x.%04x"
+ 
+ typedef struct _virCCWDeviceAddress virCCWDeviceAddress;
+-- 
+2.39.1
+

SOURCES/libvirt-util-refactor-virDomainCCWAddressAsString-into-virccw.patch

@@ -0,0 +1,194 @@
+From 531244b8147f8972e56b6ba2c7ecf04c072f296a Mon Sep 17 00:00:00 2001
+Message-Id: <531244b8147f8972e56b6ba2c7ecf04c072f296a@dist-git>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Fri, 13 May 2022 12:31:02 +0200
+Subject: [PATCH] util: refactor virDomainCCWAddressAsString into virccw
+
+Move virDomainCCWAddressAsString into virccw and rename method as
+virCCWDeviceAddressAsString.
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 1df0a1986978dcb7d1fc139f14adbc4f85b1851f)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/conf/domain_addr.c               | 12 +++---------
+ src/conf/domain_addr.h               |  3 ---
+ src/conf/domain_conf.c               |  2 +-
+ src/libvirt_private.syms             |  5 ++++-
+ src/node_device/node_device_driver.c |  2 +-
+ src/util/meson.build                 |  1 +
+ src/util/virccw.c                    | 29 ++++++++++++++++++++++++++++
+ src/util/virccw.h                    |  3 +++
+ 8 files changed, 42 insertions(+), 15 deletions(-)
+ create mode 100644 src/util/virccw.c
+
+diff --git a/src/conf/domain_addr.c b/src/conf/domain_addr.c
+index d584d3b8a8..bf51ef5e5a 100644
+--- a/src/conf/domain_addr.c
++++ b/src/conf/domain_addr.c
+@@ -1286,12 +1286,6 @@ virDomainPCIAddressSetAllMulti(virDomainDef *def)
+ }
+ 
+ 
+-char*
+-virDomainCCWAddressAsString(virCCWDeviceAddress *addr)
+-{
+-    return g_strdup_printf("%x.%x.%04x", addr->cssid, addr->ssid, addr->devno);
+-}
+-
+ static int
+ virDomainCCWAddressIncrement(virCCWDeviceAddress *addr)
+ {
+@@ -1317,7 +1311,7 @@ virDomainCCWAddressAssign(virDomainDeviceInfo *dev,
+         return 0;
+ 
+     if (!autoassign && dev->addr.ccw.assigned) {
+-        if (!(addr = virDomainCCWAddressAsString(&dev->addr.ccw)))
++        if (!(addr = virCCWDeviceAddressAsString(&dev->addr.ccw)))
+             return -1;
+ 
+         if (virHashLookup(addrs->defined, addr)) {
+@@ -1327,7 +1321,7 @@ virDomainCCWAddressAssign(virDomainDeviceInfo *dev,
+             return -1;
+         }
+     } else if (autoassign && !dev->addr.ccw.assigned) {
+-        if (!(addr = virDomainCCWAddressAsString(&addrs->next)))
++        if (!(addr = virCCWDeviceAddressAsString(&addrs->next)))
+             return -1;
+ 
+         while (virHashLookup(addrs->defined, addr)) {
+@@ -1337,7 +1331,7 @@ virDomainCCWAddressAssign(virDomainDeviceInfo *dev,
+                 return -1;
+             }
+             VIR_FREE(addr);
+-            if (!(addr = virDomainCCWAddressAsString(&addrs->next)))
++            if (!(addr = virCCWDeviceAddressAsString(&addrs->next)))
+                 return -1;
+         }
+         dev->addr.ccw = addrs->next;
+diff --git a/src/conf/domain_addr.h b/src/conf/domain_addr.h
+index c8d069e07e..a67851c327 100644
+--- a/src/conf/domain_addr.h
++++ b/src/conf/domain_addr.h
+@@ -205,9 +205,6 @@ int virDomainCCWAddressAssign(virDomainDeviceInfo *dev,
+     ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2);
+ void virDomainCCWAddressSetFree(virDomainCCWAddressSet *addrs);
+ 
+-char* virDomainCCWAddressAsString(virCCWDeviceAddress *addr)
+-    ATTRIBUTE_NONNULL(1);
+-
+ virDomainCCWAddressSet *
+ virDomainCCWAddressSetCreateFromDomain(virDomainDef *def)
+     ATTRIBUTE_NONNULL(1);
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index ad3bd56da0..17383fc878 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -15793,7 +15793,7 @@ virDomainNetFindIdx(virDomainDef *def, virDomainNetDef *net)
+         alias = net->info.alias;
+ 
+     if (CCWAddrSpecified)
+-        addr = virDomainCCWAddressAsString(&net->info.addr.ccw);
++        addr = virCCWDeviceAddressAsString(&net->info.addr.ccw);
+     else if (PCIAddrSpecified)
+         addr = virPCIDeviceAddressAsString(&net->info.addr.pci);
+     else
+diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
+index 568b0f34a1..e8d3edb0fe 100644
+--- a/src/libvirt_private.syms
++++ b/src/libvirt_private.syms
+@@ -147,7 +147,6 @@ virPCIDeviceAddressParseXML;
+ 
+ # conf/domain_addr.h
+ virDomainCCWAddressAssign;
+-virDomainCCWAddressAsString;
+ virDomainCCWAddressSetCreateFromDomain;
+ virDomainCCWAddressSetFree;
+ virDomainPCIAddressBusIsFullyReserved;
+@@ -1902,6 +1901,10 @@ virBufferUse;
+ virBufferVasprintf;
+ 
+ 
++# util/virccw.h
++virCCWDeviceAddressAsString;
++
++
+ # util/vircgroup.h
+ virCgroupAddMachineProcess;
+ virCgroupAddProcess;
+diff --git a/src/node_device/node_device_driver.c b/src/node_device/node_device_driver.c
+index b0abf59618..e6ab4bb94c 100644
+--- a/src/node_device/node_device_driver.c
++++ b/src/node_device/node_device_driver.c
+@@ -682,7 +682,7 @@ nodeDeviceObjFormatAddress(virNodeDeviceObj *obj)
+                 .devno = caps->data.ccw_dev.devno
+             };
+ 
+-            addr = virDomainCCWAddressAsString(&ccw_addr);
++            addr = virCCWDeviceAddressAsString(&ccw_addr);
+             break;
+             }
+ 
+diff --git a/src/util/meson.build b/src/util/meson.build
+index 24350a3e67..13ed105798 100644
+--- a/src/util/meson.build
++++ b/src/util/meson.build
+@@ -9,6 +9,7 @@ util_sources = [
+   'virbitmap.c',
+   'virbpf.c',
+   'virbuffer.c',
++  'virccw.c',
+   'vircgroup.c',
+   'vircgroupbackend.c',
+   'vircgroupv1.c',
+diff --git a/src/util/virccw.c b/src/util/virccw.c
+new file mode 100644
+index 0000000000..409287b380
+--- /dev/null
++++ b/src/util/virccw.c
+@@ -0,0 +1,29 @@
++/*
++ * virccw.c: helper APIs for managing host CCW devices
++ *
++ * Copyright (C) 2022 IBM Corporation
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2.1 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public
++ * License along with this library.  If not, see
++ * <http://www.gnu.org/licenses/>.
++ */
++
++#include <config.h>
++#include "virccw.h"
++
++
++char*
++virCCWDeviceAddressAsString(virCCWDeviceAddress *addr)
++{
++    return g_strdup_printf("%x.%x.%04x", addr->cssid, addr->ssid, addr->devno);
++}
+diff --git a/src/util/virccw.h b/src/util/virccw.h
+index 701e13284b..21a03406fa 100644
+--- a/src/util/virccw.h
++++ b/src/util/virccw.h
+@@ -29,3 +29,6 @@ struct _virCCWDeviceAddress {
+     unsigned int devno;
+     bool         assigned;
+ };
++
++char* virCCWDeviceAddressAsString(virCCWDeviceAddress *addr)
++    ATTRIBUTE_NONNULL(1);
+-- 
+2.39.1
+

SOURCES/libvirt-util-refactor-virDomainCCWAddressIncrement-into-virccw.patch

@@ -0,0 +1,100 @@
+From fcb45d357cc3b6e9ee413014e21de1ab2d20273f Mon Sep 17 00:00:00 2001
+Message-Id: <fcb45d357cc3b6e9ee413014e21de1ab2d20273f@dist-git>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Fri, 13 May 2022 12:31:05 +0200
+Subject: [PATCH] util: refactor virDomainCCWAddressIncrement into virccw
+
+Refactor virDomainCCWAddressIncrement into virccw and rename method as
+virCCWDeviceAddressIncrement.
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit be1e16ed1161173b07f2e8f20f2ca3294ac49406)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/conf/domain_addr.c   | 16 +---------------
+ src/libvirt_private.syms |  1 +
+ src/util/virccw.c        | 13 +++++++++++++
+ src/util/virccw.h        |  1 +
+ 4 files changed, 16 insertions(+), 15 deletions(-)
+
+diff --git a/src/conf/domain_addr.c b/src/conf/domain_addr.c
+index 655f3cc09e..b04ab0628b 100644
+--- a/src/conf/domain_addr.c
++++ b/src/conf/domain_addr.c
+@@ -1286,20 +1286,6 @@ virDomainPCIAddressSetAllMulti(virDomainDef *def)
+ }
+ 
+ 
+-static int
+-virDomainCCWAddressIncrement(virCCWDeviceAddress *addr)
+-{
+-    virCCWDeviceAddress ccwaddr = *addr;
+-
+-    /* We are not touching subchannel sets and channel subsystems */
+-    if (++ccwaddr.devno > VIR_CCW_DEVICE_MAX_DEVNO)
+-        return -1;
+-
+-    *addr = ccwaddr;
+-    return 0;
+-}
+-
+-
+ int
+ virDomainCCWAddressAssign(virDomainDeviceInfo *dev,
+                           virDomainCCWAddressSet *addrs,
+@@ -1325,7 +1311,7 @@ virDomainCCWAddressAssign(virDomainDeviceInfo *dev,
+             return -1;
+ 
+         while (virHashLookup(addrs->defined, addr)) {
+-            if (virDomainCCWAddressIncrement(&addrs->next) < 0) {
++            if (virCCWDeviceAddressIncrement(&addrs->next) < 0) {
+                 virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                                _("There are no more free CCW devnos."));
+                 return -1;
+diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
+index e8d3edb0fe..eb56292b34 100644
+--- a/src/libvirt_private.syms
++++ b/src/libvirt_private.syms
+@@ -1903,6 +1903,7 @@ virBufferVasprintf;
+ 
+ # util/virccw.h
+ virCCWDeviceAddressAsString;
++virCCWDeviceAddressIncrement;
+ 
+ 
+ # util/vircgroup.h
+diff --git a/src/util/virccw.c b/src/util/virccw.c
+index 5a19d3a112..d14d432414 100644
+--- a/src/util/virccw.c
++++ b/src/util/virccw.c
+@@ -27,3 +27,16 @@ virCCWDeviceAddressAsString(virCCWDeviceAddress *addr)
+ {
+     return g_strdup_printf(VIR_CCW_DEVICE_ADDRESS_FMT, addr->cssid, addr->ssid, addr->devno);
+ }
++
++int
++virCCWDeviceAddressIncrement(virCCWDeviceAddress *addr)
++{
++    virCCWDeviceAddress ccwaddr = *addr;
++
++    /* We are not touching subchannel sets and channel subsystems */
++    if (++ccwaddr.devno > VIR_CCW_DEVICE_MAX_DEVNO)
++        return -1;
++
++    *addr = ccwaddr;
++    return 0;
++}
+diff --git a/src/util/virccw.h b/src/util/virccw.h
+index c3a47127f1..4c48c9605e 100644
+--- a/src/util/virccw.h
++++ b/src/util/virccw.h
+@@ -37,3 +37,4 @@ struct _virCCWDeviceAddress {
+ 
+ char* virCCWDeviceAddressAsString(virCCWDeviceAddress *addr)
+     ATTRIBUTE_NONNULL(1);
++int virCCWDeviceAddressIncrement(virCCWDeviceAddress *addr);
+-- 
+2.39.1
+

SOURCES/libvirt-util-refactor-virDomainDeviceCCWAddress-into-virccw.h.patch

@@ -0,0 +1,299 @@
+From a259f2fc77dac6fa2fd7910d4c96d231b0ea3182 Mon Sep 17 00:00:00 2001
+Message-Id: <a259f2fc77dac6fa2fd7910d4c96d231b0ea3182@dist-git>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Fri, 13 May 2022 12:31:01 +0200
+Subject: [PATCH] util: refactor virDomainDeviceCCWAddress into virccw.h
+
+Refactor ccw data structure virDomainDeviceCCWAddress into util virccw.h
+and rename it as virCCWDeviceAddress.
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 45a8e3988f7b087b3b721e74ce5e6b5658b2b424)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/conf/device_conf.c               |  8 +++----
+ src/conf/device_conf.h               | 19 ++++++-----------
+ src/conf/domain_addr.c               |  6 +++---
+ src/conf/domain_addr.h               |  4 ++--
+ src/conf/domain_conf.c               |  6 +++---
+ src/conf/domain_conf.h               |  6 +++---
+ src/node_device/node_device_driver.c |  2 +-
+ src/qemu/qemu_agent.c                |  4 ++--
+ src/qemu/qemu_agent.h                |  2 +-
+ src/util/virccw.h                    | 31 ++++++++++++++++++++++++++++
+ 10 files changed, 56 insertions(+), 32 deletions(-)
+ create mode 100644 src/util/virccw.h
+
+diff --git a/src/conf/device_conf.c b/src/conf/device_conf.c
+index cb523d3a0d..92b908b2e6 100644
+--- a/src/conf/device_conf.c
++++ b/src/conf/device_conf.c
+@@ -259,7 +259,7 @@ virPCIDeviceAddressFormat(virBuffer *buf,
+ }
+ 
+ bool
+-virDomainDeviceCCWAddressIsValid(virDomainDeviceCCWAddress *addr)
++virDomainDeviceCCWAddressIsValid(virCCWDeviceAddress *addr)
+ {
+     return addr->cssid <= VIR_DOMAIN_DEVICE_CCW_MAX_CSSID &&
+            addr->ssid <= VIR_DOMAIN_DEVICE_CCW_MAX_SSID &&
+@@ -268,7 +268,7 @@ virDomainDeviceCCWAddressIsValid(virDomainDeviceCCWAddress *addr)
+ 
+ int
+ virDomainDeviceCCWAddressParseXML(xmlNodePtr node,
+-                                  virDomainDeviceCCWAddress *addr)
++                                  virCCWDeviceAddress *addr)
+ {
+     int cssid;
+     int ssid;
+@@ -307,8 +307,8 @@ virDomainDeviceCCWAddressParseXML(xmlNodePtr node,
+ }
+ 
+ bool
+-virDomainDeviceCCWAddressEqual(virDomainDeviceCCWAddress *addr1,
+-                               virDomainDeviceCCWAddress *addr2)
++virDomainDeviceCCWAddressEqual(virCCWDeviceAddress *addr1,
++                               virCCWDeviceAddress *addr2)
+ {
+     if (addr1->cssid == addr2->cssid &&
+         addr1->ssid == addr2->ssid &&
+diff --git a/src/conf/device_conf.h b/src/conf/device_conf.h
+index b6b710d313..60d90bbf19 100644
+--- a/src/conf/device_conf.h
++++ b/src/conf/device_conf.h
+@@ -27,6 +27,7 @@
+ #include "internal.h"
+ #include "virthread.h"
+ #include "virbuffer.h"
++#include "virccw.h"
+ #include "virpci.h"
+ #include "virnetdev.h"
+ #include "virenum.h"
+@@ -73,14 +74,6 @@ struct _virDomainDeviceVirtioSerialAddress {
+ #define VIR_DOMAIN_DEVICE_CCW_MAX_SSID       3
+ #define VIR_DOMAIN_DEVICE_CCW_MAX_DEVNO  65535
+ 
+-typedef struct _virDomainDeviceCCWAddress virDomainDeviceCCWAddress;
+-struct _virDomainDeviceCCWAddress {
+-    unsigned int cssid;
+-    unsigned int ssid;
+-    unsigned int devno;
+-    bool         assigned;
+-};
+-
+ typedef struct _virDomainDeviceCcidAddress virDomainDeviceCcidAddress;
+ struct _virDomainDeviceCcidAddress {
+     unsigned int controller;
+@@ -136,7 +129,7 @@ struct _virDomainDeviceInfo {
+         virDomainDeviceCcidAddress ccid;
+         virDomainDeviceUSBAddress usb;
+         virDomainDeviceSpaprVioAddress spaprvio;
+-        virDomainDeviceCCWAddress ccw;
++        virCCWDeviceAddress ccw;
+         virDomainDeviceISAAddress isa;
+         virDomainDeviceDimmAddress dimm;
+     } addr;
+@@ -204,11 +197,11 @@ void virPCIDeviceAddressFormat(virBuffer *buf,
+                                virPCIDeviceAddress addr,
+                                bool includeTypeInAddr);
+ 
+-bool virDomainDeviceCCWAddressIsValid(virDomainDeviceCCWAddress *addr);
++bool virDomainDeviceCCWAddressIsValid(virCCWDeviceAddress *addr);
+ int virDomainDeviceCCWAddressParseXML(xmlNodePtr node,
+-                                      virDomainDeviceCCWAddress *addr);
+-bool virDomainDeviceCCWAddressEqual(virDomainDeviceCCWAddress *addr1,
+-                                    virDomainDeviceCCWAddress *addr2);
++                                      virCCWDeviceAddress *addr);
++bool virDomainDeviceCCWAddressEqual(virCCWDeviceAddress *addr1,
++                                    virCCWDeviceAddress *addr2);
+ #define VIR_CCW_DEVICE_ADDRESS_FMT "%x.%x.%04x"
+ 
+ int virDomainDeviceDriveAddressParseXML(xmlNodePtr node,
+diff --git a/src/conf/domain_addr.c b/src/conf/domain_addr.c
+index 49745ba881..d584d3b8a8 100644
+--- a/src/conf/domain_addr.c
++++ b/src/conf/domain_addr.c
+@@ -1287,15 +1287,15 @@ virDomainPCIAddressSetAllMulti(virDomainDef *def)
+ 
+ 
+ char*
+-virDomainCCWAddressAsString(virDomainDeviceCCWAddress *addr)
++virDomainCCWAddressAsString(virCCWDeviceAddress *addr)
+ {
+     return g_strdup_printf("%x.%x.%04x", addr->cssid, addr->ssid, addr->devno);
+ }
+ 
+ static int
+-virDomainCCWAddressIncrement(virDomainDeviceCCWAddress *addr)
++virDomainCCWAddressIncrement(virCCWDeviceAddress *addr)
+ {
+-    virDomainDeviceCCWAddress ccwaddr = *addr;
++    virCCWDeviceAddress ccwaddr = *addr;
+ 
+     /* We are not touching subchannel sets and channel subsystems */
+     if (++ccwaddr.devno > VIR_DOMAIN_DEVICE_CCW_MAX_DEVNO)
+diff --git a/src/conf/domain_addr.h b/src/conf/domain_addr.h
+index 814b556024..c8d069e07e 100644
+--- a/src/conf/domain_addr.h
++++ b/src/conf/domain_addr.h
+@@ -195,7 +195,7 @@ void virDomainPCIAddressSetAllMulti(virDomainDef *def)
+ 
+ struct _virDomainCCWAddressSet {
+     GHashTable *defined;
+-    virDomainDeviceCCWAddress next;
++    virCCWDeviceAddress next;
+ };
+ typedef struct _virDomainCCWAddressSet virDomainCCWAddressSet;
+ 
+@@ -205,7 +205,7 @@ int virDomainCCWAddressAssign(virDomainDeviceInfo *dev,
+     ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2);
+ void virDomainCCWAddressSetFree(virDomainCCWAddressSet *addrs);
+ 
+-char* virDomainCCWAddressAsString(virDomainDeviceCCWAddress *addr)
++char* virDomainCCWAddressAsString(virCCWDeviceAddress *addr)
+     ATTRIBUTE_NONNULL(1);
+ 
+ virDomainCCWAddressSet *
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index 95afd9226e..ad3bd56da0 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -15541,7 +15541,7 @@ virDomainDiskControllerMatch(int controller_type, int disk_bus)
+ int
+ virDomainDiskIndexByAddress(virDomainDef *def,
+                             virPCIDeviceAddress *pci_address,
+-                            virDomainDeviceCCWAddress *ccw_addr,
++                            virCCWDeviceAddress *ccw_addr,
+                             unsigned int bus, unsigned int target,
+                             unsigned int unit)
+ {
+@@ -15585,7 +15585,7 @@ virDomainDiskIndexByAddress(virDomainDef *def,
+ virDomainDiskDef *
+ virDomainDiskByAddress(virDomainDef *def,
+                        virPCIDeviceAddress *pci_address,
+-                       virDomainDeviceCCWAddress *ccw_addr,
++                       virCCWDeviceAddress *ccw_addr,
+                        unsigned int bus,
+                        unsigned int target,
+                        unsigned int unit)
+@@ -16184,7 +16184,7 @@ virDomainControllerFindByType(virDomainDef *def,
+ 
+ int
+ virDomainControllerFindByCCWAddress(virDomainDef *def,
+-                                    virDomainDeviceCCWAddress *addr)
++                                    virCCWDeviceAddress *addr)
+ {
+     size_t i;
+ 
+diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
+index 45976beb2b..930af36868 100644
+--- a/src/conf/domain_conf.h
++++ b/src/conf/domain_conf.h
+@@ -3622,12 +3622,12 @@ void virDomainRNGDefFree(virDomainRNGDef *def);
+ 
+ int virDomainDiskIndexByAddress(virDomainDef *def,
+                                 virPCIDeviceAddress *pci_controller,
+-                                virDomainDeviceCCWAddress *ccw_addr,
++                                virCCWDeviceAddress *ccw_addr,
+                                 unsigned int bus, unsigned int target,
+                                 unsigned int unit);
+ virDomainDiskDef *virDomainDiskByAddress(virDomainDef *def,
+                                          virPCIDeviceAddress *pci_controller,
+-                                         virDomainDeviceCCWAddress *ccw_addr,
++                                         virCCWDeviceAddress *ccw_addr,
+                                          unsigned int bus,
+                                          unsigned int target,
+                                          unsigned int unit);
+@@ -3712,7 +3712,7 @@ void virDomainControllerInsertPreAlloced(virDomainDef *def,
+ int virDomainControllerFind(const virDomainDef *def, int type, int idx);
+ int virDomainControllerFindByType(virDomainDef *def, int type);
+ int virDomainControllerFindByCCWAddress(virDomainDef *def,
+-                                        virDomainDeviceCCWAddress *addr);
++                                        virCCWDeviceAddress *addr);
+ int virDomainControllerFindByPCIAddress(virDomainDef *def,
+                                         virPCIDeviceAddress *addr);
+ int virDomainControllerFindUnusedIndex(virDomainDef const *def, int type);
+diff --git a/src/node_device/node_device_driver.c b/src/node_device/node_device_driver.c
+index d19ed7d948..b0abf59618 100644
+--- a/src/node_device/node_device_driver.c
++++ b/src/node_device/node_device_driver.c
+@@ -676,7 +676,7 @@ nodeDeviceObjFormatAddress(virNodeDeviceObj *obj)
+             }
+ 
+         case VIR_NODE_DEV_CAP_CSS_DEV: {
+-            virDomainDeviceCCWAddress ccw_addr = {
++            virCCWDeviceAddress ccw_addr = {
+                 .cssid = caps->data.ccw_dev.cssid,
+                 .ssid = caps->data.ccw_dev.ssid,
+                 .devno = caps->data.ccw_dev.devno
+diff --git a/src/qemu/qemu_agent.c b/src/qemu/qemu_agent.c
+index 8a55044c9e..db844148a6 100644
+--- a/src/qemu/qemu_agent.c
++++ b/src/qemu/qemu_agent.c
+@@ -1769,9 +1769,9 @@ qemuAgentGetDiskAddress(virJSONValue *json)
+     GET_DISK_ADDR(pci, &addr->pci_controller.function, "function");
+ 
+     if ((ccw = virJSONValueObjectGet(json, "ccw-address"))) {
+-        g_autofree virDomainDeviceCCWAddress *ccw_addr = NULL;
++        g_autofree virCCWDeviceAddress *ccw_addr = NULL;
+ 
+-        ccw_addr = g_new0(virDomainDeviceCCWAddress, 1);
++        ccw_addr = g_new0(virCCWDeviceAddress, 1);
+ 
+         GET_DISK_ADDR(ccw, &ccw_addr->cssid, "cssid");
+         if (ccw_addr->cssid == 0)  /* Guest CSSID 0 is 0xfe on host */
+diff --git a/src/qemu/qemu_agent.h b/src/qemu/qemu_agent.h
+index 862f6b0a95..c07d8507ba 100644
+--- a/src/qemu/qemu_agent.h
++++ b/src/qemu/qemu_agent.h
+@@ -72,7 +72,7 @@ struct _qemuAgentDiskAddress {
+     unsigned int target;
+     unsigned int unit;
+     char *devnode;
+-    virDomainDeviceCCWAddress *ccw_addr;
++    virCCWDeviceAddress *ccw_addr;
+ };
+ void qemuAgentDiskAddressFree(qemuAgentDiskAddress *addr);
+ G_DEFINE_AUTOPTR_CLEANUP_FUNC(qemuAgentDiskAddress, qemuAgentDiskAddressFree);
+diff --git a/src/util/virccw.h b/src/util/virccw.h
+new file mode 100644
+index 0000000000..701e13284b
+--- /dev/null
++++ b/src/util/virccw.h
+@@ -0,0 +1,31 @@
++/*
++ * virccw.h: helper APIs for managing host CCW devices
++ *
++ * Copyright (C) 2022 IBM Corporation
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2.1 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public
++ * License along with this library.  If not, see
++ * <http://www.gnu.org/licenses/>.
++ */
++
++#pragma once
++
++#include "internal.h"
++
++typedef struct _virCCWDeviceAddress virCCWDeviceAddress;
++struct _virCCWDeviceAddress {
++    unsigned int cssid;
++    unsigned int ssid;
++    unsigned int devno;
++    bool         assigned;
++};
+-- 
+2.39.1
+

SOURCES/libvirt-util-refactor-virDomainDeviceCCWAddressEqual-into-virccw.patch

@@ -0,0 +1,151 @@
+From 71f605aed8cb1f27eef21953005b3251e41e1925 Mon Sep 17 00:00:00 2001
+Message-Id: <71f605aed8cb1f27eef21953005b3251e41e1925@dist-git>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Fri, 13 May 2022 12:31:07 +0200
+Subject: [PATCH] util: refactor virDomainDeviceCCWAddressEqual into virccw
+
+Refactor virDomainDeviceCCWAddressEqual into virccw and rename method as
+virCCWDeviceAddressEqual.
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 784b87603517bd920910ccfb69daae8980a21d8d)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/conf/device_conf.c   | 12 ------------
+ src/conf/device_conf.h   |  2 --
+ src/conf/domain_conf.c   |  8 ++++----
+ src/libvirt_private.syms |  2 +-
+ src/util/virccw.c        | 12 ++++++++++++
+ src/util/virccw.h        |  2 ++
+ 6 files changed, 19 insertions(+), 19 deletions(-)
+
+diff --git a/src/conf/device_conf.c b/src/conf/device_conf.c
+index 2385e81994..958e2f43cc 100644
+--- a/src/conf/device_conf.c
++++ b/src/conf/device_conf.c
+@@ -298,18 +298,6 @@ virDomainDeviceCCWAddressParseXML(xmlNodePtr node,
+     return 0;
+ }
+ 
+-bool
+-virDomainDeviceCCWAddressEqual(virCCWDeviceAddress *addr1,
+-                               virCCWDeviceAddress *addr2)
+-{
+-    if (addr1->cssid == addr2->cssid &&
+-        addr1->ssid == addr2->ssid &&
+-        addr1->devno == addr2->devno) {
+-        return true;
+-    }
+-    return false;
+-}
+-
+ int
+ virDomainDeviceDriveAddressParseXML(xmlNodePtr node,
+                                     virDomainDeviceDriveAddress *addr)
+diff --git a/src/conf/device_conf.h b/src/conf/device_conf.h
+index 0ed6991c23..01e2edccc9 100644
+--- a/src/conf/device_conf.h
++++ b/src/conf/device_conf.h
+@@ -195,8 +195,6 @@ void virPCIDeviceAddressFormat(virBuffer *buf,
+ 
+ int virDomainDeviceCCWAddressParseXML(xmlNodePtr node,
+                                       virCCWDeviceAddress *addr);
+-bool virDomainDeviceCCWAddressEqual(virCCWDeviceAddress *addr1,
+-                                    virCCWDeviceAddress *addr2);
+ 
+ int virDomainDeviceDriveAddressParseXML(xmlNodePtr node,
+                                         virDomainDeviceDriveAddress *addr);
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index 17383fc878..1e1c7f01b1 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -15566,7 +15566,7 @@ virDomainDiskIndexByAddress(virDomainDef *def,
+             return i;
+         if (vdisk->info.type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_CCW &&
+             ccw_addr &&
+-            virDomainDeviceCCWAddressEqual(&vdisk->info.addr.ccw, ccw_addr)) {
++            virCCWDeviceAddressEqual(&vdisk->info.addr.ccw, ccw_addr)) {
+             return i;
+         }
+         if (vdisk->info.type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_DRIVE) {
+@@ -15755,8 +15755,8 @@ virDomainNetFindIdx(virDomainDef *def, virDomainNetDef *net)
+             continue;
+ 
+         if (CCWAddrSpecified &&
+-            !virDomainDeviceCCWAddressEqual(&def->nets[i]->info.addr.ccw,
+-                                            &net->info.addr.ccw))
++            !virCCWDeviceAddressEqual(&def->nets[i]->info.addr.ccw,
++                                      &net->info.addr.ccw))
+             continue;
+ 
+         if (net->info.alias && def->nets[i]->info.alias &&
+@@ -16192,7 +16192,7 @@ virDomainControllerFindByCCWAddress(virDomainDef *def,
+         virDomainDeviceInfo *info = &def->controllers[i]->info;
+ 
+         if (info->type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_CCW &&
+-            virDomainDeviceCCWAddressEqual(&info->addr.ccw, addr))
++            virCCWDeviceAddressEqual(&info->addr.ccw, addr))
+             return i;
+     }
+ 
+diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
+index 9ed367d427..0d3ee4c20a 100644
+--- a/src/libvirt_private.syms
++++ b/src/libvirt_private.syms
+@@ -131,7 +131,6 @@ virDeviceInfoPCIAddressIsWanted;
+ virDomainDeviceAddressIsValid;
+ virDomainDeviceAddressTypeToString;
+ virDomainDeviceCcidAddressParseXML;
+-virDomainDeviceCCWAddressEqual;
+ virDomainDeviceCCWAddressParseXML;
+ virDomainDeviceDriveAddressParseXML;
+ virDomainDeviceInfoAddressIsEqual;
+@@ -1902,6 +1901,7 @@ virBufferVasprintf;
+ 
+ # util/virccw.h
+ virCCWDeviceAddressAsString;
++virCCWDeviceAddressEqual;
+ virCCWDeviceAddressIncrement;
+ virCCWDeviceAddressIsValid;
+ 
+diff --git a/src/util/virccw.c b/src/util/virccw.c
+index c3dfda2613..e2785bd9ab 100644
+--- a/src/util/virccw.c
++++ b/src/util/virccw.c
+@@ -30,6 +30,18 @@ virCCWDeviceAddressIsValid(virCCWDeviceAddress *addr)
+            addr->devno <= VIR_CCW_DEVICE_MAX_DEVNO;
+ }
+ 
++bool
++virCCWDeviceAddressEqual(virCCWDeviceAddress *addr1,
++                         virCCWDeviceAddress *addr2)
++{
++    if (addr1->cssid == addr2->cssid &&
++        addr1->ssid == addr2->ssid &&
++        addr1->devno == addr2->devno) {
++        return true;
++    }
++    return false;
++}
++
+ char*
+ virCCWDeviceAddressAsString(virCCWDeviceAddress *addr)
+ {
+diff --git a/src/util/virccw.h b/src/util/virccw.h
+index c4daaff7b3..aebbd4ab6d 100644
+--- a/src/util/virccw.h
++++ b/src/util/virccw.h
+@@ -36,6 +36,8 @@ struct _virCCWDeviceAddress {
+ };
+ 
+ bool virCCWDeviceAddressIsValid(virCCWDeviceAddress *addr);
++bool virCCWDeviceAddressEqual(virCCWDeviceAddress *addr1,
++                              virCCWDeviceAddress *addr2);
+ 
+ char* virCCWDeviceAddressAsString(virCCWDeviceAddress *addr)
+     ATTRIBUTE_NONNULL(1);
+-- 
+2.39.1
+

SOURCES/libvirt-util-refactor-virDomainDeviceCCWAddressIsValid-into-virccw.patch

@@ -0,0 +1,126 @@
+From 3de657416726803a56fb5b025396bccdd8bfa955 Mon Sep 17 00:00:00 2001
+Message-Id: <3de657416726803a56fb5b025396bccdd8bfa955@dist-git>
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Fri, 13 May 2022 12:31:06 +0200
+Subject: [PATCH] util: refactor virDomainDeviceCCWAddressIsValid into virccw
+
+Refactor virDomainDeviceCCWAddressIsValid into virccw and rename method
+as virCCWDeviceAddressIsValid.
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+(cherry picked from commit 38756ce5ba17d31597a3470d07708a21bf460c9b)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/conf/device_conf.c   | 12 ++----------
+ src/conf/device_conf.h   |  1 -
+ src/libvirt_private.syms |  2 +-
+ src/util/virccw.c        |  8 ++++++++
+ src/util/virccw.h        |  2 ++
+ 5 files changed, 13 insertions(+), 12 deletions(-)
+
+diff --git a/src/conf/device_conf.c b/src/conf/device_conf.c
+index bdc9219f84..2385e81994 100644
+--- a/src/conf/device_conf.c
++++ b/src/conf/device_conf.c
+@@ -258,14 +258,6 @@ virPCIDeviceAddressFormat(virBuffer *buf,
+                       addr.function);
+ }
+ 
+-bool
+-virDomainDeviceCCWAddressIsValid(virCCWDeviceAddress *addr)
+-{
+-    return addr->cssid <= VIR_CCW_DEVICE_MAX_CSSID &&
+-           addr->ssid <= VIR_CCW_DEVICE_MAX_SSID &&
+-           addr->devno <= VIR_CCW_DEVICE_MAX_DEVNO;
+-}
+-
+ int
+ virDomainDeviceCCWAddressParseXML(xmlNodePtr node,
+                                   virCCWDeviceAddress *addr)
+@@ -288,7 +280,7 @@ virDomainDeviceCCWAddressParseXML(xmlNodePtr node,
+                                 &addr->devno)) < 0)
+         return -1;
+ 
+-    if (!virDomainDeviceCCWAddressIsValid(addr)) {
++    if (!virCCWDeviceAddressIsValid(addr)) {
+         virReportError(VIR_ERR_INTERNAL_ERROR,
+                        _("Invalid specification for virtio ccw address: cssid='0x%x' ssid='0x%x' devno='0x%04x'"),
+                        addr->cssid, addr->ssid, addr->devno);
+@@ -453,7 +445,7 @@ virDomainDeviceAddressIsValid(virDomainDeviceInfo *info,
+         return true;
+ 
+     case VIR_DOMAIN_DEVICE_ADDRESS_TYPE_CCW:
+-        return virDomainDeviceCCWAddressIsValid(&info->addr.ccw);
++        return virCCWDeviceAddressIsValid(&info->addr.ccw);
+ 
+     case VIR_DOMAIN_DEVICE_ADDRESS_TYPE_USB:
+         return true;
+diff --git a/src/conf/device_conf.h b/src/conf/device_conf.h
+index 5c4b7b2f8e..0ed6991c23 100644
+--- a/src/conf/device_conf.h
++++ b/src/conf/device_conf.h
+@@ -193,7 +193,6 @@ void virPCIDeviceAddressFormat(virBuffer *buf,
+                                virPCIDeviceAddress addr,
+                                bool includeTypeInAddr);
+ 
+-bool virDomainDeviceCCWAddressIsValid(virCCWDeviceAddress *addr);
+ int virDomainDeviceCCWAddressParseXML(xmlNodePtr node,
+                                       virCCWDeviceAddress *addr);
+ bool virDomainDeviceCCWAddressEqual(virCCWDeviceAddress *addr1,
+diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
+index eb56292b34..9ed367d427 100644
+--- a/src/libvirt_private.syms
++++ b/src/libvirt_private.syms
+@@ -132,7 +132,6 @@ virDomainDeviceAddressIsValid;
+ virDomainDeviceAddressTypeToString;
+ virDomainDeviceCcidAddressParseXML;
+ virDomainDeviceCCWAddressEqual;
+-virDomainDeviceCCWAddressIsValid;
+ virDomainDeviceCCWAddressParseXML;
+ virDomainDeviceDriveAddressParseXML;
+ virDomainDeviceInfoAddressIsEqual;
+@@ -1904,6 +1903,7 @@ virBufferVasprintf;
+ # util/virccw.h
+ virCCWDeviceAddressAsString;
+ virCCWDeviceAddressIncrement;
++virCCWDeviceAddressIsValid;
+ 
+ 
+ # util/vircgroup.h
+diff --git a/src/util/virccw.c b/src/util/virccw.c
+index d14d432414..c3dfda2613 100644
+--- a/src/util/virccw.c
++++ b/src/util/virccw.c
+@@ -22,6 +22,14 @@
+ #include "virccw.h"
+ 
+ 
++bool
++virCCWDeviceAddressIsValid(virCCWDeviceAddress *addr)
++{
++    return addr->cssid <= VIR_CCW_DEVICE_MAX_CSSID &&
++           addr->ssid <= VIR_CCW_DEVICE_MAX_SSID &&
++           addr->devno <= VIR_CCW_DEVICE_MAX_DEVNO;
++}
++
+ char*
+ virCCWDeviceAddressAsString(virCCWDeviceAddress *addr)
+ {
+diff --git a/src/util/virccw.h b/src/util/virccw.h
+index 4c48c9605e..c4daaff7b3 100644
+--- a/src/util/virccw.h
++++ b/src/util/virccw.h
+@@ -35,6 +35,8 @@ struct _virCCWDeviceAddress {
+     bool         assigned;
+ };
+ 
++bool virCCWDeviceAddressIsValid(virCCWDeviceAddress *addr);
++
+ char* virCCWDeviceAddressAsString(virCCWDeviceAddress *addr)
+     ATTRIBUTE_NONNULL(1);
+ int virCCWDeviceAddressIncrement(virCCWDeviceAddress *addr);
+-- 
+2.39.1
+

SOURCES/libvirt-vircpi-Add-PCIe-5.0-and-6.0-link-speeds.patch

@@ -0,0 +1,65 @@
+From 0a192b453da043cfb3679a07b55c1628b56efdde Mon Sep 17 00:00:00 2001
+Message-Id: <0a192b453da043cfb3679a07b55c1628b56efdde@dist-git>
+From: Michal Privoznik <mprivozn@redhat.com>
+Date: Fri, 8 Jul 2022 14:29:32 +0200
+Subject: [PATCH] vircpi: Add PCIe 5.0 and 6.0 link speeds
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The PCIe 5.0 and PCIe 6.0 standards define new link speeds:
+32GT/s and 64GT/s, respectively. Update our internal enum to
+include these new speeds. Otherwise we format incorrect XML:
+
+  <pci-express>
+    <link validity='cap' port='0' speed='(null)' width='16'/>
+    <link validity='sta' speed='16' width='16'/>
+  </pci-express>
+
+Like all "good" specifications, these are also locked behind a
+login portal. But we can look at pciutils' source code: [1] and
+[2].
+
+1: https://git.kernel.org/pub/scm/utils/pciutils/pciutils.git/commit/ls-caps.c?id=caca31a0eea41c7b051705704c1158fddc02fbd2
+2: https://git.kernel.org/pub/scm/utils/pciutils/pciutils.git/commit/ls-caps.c?id=5bdf63b6b1bc35b59c4b3f47f7ca83ca1868155b
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2105231
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+(cherry picked from commit d33c2a9e2f933b31f8e96e9938c237bdffe27f84)
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2168116
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+---
+ src/util/virpci.c | 2 +-
+ src/util/virpci.h | 2 ++
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/util/virpci.c b/src/util/virpci.c
+index 0d476cd8b4..4949d1a3d4 100644
+--- a/src/util/virpci.c
++++ b/src/util/virpci.c
+@@ -46,7 +46,7 @@ VIR_LOG_INIT("util.pci");
+ 
+ VIR_ENUM_IMPL(virPCIELinkSpeed,
+               VIR_PCIE_LINK_SPEED_LAST,
+-              "", "2.5", "5", "8", "16",
++              "", "2.5", "5", "8", "16", "32", "64"
+ );
+ 
+ VIR_ENUM_IMPL(virPCIStubDriver,
+diff --git a/src/util/virpci.h b/src/util/virpci.h
+index b9b9cd7b34..4d9193f24e 100644
+--- a/src/util/virpci.h
++++ b/src/util/virpci.h
+@@ -83,6 +83,8 @@ typedef enum {
+     VIR_PCIE_LINK_SPEED_5,
+     VIR_PCIE_LINK_SPEED_8,
+     VIR_PCIE_LINK_SPEED_16,
++    VIR_PCIE_LINK_SPEED_32,
++    VIR_PCIE_LINK_SPEED_64,
+     VIR_PCIE_LINK_SPEED_LAST
+ } virPCIELinkSpeed;
+ 
+-- 
+2.39.1
+

SOURCES/libvirt-virnuma-Avoid-integer-overflow-in-virNumaGetPages.patch

@@ -0,0 +1,68 @@
+From f3ae3ac1807549c1eb4cc5a0286047ff019e14a0 Mon Sep 17 00:00:00 2001
+Message-ID: <f3ae3ac1807549c1eb4cc5a0286047ff019e14a0.1702401900.git.jdenemar@redhat.com>
+From: Michal Privoznik <mprivozn@redhat.com>
+Date: Fri, 24 Nov 2023 11:59:32 +0100
+Subject: [PATCH] virnuma: Avoid integer overflow in virNumaGetPages()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+On systems with humongous pages (16GiB) and 32bit int it's easy
+to hit integer overflow in virNumaGetPages(). What happens is,
+inside of virNumaGetPages() as we process hugepages for given
+NUMA node (e.g. in order to produce capabilities XML), we keep a
+sum of sizes of pools in an ULL variable (huge_page_sum). In each
+iteration, the variable is incremented by 1024 * page_size *
+page_avail. Now, page_size is just an uint, so we have:
+
+  ULL += U * U * ULL;
+
+and because of associativity, U * U is computed first and since
+we have two operands of the same type, no type expansion happens.
+But this means, for humongous pages (like 16GiB) the
+multiplication overflows.
+
+Therefore, move the multiplication out of the loop. This helps in
+two ways:
+
+1) now we have ULL += U * ULL; which expands the uint in
+   multiplication,
+
+2) it saves couple of CPU cycles.
+
+Resolves: https://issues.redhat.com/browse/RHEL-16749
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+(cherry picked from commit 9694d1ca6a4ef7a37ac20249eb8b85c1bb48ef6b)
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+---
+ src/util/virnuma.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/src/util/virnuma.c b/src/util/virnuma.c
+index 7c892d6267..e0938867f9 100644
+--- a/src/util/virnuma.c
++++ b/src/util/virnuma.c
+@@ -806,9 +806,7 @@ virNumaGetPages(int node,
+         tmp_free[ntmp] = page_free;
+         ntmp++;
+ 
+-        /* page_size is in kibibytes while we want huge_page_sum
+-         * in just bytes. */
+-        huge_page_sum += 1024 * page_size * page_avail;
++        huge_page_sum += page_size * page_avail;
+     }
+ 
+     if (direrr < 0)
+@@ -819,6 +817,9 @@ virNumaGetPages(int node,
+     VIR_REALLOC_N(tmp_avail, ntmp + 1);
+     VIR_REALLOC_N(tmp_free, ntmp + 1);
+ 
++    /* page_size is in kibibytes while we want huge_page_sum in just bytes. */
++    huge_page_sum *= 1024;
++
+     if (virNumaGetPageInfo(node, system_page_size, huge_page_sum,
+                            &tmp_avail[ntmp], &tmp_free[ntmp]) < 0)
+         return -1;
+-- 
+2.43.0

SOURCES/libvirt-virpci-Resolve-leak-in-virPCIVirtualFunctionList-cleanup.patch

@@ -0,0 +1,56 @@
+From 0e91f4dc214d01e9d9537b1111ce67010530fd20 Mon Sep 17 00:00:00 2001
+Message-Id: <0e91f4dc214d01e9d9537b1111ce67010530fd20@dist-git>
+From: Tim Shearer <TShearer@adva.com>
+Date: Mon, 1 May 2023 13:15:48 +0000
+Subject: [PATCH] virpci: Resolve leak in virPCIVirtualFunctionList cleanup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Repeatedly querying an SR-IOV PCI device's capabilities exposes a
+memory leak caused by a failure to free the virPCIVirtualFunction
+array within the parent struct's g_autoptr cleanup.
+
+Valgrind output after getting a single interface's XML description
+1000 times:
+
+==325982== 256,000 bytes in 1,000 blocks are definitely lost in loss record 2,634 of 2,635
+==325982==    at 0x4C3C096: realloc (vg_replace_malloc.c:1437)
+==325982==    by 0x59D952D: g_realloc (in /usr/lib64/libglib-2.0.so.0.5600.4)
+==325982==    by 0x4EE1F52: virReallocN (viralloc.c:52)
+==325982==    by 0x4EE1FB7: virExpandN (viralloc.c:78)
+==325982==    by 0x4EE219A: virInsertElementInternal (viralloc.c:183)
+==325982==    by 0x4EE23B2: virAppendElement (viralloc.c:288)
+==325982==    by 0x4F65D85: virPCIGetVirtualFunctionsFull (virpci.c:2389)
+==325982==    by 0x4F65753: virPCIGetVirtualFunctions (virpci.c:2256)
+==325982==    by 0x505CB75: virNodeDeviceGetPCISRIOVCaps (node_device_conf.c:2969)
+==325982==    by 0x505D181: virNodeDeviceGetPCIDynamicCaps (node_device_conf.c:3099)
+==325982==    by 0x505BC4E: virNodeDeviceUpdateCaps (node_device_conf.c:2677)
+==325982==    by 0x260FCBB2: nodeDeviceGetXMLDesc (node_device_driver.c:355)
+
+Signed-off-by: Tim Shearer <tshearer@adva.com>
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+(cherry picked from commit 6425a311b8ad19d6f9c0b315bf1d722551ea3585)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=2196351
+https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2023-2700
+
+Signed-off-by: Ján Tomko <jtomko@redhat.com>
+---
+ src/util/virpci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/util/virpci.c b/src/util/virpci.c
+index 4949d1a3d4..2714d11a7d 100644
+--- a/src/util/virpci.c
++++ b/src/util/virpci.c
+@@ -2255,6 +2255,7 @@ virPCIVirtualFunctionListFree(virPCIVirtualFunctionList *list)
+         g_free(list->functions[i].ifname);
+     }
+ 
++    g_free(list->functions);
+     g_free(list);
+ }
+ 
+-- 
+2.40.1

SPECS/libvirt.spec

@@ -210,7 +210,7 @@
 Summary: Library providing a simple virtualization API
 Name: libvirt
 Version: 8.0.0
-Release: 14%{?dist}%{?extra_release}
+Release: 23.2%{?dist}%{?extra_release}
 License: LGPLv2+
 URL: https://libvirt.org/
 
@@ -282,6 +282,45 @@ Patch59: libvirt-qemu-gpu-Get-pid-without-binary-validation.patch
 Patch60: libvirt-build-Only-install-libvirt-guests-when-building-libvirtd.patch
 Patch61: libvirt-tools-Fix-install_mode-for-some-scripts.patch
 Patch62: libvirt-qemu-Ignore-missing-vm.unprivileged_userfaultfd-sysctl.patch
+Patch63: libvirt-nodedev-fix-reported-error-msg-in-css-cap-XML-parsing.patch
+Patch64: libvirt-util-refactor-virDomainDeviceCCWAddress-into-virccw.h.patch
+Patch65: libvirt-util-refactor-virDomainCCWAddressAsString-into-virccw.patch
+Patch66: libvirt-util-make-reuse-of-ccw-device-address-format-constant.patch
+Patch67: libvirt-util-refactor-ccw-address-constants-into-virccw.patch
+Patch68: libvirt-util-refactor-virDomainCCWAddressIncrement-into-virccw.patch
+Patch69: libvirt-util-refactor-virDomainDeviceCCWAddressIsValid-into-virccw.patch
+Patch70: libvirt-util-refactor-virDomainDeviceCCWAddressEqual-into-virccw.patch
+Patch71: libvirt-conf-adjust-method-name-virDomainDeviceCCWAddressParseXML.patch
+Patch72: libvirt-util-add-ccw-device-address-parsing-into-virccw.patch
+Patch73: libvirt-util-add-virCCWDeviceAddressFromString-to-virccw.patch
+Patch74: libvirt-nodedev-refactor-css-format-from-ccw-format-method.patch
+Patch75: libvirt-nodedev-refactor-ccw-device-address-parsing-from-XML.patch
+Patch76: libvirt-nodedev-refactor-css-XML-parsing-from-ccw-XML-parsing.patch
+Patch77: libvirt-schemas-refactor-out-nodedev-ccw-address-schema.patch
+Patch78: libvirt-nodedev-add-optional-device-address-of-channel-device-to-css-device.patch
+Patch79: libvirt-nodedev-add-tests-for-optional-device-address-to-css-device.patch
+Patch80: libvirt-nodedev-prevent-internal-error-on-dev_busid-parse.patch
+Patch81: libvirt-rpc-Fix-memory-leak-of-fds.patch
+Patch82: libvirt-qemu_namespace-Don-t-leak-memory-in-qemuDomainGetPreservedMounts.patch
+Patch83: libvirt-vircpi-Add-PCIe-5.0-and-6.0-link-speeds.patch
+Patch84: libvirt-conf-Make-VIR_DOMAIN_NET_TYPE_ETHERNET-not-share-host-view.patch
+Patch85: libvirt-qemu-domain-Fix-logic-when-tainting-domain.patch
+Patch86: libvirt-qemu-agent-Make-fetching-of-can-offline-member-from-guest-query-vcpus-optional.patch
+Patch87: libvirt-qemu-monitor-Drop-old-monitor-fields-from-struct-_qemuMonitorMessage.patch
+Patch88: libvirt-qemu-Make-struct-_qemuMonitorMessage-private.patch
+Patch89: libvirt-qemu-monitor-Move-declaration-of-struct-_qemuMonitor-to-qemu_monitor_priv.h.patch
+Patch90: libvirt-qemu-qemuBlockGetNamedNodeData-Remove-pointless-error-path.patch
+Patch91: libvirt-qemu-monitor-Store-whether-query-named-block-nodes-supports-flat-parameter.patch
+Patch92: libvirt-qemuMonitorJSONBlockStatsUpdateCapacityBlockdev-Use-flat-mode-of-query-named-block-nodes.patch
+Patch93: libvirt-qemu-relax-shared-memory-check-for-vhostuser-daemons.patch
+Patch94: libvirt-virpci-Resolve-leak-in-virPCIVirtualFunctionList-cleanup.patch
+Patch95: libvirt-node_device_conf-Avoid-memleak-in-virNodeDeviceGetPCIVPDDynamicCap.patch
+Patch96: libvirt-nodedev-update-transient-mdevs.patch
+Patch97: libvirt-lib-Set-up-cpuset-controller-for-restrictive-numatune.patch
+Patch98: libvirt-virnuma-Avoid-integer-overflow-in-virNumaGetPages.patch
+Patch99: libvirt-remote-check-for-negative-array-lengths-before-allocation.patch
+Patch100: libvirt-util-Fix-error-return-for-virProcessKillPainfullyDelay.patch
+Patch101: libvirt-rpc-ensure-temporary-GSource-is-removed-from-client-event-loop.patch
 
 Requires: libvirt-daemon = %{version}-%{release}
 Requires: libvirt-daemon-config-network = %{version}-%{release}
@@ -2161,6 +2200,67 @@ exit 0
 
 
 %changelog
+* Thu Jun  6 2024 Jiri Denemark <jdenemar@redhat.com> - 8.0.0-23.2.el8
+- util: Fix error return for virProcessKillPainfullyDelay() (RHEL-36064)
+- rpc: ensure temporary GSource is removed from client event loop (CVE-2024-4418)
+
+* Tue Apr  9 2024 Jiri Denemark <jdenemar@redhat.com> - 8.0.0-23.1.el8
+- remote: check for negative array lengths before allocation (CVE-2024-2494)
+
+* Tue Dec 12 2023 Jiri Denemark <jdenemar@redhat.com> - 8.0.0-23
+- virnuma: Avoid integer overflow in virNumaGetPages() (rhbz#RHEL-16749)
+
+* Mon Jul 31 2023 Jiri Denemark <jdenemar@redhat.com> - 8.0.0-22
+- lib: Set up cpuset controller for restrictive numatune (rhbz#2223464)
+
+* Thu Jun 22 2023 Jiri Denemark <jdenemar@redhat.com> - 8.0.0-21
+- nodedev: update transient mdevs (rhbz#2143160)
+
+* Fri May 19 2023 Jiri Denemark <jdenemar@redhat.com> - 8.0.0-20
+- qemu: monitor: Drop old monitor fields from 'struct _qemuMonitorMessage' (rhbz#2170472)
+- qemu: Make 'struct _qemuMonitorMessage' private (rhbz#2170472)
+- qemu: monitor: Move declaration of struct _qemuMonitor to qemu_monitor_priv.h (rhbz#2170472)
+- qemu: qemuBlockGetNamedNodeData: Remove pointless error path (rhbz#2170472)
+- qemu: monitor: Store whether 'query-named-block-nodes' supports 'flat' parameter (rhbz#2170472)
+- qemuMonitorJSONBlockStatsUpdateCapacityBlockdev: Use 'flat' mode of query-named-block-nodes (rhbz#2170472)
+- qemu: relax shared memory check for vhostuser daemons (rhbz#2177701)
+- virpci: Resolve leak in virPCIVirtualFunctionList cleanup (CVE-2023-2700)
+- node_device_conf: Avoid memleak in virNodeDeviceGetPCIVPDDynamicCap() (CVE-2023-2700)
+
+* Tue Mar 14 2023 Jiri Denemark <jdenemar@redhat.com> - 8.0.0-19
+- qemu: domain: Fix logic when tainting domain (rhbz#2174447)
+- qemu: agent: Make fetching of 'can-offline' member from 'guest-query-vcpus' optional (rhbz#2174447)
+
+* Wed Mar  1 2023 Jiri Denemark <jdenemar@redhat.com> - 8.0.0-18
+- conf: Make VIR_DOMAIN_NET_TYPE_ETHERNET not share 'host view' (rhbz#2172578)
+
+* Thu Feb  9 2023 Jiri Denemark <jdenemar@redhat.com> - 8.0.0-17
+- vircpi: Add PCIe 5.0 and 6.0 link speeds (rhbz#2168116)
+
+* Wed Feb  8 2023 Jiri Denemark <jdenemar@redhat.com> - 8.0.0-16
+- qemu_namespace: Don't leak memory in qemuDomainGetPreservedMounts() (rhbz#2166573)
+
+* Tue Jan 31 2023 Jiri Denemark <jdenemar@redhat.com> - 8.0.0-15
+- nodedev: fix reported error msg in css cap XML parsing (rhbz#2165011)
+- util: refactor virDomainDeviceCCWAddress into virccw.h (rhbz#2165011)
+- util: refactor virDomainCCWAddressAsString into virccw (rhbz#2165011)
+- util: make reuse of ccw device address format constant (rhbz#2165011)
+- util: refactor ccw address constants into virccw (rhbz#2165011)
+- util: refactor virDomainCCWAddressIncrement into virccw (rhbz#2165011)
+- util: refactor virDomainDeviceCCWAddressIsValid into virccw (rhbz#2165011)
+- util: refactor virDomainDeviceCCWAddressEqual into virccw (rhbz#2165011)
+- conf: adjust method name virDomainDeviceCCWAddressParseXML (rhbz#2165011)
+- util: add ccw device address parsing into virccw (rhbz#2165011)
+- util: add virCCWDeviceAddressFromString to virccw (rhbz#2165011)
+- nodedev: refactor css format from ccw format method (rhbz#2165011)
+- nodedev: refactor ccw device address parsing from XML (rhbz#2165011)
+- nodedev: refactor css XML parsing from ccw XML parsing (rhbz#2165011)
+- schemas: refactor out nodedev ccw address schema (rhbz#2165011)
+- nodedev: add optional device address of channel device to css device (rhbz#2165011)
+- nodedev: add tests for optional device address to css device (rhbz#2165011)
+- nodedev: prevent internal error on dev_busid parse (rhbz#2165011)
+- rpc: Fix memory leak of fds (rhbz#2165428)
+
 * Wed Jan 11 2023 Jiri Denemark <jdenemar@redhat.com> - 8.0.0-14
 - qemu: Ignore missing vm.unprivileged_userfaultfd sysctl (rhbz#2148578)