140 changed files with 51138 additions and 13508 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +0,0 @@
 SOURCES/libvirt-8.0.0.tar.xz
--- a/.libvirt.metadata
+++ b/.libvirt.metadata
@ -1 +0,0 @@
 e440412e9b45d7e24f0ef492d8edf5cf2cbd3f4c SOURCES/libvirt-8.0.0.tar.xz
--- a/SOURCES/libvirt-9.5.0.tar.xz
+++ b/SOURCES/libvirt-9.5.0.tar.xz
--- a/SOURCES/libvirt-Add-VIR_MIGRATE_ZEROCOPY-flag.patch
+++ b/SOURCES/libvirt-Add-VIR_MIGRATE_ZEROCOPY-flag.patch
@ -1,49 +0,0 @@
 From 9c2fd182a02d64004e30900c52e3fcdb550de0bd Mon Sep 17 00:00:00 2001
 Message-Id: <9c2fd182a02d64004e30900c52e3fcdb550de0bd@dist-git>
 From: Jiri Denemark <jdenemar@redhat.com>
 Date: Wed, 22 Jun 2022 16:35:50 +0200
 Subject: [PATCH] Add VIR_MIGRATE_ZEROCOPY flag
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The flag can be used to enable zero-copy mechanism for migrating memory
 pages.
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit 8744beecb36600e773c8a8c4823db2bf4b3e262d)
 https://bugzilla.redhat.com/show_bug.cgi?id=2089433
 Conflicts:
 	include/libvirt/libvirt-domain.h
            - post-copy recovery not backported
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 include/libvirt/libvirt-domain.h | 8 ++++++++
 1 file changed, 8 insertions(+)
 diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-domain.h
 index 5f0a9b7572..792973ce2d 100644
 --- a/include/libvirt/libvirt-domain.h
 +++ b/include/libvirt/libvirt-domain.h
@@ -860,6 +860,14 @@ typedef enum {
       */
     VIR_MIGRATE_NON_SHARED_SYNCHRONOUS_WRITES = (1 << 18),
 +    /* Use zero-copy mechanism for migrating memory pages. For QEMU/KVM this
 +     * means QEMU will be temporarily allowed to lock all guest pages in host's
 +     * memory, although only those that are queued for transfer will be locked
 +     * at the same time.
 +     *
 +     * Since: 8.5.0
 +     */
 +    VIR_MIGRATE_ZEROCOPY = (1 << 20),
 } virDomainMigrateFlags;
 -- 
 2.35.1
--- a/SOURCES/libvirt-RHEL-Add-rhel-machine-types-to-qemuDomainMachineNeedsFDC.patch
+++ b/SOURCES/libvirt-RHEL-Add-rhel-machine-types-to-qemuDomainMachineNeedsFDC.patch
@ -1,47 +0,0 @@
 From f0d0a6a9701522eee013682eb0ef566ef7cdac61 Mon Sep 17 00:00:00 2001
 Message-Id: <f0d0a6a9701522eee013682eb0ef566ef7cdac61@dist-git>
 From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
 Date: Mon, 22 Feb 2016 12:51:51 +0100
 Subject: [PATCH] RHEL: Add rhel machine types to qemuDomainMachineNeedsFDC
 RHEL-only.
 pc-q35-rhel7.0.0 and pc-q35-rhel7.1.0 do not need an explicit
 isa-fdc controller.
 https://bugzilla.redhat.com/show_bug.cgi?id=1227880
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/qemu/qemu_domain.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)
 diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
 index a8401bac30..40fe9985e6 100644
 --- a/src/qemu/qemu_domain.c
 +++ b/src/qemu/qemu_domain.c
@@ -8767,8 +8767,19 @@ qemuDomainHasBuiltinIDE(const virDomainDef *def)
 bool
 qemuDomainNeedsFDC(const virDomainDef *def)
 {
 -    /* all supported Q35 machines need explicit FDC */
 -    return qemuDomainIsQ35(def);
 +    const char *p;
 +
 +    /* all supported Q35 machines need explicit FDC except for old RHEL-7
 +     * machine types */
 +    if (!qemuDomainIsQ35(def))
 +        return false;
 +
 +    if ((p = STRSKIP(def->os.machine, "pc-q35-")) &&
 +        (STRPREFIX(p, "rhel7.0.0") ||
 +         STRPREFIX(p, "rhel7.1.0")))
 +        return false;
 +
 +    return true;
 }
 -- 
 2.34.1
--- a/SOURCES/libvirt-RHEL-Enable-usage-of-x-blockdev-reopen.patch
+++ b/SOURCES/libvirt-RHEL-Enable-usage-of-x-blockdev-reopen.patch
@ -1,257 +0,0 @@
 From b2529d5ff3a18a2b0022da75431cea5bf037819e Mon Sep 17 00:00:00 2001
 Message-Id: <b2529d5ff3a18a2b0022da75431cea5bf037819e@dist-git>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Wed, 28 Jul 2021 17:37:21 +0200
 Subject: [PATCH] RHEL: Enable usage of x-blockdev-reopen
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RHEL-only
 Introduce a new capability QEMU_CAPS_BLOCKDEV_REOPEN_COM_REDHAT_AV_8_2_0_API
 based on the presence of '__com.redhat_rhel-av-8_2_0-api' feature for
 'x-blockdev-reopen' which states that reopen works for what libvirt
 is going to use it and wire up code to call the x- prefixed command.
 This implementation will become dormant once qemu starts supporting
 upstream-stable blockdev-reopen.
 https://bugzilla.redhat.com/show_bug.cgi?id=1799013
 Starting with libvirt-7.6, upstream has adapted to the new format of
 arguments so this patch was modified to support blockdev-reopen which
 takes an array of nodes to reopen.
 https://bugzilla.redhat.com/show_bug.cgi?id=1929765
 Message-Id: <3fcde2fc6add36d5276ae224caf18adc8bca7d48.1627486352.git.pkrempa@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 ---
 src/qemu/qemu_block.c        | 24 +++++++++++++++---------
 src/qemu/qemu_block.h        |  3 ++-
 src/qemu/qemu_capabilities.c | 13 +++++++++++++
 src/qemu/qemu_capabilities.h |  3 +++
 src/qemu/qemu_monitor.c      |  5 +++--
 src/qemu/qemu_monitor.h      |  3 ++-
 src/qemu/qemu_monitor_json.c | 12 +++++++++---
 src/qemu/qemu_monitor_json.h |  3 ++-
 tests/qemumonitorjsontest.c  |  2 +-
 9 files changed, 50 insertions(+), 18 deletions(-)
 diff --git a/src/qemu/qemu_block.c b/src/qemu/qemu_block.c
 index e5ff653a60..aa566d0097 100644
 --- a/src/qemu/qemu_block.c
 +++ b/src/qemu/qemu_block.c
@@ -3331,7 +3331,8 @@ qemuBlockBitmapsHandleCommitFinish(virStorageSource *topsrc,
 int
 qemuBlockReopenFormatMon(qemuMonitor *mon,
 -                         virStorageSource *src)
 +                         virStorageSource *src,
 +                         bool downstream)
 {
     g_autoptr(virJSONValue) reopenprops = NULL;
     g_autoptr(virJSONValue) srcprops = NULL;
@@ -3340,15 +3341,19 @@ qemuBlockReopenFormatMon(qemuMonitor *mon,
     if (!(srcprops = qemuBlockStorageSourceGetBlockdevProps(src, src->backingStore)))
         return -1;
 -    if (virJSONValueArrayAppend(reopenoptions, &srcprops) < 0)
 -        return -1;
 +    if (downstream) {
 +        reopenprops = g_steal_pointer(&srcprops);
 +    } else {
 +        if (virJSONValueArrayAppend(reopenoptions, &srcprops) < 0)
 +            return -1;
 -    if (virJSONValueObjectAdd(&reopenprops,
 -                              "a:options", &reopenoptions,
 -                              NULL) < 0)
 -        return -1;
 +        if (virJSONValueObjectAdd(&reopenprops,
 +                                  "a:options", &reopenoptions,
 +                                  NULL) < 0)
 +            return -1;
 +    }
 -    if (qemuMonitorBlockdevReopen(mon, &reopenprops) < 0)
 +    if (qemuMonitorBlockdevReopen(mon, &reopenprops, downstream) < 0)
         return -1;
     return 0;
@@ -3372,6 +3377,7 @@ qemuBlockReopenFormat(virDomainObj *vm,
 {
     qemuDomainObjPrivate *priv = vm->privateData;
     virQEMUDriver *driver = priv->driver;
 +    bool downstream = virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_BLOCKDEV_REOPEN_COM_REDHAT_AV_8_2_0_API);
     int rc;
     /* If we are lacking the object here, qemu might have opened an image with
@@ -3385,7 +3391,7 @@ qemuBlockReopenFormat(virDomainObj *vm,
     if (qemuDomainObjEnterMonitorAsync(driver, vm, asyncJob) < 0)
         return -1;
 -    rc = qemuBlockReopenFormatMon(priv->mon, src);
 +    rc = qemuBlockReopenFormatMon(priv->mon, src, downstream);
     qemuDomainObjExitMonitor(driver, vm);
     if (rc < 0)
 diff --git a/src/qemu/qemu_block.h b/src/qemu/qemu_block.h
 index 184a549d5c..130cfcdefd 100644
 --- a/src/qemu/qemu_block.h
 +++ b/src/qemu/qemu_block.h
@@ -267,7 +267,8 @@ qemuBlockBitmapsHandleCommitFinish(virStorageSource *topsrc,
 /* only for use in qemumonitorjsontest */
 int
 qemuBlockReopenFormatMon(qemuMonitor *mon,
 -                         virStorageSource *src);
 +                         virStorageSource *src,
 +                         bool downstream);
 int
 qemuBlockReopenReadWrite(virDomainObj *vm,
 diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
 index 5f1eb5014c..8ae80ef8d7 100644
 --- a/src/qemu/qemu_capabilities.c
 +++ b/src/qemu/qemu_capabilities.c
@@ -654,6 +654,9 @@ VIR_ENUM_IMPL(virQEMUCaps,
               "rbd-encryption", /* QEMU_CAPS_RBD_ENCRYPTION */
               "sev-guest-kernel-hashes", /* QEMU_CAPS_SEV_GUEST_KERNEL_HASHES */
               "sev-inject-launch-secret", /* QEMU_CAPS_SEV_INJECT_LAUNCH_SECRET */
 +
 +              /* 420 */
 +              "blockdev-reopen.__com.redhat_rhel-av-8_2_0-api", /* QEMU_CAPS_BLOCKDEV_REOPEN_COM_REDHAT_AV_8_2_0_API */
     );
@@ -1540,6 +1543,7 @@ static struct virQEMUCapsDevicePropsFlags virQEMUCapsDevicePropsVhostUserFS[] =
 /* see documentation for virQEMUQAPISchemaPathGet for the query format */
 static struct virQEMUCapsStringFlags virQEMUCapsQMPSchemaQueries[] = {
     { "block-commit/arg-type/*top",  QEMU_CAPS_ACTIVE_COMMIT },
 +    { "x-blockdev-reopen/$__com.redhat_rhel-av-8_2_0-api", QEMU_CAPS_BLOCKDEV_REOPEN_COM_REDHAT_AV_8_2_0_API },
     { "blockdev-add/arg-type/options/+gluster/debug-level", QEMU_CAPS_GLUSTER_DEBUG_LEVEL},
     { "blockdev-add/arg-type/+gluster/debug", QEMU_CAPS_GLUSTER_DEBUG_LEVEL},
     { "blockdev-add/arg-type/+vxhs", QEMU_CAPS_VXHS},
@@ -5235,6 +5239,15 @@ virQEMUCapsInitProcessCaps(virQEMUCaps *qemuCaps)
         qemuCaps->arch == VIR_ARCH_MIPS)
         virQEMUCapsSet(qemuCaps, QEMU_CAPS_SCSI_NCR53C90);
 +    /* RHEL-only:
 +     * - if upstream blockdev-reopen is enabled, clear the downstream flag
 +     * - if the downstream flag is present but not the upstream, assert the upstream flag too
 +     */
 +    if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_BLOCKDEV_REOPEN))
 +        virQEMUCapsClear(qemuCaps, QEMU_CAPS_BLOCKDEV_REOPEN_COM_REDHAT_AV_8_2_0_API);
 +    if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_BLOCKDEV_REOPEN_COM_REDHAT_AV_8_2_0_API))
 +        virQEMUCapsSet(qemuCaps, QEMU_CAPS_BLOCKDEV_REOPEN);
 +
     virQEMUCapsInitProcessCapsInterlock(qemuCaps);
 }
 diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
 index e3a3ab4445..cde6c18b4c 100644
 --- a/src/qemu/qemu_capabilities.h
 +++ b/src/qemu/qemu_capabilities.h
@@ -634,6 +634,9 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */
     QEMU_CAPS_SEV_GUEST_KERNEL_HASHES, /* sev-guest.kernel-hashes= */
     QEMU_CAPS_SEV_INJECT_LAUNCH_SECRET, /* 'sev-inject-launch-secret' qmp command present */
 +    /* 420 */
 +    QEMU_CAPS_BLOCKDEV_REOPEN_COM_REDHAT_AV_8_2_0_API, /* downstream support for blockdev reopen in rhel-av-8.2.0 */
 +
     QEMU_CAPS_LAST /* this must always be the last item */
 } virQEMUCapsFlags;
 diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c
 index babf9e62fb..23638d3fe8 100644
 --- a/src/qemu/qemu_monitor.c
 +++ b/src/qemu/qemu_monitor.c
@@ -4247,14 +4247,15 @@ qemuMonitorBlockdevAdd(qemuMonitor *mon,
 int
 qemuMonitorBlockdevReopen(qemuMonitor *mon,
 -                          virJSONValue **props)
 +                          virJSONValue **props,
 +                          bool downstream)
 {
     VIR_DEBUG("props=%p (node-name=%s)", *props,
               NULLSTR(virJSONValueObjectGetString(*props, "node-name")));
     QEMU_CHECK_MONITOR(mon);
 -    return qemuMonitorJSONBlockdevReopen(mon, props);
 +    return qemuMonitorJSONBlockdevReopen(mon, props, downstream);
 }
 diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h
 index 9b2e4e1421..d2037914be 100644
 --- a/src/qemu/qemu_monitor.h
 +++ b/src/qemu/qemu_monitor.h
@@ -1426,7 +1426,8 @@ int qemuMonitorBlockdevAdd(qemuMonitor *mon,
                            virJSONValue **props);
 int qemuMonitorBlockdevReopen(qemuMonitor *mon,
 -                              virJSONValue **props);
 +                              virJSONValue **props,
 +                              bool downstream);
 int qemuMonitorBlockdevDel(qemuMonitor *mon,
                            const char *nodename);
 diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
 index b0b513683b..34a46b9b41 100644
 --- a/src/qemu/qemu_monitor_json.c
 +++ b/src/qemu/qemu_monitor_json.c
@@ -8051,13 +8051,19 @@ qemuMonitorJSONBlockdevAdd(qemuMonitor *mon,
 int
 qemuMonitorJSONBlockdevReopen(qemuMonitor *mon,
 -                              virJSONValue **props)
 +                              virJSONValue **props,
 +                              bool downstream)
 {
     g_autoptr(virJSONValue) cmd = NULL;
     g_autoptr(virJSONValue) reply = NULL;
 -    if (!(cmd = qemuMonitorJSONMakeCommandInternal("blockdev-reopen", props)))
 -        return -1;
 +    if (downstream) {
 +        if (!(cmd = qemuMonitorJSONMakeCommandInternal("x-blockdev-reopen", props)))
 +            return -1;
 +    } else {
 +        if (!(cmd = qemuMonitorJSONMakeCommandInternal("blockdev-reopen", props)))
 +            return -1;
 +    }
     if (qemuMonitorJSONCommand(mon, cmd, &reply) < 0)
         return -1;
 diff --git a/src/qemu/qemu_monitor_json.h b/src/qemu/qemu_monitor_json.h
 index 64d9ebdaa3..15ce03d7af 100644
 --- a/src/qemu/qemu_monitor_json.h
 +++ b/src/qemu/qemu_monitor_json.h
@@ -748,7 +748,8 @@ qemuMonitorJSONBlockdevAdd(qemuMonitor *mon,
 int
 qemuMonitorJSONBlockdevReopen(qemuMonitor *mon,
 -                              virJSONValue **props)
 +                              virJSONValue **props,
 +                              bool downstream)
     ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2);
 int
 diff --git a/tests/qemumonitorjsontest.c b/tests/qemumonitorjsontest.c
 index 48e2a457ab..8624a547b5 100644
 --- a/tests/qemumonitorjsontest.c
 +++ b/tests/qemumonitorjsontest.c
@@ -2780,7 +2780,7 @@ testQemuMonitorJSONBlockdevReopen(const void *opaque)
     if (qemuMonitorTestAddItem(test, "blockdev-reopen", "{\"return\":{}}") < 0)
         return -1;
 -    if (qemuBlockReopenFormatMon(qemuMonitorTestGetMonitor(test), src) < 0)
 +    if (qemuBlockReopenFormatMon(qemuMonitorTestGetMonitor(test), src, false) < 0)
         return -1;
     return 0;
 -- 
 2.34.1
--- a/SOURCES/libvirt-RHEL-Fix-virConnectGetMaxVcpus-output.patch
+++ b/SOURCES/libvirt-RHEL-Fix-virConnectGetMaxVcpus-output.patch
@ -1,46 +0,0 @@
 From 29eb7b77805cf5fb756c964cdbe7fb7fb2c01f5f Mon Sep 17 00:00:00 2001
 Message-Id: <29eb7b77805cf5fb756c964cdbe7fb7fb2c01f5f@dist-git>
 From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
 Date: Mon, 27 Aug 2018 13:09:38 +0200
 Subject: [PATCH] RHEL: Fix virConnectGetMaxVcpus output
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 https://bugzilla.redhat.com/show_bug.cgi?id=1092363
 RHEL-only.
 Ignore the maximum vcpu limit (KVM_CAP_MAX_VCPUS) on RHEL,
 since RHEL QEMU treats the recommended limit (KVM_CAP_NR_VCPUS)
 as the maximum, see:
 https://bugzilla.redhat.com/show_bug.cgi?id=998708
 (cherry picked from commit 7dff909fa34bdd93ad200dbffe70c0c1ee931925)
 Signed-off-by: Ján Tomko <jtomko@redhat.com>
 https: //bugzilla.redhat.com/show_bug.cgi?id=1582222
 Reviewed-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/util/virhostcpu.c | 5 +++++
 1 file changed, 5 insertions(+)
 diff --git a/src/util/virhostcpu.c b/src/util/virhostcpu.c
 index a07c00a0e9..35f41daef2 100644
 --- a/src/util/virhostcpu.c
 +++ b/src/util/virhostcpu.c
@@ -1166,6 +1166,11 @@ virHostCPUGetKVMMaxVCPUs(void)
         return -1;
     }
 +/* Ignore KVM_CAP_MAX_VCPUS on RHEL - the recommended maximum
 + * is treated as a hard limit.
 + */
 +# undef KVM_CAP_MAX_VCPUS
 +
 # ifdef KVM_CAP_MAX_VCPUS
     /* at first try KVM_CAP_MAX_VCPUS to determine the maximum count */
     if ((ret = ioctl(fd, KVM_CHECK_EXTENSION, KVM_CAP_MAX_VCPUS)) > 0)
 -- 
 2.34.1
--- a/SOURCES/libvirt-RHEL-Hack-around-changed-Broadwell-Haswell-CPUs.patch
+++ b/SOURCES/libvirt-RHEL-Hack-around-changed-Broadwell-Haswell-CPUs.patch
@ -1,185 +0,0 @@
 From 1d93a3944a200b7c955800faa598e0e11da098f8 Mon Sep 17 00:00:00 2001
 Message-Id: <1d93a3944a200b7c955800faa598e0e11da098f8@dist-git>
 From: Jiri Denemark <jdenemar@redhat.com>
 Date: Fri, 27 Mar 2015 12:48:40 +0100
 Subject: [PATCH] RHEL: Hack around changed Broadwell/Haswell CPUs
 RHEL-only
 Upstream tried to solve the change of Broadwell and Haswell CPUs by
 removing rtm and hle features from the corresponding CPU models for new
 machine types. Then they reverted this and introduced new *-noTSX models
 instead. However, the original fix was backported to RHEL.
 This patch makes sure Broadwell and Haswell will always contain rtm and
 hle features regardless on RHEL version or machine type used.
 https://bugzilla.redhat.com/show_bug.cgi?id=1199446
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/qemu/qemu_command.c                       | 22 +++++++++++++++++++
 tests/qemuxml2argvdata/cpu-Haswell.args       |  2 +-
 .../qemuxml2argvdata/cpu-host-model-cmt.args  |  2 +-
 .../cpu-translation.x86_64-4.0.0.args         |  2 +-
 .../cpu-translation.x86_64-latest.args        |  2 +-
 tests/qemuxml2argvdata/cpu-tsc-frequency.args |  2 +-
 tests/qemuxml2argvdata/q35-acpi-nouefi.args   |  2 +-
 tests/qemuxml2argvdata/q35-acpi-uefi.args     |  2 +-
 tests/qemuxml2argvdata/q35-noacpi-nouefi.args |  2 +-
 9 files changed, 30 insertions(+), 8 deletions(-)
 diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
 index d822533ccb..6b4647a711 100644
 --- a/src/qemu/qemu_command.c
 +++ b/src/qemu/qemu_command.c
@@ -6521,6 +6521,8 @@ qemuBuildCpuModelArgStr(virQEMUDriver *driver,
 {
     size_t i;
     virCPUDef *cpu = def->cpu;
 +    bool hle = false;
 +    bool rtm = false;
     switch ((virCPUMode) cpu->mode) {
     case VIR_CPU_MODE_HOST_PASSTHROUGH:
@@ -6587,6 +6589,12 @@ qemuBuildCpuModelArgStr(virQEMUDriver *driver,
     for (i = 0; i < cpu->nfeatures; i++) {
         const char *featname =
             virQEMUCapsCPUFeatureToQEMU(qemuCaps, cpu->features[i].name);
 +
 +        if (STREQ("rtm", cpu->features[i].name))
 +            rtm = true;
 +        if (STREQ("hle", cpu->features[i].name))
 +            hle = true;
 +
         switch ((virCPUFeaturePolicy) cpu->features[i].policy) {
         case VIR_CPU_FEATURE_FORCE:
         case VIR_CPU_FEATURE_REQUIRE:
@@ -6604,6 +6612,20 @@ qemuBuildCpuModelArgStr(virQEMUDriver *driver,
         }
     }
 +    /* Some versions of qemu-kvm in RHEL provide Broadwell and Haswell CPU
 +     * models which lack rtm and hle features when used with some machine
 +     * types. Let's make sure Broadwell and Haswell will always have these
 +     * features. But only if the features were not explicitly mentioned in
 +     * the guest CPU definition.
 +     */
 +    if (STREQ_NULLABLE(cpu->model, "Broadwell") ||
 +        STREQ_NULLABLE(cpu->model, "Haswell")) {
 +        if (!rtm)
 +            virBufferAddLit(buf, ",rtm=on");
 +        if (!hle)
 +            virBufferAddLit(buf, ",hle=on");
 +    }
 +
     return 0;
 }
 diff --git a/tests/qemuxml2argvdata/cpu-Haswell.args b/tests/qemuxml2argvdata/cpu-Haswell.args
 index b57fdfddc5..965274c1f0 100644
 --- a/tests/qemuxml2argvdata/cpu-Haswell.args
 +++ b/tests/qemuxml2argvdata/cpu-Haswell.args
@@ -13,7 +13,7 @@ QEMU_AUDIO_DRV=none \
 -object secret,id=masterKey0,format=raw,file=/tmp/lib/domain--1-QEMUGuest1/master-key.aes \
 -machine pc,usb=off,dump-guest-core=off \
 -accel kvm \
 --cpu Haswell \
 +-cpu Haswell,rtm=on,hle=on \
 -m 214 \
 -realtime mlock=off \
 -smp 6,sockets=6,cores=1,threads=1 \
 diff --git a/tests/qemuxml2argvdata/cpu-host-model-cmt.args b/tests/qemuxml2argvdata/cpu-host-model-cmt.args
 index 0de04e877d..602f70de86 100644
 --- a/tests/qemuxml2argvdata/cpu-host-model-cmt.args
 +++ b/tests/qemuxml2argvdata/cpu-host-model-cmt.args
@@ -13,7 +13,7 @@ QEMU_AUDIO_DRV=none \
 -object secret,id=masterKey0,format=raw,file=/tmp/lib/domain--1-QEMUGuest1/master-key.aes \
 -machine pc,usb=off,dump-guest-core=off \
 -accel tcg \
 --cpu Haswell,vme=on,ds=on,acpi=on,ss=on,ht=on,tm=on,pbe=on,dtes64=on,monitor=on,ds-cpl=on,vmx=on,smx=on,est=on,tm2=on,xtpr=on,pdcm=on,f16c=on,rdrand=on,pdpe1gb=on,abm=on,lahf-lm=on \
 +-cpu Haswell,vme=on,ds=on,acpi=on,ss=on,ht=on,tm=on,pbe=on,dtes64=on,monitor=on,ds-cpl=on,vmx=on,smx=on,est=on,tm2=on,xtpr=on,pdcm=on,f16c=on,rdrand=on,pdpe1gb=on,abm=on,lahf-lm=on,rtm=on,hle=on \
 -m 214 \
 -realtime mlock=off \
 -smp 6,sockets=6,cores=1,threads=1 \
 diff --git a/tests/qemuxml2argvdata/cpu-translation.x86_64-4.0.0.args b/tests/qemuxml2argvdata/cpu-translation.x86_64-4.0.0.args
 index 09141106d5..ace08d5d76 100644
 --- a/tests/qemuxml2argvdata/cpu-translation.x86_64-4.0.0.args
 +++ b/tests/qemuxml2argvdata/cpu-translation.x86_64-4.0.0.args
@@ -13,7 +13,7 @@ QEMU_AUDIO_DRV=none \
 -object secret,id=masterKey0,format=raw,file=/tmp/lib/domain--1-QEMUGuest1/master-key.aes \
 -machine pc-i440fx-4.0,usb=off,dump-guest-core=off \
 -accel tcg \
 --cpu Haswell,pclmulqdq=on,ds-cpl=on,tsc-adjust=on,fxsr-opt=on,lahf-lm=on,cmp-legacy=on,nodeid-msr=on,perfctr-core=on,perfctr-nb=on,kvm-pv-eoi=on,kvm-pv-unhalt=on \
 +-cpu Haswell,pclmulqdq=on,ds-cpl=on,tsc-adjust=on,fxsr-opt=on,lahf-lm=on,cmp-legacy=on,nodeid-msr=on,perfctr-core=on,perfctr-nb=on,rtm=on,hle=on,kvm-pv-eoi=on,kvm-pv-unhalt=on \
 -m 214 \
 -overcommit mem-lock=off \
 -smp 1,sockets=1,cores=1,threads=1 \
 diff --git a/tests/qemuxml2argvdata/cpu-translation.x86_64-latest.args b/tests/qemuxml2argvdata/cpu-translation.x86_64-latest.args
 index 2dab572a6b..a9f7c4b910 100644
 --- a/tests/qemuxml2argvdata/cpu-translation.x86_64-latest.args
 +++ b/tests/qemuxml2argvdata/cpu-translation.x86_64-latest.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/tmp/lib/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram \
 -accel tcg \
 --cpu Haswell,pclmulqdq=on,ds-cpl=on,tsc-adjust=on,fxsr-opt=on,lahf-lm=on,cmp-legacy=on,nodeid-msr=on,perfctr-core=on,perfctr-nb=on,kvm-pv-eoi=on,kvm-pv-unhalt=on \
 +-cpu Haswell,pclmulqdq=on,ds-cpl=on,tsc-adjust=on,fxsr-opt=on,lahf-lm=on,cmp-legacy=on,nodeid-msr=on,perfctr-core=on,perfctr-nb=on,rtm=on,hle=on,kvm-pv-eoi=on,kvm-pv-unhalt=on \
 -m 214 \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
 diff --git a/tests/qemuxml2argvdata/cpu-tsc-frequency.args b/tests/qemuxml2argvdata/cpu-tsc-frequency.args
 index 4a032f5d85..48fb75abcc 100644
 --- a/tests/qemuxml2argvdata/cpu-tsc-frequency.args
 +++ b/tests/qemuxml2argvdata/cpu-tsc-frequency.args
@@ -13,7 +13,7 @@ QEMU_AUDIO_DRV=none \
 -object secret,id=masterKey0,format=raw,file=/tmp/lib/domain--1-QEMUGuest1/master-key.aes \
 -machine pc,usb=off,dump-guest-core=off \
 -accel kvm \
 --cpu Haswell,vme=on,ds=on,acpi=on,ss=on,ht=on,tm=on,pbe=on,dtes64=on,monitor=on,ds-cpl=on,vmx=on,smx=on,est=on,tm2=on,xtpr=on,pdcm=on,f16c=on,rdrand=on,pdpe1gb=on,abm=on,lahf-lm=on,invtsc=on,tsc-frequency=4567890000 \
 +-cpu Haswell,vme=on,ds=on,acpi=on,ss=on,ht=on,tm=on,pbe=on,dtes64=on,monitor=on,ds-cpl=on,vmx=on,smx=on,est=on,tm2=on,xtpr=on,pdcm=on,f16c=on,rdrand=on,pdpe1gb=on,abm=on,lahf-lm=on,invtsc=on,rtm=on,hle=on,tsc-frequency=4567890000 \
 -m 214 \
 -realtime mlock=off \
 -smp 1,sockets=1,cores=1,threads=1 \
 diff --git a/tests/qemuxml2argvdata/q35-acpi-nouefi.args b/tests/qemuxml2argvdata/q35-acpi-nouefi.args
 index 3faee48c77..a1f742712d 100644
 --- a/tests/qemuxml2argvdata/q35-acpi-nouefi.args
 +++ b/tests/qemuxml2argvdata/q35-acpi-nouefi.args
@@ -13,7 +13,7 @@ QEMU_AUDIO_DRV=none \
 -object secret,id=masterKey0,format=raw,file=/tmp/lib/domain--1-guest/master-key.aes \
 -machine q35,usb=off,dump-guest-core=off \
 -accel tcg \
 --cpu Haswell \
 +-cpu Haswell,rtm=on,hle=on \
 -m 1024 \
 -realtime mlock=off \
 -smp 1,sockets=1,cores=1,threads=1 \
 diff --git a/tests/qemuxml2argvdata/q35-acpi-uefi.args b/tests/qemuxml2argvdata/q35-acpi-uefi.args
 index 60da1e282a..620056223a 100644
 --- a/tests/qemuxml2argvdata/q35-acpi-uefi.args
 +++ b/tests/qemuxml2argvdata/q35-acpi-uefi.args
@@ -13,7 +13,7 @@ QEMU_AUDIO_DRV=none \
 -object secret,id=masterKey0,format=raw,file=/tmp/lib/domain--1-guest/master-key.aes \
 -machine q35,usb=off,dump-guest-core=off \
 -accel tcg \
 --cpu Haswell \
 +-cpu Haswell,rtm=on,hle=on \
 -drive file=/usr/share/OVMF/OVMF_CODE.fd,if=pflash,format=raw,unit=0,readonly=on \
 -drive file=/var/lib/libvirt/qemu/nvram/guest_VARS.fd,if=pflash,format=raw,unit=1 \
 -m 1024 \
 diff --git a/tests/qemuxml2argvdata/q35-noacpi-nouefi.args b/tests/qemuxml2argvdata/q35-noacpi-nouefi.args
 index 14e5bbc22a..ea66536c2a 100644
 --- a/tests/qemuxml2argvdata/q35-noacpi-nouefi.args
 +++ b/tests/qemuxml2argvdata/q35-noacpi-nouefi.args
@@ -13,7 +13,7 @@ QEMU_AUDIO_DRV=none \
 -object secret,id=masterKey0,format=raw,file=/tmp/lib/domain--1-guest/master-key.aes \
 -machine q35,usb=off,dump-guest-core=off \
 -accel tcg \
 --cpu Haswell \
 +-cpu Haswell,rtm=on,hle=on \
 -m 1024 \
 -realtime mlock=off \
 -smp 1,sockets=1,cores=1,threads=1 \
 -- 
 2.34.1
--- a/SOURCES/libvirt-RHEL-Remove-glib-2.64.0-workaround-for-GSource-race.patch
+++ b/SOURCES/libvirt-RHEL-Remove-glib-2.64.0-workaround-for-GSource-race.patch
@ -1,89 +0,0 @@
 From b550b671bace6d979a0763a837ce97ddf72e8fc8 Mon Sep 17 00:00:00 2001
 Message-Id: <b550b671bace6d979a0763a837ce97ddf72e8fc8@dist-git>
 From: Martin Kletzander <mkletzan@redhat.com>
 Date: Fri, 28 Jan 2022 20:33:12 +0100
 Subject: [PATCH] RHEL: Remove <glib-2.64.0 workaround for GSource race
 https://bugzilla.redhat.com/show_bug.cgi?id=2045879
 This is to accommodate for RHEL 8 downstream glib being fixed with a backport in
 version 2.56.4-12 (Bug 1948988).  Another reason for that is that our workaround
 does not play nice with a fixed glib, leading to libvirt not properly
 dereferencing the monitor socket, eventually leading to EMFILE: Too many open
 files.
 RHEL-only
 Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
 Reviewed-by: Peter Krempa <pkrempa@redhat.com>
 ---
 src/util/glibcompat.c | 46 ++++++++-----------------------------------
 1 file changed, 8 insertions(+), 38 deletions(-)
 diff --git a/src/util/glibcompat.c b/src/util/glibcompat.c
 index eb6dcc0111..bf890f10d2 100644
 --- a/src/util/glibcompat.c
 +++ b/src/util/glibcompat.c
@@ -212,51 +212,21 @@ vir_g_strdup_vprintf(const char *msg, va_list args)
     return ret;
 }
 -
 /*
 - * If the last reference to a GSource is released in a non-main
 - * thread we're exposed to a race condition that causes a
 - * crash:
 - *
 - *    https://gitlab.gnome.org/GNOME/glib/-/merge_requests/1358
 + * This is a leftover of a hack that works around glib older than 2.64.0, but
 + * the fix in glib as backported in RHEL-8 to glib2-2.56.4-12 in BZ 1948988:
  *
 - * Thus we're using an idle func to release our ref...
 + *   https://bugzilla.redhat.com/show_bug.cgi?id=1948988
  *
 - * ...but this imposes a significant performance penalty on
 - * I/O intensive workloads which are sensitive to the iterations
 - * of the event loop, so avoid the workaround if we know we have
 - * new enough glib.
 + * and our workaround coupled with that glib fix started causing leaks, which
 + * surfaced with us not unreferencing the qemu monitor socket in BZ 2045879:
  *
 - * The function below is used from a header file definition.
 + *   https://bugzilla.redhat.com/show_bug.cgi?id=2045879
  *
 - * Drop when min glib >= 2.64.0
 + * Keeping this wrapper makes it easier to follow with other backports without
 + * conflicts in callers due to the function name change.
  */
 -#if GLIB_CHECK_VERSION(2, 64, 0)
 void vir_g_source_unref(GSource *src, GMainContext *ctx G_GNUC_UNUSED)
 {
     g_source_unref(src);
 }
 -#else
 -
 -static gboolean
 -virEventGLibSourceUnrefIdle(gpointer data)
 -{
 -    GSource *src = data;
 -
 -    g_source_unref(src);
 -
 -    return FALSE;
 -}
 -
 -void vir_g_source_unref(GSource *src, GMainContext *ctx)
 -{
 -    GSource *idle = g_idle_source_new();
 -
 -    g_source_set_callback(idle, virEventGLibSourceUnrefIdle, src, NULL);
 -
 -    g_source_attach(idle, ctx);
 -
 -    g_source_unref(idle);
 -}
 -
 -#endif
 -- 
 2.35.1
--- a/SOURCES/libvirt-RHEL-qemu-Add-ability-to-set-sgio-values-for-hostdev.patch
+++ b/SOURCES/libvirt-RHEL-qemu-Add-ability-to-set-sgio-values-for-hostdev.patch
@ -1,81 +0,0 @@
 From d6956a1aaa8757fab60132c3ee46c2bb199a78a8 Mon Sep 17 00:00:00 2001
 Message-Id: <d6956a1aaa8757fab60132c3ee46c2bb199a78a8@dist-git>
 From: John Ferlan <jferlan@redhat.com>
 Date: Mon, 17 Dec 2018 20:42:30 -0500
 Subject: [PATCH] RHEL: qemu: Add ability to set sgio values for hostdev
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 https://bugzilla.redhat.com/show_bug.cgi?id=1582424
 RHEL-only
 Add necessary checks in order to allow setting sgio values for a scsi
 host device
 Signed-off-by: John Ferlan <jferlan@redhat.com>
 Signed-off-by: Ján Tomko <jtomko@redhat.com>
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/qemu/qemu_conf.c | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)
 diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c
 index 6077457ff4..ba85fc6e22 100644
 --- a/src/qemu/qemu_conf.c
 +++ b/src/qemu/qemu_conf.c
@@ -1841,8 +1841,9 @@ qemuSetUnprivSGIO(virDomainDeviceDef *dev)
     virDomainDiskDef *disk = NULL;
     virDomainHostdevDef *hostdev = NULL;
     g_autofree char *sysfs_path = NULL;
 +    g_autofree char *hostdev_path = NULL;
     const char *path = NULL;
 -    int val = -1;
 +    int val = 0;
     /* "sgio" is only valid for block disk; cdrom
      * and floopy disk can have empty source.
@@ -1858,17 +1859,14 @@ qemuSetUnprivSGIO(virDomainDeviceDef *dev)
     } else if (dev->type == VIR_DOMAIN_DEVICE_HOSTDEV) {
         hostdev = dev->data.hostdev;
 -        if (!qemuIsSharedHostdev(hostdev))
 +        if (hostdev->source.subsys.u.scsi.protocol ==
 +            VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
             return 0;
 -        if (hostdev->source.subsys.u.scsi.sgio) {
 -            virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
 -                           _("'sgio' is not supported for SCSI "
 -                             "generic device yet "));
 +        if (!(hostdev_path = qemuGetHostdevPath(hostdev)))
             return -1;
 -        }
 -        return 0;
 +        path = hostdev_path;
     } else {
         return 0;
     }
@@ -1877,7 +1875,16 @@ qemuSetUnprivSGIO(virDomainDeviceDef *dev)
         return -1;
     /* By default, filter the SG_IO commands, i.e. set unpriv_sgio to 0.  */
 -    val = (disk->sgio == VIR_DOMAIN_DEVICE_SGIO_UNFILTERED);
 +    if (dev->type == VIR_DOMAIN_DEVICE_DISK) {
 +        if (disk->sgio == VIR_DOMAIN_DEVICE_SGIO_UNFILTERED)
 +            val = 1;
 +    } else {
 +        /* Only settable if <shareable/> was present for hostdev */
 +        if (qemuIsSharedHostdev(hostdev) &&
 +            hostdev->source.subsys.u.scsi.sgio ==
 +            VIR_DOMAIN_DEVICE_SGIO_UNFILTERED)
 +            val = 1;
 +    }
     /* Do not do anything if unpriv_sgio is not supported by the kernel and the
      * whitelist is enabled.  But if requesting unfiltered access, always call
 -- 
 2.34.1
--- a/SOURCES/libvirt-RHEL-qemu-Add-check-for-unpriv-sgio-for-SCSI-generic-host-device.patch
+++ b/SOURCES/libvirt-RHEL-qemu-Add-check-for-unpriv-sgio-for-SCSI-generic-host-device.patch
@ -1,66 +0,0 @@
 From f562b4c83d342002291f6bd7c5776eaecbd3147f Mon Sep 17 00:00:00 2001
 Message-Id: <f562b4c83d342002291f6bd7c5776eaecbd3147f@dist-git>
 From: John Ferlan <jferlan@redhat.com>
 Date: Mon, 17 Dec 2018 20:42:31 -0500
 Subject: [PATCH] RHEL: qemu: Add check for unpriv sgio for SCSI generic host
 device
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 https://bugzilla.redhat.com/show_bug.cgi?id=1582424
 RHEL-only
 Check if the hostdev has set the sgio filtered/unfiltered and handle
 appropriately.
 This restores functionality removed by upstream commit id 'ce346623'
 to remove sgio support for the SCSI generic host device.
 Signed-off-by: John Ferlan <jferlan@redhat.com>
 Signed-off-by: Ján Tomko <jtomko@redhat.com>
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/qemu/qemu_conf.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)
 diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c
 index ba85fc6e22..28c334761b 100644
 --- a/src/qemu/qemu_conf.c
 +++ b/src/qemu/qemu_conf.c
@@ -1749,13 +1749,29 @@ qemuSharedHostdevAddRemoveInternal(virQEMUDriver *driver,
 {
     g_autofree char *dev_path = NULL;
     g_autofree char *key = NULL;
 +    virDomainHostdevSubsysSCSI *scsisrc = &hostdev->source.subsys.u.scsi;
 +    virDomainHostdevSubsysSCSIHost *scsihostsrc = &scsisrc->u.host;
     int ret = -1;
     if (!qemuIsSharedHostdev(hostdev))
         return 0;
 -    if (!(dev_path = qemuGetHostdevPath(hostdev)) ||
 -        !(key = qemuGetSharedDeviceKey(dev_path)))
 +    if (!(dev_path = qemuGetHostdevPath(hostdev)))
 +        return -1;
 +
 +    if ((ret = qemuCheckUnprivSGIO(driver->sharedDevices, dev_path,
 +                                   scsisrc->sgio)) < 0) {
 +        if (ret == -2) {
 +            virReportError(VIR_ERR_OPERATION_INVALID,
 +                           _("sgio of shared scsi host device '%s-%u-%u-%llu' "
 +                             "conflicts with other active domains"),
 +                           scsihostsrc->adapter, scsihostsrc->bus,
 +                           scsihostsrc->target, scsihostsrc->unit);
 +        }
 +        return -1;
 +    }
 +
 +    if (!(key = qemuGetSharedDeviceKey(dev_path)))
         return -1;
     qemuDriverLock(driver);
 -- 
 2.34.1
--- a/SOURCES/libvirt-RHEL-qemu_migration-Fix-restoring-memlock-limit-on-destination.patch
+++ b/SOURCES/libvirt-RHEL-qemu_migration-Fix-restoring-memlock-limit-on-destination.patch
@ -1,52 +0,0 @@
 From b6c1f9ca8eb0ca8f7603ab205c7dc95b9f07b5a0 Mon Sep 17 00:00:00 2001
 Message-Id: <b6c1f9ca8eb0ca8f7603ab205c7dc95b9f07b5a0@dist-git>
 From: Jiri Denemark <jdenemar@redhat.com>
 Date: Mon, 18 Jul 2022 16:01:20 +0200
 Subject: [PATCH] RHEL: qemu_migration: Fix restoring memlock limit on
 destination
 Restoring memory locking limit on the destination host only makes sense
 when migration succeeded as otherwise the QEMU process will be killed
 anyway. Specifically if the migration fails because the process died,
 touching the limit would produce rather unhelpful error message instead
 of the real issue:
    cannot get locked memory limit of process -1: No such file or
    directory
 This patch is RHEL-only caused by misplacing the call to
 qemuDomainSetMaxMemLock when the "qemu_migration: Restore original
 memory locking limit" upstream patch was backported to an older code
 base.
 https://bugzilla.redhat.com/show_bug.cgi?id=2107954
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/qemu/qemu_migration.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c
 index db5163e993..11f87296d6 100644
 --- a/src/qemu/qemu_migration.c
 +++ b/src/qemu/qemu_migration.c
@@ -5895,6 +5895,8 @@ qemuMigrationDstFinish(virQEMUDriver *driver,
          */
         if (inPostCopy)
             g_clear_pointer(&priv->job.completed, qemuDomainJobInfoFree);
 +
 +        qemuDomainSetMaxMemLock(vm, 0, &priv->preMigrationMemlock);
     }
     qemuMigrationParamsReset(driver, vm, QEMU_ASYNC_JOB_MIGRATION_IN,
@@ -5907,7 +5909,6 @@ qemuMigrationDstFinish(virQEMUDriver *driver,
  cleanup:
     g_clear_pointer(&jobInfo, qemuDomainJobInfoFree);
     virPortAllocatorRelease(port);
 -    qemuDomainSetMaxMemLock(vm, 0, &priv->preMigrationMemlock);
     if (priv->mon)
         qemuMonitorSetDomainLog(priv->mon, NULL, NULL, NULL);
     VIR_FREE(priv->origname);
 -- 
 2.35.1
--- a/SOURCES/libvirt-RHEL-virscsi-Check-device-type-before-getting-it-s-dev-node-name.patch
+++ b/SOURCES/libvirt-RHEL-virscsi-Check-device-type-before-getting-it-s-dev-node-name.patch
@ -1,215 +0,0 @@
 From 9c5daeb8c99ca12a66387de448f585742887fd75 Mon Sep 17 00:00:00 2001
 Message-Id: <9c5daeb8c99ca12a66387de448f585742887fd75@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Fri, 6 Mar 2020 15:52:21 +0100
 Subject: [PATCH] RHEL: virscsi: Check device type before getting it's /dev
 node name
 Not all SCSI devices are block devices, therefore
 /sys/bus/scsi/devices/X:X:X:X/block/ directory does not always
 exist. Check if the SCSI device is a block device beforehand.
 https://bugzilla.redhat.com/show_bug.cgi?id=1808390
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Message-Id: <20200306145226.1610708-2-abologna@redhat.com>
 Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/util/virscsi.c             | 140 ++++++++++++++++++++++++++++++---
 tests/virscsidata/0-0-0-0/type |   1 +
 tests/virscsidata/1-0-0-0/type |   1 +
 3 files changed, 131 insertions(+), 11 deletions(-)
 create mode 100644 tests/virscsidata/0-0-0-0/type
 create mode 100644 tests/virscsidata/1-0-0-0/type
 diff --git a/src/util/virscsi.c b/src/util/virscsi.c
 index 6a90d9002f..770f727cac 100644
 --- a/src/util/virscsi.c
 +++ b/src/util/virscsi.c
@@ -47,6 +47,32 @@ struct _virUsedByInfo {
 };
 typedef struct _virUsedByInfo virUsedByInfo;
 +
 +/* Keep in sync with scsi/scsi_proto.h */
 +typedef enum {
 +    VIR_SCSI_DEVICE_TYPE_NONE = -1,
 +    VIR_SCSI_DEVICE_TYPE_DISK = 0x00,
 +    VIR_SCSI_DEVICE_TYPE_TAPE = 0x01,
 +    VIR_SCSI_DEVICE_TYPE_PRINTER = 0x02,
 +    VIR_SCSI_DEVICE_TYPE_PROCESSOR = 0x03,
 +    VIR_SCSI_DEVICE_TYPE_WORM = 0x04,
 +    VIR_SCSI_DEVICE_TYPE_ROM = 0x05,
 +    VIR_SCSI_DEVICE_TYPE_SCANNER = 0x06,
 +    VIR_SCSI_DEVICE_TYPE_MOD = 0x07,
 +    VIR_SCSI_DEVICE_TYPE_MEDIUM_CHANGER = 0x08,
 +    VIR_SCSI_DEVICE_TYPE_COMM = 0x09,
 +    VIR_SCSI_DEVICE_TYPE_RAID = 0x0c,
 +    VIR_SCSI_DEVICE_TYPE_ENCLOSURE = 0x0d,
 +    VIR_SCSI_DEVICE_TYPE_RBC = 0x0e,
 +    VIR_SCSI_DEVICE_TYPE_OSD = 0x11,
 +    VIR_SCSI_DEVICE_TYPE_ZBC = 0x14,
 +    VIR_SCSI_DEVICE_TYPE_WLUN = 0x1e,
 +    VIR_SCSI_DEVICE_TYPE_NO_LUN = 0x7f,
 +
 +    VIR_SCSI_DEVICE_TYPE_LAST,
 +} virSCSIDeviceType;
 +
 +
 struct _virSCSIDevice {
     unsigned int adapter;
     unsigned int bus;
@@ -126,6 +152,78 @@ virSCSIDeviceGetSgName(const char *sysfs_prefix,
     return NULL;
 }
 +
 +static int
 +virSCSIDeviceGetType(const char *prefix,
 +                     unsigned int adapter,
 +                     unsigned int bus,
 +                     unsigned int target,
 +                     unsigned long long unit,
 +                     virSCSIDeviceType *type)
 +{
 +    int intType;
 +
 +    if (virFileReadValueInt(&intType,
 +                            "%s/%d:%u:%u:%llu/type",
 +                            prefix, adapter, bus, target, unit) < 0)
 +        return -1;
 +
 +    switch (intType) {
 +    case VIR_SCSI_DEVICE_TYPE_DISK:
 +    case VIR_SCSI_DEVICE_TYPE_TAPE:
 +    case VIR_SCSI_DEVICE_TYPE_PRINTER:
 +    case VIR_SCSI_DEVICE_TYPE_PROCESSOR:
 +    case VIR_SCSI_DEVICE_TYPE_WORM:
 +    case VIR_SCSI_DEVICE_TYPE_ROM:
 +    case VIR_SCSI_DEVICE_TYPE_SCANNER:
 +    case VIR_SCSI_DEVICE_TYPE_MOD:
 +    case VIR_SCSI_DEVICE_TYPE_MEDIUM_CHANGER:
 +    case VIR_SCSI_DEVICE_TYPE_COMM:
 +    case VIR_SCSI_DEVICE_TYPE_RAID:
 +    case VIR_SCSI_DEVICE_TYPE_ENCLOSURE:
 +    case VIR_SCSI_DEVICE_TYPE_RBC:
 +    case VIR_SCSI_DEVICE_TYPE_OSD:
 +    case VIR_SCSI_DEVICE_TYPE_ZBC:
 +    case VIR_SCSI_DEVICE_TYPE_WLUN:
 +    case VIR_SCSI_DEVICE_TYPE_NO_LUN:
 +        *type = intType;
 +        break;
 +
 +    default:
 +        virReportError(VIR_ERR_INTERNAL_ERROR,
 +                       _("unknown SCSI device type: %x"),
 +                       intType);
 +        return -1;
 +    }
 +
 +    return 0;
 +}
 +
 +
 +static char *
 +virSCSIDeviceGetDevNameBlock(const char *prefix,
 +                             unsigned int adapter,
 +                             unsigned int bus,
 +                             unsigned int target,
 +                             unsigned long long unit)
 +{
 +    g_autoptr(DIR) dir = NULL;
 +    struct dirent *entry;
 +    g_autofree char *path = NULL;
 +
 +    path = g_strdup_printf("%s/%d:%u:%u:%llu/block",
 +                           prefix, adapter, bus, target, unit);
 +
 +    if (virDirOpen(&dir, path) < 0)
 +        return NULL;
 +
 +    if (virDirRead(dir, &entry, path) > 0)
 +        return g_strdup(entry->d_name);
 +
 +    return NULL;
 +}
 +
 +
 /* Returns device name (e.g. "sdc") on success, or NULL
  * on failure.
  */
@@ -136,25 +234,45 @@ virSCSIDeviceGetDevName(const char *sysfs_prefix,
                         unsigned int target,
                         unsigned long long unit)
 {
 -    g_autoptr(DIR) dir = NULL;
 -    struct dirent *entry;
 -    g_autofree char *path = NULL;
     unsigned int adapter_id;
 +    virSCSIDeviceType type;
     const char *prefix = sysfs_prefix ? sysfs_prefix : SYSFS_SCSI_DEVICES;
     if (virSCSIDeviceGetAdapterId(adapter, &adapter_id) < 0)
         return NULL;
 -    path = g_strdup_printf("%s/%d:%u:%u:%llu/block", prefix, adapter_id, bus,
 -                           target, unit);
 -
 -    if (virDirOpen(&dir, path) < 0)
 +    if (virSCSIDeviceGetType(prefix, adapter_id,
 +                             bus, target, unit, &type) < 0)
         return NULL;
 -    if (virDirRead(dir, &entry, path) > 0)
 -        return g_strdup(entry->d_name);
 -
 -    return NULL;
 +    switch (type) {
 +    case VIR_SCSI_DEVICE_TYPE_DISK:
 +        return virSCSIDeviceGetDevNameBlock(prefix, adapter_id, bus, target, unit);
 +
 +    case VIR_SCSI_DEVICE_TYPE_TAPE:
 +    case VIR_SCSI_DEVICE_TYPE_PRINTER:
 +    case VIR_SCSI_DEVICE_TYPE_PROCESSOR:
 +    case VIR_SCSI_DEVICE_TYPE_WORM:
 +    case VIR_SCSI_DEVICE_TYPE_ROM:
 +    case VIR_SCSI_DEVICE_TYPE_SCANNER:
 +    case VIR_SCSI_DEVICE_TYPE_MOD:
 +    case VIR_SCSI_DEVICE_TYPE_MEDIUM_CHANGER:
 +    case VIR_SCSI_DEVICE_TYPE_COMM:
 +    case VIR_SCSI_DEVICE_TYPE_RAID:
 +    case VIR_SCSI_DEVICE_TYPE_ENCLOSURE:
 +    case VIR_SCSI_DEVICE_TYPE_RBC:
 +    case VIR_SCSI_DEVICE_TYPE_OSD:
 +    case VIR_SCSI_DEVICE_TYPE_ZBC:
 +    case VIR_SCSI_DEVICE_TYPE_WLUN:
 +    case VIR_SCSI_DEVICE_TYPE_NO_LUN:
 +    case VIR_SCSI_DEVICE_TYPE_NONE:
 +    case VIR_SCSI_DEVICE_TYPE_LAST:
 +    default:
 +        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
 +                       _("unsupported SCSI device type: %x"),
 +                       type);
 +        return NULL;
 +    }
 }
 virSCSIDevice *
 diff --git a/tests/virscsidata/0-0-0-0/type b/tests/virscsidata/0-0-0-0/type
 new file mode 100644
 index 0000000000..573541ac97
 --- /dev/null
 +++ b/tests/virscsidata/0-0-0-0/type
@@ -0,0 +1 @@
 +0
 diff --git a/tests/virscsidata/1-0-0-0/type b/tests/virscsidata/1-0-0-0/type
 new file mode 100644
 index 0000000000..573541ac97
 --- /dev/null
 +++ b/tests/virscsidata/1-0-0-0/type
@@ -0,0 +1 @@
 +0
 -- 
 2.34.1
--- a/SOURCES/libvirt-RHEL-virscsi-Introduce-and-use-virSCSIDeviceGetUnprivSGIOSysfsPath.patch
+++ b/SOURCES/libvirt-RHEL-virscsi-Introduce-and-use-virSCSIDeviceGetUnprivSGIOSysfsPath.patch
@ -1,272 +0,0 @@
 From 1ce4faffcd4616bbcea4d198c3f60cbcfddd784e Mon Sep 17 00:00:00 2001
 Message-Id: <1ce4faffcd4616bbcea4d198c3f60cbcfddd784e@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Fri, 6 Mar 2020 15:52:23 +0100
 Subject: [PATCH] RHEL: virscsi: Introduce and use
 virSCSIDeviceGetUnprivSGIOSysfsPath()
 When constructing a path to the 'unpriv_sgio' file of given SCSI
 device we don't need to go through /dev/* and major() + minor()
 path. The generated path points to
 /sys/dev/block/MAJ:MIN/queue/unpriv_sgio which is wrong if the
 SCSI device in question is not a block device. We can generate a
 different path: /sys/bus/scsi/devices/X:X:X:X/unpriv_sgio where
 the file is directly accessible regardless of the SCSI device
 type.
 https://bugzilla.redhat.com/show_bug.cgi?id=1808390
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Message-Id: <20200306145226.1610708-4-abologna@redhat.com>
 Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/libvirt_private.syms |  1 +
 src/qemu/qemu_conf.c     | 31 +++++++++++++++++++------------
 src/util/virscsi.c       | 19 +++++++++++++++++++
 src/util/virscsi.h       |  5 +++++
 src/util/virutil.c       | 24 ++++++------------------
 src/util/virutil.h       |  2 --
 6 files changed, 50 insertions(+), 32 deletions(-)
 diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
 index 5b76e66e61..2c42e2a5e8 100644
 --- a/src/libvirt_private.syms
 +++ b/src/libvirt_private.syms
@@ -3191,6 +3191,7 @@ virSCSIDeviceGetSgName;
 virSCSIDeviceGetShareable;
 virSCSIDeviceGetTarget;
 virSCSIDeviceGetUnit;
 +virSCSIDeviceGetUnprivSGIOSysfsPath;
 virSCSIDeviceIsAvailable;
 virSCSIDeviceListAdd;
 virSCSIDeviceListCount;
 diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c
 index 28c334761b..a0b8076d6b 100644
 --- a/src/qemu/qemu_conf.c
 +++ b/src/qemu/qemu_conf.c
@@ -1506,7 +1506,7 @@ qemuCheckUnprivSGIO(GHashTable *sharedDevices,
     if (!(virHashLookup(sharedDevices, key)))
         return 0;
 -    if (virGetDeviceUnprivSGIO(device_path, NULL, &val) < 0)
 +    if (virGetDeviceUnprivSGIO(sysfs_path, &val) < 0)
         return -1;
     /* Error message on failure needs to be handled in caller
@@ -1857,39 +1857,46 @@ qemuSetUnprivSGIO(virDomainDeviceDef *dev)
     virDomainDiskDef *disk = NULL;
     virDomainHostdevDef *hostdev = NULL;
     g_autofree char *sysfs_path = NULL;
 -    g_autofree char *hostdev_path = NULL;
 -    const char *path = NULL;
     int val = 0;
     /* "sgio" is only valid for block disk; cdrom
      * and floopy disk can have empty source.
      */
     if (dev->type == VIR_DOMAIN_DEVICE_DISK) {
 +        const char *path;
 +
         disk = dev->data.disk;
 +        path = virDomainDiskGetSource(disk);
         if (disk->device != VIR_DOMAIN_DISK_DEVICE_LUN ||
             !virStorageSourceIsBlockLocal(disk->src))
             return 0;
 -        path = virDomainDiskGetSource(disk);
 +        if (!(sysfs_path = virGetUnprivSGIOSysfsPath(path, NULL)))
 +            return -1;
 +
     } else if (dev->type == VIR_DOMAIN_DEVICE_HOSTDEV) {
 +        virDomainHostdevSubsysSCSI *scsisrc;
 +        virDomainHostdevSubsysSCSIHost *scsihostsrc;
 +
         hostdev = dev->data.hostdev;
 +        scsisrc = &hostdev->source.subsys.u.scsi;
 +        scsihostsrc = &scsisrc->u.host;
         if (hostdev->source.subsys.u.scsi.protocol ==
             VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI)
             return 0;
 -        if (!(hostdev_path = qemuGetHostdevPath(hostdev)))
 +        if (!(sysfs_path = virSCSIDeviceGetUnprivSGIOSysfsPath(NULL,
 +                                                               scsihostsrc->adapter,
 +                                                               scsihostsrc->bus,
 +                                                               scsihostsrc->target,
 +                                                               scsihostsrc->unit)))
             return -1;
 -
 -        path = hostdev_path;
     } else {
         return 0;
     }
 -    if (!(sysfs_path = virGetUnprivSGIOSysfsPath(path, NULL)))
 -        return -1;
 -
     /* By default, filter the SG_IO commands, i.e. set unpriv_sgio to 0.  */
     if (dev->type == VIR_DOMAIN_DEVICE_DISK) {
         if (disk->sgio == VIR_DOMAIN_DEVICE_SGIO_UNFILTERED)
@@ -1909,11 +1916,11 @@ qemuSetUnprivSGIO(virDomainDeviceDef *dev)
     if (virFileExists(sysfs_path) || val == 1) {
         int curr_val;
 -        if (virGetDeviceUnprivSGIO(path, NULL, &curr_val) < 0)
 +        if (virGetDeviceUnprivSGIO(sysfs_path, &curr_val) < 0)
             return -1;
         if (curr_val != val &&
 -            virSetDeviceUnprivSGIO(path, NULL, val) < 0) {
 +            virSetDeviceUnprivSGIO(sysfs_path, val) < 0) {
             return -1;
         }
     }
 diff --git a/src/util/virscsi.c b/src/util/virscsi.c
 index 6165196423..b437fdcac0 100644
 --- a/src/util/virscsi.c
 +++ b/src/util/virscsi.c
@@ -302,6 +302,25 @@ virSCSIDeviceGetDevName(const char *sysfs_prefix,
     }
 }
 +
 +char *
 +virSCSIDeviceGetUnprivSGIOSysfsPath(const char *sysfs_prefix,
 +                                    const char *adapter,
 +                                    unsigned int bus,
 +                                    unsigned int target,
 +                                    unsigned long long unit)
 +{
 +    unsigned int adapter_id;
 +    const char *prefix = sysfs_prefix ? sysfs_prefix : SYSFS_SCSI_DEVICES;
 +
 +    if (virSCSIDeviceGetAdapterId(adapter, &adapter_id) < 0)
 +        return NULL;
 +
 +    return g_strdup_printf("%s/%d:%u:%u:%llu/unpriv_sgio",
 +                           prefix, adapter_id, bus, target, unit);
 +}
 +
 +
 virSCSIDevice *
 virSCSIDeviceNew(const char *sysfs_prefix,
                  const char *adapter,
 diff --git a/src/util/virscsi.h b/src/util/virscsi.h
 index 65ad15ed76..5721985939 100644
 --- a/src/util/virscsi.h
 +++ b/src/util/virscsi.h
@@ -40,6 +40,11 @@ char *virSCSIDeviceGetDevName(const char *sysfs_prefix,
                               unsigned int bus,
                               unsigned int target,
                               unsigned long long unit);
 +char *virSCSIDeviceGetUnprivSGIOSysfsPath(const char *sysfs_prefix,
 +                                          const char *adapter,
 +                                          unsigned int bus,
 +                                          unsigned int target,
 +                                          unsigned long long unit);
 virSCSIDevice *virSCSIDeviceNew(const char *sysfs_prefix,
                                   const char *adapter,
 diff --git a/src/util/virutil.c b/src/util/virutil.c
 index e04f1343d8..b1e37b45c5 100644
 --- a/src/util/virutil.c
 +++ b/src/util/virutil.c
@@ -1377,18 +1377,13 @@ virGetUnprivSGIOSysfsPath(const char *path,
 int
 virSetDeviceUnprivSGIO(const char *path,
 -                       const char *sysfs_dir,
                        int unpriv_sgio)
 {
 -    char *sysfs_path = NULL;
     char *val = NULL;
     int ret = -1;
     int rc;
 -    if (!(sysfs_path = virGetUnprivSGIOSysfsPath(path, sysfs_dir)))
 -        return -1;
 -
 -    if (!virFileExists(sysfs_path)) {
 +    if (!virFileExists(path)) {
         virReportError(VIR_ERR_OPERATION_INVALID, "%s",
                        _("unpriv_sgio is not supported by this kernel"));
         goto cleanup;
@@ -1396,38 +1391,32 @@ virSetDeviceUnprivSGIO(const char *path,
     val = g_strdup_printf("%d", unpriv_sgio);
 -    if ((rc = virFileWriteStr(sysfs_path, val, 0)) < 0) {
 -        virReportSystemError(-rc, _("failed to set %s"), sysfs_path);
 +    if ((rc = virFileWriteStr(path, val, 0)) < 0) {
 +        virReportSystemError(-rc, _("failed to set %s"), path);
         goto cleanup;
     }
     ret = 0;
  cleanup:
 -    VIR_FREE(sysfs_path);
     VIR_FREE(val);
     return ret;
 }
 int
 virGetDeviceUnprivSGIO(const char *path,
 -                       const char *sysfs_dir,
                        int *unpriv_sgio)
 {
 -    char *sysfs_path = NULL;
     char *buf = NULL;
     char *tmp = NULL;
     int ret = -1;
 -    if (!(sysfs_path = virGetUnprivSGIOSysfsPath(path, sysfs_dir)))
 -        return -1;
 -
 -    if (!virFileExists(sysfs_path)) {
 +    if (!virFileExists(path)) {
         virReportError(VIR_ERR_OPERATION_INVALID, "%s",
                        _("unpriv_sgio is not supported by this kernel"));
         goto cleanup;
     }
 -    if (virFileReadAll(sysfs_path, 1024, &buf) < 0)
 +    if (virFileReadAll(path, 1024, &buf) < 0)
         goto cleanup;
     if ((tmp = strchr(buf, '\n')))
@@ -1435,13 +1424,12 @@ virGetDeviceUnprivSGIO(const char *path,
     if (virStrToLong_i(buf, NULL, 10, unpriv_sgio) < 0) {
         virReportError(VIR_ERR_INTERNAL_ERROR,
 -                       _("failed to parse value of %s"), sysfs_path);
 +                       _("failed to parse value of %s"), path);
         goto cleanup;
     }
     ret = 0;
  cleanup:
 -    VIR_FREE(sysfs_path);
     VIR_FREE(buf);
     return ret;
 }
 diff --git a/src/util/virutil.h b/src/util/virutil.h
 index 854b494890..da267c6446 100644
 --- a/src/util/virutil.h
 +++ b/src/util/virutil.h
@@ -120,10 +120,8 @@ int virGetDeviceID(const char *path,
                    int *maj,
                    int *min) G_GNUC_NO_INLINE;
 int virSetDeviceUnprivSGIO(const char *path,
 -                           const char *sysfs_dir,
                            int unpriv_sgio);
 int virGetDeviceUnprivSGIO(const char *path,
 -                           const char *sysfs_dir,
                            int *unpriv_sgio);
 char *virGetUnprivSGIOSysfsPath(const char *path,
                                 const char *sysfs_dir);
 -- 
 2.34.1
--- a/SOURCES/libvirt-RHEL-virscsi-Support-TAPEs-in-virSCSIDeviceGetDevName.patch
+++ b/SOURCES/libvirt-RHEL-virscsi-Support-TAPEs-in-virSCSIDeviceGetDevName.patch
@ -1,200 +0,0 @@
 From 5b96a8773d33af9822f6b6ccddc8f372841895a6 Mon Sep 17 00:00:00 2001
 Message-Id: <5b96a8773d33af9822f6b6ccddc8f372841895a6@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Fri, 6 Mar 2020 15:52:22 +0100
 Subject: [PATCH] RHEL: virscsi: Support TAPEs in virSCSIDeviceGetDevName()
 If the SCSI device we want to get /dev node name for is TAPE
 device we need to look at 'tape' symlink in the sysfs dir
 corresponding to the device.
 https://bugzilla.redhat.com/show_bug.cgi?id=1808390
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Message-Id: <20200306145226.1610708-3-abologna@redhat.com>
 Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/util/virscsi.c                          | 27 +++++++++++++++
 tests/virscsidata/2-0-0-0/model             |  1 +
 tests/virscsidata/2-0-0-0/scsi_tape/st0/dev |  1 +
 tests/virscsidata/2-0-0-0/sg3/dev           |  1 +
 tests/virscsidata/2-0-0-0/tape              |  1 +
 tests/virscsidata/2-0-0-0/type              |  1 +
 tests/virscsidata/2-0-0-0/vendor            |  1 +
 tests/virscsidata/sg3                       |  0
 tests/virscsitest.c                         | 38 ++++++++++++++++++---
 9 files changed, 66 insertions(+), 5 deletions(-)
 create mode 100644 tests/virscsidata/2-0-0-0/model
 create mode 100644 tests/virscsidata/2-0-0-0/scsi_tape/st0/dev
 create mode 100644 tests/virscsidata/2-0-0-0/sg3/dev
 create mode 120000 tests/virscsidata/2-0-0-0/tape
 create mode 100644 tests/virscsidata/2-0-0-0/type
 create mode 100644 tests/virscsidata/2-0-0-0/vendor
 create mode 100644 tests/virscsidata/sg3
 diff --git a/src/util/virscsi.c b/src/util/virscsi.c
 index 770f727cac..6165196423 100644
 --- a/src/util/virscsi.c
 +++ b/src/util/virscsi.c
@@ -224,6 +224,31 @@ virSCSIDeviceGetDevNameBlock(const char *prefix,
 }
 +static char *
 +virSCSIDeviceGetDevNameTape(const char *prefix,
 +                            unsigned int adapter,
 +                            unsigned int bus,
 +                            unsigned int target,
 +                            unsigned long long unit)
 +{
 +    g_autofree char *path = NULL;
 +    g_autofree char *resolvedPath = NULL;
 +    g_autoptr(GError) err = NULL;
 +
 +    path = g_strdup_printf("%s/%d:%u:%u:%llu/tape",
 +                           prefix, adapter, bus, target, unit);
 +
 +    if (!(resolvedPath = g_file_read_link(path, &err))) {
 +        virReportError(VIR_ERR_SYSTEM_ERROR,
 +                       _("Unable to read link: %s"),
 +                       err->message);
 +        return NULL;
 +    }
 +
 +    return g_path_get_basename(resolvedPath);
 +}
 +
 +
 /* Returns device name (e.g. "sdc") on success, or NULL
  * on failure.
  */
@@ -250,6 +275,8 @@ virSCSIDeviceGetDevName(const char *sysfs_prefix,
         return virSCSIDeviceGetDevNameBlock(prefix, adapter_id, bus, target, unit);
     case VIR_SCSI_DEVICE_TYPE_TAPE:
 +        return virSCSIDeviceGetDevNameTape(prefix, adapter_id, bus, target, unit);
 +
     case VIR_SCSI_DEVICE_TYPE_PRINTER:
     case VIR_SCSI_DEVICE_TYPE_PROCESSOR:
     case VIR_SCSI_DEVICE_TYPE_WORM:
 diff --git a/tests/virscsidata/2-0-0-0/model b/tests/virscsidata/2-0-0-0/model
 new file mode 100644
 index 0000000000..d2ab4715c3
 --- /dev/null
 +++ b/tests/virscsidata/2-0-0-0/model
@@ -0,0 +1 @@
 +scsi_debug
 diff --git a/tests/virscsidata/2-0-0-0/scsi_tape/st0/dev b/tests/virscsidata/2-0-0-0/scsi_tape/st0/dev
 new file mode 100644
 index 0000000000..3dd777e840
 --- /dev/null
 +++ b/tests/virscsidata/2-0-0-0/scsi_tape/st0/dev
@@ -0,0 +1 @@
 +9:0
 diff --git a/tests/virscsidata/2-0-0-0/sg3/dev b/tests/virscsidata/2-0-0-0/sg3/dev
 new file mode 100644
 index 0000000000..b369a59b3e
 --- /dev/null
 +++ b/tests/virscsidata/2-0-0-0/sg3/dev
@@ -0,0 +1 @@
 +21:3
 diff --git a/tests/virscsidata/2-0-0-0/tape b/tests/virscsidata/2-0-0-0/tape
 new file mode 120000
 index 0000000000..6ca7f77539
 --- /dev/null
 +++ b/tests/virscsidata/2-0-0-0/tape
@@ -0,0 +1 @@
 +scsi_tape/st0
 \ No newline at end of file
 diff --git a/tests/virscsidata/2-0-0-0/type b/tests/virscsidata/2-0-0-0/type
 new file mode 100644
 index 0000000000..d00491fd7e
 --- /dev/null
 +++ b/tests/virscsidata/2-0-0-0/type
@@ -0,0 +1 @@
 +1
 diff --git a/tests/virscsidata/2-0-0-0/vendor b/tests/virscsidata/2-0-0-0/vendor
 new file mode 100644
 index 0000000000..9b075671ea
 --- /dev/null
 +++ b/tests/virscsidata/2-0-0-0/vendor
@@ -0,0 +1 @@
 +Linux
 diff --git a/tests/virscsidata/sg3 b/tests/virscsidata/sg3
 new file mode 100644
 index 0000000000..e69de29bb2
 diff --git a/tests/virscsitest.c b/tests/virscsitest.c
 index c96699e157..924b77af08 100644
 --- a/tests/virscsitest.c
 +++ b/tests/virscsitest.c
@@ -33,17 +33,33 @@ VIR_LOG_INIT("tests.scsitest");
 static char *virscsi_prefix;
 +typedef struct {
 +    const char *adapter;
 +    unsigned int bus;
 +    unsigned int target;
 +    unsigned int unit;
 +    const char *expectedName;
 +} testGetDevNameData;
 +
 static int
 -test1(const void *data G_GNUC_UNUSED)
 +testGetDevName(const void *opaque)
 {
 +    const testGetDevNameData *data = opaque;
     g_autofree char *name = NULL;
     if (!(name = virSCSIDeviceGetDevName(virscsi_prefix,
 -                                         "scsi_host1", 0, 0, 0)))
 +                                         data->adapter,
 +                                         data->bus,
 +                                         data->target,
 +                                         data->unit)))
         return -1;
 -    if (STRNEQ(name, "sdh"))
 +    if (STRNEQ(name, data->expectedName)) {
 +        fprintf(stderr,
 +                "SCSI dev name mismatch, expected %s got %s",
 +                data->expectedName, name);
         return -1;
 +    }
     return 0;
 }
@@ -200,15 +216,27 @@ mymain(void)
     CREATE_SYMLINK("0-0-0-0", "0:0:0:0");
     CREATE_SYMLINK("1-0-0-0", "1:0:0:0");
 +    CREATE_SYMLINK("2-0-0-0", "2:0:0:0");
     CREATE_SYMLINK("sg0", "sg0");
 +    CREATE_SYMLINK("sg3", "sg3");
     CREATE_SYMLINK("sg8", "sg8");
     VIR_FREE(virscsi_prefix);
     virscsi_prefix = g_strdup(tmpdir);
 -    if (virTestRun("test1", test1, NULL) < 0)
 -        ret = -1;
 +#define TEST_GET_DEV_NAME(adapter, bus, target, unit, expectedName) \
 +    do { \
 +        testGetDevNameData data = {adapter, bus, target, unit, expectedName}; \
 +        if (virTestRun("test getDevname " expectedName, \
 +                       testGetDevName, &data) < 0) \
 +            ret = -1; \
 +    } while (0)
 +
 +    TEST_GET_DEV_NAME("scsi_host0", 0, 0, 0, "sda");
 +    TEST_GET_DEV_NAME("scsi_host1", 0, 0, 0, "sdh");
 +    TEST_GET_DEV_NAME("scsi_host2", 0, 0, 0, "st0");
 +
     if (virTestRun("test2", test2, NULL) < 0)
         ret = -1;
 -- 
 2.34.1
--- a/SOURCES/libvirt-RHEL-virutil-Accept-non-block-devices-in-virGetDeviceID.patch
+++ b/SOURCES/libvirt-RHEL-virutil-Accept-non-block-devices-in-virGetDeviceID.patch
@ -1,37 +0,0 @@
 From ac8357ab7dd676af82b971673f8d7e862ff07624 Mon Sep 17 00:00:00 2001
 Message-Id: <ac8357ab7dd676af82b971673f8d7e862ff07624@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Fri, 6 Mar 2020 15:52:24 +0100
 Subject: [PATCH] RHEL: virutil: Accept non-block devices in virGetDeviceID()
 If a caller wants to learn major or minor number for a device,
 let them. There's no need to check if the device is a block
 device here.
 https://bugzilla.redhat.com/show_bug.cgi?id=1808390
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Message-Id: <20200306145226.1610708-5-abologna@redhat.com>
 Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/util/virutil.c | 3 ---
 1 file changed, 3 deletions(-)
 diff --git a/src/util/virutil.c b/src/util/virutil.c
 index b1e37b45c5..ced8493516 100644
 --- a/src/util/virutil.c
 +++ b/src/util/virutil.c
@@ -1333,9 +1333,6 @@ virGetDeviceID(const char *path, int *maj, int *min)
     if (stat(path, &sb) < 0)
         return -errno;
 -    if (!S_ISBLK(sb.st_mode))
 -        return -EINVAL;
 -
     if (maj)
         *maj = major(sb.st_rdev);
     if (min)
 -- 
 2.34.1
--- a/SOURCES/libvirt-Revert-qemu_passt-Actually-use-logfd.patch
+++ b/SOURCES/libvirt-Revert-qemu_passt-Actually-use-logfd.patch
@ -0,0 +1,38 @@
 From f3e5bf77bc6f591e5799ae9de36498df5c2a1811 Mon Sep 17 00:00:00 2001
 Message-ID: <f3e5bf77bc6f591e5799ae9de36498df5c2a1811.1691014499.git.jdenemar@redhat.com>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Tue, 1 Aug 2023 16:18:47 +0200
 Subject: [PATCH] Revert "qemu_passt: Actually use @logfd"
 This reverts commit 83686f1eea1a001a37a92f2c054ffb2689c43a40.
 This is needed only so that the next revert is clean.
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
 (cherry picked from commit bc9a254dc72b6904e8368c3fea3ab49b7238ff34)
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2209191
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/qemu/qemu_passt.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/src/qemu/qemu_passt.c b/src/qemu/qemu_passt.c
 index 3679bf75fc..25b22d8ad9 100644
 --- a/src/qemu/qemu_passt.c
 +++ b/src/qemu/qemu_passt.c
@@ -204,9 +204,9 @@ qemuPasstStart(virDomainObj *vm,
         /* The logFile location is not restricted to a per-domain directory. It
          * can be anywhere. Pre-create it as passt may not have enough perms to
          * do so. */
 -        if ((logfd = qemuDomainOpenFile(cfg, vm->def, net->backend.logFile,
 -                                        O_CREAT | O_TRUNC | O_APPEND | O_RDWR,
 -                                        &needUnlink)) < 0) {
 +        if (qemuDomainOpenFile(cfg, vm->def, net->backend.logFile,
 +                               O_CREAT | O_TRUNC | O_APPEND | O_RDWR,
 +                               &needUnlink) < 0) {
             return -1;
         }
 -- 
 2.41.0
--- a/SOURCES/libvirt-Revert-qemu_passt-Precreate-passt-logfile.patch
+++ b/SOURCES/libvirt-Revert-qemu_passt-Precreate-passt-logfile.patch
@ -0,0 +1,148 @@
 From 8897c7d63f763bf9b59f7e79ec6b2f9caf84823b Mon Sep 17 00:00:00 2001
 Message-ID: <8897c7d63f763bf9b59f7e79ec6b2f9caf84823b.1691014499.git.jdenemar@redhat.com>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Tue, 1 Aug 2023 16:20:58 +0200
 Subject: [PATCH] Revert "qemu_passt: Precreate passt logfile"
 This reverts commit 8511b96a319836700b4829816cdae27c3630060d.
 Turns out, we need to do a bit more than just plain
 qemuSecurityDomainSetPathLabel() which sets svirt_image_t. Passt
 has its own SELinux policy and as a part of that they invent
 passt_log_t for log files. Right now, I don't know how libvirt
 could query that and even if I did, passt SELinux policy would
 need to permit relabelling from svirt_t to passt_log_t, which it
 doesn't [1].
 Until these problems are addressed we shouldn't be pre-creating
 the file as it puts users into way worse position - even
 scenarios that used to work don't work. But then again - using
 log file for passt is usually valuable for developers only and
 not regular users.
 1: https://bugzilla.redhat.com/show_bug.cgi?id=2209191#c10
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
 (cherry picked from commit 99349ba18e726465215a71f28d2146a0a2adb65d)
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2209191
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/qemu/qemu_passt.c | 40 +++++-----------------------------------
 1 file changed, 5 insertions(+), 35 deletions(-)
 diff --git a/src/qemu/qemu_passt.c b/src/qemu/qemu_passt.c
 index 25b22d8ad9..99636a3a49 100644
 --- a/src/qemu/qemu_passt.c
 +++ b/src/qemu/qemu_passt.c
@@ -20,8 +20,6 @@
 #include <config.h>
 -#include <fcntl.h>
 -
 #include "qemu_dbus.h"
 #include "qemu_extdevice.h"
 #include "qemu_security.h"
@@ -138,13 +136,9 @@ void
 qemuPasstStop(virDomainObj *vm,
               virDomainNetDef *net)
 {
 -    qemuDomainObjPrivate *priv = vm->privateData;
 -    virQEMUDriver *driver = priv->driver;
     g_autofree char *pidfile = qemuPasstCreatePidFilename(vm, net);
     g_autofree char *passtSocketName = qemuPasstCreateSocketPath(vm, net);
 -    qemuSecurityDomainRestorePathLabel(driver, vm, net->backend.logFile);
 -
     qemuPasstKill(pidfile, passtSocketName);
 }
@@ -172,12 +166,10 @@ qemuPasstStart(virDomainObj *vm,
 {
     qemuDomainObjPrivate *priv = vm->privateData;
     virQEMUDriver *driver = priv->driver;
 -    g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver);
     g_autofree char *passtSocketName = qemuPasstCreateSocketPath(vm, net);
     g_autoptr(virCommand) cmd = NULL;
     g_autofree char *pidfile = qemuPasstCreatePidFilename(vm, net);
     char macaddr[VIR_MAC_STRING_BUFLEN];
 -    bool needUnlink = false;
     size_t i;
     cmd = virCommandNew(PASST);
@@ -199,25 +191,8 @@ qemuPasstStart(virDomainObj *vm,
     if (net->sourceDev)
         virCommandAddArgList(cmd, "--interface", net->sourceDev, NULL);
 -    if (net->backend.logFile) {
 -        VIR_AUTOCLOSE logfd = -1;
 -        /* The logFile location is not restricted to a per-domain directory. It
 -         * can be anywhere. Pre-create it as passt may not have enough perms to
 -         * do so. */
 -        if (qemuDomainOpenFile(cfg, vm->def, net->backend.logFile,
 -                               O_CREAT | O_TRUNC | O_APPEND | O_RDWR,
 -                               &needUnlink) < 0) {
 -            return -1;
 -        }
 -
 -        if (qemuSecurityDomainSetPathLabel(driver, vm,
 -                                           net->backend.logFile, false) < 0) {
 -            goto error;
 -        }
 -
 -        /* Worse, passt deliberately doesn't support FD passing. */
 +    if (net->backend.logFile)
         virCommandAddArgList(cmd, "--log-file", net->backend.logFile, NULL);
 -    }
     /* Add IP address info */
     for (i = 0; i < net->guestIP.nips; i++) {
@@ -228,7 +203,7 @@ qemuPasstStart(virDomainObj *vm,
          * a single IPv4 and single IPv6 address
          */
         if (!(addr = virSocketAddrFormat(&ip->address)))
 -            goto error;
 +            return -1;
         virCommandAddArgList(cmd, "--address", addr, NULL);
@@ -256,14 +231,14 @@ qemuPasstStart(virDomainObj *vm,
             /* validation guarantees this will never happen */
             virReportError(VIR_ERR_INTERNAL_ERROR,
                            _("Invalid portForward proto value %1$u"), pf->proto);
 -            goto error;
 +            return -1;
         }
         if (VIR_SOCKET_ADDR_VALID(&pf->address)) {
             g_autofree char *addr = NULL;
             if (!(addr = virSocketAddrFormat(&pf->address)))
 -                goto error;
 +                return -1;
             virBufferAddStr(&buf, addr);
             emitsep = true;
@@ -309,7 +284,7 @@ qemuPasstStart(virDomainObj *vm,
     if (qemuExtDeviceLogCommand(driver, vm, cmd, "passt") < 0)
 -        goto error;
 +        return -1;
     if (qemuSecurityCommandRun(driver, vm, cmd, -1, -1, true, NULL) < 0)
         goto error;
@@ -317,11 +292,6 @@ qemuPasstStart(virDomainObj *vm,
     return 0;
  error:
 -    if (needUnlink && unlink(net->backend.logFile) < 0) {
 -        VIR_WARN("Unable to unlink '%s': %s",
 -                 net->backend.logFile, g_strerror(errno));
 -    }
 -
     qemuPasstKill(pidfile, passtSocketName);
     return -1;
 }
 -- 
 2.41.0
--- a/SOURCES/libvirt-Revert-report-error-when-virProcessGetStatInfo-is-unable-to-parse-data.patch
+++ b/SOURCES/libvirt-Revert-report-error-when-virProcessGetStatInfo-is-unable-to-parse-data.patch
@ -1,103 +0,0 @@
 From 732113455fb7eadeea178c71cc77f0ffdf639f24 Mon Sep 17 00:00:00 2001
 Message-Id: <732113455fb7eadeea178c71cc77f0ffdf639f24@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Tue, 18 Jan 2022 12:40:09 +0100
 Subject: [PATCH] Revert "report error when virProcessGetStatInfo() is unable
 to parse data"
 This reverts commit 938382b60ae5bd1f83b5cb09e1ce68b9a88f679a.
 Turns out, the commit did more harm than good. It changed
 semantics on some public APIs. For instance, while
 qemuDomainGetInfo() previously did not returned an error it does
 now. While the calls to virProcessGetStatInfo() is guarded with
 virDomainObjIsActive() it doesn't necessarily mean that QEMU's
 PID is still alive. QEMU might be gone but we just haven't
 realized it (e.g. because the eof handler thread is waiting for a
 job).
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2041610
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Andrea Bolognani <abologna@redhat.com>
 (cherry picked from commit 105dace22cc7b5b18d72a4dcad4a2cf386ce5c99)
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/ch/ch_driver.c     | 2 ++
 src/qemu/qemu_driver.c | 7 ++++++-
 src/util/virprocess.c  | 8 ++------
 3 files changed, 10 insertions(+), 7 deletions(-)
 diff --git a/src/ch/ch_driver.c b/src/ch/ch_driver.c
 index 3cbc668489..53e0872207 100644
 --- a/src/ch/ch_driver.c
 +++ b/src/ch/ch_driver.c
@@ -1073,6 +1073,8 @@ chDomainHelperGetVcpus(virDomainObj *vm,
             if (virProcessGetStatInfo(&vcpuinfo->cpuTime,
                                       &vcpuinfo->cpu, NULL,
                                       vm->pid, vcpupid) < 0) {
 +                virReportSystemError(errno, "%s",
 +                                      _("cannot get vCPU placement & pCPU time"));
                 return -1;
             }
         }
 diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
 index 65ac5ef367..d3d76c003f 100644
 --- a/src/qemu/qemu_driver.c
 +++ b/src/qemu/qemu_driver.c
@@ -1359,6 +1359,8 @@ qemuDomainHelperGetVcpus(virDomainObj *vm,
             if (virProcessGetStatInfo(&vcpuinfo->cpuTime,
                                       &vcpuinfo->cpu, NULL,
                                       vm->pid, vcpupid) < 0) {
 +                virReportSystemError(errno, "%s",
 +                                     _("cannot get vCPU placement & pCPU time"));
                 return -1;
             }
         }
@@ -2519,6 +2521,8 @@ qemuDomainGetInfo(virDomainPtr dom,
     if (virDomainObjIsActive(vm)) {
         if (virProcessGetStatInfo(&(info->cpuTime), NULL, NULL,
                                   vm->pid, 0) < 0) {
 +            virReportError(VIR_ERR_OPERATION_FAILED, "%s",
 +                           _("cannot read cputime for domain"));
             goto cleanup;
         }
     }
@@ -10526,7 +10530,8 @@ qemuDomainMemoryStatsInternal(virQEMUDriver *driver,
     }
     if (virProcessGetStatInfo(NULL, NULL, &rss, vm->pid, 0) < 0) {
 -        virResetLastError();
 +        virReportError(VIR_ERR_OPERATION_FAILED, "%s",
 +                       _("cannot get RSS for domain"));
     } else {
         stats[ret].tag = VIR_DOMAIN_MEMORY_STAT_RSS;
         stats[ret].val = rss;
 diff --git a/src/util/virprocess.c b/src/util/virprocess.c
 index 85d8c8e747..b559a4257e 100644
 --- a/src/util/virprocess.c
 +++ b/src/util/virprocess.c
@@ -1784,10 +1784,7 @@ virProcessGetStatInfo(unsigned long long *cpuTime,
         virStrToLong_ullp(proc_stat[VIR_PROCESS_STAT_STIME], NULL, 10, &systime) < 0 ||
         virStrToLong_l(proc_stat[VIR_PROCESS_STAT_RSS], NULL, 10, &rss) < 0 ||
         virStrToLong_i(proc_stat[VIR_PROCESS_STAT_PROCESSOR], NULL, 10, &cpu) < 0) {
 -        virReportError(VIR_ERR_INTERNAL_ERROR,
 -                       _("cannot parse process status data for pid '%d/%d'"),
 -                       (int) pid, (int) tid);
 -        return -1;
 +        VIR_WARN("cannot parse process status data");
     }
     /* We got jiffies
@@ -1884,8 +1881,7 @@ virProcessGetStatInfo(unsigned long long *cpuTime G_GNUC_UNUSED,
                       pid_t pid G_GNUC_UNUSED,
                       pid_t tid G_GNUC_UNUSED)
 {
 -    virReportSystemError(ENOSYS, "%s",
 -                         _("Process statistics data is not supported on this platform"));
 +    errno = ENOSYS;
     return -1;
 }
 -- 
 2.35.0
--- a/SOURCES/libvirt-build-Only-install-libvirt-guests-when-building-libvirtd.patch
+++ b/SOURCES/libvirt-build-Only-install-libvirt-guests-when-building-libvirtd.patch
@ -1,75 +0,0 @@
 From b0fb5cbba2e03fbca8471487bf78931b3090b108 Mon Sep 17 00:00:00 2001
 Message-Id: <b0fb5cbba2e03fbca8471487bf78931b3090b108@dist-git>
 From: Jim Fehlig <jfehlig@suse.com>
 Date: Mon, 10 Jan 2022 11:42:58 -0700
 Subject: [PATCH] build: Only install libvirt-guests when building libvirtd
 libvirt-guests was already moved to the libvirt daemon package in commit
 d800c50349. It only needs to be installed when building libvirtd.
 Signed-off-by: Jim Fehlig <jfehlig@suse.com>
 Reviewed-by: Andrea Bolognani <abologna@redhat.com>
 (cherry picked from commit 3be5ba11a2c6fcb2dfdffa03ab4f847113f36b85)
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2153688
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 tools/meson.build | 38 ++++++++++++++++++++------------------
 1 file changed, 20 insertions(+), 18 deletions(-)
 diff --git a/tools/meson.build b/tools/meson.build
 index 22fa3604ba..2d0aecb90b 100644
 --- a/tools/meson.build
 +++ b/tools/meson.build
@@ -297,29 +297,31 @@ if conf.has('WITH_SANLOCK')
   )
 endif
 -configure_file(
 -  input: 'libvirt-guests.sh.in',
 -  output: '@BASENAME@',
 -  configuration: tools_conf,
 -  install: true,
 -  install_dir: libexecdir,
 -  install_mode: 'rwxrwxr-x',
 -)
 -
 -if init_script == 'systemd'
 -  install_data(
 -    'libvirt-guests.sysconf',
 -    install_dir: sysconfdir / 'sysconfig',
 -    rename: 'libvirt-guests',
 -  )
 -
 +if conf.has('WITH_LIBVIRTD')
   configure_file(
 -    input: 'libvirt-guests.service.in',
 +    input: 'libvirt-guests.sh.in',
     output: '@BASENAME@',
     configuration: tools_conf,
     install: true,
 -    install_dir: prefix / 'lib' / 'systemd' / 'system',
 +    install_dir: libexecdir,
 +    install_mode: 'rwxrwxr-x',
   )
 +
 +  if init_script == 'systemd'
 +    install_data(
 +      'libvirt-guests.sysconf',
 +      install_dir: sysconfdir / 'sysconfig',
 +      rename: 'libvirt-guests',
 +    )
 +
 +    configure_file(
 +      input: 'libvirt-guests.service.in',
 +      output: '@BASENAME@',
 +      configuration: tools_conf,
 +      install: true,
 +      install_dir: prefix / 'lib' / 'systemd' / 'system',
 +    )
 +  endif
 endif
 if bash_completion_dep.found()
 -- 
 2.39.0
--- a/SOURCES/libvirt-conf-Don-t-default-to-raw-format-for-loader-NVRAM.patch
+++ b/SOURCES/libvirt-conf-Don-t-default-to-raw-format-for-loader-NVRAM.patch
@ -0,0 +1,392 @@
 From 7708f08af4581f11d9bc3c3cdf858e55ebdb5a6c Mon Sep 17 00:00:00 2001
 Message-ID: <7708f08af4581f11d9bc3c3cdf858e55ebdb5a6c.1692951632.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Tue, 16 May 2023 19:50:50 +0200
 Subject: [PATCH] conf: Don't default to raw format for loader/NVRAM
 Due to the way the information is stored by the XML parser, we've
 had this quirk where specifying any information about the loader
 or NVRAM would implicitly set its format to raw. That is,
  <nvram>/path/to/guest_VARS.fd</nvram>
 would effectively be interpreted as
  <nvram format='raw'>/path/to/guest_VARS.fd</nvram>
 forcing the use of raw format firmware even when qcow2 format
 would normally be preferred based on the ordering of firmware
 descriptors. This behavior can be worked around in a number of
 ways, but it's fairly unintuitive.
 In order to remove this quirk, move the selection of the default
 firmware format from the parser down to the individual drivers.
 Most drivers only support raw firmware images, so they can
 unconditionally set the format early and be done with it; the
 QEMU driver, however, supports multiple formats and so in that
 case we want this default to be applied as late as possible,
 when we have already ruled out the possibility of using qcow2
 formatted firmware images.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 10a8997cbb402f7edb9f970af70feee2fc256a1c)
 https://bugzilla.redhat.com/show_bug.cgi?id=2196178
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/bhyve/bhyve_firmware.c                    |  3 ++
 src/conf/domain_conf.c                        | 21 ++++++----
 src/libxl/libxl_conf.c                        | 15 +++++---
 src/libxl/xen_xl.c                            |  2 +
 src/libxl/xen_xm.c                            |  1 +
 src/qemu/qemu_firmware.c                      | 27 +++++++++++--
 ...uto-efi-format-mismatch.x86_64-latest.args | 38 +++++++++++++++++++
 ...auto-efi-format-mismatch.x86_64-latest.err |  1 -
 .../firmware-auto-efi-format-mismatch.xml     |  2 +-
 ...oader-secure-abi-update.x86_64-latest.args |  8 ++--
 tests/qemuxml2argvtest.c                      |  2 +-
 ...loader-secure-abi-update.x86_64-latest.xml |  4 +-
 12 files changed, 98 insertions(+), 26 deletions(-)
 create mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-format-mismatch.x86_64-latest.args
 delete mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-format-mismatch.x86_64-latest.err
 diff --git a/src/bhyve/bhyve_firmware.c b/src/bhyve/bhyve_firmware.c
 index 57ab9c7a82..8aaf05dc62 100644
 --- a/src/bhyve/bhyve_firmware.c
 +++ b/src/bhyve/bhyve_firmware.c
@@ -80,6 +80,9 @@ bhyveFirmwareFillDomain(bhyveConn *driver,
     if (!def->os.loader)
         def->os.loader = virDomainLoaderDefNew();
 +    if (!def->os.loader->format)
 +        def->os.loader->format = VIR_STORAGE_FILE_RAW;
 +
     if (def->os.loader->format != VIR_STORAGE_FILE_RAW) {
         virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
                        _("Unsupported loader format '%1$s'"),
 diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
 index 5ac5c0b771..8fa0a6dc73 100644
 --- a/src/conf/domain_conf.c
 +++ b/src/conf/domain_conf.c
@@ -3728,7 +3728,6 @@ virDomainLoaderDefNew(void)
     virDomainLoaderDef *def = NULL;
     def = g_new0(virDomainLoaderDef, 1);
 -    def->format = VIR_STORAGE_FILE_RAW;
     return def;
 }
@@ -16771,10 +16770,11 @@ virDomainLoaderDefParseXMLNvram(virDomainLoaderDef *loader,
     if (virXMLPropEnumDefault(nvramNode, "format",
                               virStorageFileFormatTypeFromString, VIR_XML_PROP_NONE,
 -                              &format, VIR_STORAGE_FILE_RAW) < 0) {
 +                              &format, VIR_STORAGE_FILE_NONE) < 0) {
         return -1;
     }
 -    if (format != VIR_STORAGE_FILE_RAW &&
 +    if (format &&
 +        format != VIR_STORAGE_FILE_RAW &&
         format != VIR_STORAGE_FILE_QCOW2) {
         virReportError(VIR_ERR_XML_ERROR,
                        _("Unsupported nvram format '%1$s'"),
@@ -16860,10 +16860,11 @@ virDomainLoaderDefParseXMLLoader(virDomainLoaderDef *loader,
     if (virXMLPropEnumDefault(loaderNode, "format",
                               virStorageFileFormatTypeFromString, VIR_XML_PROP_NONE,
 -                              &format, VIR_STORAGE_FILE_RAW) < 0) {
 +                              &format, VIR_STORAGE_FILE_NONE) < 0) {
         return -1;
     }
 -    if (format != VIR_STORAGE_FILE_RAW &&
 +    if (format &&
 +        format != VIR_STORAGE_FILE_RAW &&
         format != VIR_STORAGE_FILE_QCOW2) {
         virReportError(VIR_ERR_XML_ERROR,
                        _("Unsupported loader format '%1$s'"),
@@ -16894,7 +16895,9 @@ virDomainLoaderDefParseXML(virDomainLoaderDef *loader,
                                          loaderNode) < 0)
         return -1;
 -    if (loader->nvram && loader->format != loader->nvram->format) {
 +    if (loader->nvram &&
 +        loader->format && loader->nvram->format &&
 +        loader->format != loader->nvram->format) {
         virReportError(VIR_ERR_XML_ERROR,
                        _("Format mismatch: loader.format='%1$s' nvram.format='%2$s'"),
                        virStorageFileFormatTypeToString(loader->format),
@@ -26224,7 +26227,8 @@ virDomainLoaderDefFormatNvram(virBuffer *buf,
                 return -1;
         }
 -        if (src->format != VIR_STORAGE_FILE_RAW) {
 +        if (src->format &&
 +            src->format != VIR_STORAGE_FILE_RAW) {
             virBufferEscapeString(&attrBuf, " format='%s'",
                                   virStorageFileFormatTypeToString(src->format));
         }
@@ -26262,7 +26266,8 @@ virDomainLoaderDefFormat(virBuffer *buf,
                           virTristateBoolTypeToString(loader->stateless));
     }
 -    if (loader->format != VIR_STORAGE_FILE_RAW) {
 +    if (loader->format &&
 +        loader->format != VIR_STORAGE_FILE_RAW) {
         virBufferEscapeString(&loaderAttrBuf, " format='%s'",
                               virStorageFileFormatTypeToString(loader->format));
     }
 diff --git a/src/libxl/libxl_conf.c b/src/libxl/libxl_conf.c
 index a1c76935b6..14ad320023 100644
 --- a/src/libxl/libxl_conf.c
 +++ b/src/libxl/libxl_conf.c
@@ -654,11 +654,16 @@ libxlMakeDomBuildInfo(virDomainDef *def,
             b_info->u.hvm.system_firmware = g_strdup(def->os.loader->path);
         }
 -        if (def->os.loader && def->os.loader->format != VIR_STORAGE_FILE_RAW) {
 -            virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
 -                           _("Unsupported loader format '%1$s'"),
 -                           virStorageFileFormatTypeToString(def->os.loader->format));
 -            return -1;
 +        if (def->os.loader) {
 +            if (!def->os.loader->format)
 +                def->os.loader->format = VIR_STORAGE_FILE_RAW;
 +
 +            if (def->os.loader->format != VIR_STORAGE_FILE_RAW) {
 +                virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
 +                               _("Unsupported loader format '%1$s'"),
 +                               virStorageFileFormatTypeToString(def->os.loader->format));
 +                return -1;
 +            }
         }
         if (def->emulator) {
 diff --git a/src/libxl/xen_xl.c b/src/libxl/xen_xl.c
 index 1cc42fa59f..ab1941454d 100644
 --- a/src/libxl/xen_xl.c
 +++ b/src/libxl/xen_xl.c
@@ -115,6 +115,7 @@ xenParseXLOS(virConf *conf, virDomainDef *def, virCaps *caps)
         if (bios && STREQ(bios, "ovmf")) {
             def->os.loader = virDomainLoaderDefNew();
 +            def->os.loader->format = VIR_STORAGE_FILE_RAW;
             def->os.loader->type = VIR_DOMAIN_LOADER_TYPE_PFLASH;
             def->os.loader->readonly = VIR_TRISTATE_BOOL_YES;
             if (bios_path)
@@ -126,6 +127,7 @@ xenParseXLOS(virConf *conf, virDomainDef *def, virCaps *caps)
                 if (caps->guests[i]->ostype == VIR_DOMAIN_OSTYPE_HVM &&
                     caps->guests[i]->arch.id == def->os.arch) {
                     def->os.loader = virDomainLoaderDefNew();
 +                    def->os.loader->format = VIR_STORAGE_FILE_RAW;
                     def->os.loader->path = g_strdup(caps->guests[i]->arch.defaultInfo.loader);
                 }
             }
 diff --git a/src/libxl/xen_xm.c b/src/libxl/xen_xm.c
 index 0031d6cbc6..5705a5ec0c 100644
 --- a/src/libxl/xen_xm.c
 +++ b/src/libxl/xen_xm.c
@@ -43,6 +43,7 @@ xenParseXMOS(virConf *conf, virDomainDef *def)
         g_autofree char *boot = NULL;
         def->os.loader = virDomainLoaderDefNew();
 +        def->os.loader->format = VIR_STORAGE_FILE_RAW;
         if (xenConfigCopyString(conf, "kernel", &def->os.loader->path) < 0)
             return -1;
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index ebaf32cf71..3dcd139a47 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1082,6 +1082,11 @@ qemuFirmwareEnsureNVRAM(virDomainDef *def,
     if (loader->stateless == VIR_TRISTATE_BOOL_YES)
         return;
 +    /* If the NVRAM format hasn't been set yet, inherit the same as
 +     * the loader */
 +    if (loader->nvram && !loader->nvram->format)
 +        loader->nvram->format = loader->format;
 +
     /* If the source already exists and is fully specified, including
      * the path, leave it alone */
     if (loader->nvram && loader->nvram->path)
@@ -1328,7 +1333,7 @@ qemuFirmwareMatchDomain(const virDomainDef *def,
                       flash->executable.format);
             return false;
         }
 -        if (loader &&
 +        if (loader && loader->format &&
             STRNEQ(flash->executable.format, virStorageFileFormatTypeToString(loader->format))) {
             VIR_DEBUG("Discarding loader with mismatching flash format '%s' != '%s'",
                       flash->executable.format,
@@ -1342,7 +1347,7 @@ qemuFirmwareMatchDomain(const virDomainDef *def,
                           flash->nvram_template.format);
                 return false;
             }
 -            if (loader && loader->nvram &&
 +            if (loader && loader->nvram && loader->nvram->format &&
                 STRNEQ(flash->nvram_template.format, virStorageFileFormatTypeToString(loader->nvram->format))) {
                 VIR_DEBUG("Discarding loader with mismatching nvram template format '%s' != '%s'",
                           flash->nvram_template.format,
@@ -1630,7 +1635,8 @@ qemuFirmwareFillDomainLegacy(virQEMUDriver *driver,
         return 1;
     }
 -    if (loader->format != VIR_STORAGE_FILE_RAW) {
 +    if (loader->format &&
 +        loader->format != VIR_STORAGE_FILE_RAW) {
         VIR_DEBUG("Ignoring legacy entries for loader with flash format '%s'",
                   virStorageFileFormatTypeToString(loader->format));
         return 1;
@@ -1793,6 +1799,7 @@ qemuFirmwareFillDomain(virQEMUDriver *driver,
         return -1;
     if (loader &&
 +        loader->format &&
         loader->format != VIR_STORAGE_FILE_RAW &&
         loader->format != VIR_STORAGE_FILE_QCOW2) {
         virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
@@ -1801,6 +1808,7 @@ qemuFirmwareFillDomain(virQEMUDriver *driver,
         return -1;
     }
     if (nvram &&
 +        nvram->format &&
         nvram->format != VIR_STORAGE_FILE_RAW &&
         nvram->format != VIR_STORAGE_FILE_QCOW2) {
         virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
@@ -1831,8 +1839,19 @@ qemuFirmwareFillDomain(virQEMUDriver *driver,
          * CODE:NVRAM pairs that might have been provided at build
          * time */
         if (!autoSelection) {
 -            if (qemuFirmwareFillDomainLegacy(driver, def) < 0)
 +            if ((ret = qemuFirmwareFillDomainLegacy(driver, def)) < 0)
                 return -1;
 +
 +            /* If we've gotten this far without finding a match, it
 +             * means that we're dealing with a set of completely
 +             * custom paths. In that case, unless the user has
 +             * specified otherwise, we have to assume that they're in
 +             * raw format */
 +            if (ret == 1) {
 +                if (loader && !loader->format) {
 +                    loader->format = VIR_STORAGE_FILE_RAW;
 +                }
 +            }
         } else {
             virReportError(VIR_ERR_OPERATION_FAILED,
                            _("Unable to find any firmware to satisfy '%1$s'"),
 diff --git a/tests/qemuxml2argvdata/firmware-auto-efi-format-mismatch.x86_64-latest.args b/tests/qemuxml2argvdata/firmware-auto-efi-format-mismatch.x86_64-latest.args
 new file mode 100644
 index 0000000000..e8d7d580f7
 --- /dev/null
 +++ b/tests/qemuxml2argvdata/firmware-auto-efi-format-mismatch.x86_64-latest.args
@@ -0,0 +1,38 @@
 +LC_ALL=C \
 +PATH=/bin \
 +HOME=/var/lib/libvirt/qemu/domain--1-guest \
 +USER=test \
 +LOGNAME=test \
 +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
 +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
 +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 +/usr/bin/qemu-system-x86_64 \
 +-name guest=guest,debug-threads=on \
 +-S \
 +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 +-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
 +-blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"qcow2","file":"libvirt-pflash0-storage"}' \
 +-blockdev '{"driver":"file","filename":"/path/to/guest_VARS.qcow2","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \
 +-blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"qcow2","file":"libvirt-pflash1-storage"}' \
 +-machine pc-q35-4.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,acpi=on \
 +-accel kvm \
 +-cpu qemu64 \
 +-global driver=cfi.pflash01,property=secure,value=on \
 +-m size=1048576k \
 +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
 +-overcommit mem-lock=off \
 +-smp 1,sockets=1,cores=1,threads=1 \
 +-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
 +-display none \
 +-no-user-config \
 +-nodefaults \
 +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 +-mon chardev=charmonitor,id=monitor,mode=control \
 +-rtc base=utc \
 +-no-shutdown \
 +-boot strict=on \
 +-audiodev '{"id":"audio1","driver":"none"}' \
 +-global ICH9-LPC.noreboot=off \
 +-watchdog-action reset \
 +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 +-msg timestamp=on
 diff --git a/tests/qemuxml2argvdata/firmware-auto-efi-format-mismatch.x86_64-latest.err b/tests/qemuxml2argvdata/firmware-auto-efi-format-mismatch.x86_64-latest.err
 deleted file mode 100644
 index abfdfc4357..0000000000
 --- a/tests/qemuxml2argvdata/firmware-auto-efi-format-mismatch.x86_64-latest.err
 +++ /dev/null
@@ -1 +0,0 @@
 -XML error: Format mismatch: loader.format='qcow2' nvram.format='raw'
 diff --git a/tests/qemuxml2argvdata/firmware-auto-efi-format-mismatch.xml b/tests/qemuxml2argvdata/firmware-auto-efi-format-mismatch.xml
 index 6613d9e9a9..75fa44fd20 100644
 --- a/tests/qemuxml2argvdata/firmware-auto-efi-format-mismatch.xml
 +++ b/tests/qemuxml2argvdata/firmware-auto-efi-format-mismatch.xml
@@ -6,7 +6,7 @@
   <os firmware='efi'>
     <type arch='x86_64' machine='pc-q35-4.0'>hvm</type>
     <loader format='qcow2'/>
 -    <nvram>/path/to/guest_VARS.fd</nvram>
 +    <nvram>/path/to/guest_VARS.qcow2</nvram>
   </os>
   <features>
     <acpi/>
 diff --git a/tests/qemuxml2argvdata/firmware-auto-efi-loader-secure-abi-update.x86_64-latest.args b/tests/qemuxml2argvdata/firmware-auto-efi-loader-secure-abi-update.x86_64-latest.args
 index 48f357cbf9..790fb619e8 100644
 --- a/tests/qemuxml2argvdata/firmware-auto-efi-loader-secure-abi-update.x86_64-latest.args
 +++ b/tests/qemuxml2argvdata/firmware-auto-efi-loader-secure-abi-update.x86_64-latest.args
@@ -10,10 +10,10 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -name guest=guest,debug-threads=on \
 -S \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 --blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
 --blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \
 --blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \
 --blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"raw","file":"libvirt-pflash1-storage"}' \
 +-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
 +-blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"qcow2","file":"libvirt-pflash0-storage"}' \
 +-blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.qcow2","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \
 +-blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"qcow2","file":"libvirt-pflash1-storage"}' \
 -machine pc-q35-4.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,acpi=on \
 -accel kvm \
 -cpu qemu64 \
 diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
 index 370b26a023..9439a5a1e6 100644
 --- a/tests/qemuxml2argvtest.c
 +++ b/tests/qemuxml2argvtest.c
@@ -1117,7 +1117,7 @@ mymain(void)
     DO_TEST_CAPS_LATEST("firmware-auto-efi-format-nvram-qcow2-network-nbd");
     DO_TEST_CAPS_ARCH_LATEST("firmware-auto-efi-format-loader-raw", "aarch64");
     DO_TEST_CAPS_ARCH_LATEST_ABI_UPDATE("firmware-auto-efi-format-loader-raw-abi-update", "aarch64");
 -    DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-auto-efi-format-mismatch");
 +    DO_TEST_CAPS_LATEST("firmware-auto-efi-format-mismatch");
     DO_TEST_NOCAPS("clock-utc");
     DO_TEST_NOCAPS("clock-localtime");
 diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-loader-secure-abi-update.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-loader-secure-abi-update.x86_64-latest.xml
 index 332d931ba1..f4ff7a0fc2 100644
 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-loader-secure-abi-update.x86_64-latest.xml
 +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-loader-secure-abi-update.x86_64-latest.xml
@@ -10,8 +10,8 @@
       <feature enabled='yes' name='enrolled-keys'/>
       <feature enabled='yes' name='secure-boot'/>
     </firmware>
 -    <loader readonly='yes' secure='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader>
 -    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
 +    <loader readonly='yes' secure='yes' type='pflash' format='qcow2'>/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2</loader>
 +    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS_4M.secboot.qcow2' format='qcow2'>/var/lib/libvirt/qemu/nvram/guest_VARS.qcow2</nvram>
     <boot dev='hd'/>
   </os>
   <features>
 -- 
 2.42.0
--- a/SOURCES/libvirt-conf-Introduce-memory-allocation-threads.patch
+++ b/SOURCES/libvirt-conf-Introduce-memory-allocation-threads.patch
@ -1,155 +0,0 @@
 From 19f7e6dc950baf346738f462ac5c6b815c04edcc Mon Sep 17 00:00:00 2001
 Message-Id: <19f7e6dc950baf346738f462ac5c6b815c04edcc@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Mon, 21 Mar 2022 16:49:25 +0100
 Subject: [PATCH] conf: Introduce memory allocation threads
 Since its v5.0.0 release QEMU is capable of specifying number of
 threads used to allocate memory. It defaults to 1, which may be
 too low for humongous guests with gigantic pages.
 In general, on QEMU cmd line level it is possible to use
 different number of threads per each memory-backend-* object, in
 practical terms it's not useful. Therefore, use <memoryBacking/>
 to set guest wide value and let all memory devices 'inherit' it,
 silently. IOW, don't introduce per device knob because that would
 only complicate things for a little or no benefit.
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
 (cherry picked from commit ba7f98126fa84d354ce72929b77cc111a9a557a9)
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2067126
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 docs/formatdomain.rst                        |  8 +++++---
 docs/schemas/domaincommon.rng                | 19 +++++++++++++------
 src/conf/domain_conf.c                       | 15 ++++++++++++++-
 src/conf/domain_conf.h                       |  1 +
 tests/qemuxml2argvdata/memfd-memory-numa.xml |  2 +-
 5 files changed, 34 insertions(+), 11 deletions(-)
 diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst
 index 8128e43da4..17e89a0c0d 100644
 --- a/docs/formatdomain.rst
 +++ b/docs/formatdomain.rst
@@ -977,7 +977,7 @@ Memory Backing
        <locked/>
        <source type="file|anonymous|memfd"/>
        <access mode="shared|private"/>
 -       <allocation mode="immediate|ondemand"/>
 +       <allocation mode="immediate|ondemand" threads='8'/>
        <discard/>
      </memoryBacking>
      ...
@@ -1026,8 +1026,10 @@ influence how virtual memory pages are backed by host pages.
    Using the ``mode`` attribute, specify if the memory is to be "shared" or
    "private". This can be overridden per numa node by ``memAccess``.
 ``allocation``
 -   Using the ``mode`` attribute, specify when to allocate the memory by
 -   supplying either "immediate" or "ondemand".
 +   Using the optional ``mode`` attribute, specify when to allocate the memory by
 +   supplying either "immediate" or "ondemand". :since:`Since 8.2.0` it is
 +   possible to set the number of threads that hypervisor uses to allocate
 +   memory via ``threads`` attribute.
 ``discard``
    When set and supported by hypervisor the memory content is discarded just
    before guest shuts down (or when DIMM module is unplugged). Please note that
 diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
 index 7fa5c2b8b5..c9c1529979 100644
 --- a/docs/schemas/domaincommon.rng
 +++ b/docs/schemas/domaincommon.rng
@@ -745,12 +745,19 @@
             </optional>
             <optional>
               <element name="allocation">
 -                <attribute name="mode">
 -                  <choice>
 -                    <value>immediate</value>
 -                    <value>ondemand</value>
 -                  </choice>
 -                </attribute>
 +                <optional>
 +                  <attribute name="mode">
 +                    <choice>
 +                      <value>immediate</value>
 +                      <value>ondemand</value>
 +                    </choice>
 +                  </attribute>
 +                </optional>
 +                <optional>
 +                  <attribute name="threads">
 +                    <ref name="unsignedInt"/>
 +                  </attribute>
 +                </optional>
               </element>
             </optional>
             <optional>
 diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
 index 5691b8d2d5..805a15848e 100644
 --- a/src/conf/domain_conf.c
 +++ b/src/conf/domain_conf.c
@@ -19095,6 +19095,13 @@ virDomainDefParseMemory(virDomainDef *def,
         VIR_FREE(tmp);
     }
 +    if (virXPathUInt("string(./memoryBacking/allocation/@threads)",
 +                     ctxt, &def->mem.allocation_threads) == -2) {
 +        virReportError(VIR_ERR_XML_ERROR, "%s",
 +                       _("Failed to parse memory allocation threads"));
 +        return -1;
 +    }
 +
     if (virXPathNode("./memoryBacking/hugepages", ctxt)) {
         /* hugepages will be used */
         if ((n = virXPathNodeSet("./memoryBacking/hugepages/page", ctxt, &nodes)) < 0) {
@@ -27639,6 +27646,7 @@ virDomainMemorybackingFormat(virBuffer *buf,
                              const virDomainMemtune *mem)
 {
     g_auto(virBuffer) childBuf = VIR_BUFFER_INIT_CHILD(buf);
 +    g_auto(virBuffer) allocAttrBuf = VIR_BUFFER_INITIALIZER;
     if (mem->nhugepages)
         virDomainHugepagesFormat(&childBuf, mem->hugepages, mem->nhugepages);
@@ -27653,8 +27661,13 @@ virDomainMemorybackingFormat(virBuffer *buf,
         virBufferAsprintf(&childBuf, "<access mode='%s'/>\n",
                           virDomainMemoryAccessTypeToString(mem->access));
     if (mem->allocation)
 -        virBufferAsprintf(&childBuf, "<allocation mode='%s'/>\n",
 +        virBufferAsprintf(&allocAttrBuf, " mode='%s'",
                           virDomainMemoryAllocationTypeToString(mem->allocation));
 +    if (mem->allocation_threads > 0)
 +        virBufferAsprintf(&allocAttrBuf, " threads='%u'", mem->allocation_threads);
 +
 +    virXMLFormatElement(&childBuf, "allocation", &allocAttrBuf, NULL);
 +
     if (mem->discard)
         virBufferAddLit(&childBuf, "<discard/>\n");
 diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
 index 144ba4dd12..10af94e2e4 100644
 --- a/src/conf/domain_conf.h
 +++ b/src/conf/domain_conf.h
@@ -2677,6 +2677,7 @@ struct _virDomainMemtune {
     int source; /* enum virDomainMemorySource */
     int access; /* enum virDomainMemoryAccess */
     int allocation; /* enum virDomainMemoryAllocation */
 +    unsigned int allocation_threads;
     virTristateBool discard;
 };
 diff --git a/tests/qemuxml2argvdata/memfd-memory-numa.xml b/tests/qemuxml2argvdata/memfd-memory-numa.xml
 index 1ebcee8939..1ac87e3aef 100644
 --- a/tests/qemuxml2argvdata/memfd-memory-numa.xml
 +++ b/tests/qemuxml2argvdata/memfd-memory-numa.xml
@@ -10,7 +10,7 @@
     </hugepages>
     <source type='memfd'/>
     <access mode='shared'/>
 -    <allocation mode='immediate'/>
 +    <allocation mode='immediate' threads='8'/>
   </memoryBacking>
   <vcpu placement='static'>8</vcpu>
   <numatune>
 -- 
 2.35.1
--- a/SOURCES/libvirt-conf-Make-VIR_DOMAIN_NET_TYPE_ETHERNET-not-share-host-view.patch
+++ b/SOURCES/libvirt-conf-Make-VIR_DOMAIN_NET_TYPE_ETHERNET-not-share-host-view.patch
@ -1,46 +0,0 @@
 From 666b68a93006c4299747d159bcacb7164b8c5d91 Mon Sep 17 00:00:00 2001
 Message-Id: <666b68a93006c4299747d159bcacb7164b8c5d91@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Thu, 24 Nov 2022 10:28:59 +0100
 Subject: [PATCH] conf: Make VIR_DOMAIN_NET_TYPE_ETHERNET not share 'host view'
 When setting up QoS for a domain <interface/>, or when reporting
 its statistics we may need to swap TX/RX values. This is all
 explained in comment to virDomainNetTypeSharesHostView().
 However, this function claims that VIR_DOMAIN_NET_TYPE_ETHERNET
 also shares the 'host view', meaning the TX/RX values must be
 swapped. But that's not true.
 An easy reproducer is to start a domain with two <interface/>-s:
 one type of network, the other of type ethernet and configure the
 same <bandwidth/> for both. Reversed setting can then be observed
 (e.g. via tc).
 Reported-by: Oleg Vasilev <oleg.vasilev@virtuozzo.com>
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
 (cherry picked from commit 0862cb3ce46253a58ca02d36b2b6a6397a60bfc7)
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2172578
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/conf/domain_conf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
 index 401ddaa1a0..427e7d1bb5 100644
 --- a/src/conf/domain_conf.c
 +++ b/src/conf/domain_conf.c
@@ -30472,9 +30472,9 @@ virDomainNetTypeSharesHostView(const virDomainNetDef *net)
     virDomainNetType actualType = virDomainNetGetActualType(net);
     switch (actualType) {
     case VIR_DOMAIN_NET_TYPE_DIRECT:
 -    case VIR_DOMAIN_NET_TYPE_ETHERNET:
         return true;
     case VIR_DOMAIN_NET_TYPE_USER:
 +    case VIR_DOMAIN_NET_TYPE_ETHERNET:
     case VIR_DOMAIN_NET_TYPE_VHOSTUSER:
     case VIR_DOMAIN_NET_TYPE_SERVER:
     case VIR_DOMAIN_NET_TYPE_CLIENT:
 -- 
 2.39.2
--- a/SOURCES/libvirt-conf-Move-virDomainObj-originalMemlock-into-qemuDomainObjPrivate.patch
+++ b/SOURCES/libvirt-conf-Move-virDomainObj-originalMemlock-into-qemuDomainObjPrivate.patch
@ -1,91 +0,0 @@
 From 00c5cab2b92b653edbf491d9ef60359578c3d59a Mon Sep 17 00:00:00 2001
 Message-Id: <00c5cab2b92b653edbf491d9ef60359578c3d59a@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Wed, 11 May 2022 16:27:18 +0200
 Subject: [PATCH] conf: Move virDomainObj::originalMemlock into
 qemuDomainObjPrivate
 Since v1.3.0-90-gafbe1d4c56 the original value of memlock limit
 is stored inside virDomainObj struct directly (under
 originalMemlock member). This is needless because the value is
 used only inside QEMU driver and thus can reside in
 qemuDomainObjPrivate struct.
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Peter Krempa <pkrempa@redhat.com>
 (cherry picked from commit 75df6d2c291c48d65c1e54dd93e3d2d3cb0712e7)
 https://bugzilla.redhat.com/show_bug.cgi?id=2089433
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/conf/domain_conf.h | 3 ---
 src/qemu/qemu_domain.c | 9 +++++----
 src/qemu/qemu_domain.h | 3 +++
 3 files changed, 8 insertions(+), 7 deletions(-)
 diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
 index d0d0fdc815..45976beb2b 100644
 --- a/src/conf/domain_conf.h
 +++ b/src/conf/domain_conf.h
@@ -3031,9 +3031,6 @@ struct _virDomainObj {
     int taint;
     size_t ndeprecations;
     char **deprecations;
 -
 -    unsigned long long originalMemlock; /* Original RLIMIT_MEMLOCK, zero if no
 -                                         * restore will be required later */
 };
 G_DEFINE_AUTOPTR_CLEANUP_FUNC(virDomainObj, virObjectUnref);
 diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
 index 40fe9985e6..86d673dafa 100644
 --- a/src/qemu/qemu_domain.c
 +++ b/src/qemu/qemu_domain.c
@@ -9269,6 +9269,7 @@ int
 qemuDomainAdjustMaxMemLock(virDomainObj *vm,
                            bool forceVFIO)
 {
 +    qemuDomainObjPrivate *priv = vm->privateData;
     unsigned long long currentMemLock = 0;
     unsigned long long desiredMemLock = 0;
@@ -9281,8 +9282,8 @@ qemuDomainAdjustMaxMemLock(virDomainObj *vm,
             /* If this is the first time adjusting the limit, save the current
              * value so that we can restore it once memory locking is no longer
              * required */
 -            if (vm->originalMemlock == 0) {
 -                vm->originalMemlock = currentMemLock;
 +            if (priv->originalMemlock == 0) {
 +                priv->originalMemlock = currentMemLock;
             }
         } else {
             /* If the limit is already high enough, we can assume
@@ -9295,8 +9296,8 @@ qemuDomainAdjustMaxMemLock(virDomainObj *vm,
     } else {
         /* Once memory locking is no longer required, we can restore the
          * original, usually very low, limit */
 -        desiredMemLock = vm->originalMemlock;
 -        vm->originalMemlock = 0;
 +        desiredMemLock = priv->originalMemlock;
 +        priv->originalMemlock = 0;
     }
     if (desiredMemLock > 0 &&
 diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h
 index e5046367e3..e9497d20de 100644
 --- a/src/qemu/qemu_domain.h
 +++ b/src/qemu/qemu_domain.h
@@ -241,6 +241,9 @@ struct _qemuDomainObjPrivate {
     GSList *dbusVMStateIds;
     /* true if -object dbus-vmstate was added */
     bool dbusVMState;
 +
 +    unsigned long long originalMemlock; /* Original RLIMIT_MEMLOCK, zero if no
 +                                         * restore will be required later */
 };
 #define QEMU_DOMAIN_PRIVATE(vm) \
 -- 
 2.35.1
--- a/SOURCES/libvirt-conf-adjust-method-name-virDomainDeviceCCWAddressParseXML.patch
+++ b/SOURCES/libvirt-conf-adjust-method-name-virDomainDeviceCCWAddressParseXML.patch
@ -1,88 +0,0 @@
 From 3c65b917f70d556fa1059b0400771c8159b8ca3b Mon Sep 17 00:00:00 2001
 Message-Id: <3c65b917f70d556fa1059b0400771c8159b8ca3b@dist-git>
 From: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Date: Fri, 13 May 2022 12:31:08 +0200
 Subject: [PATCH] conf: adjust method name virDomainDeviceCCWAddressParseXML
 Adjust method name virDomainDeviceCCWAddressParseXML to
 virCCWDeviceAddressParseXML.
 Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 2d9fd19bf5d7a3d33b94e464c335252682edd623)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 src/conf/device_conf.c   | 4 ++--
 src/conf/device_conf.h   | 4 ++--
 src/conf/domain_conf.c   | 3 +--
 src/libvirt_private.syms | 2 +-
 4 files changed, 6 insertions(+), 7 deletions(-)
 diff --git a/src/conf/device_conf.c b/src/conf/device_conf.c
 index 958e2f43cc..e93fd57341 100644
 --- a/src/conf/device_conf.c
 +++ b/src/conf/device_conf.c
@@ -259,8 +259,8 @@ virPCIDeviceAddressFormat(virBuffer *buf,
 }
 int
 -virDomainDeviceCCWAddressParseXML(xmlNodePtr node,
 -                                  virCCWDeviceAddress *addr)
 +virCCWDeviceAddressParseXML(xmlNodePtr node,
 +                            virCCWDeviceAddress *addr)
 {
     int cssid;
     int ssid;
 diff --git a/src/conf/device_conf.h b/src/conf/device_conf.h
 index 01e2edccc9..910e6b7792 100644
 --- a/src/conf/device_conf.h
 +++ b/src/conf/device_conf.h
@@ -193,8 +193,8 @@ void virPCIDeviceAddressFormat(virBuffer *buf,
                                virPCIDeviceAddress addr,
                                bool includeTypeInAddr);
 -int virDomainDeviceCCWAddressParseXML(xmlNodePtr node,
 -                                      virCCWDeviceAddress *addr);
 +int virCCWDeviceAddressParseXML(xmlNodePtr node,
 +                                virCCWDeviceAddress *addr);
 int virDomainDeviceDriveAddressParseXML(xmlNodePtr node,
                                         virDomainDeviceDriveAddress *addr);
 diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
 index 1e1c7f01b1..401ddaa1a0 100644
 --- a/src/conf/domain_conf.c
 +++ b/src/conf/domain_conf.c
@@ -6630,8 +6630,7 @@ virDomainDeviceAddressParseXML(xmlNodePtr address,
         break;
     case VIR_DOMAIN_DEVICE_ADDRESS_TYPE_CCW:
 -        if (virDomainDeviceCCWAddressParseXML
 -                (address, &info->addr.ccw) < 0)
 +        if (virCCWDeviceAddressParseXML(address, &info->addr.ccw) < 0)
             return -1;
         break;
 diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
 index 0d3ee4c20a..44b551fb60 100644
 --- a/src/libvirt_private.syms
 +++ b/src/libvirt_private.syms
@@ -124,6 +124,7 @@ virCPUModeTypeToString;
 # conf/device_conf.h
 +virCCWDeviceAddressParseXML;
 virDeviceInfoPCIAddressExtensionIsPresent;
 virDeviceInfoPCIAddressExtensionIsWanted;
 virDeviceInfoPCIAddressIsPresent;
@@ -131,7 +132,6 @@ virDeviceInfoPCIAddressIsWanted;
 virDomainDeviceAddressIsValid;
 virDomainDeviceAddressTypeToString;
 virDomainDeviceCcidAddressParseXML;
 -virDomainDeviceCCWAddressParseXML;
 virDomainDeviceDriveAddressParseXML;
 virDomainDeviceInfoAddressIsEqual;
 virDomainDeviceSpaprVioAddressParseXML;
 -- 
 2.39.1
--- a/SOURCES/libvirt-conf-domcaps-Add-async-teardown-domain-capability.patch
+++ b/SOURCES/libvirt-conf-domcaps-Add-async-teardown-domain-capability.patch
--- a/SOURCES/libvirt-conf-virtiofs-add-thread_pool-element.patch
+++ b/SOURCES/libvirt-conf-virtiofs-add-thread_pool-element.patch
@ -1,151 +0,0 @@
 From 0c09e4225c511ce1b0ebe22e45962f83d5145e66 Mon Sep 17 00:00:00 2001
 Message-Id: <0c09e4225c511ce1b0ebe22e45962f83d5145e66@dist-git>
 From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
 Date: Fri, 10 Jun 2022 15:10:29 +0200
 Subject: [PATCH] conf: virtiofs: add thread_pool element
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Add an element to configure the thread pool size:
 ...
 <binary>
  <thread_pool size='16'/>
 </binary>
 ...
 https://bugzilla.redhat.com/show_bug.cgi?id=2072905
 Signed-off-by: Ján Tomko <jtomko@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 0df2e7df80452f81edbfeb0ee355235b533346a9)
 Signed-off-by: Ján Tomko <jtomko@redhat.com>
 https://bugzilla.redhat.com/show_bug.cgi?id=2079582
 ---
 docs/formatdomain.rst                             |  6 ++++++
 docs/schemas/domaincommon.rng                     |  9 +++++++++
 src/conf/domain_conf.c                            | 15 +++++++++++++++
 src/conf/domain_conf.h                            |  1 +
 .../qemuxml2argvdata/vhost-user-fs-fd-memory.xml  |  1 +
 5 files changed, 32 insertions(+)
 diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst
 index 17e89a0c0d..e6cf2ec083 100644
 --- a/docs/formatdomain.rst
 +++ b/docs/formatdomain.rst
@@ -3316,6 +3316,7 @@ A directory on the host that can be accessed directly from the guest.
             <cache mode='always'/>
             <sandbox mode='namespace'/>
             <lock posix='on' flock='on'/>
 +            <thread_pool size='16'/>
          </binary>
          <source dir='/path'/>
          <target dir='mount_tag'/>
@@ -3449,6 +3450,11 @@ A directory on the host that can be accessed directly from the guest.
    ``chroot``, see the
    `virtiofsd documentation <https://qemu.readthedocs.io/en/latest/tools/virtiofsd.html>`__
    for more details. ( :since:`Since 7.2.0` )
 +   Element ``thread_pool`` accepts one attribute ``size`` which defines the
 +   maximum thread pool size. A value of "0" disables the pool.
 +   The thread pool helps increase the number of requests in flight when used with
 +   storage that has a higher latency.  However, it has an overhead, and so for
 +   fast, low latency filesystems, it may be best to turn it off. ( :since:`Since 8.5.0` )
 ``source``
    The resource on the host that is being accessed in the guest. The ``name``
    attribute must be used with ``type='template'``, and the ``dir`` attribute
 diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
 index c9c1529979..79c8979410 100644
 --- a/docs/schemas/domaincommon.rng
 +++ b/docs/schemas/domaincommon.rng
@@ -3064,6 +3064,15 @@
             </optional>
           </element>
         </optional>
 +        <optional>
 +          <element name="thread_pool">
 +            <optional>
 +              <attribute name="size">
 +                <data type="integer"/>
 +              </attribute>
 +            </optional>
 +          </element>
 +        </optional>
       </interleave>
     </element>
   </define>
 diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
 index 92510973e6..95afd9226e 100644
 --- a/src/conf/domain_conf.c
 +++ b/src/conf/domain_conf.c
@@ -2447,6 +2447,8 @@ virDomainFSDefNew(virDomainXMLOption *xmlopt)
     ret->src = virStorageSourceNew();
 +    ret->thread_pool_size = -1;
 +
     if (xmlopt &&
         xmlopt->privateData.fsNew &&
         !(ret->privateData = xmlopt->privateData.fsNew()))
@@ -9869,6 +9871,7 @@ virDomainFSDefParseXML(virDomainXMLOption *xmlopt,
     if (def->fsdriver == VIR_DOMAIN_FS_DRIVER_TYPE_VIRTIOFS) {
         g_autofree char *queue_size = virXPathString("string(./driver/@queue)", ctxt);
         g_autofree char *binary = virXPathString("string(./binary/@path)", ctxt);
 +        g_autofree char *thread_pool_size = virXPathString("string(./binary/thread_pool/@size)", ctxt);
         g_autofree char *xattr = virXPathString("string(./binary/@xattr)", ctxt);
         g_autofree char *cache = virXPathString("string(./binary/cache/@mode)", ctxt);
         g_autofree char *sandbox = virXPathString("string(./binary/sandbox/@mode)", ctxt);
@@ -9883,6 +9886,14 @@ virDomainFSDefParseXML(virDomainXMLOption *xmlopt,
             goto error;
         }
 +        if (thread_pool_size &&
 +            virStrToLong_i(thread_pool_size, NULL, 10, &def->thread_pool_size) < 0) {
 +            virReportError(VIR_ERR_XML_ERROR,
 +                           _("cannot parse thread pool size '%s' for virtiofs"),
 +                           queue_size);
 +            goto error;
 +        }
 +
         if (binary)
             def->binary = virFileSanitizePath(binary);
@@ -24205,6 +24216,10 @@ virDomainFSDefFormat(virBuffer *buf,
         }
         virXMLFormatElement(&binaryBuf, "lock", &lockAttrBuf, NULL);
 +
 +        if (def->thread_pool_size >= 0)
 +            virBufferAsprintf(&binaryBuf, "<thread_pool size='%d'/>\n", def->thread_pool_size);
 +
     }
     virDomainVirtioOptionsFormat(&driverAttrBuf, def->virtio);
 diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
 index 10af94e2e4..d0d0fdc815 100644
 --- a/src/conf/domain_conf.h
 +++ b/src/conf/domain_conf.h
@@ -892,6 +892,7 @@ struct _virDomainFSDef {
     virTristateSwitch posix_lock;
     virTristateSwitch flock;
     virDomainFSSandboxMode sandbox;
 +    int thread_pool_size;
     virDomainVirtioOptions *virtio;
     virObject *privateData;
 };
 diff --git a/tests/qemuxml2argvdata/vhost-user-fs-fd-memory.xml b/tests/qemuxml2argvdata/vhost-user-fs-fd-memory.xml
 index abddf0870b..81de8c0dd7 100644
 --- a/tests/qemuxml2argvdata/vhost-user-fs-fd-memory.xml
 +++ b/tests/qemuxml2argvdata/vhost-user-fs-fd-memory.xml
@@ -32,6 +32,7 @@
         <cache mode='always'/>
         <sandbox mode='chroot'/>
         <lock posix='off' flock='off'/>
 +        <thread_pool size='16'/>
       </binary>
       <source dir='/path'/>
       <target dir='mount_tag'/>
 -- 
 2.35.1
--- a/SOURCES/libvirt-cpu_map-Disable-cpu64-rhel-for-host-model-and-baseline.patch
+++ b/SOURCES/libvirt-cpu_map-Disable-cpu64-rhel-for-host-model-and-baseline.patch
@ -1,60 +0,0 @@
 From 46f4cfe513f0f893c862dca7f02ed7d7932b2115 Mon Sep 17 00:00:00 2001
 Message-Id: <46f4cfe513f0f893c862dca7f02ed7d7932b2115@dist-git>
 From: Jiri Denemark <jdenemar@redhat.com>
 Date: Tue, 26 Apr 2022 12:50:41 +0200
 Subject: [PATCH] cpu_map: Disable cpu64-rhel* for host-model and baseline
 These ancient RHEL-only CPU models should not really be used by any CPU
 definition created by libvirt. We keep them just for backwards
 compatibility with domains which might still be using them.
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit d2e4d66be35cd04da72e5f5129a8a4da6a931505)
 https://bugzilla.redhat.com/show_bug.cgi?id=1851227
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/cpu_map/x86_cpu64-rhel5.xml                        | 2 +-
 src/cpu_map/x86_cpu64-rhel6.xml                        | 2 +-
 tests/cputestdata/x86_64-baseline-no-vendor-result.xml | 3 ++-
 3 files changed, 4 insertions(+), 3 deletions(-)
 diff --git a/src/cpu_map/x86_cpu64-rhel5.xml b/src/cpu_map/x86_cpu64-rhel5.xml
 index be6bcdb7a6..7402b7603c 100644
 --- a/src/cpu_map/x86_cpu64-rhel5.xml
 +++ b/src/cpu_map/x86_cpu64-rhel5.xml
@@ -1,6 +1,6 @@
 <cpus>
   <model name='cpu64-rhel5'>
 -    <decode host='on' guest='on'/>
 +    <decode host='off' guest='off'/>
     <feature name='apic'/>
     <feature name='clflush'/>
     <feature name='cmov'/>
 diff --git a/src/cpu_map/x86_cpu64-rhel6.xml b/src/cpu_map/x86_cpu64-rhel6.xml
 index c62b1b5575..061939c733 100644
 --- a/src/cpu_map/x86_cpu64-rhel6.xml
 +++ b/src/cpu_map/x86_cpu64-rhel6.xml
@@ -1,6 +1,6 @@
 <cpus>
   <model name='cpu64-rhel6'>
 -    <decode host='on' guest='on'/>
 +    <decode host='off' guest='off'/>
     <feature name='apic'/>
     <feature name='clflush'/>
     <feature name='cmov'/>
 diff --git a/tests/cputestdata/x86_64-baseline-no-vendor-result.xml b/tests/cputestdata/x86_64-baseline-no-vendor-result.xml
 index 00e03b2152..4b4921cf93 100644
 --- a/tests/cputestdata/x86_64-baseline-no-vendor-result.xml
 +++ b/tests/cputestdata/x86_64-baseline-no-vendor-result.xml
@@ -1,3 +1,4 @@
 <cpu mode='custom' match='exact'>
 -  <model fallback='allow'>cpu64-rhel6</model>
 +  <model fallback='allow'>kvm64</model>
 +  <feature policy='require' name='lahf_lm'/>
 </cpu>
 -- 
 2.35.1
--- a/SOURCES/libvirt-cpu_x86-Consolidate-signature-match-in-x86DecodeUseCandidate.patch
+++ b/SOURCES/libvirt-cpu_x86-Consolidate-signature-match-in-x86DecodeUseCandidate.patch
@ -1,75 +0,0 @@
 From 99a298a4a0575bf0072f504c4b8e4551400c44c0 Mon Sep 17 00:00:00 2001
 Message-Id: <99a298a4a0575bf0072f504c4b8e4551400c44c0@dist-git>
 From: Jiri Denemark <jdenemar@redhat.com>
 Date: Tue, 26 Apr 2022 11:58:07 +0200
 Subject: [PATCH] cpu_x86: Consolidate signature match in x86DecodeUseCandidate
 Checking the signature in two different places makes no sense since the
 code in between can only mark the candidate as the best option so far,
 which is what the second signature match does as well.
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 35ce086667e68e8f546cf36473591dd7c19c72eb)
 https://bugzilla.redhat.com/show_bug.cgi?id=1851227
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/cpu/cpu_x86.c | 31 ++++++++++++++-----------------
 1 file changed, 14 insertions(+), 17 deletions(-)
 diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c
 index 5cb9caef8a..f007487824 100644
 --- a/src/cpu/cpu_x86.c
 +++ b/src/cpu/cpu_x86.c
@@ -2020,15 +2020,22 @@ x86DecodeUseCandidate(virCPUx86Model *current,
     }
     /* Ideally we want to select a model with family/model equal to
 -     * family/model of the real CPU. Once we found such model, we only
 +     * family/model of the real CPU and once we found such model, we only
      * consider candidates with matching family/model.
      */
 -    if (signature &&
 -        virCPUx86SignaturesMatch(current->signatures, signature) &&
 -        !virCPUx86SignaturesMatch(candidate->signatures, signature)) {
 -        VIR_DEBUG("%s differs in signature from matching %s",
 -                  cpuCandidate->model, cpuCurrent->model);
 -        return 0;
 +    if (signature) {
 +        if (virCPUx86SignaturesMatch(current->signatures, signature) &&
 +            !virCPUx86SignaturesMatch(candidate->signatures, signature)) {
 +            VIR_DEBUG("%s differs in signature from matching %s",
 +                      cpuCandidate->model, cpuCurrent->model);
 +            return 0;
 +        }
 +
 +        if (!virCPUx86SignaturesMatch(current->signatures, signature) &&
 +            virCPUx86SignaturesMatch(candidate->signatures, signature)) {
 +            VIR_DEBUG("%s provides matching signature", cpuCandidate->model);
 +            return 1;
 +        }
     }
     if (cpuCurrent->nfeatures > cpuCandidate->nfeatures) {
@@ -2037,16 +2044,6 @@ x86DecodeUseCandidate(virCPUx86Model *current,
         return 1;
     }
 -    /* Prefer a candidate with matching signature even though it would
 -     * result in longer list of features.
 -     */
 -    if (signature &&
 -        virCPUx86SignaturesMatch(candidate->signatures, signature) &&
 -        !virCPUx86SignaturesMatch(current->signatures, signature)) {
 -        VIR_DEBUG("%s provides matching signature", cpuCandidate->model);
 -        return 1;
 -    }
 -
     VIR_DEBUG("%s does not result in shorter feature list than %s",
               cpuCandidate->model, cpuCurrent->model);
     return 0;
 -- 
 2.35.1
--- a/SOURCES/libvirt-cpu_x86-Ignore-enabled-features-for-input-models-in-x86DecodeUseCandidate.patch
+++ b/SOURCES/libvirt-cpu_x86-Ignore-enabled-features-for-input-models-in-x86DecodeUseCandidate.patch
@ -1,272 +0,0 @@
 From 752c74eeae67d41e7550991cb3bbe289984ec9d3 Mon Sep 17 00:00:00 2001
 Message-Id: <752c74eeae67d41e7550991cb3bbe289984ec9d3@dist-git>
 From: Jiri Denemark <jdenemar@redhat.com>
 Date: Fri, 29 Apr 2022 10:35:02 +0200
 Subject: [PATCH] cpu_x86: Ignore enabled features for input models in
 x86DecodeUseCandidate
 While we don't want to aim for the shortest list of disabled features in
 the baseline result (it would select a very old model), we want to do so
 while looking at any of the input models for which we're trying to
 compute a baseline CPU model. Given a set of input models, we always
 want to take the least capable one of them (i.e., the one with shortest
 list of disabled features) or a better model which is not one of the
 input models.
 So when considering an input model, we just check whether its list of
 disabled features is shorter than the currently best one. When looking
 at other models we check both enabled and disabled features while
 penalizing disabled features as implemented by the previous patch.
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit bb6cedd2082599323257ee0df18c93a6e0551b0b)
 https://bugzilla.redhat.com/show_bug.cgi?id=1851227
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/cpu/cpu_x86.c                             | 66 ++++++++++++-------
 ...4-baseline-Westmere+Nehalem-migratable.xml |  8 ++-
 ...86_64-baseline-Westmere+Nehalem-result.xml |  8 ++-
 ...-cpuid-baseline-Cooperlake+Cascadelake.xml | 13 ++--
 4 files changed, 64 insertions(+), 31 deletions(-)
 diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c
 index ebcd96edb1..7b59dad8bf 100644
 --- a/src/cpu/cpu_x86.c
 +++ b/src/cpu/cpu_x86.c
@@ -1975,7 +1975,8 @@ virCPUx86Compare(virCPUDef *host,
 static int
 virCPUx86CompareCandidateFeatureList(virCPUDef *cpuCurrent,
 -                                     virCPUDef *cpuCandidate)
 +                                     virCPUDef *cpuCandidate,
 +                                     bool isPreferred)
 {
     size_t current = cpuCurrent->nfeatures;
     size_t enabledCurrent = current;
@@ -2017,6 +2018,14 @@ virCPUx86CompareCandidateFeatureList(virCPUDef *cpuCurrent,
         return 1;
     }
 +    if (isPreferred && disabled < disabledCurrent) {
 +        VIR_DEBUG("%s is in the list of preferred models and provides fewer "
 +                  "disabled features than %s: %zu < %zu",
 +                  cpuCandidate->model, cpuCurrent->model,
 +                  disabled, disabledCurrent);
 +        return 1;
 +    }
 +
     VIR_DEBUG("%s is not better than %s: %zu (%zu, %zu) >= %zu (%zu, %zu)",
               cpuCandidate->model, cpuCurrent->model,
               candidate, enabled, disabled,
@@ -2039,8 +2048,10 @@ x86DecodeUseCandidate(virCPUx86Model *current,
                       virCPUx86Model *candidate,
                       virCPUDef *cpuCandidate,
                       uint32_t signature,
 -                      const char *preferred)
 +                      const char **preferred)
 {
 +    bool isPreferred = false;
 +
     if (cpuCandidate->type == VIR_CPU_TYPE_HOST &&
         !candidate->decodeHost) {
         VIR_DEBUG("%s is not supposed to be used for host CPU definition",
@@ -2064,9 +2075,13 @@ x86DecodeUseCandidate(virCPUx86Model *current,
         }
     }
 -    if (preferred && STREQ(cpuCandidate->model, preferred)) {
 -        VIR_DEBUG("%s is the preferred model", cpuCandidate->model);
 -        return 2;
 +    if (preferred) {
 +        isPreferred = g_strv_contains(preferred, cpuCandidate->model);
 +
 +        if (isPreferred && !preferred[1]) {
 +            VIR_DEBUG("%s is the preferred model", cpuCandidate->model);
 +            return 2;
 +        }
     }
     if (!cpuCurrent) {
@@ -2093,7 +2108,8 @@ x86DecodeUseCandidate(virCPUx86Model *current,
         }
     }
 -    return virCPUx86CompareCandidateFeatureList(cpuCurrent, cpuCandidate);
 +    return virCPUx86CompareCandidateFeatureList(cpuCurrent, cpuCandidate,
 +                                                isPreferred);
 }
@@ -2136,7 +2152,7 @@ static int
 x86Decode(virCPUDef *cpu,
           const virCPUx86Data *cpuData,
           virDomainCapsCPUModels *models,
 -          const char *preferred,
 +          const char **preferred,
           bool migratable)
 {
     virCPUx86Map *map;
@@ -2169,6 +2185,9 @@ x86Decode(virCPUDef *cpu,
     x86DataFilterTSX(&data, vendor, map);
 +    if (preferred && !preferred[0])
 +        preferred = NULL;
 +
     /* Walk through the CPU models in reverse order to check newest
      * models first.
      */
@@ -2176,16 +2195,18 @@ x86Decode(virCPUDef *cpu,
         candidate = map->models[i];
         if (models &&
             !(hvModel = virDomainCapsCPUModelsGet(models, candidate->name))) {
 -            if (preferred && STREQ(candidate->name, preferred)) {
 +            if (preferred &&
 +                !preferred[1] &&
 +                STREQ(candidate->name, preferred[0])) {
                 if (cpu->fallback != VIR_CPU_FALLBACK_ALLOW) {
                     virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
                                    _("CPU model %s is not supported by hypervisor"),
 -                                   preferred);
 +                                   preferred[0]);
                     return -1;
                 } else {
                     VIR_WARN("Preferred CPU model %s not allowed by"
                              " hypervisor; closest supported model will be"
 -                             " used", preferred);
 +                             " used", preferred[0]);
                 }
             } else {
                 VIR_DEBUG("CPU model %s not allowed by hypervisor; ignoring",
@@ -2793,8 +2814,8 @@ virCPUx86Baseline(virCPUDef **cpus,
     size_t i;
     virCPUx86Vendor *vendor = NULL;
     bool outputVendor = true;
 -    const char *modelName;
 -    bool matchingNames = true;
 +    g_autofree char **modelNames = NULL;
 +    size_t namesLen = 0;
     g_autoptr(virCPUData) featData = NULL;
     if (!(map = virCPUx86GetMap()))
@@ -2816,19 +2837,17 @@ virCPUx86Baseline(virCPUDef **cpus,
         return NULL;
     }
 -    modelName = cpus[0]->model;
 +    modelNames = g_new0(char *, ncpus + 1);
 +    if (cpus[0]->model)
 +        modelNames[namesLen++] = cpus[0]->model;
 +
     for (i = 1; i < ncpus; i++) {
         g_autoptr(virCPUx86Model) model = NULL;
         const char *vn = NULL;
 -        if (matchingNames && cpus[i]->model) {
 -            if (!modelName) {
 -                modelName = cpus[i]->model;
 -            } else if (STRNEQ(modelName, cpus[i]->model)) {
 -                modelName = NULL;
 -                matchingNames = false;
 -            }
 -        }
 +        if (cpus[i]->model &&
 +            !g_strv_contains((const char **) modelNames, cpus[i]->model))
 +            modelNames[namesLen++] = cpus[i]->model;
         if (!(model = x86ModelFromCPU(cpus[i], map, -1)))
             return NULL;
@@ -2891,10 +2910,11 @@ virCPUx86Baseline(virCPUDef **cpus,
         virCPUx86DataAddItem(&base_model->data, &vendor->data) < 0)
         return NULL;
 -    if (x86Decode(cpu, &base_model->data, models, modelName, migratable) < 0)
 +    if (x86Decode(cpu, &base_model->data, models,
 +                  (const char **) modelNames, migratable) < 0)
         return NULL;
 -    if (STREQ_NULLABLE(cpu->model, modelName))
 +    if (namesLen == 1 && STREQ(cpu->model, modelNames[0]))
         cpu->fallback = VIR_CPU_FALLBACK_FORBID;
     if (!outputVendor)
 diff --git a/tests/cputestdata/x86_64-baseline-Westmere+Nehalem-migratable.xml b/tests/cputestdata/x86_64-baseline-Westmere+Nehalem-migratable.xml
 index 775a27de2e..f5846b1619 100644
 --- a/tests/cputestdata/x86_64-baseline-Westmere+Nehalem-migratable.xml
 +++ b/tests/cputestdata/x86_64-baseline-Westmere+Nehalem-migratable.xml
@@ -1,10 +1,14 @@
 <cpu mode='custom' match='exact'>
 -  <model fallback='allow'>SandyBridge</model>
 +  <model fallback='allow'>Westmere</model>
   <vendor>Intel</vendor>
   <feature policy='require' name='vme'/>
   <feature policy='require' name='ss'/>
 +  <feature policy='require' name='pclmuldq'/>
   <feature policy='require' name='pcid'/>
 +  <feature policy='require' name='x2apic'/>
 +  <feature policy='require' name='tsc-deadline'/>
 +  <feature policy='require' name='xsave'/>
   <feature policy='require' name='osxsave'/>
 +  <feature policy='require' name='avx'/>
   <feature policy='require' name='hypervisor'/>
 -  <feature policy='disable' name='rdtscp'/>
 </cpu>
 diff --git a/tests/cputestdata/x86_64-baseline-Westmere+Nehalem-result.xml b/tests/cputestdata/x86_64-baseline-Westmere+Nehalem-result.xml
 index cafca97d62..166833276c 100644
 --- a/tests/cputestdata/x86_64-baseline-Westmere+Nehalem-result.xml
 +++ b/tests/cputestdata/x86_64-baseline-Westmere+Nehalem-result.xml
@@ -1,11 +1,15 @@
 <cpu mode='custom' match='exact'>
 -  <model fallback='allow'>SandyBridge</model>
 +  <model fallback='allow'>Westmere</model>
   <vendor>Intel</vendor>
   <feature policy='require' name='vme'/>
   <feature policy='require' name='ss'/>
 +  <feature policy='require' name='pclmuldq'/>
   <feature policy='require' name='pcid'/>
 +  <feature policy='require' name='x2apic'/>
 +  <feature policy='require' name='tsc-deadline'/>
 +  <feature policy='require' name='xsave'/>
   <feature policy='require' name='osxsave'/>
 +  <feature policy='require' name='avx'/>
   <feature policy='require' name='hypervisor'/>
   <feature policy='require' name='invtsc'/>
 -  <feature policy='disable' name='rdtscp'/>
 </cpu>
 diff --git a/tests/cputestdata/x86_64-cpuid-baseline-Cooperlake+Cascadelake.xml b/tests/cputestdata/x86_64-cpuid-baseline-Cooperlake+Cascadelake.xml
 index 46c32c996f..ecac749b97 100644
 --- a/tests/cputestdata/x86_64-cpuid-baseline-Cooperlake+Cascadelake.xml
 +++ b/tests/cputestdata/x86_64-cpuid-baseline-Cooperlake+Cascadelake.xml
@@ -1,17 +1,22 @@
 <cpu mode='custom' match='exact'>
 -  <model fallback='allow'>Cooperlake</model>
 +  <model fallback='allow'>Cascadelake-Server</model>
   <vendor>Intel</vendor>
   <feature policy='require' name='ss'/>
   <feature policy='require' name='vmx'/>
   <feature policy='require' name='hypervisor'/>
   <feature policy='require' name='tsc_adjust'/>
 -  <feature policy='require' name='mpx'/>
   <feature policy='require' name='umip'/>
 +  <feature policy='require' name='pku'/>
   <feature policy='require' name='md-clear'/>
 +  <feature policy='require' name='stibp'/>
 +  <feature policy='require' name='arch-capabilities'/>
   <feature policy='require' name='xsaves'/>
   <feature policy='require' name='ibpb'/>
   <feature policy='require' name='amd-ssbd'/>
 +  <feature policy='require' name='rdctl-no'/>
 +  <feature policy='require' name='ibrs-all'/>
 +  <feature policy='require' name='skip-l1dfl-vmentry'/>
 +  <feature policy='require' name='mds-no'/>
 +  <feature policy='require' name='pschange-mc-no'/>
   <feature policy='require' name='tsx-ctrl'/>
 -  <feature policy='disable' name='avx512-bf16'/>
 -  <feature policy='disable' name='taa-no'/>
 </cpu>
 -- 
 2.35.1
--- a/SOURCES/libvirt-cpu_x86-Penalize-disabled-features-when-computing-CPU-model.patch
+++ b/SOURCES/libvirt-cpu_x86-Penalize-disabled-features-when-computing-CPU-model.patch
--- a/SOURCES/libvirt-cpu_x86-Refactor-feature-list-comparison-in-x86DecodeUseCandidate.patch
+++ b/SOURCES/libvirt-cpu_x86-Refactor-feature-list-comparison-in-x86DecodeUseCandidate.patch
@ -1,73 +0,0 @@
 From 3d7a4041d31e403dc9e762b34f7faf36f7f20a28 Mon Sep 17 00:00:00 2001
 Message-Id: <3d7a4041d31e403dc9e762b34f7faf36f7f20a28@dist-git>
 From: Jiri Denemark <jdenemar@redhat.com>
 Date: Tue, 26 Apr 2022 15:02:51 +0200
 Subject: [PATCH] cpu_x86: Refactor feature list comparison in
 x86DecodeUseCandidate
 It will become more complicated and so it deserves to be separated into
 a new function.
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 1d6ca40ac23c039abc4392b668f256d0eda33280)
 https://bugzilla.redhat.com/show_bug.cgi?id=1851227
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/cpu/cpu_x86.c | 31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)
 diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c
 index f007487824..81c2441b8b 100644
 --- a/src/cpu/cpu_x86.c
 +++ b/src/cpu/cpu_x86.c
@@ -1970,6 +1970,27 @@ virCPUx86Compare(virCPUDef *host,
 }
 +static int
 +virCPUx86CompareCandidateFeatureList(virCPUDef *cpuCurrent,
 +                                     virCPUDef *cpuCandidate)
 +{
 +    size_t current = cpuCurrent->nfeatures;
 +    size_t candidate = cpuCandidate->nfeatures;
 +
 +    if (candidate < current) {
 +        VIR_DEBUG("%s is better than %s: %zu < %zu",
 +                  cpuCandidate->model, cpuCurrent->model,
 +                  candidate, current);
 +        return 1;
 +    }
 +
 +    VIR_DEBUG("%s is not better than %s: %zu >= %zu",
 +              cpuCandidate->model, cpuCurrent->model,
 +              candidate, current);
 +    return 0;
 +}
 +
 +
 /*
  * Checks whether a candidate model is a better fit for the CPU data than the
  * current model.
@@ -2038,15 +2059,7 @@ x86DecodeUseCandidate(virCPUx86Model *current,
         }
     }
 -    if (cpuCurrent->nfeatures > cpuCandidate->nfeatures) {
 -        VIR_DEBUG("%s results in shorter feature list than %s",
 -                  cpuCandidate->model, cpuCurrent->model);
 -        return 1;
 -    }
 -
 -    VIR_DEBUG("%s does not result in shorter feature list than %s",
 -              cpuCandidate->model, cpuCurrent->model);
 -    return 0;
 +    return virCPUx86CompareCandidateFeatureList(cpuCurrent, cpuCandidate);
 }
 -- 
 2.35.1
--- a/SOURCES/libvirt-cputest-Add-some-real-world-baseline-tests.patch
+++ b/SOURCES/libvirt-cputest-Add-some-real-world-baseline-tests.patch
@ -1,498 +0,0 @@
 From b37a398da4323407de24d19afac937eac80170cc Mon Sep 17 00:00:00 2001
 Message-Id: <b37a398da4323407de24d19afac937eac80170cc@dist-git>
 From: Jiri Denemark <jdenemar@redhat.com>
 Date: Thu, 21 Apr 2022 18:25:15 +0200
 Subject: [PATCH] cputest: Add some real world baseline tests
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 63d633b9a4fc42da7e2acaf45501914607d968a5)
 https://bugzilla.redhat.com/show_bug.cgi?id=1851227
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 tests/cputest.c                               | 118 +++++++++++++++---
 ...id-baseline-Broadwell-IBRS+Cascadelake.xml |  11 ++
 ..._64-cpuid-baseline-Cascadelake+Icelake.xml |  14 +++
 ...puid-baseline-Cascadelake+Skylake-IBRS.xml |  12 ++
 ..._64-cpuid-baseline-Cascadelake+Skylake.xml |   8 ++
 ...-cpuid-baseline-Cooperlake+Cascadelake.xml |  17 +++
 ...6_64-cpuid-baseline-Cooperlake+Icelake.xml |  14 +++
 .../x86_64-cpuid-baseline-EPYC+Rome.xml       |  13 ++
 .../x86_64-cpuid-baseline-Haswell+Skylake.xml |  14 +++
 ...-baseline-Haswell-noTSX-IBRS+Broadwell.xml |  14 +++
 ...seline-Haswell-noTSX-IBRS+Skylake-IBRS.xml |  14 +++
 ...id-baseline-Haswell-noTSX-IBRS+Skylake.xml |  14 +++
 .../x86_64-cpuid-baseline-Ryzen+Rome.xml      |  13 ++
 ...4-cpuid-baseline-Skylake-Client+Server.xml |   9 ++
 14 files changed, 271 insertions(+), 14 deletions(-)
 create mode 100644 tests/cputestdata/x86_64-cpuid-baseline-Broadwell-IBRS+Cascadelake.xml
 create mode 100644 tests/cputestdata/x86_64-cpuid-baseline-Cascadelake+Icelake.xml
 create mode 100644 tests/cputestdata/x86_64-cpuid-baseline-Cascadelake+Skylake-IBRS.xml
 create mode 100644 tests/cputestdata/x86_64-cpuid-baseline-Cascadelake+Skylake.xml
 create mode 100644 tests/cputestdata/x86_64-cpuid-baseline-Cooperlake+Cascadelake.xml
 create mode 100644 tests/cputestdata/x86_64-cpuid-baseline-Cooperlake+Icelake.xml
 create mode 100644 tests/cputestdata/x86_64-cpuid-baseline-EPYC+Rome.xml
 create mode 100644 tests/cputestdata/x86_64-cpuid-baseline-Haswell+Skylake.xml
 create mode 100644 tests/cputestdata/x86_64-cpuid-baseline-Haswell-noTSX-IBRS+Broadwell.xml
 create mode 100644 tests/cputestdata/x86_64-cpuid-baseline-Haswell-noTSX-IBRS+Skylake-IBRS.xml
 create mode 100644 tests/cputestdata/x86_64-cpuid-baseline-Haswell-noTSX-IBRS+Skylake.xml
 create mode 100644 tests/cputestdata/x86_64-cpuid-baseline-Ryzen+Rome.xml
 create mode 100644 tests/cputestdata/x86_64-cpuid-baseline-Skylake-Client+Server.xml
 diff --git a/tests/cputest.c b/tests/cputest.c
 index b939e20718..b39ec7e18b 100644
 --- a/tests/cputest.c
 +++ b/tests/cputest.c
@@ -58,6 +58,8 @@ struct data {
     const char *name;
     virDomainCapsCPUModels *models;
     const char *modelsName;
 +    const char **cpus;
 +    int ncpus;
     unsigned int flags;
     int result;
 };
@@ -561,6 +563,60 @@ cpuTestCPUID(bool guest, const void *arg)
 }
 +static int
 +cpuTestCPUIDBaseline(const void *arg)
 +{
 +    const struct data *data = arg;
 +    int ret = -1;
 +    virCPUDef **cpus = NULL;
 +    virCPUDef *baseline = NULL;
 +    g_autofree char *result = NULL;
 +    size_t i;
 +
 +    cpus = g_new0(virCPUDef *, data->ncpus);
 +    for (i = 0; i < data->ncpus; i++) {
 +        g_autofree char *name = NULL;
 +
 +        name = g_strdup_printf("cpuid-%s-json", data->cpus[i]);
 +        if (!(cpus[i] = cpuTestLoadXML(data->arch, name)))
 +            goto cleanup;
 +    }
 +
 +    baseline = virCPUBaseline(data->arch, cpus, data->ncpus, NULL, NULL, false);
 +    if (!baseline)
 +        goto cleanup;
 +
 +    result = g_strdup_printf("cpuid-baseline-%s", data->name);
 +
 +    if (cpuTestCompareXML(data->arch, baseline, result) < 0)
 +        goto cleanup;
 +
 +    for (i = 0; i < data->ncpus; i++) {
 +        virCPUCompareResult cmp;
 +
 +        cmp = virCPUCompare(data->arch, cpus[i], baseline, false);
 +        if (cmp != VIR_CPU_COMPARE_SUPERSET &&
 +            cmp != VIR_CPU_COMPARE_IDENTICAL) {
 +            VIR_TEST_VERBOSE("\nbaseline CPU is incompatible with CPU %zu", i);
 +            VIR_TEST_VERBOSE("%74s", "... ");
 +            ret = -1;
 +            goto cleanup;
 +        }
 +    }
 +
 +    ret = 0;
 +
 + cleanup:
 +    if (cpus) {
 +        for (i = 0; i < data->ncpus; i++)
 +            virCPUDefFree(cpus[i]);
 +        VIR_FREE(cpus);
 +    }
 +    virCPUDefFree(baseline);
 +    return ret;
 +}
 +
 +
 static int
 cpuTestHostCPUID(const void *arg)
 {
@@ -888,13 +944,13 @@ mymain(void)
         goto cleanup;
     }
 -#define DO_TEST(arch, api, name, host, cpu, \
 +#define DO_TEST(arch, api, name, host, cpu, cpus, ncpus, \
                 models, flags, result) \
     do { \
         struct data data = { \
             arch, host, cpu, models, \
             models == NULL ? NULL : #models, \
 -            flags, result \
 +            cpus, ncpus, flags, result \
         }; \
         g_autofree char *testLabel = NULL; \
  \
@@ -907,12 +963,12 @@ mymain(void)
 #define DO_TEST_COMPARE(arch, host, cpu, result) \
     DO_TEST(arch, cpuTestCompare, \
             host "/" cpu " (" #result ")", \
 -            host, cpu, NULL, 0, result)
 +            host, cpu, NULL, 0, NULL, 0, result)
 #define DO_TEST_UPDATE_ONLY(arch, host, cpu) \
     DO_TEST(arch, cpuTestUpdate, \
             cpu " on " host, \
 -            host, cpu, NULL, 0, 0)
 +            host, cpu, NULL, 0, NULL, 0, 0)
 #define DO_TEST_UPDATE(arch, host, cpu, result) \
     do { \
@@ -930,31 +986,31 @@ mymain(void)
             suffix = " (migratable)"; \
         label = g_strdup_printf("%s%s", name, suffix); \
         DO_TEST(arch, cpuTestBaseline, label, NULL, \
 -                "baseline-" name, NULL, flags, result); \
 +                "baseline-" name, NULL, 0, NULL, flags, result); \
     } while (0)
 #define DO_TEST_HASFEATURE(arch, host, feature, result) \
     DO_TEST(arch, cpuTestHasFeature, \
             host "/" feature " (" #result ")", \
 -            host, feature, NULL, 0, result)
 +            host, feature, NULL, 0, NULL, 0, result)
 #define DO_TEST_GUESTCPU(arch, host, cpu, models, result) \
     DO_TEST(arch, cpuTestGuestCPU, \
             host "/" cpu " (" #models ")", \
 -            host, cpu, models, 0, result)
 +            host, cpu, NULL, 0, models, 0, result)
 #if WITH_QEMU
 # define DO_TEST_JSON(arch, host, json) \
     do { \
         if (json == JSON_MODELS) { \
             DO_TEST(arch, cpuTestGuestCPUID, host, host, \
 -                    NULL, NULL, 0, 0); \
 +                    NULL, NULL, 0, NULL, 0, 0); \
         } \
         if (json != JSON_NONE) { \
             DO_TEST(arch, cpuTestJSONCPUID, host, host, \
 -                    NULL, NULL, json, 0); \
 +                    NULL, NULL, 0, NULL, json, 0); \
             DO_TEST(arch, cpuTestJSONSignature, host, host, \
 -                    NULL, NULL, 0, 0); \
 +                    NULL, NULL, 0, NULL, 0, 0); \
         } \
     } while (0)
 #else
@@ -964,18 +1020,26 @@ mymain(void)
 #define DO_TEST_CPUID(arch, host, json) \
     do { \
         DO_TEST(arch, cpuTestHostCPUID, host, host, \
 -                NULL, NULL, 0, 0); \
 +                NULL, NULL, 0, NULL, 0, 0); \
         DO_TEST(arch, cpuTestGuestCPUID, host, host, \
 -                NULL, NULL, json, 0); \
 +                NULL, NULL, 0, NULL, json, 0); \
         DO_TEST(arch, cpuTestCPUIDSignature, host, host, \
 -                NULL, NULL, 0, 0); \
 +                NULL, NULL, 0, NULL, 0, 0); \
         DO_TEST_JSON(arch, host, json); \
         if (json != JSON_NONE) { \
             DO_TEST(arch, cpuTestUpdateLive, host, host, \
 -                    NULL, NULL, json, 0); \
 +                    NULL, NULL, 0, NULL, json, 0); \
         } \
     } while (0)
 +#define DO_TEST_CPUID_BASELINE(arch, label, cpu1, cpu2) \
 +    do { \
 +        const char *cpus[] = {cpu1, cpu2}; \
 +        DO_TEST(arch, cpuTestCPUIDBaseline, \
 +                label " (" cpu1 ", " cpu2 ")", \
 +                NULL, label, cpus, 2, NULL, 0, 0); \
 +    } while (0)
 +
     /* host to host comparison */
     DO_TEST_COMPARE(VIR_ARCH_X86_64, "host", "host", VIR_CPU_COMPARE_IDENTICAL);
     DO_TEST_COMPARE(VIR_ARCH_X86_64, "host", "host-better", VIR_CPU_COMPARE_INCOMPATIBLE);
@@ -1157,6 +1221,32 @@ mymain(void)
     DO_TEST_CPUID(VIR_ARCH_X86_64, "Ice-Lake-Server", JSON_MODELS);
     DO_TEST_CPUID(VIR_ARCH_X86_64, "Cooperlake", JSON_MODELS);
 +    DO_TEST_CPUID_BASELINE(VIR_ARCH_X86_64, "Ryzen+Rome",
 +                           "Ryzen-7-1800X-Eight-Core", "Ryzen-9-3900X-12-Core");
 +    DO_TEST_CPUID_BASELINE(VIR_ARCH_X86_64, "EPYC+Rome",
 +                           "EPYC-7601-32-Core", "EPYC-7502-32-Core");
 +    DO_TEST_CPUID_BASELINE(VIR_ARCH_X86_64, "Haswell-noTSX-IBRS+Skylake",
 +                           "Xeon-E5-2609-v3", "Xeon-Gold-6148");
 +    DO_TEST_CPUID_BASELINE(VIR_ARCH_X86_64, "Haswell-noTSX-IBRS+Skylake-IBRS",
 +                           "Xeon-E5-2609-v3", "Xeon-Gold-6130");
 +    DO_TEST_CPUID_BASELINE(VIR_ARCH_X86_64, "Broadwell-IBRS+Cascadelake",
 +                           "Xeon-E5-2623-v4", "Xeon-Platinum-8268");
 +    DO_TEST_CPUID_BASELINE(VIR_ARCH_X86_64, "Cascadelake+Skylake-IBRS",
 +                           "Xeon-Platinum-8268", "Xeon-Gold-6130");
 +    DO_TEST_CPUID_BASELINE(VIR_ARCH_X86_64, "Cascadelake+Skylake",
 +                           "Xeon-Platinum-9242", "Xeon-Gold-6148");
 +    DO_TEST_CPUID_BASELINE(VIR_ARCH_X86_64, "Cascadelake+Icelake",
 +                           "Xeon-Platinum-9242", "Ice-Lake-Server");
 +    DO_TEST_CPUID_BASELINE(VIR_ARCH_X86_64, "Cooperlake+Icelake",
 +                           "Cooperlake", "Ice-Lake-Server");
 +    DO_TEST_CPUID_BASELINE(VIR_ARCH_X86_64, "Cooperlake+Cascadelake",
 +                           "Cooperlake", "Xeon-Platinum-9242");
 +    DO_TEST_CPUID_BASELINE(VIR_ARCH_X86_64, "Skylake-Client+Server",
 +                           "Core-i5-6600", "Xeon-Gold-6148");
 +    DO_TEST_CPUID_BASELINE(VIR_ARCH_X86_64, "Haswell-noTSX-IBRS+Broadwell",
 +                           "Xeon-E5-2609-v3", "Xeon-E5-2650-v4");
 +    DO_TEST_CPUID_BASELINE(VIR_ARCH_X86_64, "Haswell+Skylake",
 +                           "Xeon-E7-8890-v3", "Xeon-Gold-5115");
  cleanup:
 #if WITH_QEMU
     qemuTestDriverFree(&driver);
 diff --git a/tests/cputestdata/x86_64-cpuid-baseline-Broadwell-IBRS+Cascadelake.xml b/tests/cputestdata/x86_64-cpuid-baseline-Broadwell-IBRS+Cascadelake.xml
 new file mode 100644
 index 0000000000..4e3f253e9b
 --- /dev/null
 +++ b/tests/cputestdata/x86_64-cpuid-baseline-Broadwell-IBRS+Cascadelake.xml
@@ -0,0 +1,11 @@
 +<cpu mode='custom' match='exact'>
 +  <model fallback='allow'>Skylake-Client-IBRS</model>
 +  <vendor>Intel</vendor>
 +  <feature policy='require' name='ss'/>
 +  <feature policy='require' name='hypervisor'/>
 +  <feature policy='require' name='tsc_adjust'/>
 +  <feature policy='require' name='pdpe1gb'/>
 +  <feature policy='disable' name='mpx'/>
 +  <feature policy='disable' name='xsavec'/>
 +  <feature policy='disable' name='xgetbv1'/>
 +</cpu>
 diff --git a/tests/cputestdata/x86_64-cpuid-baseline-Cascadelake+Icelake.xml b/tests/cputestdata/x86_64-cpuid-baseline-Cascadelake+Icelake.xml
 new file mode 100644
 index 0000000000..e372a3e446
 --- /dev/null
 +++ b/tests/cputestdata/x86_64-cpuid-baseline-Cascadelake+Icelake.xml
@@ -0,0 +1,14 @@
 +<cpu mode='custom' match='exact'>
 +  <model fallback='allow'>Cooperlake</model>
 +  <vendor>Intel</vendor>
 +  <feature policy='require' name='ss'/>
 +  <feature policy='require' name='hypervisor'/>
 +  <feature policy='require' name='tsc_adjust'/>
 +  <feature policy='require' name='mpx'/>
 +  <feature policy='require' name='umip'/>
 +  <feature policy='require' name='xsaves'/>
 +  <feature policy='disable' name='avx512-bf16'/>
 +  <feature policy='disable' name='mds-no'/>
 +  <feature policy='disable' name='pschange-mc-no'/>
 +  <feature policy='disable' name='taa-no'/>
 +</cpu>
 diff --git a/tests/cputestdata/x86_64-cpuid-baseline-Cascadelake+Skylake-IBRS.xml b/tests/cputestdata/x86_64-cpuid-baseline-Cascadelake+Skylake-IBRS.xml
 new file mode 100644
 index 0000000000..e559e01583
 --- /dev/null
 +++ b/tests/cputestdata/x86_64-cpuid-baseline-Cascadelake+Skylake-IBRS.xml
@@ -0,0 +1,12 @@
 +<cpu mode='custom' match='exact'>
 +  <model fallback='allow'>Cascadelake-Server</model>
 +  <vendor>Intel</vendor>
 +  <feature policy='require' name='ss'/>
 +  <feature policy='require' name='hypervisor'/>
 +  <feature policy='require' name='tsc_adjust'/>
 +  <feature policy='require' name='umip'/>
 +  <feature policy='require' name='pku'/>
 +  <feature policy='require' name='xsaves'/>
 +  <feature policy='require' name='skip-l1dfl-vmentry'/>
 +  <feature policy='disable' name='avx512vnni'/>
 +</cpu>
 diff --git a/tests/cputestdata/x86_64-cpuid-baseline-Cascadelake+Skylake.xml b/tests/cputestdata/x86_64-cpuid-baseline-Cascadelake+Skylake.xml
 new file mode 100644
 index 0000000000..906259df0b
 --- /dev/null
 +++ b/tests/cputestdata/x86_64-cpuid-baseline-Cascadelake+Skylake.xml
@@ -0,0 +1,8 @@
 +<cpu mode='custom' match='exact'>
 +  <model fallback='allow'>Skylake-Server</model>
 +  <vendor>Intel</vendor>
 +  <feature policy='require' name='ss'/>
 +  <feature policy='require' name='hypervisor'/>
 +  <feature policy='require' name='tsc_adjust'/>
 +  <feature policy='require' name='clflushopt'/>
 +</cpu>
 diff --git a/tests/cputestdata/x86_64-cpuid-baseline-Cooperlake+Cascadelake.xml b/tests/cputestdata/x86_64-cpuid-baseline-Cooperlake+Cascadelake.xml
 new file mode 100644
 index 0000000000..46c32c996f
 --- /dev/null
 +++ b/tests/cputestdata/x86_64-cpuid-baseline-Cooperlake+Cascadelake.xml
@@ -0,0 +1,17 @@
 +<cpu mode='custom' match='exact'>
 +  <model fallback='allow'>Cooperlake</model>
 +  <vendor>Intel</vendor>
 +  <feature policy='require' name='ss'/>
 +  <feature policy='require' name='vmx'/>
 +  <feature policy='require' name='hypervisor'/>
 +  <feature policy='require' name='tsc_adjust'/>
 +  <feature policy='require' name='mpx'/>
 +  <feature policy='require' name='umip'/>
 +  <feature policy='require' name='md-clear'/>
 +  <feature policy='require' name='xsaves'/>
 +  <feature policy='require' name='ibpb'/>
 +  <feature policy='require' name='amd-ssbd'/>
 +  <feature policy='require' name='tsx-ctrl'/>
 +  <feature policy='disable' name='avx512-bf16'/>
 +  <feature policy='disable' name='taa-no'/>
 +</cpu>
 diff --git a/tests/cputestdata/x86_64-cpuid-baseline-Cooperlake+Icelake.xml b/tests/cputestdata/x86_64-cpuid-baseline-Cooperlake+Icelake.xml
 new file mode 100644
 index 0000000000..e372a3e446
 --- /dev/null
 +++ b/tests/cputestdata/x86_64-cpuid-baseline-Cooperlake+Icelake.xml
@@ -0,0 +1,14 @@
 +<cpu mode='custom' match='exact'>
 +  <model fallback='allow'>Cooperlake</model>
 +  <vendor>Intel</vendor>
 +  <feature policy='require' name='ss'/>
 +  <feature policy='require' name='hypervisor'/>
 +  <feature policy='require' name='tsc_adjust'/>
 +  <feature policy='require' name='mpx'/>
 +  <feature policy='require' name='umip'/>
 +  <feature policy='require' name='xsaves'/>
 +  <feature policy='disable' name='avx512-bf16'/>
 +  <feature policy='disable' name='mds-no'/>
 +  <feature policy='disable' name='pschange-mc-no'/>
 +  <feature policy='disable' name='taa-no'/>
 +</cpu>
 diff --git a/tests/cputestdata/x86_64-cpuid-baseline-EPYC+Rome.xml b/tests/cputestdata/x86_64-cpuid-baseline-EPYC+Rome.xml
 new file mode 100644
 index 0000000000..e1984b2890
 --- /dev/null
 +++ b/tests/cputestdata/x86_64-cpuid-baseline-EPYC+Rome.xml
@@ -0,0 +1,13 @@
 +<cpu mode='custom' match='exact'>
 +  <model fallback='allow'>EPYC</model>
 +  <vendor>AMD</vendor>
 +  <feature policy='require' name='x2apic'/>
 +  <feature policy='require' name='tsc-deadline'/>
 +  <feature policy='require' name='hypervisor'/>
 +  <feature policy='require' name='tsc_adjust'/>
 +  <feature policy='require' name='cmp_legacy'/>
 +  <feature policy='require' name='npt'/>
 +  <feature policy='require' name='nrip-save'/>
 +  <feature policy='disable' name='svm'/>
 +  <feature policy='disable' name='monitor'/>
 +</cpu>
 diff --git a/tests/cputestdata/x86_64-cpuid-baseline-Haswell+Skylake.xml b/tests/cputestdata/x86_64-cpuid-baseline-Haswell+Skylake.xml
 new file mode 100644
 index 0000000000..e687a679b3
 --- /dev/null
 +++ b/tests/cputestdata/x86_64-cpuid-baseline-Haswell+Skylake.xml
@@ -0,0 +1,14 @@
 +<cpu mode='custom' match='exact'>
 +  <model fallback='allow'>Haswell</model>
 +  <vendor>Intel</vendor>
 +  <feature policy='require' name='vme'/>
 +  <feature policy='require' name='ss'/>
 +  <feature policy='require' name='f16c'/>
 +  <feature policy='require' name='rdrand'/>
 +  <feature policy='require' name='hypervisor'/>
 +  <feature policy='require' name='arat'/>
 +  <feature policy='require' name='tsc_adjust'/>
 +  <feature policy='require' name='xsaveopt'/>
 +  <feature policy='require' name='pdpe1gb'/>
 +  <feature policy='require' name='abm'/>
 +</cpu>
 diff --git a/tests/cputestdata/x86_64-cpuid-baseline-Haswell-noTSX-IBRS+Broadwell.xml b/tests/cputestdata/x86_64-cpuid-baseline-Haswell-noTSX-IBRS+Broadwell.xml
 new file mode 100644
 index 0000000000..651457b17a
 --- /dev/null
 +++ b/tests/cputestdata/x86_64-cpuid-baseline-Haswell-noTSX-IBRS+Broadwell.xml
@@ -0,0 +1,14 @@
 +<cpu mode='custom' match='exact'>
 +  <model fallback='allow'>Haswell-noTSX</model>
 +  <vendor>Intel</vendor>
 +  <feature policy='require' name='vme'/>
 +  <feature policy='require' name='ss'/>
 +  <feature policy='require' name='f16c'/>
 +  <feature policy='require' name='rdrand'/>
 +  <feature policy='require' name='hypervisor'/>
 +  <feature policy='require' name='arat'/>
 +  <feature policy='require' name='tsc_adjust'/>
 +  <feature policy='require' name='xsaveopt'/>
 +  <feature policy='require' name='pdpe1gb'/>
 +  <feature policy='require' name='abm'/>
 +</cpu>
 diff --git a/tests/cputestdata/x86_64-cpuid-baseline-Haswell-noTSX-IBRS+Skylake-IBRS.xml b/tests/cputestdata/x86_64-cpuid-baseline-Haswell-noTSX-IBRS+Skylake-IBRS.xml
 new file mode 100644
 index 0000000000..8bda1c02e2
 --- /dev/null
 +++ b/tests/cputestdata/x86_64-cpuid-baseline-Haswell-noTSX-IBRS+Skylake-IBRS.xml
@@ -0,0 +1,14 @@
 +<cpu mode='custom' match='exact'>
 +  <model fallback='allow'>Haswell-noTSX-IBRS</model>
 +  <vendor>Intel</vendor>
 +  <feature policy='require' name='vme'/>
 +  <feature policy='require' name='ss'/>
 +  <feature policy='require' name='f16c'/>
 +  <feature policy='require' name='rdrand'/>
 +  <feature policy='require' name='hypervisor'/>
 +  <feature policy='require' name='arat'/>
 +  <feature policy='require' name='tsc_adjust'/>
 +  <feature policy='require' name='xsaveopt'/>
 +  <feature policy='require' name='pdpe1gb'/>
 +  <feature policy='require' name='abm'/>
 +</cpu>
 diff --git a/tests/cputestdata/x86_64-cpuid-baseline-Haswell-noTSX-IBRS+Skylake.xml b/tests/cputestdata/x86_64-cpuid-baseline-Haswell-noTSX-IBRS+Skylake.xml
 new file mode 100644
 index 0000000000..651457b17a
 --- /dev/null
 +++ b/tests/cputestdata/x86_64-cpuid-baseline-Haswell-noTSX-IBRS+Skylake.xml
@@ -0,0 +1,14 @@
 +<cpu mode='custom' match='exact'>
 +  <model fallback='allow'>Haswell-noTSX</model>
 +  <vendor>Intel</vendor>
 +  <feature policy='require' name='vme'/>
 +  <feature policy='require' name='ss'/>
 +  <feature policy='require' name='f16c'/>
 +  <feature policy='require' name='rdrand'/>
 +  <feature policy='require' name='hypervisor'/>
 +  <feature policy='require' name='arat'/>
 +  <feature policy='require' name='tsc_adjust'/>
 +  <feature policy='require' name='xsaveopt'/>
 +  <feature policy='require' name='pdpe1gb'/>
 +  <feature policy='require' name='abm'/>
 +</cpu>
 diff --git a/tests/cputestdata/x86_64-cpuid-baseline-Ryzen+Rome.xml b/tests/cputestdata/x86_64-cpuid-baseline-Ryzen+Rome.xml
 new file mode 100644
 index 0000000000..051402b9d5
 --- /dev/null
 +++ b/tests/cputestdata/x86_64-cpuid-baseline-Ryzen+Rome.xml
@@ -0,0 +1,13 @@
 +<cpu mode='custom' match='exact'>
 +  <model fallback='allow'>EPYC</model>
 +  <vendor>AMD</vendor>
 +  <feature policy='require' name='x2apic'/>
 +  <feature policy='require' name='tsc-deadline'/>
 +  <feature policy='require' name='hypervisor'/>
 +  <feature policy='require' name='tsc_adjust'/>
 +  <feature policy='require' name='cmp_legacy'/>
 +  <feature policy='require' name='npt'/>
 +  <feature policy='require' name='nrip-save'/>
 +  <feature policy='disable' name='sha-ni'/>
 +  <feature policy='disable' name='monitor'/>
 +</cpu>
 diff --git a/tests/cputestdata/x86_64-cpuid-baseline-Skylake-Client+Server.xml b/tests/cputestdata/x86_64-cpuid-baseline-Skylake-Client+Server.xml
 new file mode 100644
 index 0000000000..d46ff26eeb
 --- /dev/null
 +++ b/tests/cputestdata/x86_64-cpuid-baseline-Skylake-Client+Server.xml
@@ -0,0 +1,9 @@
 +<cpu mode='custom' match='exact'>
 +  <model fallback='allow'>Skylake-Client</model>
 +  <vendor>Intel</vendor>
 +  <feature policy='require' name='ss'/>
 +  <feature policy='require' name='hypervisor'/>
 +  <feature policy='require' name='tsc_adjust'/>
 +  <feature policy='require' name='clflushopt'/>
 +  <feature policy='require' name='pdpe1gb'/>
 +</cpu>
 -- 
 2.35.1
--- a/SOURCES/libvirt-cputest-Drop-some-old-artificial-baseline-tests.patch
+++ b/SOURCES/libvirt-cputest-Drop-some-old-artificial-baseline-tests.patch
@ -1,334 +0,0 @@
 From 50d94f13286ca19ef1f457be72debdbf77547df6 Mon Sep 17 00:00:00 2001
 Message-Id: <50d94f13286ca19ef1f457be72debdbf77547df6@dist-git>
 From: Jiri Denemark <jdenemar@redhat.com>
 Date: Wed, 4 May 2022 16:21:38 +0200
 Subject: [PATCH] cputest: Drop some old artificial baseline tests
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 6aff36019bbaf643f451779621c6c88cab0e64a7)
 https://bugzilla.redhat.com/show_bug.cgi?id=1851227
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 tests/cputest.c                               |  6 ---
 .../cputestdata/x86_64-baseline-1-result.xml  |  5 --
 tests/cputestdata/x86_64-baseline-1.xml       | 20 --------
 .../cputestdata/x86_64-baseline-2-result.xml  |  4 --
 tests/cputestdata/x86_64-baseline-2.xml       | 22 ---------
 .../x86_64-baseline-5-expanded.xml            | 47 -------------------
 .../cputestdata/x86_64-baseline-5-result.xml  | 10 ----
 tests/cputestdata/x86_64-baseline-5.xml       | 35 --------------
 .../cputestdata/x86_64-baseline-7-result.xml  |  4 --
 tests/cputestdata/x86_64-baseline-7.xml       | 24 ----------
 .../cputestdata/x86_64-baseline-8-result.xml  |  4 --
 tests/cputestdata/x86_64-baseline-8.xml       | 28 -----------
 12 files changed, 209 deletions(-)
 delete mode 100644 tests/cputestdata/x86_64-baseline-1-result.xml
 delete mode 100644 tests/cputestdata/x86_64-baseline-1.xml
 delete mode 100644 tests/cputestdata/x86_64-baseline-2-result.xml
 delete mode 100644 tests/cputestdata/x86_64-baseline-2.xml
 delete mode 100644 tests/cputestdata/x86_64-baseline-5-expanded.xml
 delete mode 100644 tests/cputestdata/x86_64-baseline-5-result.xml
 delete mode 100644 tests/cputestdata/x86_64-baseline-5.xml
 delete mode 100644 tests/cputestdata/x86_64-baseline-7-result.xml
 delete mode 100644 tests/cputestdata/x86_64-baseline-7.xml
 delete mode 100644 tests/cputestdata/x86_64-baseline-8-result.xml
 delete mode 100644 tests/cputestdata/x86_64-baseline-8.xml
 diff --git a/tests/cputest.c b/tests/cputest.c
 index 0f0621292a..20d56836be 100644
 --- a/tests/cputest.c
 +++ b/tests/cputest.c
@@ -1051,18 +1051,12 @@ mymain(void)
     DO_TEST_BASELINE(VIR_ARCH_X86_64, "incompatible-vendors", 0, -1);
     DO_TEST_BASELINE(VIR_ARCH_X86_64, "no-vendor", 0, 0);
     DO_TEST_BASELINE(VIR_ARCH_X86_64, "some-vendors", 0, 0);
 -    DO_TEST_BASELINE(VIR_ARCH_X86_64, "1", 0, 0);
 -    DO_TEST_BASELINE(VIR_ARCH_X86_64, "2", 0, 0);
     DO_TEST_BASELINE(VIR_ARCH_X86_64, "3", 0, 0);
     DO_TEST_BASELINE(VIR_ARCH_X86_64, "3", VIR_CONNECT_BASELINE_CPU_EXPAND_FEATURES, 0);
     DO_TEST_BASELINE(VIR_ARCH_X86_64, "4", 0, 0);
     DO_TEST_BASELINE(VIR_ARCH_X86_64, "4", VIR_CONNECT_BASELINE_CPU_EXPAND_FEATURES, 0);
 -    DO_TEST_BASELINE(VIR_ARCH_X86_64, "5", 0, 0);
 -    DO_TEST_BASELINE(VIR_ARCH_X86_64, "5", VIR_CONNECT_BASELINE_CPU_EXPAND_FEATURES, 0);
     DO_TEST_BASELINE(VIR_ARCH_X86_64, "6", 0, 0);
     DO_TEST_BASELINE(VIR_ARCH_X86_64, "6", VIR_CONNECT_BASELINE_CPU_MIGRATABLE, 0);
 -    DO_TEST_BASELINE(VIR_ARCH_X86_64, "7", 0, 0);
 -    DO_TEST_BASELINE(VIR_ARCH_X86_64, "8", 0, 0);
     DO_TEST_BASELINE(VIR_ARCH_PPC64, "incompatible-vendors", 0, -1);
     DO_TEST_BASELINE(VIR_ARCH_PPC64, "no-vendor", 0, 0);
 diff --git a/tests/cputestdata/x86_64-baseline-1-result.xml b/tests/cputestdata/x86_64-baseline-1-result.xml
 deleted file mode 100644
 index 96c4f43b3d..0000000000
 --- a/tests/cputestdata/x86_64-baseline-1-result.xml
 +++ /dev/null
@@ -1,5 +0,0 @@
 -<cpu mode='custom' match='exact'>
 -  <model fallback='allow'>Conroe</model>
 -  <vendor>Intel</vendor>
 -  <feature policy='disable' name='lahf_lm'/>
 -</cpu>
 diff --git a/tests/cputestdata/x86_64-baseline-1.xml b/tests/cputestdata/x86_64-baseline-1.xml
 deleted file mode 100644
 index 509e6a85d2..0000000000
 --- a/tests/cputestdata/x86_64-baseline-1.xml
 +++ /dev/null
@@ -1,20 +0,0 @@
 -<cpuTest>
 -<cpu>
 -  <arch>x86_64</arch>
 -  <model>Penryn</model>
 -  <vendor>Intel</vendor>
 -  <topology sockets='2' cores='4' threads='1'/>
 -</cpu>
 -<cpu>
 -  <arch>x86_64</arch>
 -  <model>Conroe</model>
 -  <vendor>Intel</vendor>
 -  <topology sockets='1' cores='1' threads='1'/>
 -</cpu>
 -<cpu>
 -  <arch>x86_64</arch>
 -  <model>core2duo</model>
 -  <vendor>Intel</vendor>
 -  <topology sockets='1' cores='1' threads='1'/>
 -</cpu>
 -</cpuTest>
 diff --git a/tests/cputestdata/x86_64-baseline-2-result.xml b/tests/cputestdata/x86_64-baseline-2-result.xml
 deleted file mode 100644
 index a11352d0b1..0000000000
 --- a/tests/cputestdata/x86_64-baseline-2-result.xml
 +++ /dev/null
@@ -1,4 +0,0 @@
 -<cpu mode='custom' match='exact'>
 -  <model fallback='allow'>core2duo</model>
 -  <feature policy='disable' name='nx'/>
 -</cpu>
 diff --git a/tests/cputestdata/x86_64-baseline-2.xml b/tests/cputestdata/x86_64-baseline-2.xml
 deleted file mode 100644
 index 055223fd34..0000000000
 --- a/tests/cputestdata/x86_64-baseline-2.xml
 +++ /dev/null
@@ -1,22 +0,0 @@
 -<cpuTest>
 -<cpu>
 -  <arch>x86_64</arch>
 -  <model>core2duo</model>
 -  <topology sockets='1' cores='2' threads='1'/>
 -</cpu>
 -<cpu>
 -  <arch>x86_64</arch>
 -  <model>pentiumpro</model>
 -  <topology sockets='1' cores='2' threads='1'/>
 -  <feature name='mtrr'/>
 -  <feature name='clflush'/>
 -  <feature name='mca'/>
 -  <feature name='vme'/>
 -  <feature name='pse36'/>
 -  <feature name='pni'/>
 -  <feature name='monitor'/>
 -  <feature name='ssse3'/>
 -  <feature name='lm'/>
 -  <feature name='syscall'/>
 -</cpu>
 -</cpuTest>
 diff --git a/tests/cputestdata/x86_64-baseline-5-expanded.xml b/tests/cputestdata/x86_64-baseline-5-expanded.xml
 deleted file mode 100644
 index 2c1b400150..0000000000
 --- a/tests/cputestdata/x86_64-baseline-5-expanded.xml
 +++ /dev/null
@@ -1,47 +0,0 @@
 -<cpu mode='custom' match='exact'>
 -  <model fallback='allow'>SandyBridge</model>
 -  <vendor>Intel</vendor>
 -  <feature policy='require' name='aes'/>
 -  <feature policy='require' name='apic'/>
 -  <feature policy='require' name='avx'/>
 -  <feature policy='require' name='clflush'/>
 -  <feature policy='require' name='cmov'/>
 -  <feature policy='require' name='cx16'/>
 -  <feature policy='require' name='cx8'/>
 -  <feature policy='require' name='de'/>
 -  <feature policy='require' name='fpu'/>
 -  <feature policy='require' name='fxsr'/>
 -  <feature policy='require' name='hypervisor'/>
 -  <feature policy='require' name='lahf_lm'/>
 -  <feature policy='require' name='lm'/>
 -  <feature policy='require' name='mca'/>
 -  <feature policy='require' name='mce'/>
 -  <feature policy='require' name='mmx'/>
 -  <feature policy='require' name='msr'/>
 -  <feature policy='require' name='mtrr'/>
 -  <feature policy='require' name='nx'/>
 -  <feature policy='require' name='osxsave'/>
 -  <feature policy='require' name='pae'/>
 -  <feature policy='require' name='pat'/>
 -  <feature policy='require' name='pcid'/>
 -  <feature policy='require' name='pclmuldq'/>
 -  <feature policy='require' name='pge'/>
 -  <feature policy='require' name='pni'/>
 -  <feature policy='require' name='popcnt'/>
 -  <feature policy='require' name='pse'/>
 -  <feature policy='require' name='pse36'/>
 -  <feature policy='disable' name='rdtscp'/>
 -  <feature policy='require' name='sep'/>
 -  <feature policy='require' name='ss'/>
 -  <feature policy='require' name='sse'/>
 -  <feature policy='require' name='sse2'/>
 -  <feature policy='require' name='sse4.1'/>
 -  <feature policy='require' name='sse4.2'/>
 -  <feature policy='require' name='ssse3'/>
 -  <feature policy='require' name='syscall'/>
 -  <feature policy='require' name='tsc'/>
 -  <feature policy='require' name='tsc-deadline'/>
 -  <feature policy='require' name='vme'/>
 -  <feature policy='require' name='x2apic'/>
 -  <feature policy='require' name='xsave'/>
 -</cpu>
 diff --git a/tests/cputestdata/x86_64-baseline-5-result.xml b/tests/cputestdata/x86_64-baseline-5-result.xml
 deleted file mode 100644
 index 775a27de2e..0000000000
 --- a/tests/cputestdata/x86_64-baseline-5-result.xml
 +++ /dev/null
@@ -1,10 +0,0 @@
 -<cpu mode='custom' match='exact'>
 -  <model fallback='allow'>SandyBridge</model>
 -  <vendor>Intel</vendor>
 -  <feature policy='require' name='vme'/>
 -  <feature policy='require' name='ss'/>
 -  <feature policy='require' name='pcid'/>
 -  <feature policy='require' name='osxsave'/>
 -  <feature policy='require' name='hypervisor'/>
 -  <feature policy='disable' name='rdtscp'/>
 -</cpu>
 diff --git a/tests/cputestdata/x86_64-baseline-5.xml b/tests/cputestdata/x86_64-baseline-5.xml
 deleted file mode 100644
 index 80cd533ca4..0000000000
 --- a/tests/cputestdata/x86_64-baseline-5.xml
 +++ /dev/null
@@ -1,35 +0,0 @@
 -<cpuTest>
 -<cpu>
 -  <arch>x86_64</arch>
 -  <model>Westmere</model>
 -  <vendor>Intel</vendor>
 -  <topology sockets='4' cores='1' threads='1'/>
 -  <feature name='hypervisor'/>
 -  <feature name='avx'/>
 -  <feature name='osxsave'/>
 -  <feature name='xsave'/>
 -  <feature name='tsc-deadline'/>
 -  <feature name='x2apic'/>
 -  <feature name='pcid'/>
 -  <feature name='pclmuldq'/>
 -  <feature name='ss'/>
 -  <feature name='vme'/>
 -</cpu>
 -<cpu>
 -  <arch>x86_64</arch>
 -  <model>Nehalem</model>
 -  <vendor>Intel</vendor>
 -  <topology sockets='4' cores='1' threads='1'/>
 -  <feature name='aes'/>
 -  <feature name='hypervisor'/>
 -  <feature name='avx'/>
 -  <feature name='osxsave'/>
 -  <feature name='xsave'/>
 -  <feature name='tsc-deadline'/>
 -  <feature name='x2apic'/>
 -  <feature name='pcid'/>
 -  <feature name='pclmuldq'/>
 -  <feature name='ss'/>
 -  <feature name='vme'/>
 -</cpu>
 -</cpuTest>
 diff --git a/tests/cputestdata/x86_64-baseline-7-result.xml b/tests/cputestdata/x86_64-baseline-7-result.xml
 deleted file mode 100644
 index 2af549e77a..0000000000
 --- a/tests/cputestdata/x86_64-baseline-7-result.xml
 +++ /dev/null
@@ -1,4 +0,0 @@
 -<cpu mode='custom' match='exact'>
 -  <model fallback='allow'>Haswell-noTSX</model>
 -  <vendor>Intel</vendor>
 -</cpu>
 diff --git a/tests/cputestdata/x86_64-baseline-7.xml b/tests/cputestdata/x86_64-baseline-7.xml
 deleted file mode 100644
 index b7e61b160c..0000000000
 --- a/tests/cputestdata/x86_64-baseline-7.xml
 +++ /dev/null
@@ -1,24 +0,0 @@
 -<cpuTest>
 -    <cpu>
 -      <arch>x86_64</arch>
 -      <model>SandyBridge</model>
 -      <vendor>Intel</vendor>
 -      <topology sockets='1' cores='2' threads='2'/>
 -      <feature name='invpcid'/>
 -      <feature name='erms'/>
 -      <feature name='bmi2'/>
 -      <feature name='smep'/>
 -      <feature name='avx2'/>
 -      <feature name='bmi1'/>
 -      <feature name='fsgsbase'/>
 -      <feature name='movbe'/>
 -      <feature name='pcid'/>
 -      <feature name='fma'/>
 -    </cpu>
 -    <cpu>
 -      <arch>x86_64</arch>
 -      <model>Haswell-noTSX</model>
 -      <vendor>Intel</vendor>
 -      <topology sockets='1' cores='2' threads='2'/>
 -    </cpu>
 -</cpuTest>
 diff --git a/tests/cputestdata/x86_64-baseline-8-result.xml b/tests/cputestdata/x86_64-baseline-8-result.xml
 deleted file mode 100644
 index 88226b3dab..0000000000
 --- a/tests/cputestdata/x86_64-baseline-8-result.xml
 +++ /dev/null
@@ -1,4 +0,0 @@
 -<cpu mode='custom' match='exact'>
 -  <model fallback='allow'>Broadwell-noTSX</model>
 -  <vendor>Intel</vendor>
 -</cpu>
 diff --git a/tests/cputestdata/x86_64-baseline-8.xml b/tests/cputestdata/x86_64-baseline-8.xml
 deleted file mode 100644
 index f1ee67d542..0000000000
 --- a/tests/cputestdata/x86_64-baseline-8.xml
 +++ /dev/null
@@ -1,28 +0,0 @@
 -<cpuTest>
 -    <cpu>
 -      <arch>x86_64</arch>
 -      <model>SandyBridge</model>
 -      <vendor>Intel</vendor>
 -      <topology sockets='1' cores='2' threads='2'/>
 -      <feature name='invpcid'/>
 -      <feature name='erms'/>
 -      <feature name='bmi2'/>
 -      <feature name='smep'/>
 -      <feature name='avx2'/>
 -      <feature name='bmi1'/>
 -      <feature name='fsgsbase'/>
 -      <feature name='movbe'/>
 -      <feature name='pcid'/>
 -      <feature name='fma'/>
 -      <feature name='3dnowprefetch'/>
 -      <feature name='rdseed'/>
 -      <feature name='adx'/>
 -      <feature name='smap'/>
 -    </cpu>
 -    <cpu>
 -      <arch>x86_64</arch>
 -      <model>Broadwell-noTSX</model>
 -      <vendor>Intel</vendor>
 -      <topology sockets='1' cores='2' threads='2'/>
 -    </cpu>
 -</cpuTest>
 -- 
 2.35.1
--- a/SOURCES/libvirt-cputest-Give-better-names-to-baseline-tests.patch
+++ b/SOURCES/libvirt-cputest-Give-better-names-to-baseline-tests.patch
@ -1,97 +0,0 @@
 From 6cf9cd8f6d9e90eadd58d8a37129e7401876e4e8 Mon Sep 17 00:00:00 2001
 Message-Id: <6cf9cd8f6d9e90eadd58d8a37129e7401876e4e8@dist-git>
 From: Jiri Denemark <jdenemar@redhat.com>
 Date: Wed, 4 May 2022 16:28:03 +0200
 Subject: [PATCH] cputest: Give better names to baseline tests
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 3daa68e26514dc114d71f4c44f7d728e93a53cd0)
 https://bugzilla.redhat.com/show_bug.cgi?id=1851227
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 tests/cputest.c                                      | 12 ++++++------
 ... x86_64-baseline-Westmere+Nehalem-migratable.xml} |  0
 ...l => x86_64-baseline-Westmere+Nehalem-result.xml} |  0
 ...ne-6.xml => x86_64-baseline-Westmere+Nehalem.xml} |  0
 ...ded.xml => x86_64-baseline-features-expanded.xml} |  0
 ...esult.xml => x86_64-baseline-features-result.xml} |  0
 ...4-baseline-4.xml => x86_64-baseline-features.xml} |  0
 ...anded.xml => x86_64-baseline-simple-expanded.xml} |  0
 ...-result.xml => x86_64-baseline-simple-result.xml} |  0
 ..._64-baseline-3.xml => x86_64-baseline-simple.xml} |  0
 10 files changed, 6 insertions(+), 6 deletions(-)
 rename tests/cputestdata/{x86_64-baseline-6-migratable.xml => x86_64-baseline-Westmere+Nehalem-migratable.xml} (100%)
 rename tests/cputestdata/{x86_64-baseline-6-result.xml => x86_64-baseline-Westmere+Nehalem-result.xml} (100%)
 rename tests/cputestdata/{x86_64-baseline-6.xml => x86_64-baseline-Westmere+Nehalem.xml} (100%)
 rename tests/cputestdata/{x86_64-baseline-4-expanded.xml => x86_64-baseline-features-expanded.xml} (100%)
 rename tests/cputestdata/{x86_64-baseline-4-result.xml => x86_64-baseline-features-result.xml} (100%)
 rename tests/cputestdata/{x86_64-baseline-4.xml => x86_64-baseline-features.xml} (100%)
 rename tests/cputestdata/{x86_64-baseline-3-expanded.xml => x86_64-baseline-simple-expanded.xml} (100%)
 rename tests/cputestdata/{x86_64-baseline-3-result.xml => x86_64-baseline-simple-result.xml} (100%)
 rename tests/cputestdata/{x86_64-baseline-3.xml => x86_64-baseline-simple.xml} (100%)
 diff --git a/tests/cputest.c b/tests/cputest.c
 index 20d56836be..b939e20718 100644
 --- a/tests/cputest.c
 +++ b/tests/cputest.c
@@ -1051,12 +1051,12 @@ mymain(void)
     DO_TEST_BASELINE(VIR_ARCH_X86_64, "incompatible-vendors", 0, -1);
     DO_TEST_BASELINE(VIR_ARCH_X86_64, "no-vendor", 0, 0);
     DO_TEST_BASELINE(VIR_ARCH_X86_64, "some-vendors", 0, 0);
 -    DO_TEST_BASELINE(VIR_ARCH_X86_64, "3", 0, 0);
 -    DO_TEST_BASELINE(VIR_ARCH_X86_64, "3", VIR_CONNECT_BASELINE_CPU_EXPAND_FEATURES, 0);
 -    DO_TEST_BASELINE(VIR_ARCH_X86_64, "4", 0, 0);
 -    DO_TEST_BASELINE(VIR_ARCH_X86_64, "4", VIR_CONNECT_BASELINE_CPU_EXPAND_FEATURES, 0);
 -    DO_TEST_BASELINE(VIR_ARCH_X86_64, "6", 0, 0);
 -    DO_TEST_BASELINE(VIR_ARCH_X86_64, "6", VIR_CONNECT_BASELINE_CPU_MIGRATABLE, 0);
 +    DO_TEST_BASELINE(VIR_ARCH_X86_64, "simple", 0, 0);
 +    DO_TEST_BASELINE(VIR_ARCH_X86_64, "simple", VIR_CONNECT_BASELINE_CPU_EXPAND_FEATURES, 0);
 +    DO_TEST_BASELINE(VIR_ARCH_X86_64, "features", 0, 0);
 +    DO_TEST_BASELINE(VIR_ARCH_X86_64, "features", VIR_CONNECT_BASELINE_CPU_EXPAND_FEATURES, 0);
 +    DO_TEST_BASELINE(VIR_ARCH_X86_64, "Westmere+Nehalem", 0, 0);
 +    DO_TEST_BASELINE(VIR_ARCH_X86_64, "Westmere+Nehalem", VIR_CONNECT_BASELINE_CPU_MIGRATABLE, 0);
     DO_TEST_BASELINE(VIR_ARCH_PPC64, "incompatible-vendors", 0, -1);
     DO_TEST_BASELINE(VIR_ARCH_PPC64, "no-vendor", 0, 0);
 diff --git a/tests/cputestdata/x86_64-baseline-6-migratable.xml b/tests/cputestdata/x86_64-baseline-Westmere+Nehalem-migratable.xml
 similarity index 100%
 rename from tests/cputestdata/x86_64-baseline-6-migratable.xml
 rename to tests/cputestdata/x86_64-baseline-Westmere+Nehalem-migratable.xml
 diff --git a/tests/cputestdata/x86_64-baseline-6-result.xml b/tests/cputestdata/x86_64-baseline-Westmere+Nehalem-result.xml
 similarity index 100%
 rename from tests/cputestdata/x86_64-baseline-6-result.xml
 rename to tests/cputestdata/x86_64-baseline-Westmere+Nehalem-result.xml
 diff --git a/tests/cputestdata/x86_64-baseline-6.xml b/tests/cputestdata/x86_64-baseline-Westmere+Nehalem.xml
 similarity index 100%
 rename from tests/cputestdata/x86_64-baseline-6.xml
 rename to tests/cputestdata/x86_64-baseline-Westmere+Nehalem.xml
 diff --git a/tests/cputestdata/x86_64-baseline-4-expanded.xml b/tests/cputestdata/x86_64-baseline-features-expanded.xml
 similarity index 100%
 rename from tests/cputestdata/x86_64-baseline-4-expanded.xml
 rename to tests/cputestdata/x86_64-baseline-features-expanded.xml
 diff --git a/tests/cputestdata/x86_64-baseline-4-result.xml b/tests/cputestdata/x86_64-baseline-features-result.xml
 similarity index 100%
 rename from tests/cputestdata/x86_64-baseline-4-result.xml
 rename to tests/cputestdata/x86_64-baseline-features-result.xml
 diff --git a/tests/cputestdata/x86_64-baseline-4.xml b/tests/cputestdata/x86_64-baseline-features.xml
 similarity index 100%
 rename from tests/cputestdata/x86_64-baseline-4.xml
 rename to tests/cputestdata/x86_64-baseline-features.xml
 diff --git a/tests/cputestdata/x86_64-baseline-3-expanded.xml b/tests/cputestdata/x86_64-baseline-simple-expanded.xml
 similarity index 100%
 rename from tests/cputestdata/x86_64-baseline-3-expanded.xml
 rename to tests/cputestdata/x86_64-baseline-simple-expanded.xml
 diff --git a/tests/cputestdata/x86_64-baseline-3-result.xml b/tests/cputestdata/x86_64-baseline-simple-result.xml
 similarity index 100%
 rename from tests/cputestdata/x86_64-baseline-3-result.xml
 rename to tests/cputestdata/x86_64-baseline-simple-result.xml
 diff --git a/tests/cputestdata/x86_64-baseline-3.xml b/tests/cputestdata/x86_64-baseline-simple.xml
 similarity index 100%
 rename from tests/cputestdata/x86_64-baseline-3.xml
 rename to tests/cputestdata/x86_64-baseline-simple.xml
 -- 
 2.35.1
--- a/SOURCES/libvirt-domain_validate-Split-out-validation-of-disk-startup-policy.patch
+++ b/SOURCES/libvirt-domain_validate-Split-out-validation-of-disk-startup-policy.patch
@ -1,111 +0,0 @@
 From 296343c5a950668d790f9cd5ebd7b466e8156d03 Mon Sep 17 00:00:00 2001
 Message-Id: <296343c5a950668d790f9cd5ebd7b466e8156d03@dist-git>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Tue, 14 Jun 2022 13:23:29 +0200
 Subject: [PATCH] domain_validate: Split out validation of disk startup policy
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Move the code into 'virDomainDiskDefValidateStartupPolicy' which will be
 later reused in the qemu driver.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit 3603a18bcec18842cedecbd8329723062b87795c)
 https://bugzilla.redhat.com/show_bug.cgi?id=2095758
 ---
 src/conf/domain_validate.c | 45 ++++++++++++++++++++++++--------------
 src/conf/domain_validate.h |  2 ++
 src/libvirt_private.syms   |  1 +
 3 files changed, 31 insertions(+), 17 deletions(-)
 diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c
 index 452742e67c..bfff7339ef 100644
 --- a/src/conf/domain_validate.c
 +++ b/src/conf/domain_validate.c
@@ -598,6 +598,32 @@ virDomainDiskDefSourceLUNValidate(const virStorageSource *src)
 }
 +int
 +virDomainDiskDefValidateStartupPolicy(const virDomainDiskDef *disk)
 +{
 +    if (disk->startupPolicy == VIR_DOMAIN_STARTUP_POLICY_DEFAULT)
 +        return 0;
 +
 +    if (disk->src->type == VIR_STORAGE_TYPE_NETWORK) {
 +        virReportError(VIR_ERR_XML_ERROR,
 +                       _("disk startupPolicy '%s' is not allowed for disk of '%s' type"),
 +                       virDomainStartupPolicyTypeToString(disk->startupPolicy),
 +                       virStorageTypeToString(disk->src->type));
 +        return -1;
 +    }
 +
 +    if (disk->device != VIR_DOMAIN_DISK_DEVICE_CDROM &&
 +        disk->device != VIR_DOMAIN_DISK_DEVICE_FLOPPY &&
 +        disk->startupPolicy == VIR_DOMAIN_STARTUP_POLICY_REQUISITE) {
 +        virReportError(VIR_ERR_XML_ERROR, "%s",
 +                       _("disk startupPolicy 'requisite' is allowed only for cdrom or floppy"));
 +        return -1;
 +    }
 +
 +    return 0;
 +}
 +
 +
 static int
 virDomainDiskDefValidate(const virDomainDef *def,
                          const virDomainDiskDef *disk)
@@ -775,23 +801,8 @@ virDomainDiskDefValidate(const virDomainDef *def,
         return -1;
     }
 -    if (disk->startupPolicy != VIR_DOMAIN_STARTUP_POLICY_DEFAULT) {
 -        if (disk->src->type == VIR_STORAGE_TYPE_NETWORK) {
 -            virReportError(VIR_ERR_XML_ERROR,
 -                           _("disk startupPolicy '%s' is not allowed for disk of '%s' type"),
 -                           virDomainStartupPolicyTypeToString(disk->startupPolicy),
 -                           virStorageTypeToString(disk->src->type));
 -            return -1;
 -        }
 -
 -        if (disk->device != VIR_DOMAIN_DISK_DEVICE_CDROM &&
 -            disk->device != VIR_DOMAIN_DISK_DEVICE_FLOPPY &&
 -            disk->startupPolicy == VIR_DOMAIN_STARTUP_POLICY_REQUISITE) {
 -            virReportError(VIR_ERR_XML_ERROR, "%s",
 -                           _("disk startupPolicy 'requisite' is allowed only for cdrom or floppy"));
 -            return -1;
 -        }
 -    }
 +    if (virDomainDiskDefValidateStartupPolicy(disk) < 0)
 +        return -1;
     if (disk->wwn && !virValidateWWN(disk->wwn))
         return -1;
 diff --git a/src/conf/domain_validate.h b/src/conf/domain_validate.h
 index 430d61fd3c..07b99195e3 100644
 --- a/src/conf/domain_validate.h
 +++ b/src/conf/domain_validate.h
@@ -41,4 +41,6 @@ int virDomainDeviceDefValidate(const virDomainDeviceDef *dev,
 int virDomainDiskDefValidateSource(const virStorageSource *src);
 +int virDomainDiskDefValidateStartupPolicy(const virDomainDiskDef *disk);
 +
 int virDomainDiskDefSourceLUNValidate(const virStorageSource *src);
 diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
 index 2c42e2a5e8..5b7a056151 100644
 --- a/src/libvirt_private.syms
 +++ b/src/libvirt_private.syms
@@ -777,6 +777,7 @@ virDomainActualNetDefValidate;
 virDomainDefValidate;
 virDomainDeviceValidateAliasForHotplug;
 virDomainDiskDefSourceLUNValidate;
 +virDomainDiskDefValidateStartupPolicy;
 # conf/interface_conf.h
 -- 
 2.35.1
--- a/SOURCES/libvirt-lib-Set-up-cpuset-controller-for-restrictive-numatune.patch
+++ b/SOURCES/libvirt-lib-Set-up-cpuset-controller-for-restrictive-numatune.patch
@ -1,77 +0,0 @@
 From 08ddc711a2e6d94a0fce55fec8e012a434655d2c Mon Sep 17 00:00:00 2001
 Message-ID: <08ddc711a2e6d94a0fce55fec8e012a434655d2c.1690812875.git.jdenemar@redhat.com>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Fri, 1 Apr 2022 14:30:05 +0200
 Subject: [PATCH] lib: Set up cpuset controller for restrictive numatune
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The aim of 'restrictive' numatune mode is to rely solely on
 CGroups to have QEMU running on configured NUMA nodes.  However,
 we were never setting the cpuset controller when a domain was
 starting up. We are doing so only when
 virDomainSetNumaParameters() is called (aka live pinning).
 This is obviously wrong. Fortunately, fix is simple as
 'restrictive' is similar to 'strict' - every location where
 VIR_DOMAIN_NUMATUNE_MEM_STRICT occurs can be audited and
 VIR_DOMAIN_NUMATUNE_MEM_RESTRICTIVE case can be added.
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2070380
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit 629282d8845407c1aff9a26f5dc026e15121f8cd)
 Conflicts:
 - src/ch/ch_process.c: The CH driver diverged because it's
  unsupported downstream. Just drop the conflicting hunk from
  there.
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2223464
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/lxc/lxc_controller.c | 3 ++-
 src/qemu/qemu_process.c  | 6 ++++--
 2 files changed, 6 insertions(+), 3 deletions(-)
 diff --git a/src/lxc/lxc_controller.c b/src/lxc/lxc_controller.c
 index 3c930eaacd..6fd8373256 100644
 --- a/src/lxc/lxc_controller.c
 +++ b/src/lxc/lxc_controller.c
@@ -812,7 +812,8 @@ static int virLXCControllerSetupResourceLimits(virLXCController *ctrl)
     virDomainNumatuneMemMode mode;
     if (virDomainNumatuneGetMode(ctrl->def->numa, -1, &mode) == 0) {
 -        if (mode == VIR_DOMAIN_NUMATUNE_MEM_STRICT &&
 +        if ((mode == VIR_DOMAIN_NUMATUNE_MEM_STRICT ||
 +             mode == VIR_DOMAIN_NUMATUNE_MEM_RESTRICTIVE) &&
             virCgroupControllerAvailable(VIR_CGROUP_CONTROLLER_CPUSET)) {
             /* Use virNuma* API iff necessary. Once set and child is exec()-ed,
              * there's no way for us to change it. Rely on cgroups (if available
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index 0fb665bc82..73d54f01cd 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -2645,7 +2645,8 @@ qemuProcessSetupPid(virDomainObj *vm,
         virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_CPUSET)) {
         if (virDomainNumatuneGetMode(vm->def->numa, -1, &mem_mode) == 0 &&
 -            mem_mode == VIR_DOMAIN_NUMATUNE_MEM_STRICT &&
 +            (mem_mode == VIR_DOMAIN_NUMATUNE_MEM_STRICT ||
 +             mem_mode == VIR_DOMAIN_NUMATUNE_MEM_RESTRICTIVE) &&
             virDomainNumatuneMaybeFormatNodeset(vm->def->numa,
                                                 priv->autoNodeset,
                                                 &mem_mask, -1) < 0)
@@ -3162,7 +3163,8 @@ static int qemuProcessHook(void *data)
         goto cleanup;
     if (virDomainNumatuneGetMode(h->vm->def->numa, -1, &mode) == 0) {
 -        if (mode == VIR_DOMAIN_NUMATUNE_MEM_STRICT &&
 +        if ((mode == VIR_DOMAIN_NUMATUNE_MEM_STRICT ||
 +             mode == VIR_DOMAIN_NUMATUNE_MEM_RESTRICTIVE) &&
             h->cfg->cgroupControllers & (1 << VIR_CGROUP_CONTROLLER_CPUSET) &&
             virCgroupControllerAvailable(VIR_CGROUP_CONTROLLER_CPUSET)) {
             /* Use virNuma* API iff necessary. Once set and child is exec()-ed,
 -- 
 2.41.0
--- a/SOURCES/libvirt-node_device-Don-t-leak-error-message-buffer-from-virMdevctlListDefined-Active.patch
+++ b/SOURCES/libvirt-node_device-Don-t-leak-error-message-buffer-from-virMdevctlListDefined-Active.patch
@ -0,0 +1,79 @@
 From f158b6573ac39bdd1ba36c3900e65afffe57f3ca Mon Sep 17 00:00:00 2001
 Message-ID: <f158b6573ac39bdd1ba36c3900e65afffe57f3ca.1689974710.git.jdenemar@redhat.com>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Wed, 19 Jul 2023 15:22:22 +0200
 Subject: [PATCH] node_device: Don't leak error message buffer from
 virMdevctlListDefined|Active
 nodeDeviceUpdateMediatedDevices invokes virMdevctlListDefined and
 virMdevctlListActive both of which were passed the same 'errmsg' buffer.
 Since virCommandSetErrorBuffer() always allocates the error buffer one
 of them was leaked.
 Fix it by populating the 'errmsg' buffer only on failure of
 virMdevctlListActive|Defined which invoke the command.
 Add a comment to nodeDeviceGetMdevctlListCommand reminding how
 virCommandSetErrorBuffer() works.
 Fixes: 44a0f2f0c8f
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2143158
 (cherry picked from commit 7ca777cc09242cb3a30b12d5e0e396c6aaf1a5e7)
 Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
 ---
 src/node_device/node_device_driver.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)
 diff --git a/src/node_device/node_device_driver.c b/src/node_device/node_device_driver.c
 index 5dc45ddbb4..2ef9197adc 100644
 --- a/src/node_device/node_device_driver.c
 +++ b/src/node_device/node_device_driver.c
@@ -1044,6 +1044,15 @@ virMdevctlSetAutostart(virNodeDeviceDef *def, bool autostart, char **errmsg)
 }
 +/**
 + * nodeDeviceGetMdevctlListCommand:
 + * @defined: list mdevctl entries with persistent config
 + * @output: filled with the output of mdevctl once invoked
 + * @errmsg: always allocated, optionally filled with error from 'mdevctl'
 + *
 + * Prepares a virCommand structure to invoke 'mdevctl' caller is responsible to
 + * free the buffers which are filled by the virCommand infrastructure.
 + */
 virCommand*
 nodeDeviceGetMdevctlListCommand(bool defined,
                                 char **output,
@@ -1624,9 +1633,11 @@ virMdevctlListDefined(virNodeDeviceDef ***devs, char **errmsg)
 {
     int status;
     g_autofree char *output = NULL;
 -    g_autoptr(virCommand) cmd = nodeDeviceGetMdevctlListCommand(true, &output, errmsg);
 +    g_autofree char *errbuf = NULL;
 +    g_autoptr(virCommand) cmd = nodeDeviceGetMdevctlListCommand(true, &output, &errbuf);
     if (virCommandRun(cmd, &status) < 0 || status != 0) {
 +        *errmsg = g_steal_pointer(&errbuf);
         return -1;
     }
@@ -1642,9 +1653,11 @@ virMdevctlListActive(virNodeDeviceDef ***devs, char **errmsg)
 {
     int status;
     g_autofree char *output = NULL;
 -    g_autoptr(virCommand) cmd = nodeDeviceGetMdevctlListCommand(false, &output, errmsg);
 +    g_autofree char *errbuf = NULL;
 +    g_autoptr(virCommand) cmd = nodeDeviceGetMdevctlListCommand(false, &output, &errbuf);
     if (virCommandRun(cmd, &status) < 0 || status != 0) {
 +        *errmsg = g_steal_pointer(&errbuf);
         return -1;
     }
 -- 
 2.41.0
--- a/SOURCES/libvirt-node_device-Rework-udevKludgeStorageType.patch
+++ b/SOURCES/libvirt-node_device-Rework-udevKludgeStorageType.patch
@ -1,84 +0,0 @@
 From 71a79a215d278d83f3cd3da330e0378209983b6b Mon Sep 17 00:00:00 2001
 Message-Id: <71a79a215d278d83f3cd3da330e0378209983b6b@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Wed, 26 Jan 2022 14:00:13 +0100
 Subject: [PATCH] node_device: Rework udevKludgeStorageType()
 The udevKludgeStorageType() function looks at devlink name
 (/dev/XXX) and guesses the type of the (storage) device using a
 series of STRPREFIX() calls. Well those can be turn into an array
 and a for() loop, especially if we are about to add a new case
 (in the next commit).
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Peter Krempa <pkrempa@redhat.com>
 (cherry picked from commit ec9e2adb961f2e1a121f47e7985142e827f3347b)
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2056673
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/node_device/node_device_udev.c | 43 ++++++++++++++++--------------
 1 file changed, 23 insertions(+), 20 deletions(-)
 diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c
 index cd1722f934..dd18401e78 100644
 --- a/src/node_device/node_device_udev.c
 +++ b/src/node_device/node_device_udev.c
@@ -890,32 +890,35 @@ udevProcessDASD(struct udev_device *device,
 static int
 udevKludgeStorageType(virNodeDeviceDef *def)
 {
 +    size_t i;
 +    const struct {
 +        const char *prefix;
 +        const char *subst;
 +    } fixups[] = {
 +        /* virtio disk */
 +        { "/dev/vd", "disk" },
 +
 +        /* For Direct Access Storage Devices (DASDs) there are
 +         * currently no identifiers in udev besides ID_PATH. Since
 +         * ID_TYPE=disk does not exist on DASDs they fall through
 +         * the udevProcessStorage detection logic. */
 +        { "/dev/dasd", "dasd" },
 +    };
 +
     VIR_DEBUG("Could not find definitive storage type for device "
               "with sysfs path '%s', trying to guess it",
               def->sysfs_path);
 -    /* virtio disk */
 -    if (STRPREFIX(def->caps->data.storage.block, "/dev/vd")) {
 -        def->caps->data.storage.drive_type = g_strdup("disk");
 -        VIR_DEBUG("Found storage type '%s' for device "
 -                  "with sysfs path '%s'",
 -                  def->caps->data.storage.drive_type,
 -                  def->sysfs_path);
 -        return 0;
 +    for (i = 0; i < G_N_ELEMENTS(fixups); i++) {
 +        if (STRPREFIX(def->caps->data.storage.block, fixups[i].prefix)) {
 +            def->caps->data.storage.drive_type = g_strdup(fixups[i].subst);
 +            VIR_DEBUG("Found storage type '%s' for device with sysfs path '%s'",
 +                      def->caps->data.storage.drive_type,
 +                      def->sysfs_path);
 +            return 0;
 +        }
     }
 -    /* For Direct Access Storage Devices (DASDs) there are
 -     * currently no identifiers in udev besides ID_PATH. Since
 -     * ID_TYPE=disk does not exist on DASDs they fall through
 -     * the udevProcessStorage detection logic. */
 -    if (STRPREFIX(def->caps->data.storage.block, "/dev/dasd")) {
 -        def->caps->data.storage.drive_type = g_strdup("dasd");
 -        VIR_DEBUG("Found storage type '%s' for device "
 -                  "with sysfs path '%s'",
 -                  def->caps->data.storage.drive_type,
 -                  def->sysfs_path);
 -        return 0;
 -    }
     VIR_DEBUG("Could not determine storage type "
               "for device with sysfs path '%s'", def->sysfs_path);
     return -1;
 -- 
 2.35.1
--- a/SOURCES/libvirt-node_device-Treat-NVMe-disks-as-regular-disks.patch
+++ b/SOURCES/libvirt-node_device-Treat-NVMe-disks-as-regular-disks.patch
@ -1,39 +0,0 @@
 From c04c7a986bd3514730e4169bf1a70bbec1fda006 Mon Sep 17 00:00:00 2001
 Message-Id: <c04c7a986bd3514730e4169bf1a70bbec1fda006@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Wed, 26 Jan 2022 13:47:33 +0100
 Subject: [PATCH] node_device: Treat NVMe disks as regular disks
 Unfortunately, udev doesn't set ID_TYPE attribute for NVMe disks,
 therefore we have to add another case into udevKludgeStorageType()
 to treat /dev/nvme* devlinks as any other disk.
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2045953
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Peter Krempa <pkrempa@redhat.com>
 (cherry picked from commit f103976ff34a52298df1810d82ececa3e7da4291)
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2056673
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/node_device/node_device_udev.c | 5 +++++
 1 file changed, 5 insertions(+)
 diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c
 index dd18401e78..a9e8bf10da 100644
 --- a/src/node_device/node_device_udev.c
 +++ b/src/node_device/node_device_udev.c
@@ -903,6 +903,11 @@ udevKludgeStorageType(virNodeDeviceDef *def)
          * ID_TYPE=disk does not exist on DASDs they fall through
          * the udevProcessStorage detection logic. */
         { "/dev/dasd", "dasd" },
 +
 +        /* NVMe disk. While strictly speaking /dev/nvme is a
 +         * controller not a disk, this function is called if and
 +         * only if @def is of VIR_NODE_DEV_CAP_STORAGE type. */
 +        { "/dev/nvme", "disk" },
     };
     VIR_DEBUG("Could not find definitive storage type for device "
 -- 
 2.35.1
--- a/SOURCES/libvirt-node_device_conf-Avoid-memleak-in-virNodeDeviceGetPCIVPDDynamicCap.patch
+++ b/SOURCES/libvirt-node_device_conf-Avoid-memleak-in-virNodeDeviceGetPCIVPDDynamicCap.patch
@ -1,52 +0,0 @@
 From 989a569c9c9da0fbf89aab7f292669366b2503f1 Mon Sep 17 00:00:00 2001
 Message-Id: <989a569c9c9da0fbf89aab7f292669366b2503f1@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Wed, 30 Nov 2022 14:53:21 +0100
 Subject: [PATCH] node_device_conf: Avoid memleak in
 virNodeDeviceGetPCIVPDDynamicCap()
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The virNodeDeviceGetPCIVPDDynamicCap() function is called from
 virNodeDeviceGetPCIDynamicCaps() and therefore has to be a wee
 bit more clever about adding VPD capability. Namely, it has to
 remove the old one before adding a new one. This is how other
 functions called from virNodeDeviceGetPCIDynamicCaps() behave
 as well.
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2143235
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Peter Krempa <pkrempa@redhat.com>
 (cherry picked from commit 64d32118540aca3d42bc5ee21c8b780cafe04bfa)
 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2023-2700
 Signed-off-by: Ján Tomko <jtomko@redhat.com>
 ---
 src/conf/node_device_conf.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
 diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c
 index 16b9497faf..eee94a3900 100644
 --- a/src/conf/node_device_conf.c
 +++ b/src/conf/node_device_conf.c
@@ -3100,6 +3100,9 @@ virNodeDeviceGetPCIVPDDynamicCap(virNodeDevCapPCIDev *devCapPCIDev)
     virPCIDeviceAddress devAddr;
     g_autoptr(virPCIVPDResource) res = NULL;
 +    g_clear_pointer(&devCapPCIDev->vpd, virPCIVPDResourceFree);
 +    devCapPCIDev->flags &= ~VIR_NODE_DEV_CAP_FLAG_PCI_VPD;
 +
     devAddr.domain = devCapPCIDev->domain;
     devAddr.bus = devCapPCIDev->bus;
     devAddr.slot = devCapPCIDev->slot;
@@ -3113,8 +3116,6 @@ virNodeDeviceGetPCIVPDDynamicCap(virNodeDevCapPCIDev *devCapPCIDev)
         if ((res = virPCIDeviceGetVPD(pciDev))) {
             devCapPCIDev->flags |= VIR_NODE_DEV_CAP_FLAG_PCI_VPD;
             devCapPCIDev->vpd = g_steal_pointer(&res);
 -        } else {
 -            virPCIVPDResourceFree(g_steal_pointer(&devCapPCIDev->vpd));
         }
     }
     return 0;
 -- 
 2.40.1
--- a/SOURCES/libvirt-nodedev-add-optional-device-address-of-channel-device-to-css-device.patch
+++ b/SOURCES/libvirt-nodedev-add-optional-device-address-of-channel-device-to-css-device.patch
@ -1,151 +0,0 @@
 From 5921eeddf0a284ccbec04896901c9bd4177de6dd Mon Sep 17 00:00:00 2001
 Message-Id: <5921eeddf0a284ccbec04896901c9bd4177de6dd@dist-git>
 From: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Date: Fri, 13 May 2022 12:31:15 +0200
 Subject: [PATCH] nodedev: add optional device address of channel device to css
 device
 Add the new introduced sysfs attribute dev_busid which provides the address
 of the device in the subchannel independent from the bound device driver.
 It is added if available in the sysfs as optional channel_dev_addr element into
 the css device capabilty providing the ccw deivce address attributes cssid,
 ssid and devno.
 Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 122b975e4004c83b6fc442ec6cdfd71eb5b55cc4)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 docs/schemas/nodedev.rng           |  5 +++++
 src/conf/node_device_conf.c        | 28 ++++++++++++++++++++++++++++
 src/conf/node_device_conf.h        |  2 ++
 src/node_device/node_device_udev.c |  8 ++++++++
 4 files changed, 43 insertions(+)
 diff --git a/docs/schemas/nodedev.rng b/docs/schemas/nodedev.rng
 index 29515d2d7e..43f1abc247 100644
 --- a/docs/schemas/nodedev.rng
 +++ b/docs/schemas/nodedev.rng
@@ -677,6 +677,11 @@
       <value>css</value>
     </attribute>
     <ref name="capccwaddress"/>
 +    <optional>
 +      <element name="channel_dev_addr">
 +        <ref name="capccwaddress"/>
 +      </element>
 +    </optional>
     <optional>
       <ref name="mdev_types"/>
     </optional>
 diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c
 index fcb5be24e1..16b9497faf 100644
 --- a/src/conf/node_device_conf.c
 +++ b/src/conf/node_device_conf.c
@@ -643,6 +643,17 @@ virNodeDeviceCapCSSDefFormat(virBuffer *buf,
     virNodeDeviceCapCCWDefFormat(buf, data);
 +    if (ccw_dev.channel_dev_addr) {
 +        virCCWDeviceAddress *ccw = ccw_dev.channel_dev_addr;
 +        virBufferAddLit(buf, "<channel_dev_addr>\n");
 +        virBufferAdjustIndent(buf, 2);
 +        virBufferAsprintf(buf, "<cssid>0x%x</cssid>\n", ccw->cssid);
 +        virBufferAsprintf(buf, "<ssid>0x%x</ssid>\n", ccw->ssid);
 +        virBufferAsprintf(buf, "<devno>0x%04x</devno>\n", ccw->devno);
 +        virBufferAdjustIndent(buf, -2);
 +        virBufferAddLit(buf, "</channel_dev_addr>\n");
 +    }
 +
     if (ccw_dev.flags & VIR_NODE_DEV_CAP_FLAG_CSS_MDEV)
         virNodeDeviceCapMdevTypesFormat(buf,
                                         ccw_dev.mdev_types,
@@ -1255,6 +1266,7 @@ virNodeDevCapCSSParseXML(xmlXPathContextPtr ctxt,
     g_autofree xmlNodePtr *nodes = NULL;
     int n = 0;
     size_t i = 0;
 +    xmlNodePtr channel_ddno = NULL;
     ctxt->node = node;
@@ -1269,6 +1281,21 @@ virNodeDevCapCSSParseXML(xmlXPathContextPtr ctxt,
             return -1;
     }
 +    /* channel_dev_addr is optional */
 +    if ((channel_ddno = virXPathNode("./channel_dev_addr[1]", ctxt))) {
 +        g_autofree virCCWDeviceAddress *channel_dev = NULL;
 +
 +        channel_dev = g_new0(virCCWDeviceAddress, 1);
 +
 +        if (virNodeDevCCWDeviceAddressParseXML(ctxt,
 +                                               channel_ddno,
 +                                               def->name,
 +                                               channel_dev) < 0)
 +            return -1;
 +
 +        ccw_dev->channel_dev_addr = g_steal_pointer(&channel_dev);
 +    }
 +
     return 0;
 }
@@ -2637,6 +2664,7 @@ virNodeDevCapsDefFree(virNodeDevCapsDef *caps)
         for (i = 0; i < data->ccw_dev.nmdev_types; i++)
             virMediatedDeviceTypeFree(data->ccw_dev.mdev_types[i]);
         g_free(data->ccw_dev.mdev_types);
 +        g_free(data->ccw_dev.channel_dev_addr);
         break;
     case VIR_NODE_DEV_CAP_AP_MATRIX:
         g_free(data->ap_matrix.addr);
 diff --git a/src/conf/node_device_conf.h b/src/conf/node_device_conf.h
 index e4d1f67d53..d1751ed874 100644
 --- a/src/conf/node_device_conf.h
 +++ b/src/conf/node_device_conf.h
@@ -24,6 +24,7 @@
 #include "internal.h"
 #include "virbitmap.h"
 +#include "virccw.h"
 #include "virpcivpd.h"
 #include "virscsihost.h"
 #include "virpci.h"
@@ -279,6 +280,7 @@ struct _virNodeDevCapCCW {
     unsigned int flags; /* enum virNodeDevCCWCapFlags */
     virMediatedDeviceType **mdev_types;
     size_t nmdev_types;
 +    virCCWDeviceAddress *channel_dev_addr;
 };
 typedef struct _virNodeDevCapVDPA virNodeDevCapVDPA;
 diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c
 index ffcb3e8640..611a2592ca 100644
 --- a/src/node_device/node_device_udev.c
 +++ b/src/node_device/node_device_udev.c
@@ -1128,6 +1128,8 @@ static int
 udevProcessCSS(struct udev_device *device,
                virNodeDeviceDef *def)
 {
 +    g_autofree char *dev_busid = NULL;
 +
     /* only process IO subchannel and vfio-ccw devices to keep the list sane */
     if (!def->driver ||
         (STRNEQ(def->driver, "io_subchannel") &&
@@ -1139,6 +1141,12 @@ udevProcessCSS(struct udev_device *device,
     udevGenerateDeviceName(device, def, NULL);
 +    /* process optional channel devices information */
 +    udevGetStringSysfsAttr(device, "dev_busid", &dev_busid);
 +
 +    if (dev_busid != NULL)
 +        def->caps->data.ccw_dev.channel_dev_addr = virCCWDeviceAddressFromString(dev_busid);
 +
     if (virNodeDeviceGetCSSDynamicCaps(def->sysfs_path, &def->caps->data.ccw_dev) < 0)
         return -1;
 -- 
 2.39.1
--- a/SOURCES/libvirt-nodedev-add-tests-for-optional-device-address-to-css-device.patch
+++ b/SOURCES/libvirt-nodedev-add-tests-for-optional-device-address-to-css-device.patch
@ -1,149 +0,0 @@
 From ea4976de7bccfe8016950d040629a6818a58db4e Mon Sep 17 00:00:00 2001
 Message-Id: <ea4976de7bccfe8016950d040629a6818a58db4e@dist-git>
 From: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Date: Fri, 13 May 2022 12:31:16 +0200
 Subject: [PATCH] nodedev: add tests for optional device address to css device
 Add nodedev schema parsing and format tests for the optional new device
 address on the css devices.
 Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 127fda5e84790af2c5a16b61a87e339391cccb3b)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 .../css_0_0_10000-invalid.xml                 | 10 +++++++++
 ...s_0_0_fffe_mdev_types_channel_dev_addr.xml | 22 +++++++++++++++++++
 .../css_0_0_ffff_channel_dev_addr-invalid.xml | 15 +++++++++++++
 .../css_0_0_ffff_channel_dev_addr.xml         | 15 +++++++++++++
 ...s_0_0_fffe_mdev_types_channel_dev_addr.xml |  1 +
 .../css_0_0_ffff_channel_dev_addr.xml         |  1 +
 tests/nodedevxml2xmltest.c                    |  2 ++
 7 files changed, 66 insertions(+)
 create mode 100644 tests/nodedevschemadata/css_0_0_10000-invalid.xml
 create mode 100644 tests/nodedevschemadata/css_0_0_fffe_mdev_types_channel_dev_addr.xml
 create mode 100644 tests/nodedevschemadata/css_0_0_ffff_channel_dev_addr-invalid.xml
 create mode 100644 tests/nodedevschemadata/css_0_0_ffff_channel_dev_addr.xml
 create mode 120000 tests/nodedevxml2xmlout/css_0_0_fffe_mdev_types_channel_dev_addr.xml
 create mode 120000 tests/nodedevxml2xmlout/css_0_0_ffff_channel_dev_addr.xml
 diff --git a/tests/nodedevschemadata/css_0_0_10000-invalid.xml b/tests/nodedevschemadata/css_0_0_10000-invalid.xml
 new file mode 100644
 index 0000000000..740bb489a7
 --- /dev/null
 +++ b/tests/nodedevschemadata/css_0_0_10000-invalid.xml
@@ -0,0 +1,10 @@
 +<device>
 +  <name>css_0_0_10000</name>
 +  <path>/sys/devices/css0/0.0.10000</path>
 +  <parent>computer</parent>
 +  <capability type='css'>
 +    <cssid>0x0</cssid>
 +    <ssid>0x0</ssid>
 +    <devno>0x10000</devno>
 +  </capability>
 +</device>
 diff --git a/tests/nodedevschemadata/css_0_0_fffe_mdev_types_channel_dev_addr.xml b/tests/nodedevschemadata/css_0_0_fffe_mdev_types_channel_dev_addr.xml
 new file mode 100644
 index 0000000000..198dcb0cb0
 --- /dev/null
 +++ b/tests/nodedevschemadata/css_0_0_fffe_mdev_types_channel_dev_addr.xml
@@ -0,0 +1,22 @@
 +<device>
 +  <name>css_0_0_fffe</name>
 +  <path>/sys/devices/css0/0.0.fffe</path>
 +  <parent>computer</parent>
 +  <capability type='css'>
 +    <cssid>0x0</cssid>
 +    <ssid>0x0</ssid>
 +    <devno>0xfffe</devno>
 +    <channel_dev_addr>
 +      <cssid>0x0</cssid>
 +      <ssid>0x0</ssid>
 +      <devno>0x0815</devno>
 +    </channel_dev_addr>
 +    <capability type='mdev_types'>
 +      <type id='vfio_ccw-io'>
 +        <name>I/O subchannel (Non-QDIO)</name>
 +        <deviceAPI>vfio-ccw</deviceAPI>
 +        <availableInstances>1</availableInstances>
 +      </type>
 +    </capability>
 +  </capability>
 +</device>
 diff --git a/tests/nodedevschemadata/css_0_0_ffff_channel_dev_addr-invalid.xml b/tests/nodedevschemadata/css_0_0_ffff_channel_dev_addr-invalid.xml
 new file mode 100644
 index 0000000000..3f2c5558c7
 --- /dev/null
 +++ b/tests/nodedevschemadata/css_0_0_ffff_channel_dev_addr-invalid.xml
@@ -0,0 +1,15 @@
 +<device>
 +  <name>css_0_0_ffff</name>
 +  <path>/sys/devices/css0/0.0.ffff</path>
 +  <parent>computer</parent>
 +  <capability type='css'>
 +    <cssid>0x0</cssid>
 +    <ssid>0x0</ssid>
 +    <devno>0xffff</devno>
 +    <channel_dev_addr>
 +      <cssid>0x0</cssid>
 +      <ssid>0x0</ssid>
 +      <devno>0x10000</devno>
 +    </channel_dev_addr>
 +  </capability>
 +</device>
 diff --git a/tests/nodedevschemadata/css_0_0_ffff_channel_dev_addr.xml b/tests/nodedevschemadata/css_0_0_ffff_channel_dev_addr.xml
 new file mode 100644
 index 0000000000..17a77cb282
 --- /dev/null
 +++ b/tests/nodedevschemadata/css_0_0_ffff_channel_dev_addr.xml
@@ -0,0 +1,15 @@
 +<device>
 +  <name>css_0_0_ffff</name>
 +  <path>/sys/devices/css0/0.0.ffff</path>
 +  <parent>computer</parent>
 +  <capability type='css'>
 +    <cssid>0x0</cssid>
 +    <ssid>0x0</ssid>
 +    <devno>0xffff</devno>
 +    <channel_dev_addr>
 +      <cssid>0x0</cssid>
 +      <ssid>0x0</ssid>
 +      <devno>0x0815</devno>
 +    </channel_dev_addr>
 +  </capability>
 +</device>
 diff --git a/tests/nodedevxml2xmlout/css_0_0_fffe_mdev_types_channel_dev_addr.xml b/tests/nodedevxml2xmlout/css_0_0_fffe_mdev_types_channel_dev_addr.xml
 new file mode 120000
 index 0000000000..65ab582ee8
 --- /dev/null
 +++ b/tests/nodedevxml2xmlout/css_0_0_fffe_mdev_types_channel_dev_addr.xml
@@ -0,0 +1 @@
 +../nodedevschemadata/css_0_0_fffe_mdev_types_channel_dev_addr.xml
 \ No newline at end of file
 diff --git a/tests/nodedevxml2xmlout/css_0_0_ffff_channel_dev_addr.xml b/tests/nodedevxml2xmlout/css_0_0_ffff_channel_dev_addr.xml
 new file mode 120000
 index 0000000000..cbfe719777
 --- /dev/null
 +++ b/tests/nodedevxml2xmlout/css_0_0_ffff_channel_dev_addr.xml
@@ -0,0 +1 @@
 +../nodedevschemadata/css_0_0_ffff_channel_dev_addr.xml
 \ No newline at end of file
 diff --git a/tests/nodedevxml2xmltest.c b/tests/nodedevxml2xmltest.c
 index 557347fb07..ad9562cc82 100644
 --- a/tests/nodedevxml2xmltest.c
 +++ b/tests/nodedevxml2xmltest.c
@@ -125,7 +125,9 @@ mymain(void)
     DO_TEST("mdev_3627463d_b7f0_4fea_b468_f1da537d301b");
     DO_TEST("ccw_0_0_ffff");
     DO_TEST("css_0_0_ffff");
 +    DO_TEST("css_0_0_ffff_channel_dev_addr");
     DO_TEST("css_0_0_fffe_mdev_types");
 +    DO_TEST("css_0_0_fffe_mdev_types_channel_dev_addr");
     DO_TEST("ap_card07");
     DO_TEST("ap_07_0038");
     DO_TEST("ap_matrix");
 -- 
 2.39.1
--- a/SOURCES/libvirt-nodedev-fix-reported-error-msg-in-css-cap-XML-parsing.patch
+++ b/SOURCES/libvirt-nodedev-fix-reported-error-msg-in-css-cap-XML-parsing.patch
@ -1,32 +0,0 @@
 From d82e4473a66da27d2c6f41f8ecadacbd00f44430 Mon Sep 17 00:00:00 2001
 Message-Id: <d82e4473a66da27d2c6f41f8ecadacbd00f44430@dist-git>
 From: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Date: Fri, 13 May 2022 12:31:00 +0200
 Subject: [PATCH] nodedev: fix reported error msg in css cap XML parsing
 Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 78094a4bd1562fec73ae99c67ddcbedd83953d5c)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 src/conf/node_device_conf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c
 index 0bac0fde8d..a6ebf4b66f 100644
 --- a/src/conf/node_device_conf.c
 +++ b/src/conf/node_device_conf.c
@@ -1193,7 +1193,7 @@ virNodeDevCapCCWParseXML(xmlXPathContextPtr ctxt,
     if (virStrToLong_uip(ssid, NULL, 0, &ccw_dev->ssid) < 0) {
         virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
                        _("invalid ssid value '%s' for '%s'"),
 -                       cssid, def->name);
 +                       ssid, def->name);
         return -1;
     }
 -- 
 2.39.1
--- a/SOURCES/libvirt-nodedev-prevent-internal-error-on-dev_busid-parse.patch
+++ b/SOURCES/libvirt-nodedev-prevent-internal-error-on-dev_busid-parse.patch
@ -1,35 +0,0 @@
 From 7c60078d7a6442dc8cb5a711876d28f70d892bff Mon Sep 17 00:00:00 2001
 Message-Id: <7c60078d7a6442dc8cb5a711876d28f70d892bff@dist-git>
 From: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Date: Mon, 23 May 2022 17:56:21 +0200
 Subject: [PATCH] nodedev: prevent internal error on dev_busid parse
 As "none" is a legal value represented in the sysfs attribute dev_busid
 this patch prevents libvirt from incorrectly reporting an internal error.
 Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Suggested-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit e37c39747be0792d03c450e56ddb3c78d08cbf3e)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 src/node_device/node_device_udev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c
 index 611a2592ca..b76e3de681 100644
 --- a/src/node_device/node_device_udev.c
 +++ b/src/node_device/node_device_udev.c
@@ -1144,7 +1144,7 @@ udevProcessCSS(struct udev_device *device,
     /* process optional channel devices information */
     udevGetStringSysfsAttr(device, "dev_busid", &dev_busid);
 -    if (dev_busid != NULL)
 +    if (dev_busid != NULL && STRNEQ(dev_busid, "none"))
         def->caps->data.ccw_dev.channel_dev_addr = virCCWDeviceAddressFromString(dev_busid);
     if (virNodeDeviceGetCSSDynamicCaps(def->sysfs_path, &def->caps->data.ccw_dev) < 0)
 -- 
 2.39.1
--- a/SOURCES/libvirt-nodedev-refactor-ccw-device-address-parsing-from-XML.patch
+++ b/SOURCES/libvirt-nodedev-refactor-ccw-device-address-parsing-from-XML.patch
@ -1,140 +0,0 @@
 From ef8c30a091b5b0f08f9405878b49c21c5525dd0a Mon Sep 17 00:00:00 2001
 Message-Id: <ef8c30a091b5b0f08f9405878b49c21c5525dd0a@dist-git>
 From: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Date: Fri, 13 May 2022 12:31:12 +0200
 Subject: [PATCH] nodedev: refactor ccw device address parsing from XML
 Move ccw device address XML parsing into new method for later reuse.
 Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 4402295d371a62ab8632d23002283b8a7721e6a7)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 src/conf/node_device_conf.c | 96 ++++++++++++++++++++++---------------
 1 file changed, 58 insertions(+), 38 deletions(-)
 diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c
 index 1e00f65717..8982368465 100644
 --- a/src/conf/node_device_conf.c
 +++ b/src/conf/node_device_conf.c
@@ -1141,6 +1141,58 @@ virNodeDevAPMatrixCapabilityParseXML(xmlXPathContextPtr ctxt,
 }
 +static int
 +virNodeDevCCWDeviceAddressParseXML(xmlXPathContextPtr ctxt,
 +                                   xmlNodePtr node,
 +                                   const char *dev_name,
 +                                   virCCWDeviceAddress *ccw_addr)
 +{
 +    VIR_XPATH_NODE_AUTORESTORE(ctxt)
 +    g_autofree char *cssid = NULL;
 +    g_autofree char *ssid = NULL;
 +    g_autofree char *devno = NULL;
 +
 +    ctxt->node = node;
 +
 +    if (!(cssid = virXPathString("string(./cssid[1])", ctxt))) {
 +        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
 +                       _("missing cssid value for '%s'"), dev_name);
 +        return -1;
 +    }
 +    if (virStrToLong_uip(cssid, NULL, 0, &ccw_addr->cssid) < 0) {
 +        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
 +                       _("invalid cssid value '%s' for '%s'"),
 +                       cssid, dev_name);
 +        return -1;
 +    }
 +
 +    if (!(ssid = virXPathString("string(./ssid[1])", ctxt))) {
 +        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
 +                       _("missing ssid value for '%s'"), dev_name);
 +        return -1;
 +    }
 +    if (virStrToLong_uip(ssid, NULL, 0, &ccw_addr->ssid) < 0) {
 +        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
 +                       _("invalid ssid value '%s' for '%s'"),
 +                       ssid, dev_name);
 +        return -1;
 +    }
 +
 +    if (!(devno = virXPathString("string(./devno[1])", ctxt))) {
 +        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
 +                       _("missing devno value for '%s'"), dev_name);
 +        return -1;
 +    }
 +    if (virStrToLong_uip(devno, NULL, 16, &ccw_addr->devno) < 0) {
 +        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
 +                       _("invalid devno value '%s' for '%s'"),
 +                       devno, dev_name);
 +        return -1;
 +    }
 +
 +    return 0;
 +}
 +
 static int
 virNodeDevCSSCapabilityParseXML(xmlXPathContextPtr ctxt,
                                 xmlNodePtr node,
@@ -1178,50 +1230,18 @@ virNodeDevCapCCWParseXML(xmlXPathContextPtr ctxt,
     g_autofree xmlNodePtr *nodes = NULL;
     int n = 0;
     size_t i = 0;
 -    g_autofree char *cssid = NULL;
 -    g_autofree char *ssid = NULL;
 -    g_autofree char *devno = NULL;
 +    g_autofree virCCWDeviceAddress *ccw_addr = NULL;
     ctxt->node = node;
 -    if (!(cssid = virXPathString("string(./cssid[1])", ctxt))) {
 -        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
 -                       _("missing cssid value for '%s'"), def->name);
 -        return -1;
 -    }
 -
 -    if (virStrToLong_uip(cssid, NULL, 0, &ccw_dev->cssid) < 0) {
 -        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
 -                       _("invalid cssid value '%s' for '%s'"),
 -                       cssid, def->name);
 -        return -1;
 -    }
 -
 -    if (!(ssid = virXPathString("string(./ssid[1])", ctxt))) {
 -        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
 -                       _("missing ssid value for '%s'"), def->name);
 -        return -1;
 -    }
 +    ccw_addr = g_new0(virCCWDeviceAddress, 1);
 -    if (virStrToLong_uip(ssid, NULL, 0, &ccw_dev->ssid) < 0) {
 -        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
 -                       _("invalid ssid value '%s' for '%s'"),
 -                       ssid, def->name);
 +    if (virNodeDevCCWDeviceAddressParseXML(ctxt, node, def->name, ccw_addr) < 0)
         return -1;
 -    }
 -    if (!(devno = virXPathString("string(./devno[1])", ctxt))) {
 -        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
 -                       _("missing devno value for '%s'"), def->name);
 -        return -1;
 -    }
 -
 -    if (virStrToLong_uip(devno, NULL, 16, &ccw_dev->devno) < 0) {
 -        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
 -                       _("invalid devno value '%s' for '%s'"),
 -                       devno, def->name);
 -        return -1;
 -    }
 +    ccw_dev->cssid = ccw_addr->cssid;
 +    ccw_dev->ssid = ccw_addr->ssid;
 +    ccw_dev->devno = ccw_addr->devno;
     if ((n = virXPathNodeSet("./capability", ctxt, &nodes)) < 0)
         return -1;
 -- 
 2.39.1
--- a/SOURCES/libvirt-nodedev-refactor-css-XML-parsing-from-ccw-XML-parsing.patch
+++ b/SOURCES/libvirt-nodedev-refactor-css-XML-parsing-from-ccw-XML-parsing.patch
@ -1,99 +0,0 @@
 From 286c821eee3b682d6aa4aeaa13aad92382708803 Mon Sep 17 00:00:00 2001
 Message-Id: <286c821eee3b682d6aa4aeaa13aad92382708803@dist-git>
 From: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Date: Fri, 13 May 2022 12:31:13 +0200
 Subject: [PATCH] nodedev: refactor css XML parsing from ccw XML parsing
 In preparation for easier extension later.
 Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 245ff2d6634b3afb0dbf0d295051e458095bfc80)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 src/conf/node_device_conf.c | 40 +++++++++++++++++++++++++++----------
 1 file changed, 30 insertions(+), 10 deletions(-)
 diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c
 index 8982368465..fcb5be24e1 100644
 --- a/src/conf/node_device_conf.c
 +++ b/src/conf/node_device_conf.c
@@ -1193,6 +1193,31 @@ virNodeDevCCWDeviceAddressParseXML(xmlXPathContextPtr ctxt,
     return 0;
 }
 +
 +static int
 +virNodeDevCapCCWParseXML(xmlXPathContextPtr ctxt,
 +                         virNodeDeviceDef *def,
 +                         xmlNodePtr node,
 +                         virNodeDevCapCCW *ccw_dev)
 +{
 +    VIR_XPATH_NODE_AUTORESTORE(ctxt)
 +    g_autofree virCCWDeviceAddress *ccw_addr = NULL;
 +
 +    ctxt->node = node;
 +
 +    ccw_addr = g_new0(virCCWDeviceAddress, 1);
 +
 +    if (virNodeDevCCWDeviceAddressParseXML(ctxt, node, def->name, ccw_addr) < 0)
 +        return -1;
 +
 +    ccw_dev->cssid = ccw_addr->cssid;
 +    ccw_dev->ssid = ccw_addr->ssid;
 +    ccw_dev->devno = ccw_addr->devno;
 +
 +    return 0;
 +}
 +
 +
 static int
 virNodeDevCSSCapabilityParseXML(xmlXPathContextPtr ctxt,
                                 xmlNodePtr node,
@@ -1221,7 +1246,7 @@ virNodeDevCSSCapabilityParseXML(xmlXPathContextPtr ctxt,
 static int
 -virNodeDevCapCCWParseXML(xmlXPathContextPtr ctxt,
 +virNodeDevCapCSSParseXML(xmlXPathContextPtr ctxt,
                          virNodeDeviceDef *def,
                          xmlNodePtr node,
                          virNodeDevCapCCW *ccw_dev)
@@ -1230,19 +1255,12 @@ virNodeDevCapCCWParseXML(xmlXPathContextPtr ctxt,
     g_autofree xmlNodePtr *nodes = NULL;
     int n = 0;
     size_t i = 0;
 -    g_autofree virCCWDeviceAddress *ccw_addr = NULL;
     ctxt->node = node;
 -    ccw_addr = g_new0(virCCWDeviceAddress, 1);
 -
 -    if (virNodeDevCCWDeviceAddressParseXML(ctxt, node, def->name, ccw_addr) < 0)
 +    if (virNodeDevCapCCWParseXML(ctxt, def, node, ccw_dev) < 0)
         return -1;
 -    ccw_dev->cssid = ccw_addr->cssid;
 -    ccw_dev->ssid = ccw_addr->ssid;
 -    ccw_dev->devno = ccw_addr->devno;
 -
     if ((n = virXPathNodeSet("./capability", ctxt, &nodes)) < 0)
         return -1;
@@ -2282,9 +2300,11 @@ virNodeDevCapsDefParseXML(xmlXPathContextPtr ctxt,
         ret = virNodeDevCapMdevParseXML(ctxt, def, node, &caps->data.mdev);
         break;
     case VIR_NODE_DEV_CAP_CCW_DEV:
 -    case VIR_NODE_DEV_CAP_CSS_DEV:
         ret = virNodeDevCapCCWParseXML(ctxt, def, node, &caps->data.ccw_dev);
         break;
 +    case VIR_NODE_DEV_CAP_CSS_DEV:
 +        ret = virNodeDevCapCSSParseXML(ctxt, def, node, &caps->data.ccw_dev);
 +        break;
     case VIR_NODE_DEV_CAP_AP_CARD:
         ret = virNodeDevCapAPCardParseXML(ctxt, def, node,
                                           &caps->data.ap_card);
 -- 
 2.39.1
--- a/SOURCES/libvirt-nodedev-refactor-css-format-from-ccw-format-method.patch
+++ b/SOURCES/libvirt-nodedev-refactor-css-format-from-ccw-format-method.patch
@ -1,62 +0,0 @@
 From d370e2e984b4501060ea0d7a10629db0bfe51ef2 Mon Sep 17 00:00:00 2001
 Message-Id: <d370e2e984b4501060ea0d7a10629db0bfe51ef2@dist-git>
 From: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Date: Fri, 13 May 2022 12:31:11 +0200
 Subject: [PATCH] nodedev: refactor css format from ccw format method
 In preparation for easier extension later.
 Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit c5864885060b136214b4bcef25d604cc3d147014)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2165011
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 src/conf/node_device_conf.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)
 diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c
 index a6ebf4b66f..1e00f65717 100644
 --- a/src/conf/node_device_conf.c
 +++ b/src/conf/node_device_conf.c
@@ -632,10 +632,21 @@ virNodeDeviceCapCCWDefFormat(virBuffer *buf,
                       data->ccw_dev.ssid);
     virBufferAsprintf(buf, "<devno>0x%04x</devno>\n",
                       data->ccw_dev.devno);
 -    if (data->ccw_dev.flags & VIR_NODE_DEV_CAP_FLAG_CSS_MDEV)
 +}
 +
 +
 +static void
 +virNodeDeviceCapCSSDefFormat(virBuffer *buf,
 +                             const virNodeDevCapData *data)
 +{
 +    virNodeDevCapCCW ccw_dev = data->ccw_dev;
 +
 +    virNodeDeviceCapCCWDefFormat(buf, data);
 +
 +    if (ccw_dev.flags & VIR_NODE_DEV_CAP_FLAG_CSS_MDEV)
         virNodeDeviceCapMdevTypesFormat(buf,
 -                                        data->ccw_dev.mdev_types,
 -                                        data->ccw_dev.nmdev_types);
 +                                        ccw_dev.mdev_types,
 +                                        ccw_dev.nmdev_types);
 }
@@ -724,9 +735,11 @@ virNodeDeviceDefFormat(const virNodeDeviceDef *def)
             virNodeDeviceCapMdevDefFormat(&buf, data);
             break;
         case VIR_NODE_DEV_CAP_CCW_DEV:
 -        case VIR_NODE_DEV_CAP_CSS_DEV:
             virNodeDeviceCapCCWDefFormat(&buf, data);
             break;
 +        case VIR_NODE_DEV_CAP_CSS_DEV:
 +            virNodeDeviceCapCSSDefFormat(&buf, data);
 +            break;
         case VIR_NODE_DEV_CAP_VDPA:
             virNodeDeviceCapVDPADefFormat(&buf, data);
             break;
 -- 
 2.39.1
--- a/SOURCES/libvirt-nodedev-refactor-mdevctl-thread-functions.patch
+++ b/SOURCES/libvirt-nodedev-refactor-mdevctl-thread-functions.patch
@ -0,0 +1,105 @@
 From 05230da856d2f016c21f49a406780fbe15f74c32 Mon Sep 17 00:00:00 2001
 Message-ID: <05230da856d2f016c21f49a406780fbe15f74c32.1689602377.git.jdenemar@redhat.com>
 From: Jonathon Jongsma <jjongsma@redhat.com>
 Date: Wed, 5 Jul 2023 15:35:59 -0500
 Subject: [PATCH] nodedev: refactor mdevctl thread functions
 Factor out a new scheduleMdevctlUpdate() function so that we can re-use
 it from other places. Now that other events can make it necessary to
 re-query mdevctl for mdev updates, this function will be useful for
 coalescing multiple updates in quick succession into a single mdevctl
 query.
 Also rename a couple functions. The names weren't very descriptive of
 their behavior. For example, the old scheduleMdevctlHandler() function
 didn't actually schedule anything, it just started a thread. So rename
 it to free up the 'schedule' name for the above refactored function.
 Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
 Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
 (cherry picked from commit 9b7fadc5dc33b85b597c95d944dc23c02c29c29f)
 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2143158
 Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
 ---
 src/node_device/node_device_udev.c | 36 ++++++++++++++++++++----------
 1 file changed, 24 insertions(+), 12 deletions(-)
 diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c
 index fce4212728..86ef4af728 100644
 --- a/src/node_device/node_device_udev.c
 +++ b/src/node_device/node_device_udev.c
@@ -2075,7 +2075,7 @@ udevPCITranslateInit(bool privileged G_GNUC_UNUSED)
 static void
 -mdevctlHandlerThread(void *opaque G_GNUC_UNUSED)
 +mdevctlUpdateThreadFunc(void *opaque G_GNUC_UNUSED)
 {
     udevEventData *priv = driver->privateData;
     VIR_LOCK_GUARD lock = virLockGuardLock(&priv->mdevctlLock);
@@ -2086,7 +2086,7 @@ mdevctlHandlerThread(void *opaque G_GNUC_UNUSED)
 static void
 -scheduleMdevctlHandler(int timer G_GNUC_UNUSED, void *opaque)
 +launchMdevctlUpdateThread(int timer G_GNUC_UNUSED, void *opaque)
 {
     udevEventData *priv = opaque;
     virThread thread;
@@ -2096,7 +2096,7 @@ scheduleMdevctlHandler(int timer G_GNUC_UNUSED, void *opaque)
         priv->mdevctlTimeout = -1;
     }
 -    if (virThreadCreateFull(&thread, false, mdevctlHandlerThread,
 +    if (virThreadCreateFull(&thread, false, mdevctlUpdateThreadFunc,
                             "mdevctl-thread", false, NULL) < 0) {
         virReportSystemError(errno, "%s",
                              _("failed to create mdevctl thread"));
@@ -2192,6 +2192,26 @@ mdevctlEnableMonitor(udevEventData *priv)
 }
 +/* Schedules an mdevctl update for 100ms in the future, canceling any existing
 + * timeout that may have been set. In this way, multiple update requests in
 + * quick succession can be collapsed into a single update. if @force is true,
 + * an update thread will be spawned immediately. */
 +static void
 +scheduleMdevctlUpdate(udevEventData *data,
 +                      bool force)
 +{
 +    if (!force) {
 +        if (data->mdevctlTimeout > 0)
 +            virEventRemoveTimeout(data->mdevctlTimeout);
 +        data->mdevctlTimeout = virEventAddTimeout(100, launchMdevctlUpdateThread,
 +                                                  data, NULL);
 +        return;
 +    }
 +
 +    launchMdevctlUpdateThread(-1, data);
 +}
 +
 +
 static void
 mdevctlEventHandleCallback(GFileMonitor *monitor G_GNUC_UNUSED,
                            GFile *file,
@@ -2222,15 +2242,7 @@ mdevctlEventHandleCallback(GFileMonitor *monitor G_GNUC_UNUSED,
      * configuration change, try to coalesce these changes by waiting for the
      * CHANGES_DONE_HINT event. As a fallback,  add a timeout to trigger the
      * signal if that event never comes */
 -    if (event_type != G_FILE_MONITOR_EVENT_CHANGES_DONE_HINT) {
 -        if (priv->mdevctlTimeout > 0)
 -            virEventRemoveTimeout(priv->mdevctlTimeout);
 -        priv->mdevctlTimeout = virEventAddTimeout(100, scheduleMdevctlHandler,
 -                                                  priv, NULL);
 -        return;
 -    }
 -
 -    scheduleMdevctlHandler(-1, priv);
 +    scheduleMdevctlUpdate(priv, (event_type == G_FILE_MONITOR_EVENT_CHANGES_DONE_HINT));
 }
 -- 
 2.41.0
--- a/SOURCES/libvirt-nodedev-report-mdev-persistence-properly.patch
+++ b/SOURCES/libvirt-nodedev-report-mdev-persistence-properly.patch
@ -0,0 +1,104 @@
 From c2150285aff9b308b969d5fc6f32f75db620dfe3 Mon Sep 17 00:00:00 2001
 Message-ID: <c2150285aff9b308b969d5fc6f32f75db620dfe3.1689974710.git.jdenemar@redhat.com>
 From: Jonathon Jongsma <jjongsma@redhat.com>
 Date: Tue, 18 Jul 2023 14:47:49 -0500
 Subject: [PATCH] nodedev: report mdev persistence properly
 Since commit 44a0f2f0, we now query mdevctl for transient (active) mdevs
 in order to gather attributes for the mdev. Unfortunately, this commit
 introduced a regression because nodeDeviceUpdateMediatedDevice() assumed
 that all mdevs returned from mdevctl were actually persistent mdevs but
 we were using it to update transient mdevs. Refactor the function so
 that we can use it to update both persistent and transient mdevs.
 Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2143158
 (cherry picked from commit fa0d5f4ebc0aa178d9dea278914f9149a4c4af54)
 Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
 ---
 src/node_device/node_device_driver.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)
 diff --git a/src/node_device/node_device_driver.c b/src/node_device/node_device_driver.c
 index a2d0600560..5dc45ddbb4 100644
 --- a/src/node_device/node_device_driver.c
 +++ b/src/node_device/node_device_driver.c
@@ -1339,11 +1339,12 @@ nodeDeviceDestroy(virNodeDevicePtr device)
 /* takes ownership of @def and potentially frees it. @def should not be used
  * after returning from this function */
 static int
 -nodeDeviceUpdateMediatedDevice(virNodeDeviceDef *def)
 +nodeDeviceUpdateMediatedDevice(virNodeDeviceDef *def,
 +                               bool defined)
 {
     virNodeDeviceObj *obj;
     virObjectEvent *event;
 -    bool defined = false;
 +    bool was_defined = false;
     g_autoptr(virNodeDeviceDef) owned = def;
     g_autofree char *name = g_strdup(owned->name);
@@ -1359,13 +1360,13 @@ nodeDeviceUpdateMediatedDevice(virNodeDeviceDef *def)
         bool changed;
         virNodeDeviceDef *olddef = virNodeDeviceObjGetDef(obj);
 -        defined = virNodeDeviceObjIsPersistent(obj);
 +        was_defined = virNodeDeviceObjIsPersistent(obj);
         /* Active devices contain some additional information (e.g. sysfs
          * path) that is not provided by mdevctl, so re-use the existing
          * definition and copy over new mdev data */
         changed = nodeDeviceDefCopyFromMdevctl(olddef, owned);
 -        if (defined && !changed) {
 +        if (was_defined && !changed) {
             /* if this device was already defined and the definition
              * hasn't changed, there's nothing to do for this device */
             virNodeDeviceObjEndAPI(&obj);
@@ -1373,11 +1374,11 @@ nodeDeviceUpdateMediatedDevice(virNodeDeviceDef *def)
         }
     }
 -    /* all devices returned by virMdevctlListDefined() are persistent */
 -    virNodeDeviceObjSetPersistent(obj, true);
 +    if (defined)
 +        virNodeDeviceObjSetPersistent(obj, true);
     virNodeDeviceObjSetAutostart(obj, def->caps->data.mdev.autostart);
 -    if (!defined)
 +    if (!was_defined && defined)
         event = virNodeDeviceEventLifecycleNew(name,
                                                VIR_NODE_DEVICE_EVENT_DEFINED,
                                                0);
@@ -1447,7 +1448,7 @@ nodeDeviceDefineXML(virConnect *conn,
      * have already received the uuid from virMdevctlDefine(), we can simply
      * add the provisional device to the list and return it immediately and
      * avoid this long delay. */
 -    if (nodeDeviceUpdateMediatedDevice(g_steal_pointer(&def)) < 0)
 +    if (nodeDeviceUpdateMediatedDevice(g_steal_pointer(&def), true) < 0)
         return NULL;
     return virGetNodeDevice(conn, name);
@@ -1742,7 +1743,7 @@ nodeDeviceUpdateMediatedDevices(void)
                                       removeMissingPersistentMdev, &data);
     for (i = 0; i < data.ndefs; i++)
 -        if (nodeDeviceUpdateMediatedDevice(defs[i]) < 0)
 +        if (nodeDeviceUpdateMediatedDevice(defs[i], true) < 0)
             return -1;
     /* Update active/transient mdev devices */
@@ -1753,7 +1754,7 @@ nodeDeviceUpdateMediatedDevices(void)
     }
     for (i = 0; i < act_ndefs; i++)
 -        if (nodeDeviceUpdateMediatedDevice(act_defs[i]) < 0)
 +        if (nodeDeviceUpdateMediatedDevice(act_defs[i], false) < 0)
             return -1;
     return 0;
 -- 
 2.41.0
--- a/SOURCES/libvirt-nodedev-transient-mdev-update-on-nodeDeviceCreateXML.patch
+++ b/SOURCES/libvirt-nodedev-transient-mdev-update-on-nodeDeviceCreateXML.patch
@ -0,0 +1,50 @@
 From d993cec578f2bbb121dcacea6728cf34da14e62e Mon Sep 17 00:00:00 2001
 Message-ID: <d993cec578f2bbb121dcacea6728cf34da14e62e.1689602377.git.jdenemar@redhat.com>
 From: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Date: Fri, 30 Jun 2023 13:34:00 +0200
 Subject: [PATCH] nodedev: transient mdev update on nodeDeviceCreateXML
 Update the optional mdev attributes by running an mdevctl update on a
 new created nodedev object representing an mdev.
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2143158
 Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Reviewed-by: Jonathon Jongsma <jjongsma@redhat.com>
 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2143158
 (cherry picked from commit 37481aa1f15ece6b187b8fa219966f77648c813d)
 Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
 ---
 src/node_device/node_device_udev.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)
 diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c
 index 4c37ec3189..fce4212728 100644
 --- a/src/node_device/node_device_udev.c
 +++ b/src/node_device/node_device_udev.c
@@ -1757,12 +1757,20 @@ nodeStateCleanup(void)
 static int
 udevHandleOneDevice(struct udev_device *device)
 {
 +    virNodeDevCapType dev_cap_type;
     const char *action = udev_device_get_action(device);
     VIR_DEBUG("udev action: '%s': %s", action, udev_device_get_syspath(device));
 -    if (STREQ(action, "add") || STREQ(action, "change"))
 -        return udevAddOneDevice(device);
 +    if (STREQ(action, "add") || STREQ(action, "change")) {
 +        int ret = udevAddOneDevice(device);
 +        if (ret == 0 &&
 +            udevGetDeviceType(device, &dev_cap_type) == 0 &&
 +            dev_cap_type == VIR_NODE_DEV_CAP_MDEV)
 +            if (nodeDeviceUpdateMediatedDevices() < 0)
 +                VIR_WARN("mdevctl failed to update mediated devices");
 +        return ret;
 +    }
     if (STREQ(action, "remove"))
         return udevRemoveOneDevice(device);
 -- 
 2.41.0
--- a/SOURCES/libvirt-nodedev-update-mdevs-from-the-mdevctl-thread.patch
+++ b/SOURCES/libvirt-nodedev-update-mdevs-from-the-mdevctl-thread.patch
@ -0,0 +1,70 @@
 From 48813113774c7ff0ab1b43c1861b6495bb3ce830 Mon Sep 17 00:00:00 2001
 Message-ID: <48813113774c7ff0ab1b43c1861b6495bb3ce830.1689602377.git.jdenemar@redhat.com>
 From: Jonathon Jongsma <jjongsma@redhat.com>
 Date: Thu, 6 Jul 2023 09:16:35 -0500
 Subject: [PATCH] nodedev: update mdevs from the mdevctl thread
 Rather than directly executing mdevctl from the udev event thread when
 we determine that we need to re-query, schedule the mdevctl thread to
 run. This also helps to coalesce multiple back-to-back updates into a
 single one when there are multiple updates in a row or at startup when a
 host has a very large number of mdevs.
 Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
 Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
 (cherry picked from commit 14026db9b0e25739ea30685bd643ff23aca30588)
 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2143158
 Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
 ---
 src/node_device/node_device_udev.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)
 diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c
 index 86ef4af728..6451574c1d 100644
 --- a/src/node_device/node_device_udev.c
 +++ b/src/node_device/node_device_udev.c
@@ -1443,6 +1443,9 @@ udevGetDeviceDetails(struct udev_device *device,
 }
 +static void scheduleMdevctlUpdate(udevEventData *data, bool force);
 +
 +
 static int
 udevRemoveOneDeviceSysPath(const char *path)
 {
@@ -1475,8 +1478,7 @@ udevRemoveOneDeviceSysPath(const char *path)
     virNodeDeviceObjEndAPI(&obj);
     /* cannot check for mdev_types since they have already been removed */
 -    if (nodeDeviceUpdateMediatedDevices() < 0)
 -        VIR_WARN("mdevctl failed to update mediated devices");
 +    scheduleMdevctlUpdate(driver->privateData, false);
     virObjectEventStateQueue(driver->nodeDeviceEventState, event);
     return 0;
@@ -1604,8 +1606,8 @@ udevAddOneDevice(struct udev_device *device)
     has_mdev_types = virNodeDeviceObjHasCap(obj, VIR_NODE_DEV_CAP_MDEV_TYPES);
     virNodeDeviceObjEndAPI(&obj);
 -    if (has_mdev_types && nodeDeviceUpdateMediatedDevices() < 0)
 -        VIR_WARN("mdevctl failed to update mediated devices");
 +    if (has_mdev_types)
 +        scheduleMdevctlUpdate(driver->privateData, false);
     ret = 0;
@@ -1767,8 +1769,7 @@ udevHandleOneDevice(struct udev_device *device)
         if (ret == 0 &&
             udevGetDeviceType(device, &dev_cap_type) == 0 &&
             dev_cap_type == VIR_NODE_DEV_CAP_MDEV)
 -            if (nodeDeviceUpdateMediatedDevices() < 0)
 -                VIR_WARN("mdevctl failed to update mediated devices");
 +            scheduleMdevctlUpdate(driver->privateData, false);
         return ret;
     }
 -- 
 2.41.0
--- a/SOURCES/libvirt-nodedev-update-transient-mdevs.patch
+++ b/SOURCES/libvirt-nodedev-update-transient-mdevs.patch
@ -1,79 +0,0 @@
 From aebcc09c7060f6eace93821c6a782031cf107d85 Mon Sep 17 00:00:00 2001
 Message-ID: <aebcc09c7060f6eace93821c6a782031cf107d85.1687452713.git.jdenemar@redhat.com>
 From: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Date: Mon, 8 May 2023 19:10:46 +0200
 Subject: [PATCH] nodedev: update transient mdevs
 Instead of updating defined mdevs only add another update for active
 devices as well to cover transient mdev devices as well.
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2143158
 Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Reviewed-by: Jonathon Jongsma <jjongsma@redhat.com>
 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2143160
 (cherry picked from commit 44a0f2f0c8ff5e78c238013ed297b8fce223ac5a)
 Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
 ---
 src/node_device/node_device_driver.c | 31 ++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 diff --git a/src/node_device/node_device_driver.c b/src/node_device/node_device_driver.c
 index e6ab4bb94c..943f6121a0 100644
 --- a/src/node_device/node_device_driver.c
 +++ b/src/node_device/node_device_driver.c
@@ -1651,6 +1651,24 @@ virMdevctlListDefined(virNodeDeviceDef ***devs, char **errmsg)
 }
 +static int
 +virMdevctlListActive(virNodeDeviceDef ***devs, char **errmsg)
 +{
 +    int status;
 +    g_autofree char *output = NULL;
 +    g_autoptr(virCommand) cmd = nodeDeviceGetMdevctlListCommand(false, &output, errmsg);
 +
 +    if (virCommandRun(cmd, &status) < 0 || status != 0) {
 +        return -1;
 +    }
 +
 +    if (!output)
 +        return -1;
 +
 +    return nodeDeviceParseMdevctlJSON(output, devs);
 +}
 +
 +
 typedef struct _virMdevctlForEachData virMdevctlForEachData;
 struct _virMdevctlForEachData {
     int ndefs;
@@ -1712,6 +1730,8 @@ int
 nodeDeviceUpdateMediatedDevices(void)
 {
     g_autofree virNodeDeviceDef **defs = NULL;
 +    g_autofree virNodeDeviceDef **act_defs = NULL;
 +    int act_ndefs = 0;
     g_autofree char *errmsg = NULL;
     g_autofree char *mdevctl = NULL;
     virMdevctlForEachData data = { 0, };
@@ -1738,6 +1758,17 @@ nodeDeviceUpdateMediatedDevices(void)
         if (nodeDeviceUpdateMediatedDevice(defs[i]) < 0)
             return -1;
 +    /* Update active/transient mdev devices */
 +    if ((act_ndefs = virMdevctlListActive(&act_defs, &errmsg)) < 0) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR,
 +                       _("failed to query mdevs from mdevctl: %1$s"), errmsg);
 +        return -1;
 +    }
 +
 +    for (i = 0; i < act_ndefs; i++)
 +        if (nodeDeviceUpdateMediatedDevice(act_defs[i]) < 0)
 +            return -1;
 +
     return 0;
 }
 -- 
 2.41.0
--- a/SOURCES/libvirt-nwfilter-fix-crash-when-counting-number-of-network-filters.patch
+++ b/SOURCES/libvirt-nwfilter-fix-crash-when-counting-number-of-network-filters.patch
@ -1,55 +0,0 @@
 From dc6ab8b51ff53ba22abfb84f24641aa87320038a Mon Sep 17 00:00:00 2001
 Message-Id: <dc6ab8b51ff53ba22abfb84f24641aa87320038a@dist-git>
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Tue, 8 Mar 2022 17:28:38 +0000
 Subject: [PATCH] nwfilter: fix crash when counting number of network filters
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The virNWFilterObjListNumOfNWFilters method iterates over the
 driver->nwfilters, accessing virNWFilterObj instances. As such
 it needs to be protected against concurrent modification of
 the driver->nwfilters object.
 This API allows unprivileged users to connect, so users with
 read-only access to libvirt can cause a denial of service
 crash if they are able to race with a call of virNWFilterUndefine.
 Since network filters are usually statically defined, this is
 considered a low severity problem.
 This is assigned CVE-2022-0897.
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit a4947e8f63c3e6b7b067b444f3d6cf674c0d7f36)
 https://bugzilla.redhat.com/show_bug.cgi?id=2063902
 ---
 src/nwfilter/nwfilter_driver.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)
 diff --git a/src/nwfilter/nwfilter_driver.c b/src/nwfilter/nwfilter_driver.c
 index 200451d6b1..956aca6421 100644
 --- a/src/nwfilter/nwfilter_driver.c
 +++ b/src/nwfilter/nwfilter_driver.c
@@ -478,11 +478,15 @@ nwfilterLookupByName(virConnectPtr conn,
 static int
 nwfilterConnectNumOfNWFilters(virConnectPtr conn)
 {
 +    int ret;
     if (virConnectNumOfNWFiltersEnsureACL(conn) < 0)
         return -1;
 -    return virNWFilterObjListNumOfNWFilters(driver->nwfilters, conn,
 -                                        virConnectNumOfNWFiltersCheckACL);
 +    nwfilterDriverLock();
 +    ret = virNWFilterObjListNumOfNWFilters(driver->nwfilters, conn,
 +                                           virConnectNumOfNWFiltersCheckACL);
 +    nwfilterDriverUnlock();
 +    return ret;
 }
 -- 
 2.35.1
--- a/SOURCES/libvirt-qemu-Add-qemuDomainSetMaxMemLock-helper.patch
+++ b/SOURCES/libvirt-qemu-Add-qemuDomainSetMaxMemLock-helper.patch
@ -1,155 +0,0 @@
 From 2595c7716b19214b2729b41b86656f96a2cd18bc Mon Sep 17 00:00:00 2001
 Message-Id: <2595c7716b19214b2729b41b86656f96a2cd18bc@dist-git>
 From: Jiri Denemark <jdenemar@redhat.com>
 Date: Wed, 22 Jun 2022 15:21:30 +0200
 Subject: [PATCH] qemu: Add qemuDomainSetMaxMemLock helper
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 qemuDomainAdjustMaxMemLock combined computing the desired limit with
 applying it. This patch separates the code to apply a memory locking
 limit to a new qemuDomainSetMaxMemLock helper for better reusability.
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit dff51c7f5760ded8235076f55d082fe4363f2f78)
 https://bugzilla.redhat.com/show_bug.cgi?id=2089433
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/qemu/qemu_domain.c | 95 ++++++++++++++++++++++++++----------------
 src/qemu/qemu_domain.h |  3 ++
 2 files changed, 61 insertions(+), 37 deletions(-)
 diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
 index ee7d310903..a81789f194 100644
 --- a/src/qemu/qemu_domain.c
 +++ b/src/qemu/qemu_domain.c
@@ -9261,6 +9261,61 @@ qemuDomainGetMemLockLimitBytes(virDomainDef *def,
 }
 +/**
 + * qemuDomainSetMaxMemLock:
 + * @vm: domain
 + * @limit: the desired memory locking limit
 + * @origPtr: where to store (or load from) the original value of the limit
 + *
 + * Set the memory locking limit for @vm unless it's already big enough. If
 + * @origPtr is non-NULL, the original value of the limit will be store there
 + * and can be restored by calling this function with @limit == 0.
 + *
 + * Returns: 0 on success, -1 otherwise.
 + */
 +int
 +qemuDomainSetMaxMemLock(virDomainObj *vm,
 +                        unsigned long long limit,
 +                        unsigned long long *origPtr)
 +{
 +    unsigned long long current = 0;
 +
 +    if (virProcessGetMaxMemLock(vm->pid, &current) < 0)
 +        return -1;
 +
 +    if (limit > 0) {
 +        VIR_DEBUG("Requested memory lock limit: %llu", limit);
 +        /* If the limit is already high enough, we can assume
 +         * that some external process is taking care of managing
 +         * process limits and we shouldn't do anything ourselves:
 +         * we're probably running in a containerized environment
 +         * where we don't have enough privilege anyway */
 +        if (current >= limit) {
 +            VIR_DEBUG("Current limit %llu is big enough", current);
 +            return 0;
 +        }
 +
 +        /* If this is the first time adjusting the limit, save the current
 +         * value so that we can restore it once memory locking is no longer
 +         * required */
 +        if (origPtr && *origPtr == 0)
 +            *origPtr = current;
 +    } else {
 +        /* Once memory locking is no longer required, we can restore the
 +         * original, usually very low, limit. But only if we actually stored
 +         * the original limit before. */
 +        if (!origPtr || *origPtr == 0)
 +            return 0;
 +
 +        limit = *origPtr;
 +        *origPtr = 0;
 +        VIR_DEBUG("Resetting memory lock limit back to %llu", limit);
 +    }
 +
 +    return virProcessSetMaxMemLock(vm->pid, limit);
 +}
 +
 +
 /**
  * qemuDomainAdjustMaxMemLock:
  * @vm: domain
@@ -9282,43 +9337,9 @@ int
 qemuDomainAdjustMaxMemLock(virDomainObj *vm,
                            bool forceVFIO)
 {
 -    qemuDomainObjPrivate *priv = vm->privateData;
 -    unsigned long long currentMemLock = 0;
 -    unsigned long long desiredMemLock = 0;
 -
 -    desiredMemLock = qemuDomainGetMemLockLimitBytes(vm->def, forceVFIO);
 -    if (virProcessGetMaxMemLock(vm->pid, &currentMemLock) < 0)
 -        return -1;
 -
 -    if (desiredMemLock > 0) {
 -        if (currentMemLock < desiredMemLock) {
 -            /* If this is the first time adjusting the limit, save the current
 -             * value so that we can restore it once memory locking is no longer
 -             * required */
 -            if (priv->originalMemlock == 0) {
 -                priv->originalMemlock = currentMemLock;
 -            }
 -        } else {
 -            /* If the limit is already high enough, we can assume
 -             * that some external process is taking care of managing
 -             * process limits and we shouldn't do anything ourselves:
 -             * we're probably running in a containerized environment
 -             * where we don't have enough privilege anyway */
 -            desiredMemLock = 0;
 -        }
 -    } else {
 -        /* Once memory locking is no longer required, we can restore the
 -         * original, usually very low, limit */
 -        desiredMemLock = priv->originalMemlock;
 -        priv->originalMemlock = 0;
 -    }
 -
 -    if (desiredMemLock > 0 &&
 -        virProcessSetMaxMemLock(vm->pid, desiredMemLock) < 0) {
 -        return -1;
 -    }
 -
 -    return 0;
 +    return qemuDomainSetMaxMemLock(vm,
 +                                   qemuDomainGetMemLockLimitBytes(vm->def, forceVFIO),
 +                                   &QEMU_DOMAIN_PRIVATE(vm)->originalMemlock);
 }
 diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h
 index e9497d20de..6d1d23439a 100644
 --- a/src/qemu/qemu_domain.h
 +++ b/src/qemu/qemu_domain.h
@@ -789,6 +789,9 @@ int qemuDomainAdjustMaxMemLock(virDomainObj *vm,
                                bool forceVFIO);
 int qemuDomainAdjustMaxMemLockHostdev(virDomainObj *vm,
                                       virDomainHostdevDef *hostdev);
 +int qemuDomainSetMaxMemLock(virDomainObj *vm,
 +                            unsigned long long limit,
 +                            unsigned long long *origPtr);
 int qemuDomainDefValidateMemoryHotplug(const virDomainDef *def,
                                        const virDomainMemoryDef *mem);
 -- 
 2.35.1
--- a/SOURCES/libvirt-qemu-Don-t-overwrite-NVRAM-template-for-legacy-firmware.patch
+++ b/SOURCES/libvirt-qemu-Don-t-overwrite-NVRAM-template-for-legacy-firmware.patch
@ -0,0 +1,77 @@
 From a106b0bcb4fd652b9843257f799d9601151449b4 Mon Sep 17 00:00:00 2001
 Message-ID: <a106b0bcb4fd652b9843257f799d9601151449b4.1692951632.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Fri, 26 May 2023 19:59:06 +0200
 Subject: [PATCH] qemu: Don't overwrite NVRAM template for legacy firmware
 Just because we have found a matching entry, it doesn't mean
 that we should discard the information explicitly provided in
 the domain XML.
 https://bugzilla.redhat.com/show_bug.cgi?id=2196178
 https://gitlab.com/libvirt/libvirt/-/issues/500
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 4a49114ff47d4a9432d211200f734886f9ce200b)
 https://bugzilla.redhat.com/show_bug.cgi?id=2196178
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c                      | 26 +++++++++++++++++--
 ...efi-secboot-legacy-paths.x86_64-latest.xml |  2 +-
 2 files changed, 25 insertions(+), 3 deletions(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index b1d342563b..a9437b5b95 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1609,8 +1609,30 @@ qemuFirmwareFillDomainLegacy(virQEMUDriver *driver,
         loader->type = VIR_DOMAIN_LOADER_TYPE_PFLASH;
         loader->readonly = VIR_TRISTATE_BOOL_YES;
 -        VIR_FREE(loader->nvramTemplate);
 -        loader->nvramTemplate = g_strdup(cfg->firmwares[i]->nvram);
 +        /* Only use the default template path if one hasn't been
 +         * provided by the user.
 +         *
 +         * In addition to fully-custom templates, which are a valid
 +         * use case, we could simply be in a situation where
 +         * qemu.conf contains
 +         *
 +         *   nvram = [
 +         *     "/path/to/OVMF_CODE.secboot.fd:/path/to/OVMF_VARS.fd",
 +         *     "/path/to/OVMF_CODE.secboot.fd:/path/to/OVMF_VARS.secboot.fd"
 +         *   ]
 +         *
 +         * and the domain has been configured as
 +         *
 +         *   <os>
 +         *     <loader readonly='yes' type='pflash'>/path/to/OVMF_CODE.secboot.fd</loader>
 +         *     <nvram template='/path/to/OVMF/OVMF_VARS.secboot.fd'>
 +         *   </os>
 +         *
 +         * In this case, the global default is to have Secure Boot
 +         * disabled, but the domain configuration explicitly enables
 +         * it, and we shouldn't overrule this choice */
 +        if (!loader->nvramTemplate)
 +            loader->nvramTemplate = g_strdup(cfg->firmwares[i]->nvram);
         qemuFirmwareEnsureNVRAM(def, cfg, VIR_STORAGE_FILE_RAW);
 diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml
 index b8c2dfef66..9027123558 100644
 --- a/tests/qemuxml2xmloutdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml
 +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-secboot-legacy-paths.x86_64-latest.xml
@@ -7,7 +7,7 @@
   <os>
     <type arch='x86_64' machine='pc-q35-4.0'>hvm</type>
     <loader readonly='yes' secure='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.secboot.fd</loader>
 -    <nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
 +    <nvram template='/usr/share/OVMF/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
     <boot dev='hd'/>
   </os>
   <features>
 -- 
 2.42.0
--- a/SOURCES/libvirt-qemu-Filter-firmware-based-on-loader.readonly.patch
+++ b/SOURCES/libvirt-qemu-Filter-firmware-based-on-loader.readonly.patch
@ -0,0 +1,340 @@
 From 9b3f3afb21c64dc403fea734b1cb75a8bd2e4fc0 Mon Sep 17 00:00:00 2001
 Message-ID: <9b3f3afb21c64dc403fea734b1cb75a8bd2e4fc0.1692951632.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Tue, 30 May 2023 18:01:58 +0200
 Subject: [PATCH] qemu: Filter firmware based on loader.readonly
 If the user included loader.readonly=no in the domain XML, we
 should not pick a firmware build that expects to work with
 loader.readonly=yes.
 https://bugzilla.redhat.com/show_bug.cgi?id=2196178
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit e96e322725f27d59ebcbd194c8da949b64bab9d6)
 https://bugzilla.redhat.com/show_bug.cgi?id=2196178
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c                      | 12 ++++++
 ...-auto-efi-rw-abi-update.x86_64-latest.args | 38 -----------------
 ...e-auto-efi-rw-abi-update.x86_64-latest.err |  1 +
 .../firmware-auto-efi-rw.x86_64-latest.args   | 38 -----------------
 .../firmware-auto-efi-rw.x86_64-latest.err    |  1 +
 ...ual-efi-rw-legacy-paths.x86_64-latest.args |  6 +--
 ...ual-efi-rw-modern-paths.x86_64-latest.args |  6 +--
 tests/qemuxml2argvtest.c                      |  4 +-
 ...e-auto-efi-rw-abi-update.x86_64-latest.xml | 41 -------------------
 .../firmware-auto-efi-rw.x86_64-latest.xml    |  8 +---
 ...nual-efi-rw-legacy-paths.x86_64-latest.xml |  3 +-
 ...nual-efi-rw-modern-paths.x86_64-latest.xml |  9 +---
 tests/qemuxml2xmltest.c                       |  1 -
 13 files changed, 24 insertions(+), 144 deletions(-)
 delete mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-rw-abi-update.x86_64-latest.args
 create mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-rw-abi-update.x86_64-latest.err
 delete mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-rw.x86_64-latest.args
 create mode 100644 tests/qemuxml2argvdata/firmware-auto-efi-rw.x86_64-latest.err
 delete mode 100644 tests/qemuxml2xmloutdata/firmware-auto-efi-rw-abi-update.x86_64-latest.xml
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 2c9a03e6cf..3538654913 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1295,6 +1295,13 @@ qemuFirmwareMatchDomain(const virDomainDef *def,
             }
         }
 +        if (loader &&
 +            loader->readonly == VIR_TRISTATE_BOOL_NO &&
 +            flash->mode != QEMU_FIRMWARE_FLASH_MODE_COMBINED) {
 +            VIR_DEBUG("Discarding readonly loader");
 +            return false;
 +        }
 +
         if (STRNEQ(flash->executable.format, "raw") &&
             STRNEQ(flash->executable.format, "qcow2")) {
             VIR_DEBUG("Discarding loader with unsupported flash format '%s'",
@@ -1593,6 +1600,11 @@ qemuFirmwareFillDomainLegacy(virQEMUDriver *driver,
         return 1;
     }
 +    if (loader->readonly == VIR_TRISTATE_BOOL_NO) {
 +        VIR_DEBUG("Ignoring legacy entries for read-write loader");
 +        return 1;
 +    }
 +
     if (loader->stateless == VIR_TRISTATE_BOOL_YES) {
         VIR_DEBUG("Ignoring legacy entries for stateless loader");
         return 1;
 diff --git a/tests/qemuxml2argvdata/firmware-auto-efi-rw-abi-update.x86_64-latest.args b/tests/qemuxml2argvdata/firmware-auto-efi-rw-abi-update.x86_64-latest.args
 deleted file mode 100644
 index 48f357cbf9..0000000000
 --- a/tests/qemuxml2argvdata/firmware-auto-efi-rw-abi-update.x86_64-latest.args
 +++ /dev/null
@@ -1,38 +0,0 @@
 -LC_ALL=C \
 -PATH=/bin \
 -HOME=/var/lib/libvirt/qemu/domain--1-guest \
 -USER=test \
 -LOGNAME=test \
 -XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
 -XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
 -XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -/usr/bin/qemu-system-x86_64 \
 --name guest=guest,debug-threads=on \
 --S \
 --object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 --blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
 --blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \
 --blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \
 --blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"raw","file":"libvirt-pflash1-storage"}' \
 --machine pc-q35-4.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,acpi=on \
 --accel kvm \
 --cpu qemu64 \
 --global driver=cfi.pflash01,property=secure,value=on \
 --m size=1048576k \
 --object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
 --overcommit mem-lock=off \
 --smp 1,sockets=1,cores=1,threads=1 \
 --uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
 --display none \
 --no-user-config \
 --nodefaults \
 --chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 --mon chardev=charmonitor,id=monitor,mode=control \
 --rtc base=utc \
 --no-shutdown \
 --boot strict=on \
 --audiodev '{"id":"audio1","driver":"none"}' \
 --global ICH9-LPC.noreboot=off \
 --watchdog-action reset \
 --sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 --msg timestamp=on
 diff --git a/tests/qemuxml2argvdata/firmware-auto-efi-rw-abi-update.x86_64-latest.err b/tests/qemuxml2argvdata/firmware-auto-efi-rw-abi-update.x86_64-latest.err
 new file mode 100644
 index 0000000000..4cfde1bd2e
 --- /dev/null
 +++ b/tests/qemuxml2argvdata/firmware-auto-efi-rw-abi-update.x86_64-latest.err
@@ -0,0 +1 @@
 +operation failed: Unable to find any firmware to satisfy 'efi'
 diff --git a/tests/qemuxml2argvdata/firmware-auto-efi-rw.x86_64-latest.args b/tests/qemuxml2argvdata/firmware-auto-efi-rw.x86_64-latest.args
 deleted file mode 100644
 index 48f357cbf9..0000000000
 --- a/tests/qemuxml2argvdata/firmware-auto-efi-rw.x86_64-latest.args
 +++ /dev/null
@@ -1,38 +0,0 @@
 -LC_ALL=C \
 -PATH=/bin \
 -HOME=/var/lib/libvirt/qemu/domain--1-guest \
 -USER=test \
 -LOGNAME=test \
 -XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
 -XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
 -XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -/usr/bin/qemu-system-x86_64 \
 --name guest=guest,debug-threads=on \
 --S \
 --object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 --blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
 --blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \
 --blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \
 --blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"raw","file":"libvirt-pflash1-storage"}' \
 --machine pc-q35-4.0,usb=off,smm=on,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,acpi=on \
 --accel kvm \
 --cpu qemu64 \
 --global driver=cfi.pflash01,property=secure,value=on \
 --m size=1048576k \
 --object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
 --overcommit mem-lock=off \
 --smp 1,sockets=1,cores=1,threads=1 \
 --uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
 --display none \
 --no-user-config \
 --nodefaults \
 --chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 --mon chardev=charmonitor,id=monitor,mode=control \
 --rtc base=utc \
 --no-shutdown \
 --boot strict=on \
 --audiodev '{"id":"audio1","driver":"none"}' \
 --global ICH9-LPC.noreboot=off \
 --watchdog-action reset \
 --sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 --msg timestamp=on
 diff --git a/tests/qemuxml2argvdata/firmware-auto-efi-rw.x86_64-latest.err b/tests/qemuxml2argvdata/firmware-auto-efi-rw.x86_64-latest.err
 new file mode 100644
 index 0000000000..4cfde1bd2e
 --- /dev/null
 +++ b/tests/qemuxml2argvdata/firmware-auto-efi-rw.x86_64-latest.err
@@ -0,0 +1 @@
 +operation failed: Unable to find any firmware to satisfy 'efi'
 diff --git a/tests/qemuxml2argvdata/firmware-manual-efi-rw-legacy-paths.x86_64-latest.args b/tests/qemuxml2argvdata/firmware-manual-efi-rw-legacy-paths.x86_64-latest.args
 index ccc279e4e3..85495da6f5 100644
 --- a/tests/qemuxml2argvdata/firmware-manual-efi-rw-legacy-paths.x86_64-latest.args
 +++ b/tests/qemuxml2argvdata/firmware-manual-efi-rw-legacy-paths.x86_64-latest.args
@@ -11,10 +11,8 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -S \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 -blockdev '{"driver":"file","filename":"/usr/share/OVMF/OVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
 --blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \
 --blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \
 --blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"raw","file":"libvirt-pflash1-storage"}' \
 --machine pc-q35-4.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,acpi=on \
 +-blockdev '{"node-name":"libvirt-pflash0-format","read-only":false,"driver":"raw","file":"libvirt-pflash0-storage"}' \
 +-machine pc-q35-4.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,acpi=on \
 -accel tcg \
 -cpu qemu64 \
 -m size=1048576k \
 diff --git a/tests/qemuxml2argvdata/firmware-manual-efi-rw-modern-paths.x86_64-latest.args b/tests/qemuxml2argvdata/firmware-manual-efi-rw-modern-paths.x86_64-latest.args
 index 2d45fa4792..c26daad29f 100644
 --- a/tests/qemuxml2argvdata/firmware-manual-efi-rw-modern-paths.x86_64-latest.args
 +++ b/tests/qemuxml2argvdata/firmware-manual-efi-rw-modern-paths.x86_64-latest.args
@@ -11,10 +11,8 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -S \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 -blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
 --blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \
 --blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \
 --blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"raw","file":"libvirt-pflash1-storage"}' \
 --machine pc-q35-4.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,acpi=on \
 +-blockdev '{"node-name":"libvirt-pflash0-format","read-only":false,"driver":"raw","file":"libvirt-pflash0-storage"}' \
 +-machine pc-q35-4.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,acpi=on \
 -accel tcg \
 -cpu qemu64 \
 -m size=1048576k \
 diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
 index b2d9e00350..370b26a023 100644
 --- a/tests/qemuxml2argvtest.c
 +++ b/tests/qemuxml2argvtest.c
@@ -1089,8 +1089,8 @@ mymain(void)
     DO_TEST_CAPS_LATEST("firmware-auto-efi");
     DO_TEST_CAPS_LATEST_ABI_UPDATE("firmware-auto-efi-abi-update");
     DO_TEST_CAPS_LATEST("firmware-auto-efi-stateless");
 -    DO_TEST_CAPS_LATEST("firmware-auto-efi-rw");
 -    DO_TEST_CAPS_LATEST_ABI_UPDATE("firmware-auto-efi-rw-abi-update");
 +    DO_TEST_CAPS_LATEST_FAILURE("firmware-auto-efi-rw");
 +    DO_TEST_CAPS_LATEST_ABI_UPDATE_PARSE_ERROR("firmware-auto-efi-rw-abi-update");
     DO_TEST_CAPS_LATEST("firmware-auto-efi-loader-secure");
     DO_TEST_CAPS_LATEST_ABI_UPDATE("firmware-auto-efi-loader-secure-abi-update");
     DO_TEST_CAPS_LATEST("firmware-auto-efi-loader-insecure");
 diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-rw-abi-update.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-rw-abi-update.x86_64-latest.xml
 deleted file mode 100644
 index 332d931ba1..0000000000
 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-rw-abi-update.x86_64-latest.xml
 +++ /dev/null
@@ -1,41 +0,0 @@
 -<domain type='kvm'>
 -  <name>guest</name>
 -  <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid>
 -  <memory unit='KiB'>1048576</memory>
 -  <currentMemory unit='KiB'>1048576</currentMemory>
 -  <vcpu placement='static'>1</vcpu>
 -  <os firmware='efi'>
 -    <type arch='x86_64' machine='pc-q35-4.0'>hvm</type>
 -    <firmware>
 -      <feature enabled='yes' name='enrolled-keys'/>
 -      <feature enabled='yes' name='secure-boot'/>
 -    </firmware>
 -    <loader readonly='yes' secure='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader>
 -    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
 -    <boot dev='hd'/>
 -  </os>
 -  <features>
 -    <acpi/>
 -    <smm state='on'/>
 -  </features>
 -  <cpu mode='custom' match='exact' check='none'>
 -    <model fallback='forbid'>qemu64</model>
 -  </cpu>
 -  <clock offset='utc'/>
 -  <on_poweroff>destroy</on_poweroff>
 -  <on_reboot>restart</on_reboot>
 -  <on_crash>destroy</on_crash>
 -  <devices>
 -    <emulator>/usr/bin/qemu-system-x86_64</emulator>
 -    <controller type='usb' index='0' model='none'/>
 -    <controller type='sata' index='0'>
 -      <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
 -    </controller>
 -    <controller type='pci' index='0' model='pcie-root'/>
 -    <input type='mouse' bus='ps2'/>
 -    <input type='keyboard' bus='ps2'/>
 -    <audio id='1' type='none'/>
 -    <watchdog model='itco' action='reset'/>
 -    <memballoon model='none'/>
 -  </devices>
 -</domain>
 diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-rw.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-rw.x86_64-latest.xml
 index 332d931ba1..c2d0c33a0b 100644
 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-rw.x86_64-latest.xml
 +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-rw.x86_64-latest.xml
@@ -6,17 +6,11 @@
   <vcpu placement='static'>1</vcpu>
   <os firmware='efi'>
     <type arch='x86_64' machine='pc-q35-4.0'>hvm</type>
 -    <firmware>
 -      <feature enabled='yes' name='enrolled-keys'/>
 -      <feature enabled='yes' name='secure-boot'/>
 -    </firmware>
 -    <loader readonly='yes' secure='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader>
 -    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
 +    <loader readonly='no'/>
     <boot dev='hd'/>
   </os>
   <features>
     <acpi/>
 -    <smm state='on'/>
   </features>
   <cpu mode='custom' match='exact' check='none'>
     <model fallback='forbid'>qemu64</model>
 diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-rw-legacy-paths.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-rw-legacy-paths.x86_64-latest.xml
 index cfd7a6824f..c5baedc42c 100644
 --- a/tests/qemuxml2xmloutdata/firmware-manual-efi-rw-legacy-paths.x86_64-latest.xml
 +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-rw-legacy-paths.x86_64-latest.xml
@@ -6,8 +6,7 @@
   <vcpu placement='static'>1</vcpu>
   <os>
     <type arch='x86_64' machine='pc-q35-4.0'>hvm</type>
 -    <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader>
 -    <nvram template='/usr/share/OVMF/OVMF_VARS.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
 +    <loader readonly='no' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader>
     <boot dev='hd'/>
   </os>
   <features>
 diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-rw-modern-paths.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-rw-modern-paths.x86_64-latest.xml
 index 468ca022ef..0d755a4306 100644
 --- a/tests/qemuxml2xmloutdata/firmware-manual-efi-rw-modern-paths.x86_64-latest.xml
 +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-rw-modern-paths.x86_64-latest.xml
@@ -4,14 +4,9 @@
   <memory unit='KiB'>1048576</memory>
   <currentMemory unit='KiB'>1048576</currentMemory>
   <vcpu placement='static'>1</vcpu>
 -  <os firmware='efi'>
 +  <os>
     <type arch='x86_64' machine='pc-q35-4.0'>hvm</type>
 -    <firmware>
 -      <feature enabled='no' name='enrolled-keys'/>
 -      <feature enabled='no' name='secure-boot'/>
 -    </firmware>
 -    <loader readonly='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader>
 -    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
 +    <loader readonly='no' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader>
     <boot dev='hd'/>
   </os>
   <features>
 diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c
 index d3d4e4e585..3f2ef10df7 100644
 --- a/tests/qemuxml2xmltest.c
 +++ b/tests/qemuxml2xmltest.c
@@ -901,7 +901,6 @@ mymain(void)
     DO_TEST_CAPS_LATEST_ABI_UPDATE("firmware-auto-efi-abi-update");
     DO_TEST_CAPS_LATEST("firmware-auto-efi-stateless");
     DO_TEST_CAPS_LATEST("firmware-auto-efi-rw");
 -    DO_TEST_CAPS_LATEST_ABI_UPDATE("firmware-auto-efi-rw-abi-update");
     DO_TEST_CAPS_LATEST("firmware-auto-efi-loader-secure");
     DO_TEST_CAPS_LATEST_ABI_UPDATE("firmware-auto-efi-loader-secure-abi-update");
     DO_TEST_CAPS_LATEST("firmware-auto-efi-loader-insecure");
 -- 
 2.42.0
--- a/SOURCES/libvirt-qemu-Fix-lookup-against-stateless-combined-pflash.patch
+++ b/SOURCES/libvirt-qemu-Fix-lookup-against-stateless-combined-pflash.patch
@ -0,0 +1,46 @@
 From f57a07068f7cc7ccdbf9814f9c69cbef1d2c9d6c Mon Sep 17 00:00:00 2001
 Message-ID: <f57a07068f7cc7ccdbf9814f9c69cbef1d2c9d6c.1692951632.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Fri, 26 May 2023 17:47:42 +0200
 Subject: [PATCH] qemu: Fix lookup against stateless/combined pflash
 Just like the more common split builds, these are of type
 QEMU_FIRMWARE_DEVICE_FLASH; however, they have no associated
 NVRAM template, so we can't access the corresponding structure
 member unconditionally or we'll trigger a crash.
 https://bugzilla.redhat.com/show_bug.cgi?id=2196178
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit ac76386edad3be2bbd6202a30063b9205011f5c5)
 https://bugzilla.redhat.com/show_bug.cgi?id=2196178
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 5f030ebce4..b1d342563b 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -971,9 +971,12 @@ qemuFirmwareMatchesPaths(const qemuFirmware *fw,
         if (loader && loader->path &&
             STRNEQ(loader->path, flash->executable.filename))
             return false;
 -        if (loader && loader->nvramTemplate &&
 -            STRNEQ(loader->nvramTemplate, flash->nvram_template.filename))
 -            return false;
 +        if (loader && loader->nvramTemplate) {
 +            if (flash->mode != QEMU_FIRMWARE_FLASH_MODE_SPLIT)
 +                return false;
 +            if (STRNEQ(loader->nvramTemplate, flash->nvram_template.filename))
 +                return false;
 +        }
         break;
     case QEMU_FIRMWARE_DEVICE_MEMORY:
         if (loader && loader->path &&
 -- 
 2.42.0
--- a/SOURCES/libvirt-qemu-Fix-return-value-for-qemuFirmwareFillDomainLegacy.patch
+++ b/SOURCES/libvirt-qemu-Fix-return-value-for-qemuFirmwareFillDomainLegacy.patch
@ -0,0 +1,48 @@
 From 1fefaa42f98530ed449ea9aa4863c4c1bc5327b5 Mon Sep 17 00:00:00 2001
 Message-ID: <1fefaa42f98530ed449ea9aa4863c4c1bc5327b5.1692951632.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Wed, 2 Aug 2023 17:18:32 +0200
 Subject: [PATCH] qemu: Fix return value for qemuFirmwareFillDomainLegacy()
 The documentation states that, just like the Modern() variant,
 this function should return 1 if a match wasn't found. It
 currently doesn't do that, and returns 0 instead.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit d917883b30f1d33f1df78394152e67b402b9c72e)
 https://bugzilla.redhat.com/show_bug.cgi?id=2196178
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index cf9a45dc39..5f030ebce4 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1575,17 +1575,17 @@ qemuFirmwareFillDomainLegacy(virQEMUDriver *driver,
     size_t i;
     if (!loader)
 -        return 0;
 +        return 1;
     if (loader->type != VIR_DOMAIN_LOADER_TYPE_PFLASH) {
         VIR_DEBUG("Ignoring legacy entries for '%s' loader",
                   virDomainLoaderTypeToString(loader->type));
 -        return 0;
 +        return 1;
     }
     if (loader->stateless == VIR_TRISTATE_BOOL_YES) {
         VIR_DEBUG("Ignoring legacy entries for stateless loader");
 -        return 0;
 +        return 1;
     }
     if (loader->format != VIR_STORAGE_FILE_RAW) {
 -- 
 2.42.0
--- a/SOURCES/libvirt-qemu-Generate-NVRAM-path-in-more-cases.patch
+++ b/SOURCES/libvirt-qemu-Generate-NVRAM-path-in-more-cases.patch
@ -0,0 +1,321 @@
 From e71463f711cef030989717f401d0399ec6870705 Mon Sep 17 00:00:00 2001
 Message-ID: <e71463f711cef030989717f401d0399ec6870705.1692951632.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Fri, 26 May 2023 14:40:02 +0200
 Subject: [PATCH] qemu: Generate NVRAM path in more cases
 Right now, we only generate it after finding a matching entry
 either among firmware descriptors or in the legacy firmware
 list.
 Even if the domain is configured to use a custom firmware build
 that we know nothing about, however, we should still automatically
 generate the NVRAM path instead of requiring the user to provide
 it manually.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit ccbb987707e282af8d7f8c0db47e70fdebab959f)
 https://bugzilla.redhat.com/show_bug.cgi?id=2196178
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_firmware.c                      | 52 +++++++++++--------
 ...loader-path-nonstandard.x86_64-latest.args | 37 +++++++++++++
 ...-loader-path-nonstandard.x86_64-latest.err |  1 -
 ...am-template-nonstandard.x86_64-latest.args | 37 +++++++++++++
 ...ram-template-nonstandard.x86_64-latest.err |  1 -
 tests/qemuxml2argvtest.c                      |  4 +-
 ...-loader-path-nonstandard.x86_64-latest.xml |  2 +-
 ...ram-template-nonstandard.x86_64-latest.xml |  2 +-
 8 files changed, 109 insertions(+), 27 deletions(-)
 create mode 100644 tests/qemuxml2argvdata/firmware-manual-efi-loader-path-nonstandard.x86_64-latest.args
 delete mode 100644 tests/qemuxml2argvdata/firmware-manual-efi-loader-path-nonstandard.x86_64-latest.err
 create mode 100644 tests/qemuxml2argvdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.args
 delete mode 100644 tests/qemuxml2argvdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.err
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index a9437b5b95..2c9a03e6cf 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -1053,7 +1053,7 @@ qemuFirmwareOSInterfaceTypeFromOsDefLoaderType(virDomainLoader type)
 /**
  * qemuFirmwareEnsureNVRAM:
  * @def: domain definition
 - * @cfg: QEMU driver configuration
 + * @driver: QEMU driver
  *
  * Make sure that a source for the NVRAM file exists, possibly by
  * creating it. This might involve automatically generating the
@@ -1061,15 +1061,24 @@ qemuFirmwareOSInterfaceTypeFromOsDefLoaderType(virDomainLoader type)
  */
 static void
 qemuFirmwareEnsureNVRAM(virDomainDef *def,
 -                        const virQEMUDriverConfig *cfg,
 -                        virStorageFileFormat format)
 +                        virQEMUDriver *driver)
 {
 +    g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver);
     virDomainLoaderDef *loader = def->os.loader;
     const char *ext = NULL;
     if (!loader)
         return;
 +    if (loader->type != VIR_DOMAIN_LOADER_TYPE_PFLASH)
 +        return;
 +
 +    if (loader->readonly != VIR_TRISTATE_BOOL_YES)
 +        return;
 +
 +    if (loader->stateless == VIR_TRISTATE_BOOL_YES)
 +        return;
 +
     /* If the source already exists and is fully specified, including
      * the path, leave it alone */
     if (loader->nvram && loader->nvram->path)
@@ -1080,11 +1089,11 @@ qemuFirmwareEnsureNVRAM(virDomainDef *def,
     loader->nvram = virStorageSourceNew();
     loader->nvram->type = VIR_STORAGE_TYPE_FILE;
 -    loader->nvram->format = format;
 +    loader->nvram->format = loader->format;
 -    if (format == VIR_STORAGE_FILE_RAW)
 +    if (loader->nvram->format == VIR_STORAGE_FILE_RAW)
         ext = ".fd";
 -    if (format == VIR_STORAGE_FILE_QCOW2)
 +    if (loader->nvram->format == VIR_STORAGE_FILE_QCOW2)
         ext = ".qcow2";
     loader->nvram->path = g_strdup_printf("%s/%s_VARS%s",
@@ -1347,8 +1356,7 @@ qemuFirmwareMatchDomain(const virDomainDef *def,
 static int
 -qemuFirmwareEnableFeaturesModern(virQEMUDriverConfig *cfg,
 -                                 virDomainDef *def,
 +qemuFirmwareEnableFeaturesModern(virDomainDef *def,
                                  const qemuFirmware *fw)
 {
     const qemuFirmwareMappingFlash *flash = &fw->mapping.data.flash;
@@ -1377,16 +1385,15 @@ qemuFirmwareEnableFeaturesModern(virQEMUDriverConfig *cfg,
         loader->path = g_strdup(flash->executable.filename);
         if (flash->mode == QEMU_FIRMWARE_FLASH_MODE_SPLIT) {
 -            if ((format = virStorageFileFormatTypeFromString(flash->nvram_template.format)) < 0)
 -                return -1;
 -
 -            qemuFirmwareEnsureNVRAM(def, cfg, format);
 -
 -            /* If the NVRAM is not a local path then we can't create or
 -             * reset it, so in that case filling in the nvramTemplate
 -             * field would be misleading */
 +            /* Only fill in nvramTemplate if the NVRAM location is already
 +             * known to be a local path or hasn't been provided, in which
 +             * case a local path will be generated by libvirt later.
 +             *
 +             * We can't create or reset non-local NVRAM files, so filling
 +             * in nvramTemplate for those would be misleading */
             VIR_FREE(loader->nvramTemplate);
 -            if (loader->nvram && virStorageSourceIsLocalStorage(loader->nvram)) {
 +            if (!loader->nvram ||
 +                (loader->nvram && virStorageSourceIsLocalStorage(loader->nvram))) {
                 loader->nvramTemplate = g_strdup(flash->nvram_template.filename);
             }
         }
@@ -1608,6 +1615,7 @@ qemuFirmwareFillDomainLegacy(virQEMUDriver *driver,
         loader->type = VIR_DOMAIN_LOADER_TYPE_PFLASH;
         loader->readonly = VIR_TRISTATE_BOOL_YES;
 +        loader->format = VIR_STORAGE_FILE_RAW;
         /* Only use the default template path if one hasn't been
          * provided by the user.
@@ -1634,8 +1642,6 @@ qemuFirmwareFillDomainLegacy(virQEMUDriver *driver,
         if (!loader->nvramTemplate)
             loader->nvramTemplate = g_strdup(cfg->firmwares[i]->nvram);
 -        qemuFirmwareEnsureNVRAM(def, cfg, VIR_STORAGE_FILE_RAW);
 -
         VIR_DEBUG("decided on firmware '%s' template '%s'",
                   loader->path, NULLSTR(loader->nvramTemplate));
@@ -1664,7 +1670,6 @@ static int
 qemuFirmwareFillDomainModern(virQEMUDriver *driver,
                              virDomainDef *def)
 {
 -    g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver);
     g_auto(GStrv) paths = NULL;
     qemuFirmware **firmwares = NULL;
     ssize_t nfirmwares = 0;
@@ -1695,7 +1700,7 @@ qemuFirmwareFillDomainModern(virQEMUDriver *driver,
      * likely that admin/FW manufacturer messed up. */
     qemuFirmwareSanityCheck(theone, paths[i]);
 -    if (qemuFirmwareEnableFeaturesModern(cfg, def, theone) < 0)
 +    if (qemuFirmwareEnableFeaturesModern(def, theone) < 0)
         goto cleanup;
     ret = 0;
@@ -1802,6 +1807,11 @@ qemuFirmwareFillDomain(virQEMUDriver *driver,
         }
     }
 +    /* Always ensure that the NVRAM path is present, even if we
 +     * haven't found a match: the configuration might simply be
 +     * referring to a custom firmware build */
 +    qemuFirmwareEnsureNVRAM(def, driver);
 +
     return 0;
 }
 diff --git a/tests/qemuxml2argvdata/firmware-manual-efi-loader-path-nonstandard.x86_64-latest.args b/tests/qemuxml2argvdata/firmware-manual-efi-loader-path-nonstandard.x86_64-latest.args
 new file mode 100644
 index 0000000000..4e989344b3
 --- /dev/null
 +++ b/tests/qemuxml2argvdata/firmware-manual-efi-loader-path-nonstandard.x86_64-latest.args
@@ -0,0 +1,37 @@
 +LC_ALL=C \
 +PATH=/bin \
 +HOME=/var/lib/libvirt/qemu/domain--1-guest \
 +USER=test \
 +LOGNAME=test \
 +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
 +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
 +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 +/usr/bin/qemu-system-x86_64 \
 +-name guest=guest,debug-threads=on \
 +-S \
 +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 +-blockdev '{"driver":"file","filename":"/path/to/OVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
 +-blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \
 +-blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \
 +-blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"raw","file":"libvirt-pflash1-storage"}' \
 +-machine pc-q35-4.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,acpi=on \
 +-accel tcg \
 +-cpu qemu64 \
 +-m size=1048576k \
 +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
 +-overcommit mem-lock=off \
 +-smp 1,sockets=1,cores=1,threads=1 \
 +-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
 +-display none \
 +-no-user-config \
 +-nodefaults \
 +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 +-mon chardev=charmonitor,id=monitor,mode=control \
 +-rtc base=utc \
 +-no-shutdown \
 +-boot strict=on \
 +-audiodev '{"id":"audio1","driver":"none"}' \
 +-global ICH9-LPC.noreboot=off \
 +-watchdog-action reset \
 +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 +-msg timestamp=on
 diff --git a/tests/qemuxml2argvdata/firmware-manual-efi-loader-path-nonstandard.x86_64-latest.err b/tests/qemuxml2argvdata/firmware-manual-efi-loader-path-nonstandard.x86_64-latest.err
 deleted file mode 100644
 index 6a1618a1aa..0000000000
 --- a/tests/qemuxml2argvdata/firmware-manual-efi-loader-path-nonstandard.x86_64-latest.err
 +++ /dev/null
@@ -1 +0,0 @@
 -internal error: argument key 'filename' must not have null value
 diff --git a/tests/qemuxml2argvdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.args b/tests/qemuxml2argvdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.args
 new file mode 100644
 index 0000000000..1dc1993285
 --- /dev/null
 +++ b/tests/qemuxml2argvdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.args
@@ -0,0 +1,37 @@
 +LC_ALL=C \
 +PATH=/bin \
 +HOME=/var/lib/libvirt/qemu/domain--1-guest \
 +USER=test \
 +LOGNAME=test \
 +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
 +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
 +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 +/usr/bin/qemu-system-x86_64 \
 +-name guest=guest,debug-threads=on \
 +-S \
 +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 +-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
 +-blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \
 +-blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \
 +-blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"raw","file":"libvirt-pflash1-storage"}' \
 +-machine pc-q35-4.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format,acpi=on \
 +-accel kvm \
 +-cpu qemu64 \
 +-m size=1048576k \
 +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \
 +-overcommit mem-lock=off \
 +-smp 1,sockets=1,cores=1,threads=1 \
 +-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
 +-display none \
 +-no-user-config \
 +-nodefaults \
 +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 +-mon chardev=charmonitor,id=monitor,mode=control \
 +-rtc base=utc \
 +-no-shutdown \
 +-boot strict=on \
 +-audiodev '{"id":"audio1","driver":"none"}' \
 +-global ICH9-LPC.noreboot=off \
 +-watchdog-action reset \
 +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 +-msg timestamp=on
 diff --git a/tests/qemuxml2argvdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.err b/tests/qemuxml2argvdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.err
 deleted file mode 100644
 index 6a1618a1aa..0000000000
 --- a/tests/qemuxml2argvdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.err
 +++ /dev/null
@@ -1 +0,0 @@
 -internal error: argument key 'filename' must not have null value
 diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
 index 95842140f3..b2d9e00350 100644
 --- a/tests/qemuxml2argvtest.c
 +++ b/tests/qemuxml2argvtest.c
@@ -1053,13 +1053,13 @@ mymain(void)
     DO_TEST_CAPS_LATEST("firmware-manual-efi-rw-implicit");
     DO_TEST_CAPS_LATEST("firmware-manual-efi-loader-secure");
     DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-manual-efi-loader-no-path");
 -    DO_TEST_CAPS_LATEST_FAILURE("firmware-manual-efi-loader-path-nonstandard");
 +    DO_TEST_CAPS_LATEST("firmware-manual-efi-loader-path-nonstandard");
     DO_TEST_CAPS_LATEST("firmware-manual-efi-secboot");
     DO_TEST_CAPS_LATEST("firmware-manual-efi-no-enrolled-keys");
     DO_TEST_CAPS_LATEST("firmware-manual-efi-no-secboot");
     DO_TEST_CAPS_LATEST("firmware-manual-efi-stateless");
     DO_TEST_CAPS_LATEST("firmware-manual-efi-nvram-template");
 -    DO_TEST_CAPS_LATEST_FAILURE("firmware-manual-efi-nvram-template-nonstandard");
 +    DO_TEST_CAPS_LATEST("firmware-manual-efi-nvram-template-nonstandard");
     DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-manual-efi-nvram-template-stateless");
     DO_TEST_CAPS_LATEST("firmware-manual-efi-nvram-network-iscsi");
     DO_TEST_CAPS_LATEST("firmware-manual-efi-nvram-network-nbd");
 diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-loader-path-nonstandard.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-loader-path-nonstandard.x86_64-latest.xml
 index 5940bfd0ea..039c485706 100644
 --- a/tests/qemuxml2xmloutdata/firmware-manual-efi-loader-path-nonstandard.x86_64-latest.xml
 +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-loader-path-nonstandard.x86_64-latest.xml
@@ -7,7 +7,7 @@
   <os>
     <type arch='x86_64' machine='pc-q35-4.0'>hvm</type>
     <loader readonly='yes' type='pflash'>/path/to/OVMF_CODE.fd</loader>
 -    <nvram template='/path/to/OVMF_VARS.fd'/>
 +    <nvram template='/path/to/OVMF_VARS.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
     <boot dev='hd'/>
   </os>
   <features>
 diff --git a/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml b/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml
 index 816e285621..5433650516 100644
 --- a/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml
 +++ b/tests/qemuxml2xmloutdata/firmware-manual-efi-nvram-template-nonstandard.x86_64-latest.xml
@@ -7,7 +7,7 @@
   <os>
     <type arch='x86_64' machine='pc-q35-4.0'>hvm</type>
     <loader readonly='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader>
 -    <nvram template='/path/to/OVMF_VARS.fd'/>
 +    <nvram template='/path/to/OVMF_VARS.fd'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
     <boot dev='hd'/>
   </os>
   <features>
 -- 
 2.42.0
--- a/SOURCES/libvirt-qemu-Ignore-missing-vm.unprivileged_userfaultfd-sysctl.patch
+++ b/SOURCES/libvirt-qemu-Ignore-missing-vm.unprivileged_userfaultfd-sysctl.patch
@ -1,38 +0,0 @@
 From 08fef741d85ecfb3493c47f5f1334f91c30e3233 Mon Sep 17 00:00:00 2001
 Message-Id: <08fef741d85ecfb3493c47f5f1334f91c30e3233@dist-git>
 From: Jiri Denemark <jdenemar@redhat.com>
 Date: Wed, 9 Feb 2022 11:08:42 +0100
 Subject: [PATCH] qemu: Ignore missing vm.unprivileged_userfaultfd sysctl
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Older kernels did not support this sysctl, but they did not restrict
 userfaultfd in any way so everything worked as if
 vm.unprivileged_userfaultfd was set to 1. Thus we can safely ignore
 errors when setting the value.
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit 558f00397a0d46ad22bf53a22a40ed6fc4fdb5eb)
 https://bugzilla.redhat.com/show_bug.cgi?id=2148578
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/qemu/postcopy-migration.sysctl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/qemu/postcopy-migration.sysctl b/src/qemu/postcopy-migration.sysctl
 index aa8f015ae0..db3f11e49f 100644
 --- a/src/qemu/postcopy-migration.sysctl
 +++ b/src/qemu/postcopy-migration.sysctl
@@ -3,4 +3,4 @@
 # privileged processes.
 # It can be safely overridden by a file in /etc/sysctl.d/ in case post-copy
 # migration is not used on the host.
 -vm.unprivileged_userfaultfd = 1
 +-vm.unprivileged_userfaultfd = 1
 -- 
 2.39.0
--- a/SOURCES/libvirt-qemu-Make-struct-_qemuMonitorMessage-private.patch
+++ b/SOURCES/libvirt-qemu-Make-struct-_qemuMonitorMessage-private.patch
@ -1,105 +0,0 @@
 From 85b7d8295d72214b08f0fff93c473baaa88a569b Mon Sep 17 00:00:00 2001
 Message-Id: <85b7d8295d72214b08f0fff93c473baaa88a569b@dist-git>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Mon, 14 Feb 2022 15:57:21 +0100
 Subject: [PATCH] qemu: Make 'struct _qemuMonitorMessage' private
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Move the declaration of the struct into 'qemu_monitor_priv.h' as other
 code has no business in peeking into the monitor messages.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit f9ae469a6ebb17e0990096e826f049c1c46cd760)
 https://bugzilla.redhat.com/show_bug.cgi?id=2170472
 ---
 src/qemu/qemu_monitor.h      | 14 --------------
 src/qemu/qemu_monitor_json.c |  3 +++
 src/qemu/qemu_monitor_priv.h | 16 ++++++++++++++++
 tests/qemucapsprobemock.c    |  3 +++
 4 files changed, 22 insertions(+), 14 deletions(-)
 diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h
 index a4a4edf5a6..d00967d84f 100644
 --- a/src/qemu/qemu_monitor.h
 +++ b/src/qemu/qemu_monitor.h
@@ -34,21 +34,7 @@
 #include "virenum.h"
 typedef struct _qemuMonitor qemuMonitor;
 -
 typedef struct _qemuMonitorMessage qemuMonitorMessage;
 -struct _qemuMonitorMessage {
 -    int txFD;
 -
 -    const char *txBuffer;
 -    int txOffset;
 -    int txLength;
 -
 -    /* Used by the JSON monitor to hold reply / error */
 -    void *rxObject;
 -
 -    /* True if rxObject is ready, or a fatal error occurred on the monitor channel */
 -    bool finished;
 -};
 typedef enum {
     QEMU_MONITOR_EVENT_PANIC_INFO_TYPE_NONE = 0,
 diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
 index 34a46b9b41..7d8755246f 100644
 --- a/src/qemu/qemu_monitor_json.c
 +++ b/src/qemu/qemu_monitor_json.c
@@ -44,6 +44,9 @@
 # include "libvirt_qemu_probes.h"
 #endif
 +#define LIBVIRT_QEMU_MONITOR_PRIV_H_ALLOW
 +#include "qemu_monitor_priv.h"
 +
 #define VIR_FROM_THIS VIR_FROM_QEMU
 VIR_LOG_INIT("qemu.qemu_monitor_json");
 diff --git a/src/qemu/qemu_monitor_priv.h b/src/qemu/qemu_monitor_priv.h
 index 31bb3526b9..6115f830de 100644
 --- a/src/qemu/qemu_monitor_priv.h
 +++ b/src/qemu/qemu_monitor_priv.h
@@ -24,5 +24,21 @@
 #include "qemu_monitor.h"
 +
 +struct _qemuMonitorMessage {
 +    int txFD;
 +
 +    const char *txBuffer;
 +    int txOffset;
 +    int txLength;
 +
 +    /* Used by the JSON monitor to hold reply / error */
 +    void *rxObject;
 +
 +    /* True if rxObject is ready, or a fatal error occurred on the monitor channel */
 +    bool finished;
 +};
 +
 +
 void
 qemuMonitorResetCommandID(qemuMonitor *mon);
 diff --git a/tests/qemucapsprobemock.c b/tests/qemucapsprobemock.c
 index 915036d178..2717ed5d84 100644
 --- a/tests/qemucapsprobemock.c
 +++ b/tests/qemucapsprobemock.c
@@ -25,6 +25,9 @@
 #include "qemu/qemu_monitor.h"
 #include "qemu/qemu_monitor_json.h"
 +#define LIBVIRT_QEMU_MONITOR_PRIV_H_ALLOW
 +#include "qemu/qemu_monitor_priv.h"
 +
 #define REAL_SYM(realFunc) \
     do { \
         if (!realFunc && !(realFunc = dlsym(RTLD_NEXT, __FUNCTION__))) { \
 -- 
 2.40.1
--- a/SOURCES/libvirt-qemu-Match-NVRAM-template-extension-for-new-domains.patch
+++ b/SOURCES/libvirt-qemu-Match-NVRAM-template-extension-for-new-domains.patch
@ -0,0 +1,178 @@
 From 6dbe828752378e2215d4fd4fca65c94372ad0cf2 Mon Sep 17 00:00:00 2001
 Message-ID: <6dbe828752378e2215d4fd4fca65c94372ad0cf2.1692951632.git.jdenemar@redhat.com>
 From: Andrea Bolognani <abologna@redhat.com>
 Date: Tue, 30 May 2023 18:24:40 +0200
 Subject: [PATCH] qemu: Match NVRAM template extension for new domains
 Keep things consistent by using the same file extension for the
 generated NVRAM path as the NVRAM template.
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit b845e376a45a8e93f933a4a41068a9ce27adf755)
 https://bugzilla.redhat.com/show_bug.cgi?id=2196178
 Signed-off-by: Andrea Bolognani <abologna@redhat.com>
 ---
 src/qemu/qemu_domain.c                        |  2 +-
 src/qemu/qemu_firmware.c                      | 32 ++++++++++++++++---
 src/qemu/qemu_firmware.h                      |  3 +-
 src/qemu/qemu_process.c                       |  2 +-
 ...-loader-raw-abi-update.aarch64-latest.args |  2 +-
 ...t-loader-raw-abi-update.aarch64-latest.xml |  2 +-
 6 files changed, 33 insertions(+), 10 deletions(-)
 diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
 index 94587638c3..3bb3e5fdfa 100644
 --- a/src/qemu/qemu_domain.c
 +++ b/src/qemu/qemu_domain.c
@@ -4505,7 +4505,7 @@ qemuDomainDefBootPostParse(virDomainDef *def,
      * to start the domain, qemuFirmwareFillDomain() will be run
      * again, fail in the same way, and at that point we'll have a
      * chance to inform the user of any issues */
 -    if (qemuFirmwareFillDomain(driver, def) < 0) {
 +    if (qemuFirmwareFillDomain(driver, def, abiUpdate) < 0) {
         if (abiUpdate) {
             return -1;
         } else {
 diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c
 index 3538654913..ebaf32cf71 100644
 --- a/src/qemu/qemu_firmware.c
 +++ b/src/qemu/qemu_firmware.c
@@ -32,6 +32,7 @@
 #include "virlog.h"
 #include "viralloc.h"
 #include "virenum.h"
 +#include "virstring.h"
 #define VIR_FROM_THIS VIR_FROM_QEMU
@@ -1054,6 +1055,7 @@ qemuFirmwareOSInterfaceTypeFromOsDefLoaderType(virDomainLoader type)
  * qemuFirmwareEnsureNVRAM:
  * @def: domain definition
  * @driver: QEMU driver
 + * @abiUpdate: whether a new domain is being defined
  *
  * Make sure that a source for the NVRAM file exists, possibly by
  * creating it. This might involve automatically generating the
@@ -1061,7 +1063,8 @@ qemuFirmwareOSInterfaceTypeFromOsDefLoaderType(virDomainLoader type)
  */
 static void
 qemuFirmwareEnsureNVRAM(virDomainDef *def,
 -                        virQEMUDriver *driver)
 +                        virQEMUDriver *driver,
 +                        bool abiUpdate)
 {
     g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver);
     virDomainLoaderDef *loader = def->os.loader;
@@ -1091,8 +1094,25 @@ qemuFirmwareEnsureNVRAM(virDomainDef *def,
     loader->nvram->type = VIR_STORAGE_TYPE_FILE;
     loader->nvram->format = loader->format;
 -    if (loader->nvram->format == VIR_STORAGE_FILE_RAW)
 -        ext = ".fd";
 +    if (loader->nvram->format == VIR_STORAGE_FILE_RAW) {
 +        /* The extension used by raw edk2 builds has historically
 +         * been .fd, but more recent aarch64 builds have started
 +         * using the .raw extension instead.
 +         *
 +         * If we're defining a new domain, we should try to match the
 +         * extension for the file backing its NVRAM store with the
 +         * one used by the template to keep things nice and
 +         * consistent.
 +         *
 +         * If we're loading an existing domain, however, we need to
 +         * stick with the .fd extension to ensure compatibility */
 +        if (abiUpdate &&
 +            loader->nvramTemplate &&
 +            virStringHasSuffix(loader->nvramTemplate, ".raw"))
 +            ext = ".raw";
 +        else
 +            ext = ".fd";
 +    }
     if (loader->nvram->format == VIR_STORAGE_FILE_QCOW2)
         ext = ".qcow2";
@@ -1729,6 +1749,7 @@ qemuFirmwareFillDomainModern(virQEMUDriver *driver,
  * qemuFirmwareFillDomain:
  * @driver: QEMU driver
  * @def: domain definition
 + * @abiUpdate: whether a new domain is being defined
  *
  * Perform firmware selection.
  *
@@ -1752,7 +1773,8 @@ qemuFirmwareFillDomainModern(virQEMUDriver *driver,
  */
 int
 qemuFirmwareFillDomain(virQEMUDriver *driver,
 -                       virDomainDef *def)
 +                       virDomainDef *def,
 +                       bool abiUpdate)
 {
     virDomainLoaderDef *loader = def->os.loader;
     virStorageSource *nvram = loader ? loader->nvram : NULL;
@@ -1822,7 +1844,7 @@ qemuFirmwareFillDomain(virQEMUDriver *driver,
     /* Always ensure that the NVRAM path is present, even if we
      * haven't found a match: the configuration might simply be
      * referring to a custom firmware build */
 -    qemuFirmwareEnsureNVRAM(def, driver);
 +    qemuFirmwareEnsureNVRAM(def, driver, abiUpdate);
     return 0;
 }
 diff --git a/src/qemu/qemu_firmware.h b/src/qemu/qemu_firmware.h
 index 1ce0920713..39572d979d 100644
 --- a/src/qemu/qemu_firmware.h
 +++ b/src/qemu/qemu_firmware.h
@@ -44,7 +44,8 @@ qemuFirmwareFetchConfigs(char ***firmwares,
 int
 qemuFirmwareFillDomain(virQEMUDriver *driver,
 -                       virDomainDef *def);
 +                       virDomainDef *def,
 +                       bool abiUpdate);
 int
 qemuFirmwareGetSupported(const char *machine,
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index db06991450..32fe46dae8 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -6706,7 +6706,7 @@ qemuProcessPrepareDomain(virQEMUDriver *driver,
         return -1;
     VIR_DEBUG("Prepare bios/uefi paths");
 -    if (qemuFirmwareFillDomain(driver, vm->def) < 0)
 +    if (qemuFirmwareFillDomain(driver, vm->def, false) < 0)
         return -1;
     if (qemuDomainInitializePflashStorageSource(vm, cfg) < 0)
         return -1;
 diff --git a/tests/qemuxml2argvdata/firmware-auto-efi-format-loader-raw-abi-update.aarch64-latest.args b/tests/qemuxml2argvdata/firmware-auto-efi-format-loader-raw-abi-update.aarch64-latest.args
 index eb5cd8d5fc..3e319a29bf 100644
 --- a/tests/qemuxml2argvdata/firmware-auto-efi-format-loader-raw-abi-update.aarch64-latest.args
 +++ b/tests/qemuxml2argvdata/firmware-auto-efi-format-loader-raw-abi-update.aarch64-latest.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
 -blockdev '{"driver":"file","filename":"/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.raw","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \
 -blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \
 --blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \
 +-blockdev '{"driver":"file","filename":"/var/lib/libvirt/qemu/nvram/guest_VARS.raw","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \
 -blockdev '{"node-name":"libvirt-pflash1-format","read-only":false,"driver":"raw","file":"libvirt-pflash1-storage"}' \
 -machine virt-4.0,usb=off,gic-version=2,dump-guest-core=off,memory-backend=mach-virt.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-pflash1-format \
 -accel tcg \
 diff --git a/tests/qemuxml2xmloutdata/firmware-auto-efi-format-loader-raw-abi-update.aarch64-latest.xml b/tests/qemuxml2xmloutdata/firmware-auto-efi-format-loader-raw-abi-update.aarch64-latest.xml
 index 38c680fabd..ee22b16831 100644
 --- a/tests/qemuxml2xmloutdata/firmware-auto-efi-format-loader-raw-abi-update.aarch64-latest.xml
 +++ b/tests/qemuxml2xmloutdata/firmware-auto-efi-format-loader-raw-abi-update.aarch64-latest.xml
@@ -11,7 +11,7 @@
       <feature enabled='no' name='secure-boot'/>
     </firmware>
     <loader readonly='yes' type='pflash'>/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.raw</loader>
 -    <nvram template='/usr/share/edk2/aarch64/vars-template-pflash.raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.fd</nvram>
 +    <nvram template='/usr/share/edk2/aarch64/vars-template-pflash.raw'>/var/lib/libvirt/qemu/nvram/guest_VARS.raw</nvram>
     <boot dev='hd'/>
   </os>
   <features>
 -- 
 2.42.0
--- a/SOURCES/libvirt-qemu-S390-does-not-provide-physical-address-size.patch
+++ b/SOURCES/libvirt-qemu-S390-does-not-provide-physical-address-size.patch
@ -0,0 +1,175 @@
 From 5af7ae809ed21678c265a9559c9f70b90dcd31d9 Mon Sep 17 00:00:00 2001
 Message-ID: <5af7ae809ed21678c265a9559c9f70b90dcd31d9.1689974710.git.jdenemar@redhat.com>
 From: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Date: Fri, 14 Jul 2023 16:38:14 +0200
 Subject: [PATCH] qemu: S390 does not provide physical address size
 Commit be1b7d5b18 introduced parsing /proc/cpuinfo for "address size"
 which is not including on S390 and therefore reports an internal error.
 Lets remove the parsing on S390.
 Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
 Reviewed-by: Collin Walling <walling@linux.ibm.com>
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 8417c1394cd4deccee07235d4f7b2c54b774b08d)
 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2224016
 Signed-off-by: Boris Fiuczynski <bfiuczyn@redhat.com>
 ---
 src/cpu/cpu_x86.c                         |  2 +-
 src/qemu/qemu_capabilities.c              |  2 +-
 src/util/virhostcpu.c                     | 12 ++++++++++--
 src/util/virhostcpu.h                     |  3 ++-
 tests/domaincapsdata/qemu_4.2.0.s390x.xml |  1 -
 tests/domaincapsdata/qemu_5.2.0.s390x.xml |  1 -
 tests/domaincapsdata/qemu_6.0.0.s390x.xml |  1 -
 tests/domaincapsdata/qemu_8.1.0.s390x.xml |  1 -
 tests/domaincapsmock.c                    |  8 ++++++--
 9 files changed, 20 insertions(+), 11 deletions(-)
 diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c
 index 8d371d5501..3c0163c4d1 100644
 --- a/src/cpu/cpu_x86.c
 +++ b/src/cpu/cpu_x86.c
@@ -2795,7 +2795,7 @@ virCPUx86GetHost(virCPUDef *cpu,
         VIR_DEBUG("Host CPU does not support invariant TSC");
     }
 -    if (virHostCPUGetPhysAddrSize(&addrsz) == 0) {
 +    if (virHostCPUGetPhysAddrSize(cpuData->arch, &addrsz) == 0) {
         virCPUMaxPhysAddrDef *addr = g_new0(virCPUMaxPhysAddrDef, 1);
         addr->bits = addrsz;
 diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
 index 338608f0a2..85ea879f0b 100644
 --- a/src/qemu/qemu_capabilities.c
 +++ b/src/qemu/qemu_capabilities.c
@@ -3911,7 +3911,7 @@ virQEMUCapsInitHostCPUModel(virQEMUCaps *qemuCaps,
     }
     if (virQEMUCapsTypeIsAccelerated(type))
 -        virHostCPUGetPhysAddrSize(&physAddrSize);
 +        virHostCPUGetPhysAddrSize(hostArch, &physAddrSize);
     virQEMUCapsSetHostModel(qemuCaps, type, physAddrSize, cpu, migCPU, fullCPU);
 diff --git a/src/util/virhostcpu.c b/src/util/virhostcpu.c
 index 19195a1470..a15731e9ea 100644
 --- a/src/util/virhostcpu.c
 +++ b/src/util/virhostcpu.c
@@ -1646,10 +1646,17 @@ virHostCPUGetSignature(char **signature)
 }
 int
 -virHostCPUGetPhysAddrSize(unsigned int *size)
 +virHostCPUGetPhysAddrSize(const virArch hostArch,
 +                          unsigned int *size)
 {
     g_autoptr(FILE) cpuinfo = NULL;
 +    if (ARCH_IS_S390(hostArch)) {
 +        /* Ensure size is set to 0 as physical address size is unknown */
 +        *size = 0;
 +        return 0;
 +    }
 +
     if (!(cpuinfo = fopen(CPUINFO_PATH, "r"))) {
         virReportSystemError(errno, _("Failed to open cpuinfo file '%1$s'"),
                              CPUINFO_PATH);
@@ -1669,7 +1676,8 @@ virHostCPUGetSignature(char **signature)
 }
 int
 -virHostCPUGetPhysAddrSize(unsigned int *size G_GNUC_UNUSED)
 +virHostCPUGetPhysAddrSize(const virArch hostArch G_GNUC_UNUSED,
 +                          unsigned int *size G_GNUC_UNUSED)
 {
     errno = ENOSYS;
     return -1;
 diff --git a/src/util/virhostcpu.h b/src/util/virhostcpu.h
 index 5232fee36d..5f0d43e069 100644
 --- a/src/util/virhostcpu.h
 +++ b/src/util/virhostcpu.h
@@ -87,7 +87,8 @@ virHostCPUTscInfo *virHostCPUGetTscInfo(void);
 int virHostCPUGetSignature(char **signature);
 -int virHostCPUGetPhysAddrSize(unsigned int *size);
 +int virHostCPUGetPhysAddrSize(const virArch hostArch,
 +                              unsigned int *size);
 int virHostCPUGetHaltPollTime(pid_t pid,
                               unsigned long long *haltPollSuccess,
 diff --git a/tests/domaincapsdata/qemu_4.2.0.s390x.xml b/tests/domaincapsdata/qemu_4.2.0.s390x.xml
 index da271825f9..2566f42997 100644
 --- a/tests/domaincapsdata/qemu_4.2.0.s390x.xml
 +++ b/tests/domaincapsdata/qemu_4.2.0.s390x.xml
@@ -38,7 +38,6 @@
     </mode>
     <mode name='host-model' supported='yes'>
       <model fallback='forbid'>gen15a-base</model>
 -      <maxphysaddr mode='passthrough' limit='64'/>
       <feature policy='require' name='aen'/>
       <feature policy='require' name='cmmnt'/>
       <feature policy='require' name='vxpdeh'/>
 diff --git a/tests/domaincapsdata/qemu_5.2.0.s390x.xml b/tests/domaincapsdata/qemu_5.2.0.s390x.xml
 index 99faaad866..12f38d3638 100644
 --- a/tests/domaincapsdata/qemu_5.2.0.s390x.xml
 +++ b/tests/domaincapsdata/qemu_5.2.0.s390x.xml
@@ -38,7 +38,6 @@
     </mode>
     <mode name='host-model' supported='yes'>
       <model fallback='forbid'>gen15a-base</model>
 -      <maxphysaddr mode='passthrough' limit='64'/>
       <feature policy='require' name='aen'/>
       <feature policy='require' name='cmmnt'/>
       <feature policy='require' name='vxpdeh'/>
 diff --git a/tests/domaincapsdata/qemu_6.0.0.s390x.xml b/tests/domaincapsdata/qemu_6.0.0.s390x.xml
 index df3708f801..703f729ae2 100644
 --- a/tests/domaincapsdata/qemu_6.0.0.s390x.xml
 +++ b/tests/domaincapsdata/qemu_6.0.0.s390x.xml
@@ -38,7 +38,6 @@
     </mode>
     <mode name='host-model' supported='yes'>
       <model fallback='forbid'>gen15a-base</model>
 -      <maxphysaddr mode='passthrough' limit='64'/>
       <feature policy='require' name='aen'/>
       <feature policy='require' name='cmmnt'/>
       <feature policy='require' name='vxpdeh'/>
 diff --git a/tests/domaincapsdata/qemu_8.1.0.s390x.xml b/tests/domaincapsdata/qemu_8.1.0.s390x.xml
 index d70b639503..3562e96965 100644
 --- a/tests/domaincapsdata/qemu_8.1.0.s390x.xml
 +++ b/tests/domaincapsdata/qemu_8.1.0.s390x.xml
@@ -38,7 +38,6 @@
     </mode>
     <mode name='host-model' supported='yes'>
       <model fallback='forbid'>gen16a-base</model>
 -      <maxphysaddr mode='passthrough' limit='64'/>
       <feature policy='require' name='nnpa'/>
       <feature policy='require' name='aen'/>
       <feature policy='require' name='cmmnt'/>
 diff --git a/tests/domaincapsmock.c b/tests/domaincapsmock.c
 index cecb333602..6ae0c4ad45 100644
 --- a/tests/domaincapsmock.c
 +++ b/tests/domaincapsmock.c
@@ -37,9 +37,13 @@ virHostCPUGetMicrocodeVersion(virArch hostArch G_GNUC_UNUSED)
 }
 int
 -virHostCPUGetPhysAddrSize(unsigned int *size)
 +virHostCPUGetPhysAddrSize(const virArch hostArch,
 +                          unsigned int *size)
 {
 -    *size = 64;
 +    if (ARCH_IS_S390(hostArch))
 +        *size = 0;
 +    else
 +        *size = 64;
     return 0;
 }
 -- 
 2.41.0
--- a/SOURCES/libvirt-qemu-Validate-domain-definition-even-on-migration.patch
+++ b/SOURCES/libvirt-qemu-Validate-domain-definition-even-on-migration.patch
@ -1,72 +0,0 @@
 From fa7cff4e684ededd184976d4fdf217cc155825b8 Mon Sep 17 00:00:00 2001
 Message-Id: <fa7cff4e684ededd184976d4fdf217cc155825b8@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Mon, 31 Jan 2022 12:55:47 +0100
 Subject: [PATCH] qemu: Validate domain definition even on migration
 When we are about to spawn QEMU, we validate the domain
 definition against qemuCaps. Except when domain is/was already
 running before (i.e. on incoming migration, snapshots, resume
 from a file). However, especially on incoming migration it may
 happen that the destination QEMU is different to the source
 QEMU, e.g. the destination QEMU may have some devices disabled.
 And we have a function that validates devices/features requested
 in domain XML against the desired QEMU capabilities (aka
 qemuCaps) - it's virDomainDefValidate() which calls
 qemuValidateDomainDef() and qemuValidateDomainDeviceDef()
 subsequently.
 But the problem here is that the validation function is
 explicitly skipped over in specific scenarios (like incoming
 migration, restore from a snapshot or previously saved file).
 This in turn means that we may spawn QEMU and request
 device/features it doesn't support. When that happens QEMU fails
 to load migration stream:
  qemu-kvm: ... 'virtio-mem-pci' is not a valid device model name
 (NB, while the example shows one particular device, the problem
 is paramount)
 This problem is easier to run into since we are slowly moving
 validation from qemu_command.c into said validation functions.
 The solution is simple: do the validation in all cases. And while
 it may happen that users would be unable to migrate/restore a
 guest due to a bug in our validator, spawning QEMU without
 validation is worse (especially when you consider that users can
 supply their own XMLs for migrate/restore operations - these were
 never validated).
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2048435
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Peter Krempa <pkrempa@redhat.com>
 (cherry picked from commit 517b8c12b98d7ac0bb4d582e0b491d50d776eb6d)
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2050702
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/qemu/qemu_process.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index 5c9ca0fe4f..5c6657a876 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -5411,11 +5411,7 @@ qemuProcessStartValidate(virQEMUDriver *driver,
     }
 -    /* Checks below should not be executed when starting a qemu process for a
 -     * VM that was running before (migration, snapshots, save). It's more
 -     * important to start such VM than keep the configuration clean */
 -    if ((flags & VIR_QEMU_PROCESS_START_NEW) &&
 -        virDomainDefValidate(vm->def, 0, driver->xmlopt, qemuCaps) < 0)
 +    if (virDomainDefValidate(vm->def, 0, driver->xmlopt, qemuCaps) < 0)
         return -1;
     if (qemuProcessStartValidateGraphics(vm) < 0)
 -- 
 2.35.1
--- a/SOURCES/libvirt-qemu-add-run-with-async-teardown-capability.patch
+++ b/SOURCES/libvirt-qemu-add-run-with-async-teardown-capability.patch
@ -0,0 +1,97 @@
 From 1c1274ab6be81184ca2193a86735e2edb27aee8d Mon Sep 17 00:00:00 2001
 Message-ID: <1c1274ab6be81184ca2193a86735e2edb27aee8d.1689974709.git.jdenemar@redhat.com>
 From: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Date: Wed, 5 Jul 2023 08:20:25 +0200
 Subject: [PATCH] qemu: add run-with async-teardown capability
 QEMU capability is looking in query-command-line-options response for
 ...
    {
      "parameters": [
        {
          "name": "async-teardown",
          "type": "boolean"
        }
      ],
      "option": "run-with"
    }
 ...
 allow to use the QEMU option -run-with async-teardown=on|off
 Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 65c6513811d1cdc7e97319164d7528411520dd0c)
 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2168499
 Signed-off-by: Boris Fiuczynski <bfiuczyn@redhat.com>
 ---
 src/qemu/qemu_capabilities.c                     | 4 ++++
 src/qemu/qemu_capabilities.h                     | 3 +++
 tests/qemucapabilitiesdata/caps_8.1.0_s390x.xml  | 1 +
 tests/qemucapabilitiesdata/caps_8.1.0_x86_64.xml | 1 +
 4 files changed, 9 insertions(+)
 diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
 index 7dad7231ee..c9f4b17208 100644
 --- a/src/qemu/qemu_capabilities.c
 +++ b/src/qemu/qemu_capabilities.c
@@ -694,6 +694,9 @@ VIR_ENUM_IMPL(virQEMUCaps,
               "rbd-encryption-layering", /* QEMU_CAPS_RBD_ENCRYPTION_LAYERING */
               "rbd-encryption-luks-any", /* QEMU_CAPS_RBD_ENCRYPTION_LUKS_ANY */
               "qcow2-discard-no-unref", /* QEMU_CAPS_QCOW2_DISCARD_NO_UNREF */
 +
 +              /* 450 */
 +              "run-with.async-teardown", /* QEMU_CAPS_RUN_WITH_ASYNC_TEARDOWN */
     );
@@ -3369,6 +3372,7 @@ static struct virQEMUCapsCommandLineProps virQEMUCapsCommandLine[] = {
     { "spice", "gl", QEMU_CAPS_SPICE_GL },
     { "spice", "rendernode", QEMU_CAPS_SPICE_RENDERNODE },
     { "vnc", "power-control", QEMU_CAPS_VNC_POWER_CONTROL },
 +    { "run-with", "async-teardown", QEMU_CAPS_RUN_WITH_ASYNC_TEARDOWN },
 };
 static int
 diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
 index ce545cb2cc..2460fa7fa0 100644
 --- a/src/qemu/qemu_capabilities.h
 +++ b/src/qemu/qemu_capabilities.h
@@ -674,6 +674,9 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */
     QEMU_CAPS_RBD_ENCRYPTION_LUKS_ANY, /* luks-any (LUKS and LUKS2) encryption format for Ceph RBD */
     QEMU_CAPS_QCOW2_DISCARD_NO_UNREF, /* qcow2 block driver allows discards without unrefing the sector */
 +    /* 450 */
 +    QEMU_CAPS_RUN_WITH_ASYNC_TEARDOWN, /* asynchronous teardown -run-with async-teardown=on|off */
 +
     QEMU_CAPS_LAST /* this must always be the last item */
 } virQEMUCapsFlags;
 diff --git a/tests/qemucapabilitiesdata/caps_8.1.0_s390x.xml b/tests/qemucapabilitiesdata/caps_8.1.0_s390x.xml
 index 23b5aece15..88c7ac89db 100644
 --- a/tests/qemucapabilitiesdata/caps_8.1.0_s390x.xml
 +++ b/tests/qemucapabilitiesdata/caps_8.1.0_s390x.xml
@@ -114,6 +114,7 @@
   <flag name='virtio-gpu.blob'/>
   <flag name='rbd-encryption-layering'/>
   <flag name='rbd-encryption-luks-any'/>
 +  <flag name='run-with.async-teardown'/>
   <version>8000050</version>
   <microcodeVersion>39100245</microcodeVersion>
   <package>v8.0.0-1270-g1c12355b</package>
 diff --git a/tests/qemucapabilitiesdata/caps_8.1.0_x86_64.xml b/tests/qemucapabilitiesdata/caps_8.1.0_x86_64.xml
 index f717c83fec..475496a8c8 100644
 --- a/tests/qemucapabilitiesdata/caps_8.1.0_x86_64.xml
 +++ b/tests/qemucapabilitiesdata/caps_8.1.0_x86_64.xml
@@ -206,6 +206,7 @@
   <flag name='rbd-encryption-layering'/>
   <flag name='rbd-encryption-luks-any'/>
   <flag name='qcow2-discard-no-unref'/>
 +  <flag name='run-with.async-teardown'/>
   <version>8000050</version>
   <microcodeVersion>43100245</microcodeVersion>
   <package>v8.0.0-1739-g5f9dd6a8ce</package>
 -- 
 2.41.0
--- a/SOURCES/libvirt-qemu-agent-Make-fetching-of-can-offline-member-from-guest-query-vcpus-optional.patch
+++ b/SOURCES/libvirt-qemu-agent-Make-fetching-of-can-offline-member-from-guest-query-vcpus-optional.patch
@ -1,46 +0,0 @@
 From c57b31305a7fc8c2a4d11e11e7a48c4826160fa2 Mon Sep 17 00:00:00 2001
 Message-Id: <c57b31305a7fc8c2a4d11e11e7a48c4826160fa2@dist-git>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Wed, 1 Mar 2023 16:51:42 +0100
 Subject: [PATCH] qemu: agent: Make fetching of 'can-offline' member from
 'guest-query-vcpus' optional
 The 'can-offline' member is optional according to agent's schema and in
 fact in certain cases it's not returned. Libvirt then spams the logs
 if something is polling the bulk guest stats API.
 Noticed when going through oVirt logs which appears to call the bulk
 stats API repeatedly.
 Instead of requiring it we simply reply that the vCPU can't be offlined.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Laine Stump <laine@redhat.com>
 (cherry picked from commit 790ea58153b9ef1120a577d1a87a4ca2e988ee5c)
 https://bugzilla.redhat.com/show_bug.cgi?id=2174447
 ---
 src/qemu/qemu_agent.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)
 diff --git a/src/qemu/qemu_agent.c b/src/qemu/qemu_agent.c
 index db844148a6..09b7340bc8 100644
 --- a/src/qemu/qemu_agent.c
 +++ b/src/qemu/qemu_agent.c
@@ -1371,12 +1371,8 @@ qemuAgentGetVCPUs(qemuAgent *agent,
             return -1;
         }
 -        if (virJSONValueObjectGetBoolean(entry, "can-offline",
 -                                         &in->offlinable) < 0) {
 -            virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
 -                           _("'can-offline' missing in reply of guest-get-vcpus"));
 -            return -1;
 -        }
 +        in->offlinable = false;
 +        ignore_value(virJSONValueObjectGetBoolean(entry, "can-offline", &in->offlinable));
     }
     return ndata;
 -- 
 2.39.2
--- a/SOURCES/libvirt-qemu-allow-use-of-async-teardown-in-domain.patch
+++ b/SOURCES/libvirt-qemu-allow-use-of-async-teardown-in-domain.patch
@ -0,0 +1,836 @@
 From d216c360f9d0acda0726194aed81e145018a3951 Mon Sep 17 00:00:00 2001
 Message-ID: <d216c360f9d0acda0726194aed81e145018a3951.1689974709.git.jdenemar@redhat.com>
 From: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Date: Wed, 5 Jul 2023 08:20:26 +0200
 Subject: [PATCH] qemu: allow use of async teardown in domain
 Asynchronous teardown can be specified if the QEMU binary supports it by
 adding in the domain XML
  <features>
    ...
    <async-teardown enabled='yes|no'/>
    ...
  </features>
 By default this new feature is disabled.
 Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 3bf02acdc5446b2c4a3078f99d8f5232acff9043)
 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2168499
 Signed-off-by: Boris Fiuczynski <bfiuczyn@redhat.com>
 ---
 docs/formatdomain.rst                         |  6 +++
 src/conf/domain_conf.c                        | 22 ++++++++++
 src/conf/domain_conf.h                        |  1 +
 src/conf/schemas/domaincommon.rng             |  9 ++++
 src/qemu/qemu_command.c                       | 22 ++++++++++
 src/qemu/qemu_validate.c                      |  9 ++++
 .../async-teardown.x86_64-latest.args         | 37 ++++++++++++++++
 tests/qemuxml2argvdata/async-teardown.xml     | 31 +++++++++++++
 ...0-async-teardown-disabled.s390x-6.0.0.args | 35 +++++++++++++++
 ...-async-teardown-disabled.s390x-latest.args | 36 +++++++++++++++
 .../s390-async-teardown-disabled.xml          | 24 ++++++++++
 ...async-teardown-no-attrib.s390x-latest.args | 36 +++++++++++++++
 .../s390-async-teardown-no-attrib.xml         | 24 ++++++++++
 .../s390-async-teardown.s390x-6.0.0.err       |  1 +
 .../s390-async-teardown.s390x-latest.args     | 36 +++++++++++++++
 .../qemuxml2argvdata/s390-async-teardown.xml  | 24 ++++++++++
 tests/qemuxml2argvtest.c                      |  7 +++
 .../async-teardown.x86_64-latest.xml          | 44 +++++++++++++++++++
 ...90-async-teardown-disabled.s390x-6.0.0.xml | 36 +++++++++++++++
 ...0-async-teardown-disabled.s390x-latest.xml | 36 +++++++++++++++
 ...-async-teardown-no-attrib.s390x-latest.xml | 36 +++++++++++++++
 .../s390-async-teardown.s390x-latest.xml      | 36 +++++++++++++++
 tests/qemuxml2xmltest.c                       |  6 +++
 23 files changed, 554 insertions(+)
 create mode 100644 tests/qemuxml2argvdata/async-teardown.x86_64-latest.args
 create mode 100644 tests/qemuxml2argvdata/async-teardown.xml
 create mode 100644 tests/qemuxml2argvdata/s390-async-teardown-disabled.s390x-6.0.0.args
 create mode 100644 tests/qemuxml2argvdata/s390-async-teardown-disabled.s390x-latest.args
 create mode 100644 tests/qemuxml2argvdata/s390-async-teardown-disabled.xml
 create mode 100644 tests/qemuxml2argvdata/s390-async-teardown-no-attrib.s390x-latest.args
 create mode 100644 tests/qemuxml2argvdata/s390-async-teardown-no-attrib.xml
 create mode 100644 tests/qemuxml2argvdata/s390-async-teardown.s390x-6.0.0.err
 create mode 100644 tests/qemuxml2argvdata/s390-async-teardown.s390x-latest.args
 create mode 100644 tests/qemuxml2argvdata/s390-async-teardown.xml
 create mode 100644 tests/qemuxml2xmloutdata/async-teardown.x86_64-latest.xml
 create mode 100644 tests/qemuxml2xmloutdata/s390-async-teardown-disabled.s390x-6.0.0.xml
 create mode 100644 tests/qemuxml2xmloutdata/s390-async-teardown-disabled.s390x-latest.xml
 create mode 100644 tests/qemuxml2xmloutdata/s390-async-teardown-no-attrib.s390x-latest.xml
 create mode 100644 tests/qemuxml2xmloutdata/s390-async-teardown.s390x-latest.xml
 diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst
 index f29449f749..c61c8a3fec 100644
 --- a/docs/formatdomain.rst
 +++ b/docs/formatdomain.rst
@@ -2000,6 +2000,7 @@ Hypervisors may allow certain CPU / machine features to be toggled on/off.
      <tcg>
        <tb-cache unit='MiB'>128</tb-cache>
      </tcg>
 +     <async-teardown enabled='yes'/>
    </features>
    ...
@@ -2230,6 +2231,11 @@ are:
    tb-cache    The size of translation block cache size       an integer (a multiple of MiB)                      :since:`8.0.0`
    =========== ============================================== =================================================== ==============
 +``async-teardown``
 +   Depending on the ``enabled`` attribute (values ``yes``, ``no``) enable or
 +   disable QEMU asynchronous teardown to improve memory reclaiming on a guest.
 +   :since:`Since 9.6.0` (QEMU only)
 +
 Time keeping
 ------------
 diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
 index 4121b6a054..5ac5c0b771 100644
 --- a/src/conf/domain_conf.c
 +++ b/src/conf/domain_conf.c
@@ -181,6 +181,7 @@ VIR_ENUM_IMPL(virDomainFeature,
               "sbbc",
               "ibs",
               "tcg",
 +              "async-teardown",
 );
 VIR_ENUM_IMPL(virDomainCapabilitiesPolicy,
@@ -16689,6 +16690,20 @@ virDomainFeaturesDefParse(virDomainDef *def,
                 return -1;
             break;
 +        case VIR_DOMAIN_FEATURE_ASYNC_TEARDOWN: {
 +            virTristateBool enabled;
 +
 +            if (virXMLPropTristateBool(nodes[i], "enabled",
 +                                       VIR_XML_PROP_NONE, &enabled) < 0)
 +                return -1;
 +
 +            if (enabled == VIR_TRISTATE_BOOL_ABSENT)
 +                enabled = VIR_TRISTATE_BOOL_YES;
 +
 +            def->features[val] = enabled;
 +            break;
 +        }
 +
         case VIR_DOMAIN_FEATURE_LAST:
             break;
         }
@@ -20628,6 +20643,7 @@ virDomainDefFeaturesCheckABIStability(virDomainDef *src,
         case VIR_DOMAIN_FEATURE_MSRS:
         case VIR_DOMAIN_FEATURE_TCG:
 +        case VIR_DOMAIN_FEATURE_ASYNC_TEARDOWN:
         case VIR_DOMAIN_FEATURE_LAST:
             break;
         }
@@ -27340,6 +27356,12 @@ virDomainDefFormatFeatures(virBuffer *buf,
             virDomainFeatureTCGFormat(&childBuf, def);
             break;
 +        case VIR_DOMAIN_FEATURE_ASYNC_TEARDOWN:
 +            if (def->features[i] != VIR_TRISTATE_SWITCH_ABSENT)
 +                virBufferAsprintf(&childBuf, "<async-teardown enabled='%s'/>\n",
 +                                  virTristateBoolTypeToString(def->features[i]));
 +            break;
 +
         case VIR_DOMAIN_FEATURE_LAST:
             break;
         }
 diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
 index cddaa3824d..c857ba556f 100644
 --- a/src/conf/domain_conf.h
 +++ b/src/conf/domain_conf.h
@@ -2170,6 +2170,7 @@ typedef enum {
     VIR_DOMAIN_FEATURE_SBBC,
     VIR_DOMAIN_FEATURE_IBS,
     VIR_DOMAIN_FEATURE_TCG,
 +    VIR_DOMAIN_FEATURE_ASYNC_TEARDOWN,
     VIR_DOMAIN_FEATURE_LAST
 } virDomainFeature;
 diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng
 index fcf9e00600..c2f56b0490 100644
 --- a/src/conf/schemas/domaincommon.rng
 +++ b/src/conf/schemas/domaincommon.rng
@@ -6660,6 +6660,15 @@
           <optional>
             <ref name="tcgfeatures"/>
           </optional>
 +          <optional>
 +            <element name="async-teardown">
 +              <optional>
 +                <attribute name="enabled">
 +                  <ref name="virYesNo"/>
 +                </attribute>
 +              </optional>
 +            </element>
 +          </optional>
         </interleave>
       </element>
     </optional>
 diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
 index cde6ab4dde..ec5d8b52d4 100644
 --- a/src/qemu/qemu_command.c
 +++ b/src/qemu/qemu_command.c
@@ -10175,6 +10175,25 @@ qemuBuildCryptoCommandLine(virCommand *cmd,
 }
 +static int
 +qemuBuildAsyncTeardownCommandLine(virCommand *cmd,
 +                                  const virDomainDef *def,
 +                                  virQEMUCaps *qemuCaps)
 +{
 +    g_autofree char *async = NULL;
 +    virTristateBool enabled = def->features[VIR_DOMAIN_FEATURE_ASYNC_TEARDOWN];
 +
 +    if (enabled != VIR_TRISTATE_BOOL_ABSENT &&
 +        virQEMUCapsGet(qemuCaps, QEMU_CAPS_RUN_WITH_ASYNC_TEARDOWN)) {
 +        async = g_strdup_printf("async-teardown=%s",
 +                                virTristateSwitchTypeToString(enabled));
 +        virCommandAddArgList(cmd, "-run-with", async, NULL);
 +    }
 +
 +    return 0;
 +}
 +
 +
 typedef enum {
     QEMU_COMMAND_DEPRECATION_BEHAVIOR_NONE = 0,
     QEMU_COMMAND_DEPRECATION_BEHAVIOR_OMIT,
@@ -10530,6 +10549,9 @@ qemuBuildCommandLine(virDomainObj *vm,
     if (qemuBuildCryptoCommandLine(cmd, def, qemuCaps) < 0)
         return NULL;
 +    if (qemuBuildAsyncTeardownCommandLine(cmd, def, qemuCaps) < 0)
 +        return NULL;
 +
     if (cfg->logTimestamp)
         virCommandAddArgList(cmd, "-msg", "timestamp=on", NULL);
 diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c
 index a53729d349..7e09e2c52f 100644
 --- a/src/qemu/qemu_validate.c
 +++ b/src/qemu/qemu_validate.c
@@ -219,6 +219,15 @@ qemuValidateDomainDefFeatures(const virDomainDef *def,
             }
             break;
 +        case VIR_DOMAIN_FEATURE_ASYNC_TEARDOWN:
 +            if (def->features[i] == VIR_TRISTATE_BOOL_YES &&
 +                !virQEMUCapsGet(qemuCaps, QEMU_CAPS_RUN_WITH_ASYNC_TEARDOWN)) {
 +                virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
 +                              _("asynchronous teardown is not available with this QEMU binary"));
 +                return -1;
 +            }
 +            break;
 +
         case VIR_DOMAIN_FEATURE_SMM:
         case VIR_DOMAIN_FEATURE_KVM:
         case VIR_DOMAIN_FEATURE_XEN:
 diff --git a/tests/qemuxml2argvdata/async-teardown.x86_64-latest.args b/tests/qemuxml2argvdata/async-teardown.x86_64-latest.args
 new file mode 100644
 index 0000000000..455382f1f0
 --- /dev/null
 +++ b/tests/qemuxml2argvdata/async-teardown.x86_64-latest.args
@@ -0,0 +1,37 @@
 +LC_ALL=C \
 +PATH=/bin \
 +HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1 \
 +USER=test \
 +LOGNAME=test \
 +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.local/share \
 +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.cache \
 +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 +/usr/bin/qemu-system-x86_64 \
 +-name guest=QEMUGuest1,debug-threads=on \
 +-S \
 +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 +-machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 +-accel tcg \
 +-cpu qemu64 \
 +-m size=219136k \
 +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 +-overcommit mem-lock=off \
 +-smp 1,sockets=1,cores=1,threads=1 \
 +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 +-display none \
 +-no-user-config \
 +-nodefaults \
 +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 +-mon chardev=charmonitor,id=monitor,mode=control \
 +-rtc base=utc \
 +-no-shutdown \
 +-boot strict=on \
 +-device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \
 +-blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \
 +-blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 +-device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 +-audiodev '{"id":"audio1","driver":"none"}' \
 +-device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
 +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 +-run-with async-teardown=on \
 +-msg timestamp=on
 diff --git a/tests/qemuxml2argvdata/async-teardown.xml b/tests/qemuxml2argvdata/async-teardown.xml
 new file mode 100644
 index 0000000000..70c1eccc55
 --- /dev/null
 +++ b/tests/qemuxml2argvdata/async-teardown.xml
@@ -0,0 +1,31 @@
 +<domain type='qemu'>
 +  <name>QEMUGuest1</name>
 +  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
 +  <memory unit='KiB'>219136</memory>
 +  <currentMemory unit='KiB'>219136</currentMemory>
 +  <vcpu placement='static'>1</vcpu>
 +  <os>
 +    <type arch='x86_64' machine='pc'>hvm</type>
 +    <boot dev='hd'/>
 +  </os>
 +  <clock offset='utc'/>
 +  <on_poweroff>destroy</on_poweroff>
 +  <on_reboot>restart</on_reboot>
 +  <on_crash>destroy</on_crash>
 +  <features>
 +    <async-teardown enabled='yes'/>
 +  </features>
 +  <devices>
 +    <emulator>/usr/bin/qemu-system-x86_64</emulator>
 +    <disk type='block' device='disk'>
 +      <source dev='/dev/HostVG/QEMUGuest1'/>
 +      <target dev='hda' bus='ide'/>
 +      <address type='drive' controller='0' bus='0' target='0' unit='0'/>
 +    </disk>
 +    <controller type='usb' index='0'/>
 +    <controller type='fdc' index='0'/>
 +    <controller type='ide' index='0'/>
 +    <controller type='pci' index='0' model='pci-root'/>
 +    <memballoon model='virtio'/>
 +  </devices>
 +</domain>
 diff --git a/tests/qemuxml2argvdata/s390-async-teardown-disabled.s390x-6.0.0.args b/tests/qemuxml2argvdata/s390-async-teardown-disabled.s390x-6.0.0.args
 new file mode 100644
 index 0000000000..57690530a2
 --- /dev/null
 +++ b/tests/qemuxml2argvdata/s390-async-teardown-disabled.s390x-6.0.0.args
@@ -0,0 +1,35 @@
 +LC_ALL=C \
 +PATH=/bin \
 +HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1 \
 +USER=test \
 +LOGNAME=test \
 +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.local/share \
 +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.cache \
 +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 +/usr/bin/qemu-system-s390x \
 +-name guest=QEMUGuest1,debug-threads=on \
 +-S \
 +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 +-machine s390-ccw-virtio-6.0,usb=off,dump-guest-core=off,memory-backend=s390.ram \
 +-accel tcg \
 +-cpu qemu \
 +-m size=262144k \
 +-object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":268435456}' \
 +-overcommit mem-lock=off \
 +-smp 1,sockets=1,cores=1,threads=1 \
 +-uuid 9aa4b45c-b9dd-45ef-91fe-862b27b4231f \
 +-display none \
 +-no-user-config \
 +-nodefaults \
 +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 +-mon chardev=charmonitor,id=monitor,mode=control \
 +-rtc base=utc \
 +-no-shutdown \
 +-boot strict=on \
 +-device virtio-serial-ccw,id=virtio-serial0,devno=fe.0.0000 \
 +-chardev pty,id=charconsole0 \
 +-device virtconsole,chardev=charconsole0,id=console0 \
 +-audiodev '{"id":"audio1","driver":"none"}' \
 +-device virtio-balloon-ccw,id=balloon0,devno=fe.0.0001 \
 +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 +-msg timestamp=on
 diff --git a/tests/qemuxml2argvdata/s390-async-teardown-disabled.s390x-latest.args b/tests/qemuxml2argvdata/s390-async-teardown-disabled.s390x-latest.args
 new file mode 100644
 index 0000000000..96b18b83ce
 --- /dev/null
 +++ b/tests/qemuxml2argvdata/s390-async-teardown-disabled.s390x-latest.args
@@ -0,0 +1,36 @@
 +LC_ALL=C \
 +PATH=/bin \
 +HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1 \
 +USER=test \
 +LOGNAME=test \
 +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.local/share \
 +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.cache \
 +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 +/usr/bin/qemu-system-s390x \
 +-name guest=QEMUGuest1,debug-threads=on \
 +-S \
 +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 +-machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram \
 +-accel tcg \
 +-cpu qemu \
 +-m size=262144k \
 +-object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":268435456}' \
 +-overcommit mem-lock=off \
 +-smp 1,sockets=1,cores=1,threads=1 \
 +-uuid 9aa4b45c-b9dd-45ef-91fe-862b27b4231f \
 +-display none \
 +-no-user-config \
 +-nodefaults \
 +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 +-mon chardev=charmonitor,id=monitor,mode=control \
 +-rtc base=utc \
 +-no-shutdown \
 +-boot strict=on \
 +-device '{"driver":"virtio-serial-ccw","id":"virtio-serial0","devno":"fe.0.0000"}' \
 +-chardev pty,id=charconsole0 \
 +-device '{"driver":"virtconsole","chardev":"charconsole0","id":"console0"}' \
 +-audiodev '{"id":"audio1","driver":"none"}' \
 +-device '{"driver":"virtio-balloon-ccw","id":"balloon0","devno":"fe.0.0001"}' \
 +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 +-run-with async-teardown=off \
 +-msg timestamp=on
 diff --git a/tests/qemuxml2argvdata/s390-async-teardown-disabled.xml b/tests/qemuxml2argvdata/s390-async-teardown-disabled.xml
 new file mode 100644
 index 0000000000..3939be0006
 --- /dev/null
 +++ b/tests/qemuxml2argvdata/s390-async-teardown-disabled.xml
@@ -0,0 +1,24 @@
 +<domain type='qemu'>
 +  <name>QEMUGuest1</name>
 +  <uuid>9aa4b45c-b9dd-45ef-91fe-862b27b4231f</uuid>
 +  <memory>262144</memory>
 +  <currentMemory>262144</currentMemory>
 +  <os>
 +    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
 +  </os>
 +  <clock offset='utc'/>
 +  <on_poweroff>destroy</on_poweroff>
 +  <on_reboot>restart</on_reboot>
 +  <on_crash>destroy</on_crash>
 +  <features>
 +    <async-teardown enabled='no'/>
 +  </features>
 +  <devices>
 +    <emulator>/usr/bin/qemu-system-s390x</emulator>
 +    <controller type='virtio-serial' index='0'>
 +    </controller>
 +    <console type='pty'>
 +      <target type='virtio'/>
 +    </console>
 +  </devices>
 +</domain>
 diff --git a/tests/qemuxml2argvdata/s390-async-teardown-no-attrib.s390x-latest.args b/tests/qemuxml2argvdata/s390-async-teardown-no-attrib.s390x-latest.args
 new file mode 100644
 index 0000000000..cc7866499f
 --- /dev/null
 +++ b/tests/qemuxml2argvdata/s390-async-teardown-no-attrib.s390x-latest.args
@@ -0,0 +1,36 @@
 +LC_ALL=C \
 +PATH=/bin \
 +HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1 \
 +USER=test \
 +LOGNAME=test \
 +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.local/share \
 +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.cache \
 +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 +/usr/bin/qemu-system-s390x \
 +-name guest=QEMUGuest1,debug-threads=on \
 +-S \
 +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 +-machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram \
 +-accel tcg \
 +-cpu qemu \
 +-m size=262144k \
 +-object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":268435456}' \
 +-overcommit mem-lock=off \
 +-smp 1,sockets=1,cores=1,threads=1 \
 +-uuid 9aa4b45c-b9dd-45ef-91fe-862b27b4231f \
 +-display none \
 +-no-user-config \
 +-nodefaults \
 +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 +-mon chardev=charmonitor,id=monitor,mode=control \
 +-rtc base=utc \
 +-no-shutdown \
 +-boot strict=on \
 +-device '{"driver":"virtio-serial-ccw","id":"virtio-serial0","devno":"fe.0.0000"}' \
 +-chardev pty,id=charconsole0 \
 +-device '{"driver":"virtconsole","chardev":"charconsole0","id":"console0"}' \
 +-audiodev '{"id":"audio1","driver":"none"}' \
 +-device '{"driver":"virtio-balloon-ccw","id":"balloon0","devno":"fe.0.0001"}' \
 +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 +-run-with async-teardown=on \
 +-msg timestamp=on
 diff --git a/tests/qemuxml2argvdata/s390-async-teardown-no-attrib.xml b/tests/qemuxml2argvdata/s390-async-teardown-no-attrib.xml
 new file mode 100644
 index 0000000000..e069cd41ed
 --- /dev/null
 +++ b/tests/qemuxml2argvdata/s390-async-teardown-no-attrib.xml
@@ -0,0 +1,24 @@
 +<domain type='qemu'>
 +  <name>QEMUGuest1</name>
 +  <uuid>9aa4b45c-b9dd-45ef-91fe-862b27b4231f</uuid>
 +  <memory>262144</memory>
 +  <currentMemory>262144</currentMemory>
 +  <os>
 +    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
 +  </os>
 +  <clock offset='utc'/>
 +  <on_poweroff>destroy</on_poweroff>
 +  <on_reboot>restart</on_reboot>
 +  <on_crash>destroy</on_crash>
 +  <features>
 +    <async-teardown/>
 +  </features>
 +  <devices>
 +    <emulator>/usr/bin/qemu-system-s390x</emulator>
 +    <controller type='virtio-serial' index='0'>
 +    </controller>
 +    <console type='pty'>
 +      <target type='virtio'/>
 +    </console>
 +  </devices>
 +</domain>
 diff --git a/tests/qemuxml2argvdata/s390-async-teardown.s390x-6.0.0.err b/tests/qemuxml2argvdata/s390-async-teardown.s390x-6.0.0.err
 new file mode 100644
 index 0000000000..aa9a4739cb
 --- /dev/null
 +++ b/tests/qemuxml2argvdata/s390-async-teardown.s390x-6.0.0.err
@@ -0,0 +1 @@
 +unsupported configuration: asynchronous teardown is not available with this QEMU binary
 diff --git a/tests/qemuxml2argvdata/s390-async-teardown.s390x-latest.args b/tests/qemuxml2argvdata/s390-async-teardown.s390x-latest.args
 new file mode 100644
 index 0000000000..cc7866499f
 --- /dev/null
 +++ b/tests/qemuxml2argvdata/s390-async-teardown.s390x-latest.args
@@ -0,0 +1,36 @@
 +LC_ALL=C \
 +PATH=/bin \
 +HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1 \
 +USER=test \
 +LOGNAME=test \
 +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.local/share \
 +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.cache \
 +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 +/usr/bin/qemu-system-s390x \
 +-name guest=QEMUGuest1,debug-threads=on \
 +-S \
 +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 +-machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram \
 +-accel tcg \
 +-cpu qemu \
 +-m size=262144k \
 +-object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":268435456}' \
 +-overcommit mem-lock=off \
 +-smp 1,sockets=1,cores=1,threads=1 \
 +-uuid 9aa4b45c-b9dd-45ef-91fe-862b27b4231f \
 +-display none \
 +-no-user-config \
 +-nodefaults \
 +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
 +-mon chardev=charmonitor,id=monitor,mode=control \
 +-rtc base=utc \
 +-no-shutdown \
 +-boot strict=on \
 +-device '{"driver":"virtio-serial-ccw","id":"virtio-serial0","devno":"fe.0.0000"}' \
 +-chardev pty,id=charconsole0 \
 +-device '{"driver":"virtconsole","chardev":"charconsole0","id":"console0"}' \
 +-audiodev '{"id":"audio1","driver":"none"}' \
 +-device '{"driver":"virtio-balloon-ccw","id":"balloon0","devno":"fe.0.0001"}' \
 +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 +-run-with async-teardown=on \
 +-msg timestamp=on
 diff --git a/tests/qemuxml2argvdata/s390-async-teardown.xml b/tests/qemuxml2argvdata/s390-async-teardown.xml
 new file mode 100644
 index 0000000000..3291b1ada3
 --- /dev/null
 +++ b/tests/qemuxml2argvdata/s390-async-teardown.xml
@@ -0,0 +1,24 @@
 +<domain type='qemu'>
 +  <name>QEMUGuest1</name>
 +  <uuid>9aa4b45c-b9dd-45ef-91fe-862b27b4231f</uuid>
 +  <memory>262144</memory>
 +  <currentMemory>262144</currentMemory>
 +  <os>
 +    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
 +  </os>
 +  <clock offset='utc'/>
 +  <on_poweroff>destroy</on_poweroff>
 +  <on_reboot>restart</on_reboot>
 +  <on_crash>destroy</on_crash>
 +  <features>
 +    <async-teardown enabled='yes'/>
 +  </features>
 +  <devices>
 +    <emulator>/usr/bin/qemu-system-s390x</emulator>
 +    <controller type='virtio-serial' index='0'>
 +    </controller>
 +    <console type='pty'>
 +      <target type='virtio'/>
 +    </console>
 +  </devices>
 +</domain>
 diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
 index c1bba779b3..9abaa72674 100644
 --- a/tests/qemuxml2argvtest.c
 +++ b/tests/qemuxml2argvtest.c
@@ -2701,6 +2701,13 @@ mymain(void)
     DO_TEST_CAPS_LATEST("crypto-builtin");
 +    DO_TEST_CAPS_LATEST("async-teardown");
 +    DO_TEST_CAPS_ARCH_LATEST("s390-async-teardown", "s390x");
 +    DO_TEST_CAPS_ARCH_LATEST("s390-async-teardown-no-attrib", "s390x");
 +    DO_TEST_CAPS_ARCH_VER_PARSE_ERROR("s390-async-teardown", "s390x", "6.0.0");
 +    DO_TEST_CAPS_ARCH_LATEST("s390-async-teardown-disabled", "s390x");
 +    DO_TEST_CAPS_ARCH_VER("s390-async-teardown-disabled", "s390x", "6.0.0");
 +
     qemuTestDriverFree(&driver);
     virFileWrapperClearPrefixes();
 diff --git a/tests/qemuxml2xmloutdata/async-teardown.x86_64-latest.xml b/tests/qemuxml2xmloutdata/async-teardown.x86_64-latest.xml
 new file mode 100644
 index 0000000000..e98308a9b1
 --- /dev/null
 +++ b/tests/qemuxml2xmloutdata/async-teardown.x86_64-latest.xml
@@ -0,0 +1,44 @@
 +<domain type='qemu'>
 +  <name>QEMUGuest1</name>
 +  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
 +  <memory unit='KiB'>219136</memory>
 +  <currentMemory unit='KiB'>219136</currentMemory>
 +  <vcpu placement='static'>1</vcpu>
 +  <os>
 +    <type arch='x86_64' machine='pc'>hvm</type>
 +    <boot dev='hd'/>
 +  </os>
 +  <features>
 +    <async-teardown enabled='yes'/>
 +  </features>
 +  <cpu mode='custom' match='exact' check='none'>
 +    <model fallback='forbid'>qemu64</model>
 +  </cpu>
 +  <clock offset='utc'/>
 +  <on_poweroff>destroy</on_poweroff>
 +  <on_reboot>restart</on_reboot>
 +  <on_crash>destroy</on_crash>
 +  <devices>
 +    <emulator>/usr/bin/qemu-system-x86_64</emulator>
 +    <disk type='block' device='disk'>
 +      <driver name='qemu' type='raw'/>
 +      <source dev='/dev/HostVG/QEMUGuest1'/>
 +      <target dev='hda' bus='ide'/>
 +      <address type='drive' controller='0' bus='0' target='0' unit='0'/>
 +    </disk>
 +    <controller type='usb' index='0' model='piix3-uhci'>
 +      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
 +    </controller>
 +    <controller type='fdc' index='0'/>
 +    <controller type='ide' index='0'>
 +      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
 +    </controller>
 +    <controller type='pci' index='0' model='pci-root'/>
 +    <input type='mouse' bus='ps2'/>
 +    <input type='keyboard' bus='ps2'/>
 +    <audio id='1' type='none'/>
 +    <memballoon model='virtio'>
 +      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
 +    </memballoon>
 +  </devices>
 +</domain>
 diff --git a/tests/qemuxml2xmloutdata/s390-async-teardown-disabled.s390x-6.0.0.xml b/tests/qemuxml2xmloutdata/s390-async-teardown-disabled.s390x-6.0.0.xml
 new file mode 100644
 index 0000000000..a53d4995f0
 --- /dev/null
 +++ b/tests/qemuxml2xmloutdata/s390-async-teardown-disabled.s390x-6.0.0.xml
@@ -0,0 +1,36 @@
 +<domain type='qemu'>
 +  <name>QEMUGuest1</name>
 +  <uuid>9aa4b45c-b9dd-45ef-91fe-862b27b4231f</uuid>
 +  <memory unit='KiB'>262144</memory>
 +  <currentMemory unit='KiB'>262144</currentMemory>
 +  <vcpu placement='static'>1</vcpu>
 +  <os>
 +    <type arch='s390x' machine='s390-ccw-virtio-6.0'>hvm</type>
 +    <boot dev='hd'/>
 +  </os>
 +  <features>
 +    <async-teardown enabled='no'/>
 +  </features>
 +  <cpu mode='custom' match='exact' check='none'>
 +    <model fallback='forbid'>qemu</model>
 +  </cpu>
 +  <clock offset='utc'/>
 +  <on_poweroff>destroy</on_poweroff>
 +  <on_reboot>restart</on_reboot>
 +  <on_crash>destroy</on_crash>
 +  <devices>
 +    <emulator>/usr/bin/qemu-system-s390x</emulator>
 +    <controller type='virtio-serial' index='0'>
 +      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/>
 +    </controller>
 +    <controller type='pci' index='0' model='pci-root'/>
 +    <console type='pty'>
 +      <target type='virtio' port='0'/>
 +    </console>
 +    <audio id='1' type='none'/>
 +    <memballoon model='virtio'>
 +      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0001'/>
 +    </memballoon>
 +    <panic model='s390'/>
 +  </devices>
 +</domain>
 diff --git a/tests/qemuxml2xmloutdata/s390-async-teardown-disabled.s390x-latest.xml b/tests/qemuxml2xmloutdata/s390-async-teardown-disabled.s390x-latest.xml
 new file mode 100644
 index 0000000000..06c890cbff
 --- /dev/null
 +++ b/tests/qemuxml2xmloutdata/s390-async-teardown-disabled.s390x-latest.xml
@@ -0,0 +1,36 @@
 +<domain type='qemu'>
 +  <name>QEMUGuest1</name>
 +  <uuid>9aa4b45c-b9dd-45ef-91fe-862b27b4231f</uuid>
 +  <memory unit='KiB'>262144</memory>
 +  <currentMemory unit='KiB'>262144</currentMemory>
 +  <vcpu placement='static'>1</vcpu>
 +  <os>
 +    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
 +    <boot dev='hd'/>
 +  </os>
 +  <features>
 +    <async-teardown enabled='no'/>
 +  </features>
 +  <cpu mode='custom' match='exact' check='none'>
 +    <model fallback='forbid'>qemu</model>
 +  </cpu>
 +  <clock offset='utc'/>
 +  <on_poweroff>destroy</on_poweroff>
 +  <on_reboot>restart</on_reboot>
 +  <on_crash>destroy</on_crash>
 +  <devices>
 +    <emulator>/usr/bin/qemu-system-s390x</emulator>
 +    <controller type='virtio-serial' index='0'>
 +      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/>
 +    </controller>
 +    <controller type='pci' index='0' model='pci-root'/>
 +    <console type='pty'>
 +      <target type='virtio' port='0'/>
 +    </console>
 +    <audio id='1' type='none'/>
 +    <memballoon model='virtio'>
 +      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0001'/>
 +    </memballoon>
 +    <panic model='s390'/>
 +  </devices>
 +</domain>
 diff --git a/tests/qemuxml2xmloutdata/s390-async-teardown-no-attrib.s390x-latest.xml b/tests/qemuxml2xmloutdata/s390-async-teardown-no-attrib.s390x-latest.xml
 new file mode 100644
 index 0000000000..510396a9a8
 --- /dev/null
 +++ b/tests/qemuxml2xmloutdata/s390-async-teardown-no-attrib.s390x-latest.xml
@@ -0,0 +1,36 @@
 +<domain type='qemu'>
 +  <name>QEMUGuest1</name>
 +  <uuid>9aa4b45c-b9dd-45ef-91fe-862b27b4231f</uuid>
 +  <memory unit='KiB'>262144</memory>
 +  <currentMemory unit='KiB'>262144</currentMemory>
 +  <vcpu placement='static'>1</vcpu>
 +  <os>
 +    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
 +    <boot dev='hd'/>
 +  </os>
 +  <features>
 +    <async-teardown enabled='yes'/>
 +  </features>
 +  <cpu mode='custom' match='exact' check='none'>
 +    <model fallback='forbid'>qemu</model>
 +  </cpu>
 +  <clock offset='utc'/>
 +  <on_poweroff>destroy</on_poweroff>
 +  <on_reboot>restart</on_reboot>
 +  <on_crash>destroy</on_crash>
 +  <devices>
 +    <emulator>/usr/bin/qemu-system-s390x</emulator>
 +    <controller type='virtio-serial' index='0'>
 +      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/>
 +    </controller>
 +    <controller type='pci' index='0' model='pci-root'/>
 +    <console type='pty'>
 +      <target type='virtio' port='0'/>
 +    </console>
 +    <audio id='1' type='none'/>
 +    <memballoon model='virtio'>
 +      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0001'/>
 +    </memballoon>
 +    <panic model='s390'/>
 +  </devices>
 +</domain>
 diff --git a/tests/qemuxml2xmloutdata/s390-async-teardown.s390x-latest.xml b/tests/qemuxml2xmloutdata/s390-async-teardown.s390x-latest.xml
 new file mode 100644
 index 0000000000..510396a9a8
 --- /dev/null
 +++ b/tests/qemuxml2xmloutdata/s390-async-teardown.s390x-latest.xml
@@ -0,0 +1,36 @@
 +<domain type='qemu'>
 +  <name>QEMUGuest1</name>
 +  <uuid>9aa4b45c-b9dd-45ef-91fe-862b27b4231f</uuid>
 +  <memory unit='KiB'>262144</memory>
 +  <currentMemory unit='KiB'>262144</currentMemory>
 +  <vcpu placement='static'>1</vcpu>
 +  <os>
 +    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
 +    <boot dev='hd'/>
 +  </os>
 +  <features>
 +    <async-teardown enabled='yes'/>
 +  </features>
 +  <cpu mode='custom' match='exact' check='none'>
 +    <model fallback='forbid'>qemu</model>
 +  </cpu>
 +  <clock offset='utc'/>
 +  <on_poweroff>destroy</on_poweroff>
 +  <on_reboot>restart</on_reboot>
 +  <on_crash>destroy</on_crash>
 +  <devices>
 +    <emulator>/usr/bin/qemu-system-s390x</emulator>
 +    <controller type='virtio-serial' index='0'>
 +      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/>
 +    </controller>
 +    <controller type='pci' index='0' model='pci-root'/>
 +    <console type='pty'>
 +      <target type='virtio' port='0'/>
 +    </console>
 +    <audio id='1' type='none'/>
 +    <memballoon model='virtio'>
 +      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0001'/>
 +    </memballoon>
 +    <panic model='s390'/>
 +  </devices>
 +</domain>
 diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c
 index 565cb3e1e1..b66274beb8 100644
 --- a/tests/qemuxml2xmltest.c
 +++ b/tests/qemuxml2xmltest.c
@@ -1241,6 +1241,12 @@ mymain(void)
     DO_TEST_CAPS_LATEST("cpu-phys-bits-limit");
     DO_TEST_CAPS_LATEST("cpu-phys-bits-emulate-bare");
 +    DO_TEST_CAPS_LATEST("async-teardown");
 +    DO_TEST_CAPS_ARCH_LATEST("s390-async-teardown", "s390x");
 +    DO_TEST_CAPS_ARCH_LATEST("s390-async-teardown-no-attrib", "s390x");
 +    DO_TEST_CAPS_ARCH_LATEST("s390-async-teardown-disabled", "s390x");
 +    DO_TEST_CAPS_ARCH_VER("s390-async-teardown-disabled", "s390x", "6.0.0");
 +
  cleanup:
     qemuTestDriverFree(&driver);
     virFileWrapperClearPrefixes();
 -- 
 2.41.0
--- a/SOURCES/libvirt-qemu-domain-Fix-logic-when-tainting-domain.patch
+++ b/SOURCES/libvirt-qemu-domain-Fix-logic-when-tainting-domain.patch
@ -1,39 +0,0 @@
 From 521e9a7731ac678ca790da4b04dabe4369efb984 Mon Sep 17 00:00:00 2001
 Message-Id: <521e9a7731ac678ca790da4b04dabe4369efb984@dist-git>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Wed, 1 Mar 2023 17:09:42 +0100
 Subject: [PATCH] qemu: domain: Fix logic when tainting domain
 Originally the code was skipping all repeated taints with the same taint
 flag but a logic bug introduced in commit 30626ed15b239c424ae inverted
 the condition. This caused that actually the first occurence was NOT
 logged but any subsequent was.
 This was noticed when going through oVirt logs as they use custom guest
 agent commands and the logs are totally spammed with this message.
 Fixes: 30626ed15b239c424ae891f096057a696eadd715
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Laine Stump <laine@redhat.com>
 (cherry picked from commit 9134b40d0b43a5e1a9928b0a0d948205941d9807)
 https://bugzilla.redhat.com/show_bug.cgi?id=2174447
 ---
 src/qemu/qemu_domain.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
 index c24d1e4d53..c70661fc49 100644
 --- a/src/qemu/qemu_domain.c
 +++ b/src/qemu/qemu_domain.c
@@ -6369,7 +6369,7 @@ void qemuDomainObjTaintMsg(virQEMUDriver *driver,
     const char *extrasuffix = "";
     va_list args;
 -    if (virDomainObjTaint(obj, taint)) {
 +    if (!virDomainObjTaint(obj, taint)) {
         /* If an extra message was given we must always
          * emit the taint warning, otherwise it is a
          * one-time only warning per VM
 -- 
 2.39.2
--- a/SOURCES/libvirt-qemu-fix-inactive-snapshot-revert.patch
+++ b/SOURCES/libvirt-qemu-fix-inactive-snapshot-revert.patch
@ -1,44 +0,0 @@
 From 94bc9eaf3bbcaec47bd233378bbbb45f5f1523ca Mon Sep 17 00:00:00 2001
 Message-Id: <94bc9eaf3bbcaec47bd233378bbbb45f5f1523ca@dist-git>
 From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
 Date: Thu, 20 Jan 2022 14:53:33 +0100
 Subject: [PATCH] qemu: fix inactive snapshot revert
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The commit splitting out the qemuSnapshotRevertInactive function
 dropped the 'defined = true' line by accident and instead
 returned -1, leaving the user with a cryptic error:
 error: An error occurred, but the cause is unknown
 https://bugzilla.redhat.com/show_bug.cgi?id=2039136
 https://gitlab.com/libvirt/libvirt/-/issues/266
 Fixes: 85e4a13c3f19078fb6af5ffb4a80022c142cbc7e
 Signed-off-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit 76deb656132bb8817ddae4b7f417930c4db824c9)
 https://bugzilla.redhat.com/show_bug.cgi?id=2043584
 Signed-off-by: Ján Tomko <jtomko@redhat.com>
 ---
 src/qemu/qemu_snapshot.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c
 index f92e00f9c0..ac7bab90f8 100644
 --- a/src/qemu/qemu_snapshot.c
 +++ b/src/qemu/qemu_snapshot.c
@@ -2193,7 +2193,7 @@ qemuSnapshotRevertInactive(virDomainObj *vm,
     if (*inactiveConfig) {
         virDomainObjAssignDef(vm, inactiveConfig, false, NULL);
 -        return -1;
 +        defined = true;
     }
     if (flags & (VIR_DOMAIN_SNAPSHOT_REVERT_RUNNING |
 -- 
 2.35.0
--- a/SOURCES/libvirt-qemu-gpu-Get-pid-without-binary-validation.patch
+++ b/SOURCES/libvirt-qemu-gpu-Get-pid-without-binary-validation.patch
@ -1,67 +0,0 @@
 From c70b1a8d8a4bc34bcbf9ef4bccac678257b8c494 Mon Sep 17 00:00:00 2001
 Message-Id: <c70b1a8d8a4bc34bcbf9ef4bccac678257b8c494@dist-git>
 From: Vasiliy Ulyanov <vulyanov@suse.de>
 Date: Wed, 2 Feb 2022 17:28:17 +0100
 Subject: [PATCH] qemu: gpu: Get pid without binary validation
 The binary validation in virPidFileReadPathIfAlive may fail with EACCES
 if the calling process does not have CAP_SYS_PTRACE capability.
 Therefore instead do only the check that the pidfile is locked by the
 correct process.
 Fixes the same issue as with swtpm.
 Signed-off-by: Vasiliy Ulyanov <vulyanov@suse.de>
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit e3dfa52d260da8a41a0ec35767d08e37c825824a)
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2152188
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/qemu/qemu_vhost_user_gpu.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)
 diff --git a/src/qemu/qemu_vhost_user_gpu.c b/src/qemu/qemu_vhost_user_gpu.c
 index ef198a4820..f7d444e851 100644
 --- a/src/qemu/qemu_vhost_user_gpu.c
 +++ b/src/qemu/qemu_vhost_user_gpu.c
@@ -54,7 +54,6 @@ qemuVhostUserGPUCreatePidFilename(const char *stateDir,
 /*
  * qemuVhostUserGPUGetPid:
 - * @binpath: path of executable associated with the pidfile
  * @stateDir: the directory where vhost-user-gpu writes the pidfile into
  * @shortName: short name of the domain
  * @alias: video device alias
@@ -65,8 +64,7 @@ qemuVhostUserGPUCreatePidFilename(const char *stateDir,
  * set to -1;
  */
 static int
 -qemuVhostUserGPUGetPid(const char *binPath,
 -                       const char *stateDir,
 +qemuVhostUserGPUGetPid(const char *stateDir,
                        const char *shortName,
                        const char *alias,
                        pid_t *pid)
@@ -76,7 +74,7 @@ qemuVhostUserGPUGetPid(const char *binPath,
     if (!(pidfile = qemuVhostUserGPUCreatePidFilename(stateDir, shortName, alias)))
         return -1;
 -    if (virPidFileReadPathIfAlive(pidfile, pid, binPath) < 0)
 +    if (virPidFileReadPathIfLocked(pidfile, pid) < 0)
         return -1;
     return 0;
@@ -253,8 +251,7 @@ qemuExtVhostUserGPUSetupCgroup(virQEMUDriver *driver,
     if (!shortname)
         return -1;
 -    rc = qemuVhostUserGPUGetPid(video->driver->vhost_user_binary,
 -                                cfg->stateDir, shortname, video->info.alias, &pid);
 +    rc = qemuVhostUserGPUGetPid(cfg->stateDir, shortname, video->info.alias, &pid);
     if (rc < 0 || (rc == 0 && pid == (pid_t)-1)) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
                        _("Could not get process id of vhost-user-gpu"));
 -- 
 2.39.0
--- a/SOURCES/libvirt-qemu-monitor-Drop-old-monitor-fields-from-struct-_qemuMonitorMessage.patch
+++ b/SOURCES/libvirt-qemu-monitor-Drop-old-monitor-fields-from-struct-_qemuMonitorMessage.patch
@ -1,44 +0,0 @@
 From a4d8210ae9fd84740e01b96d28bfb6183f3f3270 Mon Sep 17 00:00:00 2001
 Message-Id: <a4d8210ae9fd84740e01b96d28bfb6183f3f3270@dist-git>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Mon, 14 Feb 2022 16:02:29 +0100
 Subject: [PATCH] qemu: monitor: Drop old monitor fields from 'struct
 _qemuMonitorMessage'
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The fields are no longer used since we've deleted support for HMP-only
 qemus. The HMP command pass-through works via a QMP command.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit c5eb99a9d9af8683789e99cc904671e343580058)
 https://bugzilla.redhat.com/show_bug.cgi?id=2170472
 ---
 src/qemu/qemu_monitor.h | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)
 diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h
 index d2037914be..a4a4edf5a6 100644
 --- a/src/qemu/qemu_monitor.h
 +++ b/src/qemu/qemu_monitor.h
@@ -43,15 +43,10 @@ struct _qemuMonitorMessage {
     int txOffset;
     int txLength;
 -    /* Used by the text monitor reply / error */
 -    char *rxBuffer;
 -    int rxLength;
     /* Used by the JSON monitor to hold reply / error */
     void *rxObject;
 -    /* True if rxBuffer / rxObject are ready, or a
 -     * fatal error occurred on the monitor channel
 -     */
 +    /* True if rxObject is ready, or a fatal error occurred on the monitor channel */
     bool finished;
 };
 -- 
 2.40.1
--- a/SOURCES/libvirt-qemu-monitor-Move-declaration-of-struct-_qemuMonitor-to-qemu_monitor_priv.h.patch
+++ b/SOURCES/libvirt-qemu-monitor-Move-declaration-of-struct-_qemuMonitor-to-qemu_monitor_priv.h.patch
@ -1,157 +0,0 @@
 From c2ed5aeee7bf365877e0764699f032fb749630b0 Mon Sep 17 00:00:00 2001
 Message-Id: <c2ed5aeee7bf365877e0764699f032fb749630b0@dist-git>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Mon, 14 Feb 2022 16:07:41 +0100
 Subject: [PATCH] qemu: monitor: Move declaration of struct _qemuMonitor to
 qemu_monitor_priv.h
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 In order to mock the SCM_RIGHTS sendmsg to simulate sending
 filedescriptors to fake qemu in tests we need access to some fields of
 'struct _qemuMonitor'. Move its declaration to the private header file.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit 7c35c483eaa78eb847e0865cbb210d5355f75d7a)
 https://bugzilla.redhat.com/show_bug.cgi?id=2170472
 ---
 src/qemu/qemu_monitor.c      | 50 ---------------------------------
 src/qemu/qemu_monitor_priv.h | 54 ++++++++++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+), 50 deletions(-)
 diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c
 index 23638d3fe8..bba92592c5 100644
 --- a/src/qemu/qemu_monitor.c
 +++ b/src/qemu/qemu_monitor.c
@@ -65,56 +65,6 @@ VIR_LOG_INIT("qemu.qemu_monitor");
  */
 #define QEMU_MONITOR_MAX_RESPONSE (10 * 1024 * 1024)
 -struct _qemuMonitor {
 -    virObjectLockable parent;
 -
 -    virCond notify;
 -
 -    int fd;
 -
 -    GMainContext *context;
 -    GSocket *socket;
 -    GSource *watch;
 -
 -    virDomainObj *vm;
 -    char *domainName;
 -
 -    qemuMonitorCallbacks *cb;
 -    void *callbackOpaque;
 -
 -    /* If there's a command being processed this will be
 -     * non-NULL */
 -    qemuMonitorMessage *msg;
 -
 -    /* Buffer incoming data ready for Text/QMP monitor
 -     * code to process & find message boundaries */
 -    size_t bufferOffset;
 -    size_t bufferLength;
 -    char *buffer;
 -
 -    /* If anything went wrong, this will be fed back
 -     * the next monitor msg */
 -    virError lastError;
 -
 -    /* Set to true when EOF is detected on the monitor */
 -    bool goteof;
 -
 -    int nextSerial;
 -
 -    bool waitGreeting;
 -
 -    /* If found, path to the virtio memballoon driver */
 -    char *balloonpath;
 -    bool ballooninit;
 -
 -    /* Log file context of the qemu process to dig for usable info */
 -    qemuMonitorReportDomainLogError logFunc;
 -    void *logOpaque;
 -    virFreeCallback logDestroy;
 -
 -    /* true if qemu no longer wants 'props' sub-object of object-add */
 -    bool objectAddNoWrap;
 -};
 /**
  * QEMU_CHECK_MONITOR_FULL:
 diff --git a/src/qemu/qemu_monitor_priv.h b/src/qemu/qemu_monitor_priv.h
 index 6115f830de..606aa79fbd 100644
 --- a/src/qemu/qemu_monitor_priv.h
 +++ b/src/qemu/qemu_monitor_priv.h
@@ -24,6 +24,8 @@
 #include "qemu_monitor.h"
 +#include <gio/gio.h>
 +
 struct _qemuMonitorMessage {
     int txFD;
@@ -40,5 +42,57 @@ struct _qemuMonitorMessage {
 };
 +struct _qemuMonitor {
 +    virObjectLockable parent;
 +
 +    virCond notify;
 +
 +    int fd;
 +
 +    GMainContext *context;
 +    GSocket *socket;
 +    GSource *watch;
 +
 +    virDomainObj *vm;
 +    char *domainName;
 +
 +    qemuMonitorCallbacks *cb;
 +    void *callbackOpaque;
 +
 +    /* If there's a command being processed this will be
 +     * non-NULL */
 +    qemuMonitorMessage *msg;
 +
 +    /* Buffer incoming data ready for Text/QMP monitor
 +     * code to process & find message boundaries */
 +    size_t bufferOffset;
 +    size_t bufferLength;
 +    char *buffer;
 +
 +    /* If anything went wrong, this will be fed back
 +     * the next monitor msg */
 +    virError lastError;
 +
 +    /* Set to true when EOF is detected on the monitor */
 +    bool goteof;
 +
 +    int nextSerial;
 +
 +    bool waitGreeting;
 +
 +    /* If found, path to the virtio memballoon driver */
 +    char *balloonpath;
 +    bool ballooninit;
 +
 +    /* Log file context of the qemu process to dig for usable info */
 +    qemuMonitorReportDomainLogError logFunc;
 +    void *logOpaque;
 +    virFreeCallback logDestroy;
 +
 +    /* true if qemu no longer wants 'props' sub-object of object-add */
 +    bool objectAddNoWrap;
 +};
 +
 +
 void
 qemuMonitorResetCommandID(qemuMonitor *mon);
 -- 
 2.40.1
--- a/SOURCES/libvirt-qemu-monitor-Store-whether-query-named-block-nodes-supports-flat-parameter.patch
+++ b/SOURCES/libvirt-qemu-monitor-Store-whether-query-named-block-nodes-supports-flat-parameter.patch
@ -1,57 +0,0 @@
 From b3ffc8876adf777c7baefb6e467d7552c0a03251 Mon Sep 17 00:00:00 2001
 Message-Id: <b3ffc8876adf777c7baefb6e467d7552c0a03251@dist-git>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Wed, 9 Nov 2022 10:53:49 +0100
 Subject: [PATCH] qemu: monitor: Store whether 'query-named-block-nodes'
 supports 'flat' parameter
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Rather than having callers always pass this flag store it in the
 qemuMonitor object. Following patches will convert the code to use this
 internal flag.
 In the future this will also simplify removal when all supported qemu
 versions will support the new mode.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit b0e4ad5263c73a926b8246028c76c552b07fca74)
 https://bugzilla.redhat.com/show_bug.cgi?id=2170472
 ---
 src/qemu/qemu_monitor.c      | 4 +++-
 src/qemu/qemu_monitor_priv.h | 2 ++
 2 files changed, 5 insertions(+), 1 deletion(-)
 diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c
 index bba92592c5..99667fdf2f 100644
 --- a/src/qemu/qemu_monitor.c
 +++ b/src/qemu/qemu_monitor.c
@@ -610,8 +610,10 @@ qemuMonitorOpenInternal(virDomainObj *vm,
     mon->cb = cb;
     mon->callbackOpaque = opaque;
 -    if (priv)
 +    if (priv) {
         mon->objectAddNoWrap = virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_OBJECT_JSON);
 +        mon->queryNamedBlockNodesFlat = virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_QMP_QUERY_NAMED_BLOCK_NODES_FLAT);
 +    }
     if (virSetCloseExec(mon->fd) < 0) {
         virReportError(VIR_ERR_INTERNAL_ERROR,
 diff --git a/src/qemu/qemu_monitor_priv.h b/src/qemu/qemu_monitor_priv.h
 index 606aa79fbd..e32928805f 100644
 --- a/src/qemu/qemu_monitor_priv.h
 +++ b/src/qemu/qemu_monitor_priv.h
@@ -91,6 +91,8 @@ struct _qemuMonitor {
     /* true if qemu no longer wants 'props' sub-object of object-add */
     bool objectAddNoWrap;
 +    /* query-named-block-nodes supports the 'flat' option */
 +    bool queryNamedBlockNodesFlat;
 };
 -- 
 2.40.1
--- a/SOURCES/libvirt-qemu-qemuBlockGetNamedNodeData-Remove-pointless-error-path.patch
+++ b/SOURCES/libvirt-qemu-qemuBlockGetNamedNodeData-Remove-pointless-error-path.patch
@ -1,53 +0,0 @@
 From 31986239312c0e460800f5b9921f6593f1556015 Mon Sep 17 00:00:00 2001
 Message-Id: <31986239312c0e460800f5b9921f6593f1556015@dist-git>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Wed, 9 Nov 2022 10:45:27 +0100
 Subject: [PATCH] qemu: qemuBlockGetNamedNodeData: Remove pointless error path
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 We don't need automatic freeing for 'blockNamedNodeData' and we can
 directly return it rather than checking it for NULL-ness first.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit 3fe74ebd9037d695df906ed137d22a8d8d77e169)
 Conflicts:
 	src/qemu/qemu_block.c
    - qemuDomainObjEnter/ExitMonitor still needs 'driver'
 https://bugzilla.redhat.com/show_bug.cgi?id=2170472
 ---
 src/qemu/qemu_block.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)
 diff --git a/src/qemu/qemu_block.c b/src/qemu/qemu_block.c
 index aa566d0097..c9229d1918 100644
 --- a/src/qemu/qemu_block.c
 +++ b/src/qemu/qemu_block.c
@@ -3020,7 +3020,7 @@ qemuBlockGetNamedNodeData(virDomainObj *vm,
 {
     qemuDomainObjPrivate *priv = vm->privateData;
     virQEMUDriver *driver = priv->driver;
 -    g_autoptr(GHashTable) blockNamedNodeData = NULL;
 +    GHashTable *blockNamedNodeData = NULL;
     bool supports_flat = virQEMUCapsGet(priv->qemuCaps,
                                         QEMU_CAPS_QMP_QUERY_NAMED_BLOCK_NODES_FLAT);
@@ -3031,10 +3031,7 @@ qemuBlockGetNamedNodeData(virDomainObj *vm,
     qemuDomainObjExitMonitor(driver, vm);
 -    if (!blockNamedNodeData)
 -        return NULL;
 -
 -    return g_steal_pointer(&blockNamedNodeData);
 +    return blockNamedNodeData;
 }
 -- 
 2.40.1
--- a/SOURCES/libvirt-qemu-relax-shared-memory-check-for-vhostuser-daemons.patch
+++ b/SOURCES/libvirt-qemu-relax-shared-memory-check-for-vhostuser-daemons.patch
@ -1,65 +0,0 @@
 From e9418cec1ba24b6cf78f85bbbef8586ed612692a Mon Sep 17 00:00:00 2001
 Message-Id: <e9418cec1ba24b6cf78f85bbbef8586ed612692a@dist-git>
 From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
 Date: Mon, 13 Mar 2023 13:56:47 +0100
 Subject: [PATCH] qemu: relax shared memory check for vhostuser daemons
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 For some vhostuser daemons, we validate that the guest memory is shared
 with the host.
 With earlier versions of QEMU, it was only possible to mark memory
 as shared by defining an explicit NUMA topology.  Later, QEMU exposed
 the name of the default memory backend (defaultRAMid) so we can mark
 that memory as shared.
 Since libvirt commit:
  commit bff2ad5d6b1f25da02802273934d2a519159fec7
    qemu: Relax validation for mem->access if guest has no NUMA
 we already check for the case when user requests shared memory,
 but QEMU did not expose defaultRAMid.
 Drop the duplicit check from vhostuser device validation, to make
 it pass on hotplug even after libvirtd restart.
 This avoids the need to store the defaultRAMid, since we don't really
 need it for anything after the VM has been already started.
 https://bugzilla.redhat.com/show_bug.cgi?id=2078693
 https://bugzilla.redhat.com/show_bug.cgi?id=2177701
 Signed-off-by: Ján Tomko <jtomko@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit d5c7b7870e45575f81fffcb611c2546d0e02e778)
 Signed-off-by: Ján Tomko <jtomko@redhat.com>
 ---
 src/qemu/qemu_validate.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)
 diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c
 index 7bc14293d6..4069f47c12 100644
 --- a/src/qemu/qemu_validate.c
 +++ b/src/qemu/qemu_validate.c
@@ -1588,16 +1588,12 @@ qemuValidateDomainVirtioOptions(const virDomainVirtioOptions *virtio,
 static int
 qemuValidateDomainDefVhostUserRequireSharedMemory(const virDomainDef *def,
                                                   const char *name,
 -                                                  virQEMUCaps *qemuCaps)
 +                                                  virQEMUCaps *qemuCaps G_GNUC_UNUSED)
 {
 -    const char *defaultRAMId = virQEMUCapsGetMachineDefaultRAMid(qemuCaps,
 -                                                                 def->virtType,
 -                                                                 def->os.machine);
     size_t numa_nodes = virDomainNumaGetNodeCount(def->numa);
     size_t i;
 -    if (numa_nodes == 0 &&
 -        !(defaultRAMId && def->mem.access == VIR_DOMAIN_MEMORY_ACCESS_SHARED)) {
 +    if (numa_nodes == 0 && def->mem.access != VIR_DOMAIN_MEMORY_ACCESS_SHARED) {
         virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
                        _("'%s' requires shared memory"), name);
         return -1;
 -- 
 2.40.1
--- a/SOURCES/libvirt-qemu-tpm-Get-swtpm-pid-without-binary-validation.patch
+++ b/SOURCES/libvirt-qemu-tpm-Get-swtpm-pid-without-binary-validation.patch
@ -1,219 +0,0 @@
 From e3487aab5319df05c5a06a83e4d3e4a87c1e51a9 Mon Sep 17 00:00:00 2001
 Message-Id: <e3487aab5319df05c5a06a83e4d3e4a87c1e51a9@dist-git>
 From: Vasiliy Ulyanov <vulyanov@suse.de>
 Date: Wed, 2 Feb 2022 17:28:16 +0100
 Subject: [PATCH] qemu: tpm: Get swtpm pid without binary validation
 Access to /proc/[pid]/exe may be restricted in certain environments (e.g.
 in containers) and any attempt to stat(2) or readlink(2) the file will
 result in 'permission denied' error if the calling process does not have
 CAP_SYS_PTRACE capability. According to proc(5) manpage:
 Permission to dereference or read (readlink(2)) this symbolic link is
 governed by a ptrace access mode PTRACE_MODE_READ_FSCREDS check; see
 ptrace(2).
 The binary validation in virPidFileReadPathIfAlive may fail with EACCES.
 Therefore instead do only the check that the pidfile is locked by the
 correct process. To ensure this is always the case the daemonization and
 pidfile handling of the swtpm command is now controlled by libvirt.
 Signed-off-by: Vasiliy Ulyanov <vulyanov@suse.de>
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit a9c500d2b50c5c041a1bb6ae9724402cf1cec8fe)
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2152188
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/qemu/qemu_tpm.c | 94 ++++++++++++++++++++++++++-------------------
 1 file changed, 54 insertions(+), 40 deletions(-)
 diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c
 index 7e7b01768e..9c5d1ffed4 100644
 --- a/src/qemu/qemu_tpm.c
 +++ b/src/qemu/qemu_tpm.c
@@ -44,6 +44,7 @@
 #include "qemu_tpm.h"
 #include "virtpm.h"
 #include "virsecret.h"
 +#include "virtime.h"
 #define VIR_FROM_THIS VIR_FROM_NONE
@@ -258,13 +259,13 @@ qemuTPMEmulatorGetPid(const char *swtpmStateDir,
                       const char *shortName,
                       pid_t *pid)
 {
 -    g_autofree char *swtpm = virTPMGetSwtpm();
     g_autofree char *pidfile = qemuTPMEmulatorCreatePidFilename(swtpmStateDir,
                                                                 shortName);
 +
     if (!pidfile)
         return -1;
 -    if (virPidFileReadPathIfAlive(pidfile, pid, swtpm) < 0)
 +    if (virPidFileReadPathIfLocked(pidfile, pid) < 0)
         return -1;
     return 0;
@@ -660,9 +661,6 @@ qemuTPMEmulatorReconfigure(const char *storagepath,
  * @privileged: whether we are running in privileged mode
  * @swtpm_user: The uid for the swtpm to run as (drop privileges to from root)
  * @swtpm_group: The gid for the swtpm to run as
 - * @swtpmStateDir: the directory where swtpm writes the pid file and creates the
 - *                 Unix socket
 - * @shortName: the short name of the VM
  * @incomingMigration: whether we have an incoming migration
  *
  * Create the virCommand use for starting the emulator
@@ -676,13 +674,10 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm,
                             bool privileged,
                             uid_t swtpm_user,
                             gid_t swtpm_group,
 -                            const char *swtpmStateDir,
 -                            const char *shortName,
                             bool incomingMigration)
 {
     g_autoptr(virCommand) cmd = NULL;
     bool created = false;
 -    g_autofree char *pidfile = NULL;
     g_autofree char *swtpm = virTPMGetSwtpm();
     int pwdfile_fd = -1;
     int migpwdfile_fd = -1;
@@ -721,7 +716,7 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm,
     virCommandClearCaps(cmd);
 -    virCommandAddArgList(cmd, "socket", "--daemon", "--ctrl", NULL);
 +    virCommandAddArgList(cmd, "socket", "--ctrl", NULL);
     virCommandAddArgFormat(cmd, "type=unixio,path=%s,mode=0600",
                            tpm->data.emulator.source->data.nix.path);
@@ -748,12 +743,6 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm,
         break;
     }
 -    if (!(pidfile = qemuTPMEmulatorCreatePidFilename(swtpmStateDir, shortName)))
 -        goto error;
 -
 -    virCommandAddArg(cmd, "--pid");
 -    virCommandAddArgFormat(cmd, "file=%s", pidfile);
 -
     if (tpm->data.emulator.hassecretuuid) {
         if (!virTPMSwtpmCapsGet(VIR_TPM_SWTPM_FEATURE_CMDARG_PWD_FD)) {
             virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED,
@@ -904,12 +893,14 @@ qemuExtTPMStartEmulator(virQEMUDriver *driver,
                         bool incomingMigration)
 {
     g_autoptr(virCommand) cmd = NULL;
 -    int exitstatus = 0;
 -    g_autofree char *errbuf = NULL;
 +    VIR_AUTOCLOSE errfd = -1;
     g_autoptr(virQEMUDriverConfig) cfg = NULL;
     g_autofree char *shortName = virDomainDefGetShortName(vm->def);
 -    int cmdret = 0, timeout, rc;
 -    pid_t pid;
 +    g_autofree char *pidfile = NULL;
 +    virTimeBackOffVar timebackoff;
 +    const unsigned long long timeout = 1000; /* ms */
 +    int cmdret = 0;
 +    pid_t pid = -1;
     if (!shortName)
         return -1;
@@ -923,48 +914,71 @@ qemuExtTPMStartEmulator(virQEMUDriver *driver,
                                             driver->privileged,
                                             cfg->swtpm_user,
                                             cfg->swtpm_group,
 -                                            cfg->swtpmStateDir, shortName,
                                             incomingMigration)))
         return -1;
     if (qemuExtDeviceLogCommand(driver, vm, cmd, "TPM Emulator") < 0)
         return -1;
 -    virCommandSetErrorBuffer(cmd, &errbuf);
 +    if (!(pidfile = qemuTPMEmulatorCreatePidFilename(cfg->swtpmStateDir, shortName)))
 +        return -1;
 +
 +    virCommandDaemonize(cmd);
 +    virCommandSetPidFile(cmd, pidfile);
 +    virCommandSetErrorFD(cmd, &errfd);
     if (qemuSecurityStartTPMEmulator(driver, vm, cmd,
                                      cfg->swtpm_user, cfg->swtpm_group,
 -                                     &exitstatus, &cmdret) < 0)
 +                                     NULL, &cmdret) < 0)
         return -1;
 -    if (cmdret < 0 || exitstatus != 0) {
 -        virReportError(VIR_ERR_INTERNAL_ERROR,
 -                       _("Could not start 'swtpm'. exitstatus: %d, "
 -                         "error: %s"), exitstatus, errbuf);
 -        return -1;
 +    if (cmdret < 0) {
 +        /* virCommandRun() hidden in qemuSecurityStartTPMEmulator()
 +         * already reported error. */
 +        goto error;
     }
 -    /* check that the swtpm has written its pid into the file */
 -    timeout = 1000; /* ms */
 -    while (timeout > 0) {
 -        rc = qemuTPMEmulatorGetPid(cfg->swtpmStateDir, shortName, &pid);
 -        if (rc < 0) {
 -            timeout -= 50;
 -            g_usleep(50 * 1000);
 +    if (virPidFileReadPath(pidfile, &pid) < 0) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
 +                       _("swtpm didn't show up"));
 +        goto error;
 +    }
 +
 +    if (virTimeBackOffStart(&timebackoff, 1, timeout) < 0)
 +        goto error;
 +    while (virTimeBackOffWait(&timebackoff)) {
 +        char errbuf[1024] = { 0 };
 +
 +        if (virFileExists(tpm->data.emulator.source->data.nix.path))
 +            break;
 +
 +        if (virProcessKill(pid, 0) == 0)
             continue;
 +
 +        if (saferead(errfd, errbuf, sizeof(errbuf) - 1) < 0) {
 +            virReportSystemError(errno, "%s",
 +                                 _("swtpm died unexpectedly"));
 +        } else {
 +            virReportError(VIR_ERR_OPERATION_FAILED,
 +                           _("swtpm died and reported: %s"), errbuf);
         }
 -        if (rc == 0 && pid == (pid_t)-1)
 -            goto error;
 -        break;
 +        goto error;
     }
 -    if (timeout <= 0)
 +
 +    if (!virFileExists(tpm->data.emulator.source->data.nix.path)) {
 +        virReportError(VIR_ERR_OPERATION_TIMEOUT, "%s",
 +                       _("swtpm socket did not show up"));
         goto error;
 +    }
     return 0;
  error:
 -    virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
 -                   _("swtpm failed to start"));
 +    virCommandAbort(cmd);
 +    if (pid >= 0)
 +        virProcessKillPainfully(pid, true);
 +    if (pidfile)
 +        unlink(pidfile);
     return -1;
 }
 -- 
 2.39.0
--- a/SOURCES/libvirt-qemu-virtiofs-format-thread-pool-size.patch
+++ b/SOURCES/libvirt-qemu-virtiofs-format-thread-pool-size.patch
@ -1,37 +0,0 @@
 From 44f83782ba882f9eb037a54fb75231c305d98712 Mon Sep 17 00:00:00 2001
 Message-Id: <44f83782ba882f9eb037a54fb75231c305d98712@dist-git>
 From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
 Date: Fri, 10 Jun 2022 15:25:00 +0200
 Subject: [PATCH] qemu: virtiofs: format --thread-pool-size
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 https://bugzilla.redhat.com/show_bug.cgi?id=2079582
 Signed-off-by: Ján Tomko <jtomko@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 2753eba20ce76d3d8785b23a6e940574ca12fe3c)
 Signed-off-by: Ján Tomko <jtomko@redhat.com>
 ---
 src/qemu/qemu_virtiofs.c | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/src/qemu/qemu_virtiofs.c b/src/qemu/qemu_virtiofs.c
 index 1b853a5a59..1ee3781286 100644
 --- a/src/qemu/qemu_virtiofs.c
 +++ b/src/qemu/qemu_virtiofs.c
@@ -163,6 +163,10 @@ qemuVirtioFSBuildCommandLine(virQEMUDriverConfig *cfg,
         virBufferAddLit(&opts, ",no_posix_lock");
     virCommandAddArgBuffer(cmd, &opts);
 +
 +    if (fs->thread_pool_size >= 0)
 +        virCommandAddArgFormat(cmd, "--thread-pool-size=%i", fs->thread_pool_size);
 +
     if (cfg->virtiofsdDebug)
         virCommandAddArg(cmd, "-d");
 -- 
 2.35.1
--- a/SOURCES/libvirt-qemuAgentGetDisks-Don-t-use-virJSONValueObjectGetStringArray-for-optional-data.patch
+++ b/SOURCES/libvirt-qemuAgentGetDisks-Don-t-use-virJSONValueObjectGetStringArray-for-optional-data.patch
@ -1,57 +0,0 @@
 From 1ad707f19e570b76c1f6517194d9cc86b084014d Mon Sep 17 00:00:00 2001
 Message-Id: <1ad707f19e570b76c1f6517194d9cc86b084014d@dist-git>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Thu, 1 Dec 2022 17:02:42 +0100
 Subject: [PATCH] qemuAgentGetDisks: Don't use virJSONValueObjectGetStringArray
 for optional data
 The 'dependencies' field in the return data may be missing in some
 cases. Historically 'virJSONValueObjectGetStringArray' didn't report
 error in such case, but later refactor (commit 043b50b948ef3c2 ) added
 an error in order to use it in other places too.
 Unfortunately this results in the error log being spammed with an
 irrelevant error in case when qemuAgentGetDisks is invoked on a VM
 running windows.
 Replace the use of virJSONValueObjectGetStringArray by fetching the
 array first and calling virJSONValueArrayToStringList only when we have
 an array.
 Fixes: 043b50b948ef3c2a4adf5fa32a93ec2589851ac6
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2149752
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 3b576601dfb924bb518870a01de5d1a421cbb467)
 ---
 src/qemu/qemu_agent.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)
 diff --git a/src/qemu/qemu_agent.c b/src/qemu/qemu_agent.c
 index f33cd47078..8a55044c9e 100644
 --- a/src/qemu/qemu_agent.c
 +++ b/src/qemu/qemu_agent.c
@@ -2550,6 +2550,7 @@ int qemuAgentGetDisks(qemuAgent *agent,
     for (i = 0; i < ndata; i++) {
         virJSONValue *addr;
         virJSONValue *entry = virJSONValueArrayGet(data, i);
 +        virJSONValue *dependencies;
         qemuAgentDiskInfo *disk;
         if (!entry) {
@@ -2575,7 +2576,11 @@ int qemuAgentGetDisks(qemuAgent *agent,
             goto error;
         }
 -        disk->dependencies = virJSONValueObjectGetStringArray(entry, "dependencies");
 +        if ((dependencies = virJSONValueObjectGetArray(entry, "dependencies"))) {
 +            if (!(disk->dependencies = virJSONValueArrayToStringList(dependencies)))
 +                goto error;
 +        }
 +
         disk->alias = g_strdup(virJSONValueObjectGetString(entry, "alias"));
         addr = virJSONValueObjectGetObject(entry, "address");
         if (addr) {
 -- 
 2.39.0
--- a/SOURCES/libvirt-qemuDomainSetupDisk-Initialize-targetPaths.patch
+++ b/SOURCES/libvirt-qemuDomainSetupDisk-Initialize-targetPaths.patch
@ -1,41 +0,0 @@
 From ab4488be3282dd5d0b9582e6a5d1dafbe7b90489 Mon Sep 17 00:00:00 2001
 Message-Id: <ab4488be3282dd5d0b9582e6a5d1dafbe7b90489@dist-git>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Tue, 25 Jan 2022 17:49:00 +0100
 Subject: [PATCH] qemuDomainSetupDisk: Initialize 'targetPaths'
 Compiler isn't able to see that 'virDevMapperGetTargets' in cases e.g.
 when the devmapper isn't available may not initialize the value in the
 pointer passed as the second argument.
 The usage 'qemuDomainSetupDisk' lead to an accidental infinite loop as
 previous calls apparently doctored the stack to a point where
 'g_slist_concat' would end up in an infinite loop trying to find the end
 of the list.
 Fixes: 6c49c2ee9fcb88de02cdc333f666a8e95d60a3b0
 Closes: https://gitlab.com/libvirt/libvirt/-/issues/268
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Andrea Bolognani <abologna@redhat.com>
 (cherry picked from commit ddb2384f0c78a91c40d95afdbc7fe325e95ef2bc)
 https://bugzilla.redhat.com/show_bug.cgi?id=2046172
 ---
 src/qemu/qemu_namespace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/qemu/qemu_namespace.c b/src/qemu/qemu_namespace.c
 index 23b1160c5e..94453033f5 100644
 --- a/src/qemu/qemu_namespace.c
 +++ b/src/qemu/qemu_namespace.c
@@ -251,7 +251,7 @@ qemuDomainSetupDisk(virStorageSource *src,
             if (!(tmpPath = virPCIDeviceAddressGetIOMMUGroupDev(&next->nvme->pciAddr)))
                 return -1;
         } else {
 -            GSList *targetPaths;
 +            GSList *targetPaths = NULL;
             if (virStorageSourceIsEmpty(next) ||
                 !virStorageSourceIsLocalStorage(next)) {
 -- 
 2.35.1
--- a/SOURCES/libvirt-qemuMonitorJSONBlockStatsUpdateCapacityBlockdev-Use-flat-mode-of-query-named-block-nodes.patch
+++ b/SOURCES/libvirt-qemuMonitorJSONBlockStatsUpdateCapacityBlockdev-Use-flat-mode-of-query-named-block-nodes.patch
@ -1,41 +0,0 @@
 From f20062e1fe1e7bca8b97d2383f9e8a06f0f4111a Mon Sep 17 00:00:00 2001
 Message-Id: <f20062e1fe1e7bca8b97d2383f9e8a06f0f4111a@dist-git>
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Wed, 9 Nov 2022 11:06:25 +0100
 Subject: [PATCH] qemuMonitorJSONBlockStatsUpdateCapacityBlockdev: Use 'flat'
 mode of query-named-block-nodes
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 'query-named-block-nodes' in non-flat mode returns redundantly nested
 data under the 'backing-image' field. Fortunately we don't need it when
 updating the capacity stats.
 This function was unfortunately not fixed originally when the support
 for flat mode was added. Use the flat cached in the monitor object to
 force flat mode if available.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit bbd4d4899391b3bd1906cce61a3634f42f4b1bdf)
 https://bugzilla.redhat.com/show_bug.cgi?id=2170472
 ---
 src/qemu/qemu_monitor_json.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
 index 7d8755246f..789554e225 100644
 --- a/src/qemu/qemu_monitor_json.c
 +++ b/src/qemu/qemu_monitor_json.c
@@ -2679,7 +2679,7 @@ qemuMonitorJSONBlockStatsUpdateCapacityBlockdev(qemuMonitor *mon,
 {
     g_autoptr(virJSONValue) nodes = NULL;
 -    if (!(nodes = qemuMonitorJSONQueryNamedBlockNodes(mon, false)))
 +    if (!(nodes = qemuMonitorJSONQueryNamedBlockNodes(mon, mon->queryNamedBlockNodesFlat)))
         return -1;
     if (virJSONValueArrayForeachSteal(nodes,
 -- 
 2.40.1
--- a/SOURCES/libvirt-qemuProcessReconnect-Don-t-build-memory-paths.patch
+++ b/SOURCES/libvirt-qemuProcessReconnect-Don-t-build-memory-paths.patch
@ -1,57 +0,0 @@
 From c5c8bb4aafc8f247e6da146a6683174038611600 Mon Sep 17 00:00:00 2001
 Message-Id: <c5c8bb4aafc8f247e6da146a6683174038611600@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Wed, 28 Sep 2022 10:12:36 +0200
 Subject: [PATCH] qemuProcessReconnect: Don't build memory paths
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Let me take you on a short trip to history. A long time ago,
 libvirt would configure all QEMUs to use $hugetlbfs/libvirt/qemu
 for their hugepages setup. This was problematic, because it did
 not allow enough separation between guests. Therefore in
 v3.0.0-rc1~367 the path changed to a per-domain basis:
  $hugetlbfs/libvirt/qemu/$domainShortName
 And to help with migration on daemon restart a call to
 qemuProcessBuildDestroyMemoryPaths() was added to
 qemuProcessReconnect() (well, it was named
 qemuProcessBuildDestroyHugepagesPath() back then, see
 v3.10.0-rc1~174). This was desirable then, because the memory
 hotplug code did not call the function, it simply assumes
 per-domain paths to exist. But this changed in v3.5.0-rc1~92
 after which the per-domain paths are created on memory hotplug
 too.
 Therefore, it's no longer necessary to create these paths in
 qemuProcessReconnect(). They are created exactly when needed
 (domain startup and memory hotplug).
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit 3478cca80ea7382cfdbff836d5d0b92aa014297b)
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2123196
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/qemu/qemu_process.c | 3 ---
 1 file changed, 3 deletions(-)
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index 1164340aa9..0fb665bc82 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -8869,9 +8869,6 @@ qemuProcessReconnect(void *opaque)
         goto cleanup;
     }
 -    if (qemuProcessBuildDestroyMemoryPaths(driver, obj, NULL, true) < 0)
 -        goto error;
 -
     if ((qemuDomainAssignAddresses(obj->def, priv->qemuCaps,
                                    driver, obj, false)) < 0) {
         goto error;
 -- 
 2.38.0
--- a/SOURCES/libvirt-qemu_capabilities-Detect-memory-backend-.prealloc-threads-property.patch
+++ b/SOURCES/libvirt-qemu_capabilities-Detect-memory-backend-.prealloc-threads-property.patch
@ -1,314 +0,0 @@
 From c387e7680c07d7dbb934dbe972e99ab78cebad28 Mon Sep 17 00:00:00 2001
 Message-Id: <c387e7680c07d7dbb934dbe972e99ab78cebad28@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Mon, 21 Mar 2022 16:55:05 +0100
 Subject: [PATCH] qemu_capabilities: Detect memory-backend-*.prealloc-threads
 property
 The prealloc-threads is property of memory-backend class which is
 parent to the other three classes memory-backend-{ram,file,memfd}.
 Therefore the property is present for all, or none if QEMU is
 older than v5.0.0-rc0~75^2~1^2~3 which introduced the property.
 Anyway, the .reserve property is the same story, and we chose
 memory-backend-file to detect it, so stick with our earlier
 decision and use the same backend to detect this new property.
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
 (cherry picked from commit a30dac15dcdb7a6c7a3e9b6cfc5cd77bae185081)
 Conflicts:
 src/qemu/qemu_capabilities.c: Context
 src/qemu/qemu_capabilities.h
 tests/qemucapabilitiesdata/caps_5.2.0.aarch64.xml
 tests/qemucapabilitiesdata/caps_5.2.0.ppc64.xml
 tests/qemucapabilitiesdata/caps_5.2.0.riscv64.xml
 tests/qemucapabilitiesdata/caps_5.2.0.s390x.xml
 tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml
 tests/qemucapabilitiesdata/caps_6.0.0.aarch64.xml
 tests/qemucapabilitiesdata/caps_6.0.0.s390x.xml
 tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml
 tests/qemucapabilitiesdata/caps_6.1.0.x86_64.xml
 tests/qemucapabilitiesdata/caps_6.2.0.aarch64.xml
 tests/qemucapabilitiesdata/caps_6.2.0.ppc64.xml
 tests/qemucapabilitiesdata/caps_6.2.0.x86_64.xml
 tests/qemucapabilitiesdata/caps_7.0.0.ppc64.xml
 tests/qemucapabilitiesdata/caps_7.0.0.x86_64.xml
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2067126
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/qemu/qemu_capabilities.c                      | 2 ++
 src/qemu/qemu_capabilities.h                      | 1 +
 tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml | 1 +
 tests/qemucapabilitiesdata/caps_5.0.0.ppc64.xml   | 1 +
 tests/qemucapabilitiesdata/caps_5.0.0.riscv64.xml | 1 +
 tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml  | 1 +
 tests/qemucapabilitiesdata/caps_5.1.0.sparc.xml   | 1 +
 tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml  | 1 +
 tests/qemucapabilitiesdata/caps_5.2.0.aarch64.xml | 1 +
 tests/qemucapabilitiesdata/caps_5.2.0.ppc64.xml   | 1 +
 tests/qemucapabilitiesdata/caps_5.2.0.riscv64.xml | 1 +
 tests/qemucapabilitiesdata/caps_5.2.0.s390x.xml   | 1 +
 tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml  | 1 +
 tests/qemucapabilitiesdata/caps_6.0.0.aarch64.xml | 1 +
 tests/qemucapabilitiesdata/caps_6.0.0.s390x.xml   | 1 +
 tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml  | 1 +
 tests/qemucapabilitiesdata/caps_6.1.0.x86_64.xml  | 1 +
 tests/qemucapabilitiesdata/caps_6.2.0.aarch64.xml | 1 +
 tests/qemucapabilitiesdata/caps_6.2.0.ppc64.xml   | 1 +
 tests/qemucapabilitiesdata/caps_6.2.0.x86_64.xml  | 1 +
 20 files changed, 21 insertions(+)
 diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
 index 8ae80ef8d7..c4f7db55c8 100644
 --- a/src/qemu/qemu_capabilities.c
 +++ b/src/qemu/qemu_capabilities.c
@@ -657,6 +657,7 @@ VIR_ENUM_IMPL(virQEMUCaps,
               /* 420 */
               "blockdev-reopen.__com.redhat_rhel-av-8_2_0-api", /* QEMU_CAPS_BLOCKDEV_REOPEN_COM_REDHAT_AV_8_2_0_API */
 +              "memory-backend-file.prealloc-threads", /* QEMU_CAPS_MEMORY_BACKEND_PREALLOC_THREADS */
     );
@@ -1713,6 +1714,7 @@ static struct virQEMUCapsStringFlags virQEMUCapsObjectPropsMemoryBackendFile[] =
      * released qemu versions. */
     { "x-use-canonical-path-for-ramblock-id", QEMU_CAPS_X_USE_CANONICAL_PATH_FOR_RAMBLOCK_ID },
     { "reserve", QEMU_CAPS_MEMORY_BACKEND_RESERVE },
 +    { "prealloc-threads", QEMU_CAPS_MEMORY_BACKEND_PREALLOC_THREADS },
 };
 static struct virQEMUCapsStringFlags virQEMUCapsObjectPropsMemoryBackendMemfd[] = {
 diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
 index cde6c18b4c..8e65635e0d 100644
 --- a/src/qemu/qemu_capabilities.h
 +++ b/src/qemu/qemu_capabilities.h
@@ -636,6 +636,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */
     /* 420 */
     QEMU_CAPS_BLOCKDEV_REOPEN_COM_REDHAT_AV_8_2_0_API, /* downstream support for blockdev reopen in rhel-av-8.2.0 */
 +    QEMU_CAPS_MEMORY_BACKEND_PREALLOC_THREADS, /* -object memory-backend-*.prealloc-threads */
     QEMU_CAPS_LAST /* this must always be the last item */
 } virQEMUCapsFlags;
 diff --git a/tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml b/tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml
 index bb6a7d5ee7..3b18f160db 100644
 --- a/tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml
 +++ b/tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml
@@ -179,6 +179,7 @@
   <flag name='input-linux'/>
   <flag name='query-display-options'/>
   <flag name='virtio-blk.queue-size'/>
 +  <flag name='memory-backend-file.prealloc-threads'/>
   <version>5000000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>61700241</microcodeVersion>
 diff --git a/tests/qemucapabilitiesdata/caps_5.0.0.ppc64.xml b/tests/qemucapabilitiesdata/caps_5.0.0.ppc64.xml
 index f8317c1117..c90f2be296 100644
 --- a/tests/qemucapabilitiesdata/caps_5.0.0.ppc64.xml
 +++ b/tests/qemucapabilitiesdata/caps_5.0.0.ppc64.xml
@@ -187,6 +187,7 @@
   <flag name='input-linux'/>
   <flag name='query-display-options'/>
   <flag name='virtio-blk.queue-size'/>
 +  <flag name='memory-backend-file.prealloc-threads'/>
   <version>5000000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>42900241</microcodeVersion>
 diff --git a/tests/qemucapabilitiesdata/caps_5.0.0.riscv64.xml b/tests/qemucapabilitiesdata/caps_5.0.0.riscv64.xml
 index 58c7eb6651..8fbe8f114f 100644
 --- a/tests/qemucapabilitiesdata/caps_5.0.0.riscv64.xml
 +++ b/tests/qemucapabilitiesdata/caps_5.0.0.riscv64.xml
@@ -171,6 +171,7 @@
   <flag name='input-linux'/>
   <flag name='query-display-options'/>
   <flag name='virtio-blk.queue-size'/>
 +  <flag name='memory-backend-file.prealloc-threads'/>
   <version>5000000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>0</microcodeVersion>
 diff --git a/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml
 index 69f49020e7..b76c4346a4 100644
 --- a/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml
 +++ b/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml
@@ -221,6 +221,7 @@
   <flag name='input-linux'/>
   <flag name='query-display-options'/>
   <flag name='virtio-blk.queue-size'/>
 +  <flag name='memory-backend-file.prealloc-threads'/>
   <version>5000000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>43100241</microcodeVersion>
 diff --git a/tests/qemucapabilitiesdata/caps_5.1.0.sparc.xml b/tests/qemucapabilitiesdata/caps_5.1.0.sparc.xml
 index 58af90b29f..7de7c291f5 100644
 --- a/tests/qemucapabilitiesdata/caps_5.1.0.sparc.xml
 +++ b/tests/qemucapabilitiesdata/caps_5.1.0.sparc.xml
@@ -90,6 +90,7 @@
   <flag name='rotation-rate'/>
   <flag name='input-linux'/>
   <flag name='query-display-options'/>
 +  <flag name='memory-backend-file.prealloc-threads'/>
   <version>5001000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>0</microcodeVersion>
 diff --git a/tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml
 index 578e16e8b0..9b5cb3cd7a 100644
 --- a/tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml
 +++ b/tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml
@@ -224,6 +224,7 @@
   <flag name='query-display-options'/>
   <flag name='virtio-blk.queue-size'/>
   <flag name='virtio-mem-pci'/>
 +  <flag name='memory-backend-file.prealloc-threads'/>
   <version>5001000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>43100242</microcodeVersion>
 diff --git a/tests/qemucapabilitiesdata/caps_5.2.0.aarch64.xml b/tests/qemucapabilitiesdata/caps_5.2.0.aarch64.xml
 index b943eaedaf..020c04c1c4 100644
 --- a/tests/qemucapabilitiesdata/caps_5.2.0.aarch64.xml
 +++ b/tests/qemucapabilitiesdata/caps_5.2.0.aarch64.xml
@@ -184,6 +184,7 @@
   <flag name='query-display-options'/>
   <flag name='virtio-blk.queue-size'/>
   <flag name='query-dirty-rate'/>
 +  <flag name='memory-backend-file.prealloc-threads'/>
   <version>5002000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>61700243</microcodeVersion>
 diff --git a/tests/qemucapabilitiesdata/caps_5.2.0.ppc64.xml b/tests/qemucapabilitiesdata/caps_5.2.0.ppc64.xml
 index ec64e1cacf..5346b1552c 100644
 --- a/tests/qemucapabilitiesdata/caps_5.2.0.ppc64.xml
 +++ b/tests/qemucapabilitiesdata/caps_5.2.0.ppc64.xml
@@ -190,6 +190,7 @@
   <flag name='query-display-options'/>
   <flag name='virtio-blk.queue-size'/>
   <flag name='query-dirty-rate'/>
 +  <flag name='memory-backend-file.prealloc-threads'/>
   <version>5002000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>42900243</microcodeVersion>
 diff --git a/tests/qemucapabilitiesdata/caps_5.2.0.riscv64.xml b/tests/qemucapabilitiesdata/caps_5.2.0.riscv64.xml
 index a11d15f91a..9f6974f85d 100644
 --- a/tests/qemucapabilitiesdata/caps_5.2.0.riscv64.xml
 +++ b/tests/qemucapabilitiesdata/caps_5.2.0.riscv64.xml
@@ -174,6 +174,7 @@
   <flag name='query-display-options'/>
   <flag name='virtio-blk.queue-size'/>
   <flag name='query-dirty-rate'/>
 +  <flag name='memory-backend-file.prealloc-threads'/>
   <version>5002000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>0</microcodeVersion>
 diff --git a/tests/qemucapabilitiesdata/caps_5.2.0.s390x.xml b/tests/qemucapabilitiesdata/caps_5.2.0.s390x.xml
 index 552e1d43c9..44753b64c3 100644
 --- a/tests/qemucapabilitiesdata/caps_5.2.0.s390x.xml
 +++ b/tests/qemucapabilitiesdata/caps_5.2.0.s390x.xml
@@ -141,6 +141,7 @@
   <flag name='query-display-options'/>
   <flag name='virtio-blk.queue-size'/>
   <flag name='query-dirty-rate'/>
 +  <flag name='memory-backend-file.prealloc-threads'/>
   <version>5002000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>39100243</microcodeVersion>
 diff --git a/tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml
 index bcc262551a..db11c99739 100644
 --- a/tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml
 +++ b/tests/qemucapabilitiesdata/caps_5.2.0.x86_64.xml
@@ -227,6 +227,7 @@
   <flag name='virtio-mem-pci'/>
   <flag name='piix4.acpi-root-pci-hotplug'/>
   <flag name='query-dirty-rate'/>
 +  <flag name='memory-backend-file.prealloc-threads'/>
   <version>5002000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>43100243</microcodeVersion>
 diff --git a/tests/qemucapabilitiesdata/caps_6.0.0.aarch64.xml b/tests/qemucapabilitiesdata/caps_6.0.0.aarch64.xml
 index 0fefe64537..5f9a97df43 100644
 --- a/tests/qemucapabilitiesdata/caps_6.0.0.aarch64.xml
 +++ b/tests/qemucapabilitiesdata/caps_6.0.0.aarch64.xml
@@ -192,6 +192,7 @@
   <flag name='set-action'/>
   <flag name='virtio-blk.queue-size'/>
   <flag name='query-dirty-rate'/>
 +  <flag name='memory-backend-file.prealloc-threads'/>
   <version>6000000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>61700242</microcodeVersion>
 diff --git a/tests/qemucapabilitiesdata/caps_6.0.0.s390x.xml b/tests/qemucapabilitiesdata/caps_6.0.0.s390x.xml
 index 61685066b8..46bd1d3d2d 100644
 --- a/tests/qemucapabilitiesdata/caps_6.0.0.s390x.xml
 +++ b/tests/qemucapabilitiesdata/caps_6.0.0.s390x.xml
@@ -149,6 +149,7 @@
   <flag name='set-action'/>
   <flag name='virtio-blk.queue-size'/>
   <flag name='query-dirty-rate'/>
 +  <flag name='memory-backend-file.prealloc-threads'/>
   <version>6000000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>39100242</microcodeVersion>
 diff --git a/tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml
 index 0d6763e9a3..99bbb6e237 100644
 --- a/tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml
 +++ b/tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml
@@ -236,6 +236,7 @@
   <flag name='piix4.acpi-root-pci-hotplug'/>
   <flag name='query-dirty-rate'/>
   <flag name='sev-inject-launch-secret'/>
 +  <flag name='memory-backend-file.prealloc-threads'/>
   <version>6000000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>43100242</microcodeVersion>
 diff --git a/tests/qemucapabilitiesdata/caps_6.1.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_6.1.0.x86_64.xml
 index 228f397c67..ff0715e605 100644
 --- a/tests/qemucapabilitiesdata/caps_6.1.0.x86_64.xml
 +++ b/tests/qemucapabilitiesdata/caps_6.1.0.x86_64.xml
@@ -240,6 +240,7 @@
   <flag name='query-dirty-rate'/>
   <flag name='rbd-encryption'/>
   <flag name='sev-inject-launch-secret'/>
 +  <flag name='memory-backend-file.prealloc-threads'/>
   <version>6001000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>43100243</microcodeVersion>
 diff --git a/tests/qemucapabilitiesdata/caps_6.2.0.aarch64.xml b/tests/qemucapabilitiesdata/caps_6.2.0.aarch64.xml
 index 6bf9933bc5..dd6f0e6919 100644
 --- a/tests/qemucapabilitiesdata/caps_6.2.0.aarch64.xml
 +++ b/tests/qemucapabilitiesdata/caps_6.2.0.aarch64.xml
@@ -203,6 +203,7 @@
   <flag name='memory-backend-file.reserve'/>
   <flag name='query-dirty-rate'/>
   <flag name='rbd-encryption'/>
 +  <flag name='memory-backend-file.prealloc-threads'/>
   <version>6001050</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>61700244</microcodeVersion>
 diff --git a/tests/qemucapabilitiesdata/caps_6.2.0.ppc64.xml b/tests/qemucapabilitiesdata/caps_6.2.0.ppc64.xml
 index 06cd7fb396..2646cdf88f 100644
 --- a/tests/qemucapabilitiesdata/caps_6.2.0.ppc64.xml
 +++ b/tests/qemucapabilitiesdata/caps_6.2.0.ppc64.xml
@@ -199,6 +199,7 @@
   <flag name='piix4.acpi-root-pci-hotplug'/>
   <flag name='query-dirty-rate'/>
   <flag name='rbd-encryption'/>
 +  <flag name='memory-backend-file.prealloc-threads'/>
   <version>6001050</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>42900244</microcodeVersion>
 diff --git a/tests/qemucapabilitiesdata/caps_6.2.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_6.2.0.x86_64.xml
 index 75aaeed03c..f25ec1b84a 100644
 --- a/tests/qemucapabilitiesdata/caps_6.2.0.x86_64.xml
 +++ b/tests/qemucapabilitiesdata/caps_6.2.0.x86_64.xml
@@ -241,6 +241,7 @@
   <flag name='rbd-encryption'/>
   <flag name='sev-guest-kernel-hashes'/>
   <flag name='sev-inject-launch-secret'/>
 +  <flag name='memory-backend-file.prealloc-threads'/>
   <version>6002000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>43100244</microcodeVersion>
 -- 
 2.35.1
--- a/SOURCES/libvirt-qemu_command-Generate-memory-only-after-controllers.patch
+++ b/SOURCES/libvirt-qemu_command-Generate-memory-only-after-controllers.patch
@ -1,663 +0,0 @@
 From e4e8b74f2cf090c8b29efcd3ceac4e4c4d07b929 Mon Sep 17 00:00:00 2001
 Message-Id: <e4e8b74f2cf090c8b29efcd3ceac4e4c4d07b929@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Thu, 27 Jan 2022 11:13:53 +0100
 Subject: [PATCH] qemu_command: Generate memory only after controllers
 Currently, memory device (def->mems) part of cmd line is
 generated before any controller. In majority of cases it doesn't
 matter because neither of memory devices live on a bus that's
 created by an exposed controller (e.g. there's no DIMM
 controller, at least not exposed). Except for virtio-mem and
 virtio-pmem, which do have a PCI address. And if it so happens
 that the device goes onto non-default bus (pci.0) starting such
 guest fails, because the controller that creates the desired bus
 wasn't processed yet. QEMU processes arguments in order.
 For instance, if virtio-mem has address with bus='0x01' QEMU
 refuses to start with the following message:
  Bus 'pci.1' not found
 Similarly for virtio-pmem. I've successfully tested migration and
 changing the order does not affect migration stream.
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2047271
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Andrea Bolognani <abologna@redhat.com>
 (cherry picked from commit af23241cfed712f69450e82135d7c7b4899736de)
 Conflicts:
 tests/qemuxml2argvdata/hugepages-nvdimm.x86_64-latest.args:
 tests/qemuxml2argvdata/memfd-memory-numa.x86_64-latest.args:
 tests/qemuxml2argvdata/memory-hotplug-nvdimm-access.x86_64-latest.args:
 tests/qemuxml2argvdata/memory-hotplug-nvdimm-align.x86_64-latest.args:
 tests/qemuxml2argvdata/memory-hotplug-nvdimm-label.x86_64-latest.args:
 tests/qemuxml2argvdata/memory-hotplug-nvdimm-pmem.x86_64-latest.args:
 tests/qemuxml2argvdata/memory-hotplug-nvdimm-readonly.x86_64-latest.args:
 tests/qemuxml2argvdata/memory-hotplug-nvdimm.x86_64-latest.args:
 tests/qemuxml2argvdata/memory-hotplug-virtio-mem.x86_64-latest.args:
 tests/qemuxml2argvdata/memory-hotplug-virtio-pmem.x86_64-latest.args:
  These happened because downstream we don't use JSON for -device,
  but upstream we do (as of 1a691fe1c84090da80a652c4c80ac00a6134a69b).
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2050697
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/qemu/qemu_command.c                                   | 6 +++---
 tests/qemuxml2argvdata/hugepages-memaccess.args           | 4 ++--
 tests/qemuxml2argvdata/hugepages-memaccess2.args          | 4 ++--
 tests/qemuxml2argvdata/hugepages-numa-default-dimm.args   | 4 ++--
 .../qemuxml2argvdata/hugepages-nvdimm.x86_64-latest.args  | 4 ++--
 .../qemuxml2argvdata/memfd-memory-numa.x86_64-latest.args | 4 ++--
 tests/qemuxml2argvdata/memory-hotplug-dimm-addr.args      | 8 ++++----
 tests/qemuxml2argvdata/memory-hotplug-dimm.args           | 8 ++++----
 .../memory-hotplug-nvdimm-access.x86_64-latest.args       | 4 ++--
 .../memory-hotplug-nvdimm-align.x86_64-5.2.0.args         | 4 ++--
 .../memory-hotplug-nvdimm-align.x86_64-latest.args        | 4 ++--
 .../memory-hotplug-nvdimm-label.x86_64-5.2.0.args         | 4 ++--
 .../memory-hotplug-nvdimm-label.x86_64-latest.args        | 4 ++--
 .../memory-hotplug-nvdimm-pmem.x86_64-5.2.0.args          | 4 ++--
 .../memory-hotplug-nvdimm-pmem.x86_64-latest.args         | 4 ++--
 .../memory-hotplug-nvdimm-ppc64-abi-update.args           | 4 ++--
 tests/qemuxml2argvdata/memory-hotplug-nvdimm-ppc64.args   | 4 ++--
 .../memory-hotplug-nvdimm-readonly.x86_64-5.2.0.args      | 4 ++--
 .../memory-hotplug-nvdimm-readonly.x86_64-latest.args     | 4 ++--
 .../memory-hotplug-nvdimm.x86_64-latest.args              | 4 ++--
 .../memory-hotplug-ppc64-nonuma-abi-update.args           | 8 ++++----
 tests/qemuxml2argvdata/memory-hotplug-ppc64-nonuma.args   | 8 ++++----
 .../memory-hotplug-virtio-mem.x86_64-latest.args          | 8 ++++----
 .../memory-hotplug-virtio-pmem.x86_64-5.2.0.args          | 4 ++--
 .../memory-hotplug-virtio-pmem.x86_64-latest.args         | 4 ++--
 tests/qemuxml2argvdata/pages-dimm-discard.args            | 8 ++++----
 26 files changed, 65 insertions(+), 65 deletions(-)
 diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
 index 6b4647a711..2acdcca2ff 100644
 --- a/src/qemu/qemu_command.c
 +++ b/src/qemu/qemu_command.c
@@ -10565,9 +10565,6 @@ qemuBuildCommandLine(virQEMUDriver *driver,
         qemuBuildNumaCommandLine(cfg, def, cmd, priv) < 0)
         return NULL;
 -    if (qemuBuildMemoryDeviceCommandLine(cmd, cfg, def, priv) < 0)
 -        return NULL;
 -
     virUUIDFormat(def->uuid, uuid);
     virCommandAddArgList(cmd, "-uuid", uuid, NULL);
@@ -10617,6 +10614,9 @@ qemuBuildCommandLine(virQEMUDriver *driver,
     if (qemuBuildControllersCommandLine(cmd, def, qemuCaps) < 0)
         return NULL;
 +    if (qemuBuildMemoryDeviceCommandLine(cmd, cfg, def, priv) < 0)
 +        return NULL;
 +
     if (qemuBuildHubCommandLine(cmd, def, qemuCaps) < 0)
         return NULL;
 diff --git a/tests/qemuxml2argvdata/hugepages-memaccess.args b/tests/qemuxml2argvdata/hugepages-memaccess.args
 index b89f791697..a369c7f6da 100644
 --- a/tests/qemuxml2argvdata/hugepages-memaccess.args
 +++ b/tests/qemuxml2argvdata/hugepages-memaccess.args
@@ -24,8 +24,6 @@ QEMU_AUDIO_DRV=none \
 -numa node,nodeid=2,cpus=2,memdev=ram-node2 \
 -object memory-backend-file,id=ram-node3,mem-path=/dev/hugepages1G/libvirt/qemu/-1-QEMUGuest1,share=off,prealloc=on,size=1073741824,host-nodes=3,policy=bind \
 -numa node,nodeid=3,cpus=3,memdev=ram-node3 \
 --object memory-backend-file,id=memdimm0,mem-path=/dev/hugepages2M/libvirt/qemu/-1-QEMUGuest1,share=on,prealloc=on,size=536870912,host-nodes=0-3,policy=bind \
 --device pc-dimm,node=1,memdev=memdimm0,id=dimm0,slot=0,addr=4294967296 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -37,6 +35,8 @@ QEMU_AUDIO_DRV=none \
 -no-acpi \
 -boot strict=on \
 -usb \
 +-object memory-backend-file,id=memdimm0,mem-path=/dev/hugepages2M/libvirt/qemu/-1-QEMUGuest1,share=on,prealloc=on,size=536870912,host-nodes=0-3,policy=bind \
 +-device pc-dimm,node=1,memdev=memdimm0,id=dimm0,slot=0,addr=4294967296 \
 -drive file=/dev/HostVG/QEMUGuest1,format=raw,if=none,id=drive-ide0-0-0 \
 -device ide-hd,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0,bootindex=1 \
 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3 \
 diff --git a/tests/qemuxml2argvdata/hugepages-memaccess2.args b/tests/qemuxml2argvdata/hugepages-memaccess2.args
 index 0c296797e9..434ebdaa62 100644
 --- a/tests/qemuxml2argvdata/hugepages-memaccess2.args
 +++ b/tests/qemuxml2argvdata/hugepages-memaccess2.args
@@ -24,8 +24,6 @@ QEMU_AUDIO_DRV=none \
 -numa node,nodeid=2,cpus=2,memdev=ram-node2 \
 -object memory-backend-file,id=ram-node3,mem-path=/var/lib/libvirt/qemu/ram/-1-QEMUGuest1/ram-node3,share=off,size=1073741824,host-nodes=3,policy=bind \
 -numa node,nodeid=3,cpus=3,memdev=ram-node3 \
 --object memory-backend-file,id=memdimm0,mem-path=/dev/hugepages2M/libvirt/qemu/-1-QEMUGuest1,share=on,prealloc=on,size=536870912,host-nodes=0-3,policy=bind \
 --device pc-dimm,node=1,memdev=memdimm0,id=dimm0,slot=0,addr=4294967296 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -37,6 +35,8 @@ QEMU_AUDIO_DRV=none \
 -no-acpi \
 -boot strict=on \
 -usb \
 +-object memory-backend-file,id=memdimm0,mem-path=/dev/hugepages2M/libvirt/qemu/-1-QEMUGuest1,share=on,prealloc=on,size=536870912,host-nodes=0-3,policy=bind \
 +-device pc-dimm,node=1,memdev=memdimm0,id=dimm0,slot=0,addr=4294967296 \
 -drive file=/dev/HostVG/QEMUGuest1,format=raw,if=none,id=drive-ide0-0-0 \
 -device ide-hd,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0,bootindex=1 \
 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3 \
 diff --git a/tests/qemuxml2argvdata/hugepages-numa-default-dimm.args b/tests/qemuxml2argvdata/hugepages-numa-default-dimm.args
 index f560cabf8e..57bb70346d 100644
 --- a/tests/qemuxml2argvdata/hugepages-numa-default-dimm.args
 +++ b/tests/qemuxml2argvdata/hugepages-numa-default-dimm.args
@@ -19,8 +19,6 @@ QEMU_AUDIO_DRV=none \
 -mem-prealloc \
 -mem-path /dev/hugepages2M/libvirt/qemu/-1-fedora \
 -numa node,nodeid=0,cpus=0-1,mem=1024 \
 --object memory-backend-file,id=memdimm0,mem-path=/dev/hugepages1G/libvirt/qemu/-1-fedora,size=1073741824,host-nodes=1-3,policy=bind \
 --device pc-dimm,node=0,memdev=memdimm0,id=dimm0,slot=0 \
 -uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
 -display none \
 -no-user-config \
@@ -32,4 +30,6 @@ QEMU_AUDIO_DRV=none \
 -no-acpi \
 -boot strict=on \
 -usb \
 +-object memory-backend-file,id=memdimm0,mem-path=/dev/hugepages1G/libvirt/qemu/-1-fedora,size=1073741824,host-nodes=1-3,policy=bind \
 +-device pc-dimm,node=0,memdev=memdimm0,id=dimm0,slot=0 \
 -msg timestamp=on
 diff --git a/tests/qemuxml2argvdata/hugepages-nvdimm.x86_64-latest.args b/tests/qemuxml2argvdata/hugepages-nvdimm.x86_64-latest.args
 index 8b5665f86e..7d9dcfb4df 100644
 --- a/tests/qemuxml2argvdata/hugepages-nvdimm.x86_64-latest.args
 +++ b/tests/qemuxml2argvdata/hugepages-nvdimm.x86_64-latest.args
@@ -18,8 +18,6 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -smp 2,sockets=2,dies=1,cores=1,threads=1 \
 -object '{"qom-type":"memory-backend-file","id":"ram-node0","mem-path":"/dev/hugepages2M/libvirt/qemu/-1-QEMUGuest1","share":true,"prealloc":true,"size":1073741824}' \
 -numa node,nodeid=0,cpus=0-1,memdev=ram-node0 \
 --object '{"qom-type":"memory-backend-file","id":"memnvdimm0","mem-path":"/tmp/nvdimm","share":true,"prealloc":true,"size":536870912}' \
 --device nvdimm,node=0,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -31,6 +29,8 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -no-acpi \
 -boot strict=on \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
 +-object '{"qom-type":"memory-backend-file","id":"memnvdimm0","mem-path":"/tmp/nvdimm","share":true,"prealloc":true,"size":536870912}' \
 +-device nvdimm,node=0,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
 diff --git a/tests/qemuxml2argvdata/memfd-memory-numa.x86_64-latest.args b/tests/qemuxml2argvdata/memfd-memory-numa.x86_64-latest.args
 index 8a40e2d79c..04a320d469 100644
 --- a/tests/qemuxml2argvdata/memfd-memory-numa.x86_64-latest.args
 +++ b/tests/qemuxml2argvdata/memfd-memory-numa.x86_64-latest.args
@@ -18,8 +18,6 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-instance-00000092/.config \
 -smp 8,sockets=1,dies=1,cores=8,threads=1 \
 -object '{"qom-type":"memory-backend-memfd","id":"ram-node0","hugetlb":true,"hugetlbsize":2097152,"share":true,"prealloc":true,"size":15032385536,"host-nodes":[3],"policy":"preferred"}' \
 -numa node,nodeid=0,cpus=0-7,memdev=ram-node0 \
 --object '{"qom-type":"memory-backend-file","id":"memnvdimm0","mem-path":"/tmp/nvdimm","share":true,"prealloc":true,"size":536870912,"host-nodes":[3],"policy":"preferred"}' \
 --device nvdimm,node=0,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -uuid 126f2720-6f8e-45ab-a886-ec9277079a67 \
 -display none \
 -no-user-config \
@@ -31,6 +29,8 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-instance-00000092/.config \
 -no-acpi \
 -boot strict=on \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
 +-object '{"qom-type":"memory-backend-file","id":"memnvdimm0","mem-path":"/tmp/nvdimm","share":true,"prealloc":true,"size":536870912,"host-nodes":[3],"policy":"preferred"}' \
 +-device nvdimm,node=0,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3 \
 -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-dimm-addr.args b/tests/qemuxml2argvdata/memory-hotplug-dimm-addr.args
 index 907072d55d..b36117f1e8 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-dimm-addr.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-dimm-addr.args
@@ -17,10 +17,6 @@ QEMU_AUDIO_DRV=none \
 -realtime mlock=off \
 -smp 2,sockets=2,cores=1,threads=1 \
 -numa node,nodeid=0,cpus=0-1,mem=214 \
 --object memory-backend-file,id=memdimm0,mem-path=/dev/hugepages2M/libvirt/qemu/-1-QEMUGuest1,prealloc=on,size=536870912,host-nodes=1-3,policy=bind \
 --device pc-dimm,node=0,memdev=memdimm0,id=dimm0,slot=0,addr=4294967296 \
 --object memory-backend-ram,id=memdimm2,size=536870912 \
 --device pc-dimm,node=0,memdev=memdimm2,id=dimm2,slot=2 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -32,6 +28,10 @@ QEMU_AUDIO_DRV=none \
 -no-acpi \
 -boot strict=on \
 -usb \
 +-object memory-backend-file,id=memdimm0,mem-path=/dev/hugepages2M/libvirt/qemu/-1-QEMUGuest1,prealloc=on,size=536870912,host-nodes=1-3,policy=bind \
 +-device pc-dimm,node=0,memdev=memdimm0,id=dimm0,slot=0,addr=4294967296 \
 +-object memory-backend-ram,id=memdimm2,size=536870912 \
 +-device pc-dimm,node=0,memdev=memdimm2,id=dimm2,slot=2 \
 -drive file=/dev/HostVG/QEMUGuest1,format=raw,if=none,id=drive-ide0-0-0 \
 -device ide-hd,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0,bootindex=1 \
 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x2 \
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-dimm.args b/tests/qemuxml2argvdata/memory-hotplug-dimm.args
 index 5d87f4a3ef..72c2803c5e 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-dimm.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-dimm.args
@@ -17,10 +17,6 @@ QEMU_AUDIO_DRV=none \
 -realtime mlock=off \
 -smp 2,sockets=2,cores=1,threads=1 \
 -numa node,nodeid=0,cpus=0-1,mem=214 \
 --object memory-backend-ram,id=memdimm0,size=536870912 \
 --device pc-dimm,node=0,memdev=memdimm0,id=dimm0,slot=0 \
 --object memory-backend-file,id=memdimm1,mem-path=/dev/hugepages2M/libvirt/qemu/-1-QEMUGuest1,prealloc=on,size=536870912,host-nodes=1-3,policy=bind \
 --device pc-dimm,node=0,memdev=memdimm1,id=dimm1,slot=1 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -32,6 +28,10 @@ QEMU_AUDIO_DRV=none \
 -no-acpi \
 -boot strict=on \
 -usb \
 +-object memory-backend-ram,id=memdimm0,size=536870912 \
 +-device pc-dimm,node=0,memdev=memdimm0,id=dimm0,slot=0 \
 +-object memory-backend-file,id=memdimm1,mem-path=/dev/hugepages2M/libvirt/qemu/-1-QEMUGuest1,prealloc=on,size=536870912,host-nodes=1-3,policy=bind \
 +-device pc-dimm,node=0,memdev=memdimm1,id=dimm1,slot=1 \
 -drive file=/dev/HostVG/QEMUGuest1,format=raw,if=none,id=drive-ide0-0-0 \
 -device ide-hd,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0,bootindex=1 \
 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x2 \
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-access.x86_64-latest.args b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-access.x86_64-latest.args
 index 3664150c51..94aeadabce 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-access.x86_64-latest.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-access.x86_64-latest.args
@@ -18,8 +18,6 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -smp 2,sockets=2,dies=1,cores=1,threads=1 \
 -object '{"qom-type":"memory-backend-ram","id":"ram-node0","size":224395264}' \
 -numa node,nodeid=0,cpus=0-1,memdev=ram-node0 \
 --object '{"qom-type":"memory-backend-file","id":"memnvdimm0","mem-path":"/tmp/nvdimm","share":false,"prealloc":true,"size":536870912}' \
 --device nvdimm,node=0,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -31,6 +29,8 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -no-acpi \
 -boot strict=on \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
 +-object '{"qom-type":"memory-backend-file","id":"memnvdimm0","mem-path":"/tmp/nvdimm","share":false,"prealloc":true,"size":536870912}' \
 +-device nvdimm,node=0,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device ide-hd,bus=ide.0,unit=0,drive=libvirt-1-format,id=ide0-0-0,bootindex=1 \
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-align.x86_64-5.2.0.args b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-align.x86_64-5.2.0.args
 index 6c28c86004..0b29a6fded 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-align.x86_64-5.2.0.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-align.x86_64-5.2.0.args
@@ -18,8 +18,6 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -smp 2,sockets=2,dies=1,cores=1,threads=1 \
 -object memory-backend-ram,id=ram-node0,size=224395264 \
 -numa node,nodeid=0,cpus=0-1,memdev=ram-node0 \
 --object memory-backend-file,id=memnvdimm0,mem-path=/tmp/nvdimm,share=off,prealloc=on,size=536870912,align=2097152 \
 --device nvdimm,node=0,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -31,6 +29,8 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -no-acpi \
 -boot strict=on \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
 +-object memory-backend-file,id=memnvdimm0,mem-path=/tmp/nvdimm,share=off,prealloc=on,size=536870912,align=2097152 \
 +-device nvdimm,node=0,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device ide-hd,bus=ide.0,unit=0,drive=libvirt-1-format,id=ide0-0-0,bootindex=1 \
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-align.x86_64-latest.args b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-align.x86_64-latest.args
 index aa77849079..5045cc8318 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-align.x86_64-latest.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-align.x86_64-latest.args
@@ -18,8 +18,6 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -smp 2,sockets=2,dies=1,cores=1,threads=1 \
 -object '{"qom-type":"memory-backend-ram","id":"ram-node0","size":224395264}' \
 -numa node,nodeid=0,cpus=0-1,memdev=ram-node0 \
 --object '{"qom-type":"memory-backend-file","id":"memnvdimm0","mem-path":"/tmp/nvdimm","share":false,"prealloc":true,"size":536870912,"align":2097152}' \
 --device nvdimm,node=0,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -31,6 +29,8 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -no-acpi \
 -boot strict=on \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
 +-object '{"qom-type":"memory-backend-file","id":"memnvdimm0","mem-path":"/tmp/nvdimm","share":false,"prealloc":true,"size":536870912,"align":2097152}' \
 +-device nvdimm,node=0,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device ide-hd,bus=ide.0,unit=0,drive=libvirt-1-format,id=ide0-0-0,bootindex=1 \
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-label.x86_64-5.2.0.args b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-label.x86_64-5.2.0.args
 index c45b401af5..7c67161b78 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-label.x86_64-5.2.0.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-label.x86_64-5.2.0.args
@@ -18,8 +18,6 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -smp 2,sockets=2,dies=1,cores=1,threads=1 \
 -object memory-backend-ram,id=ram-node0,size=224395264 \
 -numa node,nodeid=0,cpus=0-1,memdev=ram-node0 \
 --object memory-backend-file,id=memnvdimm0,mem-path=/tmp/nvdimm,share=off,prealloc=on,size=536870912 \
 --device nvdimm,node=0,label-size=131072,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -31,6 +29,8 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -no-acpi \
 -boot strict=on \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
 +-object memory-backend-file,id=memnvdimm0,mem-path=/tmp/nvdimm,share=off,prealloc=on,size=536870912 \
 +-device nvdimm,node=0,label-size=131072,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device ide-hd,bus=ide.0,unit=0,drive=libvirt-1-format,id=ide0-0-0,bootindex=1 \
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-label.x86_64-latest.args b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-label.x86_64-latest.args
 index 07863ba87c..9466877699 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-label.x86_64-latest.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-label.x86_64-latest.args
@@ -18,8 +18,6 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -smp 2,sockets=2,dies=1,cores=1,threads=1 \
 -object '{"qom-type":"memory-backend-ram","id":"ram-node0","size":224395264}' \
 -numa node,nodeid=0,cpus=0-1,memdev=ram-node0 \
 --object '{"qom-type":"memory-backend-file","id":"memnvdimm0","mem-path":"/tmp/nvdimm","share":false,"prealloc":true,"size":536870912}' \
 --device nvdimm,node=0,label-size=131072,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -31,6 +29,8 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -no-acpi \
 -boot strict=on \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
 +-object '{"qom-type":"memory-backend-file","id":"memnvdimm0","mem-path":"/tmp/nvdimm","share":false,"prealloc":true,"size":536870912}' \
 +-device nvdimm,node=0,label-size=131072,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device ide-hd,bus=ide.0,unit=0,drive=libvirt-1-format,id=ide0-0-0,bootindex=1 \
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-pmem.x86_64-5.2.0.args b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-pmem.x86_64-5.2.0.args
 index 3f35d4dca2..c4dae0cfd1 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-pmem.x86_64-5.2.0.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-pmem.x86_64-5.2.0.args
@@ -18,8 +18,6 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -smp 2,sockets=2,dies=1,cores=1,threads=1 \
 -object memory-backend-ram,id=ram-node0,size=224395264 \
 -numa node,nodeid=0,cpus=0-1,memdev=ram-node0 \
 --object memory-backend-file,id=memnvdimm0,mem-path=/tmp/nvdimm,share=off,size=536870912,pmem=on \
 --device nvdimm,node=0,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -31,6 +29,8 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -no-acpi \
 -boot strict=on \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
 +-object memory-backend-file,id=memnvdimm0,mem-path=/tmp/nvdimm,share=off,size=536870912,pmem=on \
 +-device nvdimm,node=0,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device ide-hd,bus=ide.0,unit=0,drive=libvirt-1-format,id=ide0-0-0,bootindex=1 \
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-pmem.x86_64-latest.args b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-pmem.x86_64-latest.args
 index 4ed86feb01..9324535ac3 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-pmem.x86_64-latest.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-pmem.x86_64-latest.args
@@ -18,8 +18,6 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -smp 2,sockets=2,dies=1,cores=1,threads=1 \
 -object '{"qom-type":"memory-backend-ram","id":"ram-node0","size":224395264}' \
 -numa node,nodeid=0,cpus=0-1,memdev=ram-node0 \
 --object '{"qom-type":"memory-backend-file","id":"memnvdimm0","mem-path":"/tmp/nvdimm","share":false,"size":536870912,"pmem":true}' \
 --device nvdimm,node=0,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -31,6 +29,8 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -no-acpi \
 -boot strict=on \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
 +-object '{"qom-type":"memory-backend-file","id":"memnvdimm0","mem-path":"/tmp/nvdimm","share":false,"size":536870912,"pmem":true}' \
 +-device nvdimm,node=0,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device ide-hd,bus=ide.0,unit=0,drive=libvirt-1-format,id=ide0-0-0,bootindex=1 \
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-ppc64-abi-update.args b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-ppc64-abi-update.args
 index ebdb0429d0..55b16c9dc2 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-ppc64-abi-update.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-ppc64-abi-update.args
@@ -17,8 +17,6 @@ QEMU_AUDIO_DRV=none \
 -realtime mlock=off \
 -smp 2,sockets=2,cores=1,threads=1 \
 -numa node,nodeid=0,cpus=0-1,mem=1024 \
 --object memory-backend-file,id=memnvdimm0,mem-path=/tmp/nvdimm,prealloc=on,size=537001984 \
 --device nvdimm,node=0,label-size=131072,uuid=49545eb3-75e1-2d0a-acdd-f0294406c99e,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -28,4 +26,6 @@ QEMU_AUDIO_DRV=none \
 -rtc base=utc \
 -no-shutdown \
 -boot strict=on \
 +-object memory-backend-file,id=memnvdimm0,mem-path=/tmp/nvdimm,prealloc=on,size=537001984 \
 +-device nvdimm,node=0,label-size=131072,uuid=49545eb3-75e1-2d0a-acdd-f0294406c99e,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -msg timestamp=on
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-ppc64.args b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-ppc64.args
 index ebdb0429d0..55b16c9dc2 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-ppc64.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-ppc64.args
@@ -17,8 +17,6 @@ QEMU_AUDIO_DRV=none \
 -realtime mlock=off \
 -smp 2,sockets=2,cores=1,threads=1 \
 -numa node,nodeid=0,cpus=0-1,mem=1024 \
 --object memory-backend-file,id=memnvdimm0,mem-path=/tmp/nvdimm,prealloc=on,size=537001984 \
 --device nvdimm,node=0,label-size=131072,uuid=49545eb3-75e1-2d0a-acdd-f0294406c99e,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -28,4 +26,6 @@ QEMU_AUDIO_DRV=none \
 -rtc base=utc \
 -no-shutdown \
 -boot strict=on \
 +-object memory-backend-file,id=memnvdimm0,mem-path=/tmp/nvdimm,prealloc=on,size=537001984 \
 +-device nvdimm,node=0,label-size=131072,uuid=49545eb3-75e1-2d0a-acdd-f0294406c99e,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -msg timestamp=on
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-readonly.x86_64-5.2.0.args b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-readonly.x86_64-5.2.0.args
 index bca2f286ba..b1873c100f 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-readonly.x86_64-5.2.0.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-readonly.x86_64-5.2.0.args
@@ -18,8 +18,6 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -smp 2,sockets=2,dies=1,cores=1,threads=1 \
 -object memory-backend-ram,id=ram-node0,size=224395264 \
 -numa node,nodeid=0,cpus=0-1,memdev=ram-node0 \
 --object memory-backend-file,id=memnvdimm0,mem-path=/tmp/nvdimm,share=off,prealloc=on,size=536870912 \
 --device nvdimm,node=0,unarmed=on,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -31,6 +29,8 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -no-acpi \
 -boot strict=on \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
 +-object memory-backend-file,id=memnvdimm0,mem-path=/tmp/nvdimm,share=off,prealloc=on,size=536870912 \
 +-device nvdimm,node=0,unarmed=on,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device ide-hd,bus=ide.0,unit=0,drive=libvirt-1-format,id=ide0-0-0,bootindex=1 \
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-readonly.x86_64-latest.args b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-readonly.x86_64-latest.args
 index 8be7f35cec..4f11d22e00 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-nvdimm-readonly.x86_64-latest.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-nvdimm-readonly.x86_64-latest.args
@@ -18,8 +18,6 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -smp 2,sockets=2,dies=1,cores=1,threads=1 \
 -object '{"qom-type":"memory-backend-ram","id":"ram-node0","size":224395264}' \
 -numa node,nodeid=0,cpus=0-1,memdev=ram-node0 \
 --object '{"qom-type":"memory-backend-file","id":"memnvdimm0","mem-path":"/tmp/nvdimm","share":false,"prealloc":true,"size":536870912}' \
 --device nvdimm,node=0,unarmed=on,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -31,6 +29,8 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -no-acpi \
 -boot strict=on \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
 +-object '{"qom-type":"memory-backend-file","id":"memnvdimm0","mem-path":"/tmp/nvdimm","share":false,"prealloc":true,"size":536870912}' \
 +-device nvdimm,node=0,unarmed=on,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device ide-hd,bus=ide.0,unit=0,drive=libvirt-1-format,id=ide0-0-0,bootindex=1 \
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-nvdimm.x86_64-latest.args b/tests/qemuxml2argvdata/memory-hotplug-nvdimm.x86_64-latest.args
 index 307698749e..434a0f91cf 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-nvdimm.x86_64-latest.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-nvdimm.x86_64-latest.args
@@ -18,8 +18,6 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -smp 2,sockets=2,dies=1,cores=1,threads=1 \
 -object '{"qom-type":"memory-backend-ram","id":"ram-node0","size":1073741824}' \
 -numa node,nodeid=0,cpus=0-1,memdev=ram-node0 \
 --object '{"qom-type":"memory-backend-file","id":"memnvdimm0","mem-path":"/tmp/nvdimm","prealloc":true,"size":536870912}' \
 --device nvdimm,node=0,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -31,6 +29,8 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -no-acpi \
 -boot strict=on \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
 +-object '{"qom-type":"memory-backend-file","id":"memnvdimm0","mem-path":"/tmp/nvdimm","prealloc":true,"size":536870912}' \
 +-device nvdimm,node=0,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device ide-hd,bus=ide.0,unit=0,drive=libvirt-1-format,id=ide0-0-0,bootindex=1 \
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-ppc64-nonuma-abi-update.args b/tests/qemuxml2argvdata/memory-hotplug-ppc64-nonuma-abi-update.args
 index 5380c9e805..e8a6451841 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-ppc64-nonuma-abi-update.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-ppc64-nonuma-abi-update.args
@@ -16,10 +16,6 @@ QEMU_AUDIO_DRV=none \
 -m size=1048576k,slots=16,maxmem=4194304k \
 -realtime mlock=off \
 -smp 1,sockets=1,cores=1,threads=1 \
 --object memory-backend-ram,id=memdimm0,size=536870912 \
 --device pc-dimm,memdev=memdimm0,id=dimm0,slot=0 \
 --object memory-backend-ram,id=memdimm1,size=536870912 \
 --device pc-dimm,memdev=memdimm1,id=dimm1,slot=1 \
 -uuid 49545eb3-75e1-2d0a-acdd-f0294406c99e \
 -display none \
 -no-user-config \
@@ -29,4 +25,8 @@ QEMU_AUDIO_DRV=none \
 -rtc base=utc \
 -no-shutdown \
 -boot strict=on \
 +-object memory-backend-ram,id=memdimm0,size=536870912 \
 +-device pc-dimm,memdev=memdimm0,id=dimm0,slot=0 \
 +-object memory-backend-ram,id=memdimm1,size=536870912 \
 +-device pc-dimm,memdev=memdimm1,id=dimm1,slot=1 \
 -msg timestamp=on
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-ppc64-nonuma.args b/tests/qemuxml2argvdata/memory-hotplug-ppc64-nonuma.args
 index acff36eb78..181409cde0 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-ppc64-nonuma.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-ppc64-nonuma.args
@@ -16,10 +16,6 @@ QEMU_AUDIO_DRV=none \
 -m size=1310720k,slots=16,maxmem=4194304k \
 -realtime mlock=off \
 -smp 1,sockets=1,cores=1,threads=1 \
 --object memory-backend-ram,id=memdimm0,size=536870912 \
 --device pc-dimm,memdev=memdimm0,id=dimm0,slot=0 \
 --object memory-backend-ram,id=memdimm1,size=536870912 \
 --device pc-dimm,memdev=memdimm1,id=dimm1,slot=1 \
 -uuid 49545eb3-75e1-2d0a-acdd-f0294406c99e \
 -display none \
 -no-user-config \
@@ -29,4 +25,8 @@ QEMU_AUDIO_DRV=none \
 -rtc base=utc \
 -no-shutdown \
 -boot strict=on \
 +-object memory-backend-ram,id=memdimm0,size=536870912 \
 +-device pc-dimm,memdev=memdimm0,id=dimm0,slot=0 \
 +-object memory-backend-ram,id=memdimm1,size=536870912 \
 +-device pc-dimm,memdev=memdimm1,id=dimm1,slot=1 \
 -msg timestamp=on
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-virtio-mem.x86_64-latest.args b/tests/qemuxml2argvdata/memory-hotplug-virtio-mem.x86_64-latest.args
 index 8747b249da..30b635d365 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-virtio-mem.x86_64-latest.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-virtio-mem.x86_64-latest.args
@@ -18,10 +18,6 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -smp 2,sockets=2,dies=1,cores=1,threads=1 \
 -object '{"qom-type":"memory-backend-ram","id":"ram-node0","size":2145386496}' \
 -numa node,nodeid=0,cpus=0-1,memdev=ram-node0 \
 --object '{"qom-type":"memory-backend-ram","id":"memvirtiomem0","reserve":false,"size":1073741824}' \
 --device virtio-mem-pci,node=0,block-size=2097152,requested-size=536870912,memdev=memvirtiomem0,id=virtiomem0,bus=pci.0,addr=0x2 \
 --object '{"qom-type":"memory-backend-file","id":"memvirtiomem1","mem-path":"/dev/hugepages2M/libvirt/qemu/-1-QEMUGuest1","reserve":false,"size":2147483648,"host-nodes":[1,2,3],"policy":"bind"}' \
 --device virtio-mem-pci,node=0,block-size=2097152,requested-size=1073741824,memdev=memvirtiomem1,id=virtiomem1,bus=pci.0,addr=0x3 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -33,6 +29,10 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -no-acpi \
 -boot strict=on \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
 +-object '{"qom-type":"memory-backend-ram","id":"memvirtiomem0","reserve":false,"size":1073741824}' \
 +-device virtio-mem-pci,node=0,block-size=2097152,requested-size=536870912,memdev=memvirtiomem0,id=virtiomem0,bus=pci.0,addr=0x2 \
 +-object '{"qom-type":"memory-backend-file","id":"memvirtiomem1","mem-path":"/dev/hugepages2M/libvirt/qemu/-1-QEMUGuest1","reserve":false,"size":2147483648,"host-nodes":[1,2,3],"policy":"bind"}' \
 +-device virtio-mem-pci,node=0,block-size=2097152,requested-size=1073741824,memdev=memvirtiomem1,id=virtiomem1,bus=pci.0,addr=0x3 \
 -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device ide-hd,bus=ide.0,unit=0,drive=libvirt-1-format,id=ide0-0-0,bootindex=1 \
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-virtio-pmem.x86_64-5.2.0.args b/tests/qemuxml2argvdata/memory-hotplug-virtio-pmem.x86_64-5.2.0.args
 index 17fd98fb88..8fa678c209 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-virtio-pmem.x86_64-5.2.0.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-virtio-pmem.x86_64-5.2.0.args
@@ -18,8 +18,6 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -smp 2,sockets=2,dies=1,cores=1,threads=1 \
 -object memory-backend-ram,id=ram-node0,size=2145386496 \
 -numa node,nodeid=0,cpus=0-1,memdev=ram-node0 \
 --object memory-backend-file,id=memvirtiopmem0,mem-path=/tmp/virtio_pmem,share=on,size=536870912 \
 --device virtio-pmem-pci,memdev=memvirtiopmem0,id=virtiopmem0,bus=pci.0,addr=0x5 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -31,6 +29,8 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -no-acpi \
 -boot strict=on \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
 +-object memory-backend-file,id=memvirtiopmem0,mem-path=/tmp/virtio_pmem,share=on,size=536870912 \
 +-device virtio-pmem-pci,memdev=memvirtiopmem0,id=virtiopmem0,bus=pci.0,addr=0x5 \
 -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device ide-hd,bus=ide.0,unit=0,drive=libvirt-1-format,id=ide0-0-0,bootindex=1 \
 diff --git a/tests/qemuxml2argvdata/memory-hotplug-virtio-pmem.x86_64-latest.args b/tests/qemuxml2argvdata/memory-hotplug-virtio-pmem.x86_64-latest.args
 index e5a91b6d33..95ff490cef 100644
 --- a/tests/qemuxml2argvdata/memory-hotplug-virtio-pmem.x86_64-latest.args
 +++ b/tests/qemuxml2argvdata/memory-hotplug-virtio-pmem.x86_64-latest.args
@@ -18,8 +18,6 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -smp 2,sockets=2,dies=1,cores=1,threads=1 \
 -object '{"qom-type":"memory-backend-ram","id":"ram-node0","size":2145386496}' \
 -numa node,nodeid=0,cpus=0-1,memdev=ram-node0 \
 --object '{"qom-type":"memory-backend-file","id":"memvirtiopmem0","mem-path":"/tmp/virtio_pmem","share":true,"size":536870912}' \
 --device virtio-pmem-pci,memdev=memvirtiopmem0,id=virtiopmem0,bus=pci.0,addr=0x5 \
 -uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
 -display none \
 -no-user-config \
@@ -31,6 +29,8 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \
 -no-acpi \
 -boot strict=on \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
 +-object '{"qom-type":"memory-backend-file","id":"memvirtiopmem0","mem-path":"/tmp/virtio_pmem","share":true,"size":536870912}' \
 +-device virtio-pmem-pci,memdev=memvirtiopmem0,id=virtiopmem0,bus=pci.0,addr=0x5 \
 -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","auto-read-only":true,"discard":"unmap"}' \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device ide-hd,bus=ide.0,unit=0,drive=libvirt-1-format,id=ide0-0-0,bootindex=1 \
 diff --git a/tests/qemuxml2argvdata/pages-dimm-discard.args b/tests/qemuxml2argvdata/pages-dimm-discard.args
 index 2ebe9c1350..e63c908549 100644
 --- a/tests/qemuxml2argvdata/pages-dimm-discard.args
 +++ b/tests/qemuxml2argvdata/pages-dimm-discard.args
@@ -17,10 +17,6 @@ QEMU_AUDIO_DRV=none \
 -realtime mlock=off \
 -smp 2,sockets=2,cores=1,threads=1 \
 -numa node,nodeid=0,cpus=0-1,mem=1024 \
 --object memory-backend-file,id=memdimm0,mem-path=/dev/hugepages1G/libvirt/qemu/-1-fedora,prealloc=on,size=1073741824,host-nodes=1-3,policy=bind \
 --device pc-dimm,node=0,memdev=memdimm0,id=dimm0,slot=0 \
 --object memory-backend-file,id=memdimm1,mem-path=/var/lib/libvirt/qemu/ram/-1-fedora/dimm1,discard-data=on,share=off,size=536870912 \
 --device pc-dimm,node=0,memdev=memdimm1,id=dimm1,slot=1 \
 -uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \
 -display none \
 -no-user-config \
@@ -32,4 +28,8 @@ QEMU_AUDIO_DRV=none \
 -no-acpi \
 -boot strict=on \
 -usb \
 +-object memory-backend-file,id=memdimm0,mem-path=/dev/hugepages1G/libvirt/qemu/-1-fedora,prealloc=on,size=1073741824,host-nodes=1-3,policy=bind \
 +-device pc-dimm,node=0,memdev=memdimm0,id=dimm0,slot=0 \
 +-object memory-backend-file,id=memdimm1,mem-path=/var/lib/libvirt/qemu/ram/-1-fedora/dimm1,discard-data=on,share=off,size=536870912 \
 +-device pc-dimm,node=0,memdev=memdimm1,id=dimm1,slot=1 \
 -msg timestamp=on
 -- 
 2.35.1
--- a/SOURCES/libvirt-qemu_command-Generate-prealloc-threads-property.patch
+++ b/SOURCES/libvirt-qemu_command-Generate-prealloc-threads-property.patch
@ -1,66 +0,0 @@
 From e52b12a986de8ac469b98135b2c1d2a8a63b9052 Mon Sep 17 00:00:00 2001
 Message-Id: <e52b12a986de8ac469b98135b2c1d2a8a63b9052@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Mon, 21 Mar 2022 17:10:15 +0100
 Subject: [PATCH] qemu_command: Generate prealloc-threads property
 Let's generate prealloc-threads property onto the cmd line if
 domain configuration requests so.
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
 (cherry picked from commit b8d6ecc70c8a8e9c90bab48b6829b42d8b77c748)
 Conflicts:
 tests/qemuxml2argvdata/memfd-memory-numa.x86_64-latest.args:
 Upstream has moved some cmd line arguments
 (v8.0.0-260-gaf23241cfe) but that is not backported.
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2067126
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/qemu/qemu_command.c                                     | 5 ++++-
 tests/qemuxml2argvdata/memfd-memory-numa.x86_64-latest.args | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)
 diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
 index 2acdcca2ff..d23af97e0c 100644
 --- a/src/qemu/qemu_command.c
 +++ b/src/qemu/qemu_command.c
@@ -3856,7 +3856,10 @@ qemuBuildMemoryBackendProps(virJSONValue **backendProps,
             return -1;
     } else {
         if (!priv->memPrealloc &&
 -            virJSONValueObjectAdd(&props, "B:prealloc", prealloc, NULL) < 0)
 +            virJSONValueObjectAdd(&props,
 +                                  "B:prealloc", prealloc,
 +                                  "p:prealloc-threads", def->mem.allocation_threads,
 +                                  NULL) < 0)
             return -1;
     }
 diff --git a/tests/qemuxml2argvdata/memfd-memory-numa.x86_64-latest.args b/tests/qemuxml2argvdata/memfd-memory-numa.x86_64-latest.args
 index 04a320d469..9b2e6086c3 100644
 --- a/tests/qemuxml2argvdata/memfd-memory-numa.x86_64-latest.args
 +++ b/tests/qemuxml2argvdata/memfd-memory-numa.x86_64-latest.args
@@ -16,7 +16,7 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-instance-00000092/.config \
 -m size=14680064k,slots=16,maxmem=1099511627776k \
 -overcommit mem-lock=off \
 -smp 8,sockets=1,dies=1,cores=8,threads=1 \
 --object '{"qom-type":"memory-backend-memfd","id":"ram-node0","hugetlb":true,"hugetlbsize":2097152,"share":true,"prealloc":true,"size":15032385536,"host-nodes":[3],"policy":"preferred"}' \
 +-object '{"qom-type":"memory-backend-memfd","id":"ram-node0","hugetlb":true,"hugetlbsize":2097152,"share":true,"prealloc":true,"prealloc-threads":8,"size":15032385536,"host-nodes":[3],"policy":"preferred"}' \
 -numa node,nodeid=0,cpus=0-7,memdev=ram-node0 \
 -uuid 126f2720-6f8e-45ab-a886-ec9277079a67 \
 -display none \
@@ -29,7 +29,7 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-instance-00000092/.config \
 -no-acpi \
 -boot strict=on \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
 --object '{"qom-type":"memory-backend-file","id":"memnvdimm0","mem-path":"/tmp/nvdimm","share":true,"prealloc":true,"size":536870912,"host-nodes":[3],"policy":"preferred"}' \
 +-object '{"qom-type":"memory-backend-file","id":"memnvdimm0","mem-path":"/tmp/nvdimm","share":true,"prealloc":true,"prealloc-threads":8,"size":536870912,"host-nodes":[3],"policy":"preferred"}' \
 -device nvdimm,node=0,memdev=memnvdimm0,id=nvdimm0,slot=0 \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3 \
 -- 
 2.35.1
--- a/SOURCES/libvirt-qemu_domain-Format-qemuDomainObjPrivate-originalMemlock.patch
+++ b/SOURCES/libvirt-qemu_domain-Format-qemuDomainObjPrivate-originalMemlock.patch
@ -1,55 +0,0 @@
 From b221b3ab6d881efedc544e0e0ed9c507e21fd178 Mon Sep 17 00:00:00 2001
 Message-Id: <b221b3ab6d881efedc544e0e0ed9c507e21fd178@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Wed, 11 May 2022 16:37:27 +0200
 Subject: [PATCH] qemu_domain: Format qemuDomainObjPrivate::originalMemlock
 Now that qemuDomainObjPrivate struct gained new member format it
 into XML and parse it so that the value is preserved across
 daemon restarts.
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Peter Krempa <pkrempa@redhat.com>
 (cherry picked from commit 21aec91790ae14d24512856b20cff49764ede637)
 https://bugzilla.redhat.com/show_bug.cgi?id=2089433
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/qemu/qemu_domain.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
 index 86d673dafa..ee7d310903 100644
 --- a/src/qemu/qemu_domain.c
 +++ b/src/qemu/qemu_domain.c
@@ -2383,6 +2383,12 @@ qemuDomainObjPrivateXMLFormat(virBuffer *buf,
     if (qemuDomainObjPrivateXMLFormatBackups(buf, vm) < 0)
         return -1;
 +    if (priv->originalMemlock > 0) {
 +        virBufferAsprintf(buf,
 +                          "<originalMemlock>%llu</originalMemlock>\n",
 +                          priv->originalMemlock);
 +    }
 +
     return 0;
 }
@@ -3104,6 +3110,13 @@ qemuDomainObjPrivateXMLParse(xmlXPathContextPtr ctxt,
     priv->memPrealloc = virXPathBoolean("boolean(./memPrealloc)", ctxt) == 1;
 +    if (virXPathULongLong("string(./originalMemlock)",
 +                          ctxt, &priv->originalMemlock) == -2) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
 +                       _("failed to parse original memlock size"));
 +        goto error;
 +    }
 +
     return 0;
  error:
 -- 
 2.35.1
--- a/SOURCES/libvirt-qemu_migration-Implement-VIR_MIGRATE_ZEROCOPY-flag.patch
+++ b/SOURCES/libvirt-qemu_migration-Implement-VIR_MIGRATE_ZEROCOPY-flag.patch
@ -1,120 +0,0 @@
 From 35f06623b82d99dd380340eef465394975dd1c80 Mon Sep 17 00:00:00 2001
 Message-Id: <35f06623b82d99dd380340eef465394975dd1c80@dist-git>
 From: Jiri Denemark <jdenemar@redhat.com>
 Date: Wed, 22 Jun 2022 16:37:31 +0200
 Subject: [PATCH] qemu_migration: Implement VIR_MIGRATE_ZEROCOPY flag
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Resolves: https://gitlab.com/libvirt/libvirt/-/issues/306
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit d375993ab314a41bca7ef6c846e07afc18c37774)
 https://bugzilla.redhat.com/show_bug.cgi?id=2089433
 Conflicts:
 	src/qemu/qemu_migration.c
 	src/qemu/qemu_migration.h
            - post-copy recovery not bacported
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/qemu/qemu_migration.c        | 21 +++++++++++++++++++++
 src/qemu/qemu_migration.h        |  1 +
 src/qemu/qemu_migration_params.c |  6 ++++++
 src/qemu/qemu_migration_params.h |  1 +
 4 files changed, 29 insertions(+)
 diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c
 index 35ad201580..db5163e993 100644
 --- a/src/qemu/qemu_migration.c
 +++ b/src/qemu/qemu_migration.c
@@ -2366,6 +2366,12 @@ qemuMigrationSrcBeginPhase(virQEMUDriver *driver,
         return NULL;
     }
 +    if (flags & VIR_MIGRATE_ZEROCOPY && !(flags & VIR_MIGRATE_PARALLEL)) {
 +        virReportError(VIR_ERR_OPERATION_INVALID, "%s",
 +                       _("zero-copy is only available for parallel migration"));
 +        return NULL;
 +    }
 +
     if (flags & (VIR_MIGRATE_NON_SHARED_DISK | VIR_MIGRATE_NON_SHARED_INC)) {
         if (flags & VIR_MIGRATE_NON_SHARED_SYNCHRONOUS_WRITES &&
             !virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_BLOCKDEV)) {
@@ -4137,6 +4143,21 @@ qemuMigrationSrcRun(virQEMUDriver *driver,
                                  migParams) < 0)
         goto error;
 +    if (flags & VIR_MIGRATE_ZEROCOPY) {
 +        /* Zero-copy requires pages in transfer to be locked in host memory.
 +         * Unfortunately, we have no reliable way of computing how many pages
 +         * will need to be locked at the same time. Thus we set the limit to
 +         * the whole guest memory and reset it back once migration is done. */
 +        unsigned long long limit;
 +
 +        if (virMemoryLimitIsSet(vm->def->mem.hard_limit))
 +            limit = vm->def->mem.hard_limit;
 +        else
 +            limit = virDomainDefGetMemoryTotal(vm->def);
 +
 +        if (qemuDomainSetMaxMemLock(vm, limit << 10, &priv->preMigrationMemlock) < 0)
 +            goto error;
 +    }
     if (storageMigration) {
         if (mig->nbd) {
 diff --git a/src/qemu/qemu_migration.h b/src/qemu/qemu_migration.h
 index b233358a51..6f737f7b4c 100644
 --- a/src/qemu/qemu_migration.h
 +++ b/src/qemu/qemu_migration.h
@@ -60,6 +60,7 @@
      VIR_MIGRATE_TLS | \
      VIR_MIGRATE_PARALLEL | \
      VIR_MIGRATE_NON_SHARED_SYNCHRONOUS_WRITES | \
 +     VIR_MIGRATE_ZEROCOPY | \
      0)
 /* All supported migration parameters and their types. */
 diff --git a/src/qemu/qemu_migration_params.c b/src/qemu/qemu_migration_params.c
 index 7b225fdf4b..c985583861 100644
 --- a/src/qemu/qemu_migration_params.c
 +++ b/src/qemu/qemu_migration_params.c
@@ -96,6 +96,7 @@ VIR_ENUM_IMPL(qemuMigrationCapability,
               "multifd",
               "dirty-bitmaps",
               "return-path",
 +              "zero-copy-send",
 );
@@ -177,6 +178,11 @@ static const qemuMigrationParamsFlagMapItem qemuMigrationParamsFlagMap[] = {
      VIR_MIGRATE_TUNNELLED,
      QEMU_MIGRATION_CAP_RETURN_PATH,
      QEMU_MIGRATION_SOURCE | QEMU_MIGRATION_DESTINATION},
 +
 +    {QEMU_MIGRATION_FLAG_REQUIRED,
 +     VIR_MIGRATE_ZEROCOPY,
 +     QEMU_MIGRATION_CAP_ZERO_COPY_SEND,
 +     QEMU_MIGRATION_SOURCE},
 };
 /* Translation from VIR_MIGRATE_PARAM_* typed parameters to
 diff --git a/src/qemu/qemu_migration_params.h b/src/qemu/qemu_migration_params.h
 index b4de8dda7b..caa5e47f0f 100644
 --- a/src/qemu/qemu_migration_params.h
 +++ b/src/qemu/qemu_migration_params.h
@@ -41,6 +41,7 @@ typedef enum {
     QEMU_MIGRATION_CAP_MULTIFD,
     QEMU_MIGRATION_CAP_BLOCK_DIRTY_BITMAPS,
     QEMU_MIGRATION_CAP_RETURN_PATH,
 +    QEMU_MIGRATION_CAP_ZERO_COPY_SEND,
     QEMU_MIGRATION_CAP_LAST
 } qemuMigrationCapability;
 -- 
 2.35.1
--- a/SOURCES/libvirt-qemu_migration-Restore-original-memory-locking-limit.patch
+++ b/SOURCES/libvirt-qemu_migration-Restore-original-memory-locking-limit.patch
@ -1,133 +0,0 @@
 From 8cccd9634ecd91a5b7343eddc037e0fa7de2f9f6 Mon Sep 17 00:00:00 2001
 Message-Id: <8cccd9634ecd91a5b7343eddc037e0fa7de2f9f6@dist-git>
 From: Jiri Denemark <jdenemar@redhat.com>
 Date: Wed, 22 Jun 2022 16:12:02 +0200
 Subject: [PATCH] qemu_migration: Restore original memory locking limit
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 For RDMA migration we update memory locking limit, but never set it back
 once migration finishes (on the destination host) or aborts (on the
 source host).
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit d4d3bb813031275c2c7cf72724b83c97ce82ab7a)
 https://bugzilla.redhat.com/show_bug.cgi?id=2089433
 Conflicts:
 	src/qemu/qemu_migration.c
            - post-copy resovery not backported
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/qemu/qemu_domain.c    | 12 ++++++++++++
 src/qemu/qemu_domain.h    |  3 +++
 src/qemu/qemu_migration.c | 10 ++++++++--
 3 files changed, 23 insertions(+), 2 deletions(-)
 diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
 index a81789f194..c24d1e4d53 100644
 --- a/src/qemu/qemu_domain.c
 +++ b/src/qemu/qemu_domain.c
@@ -2389,6 +2389,11 @@ qemuDomainObjPrivateXMLFormat(virBuffer *buf,
                           priv->originalMemlock);
     }
 +    if (priv->preMigrationMemlock > 0) {
 +        virBufferAsprintf(buf, "<preMigrationMemlock>%llu</preMigrationMemlock>\n",
 +                          priv->preMigrationMemlock);
 +    }
 +
     return 0;
 }
@@ -3117,6 +3122,13 @@ qemuDomainObjPrivateXMLParse(xmlXPathContextPtr ctxt,
         goto error;
     }
 +    if (virXPathULongLong("string(./preMigrationMemlock)", ctxt,
 +                          &priv->preMigrationMemlock) == -2) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
 +                       _("failed to parse pre-migration memlock limit"));
 +        return -1;
 +    }
 +
     return 0;
  error:
 diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h
 index 6d1d23439a..d6e8a7a0fb 100644
 --- a/src/qemu/qemu_domain.h
 +++ b/src/qemu/qemu_domain.h
@@ -146,6 +146,9 @@ struct _qemuDomainObjPrivate {
     int nbdPort; /* Port used for migration with NBD */
     unsigned short migrationPort;
     int preMigrationState;
 +    unsigned long long preMigrationMemlock; /* Original RLIMIT_MEMLOCK in case
 +                                               it was changed for the current
 +                                               migration job. */
     virChrdevs *devs;
 diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c
 index 10338f8e87..35ad201580 100644
 --- a/src/qemu/qemu_migration.c
 +++ b/src/qemu/qemu_migration.c
@@ -2974,7 +2974,8 @@ qemuMigrationDstPrepareAny(virQEMUDriver *driver,
     if (STREQ_NULLABLE(protocol, "rdma") &&
         vm->def->mem.hard_limit > 0 &&
 -        qemuDomainSetMaxMemLock(vm, vm->def->mem.hard_limit << 10, NULL) < 0) {
 +        qemuDomainSetMaxMemLock(vm, vm->def->mem.hard_limit << 10,
 +                                &priv->preMigrationMemlock) < 0) {
         goto stopjob;
     }
@@ -3451,6 +3452,7 @@ qemuMigrationSrcConfirmPhase(virQEMUDriver *driver,
                                          VIR_DOMAIN_EVENT_STOPPED_MIGRATED);
         virObjectEventStateQueue(driver->domainEventState, event);
         qemuDomainEventEmitJobCompleted(driver, vm);
 +        priv->preMigrationMemlock = 0;
     } else {
         virErrorPtr orig_err;
         int reason;
@@ -3471,6 +3473,7 @@ qemuMigrationSrcConfirmPhase(virQEMUDriver *driver,
         qemuMigrationParamsReset(driver, vm, QEMU_ASYNC_JOB_MIGRATION_OUT,
                                  jobPriv->migParams, priv->job.apiFlags);
 +        qemuDomainSetMaxMemLock(vm, 0, &priv->preMigrationMemlock);
         qemuDomainSaveStatus(vm);
     }
@@ -4224,7 +4227,8 @@ qemuMigrationSrcRun(virQEMUDriver *driver,
     case MIGRATION_DEST_HOST:
         if (STREQ(spec->dest.host.protocol, "rdma") &&
             vm->def->mem.hard_limit > 0 &&
 -            qemuDomainSetMaxMemLock(vm, vm->def->mem.hard_limit << 10, NULL) < 0) {
 +            qemuDomainSetMaxMemLock(vm, vm->def->mem.hard_limit << 10,
 +                                    &priv->preMigrationMemlock) < 0) {
             goto exit_monitor;
         }
         rc = qemuMonitorMigrateToHost(priv->mon, migrate_flags,
@@ -5408,6 +5412,7 @@ qemuMigrationSrcPerformPhase(virQEMUDriver *driver,
     if (ret < 0) {
         qemuMigrationParamsReset(driver, vm, QEMU_ASYNC_JOB_MIGRATION_OUT,
                                  jobPriv->migParams, priv->job.apiFlags);
 +        qemuDomainSetMaxMemLock(vm, 0, &priv->preMigrationMemlock);
         qemuMigrationJobFinish(driver, vm);
     } else {
         qemuMigrationJobContinue(vm);
@@ -5881,6 +5886,7 @@ qemuMigrationDstFinish(virQEMUDriver *driver,
  cleanup:
     g_clear_pointer(&jobInfo, qemuDomainJobInfoFree);
     virPortAllocatorRelease(port);
 +    qemuDomainSetMaxMemLock(vm, 0, &priv->preMigrationMemlock);
     if (priv->mon)
         qemuMonitorSetDomainLog(priv->mon, NULL, NULL, NULL);
     VIR_FREE(priv->origname);
 -- 
 2.35.1
--- a/SOURCES/libvirt-qemu_migration-Use-qemuDomainSetMaxMemLock.patch
+++ b/SOURCES/libvirt-qemu_migration-Use-qemuDomainSetMaxMemLock.patch
@ -1,53 +0,0 @@
 From 8354fa1d2e471699331961272bc38f5e4cfe7cb8 Mon Sep 17 00:00:00 2001
 Message-Id: <8354fa1d2e471699331961272bc38f5e4cfe7cb8@dist-git>
 From: Jiri Denemark <jdenemar@redhat.com>
 Date: Wed, 22 Jun 2022 09:04:04 +0200
 Subject: [PATCH] qemu_migration: Use qemuDomainSetMaxMemLock
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 This helper will not try to set the limit if it is already big enough,
 which may be useful when libvirt daemon is running in a containerized
 environment and is not allowed to change memory locking limit.
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit 22ee8cbf090c45f999b76e3f8dc7a45065fc9edf)
 https://bugzilla.redhat.com/show_bug.cgi?id=2089433
 Conflicts:
 	src/qemu/qemu_migration.c
            - refactoring for post-copy recovery not backported
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/qemu/qemu_migration.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c
 index 2635ef1162..10338f8e87 100644
 --- a/src/qemu/qemu_migration.c
 +++ b/src/qemu/qemu_migration.c
@@ -2974,7 +2974,7 @@ qemuMigrationDstPrepareAny(virQEMUDriver *driver,
     if (STREQ_NULLABLE(protocol, "rdma") &&
         vm->def->mem.hard_limit > 0 &&
 -        virProcessSetMaxMemLock(vm->pid, vm->def->mem.hard_limit << 10) < 0) {
 +        qemuDomainSetMaxMemLock(vm, vm->def->mem.hard_limit << 10, NULL) < 0) {
         goto stopjob;
     }
@@ -4224,7 +4224,7 @@ qemuMigrationSrcRun(virQEMUDriver *driver,
     case MIGRATION_DEST_HOST:
         if (STREQ(spec->dest.host.protocol, "rdma") &&
             vm->def->mem.hard_limit > 0 &&
 -            virProcessSetMaxMemLock(vm->pid, vm->def->mem.hard_limit << 10) < 0) {
 +            qemuDomainSetMaxMemLock(vm, vm->def->mem.hard_limit << 10, NULL) < 0) {
             goto exit_monitor;
         }
         rc = qemuMonitorMigrateToHost(priv->mon, migrate_flags,
 -- 
 2.35.1
--- a/SOURCES/libvirt-qemu_namespace-Don-t-leak-memory-in-qemuDomainGetPreservedMounts.patch
+++ b/SOURCES/libvirt-qemu_namespace-Don-t-leak-memory-in-qemuDomainGetPreservedMounts.patch
@ -1,57 +0,0 @@
 From 77b0485ba92fe5f0520321385af8a7581c286df1 Mon Sep 17 00:00:00 2001
 Message-Id: <77b0485ba92fe5f0520321385af8a7581c286df1@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Mon, 31 Oct 2022 15:38:13 +0100
 Subject: [PATCH] qemu_namespace: Don't leak memory in
 qemuDomainGetPreservedMounts()
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The aim of qemuDomainGetPreservedMounts() is to get a list of
 filesystems mounted under /dev and optionally generate a path for
 each one where they are moved temporarily when building the
 namespace. And the function tries to be a bit clever about it.
 For instance, if /dev/shm mount point exists, there's no need to
 consider /dev/shm/a nor /dev/shm/b as preserving just 'top level'
 /dev/shm gives the same result. To achieve this, the function
 iterates over the list of filesystem as returned by
 virFileGetMountSubtree() and removes the nested ones. However, it
 does so in a bit clumsy way: plain VIR_DELETE_ELEMENT() is used
 without freeing the string itself. Therefore, if all three
 aforementioned example paths appeared on the list, /dev/shm/a and
 /dev/shm/b strings would be leaked.
 And when I think about it more, there's no real need to shrink
 the array down (realloc()). It's going to be free()-d when
 returning from the function. Switch to
 VIR_DELETE_ELEMENT_INPLACE() then.
 Fixes: cdd9205dfffa3aaed935446a41f0d2dd1357c268
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Peter Krempa <pkrempa@redhat.com>
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 (cherry picked from commit bca7a53333ead7c1afd178728de74c2977cd4b5e)
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2166573
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/qemu/qemu_namespace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/src/qemu/qemu_namespace.c b/src/qemu/qemu_namespace.c
 index 74ffd6fb90..2f50087c1d 100644
 --- a/src/qemu/qemu_namespace.c
 +++ b/src/qemu/qemu_namespace.c
@@ -160,7 +160,8 @@ qemuDomainGetPreservedMounts(virQEMUDriverConfig *cfg,
             if (c && (*c == '/' || *c == '\0')) {
                 VIR_DEBUG("Dropping path %s because of %s", mounts[j], mounts[i]);
 -                VIR_DELETE_ELEMENT(mounts, j, nmounts);
 +                VIR_FREE(mounts[j]);
 +                VIR_DELETE_ELEMENT_INPLACE(mounts, j, nmounts);
             } else {
                 j++;
             }
 -- 
 2.39.1
--- a/SOURCES/libvirt-qemu_namespace-Fix-a-corner-case-in-qemuDomainGetPreservedMounts.patch
+++ b/SOURCES/libvirt-qemu_namespace-Fix-a-corner-case-in-qemuDomainGetPreservedMounts.patch
@ -1,80 +0,0 @@
 From 215adedb16aa082d052f84705338de0d77721fe0 Mon Sep 17 00:00:00 2001
 Message-Id: <215adedb16aa082d052f84705338de0d77721fe0@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Tue, 6 Sep 2022 13:43:22 +0200
 Subject: [PATCH] qemu_namespace: Fix a corner case in
 qemuDomainGetPreservedMounts()
 When setting up namespace for QEMU we look at mount points under
 /dev (like /dev/pts, /dev/mqueue/, etc.) because we want to
 preserve those (which is done by moving them to a temp location,
 unshare(), and then moving them back). We have a convenience
 helper - qemuDomainGetPreservedMounts() - that processes the
 mount table and (optionally) moves the other filesystems too.
 This helper is also used when attempting to create a path in NS,
 because the path, while starting with "/dev/" prefix, may
 actually lead to one of those filesystems that we preserved.
 And here comes the corner case: while we require the parent mount
 table to be in shared mode (equivalent of `mount --make-rshared /'),
 these mount events propagate iff the target path exist inside the
 slave mount table (= QEMU's private namespace). And since we
 create only a subset of /dev nodes, well, that assumption is not
 always the case.
 For instance, assume that a domain is already running, no
 hugepages were configured for it nor any hugetlbfs is mounted.
 Now, when a hugetlbfs is mounted into '/dev/hugepages', this is
 propagated into the QEMU's namespace, but since the target dir
 does not exist in the private /dev, the FS is not mounted in the
 namespace.
 Fortunately, this difference between namespaces is visible when
 comparing /proc/mounts and /proc/$PID/mounts (where PID is the
 QEMU's PID). Therefore, if possible we should look at the latter.
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
 (cherry picked from commit 46b03819ae8d833b11c2aaccb2c2a0361727f51b)
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2123196
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/qemu/qemu_namespace.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)
 diff --git a/src/qemu/qemu_namespace.c b/src/qemu/qemu_namespace.c
 index 4bff325a2c..fc286ab0be 100644
 --- a/src/qemu/qemu_namespace.c
 +++ b/src/qemu/qemu_namespace.c
@@ -110,6 +110,8 @@ qemuDomainGetPreservedMountPath(virQEMUDriverConfig *cfg,
  * b) generate backup path for all the entries in a)
  *
  * Any of the return pointers can be NULL. Both arrays are NULL-terminated.
 + * Get the mount table either from @vm's PID (if running), or from the
 + * namespace we're in (if @vm's not running).
  *
  * Returns 0 on success, -1 otherwise (with error reported)
  */
@@ -124,12 +126,18 @@ qemuDomainGetPreservedMounts(virQEMUDriverConfig *cfg,
     size_t nmounts = 0;
     g_auto(GStrv) paths = NULL;
     g_auto(GStrv) savePaths = NULL;
 +    g_autofree char *mountsPath = NULL;
     size_t i;
     if (ndevPath)
         *ndevPath = 0;
 -    if (virFileGetMountSubtree(QEMU_PROC_MOUNTS, "/dev", &mounts, &nmounts) < 0)
 +    if (vm->pid > 0)
 +        mountsPath = g_strdup_printf("/proc/%lld/mounts", (long long) vm->pid);
 +    else
 +        mountsPath = g_strdup(QEMU_PROC_MOUNTS);
 +
 +    if (virFileGetMountSubtree(mountsPath, "/dev", &mounts, &nmounts) < 0)
         return -1;
     if (nmounts == 0)
 -- 
 2.38.0
--- a/SOURCES/libvirt-qemu_namespace-Introduce-qemuDomainNamespaceSetupPath.patch
+++ b/SOURCES/libvirt-qemu_namespace-Introduce-qemuDomainNamespaceSetupPath.patch
@ -1,68 +0,0 @@
 From d515c964d740274d01bb8de1e5b0351490d6b9d3 Mon Sep 17 00:00:00 2001
 Message-Id: <d515c964d740274d01bb8de1e5b0351490d6b9d3@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Tue, 6 Sep 2022 13:43:58 +0200
 Subject: [PATCH] qemu_namespace: Introduce qemuDomainNamespaceSetupPath()
 Sometimes it may come handy to just bind mount a directory/file
 into domain's namespace. Implement a thin wrapper over
 qemuNamespaceMknodPaths() which has all the logic we need.
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
 (cherry picked from commit 5853d707189005a4ea5b2215e80853867b822fd9)
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2123196
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/qemu/qemu_namespace.c | 19 +++++++++++++++++++
 src/qemu/qemu_namespace.h |  4 ++++
 2 files changed, 23 insertions(+)
 diff --git a/src/qemu/qemu_namespace.c b/src/qemu/qemu_namespace.c
 index fc286ab0be..74ffd6fb90 100644
 --- a/src/qemu/qemu_namespace.c
 +++ b/src/qemu/qemu_namespace.c
@@ -1398,6 +1398,25 @@ qemuNamespaceUnlinkPaths(virDomainObj *vm,
 }
 +int
 +qemuDomainNamespaceSetupPath(virDomainObj *vm,
 +                             const char *path,
 +                             bool *created)
 +{
 +    g_autoptr(virGSListString) paths = NULL;
 +
 +    if (!qemuDomainNamespaceEnabled(vm, QEMU_DOMAIN_NS_MOUNT))
 +        return 0;
 +
 +    paths = g_slist_prepend(paths, g_strdup(path));
 +
 +    if (qemuNamespaceMknodPaths(vm, paths, created) < 0)
 +        return -1;
 +
 +    return 0;
 +}
 +
 +
 int
 qemuDomainNamespaceSetupDisk(virDomainObj *vm,
                              virStorageSource *src,
 diff --git a/src/qemu/qemu_namespace.h b/src/qemu/qemu_namespace.h
 index 020aca13d8..1ab9322061 100644
 --- a/src/qemu/qemu_namespace.h
 +++ b/src/qemu/qemu_namespace.h
@@ -49,6 +49,10 @@ void qemuDomainDestroyNamespace(virQEMUDriver *driver,
 bool qemuDomainNamespaceAvailable(qemuDomainNamespace ns);
 +int qemuDomainNamespaceSetupPath(virDomainObj *vm,
 +                                 const char *path,
 +                                 bool *created);
 +
 int qemuDomainNamespaceSetupDisk(virDomainObj *vm,
                                  virStorageSource *src,
                                  bool *created);
 -- 
 2.38.0
--- a/SOURCES/libvirt-qemu_namespace-Tolerate-missing-ACLs-when-creating-a-path-in-namespace.patch
+++ b/SOURCES/libvirt-qemu_namespace-Tolerate-missing-ACLs-when-creating-a-path-in-namespace.patch
@ -1,45 +0,0 @@
 From 7c7ec6e6c20675a99abe8685c715dc95e7e8dbff Mon Sep 17 00:00:00 2001
 Message-Id: <7c7ec6e6c20675a99abe8685c715dc95e7e8dbff@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Tue, 6 Sep 2022 13:37:23 +0200
 Subject: [PATCH] qemu_namespace: Tolerate missing ACLs when creating a path in
 namespace
 When creating a path in a domain's mount namespace we try to set
 ACLs on it, so that it's a verbatim copy of the path in parent's
 namespace. The ACLs are queried upfront (by
 qemuNamespaceMknodItemInit()) but this is fault tolerant so the
 pointer to ACLs might be NULL (meaning no ACLs were queried, for
 instance because the underlying filesystem does not support
 them). But then we take this NULL and pass it to virFileSetACLs()
 which immediately returns an error because NULL is invalid value.
 Mimic what we do with SELinux label - only set ACLs if they are
 non-NULL which includes symlinks.
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
 (cherry picked from commit 687374959e160dc566bd4b6d43c7bf1beb470c59)
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2123196
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/qemu/qemu_namespace.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
 diff --git a/src/qemu/qemu_namespace.c b/src/qemu/qemu_namespace.c
 index 94453033f5..4bff325a2c 100644
 --- a/src/qemu/qemu_namespace.c
 +++ b/src/qemu/qemu_namespace.c
@@ -1023,8 +1023,7 @@ qemuNamespaceMknodOne(qemuNamespaceMknodItem *data)
         goto cleanup;
     }
 -    /* Symlinks don't have ACLs. */
 -    if (!isLink &&
 +    if (data->acl &&
         virFileSetACLs(data->file, data->acl) < 0 &&
         errno != ENOTSUP) {
         virReportSystemError(errno,
 -- 
 2.38.0
--- a/SOURCES/libvirt-qemu_process-Don-t-require-a-hugetlbfs-mount-for-memfd.patch
+++ b/SOURCES/libvirt-qemu_process-Don-t-require-a-hugetlbfs-mount-for-memfd.patch
@ -1,50 +0,0 @@
 From f745b9ae2d12df0c0f2253c295f3d411a8a4165d Mon Sep 17 00:00:00 2001
 Message-Id: <f745b9ae2d12df0c0f2253c295f3d411a8a4165d@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Mon, 5 Sep 2022 10:34:44 +0200
 Subject: [PATCH] qemu_process: Don't require a hugetlbfs mount for memfd
 The aim of qemuProcessNeedHugepagesPath() is to determine whether
 a hugetlbfs mount point is required for given domain (as in
 whether qemuBuildMemoryBackendProps() picks up
 memory-backend-file pointing to a hugetlbfs mount point). Well,
 when domain is configured to use memfd backend then that
 condition can never be true. Therefore, skip creating domain's
 private path under hugetlbfs mount points.
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
 (cherry picked from commit f14f8dff9330ed51d817f190a2ee9ac76dfac00b)
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2123196
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/qemu/qemu_process.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index 5c6657a876..540eee9ff0 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -3810,8 +3810,18 @@ qemuProcessNeedHugepagesPath(virDomainDef *def,
     const long system_pagesize = virGetSystemPageSizeKB();
     size_t i;
 -    if (def->mem.source == VIR_DOMAIN_MEMORY_SOURCE_FILE)
 +    switch ((virDomainMemorySource)def->mem.source) {
 +    case VIR_DOMAIN_MEMORY_SOURCE_FILE:
 +        /* This needs a hugetlbfs mount. */
         return true;
 +    case VIR_DOMAIN_MEMORY_SOURCE_MEMFD:
 +        /* memfd works without a hugetlbfs mount */
 +        return false;
 +    case VIR_DOMAIN_MEMORY_SOURCE_NONE:
 +    case VIR_DOMAIN_MEMORY_SOURCE_ANONYMOUS:
 +    case VIR_DOMAIN_MEMORY_SOURCE_LAST:
 +        break;
 +    }
     for (i = 0; i < def->mem.nhugepages; i++) {
         if (def->mem.hugepages[i].size != system_pagesize)
 -- 
 2.38.0
--- a/SOURCES/libvirt-qemu_process.c-Propagate-hugetlbfs-mounts-on-reconnect.patch
+++ b/SOURCES/libvirt-qemu_process.c-Propagate-hugetlbfs-mounts-on-reconnect.patch
@ -1,65 +0,0 @@
 From 2aeb222d9d61868ef40932b4349af84696415e11 Mon Sep 17 00:00:00 2001
 Message-Id: <2aeb222d9d61868ef40932b4349af84696415e11@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Tue, 6 Sep 2022 13:45:51 +0200
 Subject: [PATCH] qemu_process.c: Propagate hugetlbfs mounts on reconnect
 When reconnecting to a running QEMU process, we construct the
 per-domain path in all hugetlbfs mounts. This is a relict from
 the past (v3.4.0-100-g5b24d25062) where we switched to a
 per-domain path and we want to create those paths when libvirtd
 restarts on upgrade.
 And with namespaces enabled there is one corner case where the
 path is not created. In fact an error is reported and the
 reconnect fails. Ideally, all mount events are propagated into
 the QEMU's namespace. And they probably are, except when the
 target path does not exist inside the namespace. Now, it's pretty
 common for users to mount hugetlbfs under /dev (e.g.
 /dev/hugepages), but if domain is started without hugepages (or
 more specifically - private hugetlbfs path wasn't created on
 domain startup), then the reconnect code tries to create it.
 But it fails to do so, well, it fails to set seclabels on the
 path because, because the path does not exist in the private
 namespace. And it doesn't exist because we specifically create
 only a subset of all possible /dev nodes. Therefore, the mount
 event, whilst propagated, is not successful and hence the
 filesystem is not mounted. We have to do it ourselves.
 If hugetlbfs is mount anywhere else there's no problem and this
 is effectively a dead code.
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2123196
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
 (cherry picked from commit 0377177c7856bb87a9d8aa1324b54f5fbe9f1e5b)
 Conflicts:
 - docs/kbase/qemu-passthrough-security.rst: Well, v8.8.0-rc1~32
  isn't backported, thus we can't remove a paragraph that the
  backported commit did. It's a documentation after all, so no
  harm.
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2123196
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/qemu/qemu_process.c | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
 index 540eee9ff0..1164340aa9 100644
 --- a/src/qemu/qemu_process.c
 +++ b/src/qemu/qemu_process.c
@@ -3906,6 +3906,9 @@ qemuProcessBuildDestroyMemoryPathsImpl(virQEMUDriver *driver,
             return -1;
         }
 +        if (qemuDomainNamespaceSetupPath(vm, path, NULL) < 0)
 +            return -1;
 +
         if (qemuSecurityDomainSetPathLabel(driver, vm, path, true) < 0)
             return -1;
     } else {
 -- 
 2.38.0
--- a/SOURCES/libvirt-qemu_tpm-Do-async-IO-when-starting-swtpm-emulator.patch
+++ b/SOURCES/libvirt-qemu_tpm-Do-async-IO-when-starting-swtpm-emulator.patch
@ -1,49 +0,0 @@
 From 87b0f241db1eba0e9db1fd233c5ab8a8d0115979 Mon Sep 17 00:00:00 2001
 Message-Id: <87b0f241db1eba0e9db1fd233c5ab8a8d0115979@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Mon, 21 Mar 2022 13:33:06 +0100
 Subject: [PATCH] qemu_tpm: Do async IO when starting swtpm emulator
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 When vTPM is secured via virSecret libvirt passes the secret
 value via an FD when swtpm is started (arguments --key and
 --migration-key). The writing of the secret into the FDs is
 handled via virCommand, specifically qemu_tpm calls
 virCommandSetSendBuffer()) and then virCommandRunAsync() spawns a
 thread to handle writing into the FD via
 virCommandDoAsyncIOHelper. But the thread is not created unless
 VIR_EXEC_ASYNC_IO flag is set, which it isn't. In order to fix
 it, virCommandDoAsyncIO() must be called.
 The credit goes to Marc-André Lureau
 <marcandre.lureau@redhat.com> who has done all the debugging and
 proposed fix in the bugzilla.
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2064115
 Fixes: a9c500d2b50c5c041a1bb6ae9724402cf1cec8fe
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
 (cherry picked from commit 4d7bb0177a33c4e90fd001edfe27bc030354d875)
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2152188
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/qemu/qemu_tpm.c | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c
 index 9c5d1ffed4..29dcb2ac0f 100644
 --- a/src/qemu/qemu_tpm.c
 +++ b/src/qemu/qemu_tpm.c
@@ -923,6 +923,7 @@ qemuExtTPMStartEmulator(virQEMUDriver *driver,
     if (!(pidfile = qemuTPMEmulatorCreatePidFilename(cfg->swtpmStateDir, shortName)))
         return -1;
 +    virCommandDoAsyncIO(cmd);
     virCommandDaemonize(cmd);
     virCommandSetPidFile(cmd, pidfile);
     virCommandSetErrorFD(cmd, &errfd);
 -- 
 2.39.0
--- a/SOURCES/libvirt-qemu_validate-Validate-prealloc-threads-against-qemuCpas.patch
+++ b/SOURCES/libvirt-qemu_validate-Validate-prealloc-threads-against-qemuCpas.patch
@ -1,39 +0,0 @@
 From 088ba382d7a099ddbebe37e5486ce648e24266db Mon Sep 17 00:00:00 2001
 Message-Id: <088ba382d7a099ddbebe37e5486ce648e24266db@dist-git>
 From: Michal Privoznik <mprivozn@redhat.com>
 Date: Mon, 21 Mar 2022 17:09:40 +0100
 Subject: [PATCH] qemu_validate: Validate prealloc threads against qemuCpas
 Only fairly new QEMUs are capable of user provided number of
 preallocation threads. Validate this assumption.
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
 (cherry picked from commit 75a4e0165ef199809974e97b507d3953e1de01d1)
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2067126
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/qemu/qemu_validate.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c
 index 3a69733f81..7bc14293d6 100644
 --- a/src/qemu/qemu_validate.c
 +++ b/src/qemu/qemu_validate.c
@@ -739,6 +739,13 @@ qemuValidateDomainDefMemory(const virDomainDef *def,
         return -1;
     }
 +    if (mem->allocation_threads > 0 &&
 +        !virQEMUCapsGet(qemuCaps, QEMU_CAPS_MEMORY_BACKEND_PREALLOC_THREADS)) {
 +        virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
 +                       _("preallocation threads are unsupported with this QEMU"));
 +        return -1;
 +    }
 +
     if (mem->source == VIR_DOMAIN_MEMORY_SOURCE_ANONYMOUS) {
         virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
                        _("hugepages are not allowed with anonymous "
 -- 
 2.35.1
--- a/SOURCES/libvirt-remote-check-for-negative-array-lengths-before-allocation.patch
+++ b/SOURCES/libvirt-remote-check-for-negative-array-lengths-before-allocation.patch
@ -1,218 +0,0 @@
 From cb42cd98d347deeee7c225d8d1e9f71f232cad29 Mon Sep 17 00:00:00 2001
 Message-ID: <cb42cd98d347deeee7c225d8d1e9f71f232cad29.1712647819.git.jdenemar@redhat.com>
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Fri, 15 Mar 2024 10:47:50 +0000
 Subject: [PATCH] remote: check for negative array lengths before allocation
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 While the C API entry points will validate non-negative lengths
 for various parameters, the RPC server de-serialization code
 will need to allocate memory for arrays before entering the C
 API. These allocations will thus happen before the non-negative
 length check is performed.
 Passing a negative length to the g_new0 function will usually
 result in a crash due to the negative length being treated as
 a huge positive number.
 This was found and diagnosed by ALT Linux Team with AFLplusplus.
 CVE-2024-2494
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 Found-by: Alexandr Shashkin <dutyrok@altlinux.org>
 Co-developed-by: Alexander Kuznetsov <kuznetsovam@altlinux.org>
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 8a3f8d957507c1f8223fdcf25a3ff885b15557f2)
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/remote/remote_daemon_dispatch.c | 65 +++++++++++++++++++++++++++++
 src/rpc/gendispatch.pl              |  5 +++
 2 files changed, 70 insertions(+)
 diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c
 index 689001889e..c193227926 100644
 --- a/src/remote/remote_daemon_dispatch.c
 +++ b/src/remote/remote_daemon_dispatch.c
@@ -2306,6 +2306,10 @@ remoteDispatchDomainGetSchedulerParameters(virNetServer *server G_GNUC_UNUSED,
     if (!conn)
         goto cleanup;
 +    if (args->nparams < 0) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
 +        goto cleanup;
 +    }
     if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -2354,6 +2358,10 @@ remoteDispatchDomainGetSchedulerParametersFlags(virNetServer *server G_GNUC_UNUS
     if (!conn)
         goto cleanup;
 +    if (args->nparams < 0) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
 +        goto cleanup;
 +    }
     if (args->nparams > REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -2512,6 +2520,10 @@ remoteDispatchDomainBlockStatsFlags(virNetServer *server G_GNUC_UNUSED,
         goto cleanup;
     flags = args->flags;
 +    if (args->nparams < 0) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
 +        goto cleanup;
 +    }
     if (args->nparams > REMOTE_DOMAIN_BLOCK_STATS_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -2737,6 +2749,14 @@ remoteDispatchDomainGetVcpuPinInfo(virNetServer *server G_GNUC_UNUSED,
     if (!(dom = get_nonnull_domain(conn, args->dom)))
         goto cleanup;
 +    if (args->ncpumaps < 0) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps must be non-negative"));
 +        goto cleanup;
 +    }
 +    if (args->maplen < 0) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be non-negative"));
 +        goto cleanup;
 +    }
     if (args->ncpumaps > REMOTE_VCPUINFO_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("ncpumaps > REMOTE_VCPUINFO_MAX"));
         goto cleanup;
@@ -2831,6 +2851,11 @@ remoteDispatchDomainGetEmulatorPinInfo(virNetServer *server G_GNUC_UNUSED,
     if (!(dom = get_nonnull_domain(conn, args->dom)))
         goto cleanup;
 +    if (args->maplen < 0) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maplen must be non-negative"));
 +        goto cleanup;
 +    }
 +
     /* Allocate buffers to take the results */
     if (args->maplen > 0)
         cpumaps = g_new0(unsigned char, args->maplen);
@@ -2878,6 +2903,14 @@ remoteDispatchDomainGetVcpus(virNetServer *server G_GNUC_UNUSED,
     if (!(dom = get_nonnull_domain(conn, args->dom)))
         goto cleanup;
 +    if (args->maxinfo < 0) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be non-negative"));
 +        goto cleanup;
 +    }
 +    if (args->maplen < 0) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo must be non-negative"));
 +        goto cleanup;
 +    }
     if (args->maxinfo > REMOTE_VCPUINFO_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo > REMOTE_VCPUINFO_MAX"));
         goto cleanup;
@@ -3117,6 +3150,10 @@ remoteDispatchDomainGetMemoryParameters(virNetServer *server G_GNUC_UNUSED,
     flags = args->flags;
 +    if (args->nparams < 0) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
 +        goto cleanup;
 +    }
     if (args->nparams > REMOTE_DOMAIN_MEMORY_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -3177,6 +3214,10 @@ remoteDispatchDomainGetNumaParameters(virNetServer *server G_GNUC_UNUSED,
     flags = args->flags;
 +    if (args->nparams < 0) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
 +        goto cleanup;
 +    }
     if (args->nparams > REMOTE_DOMAIN_NUMA_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -3237,6 +3278,10 @@ remoteDispatchDomainGetBlkioParameters(virNetServer *server G_GNUC_UNUSED,
     flags = args->flags;
 +    if (args->nparams < 0) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
 +        goto cleanup;
 +    }
     if (args->nparams > REMOTE_DOMAIN_BLKIO_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -3298,6 +3343,10 @@ remoteDispatchNodeGetCPUStats(virNetServer *server G_GNUC_UNUSED,
     flags = args->flags;
 +    if (args->nparams < 0) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
 +        goto cleanup;
 +    }
     if (args->nparams > REMOTE_NODE_CPU_STATS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -3365,6 +3414,10 @@ remoteDispatchNodeGetMemoryStats(virNetServer *server G_GNUC_UNUSED,
     flags = args->flags;
 +    if (args->nparams < 0) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
 +        goto cleanup;
 +    }
     if (args->nparams > REMOTE_NODE_MEMORY_STATS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -3545,6 +3598,10 @@ remoteDispatchDomainGetBlockIoTune(virNetServer *server G_GNUC_UNUSED,
     if (!conn)
         goto cleanup;
 +    if (args->nparams < 0) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
 +        goto cleanup;
 +    }
     if (args->nparams > REMOTE_DOMAIN_BLOCK_IO_TUNE_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -5087,6 +5144,10 @@ remoteDispatchDomainGetInterfaceParameters(virNetServer *server G_GNUC_UNUSED,
     flags = args->flags;
 +    if (args->nparams < 0) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
 +        goto cleanup;
 +    }
     if (args->nparams > REMOTE_DOMAIN_INTERFACE_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
@@ -5307,6 +5368,10 @@ remoteDispatchNodeGetMemoryParameters(virNetServer *server G_GNUC_UNUSED,
     flags = args->flags;
 +    if (args->nparams < 0) {
 +        virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams must be non-negative"));
 +        goto cleanup;
 +    }
     if (args->nparams > REMOTE_NODE_MEMORY_PARAMETERS_MAX) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("nparams too large"));
         goto cleanup;
 diff --git a/src/rpc/gendispatch.pl b/src/rpc/gendispatch.pl
 index 9f5bf0e316..aacab88808 100755
 --- a/src/rpc/gendispatch.pl
 +++ b/src/rpc/gendispatch.pl
@@ -1074,6 +1074,11 @@ elsif ($mode eq "server") {
         print "\n";
         if ($single_ret_as_list) {
 +            print "    if (args->$single_ret_list_max_var < 0) {\n";
 +            print "        virReportError(VIR_ERR_RPC,\n";
 +            print "                       \"%s\", _(\"max$single_ret_list_name must be non-negative\"));\n";
 +            print "        goto cleanup;\n";
 +            print "    }\n";
             print "    if (args->$single_ret_list_max_var > $single_ret_list_max_define) {\n";
             print "        virReportError(VIR_ERR_RPC,\n";
             print "                       \"%s\", _(\"max$single_ret_list_name > $single_ret_list_max_define\"));\n";
 -- 
 2.44.0
--- a/SOURCES/libvirt-rpc-Fix-memory-leak-of-fds.patch
+++ b/SOURCES/libvirt-rpc-Fix-memory-leak-of-fds.patch
@ -1,36 +0,0 @@
 From 0f6009e5a8ca63388772597f3e42c71b50635a02 Mon Sep 17 00:00:00 2001
 Message-Id: <0f6009e5a8ca63388772597f3e42c71b50635a02@dist-git>
 From: Peng Liang <liangpeng10@huawei.com>
 Date: Wed, 2 Mar 2022 17:22:05 +0800
 Subject: [PATCH] rpc: Fix memory leak of fds
 In virSystemdActivationClaimFDs, the memory of ent->fds has been stolen
 and stored in fds, but fds is never freed, which causes a memory leak.
 Fix it by declaring fds as g_autofree.
 Reported-by: Jie Tang <tangjie18@huawei.com>
 Signed-off-by: Peng Liang <liangpeng10@huawei.com>
 Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
 (cherry picked from commit 8a1915c4d6c33669dcb390d0708cb6e5d651770d)
 https://bugzilla.redhat.com/show_bug.cgi?id=2165428
 Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
 ---
 src/rpc/virnetserver.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/rpc/virnetserver.c b/src/rpc/virnetserver.c
 index ad581a36dd..d9430a2cfa 100644
 --- a/src/rpc/virnetserver.c
 +++ b/src/rpc/virnetserver.c
@@ -655,7 +655,7 @@ virNetServerAddServiceActivation(virNetServer *srv,
                                  size_t max_queued_clients,
                                  size_t nrequests_client_max)
 {
 -    int *fds;
 +    g_autofree int *fds = NULL;
     size_t nfds;
     if (act == NULL)
 -- 
 2.39.1
--- a/SOURCES/libvirt-rpc-ensure-temporary-GSource-is-removed-from-client-event-loop.patch
+++ b/SOURCES/libvirt-rpc-ensure-temporary-GSource-is-removed-from-client-event-loop.patch
@ -1,101 +0,0 @@
 From b84d0a699f3976644d3090562ce62ede55335fbc Mon Sep 17 00:00:00 2001
 Message-ID: <b84d0a699f3976644d3090562ce62ede55335fbc.1717684031.git.jdenemar@redhat.com>
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Tue, 30 Apr 2024 11:51:15 +0100
 Subject: [PATCH] rpc: ensure temporary GSource is removed from client event
 loop
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Users are seeing periodic segfaults from libvirt client apps,
 especially thread heavy ones like virt-manager. A typical
 stack trace would end up in the virNetClientIOEventFD method,
 with illegal access to stale stack data. eg
 ==238721==ERROR: AddressSanitizer: stack-use-after-return on address 0x75cd18709788 at pc 0x75cd3111f907 bp 0x75cd181ff550 sp 0x75cd181ff548
 WRITE of size 4 at 0x75cd18709788 thread T11
    #0 0x75cd3111f906 in virNetClientIOEventFD /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:1634:15
    #1 0x75cd3210d198  (/usr/lib/libglib-2.0.so.0+0x5a198) (BuildId: 0a2311dfbbc6c215dc36f4b6bdd2b4b6fbae55a2)
    #2 0x75cd3216c3be  (/usr/lib/libglib-2.0.so.0+0xb93be) (BuildId: 0a2311dfbbc6c215dc36f4b6bdd2b4b6fbae55a2)
    #3 0x75cd3210ddc6 in g_main_loop_run (/usr/lib/libglib-2.0.so.0+0x5adc6) (BuildId: 0a2311dfbbc6c215dc36f4b6bdd2b4b6fbae55a2)
    #4 0x75cd3111a47c in virNetClientIOEventLoop /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:1722:9
    #5 0x75cd3111a47c in virNetClientIO /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:2002:10
    #6 0x75cd3111a47c in virNetClientSendInternal /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:2170:11
    #7 0x75cd311198a8 in virNetClientSendWithReply /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclient.c:2198:11
    #8 0x75cd31111653 in virNetClientProgramCall /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/rpc/virnetclientprogram.c:318:9
    #9 0x75cd31241c8f in callFull /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/remote/remote_driver.c:6054:10
    #10 0x75cd31241c8f in call /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/remote/remote_driver.c:6076:12
    #11 0x75cd31241c8f in remoteNetworkGetXMLDesc /usr/src/debug/libvirt/libvirt-10.2.0/build/src/remote/remote_client_bodies.h:5959:9
    #12 0x75cd31410ff7 in virNetworkGetXMLDesc /usr/src/debug/libvirt/libvirt-10.2.0/build/../src/libvirt-network.c:952:15
 The root cause is a bad assumption in the virNetClientIOEventLoop
 method. This method is run by whichever thread currently owns the
 buck, and is responsible for handling I/O. Inside a for(;;) loop,
 this method creates a temporary GSource, adds it to the event loop
 and runs g_main_loop_run(). When I/O is ready, the GSource callback
 (virNetClientIOEventFD) will fire and call g_main_loop_quit(), and
 return G_SOURCE_REMOVE which results in the temporary GSource being
 destroyed. A g_autoptr() will then remove the last reference.
 What was overlooked, is that a second thread can come along and
 while it can't enter virNetClientIOEventLoop, it will register an
 idle source that uses virNetClientIOWakeup to interrupt the
 original thread's 'g_main_loop_run' call. When this happens the
 virNetClientIOEventFD callback never runs, and so the temporary
 GSource is not destroyed. The g_autoptr() will remove a reference,
 but by virtue of still being attached to the event context, there
 is an extra reference held causing GSource to be leaked. The
 next time 'g_main_loop_run' is called, the original GSource will
 trigger its callback, and access data that was allocated on the
 stack by the previous thread, and likely SEGV.
 To solve this, the thread calling 'g_main_loop_run' must call
 g_source_destroy, immediately upon return, to guarantee that
 the temporary GSource is removed.
 CVE-2024-4418
 Reviewed-by: Ján Tomko <jtomko@redhat.com>
 Reported-by: Martin Shirokov <shirokovmartin@gmail.com>
 Tested-by: Martin Shirokov <shirokovmartin@gmail.com>
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 8074d64dc2eca846d6a61efe1a9b7428a0ce1dd1)
 Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
 ---
 src/rpc/virnetclient.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)
 diff --git a/src/rpc/virnetclient.c b/src/rpc/virnetclient.c
 index f526ad89ec..b9490072c3 100644
 --- a/src/rpc/virnetclient.c
 +++ b/src/rpc/virnetclient.c
@@ -1664,7 +1664,7 @@ static int virNetClientIOEventLoop(virNetClient *client,
 #endif /* !WIN32 */
         int timeout = -1;
         virNetMessage *msg = NULL;
 -        g_autoptr(GSource) G_GNUC_UNUSED source = NULL;
 +        g_autoptr(GSource) source = NULL;
         GIOCondition ev = 0;
         struct virNetClientIOEventData data = {
             .client = client,
@@ -1728,6 +1728,18 @@ static int virNetClientIOEventLoop(virNetClient *client,
         g_main_loop_run(client->eventLoop);
 +        /*
 +         * If virNetClientIOEventFD ran, this GSource will already be
 +         * destroyed due to G_SOURCE_REMOVE. It is harmless to re-destroy
 +         * it, since we still own a reference.
 +         *
 +         * If virNetClientIOWakeup ran, it will have interrupted the
 +         * g_main_loop_run call, before virNetClientIOEventFD could
 +         * run, and thus the GSource is still registered, and we need
 +         * to destroy it since it is referencing stack memory for 'data'
 +         */
 +        g_source_destroy(source);
 +
 #ifndef WIN32
         ignore_value(pthread_sigmask(SIG_SETMASK, &oldmask, NULL));
 #endif /* !WIN32 */
 -- 
 2.45.1
--- a/Show More
+++ b/Show More
		`@ -1 +0,0 @@`
			`e440412e9b45d7e24f0ef492d8edf5cf2cbd3f4c SOURCES/libvirt-8.0.0.tar.xz`