Bug 1307094

+++ This bug was initially created as a clone of Bug #1254164 +++

Description of problem:
on a VM with SPICE configured, libvirt 1.2.8-16.el7_1.3 on RHEL 7.1 sends 'disable-ticketing' to QEMU after a save/restore cycle.
This is not what libvirt 0.10.2-46.el6_6.6 used to do, and may open breaches into VMs.

Version-Release number of selected component (if applicable):
libvirt-0.10.2-54.el6_7.3.x86_64

How reproducible:
100%

Steps to Reproduce:
1. define a domain with spice password set, e.g.,
   <graphics type='spice' autoport='yes' passwd='**' passwdValidTo='1970-01-01T00:00:01'/>
2. start the domain
3. virsh save DOM /tmp/DOM.save
4. virsh save-image-dumpxml --security-info /tmp/DOM.save >/tmp/DOM.xml
5. check the password is present in /tmp/DOM.xml
6. change the spice password using virsh save-image-edit /tmp/DOM.save
7. virsh save-image-dumpxml --security-info /tmp/DOM.save
8. virsh restore --xml /tmp/DOM.xml /tmp/DOM.save
9. virsh dumpxml --security-info DOM

Actual results:

The XMLs produced in step 7 and 9 do not contain any spice password.

Expected results:

Step 7 should show the changed password in the XML and step 9 should show the original spice password.
Additional info:

Fixed upstream with the three commits:

commit f76df311e8896957b92d0e0c5251ee3e6754d9ac
Author: Luyao Huang <lhuang>
Date:   Tue Jan 20 17:04:41 2015 +0800

    qemu: fix cannot set graphic passwd via qemuDomainSaveImageDefineXML
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1183890
    
    When we try to update a xml to a image file, we will clear the
    graphics passwd settings, because we do not pass VIR_DOMAIN_XML_SECURE
    to qemuDomainDefCopy, qemuDomainDefFormatBuf won't format the passwd.
    
    Add VIR_DOMAIN_XML_SECURE flag when we call qemuDomainDefCopy
    in qemuDomainSaveImageUpdateDef.
    
    Signed-off-by: Luyao Huang <lhuang>

diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index bc0a48c..1d3bee6 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -5623,7 +5623,8 @@ qemuDomainSaveImageUpdateDef(virQEMUDriverPtr driver,

     if (!(newdef_migr = qemuDomainDefCopy(driver,
                                           newdef,
-                                          VIR_DOMAIN_XML_MIGRATABLE)))
+                                          VIR_DOMAIN_XML_MIGRATABLE |
+                                          VIR_DOMAIN_XML_SECURE)))
         goto cleanup;

     if (!virDomainDefCheckABIStability(def, newdef_migr)) {



commit cf2d4c603c37a58c7c6cacc87f0e78b45903ae7c
Author: Michal Privoznik <mprivozn>
Date:   Thu Feb 19 13:54:53 2015 +0100

    qemu: Use correct flags for ABI stability check in SaveImageUpdateDef
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1183869
    
    Soo. you've successfully started yourself a domain. And since you want
    to use it on your host exclusively you are confident enough to
    passthrough the host CPU model, like this:
    
      <cpu mode='host-passthrough'/>
    
    Then, after a while, you want to save the domain into a file (e.g.
    virsh save dom dom.save). And here comes the trouble. The file consist
    of two parts: Libvirt header (containing domain XML among other
    things), and qemu migration data. Now, the domain XML in the header is
    formatted using special flags (VIR_DOMAIN_XML_SECURE |
    VIR_DOMAIN_XML_UPDATE_CPU | VIR_DOMAIN_XML_INACTIVE |
    VIR_DOMAIN_XML_MIGRATABLE).
    
    Then, on your way back from the bar, you think of changing something
    in the XML in the saved file (we have a command for it after all), say
    listen address for graphics console. So you successfully type in the
    command:
    
      virsh save-image-edit dom.save
    
    Change all the bits, and exit the editor. But instead of success
    you're left with sad error message:
    
      error: unsupported configuration: Target CPU model <null> does not
      match source Pentium Pro
    
    Sigh. Digging into the code you see lines, where we check for ABI
    stability. The new XML you've produced is compared with the old one
    from the saved file to see if qemu ABI will break or not. Wait, what?
    We are using different flags to parse the XML you've provided so we
    were just lucky it worked in some cases? Yep, that's right.
    
    Signed-off-by: Michal Privoznik <mprivozn>

diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index bec05d4..4057abd 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -5734,8 +5734,8 @@ qemuDomainSaveImageUpdateDef(virQEMUDriverPtr driver,

     if (!(newdef_migr = qemuDomainDefCopy(driver,
                                           newdef,
-                                          VIR_DOMAIN_XML_MIGRATABLE |
-                                          VIR_DOMAIN_XML_SECURE)))
+                                          QEMU_DOMAIN_FORMAT_LIVE_FLAGS ||
+                                          VIR_DOMAIN_XML_MIGRATABLE)))
         goto cleanup;

     if (!virDomainDefCheckABIStability(def, newdef_migr)) {



commit c75f42f3318463b0555edac333c8f20d54b4d5dc
Author: Ján Tomko <jtomko>
Date:   Fri Feb 27 11:55:40 2015 +0100

    Really fix XML formatting flags in SaveImageUpdateDef
    
    Commit cf2d4c6 used a logical or instead of bitwise or,
    effectively passing 1, that is VIR_DOMAIN_XML_INACTIVE.
    
    This was caught by a warning when building with clang.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1183869

diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index e9aa0b5..e282464 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -5734,7 +5734,7 @@ qemuDomainSaveImageUpdateDef(virQEMUDriverPtr driver,

     if (!(newdef_migr = qemuDomainDefCopy(driver,
                                           newdef,
-                                          QEMU_DOMAIN_FORMAT_LIVE_FLAGS ||
+                                          QEMU_DOMAIN_FORMAT_LIVE_FLAGS |
                                           VIR_DOMAIN_XML_MIGRATABLE)))
         goto cleanup;