diff --git a/SOURCES/libvirt-conf-Add-some-shmem-helpers-for-future-use.patch b/SOURCES/libvirt-conf-Add-some-shmem-helpers-for-future-use.patch
new file mode 100644
index 0000000..2fbbfaf
--- /dev/null
+++ b/SOURCES/libvirt-conf-Add-some-shmem-helpers-for-future-use.patch
@@ -0,0 +1,143 @@
+From 378bfb59a59c8b029c95f538fee46262a2c72116 Mon Sep 17 00:00:00 2001
+Message-Id: <378bfb59a59c8b029c95f538fee46262a2c72116@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:44 +0100
+Subject: [PATCH] conf: Add some shmem helpers for future use
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit e5568193f4d663f6a9edebcf9044d527f90a031f)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/conf/domain_conf.c | 75 ++++++++++++++++++++++++++++++++++++++++++++++++
+ src/conf/domain_conf.h | 9 ++++++
+ src/libvirt_private.syms | 5 ++++
+ 3 files changed, 89 insertions(+)
+
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index 415ab1c..57d5ec8 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -14831,6 +14831,81 @@ virDomainRedirdevDefRemove(virDomainDefPtr def, size_t idx)
+ }
+
+
++int
++virDomainShmemDefInsert(virDomainDefPtr def,
++ virDomainShmemDefPtr shmem)
++{
++ return VIR_APPEND_ELEMENT(def->shmems, def->nshmems, shmem);
++}
++
++
++bool
++virDomainShmemDefEquals(virDomainShmemDefPtr src,
++ virDomainShmemDefPtr dst)
++{
++ if (STRNEQ_NULLABLE(src->name, dst->name))
++ return false;
++
++ if (src->size != dst->size)
++ return false;
++
++ if (src->server.enabled != dst->server.enabled)
++ return false;
++
++ if (src->server.enabled) {
++ if (STRNEQ_NULLABLE(src->server.chr.data.nix.path,
++ dst->server.chr.data.nix.path))
++ return false;
++ }
++
++ if (src->msi.enabled != dst->msi.enabled)
++ return false;
++
++ if (src->msi.enabled) {
++ if (src->msi.vectors != dst->msi.vectors)
++ return false;
++ if (src->msi.ioeventfd != dst->msi.ioeventfd)
++ return false;
++ }
++
++ if (src->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_NONE &&
++ !virDomainDeviceInfoAddressIsEqual(&src->info, &dst->info))
++ return false;
++
++ return true;
++}
++
++
++ssize_t
++virDomainShmemDefFind(virDomainDefPtr def,
++ virDomainShmemDefPtr shmem)
++{
++ size_t i;
++
++ for (i = 0; i < def->nshmems; i++) {
++ if (virDomainShmemDefEquals(def->shmems[i], shmem))
++ break;
++ }
++
++ if (i < def->nshmems)
++ return i;
++
++ return -1;
++}
++
++
++virDomainShmemDefPtr
++virDomainShmemDefRemove(virDomainDefPtr def,
++ size_t idx)
++{
++ virDomainShmemDefPtr ret = def->shmems[idx];
++
++ VIR_DELETE_ELEMENT(def->shmems, idx, def->nshmems);
++
++ return ret;
++}
++
++
+ char *
+ virDomainDefGetDefaultEmulator(virDomainDefPtr def,
+ virCapsPtr caps)
+diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
+index c674796..594982e 100644
+--- a/src/conf/domain_conf.h
++++ b/src/conf/domain_conf.h
+@@ -2955,6 +2955,15 @@ int virDomainMemoryFindInactiveByDef(virDomainDefPtr def,
+ virDomainMemoryDefPtr mem)
+ ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_RETURN_CHECK;
+
++int virDomainShmemDefInsert(virDomainDefPtr def, virDomainShmemDefPtr shmem)
++ ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_RETURN_CHECK;
++bool virDomainShmemDefEquals(virDomainShmemDefPtr src, virDomainShmemDefPtr dst)
++ ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_RETURN_CHECK;
++ssize_t virDomainShmemDefFind(virDomainDefPtr def, virDomainShmemDefPtr shmem)
++ ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_RETURN_CHECK;
++virDomainShmemDefPtr virDomainShmemDefRemove(virDomainDefPtr def, size_t idx)
++ ATTRIBUTE_NONNULL(1);
++
+ VIR_ENUM_DECL(virDomainTaint)
+ VIR_ENUM_DECL(virDomainVirt)
+ VIR_ENUM_DECL(virDomainBoot)
+diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
+index 5878360..9b7c26c 100644
+--- a/src/libvirt_private.syms
++++ b/src/libvirt_private.syms
+@@ -455,6 +455,11 @@ virDomainSaveStatus;
+ virDomainSaveXML;
+ virDomainSeclabelTypeFromString;
+ virDomainSeclabelTypeToString;
++virDomainShmemDefEquals;
++virDomainShmemDefFind;
++virDomainShmemDefFree;
++virDomainShmemDefInsert;
++virDomainShmemDefRemove;
+ virDomainShutdownReasonTypeFromString;
+ virDomainShutdownReasonTypeToString;
+ virDomainShutoffReasonTypeFromString;
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-conf-Allow-copying-of-shmem-defs.patch b/SOURCES/libvirt-conf-Allow-copying-of-shmem-defs.patch
new file mode 100644
index 0000000..c85ff2d
--- /dev/null
+++ b/SOURCES/libvirt-conf-Allow-copying-of-shmem-defs.patch
@@ -0,0 +1,42 @@
+From 4ee594e8126c8187e933c10f1a24d28df3fd1090 Mon Sep 17 00:00:00 2001
+Message-Id: <4ee594e8126c8187e933c10f1a24d28df3fd1090@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:34 +0100
+Subject: [PATCH] conf: Allow copying of shmem defs
+
+This way we'll be able to hotplug with both --live and --config in one
+API call.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit 921ec15fdbf215e74f0898b0b8cf879db63ccb4b)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/conf/domain_conf.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index caa9ce0..415ab1c 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -25026,11 +25026,14 @@ virDomainDeviceDefCopy(virDomainDeviceDefPtr src,
+ case VIR_DOMAIN_DEVICE_MEMORY:
+ rc = virDomainMemoryDefFormat(&buf, src->data.memory, flags);
+ break;
++ case VIR_DOMAIN_DEVICE_SHMEM:
++ rc = virDomainShmemDefFormat(&buf, src->data.shmem, flags);
++ break;
++
+ case VIR_DOMAIN_DEVICE_NONE:
+ case VIR_DOMAIN_DEVICE_SMARTCARD:
+ case VIR_DOMAIN_DEVICE_MEMBALLOON:
+ case VIR_DOMAIN_DEVICE_NVRAM:
+- case VIR_DOMAIN_DEVICE_SHMEM:
+ case VIR_DOMAIN_DEVICE_IOMMU:
+ case VIR_DOMAIN_DEVICE_LAST:
+ virReportError(VIR_ERR_INTERNAL_ERROR,
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-conf-Don-t-complicate-find-loop.patch b/SOURCES/libvirt-conf-Don-t-complicate-find-loop.patch
new file mode 100644
index 0000000..f9cba34
--- /dev/null
+++ b/SOURCES/libvirt-conf-Don-t-complicate-find-loop.patch
@@ -0,0 +1,37 @@
+From 5357b85bd1454127075feb039ae1b3c9216fc77e Mon Sep 17 00:00:00 2001
+Message-Id: <5357b85bd1454127075feb039ae1b3c9216fc77e@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:47 +0100
+Subject: [PATCH] conf: Don't complicate find loop
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit d7107959c3cd9f113158b9165449f9c7d4754113)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/conf/domain_conf.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index 8afd2b0..25e4ba2 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -14884,12 +14884,9 @@ virDomainShmemDefFind(virDomainDefPtr def,
+
+ for (i = 0; i < def->nshmems; i++) {
+ if (virDomainShmemDefEquals(shmem, def->shmems[i]))
+- break;
++ return i;
+ }
+
+- if (i < def->nshmems)
+- return i;
+-
+ return -1;
+ }
+
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-conf-Fix-virDomainShmemDefFind.patch b/SOURCES/libvirt-conf-Fix-virDomainShmemDefFind.patch
new file mode 100644
index 0000000..12b9577
--- /dev/null
+++ b/SOURCES/libvirt-conf-Fix-virDomainShmemDefFind.patch
@@ -0,0 +1,38 @@
+From 6ee171e55799c279c776a7dfea6e132f2de5bca5 Mon Sep 17 00:00:00 2001
+Message-Id: <6ee171e55799c279c776a7dfea6e132f2de5bca5@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:46 +0100
+Subject: [PATCH] conf: Fix virDomainShmemDefFind
+
+Due to the switch of parameters in a call to virDomainShmemDefEquals()
+no device was found when looking for device with all the information
+except address. Also fix the indentation.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit ae612493ffbba8980a31800e260cc5b6b7f456e8)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/conf/domain_conf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index 57d5ec8..8afd2b0 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -14883,8 +14883,8 @@ virDomainShmemDefFind(virDomainDefPtr def,
+ size_t i;
+
+ for (i = 0; i < def->nshmems; i++) {
+- if (virDomainShmemDefEquals(def->shmems[i], shmem))
+- break;
++ if (virDomainShmemDefEquals(shmem, def->shmems[i]))
++ break;
+ }
+
+ if (i < def->nshmems)
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-conf-Remove-incorrect-check-when-encoding-shmem-audit-message.patch b/SOURCES/libvirt-conf-Remove-incorrect-check-when-encoding-shmem-audit-message.patch
new file mode 100644
index 0000000..fd65de2
--- /dev/null
+++ b/SOURCES/libvirt-conf-Remove-incorrect-check-when-encoding-shmem-audit-message.patch
@@ -0,0 +1,44 @@
+From 5005542c10ebdf6fcb4d76f31c522cc1c9136a67 Mon Sep 17 00:00:00 2001
+Message-Id: <5005542c10ebdf6fcb4d76f31c522cc1c9136a67@dist-git>
+From: John Ferlan <jferlan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:45 +0100
+Subject: [PATCH] conf: Remove incorrect check when encoding shmem audit
+ message
+
+Remove the !size check since size is initialized to NULL and thus
+causing the condition to always be true
+
+(cherry picked from commit c951cdbff94ff577c5caa3dfff4153a161c073e6)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1389013
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/conf/domain_audit.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/conf/domain_audit.c b/src/conf/domain_audit.c
+index f0cc49c..be962d6 100644
+--- a/src/conf/domain_audit.c
++++ b/src/conf/domain_audit.c
+@@ -982,7 +982,7 @@ virDomainAuditShmem(virDomainObjPtr vm,
+
+ virUUIDFormat(vm->def->uuid, uuidstr);
+
+- if (!vmname || !src || !size || !shmem ||
++ if (!vmname || !src || !shmem ||
+ virAsprintfQuiet(&size, "%llu", def->size) < 0) {
+ VIR_WARN("OOM while encoding audit message");
+ goto cleanup;
+@@ -996,7 +996,7 @@ virDomainAuditShmem(virDomainObjPtr vm,
+
+ VIR_AUDIT(VIR_AUDIT_RECORD_RESOURCE, success,
+ "virt=%s resrc=shmem reason=%s %s uuid=%s size=%s %s %s",
+- virt, reason, vmname, uuidstr, size ?: "?", shmem, src);
++ virt, reason, vmname, uuidstr, size, shmem, src);
+
+ cleanup:
+ VIR_FREE(vmname);
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-conf-qemu-Add-newer-shmem-models.patch b/SOURCES/libvirt-conf-qemu-Add-newer-shmem-models.patch
new file mode 100644
index 0000000..f28116c
--- /dev/null
+++ b/SOURCES/libvirt-conf-qemu-Add-newer-shmem-models.patch
@@ -0,0 +1,273 @@
+From 1a9572f07ac3c181166e3c67b179716d5830134c Mon Sep 17 00:00:00 2001
+Message-Id: <1a9572f07ac3c181166e3c67b179716d5830134c@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:50 +0100
+Subject: [PATCH] conf, qemu: Add newer shmem models
+
+The old ivshmem is deprecated in QEMU, so let's use the better
+ivshmem-{plain,doorbell} variants instead.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit 3c06aa7b30e91920698368ceb87c49aab06e37fe)
+
+ Conflicts:
+ tests/qemuxml2xmltest.c -- DO_TEST rewrite
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ docs/formatdomain.html.in | 10 +++-
+ docs/schemas/domaincommon.rng | 2 +
+ src/conf/domain_conf.c | 4 +-
+ src/conf/domain_conf.h | 2 +
+ src/qemu/qemu_command.c | 7 +++
+ .../qemuxml2argv-shmem-plain-doorbell.xml | 58 +++++++++++++++++++
+ .../qemuxml2xmlout-shmem-plain-doorbell.xml | 67 ++++++++++++++++++++++
+ tests/qemuxml2xmltest.c | 1 +
+ 8 files changed, 147 insertions(+), 4 deletions(-)
+ create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-shmem-plain-doorbell.xml
+ create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-shmem-plain-doorbell.xml
+
+diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
+index a39d730..e9b7bad 100644
+--- a/docs/formatdomain.html.in
++++ b/docs/formatdomain.html.in
+@@ -6686,10 +6686,11 @@ qemu-kvm -net nic,model=? /dev/null
+ ...
+ <devices>
+ <shmem name='my_shmem0'>
++ <model type='ivshmem-plain'/>
+ <size unit='M'>4</size>
+ </shmem>
+ <shmem name='shmem_server'>
+- <model type='ivshmem'/>
++ <model type='ivshmem-doorbell'/>
+ <size unit='M'>2</size>
+ <server path='/tmp/socket-shmem'/>
+ <msi vectors='32' ioeventfd='on'/>
+@@ -6708,8 +6709,11 @@ qemu-kvm -net nic,model=? /dev/null
+ <dd>
+ Attribute <code>type</code> of the optional element <code>model</code>
+ specifies the model of the underlying device providing the
+- <code>shmem</code> device. Currently the only supported model is
+- <code>ivshmem</code>.
++ <code>shmem</code> device. The models currently supported are
++ <code>ivshmem</code> (supports both server and server-less shmem, but is
++ deprecated by newer QEMU in favour of the -plain and -doorbell variants),
++ <code>ivshmem-plain</code> (only for server-less shmem) and
++ <code>ivshmem-doorbell</code> (only for shmem with the server).
+ </dd>
+ <dt><code>size</code></dt>
+ <dd>
+diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
+index 7d16536..6acc107 100644
+--- a/docs/schemas/domaincommon.rng
++++ b/docs/schemas/domaincommon.rng
+@@ -3557,6 +3557,8 @@
+ <attribute name="type">
+ <choice>
+ <value>ivshmem</value>
++ <value>ivshmem-plain</value>
++ <value>ivshmem-doorbell</value>
+ </choice>
+ </attribute>
+ </element>
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index 25b1c63..514e50d 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -841,7 +841,9 @@ VIR_ENUM_IMPL(virDomainMemoryModel, VIR_DOMAIN_MEMORY_MODEL_LAST,
+ "", "dimm")
+
+ VIR_ENUM_IMPL(virDomainShmemModel, VIR_DOMAIN_SHMEM_MODEL_LAST,
+- "ivshmem")
++ "ivshmem",
++ "ivshmem-plain",
++ "ivshmem-doorbell")
+
+ static virClassPtr virDomainObjClass;
+ static virClassPtr virDomainXMLOptionClass;
+diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
+index db74d1d..b8944cb 100644
+--- a/src/conf/domain_conf.h
++++ b/src/conf/domain_conf.h
+@@ -1551,6 +1551,8 @@ struct _virDomainNVRAMDef {
+
+ typedef enum {
+ VIR_DOMAIN_SHMEM_MODEL_IVSHMEM,
++ VIR_DOMAIN_SHMEM_MODEL_IVSHMEM_PLAIN,
++ VIR_DOMAIN_SHMEM_MODEL_IVSHMEM_DOORBELL,
+
+ VIR_DOMAIN_SHMEM_MODEL_LAST
+ } virDomainShmemModel;
+diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
+index c5d29b4..e145c9f 100644
+--- a/src/qemu/qemu_command.c
++++ b/src/qemu/qemu_command.c
+@@ -8564,6 +8564,13 @@ qemuBuildShmemCommandLine(virLogManagerPtr logManager,
+ devstr = qemuBuildShmemDevLegacyStr(def, shmem, qemuCaps);
+ break;
+
++ case VIR_DOMAIN_SHMEM_MODEL_IVSHMEM_PLAIN:
++ case VIR_DOMAIN_SHMEM_MODEL_IVSHMEM_DOORBELL:
++ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
++ _("%s device is not supported with this QEMU binary"),
++ virDomainShmemModelTypeToString(shmem->model));
++ break;
++
+ case VIR_DOMAIN_SHMEM_MODEL_LAST:
+ break;
+ }
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-shmem-plain-doorbell.xml b/tests/qemuxml2argvdata/qemuxml2argv-shmem-plain-doorbell.xml
+new file mode 100644
+index 0000000..454437c
+--- /dev/null
++++ b/tests/qemuxml2argvdata/qemuxml2argv-shmem-plain-doorbell.xml
+@@ -0,0 +1,58 @@
++<domain type='qemu'>
++ <name>QEMUGuest1</name>
++ <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
++ <memory unit='KiB'>219136</memory>
++ <currentMemory unit='KiB'>219136</currentMemory>
++ <vcpu placement='static'>1</vcpu>
++ <os>
++ <type arch='i686' machine='pc'>hvm</type>
++ <boot dev='hd'/>
++ </os>
++ <clock offset='utc'/>
++ <on_poweroff>destroy</on_poweroff>
++ <on_reboot>restart</on_reboot>
++ <on_crash>destroy</on_crash>
++ <devices>
++ <emulator>/usr/bin/qemu</emulator>
++ <controller type='usb' index='0'/>
++ <controller type='pci' index='0' model='pci-root'/>
++ <input type='mouse' bus='ps2'/>
++ <input type='keyboard' bus='ps2'/>
++ <memballoon model='none'/>
++ <shmem name='shmem0'>
++ <model type='ivshmem-plain'/>
++ </shmem>
++ <shmem name='shmem1'>
++ <model type='ivshmem-plain'/>
++ <size unit='M'>128</size>
++ </shmem>
++ <shmem name='shmem2'>
++ <model type='ivshmem-plain'/>
++ <size unit='M'>256</size>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
++ </shmem>
++ <shmem name='shmem3'>
++ <model type='ivshmem-doorbell'/>
++ <server/>
++ </shmem>
++ <shmem name='shmem4'>
++ <model type='ivshmem-doorbell'/>
++ <server path='/tmp/shmem4-sock'/>
++ </shmem>
++ <shmem name='shmem5'>
++ <model type='ivshmem-doorbell'/>
++ <server path='/tmp/shmem5-sock'/>
++ <msi ioeventfd='off'/>
++ </shmem>
++ <shmem name='shmem6'>
++ <model type='ivshmem-doorbell'/>
++ <server path='/tmp/shmem6-sock'/>
++ <msi vectors='16'/>
++ </shmem>
++ <shmem name='shmem7'>
++ <model type='ivshmem-doorbell'/>
++ <server path='/tmp/shmem7-sock'/>
++ <msi vectors='32' ioeventfd='on'/>
++ </shmem>
++ </devices>
++</domain>
+diff --git a/tests/qemuxml2xmloutdata/qemuxml2xmlout-shmem-plain-doorbell.xml b/tests/qemuxml2xmloutdata/qemuxml2xmlout-shmem-plain-doorbell.xml
+new file mode 100644
+index 0000000..ab9c69b
+--- /dev/null
++++ b/tests/qemuxml2xmloutdata/qemuxml2xmlout-shmem-plain-doorbell.xml
+@@ -0,0 +1,67 @@
++<domain type='qemu'>
++ <name>QEMUGuest1</name>
++ <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
++ <memory unit='KiB'>219136</memory>
++ <currentMemory unit='KiB'>219136</currentMemory>
++ <vcpu placement='static'>1</vcpu>
++ <os>
++ <type arch='i686' machine='pc'>hvm</type>
++ <boot dev='hd'/>
++ </os>
++ <clock offset='utc'/>
++ <on_poweroff>destroy</on_poweroff>
++ <on_reboot>restart</on_reboot>
++ <on_crash>destroy</on_crash>
++ <devices>
++ <emulator>/usr/bin/qemu</emulator>
++ <controller type='usb' index='0'>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
++ </controller>
++ <controller type='pci' index='0' model='pci-root'/>
++ <input type='mouse' bus='ps2'/>
++ <input type='keyboard' bus='ps2'/>
++ <memballoon model='none'/>
++ <shmem name='shmem0'>
++ <model type='ivshmem-plain'/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
++ </shmem>
++ <shmem name='shmem1'>
++ <model type='ivshmem-plain'/>
++ <size unit='M'>128</size>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
++ </shmem>
++ <shmem name='shmem2'>
++ <model type='ivshmem-plain'/>
++ <size unit='M'>256</size>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
++ </shmem>
++ <shmem name='shmem3'>
++ <model type='ivshmem-doorbell'/>
++ <server/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
++ </shmem>
++ <shmem name='shmem4'>
++ <model type='ivshmem-doorbell'/>
++ <server path='/tmp/shmem4-sock'/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
++ </shmem>
++ <shmem name='shmem5'>
++ <model type='ivshmem-doorbell'/>
++ <server path='/tmp/shmem5-sock'/>
++ <msi ioeventfd='off'/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
++ </shmem>
++ <shmem name='shmem6'>
++ <model type='ivshmem-doorbell'/>
++ <server path='/tmp/shmem6-sock'/>
++ <msi vectors='16'/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x09' function='0x0'/>
++ </shmem>
++ <shmem name='shmem7'>
++ <model type='ivshmem-doorbell'/>
++ <server path='/tmp/shmem7-sock'/>
++ <msi vectors='32' ioeventfd='on'/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x0a' function='0x0'/>
++ </shmem>
++ </devices>
++</domain>
+diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c
+index 5458361..c6bf7ad 100644
+--- a/tests/qemuxml2xmltest.c
++++ b/tests/qemuxml2xmltest.c
+@@ -827,6 +827,7 @@ mymain(void)
+ DO_TEST("tap-vhost");
+ DO_TEST("tap-vhost-incorrect");
+ DO_TEST("shmem");
++ DO_TEST("shmem-plain-doorbell");
+ DO_TEST("smbios");
+ DO_TEST("smbios-multiple-type2");
+
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-conf-qemu-Add-support-for-shmem-model.patch b/SOURCES/libvirt-conf-qemu-Add-support-for-shmem-model.patch
new file mode 100644
index 0000000..fc6826b
--- /dev/null
+++ b/SOURCES/libvirt-conf-qemu-Add-support-for-shmem-model.patch
@@ -0,0 +1,296 @@
+From c07ec81488d9bba54d5ea209479c798f005faa47 Mon Sep 17 00:00:00 2001
+Message-Id: <c07ec81488d9bba54d5ea209479c798f005faa47@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:49 +0100
+Subject: [PATCH] conf, qemu: Add support for shmem model
+
+Just the default one now, new ones will be added in following commits.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit 64530a9c667e4f875992ec0d85cffd2072b8cfd7)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ docs/formatdomain.html.in | 8 +++++
+ docs/schemas/domaincommon.rng | 9 +++++
+ src/conf/domain_conf.c | 44 +++++++++++++++++------
+ src/conf/domain_conf.h | 8 +++++
+ src/libvirt_private.syms | 2 ++
+ src/qemu/qemu_command.c | 11 +++++-
+ tests/qemuxml2argvdata/qemuxml2argv-shmem.xml | 2 ++
+ tests/qemuxml2xmloutdata/qemuxml2xmlout-shmem.xml | 8 +++++
+ 8 files changed, 80 insertions(+), 12 deletions(-)
+
+diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
+index 4970d61..a39d730 100644
+--- a/docs/formatdomain.html.in
++++ b/docs/formatdomain.html.in
+@@ -6689,6 +6689,7 @@ qemu-kvm -net nic,model=? /dev/null
+ <size unit='M'>4</size>
+ </shmem>
+ <shmem name='shmem_server'>
++ <model type='ivshmem'/>
+ <size unit='M'>2</size>
+ <server path='/tmp/socket-shmem'/>
+ <msi vectors='32' ioeventfd='on'/>
+@@ -6703,6 +6704,13 @@ qemu-kvm -net nic,model=? /dev/null
+ The <code>shmem</code> element has one mandatory attribute,
+ <code>name</code> to identify the shared memory.
+ </dd>
++ <dt><code>model</code></dt>
++ <dd>
++ Attribute <code>type</code> of the optional element <code>model</code>
++ specifies the model of the underlying device providing the
++ <code>shmem</code> device. Currently the only supported model is
++ <code>ivshmem</code>.
++ </dd>
+ <dt><code>size</code></dt>
+ <dd>
+ The optional <code>size</code> element specifies the size of the shared
+diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
+index d88ff3e..7d16536 100644
+--- a/docs/schemas/domaincommon.rng
++++ b/docs/schemas/domaincommon.rng
+@@ -3553,6 +3553,15 @@
+ <attribute name="name"/>
+ <interleave>
+ <optional>
++ <element name="model">
++ <attribute name="type">
++ <choice>
++ <value>ivshmem</value>
++ </choice>
++ </attribute>
++ </element>
++ </optional>
++ <optional>
+ <element name="size">
+ <ref name="scaledInteger"/>
+ </element>
+diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
+index 25e4ba2..25b1c63 100644
+--- a/src/conf/domain_conf.c
++++ b/src/conf/domain_conf.c
+@@ -840,6 +840,9 @@ VIR_ENUM_IMPL(virDomainBlockJob, VIR_DOMAIN_BLOCK_JOB_TYPE_LAST,
+ VIR_ENUM_IMPL(virDomainMemoryModel, VIR_DOMAIN_MEMORY_MODEL_LAST,
+ "", "dimm")
+
++VIR_ENUM_IMPL(virDomainShmemModel, VIR_DOMAIN_SHMEM_MODEL_LAST,
++ "ivshmem")
++
+ static virClassPtr virDomainObjClass;
+ static virClassPtr virDomainXMLOptionClass;
+ static void virDomainObjDispose(void *obj);
+@@ -12267,6 +12270,20 @@ virDomainShmemDefParseXML(xmlNodePtr node,
+
+ ctxt->node = node;
+
++ tmp = virXPathString("string(./model/@type)", ctxt);
++ if (tmp) {
++ /* If there's none, we will automatically have the first one
++ * (as default). Unfortunately this has to be done for
++ * compatibility reasons. */
++ if ((def->model = virDomainShmemModelTypeFromString(tmp)) < 0) {
++ virReportError(VIR_ERR_XML_ERROR,
++ _("Unknown shmem model type '%s'"), tmp);
++ goto cleanup;
++ }
++
++ VIR_FREE(tmp);
++ }
++
+ if (!(def->name = virXMLPropString(node, "name"))) {
+ virReportError(VIR_ERR_XML_ERROR, "%s",
+ _("shmem element must contain 'name' attribute"));
+@@ -14849,6 +14866,9 @@ virDomainShmemDefEquals(virDomainShmemDefPtr src,
+ if (src->size != dst->size)
+ return false;
+
++ if (src->model != dst->model)
++ return false;
++
+ if (src->server.enabled != dst->server.enabled)
+ return false;
+
+@@ -18828,6 +18848,15 @@ virDomainShmemDefCheckABIStability(virDomainShmemDefPtr src,
+ return false;
+ }
+
++ if (src->model != dst->model) {
++ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
++ _("Target shared memory model '%s' does not match "
++ "source model '%s'"),
++ virDomainShmemModelTypeToString(dst->model),
++ virDomainShmemModelTypeToString(src->model));
++ return false;
++ }
++
+ if (src->size != dst->size) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("Target shared memory size '%llu' does not match "
+@@ -21849,20 +21878,13 @@ virDomainShmemDefFormat(virBufferPtr buf,
+ virDomainShmemDefPtr def,
+ unsigned int flags)
+ {
+- virBufferEscapeString(buf, "<shmem name='%s'", def->name);
+-
+- if (!def->size &&
+- !def->server.enabled &&
+- !def->msi.enabled &&
+- !virDomainDeviceInfoNeedsFormat(&def->info, flags)) {
+- virBufferAddLit(buf, "/>\n");
+- return 0;
+- } else {
+- virBufferAddLit(buf, ">\n");
+- }
++ virBufferEscapeString(buf, "<shmem name='%s'>\n", def->name);
+
+ virBufferAdjustIndent(buf, 2);
+
++ virBufferAsprintf(buf, "<model type='%s'/>\n",
++ virDomainShmemModelTypeToString(def->model));
++
+ if (def->size)
+ virBufferAsprintf(buf, "<size unit='M'>%llu</size>\n", def->size >> 20);
+
+diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
+index 594982e..db74d1d 100644
+--- a/src/conf/domain_conf.h
++++ b/src/conf/domain_conf.h
+@@ -1549,9 +1549,16 @@ struct _virDomainNVRAMDef {
+ virDomainDeviceInfo info;
+ };
+
++typedef enum {
++ VIR_DOMAIN_SHMEM_MODEL_IVSHMEM,
++
++ VIR_DOMAIN_SHMEM_MODEL_LAST
++} virDomainShmemModel;
++
+ struct _virDomainShmemDef {
+ char *name;
+ unsigned long long size;
++ int model; /* enum virDomainShmemModel */
+ struct {
+ bool enabled;
+ virDomainChrSourceDef chr;
+@@ -3042,6 +3049,7 @@ VIR_ENUM_DECL(virDomainTPMBackend)
+ VIR_ENUM_DECL(virDomainMemoryModel)
+ VIR_ENUM_DECL(virDomainMemoryBackingModel)
+ VIR_ENUM_DECL(virDomainIOMMUModel)
++VIR_ENUM_DECL(virDomainShmemModel)
+ /* from libvirt.h */
+ VIR_ENUM_DECL(virDomainState)
+ VIR_ENUM_DECL(virDomainNostateReason)
+diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
+index 9b7c26c..bee5676 100644
+--- a/src/libvirt_private.syms
++++ b/src/libvirt_private.syms
+@@ -460,6 +460,8 @@ virDomainShmemDefFind;
+ virDomainShmemDefFree;
+ virDomainShmemDefInsert;
+ virDomainShmemDefRemove;
++virDomainShmemModelTypeFromString;
++virDomainShmemModelTypeToString;
+ virDomainShutdownReasonTypeFromString;
+ virDomainShutdownReasonTypeToString;
+ virDomainShutoffReasonTypeFromString;
+diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
+index e668a58..c5d29b4 100644
+--- a/src/qemu/qemu_command.c
++++ b/src/qemu/qemu_command.c
+@@ -8559,7 +8559,16 @@ qemuBuildShmemCommandLine(virLogManagerPtr logManager,
+ return -1;
+ }
+
+- if (!(devstr = qemuBuildShmemDevLegacyStr(def, shmem, qemuCaps)))
++ switch ((virDomainShmemModel)shmem->model) {
++ case VIR_DOMAIN_SHMEM_MODEL_IVSHMEM:
++ devstr = qemuBuildShmemDevLegacyStr(def, shmem, qemuCaps);
++ break;
++
++ case VIR_DOMAIN_SHMEM_MODEL_LAST:
++ break;
++ }
++
++ if (!devstr)
+ return -1;
+ virCommandAddArgList(cmd, "-device", devstr, NULL);
+ VIR_FREE(devstr);
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-shmem.xml b/tests/qemuxml2argvdata/qemuxml2argv-shmem.xml
+index 5bc4904..b56e9e1 100644
+--- a/tests/qemuxml2argvdata/qemuxml2argv-shmem.xml
++++ b/tests/qemuxml2argvdata/qemuxml2argv-shmem.xml
+@@ -28,6 +28,7 @@
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
+ </shmem>
+ <shmem name='shmem3'>
++ <model type='ivshmem'/>
+ <size unit='M'>512</size>
+ <server/>
+ </shmem>
+@@ -41,6 +42,7 @@
+ <msi ioeventfd='off'/>
+ </shmem>
+ <shmem name='shmem6'>
++ <model type='ivshmem'/>
+ <size unit='M'>4096</size>
+ <server path='/tmp/shmem6-sock'/>
+ <msi vectors='16'/>
+diff --git a/tests/qemuxml2xmloutdata/qemuxml2xmlout-shmem.xml b/tests/qemuxml2xmloutdata/qemuxml2xmlout-shmem.xml
+index 1197f36..5602913 100644
+--- a/tests/qemuxml2xmloutdata/qemuxml2xmlout-shmem.xml
++++ b/tests/qemuxml2xmloutdata/qemuxml2xmlout-shmem.xml
+@@ -22,39 +22,47 @@
+ <input type='keyboard' bus='ps2'/>
+ <memballoon model='none'/>
+ <shmem name='shmem0'>
++ <model type='ivshmem'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
+ </shmem>
+ <shmem name='shmem1'>
++ <model type='ivshmem'/>
+ <size unit='M'>128</size>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
+ </shmem>
+ <shmem name='shmem2'>
++ <model type='ivshmem'/>
+ <size unit='M'>256</size>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
+ </shmem>
+ <shmem name='shmem3'>
++ <model type='ivshmem'/>
+ <size unit='M'>512</size>
+ <server/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
+ </shmem>
+ <shmem name='shmem4'>
++ <model type='ivshmem'/>
+ <size unit='M'>1024</size>
+ <server path='/tmp/shmem4-sock'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
+ </shmem>
+ <shmem name='shmem5'>
++ <model type='ivshmem'/>
+ <size unit='M'>2048</size>
+ <server path='/tmp/shmem5-sock'/>
+ <msi ioeventfd='off'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
+ </shmem>
+ <shmem name='shmem6'>
++ <model type='ivshmem'/>
+ <size unit='M'>4096</size>
+ <server path='/tmp/shmem6-sock'/>
+ <msi vectors='16'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x09' function='0x0'/>
+ </shmem>
+ <shmem name='shmem7'>
++ <model type='ivshmem'/>
+ <size unit='M'>8192</size>
+ <server path='/tmp/shmem7-sock'/>
+ <msi vectors='32' ioeventfd='on'/>
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-qemu-Abstract-shmem-socket-path-preparation.patch b/SOURCES/libvirt-qemu-Abstract-shmem-socket-path-preparation.patch
new file mode 100644
index 0000000..ca6f983
--- /dev/null
+++ b/SOURCES/libvirt-qemu-Abstract-shmem-socket-path-preparation.patch
@@ -0,0 +1,78 @@
+From 2bcbf4e9a10d8db84c212c7815456af6996bc6e9 Mon Sep 17 00:00:00 2001
+Message-Id: <2bcbf4e9a10d8db84c212c7815456af6996bc6e9@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:41 +0100
+Subject: [PATCH] qemu: Abstract shmem socket path preparation
+
+Put it into qemuDomainPrepareShmemChardev() so it can be used later.
+Also don't fill in the path unless the server option is enabled.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit 0f61d7b5f2b5d011b58386e7bf1a48f75a15e9d7)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/qemu/qemu_command.c | 5 +----
+ src/qemu/qemu_domain.c | 13 +++++++++++++
+ src/qemu/qemu_domain.h | 3 +++
+ 3 files changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
+index 3ebfe84..adb743b 100644
+--- a/src/qemu/qemu_command.c
++++ b/src/qemu/qemu_command.c
+@@ -8513,10 +8513,7 @@ qemuBuildShmemBackendStr(virLogManagerPtr logManager,
+ {
+ char *devstr = NULL;
+
+- if (!shmem->server.chr.data.nix.path &&
+- virAsprintf(&shmem->server.chr.data.nix.path,
+- "/var/lib/libvirt/shmem-%s-sock",
+- shmem->name) < 0)
++ if (qemuDomainPrepareShmemChardev(shmem) < 0)
+ return NULL;
+
+ devstr = qemuBuildChrChardevStr(logManager, cmd, cfg, def,
+diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
+index 8db2ed5..4f99c14 100644
+--- a/src/qemu/qemu_domain.c
++++ b/src/qemu/qemu_domain.c
+@@ -5993,6 +5993,19 @@ qemuDomainPrepareChannel(virDomainChrDefPtr channel,
+ }
+
+
++int
++qemuDomainPrepareShmemChardev(virDomainShmemDefPtr shmem)
++{
++ if (!shmem->server.enabled ||
++ shmem->server.chr.data.nix.path)
++ return 0;
++
++ return virAsprintf(&shmem->server.chr.data.nix.path,
++ "/var/lib/libvirt/shmem-%s-sock",
++ shmem->name);
++}
++
++
+ /**
+ * qemuDomainVcpuHotplugIsInOrder:
+ * @def: domain definition
+diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h
+index f94bfc9..66ffe58 100644
+--- a/src/qemu/qemu_domain.h
++++ b/src/qemu/qemu_domain.h
+@@ -724,6 +724,9 @@ int qemuDomainPrepareChannel(virDomainChrDefPtr chr,
+ const char *domainChannelTargetDir)
+ ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2);
+
++int qemuDomainPrepareShmemChardev(virDomainShmemDefPtr shmem)
++ ATTRIBUTE_NONNULL(1);
++
+ bool qemuDomainVcpuHotplugIsInOrder(virDomainDefPtr def)
+ ATTRIBUTE_NONNULL(1);
+
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-qemu-Add-capabilities-for-ivshmem-plain-doorbell.patch b/SOURCES/libvirt-qemu-Add-capabilities-for-ivshmem-plain-doorbell.patch
new file mode 100644
index 0000000..1b44c3c
--- /dev/null
+++ b/SOURCES/libvirt-qemu-Add-capabilities-for-ivshmem-plain-doorbell.patch
@@ -0,0 +1,134 @@
+From 444d00e9ead63e1bd96a2ba36fa678dbcaf9c6c2 Mon Sep 17 00:00:00 2001
+Message-Id: <444d00e9ead63e1bd96a2ba36fa678dbcaf9c6c2@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:51 +0100
+Subject: [PATCH] qemu: Add capabilities for ivshmem-{plain, doorbell}
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit 22d94ca46d797a7e7abd61134ad4490bf196baf5)
+
+ Conflicts (due to bunch of other capabilities):
+ src/qemu/qemu_capabilities.c
+ src/qemu/qemu_capabilities.h
+ tests/qemucapabilitiesdata/caps_2.6.0-gicv2.aarch64.xml
+ tests/qemucapabilitiesdata/caps_2.6.0-gicv3.aarch64.xml
+ tests/qemucapabilitiesdata/caps_2.6.0.ppc64le.xml
+ tests/qemucapabilitiesdata/caps_2.6.0.x86_64.xml
+ tests/qemucapabilitiesdata/caps_2.7.0.x86_64.xml
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/qemu/qemu_capabilities.c | 4 ++++
+ src/qemu/qemu_capabilities.h | 2 ++
+ tests/qemucapabilitiesdata/caps_2.6.0-gicv2.aarch64.xml | 2 ++
+ tests/qemucapabilitiesdata/caps_2.6.0-gicv3.aarch64.xml | 2 ++
+ tests/qemucapabilitiesdata/caps_2.6.0.ppc64le.xml | 2 ++
+ tests/qemucapabilitiesdata/caps_2.6.0.x86_64.xml | 2 ++
+ tests/qemucapabilitiesdata/caps_2.7.0.x86_64.xml | 2 ++
+ 7 files changed, 16 insertions(+)
+
+diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
+index 2c49109..e511b8e 100644
+--- a/src/qemu/qemu_capabilities.c
++++ b/src/qemu/qemu_capabilities.c
+@@ -342,6 +342,8 @@ VIR_ENUM_IMPL(virQEMUCaps, QEMU_CAPS_LAST,
+ "query-hotpluggable-cpus",
+
+ "virtio-net.rx_queue_size", /* 235 */
++ "ivshmem-plain",
++ "ivshmem-doorbell",
+ );
+
+
+@@ -1563,6 +1565,8 @@ struct virQEMUCapsStringFlags virQEMUCapsObjectTypes[] = {
+ { "pxb-pcie", QEMU_CAPS_DEVICE_PXB_PCIE },
+ { "tls-creds-x509", QEMU_CAPS_OBJECT_TLS_CREDS_X509 },
+ { "intel-iommu", QEMU_CAPS_DEVICE_INTEL_IOMMU },
++ { "ivshmem-plain", QEMU_CAPS_DEVICE_IVSHMEM_PLAIN },
++ { "ivshmem-doorbell", QEMU_CAPS_DEVICE_IVSHMEM_DOORBELL },
+ };
+
+ static struct virQEMUCapsStringFlags virQEMUCapsObjectPropsVirtioBalloon[] = {
+diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
+index 6949ec8..f6f624d 100644
+--- a/src/qemu/qemu_capabilities.h
++++ b/src/qemu/qemu_capabilities.h
+@@ -376,6 +376,8 @@ typedef enum {
+
+ /* 235 */
+ QEMU_CAPS_VIRTIO_NET_RX_QUEUE_SIZE, /* virtio-net-*.rx_queue_size */
++ QEMU_CAPS_DEVICE_IVSHMEM_PLAIN, /* -device ivshmem-plain */
++ QEMU_CAPS_DEVICE_IVSHMEM_DOORBELL, /* -device ivshmem-doorbell */
+
+ QEMU_CAPS_LAST /* this must always be the last item */
+ } virQEMUCapsFlags;
+diff --git a/tests/qemucapabilitiesdata/caps_2.6.0-gicv2.aarch64.xml b/tests/qemucapabilitiesdata/caps_2.6.0-gicv2.aarch64.xml
+index 7586269..63b9a30 100644
+--- a/tests/qemucapabilitiesdata/caps_2.6.0-gicv2.aarch64.xml
++++ b/tests/qemucapabilitiesdata/caps_2.6.0-gicv2.aarch64.xml
+@@ -157,6 +157,8 @@
+ <flag name='drive-detect-zeroes'/>
+ <flag name='tls-creds-x509'/>
+ <flag name='smm'/>
++ <flag name='ivshmem-plain'/>
++ <flag name='ivshmem-doorbell'/>
+ <version>2005094</version>
+ <kvmVersion>0</kvmVersion>
+ <package></package>
+diff --git a/tests/qemucapabilitiesdata/caps_2.6.0-gicv3.aarch64.xml b/tests/qemucapabilitiesdata/caps_2.6.0-gicv3.aarch64.xml
+index cc146f6..e2f01ec 100644
+--- a/tests/qemucapabilitiesdata/caps_2.6.0-gicv3.aarch64.xml
++++ b/tests/qemucapabilitiesdata/caps_2.6.0-gicv3.aarch64.xml
+@@ -157,6 +157,8 @@
+ <flag name='drive-detect-zeroes'/>
+ <flag name='tls-creds-x509'/>
+ <flag name='smm'/>
++ <flag name='ivshmem-plain'/>
++ <flag name='ivshmem-doorbell'/>
+ <version>2005094</version>
+ <kvmVersion>0</kvmVersion>
+ <package></package>
+diff --git a/tests/qemucapabilitiesdata/caps_2.6.0.ppc64le.xml b/tests/qemucapabilitiesdata/caps_2.6.0.ppc64le.xml
+index cf77e92..d10a604 100644
+--- a/tests/qemucapabilitiesdata/caps_2.6.0.ppc64le.xml
++++ b/tests/qemucapabilitiesdata/caps_2.6.0.ppc64le.xml
+@@ -151,6 +151,8 @@
+ <flag name='drive-detect-zeroes'/>
+ <flag name='tls-creds-x509'/>
+ <flag name='smm'/>
++ <flag name='ivshmem-plain'/>
++ <flag name='ivshmem-doorbell'/>
+ <version>2005094</version>
+ <kvmVersion>0</kvmVersion>
+ <package></package>
+diff --git a/tests/qemucapabilitiesdata/caps_2.6.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_2.6.0.x86_64.xml
+index 5a2512e..70bf9f4 100644
+--- a/tests/qemucapabilitiesdata/caps_2.6.0.x86_64.xml
++++ b/tests/qemucapabilitiesdata/caps_2.6.0.x86_64.xml
+@@ -194,6 +194,8 @@
+ <flag name='tls-creds-x509'/>
+ <flag name='intel-iommu'/>
+ <flag name='smm'/>
++ <flag name='ivshmem-plain'/>
++ <flag name='ivshmem-doorbell'/>
+ <version>2006000</version>
+ <kvmVersion>0</kvmVersion>
+ <package></package>
+diff --git a/tests/qemucapabilitiesdata/caps_2.7.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_2.7.0.x86_64.xml
+index 8f878fe..78bbaf8 100644
+--- a/tests/qemucapabilitiesdata/caps_2.7.0.x86_64.xml
++++ b/tests/qemucapabilitiesdata/caps_2.7.0.x86_64.xml
+@@ -192,6 +192,8 @@
+ <flag name='intel-iommu'/>
+ <flag name='smm'/>
+ <flag name='query-hotpluggable-cpus'/>
++ <flag name='ivshmem-plain'/>
++ <flag name='ivshmem-doorbell'/>
+ <version>2006091</version>
+ <kvmVersion>0</kvmVersion>
+ <package> (v2.7.0-rc1-52-g42e0d60)</package>
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-qemu-Add-qemuAssignDeviceShmemAlias-and-use-it.patch b/SOURCES/libvirt-qemu-Add-qemuAssignDeviceShmemAlias-and-use-it.patch
new file mode 100644
index 0000000..167249f
--- /dev/null
+++ b/SOURCES/libvirt-qemu-Add-qemuAssignDeviceShmemAlias-and-use-it.patch
@@ -0,0 +1,85 @@
+From 27452e33f75a6bc6562d6a6992b496e9e0e25f93 Mon Sep 17 00:00:00 2001
+Message-Id: <27452e33f75a6bc6562d6a6992b496e9e0e25f93@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:43 +0100
+Subject: [PATCH] qemu: Add qemuAssignDeviceShmemAlias and use it
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit a9996a45992d6d204ec922d836b26da65e3f7191)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/qemu/qemu_alias.c | 32 +++++++++++++++++++++++++++++++-
+ src/qemu/qemu_alias.h | 4 ++++
+ 2 files changed, 35 insertions(+), 1 deletion(-)
+
+diff --git a/src/qemu/qemu_alias.c b/src/qemu/qemu_alias.c
+index a85d3d1..9d4b1d6 100644
+--- a/src/qemu/qemu_alias.c
++++ b/src/qemu/qemu_alias.c
+@@ -351,6 +351,36 @@ qemuAssignDeviceMemoryAlias(virDomainDefPtr def,
+
+
+ int
++qemuAssignDeviceShmemAlias(virDomainDefPtr def,
++ virDomainShmemDefPtr shmem,
++ int idx)
++{
++ if (idx == -1) {
++ size_t i;
++ idx = 0;
++ for (i = 0; i < def->nshmems; i++) {
++ int thisidx;
++
++ if ((thisidx = qemuDomainDeviceAliasIndex(&def->shmems[i]->info,
++ "shmem")) < 0) {
++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
++ _("Unable to determine device index "
++ "for shmem device"));
++ return -1;
++ }
++
++ if (thisidx >= idx)
++ idx = thisidx + 1;
++ }
++ }
++
++ if (virAsprintf(&shmem->info.alias, "shmem%d", idx) < 0)
++ return -1;
++ return 0;
++}
++
++
++int
+ qemuAssignDeviceAliases(virDomainDefPtr def, virQEMUCapsPtr qemuCaps)
+ {
+ size_t i;
+@@ -419,7 +449,7 @@ qemuAssignDeviceAliases(virDomainDefPtr def, virQEMUCapsPtr qemuCaps)
+ return -1;
+ }
+ for (i = 0; i < def->nshmems; i++) {
+- if (virAsprintf(&def->shmems[i]->info.alias, "shmem%zu", i) < 0)
++ if (qemuAssignDeviceShmemAlias(def, def->shmems[i], i) < 0)
+ return -1;
+ }
+ for (i = 0; i < def->nsmartcards; i++) {
+diff --git a/src/qemu/qemu_alias.h b/src/qemu/qemu_alias.h
+index bb19710..6aee457 100644
+--- a/src/qemu/qemu_alias.h
++++ b/src/qemu/qemu_alias.h
+@@ -60,6 +60,10 @@ int qemuAssignDeviceRNGAlias(virDomainDefPtr def,
+ int qemuAssignDeviceMemoryAlias(virDomainDefPtr def,
+ virDomainMemoryDefPtr mems);
+
++int qemuAssignDeviceShmemAlias(virDomainDefPtr def,
++ virDomainShmemDefPtr shmem,
++ int idx);
++
+ int qemuAssignDeviceAliases(virDomainDefPtr def, virQEMUCapsPtr qemuCaps);
+
+ int qemuDomainDeviceAliasIndex(const virDomainDeviceInfo *info,
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-qemu-Add-support-for-hot-cold-un-plug-of-shmem-devices.patch b/SOURCES/libvirt-qemu-Add-support-for-hot-cold-un-plug-of-shmem-devices.patch
new file mode 100644
index 0000000..298324d
--- /dev/null
+++ b/SOURCES/libvirt-qemu-Add-support-for-hot-cold-un-plug-of-shmem-devices.patch
@@ -0,0 +1,701 @@
+From fa914e6aea49d5cdc063b366a793d4d76a3a4030 Mon Sep 17 00:00:00 2001
+Message-Id: <fa914e6aea49d5cdc063b366a793d4d76a3a4030@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:54 +0100
+Subject: [PATCH] qemu: Add support for hot/cold-(un)plug of shmem devices
+
+This is needed in order to migrate a domain with shmem devices as that
+is not allowed to migrate.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit fb2d0cc6332ed2d5546aad623792231d619a4707)
+
+ Conflicts:
+ tests/qemuhotplugtest.c -- ccw hotplug tests
+ tests/qemuhotplugtestdata -- directories refactor
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/qemu/qemu_driver.c | 39 +++-
+ src/qemu/qemu_hotplug.c | 239 ++++++++++++++++++++-
+ src/qemu/qemu_hotplug.h | 6 +
+ tests/qemuhotplugtest.c | 21 ++
+ ...uhotplug-hotplug-base-live+ivshmem-doorbell.xml | 65 ++++++
+ ...plug-hotplug-base-live+ivshmem-plain-detach.xml | 1 +
+ ...qemuhotplug-hotplug-base-live+ivshmem-plain.xml | 1 +
+ .../qemuhotplug-ivshmem-doorbell-detach.xml | 7 +
+ .../qemuhotplug-ivshmem-doorbell.xml | 4 +
+ .../qemuhotplug-ivshmem-plain-detach.xml | 6 +
+ .../qemuhotplug-ivshmem-plain.xml | 3 +
+ ...emuxml2argv-hotplug-base-live+ivshmem-plain.xml | 58 +++++
+ 12 files changed, 445 insertions(+), 5 deletions(-)
+ create mode 100644 tests/qemuhotplugtestdata/qemuhotplug-hotplug-base-live+ivshmem-doorbell.xml
+ create mode 120000 tests/qemuhotplugtestdata/qemuhotplug-hotplug-base-live+ivshmem-plain-detach.xml
+ create mode 120000 tests/qemuhotplugtestdata/qemuhotplug-hotplug-base-live+ivshmem-plain.xml
+ create mode 100644 tests/qemuhotplugtestdata/qemuhotplug-ivshmem-doorbell-detach.xml
+ create mode 100644 tests/qemuhotplugtestdata/qemuhotplug-ivshmem-doorbell.xml
+ create mode 100644 tests/qemuhotplugtestdata/qemuhotplug-ivshmem-plain-detach.xml
+ create mode 100644 tests/qemuhotplugtestdata/qemuhotplug-ivshmem-plain.xml
+ create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-hotplug-base-live+ivshmem-plain.xml
+
+diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
+index 6775327..9b4d54b 100644
+--- a/src/qemu/qemu_driver.c
++++ b/src/qemu/qemu_driver.c
+@@ -7519,6 +7519,15 @@ qemuDomainAttachDeviceLive(virDomainObjPtr vm,
+ dev->data.memory = NULL;
+ break;
+
++ case VIR_DOMAIN_DEVICE_SHMEM:
++ ret = qemuDomainAttachShmemDevice(driver, vm,
++ dev->data.shmem);
++ if (ret < 0) {
++ alias = dev->data.shmem->info.alias;
++ dev->data.shmem = NULL;
++ }
++ break;
++
+ case VIR_DOMAIN_DEVICE_NONE:
+ case VIR_DOMAIN_DEVICE_FS:
+ case VIR_DOMAIN_DEVICE_INPUT:
+@@ -7530,7 +7539,6 @@ qemuDomainAttachDeviceLive(virDomainObjPtr vm,
+ case VIR_DOMAIN_DEVICE_SMARTCARD:
+ case VIR_DOMAIN_DEVICE_MEMBALLOON:
+ case VIR_DOMAIN_DEVICE_NVRAM:
+- case VIR_DOMAIN_DEVICE_SHMEM:
+ case VIR_DOMAIN_DEVICE_TPM:
+ case VIR_DOMAIN_DEVICE_PANIC:
+ case VIR_DOMAIN_DEVICE_IOMMU:
+@@ -7609,6 +7617,9 @@ qemuDomainDetachDeviceLive(virDomainObjPtr vm,
+ case VIR_DOMAIN_DEVICE_MEMORY:
+ ret = qemuDomainDetachMemoryDevice(driver, vm, dev->data.memory);
+ break;
++ case VIR_DOMAIN_DEVICE_SHMEM:
++ ret = qemuDomainDetachShmemDevice(driver, vm, dev->data.shmem);
++ break;
+
+ case VIR_DOMAIN_DEVICE_FS:
+ case VIR_DOMAIN_DEVICE_INPUT:
+@@ -7620,7 +7631,6 @@ qemuDomainDetachDeviceLive(virDomainObjPtr vm,
+ case VIR_DOMAIN_DEVICE_SMARTCARD:
+ case VIR_DOMAIN_DEVICE_MEMBALLOON:
+ case VIR_DOMAIN_DEVICE_NVRAM:
+- case VIR_DOMAIN_DEVICE_SHMEM:
+ case VIR_DOMAIN_DEVICE_REDIRDEV:
+ case VIR_DOMAIN_DEVICE_NONE:
+ case VIR_DOMAIN_DEVICE_TPM:
+@@ -7767,6 +7777,7 @@ qemuDomainAttachDeviceConfig(virDomainDefPtr vmdef,
+ virDomainControllerDefPtr controller;
+ virDomainFSDefPtr fs;
+ virDomainRedirdevDefPtr redirdev;
++ virDomainShmemDefPtr shmem;
+
+ switch ((virDomainDeviceType) dev->type) {
+ case VIR_DOMAIN_DEVICE_DISK:
+@@ -7891,6 +7902,18 @@ qemuDomainAttachDeviceConfig(virDomainDefPtr vmdef,
+ dev->data.redirdev = NULL;
+ break;
+
++ case VIR_DOMAIN_DEVICE_SHMEM:
++ shmem = dev->data.shmem;
++ if (virDomainShmemDefFind(vmdef, shmem) >= 0) {
++ virReportError(VIR_ERR_OPERATION_INVALID, "%s",
++ _("device is already in the domain configuration"));
++ return -1;
++ }
++ if (virDomainShmemDefInsert(vmdef, shmem) < 0)
++ return -1;
++ dev->data.shmem = NULL;
++ break;
++
+ case VIR_DOMAIN_DEVICE_INPUT:
+ case VIR_DOMAIN_DEVICE_SOUND:
+ case VIR_DOMAIN_DEVICE_VIDEO:
+@@ -7900,7 +7923,6 @@ qemuDomainAttachDeviceConfig(virDomainDefPtr vmdef,
+ case VIR_DOMAIN_DEVICE_SMARTCARD:
+ case VIR_DOMAIN_DEVICE_MEMBALLOON:
+ case VIR_DOMAIN_DEVICE_NVRAM:
+- case VIR_DOMAIN_DEVICE_SHMEM:
+ case VIR_DOMAIN_DEVICE_NONE:
+ case VIR_DOMAIN_DEVICE_TPM:
+ case VIR_DOMAIN_DEVICE_PANIC:
+@@ -8047,6 +8069,16 @@ qemuDomainDetachDeviceConfig(virDomainDefPtr vmdef,
+ virDomainRedirdevDefFree(virDomainRedirdevDefRemove(vmdef, idx));
+ break;
+
++ case VIR_DOMAIN_DEVICE_SHMEM:
++ if ((idx = virDomainShmemDefFind(vmdef, dev->data.shmem)) < 0) {
++ virReportError(VIR_ERR_OPERATION_FAILED, "%s",
++ _("matching shmem device was not found"));
++ return -1;
++ }
++
++ virDomainShmemDefFree(virDomainShmemDefRemove(vmdef, idx));
++ break;
++
+
+ case VIR_DOMAIN_DEVICE_INPUT:
+ case VIR_DOMAIN_DEVICE_SOUND:
+@@ -8057,7 +8089,6 @@ qemuDomainDetachDeviceConfig(virDomainDefPtr vmdef,
+ case VIR_DOMAIN_DEVICE_SMARTCARD:
+ case VIR_DOMAIN_DEVICE_MEMBALLOON:
+ case VIR_DOMAIN_DEVICE_NVRAM:
+- case VIR_DOMAIN_DEVICE_SHMEM:
+ case VIR_DOMAIN_DEVICE_NONE:
+ case VIR_DOMAIN_DEVICE_TPM:
+ case VIR_DOMAIN_DEVICE_PANIC:
+diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
+index f038be5..df3764f 100644
+--- a/src/qemu/qemu_hotplug.c
++++ b/src/qemu/qemu_hotplug.c
+@@ -2134,6 +2134,131 @@ qemuDomainAttachHostDevice(virConnectPtr conn,
+ return -1;
+ }
+
++
++int
++qemuDomainAttachShmemDevice(virQEMUDriverPtr driver,
++ virDomainObjPtr vm,
++ virDomainShmemDefPtr shmem)
++{
++ int ret = -1;
++ char *shmstr = NULL;
++ char *charAlias = NULL;
++ char *memAlias = NULL;
++ bool release_backing = false;
++ bool release_address = true;
++ virErrorPtr orig_err = NULL;
++ virJSONValuePtr props = NULL;
++ qemuDomainObjPrivatePtr priv = vm->privateData;
++
++ switch ((virDomainShmemModel)shmem->model) {
++ case VIR_DOMAIN_SHMEM_MODEL_IVSHMEM_PLAIN:
++ case VIR_DOMAIN_SHMEM_MODEL_IVSHMEM_DOORBELL:
++ break;
++
++ case VIR_DOMAIN_SHMEM_MODEL_IVSHMEM:
++ virReportError(VIR_ERR_OPERATION_UNSUPPORTED,
++ _("live attach of shmem model '%s' is not supported"),
++ virDomainShmemModelTypeToString(shmem->model));
++ /* fall-through */
++ case VIR_DOMAIN_SHMEM_MODEL_LAST:
++ return -1;
++ }
++
++ if (qemuAssignDeviceShmemAlias(vm->def, shmem, -1) < 0)
++ return -1;
++
++ if (qemuDomainPrepareShmemChardev(shmem) < 0)
++ return -1;
++
++ if (VIR_REALLOC_N(vm->def->shmems, vm->def->nshmems + 1) < 0)
++ return -1;
++
++ if ((shmem->info.type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_NONE ||
++ shmem->info.type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI) &&
++ (virDomainPCIAddressEnsureAddr(priv->pciaddrs, &shmem->info) < 0))
++ return -1;
++
++ if (!(shmstr = qemuBuildShmemDevStr(vm->def, shmem, priv->qemuCaps)))
++ goto cleanup;
++
++ if (shmem->server.enabled) {
++ if (virAsprintf(&charAlias, "char%s", shmem->info.alias) < 0)
++ goto cleanup;
++ } else {
++ if (!(props = qemuBuildShmemBackendMemProps(shmem)))
++ goto cleanup;
++
++ if (virAsprintf(&memAlias, "shmmem-%s", shmem->info.alias) < 0)
++ goto cleanup;
++ }
++
++ qemuDomainObjEnterMonitor(driver, vm);
++
++ if (shmem->server.enabled) {
++ if (qemuMonitorAttachCharDev(priv->mon, charAlias,
++ &shmem->server.chr) < 0)
++ goto exit_monitor;
++ } else {
++ if (qemuMonitorAddObject(priv->mon, "memory-backend-file",
++ memAlias, props) < 0) {
++ props = NULL;
++ goto exit_monitor;
++ }
++ props = NULL;
++ }
++
++ release_backing = true;
++
++ if (qemuMonitorAddDevice(priv->mon, shmstr) < 0)
++ goto exit_monitor;
++
++ if (qemuDomainObjExitMonitor(driver, vm) < 0) {
++ release_address = false;
++ goto cleanup;
++ }
++
++ /* Doing a copy here just so the pointer doesn't get nullified
++ * because we need it in the audit function */
++ VIR_APPEND_ELEMENT_COPY_INPLACE(vm->def->shmems, vm->def->nshmems, shmem);
++
++ ret = 0;
++ release_address = false;
++
++ audit:
++ virDomainAuditShmem(vm, shmem, "attach", ret == 0);
++
++ cleanup:
++ if (release_address)
++ qemuDomainReleaseDeviceAddress(vm, &shmem->info, NULL);
++
++ virJSONValueFree(props);
++ VIR_FREE(memAlias);
++ VIR_FREE(charAlias);
++ VIR_FREE(shmstr);
++
++ return ret;
++
++ exit_monitor:
++ orig_err = virSaveLastError();
++ if (release_backing) {
++ if (shmem->server.enabled)
++ ignore_value(qemuMonitorDetachCharDev(priv->mon, charAlias));
++ else
++ ignore_value(qemuMonitorDelObject(priv->mon, memAlias));
++ }
++
++ if (orig_err) {
++ virSetError(orig_err);
++ virFreeError(orig_err);
++ }
++
++ if (qemuDomainObjExitMonitor(driver, vm) < 0)
++ release_address = false;
++
++ goto audit;
++}
++
++
+ static int
+ qemuDomainChangeNetBridge(virDomainObjPtr vm,
+ virDomainNetDefPtr olddev,
+@@ -3398,6 +3523,62 @@ qemuDomainRemoveRNGDevice(virQEMUDriverPtr driver,
+ }
+
+
++static int
++qemuDomainRemoveShmemDevice(virQEMUDriverPtr driver,
++ virDomainObjPtr vm,
++ virDomainShmemDefPtr shmem)
++{
++ int rc;
++ int ret = -1;
++ ssize_t idx = -1;
++ char *charAlias = NULL;
++ char *memAlias = NULL;
++ qemuDomainObjPrivatePtr priv = vm->privateData;
++ virObjectEventPtr event = NULL;
++
++ VIR_DEBUG("Removing shmem device %s from domain %p %s",
++ shmem->info.alias, vm, vm->def->name);
++
++ if (shmem->server.enabled) {
++ if (virAsprintf(&charAlias, "char%s", shmem->info.alias) < 0)
++ return -1;
++ } else {
++ if (virAsprintf(&memAlias, "shmmem-%s", shmem->info.alias) < 0)
++ return -1;
++ }
++
++ qemuDomainObjEnterMonitor(driver, vm);
++
++ if (shmem->server.enabled)
++ rc = qemuMonitorDetachCharDev(priv->mon, charAlias);
++ else
++ rc = qemuMonitorDelObject(priv->mon, memAlias);
++
++ if (qemuDomainObjExitMonitor(driver, vm) < 0)
++ goto cleanup;
++
++ virDomainAuditShmem(vm, shmem, "detach", rc == 0);
++
++ if (rc < 0)
++ goto cleanup;
++
++ event = virDomainEventDeviceRemovedNewFromObj(vm, shmem->info.alias);
++ qemuDomainEventQueue(driver, event);
++
++ if ((idx = virDomainShmemDefFind(vm->def, shmem)) >= 0)
++ virDomainShmemDefRemove(vm->def, idx);
++ qemuDomainReleaseDeviceAddress(vm, &shmem->info, NULL);
++ virDomainShmemDefFree(shmem);
++
++ ret = 0;
++ cleanup:
++ VIR_FREE(charAlias);
++ VIR_FREE(memAlias);
++
++ return ret;
++}
++
++
+ int
+ qemuDomainRemoveDevice(virQEMUDriverPtr driver,
+ virDomainObjPtr vm,
+@@ -3429,6 +3610,10 @@ qemuDomainRemoveDevice(virQEMUDriverPtr driver,
+ ret = qemuDomainRemoveMemoryDevice(driver, vm, dev->data.memory);
+ break;
+
++ case VIR_DOMAIN_DEVICE_SHMEM:
++ ret = qemuDomainRemoveShmemDevice(driver, vm, dev->data.shmem);
++ break;
++
+ case VIR_DOMAIN_DEVICE_NONE:
+ case VIR_DOMAIN_DEVICE_LEASE:
+ case VIR_DOMAIN_DEVICE_FS:
+@@ -3442,7 +3627,6 @@ qemuDomainRemoveDevice(virQEMUDriverPtr driver,
+ case VIR_DOMAIN_DEVICE_SMARTCARD:
+ case VIR_DOMAIN_DEVICE_MEMBALLOON:
+ case VIR_DOMAIN_DEVICE_NVRAM:
+- case VIR_DOMAIN_DEVICE_SHMEM:
+ case VIR_DOMAIN_DEVICE_TPM:
+ case VIR_DOMAIN_DEVICE_PANIC:
+ case VIR_DOMAIN_DEVICE_IOMMU:
+@@ -4017,6 +4201,59 @@ int qemuDomainDetachHostDevice(virQEMUDriverPtr driver,
+ return qemuDomainDetachThisHostDevice(driver, vm, detach);
+ }
+
++
++int
++qemuDomainDetachShmemDevice(virQEMUDriverPtr driver,
++ virDomainObjPtr vm,
++ virDomainShmemDefPtr dev)
++{
++ int ret = -1;
++ ssize_t idx = -1;
++ virDomainShmemDefPtr shmem = NULL;
++ qemuDomainObjPrivatePtr priv = vm->privateData;
++
++ if ((idx = virDomainShmemDefFind(vm->def, dev)) < 0) {
++ virReportError(VIR_ERR_OPERATION_INVALID, "%s",
++ _("device not present in domain configuration"));
++ return -1;
++ }
++
++ shmem = vm->def->shmems[idx];
++
++ switch ((virDomainShmemModel)shmem->model) {
++ case VIR_DOMAIN_SHMEM_MODEL_IVSHMEM_PLAIN:
++ case VIR_DOMAIN_SHMEM_MODEL_IVSHMEM_DOORBELL:
++ break;
++
++ case VIR_DOMAIN_SHMEM_MODEL_IVSHMEM:
++ virReportError(VIR_ERR_OPERATION_UNSUPPORTED,
++ _("live detach of shmem model '%s' is not supported"),
++ virDomainShmemModelTypeToString(shmem->model));
++ /* fall-through */
++ case VIR_DOMAIN_SHMEM_MODEL_LAST:
++ return -1;
++ }
++
++ qemuDomainMarkDeviceForRemoval(vm, &shmem->info);
++ qemuDomainObjEnterMonitor(driver, vm);
++
++ ret = qemuMonitorDelDevice(priv->mon, shmem->info.alias);
++
++ if (qemuDomainObjExitMonitor(driver, vm) < 0)
++ ret = -1;
++
++ if (ret == 0) {
++ if ((ret = qemuDomainWaitForDeviceRemoval(vm)) == 1) {
++ qemuDomainReleaseDeviceAddress(vm, &shmem->info, NULL);
++ ret = qemuDomainRemoveShmemDevice(driver, vm, shmem);
++ }
++ }
++ qemuDomainResetDeviceRemoval(vm);
++
++ return ret;
++}
++
++
+ int
+ qemuDomainDetachNetDevice(virQEMUDriverPtr driver,
+ virDomainObjPtr vm,
+diff --git a/src/qemu/qemu_hotplug.h b/src/qemu/qemu_hotplug.h
+index b048cf4..ca54bbd 100644
+--- a/src/qemu/qemu_hotplug.h
++++ b/src/qemu/qemu_hotplug.h
+@@ -50,6 +50,9 @@ int qemuDomainAttachHostDevice(virConnectPtr conn,
+ virQEMUDriverPtr driver,
+ virDomainObjPtr vm,
+ virDomainHostdevDefPtr hostdev);
++int qemuDomainAttachShmemDevice(virQEMUDriverPtr driver,
++ virDomainObjPtr vm,
++ virDomainShmemDefPtr shmem);
+ int qemuDomainFindGraphicsIndex(virDomainDefPtr def,
+ virDomainGraphicsDefPtr dev);
+ int qemuDomainAttachMemory(virQEMUDriverPtr driver,
+@@ -86,6 +89,9 @@ int qemuDomainDetachNetDevice(virQEMUDriverPtr driver,
+ int qemuDomainDetachHostDevice(virQEMUDriverPtr driver,
+ virDomainObjPtr vm,
+ virDomainDeviceDefPtr dev);
++int qemuDomainDetachShmemDevice(virQEMUDriverPtr driver,
++ virDomainObjPtr vm,
++ virDomainShmemDefPtr dev);
+ int qemuDomainAttachLease(virQEMUDriverPtr driver,
+ virDomainObjPtr vm,
+ virDomainLeaseDefPtr lease);
+diff --git a/tests/qemuhotplugtest.c b/tests/qemuhotplugtest.c
+index 07b8091..9a92855 100644
+--- a/tests/qemuhotplugtest.c
++++ b/tests/qemuhotplugtest.c
+@@ -73,6 +73,8 @@ qemuHotplugCreateObjects(virDomainXMLOptionPtr xmlopt,
+
+ virQEMUCapsSet(priv->qemuCaps, QEMU_CAPS_VIRTIO_SCSI);
+ virQEMUCapsSet(priv->qemuCaps, QEMU_CAPS_DEVICE_USB_STORAGE);
++ virQEMUCapsSet(priv->qemuCaps, QEMU_CAPS_DEVICE_IVSHMEM_PLAIN);
++ virQEMUCapsSet(priv->qemuCaps, QEMU_CAPS_DEVICE_IVSHMEM_DOORBELL);
+ if (event)
+ virQEMUCapsSet(priv->qemuCaps, QEMU_CAPS_DEVICE_DEL_EVENT);
+
+@@ -118,6 +120,9 @@ testQemuHotplugAttach(virDomainObjPtr vm,
+ case VIR_DOMAIN_DEVICE_CHR:
+ ret = qemuDomainAttachChrDevice(&driver, vm, dev->data.chr);
+ break;
++ case VIR_DOMAIN_DEVICE_SHMEM:
++ ret = qemuDomainAttachShmemDevice(&driver, vm, dev->data.shmem);
++ break;
+ default:
+ VIR_TEST_VERBOSE("device type '%s' cannot be attached\n",
+ virDomainDeviceTypeToString(dev->type));
+@@ -140,6 +145,9 @@ testQemuHotplugDetach(virDomainObjPtr vm,
+ case VIR_DOMAIN_DEVICE_CHR:
+ ret = qemuDomainDetachChrDevice(&driver, vm, dev->data.chr);
+ break;
++ case VIR_DOMAIN_DEVICE_SHMEM:
++ ret = qemuDomainDetachShmemDevice(&driver, vm, dev->data.shmem);
++ break;
+ default:
+ VIR_TEST_VERBOSE("device type '%s' cannot be detached\n",
+ virDomainDeviceTypeToString(dev->type));
+@@ -602,6 +610,19 @@ mymain(void)
+ "device_del", QMP_OK,
+ "chardev-remove", QMP_OK);
+
++ DO_TEST_ATTACH("hotplug-base-live", "ivshmem-plain", false, true,
++ "object-add", QMP_OK,
++ "device_add", QMP_OK);
++ DO_TEST_ATTACH("hotplug-base-live", "ivshmem-doorbell", false, true,
++ "chardev-add", QMP_OK,
++ "device_add", QMP_OK);
++ DO_TEST_DETACH("hotplug-base-live+ivshmem-plain", "ivshmem-doorbell-detach", false, true,
++ "device_del", QMP_OK,
++ "chardev-remove", QMP_OK);
++ DO_TEST_DETACH("hotplug-base-live", "ivshmem-plain-detach", false, false,
++ "device_del", QMP_OK,
++ "object-del", QMP_OK);
++
+ qemuTestDriverFree(&driver);
+ return (ret == 0) ? EXIT_SUCCESS : EXIT_FAILURE;
+ }
+diff --git a/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base-live+ivshmem-doorbell.xml b/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base-live+ivshmem-doorbell.xml
+new file mode 100644
+index 0000000..8d09fee
+--- /dev/null
++++ b/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base-live+ivshmem-doorbell.xml
+@@ -0,0 +1,65 @@
++<domain type='kvm' id='7'>
++ <name>hotplug</name>
++ <uuid>d091ea82-29e6-2e34-3005-f02617b36e87</uuid>
++ <memory unit='KiB'>4194304</memory>
++ <currentMemory unit='KiB'>4194304</currentMemory>
++ <vcpu placement='static'>4</vcpu>
++ <os>
++ <type arch='x86_64' machine='pc'>hvm</type>
++ <boot dev='hd'/>
++ </os>
++ <features>
++ <acpi/>
++ <apic/>
++ <pae/>
++ </features>
++ <clock offset='utc'/>
++ <on_poweroff>destroy</on_poweroff>
++ <on_reboot>restart</on_reboot>
++ <on_crash>restart</on_crash>
++ <devices>
++ <emulator>/usr/libexec/qemu-kvm</emulator>
++ <controller type='usb' index='0'>
++ <alias name='usb'/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
++ </controller>
++ <controller type='ide' index='0'>
++ <alias name='ide'/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
++ </controller>
++ <controller type='scsi' index='0' model='virtio-scsi'>
++ <alias name='scsi0'/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
++ </controller>
++ <controller type='pci' index='0' model='pci-root'>
++ <alias name='pci'/>
++ </controller>
++ <controller type='virtio-serial' index='0'>
++ <alias name='virtio-serial0'/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
++ </controller>
++ <input type='mouse' bus='ps2'>
++ <alias name='input0'/>
++ </input>
++ <input type='keyboard' bus='ps2'>
++ <alias name='input1'/>
++ </input>
++ <memballoon model='none'>
++ <alias name='balloon0'/>
++ </memballoon>
++ <shmem name='shmem0'>
++ <model type='ivshmem-plain'/>
++ <size unit='M'>4</size>
++ <alias name='shmem0'/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
++ </shmem>
++ <shmem name='shmem1'>
++ <model type='ivshmem-doorbell'/>
++ <server path='/var/lib/libvirt/shmem-shmem1-sock'/>
++ <msi ioeventfd='on'/>
++ <alias name='shmem1'/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
++ </shmem>
++ </devices>
++ <seclabel type='none' model='none'/>
++</domain>
+diff --git a/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base-live+ivshmem-plain-detach.xml b/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base-live+ivshmem-plain-detach.xml
+new file mode 120000
+index 0000000..d5e2051
+--- /dev/null
++++ b/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base-live+ivshmem-plain-detach.xml
+@@ -0,0 +1 @@
++../qemuxml2argvdata/qemuxml2argv-hotplug-base-live.xml
+\ No newline at end of file
+diff --git a/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base-live+ivshmem-plain.xml b/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base-live+ivshmem-plain.xml
+new file mode 120000
+index 0000000..cf27c10
+--- /dev/null
++++ b/tests/qemuhotplugtestdata/qemuhotplug-hotplug-base-live+ivshmem-plain.xml
+@@ -0,0 +1 @@
++../qemuxml2argvdata/qemuxml2argv-hotplug-base-live+ivshmem-plain.xml
+\ No newline at end of file
+diff --git a/tests/qemuhotplugtestdata/qemuhotplug-ivshmem-doorbell-detach.xml b/tests/qemuhotplugtestdata/qemuhotplug-ivshmem-doorbell-detach.xml
+new file mode 100644
+index 0000000..7c06696
+--- /dev/null
++++ b/tests/qemuhotplugtestdata/qemuhotplug-ivshmem-doorbell-detach.xml
+@@ -0,0 +1,7 @@
++<shmem name='shmem1'>
++ <model type='ivshmem-doorbell'/>
++ <server path='/var/lib/libvirt/shmem-shmem1-sock'/>
++ <msi ioeventfd='on'/>
++ <alias name='shmem1'/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
++</shmem>
+diff --git a/tests/qemuhotplugtestdata/qemuhotplug-ivshmem-doorbell.xml b/tests/qemuhotplugtestdata/qemuhotplug-ivshmem-doorbell.xml
+new file mode 100644
+index 0000000..06cb0c9
+--- /dev/null
++++ b/tests/qemuhotplugtestdata/qemuhotplug-ivshmem-doorbell.xml
+@@ -0,0 +1,4 @@
++<shmem name='shmem1'>
++ <model type='ivshmem-doorbell'/>
++ <server/>
++</shmem>
+diff --git a/tests/qemuhotplugtestdata/qemuhotplug-ivshmem-plain-detach.xml b/tests/qemuhotplugtestdata/qemuhotplug-ivshmem-plain-detach.xml
+new file mode 100644
+index 0000000..68f592f
+--- /dev/null
++++ b/tests/qemuhotplugtestdata/qemuhotplug-ivshmem-plain-detach.xml
+@@ -0,0 +1,6 @@
++<shmem name='shmem0'>
++ <model type='ivshmem-plain'/>
++ <size unit='M'>4</size>
++ <alias name='shmem0'/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
++</shmem>
+diff --git a/tests/qemuhotplugtestdata/qemuhotplug-ivshmem-plain.xml b/tests/qemuhotplugtestdata/qemuhotplug-ivshmem-plain.xml
+new file mode 100644
+index 0000000..6bd96ff
+--- /dev/null
++++ b/tests/qemuhotplugtestdata/qemuhotplug-ivshmem-plain.xml
+@@ -0,0 +1,3 @@
++<shmem name='shmem0'>
++ <model type='ivshmem-plain'/>
++</shmem>
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-hotplug-base-live+ivshmem-plain.xml b/tests/qemuxml2argvdata/qemuxml2argv-hotplug-base-live+ivshmem-plain.xml
+new file mode 100644
+index 0000000..ac3fa4f
+--- /dev/null
++++ b/tests/qemuxml2argvdata/qemuxml2argv-hotplug-base-live+ivshmem-plain.xml
+@@ -0,0 +1,58 @@
++<domain type='kvm' id='7'>
++ <name>hotplug</name>
++ <uuid>d091ea82-29e6-2e34-3005-f02617b36e87</uuid>
++ <memory unit='KiB'>4194304</memory>
++ <currentMemory unit='KiB'>4194304</currentMemory>
++ <vcpu placement='static'>4</vcpu>
++ <os>
++ <type arch='x86_64' machine='pc'>hvm</type>
++ <boot dev='hd'/>
++ </os>
++ <features>
++ <acpi/>
++ <apic/>
++ <pae/>
++ </features>
++ <clock offset='utc'/>
++ <on_poweroff>destroy</on_poweroff>
++ <on_reboot>restart</on_reboot>
++ <on_crash>restart</on_crash>
++ <devices>
++ <emulator>/usr/libexec/qemu-kvm</emulator>
++ <controller type='usb' index='0'>
++ <alias name='usb'/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
++ </controller>
++ <controller type='ide' index='0'>
++ <alias name='ide'/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
++ </controller>
++ <controller type='scsi' index='0' model='virtio-scsi'>
++ <alias name='scsi0'/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
++ </controller>
++ <controller type='pci' index='0' model='pci-root'>
++ <alias name='pci'/>
++ </controller>
++ <controller type='virtio-serial' index='0'>
++ <alias name='virtio-serial0'/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
++ </controller>
++ <input type='mouse' bus='ps2'>
++ <alias name='input0'/>
++ </input>
++ <input type='keyboard' bus='ps2'>
++ <alias name='input1'/>
++ </input>
++ <memballoon model='none'>
++ <alias name='balloon0'/>
++ </memballoon>
++ <shmem name='shmem0'>
++ <model type='ivshmem-plain'/>
++ <size unit='M'>4</size>
++ <alias name='shmem0'/>
++ <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
++ </shmem>
++ </devices>
++ <seclabel type='none' model='none'/>
++</domain>
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-qemu-Disable-migration-with-ivshmem.patch b/SOURCES/libvirt-qemu-Disable-migration-with-ivshmem.patch
new file mode 100644
index 0000000..d99fad8
--- /dev/null
+++ b/SOURCES/libvirt-qemu-Disable-migration-with-ivshmem.patch
@@ -0,0 +1,40 @@
+From 4eefdf0995c1ce440f51da22906e5f761a9a9c72 Mon Sep 17 00:00:00 2001
+Message-Id: <4eefdf0995c1ce440f51da22906e5f761a9a9c72@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:48 +0100
+Subject: [PATCH] qemu: Disable migration with ivshmem
+
+It was never safe anyway and as such shouldn't have been enabled in the
+first place. Future patches will allow hot-(un)pluging of some ivshmem
+devices as a workaround.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit d17fab69be7a73336d388b805c282037ffb29647)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/qemu/qemu_migration.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c
+index 496a3f1..545ed1c 100644
+--- a/src/qemu/qemu_migration.c
++++ b/src/qemu/qemu_migration.c
+@@ -2350,6 +2350,12 @@ qemuMigrationIsAllowed(virQEMUDriverPtr driver,
+ return false;
+ }
+ }
++
++ if (vm->def->nshmems) {
++ virReportError(VIR_ERR_OPERATION_INVALID, "%s",
++ _("migration with shmem device is not supported"));
++ return false;
++ }
+ }
+
+ return true;
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-qemu-Fix-double-free-when-live-attaching-shmem.patch b/SOURCES/libvirt-qemu-Fix-double-free-when-live-attaching-shmem.patch
new file mode 100644
index 0000000..812199f
--- /dev/null
+++ b/SOURCES/libvirt-qemu-Fix-double-free-when-live-attaching-shmem.patch
@@ -0,0 +1,35 @@
+From c70aca8e3aa358b5451d5b0d45bf6802ceb9ad94 Mon Sep 17 00:00:00 2001
+Message-Id: <c70aca8e3aa358b5451d5b0d45bf6802ceb9ad94@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Thu, 10 Nov 2016 10:16:58 +0100
+Subject: [PATCH] qemu: Fix double free when live-attaching shmem
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Function qemuDomainAttachShmemDevice() steals the device data if the
+hotplug was successful, but the condition checked for unsuccessful
+execution otherwise.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit cca34e38fd32dbafa2c647f41a7dfb30d1e2e0a9)
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/qemu/qemu_driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
+index 9b4d54b..1e02a7f 100644
+--- a/src/qemu/qemu_driver.c
++++ b/src/qemu/qemu_driver.c
+@@ -7522,7 +7522,7 @@ qemuDomainAttachDeviceLive(virDomainObjPtr vm,
+ case VIR_DOMAIN_DEVICE_SHMEM:
+ ret = qemuDomainAttachShmemDevice(driver, vm,
+ dev->data.shmem);
+- if (ret < 0) {
++ if (!ret) {
+ alias = dev->data.shmem->info.alias;
+ dev->data.shmem = NULL;
+ }
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-qemu-Make-qemuBuildShmemDevStr-static.patch b/SOURCES/libvirt-qemu-Make-qemuBuildShmemDevStr-static.patch
new file mode 100644
index 0000000..1bfe243
--- /dev/null
+++ b/SOURCES/libvirt-qemu-Make-qemuBuildShmemDevStr-static.patch
@@ -0,0 +1,50 @@
+From 93fc1569d49857d0cfc28b24c29b9e1f3dc94a01 Mon Sep 17 00:00:00 2001
+Message-Id: <93fc1569d49857d0cfc28b24c29b9e1f3dc94a01@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:37 +0100
+Subject: [PATCH] qemu: Make qemuBuildShmemDevStr static
+
+It isn't used anywhere else.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit c7e0a6a667de26c86910c6b1c65810b6762fdd05)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/qemu/qemu_command.c | 2 +-
+ src/qemu/qemu_command.h | 4 ----
+ 2 files changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
+index 7abe213..4b08b81 100644
+--- a/src/qemu/qemu_command.c
++++ b/src/qemu/qemu_command.c
+@@ -8456,7 +8456,7 @@ qemuBuildSmartcardCommandLine(virLogManagerPtr logManager,
+ }
+
+
+-char *
++static char *
+ qemuBuildShmemDevStr(virDomainDefPtr def,
+ virDomainShmemDefPtr shmem,
+ virQEMUCapsPtr qemuCaps)
+diff --git a/src/qemu/qemu_command.h b/src/qemu/qemu_command.h
+index 36cfc51..7f33d83 100644
+--- a/src/qemu/qemu_command.h
++++ b/src/qemu/qemu_command.h
+@@ -143,10 +143,6 @@ int qemuBuildRNGBackendProps(virDomainRNGDefPtr rng,
+ const char **type,
+ virJSONValuePtr *props);
+
+-char *qemuBuildShmemDevStr(virDomainDefPtr def,
+- virDomainShmemDefPtr shmem,
+- virQEMUCapsPtr qemuCaps);
+-
+ int qemuOpenPCIConfig(virDomainHostdevDefPtr dev);
+
+ /* Current, best practice */
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-qemu-Make-sure-shmem-memory-is-shared.patch b/SOURCES/libvirt-qemu-Make-sure-shmem-memory-is-shared.patch
new file mode 100644
index 0000000..39afc25
--- /dev/null
+++ b/SOURCES/libvirt-qemu-Make-sure-shmem-memory-is-shared.patch
@@ -0,0 +1,55 @@
+From fda2c7a3be95b163c88132fe98ce19e2e624aa02 Mon Sep 17 00:00:00 2001
+Message-Id: <fda2c7a3be95b163c88132fe98ce19e2e624aa02@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Thu, 10 Nov 2016 10:16:59 +0100
+Subject: [PATCH] qemu: Make sure shmem memory is shared
+
+Even though using /dev/shm/asdf as the backend, we still need to make
+the mapping shared. The original patch forgot to add that parameter.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit 5672a265ce061827595be2270f29e8eb920313bd)
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/qemu/qemu_command.c | 1 +
+ tests/qemuxml2argvdata/qemuxml2argv-shmem-plain-doorbell.args | 6 +++---
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
+index dd8f60f..43e1a93 100644
+--- a/src/qemu/qemu_command.c
++++ b/src/qemu/qemu_command.c
+@@ -8580,6 +8580,7 @@ qemuBuildShmemBackendMemProps(virDomainShmemDefPtr shmem)
+ virJSONValueObjectCreate(&ret,
+ "s:mem-path", mem_path,
+ "U:size", shmem->size,
++ "b:share", true,
+ NULL);
+
+ VIR_FREE(mem_path);
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-shmem-plain-doorbell.args b/tests/qemuxml2argvdata/qemuxml2argv-shmem-plain-doorbell.args
+index 7abc7f8..688b7c7 100644
+--- a/tests/qemuxml2argvdata/qemuxml2argv-shmem-plain-doorbell.args
++++ b/tests/qemuxml2argvdata/qemuxml2argv-shmem-plain-doorbell.args
+@@ -18,13 +18,13 @@ QEMU_AUDIO_DRV=none \
+ -boot c \
+ -usb \
+ -object memory-backend-file,id=shmmem-shmem0,mem-path=/dev/shm/shmem0,\
+-size=4194304 \
++size=4194304,share=yes \
+ -device ivshmem-plain,id=shmem0,memdev=shmmem-shmem0,bus=pci.0,addr=0x3 \
+ -object memory-backend-file,id=shmmem-shmem1,mem-path=/dev/shm/shmem1,\
+-size=134217728 \
++size=134217728,share=yes \
+ -device ivshmem-plain,id=shmem1,memdev=shmmem-shmem1,bus=pci.0,addr=0x5 \
+ -object memory-backend-file,id=shmmem-shmem2,mem-path=/dev/shm/shmem2,\
+-size=268435456 \
++size=268435456,share=yes \
+ -device ivshmem-plain,id=shmem2,memdev=shmmem-shmem2,bus=pci.0,addr=0x4 \
+ -device ivshmem-doorbell,id=shmem3,chardev=charshmem3,ioeventfd=on,bus=pci.0,\
+ addr=0x6 \
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-qemu-Move-common-checks-outside-qemuBuildShmemDevLegacyStr.patch b/SOURCES/libvirt-qemu-Move-common-checks-outside-qemuBuildShmemDevLegacyStr.patch
new file mode 100644
index 0000000..de5646c
--- /dev/null
+++ b/SOURCES/libvirt-qemu-Move-common-checks-outside-qemuBuildShmemDevLegacyStr.patch
@@ -0,0 +1,105 @@
+From 5a9b62b909200f231a70331d1848c983046f4fc7 Mon Sep 17 00:00:00 2001
+Message-Id: <5a9b62b909200f231a70331d1848c983046f4fc7@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:39 +0100
+Subject: [PATCH] qemu: Move common checks outside qemuBuildShmemDevLegacyStr
+
+Some checks will need to be performed for newer device types as well, so
+let's not duplicate them.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit 9187cecc8170cbb5230d6d9787ad97edc8a07c06)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/qemu/qemu_command.c | 54 +++++++++++++++++++++++++------------------------
+ 1 file changed, 28 insertions(+), 26 deletions(-)
+
+diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
+index a3c9c7a..6eafa5e 100644
+--- a/src/qemu/qemu_command.c
++++ b/src/qemu/qemu_command.c
+@@ -8467,29 +8467,12 @@ qemuBuildShmemDevLegacyStr(virDomainDefPtr def,
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+ _("ivshmem device is not supported "
+ "with this QEMU binary"));
+- goto error;
++ return NULL;
+ }
+
+ virBufferAddLit(&buf, "ivshmem");
+- if (shmem->size) {
+- /*
+- * Thanks to our parsing code, we have a guarantee that the
+- * size is power of two and is at least a mebibyte in size.
+- * But because it may change in the future, the checks are
+- * doubled in here.
+- */
+- if (shmem->size & (shmem->size - 1)) {
+- virReportError(VIR_ERR_XML_ERROR, "%s",
+- _("shmem size must be a power of two"));
+- goto error;
+- }
+- if (shmem->size < 1024 * 1024) {
+- virReportError(VIR_ERR_XML_ERROR, "%s",
+- _("shmem size must be at least 1 MiB (1024 KiB)"));
+- goto error;
+- }
++ if (shmem->size)
+ virBufferAsprintf(&buf, ",size=%llum", shmem->size >> 20);
+- }
+
+ if (!shmem->server.enabled) {
+ virBufferAsprintf(&buf, ",shm=%s,id=%s", shmem->name, shmem->info.alias);
+@@ -8505,13 +8488,6 @@ qemuBuildShmemDevLegacyStr(virDomainDefPtr def,
+ }
+ }
+
+- if (shmem->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI) {
+- virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+- _("only 'pci' addresses are supported for the "
+- "shared memory device"));
+- goto error;
+- }
+-
+ if (qemuBuildDeviceAddressStr(&buf, def, &shmem->info, qemuCaps) < 0)
+ goto error;
+
+@@ -8558,6 +8534,32 @@ qemuBuildShmemCommandLine(virLogManagerPtr logManager,
+ {
+ char *devstr = NULL;
+
++ if (shmem->size) {
++ /*
++ * Thanks to our parsing code, we have a guarantee that the
++ * size is power of two and is at least a mebibyte in size.
++ * But because it may change in the future, the checks are
++ * doubled in here.
++ */
++ if (shmem->size & (shmem->size - 1)) {
++ virReportError(VIR_ERR_XML_ERROR, "%s",
++ _("shmem size must be a power of two"));
++ return -1;
++ }
++ if (shmem->size < 1024 * 1024) {
++ virReportError(VIR_ERR_XML_ERROR, "%s",
++ _("shmem size must be at least 1 MiB (1024 KiB)"));
++ return -1;
++ }
++ }
++
++ if (shmem->info.type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI) {
++ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
++ _("only 'pci' addresses are supported for the "
++ "shared memory device"));
++ return -1;
++ }
++
+ if (!(devstr = qemuBuildShmemDevLegacyStr(def, shmem, qemuCaps)))
+ return -1;
+ virCommandAddArgList(cmd, "-device", devstr, NULL);
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-qemu-Rename-qemuBuildShmemBackendStr-to-qemuBuildShmemBackendChrStr.patch b/SOURCES/libvirt-qemu-Rename-qemuBuildShmemBackendStr-to-qemuBuildShmemBackendChrStr.patch
new file mode 100644
index 0000000..0696e0a
--- /dev/null
+++ b/SOURCES/libvirt-qemu-Rename-qemuBuildShmemBackendStr-to-qemuBuildShmemBackendChrStr.patch
@@ -0,0 +1,56 @@
+From 2479f664481c9c512b3fb2da21aeaac37f53d584 Mon Sep 17 00:00:00 2001
+Message-Id: <2479f664481c9c512b3fb2da21aeaac37f53d584@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:42 +0100
+Subject: [PATCH] qemu: Rename qemuBuildShmemBackendStr to
+ qemuBuildShmemBackendChrStr
+
+There will be more backends in the future so let's not complicate it.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit a0c99e1a0aadbc4ed7e1670d63e29e49b8a7a67a)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/qemu/qemu_command.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
+index adb743b..e668a58 100644
+--- a/src/qemu/qemu_command.c
++++ b/src/qemu/qemu_command.c
+@@ -8504,12 +8504,12 @@ qemuBuildShmemDevLegacyStr(virDomainDefPtr def,
+ }
+
+ static char *
+-qemuBuildShmemBackendStr(virLogManagerPtr logManager,
+- virCommandPtr cmd,
+- virQEMUDriverConfigPtr cfg,
+- virDomainDefPtr def,
+- virDomainShmemDefPtr shmem,
+- virQEMUCapsPtr qemuCaps)
++qemuBuildShmemBackendChrStr(virLogManagerPtr logManager,
++ virCommandPtr cmd,
++ virQEMUDriverConfigPtr cfg,
++ virDomainDefPtr def,
++ virDomainShmemDefPtr shmem,
++ virQEMUCapsPtr qemuCaps)
+ {
+ char *devstr = NULL;
+
+@@ -8565,8 +8565,8 @@ qemuBuildShmemCommandLine(virLogManagerPtr logManager,
+ VIR_FREE(devstr);
+
+ if (shmem->server.enabled) {
+- if (!(devstr = qemuBuildShmemBackendStr(logManager, cmd, cfg, def,
+- shmem, qemuCaps)))
++ if (!(devstr = qemuBuildShmemBackendChrStr(logManager, cmd, cfg, def,
++ shmem, qemuCaps)))
+ return -1;
+
+ virCommandAddArgList(cmd, "-chardev", devstr, NULL);
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-qemu-Rename-qemuBuildShmemDevStr-to-qemuBuildShmemDevLegacyStr.patch b/SOURCES/libvirt-qemu-Rename-qemuBuildShmemDevStr-to-qemuBuildShmemDevLegacyStr.patch
new file mode 100644
index 0000000..9d97180
--- /dev/null
+++ b/SOURCES/libvirt-qemu-Rename-qemuBuildShmemDevStr-to-qemuBuildShmemDevLegacyStr.patch
@@ -0,0 +1,48 @@
+From e45e5fbf470bc13beada6c5c3f6027b2af3666dd Mon Sep 17 00:00:00 2001
+Message-Id: <e45e5fbf470bc13beada6c5c3f6027b2af3666dd@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:38 +0100
+Subject: [PATCH] qemu: Rename qemuBuildShmemDevStr to
+ qemuBuildShmemDevLegacyStr
+
+This will make sense after adding support for newer device types.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit bf854ae3f1e47773d9ea0692e9f056629ac9cde4)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/qemu/qemu_command.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
+index 4b08b81..a3c9c7a 100644
+--- a/src/qemu/qemu_command.c
++++ b/src/qemu/qemu_command.c
+@@ -8457,9 +8457,9 @@ qemuBuildSmartcardCommandLine(virLogManagerPtr logManager,
+
+
+ static char *
+-qemuBuildShmemDevStr(virDomainDefPtr def,
+- virDomainShmemDefPtr shmem,
+- virQEMUCapsPtr qemuCaps)
++qemuBuildShmemDevLegacyStr(virDomainDefPtr def,
++ virDomainShmemDefPtr shmem,
++ virQEMUCapsPtr qemuCaps)
+ {
+ virBuffer buf = VIR_BUFFER_INITIALIZER;
+
+@@ -8558,7 +8558,7 @@ qemuBuildShmemCommandLine(virLogManagerPtr logManager,
+ {
+ char *devstr = NULL;
+
+- if (!(devstr = qemuBuildShmemDevStr(def, shmem, qemuCaps)))
++ if (!(devstr = qemuBuildShmemDevLegacyStr(def, shmem, qemuCaps)))
+ return -1;
+ virCommandAddArgList(cmd, "-device", devstr, NULL);
+ VIR_FREE(devstr);
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-qemu-Reorder-shmem-params-nicely.patch b/SOURCES/libvirt-qemu-Reorder-shmem-params-nicely.patch
new file mode 100644
index 0000000..e23b925
--- /dev/null
+++ b/SOURCES/libvirt-qemu-Reorder-shmem-params-nicely.patch
@@ -0,0 +1,77 @@
+From 8e8e5451fc4c34fd3bb30a193be8499d5148898f Mon Sep 17 00:00:00 2001
+Message-Id: <8e8e5451fc4c34fd3bb30a193be8499d5148898f@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:40 +0100
+Subject: [PATCH] qemu: Reorder shmem params nicely
+
+Always format id first so that we don't need to do that twice in
+different code paths.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit 6b5622e4b546eb0d0169b7f07ad3dae7a6560a35)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/qemu/qemu_command.c | 6 ++++--
+ tests/qemuxml2argvdata/qemuxml2argv-shmem.args | 16 ++++++++--------
+ 2 files changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
+index 6eafa5e..3ebfe84 100644
+--- a/src/qemu/qemu_command.c
++++ b/src/qemu/qemu_command.c
+@@ -8471,13 +8471,15 @@ qemuBuildShmemDevLegacyStr(virDomainDefPtr def,
+ }
+
+ virBufferAddLit(&buf, "ivshmem");
++ virBufferAsprintf(&buf, ",id=%s", shmem->info.alias);
++
+ if (shmem->size)
+ virBufferAsprintf(&buf, ",size=%llum", shmem->size >> 20);
+
+ if (!shmem->server.enabled) {
+- virBufferAsprintf(&buf, ",shm=%s,id=%s", shmem->name, shmem->info.alias);
++ virBufferAsprintf(&buf, ",shm=%s", shmem->name);
+ } else {
+- virBufferAsprintf(&buf, ",chardev=char%s,id=%s", shmem->info.alias, shmem->info.alias);
++ virBufferAsprintf(&buf, ",chardev=char%s", shmem->info.alias);
+ if (shmem->msi.enabled) {
+ virBufferAddLit(&buf, ",msi=on");
+ if (shmem->msi.vectors)
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-shmem.args b/tests/qemuxml2argvdata/qemuxml2argv-shmem.args
+index 89caf49..99fac11 100644
+--- a/tests/qemuxml2argvdata/qemuxml2argv-shmem.args
++++ b/tests/qemuxml2argvdata/qemuxml2argv-shmem.args
+@@ -17,19 +17,19 @@ QEMU_AUDIO_DRV=none \
+ -no-acpi \
+ -boot c \
+ -usb \
+--device ivshmem,shm=shmem0,id=shmem0,bus=pci.0,addr=0x3 \
+--device ivshmem,size=128m,shm=shmem1,id=shmem1,bus=pci.0,addr=0x5 \
+--device ivshmem,size=256m,shm=shmem2,id=shmem2,bus=pci.0,addr=0x4 \
+--device ivshmem,size=512m,chardev=charshmem3,id=shmem3,bus=pci.0,addr=0x6 \
++-device ivshmem,id=shmem0,shm=shmem0,bus=pci.0,addr=0x3 \
++-device ivshmem,id=shmem1,size=128m,shm=shmem1,bus=pci.0,addr=0x5 \
++-device ivshmem,id=shmem2,size=256m,shm=shmem2,bus=pci.0,addr=0x4 \
++-device ivshmem,id=shmem3,size=512m,chardev=charshmem3,bus=pci.0,addr=0x6 \
+ -chardev socket,id=charshmem3,path=/var/lib/libvirt/shmem-shmem3-sock \
+--device ivshmem,size=1024m,chardev=charshmem4,id=shmem4,bus=pci.0,addr=0x7 \
++-device ivshmem,id=shmem4,size=1024m,chardev=charshmem4,bus=pci.0,addr=0x7 \
+ -chardev socket,id=charshmem4,path=/tmp/shmem4-sock \
+--device ivshmem,size=2048m,chardev=charshmem5,id=shmem5,msi=on,ioeventfd=off,\
++-device ivshmem,id=shmem5,size=2048m,chardev=charshmem5,msi=on,ioeventfd=off,\
+ bus=pci.0,addr=0x8 \
+ -chardev socket,id=charshmem5,path=/tmp/shmem5-sock \
+--device ivshmem,size=4096m,chardev=charshmem6,id=shmem6,msi=on,vectors=16,\
++-device ivshmem,id=shmem6,size=4096m,chardev=charshmem6,msi=on,vectors=16,\
+ bus=pci.0,addr=0x9 \
+ -chardev socket,id=charshmem6,path=/tmp/shmem6-sock \
+--device ivshmem,size=8192m,chardev=charshmem7,id=shmem7,msi=on,vectors=32,\
++-device ivshmem,id=shmem7,size=8192m,chardev=charshmem7,msi=on,vectors=32,\
+ ioeventfd=on,bus=pci.0,addr=0xa \
+ -chardev socket,id=charshmem7,path=/tmp/shmem7-sock
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-qemu-Reset-post-copy-capability-after-migration.patch b/SOURCES/libvirt-qemu-Reset-post-copy-capability-after-migration.patch
new file mode 100644
index 0000000..eb35268
--- /dev/null
+++ b/SOURCES/libvirt-qemu-Reset-post-copy-capability-after-migration.patch
@@ -0,0 +1,42 @@
+From db226bbecedc7873a71f202fd01c24ba086235f1 Mon Sep 17 00:00:00 2001
+Message-Id: <db226bbecedc7873a71f202fd01c24ba086235f1@dist-git>
+From: Jiri Denemark <jdenemar@redhat.com>
+Date: Wed, 2 Nov 2016 14:20:42 +0100
+Subject: [PATCH] qemu: Reset post-copy capability after migration
+
+Unlike other migration capabilities, post-copy is also set on the
+destination host which means it doesn't disappear once domain is
+migrated. As a result of that other functionality which internally uses
+migration to a file (virDomainManagedSave, virDomainSave,
+virDomainCoreDump) may fail after migration because the post-copy
+capability is still set.
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1374718
+
+Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
+(cherry picked from commit fe1dd39087ae9a49888bc72dee38ff0e6f639693)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392030
+
+Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
+---
+ src/qemu/qemu_migration.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c
+index 7426bfd..496a3f1 100644
+--- a/src/qemu/qemu_migration.c
++++ b/src/qemu/qemu_migration.c
+@@ -6401,6 +6401,9 @@ qemuMigrationFinish(virQEMUDriverPtr driver,
+ */
+ if (inPostCopy)
+ VIR_FREE(priv->job.completed);
++
++ qemuMigrationSetPostCopy(driver, vm, false,
++ QEMU_ASYNC_JOB_MIGRATION_IN);
+ }
+
+ qemuMigrationJobFinish(driver, vm);
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-qemu-Save-various-defaults-for-shmem.patch b/SOURCES/libvirt-qemu-Save-various-defaults-for-shmem.patch
new file mode 100644
index 0000000..2beb98d
--- /dev/null
+++ b/SOURCES/libvirt-qemu-Save-various-defaults-for-shmem.patch
@@ -0,0 +1,165 @@
+From 0f6a07209863beec18fb907b293531bd6c61f5d5 Mon Sep 17 00:00:00 2001
+Message-Id: <0f6a07209863beec18fb907b293531bd6c61f5d5@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:52 +0100
+Subject: [PATCH] qemu: Save various defaults for shmem
+
+We're keeping some things at default and that's not something we want to
+do intentionally. Let's save some sensible defaults upfront in order to
+avoid having problems later. The details for the defaults (of the newer
+implementation) can be found in qemu's commit 5400c02b90bb:
+
+ http://git.qemu.org/?p=qemu.git;a=commit;h=5400c02b90bb
+
+Since we are merely saving the defaults it will not change the guest ABI
+and thanks to the fact that we're doing it in the PostParse callback it
+will not break the ABI stability checks.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit acf0ec024a220364c4a6a94996c82875c6d1ba13)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/qemu/qemu_domain.c | 54 ++++++++++++++++++++++
+ tests/qemuxml2argvdata/qemuxml2argv-shmem.args | 2 +-
+ .../qemuxml2xmlout-shmem-plain-doorbell.xml | 5 +-
+ tests/qemuxml2xmloutdata/qemuxml2xmlout-shmem.xml | 1 +
+ 4 files changed, 60 insertions(+), 2 deletions(-)
+
+diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
+index 4f99c14..3d2650f 100644
+--- a/src/qemu/qemu_domain.c
++++ b/src/qemu/qemu_domain.c
+@@ -2544,6 +2544,56 @@ qemuDomainChrDefDropDefaultPath(virDomainChrDefPtr chr,
+
+
+ static int
++qemuDomainShmemDefPostParse(virDomainShmemDefPtr shm)
++{
++ /* This was the default since the introduction of this device. */
++ if (shm->model != VIR_DOMAIN_SHMEM_MODEL_IVSHMEM_DOORBELL && !shm->size)
++ shm->size = 4 << 20;
++
++ /* Nothing more to check/change for IVSHMEM */
++ if (shm->model == VIR_DOMAIN_SHMEM_MODEL_IVSHMEM)
++ return 0;
++
++ if (!shm->server.enabled) {
++ if (shm->model == VIR_DOMAIN_SHMEM_MODEL_IVSHMEM_DOORBELL) {
++ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
++ _("shmem model '%s' is supported "
++ "only with server option enabled"),
++ virDomainShmemModelTypeToString(shm->model));
++ return -1;
++ }
++
++ if (shm->msi.enabled) {
++ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
++ _("shmem model '%s' doesn't support "
++ "msi"),
++ virDomainShmemModelTypeToString(shm->model));
++ }
++ } else {
++ if (shm->model == VIR_DOMAIN_SHMEM_MODEL_IVSHMEM_PLAIN) {
++ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
++ _("shmem model '%s' is supported "
++ "only with server option disabled"),
++ virDomainShmemModelTypeToString(shm->model));
++ return -1;
++ }
++
++ if (shm->size) {
++ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
++ _("shmem model '%s' does not support size setting"),
++ virDomainShmemModelTypeToString(shm->model));
++ return -1;
++ }
++ shm->msi.enabled = true;
++ if (!shm->msi.ioeventfd)
++ shm->msi.ioeventfd = VIR_TRISTATE_SWITCH_ON;
++ }
++
++ return 0;
++}
++
++
++static int
+ qemuDomainDeviceDefPostParse(virDomainDeviceDefPtr dev,
+ const virDomainDef *def,
+ virCapsPtr caps ATTRIBUTE_UNUSED,
+@@ -2708,6 +2758,10 @@ qemuDomainDeviceDefPostParse(virDomainDeviceDefPtr dev,
+ }
+ }
+
++ if (dev->type == VIR_DOMAIN_DEVICE_SHMEM &&
++ qemuDomainShmemDefPostParse(dev->data.shmem) < 0)
++ goto cleanup;
++
+ ret = 0;
+
+ cleanup:
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-shmem.args b/tests/qemuxml2argvdata/qemuxml2argv-shmem.args
+index 99fac11..bdf660a 100644
+--- a/tests/qemuxml2argvdata/qemuxml2argv-shmem.args
++++ b/tests/qemuxml2argvdata/qemuxml2argv-shmem.args
+@@ -17,7 +17,7 @@ QEMU_AUDIO_DRV=none \
+ -no-acpi \
+ -boot c \
+ -usb \
+--device ivshmem,id=shmem0,shm=shmem0,bus=pci.0,addr=0x3 \
++-device ivshmem,id=shmem0,size=4m,shm=shmem0,bus=pci.0,addr=0x3 \
+ -device ivshmem,id=shmem1,size=128m,shm=shmem1,bus=pci.0,addr=0x5 \
+ -device ivshmem,id=shmem2,size=256m,shm=shmem2,bus=pci.0,addr=0x4 \
+ -device ivshmem,id=shmem3,size=512m,chardev=charshmem3,bus=pci.0,addr=0x6 \
+diff --git a/tests/qemuxml2xmloutdata/qemuxml2xmlout-shmem-plain-doorbell.xml b/tests/qemuxml2xmloutdata/qemuxml2xmlout-shmem-plain-doorbell.xml
+index ab9c69b..7872e1c 100644
+--- a/tests/qemuxml2xmloutdata/qemuxml2xmlout-shmem-plain-doorbell.xml
++++ b/tests/qemuxml2xmloutdata/qemuxml2xmlout-shmem-plain-doorbell.xml
+@@ -23,6 +23,7 @@
+ <memballoon model='none'/>
+ <shmem name='shmem0'>
+ <model type='ivshmem-plain'/>
++ <size unit='M'>4</size>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
+ </shmem>
+ <shmem name='shmem1'>
+@@ -38,11 +39,13 @@
+ <shmem name='shmem3'>
+ <model type='ivshmem-doorbell'/>
+ <server/>
++ <msi ioeventfd='on'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
+ </shmem>
+ <shmem name='shmem4'>
+ <model type='ivshmem-doorbell'/>
+ <server path='/tmp/shmem4-sock'/>
++ <msi ioeventfd='on'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
+ </shmem>
+ <shmem name='shmem5'>
+@@ -54,7 +57,7 @@
+ <shmem name='shmem6'>
+ <model type='ivshmem-doorbell'/>
+ <server path='/tmp/shmem6-sock'/>
+- <msi vectors='16'/>
++ <msi vectors='16' ioeventfd='on'/>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x09' function='0x0'/>
+ </shmem>
+ <shmem name='shmem7'>
+diff --git a/tests/qemuxml2xmloutdata/qemuxml2xmlout-shmem.xml b/tests/qemuxml2xmloutdata/qemuxml2xmlout-shmem.xml
+index 5602913..04b463a 100644
+--- a/tests/qemuxml2xmloutdata/qemuxml2xmlout-shmem.xml
++++ b/tests/qemuxml2xmloutdata/qemuxml2xmlout-shmem.xml
+@@ -23,6 +23,7 @@
+ <memballoon model='none'/>
+ <shmem name='shmem0'>
+ <model type='ivshmem'/>
++ <size unit='M'>4</size>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
+ </shmem>
+ <shmem name='shmem1'>
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-qemu-Support-newer-ivshmem-device-variants.patch b/SOURCES/libvirt-qemu-Support-newer-ivshmem-device-variants.patch
new file mode 100644
index 0000000..1411765
--- /dev/null
+++ b/SOURCES/libvirt-qemu-Support-newer-ivshmem-device-variants.patch
@@ -0,0 +1,239 @@
+From e168fd982d20f1d68d13b210606f646ec937b678 Mon Sep 17 00:00:00 2001
+Message-Id: <e168fd982d20f1d68d13b210606f646ec937b678@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:53 +0100
+Subject: [PATCH] qemu: Support newer ivshmem device variants
+
+QEMU added support for ivshmem-plain and ivshmem-doorbell. Those are
+reworked varians of legacy ivshmem that are compatible from the guest
+POV, but not from host's POV and have sane specification and handling.
+
+Details about the newer device type can be found in qemu's commit
+5400c02b90bb:
+
+ http://git.qemu.org/?p=qemu.git;a=commit;h=5400c02b90bb
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit 06524fd52c74a4fc672e9eec2b5a13d540e7ee06)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ src/qemu/qemu_command.c | 99 +++++++++++++++++++++-
+ src/qemu/qemu_command.h | 10 +++
+ .../qemuxml2argv-shmem-plain-doorbell.args | 43 ++++++++++
+ tests/qemuxml2argvtest.c | 3 +
+ 4 files changed, 152 insertions(+), 3 deletions(-)
+ create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-shmem-plain-doorbell.args
+
+diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
+index e145c9f..dd8f60f 100644
+--- a/src/qemu/qemu_command.c
++++ b/src/qemu/qemu_command.c
+@@ -8503,6 +8503,50 @@ qemuBuildShmemDevLegacyStr(virDomainDefPtr def,
+ return NULL;
+ }
+
++char *
++qemuBuildShmemDevStr(virDomainDefPtr def,
++ virDomainShmemDefPtr shmem,
++ virQEMUCapsPtr qemuCaps)
++{
++ virBuffer buf = VIR_BUFFER_INITIALIZER;
++
++ if ((shmem->model == VIR_DOMAIN_SHMEM_MODEL_IVSHMEM_PLAIN &&
++ !virQEMUCapsGet(qemuCaps, QEMU_CAPS_DEVICE_IVSHMEM_PLAIN)) ||
++ (shmem->model == VIR_DOMAIN_SHMEM_MODEL_IVSHMEM_DOORBELL &&
++ !virQEMUCapsGet(qemuCaps, QEMU_CAPS_DEVICE_IVSHMEM_DOORBELL))) {
++ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
++ _("shmem model '%s' is not supported "
++ "by this QEMU binary"),
++ virDomainShmemModelTypeToString(shmem->model));
++ return NULL;
++ }
++
++ virBufferAdd(&buf, virDomainShmemModelTypeToString(shmem->model), -1);
++ virBufferAsprintf(&buf, ",id=%s", shmem->info.alias);
++
++ if (shmem->server.enabled)
++ virBufferAsprintf(&buf, ",chardev=char%s", shmem->info.alias);
++ else
++ virBufferAsprintf(&buf, ",memdev=shmmem-%s", shmem->info.alias);
++
++ if (shmem->msi.vectors)
++ virBufferAsprintf(&buf, ",vectors=%u", shmem->msi.vectors);
++ if (shmem->msi.ioeventfd) {
++ virBufferAsprintf(&buf, ",ioeventfd=%s",
++ virTristateSwitchTypeToString(shmem->msi.ioeventfd));
++ }
++
++ if (qemuBuildDeviceAddressStr(&buf, def, &shmem->info, qemuCaps) < 0) {
++ virBufferFreeAndReset(&buf);
++ return NULL;
++ }
++
++ if (virBufferCheckError(&buf) < 0)
++ return NULL;
++
++ return virBufferContentAndReset(&buf);
++}
++
+ static char *
+ qemuBuildShmemBackendChrStr(virLogManagerPtr logManager,
+ virCommandPtr cmd,
+@@ -8523,6 +8567,50 @@ qemuBuildShmemBackendChrStr(virLogManagerPtr logManager,
+ return devstr;
+ }
+
++
++virJSONValuePtr
++qemuBuildShmemBackendMemProps(virDomainShmemDefPtr shmem)
++{
++ char *mem_path = NULL;
++ virJSONValuePtr ret = NULL;
++
++ if (virAsprintf(&mem_path, "/dev/shm/%s", shmem->name) < 0)
++ return NULL;
++
++ virJSONValueObjectCreate(&ret,
++ "s:mem-path", mem_path,
++ "U:size", shmem->size,
++ NULL);
++
++ VIR_FREE(mem_path);
++ return ret;
++}
++
++
++static char *
++qemuBuildShmemBackendMemStr(virDomainShmemDefPtr shmem)
++{
++ char *ret = NULL;
++ char *alias = NULL;
++ virJSONValuePtr props = qemuBuildShmemBackendMemProps(shmem);
++
++ if (!props)
++ return NULL;
++
++ if (virAsprintf(&alias, "shmmem-%s", shmem->info.alias) < 0)
++ goto cleanup;
++
++ ret = virQEMUBuildObjectCommandlineFromJSON("memory-backend-file",
++ alias,
++ props);
++ cleanup:
++ VIR_FREE(alias);
++ virJSONValueFree(props);
++
++ return ret;
++}
++
++
+ static int
+ qemuBuildShmemCommandLine(virLogManagerPtr logManager,
+ virCommandPtr cmd,
+@@ -8565,10 +8653,15 @@ qemuBuildShmemCommandLine(virLogManagerPtr logManager,
+ break;
+
+ case VIR_DOMAIN_SHMEM_MODEL_IVSHMEM_PLAIN:
++ if (!(devstr = qemuBuildShmemBackendMemStr(shmem)))
++ return -1;
++
++ virCommandAddArgList(cmd, "-object", devstr, NULL);
++ VIR_FREE(devstr);
++
++ /* fall-through */
+ case VIR_DOMAIN_SHMEM_MODEL_IVSHMEM_DOORBELL:
+- virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+- _("%s device is not supported with this QEMU binary"),
+- virDomainShmemModelTypeToString(shmem->model));
++ devstr = qemuBuildShmemDevStr(def, shmem, qemuCaps);
+ break;
+
+ case VIR_DOMAIN_SHMEM_MODEL_LAST:
+diff --git a/src/qemu/qemu_command.h b/src/qemu/qemu_command.h
+index 7f33d83..a633f4e 100644
+--- a/src/qemu/qemu_command.h
++++ b/src/qemu/qemu_command.h
+@@ -179,4 +179,14 @@ bool qemuCheckCCWS390AddressSupport(const virDomainDef *def,
+ virJSONValuePtr qemuBuildHotpluggableCPUProps(const virDomainVcpuDef *vcpu)
+ ATTRIBUTE_NONNULL(1);
+
++virJSONValuePtr qemuBuildShmemBackendMemProps(virDomainShmemDefPtr shmem)
++ ATTRIBUTE_NONNULL(1);
++
++char *qemuBuildShmemDevStr(virDomainDefPtr def,
++ virDomainShmemDefPtr shmem,
++ virQEMUCapsPtr qemuCaps)
++ ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3);
++
++
++
+ #endif /* __QEMU_COMMAND_H__*/
+diff --git a/tests/qemuxml2argvdata/qemuxml2argv-shmem-plain-doorbell.args b/tests/qemuxml2argvdata/qemuxml2argv-shmem-plain-doorbell.args
+new file mode 100644
+index 0000000..7abc7f8
+--- /dev/null
++++ b/tests/qemuxml2argvdata/qemuxml2argv-shmem-plain-doorbell.args
+@@ -0,0 +1,43 @@
++LC_ALL=C \
++PATH=/bin \
++HOME=/home/test \
++USER=test \
++LOGNAME=test \
++QEMU_AUDIO_DRV=none \
++/usr/bin/qemu \
++-name QEMUGuest1 \
++-S \
++-M pc \
++-m 214 \
++-smp 1,sockets=1,cores=1,threads=1 \
++-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
++-nographic \
++-nodefaults \
++-monitor unix:/tmp/lib/domain--1-QEMUGuest1/monitor.sock,server,nowait \
++-no-acpi \
++-boot c \
++-usb \
++-object memory-backend-file,id=shmmem-shmem0,mem-path=/dev/shm/shmem0,\
++size=4194304 \
++-device ivshmem-plain,id=shmem0,memdev=shmmem-shmem0,bus=pci.0,addr=0x3 \
++-object memory-backend-file,id=shmmem-shmem1,mem-path=/dev/shm/shmem1,\
++size=134217728 \
++-device ivshmem-plain,id=shmem1,memdev=shmmem-shmem1,bus=pci.0,addr=0x5 \
++-object memory-backend-file,id=shmmem-shmem2,mem-path=/dev/shm/shmem2,\
++size=268435456 \
++-device ivshmem-plain,id=shmem2,memdev=shmmem-shmem2,bus=pci.0,addr=0x4 \
++-device ivshmem-doorbell,id=shmem3,chardev=charshmem3,ioeventfd=on,bus=pci.0,\
++addr=0x6 \
++-chardev socket,id=charshmem3,path=/var/lib/libvirt/shmem-shmem3-sock \
++-device ivshmem-doorbell,id=shmem4,chardev=charshmem4,ioeventfd=on,bus=pci.0,\
++addr=0x7 \
++-chardev socket,id=charshmem4,path=/tmp/shmem4-sock \
++-device ivshmem-doorbell,id=shmem5,chardev=charshmem5,ioeventfd=off,bus=pci.0,\
++addr=0x8 \
++-chardev socket,id=charshmem5,path=/tmp/shmem5-sock \
++-device ivshmem-doorbell,id=shmem6,chardev=charshmem6,vectors=16,ioeventfd=on,\
++bus=pci.0,addr=0x9 \
++-chardev socket,id=charshmem6,path=/tmp/shmem6-sock \
++-device ivshmem-doorbell,id=shmem7,chardev=charshmem7,vectors=32,ioeventfd=on,\
++bus=pci.0,addr=0xa \
++-chardev socket,id=charshmem7,path=/tmp/shmem7-sock
+diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
+index df9c832..7ae7f5d 100644
+--- a/tests/qemuxml2argvtest.c
++++ b/tests/qemuxml2argvtest.c
+@@ -1967,6 +1967,9 @@ mymain(void)
+ DO_TEST("fips-enabled", QEMU_CAPS_ENABLE_FIPS);
+
+ DO_TEST("shmem", QEMU_CAPS_DEVICE_IVSHMEM);
++ DO_TEST("shmem-plain-doorbell", QEMU_CAPS_DEVICE_IVSHMEM,
++ QEMU_CAPS_DEVICE_IVSHMEM_PLAIN,
++ QEMU_CAPS_DEVICE_IVSHMEM_DOORBELL);
+ DO_TEST_FAILURE("shmem", NONE);
+ DO_TEST_FAILURE("shmem-invalid-size",
+ QEMU_CAPS_DEVICE_IVSHMEM);
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-qemu-allow-32-slots-on-pcie-expander-bus-not-just-1.patch b/SOURCES/libvirt-qemu-allow-32-slots-on-pcie-expander-bus-not-just-1.patch
new file mode 100644
index 0000000..b74cc4f
--- /dev/null
+++ b/SOURCES/libvirt-qemu-allow-32-slots-on-pcie-expander-bus-not-just-1.patch
@@ -0,0 +1,43 @@
+From ea75f6f6363136f9a0ffe4cc03f09f7f984f9546 Mon Sep 17 00:00:00 2001
+Message-Id: <ea75f6f6363136f9a0ffe4cc03f09f7f984f9546@dist-git>
+From: Laine Stump <laine@laine.org>
+Date: Thu, 27 Oct 2016 12:31:33 -0400
+Subject: [PATCH] qemu: allow 32 slots on pcie-expander-bus, not just 1
+
+When I added support for the pcie-expander-bus controller in commit
+bc07251f, I incorrectly thought that it only had a single slot
+available. Actually it has 32 slots, just like the root complex aka
+pcie-root (the part that I *did* get correct is that unlike pcie-root
+a pcie-expander-bus doesn't allow any integrated endpoint devices -
+only pcie-root-ports and dmi-to-pci-controllers are allowed).
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1389369
+
+(cherry picked from commit 22afd44171a2df74fecb7058d146e83adddaae45)
+---
+ src/conf/domain_addr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/conf/domain_addr.c b/src/conf/domain_addr.c
+index cad1c27..e87fb4b 100644
+--- a/src/conf/domain_addr.c
++++ b/src/conf/domain_addr.c
+@@ -304,13 +304,13 @@ virDomainPCIAddressBusSetModel(virDomainPCIAddressBusPtr bus,
+ bus->maxSlot = VIR_PCI_ADDRESS_SLOT_LAST;
+ break;
+ case VIR_DOMAIN_CONTROLLER_MODEL_PCIE_EXPANDER_BUS:
+- /* single slot, no hotplug, only accepts pcie-root-port or
++ /* 32 slots, no hotplug, only accepts pcie-root-port or
+ * dmi-to-pci-bridge
+ */
+ bus->flags = (VIR_PCI_CONNECT_TYPE_PCIE_ROOT_PORT |
+ VIR_PCI_CONNECT_TYPE_DMI_TO_PCI_BRIDGE);
+ bus->minSlot = 0;
+- bus->maxSlot = 0;
++ bus->maxSlot = VIR_PCI_ADDRESS_SLOT_LAST;
+ break;
+
+ default:
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-qemuhotplugtest-Only-read-result_filename-if-used.patch b/SOURCES/libvirt-qemuhotplugtest-Only-read-result_filename-if-used.patch
new file mode 100644
index 0000000..468fff8
--- /dev/null
+++ b/SOURCES/libvirt-qemuhotplugtest-Only-read-result_filename-if-used.patch
@@ -0,0 +1,32 @@
+From 85bcdfb34ed4520a7e63be7cebe8019dbeeecb56 Mon Sep 17 00:00:00 2001
+Message-Id: <85bcdfb34ed4520a7e63be7cebe8019dbeeecb56@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:31 +0100
+Subject: [PATCH] qemuhotplugtest: Only read result_filename if used
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit a41d87f42fce94e93d7439a88c2d67d61c84d105)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ tests/qemuhotplugtest.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/qemuhotplugtest.c b/tests/qemuhotplugtest.c
+index 5f6b838..07b8091 100644
+--- a/tests/qemuhotplugtest.c
++++ b/tests/qemuhotplugtest.c
+@@ -239,7 +239,7 @@ testQemuHotplug(const void *data)
+ virTestLoadFile(device_filename, &device_xml) < 0)
+ goto cleanup;
+
+- if (test->action != UPDATE &&
++ if (test->action == ATTACH &&
+ virTestLoadFile(result_filename, &result_xml) < 0)
+ goto cleanup;
+
+--
+2.10.2
+
diff --git a/SOURCES/libvirt-schema-Allow-shmem-to-have-alias.patch b/SOURCES/libvirt-schema-Allow-shmem-to-have-alias.patch
new file mode 100644
index 0000000..df2ae84
--- /dev/null
+++ b/SOURCES/libvirt-schema-Allow-shmem-to-have-alias.patch
@@ -0,0 +1,35 @@
+From 3d7d9b8b2f298a0b1a98437c801b18776dfe890f Mon Sep 17 00:00:00 2001
+Message-Id: <3d7d9b8b2f298a0b1a98437c801b18776dfe890f@dist-git>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Fri, 4 Nov 2016 10:29:33 +0100
+Subject: [PATCH] schema: Allow shmem to have alias
+
+It already is used and tests will be automatically added in later patches.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit 9f8be11d5d8b601d47c54c6360045cd17f50f7c5)
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1392031
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ docs/schemas/domaincommon.rng | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
+index 6935b0d..d88ff3e 100644
+--- a/docs/schemas/domaincommon.rng
++++ b/docs/schemas/domaincommon.rng
+@@ -3579,6 +3579,9 @@
+ </element>
+ </optional>
+ <optional>
++ <ref name="alias"/>
++ </optional>
++ <optional>
+ <ref name="address"/>
+ </optional>
+ </interleave>
+--
+2.10.2
+
diff --git a/SOURCES/symlinks b/SOURCES/symlinks
index a1816be..cf2e503 100644
--- a/SOURCES/symlinks
+++ b/SOURCES/symlinks
@@ -1,3 +1,5 @@
+tests/qemuhotplugtestdata/qemuhotplug-hotplug-base-live+ivshmem-plain-detach.xml ../qemuxml2argvdata/qemuxml2argv-hotplug-base-live.xml
+tests/qemuhotplugtestdata/qemuhotplug-hotplug-base-live+ivshmem-plain.xml ../qemuxml2argvdata/qemuxml2argv-hotplug-base-live+ivshmem-plain.xml
tests/qemuxml2argvdata/qemuxml2argv-aarch64-gic-default.args qemuxml2argv-aarch64-gic-v2.args
tests/qemuxml2argvdata/qemuxml2argv-aarch64-gic-none-both.args qemuxml2argv-aarch64-gic-v3.args
tests/qemuxml2argvdata/qemuxml2argv-aarch64-gic-none-both.xml qemuxml2argv-aarch64-gic-none.xml
diff --git a/SPECS/libvirt.spec b/SPECS/libvirt.spec
index f4d1691..438ff4b 100644
--- a/SPECS/libvirt.spec
+++ b/SPECS/libvirt.spec
@@ -217,7 +217,7 @@
Summary: Library providing a simple virtualization API
Name: libvirt
Version: 2.0.0
-Release: 10%{?dist}%{?extra_release}
+Release: 10%{?dist}.2%{?extra_release}
License: LGPLv2+
Group: Development/Libraries
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
@@ -462,6 +462,31 @@ Patch230: libvirt-qemu-monitor-qemuMonitorGetCPUInfoHotplug-Add-iterator-anycpu.
Patch231: libvirt-qemu-monitor-Add-vcpu-state-information-to-monitor-data.patch
Patch232: libvirt-qemu-domain-Don-t-infer-vcpu-state.patch
Patch233: libvirt-virtlogd-Don-t-stop-or-restart-along-with-libvirtd.patch
+Patch234: libvirt-qemu-allow-32-slots-on-pcie-expander-bus-not-just-1.patch
+Patch235: libvirt-qemu-Reset-post-copy-capability-after-migration.patch
+Patch236: libvirt-qemuhotplugtest-Only-read-result_filename-if-used.patch
+Patch237: libvirt-schema-Allow-shmem-to-have-alias.patch
+Patch238: libvirt-conf-Allow-copying-of-shmem-defs.patch
+Patch239: libvirt-qemu-Make-qemuBuildShmemDevStr-static.patch
+Patch240: libvirt-qemu-Rename-qemuBuildShmemDevStr-to-qemuBuildShmemDevLegacyStr.patch
+Patch241: libvirt-qemu-Move-common-checks-outside-qemuBuildShmemDevLegacyStr.patch
+Patch242: libvirt-qemu-Reorder-shmem-params-nicely.patch
+Patch243: libvirt-qemu-Abstract-shmem-socket-path-preparation.patch
+Patch244: libvirt-qemu-Rename-qemuBuildShmemBackendStr-to-qemuBuildShmemBackendChrStr.patch
+Patch245: libvirt-qemu-Add-qemuAssignDeviceShmemAlias-and-use-it.patch
+Patch246: libvirt-conf-Add-some-shmem-helpers-for-future-use.patch
+Patch247: libvirt-conf-Remove-incorrect-check-when-encoding-shmem-audit-message.patch
+Patch248: libvirt-conf-Fix-virDomainShmemDefFind.patch
+Patch249: libvirt-conf-Don-t-complicate-find-loop.patch
+Patch250: libvirt-qemu-Disable-migration-with-ivshmem.patch
+Patch251: libvirt-conf-qemu-Add-support-for-shmem-model.patch
+Patch252: libvirt-conf-qemu-Add-newer-shmem-models.patch
+Patch253: libvirt-qemu-Add-capabilities-for-ivshmem-plain-doorbell.patch
+Patch254: libvirt-qemu-Save-various-defaults-for-shmem.patch
+Patch255: libvirt-qemu-Support-newer-ivshmem-device-variants.patch
+Patch256: libvirt-qemu-Add-support-for-hot-cold-un-plug-of-shmem-devices.patch
+Patch257: libvirt-qemu-Fix-double-free-when-live-attaching-shmem.patch
+Patch258: libvirt-qemu-Make-sure-shmem-memory-is-shared.patch
Requires: libvirt-daemon = %{version}-%{release}
@@ -2104,6 +2129,35 @@ exit 0
%changelog
+* Thu Nov 10 2016 Jiri Denemark <jdenemar@redhat.com> - 2.0.0-10.el7_3.2
+- qemu: Fix double free when live-attaching shmem (rhbz#1392031)
+- qemu: Make sure shmem memory is shared (rhbz#1392031)
+
+* Fri Nov 4 2016 Jiri Denemark <jdenemar@redhat.com> - 2.0.0-10.el7_3.1
+- qemu: allow 32 slots on pcie-expander-bus, not just 1 (rhbz#1389369)
+- qemu: Reset post-copy capability after migration (rhbz#1392030)
+- qemuhotplugtest: Only read result_filename if used (rhbz#1392031)
+- schema: Allow shmem to have alias (rhbz#1392031)
+- conf: Allow copying of shmem defs (rhbz#1392031)
+- qemu: Make qemuBuildShmemDevStr static (rhbz#1392031)
+- qemu: Rename qemuBuildShmemDevStr to qemuBuildShmemDevLegacyStr (rhbz#1392031)
+- qemu: Move common checks outside qemuBuildShmemDevLegacyStr (rhbz#1392031)
+- qemu: Reorder shmem params nicely (rhbz#1392031)
+- qemu: Abstract shmem socket path preparation (rhbz#1392031)
+- qemu: Rename qemuBuildShmemBackendStr to qemuBuildShmemBackendChrStr (rhbz#1392031)
+- qemu: Add qemuAssignDeviceShmemAlias and use it (rhbz#1392031)
+- conf: Add some shmem helpers for future use (rhbz#1392031)
+- conf: Remove incorrect check when encoding shmem audit message (rhbz#1389013)
+- conf: Fix virDomainShmemDefFind (rhbz#1392031)
+- conf: Don't complicate find loop (rhbz#1392031)
+- qemu: Disable migration with ivshmem (rhbz#1392031)
+- conf, qemu: Add support for shmem model (rhbz#1392031)
+- conf, qemu: Add newer shmem models (rhbz#1392031)
+- qemu: Add capabilities for ivshmem-{plain, doorbell} (rhbz#1392031)
+- qemu: Save various defaults for shmem (rhbz#1392031)
+- qemu: Support newer ivshmem device variants (rhbz#1392031)
+- qemu: Add support for hot/cold-(un)plug of shmem devices (rhbz#1392031)
+
* Wed Sep 21 2016 Jiri Denemark <jdenemar@redhat.com> - 2.0.0-10
- virtlogd: Don't stop or restart along with libvirtd (rhbz#1372576)