December 2025 - Devel - libvirt List Archives

[PATCH] qemu_dbus: Escape path to dbus-daemon socket if needed
by Michal Privoznik 19 Dec '25

19 Dec '25

From: Michal Privoznik <mprivozn(a)redhat.com> According to [1] there are only few characters allowed in the path to the daemon socket (alphanum and some punctuation; notably, space is missing on the list). The rest must be escaped by '%NN' notation. Fortunately, g_uri_escape_string() with some carefully selected input values is able to escape the path. Almost - it considers tilde valid but DBus doesn't. Well, let's hope nobody has tilde in domain name. 1: https://gitlab.freedesktop.org/dbus/dbus/-/blob/2dee5236088bcf690ba92b743a5… Closes: https://gitlab.com/libvirt/libvirt/-/issues/834 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_dbus.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_dbus.c b/src/qemu/qemu_dbus.c index 625884ad46..db0757b71d 100644 --- a/src/qemu/qemu_dbus.c +++ b/src/qemu/qemu_dbus.c @@ -119,6 +119,12 @@ static int qemuDBusWriteConfig(const char *filename, const char *path, bool privileged) { g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER; + /* Escape @path pointing to socket where the dbus-daemon is going to listen + * to. Valid characters are alphanumeric, '-', '_', '/', '\\', '*' and '.'. + * The rest must be URI escaped. g_uri_escape_string() treads alphanumeric, + * '-', '.', '_' and '~' as valid. + */ + g_autofree char *escapedPath = g_uri_escape_string(path, "/\\*", false); g_autofree char *config = NULL; virBufferAddLit(&buf, "<!DOCTYPE busconfig PUBLIC \"-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN\"\n"); @@ -127,7 +133,7 @@ qemuDBusWriteConfig(const char *filename, const char *path, bool privileged) virBufferAdjustIndent(&buf, 2); virBufferAddLit(&buf, "<type>org.libvirt.qemu</type>\n"); - virBufferAsprintf(&buf, "<listen>unix:path=%s</listen>\n", path); + virBufferAsprintf(&buf, "<listen>unix:path=%s</listen>\n", escapedPath); virBufferAddLit(&buf, "<auth>EXTERNAL</auth>\n"); virBufferAddLit(&buf, "<policy context='default'>\n"); -- 2.51.2

4 4

[PATCH v2 0/5] qemu: Implement support for iommufd
by Nathan Chen 18 Dec '25

18 Dec '25

Hi, This is a follow up to the first patch series [0] for using iommufd to propagate DMA mappings to the kernel for VM-assigned host devices in a qemu VM. We add a new 'iommufd' attribute for hostdev devices to be associated with the iommufd object. For instance, specifying the iommufd object and associated hostdev in a VM definition: <devices> ... <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> ... </devices> This would get translated to a qemu command line with the arguments below. Note that libvirt will open the /dev/iommu and VFIO cdev, passing the associated fd number to qemu: -object '{"qom-type":"iommufd","id":"iommufd0","fd":"24"}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","iommufd":"iommufd0","fd":"22","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","iommufd":"iommufd0","fd":"25","bus":"pci.22","addr":"0x0"}' \ Note that when Libvirt launches the qemu process as an unprivileged user, i.e. libvirt-qemu, it is bound by the RLIMIT_MEMLOCK limit calculated based on how much RAM is assigned to the VM. IOMMUFD's unified memory accounting causes ENOMEM errors for large device BARs that exceed the process memlock limit. VFIO without IOMMUFD does not check device memory against the limit and therefore does not show this behavior. To work around the issue, we can specify CAP_IPC_LOCK=ep capability for the qemu binary to bypass the RLIMIT_MEMLOCK limit. I am working on a long-term fix in the kernel to mark device memory regions so they do not count against the RLIMIT_MEMLOCK limit for how much memory can be locked/pinned, as I/O device BARs do not consume host RAM. This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/iommufd-11-25 Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/MYPM… Signed-off-by: Nathan Chen <nathanc(a)nvidia.com> Nathan Chen (5): qemu: Implement support for associating iommufd to hostdev qemu: open VFIO FDs from libvirt backend qemu: open iommufd FD from libvirt backend qemu: Update Cgroup, namespace, and seclabel for iommufd tests: qemuxmlconfdata: provide iommufd sample XML and CLI args docs/formatdomain.rst | 8 + src/conf/device_conf.c | 12 ++ src/conf/device_conf.h | 1 + src/conf/domain_conf.h | 2 + src/conf/schemas/basictypes.rng | 5 + src/libvirt_private.syms | 1 + src/qemu/qemu_cgroup.c | 26 +-- src/qemu/qemu_command.c | 53 ++++- src/qemu/qemu_domain.c | 40 ++++ src/qemu/qemu_domain.h | 19 ++ src/qemu/qemu_namespace.c | 16 +- src/qemu/qemu_process.c | 186 ++++++++++++++++++ src/security/security_apparmor.c | 18 +- src/security/security_dac.c | 28 ++- src/security/security_selinux.c | 28 ++- src/security/virt-aa-helper.c | 11 +- src/util/virpci.c | 69 +++++++ src/util/virpci.h | 2 + .../iommufd-q35.x86_64-latest.args | 41 ++++ .../iommufd-q35.x86_64-latest.xml | 60 ++++++ tests/qemuxmlconfdata/iommufd-q35.xml | 38 ++++ .../iommufd-virt.aarch64-latest.args | 33 ++++ .../iommufd-virt.aarch64-latest.xml | 34 ++++ tests/qemuxmlconfdata/iommufd-virt.xml | 22 +++ .../iommufd.x86_64-latest.args | 35 ++++ .../qemuxmlconfdata/iommufd.x86_64-latest.xml | 38 ++++ tests/qemuxmlconfdata/iommufd.xml | 30 +++ tests/qemuxmlconftest.c | 33 ++++ 28 files changed, 839 insertions(+), 50 deletions(-) create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-q35.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.xml create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd.xml -- 2.43.0

2 15

[PATCH] rpm: disable -Werror on ELN builds
by Daniel P. Berrangé 18 Dec '25

18 Dec '25

From: Daniel P. Berrangé <berrange(a)redhat.com> The ELN build root performs rebuilds of Fedora rawhide packages with %{rhel} set instead of %{fedora}. The vast majority of the time this will "do the right thing", but when we control -Dwerror we chose to enable -Werror on RHEL on the basis that the GCC toolchain is stable and thus we don't expect new warnings to appear. That does not hold true for ELN which tracks rawhide GCC. Thus we have the rare situation where we should explicitly check %{eln} not just %{rhel}. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index ccfe75135b..22c9975d9f 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -263,8 +263,9 @@ # RHEL releases provide stable tool chains and so it is safe to turn # compiler warning into errors without being worried about frequent -# changes in reported warnings -%if 0%{?rhel} +# changes in reported warnings. ELN is a rebuild of Rawhide so should +# be treated as unstable for this flag +%if 0%{?rhel} && !0%{?eln} %define enable_werror -Dwerror=true %else %define enable_werror -Dwerror=false -Dgit_werror=disabled -- 2.52.0

2 1

[PATCH v2 0/2] bhyve: implement SLIRP networking
by Roman Bogorodskiy 18 Dec '25

18 Dec '25

Was going to push it right away, but there were a little more changes than I expected, so sending v2. Changes from v1: - Patch 1/3 (implementation) updated to pass "mac=" MAC address configuration for the slirp interface, - Patch 2/3 updated to remove error if MAC address is specified and squashed into 1/3 as there was only a single code chunk left. Roman Bogorodskiy (2): bhyve: implement SLIRP networking docs: drvbhyve: document SLIRP networking docs/drvbhyve.rst | 24 ++++++++++++++ src/bhyve/bhyve_command.c | 10 ++++-- src/bhyve/bhyve_domain.c | 12 ++++++- .../bhyvexml2argv-slirp-ip.xml | 22 +++++++++++++ .../bhyvexml2argv-slirp-mac-addr.args | 10 ++++++ .../bhyvexml2argv-slirp-mac-addr.ldargs | 4 +++ .../bhyvexml2argv-slirp-mac-addr.xml | 22 +++++++++++++ .../bhyvexml2argv-slirp.args | 10 ++++++ .../bhyvexml2argv-slirp.ldargs | 4 +++ .../bhyvexml2argvdata/bhyvexml2argv-slirp.xml | 21 ++++++++++++ tests/bhyvexml2argvtest.c | 3 ++ .../bhyvexml2xmlout-slirp.xml | 32 +++++++++++++++++++ tests/bhyvexml2xmltest.c | 1 + 13 files changed, 172 insertions(+), 3 deletions(-) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp-ip.xml create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp-mac-addr.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp-mac-addr.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp-mac-addr.xml create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp.xml create mode 100644 tests/bhyvexml2xmloutdata/bhyvexml2xmlout-slirp.xml -- 2.51.2

2 5

[PATCH] hw/arm: Deprecate legacy VirtIO devices on big-endian guests
by Philippe Mathieu-Daudé 18 Dec '25

18 Dec '25

We couldn't find a way (guest OS with VirtIO drivers) to test a legacy VirtIO device on a ARM vCPU running in big-endian. Deprecate for the v11.0 release, giving 1 year to users who really care to contribute functional tests. Suggested-by: Alex Bennée <alex.bennee(a)linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd(a)linaro.org> --- docs/about/deprecated.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index ac31a2bce42..3a69facb0f1 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -515,6 +515,17 @@ It was implemented as a no-op instruction in TCG up to QEMU 9.0, but only with ``-cpu max`` (which does not guarantee migration compatibility across versions). +VirtIO devices +'''''''''''''' + +Legacy VirtIO devices on Big-Endian ARM architecture (since 11.0) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +There are no functional tests for legacy virtio devices used by ARM +machines running in big-endian order, which makes harder to maintain +the code path while the code base evolve. + + Backwards compatibility ----------------------- -- 2.52.0

4 4

[PATCH v3 21/51] qapi/migration: Deprecate capabilities commands
by Fabiano Rosas 16 Dec '25

16 Dec '25

The concept of capabilities is being merged into the concept of parameters. From now on, the commands that handle capabilities are deprecated in favor of the commands that handle parameters. Affected commands: - migrate-set-capabilities - query-migrate-capabilities Reviewed-by: Markus Armbruster <armbru(a)redhat.com> Reviewed-by: Peter Xu <peterx(a)redhat.com> Signed-off-by: Fabiano Rosas <farosas(a)suse.de> --- docs/about/deprecated.rst | 10 ++++++++++ migration/migration-hmp-cmds.c | 6 ++++++ qapi/migration.json | 16 ++++++++++++++-- 3 files changed, 30 insertions(+), 2 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index ac31a2bce4..1949508efa 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -588,3 +588,13 @@ command documentation for details on the ``fdset`` usage. The ``zero-blocks`` capability was part of the block migration which doesn't exist anymore since it was removed in QEMU v9.1. + +``migrate-set-capabilities`` command (since 10.2) +''''''''''''''''''''''''''''''''''''''''''''''''' + +Use ``migrate-set-parameters`` instead. + +``query-migrate-capabilities`` command (since 10.2) +''''''''''''''''''''''''''''''''''''''''''''''''''' + +Use ``query-migrate-parameters`` instead. diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c index 28b48c34bf..7e5ac57da5 100644 --- a/migration/migration-hmp-cmds.c +++ b/migration/migration-hmp-cmds.c @@ -298,6 +298,9 @@ void hmp_info_migrate_capabilities(Monitor *mon, const QDict *qdict) { MigrationCapabilityStatusList *caps, *cap; + warn_report("info migrate_capabilities is deprecated;" + " use info migrate_parameters instead"); + caps = qmp_query_migrate_capabilities(NULL); if (caps) { @@ -705,6 +708,9 @@ void hmp_migrate_set_capability(Monitor *mon, const QDict *qdict) MigrationCapabilityStatus *value; int val; + warn_report("migrate_set_capability is deprecated;" + " use migrate_set_parameter instead"); + val = qapi_enum_parse(&MigrationCapability_lookup, cap, -1, &err); if (val < 0) { goto end; diff --git a/qapi/migration.json b/qapi/migration.json index fcbb699a47..76a1e03f2f 100644 --- a/qapi/migration.json +++ b/qapi/migration.json @@ -570,6 +570,11 @@ # # @capabilities: json array of capability modifications to make # +# Features: +# +# @deprecated: This command is deprecated. Use migrate-set-parameters +# instead. +# # Since: 1.2 # # .. qmp-example:: @@ -579,13 +584,19 @@ # <- { "return": {} } ## { 'command': 'migrate-set-capabilities', - 'data': { 'capabilities': ['MigrationCapabilityStatus'] } } + 'data': { 'capabilities': ['MigrationCapabilityStatus'] }, + 'features': ['deprecated'] } ## # @query-migrate-capabilities: # # Return information about the current migration capabilities status # +# Features: +# +# @deprecated: This command is deprecated. Use +# query-migrate-parameters instead. +# # Since: 1.2 # # .. qmp-example:: @@ -601,7 +612,8 @@ # {"state": false, "capability": "x-colo"} # ]} ## -{ 'command': 'query-migrate-capabilities', 'returns': ['MigrationCapabilityStatus']} +{ 'command': 'query-migrate-capabilities', 'returns': ['MigrationCapabilityStatus'], + 'features': ['deprecated'] } ## # @MultiFDCompression: -- 2.51.0

1 0

[PATCH 1/3] bhyve: implement SLIRP networking
by Roman Bogorodskiy 16 Dec '25

16 Dec '25

Bhyve supports SLIRP networking using the following syntax: -s 12:0,e1000,slirp,open Where "e1000" is a NIC model, "slirp" is the SLIRP backend and "open" specifies open mode where external network is available to the guest. The "open" mode is a recent addition in FreeBSD -CURRENT. Unfortunately, bhyve does not provide a way to probe whether the open mode is supported, so users will have to make sure it's supported on their own. For the reference, without the "open" mode, the guest will have no outside network connectivity. To make this mode useful, it is possible to configure forwarding from the host to the guest, but it is not covered by this patch. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve_command.c | 6 +++- .../bhyvexml2argv-slirp.args | 10 ++++++ .../bhyvexml2argv-slirp.ldargs | 4 +++ .../bhyvexml2argvdata/bhyvexml2argv-slirp.xml | 21 ++++++++++++ tests/bhyvexml2argvtest.c | 1 + .../bhyvexml2xmlout-slirp.xml | 32 +++++++++++++++++++ tests/bhyvexml2xmltest.c | 1 + 7 files changed, 74 insertions(+), 1 deletion(-) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp.xml create mode 100644 tests/bhyvexml2xmloutdata/bhyvexml2xmlout-slirp.xml diff --git a/src/bhyve/bhyve_command.c b/src/bhyve/bhyve_command.c index e42e7b1ecc..b7e47084e6 100644 --- a/src/bhyve/bhyve_command.c +++ b/src/bhyve/bhyve_command.c @@ -93,9 +93,13 @@ bhyveBuildNetArgStr(const virDomainDef *def, goto cleanup; } break; + case VIR_DOMAIN_NET_TYPE_USER: + virCommandAddArg(cmd, "-s"); + virCommandAddArgFormat(cmd, "%d:0,%s,slirp,open", + net->info.addr.pci.slot, nic_model); + return 0; case VIR_DOMAIN_NET_TYPE_ETHERNET: case VIR_DOMAIN_NET_TYPE_DIRECT: - case VIR_DOMAIN_NET_TYPE_USER: case VIR_DOMAIN_NET_TYPE_VHOSTUSER: case VIR_DOMAIN_NET_TYPE_SERVER: case VIR_DOMAIN_NET_TYPE_CLIENT: diff --git a/tests/bhyvexml2argvdata/bhyvexml2argv-slirp.args b/tests/bhyvexml2argvdata/bhyvexml2argv-slirp.args new file mode 100644 index 0000000000..ff9a90ebc9 --- /dev/null +++ b/tests/bhyvexml2argvdata/bhyvexml2argv-slirp.args @@ -0,0 +1,10 @@ +bhyve \ +-c 1 \ +-m 214 \ +-u \ +-H \ +-P \ +-s 0:0,hostbridge \ +-s 2:0,ahci,hd:/tmp/freebsd.img \ +-s 3:0,e1000,slirp,open \ +bhyve diff --git a/tests/bhyvexml2argvdata/bhyvexml2argv-slirp.ldargs b/tests/bhyvexml2argvdata/bhyvexml2argv-slirp.ldargs new file mode 100644 index 0000000000..5905f4b3e6 --- /dev/null +++ b/tests/bhyvexml2argvdata/bhyvexml2argv-slirp.ldargs @@ -0,0 +1,4 @@ +bhyveload \ +-m 214 \ +-d /tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/bhyvexml2argv-slirp.xml b/tests/bhyvexml2argvdata/bhyvexml2argv-slirp.xml new file mode 100644 index 0000000000..5cf13d2a20 --- /dev/null +++ b/tests/bhyvexml2argvdata/bhyvexml2argv-slirp.xml @@ -0,0 +1,21 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='user'> + <model type='e1000'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2argvtest.c b/tests/bhyvexml2argvtest.c index 650313c2da..ee3d677947 100644 --- a/tests/bhyvexml2argvtest.c +++ b/tests/bhyvexml2argvtest.c @@ -270,6 +270,7 @@ mymain(void) DO_TEST("sata-rotation-rate"); DO_TEST_FAILURE("disk-virtio-rotation-rate"); DO_TEST_FAILURE("disk-virtio-queue-opts"); + DO_TEST("slirp"); /* Address allocation tests */ DO_TEST("addr-single-sata-disk"); diff --git a/tests/bhyvexml2xmloutdata/bhyvexml2xmlout-slirp.xml b/tests/bhyvexml2xmloutdata/bhyvexml2xmlout-slirp.xml new file mode 100644 index 0000000000..44d2616f6c --- /dev/null +++ b/tests/bhyvexml2xmloutdata/bhyvexml2xmlout-slirp.xml @@ -0,0 +1,32 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='file' device='disk'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <controller type='pci' index='0' model='pci-root'/> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </controller> + <interface type='user'> + <mac address='52:54:00:00:00:00'/> + <model type='e1000'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2xmltest.c b/tests/bhyvexml2xmltest.c index c2458b9fc4..0abc50b0de 100644 --- a/tests/bhyvexml2xmltest.c +++ b/tests/bhyvexml2xmltest.c @@ -122,6 +122,7 @@ mymain(void) DO_TEST_DIFFERENT("nvme"); DO_TEST_DIFFERENT("2-nvme-2-controllers"); DO_TEST_DIFFERENT("passthru-multiple-devs"); + DO_TEST_DIFFERENT("slirp"); /* Address allocation tests */ DO_TEST_DIFFERENT("addr-single-sata-disk"); -- 2.51.2

3 9

Question about error conditions for ACPI usage on aarch64
by Kazuhiro Abe (Fujitsu) 16 Dec '25

16 Dec '25

Hi all, We are currently working on CCA support. Due to CCA specifications, we are unable to use pflash with QEMU. Therefore, we intend to enable ACPI by specifying the UEFI firmware using the QEMU -bios option as follows: -machine virt,acpi=on -bios /usr/share/qemu-efi-aarch64/QEMU_EFI.fd Using the above QEMU option, we can successfully boot VM. My understanding is that the above QEMU option could be translated by the following libvirt XML: <os> <type arch='aarch64' machine='virt-4.0'>hvm</type> <loader type="rom">/usr/share/qemu-efi-aarch64/QEMU_EFI.fd</loader> </os> <features> <acpi/> </features> However, this XML configuration results in a validation error. Specifically, the error occurs because def->os.firmware is VIR_DOMAIN_OS_DEF_FIRMWARE_NONE during the following check: src/qemu/qemu_validate.c: qemuValidateDomainDef() /* On aarch64, ACPI requires UEFI */ if (def->features[VIR_DOMAIN_FEATURE_ACPI] == VIR_TRISTATE_SWITCH_ON && def->os.arch == VIR_ARCH_AARCH64 && (def->os.firmware != VIR_DOMAIN_OS_DEF_FIRMWARE_EFI && !virDomainDefHasOldStyleUEFI(def))) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("ACPI requires UEFI on this architecture")); return -1; } It appears that a configuration that successfully boots QEMU directly is being rejected by libvirt. Could you please explain if there's a specific reason for this strict validation? We are particularly interested in why VIR_DOMAIN_OS_DEF_FIRMWARE_NONE also becomes a condition for this error. Best Regards, Kazuhiro Abe

3 9

[PATCH] util: json: Increase JSON nesting limit when parsing to 300
by Peter Krempa 12 Dec '25

12 Dec '25

From: Peter Krempa <pkrempa(a)redhat.com> The default in json-c is 32 which is too low to accomodate the 200 snapshot layers we supported historically in the qemu driver (200 is picked based on the 256 layer limit in libxml). The response to 'query-block' is otherwise too low and we fail to start the VM when there's around 26 images in a backing chain. 'json_tokener_new_ex' is supported since json-c 0.11 and we require at least 0.14. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- I've also figured out that we don't actually care about the backing image information so I've proposed a 'flat' mode for 'query-block' in qemu similarly to what we do for 'query-named-block-nodes': https://mail.gnu.org/archive/html/qemu-block/2025-12/msg00104.html src/util/virjson.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/util/virjson.c b/src/util/virjson.c index a799707c16..454bd657be 100644 --- a/src/util/virjson.c +++ b/src/util/virjson.c @@ -1466,7 +1466,15 @@ virJSONValueFromString(const char *jsonstring) VIR_DEBUG("string=%s", jsonstring); - tok = json_tokener_new(); + /* When creating the tokener we need to specify the limit of the nesting + * depth of JSON objects. The default in json-c is 32. Since we need to + * support at least 200 layers of snapshots (the limit is based on a + * conservative take on the 256 layer nesting limit for XML in libxml), for + * which we have internal checks, we also need to set the JSON limit to + * be able to parse qemu responses for such a deeply nested snapshot list. + * '300' is picked a sa conservative buffer on top of the 200 layers plus + * some of the extra wrappers that qemu adds*/ + tok = json_tokener_new_ex(300); if (!tok) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("failed to create JSON tokener")); -- 2.52.0

2 2

Re: [RFC PATCH 2/9] MAINTAINERS: fix libvirt entry
by Philippe Mathieu-Daudé 12 Dec '25

12 Dec '25

On 11/12/25 19:01, Alex Bennée wrote: > We have a particular tag for lists so lets use it. > > Signed-off-by: Alex Bennée <alex.bennee(a)linaro.org> > --- > MAINTAINERS | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/MAINTAINERS b/MAINTAINERS > index 05b644cfc9b..a3fdc4ca911 100644 > --- a/MAINTAINERS > +++ b/MAINTAINERS > @@ -4466,7 +4466,7 @@ F: gitdm.config > F: contrib/gitdm/* > > Incompatible changes > -R: devel(a)lists.libvirt.org > +L: devel(a)lists.libvirt.org Maybe keep both? See: commit b02c9bc35a03c099600693d6909f4566078880b8 Author: Markus Armbruster <armbru(a)redhat.com> Date: Mon Jul 16 09:32:26 2018 +0200 MAINTAINERS: New section "Incompatible changes", copy libvir-list Libvirt developers would like to be copied on patches to qemu-doc appendix "Deprecated features". Do them the favor. Signed-off-by: Markus Armbruster <armbru(a)redhat.com> Message-Id: <20180716073226.21127-3-armbru(a)redhat.com> Reviewed-by: Thomas Huth <thuth(a)redhat.com> Reviewed-by: Cornelia Huck <cohuck(a)redhat.com> Reviewed-by: Daniel P. Berrangé <berrange(a)redhat.com> diff --git a/MAINTAINERS b/MAINTAINERS index 20eef3cb61c..666e9368126 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -2194,6 +2194,10 @@ M: Daniel P. Berrange <berrange(a)redhat.com> S: Odd Fixes F: docs/devel/build-system.txt +Incompatible changes +R: libvir-list(a)redhat.com +F: qemu-deprecated.texi

3 2

[PATCH 0/5] cover: RFE libvirt secret encryption on disk
by Arun Menon 12 Dec '25

12 Dec '25

Libvirt secrets are stored unencrypted on the disk. With this series we want to start encrypting the secrets. 1. Introduce the GnuTLS decryption wrapper functions that work exact opposite to the encryption wrappers. The new test added works fine because during test execution, we use the mock implementation of virRandomBytes while generating the iv and the key. 2. Add a new service called virt-secrets-init-encryption, that is linked to the virtsecretd service. virtsecretd service only starts after the new service generates a random encryption key. 3. Add a new secret.conf configuration file that helps user to set a. secrets_encryption_key - allows the user to specify the encryption key file path, in case the default key is not to be used. b. encrypt_data - set to 0 or 1. If set to 1, then the newly added secrets will be encrypted. 4. Add encryption scheme or cipher attribute that will allow us to choose the last used cipher. New modes can be added to the enum. 5. Once we have the encryption key, and a reliable way to tell the daemon what encryption scheme the secret object must use, we can encrypt the secrets on disk and store them in <uuid>.<encryption_scheme> format. It is important to note that if the encryption key is changed between restarts, then the respective secret will not be loaded by the driver. This is a sincere attempt to improve upon the already submitted patch https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/KE6G… Resolves: https://issues.redhat.com/browse/RHEL-7125 RFC: https://patchew.org/Libvirt/20251127072232.38426-1-armenon@redhat.com/ --- Changes in v1: - Previously, encrypt_data was set to 1 regardless of what is present in the secrets config file. This is now changed. encrypt_data is first read from the config file, and it is set to 1 only if secrets_encryption_key is not NULL or if systemd credential named "secrets-encryption-key" exists. - Rename from secrets.conf to secret.conf. Move secrets_config.c from src/conf to src/secret/ - Add a special error code 'VIR_ERR_INVALID_ENCR_KEY_SECRET' for when the secret key length is invalid. - Add the 2 directives to load credential into libvirtd service as well. Rename unit file name from secret-init-encryption.in to virt-secret-init-encryption.service.in. - Remove unnecessary configuration settings and make it inline. Arun Menon (5): util: Add support for GnuTLS decryption secret: Set up default encryption secret key for the virtsecretd service secret: Add secret.conf configuration file and parse it secret: Add encryptionSchemeType attribute to store ciphers secret: Add functionality to load and save secrets in encrypted format include/libvirt/virterror.h | 1 + libvirt.spec.in | 7 + po/POTFILES | 1 + src/conf/secret_conf.c | 6 + src/conf/secret_conf.h | 9 + src/conf/virsecretobj.c | 184 ++++++++++++++---- src/conf/virsecretobj.h | 18 +- src/libvirt_private.syms | 1 + src/meson.build | 1 + src/remote/libvirtd.service.in | 2 + src/secret/libvirt_secrets.aug | 40 ++++ src/secret/meson.build | 34 ++++ src/secret/secret.conf.in | 14 ++ src/secret/secret_config.c | 171 ++++++++++++++++ src/secret/secret_config.h | 40 ++++ src/secret/secret_driver.c | 34 +++- src/secret/test_libvirt_secrets.aug.in | 6 + .../virt-secret-init-encryption.service.in | 7 + src/secret/virtsecretd.service.extra.in | 8 + src/util/vircrypto.c | 126 +++++++++++- src/util/vircrypto.h | 8 + src/util/virerror.c | 3 + tests/vircryptotest.c | 65 +++++++ 23 files changed, 736 insertions(+), 50 deletions(-) create mode 100644 src/secret/libvirt_secrets.aug create mode 100644 src/secret/secret.conf.in create mode 100644 src/secret/secret_config.c create mode 100644 src/secret/secret_config.h create mode 100644 src/secret/test_libvirt_secrets.aug.in create mode 100644 src/secret/virt-secret-init-encryption.service.in -- 2.51.1

2 9

[PATCH v1] tests: add capabilities for QEMU v10.1.0 on s390x
by Shalini Chellathurai Saroja 12 Dec '25

12 Dec '25

Let us introduce the capabilities for QEMU v10.1.0 on s390x. Signed-off-by: Shalini Chellathurai Saroja <shalini(a)linux.ibm.com> Reviewed-by: Boris Fiuczynski <fiuczy(a)linux.ibm.com> The replies and xml files are removed from this patch and are available in https://gitlab.com/shalinichellathurai/libvirt/-/commit/e2c1c82c6701c87b4f6… --- tests/domaincapsdata/qemu_10.1.0.s390x.xml | 444 + .../caps_10.1.0_s390x.replies | 39228 ++++++++++++++++ .../caps_10.1.0_s390x.xml | 4244 ++ ...deprecated-features-none.s390x-latest.args | 2 +- ...-deprecated-features-off.s390x-latest.args | 2 +- ...l-deprecated-features-on.s390x-latest.args | 2 +- ...default-video-type-s390x.s390x-latest.args | 2 +- ...vfio-zpci-ccw-memballoon.s390x-latest.args | 2 +- .../launch-security-s390-pv.s390x-latest.args | 2 +- ...t-cpu-kvm-ccw-virtio-4.2.s390x-latest.args | 2 +- .../s390-defaultconsole.s390x-latest.args | 2 +- .../s390-panic.s390x-latest.args | 2 +- 12 files changed, 43925 insertions(+), 9 deletions(-) create mode 100644 tests/domaincapsdata/qemu_10.1.0.s390x.xml create mode 100644 tests/qemucapabilitiesdata/caps_10.1.0_s390x.replies create mode 100644 tests/qemucapabilitiesdata/caps_10.1.0_s390x.xml diff --git a/tests/domaincapsdata/qemu_10.1.0.s390x.xml b/tests/domaincapsdata/qemu_10.1.0.s390x.xml new file mode 100644 index 0000000000..9d773385c4 --- /dev/null +++ b/tests/domaincapsdata/qemu_10.1.0.s390x.xml @@ -0,0 +1,444 @@ +<domainCapabilities> + <path>/usr/bin/qemu-system-s390x</path> + <domain>kvm</domain> + <machine>s390-ccw-virtio-10.1</machine> + <arch>s390x</arch> + <vcpu max='248'/> + <iothreads supported='yes'/> + <os supported='yes'> + <enum name='firmware'/> + <loader supported='yes'> + <value>/obviously/fake/firmware1.fd</value> + <value>/obviously/fake/firmware2.fd</value> + <enum name='type'> + <value>rom</value> + <value>pflash</value> + </enum> + <enum name='readonly'> + <value>yes</value> + <value>no</value> + </enum> + <enum name='secure'> + <value>no</value> + </enum> + </loader> + </os> + <cpu> + <mode name='host-passthrough' supported='yes'> + <enum name='hostPassthroughMigratable'> + <value>off</value> + </enum> + </mode> + <mode name='maximum' supported='yes'> + <enum name='maximumMigratable'> + <value>on</value> + <value>off</value> + </enum> + </mode> + <mode name='host-model' supported='yes'> + <model fallback='forbid'>gen17a-base</model> + <feature policy='require' name='nnpa'/> + <feature policy='require' name='aen'/> + <feature policy='require' name='gen17ptff'/> + <feature policy='require' name='ccf'/> + <feature policy='require' name='cmmnt'/> + <feature policy='require' name='vxpdeh'/> + <feature policy='require' name='aefsi'/> + <feature policy='require' name='diag318'/> + <feature policy='require' name='mepoch'/> + <feature policy='require' name='msa9'/> + <feature policy='require' name='msa8'/> + <feature policy='require' name='msa7'/> + <feature policy='require' name='msa6'/> + <feature policy='require' name='msa5'/> + <feature policy='require' name='msa4'/> + <feature policy='require' name='msa3'/> + <feature policy='require' name='msa2'/> + <feature policy='require' name='msa1'/> + <feature policy='require' name='msa13_pckmo'/> + <feature policy='require' name='msa11_pckmo'/> + <feature policy='require' name='msa10_pckmo'/> + <feature policy='require' name='sthyi'/> + <feature policy='require' name='edat'/> + <feature policy='require' name='ri'/> + <feature policy='require' name='deflate'/> + <feature policy='require' name='msa13'/> + <feature policy='require' name='msa11'/> + <feature policy='require' name='msa10'/> + <feature policy='require' name='edat2'/> + <feature policy='require' name='vxpdeh3'/> + <feature policy='require' name='etoken'/> + <feature policy='require' name='vx'/> + <feature policy='require' name='ipter'/> + <feature policy='require' name='pai'/> + <feature policy='require' name='paie'/> + <feature policy='require' name='mepochptff'/> + <feature policy='require' name='ap'/> + <feature policy='require' name='vxeh'/> + <feature policy='require' name='vxpd'/> + <feature policy='require' name='esop'/> + <feature policy='require' name='msa9_pckmo'/> + <feature policy='require' name='vxeh3'/> + <feature policy='require' name='vxeh2'/> + <feature policy='require' name='esort'/> + <feature policy='require' name='appv'/> + <feature policy='require' name='apqi'/> + <feature policy='require' name='apft'/> + <feature policy='require' name='els'/> + <feature policy='require' name='iep'/> + <feature policy='require' name='appvi'/> + <feature policy='require' name='ineff_nc_tx'/> + <feature policy='require' name='apqci'/> + <feature policy='require' name='cte'/> + <feature policy='require' name='ais'/> + <feature policy='require' name='bpb'/> + <feature policy='require' name='ctop'/> + <feature policy='require' name='gs'/> + <feature policy='require' name='ppa15'/> + <feature policy='require' name='zpci'/> + <feature policy='require' name='rdp'/> + <feature policy='require' name='sea_esop2'/> + <feature policy='require' name='beareh'/> + <feature policy='require' name='te'/> + <feature policy='require' name='cmm'/> + <feature policy='require' name='vxpdeh2'/> + </mode> + <mode name='custom' supported='yes'> + <model usable='yes' vendor='IBM'>gen15a</model> + <model usable='yes' vendor='IBM'>gen15a-base</model> + <model usable='yes' vendor='IBM'>gen15b</model> + <model usable='yes' vendor='IBM'>gen15b-base</model> + <model usable='yes' vendor='IBM'>gen16a</model> + <model usable='yes' vendor='IBM'>gen16a-base</model> + <model usable='yes' vendor='IBM'>gen16b</model> + <model usable='yes' vendor='IBM'>gen16b-base</model> + <model usable='yes' vendor='IBM'>gen17a</model> + <model usable='yes' vendor='IBM'>gen17a-base</model> + <model usable='yes' vendor='IBM'>gen17b</model> + <model usable='yes' vendor='IBM'>gen17b-base</model> + <model usable='yes' vendor='unknown'>max</model> + <model usable='yes' vendor='unknown'>qemu</model> + <model usable='no' vendor='IBM'>z10BC</model> + <blockers model='z10BC'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z10BC-base</model> + <blockers model='z10BC-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z10BC.2</model> + <blockers model='z10BC.2'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z10BC.2-base</model> + <blockers model='z10BC.2-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z10EC</model> + <blockers model='z10EC'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z10EC-base</model> + <blockers model='z10EC-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z10EC.2</model> + <blockers model='z10EC.2'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z10EC.2-base</model> + <blockers model='z10EC.2-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z10EC.3</model> + <blockers model='z10EC.3'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z10EC.3-base</model> + <blockers model='z10EC.3-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z114</model> + <blockers model='z114'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z114-base</model> + <blockers model='z114-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z13</model> + <blockers model='z13'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z13-base</model> + <blockers model='z13-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z13.2</model> + <blockers model='z13.2'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z13.2-base</model> + <blockers model='z13.2-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z13s</model> + <blockers model='z13s'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z13s-base</model> + <blockers model='z13s-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z14</model> + <blockers model='z14'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z14-base</model> + <blockers model='z14-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z14.2</model> + <blockers model='z14.2'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z14.2-base</model> + <blockers model='z14.2-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z14ZR1</model> + <blockers model='z14ZR1'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z14ZR1-base</model> + <blockers model='z14ZR1-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z196</model> + <blockers model='z196'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z196-base</model> + <blockers model='z196-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z196.2</model> + <blockers model='z196.2'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z196.2-base</model> + <blockers model='z196.2-base'> + <feature name='csske'/> + </blockers> + <model usable='yes' vendor='IBM'>z800</model> + <model usable='yes' vendor='IBM'>z800-base</model> + <model usable='yes' vendor='IBM'>z890</model> + <model usable='yes' vendor='IBM'>z890-base</model> + <model usable='yes' vendor='IBM'>z890.2</model> + <model usable='yes' vendor='IBM'>z890.2-base</model> + <model usable='yes' vendor='IBM'>z890.3</model> + <model usable='yes' vendor='IBM'>z890.3-base</model> + <model usable='yes' vendor='IBM'>z900</model> + <model usable='yes' vendor='IBM'>z900-base</model> + <model usable='yes' vendor='IBM'>z900.2</model> + <model usable='yes' vendor='IBM'>z900.2-base</model> + <model usable='yes' vendor='IBM'>z900.3</model> + <model usable='yes' vendor='IBM'>z900.3-base</model> + <model usable='yes' vendor='IBM'>z990</model> + <model usable='yes' vendor='IBM'>z990-base</model> + <model usable='yes' vendor='IBM'>z990.2</model> + <model usable='yes' vendor='IBM'>z990.2-base</model> + <model usable='yes' vendor='IBM'>z990.3</model> + <model usable='yes' vendor='IBM'>z990.3-base</model> + <model usable='yes' vendor='IBM'>z990.4</model> + <model usable='yes' vendor='IBM'>z990.4-base</model> + <model usable='yes' vendor='IBM'>z990.5</model> + <model usable='yes' vendor='IBM'>z990.5-base</model> + <model usable='yes' vendor='IBM'>z9BC</model> + <model usable='yes' vendor='IBM'>z9BC-base</model> + <model usable='yes' vendor='IBM'>z9BC.2</model> + <model usable='yes' vendor='IBM'>z9BC.2-base</model> + <model usable='yes' vendor='IBM'>z9EC</model> + <model usable='yes' vendor='IBM'>z9EC-base</model> + <model usable='yes' vendor='IBM'>z9EC.2</model> + <model usable='yes' vendor='IBM'>z9EC.2-base</model> + <model usable='yes' vendor='IBM'>z9EC.3</model> + <model usable='yes' vendor='IBM'>z9EC.3-base</model> + <model usable='no' vendor='IBM'>zBC12</model> + <blockers model='zBC12'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>zBC12-base</model> + <blockers model='zBC12-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>zEC12</model> + <blockers model='zEC12'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>zEC12-base</model> + <blockers model='zEC12-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>zEC12.2</model> + <blockers model='zEC12.2'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>zEC12.2-base</model> + <blockers model='zEC12.2-base'> + <feature name='csske'/> + </blockers> + </mode> + </cpu> + <memoryBacking supported='yes'> + <enum name='sourceType'> + <value>file</value> + <value>anonymous</value> + <value>memfd</value> + </enum> + </memoryBacking> + <devices> + <disk supported='yes'> + <enum name='diskDevice'> + <value>disk</value> + <value>cdrom</value> + <value>lun</value> + </enum> + <enum name='bus'> + <value>scsi</value> + <value>virtio</value> + <value>usb</value> + <value>nvme</value> + </enum> + <enum name='model'> + <value>virtio</value> + <value>virtio-transitional</value> + <value>virtio-non-transitional</value> + </enum> + </disk> + <graphics supported='yes'> + <enum name='type'> + <value>sdl</value> + <value>vnc</value> + <value>rdp</value> + <value>egl-headless</value> + <value>dbus</value> + </enum> + </graphics> + <video supported='yes'> + <enum name='modelType'> + <value>virtio</value> + <value>none</value> + </enum> + </video> + <hostdev supported='yes'> + <enum name='mode'> + <value>subsystem</value> + </enum> + <enum name='startupPolicy'> + <value>default</value> + <value>mandatory</value> + <value>requisite</value> + <value>optional</value> + </enum> + <enum name='subsysType'> + <value>usb</value> + <value>pci</value> + <value>scsi</value> + </enum> + <enum name='capsType'/> + <enum name='pciBackend'> + <value>default</value> + <value>vfio</value> + </enum> + </hostdev> + <rng supported='yes'> + <enum name='model'> + <value>virtio</value> + <value>virtio-transitional</value> + <value>virtio-non-transitional</value> + </enum> + <enum name='backendModel'> + <value>random</value> + <value>egd</value> + <value>builtin</value> + </enum> + </rng> + <filesystem supported='yes'> + <enum name='driverType'> + <value>path</value> + <value>handle</value> + <value>virtiofs</value> + </enum> + </filesystem> + <tpm supported='no'/> + <redirdev supported='yes'> + <enum name='bus'> + <value>usb</value> + </enum> + </redirdev> + <channel supported='yes'> + <enum name='type'> + <value>pty</value> + <value>unix</value> + </enum> + </channel> + <crypto supported='yes'> + <enum name='model'> + <value>virtio</value> + </enum> + <enum name='type'> + <value>qemu</value> + </enum> + <enum name='backendModel'> + <value>builtin</value> + <value>lkcf</value> + </enum> + </crypto> + <interface supported='yes'> + <enum name='backendType'> + <value>default</value> + <value>passt</value> + </enum> + </interface> + <panic supported='yes'> + <enum name='model'> + <value>s390</value> + </enum> + </panic> + <console supported='yes'> + <enum name='type'> + <value>null</value> + <value>vc</value> + <value>pty</value> + <value>dev</value> + <value>file</value> + <value>pipe</value> + <value>stdio</value> + <value>udp</value> + <value>tcp</value> + <value>unix</value> + <value>qemu-vdagent</value> + <value>dbus</value> + </enum> + </console> + </devices> + <features> + <gic supported='no'/> + <vmcoreinfo supported='no'/> + <genid supported='no'/> + <backingStoreInput supported='yes'/> + <backup supported='yes'/> + <async-teardown supported='yes'/> + <s390-pv supported='yes'/> + <ps2 supported='no'/> + <tdx supported='no'/> + <sev supported='no'/> + <sgx supported='no'/> + <launchSecurity supported='yes'> + <enum name='sectype'> + <value>s390-pv</value> + </enum> + </launchSecurity> + </features> +</domainCapabilities> diff --git a/tests/qemucapabilitiesdata/caps_10.1.0_s390x.replies b/tests/qemucapabilitiesdata/caps_10.1.0_s390x.replies new file mode 100644 index 0000000000..f693bca7b1 --- /dev/null +++ b/tests/qemucapabilitiesdata/caps_10.1.0_s390x.replies @@ -0,0 +1,39228 @@ [...snipped...] diff --git a/tests/qemucapabilitiesdata/caps_10.1.0_s390x.xml b/tests/qemucapabilitiesdata/caps_10.1.0_s390x.xml new file mode 100644 index 0000000000..8d59566cc0 --- /dev/null +++ b/tests/qemucapabilitiesdata/caps_10.1.0_s390x.xml @@ -0,0 +1,4244 @@ [...snipped...] diff --git a/tests/qemuxmlconfdata/cpu-model-deprecated-features-none.s390x-latest.args b/tests/qemuxmlconfdata/cpu-model-deprecated-features-none.s390x-latest.args index ba6e7c5304..2305f6b194 100644 --- a/tests/qemuxmlconfdata/cpu-model-deprecated-features-none.s390x-latest.args +++ b/tests/qemuxmlconfdata/cpu-model-deprecated-features-none.s390x-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ -machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram \ -accel kvm \ --cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=off,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on \ +-cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on,csske=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-latest.args b/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-latest.args index ba6e7c5304..2305f6b194 100644 --- a/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-latest.args +++ b/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ -machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram \ -accel kvm \ --cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=off,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on \ +-cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on,csske=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-model-deprecated-features-on.s390x-latest.args b/tests/qemuxmlconfdata/cpu-model-deprecated-features-on.s390x-latest.args index 8cdb2a2ac2..e0d433e77e 100644 --- a/tests/qemuxmlconfdata/cpu-model-deprecated-features-on.s390x-latest.args +++ b/tests/qemuxmlconfdata/cpu-model-deprecated-features-on.s390x-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ -machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram \ -accel kvm \ --cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=on,ais=on,bpb=on,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=on,cmm=on,vxpdeh2=on \ +-cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=on,ais=on,bpb=on,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=on,cmm=on,vxpdeh2=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/default-video-type-s390x.s390x-latest.args b/tests/qemuxmlconfdata/default-video-type-s390x.s390x-latest.args index ff71f5b872..f8b4538815 100644 --- a/tests/qemuxmlconfdata/default-video-type-s390x.s390x-latest.args +++ b/tests/qemuxmlconfdata/default-video-type-s390x.s390x-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-default-video-type-s/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-default-video-type-s/master-key.aes"}' \ -machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram \ -accel kvm \ --cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=off,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on \ +-cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on,csske=off \ -m size=1048576k \ -object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":1073741824}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/hostdev-vfio-zpci-ccw-memballoon.s390x-latest.args b/tests/qemuxmlconfdata/hostdev-vfio-zpci-ccw-memballoon.s390x-latest.args index 25c0ed2c9c..e8a95ec89e 100644 --- a/tests/qemuxmlconfdata/hostdev-vfio-zpci-ccw-memballoon.s390x-latest.args +++ b/tests/qemuxmlconfdata/hostdev-vfio-zpci-ccw-memballoon.s390x-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-KVMGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-KVMGuest1/master-key.aes"}' \ -machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram \ -accel kvm \ --cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=off,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on \ +-cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on,csske=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/launch-security-s390-pv.s390x-latest.args b/tests/qemuxmlconfdata/launch-security-s390-pv.s390x-latest.args index 4c80d0bf39..9786e0a574 100644 --- a/tests/qemuxmlconfdata/launch-security-s390-pv.s390x-latest.args +++ b/tests/qemuxmlconfdata/launch-security-s390-pv.s390x-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram,confidential-guest-support=lsec0 \ -accel kvm \ --cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=off,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on \ +-cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on,csske=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-latest.args b/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-latest.args index 3f3de9a668..9fc3134702 100644 --- a/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-latest.args +++ b/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-test/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-test/master-key.aes"}' \ -machine s390-ccw-virtio-4.2,usb=off,dump-guest-core=off,memory-backend=s390.ram \ -accel kvm \ --cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=off,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on \ +-cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on,csske=off \ -m size=262144k \ -object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":268435456}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/s390-defaultconsole.s390x-latest.args b/tests/qemuxmlconfdata/s390-defaultconsole.s390x-latest.args index 3efa883d8c..1dceeb59d4 100644 --- a/tests/qemuxmlconfdata/s390-defaultconsole.s390x-latest.args +++ b/tests/qemuxmlconfdata/s390-defaultconsole.s390x-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-test/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-test/master-key.aes"}' \ -machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram \ -accel kvm \ --cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=off,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on \ +-cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on,csske=off \ -m size=262144k \ -object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":268435456}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/s390-panic.s390x-latest.args b/tests/qemuxmlconfdata/s390-panic.s390x-latest.args index 8afd5de0f6..bd79ab1ee3 100644 --- a/tests/qemuxmlconfdata/s390-panic.s390x-latest.args +++ b/tests/qemuxmlconfdata/s390-panic.s390x-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-test/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-test/master-key.aes"}' \ -machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram \ -accel kvm \ --cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=off,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on \ +-cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on,csske=off \ -m size=262144k \ -object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":268435456}' \ -overcommit mem-lock=off \ -- 2.51.0

2 1

[PATCH] qemu_domain: Allow the builtin IDE to be used on r2d
by socksinspace 12 Dec '25

12 Dec '25

The r2d machine uses IDE for storage (a CF Card on the real hardware) Signed-off-by: socksinspace <socksinspace(a)mailbox.org> --- Tested to build, pass tests and run as expected when applied on top of 11.10.0 as packaged in Alpine Linux src/qemu/qemu_domain.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index ac56fc7cb4..f6d4e4c3ec 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -7696,7 +7696,8 @@ qemuDomainMachineHasBuiltinIDE(const char *machine, return qemuDomainMachineIsI440FX(machine, arch) || STREQ(machine, "malta") || STREQ(machine, "sun4u") || - STREQ(machine, "g3beige"); + STREQ(machine, "g3beige") || + STREQ(machine, "r2d"); } -- 2.52.0

1 0

[PATCH] virfiletest: Fix build on non-Linux
by Jiri Denemark 10 Dec '25

10 Dec '25

From: Jiri Denemark <jdenemar(a)redhat.com> Fixes: 121d179e068b584f62ea2c029d89a44e67c909c0 Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- tests/virfiletest.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/virfiletest.c b/tests/virfiletest.c index ccd76a3fac..3f179a3f74 100644 --- a/tests/virfiletest.c +++ b/tests/virfiletest.c @@ -329,6 +329,7 @@ testFileIsSharedFSType(const void *opaque G_GNUC_UNUSED) } +#ifdef __linux__ static const char *shared_filesystems[] = { "/run/user/501/gvfs", "/nfs", @@ -338,6 +339,7 @@ static const char *shared_filesystems[] = { "/quobyte", NULL, }; +#endif static int testFileIsSharedFSOverride(const void *opaque G_GNUC_UNUSED) -- 2.52.0

1 0

[PATCH 0/4] util: Fix race when checking whether a path is on a shared FS
by Jiri Denemark 10 Dec '25

10 Dec '25

See 2/4 for details. Jiri Denemark (4): tests: Test virFileIsSharedFSOverride util: Fix race condition in virFileIsSharedFSType util: Fix race condition in virFileIsSharedFSOverride util: Rework virFileIsSharedFSOverride using virFileCheckParents src/util/virfile.c | 133 +++++++++++++++++++++++++++++--------------- tests/virfiletest.c | 69 +++++++++++++++++++++++ 2 files changed, 156 insertions(+), 46 deletions(-) -- 2.52.0

3 6

[PATCH 0/9] qemu: Fix few bugs in snapshot/save code (background snapshot saga part 1)
by Peter Krempa 09 Dec '25

09 Dec '25

While looking trhough the snapshot code I've noticed a few bugs: - memleak in cleanup code of migration to file (1/9) - wrong place where 'manual' external disk snapshot is taken (2/9) - bad interaction between 'manual' snapshot and the _QUIESCE flag (3/9) - constants for save image types not exposed (6/9) - use of wrong 'flags' in migration to file code (8/9) The series contains also few cleanups and improvements: - bash completion for save image type (7/9) - use of proper types for save image type (4,5/9) - avoid problems with 'flags' in qemuMigrationParamsForSave (9/9) Part 2 will focus on some code cleanups. Peter Krempa (9): qemuMigrationSrcToFile: Don't leak 'qemuFDPass' in cleanup path qemu: snapshot: Setup disks for manual snapshot only when the VM is actually paused qemuSnapshotPrepare: Prohibit 'manual' disk snapshot mode with VIR_DOMAIN_SNAPSHOT_CREATE_QUIESCE flag qemu: Use 'virQEMUSaveFormat' type everywhere except qemu_conf qemu: conf: Use proper type for (save|dump|snapshot)ImageFormat include: Create constants for save image format values virsh: Add completer for '--image-format' option of 'save' command qemuMigrationSrcToFile: Don't cross-contaminate 'flags' variable qemuMigrationParamsForSave: Don't take opaque 'flags' include/libvirt/libvirt-domain.h | 87 ++++++++++++++++++++++++++++++-- src/qemu/qemu_conf.c | 48 ++++++++++++------ src/qemu/qemu_conf.h | 7 +-- src/qemu/qemu_driver.c | 29 +++++++---- src/qemu/qemu_migration.c | 14 ++--- src/qemu/qemu_migration.h | 2 +- src/qemu/qemu_migration_params.c | 4 +- src/qemu/qemu_migration_params.h | 2 +- src/qemu/qemu_saveimage.c | 22 ++++---- src/qemu/qemu_saveimage.h | 24 ++------- src/qemu/qemu_saveimage_format.h | 25 +++++++++ src/qemu/qemu_snapshot.c | 14 +++-- tools/virsh-domain.c | 21 ++++++++ 13 files changed, 224 insertions(+), 75 deletions(-) create mode 100644 src/qemu/qemu_saveimage_format.h -- 2.52.0

2 10

[PATCH 0/2] qemu: Treat memory device source nodemask as strict NUMA policy
by Michal Privoznik 09 Dec '25

09 Dec '25

*** BLURB HERE *** Michal Prívozník (2): qemuxmlconftest: Introduce memory-hotplug-numa-preferred test case qemu: Treat memory device source nodemask as strict NUMA policy src/qemu/qemu_command.c | 6 ++ ...-hotplug-numa-preferred.x86_64-latest.args | 44 ++++++++++++ ...y-hotplug-numa-preferred.x86_64-latest.xml | 1 + .../memory-hotplug-numa-preferred.xml | 68 +++++++++++++++++++ tests/qemuxmlconftest.c | 1 + 5 files changed, 120 insertions(+) create mode 100644 tests/qemuxmlconfdata/memory-hotplug-numa-preferred.x86_64-latest.args create mode 120000 tests/qemuxmlconfdata/memory-hotplug-numa-preferred.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/memory-hotplug-numa-preferred.xml -- 2.51.2

2 3

[PATCH] qemu: tpm: Account for possible migration without actually sharing storage
by Peter Krempa 08 Dec '25

08 Dec '25

From: Peter Krempa <pkrempa(a)redhat.com> The current logic in 'qemuTPMEmulatorBuildCommand' skips all setup if the *location* of the data is on what we'd consider shared storage. This means that if the location is not actually shared (e.g. it's shared betweeh some other hosts than the two doing the migration) and the path wasn't ever used (e.g. by migrating out) from the host where we're migrating into the complete setup of the location would be skipped even when it doesn't exist. Fix the logic by skipping only some of the setup steps so that 'qemuTPMEmulatorCreateStorage' can still create the storage if it doesn't exist. The rest of the code then needs to take the 'created' flag returned from 'qemuTPMEmulatorCreateStorage' into account. Fixes: 68103e9daf633b789428fedef56f816c92f6ee75 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_tpm.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index 4c9445d72c..1ce6390fd5 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -158,6 +158,7 @@ qemuTPMEmulatorGetPid(const char *swtpmStateDir, /** * qemuTPMEmulatorCreateStorage: * @tpm: TPM definition for an emulator type + * @sharedStorageMigration: VM is being migrated with possibly shared storage * @created: a pointer to a bool that will be set to true if the * storage was created because it did not exist yet * @swtpm_user: The uid that needs to be able to access the directory @@ -169,6 +170,7 @@ qemuTPMEmulatorGetPid(const char *swtpmStateDir, */ static int qemuTPMEmulatorCreateStorage(virDomainTPMDef *tpm, + bool sharedStorageMigration, bool *created, uid_t swtpm_user, gid_t swtpm_group) @@ -187,8 +189,14 @@ qemuTPMEmulatorCreateStorage(virDomainTPMDef *tpm, *created = false; if (!virFileExists(source_path) || - virDirIsEmpty(source_path, true) > 0) + virDirIsEmpty(source_path, true) > 0) { *created = true; + } else { + /* If the location exists and is shared, we don't need to create it + * during migration */ + if (sharedStorageMigration) + return 0; + } if (virDirCreate(source_path, 0700, swtpm_user, swtpm_group, VIR_DIR_CREATE_ALLOW_EXIST) < 0) { @@ -809,16 +817,13 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm, run_setup = true; } - /* Do not create storage and run swtpm_setup on incoming migration over - * shared storage - */ on_shared_storage = virFileIsSharedFS(tpm->data.emulator.source_path, cfg->sharedFilesystems) == 1; - if (incomingMigration && on_shared_storage) - create_storage = false; if (create_storage) { - if (qemuTPMEmulatorCreateStorage(tpm, &created, + if (qemuTPMEmulatorCreateStorage(tpm, + incomingMigration && on_shared_storage, + &created, cfg->swtpm_user, cfg->swtpm_group) < 0) return NULL; run_setup = created; @@ -885,6 +890,9 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm, /* If swtpm supports it and the TPM state is stored on shared storage, * start swtpm with --migration release-lock-outgoing so it can migrate * across shared storage if needed. + * + * Note that if 'created' is true, the location didn't exist so the storage + * is not actually shared. */ QEMU_DOMAIN_TPM_PRIVATE(tpm)->swtpm.can_migrate_shared_storage = false; if (on_shared_storage && @@ -892,13 +900,13 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm, virCommandAddArg(cmd, "--migration"); virCommandAddArgFormat(cmd, "release-lock-outgoing%s", - incomingMigration ? ",incoming": ""); + incomingMigration && !created ? ",incoming": ""); QEMU_DOMAIN_TPM_PRIVATE(tpm)->swtpm.can_migrate_shared_storage = true; } else { /* Report an error if there's an incoming migration across shared * storage and swtpm does not support the --migration option. */ - if (incomingMigration && on_shared_storage) { + if (incomingMigration && on_shared_storage && !created) { virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, _("%1$s (on destination side) does not support the --migration option needed for migration with shared storage"), swtpm); -- 2.52.0

2 3

[PATCH v2] NEWS: Mention the passt hostname and fqdn attributes
by Han Han 08 Dec '25

08 Dec '25

Signed-off-by: Han Han <hhan(a)redhat.com> --- V1: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/NT3X… NEWS.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 01efe82c97..28641ec1a1 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -217,6 +217,11 @@ v11.8.0 (2025-10-01) On the XML side, the existing ``<acpi>`` element has been extended with a ``nodeset`` attribute to specify the NUMA node affinity of a PCI device. + * qemu: Add support for hostname and FQDN configration of passt backend + + The attributes ``hostname`` and ``fqdn`` for passt backend configure + the guest interface with hostname and FQDN. + * **Improvements** * ch: Events emitting -- 2.52.0

2 1

[PATCH 0/1] qemu: Use pci_bus to identify multi-smmuv3 model
by Nathan Chen 06 Dec '25

06 Dec '25

The previous qemu virt-machine smmuv3 model and the new arm-smmuv3 model cannot both be specified at the same time. When launching a Libvirt VM with a single arm-smmuv3 model denoted by the <pciBus> attribute, qemuBuildMachineCommandLine() still appends the iommu=smmuv3 -machine parameter in addition to the arm-smmuv3 model passed to -device, preventing the VM from booting. Use the presence of a non-negative pci_bus to identify the multi-smmuv3 IOMMU model, instead of the niommus attribute. This allows for specifying a single arm-smmuv3 on the qemu command line, instead of both the virt-machine smmuv3 and arm-smmuv3 being specified at the same time. This patch is available on Github [0]. [0] https://github.com/NathanChenNVIDIA/libvirt/commits/single-smmuv3-12-25/ Signed-off-by: Nathan Chen <nathanc(a)nvidia.com> Nathan Chen (1): qemu: Use pci_bus to identify multi-smmuv3 model src/qemu/qemu_command.c | 2 +- src/qemu/qemu_postparse.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) -- 2.43.0

2 5

[PULL 14/14] aspeed: Deprecate the fby35 machine
by Alex Bennée 06 Dec '25

06 Dec '25

From: Cédric Le Goater <clg(a)redhat.com> There are no functional tests for the 'fby35' machine which makes harder to determine when something becomes deprecated or unused. The 'fby35' machine was originally added as an example of a multi-SoC system, with the expectation the models would evolve over time in an heterogeneous system. This hasn't happened and no public firmware is available to boot it. It can be replaced by the 'ast2700fc', another multi-SoC machine based on the newer AST2700 SoCs which are excepted to receive better support in the future. Cc: Peter Delevoryas <peter(a)pjd.dev> Signed-off-by: Cédric Le Goater <clg(a)redhat.com> Message-ID: <20251126102424.927527-1-clg(a)redhat.com> Signed-off-by: Alex Bennée <alex.bennee(a)linaro.org> diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 9386cffba26..ac31a2bce42 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -308,13 +308,24 @@ I2C devices connected to the board can be defined via the QEMU command line. Arm ``fp5280g2-bmc`` machine (since 10.2) -''''''''''''''''''''''''''''''''''''''''''' +''''''''''''''''''''''''''''''''''''''''' The ``fp5280g2-bmc`` machine does not rely on any specific device models, it can be replaced by the ``ast2500-evb`` machine using the ``fmc-model`` option to specify the flash type. The I2C devices connected to the board can be defined via the QEMU command line. +Arm ``fby35`` machine (since 10.2) +'''''''''''''''''''''''''''''''''' + +The ``fby35`` machine was originally added as an example of a +multi-SoC system, with the expectation the models would evolve over +time in an heterogeneous system. This hasn't happened and no public +firmware is available to boot it. It can be replaced by the +``ast2700fc``, another multi-SoC machine based on the newer AST2700 +SoCs which are excepted to receive better support in the future. + + RISC-V default machine option (since 10.0) '''''''''''''''''''''''''''''''''''''''''' diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c index 70d3a99d79e..e61a6438fef 100644 --- a/hw/arm/fby35.c +++ b/hw/arm/fby35.c @@ -175,6 +175,7 @@ static void fby35_class_init(ObjectClass *oc, const void *data) MachineClass *mc = MACHINE_CLASS(oc); mc->desc = "Meta Platforms fby35"; + mc->deprecation_reason = "For a multi-soc machine, use 'ast2700fc' instead"; mc->init = fby35_init; mc->no_floppy = 1; mc->no_cdrom = 1; -- 2.47.3

1 0

[PATCH] ci: refresh with 'lcitool manifest'
by Michal Privoznik 04 Dec '25

04 Dec '25

From: Michal Privoznik <mprivozn(a)redhat.com> Update FreeBSD to their new minor versions. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Green pipeline (although it doesn't show cirrus jobs): https://gitlab.com/MichalPrivoznik/libvirt/-/pipelines/2194225996 There is also FreeBSD 15.0 which was released yesterday. But there are some issues with its availability in cirrus [1] so I'm not updating the majo version, for now. 1: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291354 ci/gitlab/builds.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ci/gitlab/builds.yml b/ci/gitlab/builds.yml index a98b0d9c46..fe1468ff81 100644 --- a/ci/gitlab/builds.yml +++ b/ci/gitlab/builds.yml @@ -515,7 +515,7 @@ x86_64-freebsd-13: allow_failure: exit_codes: 3 variables: - CIRRUS_VM_IMAGE_NAME: freebsd-13-4 + CIRRUS_VM_IMAGE_NAME: freebsd-13-5 CIRRUS_VM_IMAGE_SELECTOR: image_family CIRRUS_VM_INSTANCE_TYPE: freebsd_instance INSTALL_COMMAND: pkg install -y @@ -530,7 +530,7 @@ x86_64-freebsd-14: allow_failure: exit_codes: 3 variables: - CIRRUS_VM_IMAGE_NAME: freebsd-14-2 + CIRRUS_VM_IMAGE_NAME: freebsd-14-3 CIRRUS_VM_IMAGE_SELECTOR: image_family CIRRUS_VM_INSTANCE_TYPE: freebsd_instance INSTALL_COMMAND: pkg install -y -- 2.51.2

2 1

[PATCH] NEWS: Mention the passt hostname and fqdn attributes
by Han Han 03 Dec '25

03 Dec '25

Signed-off-by: Han Han <hhan(a)redhat.com> --- NEWS.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 91ed53ba7e..1b2b8778b1 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -205,6 +205,12 @@ v11.8.0 (2025-10-01) On the XML side, the existing ``<acpi>`` element has been extended with a ``nodeset`` attribute to specify the NUMA node affinity of a PCI device. + * qemu: Add support for hostname and FQDN configration of passt backend + + Implement passt ``--hostname`` and ``--hostname`` options to libvirt via the + interface attributes ``hostname`` and ``fqdn`` of passt backend. They configure + the guest interface with hostname and FQDN. + * **Improvements** * ch: Events emitting -- 2.52.0

2 2

[RFC v3 0/5] cover: RFE libvirt secret encryption on disk
by Arun Menon 02 Dec '25

02 Dec '25

Libvirt secrets are stored unencrypted on the disk. With this series we want to start encrypting the secrets. 1. Introduce the GnuTLS decryption wrapper functions that work exact opposite to the encryption wrappers. 2. Add a new service called virt-secrets-init-encryption, that is linked to the virtsecretd service. virtsecretd service only starts after the new service generates a random encryption key. 3. Add a new secrets.conf configuration file that helps user to set a. secrets_encryption_key - allows the user to specify the encryption key file path, in case the default key is not to be used. b. encrypt_data - set to 0 or 1. If set to 1, then the newly added secrets will be encrypted. 4. Add encryption scheme or cipher attribute that will allow us to choose the last used cipher. 5. Once we have the encryption key, and a reliable way to tell the daemon what encryption scheme the secret object is using, we can encrypt the secrets on disk and store them in <uuid>.<encryption_scheme> format. It is important to note that if the encryption key is changed between restarts, then the respective secret will not be loaded by the driver. This is a sincere attempt to improve upon the already submitted patch https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/KE6G… Resolves: https://issues.redhat.com/browse/RHEL-7125 --- Changes in v3: - Secrets xml configuration no longer stores the encryption scheme, therefore not allowing the user to toggle between ciphers. - Removed unnecessary socket files of the new service. It now has a general configuration with which it starts. - Addressed review comments from Peter on coding style and design. - Loading of secrets is dependent on the file extension. Most recent cipher is used while saving the secrets. Changes in v2: - Corrected the encryption key length check. It should be 32. - Added a new patch that introduces the encryption scheme attribute. This will help us identify which secrets are encrypted. - A new systemd unit service file added that starts before virtsecretd, helping us to construct a random encryption key and pass it to the virtsecretd service. - Parsing logic of secrets.conf moved to a separate file. - Spec file changes, augeas. Arun Menon (5): util: Add support for GnuTLS decryption secret: Set up default encryption secret key for the virtsecretd service secret: Add secrets.conf configuration file and parse it secret: Add encryptionSchemeType attribute to store ciphers secret: Add functionality to load and save secrets in encrypted format include/libvirt/libvirt-secret.h | 20 +++ libvirt.spec.in | 7 + po/POTFILES | 1 + src/conf/meson.build | 1 + src/conf/secret_conf.h | 1 + src/conf/secret_config.c | 177 ++++++++++++++++++++++++ src/conf/secret_config.h | 38 +++++ src/conf/virsecretobj.c | 177 ++++++++++++++++++------ src/conf/virsecretobj.h | 13 +- src/libvirt_private.syms | 3 + src/meson.build | 1 + src/secret/libvirt_secrets.aug | 40 ++++++ src/secret/meson.build | 42 ++++++ src/secret/secret-init-encryption.in | 10 ++ src/secret/secret_driver.c | 27 +++- src/secret/secrets.conf.in | 12 ++ src/secret/test_libvirt_secrets.aug.in | 6 + src/secret/virtsecretd.service.extra.in | 8 ++ src/util/vircrypto.c | 126 ++++++++++++++++- src/util/vircrypto.h | 8 ++ src/util/virsecret.c | 4 + src/util/virsecret.h | 1 + tests/vircryptotest.c | 65 +++++++++ 23 files changed, 735 insertions(+), 53 deletions(-) create mode 100644 src/conf/secret_config.c create mode 100644 src/conf/secret_config.h create mode 100644 src/secret/libvirt_secrets.aug create mode 100644 src/secret/secret-init-encryption.in create mode 100644 src/secret/secrets.conf.in create mode 100644 src/secret/test_libvirt_secrets.aug.in -- 2.51.1

3 21

[PATCH 0/8] Avoid changing const string via strchr() and friends
by Michal Privoznik 02 Dec '25

02 Dec '25

This stems from the discussion here: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/HVMC… Green pipeline here: https://gitlab.com/MichalPrivoznik/libvirt/-/pipelines/2183169334 Michal Prívozník (8): vircommand: Update documentation to virCommandSetDryRun() virstringtest: Introduce a test for virSkipSpacesBackwards() virfirewalltest: Introduce testIPtablesSetupPrivateChains() virSkipSpacesBackwards: Turn @endp into const iptablesPrivateChainCreate: Rename @tmp variable iptablesPrivateChainCreate: Switch to STRSKIP() iptablesPrivateChainCreate: Avoid modifying const string lib: Avoid changing const strings via strchr() and friends src/interface/interface_backend_udev.c | 2 +- src/libxl/xen_common.c | 10 +- src/libxl/xen_xm.c | 10 +- src/network/meson.build | 1 + src/network/network_iptables.c | 33 ++++--- src/node_device/node_device_udev.c | 2 +- src/nwfilter/nwfilter_ebiptables_driver.c | 4 +- src/qemu/qemu_monitor_json.c | 2 +- src/qemu/qemu_nbdkit.c | 2 +- src/rpc/virnetsshsession.c | 5 +- src/storage/storage_util.c | 2 +- src/storage_file/storage_source.c | 4 +- src/util/vircgroup.c | 2 +- src/util/vircommand.c | 10 +- src/util/virfile.c | 2 +- src/util/virstoragefile.c | 4 +- src/util/virstring.c | 20 ++-- src/util/virstring.h | 2 +- src/util/virsysinfo.c | 22 ++--- src/util/virxml.c | 3 +- src/vmware/vmware_conf.c | 2 +- tests/meson.build | 9 +- tests/virfirewalltest.c | 111 ++++++++++++++++++++++ tests/virstringtest.c | 48 ++++++++++ tools/vsh.c | 6 +- 25 files changed, 252 insertions(+), 66 deletions(-) -- 2.51.2

3 11