January 2026 - Devel - libvirt List Archives

[PATCH v4 0/6] cover: RFE libvirt secret encryption on disk
by Arun Menon 07 Feb '26

07 Feb '26

Libvirt secrets are stored unencrypted on the disk. With this series we want to start encrypting the secrets. 1. Introduce the GnuTLS decryption wrapper functions that work exact opposite to the encryption wrappers. 2. Add a new service called virt-secrets-init-encryption, that is linked to the virtsecretd service. virtsecretd service only starts after the new service generates a random encryption key. 3. Add a new secrets.conf configuration file that helps user to set a. secrets_encryption_key - allows the user to specify the encryption key file path, in case the default key is not to be used. b. encrypt_data - set to 0 or 1. If set to 1, then the newly added secrets will be encrypted. 4. Add encryption scheme or cipher attribute that will allow us to choose the last used cipher. 5. Once we have the encryption key, and a reliable way to tell the daemon what encryption scheme the secret object is using, we can encrypt the secrets on disk and store them in <uuid>.<encryption_scheme> format. It is important to note that if the encryption key is changed between restarts, then the respective secret will not be loaded by the driver. 6. Add documentation. This is a sincere attempt to improve upon the already submitted patch https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/KE6G… Resolves: https://issues.redhat.com/browse/RHEL-7125 --- Changes in v3: - Fix the regression of loading unencrypted secrets after an upgrade. Previously the .base64 unencrypted secrets were not being loaded. - Add documentation on encrypted secrets. Changes in v3: - Secrets xml configuration no longer stores the encryption scheme, therefore not allowing the user to toggle between ciphers. - Removed unnecessary socket files of the new service. It now has a general configuration with which it starts. - Addressed review comments from Peter on coding style and design. - Loading of secrets is dependent on the file extension. Most recent cipher is used while saving the secrets. Changes in v2: - Corrected the encryption key length check. It should be 32. - Added a new patch that introduces the encryption scheme attribute. This will help us identify which secrets are encrypted. - A new systemd unit service file added that starts before virtsecretd, helping us to construct a random encryption key and pass it to the virtsecretd service. - Parsing logic of secrets.conf moved to a separate file. - Spec file changes, augeas. Arun Menon (6): util: Add support for GnuTLS decryption secret: Set up default encryption secret key for the virtsecretd service secret: Add secret.conf configuration file and parse it secret: Rename virSecretObj structure attribute from base64File to secretValueFile secret: Add functionality to load and save secrets in encrypted format docs: secret: Add documentation of secret encryption feature docs/drvsecret.rst | 4 + docs/meson.build | 1 + docs/secretencryption.rst | 86 ++++++++ include/libvirt/virterror.h | 1 + libvirt.spec.in | 8 + po/POTFILES | 1 + src/conf/virsecretobj.c | 193 ++++++++++++++---- src/conf/virsecretobj.h | 18 +- src/libvirt_private.syms | 1 + src/meson.build | 1 + src/remote/libvirtd.service.in | 4 + src/secret/libvirt_secrets.aug | 40 ++++ src/secret/meson.build | 32 +++ src/secret/secret.conf.in | 14 ++ src/secret/secret_config.c | 179 ++++++++++++++++ src/secret/secret_config.h | 40 ++++ src/secret/secret_driver.c | 34 ++- src/secret/test_libvirt_secrets.aug.in | 6 + .../virt-secret-init-encryption.service.in | 8 + src/secret/virtsecretd.service.extra.in | 8 + src/util/vircrypto.c | 126 +++++++++++- src/util/vircrypto.h | 8 + src/util/virerror.c | 3 + tests/vircryptotest.c | 65 ++++++ 24 files changed, 831 insertions(+), 50 deletions(-) create mode 100644 docs/secretencryption.rst create mode 100644 src/secret/libvirt_secrets.aug create mode 100644 src/secret/secret.conf.in create mode 100644 src/secret/secret_config.c create mode 100644 src/secret/secret_config.h create mode 100644 src/secret/test_libvirt_secrets.aug.in create mode 100644 src/secret/virt-secret-init-encryption.service.in -- 2.51.1

2 14

[PATCH] virt-aa-helper: Fix unchecked return values
by Dmitry Lopatin 06 Feb '26

06 Feb '26

Add missing return value checks to fix the following issues reported by the static analyzer: - vah_add_file() call when adding render node path to the AppArmor profile (line 1029) was not checked, while there are examples with return code check throughout the code. - vah_add_file() call when adding default render node path (line 1037) had the same issue. - virDriverLoadModule() call when loading the storage driver (line 908) was not checked, while there are examples with return code check throughout the code. Signed-off-by: Dmitry Lopatin <dmitry.lopatin(a)flant.com> --- src/security/virt-aa-helper.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 067a17f331..07e5882237 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -905,7 +905,8 @@ get_files(vahControl * ctl) /* load the storage driver so that backing store can be accessed */ #ifdef WITH_STORAGE - virDriverLoadModule("storage", "storageRegister", false); + if (virDriverLoadModule("storage", "storageRegister", false) < 0) + goto cleanup; #endif for (i = 0; i < ctl->def->ndisks; i++) { @@ -1026,7 +1027,8 @@ get_files(vahControl * ctl) const char *rendernode = virDomainGraphicsGetRenderNode(graphics); if (rendernode) { - vah_add_file(&buf, rendernode, "rw"); + if (vah_add_file(&buf, rendernode, "rw") != 0) + goto cleanup; needsgl = true; } else { if (virDomainGraphicsNeedsAutoRenderNode(graphics)) { @@ -1034,7 +1036,8 @@ get_files(vahControl * ctl) needsgl = true; if (defaultRenderNode) { - vah_add_file(&buf, defaultRenderNode, "rw"); + if (vah_add_file(&buf, defaultRenderNode, "rw") != 0) + goto cleanup; VIR_FREE(defaultRenderNode); } } -- 2.34.1

5 9

[PATCH 0/4] qemu: Automatically add USB controller if USB devices are present
by Andrea Bolognani 06 Feb '26

06 Feb '26

Makes things more user-friendly for those machine types where a default USB controller is normally not automatically added. https://issues.redhat.com/browse/RHEL-2455 Andrea Bolognani (4): tests: Add usb-controller-automatic-with-devices-virt-aarch64 conf: Rename virDomainDefHasUSB() to virDomainDefHasUSBControllers() conf: Introduce virDomainDefHasUSBDevices() qemu: Automatically add USB controller if USB devices are present src/conf/domain_conf.c | 31 +++++++++++++- src/conf/domain_conf.h | 3 +- src/conf/domain_validate.c | 2 +- src/libvirt_private.syms | 3 +- src/qemu/qemu_domain_address.c | 2 +- src/qemu/qemu_postparse.c | 11 +++++ ...h-devices-virt-aarch64.aarch64-latest.args | 36 ++++++++++++++++ ...th-devices-virt-aarch64.aarch64-latest.xml | 41 +++++++++++++++++++ ...er-automatic-with-devices-virt-aarch64.xml | 14 +++++++ tests/qemuxmlconftest.c | 2 + 10 files changed, 139 insertions(+), 6 deletions(-) create mode 100644 tests/qemuxmlconfdata/usb-controller-automatic-with-devices-virt-aarch64.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/usb-controller-automatic-with-devices-virt-aarch64.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/usb-controller-automatic-with-devices-virt-aarch64.xml -- 2.52.0

2 7

[PATCH v2 0/7] virtio-iommu: Support setting aw-bits and granule
by Michal Privoznik 06 Feb '26

06 Feb '26

v2 of: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/3HN6… diff to v1: - setting of granule is done in a subelement of driver now Michal Prívozník (7): conf: Teach virDomainParseMemory() new retval qemu_capabilities: Introduce QEMU_CAPS_VIRTIO_IOMMU_AW_BITS conf: Allow aw_bits for virtio-iommu qemu_command: Generate aw_bits prop for virtio-iommu conf: Introduce granule attribute for virtio-iommu qemu_validate: Check whether granule of virtio-iommu is supported qemu_command: Generate granule prop for virtio-iommu docs/formatdomain.rst | 40 +++++++- src/conf/domain_conf.c | 95 +++++++++++++++++-- src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 21 +++- src/conf/schemas/domaincommon.rng | 22 +++++ src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 11 +++ src/qemu/qemu_validate.c | 30 +++++- .../caps_10.0.0_aarch64.xml | 1 + .../caps_10.0.0_ppc64.xml | 1 + .../caps_10.0.0_s390x.xml | 1 + .../caps_10.0.0_x86_64+amdsev.xml | 1 + .../caps_10.0.0_x86_64.xml | 1 + .../caps_10.1.0_s390x.xml | 1 + .../caps_10.1.0_x86_64+inteltdx.xml | 1 + .../caps_10.1.0_x86_64.xml | 1 + .../caps_10.2.0_aarch64.xml | 1 + .../caps_10.2.0_x86_64+mshv.xml | 1 + .../caps_10.2.0_x86_64.xml | 1 + .../caps_11.0.0_aarch64.xml | 1 + .../caps_11.0.0_x86_64.xml | 1 + .../caps_9.0.0_x86_64.xml | 1 + .../caps_9.1.0_riscv64.xml | 1 + .../qemucapabilitiesdata/caps_9.1.0_s390x.xml | 1 + .../caps_9.1.0_x86_64.xml | 1 + .../caps_9.2.0_aarch64+hvf.xml | 1 + .../qemucapabilitiesdata/caps_9.2.0_s390x.xml | 1 + .../caps_9.2.0_x86_64+amdsev.xml | 1 + .../caps_9.2.0_x86_64.xml | 1 + .../virtio-iommu-aarch64.aarch64-latest.args | 2 +- .../virtio-iommu-aarch64.aarch64-latest.xml | 3 + .../qemuxmlconfdata/virtio-iommu-aarch64.xml | 6 +- ...io-iommu-dma-translation.x86_64-latest.err | 2 +- .../virtio-iommu-x86_64.x86_64-latest.args | 2 +- .../virtio-iommu-x86_64.x86_64-latest.xml | 3 + tests/qemuxmlconfdata/virtio-iommu-x86_64.xml | 6 +- 37 files changed, 247 insertions(+), 21 deletions(-) -- 2.52.0

2 11

[PATCH 1/2] bhyve: do not use deprecated IOAPIC option
by Roman Bogorodskiy 06 Feb '26

06 Feb '26

The '-I' flag for enabling IOAPIC was deprecated long ago in bhyve: https://cgit.freebsd.org/src/commit/?id=a1a4cbea587a6e201e07dc121268f3e559e… And IOAPIC is provided unconditionally since then. As no supported FreeBSD versions require that now, simply drop this flag. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve_command.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/bhyve/bhyve_command.c b/src/bhyve/bhyve_command.c index a45a5d1c33..97a483d9a5 100644 --- a/src/bhyve/bhyve_command.c +++ b/src/bhyve/bhyve_command.c @@ -953,8 +953,6 @@ virBhyveProcessBuildBhyveCmd(struct _bhyveConn *driver, virDomainDef *def, /* Options */ if (def->features[VIR_DOMAIN_FEATURE_ACPI] == VIR_TRISTATE_SWITCH_ON) virCommandAddArg(cmd, "-A"); /* Create an ACPI table */ - if (def->features[VIR_DOMAIN_FEATURE_APIC] == VIR_TRISTATE_SWITCH_ON) - virCommandAddArg(cmd, "-I"); /* Present ioapic to the guest */ if (def->features[VIR_DOMAIN_FEATURE_MSRS] == VIR_TRISTATE_SWITCH_ON) { if (def->msrs_features[VIR_DOMAIN_MSRS_UNKNOWN] == VIR_DOMAIN_MSRS_UNKNOWN_IGNORE) virCommandAddArg(cmd, "-w"); -- 2.52.0

1 3

[PATCH v10 0/8] blockdev-replace
by Vladimir Sementsov-Ogievskiy 05 Feb '26

05 Feb '26

Hi all! This series presents a new command blockdev-replace, which helps to insert/remove filters anywhere in the block graph. It can: - replace qdev block-node by qdev-id - replace export block-node by export-id - replace any child of parent block-node by node-name and child name So insertions is done in two steps: 1. blockdev_add (create filter node, unparented) [some parent] [new filter] | | V V [ some child ] 2. blockdev-replace (replace child by the filter) [some parent] | V [new filter] | V [some child] And removal is done in reverse order: 1. blockdev-replace (go back to picture 1) 2. blockdev_del (remove filter node) Ideally, we should do both operations (add + replace or replace + del) in a transaction, but that should be another series. v10: reabsed on master. 02: change exp-blk check into assert 04: rewrite to simpler API (on unique parent id) 07: switch to new API 08: new Vladimir Sementsov-Ogievskiy (8): block-backend: blk_root(): drop const specifier on return type block/export: add blk_by_export_id() block: make bdrv_find_child() function public qapi: add blockdev-replace command block: bdrv_get_xdbg_block_graph(): report export ids iotests.py: introduce VM.assert_edges_list() method iotests: add filter-insertion deprecate names duplication between qdev, block-node and block-export block.c | 29 +++ block/block-backend.c | 2 +- block/export/export.c | 41 ++++ blockdev.c | 82 +++++-- docs/about/deprecated.rst | 10 + include/block/block-global-state.h | 1 + include/block/block_int-io.h | 2 + include/block/export.h | 1 + include/system/block-backend-global-state.h | 5 +- qapi/block-core.json | 24 ++ stubs/blk-by-qdev-id.c | 18 ++ stubs/blk-exp-find-by-blk.c | 13 + stubs/meson.build | 2 + system/qdev-monitor.c | 16 ++ tests/qemu-iotests/iotests.py | 17 ++ tests/qemu-iotests/tests/filter-insertion | 222 ++++++++++++++++++ tests/qemu-iotests/tests/filter-insertion.out | 5 + 17 files changed, 474 insertions(+), 16 deletions(-) create mode 100644 stubs/blk-by-qdev-id.c create mode 100644 stubs/blk-exp-find-by-blk.c create mode 100755 tests/qemu-iotests/tests/filter-insertion create mode 100644 tests/qemu-iotests/tests/filter-insertion.out -- 2.52.0

2 13

[PATCH 0/3] apparmor: Separate seclabel generation and profile loading
by Michal Privoznik 04 Feb '26

04 Feb '26

See 3/3 for explanation. Michal Prívozník (3): security: Introduce virSecurityDomainLoadProfile() qemu: Call virSecurityManagerLoadProfile() at the end of qemuProcessPrepareDomain() security_apparmor: Move profile loading into .domainLoadProfile callback src/libvirt_private.syms | 1 + src/qemu/qemu_process.c | 7 +++++++ src/qemu/qemu_security.h | 1 + src/security/security_apparmor.c | 31 +++++++++++++++++++++++-------- src/security/security_driver.h | 4 ++++ src/security/security_manager.c | 13 +++++++++++++ src/security/security_manager.h | 2 ++ src/security/security_stack.c | 15 +++++++++++++++ 8 files changed, 66 insertions(+), 8 deletions(-) -- 2.52.0

2 4

Download of volume: alternating frames of 262120 and 24 bytes
by Erik Huelsmann 04 Feb '26

04 Feb '26

Hi, While analysing traffic generated by "virsh vol-download", I noticed that the download stream exhibits the following pattern (over qemu+ssh://): <Start> Read 4 bytes (= frame length field) Read 262144 bytes (= header + payload ; VIR_NET_MESSAGE_HEADER_MAX (24) + VIR_NET_MESSAGE_LEGACY_PAYLOAD_MAX (262120)) Read 4 bytes (= frame length field) Read 48 bytes (= header + payload) <Go back to Start> While nothing seems to be actually wrong with this pattern, the average payload on large data transfers is only (262120+24)/2 == 131072 and the CPU makes double the iterations necessary. I'll be trying to figure out where this comes from, but I imagine that will be pretty hard to track down. Two questions: 1. Do you see the same thing? 2. Any ideas/hints where I could start looking? Regards, -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

2 8

[PATCH v2 0/2] bhyve: improve loader handling on arm64
by Roman Bogorodskiy 04 Feb '26

04 Feb '26

Changes since v1: - Make the default loader uboot path configurable in bhyve.conf. It might be useful for users and also way simpler to mock in the test than the hardcoded value in the code. Roman Bogorodskiy (2): bhyve: improve loader handling on arm64 bhyve: conf: do not hardcode datadir in bhyve.conf src/bhyve/{bhyve.conf => bhyve.conf.in} | 7 +++++- src/bhyve/bhyve_conf.c | 8 +++++++ src/bhyve/bhyve_domain.c | 23 +++++++++++++++++++ src/bhyve/bhyve_utils.h | 2 ++ src/bhyve/meson.build | 13 +++++++++-- .../aarch64/bhyvexml2argv-base.args | 1 + .../aarch64/bhyvexml2argv-base.ldargs | 8 +------ .../aarch64/bhyvexml2argv-console.args | 1 + .../aarch64/bhyvexml2argv-console.ldargs | 8 +------ tests/bhyvexml2argvmock.c | 20 +++++++++++++++- tests/bhyvexml2argvtest.c | 2 ++ .../aarch64/bhyvexml2xmlout-base.xml | 1 + .../aarch64/bhyvexml2xmlout-console.xml | 1 + tests/bhyvexml2xmltest.c | 4 ++++ 14 files changed, 81 insertions(+), 18 deletions(-) rename src/bhyve/{bhyve.conf => bhyve.conf.in} (73%) -- 2.52.0

2 6

[PATCH] build: add detection of xdrproc_t arguments count
by Roman Bogorodskiy 04 Feb '26

04 Feb '26

According to 9fa3a8ab6fd82ad2f5a14b490696085061418718, macOS insists on passing 3 arguments for xdrproc_t. Passing 3 arguments was a good common ground, but since recently[1] FreeBSD only accepts 2 arguments. Add a meson.build check whether 3 arguments are accepted, and add macros which passes either 2 or 3 arguments to xdrproc_t based on the result of this check. 1: https://cgit.freebsd.org/src/commit/?id=ac5a19ec6989675c8ec6c3ca245dba243d1… Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- meson.build | 19 +++++++++++++++++++ scripts/rpcgen/tests/test_demo.c | 12 +++++++++--- src/rpc/virnetmessage.c | 10 ++++++++-- 3 files changed, 36 insertions(+), 5 deletions(-) diff --git a/meson.build b/meson.build index 964d1fa4e1..4a4f89c1cb 100644 --- a/meson.build +++ b/meson.build @@ -893,6 +893,25 @@ else xdr_dep = dependency('', required: false) endif +if xdr_dep.found() + xdrproc_3arg_code = ''' + #include <rpc/xdr.h> + + bool_t test_filter(XDR *xdr, void *data, unsigned int opaque_flags) { + return TRUE; + } + + int main() { + XDR xdr; + xdrproc_t filter = (xdrproc_t)&test_filter; + (*filter)(&xdr, NULL, 0); + return 0; + } + ''' + if cc.compiles(xdrproc_3arg_code, dependencies: xdr_dep) + conf.set('XDRPROC_T_3ARGS', 1) + endif +endif # generic build dependencies diff --git a/scripts/rpcgen/tests/test_demo.c b/scripts/rpcgen/tests/test_demo.c index e6ba7ddbc5..82eda89592 100644 --- a/scripts/rpcgen/tests/test_demo.c +++ b/scripts/rpcgen/tests/test_demo.c @@ -8,6 +8,12 @@ # define xdr_uint64_t xdr_u_int64_t #endif +#if defined(XDRPROC_T_3ARGS) +# define XDRPROC(proc, xdr, data) (proc(&xdr, data, 0)) +#else +# define XDRPROC(proc, xdr, data) (proc(&xdr, data)) +#endif + #include "demo.h" #include "demo.c" @@ -27,7 +33,7 @@ static void test_xdr(xdrproc_t proc, void *vorig, void *vnew, const char *testna /* Step 1: serialize the vorig and compare to the data in test .bin files */ xdrmem_create(&xdr, buf, buflen, XDR_ENCODE); - ret = !!proc(&xdr, vorig, 0); + ret = !!XDRPROC(proc, xdr, vorig); g_assert_cmpint(ret, ==, !fail); if (fail) @@ -54,7 +60,7 @@ static void test_xdr(xdrproc_t proc, void *vorig, void *vnew, const char *testna /* Step 2: de-serialize the state to create a new object */ xdrmem_create(&xdr, buf, buflen, XDR_DECODE); - ret = !!proc(&xdr, vnew, 0); + ret = !!XDRPROC(proc, xdr, vnew); g_assert_cmpint(ret, ==, true); actlen = xdr_getpos(&xdr); @@ -68,7 +74,7 @@ static void test_xdr(xdrproc_t proc, void *vorig, void *vnew, const char *testna xdrmem_create(&xdr, buf, buflen, XDR_ENCODE); - ret = !!proc(&xdr, vnew, 0); + ret = !!XDRPROC(proc, xdr, vnew); g_assert_cmpint(ret, ==, true); actlen = xdr_getpos(&xdr); diff --git a/src/rpc/virnetmessage.c b/src/rpc/virnetmessage.c index af0f9cb30b..e66df5c9e2 100644 --- a/src/rpc/virnetmessage.c +++ b/src/rpc/virnetmessage.c @@ -34,6 +34,12 @@ VIR_LOG_INIT("rpc.netmessage"); +#if defined(XDRPROC_T_3ARGS) +# define XDRPROC_FILTER(filter, xdr, data) ((*filter)(&xdr, data, 0)) +#else +# define XDRPROC_FILTER(filter, xdr, data) ((*filter)(&xdr, data)) +#endif + virNetMessage *virNetMessageNew(bool tracked) { virNetMessage *msg; @@ -367,7 +373,7 @@ int virNetMessageEncodePayload(virNetMessage *msg, msg->bufferLength - msg->bufferOffset, XDR_ENCODE); /* Try to encode the payload. If the buffer is too small increase it. */ - while (!(*filter)(&xdr, data, 0)) { + while (!XDRPROC_FILTER(*filter, xdr, data)) { unsigned int newlen = msg->bufferLength - VIR_NET_MESSAGE_LEN_MAX; newlen *= 2; @@ -424,7 +430,7 @@ int virNetMessageDecodePayload(virNetMessage *msg, xdrmem_create(&xdr, msg->buffer + msg->bufferOffset, msg->bufferLength - msg->bufferOffset, XDR_DECODE); - if (!(*filter)(&xdr, data, 0)) { + if (!XDRPROC_FILTER(*filter, xdr, data)) { virReportError(VIR_ERR_RPC, "%s", _("Unable to decode message payload")); goto error; } -- 2.52.0

4 7