September 2026 - Devel - libvirt List Archives

Release of libvirt-12.2.0
by Jiri Denemark 10 Sep '26

10 Sep '26

The 12.2.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * Removed features * qemu: Stop advertising support for ``handle`` backend of 9p filesystems QEMU removed the feature in the 4.0 release, but our capability XML still reported it. * New features * qemu: Add support to configure IOMMUFD backend for whole VM In addition to setting IOMMUFD backend for each device it is possible to use the new ``<iommufd>`` element to enable IOMMUFD backend for all host devices. Users can still change it per device. * qemu: Add support to pass FD for IOMMUFD when starting VM Management applications running unprivileged libvirt can open /dev/iommu and pass FD to libvirt in order to change locked memory accounting. This is done via new ``<iommufd>`` element. * qemu: Add support for declaring that storage was zeroed for storage copy APIs The qemu driver now can skip zeroing of the storage during ``virDomainBlockCopy`` or migration with non-shared storage with the appropriate flags. This can be used for storage technologies which lack efficient zeroing support. * hyperv: Add basic snapshot functionality The hyperv driver now implements the following libvirt APIs: ``virDomainDefineXMLFlags()``, ``virDomainSnapshotLookupByName()``, ``virDomainListAllSnapshots()``, ``virDomainSnapshotNum()``, ``virDomainSnapshotGetXMLDesc()``, ``virDomainSnapshotCurrent()``, ``virDomainHasCurrentSnapshot()``, ``virDomainSnapshotGetParent()``. * Improvements * conf: support more than 255 vCPUs with amd-iommu With 256 or more vCPUs libvirt previously required EIM enabled for all models of IOMMU. This is not valid for AMD model and validation was changed so that XTSup is required there. Additionally, it is automatically enabled if needed. * Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES flag This new flag for virConnectGetDomainCapabilities can be used to request the host-model CPU definition to include all supported features (normally only extra features relative to the selected CPU model are listed). * qemu: Add statistics for ``<dataStore>`` storage The bulk statistics (``virsh domstats --block --backing``) now report also information about the ``<dataStore>`` if given disk uses this feature. * hyperv: Hyper-V guests now report TPM device status in their domain xml definition. * Bug fixes * qemu: Fix crash when attaching network inteface with hostdev network Introduced in v12.1.0 by implementing IOMMUFD backend support for host devices. Enjoy. Jirka

1 0

[PATCH v2 00/12] conf, qemu: Add scalable_mode, fsts, pasid_bits, and svm support for intel-iommu
by Zhenzhong Duan 10 Sep '26

10 Sep '26

Hi, This series adds support for configuring Intel vIOMMU (VT-d) in domain XML and formatting them onto the QEMU command line: * scalable_mode: Configures scalable mode support ('on'/'off'). * fsts: Enables First-Stage Translation support ('on'/'off'). * pasid_bits: Sets the number of supported PASID bits. * svm: Enables Shared Virtual Memory (SVM) / PRQ support ('on'/'off'). With these attributes, users can configure advanced vIOMMU features for both emulated devices and assigned host devices (e.g., vSVA / nested translation via iommufd and first-stage translation). Example domain XML configuration: <iommu model='intel'> <driver caching_mode='on' iotlb='on' scalable_mode='on' fsts='on' pasid_bits='6' svm='on'/> </iommu> Which formats the following QEMU command line options: -device {"driver":"intel-iommu","id":"iommu0","caching-mode":true,"device-iotlb":true,"scalable-mode":true,"fsts":true,"pasid-bits":6,"svm":true} Testing: - Validated with libvirt test suite (ninja test). - Tested DSA card passthrough and SVM/vSVA with iommufd backend. Changelog: v1: - Added support for 'pasid_bits' and 'svm' attributes. - rebased to master branch newest Thanks, Zhenzhong Zhenzhong Duan (12): qemu_capabilities: Introduce QEMU_CAPS_INTEL_IOMMU_SCALABLE_MODE conf: Add scalable_mode attribute to iommu qemu: format scalable-mode on intel-iommu command line qemu_capabilities: Introduce QEMU_CAPS_INTEL_IOMMU_FSTS conf: Add fsts attribute to iommu qemu: format fsts on intel-iommu command line qemu_capabilities: Introduce QEMU_CAPS_INTEL_IOMMU_PASID_BITS conf: add pasid_bits attribute to iommu qemu: format pasid-bits on intel-iommu command line qemu_capabilities: Introduce QEMU_CAPS_INTEL_IOMMU_SVM conf: add svm attribute to iommu qemu: format svm on intel-iommu command line docs/formatdomain.rst | 19 ++++++ src/conf/domain_conf.c | 64 +++++++++++++++++++ src/conf/domain_conf.h | 4 ++ src/conf/domain_validate.c | 12 ++++ src/conf/schemas/domaincommon.rng | 20 ++++++ src/qemu/qemu_capabilities.c | 10 +++ src/qemu/qemu_capabilities.h | 6 ++ src/qemu/qemu_command.c | 4 ++ src/qemu/qemu_validate.c | 31 ++++++++- .../caps_11.0.0_x86_64+sgx.xml | 1 + .../caps_11.0.0_x86_64.xml | 1 + .../caps_11.1.0_x86_64.xml | 4 ++ .../intel-iommu-fsts.x86_64-latest.args | 34 ++++++++++ .../intel-iommu-fsts.x86_64-latest.xml | 37 +++++++++++ tests/qemuxmlconfdata/intel-iommu-fsts.xml | 37 +++++++++++ .../intel-iommu-pasid-bits.x86_64-latest.args | 34 ++++++++++ .../intel-iommu-pasid-bits.x86_64-latest.xml | 37 +++++++++++ .../intel-iommu-pasid-bits.xml | 37 +++++++++++ ...tel-iommu-scalable-mode.x86_64-latest.args | 34 ++++++++++ ...ntel-iommu-scalable-mode.x86_64-latest.xml | 37 +++++++++++ .../intel-iommu-scalable-mode.xml | 37 +++++++++++ .../intel-iommu-svm.x86_64-latest.args | 34 ++++++++++ .../intel-iommu-svm.x86_64-latest.xml | 37 +++++++++++ tests/qemuxmlconfdata/intel-iommu-svm.xml | 37 +++++++++++ tests/qemuxmlconftest.c | 4 ++ 25 files changed, 611 insertions(+), 1 deletion(-) create mode 100644 tests/qemuxmlconfdata/intel-iommu-fsts.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/intel-iommu-fsts.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-fsts.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-pasid-bits.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/intel-iommu-pasid-bits.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-pasid-bits.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-scalable-mode.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/intel-iommu-scalable-mode.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-scalable-mode.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-svm.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/intel-iommu-svm.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-svm.xml -- 2.52.0

3 23

[PATCH v3 0/7] Add TLS-PSK support for migration
by Abhisek Panda 10 Sep '26

10 Sep '26

QEMU provides the capability to encrypt the migration data stream using two transport layer security (TLS) authentication schemes: X.509 certificates and pre-shared keys (PSK). Currently, Libvirt only supports the X.509-based TLS authentication scheme. In TLS X.509 certificates, a set of live migrations utilize a fixed set of static certificates for encrypted migration. In this authentication scheme, users require to deploy a certificate authority and monitor the certificate expiration window. In case certificates are compromised all the future live migrations are vulnerable. To resolve this, this patch series introduce the support for pre-shared key-based authentication scheme. This mechanism relies on symmetric pre-shared keys (a secret key that is known to both sender and receiver prior to secure communication) for providing secure transfer of data. Libvirt solely manages the lifecycle of the ephemeral pre-shared keys, including, generation, persistent storage, and cleanup. Libvirt generates the key on the source machine, then transfers it to the destination machine using the migration cookie. To allow users to configure the size of the key, Libvirt provides the migrate_tls_psk_length configuration parameter in qemu.conf. To avoid introduction of an additional VIR_MIGRATE_* flag, we rely on existing the VIR_MIGRATE_TLS flag. If the VIR_MIGRATE_TLS flag is set but the necessary X.509 credential files are missing on the destination, then we fallback to using PSK-based authentication scheme during migration. v3: 1. Destination host decides which TLS authentication scheme to use. 2. The directory of the key file is set to <tls_psk_state_dir>/$ID-$VMNAME. 3. Use the same alias for both tls-creds-x509 and tls-creds-psk objects. 4. Validate the length of the pre-shared key. 5. Unit test to validate the pre-shared key in the migration cookie. v2: 1. Libvirt manages the lifecycle of pre-shared keys. 2. Transfer of keys to the destination via the migration cookie 3. Remove the VIR_MIGRATE_TLS_PSK flag instead rely on VIR_MIGRATE_TLS and availability of ca-cert.pem on source. 4. Drop VIR_MIGRATE_PARAM_TLS_PSK_DIRECTORY, Libvirt solely manages the pre-shared keys. Abhisek Panda (7): conf: Add a configuration param for TLS-PSK qemu: Manage a pre-shared key's lifecycle qemu: Add support to build the tls-creds-psk object qemu: rename tls-creds-x509 obj related functions qemu: Manage tls-creds-psk object lifecycle qemu: Set up the migrate TLS-PSK objects tests: Add testing of pre-shared key lifecycle include/libvirt/libvirt-domain.h | 11 +- src/qemu/libvirtd_qemu.aug | 1 + src/qemu/qemu.conf.in | 8 ++ src/qemu/qemu_command.c | 26 ++++ src/qemu/qemu_command.h | 7 + src/qemu/qemu_conf.c | 22 ++++ src/qemu/qemu_conf.h | 2 + src/qemu/qemu_domain.c | 1 + src/qemu/qemu_domain.h | 1 + src/qemu/qemu_driver.c | 6 + src/qemu/qemu_hotplug.c | 40 +++--- src/qemu/qemu_hotplug.h | 24 ++-- src/qemu/qemu_migration.c | 202 +++++++++++++++++++++++++---- src/qemu/qemu_migration_cookie.c | 94 +++++++++++++- src/qemu/qemu_migration_cookie.h | 5 + src/qemu/qemu_migration_params.c | 98 +++++++++++--- src/qemu/qemu_migration_params.h | 22 +++- src/qemu/test_libvirtd_qemu.aug.in | 1 + tests/qemumigrationcookiexmltest.c | 141 +++++++++++++++++++- tests/testutilsqemu.c | 12 ++ 20 files changed, 631 insertions(+), 93 deletions(-) -- 2.43.7

2 20

[PATCH 0/2] virnetdevtap: fix tap device leaks on FreeBSD
by Roman Bogorodskiy 10 Sep '26

10 Sep '26

Roman Bogorodskiy (2): virnetdevtap: fix tap device leak on rename virnetdevtap: fix tap device leak in virNetDevTapCreateInBridgePort() src/util/virnetdevtap.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) -- 2.55.0

2 3

[PATCH 0/4] qemu: Support backup and fsync optional attributes in SWTPM
by Arun Menon 09 Sep '26

09 Sep '26

In the upcoming release of swtpm, 2 new options, backup and fsync will be added to the directory backend [1] and [2]. This allows the user to backup and fsync the state file and its parent directory. It lowers the probability of TPM state file corruption in case of a power loss. Although this has not been added to the stable swtpm release yet, Libvirt will require some changes to incorporate these options in the XML config. Following is the sample xml configuration snip to enable backup and fsync: <tpm model='tpm-crb'> <backend type='emulator' version='2.0' backup='yes' fsync='yes'/> </tpm> Tested with swtpm commit #8ecf2c1 and libtpms commit #18e42c8d: $ ps aux | grep swtpm arun 33881 0.0 0.0 24080 10188 ? S 00:09 0:00 /usr/local/bin/swtpm socket --ctrl type=unixio,path=/run/user/1000/libvirt/qemu/run/swtpm/5-guest-vm-swtpm.sock,mode=0600 --tpmstate dir=/home/arun/.config/libvirt/qemu/swtpm/0a64239e-6311-4e53-8903-d1d49608a751/tpm2,mode=0600,lock,backup,fsync --log file=/home/arun/.cache/libvirt/qemu/log/guest-vm-swtpm.log --terminate --tpm2 $ ls -lrt $HOME/.config/libvirt/qemu/swtpm/0a64239e-6311-4e53-8903-d1d49608a751/tpm2 total 16 -rw-------. 1 arun arun 6807 Sep 7 00:14 tpm2-00.permall.bak -rw-------. 1 arun arun 6807 Sep 7 01:02 tpm2-00.permall [1] https://github.com/stefanberger/swtpm/commit/186f72a3a995fc68957ffc0b1438bb… [2] https://github.com/stefanberger/swtpm/commit/795c1973c913da59925fa6c2d688c5… Arun Menon (4): conf: Add backup and fsync optional swtpm attributes to RNG schema conf: Parse and read the xml attributes for swtpm backup and fsync qemu: tpm: Add backup and fsync options to the swtpm command qemuxmlconftest: Add example for backup and fsync tpmstate options docs/formatdomain.rst | 16 ++++++++++ src/conf/domain_conf.c | 31 +++++++++++++++++++ src/conf/domain_conf.h | 2 ++ src/conf/schemas/domaincommon.rng | 10 ++++++ src/qemu/qemu_tpm.c | 17 ++++++++-- src/util/virtpm.c | 2 ++ src/util/virtpm.h | 2 ++ .../tpm-emulator-tpm2-pstate.xml | 2 +- 8 files changed, 79 insertions(+), 3 deletions(-) -- 2.54.0

3 11

[PATCH v2] qemu: Fix crash in qemuProcessStop due to NULL eventThread
by Pritam Srichandan Sahoo 09 Sep '26

09 Sep '26

When a VM shuts down, the monitor EOF event is queued to the worker thread pool. If another thread enters qemuProcessStop() first and frees priv->eventThread via g_steal_pointer(), the second call from the EOF event worker thread hits a NULL dereference when calling virEventThreadStop(priv->eventThread). The existing 'if (priv->eventThread)' guard is insufficient because the VM object is unlocked between the check and the call to virEventThreadStop(), allowing a concurrent thread to clear the pointer in the meantime. Fix this by taking a GObject reference to eventThread before unlocking the VM. This ensures the pointer remains valid for virEventThreadStop() even if another thread clears priv->eventThread concurrently. Crash backtrace: #0 virEventThreadStop (evt=0x0) #1 qemuProcessStop (reason=VIR_DOMAIN_SHUTOFF_SHUTDOWN, asyncJob=VIR_ASYNC_JOB_NONE) #2 processMonitorEOFEvent (driver=..., vm=...) #3 qemuProcessEventHandler (data=..., opaque=...) #4 virThreadPoolWorker (opaque=...) Signed-off-by: Pritam Srichandan Sahoo <PritamSrichandan.Sahoo(a)windriver.com> --- v2: Resend as an inline plain-text patch. The v1 posting was delivered as an email attachment which is harder to review; no code changes from v1. src/qemu/qemu_process.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 0d9b8bcb93..642e18eeb1 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -8850,13 +8850,15 @@ void qemuProcessStop(virQEMUDriver *driver, * the global domain object list code depends on it (and it can't actually * check 'priv->beingDestroyed as that's private). */ if (priv->eventThread) { + virEventThread *eventThread = g_object_ref(priv->eventThread); /* Explicitly set priv->beingDestroyed. While it's done in * qemuProcessBeginStopJob(), qemuProcessStop() is called from places * where stop job is not acquired. */ priv->beingDestroyed = true; virObjectUnlock(vm); - virEventThreadStop(priv->eventThread); + virEventThreadStop(eventThread); virObjectLock(vm); + g_object_unref(eventThread); } if (priv->agent) { -- 2.53.0

1 0

[PATCH] src: stop using deprecated syntax for hv-crash argument
by Daniel P. Berrangé 08 Sep '26

08 Sep '26

From: Daniel P. Berrangé <berrange(a)redhat.com> QEMU historically accepted bare keywords as a short-cut for turning on a boolean option. This was deprecated quite a long time ago and most usage would trigger a warning from QEMU, but the -cpu arg is special and doesn't warn. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/qemu/qemu_command.c | 2 +- tests/qemuxmlconfdata/hyperv-panic.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/panic-double.x86_64-latest.args | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index a07b915f4d..bcddb9c922 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -6748,7 +6748,7 @@ qemuBuildCpuCommandLine(virCommand *cmd, for (i = 0; i < def->npanics; i++) { if (def->panics[i]->model == VIR_DOMAIN_PANIC_MODEL_HYPERV) { - virBufferAddLit(&buf, ",hv-crash"); + virBufferAddLit(&buf, ",hv-crash=on"); break; } } diff --git a/tests/qemuxmlconfdata/hyperv-panic.x86_64-latest.args b/tests/qemuxmlconfdata/hyperv-panic.x86_64-latest.args index ee0f8551c2..0182cc8e18 100644 --- a/tests/qemuxmlconfdata/hyperv-panic.x86_64-latest.args +++ b/tests/qemuxmlconfdata/hyperv-panic.x86_64-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=on \ -accel tcg \ --cpu qemu64,hv-crash \ +-cpu qemu64,hv-crash=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/panic-double.x86_64-latest.args b/tests/qemuxmlconfdata/panic-double.x86_64-latest.args index 9c5b3a7694..21ecaf4d84 100644 --- a/tests/qemuxmlconfdata/panic-double.x86_64-latest.args +++ b/tests/qemuxmlconfdata/panic-double.x86_64-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=on \ -accel tcg \ --cpu qemu64,hv-crash \ +-cpu qemu64,hv-crash=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ -overcommit mem-lock=off \ -- 2.55.0

2 3

[PATCH 0/2] virnetdevbridge: support VLAN configuration on FreeBSD
by Roman Bogorodskiy 08 Sep '26

08 Sep '26

This series implements VLAN networking on FreeBSD. Specifically, it implements controlling bridge's VLAN filtering via the `macTableManager='libvirt'` in the network XML. And various configurations specified by domain's <vlan> element. I have documented my testing of these configurations here: https://gist.github.com/novel/e26e90f031f965920587bf126899356e I'd definitely appreciate a second pair of eyes on this to make sure the documented behavior matches the XML intent. Roman Bogorodskiy (2): virnetdevbridge: support VLAN filtering setting on FreeBSD virnetdevbridge: support VLAN configuration on FreeBSD src/util/virnetdevbridge.c | 110 +++++++++++++++++++++++++++++++++++-- 1 file changed, 105 insertions(+), 5 deletions(-) -- 2.55.0

2 3

[PULL v3 00/12] Misc fixes patches
by Daniel P. Berrangé 08 Sep '26

08 Sep '26

The following changes since commit ff1d2d19d7e24893e2012d879f8e73077e17b9bd: Merge tag 'pull-11.1-check-tcg-meson-040926-2' of https://gitlab.com/stsquad/qemu into staging (2026-09-04 16:52:58 +0100) are available in the Git repository at: https://gitlab.com/berrange/qemu tags/misc-fixes-pull-request for you to fetch changes up to 0766e83d2f94285338e6c642b4b003ffafb142f4: docs/system/security: exclude uninitialized stack variables as bugs (2026-09-07 11:31:03 +0100) ---------------------------------------------------------------- Merge crypto, I/O and misc fixes * Deprecated the AF_ALG crypto backend * Improve checkpatch output in CI jobs * Document security policy for uninitialized stack variables * Fix multiple denial of service flaws in websockets * Fix error handling in some x509 APIs ---------------------------------------------------------------- Daniel P. Berrangé (3): crypto: deprecate the AF_ALG crypto backend gitlab: use --emacs --quiet for checkpatch.pl instead of --terse docs/system/security: exclude uninitialized stack variables as bugs Denis V. Lunev (6): io/channel-socket: do not treat a zero length write as an error io/channel-websock: send an HTTP 400 when the greeting has no space io/channel-websock: handle a blocked write during the handshake tests/unit: add websock handshake test io/channel-websock: do not lose QIO_CHANNEL_ERR_BLOCK while reading tests/unit: cover blocked IO during the websock handshake Evgeny Kolmakov (1): crypto: Use g_autofree Marc-André Lureau (2): crypto/x509-utils: don't double set errp crypto/x509-utils: propagate the error .gitlab-ci.d/check-patch.py | 6 +- crypto/block.c | 17 +- crypto/hmac-gcrypt.c | 12 +- crypto/hmac-glib.c | 10 +- crypto/ivgen-essiv.c | 15 +- crypto/ivgen.c | 6 +- crypto/secret_keyring.c | 5 +- crypto/x509-utils.c | 4 +- docs/about/deprecated.rst | 21 +++ docs/system/security.rst | 10 ++ io/channel-socket.c | 2 +- io/channel-websock.c | 10 +- meson.build | 6 + tests/unit/meson.build | 1 + tests/unit/test-io-channel-websock.c | 249 +++++++++++++++++++++++++++ 15 files changed, 326 insertions(+), 48 deletions(-) create mode 100644 tests/unit/test-io-channel-websock.c -- 2.55.0

2 13

[PULL v2 00/13] Misc fixes patches
by Daniel P. Berrangé 07 Sep '26

07 Sep '26

The following changes since commit 99e54ab5e7a6efc945af6d5661842155d1f3fc7a: Merge tag 'hw-misc-20260903' of https://github.com/philmd/qemu into staging (2026-09-03 16:43:24 +0100) are available in the Git repository at: https://gitlab.com/berrange/qemu tags/misc-fixes-pull-request for you to fetch changes up to 39dfe7cf8e87d6de975bae6c10c3712f4df56ee6: docs/system/security: exclude uninitialized stack variables as bugs (2026-09-04 14:29:16 +0100) ---------------------------------------------------------------- Merge crypto, I/O and misc fixes * Deprecated the AF_ALG crypto backend * Improve checkpatch output in CI jobs * Fix --disable-containers arg handling in configure * Document security policy for uninitialized stack variables * Fix multiple denial of service flaws in websockets * Fix error handling in some x509 APIs ---------------------------------------------------------------- Daniel P. Berrangé (4): crypto: deprecate the AF_ALG crypto backend gitlab: use --emacs --quiet for checkpatch.pl instead of --terse configure: correctly honour --disable-containers docs/system/security: exclude uninitialized stack variables as bugs Denis V. Lunev (6): io/channel-socket: do not treat a zero length write as an error io/channel-websock: send an HTTP 400 when the greeting has no space io/channel-websock: handle a blocked write during the handshake tests/unit: add websock handshake test io/channel-websock: do not lose QIO_CHANNEL_ERR_BLOCK while reading tests/unit: cover blocked IO during the websock handshake Evgeny Kolmakov (1): crypto: Use g_autofree Marc-André Lureau (2): crypto/x509-utils: don't double set errp crypto/x509-utils: propagate the error .gitlab-ci.d/check-patch.py | 6 +- configure | 1 + crypto/block.c | 17 +- crypto/hmac-gcrypt.c | 12 +- crypto/hmac-glib.c | 10 +- crypto/ivgen-essiv.c | 15 +- crypto/ivgen.c | 6 +- crypto/secret_keyring.c | 5 +- crypto/x509-utils.c | 4 +- docs/about/deprecated.rst | 21 +++ docs/system/security.rst | 10 ++ io/channel-socket.c | 2 +- io/channel-websock.c | 10 +- meson.build | 6 + tests/unit/meson.build | 1 + tests/unit/test-io-channel-websock.c | 249 +++++++++++++++++++++++++++ 16 files changed, 327 insertions(+), 48 deletions(-) create mode 100644 tests/unit/test-io-channel-websock.c -- 2.55.0

2 15