- Devel - libvirt List Archives

[PATCH 0/2] bhyve: implement virDomainGetGuestInfo()
by Roman Bogorodskiy 18 Jul '26

18 Jul '26

Roman Bogorodskiy (2): qemu: move qemuAgent*InfoFormatParams to hypervisor/qemu_agent.c bhyve: implement virDomainGetGuestInfo() src/bhyve/bhyve_driver.c | 192 ++++++++++++++++++++++++++++++++++++ src/hypervisor/qemu_agent.c | 159 +++++++++++++++++++++++++++++ src/hypervisor/qemu_agent.h | 17 ++++ src/libvirt_private.syms | 3 + src/qemu/qemu_driver.c | 162 +----------------------------- 5 files changed, 372 insertions(+), 161 deletions(-) -- 2.52.0

1 2

[PATCH v10 0/6] qemu: Support HW-accelerated vSMMUs
by Nathan Chen 18 Jul '26

18 Jul '26

Hi, This is a follow up to the v9 patchset [0] for supporting multiple hardware-accelerated vSMMU instances. For instance, specifying hostdevs associated with multiple accelerated SMMUs, configured to be routed to pcie-expander-bus controllers in a way where VFIO device to SMMUv3 associations are matched with the host: <devices> ... <controller type='pci' index='1' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='252'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </controller> <controller type='pci' index='2' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='248'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </controller> ... <controller type='pci' index='21' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='21' port='0x0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </controller> <controller type='pci' index='22' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='22' port='0xa8'/> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </controller> ... <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> <iommu model='smmuv3'> <driver pciBus='1' accel='on' ats='on' ril='off' ssidsize='20' oas='44'/> </iommu> <iommu model='smmuv3'> <driver pciBus='2' accel='on' ats='on' ril='off' ssidsize='20' oas='44'/> </iommu> </devices> This would get translated to a qemu command line with the arguments below: -device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ -device '{"driver":"pxb-pcie","bus_nr":248,"id":"pci.2","bus":"pcie.0","addr":"0x2"}' \ -device '{"driver":"pcie-root-port","port":0,"chassis":21,"id":"pci.21","bus":"pci.1","addr":"0x0"}' \ -device '{"driver":"pcie-root-port","port":168,"chassis":22,"id":"pci.22","bus":"pci.2","addr":"0x0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"iommu0","accel":true,"ats":"on","ril":"off","ssidsize":"20","oas":"44"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.2","id":"iommu1","accel":true,"ats":"on","ril":"off","ssidsize":"20","oas":"44"}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","bus":"pci.22","addr":"0x0"}' \ Two QEMU series implementing auto support for accel SMMUv3 properties are now present in the upstream master branch [1][2]. This Libvirt series leverages the auto support: users can omit SMMUv3 properties ATS, RIL, OAS, and SSIDSIZE on the domain XML, and they will also be omitted on the QEMU command line as a result. With these new QEMU series applied, the feature property values will default to 'auto' to be resolved based on what the host SMMU supports. This series also adds documentation fixes for docs/formatdomain.rst and implements support for QEMU capability checks on device-pluggable accel smmuv3. This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/smmuv3-accel-v10/ Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/W6HJ… [1] https://lore.kernel.org/all/20260323182454.1416110-1-nathanc@nvidia.com/ [2] https://lore.kernel.org/all/20260608174900.2227340-1-nathanc@nvidia.com/ Changes from v9: - Rename ssidSize to ssidsize - Update docs/formatdomain.rst to mention `since 12.6.0` for accel smmuv3 properties and these properties' hypervisor defaults being used if not specified. - Separate out virDomainIOMMUDefEquals() check for pci_bus into a new fix commit - Include fix commit for `since 11.10.0` for pciBus attribute in docs/formatdomain.rst - Use T:accel to propagate accel=off - Use qemuOnOffAuto() for ats and ril - Add QEMU capabilities checks for device-pluggable smmuv3 and accel smmuv3 Changes from v8: - Changed smmuv3 attribute QEMU CLI values to strings to match QEMU 11.0 Changes from v7: - Remove support for x-vpasid-cap-offset based on feedback pointing out the QEMU feature prefixed with x- is experimental and not to be supported in Libvirt - Implement support for auto SMMUv3 properties. Omitting these properties in the XML omits them on the QEMU command line as well, which results in default auto values being chosen for ATS, RIL, SSIDSIZE, and OAS - Add validation check that only allows enabling accel SMMUv3 features when accel is enabled - Add tests for accel=on but omitting accel SMMUv3 feature properties Changes from v6: - Remove smmuv3 'pasid' attribute - Add smmuv3 'ssidsize' attribute - Add support for 'vpasidCapOffset' element - Modify logic for building accel smmuv3 qemu command line to omit ATS, RIL, accel flags when not needed (enabled/disabled by default in QEMU SMMUv3) Nathan Chen (6): conf: Include check for pci_bus in virDomainIOMMUDefEquals() docs: formatdomain: Include Libvirt version for IOMMU pciBus attribute qemu: Add support for HW-accelerated nested SMMUv3 qemu: introduce QEMU_CAPS_ARM_SMMUV3 qemu: introduce QEMU_CAPS_ARM_SMMUV3_ACCEL tests: qemuxmlconfdata: provide HW-accel smmuv3 sample XML and CLI args docs/formatdomain.rst | 41 ++++- src/conf/domain_conf.c | 80 ++++++++++ src/conf/domain_conf.h | 5 + src/conf/domain_validate.c | 27 +++- src/conf/schemas/domaincommon.rng | 25 +++ src/qemu/qemu_capabilities.c | 14 ++ src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_command.c | 15 ++ src/qemu/qemu_validate.c | 21 ++- .../caps_10.0.0_aarch64.replies | 79 ++++++---- .../caps_10.2.0_aarch64.replies | 89 +++++++---- .../caps_10.2.0_aarch64.xml | 1 + .../caps_11.0.0_aarch64.replies | 132 ++++++++++++---- .../caps_11.0.0_aarch64.xml | 2 + .../caps_11.1.0_aarch64.replies | 143 ++++++++++++++---- .../caps_11.1.0_aarch64.xml | 2 + .../caps_8.2.0_aarch64.replies | 79 ++++++---- .../caps_8.2.0_armv7l.replies | 79 ++++++---- .../caps_9.2.0_aarch64+hvf.replies | 75 ++++++--- ...uv3-pci-bus-accel-auto.aarch64-latest.args | 38 +++++ ...muv3-pci-bus-accel-auto.aarch64-latest.xml | 63 ++++++++ .../iommu-smmuv3-pci-bus-accel-auto.xml | 53 +++++++ ...u-smmuv3-pci-bus-accel.aarch64-latest.args | 38 +++++ ...mu-smmuv3-pci-bus-accel.aarch64-latest.xml | 63 ++++++++ .../iommu-smmuv3-pci-bus-accel.xml | 53 +++++++ tests/qemuxmlconftest.c | 2 + 26 files changed, 1032 insertions(+), 189 deletions(-) create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.xml -- 2.43.0

1 6

[RFC] sanlock: Add option to check ownership of disk leases
by Jim Fehlig 17 Jul '26

17 Jul '26

From: Jim Fehlig <jfehlig(a)suse.com> In a clustered environment it may be desirable to provision disk leases for use by a specific domain. This patch adds a 'check_disk_lease_owner' option to the sanlock driver to check that leases are owned by the domain attempting to acquire them. sanlock's Lock Value Block (LVB) is used to store the owning domain UUID within the lease. When a domain is started and attempts to acquire its leases, the sanlock driver will ensure its UUID matches the UUID recorded in the leases. Any mismatches will cause lease acquisition and domain startup to fail. The 'check_disk_lease_owner' option is disabled by default. When enabled, it can be used with auto_disk_leases or leases managed by an external application. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- Inspired by Claudio, implemented by Jim :-) src/locking/libvirt_sanlock.aug | 1 + src/locking/lock_driver_sanlock.c | 78 ++++++++++++++++++++++++- src/locking/sanlock.conf | 23 ++++++++ src/locking/test_libvirt_sanlock.aug.in | 1 + 4 files changed, 102 insertions(+), 1 deletion(-) diff --git a/src/locking/libvirt_sanlock.aug b/src/locking/libvirt_sanlock.aug index 62d0672952..af6c25755f 100644 --- a/src/locking/libvirt_sanlock.aug +++ b/src/locking/libvirt_sanlock.aug @@ -25,6 +25,7 @@ module Libvirt_sanlock = | int_entry "io_timeout" | str_entry "user" | str_entry "group" + | bool_entry "check_disk_lease_owner" let comment = [ label "#comment" . del /#[ \t]*/ "# " . store /([^ \t\n][^\n]*)?/ . del /\n/ "\n" ] let empty = [ label "#empty" . eol ] diff --git a/src/locking/lock_driver_sanlock.c b/src/locking/lock_driver_sanlock.c index a07f3652c1..7ed1081cbd 100644 --- a/src/locking/lock_driver_sanlock.c +++ b/src/locking/lock_driver_sanlock.c @@ -67,6 +67,7 @@ struct _virLockManagerSanlockDriver { unsigned int hostID; bool autoDiskLease; char *autoDiskLeasePath; + bool checkDiskLeaseOwner; unsigned int io_timeout; /* under which permissions does sanlock run */ @@ -147,6 +148,10 @@ virLockManagerSanlockLoadConfig(virLockManagerSanlockDriver *driver, if (virConfGetValueBool(conf, "require_lease_for_disks", &driver->requireLeaseForDisks) < 0) return -1; + if (virConfGetValueBool(conf, "check_disk_lease_owner", + &driver->checkDiskLeaseOwner) < 0) + return -1; + if (virConfGetValueUInt(conf, "io_timeout", &driver->io_timeout) < 0) return -1; @@ -839,6 +844,73 @@ virLockManagerSanlockRegisterKillscript(int sock, return 0; } +static int virLockManagerSanlockCheckOwner(virLockManagerSanlockDriver *driver, + virLockManagerSanlockPrivate *priv) +{ + char lvb[VIR_UUID_STRING_BUFLEN] = {0}; + char vm_uuidstr[VIR_UUID_STRING_BUFLEN]; + int rv; + size_t i; + + if (!driver->checkDiskLeaseOwner) + return 0; + + virUUIDFormat(priv->vm_uuid, vm_uuidstr); + + for (i = 0; i < priv->res_count; i++) { + memset(lvb, 0, sizeof(lvb)); + + rv = sanlock_get_lvb(0, priv->res_args[i], lvb, sizeof(lvb)); + if (rv < 0) { + /* Failed to read LVB, treat as "legacy" lease + * without ownership tracking and skip the check. + */ + VIR_DEBUG("Failed to read LVB, skipping ownership check"); + continue; + } + + if (lvb[0] == '\0') { + VIR_DEBUG("Writing VM UUID to empty LVB"); + /* Empty LVB: this lease does not yet have an owner recorded. Write + * the domain's UUID so that subsequent acquire attempts by other + * domains will be rejected. This handles the auto_disk_leases case + * where lease files are created by libvirt. rather + */ + if ((rv = sanlock_set_lvb(0, priv->res_args[i], vm_uuidstr, + sizeof(vm_uuidstr))) < 0) { + char *err = NULL; + if (virLockManagerSanlockError(rv, &err)) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Failed to set LVB for lease %1$s: %2$s"), + priv->res_args[i]->disks[0].path, NULLSTR(err)); + VIR_FREE(err); + } else { + virReportSystemError(-rv, + _("Failed to set LVB for lease %1$s"), + priv->res_args[i]->disks[0].path); + } + return -1; + } + continue; + } + + VIR_DEBUG("Comparing LVB UUID '%s' to VM UUID '%s'", lvb, vm_uuidstr); + if (STRNEQ(lvb, vm_uuidstr)) { + /* + * LVB contains a different domain UUID. This lease + * was provisioned for another domain and must not + * be acquired by this one. + */ + virReportError(VIR_ERR_RESOURCE_BUSY, + _("Disk lease %1$s is already assigned to domain %2$s, not %3$s"), + priv->res_args[i]->disks[0].path, lvb, vm_uuidstr); + return -1; + } + } + return 0; +} + + static int virLockManagerSanlockAcquire(virLockManager *lock, const char *state, unsigned int flags, @@ -934,7 +1006,8 @@ static int virLockManagerSanlockAcquire(virLockManager *lock, if (!(flags & VIR_LOCK_MANAGER_ACQUIRE_REGISTER_ONLY)) { VIR_DEBUG("Acquiring object %u", priv->res_count); - if ((rv = sanlock_acquire(sock, priv->vm_pid, 0, + if ((rv = sanlock_acquire(sock, priv->vm_pid, + driver->checkDiskLeaseOwner ? SANLK_ACQUIRE_LVB : 0, priv->res_count, priv->res_args, opt)) < 0) { char *err = NULL; @@ -949,6 +1022,9 @@ static int virLockManagerSanlockAcquire(virLockManager *lock, } goto error; } + + if (virLockManagerSanlockCheckOwner(driver, priv) < 0) + goto error; } VIR_FREE(opt); diff --git a/src/locking/sanlock.conf b/src/locking/sanlock.conf index 3c356bef9c..e7d6938e84 100644 --- a/src/locking/sanlock.conf +++ b/src/locking/sanlock.conf @@ -67,3 +67,26 @@ # access them. Accepted values are described in qemu.conf. #user = "root" #group = "root" + +# +# Flag to enable verifying if disk leases have been provisioned +# for domains attempting to acquire them. This is accomplished +# using sanlock's Lock Value Block (LVB), a 512 byte application +# specific block in the lease lockspace where the domain's UUID +# can be stored when the lease is created. When libvirt starts a +# domain, the sanlock driver will check for a valid and matching +# UUID in the LVB of all leases. This prevents a lease that was +# provisioned for one domain from accidentally being used by a +# different domain. +# +# When enabled, if a lease file has an empty LVB, the UUID of the +# acquiring domain is written into the LVB automatically, so that +# subsequent lease acquisition attempts by other domains will be +# rejected. This behavior accommodates the auto_disk_leases case, +# where leases are created by libvirt. If leases are managed by +# an external application, it must write the domain UUID into the +# LVB during lease creation. +# +# Defaults to disabled. +# +#check_disk_lease_owner = 0 diff --git a/src/locking/test_libvirt_sanlock.aug.in b/src/locking/test_libvirt_sanlock.aug.in index 5eabb6726d..e468a2cdcd 100644 --- a/src/locking/test_libvirt_sanlock.aug.in +++ b/src/locking/test_libvirt_sanlock.aug.in @@ -9,3 +9,4 @@ module Test_libvirt_sanlock = { "io_timeout" = "0" } { "user" = "root" } { "group" = "root" } +{ "check_disk_lease_owner" = "0" } -- 2.51.0

2 4

[PATCH] NEWS: Update with recent feature additions
by Jim Fehlig 17 Jul '26

17 Jul '26

From: Jim Fehlig <jfehlig(a)suse.com> Add NEWS entries for the new libvirtd build option and new sanlock plugin setting. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- NEWS.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index d4c5cfd334..e986cf8c9a 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -17,6 +17,17 @@ v12.6.0 (unreleased) * **New features** + * build: Add option to control building libvirtd + + Meson option ``libvirtd`` has been added to control building the monolithic + libvirtd, independent from the stateful, daemon-based drivers. + + * sanlock: Add option to check ownership of disk leases + + The sanlock lock driver plugin now supports the ``check_disk_lease_owner`` + setting in sanlock.conf. When enabled, the sanlock plugin will check that + leases are owned by the domain attempting to acquire them. + * **Improvements** * **Bug fixes** -- 2.51.0

1 0

[RFC] qemu: add configurable vCPU hotplug selection order
by Partha Satapathy 17 Jul '26

17 Jul '26

qemu: add configurable vCPU hotplug selection order Count-based vCPU hotplug currently selects eligible vCPU hotplug entities according to their vCPU IDs. For example: virsh setvcpus VM COUNT --live does not provide a way for an administrator to control which eligible entities are added or removed first. The existing ID-based policy is suitable for simple guests and for deployments where the vCPU ID layout already represents the desired placement policy. Domains that do not configure the new feature continue to use the current ID-based behavior. One use case is preserving a balanced guest NUMA CPU distribution during count-based vCPU changes. Depending on how vCPU IDs are assigned to guest NUMA cells, repeatedly adding or removing vCPUs by ID may concentrate the change in one cell before affecting another, resulting in an undesirable asymmetric guest CPU layout. There is no single balancing policy that is correct for every guest. An administrator may want to remove one hotplug entity from each guest NUMA cell in a round-robin sequence. For a guest with a threaded CPU topology, the preferred policy may instead remove a complete core, or several threads from one cell, before proceeding to the next. The appropriate sequence depends on the guest topology, workload, architecture, and performance requirements. The mechanism is not limited to NUMA balancing. It can also express administrator-defined policies such as: * retaining CPUs used for latency-sensitive, isolated, or housekeeping workloads; * implementing CPU capacity tiers; * satisfying software licensing or application-affinity constraints; * preserving a preferred socket, core, or thread population while reducing capacity; or * restoring vCPUs in a predictable order after an earlier reduction. Rather than embedding any one placement policy in libvirt, this proposal provides a general ordering mechanism. Administrators can describe the desired selection sequence in the domain XML according to the guest and deployment requirements. The existing per-vCPU 'order' attribute has different semantics and cannot be reused for this purpose. It is used to define the order and grouping of vCPUs when they are enabled. It applies to online vCPUs and is not a policy for selecting offline hotpluggable vCPUs. In particular, 'order' is not used to choose which vCPUs are removed by a count-based `setvcpus` reduction. Therefore, it cannot express an administrator-defined hot-unplug sequence. In contrast, 'hporder' is configured on disabled hotpluggable vCPUs and is used when libvirt selects eligible hotplug entities for count-based vCPU changes. It determines both which entities are removed during reduction and the order in which ranked entities are restored during expansion. It does not change the existing 'order' semantics, startup behavior, or hotplug entity composition. Introduce an optional positive per-vCPU 'hporder' XML attribute for QEMU domains. If the attribute is omitted, the vCPU remains unranked. All vCPUs belonging to the same QEMU hotplug entity must have the same 'hporder' value because they cannot be added or removed independently. The configuration is rejected if the values within an entity differ. For count-based operations, the QEMU driver applies the following selection policy: * On expansion, select unranked entities in ascending vCPU ID order, followed by ranked entities in ascending 'hporder' order. * On reduction, select ranked entities in descending 'hporder' order, followed by unranked entities in descending vCPU ID order. The ordering has two useful properties. First, domains without 'hporder' retain the existing behavior. Second, among ranked entities, expansion naturally restores entities in the reverse order in which reduction removed them. Unranked entities are selected first during expansion so that configuring 'hporder' can be used primarily to describe a preferred removal order without changing the normal expansion order of other hotpluggable vCPUs. The setting affects only the selection of eligible entities during count-based vCPU operations. It does not change: * the initial boot CPU order; * the existing per-vCPU 'order' attribute; * the composition of a QEMU hotplug entity; * whether a vCPU is hotpluggable; or * operations that explicitly address individual vCPUs. The value is preserved in domain XML and exposed through: virDomainSetVcpuHpOrder() A positive API value configures the order. Passing zero removes the configured value. Zero is not valid in domain XML and is therefore omitted when the XML is formatted. The corresponding virsh commands are: setvcpuhporder DOMAIN VCPU HPORDER delvcpuhporder DOMAIN VCPU Proposed implementation: 1. Add the 'hporder' attribute to the per-vCPU domain XML. 2. Validate that all vCPUs belonging to the same QEMU hotplug entity use the same 'hporder' value. 3. Use 'hporder' when selecting eligible vCPU hotplug entities for count-based expansion and reduction. 4. Add a public API for configuring or removing the 'hporder' value. 5. Add virsh commands for setting and removing the value. 6. Update the domain XML and API documentation to describe the new attribute, its valid values, its interaction with the existing per-vCPU 'order' attribute, and the selection rules used for expansion and reduction. 7. Add automated test coverage for XML parsing and formatting, invalid zero values, hotplug-entity consistency, and count-based expansion and reduction ordering. RFC: Feedback is welcome on the ordering policy and interface. In particular, feedback is requested on the XML/API naming, the handling of unranked vCPUs during expansion, and whether this should remain a QEMU-only feature. Signed-off-by: Partha Sarathi Satapathy <partha.satapathy(a)oracle.com>

4 8

[PATCH] util: virusb: skip USB devices with an inaccessible device node
by Yaroslav Borbat 16 Jul '26

16 Jul '26

From: Yaroslav Borbat <yaroslav.752(a)gmail.com> Inside a container sysfs is usually mounted from the host and exposes all USB devices, while nodes under /dev/bus/usb/ only exist for devices passed into the container's mount namespace. virUSBDeviceSearch() enumerated devices from sysfs alone, so such a device was reported as present: a hostdev with startupPolicy='optional' was not dropped and the domain failed to start. Skip devices whose /dev node is inaccessible during enumeration. virUSBDeviceFind() now ignores them for optional hostdevs and reports an explicit "not accessible in the current mount namespace" error for mandatory ones. Extend the virusb test to cover both cases. Closes: libvirt/libvirt#894 Signed-off-by: Yaroslav Borbat <yaroslav.752(a)gmail.com> --- src/util/virusb.c | 41 ++++++++++++++++++++++++++++++++++++----- tests/virusbmock.c | 33 ++++++++++++++++++++++++++++++++- tests/virusbtest.c | 38 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 106 insertions(+), 6 deletions(-) diff --git a/src/util/virusb.c b/src/util/virusb.c index 85ad3d58ce..1d31912971 100644 --- a/src/util/virusb.c +++ b/src/util/virusb.c @@ -120,7 +120,8 @@ virUSBDeviceSearch(unsigned int vendor, unsigned int devno, const char *port, const char *vroot, - unsigned int flags) + unsigned int flags, + char **inaccessiblePath) { g_autoptr(DIR) dir = NULL; bool found = false; @@ -198,6 +199,28 @@ virUSBDeviceSearch(unsigned int vendor, if (!usb) goto cleanup; + /* In containerized environments sysfs may expose USB devices + * from the host kernel while the corresponding device node + * under /dev/bus/usb/ is not present in the current mount + * namespace. Such a device cannot be used, so skip it here. + * Remember its path so that the caller can distinguish "no + * matching device at all" from "device present on the host but + * inaccessible in our mount namespace" when reporting errors. */ + if (virUSBDeviceGetPath(usb) && + !virFileExists(virUSBDeviceGetPath(usb))) { + VIR_DEBUG("USB device %03u:%03u found in sysfs but device " + "node '%s' is not accessible in the current mount " + "namespace, skipping", + found_bus, found_devno, + virUSBDeviceGetPath(usb)); + if (inaccessiblePath && !*inaccessiblePath) + *inaccessiblePath = g_strdup(virUSBDeviceGetPath(usb)); + g_clear_pointer(&usb, virUSBDeviceFree); + if (found) + break; + continue; + } + if (virUSBDeviceListAdd(list, &usb) < 0) goto cleanup; @@ -226,10 +249,11 @@ virUSBDeviceFind(unsigned int vendor, virUSBDeviceList **devices) { g_autoptr(virUSBDeviceList) list = NULL; + g_autofree char *inaccessiblePath = NULL; int count; if (!(list = virUSBDeviceSearch(vendor, product, bus, devno, port, - vroot, flags))) + vroot, flags, &inaccessiblePath))) return -1; count = list->count; @@ -240,9 +264,16 @@ virUSBDeviceFind(unsigned int vendor, return 0; } - virReportError(VIR_ERR_INTERNAL_ERROR, - _("Did not find matching USB device: vid:%1$04x, pid:%2$04x, bus:%3$u, device:%4$u, port:%5$s"), - vendor, product, bus, devno, port ? port : ""); + if (inaccessiblePath) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("USB device vid:%1$04x, pid:%2$04x, bus:%3$u, device:%4$u, port:%5$s is present on the host but its device node '%6$s' is not accessible in the current mount namespace"), + vendor, product, bus, devno, port ? port : "", + inaccessiblePath); + } else { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Did not find matching USB device: vid:%1$04x, pid:%2$04x, bus:%3$u, device:%4$u, port:%5$s"), + vendor, product, bus, devno, port ? port : ""); + } return -1; } diff --git a/tests/virusbmock.c b/tests/virusbmock.c index c23bed4528..c67a0ba307 100644 --- a/tests/virusbmock.c +++ b/tests/virusbmock.c @@ -22,18 +22,27 @@ #include <sys/stat.h> #include <dirent.h> #include <dlfcn.h> +#include <errno.h> #include <fcntl.h> +#include <unistd.h> #include "virmock.h" #define USB_SYSFS "/sys/bus/usb" #define FAKE_USB_SYSFS "virusbtestdata/sys_bus_usb" +#define USB_DEVFS "/dev/bus/usb/" + +/* Device node of the test device that is present in the fake sysfs but is + * meant to be inaccessible in the current mount namespace (usb4, i.e. the + * root hub 1d6b:0003 on bus 4). See virusbtest.c. */ +#define INACCESSIBLE_USB_NODE USB_DEVFS "004/001" static int (*real_open)(const char *pathname, int flags, ...); #if WITH___OPEN_2 static int (*real___open_2)(const char *path, int flags); #endif static DIR *(*real_opendir)(const char *name); +static int (*real_access)(const char *path, int mode); static void init_syms(void) { @@ -49,6 +58,7 @@ static void init_syms(void) VIR_MOCK_REAL_INIT(__open_2); #endif VIR_MOCK_REAL_INIT(opendir); + VIR_MOCK_REAL_INIT(access); } static char *get_fake_path(const char *real_path) @@ -58,7 +68,7 @@ static char *get_fake_path(const char *real_path) if ((p = STRSKIP(real_path, USB_SYSFS))) path = g_strdup_printf("%s/%s/%s", abs_srcdir, FAKE_USB_SYSFS, p); - else if (!p) + else path = g_strdup(real_path); return path; @@ -75,6 +85,27 @@ DIR *opendir(const char *name) return real_opendir(path); } +int access(const char *path, int mode) +{ + init_syms(); + + /* virUSBDeviceSearch() checks whether the /dev/bus/usb node of a device + * found in sysfs is accessible. There are no such nodes in the test + * environment, so pretend every USB device node exists, except the one + * device that is meant to be inaccessible in the current mount namespace + * (as happens inside a container). This lets us exercise the code path + * without shipping empty device-node files. */ + if (STRPREFIX(path, USB_DEVFS)) { + if (STREQ(path, INACCESSIBLE_USB_NODE)) { + errno = ENOENT; + return -1; + } + return 0; + } + + return real_access(path, mode); +} + int open(const char *pathname, int flags, ...) { g_autofree char *path = NULL; diff --git a/tests/virusbtest.c b/tests/virusbtest.c index 12ac338df9..58ca769059 100644 --- a/tests/virusbtest.c +++ b/tests/virusbtest.c @@ -259,6 +259,40 @@ testUSBList(const void *opaque G_GNUC_UNUSED) } +/* usb4 (bus 4, device 1) is present in the fake sysfs, but the mock makes + * its /dev/bus/usb node inaccessible, i.e. the device is exposed by the host + * kernel but not accessible in our mount namespace (as happens inside a + * container). Such a device must be treated as absent: skipped for + * startupPolicy 'optional' (mandatory == false) and reported as an error + * otherwise. */ +static int +testDeviceFindInaccessible(const void *opaque G_GNUC_UNUSED) +{ + g_autoptr(virUSBDeviceList) devs = NULL; + int rv; + + rv = virUSBDeviceFind(0x1d6b, 0x0003, 4, 1, NULL, NULL, false, + USB_DEVICE_FIND_BY_DEVICE, &devs); + if (rv != 0 || devs) { + virReportError(VIR_ERR_INTERNAL_ERROR, + "optional inaccessible device: expected no match " + "(rv=0 and no device list), got rv=%d", rv); + return -1; + } + + rv = virUSBDeviceFind(0x1d6b, 0x0003, 4, 1, NULL, NULL, true, + USB_DEVICE_FIND_BY_DEVICE, &devs); + if (rv >= 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + "mandatory inaccessible device: expected failure, " + "but the device was reported as available"); + return -1; + } + + return 0; +} + + static int mymain(void) { @@ -336,6 +370,10 @@ mymain(void) if (virTestRun("USB List test", testUSBList, NULL) < 0) rv = -1; + if (virTestRun("USBDeviceFind inaccessible node", + testDeviceFindInaccessible, NULL) < 0) + rv = -1; + if (rv < 0) return EXIT_FAILURE; return EXIT_SUCCESS; -- 2.54.0

1 0

[PATCH 0/7] qemu: Update qemu capabilities and use new monitor syntax
by Peter Krempa 16 Jul '26

16 Jul '26

Peter Krempa (7): qemucapabilitiestest: Update 'caps_11.1.0_x86_64' to 'v11.1.0-rc0' qemucapabilitiestest: Update 'caps_11.1.0_aarch64' to 'v11.1.0-rc0' qemuMonitorJSONIOProcessLine: Log monitor object pointer in debug message qemu: monitor: Standardize log format in QEMU_CHECK_MONITOR_FULL macro qemu: capabilities: Introduce QEMU_CAPS_OBJECT_MONITOR_QMP qemu: command: Use monitor via '-object monitor-qmp,...' qemuxmlconftest: Add a note that the pinned CPU model tests test also old-style QMP monitor instantation src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 17 +- src/qemu/qemu_monitor.c | 2 +- src/qemu/qemu_monitor_json.c | 2 +- .../qemu_11.1.0-q35.x86_64-expanded.xml | 1 + .../qemu_11.1.0-q35.x86_64-supported.xml | 1 + .../domaincapsdata/qemu_11.1.0-q35.x86_64.xml | 1 + tests/domaincapsdata/qemu_11.1.0.x86_64.xml | 1 + .../caps_11.1.0_aarch64.replies | 2026 +++++++++-------- .../caps_11.1.0_aarch64.xml | 5 +- .../caps_11.1.0_x86_64.replies | 1996 ++++++++-------- .../caps_11.1.0_x86_64.xml | 7 +- ...arch64-cpu-passthrough.aarch64-latest.args | 2 +- ...ault-cpu-kvm-virt-10.0.aarch64-latest.args | 2 +- ...ault-cpu-tcg-virt-10.0.aarch64-latest.args | 2 +- ...aarch64-features-pauth.aarch64-latest.args | 2 +- .../aarch64-features-ras.aarch64-latest.args | 2 +- .../aarch64-features-sve.aarch64-latest.args | 2 +- ...rch64-gic-default-both.aarch64-latest.args | 2 +- ...aarch64-gic-default-v2.aarch64-latest.args | 2 +- ...aarch64-gic-default-v3.aarch64-latest.args | 2 +- .../aarch64-gic-default.aarch64-latest.args | 2 +- .../aarch64-gic-host.aarch64-latest.args | 2 +- .../aarch64-gic-none-both.aarch64-latest.args | 2 +- .../aarch64-gic-none-tcg.aarch64-latest.args | 2 +- .../aarch64-gic-none-v2.aarch64-latest.args | 2 +- .../aarch64-gic-none-v3.aarch64-latest.args | 2 +- .../aarch64-gic-none.aarch64-latest.args | 2 +- .../aarch64-gic-v2.aarch64-latest.args | 2 +- .../aarch64-gic-v3.aarch64-latest.args | 2 +- .../aarch64-kvm-32-on-64.aarch64-latest.args | 2 +- ...usb-minimal.aarch64-latest.abi-update.args | 2 +- .../aarch64-nousb-minimal.aarch64-latest.args | 2 +- .../aarch64-pci-serial.aarch64-latest.args | 2 +- ...iew-minimal.aarch64-latest.abi-update.args | 2 +- ...rch64-realview-minimal.aarch64-latest.args | 2 +- ...arch64-traditional-pci.aarch64-latest.args | 2 +- ...aarch64-usb-controller.aarch64-latest.args | 2 +- .../aarch64-video-default.aarch64-latest.args | 2 +- ...4-video-virtio-gpu-pci.aarch64-latest.args | 2 +- ...ault-models.aarch64-latest.abi-update.args | 2 +- ...64-virt-default-models.aarch64-latest.args | 2 +- ...rch64-virt-default-nic.aarch64-latest.args | 2 +- .../aarch64-virt-graphics.aarch64-latest.args | 2 +- ...h64-virt-headless-mmio.aarch64-latest.args | 2 +- .../aarch64-virt-headless.aarch64-latest.args | 2 +- ...irt-minimal.aarch64-latest.abi-update.args | 2 +- .../aarch64-virt-minimal.aarch64-latest.args | 2 +- .../aarch64-virt-virtio.aarch64-latest.args | 2 +- ...64-virt-virtualization.aarch64-latest.args | 2 +- ...o-pci-manual-addresses.aarch64-latest.args | 2 +- .../acpi-generic-initiator.x86_64-latest.args | 2 +- .../acpi-table-many.x86_64-latest.args | 2 +- .../acpi-table.x86_64-latest.args | 2 +- .../amd-iommu.x86_64-latest.args | 2 +- .../arm-vexpressa9-basic.aarch64-latest.args | 2 +- .../arm-vexpressa9-nodevs.aarch64-latest.args | 2 +- .../arm-vexpressa9-virtio.aarch64-latest.args | 2 +- .../async-teardown.x86_64-latest.args | 2 +- .../audio-alsa-best.x86_64-latest.args | 2 +- .../audio-alsa-full.x86_64-latest.args | 2 +- .../audio-alsa-minimal.x86_64-latest.args | 2 +- .../audio-coreaudio-best.x86_64-latest.args | 2 +- .../audio-coreaudio-full.x86_64-latest.args | 2 +- ...audio-coreaudio-minimal.x86_64-latest.args | 2 +- ...udio-default-nographics.x86_64-latest.args | 2 +- .../audio-default-sdl.x86_64-latest.args | 2 +- .../audio-default-spice.x86_64-latest.args | 2 +- .../audio-default-vnc.x86_64-latest.args | 2 +- .../audio-file-best.x86_64-latest.args | 2 +- .../audio-file-full.x86_64-latest.args | 2 +- .../audio-file-minimal.x86_64-latest.args | 2 +- .../audio-jack-full.x86_64-latest.args | 2 +- .../audio-jack-minimal.x86_64-latest.args | 2 +- .../audio-many-backends.x86_64-latest.args | 2 +- .../audio-none-best.x86_64-latest.args | 2 +- .../audio-none-full.x86_64-latest.args | 2 +- .../audio-none-minimal.x86_64-latest.args | 2 +- .../audio-oss-best.x86_64-latest.args | 2 +- .../audio-oss-full.x86_64-latest.args | 2 +- .../audio-oss-minimal.x86_64-latest.args | 2 +- .../audio-pipewire-best.x86_64-latest.args | 2 +- .../audio-pipewire-full.x86_64-latest.args | 2 +- .../audio-pipewire-minimal.x86_64-latest.args | 2 +- .../audio-pulseaudio-best.x86_64-latest.args | 2 +- .../audio-pulseaudio-full.x86_64-latest.args | 2 +- ...udio-pulseaudio-minimal.x86_64-latest.args | 2 +- .../audio-sdl-best.x86_64-latest.args | 2 +- .../audio-sdl-full.x86_64-latest.args | 2 +- .../audio-sdl-minimal.x86_64-latest.args | 2 +- .../audio-spice-best.x86_64-latest.args | 2 +- .../audio-spice-full.x86_64-latest.args | 2 +- .../audio-spice-minimal.x86_64-latest.args | 2 +- .../autoindex.x86_64-latest.args | 2 +- .../balloon-device-auto.x86_64-latest.args | 2 +- ...loon-device-deflate-off.x86_64-latest.args | 2 +- .../balloon-device-deflate.x86_64-latest.args | 2 +- .../balloon-device-period.x86_64-latest.args | 2 +- .../balloon-device.x86_64-latest.args | 2 +- .../balloon-mmio-deflate.aarch64-latest.args | 2 +- .../blkdeviotune-group-num.x86_64-latest.args | 2 +- ...blkdeviotune-max-length.x86_64-latest.args | 2 +- .../blkdeviotune-max.x86_64-latest.args | 2 +- .../blkdeviotune.x86_64-latest.args | 2 +- .../blkiotune-device.x86_64-latest.args | 2 +- .../blkiotune.x86_64-latest.args | 2 +- .../boot-cdrom.x86_64-latest.args | 2 +- .../boot-complex.x86_64-latest.args | 2 +- .../boot-floppy-q35.x86_64-latest.args | 2 +- .../boot-floppy.x86_64-latest.args | 2 +- ...boot-menu-disable-drive.x86_64-latest.args | 2 +- ...nu-disable-with-timeout.x86_64-latest.args | 2 +- .../boot-menu-disable.x86_64-latest.args | 2 +- ...enu-enable-with-timeout.x86_64-latest.args | 2 +- .../boot-menu-enable.x86_64-latest.args | 2 +- .../boot-multi.x86_64-latest.args | 2 +- .../boot-network.x86_64-latest.args | 2 +- .../boot-order.x86_64-latest.args | 2 +- .../channel-guestfwd.x86_64-latest.args | 2 +- ...l-qemu-vdagent-features.x86_64-latest.args | 2 +- .../channel-qemu-vdagent.x86_64-latest.args | 2 +- .../channel-spicevmc.x86_64-latest.args | 2 +- .../channel-unix-guestfwd.x86_64-latest.args | 2 +- ...hannel-unix-source-path.x86_64-latest.args | 2 +- .../channel-virtio-auto.x86_64-latest.args | 2 +- .../channel-virtio-autoadd.x86_64-latest.args | 2 +- ...annel-virtio-autoassign.x86_64-latest.args | 2 +- .../channel-virtio-default.x86_64-latest.args | 2 +- .../channel-virtio-state.x86_64-latest.args | 2 +- .../channel-virtio-unix.x86_64-latest.args | 2 +- .../channel-virtio.x86_64-latest.args | 2 +- .../chardev-backends-json.x86_64-latest.args | 2 +- .../chardev-backends.x86_64-latest.args | 2 +- .../chardev-label.x86_64-latest.args | 2 +- .../chardev-reconnect.x86_64-latest.args | 2 +- .../clock-absolute.x86_64-latest.args | 2 +- .../clock-catchup.x86_64-latest.args | 2 +- .../clock-france.x86_64-latest.args | 2 +- .../clock-hpet-off.x86_64-latest.args | 2 +- ...caltime-basis-localtime.x86_64-latest.args | 2 +- .../clock-localtime.x86_64-latest.args | 2 +- .../clock-realtime.x86_64-latest.args | 2 +- .../clock-timer-armvtimer.aarch64-latest.args | 2 +- .../clock-timer-hyperv-rtc.x86_64-latest.args | 2 +- .../clock-utc.x86_64-latest.args | 2 +- .../clock-variable.x86_64-latest.args | 2 +- .../console-compat-auto.x86_64-latest.args | 2 +- .../console-compat-chardev.x86_64-latest.args | 2 +- .../console-compat-crash.x86_64-latest.args | 2 +- .../console-compat.x86_64-latest.args | 2 +- .../console-compat2.x86_64-latest.args | 2 +- .../console-virtio-many.x86_64-latest.args | 2 +- ...rial-autoassign-address.x86_64-latest.args | 2 +- .../console-virtio-unix.x86_64-latest.args | 2 +- .../console-virtio.x86_64-latest.args | 2 +- .../controller-order.x86_64-latest.args | 2 +- .../controller-scsi-auto.x86_64-latest.args | 2 +- ...ller-scsi-inherit-model.x86_64-latest.args | 2 +- .../controller-usb-order.x86_64-latest.args | 2 +- .../controller-virtio-scsi.x86_64-latest.args | 2 +- .../cpu-Haswell-noTSX.x86_64-latest.args | 2 +- .../cpu-Haswell.x86_64-latest.args | 2 +- .../cpu-Haswell2.x86_64-latest.args | 2 +- .../cpu-Haswell3.x86_64-latest.args | 2 +- ...-Icelake-Server-pconfig.x86_64-latest.args | 2 +- .../cpu-cache-disable.x86_64-latest.args | 2 +- .../cpu-cache-disable3.x86_64-latest.args | 2 +- .../cpu-cache-emulate-l3.x86_64-latest.args | 2 +- .../cpu-cache-passthrough.x86_64-latest.args | 2 +- .../cpu-check-default-none.x86_64-latest.args | 2 +- ...cpu-check-default-none2.x86_64-latest.args | 2 +- ...u-check-default-partial.x86_64-latest.args | 2 +- ...-check-default-partial2.x86_64-latest.args | 2 +- .../cpu-check-none.x86_64-latest.args | 2 +- .../cpu-empty.x86_64-latest.args | 2 +- .../cpu-eoi-disabled.x86_64-latest.args | 2 +- .../cpu-eoi-enabled.x86_64-latest.args | 2 +- .../cpu-exact1.x86_64-latest.args | 2 +- .../cpu-exact2-nofallback.x86_64-latest.args | 2 +- .../cpu-exact2.x86_64-latest.args | 2 +- .../cpu-host-kvmclock.x86_64-latest.args | 2 +- .../cpu-host-model-cmt.x86_64-latest.args | 2 +- ...host-model-fallback-kvm.x86_64-latest.args | 4 +- ...host-model-fallback-tcg.x86_64-latest.args | 2 +- ...cpu-host-model-features.x86_64-latest.args | 4 +- .../cpu-host-model-kvm.x86_64-latest.args | 4 +- ...st-model-nofallback-kvm.x86_64-latest.args | 4 +- ...st-model-nofallback-tcg.x86_64-latest.args | 2 +- .../cpu-host-model-tcg.x86_64-latest.args | 2 +- .../cpu-host-model-vendor.x86_64-latest.args | 2 +- ...st-passthrough-features.x86_64-latest.args | 2 +- .../cpu-host-passthrough.x86_64-latest.args | 2 +- .../cpu-hotplug-startup.x86_64-latest.args | 2 +- .../cpu-kvmclock.x86_64-latest.args | 2 +- .../cpu-minimum1.x86_64-latest.args | 2 +- .../cpu-minimum2.x86_64-latest.args | 2 +- ...cpu-no-removed-features.x86_64-latest.args | 2 +- .../cpu-numa-disjoint.x86_64-latest.args | 2 +- .../cpu-numa-disordered.x86_64-latest.args | 2 +- .../cpu-numa-memshared.x86_64-latest.args | 2 +- ...-numa-no-memory-element.x86_64-latest.args | 2 +- .../cpu-numa1.x86_64-latest.args | 2 +- .../cpu-numa2.x86_64-latest.args | 2 +- ...-phys-bits-emulate-bare.x86_64-latest.args | 2 +- .../cpu-phys-bits-emulate.x86_64-latest.args | 2 +- .../cpu-phys-bits-emulate2.x86_64-latest.args | 2 +- .../cpu-phys-bits-limit.x86_64-latest.args | 2 +- ...u-phys-bits-passthrough.x86_64-latest.args | 2 +- .../cpu-strict1.x86_64-latest.args | 2 +- .../cpu-topology1.x86_64-latest.args | 2 +- .../cpu-topology2.x86_64-latest.args | 2 +- .../cpu-topology3.x86_64-latest.args | 2 +- .../cpu-topology4.x86_64-latest.args | 2 +- .../cpu-topology5.aarch64-latest.args | 2 +- .../cpu-translation.x86_64-latest.args | 2 +- .../cpu-tsc-frequency.x86_64-latest.args | 2 +- .../cputune-cpuset-big-id.x86_64-latest.args | 2 +- .../cputune-numatune.x86_64-latest.args | 2 +- .../cputune-zero-shares.x86_64-latest.args | 2 +- .../cputune.x86_64-latest.args | 2 +- .../crypto-builtin.x86_64-latest.args | 2 +- .../default-kvm-host-arch.x86_64-latest.args | 2 +- .../default-qemu-host-arch.x86_64-latest.args | 2 +- ...ult-video-type-aarch64.aarch64-latest.args | 2 +- ...fault-video-type-x86_64.x86_64-latest.args | 2 +- .../devices-acpi-index.x86_64-latest.args | 2 +- .../disk-active-commit.x86_64-latest.args | 2 +- .../disk-aio-io_uring.x86_64-latest.args | 2 +- .../disk-aio.x86_64-latest.args | 2 +- .../disk-arm-virtio-sd.aarch64-latest.args | 2 +- ...-backing-chains-noindex.x86_64-latest.args | 2 +- ...disk-blockio-no-discard.x86_64-latest.args | 2 +- .../disk-blockio.x86_64-latest.args | 2 +- .../disk-boot-cdrom.x86_64-latest.args | 2 +- .../disk-boot-disk.x86_64-latest.args | 2 +- .../disk-cache.x86_64-latest.args | 2 +- ...m-empty-network-invalid.x86_64-latest.args | 2 +- ...sk-cdrom-network-nbdkit.x86_64-latest.args | 2 +- .../disk-cdrom-network.x86_64-latest.args | 2 +- .../disk-cdrom-tray.x86_64-latest.args | 2 +- ...om-usb-empty.x86_64-latest.abi-update.args | 2 +- .../disk-cdrom.x86_64-latest.args | 2 +- .../disk-copy_on_read.x86_64-latest.args | 2 +- .../disk-detect-zeroes.x86_64-latest.args | 2 +- .../disk-discard.x86_64-latest.args | 2 +- .../disk-discard_no_unref.x86_64-latest.args | 2 +- .../disk-error-policy.x86_64-latest.args | 2 +- .../disk-floppy-q35.x86_64-latest.args | 2 +- .../disk-floppy-tray.x86_64-latest.args | 2 +- .../disk-floppy.x86_64-latest.args | 2 +- .../disk-fmt-qcow.x86_64-latest.args | 2 +- .../disk-geometry.x86_64-latest.args | 2 +- .../disk-ide-split.x86_64-latest.args | 2 +- .../disk-ide-wwn.x86_64-latest.args | 2 +- .../disk-ioeventfd.x86_64-latest.args | 2 +- .../disk-metadata-cache.x86_64-latest.args | 2 +- .../disk-mirror-old.x86_64-latest.args | 2 +- .../disk-mirror.x86_64-latest.args | 2 +- ...isk-network-http-nbdkit.x86_64-latest.args | 2 +- .../disk-network-http.x86_64-latest.args | 2 +- .../disk-network-iscsi.x86_64-latest.args | 2 +- .../disk-network-nbd.x86_64-latest.args | 2 +- .../disk-network-nfs.x86_64-latest.args | 2 +- ...rbd-encryption-layering.x86_64-latest.args | 2 +- ...rbd-encryption-luks-any.x86_64-latest.args | 2 +- ...-network-rbd-encryption.x86_64-latest.args | 2 +- ...sk-network-rbd-no-colon.x86_64-latest.args | 2 +- .../disk-network-rbd.x86_64-latest.args | 2 +- ...isk-network-source-auth.x86_64-latest.args | 2 +- ...rce-curl-nbdkit-backing.x86_64-latest.args | 2 +- ...work-source-curl-nbdkit.x86_64-latest.args | 2 +- ...isk-network-source-curl.x86_64-latest.args | 2 +- .../disk-network-ssh-key.x86_64-latest.args | 2 +- ...disk-network-ssh-nbdkit.x86_64-latest.args | 2 +- ...sk-network-ssh-password.x86_64-latest.args | 2 +- .../disk-network-ssh.x86_64-latest.args | 2 +- ...rk-tlsx509-nbd-hostname.x86_64-latest.args | 2 +- ...isk-network-tlsx509-nbd.x86_64-latest.args | 2 +- .../disk-no-boot.x86_64-latest.args | 2 +- .../disk-nvme.x86_64-latest.args | 2 +- .../disk-order.x86_64-latest.args | 2 +- ...sk-qcow2-datafile-store.x86_64-latest.args | 2 +- .../disk-readonly-disk.x86_64-latest.args | 2 +- .../disk-rotation.x86_64-latest.args | 2 +- .../disk-sata-device.x86_64-latest.args | 2 +- .../disk-sata-product.x86_64-latest.args | 2 +- .../disk-scsi-device-auto.x86_64-latest.args | 2 +- .../disk-scsi-disk-split.x86_64-latest.args | 2 +- .../disk-scsi-disk-vpd.x86_64-latest.args | 2 +- .../disk-scsi-disk-wwn.x86_64-latest.args | 2 +- ...sk-scsi-lun-passthrough.x86_64-latest.args | 2 +- .../disk-scsi.x86_64-latest.args | 2 +- .../disk-serial.x86_64-latest.args | 2 +- .../disk-shared.x86_64-latest.args | 2 +- .../disk-slices.x86_64-latest.args | 2 +- .../disk-snapshot.x86_64-latest.args | 2 +- .../disk-source-fd.x86_64-latest.args | 2 +- .../disk-source-pool-mode.x86_64-latest.args | 2 +- .../disk-source-pool.x86_64-latest.args | 2 +- ...tuppolicy-optional-drop.x86_64-latest.args | 2 +- ...sk-statistics-intervals.x86_64-latest.args | 2 +- .../disk-target-nvme.x86_64-latest.args | 2 +- .../disk-transient.x86_64-latest.args | 2 +- .../disk-usb-device-model.x86_64-latest.args | 2 +- ...est.QEMU_CAPS_DEVICE_USB_BOT-disabled.args | 2 +- ...ate.QEMU_CAPS_DEVICE_USB_BOT-disabled.args | 2 +- ...k-usb-device.x86_64-latest.abi-update.args | 2 +- .../disk-usb-device.x86_64-latest.args | 2 +- .../disk-vhostuser-numa.x86_64-latest.args | 2 +- .../disk-vhostuser.x86_64-latest.args | 2 +- .../disk-vhostvdpa.x86_64-latest.args | 2 +- .../disk-virtio-queues.x86_64-latest.args | 2 +- ...irtio-scsi-reservations.x86_64-latest.args | 2 +- .../disk-virtio.x86_64-latest.args | 2 +- .../downscript.x86_64-latest.args | 2 +- .../encrypted-disk-usage.x86_64-latest.args | 2 +- .../encrypted-disk.x86_64-latest.args | 2 +- .../eoi-disabled.x86_64-latest.args | 2 +- .../eoi-enabled.x86_64-latest.args | 2 +- .../event_idx.x86_64-latest.args | 2 +- ...memory-no-numa-topology.x86_64-latest.args | 2 +- ...fd-memory-numa-topology.x86_64-latest.args | 2 +- ...d-memory-numa-topology2.x86_64-latest.args | 2 +- ...d-memory-numa-topology3.x86_64-latest.args | 2 +- ...d-memory-numa-topology4.x86_64-latest.args | 2 +- .../fips-enabled.x86_64-latest.args | 2 +- ...are-auto-bios-stateless.x86_64-latest.args | 2 +- .../firmware-auto-bios.x86_64-latest.args | 2 +- ...efi-aarch64.aarch64-latest.abi-update.args | 2 +- ...mware-auto-efi-aarch64.aarch64-latest.args | 2 +- ...-enrolled-keys-aarch64.aarch64-latest.args | 2 +- ...-auto-efi-enrolled-keys.x86_64-latest.args | 2 +- ...loader-qcow2-nvram-path.x86_64-latest.args | 2 +- ...efi-format-loader-qcow2.x86_64-latest.args | 2 +- ...-loader-raw.aarch64-latest.abi-update.args | 2 +- ...-efi-format-loader-raw.aarch64-latest.args | 2 +- ...uto-efi-format-mismatch.x86_64-latest.args | 2 +- ...nvram-qcow2-network-nbd.x86_64-latest.args | 2 +- ...format-nvram-qcow2-path.x86_64-latest.args | 2 +- ...-efi-format-nvram-qcow2.x86_64-latest.args | 2 +- ...t-nvram-raw-loader-path.x86_64-latest.args | 2 +- ...-raw-nvramtemplate-path.x86_64-latest.args | 2 +- ...at-nvram-raw.x86_64-latest.abi-update.args | 2 +- ...to-efi-format-nvram-raw.x86_64-latest.args | 2 +- ...mat-nvramtemplate-qcow2.x86_64-latest.args | 2 +- ...uto-efi-loader-insecure.x86_64-latest.args | 2 +- ...re-auto-efi-loader-path.x86_64-latest.args | 2 +- ...oader-secure.x86_64-latest.abi-update.args | 2 +- ...-auto-efi-loader-secure.x86_64-latest.args | 2 +- ...to-efi-no-enrolled-keys.x86_64-latest.args | 2 +- ...are-auto-efi-no-secboot.x86_64-latest.args | 2 +- ...are-auto-efi-nvram-file.x86_64-latest.args | 2 +- ...efi-nvram-network-iscsi.x86_64-latest.args | 2 +- ...o-efi-nvram-network-nbd.x86_64-latest.args | 2 +- ...are-auto-efi-nvram-path.x86_64-latest.args | 2 +- ...auto-efi-nvram-template.x86_64-latest.args | 2 +- ...ware-auto-efi-rw-pflash.x86_64-latest.args | 2 +- .../firmware-auto-efi-rw.x86_64-latest.args | 2 +- ...rmware-auto-efi-secboot.x86_64-latest.args | 2 +- ...rmware-auto-efi-smm-off.x86_64-latest.args | 2 +- ...ware-auto-efi-stateless.x86_64-latest.args | 2 +- ...o-efi-varstore-aarch64.aarch64-latest.args | 2 +- ...e-auto-efi-varstore-q35.x86_64-latest.args | 2 +- ...are-auto-efi.x86_64-latest.abi-update.args | 2 +- .../firmware-auto-efi.x86_64-latest.args | 2 +- ...nual-bios-not-stateless.x86_64-latest.args | 2 +- ...e-manual-bios-stateless.x86_64-latest.args | 2 +- .../firmware-manual-bios.x86_64-latest.args | 2 +- ...i-aarch64-legacy-paths.aarch64-latest.args | 2 +- ...anual-efi-acpi-aarch64.aarch64-latest.args | 2 +- ...are-manual-efi-acpi-q35.x86_64-latest.args | 2 +- ...are-manual-efi-features.x86_64-latest.args | 2 +- ...loader-path-nonstandard.x86_64-latest.args | 2 +- ...anual-efi-loader-secure.x86_64-latest.args | 2 +- ...olled-keys-legacy-paths.x86_64-latest.args | 2 +- ...al-efi-no-enrolled-keys.x86_64-latest.args | 2 +- ...no-secboot-legacy-paths.x86_64-latest.args | 2 +- ...e-manual-efi-no-secboot.x86_64-latest.args | 2 +- ...ual-efi-noacpi-aarch64.aarch64-latest.args | 2 +- ...e-manual-efi-nvram-file.x86_64-latest.args | 2 +- ...efi-nvram-network-iscsi.x86_64-latest.args | 2 +- ...l-efi-nvram-network-nbd.x86_64-latest.args | 2 +- ...late-nonstandard-format.x86_64-latest.args | 2 +- ...onstandard-legacy-paths.x86_64-latest.args | 2 +- ...am-template-nonstandard.x86_64-latest.args | 2 +- ...nual-efi-nvram-template.x86_64-latest.args | 2 +- ...-manual-efi-rw-implicit.x86_64-latest.args | 2 +- ...ual-efi-rw-legacy-paths.x86_64-latest.args | 2 +- ...ual-efi-rw-modern-paths.x86_64-latest.args | 2 +- .../firmware-manual-efi-rw.x86_64-latest.args | 2 +- ...fi-secboot-legacy-paths.x86_64-latest.args | 2 +- ...ware-manual-efi-secboot.x86_64-latest.args | 2 +- ...re-manual-efi-stateless.x86_64-latest.args | 2 +- ...l-efi-varstore-aarch64.aarch64-latest.args | 2 +- ...manual-efi-varstore-q35.x86_64-latest.args | 2 +- .../firmware-manual-efi.x86_64-latest.args | 2 +- ...e-manual-noefi-acpi-q35.x86_64-latest.args | 2 +- ...l-noefi-noacpi-aarch64.aarch64-latest.args | 2 +- ...manual-noefi-noacpi-q35.x86_64-latest.args | 2 +- .../floppy-drive-fat.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/fs9p.x86_64-latest.args | 2 +- .../genid-auto.x86_64-latest.args | 2 +- .../qemuxmlconfdata/genid.x86_64-latest.args | 2 +- .../graphics-dbus-address.x86_64-latest.args | 2 +- .../graphics-dbus-audio.x86_64-latest.args | 2 +- .../graphics-dbus-chardev.x86_64-latest.args | 2 +- .../graphics-dbus-p2p.x86_64-latest.args | 2 +- .../graphics-dbus-usbredir.x86_64-latest.args | 2 +- .../graphics-dbus.x86_64-latest.args | 2 +- ...egl-headless-rendernode.x86_64-latest.args | 2 +- .../graphics-egl-headless.x86_64-latest.args | 2 +- ...graphics-listen-network.x86_64-latest.args | 2 +- .../graphics-rdp.x86_64-latest.args | 2 +- ...graphics-sdl-fullscreen.x86_64-latest.args | 2 +- .../graphics-sdl.x86_64-latest.args | 2 +- ...s-spice-agent-file-xfer.x86_64-latest.args | 2 +- ...aphics-spice-agentmouse.x86_64-latest.args | 2 +- ...s-spice-auto-socket-cfg.x86_64-latest.args | 2 +- ...phics-spice-auto-socket.x86_64-latest.args | 2 +- ...phics-spice-compression.x86_64-latest.args | 2 +- ...hics-spice-egl-headless.x86_64-latest.args | 2 +- ...pice-gl-auto-rendernode.x86_64-latest.args | 2 +- .../graphics-spice-no-args.x86_64-latest.args | 2 +- .../graphics-spice-qxl-vga.x86_64-latest.args | 2 +- .../graphics-spice-sasl.x86_64-latest.args | 2 +- .../graphics-spice-socket.x86_64-latest.args | 2 +- .../graphics-spice-timeout.x86_64-latest.args | 2 +- ...raphics-spice-usb-redir.x86_64-latest.args | 2 +- .../graphics-spice.x86_64-latest.args | 2 +- ...ics-vnc-auto-socket-cfg.x86_64-latest.args | 2 +- ...raphics-vnc-auto-socket.x86_64-latest.args | 2 +- ...aphics-vnc-egl-headless.x86_64-latest.args | 2 +- ...hics-vnc-no-listen-attr.x86_64-latest.args | 2 +- .../graphics-vnc-none.x86_64-latest.args | 2 +- .../graphics-vnc-policy.x86_64-latest.args | 2 +- .../graphics-vnc-power.x86_64-latest.args | 2 +- ...remove-generated-socket.x86_64-latest.args | 2 +- .../graphics-vnc-sasl.x86_64-latest.args | 2 +- ...-vnc-socket-new-cmdline.x86_64-latest.args | 2 +- .../graphics-vnc-socket.x86_64-latest.args | 2 +- ...hics-vnc-standalone-p2p.x86_64-latest.args | 2 +- ...s-vnc-standalone-socket.x86_64-latest.args | 2 +- ...graphics-vnc-standalone.x86_64-latest.args | 2 +- ...graphics-vnc-tls-secret.x86_64-latest.args | 2 +- .../graphics-vnc-tls.x86_64-latest.args | 2 +- .../graphics-vnc-websocket.x86_64-latest.args | 2 +- .../graphics-vnc.x86_64-latest.args | 2 +- ...tdev-mdev-display-ramfb.x86_64-latest.args | 2 +- ...play-spice-egl-headless.x86_64-latest.args | 2 +- ...ev-display-spice-opengl.x86_64-latest.args | 2 +- ...isplay-vnc-egl-headless.x86_64-latest.args | 2 +- ...ostdev-mdev-display-vnc.x86_64-latest.args | 2 +- .../hostdev-mdev-display.x86_64-latest.args | 2 +- ...hostdev-mdev-precreated.x86_64-latest.args | 2 +- ...tdev-pci-address-device.x86_64-latest.args | 2 +- ...-pci-address-unassigned.x86_64-latest.args | 2 +- .../hostdev-pci-address.x86_64-latest.args | 2 +- ...stdev-pci-display-ramfb.x86_64-latest.args | 2 +- ...stdev-pci-multifunction.x86_64-latest.args | 2 +- ...ev-scsi-autogen-address.x86_64-latest.args | 2 +- ...hostdev-scsi-large-unit.x86_64-latest.args | 2 +- .../hostdev-scsi-lsi.x86_64-latest.args | 2 +- .../hostdev-scsi-shareable.x86_64-latest.args | 2 +- ...dev-scsi-vhost-scsi-pci.x86_64-latest.args | 2 +- ...ev-scsi-vhost-scsi-pcie.x86_64-latest.args | 2 +- ...ostdev-scsi-virtio-scsi.x86_64-latest.args | 2 +- ...usb-address-device-boot.x86_64-latest.args | 2 +- ...tdev-usb-address-device.x86_64-latest.args | 2 +- ...ostdev-usb-address-port.x86_64-latest.args | 2 +- .../hostdev-usb-address.x86_64-latest.args | 2 +- ...tdev-usb-vendor-product.x86_64-latest.args | 2 +- ...ostdev-vfio-multidomain.x86_64-latest.args | 2 +- .../hostdev-vfio.x86_64-latest.args | 2 +- .../hotplug-base.x86_64-latest.args | 2 +- .../hugepages-default-2M.x86_64-latest.args | 2 +- ...ges-default-system-size.x86_64-latest.args | 2 +- .../hugepages-default.x86_64-latest.args | 2 +- .../hugepages-memaccess.x86_64-latest.args | 2 +- .../hugepages-memaccess2.x86_64-latest.args | 2 +- .../hugepages-memaccess3.x86_64-latest.args | 2 +- .../hugepages-nodeset.x86_64-latest.args | 2 +- ...gepages-numa-default-2M.x86_64-latest.args | 2 +- ...pages-numa-default-dimm.x86_64-latest.args | 2 +- .../hugepages-numa-default.x86_64-latest.args | 2 +- ...pages-numa-nodeset-part.x86_64-latest.args | 2 +- .../hugepages-numa-nodeset.x86_64-latest.args | 2 +- .../hugepages-nvdimm.x86_64-latest.args | 2 +- .../hugepages-shared.x86_64-latest.args | 2 +- .../qemuxmlconfdata/hwuuid.x86_64-latest.args | 2 +- .../hyperv-host-model.x86_64-latest.args | 2 +- .../hyperv-off.x86_64-latest.args | 2 +- .../hyperv-panic.x86_64-latest.args | 2 +- .../hyperv-passthrough.x86_64-latest.args | 2 +- ...-spinlocks-never-notify.x86_64-latest.args | 2 +- .../hyperv-stimer-direct.x86_64-latest.args | 2 +- .../qemuxmlconfdata/hyperv.x86_64-latest.args | 2 +- .../input-linux.x86_64-latest.args | 2 +- .../input-usbmouse-addr.x86_64-latest.args | 2 +- .../input-usbmouse.x86_64-latest.args | 2 +- .../input-usbtablet.x86_64-latest.args | 2 +- .../intel-iommu-aw-bits.x86_64-latest.args | 2 +- ...ntel-iommu-caching-mode.x86_64-latest.args | 2 +- ...ntel-iommu-device-iotlb.x86_64-latest.args | 2 +- ...l-iommu-dma-translation.x86_64-latest.args | 2 +- ...-eim-autoadd.x86_64-latest.abi-update.args | 2 +- .../intel-iommu-eim.x86_64-latest.args | 2 +- .../intel-iommu.x86_64-latest.args | 2 +- ...-smmuv3-pci-bus-single.aarch64-latest.args | 2 +- .../iommu-smmuv3-pci-bus.aarch64-latest.args | 2 +- .../iommu-smmuv3.aarch64-latest.args | 2 +- .../iommufd-q35-fd.x86_64-latest.args | 2 +- .../iommufd-q35.x86_64-latest.args | 2 +- ...fd-virt-pci-bus-single.aarch64-latest.args | 2 +- .../iommufd-virt.aarch64-latest.args | 2 +- .../iommufd.x86_64-latest.args | 2 +- .../iothreads-disk.x86_64-latest.args | 2 +- .../iothreads-ids-partial.x86_64-latest.args | 2 +- ...othreads-ids-pool-sizes.x86_64-latest.args | 2 +- .../iothreads-ids.x86_64-latest.args | 2 +- ...ads-virtio-scsi-mapping.x86_64-latest.args | 2 +- ...threads-virtio-scsi-pci.x86_64-latest.args | 2 +- .../kvm-features-off.x86_64-latest.args | 2 +- .../kvm-features.x86_64-latest.args | 2 +- .../kvm-pit-delay.x86_64-latest.args | 2 +- .../kvm-pit-discard.x86_64-latest.args | 2 +- .../kvmclock+eoi-disabled.x86_64-latest.args | 2 +- .../kvmclock.x86_64-latest.args | 2 +- ...nch-security-sev-direct.x86_64-latest.args | 2 +- ...launch-security-sev-snp.x86_64-latest.args | 2 +- .../qemuxmlconfdata/lease.x86_64-latest.args | 2 +- ...luks-disks-source-qcow2.x86_64-latest.args | 2 +- .../luks-disks-source.x86_64-latest.args | 2 +- .../luks-disks.x86_64-latest.args | 2 +- ...ch-virt-console-native.aarch64-latest.args | 2 +- ...ch-virt-console-virtio.aarch64-latest.args | 2 +- ...-serial+console-native.aarch64-latest.args | 2 +- ...ach-virt-serial-compat.aarch64-latest.args | 2 +- ...ach-virt-serial-native.aarch64-latest.args | 2 +- .../mach-virt-serial-pci.aarch64-latest.args | 2 +- .../mach-virt-serial-usb.aarch64-latest.args | 2 +- .../machine-aliases1.x86_64-latest.args | 2 +- .../machine-aliases2.x86_64-latest.args | 2 +- .../machine-core-off.x86_64-latest.args | 2 +- .../machine-core-on.x86_64-latest.args | 2 +- .../machine-i8042-off.x86_64-latest.args | 2 +- .../machine-i8042-on.x86_64-latest.args | 2 +- .../machine-smm-off.x86_64-latest.args | 2 +- .../machine-smm-on.x86_64-latest.args | 2 +- .../machine-vmport-opt.x86_64-latest.args | 2 +- ...memory-default-hugepage.x86_64-latest.args | 2 +- .../memfd-memory-numa.x86_64-latest.args | 2 +- ...emory-hotplug-dimm-addr.x86_64-latest.args | 2 +- .../memory-hotplug-dimm.x86_64-latest.args | 2 +- ...memory-hotplug-multiple.x86_64-latest.args | 2 +- ...-hotplug-numa-preferred.x86_64-latest.args | 2 +- ...y-hotplug-nvdimm-access.x86_64-latest.args | 2 +- ...ry-hotplug-nvdimm-align.x86_64-latest.args | 2 +- ...ry-hotplug-nvdimm-label.x86_64-latest.args | 2 +- ...-hotplug-nvdimm-overlap.x86_64-latest.args | 2 +- ...ory-hotplug-nvdimm-pmem.x86_64-latest.args | 2 +- ...hotplug-nvdimm-readonly.x86_64-latest.args | 2 +- .../memory-hotplug-nvdimm.x86_64-latest.args | 2 +- ...mory-hotplug-virtio-mem.x86_64-latest.args | 2 +- ...ory-hotplug-virtio-pmem.x86_64-latest.args | 2 +- .../memory-hotplug.x86_64-latest.args | 2 +- .../memorybacking-set.x86_64-latest.args | 2 +- .../memorybacking-unset.x86_64-latest.args | 2 +- .../memtune-unlimited.x86_64-latest.args | 2 +- .../memtune.x86_64-latest.args | 2 +- .../metadata-duplicate.x86_64-latest.args | 2 +- .../metadata.x86_64-latest.args | 2 +- .../migrate-numa-unaligned.x86_64-latest.args | 2 +- .../migrate.x86_64-latest.args | 2 +- .../misc-disable-s3.x86_64-latest.args | 2 +- .../misc-disable-suspends.x86_64-latest.args | 2 +- .../misc-enable-s4.x86_64-latest.args | 2 +- .../misc-no-reboot.x86_64-latest.args | 2 +- .../misc-uuid.x86_64-latest.args | 2 +- .../mlock-off.x86_64-latest.args | 2 +- .../mlock-on.x86_64-latest.args | 2 +- .../mtp-usb-device.x86_64-latest.args | 2 +- ...ultifunction-pci-device.x86_64-latest.args | 2 +- .../name-escape.x86_64-latest.args | 2 +- .../net-bandwidth.x86_64-latest.args | 2 +- .../net-bandwidth2.x86_64-latest.args | 2 +- .../net-client.x86_64-latest.args | 2 +- .../net-coalesce.x86_64-latest.args | 2 +- .../net-eth-hostip.x86_64-latest.args | 2 +- .../net-eth-ifname.x86_64-latest.args | 2 +- .../net-eth-names.x86_64-latest.args | 2 +- .../net-eth-unmanaged-tap.x86_64-latest.args | 2 +- .../net-eth.x86_64-latest.args | 2 +- .../net-hostdev-bootorder.x86_64-latest.args | 2 +- ...net-hostdev-multidomain.x86_64-latest.args | 2 +- ...ostdev-vfio-multidomain.x86_64-latest.args | 2 +- .../net-hostdev-vfio.x86_64-latest.args | 2 +- .../net-hostdev.x86_64-latest.args | 2 +- .../net-isolated-port.x86_64-latest.args | 2 +- .../net-linkstate.x86_64-latest.args | 2 +- .../net-many-models.x86_64-latest.args | 2 +- .../net-mcast.x86_64-latest.args | 2 +- .../net-midonet.x86_64-latest.args | 2 +- .../net-mtu.x86_64-latest.args | 2 +- .../net-openvswitch.x86_64-latest.args | 2 +- .../net-server.x86_64-latest.args | 2 +- .../net-udp.x86_64-latest.args | 2 +- .../net-usb.x86_64-latest.args | 2 +- .../net-user-addr.x86_64-latest.args | 2 +- .../net-user-passt.x86_64-latest.args | 2 +- .../net-user.x86_64-latest.args | 2 +- .../net-vdpa-multiqueue.x86_64-latest.args | 2 +- .../net-vdpa.x86_64-latest.args | 2 +- .../net-vhostuser-multiq.x86_64-latest.args | 2 +- .../net-vhostuser-passt.x86_64-latest.args | 2 +- .../net-vhostuser.x86_64-latest.args | 2 +- .../net-virtio-device.x86_64-latest.args | 2 +- ...virtio-disable-offloads.x86_64-latest.args | 2 +- .../net-virtio-netdev.x86_64-latest.args | 2 +- ...irtio-network-portgroup.x86_64-latest.args | 2 +- .../net-virtio-rss.x86_64-latest.args | 2 +- ...et-virtio-rxtxqueuesize.x86_64-latest.args | 2 +- ...-virtio-teaming-hostdev.x86_64-latest.args | 2 +- ...-virtio-teaming-network.x86_64-latest.args | 2 +- .../net-virtio-teaming.x86_64-latest.args | 2 +- .../net-virtio-vhost.x86_64-latest.args | 2 +- .../net-virtio.x86_64-latest.args | 2 +- .../nosharepages.x86_64-latest.args | 2 +- ...auto-memory-vcpu-cpuset.x86_64-latest.args | 2 +- ...no-cpuset-and-placement.x86_64-latest.args | 2 +- ...d-auto-vcpu-no-numatune.x86_64-latest.args | 2 +- ...to-vcpu-static-numatune.x86_64-latest.args | 2 +- ...static-memory-auto-vcpu.x86_64-latest.args | 2 +- ...static-vcpu-no-numatune.x86_64-latest.args | 2 +- .../qemuxmlconfdata/numad.x86_64-latest.args | 2 +- ...ne-auto-nodeset-invalid.x86_64-latest.args | 2 +- .../numatune-auto-prefer.x86_64-latest.args | 2 +- .../numatune-distances.x86_64-latest.args | 2 +- .../numatune-hmat-none.x86_64-latest.args | 2 +- .../numatune-hmat.x86_64-latest.args | 2 +- ...atune-memnode-no-memory.x86_64-latest.args | 2 +- ...emnode-restrictive-mode.x86_64-latest.args | 2 +- .../numatune-memnode.x86_64-latest.args | 2 +- .../numatune-no-vcpu.x86_64-latest.args | 2 +- .../numatune-system-memory.x86_64-latest.args | 2 +- ...vcpus-topology-mismatch.x86_64-latest.args | 2 +- .../pages-dimm-discard.x86_64-latest.args | 2 +- ...pages-discard-hugepages.x86_64-latest.args | 2 +- .../pages-discard.x86_64-latest.args | 2 +- .../panic-double.x86_64-latest.args | 2 +- .../panic-no-address.x86_64-latest.args | 2 +- .../qemuxmlconfdata/panic.x86_64-latest.args | 2 +- ...arallel-parport-chardev.x86_64-latest.args | 2 +- .../parallel-tcp-chardev.x86_64-latest.args | 2 +- .../parallel-unix-chardev.x86_64-latest.args | 2 +- ...pi-root-hotplug-disable.x86_64-latest.args | 2 +- ...cpi-root-hotplug-enable.x86_64-latest.args | 2 +- .../pci-autoadd-addr.x86_64-latest.args | 2 +- .../pci-autoadd-idx.x86_64-latest.args | 2 +- .../pci-autofill-addr.x86_64-latest.args | 2 +- .../pci-bridge-many-disks.x86_64-latest.args | 2 +- .../pci-bridge.x86_64-latest.args | 2 +- .../pci-expander-bus.x86_64-latest.args | 2 +- .../pci-many.x86_64-latest.args | 2 +- .../pci-rom-disabled.x86_64-latest.args | 2 +- .../pci-rom.x86_64-latest.args | 2 +- .../pci-serial-dev-chardev.x86_64-latest.args | 2 +- ...e-expander-bus-aarch64.aarch64-latest.args | 2 +- .../pcie-expander-bus.x86_64-latest.args | 2 +- ...root-port-model-generic.x86_64-latest.args | 2 +- ...root-port-model-ioh3420.x86_64-latest.args | 2 +- ...cie-root-port-nohotplug.x86_64-latest.args | 2 +- .../pcie-root-port.x86_64-latest.args | 2 +- .../pcie-root.x86_64-latest.args | 2 +- ...-switch-downstream-port.x86_64-latest.args | 2 +- ...ie-switch-upstream-port.x86_64-latest.args | 2 +- .../pcihole64-gib.x86_64-latest.args | 2 +- .../pcihole64-q35.x86_64-latest.args | 2 +- .../pcihole64-virt.aarch64-latest.args | 2 +- .../pcihole64.x86_64-latest.args | 2 +- .../pmu-feature-off.x86_64-latest.args | 2 +- .../pmu-feature.x86_64-latest.args | 2 +- .../pstore-acpi-erst.x86_64-latest.args | 2 +- .../pv-spinlock-disabled.x86_64-latest.args | 2 +- .../pv-spinlock-enabled.x86_64-latest.args | 2 +- .../pvpanic-pci-aarch64.aarch64-latest.args | 2 +- ...pci-no-address-aarch64.aarch64-latest.args | 2 +- .../pvpanic-pci-x86_64.x86_64-latest.args | 2 +- ...35-default-devices-only.x86_64-latest.args | 2 +- .../q35-multifunction.x86_64-latest.args | 2 +- .../q35-pci-force-address.x86_64-latest.args | 2 +- .../q35-pcie-autoadd.x86_64-latest.args | 2 +- .../q35-pcie.x86_64-latest.args | 2 +- .../q35-usb2-multi.x86_64-latest.args | 2 +- .../q35-usb2-reorder.x86_64-latest.args | 2 +- .../q35-usb2.x86_64-latest.args | 2 +- .../q35-virt-manager-basic.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/q35.x86_64-latest.args | 2 +- .../qemu-ns-alt.x86_64-latest.args | 2 +- ...qemu-ns-commandline-ns0.x86_64-latest.args | 2 +- ...qemu-ns-commandline-ns1.x86_64-latest.args | 2 +- .../qemu-ns-commandline.x86_64-latest.args | 2 +- ...-domain-commandline-ns0.x86_64-latest.args | 2 +- ...u-ns-domain-commandline.x86_64-latest.args | 2 +- .../qemu-ns-domain-ns0.x86_64-latest.args | 2 +- .../qemu-ns-no-env.x86_64-latest.args | 2 +- .../qemu-ns.x86_64-latest.args | 2 +- ...reboot-timeout-disabled.x86_64-latest.args | 2 +- .../reboot-timeout-enabled.x86_64-latest.args | 2 +- .../restore-v2-fd.x86_64-latest.args | 2 +- .../restore-v2.x86_64-latest.args | 2 +- ...rder-domain-subelements.x86_64-latest.args | 2 +- .../seclabel-dac-none.x86_64-latest.args | 2 +- ...eclabel-device-multiple.x86_64-latest.args | 2 +- ...label-dynamic-baselabel.x86_64-latest.args | 2 +- ...label-dynamic-labelskip.x86_64-latest.args | 2 +- ...el-dynamic-none-relabel.x86_64-latest.args | 2 +- .../seclabel-dynamic-none.x86_64-latest.args | 2 +- ...clabel-dynamic-override.x86_64-latest.args | 2 +- ...eclabel-dynamic-relabel.x86_64-latest.args | 2 +- .../seclabel-dynamic.x86_64-latest.args | 2 +- .../seclabel-none.x86_64-latest.args | 2 +- ...l-selinux-none-override.x86_64-latest.args | 2 +- ...clabel-static-labelskip.x86_64-latest.args | 2 +- ...seclabel-static-relabel.x86_64-latest.args | 2 +- .../seclabel-static.x86_64-latest.args | 2 +- .../serial-debugcon.x86_64-latest.args | 2 +- ...rial-dev-chardev-iobase.x86_64-latest.args | 2 +- .../serial-dev-chardev.x86_64-latest.args | 2 +- .../serial-file-chardev.x86_64-latest.args | 2 +- .../serial-file-log.x86_64-latest.args | 2 +- .../serial-many-chardev.x86_64-latest.args | 2 +- .../serial-pty-chardev.x86_64-latest.args | 2 +- .../serial-spiceport.x86_64-latest.args | 2 +- ...serial-target-port-auto.x86_64-latest.args | 2 +- .../serial-tcp-chardev.x86_64-latest.args | 2 +- ...rial-tcp-telnet-chardev.x86_64-latest.args | 2 +- ...p-tlsx509-chardev-notls.x86_64-latest.args | 2 +- ...-tlsx509-chardev-verify.x86_64-latest.args | 2 +- ...ial-tcp-tlsx509-chardev.x86_64-latest.args | 2 +- ...-tlsx509-secret-chardev.x86_64-latest.args | 2 +- .../serial-udp-chardev.x86_64-latest.args | 2 +- .../serial-unix-chardev.x86_64-latest.args | 2 +- .../serial-vc-chardev.x86_64-latest.args | 2 +- .../shmem-plain-doorbell.x86_64-latest.args | 2 +- .../smartcard-controller.x86_64-latest.args | 2 +- ...t-certificates-database.x86_64-latest.args | 2 +- ...tcard-host-certificates.x86_64-latest.args | 2 +- .../smartcard-host.x86_64-latest.args | 2 +- ...rd-passthrough-spicevmc.x86_64-latest.args | 2 +- ...artcard-passthrough-tcp.x86_64-latest.args | 2 +- ...rtcard-passthrough-unix.x86_64-latest.args | 2 +- .../smbios-type-fwcfg.x86_64-latest.args | 2 +- .../qemuxmlconfdata/smbios.x86_64-latest.args | 2 +- .../sound-device-virtio.x86_64-latest.args | 2 +- .../sound-device.x86_64-latest.args | 2 +- .../tap-vhost-incorrect.x86_64-latest.args | 2 +- .../tap-vhost.x86_64-latest.args | 2 +- .../throttlefilter.x86_64-latest.args | 2 +- ...pm-emulator-crb-profile.x86_64-latest.args | 2 +- .../tpm-emulator-tpm2-enc.x86_64-latest.args | 2 +- ...pm-emulator-tpm2-pstate.x86_64-latest.args | 2 +- .../tpm-emulator-tpm2.x86_64-latest.args | 2 +- .../tpm-emulator.x86_64-latest.args | 2 +- .../tpm-external.x86_64-latest.args | 2 +- .../tpm-passthrough-crb.x86_64-latest.args | 2 +- .../tpm-passthrough.x86_64-latest.args | 2 +- .../tseg-explicit-size.x86_64-latest.args | 2 +- ...roller-automatic-i440fx.x86_64-latest.args | 2 +- ...troller-automatic-isapc.x86_64-latest.args | 2 +- ...oller-automatic-microvm.x86_64-latest.args | 2 +- ...ontroller-automatic-q35.x86_64-latest.args | 2 +- ...ler-automatic-realview.aarch64-latest.args | 2 +- ...tomatic-unavailable-q35.x86_64-latest.args | 2 +- ...automatic-virt-aarch64.aarch64-latest.args | 2 +- ...ault-fallback-realview.aarch64-latest.args | 2 +- ...-fallback-virt-aarch64.aarch64-latest.args | 2 +- ...ntroller-default-i440fx.x86_64-latest.args | 2 +- ...-controller-default-q35.x86_64-latest.args | 2 +- ...oller-default-realview.aarch64-latest.args | 2 +- ...r-default-virt-aarch64.aarch64-latest.args | 2 +- ...troller-ich9-autoassign.x86_64-latest.args | 2 +- ...ntroller-ich9-companion.x86_64-latest.args | 2 +- ...ntroller-ich9-ehci-addr.x86_64-latest.args | 2 +- ...ler-nec-xhci-autoassign.x86_64-latest.args | 2 +- ...usb-controller-nec-xhci.x86_64-latest.args | 2 +- .../usb-controller-piix3.x86_64-latest.args | 2 +- ...sb-controller-qemu-xhci.x86_64-latest.args | 2 +- .../usb-hub-autoadd-deluxe.x86_64-latest.args | 2 +- .../usb-hub-autoadd.x86_64-latest.args | 2 +- .../usb-hub.x86_64-latest.args | 2 +- .../usb-long-port-path.x86_64-latest.args | 2 +- .../usb-none.x86_64-latest.args | 2 +- .../usb-port-autoassign.x86_64-latest.args | 2 +- .../usb-port-missing.x86_64-latest.args | 2 +- .../usb-ports.x86_64-latest.args | 2 +- .../usb-redir-boot.x86_64-latest.args | 2 +- ...sb-redir-filter-version.x86_64-latest.args | 2 +- .../usb-redir-filter.x86_64-latest.args | 2 +- .../usb-redir-unix.x86_64-latest.args | 2 +- .../usb-redir.x86_64-latest.args | 2 +- .../usb1-usb2.x86_64-latest.args | 2 +- .../user-aliases-usb.x86_64-latest.args | 2 +- .../user-aliases.x86_64-latest.args | 2 +- .../user-aliases2.x86_64-latest.args | 2 +- .../vcpu-placement-static.x86_64-latest.args | 2 +- ...vhost-user-fs-fd-memory.x86_64-latest.args | 2 +- ...st-user-fs-fd-openfiles.x86_64-latest.args | 2 +- ...vhost-user-fs-hugepages.x86_64-latest.args | 2 +- .../vhost-user-fs-readonly.x86_64-latest.args | 2 +- .../vhost-user-fs-sock.x86_64-latest.args | 2 +- ...host-user-gpu-secondary.x86_64-latest.args | 2 +- .../vhost-user-vga.x86_64-latest.args | 2 +- .../vhost-vsock-auto.x86_64-latest.args | 2 +- .../vhost-vsock.x86_64-latest.args | 2 +- ...eo-bochs-display-device.x86_64-latest.args | 2 +- .../video-bochs-edid-none.x86_64-latest.args | 2 +- .../video-bochs-edid-off.x86_64-latest.args | 2 +- .../video-bochs-edid-on.x86_64-latest.args | 2 +- ...-device-pciaddr-default.x86_64-latest.args | 2 +- .../video-none-device.x86_64-latest.args | 2 +- ...video-qxl-device-vgamem.x86_64-latest.args | 2 +- ...video-qxl-device-vram64.x86_64-latest.args | 2 +- .../video-qxl-device.x86_64-latest.args | 2 +- .../video-qxl-heads.x86_64-latest.args | 2 +- .../video-qxl-noheads.x86_64-latest.args | 2 +- .../video-qxl-resolution.x86_64-latest.args | 2 +- ...o-qxl-sec-device-vgamem.x86_64-latest.args | 2 +- ...o-qxl-sec-device-vram64.x86_64-latest.args | 2 +- .../video-qxl-sec-device.x86_64-latest.args | 2 +- ...eo-ramfb-display-device.x86_64-latest.args | 2 +- ...video-vga-device-vgamem.x86_64-latest.args | 2 +- .../video-vga-device.x86_64-latest.args | 2 +- .../video-vga-edid-none.x86_64-latest.args | 2 +- .../video-vga-edid-off.x86_64-latest.args | 2 +- .../video-vga-edid-on.x86_64-latest.args | 2 +- .../video-vga-qxl-heads.x86_64-latest.args | 2 +- .../video-virtio-blob-off.x86_64-latest.args | 2 +- .../video-virtio-blob-on.x86_64-latest.args | 2 +- .../video-virtio-edid-none.x86_64-latest.args | 2 +- .../video-virtio-edid-off.x86_64-latest.args | 2 +- .../video-virtio-edid-on.x86_64-latest.args | 2 +- ...video-virtio-gpu-device.x86_64-latest.args | 2 +- ...video-virtio-gpu-sdl-gl.x86_64-latest.args | 2 +- ...eo-virtio-gpu-secondary.x86_64-latest.args | 2 +- ...deo-virtio-gpu-spice-gl.x86_64-latest.args | 2 +- .../video-virtio-gpu-virgl.x86_64-latest.args | 2 +- ...io-vga-device-downgrade.x86_64-latest.args | 2 +- ....QEMU_CAPS_VIRTIO_GPU_GL_PCI-disabled.args | 2 +- ...APS_VIRTIO_VGA_GL-disabled-ABI_UPDATE.args | 2 +- ...test.QEMU_CAPS_VIRTIO_VGA_GL-disabled.args | 2 +- ...video-virtio-vga-gpu-gl.x86_64-latest.args | 2 +- ....QEMU_CAPS_DEVICE_VIRTIO_VGA-disabled.args | 2 +- .../video-virtio-vga.x86_64-latest.args | 2 +- .../virtio-9p-createmode.x86_64-latest.args | 2 +- .../virtio-9p-multidevs.x86_64-latest.args | 2 +- ...irtio-input-passthrough.x86_64-latest.args | 2 +- .../virtio-input.x86_64-latest.args | 2 +- .../virtio-iommu-aarch64.aarch64-latest.args | 2 +- .../virtio-iommu-x86_64.x86_64-latest.args | 2 +- ...virtio-non-transitional.x86_64-latest.args | 2 +- ...-options-controller-ats.x86_64-latest.args | 2 +- ...ptions-controller-iommu.x86_64-latest.args | 2 +- ...tions-controller-packed.x86_64-latest.args | 2 +- ...virtio-options-disk-ats.x86_64-latest.args | 2 +- ...rtio-options-disk-iommu.x86_64-latest.args | 2 +- ...tio-options-disk-packed.x86_64-latest.args | 2 +- .../virtio-options-fs-ats.x86_64-latest.args | 2 +- ...virtio-options-fs-iommu.x86_64-latest.args | 2 +- ...irtio-options-fs-packed.x86_64-latest.args | 2 +- ...irtio-options-input-ats.x86_64-latest.args | 2 +- ...tio-options-input-iommu.x86_64-latest.args | 2 +- ...io-options-input-packed.x86_64-latest.args | 2 +- ...-options-memballoon-ats.x86_64-latest.args | 2 +- ...loon-freepage-reporting.x86_64-latest.args | 2 +- ...ptions-memballoon-iommu.x86_64-latest.args | 2 +- ...tions-memballoon-packed.x86_64-latest.args | 2 +- .../virtio-options-net-ats.x86_64-latest.args | 2 +- ...irtio-options-net-iommu.x86_64-latest.args | 2 +- ...rtio-options-net-packed.x86_64-latest.args | 2 +- .../virtio-options-rng-ats.x86_64-latest.args | 2 +- ...irtio-options-rng-iommu.x86_64-latest.args | 2 +- ...rtio-options-rng-packed.x86_64-latest.args | 2 +- ...irtio-options-video-ats.x86_64-latest.args | 2 +- ...tio-options-video-iommu.x86_64-latest.args | 2 +- ...io-options-video-packed.x86_64-latest.args | 2 +- .../virtio-options.x86_64-latest.args | 2 +- .../virtio-rng-builtin.x86_64-latest.args | 2 +- .../virtio-rng-default.x86_64-latest.args | 2 +- .../virtio-rng-egd-unix.x86_64-latest.args | 2 +- .../virtio-rng-egd.x86_64-latest.args | 2 +- .../virtio-rng-multiple.x86_64-latest.args | 2 +- .../virtio-rng-random.x86_64-latest.args | 2 +- .../virtio-transitional.x86_64-latest.args | 2 +- .../vmcoreinfo.x86_64-latest.args | 2 +- .../watchdog-device.x86_64-latest.args | 2 +- .../watchdog-dump.x86_64-latest.args | 2 +- .../watchdog-injectnmi.x86_64-latest.args | 2 +- .../watchdog-q35-multiple.x86_64-latest.args | 2 +- .../watchdog.x86_64-latest.args | 2 +- .../x86-kvm-32-on-64.x86_64-latest.args | 2 +- ...6_64-default-cpu-kvm-pc.x86_64-latest.args | 2 +- ..._64-default-cpu-kvm-q35.x86_64-latest.args | 2 +- ...efault-cpu-tcg-features.x86_64-latest.args | 2 +- ...6_64-default-cpu-tcg-pc.x86_64-latest.args | 2 +- ..._64-default-cpu-tcg-q35.x86_64-latest.args | 2 +- ...fault-models.x86_64-latest.abi-update.args | 2 +- ...86_64-pc-default-models.x86_64-latest.args | 2 +- .../x86_64-pc-graphics.x86_64-latest.args | 2 +- .../x86_64-pc-headless.x86_64-latest.args | 2 +- ...4-pc-minimal.x86_64-latest.abi-update.args | 2 +- .../x86_64-pc-minimal.x86_64-latest.args | 2 +- ...fault-models.x86_64-latest.abi-update.args | 2 +- ...6_64-q35-default-models.x86_64-latest.args | 2 +- .../x86_64-q35-graphics.x86_64-latest.args | 2 +- .../x86_64-q35-headless.x86_64-latest.args | 2 +- ...-q35-minimal.x86_64-latest.abi-update.args | 2 +- .../x86_64-q35-minimal.x86_64-latest.args | 2 +- tests/qemuxmlconftest.c | 4 + 919 files changed, 3101 insertions(+), 2783 deletions(-) -- 2.55.0

2 8

[PATCH] docs: Fix example syntax error and update testing.rst
by rsmigiel＠redhat.com 16 Jul '26

16 Jul '26

From: Radoslaw Smigielski <rsmigiel(a)redhat.com> From: Radoslaw Smigielski <rsmigiel(a)redhat.com> Fix syntax error in one of the testing examples on alpine-edge image with prefix. Update CI helper examples to use more recent OS versions: - Fedora 38 -> Fedora 44 - Debian 11 -> Debian 13 - Debian 10 -> Debian 13 Signed-off-by: Radoslaw Smigielski <rsmigiel(a)redhat.com> --- docs/testing.rst | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/testing.rst b/docs/testing.rst index 84111ffd4c9e..436e8e8c3910 100644 --- a/docs/testing.rst +++ b/docs/testing.rst @@ -137,18 +137,18 @@ the default libvirt registry: ... Now, let's say one would want to run the ``website`` job from GitLab on Debian -11. This is how a GitLab job specification can be referenced on ``ci/helper``'s +13. This is how a GitLab job specification can be referenced on ``ci/helper``'s command line: :: - $ ci/helper run --job website debian-10 + $ ci/helper run --job website debian-13 What if you want to run an rpmbuild of libvirt on an RPM distro? :: - $ ci/helper run --job rpmbuild fedora-38 + $ ci/helper run --job rpmbuild fedora-44 Want to use your own, say alpine-edge, container image from your GitLab container registry? @@ -156,7 +156,7 @@ Proceed with the following: :: - $ ci/helper run --job build --image-prefix registry.gitlab.com/<user>/libvirt/ci- alpine-edge + $ ci/helper run --job build --image-prefix registry.gitlab.com/<user>/libvirt/ci-alpine-edge Finally, it would be nice if one could get an interactive shell inside the test environment to debug potential build issues. This can be achieved with the -- 2.54.0

2 1

[PATCH] remote: block use of URI transport in scheme & query parameters
by Daniel P. Berrangé 16 Jul '26

16 Jul '26

From: Daniel P. Berrangé <berrange(a)redhat.com> The remote driver client supports specifying a transport in the URI scheme component such as +ext, +unix, +tls, etc. This determines how it should connect to the daemons. It strips this transport from the scheme to create a plain driver name that it forwards on to the remote server. It also, however, supports a "name" URI parameter which can be used to override the stripped URI that gets sent to the remote server. Unfortunately there is no validation of the URI by the remote server, so the URI override could include the transport in the scheme component. When the remote server sees a transport in the URI scheme, the connection gets diverted into the remote driver which then opens another client connection. When the "ext" transport is combined with the "command" URI parameter, this allows the client to trick the server into running an arbitrary command with the same privileges as the server. This can be abused with a read-only connection to a privileged server in order to elevate local privileges. There is no a valid reason to accept a transport component in the URI scheme received by the server, so validate this condition and reject any connection that violates it. This patch is derived from a proposal made by the reporter along with their disclosure, but generalized to block all schemes, not merely +ext and apply unconditionally to all connections not merely read-only ones. Reported-by: Deutsche Telekom Red Team <redteam(a)telekom.de> Fixes: CVE-2026-15268 Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/remote/remote_daemon_dispatch.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c index 329853b6da..95ab173b7c 100644 --- a/src/remote/remote_daemon_dispatch.c +++ b/src/remote/remote_daemon_dispatch.c @@ -2135,6 +2135,31 @@ remoteDispatchProbeURI(bool readonly, } #endif /* VIRTPROXYD */ +static int +remoteCheckPermittedConnURI(const char *uristr) +{ + g_autoptr(virURI) uri = NULL; + + if (!(uri = virURIParse(uristr))) + return -1; + + /* + * Use of a transport (eg "+ext") in the scheme can be used to + * trick the daemon into using the remote driver to connect to + * an arbitrary socket under the caller's control. The valid + * URIs from the remote driver client will never include a + * transport component, so always reject that attempt. + */ + if (uri->scheme && + strchr(uri->scheme, '+')) { + virReportError(VIR_ERR_OPERATION_DENIED, + _("Remote URI '%1$s' is not permitted to include a transport"), + uristr); + return -1; + } + + return 0; +} static int remoteDispatchConnectOpen(virNetServer *server G_GNUC_UNUSED, @@ -2164,6 +2189,10 @@ remoteDispatchConnectOpen(virNetServer *server G_GNUC_UNUSED, name = args->name ? *args->name : NULL; + if (name && STRNEQ(name, "") && + remoteCheckPermittedConnURI(name) < 0) + goto cleanup; + /* If this connection arrived on a readonly socket, force * the connection to be readonly. */ -- 2.55.0

2 1

[libvirt PATCH 0/4] network: reject line breaks in DNS records emitted to dnsmasq
by Michael Bommarito 16 Jul '26

16 Jul '26

The network XML schema supports typed DNS records using <dns><txt> and <dns><srv> tags, and the TXT and SRV domain/target values do not strip XML numeric char refs like 
 (LF). As a result, these XML values can be used to insert additional configuration or commands into the dnsmasq config created by the network driver, e.g., a malicious dhcp-script=... line. libvirt socket access is already documented as root-equivalent, and raw <dnsmasq:options> namespace already exists, so this fix should be treated as hardening-only for default deployments that do not provide unpriv users with access to configure/extend these values. The series validates on both the parser and the emitter side: 1-2. reject LF/CR in the TXT value and SRV domain/target at XML parse time; 3. add a defensive check in the dnsmasq config emitter so a future parser gap cannot reintroduce directive injection; the raw <dnsmasq:options> namespace is intentionally left untouched; 4. add parse-path and update-API negative tests using 
/. Coordinated and assigned CVE-2026-61477 by RH team. Testing: built against current master with the network driver and tests enabled. The new negative tests fail on unpatched master (the expected parse error does not occur) and pass with the series applied, across both the network XML parse path and the update API. Michael Bommarito (4): conf: reject line breaks in DNS TXT record values conf: reject line breaks in DNS SRV domain and target network: reject line breaks before writing dnsmasq DNS config tests: cover line-break rejection in DNS TXT and SRV records src/conf/network_conf.c | 24 ++++++++++++++++ src/network/bridge_driver.c | 28 +++++++++++++++++++ .../dns-txt-record-newline.xml | 1 + .../srv-record-target-newline.xml | 1 + tests/networkxml2xmlupdatetest.c | 12 ++++++++ ...-network-dns-srv-record-domain-newline.xml | 14 ++++++++++ ...-network-dns-srv-record-target-newline.xml | 14 ++++++++++ .../nat-network-dns-txt-record-newline.xml | 14 ++++++++++ tests/networkxmlconftest.c | 3 ++ 9 files changed, 111 insertions(+) create mode 100644 tests/networkxml2xmlupdatein/dns-txt-record-newline.xml create mode 100644 tests/networkxml2xmlupdatein/srv-record-target-newline.xml create mode 100644 tests/networkxmlconfdata/nat-network-dns-srv-record-domain-newline.xml create mode 100644 tests/networkxmlconfdata/nat-network-dns-srv-record-target-newline.xml create mode 100644 tests/networkxmlconfdata/nat-network-dns-txt-record-newline.xml -- 2.53.0

2 7