docs: Clarify what source and name attributes of TPM profile describe

Clarify what source and name attributes of TPM profile describe and
update the version placeholder to the libvirt version when profiles
were first supported, v10.10. Also mention that profiles with prefix
'custom:' in their name can be modified.

Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>

.mailmap

@@ -48,6 +48,7 @@
 <shi_lei@massclouds.com> <shilei.massclouds@gmx.com>
 <adrian.brzezinski@eo.pl> <redhat@adrb.pl>
 <matt@datto.com> <mcoleman@datto.com>
+<dbarboza@ventanamicro.com> <danielhb413@gmail.com>
 
 # Name consolidation:
 # Preferred author spelling <preferred email>
@@ -70,6 +71,7 @@ Wang Yufei (James) <james.wangyufei@huawei.com>
 Deepak C Shetty <dpkshetty@gmail.com>
 Dave Allan <dallan@redhat.com>
 Richard W.M. Jones <rjones@redhat.com>
+Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 
 # Non-trivial consolidation:
 # see git documentation for information about the format

NEWS.rst

@@ -8,6 +8,260 @@ the changes introduced by each of them.
 For a more fine-grained view, use the `git log`_.
 
 
+v11.2.0 (unreleased)
+====================
+
+* **Security**
+
+* **Removed features**
+
+* **New features**
+
+* **Improvements**
+
+* **Bug fixes**
+
+
+v11.1.0 (2025-03-03)
+====================
+
+* **Packaging changes**
+
+  * De-modularize the 'fs' storage file backend
+
+    The storage file backend for local files uses only code which we compile
+    into the internal libraries anyways so there's no point in having it
+    as a loadable module. The ``storage-file/libvirt_storage_file_fs.so`` module
+    no longer exists and its functionality is embedded directly.
+
+* **Removed features**
+
+  * vbox: removed support for version 6.1 APIs
+
+    Libvirt no longer supports use of VirtualBox 6.1 since this version reached
+    its end of life on 2024/01.
+
+* **New features**
+
+  * nodedev: Support ccwgroup based qeth devices
+
+    CCW group devices are devices that use multiple subchannels on the
+    mainframe's channel subsystem. A qeth group device maps to subchannels and
+    their corresponding device numbers and device bus-IDs. The ``ccwgroup``
+    device nodes are placed besides the subchannel nodes under computer and list
+    the group members within a new ``ccwgroup`` capability. A new capability
+    ``ccwgroup_member`` is added into capability ``ccw`` to represent a device
+    membership to a ccwgroup. Filters are added to find ccwgroups as well as
+    ccwgroup members.
+
+  * ch: Support handling events from cloud-hypervisor
+
+    The ch driver now supports handling events from the cloud-hypervisor.
+    Events include VM lifecyle operations such as  shutdown, pause, resume,
+    etc. Libvirt will now read these events and take actions such as
+    updating domain state, etc.
+
+  * Introduce virtio-mem ``<memory/>`` model for s390 guests
+
+    The virtio-mem model of ``<memory/>`` device can now be used with s390
+    guests.
+
+  * Support using passt as the backend for interface type='vhostuser'
+
+    The combination of vhostuser transport with passt as the backend
+    provides high performance, fully featured networking without the
+    need for libvirt or QEMU to have any elevated privileges or
+    capabilities. Configuration and features are identical to the
+    configuration for type='user' with the passt backend.
+
+* **Improvements**
+
+  * qemu: I/O error messages can be queried via ``virDomainGetMessages()``
+
+    The qemu hypervisor driver now preserves the last I/O error message along
+    with the timestamp when it was recorded and preserves it to be queried via
+    ``virDomainGetMessages()``.
+
+* **Bug fixes**
+
+  * tools: ssh-proxy: Check if domain is running before connecting to it
+
+    If domain is not running but has a static CID configured for its VSOCK then
+    the ssh-proxy parsed it anyways. This may have resulted in mistakenly
+    connecting to a different domain. Domain status is checked before parsing
+    its CID.
+
+  * apparmor: Allow SGX if configured
+
+    If domain has ``<memory model='sgx-epc'\>`` configured then libvirt now
+    adds corresponding devices into a per-domain profile so that AppArmor does
+    not deny QEMU access to them.
+
+  * qemu: Fix crash when starting a domain on a host with unknown host CPU
+
+    On hosts where we cannot detect a host CPU model (mostly aarch64 hosts)
+    starting a domain with a custom CPU model caused a crash of virtqemud.
+
+    The bug was introduced in libvirt-10.9.0
+
+
+v11.0.0 (2025-01-15)
+====================
+
+* **New features**
+
+  * network/qemu/lxc: support vlans on standard Linux host bridges
+
+    The network, qemu, and lxc drivers now support (using the
+    ``<vlan>`` subelement) vlan tagging and trunking on network
+    interfaces connected to a standard Linux host bridge.
+
+  * qemu: Add support for direct and extended tlbflush features
+
+    Domains can now utilise more tlbflush hyperv features.
+
+* **Improvements**
+
+  * ch: Enable user aliases
+
+    User can now specify custom aliases for devices in domain XML
+
+  * qemu: Grab a QUERY job when formatting domain XML
+
+    Under some specific conditions it might have happened that domain XML did
+    not contain runtime information or returned an XML that's in process of
+    changing (e.g. by a thread that's hotplugging a device). Formatting domain
+    XML now serializes properly with other threads.
+
+  * virtiofs: Allow read only mode
+
+    The ``<filesystem/>`` with `virtiofsd` backend can now use ``<readonly/>``
+    tag to export underlying filesystem in read only mode.
+
+  * qemu: allow migration of vGPU from mdev device <-> SRIOV VF device
+
+    Some GPU vendors are switching from using vGPUs creating using
+    mdev and identified with a uuid, to vGPUs created as SRIOV VFs and
+    identified by their PCI address, and want to support live
+    migration from a host using one type of vGPU to the other
+    type. This is now possible.
+
+* **Bug fixes**
+
+  * qemu: tpm: do not update profile name for transient domains
+
+    Fix a possible crash when starting a transient domain which was
+    introduced in the previous release.
+
+  * qemu: Fix snapshot to not delete disk image with internal snapshot
+
+    When a VM has internal snapshot that is parent to external snapshot and user
+    reverts to the internal snapshot and deletes the external snapshot libvirt
+    would delete the disk image containing the internal snapshot. This would
+    result in data loss.
+
+  * qemu: Do not format invalid XML with hyperv features in passthrough mode
+
+    When hyperv features were specified together with ``mode="passthrough"``
+    libvirt parsed and formatted such features in the domain XML even though
+    they were not used at all, resulting in XML that is not valid based on our
+    schema.  This is now fixed by not parsing any specified features when the
+    passthrough mode is used.
+
+  * qemu: Fix a crash when starting a domain with ovs bridge and QOS
+
+  * cpu: Add missing -v1 variants for CPU models
+
+    Some CPU models (mostly old ones) were missed when versioned CPU model
+    names were introduced in the previous release.
+
+  * qemu: Fix false error when recovering failed post-copy migration
+
+    In some cases libvirt would report a failure to recover post-copy migration
+    even though the recovery started just fine and migration would eventually
+    successfully finish.
+
+
+v10.10.0 (2024-12-02)
+=====================
+
+* **New features**
+
+  * qemu: add multi boot device support on s390x
+
+    For classical mainframe guests (i.e. LPAR or z/VM installations), you
+    always have to explicitly specify the disk where you want to boot from (or
+    "IPL" from, in s390x-speak -- IPL means "Initial Program Load").
+
+    In the past QEMU only used the first device in the boot order to IPL from.
+    With the new multi boot device support on s390x that is available with QEMU
+    version 9.2 and newer, this limitation is lifted. If the IPL fails for the
+    first device with the lowest boot index, the device with the second lowest
+    boot index will be tried and so on until IPL is successful or there are no
+    remaining boot devices to try.
+
+    Limitation: The s390x BIOS will try to IPL up to 8 total devices, any
+    number of which may be disks or network devices.
+
+  * qemu: Add support for versioned CPU models
+
+    Updates to QEMU CPU models with -vN suffix can now be used in libvirt just
+    like any other CPU model.
+
+  * qemu: Support for the 'data-file' QCOW2 image feature
+
+    The QEMU hypervisor driver now supports QCOW2 images with 'data-file'
+    feature present (both when probing form the image itself and when specified
+    explicitly via ``<dataStore>`` element). This can be useful when it's
+    required to keep data "raw" on disk, but the use case requires features
+    of the QCOW2 format such as incremental backups.
+
+  * swtpm: Add support for profiles
+
+    Upcoming swtpm release will have TPM profile support that allows to
+    restrict a TPM's provided set of crypto algorithms and commands. Users can
+    now select profile by using ``<profile/>`` in their TPM XML definition.
+
+* **Improvements**
+
+  * qemu: Support UEFI NVRAM images on block storage
+
+    Libvirt now allows users to use block storage as backend for UEFI NVRAM
+    images and allows them to be in format different than the template. When
+    qcow2 is used as the format, the images are now also auto-populated from the
+    template.
+
+  * qemu: Automatically add IOMMU when needed
+
+    When domain of 'qemu' or 'kvm' type has more than 255 vCPUs IOMMU with EIM
+    mode is required. Starting with this release libvirt automatically adds one
+    (or turns on the EIM mode if there's IOMMU without it).
+
+  * ch: allow hostdevs in domain definition
+
+    The Cloud Hypervisor driver (ch) now supports ``<hostdev/>``-s.
+
+  * ch: Enable callbacks for ch domain events
+
+    The Cloud Hypervisor driver (ch) now supports emitting events on domain
+    define, undefine, start, boot, stop and destroy.
+
+* **Bug fixes**
+
+  * qemu: Fix reversion and inactive deletion of internal snapshots with UEFI NVRAM
+
+    In `v10.9.0 (2024-11-01)`_ creation of internal snapshots of VMs with UEFI
+    firmware was allowed, but certain operations such as reversion or inactive
+    deletion didn't work properly as they didn't consider the NVRAM qcow2 file.
+
+  * virnetdevopenvswitch: Warn on unsupported QoS settings
+
+    For OpenVSwitch vNICs libivrt does not set QoS directly using 'tc' but
+    offloads setting to OVS. But OVS is not as feature full as libvirt in this
+    regard and setting different 'peak' than 'average' results in vNIC always
+    sticking with 'peak'. Produce a warning if that's the case.
+
+
 v10.9.0 (2024-11-01)
 ====================
 
@@ -168,6 +422,17 @@ v10.7.0 (2024-09-02)
     domain XML for descendants of the generic PC machine type (``i440fx``,
     ``q35``, ``xenfv`` and ``isapc``).
 
+  * qemu: Add support for hyperv enlightenment feature ``hv-emsr-bitmap``
+
+    It is introduced since ``QEMU 7.10``, allowing L0 (KVM) and L1 (Hyper-V)
+    hypervisors to collaborate to avoid unnecessary updates to L2 MSR-Bitmap
+    upon vmexits.
+
+  * qemu: Add support for hyperv enlightenment feature ``hv-xmm-input``
+
+    It is introduced since ``QEMU 7.10``, allowing to pass parameters for
+    certain hypercalls using XMM registers (“XMM Fast Hypercall Input”).
+
 * **Improvements**
 
   * ch: support restore with network devices
@@ -297,6 +562,18 @@ v10.5.0 (2024-07-01)
 v10.4.0 (2024-06-03)
 ====================
 
+* **Security**
+
+  * ``CVE-2024-4418``: Fix stack use-after-free in virNetClientIOEventLoop()
+
+    Fix race condition leading to a stack use-after-free bug was found in libvirt.
+    Due to a bad assumption in the virNetClientIOEventLoop() method, the data
+    pointer to a stack-allocated virNetClientIOEventData structure ended up being
+    used in the virNetClientIOEventFD callback while the data pointer's stack frame
+    was concurrently being "freed" when returning from virNetClientIOEventLoop().
+    This flaw allows a local, unprivileged user to access virtproxyd without
+    authenticating.
+
 * **New features**
 
   * qemu: Support for ras feature for virt machine type
@@ -450,6 +727,18 @@ v10.3.0 (2024-05-02)
 v10.2.0 (2024-04-02)
 ====================
 
+* **Security**
+
+  * ``CVE-2024-2494``: remote: check for negative array lengths before allocation
+
+   Fix the flaw of the RPC library APIs of libvirt. The RPC server
+   de-serialization code allocates memory for arrays before the non-negative
+   length check is performed by the C API entry points. Passing a negative length
+   to the g_new0 function results in a crash due to the negative length being
+   treated as a huge positive number. A local unprivileged user could use this
+   flaw to perform a denial of service attack by causing the libvirt daemon to
+   crash.
+
 * **New features**
 
   * ch: Basic save and restore support for ch driver
@@ -840,6 +1129,10 @@ v9.8.0 (2023-10-02)
         <source dev='/dev/vhost-vdpa-0'>
         ...
 
+  * cpu_map: Add the EPYC-Genoa cpu model
+
+    This model is introduced since ``QEMU 8.1``.
+
 * **Improvements**
 
   * qemu: add nbdkit backend for network disks

build-aux/syntax-check.mk

@@ -92,8 +92,8 @@ sc_prohibit_raw_virclassnew:
 
 # Avoid raw malloc and free, except in documentation comments.
 sc_prohibit_raw_allocation:
-	@prohibit='^.[^*].*\<((m|c|re)alloc|free) *\([^)]' \
-	halt='use VIR_ macros from viralloc.h instead of malloc/free' \
+	@prohibit='^.[^*].*\<((m|c|re)alloc|free|g_malloc) *\([^)]' \
+	halt='use g_new0/g_malloc0/g_free instead of malloc/free/g_malloc' \
 	  $(_sc_search_regexp)
 
 # Avoid functions that can lead to double-close bugs.
@@ -401,6 +401,8 @@ msg_gen_function += virReportError
 msg_gen_function += virReportErrorHelper
 msg_gen_function += virReportSystemError
 msg_gen_function += virLastErrorPrefixMessage
+msg_gen_function += vshError
+msg_gen_function += vshWarn
 
 # Uncomment the following and run "ninja test" to see diagnostics
 # that are not yet marked for translation, but that need to be rewritten
@@ -408,7 +410,6 @@ msg_gen_function += virLastErrorPrefixMessage
 # msg_gen_function += fprintf
 # msg_gen_function += testError
 # msg_gen_function += vshPrint
-# msg_gen_function += vshError
 
 space = $(null) $(null)
 func_re= ($(subst $(space),|,$(msg_gen_function)))
@@ -1135,7 +1136,7 @@ sc_prohibit_backup_files:
 sc_avoid_remote_reference_to_local_file:
 	@prohibit='<#' \
 	in_vc_files='\.rst$$' \
-	halt='use local reference within a file' \
+	halt='use `section`_ or `here <section_>`__ instead of `here <#section>`__' \
 	  $(_sc_search_regexp)
 
 # This Perl code is slightly obfuscated.  Not only is each "$" doubled
@@ -1273,9 +1274,10 @@ po_file ?= $(top_srcdir)/po/POTFILES
 # This is all generated files for RPC code.
 generated_files = \
   $(top_builddir)/src/*.[ch] \
-  $(top_builddir)/src/*/*.[ch]
+  $(top_builddir)/src/*/*.[ch] \
+  $(top_builddir)/src/*/*.policy.in
 
-_gl_translatable_string_re ?= \b(N?_|gettext *)\([^)"]*("|$$)
+_gl_translatable_string_re ?= (^<policyconfig>|\b(N?_|gettext *)\([^)"]*("|$$))
 
 # sc_po_check can fail if generated files are not built first
 sc_po_check:
@@ -1437,7 +1439,7 @@ exclude_file_name_regexp--sc_require_config_h_first = \
 	^(examples/|tools/virsh-edit\.c$$|tests/virmockstathelpers\.c$$|scripts/rpcgen/tests/test_demo\.c$$)
 
 exclude_file_name_regexp--sc_trailing_blank = \
-  /sysinfodata/.*\.data|/virhostcpudata/.*\.cpuinfo|tests/virshtestdata/.*$$
+  /sysinfodata/.*\.data|/virhostcpudata/.*\.cpuinfo|tests/virshtestdata/.*|docs/fonts|scripts/rpcgen/tests/.*\.bin|tests/viracpidata/.*|tests/virpcitestdata/*|tests/virstoragetestdata/images/.*\.qcow2$$
 
 exclude_file_name_regexp--sc_unmarked_diagnostics = \
   ^(scripts/apibuild.py|tests/virt-aa-helper-test|docs/js/.*\.js)$$

ci/buildenv/debian-11-cross-aarch64.sh

@@ -1,117 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool manifest ci/manifest.yml
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-function install_buildenv() {
-    export DEBIAN_FRONTEND=noninteractive
-    apt-get update
-    apt-get dist-upgrade -y
-    apt-get install --no-install-recommends -y \
-            augeas-lenses \
-            augeas-tools \
-            bash-completion \
-            black \
-            ca-certificates \
-            ccache \
-            codespell \
-            cpp \
-            diffutils \
-            dwarves \
-            ebtables \
-            flake8 \
-            gettext \
-            git \
-            grep \
-            iproute2 \
-            iptables \
-            kmod \
-            libclang-dev \
-            libxml2-utils \
-            locales \
-            lvm2 \
-            make \
-            meson \
-            nfs-common \
-            ninja-build \
-            numad \
-            open-iscsi \
-            perl-base \
-            pkgconf \
-            policykit-1 \
-            python3 \
-            python3-docutils \
-            python3-pytest \
-            qemu-utils \
-            sed \
-            xsltproc
-    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen
-    dpkg-reconfigure locales
-    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
-    export DEBIAN_FRONTEND=noninteractive
-    dpkg --add-architecture arm64
-    apt-get update
-    apt-get dist-upgrade -y
-    apt-get install --no-install-recommends -y dpkg-dev
-    apt-get install --no-install-recommends -y \
-            gcc-aarch64-linux-gnu \
-            libacl1-dev:arm64 \
-            libapparmor-dev:arm64 \
-            libattr1-dev:arm64 \
-            libaudit-dev:arm64 \
-            libblkid-dev:arm64 \
-            libc6-dev:arm64 \
-            libcap-ng-dev:arm64 \
-            libcurl4-gnutls-dev:arm64 \
-            libdevmapper-dev:arm64 \
-            libfuse-dev:arm64 \
-            libglib2.0-dev:arm64 \
-            libglusterfs-dev:arm64 \
-            libgnutls28-dev:arm64 \
-            libiscsi-dev:arm64 \
-            libjson-c-dev:arm64 \
-            libnl-3-dev:arm64 \
-            libnl-route-3-dev:arm64 \
-            libnuma-dev:arm64 \
-            libparted-dev:arm64 \
-            libpcap0.8-dev:arm64 \
-            libpciaccess-dev:arm64 \
-            librbd-dev:arm64 \
-            libreadline-dev:arm64 \
-            libsanlock-dev:arm64 \
-            libsasl2-dev:arm64 \
-            libselinux1-dev:arm64 \
-            libssh-gcrypt-dev:arm64 \
-            libssh2-1-dev:arm64 \
-            libtirpc-dev:arm64 \
-            libudev-dev:arm64 \
-            libxen-dev:arm64 \
-            libxml2-dev:arm64 \
-            systemtap-sdt-dev:arm64
-    mkdir -p /usr/local/share/meson/cross
-    printf "[binaries]\n\
-c = '/usr/bin/aarch64-linux-gnu-gcc'\n\
-ar = '/usr/bin/aarch64-linux-gnu-gcc-ar'\n\
-strip = '/usr/bin/aarch64-linux-gnu-strip'\n\
-pkgconfig = '/usr/bin/aarch64-linux-gnu-pkg-config'\n\
-\n\
-[host_machine]\n\
-system = 'linux'\n\
-cpu_family = 'aarch64'\n\
-cpu = 'aarch64'\n\
-endian = 'little'\n" > /usr/local/share/meson/cross/aarch64-linux-gnu
-    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
-    mkdir -p /usr/libexec/ccache-wrappers
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/aarch64-linux-gnu-cc
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/aarch64-linux-gnu-gcc
-}
-
-export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
-export LANG="en_US.UTF-8"
-export MAKE="/usr/bin/make"
-export NINJA="/usr/bin/ninja"
-export PYTHON="/usr/bin/python3"
-
-export ABI="aarch64-linux-gnu"
-export MESON_OPTS="--cross-file=aarch64-linux-gnu"

ci/buildenv/debian-11-cross-armv6l.sh

@@ -1,116 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool manifest ci/manifest.yml
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-function install_buildenv() {
-    export DEBIAN_FRONTEND=noninteractive
-    apt-get update
-    apt-get dist-upgrade -y
-    apt-get install --no-install-recommends -y \
-            augeas-lenses \
-            augeas-tools \
-            bash-completion \
-            black \
-            ca-certificates \
-            ccache \
-            codespell \
-            cpp \
-            diffutils \
-            dwarves \
-            ebtables \
-            flake8 \
-            gettext \
-            git \
-            grep \
-            iproute2 \
-            iptables \
-            kmod \
-            libclang-dev \
-            libxml2-utils \
-            locales \
-            lvm2 \
-            make \
-            meson \
-            nfs-common \
-            ninja-build \
-            numad \
-            open-iscsi \
-            perl-base \
-            pkgconf \
-            policykit-1 \
-            python3 \
-            python3-docutils \
-            python3-pytest \
-            qemu-utils \
-            sed \
-            xsltproc
-    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen
-    dpkg-reconfigure locales
-    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
-    export DEBIAN_FRONTEND=noninteractive
-    dpkg --add-architecture armel
-    apt-get update
-    apt-get dist-upgrade -y
-    apt-get install --no-install-recommends -y dpkg-dev
-    apt-get install --no-install-recommends -y \
-            gcc-arm-linux-gnueabi \
-            libacl1-dev:armel \
-            libapparmor-dev:armel \
-            libattr1-dev:armel \
-            libaudit-dev:armel \
-            libblkid-dev:armel \
-            libc6-dev:armel \
-            libcap-ng-dev:armel \
-            libcurl4-gnutls-dev:armel \
-            libdevmapper-dev:armel \
-            libfuse-dev:armel \
-            libglib2.0-dev:armel \
-            libglusterfs-dev:armel \
-            libgnutls28-dev:armel \
-            libiscsi-dev:armel \
-            libjson-c-dev:armel \
-            libnl-3-dev:armel \
-            libnl-route-3-dev:armel \
-            libnuma-dev:armel \
-            libparted-dev:armel \
-            libpcap0.8-dev:armel \
-            libpciaccess-dev:armel \
-            librbd-dev:armel \
-            libreadline-dev:armel \
-            libsanlock-dev:armel \
-            libsasl2-dev:armel \
-            libselinux1-dev:armel \
-            libssh-gcrypt-dev:armel \
-            libssh2-1-dev:armel \
-            libtirpc-dev:armel \
-            libudev-dev:armel \
-            libxml2-dev:armel \
-            systemtap-sdt-dev:armel
-    mkdir -p /usr/local/share/meson/cross
-    printf "[binaries]\n\
-c = '/usr/bin/arm-linux-gnueabi-gcc'\n\
-ar = '/usr/bin/arm-linux-gnueabi-gcc-ar'\n\
-strip = '/usr/bin/arm-linux-gnueabi-strip'\n\
-pkgconfig = '/usr/bin/arm-linux-gnueabi-pkg-config'\n\
-\n\
-[host_machine]\n\
-system = 'linux'\n\
-cpu_family = 'arm'\n\
-cpu = 'arm'\n\
-endian = 'little'\n" > /usr/local/share/meson/cross/arm-linux-gnueabi
-    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
-    mkdir -p /usr/libexec/ccache-wrappers
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/arm-linux-gnueabi-cc
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/arm-linux-gnueabi-gcc
-}
-
-export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
-export LANG="en_US.UTF-8"
-export MAKE="/usr/bin/make"
-export NINJA="/usr/bin/ninja"
-export PYTHON="/usr/bin/python3"
-
-export ABI="arm-linux-gnueabi"
-export MESON_OPTS="--cross-file=arm-linux-gnueabi"

ci/buildenv/debian-11-cross-armv7l.sh

@@ -1,117 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool manifest ci/manifest.yml
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-function install_buildenv() {
-    export DEBIAN_FRONTEND=noninteractive
-    apt-get update
-    apt-get dist-upgrade -y
-    apt-get install --no-install-recommends -y \
-            augeas-lenses \
-            augeas-tools \
-            bash-completion \
-            black \
-            ca-certificates \
-            ccache \
-            codespell \
-            cpp \
-            diffutils \
-            dwarves \
-            ebtables \
-            flake8 \
-            gettext \
-            git \
-            grep \
-            iproute2 \
-            iptables \
-            kmod \
-            libclang-dev \
-            libxml2-utils \
-            locales \
-            lvm2 \
-            make \
-            meson \
-            nfs-common \
-            ninja-build \
-            numad \
-            open-iscsi \
-            perl-base \
-            pkgconf \
-            policykit-1 \
-            python3 \
-            python3-docutils \
-            python3-pytest \
-            qemu-utils \
-            sed \
-            xsltproc
-    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen
-    dpkg-reconfigure locales
-    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
-    export DEBIAN_FRONTEND=noninteractive
-    dpkg --add-architecture armhf
-    apt-get update
-    apt-get dist-upgrade -y
-    apt-get install --no-install-recommends -y dpkg-dev
-    apt-get install --no-install-recommends -y \
-            gcc-arm-linux-gnueabihf \
-            libacl1-dev:armhf \
-            libapparmor-dev:armhf \
-            libattr1-dev:armhf \
-            libaudit-dev:armhf \
-            libblkid-dev:armhf \
-            libc6-dev:armhf \
-            libcap-ng-dev:armhf \
-            libcurl4-gnutls-dev:armhf \
-            libdevmapper-dev:armhf \
-            libfuse-dev:armhf \
-            libglib2.0-dev:armhf \
-            libglusterfs-dev:armhf \
-            libgnutls28-dev:armhf \
-            libiscsi-dev:armhf \
-            libjson-c-dev:armhf \
-            libnl-3-dev:armhf \
-            libnl-route-3-dev:armhf \
-            libnuma-dev:armhf \
-            libparted-dev:armhf \
-            libpcap0.8-dev:armhf \
-            libpciaccess-dev:armhf \
-            librbd-dev:armhf \
-            libreadline-dev:armhf \
-            libsanlock-dev:armhf \
-            libsasl2-dev:armhf \
-            libselinux1-dev:armhf \
-            libssh-gcrypt-dev:armhf \
-            libssh2-1-dev:armhf \
-            libtirpc-dev:armhf \
-            libudev-dev:armhf \
-            libxen-dev:armhf \
-            libxml2-dev:armhf \
-            systemtap-sdt-dev:armhf
-    mkdir -p /usr/local/share/meson/cross
-    printf "[binaries]\n\
-c = '/usr/bin/arm-linux-gnueabihf-gcc'\n\
-ar = '/usr/bin/arm-linux-gnueabihf-gcc-ar'\n\
-strip = '/usr/bin/arm-linux-gnueabihf-strip'\n\
-pkgconfig = '/usr/bin/arm-linux-gnueabihf-pkg-config'\n\
-\n\
-[host_machine]\n\
-system = 'linux'\n\
-cpu_family = 'arm'\n\
-cpu = 'armhf'\n\
-endian = 'little'\n" > /usr/local/share/meson/cross/arm-linux-gnueabihf
-    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
-    mkdir -p /usr/libexec/ccache-wrappers
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/arm-linux-gnueabihf-cc
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/arm-linux-gnueabihf-gcc
-}
-
-export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
-export LANG="en_US.UTF-8"
-export MAKE="/usr/bin/make"
-export NINJA="/usr/bin/ninja"
-export PYTHON="/usr/bin/python3"
-
-export ABI="arm-linux-gnueabihf"
-export MESON_OPTS="--cross-file=arm-linux-gnueabihf"

ci/buildenv/debian-11-cross-i686.sh

@@ -1,116 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool manifest ci/manifest.yml
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-function install_buildenv() {
-    export DEBIAN_FRONTEND=noninteractive
-    apt-get update
-    apt-get dist-upgrade -y
-    apt-get install --no-install-recommends -y \
-            augeas-lenses \
-            augeas-tools \
-            bash-completion \
-            black \
-            ca-certificates \
-            ccache \
-            codespell \
-            cpp \
-            diffutils \
-            dwarves \
-            ebtables \
-            flake8 \
-            gettext \
-            git \
-            grep \
-            iproute2 \
-            iptables \
-            kmod \
-            libclang-dev \
-            libxml2-utils \
-            locales \
-            lvm2 \
-            make \
-            meson \
-            nfs-common \
-            ninja-build \
-            numad \
-            open-iscsi \
-            perl-base \
-            pkgconf \
-            policykit-1 \
-            python3 \
-            python3-docutils \
-            python3-pytest \
-            qemu-utils \
-            sed \
-            xsltproc
-    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen
-    dpkg-reconfigure locales
-    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
-    export DEBIAN_FRONTEND=noninteractive
-    dpkg --add-architecture i386
-    apt-get update
-    apt-get dist-upgrade -y
-    apt-get install --no-install-recommends -y dpkg-dev
-    apt-get install --no-install-recommends -y \
-            gcc-i686-linux-gnu \
-            libacl1-dev:i386 \
-            libapparmor-dev:i386 \
-            libattr1-dev:i386 \
-            libaudit-dev:i386 \
-            libblkid-dev:i386 \
-            libc6-dev:i386 \
-            libcap-ng-dev:i386 \
-            libcurl4-gnutls-dev:i386 \
-            libdevmapper-dev:i386 \
-            libfuse-dev:i386 \
-            libglib2.0-dev:i386 \
-            libglusterfs-dev:i386 \
-            libgnutls28-dev:i386 \
-            libiscsi-dev:i386 \
-            libjson-c-dev:i386 \
-            libnl-3-dev:i386 \
-            libnl-route-3-dev:i386 \
-            libnuma-dev:i386 \
-            libparted-dev:i386 \
-            libpcap0.8-dev:i386 \
-            libpciaccess-dev:i386 \
-            librbd-dev:i386 \
-            libreadline-dev:i386 \
-            libsanlock-dev:i386 \
-            libsasl2-dev:i386 \
-            libselinux1-dev:i386 \
-            libssh-gcrypt-dev:i386 \
-            libssh2-1-dev:i386 \
-            libtirpc-dev:i386 \
-            libudev-dev:i386 \
-            libxml2-dev:i386 \
-            systemtap-sdt-dev:i386
-    mkdir -p /usr/local/share/meson/cross
-    printf "[binaries]\n\
-c = '/usr/bin/i686-linux-gnu-gcc'\n\
-ar = '/usr/bin/i686-linux-gnu-gcc-ar'\n\
-strip = '/usr/bin/i686-linux-gnu-strip'\n\
-pkgconfig = '/usr/bin/i686-linux-gnu-pkg-config'\n\
-\n\
-[host_machine]\n\
-system = 'linux'\n\
-cpu_family = 'x86'\n\
-cpu = 'i686'\n\
-endian = 'little'\n" > /usr/local/share/meson/cross/i686-linux-gnu
-    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
-    mkdir -p /usr/libexec/ccache-wrappers
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/i686-linux-gnu-cc
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/i686-linux-gnu-gcc
-}
-
-export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
-export LANG="en_US.UTF-8"
-export MAKE="/usr/bin/make"
-export NINJA="/usr/bin/ninja"
-export PYTHON="/usr/bin/python3"
-
-export ABI="i686-linux-gnu"
-export MESON_OPTS="--cross-file=i686-linux-gnu"

ci/buildenv/debian-11-cross-mips64el.sh

@@ -1,116 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool manifest ci/manifest.yml
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-function install_buildenv() {
-    export DEBIAN_FRONTEND=noninteractive
-    apt-get update
-    apt-get dist-upgrade -y
-    apt-get install --no-install-recommends -y \
-            augeas-lenses \
-            augeas-tools \
-            bash-completion \
-            black \
-            ca-certificates \
-            ccache \
-            codespell \
-            cpp \
-            diffutils \
-            dwarves \
-            ebtables \
-            flake8 \
-            gettext \
-            git \
-            grep \
-            iproute2 \
-            iptables \
-            kmod \
-            libclang-dev \
-            libxml2-utils \
-            locales \
-            lvm2 \
-            make \
-            meson \
-            nfs-common \
-            ninja-build \
-            numad \
-            open-iscsi \
-            perl-base \
-            pkgconf \
-            policykit-1 \
-            python3 \
-            python3-docutils \
-            python3-pytest \
-            qemu-utils \
-            sed \
-            xsltproc
-    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen
-    dpkg-reconfigure locales
-    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
-    export DEBIAN_FRONTEND=noninteractive
-    dpkg --add-architecture mips64el
-    apt-get update
-    apt-get dist-upgrade -y
-    apt-get install --no-install-recommends -y dpkg-dev
-    apt-get install --no-install-recommends -y \
-            gcc-mips64el-linux-gnuabi64 \
-            libacl1-dev:mips64el \
-            libapparmor-dev:mips64el \
-            libattr1-dev:mips64el \
-            libaudit-dev:mips64el \
-            libblkid-dev:mips64el \
-            libc6-dev:mips64el \
-            libcap-ng-dev:mips64el \
-            libcurl4-gnutls-dev:mips64el \
-            libdevmapper-dev:mips64el \
-            libfuse-dev:mips64el \
-            libglib2.0-dev:mips64el \
-            libglusterfs-dev:mips64el \
-            libgnutls28-dev:mips64el \
-            libiscsi-dev:mips64el \
-            libjson-c-dev:mips64el \
-            libnl-3-dev:mips64el \
-            libnl-route-3-dev:mips64el \
-            libnuma-dev:mips64el \
-            libparted-dev:mips64el \
-            libpcap0.8-dev:mips64el \
-            libpciaccess-dev:mips64el \
-            librbd-dev:mips64el \
-            libreadline-dev:mips64el \
-            libsanlock-dev:mips64el \
-            libsasl2-dev:mips64el \
-            libselinux1-dev:mips64el \
-            libssh-gcrypt-dev:mips64el \
-            libssh2-1-dev:mips64el \
-            libtirpc-dev:mips64el \
-            libudev-dev:mips64el \
-            libxml2-dev:mips64el \
-            systemtap-sdt-dev:mips64el
-    mkdir -p /usr/local/share/meson/cross
-    printf "[binaries]\n\
-c = '/usr/bin/mips64el-linux-gnuabi64-gcc'\n\
-ar = '/usr/bin/mips64el-linux-gnuabi64-gcc-ar'\n\
-strip = '/usr/bin/mips64el-linux-gnuabi64-strip'\n\
-pkgconfig = '/usr/bin/mips64el-linux-gnuabi64-pkg-config'\n\
-\n\
-[host_machine]\n\
-system = 'linux'\n\
-cpu_family = 'mips64'\n\
-cpu = 'mips64el'\n\
-endian = 'little'\n" > /usr/local/share/meson/cross/mips64el-linux-gnuabi64
-    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
-    mkdir -p /usr/libexec/ccache-wrappers
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/mips64el-linux-gnuabi64-cc
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/mips64el-linux-gnuabi64-gcc
-}
-
-export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
-export LANG="en_US.UTF-8"
-export MAKE="/usr/bin/make"
-export NINJA="/usr/bin/ninja"
-export PYTHON="/usr/bin/python3"
-
-export ABI="mips64el-linux-gnuabi64"
-export MESON_OPTS="--cross-file=mips64el-linux-gnuabi64"

ci/buildenv/debian-11-cross-mipsel.sh

@@ -1,116 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool manifest ci/manifest.yml
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-function install_buildenv() {
-    export DEBIAN_FRONTEND=noninteractive
-    apt-get update
-    apt-get dist-upgrade -y
-    apt-get install --no-install-recommends -y \
-            augeas-lenses \
-            augeas-tools \
-            bash-completion \
-            black \
-            ca-certificates \
-            ccache \
-            codespell \
-            cpp \
-            diffutils \
-            dwarves \
-            ebtables \
-            flake8 \
-            gettext \
-            git \
-            grep \
-            iproute2 \
-            iptables \
-            kmod \
-            libclang-dev \
-            libxml2-utils \
-            locales \
-            lvm2 \
-            make \
-            meson \
-            nfs-common \
-            ninja-build \
-            numad \
-            open-iscsi \
-            perl-base \
-            pkgconf \
-            policykit-1 \
-            python3 \
-            python3-docutils \
-            python3-pytest \
-            qemu-utils \
-            sed \
-            xsltproc
-    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen
-    dpkg-reconfigure locales
-    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
-    export DEBIAN_FRONTEND=noninteractive
-    dpkg --add-architecture mipsel
-    apt-get update
-    apt-get dist-upgrade -y
-    apt-get install --no-install-recommends -y dpkg-dev
-    apt-get install --no-install-recommends -y \
-            gcc-mipsel-linux-gnu \
-            libacl1-dev:mipsel \
-            libapparmor-dev:mipsel \
-            libattr1-dev:mipsel \
-            libaudit-dev:mipsel \
-            libblkid-dev:mipsel \
-            libc6-dev:mipsel \
-            libcap-ng-dev:mipsel \
-            libcurl4-gnutls-dev:mipsel \
-            libdevmapper-dev:mipsel \
-            libfuse-dev:mipsel \
-            libglib2.0-dev:mipsel \
-            libglusterfs-dev:mipsel \
-            libgnutls28-dev:mipsel \
-            libiscsi-dev:mipsel \
-            libjson-c-dev:mipsel \
-            libnl-3-dev:mipsel \
-            libnl-route-3-dev:mipsel \
-            libnuma-dev:mipsel \
-            libparted-dev:mipsel \
-            libpcap0.8-dev:mipsel \
-            libpciaccess-dev:mipsel \
-            librbd-dev:mipsel \
-            libreadline-dev:mipsel \
-            libsanlock-dev:mipsel \
-            libsasl2-dev:mipsel \
-            libselinux1-dev:mipsel \
-            libssh-gcrypt-dev:mipsel \
-            libssh2-1-dev:mipsel \
-            libtirpc-dev:mipsel \
-            libudev-dev:mipsel \
-            libxml2-dev:mipsel \
-            systemtap-sdt-dev:mipsel
-    mkdir -p /usr/local/share/meson/cross
-    printf "[binaries]\n\
-c = '/usr/bin/mipsel-linux-gnu-gcc'\n\
-ar = '/usr/bin/mipsel-linux-gnu-gcc-ar'\n\
-strip = '/usr/bin/mipsel-linux-gnu-strip'\n\
-pkgconfig = '/usr/bin/mipsel-linux-gnu-pkg-config'\n\
-\n\
-[host_machine]\n\
-system = 'linux'\n\
-cpu_family = 'mips'\n\
-cpu = 'mipsel'\n\
-endian = 'little'\n" > /usr/local/share/meson/cross/mipsel-linux-gnu
-    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
-    mkdir -p /usr/libexec/ccache-wrappers
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/mipsel-linux-gnu-cc
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/mipsel-linux-gnu-gcc
-}
-
-export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
-export LANG="en_US.UTF-8"
-export MAKE="/usr/bin/make"
-export NINJA="/usr/bin/ninja"
-export PYTHON="/usr/bin/python3"
-
-export ABI="mipsel-linux-gnu"
-export MESON_OPTS="--cross-file=mipsel-linux-gnu"

ci/buildenv/debian-11-cross-ppc64le.sh

@@ -1,116 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool manifest ci/manifest.yml
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-function install_buildenv() {
-    export DEBIAN_FRONTEND=noninteractive
-    apt-get update
-    apt-get dist-upgrade -y
-    apt-get install --no-install-recommends -y \
-            augeas-lenses \
-            augeas-tools \
-            bash-completion \
-            black \
-            ca-certificates \
-            ccache \
-            codespell \
-            cpp \
-            diffutils \
-            dwarves \
-            ebtables \
-            flake8 \
-            gettext \
-            git \
-            grep \
-            iproute2 \
-            iptables \
-            kmod \
-            libclang-dev \
-            libxml2-utils \
-            locales \
-            lvm2 \
-            make \
-            meson \
-            nfs-common \
-            ninja-build \
-            numad \
-            open-iscsi \
-            perl-base \
-            pkgconf \
-            policykit-1 \
-            python3 \
-            python3-docutils \
-            python3-pytest \
-            qemu-utils \
-            sed \
-            xsltproc
-    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen
-    dpkg-reconfigure locales
-    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
-    export DEBIAN_FRONTEND=noninteractive
-    dpkg --add-architecture ppc64el
-    apt-get update
-    apt-get dist-upgrade -y
-    apt-get install --no-install-recommends -y dpkg-dev
-    apt-get install --no-install-recommends -y \
-            gcc-powerpc64le-linux-gnu \
-            libacl1-dev:ppc64el \
-            libapparmor-dev:ppc64el \
-            libattr1-dev:ppc64el \
-            libaudit-dev:ppc64el \
-            libblkid-dev:ppc64el \
-            libc6-dev:ppc64el \
-            libcap-ng-dev:ppc64el \
-            libcurl4-gnutls-dev:ppc64el \
-            libdevmapper-dev:ppc64el \
-            libfuse-dev:ppc64el \
-            libglib2.0-dev:ppc64el \
-            libglusterfs-dev:ppc64el \
-            libgnutls28-dev:ppc64el \
-            libiscsi-dev:ppc64el \
-            libjson-c-dev:ppc64el \
-            libnl-3-dev:ppc64el \
-            libnl-route-3-dev:ppc64el \
-            libnuma-dev:ppc64el \
-            libparted-dev:ppc64el \
-            libpcap0.8-dev:ppc64el \
-            libpciaccess-dev:ppc64el \
-            librbd-dev:ppc64el \
-            libreadline-dev:ppc64el \
-            libsanlock-dev:ppc64el \
-            libsasl2-dev:ppc64el \
-            libselinux1-dev:ppc64el \
-            libssh-gcrypt-dev:ppc64el \
-            libssh2-1-dev:ppc64el \
-            libtirpc-dev:ppc64el \
-            libudev-dev:ppc64el \
-            libxml2-dev:ppc64el \
-            systemtap-sdt-dev:ppc64el
-    mkdir -p /usr/local/share/meson/cross
-    printf "[binaries]\n\
-c = '/usr/bin/powerpc64le-linux-gnu-gcc'\n\
-ar = '/usr/bin/powerpc64le-linux-gnu-gcc-ar'\n\
-strip = '/usr/bin/powerpc64le-linux-gnu-strip'\n\
-pkgconfig = '/usr/bin/powerpc64le-linux-gnu-pkg-config'\n\
-\n\
-[host_machine]\n\
-system = 'linux'\n\
-cpu_family = 'ppc64'\n\
-cpu = 'powerpc64le'\n\
-endian = 'little'\n" > /usr/local/share/meson/cross/powerpc64le-linux-gnu
-    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
-    mkdir -p /usr/libexec/ccache-wrappers
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/powerpc64le-linux-gnu-cc
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/powerpc64le-linux-gnu-gcc
-}
-
-export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
-export LANG="en_US.UTF-8"
-export MAKE="/usr/bin/make"
-export NINJA="/usr/bin/ninja"
-export PYTHON="/usr/bin/python3"
-
-export ABI="powerpc64le-linux-gnu"
-export MESON_OPTS="--cross-file=powerpc64le-linux-gnu"

ci/buildenv/debian-11-cross-s390x.sh

@@ -1,116 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool manifest ci/manifest.yml
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-function install_buildenv() {
-    export DEBIAN_FRONTEND=noninteractive
-    apt-get update
-    apt-get dist-upgrade -y
-    apt-get install --no-install-recommends -y \
-            augeas-lenses \
-            augeas-tools \
-            bash-completion \
-            black \
-            ca-certificates \
-            ccache \
-            codespell \
-            cpp \
-            diffutils \
-            dwarves \
-            ebtables \
-            flake8 \
-            gettext \
-            git \
-            grep \
-            iproute2 \
-            iptables \
-            kmod \
-            libclang-dev \
-            libxml2-utils \
-            locales \
-            lvm2 \
-            make \
-            meson \
-            nfs-common \
-            ninja-build \
-            numad \
-            open-iscsi \
-            perl-base \
-            pkgconf \
-            policykit-1 \
-            python3 \
-            python3-docutils \
-            python3-pytest \
-            qemu-utils \
-            sed \
-            xsltproc
-    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen
-    dpkg-reconfigure locales
-    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
-    export DEBIAN_FRONTEND=noninteractive
-    dpkg --add-architecture s390x
-    apt-get update
-    apt-get dist-upgrade -y
-    apt-get install --no-install-recommends -y dpkg-dev
-    apt-get install --no-install-recommends -y \
-            gcc-s390x-linux-gnu \
-            libacl1-dev:s390x \
-            libapparmor-dev:s390x \
-            libattr1-dev:s390x \
-            libaudit-dev:s390x \
-            libblkid-dev:s390x \
-            libc6-dev:s390x \
-            libcap-ng-dev:s390x \
-            libcurl4-gnutls-dev:s390x \
-            libdevmapper-dev:s390x \
-            libfuse-dev:s390x \
-            libglib2.0-dev:s390x \
-            libglusterfs-dev:s390x \
-            libgnutls28-dev:s390x \
-            libiscsi-dev:s390x \
-            libjson-c-dev:s390x \
-            libnl-3-dev:s390x \
-            libnl-route-3-dev:s390x \
-            libnuma-dev:s390x \
-            libparted-dev:s390x \
-            libpcap0.8-dev:s390x \
-            libpciaccess-dev:s390x \
-            librbd-dev:s390x \
-            libreadline-dev:s390x \
-            libsanlock-dev:s390x \
-            libsasl2-dev:s390x \
-            libselinux1-dev:s390x \
-            libssh-gcrypt-dev:s390x \
-            libssh2-1-dev:s390x \
-            libtirpc-dev:s390x \
-            libudev-dev:s390x \
-            libxml2-dev:s390x \
-            systemtap-sdt-dev:s390x
-    mkdir -p /usr/local/share/meson/cross
-    printf "[binaries]\n\
-c = '/usr/bin/s390x-linux-gnu-gcc'\n\
-ar = '/usr/bin/s390x-linux-gnu-gcc-ar'\n\
-strip = '/usr/bin/s390x-linux-gnu-strip'\n\
-pkgconfig = '/usr/bin/s390x-linux-gnu-pkg-config'\n\
-\n\
-[host_machine]\n\
-system = 'linux'\n\
-cpu_family = 's390x'\n\
-cpu = 's390x'\n\
-endian = 'big'\n" > /usr/local/share/meson/cross/s390x-linux-gnu
-    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
-    mkdir -p /usr/libexec/ccache-wrappers
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/s390x-linux-gnu-cc
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/s390x-linux-gnu-gcc
-}
-
-export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
-export LANG="en_US.UTF-8"
-export MAKE="/usr/bin/make"
-export NINJA="/usr/bin/ninja"
-export PYTHON="/usr/bin/python3"
-
-export ABI="s390x-linux-gnu"
-export MESON_OPTS="--cross-file=s390x-linux-gnu"

ci/buildenv/debian-11.sh

@@ -1,100 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool manifest ci/manifest.yml
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-function install_buildenv() {
-    export DEBIAN_FRONTEND=noninteractive
-    apt-get update
-    apt-get dist-upgrade -y
-    apt-get install --no-install-recommends -y \
-            augeas-lenses \
-            augeas-tools \
-            bash-completion \
-            black \
-            ca-certificates \
-            ccache \
-            clang \
-            codespell \
-            cpp \
-            diffutils \
-            dwarves \
-            ebtables \
-            flake8 \
-            gcc \
-            gettext \
-            git \
-            grep \
-            iproute2 \
-            iptables \
-            kmod \
-            libacl1-dev \
-            libapparmor-dev \
-            libattr1-dev \
-            libaudit-dev \
-            libblkid-dev \
-            libc6-dev \
-            libcap-ng-dev \
-            libclang-dev \
-            libcurl4-gnutls-dev \
-            libdevmapper-dev \
-            libfuse-dev \
-            libglib2.0-dev \
-            libglusterfs-dev \
-            libgnutls28-dev \
-            libiscsi-dev \
-            libjson-c-dev \
-            libnetcf-dev \
-            libnl-3-dev \
-            libnl-route-3-dev \
-            libnuma-dev \
-            libparted-dev \
-            libpcap0.8-dev \
-            libpciaccess-dev \
-            librbd-dev \
-            libreadline-dev \
-            libsanlock-dev \
-            libsasl2-dev \
-            libselinux1-dev \
-            libssh-gcrypt-dev \
-            libssh2-1-dev \
-            libtirpc-dev \
-            libudev-dev \
-            libxen-dev \
-            libxml2-dev \
-            libxml2-utils \
-            locales \
-            lvm2 \
-            make \
-            meson \
-            nfs-common \
-            ninja-build \
-            numad \
-            open-iscsi \
-            perl-base \
-            pkgconf \
-            policykit-1 \
-            python3 \
-            python3-docutils \
-            python3-pytest \
-            qemu-utils \
-            sed \
-            systemtap-sdt-dev \
-            wireshark-dev \
-            xsltproc
-    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen
-    dpkg-reconfigure locales
-    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
-    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
-    mkdir -p /usr/libexec/ccache-wrappers
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
-}
-
-export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
-export LANG="en_US.UTF-8"
-export MAKE="/usr/bin/make"
-export NINJA="/usr/bin/ninja"
-export PYTHON="/usr/bin/python3"

ci/buildenv/debian-12-cross-aarch64.sh

@@ -83,7 +83,7 @@ function install_buildenv() {
             libsanlock-dev:arm64 \
             libsasl2-dev:arm64 \
             libselinux1-dev:arm64 \
-            libssh-gcrypt-dev:arm64 \
+            libssh-dev:arm64 \
             libssh2-1-dev:arm64 \
             libtirpc-dev:arm64 \
             libudev-dev:arm64 \

ci/buildenv/debian-12-cross-armv6l.sh

@@ -83,7 +83,7 @@ function install_buildenv() {
             libsanlock-dev:armel \
             libsasl2-dev:armel \
             libselinux1-dev:armel \
-            libssh-gcrypt-dev:armel \
+            libssh-dev:armel \
             libssh2-1-dev:armel \
             libtirpc-dev:armel \
             libudev-dev:armel \

ci/buildenv/debian-12-cross-armv7l.sh

@@ -83,7 +83,7 @@ function install_buildenv() {
             libsanlock-dev:armhf \
             libsasl2-dev:armhf \
             libselinux1-dev:armhf \
-            libssh-gcrypt-dev:armhf \
+            libssh-dev:armhf \
             libssh2-1-dev:armhf \
             libtirpc-dev:armhf \
             libudev-dev:armhf \

ci/buildenv/debian-12-cross-i686.sh

@@ -83,7 +83,7 @@ function install_buildenv() {
             libsanlock-dev:i386 \
             libsasl2-dev:i386 \
             libselinux1-dev:i386 \
-            libssh-gcrypt-dev:i386 \
+            libssh-dev:i386 \
             libssh2-1-dev:i386 \
             libtirpc-dev:i386 \
             libudev-dev:i386 \

ci/buildenv/debian-12-cross-mips64el.sh

@@ -83,7 +83,7 @@ function install_buildenv() {
             libsanlock-dev:mips64el \
             libsasl2-dev:mips64el \
             libselinux1-dev:mips64el \
-            libssh-gcrypt-dev:mips64el \
+            libssh-dev:mips64el \
             libssh2-1-dev:mips64el \
             libtirpc-dev:mips64el \
             libudev-dev:mips64el \

ci/buildenv/debian-12-cross-mipsel.sh

@@ -83,7 +83,7 @@ function install_buildenv() {
             libsanlock-dev:mipsel \
             libsasl2-dev:mipsel \
             libselinux1-dev:mipsel \
-            libssh-gcrypt-dev:mipsel \
+            libssh-dev:mipsel \
             libssh2-1-dev:mipsel \
             libtirpc-dev:mipsel \
             libudev-dev:mipsel \

ci/buildenv/debian-12-cross-ppc64le.sh

@@ -83,7 +83,7 @@ function install_buildenv() {
             libsanlock-dev:ppc64el \
             libsasl2-dev:ppc64el \
             libselinux1-dev:ppc64el \
-            libssh-gcrypt-dev:ppc64el \
+            libssh-dev:ppc64el \
             libssh2-1-dev:ppc64el \
             libtirpc-dev:ppc64el \
             libudev-dev:ppc64el \

ci/buildenv/debian-12-cross-s390x.sh

@@ -83,7 +83,7 @@ function install_buildenv() {
             libsanlock-dev:s390x \
             libsasl2-dev:s390x \
             libselinux1-dev:s390x \
-            libssh-gcrypt-dev:s390x \
+            libssh-dev:s390x \
             libssh2-1-dev:s390x \
             libtirpc-dev:s390x \
             libudev-dev:s390x \

ci/buildenv/debian-12.sh

@@ -57,7 +57,7 @@ function install_buildenv() {
             libsanlock-dev \
             libsasl2-dev \
             libselinux1-dev \
-            libssh-gcrypt-dev \
+            libssh-dev \
             libssh2-1-dev \
             libtirpc-dev \
             libudev-dev \

ci/buildenv/debian-sid-cross-aarch64.sh

@@ -83,7 +83,7 @@ function install_buildenv() {
             libsanlock-dev:arm64 \
             libsasl2-dev:arm64 \
             libselinux1-dev:arm64 \
-            libssh-gcrypt-dev:arm64 \
+            libssh-dev:arm64 \
             libssh2-1-dev:arm64 \
             libtirpc-dev:arm64 \
             libudev-dev:arm64 \

ci/buildenv/debian-sid-cross-armv6l.sh

@@ -82,7 +82,7 @@ function install_buildenv() {
             libsanlock-dev:armel \
             libsasl2-dev:armel \
             libselinux1-dev:armel \
-            libssh-gcrypt-dev:armel \
+            libssh-dev:armel \
             libssh2-1-dev:armel \
             libtirpc-dev:armel \
             libudev-dev:armel \

ci/buildenv/debian-sid-cross-armv7l.sh

@@ -82,7 +82,7 @@ function install_buildenv() {
             libsanlock-dev:armhf \
             libsasl2-dev:armhf \
             libselinux1-dev:armhf \
-            libssh-gcrypt-dev:armhf \
+            libssh-dev:armhf \
             libssh2-1-dev:armhf \
             libtirpc-dev:armhf \
             libudev-dev:armhf \

ci/buildenv/debian-sid-cross-i686.sh

@@ -82,7 +82,7 @@ function install_buildenv() {
             libsanlock-dev:i386 \
             libsasl2-dev:i386 \
             libselinux1-dev:i386 \
-            libssh-gcrypt-dev:i386 \
+            libssh-dev:i386 \
             libssh2-1-dev:i386 \
             libtirpc-dev:i386 \
             libudev-dev:i386 \

ci/buildenv/debian-sid-cross-mips64el.sh

@@ -83,7 +83,7 @@ function install_buildenv() {
             libsanlock-dev:mips64el \
             libsasl2-dev:mips64el \
             libselinux1-dev:mips64el \
-            libssh-gcrypt-dev:mips64el \
+            libssh-dev:mips64el \
             libssh2-1-dev:mips64el \
             libtirpc-dev:mips64el \
             libudev-dev:mips64el \

ci/buildenv/debian-sid-cross-ppc64le.sh

@@ -83,7 +83,7 @@ function install_buildenv() {
             libsanlock-dev:ppc64el \
             libsasl2-dev:ppc64el \
             libselinux1-dev:ppc64el \
-            libssh-gcrypt-dev:ppc64el \
+            libssh-dev:ppc64el \
             libssh2-1-dev:ppc64el \
             libtirpc-dev:ppc64el \
             libudev-dev:ppc64el \

ci/buildenv/debian-sid-cross-s390x.sh

@@ -83,7 +83,7 @@ function install_buildenv() {
             libsanlock-dev:s390x \
             libsasl2-dev:s390x \
             libselinux1-dev:s390x \
-            libssh-gcrypt-dev:s390x \
+            libssh-dev:s390x \
             libssh2-1-dev:s390x \
             libtirpc-dev:s390x \
             libudev-dev:s390x \

ci/buildenv/debian-sid.sh

@@ -57,7 +57,7 @@ function install_buildenv() {
             libsanlock-dev \
             libsasl2-dev \
             libselinux1-dev \
-            libssh-gcrypt-dev \
+            libssh-dev \
             libssh2-1-dev \
             libtirpc-dev \
             libudev-dev \

ci/buildenv/fedora-41-cross-mingw32.sh

@@ -8,7 +8,7 @@ function install_buildenv() {
     dnf update -y
     dnf install -y \
         augeas \
-        bash-completion \
+        bash-completion-devel \
         ca-certificates \
         ccache \
         codespell \

ci/buildenv/fedora-41-cross-mingw64.sh

@@ -8,7 +8,7 @@ function install_buildenv() {
     dnf update -y
     dnf install -y \
         augeas \
-        bash-completion \
+        bash-completion-devel \
         ca-certificates \
         ccache \
         codespell \

ci/buildenv/fedora-41.sh

@@ -9,7 +9,7 @@ function install_buildenv() {
     dnf install -y \
         audit-libs-devel \
         augeas \
-        bash-completion \
+        bash-completion-devel \
         ca-certificates \
         ccache \
         clang \
@@ -82,6 +82,7 @@ function install_buildenv() {
         systemd-devel \
         systemd-rpm-macros \
         systemtap-sdt-devel \
+        systemtap-sdt-dtrace \
         wireshark-devel \
         xen-devel
     rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED

ci/cirrus/freebsd-13.vars

@@ -11,6 +11,6 @@ MAKE='/usr/local/bin/gmake'
 NINJA='/usr/local/bin/ninja'
 PACKAGING_COMMAND='pkg'
 PIP3='/usr/local/bin/pip-3.8'
-PKGS='augeas bash-completion ca_root_nss ccache codespell cppi curl cyrus-sasl diffutils fusefs-libs gettext git glib gmake gnugrep gnutls gsed json-c libpcap libpciaccess libssh libssh2 libxml2 libxslt meson ninja perl5 pkgconf polkit py311-black py311-docutils py311-flake8 py311-pytest python3 qemu readline'
+PKGS='augeas bash-completion ca_root_nss ccache4 codespell cppi curl cyrus-sasl diffutils fusefs-libs gettext git glib gmake gnugrep gnutls gsed json-c libpcap libpciaccess libssh libssh2 libxml2 libxslt meson ninja perl5 pkgconf polkit py311-black py311-docutils py311-flake8 py311-pytest python3 qemu readline'
 PYPI_PKGS=''
 PYTHON='/usr/local/bin/python3'

ci/cirrus/freebsd-14.vars

@@ -10,7 +10,7 @@ CROSS_PKGS=''
 MAKE='/usr/local/bin/gmake'
 NINJA='/usr/local/bin/ninja'
 PACKAGING_COMMAND='pkg'
-PIP3='/usr/local/bin/pip-3.8'
-PKGS='augeas bash-completion ca_root_nss ccache codespell cppi curl cyrus-sasl diffutils fusefs-libs gettext git glib gmake gnugrep gnutls gsed json-c libpcap libpciaccess libssh libssh2 libxml2 libxslt meson ninja perl5 pkgconf polkit py311-black py311-docutils py311-flake8 py311-pytest python3 qemu readline'
+PIP3='/usr/local/bin/pip'
+PKGS='augeas bash-completion ca_root_nss ccache4 codespell cppi curl cyrus-sasl diffutils fusefs-libs gettext git glib gmake gnugrep gnutls gsed json-c libpcap libpciaccess libssh libssh2 libxml2 libxslt meson ninja perl5 pkgconf polkit py311-black py311-docutils py311-flake8 py311-pytest python3 qemu readline'
 PYPI_PKGS=''
 PYTHON='/usr/local/bin/python3'

ci/containers/alpine-321.Dockerfile

@@ -4,7 +4,7 @@
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM docker.io/library/alpine:3.19
+FROM docker.io/library/alpine:3.21
 
 RUN apk update && \
     apk upgrade && \

ci/containers/debian-11-cross-aarch64.Dockerfile

@@ -1,123 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool manifest ci/manifest.yml
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-FROM docker.io/library/debian:11-slim
-
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    apt-get update && \
-    apt-get install -y eatmydata && \
-    eatmydata apt-get dist-upgrade -y && \
-    eatmydata apt-get install --no-install-recommends -y \
-                      augeas-lenses \
-                      augeas-tools \
-                      bash-completion \
-                      black \
-                      ca-certificates \
-                      ccache \
-                      codespell \
-                      cpp \
-                      diffutils \
-                      dwarves \
-                      ebtables \
-                      flake8 \
-                      gettext \
-                      git \
-                      grep \
-                      iproute2 \
-                      iptables \
-                      kmod \
-                      libclang-dev \
-                      libxml2-utils \
-                      locales \
-                      lvm2 \
-                      make \
-                      meson \
-                      nfs-common \
-                      ninja-build \
-                      numad \
-                      open-iscsi \
-                      perl-base \
-                      pkgconf \
-                      policykit-1 \
-                      python3 \
-                      python3-docutils \
-                      python3-pytest \
-                      qemu-utils \
-                      sed \
-                      xsltproc && \
-    eatmydata apt-get autoremove -y && \
-    eatmydata apt-get autoclean -y && \
-    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
-    dpkg-reconfigure locales && \
-    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
-
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
-
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    dpkg --add-architecture arm64 && \
-    eatmydata apt-get update && \
-    eatmydata apt-get dist-upgrade -y && \
-    eatmydata apt-get install --no-install-recommends -y dpkg-dev && \
-    eatmydata apt-get install --no-install-recommends -y \
-                      gcc-aarch64-linux-gnu \
-                      libacl1-dev:arm64 \
-                      libapparmor-dev:arm64 \
-                      libattr1-dev:arm64 \
-                      libaudit-dev:arm64 \
-                      libblkid-dev:arm64 \
-                      libc6-dev:arm64 \
-                      libcap-ng-dev:arm64 \
-                      libcurl4-gnutls-dev:arm64 \
-                      libdevmapper-dev:arm64 \
-                      libfuse-dev:arm64 \
-                      libglib2.0-dev:arm64 \
-                      libglusterfs-dev:arm64 \
-                      libgnutls28-dev:arm64 \
-                      libiscsi-dev:arm64 \
-                      libjson-c-dev:arm64 \
-                      libnl-3-dev:arm64 \
-                      libnl-route-3-dev:arm64 \
-                      libnuma-dev:arm64 \
-                      libparted-dev:arm64 \
-                      libpcap0.8-dev:arm64 \
-                      libpciaccess-dev:arm64 \
-                      librbd-dev:arm64 \
-                      libreadline-dev:arm64 \
-                      libsanlock-dev:arm64 \
-                      libsasl2-dev:arm64 \
-                      libselinux1-dev:arm64 \
-                      libssh-gcrypt-dev:arm64 \
-                      libssh2-1-dev:arm64 \
-                      libtirpc-dev:arm64 \
-                      libudev-dev:arm64 \
-                      libxen-dev:arm64 \
-                      libxml2-dev:arm64 \
-                      systemtap-sdt-dev:arm64 && \
-    eatmydata apt-get autoremove -y && \
-    eatmydata apt-get autoclean -y && \
-    mkdir -p /usr/local/share/meson/cross && \
-    printf "[binaries]\n\
-c = '/usr/bin/aarch64-linux-gnu-gcc'\n\
-ar = '/usr/bin/aarch64-linux-gnu-gcc-ar'\n\
-strip = '/usr/bin/aarch64-linux-gnu-strip'\n\
-pkgconfig = '/usr/bin/aarch64-linux-gnu-pkg-config'\n\
-\n\
-[host_machine]\n\
-system = 'linux'\n\
-cpu_family = 'aarch64'\n\
-cpu = 'aarch64'\n\
-endian = 'little'\n" > /usr/local/share/meson/cross/aarch64-linux-gnu && \
-    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
-    mkdir -p /usr/libexec/ccache-wrappers && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/aarch64-linux-gnu-cc && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/aarch64-linux-gnu-gcc
-
-ENV ABI "aarch64-linux-gnu"
-ENV MESON_OPTS "--cross-file=aarch64-linux-gnu"

ci/containers/debian-11-cross-armv6l.Dockerfile

@@ -1,122 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool manifest ci/manifest.yml
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-FROM docker.io/library/debian:11-slim
-
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    apt-get update && \
-    apt-get install -y eatmydata && \
-    eatmydata apt-get dist-upgrade -y && \
-    eatmydata apt-get install --no-install-recommends -y \
-                      augeas-lenses \
-                      augeas-tools \
-                      bash-completion \
-                      black \
-                      ca-certificates \
-                      ccache \
-                      codespell \
-                      cpp \
-                      diffutils \
-                      dwarves \
-                      ebtables \
-                      flake8 \
-                      gettext \
-                      git \
-                      grep \
-                      iproute2 \
-                      iptables \
-                      kmod \
-                      libclang-dev \
-                      libxml2-utils \
-                      locales \
-                      lvm2 \
-                      make \
-                      meson \
-                      nfs-common \
-                      ninja-build \
-                      numad \
-                      open-iscsi \
-                      perl-base \
-                      pkgconf \
-                      policykit-1 \
-                      python3 \
-                      python3-docutils \
-                      python3-pytest \
-                      qemu-utils \
-                      sed \
-                      xsltproc && \
-    eatmydata apt-get autoremove -y && \
-    eatmydata apt-get autoclean -y && \
-    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
-    dpkg-reconfigure locales && \
-    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
-
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
-
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    dpkg --add-architecture armel && \
-    eatmydata apt-get update && \
-    eatmydata apt-get dist-upgrade -y && \
-    eatmydata apt-get install --no-install-recommends -y dpkg-dev && \
-    eatmydata apt-get install --no-install-recommends -y \
-                      gcc-arm-linux-gnueabi \
-                      libacl1-dev:armel \
-                      libapparmor-dev:armel \
-                      libattr1-dev:armel \
-                      libaudit-dev:armel \
-                      libblkid-dev:armel \
-                      libc6-dev:armel \
-                      libcap-ng-dev:armel \
-                      libcurl4-gnutls-dev:armel \
-                      libdevmapper-dev:armel \
-                      libfuse-dev:armel \
-                      libglib2.0-dev:armel \
-                      libglusterfs-dev:armel \
-                      libgnutls28-dev:armel \
-                      libiscsi-dev:armel \
-                      libjson-c-dev:armel \
-                      libnl-3-dev:armel \
-                      libnl-route-3-dev:armel \
-                      libnuma-dev:armel \
-                      libparted-dev:armel \
-                      libpcap0.8-dev:armel \
-                      libpciaccess-dev:armel \
-                      librbd-dev:armel \
-                      libreadline-dev:armel \
-                      libsanlock-dev:armel \
-                      libsasl2-dev:armel \
-                      libselinux1-dev:armel \
-                      libssh-gcrypt-dev:armel \
-                      libssh2-1-dev:armel \
-                      libtirpc-dev:armel \
-                      libudev-dev:armel \
-                      libxml2-dev:armel \
-                      systemtap-sdt-dev:armel && \
-    eatmydata apt-get autoremove -y && \
-    eatmydata apt-get autoclean -y && \
-    mkdir -p /usr/local/share/meson/cross && \
-    printf "[binaries]\n\
-c = '/usr/bin/arm-linux-gnueabi-gcc'\n\
-ar = '/usr/bin/arm-linux-gnueabi-gcc-ar'\n\
-strip = '/usr/bin/arm-linux-gnueabi-strip'\n\
-pkgconfig = '/usr/bin/arm-linux-gnueabi-pkg-config'\n\
-\n\
-[host_machine]\n\
-system = 'linux'\n\
-cpu_family = 'arm'\n\
-cpu = 'arm'\n\
-endian = 'little'\n" > /usr/local/share/meson/cross/arm-linux-gnueabi && \
-    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
-    mkdir -p /usr/libexec/ccache-wrappers && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/arm-linux-gnueabi-cc && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/arm-linux-gnueabi-gcc
-
-ENV ABI "arm-linux-gnueabi"
-ENV MESON_OPTS "--cross-file=arm-linux-gnueabi"

ci/containers/debian-11-cross-armv7l.Dockerfile

@@ -1,123 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool manifest ci/manifest.yml
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-FROM docker.io/library/debian:11-slim
-
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    apt-get update && \
-    apt-get install -y eatmydata && \
-    eatmydata apt-get dist-upgrade -y && \
-    eatmydata apt-get install --no-install-recommends -y \
-                      augeas-lenses \
-                      augeas-tools \
-                      bash-completion \
-                      black \
-                      ca-certificates \
-                      ccache \
-                      codespell \
-                      cpp \
-                      diffutils \
-                      dwarves \
-                      ebtables \
-                      flake8 \
-                      gettext \
-                      git \
-                      grep \
-                      iproute2 \
-                      iptables \
-                      kmod \
-                      libclang-dev \
-                      libxml2-utils \
-                      locales \
-                      lvm2 \
-                      make \
-                      meson \
-                      nfs-common \
-                      ninja-build \
-                      numad \
-                      open-iscsi \
-                      perl-base \
-                      pkgconf \
-                      policykit-1 \
-                      python3 \
-                      python3-docutils \
-                      python3-pytest \
-                      qemu-utils \
-                      sed \
-                      xsltproc && \
-    eatmydata apt-get autoremove -y && \
-    eatmydata apt-get autoclean -y && \
-    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
-    dpkg-reconfigure locales && \
-    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
-
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
-
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    dpkg --add-architecture armhf && \
-    eatmydata apt-get update && \
-    eatmydata apt-get dist-upgrade -y && \
-    eatmydata apt-get install --no-install-recommends -y dpkg-dev && \
-    eatmydata apt-get install --no-install-recommends -y \
-                      gcc-arm-linux-gnueabihf \
-                      libacl1-dev:armhf \
-                      libapparmor-dev:armhf \
-                      libattr1-dev:armhf \
-                      libaudit-dev:armhf \
-                      libblkid-dev:armhf \
-                      libc6-dev:armhf \
-                      libcap-ng-dev:armhf \
-                      libcurl4-gnutls-dev:armhf \
-                      libdevmapper-dev:armhf \
-                      libfuse-dev:armhf \
-                      libglib2.0-dev:armhf \
-                      libglusterfs-dev:armhf \
-                      libgnutls28-dev:armhf \
-                      libiscsi-dev:armhf \
-                      libjson-c-dev:armhf \
-                      libnl-3-dev:armhf \
-                      libnl-route-3-dev:armhf \
-                      libnuma-dev:armhf \
-                      libparted-dev:armhf \
-                      libpcap0.8-dev:armhf \
-                      libpciaccess-dev:armhf \
-                      librbd-dev:armhf \
-                      libreadline-dev:armhf \
-                      libsanlock-dev:armhf \
-                      libsasl2-dev:armhf \
-                      libselinux1-dev:armhf \
-                      libssh-gcrypt-dev:armhf \
-                      libssh2-1-dev:armhf \
-                      libtirpc-dev:armhf \
-                      libudev-dev:armhf \
-                      libxen-dev:armhf \
-                      libxml2-dev:armhf \
-                      systemtap-sdt-dev:armhf && \
-    eatmydata apt-get autoremove -y && \
-    eatmydata apt-get autoclean -y && \
-    mkdir -p /usr/local/share/meson/cross && \
-    printf "[binaries]\n\
-c = '/usr/bin/arm-linux-gnueabihf-gcc'\n\
-ar = '/usr/bin/arm-linux-gnueabihf-gcc-ar'\n\
-strip = '/usr/bin/arm-linux-gnueabihf-strip'\n\
-pkgconfig = '/usr/bin/arm-linux-gnueabihf-pkg-config'\n\
-\n\
-[host_machine]\n\
-system = 'linux'\n\
-cpu_family = 'arm'\n\
-cpu = 'armhf'\n\
-endian = 'little'\n" > /usr/local/share/meson/cross/arm-linux-gnueabihf && \
-    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
-    mkdir -p /usr/libexec/ccache-wrappers && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/arm-linux-gnueabihf-cc && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/arm-linux-gnueabihf-gcc
-
-ENV ABI "arm-linux-gnueabihf"
-ENV MESON_OPTS "--cross-file=arm-linux-gnueabihf"

ci/containers/debian-11-cross-i686.Dockerfile

@@ -1,122 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool manifest ci/manifest.yml
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-FROM docker.io/library/debian:11-slim
-
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    apt-get update && \
-    apt-get install -y eatmydata && \
-    eatmydata apt-get dist-upgrade -y && \
-    eatmydata apt-get install --no-install-recommends -y \
-                      augeas-lenses \
-                      augeas-tools \
-                      bash-completion \
-                      black \
-                      ca-certificates \
-                      ccache \
-                      codespell \
-                      cpp \
-                      diffutils \
-                      dwarves \
-                      ebtables \
-                      flake8 \
-                      gettext \
-                      git \
-                      grep \
-                      iproute2 \
-                      iptables \
-                      kmod \
-                      libclang-dev \
-                      libxml2-utils \
-                      locales \
-                      lvm2 \
-                      make \
-                      meson \
-                      nfs-common \
-                      ninja-build \
-                      numad \
-                      open-iscsi \
-                      perl-base \
-                      pkgconf \
-                      policykit-1 \
-                      python3 \
-                      python3-docutils \
-                      python3-pytest \
-                      qemu-utils \
-                      sed \
-                      xsltproc && \
-    eatmydata apt-get autoremove -y && \
-    eatmydata apt-get autoclean -y && \
-    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
-    dpkg-reconfigure locales && \
-    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
-
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
-
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    dpkg --add-architecture i386 && \
-    eatmydata apt-get update && \
-    eatmydata apt-get dist-upgrade -y && \
-    eatmydata apt-get install --no-install-recommends -y dpkg-dev && \
-    eatmydata apt-get install --no-install-recommends -y \
-                      gcc-i686-linux-gnu \
-                      libacl1-dev:i386 \
-                      libapparmor-dev:i386 \
-                      libattr1-dev:i386 \
-                      libaudit-dev:i386 \
-                      libblkid-dev:i386 \
-                      libc6-dev:i386 \
-                      libcap-ng-dev:i386 \
-                      libcurl4-gnutls-dev:i386 \
-                      libdevmapper-dev:i386 \
-                      libfuse-dev:i386 \
-                      libglib2.0-dev:i386 \
-                      libglusterfs-dev:i386 \
-                      libgnutls28-dev:i386 \
-                      libiscsi-dev:i386 \
-                      libjson-c-dev:i386 \
-                      libnl-3-dev:i386 \
-                      libnl-route-3-dev:i386 \
-                      libnuma-dev:i386 \
-                      libparted-dev:i386 \
-                      libpcap0.8-dev:i386 \
-                      libpciaccess-dev:i386 \
-                      librbd-dev:i386 \
-                      libreadline-dev:i386 \
-                      libsanlock-dev:i386 \
-                      libsasl2-dev:i386 \
-                      libselinux1-dev:i386 \
-                      libssh-gcrypt-dev:i386 \
-                      libssh2-1-dev:i386 \
-                      libtirpc-dev:i386 \
-                      libudev-dev:i386 \
-                      libxml2-dev:i386 \
-                      systemtap-sdt-dev:i386 && \
-    eatmydata apt-get autoremove -y && \
-    eatmydata apt-get autoclean -y && \
-    mkdir -p /usr/local/share/meson/cross && \
-    printf "[binaries]\n\
-c = '/usr/bin/i686-linux-gnu-gcc'\n\
-ar = '/usr/bin/i686-linux-gnu-gcc-ar'\n\
-strip = '/usr/bin/i686-linux-gnu-strip'\n\
-pkgconfig = '/usr/bin/i686-linux-gnu-pkg-config'\n\
-\n\
-[host_machine]\n\
-system = 'linux'\n\
-cpu_family = 'x86'\n\
-cpu = 'i686'\n\
-endian = 'little'\n" > /usr/local/share/meson/cross/i686-linux-gnu && \
-    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
-    mkdir -p /usr/libexec/ccache-wrappers && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/i686-linux-gnu-cc && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/i686-linux-gnu-gcc
-
-ENV ABI "i686-linux-gnu"
-ENV MESON_OPTS "--cross-file=i686-linux-gnu"

ci/containers/debian-11-cross-mips64el.Dockerfile

@@ -1,122 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool manifest ci/manifest.yml
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-FROM docker.io/library/debian:11-slim
-
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    apt-get update && \
-    apt-get install -y eatmydata && \
-    eatmydata apt-get dist-upgrade -y && \
-    eatmydata apt-get install --no-install-recommends -y \
-                      augeas-lenses \
-                      augeas-tools \
-                      bash-completion \
-                      black \
-                      ca-certificates \
-                      ccache \
-                      codespell \
-                      cpp \
-                      diffutils \
-                      dwarves \
-                      ebtables \
-                      flake8 \
-                      gettext \
-                      git \
-                      grep \
-                      iproute2 \
-                      iptables \
-                      kmod \
-                      libclang-dev \
-                      libxml2-utils \
-                      locales \
-                      lvm2 \
-                      make \
-                      meson \
-                      nfs-common \
-                      ninja-build \
-                      numad \
-                      open-iscsi \
-                      perl-base \
-                      pkgconf \
-                      policykit-1 \
-                      python3 \
-                      python3-docutils \
-                      python3-pytest \
-                      qemu-utils \
-                      sed \
-                      xsltproc && \
-    eatmydata apt-get autoremove -y && \
-    eatmydata apt-get autoclean -y && \
-    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
-    dpkg-reconfigure locales && \
-    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
-
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
-
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    dpkg --add-architecture mips64el && \
-    eatmydata apt-get update && \
-    eatmydata apt-get dist-upgrade -y && \
-    eatmydata apt-get install --no-install-recommends -y dpkg-dev && \
-    eatmydata apt-get install --no-install-recommends -y \
-                      gcc-mips64el-linux-gnuabi64 \
-                      libacl1-dev:mips64el \
-                      libapparmor-dev:mips64el \
-                      libattr1-dev:mips64el \
-                      libaudit-dev:mips64el \
-                      libblkid-dev:mips64el \
-                      libc6-dev:mips64el \
-                      libcap-ng-dev:mips64el \
-                      libcurl4-gnutls-dev:mips64el \
-                      libdevmapper-dev:mips64el \
-                      libfuse-dev:mips64el \
-                      libglib2.0-dev:mips64el \
-                      libglusterfs-dev:mips64el \
-                      libgnutls28-dev:mips64el \
-                      libiscsi-dev:mips64el \
-                      libjson-c-dev:mips64el \
-                      libnl-3-dev:mips64el \
-                      libnl-route-3-dev:mips64el \
-                      libnuma-dev:mips64el \
-                      libparted-dev:mips64el \
-                      libpcap0.8-dev:mips64el \
-                      libpciaccess-dev:mips64el \
-                      librbd-dev:mips64el \
-                      libreadline-dev:mips64el \
-                      libsanlock-dev:mips64el \
-                      libsasl2-dev:mips64el \
-                      libselinux1-dev:mips64el \
-                      libssh-gcrypt-dev:mips64el \
-                      libssh2-1-dev:mips64el \
-                      libtirpc-dev:mips64el \
-                      libudev-dev:mips64el \
-                      libxml2-dev:mips64el \
-                      systemtap-sdt-dev:mips64el && \
-    eatmydata apt-get autoremove -y && \
-    eatmydata apt-get autoclean -y && \
-    mkdir -p /usr/local/share/meson/cross && \
-    printf "[binaries]\n\
-c = '/usr/bin/mips64el-linux-gnuabi64-gcc'\n\
-ar = '/usr/bin/mips64el-linux-gnuabi64-gcc-ar'\n\
-strip = '/usr/bin/mips64el-linux-gnuabi64-strip'\n\
-pkgconfig = '/usr/bin/mips64el-linux-gnuabi64-pkg-config'\n\
-\n\
-[host_machine]\n\
-system = 'linux'\n\
-cpu_family = 'mips64'\n\
-cpu = 'mips64el'\n\
-endian = 'little'\n" > /usr/local/share/meson/cross/mips64el-linux-gnuabi64 && \
-    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
-    mkdir -p /usr/libexec/ccache-wrappers && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/mips64el-linux-gnuabi64-cc && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/mips64el-linux-gnuabi64-gcc
-
-ENV ABI "mips64el-linux-gnuabi64"
-ENV MESON_OPTS "--cross-file=mips64el-linux-gnuabi64"

ci/containers/debian-11-cross-mipsel.Dockerfile

@@ -1,122 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool manifest ci/manifest.yml
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-FROM docker.io/library/debian:11-slim
-
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    apt-get update && \
-    apt-get install -y eatmydata && \
-    eatmydata apt-get dist-upgrade -y && \
-    eatmydata apt-get install --no-install-recommends -y \
-                      augeas-lenses \
-                      augeas-tools \
-                      bash-completion \
-                      black \
-                      ca-certificates \
-                      ccache \
-                      codespell \
-                      cpp \
-                      diffutils \
-                      dwarves \
-                      ebtables \
-                      flake8 \
-                      gettext \
-                      git \
-                      grep \
-                      iproute2 \
-                      iptables \
-                      kmod \
-                      libclang-dev \
-                      libxml2-utils \
-                      locales \
-                      lvm2 \
-                      make \
-                      meson \
-                      nfs-common \
-                      ninja-build \
-                      numad \
-                      open-iscsi \
-                      perl-base \
-                      pkgconf \
-                      policykit-1 \
-                      python3 \
-                      python3-docutils \
-                      python3-pytest \
-                      qemu-utils \
-                      sed \
-                      xsltproc && \
-    eatmydata apt-get autoremove -y && \
-    eatmydata apt-get autoclean -y && \
-    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
-    dpkg-reconfigure locales && \
-    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
-
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
-
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    dpkg --add-architecture mipsel && \
-    eatmydata apt-get update && \
-    eatmydata apt-get dist-upgrade -y && \
-    eatmydata apt-get install --no-install-recommends -y dpkg-dev && \
-    eatmydata apt-get install --no-install-recommends -y \
-                      gcc-mipsel-linux-gnu \
-                      libacl1-dev:mipsel \
-                      libapparmor-dev:mipsel \
-                      libattr1-dev:mipsel \
-                      libaudit-dev:mipsel \
-                      libblkid-dev:mipsel \
-                      libc6-dev:mipsel \
-                      libcap-ng-dev:mipsel \
-                      libcurl4-gnutls-dev:mipsel \
-                      libdevmapper-dev:mipsel \
-                      libfuse-dev:mipsel \
-                      libglib2.0-dev:mipsel \
-                      libglusterfs-dev:mipsel \
-                      libgnutls28-dev:mipsel \
-                      libiscsi-dev:mipsel \
-                      libjson-c-dev:mipsel \
-                      libnl-3-dev:mipsel \
-                      libnl-route-3-dev:mipsel \
-                      libnuma-dev:mipsel \
-                      libparted-dev:mipsel \
-                      libpcap0.8-dev:mipsel \
-                      libpciaccess-dev:mipsel \
-                      librbd-dev:mipsel \
-                      libreadline-dev:mipsel \
-                      libsanlock-dev:mipsel \
-                      libsasl2-dev:mipsel \
-                      libselinux1-dev:mipsel \
-                      libssh-gcrypt-dev:mipsel \
-                      libssh2-1-dev:mipsel \
-                      libtirpc-dev:mipsel \
-                      libudev-dev:mipsel \
-                      libxml2-dev:mipsel \
-                      systemtap-sdt-dev:mipsel && \
-    eatmydata apt-get autoremove -y && \
-    eatmydata apt-get autoclean -y && \
-    mkdir -p /usr/local/share/meson/cross && \
-    printf "[binaries]\n\
-c = '/usr/bin/mipsel-linux-gnu-gcc'\n\
-ar = '/usr/bin/mipsel-linux-gnu-gcc-ar'\n\
-strip = '/usr/bin/mipsel-linux-gnu-strip'\n\
-pkgconfig = '/usr/bin/mipsel-linux-gnu-pkg-config'\n\
-\n\
-[host_machine]\n\
-system = 'linux'\n\
-cpu_family = 'mips'\n\
-cpu = 'mipsel'\n\
-endian = 'little'\n" > /usr/local/share/meson/cross/mipsel-linux-gnu && \
-    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
-    mkdir -p /usr/libexec/ccache-wrappers && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/mipsel-linux-gnu-cc && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/mipsel-linux-gnu-gcc
-
-ENV ABI "mipsel-linux-gnu"
-ENV MESON_OPTS "--cross-file=mipsel-linux-gnu"

ci/containers/debian-11-cross-ppc64le.Dockerfile

@@ -1,122 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool manifest ci/manifest.yml
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-FROM docker.io/library/debian:11-slim
-
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    apt-get update && \
-    apt-get install -y eatmydata && \
-    eatmydata apt-get dist-upgrade -y && \
-    eatmydata apt-get install --no-install-recommends -y \
-                      augeas-lenses \
-                      augeas-tools \
-                      bash-completion \
-                      black \
-                      ca-certificates \
-                      ccache \
-                      codespell \
-                      cpp \
-                      diffutils \
-                      dwarves \
-                      ebtables \
-                      flake8 \
-                      gettext \
-                      git \
-                      grep \
-                      iproute2 \
-                      iptables \
-                      kmod \
-                      libclang-dev \
-                      libxml2-utils \
-                      locales \
-                      lvm2 \
-                      make \
-                      meson \
-                      nfs-common \
-                      ninja-build \
-                      numad \
-                      open-iscsi \
-                      perl-base \
-                      pkgconf \
-                      policykit-1 \
-                      python3 \
-                      python3-docutils \
-                      python3-pytest \
-                      qemu-utils \
-                      sed \
-                      xsltproc && \
-    eatmydata apt-get autoremove -y && \
-    eatmydata apt-get autoclean -y && \
-    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
-    dpkg-reconfigure locales && \
-    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
-
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
-
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    dpkg --add-architecture ppc64el && \
-    eatmydata apt-get update && \
-    eatmydata apt-get dist-upgrade -y && \
-    eatmydata apt-get install --no-install-recommends -y dpkg-dev && \
-    eatmydata apt-get install --no-install-recommends -y \
-                      gcc-powerpc64le-linux-gnu \
-                      libacl1-dev:ppc64el \
-                      libapparmor-dev:ppc64el \
-                      libattr1-dev:ppc64el \
-                      libaudit-dev:ppc64el \
-                      libblkid-dev:ppc64el \
-                      libc6-dev:ppc64el \
-                      libcap-ng-dev:ppc64el \
-                      libcurl4-gnutls-dev:ppc64el \
-                      libdevmapper-dev:ppc64el \
-                      libfuse-dev:ppc64el \
-                      libglib2.0-dev:ppc64el \
-                      libglusterfs-dev:ppc64el \
-                      libgnutls28-dev:ppc64el \
-                      libiscsi-dev:ppc64el \
-                      libjson-c-dev:ppc64el \
-                      libnl-3-dev:ppc64el \
-                      libnl-route-3-dev:ppc64el \
-                      libnuma-dev:ppc64el \
-                      libparted-dev:ppc64el \
-                      libpcap0.8-dev:ppc64el \
-                      libpciaccess-dev:ppc64el \
-                      librbd-dev:ppc64el \
-                      libreadline-dev:ppc64el \
-                      libsanlock-dev:ppc64el \
-                      libsasl2-dev:ppc64el \
-                      libselinux1-dev:ppc64el \
-                      libssh-gcrypt-dev:ppc64el \
-                      libssh2-1-dev:ppc64el \
-                      libtirpc-dev:ppc64el \
-                      libudev-dev:ppc64el \
-                      libxml2-dev:ppc64el \
-                      systemtap-sdt-dev:ppc64el && \
-    eatmydata apt-get autoremove -y && \
-    eatmydata apt-get autoclean -y && \
-    mkdir -p /usr/local/share/meson/cross && \
-    printf "[binaries]\n\
-c = '/usr/bin/powerpc64le-linux-gnu-gcc'\n\
-ar = '/usr/bin/powerpc64le-linux-gnu-gcc-ar'\n\
-strip = '/usr/bin/powerpc64le-linux-gnu-strip'\n\
-pkgconfig = '/usr/bin/powerpc64le-linux-gnu-pkg-config'\n\
-\n\
-[host_machine]\n\
-system = 'linux'\n\
-cpu_family = 'ppc64'\n\
-cpu = 'powerpc64le'\n\
-endian = 'little'\n" > /usr/local/share/meson/cross/powerpc64le-linux-gnu && \
-    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
-    mkdir -p /usr/libexec/ccache-wrappers && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/powerpc64le-linux-gnu-cc && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/powerpc64le-linux-gnu-gcc
-
-ENV ABI "powerpc64le-linux-gnu"
-ENV MESON_OPTS "--cross-file=powerpc64le-linux-gnu"

ci/containers/debian-11-cross-s390x.Dockerfile

@@ -1,122 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool manifest ci/manifest.yml
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-FROM docker.io/library/debian:11-slim
-
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    apt-get update && \
-    apt-get install -y eatmydata && \
-    eatmydata apt-get dist-upgrade -y && \
-    eatmydata apt-get install --no-install-recommends -y \
-                      augeas-lenses \
-                      augeas-tools \
-                      bash-completion \
-                      black \
-                      ca-certificates \
-                      ccache \
-                      codespell \
-                      cpp \
-                      diffutils \
-                      dwarves \
-                      ebtables \
-                      flake8 \
-                      gettext \
-                      git \
-                      grep \
-                      iproute2 \
-                      iptables \
-                      kmod \
-                      libclang-dev \
-                      libxml2-utils \
-                      locales \
-                      lvm2 \
-                      make \
-                      meson \
-                      nfs-common \
-                      ninja-build \
-                      numad \
-                      open-iscsi \
-                      perl-base \
-                      pkgconf \
-                      policykit-1 \
-                      python3 \
-                      python3-docutils \
-                      python3-pytest \
-                      qemu-utils \
-                      sed \
-                      xsltproc && \
-    eatmydata apt-get autoremove -y && \
-    eatmydata apt-get autoclean -y && \
-    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
-    dpkg-reconfigure locales && \
-    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
-
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
-
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    dpkg --add-architecture s390x && \
-    eatmydata apt-get update && \
-    eatmydata apt-get dist-upgrade -y && \
-    eatmydata apt-get install --no-install-recommends -y dpkg-dev && \
-    eatmydata apt-get install --no-install-recommends -y \
-                      gcc-s390x-linux-gnu \
-                      libacl1-dev:s390x \
-                      libapparmor-dev:s390x \
-                      libattr1-dev:s390x \
-                      libaudit-dev:s390x \
-                      libblkid-dev:s390x \
-                      libc6-dev:s390x \
-                      libcap-ng-dev:s390x \
-                      libcurl4-gnutls-dev:s390x \
-                      libdevmapper-dev:s390x \
-                      libfuse-dev:s390x \
-                      libglib2.0-dev:s390x \
-                      libglusterfs-dev:s390x \
-                      libgnutls28-dev:s390x \
-                      libiscsi-dev:s390x \
-                      libjson-c-dev:s390x \
-                      libnl-3-dev:s390x \
-                      libnl-route-3-dev:s390x \
-                      libnuma-dev:s390x \
-                      libparted-dev:s390x \
-                      libpcap0.8-dev:s390x \
-                      libpciaccess-dev:s390x \
-                      librbd-dev:s390x \
-                      libreadline-dev:s390x \
-                      libsanlock-dev:s390x \
-                      libsasl2-dev:s390x \
-                      libselinux1-dev:s390x \
-                      libssh-gcrypt-dev:s390x \
-                      libssh2-1-dev:s390x \
-                      libtirpc-dev:s390x \
-                      libudev-dev:s390x \
-                      libxml2-dev:s390x \
-                      systemtap-sdt-dev:s390x && \
-    eatmydata apt-get autoremove -y && \
-    eatmydata apt-get autoclean -y && \
-    mkdir -p /usr/local/share/meson/cross && \
-    printf "[binaries]\n\
-c = '/usr/bin/s390x-linux-gnu-gcc'\n\
-ar = '/usr/bin/s390x-linux-gnu-gcc-ar'\n\
-strip = '/usr/bin/s390x-linux-gnu-strip'\n\
-pkgconfig = '/usr/bin/s390x-linux-gnu-pkg-config'\n\
-\n\
-[host_machine]\n\
-system = 'linux'\n\
-cpu_family = 's390x'\n\
-cpu = 's390x'\n\
-endian = 'big'\n" > /usr/local/share/meson/cross/s390x-linux-gnu && \
-    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
-    mkdir -p /usr/libexec/ccache-wrappers && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/s390x-linux-gnu-cc && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/s390x-linux-gnu-gcc
-
-ENV ABI "s390x-linux-gnu"
-ENV MESON_OPTS "--cross-file=s390x-linux-gnu"

ci/containers/debian-11.Dockerfile

@@ -1,103 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool manifest ci/manifest.yml
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-FROM docker.io/library/debian:11-slim
-
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    apt-get update && \
-    apt-get install -y eatmydata && \
-    eatmydata apt-get dist-upgrade -y && \
-    eatmydata apt-get install --no-install-recommends -y \
-                      augeas-lenses \
-                      augeas-tools \
-                      bash-completion \
-                      black \
-                      ca-certificates \
-                      ccache \
-                      clang \
-                      codespell \
-                      cpp \
-                      diffutils \
-                      dwarves \
-                      ebtables \
-                      flake8 \
-                      gcc \
-                      gettext \
-                      git \
-                      grep \
-                      iproute2 \
-                      iptables \
-                      kmod \
-                      libacl1-dev \
-                      libapparmor-dev \
-                      libattr1-dev \
-                      libaudit-dev \
-                      libblkid-dev \
-                      libc6-dev \
-                      libcap-ng-dev \
-                      libclang-dev \
-                      libcurl4-gnutls-dev \
-                      libdevmapper-dev \
-                      libfuse-dev \
-                      libglib2.0-dev \
-                      libglusterfs-dev \
-                      libgnutls28-dev \
-                      libiscsi-dev \
-                      libjson-c-dev \
-                      libnetcf-dev \
-                      libnl-3-dev \
-                      libnl-route-3-dev \
-                      libnuma-dev \
-                      libparted-dev \
-                      libpcap0.8-dev \
-                      libpciaccess-dev \
-                      librbd-dev \
-                      libreadline-dev \
-                      libsanlock-dev \
-                      libsasl2-dev \
-                      libselinux1-dev \
-                      libssh-gcrypt-dev \
-                      libssh2-1-dev \
-                      libtirpc-dev \
-                      libudev-dev \
-                      libxen-dev \
-                      libxml2-dev \
-                      libxml2-utils \
-                      locales \
-                      lvm2 \
-                      make \
-                      meson \
-                      nfs-common \
-                      ninja-build \
-                      numad \
-                      open-iscsi \
-                      perl-base \
-                      pkgconf \
-                      policykit-1 \
-                      python3 \
-                      python3-docutils \
-                      python3-pytest \
-                      qemu-utils \
-                      sed \
-                      systemtap-sdt-dev \
-                      wireshark-dev \
-                      xsltproc && \
-    eatmydata apt-get autoremove -y && \
-    eatmydata apt-get autoclean -y && \
-    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
-    dpkg-reconfigure locales && \
-    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED && \
-    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
-    mkdir -p /usr/libexec/ccache-wrappers && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang && \
-    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
-
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"

ci/containers/debian-12-cross-aarch64.Dockerfile

@@ -94,7 +94,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libsanlock-dev:arm64 \
                       libsasl2-dev:arm64 \
                       libselinux1-dev:arm64 \
-                      libssh-gcrypt-dev:arm64 \
+                      libssh-dev:arm64 \
                       libssh2-1-dev:arm64 \
                       libtirpc-dev:arm64 \
                       libudev-dev:arm64 \

ci/containers/debian-12-cross-armv6l.Dockerfile

@@ -94,7 +94,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libsanlock-dev:armel \
                       libsasl2-dev:armel \
                       libselinux1-dev:armel \
-                      libssh-gcrypt-dev:armel \
+                      libssh-dev:armel \
                       libssh2-1-dev:armel \
                       libtirpc-dev:armel \
                       libudev-dev:armel \

ci/containers/debian-12-cross-armv7l.Dockerfile

@@ -94,7 +94,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libsanlock-dev:armhf \
                       libsasl2-dev:armhf \
                       libselinux1-dev:armhf \
-                      libssh-gcrypt-dev:armhf \
+                      libssh-dev:armhf \
                       libssh2-1-dev:armhf \
                       libtirpc-dev:armhf \
                       libudev-dev:armhf \

ci/containers/debian-12-cross-i686.Dockerfile

@@ -94,7 +94,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libsanlock-dev:i386 \
                       libsasl2-dev:i386 \
                       libselinux1-dev:i386 \
-                      libssh-gcrypt-dev:i386 \
+                      libssh-dev:i386 \
                       libssh2-1-dev:i386 \
                       libtirpc-dev:i386 \
                       libudev-dev:i386 \

ci/containers/debian-12-cross-mips64el.Dockerfile

@@ -94,7 +94,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libsanlock-dev:mips64el \
                       libsasl2-dev:mips64el \
                       libselinux1-dev:mips64el \
-                      libssh-gcrypt-dev:mips64el \
+                      libssh-dev:mips64el \
                       libssh2-1-dev:mips64el \
                       libtirpc-dev:mips64el \
                       libudev-dev:mips64el \

ci/containers/debian-12-cross-mipsel.Dockerfile

@@ -94,7 +94,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libsanlock-dev:mipsel \
                       libsasl2-dev:mipsel \
                       libselinux1-dev:mipsel \
-                      libssh-gcrypt-dev:mipsel \
+                      libssh-dev:mipsel \
                       libssh2-1-dev:mipsel \
                       libtirpc-dev:mipsel \
                       libudev-dev:mipsel \

ci/containers/debian-12-cross-ppc64le.Dockerfile

@@ -94,7 +94,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libsanlock-dev:ppc64el \
                       libsasl2-dev:ppc64el \
                       libselinux1-dev:ppc64el \
-                      libssh-gcrypt-dev:ppc64el \
+                      libssh-dev:ppc64el \
                       libssh2-1-dev:ppc64el \
                       libtirpc-dev:ppc64el \
                       libudev-dev:ppc64el \

ci/containers/debian-12-cross-s390x.Dockerfile

@@ -94,7 +94,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libsanlock-dev:s390x \
                       libsasl2-dev:s390x \
                       libselinux1-dev:s390x \
-                      libssh-gcrypt-dev:s390x \
+                      libssh-dev:s390x \
                       libssh2-1-dev:s390x \
                       libtirpc-dev:s390x \
                       libudev-dev:s390x \

ci/containers/debian-12.Dockerfile

@@ -59,7 +59,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libsanlock-dev \
                       libsasl2-dev \
                       libselinux1-dev \
-                      libssh-gcrypt-dev \
+                      libssh-dev \
                       libssh2-1-dev \
                       libtirpc-dev \
                       libudev-dev \

ci/containers/debian-sid-cross-aarch64.Dockerfile

@@ -94,7 +94,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libsanlock-dev:arm64 \
                       libsasl2-dev:arm64 \
                       libselinux1-dev:arm64 \
-                      libssh-gcrypt-dev:arm64 \
+                      libssh-dev:arm64 \
                       libssh2-1-dev:arm64 \
                       libtirpc-dev:arm64 \
                       libudev-dev:arm64 \

ci/containers/debian-sid-cross-armv6l.Dockerfile

@@ -93,7 +93,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libsanlock-dev:armel \
                       libsasl2-dev:armel \
                       libselinux1-dev:armel \
-                      libssh-gcrypt-dev:armel \
+                      libssh-dev:armel \
                       libssh2-1-dev:armel \
                       libtirpc-dev:armel \
                       libudev-dev:armel \

ci/containers/debian-sid-cross-armv7l.Dockerfile

@@ -93,7 +93,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libsanlock-dev:armhf \
                       libsasl2-dev:armhf \
                       libselinux1-dev:armhf \
-                      libssh-gcrypt-dev:armhf \
+                      libssh-dev:armhf \
                       libssh2-1-dev:armhf \
                       libtirpc-dev:armhf \
                       libudev-dev:armhf \

ci/containers/debian-sid-cross-i686.Dockerfile

@@ -93,7 +93,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libsanlock-dev:i386 \
                       libsasl2-dev:i386 \
                       libselinux1-dev:i386 \
-                      libssh-gcrypt-dev:i386 \
+                      libssh-dev:i386 \
                       libssh2-1-dev:i386 \
                       libtirpc-dev:i386 \
                       libudev-dev:i386 \

ci/containers/debian-sid-cross-mips64el.Dockerfile

@@ -94,7 +94,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libsanlock-dev:mips64el \
                       libsasl2-dev:mips64el \
                       libselinux1-dev:mips64el \
-                      libssh-gcrypt-dev:mips64el \
+                      libssh-dev:mips64el \
                       libssh2-1-dev:mips64el \
                       libtirpc-dev:mips64el \
                       libudev-dev:mips64el \

ci/containers/debian-sid-cross-ppc64le.Dockerfile

@@ -94,7 +94,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libsanlock-dev:ppc64el \
                       libsasl2-dev:ppc64el \
                       libselinux1-dev:ppc64el \
-                      libssh-gcrypt-dev:ppc64el \
+                      libssh-dev:ppc64el \
                       libssh2-1-dev:ppc64el \
                       libtirpc-dev:ppc64el \
                       libudev-dev:ppc64el \

ci/containers/debian-sid-cross-s390x.Dockerfile

@@ -94,7 +94,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libsanlock-dev:s390x \
                       libsasl2-dev:s390x \
                       libselinux1-dev:s390x \
-                      libssh-gcrypt-dev:s390x \
+                      libssh-dev:s390x \
                       libssh2-1-dev:s390x \
                       libtirpc-dev:s390x \
                       libudev-dev:s390x \

ci/containers/debian-sid.Dockerfile

@@ -59,7 +59,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libsanlock-dev \
                       libsasl2-dev \
                       libselinux1-dev \
-                      libssh-gcrypt-dev \
+                      libssh-dev \
                       libssh2-1-dev \
                       libtirpc-dev \
                       libudev-dev \

ci/containers/fedora-41-cross-mingw32.Dockerfile

@@ -4,7 +4,7 @@
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM registry.fedoraproject.org/fedora:40
+FROM registry.fedoraproject.org/fedora:41
 
 RUN dnf install -y nosync && \
     printf '#!/bin/sh\n\
@@ -19,7 +19,7 @@ exec "$@"\n' > /usr/bin/nosync && \
     nosync dnf update -y && \
     nosync dnf install -y \
                augeas \
-               bash-completion \
+               bash-completion-devel \
                ca-certificates \
                ccache \
                codespell \

ci/containers/fedora-41-cross-mingw64.Dockerfile

@@ -4,7 +4,7 @@
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM registry.fedoraproject.org/fedora:40
+FROM registry.fedoraproject.org/fedora:41
 
 RUN dnf install -y nosync && \
     printf '#!/bin/sh\n\
@@ -19,7 +19,7 @@ exec "$@"\n' > /usr/bin/nosync && \
     nosync dnf update -y && \
     nosync dnf install -y \
                augeas \
-               bash-completion \
+               bash-completion-devel \
                ca-certificates \
                ccache \
                codespell \

ci/containers/fedora-41.Dockerfile

@@ -4,7 +4,7 @@
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM registry.fedoraproject.org/fedora:39
+FROM registry.fedoraproject.org/fedora:41
 
 RUN dnf install -y nosync && \
     printf '#!/bin/sh\n\
@@ -20,7 +20,7 @@ exec "$@"\n' > /usr/bin/nosync && \
     nosync dnf install -y \
                audit-libs-devel \
                augeas \
-               bash-completion \
+               bash-completion-devel \
                ca-certificates \
                ccache \
                clang \
@@ -93,6 +93,7 @@ exec "$@"\n' > /usr/bin/nosync && \
                systemd-devel \
                systemd-rpm-macros \
                systemtap-sdt-devel \
+               systemtap-sdt-dtrace \
                wireshark-devel \
                xen-devel && \
     nosync dnf autoremove -y && \

ci/gitlab.yml

@@ -11,8 +11,11 @@
 #  - RUN_PIPELINE - force creation of a CI pipeline when
 #    pushing to a branch in a forked repository. Official
 #    CI pipelines are triggered when merge requests are
-#    created/updated. Setting this variable to a non-empty
-#    value allows CI testing prior to opening a merge request.
+#    created/updated. Setting this variable allows CI
+#    testing prior to opening a merge request. A value
+#    of "0" will create the pipeline but leave all jobs
+#    to be manually started, while "1" will immediately
+#    run all default jobs.
 #
 #  - RUN_PIPELINE_UPSTREAM_ENV - same semantics as RUN_PIPELINE,
 #    but uses the CI environment (containers) from the upstream project
@@ -38,11 +41,13 @@
 #
 # Aliases can be set for common usage
 #
-#  $ git config --local alias.push-ci "push -o ci.variable=RUN_PIPELINE=1"
+#  $ git config --local alias.push-ci "push -o ci.variable=RUN_PIPELINE=0"
+#  $ git config --local alias.push-ci-now "push -o ci.variable=RUN_PIPELINE=1"
 #
 # Allowing the less verbose invocation
 #
-#  $ git push-ci
+#  $ git push-ci     (create pipeline but don't start jobs)
+#  $ git push-ci-now (create pipeline and start default jobs)
 #
 # Pipeline variables can also be set in the repository
 # pipeline config globally, or set against scheduled pipelines
@@ -50,6 +55,7 @@
 
 variables:
   RUN_UPSTREAM_NAMESPACE: libvirt
+  CONTAINER_UPSTREAM_NAMESPACE: libvirt
   FF_SCRIPT_SECTIONS: 1
 
 

ci/gitlab/build-templates.yml

@@ -35,7 +35,7 @@
       fi
     - cat /packages.txt
   variables:
-    IMAGE: $CI_REGISTRY/$RUN_UPSTREAM_NAMESPACE/libvirt/ci-$NAME:latest
+    IMAGE: $CI_REGISTRY/$CONTAINER_UPSTREAM_NAMESPACE/libvirt/ci-$NAME:latest
   rules:
     ### PUSH events
 
@@ -47,19 +47,27 @@
       when: on_success
 
     # forks: pushes to a branch when a pipeline run in upstream env is explicitly requested
-    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE_UPSTREAM_ENV && $JOB_OPTIONAL'
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE_UPSTREAM_ENV == "0"'
       when: manual
       allow_failure: true
-    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE_UPSTREAM_ENV'
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE_UPSTREAM_ENV == "1" && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE_UPSTREAM_ENV == "1"'
       when: on_success
 
     # forks: pushes to branches with pipeline requested
-    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE && $JOB_OPTIONAL'
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE == "0"'
       when: manual
       allow_failure: true
       variables:
         IMAGE: $TARGET_BASE_IMAGE
-    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE'
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE == "1" && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+      variables:
+        IMAGE: $TARGET_BASE_IMAGE
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE == "1"'
       when: on_success
       variables:
         IMAGE: $TARGET_BASE_IMAGE
@@ -171,7 +179,7 @@
       fi
     - cat /packages.txt
   variables:
-    IMAGE: $CI_REGISTRY/$RUN_UPSTREAM_NAMESPACE/libvirt/ci-$NAME-cross-$CROSS:latest
+    IMAGE: $CI_REGISTRY/$CONTAINER_UPSTREAM_NAMESPACE/libvirt/ci-$NAME-cross-$CROSS:latest
   rules:
     ### PUSH events
 
@@ -183,19 +191,27 @@
       when: on_success
 
     # forks: pushes to a branch when a pipeline run in upstream env is explicitly requested
-    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE_UPSTREAM_ENV && $JOB_OPTIONAL'
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE_UPSTREAM_ENV == "0"'
       when: manual
       allow_failure: true
-    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE_UPSTREAM_ENV'
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE_UPSTREAM_ENV == "1" && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE_UPSTREAM_ENV == "1"'
       when: on_success
 
     # forks: pushes to branches with pipeline requested
-    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE && $JOB_OPTIONAL'
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE == "0"'
       when: manual
       allow_failure: true
       variables:
         IMAGE: $TARGET_BASE_IMAGE
-    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE'
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE == "1" && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+      variables:
+        IMAGE: $TARGET_BASE_IMAGE
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE == "1"'
       when: on_success
       variables:
         IMAGE: $TARGET_BASE_IMAGE
@@ -302,15 +318,21 @@
       when: on_success
 
     # forks: pushes to branches with pipeline requested (including pipeline in upstream environment)
-    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE && $JOB_OPTIONAL'
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE == "0"'
       when: manual
       allow_failure: true
-    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE'
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE == "1" && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE == "1"'
       when: on_success
-    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE_UPSTREAM_ENV && $JOB_OPTIONAL'
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE_UPSTREAM_ENV == "0"'
       when: manual
       allow_failure: true
-    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE_UPSTREAM_ENV'
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE_UPSTREAM_ENV == "1" && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE_UPSTREAM_ENV == "1"'
       when: on_success
 
     # upstream+forks: Run pipelines on MR, web, api & scheduled

ci/gitlab/builds.yml

@@ -33,15 +33,15 @@ x86_64-almalinux-9-clang:
     TARGET_BASE_IMAGE: docker.io/library/almalinux:9
 
 
-x86_64-alpine-319:
+x86_64-alpine-321:
   extends: .native_build_job
   needs:
-    - job: x86_64-alpine-319-container
+    - job: x86_64-alpine-321-container
       optional: true
   allow_failure: false
   variables:
-    NAME: alpine-319
-    TARGET_BASE_IMAGE: docker.io/library/alpine:3.19
+    NAME: alpine-321
+    TARGET_BASE_IMAGE: docker.io/library/alpine:3.21
 
 
 x86_64-alpine-edge:
@@ -70,30 +70,6 @@ x86_64-centos-stream-9:
       - libvirt-rpms
 
 
-x86_64-debian-11:
-  extends: .native_build_job
-  needs:
-    - job: x86_64-debian-11-container
-      optional: true
-  allow_failure: false
-  variables:
-    JOB_OPTIONAL: 1
-    NAME: debian-11
-    TARGET_BASE_IMAGE: docker.io/library/debian:11-slim
-
-
-x86_64-debian-11-clang:
-  extends: .native_build_job
-  needs:
-    - job: x86_64-debian-11-container
-      optional: true
-  allow_failure: false
-  variables:
-    JOB_OPTIONAL: 1
-    NAME: debian-11
-    TARGET_BASE_IMAGE: docker.io/library/debian:11-slim
-
-
 x86_64-debian-12:
   extends: .native_build_job
   needs:
@@ -127,21 +103,6 @@ x86_64-debian-sid:
     TARGET_BASE_IMAGE: docker.io/library/debian:sid-slim
 
 
-x86_64-fedora-39:
-  extends: .native_build_job
-  needs:
-    - job: x86_64-fedora-39-container
-      optional: true
-  allow_failure: false
-  variables:
-    NAME: fedora-39
-    TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:39
-  artifacts:
-    expire_in: 1 day
-    paths:
-      - libvirt-rpms
-
-
 x86_64-fedora-40:
   extends: .native_build_job
   needs:
@@ -157,6 +118,21 @@ x86_64-fedora-40:
       - libvirt-rpms
 
 
+x86_64-fedora-41:
+  extends: .native_build_job
+  needs:
+    - job: x86_64-fedora-41-container
+      optional: true
+  allow_failure: false
+  variables:
+    NAME: fedora-41
+    TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:41
+  artifacts:
+    expire_in: 1 day
+    paths:
+      - libvirt-rpms
+
+
 x86_64-fedora-rawhide:
   extends: .native_build_job
   needs:
@@ -246,110 +222,6 @@ x86_64-ubuntu-2404-clang:
 
 # Cross build jobs
 
-aarch64-debian-11:
-  extends: .cross_build_job
-  needs:
-    - job: aarch64-debian-11-container
-      optional: true
-  allow_failure: false
-  variables:
-    CROSS: aarch64
-    JOB_OPTIONAL: 1
-    NAME: debian-11
-    TARGET_BASE_IMAGE: docker.io/library/debian:11-slim
-
-
-armv6l-debian-11:
-  extends: .cross_build_job
-  needs:
-    - job: armv6l-debian-11-container
-      optional: true
-  allow_failure: false
-  variables:
-    CROSS: armv6l
-    JOB_OPTIONAL: 1
-    NAME: debian-11
-    TARGET_BASE_IMAGE: docker.io/library/debian:11-slim
-
-
-armv7l-debian-11:
-  extends: .cross_build_job
-  needs:
-    - job: armv7l-debian-11-container
-      optional: true
-  allow_failure: false
-  variables:
-    CROSS: armv7l
-    JOB_OPTIONAL: 1
-    NAME: debian-11
-    TARGET_BASE_IMAGE: docker.io/library/debian:11-slim
-
-
-i686-debian-11:
-  extends: .cross_build_job
-  needs:
-    - job: i686-debian-11-container
-      optional: true
-  allow_failure: false
-  variables:
-    CROSS: i686
-    JOB_OPTIONAL: 1
-    NAME: debian-11
-    TARGET_BASE_IMAGE: docker.io/library/debian:11-slim
-
-
-mips64el-debian-11:
-  extends: .cross_build_job
-  needs:
-    - job: mips64el-debian-11-container
-      optional: true
-  allow_failure: false
-  variables:
-    CROSS: mips64el
-    JOB_OPTIONAL: 1
-    NAME: debian-11
-    TARGET_BASE_IMAGE: docker.io/library/debian:11-slim
-
-
-mipsel-debian-11:
-  extends: .cross_build_job
-  needs:
-    - job: mipsel-debian-11-container
-      optional: true
-  allow_failure: false
-  variables:
-    CROSS: mipsel
-    JOB_OPTIONAL: 1
-    NAME: debian-11
-    TARGET_BASE_IMAGE: docker.io/library/debian:11-slim
-
-
-ppc64le-debian-11:
-  extends: .cross_build_job
-  needs:
-    - job: ppc64le-debian-11-container
-      optional: true
-  allow_failure: false
-  variables:
-    CROSS: ppc64le
-    JOB_OPTIONAL: 1
-    NAME: debian-11
-    TARGET_BASE_IMAGE: docker.io/library/debian:11-slim
-
-
-s390x-debian-11:
-  extends: .cross_build_job
-  needs:
-    - job: s390x-debian-11-container
-      optional: true
-  allow_failure: false
-  variables:
-    CROSS: s390x
-    JOB_OPTIONAL: 1
-    NAME: debian-11
-    TARGET_BASE_IMAGE: docker.io/library/debian:11-slim
-
-
 aarch64-debian-12:
   extends: .cross_build_job
   needs:
@@ -544,29 +416,29 @@ s390x-debian-sid:
     TARGET_BASE_IMAGE: docker.io/library/debian:sid-slim
 
 
-mingw32-fedora-40:
+mingw32-fedora-41:
   extends: .cross_build_job
   needs:
-    - job: mingw32-fedora-40-container
+    - job: mingw32-fedora-41-container
       optional: true
   allow_failure: false
   variables:
     CROSS: mingw32
     JOB_OPTIONAL: 1
-    NAME: fedora-40
-    TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:40
+    NAME: fedora-41
+    TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:41
 
 
-mingw64-fedora-40:
+mingw64-fedora-41:
   extends: .cross_build_job
   needs:
-    - job: mingw64-fedora-40-container
+    - job: mingw64-fedora-41-container
       optional: true
   allow_failure: false
   variables:
     CROSS: mingw64
-    NAME: fedora-40
-    TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:40
+    NAME: fedora-41
+    TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:41
 
 
 mingw32-fedora-rawhide:
@@ -602,7 +474,7 @@ x86_64-freebsd-13:
   allow_failure:
     exit_codes: 3
   variables:
-    CIRRUS_VM_IMAGE_NAME: freebsd-13-3
+    CIRRUS_VM_IMAGE_NAME: freebsd-13-4
     CIRRUS_VM_IMAGE_SELECTOR: image_family
     CIRRUS_VM_INSTANCE_TYPE: freebsd_instance
     INSTALL_COMMAND: pkg install -y
@@ -617,7 +489,7 @@ x86_64-freebsd-14:
   allow_failure:
     exit_codes: 3
   variables:
-    CIRRUS_VM_IMAGE_NAME: freebsd-14-0
+    CIRRUS_VM_IMAGE_NAME: freebsd-14-2
     CIRRUS_VM_IMAGE_SELECTOR: image_family
     CIRRUS_VM_INSTANCE_TYPE: freebsd_instance
     INSTALL_COMMAND: pkg install -y

ci/gitlab/containers.yml

@@ -14,11 +14,11 @@ x86_64-almalinux-9-container:
     NAME: almalinux-9
 
 
-x86_64-alpine-319-container:
+x86_64-alpine-321-container:
   extends: .container_job
   allow_failure: false
   variables:
-    NAME: alpine-319
+    NAME: alpine-321
 
 
 x86_64-alpine-edge-container:
@@ -35,14 +35,6 @@ x86_64-centos-stream-9-container:
     NAME: centos-stream-9
 
 
-x86_64-debian-11-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    JOB_OPTIONAL: 1
-    NAME: debian-11
-
-
 x86_64-debian-12-container:
   extends: .container_job
   allow_failure: false
@@ -57,13 +49,6 @@ x86_64-debian-sid-container:
     NAME: debian-sid
 
 
-x86_64-fedora-39-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    NAME: fedora-39
-
-
 x86_64-fedora-40-container:
   extends: .container_job
   allow_failure: false
@@ -71,6 +56,13 @@ x86_64-fedora-40-container:
     NAME: fedora-40
 
 
+x86_64-fedora-41-container:
+  extends: .container_job
+  allow_failure: false
+  variables:
+    NAME: fedora-41
+
+
 x86_64-fedora-rawhide-container:
   extends: .container_job
   allow_failure: true
@@ -109,70 +101,6 @@ x86_64-ubuntu-2404-container:
 
 # Cross container jobs
 
-aarch64-debian-11-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    JOB_OPTIONAL: 1
-    NAME: debian-11-cross-aarch64
-
-
-armv6l-debian-11-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    JOB_OPTIONAL: 1
-    NAME: debian-11-cross-armv6l
-
-
-armv7l-debian-11-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    JOB_OPTIONAL: 1
-    NAME: debian-11-cross-armv7l
-
-
-i686-debian-11-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    JOB_OPTIONAL: 1
-    NAME: debian-11-cross-i686
-
-
-mips64el-debian-11-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    JOB_OPTIONAL: 1
-    NAME: debian-11-cross-mips64el
-
-
-mipsel-debian-11-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    JOB_OPTIONAL: 1
-    NAME: debian-11-cross-mipsel
-
-
-ppc64le-debian-11-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    JOB_OPTIONAL: 1
-    NAME: debian-11-cross-ppc64le
-
-
-s390x-debian-11-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    JOB_OPTIONAL: 1
-    NAME: debian-11-cross-s390x
-
-
 aarch64-debian-12-container:
   extends: .container_job
   allow_failure: false
@@ -292,19 +220,19 @@ s390x-debian-sid-container:
     NAME: debian-sid-cross-s390x
 
 
-mingw32-fedora-40-container:
+mingw32-fedora-41-container:
   extends: .container_job
   allow_failure: false
   variables:
     JOB_OPTIONAL: 1
-    NAME: fedora-40-cross-mingw32
+    NAME: fedora-41-cross-mingw32
 
 
-mingw64-fedora-40-container:
+mingw64-fedora-41-container:
   extends: .container_job
   allow_failure: false
   variables:
-    NAME: fedora-40-cross-mingw64
+    NAME: fedora-41-cross-mingw64
 
 
 mingw32-fedora-rawhide-container:

ci/gitlab/sanity-checks.yml

@@ -18,9 +18,13 @@ check-dco:
       when: on_success
 
     # forks: pushes to branches with pipeline requested (including upstream env pipelines)
-    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH && $RUN_PIPELINE'
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH && $RUN_PIPELINE == "0"'
+      when: manual
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH && $RUN_PIPELINE == "1"'
       when: on_success
-    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH && $RUN_PIPELINE_UPSTREAM_ENV'
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH && $RUN_PIPELINE_UPSTREAM_ENV == "0"'
+      when: manual
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH && $RUN_PIPELINE_UPSTREAM_ENV == "1"'
       when: on_success
 
     # upstream+forks: that's all folks

ci/integration.yml

@@ -29,23 +29,23 @@ centos-stream-9-tests:
 # and libvirt-python CI jobs, so the new target needs to be introduced
 # there before it can be used here. The VM template for the target
 # also needs to be created on the runner host.
-fedora-39-tests:
+fedora-41-tests:
   extends: .integration_tests
   variables:
     # needed by libvirt-gitlab-executor
-    DISTRO: fedora-39
+    DISTRO: fedora-41
     # can be overridden in forks to set a different runner tag
     LIBVIRT_CI_INTEGRATION_RUNNER_TAG: redhat-vm-host
   tags:
     - $LIBVIRT_CI_INTEGRATION_RUNNER_TAG
   needs:
-    - x86_64-fedora-39
+    - x86_64-fedora-41
     - project: libvirt/libvirt-perl
-      job: x86_64-fedora-39
+      job: x86_64-fedora-41
       ref: master
       artifacts: true
     - project: libvirt/libvirt-python
-      job: x86_64-fedora-39
+      job: x86_64-fedora-41
       ref: master
       artifacts: true
 
@@ -53,22 +53,22 @@ fedora-39-tests:
 # and libvirt-python CI jobs, so the new target needs to be introduced
 # there before it can be used here. The VM template for the target
 # also needs to be created on the runner host.
-.fedora-39-upstream-qemu-tests:
+.fedora-41-upstream-qemu-tests:
   extends: .integration_tests
   variables:
     # needed by libvirt-gitlab-executor
-    DISTRO: fedora-39
+    DISTRO: fedora-41
     # can be overridden in forks to set a different runner tag
     LIBVIRT_CI_INTEGRATION_RUNNER_TAG: redhat-vm-host
   tags:
     - $LIBVIRT_CI_INTEGRATION_RUNNER_TAG
   needs:
-    - x86_64-fedora-39
+    - x86_64-fedora-41
     - project: libvirt/libvirt-perl
-      job: x86_64-fedora-39
+      job: x86_64-fedora-41
       ref: master
       artifacts: true
     - project: libvirt/libvirt-python
-      job: x86_64-fedora-39
+      job: x86_64-fedora-41
       ref: master
       artifacts: true

ci/jobs.sh

@@ -124,6 +124,9 @@ run_integration() {
         DAEMONS="virtinterfaced virtlockd virtlogd virtnetworkd virtnodedevd virtnwfilterd virtproxyd virtqemud virtsecretd virtstoraged"
     fi
 
+    # Force libvirt to use iptables to make sure libvirt-tck tests don't fail
+    run_cmd_quiet sudo augtool set /files/etc/libvirt/network.conf/firewall_backend "'iptables'"
+
     echo "DAEMONS=$DAEMONS"
     for daemon in $DAEMONS
     do

ci/manifest.yml

@@ -19,7 +19,7 @@ targets:
           RPM: skip
           CC: clang
 
-  alpine-319: x86_64
+  alpine-321: x86_64
 
   alpine-edge:
     jobs:
@@ -34,46 +34,6 @@ targets:
           paths:
             - libvirt-rpms
 
-  debian-11:
-    jobs:
-      - arch: x86_64
-        builds: false
-
-      - arch: x86_64
-        suffix: -clang
-        builds: false
-
-      - arch: aarch64
-        containers: false
-        builds: false
-
-      - arch: armv6l
-        containers: false
-        builds: false
-
-      - arch: armv7l
-        builds: false
-
-      - arch: i686
-        containers: false
-        builds: false
-
-      - arch: mips64el
-        containers: false
-        builds: false
-
-      - arch: mipsel
-        containers: false
-        builds: false
-
-      - arch: ppc64le
-        containers: false
-        builds: false
-
-      - arch: s390x
-        containers: false
-        builds: false
-
   debian-12:
     jobs:
       - arch: x86_64
@@ -144,7 +104,7 @@ targets:
         containers: false
         builds: false
 
-  fedora-39:
+  fedora-40:
     jobs:
       - arch: x86_64
         artifacts:
@@ -152,7 +112,7 @@ targets:
           paths:
             - libvirt-rpms
 
-  fedora-40:
+  fedora-41:
     jobs:
       - arch: x86_64
         artifacts:

docs/api.rst

@@ -26,7 +26,7 @@ name will default to a preselected hypervisor, but it's probably not a
 wise thing to do in most cases. See the `connection URI <uri.html>`__
 page for a full descriptions of the values allowed.
 
-OnDevice the application obtains a
+Once the application obtains a
 `virConnectPtr <html/libvirt-libvirt-host.html#virConnectPtr>`__
 connection to the hypervisor it can then use it to manage the
 hypervisor's available domains and related virtualization resources,

docs/apps.rst

@@ -206,6 +206,11 @@ Libraries
    Allows using simple ruby objects to manipulate hypervisors, guests,
    storage, network etc. It is based on top of the `native ruby
    bindings <https://ruby.libvirt.org/>`__.
+`Perl Async bindings <https://github.com/ehuelsmann/perl-sys-async-virt#readme>`__
+   Perl `Sys::Async::Virt library <https://metacpan.org/pod/Sys::Async::Virt>`__
+   supporting the asynchronous paradigm introduced by `Future::AsyncAwait
+   <https://metacpan.org/pod/Future::AsyncAwait>`__ that tries to stay close to
+   the `Sys::Virt API <https://metacpan.org/pod/Sys::Virt>`__.
 
 LiveCD / Appliances
 -------------------

docs/formatdomain.rst

@@ -268,24 +268,34 @@ harddisk, cdrom, network) determining where to obtain/find the boot image.
    Some UEFI firmwares may want to use a non-volatile memory to store some
    variables. In the host, this is represented as a file and the absolute path
    to the file is stored in this element. Moreover, when the domain is started
-   up libvirt copies so called master NVRAM store file defined in ``qemu.conf``.
-   If needed, the ``template`` attribute can be used to per domain override map
-   of master NVRAM stores from the config file. Note, that for transient domains
-   if the NVRAM file has been created by libvirt it is left behind and it is
-   management application's responsibility to save and remove file (if needed to
-   be persistent). :since:`Since 1.2.8`
+   up libvirt copies so called master NVRAM store file either selected by the
+   firmware autoselection process or defined in ``qemu.conf``.
+   If needed, the ``template`` attribute can be used to override the
+   automatically chosen NVRAM template and ``templateFormat`` to specify the
+   format for the template file (currently supported are ``raw`` and ``qcow2``).
+   When firmware auto-selection is in use the ``templateFormat`` field reflects
+   the format of the picked template. :since:`Since 10.10.0 (QEMU only)`
+
+   Note, that for transient domains if the NVRAM file has been created by
+   libvirt it is left behind and it is management application's responsibility
+   to save and remove file (if needed to be persistent). :since:`Since 1.2.8`
 
    :since:`Since 8.5.0`,  it's possible for the element to have ``type`` attribute
    (accepts values ``file``, ``block`` and ``network``) in that case the NVRAM
    storage is described by a ``<source>`` sub-element with the same syntax as
-   ``disk``'s source. See `Hard drives, floppy disks, CDROMs`_.
+   ``disk``'s source. See `Hard drives, floppy disks, CDROMs`_. For ``block``
+   backed NVRAM images it may be necessary to ensure that the block device
+   has the correct guest visible size based on hypervisor expectations. This
+   may require use of non ``raw`` format image that allows arbitrary disk
+   size.
 
    **Note:** ``network`` backed NVRAM the variables are not instantiated from
    the ``template`` and it's user's responsibility to provide a valid NVRAM image.
 
-   This element supports a ``format`` attribute, which has the same semantics
-   as the attribute of the same name for the ``<loader>`` element.
-   :since:`Since 9.2.0 (QEMU only)`
+   This element supports a ``format`` attribute, which specifies the format
+   of the NVRAM image. :since:`Since 9.2.0 (QEMU only)` Note that hypervisors
+   may not support automatic population of the nvram if ``format`` differs from
+   ``templateFormat`` or may support only a specific ``format``.
 
    It is not valid to provide this element if the loader is marked as
    stateless.
@@ -387,6 +397,7 @@ and full virtualized guests.
      <kernel>/root/f8-i386-vmlinuz</kernel>
      <initrd>/root/f8-i386-initrd</initrd>
      <cmdline>console=ttyS0 ks=http://example.com/f8-i386/os/</cmdline>
+     <shim>/path/to/shim.efi</shim>
      <dtb>/root/ppc.dtb</dtb>
    </os>
    ...
@@ -407,6 +418,10 @@ and full virtualized guests.
    The contents of this element specify arguments to be passed to the kernel (or
    installer) at boot time. This is often used to specify an alternate primary
    console (eg serial port), or the installation media source / kickstart file
+``shim``
+   Use specified fully-qualified path to load an initial UEFI bootloader that
+   handles chaining to a trusted full bootloader under secure boot
+   environments.
 ``dtb``
    The contents of this element specify the fully-qualified path to the
    (optional) device tree binary (dtb) image in the host OS.
@@ -480,9 +495,26 @@ These options apply to any form of booting of the guest OS.
    ...
 
 ``acpi``
-   The ``table`` element contains a fully-qualified path to the ACPI table. The
-   ``type`` attribute contains the ACPI table type (currently only ``slic`` is
-   supported) :since:`Since 1.3.5 (QEMU)` :since:`Since 5.9.0 (Xen)`
+   The ``table`` element contains a fully-qualified path to the ACPI table,
+   with the ``type`` attribute dictating what data must be present in the
+   file:
+
+   * ``raw``: a single ACPI table with header and data, with ACPI
+     signature auto-detected from header (:since:`Since 11.2.0 (QEMU)`).
+   * ``rawset``: concatenation of multiple ACPI tables with header
+     and data, each with any ACPI signature, auto-detected from header
+     (:since:`Since 11.2.0 (Xen)`).
+   * ``slic``: a single ACPI table with header and data, providing
+     software licensing information. The ACPI table signature in the
+     header will be forced to ``SLIC`` (:since:`Since 1.3.5 (QEMU)`,
+     mis-interpreted as ``rawset`` :since:`Since 5.9.0 (Xen)`).
+   * ``msdm``: a single ACPI table with header and data, providing
+     Microsoft Data Management information. The ACPI table signature
+     in the header will be forced to ``MSDM``
+     (:since:`Since 11.2.0 (QEMU)`).
+
+   Each type may be used only once, except for ``raw`` which can
+   appear multiple times.
 
 
 SMBIOS System Information
@@ -1478,38 +1510,46 @@ In case no restrictions need to be put on CPU model and its features, a simpler
       presented to the guest. This is the default when no ``mode`` attribute is
       specified. This mode makes it so that a persistent guest will see the same
       hardware no matter what host the guest is booted on.
+
    ``host-model``
-      The ``host-model`` mode is essentially a shortcut to copying host CPU
-      definition from capabilities XML into domain XML. Since the CPU definition
-      is copied just before starting a domain, exactly the same XML can be used
-      on different hosts while still providing the best guest CPU each host
-      supports. The ``match`` attribute can't be used in this mode. Specifying
-      CPU model is not supported either, but ``model``'s ``fallback`` attribute
-      may still be used. Using the ``feature`` element, specific flags may be
-      enabled or disabled specifically in addition to the host model. This may
-      be used to fine tune features that can be emulated. :since:`(Since 1.1.1)`
-      . Libvirt does not model every aspect of each CPU so the guest CPU will
-      not match the host CPU exactly. On the other hand, the ABI provided to the
+      The ``host-model`` mode is essentially a shortcut to copying host-model
+      CPU definition from `domain capabilities XML
+      <formatdomaincaps.html#cpu-configuration>`__ into domain XML. Since the
+      CPU definition is copied just before starting a domain, exactly the same
+      XML can be used on different hosts while still providing the best guest
+      CPU each host supports. The ``match`` attribute can't be used in this
+      mode. Specifying CPU model is not supported either, but ``model``'s
+      ``fallback`` attribute may still be used. Using the ``feature`` element,
+      specific flags may be enabled or disabled specifically in addition to the
+      host model. This may be used to fine tune features that can be emulated.
+      :since:`(Since 1.1.1)`
+
+      Libvirt does not model every aspect of each CPU so the guest CPU will not
+      match the host CPU exactly. On the other hand, the ABI provided to the
       guest is reproducible. During migration, complete CPU model definition is
-      transferred to the destination host so the migrated guest will see exactly
-      the same CPU model for the running instance of the guest, even if the
-      destination host contains more capable CPUs or newer kernel; but shutting
-      down and restarting the guest may present different hardware to the guest
-      according to the capabilities of the new host. Prior to libvirt 3.2.0 and
-      QEMU 2.9.0 detection of the host CPU model via QEMU is not supported. Thus
-      the CPU configuration created using ``host-model`` may not work as
-      expected. :since:`Since 3.2.0 and QEMU 2.9.0` this mode works the way it
-      was designed and it is indicated by the ``fallback`` attribute set to
-      ``forbid`` in the host-model CPU definition advertised in `domain
-      capabilities XML <formatdomaincaps.html#cpu-configuration>`__. When
-      ``fallback`` attribute is set to ``allow`` in the domain capabilities
-      XML, it is recommended to use ``custom`` mode with just the CPU model
-      from the host capabilities XML. :since:`Since 1.2.11` PowerISA allows
-      processors to run VMs in binary compatibility mode supporting an older
-      version of ISA.  Libvirt on PowerPC architecture uses the ``host-model``
-      to signify a guest mode CPU running in binary compatibility mode.
-      Example: When a user needs a power7 VM to run in compatibility mode on a
-      Power8 host, this can be described in XML as follows :
+      transferred to the destination host so the migrated guest will see
+      exactly the same CPU model for the running instance of the guest, even if
+      the destination host contains more capable CPUs or newer kernel; but
+      shutting down and restarting the guest may present different hardware to
+      the guest according to the capabilities of the new host.
+
+      Prior to libvirt 3.2.0 and QEMU 2.9.0 detection of the host CPU model via
+      QEMU is not supported. Thus the CPU configuration created using
+      ``host-model`` may not work as expected. :since:`Since 3.2.0 and QEMU
+      2.9.0` this mode works the way it was designed and it is indicated by the
+      ``fallback`` attribute set to ``forbid`` in the host-model CPU definition
+      advertised in `domain capabilities XML
+      <formatdomaincaps.html#cpu-configuration>`__. When ``fallback`` attribute
+      is set to ``allow`` in the domain capabilities XML, it is recommended to
+      use ``custom`` mode with just the CPU model from the host capabilities
+      XML.
+
+      :since:`Since 1.2.11` PowerISA allows processors to run VMs in binary
+      compatibility mode supporting an older version of ISA.  Libvirt on
+      PowerPC architecture uses the ``host-model`` to signify a guest mode CPU
+      running in binary compatibility mode. Example: When a user needs a power7
+      VM to run in compatibility mode on a Power8 host, this can be described
+      in XML as follows:
 
       ::
 
@@ -1989,7 +2029,10 @@ Hypervisors may allow certain CPU / machine features to be toggled on/off.
        <vendor_id state='on' value='KVM Hv'/>
        <frequencies state='on'/>
        <reenlightenment state='on'/>
-       <tlbflush state='on'/>
+       <tlbflush state='on'>
+         <direct state='on'/>
+         <extended state='on'/>
+       </tlbflush>
        <ipi state='on'/>
        <evmcs state='on'/>
        <emsr_bitmap state='on'/>
@@ -2028,6 +2071,7 @@ Hypervisors may allow certain CPU / machine features to be toggled on/off.
      <async-teardown enabled='yes'/>
      <ras state='on'/>
      <ps2 state='on'/>
+     <aia value='aplic-imsic'/>
    </features>
    ...
 
@@ -2064,9 +2108,9 @@ are:
    Enable various features improving behavior of guests running Microsoft
    Windows.
 
-   =============== ====================================================================== ============================================ =======================================================
+   =============== ====================================================================== ============================================ ========================================================================
    Feature         Description                                                            Value                                        Since
-   =============== ====================================================================== ============================================ =======================================================
+   =============== ====================================================================== ============================================ ========================================================================
    relaxed         Relax constraints on timers                                            on, off                                      :since:`1.0.0 (QEMU 2.0)`
    vapic           Enable virtual APIC                                                    on, off                                      :since:`1.1.0 (QEMU 2.0)`
    spinlocks       Enable spinlock support                                                on, off; retries - at least 4095             :since:`1.1.0 (QEMU 2.0)`
@@ -2078,13 +2122,13 @@ are:
    vendor_id       Set hypervisor vendor id                                               on, off; value - string, up to 12 characters :since:`1.3.3 (QEMU 2.5)`
    frequencies     Expose frequency MSRs                                                  on, off                                      :since:`4.7.0 (QEMU 2.12)`
    reenlightenment Enable re-enlightenment notification on migration                      on, off                                      :since:`4.7.0 (QEMU 3.0)`
-   tlbflush        Enable PV TLB flush support                                            on, off                                      :since:`4.7.0 (QEMU 3.0)`
+   tlbflush        Enable PV TLB flush support                                            on, off; direct - on,off; extended - on,off  :since:`4.7.0 (QEMU 3.0), direct and extended modes 11.0.0 (QEMU 7.1.0)`
    ipi             Enable PV IPI support                                                  on, off                                      :since:`4.10.0 (QEMU 3.1)`
    evmcs           Enable Enlightened VMCS                                                on, off                                      :since:`4.10.0 (QEMU 3.1)`
    avic            Enable use Hyper-V SynIC with hardware APICv/AVIC                      on, off                                      :since:`8.10.0 (QEMU 6.2)`
    emsr_bitmap     Avoid unnecessary updates to L2 MSR Bitmap upon vmexits.               on, off                                      :since:`10.7.0 (QEMU 7.1)`
    xmm_input       Enable XMM Fast Hypercall Input                                        on, off                                      :since:`10.7.0 (QEMU 7.1)`
-   =============== ====================================================================== ============================================ =======================================================
+   =============== ====================================================================== ============================================ ========================================================================
 
    :since:`Since 8.0.0`, the hypervisor can be configured further by setting
    the ``mode`` attribute to one of the following values:
@@ -2275,6 +2319,13 @@ are:
    disable the emulation of a PS/2 controller used by ``ps2`` bus input devices.
    If the attribute is not defined, the hypervisor default will be used.
    :since:`Since 10.7.0` (QEMU only)
+``aia``
+   Configure aia (Advanced Interrupt Architecture) for RISC-V 'virt'
+   guests. Possible values for the ``value`` attribute are ``aplic`` (one
+   emulated APLIC device present per socket), ``aplic-imsic`` (one APLIC and
+   one IMSIC device present per core), or ``none`` (no support for AIA).
+   If the attribute is not defined, the hypervisor default
+   will be used. :since:`Since 11.1.0` (QEMU/KVM and RISC-V guests only)
 
 Time keeping
 ------------
@@ -2723,6 +2774,25 @@ paravirtualized driver is specified via the ``disk`` element.
        <source dev='/dev/vhost-vdpa-0' />
        <target dev='vdg' bus='virtio'/>
      </disk>
+     <disk type='file' device='disk'>
+       <driver name='qemu' type='qcow2'/>
+       <source file='/path/to/datastore.qcow2'>
+         <dataStore type='file'>
+           <format type='raw'/>
+           <source file='/path/to/datastore'/>
+         <dataStore/>
+       </source>
+       <backingStore type='file'>
+         <format type='qcow2'/>
+         <source file='/var/lib/libvirt/images/base-with-data-file.qcow'>
+           <dataStore type='block'>
+             <format type='raw'/>
+             <source dev='/dev/mapper/base2'/>
+           <dataStore/>
+         </source>
+       </backingStore>
+       <target dev='vdh' bus='virtio'/>
+     </disk>
    </devices>
    ...
 
@@ -2756,8 +2826,8 @@ paravirtualized driver is specified via the ``disk`` element.
    ``model``
       Indicates the emulated device model of the disk. Typically this is
       indicated solely by the ``bus`` property but for ``bus`` "virtio" the
-      model can be specified further with "virtio-transitional",
-      "virtio-non-transitional", or "virtio". See `Virtio transitional devices`_
+      model can be specified further with "virtio", "virtio-transitional" or
+      "virtio-non-transitional". See `virtio device models`_
       for more details. :since:`Since 5.2.0`
    ``rawio``
       Indicates whether the disk needs rawio capability. Valid settings are
@@ -2767,14 +2837,13 @@ paravirtualized driver is specified via the ``disk`` element.
       per-process basis). This attribute is only valid when device is "lun". NB,
       ``rawio`` intends to confine the capability per-device, however, current
       QEMU implementation gives the domain process broader capability than that
-      (per-process basis, affects all the domain disks). To confine the
-      capability as much as possible for QEMU driver as this stage, ``sgio`` is
-      recommended, it's more secure than ``rawio``. :since:`Since 0.9.10`
+      (per-process basis, affects all the domain disks). :since:`Since 0.9.10`
    ``sgio``
       If supported by the hypervisor and OS, indicates whether unprivileged
       SG_IO commands are filtered for the disk. Valid settings are "filtered" or
       "unfiltered" where the default is "filtered". Only available when the
-      ``device`` is 'lun'. :since:`Since 1.0.2`
+      ``device`` is 'lun'. The attribute exists :since:`Since 1.0.2`, although
+      currently it's no longer supported by any hypervisor.
    ``snapshot``
       Indicates the default behavior of the disk during disk snapshots:
       ``internal`` requires a file format such as qcow2 that can store both
@@ -3094,6 +3163,28 @@ paravirtualized driver is specified via the ``disk`` element.
       attribute.
       :since:`Since 9.8.0`
 
+   ``dataStore``
+      This element describes external data store, which is storage holding the
+      actual data blocks of the given storage image. In such case the disk source
+      image holds only the metadata. This feature is currently supported only
+      by the ``qcow2`` format. :since:`Since 10.10.0`
+
+      The following attribute is supported in ``dataStore``:
+
+      ``type``
+         The ``type`` attribute represents the type of storage used by the data store,
+         see disk type attribute above for more details and possible values.
+
+      Moreover, ``dataStore`` supports the following sub-elements:
+
+      ``format``
+         The ``format`` element contains ``type`` attribute which specifies the
+         internal format of the data store. Only ``raw`` value is supported.
+
+      ``source``
+         This element has the same structure as the ``source`` element in ``disk``.
+         It specifies which file, device, or network location contains the data of
+         the described data store.
 
    For a "file" or "volume" disk type which represents a cdrom or floppy (the
    ``device`` attribute), it is possible to define policy what to do with the
@@ -3373,10 +3464,27 @@ paravirtualized driver is specified via the ``disk`` element.
       *Note:* ``iothread`` is mutually exclusive with ``iothreads``.
    -  The optional ``iothreads`` sub-element allows specifying multiple IOThreads
       via the ``iothread`` sub-element with attribute ``id``  the disk will use
-      for I/O operations. Optionally the ``iothread`` element can have multiple
-      ``queue`` subelements specifying that given iothread should be used to
-      handle given queues. :since:`Since 10.0.0 (QEMU 9.0, virtio disks only)`.
-      Example::
+      for I/O operations. The virt queues (see ``queues`` attribute below) are
+      automatically distributed among the configured iothreads.
+
+      Optionally the ``iothread`` element can have multiple ``queue``
+      subelements with mandatory ``id`` atribute specifying that the iothread
+      should be used to handle given virt queue. If queue mapping is present
+      the ``queues`` attribute of  ``driver`` must be configured and all
+      configured virt queues must be included in the mapping. The
+      ``virtio-blk`` device exposes request virt queues ``0`` to ``N-1`` where
+      N is the number of queues configured for the device.
+
+      :since:`Since 10.0.0 (QEMU 9.0, virtio disks only)`.
+
+      Examples::
+
+        <driver name='qemu' queues='4'>
+          <iothreads>
+            <iothread id='2'/>
+            <iothread id='3'/>
+          </iothreads>
+        </driver>
 
         <driver name='qemu' queues='3'>
           <iothreads>
@@ -3507,12 +3615,13 @@ paravirtualized driver is specified via the ``disk`` element.
    :since:`Since 0.10.1`
 ``vendor``
    If present, this element specifies the vendor of a virtual hard disk or
-   CD-ROM device. It must not be longer than 8 printable characters.
-   :since:`Since 1.0.1`
+   CD-ROM device. It must not be longer than 8 printable characters. Only for
+   'scsi' ``bus``.:since:`Since 1.0.1`
 ``product``
    If present, this element specifies the product of a virtual hard disk or
-   CD-ROM device. It must not be longer than 16 printable characters.
-   :since:`Since 1.0.1`
+   CD-ROM device. It must not be longer than 16 printable characters for 'scsi'
+   (:since:`Since 1.0.1`). For 'sata' or 'ide' not longer than 40 printable
+   characters (:since:`Since 11.1.0`). Other ``bus`` is not supported.
 ``address``
    If present, the ``address`` element ties the disk to a given slot of a
    controller (the actual ``<controller>`` device can often be inferred by
@@ -3681,9 +3790,8 @@ A directory on the host that can be accessed directly from the guest.
       info <https://lists.gnu.org/archive/html/qemu-devel/2010-09/msg00121.html>`__
 
    :since:`Since 5.2.0`, the filesystem element has an optional attribute
-   ``model`` with supported values "virtio-transitional",
-   "virtio-non-transitional", or "virtio". See `Virtio transitional devices`_
-   for more details.
+   ``model`` with supported values "virtio", "virtio-transitional" or
+   "virtio-non-transitional". See `virtio device models`_ for more details.
 
    The filesystem element has optional attributes ``fmode`` and ``dmode``.
    These two attributes control the creation mode for files and directories
@@ -3778,8 +3886,8 @@ A directory on the host that can be accessed directly from the guest.
    :since:`Since 10.0.0`
 ``readonly``
    Enables exporting filesystem as a readonly mount for guest, by default
-   read-write access is given (currently only works for QEMU/KVM driver; not
-   with virtiofs).
+   read-write access is given (works for QEMU/KVM driver, :since:`Since 11.0.0,
+   requires virtiofs 1.13.0` ).
 ``space_hard_limit``
    Maximum space available to this guest's filesystem. :since:`Since 0.9.13`
    Only supported by the OpenVZ driver.
@@ -3911,11 +4019,20 @@ Note: In general you should leave this option alone, unless you are very certain
 you know what you are doing.
 
 
-Virtio transitional devices
-~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Virtio device models
+~~~~~~~~~~~~~~~~~~~~
 
-:since:`Since 5.2.0`, some of QEMU's virtio devices, when used with PCI/PCIe
-machine types, accept the following ``model`` values:
+Virtio devices come in several variants, some of which are only applicable to
+certain machine types or scenarios. The variant can be chosen via the ``model``
+attribute, which supports the following values:
+
+``virtio``
+   This is the recommended choice in the absence of guest OS specific
+   constraints, as it will will generally work correctly across a large range
+   of architectures, machine types and libvirt versions.
+
+:since:`Since 5.2.0`, the following values can additionally be used with machine
+types based on PCI (either conventional PCI or PCI Express):
 
 ``virtio-transitional``
    This device can work both with virtio 0.9 and virtio 1.0 guest drivers, so
@@ -3927,12 +4044,6 @@ machine types, accept the following ``model`` values:
    necessary. libvirt will plug the device into either a PCI Express slot or a
    conventional PCI slot based on the machine type, resulting in a more
    optimized PCI topology.
-``virtio``
-   This device will work like a ``virtio-non-transitional`` device when plugged
-   into a PCI Express slot, and like a ``virtio-transitional`` device otherwise;
-   libvirt will pick one or the other based on the machine type. This is the
-   best choice when compatibility with libvirt versions older than 5.2.0 is
-   necessary, but it's otherwise not recommended to use it.
 
 While the information outlined above applies to most virtio devices, there are a
 few exceptions:
@@ -3993,14 +4104,14 @@ specific features, such as:
    The ``virtio-serial`` controller has two additional optional attributes
    ``ports`` and ``vectors``, which control how many devices can be connected
    through the controller. :since:`Since 5.2.0`, it supports an optional
-   attribute ``model`` which can be 'virtio', 'virtio-transitional', or
-   'virtio-non-transitional'. See `Virtio transitional devices`_ for more details.
+   attribute ``model`` which can be 'virtio', 'virtio-transitional' or
+   'virtio-non-transitional'. See `virtio device models`_ for more details.
 ``scsi``
    A ``scsi`` controller has an optional attribute ``model``, which is one of
    'auto', 'buslogic', 'ibmvscsi', 'lsilogic', 'lsisas1068', 'lsisas1078',
    'virtio-scsi', 'vmpvscsi', 'virtio-transitional', 'virtio-non-transitional',
    'ncr53c90' (as builtin implicit controller only), 'am53c974', 'dc390'.
-   See `Virtio transitional devices`_ for more details.
+   See `virtio device models`_ for more details.
 ``usb``
    A ``usb`` controller has an optional attribute ``model``, which is one of
    "piix3-uhci", "piix4-uhci", "ehci", "ich9-ehci1", "ich9-uhci1", "ich9-uhci2",
@@ -4346,7 +4457,7 @@ or:
 
    ...
    <devices>
-     <hostdev mode='subsystem' type='scsi' sgio='filtered' rawio='yes'>
+     <hostdev mode='subsystem' type='scsi' rawio='yes'>
        <source>
          <adapter name='scsi_host0'/>
          <address bus='0' target='0' unit='0'/>
@@ -4402,9 +4513,9 @@ or:
        </source>
        </hostdev>
        <hostdev mode='subsystem' type='mdev' model='vfio-ccw'>
-       <source>
-         <address uuid='9063cba3-ecef-47b6-abcf-3fef4fdcad85'/>
-       </source>
+         <source>
+           <address uuid='9063cba3-ecef-47b6-abcf-3fef4fdcad85'/>
+         </source>
        <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0001'/>
        </hostdev>
      </devices>
@@ -4436,21 +4547,25 @@ or:
       ``display`` attribute to be set to ``on``.
    ``scsi``
       For SCSI devices, user is responsible to make sure the device is not used
-      by host. If supported by the hypervisor and OS, the optional ``sgio`` (
-      :since:`since 1.0.6` ) attribute indicates whether unprivileged SG_IO
-      commands are filtered for the disk. Valid settings are "filtered" or
-      "unfiltered", where the default is "filtered". The optional ``rawio`` (
-      :since:`since 1.2.9` ) attribute indicates whether the lun needs the rawio
-      capability. Valid settings are "yes" or "no". See the rawio description
-      within the `Hard drives, floppy disks, CDROMs`_ section. If a disk lun in the domain
-      already has the rawio capability, then this setting not required.
+      by host.
+
+      If supported by the hypervisor and OS, the optional ``sgio`` (
+      :since:`since 1.0.6`, but currently no longer supported by any hypervisor
+      driver ) attribute indicates whether unprivileged SG_IO commands are
+      filtered for the disk. Valid settings are "filtered" or
+      "unfiltered", where the default is "filtered".
+
+      The optional ``rawio`` (:since:`since 1.2.9` ) attribute indicates whether
+      the lun needs the rawio capability. Valid settings are "yes" or "no".
+      See the rawio description within the `Hard drives, floppy disks, CDROMs`_
+      section. If a disk lun in the domain already has the rawio capability,
+      then this setting not required.
    ``scsi_host``
       :since:`since 2.5.0` For SCSI devices, user is responsible to make sure
       the device is not used by host. This ``type`` passes all LUNs presented by
       a single HBA to the guest. :since:`Since 5.2.0`, the ``model`` attribute
-      can be specified further with "virtio-transitional",
-      "virtio-non-transitional", or "virtio". `Virtio transitional devices`_
-      for more details.
+      can be specified further with "virtio", "virtio-transitional" or
+      "virtio-non-transitional". See `virtio device models`_ for more details.
    ``mdev``
       For mediated devices ( :since:`Since 3.2.0` ) the ``model`` attribute
       specifies the device API which determines how the host's vfio driver will
@@ -5019,25 +5134,34 @@ to the interface.
    </devices>
    ...
 
-Userspace (SLIRP or passt) connection
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+Userspace connection using SLIRP
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-The ``user`` type connects the guest interface to the outside via a
+The ``user`` interface type connects the guest interface to the outside via a
 transparent userspace proxy that doesn't require any special system
 privileges, making it usable in cases when libvirt itself is running
 with no privileges (e.g. libvirt's "session mode" daemon, or when
 libvirt is run inside an unprivileged container).
 
-By default, this user proxy is done with QEMU's internal SLIRP driver
-which has DHCP & DNS services that give the guest IP addresses
-starting from ``10.0.2.15``, a default route of ``10.0.2.2`` and DNS
-server of ``10.0.2.3``. :since:`Since 3.8.0` it is possible to override
-the default network address by including an ``ip`` element specifying
-an IPv4 address in its one mandatory attribute,
-``address``. Optionally, a second ``ip`` element with a ``family``
-attribute set to "ipv6" can be specified to add an IPv6 address to the
-interface. ``address``. Optionally, address ``prefix`` can be
-specified.
+By default, this user proxy is done with QEMU's SLIRP driver, a
+userspace proxy built into QEMU that has DHCP & DNS services that give
+the guest an IP address of ``10.0.2.15``, a default route of
+``10.0.2.2`` and DNS server at ``10.0.2.3``.
+
+:since:`Since 3.8.0` it is possible to override the guest's default
+network address by including an ``ip`` element specifying an IPv4
+address in its one mandatory attribute, ``address``. Optionally, a
+second ``ip`` element with a ``family`` attribute set to "ipv6" can be
+specified to add an IPv6 address to the interface. ``address``.
+Optionally, an address ``prefix`` can be specified. These settings are
+surprisingly **not** used by SLIRP to set the exact IP address;
+instead they are used to determine what network/subnet the guest's IP
+address should be on, and the guest will be given an address in that
+subnet, but the host portion of the address will still be "2.15". In
+the example below, for example, the guest will be given the IP address
+172.17.2.15 (**note that the '1.1' in the host portion of the address
+has been ignored**), default route of 172.17.2.2, and DNS server
+172.17.2.3.
 
 ::
 
@@ -5047,34 +5171,74 @@ specified.
      ...
      <interface type='user'>
        <mac address="00:11:22:33:44:55"/>
-       <ip family='ipv4' address='172.17.2.0' prefix='24'/>
-       <ip family='ipv6' address='2001:db8:ac10:fd01::' prefix='64'/>
+       <ip family='ipv4' address='172.17.1.1' prefix='16'/>
+       <ip family='ipv6' address='2001:db8:ac10:fd01::1' prefix='64'/>
      </interface>
    </devices>
    ...
 
-:since:`Since 9.0.0` an alternate backend implementation of the
-``user`` interface type can be selected by setting the interface's
-``<backend>`` subelement ``type`` attribute to ``passt``. In this
-case, the passt transport (https://passt.top) is used. Similar to
-SLIRP, passt has an internal DHCP server that provides a requesting
-guest with one ipv4 and one ipv6 address; it then uses userspace
-proxies and a separate network namespace to provide outgoing
-UDP/TCP/ICMP sessions, and optionally redirect incoming traffic
-destined for the host toward the guest instead.
+Userspace connection using passt
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-When the passt backend is used, the ``<backend>`` attribute
-``logFile`` can be used to tell the passt process for this interface
-where to write its message log, and the ``<source>`` attribute ``dev``
-can tell it to use a particular host interface to derive the routes
-given to the guest for forwarding traffic upstream.  Due to the design
-decisions of passt, if using SELinux, the log file is recommended to
-reside in the runtime directory of a user under which the passt
-process will run, most probably ``/run/user/$UID`` where ``$UID`` is
-the UID of the user, e.g. ``qemu``.  Beware that libvirt does not
-create this directory if it does not already exist to avoid possible,
-however unlikely, issues, especially since this logfile attribute is
-meant mostly for debugging.
+:since:`Since 9.0.0 (QEMU and KVM only)` an alternate backend
+implementation of the ``user`` interface type can be selected by
+setting the interface's ``<backend>`` subelement ``type`` attribute to
+``passt``. In this case, the passt transport `(details here)
+<https://passt.top>`__ is used. passt is run as a separate process
+from QEMU - the passt process handles the details of forwarding
+network traffic back and forth to the physical network (using
+userspace proxies and a separate network namespace to provide outgoing
+UDP/TCP/ICMP sessions, and optionally redirecting incoming traffic
+destined for the host toward the guest instead), and a socket between
+passt and QEMU forwards that traffic on to the guest (and back out,
+of course).
+
+:since:`Since 11.1.0 (QEMU and KVM only)` you may prefer to use the
+passt backend with the more efficient and performant type='vhostuser'
+rather than type='user'. All the options related to passt in the
+paragraphs below here also apply when using the passt backend with
+type='vhostuser'; any other details specific to vhostuser are
+described `here
+<formatdomain.html#vhost-user-connection-with-passt-backend>`__.
+
+
+Similar to SLIRP, passt has an internal DHCP server that provides a
+requesting guest with one ipv4 and one ipv6 address. There are default
+values for both of these, or you can use the ``<ip>`` element
+(described above, with behavioral differences as outlined below) to
+configure one IPv4 and one IPv6 address that passt's DHCP server can
+provide to the guest.
+
+Unlike SLIRP, when no ``<ip>`` address is specified, passt will by
+default provide the guest with an IP address, DNS server, etc. that
+are identical to those settings on the host itself (through the magic
+of the proxies and a separate network namespace, this doesn't create
+any conflict).
+
+Also different from SLIRP's behavior: if you do specify IP
+address(es), the exact address and netmask/prefix you specify will be
+provided to the guest (i.e. passt doesn't interpret the <ip> settings
+as a network address like SLIRP does, but as a host address). In
+example given above, the guest IP would be set to exactly 172.17.1.1.
+
+Just as with SLIRP, though, once traffic from the guest leaves the
+host towards the rest of the network, it will always appear as if it
+came from the host's IP.
+
+There are a few other options that are configurable only for the passt
+backend.  For example, the ``<backend>`` attribute ``logFile`` can be
+used to tell the passt process for this interface where to write its
+message log, and the ``<source>`` attribute ``dev`` can tell it a
+particular host interface to use when deriving the routes given to the
+guest for forwarding traffic upstream.  Due to the design decisions of
+passt, when using SELinux on the host, it is recommended that the log
+file reside in the runtime directory of the user under which the passt
+process will run, most probably ``/run/user/$UID`` (where ``$UID`` is
+the UID of that user), e.g. ``/run/user/1000``. Be aware that libvirt
+does not create this directory if it does not already exist to avoid
+possible, however unlikely, issues with orphaned directories or
+permissions, etc. The logfile attribute is meant mostly for debugging,
+so it shouldn't be set under normal circumstances.
 
 Additionally, when passt is used, multiple ``<portForward>`` elements
 can be added to forward incoming network traffic for the host to this
@@ -5111,7 +5275,7 @@ ports **with the exception of some subset**.
        <backend type='passt' logFile='/run/user/$UID/passt-domain.log'/>
        <mac address="00:11:22:33:44:55"/>
        <source dev='eth0'/>
-       <ip family='ipv4' address='172.17.2.4' prefix='24'/>
+       <ip family='ipv4' address='172.17.5.4' prefix='24'/>
        <ip family='ipv6' address='2001:db8:ac10:fd01::20'/>
        <portForward proto='tcp'>
          <range start='2022' to='22'/>
@@ -5664,7 +5828,7 @@ Setting NIC driver-specific options
          <host csum='off' gso='off' tso4='off' tso6='off' ecn='off' ufo='off' mrg_rxbuf='off'/>
          <guest csum='off' tso4='off' tso6='off' ecn='off' ufo='off'/>
        </driver>
-       </interface>
+     </interface>
    </devices>
    ...
 
@@ -5730,7 +5894,7 @@ following attributes are available for the ``virtio`` NIC driver:
    The optional ``queues`` attribute controls the number of queues to be used
    for either `Multiqueue
    virtio-net <https://www.linux-kvm.org/page/Multiqueue>`__ or vhost-user (See
-   `vhost-user interface`_) network interfaces. Use of multiple packet
+   `vhost-user connection`_) network interfaces. Use of multiple packet
    processing queues requires the interface having the
    ``<model type='virtio'/>`` element. Each queue will potentially be handled by
    a different processor, resulting in much higher throughput.
@@ -5986,28 +6150,29 @@ VLAN tags to apply to the guest's network traffic :since:`Since 0.10.0`.
 
 Network connections that support guest-transparent VLAN tagging include
 ``type='bridge'`` interfaces connected to an Open vSwitch bridge, SRIOV
-Virtual Functions (VF) used via ``type='hostdev'`` (direct device assignment)
-and, :since:`since 1.3.5`, SRIOV VFs used via ``type='direct'`` with
-``mode='passthrough'`` (macvtap "passthru" mode). All other
-connection types, including standard linux bridges and libvirt's own virtual
+Virtual Functions (VF) used via ``type='hostdev'`` (direct device assignment),
+:since:`since 1.3.5`, SRIOV VFs used via ``type='direct'`` with
+``mode='passthrough'`` (macvtap "passthru" mode) and, :since:`since 11.0.0`
+standard linux bridges. Other connection types, including libvirt's own virtual
 networks, **do not** support it. 802.1Qbh (vn-link) and 802.1Qbg (VEPA) switches
 provide their own way (outside of libvirt) to tag guest traffic onto a specific
 VLAN. Each tag is given in a separate ``<tag>`` subelement of ``<vlan>`` (for
 example: ``<tag id='42'/>``). For VLAN trunking of multiple tags (which is
-supported only on Open vSwitch connections), multiple ``<tag>`` subelements can
-be specified, which implies that the user wants to do VLAN trunking on the
-interface for all the specified tags. In the case that VLAN trunking of a single
-tag is desired, the optional attribute ``trunk='yes'`` can be added to the
-toplevel ``<vlan>`` element to differentiate trunking of a single tag from
-normal tagging.
+supported on Open vSwitch connections and standard linux bridges), multiple
+``<tag>`` subelements can be specified, which implies that the user wants to do
+VLAN trunking on the interface for all the specified tags. In the case that VLAN
+trunking of a single tag is desired, the optional attribute ``trunk='yes'`` can
+be added to the toplevel ``<vlan>`` element to differentiate trunking of a
+single tag from normal tagging.
 
-For network connections using Open vSwitch it is also possible to configure
-'native-tagged' and 'native-untagged' VLAN modes :since:`Since 1.1.0`. This is
-done with the optional ``nativeMode`` attribute on the ``<tag>`` subelement:
-``nativeMode`` may be set to 'tagged' or 'untagged'. The ``id`` attribute of the
-``<tag>`` subelement containing ``nativeMode`` sets which VLAN is considered to
-be the "native" VLAN for this interface, and the ``nativeMode`` attribute
-determines whether or not traffic for that VLAN will be tagged.
+For network connections using Open vSwitch and standard linux bridges it is also
+possible to configure 'native-tagged' and 'native-untagged' VLAN modes
+:since:`Since 1.1.0`. This is done with the optional ``nativeMode`` attribute on
+the ``<tag>`` subelement: ``nativeMode`` may be set to 'tagged' or 'untagged'.
+The ``id`` attribute of the ``<tag>`` subelement containing ``nativeMode`` sets
+which VLAN is considered to be the "native" VLAN for this interface, and the
+``nativeMode`` attribute determines whether or not traffic for that VLAN will be
+tagged.
 
 
 Isolating guests' network traffic from each other
@@ -6174,8 +6339,8 @@ similarly named elements used to configure the guest side of the interface
 (described above).
 
 
-vhost-user interface
-^^^^^^^^^^^^^^^^^^^^
+vhost-user connection
+^^^^^^^^^^^^^^^^^^^^^
 
 :since:`Since 1.2.7` the vhost-user enables the communication between a QEMU
 virtual machine and other userspace process using the Virtio transport protocol.
@@ -6202,16 +6367,63 @@ plane is based on shared memory.
    </devices>
    ...
 
-The ``<source>`` element has to be specified along with the type of char device.
-Currently, only type='unix' is supported, where the path (the directory path of
-the socket) and mode attributes are required. Both ``mode='server'`` and
-``mode='client'`` are supported. vhost-user requires the virtio model type, thus
-the ``<model>`` element is mandatory. :since:`Since 4.1.0` the element has an
-optional child element ``reconnect`` which configures reconnect timeout if the
-connection is lost. It has two attributes ``enabled`` (which accepts ``yes`` and
-``no``) and ``timeout`` which specifies the amount of seconds after which
+The ``<source>`` element has to be specified along with the type of
+char device.  Currently, only type='unix' is supported, where the path
+(the directory path of the socket) and mode attributes are
+required. Both ``mode='server'`` and ``mode='client'`` are
+supported. (:since:`Since 11.1.0` the default source type for
+vhostuser interfaces is 'unix' and default mode is 'client', so those
+two attributes are now optional).
+
+The vhost-user protocol only works with the virtio guest driver, so
+the ``<model>`` element ``type`` attribute is mandatory (:since:`Since
+11.1.0` the default model type for vhostuser interfaces is now
+'virtio' so ``<model>`` is no longer mandatory). :since:`Since 4.1.0`
+the ``<source>`` element has an optional child element ``reconnect``
+which configures reconnect timeout if the connection is lost. It has
+two attributes ``enabled`` (which accepts ``yes`` and ``no``) and
+``timeout`` which specifies the amount of seconds after which
 hypervisor tries to reconnect.
 
+Note that when ``mode='server'`` is used, the hypervisor will wait for the
+incoming connection to be established prior to actually running the VM. This is
+not possible when hotplugging an interface with such config so the VM will
+continue to run even when no connection is made. It's advised to use
+``mode='client'`` instead.
+
+vhost-user connection with passt backend
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+:since:`Since 11.1.0 (QEMU and KVM only)` passt can be used as the
+other end of the vhost-user connection. This is a compelling
+alternative, because passt provides all of its network connectivity
+without requiring any elevated privileges or capabilities, and
+vhost-user uses shared memory to make this unprivileged connection
+very high performance as well. You can set a type='vhostuser'
+interface to use passt as the backend by adding ``<backend
+type='passt'/>``. When passt is the backend, only a single driver
+queue is supported, and the ``<source>`` path/type/mode are all
+implied to be "matching the passt process" so **must not** be
+specified. All of the passt options `described here
+<formatdomain.html#userspace-connection-using-passt>`__, are also
+supported for ``type='vhostuser'`` with the passt backend, e.g.
+setting guest-side IP addresses with ``<ip>`` and port forwarding with
+``<portForward``.
+
+::
+
+   ...
+   <devices>
+     <interface type='vhostuser'>
+       <backend type='passt'/>
+       <mac address='52:54:00:3b:83:1a'/>
+       <source dev='enp1s0'/>
+       <ip address='10.30.0.5 prefix='24'/>
+     </interface>
+   </devices>
+   ...
+
+
 Traffic filtering with NWFilter
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
@@ -6296,8 +6508,8 @@ value 'all' which when enabled grabs all input devices instead of just one,
 change the grab key combination.
 ``input`` type ``evdev`` is currently supported only on linux devices.
 (KVM only) :since:`Since 5.2.0`, the ``input`` element accepts a
-``model`` attribute which has the values 'virtio', 'virtio-transitional' and
-'virtio-non-transitional'. See `Virtio transitional devices`_ for more details.
+``model`` attribute which has the values 'virtio', 'virtio-transitional' or
+'virtio-non-transitional'. See `virtio device models`_ for more details.
 
 The subelement ``driver`` can be used to tune the virtio options of the device:
 `Virtio-related options`_ can also be set. ( :since:`Since 3.5.0` )
@@ -6408,7 +6620,7 @@ interaction with the admin.
       ::
 
          <graphics type='vnc' ...>
-           <audio id='1'>
+           <audio id='1'/>
          </graphics>
 
       Where ``1`` is an id of the audio device (See `Audio backends`_). If no
@@ -6545,7 +6757,7 @@ interaction with the admin.
 
         <graphics type='dbus'/>
 
-      ``p2p`` (accepts ``on`` or ``off``) enables peer-to-peer connections,
+      ``p2p`` (accepts ``yes`` or ``no``) enables peer-to-peer connections,
       established through virDomainOpenGraphics() APIs.
 
       ``address`` (accepts a `D-Bus address
@@ -6565,7 +6777,7 @@ interaction with the admin.
       ::
 
          <graphics type='dbus' ...>
-           <audio id='1'>
+           <audio id='1'/>
          </graphics>
 
       Where ``1`` is an id of the audio device (See `Audio backends`_).
@@ -7476,7 +7688,7 @@ backend using the ``<audio>`` sub-element:
    ...
    <devices>
      <sound model='ich7'>
-        <audio id='1'>
+        <audio id='1'/>
      </sound>
    </devices>
    ...
@@ -7978,7 +8190,7 @@ Example: manually added device with static PCI slot 2 requested
    -  'virtio-non-transitional' :since:`Since 5.2.0`
    -  'xen' - default with Xen
 
-   See `Virtio transitional devices`_ for more details.
+   See `virtio device models`_ for more details.
 
 ``autodeflate``
    The optional ``autodeflate`` attribute allows to enable/disable (values
@@ -8044,7 +8256,7 @@ Example: usage of the RNG device:
    -  'virtio-transitional' :since:`Since 5.2.0`
    -  'virtio-non-transitional' :since:`Since 5.2.0`
 
-   See `Virtio transitional devices`_ for more details.
+   See `virtio device models`_ for more details.
 
 ``rate``
    The optional ``rate`` element allows limiting the rate at which entropy can
@@ -8127,6 +8339,21 @@ Example: usage of the TPM Emulator
            <active_pcr_banks>
                <sha256/>
            </active_pcr_banks>
+           <profile source='local:restricted' removeDisabled='check' name='custom:restricted'/>
+         </backend>
+       </tpm>
+     </devices>
+     ...
+
+Example: usage of external TPM emulator :since:`Since 9.0.0`
+
+::
+
+     ...
+     <devices>
+       <tpm model='tpm-tis'>
+         <backend type='external'>
+           <source type='unix' mode='connect' path='/tmp/path.sock'/>
          </backend>
        </tpm>
      </devices>
@@ -8170,6 +8397,12 @@ Example: usage of the TPM Emulator
       parameter can be used to enable logging in the emulator backend, and
       accepts non-zero integer values.
 
+   ``external``
+      For this backend, libvirt expects the TPM emulator to be started externally.
+      The path to the unix socket where the emulator is listening is passed
+      via the ``source`` element. Other ``backend`` sub-elements do not apply
+      in this case, since they are controlled by the emulator command line.
+
 ``version``
    The ``version`` attribute indicates the version of the TPM. This attribute
    only works with the ``emulator`` backend. The following versions are
@@ -8181,6 +8414,37 @@ Example: usage of the TPM Emulator
    The default version used depends on the combination of hypervisor, guest
    architecture, TPM model and backend.
 
+``source``
+   For the ``emulator`` backend, the ``source`` element specifies the location
+   of the TPM state storage. :since:`Since v10.10.0`
+
+   For the ``external`` backend, it specifies the socket of the externally
+   started TPM emulator. :since:`Since v9.0.0`
+
+   This element does not work with the ``passthrough`` backend.
+
+   When specified, it is the user's responsability to prevent files from being
+   used by multiple VMs or emulators (swtpm will also use advisory locking). If
+   not specified, the storage configuration is left to libvirt discretion.
+
+   This element requires that swtpm v0.7 or later is installed.
+
+   The following attributes are supported:
+
+   ``type``
+      For ``external`` backend, only type ``unix`` is supported.
+      For ``emulator`` backend, it's possible to provide ``file`` to utilize
+      a single file or block device where the TPM state will be stored,
+      or ``dir`` for the directory where the files will be stored.
+
+   ``mode``
+      Connection mode for the ``unix`` socket. Only ``connect`` is supported.
+      Can be omitted.
+
+   ``path``
+      The path to the TPM state storage, or the unix socket.
+
+
 ``persistent_state``
    The ``persistent_state`` attribute indicates whether 'swtpm' TPM state is
    kept or not when a transient domain is powered off or undefined. This
@@ -8199,6 +8463,42 @@ Example: usage of the TPM Emulator
    and may not have any effect otherwise. The selection of PCR banks only works
    with the ``emulator`` backend. :since:`Since 7.10.0`
 
+``profile``
+   The ``profile`` node is used to set a profile for a TPM 2.0 given in the
+   ``source`` attribute. This attribute describes the name of the file under
+   which the profile is stored, e.g. 'local:restricted' describes a locally
+   created profile with name 'restricted.json' that is found in the directory
+   pointed to by swtpm_setup.conf's local_profiles_dir. This profile will be set
+   when the TPM is initially created and after that the profile cannot be
+   changed anymore. Once a profile has been set, the ``name`` attribute will be
+   updated with the profile's name from its JSON description, for example
+   'custom:restricted'. If no profile is provided, then swtpm will use the
+   latest built-in 'default' profile or the default profile set in
+   swtpm_setup.conf. Otherwise swtpm_setup will search for a profile with the
+   given name with appended .json suffix in a configurable local and then in a
+   distro directory. If none could be found in either, it will fall back trying
+   to use a built-in one.
+
+   The built-in 'null' profile provides backwards compatibility with
+   libtpms v0.9 but also restricts the user to use only TPM features that were
+   available at the time of libtpms v0.9. The built-in 'custom' profile, or
+   those with the prefix 'custom:' in the name, are the
+   only profiles that a user can modify and where the ``removeDisabled``
+   attribute has any effect. This attribute is particularly useful when a host
+   is running in FIPS mode and therefore some crypto algorithms (camellia,
+   tdes, unpadded RSA encryption, 1024-bit RSA keys, and others) are
+   disabled. When it is set to ``check`` (recommended) then only those
+   algorithms that are currently disabled will automatically be removed from
+   the 'custom' profile, while when it is set to ``fips-host`` then all
+   potentially disabled algorithms will be removed. :since:`Since 10.10.0`
+
+   TPM profiles provided by a distro can be referenced with the 'distro:'
+   prefix. Locally created TPM profiles can be referenced with the
+   'local:' prefix.
+
+   For further information about TPM profiles see the man pages for ``swtpm``
+   (swtpm v0.10).
+
 ``encryption``
    The ``encryption`` element allows the state of a TPM emulator to be
    encrypted. The ``secret`` must reference a secret object that holds the
@@ -8647,8 +8947,8 @@ Vsock
 ~~~~~
 
 A vsock host/guest interface. The ``model`` attribute defaults to ``virtio``.
-:since:`Since 5.2.0` ``model`` can also be 'virtio-transitional' and
-'virtio-non-transitional', see `Virtio transitional devices`_  for more details.
+:since:`Since 5.2.0` ``model`` can also be 'virtio-transitional' or
+'virtio-non-transitional', see `virtio device models`_ for more details.
 The optional attribute ``address`` of the ``cid`` element specifies the CID
 assigned to the guest. If the attribute ``auto`` is set to ``yes``, libvirt will
 assign a free CID automatically on domain startup. :since:`Since 4.4.0`
@@ -8949,7 +9249,7 @@ attributes and elements with ``type='sev'`` but differs in others. Example confi
       <guestVisibleWorkarounds>...</guestVisibleWorkarounds>
       <idBlock>...</idBlock>
       <idAuth>...</idAuth>
-      <hostData>.../hostData>
+      <hostData>...</hostData>
     </launchSecurity>
     ...
   </domain>

docs/formatdomaincaps.rst

@@ -193,12 +193,12 @@ CPUs <formatdomain.html#cpu-model-and-topology>`__.
          <feature policy='require' name='vmx'/>
        </mode>
        <mode name='custom' supported='yes'>
-         <model usable='no' deprecated='no' vendor='Intel'>Broadwell</model>
+         <model usable='no' deprecated='no' vendor='Intel' canonical='Broadwell-v1'>Broadwell</model>
          <blockers model='Broadwell'>
            <feature name='hle'/>
            <feature name='rtm'/>
          </blockers>
-         <model usable='yes' deprecated='no' vendor='Intel'>Broadwell-noTSX</model>
+         <model usable='yes' deprecated='no' vendor='Intel' canonical='Broadwell-v2'>Broadwell-noTSX</model>
          <model usable='no' deprecated='no' vendor='AMD'>EPYC-Milan</model>
          <blockers model='EPYC-Milan'>
            <feature name='clzero'/>
@@ -265,7 +265,9 @@ more details about it:
    the hypervisor's policy on usage of this model :since:`(since 7.1.0)`. The
    ``vendor`` attribute :since:`(since 8.9.0)` contains the vendor of the CPU
    model for users who want to use CPU models with specific vendors only. CPU
-   models with undefined vendor will be listed with ``vendor='unkwnown'``.
+   models with undefined vendor will be listed with ``vendor='unkwnown'``. The
+   ``canonical`` attribute :since:`(since 10.10.0)` contains a canonical name of
+   the CPU model if the model is actually an alias to another one.
 
 I/O Threads
 ~~~~~~~~~~~
@@ -671,6 +673,30 @@ Interface device corresponds to `network interface
 ``backendType``
    Options for the ``type`` attribute of the ``<backend/>`` element
 
+Panic device
+^^^^^^^^^^^^
+
+Interface device corresponds to `panic device
+<formatdomain.html#panic-device>`__ (``<panic/>``) in domain XML.
+
+::
+
+  <domainCapabilities>
+    ...
+    <devices>
+      <panic supported='yes'>
+        <enum name='model'>
+          <value>isa</value>
+          <value>hyperv</value>
+        </enum>
+      </panic>
+      ...
+    </devices>
+  </domainCapabilities>
+
+``model``
+   Options for the ``model`` attribute of the ``<panic/>`` element
+
 
 Features
 ~~~~~~~~

docs/formatnetwork.rst

@@ -520,28 +520,29 @@ VLAN tags to apply to the guest's network traffic :since:`Since 0.10.0`.
 
 Network connections that support guest-transparent VLAN tagging include
 ``type='bridge'`` interfaces connected to an Open vSwitch bridge, SRIOV
-Virtual Functions (VF) used via ``type='hostdev'`` (direct device assignment)
-and, :since:`since 1.3.5`, SRIOV VFs used via ``type='direct'`` with
-``mode='passthrough'`` (macvtap "passthru" mode). All other
-connection types, including standard linux bridges and libvirt's own virtual
-networks, **do not** support it. 802.1Qbh (vn-link) and 802.1Qbg (VEPA) switches
-provide their own way (outside of libvirt) to tag guest traffic onto a specific
-VLAN. Each tag is given in a separate ``<tag>`` subelement of ``<vlan>`` (for
-example: ``<tag id='42'/>``). For VLAN trunking of multiple tags (which is
-supported only on Open vSwitch connections), multiple ``<tag>`` subelements can
-be specified, which implies that the user wants to do VLAN trunking on the
-interface for all the specified tags. In the case that VLAN trunking of a single
-tag is desired, the optional attribute ``trunk='yes'`` can be added to the
-toplevel ``<vlan>`` element to differentiate trunking of a single tag from
-normal tagging.
+Virtual Functions (VF) used via ``type='hostdev'`` (direct device assignment),
+:since:`since 1.3.5`, SRIOV VFs used via ``type='direct'`` with
+``mode='passthrough'`` (macvtap "passthru" mode) and, :since:`since 11.0.0`,
+standard linux bridges. All other connection types, including libvirt's own
+virtual networks, **do not** support it. 802.1Qbh (vn-link) and 802.1Qbg (VEPA)
+switches provide their own way (outside of libvirt) to tag guest traffic onto a
+specific VLAN. Each tag is given in a separate ``<tag>`` subelement of
+``<vlan>`` (for example: ``<tag id='42'/>``). For VLAN trunking of multiple
+tags (which is supported on Open vSwitch connections and standard linux
+bridges), multiple ``<tag>`` subelements can be specified, which implies that
+the user wants to do VLAN trunking on the interface for all the specified tags.
+In the case that VLAN trunking of a single tag is desired, the optional
+attribute ``trunk='yes'`` can be added to the toplevel ``<vlan>`` element to
+differentiate trunking of a single tag from normal tagging.
 
-For network connections using Open vSwitch it is also possible to configure
-'native-tagged' and 'native-untagged' VLAN modes :since:`Since 1.1.0`. This is
-done with the optional ``nativeMode`` attribute on the ``<tag>`` subelement:
-``nativeMode`` may be set to 'tagged' or 'untagged'. The ``id`` attribute of the
-``<tag>`` subelement containing ``nativeMode`` sets which VLAN is considered to
-be the "native" VLAN for this interface, and the ``nativeMode`` attribute
-determines whether or not traffic for that VLAN will be tagged.
+For network connections using Open vSwitch :since:`since 1.1.10` and standard
+linux bridges :since:`since 11.0.0` it is also possible to configure
+'native-tagged' and 'native-untagged' VLAN modes. This is done with the optional
+``nativeMode`` attribute on the ``<tag>`` subelement: ``nativeMode`` may be set
+to 'tagged' or 'untagged'. The ``id`` attribute of the ``<tag>`` subelement
+containing ``nativeMode`` sets which VLAN is considered to be the "native" VLAN
+for this interface, and the ``nativeMode`` attribute determines whether or not
+traffic for that VLAN will be tagged.
 
 ``<vlan>`` elements can also be specified in a ``<portgroup>`` element, as well
 as directly in a domain's ``<interface>`` element. In the case that a vlan tag

docs/formatsecret.rst

@@ -318,7 +318,7 @@ be omitted if the file contents are base64-encoded.
 
 ::
 
-   # virsh secret-set-value 6dd3e4a5-1d76-44ce-961f-f119f5aad935 --file --plain secretinfile
+   # virsh secret-set-value 6dd3e4a5-1d76-44ce-961f-f119f5aad935 --file secretinfile --plain
    Secret value set
 
 **WARNING** The following approach is **insecure** and deprecated. The secret

docs/index.rst

@@ -16,7 +16,7 @@ The libvirt project:
    `QEMU <drvqemu.html>`__,
    `Xen <drvxen.html>`__,
    `Virtuozzo <drvvirtuozzo.html>`__,
-   `VMWare ESX <drvesx.html>`__,
+   `VMware ESX <drvesx.html>`__,
    `LXC <drvlxc.html>`__,
    `BHyve <drvbhyve.html>`__ and
    `more <drivers.html>`__

docs/kbase/virtiofs.rst

@@ -13,9 +13,13 @@ is designed to offer local file system semantics and performance.
 
 See https://virtio-fs.gitlab.io/
 
-*Note:* virtiofs currently does not support migration so operations such as
-migration, save/managed-save, or snapshots with memory are not supported if
-a VM has a virtiofs filesystem connected.
+*Note:* Older versions of ``virtiofsd`` (prior to ``1.11``)  do not not support
+migration so operations such as migration, save/managed-save, or snapshots with
+memory may not supported if a VM has a virtiofs filesystem connected.
+
+Additionally snapshot operations managed by libvirt do not snapshot the state
+of the files shared via ``virtiofs``, and thus reverting to an earlier state is
+not recommended.
 
 Sharing a host directory with a guest
 =====================================

docs/manpages/virsh.rst

@@ -568,6 +568,7 @@ domcapabilities
 
    domcapabilities [virttype] [emulatorbin] [arch] [machine]
                    [--xpath EXPRESSION] [--wrap]
+                   [--disable-deprecated-features]
 
 
 Print an XML document describing the domain capabilities for the
@@ -609,6 +610,11 @@ a standalone document, however, for ease of additional processing,
 the **--wrap** argument will cause the matching node to be wrapped
 in a common root node.
 
+The **--disable-deprecated-features** argument will modify the contents
+of host-model CPU XML, updating the features list with any features
+flagged as deprecated for the CPU model by the hypervisor. These
+features will be paired with the "disable" policy.
+
 
 pool-capabilities
 -----------------
@@ -948,15 +954,22 @@ provide on the host. (This is different from ``cpu-compare`` which compares the
 CPU definition with the host CPU without considering any specific hypervisor
 and its abilities.)
 
-The XML *FILE* may contain either a host or guest CPU definition. The host CPU
-definition is the <cpu> element and its contents as printed by the
-``capabilities`` command. The guest CPU definition is the <cpu> element and its
-contents from the domain XML definition or the CPU definition created from the
-host CPU model found in the domain capabilities XML (printed by the
-``domcapabilities`` command). In addition to the <cpu> element itself, this
-command accepts full domain XML, capabilities XML, or domain capabilities XML
-containing the CPU definition. For more information on guest CPU definition
-see: `https://libvirt.org/formatdomain.html#elementsCPU <https://libvirt.org/formatdomain.html#cpu-model-and-topology>`__.
+The XML *FILE* should contain a guest CPU definition: either the ``<cpu>``
+element and its contents from a domain XML definition or a CPU definition
+created from the host CPU model found in the ``<mode name="host-model">``
+element in the domain capabilities XML (printed by the ``domcapabilities``
+command). The ``<mode name="host-model">`` element itself or even its
+``<cpu>`` parent element found in domain capabilities XML is not accepted.
+The element has to be transformed into an actual CPU definition. For more
+information on guest CPU definition see:
+`https://libvirt.org/formatdomain.html#elementsCPU <https://libvirt.org/formatdomain.html#cpu-model-and-topology>`__.
+
+Alternatively this command will automatically extract the CPU definition when
+provided with a full domain or domain capabilities XML.
+
+For historical reasons the XML *FILE* may also contain a host CPU definition,
+but such usage is strongly discouraged as it will most likely provide incorrect
+results.
 
 The *virttype* option specifies the virtualization type (usable in the 'type'
 attribute of the <domain> top level element from the domain XML). *emulator*
@@ -987,15 +1000,19 @@ As an alternative for *FILE* in case the XML would only contain a CPU model
 with no additional features the CPU model name itself can be passed as *model*.
 Exactly one of *FILE* and *model* must be used.
 
-The XML *FILE* may contain either host or guest CPU definitions describing the
-host CPU model. The host CPU definition is the <cpu> element and its contents
-as printed by ``capabilities`` command. The guest CPU definition may be created
-from the host CPU model found in domain capabilities XML (printed by
-``domcapabilities`` command). In addition to the <cpu> elements, this command
-accepts full capabilities XMLs, or domain capabilities XMLs containing the CPU
-definitions. It is recommended to use only the CPU definitions from domain
-capabilities, as on some architectures using the host CPU definition may either
-fail or provide unexpected results.
+The XML *FILE* should contain guest CPU definitions created from the host CPU
+model found in the ``<mode name="host-model">`` element domain capabilities
+XMLs (printed by the ``domcapabilities`` command on each host). The
+``<mode name="host-model">`` elements themselves or even their ``<cpu>``
+parent  elements found in domain capabilities XMLs are not accepted. The
+elements have to be transformed into actual CPU definitions.
+
+Alternatively this command will automatically extract the CPU definitions when
+provided with domain capabilities XMLs.
+
+For historical reasons the XML *FILE* may also contain host CPU definitions,
+but such usage is strongly discouraged as it will most likely provide incorrect
+results.
 
 When *FILE* contains only a single CPU definition, the command will print the
 same CPU with restrictions imposed by the capabilities of the hypervisor.
@@ -2428,14 +2445,15 @@ When selecting the *--state* group the following fields are returned:
 * ``vcpu.<num>.state`` - state of the virtual CPU <num>, as
   number from virVcpuState enum
 * ``vcpu.<num>.time`` - virtual cpu time spent by virtual
-  CPU <num> (in microseconds)
-* ``vcpu.<num>.wait`` - virtual cpu time spent by virtual
-  CPU <num> waiting on I/O (in microseconds)
+  CPU <num> (in nanoseconds)
+* ``vcpu.<num>.wait`` - time the vCPU <num> thread was waiting in the runqueue
+  as the scheduler has something else running ahead of it (in nanoseconds),
+  requires CONFIG_SCHED_INFO on Linux
 * ``vcpu.<num>.halted`` - virtual CPU <num> is halted: yes or
   no (may indicate the processor is idle or even disabled,
   depending on the architecture)
-* ``vcpu.<num>.delay`` - time the vCPU <num> thread was enqueued by the
-  host scheduler, but was waiting in the queue instead of running.
+* ``vcpu.<num>.delay`` - time the vCPU <num> thread was waiting in the runqueue
+  as the scheduler has something else running ahead of it (in nanoseconds).
   Exposed to the VM as a steal time.
 
 This group of statistics also reports additional hypervisor-originating per-vCPU
@@ -2912,7 +2930,7 @@ Success is always reported in this case.
 
 You can limit the types of information that are returned by specifying one or
 more flags.  Available information types flags are *--user*, *--os*,
-*--timezone*, *--hostname*, *--filesystem*, *--disk* and *--interface*.
+*--timezone*, *--hostname*, *--filesystem*, *--disk*, *--interface* and *--load*.
 If an explicitly requested information type is not supported by the guest agent
 at that point, the processes will provide an exit code of 1.
 
@@ -2981,6 +2999,7 @@ returned:
 * ``disk.<num>.serial`` -  optional disk serial number
 * ``disk.<num>.alias`` - the device alias of the disk (e.g. sda)
 * ``disk.<num>.guest_alias`` - optional alias assigned to the disk
+* ``disk.<num>.guest_bus`` - bus type as reported by the guest
 
 *--interface* returns:
 * ``if.count`` - the number of interfaces defined on this domain
@@ -2991,6 +3010,12 @@ returned:
 * ``if.<num>.addr.<num1>.addr`` - the IP address of addr <num1>
 * ``if.<num>.addr.<num1>.prefix`` - the prefix of IP address of addr <num1>
 
+*--load* returns:
+* ``load.1m``  - average load in guest for last 1 minute
+* ``load.5m``  - average load in guest for last 5 minutes
+* ``load.15m`` - average load in guest for last 15 minutes
+
+
 guestvcpus
 ----------
 
@@ -3401,6 +3426,7 @@ migrate
       [--parallel [--parallel-connections connections]]
       [--bandwidth bandwidth] [--tls-destination hostname]
       [--disks-uri URI] [--copy-storage-synchronous-writes]
+      [--available-switchover-bandwidth bandwidth]
 
 Migrate domain to another host.  Add *--live* for live migration; <--p2p>
 for peer-2-peer migration; *--direct* for direct migration; or *--tunnelled*
@@ -3409,7 +3435,8 @@ starting the domain on destination and without stopping it on source host.
 Offline migration may be used with inactive domains and it must be used with
 *--persistent* option.
 
-*--persistent* leaves the domain persistent on destination host,
+*--persistent* leaves the domain persistent on destination host (See below
+for quirks when used together with *--xml*),
 *--undefinesource* undefines the domain on the source host, and *--suspend*
 leaves the domain paused on the destination host.
 
@@ -3489,13 +3516,18 @@ such as GFS2 or GPFS. If you are sure the migration is safe or you just do not
 care, use *--unsafe* to force the migration.
 
 *dname* is used for renaming the domain to new name during migration, which
-also usually can be omitted.  Likewise, *--xml* ``file`` is usually
-omitted, but can be used to supply an alternative XML file for use on
-the destination to supply a larger set of changes to any host-specific
-portions of the domain XML, such as accounting for naming differences
-between source and destination in accessing underlying storage.
-If *--persistent* is enabled, *--persistent-xml* ``file`` can be used to
-supply an alternative XML file which will be used as the persistent guest
+also usually can be omitted.
+
+*--xml* ``file``, while usually not required, can be used to supply an
+alternative XML file for use on the destination to supply a larger set of
+changes to any host-specific portions of the domain XML, such as accounting for
+naming differences between source and destination in accessing underlying
+storage. If *--xml* is used together with *--persistent* it's usually required
+to provide a persistent XML definition via *--persistent-xml* (see below) which
+is fixed the same way as the XML passed to *--file* was.
+
+If *--persistent* is enabled, *--persistent-xml* ``file`` can be used
+to supply an alternative XML file which will be used as the persistent guest
 definition on the destination host.
 
 *--timeout* ``seconds`` tells virsh to run a specified action when live
@@ -3651,6 +3683,17 @@ the context of the existing socket because it is different from the file
 representation of the socket and the context is chosen by its creator (usually
 by using *setsockcreatecon{,_raw}()* functions).
 
+Optional *--available-switchover-bandwidth* overrides the automatically
+computed bandwidth (in MiB/s) available for the final phase of (pre-copy)
+migration during which CPUs are stopped and all the remaining memory and device
+state is transferred. Knowing this bandwidth is important for accurate
+estimation of the domain downtime and deciding the right moment for switching
+over. Normally this would be estimated based on the bandwidth used by
+migration, but this could be lower than the actual available bandwidth. Using
+this option may help with migration convergence when the migration would keep
+iterating over and over thinking there's not enough bandwidth to comply with
+the configured maximum downtime.
+
 
 migrate-compcache
 -----------------
@@ -5508,15 +5551,16 @@ List all of the devices available on the node that are known by libvirt.
 separated by comma, e.g. --cap pci,scsi. Valid capability types include
 'system', 'pci', 'usb_device', 'usb', 'net', 'scsi_host', 'scsi_target',
 'scsi', 'storage', 'fc_host', 'vports', 'scsi_generic', 'drm', 'mdev',
-'mdev_types', 'ccw', 'css', 'ap_card', 'ap_queue', 'ap_matrix'. By default,
-only active devices are listed. *--inactive* is used to list only inactive
-devices, and *--all* is used to list both active and inactive devices.
-*--persistent* is used to list only persistent devices, and *--transient* is
-used to list only transient devices. Not providing *--persistent* or
-*--transient* will list all devices unless filtered otherwise. *--transient*
-is mutually exclusive with *--persistent* and *--inactive*.
-If *--tree* is used, the output is formatted in a tree representing parents of
-each node. *--tree* is mutually exclusive with all other options but *--all*.
+'mdev_types', 'ccw', 'ccwgroup', 'ccwgroup_member', 'css', 'ap_card',
+'ap_queue', 'ap_matrix'. By default, only active devices are listed.
+*--inactive* is used to list only inactive devices, and *--all* is used to
+list both active and inactive devices. *--persistent* is used to list only
+persistent devices, and *--transient* is used to list only transient devices.
+Not providing *--persistent* or *--transient* will list all devices unless
+filtered otherwise. *--transient* is mutually exclusive with *--persistent*
+and *--inactive*. If *--tree* is used, the output is formatted in a tree
+representing parents of each node. *--tree* is mutually exclusive with all
+other options but *--all*.
 
 
 nodedev-reattach

docs/nss.rst

@@ -1,161 +1,119 @@
+.. role:: since
+
 ==================
 Libvirt NSS module
 ==================
 
 .. contents::
 
-When it comes to managing guests and executing commands inside them, logging
-into guest operating system and doing the job is convenient. Users are used to
-ssh in this case. Ideally:
+Effectively managing guests often requires connecting to them via SSH, same as
+you would for any remote machine. Ideally
 
-``ssh user@virtualMachine``
+::
 
-would be nice. But depending on virtual network configuration it might not be
-always possible. For instance, when using libvirt NATed network it's dnsmasq
-(spawned by libvirt) who assigns IP addresses to domains. But by default, the
-dnsmasq process is then not consulted when it comes to host name translation.
-Users work around this problem by configuring their libvirt network to assign
-static IP addresses and maintaining ``/etc/hosts`` file in sync. But this puts
-needless burden onto users. This is where NSS module comes handy.
+   $ ssh user@mydomain
+
+would work out of the box, but depending on the network configuration that
+might not be the case. Setting up the libvirt NSS module is a one-time
+operation that makes the process of connecting from the host to the guests
+running on it much more convenient.
+
+Note that this feature only works in certain scenarios. See the
+`limitations`_ section for more information.
 
 Installation
 ------------
 
-Installing the module is really easy:
+Installing the module on Fedora or RHEL is really easy:
 
 ::
 
-   # yum install libvirt-nss
+   # dnf install libvirt-nss
+
+The package might have a different name on other distributions, but the process
+of installing it will be similar.
 
 Configuration
 -------------
 
-Enabling the module is really easy. Just add **libvirt** into
-``/etc/nsswitch.conf`` file. For instance:
+If you're running a new enough version of Fedora (>= 37) or RHEL (>= 10), then
+you can use ``authselect`` to enable the module with a single command:
 
 ::
 
-   $ cat /etc/nsswitch.conf
-   # /etc/nsswitch.conf:
-   passwd:      compat
-   shadow:      compat
-   group:       compat
-   hosts:       files libvirt dns
-   # ...
+   # authselect enable-feature with-libvirt
 
-So, in this specific case, whenever ssh program is looking up the host user is
-trying to connect to, **files** module is consulted first (which boils down to
-looking up the host name in ``/etc/hosts`` file), if not found **libvirt**
-module is consulted then. The DNS is the last effort then, if none of the
-previous modules matched the host in question. Therefore users should consider
-the order in which they want the modules to lookup given host name.
+For other distributions, you will have to manually update the configuration in
+``/etc/nsswitch.conf`` so that the ``hosts`` line looks similar to
 
-Sources of information
+::
+
+   hosts: files libvirt libvirt_guest dns
+
+With this configuration, whenever SSH (or any other application)
+tries to contact a guest, the ``files`` module will be consulted first (this
+boils down to searching for a matching line in ``/etc/hosts``); if no IP
+address could be found that way, the ``libvirt`` and ``libvirt_guest`` modules
+(see `below <variants_>`__ for differences between the two) will be used
+instead. Finally, if no previous attempt at resolving the hostname was
+successful, a DNS query will be performed.
+
+Variants
+--------
+
+There are two different variants of the module:
+
+* ``libvirt`` (:since:`since 1.3.3`) resolves hostnames based on the
+  information that the guest OS itself has reported to the DHCP server when
+  asking for an IP address, so it won't work if the guest OS hasn't been fully
+  configured yet;
+
+* ``libvirt_guest`` (:since:`since 3.0.0`) resolves hostnames by mapping them
+  directly to libvirt domain names, so it will work regardless of how the guest
+  OS is configured and will have more predictable results.
+
+The recommended configuration seen above enables both of them and gives
+priority to the former but it's also possible to enable only a single one, or
+to alter the precedence by simply changing the order in which they are listed.
+
+Implementation details
 ----------------------
 
-As of ``v3.0.0`` release, libvirt offers two NSS modules implementing two
-different methods of hostname translation. The first and older method is
-implemented by ``libvirt`` plugin and basically looks up the hostname to IP
-address translation in DHCP server records. Therefore this is dependent on
-hostname provided by guests. Thing is, not all the guests out there provide one
-in DHCP transactions, or not every sysadmin out there believes all the guests.
-Hence libvirt implements second method in ``libvirt_guest`` module which does
-libvirt guest name to IP address translation (regardless of hostname set in the
-guest).
+Whenever a Unix process needs to convert a hostname into an IP address, it will
+call the `gethostbyname() <https://linux.die.net/man/3/gethostbyname>`__ libc
+function or one of its variants.
 
-To enable either of the modules put their name into the ``nsswitch.conf`` file.
-For instance, to enable ``libvirt_guest`` module:
+Since multiple sources for this information are possible (for example the
+contents of ``/etc/hosts``, DNS, LDAP, etc.) a mechanism called
+`NSS <https://en.wikipedia.org/wiki/Name_Service_Switch>`__ has been created to
+make the name resolution process extensible. This allows each source to be
+implemented as a separate plugin that can be enabled or disabled based on the
+administrator's preferences.
+
+In the case of libvirt, the lookup is performed by inspecting the DHCP leases
+handed out by ``dnsmasq``, the software used to implement NATed networks. The
+results will be the same that would be reported by
 
 ::
 
-   $ cat /etc/nsswitch.conf
-   # /etc/nsswitch.conf:
-   hosts:       files libvirt_guest dns
-   # ...
+   $ virsh domifaddr --source lease mydomain
 
-Or users can enable both at the same time:
-
-::
-
-   $ cat /etc/nsswitch.conf
-   # /etc/nsswitch.conf:
-   hosts:       files libvirt libvirt_guest dns
-   # ...
-
-This configuration will mean that if hostname is not found by the ``libvirt``
-module (e.g. because a guest did not sent hostname during DHCP transaction), the
-``libvirt_guest`` module is consulted (and if the hostname matches libvirt guest
-name it will be resolved).
-
-How does it work?
------------------
-
-Whenever an Unix process wants to do a host name translation
-`gethostbyname() <https://linux.die.net/man/3/gethostbyname>`__ or some variant
-of it is called. This is a glibc function that takes a string containing the
-host name, crunch it and produces a list of IP addresses assigned to that host.
-Now, glibc developers made a really good decision when implementing the
-internals of the function when they decided to make the function pluggable.
-Since there can be several sources for the records (e.g. ``/etc/hosts`` file,
-DNS, LDAP, etc.) it would not make much sense to create one big implementation
-containing all possible cases. What they have done instead is this pluggable
-mechanism. Small plugins implementing nothing but specific technology for lookup
-process are provided and the function then calls those plugins. There is just
-one configuration file that instructs the lookup function in which order should
-the plugins be called and which plugins should be loaded. For more info reading
-`wiki page <https://en.wikipedia.org/wiki/Name_Service_Switch>`__ is
-recommended.
-
-And this is point where libvirt comes in. Libvirt provides plugin for the NSS
-ecosystem. For some time now libvirt keeps a list of assigned IP addresses for
-libvirt networks. The NSS plugin does no more than search the list trying to
-find matching record for given host name. When found, matching IP address is
-returned to the caller. If not found, translation process continues with the
-next plugin configured. At this point it is important to stress the order in
-which plugins are called. Users should be aware that a hostname might match in
-multiple plugins and right after first match, translation process is terminated
-and no other plugin is consulted. Therefore, if there are two different records
-for the same host name users should carefully chose the lookup order.
+except that things will work transparently for any application that uses the
+libc resolver, without it needing to link against libvirt or even be aware of
+its existence.
 
 Limitations
 -----------
 
-#. The ``libvirt`` NSS module matches only hostnames provided by guest. If the
-   libvirt name and one advertised by guest differs, the latter is matched.
-   However, as of ``v3.0.0`` there are two libvirt NSS modules translating both
-   hostnames provided by guest and libvirt guest names.
-#. The module works only in that cases where IP addresses are assigned by
-   dnsmasq spawned by libvirt. Libvirt NATed networks are typical example.
-
-*The following paragraph describes implementation limitation of the ``libvirt``
-NSS module.* These limitation are result of libvirt's internal implementation.
-While libvirt can report IP addresses regardless of their origin, a public API
-must be used to obtain those. However, for the API a connection object is
-required. Doing that for every name translation request would be too costly.
-Fortunately, libvirt spawns dnsmasq for NATed networks. Not only that, it
-provides small executable that on each IP address space change updates an
-internal list of addresses thus keeping it in sync. The NSS module then merely
-consults the list trying to find the match. Users can view the list themselves:
-
-::
-
-   virsh net-dhcp-leases $network
-
-where ``$network`` iterates through all running networks. So the module does
-merely the same as
-
-::
-
-   virsh domifaddr --source lease $domain
-
-If there's no record for either of the aforementioned commands, it's very likely
-that NSS module won't find anything and vice versa. As of ``v3.0.0`` libvirt
-provides ``libvirt_guest`` NSS module that doesn't have this limitation.
-However, the statement is still true for the ``libvirt`` NSS module.
+Since the libvirt NSS module works by looking at ``dnsmasq``, it can only work
+for guests that are connected to a NATed libvirt network. Guests that obtain
+their IP addresses in any other way (usermode networking, assigned network
+devices and so on) will not be able to have their hostnames resolved through
+it.
 
 Alternatives
 ------------
 
-As of ``v10.3.0`` libvirt implements an `SSH proxy <ssh-proxy.html>`__ which
-doesn't require any network interface to SSH into the guest as SSH flows
-through a VSOCK device.
+:since:`Since 10.3.0`, libvirt implements an `SSH proxy <ssh-proxy.html>`__.
+This allows the use of SSH even for guests that have no network connectivity,
+by communicating over VSOCK.

include/libvirt/libvirt-nodedev.h

@@ -90,6 +90,8 @@ typedef enum {
     VIR_CONNECT_LIST_NODE_DEVICES_CAP_AP_QUEUE      = 1 << 19, /* s390 AP Queue (Since: 7.0.0) */
     VIR_CONNECT_LIST_NODE_DEVICES_CAP_AP_MATRIX     = 1 << 20, /* s390 AP Matrix (Since: 7.0.0) */
     VIR_CONNECT_LIST_NODE_DEVICES_CAP_VPD           = 1 << 21, /* Device with VPD (Since: 7.9.0) */
+    VIR_CONNECT_LIST_NODE_DEVICES_CAP_CCWGROUP_DEV  = 1 << 22, /* s390 CCWGROUP device (Since: 11.1.0) */
+    VIR_CONNECT_LIST_NODE_DEVICES_CAP_CCWGROUP_MEMBER = 1 << 23, /* s390 CCW device member of CCWGROUP device (Since: 11.1.0) */
 
     VIR_CONNECT_LIST_NODE_DEVICES_PERSISTENT        = 1 << 28, /* Persisted devices (Since: 10.1.0) */
     VIR_CONNECT_LIST_NODE_DEVICES_TRANSIENT         = 1 << 29, /* Transient devices (Since: 10.1.0) */

libvirt.spec.in

@@ -29,12 +29,14 @@
 %define arches_zfs              %{arches_x86} %{power64} %{arm}
 %define arches_numactl          %{arches_x86} %{power64} aarch64 s390x
 %define arches_numad            %{arches_x86} %{power64} aarch64
+%define arches_ch               x86_64 aarch64
 
 # The hypervisor drivers that run in libvirtd
 %define with_qemu          0%{!?_without_qemu:1}
 %define with_lxc           0%{!?_without_lxc:1}
 %define with_libxl         0%{!?_without_libxl:1}
 %define with_vbox          0%{!?_without_vbox:1}
+%define with_ch            0%{!?_without_ch:1}
 
 %ifarch %{arches_qemu_kvm}
     %define with_qemu_kvm      %{with_qemu}
@@ -42,6 +44,12 @@
     %define with_qemu_kvm      0
 %endif
 
+%if 0%{?fedora} >= 42
+    %define with_account_add 0
+%else
+    %define with_account_add 1
+%endif
+
 %define with_qemu_tcg      %{with_qemu}
 
 # RHEL disables TCG on all architectures
@@ -123,6 +131,9 @@
 %ifnarch %{arches_ceph}
     %define with_storage_rbd 0
 %endif
+%ifnarch %{arches_ch}
+    %define with_ch 0
+%endif
 
 # RHEL doesn't ship many hypervisor drivers
 %if 0%{?rhel}
@@ -132,6 +143,7 @@
     %define with_libxl 0
     %define with_hyperv 0
     %define with_lxc 0
+    %define with_ch 0
 %endif
 
 %define with_firewalld_zone 0%{!?_without_firewalld_zone:1}
@@ -317,6 +329,9 @@ Obsoletes: libvirt-daemon-uml <= 5.0.0
 %if %{with_vbox}
 Requires: libvirt-daemon-driver-vbox = %{version}-%{release}
 %endif
+%if %{with_ch}
+Requires: libvirt-daemon-driver-ch = %{version}-%{release}
+%endif
 Requires: libvirt-daemon-driver-nwfilter = %{version}-%{release}
 Requires: libvirt-daemon-driver-interface = %{version}-%{release}
 Requires: libvirt-daemon-driver-secret = %{version}-%{release}
@@ -331,7 +346,7 @@ Requires: libvirt-libs = %{version}-%{release}
 BuildRequires: python3-docutils
 BuildRequires: meson >= 0.56.0
 BuildRequires: ninja-build
-BuildRequires: git
+BuildRequires: git-core
 BuildRequires: perl-interpreter
 BuildRequires: python3
 BuildRequires: python3-pytest
@@ -348,7 +363,7 @@ BuildRequires: gcc
     %if %{with_libxl}
 BuildRequires: xen-devel
     %endif
-BuildRequires: glib2-devel >= 2.58
+BuildRequires: glib2-devel >= 2.66
 BuildRequires: libxml2-devel
 BuildRequires: readline-devel
 BuildRequires: pkgconfig(bash-completion) >= 2.0
@@ -526,8 +541,10 @@ Requires(posttrans): /usr/bin/systemctl
 Requires(preun): /usr/bin/systemctl
 # libvirtd depends on 'messagebus' service
 Requires: dbus
+    %if %{with_account_add}
 # For uid creation during pre
 Requires(pre): shadow-utils
+    %endif
 # Needed by /usr/libexec/libvirt-guests.sh script.
     %if 0%{?fedora}
 Requires: gettext-runtime
@@ -554,6 +571,7 @@ resources
 %package daemon-plugin-lockd
 Summary: lockd client plugin for virtlockd
 Requires: libvirt-libs = %{version}-%{release}
+Requires: libvirt-daemon-common = %{version}-%{release}
 Requires: libvirt-daemon-lock = %{version}-%{release}
 
 %description daemon-plugin-lockd
@@ -1026,6 +1044,20 @@ Server side daemon and driver required to manage the virtualization
 capabilities of VirtualBox
     %endif
 
+    %if %{with_ch}
+%package daemon-driver-ch
+Summary: Cloud-Hypervisor driver plugin for libvirtd daemon
+Requires: libvirt-daemon-common = %{version}-%{release}
+Requires: libvirt-daemon-log = %{version}-%{release}
+Requires: libvirt-libs = %{version}-%{release}
+
+%description daemon-driver-ch
+The ch driver plugin for the libvirtd daemon, providing
+an implementation of the hypervisor driver APIs by
+Cloud-Hypervisor
+    %endif
+
+
 %package client
 Summary: Client side utilities of the libvirt library
 Requires: libvirt-libs = %{version}-%{release}
@@ -1071,6 +1103,10 @@ Wireshark dissector plugin for better analysis of libvirt RPC traffic.
 %package login-shell
 Summary: Login shell for connecting users to an LXC container
 Requires: libvirt-libs = %{version}-%{release}
+        %if %{with_account_add}
+# For uid creation during pre
+Requires(pre): shadow-utils
+        %endif
 
 %description login-shell
 Provides the set-uid virt-login-shell binary that is used to
@@ -1093,6 +1129,7 @@ Requires: sanlock >= 2.4
 #for virt-sanlock-cleanup require augeas
 Requires: augeas
 Requires: libvirt-libs = %{version}-%{release}
+Requires: libvirt-daemon-common = %{version}-%{release}
 Obsoletes: libvirt-lock-sanlock < 9.1.0
 Provides: libvirt-lock-sanlock = %{version}-%{release}
 
@@ -1188,9 +1225,15 @@ exit 1
 %endif
 
 %if %{with_esx}
-    %define arg_esx -Ddriver_esx=enabled -Dcurl=enabled
+    %define arg_esx -Ddriver_esx=enabled
 %else
-    %define arg_esx -Ddriver_esx=disabled -Dcurl=disabled
+    %define arg_esx -Ddriver_esx=disabled
+%endif
+
+%if %{with_esx} || %{with_ch}
+    %define arg_curl -Dcurl=enabled
+%else
+    %define arg_curl -Dcurl=disabled
 %endif
 
 %if %{with_hyperv}
@@ -1205,6 +1248,12 @@ exit 1
     %define arg_vmware -Ddriver_vmware=disabled
 %endif
 
+%if %{with_ch}
+    %define arg_ch -Ddriver_ch=enabled
+%else
+    %define arg_ch -Ddriver_ch=disabled
+%endif
+
 %if %{with_storage_rbd}
     %define arg_storage_rbd -Dstorage_rbd=enabled
 %else
@@ -1335,11 +1384,12 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec)
            -Ddriver_remote=enabled \
            -Ddriver_test=enabled \
            %{?arg_esx} \
+           %{?arg_curl} \
            %{?arg_hyperv} \
            %{?arg_vmware} \
+           %{?arg_ch} \
            -Ddriver_vz=disabled \
            -Ddriver_bhyve=disabled \
-           -Ddriver_ch=disabled \
            %{?arg_remote_mode} \
            -Ddriver_interface=enabled \
            -Ddriver_network=enabled \
@@ -1419,6 +1469,7 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec)
   -Dblkid=disabled \
   -Dcapng=disabled \
   -Ddriver_bhyve=disabled \
+  -Ddriver_ch=disabled \
   -Ddriver_hyperv=disabled \
   -Ddriver_interface=disabled \
   -Ddriver_libvirtd=disabled \
@@ -1541,6 +1592,10 @@ rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/libvirtd.libxl
 rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/libvirtd_libxl.aug
 rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_libxl.aug
     %endif
+    %if ! %{with_ch}
+rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/libvirtd_ch.aug
+rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_ch.aug
+    %endif
 
 # Copied into libvirt-docs subpackage eventually
 mv $RPM_BUILD_ROOT%{_datadir}/doc/libvirt libvirt-docs
@@ -1751,10 +1806,12 @@ export VIR_TEST_DEBUG=1
 %pre daemon-common
 %libvirt_sysconfig_pre libvirt-guests
 %libvirt_systemd_oneshot_pre libvirt-guests
+    %if %{with_account_add}
 # 'libvirt' group is just to allow password-less polkit access to libvirt
 # daemons. The uid number is irrelevant, so we use dynamic allocation.
 getent group libvirt >/dev/null || groupadd -r libvirt
 exit 0
+    %endif
 
 %posttrans daemon-common
 %libvirt_sysconfig_posttrans libvirt-guests
@@ -1877,6 +1934,7 @@ exit 0
 %libvirt_sysconfig_pre virtqemud
 %libvirt_systemd_unix_pre virtqemud
 
+        %if %{with_account_add}
 # We want soft static allocation of well-known ids, as disk images
 # are commonly shared across NFS mounts by id rather than name.
 # See https://docs.fedoraproject.org/en-US/packaging-guidelines/UsersAndGroups/
@@ -1892,6 +1950,7 @@ if ! getent passwd 'qemu' >/dev/null; then
   fi
 fi
 exit 0
+        %endif
 
 %posttrans daemon-driver-qemu
 %libvirt_sysconfig_posttrans virtqemud
@@ -1940,6 +1999,19 @@ exit 0
 %libvirt_systemd_unix_preun virtxend
     %endif
 
+    %if %{with_ch}
+%pre daemon-driver-ch
+%libvirt_sysconfig_pre virtchd
+%libvirt_systemd_unix_pre virtchd
+
+%posttrans daemon-driver-ch
+%libvirt_sysconfig_posttrans virtchd
+%libvirt_systemd_unix_posttrans virtchd
+
+%preun daemon-driver-ch
+%libvirt_systemd_unix_preun virtchd
+    %endif
+
 %pre daemon-config-network
 %libvirt_systemd_config_pre libvirtd
 %libvirt_systemd_config_pre virtnetworkd
@@ -2005,8 +2077,10 @@ done
 
     %if %{with_lxc}
 %pre login-shell
+        %if %{with_account_add}
 getent group virtlogin >/dev/null || groupadd -r virtlogin
 exit 0
+        %endif
     %endif
 %endif
 
@@ -2027,7 +2101,9 @@ exit 0
 %config(noreplace) %{_sysconfdir}/libvirt/libvirtd.conf
 %config(noreplace) %{_prefix}/lib/sysctl.d/60-libvirtd.conf
 %config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd
+%dir %{_datadir}/augeas/lenses
 %{_datadir}/augeas/lenses/libvirtd.aug
+%dir %{_datadir}/augeas/lenses/tests
 %{_datadir}/augeas/lenses/tests/test_libvirtd.aug
 %attr(0755, root, root) %{_sbindir}/libvirtd
 %{_mandir}/man8/libvirtd.8*
@@ -2048,9 +2124,11 @@ exit 0
 %dir %attr(0755, root, root) %{_libdir}/libvirt/connection-driver/
 %dir %attr(0755, root, root) %{_libdir}/libvirt/storage-backend/
 %dir %attr(0755, root, root) %{_libdir}/libvirt/storage-file/
+%dir %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/
 %{_datadir}/polkit-1/actions/org.libvirt.unix.policy
 %{_datadir}/polkit-1/actions/org.libvirt.api.policy
 %{_datadir}/polkit-1/rules.d/50-libvirt.rules
+%{_sysusersdir}/libvirt.conf
 %dir %attr(0700, root, root) %{_localstatedir}/log/libvirt/
 %attr(0755, root, root) %{_libexecdir}/libvirt_iohelper
 %attr(0755, root, root) %{_bindir}/virt-ssh-helper
@@ -2078,7 +2156,6 @@ exit 0
 %{_mandir}/man8/virtlockd.8*
 
 %files daemon-plugin-lockd
-%dir %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/
 %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/lockd.so
 
 %files daemon-log
@@ -2217,7 +2294,6 @@ exit 0
 %ghost %dir %{_rundir}/libvirt/storage/
 %{_libdir}/libvirt/connection-driver/libvirt_driver_storage.so
 %{_libdir}/libvirt/storage-backend/libvirt_storage_backend_fs.so
-%{_libdir}/libvirt/storage-file/libvirt_storage_file_fs.so
 %{_mandir}/man8/virtstoraged.8*
 
 %files daemon-driver-storage-disk
@@ -2275,10 +2351,10 @@ exit 0
 %config(noreplace) %{_sysconfdir}/libvirt/qemu.conf
 %config(noreplace) %{_sysconfdir}/libvirt/qemu-lockd.conf
 %config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd.qemu
-%ghost %dir %attr(0770, %{qemu_user}, %{qemu_group}) %{_rundir}/libvirt/qemu/
+%ghost %dir %attr(0755, %{qemu_user}, %{qemu_group}) %{_rundir}/libvirt/qemu/
 %ghost %dir %attr(0770, %{qemu_user}, %{qemu_group}) %{_rundir}/libvirt/qemu/dbus/
-%ghost %dir %attr(0770, %{qemu_user}, %{qemu_group}) %{_rundir}/libvirt/qemu/passt/
-%ghost %dir %attr(0770, %{qemu_user}, %{qemu_group}) %{_rundir}/libvirt/qemu/slirp/
+%ghost %dir %attr(0755, %{qemu_user}, %{qemu_group}) %{_rundir}/libvirt/qemu/passt/
+%ghost %dir %attr(0755, %{qemu_user}, %{qemu_group}) %{_rundir}/libvirt/qemu/slirp/
 %ghost %dir %attr(0770, %{qemu_user}, %{qemu_group}) %{_rundir}/libvirt/qemu/swtpm/
 %dir %attr(0751, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/
 %dir %attr(0751, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/checkpoint/
@@ -2393,7 +2469,6 @@ exit 0
         %if %{with_libxl}
 %config(noreplace) %{_sysconfdir}/libvirt/libxl-sanlock.conf
         %endif
-%dir %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/
 %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/sanlock.so
 %{_datadir}/augeas/lenses/libvirt_sanlock.aug
 %{_datadir}/augeas/lenses/tests/test_libvirt_sanlock.aug
@@ -2403,6 +2478,19 @@ exit 0
 %attr(0755, root, root) %{_libexecdir}/libvirt_sanlock_helper
     %endif
 
+    %if %{with_ch}
+%files daemon-driver-ch
+%attr(0755, root, root) %{_sbindir}/virtchd
+%config(noreplace) %{_sysconfdir}/libvirt/virtchd.conf
+%{_datadir}/augeas/lenses/virtchd.aug
+%{_datadir}/augeas/lenses/tests/test_virtchd.aug
+%{_unitdir}/virtchd-admin.socket
+%{_unitdir}/virtchd-ro.socket
+%{_unitdir}/virtchd.service
+%{_unitdir}/virtchd.socket
+%{_libdir}/libvirt/connection-driver/libvirt_driver_ch.so
+    %endif
+
 %files client
 %{_mandir}/man1/virsh.1*
 %{_mandir}/man1/virt-xml-validate.1*
@@ -2433,15 +2521,17 @@ exit 0
 %{_libdir}/libvirt-lxc.so.*
 %{_libdir}/libvirt-admin.so.*
 %dir %{_datadir}/libvirt/
+%{_datadir}/libvirt/test-screenshot.png
 %dir %{_datadir}/libvirt/schemas/
+%{_datadir}/libvirt/schemas/*.rng
+%dir %{_datadir}/systemtap/tapset/
 %{_datadir}/systemtap/tapset/libvirt_probes*.stp
 %{_datadir}/systemtap/tapset/libvirt_functions.stp
     %if %{with_qemu}
 %{_datadir}/systemtap/tapset/libvirt_qemu_probes*.stp
     %endif
-%{_datadir}/libvirt/schemas/*.rng
+%dir %{_datadir}/libvirt/cpu_map
 %{_datadir}/libvirt/cpu_map/*.xml
-%{_datadir}/libvirt/test-screenshot.png
 
     %if %{with_wireshark}
 %files wireshark
@@ -2461,6 +2551,7 @@ exit 0
 %attr(4750, root, virtlogin) %{_bindir}/virt-login-shell
 %{_libexecdir}/virt-login-shell-helper
 %config(noreplace) %{_sysconfdir}/libvirt/virt-login-shell.conf
+%{_sysusersdir}/libvirt-login-shell.conf
 %{_mandir}/man1/virt-login-shell.1*
     %endif
 

meson.build

@@ -1,6 +1,6 @@
 project(
   'libvirt', 'c',
-  version: '10.9.0',
+  version: '11.2.0',
   license: 'LGPLv2+',
   meson_version: '>= 0.56.0',
   default_options: [
@@ -15,6 +15,10 @@ if meson.version().version_compare('>=0.64.0')
   fs = import('fs')
 endif
 
+i18n = import('i18n')
+
+po_dir = meson.project_source_root() / 'po'
+
 # figure out if we are building from git
 
 git = run_command('test', '-e', '.git', check: false).returncode() == 0
@@ -78,7 +82,7 @@ endif
 
 runstatedir = get_option('runstatedir')
 if runstatedir == ''
-  runstatedir = localstatedir / 'run'
+  runstatedir = '/run'
 endif
 
 initconfdir = get_option('initconfdir')
@@ -114,6 +118,8 @@ localedir = prefix / get_option('localedir')
 mandir = prefix / get_option('mandir')
 sbindir = prefix / get_option('sbindir')
 sharedstatedir = prefix / get_option('sharedstatedir')
+polkitactionsdir = datadir / 'polkit-1' / 'actions'
+polkitrulesdir = datadir / 'polkit-1' / 'rules.d'
 
 docdir = get_option('docdir')
 if docdir == ''
@@ -128,6 +134,11 @@ if sshconfdir == ''
   sshconfdir = sysconfdir / 'ssh' / 'ssh_config.d'
 endif
 
+connection_driver_install_dir = libdir / 'libvirt' / 'connection-driver'
+storage_backend_install_dir = libdir / 'libvirt' / 'storage-backend'
+storage_file_install_dir = libdir / 'libvirt' / 'storage-file'
+lock_driver_install_dir = libdir / 'libvirt' / 'lock-driver'
+
 
 # generate configmake.h header
 
@@ -998,7 +1009,7 @@ else
   endif
 endif
 
-glib_version = '2.58.0'
+glib_version = '2.66.0'
 glib_dep = dependency('glib-2.0', version: '>=' + glib_version)
 gobject_dep = dependency('gobject-2.0', version: '>=' + glib_version)
 if host_machine.system() == 'windows'
@@ -1576,8 +1587,15 @@ elif get_option('driver_lxc').enabled()
   error('linux and remote_driver are required for LXC')
 endif
 
-if not get_option('driver_ch').disabled() and host_machine.system() == 'linux' and (host_machine.cpu_family() == 'x86_64' or host_machine.cpu_family() == 'aarch64')
-  use_ch = true
+if not get_option('driver_ch').disabled()
+  if host_machine.system() == 'linux' and (host_machine.cpu_family() == 'x86_64' or host_machine.cpu_family() == 'aarch64')
+    use_ch = true
+  else
+    use_ch = false
+    if get_option('driver_ch').enabled()
+      error('linux on x86_64 or aarch64 is required to build Cloud-Hypervisor driver')
+    endif
+  endif
 
   if not conf.has('WITH_LIBVIRTD')
     use_ch = false
@@ -1787,11 +1805,11 @@ if conf.has('WITH_LIBVIRTD')
     conf.set('WITH_STORAGE_DIR', 1)
   endif
 
-  if not get_option('storage_disk').disabled() and devmapper_dep.found() and libparted_dep.found()
+  if not get_option('storage_disk').disabled() and libparted_dep.found()
     use_storage = true
     conf.set('WITH_STORAGE_DISK', 1)
   elif get_option('storage_disk').enabled()
-    error('You must install libparted and libdevmapper to compile libvirt with disk storage driver')
+    error('You must install libparted to compile libvirt with disk storage driver')
   endif
 
   if not get_option('storage_fs').disabled()

po/POTFILES

@@ -1,6 +1,7 @@
 src/access/viraccessapicheck.c
 src/access/viraccessapichecklxc.c
 src/access/viraccessapicheckqemu.c
+src/access/org.libvirt.api.policy.in
 src/admin/admin_client.h
 src/admin/admin_server_dispatch_stubs.h
 src/remote/remote_client_bodies.h
@@ -21,6 +22,8 @@ src/bhyve/bhyve_process.c
 src/ch/ch_conf.c
 src/ch/ch_domain.c
 src/ch/ch_driver.c
+src/ch/ch_events.c
+src/ch/ch_hostdev.c
 src/ch/ch_interface.c
 src/ch/ch_monitor.c
 src/ch/ch_process.c
@@ -93,6 +96,7 @@ src/hyperv/hyperv_util.c
 src/hyperv/hyperv_wmi.c
 src/hypervisor/domain_cgroup.c
 src/hypervisor/domain_driver.c
+src/hypervisor/domain_logcontext.c
 src/hypervisor/domain_interface.c
 src/hypervisor/virhostdev.c
 src/interface/interface_backend_netcf.c
@@ -179,7 +183,6 @@ src/qemu/qemu_hostdev.c
 src/qemu/qemu_hotplug.c
 src/qemu/qemu_interface.c
 src/qemu/qemu_interop_config.c
-src/qemu/qemu_logcontext.c
 src/qemu/qemu_migration.c
 src/qemu/qemu_migration_cookie.c
 src/qemu/qemu_migration_params.c
@@ -189,6 +192,7 @@ src/qemu/qemu_monitor_text.c
 src/qemu/qemu_namespace.c
 src/qemu/qemu_nbdkit.c
 src/qemu/qemu_passt.c
+src/qemu/qemu_postparse.c
 src/qemu/qemu_process.c
 src/qemu/qemu_qapi.c
 src/qemu/qemu_saveimage.c
@@ -199,6 +203,7 @@ src/qemu/qemu_validate.c
 src/qemu/qemu_vhost_user.c
 src/qemu/qemu_vhost_user_gpu.c
 src/qemu/qemu_virtiofs.c
+src/remote/libvirtd.policy.in
 src/remote/remote_daemon.c
 src/remote/remote_daemon_config.c
 src/remote/remote_daemon_dispatch.c
@@ -291,6 +296,7 @@ src/util/virhostcpu.c
 src/util/virhostmem.c
 src/util/virhostuptime.c
 src/util/viridentity.c
+src/util/virinhibitor.c
 src/util/virinitctl.c
 src/util/viriscsi.c
 src/util/virjson.c