October 2025 - Devel - libvirt List Archives

[RFC PATCH v5 0/7] qemu: Implement support for iommufd and multiple HW-accel vSMMUs
by Nathan Chen 02 Oct '25

02 Oct '25

Hi, This is a follow up to the fourth RFC patchset [0] for supporting multiple vSMMU instances and using iommufd to propagate DMA mappings to kernel for VM-assigned host devices in a qemu VM. This patchset implements support for specifying multiple <iommu> devices within the VM definition when smmuv3Dev IOMMU model is specified, and is tested with Shameer's v4 qemu RFC for HW-accelerated vSMMU devices [1] Moreover, it adds a new 'iommufd' attribute for hostdev devices to be associated with the iommufd object. For instance, specifying the iommufd object and associated hostdev in a VM definition with multiple IOMMUs, configured to be routed to pcie-expander-bus controllers in a way where VFIO device to SMMUv3 associations are matched with the host: <devices> ... <controller type='pci' index='1' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='252'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </controller> <controller type='pci' index='2' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='248'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </controller> ... <controller type='pci' index='21' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='21' port='0x0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </controller> <controller type='pci' index='22' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='22' port='0xa8'/> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </controller> ... <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> <iommu model='smmuv3Dev'> <driver parentIdx='1' accel='on' ats='on' ril='on' pasid='on' oas='44'/> </iommu> <iommu model='smmuv3Dev'> <driver parentIdx='2' accel='on' ats='on' ril='on' pasid='on' oas='44'/> </iommu> </devices> This would get translated to a qemu command line with the arguments below. Note that libvirt will open the /dev/iommu and VFIO cdev, passing the associated fd number to qemu: -device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ -device '{"driver":"pxb-pcie","bus_nr":248,"id":"pci.2","bus":"pcie.0","addr":"0x2"}' \ -device '{"driver":"pcie-root-port","port":0,"chassis":21,"id":"pci.21","bus":"pci.1","addr":"0x0"}' \ -device '{"driver":"pcie-root-port","port":168,"chassis":22,"id":"pci.22","bus":"pci.2","addr":"0x0"}' \ -object '{"qom-type":"iommufd","id":"iommufd0","fd":"24"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"smmuv3.0","accel":true,"ats":true,"ril":true,"pasid":true,"oas":44}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.2","id":"smmuv3.1","accel":true,"ats":true,"ril":true,"pasid":true,"oas":44}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","iommufd":"iommufd0","fd":"22","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","iommufd":"iommufd0","fd":"25","bus":"pci.22","addr":"0x0"}' \ Changes from RFCv3: - Move smmuv3Dev-specific attributes under <driver> - Include new smmuv3Dev-specific attributes based on Shameer's v4 qemu series This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/smmuv3Dev-iommufd-10-01-25 Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/T66F… [1] https://lore.kernel.org/all/20250929133643.38961-1-skolothumtho@nvidia.com/… Signed-off-by: Nathan Chen <nathanc(a)nvidia.com> Nathan Chen (7): qemu: add IOMMU model smmuv3Dev conf: Support multiple smmuv3Dev IOMMU devices tests: qemuxmlconfdata: provide smmuv3Dev sample XML and CLI args qemu: Implement support for associating iommufd to hostdev qemu: open iommufd FDs from libvirt backend qemu: Update Cgroup, namespace, and seclabel for qemu to access iommufd paths tests: qemuxmlconfdata: provide iommufd sample XML and CLI args docs/formatdomain.rst | 44 ++- src/conf/device_conf.c | 9 + src/conf/device_conf.h | 1 + src/conf/domain_conf.c | 177 +++++++++-- src/conf/domain_conf.h | 16 +- src/conf/domain_validate.c | 73 ++++- src/conf/schemas/basictypes.rng | 5 + src/conf/schemas/domaincommon.rng | 35 ++- src/libvirt_private.syms | 2 + src/qemu/qemu_alias.c | 15 +- src/qemu/qemu_cgroup.c | 61 ++++ src/qemu/qemu_cgroup.h | 1 + src/qemu/qemu_command.c | 275 +++++++++++++----- src/qemu/qemu_command.h | 3 +- src/qemu/qemu_domain.c | 8 + src/qemu/qemu_domain.h | 7 + src/qemu/qemu_domain_address.c | 33 ++- src/qemu/qemu_driver.c | 8 +- src/qemu/qemu_hotplug.c | 2 +- src/qemu/qemu_namespace.c | 44 +++ src/qemu/qemu_postparse.c | 11 +- src/qemu/qemu_process.c | 232 +++++++++++++++ src/qemu/qemu_validate.c | 18 +- src/security/security_apparmor.c | 15 + src/security/security_dac.c | 34 +++ src/security/security_selinux.c | 30 ++ src/util/virpci.c | 68 +++++ src/util/virpci.h | 1 + .../iommu-smmuv3Dev.aarch64-latest.args | 39 +++ .../iommu-smmuv3Dev.aarch64-latest.xml | 66 +++++ tests/qemuxmlconfdata/iommu-smmuv3Dev.xml | 53 ++++ .../iommufd-q35.x86_64-latest.args | 41 +++ .../iommufd-q35.x86_64-latest.xml | 60 ++++ tests/qemuxmlconfdata/iommufd-q35.xml | 38 +++ .../iommufd-virt.aarch64-latest.args | 33 +++ .../iommufd-virt.aarch64-latest.xml | 34 +++ tests/qemuxmlconfdata/iommufd-virt.xml | 22 ++ .../iommufd.x86_64-latest.args | 35 +++ .../qemuxmlconfdata/iommufd.x86_64-latest.xml | 38 +++ tests/qemuxmlconfdata/iommufd.xml | 30 ++ tests/qemuxmlconftest.c | 5 + 41 files changed, 1584 insertions(+), 138 deletions(-) create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3Dev.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3Dev.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3Dev.xml create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-q35.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.xml create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd.xml -- 2.43.0

1 7

[PATCH v2 00/27] CI/build-sys fixes to enable Rust more widely
by marcandre.lureau＠redhat.com 02 Oct '25

02 Oct '25

From: Marc-André Lureau <marcandre.lureau(a)redhat.com> Hi, This patch series fixes a number of issues with the build system and CI and enable Rust for many of our jobs, getting us closer to enable Rust by default. emscripten is difficult to enable, help welcome. v2: - add a rust-to-clang-target-test.sh configure script - drop "RFC: configure: use the same machine as the host triple" - replace "tests: move mips to debian-legacy-test-cross" with "RFC: build-sys: deprecate mips host" - start tackling emscripten - fix mis-placed submodule update - other minor changes, commit message tweaks, bz links - add r-b tags Marc-André Lureau (27): build-sys: require -lrt when no shm_open() in std libs gitlab-ci: fix 'needs' property type must be array scripts/archive-source: speed up downloading subprojects scripts/archive-source: silence subprojects downloads scripts/archive-source: use a bash array configure: fix rust meson configuration configure: set the bindgen cross target tests/docker/common: print errors to stderr tests/docker: use fully qualified image name for emsdk tests/docker/common: print meson log on configure failure build-sys: cfi_debug and safe_stack are not compatible lcitool: update, switch to f41 lcitool/qemu: include libclang-rt for TSAN lcitool/alpine: workaround bindgen issue tests/lcitool: add missing rust-std dep tests/lcitool: update to debian13 tests/docker: add ENABLE_RUST environment tests/lcitool: enable rust & refresh configure: set the meson executable suffix/ext tests/freebsd: enable Rust meson: rust-bindgen limit allowlist-file to srcdir/include RFC: tests/docker: add rust to debian-legacy-test-cross WIP: gitlab-ci: enable rust for msys2-64bit WIP: cirrus/macos: enable Rust RFC: build-sys: deprecate mips host build-sys: pass -fvisibility=default for wasm bindgen WIP: enable rust for wasm/emscripten docs/about/build-platforms.rst | 2 - docs/about/deprecated.rst | 9 +-- configure | 27 +++++++- meson.build | 34 +++++++--- .gitlab-ci.d/buildtest-template.yml | 2 +- .gitlab-ci.d/buildtest.yml | 66 +++++++++---------- .gitlab-ci.d/cirrus.yml | 4 +- .gitlab-ci.d/crossbuilds.yml | 46 ++++++------- .gitlab-ci.d/static_checks.yml | 6 +- .gitlab-ci.d/windows.yml | 8 ++- rust/bql/meson.build | 1 + rust/chardev/meson.build | 1 + rust/hw/char/pl011/meson.build | 1 + rust/hw/core/meson.build | 1 + rust/migration/meson.build | 3 +- rust/qom/meson.build | 1 + rust/system/meson.build | 1 + rust/util/meson.build | 1 + scripts/archive-source.sh | 33 +++++++--- .../ci/setup/ubuntu/ubuntu-2204-aarch64.yaml | 5 +- .../ci/setup/ubuntu/ubuntu-2204-s390x.yaml | 5 +- scripts/rust-to-clang-target-test.sh | 43 ++++++++++++ scripts/rust-to-clang-target.sh | 62 +++++++++++++++++ tests/docker/common.rc | 11 +++- tests/docker/dockerfiles/alpine.docker | 6 +- tests/docker/dockerfiles/centos9.docker | 4 ++ .../dockerfiles/debian-amd64-cross.docker | 18 +++-- .../dockerfiles/debian-arm64-cross.docker | 18 +++-- .../dockerfiles/debian-armhf-cross.docker | 21 +++--- .../dockerfiles/debian-i686-cross.docker | 20 ++++-- .../debian-legacy-test-cross.docker | 9 ++- .../dockerfiles/debian-mips64el-cross.docker | 9 ++- .../dockerfiles/debian-mipsel-cross.docker | 9 ++- .../dockerfiles/debian-ppc64el-cross.docker | 18 +++-- .../dockerfiles/debian-riscv64-cross.docker | 10 ++- .../dockerfiles/debian-s390x-cross.docker | 18 +++-- tests/docker/dockerfiles/debian.docker | 18 +++-- .../dockerfiles/emsdk-wasm32-cross.docker | 29 +++++++- .../dockerfiles/fedora-rust-nightly.docker | 18 +++-- .../dockerfiles/fedora-win64-cross.docker | 15 +++-- tests/docker/dockerfiles/fedora.docker | 18 +++-- tests/docker/dockerfiles/opensuse-leap.docker | 7 +- tests/docker/dockerfiles/ubuntu2204.docker | 7 +- tests/docker/test-wasm | 12 ++++ tests/lcitool/libvirt-ci | 2 +- tests/lcitool/projects/qemu.yml | 3 +- tests/lcitool/refresh | 48 +++++++++----- tests/vm/freebsd | 4 +- 48 files changed, 531 insertions(+), 183 deletions(-) create mode 100755 scripts/rust-to-clang-target-test.sh create mode 100644 scripts/rust-to-clang-target.sh create mode 100755 tests/docker/test-wasm -- 2.51.0

9 51

[PATCH] virt-login-shell: check for NULL from virGetLastError()
by gerben＠altlinux.org 01 Oct '25

01 Oct '25

From: Denis Rastyogin <gerben(a)altlinux.org> virGetLastError() may return NULL in case of OOM. Without a check this could lead to a NULL pointer dereference when accessing its fields. The result of virGetLastError() is usually checked in other places, so add the missing check here as well. Found by Linux Verification Center (linuxtesting.org) with SVACE. Reported-by: Pavel Nekrasov <p.nekrasov(a)fobos-nt.ru> Signed-off-by: Denis Rastyogin <gerben(a)altlinux.org> --- tools/virt-login-shell-helper.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/virt-login-shell-helper.c b/tools/virt-login-shell-helper.c index cb59b5dec0..9282ca481e 100644 --- a/tools/virt-login-shell-helper.c +++ b/tools/virt-login-shell-helper.c @@ -282,6 +282,10 @@ main(int argc, char **argv) if (!virDomainIsActive(dom) && virDomainCreate(dom) < 0) { virErrorPtr last_error; last_error = virGetLastError(); + + if (!last_error) + goto cleanup; + if (last_error->code != VIR_ERR_OPERATION_INVALID) { virReportSystemError(last_error->code, _("Can't create %1$s container: %2$s"), -- 2.42.2

3 3

Release of libvirt-11.8.0
by Jiri Denemark 01 Oct '25

01 Oct '25

The 11.8.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * New features * ch: Disk hotplug Support Users can now attach and detach disks of Cloud Hypervisor domains at runtime. * qemu: Add support for NUMA affinity of PCI devices To support NVIDIA Multi-Instance GPU (MIG) configurations, libvirt now handles QEMU's acpi-generic-initiator device internally. MIG enables partitioning a physical GPU into multiple isolated instances, each associated with one or more virtual NUMA nodes. On the XML side, the existing ``<acpi>`` element has been extended with a ``nodeset`` attribute to specify the NUMA node affinity of a PCI device. * Improvements * ch: Events emitting The CH driver not only emits more domain lifecycle events but also implements ``virConnectDomainEventRegister()`` and ``virConnectDomainEventDeregister()`` APIs for management applications to listen on those events. * Bug fixes * qemu: Fix selection of stateless/combined firmware A stateless firmware will now be correctly chosen when appropriate, e.g. for domains configured to use SEV-SNP. * ch: Make sure the cloud-hypervisor process is killed in ``virCHProcessStop()`` Due to wrong assumptions in the CH driver, calling ``virDomainDestroy()`` did not kill the corresponding cloud-hypervisor process. Domains can be now destroyed reliably. Enjoy. Jirka

1 0