November 2025 - Devel - libvirt List Archives

[RFC PATCH v3 0/4] qemu: Implement support for EGM
by Nathan Chen 01 Dec '25

01 Dec '25

The Grace SOC introduces Extended GPU Memory (EGM) [3], a feature that enables GPUs to efficiently access system memory within and across nodes. This patch series adds support for virtualizing EGM (vEGM) in libvirt, allowing VMs to utilize dedicated EGM memory regions through ACPI. This patch series is a follow-up RFC to the second EGM RFC series [0], to gather feedback from the libvirt community on the overall approach and implementation details. While kernel EGM driver support and QEMU acpi-egm-memory device support are not yet upstream, reference implementations are available [1][2] to enable testing and validation of the libvirt integration. Any community feedback is appreciated. Background and Use Cases ========================= EGM allows host memory to be partitioned into two regions: 1. Standard memory for Host OS usage 2. EGM region assigned to VMs as their system memory This technology enables various high-performance computing scenarios [3]: - Large memory pools for AI/ML workloads - High-performance computing applications - Memory extension for systems with limited main memory - GPU-accelerated workloads requiring large addressable memory Implementation Overview ======================= This series adds a new memory device model VIR_DOMAIN_MEMORY_MODEL_EGM with 'path' source attribute and 'pciDev' target attribute to denote host EGM device backing path and PCI device alias to associate the vEGM with, respectively. For instance, given the XML stanzas below: <memory model='egm' access='shared'> <source> <path>/dev/egm4</path> </source> <target> <size unit='KiB'>8388608</size> <node>0</node> <pciDev>ua-hostdev0</pciDev> </target> </memory> <memory model='egm' access='shared'> <source> <path>/dev/egm5</path> </source> <target> <size unit='KiB'>8388608</size> <node>1</node> <pciDev>ua-hostdev1</pciDev> </target> </memory> The corresponding qemu command line will include the following arguments: -object '{"qom-type":"memory-backend-file","id":"memegm0","mem-path":"/dev/egm4","share":true,"prealloc":true,"size":8589934592}' \ -object acpi-egm-memory,id=egm0,pci-dev=ua-hostdev0,node=0 \ -object '{"qom-type":"memory-backend-file","id":"memegm1","mem-path":"/dev/egm5","share":true,"prealloc":true,"size":8589934592}' \ -object acpi-egm-memory,id=egm1,pci-dev=ua-hostdev1,node=1 \ -numa node,nodeid=0,cpus=0-1,memdev=memegm4 \ -numa node,nodeid=1,cpus=2-3,memdev=memegm5 \ For a system where multiple GPUs are associated with a single host socket/NUMA node/EGM chardev, we consolidate the memory backing into a single memory-backend-file object per host EGM chardev. For instance, given the XML stanzas below: <memory model='egm' access='shared'> <source> <path>/dev/egm4</path> </source> <target> <size unit='KiB'>8388608</size> <node>0</node> <pciDev>ua-hostdev0</pciDev> </target> </memory> <memory model='egm' access='shared'> <source> <path>/dev/egm4</path> </source> <target> <size unit='KiB'>8388608</size> <node>0</node> <pciDev>ua-hostdev1</pciDev> </target> </memory> The corresponding qemu command line will include the following arguments: -object '{"qom-type":"memory-backend-file","id":"memegm0","mem-path":"/dev/egm4","share":true,"prealloc":true,"size":17179869184}' \ -object acpi-egm-memory,id=egm0,pci-dev=ua-hostdev0,node=0 \ -object acpi-egm-memory,id=egm1,pci-dev=ua-hostdev1,node=0 \ -numa node,nodeid=0,cpus=0-4,memdev=memegm0 \ Changes from RFCv2: - Decouple host EGM chardev name from guest EGM ID - Consolidate all acpi-egm-memory objects' memory into a single memory-backend-file per EGM chardev specified. Changes from RFCv1: - Use existing memory device infrastructure to represent EGM configuration - Added support for multiple EGM devices This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/egm-11-24-25 Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/6RU7… [1] https://github.com/ianm-nv/qemu/tree/6.8_ghvirt_egm_may2025 [2] https://github.com/NVIDIA/QEMU/commit/32db1b74fb99c0571724c7e69485e89098c14… [3] https://developer.nvidia.com/blog/nvidia-grace-hopper-superchip-architectur… Ian May (1): tests: Add qemuxmlconftest for ACPI EGM memory device Nathan Chen (3): conf: Support EGM memory device model qemu: Add cgroup, namespace, and seclabel setup for EGM memory device model qemu: Add qemu CLI support for EGM docs/formatdomain.rst | 18 +- src/conf/domain_conf.c | 34 +++- src/conf/domain_conf.h | 7 + src/conf/domain_postparse.c | 6 +- src/conf/domain_validate.c | 15 ++ src/conf/schemas/domaincommon.rng | 6 + src/qemu/qemu_alias.c | 7 +- src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_cgroup.c | 10 ++ src/qemu/qemu_command.c | 158 ++++++++++++++++-- src/qemu/qemu_domain.c | 15 +- src/qemu/qemu_domain_address.c | 3 + src/qemu/qemu_driver.c | 1 + src/qemu/qemu_hotplug.c | 1 + src/qemu/qemu_monitor_json.c | 1 + src/qemu/qemu_namespace.c | 3 + src/qemu/qemu_postparse.c | 1 + src/qemu/qemu_process.c | 2 + src/qemu/qemu_validate.c | 6 + src/security/apparmor/usr.sbin.libvirtd.in | 3 + src/security/security_apparmor.c | 2 + src/security/security_dac.c | 8 + src/security/security_selinux.c | 6 + src/security/virt-aa-helper.c | 4 + src/util/virfile.h | 2 +- tests/meson.build | 1 + tests/qemuegmmock.c | 67 ++++++++ .../acpi-egm-memory.aarch64-latest.args | 47 ++++++ .../acpi-egm-memory.aarch64-latest.xml | 124 ++++++++++++++ tests/qemuxmlconfdata/acpi-egm-memory.xml | 124 ++++++++++++++ tests/qemuxmlconftest.c | 8 +- 32 files changed, 672 insertions(+), 21 deletions(-) create mode 100644 tests/qemuegmmock.c create mode 100644 tests/qemuxmlconfdata/acpi-egm-memory.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/acpi-egm-memory.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/acpi-egm-memory.xml -- 2.43.0

2 8

[PATCH 0/3] Fix VMX-* feature detection from MSR
by Hector Cao 01 Dec '25

01 Dec '25

Currently, libvirt is unable to detect the CPU model of recent Intel CPUs (like Granite Rapids) with VMX-* features specified in the MSRs (Model Specific Registers). This is due to the wrong parsing of these VMX-* features from the MSR values. This series of 3 commits allow to fix the MSR VMX-* feature detection. This has been tested successfully on a platform equipped with Intel Granite Rapids CPU. Hector Cao (3): cpu_map: fix sync script to extract correctly vmx-* features cpu_map: update vmx-* features cputest : fix test failures due to VMX-* feature update src/cpu_map/sync_qemu_features_i386.py | 19 +++ src/cpu_map/x86_features.xml | 136 +++++++++--------- .../x86_64-cpuid-Atom-P5362-2-enabled.xml | 10 +- .../x86_64-cpuid-Atom-P5362-enabled.xml | 10 +- .../x86_64-cpuid-Cooperlake-enabled.xml | 10 +- .../x86_64-cpuid-Core-i7-1270P-enabled.xml | 10 +- .../x86_64-cpuid-Core-i7-1365U-enabled.xml | 10 +- .../x86_64-cpuid-Core-i7-8550U-enabled.xml | 10 +- .../x86_64-cpuid-Xeon-6731E-enabled.xml | 10 +- .../x86_64-cpuid-Xeon-6788P-disabled.xml | 1 + .../x86_64-cpuid-Xeon-6788P-enabled.xml | 10 +- .../x86_64-cpuid-Xeon-6788P-guest.xml | 17 ++- .../x86_64-cpuid-Xeon-6788P-host.xml | 17 ++- ...x86_64-cpuid-Xeon-Bronze-3408U-enabled.xml | 10 +- .../x86_64-cpuid-Xeon-E3-1270-v5-enabled.xml | 10 +- .../x86_64-cpuid-Xeon-Gold-6152-enabled.xml | 10 +- .../x86_64-cpuid-Xeon-Gold-6530-enabled.xml | 10 +- ...86_64-cpuid-Xeon-Platinum-9242-enabled.xml | 10 +- ...x86_64-cpuid-Xeon-Silver-4214R-enabled.xml | 10 +- .../x86_64-cpuid-Xeon-w7-3465X-enabled.xml | 10 +- 20 files changed, 181 insertions(+), 159 deletions(-) -- 2.45.2

3 8

[PATCH] NEWS: Mention CVE-2025-13193 and improvements for block stats/config and backups
by Peter Krempa 28 Nov '25

28 Nov '25

From: Peter Krempa <pkrempa(a)redhat.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- NEWS.rst | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 879e9e8448..91ed53ba7e 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -29,6 +29,14 @@ v11.10.0 (unreleased) identification parts of the XML definition (which is needed to perform the checks) and full parsing is done only after checking all ACLs. + * CVE-2025-13193: Incorrect permissions on images after external snapshot of an inactive VM + + The overlay ``qcow2`` images which are created as part of creation of an + external snapshot of an inactive VM had world-readable (644) permissions + which would allow unauthorized users to see contents of blocks written by + the VM after snapshot was taken. Libvirt now sets proper umask so that + the images are created with 600 mode. + * **Removed features** * **New features** @@ -39,6 +47,11 @@ v11.10.0 (unreleased) feature requires Qemu version 10.2.0 or later and is available on Linux hosts where the /dev/mshv is present. + * Add more statistics for block devices on QEMU domains + + The block devices now report optimal access request sizes as well as + statistics such as the queue depth. + * **Improvements** * bhyve: VNC ``wait`` attribute support @@ -57,6 +70,12 @@ v11.10.0 (unreleased) The virt-host-validate tool will now report extra details when certain checks pass. + * qemu: Allow backup jobs to continue if guest OS shuts down + + When starting a backup job users can now use a flag which prevents the VM + to be completely cleaned up if the guest OS shuts down while the backup is + running so that the backup can be finalized. + * **Bug fixes** * ch: Use correct domain definition in chDomainGetXMLDesc() @@ -83,6 +102,13 @@ v11.10.0 (unreleased) if the QEMU binary had it built-in. It is now limited to only platforms with the TDX kernel feature available for use. + * qemu: set ``detect_zeroes`` for all backing chain layers + + Some block jobs (snapshots, block commit) could modify the backing chain in + a way where ``detect_zeroes`` would no longer be honoured. We now set + it for all images in the backing chain, so that it will behave correctly + even after those operations. + v11.9.0 (2025-11-03) ==================== -- 2.52.0

2 1

[PATCH] formatdomaincaps: Fix typo in Hyper-V Enlightenments section
by Jiri Denemark 28 Nov '25

28 Nov '25

From: Jiri Denemark <jdenemar(a)redhat.com> Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- docs/formatdomaincaps.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/formatdomaincaps.rst b/docs/formatdomaincaps.rst index 32dc09d41e..8b4f0ecff3 100644 --- a/docs/formatdomaincaps.rst +++ b/docs/formatdomaincaps.rst @@ -871,7 +871,7 @@ are supported. The ``features`` enum corresponds to the ``<hyperv/>`` element (well, its children) as documented in `Hypervisor features <formatdomain.html#hypervisor-features>`__. The ``defaults`` element then contains child elements describing default values as reported by hypervisor, -e.h. whether direct or extended TLB flushes are available. :since:`(since +e.g. whether direct or extended TLB flushes are available. :since:`(since 11.9.0)` Launch security -- 2.51.1

2 1

[PATCH] NEWS: Fix incoming migration to QEMU 10.0.0
by Jiri Denemark 28 Nov '25

28 Nov '25

From: Jiri Denemark <jdenemar(a)redhat.com> Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- NEWS.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index c742954091..d5028d230d 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -43,6 +43,13 @@ v11.10.0 (unreleased) subdirectory, the ESX driver would have failed to parse that and an error was reported when obtaining domain XML. This is now fixed. + * qemu: Fix incoming migration to QEMU 10.0.0 and newer + + Due to a change in the way QEMU 10.0.0 reports the state of "ht" CPU + feature, incoming migration of a domain with multiple CPU threads would + fail with "guest CPU doesn't match specification: extra features: ht" + error. + v11.9.0 (2025-11-03) ==================== -- 2.51.1

2 1

[PATCH] NEWS: Add CVE-2025-12748
by Martin Kletzander 28 Nov '25

28 Nov '25

From: Martin Kletzander <mkletzan(a)redhat.com> Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- NEWS.rst | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index c742954091df..8cc6e698ca25 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -13,6 +13,22 @@ v11.10.0 (unreleased) * **Security** + * CVE-2025-12748: Denial of service by some ACL-limited accounts + + Parsing of user provided XMLs in APIs which needed the identification + information from those XML definitions was done in full before ACL checks + were performed. Some valid, but useless, definitions could cause allocation + of too much memory, leading to denial of service. APIs which do equate to + full root access (such as ``domain:write``), and were parsing XML + definitions in full before performing ACL checks could, potentially, be + exploited in a way that would allow users (which were about to be denied the + API call) to cause aforementioned overallocation even before the ACL checks + were performed. + + A change was made so that parsing before ACL checks are done only for the + identification parts of the XML definition (which is needed to perform the + checks) and full parsing is done only after checking all ACLs. + * **Removed features** * **New features** -- 2.52.0

2 2

[PATCH] news: document improved certs, host validate details & TDX fix
by Daniel P. Berrangé 28 Nov '25

28 Nov '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- NEWS.rst | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 7c3a6c01e7..a41f53e00d 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -30,8 +30,25 @@ v11.10.0 (unreleased) Bhyve guests can now be configured to wait for a VNC connection before booting. + * remote: multiple certificate support + + The remote daemon and client can be configured to load multiple x509 + certificate identities. This facilitates a transition to certificates + supporting Post-Quantum Crytographic algorithms. + + * tools: improved virt-host-validate output + + The virt-host-validate tool will now report extra details when certain + checks pass. + * **Bug fixes** + * qemu: fix incorrect reporting of the TDX launch security type + + The TDX launch security type was incorrectly reported on all platforms + if the QEMU binary had it built-in. It is now limited to only platforms + with the TDX kernel feature available for use. + v11.9.0 (2025-11-03) ==================== -- 2.51.1

2 1

[PATCH] rpm: disable QEMU driver on non-64-bit arches for Fedora >= 44
by Daniel P. Berrangé 27 Nov '25

27 Nov '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 62af7fb517..8b3bc9884f 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -32,12 +32,22 @@ %define arches_ch x86_64 aarch64 # The hypervisor drivers that run in libvirtd -%define with_qemu 0%{!?_without_qemu:1} %define with_lxc 0%{!?_without_lxc:1} %define with_libxl 0%{!?_without_libxl:1} %define with_vbox 0%{!?_without_vbox:1} %define with_ch 0%{!?_without_ch:1} +%ifarch %{arches_64bit} + %define with_qemu 0%{!?_without_qemu:1} +%else + # QEMU drops 32-bit in Fedora 44 + %if %{?fedora} > 43 + %define with_qemu 0 + %else + %define with_qemu 0%{!?_without_qemu:1} + %endif +%endif + %ifarch %{arches_qemu_kvm} %define with_qemu_kvm %{with_qemu} %else -- 2.51.1

2 1

[PATCH] rpm: disable QEMU driver on non-64-bit arches for Fedora >= 44
by Daniel P. Berrangé 27 Nov '25

27 Nov '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 62af7fb517..8b3bc9884f 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -32,12 +32,22 @@ %define arches_ch x86_64 aarch64 # The hypervisor drivers that run in libvirtd -%define with_qemu 0%{!?_without_qemu:1} %define with_lxc 0%{!?_without_lxc:1} %define with_libxl 0%{!?_without_libxl:1} %define with_vbox 0%{!?_without_vbox:1} %define with_ch 0%{!?_without_ch:1} +%ifarch %{arches_64bit} + %define with_qemu 0%{!?_without_qemu:1} +%else + # QEMU drops 32-bit in Fedora 44 + %if %{?fedora} > 43 + %define with_qemu 0 + %else + %define with_qemu 0%{!?_without_qemu:1} + %endif +%endif + %ifarch %{arches_qemu_kvm} %define with_qemu_kvm %{with_qemu} %else -- 2.51.1

1 0

[PATCH] NEWS: Document features/improvements/bug fixes I've participated in
by Michal Privoznik 27 Nov '25

27 Nov '25

From: Michal Privoznik <mprivozn(a)redhat.com> There are some features/improvements/bug fixes I've either contributed or reviewed/merged. Document them for upcoming release. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- NEWS.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 7c3a6c01e7..4d9b98f93c 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -32,6 +32,17 @@ v11.10.0 (unreleased) * **Bug fixes** + * ch: Use correct domain definition in chDomainGetXMLDesc() + + Cloud-Hyper driver claims to support ``VIR_DOMAIN_XML_INACTIVE`` but in + fact it never formatted the inactive XML. This is now fixed. + + * esx: Allow disk images in subdirectories + + If a domain has a disk image that's not in a datastore path but in a + subdirectory, the ESX driver would have failed to parse that and an error + was reported when obtaining domain XML. This is now fixed. + v11.9.0 (2025-11-03) ==================== -- 2.51.2

2 1