November 2025 - Devel - libvirt List Archives

Question about error conditions for ACPI usage on aarch64
by Kazuhiro Abe (Fujitsu) 18 Nov '25

18 Nov '25

Hi all, We are currently working on CCA support. Due to CCA specifications, we are unable to use pflash with QEMU. Therefore, we intend to enable ACPI by specifying the UEFI firmware using the QEMU -bios option as follows: -machine virt,acpi=on -bios /usr/share/qemu-efi-aarch64/QEMU_EFI.fd Using the above QEMU option, we can successfully boot VM. My understanding is that the above QEMU option could be translated by the following libvirt XML: <os> <type arch='aarch64' machine='virt-4.0'>hvm</type> <loader type="rom">/usr/share/qemu-efi-aarch64/QEMU_EFI.fd</loader> </os> <features> <acpi/> </features> However, this XML configuration results in a validation error. Specifically, the error occurs because def->os.firmware is VIR_DOMAIN_OS_DEF_FIRMWARE_NONE during the following check: src/qemu/qemu_validate.c: qemuValidateDomainDef() /* On aarch64, ACPI requires UEFI */ if (def->features[VIR_DOMAIN_FEATURE_ACPI] == VIR_TRISTATE_SWITCH_ON && def->os.arch == VIR_ARCH_AARCH64 && (def->os.firmware != VIR_DOMAIN_OS_DEF_FIRMWARE_EFI && !virDomainDefHasOldStyleUEFI(def))) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("ACPI requires UEFI on this architecture")); return -1; } It appears that a configuration that successfully boots QEMU directly is being rejected by libvirt. Could you please explain if there's a specific reason for this strict validation? We are particularly interested in why VIR_DOMAIN_OS_DEF_FIRMWARE_NONE also becomes a condition for this error. Best Regards, Kazuhiro Abe

3 4

Plans for 11.10.0 release (freeze on 2025-11-25)
by Jiri Denemark 18 Nov '25

18 Nov '25

We are getting close to 11.10.0 release of libvirt. To aim for the release on Monday 01 Dec I suggest entering the freeze on Tuesday 25 Nov and tagging RC2 on Thursday 27 Nov. I hope this works for everyone. Jirka

1 0

[PATCH-for-10.2 v3 0/2] docs: Update around MIPS/PPC host removal
by Philippe Mathieu-Daudé 18 Nov '25

18 Nov '25

Since v2: - Generic 32-bit host removal message (danpb) Since v1: - 11.0 -> 10.2 v0 Cover: - Clarify MIPS host removal - Mention PPC host was removed Philippe Mathieu-Daudé (2): docs: Correct release of MIPS deprecations / removals docs: Mention 32-bit PPC host as removed docs/about/deprecated.rst | 2 +- docs/about/removed-features.rst | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) -- 2.51.0

4 6

libvirt serial console on non-x86 platforms
by Leigh Brown 17 Nov '25

17 Nov '25

Hi Daniel, On a whim, I tried installing libvirt on a Raspberry Pi 5. I was pleasantly surprised to find that it all worked, apart from one small wrinkle. I typically use virt-install and set up a serial console, but this failed with the error: ERROR unsupported configuration: BIOS serial console only supported on x86 architectures I created the VM with a graphical console then manually adjusted the config afterwards to use a serial console and it all worked fine. After a bit of digging I saw an email[1] from yourself talking about how graphics=off has semantic effects beyond just controlling whether the firmware prints to the serial or not. After a bit more digging, I found out that Qemu 8.0[2] removed the sga device due to SeaBIOS 1.11.0 and newer supporting this feature natively when QEMU is started with the option -M graphics=off. I made the following small patch against the Debian package: --- libvirt-11.3.0.orig/src/qemu/qemu_validate.c +++ libvirt-11.3.0/src/qemu/qemu_validate.c @@ -1304,15 +1304,7 @@ qemuValidateDomainDef(const virDomainDef /* On x86 -machine graphics=off toggles the use of the * serial console in SeaBIOS (and theoretically other * firmwares). - * On non-x86, it has also sorts of other effects - * on QEMU device models created and so we don't - * want to allow its use. */ - if (!ARCH_IS_X86(def->os.arch)) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("BIOS serial console only supported on x86 architectures")); - return -1; - } if (!def->nserials) { virReportError(VIR_ERR_XML_ERROR, "%s", _("need at least one serial port to use BIOS serial output")); With that change, I can now create VMs with a serial console through virt-install on the Raspberry PI 5. Have I got this right? If so, I'm happy to submit the patch. Regards, Leigh. -- [1] https://mail.gnu.org/archive/html/qemu-devel/2021-09/msg02417.html [2] https://wiki.qemu.org/ChangeLog/8.0

2 4

[PATCH-for-10.2 v2 0/2] docs: Update around MIPS/PPC host removal
by Philippe Mathieu-Daudé 17 Nov '25

17 Nov '25

- Clarify MIPS host removal - Mention PPC host was removed Philippe Mathieu-Daudé (2): docs: Correct release of MIPS deprecations / removals docs: Mention 32-bit PPC host as removed docs/about/deprecated.rst | 2 +- docs/about/removed-features.rst | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-) -- 2.51.0

1 2

[RFC 0/4] cover: RFE libvirt secret encryption on disk
by Arun Menon 17 Nov '25

17 Nov '25

Libvirt secrets are stored unencrypted on the disk. With this series we want to start encrypting the secrets. First we introduce a secrets.conf file that has 2 configuration settings. 1. encrypt_data - This can be set to 0 or 1. If it is set to 1 then we encrypt the secrets. We recommend to keep this as the default setting. 2. master_encryption_key - This allows the user to set the path of the encryption file. The secrets.conf file is parsed during secrets driver initialization and accordingly the secrets are stored on the disk. By default the secrets driver will look into the CREDENTIALS_DIRECTORY environment variable in systemd. The systemd unit file is configured with a pre configured key using the SetCredentialEncrypted directive. This encrypted secret key is provided to the virtsecretd on service activation. If this file is not available, then the virtsecretd driver will check the master_encryption_key configuration in secrets.conf file, provided it is made available by the user. A boolean flag called value_encrypted is added to the secrets object, to indicate whether it is encrypted or not. This is not stored on the disk yet. It is important to add this functionality so that the secrets service behaves properly across restarts. This is a sincere attempt to improve upon the already submitted patch https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/KE6G… Resolves: https://issues.redhat.com/browse/RHEL-7125 Arun Menon (4): util: Add support for GnuTLS decryption secret: Set up default encrypted master key for the virtsecretd service secret: Add secrets.conf configuration file and parse it secret: Add functionality to load and save secrets in encrypted format libvirt.spec.in | 1 + src/conf/virsecretobj.c | 13 ++ src/conf/virsecretobj.h | 7 + src/libvirt_private.syms | 3 + src/secret/meson.build | 7 + src/secret/secret_driver.c | 168 +++++++++++++++++++++++- src/secret/secrets.conf.in | 14 ++ src/secret/virtsecretd.service.extra.in | 8 ++ src/util/vircrypto.c | 130 +++++++++++++++++- src/util/vircrypto.h | 8 ++ tests/vircryptotest.c | 65 +++++++++ 11 files changed, 420 insertions(+), 4 deletions(-) create mode 100644 src/secret/secrets.conf.in -- 2.51.1

3 15

[PATCH v6] qapi: net: deprecate vhostforce option
by Vladimir Sementsov-Ogievskiy 14 Nov '25

14 Nov '25

This option for tap and vhost-user netdevs doesn't make sense since long ago (10 years!), starting from commits: 1e7398a140f7a6 ("vhost: enable vhost without without MSI-X") 24f938a682d934 ("vhost user:support vhost user nic for non msi guests") Prior these commits, to enable kernel vhost-net, or vhost-user-net for some specific kind of guests (that don't have MSI-X support), you should have set vhostforce=on. Now guest type doesn't matter, all guests are equal for these options logic. For tap the current logic is: vhost=on / vhost=off : vhostforce ignored, doesn't make sense vhost unset : vhostforce counts, enabling vhost So you may enable vhost for tap several ways: - vhost=on - vhostforce=on - vhost=on + vhostforce=on - and even vhost=on + vhostforce=off - they are all equal. For vhost-user we simply ignore the vhostforce option at all in the code. Let's finally deprecate the extra options. Also, fix @vhostforce documentation everywhere to show the real picture, and update vhost-user test to not use deprecated option. While updating command line options, drop "experimental" word from "experimental in kernel accelerator". vhost-net is in production for years. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> Reviewed-by: Markus Armbruster <armbru(a)redhat.com> --- v6: - update numbers 10.2 -> 11.0 - add r-b by Markus docs/about/deprecated.rst | 11 +++++++++++ qapi/net.json | 18 ++++++++++++++---- qemu-options.hx | 13 +++++-------- tests/qtest/vhost-user-test.c | 2 +- 4 files changed, 31 insertions(+), 13 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 03e29915f0..3f97392a45 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -498,6 +498,17 @@ Backend ``memory`` (since 9.0) ``memory`` is a deprecated synonym for ``ringbuf``. +TAP ``vhostforce`` (since 11.0) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The ``vhostforce`` option is redundant with the ``vhost`` option. +If they conflict, ``vhost`` takes precedence. Just use ``vhost``. + +Vhost-user ``vhostforce`` (since 11.0) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The ``vhostforce`` option is a no-op. Do not use it. + CPU device properties ''''''''''''''''''''' diff --git a/qapi/net.json b/qapi/net.json index 118bd34965..9a00d578e9 100644 --- a/qapi/net.json +++ b/qapi/net.json @@ -348,13 +348,18 @@ # @vhostfds: file descriptors of multiple already opened vhost net # devices # -# @vhostforce: vhost on for non-MSIX virtio guests +# @vhostforce: enable vhost-net network accelerator. Ignored when +# @vhost is set. # # @queues: number of queues to be created for multiqueue capable tap # # @poll-us: maximum number of microseconds that could be spent on busy # polling for tap (since 2.7) # +# Features: +# +# @deprecated: Member @vhostforce is deprecated. Use @vhost instead. +# # Since: 1.2 ## { 'struct': 'NetdevTapOptions', @@ -371,7 +376,7 @@ '*vhost': 'bool', '*vhostfd': 'str', '*vhostfds': 'str', - '*vhostforce': 'bool', + '*vhostforce': { 'type': 'bool', 'features': [ 'deprecated' ] }, '*queues': 'uint32', '*poll-us': 'uint32'} } @@ -610,17 +615,22 @@ # # @chardev: name of a unix socket chardev # -# @vhostforce: vhost on for non-MSIX virtio guests (default: false). +# @vhostforce: silently ignored, exists just for backward +# compatibility. # # @queues: number of queues to be created for multiqueue vhost-user # (default: 1) (Since 2.5) # +# Features: +# +# @deprecated: Member @vhostforce is deprecated. +# # Since: 2.1 ## { 'struct': 'NetdevVhostUserOptions', 'data': { 'chardev': 'str', - '*vhostforce': 'bool', + '*vhostforce': { 'type': 'bool', 'features': [ 'deprecated' ] }, '*queues': 'int' } } ## diff --git a/qemu-options.hx b/qemu-options.hx index fca2b7bc74..414b762743 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -2882,7 +2882,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, #else "-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]\n" " [,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]\n" - " [,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]\n" + " [,vhostfd=h][,vhostfds=x:y:...:z][,queues=n]\n" " [,poll-us=n]\n" " configure a host TAP network backend with ID 'str'\n" " connected to a bridge (default=" DEFAULT_BRIDGE_INTERFACE ")\n" @@ -2898,9 +2898,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')\n" " use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag\n" " use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition\n" - " use vhost=on to enable experimental in kernel accelerator\n" - " (only has effect for virtio guests which use MSIX)\n" - " use vhostforce=on to force vhost on for non-MSIX virtio guests\n" + " use vhost=on to enable in kernel accelerator\n" " use 'vhostfd=h' to connect to an already opened vhost net device\n" " use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices\n" " use 'queues=n' to specify the number of queues to be created for multiqueue TAP\n" @@ -2991,7 +2989,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " use 'start-queue=m' to specify the first queue that should be used\n" #endif #ifdef CONFIG_POSIX - "-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]\n" + "-netdev vhost-user,id=str,chardev=dev\n" " configure a vhost-user network, backed by a chardev 'dev'\n" #endif #ifdef __linux__ @@ -3882,12 +3880,11 @@ SRST for insertion into the socket map. The combination of 'map-path' and 'sock-fds' together is not supported. -``-netdev vhost-user,chardev=id[,vhostforce=on|off][,queues=n]`` +``-netdev vhost-user,chardev=id[,queues=n]`` Establish a vhost-user netdev, backed by a chardev id. The chardev should be a unix domain socket backed one. The vhost-user uses a specifically defined protocol to pass vhost ioctl replacement - messages to an application on the other end of the socket. On - non-MSIX guests, the feature can be forced with vhostforce. Use + messages to an application on the other end of the socket. Use 'queues=n' to specify the number of queues to be created for multiqueue vhost-user. diff --git a/tests/qtest/vhost-user-test.c b/tests/qtest/vhost-user-test.c index d2bb21d5b9..f977f50baf 100644 --- a/tests/qtest/vhost-user-test.c +++ b/tests/qtest/vhost-user-test.c @@ -46,7 +46,7 @@ #define QEMU_CMD_SHM " -m %d -object memory-backend-shm,id=mem,size=%dM," \ " -numa node,memdev=mem" #define QEMU_CMD_CHR " -chardev socket,id=%s,path=%s%s" -#define QEMU_CMD_NETDEV " -netdev vhost-user,id=hs0,chardev=%s,vhostforce=on" +#define QEMU_CMD_NETDEV " -netdev vhost-user,id=hs0,chardev=%s" #define HUGETLBFS_MAGIC 0x958458f6 -- 2.48.1

2 1

[PATCH 0/4] selinux: skip fallback label restore for shared media
by Cole Robinson 13 Nov '25

13 Nov '25

https://issues.redhat.com/browse/RHEL-126945 selinux label set/restore has race conditions on qemu:///session, where the xattr label remembering path is not used. See the above issue for a more detailed description of the problem. This series dodges the issue by skipping the fallback label restore for readonly resources like kernel and initrd, basically anything that would get the virt_content_t label. Note, disks already skip _all_ attempts to remember or restore selinux labels if the disk is marked readonly or shareable, and has done so for a long time. Maybe we should extend that out for anything that is inherently readonly or shareable, like kernel + initrd. But for now I stuck with the more conservative approach. And finally, this doesn't actually fix the race condition. If label remembering is working, the refcounting covers us. But if you disable label remembering at the qemu.conf level, there's likely similar issues in the DAC driver even for qemu:///system. I did not look into fixing the race but I suspect it involves keeping the security driver locked until the VM fully boots up. First two patches are not strictly related, but I noticed them while I was in the area Patch 3 adds the plumbing but no behavior change Patch 4 changes behavior Cole Robinson (4): selinux: Match remember/recall arguments for SavedStateLabel selinux: Don't remember labels for shareable SCSI devices selinux: Add is_shared plumbing to RestoreFileLabel selinux: Mark anything using content_context as shared src/security/security_selinux.c | 107 +++++++++++++++++++------------- 1 file changed, 63 insertions(+), 44 deletions(-) -- 2.51.1

2 5

[PATCH] qemu: snapshot: Set umask for 'qemu-img' when creating external inactive snapshots
by Peter Krempa 13 Nov '25

13 Nov '25

From: Peter Krempa <pkrempa(a)redhat.com> External inactive snapshots are created by invoking 'qemu-img' which creates the file. Currently qemu-img creates image with mode 644 based on default umask as libvirt doesn't set any. Having a world-readable image is obviously wrong so set the umask to 0066 to have the file readable only by the owner. Resolves: https://bugs.debian.org/1120119 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_snapshot.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c index d4994dd54e..6868910d9a 100644 --- a/src/qemu/qemu_snapshot.c +++ b/src/qemu/qemu_snapshot.c @@ -228,6 +228,9 @@ qemuSnapshotCreateQcow2Files(virDomainDef *def, NULL))) return -1; + /* ensure that new files are only readable by the user */ + virCommandSetUmask(cmd, 0066); + /* adds cmd line arg: backing_fmt=format,backing_file=/path/to/backing/file */ virBufferAsprintf(&buf, "backing_fmt=%s,backing_file=", virStorageFileFormatTypeToString(defdisk->src->format)); -- 2.51.1

2 2

[PATCH] bhyve: s/provconn/privcon/
by Michal Privoznik 13 Nov '25

13 Nov '25

From: Michal Privoznik <mprivozn(a)redhat.com> Due to a typo, the bhyve driver doesn't compile. Fix it. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Merged as trivial. src/bhyve/bhyve_driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/bhyve/bhyve_driver.c b/src/bhyve/bhyve_driver.c index 3a4e83d3d2..4b1ca80fc6 100644 --- a/src/bhyve/bhyve_driver.c +++ b/src/bhyve/bhyve_driver.c @@ -487,7 +487,7 @@ bhyveDomainDefineXMLFlags(virConnectPtr conn, const char *xml, unsigned int flag return NULL; /* Avoid parsing the whole domain definition for ACL checks */ - if (!(def = virDomainDefIDsParseString(xml, provconn->xmlopt, parse_flags))) + if (!(def = virDomainDefIDsParseString(xml, privconn->xmlopt, parse_flags))) return NULL; if (virDomainDefineXMLFlagsEnsureACL(conn, def) < 0) @@ -896,7 +896,7 @@ bhyveDomainCreateXML(virConnectPtr conn, start_flags |= VIR_BHYVE_PROCESS_START_AUTODESTROY; /* Avoid parsing the whole domain definition for ACL checks */ - if (!(def = virDomainDefIDsParseString(xml, provconn->xmlopt, parse_flags))) + if (!(def = virDomainDefIDsParseString(xml, privconn->xmlopt, parse_flags))) return NULL; if (virDomainCreateXMLEnsureACL(conn, def) < 0) -- 2.51.0

1 0

[PATCH v5] qapi: net: deprecate vhostforce option
by Vladimir Sementsov-Ogievskiy 13 Nov '25

13 Nov '25

This option for tap and vhost-user netdevs doesn't make sense since long ago (10 years!), starting from commits: 1e7398a140f7a6 ("vhost: enable vhost without without MSI-X") 24f938a682d934 ("vhost user:support vhost user nic for non msi guests") Prior these commits, to enable kernel vhost-net, or vhost-user-net for some specific kind of guests (that don't have MSI-X support), you should have set vhostforce=on. Now guest type doesn't matter, all guests are equal for these options logic. For tap the current logic is: vhost=on / vhost=off : vhostforce ignored, doesn't make sense vhost unset : vhostforce counts, enabling vhost So you may enable vhost for tap several ways: - vhost=on - vhostforce=on - vhost=on + vhostforce=on - and even vhost=on + vhostforce=off - they are all equal. For vhost-user we simply ignore the vhostforce option at all in the code. Let's finally deprecate the extra options. Also, fix @vhostforce documentation everywhere to show the real picture, and update vhost-user test to not use deprecated option. While updating command line options, drop "experimental" word from "experimental in kernel accelerator". vhost-net is in production for years. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> --- v5: update wording and commit message docs/about/deprecated.rst | 11 +++++++++++ qapi/net.json | 18 ++++++++++++++---- qemu-options.hx | 13 +++++-------- tests/qtest/vhost-user-test.c | 2 +- 4 files changed, 31 insertions(+), 13 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index dacf2882e4..a781600a2f 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -484,6 +484,17 @@ Stream ``reconnect`` (since 9.2) The ``reconnect`` option only allows specifying second granularity timeouts, which is not enough for all types of use cases, use ``reconnect-ms`` instead. +TAP ``vhostforce`` (since 10.2) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The ``vhostforce`` option is redundant with the ``vhost`` option. +If they conflict, ``vhost`` takes precedence. Just use ``vhost``. + +Vhost-user ``vhostforce`` (since 10.2) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The ``vhostforce`` option is a no-op. Do not use it. + CPU device properties ''''''''''''''''''''' diff --git a/qapi/net.json b/qapi/net.json index 60d196afe5..e8ccc8afc2 100644 --- a/qapi/net.json +++ b/qapi/net.json @@ -346,13 +346,18 @@ # @vhostfds: file descriptors of multiple already opened vhost net # devices # -# @vhostforce: vhost on for non-MSIX virtio guests +# @vhostforce: enable vhost-net network accelerator. Ignored when +# @vhost is set. # # @queues: number of queues to be created for multiqueue capable tap # # @poll-us: maximum number of microseconds that could be spent on busy # polling for tap (since 2.7) # +# Features: +# +# @deprecated: Member @vhostforce is deprecated. Use @vhost instead. +# # Since: 1.2 ## { 'struct': 'NetdevTapOptions', @@ -369,7 +374,7 @@ '*vhost': 'bool', '*vhostfd': 'str', '*vhostfds': 'str', - '*vhostforce': 'bool', + '*vhostforce': { 'type': 'bool', 'features': [ 'deprecated' ] }, '*queues': 'uint32', '*poll-us': 'uint32'} } @@ -606,17 +611,22 @@ # # @chardev: name of a unix socket chardev # -# @vhostforce: vhost on for non-MSIX virtio guests (default: false). +# @vhostforce: silently ignored, exists just for backward +# compatibility. # # @queues: number of queues to be created for multiqueue vhost-user # (default: 1) (Since 2.5) # +# Features: +# +# @deprecated: Member @vhostforce is deprecated. +# # Since: 2.1 ## { 'struct': 'NetdevVhostUserOptions', 'data': { 'chardev': 'str', - '*vhostforce': 'bool', + '*vhostforce': { 'type': 'bool', 'features': [ 'deprecated' ] }, '*queues': 'int' } } ## diff --git a/qemu-options.hx b/qemu-options.hx index 0223ceffeb..35a70096e8 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -2882,7 +2882,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, #else "-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]\n" " [,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]\n" - " [,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]\n" + " [,vhostfd=h][,vhostfds=x:y:...:z][,queues=n]\n" " [,poll-us=n]\n" " configure a host TAP network backend with ID 'str'\n" " connected to a bridge (default=" DEFAULT_BRIDGE_INTERFACE ")\n" @@ -2898,9 +2898,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')\n" " use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag\n" " use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition\n" - " use vhost=on to enable experimental in kernel accelerator\n" - " (only has effect for virtio guests which use MSIX)\n" - " use vhostforce=on to force vhost on for non-MSIX virtio guests\n" + " use vhost=on to enable in kernel accelerator\n" " use 'vhostfd=h' to connect to an already opened vhost net device\n" " use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices\n" " use 'queues=n' to specify the number of queues to be created for multiqueue TAP\n" @@ -2991,7 +2989,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " use 'start-queue=m' to specify the first queue that should be used\n" #endif #ifdef CONFIG_POSIX - "-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]\n" + "-netdev vhost-user,id=str,chardev=dev\n" " configure a vhost-user network, backed by a chardev 'dev'\n" #endif #ifdef __linux__ @@ -3882,12 +3880,11 @@ SRST for insertion into the socket map. The combination of 'map-path' and 'sock-fds' together is not supported. -``-netdev vhost-user,chardev=id[,vhostforce=on|off][,queues=n]`` +``-netdev vhost-user,chardev=id[,queues=n]`` Establish a vhost-user netdev, backed by a chardev id. The chardev should be a unix domain socket backed one. The vhost-user uses a specifically defined protocol to pass vhost ioctl replacement - messages to an application on the other end of the socket. On - non-MSIX guests, the feature can be forced with vhostforce. Use + messages to an application on the other end of the socket. Use 'queues=n' to specify the number of queues to be created for multiqueue vhost-user. diff --git a/tests/qtest/vhost-user-test.c b/tests/qtest/vhost-user-test.c index 609ff24059..a4862d7087 100644 --- a/tests/qtest/vhost-user-test.c +++ b/tests/qtest/vhost-user-test.c @@ -46,7 +46,7 @@ #define QEMU_CMD_SHM " -m %d -object memory-backend-shm,id=mem,size=%dM," \ " -numa node,memdev=mem" #define QEMU_CMD_CHR " -chardev socket,id=%s,path=%s%s" -#define QEMU_CMD_NETDEV " -netdev vhost-user,id=hs0,chardev=%s,vhostforce=on" +#define QEMU_CMD_NETDEV " -netdev vhost-user,id=hs0,chardev=%s" #define HUGETLBFS_MAGIC 0x958458f6 -- 2.48.1

3 3

[PATCH 0/1] cpu_map: fix vmx-* features wrong bitmaps
by Hector Cao 12 Nov '25

12 Nov '25

Hello, I'm unable to make virsh capabilities to detect the right CPU model on an Intel Granite Rapids platform. I would expect the get the CPU model defined in one of the src/cpu_map/x86_GraniteRapids*.xml files. The cause of the wrong detection is the fact that some vmx-* are not correctly detected and considered missing on this platform. When I take a look at the src/cpu_map/x86_features.xml file, I think that some of the vmx-* are wrongly defined. Taking as an example the vmx-apicv-xapic feature, it is defined as the first bit in the EAX register when we read the MSR 0x0000048b . But in Intel specification, this feature is represented as the first bit in the EDX register (32 higher bits). You can find in this submission the patch that fixes this issue, and this for all the affected MSRs. I tested this fix on my Granite Rapids platform and the CPU model is now correctly detected. Hector Cao (1): cpu_map: fix vmx-* features wrong bitmaps src/cpu_map/x86_features.xml | 136 +++++++++++++++++------------------ 1 file changed, 68 insertions(+), 68 deletions(-) -- 2.45.2

4 10

[PATCH 0/2] Remove use of deprecated 'xmlIndentTreeOutput' variable from libxml2
by Peter Krempa 11 Nov '25

11 Nov '25

The default from libxml2 is '1' which we wanted. Thus all use in separate processes is okay, and for the few exceptions (see 2/2) the resulting XML is mis-indented but valid for any app which would override it. Peter Krempa (2): virVBoxSnapshotConfSaveVboxFile: Don't modify deprecated 'xmlIndentTreeOutput' virXMLFormatMetadata: Don't modify deprecated 'xmlIndentTreeOutput' src/util/virxml.c | 10 ---------- src/vbox/vbox_snapshot_conf.c | 5 ----- 2 files changed, 15 deletions(-) -- 2.51.1

3 6

[PATCH 0/4] bhyve: support queue configuration for NVMe disks
by Roman Bogorodskiy 11 Nov '25

11 Nov '25

Roman Bogorodskiy (4): conf: domain_validate: make disk queue configuration driver specific bhyve: support queue configuration for NVMe disks bhyve: domain: refactor bhyveDomainDeviceDefValidate() bhyve: domain: improve disks validation src/bhyve/bhyve_command.c | 16 ++- src/bhyve/bhyve_domain.c | 110 +++++++++++++----- src/conf/domain_validate.c | 12 -- src/qemu/qemu_driver.c | 15 +++ src/qemu/qemu_validate.c | 14 +++ .../bhyvexml2argv-disk-virtio-queue-opts.xml | 23 ++++ .../bhyvexml2argvdata/bhyvexml2argv-nvme.args | 2 +- .../bhyvexml2argvdata/bhyvexml2argv-nvme.xml | 2 +- tests/bhyvexml2argvtest.c | 1 + .../bhyvexml2xmlout-nvme.xml | 2 +- 10 files changed, 148 insertions(+), 49 deletions(-) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-disk-virtio-queue-opts.xml -- 2.51.0

3 7

[PATCH 0/7] Fixes for CVE-2025-12748
by Martin Kletzander 11 Nov '25

11 Nov '25

ACL checks were performed after parsing a user provided XML in its entirety which could be written in a way that would make libvirt allocate too much memory and crash. Instead parse just the identifiers out of which only name and UUID are needed for ACL checks, perform those and then parse the whole definition. In order not to pass bogus UUID to the ACL functions, rewrite any generated UUID in the first step with a nil UUID since the ACLs cannot be written to expect a particular generated UUID as that would not make sense. If squashing the patches is preferred, let me know. Fixes: CVE-2025-12748 Reported-by: Святослав Терешин <s.tereshin(a)fobos-nt.ru> Martin Kletzander (7): conf: Add virDomainDefIDsParseString bhyve: Check ACLs before parsing the whole domain XML libxl: Check ACLs before parsing the whole domain XML lxc: Check ACLs before parsing the whole domain XML vz: Check ACLs before parsing the whole domain XML ch: Check ACLs before parsing the whole domain XML qemu: Check ACLs before parsing the whole domain XML src/bhyve/bhyve_driver.c | 24 ++++++++--- src/ch/ch_driver.c | 76 +++++++++++++++++++++++---------- src/conf/domain_conf.c | 29 +++++++++++++ src/conf/domain_conf.h | 3 ++ src/libvirt_private.syms | 1 + src/libxl/libxl_driver.c | 20 ++++++--- src/lxc/lxc_driver.c | 22 +++++++--- src/qemu/qemu_driver.c | 90 ++++++++++++++++++++------------------- src/qemu/qemu_migration.c | 21 ++++++++- src/qemu/qemu_migration.h | 4 +- src/qemu/qemu_saveimage.c | 25 +++++++++-- src/qemu/qemu_saveimage.h | 4 +- src/qemu/qemu_snapshot.c | 4 +- src/vz/vz_driver.c | 18 +++++--- 14 files changed, 243 insertions(+), 98 deletions(-) -- 2.51.2

3 14

Does our interface compatibility promise cover defaults?
by Markus Armbruster 11 Nov '25

11 Nov '25

From about/deprecated.rst: In general features are intended to be supported indefinitely once introduced into QEMU. In the event that a feature needs to be removed, it will be listed in this section. The feature will remain functional for the release in which it was deprecated and one further release. After these two releases, the feature is liable to be removed. Deprecated features may also generate warnings on the console when QEMU starts up, or if activated via a monitor command, however, this is not a mandatory requirement. This obviously applies to syntax and semantics of our external interface. Does it apply to default values there? If no: does this mean we can change defaults without notice? If yes: does this mean any change of defaults needs notice in about/deprecated.rst and the grace period? Note that changing a default is a silent change, like changing semantics / behavior, unlike changing syntax.

3 2

[PATCH] meson: default to system crypto policies where available
by Daniel P. Berrangé 10 Nov '25

10 Nov '25

From: Daniel P. Berrangé <berrange(a)redhat.com> In RHEL and Fedora, the built-in GNUTLS default priority is changed from "NORMAL" to "@SYSTEM", but because libvirt sets an explicit policy with gnutls we don't honour that. Instead we force "NORMAL" unless the 'tls_priority' meson option is changed. In RPM builds, meanwhile, we ask for "@LIBVIRT,SYSTEM" to make it look for a libvirt specific profile first, falling back to "@SYSTEM" This changes the meson option to default to "@LIBVIRT,SYSTEM" if the crypto-policies config is present on the local machine and the meson option -Dsystem=true is given. This gives developers more appropriate default behaviour, matching that seen in package builds. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- meson.build | 13 ++++++++++++- meson_options.txt | 2 +- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/meson.build b/meson.build index d68b37d0ba..c1871de64c 100644 --- a/meson.build +++ b/meson.build @@ -2035,7 +2035,18 @@ elif get_option('userfaultfd_sysctl').enabled() error('userfaultfd_sysctl option requires sysctl_config to be enabled') endif -conf.set_quoted('TLS_PRIORITY', get_option('tls_priority')) +prio = get_option('tls_priority') +if prio == 'auto' + # If local OS has 'crypto-policies' then default to that + policy = '/etc/crypto-policies/config' + if get_option('system') and \ + run_command('test', '-f', policy, check: false).returncode() == 0 + prio = '@LIBVIRT,SYSTEM' + else + prio = 'NORMAL' + endif +endif +conf.set_quoted('TLS_PRIORITY', prio) # test options diff --git a/meson_options.txt b/meson_options.txt index 3dc3e8667b..8b6b26dfc6 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -134,4 +134,4 @@ option('ssh_proxy', type: 'feature', value: 'auto', description: 'Build ssh-prox option('sysctl_config', type: 'feature', value: 'auto', description: 'Whether to install sysctl configs') # dep:sysctl_config option('userfaultfd_sysctl', type: 'feature', value: 'auto', description: 'Whether to install sysctl config for enabling unprivileged userfaultfd') -option('tls_priority', type: 'string', value: 'NORMAL', description: 'set the default TLS session priority string') +option('tls_priority', type: 'string', value: 'auto', description: 'set the default TLS session priority string') -- 2.51.1

2 1

[PATCH 0/3] docs: drvbhyve: documentation updates
by Roman Bogorodskiy 10 Nov '25

10 Nov '25

*** BLURB HERE *** Roman Bogorodskiy (3): docs: drvbhyve: document device passthrough docs: drvbhyve: improve the manpage link docs: drvbhyve: add guest-specific nodes section docs/drvbhyve.rst | 42 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-) -- 2.51.0

2 4

Downloading/uploading a VM from/to ESXi
by Konstantin Kharlamov 10 Nov '25

10 Nov '25

Hi, I'm in need of functional of downloading and uploading a VM from esxi. libvirt seems to lack it. From what I studied, at least downloading should be implemented by ExportVM SOAP function, and then by getting a list of URLs from its returned lease, while pinging the lease to make sure it doesn't timeout. I'm wondering is there any interest in libvirt in accepting such functional?

1 0

[PATCH 0/5] domain_capabilities: Use virXMLFormatElement() to format XML
by Michal Privoznik 10 Nov '25

10 Nov '25

*** BLURB HERE *** Michal Prívozník (5): domain_capabilities: Move indentation adjustment out of virDomainCapsCPUCustomFormat() domain_capabilities: Rework virDomainCapsCPUCustomFormat() domain_capabilities: Rework virDomainCapsCPUFormat() domain_capabilities: Check NULL in FORMAT_PROLOGUE domain_capabilities: Use virXMLFormatElement() in FORMAT_PROLOGUE and FORMAT_EPILOGUE macros src/conf/domain_capabilities.c | 135 ++++++++++---------- tests/domaincapsdata/bhyve_basic.x86_64.xml | 3 +- tests/domaincapsdata/bhyve_fbuf.x86_64.xml | 3 +- tests/domaincapsdata/bhyve_uefi.x86_64.xml | 3 +- 4 files changed, 68 insertions(+), 76 deletions(-) -- 2.51.0

3 12

[libvirt PATCH] scripts: do not use uninitialized variable
by Ján Tomko 07 Nov '25

07 Nov '25

From: Ján Tomko <jtomko(a)redhat.com> A previous commit removed the 'ret' variable when switching to subprocess.run, but did not adjust the exit code. Fixes: 15c9ca383c2a814c61cc4ed16b4dad91221d8129 Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- Pushed as a build fix. scripts/check-file-access.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/check-file-access.py b/scripts/check-file-access.py index 71130d4dec..42c9c6b989 100755 --- a/scripts/check-file-access.py +++ b/scripts/check-file-access.py @@ -42,7 +42,7 @@ proc = subprocess.run(sys.argv[1:]) if proc.returncode != 0 or os.read(access_fd, 10) == b'': os.close(access_fd) os.remove(access_file) - sys.exit(ret) + sys.exit(proc.returncode) known_actions = ["open", "fopen", "access", "stat", "lstat", "connect"] -- 2.51.1

1 0

[PATCH 0/5] ch: Misc cleanups
by Michal Privoznik 07 Nov '25

07 Nov '25

*** BLURB HERE *** Michal Prívozník (5): ch_process: Avoid memleak in chProcessAddNetworkDevice() ch: Use correct domain definition in chDomainGetXMLDesc() ch: Set transient domain definition ch: Assign device alias early ch: Sort driver sources and drop header files src/ch/ch_driver.c | 9 ++++++++- src/ch/ch_hotplug.c | 23 ++++++++++++++++++++--- src/ch/ch_process.c | 13 +++++++++---- src/ch/meson.build | 17 +++-------------- 4 files changed, 40 insertions(+), 22 deletions(-) -- 2.51.0

2 6

Re: [PATCH RFC V6 22/24] monitor,qdev: Introduce 'device_set' to change admin state of existing devices
by Igor Mammedov 07 Nov '25

07 Nov '25

On Thu, 09 Oct 2025 10:55:40 +0200 Markus Armbruster <armbru(a)redhat.com> wrote: > salil.mehta(a)opnsrc.net writes: > > > From: Salil Mehta <salil.mehta(a)huawei.com> > > > > This patch adds a "device_set" interface for modifying properties of devices > > that already exist in the guest topology. Unlike 'device_add'/'device_del' > > (hot-plug), 'device_set' does not create or destroy devices. It is intended > > for guest-visible hot-add semantics where hardware is provisioned at boot but > > logically enabled/disabled later via administrative policy. > > > > Compared to the existing 'qom-set' command, which is less intuitive and works > > only with object IDs, device_set provides a more device-oriented interface. > > It can be invoked at the QEMU prompt using natural device arguments, and the > > new '-deviceset' CLI option allows properties to be set at boot time, similar > > to how '-device' specifies device creation. > > Why can't we use -device? that's was my concern/suggestion in reply to cover letter (as a place to put high level review and what can be done for the next revision) (PS: It looks like I'm having email receiving issues (i.e. not getting from mail list my own emails that it bonces to me, so threading is all broken on my side and I'm might miss replies). But on positive side it looks like my replies reach the list and CCed just fine) > > While the initial implementation focuses on "admin-state" changes (e.g., > > enable/disable a CPU already described by ACPI/DT), the interface is designed > > to be generic. In future, it could be used for other per-device set/unset > > style controls — beyond administrative power-states — provided the target > > device explicitly allows such changes. This enables fine-grained runtime > > control of device properties. > > Beware, designing a generic interface can be harder, sometimes much > harder, than designing a specialized one. > > device_add and qom-set are generic, and they have issues: > > * device_add effectively bypasses QAPI by using 'gen': false. > > This bypasses QAPI's enforcement of documentation. Property > documentation is separate and poor. > > It also defeats introspection with query-qmp-schema. You need to > resort to other means instead, say QOM introspection (which is a bag > of design flaws on its own), then map from QOM to qdev. > > * device_add lets you specify any qdev property, even properties that > are intended only for use by C code. > > This results in accidental external interfaces. > > We tend to name properties like "x-prop" to discourage external use, > but I wouldn't bet my own money on us getting that always right. > Moreover, there's beauties like "x-origin". > > * qom-set & friends effectively bypass QAPI by using type 'any'. > > Again, the bypass results in poor documentation and a defeat of > query-qmp-schema. > > * qom-set lets you mess with any QOM property with a setter callback. > > Again, accidental external interfaces: most of these properties are > not meant for use with qom-set. For some, qom-set works, for some it > silently does nothing, and for some it crashes. A lot more dangerous > than device_add. > > The "x-" convention can't help here: some properties are intended for > external use with object-add, but not with qom-set. > > We should avoid such issues in new interfaces. > > We'll examine how this applies to device_set when I review the QAPI > schema. > > > Key pieces: > > * QMP: qmp_device_set() to update an existing device. The device can be > > located by "id" or via driver+property match using a DeviceListener > > callback (qdev_find_device()). > > * HMP: "device_set" command with tab-completion. Errors are surfaced via > > hmp_handle_error(). > > * CLI: "-deviceset" option for setting startup/admin properties at boot, > > including a JSON form. Options are parsed into qemu_deviceset_opts and > > applied after device creation. > > * Docs/help: HMP help text and qemu-options.hx additions explain usage and > > explicitly note that no hot-plug occurs. > > * Safety: disallowed during live migration (migration_is_idle() check). > > > > Semantics: > > * Operates on an existing DeviceState; no enumeration/new device appears. > > * Complements device_add/device_del by providing state mutation only. > > * Backward compatible: no behavior change unless "device_set"/"-deviceset" > > is used. > > > > Examples: > > HMP: > > (qemu) device_set host-arm-cpu,core-id=3,admin-state=enable > > > > CLI (at boot): > > -smp cpus=4,maxcpus=4 \ > > -deviceset host-arm-cpu,core-id=2,admin-state=disable > > > > QMP (JSON form): > > { "execute": "device_set", > > "arguments": { > > "driver": "host-arm-cpu", > > "core-id": 1, > > "admin-state": "disable" > > } > > } > > {"error": {"class": "CommandNotFound", "desc": "The command device_set has not been found"}} > > Clue below. > > > NOTE: The qdev_enable()/qdev_disable() hooks for acting on admin-state will be > > added in subsequent patches. Device classes must explicitly support any > > property they want to expose through device_set. > > > > Signed-off-by: Salil Mehta <salil.mehta(a)huawei.com> > > --- > > hmp-commands.hx | 30 +++++++++ > > hw/arm/virt.c | 86 +++++++++++++++++++++++++ > > hw/core/cpu-common.c | 12 ++++ > > hw/core/qdev.c | 21 ++++++ > > include/hw/arm/virt.h | 1 + > > include/hw/core/cpu.h | 11 ++++ > > include/hw/qdev-core.h | 22 +++++++ > > include/monitor/hmp.h | 2 + > > include/monitor/qdev.h | 30 +++++++++ > > include/system/system.h | 1 + > > qemu-options.hx | 51 +++++++++++++-- > > system/qdev-monitor.c | 139 +++++++++++++++++++++++++++++++++++++++- > > system/vl.c | 39 +++++++++++ > > 13 files changed, 440 insertions(+), 5 deletions(-) > > Clue: no update to the QAPI schema, i.e. the QMP command does not exist. > > > > > diff --git a/hmp-commands.hx b/hmp-commands.hx > > index d0e4f35a30..18056cf21d 100644 > > --- a/hmp-commands.hx > > +++ b/hmp-commands.hx > > @@ -707,6 +707,36 @@ SRST > > or a QOM object path. > > ERST > > > > +{ > > + .name = "device_set", > > + .args_type = "device:O", > > + .params = "driver[,prop=value][,...]", > > + .help = "set/unset existing device property", > > + .cmd = hmp_device_set, > > + .command_completion = device_set_completion, > > +}, > > + > > +SRST > > +``device_set`` *driver[,prop=value][,...]* > > + Change the administrative power state of an existing device. > > + > > + This command enables or disables a known device (e.g., CPU) using the > > + "device_set" interface. It does not hotplug or add a new device. > > + > > + Depending on platform support (e.g., PSCI or ACPI), this may trigger > > + corresponding operational changes — such as powering down a CPU or > > + transitioning it to active use. > > + > > + Administrative state: > > + * *enabled* — Allows the guest to use the device (e.g., CPU_ON) > > + * *disabled* — Prevents guest use; device is powered off (e.g., CPU_OFF) > > + > > + Note: The device must already exist (be declared during machine creation). > > + > > + Example: > > + (qemu) device_set host-arm-cpu,core-id=3,admin-state=disabled > > +ERST > > How exactly is the device selected? You provide a clue above: 'can be > located by "id" or via driver+property match'. > > I assume by "id" is just like device_del, i.e. by qdev ID or QOM path. > > By "driver+property match" is not obvious. Which of the arguments are > for matching, and which are for setting? > > If "id" is specified, is there any matching? > > The matching feature complicates this interface quite a bit. I doubt > it's worth the complexity. If you think it is, please split it off into > a separate patch. It's likely /me who to blame for asking to invent generic device-set QMP command. I see another application (beside ARM CPU power-on/off) for it, PCI devices to simulate powering on/off them at runtime without actually removing device. wrt command, I'd use only 'id' with it to identify target device (i.e. no template matching nor QMP path either). To enforce rule, what user hasn't named explicitly by providing 'id' isn't meant to be accessed/manged by user later on. potentially we can invent specialized power_set/get command as an alternative if it makes design easier. But then we would be spawning similar commands for other things, where as device-set would cover it all. But then I might be over-complicating things by suggesting a generic approach. > Next question. Is there a way for management applications to detect > whether a certain device supports device_set for a certain property? is there some kind of QMP command to check what does a device support, or at least what properties it supports? Can we piggy-back on that? > > Without that, what are management application supposed to do? Hard-code > what works? Run the command and see whether it fails? Adding libvirt list to discussion and possible ideas on what can be done here. > I understand right now the command supports just "admin-state" for a > certain set of devices, so hard-coding would be possible. But every new > (device, property) pair then requires management application updates, > and the hard-coded information becomes version specific. This will > become unworkable real quick. Not good enough for a command designed to > be generic. > > > + > > { > > .name = "cpu", > > .args_type = "index:i", We still do have a few legacy uses of cpu index (CLI|HMP), but I'd avoid using cpu index or something similar in new interfaces. > [...] > > > diff --git a/qemu-options.hx b/qemu-options.hx > > index 83ccde341b..f517b91042 100644 > > --- a/qemu-options.hx > > +++ b/qemu-options.hx > > @@ -375,7 +375,10 @@ SRST > > This is different from CPU hotplug where additional CPUs are not even > > present in the system description. Administratively disabled CPUs appear in > > ACPI tables i.e. are provisioned, but cannot be used until explicitly > > - enabled via QMP/HMP or the deviceset API. > > + enabled via QMP/HMP or the deviceset API. On ACPI guests, each vCPU counted > > + by 'disabledcpus=' is provisioned with '\ ``_STA``\ ' reporting Present=1 > > + and Enabled=0 (present-offline) at boot; it becomes Enabled=1 when brought > > + online via 'device_set ... admin-state=enable'. > > > > On boards supporting CPU hotplug, the optional '\ ``maxcpus``\ ' parameter > > can be set to enable further CPUs to be added at runtime. When both > > @@ -455,6 +458,15 @@ SRST > > > > -smp 2 > > > > + Note: The cluster topology will only be generated in ACPI and exposed > > + to guest if it's explicitly specified in -smp. > > + > > + Note: Administratively disabled CPUs (specified via 'disabledcpus=' and > > + '-deviceset' at CLI during boot) are especially useful for platforms like > > + ARM that lack native CPU hotplug support. These CPUs will appear to the > > + guest as unavailable, and any attempt to bring them online must go through > > + QMP/HMP commands like 'device_set'. > > + > > Examples using 'disabledcpus': > > > > For a board without CPU hotplug, enable 4 CPUs at boot and provision > > @@ -472,9 +484,6 @@ SRST > > :: > > > > -smp cpus=4,disabledcpus=2,maxcpus=8 > > - > > - Note: The cluster topology will only be generated in ACPI and exposed > > - to guest if it's explicitly specified in -smp. > > ERST > > > > DEF("numa", HAS_ARG, QEMU_OPTION_numa, > > @@ -1281,6 +1290,40 @@ SRST > > > > ERST > > > > +DEF("deviceset", HAS_ARG, QEMU_OPTION_deviceset, > > + "-deviceset driver[,prop[=value]][,...]\n" > > + " Set administrative power state of an existing device.\n" > > + " Does not hotplug a new device. Can disable or enable\n" > > + " devices (such as CPUs) at boot based on policy.\n" > > + " Example:\n" > > + " -deviceset host-arm-cpu,core-id=2,admin-state=disabled\n" > > + " Use '-deviceset help' for supported drivers\n" > > + " Use '-deviceset driver,help' for driver-specific properties\n", > > + QEMU_ARCH_ALL) > > +SRST > > +``-deviceset driver[,prop[=value]][,...]`` > > + Configure an existing device's administrative power state or properties. > > + > > + Unlike ``-device``, this option does not create a new device. Instead, > > + it sets startup properties (such as administrative power state) for > > + a device already declared via -smp or other machine configuration. > > + > > + Example: > > + -smp cpus=4 > > + -deviceset host-arm-cpu,core-id=2,admin-state=disabled > > + > > + The above disables CPU core 2 at boot using administrative offlining. > > + The guest may later re-enable the core (if permitted by platform policy). > > + > > + ``state=enabled|disabled`` > > + Sets the administrative state of the device: > > + - ``enabled``: device is made available at boot > > + - ``disabled``: device is administratively disabled and powered off > > + > > + Use ``-deviceset help`` to view all supported drivers. > > + Use ``-deviceset driver,help`` for property-specific help. > > +ERST > > + > > DEF("name", HAS_ARG, QEMU_OPTION_name, > > "-name string1[,process=string2][,debug-threads=on|off]\n" > > " set the name of the guest\n" > > diff --git a/system/qdev-monitor.c b/system/qdev-monitor.c > > index 2ac92d0a07..1099b1237d 100644 > > --- a/system/qdev-monitor.c > > +++ b/system/qdev-monitor.c > > @@ -263,12 +263,20 @@ static DeviceClass *qdev_get_device_class(const char **driver, Error **errp) > > } > > > > dc = DEVICE_CLASS(oc); > > - if (!dc->user_creatable) { > > + if (!dc->user_creatable && !dc->admin_power_state_supported) { > > error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "driver", > > "a pluggable device type"); > > return NULL; > > } > > > > + if (phase_check(PHASE_MACHINE_READY) && > > + (!dc->hotpluggable || !dc->admin_power_state_supported)) { > > + error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "driver", > > + "a pluggable device type or which supports changing power-" > > + "state administratively"); > > + return NULL; > > + } > > + > > if (object_class_dynamic_cast(oc, TYPE_SYS_BUS_DEVICE)) { > > /* sysbus devices need to be allowed by the machine */ > > MachineClass *mc = MACHINE_CLASS(object_get_class(qdev_get_machine())); > > @@ -939,6 +947,76 @@ void qmp_device_del(const char *id, Error **errp) > > } > > } > > > > +void qmp_device_set(const QDict *qdict, Error **errp) > > +{ > > + const char *state; > > + const char *driver; > > + DeviceState *dev; > > + DeviceClass *dc; > > + const char *id; > > + > > + driver = qdict_get_try_str(qdict, "driver"); > > + if (!driver) { > > + error_setg(errp, "Parameter 'driver' is missing"); > > + return; > > + } > > + > > + /* check driver exists and we are at the right phase of machine init */ > > + dc = qdev_get_device_class(&driver, errp); > > + if (!dc) { > > Since qdev_get_device_class() sets an error when it fails, *errp is not > null here, ... > > > + error_setg(errp, "driver '%s' not supported", driver); > > ... which makes this wrong. Caught by error_setv()'s assertion. > > Please test your error paths. > > > + return; > > + } > > + > > + if (migration_is_running()) { > > + error_setg(errp, "device_set not allowed while migrating"); > > + return; > > + } > > + > > + id = qdict_get_try_str(qdict, "id"); > > + > > + if (id) { > > + /* Lookup by ID */ > > + dev = find_device_state(id, false, errp); > > + if (errp && *errp) { > > + error_prepend(errp, "Device lookup failed for ID '%s': ", id); > > + return; > > + } > > + } else { > > + /* Lookup using driver and properties */ > > + dev = qdev_find_device(qdict, errp); > > + if (errp && *errp) { > > + error_prepend(errp, "Device lookup for %s failed: ", driver); > > + return; > > + } > > + } > > + if (!dev) { > > + error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND, > > + "No device found for driver '%s'", driver); > > + return; > > + } > > + > > + state = qdict_get_try_str(qdict, "admin-state"); > > + if (!state) { > > + error_setg(errp, "no device state change specified for device %s ", > > + dev->id); > > + return; > > + } else if (!strcmp(state, "enable")) { > > + > > + if (!qdev_enable(dev, qdev_get_parent_bus(DEVICE(dev)), errp)) { > > + return; > > + } > > + } else if (!strcmp(state, "disable")) { > > + if (!qdev_disable(dev, qdev_get_parent_bus(DEVICE(dev)), errp)) { > > + return; > > + } > > + } else { > > + error_setg(errp, "unrecognized specified state *%s* for device %s", > > + state, dev->id); > > + return; > > + } > > +} > > + > > int qdev_sync_config(DeviceState *dev, Error **errp) > > { > > DeviceClass *dc = DEVICE_GET_CLASS(dev); > > [...] >

4 10

[PATCH 0/5] nwfilter: add nwfilter nftables driver
by Dion Bosschieter 07 Nov '25

07 Nov '25

This series aims to implement nftables as a backend driver for the nwfilter feature. The idea is that eventually it will replace the ebiptables driver and provide an easy way for users to switch from one driver to another. The first 2 patches are moving of functions and renames, meant to decouple nwfilter from the currently only existing ebiptables driver. The 3rd patch introduces the new nwfilter driver. After which nwfilter allows users to choose it in the 4th patch. The last patch introduces unit testing of the new nftables driver. - Implemented very basic nwfilter.conf reading and choosing a nwfilter driver based on the name of the drivers (nftables/ebiptables). Defaults to the ebiptables driver. - Resolves issue https://gitlab.com/libvirt/libvirt/-/issues/603 benchmarks showed that the amount of iifname jumps for each interface with is the cause for this. Switched the nftables driver towards a vmap (verdict map) so we can have 1 rule that jumps to the correct root input/output chain per interface. Which improves throughput as when the number of interface check and jump rules increases the throughput decreases. The issue describes the interface matching works using the interface name and the majority of the effort is the strncpy, this commit also switches nftables to an interface_index compare instead. However, just using the interface_index is not enough, the amount of oif and iif jump rules causes quite a performance issue, the vmap instead solves this. - Split rules into separate tables: "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other" to preserve existing firewall behavior. - Reworked chain logic for clarity with root -input/-output chains per interface. input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). - Stuck with prerouting and postrouting as hooks for input / output on the -ethernet and -other table. This makes it easier to merge the tables in the future. Saving management of two tables and decreasing the amount of tables a packet sees. Currently ebtables filtering happens via PREROUTING and POSTROUTING hooks, while ip/ip6tables filtering happens in the output/forward hooks. - Stuck with 2 tables for compatibility reasons with eb iptables, unifying into 1 table will break users firewall definitions, which depend on being able to do accepts on ethernet rules (which currently get defined via ebtables) and additional filtering via the ip rules (which currently get defined via ip(6)tables). The nwfilter_nftables_driver keeps splitting the ethernet and non ethernet (other) rules in seperate tables "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other". - Rewrote chain logic, so it is easier to understand, input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). -ethernet and -other table follow the same style and hook in the same way. - Simplified conntrack handling: rules with accept+conntrack are duplicated to the opposite chain for symmetric behavior, to support the existing ebiptables logic. - Firewall updates continue use tmp names for atomic replacement. Unsupported nwfilter features (for now): - STP filtering - Gratuitous ARP filtering - IPSets (potential future support via nft sets) - Reject due to filtering in pre/postrouting, using drop instead of reject, copying logic from existing ebiptables ebtables actions Future improvements: - Use `nft -f` for atomic rule application. - Optional single-table mode via nwfilter.conf. - Optimize boot phase with chain hash comparison. Dion Bosschieter (5): nwfilter: rename ebiptables unit tests and data files nwfilter: move shared nwfilter driver functions into nwfilter_tech_driver.c nwfilter: add nwfilter nftables driver nwfilter: allow use of nftables nwfilter driver via nwfilter.conf nwfilter: add unit tests and test data for nwfilter nftables driver po/POTFILES | 2 + src/nwfilter/meson.build | 2 + src/nwfilter/nwfilter_driver.c | 49 +- src/nwfilter/nwfilter_ebiptables_driver.c | 262 +- src/nwfilter/nwfilter_gentech_driver.c | 60 +- src/nwfilter/nwfilter_gentech_driver.h | 4 +- src/nwfilter/nwfilter_nftables_driver.c | 2374 +++++++++++ src/nwfilter/nwfilter_nftables_driver.h | 28 + src/nwfilter/nwfilter_tech_driver.c | 250 ++ src/nwfilter/nwfilter_tech_driver.h | 50 +- tests/meson.build | 4 +- tests/nwfilternftablestest.c | 428 ++ .../ah-ipv6-linux.args | 0 .../ah-linux.args | 0 .../all-ipv6-linux.args | 0 .../all-linux.args | 0 .../arp-linux.args | 0 .../comment-linux.args | 0 .../conntrack-linux.args | 0 .../esp-ipv6-linux.args | 0 .../esp-linux.args | 0 .../example-1-linux.args | 0 .../example-2-linux.args | 0 .../hex-data-linux.args | 0 .../icmp-direction-linux.args | 0 .../icmp-direction2-linux.args | 0 .../icmp-direction3-linux.args | 0 .../icmp-linux.args | 0 .../icmpv6-linux.args | 0 .../igmp-linux.args | 0 .../ip-linux.args | 0 .../ipset-linux.args | 0 .../ipt-no-macspoof-linux.args | 0 .../ipv6-linux.args | 0 .../iter1-linux.args | 0 .../iter2-linux.args | 0 .../iter3-linux.args | 0 .../mac-linux.args | 0 .../rarp-linux.args | 0 .../sctp-ipv6-linux.args | 0 .../sctp-linux.args | 0 .../stp-linux.args | 0 .../target-linux.args | 0 .../target2-linux.args | 0 .../tcp-ipv6-linux.args | 0 .../tcp-linux.args | 0 .../udp-ipv6-linux.args | 0 .../udp-linux.args | 0 .../udplite-ipv6-linux.args | 0 .../udplite-linux.args | 0 .../vlan-linux.args | 0 ...ltest.c => nwfilterxml2ebipfirewalltest.c} | 4 +- .../ah-ipv6-linux.args | 304 ++ .../nwfilterxml2nftfirewalldata/ah-linux.args | 298 ++ .../all-ipv6-linux.args | 286 ++ .../all-linux.args | 280 ++ .../arp-linux.args | 215 + tests/nwfilterxml2nftfirewalldata/arp.xml | 27 + .../comment-linux.args | 483 +++ .../conntrack-linux.args | 198 + .../esp-ipv6-linux.args | 304 ++ .../esp-linux.args | 298 ++ .../example-1-linux.args | 266 ++ .../example-2-linux.args | 348 ++ .../hex-data-linux.args | 357 ++ .../icmp-direction-linux.args | 238 ++ .../icmp-direction2-linux.args | 238 ++ .../icmp-direction3-linux.args | 184 + .../icmp-linux.args | 252 ++ .../icmpv6-linux.args | 322 ++ .../igmp-linux.args | 298 ++ .../nwfilterxml2nftfirewalldata/ip-linux.args | 198 + .../ipt-no-macspoof-linux.args | 169 + .../ipv6-linux.args | 474 +++ .../iter1-linux.args | 298 ++ .../iter2-linux.args | 3598 +++++++++++++++++ .../iter3-linux.args | 418 ++ .../mac-linux.args | 180 + .../rarp-linux.args | 215 + .../sctp-ipv6-linux.args | 314 ++ .../sctp-linux.args | 314 ++ .../target-linux.args | 452 +++ .../target2-linux.args | 316 ++ .../tcp-ipv6-linux.args | 314 ++ .../tcp-linux.args | 468 +++ .../udp-ipv6-linux.args | 314 ++ .../udp-linux.args | 314 ++ .../udplite-ipv6-linux.args | 304 ++ .../udplite-linux.args | 298 ++ .../vlan-linux.args | 264 ++ tests/nwfilterxml2nftfirewalltest.c | 438 ++ 91 files changed, 18066 insertions(+), 307 deletions(-) create mode 100644 src/nwfilter/nwfilter_nftables_driver.c create mode 100644 src/nwfilter/nwfilter_nftables_driver.h create mode 100644 src/nwfilter/nwfilter_tech_driver.c create mode 100644 tests/nwfilternftablestest.c rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/ah-ipv6-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/ah-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/all-ipv6-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/all-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/arp-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/comment-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/conntrack-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/esp-ipv6-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/esp-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/example-1-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/example-2-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/hex-data-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/icmp-direction-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/icmp-direction2-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/icmp-direction3-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/icmp-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/icmpv6-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/igmp-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/ip-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/ipset-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/ipt-no-macspoof-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/ipv6-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/iter1-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/iter2-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/iter3-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/mac-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/rarp-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/sctp-ipv6-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/sctp-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/stp-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/target-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/target2-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/tcp-ipv6-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/tcp-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/udp-ipv6-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/udp-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/udplite-ipv6-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/udplite-linux.args (100%) rename tests/{nwfilterxml2firewalldata => nwfilterxml2ebipfirewalldata}/vlan-linux.args (100%) rename tests/{nwfilterxml2firewalltest.c => nwfilterxml2ebipfirewalltest.c} (99%) create mode 100755 tests/nwfilterxml2nftfirewalldata/ah-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/ah-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/all-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/all-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/arp-linux.args create mode 100644 tests/nwfilterxml2nftfirewalldata/arp.xml create mode 100755 tests/nwfilterxml2nftfirewalldata/comment-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/conntrack-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/esp-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/esp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/example-1-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/example-2-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/hex-data-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/icmp-direction-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/icmp-direction2-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/icmp-direction3-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/icmp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/icmpv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/igmp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/ip-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/ipt-no-macspoof-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/iter1-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/iter2-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/iter3-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/mac-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/rarp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/sctp-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/sctp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/target-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/target2-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/tcp-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/tcp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/udp-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/udp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/udplite-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/udplite-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/vlan-linux.args create mode 100644 tests/nwfilterxml2nftfirewalltest.c -- 2.43.0

2 7

[PATCH v3 0/2] [PATCH v3 0/3] qemu: use query-accelerators to query accelerators
by Praveen K Paladugu 07 Nov '25

07 Nov '25

Use the new 'query-accelerators' QMP command to query accelerators enabled in QEMU. v3: - Addressed all the pending feedback from v2 - Broke up the patch into 2 separate commits Praveen K Paladugu (2): qemu: Introduce query-accelerators cap qemu: Use query-accelerators to query accelerators src/qemu/qemu_capabilities.c | 40 ++++++++++++++++--- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_monitor.c | 9 +++++ src/qemu/qemu_monitor.h | 4 ++ src/qemu/qemu_monitor_json.c | 23 +++++++++++ src/qemu/qemu_monitor_json.h | 5 +++ .../caps_10.2.0_x86_64.replies | 11 +++-- .../caps_10.2.0_x86_64.xml | 1 + 8 files changed, 86 insertions(+), 8 deletions(-) -- 2.51.0

2 4