December 2025 - Devel - libvirt List Archives

Re: Clarification Needed: virsh snapshot-delete Behavior with External Snapshots (--disk-only)
by Peter Krempa 10 Apr '26

10 Apr '26

On Wed, Jul 23, 2025 at 04:57:57 +0000, P, Rajasekar via Users wrote: > Hello libvirt community, > > I am seeking clarification on the behavior of `virsh snapshot-delete` when used with external snapshots (created with the `--disk-only` option). > > **Environment:** > - libvirt version: 10.5.0 Note that this was released almost a year ago. > - Kernel version: 5.14.0-503.22.1.el9_5.x86_64 > - Disk image format: qcow2 > - Host OS: RHEL 9.5 > > **Steps to reproduce:** > 1. Create an external snapshot: > virsh snapshot-create-as --domain <vm> --name snap1 --disk-only --atomic > 2. Delete the snapshot: > virsh snapshot-delete <vm> --snapshotname snap1 > > **Observed behavior:** > - Changes from the overlay (snapshot) file are merged into the base image. > - The snapshot metadata is removed from libvirt. > - The snapshot file remains on disk (appears orphaned). You mean that the original overlay images remained on disk? e.g. /path/to/originalimage.snap1 ? > **Questions:** > - Is the observed automatic merge of the overlay file into the base image during `snapshot-delete` the intended behavior for external snapshots in recent libvirt versions? Or we need separate `blockcommit` step. Yes it is intended, because deleting a snapshot is effectively meaning "I don't want to return to this point any more" so the extra overlay makes no sense. > - Should the snapshot file be deleted automatically, or is manual cleanup required? If you mean the overlay, then yes it should have been deleted. > - Is there any official documentation that clarifies this behavior for external snapshots, as most documentation seems to focus on internal snapshots? The semantics of external and internal snapshots are supposed to be indentical. I don't think we document to a deep extent the actual behaviour WRT to the disk files.

2 1

[PULL 00/32] Next pr patches
by Daniel P. Berrangé 03 Apr '26

03 Apr '26

The following changes since commit 53b41bb78950912ba2d9809eef6b45e4df30c647: Merge tag 'pull-target-arm-20251031' of https://gitlab.com/pm215/qemu into staging (2025-11-01 10:52:48 +0100) are available in the Git repository at: https://gitlab.com/berrange/qemu tags/next-pr-pull-request for you to fetch changes up to 2aaca8c6d22b18786ceff51189704113d0639590: docs: creation of x509 certs compliant with post-quantum crypto (2025-11-03 10:45:55 +0000) ---------------------------------------------------------------- Merge crypto and other misc fixes / features * Increase minimum gnutls to 3.7.5 * Increase minimum libgcrypt to 1.9.4 * Increase minimum nettle to 3.7.3 * Drop obsolete in-tree XTS impl * Fix memory leak when loading certificates * Remove/reduce duplication when loading certifcates * Fix possible crash when certificates are unloaded while an active TLS connection is using when in a TLS handshake operation * Deprecate use of dh-params.pem file * Document how to create certificates with Post-Quantum Cryptography compliant algorithms. * Support loading multiple certificate identities to allow support for Post-Quantum crypto in parallel with traditional RSA/ECC * Add "-run-with exit-with-parent=on" parameter * Flush pending errors when seeing ENOBUFS with a zero-copy send attempt * Fix data buffer parameters in hash & IO channel APIs to use 'void *' ---------------------------------------------------------------- Daniel P. Berrangé (26): crypto: bump min gnutls to 3.7.5 crypto: unconditionally enable gnutls XTS support crypto: bump min libgcrypt to 1.9.4 crypto: bump min nettle to 3.7.3 crypto: drop in-tree XTS cipher mode impl crypto: remove redundant parameter checking CA certs crypto: add missing free of certs array crypto: replace stat() with access() for credential checks crypto: remove redundant access() checks before loading certs crypto: move check for TLS creds 'dir' property crypto: use g_autofree when loading x509 credentials crypto: remove needless indirection via parent_obj field crypto: move release of DH parameters into TLS creds parent crypto: shorten the endpoint == server check in TLS creds crypto: remove duplication loading x509 CA cert crypto: reduce duplication in handling TLS priority strings crypto: introduce method for reloading TLS creds crypto: introduce a wrapper around gnutls credentials crypto: fix lifecycle handling of gnutls credentials objects crypto: make TLS credentials structs private crypto: deprecate use of external dh-params.pem file crypto: avoid loading the CA certs twice crypto: avoid loading the identity certs twice crypto: expand logic to cope with multiple certificate identities crypto: support upto 5 parallel certificate identities docs: creation of x509 certs compliant with post-quantum crypto Manish Mishra (1): io: flush zerocopy socket error queue on sendmsg failure due to ENOBUF Philippe Mathieu-Daudé (2): crypto/hash: Have hashing functions take void * buffer argument io/channel: Have read/write functions take void * buffer argument Richard W.M. Jones (2): Implement -run-with exit-with-parent=on tests/qtest: Use exit-with-parent=on in qtest invocations Tejus GK (1): io: add a "blocking" field to QIOChannelSocket crypto/cipher-gnutls.c.inc | 8 - crypto/cipher-nettle.c.inc | 44 -- crypto/cipher.c | 2 +- crypto/hash.c | 16 +- crypto/hmac.c | 8 +- crypto/meson.build | 10 +- crypto/tlscreds.c | 79 ++-- crypto/tlscredsanon.c | 64 +-- crypto/tlscredsbox.c | 101 +++++ crypto/tlscredsbox.h | 50 +++ crypto/tlscredspriv.h | 36 +- crypto/tlscredspsk.c | 64 ++- crypto/tlscredsx509.c | 593 +++++++++++++++++--------- crypto/tlssession.c | 139 ++---- crypto/trace-events | 1 + crypto/xts.c | 250 ----------- docs/about/deprecated.rst | 9 + docs/system/tls.rst | 134 +++++- include/crypto/hash.h | 8 +- include/crypto/hmac.h | 4 +- include/crypto/tlscreds.h | 26 ++ include/crypto/tlscredsx509.h | 6 + include/crypto/tlssession.h | 4 +- include/crypto/xts.h | 82 ---- include/io/channel-socket.h | 6 + include/io/channel.h | 14 +- include/qemu/exit-with-parent.h | 57 +++ io/channel-socket.c | 86 +++- io/channel-tls.c | 4 +- io/channel.c | 14 +- meson.build | 69 +-- qemu-options.hx | 13 +- system/exit-with-parent.c | 140 ++++++ system/meson.build | 1 + system/vl.c | 13 + tests/qtest/libqtest.c | 22 +- tests/unit/meson.build | 3 - tests/unit/test-crypto-block.c | 3 +- tests/unit/test-crypto-tlscredsx509.c | 8 +- tests/unit/test-crypto-tlssession.c | 4 +- tests/unit/test-crypto-xts.c | 529 ----------------------- ui/vnc.c | 9 +- 42 files changed, 1208 insertions(+), 1525 deletions(-) create mode 100644 crypto/tlscredsbox.c create mode 100644 crypto/tlscredsbox.h delete mode 100644 crypto/xts.c delete mode 100644 include/crypto/xts.h create mode 100644 include/qemu/exit-with-parent.h create mode 100644 system/exit-with-parent.c delete mode 100644 tests/unit/test-crypto-xts.c -- 2.51.1

2 33

[PATCH v2] virhostcpu: Fix potential use of unallocated memory
by Felix Huettner 26 Mar '26

26 Mar '26

In case of a host that has a large number of cpus offline the count of host cpus and the last bit set in the virHostCPUGetOnlineBitmap might diverge significantly. This can e.g. be the case when disabling smt via /sys/devices/system/cpu/smt/control. On the host this looks like: ``` $ cat /sys/devices/system/cpu/present 0-255 $ cat /sys/devices/system/cpu/online 0-127 ``` However in this case virBitmapToData previously only allocated 16 bytes for the output bitmap. This is becase the last set bit is on the 15th byte. Users of virHostCPUGetMap however rely on the "cpumap" containing enough space for all existing cpus (so they would expect 32 bytes in this case). E.g. cmdNodeCpuMap relies on this for its output. It will then actually read 32 bytes from the start of the "cpumap" address where in this case the last 16 of these bytes are uninitialized. This manifests itself in flapping outputs of "virsh nodecpumap --pretty" like: ``` $ virsh nodecpumap --pretty CPUs present: 256 CPUs online: 128 CPU map: 0-127,192,194,202 $ virsh nodecpumap --pretty CPUs present: 256 CPUs online: 128 CPU map: 0-127,192,194,197 $ virsh nodecpumap --pretty CPUs present: 256 CPUs online: 128 CPU map: 0-127,192,194,196-197 ``` This in turn potentially causes users of this data to report wrong cpu counts. Note that this only seems to happen with at least 256 physical cpus where at least 128 are offline. We fix this by preallocating the expected bitmap size. Signed-off-by: Felix Huettner <felix.huettner(a)stackit.cloud> --- src/util/virhostcpu.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/src/util/virhostcpu.c b/src/util/virhostcpu.c index 5dbcc8987c..4805484b1d 100644 --- a/src/util/virhostcpu.c +++ b/src/util/virhostcpu.c @@ -1090,28 +1090,26 @@ virHostCPUGetMap(unsigned char **cpumap, unsigned int flags) { g_autoptr(virBitmap) cpus = NULL; - int ret = -1; - int dummy; + int ncpus = virHostCPUGetCount(); virCheckFlags(0, -1); if (!cpumap && !online) - return virHostCPUGetCount(); + return ncpus; if (!(cpus = virHostCPUGetOnlineBitmap())) - goto cleanup; + return -1; + + if (cpumap) { + int len = (ncpus + CHAR_BIT) / CHAR_BIT; + *cpumap = g_new0(unsigned char, len); + virBitmapToDataBuf(cpus, *cpumap, len); + } - if (cpumap) - virBitmapToData(cpus, cpumap, &dummy); if (online) *online = virBitmapCountBits(cpus); - ret = virHostCPUGetCount(); - - cleanup: - if (ret < 0 && cpumap) - VIR_FREE(*cpumap); - return ret; + return ncpus; } base-commit: c5a73f75bc6cae4f466d0a6344d5b3277ac9c2f4 -- 2.43.0

2 1

[PATCH 0/3] Add 'scalable_mode' and 'first_stage' attributes to intel IOMMU
by Zhenzhong Duan 06 Mar '26

06 Mar '26

Hi, This adds 'scalable_mode' and 'first_stage' attributes to intel IOMMU so that emulated device can run with first stage translation. This is based on Nathan Chen's iommufd series v2[1], so for passthrough device, nested tranlation is enabled automatically with below config: <iommu model='intel'> <driver caching_mode='on' iotlb='on' scalable_mode='on' first_stage='on'/> </iommu> Tests: Basic net card passthrough libvirt selftest Thanks Zhenzhong [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/KFYU… Zhenzhong Duan (3): qemu: Introduce scalable_mode and first_stage capabilities conf: add support for 'scalable_mode' and 'first_stage' attributes to intel IOMMU qemu: Add command line support for scalable mode and first stage of virtual vtd docs/formatdomain.rst | 8 +++++ src/conf/domain_conf.c | 35 ++++++++++++++++++- src/conf/domain_conf.h | 2 ++ src/conf/domain_validate.c | 6 ++++ src/conf/schemas/domaincommon.rng | 10 ++++++ src/qemu/qemu_capabilities.c | 4 +++ src/qemu/qemu_capabilities.h | 2 ++ src/qemu/qemu_command.c | 2 ++ src/qemu/qemu_validate.c | 12 +++++++ .../caps_10.0.0_x86_64+amdsev.xml | 2 ++ .../caps_10.0.0_x86_64.xml | 2 ++ .../caps_10.1.0_x86_64+inteltdx.xml | 2 ++ .../caps_10.1.0_x86_64.xml | 2 ++ .../caps_10.2.0_x86_64.xml | 2 ++ .../caps_6.2.0_x86_64.xml | 1 + .../caps_7.0.0_x86_64.xml | 1 + .../caps_7.1.0_x86_64.xml | 1 + .../caps_7.2.0_x86_64+hvf.xml | 1 + .../caps_7.2.0_x86_64.xml | 1 + .../caps_8.0.0_x86_64.xml | 1 + .../caps_8.1.0_x86_64.xml | 1 + .../caps_8.2.0_x86_64.xml | 1 + .../caps_9.0.0_x86_64.xml | 1 + .../caps_9.1.0_x86_64.xml | 1 + .../caps_9.2.0_x86_64+amdsev.xml | 1 + .../caps_9.2.0_x86_64.xml | 1 + 26 files changed, 102 insertions(+), 1 deletion(-) -- 2.47.3

3 6

[PULL 02/18] deprecation: don't enable TCG plugins by default with TCI
by Alex Bennée 27 Feb '26

27 Feb '26

The softmmu memory instrumentation test sees so many more accesses than a normal translated host and its really not worth fixing up. Lets deprecate this odd configuration and save on the CI cycles. Reviewed-by: Pierrick Bouvier <pierrick.bouvier(a)linaro.org> Signed-off-by: Alex Bennée <alex.bennee(a)linaro.org> Message-Id: <20240916085400.1046925-3-alex.bennee(a)linaro.org> diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 809b2b9b81..c0aa52def5 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -196,6 +196,14 @@ benefits from having plenty of host memory it seems reasonable to encourage users to use 64 bit builds of QEMU for analysis work whatever targets they are instrumenting. +TCG Plugin support not enabled by default with TCI (since 9.2) +'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +While the TCG interpreter can interpret the TCG ops used by plugins it +is going to be so much slower it wouldn't make sense for any serious +instrumentation. Due to implementation differences there will also be +anomalies in things like memory instrumentation. + System emulator CPUs -------------------- diff --git a/configure b/configure index cc8e1ed5b8..aa7aae70fa 100755 --- a/configure +++ b/configure @@ -629,6 +629,9 @@ meson_option_parse() { exit 1 fi } +has_meson_option() { + test "${meson_options#*"$1"}" != "$meson_options" +} meson_add_machine_file() { if test "$cross_compile" = "yes"; then @@ -1048,8 +1051,12 @@ if test "$static" = "yes" ; then plugins="no" fi if test "$plugins" != "no" && test $host_bits -eq 64; then - plugins=yes - subdirs="$subdirs contrib/plugins" + if has_meson_option "-Dtcg_interpreter=true"; then + plugins="no" + else + plugins=yes + subdirs="$subdirs contrib/plugins" + fi fi cat > $TMPC << EOF -- 2.39.5

2 1

[PATCH v2 0/2] allow migrations with the ext transport
by Sergey Dyasli 19 Feb '26

19 Feb '26

Hello, I have a use case for live-migration where the socket of the destination libvirtd is proxied by an mTLS WebSocket proxy. Since there is no WebSocket support in Libvirt, I've decided to use the existing ext transport and point it to a proxy binary on the source host of live-migration. While doing that, I've discovered a couple of roadblocks: 1. There is no way of passing cmdline arguments to the ext program 2. Live-migrations using ext transport fail localhost checks This short series addresses those limitations. Sergey Dyasli (2): remote: allow passing argv to the ext transport remote: allow migrations with the ext transport v1 -> v2: - new way of passing argv src/libvirt-domain.c | 8 +++++--- src/remote/remote_driver.c | 30 ++++++++++++++++++++++++++---- src/util/viruri.c | 32 ++++++++++++++++++++++++++++++++ src/util/viruri.h | 2 ++ 4 files changed, 65 insertions(+), 7 deletions(-) -- 2.43.7

3 5

[PATCH v6] qapi: net: deprecate vhostforce option
by Vladimir Sementsov-Ogievskiy 18 Feb '26

18 Feb '26

This option for tap and vhost-user netdevs doesn't make sense since long ago (10 years!), starting from commits: 1e7398a140f7a6 ("vhost: enable vhost without without MSI-X") 24f938a682d934 ("vhost user:support vhost user nic for non msi guests") Prior these commits, to enable kernel vhost-net, or vhost-user-net for some specific kind of guests (that don't have MSI-X support), you should have set vhostforce=on. Now guest type doesn't matter, all guests are equal for these options logic. For tap the current logic is: vhost=on / vhost=off : vhostforce ignored, doesn't make sense vhost unset : vhostforce counts, enabling vhost So you may enable vhost for tap several ways: - vhost=on - vhostforce=on - vhost=on + vhostforce=on - and even vhost=on + vhostforce=off - they are all equal. For vhost-user we simply ignore the vhostforce option at all in the code. Let's finally deprecate the extra options. Also, fix @vhostforce documentation everywhere to show the real picture, and update vhost-user test to not use deprecated option. While updating command line options, drop "experimental" word from "experimental in kernel accelerator". vhost-net is in production for years. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> Reviewed-by: Markus Armbruster <armbru(a)redhat.com> --- v6: - update numbers 10.2 -> 11.0 - add r-b by Markus docs/about/deprecated.rst | 11 +++++++++++ qapi/net.json | 18 ++++++++++++++---- qemu-options.hx | 13 +++++-------- tests/qtest/vhost-user-test.c | 2 +- 4 files changed, 31 insertions(+), 13 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 03e29915f0..3f97392a45 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -498,6 +498,17 @@ Backend ``memory`` (since 9.0) ``memory`` is a deprecated synonym for ``ringbuf``. +TAP ``vhostforce`` (since 11.0) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The ``vhostforce`` option is redundant with the ``vhost`` option. +If they conflict, ``vhost`` takes precedence. Just use ``vhost``. + +Vhost-user ``vhostforce`` (since 11.0) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The ``vhostforce`` option is a no-op. Do not use it. + CPU device properties ''''''''''''''''''''' diff --git a/qapi/net.json b/qapi/net.json index 118bd34965..9a00d578e9 100644 --- a/qapi/net.json +++ b/qapi/net.json @@ -348,13 +348,18 @@ # @vhostfds: file descriptors of multiple already opened vhost net # devices # -# @vhostforce: vhost on for non-MSIX virtio guests +# @vhostforce: enable vhost-net network accelerator. Ignored when +# @vhost is set. # # @queues: number of queues to be created for multiqueue capable tap # # @poll-us: maximum number of microseconds that could be spent on busy # polling for tap (since 2.7) # +# Features: +# +# @deprecated: Member @vhostforce is deprecated. Use @vhost instead. +# # Since: 1.2 ## { 'struct': 'NetdevTapOptions', @@ -371,7 +376,7 @@ '*vhost': 'bool', '*vhostfd': 'str', '*vhostfds': 'str', - '*vhostforce': 'bool', + '*vhostforce': { 'type': 'bool', 'features': [ 'deprecated' ] }, '*queues': 'uint32', '*poll-us': 'uint32'} } @@ -610,17 +615,22 @@ # # @chardev: name of a unix socket chardev # -# @vhostforce: vhost on for non-MSIX virtio guests (default: false). +# @vhostforce: silently ignored, exists just for backward +# compatibility. # # @queues: number of queues to be created for multiqueue vhost-user # (default: 1) (Since 2.5) # +# Features: +# +# @deprecated: Member @vhostforce is deprecated. +# # Since: 2.1 ## { 'struct': 'NetdevVhostUserOptions', 'data': { 'chardev': 'str', - '*vhostforce': 'bool', + '*vhostforce': { 'type': 'bool', 'features': [ 'deprecated' ] }, '*queues': 'int' } } ## diff --git a/qemu-options.hx b/qemu-options.hx index fca2b7bc74..414b762743 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -2882,7 +2882,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, #else "-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]\n" " [,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]\n" - " [,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]\n" + " [,vhostfd=h][,vhostfds=x:y:...:z][,queues=n]\n" " [,poll-us=n]\n" " configure a host TAP network backend with ID 'str'\n" " connected to a bridge (default=" DEFAULT_BRIDGE_INTERFACE ")\n" @@ -2898,9 +2898,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')\n" " use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag\n" " use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition\n" - " use vhost=on to enable experimental in kernel accelerator\n" - " (only has effect for virtio guests which use MSIX)\n" - " use vhostforce=on to force vhost on for non-MSIX virtio guests\n" + " use vhost=on to enable in kernel accelerator\n" " use 'vhostfd=h' to connect to an already opened vhost net device\n" " use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices\n" " use 'queues=n' to specify the number of queues to be created for multiqueue TAP\n" @@ -2991,7 +2989,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " use 'start-queue=m' to specify the first queue that should be used\n" #endif #ifdef CONFIG_POSIX - "-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]\n" + "-netdev vhost-user,id=str,chardev=dev\n" " configure a vhost-user network, backed by a chardev 'dev'\n" #endif #ifdef __linux__ @@ -3882,12 +3880,11 @@ SRST for insertion into the socket map. The combination of 'map-path' and 'sock-fds' together is not supported. -``-netdev vhost-user,chardev=id[,vhostforce=on|off][,queues=n]`` +``-netdev vhost-user,chardev=id[,queues=n]`` Establish a vhost-user netdev, backed by a chardev id. The chardev should be a unix domain socket backed one. The vhost-user uses a specifically defined protocol to pass vhost ioctl replacement - messages to an application on the other end of the socket. On - non-MSIX guests, the feature can be forced with vhostforce. Use + messages to an application on the other end of the socket. Use 'queues=n' to specify the number of queues to be created for multiqueue vhost-user. diff --git a/tests/qtest/vhost-user-test.c b/tests/qtest/vhost-user-test.c index d2bb21d5b9..f977f50baf 100644 --- a/tests/qtest/vhost-user-test.c +++ b/tests/qtest/vhost-user-test.c @@ -46,7 +46,7 @@ #define QEMU_CMD_SHM " -m %d -object memory-backend-shm,id=mem,size=%dM," \ " -numa node,memdev=mem" #define QEMU_CMD_CHR " -chardev socket,id=%s,path=%s%s" -#define QEMU_CMD_NETDEV " -netdev vhost-user,id=hs0,chardev=%s,vhostforce=on" +#define QEMU_CMD_NETDEV " -netdev vhost-user,id=hs0,chardev=%s" #define HUGETLBFS_MAGIC 0x958458f6 -- 2.48.1

2 4

[PATCH v3 0/7] USB hostdev: allow addressing by port
by Maximilian Martin 11 Feb '26

11 Feb '26

Currently, only vendor/product and bus/device matching are supported for USB host devices. Neither of these provide a stable and persistent way of assigning a guest a specific host device. Vendor/product can be ambiguous. Device numbers change on every enumeration. This patch adds a bus/port matching, which allows a specific port on the host to be specified using the dotted notation found in Linux's "devpath" sysfs attribute. The path series is based on the previous work of Thomas Hebb: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/7U3… This resubmission includes Daniel's patch which extends the USB hostdev test logic. Maximilian Martin (7): tests: validate an XML config with USB vendor/product set virusb test data: add devpath files for port addressing domain_conf, virhostdev, virusb, virusb test: add bus/port matching schema: add USB port attribute tests: validate an XML config with USB bus/port set nodedev: add USB port to nodedev XML docs: add description for USB port matching docs/formatdomain.rst | 29 ++-- src/conf/domain_conf.c | 58 ++++++- src/conf/domain_conf.h | 1 + src/conf/node_device_conf.c | 5 + src/conf/node_device_conf.h | 1 + src/conf/schemas/basictypes.rng | 31 ++++ src/conf/schemas/domaincommon.rng | 41 +---- src/conf/schemas/nodedev.rng | 3 + src/hypervisor/virhostdev.c | 131 ++++++++------ src/libvirt_private.syms | 2 - src/node_device/node_device_udev.c | 4 + src/util/virusb.c | 160 ++++++------------ src/util/virusb.h | 22 +-- .../usb_device_1d6b_1_0000_00_1d_0.xml | 1 + ...ostdev-usb-address-port.x86_64-latest.args | 36 ++++ ...hostdev-usb-address-port.x86_64-latest.xml | 45 +++++ .../hostdev-usb-address-port.xml | 28 +++ ...tdev-usb-vendor-product.x86_64-latest.args | 35 ++++ ...stdev-usb-vendor-product.x86_64-latest.xml | 44 +++++ .../hostdev-usb-vendor-product.xml | 36 ++++ tests/qemuxmlconftest.c | 25 +++ tests/virusbtest.c | 149 +++++++++++----- .../sys_bus_usb/devices/1-1.5.3.1/devpath | 1 + .../sys_bus_usb/devices/1-1.5.3.3/devpath | 1 + .../sys_bus_usb/devices/1-1.5.3/devpath | 1 + .../sys_bus_usb/devices/1-1.5.4/devpath | 1 + .../sys_bus_usb/devices/1-1.5.5/devpath | 1 + .../sys_bus_usb/devices/1-1.5.6/devpath | 1 + .../sys_bus_usb/devices/1-1.5/devpath | 1 + .../sys_bus_usb/devices/1-1.6/devpath | 1 + .../sys_bus_usb/devices/1-1/devpath | 1 + .../sys_bus_usb/devices/2-1.2/devpath | 1 + .../sys_bus_usb/devices/2-1/devpath | 1 + .../sys_bus_usb/devices/usb1/devpath | 1 + .../sys_bus_usb/devices/usb2/devpath | 1 + .../sys_bus_usb/devices/usb3/devpath | 1 + .../sys_bus_usb/devices/usb4/devpath | 1 + 37 files changed, 631 insertions(+), 271 deletions(-) create mode 100644 tests/qemuxmlconfdata/hostdev-usb-address-port.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/hostdev-usb-address-port.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/hostdev-usb-address-port.xml create mode 100644 tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/hostdev-usb-vendor-product.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/hostdev-usb-vendor-product.xml create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/1-1.5.3.1/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/1-1.5.3.3/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/1-1.5.3/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/1-1.5.4/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/1-1.5.5/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/1-1.5.6/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/1-1.5/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/1-1.6/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/1-1/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/2-1.2/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/2-1/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/usb1/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/usb2/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/usb3/devpath create mode 100644 tests/virusbtestdata/sys_bus_usb/devices/usb4/devpath -- 2.39.5

3 13

Qemu pause-before-switchover and libvirt live migration
by Rogério Vinhal Nunes 02 Feb '26

02 Feb '26

Hello, I’m looking into the libvirt hooks that are available to make use of during a live migration, but there's only hooks on migration begin and migration end. On qemu directly I’m able to use pause-before-switchover migration capability to run a custom operation just before it moves to the destination, but within libvirt it seems that while this is leveraged internally, it’s not currently exposed to the client in a way I can use. Does anyone have any suggestions on how I could expose this to the client in a generic and sensible way? Thanks, Rogerio

3 11

[PATCH v2 0/5] nwfilter: add nwfilter nftables driver
by Dion Bosschieter 16 Jan '26

16 Jan '26

This series aims to implement nftables as a backend driver for the nwfilter feature. The idea is that eventually it will replace the ebiptables driver and provide an easy way for users to switch from one driver to another. The first 2 patches are moving of functions and renames, meant to decouple nwfilter from the currently only existing ebiptables driver. The 3rd patch introduces the new nwfilter driver. After which nwfilter allows users to choose it in the 4th patch. The last patch introduces unit testing of the new nftables driver. - Implemented very basic nwfilter.conf reading and choosing a nwfilter driver based on the name of the drivers (nftables/ebiptables). Defaults to the nftables driver, based on the firewall_backend_priority meson option, following the bridge driver logic. - Resolves issue https://gitlab.com/libvirt/libvirt/-/issues/603 benchmarks showed that the amount of iifname jumps for each interface with is the cause for this. Switched the nftables driver towards a vmap (verdict map) so we can have 1 rule that jumps to the correct root input/output chain per interface. Which improves throughput as when the number of interface check and jump rules increases the throughput decreases. The issue describes the interface matching works using the interface name and the majority of the effort is the strncpy, this commit also switches nftables to an interface_index compare instead. However, just using the interface_index is not enough, the amount of oif and iif jump rules causes quite a performance issue, the vmap instead solves this. - Split rules into separate tables: "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other" to preserve existing firewall behavior. - Reworked chain logic for clarity with root -input/-output chains per interface. input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). - Stuck with prerouting and postrouting as hooks for input / output on the -ethernet and -other table. This makes it easier to merge the tables in the future. Saving management of two tables and decreasing the amount of tables a packet sees. Currently ebtables filtering happens via PREROUTING and POSTROUTING hooks, while ip/ip6tables filtering happens in the output/forward hooks. - Stuck with 2 tables for compatibility reasons with eb iptables, unifying into 1 table will break users firewall definitions, which depend on being able to do accepts on ethernet rules (which currently get defined via ebtables) and additional filtering via the ip rules (which currently get defined via ip(6)tables). The nwfilter_nftables_driver keeps splitting the ethernet and non ethernet (other) rules in seperate tables "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other". - Rewrote chain logic, so it is easier to understand, input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). -ethernet and -other table follow the same style and hook in the same way. - Simplified conntrack handling: rules with accept+conntrack are duplicated to the opposite chain for symmetric behavior, to support the existing ebiptables logic. - Firewall updates continue use tmp names for atomic replacement. Unsupported nwfilter features (for now): - STP filtering - Gratuitous ARP filtering - IPSets (potential future support via nft sets) - Reject due to filtering in pre/postrouting, using drop instead of reject, copying logic from existing ebiptables ebtables actions Future improvements: - Use `nft -f` for atomic rule application. - Optional single-table mode via nwfilter.conf. - Optimize boot phase with chain hash comparison. --- Changes in v2: - Rename {ebip,nf}tables specific test files in 1 directory instead of seperating them in different directories. - Added default nwfilter.conf file in git, documented including augeas files - Replaced hardcoding of default driver based on existing firewall_backend_priority meson option. - Added nwfilter_driver_conf.{h,c} for configuration handling, to match the common pattern used in other drivers. Dion Bosschieter (5): nwfilter: rename ebiptables unit tests and data files nwfilter: move shared nwfilter driver functions into nwfilter_tech_driver.c nwfilter: add nwfilter nftables driver nwfilter: allow use of nftables nwfilter driver via nwfilter.conf nwfilter: add unit tests and test data for nwfilter nftables driver po/POTFILES | 3 + src/conf/virnwfilterobj.h | 20 - src/nwfilter/libvirtd_nwfilter.aug | 37 + src/nwfilter/meson.build | 39 + src/nwfilter/nwfilter.conf.in | 26 + src/nwfilter/nwfilter_driver.c | 66 +- src/nwfilter/nwfilter_driver_conf.c | 210 + src/nwfilter/nwfilter_driver_conf.h | 66 + src/nwfilter/nwfilter_ebiptables_driver.c | 262 +- src/nwfilter/nwfilter_ebiptables_driver.h | 2 +- src/nwfilter/nwfilter_gentech_driver.c | 63 +- src/nwfilter/nwfilter_gentech_driver.h | 5 +- src/nwfilter/nwfilter_nftables_driver.c | 2374 +++++++++++ src/nwfilter/nwfilter_nftables_driver.h | 28 + src/nwfilter/nwfilter_tech_driver.c | 249 ++ src/nwfilter/nwfilter_tech_driver.h | 51 +- src/nwfilter/test_libvirtd_nwfilter.aug.in | 5 + tests/meson.build | 4 +- tests/nwfilternftablestest.c | 428 ++ ...ltest.c => nwfilterxml2ebipfirewalltest.c} | 4 +- ...nux.args => ah-ipv6-linux.ebiptables.args} | 0 .../ah-ipv6-linux.nftables.args | 304 ++ ...ah-linux.args => ah-linux.ebiptables.args} | 0 .../ah-linux.nftables.args | 298 ++ ...ux.args => all-ipv6-linux.ebiptables.args} | 0 .../all-ipv6-linux.nftables.args | 286 ++ ...l-linux.args => all-linux.ebiptables.args} | 0 .../all-linux.nftables.args | 280 ++ ...p-linux.args => arp-linux.ebiptables.args} | 0 .../arp-linux.nftables.args | 215 + .../nwfilterxml2firewalldata/arp.nftables.xml | 27 + ...nux.args => comment-linux.ebiptables.args} | 0 .../comment-linux.nftables.args | 483 +++ ...x.args => conntrack-linux.ebiptables.args} | 0 .../conntrack-linux.nftables.args | 198 + ...ux.args => esp-ipv6-linux.ebiptables.args} | 0 .../esp-ipv6-linux.nftables.args | 304 ++ ...p-linux.args => esp-linux.ebiptables.args} | 0 .../esp-linux.nftables.args | 298 ++ ...x.args => example-1-linux.ebiptables.args} | 0 .../example-1-linux.nftables.args | 266 ++ ...x.args => example-2-linux.ebiptables.args} | 0 .../example-2-linux.nftables.args | 348 ++ ...ux.args => hex-data-linux.ebiptables.args} | 0 .../hex-data-linux.nftables.args | 357 ++ ...s => icmp-direction-linux.ebiptables.args} | 0 .../icmp-direction-linux.nftables.args | 238 ++ ... => icmp-direction2-linux.ebiptables.args} | 0 .../icmp-direction2-linux.nftables.args | 238 ++ ... => icmp-direction3-linux.ebiptables.args} | 0 .../icmp-direction3-linux.nftables.args | 184 + ...-linux.args => icmp-linux.ebiptables.args} | 0 .../icmp-linux.nftables.args | 252 ++ ...inux.args => icmpv6-linux.ebiptables.args} | 0 .../icmpv6-linux.nftables.args | 322 ++ ...-linux.args => igmp-linux.ebiptables.args} | 0 .../igmp-linux.nftables.args | 298 ++ ...ip-linux.args => ip-linux.ebiptables.args} | 0 .../ip-linux.nftables.args | 198 + ...linux.args => ipset-linux.ebiptables.args} | 0 ... => ipt-no-macspoof-linux.ebiptables.args} | 0 .../ipt-no-macspoof-linux.nftables.args | 169 + ...-linux.args => ipv6-linux.ebiptables.args} | 0 .../ipv6-linux.nftables.args | 474 +++ ...linux.args => iter1-linux.ebiptables.args} | 0 .../iter1-linux.nftables.args | 298 ++ ...linux.args => iter2-linux.ebiptables.args} | 0 .../iter2-linux.nftables.args | 3598 +++++++++++++++++ ...linux.args => iter3-linux.ebiptables.args} | 0 .../iter3-linux.nftables.args | 418 ++ ...c-linux.args => mac-linux.ebiptables.args} | 0 .../mac-linux.nftables.args | 180 + ...-linux.args => rarp-linux.ebiptables.args} | 0 .../rarp-linux.nftables.args | 215 + ...x.args => sctp-ipv6-linux.ebiptables.args} | 0 .../sctp-ipv6-linux.nftables.args | 314 ++ ...-linux.args => sctp-linux.ebiptables.args} | 0 .../sctp-linux.nftables.args | 314 ++ ...p-linux.args => stp-linux.ebiptables.args} | 0 ...inux.args => target-linux.ebiptables.args} | 0 .../target-linux.nftables.args | 452 +++ ...nux.args => target2-linux.ebiptables.args} | 0 .../target2-linux.nftables.args | 316 ++ ...ux.args => tcp-ipv6-linux.ebiptables.args} | 0 .../tcp-ipv6-linux.nftables.args | 314 ++ ...p-linux.args => tcp-linux.ebiptables.args} | 0 .../tcp-linux.nftables.args | 468 +++ ...ux.args => udp-ipv6-linux.ebiptables.args} | 0 .../udp-ipv6-linux.nftables.args | 314 ++ ...p-linux.args => udp-linux.ebiptables.args} | 0 .../udp-linux.nftables.args | 314 ++ ...rgs => udplite-ipv6-linux.ebiptables.args} | 0 .../udplite-ipv6-linux.nftables.args | 304 ++ ...nux.args => udplite-linux.ebiptables.args} | 0 .../udplite-linux.nftables.args | 298 ++ ...-linux.args => vlan-linux.ebiptables.args} | 0 .../vlan-linux.nftables.args | 264 ++ tests/nwfilterxml2nftfirewalltest.c | 438 ++ 98 files changed, 18433 insertions(+), 365 deletions(-) create mode 100644 src/nwfilter/libvirtd_nwfilter.aug create mode 100644 src/nwfilter/nwfilter.conf.in create mode 100644 src/nwfilter/nwfilter_driver_conf.c create mode 100644 src/nwfilter/nwfilter_driver_conf.h create mode 100644 src/nwfilter/nwfilter_nftables_driver.c create mode 100644 src/nwfilter/nwfilter_nftables_driver.h create mode 100644 src/nwfilter/nwfilter_tech_driver.c create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in create mode 100644 tests/nwfilternftablestest.c rename tests/{nwfilterxml2firewalltest.c => nwfilterxml2ebipfirewalltest.c} (99%) rename tests/nwfilterxml2firewalldata/{ah-ipv6-linux.args => ah-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/ah-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{ah-linux.args => ah-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/ah-linux.nftables.args rename tests/nwfilterxml2firewalldata/{all-ipv6-linux.args => all-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/all-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{all-linux.args => all-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/all-linux.nftables.args rename tests/nwfilterxml2firewalldata/{arp-linux.args => arp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/arp-linux.nftables.args create mode 100644 tests/nwfilterxml2firewalldata/arp.nftables.xml rename tests/nwfilterxml2firewalldata/{comment-linux.args => comment-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/comment-linux.nftables.args rename tests/nwfilterxml2firewalldata/{conntrack-linux.args => conntrack-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/conntrack-linux.nftables.args rename tests/nwfilterxml2firewalldata/{esp-ipv6-linux.args => esp-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/esp-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{esp-linux.args => esp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/esp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{example-1-linux.args => example-1-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/example-1-linux.nftables.args rename tests/nwfilterxml2firewalldata/{example-2-linux.args => example-2-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/example-2-linux.nftables.args rename tests/nwfilterxml2firewalldata/{hex-data-linux.args => hex-data-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/hex-data-linux.nftables.args rename tests/nwfilterxml2firewalldata/{icmp-direction-linux.args => icmp-direction-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction-linux.nftables.args rename tests/nwfilterxml2firewalldata/{icmp-direction2-linux.args => icmp-direction2-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction2-linux.nftables.args rename tests/nwfilterxml2firewalldata/{icmp-direction3-linux.args => icmp-direction3-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction3-linux.nftables.args rename tests/nwfilterxml2firewalldata/{icmp-linux.args => icmp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/icmp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{icmpv6-linux.args => icmpv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/icmpv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{igmp-linux.args => igmp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/igmp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{ip-linux.args => ip-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/ip-linux.nftables.args rename tests/nwfilterxml2firewalldata/{ipset-linux.args => ipset-linux.ebiptables.args} (100%) rename tests/nwfilterxml2firewalldata/{ipt-no-macspoof-linux.args => ipt-no-macspoof-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.nftables.args rename tests/nwfilterxml2firewalldata/{ipv6-linux.args => ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{iter1-linux.args => iter1-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/iter1-linux.nftables.args rename tests/nwfilterxml2firewalldata/{iter2-linux.args => iter2-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/iter2-linux.nftables.args rename tests/nwfilterxml2firewalldata/{iter3-linux.args => iter3-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/iter3-linux.nftables.args rename tests/nwfilterxml2firewalldata/{mac-linux.args => mac-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/mac-linux.nftables.args rename tests/nwfilterxml2firewalldata/{rarp-linux.args => rarp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/rarp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{sctp-ipv6-linux.args => sctp-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/sctp-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{sctp-linux.args => sctp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/sctp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{stp-linux.args => stp-linux.ebiptables.args} (100%) rename tests/nwfilterxml2firewalldata/{target-linux.args => target-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/target-linux.nftables.args rename tests/nwfilterxml2firewalldata/{target2-linux.args => target2-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/target2-linux.nftables.args rename tests/nwfilterxml2firewalldata/{tcp-ipv6-linux.args => tcp-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/tcp-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{tcp-linux.args => tcp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/tcp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{udp-ipv6-linux.args => udp-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/udp-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{udp-linux.args => udp-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/udp-linux.nftables.args rename tests/nwfilterxml2firewalldata/{udplite-ipv6-linux.args => udplite-ipv6-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/udplite-ipv6-linux.nftables.args rename tests/nwfilterxml2firewalldata/{udplite-linux.args => udplite-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/udplite-linux.nftables.args rename tests/nwfilterxml2firewalldata/{vlan-linux.args => vlan-linux.ebiptables.args} (100%) create mode 100755 tests/nwfilterxml2firewalldata/vlan-linux.nftables.args create mode 100644 tests/nwfilterxml2nftfirewalltest.c -- 2.43.0

2 11