July 2025 - Devel - libvirt List Archives

[PATCH v2 0/4] Some parsing functions refactor
by Kirill Shchetiniuk 23 Jul '25

23 Jul '25

This patch series is supposed to refactor the existing logic of some parsing functions, changing the previous approach of getting the string fisrt and then parsing the string itself. Now the parsing logic is implemented by using the appropriate virXMLProp* functions. Changelog fromm v1: 1. 'ret' temp value is now 'rc' 2. code style fixes 3. 'id' param is now parsed as not mandatory Kirill Shchetiniuk (4): conf: virNetDevVPortProfileParse refactor util: virSecretLookupParseSecret refactor conf: virDomainChrDefParseTargetXML refactor qemu: qemuDomainObjPrivateXMLParseVcpu refactor src/conf/domain_conf.c | 16 +--- src/conf/netdev_vport_profile_conf.c | 112 +++++++++++---------------- src/qemu/qemu_domain.c | 16 +--- src/util/virsecret.c | 19 ++--- 4 files changed, 55 insertions(+), 108 deletions(-) -- 2.49.0

2 7

libvirt-gitlab-executor - maintainer?
by Kristina Hanicova 23 Jul '25

23 Jul '25

Hello Libvirt friends, Is anyone interested in maintaining this orphaned repository: https://gitlab.com/libvirt/libvirt-gitlab-executor ? It is used in Cryptsetup CI and we would like to upstream some changes. If no one is interested, I am willing to take on the role of the maintainer myself:) Regards, Kristina Hanicova

4 4

[PATCH 0/4] qemu: add support for RBD namespace
by Peter Krempa 23 Jul '25

23 Jul '25

After recent inquiry on libvirt-users I've necromanced this already very old series that I still had laying around. This series: - turns virStorageSource's 'protocol' to real enum - removes virStorageSource's 'volume' - wires in the RBD support Han Han (1): qemu: Add support for RBD namespace. Peter Krempa (3): conf: Turn 'protocol' field of virStorageSource into proper enum type virStorageFileBackendGlusterInit: Refactor cleanup virStorageSource: Eliminate 'volume' field docs/formatdomain.rst | 6 ++ src/conf/domain_conf.c | 36 ++------- src/conf/domain_validate.c | 2 +- src/conf/storage_source_conf.c | 79 ++++++++++++++++++- src/conf/storage_source_conf.h | 10 ++- src/libvirt_private.syms | 1 + src/libxl/libxl_conf.c | 4 +- src/libxl/xen_xl.c | 4 +- src/qemu/qemu_block.c | 41 ++++++---- src/qemu/qemu_domain.c | 2 +- src/qemu/qemu_snapshot.c | 4 +- .../storage_file_backend_gluster.c | 63 ++++++++------- src/storage_file/storage_source.c | 2 - .../storage_source_backingstore.c | 56 ++++--------- .../disk-network-rbd.x86_64-latest.args | 4 +- .../disk-network-rbd.x86_64-latest.xml | 4 +- tests/qemuxmlconfdata/disk-network-rbd.xml | 4 +- 17 files changed, 185 insertions(+), 137 deletions(-) -- 2.49.0

2 6

Clarification Needed: virsh snapshot-delete Behavior with External Snapshots (--disk-only)
by P, Rajasekar 23 Jul '25

23 Jul '25

Hello libvirt community, I am seeking clarification on the behavior of `virsh snapshot-delete` when used with external snapshots (created with the `--disk-only` option). **Environment:** - libvirt version: 10.5.0 - Kernel version: 5.14.0-503.22.1.el9_5.x86_64 - Disk image format: qcow2 - Host OS: RHEL 9.5 **Steps to reproduce:** 1. Create an external snapshot: virsh snapshot-create-as --domain <vm> --name snap1 --disk-only --atomic 2. Delete the snapshot: virsh snapshot-delete <vm> --snapshotname snap1 **Observed behavior:** - Changes from the overlay (snapshot) file are merged into the base image. - The snapshot metadata is removed from libvirt. - The snapshot file remains on disk (appears orphaned). **Questions:** - Is the observed automatic merge of the overlay file into the base image during `snapshot-delete` the intended behavior for external snapshots in recent libvirt versions? Or we need separate `blockcommit` step. - Should the snapshot file be deleted automatically, or is manual cleanup required? - Is there any official documentation that clarifies this behavior for external snapshots, as most documentation seems to focus on internal snapshots? Thank you for your help and clarification! Best regards, Raj.

1 0

[RFC PATCH 0/8] Add support for Grace ACPI Extended GPU Memory (EGM) devices
by Ian May 22 Jul '25

22 Jul '25

The Grace SOC introduces Extended GPU Memory (EGM) [3], a feature that enables GPUs to efficiently access system memory within and across nodes. This patch series adds support for virtualizing EGM (vEGM) in libvirt, allowing VMs to utilize dedicated EGM memory regions through ACPI. RFC Status ========== This patch series is submitted as an RFC to gather feedback from the libvirt community on the overall approach and implementation details. While kernel EGM driver support and QEMU acpi-egm-memory device support are not yet upstream, reference implementations are available [1][2] to enable testing and validation of the libvirt integration. Any community feedback is appreciated. Background and Use Cases ========================= EGM allows host memory to be partitioned into two regions: 1. Standard memory for Host OS usage 2. EGM region assigned to VMs as their system memory This technology enables various high-performance computing scenarios [3]: - Large memory pools for AI/ML workloads - High-performance computing applications - Memory extension for systems with limited main memory - GPU-accelerated workloads requiring large addressable memory Implementation Overview ======================= This 8-patch series adds a new device type 'acpi-egm-memory' with the following structure: 1. Schema definition - Add XML schema definition for the new ACPI EGM memory device 2. XML parsing - Implement XML parsing and internal data structures 3. Capability detection - Add QEMU capability detection for EGM support 4. Validation - Add validation logic for EGM device configuration 5. Command generation - Implement QEMU command line generation 6. Resource management - Setup required cgroup and namespace configurations 7. Documentation - Add comprehensive documentation 8. Testing - Add qemuxmlconftest for ACPI EGM memory device XML Configuration ================= Example usage in domain XML: <devices> <hostdev mode="subsystem" type="pci" managed="yes"> <alias name="ua-hostdev0"/> <source> <address domain="0x0000" bus="0x01" slot="0x00" function="0x0"/> </source> </hostdev> <acpiEgmMemory> <alias name="egm0"/> <pciDev>ua-hostdev0</pciDev> <numaNode>0</numaNode> </acpiEgmMemory> </devices> This configuration results in appropriate QEMU command line options: -object memory-backend-file,id=m0,mem-path=/dev/egm0,size=32G,share=on,prealloc=on -object acpi-egm-memory,id=egm0,pci-dev=ua-hostdev0,node=0 Implementation Notes ==================== The device validation includes checking that referenced PCI devices exist, NUMA nodes are valid, and device paths are accessible with proper permissions. Memory backing is configured automatically to use the EGM device path, and cgroups/namespaces are set up to allow safe access. Testing ======= I've tested XML parsing, validation, and qemu command line generation. The qemuxmlconftest passes for XML handling, though the command generation test currently fails since QEMU doesn't have acpi-egm-memory support yet, but the generated args look correct for when it does. Requirements ============ This feature requires: - NVIDIA ARM64 Grace platform with EGM support - Host kernel with EGM driver support [1] - QEMU with ACPI EGM device support [2] [1] https://github.com/ianm-nv/NV-Kernels/tree/6.8_ghvirt_egm_may2025 [2] https://github.com/ianm-nv/qemu/tree/6.8_ghvirt_egm_may2025 [3] https://developer.nvidia.com/blog/nvidia-grace-hopper-superchip-architectur… Ian May (8): conf: Add schema definition for ACPI EGM memory device conf: Add definitions and XML parsing for ACPI EGM memory device qemu: Add capability detection for ACPI EGM memory device qemu: Add validation for ACPI EGM memory device configuration qemu: Add command line generation for ACPI EGM memory device qemu: Add cgroup and namespace setup for ACPI EGM memory device docs: Document ACPI EGM memory device tests: Add qemuxmlconftest for ACPI EGM memory device docs/formatdomain.rst | 80 ++++++++++++++ src/ch/ch_domain.c | 1 + src/conf/domain_conf.c | 102 ++++++++++++++++++ src/conf/domain_conf.h | 11 ++ src/conf/domain_postparse.c | 8 ++ src/conf/domain_validate.c | 23 ++++ src/conf/schemas/domaincommon.rng | 19 ++++ src/conf/virconftypes.h | 2 + src/libxl/libxl_driver.c | 6 ++ src/lxc/lxc_driver.c | 6 ++ src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_cgroup.c | 21 ++++ src/qemu/qemu_command.c | 37 +++++++ src/qemu/qemu_domain.c | 2 + src/qemu/qemu_domain_address.c | 2 + src/qemu/qemu_driver.c | 3 + src/qemu/qemu_hotplug.c | 5 + src/qemu/qemu_namespace.c | 21 ++++ src/qemu/qemu_postparse.c | 1 + src/qemu/qemu_validate.c | 99 +++++++++++++++++ src/test/test_driver.c | 4 + tests/meson.build | 1 + .../caps_10.0.0_aarch64.xml | 1 + tests/qemuegmmock.c | 67 ++++++++++++ .../acpi-egm-memory.aarch64-latest.args | 1 + .../acpi-egm-memory.aarch64-latest.xml | 56 ++++++++++ tests/qemuxmlconfdata/acpi-egm-memory.xml | 27 +++++ tests/qemuxmlconftest.c | 5 +- 29 files changed, 613 insertions(+), 1 deletion(-) create mode 100644 tests/qemuegmmock.c create mode 100644 tests/qemuxmlconfdata/acpi-egm-memory.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/acpi-egm-memory.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/acpi-egm-memory.xml -- 2.43.0

1 8

[PATCH] news: document new crypto TLS priority string settings
by Daniel P. Berrangé 22 Jul '25

22 Jul '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- NEWS.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index c7885f01a0..e5e8626729 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -24,6 +24,14 @@ v11.6.0 (unreleased) flag the baseline API would return reasonable output only when run on one of the hosts that the input CPU definitions were collected from. + * Allow control over QEMU TLS priority strings + + The qemu.conf file now has multiple settings allowing control over the + QEMU TLS priority strings, for the different subsystems in QEMU that + can support TLS. This can be used to workaround a current bug in GNUTLS + that is liable to cause crashes of the source QEMU when performing long + running live migration operations with TLS enabled. + * **Improvements** * qemu: Change default SCSI controller model to ``virtio-scsi`` for ARM and RISC-V -- 2.50.1

2 1

[PATCH 00/19] security_selinux: Refactor temporary variable cleanup
by Peter Krempa 22 Jul '25

22 Jul '25

Some cleanups resutling from analyzing some selinux code. Peter Krempa (19): security/security_driver.c/h: Fix function header formatting virSecuritySELinuxTransactionRun: Refactor cleanup virSecuritySELinuxMCSFind: Refactor variable clearing virSecuritySELinuxRestoreFileLabel: Refactor cleanup virSecuritySELinux(Set|Restore)TPMFileLabel: Automatically free 'cancel_path' virSecuritySELinuxRestoreFileLabels: Refactor variable freeing virSecuritySELinux(Set|Restore)HostdevCapsLabel: Refactor cleanup virSecuritySELinux(Set|Restore)ChardevLabel: Refactor cleanup virSecuritySELinuxSet(Daemon)SocketLabel: Refactor cleanup virSecuritySELinuxSetTapFDLabel: Refactor cleanup security_selinux: Declare internal autoptr cleanup helper for 'context_t' virSecuritySELinuxContextAddRange: Refactor cleanup of 'context_t' virSecuritySELinuxGenNewContext: Refactor cleanup virSecuritySELinuxReserveLabel: Refactor cleanup virSecuritySELinuxGetProcessLabel: Automatically free 'ctx' temp variable virSecuritySELinuxSetFilecon: Automatically free 'econ' temp variable virSecuritySELinuxRestoreInputLabel: Return values directly virSecuritySELinuxGenImageLabel: Refactor cleanup virSecuritySELinuxGetSecurityMountOptions: refactor printing src/security/security_driver.c | 5 +- src/security/security_driver.h | 5 +- src/security/security_selinux.c | 347 +++++++++++++------------------- 3 files changed, 149 insertions(+), 208 deletions(-) -- 2.50.0

2 20

[PATCH v2 0/1] nwfilter: Check before removing and reinserting iptable base chains
by Dion Bosschieter 22 Jul '25

22 Jul '25

Thanks for the feedback. I've applied the iptables -L with a callback handler. The callback handler then decides whether or not to create the base chains. I changed the commit message from "nwfilter: Avoid firewall hole during VM startup by checking rule presence" to "nwfilter: Check before removing and reinserting iptable base chains". I also edited nwfilterxml2firewalltest, so it pretends that currently there are no chains and I changed the expected order of the commonRules. Dion Bosschieter (1): nwfilter: Check before removing and reinserting iptable base chains src/nwfilter/nwfilter_ebiptables_driver.c | 203 +++++++++++++--------- tests/nwfilterxml2firewalltest.c | 58 +++++-- 2 files changed, 163 insertions(+), 98 deletions(-) -- 2.43.0

2 2

[PATCH] qemu: driver: Reformat function headers for block job APIs
by Peter Krempa 22 Jul '25

22 Jul '25

From: Peter Krempa <pkrempa(a)redhat.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_driver.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 7c203e32fe..a0f770b053 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -14552,8 +14552,11 @@ qemuDomainBlockCopyCommon(virDomainObj *vm, } static int -qemuDomainBlockRebase(virDomainPtr dom, const char *path, const char *base, - unsigned long bandwidth, unsigned int flags) +qemuDomainBlockRebase(virDomainPtr dom, + const char *path, + const char *base, + unsigned long bandwidth, + unsigned int flags) { virDomainObj *vm; int ret = -1; @@ -14625,8 +14628,11 @@ qemuDomainBlockRebase(virDomainPtr dom, const char *path, const char *base, static int -qemuDomainBlockCopy(virDomainPtr dom, const char *disk, const char *destxml, - virTypedParameterPtr params, int nparams, +qemuDomainBlockCopy(virDomainPtr dom, + const char *disk, + const char *destxml, + virTypedParameterPtr params, + int nparams, unsigned int flags) { virQEMUDriver *driver = dom->conn->privateData; @@ -14703,7 +14709,9 @@ qemuDomainBlockCopy(virDomainPtr dom, const char *disk, const char *destxml, static int -qemuDomainBlockPull(virDomainPtr dom, const char *path, unsigned long bandwidth, +qemuDomainBlockPull(virDomainPtr dom, + const char *path, + unsigned long bandwidth, unsigned int flags) { virDomainObj *vm; -- 2.50.0

2 1

[PATCH v2 0/1] network: introduce Packet Filter firewall backend
by Roman Bogorodskiy 22 Jul '25

22 Jul '25

Changes since v1: - Left only firewall backend changes - Build network_pf.c only on FreeBSD - pfAddIPSpecificFirewallRules: error message for lack of IPv6 support I have also added a basic docs/drvnetwork.rst, but I think it would make more sense to include it in the follow up series with the bridge driver changes as with this patch alone pf backend cannot be used just yet. Roman Bogorodskiy (1): network: introduce Packet Filter firewall backend meson.build | 2 + po/POTFILES | 1 + src/network/bridge_driver_conf.c | 4 + src/network/bridge_driver_linux.c | 2 + src/network/meson.build | 4 + src/network/network_pf.c | 326 ++++++++++++++++++++++++++++++ src/network/network_pf.h | 26 +++ src/util/virfirewall.c | 4 +- src/util/virfirewall.h | 2 + 9 files changed, 370 insertions(+), 1 deletion(-) create mode 100644 src/network/network_pf.c create mode 100644 src/network/network_pf.h -- 2.49.0

2 2