August 2025 - Devel - libvirt List Archives

[PATCH] qemu: fix multiple missing setup/teardown of passt process for interface type='vhostuser'
by Laine Stump 25 Aug '25

25 Aug '25

passt networking support was originally added only for <interface type='user'>, and all of the codepaths leading to qemuPasst*() functions were protected with if (net->type == VIR_DOMAIN_NET_TYPE_USER && net->backend.type == VIR_DOMAIN_NET_BACKEND_PASST) When support was later added to use a vhost-user socket to connect between the passt process and qemu process, *some* of the conditionals similar to the above were changed to be if ((net->type == VIR_DOMAIN_NET_TYPE_USER || net->type == VIR_DOMAIN_NET_TYPE_VHOSTUSER) && net->backend.type == VIR_DOMAIN_NET_BACKEND_PASST) As a matter of fact, enough of these places were changed to make passt+vhostuser work. However I missed a few places that resulted in the passt process not being properly shutdown/cleaned up when the interface type was vhostuser, and also as far as I can see from examining the code, the passt process wasn't being added to the cgroup for the domain. We could fix these problems by adding the extra condition to all the missing places (checking for either 'user' or 'vhostuser' as well as for backend type of 'passt'), but since validation already guarantees that if backend type='passt' then the interface type MUST be either 'user' or 'vhostuser', it's really just adding extra code for no good purpose (and would leave open the possibility of the same problem recurring in the future if a different interface type begins using passt as well). So the better solution is to not bother checking net->type at all in those locations - if backend type is 'passt' then we call the passt-related code. Resolves: https://issues.redhat.com/browse/RHEL-80285 Resolves: https://issues.redhat.com/browse/RHEL-92842 Fixes: 1e9054b9c79d721a55f413c2983c5370044f8f60 Signed-off-by: Laine Stump <laine(a)redhat.com> --- src/qemu/qemu_extdevice.c | 15 +++------------ src/qemu/qemu_hotplug.c | 23 ++++++++--------------- 2 files changed, 11 insertions(+), 27 deletions(-) diff --git a/src/qemu/qemu_extdevice.c b/src/qemu/qemu_extdevice.c index 8df93a77ce..28cea52980 100644 --- a/src/qemu/qemu_extdevice.c +++ b/src/qemu/qemu_extdevice.c @@ -213,11 +213,6 @@ qemuExtDevicesStart(virQEMUDriver *driver, for (i = 0; i < def->nnets; i++) { virDomainNetDef *net = def->nets[i]; - if (net->type != VIR_DOMAIN_NET_TYPE_USER && - net->type != VIR_DOMAIN_NET_TYPE_VHOSTUSER) { - continue; - } - if (net->backend.type == VIR_DOMAIN_NET_BACKEND_PASST) { if (qemuPasstStart(vm, net) < 0) return -1; @@ -310,10 +305,8 @@ qemuExtDevicesStop(virQEMUDriver *driver, if (slirp) qemuSlirpStop(slirp, vm, driver, net); - if (net->type == VIR_DOMAIN_NET_TYPE_USER && - net->backend.type == VIR_DOMAIN_NET_BACKEND_PASST) { + if (net->backend.type == VIR_DOMAIN_NET_BACKEND_PASST) qemuPasstStop(vm, net); - } if (actualType == VIR_DOMAIN_NET_TYPE_ETHERNET && net->downscript) virNetDevRunEthernetScript(net->ifname, net->downscript); @@ -373,8 +366,7 @@ qemuExtDevicesHasDevice(virDomainDef *def) if (QEMU_DOMAIN_NETWORK_PRIVATE(net)->slirp) return true; - if (net->type == VIR_DOMAIN_NET_TYPE_USER && - net->backend.type == VIR_DOMAIN_NET_BACKEND_PASST) + if (net->backend.type == VIR_DOMAIN_NET_BACKEND_PASST) return true; } @@ -455,8 +447,7 @@ qemuExtDevicesSetupCgroup(virQEMUDriver *driver, if (slirp && qemuSlirpSetupCgroup(slirp, cgroup) < 0) return -1; - if (net->type == VIR_DOMAIN_NET_TYPE_USER && - net->backend.type == VIR_DOMAIN_NET_BACKEND_PASST && + if (net->backend.type == VIR_DOMAIN_NET_BACKEND_PASST && qemuPasstSetupCgroup(vm, net, cgroup) < 0) { return -1; } diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index e9568af125..866dbace90 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1298,8 +1298,6 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver, qemuPasstPrepareVhostUser(vm, net); - if (qemuPasstStart(vm, net) < 0) - goto cleanup; } else { if (virNetDevOpenvswitchGetVhostuserIfname(net->data.vhostuser->data.nix.path, net->data.vhostuser->data.nix.listen, @@ -1313,13 +1311,8 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver, break; case VIR_DOMAIN_NET_TYPE_USER: - if (net->backend.type == VIR_DOMAIN_NET_BACKEND_PASST) { - - if (qemuPasstStart(vm, net) < 0) - goto cleanup; - - } else if (!priv->disableSlirp && - virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_DBUS_VMSTATE)) { + if (!priv->disableSlirp && + virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_DBUS_VMSTATE)) { if (qemuInterfacePrepareSlirp(driver, net) < 0) goto cleanup; @@ -1356,6 +1349,10 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver, goto cleanup; } + /* both NET_TYPE_USER and NET_TYPE_VHOSTUSER might use passt */ + if (net->backend.type == VIR_DOMAIN_NET_BACKEND_PASST && qemuPasstStart(vm, net) < 0) + goto cleanup; + /* Set device online immediately */ if (virDomainInterfaceStartDevice(net) < 0) goto cleanup; @@ -1539,10 +1536,8 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver, if (QEMU_DOMAIN_NETWORK_PRIVATE(net)->slirp) qemuSlirpStop(QEMU_DOMAIN_NETWORK_PRIVATE(net)->slirp, vm, driver, net); - if (net->type == VIR_DOMAIN_NET_TYPE_USER && - net->backend.type == VIR_DOMAIN_NET_BACKEND_PASST) { + if (net->backend.type == VIR_DOMAIN_NET_BACKEND_PASST) qemuPasstStop(vm, net); - } qemuDomainObjEnterMonitor(vm); if (charDevPlugged && @@ -5112,10 +5107,8 @@ qemuDomainRemoveNetDevice(virQEMUDriver *driver, if (QEMU_DOMAIN_NETWORK_PRIVATE(net)->slirp) qemuSlirpStop(QEMU_DOMAIN_NETWORK_PRIVATE(net)->slirp, vm, driver, net); - if (net->type == VIR_DOMAIN_NET_TYPE_USER && - net->backend.type == VIR_DOMAIN_NET_BACKEND_PASST) { + if (net->backend.type == VIR_DOMAIN_NET_BACKEND_PASST) qemuPasstStop(vm, net); - } virDomainAuditNet(vm, net, NULL, "detach", true); -- 2.51.0

2 1

[PATCH v2 2/2] NEWS: ch: announce riscv-aia feature for RISC-V KVM
by BillXiang 22 Aug '25

22 Aug '25

From: xiangwencheng <xiangwencheng(a)lanxincomputing.com> Signed-off-by: BillXiang <xiangwencheng(a)lanxincomputing.com> --- NEWS.rst | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index e6a74ad699..b3f709c172 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -22,6 +22,16 @@ v11.7.0 (unreleased) Users can now configure the verbosity of Cloud Hypervisor by setting the "log_level" option in ch.conf + * Support riscv-aia feature for RISC-V KVM + + riscv-aia feature was introduced in qemu-8.2 to specify the + KVM AIA mode. The "riscv-aia" parameter is passed along with + --accel in QEMU command-line. + 1) "riscv-aia=emul": IMSIC is emulated by hypervisor + 2) "riscv-aia=hwaccel": use hardware guest IMSIC + 3) "riscv-aia=auto": use the hardware guest IMSICs whenever available + otherwise we fallback to software emulation. + * **Improvements** * **Bug fixes** -- 2.34.1

1 0

[PATCH v2 0/1] docs : add doc on cpu model and features
by Hector CAO 21 Aug '25

21 Aug '25

Hello, This is a follow-up of the submission: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/EZBL… Based on Jiri's feedback, it is better to tackle this situation by documentation. You can find here a proposal for the documentation. The section will be rendered at : https://libvirt.org/formatcaps.html Best regards, Hector v2: - wrap lines at 80 characters Hector Cao (1): docs : add doc on cpu model and features docs/formatcaps.rst | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) -- 2.34.1

3 3

[PATCH v2 0/1] virt-aa-helper: Avoid duplicate when append rule
by Hector CAO 21 Aug '25

21 Aug '25

when a device is dynamically attached to a VM, and it needs a special system access for apparmor, libvirt calls virt-aa-helper (with argument -F) to append a new rule to the apparmor profile of the VM. virt-aa-helper does not check for duplicate and blindly appends the rule to the profile. since there is no rule removal when a device is detached, this can make the profile grow in size if a big number of attach/detach operations are done and the profile might hit the size limit and futur attach operations might dysfunction because no rule can be added into the apparmor profile. this patch tries to mitigate this issue by doing a duplicate check when rules are appended into the profile. this fix does not guarantee the absence of duplicates but should be enough to prevent the profile to grow significantly in size and reach its size limit. This v2 takes into account the feedback from Michal Prívozník for the original submission: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/2HIZ… v2: - early exit if duplicate is detected - improve the check condition for existing profile data Hector Cao (1): virt-aa-helper: Avoid duplicate when append rule src/security/virt-aa-helper.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH] virt-aa-helper: Avoid duplicate when append rule
by Hector CAO 20 Aug '25

20 Aug '25

From: Hector Cao <hector.cao(a)canonical.com> when a device is dynamically attached to a VM, and it needs a special system access for apparmor, libvirt calls virt-aa-helper (with argument -F) to append a new rule to the apparmor profile of the VM. virt-aa-helper does not check for duplicate and blindly appends the rule to the profile. since there is no rule removal when a device is detached, this can make the profile grow in size if a big number of attach/detach operations are done and the profile might hit the size limit and futur attach operations might dysfunction because no rule can be added into the apparmor profile. this patch tries to mitigate this issue by doing a duplicate check when rules are appended into the profile. this fix does not guarantee the absence of duplicates but should be enough to prevent the profile to grow significantly in size and reach its size limit. Signed-off-by: Hector CAO <hector.cao(a)canonical.com> --- src/security/virt-aa-helper.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index b662d971cb..a003c6dd9e 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -208,9 +208,20 @@ update_include_file(const char *include_file, const char *included_files, return -1; } - if (append && virFileExists(include_file)) - pcontent = g_strdup_printf("%s%s", existing, included_files); - else + if (append && virFileExists(include_file)) { + /* duplicate check: include_files might contain multiple rules + * the best is to check for each rule (separated by \n) but + * it might be overkilled, just do the check for the whole + * include_files. + * most of the time, include_files contains only one rule + * so this check is ok to avoid the overflow of the profile + * duplicates might still exist though. + */ + if (!strstr(existing, included_files)) { + pcontent = g_strdup_printf("%s%s", existing, included_files); + } else + pcontent = g_strdup(existing); + } else pcontent = g_strdup_printf("%s%s", warning, included_files); plen = strlen(pcontent); -- 2.34.1

3 2

[PATCH 0/4] Enable mshv support for Qemu domains
by Praveen K Paladugu 20 Aug '25

20 Aug '25

"[PATCH v3 00/26] Implementing a MSHV (Microsoft Hypervisor) accelerator" patchset in qemu-devel mailing list introduces MSHV support within Qemu. With above patchset, Qemu guests can be started with `-accel mshv` option to use Microsoft Hypervisor (/dev/mshv) as the hypervisor. Retaining Libvirt's naming convention, this translates to `hyperv` domains. Below is an excerpt of the xml to use with this patcset: ``` <domain type='hyperv'> <name>qemu_msh_testv</name> <cpu mode='host-model'/> <os> <type machine='q35'>hvm</type> </os> ... ``` This patch set introduces the necessary changes within libvirt to support Qemu guest with hyperv (mshv) hypervisor. Known issue: ``` abs_builddir=/home/user/QEMU_MSHV/libvirt/build/tests abs_top_srcdir=/home/user/QEMU_MSHV/libvirt LD_LIBRARY_PATH=/home/user/QEMU_MSHV/libvirt/build/tests:/home/user/QEMU_MSHV/libvirt/build/src abs_srcdir=/home/user/QEMU_MSHV/libvirt/tests VIR_TEST_EXPENSIVE=0 ASAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1 UBSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 LC_ALL=C LIBVIRT_AUTOSTART=0 G_DEBUG=fatal-warnings MALLOC_PERTURB_=255 abs_top_builddir=/home/user/QEMU_MSHV/libvirt/build /home/user/QEMU_MSHV/libvirt/build/tests/qemucapabilitiestest TEST: qemucapabilitiestest wrong expected command in /home/user/QEMU_MSHV/libvirt/tests/qemucapabilitiesdata/caps_9.2.0_s390x.replies:23538: : {"execute":"query-mshv","id":"libvirt-6"} expected {"execute":"qom-list-types","id":"libvirt-6"} ``` Could someone point me to the steps to regenerate the replies files to fix above issue? Praveen K Paladugu (4): qemu: introduce mshv capabilities qemu: probe mshv capabilities qemu: use mshv accel for hyperv domains qemu_cgroup: add /dev/mshv to default devices src/qemu/qemu_capabilities.c | 71 +++++++++++++++++++++++++++++++----- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_cgroup.c | 2 +- src/qemu/qemu_command.c | 4 +- src/qemu/qemu_monitor.c | 9 +++-- src/qemu/qemu_monitor.h | 8 ++-- src/qemu/qemu_monitor_json.c | 13 ++++--- src/qemu/qemu_monitor_json.h | 10 ++--- 8 files changed, 88 insertions(+), 30 deletions(-) -- 2.50.1

1 4

FYI: Planned list outage Mon 25th Aug from 10:00 JST
by Daniel P. Berrangé 20 Aug '25

20 Aug '25

We have a planned outage of the libvirt.org mailing lists on Monday 25th August. The outage is anticipated to begin at approx 10:00 JST (Japan), and all going well, should last no more than a couple hours. There will be various cosmetic changes to the lists.libvirt.org web interface after the upgrade, due to the newer software versions introduced. With regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

1 0

[PATCH v1 0/2] docs/tlscerts: minor improvements for TLS setup
by Sebastian Mitterle 20 Aug '25

20 Aug '25

Two minor improvements for the TLS setup documentation. Sebastian Mitterle (2): docs/tlscerts: document need for socket activation docs/tlscerts: mention dropped 'encryption_key' docs/kbase/tlscerts.rst | 42 +++++++++++++++++++++++++++++++++++++---- 1 file changed, 38 insertions(+), 4 deletions(-) -- 2.50.1

1 2

[PATCH 00/12] util: sync error_report & qemu_log output more closely
by Daniel P. Berrangé 20 Aug '25

20 Aug '25

This series is a tangent that came out of discussion in https://lists.nongnu.org/archive/html/qemu-devel/2025-08/msg00903.html In thinking about adding thread info to error_report, I came to realize we should likely make qemu_log behave consistently with error_report & friends more generally. We already honour '-msg timestamp=on' in both (with duplicated code), and qemu_log doesn't honour the '-msg guest-name=on' parameter, nor will it include the binary name. This series shouldn't be considered mutually exclusive with Manos' backtrace suggestion above - it is complementary & each proposal can be evaluated independently. As an example of the current state, consider mixing error and log output today: - Default context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x55ac6d97f700 dir=fish qcrypto_tls_creds_get_path TLS creds path creds=0x55ac6d97f700 filename=ca-cert.pem path=<none> qemu-system-x86_64: Unable to access credentials fish/ca-cert.pem: No such file or directory - Full context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' \ -msg guest-name=on,timestamp=on \ -name "fish food" 2025-08-19T20:14:16.791413Z qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x55e9a3458d10 dir=fish 2025-08-19T20:14:16.791429Z qcrypto_tls_creds_get_path TLS creds path creds=0x55e9a3458d10 filename=ca-cert.pem path=<none> 2025-08-19T20:14:16.791433Z fish food qemu-system-x86_64: Unable to access credentials fish/ca-cert.pem: No such file or directory And after this series is complete: - Default context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' qemu-system-x86_64(1184284:main): qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x55a24ad5cb30 dir=fish qemu-system-x86_64(1184284:main): qcrypto_tls_creds_get_path TLS creds path creds=0x55a24ad5cb30 filename=ca-cert.pem path=<none> qemu-system-x86_64(1184284:main): Unable to access credentials fish/ca-cert.pem: No such file or directory - Full context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' \ -msg guest-name=on,timestamp=on \ -name "fish food" 2025-08-19T20:12:50.211823Z [fish food] qemu-system-x86_64(1168876:main): qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x5582183d8760 dir=fish 2025-08-19T20:12:50.211842Z [fish food] qemu-system-x86_64(1168876:main): qcrypto_tls_creds_get_path TLS creds path creds=0x5582183d8760 filename=ca-cert.pem path=<none> 2025-08-19T20:12:50.211846Z [fish food] qemu-system-x86_64(1168876:main): Unable to access credentials fish/ca-cert.pem: No such file or directory The main things to note: * error_report/warn_report/qemu_log share the same output format and -msg applies to both * -msg debug-threads=on is now unconditionally enabled and thus the param is deprecated & ignored * Thread ID and name are unconditionally enabled * Guest name is surrounded in [...] brackets * The default output lines are typically 15 chars wider given that we always include the thread ID + name now * This takes the liberty of assigning the new file to the existing error-report.c maintainer (Markus) Since splitting it off into message.c instead of putting it all in error-report.c felt slightly nicer. One thing I didn't tackle is making the location info get reported for qemu_log. This is used to give context for error messages when parsing some CLI args, and could be interesting for log messages associated with those same CLI args. I'm not too happy with the constructor priority logic, but I don't see a better option, as I don't think it is practical to order .o files passed to the linker in a way that nicely guarantees the order of constructor execution. Daniel P. Berrangé (12): include: define constant for early constructor priority monitor: initialize global data from a constructor system: unconditionally enable thread naming util: set the name for the 'main' thread util: add API to fetch the current thread id util: add API to fetch the current thread name util: introduce common helper for error-report & log code util: convert error-report & log to message API for timestamp util: add support for formatting a workload name in messages util: add support for formatting a program name in messages util: add support for formatting thread info in messages util: add brackets around guest name in message context MAINTAINERS | 2 + docs/about/deprecated.rst | 7 +++ include/qemu/compiler.h | 8 +++ include/qemu/error-report.h | 4 -- include/qemu/message.h | 52 +++++++++++++++++ include/qemu/thread.h | 3 +- meson.build | 21 +++++++ monitor/monitor.c | 14 +++-- storage-daemon/qemu-storage-daemon.c | 6 ++ system/vl.c | 30 +++++++--- tests/qemu-iotests/041 | 2 +- tests/qemu-iotests/common.filter | 2 +- tests/unit/test-error-report.c | 6 +- util/error-report.c | 29 +--------- util/log.c | 20 +++---- util/meson.build | 1 + util/message.c | 69 ++++++++++++++++++++++ util/qemu-thread-posix.c | 60 ++++++++++++++----- util/qemu-thread-win32.c | 86 ++++++++++++++++++++-------- 19 files changed, 321 insertions(+), 101 deletions(-) create mode 100644 include/qemu/message.h create mode 100644 util/message.c -- 2.50.1

2 17

[PATCH] spec: Package newly introduced CH conf files
by Michal Privoznik 19 Aug '25

19 Aug '25

From: Michal Privoznik <mprivozn(a)redhat.com> In a recent commit of v11.6.0-25-g5dca0567f6 new config files for the CH driver were introduced. But corresponding change to the specfile was missing resulting in a broken rpmbuild. Just put those files into daemon-driver-ch rpm. Fixes: 5dca0567f694a7405ca3e796149aed857b1f6090 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- libvirt.spec.in | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libvirt.spec.in b/libvirt.spec.in index 47644556d9..aff2707705 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -2468,6 +2468,9 @@ exit 0 %{_unitdir}/virtchd.service %{_unitdir}/virtchd.socket %{_libdir}/libvirt/connection-driver/libvirt_driver_ch.so +%config(noreplace) %{_sysconfdir}/libvirt/ch.conf +%{_datadir}/augeas/lenses/libvirtd_ch.aug +%{_datadir}/augeas/lenses/tests/test_libvirtd_ch.aug %endif %files client -- 2.49.1

2 1