October 2026 - Devel - libvirt List Archives

[PATCH 0/2] qemu: add support for vhost-net when using the mshv accelerator
by Magnus Kulke 16 Oct '26

16 Oct '26

Currently vhost-net is dropped for everything but KVM, this change enables it also for the MSHV accelerator (HYPERV). A unit test has been added to confirm the vhost param is generated in a QEMU cmdline for KVM and MSHV accelerators. Magnus Kulke (2): qemu: Consider vhost-net for mshv accelerator test: vhost-net qemu commandline generation src/qemu/qemu_interface.c | 6 +- tests/qemucommandutiltest.c | 128 ++++++++++++++++++++++++++++++++++++ 2 files changed, 131 insertions(+), 3 deletions(-) -- 2.34.1

2 7

[PATCH] build: disable nwfilter if network is disabled
by Marek Marczykowski-Górecki 16 Oct '26

16 Oct '26

Otherwise build with -Ddriver_network=disabled fails with: src/nwfilter/meson.build:51:43: ERROR: Unknown variable "firewall_backend_priority". Signed-off-by: Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com> --- meson.build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meson.build b/meson.build index 927665b5fb..26cf3aca21 100644 --- a/meson.build +++ b/meson.build @@ -2031,7 +2031,7 @@ endif # nwfilter should only be compiled for linux, and only if the # libvirt daemon is also being compiled -if conf.has('WITH_LIBVIRTD') and host_machine.system() == 'linux' +if conf.has('WITH_LIBVIRTD') and conf.has('WITH_NETWORK') and host_machine.system() == 'linux' conf.set('WITH_NWFILTER', 1) endif -- 2.54.0

3 2

[PATCH] tests: Model qemuInterfaceOpenVhostNet() mock more closely to its source
by Michal Privoznik 16 Oct '26

16 Oct '26

From: Michal Privoznik <mprivozn(a)redhat.com> Inside of qemuxml2argvmock.c there's an alternative implementation of qemuInterfaceOpenVhostNet(). Fair enough. But the original function (living in qemu_interface.c) has a check which exits early from the function. This check is lacking in the mock which then leads qemuxmlconftest generate a different cmd line than the production code. The is particularly important, when the check is changed and we want to verify through tests that it doesn't break anything. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tests/qemuxml2argvmock.c | 7 ++++++- tests/qemuxmlconfdata/downscript.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/net-coalesce.x86_64-latest.args | 6 +++--- .../net-eth-unmanaged-tap.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/net-isolated-port.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/net-midonet.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/net-mtu.x86_64-latest.args | 4 ++-- .../net-virtio-network-portgroup.x86_64-latest.args | 2 +- .../net-virtio-teaming-network.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/net-virtio-vhost.x86_64-latest.args | 6 +++--- .../qemuxmlconfdata/tap-vhost-incorrect.x86_64-latest.args | 2 +- tests/qemuxmlconfdata/tap-vhost.x86_64-latest.args | 2 +- 12 files changed, 22 insertions(+), 17 deletions(-) diff --git a/tests/qemuxml2argvmock.c b/tests/qemuxml2argvmock.c index 4f47b2598e..7b211a191d 100644 --- a/tests/qemuxml2argvmock.c +++ b/tests/qemuxml2argvmock.c @@ -222,13 +222,18 @@ virNetDevOpenvswitchGetVhostuserIfname(const char *path G_GNUC_UNUSED, } int -qemuInterfaceOpenVhostNet(virDomainObj *vm G_GNUC_UNUSED, +qemuInterfaceOpenVhostNet(virDomainObj *vm, virDomainNetDef *net) { qemuDomainNetworkPrivate *netpriv = QEMU_DOMAIN_NETWORK_PRIVATE(net); size_t vhostfdSize = net->driver.virtio.queues; size_t i; + if (vm->def->virtType != VIR_DOMAIN_VIRT_KVM || + net->driver.virtio.name == VIR_DOMAIN_NET_DRIVER_TYPE_QEMU) { + return 0; + } + if (!vhostfdSize) vhostfdSize = 1; diff --git a/tests/qemuxmlconfdata/downscript.x86_64-latest.args b/tests/qemuxmlconfdata/downscript.x86_64-latest.args index 6ee1d402b5..177b700f0f 100644 --- a/tests/qemuxmlconfdata/downscript.x86_64-latest.args +++ b/tests/qemuxmlconfdata/downscript.x86_64-latest.args @@ -34,7 +34,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -device '{"driver":"virtio-9p-pci","id":"fs0","fsdev":"fsdev-fs0","mount_tag":"fs1","bus":"pci.0","addr":"0x3"}' \ -fsdev local,security_model=mapped,id=fsdev-fs1,path=/export/fs2 \ -device '{"driver":"virtio-9p-pci","id":"fs1","fsdev":"fsdev-fs1","mount_tag":"fs2","bus":"pci.0","addr":"0x4"}' \ --netdev '{"type":"tap","fd":"@tap-vnet0-fd@","vhost":true,"vhostfd":"@vhostfd-net0-fd@","id":"hostnet0"}' \ +-netdev '{"type":"tap","fd":"@tap-vnet0-fd@","id":"hostnet0"}' \ -device '{"driver":"virtio-net-pci","netdev":"hostnet0","id":"net0","mac":"52:54:00:f6:66:88","bus":"pci.0","addr":"0xb"}' \ -audiodev '{"id":"audio1","driver":"none"}' \ -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0xc"}' \ diff --git a/tests/qemuxmlconfdata/net-coalesce.x86_64-latest.args b/tests/qemuxmlconfdata/net-coalesce.x86_64-latest.args index 688a19f91a..30a6cfcc87 100644 --- a/tests/qemuxmlconfdata/net-coalesce.x86_64-latest.args +++ b/tests/qemuxmlconfdata/net-coalesce.x86_64-latest.args @@ -33,11 +33,11 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-test/.config \ -device '{"driver":"virtio-blk-pci","event_idx":true,"bus":"pci.0","addr":"0x4","drive":"libvirt-2-format","id":"virtio-disk0","bootindex":2}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/Fedora-14-x86_64-Live-KDE.iso","node-name":"libvirt-1-storage","read-only":true}' \ -device '{"driver":"ide-cd","bus":"ide.1","unit":0,"drive":"libvirt-1-storage","id":"ide0-1-0","bootindex":1}' \ --netdev '{"type":"tap","fd":"@iface-net0-fd@","vhost":true,"vhostfd":"@vhostfd-net0-fd@","id":"hostnet0"}' \ +-netdev '{"type":"tap","fd":"@iface-net0-fd@","id":"hostnet0"}' \ -device '{"driver":"virtio-net-pci","netdev":"hostnet0","id":"net0","mac":"52:54:00:e5:48:58","bus":"pci.0","addr":"0x2"}' \ --netdev '{"type":"tap","fd":"@iface-net1-fd@","vhost":true,"vhostfd":"@vhostfd-net1-fd@","id":"hostnet1"}' \ +-netdev '{"type":"tap","fd":"@iface-net1-fd@","id":"hostnet1"}' \ -device '{"driver":"virtio-net-pci","netdev":"hostnet1","id":"net1","mac":"52:54:00:e5:48:59","bus":"pci.0","addr":"0x3"}' \ --netdev '{"type":"tap","fd":"@iface-net2-fd@","vhost":true,"vhostfd":"@vhostfd-net2-fd@","id":"hostnet2"}' \ +-netdev '{"type":"tap","fd":"@iface-net2-fd@","id":"hostnet2"}' \ -device '{"driver":"virtio-net-pci","netdev":"hostnet2","id":"net2","mac":"52:54:00:e5:48:60","bus":"pci.0","addr":"0x5"}' \ -chardev pty,id=charserial0 \ -device '{"driver":"isa-serial","chardev":"charserial0","id":"serial0","index":0}' \ diff --git a/tests/qemuxmlconfdata/net-eth-unmanaged-tap.x86_64-latest.args b/tests/qemuxmlconfdata/net-eth-unmanaged-tap.x86_64-latest.args index 902b70d17f..2cc2e53dc4 100644 --- a/tests/qemuxmlconfdata/net-eth-unmanaged-tap.x86_64-latest.args +++ b/tests/qemuxmlconfdata/net-eth-unmanaged-tap.x86_64-latest.args @@ -29,7 +29,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \ -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","read-only":false}' \ -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-storage","id":"ide0-0-0","bootindex":1}' \ --netdev '{"type":"tap","fd":"@tap-mytap0-fd@","vhost":true,"vhostfd":"@vhostfd-net0-fd@","id":"hostnet0"}' \ +-netdev '{"type":"tap","fd":"@tap-mytap0-fd@","id":"hostnet0"}' \ -device '{"driver":"virtio-net-pci","netdev":"hostnet0","id":"net0","mac":"fe:11:22:33:44:55","bus":"pci.0","addr":"0x2"}' \ -audiodev '{"id":"audio1","driver":"none"}' \ -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ diff --git a/tests/qemuxmlconfdata/net-isolated-port.x86_64-latest.args b/tests/qemuxmlconfdata/net-isolated-port.x86_64-latest.args index fcb202cd23..4f2833ca69 100644 --- a/tests/qemuxmlconfdata/net-isolated-port.x86_64-latest.args +++ b/tests/qemuxmlconfdata/net-isolated-port.x86_64-latest.args @@ -32,7 +32,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-q35-test/.config \ -device '{"driver":"qemu-xhci","id":"usb","bus":"pci.2","addr":"0x0"}' \ -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","read-only":false}' \ -device '{"driver":"ide-hd","bus":"ide.0","drive":"libvirt-1-storage","id":"sata0-0-0","bootindex":1}' \ --netdev '{"type":"tap","fd":"@iface-net0-fd@","vhost":true,"vhostfd":"@vhostfd-net0-fd@","id":"hostnet0"}' \ +-netdev '{"type":"tap","fd":"@iface-net0-fd@","id":"hostnet0"}' \ -device '{"driver":"virtio-net-pci","netdev":"hostnet0","id":"net0","mac":"52:54:00:d6:c0:0b","bus":"pci.1","addr":"0x0"}' \ -audiodev '{"id":"audio1","driver":"none"}' \ -device '{"driver":"qxl-vga","id":"video0","max_outputs":1,"ram_size":67108864,"vram_size":33554432,"vram64_size_mb":0,"vgamem_mb":8,"bus":"pcie.0","addr":"0x1"}' \ diff --git a/tests/qemuxmlconfdata/net-midonet.x86_64-latest.args b/tests/qemuxmlconfdata/net-midonet.x86_64-latest.args index 13bc83b4cb..f87a2df60c 100644 --- a/tests/qemuxmlconfdata/net-midonet.x86_64-latest.args +++ b/tests/qemuxmlconfdata/net-midonet.x86_64-latest.args @@ -29,7 +29,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \ -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","read-only":false}' \ -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-storage","id":"ide0-0-0","bootindex":1}' \ --netdev '{"type":"tap","fd":"@iface-net0-fd@","vhost":true,"vhostfd":"@vhostfd-net0-fd@","id":"hostnet0"}' \ +-netdev '{"type":"tap","fd":"@iface-net0-fd@","id":"hostnet0"}' \ -device '{"driver":"virtio-net-pci","netdev":"hostnet0","id":"net0","mac":"00:11:22:33:44:55","bus":"pci.0","addr":"0x2"}' \ -audiodev '{"id":"audio1","driver":"none"}' \ -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x3"}' \ diff --git a/tests/qemuxmlconfdata/net-mtu.x86_64-latest.args b/tests/qemuxmlconfdata/net-mtu.x86_64-latest.args index 922552cd8b..51f5d8383c 100644 --- a/tests/qemuxmlconfdata/net-mtu.x86_64-latest.args +++ b/tests/qemuxmlconfdata/net-mtu.x86_64-latest.args @@ -33,9 +33,9 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-test/.config \ -device '{"driver":"virtio-blk-pci","event_idx":true,"bus":"pci.0","addr":"0x4","drive":"libvirt-2-format","id":"virtio-disk0","bootindex":2}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/Fedora-14-x86_64-Live-KDE.iso","node-name":"libvirt-1-storage","read-only":true}' \ -device '{"driver":"ide-cd","bus":"ide.1","unit":0,"drive":"libvirt-1-storage","id":"ide0-1-0","bootindex":1}' \ --netdev '{"type":"tap","fd":"@iface-net0-fd@","vhost":true,"vhostfd":"@vhostfd-net0-fd@","id":"hostnet0"}' \ +-netdev '{"type":"tap","fd":"@iface-net0-fd@","id":"hostnet0"}' \ -device '{"driver":"virtio-net-pci","host_mtu":1500,"netdev":"hostnet0","id":"net0","mac":"52:54:00:e5:48:58","bus":"pci.0","addr":"0x2"}' \ --netdev '{"type":"tap","fd":"@iface-net1-fd@","vhost":true,"vhostfd":"@vhostfd-net1-fd@","sndbuf":1600,"id":"hostnet1"}' \ +-netdev '{"type":"tap","fd":"@iface-net1-fd@","sndbuf":1600,"id":"hostnet1"}' \ -device '{"driver":"virtio-net-pci","host_mtu":9000,"netdev":"hostnet1","id":"net1","mac":"52:54:00:e5:48:59","bus":"pci.0","addr":"0x3"}' \ -chardev pty,id=charserial0 \ -device '{"driver":"isa-serial","chardev":"charserial0","id":"serial0","index":0}' \ diff --git a/tests/qemuxmlconfdata/net-virtio-network-portgroup.x86_64-latest.args b/tests/qemuxmlconfdata/net-virtio-network-portgroup.x86_64-latest.args index e45b7b330e..5d9182c324 100644 --- a/tests/qemuxmlconfdata/net-virtio-network-portgroup.x86_64-latest.args +++ b/tests/qemuxmlconfdata/net-virtio-network-portgroup.x86_64-latest.args @@ -29,7 +29,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \ -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","read-only":false}' \ -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-storage","id":"ide0-0-0","bootindex":1}' \ --netdev '{"type":"tap","fd":"@iface-net0-fd@","vhost":true,"vhostfd":"@vhostfd-net0-fd@","id":"hostnet0"}' \ +-netdev '{"type":"tap","fd":"@iface-net0-fd@","id":"hostnet0"}' \ -device '{"driver":"virtio-net-pci","netdev":"hostnet0","id":"net0","mac":"00:11:22:33:44:55","bus":"pci.0","addr":"0x2"}' \ -netdev '{"type":"tap","fd":"@iface-net1-fd@","id":"hostnet1"}' \ -device '{"driver":"rtl8139","netdev":"hostnet1","id":"net1","mac":"10:11:22:33:44:55","bus":"pci.0","addr":"0x3"}' \ diff --git a/tests/qemuxmlconfdata/net-virtio-teaming-network.x86_64-latest.args b/tests/qemuxmlconfdata/net-virtio-teaming-network.x86_64-latest.args index ffaf2aa911..a798c184b1 100644 --- a/tests/qemuxmlconfdata/net-virtio-teaming-network.x86_64-latest.args +++ b/tests/qemuxmlconfdata/net-virtio-teaming-network.x86_64-latest.args @@ -29,7 +29,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \ -blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","read-only":false}' \ -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-storage","id":"ide0-0-0","bootindex":1}' \ --netdev '{"type":"tap","fd":"@iface-ua-backup0-fd@","vhost":true,"vhostfd":"@vhostfd-ua-backup0-fd@","id":"hostua-backup0"}' \ +-netdev '{"type":"tap","fd":"@iface-ua-backup0-fd@","id":"hostua-backup0"}' \ -device '{"driver":"virtio-net-pci","failover":true,"netdev":"hostua-backup0","id":"ua-backup0","mac":"00:11:22:33:44:55","bus":"pci.0","addr":"0x2"}' \ -audiodev '{"id":"audio1","driver":"none"}' \ -device '{"driver":"vfio-pci","host":"0000:06:12.2","id":"hostdev0","failover_pair_id":"ua-backup0","bus":"pci.0","addr":"0x3"}' \ diff --git a/tests/qemuxmlconfdata/net-virtio-vhost.x86_64-latest.args b/tests/qemuxmlconfdata/net-virtio-vhost.x86_64-latest.args index da1c3a3d76..3b9dc09aec 100644 --- a/tests/qemuxmlconfdata/net-virtio-vhost.x86_64-latest.args +++ b/tests/qemuxmlconfdata/net-virtio-vhost.x86_64-latest.args @@ -28,11 +28,11 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-test/.config \ -boot menu=on,strict=on \ -device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \ -device '{"driver":"virtio-serial-pci","id":"virtio-serial0","bus":"pci.0","addr":"0x6"}' \ --netdev '{"type":"tap","fds":"XXXXXXX","vhost":true,"vhostfds":"XXXXXXX","id":"hostnet0"}' \ +-netdev '{"type":"tap","fds":"XXXXXXX","id":"hostnet0"}' \ -device '{"driver":"virtio-net-pci","mq":true,"vectors":12,"netdev":"hostnet0","id":"net0","mac":"52:54:00:e5:48:58","bus":"pci.0","addr":"0x2"}' \ --netdev '{"type":"tap","fd":"@tap-vnet0-fd@","vhost":true,"vhostfd":"@vhostfd-net1-fd@","id":"hostnet1"}' \ +-netdev '{"type":"tap","fd":"@tap-vnet0-fd@","id":"hostnet1"}' \ -device '{"driver":"virtio-net-pci","ioeventfd":true,"netdev":"hostnet1","id":"net1","mac":"52:54:00:e5:48:59","bus":"pci.0","addr":"0x3"}' \ --netdev '{"type":"tap","fds":"XXXXXXX","vhost":true,"vhostfds":"XXXXXXX","id":"hostnet2"}' \ +-netdev '{"type":"tap","fds":"XXXXXXX","id":"hostnet2"}' \ -device '{"driver":"virtio-net-pci","ioeventfd":true,"mq":true,"vectors":12,"netdev":"hostnet2","id":"net2","mac":"52:54:00:e5:48:5a","bus":"pci.0","addr":"0x4"}' \ -chardev pty,id=charserial0 \ -device '{"driver":"isa-serial","chardev":"charserial0","id":"serial0","index":0}' \ diff --git a/tests/qemuxmlconfdata/tap-vhost-incorrect.x86_64-latest.args b/tests/qemuxmlconfdata/tap-vhost-incorrect.x86_64-latest.args index 2a9229f3f6..326528eea4 100644 --- a/tests/qemuxmlconfdata/tap-vhost-incorrect.x86_64-latest.args +++ b/tests/qemuxmlconfdata/tap-vhost-incorrect.x86_64-latest.args @@ -30,7 +30,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-test/.config \ -device '{"driver":"virtio-serial-pci","id":"virtio-serial0","bus":"pci.0","addr":"0x6"}' \ -netdev '{"type":"tap","fd":"@iface-net0-fd@","id":"hostnet0"}' \ -device '{"driver":"e1000","netdev":"hostnet0","id":"net0","mac":"52:54:00:e5:48:58","bus":"pci.0","addr":"0x2"}' \ --netdev '{"type":"tap","fd":"@iface-net1-fd@","vhost":true,"vhostfd":"@vhostfd-net1-fd@","id":"hostnet1"}' \ +-netdev '{"type":"tap","fd":"@iface-net1-fd@","id":"hostnet1"}' \ -device '{"driver":"virtio-net-pci","netdev":"hostnet1","id":"net1","mac":"52:54:00:e5:48:59","bus":"pci.0","addr":"0x3"}' \ -chardev pty,id=charserial0 \ -device '{"driver":"isa-serial","chardev":"charserial0","id":"serial0","index":0}' \ diff --git a/tests/qemuxmlconfdata/tap-vhost.x86_64-latest.args b/tests/qemuxmlconfdata/tap-vhost.x86_64-latest.args index 3b36e2f6ce..91ce5e170f 100644 --- a/tests/qemuxmlconfdata/tap-vhost.x86_64-latest.args +++ b/tests/qemuxmlconfdata/tap-vhost.x86_64-latest.args @@ -33,7 +33,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-test/.config \ -device '{"driver":"virtio-blk-pci","event_idx":true,"bus":"pci.0","addr":"0x4","drive":"libvirt-2-format","id":"virtio-disk0","bootindex":2}' \ -blockdev '{"driver":"file","filename":"/var/lib/libvirt/Fedora-14-x86_64-Live-KDE.iso","node-name":"libvirt-1-storage","read-only":true}' \ -device '{"driver":"ide-cd","bus":"ide.1","unit":0,"drive":"libvirt-1-storage","id":"ide0-1-0","bootindex":1}' \ --netdev '{"type":"tap","fds":"XXXXXXX","vhost":true,"vhostfds":"XXXXXXX","id":"hostnet0"}' \ +-netdev '{"type":"tap","fds":"XXXXXXX","id":"hostnet0"}' \ -device '{"driver":"virtio-net-pci","mq":true,"vectors":12,"netdev":"hostnet0","id":"net0","mac":"52:54:00:e5:48:58","bus":"pci.0","addr":"0x2"}' \ -chardev pty,id=charserial0 \ -device '{"driver":"isa-serial","chardev":"charserial0","id":"serial0","index":0}' \ -- 2.56.0

2 1

[PATCH] virpci: fix handling newline in PCI device class
by Marek Marczykowski-Górecki 16 Oct '26

16 Oct '26

The referenced commit removed trimming newline resulting in errors like: Unusual value in /sys/bus/pci//devices/0000:00:17.0/class: 0x010601 It's a perfectly valid class, it's just the newline that virStrToLong_ui didn't like (as it wasn't parsed and endptr is given NULL). Restore stripping newline, but do so a bit nicer than hardcoded offset. Fixes: 58b3a78aff "virPCIDeviceReadClass: Don't write beyond end of buffer from virFileReadAll" Signed-off-by: Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com> --- src/util/virpci.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/util/virpci.c b/src/util/virpci.c index 34fc70e261..66500132c9 100644 --- a/src/util/virpci.c +++ b/src/util/virpci.c @@ -488,6 +488,8 @@ virPCIDeviceReadClass(virPCIDevice *dev, uint16_t *device_class) if (virFileReadAll(path, 9, &id_str) < 0) return -1; + virStringTrimOptionalNewline(id_str); + if (virStrToLong_ui(id_str, NULL, 16, &value) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, _("Unusual value in %1$s/devices/%2$s/class: %3$s"), -- 2.54.0

2 1

[PATCH v1 00/14] s390x: Secure Boot interface (boot-certs + secure-boot)
by Zhuoying Cai 15 Oct '26

15 Oct '26

This series adds libvirt support for the s390x Secure IPL interface, which allows firmware to verify the integrity and authenticity of a boot image against a set of X.509 certificates before handing control to the guest OS. Two new machine properties on s390-ccw-virtio: boot-certs.N.path=<path> – supply one or more X.509 certificates or directory secure-boot=on|off – enable/disable secure boot On the XML side, a new <boot-certs> element under <os> stores the certificate paths, while the existing secure-boot firmware feature is reused to control the corresponding QEMU machine property. Providing certificates without enabling secure boot is a valid configuration and places the firmware into audit mode, allowing verification results to be reported without enforcing them. Usage example: <os> <type arch='s390x' machine='s390-ccw-virtio-11.2'>hvm</type> <firmware> <feature enabled='yes' name='secure-boot'/> </firmware> <boot-certs> <path>/path/to/cert_dir</path> <path>/path/to/cert1.pem</path> </boot-certs> </os> The series adds: * XML parsing and formatting for <boot-certs> and secure-boot on s390x * QEMU capability detection with updated s390x QMP reply fixtures for QEMU 8.1 through 11.2 * -machine argument generation for boot-certs and secure-boot * Validation (s390x-only, secure-boot requires certs, QEMU version) * Domain capabilities reporting in the <os> section * Documentation and tests Boris Fiuczynski (1): test: Add ABI update test for s390x secure-boot Zhuoying Cai (13): conf: Add s390x boot-certs XML support qemu: capabilities: Detect s390-ccw-virtio 'boot-certs' machine property qemu: Add s390x boot-certs support conf: Add s390x boot-certs domain capabilities reporting docs: formatdomain: Document boot-certs element conf: Refactor firmware feature without auto select validation conf: Allow secure-boot firmware feature on s390x qemu: capabilities: Detect s390-ccw-virtio 'secure-boot' machine property qemu: Add s390x secure-boot support qemu: Report s390-ccw-virtio 'secure-boot' in domain capabilities docs: Document s390x Secure IPL firmware feature test: Add tests for secure-boot and boot-certs attributes NEWS: Document s390x Secure Boot and boot certificates support NEWS.rst | 24 +++ docs/formatdomain.rst | 40 +++- docs/formatdomaincaps.rst | 31 +++ docs/kbase/secureboot.rst | 60 ++++++ src/conf/domain_capabilities.c | 10 + src/conf/domain_capabilities.h | 6 + src/conf/domain_conf.c | 77 +++++++- src/conf/domain_conf.h | 2 + src/conf/domain_validate.c | 32 +++- src/conf/schemas/domaincaps.rng | 9 + src/conf/schemas/domaincommon.rng | 9 + src/qemu/qemu_capabilities.c | 38 ++++ src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_command.c | 16 ++ src/qemu/qemu_validate.c | 29 +++ tests/domaincapsdata/qemu_10.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_10.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_11.0.0.s390x.xml | 1 + tests/domaincapsdata/qemu_11.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_11.2.0.s390x.xml | 6 +- tests/domaincapsdata/qemu_8.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.2.0.s390x.xml | 1 + .../caps_10.0.0_s390x.replies | 145 +++++++++++++- .../caps_10.1.0_s390x.replies | 150 ++++++++++++++- .../caps_11.0.0_s390x.replies | 156 ++++++++++++++- .../caps_11.1.0_s390x.replies | 156 ++++++++++++++- .../caps_11.2.0_s390x.replies | 181 +++++++++++++++++- .../caps_11.2.0_s390x.xml | 2 + .../caps_8.1.0_s390x.replies | 135 ++++++++++++- .../caps_8.2.0_s390x.replies | 135 ++++++++++++- .../caps_9.1.0_s390x.replies | 139 +++++++++++++- .../caps_9.2.0_s390x.replies | 144 +++++++++++++- .../s390-boot-certs-only.s390x-11.1.0.err | 1 + .../s390-boot-certs-only.s390x-latest.args | 32 ++++ .../s390-boot-certs-only.s390x-latest.xml | 30 +++ .../qemuxmlconfdata/s390-boot-certs-only.xml | 15 ++ ...90-secure-boot-audit-mode.s390x-11.1.0.err | 1 + ...0-secure-boot-audit-mode.s390x-latest.args | 32 ++++ ...90-secure-boot-audit-mode.s390x-latest.xml | 33 ++++ .../s390-secure-boot-audit-mode.xml | 18 ++ ...0-secure-boot-multi-certs.s390x-11.1.0.err | 1 + ...-secure-boot-multi-certs.s390x-latest.args | 32 ++++ ...0-secure-boot-multi-certs.s390x-latest.xml | 34 ++++ .../s390-secure-boot-multi-certs.xml | 19 ++ ...s390-secure-boot-no-certs.s390x-11.1.0.err | 1 + ...s390-secure-boot-no-certs.s390x-latest.err | 1 + .../s390-secure-boot-no-certs.xml | 15 ++ ...90-secure-boot-none-s390.x86_64-latest.err | 1 + .../s390-secure-boot-none-s390.xml | 15 ++ ...e-boot-with-enrolled-keys.s390x-latest.err | 1 + .../s390-secure-boot-with-enrolled-keys.xml | 19 ++ .../s390-secure-boot.s390x-11.1.0.err | 1 + ...0-secure-boot.s390x-latest.abi-update.args | 32 ++++ ...90-secure-boot.s390x-latest.abi-update.xml | 33 ++++ .../s390-secure-boot.s390x-latest.args | 32 ++++ .../s390-secure-boot.s390x-latest.xml | 33 ++++ tests/qemuxmlconfdata/s390-secure-boot.xml | 18 ++ tests/qemuxmlconftest.c | 14 ++ 60 files changed, 2120 insertions(+), 86 deletions(-) create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-boot-certs-only.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-audit-mode.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-multi-certs.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.s390x-latest.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-no-certs.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-none-s390.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-none-s390.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.s390x-latest.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot-with-enrolled-keys.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-11.1.0.err create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.abi-update.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.abi-update.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-secure-boot.xml -- 2.56.0

1 15

[PATCH 0/1] Report guest reboot as shutdown detail
by Jean-Louis Dupond 15 Oct '26

15 Oct '26

In oVirt for example, we have the concept of next-run config. This is a new config (memory/cpu/devices/etc) for the VM that cannot be applied live. When a next-run config exists, we set the VM to destroy on guest reboot, so we can boot it again with it's new settings on a reboot. But to be able to distinguish a reboot vs a shutdown (so we know if we need to boot the VM again or not), we need to know what has been triggered within the VM. But this is currently not passed via any event. Therefor this patch adds a new event, so we are able to distinguish a in-guest reboot vs shutdown. Jean-Louis Dupond (1): qemu: report guest reboot as shutdown detail for on_reboot=destroy examples/c/misc/event-test.c | 3 +++ include/libvirt/libvirt-domain.h | 5 +++++ src/qemu/qemu_monitor.c | 2 +- src/qemu/qemu_monitor.h | 3 ++- src/qemu/qemu_process.c | 35 +++++++++++++++++++------------- tools/virsh-domain-event.c | 3 ++- 6 files changed, 34 insertions(+), 17 deletions(-) -- 2.55.0

2 3

[PATCH 0/2] libxl: Fire reboot event
by Ben Grande 15 Oct '26

15 Oct '26

The driver libxl already detects when the shutdown reason is to reboot, but it was not firing the "VIR_DOMAIN_EVENT_ID_REBOOT" when that happened. I added support for the event to be fired when the reasons are "restart" or "destroy", later explained in the commit messages why "destroy" is included" I have tested this patch series on Qubes OS with Xen 4.19.5. CI: https://gitlab.com/libvirt/libvirt/-/merge_requests/567 Ben Grande (2): libxl: Fire reboot event NEWS: Document libvirt event for Xen reboot NEWS.rst | 3 +++ docs/formatdomain.rst | 14 +++++++++++--- src/libvirt-domain.c | 4 +++- src/libxl/libxl_domain.c | 4 ++++ 4 files changed, 21 insertions(+), 4 deletions(-) -- Benjamin Grande

3 7

[libvirt] [PATCH 00/23] Fix host-model if the chosen CPU model has more features in QEMU compared to our cpu_map.xml
by Jiri Denemark 15 Oct '26

15 Oct '26

When decoding CPUID data to virCPUDef we need to be careful about using a CPU model which cannot be directly used on the current host. Normally, libvirt would notice the features which prevent the model from being usable and it would disable them in the computed virCPUDef, but this won't work in case the definition of the CPU model in QEMU contains more features than what we have in cpu_map.xml. We need to count with the usability blockers we got from QEMU and explicitly disable all of them to make the computed virCPUDef usable. https://bugzilla.redhat.com/show_bug.cgi?id=1464832 Jiri Denemark (23): util: Introduce virStringListCopy conf: Add usability blockers to virDomainCapsCPUModel qemu: Store CPU usability blockers in caps cache qemu: Parse unavailable features for CPU models cpu: Use virDomainCapsCPUModelsPtr in cpu driver APIs cpu: Drop unused parameter from cpuDecode cpu: Return model from virCPUModelIsAllowed cpu_x86: Move x86FeatureFind* to avoid forward prototypes cpu_x86: Disable blockers from unusable CPU models cputest: Replace json bool with enum cputest: Avoid calling json_reformat in cpu-parse.sh cputest: Print correct feature in virCPUUpdateLive test cputest: Test CPU usability blockers cputest: Separate QEMUCaps creation from cpuTestCPUIDJson build: Export virCPUModelIsAllowed private API cputest: Use CPU models from QEMU when available cputest: Add query-cpu-definitions reply for Core-i5-2540M cputest: Add CPUID data for Intel(R) Xeon(R) CPU E7-4830 cputest: Add query-cpu-definitions reply for Xeon-E7-4830 cputest: Update Xeon-E3-1245 data cputest: Add query-cpu-definitions reply for Xeon-E3-1245 cputest: Update Core-i7-2600 data cputest: Make a crippled version of Core-i7-2600 src/conf/domain_capabilities.c | 30 +- src/conf/domain_capabilities.h | 7 +- src/cpu/cpu.c | 95 +- src/cpu/cpu.h | 31 +- src/cpu/cpu_arm.c | 3 +- src/cpu/cpu_ppc64.c | 14 +- src/cpu/cpu_x86.c | 108 +- src/libvirt_private.syms | 1 + src/libxl/libxl_capabilities.c | 2 +- src/libxl/libxl_driver.c | 2 +- src/qemu/qemu_capabilities.c | 123 +-- src/qemu/qemu_capabilities.h | 6 +- src/qemu/qemu_capspriv.h | 5 + src/qemu/qemu_driver.c | 2 +- src/qemu/qemu_monitor.c | 2 + src/qemu/qemu_monitor.h | 1 + src/qemu/qemu_monitor_json.c | 26 +- src/qemu/qemu_process.c | 9 +- src/test/test_driver.c | 2 +- src/util/virstring.c | 37 + src/util/virstring.h | 3 + tests/cputest.c | 324 ++++-- tests/cputestdata/cpu-cpuid.py | 26 +- tests/cputestdata/cpu-gather.sh | 1 + tests/cputestdata/cpu-parse.sh | 2 +- tests/cputestdata/cpu-reformat.py | 9 + tests/cputestdata/x86_64-cpuid-Core-i5-2540M.json | 362 +++++++ .../x86_64-cpuid-Core-i7-2600-disabled.xml | 1 - .../x86_64-cpuid-Core-i7-2600-enabled.xml | 1 + .../cputestdata/x86_64-cpuid-Core-i7-2600-json.xml | 1 + ...x86_64-cpuid-Core-i7-2600-xsaveopt-disabled.xml | 6 + .../x86_64-cpuid-Core-i7-2600-xsaveopt-enabled.xml | 8 + .../x86_64-cpuid-Core-i7-2600-xsaveopt-guest.xml | 25 + .../x86_64-cpuid-Core-i7-2600-xsaveopt-host.xml | 25 + .../x86_64-cpuid-Core-i7-2600-xsaveopt-json.xml | 11 + .../x86_64-cpuid-Core-i7-2600-xsaveopt.json | 615 +++++++++++ .../x86_64-cpuid-Core-i7-2600-xsaveopt.xml | 33 + tests/cputestdata/x86_64-cpuid-Core-i7-2600.json | 496 ++++++++- tests/cputestdata/x86_64-cpuid-Core-i7-2600.xml | 6 +- .../x86_64-cpuid-Xeon-E3-1245-disabled.xml | 1 - .../x86_64-cpuid-Xeon-E3-1245-enabled.xml | 2 +- .../cputestdata/x86_64-cpuid-Xeon-E3-1245-json.xml | 1 + tests/cputestdata/x86_64-cpuid-Xeon-E3-1245.json | 712 +++++++++---- tests/cputestdata/x86_64-cpuid-Xeon-E3-1245.xml | 7 +- .../x86_64-cpuid-Xeon-E7-4830-disabled.xml | 5 + .../x86_64-cpuid-Xeon-E7-4830-enabled.xml | 8 + .../x86_64-cpuid-Xeon-E7-4830-guest.xml | 28 + .../cputestdata/x86_64-cpuid-Xeon-E7-4830-host.xml | 29 + .../cputestdata/x86_64-cpuid-Xeon-E7-4830-json.xml | 14 + tests/cputestdata/x86_64-cpuid-Xeon-E7-4830.json | 657 ++++++++++++ tests/cputestdata/x86_64-cpuid-Xeon-E7-4830.xml | 30 + tests/domaincapstest.c | 6 +- tests/qemucapabilitiesdata/caps_2.10.0.s390x.xml | 1102 ++++++++++++++++++-- tests/qemucapabilitiesdata/caps_2.10.0.x86_64.xml | 236 ++++- tests/qemucapabilitiesdata/caps_2.8.0.x86_64.xml | 154 ++- tests/qemucapabilitiesdata/caps_2.9.0.x86_64.xml | 154 ++- 56 files changed, 4927 insertions(+), 680 deletions(-) create mode 100755 tests/cputestdata/cpu-reformat.py create mode 100644 tests/cputestdata/x86_64-cpuid-Core-i7-2600-xsaveopt-disabled.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Core-i7-2600-xsaveopt-enabled.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Core-i7-2600-xsaveopt-guest.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Core-i7-2600-xsaveopt-host.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Core-i7-2600-xsaveopt-json.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Core-i7-2600-xsaveopt.json create mode 100644 tests/cputestdata/x86_64-cpuid-Core-i7-2600-xsaveopt.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E7-4830-disabled.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E7-4830-enabled.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E7-4830-guest.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E7-4830-host.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E7-4830-json.xml create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E7-4830.json create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E7-4830.xml -- 2.14.2

3 66

[PATCH libvirt v1 0/4] s390x CPU model compatibility check for incoming migration
by Rorie Reyes 14 Oct '26

14 Oct '26

This series extends the qemu-cpu-model-comparison QMP interface in libvirt to surface the "responsible-properties" array returned by QEMU, and uses that information to perform a pre-flight CPU compatibility check on s390x before an incoming migration is accepted. Background ---------- On x86, QEMU rejects an incompatible CPU model at domain start time and produces a meaningful error. On s390x the guest starts successfully but may fail later in an opaque way if the destination host lacks required CPU features. This series brings s390x in line with x86 by catching the incompatibility early, aborting the migration cleanly, and reporting exactly which CPU properties are responsible. Functional Test Instructions ----------------------------- Prerequisites: - Two s390x hosts (source and destination) with different CPU feature levels from the same generation lineage (e.g. z16 and z17). - libvirt and QEMU built from this series on both hosts. - QEMU must support the query-cpu-model-comparison QMP command (QEMU >= 5.1). Test case 1 — Incompatible CPU model is rejected cleanly: 1. Define a guest on the source host using a custom s390x CPU model that includes features not present on the destination host. 2. Initiate a live migration to the destination host: virsh migrate --live <domain> qemu+ssh://dest-host/system 3. Expected result: migration fails immediately with a clear libvirt error before QEMU starts on the destination, e.g.: error: operation failed: guest CPU model is a newer generation than the destination host CPU model or, for a feature-level mismatch within the same generation: error: operation failed: destination host CPU model is missing features required by the guest CPU model: <prop1>, <prop2> 4. Verify the guest is still running cleanly on the source host: virsh domstate <domain> # should report: running Test case 2 — Compatible CPU model migrates successfully: 1. Define a guest using a CPU model fully supported by the destination (e.g. gen16a-base guest migrating to a gen17 host). 2. Initiate the same live migration. 3. Expected result: migration completes successfully with no errors. Rorie Reyes (4): qemu: extend GetCPUModelComparison to return responsible-properties qemu: propagate responsibleProps parameter through monitor layer qemu: introduce qemuProcessCPUModelComparison helper qemu: check CPU model compatibility on s390x before incoming migration src/qemu/qemu_driver.c | 20 ++--- src/qemu/qemu_migration.c | 114 +++++++++++++++++++++++++ src/qemu/qemu_monitor.c | 8 +- src/qemu/qemu_monitor.h | 3 +- src/qemu/qemu_monitor_json.c | 26 +++++- src/qemu/qemu_monitor_json.h | 5 +- src/qemu/qemu_process.c | 50 +++++++++++ src/qemu/qemu_process.h | 21 +++++ tests/qemumonitorjsontest.c | 159 +++++++++++++++++++++++++++++++++-- 9 files changed, 381 insertions(+), 25 deletions(-) -- 2.48.1

3 12

[libvirt PATCH] qemu: save virtiofs capabilities in status XML
by Ján Tomko 14 Oct '26

14 Oct '26

From: Ján Tomko <jtomko(a)redhat.com> Otherwise migration after daemon restart stops working. https://redhat.atlassian.net/browse/RHEL-90387 Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/conf/domain_conf.c | 9 + tests/qemustatusxml2xmldata/virtiofs-in.xml | 437 +++++++++++++++++++ tests/qemustatusxml2xmldata/virtiofs-out.xml | 1 + tests/qemuxmlactivetest.c | 2 + 4 files changed, 449 insertions(+) create mode 100644 tests/qemustatusxml2xmldata/virtiofs-in.xml create mode 120000 tests/qemustatusxml2xmldata/virtiofs-out.xml diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 94a1f8bd8e..69c2304f28 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -9564,6 +9564,7 @@ virDomainFSDefParseXML(virDomainXMLOption *xmlopt, if (def->fsdriver == VIR_DOMAIN_FS_DRIVER_TYPE_VIRTIOFS) { g_autofree char *queue_size = virXPathString("string(./driver/@queue)", ctxt); g_autofree char *binary = virXPathString("string(./binary/@path)", ctxt); + g_autofree char *caps = virXPathString("string(./binary/@caps)", ctxt); g_autofree char *thread_pool_size = virXPathString("string(./binary/thread_pool/@size)", ctxt); g_autofree char *openfiles = virXPathString("string(./binary/openfiles/@max)", ctxt); xmlNodePtr binary_node = virXPathNode("./binary", ctxt); @@ -9600,6 +9601,9 @@ virDomainFSDefParseXML(virDomainXMLOption *xmlopt, if (binary) def->binary = virFileSanitizePath(binary); + if (caps) + def->caps = virBitmapParseUnlimitedAllowEmpty(caps); + if (virXMLPropTristateSwitch(binary_node, "xattr", VIR_XML_PROP_NONE, &def->xattr) < 0) @@ -25222,6 +25226,11 @@ virDomainFSDefFormat(virBuffer *buf, g_auto(virBuffer) lockAttrBuf = VIR_BUFFER_INITIALIZER; virBufferEscapeString(&binaryAttrBuf, " path='%s'", def->binary); + if (flags & VIR_DOMAIN_DEF_FORMAT_STATUS) { + g_autofree char *capsBitmap = virBitmapFormat(def->caps); + virBufferAsprintf(&binaryAttrBuf, " caps='%s'", capsBitmap); + } + if (def->xattr != VIR_TRISTATE_SWITCH_ABSENT) { virBufferAsprintf(&binaryAttrBuf, " xattr='%s'", virTristateSwitchTypeToString(def->xattr)); diff --git a/tests/qemustatusxml2xmldata/virtiofs-in.xml b/tests/qemustatusxml2xmldata/virtiofs-in.xml new file mode 100644 index 0000000000..eeb40428bf --- /dev/null +++ b/tests/qemustatusxml2xmldata/virtiofs-in.xml @@ -0,0 +1,437 @@ +<domstatus state='running' reason='booted' pid='195139'> + <taint flag='high-privileges'/> + <monitor path='/var/lib/libvirt/qemu/domain-1-upstream/monitor.sock' type='unix'/> + <namespaces> + <mount/> + </namespaces> + <vcpus> + <vcpu id='0' pid='195156'/> + <vcpu id='1' pid='195157'/> + </vcpus> + <qemuCaps> + <flag name='kvm'/> + <flag name='mem-path'/> + <flag name='drive-serial'/> + <flag name='monitor-json'/> + <flag name='sdl'/> + <flag name='netdev'/> + <flag name='rtc'/> + <flag name='vhost-net'/> + <flag name='no-hpet'/> + <flag name='no-kvm-pit'/> + <flag name='nodefconfig'/> + <flag name='boot-menu'/> + <flag name='fsdev'/> + <flag name='name-process'/> + <flag name='smbios-type'/> + <flag name='spice'/> + <flag name='vga-none'/> + <flag name='boot-index'/> + <flag name='hda-duplex'/> + <flag name='drive-aio'/> + <flag name='ccid-emulated'/> + <flag name='ccid-passthru'/> + <flag name='chardev-spicevmc'/> + <flag name='virtio-tx-alg'/> + <flag name='pci-multifunction'/> + <flag name='virtio-blk-pci.ioeventfd'/> + <flag name='sga'/> + <flag name='virtio-blk-pci.event_idx'/> + <flag name='virtio-net-pci.event_idx'/> + <flag name='cache-directsync'/> + <flag name='piix3-usb-uhci'/> + <flag name='piix4-usb-uhci'/> + <flag name='usb-ehci'/> + <flag name='ich9-usb-ehci1'/> + <flag name='vt82c686b-usb-uhci'/> + <flag name='pci-ohci'/> + <flag name='usb-redir'/> + <flag name='usb-hub'/> + <flag name='no-shutdown'/> + <flag name='cache-unsafe'/> + <flag name='ich9-ahci'/> + <flag name='no-acpi'/> + <flag name='fsdev-readonly'/> + <flag name='virtio-blk-pci.scsi'/> + <flag name='drive-copy-on-read'/> + <flag name='fsdev-writeout'/> + <flag name='drive-iotune'/> + <flag name='system_wakeup'/> + <flag name='scsi-disk.channel'/> + <flag name='scsi-block'/> + <flag name='transaction'/> + <flag name='block-job-async'/> + <flag name='scsi-cd'/> + <flag name='ide-cd'/> + <flag name='no-user-config'/> + <flag name='hda-micro'/> + <flag name='dump-guest-memory'/> + <flag name='nec-usb-xhci'/> + <flag name='balloon-event'/> + <flag name='bridge'/> + <flag name='lsi'/> + <flag name='virtio-scsi-pci'/> + <flag name='blockio'/> + <flag name='disable-s3'/> + <flag name='disable-s4'/> + <flag name='usb-redir.filter'/> + <flag name='ide-drive.wwn'/> + <flag name='scsi-disk.wwn'/> + <flag name='seccomp-sandbox'/> + <flag name='reboot-timeout'/> + <flag name='dump-guest-core'/> + <flag name='seamless-migration'/> + <flag name='block-commit'/> + <flag name='vnc'/> + <flag name='drive-mirror'/> + <flag name='usb-redir.bootindex'/> + <flag name='usb-host.bootindex'/> + <flag name='blockdev-snapshot-sync'/> + <flag name='qxl'/> + <flag name='VGA'/> + <flag name='cirrus-vga'/> + <flag name='vmware-svga'/> + <flag name='device-video-primary'/> + <flag name='usb-serial'/> + <flag name='usb-net'/> + <flag name='add-fd'/> + <flag name='nbd-server'/> + <flag name='virtio-rng'/> + <flag name='rng-random'/> + <flag name='rng-egd'/> + <flag name='dtb'/> + <flag name='megasas'/> + <flag name='ipv6-migration'/> + <flag name='machine-opt'/> + <flag name='machine-usb-opt'/> + <flag name='tpm-passthrough'/> + <flag name='tpm-tis'/> + <flag name='pci-bridge'/> + <flag name='vfio-pci'/> + <flag name='vfio-pci.bootindex'/> + <flag name='scsi-generic'/> + <flag name='scsi-generic.bootindex'/> + <flag name='mem-merge'/> + <flag name='vnc-websocket'/> + <flag name='drive-discard'/> + <flag name='mlock'/> + <flag name='vnc-share-policy'/> + <flag name='device-del-event'/> + <flag name='dmi-to-pci-bridge'/> + <flag name='i440fx-pci-hole64-size'/> + <flag name='q35-pci-hole64-size'/> + <flag name='usb-storage'/> + <flag name='usb-storage.removable'/> + <flag name='virtio-mmio'/> + <flag name='ich9-intel-hda'/> + <flag name='kvm-pit-lost-tick-policy'/> + <flag name='boot-strict'/> + <flag name='pvpanic'/> + <flag name='spice-file-xfer-disable'/> + <flag name='spiceport'/> + <flag name='usb-kbd'/> + <flag name='host-pci-multidomain'/> + <flag name='msg-timestamp'/> + <flag name='active-commit'/> + <flag name='change-backing-file'/> + <flag name='memory-backend-ram'/> + <flag name='numa'/> + <flag name='memory-backend-file'/> + <flag name='usb-audio'/> + <flag name='rtc-reset-reinjection'/> + <flag name='splash-timeout'/> + <flag name='iothread'/> + <flag name='migrate-rdma'/> + <flag name='ivshmem'/> + <flag name='drive-iotune-max'/> + <flag name='VGA.vgamem_mb'/> + <flag name='vmware-svga.vgamem_mb'/> + <flag name='qxl.vgamem_mb'/> + <flag name='pc-dimm'/> + <flag name='machine-vmport-opt'/> + <flag name='aes-key-wrap'/> + <flag name='dea-key-wrap'/> + <flag name='pci-serial'/> + <flag name='vhost-user-multiqueue'/> + <flag name='migration-event'/> + <flag name='ioh3420'/> + <flag name='x3130-upstream'/> + <flag name='xio3130-downstream'/> + <flag name='rtl8139'/> + <flag name='e1000'/> + <flag name='virtio-net'/> + <flag name='gic-version'/> + <flag name='incoming-defer'/> + <flag name='virtio-gpu'/> + <flag name='virtio-gpu.virgl'/> + <flag name='virtio-keyboard'/> + <flag name='virtio-mouse'/> + <flag name='virtio-tablet'/> + <flag name='virtio-input-host'/> + <flag name='chardev-file-append'/> + <flag name='ich9-disable-s3'/> + <flag name='ich9-disable-s4'/> + <flag name='vserport-change-event'/> + <flag name='virtio-balloon-pci.deflate-on-oom'/> + <flag name='mptsas1068'/> + <flag name='qxl.vram64_size_mb'/> + <flag name='chardev-logfile'/> + <flag name='debug-threads'/> + <flag name='secret'/> + <flag name='pxb'/> + <flag name='pxb-pcie'/> + <flag name='device-tray-moved-event'/> + <flag name='nec-usb-xhci-ports'/> + <flag name='virtio-scsi-pci.iothread'/> + <flag name='name-guest'/> + <flag name='qxl.max_outputs'/> + <flag name='spice-unix'/> + <flag name='drive-detect-zeroes'/> + <flag name='tls-creds-x509'/> + <flag name='display'/> + <flag name='intel-iommu'/> + <flag name='smm'/> + <flag name='virtio-pci-disable-legacy'/> + <flag name='query-hotpluggable-cpus'/> + <flag name='virtio-net.rx_queue_size'/> + <flag name='virtio-vga'/> + <flag name='drive-iotune-max-length'/> + <flag name='ivshmem-plain'/> + <flag name='ivshmem-doorbell'/> + <flag name='query-qmp-schema'/> + <flag name='gluster.debug_level'/> + <flag name='vhost-scsi'/> + <flag name='drive-iotune-group'/> + <flag name='query-cpu-model-expansion'/> + <flag name='virtio-net.host_mtu'/> + <flag name='nvdimm'/> + <flag name='pcie-root-port'/> + <flag name='query-cpu-definitions'/> + <flag name='block-write-threshold'/> + <flag name='query-named-block-nodes'/> + <flag name='cpu-cache'/> + <flag name='qemu-xhci'/> + <flag name='kernel-irqchip'/> + <flag name='kernel-irqchip.split'/> + <flag name='intel-iommu.intremap'/> + <flag name='intel-iommu.caching-mode'/> + <flag name='intel-iommu.eim'/> + <flag name='intel-iommu.device-iotlb'/> + <flag name='virtio.iommu_platform'/> + <flag name='virtio.ats'/> + <flag name='loadparm'/> + <flag name='vnc-multi-servers'/> + <flag name='virtio-net.tx_queue_size'/> + <flag name='chardev-reconnect'/> + <flag name='virtio-gpu.max_outputs'/> + <flag name='vxhs'/> + <flag name='virtio-blk.num-queues'/> + <flag name='vmcoreinfo'/> + <flag name='numa.dist'/> + <flag name='disk-share-rw'/> + <flag name='iscsi.password-secret'/> + <flag name='isa-serial'/> + <flag name='dump-completed'/> + <flag name='hda-output'/> + <flag name='blockdev'/> + <flag name='blockdev-hostdev-scsi'/> + </qemuCaps> + <devices> + <device alias='rng0'/> + <device alias='sound0-codec0'/> + <device alias='virtio-disk1'/> + <device alias='virtio-serial0'/> + <device alias='video0'/> + <device alias='serial0'/> + <device alias='sound0'/> + <device alias='balloon0'/> + <device alias='channel1'/> + <device alias='channel0'/> + <device alias='net0'/> + <device alias='input0'/> + <device alias='redir0'/> + <device alias='redir1'/> + <device alias='scsi0'/> + <device alias='usb'/> + <device alias='ide0-0-0'/> + </devices> + <numad nodeset='6' cpuset='0-7'/> + <libDir path='/var/lib/libvirt/qemu/domain-1-upstream'/> + <channelTargetDir path='/var/lib/libvirt/qemu/channel/target/domain-1-upstream'/> + <memoryBackingDir path='/var/lib/libvirt/qemu/ram/1-upstream'/> + <chardevStdioLogd/> + <nodename index='123'/> + <fdset index='321'/> + <blockjobs active='no'/> + <agentTimeout>-2</agentTimeout> + <domain type='kvm' id='1'> + <name>upstream</name> + <uuid>dcf47dbd-46d1-4d5b-b442-262a806a333a</uuid> + <memory unit='KiB'>1024000</memory> + <currentMemory unit='KiB'>1024000</currentMemory> + <memoryBacking> + <access mode='shared'/> + </memoryBacking> + <vcpu placement='auto' current='2'>8</vcpu> + <numatune> + <memory mode='strict' placement='auto'/> + </numatune> + <resource> + <partition>/machine</partition> + </resource> + <os> + <type arch='x86_64' machine='pc-i440fx-2.9'>hvm</type> + <boot dev='hd'/> + <bootmenu enable='yes'/> + </os> + <features> + <acpi/> + <apic/> + <vmport state='off'/> + </features> + <cpu> + <numa> + <cell id='0' cpus='0,2,4,6' memory='512000' unit='KiB'/> + <cell id='1' cpus='1,3,5,7' memory='512000' unit='KiB'/> + </numa> + </cpu> + <clock offset='utc'> + <timer name='rtc' tickpolicy='catchup'/> + <timer name='pit' tickpolicy='delay'/> + <timer name='hpet' present='no'/> + </clock> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>restart</on_crash> + <pm> + <suspend-to-mem enabled='no'/> + <suspend-to-disk enabled='no'/> + </pm> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='qcow2' discard='unmap' detect_zeroes='on'/> + <source file='/var/lib/libvirt/images/a.qcow2'/> + <target dev='vdb' bus='virtio'/> + <alias name='virtio-disk1'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x0b' function='0x0'/> + </disk> + <controller type='usb' index='0' model='ich9-ehci1'> + <alias name='usb'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x7'/> + </controller> + <controller type='usb' index='0' model='ich9-uhci1'> + <alias name='usb'/> + <master startport='0'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0' multifunction='on'/> + </controller> + <controller type='usb' index='0' model='ich9-uhci2'> + <alias name='usb'/> + <master startport='2'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x1'/> + </controller> + <controller type='usb' index='0' model='ich9-uhci3'> + <alias name='usb'/> + <master startport='4'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x2'/> + </controller> + <controller type='pci' index='0' model='pci-root'> + <alias name='pci.0'/> + </controller> + <controller type='virtio-serial' index='0'> + <alias name='virtio-serial0'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> + </controller> + <controller type='ide' index='0'> + <alias name='ide'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/> + </controller> + <controller type='scsi' index='0' model='lsilogic'> + <alias name='scsi0'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x09' function='0x0'/> + </controller> + <controller type='fdc' index='0'> + <alias name='fdc0'/> + </controller> + <filesystem type='mount' accessmode='passthrough'> + <driver type='virtiofs'/> + <binary path='/usr/libexec/virtiofsd' caps='0-1'/> + <source dir='/tmp/fs'/> + <target dir='mount_tag'/> + <alias name='fs0'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x0a' function='0x0'/> + </filesystem> + <interface type='network'> + <mac address='52:54:00:36:bd:3b'/> + <source network='default'/> + <actual type='network'> + <source bridge='virbr0'/> + </actual> + <target dev='vnet0'/> + <model type='virtio'/> + <alias name='net0'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <serial type='pty'> + <source path='/dev/pts/67'/> + <target type='isa-serial' port='0'> + <model name='isa-serial'/> + </target> + <alias name='serial0'/> + </serial> + <console type='pty' tty='/dev/pts/67'> + <source path='/dev/pts/67'/> + <target type='serial' port='0'/> + <alias name='serial0'/> + </console> + <channel type='unix'> + <source mode='bind' path='/var/lib/libvirt/qemu/channel/target/domain-1-upstream/org.qemu.guest_agent.0'/> + <target type='virtio' name='org.qemu.guest_agent.0' state='disconnected'/> + <alias name='channel0'/> + <address type='virtio-serial' controller='0' bus='0' port='1'/> + </channel> + <channel type='spicevmc'> + <target type='virtio' name='com.redhat.spice.0' state='disconnected'/> + <alias name='channel1'/> + <address type='virtio-serial' controller='0' bus='0' port='2'/> + </channel> + <input type='tablet' bus='usb'> + <alias name='input0'/> + <address type='usb' bus='0' port='1'/> + </input> + <input type='mouse' bus='ps2'> + <alias name='input1'/> + </input> + <input type='keyboard' bus='ps2'> + <alias name='input2'/> + </input> + <graphics type='spice' port='5900' autoport='yes' listen='127.0.0.1'> + <listen type='address' address='127.0.0.1' fromConfig='1' autoGenerated='no'/> + <image compression='off'/> + </graphics> + <sound model='ich6'> + <alias name='sound0'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </sound> + <audio id='1' type='spice'/> + <video> + <model type='qxl' ram='65536' vram='65536' vgamem='16384' heads='1' primary='yes'/> + <alias name='video0'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </video> + <memballoon model='virtio'> + <alias name='balloon0'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> + </memballoon> + <rng model='virtio'> + <backend model='random'>/dev/random</backend> + <alias name='rng0'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> + </rng> + </devices> + <seclabel type='dynamic' model='dac' relabel='yes'> + <label>+0:+0</label> + <imagelabel>+0:+0</imagelabel> + </seclabel> + </domain> +</domstatus> diff --git a/tests/qemustatusxml2xmldata/virtiofs-out.xml b/tests/qemustatusxml2xmldata/virtiofs-out.xml new file mode 120000 index 0000000000..dc4b4e0f5f --- /dev/null +++ b/tests/qemustatusxml2xmldata/virtiofs-out.xml @@ -0,0 +1 @@ +virtiofs-in.xml \ No newline at end of file diff --git a/tests/qemuxmlactivetest.c b/tests/qemuxmlactivetest.c index c3609e9459..2c12b9a379 100644 --- a/tests/qemuxmlactivetest.c +++ b/tests/qemuxmlactivetest.c @@ -278,6 +278,8 @@ mymain(void) DO_TEST_STATUS("qcow2-data-file"); + DO_TEST_STATUS("virtiofs"); + /* These test cases capture situation where the 'device' attribute of a * virtio video device is missing and thus needs to be inferred from the * available capabilities when an upgraded libvirt is started */ -- 2.56.0

2 1

[RFC] logrotate: add policy for virtqemud.log
by partha.satapathy＠oracle.com 14 Oct '26

14 Oct '26

# Enable full debug logging for monolithic libvirtd # tail /etc/libvirt/libvirtd.conf log_level = 1 log_filters="1:*" log_outputs="1:file:/var/log/libvirt/libvirtd.log" # Enable full debug logging for modular QEMU daemon # tail /etc/libvirt/virtqemud.conf log_level = 1 log_filters="1:*" log_outputs="1:file:/var/log/libvirt/virtqemud.log" # Restart only the daemon architecture currently in use systemctl restart libvirtd.service # monolithic mode # OR systemctl restart virtqemud.service # modular mode In general, use either: libvirtd.service for monolithic mode, or virtqemud plus the appropriate modular supporting daemons for modular mode. /var/log/libvirt/ ├── libvirtd.log # host-wide monolithic daemon log ├── virtqemud.log # host-wide modular QEMU daemon log └── qemu/ ├── vm1.log # VM-specific QEMU process log ├── vm2.log └── ... /var/log/libvirt stores host-level libvirt daemon logs, such as libvirtd.log for monolithic mode or virtqemud.log for modular QEMU mode. The /var/log/libvirt/qemu directory stores VM-specific QEMU logs. Therefore, placing virtqemud.log under /var/log/libvirt is appropriate. The existing logrotate configuration includes /var/log/libvirt/libvirtd.log through /etc/logrotate.d/libvirtd, and all VM-specific log files matching /var/log/libvirt/qemu/*.log through /etc/logrotate.d/libvirtd.qemu. It does not currently include /var/log/libvirt/virtqemud.log; therefore, a separate logrotate rule must be added for virtqemud.log if that log is enabled. We should either place virtqemud.log under /var/log/libvirt/qemu/, which is not appropriate because that directory is intended for VM-specific logs. The virtqemud.log rotation rule can be added to /etc/logrotate.d/libvirtd.qemu, or or define a dedicated logrotate rule in a separate file such as /etc/logrotate.d/virtqemud. Example rule: /var/log/libvirt/virtqemud.log { weekly missingok rotate 4 compress delaycompress copytruncate minsize 100k } This would provide the same log-management behavior for modular virtqemud file logging, that is already available for monolithic libvirtd logging.

2 3

[PATCH 0/5] security: Check if R/O or shared disk is not directory
by Michal Privoznik 14 Oct '26

14 Oct '26

*** BLURB HERE *** Michal Prívozník (5): qemusecuritytest: Introduce new test case security: Check if R/O or shared disk is not directory qemusecuritytest: Add machinery for negative test cases qemusecuritymock: Allow pretending some paths are directories qemusecuritytest: Introduce a test case for cdrom with directory src/security/security_dac.c | 37 +++++++++++++++++++++++++++++++ src/security/security_selinux.c | 37 +++++++++++++++++++++++++++++++ tests/qemusecuritymock.c | 7 +++++- tests/qemusecuritytest.c | 39 +++++++++++++++++++++++++++++---- tests/qemusecuritytest.h | 3 +++ 5 files changed, 118 insertions(+), 5 deletions(-) -- 2.56.0

2 6

[PATCH v3] replace rbd option auth_supported with auth_*_required
by Janis Heims 14 Oct '26

14 Oct '26

As stated in Yusuke Fujimaki's patch, Ceph recently removed the deprecated auth_supported option that is still used by libvirt, causing errors when attempting to start a storage pool on a newer Ceph server: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/RELD… https://github.com/ceph/ceph/commit/350cc71d7d9e9cd6239d24080082de7ac9bf8b70 This patch addresses the issue by replacing the deprecated option with auth_client_required. While all three replacement options (auth_cluster_required, auth_service_required and auth_client_required) were previously set by Ceph, it really only makes sense to keep the last in libvirt as the other options are only relevant on the server side. See the discussion here: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/3TVM… Resolves: https://gitlab.com/libvirt/libvirt/-/work_items/918 Signed-off-by: Janis Heims <janis.heims(a)undertheprinter.com> --- Changes since v2: - Fixed corrupt patch Changes since v1: - Removed auth_cluster_required and auth_service_required src/libxl/libxl_conf.c | 7 +++---- src/libxl/xen_xl.c | 2 +- src/storage/storage_backend_rbd.c | 5 +++-- tests/xlconfigdata/test-rbd-multihost-noauth.cfg | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/src/libxl/libxl_conf.c b/src/libxl/libxl_conf.c index 3bb5c1e591..9050caf400 100644 --- a/src/libxl/libxl_conf.c +++ b/src/libxl/libxl_conf.c @@ -1087,11 +1087,10 @@ libxlMakeNetworkDiskSrcStr(virStorageSource *src, if (username) { virBufferEscape(&buf, '\\', ":", ":id=%s", username); - virBufferEscape(&buf, '\\', ":", - ":key=%s:auth_supported=cephx\\;none", - secret); + virBufferEscape(&buf, '\\', ":", ":key=%s", secret); + virBufferAddLit(&buf, ":auth_client_required=cephx\\;none"); } else { - virBufferAddLit(&buf, ":auth_supported=none"); + virBufferAddLit(&buf, ":auth_client_required=none"); } if (src->nhosts > 0) { diff --git a/src/libxl/xen_xl.c b/src/libxl/xen_xl.c index d05972af5b..5a31fc6939 100644 --- a/src/libxl/xen_xl.c +++ b/src/libxl/xen_xl.c @@ -1478,7 +1478,7 @@ xenFormatXLDiskSrcNet(virStorageSource *src) virBufferStrcat(&buf, "rbd:", src->path, NULL); - virBufferAddLit(&buf, ":auth_supported=none"); + virBufferAddLit(&buf, ":auth_client_required=none"); if (src->nhosts > 0) { virBufferAddLit(&buf, ":mon_host="); diff --git a/src/storage/storage_backend_rbd.c b/src/storage/storage_backend_rbd.c index 25cad4a28d..9832a99264 100644 --- a/src/storage/storage_backend_rbd.c +++ b/src/storage/storage_backend_rbd.c @@ -241,7 +241,7 @@ virStorageBackendRBDOpenRADOSConn(virStorageBackendRBDState *ptr, goto cleanup; if (virStorageBackendRBDRADOSConfSet(ptr->cluster, - "auth_supported", "cephx") < 0) + "auth_client_required", "cephx") < 0) goto cleanup; } else { VIR_DEBUG("Not using cephx authorization"); @@ -250,8 +250,9 @@ virStorageBackendRBDOpenRADOSConn(virStorageBackendRBDState *ptr, _("failed to create the RADOS cluster")); goto cleanup; } + if (virStorageBackendRBDRADOSConfSet(ptr->cluster, - "auth_supported", "none") < 0) + "auth_client_required", "none") < 0) goto cleanup; } diff --git a/tests/xlconfigdata/test-rbd-multihost-noauth.cfg b/tests/xlconfigdata/test-rbd-multihost-noauth.cfg index 5906865047..8ff1878885 100644 --- a/tests/xlconfigdata/test-rbd-multihost-noauth.cfg +++ b/tests/xlconfigdata/test-rbd-multihost-noauth.cfg @@ -22,4 +22,4 @@ parallel = "none" serial = "none" builder = "hvm" boot = "d" -disk = [ "format=raw,vdev=hda,access=rw,backendtype=phy,target=/dev/HostVG/XenGuest2", "format=raw,vdev=hdb,access=rw,backendtype=qdisk,target=rbd:pool/image:auth_supported=none:mon_host=mon1.example.org\\:6321\\;mon2.example.org\\:6322\\;mon3.example.org\\:6322" ] +disk = [ "format=raw,vdev=hda,access=rw,backendtype=phy,target=/dev/HostVG/XenGuest2", "format=raw,vdev=hdb,access=rw,backendtype=qdisk,target=rbd:pool/image:auth_client_required=none:mon_host=mon1.example.org\\:6321\\;mon2.example.org\\:6322\\;mon3.example.org\\:6322" ] base-commit: 215fab8ab1d912f6b25e60ab4d2ad59000f2eaff -- 2.54.0

2 1

Restricting what an authenticated remote client can do - access control for TLS/SASL identities?
by Pierre-Samuel LE STANG 14 Oct '26

14 Oct '26

Hello, I am running libvirt on a fleet of hosts which live-migrate guests between each other in peer-to-peer mode, over TLS with client certificates. With peer-to-peer migration, each host must accept incoming libvirt connections from all its peers. Today, once a remote client is authenticated (trusted x509 certificate and/or SASL), it can use the full API. I would like to restrict what a given remote peer is allowed to do, ideally to "receive an incoming migration" only. If I understand correctly, the access control framework cannot be used for remote clients today: - the only shipped access drivers are "none" and "polkit"; - the polkit driver identifies the caller by its local process ID/UID, which is only available for clients connected to the UNIX domain socket, so checks cannot succeed for remote connections; - the documentation [1] still says that the SASL / Kerberos username and/or x509 distinguished name obtained from the authentication provider should be used "in future versions". This wording dates back to the original access control work in 2013, where support for remote identities was listed as future work, and it does not seem to have changed since. So I have a few simple questions: * Is this still on your roadmap, or is somebody working on it? * Was it discussed after 2013? If there is a reason it was not done, I would be happy to understand it. * We can spend time to write and test patches in this area. If you had to do it, which direction would you take? Is there a design you would prefer, or something you would not accept upstream? We would be happy to discuss and agree on a design before starting. [1] https://libvirt.org/aclpolkit.html - "User identity attributes" Thanks, -- Pierre-Samuel Le Stang

1 0

[PATCH v2] replace rbd option auth_supported with auth_*_required
by Janis Heims 13 Oct '26

13 Oct '26

As stated in Yusuke Fujimaki's patch, Ceph recently removed the deprecated auth_supported option that is still used by libvirt, causing errors when attempting to start a storage pool on a newer Ceph server: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/RELD… https://github.com/ceph/ceph/commit/350cc71d7d9e9cd6239d24080082de7ac9bf8b70 This patch addresses the issue by replacing the deprecated option with auth_client_required. While all three replacement options (auth_cluster_required, auth_service_required and auth_client_required) were previously set by Ceph, it really only makes sense to keep the last in libvirt as the other options are only relevant on the server side. See the discussion here: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/3TVM… Resolves: https://gitlab.com/libvirt/libvirt/-/work_items/918 Signed-off-by: Janis Heims <janis.heims(a)undertheprinter.com> --- Changes since v1: - Removed auth_cluster_required and auth_service_required src/libxl/libxl_conf.c | 7 +++---- src/libxl/xen_xl.c | 2 +- src/storage/storage_backend_rbd.c | 6 ++++-- tests/xlconfigdata/test-rbd-multihost-noauth.cfg | 2 +- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/src/libxl/libxl_conf.c b/src/libxl/libxl_conf.c index 3bb5c1e591..9050caf400 100644 --- a/src/libxl/libxl_conf.c +++ b/src/libxl/libxl_conf.c @@ -1087,11 +1087,10 @@ libxlMakeNetworkDiskSrcStr(virStorageSource *src, if (username) { virBufferEscape(&buf, '\\', ":", ":id=%s", username); - virBufferEscape(&buf, '\\', ":", - ":key=%s:auth_supported=cephx\\;none", - secret); + virBufferEscape(&buf, '\\', ":", ":key=%s", secret); + virBufferAddLit(&buf, ":auth_client_required=cephx\\;none"); } else { - virBufferAddLit(&buf, ":auth_supported=none"); + virBufferAddLit(&buf, ":auth_client_required=none"); } if (src->nhosts > 0) { diff --git a/src/libxl/xen_xl.c b/src/libxl/xen_xl.c index d05972af5b..5a31fc6939 100644 --- a/src/libxl/xen_xl.c +++ b/src/libxl/xen_xl.c @@ -1478,7 +1478,7 @@ xenFormatXLDiskSrcNet(virStorageSource *src) virBufferStrcat(&buf, "rbd:", src->path, NULL); - virBufferAddLit(&buf, ":auth_supported=none"); + virBufferAddLit(&buf, ":auth_client_required=none"); if (src->nhosts > 0) { virBufferAddLit(&buf, ":mon_host="); diff --git a/src/storage/storage_backend_rbd.c b/src/storage/storage_backend_rbd.c index 25cad4a28d..64ea11a7f5 100644 --- a/src/storage/storage_backend_rbd.c +++ b/src/storage/storage_backend_rbd.c @@ -241,17 +241,19 @@ virStorageBackendRBDOpenRADOSConn(virStorageBackendRBDState *ptr, goto cleanup; if (virStorageBackendRBDRADOSConfSet(ptr->cluster, - "auth_supported", "cephx") < 0) + "auth_client_required", "cephx") < 0) goto cleanup; } else { VIR_DEBUG("Not using cephx authorization"); if (rados_create(&ptr->cluster, NULL) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("failed to create the RADOS cluster")); goto cleanup; } + if (virStorageBackendRBDRADOSConfSet(ptr->cluster, - "auth_supported", "none") < 0) + "auth_client_required", "none") < 0) goto cleanup; } diff --git a/tests/xlconfigdata/test-rbd-multihost-noauth.cfg b/tests/xlconfigdata/test-rbd-multihost-noauth.cfg index 5906865047..8ff1878885 100644 --- a/tests/xlconfigdata/test-rbd-multihost-noauth.cfg +++ b/tests/xlconfigdata/test-rbd-multihost-noauth.cfg @@ -22,4 +22,4 @@ parallel = "none" serial = "none" builder = "hvm" boot = "d" -disk = [ "format=raw,vdev=hda,access=rw,backendtype=phy,target=/dev/HostVG/XenGuest2", "format=raw,vdev=hdb,access=rw,backendtype=qdisk,target=rbd:pool/image:auth_supported=none:mon_host=mon1.example.org\\:6321\\;mon2.example.org\\:6322\\;mon3.example.org\\:6322" ] +disk = [ "format=raw,vdev=hda,access=rw,backendtype=phy,target=/dev/HostVG/XenGuest2", "format=raw,vdev=hdb,access=rw,backendtype=qdisk,target=rbd:pool/image:auth_client_required=none:mon_host=mon1.example.org\\:6321\\;mon2.example.org\\:6322\\;mon3.example.org\\:6322" ] base-commit: 215fab8ab1d912f6b25e60ab4d2ad59000f2eaff -- 2.54.0

1 0

[PATCH] docs: be more specific about when <ip> can be used in <interface>
by Laine Stump 13 Oct '26

13 Oct '26

A user commented that the documentation was rather vague about when an <ip> address specified in a domain <interface> can be used and when it can't. This extra verbiage attempts to clarify that. Signed-off-by: Laine Stump <laine(a)redhat.com> --- I'm undecided if this is too verbose to be in formatdomain.html, but once I started typing (after reading this message https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/DZWK… ) I decided to finish it and send; if it seems inappropriate there then maybe it can be put somewhere else. Also, I *think* I have the information correct for non QEMU/LXC drivers, but it's based solely on a quick examination of the code (looking for references to "guestIP"). docs/formatdomain.rst | 59 +++++++++++++++++++++++++++++++++++-------- 1 file changed, 48 insertions(+), 11 deletions(-) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index e4eb2d9ba3..2e314b159e 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -6747,17 +6747,54 @@ IP configuration </devices> ... -:since:`Since 1.2.12` network devices and hostdev devices with network -capabilities can optionally be provided one or more IP addresses to set on the -network device in the guest. Note that some hypervisors or network device types -will simply ignore them or only use the first one. The ``family`` attribute can -be set to either ``ipv4`` or ``ipv6``, and the ``address`` attribute contains -the IP address. The optional ``prefix`` is the number of 1 bits in the netmask, -and will be automatically set if not specified - for IPv4 the default prefix is -determined according to the network "class" (A, B, or C - see RFC870), and for -IPv6 the default prefix is 64. The optional ``peer`` attribute holds the IP -address of the other end of a point-to-point network device -:since:`(since 2.1.0)`. +:since:`Since 1.2.12` in some specific instances, network devices and +hostdev devices with network capabilities can optionally be provided +one or more IP addresses to set on the network device in the guest +using the <ip> subelement. Within <ip>, the ``family`` attribute can +be set to either ``ipv4`` or ``ipv6``, and the ``address`` attribute +contains the IP address. The optional ``prefix`` is the number of 1 +bits in the netmask, and will be automatically set if not specified - +for IPv4 the default prefix is determined according to the network +"class" (A, B, or C - see RFC870), and for IPv6 the default prefix +is 64. The optional ``peer`` attribute holds the IP address of the +other end of a point-to-point network device :since:`(since 2.1.0)`. + +As mentioned above, only certain types of interfaces on certain +hypervisors can use the <ip> element. In particular: + +* lxc driver - <interface> or <hostdev mode='capabilities' type='net'> + can have one or more IP addresses specified for each interface, and + this will be directly set on the interface inside the container by + libvirt. + +* QEMU driver - <interface type='user'> and <interface + type='vhostuser'> (the latter only when <backend type='passt'>) can + have a single IPv4 address specified (and for passt-backed + interfaces also a single IPv6 address). In these cases, libvirt will + setup the internal DHCP server of slirp or passt to provide the IP + addresses - the guest OS must have the interface config setup to use + DHCP or the settings in libvirt will be ignored. + +* VirtualBox driver - for <interface type='bridge'> a single IP + address can be set. + +* Cloud Hypervisor driver - for <interface type='ethernet'> a + single IP address can be set. + +* openvz driver - <interface type='ethernet'> can have multiple + IP addresses specified. + +* Xen driver - <interface type='bridge|ethernet'> can have multiple IP + addresses set. + +In all other cases, IP addresses in the libvirt domain interface +config will either be ignored, or generate an error. Aside from this, +for guests connected via libvirt's own bridge-based virtual networks, +it is also possible to set IP addresses with static <host> entries in +the `virtual network's config <formatnetwork.html#addressing>`__. If +none of the above applies to your guest, IP address configuration must +be done outside of libvirt, either by changing the relevant DHCP +server config, or changing the guest OS network config directly. :since:`Since 1.2.12` route elements can also be added to define IP routes to add in the guest. The attributes of this element are -- 2.56.0

2 1

[libvirt PATCH] util: bitmap: fix typo
by Ján Tomko 13 Oct '26

13 Oct '26

From: Ján Tomko <jtomko(a)redhat.com> Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- Pushed as trivial. src/util/virbitmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/virbitmap.c b/src/util/virbitmap.c index b9b737a087..587b3d13fc 100644 --- a/src/util/virbitmap.c +++ b/src/util/virbitmap.c @@ -562,7 +562,7 @@ virBitmapParseUnlimited(const char *str) * empty (or contains just spaces) an empty bitmap is returned instead of an * error. * - * Returns @bitmap on success, or NULL in cas of error + * Returns @bitmap on success, or NULL in case of error */ virBitmap * virBitmapParseUnlimitedAllowEmpty(const char *str) -- 2.56.0

1 0

[PATCH] qemu_driver: fix potential null pointer dereference in qemuConnectCPUModelBaseline()
by Elizaveta Tereshkina 13 Oct '26

13 Oct '26

qemuMonitorGetCPUModelExpansion() may return 0 without assigning a value to model_info if QEMU returns a GenericError. Passing NULL to qemuConnectStealCPUModelFromInfo() can lead to the NULL pointer dereference. Check the result before stealing the CPU model to avoid this. Fixes: aa797c6625 (qemu_driver: expand cpu features after baseline) Signed-off-by: Elizaveta Tereshkina <teryoshkina.ea(a)gmail.com> --- src/qemu/qemu_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index ebf19d7c0f..5922065897 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -12382,7 +12382,7 @@ qemuConnectCPUModelBaseline(virQEMUCaps *qemuCaps, false, false, &result) < 0) return NULL; - if (qemuConnectStealCPUModelFromInfo(baseline, &result) < 0) + if (result && qemuConnectStealCPUModelFromInfo(baseline, &result) < 0) return NULL; } -- 2.43.0

3 4

[PATCH] replace rbd option auth_supported with auth_*_required
by Janis Heims 13 Oct '26

13 Oct '26

As stated in Yusuke Fujimaki's patch, Ceph recently removed the deprecated auth_supported option that is still used by libvirt, causing errors when attempting to start a storage pool on a newer Ceph server: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/RELD… https://github.com/ceph/ceph/commit/350cc71d7d9e9cd6239d24080082de7ac9bf8b70 This patch addresses the issue by replacing the deprecated option with all three new options (auth_cluster_required, auth_service_required and auth_client_required), as was previously done in Ceph. Resolves: https://gitlab.com/libvirt/libvirt/-/work_items/918 Signed-off-by: Janis Heims <janis.heims(a)undertheprinter.com> --- src/libxl/libxl_conf.c | 11 ++++++---- src/libxl/xen_xl.c | 4 +++- src/storage/storage_backend_rbd.c | 22 +++++++++++++++++-- .../test-rbd-multihost-noauth.cfg | 2 +- 4 files changed, 31 insertions(+), 8 deletions(-) diff --git a/src/libxl/libxl_conf.c b/src/libxl/libxl_conf.c index 3bb5c1e591..49f968a857 100644 --- a/src/libxl/libxl_conf.c +++ b/src/libxl/libxl_conf.c @@ -1087,11 +1087,14 @@ libxlMakeNetworkDiskSrcStr(virStorageSource *src, if (username) { virBufferEscape(&buf, '\\', ":", ":id=%s", username); - virBufferEscape(&buf, '\\', ":", - ":key=%s:auth_supported=cephx\\;none", - secret); + virBufferEscape(&buf, '\\', ":", ":key=%s", secret); + virBufferAddLit(&buf, ":auth_cluster_required=cephx"); + virBufferAddLit(&buf, ":auth_service_required=cephx"); + virBufferAddLit(&buf, ":auth_client_required=cephx\\;none"); } else { - virBufferAddLit(&buf, ":auth_supported=none"); + virBufferAddLit(&buf, ":auth_cluster_required=none"); + virBufferAddLit(&buf, ":auth_service_required=none"); + virBufferAddLit(&buf, ":auth_client_required=none"); } if (src->nhosts > 0) { diff --git a/src/libxl/xen_xl.c b/src/libxl/xen_xl.c index d05972af5b..c1ddc7c071 100644 --- a/src/libxl/xen_xl.c +++ b/src/libxl/xen_xl.c @@ -1478,7 +1478,9 @@ xenFormatXLDiskSrcNet(virStorageSource *src) virBufferStrcat(&buf, "rbd:", src->path, NULL); - virBufferAddLit(&buf, ":auth_supported=none"); + virBufferAddLit(&buf, ":auth_cluster_required=none"); + virBufferAddLit(&buf, ":auth_service_required=none"); + virBufferAddLit(&buf, ":auth_client_required=none"); if (src->nhosts > 0) { virBufferAddLit(&buf, ":mon_host="); diff --git a/src/storage/storage_backend_rbd.c b/src/storage/storage_backend_rbd.c index 25cad4a28d..33e644d981 100644 --- a/src/storage/storage_backend_rbd.c +++ b/src/storage/storage_backend_rbd.c @@ -241,17 +241,35 @@ virStorageBackendRBDOpenRADOSConn(virStorageBackendRBDState *ptr, goto cleanup; if (virStorageBackendRBDRADOSConfSet(ptr->cluster, - "auth_supported", "cephx") < 0) + "auth_cluster_required", "cephx") < 0) + goto cleanup; + + if (virStorageBackendRBDRADOSConfSet(ptr->cluster, + "auth_service_required", "cephx") < 0) + goto cleanup; + + if (virStorageBackendRBDRADOSConfSet(ptr->cluster, + "auth_client_required", "cephx") < 0) goto cleanup; } else { VIR_DEBUG("Not using cephx authorization"); + if (rados_create(&ptr->cluster, NULL) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("failed to create the RADOS cluster")); goto cleanup; } + if (virStorageBackendRBDRADOSConfSet(ptr->cluster, - "auth_supported", "none") < 0) + "auth_cluster_required", "none") < 0) + goto cleanup; + + if (virStorageBackendRBDRADOSConfSet(ptr->cluster, + "auth_service_required", "none") < 0) + goto cleanup; + + if (virStorageBackendRBDRADOSConfSet(ptr->cluster, + "auth_client_required", "none") < 0) goto cleanup; } diff --git a/tests/xlconfigdata/test-rbd-multihost-noauth.cfg b/tests/xlconfigdata/test-rbd-multihost-noauth.cfg index 5906865047..b149be077c 100644 --- a/tests/xlconfigdata/test-rbd-multihost-noauth.cfg +++ b/tests/xlconfigdata/test-rbd-multihost-noauth.cfg @@ -22,4 +22,4 @@ parallel = "none" serial = "none" builder = "hvm" boot = "d" -disk = [ "format=raw,vdev=hda,access=rw,backendtype=phy,target=/dev/HostVG/XenGuest2", "format=raw,vdev=hdb,access=rw,backendtype=qdisk,target=rbd:pool/image:auth_supported=none:mon_host=mon1.example.org\\:6321\\;mon2.example.org\\:6322\\;mon3.example.org\\:6322" ] +disk = [ "format=raw,vdev=hda,access=rw,backendtype=phy,target=/dev/HostVG/XenGuest2", "format=raw,vdev=hdb,access=rw,backendtype=qdisk,target=rbd:pool/image:auth_cluster_required=none:auth_service_required=none:auth_client_required=none:mon_host=mon1.example.org\\:6321\\;mon2.example.org\\:6322\\;mon3.example.org\\:6322" ] base-commit: 215fab8ab1d912f6b25e60ab4d2ad59000f2eaff -- 2.54.0

2 3

Why can MAC and VLAN be set on <interface type='hostdev'>, but not an IP address?
by sst11336677＠gmail.com 12 Oct '26

12 Oct '26

Hi, I am using <interface type='hostdev'> to assign SR-IOV VFs to QEMU/KVM guests. libvirt lets me set the MAC address and the VLAN tag on that element, but there is no way to set an IP address. I would like to know which of these is the case: (a) libvirt cannot set it. The guest's IP address lives in the guest's own network stack, and with VFIO the host is not in the data path, so there is nothing host-side that could apply it. (b) libvirt could set it, but it has simply never been implemented. I believe the answer is (a), because the <ip> element was added to <hostdev mode='capabilities' type='net'> only for the LXC case, where the host owns the container's network namespace: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/6OH… But I would like that confirmed rather than inferred. If it is (a), would you consider saying so in the documentation? The hostdev interface section of formatdomain does not mention IP addresses at all, so there is nothing telling a reader that this is out of scope by design, or pointing them at the alternatives (a DHCP reservation keyed to the MAC that libvirt already sets, cloud-init, or the guest agent). Thanks,

2 1

Add WebKVM to the "Applications using libvirt" page
by Alvin Enrique Perez Perdomo 12 Oct '26

12 Oct '26

Hello Libvirt developers, I have developed an open-source web interface for managing QEMU/KVM virtual machines called WebKVM, and I would love to propose adding it to the "Applications using libvirt" page on the official website. Project Details: Name: WebKVM Description: A lightweight, web-based management interface for QEMU/KVM built in Go. It connects directly to the standard libvirt daemon (qemu:///system) via the native libvirt Go bindings, offering domain management, resource metrics, storage/network visibility, and browser-based consoles (noVNC, SPICE, RDP, and serial). Repository: https://github.com/Slaker19/webkvm License: Open Source (GPLv3) Please let me know if WebKVM qualifies to be listed on the page, or if you prefer me to submit a patch / GitLab Merge Request against the documentation repository directly. Thank you for your time and for maintaining such a great ecosystem. Best regards, Alvin (Slaker19)

2 1

[PATCH 0/6] add LoongArch host model support
by Xianglai Li 10 Oct '26

10 Oct '26

Hi all, This patch series adds host model support for LoongArch. The current approach is to read cpucfg information from the physical machine and use it together with the CPU model information and feature information in the XML file to jointly determine which CPU features need to be enabled for the host model. The specific policy is as follows: features supported by both the physical machine and the CPU model in the XML file are enabled; otherwise, they are disabled. Features that exist in feature.xml but are not mentioned by either the physical machine's cpucfg or the CPU model in the XML file are also set to disabled. Cc: Bibo Mao <maobibo(a)loongson.cn> Xianglai Li (6): cpu_map: add LoongArch CPU map XML files cpu: add LoongArch CPU vendor parsing cpu: add LoongArch CPU feature parsing cpu: add LoongArch CPU model parsing cpu: add LoongArch CPU decode support cpu: add LoongArch host model support po/POTFILES | 1 + src/cpu/cpu.h | 2 + src/cpu/cpu_loongarch.c | 645 ++++++++++++++++++++++++++++- src/cpu/cpu_loongarch_data.h | 34 ++ src/cpu_map/index.xml | 13 + src/cpu_map/loongarch_features.xml | 26 ++ src/cpu_map/loongarch_la464.xml | 10 + src/cpu_map/loongarch_la664.xml | 11 + src/cpu_map/loongarch_vendors.xml | 3 + src/cpu_map/meson.build | 4 + src/qemu/qemu_capabilities.c | 2 +- 11 files changed, 745 insertions(+), 6 deletions(-) create mode 100644 src/cpu/cpu_loongarch_data.h create mode 100644 src/cpu_map/loongarch_features.xml create mode 100644 src/cpu_map/loongarch_la464.xml create mode 100644 src/cpu_map/loongarch_la664.xml create mode 100644 src/cpu_map/loongarch_vendors.xml -- 2.39.1

1 6

[PATCH] qemu: allow for 15 subordinate pci controllers under each pcie-expander-bus
by Laine Stump 08 Oct '26

08 Oct '26

From: Laine Stump <laine(a)redhat.com> A guest was created with PCIe bus and 2 PCIe devices attached to two separate pcie-root-ports that were themselves attached to a pcie-expander-bus. This guest was unable to boot from the 2nd device on the pcie-expander-bus. It turns out this failure was because not enough "bus numbers" were reserved for the pcie-expander-bus in the configuration, and this led to a failure of the system firmware to initialize those devices properly. Background: Each pci[e]-expander-bus has a busNr attribute that can be optionally specified in the <target> subelement; it defines the bus number of the expander bus itself. Any pci controller attached to that expander bus is then assigned a bus number between busNr+1 and the busNr of the next higher expander bus (or 255, if there are no expander buses with a higher busNr. The pci-root (or pcie-root) bus is bus number 0, and any pci controller attached to that bus (or its subordinate buses *except for pci[e]-expander-buses*) will be automatically numbered starting at 1, and continuing up until the lowest numbered expander bus. When libvirt originally added support for the pci-expander-bus, each pci-expander-bus' busNr was initialized by default to be the busNr of the current lowest expander bus - 2 (reserving one for the pci-expander-bus itself, and one for the implicit pci-bridge that is always added (by qemu) along with the pci-expander-bus). When pcie-expander-bus support was added, this logic was left untouched, but that is incorrect - a hotplug-supporting PCIe topology requires that each device have its own pcie-root-port, and so adding multiple hotpluggable devices to a pcie-expander-bus uses up one bus number for each device. So, the solution to the original problem is to just lower the busNr of each pcie-expander-bus by 16 (rather than 2) from the previous. This allows connection of up to 15 pcie-root-port controllers (and thus 15 hotpluggable endpoint devices) to each pcie-expander bus with the default setting of busNr. Resolves: https://redhat.atlassian.net/browse/RHEL-144343 Signed-off-by: Laine Stump <laine(a)redhat.com> -- Note that I could have chosen 32 or 8 or any other number, and no matter which I chose it would be likely to not work for *somebody*. Anyway, if this scheme ever doesn't work out, manual intervention is always possible, either by manually setting busNr, or by putting multiple endpoint devices on different functions of the same pcie-root-port (which is completely unproblematic if the device will never be unplugged at runtime). Signed-off-by: Laine Stump <laine(a)redhat.com> --- src/qemu/qemu_domain_address.c | 85 ++++++++++++------- ...e-expander-bus-aarch64.aarch64-latest.args | 2 +- ...ie-expander-bus-aarch64.aarch64-latest.xml | 2 +- 3 files changed, 57 insertions(+), 32 deletions(-) diff --git a/src/qemu/qemu_domain_address.c b/src/qemu/qemu_domain_address.c index a8292a9782..81cf34fe86 100644 --- a/src/qemu/qemu_domain_address.c +++ b/src/qemu/qemu_domain_address.c @@ -2567,43 +2567,63 @@ qemuDomainAddressFindNewTargetIndex(virDomainDef *def) static int -qemuDomainAddressFindNewBusNr(virDomainDef *def) +qemuDomainAddressFindNewBusNr(virDomainDef *def, + virDomainControllerModelPCI model) { /* Try to find a nice default for busNr for a new pci-expander-bus. * This is a bit tricky, since you need to satisfy the following: * - * 1) There need to be enough unused bus numbers between busNr of this - * bus and busNr of the next highest bus for the guest to assign a - * unique bus number to each PCI bus that is a child of this - * bus. Each PCI controller. On top of this, the pxb device (which - * implements the pci-expander-bus) includes a pci-bridge within - * it, and that bridge also uses one bus number (so each pxb device - * requires at least 2 bus numbers). + * 1) There need to be enough unused bus numbers between busNr of + * this bus and busNr of the next highest bus for the guest to + * assign a unique bus number to each PCI bus that is a child + * of this bus. * * 2) There need to be enough bus numbers *below* this for all the - * child controllers of the pci-expander-bus with the next lower + * child controllers of the pci[e]-expander-bus with the next lower * busNr (or the pci-root bus if there are no lower - * pci-expander-buses). + * pci[e]-expander-buses). * * 3) If at all possible, we want to avoid needing to change the busNr * of a bus in the future, as that changes the guest's device ABI, * which could potentially lead to issues with a guest OS that is * picky about such things. * - * Due to the impossibility of predicting what might be added to the - * config in the future, we can't make a foolproof choice, but since - * a pci-expander-bus (pxb) has slots for 32 devices, and the only - * practical use for it is to assign real devices on a particular - * NUMA node in the host, it's reasonably safe to assume it should - * never need any additional child buses (probably only a few of the - * 32 will ever be used). So for pci-expander-bus we find the lowest - * existing busNr, and set this one to the current lowest - 2 (one - * for the pxb, one for the integrated pci-bridge), thus leaving the - * maximum possible bus numbers available for other buses plugged - * into pci-root (i.e. pci-bridges and other - * pci-expander-buses). Anyone who needs more than 32 devices - * descended from one pci-expander-bus should set the busNr manually - * in the config. + * Due to the impossibility of predicting what might be added to + * the config in the future, we can't make a foolproof choice, + * and the parameters are different for a pci-expander-bus and a + * pcie-expander-bus. + * + * pci-expander-bus: the pxb device (which implements the + * pci-expander-bus) includes a pci-bridge within it, and that + * bridge uuses one bus number, so each pxb device requires at + * least 2 bus numbers. That bridge has slots for 32 devices, and + * its only practical use is to assign real physical devices on a + * particular NUMA node in the host. It's reasonably safe to + * assume no guest should never have more than 32 physical + * devices on a single NUMA node that need to be assigned to a + * guest (probably only a few of the 32 will ever be used), and + * so we shouldn't need more than 2 bus numbers for each + * pci-expander-bus. So we find the lowest existing busNr, and + * set busNr of the new pci-expander-bus to that value - + * 2. Anyone who needs more than 32 devices descended from one + * pci-expander-bus should set the busNr manually in the config. + * + * pcie-expander-bus: this is (as you'd expect) a more + * complicated story - if you want to support hotplugging on a + * pcie based machinetype, then each endpoint device needs its + * own pcie-root-port, and each root port uses up one bus number + * in the range available to its parent pcie-expander-bus. Taking + * a very generous example of a guest that has 8 GPUs, 8 NICs, + * and 8 NVME drives split between two NUMA nodes, giving 16 bus + * numbers to each pcie-expander-bus gives plenty of bus number + * space for all the controllers needed for each device in this + * extreme config, while still leaving plenty of overhead for 1) + * lots of devices on NUMA node 0 and 2) more than 2 NUMA nodes + * in the unlikely case that someone was forced to create a guest + * with more than 2 NUMA nodes. Again, if someone has a config + * more extreme than this, they should just set busNr manually + * (after all, the pci addresses of all these devices are already + * all being set manually, so that shouldn't be a huge burden). * * There is room for more error checking here - in particular we * can/should determine the ultimate parent (root-bus) of each PCI @@ -2614,6 +2634,10 @@ qemuDomainAddressFindNewBusNr(virDomainDef *def) size_t i; int lowestBusNr = 256; + int maxChildControllers = 1; /* default for pci-expander-bus */ + + if (model == VIR_DOMAIN_CONTROLLER_MODEL_PCIE_EXPANDER_BUS) + maxChildControllers = 15; for (i = 0; i < def->ncontrollers; i++) { virDomainControllerDef *cont = def->controllers[i]; @@ -2626,14 +2650,15 @@ qemuDomainAddressFindNewBusNr(virDomainDef *def) } } - /* If we already have a busNR = 1, then we can't auto-assign (0 is - * the pci[e]-root, and the others may have been assigned - * purposefully). + /* If we already have a controller with busNR <= + * maxChildControllers+1, then we can't auto-assign busNr to this + * new expander bus (0 is the pci[e]-root, and the others may have + * been assigned purposefully). */ - if (lowestBusNr <= 2) + if (lowestBusNr <= (maxChildControllers + 1)) return -1; - return lowestBusNr - 2; + return lowestBusNr - (maxChildControllers + 1); } @@ -2877,7 +2902,7 @@ qemuDomainAssignPCIAddresses(virDomainDef *def, case VIR_DOMAIN_CONTROLLER_MODEL_PCI_EXPANDER_BUS: case VIR_DOMAIN_CONTROLLER_MODEL_PCIE_EXPANDER_BUS: if (options->busNr == -1) - options->busNr = qemuDomainAddressFindNewBusNr(def); + options->busNr = qemuDomainAddressFindNewBusNr(def, cont->model); if (options->busNr == -1) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("No free busNr lower than current lowest busNr is available to auto-assign to bus %1$d. Must be manually assigned"), diff --git a/tests/qemuxmlconfdata/pcie-expander-bus-aarch64.aarch64-latest.args b/tests/qemuxmlconfdata/pcie-expander-bus-aarch64.aarch64-latest.args index e76510dbbb..52011865a0 100644 --- a/tests/qemuxmlconfdata/pcie-expander-bus-aarch64.aarch64-latest.args +++ b/tests/qemuxmlconfdata/pcie-expander-bus-aarch64.aarch64-latest.args @@ -25,7 +25,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-pcie-expander-bus-te/.config \ -rtc base=utc \ -no-shutdown \ -boot strict=on \ --device '{"driver":"pxb-pcie","bus_nr":254,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ +-device '{"driver":"pxb-pcie","bus_nr":240,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ -audiodev '{"id":"audio1","driver":"none"}' \ -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ -msg timestamp=on diff --git a/tests/qemuxmlconfdata/pcie-expander-bus-aarch64.aarch64-latest.xml b/tests/qemuxmlconfdata/pcie-expander-bus-aarch64.aarch64-latest.xml index ce88da574f..0d0cac7653 100644 --- a/tests/qemuxmlconfdata/pcie-expander-bus-aarch64.aarch64-latest.xml +++ b/tests/qemuxmlconfdata/pcie-expander-bus-aarch64.aarch64-latest.xml @@ -20,7 +20,7 @@ <controller type='pci' index='0' model='pcie-root'/> <controller type='pci' index='1' model='pcie-expander-bus'> <model name='pxb-pcie'/> - <target busNr='254'/> + <target busNr='240'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </controller> <audio id='1' type='none'/> -- 2.55.0

3 4

[PATCH 0/9] bhyve: session mode support
by Roman Bogorodskiy 08 Oct '26

08 Oct '26

This series implements user session support (bhyve:///session) for the bhyve driver. Roman Bogorodskiy (9): bhyve: move paths to driver configuration bhyve: capabilities: probe monitor mode support bhyve: initial unprivileged mode support bhyve: implement virDomainReset() bhyve: implement process management for monitor mode bhyve: implement reconnect for unprivileged mode bhyve: cleanup IPC sockets bhyve: bhyvexml2argvtest: test unprivileged mode docs: drvbhyve: document session mode docs/drvbhyve.rst | 24 ++- src/bhyve/bhyve_capabilities.c | 29 +++ src/bhyve/bhyve_capabilities.h | 2 + src/bhyve/bhyve_command.c | 32 +++ src/bhyve/bhyve_command.h | 6 + src/bhyve/bhyve_conf.c | 47 +++- src/bhyve/bhyve_conf.h | 2 +- src/bhyve/bhyve_domain.c | 30 ++- src/bhyve/bhyve_domain.h | 4 +- src/bhyve/bhyve_driver.c | 173 ++++++++++----- src/bhyve/bhyve_process.c | 201 ++++++++++++++---- src/bhyve/bhyve_process.h | 5 + src/bhyve/bhyve_utils.h | 13 +- .../bhyvexml2argv-uefi-unprivileged.args | 14 ++ tests/bhyvexml2argvtest.c | 35 ++- tests/bhyvexml2xmltest.c | 4 +- 16 files changed, 506 insertions(+), 115 deletions(-) create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-uefi-unprivileged.args -- 2.55.0

2 13

[PATCH v3 00/10] conf, qemu: Add scalable_mode, fsts, pasid_bits, and svm support for intel-iommu
by Zhenzhong Duan 08 Oct '26

08 Oct '26

Hi, This series adds support for configuring Intel vIOMMU (VT-d) in domain XML and formatting them onto the QEMU command line: * scalable_mode: Configures scalable mode support ('on'/'off'). * fsts: Enables First-Stage Translation support ('on'/'off'). * pasid_bits: Sets the number of supported PASID bits. * svm: Enables Shared Virtual Memory (SVM) / PRQ support ('on'/'off'). With these attributes, users can configure advanced vIOMMU features for both emulated devices and assigned host devices (e.g., vSVA / nested translation via iommufd and first-stage translation). Example domain XML configuration: <iommu model='intel'> <driver caching_mode='on' iotlb='on' scalable_mode='on' fsts='on' pasid_bits='6' svm='on'/> </iommu> Which formats the following QEMU command line options: -device {"driver":"intel-iommu","id":"iommu0","caching-mode":true,"device-iotlb":true,"scalable-mode":true,"fsts":true,"pasid-bits":6,"svm":true} Testing: - Validated with libvirt test suite (ninja test). - Tested DSA card passthrough and SVM/vSVA with iommufd backend. Changelog: v3: - merge qemu patch into conf patch (Peter Krempa) - fix pasid_bits type definition (Peter Krempa) - fix doc to use 'pasid_bits' rather than 'pasid-bits' (Peter Krempa) - add patch10 to print attribute name in error message (Peter Krempa) - add patch5 for missing validations v2: - Added support for 'pasid_bits' and 'svm' attributes. - rebased to master branch newest Thanks, Zhenzhong Zhenzhong Duan (10): qemu_capabilities: Introduce QEMU_CAPS_INTEL_IOMMU_SCALABLE_MODE qemu: Add scalable_mode attribute to iommu qemu_capabilities: Introduce QEMU_CAPS_INTEL_IOMMU_FSTS qemu: Add fsts attribute to iommu qemu: Validate PCI hostdev assignment against intel-iommu 'fsts' qemu_capabilities: Introduce QEMU_CAPS_INTEL_IOMMU_PASID_BITS qemu: add pasid_bits attribute to iommu qemu_capabilities: Introduce QEMU_CAPS_INTEL_IOMMU_SVM qemu: add svm attribute to iommu conf: qemu: Standardize IOMMU error messages to use XML attribute names docs/formatdomain.rst | 19 +++ src/conf/domain_conf.c | 120 +++++++++++++++--- src/conf/domain_conf.h | 7 + src/conf/domain_validate.c | 55 +++++++- src/conf/schemas/domaincommon.rng | 20 +++ src/libvirt_private.syms | 1 + src/qemu/qemu_capabilities.c | 10 ++ src/qemu/qemu_capabilities.h | 6 + src/qemu/qemu_command.c | 4 + src/qemu/qemu_validate.c | 59 +++++++-- .../caps_11.0.0_x86_64+sgx.xml | 1 + .../caps_11.0.0_x86_64.xml | 1 + .../caps_11.1.0_x86_64.xml | 4 + .../intel-iommu-fsts.x86_64-latest.args | 34 +++++ .../intel-iommu-fsts.x86_64-latest.xml | 37 ++++++ tests/qemuxmlconfdata/intel-iommu-fsts.xml | 37 ++++++ .../intel-iommu-pasid-bits.x86_64-latest.args | 34 +++++ .../intel-iommu-pasid-bits.x86_64-latest.xml | 37 ++++++ .../intel-iommu-pasid-bits.xml | 37 ++++++ ...tel-iommu-scalable-mode.x86_64-latest.args | 34 +++++ ...ntel-iommu-scalable-mode.x86_64-latest.xml | 37 ++++++ .../intel-iommu-scalable-mode.xml | 37 ++++++ .../intel-iommu-svm.x86_64-latest.args | 34 +++++ .../intel-iommu-svm.x86_64-latest.xml | 37 ++++++ tests/qemuxmlconfdata/intel-iommu-svm.xml | 37 ++++++ tests/qemuxmlconftest.c | 4 + 26 files changed, 712 insertions(+), 31 deletions(-) create mode 100644 tests/qemuxmlconfdata/intel-iommu-fsts.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/intel-iommu-fsts.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-fsts.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-pasid-bits.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/intel-iommu-pasid-bits.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-pasid-bits.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-scalable-mode.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/intel-iommu-scalable-mode.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-scalable-mode.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-svm.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/intel-iommu-svm.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-svm.xml -- 2.52.0

2 11