March 2026 - Devel - libvirt List Archives

[PATCH] virt-aa-helper : grant access to unix socket for qgsd
by Hector Cao 18 Mar '26

18 Mar '26

For quote generation and remote attestation, Intel TDX VM communicates with the QGSD (Quote Generation Service) on the host via unix socket. The unix socket can be specified via: <launchSecurity type='tdx'> ... <quoteGenerationService path='/var/run/tdx-qgs/qgs.socket'/> </launchSecurity> in case the path field is omitted, a default path is used. This commit generates the needed rule in the dynamic AA profile for the VM. Signed-off-by: Hector Cao <hector.cao(a)canonical.com> --- src/security/virt-aa-helper.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index e932e79dab..53059ad5fa 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1397,6 +1397,19 @@ get_files(vahControl * ctl) break; case VIR_DOMAIN_LAUNCH_SECURITY_PV: case VIR_DOMAIN_LAUNCH_SECURITY_TDX: + /* To communicate with the QGSD daemon running on the host, if we use the unix socket, + * allow the VM to access to the unix socket. + */ + if (ctl->def->sec->data.tdx.haveQGS) { + const char *qgsd_sock_file = QGS_UNIX_SOCKET_FILE; + if (ctl->def->sec->data.tdx.qgs_unix_path) { + qgsd_sock_file = ctl->def->sec->data.tdx.qgs_unix_path; + } + if (vah_add_file(&buf, qgsd_sock_file, "rw") != 0) { + return -1; + } + } + break; case VIR_DOMAIN_LAUNCH_SECURITY_NONE: case VIR_DOMAIN_LAUNCH_SECURITY_LAST: break; -- 2.43.0

3 3

[PATCH v3 0/1] virt-aa-helper : grant access to unix socket for qgsd
by Hector Cao 18 Mar '26

18 Mar '26

Thanks Daniel for the review, I fixed the indent in the previous mail but realized afterwards that I need to add an other improvement to the patch, even though functionally, the previous patch works. The change is about moving the VIR_DOMAIN_LAUNCH_SECURITY_PV case after VIR_DOMAIN_LAUNCH_SECURITY_TDX block. Hector Cao (1): virt-aa-helper : grant access to unix socket for qgsd src/security/virt-aa-helper.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) -- 2.43.0

1 1

[PATCH 0/5] qemuhotplug: Introduce interface-network-hostdev
by Michal Privoznik 17 Mar '26

17 Mar '26

*** BLURB HERE *** Michal Prívozník (5): tests: Drop WITH_QEMU from qemu specific tests binaries/libraries qemuxmlconftest: Separate fake drivers into a separate file virnetworkportxml2xmldata: Use different PCI address in plug-hostdev-pci.xml qemuhotplugtest: Use fake drivers qemuhotplug: Introduce interface-network-hostdev tests/meson.build | 5 +- tests/qemudomaincheckpointxml2xmltest.c | 31 +- tests/qemudomainsnapshotxml2xmltest.c | 29 +- tests/qemufakedrivers.c | 368 +++++++++++++++ tests/qemufakedrivers.h | 19 + tests/qemuhotplugtest.c | 20 + .../qemuhotplug-interface-network-hostdev.xml | 4 + ...ug-base-live+interface-network-hostdev.xml | 63 +++ tests/qemumemlocktest.c | 25 +- ...-virtio-teaming-network.x86_64-latest.args | 2 +- tests/qemuxmlconftest.c | 443 +++--------------- tests/testutilsqemu.c | 43 +- tests/testutilsqemu.h | 23 +- .../plug-hostdev-pci.xml | 2 +- 14 files changed, 588 insertions(+), 489 deletions(-) create mode 100644 tests/qemufakedrivers.c create mode 100644 tests/qemufakedrivers.h create mode 100644 tests/qemuhotplugtestdevices/qemuhotplug-interface-network-hostdev.xml create mode 100644 tests/qemuhotplugtestdomains/qemuhotplug-base-live+interface-network-hostdev.xml -- 2.52.0

2 7

[PATCH] network: Don't enable ip_forward for VIR_NETWORK_FORWARD_OPEN
by Michal Privoznik 17 Mar '26

17 Mar '26

From: Michal Privoznik <mprivozn(a)redhat.com> For a network that's <forward mode="open"/> there are no firewall rules added. We should not assume that users will configure NAT, and if they do it should be their responsibility to enable IP forwarding too. Resolves: https://gitlab.com/libvirt/libvirt/-/work_items/863 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/network/bridge_driver.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index d50d42c98c..ecfce5d9a4 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -2080,8 +2080,9 @@ networkStartNetworkVirtual(virNetworkDriverState *driver, } } - /* If forward.type != NONE, turn on global IP forwarding */ - if (def->forward.type != VIR_NETWORK_FORWARD_NONE) { + /* If forward.type != NONE and != OPEN, turn on global IP forwarding */ + if (def->forward.type != VIR_NETWORK_FORWARD_NONE && + def->forward.type != VIR_NETWORK_FORWARD_OPEN) { if (v6present && !virNetDevIPCheckIPv6Forwarding()) goto error; /* Precise error message already provided */ -- 2.52.0

2 1

A few questions about libvirt-java
by Takashi Kajinami 17 Mar '26

17 Mar '26

Hi, I've been working in a downstream project using libvirt-java to manage resources in libvirt from our application written in Java. The library has been working well so far, but I'm interested in contributing further improvements of the library, such as; - Replace finalize by more modern mechanisms such as (Auto)Closeable (finalize is deprecated in recent OpenJDK versions) - Complete migration to maven (to get rid of maven-ant-tasks which was already retired) However some of the planned contributions (especially the ones listed above) have relatively large impact and I'd like to ask a few questions so that so that we can drive the effort more smoothly. 1. Do you think that these are good/reasonable improvements ? 2. May I request a new release ? The last release (0.5.3) was released 4 years ago and several changes such as new features have been merged since then. Creating a release allows us to mave backword incompatible changes with less user impact. 3. Can we bump minimum JDK version ? Current minimum JSK version supported by the library is 1.8.0 but this is quite old ELS. I wonder if we can bump it to a newer version such as OpenJDK 17 or even 21. This is required to replace "finalize". Is there requirement about the platform the library should support ? Any feedback or guidance is very much appreciated ! Thank you, Takashi -- Takashi Kajinami irc: tkajinam github: https://github.com/kajinamit launchpad: https://launchpad.net/~kajinamit

2 3

[PATCH 0/3] Random improvements
by Michal Privoznik 17 Mar '26

17 Mar '26

I've noticed an old branch. I've accumulated these while working on the networkxmlconftest. Michal Prívozník (3): src: Drop NULL check before calling virBufferEscapeString() network: Format <ip/> element using virXMLFormatElement() networkxmlconftest: s/fail/cleanup/ src/conf/domain_conf.c | 17 ++-- src/conf/network_conf.c | 87 ++++++++----------- src/conf/node_device_conf.c | 4 +- src/qemu/qemu_domain.c | 16 ++-- .../nat-network-dns-hosts-modified.xml | 3 +- .../nat-network-dns-more-hosts.xml | 3 +- .../nat-network-dns-srv-record.xml | 12 +-- .../nat-network-dns-srv-records.xml | 12 +-- .../nat-network-dns-txt-modify-ok.xml | 12 +-- .../nat-network-dns-txt-none.xml | 12 +-- .../nat-network-dns-txt-records.xml | 12 +-- .../nat-network-forward-ifaces.xml | 12 +-- .../nat-network-host-updated.xml | 12 +-- .../nat-network-hosts.xml | 12 +-- .../nat-network-no-forward-ifaces.xml | 12 +-- .../nat-network-no-hosts.xml | 3 +- .../nat-network-no-range.xml | 12 +-- .../nat-network-one-host.xml | 12 +-- tests/networkxml2xmlupdateout/nat-network.xml | 12 +-- .../dhcp6-nat-network.expect.xml | 6 +- .../nat-network-dns-forward-plain.expect.xml | 3 +- ...network-dns-forwarder-no-resolv.expect.xml | 3 +- .../nat-network-dns-forwarders.expect.xml | 3 +- .../nat-network-dns-hosts.expect.xml | 3 +- .../nat-network-dns-local-domain.expect.xml | 3 +- ...-network-dns-srv-record-minimal.expect.xml | 12 +-- .../nat-network-dns-srv-record.expect.xml | 12 +-- .../nat-network-dns-srv-records.expect.xml | 12 +-- .../nat-network-dns-txt-record.expect.xml | 12 +-- .../nat-network-explicit-flood.expect.xml | 12 +-- ...nat-network-forward-nat-address.expect.xml | 12 +-- .../nat-network-forward-nat-ipv6.expect.xml | 3 +- ...-network-forward-nat-no-address.expect.xml | 12 +-- .../nat-network-mtu.expect.xml | 12 +-- .../nat-network-name-with-quotes.expect.xml | 12 +-- .../networkxmlconfdata/nat-network.expect.xml | 12 +-- .../open-network.expect.xml | 3 +- .../ptr-domains-auto.expect.xml | 12 +-- .../routed-network-no-dns.expect.xml | 3 +- .../routed-network.expect.xml | 3 +- tests/networkxmlconftest.c | 18 ++-- 41 files changed, 167 insertions(+), 293 deletions(-) -- 2.52.0

2 4

[PATCH v3] qemu: Store tapfd path in domstatus XML
by Wesley Hershberger 17 Mar '26

17 Mar '26

Introduce a read-only `tapfd` element for direct interfaces (macvtap), which contains the path to the backing tapfd for that interface (e.g. `/dev/tapXX`). The element is only included when the domain is being formatted for internal consumption (VIR_DOMAIN_DEF_FORMAT_STATUS) and is not accepted in user-provided XML (!VIR_DOMAIN_DEF_PARSE_INACTIVE). This is used by the AppArmor security driver when re-generating profiles. Partial-Resolves: https://gitlab.com/libvirt/libvirt/-/issues/692 Bug-Ubuntu: https://bugs.launchpad.net/bugs/2126574 Signed-off-by: Wesley Hershberger <wesley.hershberger(a)canonical.com> --- Resending this patch as I've not recieved a response on my previous submission. Fixed the bug URL in the commit message as I missed that feedback item on my last mail. This submission is a partial revision of a previous series with a fix for the macvtap component of gitlab#692 [1][2]. I haven't had bandwidth to resolve the blockcommit component since the complexity there is somewhat higher (and is also lower priority for us). I kept the separate `tapfd` element rather than reusing the existing `backend` element (virDomainNetBackend.tap) to avoid making a user-visible change [3]. I'd be happy to use the existing field instead if you think that would make more sense. I opted not to introduce/modify a security driver API for FD+path as the patch here is sufficient to resolve the bug, but would be willing to do so if that would make this change more palatable. I've opened a MR to libvirt-tck with test cases that demonstrate the bugs that this fixes [4]. apparmor/110-macvtap.t passes with this patch applied. Thanks for the reviews and continued consideration. ~Wesley [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/UNNB… [2] https://gitlab.com/libvirt/libvirt/-/issues/692 [3] https://libvirt.org/formatdomain.html#setting-network-backend-specific-opti… [4] https://gitlab.com/libvirt/libvirt-tck/-/merge_requests/73 --- Changes in v3: - Fix buglink in commit message - Link to v2: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/IPEB… Changes in v2: - Drop `virt-aa-helper: Ask for no deny rule...` as it was applied - Drop `qemu: Store blockcommit permissions...` due to unresolved concerns - Pass tapfd path through netdef instead of resolving from fd - Link to v1: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/UNNB… --- src/conf/domain_conf.c | 8 ++++++++ src/conf/domain_conf.h | 1 + src/hypervisor/domain_interface.c | 2 +- src/lxc/lxc_process.c | 1 + src/qemu/qemu_interface.c | 1 + src/security/security_apparmor.c | 1 + src/security/virt-aa-helper.c | 5 +++++ src/util/virnetdevmacvlan.c | 18 +++++++++++------- src/util/virnetdevmacvlan.h | 4 +++- 9 files changed, 32 insertions(+), 9 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 03a05366e1..9714a1e141 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -2971,6 +2971,7 @@ virDomainNetDefFree(virDomainNetDef *def) g_free(def->virtio); g_free(def->coalesce); g_free(def->sourceDev); + g_free(def->tapfdpath); virNetDevIPInfoClear(&def->guestIP); virNetDevIPInfoClear(&def->hostIP); @@ -10634,6 +10635,10 @@ virDomainNetDefParseXML(virDomainXMLOption *xmlopt, return NULL; } + if (!(flags & VIR_DOMAIN_DEF_PARSE_INACTIVE)) { + def->tapfdpath = virXPathString("string(./tapfd/@path)", ctxt); + } + if (virNetworkPortOptionsParseXML(ctxt, &def->isolatedPort) < 0) return NULL; @@ -26004,6 +26009,9 @@ virDomainNetDefFormat(virBuffer *buf, if (def->mtu) virBufferAsprintf(buf, "<mtu size='%u'/>\n", def->mtu); + if (def->tapfdpath && (flags & VIR_DOMAIN_DEF_FORMAT_STATUS)) + virBufferAsprintf(buf, "<tapfd path='%s'/>\n", def->tapfdpath); + virDomainNetDefCoalesceFormatXML(buf, def->coalesce); virDomainDeviceInfoFormat(buf, &def->info, flags | VIR_DOMAIN_DEF_FORMAT_ALLOW_BOOT diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index e63230beec..3bb4de6274 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -1212,6 +1212,7 @@ struct _virDomainNetDef { char *downscript; char *domain_name; /* backend domain name */ char *ifname; /* interface name on the host (<target dev='x'/>) */ + char *tapfdpath; /* Path in /dev for macvtap (<tapfd path="/dev/tapXX">) */ virTristateBool managed_tap; virNetDevIPInfo hostIP; char *ifname_guest_actual; diff --git a/src/hypervisor/domain_interface.c b/src/hypervisor/domain_interface.c index 5bc698d272..37e3d453a0 100644 --- a/src/hypervisor/domain_interface.c +++ b/src/hypervisor/domain_interface.c @@ -111,7 +111,7 @@ virDomainInterfaceEthernetConnect(virDomainDef *def, if (virNetDevMacVLanIsMacvtap(net->ifname)) { auditdev = net->ifname; - if (virNetDevMacVLanTapOpen(net->ifname, tapfd, tapfdSize) < 0) + if (virNetDevMacVLanTapOpen(net->ifname, tapfd, tapfdSize, &net->tapfdpath) < 0) goto cleanup; if (virNetDevMacVLanTapSetup(tapfd, tapfdSize, virDomainInterfaceIsVnetCompatModel(net)) < 0) { diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c index 1bca9e8dae..c731b28871 100644 --- a/src/lxc/lxc_process.c +++ b/src/lxc/lxc_process.c @@ -379,6 +379,7 @@ virLXCProcessSetupInterfaceDirect(virLXCDriver *driver, VIR_NETDEV_VPORT_PROFILE_OP_CREATE, cfg->stateDir, NULL, 0, + &net->tapfdpath, macvlan_create_flags) < 0) return NULL; diff --git a/src/qemu/qemu_interface.c b/src/qemu/qemu_interface.c index 23a23d201a..edc53d53b3 100644 --- a/src/qemu/qemu_interface.c +++ b/src/qemu/qemu_interface.c @@ -81,6 +81,7 @@ qemuInterfaceDirectConnect(virDomainDef *def, &res_ifname, vmop, cfg->stateDir, tapfd, tapfdSize, + &net->tapfdpath, macvlan_create_flags) < 0) goto cleanup; diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index 40f13ec1a5..3ff80e1dc9 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -156,6 +156,7 @@ load_profile(virSecurityManager *mgr G_GNUC_UNUSED, if (virDomainDefFormatInternal(def, NULL, &buf, VIR_DOMAIN_DEF_FORMAT_SECURE | + VIR_DOMAIN_DEF_FORMAT_STATUS | VIR_DOMAIN_DEF_FORMAT_VOLUME_TRANSLATED) < 0) return -1; diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index e932e79dab..60e03c2ce8 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1192,6 +1192,11 @@ get_files(vahControl * ctl) vhu->type) != 0) return -1; } + + if (net->tapfdpath) { + if (vah_add_file(&buf, net->tapfdpath, "rwk") != 0) + return -1; + } } for (i = 0; i < ctl->def->nmems; i++) { diff --git a/src/util/virnetdevmacvlan.c b/src/util/virnetdevmacvlan.c index cde9d70eef..fcf63e08ff 100644 --- a/src/util/virnetdevmacvlan.c +++ b/src/util/virnetdevmacvlan.c @@ -152,24 +152,24 @@ int virNetDevMacVLanDelete(const char *ifname) int virNetDevMacVLanTapOpen(const char *ifname, int *tapfd, - size_t tapfdSize) + size_t tapfdSize, + char **tapname) { int retries = 10; int ret = -1; int ifindex; size_t i = 0; - g_autofree char *tapname = NULL; if (virNetDevGetIndex(ifname, &ifindex) < 0) return -1; - tapname = g_strdup_printf("/dev/tap%d", ifindex); + *tapname = g_strdup_printf("/dev/tap%d", ifindex); for (i = 0; i < tapfdSize; i++) { int fd = -1; while (fd < 0) { - if ((fd = open(tapname, O_RDWR)) >= 0) { + if ((fd = open(*tapname, O_RDWR)) >= 0) { tapfd[i] = fd; } else if (retries-- > 0) { /* may need to wait for udev to be done */ @@ -178,7 +178,7 @@ virNetDevMacVLanTapOpen(const char *ifname, /* However, if haven't succeeded, quit. */ virReportSystemError(errno, _("cannot open macvtap tap device %1$s"), - tapname); + *tapname); goto cleanup; } } @@ -188,6 +188,7 @@ virNetDevMacVLanTapOpen(const char *ifname, cleanup: if (ret < 0) { + g_free(*tapname); while (i--) VIR_FORCE_CLOSE(tapfd[i]); } @@ -659,6 +660,7 @@ virNetDevMacVLanCreateWithVPortProfile(const char *ifnameRequested, char *stateDir, int *tapfd, size_t tapfdSize, + char **tapfdpath, unsigned int flags) { g_autofree char *ifname = NULL; @@ -729,7 +731,7 @@ virNetDevMacVLanCreateWithVPortProfile(const char *ifnameRequested, } if (flags & VIR_NETDEV_MACVLAN_CREATE_WITH_TAP) { - if (virNetDevMacVLanTapOpen(ifname, tapfd, tapfdSize) < 0) + if (virNetDevMacVLanTapOpen(ifname, tapfd, tapfdSize, tapfdpath) < 0) goto disassociate_exit; if (virNetDevMacVLanTapSetup(tapfd, tapfdSize, vnet_hdr) < 0) @@ -888,7 +890,8 @@ int virNetDevMacVLanDelete(const char *ifname G_GNUC_UNUSED) int virNetDevMacVLanTapOpen(const char *ifname G_GNUC_UNUSED, int *tapfd G_GNUC_UNUSED, - size_t tapfdSize G_GNUC_UNUSED) + size_t tapfdSize G_GNUC_UNUSED, + char **tapname G_GNUC_UNUSED) { virReportSystemError(ENOSYS, "%s", _("Cannot create macvlan devices on this platform")); @@ -917,6 +920,7 @@ int virNetDevMacVLanCreateWithVPortProfile(const char *ifname G_GNUC_UNUSED, char *stateDir G_GNUC_UNUSED, int *tapfd G_GNUC_UNUSED, size_t tapfdSize G_GNUC_UNUSED, + char **tapfdpath G_GNUC_UNUSED, unsigned int unused_flags G_GNUC_UNUSED) { virReportSystemError(ENOSYS, "%s", diff --git a/src/util/virnetdevmacvlan.h b/src/util/virnetdevmacvlan.h index 31e4804cdc..7424b87965 100644 --- a/src/util/virnetdevmacvlan.h +++ b/src/util/virnetdevmacvlan.h @@ -72,13 +72,15 @@ int virNetDevMacVLanCreateWithVPortProfile(const char *ifname, char *stateDir, int *tapfd, size_t tapfdSize, + char **tapfdpath, unsigned int flags) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3) ATTRIBUTE_NONNULL(6) ATTRIBUTE_NONNULL(8) ATTRIBUTE_NONNULL(10) G_GNUC_WARN_UNUSED_RESULT; int virNetDevMacVLanTapOpen(const char *ifname, int *tapfd, - size_t tapfdSize) + size_t tapfdSize, + char **tapname) ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) G_GNUC_WARN_UNUSED_RESULT; --- base-commit: 54f5032e576a886cfb8232abbfa08a2f6e9f9962 change-id: 20260105-apparmor-races-d03238ee4d93 Best regards, -- Wesley Hershberger <wesley.hershberger(a)canonical.com>

1 0

[PATCH] virt-aa-helper: Prevent spurious denials for AoE disks
by PUSHKARAJ PATIL 13 Mar '26

13 Mar '26

virt-aa-helper calls virStorageSourceGetMetadata before adding a disk path to a domain's apparmor profile. This probes the device and may trigger an AppArmor denial when the disk is an AoE device under /dev/etherd/. The return value of virStorageSourceGetMetadata is not checked, so the denial has no functional impact but results in noisy dmesg logs. Allow read access to /dev/etherd/e*.* in the virt-aa-helper profile to avoid these spurious denials. Signed-off-by: PUSHKARAJ PATIL <pushkaraj.patil(a)in.ibm.com> --- src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in | 1 + 1 file changed, 1 insertion(+) diff --git a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in index e209a8bff7..80e9ef2b08 100644 --- a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in +++ b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in @@ -73,6 +73,7 @@ profile virt-aa-helper @libexecdir@/virt-aa-helper { /**.vhd r, /**.[iI][sS][oO] r, /**/disk{,.*} r, + /dev/etherd/e*.* r, include if exists <local/usr.lib.libvirt.virt-aa-helper> } -- 2.50.1 (Apple Git-155)

1 0

[PATCH 0/4] libvirt: AMD IOMMU fixes
by Xiaotian Feng 13 Mar '26

13 Mar '26

This series refines libvirt's logic for large vCPU configurations (>255) on x86/q35 machine types. Historically, the threshold was tied to Intel's EIM capability, but the real requirement is x2APIC support for APIC IDs beyond 255. AMD platforms can satisfy this via xtsup on amd-iommu. Summary of changes: 1. Fix virDomainIOMMUDefEquals to include pt and xtsup attributes for proper checks. 2. Correct error messages for passthrough (pt) and xtsup attributes to reflect their actual names instead of "dma translation". 3. Rename QEMU_MAX_VCPUS_WITHOUT_EIM to QEMU_MAX_VCPUS_WITHOUT_X2APIC and update validation logic to accept either: - intel-iommu with eim='on', or - amd-iommu with xtsup='on' for guests with more than 255 vCPUs. Error messages now mention x2APIC mode instead of extended interrupt mode. 4. Add QEMU_CAPS_AMD_IOMMU_XTSUP capability and enable xtsup by default for AMD IOMMU when a Q35 domain has >255 vCPUs, similar to Intel EIM auto-enable logic. Also ensure intremap is turned on when required. This makes the behavior vendor-neutral and improves usability for AMD EPYC guests with large vCPU counts. No ABI changes beyond stricter equality checks; this is a clarification and extension of existing logic. Xiaotian Feng (4): conf: fix virDomainIOMMUDefEquals for amd_iommu conf: fix error log for passthrough and xtsup attributes conf: support >255 vcpu w/ amd-iommu xtsup qemu: Enable AMD IOMMU XTSUP by default src/conf/domain_conf.c | 6 ++++-- src/qemu/qemu_capabilities.c | 2 ++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_postparse.c | 42 +++++++++++++++++++++++------------- src/qemu/qemu_validate.c | 11 +++++----- src/qemu/qemu_validate.h | 2 +- 6 files changed, 41 insertions(+), 23 deletions(-) -- 2.34.1

2 6

[PATCH] storage: mpath: fix error reporting in virStorageBackendGetMaps
by Lucas Amaral 13 Mar '26

13 Mar '26

virStorageBackendGetMaps() returns 1 on failure instead of the conventional -1, and does not call virReportError() in any of its error paths. On top of that, both callers silently discard the return value: virStorageBackendGetMaps() ignores the result of virStorageBackendCreateVols(), and virStorageBackendMpathRefreshPool() ignores the result of virStorageBackendGetMaps(). Fix all three issues: normalize error returns to -1, add virReportError() calls for each failure path in virStorageBackendGetMaps(), and check return values in both callers so that errors are properly propagated. Signed-off-by: Lucas Amaral <lucaaamaral(a)gmail.com> --- This is similar in spirit to commits e9b931d3e4 ("virpci: Report an error if virPCIGetVirtualFunctionIndex() fails") and 6c2c9e21ac ("virstorageobj: Make virStoragePoolObjAddVol() report an error on failure"), applying the same pattern to the mpath storage backend. Found while auditing storage backends for functions that return error codes without calling virReportError(). src/storage/storage_backend_mpath.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/src/storage/storage_backend_mpath.c b/src/storage/storage_backend_mpath.c index 9fc3983c52..a30153a93b 100644 --- a/src/storage/storage_backend_mpath.c +++ b/src/storage/storage_backend_mpath.c @@ -197,19 +197,25 @@ virStorageBackendGetMaps(virStoragePoolObj *pool) struct dm_names *names = NULL; if (!(dmt = dm_task_create(DM_DEVICE_LIST))) { - retval = 1; + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Failed to create devmapper task")); + retval = -1; goto out; } dm_task_no_open_count(dmt); if (!dm_task_run(dmt)) { - retval = 1; + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Failed to run devmapper task")); + retval = -1; goto out; } if (!(names = dm_task_get_names(dmt))) { - retval = 1; + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Failed to get devmapper device names")); + retval = -1; goto out; } @@ -218,7 +224,10 @@ virStorageBackendGetMaps(virStoragePoolObj *pool) goto out; } - virStorageBackendCreateVols(pool, names); + if (virStorageBackendCreateVols(pool, names) < 0) { + retval = -1; + goto out; + } out: if (dmt != NULL) @@ -248,7 +257,8 @@ virStorageBackendMpathRefreshPool(virStoragePoolObj *pool) virWaitForDevices(); - virStorageBackendGetMaps(pool); + if (virStorageBackendGetMaps(pool) < 0) + return -1; return 0; } -- 2.52.0

2 1