July 2026 - Devel - libvirt List Archives

[RFC] qemu: add configurable vCPU hotplug selection order
by Partha Satapathy 15 Jul '26

15 Jul '26

qemu: add configurable vCPU hotplug selection order Count-based vCPU hotplug currently selects eligible vCPU hotplug entities according to their vCPU IDs. For example: virsh setvcpus VM COUNT --live does not provide a way for an administrator to control which eligible entities are added or removed first. The existing ID-based policy is suitable for simple guests and for deployments where the vCPU ID layout already represents the desired placement policy. Domains that do not configure the new feature continue to use the current ID-based behavior. One use case is preserving a balanced guest NUMA CPU distribution during count-based vCPU changes. Depending on how vCPU IDs are assigned to guest NUMA cells, repeatedly adding or removing vCPUs by ID may concentrate the change in one cell before affecting another, resulting in an undesirable asymmetric guest CPU layout. There is no single balancing policy that is correct for every guest. An administrator may want to remove one hotplug entity from each guest NUMA cell in a round-robin sequence. For a guest with a threaded CPU topology, the preferred policy may instead remove a complete core, or several threads from one cell, before proceeding to the next. The appropriate sequence depends on the guest topology, workload, architecture, and performance requirements. The mechanism is not limited to NUMA balancing. It can also express administrator-defined policies such as: * retaining CPUs used for latency-sensitive, isolated, or housekeeping workloads; * implementing CPU capacity tiers; * satisfying software licensing or application-affinity constraints; * preserving a preferred socket, core, or thread population while reducing capacity; or * restoring vCPUs in a predictable order after an earlier reduction. Rather than embedding any one placement policy in libvirt, this proposal provides a general ordering mechanism. Administrators can describe the desired selection sequence in the domain XML according to the guest and deployment requirements. The existing per-vCPU 'order' attribute has different semantics and cannot be reused for this purpose. It is used to define the order and grouping of vCPUs when they are enabled. It applies to online vCPUs and is not a policy for selecting offline hotpluggable vCPUs. In particular, 'order' is not used to choose which vCPUs are removed by a count-based `setvcpus` reduction. Therefore, it cannot express an administrator-defined hot-unplug sequence. In contrast, 'hporder' is configured on disabled hotpluggable vCPUs and is used when libvirt selects eligible hotplug entities for count-based vCPU changes. It determines both which entities are removed during reduction and the order in which ranked entities are restored during expansion. It does not change the existing 'order' semantics, startup behavior, or hotplug entity composition. Introduce an optional positive per-vCPU 'hporder' XML attribute for QEMU domains. If the attribute is omitted, the vCPU remains unranked. All vCPUs belonging to the same QEMU hotplug entity must have the same 'hporder' value because they cannot be added or removed independently. The configuration is rejected if the values within an entity differ. For count-based operations, the QEMU driver applies the following selection policy: * On expansion, select unranked entities in ascending vCPU ID order, followed by ranked entities in ascending 'hporder' order. * On reduction, select ranked entities in descending 'hporder' order, followed by unranked entities in descending vCPU ID order. The ordering has two useful properties. First, domains without 'hporder' retain the existing behavior. Second, among ranked entities, expansion naturally restores entities in the reverse order in which reduction removed them. Unranked entities are selected first during expansion so that configuring 'hporder' can be used primarily to describe a preferred removal order without changing the normal expansion order of other hotpluggable vCPUs. The setting affects only the selection of eligible entities during count-based vCPU operations. It does not change: * the initial boot CPU order; * the existing per-vCPU 'order' attribute; * the composition of a QEMU hotplug entity; * whether a vCPU is hotpluggable; or * operations that explicitly address individual vCPUs. The value is preserved in domain XML and exposed through: virDomainSetVcpuHpOrder() A positive API value configures the order. Passing zero removes the configured value. Zero is not valid in domain XML and is therefore omitted when the XML is formatted. The corresponding virsh commands are: setvcpuhporder DOMAIN VCPU HPORDER delvcpuhporder DOMAIN VCPU Proposed implementation: 1. Add the 'hporder' attribute to the per-vCPU domain XML. 2. Validate that all vCPUs belonging to the same QEMU hotplug entity use the same 'hporder' value. 3. Use 'hporder' when selecting eligible vCPU hotplug entities for count-based expansion and reduction. 4. Add a public API for configuring or removing the 'hporder' value. 5. Add virsh commands for setting and removing the value. 6. Update the domain XML and API documentation to describe the new attribute, its valid values, its interaction with the existing per-vCPU 'order' attribute, and the selection rules used for expansion and reduction. 7. Add automated test coverage for XML parsing and formatting, invalid zero values, hotplug-entity consistency, and count-based expansion and reduction ordering. RFC: Feedback is welcome on the ordering policy and interface. In particular, feedback is requested on the XML/API naming, the handling of unranked vCPUs during expansion, and whether this should remain a QEMU-only feature. Signed-off-by: Partha Sarathi Satapathy <partha.satapathy(a)oracle.com>

3 3

[PATCH] src: fix crash searching for XML context string on errors
by Daniel P. Berrangé 15 Jul '26

15 Jul '26

From: Daniel P. Berrangé <berrange(a)redhat.com> When we have an XML parse error, libxml2 invokes a callback that receives pointers to the start of the document being parsed and the location where the error was triggered. In the case of a document that contains 100's of empty lines (ie a sequence of newlines), at some point libxml2 will advance the base pointer discarding the useful context. Thus when catchXMLError then searches backwards to discard empty lines and look for the context element, it will eventually get to the start of the string. When this happens the virBuffer that holds the context string ends up empty and then catchXMLError will dereference a NULL pointer. In almost all cases, the APIs which accept XML documents from the user are behind the primary read-write socket, however, the CPU baseline API is exposed to the read-only socket. Thus an unprivileged user can trigger a denial of service by crashing the libvirt daemons with a malicious XML document. Check for this empty string condition and skip inclusion of the XML document context in the error message. Fixes: CVE-2026-61478 Reported-by: Rx <rx1513(a)altlinux.org> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/util/virxml.c | 46 +++++++++++++++++++++++++++++++--------------- 1 file changed, 31 insertions(+), 15 deletions(-) diff --git a/src/util/virxml.c b/src/util/virxml.c index beb5301378..8349115633 100644 --- a/src/util/virxml.c +++ b/src/util/virxml.c @@ -1173,7 +1173,8 @@ catchXMLError(void *ctx, const char *msg G_GNUC_UNUSED, ...) contextstr = virBufferContentAndReset(&buf); /* (leave buffer space for pointer + line terminator) */ - for (n = 0; (n<col) && (contextstr[n] != 0); n++) { + + for (n = 0; (n<col) && contextstr && contextstr[n]; n++) { if (contextstr[n] == '\t') virBufferAddChar(&buf, '\t'); else @@ -1184,21 +1185,36 @@ catchXMLError(void *ctx, const char *msg G_GNUC_UNUSED, ...) pointerstr = virBufferContentAndReset(&buf); - if (filename) { - virGenericReportError(domcode, VIR_ERR_XML_DETAIL, - _("%1$s:%2$d: %3$s%4$s\n%5$s"), - filename, - lastError->line, - lastError->message, - contextstr, - pointerstr); + if (contextstr) { + if (filename) { + virGenericReportError(domcode, VIR_ERR_XML_DETAIL, + _("%1$s:%2$d: %3$s%4$s\n%5$s"), + filename, + lastError->line, + lastError->message, + contextstr, + pointerstr); + } else { + virGenericReportError(domcode, VIR_ERR_XML_DETAIL, + _("at line %1$d: %2$s%3$s\n%4$s"), + lastError->line, + lastError->message, + contextstr, + pointerstr); + } } else { - virGenericReportError(domcode, VIR_ERR_XML_DETAIL, - _("at line %1$d: %2$s%3$s\n%4$s"), - lastError->line, - lastError->message, - contextstr, - pointerstr); + if (filename) { + virGenericReportError(domcode, VIR_ERR_XML_DETAIL, + _("%1$s:%2$d: %3$s"), + filename, + lastError->line, + lastError->message); + } else { + virGenericReportError(domcode, VIR_ERR_XML_DETAIL, + _("at line %1$d: %2$s"), + lastError->line, + lastError->message); + } } } -- 2.55.0

2 1

[PATCH 0/4] qemu: auto-select win-dmp for Windows guest crash dumps
by Denis V. Lunev 15 Jul '26

15 Jul '26

Auto-triggered dumps (on_crash, watchdog) always use QEMU's elf default, which is not WinDbg-loadable for a Windows guest and cannot be reliably converted after the fact. This was proposed before as a per-domain XML knob (https://www.mail-archive.com/devel@lists.libvirt.org/msg09638.html) Daniel P. Berrange objected: QEMU's query-dump-guest-memory-capability reported win-dmp as available on any x86-64 guest regardless of whether it had actually published a Windows dump header, so trusting it was not safe. QEMU's win_dump_available() has since been fixed to check the guest's vmcoreinfo note (https://lore.kernel.org/qemu-devel/20260619101834.228432-1-den@openvz.org/, commit b4bdad7dce). Patch 1 queries it directly instead of adding an XML knob. Patch 4 adds a quota (auto_dump_max_size): a guest that keeps crashing otherwise fills auto_dump_path one dump at a time. Oldest dumps are pruned after each new one; the dump just written is never removed, even alone over quota. Patches 2-3 give that setting and virtlogd's max_size a "10GiB"-style syntax instead of a raw byte count, reusing virScaleInteger()'s existing unit table. Validated against real guests: a Windows Server 2022 guest crashed via Sysinternals NotMyFault produces a PAGEDU64 (win-dmp) dump; an AlmaLinux 9 guest crashed via sysrq produces an ELF one. A 1GiB quota across two Linux crashes pruned the older dump and kept the newer, over-quota one. syntax-check and virstringtest pass. Denis V. Lunev (4): qemu: auto-select win-dmp for crash- and watchdog-triggered dumps util: add virStrToBytes() and virConfGetValueBytes() for scaled sizes logging: accept a unit suffix in virtlogd's max_size qemu: cap total size of auto-triggered dumps under auto_dump_path src/libvirt_private.syms | 2 + src/logging/log_daemon_config.c | 2 +- src/logging/log_daemon_config.h | 2 +- src/logging/virtlogd.conf | 7 +- src/qemu/qemu.conf.in | 16 ++++ src/qemu/qemu_conf.c | 2 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_driver.c | 127 +++++++++++++++++++++++++++++++- src/util/virconf.c | 47 ++++++++++++ src/util/virconf.h | 3 + src/util/virutil.c | 23 ++++++ src/util/virutil.h | 5 ++ tests/virstringtest.c | 76 +++++++++++++++++++ 13 files changed, 308 insertions(+), 5 deletions(-) -- 2.53.0

3 7

[PATCH v19 03/15] net/tap: deprecate "no" as special value for script/downscript
by Vladimir Sementsov-Ogievskiy 14 Jul '26

14 Jul '26

The interface is ambiguous, as "no" is valid file name. So, using "no" as a special value to disable script is deprecated. Use an empty string ("script=" / "downscript=") instead. In a future version, "no" will be treated as a plain file name, just like any other non-empty value. Document the deprecation in docs/about/deprecated.rst, qapi/net.json, and qemu-options.hx. Update other docs to use empty string instead of "no". Add a warning. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> --- docs/about/deprecated.rst | 18 ++++++++++++++ docs/system/i386/microvm.rst | 4 +-- docs/system/i386/xenpvh.rst | 2 +- docs/system/ppc/ppce500.rst | 4 +-- docs/system/riscv/microchip-icicle-kit.rst | 2 +- docs/system/riscv/sifive_u.rst | 2 +- net/tap.c | 29 ++++++++++++++-------- qapi/net.json | 12 ++++++--- qemu-options.hx | 7 ++++-- 9 files changed, 56 insertions(+), 24 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 0c656a968fc..c4929317e3a 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -71,6 +71,15 @@ flexible enough. The monitor objects have been converted to QOM, so ``-mon mode=control`` is replaced by ``-object monitor-qmp``. The short convenience options are not deprecated, only ``-mon``. +``script=no`` and ``downscript=no`` for ``-netdev tap`` (since 11.2) +''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +The special value ``"no"`` for the ``script`` and ``downscript`` +parameters of ``-netdev tap`` disables script execution. This special +treatment of ``"no"`` is deprecated. Use an empty string (``script=`` +or ``downscript=``) to disable script execution instead. In a future +version, ``"no"`` will be treated as a plain file name. + QEMU Machine Protocol (QMP) commands ------------------------------------ @@ -164,6 +173,15 @@ Use ``job-finalize`` instead. Use ``query-accelerators`` instead. +``"no"`` as value of ``script``/``downscript`` for tap in ``netdev_add`` (since 11.2) +''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +The special value ``"no"`` for the ``script`` and ``downscript`` +parameters of ``netdev_add`` with ``type=tap`` disables script +execution. This special treatment of ``"no"`` is deprecated. Use an +empty string instead. In a future version, ``"no"`` will be treated as +a plain file name. + Human Machine Protocol (HMP) commands ------------------------------------- diff --git a/docs/system/i386/microvm.rst b/docs/system/i386/microvm.rst index 1675e37d3e7..077ea15751e 100644 --- a/docs/system/i386/microvm.rst +++ b/docs/system/i386/microvm.rst @@ -79,7 +79,7 @@ legacy ``ISA serial`` device as console:: -serial stdio \ -drive id=test,file=test.img,format=raw,if=none \ -device virtio-blk-device,drive=test \ - -netdev tap,id=tap0,script=no,downscript=no \ + -netdev tap,id=tap0,script=,downscript= \ -device virtio-net-device,netdev=tap0 While the example above works, you might be interested in reducing the @@ -103,7 +103,7 @@ disabled:: -device virtconsole,chardev=virtiocon0 \ -drive id=test,file=test.img,format=raw,if=none \ -device virtio-blk-device,drive=test \ - -netdev tap,id=tap0,script=no,downscript=no \ + -netdev tap,id=tap0,script=,downscript= \ -device virtio-net-device,netdev=tap0 diff --git a/docs/system/i386/xenpvh.rst b/docs/system/i386/xenpvh.rst index 904778e3f5c..862f38830b1 100644 --- a/docs/system/i386/xenpvh.rst +++ b/docs/system/i386/xenpvh.rst @@ -42,7 +42,7 @@ case you need to construct one manually: -vnc none \ -display none \ -device virtio-net-pci,id=nic0,netdev=net0,mac=00:16:3e:5c:81:78 \ - -netdev type=tap,id=net0,ifname=vif3.0-emu,br=xenbr0,script=no,downscript=no \ + -netdev type=tap,id=net0,ifname=vif3.0-emu,br=xenbr0,script=,downscript= \ -smp 4,maxcpus=4 \ -nographic \ -machine xenpvh,ram-low-base=0,ram-low-size=2147483648,ram-high-base=4294967296,ram-high-size=2147483648,pci-ecam-base=824633720832,pci-ecam-size=268435456,pci-mmio-base=4026531840,pci-mmio-size=33554432,pci-mmio-high-base=824902156288,pci-mmio-high-size=68719476736 \ diff --git a/docs/system/ppc/ppce500.rst b/docs/system/ppc/ppce500.rst index c9fe0915dc5..ec5aaf14fd9 100644 --- a/docs/system/ppc/ppce500.rst +++ b/docs/system/ppc/ppce500.rst @@ -158,14 +158,14 @@ interface at PCI address 0.1.0, but we can switch that to an e1000 NIC by: $ qemu-system-ppc64 -M ppce500 -smp 4 -m 2G \ -display none -serial stdio \ -bios u-boot \ - -nic tap,ifname=tap0,script=no,downscript=no,model=e1000 + -nic tap,ifname=tap0,script=,downscript=,model=e1000 The QEMU ``ppce500`` machine can also dynamically instantiate an eTSEC device if “-device eTSEC” is given to QEMU: .. code-block:: bash - -netdev tap,ifname=tap0,script=no,downscript=no,id=net0 -device eTSEC,netdev=net0 + -netdev tap,ifname=tap0,script=,downscript=,id=net0 -device eTSEC,netdev=net0 Root file system on flash drive ------------------------------- diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst index 9809e94b84b..7fdb96601ad 100644 --- a/docs/system/riscv/microchip-icicle-kit.rst +++ b/docs/system/riscv/microchip-icicle-kit.rst @@ -84,7 +84,7 @@ Then we can boot the machine by: $ qemu-system-riscv64 -M microchip-icicle-kit -smp 5 -m 2G \ -sd path/to/sdcard.img \ -nic user,model=cadence_gem \ - -nic tap,ifname=tap,model=cadence_gem,script=no \ + -nic tap,ifname=tap,model=cadence_gem,script= \ -display none -serial stdio \ -kernel path/to/u-boot/build/dir/u-boot.bin \ -dtb path/to/u-boot/build/dir/u-boot.dtb diff --git a/docs/system/riscv/sifive_u.rst b/docs/system/riscv/sifive_u.rst index 8f55ae8e313..0e4dcf3e70c 100644 --- a/docs/system/riscv/sifive_u.rst +++ b/docs/system/riscv/sifive_u.rst @@ -199,7 +199,7 @@ To boot the VxWorks kernel in QEMU with the ``sifive_u`` machine, use: $ qemu-system-riscv64 -M sifive_u -smp 5 -m 2G \ -display none -serial stdio \ - -nic tap,ifname=tap0,script=no,downscript=no \ + -nic tap,ifname=tap0,script=,downscript= \ -kernel /path/to/vxWorks \ -append "gem(0,0)host:vxWorks h=192.168.200.1 e=192.168.200.2:ffffff00 u=target pw=vxTarget f=0x01" diff --git a/net/tap.c b/net/tap.c index fedd48c48d2..2e94b4015f6 100644 --- a/net/tap.c +++ b/net/tap.c @@ -92,34 +92,40 @@ static void launch_script(const char *setup_script, const char *ifname, static void tap_send(void *opaque); static void tap_writable(void *opaque); -static bool tap_is_explicit_no_script(const char *script_arg) +static bool tap_is_explicit_no_script(const char *script_arg_name, + const char *script_arg_value) { - if (!script_arg) { + if (!script_arg_value) { return false; } - if (script_arg[0] == '\0') { + if (script_arg_value[0] == '\0') { return true; } - if (strcmp(script_arg, "no") == 0) { + if (strcmp(script_arg_value, "no") == 0) { + warn_report("%s=no is deprecated; use %s= instead " + "(empty string instead of 'no')", + script_arg_name, script_arg_name); return true; } return false; } -static char *tap_parse_script(const char *script_arg, const char *default_path) +static char *tap_parse_script(const char *script_arg_name, + const char *script_arg_value, + const char *default_path) { - if (tap_is_explicit_no_script(script_arg)) { + if (tap_is_explicit_no_script(script_arg_name, script_arg_value)) { return NULL; } - if (!script_arg) { + if (!script_arg_value) { return get_relocated_path(default_path); } - return g_strdup(script_arg); + return g_strdup(script_arg_value); } static void tap_update_fd_handler(TAPState *s) @@ -740,7 +746,7 @@ static bool net_init_tap_one(const NetdevTapOptions *tap, NetClientState *peer, qemu_set_info_str(&s->nc, "helper=%s", tap->helper); } else { qemu_set_info_str(&s->nc, "ifname=%s,script=%s,downscript=%s", ifname, - script ?: "no", downscript ?: "no"); + script ?: "", downscript ?: ""); if (downscript) { snprintf(s->down_script, sizeof(s->down_script), "%s", downscript); @@ -946,9 +952,10 @@ int net_init_tap(const Netdev *netdev, const char *name, } } else { g_autofree char *script = - tap_parse_script(tap->script, DEFAULT_NETWORK_SCRIPT); + tap_parse_script("script", tap->script, DEFAULT_NETWORK_SCRIPT); g_autofree char *downscript = - tap_parse_script(tap->downscript, DEFAULT_NETWORK_DOWN_SCRIPT); + tap_parse_script("downscript", tap->downscript, + DEFAULT_NETWORK_DOWN_SCRIPT); if (tap->ifname) { pstrcpy(ifname, sizeof ifname, tap->ifname); diff --git a/qapi/net.json b/qapi/net.json index 8f0915c4d86..ada0329ef9d 100644 --- a/qapi/net.json +++ b/qapi/net.json @@ -399,15 +399,19 @@ # @fds: multiple file descriptors of already opened multiqueue capable # tap # -# @script: script to initialize the interface. An empty string or -# "no" disables script execution. Defaults to +# @script: script to initialize the interface. An empty string +# disables script execution. Defaults to # ``<sysconfdir>/qemu-ifup``, where ``<sysconfdir>`` is the # system configuration directory at build time (typically /etc). +# Using "no" to disable script execution is deprecated (since +# 11.2); use an empty string instead. # -# @downscript: script to shut down the interface. An empty string or -# "no" disables script execution. Defaults to +# @downscript: script to shut down the interface. An empty string +# disables script execution. Defaults to # ``<sysconfdir>/qemu-ifdown``, where ``<sysconfdir>`` is the # system configuration directory at build time (typically /etc). +# Using "no" to disable script execution is deprecated (since +# 11.2); use an empty string instead. # # @br: bridge name (since 2.8) # diff --git a/qemu-options.hx b/qemu-options.hx index 200949655ea..7b9a14f5b38 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -3014,7 +3014,8 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " use network scripts 'file' (default=" DEFAULT_NETWORK_SCRIPT ")\n" " to configure it and 'dfile' (default=" DEFAULT_NETWORK_DOWN_SCRIPT ")\n" " to deconfigure it\n" - " use '[down]script=no' or '[down]script=' to disable script execution\n" + " use '[down]script=' to disable script execution\n" + " ('[down]script=no' is deprecated and will be treated as a file name in future)\n" " use network helper 'helper' (default=" DEFAULT_BRIDGE_HELPER ") to\n" " configure it\n" " use 'fd=h' to connect to an already opened TAP interface\n" @@ -3553,7 +3554,9 @@ SRST ``<sysconfdir>/qemu-ifup`` and the default network deconfigure script is ``<sysconfdir>/qemu-ifdown``, where ``<sysconfdir>`` is the system configuration directory at build time (typically ``/etc``). - Use ``[down]script=no`` or ``[down]script=`` to disable script execution. + Use ``[down]script=`` to disable script execution. + Using ``[down]script=no`` is deprecated; in a future version it will + be treated as a plain file name. If running QEMU as an unprivileged user, use the network helper to configure the TAP interface and attach it to the bridge. -- 2.43.0

1 0

[PATCH] qemu: qemuDomainRenameCallback: tidy up
by Roman Bogorodskiy 14 Jul '26

14 Jul '26

A few non-functional changes improving overall readability: - Use g_steal_pointer() for domain name switch code. - Clean up the 'cleanup' handler. - Fix indent for virDomainEventLifecycleNewFromObj() arguments. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/qemu/qemu_driver.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 3d57de389b..6c124672d4 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -19064,9 +19064,8 @@ qemuDomainRenameCallback(virDomainObj *vm, } /* Switch name in domain definition. */ - old_dom_name = vm->def->name; - vm->def->name = new_dom_name; - new_dom_name = NULL; + old_dom_name = g_steal_pointer(&vm->def->name); + vm->def->name = g_steal_pointer(&new_dom_name); if (virDomainSnapshotForEach(vm->snapshots, qemuDomainSnapshotWriteMetadataIter, @@ -19085,22 +19084,25 @@ qemuDomainRenameCallback(virDomainObj *vm, VIR_DOMAIN_EVENT_UNDEFINED, VIR_DOMAIN_EVENT_UNDEFINED_RENAMED); event_new = virDomainEventLifecycleNewFromObj(vm, - VIR_DOMAIN_EVENT_DEFINED, - VIR_DOMAIN_EVENT_DEFINED_RENAMED); + VIR_DOMAIN_EVENT_DEFINED, + VIR_DOMAIN_EVENT_DEFINED_RENAMED); virObjectEventStateQueue(driver->domainEventState, event_old); virObjectEventStateQueue(driver->domainEventState, event_new); ret = 0; cleanup: - if (old_dom_name && ret < 0) { - new_dom_name = vm->def->name; - vm->def->name = old_dom_name; - old_dom_name = NULL; - } + if (ret < 0) { + if (old_dom_name) { + new_dom_name = vm->def->name; + vm->def->name = old_dom_name; + old_dom_name = NULL; + } - if (ret < 0) virErrorPreserveLast(&err); - qemuDomainNamePathsCleanup(cfg, ret < 0 ? new_dom_name : old_dom_name, true); + qemuDomainNamePathsCleanup(cfg, new_dom_name, true); + } else { + qemuDomainNamePathsCleanup(cfg, old_dom_name, true); + } virErrorRestore(&err); return ret; } -- 2.52.0

2 1

[PATCH 0/3] bhyve: improve domain startup error handling
by Roman Bogorodskiy 13 Jul '26

13 Jul '26

Roman Bogorodskiy (3): bhyve: error handling for monitor opening bhyve: improve domain startup error handling bhyve: clear monitor reference on close src/bhyve/bhyve_driver.c | 2 +- src/bhyve/bhyve_monitor.c | 6 ++-- src/bhyve/bhyve_process.c | 73 ++++++++++++++++++++++++--------------- src/bhyve/bhyve_process.h | 3 +- 4 files changed, 51 insertions(+), 33 deletions(-) -- 2.52.0

2 6

[PATCH v2 0/6] Add TLS-PSK support for migration
by Abhisek Panda 13 Jul '26

13 Jul '26

QEMU provides the capability to encrypt the migration data stream using two transport layer security (TLS) authentication schemes: X.509 certificates and pre-shared keys (PSK). Currently, Libvirt only supports the X.509-based TLS authentication scheme. In TLS X.509 certificates, a set of live migrations utilize a fixed set of static certificates for encrypted migration. In this authentication scheme, users require to deploy a certificate authority and monitor the certificate expiration window. In case certificates are compromised all the future live migrations are vulnerable. To resolve this, this patch series introduce the support for pre-shared key-based authentication scheme. This mechanism relies on symmetric pre-shared keys (a secret key that is known to both sender and receiver prior to secure communication) for providing secure transfer of data. Libvirt solely manages the lifecycle of the ephemeral pre-shared keys, including, generation, persistent storage, and cleanup. Libvirt generates the key on the source machine, then transfers it to the destination machine using the migration cookie. To allow users to configure the size of the key, Libvirt provides the migrate_tls_psk_length configuration parameter in qemu.conf. To avoid introduction of an additional VIR_MIGRATE_* flag, we rely on existing the VIR_MIGRATE_TLS flag. If the VIR_MIGRATE_TLS flag is set but the ca-cert.pem file is missing on the source, then we fallback to using PSK-based authentication scheme during migration. v2: 1. Libvirt manages the lifecycle of pre-shared keys. 2. Transfer of keys to the destination via the migration cookie 3. Remove the VIR_MIGRATE_TLS_PSK flag instead rely on VIR_MIGRATE_TLS and availability of ca-cert.pem on source. 4. Drop VIR_MIGRATE_PARAM_TLS_PSK_DIRECTORY, Libvirt solely manages the pre-shared keys. Abhisek Panda (6): conf: Add a configuration param for TLS-PSK qemu: Manage a pre-shared key's lifecycle qemu: Add support to build the tls-creds-psk object qemu: rename tls-creds-x509 obj related functions qemu: Manage tls-creds-psk object lifecycle qemu: Set up the migrate TLS-PSK objects include/libvirt/libvirt-domain.h | 13 +- src/qemu/libvirtd_qemu.aug | 1 + src/qemu/qemu.conf.in | 8 ++ src/qemu/qemu_alias.c | 19 ++- src/qemu/qemu_alias.h | 5 +- src/qemu/qemu_backup.c | 2 +- src/qemu/qemu_command.c | 28 +++- src/qemu/qemu_command.h | 7 + src/qemu/qemu_conf.c | 10 ++ src/qemu/qemu_conf.h | 1 + src/qemu/qemu_domain.c | 2 +- src/qemu/qemu_hotplug.c | 124 +++++++++++----- src/qemu/qemu_hotplug.h | 42 ++++-- src/qemu/qemu_migration.c | 135 ++++++++++++++---- src/qemu/qemu_migration_cookie.c | 125 ++++++++++++++++ src/qemu/qemu_migration_cookie.h | 5 + src/qemu/qemu_migration_params.c | 109 ++++++++++---- src/qemu/qemu_migration_params.h | 22 ++- src/qemu/qemu_postparse.c | 2 +- src/qemu/test_libvirtd_qemu.aug.in | 1 + tests/qemumigparamsdata/tls-enabled.json | 2 +- tests/qemumigparamsdata/tls-enabled.reply | 2 +- tests/qemumigparamsdata/tls-enabled.xml | 2 +- tests/qemumigparamsdata/tls-hostname.json | 2 +- tests/qemumigparamsdata/tls-hostname.reply | 2 +- tests/qemumigparamsdata/tls-hostname.xml | 2 +- tests/qemumigrationcookiexmltest.c | 12 +- tests/qemumonitorjsontest.c | 4 +- tests/qemustatusxml2xmldata/upgrade-out.xml | 2 +- .../chardev-backends-json.x86_64-9.1.0.args | 8 +- .../chardev-backends-json.x86_64-latest.args | 8 +- .../chardev-backends.x86_64-9.1.0.args | 8 +- .../chardev-backends.x86_64-latest.args | 8 +- ...rk-tlsx509-nbd-hostname.x86_64-latest.args | 6 +- ...isk-network-tlsx509-nbd.x86_64-latest.args | 6 +- ...-tlsx509-chardev-verify.x86_64-latest.args | 4 +- ...ial-tcp-tlsx509-chardev.x86_64-latest.args | 4 +- ...-tlsx509-secret-chardev.x86_64-latest.args | 4 +- 38 files changed, 576 insertions(+), 171 deletions(-) -- 2.43.7

2 13

[PATCH v18 03/14] net/tap: deprecate "no" as special value for script/downscript
by Vladimir Sementsov-Ogievskiy 13 Jul '26

13 Jul '26

The interface is ambiguous, as "no" is valid file name. So, using "no" as a special value to disable script is deprecated. Use an empty string ("script=" / "downscript=") instead. In a future version, "no" will be treated as a plain file name, just like any other non-empty value. Document the deprecation in docs/about/deprecated.rst, qapi/net.json, and qemu-options.hx. Update other docs to use empty string instead of "no". Add a warning. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> --- docs/about/deprecated.rst | 18 ++++++++++++++++++ docs/system/i386/microvm.rst | 4 ++-- docs/system/i386/xenpvh.rst | 2 +- docs/system/ppc/ppce500.rst | 4 ++-- docs/system/riscv/microchip-icicle-kit.rst | 2 +- docs/system/riscv/sifive_u.rst | 2 +- net/tap.c | 2 ++ qapi/net.json | 12 ++++++++---- qemu-options.hx | 7 +++++-- 9 files changed, 40 insertions(+), 13 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 0c656a968fc..c4929317e3a 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -71,6 +71,15 @@ flexible enough. The monitor objects have been converted to QOM, so ``-mon mode=control`` is replaced by ``-object monitor-qmp``. The short convenience options are not deprecated, only ``-mon``. +``script=no`` and ``downscript=no`` for ``-netdev tap`` (since 11.2) +''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +The special value ``"no"`` for the ``script`` and ``downscript`` +parameters of ``-netdev tap`` disables script execution. This special +treatment of ``"no"`` is deprecated. Use an empty string (``script=`` +or ``downscript=``) to disable script execution instead. In a future +version, ``"no"`` will be treated as a plain file name. + QEMU Machine Protocol (QMP) commands ------------------------------------ @@ -164,6 +173,15 @@ Use ``job-finalize`` instead. Use ``query-accelerators`` instead. +``"no"`` as value of ``script``/``downscript`` for tap in ``netdev_add`` (since 11.2) +''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +The special value ``"no"`` for the ``script`` and ``downscript`` +parameters of ``netdev_add`` with ``type=tap`` disables script +execution. This special treatment of ``"no"`` is deprecated. Use an +empty string instead. In a future version, ``"no"`` will be treated as +a plain file name. + Human Machine Protocol (HMP) commands ------------------------------------- diff --git a/docs/system/i386/microvm.rst b/docs/system/i386/microvm.rst index 1675e37d3e7..077ea15751e 100644 --- a/docs/system/i386/microvm.rst +++ b/docs/system/i386/microvm.rst @@ -79,7 +79,7 @@ legacy ``ISA serial`` device as console:: -serial stdio \ -drive id=test,file=test.img,format=raw,if=none \ -device virtio-blk-device,drive=test \ - -netdev tap,id=tap0,script=no,downscript=no \ + -netdev tap,id=tap0,script=,downscript= \ -device virtio-net-device,netdev=tap0 While the example above works, you might be interested in reducing the @@ -103,7 +103,7 @@ disabled:: -device virtconsole,chardev=virtiocon0 \ -drive id=test,file=test.img,format=raw,if=none \ -device virtio-blk-device,drive=test \ - -netdev tap,id=tap0,script=no,downscript=no \ + -netdev tap,id=tap0,script=,downscript= \ -device virtio-net-device,netdev=tap0 diff --git a/docs/system/i386/xenpvh.rst b/docs/system/i386/xenpvh.rst index 904778e3f5c..862f38830b1 100644 --- a/docs/system/i386/xenpvh.rst +++ b/docs/system/i386/xenpvh.rst @@ -42,7 +42,7 @@ case you need to construct one manually: -vnc none \ -display none \ -device virtio-net-pci,id=nic0,netdev=net0,mac=00:16:3e:5c:81:78 \ - -netdev type=tap,id=net0,ifname=vif3.0-emu,br=xenbr0,script=no,downscript=no \ + -netdev type=tap,id=net0,ifname=vif3.0-emu,br=xenbr0,script=,downscript= \ -smp 4,maxcpus=4 \ -nographic \ -machine xenpvh,ram-low-base=0,ram-low-size=2147483648,ram-high-base=4294967296,ram-high-size=2147483648,pci-ecam-base=824633720832,pci-ecam-size=268435456,pci-mmio-base=4026531840,pci-mmio-size=33554432,pci-mmio-high-base=824902156288,pci-mmio-high-size=68719476736 \ diff --git a/docs/system/ppc/ppce500.rst b/docs/system/ppc/ppce500.rst index c9fe0915dc5..ec5aaf14fd9 100644 --- a/docs/system/ppc/ppce500.rst +++ b/docs/system/ppc/ppce500.rst @@ -158,14 +158,14 @@ interface at PCI address 0.1.0, but we can switch that to an e1000 NIC by: $ qemu-system-ppc64 -M ppce500 -smp 4 -m 2G \ -display none -serial stdio \ -bios u-boot \ - -nic tap,ifname=tap0,script=no,downscript=no,model=e1000 + -nic tap,ifname=tap0,script=,downscript=,model=e1000 The QEMU ``ppce500`` machine can also dynamically instantiate an eTSEC device if “-device eTSEC” is given to QEMU: .. code-block:: bash - -netdev tap,ifname=tap0,script=no,downscript=no,id=net0 -device eTSEC,netdev=net0 + -netdev tap,ifname=tap0,script=,downscript=,id=net0 -device eTSEC,netdev=net0 Root file system on flash drive ------------------------------- diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst index 9809e94b84b..7fdb96601ad 100644 --- a/docs/system/riscv/microchip-icicle-kit.rst +++ b/docs/system/riscv/microchip-icicle-kit.rst @@ -84,7 +84,7 @@ Then we can boot the machine by: $ qemu-system-riscv64 -M microchip-icicle-kit -smp 5 -m 2G \ -sd path/to/sdcard.img \ -nic user,model=cadence_gem \ - -nic tap,ifname=tap,model=cadence_gem,script=no \ + -nic tap,ifname=tap,model=cadence_gem,script= \ -display none -serial stdio \ -kernel path/to/u-boot/build/dir/u-boot.bin \ -dtb path/to/u-boot/build/dir/u-boot.dtb diff --git a/docs/system/riscv/sifive_u.rst b/docs/system/riscv/sifive_u.rst index 8f55ae8e313..0e4dcf3e70c 100644 --- a/docs/system/riscv/sifive_u.rst +++ b/docs/system/riscv/sifive_u.rst @@ -199,7 +199,7 @@ To boot the VxWorks kernel in QEMU with the ``sifive_u`` machine, use: $ qemu-system-riscv64 -M sifive_u -smp 5 -m 2G \ -display none -serial stdio \ - -nic tap,ifname=tap0,script=no,downscript=no \ + -nic tap,ifname=tap0,script=,downscript= \ -kernel /path/to/vxWorks \ -append "gem(0,0)host:vxWorks h=192.168.200.1 e=192.168.200.2:ffffff00 u=target pw=vxTarget f=0x01" diff --git a/net/tap.c b/net/tap.c index fedd48c48d2..1ec9e5ebe6f 100644 --- a/net/tap.c +++ b/net/tap.c @@ -103,6 +103,8 @@ static bool tap_is_explicit_no_script(const char *script_arg) } if (strcmp(script_arg, "no") == 0) { + warn_report("script=no/downscript=no is deprecated; " + "use script=/downscript= instead"); return true; } diff --git a/qapi/net.json b/qapi/net.json index 8f0915c4d86..ada0329ef9d 100644 --- a/qapi/net.json +++ b/qapi/net.json @@ -399,15 +399,19 @@ # @fds: multiple file descriptors of already opened multiqueue capable # tap # -# @script: script to initialize the interface. An empty string or -# "no" disables script execution. Defaults to +# @script: script to initialize the interface. An empty string +# disables script execution. Defaults to # ``<sysconfdir>/qemu-ifup``, where ``<sysconfdir>`` is the # system configuration directory at build time (typically /etc). +# Using "no" to disable script execution is deprecated (since +# 11.2); use an empty string instead. # -# @downscript: script to shut down the interface. An empty string or -# "no" disables script execution. Defaults to +# @downscript: script to shut down the interface. An empty string +# disables script execution. Defaults to # ``<sysconfdir>/qemu-ifdown``, where ``<sysconfdir>`` is the # system configuration directory at build time (typically /etc). +# Using "no" to disable script execution is deprecated (since +# 11.2); use an empty string instead. # # @br: bridge name (since 2.8) # diff --git a/qemu-options.hx b/qemu-options.hx index 200949655ea..7b9a14f5b38 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -3014,7 +3014,8 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " use network scripts 'file' (default=" DEFAULT_NETWORK_SCRIPT ")\n" " to configure it and 'dfile' (default=" DEFAULT_NETWORK_DOWN_SCRIPT ")\n" " to deconfigure it\n" - " use '[down]script=no' or '[down]script=' to disable script execution\n" + " use '[down]script=' to disable script execution\n" + " ('[down]script=no' is deprecated and will be treated as a file name in future)\n" " use network helper 'helper' (default=" DEFAULT_BRIDGE_HELPER ") to\n" " configure it\n" " use 'fd=h' to connect to an already opened TAP interface\n" @@ -3553,7 +3554,9 @@ SRST ``<sysconfdir>/qemu-ifup`` and the default network deconfigure script is ``<sysconfdir>/qemu-ifdown``, where ``<sysconfdir>`` is the system configuration directory at build time (typically ``/etc``). - Use ``[down]script=no`` or ``[down]script=`` to disable script execution. + Use ``[down]script=`` to disable script execution. + Using ``[down]script=no`` is deprecated; in a future version it will + be treated as a plain file name. If running QEMU as an unprivileged user, use the network helper to configure the TAP interface and attach it to the bridge. -- 2.43.0

3 4

[PATCH v2 0/5] virsh: Add missing TAB completers for several commands
by rsmigiel＠redhat.com 13 Jul '26

13 Jul '26

From: Radoslaw Smigielski <rsmigiel(a)redhat.com> These changes add missing virsh TAB completion callbacks for several commands. Fixed or added completers covers command grouped by similar options: output paths: - dump --file - save --file - blockcopy --dest - screenshot --file (fixes pre-existing wrong annotation) display / native format: - domdisplay --type - domxml-from-native --format - domxml-to-native --format storage volume formats: - vol-create-as --format - vol-create-as --backing-vol-format attach-disk: - targetbus, type, cache, io, mode, sourcetype, subdriver - source-host-socket In patch 1/5 added vshCompletePathLocalCreate, a new noop completer for local file paths used as command output where the target file may not exist yet. This is the counterpart to vshCompletePathLocalExisting, which is for existing files used as input. In patch 2/5 adds a completer for domdisplay --type using virDomainGraphicsTypeToString and VIR_DOMAIN_GRAPHICS_TYPE_LAST so the options stays in sync with libvirt graphics types. Replaced the static list from first patch set. In patch 3/5 adds virshDomainXMLNativeFormatCompleter for domxml-from-native --format (hypervisor-dependent native config format list). In virshDomainXMLNativeFormatCompleter() added 4 new "static const char[]" variables, follow the same pattern appears in the same file. Even though these variables could be a non-static local arrays. In patch 4/5 reuses existing completers for domxml-to-native --format and vol-create-as --format / --backing-vol-format. In 5/5 adds few enum and static-list completers for attach-disk options targetbus, type, cache, io, mode, and sourcetype, and reuses the storage file format completer for subdriver. In virshDomainAttachDiskSourceTypeCompleter, I added a static list of element types, I did not find any existing variable with the same list content. Partially-fixes: https://gitlab.com/libvirt/libvirt/-/work_items/9 Radoslaw Smigielski (5): virsh: Add vshCompletePathLocalCreate completer for output paths virsh: Add completer for '--type' option of 'domdisplay' command virsh: Add completer for '--format' option of 'domxml-from-native' command virsh: Add missing TAB completers for several options virsh: Add missing TAB completers for 'attach-disk' command tools/virsh-completer-domain.c | 122 +++++++++++++++++++++++++++++++++ tools/virsh-completer-domain.h | 40 +++++++++++ tools/virsh-domain.c | 16 ++++- tools/virsh-volume.c | 2 + tools/vsh-completer.c | 18 +++++ tools/vsh-completer.h | 5 ++ 6 files changed, 202 insertions(+), 1 deletion(-) -- 2.54.0

1 5

[PATCH 0/2] bhyve: implement the virDomainRename API
by Roman Bogorodskiy 13 Jul '26

13 Jul '26

Roman Bogorodskiy (2): bhyve: implement the virDomainRename API qemu: qemuDomainRenameCallback: remove unused variables src/bhyve/bhyve_domain.c | 27 +++++++++ src/bhyve/bhyve_domain.h | 1 + src/bhyve/bhyve_driver.c | 122 +++++++++++++++++++++++++++++++++++++++ src/qemu/qemu_driver.c | 4 -- 4 files changed, 150 insertions(+), 4 deletions(-) -- 2.52.0

2 6