July 2026 - Devel - libvirt List Archives

[PATCH] NEWS: document bhyve changes for 12.6.0
by Roman Bogorodskiy 25 Jul '26

25 Jul '26

Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- NEWS.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index d4c5cfd334..c874a5443e 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -17,6 +17,11 @@ v12.6.0 (unreleased) * **New features** + * bhyve: implement ``virDomainRename()`` + + The bhyve driver now implements the ``virDomainRename()`` API + for renaming of a domain (``virsh domrename``). + * **Improvements** * **Bug fixes** -- 2.52.0

1 0

[PATCH] bhyve: clean up event thread
by Roman Bogorodskiy 25 Jul '26

25 Jul '26

Currently, eventThread cleanup is missing. Fix that by calling virBhyveDomainObjStopWorker() in virBhyveProcessStop() and un-referring the eventThread in bhyveDomainObjPrivateFree(). Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- I think it would be nice to get this in before 12.6.0. src/bhyve/bhyve_domain.c | 5 +++++ src/bhyve/bhyve_process.c | 2 ++ 2 files changed, 7 insertions(+) diff --git a/src/bhyve/bhyve_domain.c b/src/bhyve/bhyve_domain.c index d5bb22501c..b6344185b7 100644 --- a/src/bhyve/bhyve_domain.c +++ b/src/bhyve/bhyve_domain.c @@ -54,6 +54,11 @@ bhyveDomainObjPrivateFree(void *data) virDomainPCIAddressSetFree(priv->pciaddrs); + if (priv->eventThread) { + VIR_ERROR(_("Unexpected event thread still active during domain deletion")); + g_object_unref(priv->eventThread); + } + g_free(priv); } diff --git a/src/bhyve/bhyve_process.c b/src/bhyve/bhyve_process.c index 636d74afcc..81f00954c2 100644 --- a/src/bhyve/bhyve_process.c +++ b/src/bhyve/bhyve_process.c @@ -675,6 +675,8 @@ virBhyveProcessStop(struct _bhyveConn *driver, if ((priv != NULL) && (priv->mon != NULL)) g_clear_pointer(&priv->mon, bhyveMonitorClose); + virBhyveDomainObjStopWorker(vm); + cmd = virBhyveProcessBuildDestroyCmd(driver, vm->def); if (virCommandRun(cmd, NULL) < 0) { /* Only failure of the actual destroy command warrants unsuccessful return code, -- 2.52.0

1 0

[PATCH 0/3] bhyve: fix a few memory leaks
by Roman Bogorodskiy 25 Jul '26

25 Jul '26

Roman Bogorodskiy (3): bhyve: fix memory leak in bhyveBuildVirtioSerialControllerArgStr() network: pf: fix memory leaks bhyve: fix memory leak in bhyveStateCleanup() src/bhyve/bhyve_command.c | 4 +++- src/bhyve/bhyve_driver.c | 1 + src/network/network_pf.c | 20 +++++++++++++------- 3 files changed, 17 insertions(+), 8 deletions(-) -- 2.52.0

2 4

[PATCH] NEWS: Update with recent feature additions
by Jim Fehlig 25 Jul '26

25 Jul '26

From: Jim Fehlig <jfehlig(a)suse.com> Add NEWS entries for the new libvirtd build option and new sanlock plugin setting. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- NEWS.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index d4c5cfd334..e986cf8c9a 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -17,6 +17,17 @@ v12.6.0 (unreleased) * **New features** + * build: Add option to control building libvirtd + + Meson option ``libvirtd`` has been added to control building the monolithic + libvirtd, independent from the stateful, daemon-based drivers. + + * sanlock: Add option to check ownership of disk leases + + The sanlock lock driver plugin now supports the ``check_disk_lease_owner`` + setting in sanlock.conf. When enabled, the sanlock plugin will check that + leases are owned by the domain attempting to acquire them. + * **Improvements** * **Bug fixes** -- 2.51.0

2 2

Incorrent lookup function argument types in libvirt-python API binding
by Krzysztoff 24 Jul '26

24 Jul '26

For some time now I've been developing an app using the libvirt-python package. I think I might have spotted an issue with *lookupByUUID* and *lookupByUUIDString* functions. First of all, when these functions are passed an argument (machine UUID) they require it to be in a specific format (16 byte string), however, *there is virtually no information about this in the documentation* about this - I managed to find out about this by testing it manually. Hypothetically - let's take *machine_uuid* of type UUID. 1. This will throw an error: [...].lookupByUUID(machine_uuid) 2. This will work properly: [...].lookupByUUID(machine_uuid.*bytes*) Secondly, in the newest version of libvirt-python (12.5.0) the expected argument type of function *lookupByUUID* has been changed to *str*. This causes Python interpreter to highlight all occurrences of lookupByUUID and show errors: Argument of type "bytes" cannot be assigned to parameter "uuid" of type > "str" in function "lookupByUUID" > "bytes" is not assignable to "str" Weirdly enough, no actual runtime error is thrown and the lookups work perfectly fine. However if the argument is actually casted to str the lookup fails with virDomainLookupByUUIDString() failed error. More importantly - this change in the argument type makes absolutely no sense, since now the function lookupByUUID requires exactly the same argument as lookupByUUIDString - I suppose these functions were supposed to do different things but now they work exactly the same. def lookupByUUID(self, uuid: "str") -> "virDomain": > """Try to lookup a domain on the given hypervisor based on its > UUID. """ > ret = libvirtmod.virDomainLookupByUUID(self._o, uuid) > if ret is None: > raise libvirtError('virDomainLookupByUUID() failed') > __tmp = virDomain(self, _obj=ret) > return __tmp > > def lookupByUUIDString(self, uuidstr: "str") -> "virDomain": > """Try to lookup a domain on the given hypervisor based on its UUID > virDomainFree should be used to free the resources after the > domain object is no longer needed. """ > ret = libvirtmod.virDomainLookupByUUIDString(self._o, uuidstr) > if ret is None: > raise libvirtError('virDomainLookupByUUIDString() failed') > __tmp = virDomain(self, _obj=ret) > return __tmp Best regards, Krzysztoff

1 0

[PATCH 1/2] util: Guard against integer overflow in nexttimer
by Yong Chen 24 Jul '26

24 Jul '26

The 'nexttimer' variable is a static int that starts at 1 and is incremented every time a new timeout is registered via virEventGLibTimeoutAdd. After running for a long period of time (many months/years with frequent client connections), nexttimer can overflow past INT_MAX and become negative. A negative timer ID causes multiple problems: 1. virKeepAliveStart: 'if (ka->timer < 0)' returns true, skipping virObjectRef() which is needed to hold the timer's reference to the keepalive object. This leads to premature object freeing. 2. virKeepAliveStop: 'if (ka->timer > 0)' returns false, skipping virEventRemoveTimeout(). The GSource is never destroyed, causing a use-after-free when the timer fires on the freed object. 3. virNetServerClientNew: 'if (client->sockTimer < 0)' returns true, causing client creation to fail with 'Connection reset by peer'. In a production environment running for 1 year and 8 months, nexttimer overflowed and accumulated 282 million leaked timer entries, consuming 19.6GB of memory. Fix by resetting nexttimer to 1 when it overflows below 1, ensuring timer IDs are always positive. Signed-off-by: Yong Chen <410664530(a)qq.com> --- src/util/vireventglib.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/util/vireventglib.c b/src/util/vireventglib.c index 6c54f62123..6fe23b3b7d 100644 --- a/src/util/vireventglib.c +++ b/src/util/vireventglib.c @@ -341,6 +341,9 @@ virEventGLibTimeoutAdd(int interval, data = g_new0(struct virEventGLibTimeout, 1); data->timer = nexttimer++; + /* Guard against integer overflow: timer IDs must be positive */ + if (nexttimer < 1) + nexttimer = 1; data->interval = interval; data->cb = cb; data->opaque = opaque; -- 2.55.0.windows.3

2 1

[libvirt PATCH] build: Check for directory in the git_werror check
by Ján Tomko 23 Jul '26

23 Jul '26

From: Jordan Petridis <jpetridis(a)gnome.org> test -e will only check if something exists, but -d is more appropriate as it will check that it exists and is also a directory. Signed-off-by: Jordan Petridis <jpetridis(a)gnome.org> Reviewed-by: Ján Tomko <jtomko(a)redhat.com> --- Pushed meson.build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meson.build b/meson.build index ad1a5da1a5..6d5085042c 100644 --- a/meson.build +++ b/meson.build @@ -21,7 +21,7 @@ po_dir = meson.project_source_root() / 'po' # figure out if we are building from git -git = run_command('test', '-e', '.git', check: false).returncode() == 0 +git = run_command('test', '-d', '.git', check: false).returncode() == 0 if git and not get_option('no_git') run_command('git', 'submodule', 'update', '--init', check: true) -- 2.55.0

1 0

[PATCH 2/2] rpc: Use != -1 instead of > 0 for timer ID checks
by Yong Chen 23 Jul '26

23 Jul '26

The timer ID stored in ka->timer uses -1 as the sentinel value meaning 'not initialized' (set in virKeepAliveNew). The checks in virKeepAliveStop and virKeepAliveDispose used '> 0' or '>= 0' to determine whether a timer is active. However, if nexttimer overflows (see previous fix in vireventglib.c), ka->timer can be a negative value other than -1 (e.g., -2147483648). In that case: - 'if (ka->timer > 0)' returns false -> virEventRemoveTimeout skipped - 'if (ka->timer >= 0)' returns false -> virEventRemoveTimeout skipped This leaves the GSource active after the keepalive object is freed, causing a use-after-free with 'bad magic number' warnings in the log. Fix by changing the checks to 'if (ka->timer != -1)', which correctly handles both positive and negative timer IDs while still skipping the sentinel value -1. Additionally, add the same check in virKeepAliveDispose as a safety net: if the object's refcount reaches 0 due to a race condition or reference counting bug, the timer must be stopped before the object is freed. Signed-off-by: Yong Chen <410664530(a)qq.com> --- src/rpc/virkeepalive.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/src/rpc/virkeepalive.c b/src/rpc/virkeepalive.c index 690bc08b2e..4e7dd25d3c 100644 --- a/src/rpc/virkeepalive.c +++ b/src/rpc/virkeepalive.c @@ -218,6 +218,18 @@ virKeepAliveDispose(void *obj) PROBE(RPC_KEEPALIVE_DISPOSE, "ka=%p", ka); + /* Ensure the timer is stopped before freeing the object. + * This is a safety net: normally virKeepAliveStop is called + * before the object's refcount reaches 0, but in case of + * race conditions or reference counting bugs, we must not + * leave a dangling timer that would trigger use-after-free. + * Use != -1 (not >= 0) to also handle negative timer IDs + * caused by nexttimer integer overflow. */ + if (ka->timer != -1) { + virEventRemoveTimeout(ka->timer); + ka->timer = -1; + } + ka->freeCB(ka->client); } @@ -301,7 +313,7 @@ virKeepAliveStop(virKeepAlive *ka) "ka=%p client=%p", ka, ka->client); - if (ka->timer > 0) { + if (ka->timer ！= -1) { virEventRemoveTimeout(ka->timer); ka->timer = -1; } -- 2.55.0.windows.3

1 0

[PATCH 0/2] Fix use-after-free caused by timer ID integer overflow
by Yong Chen 23 Jul '26

23 Jul '26

The 'nexttimer' counter in vireventglib.c is a static int starting at 1, incremented for every new timeout registration. After running for a long period (1+ years with frequent client connections), it overflows past INT_MAX and becomes negative. A negative timer ID causes multiple issues: 1. virKeepAliveStart: skips virObjectRef(), leaving the keepalive object with only 1 reference (should be 2). When the connection closes, virObjectUnref() drops refcount to 0, freeing the object while the GSource is still active -> use-after-free with 'bad magic number' logs. 2. virKeepAliveStop: skips virEventRemoveTimeout(), the GSource is never destroyed, continuing to fire on freed memory. 3. virNetServerClientNew: sockTimer creation fails, all new connections rejected with 'Connection reset by peer'. In production (libvirtd running 1 year 8 months), this caused: - 1 leaked keepalive GSource (use-after-free, continuous 'bad magic' logs) - 282 million leaked sockTimer structures (19.6GB RSS) - All virsh commands failing with 'Connection reset by peer' Patch 1: Prevent nexttimer overflow in vireventglib.c (root cause fix) Patch 2: Fix timer ID checks in virkeepalive.c (defensive fix, use != -1 instead of > 0 to handle negative IDs) Yong Chen (2): util: Guard against integer overflow in nexttimer rpc: Use != -1 instead of > 0 for timer ID checks src/rpc/virkeepalive.c | 14 +++++++++++++- src/util/vireventglib.c | 3 +++ 2 files changed, 16 insertions(+), 1 deletion(-) -- 2.55.0.windows.3

1 0

[PATCH 00/13] qemu: Refactor panic action handling and introduce 'preserve-running' action for <on_crash>
by Peter Krempa 23 Jul '26

23 Jul '26

See last patch for justification of the new feature, the rest of the patches cleans up existing code. Peter Krempa (13): qemu: Always assume support for 'QEMU_CAPS_SET_ACTION' qemu: Remove unused 'qemuProcessRebootAllowed' qemu: monitor: Remove support for 'watchdog-set-action' qemu: Remove 'allowReboot' field qemu: capabilities: Retire QEMU_CAPS_SET_ACTION qemuProcessSetupLifecycleActions: Prepare to handle other actions qemuDomainModifyLifecycleActionLive: Prepare to handle other actions processGuestPanicEvent: Don't pass panic action via parameter conf: Use proper enum types for 'onReboot', 'onPoweroff', 'onCrash', and 'onLockFailure' qemuMonitorGuestPanicEventInfoFormatMsg: Directly return message qemuProcessGuestPanicEventInfo: Fold into only caller qemu: processGuestPanicEvent: Split individual steps under separate conditions Add support for keeping VM running when panic notifier is used docs/formatdomain.rst | 3 + include/libvirt/libvirt-domain.h | 1 + src/conf/domain_conf.c | 12 +- src/conf/domain_conf.h | 9 +- src/conf/schemas/domaincommon.rng | 2 + src/libxl/libxl_conf.c | 1 + src/libxl/libxl_domain.c | 3 + src/libxl/xen_common.c | 10 +- src/qemu/qemu_capabilities.c | 3 +- src/qemu/qemu_capabilities.h | 2 +- src/qemu/qemu_command.c | 13 +- src/qemu/qemu_domain.c | 33 --- src/qemu/qemu_domain.h | 17 -- src/qemu/qemu_driver.c | 189 +++++++++++------- src/qemu/qemu_hotplug.c | 10 +- src/qemu/qemu_monitor.c | 52 ++--- src/qemu/qemu_monitor.h | 4 - src/qemu/qemu_monitor_json.c | 22 -- src/qemu/qemu_monitor_json.h | 5 - src/qemu/qemu_process.c | 88 +++----- src/qemu/qemu_process.h | 2 - src/qemu/qemu_validate.c | 14 +- .../caps_10.0.0_aarch64.xml | 1 - .../caps_10.0.0_ppc64.xml | 1 - .../caps_10.0.0_s390x.xml | 1 - .../caps_10.0.0_x86_64+amdsev.xml | 1 - .../caps_10.0.0_x86_64.xml | 1 - .../caps_10.1.0_s390x.xml | 1 - .../caps_10.1.0_x86_64+inteltdx.xml | 1 - .../caps_10.1.0_x86_64.xml | 1 - .../caps_10.2.0_aarch64.xml | 1 - .../caps_10.2.0_x86_64+mshv.xml | 1 - .../caps_10.2.0_x86_64.xml | 1 - .../caps_11.0.0_aarch64.xml | 1 - .../caps_11.0.0_s390x.xml | 1 - .../caps_11.0.0_x86_64+sgx.xml | 1 - .../caps_11.0.0_x86_64.xml | 1 - .../caps_11.1.0_aarch64.xml | 1 - .../caps_11.1.0_x86_64.xml | 1 - tests/qemucapabilitiesdata/caps_7.2.0_ppc.xml | 1 - .../caps_7.2.0_x86_64+hvf.xml | 1 - .../caps_7.2.0_x86_64.xml | 1 - .../caps_8.0.0_x86_64.xml | 1 - .../qemucapabilitiesdata/caps_8.1.0_s390x.xml | 1 - .../caps_8.1.0_x86_64.xml | 1 - .../caps_8.2.0_aarch64.xml | 1 - .../caps_8.2.0_armv7l.xml | 1 - .../caps_8.2.0_loongarch64.xml | 1 - .../qemucapabilitiesdata/caps_8.2.0_s390x.xml | 1 - .../caps_8.2.0_x86_64.xml | 1 - .../qemucapabilitiesdata/caps_9.0.0_sparc.xml | 1 - .../caps_9.0.0_x86_64.xml | 1 - .../caps_9.1.0_riscv64.xml | 1 - .../qemucapabilitiesdata/caps_9.1.0_s390x.xml | 1 - .../caps_9.1.0_x86_64.xml | 1 - .../caps_9.2.0_aarch64+hvf.xml | 1 - .../qemucapabilitiesdata/caps_9.2.0_s390x.xml | 1 - .../caps_9.2.0_x86_64+amdsev.xml | 1 - .../caps_9.2.0_x86_64.xml | 1 - .../qemustatusxml2xmldata/backup-pull-in.xml | 1 - .../blockjob-blockdev-in.xml | 1 - .../blockjob-mirror-in.xml | 1 - .../memory-backing-dir-in.xml | 1 - .../migration-in-params-in.xml | 1 - .../migration-out-nbd-bitmaps-in.xml | 1 - .../migration-out-nbd-out.xml | 1 - .../migration-out-nbd-tls-out.xml | 1 - .../migration-out-params-in.xml | 1 - tests/qemustatusxml2xmldata/modern-in.xml | 1 - .../qcow2-data-file-in.xml | 1 - .../throttlefilter-out.xml | 1 - tests/qemustatusxml2xmldata/upgrade-out.xml | 1 - .../qemustatusxml2xmldata/vcpus-multi-in.xml | 1 - .../async-teardown.x86_64-latest.xml | 2 +- tests/qemuxmlconfdata/async-teardown.xml | 2 +- tests/qemuxmlconftest.c | 1 + tools/virsh-domain.c | 3 +- 77 files changed, 209 insertions(+), 345 deletions(-) -- 2.55.0

2 19

[PATCH 0/6] qemu: add poll-weight support for iothreads
by Jaehoon Kim 22 Jul '26

22 Jul '26

This series adds support for the QEMU iothread poll-weight property, which controls the weight of the most recent event interval in the adaptive polling duration calculation. The valid range is [0, 63]; a value of 0 lets QEMU use its default weight. The series is split by layer: 1) conf/schema support 2) qemu capability detection 3) qemu backend support + public API constants + xmlconf tests 4) virsh support + test driver + virshtest 5) docs: fix pre-existing typos in iothread poll element description 6) docs: formatdomain documentation for poll-weight The series was validated with: meson test -C build virschematest meson test -C build qemucapabilitiestest meson test -C build qemuxmlconftest meson test -C build virshtest meson test -C build genericxml2xmltest QEMU commits: 9fea80ddf0 qapi/iothread: introduce poll-weight parameter for aio-poll 9563d0b5e2 aio-poll: refine iothread polling using weighted handler intervals ed21d9d65c aio-poll: avoid unnecessary polling time computation Jaehoon Kim (6): conf: add iothread poll-weight XML support qemu: capabilities: add capability for iothread poll-weight qemu: support iothread poll-weight virsh: add support for iothread poll-weight docs: fix typos in iothread poll element description docs: formatdomain: document iothread poll-weight docs/formatdomain.rst | 14 +++-- docs/manpages/virsh.rst | 18 ++++-- include/libvirt/libvirt-domain.h | 26 +++++++++ src/conf/domain_conf.c | 14 ++++- src/conf/domain_conf.h | 2 + src/conf/schemas/domaincommon.rng | 7 +++ src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 18 +++++- src/qemu/qemu_driver.c | 38 ++++++++++++ src/qemu/qemu_monitor.h | 2 + src/qemu/qemu_monitor_json.c | 18 ++++++ src/qemu/qemu_validate.c | 10 +++- src/test/test_driver.c | 12 ++++ tests/genericxml2xmlindata/iothreadids.xml | 2 +- .../caps_11.1.0_aarch64.xml | 1 + .../caps_11.1.0_x86_64.xml | 1 + ...othreads-ids-poll-weight.x86_64-11.0.0.err | 1 + ...threads-ids-poll-weight.x86_64-latest.args | 40 +++++++++++++ ...othreads-ids-poll-weight.x86_64-latest.xml | 58 +++++++++++++++++++ .../iothreads-ids-poll-weight.xml | 58 +++++++++++++++++++ tests/qemuxmlconftest.c | 2 + tests/virshtestdata/iothreads.in | 2 + tests/virshtestdata/iothreads.out | 18 ++++++ tools/virsh-domain.c | 18 ++++++ 25 files changed, 367 insertions(+), 16 deletions(-) create mode 100644 tests/qemuxmlconfdata/iothreads-ids-poll-weight.x86_64-11.0.0.err create mode 100644 tests/qemuxmlconfdata/iothreads-ids-poll-weight.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iothreads-ids-poll-weight.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iothreads-ids-poll-weight.xml -- 2.54.0

1 6

[PATCH] vbox: fix memory leak in vboxStartMachine()
by Elizaveta Tereshkina 22 Jul '26

22 Jul '26

vboxStartMachine() allocates sdlDisplay via g_strdup() and doesn't free it. Add VIR_FREE. Fixes: 3f4f0ef47d (vbox: Fix starting domains) Signed-off-by: Elizaveta Tereshkina <teryoshkina.ea(a)gmail.com> --- src/vbox/vbox_common.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/vbox/vbox_common.c b/src/vbox/vbox_common.c index 65ae9cc651..a47183927d 100644 --- a/src/vbox/vbox_common.c +++ b/src/vbox/vbox_common.c @@ -2252,6 +2252,7 @@ vboxStartMachine(virDomainPtr dom, int maxDomID, IMachine *machine) VBOX_UTF8_TO_UTF16(displayutf8, &env); VIR_FREE(displayutf8); VIR_FREE(guiDisplay); + VIR_FREE(sdlDisplay); VBOX_UTF8_TO_UTF16(sessType, &sessionType); } else if (vrdpPresent) { -- 2.39.2

2 2

[PATCH for 11.1] crypto: deprecate the AF_ALG crypto backend
by Daniel P. Berrangé 22 Jul '26

22 Jul '26

Linux 7.1 has deprecated the AF_ALG crypto backend: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… And has documented it to be always slower than userspace crypto: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… as a result of dropping support for zero-copy and hardware accelerators: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… The main use case for the AF_ALG impl was to improve the performance of virtio-crypto with the cryptodev-backend-builtin driver. In practice this did not matter since 'cryptodev-backend-lkcf' can do offload to the kernel via the keyctl syscall, and 'cryptodev-vhost-user' can offload to an external process which can optionally integrate with hardware accelerators without kernel assistance. The AF_ALG backend has no user visible configuration options at runtime, it is unconditionally tried with any use of the cipher APIs. So it does not strictly have to go through the deprecation process, however, it is left available initially in case there was an unexpected use case that relies on it which may be faster with old kernels before the above Linux commits. Suggested-by: Thomas Huth <thuth(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- docs/about/deprecated.rst | 21 +++++++++++++++++++++ meson.build | 6 ++++++ 2 files changed, 27 insertions(+) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 0c656a968f..54b2662752 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -416,6 +416,27 @@ ABI is long-obsolete. We are therefore deprecating both OABI support and NWFPE emulation, and they will be removed in a future QEMU release. +Build features +-------------- + +Crypto AF_ALG backend +--------------------- + +The use of the AF_ALG backend for cryptography has been deprecated +with no replacement. + +The AF_ALG interface is deprecated by Linux 7.1 and all support +for hardware accelerators has been removed. It will thus always be +slower than userspace crypto due to the overhead of copying data +to kernel space. The GNUTLS, Nettle and GCrypt libraries supported +by QEMU all include a variety of hardware optimized crypto +implementations which should suffice for typical needs. + +For the virtio-crypto device, the 'cryptodev-backend-lkcf' backend +can offload some operations to the kernel via the keyctl syscall, +and the 'cryptodev-vhost-user' backend can offload the device +backend to an external process which can integrate with crypto +accelerators. Backwards compatibility ----------------------- diff --git a/meson.build b/meson.build index 164328ded8..02cbe6445a 100644 --- a/meson.build +++ b/meson.build @@ -5053,3 +5053,9 @@ if not actually_reloc and (host_os == 'windows' or get_option('relocatable')) message('QEMU will have to be installed under ' + get_option('prefix') + '.') message('Use --disable-relocatable to remove this warning.') endif + +if get_option('crypto_afalg').enabled() + warning('Use of the AF_ALG crypto backend is deprecated, ' + + 'since Linux 7.1 has deprecated the AF_ALG interface ' + + 'and removed its ability to use hardware accelerators.') +endif -- 2.55.0

3 4

[PATCH 0/4] qemu: auto-select win-dmp for Windows guest crash dumps
by Denis V. Lunev 22 Jul '26

22 Jul '26

Auto-triggered dumps (on_crash, watchdog) always use QEMU's elf default, which is not WinDbg-loadable for a Windows guest and cannot be reliably converted after the fact. This was proposed before as a per-domain XML knob (https://www.mail-archive.com/devel@lists.libvirt.org/msg09638.html) Daniel P. Berrange objected: QEMU's query-dump-guest-memory-capability reported win-dmp as available on any x86-64 guest regardless of whether it had actually published a Windows dump header, so trusting it was not safe. QEMU's win_dump_available() has since been fixed to check the guest's vmcoreinfo note (https://lore.kernel.org/qemu-devel/20260619101834.228432-1-den@openvz.org/, commit b4bdad7dce). Patch 1 queries it directly instead of adding an XML knob. Patch 4 adds a quota (auto_dump_max_size): a guest that keeps crashing otherwise fills auto_dump_path one dump at a time. Oldest dumps are pruned after each new one; the dump just written is never removed, even alone over quota. Patches 2-3 give that setting and virtlogd's max_size a "10GiB"-style syntax instead of a raw byte count, reusing virScaleInteger()'s existing unit table. Validated against real guests: a Windows Server 2022 guest crashed via Sysinternals NotMyFault produces a PAGEDU64 (win-dmp) dump; an AlmaLinux 9 guest crashed via sysrq produces an ELF one. A 1GiB quota across two Linux crashes pruned the older dump and kept the newer, over-quota one. syntax-check and virstringtest pass. Denis V. Lunev (4): qemu: auto-select win-dmp for crash- and watchdog-triggered dumps util: add virStrToBytes() and virConfGetValueBytes() for scaled sizes logging: accept a unit suffix in virtlogd's max_size qemu: cap total size of auto-triggered dumps under auto_dump_path src/libvirt_private.syms | 2 + src/logging/log_daemon_config.c | 2 +- src/logging/log_daemon_config.h | 2 +- src/logging/virtlogd.conf | 7 +- src/qemu/qemu.conf.in | 16 ++++ src/qemu/qemu_conf.c | 2 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_driver.c | 127 +++++++++++++++++++++++++++++++- src/util/virconf.c | 47 ++++++++++++ src/util/virconf.h | 3 + src/util/virutil.c | 23 ++++++ src/util/virutil.h | 5 ++ tests/virstringtest.c | 76 +++++++++++++++++++ 13 files changed, 308 insertions(+), 5 deletions(-) -- 2.53.0

3 8

[PATCH 1/1] remote: fix stale status snapshot in daemonStreamHandleWrite
by Denis V. Lunev 22 Jul '26

22 Jul '26

daemonStreamHandleWrite() snapshots status from msg->header.status before dispatching to the per-type handler, then reuses that stale snapshot afterwards to decide whether to send a fake release reply. A stale snapshot lets it send that reply twice for the same 'msg', linking the message to itself and deadlooping the event loop thread in virNetMessageQueuePush()'s tail-walk loop. Remove the 'status' variable and read msg->header.status directly at the point of use instead. Commit 411cbe7199c ("remote: fix stream use-after-free") introduced it alongside its real fix: it also moved virNetMessageQueueServe() to dequeue 'msg' from stream->rx before dispatch instead of after, which is what actually prevents corrupting stream->rx's linkage and remains unchanged here. The variable itself was never load-bearing: no dispatch handler frees 'msg' on the path that reaches this check, so reading msg->header.status straight from 'msg' cannot go stale. Fixes: 411cbe7199ce ("remote: fix stream use-after-free") Signed-off-by: Denis V. Lunev <den(a)openvz.org> --- src/remote/remote_daemon_stream.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/src/remote/remote_daemon_stream.c b/src/remote/remote_daemon_stream.c index 3777c8e684..437cec374f 100644 --- a/src/remote/remote_daemon_stream.c +++ b/src/remote/remote_daemon_stream.c @@ -736,7 +736,6 @@ static int daemonStreamHandleWrite(virNetServerClient *client, daemonClientStream *stream) { - virNetMessageStatus status = VIR_NET_OK; VIR_DEBUG("client=%p, stream=%p", client, stream); while (stream->rx && !stream->closed) { @@ -748,10 +747,8 @@ daemonStreamHandleWrite(virNetServerClient *client, * Otherwise just carry on with processing stream * data. */ ret = daemonStreamHandleHole(client, stream, msg); - status = msg->header.status; } else if (msg->header.type == VIR_NET_STREAM) { - status = msg->header.status; - switch (status) { + switch (msg->header.status) { case VIR_NET_OK: ret = daemonStreamHandleFinish(client, stream, msg); break; @@ -791,7 +788,7 @@ daemonStreamHandleWrite(virNetServerClient *client, * onto the wire, but this causes the client to reset * its active request count / throttling */ - if (status == VIR_NET_CONTINUE) { + if (msg->header.status == VIR_NET_CONTINUE) { virNetMessageClear(msg); msg->header.type = VIR_NET_REPLY; if (virNetServerClientSendMessage(client, msg) < 0) { -- 2.53.0

1 0

[libvirt-python] RFC: Adding Sphinx API documentation for Python bindings
by Radoslaw Smigielski 22 Jul '26

22 Jul '26

Hi, I'd like to propose adding generated API documentation for the libvirt-python bindings and would appreciate the community's opinion on whether this is worthwhile. The problem: The libvirt-python bindings currently have no browsable API documentation. Users who want to discover available methods, their parameters, or behavior have to either read the C API docs and map them to Python or inspect the generated libvirt.py source directly, or rely on IDE auto-completion. But in the same time the infrastructure to produce good documentation is already in place, I mean XML API descriptions libvirt-api.xml, generator.py and override files (libvirt-override-virDomain.py, etc.) also contain docstrings. These docstrings are present but are not rendered anywhere for users to browse. The proposal: Add a minimal Sphinx setup (docs/conf.py, a few .rst files, and a requirements-docs.txt) to generate HTML API reference from the existing docstrings. This would cover all four modules: libvirt, libvirt_qemu, libvirt_lxc, and libvirtaio. This is a working prototype that builds successfully and produces complete API reference pages. https://gitlab.com/rsmigiel/libvirt-python/-/commit/53b1fdeca932de7b8deffb2… Would this be a welcome change? Any concerns or suggestions on the approach? Thanks for your feedback! ---------------------- < Tℏanks | Radek >

1 0

[PATCH 0/4] API docs fixes
by Peter Krempa 21 Jul '26

21 Jul '26

Peter Krempa (4): libvirt-domain: Use consistent flag names for APIs declaring use of 'virDomainDeviceModifyFlags' libvirt-qemu: Add reference to QMP protocol documentation libvirt-qemu: Document that 'virDomainQemuAttach' no longer works libvirt-qemu: Add reference to QEMU agent protocol syntax src/libvirt-domain.c | 24 ++++++++++++------------ src/libvirt-qemu.c | 17 ++++++++++++++++- 2 files changed, 28 insertions(+), 13 deletions(-) -- 2.55.0

2 5

[PATCH v19 03/15] net/tap: deprecate "no" as special value for script/downscript
by Vladimir Sementsov-Ogievskiy 21 Jul '26

21 Jul '26

The interface is ambiguous, as "no" is valid file name. So, using "no" as a special value to disable script is deprecated. Use an empty string ("script=" / "downscript=") instead. In a future version, "no" will be treated as a plain file name, just like any other non-empty value. Document the deprecation in docs/about/deprecated.rst, qapi/net.json, and qemu-options.hx. Update other docs to use empty string instead of "no". Add a warning. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> --- docs/about/deprecated.rst | 18 ++++++++++++++ docs/system/i386/microvm.rst | 4 +-- docs/system/i386/xenpvh.rst | 2 +- docs/system/ppc/ppce500.rst | 4 +-- docs/system/riscv/microchip-icicle-kit.rst | 2 +- docs/system/riscv/sifive_u.rst | 2 +- net/tap.c | 29 ++++++++++++++-------- qapi/net.json | 12 ++++++--- qemu-options.hx | 7 ++++-- 9 files changed, 56 insertions(+), 24 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 0c656a968fc..c4929317e3a 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -71,6 +71,15 @@ flexible enough. The monitor objects have been converted to QOM, so ``-mon mode=control`` is replaced by ``-object monitor-qmp``. The short convenience options are not deprecated, only ``-mon``. +``script=no`` and ``downscript=no`` for ``-netdev tap`` (since 11.2) +''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +The special value ``"no"`` for the ``script`` and ``downscript`` +parameters of ``-netdev tap`` disables script execution. This special +treatment of ``"no"`` is deprecated. Use an empty string (``script=`` +or ``downscript=``) to disable script execution instead. In a future +version, ``"no"`` will be treated as a plain file name. + QEMU Machine Protocol (QMP) commands ------------------------------------ @@ -164,6 +173,15 @@ Use ``job-finalize`` instead. Use ``query-accelerators`` instead. +``"no"`` as value of ``script``/``downscript`` for tap in ``netdev_add`` (since 11.2) +''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +The special value ``"no"`` for the ``script`` and ``downscript`` +parameters of ``netdev_add`` with ``type=tap`` disables script +execution. This special treatment of ``"no"`` is deprecated. Use an +empty string instead. In a future version, ``"no"`` will be treated as +a plain file name. + Human Machine Protocol (HMP) commands ------------------------------------- diff --git a/docs/system/i386/microvm.rst b/docs/system/i386/microvm.rst index 1675e37d3e7..077ea15751e 100644 --- a/docs/system/i386/microvm.rst +++ b/docs/system/i386/microvm.rst @@ -79,7 +79,7 @@ legacy ``ISA serial`` device as console:: -serial stdio \ -drive id=test,file=test.img,format=raw,if=none \ -device virtio-blk-device,drive=test \ - -netdev tap,id=tap0,script=no,downscript=no \ + -netdev tap,id=tap0,script=,downscript= \ -device virtio-net-device,netdev=tap0 While the example above works, you might be interested in reducing the @@ -103,7 +103,7 @@ disabled:: -device virtconsole,chardev=virtiocon0 \ -drive id=test,file=test.img,format=raw,if=none \ -device virtio-blk-device,drive=test \ - -netdev tap,id=tap0,script=no,downscript=no \ + -netdev tap,id=tap0,script=,downscript= \ -device virtio-net-device,netdev=tap0 diff --git a/docs/system/i386/xenpvh.rst b/docs/system/i386/xenpvh.rst index 904778e3f5c..862f38830b1 100644 --- a/docs/system/i386/xenpvh.rst +++ b/docs/system/i386/xenpvh.rst @@ -42,7 +42,7 @@ case you need to construct one manually: -vnc none \ -display none \ -device virtio-net-pci,id=nic0,netdev=net0,mac=00:16:3e:5c:81:78 \ - -netdev type=tap,id=net0,ifname=vif3.0-emu,br=xenbr0,script=no,downscript=no \ + -netdev type=tap,id=net0,ifname=vif3.0-emu,br=xenbr0,script=,downscript= \ -smp 4,maxcpus=4 \ -nographic \ -machine xenpvh,ram-low-base=0,ram-low-size=2147483648,ram-high-base=4294967296,ram-high-size=2147483648,pci-ecam-base=824633720832,pci-ecam-size=268435456,pci-mmio-base=4026531840,pci-mmio-size=33554432,pci-mmio-high-base=824902156288,pci-mmio-high-size=68719476736 \ diff --git a/docs/system/ppc/ppce500.rst b/docs/system/ppc/ppce500.rst index c9fe0915dc5..ec5aaf14fd9 100644 --- a/docs/system/ppc/ppce500.rst +++ b/docs/system/ppc/ppce500.rst @@ -158,14 +158,14 @@ interface at PCI address 0.1.0, but we can switch that to an e1000 NIC by: $ qemu-system-ppc64 -M ppce500 -smp 4 -m 2G \ -display none -serial stdio \ -bios u-boot \ - -nic tap,ifname=tap0,script=no,downscript=no,model=e1000 + -nic tap,ifname=tap0,script=,downscript=,model=e1000 The QEMU ``ppce500`` machine can also dynamically instantiate an eTSEC device if “-device eTSEC” is given to QEMU: .. code-block:: bash - -netdev tap,ifname=tap0,script=no,downscript=no,id=net0 -device eTSEC,netdev=net0 + -netdev tap,ifname=tap0,script=,downscript=,id=net0 -device eTSEC,netdev=net0 Root file system on flash drive ------------------------------- diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst index 9809e94b84b..7fdb96601ad 100644 --- a/docs/system/riscv/microchip-icicle-kit.rst +++ b/docs/system/riscv/microchip-icicle-kit.rst @@ -84,7 +84,7 @@ Then we can boot the machine by: $ qemu-system-riscv64 -M microchip-icicle-kit -smp 5 -m 2G \ -sd path/to/sdcard.img \ -nic user,model=cadence_gem \ - -nic tap,ifname=tap,model=cadence_gem,script=no \ + -nic tap,ifname=tap,model=cadence_gem,script= \ -display none -serial stdio \ -kernel path/to/u-boot/build/dir/u-boot.bin \ -dtb path/to/u-boot/build/dir/u-boot.dtb diff --git a/docs/system/riscv/sifive_u.rst b/docs/system/riscv/sifive_u.rst index 8f55ae8e313..0e4dcf3e70c 100644 --- a/docs/system/riscv/sifive_u.rst +++ b/docs/system/riscv/sifive_u.rst @@ -199,7 +199,7 @@ To boot the VxWorks kernel in QEMU with the ``sifive_u`` machine, use: $ qemu-system-riscv64 -M sifive_u -smp 5 -m 2G \ -display none -serial stdio \ - -nic tap,ifname=tap0,script=no,downscript=no \ + -nic tap,ifname=tap0,script=,downscript= \ -kernel /path/to/vxWorks \ -append "gem(0,0)host:vxWorks h=192.168.200.1 e=192.168.200.2:ffffff00 u=target pw=vxTarget f=0x01" diff --git a/net/tap.c b/net/tap.c index fedd48c48d2..2e94b4015f6 100644 --- a/net/tap.c +++ b/net/tap.c @@ -92,34 +92,40 @@ static void launch_script(const char *setup_script, const char *ifname, static void tap_send(void *opaque); static void tap_writable(void *opaque); -static bool tap_is_explicit_no_script(const char *script_arg) +static bool tap_is_explicit_no_script(const char *script_arg_name, + const char *script_arg_value) { - if (!script_arg) { + if (!script_arg_value) { return false; } - if (script_arg[0] == '\0') { + if (script_arg_value[0] == '\0') { return true; } - if (strcmp(script_arg, "no") == 0) { + if (strcmp(script_arg_value, "no") == 0) { + warn_report("%s=no is deprecated; use %s= instead " + "(empty string instead of 'no')", + script_arg_name, script_arg_name); return true; } return false; } -static char *tap_parse_script(const char *script_arg, const char *default_path) +static char *tap_parse_script(const char *script_arg_name, + const char *script_arg_value, + const char *default_path) { - if (tap_is_explicit_no_script(script_arg)) { + if (tap_is_explicit_no_script(script_arg_name, script_arg_value)) { return NULL; } - if (!script_arg) { + if (!script_arg_value) { return get_relocated_path(default_path); } - return g_strdup(script_arg); + return g_strdup(script_arg_value); } static void tap_update_fd_handler(TAPState *s) @@ -740,7 +746,7 @@ static bool net_init_tap_one(const NetdevTapOptions *tap, NetClientState *peer, qemu_set_info_str(&s->nc, "helper=%s", tap->helper); } else { qemu_set_info_str(&s->nc, "ifname=%s,script=%s,downscript=%s", ifname, - script ?: "no", downscript ?: "no"); + script ?: "", downscript ?: ""); if (downscript) { snprintf(s->down_script, sizeof(s->down_script), "%s", downscript); @@ -946,9 +952,10 @@ int net_init_tap(const Netdev *netdev, const char *name, } } else { g_autofree char *script = - tap_parse_script(tap->script, DEFAULT_NETWORK_SCRIPT); + tap_parse_script("script", tap->script, DEFAULT_NETWORK_SCRIPT); g_autofree char *downscript = - tap_parse_script(tap->downscript, DEFAULT_NETWORK_DOWN_SCRIPT); + tap_parse_script("downscript", tap->downscript, + DEFAULT_NETWORK_DOWN_SCRIPT); if (tap->ifname) { pstrcpy(ifname, sizeof ifname, tap->ifname); diff --git a/qapi/net.json b/qapi/net.json index 8f0915c4d86..ada0329ef9d 100644 --- a/qapi/net.json +++ b/qapi/net.json @@ -399,15 +399,19 @@ # @fds: multiple file descriptors of already opened multiqueue capable # tap # -# @script: script to initialize the interface. An empty string or -# "no" disables script execution. Defaults to +# @script: script to initialize the interface. An empty string +# disables script execution. Defaults to # ``<sysconfdir>/qemu-ifup``, where ``<sysconfdir>`` is the # system configuration directory at build time (typically /etc). +# Using "no" to disable script execution is deprecated (since +# 11.2); use an empty string instead. # -# @downscript: script to shut down the interface. An empty string or -# "no" disables script execution. Defaults to +# @downscript: script to shut down the interface. An empty string +# disables script execution. Defaults to # ``<sysconfdir>/qemu-ifdown``, where ``<sysconfdir>`` is the # system configuration directory at build time (typically /etc). +# Using "no" to disable script execution is deprecated (since +# 11.2); use an empty string instead. # # @br: bridge name (since 2.8) # diff --git a/qemu-options.hx b/qemu-options.hx index 200949655ea..7b9a14f5b38 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -3014,7 +3014,8 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " use network scripts 'file' (default=" DEFAULT_NETWORK_SCRIPT ")\n" " to configure it and 'dfile' (default=" DEFAULT_NETWORK_DOWN_SCRIPT ")\n" " to deconfigure it\n" - " use '[down]script=no' or '[down]script=' to disable script execution\n" + " use '[down]script=' to disable script execution\n" + " ('[down]script=no' is deprecated and will be treated as a file name in future)\n" " use network helper 'helper' (default=" DEFAULT_BRIDGE_HELPER ") to\n" " configure it\n" " use 'fd=h' to connect to an already opened TAP interface\n" @@ -3553,7 +3554,9 @@ SRST ``<sysconfdir>/qemu-ifup`` and the default network deconfigure script is ``<sysconfdir>/qemu-ifdown``, where ``<sysconfdir>`` is the system configuration directory at build time (typically ``/etc``). - Use ``[down]script=no`` or ``[down]script=`` to disable script execution. + Use ``[down]script=`` to disable script execution. + Using ``[down]script=no`` is deprecated; in a future version it will + be treated as a plain file name. If running QEMU as an unprivileged user, use the network helper to configure the TAP interface and attach it to the bridge. -- 2.43.0

2 1

Plans for 12.6.0 release (freeze on 2026-07-27)
by Jiri Denemark 20 Jul '26

20 Jul '26

We are getting close to 12.6.0 release of libvirt. To aim for the release on Monday 03 Aug I suggest entering the freeze on Monday 27 Jul and tagging RC2 on Thursday 30 Jul. I hope this works for everyone. Jirka

1 0

[PATCH 0/2] qemu: Fix detach of a CD-ROM device with no media
by Mitsuru Kariya 20 Jul '26

20 Jul '26

Detaching a CD-ROM device that has no media inserted currently logs an internal error: internal error: unable to execute QEMU command 'blockdev-del': Failed to find node with node-name='libvirt-N-storage' or, when no stale node name is present in the source: internal error: argument key 'node-name' must not have null value The root cause is that an empty disk source (path == NULL) satisfies virStorageSourceIsBacking() while no corresponding blockdev node ever exists in QEMU, so the detach path prepares a blockdev-del for a node that was never created. Patch 1 fixes the detach path itself: qemuDomainRemoveDiskDevice() now skips the blockdev detach preparation for an empty source, mirroring what the old-media detach in qemuDomainChangeMediaBlockdev() already does. Patch 2 fixes the way the stale node name gets there in the first place: qemuDomainChangeEjectableMedia() ran the full image setup (qemuDomainPrepareDiskSource(), backing chain detection, storage access, managed PR) even when ejecting to no media, assigning node names to an empty source that are never realized in QEMU. The setup is now skipped for an empty source, mirroring qemuDomainAttachDeviceDiskLiveInternal(), and rollback only revokes storage access when it was actually granted. To reproduce the 1st message: 1. Start a domain with a CD-ROM device with media attached 2. virsh change-media $dom $target --eject --live 3. virsh detach-disk $dom $target --live To reproduce the 2nd message: 1. Start a domain with a CD-ROM device without media attached 2. virsh detach-disk $dom $target --live No regression tests are added. Neither failure mode is reachable from qemuhotplugtest: the "null value" variant fails while constructing the blockdev-del arguments, before any QMP command is sent, leaving nothing for the test monitor to observe; the stale-node-name variant does emit a blockdev-del and would be detectable, but requires a preceding media eject to set up, which qemuhotplugtest cannot drive. Mitsuru Kariya (2): qemu: Skip empty disk source when detaching a disk device qemu: Don't prepare an empty disk source on media change src/qemu/qemu_hotplug.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) base-commit: 674fcf87bdd479302032fbeb331fea2aa51606ac -- 2.43.0

1 2

[PATCH 0/2] bhyve: implement virDomainGetGuestInfo()
by Roman Bogorodskiy 18 Jul '26

18 Jul '26

Roman Bogorodskiy (2): qemu: move qemuAgent*InfoFormatParams to hypervisor/qemu_agent.c bhyve: implement virDomainGetGuestInfo() src/bhyve/bhyve_driver.c | 192 ++++++++++++++++++++++++++++++++++++ src/hypervisor/qemu_agent.c | 159 +++++++++++++++++++++++++++++ src/hypervisor/qemu_agent.h | 17 ++++ src/libvirt_private.syms | 3 + src/qemu/qemu_driver.c | 162 +----------------------------- 5 files changed, 372 insertions(+), 161 deletions(-) -- 2.52.0

1 2

[PATCH v10 0/6] qemu: Support HW-accelerated vSMMUs
by Nathan Chen 18 Jul '26

18 Jul '26

Hi, This is a follow up to the v9 patchset [0] for supporting multiple hardware-accelerated vSMMU instances. For instance, specifying hostdevs associated with multiple accelerated SMMUs, configured to be routed to pcie-expander-bus controllers in a way where VFIO device to SMMUv3 associations are matched with the host: <devices> ... <controller type='pci' index='1' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='252'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </controller> <controller type='pci' index='2' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='248'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </controller> ... <controller type='pci' index='21' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='21' port='0x0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </controller> <controller type='pci' index='22' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='22' port='0xa8'/> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </controller> ... <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> <iommu model='smmuv3'> <driver pciBus='1' accel='on' ats='on' ril='off' ssidsize='20' oas='44'/> </iommu> <iommu model='smmuv3'> <driver pciBus='2' accel='on' ats='on' ril='off' ssidsize='20' oas='44'/> </iommu> </devices> This would get translated to a qemu command line with the arguments below: -device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ -device '{"driver":"pxb-pcie","bus_nr":248,"id":"pci.2","bus":"pcie.0","addr":"0x2"}' \ -device '{"driver":"pcie-root-port","port":0,"chassis":21,"id":"pci.21","bus":"pci.1","addr":"0x0"}' \ -device '{"driver":"pcie-root-port","port":168,"chassis":22,"id":"pci.22","bus":"pci.2","addr":"0x0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"iommu0","accel":true,"ats":"on","ril":"off","ssidsize":"20","oas":"44"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.2","id":"iommu1","accel":true,"ats":"on","ril":"off","ssidsize":"20","oas":"44"}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","bus":"pci.22","addr":"0x0"}' \ Two QEMU series implementing auto support for accel SMMUv3 properties are now present in the upstream master branch [1][2]. This Libvirt series leverages the auto support: users can omit SMMUv3 properties ATS, RIL, OAS, and SSIDSIZE on the domain XML, and they will also be omitted on the QEMU command line as a result. With these new QEMU series applied, the feature property values will default to 'auto' to be resolved based on what the host SMMU supports. This series also adds documentation fixes for docs/formatdomain.rst and implements support for QEMU capability checks on device-pluggable accel smmuv3. This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/smmuv3-accel-v10/ Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/W6HJ… [1] https://lore.kernel.org/all/20260323182454.1416110-1-nathanc@nvidia.com/ [2] https://lore.kernel.org/all/20260608174900.2227340-1-nathanc@nvidia.com/ Changes from v9: - Rename ssidSize to ssidsize - Update docs/formatdomain.rst to mention `since 12.6.0` for accel smmuv3 properties and these properties' hypervisor defaults being used if not specified. - Separate out virDomainIOMMUDefEquals() check for pci_bus into a new fix commit - Include fix commit for `since 11.10.0` for pciBus attribute in docs/formatdomain.rst - Use T:accel to propagate accel=off - Use qemuOnOffAuto() for ats and ril - Add QEMU capabilities checks for device-pluggable smmuv3 and accel smmuv3 Changes from v8: - Changed smmuv3 attribute QEMU CLI values to strings to match QEMU 11.0 Changes from v7: - Remove support for x-vpasid-cap-offset based on feedback pointing out the QEMU feature prefixed with x- is experimental and not to be supported in Libvirt - Implement support for auto SMMUv3 properties. Omitting these properties in the XML omits them on the QEMU command line as well, which results in default auto values being chosen for ATS, RIL, SSIDSIZE, and OAS - Add validation check that only allows enabling accel SMMUv3 features when accel is enabled - Add tests for accel=on but omitting accel SMMUv3 feature properties Changes from v6: - Remove smmuv3 'pasid' attribute - Add smmuv3 'ssidsize' attribute - Add support for 'vpasidCapOffset' element - Modify logic for building accel smmuv3 qemu command line to omit ATS, RIL, accel flags when not needed (enabled/disabled by default in QEMU SMMUv3) Nathan Chen (6): conf: Include check for pci_bus in virDomainIOMMUDefEquals() docs: formatdomain: Include Libvirt version for IOMMU pciBus attribute qemu: Add support for HW-accelerated nested SMMUv3 qemu: introduce QEMU_CAPS_ARM_SMMUV3 qemu: introduce QEMU_CAPS_ARM_SMMUV3_ACCEL tests: qemuxmlconfdata: provide HW-accel smmuv3 sample XML and CLI args docs/formatdomain.rst | 41 ++++- src/conf/domain_conf.c | 80 ++++++++++ src/conf/domain_conf.h | 5 + src/conf/domain_validate.c | 27 +++- src/conf/schemas/domaincommon.rng | 25 +++ src/qemu/qemu_capabilities.c | 14 ++ src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_command.c | 15 ++ src/qemu/qemu_validate.c | 21 ++- .../caps_10.0.0_aarch64.replies | 79 ++++++---- .../caps_10.2.0_aarch64.replies | 89 +++++++---- .../caps_10.2.0_aarch64.xml | 1 + .../caps_11.0.0_aarch64.replies | 132 ++++++++++++---- .../caps_11.0.0_aarch64.xml | 2 + .../caps_11.1.0_aarch64.replies | 143 ++++++++++++++---- .../caps_11.1.0_aarch64.xml | 2 + .../caps_8.2.0_aarch64.replies | 79 ++++++---- .../caps_8.2.0_armv7l.replies | 79 ++++++---- .../caps_9.2.0_aarch64+hvf.replies | 75 ++++++--- ...uv3-pci-bus-accel-auto.aarch64-latest.args | 38 +++++ ...muv3-pci-bus-accel-auto.aarch64-latest.xml | 63 ++++++++ .../iommu-smmuv3-pci-bus-accel-auto.xml | 53 +++++++ ...u-smmuv3-pci-bus-accel.aarch64-latest.args | 38 +++++ ...mu-smmuv3-pci-bus-accel.aarch64-latest.xml | 63 ++++++++ .../iommu-smmuv3-pci-bus-accel.xml | 53 +++++++ tests/qemuxmlconftest.c | 2 + 26 files changed, 1032 insertions(+), 189 deletions(-) create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.xml -- 2.43.0

1 6

[RFC] sanlock: Add option to check ownership of disk leases
by Jim Fehlig 17 Jul '26

17 Jul '26

From: Jim Fehlig <jfehlig(a)suse.com> In a clustered environment it may be desirable to provision disk leases for use by a specific domain. This patch adds a 'check_disk_lease_owner' option to the sanlock driver to check that leases are owned by the domain attempting to acquire them. sanlock's Lock Value Block (LVB) is used to store the owning domain UUID within the lease. When a domain is started and attempts to acquire its leases, the sanlock driver will ensure its UUID matches the UUID recorded in the leases. Any mismatches will cause lease acquisition and domain startup to fail. The 'check_disk_lease_owner' option is disabled by default. When enabled, it can be used with auto_disk_leases or leases managed by an external application. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- Inspired by Claudio, implemented by Jim :-) src/locking/libvirt_sanlock.aug | 1 + src/locking/lock_driver_sanlock.c | 78 ++++++++++++++++++++++++- src/locking/sanlock.conf | 23 ++++++++ src/locking/test_libvirt_sanlock.aug.in | 1 + 4 files changed, 102 insertions(+), 1 deletion(-) diff --git a/src/locking/libvirt_sanlock.aug b/src/locking/libvirt_sanlock.aug index 62d0672952..af6c25755f 100644 --- a/src/locking/libvirt_sanlock.aug +++ b/src/locking/libvirt_sanlock.aug @@ -25,6 +25,7 @@ module Libvirt_sanlock = | int_entry "io_timeout" | str_entry "user" | str_entry "group" + | bool_entry "check_disk_lease_owner" let comment = [ label "#comment" . del /#[ \t]*/ "# " . store /([^ \t\n][^\n]*)?/ . del /\n/ "\n" ] let empty = [ label "#empty" . eol ] diff --git a/src/locking/lock_driver_sanlock.c b/src/locking/lock_driver_sanlock.c index a07f3652c1..7ed1081cbd 100644 --- a/src/locking/lock_driver_sanlock.c +++ b/src/locking/lock_driver_sanlock.c @@ -67,6 +67,7 @@ struct _virLockManagerSanlockDriver { unsigned int hostID; bool autoDiskLease; char *autoDiskLeasePath; + bool checkDiskLeaseOwner; unsigned int io_timeout; /* under which permissions does sanlock run */ @@ -147,6 +148,10 @@ virLockManagerSanlockLoadConfig(virLockManagerSanlockDriver *driver, if (virConfGetValueBool(conf, "require_lease_for_disks", &driver->requireLeaseForDisks) < 0) return -1; + if (virConfGetValueBool(conf, "check_disk_lease_owner", + &driver->checkDiskLeaseOwner) < 0) + return -1; + if (virConfGetValueUInt(conf, "io_timeout", &driver->io_timeout) < 0) return -1; @@ -839,6 +844,73 @@ virLockManagerSanlockRegisterKillscript(int sock, return 0; } +static int virLockManagerSanlockCheckOwner(virLockManagerSanlockDriver *driver, + virLockManagerSanlockPrivate *priv) +{ + char lvb[VIR_UUID_STRING_BUFLEN] = {0}; + char vm_uuidstr[VIR_UUID_STRING_BUFLEN]; + int rv; + size_t i; + + if (!driver->checkDiskLeaseOwner) + return 0; + + virUUIDFormat(priv->vm_uuid, vm_uuidstr); + + for (i = 0; i < priv->res_count; i++) { + memset(lvb, 0, sizeof(lvb)); + + rv = sanlock_get_lvb(0, priv->res_args[i], lvb, sizeof(lvb)); + if (rv < 0) { + /* Failed to read LVB, treat as "legacy" lease + * without ownership tracking and skip the check. + */ + VIR_DEBUG("Failed to read LVB, skipping ownership check"); + continue; + } + + if (lvb[0] == '\0') { + VIR_DEBUG("Writing VM UUID to empty LVB"); + /* Empty LVB: this lease does not yet have an owner recorded. Write + * the domain's UUID so that subsequent acquire attempts by other + * domains will be rejected. This handles the auto_disk_leases case + * where lease files are created by libvirt. rather + */ + if ((rv = sanlock_set_lvb(0, priv->res_args[i], vm_uuidstr, + sizeof(vm_uuidstr))) < 0) { + char *err = NULL; + if (virLockManagerSanlockError(rv, &err)) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Failed to set LVB for lease %1$s: %2$s"), + priv->res_args[i]->disks[0].path, NULLSTR(err)); + VIR_FREE(err); + } else { + virReportSystemError(-rv, + _("Failed to set LVB for lease %1$s"), + priv->res_args[i]->disks[0].path); + } + return -1; + } + continue; + } + + VIR_DEBUG("Comparing LVB UUID '%s' to VM UUID '%s'", lvb, vm_uuidstr); + if (STRNEQ(lvb, vm_uuidstr)) { + /* + * LVB contains a different domain UUID. This lease + * was provisioned for another domain and must not + * be acquired by this one. + */ + virReportError(VIR_ERR_RESOURCE_BUSY, + _("Disk lease %1$s is already assigned to domain %2$s, not %3$s"), + priv->res_args[i]->disks[0].path, lvb, vm_uuidstr); + return -1; + } + } + return 0; +} + + static int virLockManagerSanlockAcquire(virLockManager *lock, const char *state, unsigned int flags, @@ -934,7 +1006,8 @@ static int virLockManagerSanlockAcquire(virLockManager *lock, if (!(flags & VIR_LOCK_MANAGER_ACQUIRE_REGISTER_ONLY)) { VIR_DEBUG("Acquiring object %u", priv->res_count); - if ((rv = sanlock_acquire(sock, priv->vm_pid, 0, + if ((rv = sanlock_acquire(sock, priv->vm_pid, + driver->checkDiskLeaseOwner ? SANLK_ACQUIRE_LVB : 0, priv->res_count, priv->res_args, opt)) < 0) { char *err = NULL; @@ -949,6 +1022,9 @@ static int virLockManagerSanlockAcquire(virLockManager *lock, } goto error; } + + if (virLockManagerSanlockCheckOwner(driver, priv) < 0) + goto error; } VIR_FREE(opt); diff --git a/src/locking/sanlock.conf b/src/locking/sanlock.conf index 3c356bef9c..e7d6938e84 100644 --- a/src/locking/sanlock.conf +++ b/src/locking/sanlock.conf @@ -67,3 +67,26 @@ # access them. Accepted values are described in qemu.conf. #user = "root" #group = "root" + +# +# Flag to enable verifying if disk leases have been provisioned +# for domains attempting to acquire them. This is accomplished +# using sanlock's Lock Value Block (LVB), a 512 byte application +# specific block in the lease lockspace where the domain's UUID +# can be stored when the lease is created. When libvirt starts a +# domain, the sanlock driver will check for a valid and matching +# UUID in the LVB of all leases. This prevents a lease that was +# provisioned for one domain from accidentally being used by a +# different domain. +# +# When enabled, if a lease file has an empty LVB, the UUID of the +# acquiring domain is written into the LVB automatically, so that +# subsequent lease acquisition attempts by other domains will be +# rejected. This behavior accommodates the auto_disk_leases case, +# where leases are created by libvirt. If leases are managed by +# an external application, it must write the domain UUID into the +# LVB during lease creation. +# +# Defaults to disabled. +# +#check_disk_lease_owner = 0 diff --git a/src/locking/test_libvirt_sanlock.aug.in b/src/locking/test_libvirt_sanlock.aug.in index 5eabb6726d..e468a2cdcd 100644 --- a/src/locking/test_libvirt_sanlock.aug.in +++ b/src/locking/test_libvirt_sanlock.aug.in @@ -9,3 +9,4 @@ module Test_libvirt_sanlock = { "io_timeout" = "0" } { "user" = "root" } { "group" = "root" } +{ "check_disk_lease_owner" = "0" } -- 2.51.0

2 4

[RFC] qemu: add configurable vCPU hotplug selection order
by Partha Satapathy 17 Jul '26

17 Jul '26

qemu: add configurable vCPU hotplug selection order Count-based vCPU hotplug currently selects eligible vCPU hotplug entities according to their vCPU IDs. For example: virsh setvcpus VM COUNT --live does not provide a way for an administrator to control which eligible entities are added or removed first. The existing ID-based policy is suitable for simple guests and for deployments where the vCPU ID layout already represents the desired placement policy. Domains that do not configure the new feature continue to use the current ID-based behavior. One use case is preserving a balanced guest NUMA CPU distribution during count-based vCPU changes. Depending on how vCPU IDs are assigned to guest NUMA cells, repeatedly adding or removing vCPUs by ID may concentrate the change in one cell before affecting another, resulting in an undesirable asymmetric guest CPU layout. There is no single balancing policy that is correct for every guest. An administrator may want to remove one hotplug entity from each guest NUMA cell in a round-robin sequence. For a guest with a threaded CPU topology, the preferred policy may instead remove a complete core, or several threads from one cell, before proceeding to the next. The appropriate sequence depends on the guest topology, workload, architecture, and performance requirements. The mechanism is not limited to NUMA balancing. It can also express administrator-defined policies such as: * retaining CPUs used for latency-sensitive, isolated, or housekeeping workloads; * implementing CPU capacity tiers; * satisfying software licensing or application-affinity constraints; * preserving a preferred socket, core, or thread population while reducing capacity; or * restoring vCPUs in a predictable order after an earlier reduction. Rather than embedding any one placement policy in libvirt, this proposal provides a general ordering mechanism. Administrators can describe the desired selection sequence in the domain XML according to the guest and deployment requirements. The existing per-vCPU 'order' attribute has different semantics and cannot be reused for this purpose. It is used to define the order and grouping of vCPUs when they are enabled. It applies to online vCPUs and is not a policy for selecting offline hotpluggable vCPUs. In particular, 'order' is not used to choose which vCPUs are removed by a count-based `setvcpus` reduction. Therefore, it cannot express an administrator-defined hot-unplug sequence. In contrast, 'hporder' is configured on disabled hotpluggable vCPUs and is used when libvirt selects eligible hotplug entities for count-based vCPU changes. It determines both which entities are removed during reduction and the order in which ranked entities are restored during expansion. It does not change the existing 'order' semantics, startup behavior, or hotplug entity composition. Introduce an optional positive per-vCPU 'hporder' XML attribute for QEMU domains. If the attribute is omitted, the vCPU remains unranked. All vCPUs belonging to the same QEMU hotplug entity must have the same 'hporder' value because they cannot be added or removed independently. The configuration is rejected if the values within an entity differ. For count-based operations, the QEMU driver applies the following selection policy: * On expansion, select unranked entities in ascending vCPU ID order, followed by ranked entities in ascending 'hporder' order. * On reduction, select ranked entities in descending 'hporder' order, followed by unranked entities in descending vCPU ID order. The ordering has two useful properties. First, domains without 'hporder' retain the existing behavior. Second, among ranked entities, expansion naturally restores entities in the reverse order in which reduction removed them. Unranked entities are selected first during expansion so that configuring 'hporder' can be used primarily to describe a preferred removal order without changing the normal expansion order of other hotpluggable vCPUs. The setting affects only the selection of eligible entities during count-based vCPU operations. It does not change: * the initial boot CPU order; * the existing per-vCPU 'order' attribute; * the composition of a QEMU hotplug entity; * whether a vCPU is hotpluggable; or * operations that explicitly address individual vCPUs. The value is preserved in domain XML and exposed through: virDomainSetVcpuHpOrder() A positive API value configures the order. Passing zero removes the configured value. Zero is not valid in domain XML and is therefore omitted when the XML is formatted. The corresponding virsh commands are: setvcpuhporder DOMAIN VCPU HPORDER delvcpuhporder DOMAIN VCPU Proposed implementation: 1. Add the 'hporder' attribute to the per-vCPU domain XML. 2. Validate that all vCPUs belonging to the same QEMU hotplug entity use the same 'hporder' value. 3. Use 'hporder' when selecting eligible vCPU hotplug entities for count-based expansion and reduction. 4. Add a public API for configuring or removing the 'hporder' value. 5. Add virsh commands for setting and removing the value. 6. Update the domain XML and API documentation to describe the new attribute, its valid values, its interaction with the existing per-vCPU 'order' attribute, and the selection rules used for expansion and reduction. 7. Add automated test coverage for XML parsing and formatting, invalid zero values, hotplug-entity consistency, and count-based expansion and reduction ordering. RFC: Feedback is welcome on the ordering policy and interface. In particular, feedback is requested on the XML/API naming, the handling of unranked vCPUs during expansion, and whether this should remain a QEMU-only feature. Signed-off-by: Partha Sarathi Satapathy <partha.satapathy(a)oracle.com>

4 8

[PATCH] util: virusb: skip USB devices with an inaccessible device node
by Yaroslav Borbat 16 Jul '26

16 Jul '26

From: Yaroslav Borbat <yaroslav.752(a)gmail.com> Inside a container sysfs is usually mounted from the host and exposes all USB devices, while nodes under /dev/bus/usb/ only exist for devices passed into the container's mount namespace. virUSBDeviceSearch() enumerated devices from sysfs alone, so such a device was reported as present: a hostdev with startupPolicy='optional' was not dropped and the domain failed to start. Skip devices whose /dev node is inaccessible during enumeration. virUSBDeviceFind() now ignores them for optional hostdevs and reports an explicit "not accessible in the current mount namespace" error for mandatory ones. Extend the virusb test to cover both cases. Closes: libvirt/libvirt#894 Signed-off-by: Yaroslav Borbat <yaroslav.752(a)gmail.com> --- src/util/virusb.c | 41 ++++++++++++++++++++++++++++++++++++----- tests/virusbmock.c | 33 ++++++++++++++++++++++++++++++++- tests/virusbtest.c | 38 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 106 insertions(+), 6 deletions(-) diff --git a/src/util/virusb.c b/src/util/virusb.c index 85ad3d58ce..1d31912971 100644 --- a/src/util/virusb.c +++ b/src/util/virusb.c @@ -120,7 +120,8 @@ virUSBDeviceSearch(unsigned int vendor, unsigned int devno, const char *port, const char *vroot, - unsigned int flags) + unsigned int flags, + char **inaccessiblePath) { g_autoptr(DIR) dir = NULL; bool found = false; @@ -198,6 +199,28 @@ virUSBDeviceSearch(unsigned int vendor, if (!usb) goto cleanup; + /* In containerized environments sysfs may expose USB devices + * from the host kernel while the corresponding device node + * under /dev/bus/usb/ is not present in the current mount + * namespace. Such a device cannot be used, so skip it here. + * Remember its path so that the caller can distinguish "no + * matching device at all" from "device present on the host but + * inaccessible in our mount namespace" when reporting errors. */ + if (virUSBDeviceGetPath(usb) && + !virFileExists(virUSBDeviceGetPath(usb))) { + VIR_DEBUG("USB device %03u:%03u found in sysfs but device " + "node '%s' is not accessible in the current mount " + "namespace, skipping", + found_bus, found_devno, + virUSBDeviceGetPath(usb)); + if (inaccessiblePath && !*inaccessiblePath) + *inaccessiblePath = g_strdup(virUSBDeviceGetPath(usb)); + g_clear_pointer(&usb, virUSBDeviceFree); + if (found) + break; + continue; + } + if (virUSBDeviceListAdd(list, &usb) < 0) goto cleanup; @@ -226,10 +249,11 @@ virUSBDeviceFind(unsigned int vendor, virUSBDeviceList **devices) { g_autoptr(virUSBDeviceList) list = NULL; + g_autofree char *inaccessiblePath = NULL; int count; if (!(list = virUSBDeviceSearch(vendor, product, bus, devno, port, - vroot, flags))) + vroot, flags, &inaccessiblePath))) return -1; count = list->count; @@ -240,9 +264,16 @@ virUSBDeviceFind(unsigned int vendor, return 0; } - virReportError(VIR_ERR_INTERNAL_ERROR, - _("Did not find matching USB device: vid:%1$04x, pid:%2$04x, bus:%3$u, device:%4$u, port:%5$s"), - vendor, product, bus, devno, port ? port : ""); + if (inaccessiblePath) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("USB device vid:%1$04x, pid:%2$04x, bus:%3$u, device:%4$u, port:%5$s is present on the host but its device node '%6$s' is not accessible in the current mount namespace"), + vendor, product, bus, devno, port ? port : "", + inaccessiblePath); + } else { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Did not find matching USB device: vid:%1$04x, pid:%2$04x, bus:%3$u, device:%4$u, port:%5$s"), + vendor, product, bus, devno, port ? port : ""); + } return -1; } diff --git a/tests/virusbmock.c b/tests/virusbmock.c index c23bed4528..c67a0ba307 100644 --- a/tests/virusbmock.c +++ b/tests/virusbmock.c @@ -22,18 +22,27 @@ #include <sys/stat.h> #include <dirent.h> #include <dlfcn.h> +#include <errno.h> #include <fcntl.h> +#include <unistd.h> #include "virmock.h" #define USB_SYSFS "/sys/bus/usb" #define FAKE_USB_SYSFS "virusbtestdata/sys_bus_usb" +#define USB_DEVFS "/dev/bus/usb/" + +/* Device node of the test device that is present in the fake sysfs but is + * meant to be inaccessible in the current mount namespace (usb4, i.e. the + * root hub 1d6b:0003 on bus 4). See virusbtest.c. */ +#define INACCESSIBLE_USB_NODE USB_DEVFS "004/001" static int (*real_open)(const char *pathname, int flags, ...); #if WITH___OPEN_2 static int (*real___open_2)(const char *path, int flags); #endif static DIR *(*real_opendir)(const char *name); +static int (*real_access)(const char *path, int mode); static void init_syms(void) { @@ -49,6 +58,7 @@ static void init_syms(void) VIR_MOCK_REAL_INIT(__open_2); #endif VIR_MOCK_REAL_INIT(opendir); + VIR_MOCK_REAL_INIT(access); } static char *get_fake_path(const char *real_path) @@ -58,7 +68,7 @@ static char *get_fake_path(const char *real_path) if ((p = STRSKIP(real_path, USB_SYSFS))) path = g_strdup_printf("%s/%s/%s", abs_srcdir, FAKE_USB_SYSFS, p); - else if (!p) + else path = g_strdup(real_path); return path; @@ -75,6 +85,27 @@ DIR *opendir(const char *name) return real_opendir(path); } +int access(const char *path, int mode) +{ + init_syms(); + + /* virUSBDeviceSearch() checks whether the /dev/bus/usb node of a device + * found in sysfs is accessible. There are no such nodes in the test + * environment, so pretend every USB device node exists, except the one + * device that is meant to be inaccessible in the current mount namespace + * (as happens inside a container). This lets us exercise the code path + * without shipping empty device-node files. */ + if (STRPREFIX(path, USB_DEVFS)) { + if (STREQ(path, INACCESSIBLE_USB_NODE)) { + errno = ENOENT; + return -1; + } + return 0; + } + + return real_access(path, mode); +} + int open(const char *pathname, int flags, ...) { g_autofree char *path = NULL; diff --git a/tests/virusbtest.c b/tests/virusbtest.c index 12ac338df9..58ca769059 100644 --- a/tests/virusbtest.c +++ b/tests/virusbtest.c @@ -259,6 +259,40 @@ testUSBList(const void *opaque G_GNUC_UNUSED) } +/* usb4 (bus 4, device 1) is present in the fake sysfs, but the mock makes + * its /dev/bus/usb node inaccessible, i.e. the device is exposed by the host + * kernel but not accessible in our mount namespace (as happens inside a + * container). Such a device must be treated as absent: skipped for + * startupPolicy 'optional' (mandatory == false) and reported as an error + * otherwise. */ +static int +testDeviceFindInaccessible(const void *opaque G_GNUC_UNUSED) +{ + g_autoptr(virUSBDeviceList) devs = NULL; + int rv; + + rv = virUSBDeviceFind(0x1d6b, 0x0003, 4, 1, NULL, NULL, false, + USB_DEVICE_FIND_BY_DEVICE, &devs); + if (rv != 0 || devs) { + virReportError(VIR_ERR_INTERNAL_ERROR, + "optional inaccessible device: expected no match " + "(rv=0 and no device list), got rv=%d", rv); + return -1; + } + + rv = virUSBDeviceFind(0x1d6b, 0x0003, 4, 1, NULL, NULL, true, + USB_DEVICE_FIND_BY_DEVICE, &devs); + if (rv >= 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + "mandatory inaccessible device: expected failure, " + "but the device was reported as available"); + return -1; + } + + return 0; +} + + static int mymain(void) { @@ -336,6 +370,10 @@ mymain(void) if (virTestRun("USB List test", testUSBList, NULL) < 0) rv = -1; + if (virTestRun("USBDeviceFind inaccessible node", + testDeviceFindInaccessible, NULL) < 0) + rv = -1; + if (rv < 0) return EXIT_FAILURE; return EXIT_SUCCESS; -- 2.54.0

1 0