August 2026 - Devel - libvirt List Archives

[PATCH v11 0/7] qemu: Support HW-accelerated vSMMUs
by Nathan Chen 07 Aug '26

07 Aug '26

Hi, This is a follow up to the v10 patchset [0] for supporting multiple hardware-accelerated vSMMU instances. For instance, specifying hostdevs associated with multiple accelerated SMMUs, configured to be routed to pcie-expander-bus controllers in a way where VFIO device to SMMUv3 associations are matched with the host: <devices> ... <controller type='pci' index='1' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='252'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </controller> <controller type='pci' index='2' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='248'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </controller> ... <controller type='pci' index='21' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='21' port='0x0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </controller> <controller type='pci' index='22' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='22' port='0xa8'/> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </controller> ... <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> <iommu model='smmuv3'> <driver pciBus='1' accel='on' ats='on' ril='off' ssidsize='20' oas='44'/> </iommu> <iommu model='smmuv3'> <driver pciBus='2' accel='on' ats='on' ril='off' ssidsize='20' oas='44'/> </iommu> </devices> This would get translated to a qemu command line with the arguments below: -device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ -device '{"driver":"pxb-pcie","bus_nr":248,"id":"pci.2","bus":"pcie.0","addr":"0x2"}' \ -device '{"driver":"pcie-root-port","port":0,"chassis":21,"id":"pci.21","bus":"pci.1","addr":"0x0"}' \ -device '{"driver":"pcie-root-port","port":168,"chassis":22,"id":"pci.22","bus":"pci.2","addr":"0x0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"iommu0","accel":true,"ats":"on","ril":"off","ssidsize":"20","oas":"44"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.2","id":"iommu1","accel":true,"ats":"on","ril":"off","ssidsize":"20","oas":"44"}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","bus":"pci.22","addr":"0x0"}' \ Two QEMU series implementing auto support for accel SMMUv3 properties are now present in the upstream master branch [1][2]. This Libvirt series leverages the auto support: users can omit SMMUv3 properties ATS, RIL, OAS, and SSIDSIZE on the domain XML, and they will also be omitted on the QEMU command line as a result. With these new QEMU series applied, the feature property values will default to 'auto' to be resolved based on what the host SMMU supports. This series also adds documentation fixes for docs/formatdomain.rst and implements support for QEMU capability checks on device-pluggable accel smmuv3. This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/smmuv3-accel-v11/ Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/Z33Q… [1] https://lore.kernel.org/all/20260323182454.1416110-1-nathanc@nvidia.com/ [2] https://lore.kernel.org/all/20260608174900.2227340-1-nathanc@nvidia.com/ Changes from v10: - Move QEMU capabilities patches before introducing accel support - Move qemu_validate.c QEMU cap check for accel to the main accel support patch - Use QEMU_CAPS_ARM_SMMUV3_SMMU_PER_BUS instead of QEMU_CAPS_ARM_SMMUV3 - Remove check for qemu reporting arm-smmuv3 support on non-ARM architecture - Revise qemuValidateDomainDeviceDefIOMMU conditional statement format - Add QEMU_CAPS_DEVICE_SMMUV3 and gate QEMU_CAPS_ARM_SMMUV3_SMMU_PER_BUS on QEMU_CAPS_DEVICE_SMMUV3 Changes from v9: - Rename ssidSize to ssidsize - Update docs/formatdomain.rst to mention `since 12.6.0` for accel smmuv3 properties and these properties' hypervisor defaults being used if not specified. - Separate out virDomainIOMMUDefEquals() check for pci_bus into a new fix commit - Include fix commit for `since 11.10.0` for pciBus attribute in docs/formatdomain.rst - Use T:accel to propagate accel=off - Use qemuOnOffAuto() for ats and ril - Add QEMU capabilities checks for device-pluggable smmuv3 and accel smmuv3 Changes from v8: - Changed smmuv3 attribute QEMU CLI values to strings to match QEMU 11.0 Changes from v7: - Remove support for x-vpasid-cap-offset based on feedback pointing out the QEMU feature prefixed with x- is experimental and not to be supported in Libvirt - Implement support for auto SMMUv3 properties. Omitting these properties in the XML omits them on the QEMU command line as well, which results in default auto values being chosen for ATS, RIL, SSIDSIZE, and OAS - Add validation check that only allows enabling accel SMMUv3 features when accel is enabled - Add tests for accel=on but omitting accel SMMUv3 feature properties Changes from v6: - Remove smmuv3 'pasid' attribute - Add smmuv3 'ssidsize' attribute - Add support for 'vpasidCapOffset' element - Modify logic for building accel smmuv3 qemu command line to omit ATS, RIL, accel flags when not needed (enabled/disabled by default in QEMU SMMUv3) Nathan Chen (7): conf: Include check for pci_bus in virDomainIOMMUDefEquals() docs: formatdomain: Include Libvirt version for IOMMU pciBus attribute qemu: introduce QEMU_CAPS_DEVICE_SMMUV3 qemu: introduce QEMU_CAPS_ARM_SMMUV3_SMMU_PER_BUS qemu: introduce QEMU_CAPS_ARM_SMMUV3_ACCEL qemu: Add support for HW-accelerated nested SMMUv3 tests: qemuxmlconfdata: provide HW-accel smmuv3 sample XML and CLI args docs/formatdomain.rst | 41 ++++- src/conf/domain_conf.c | 80 ++++++++++ src/conf/domain_conf.h | 5 + src/conf/domain_validate.c | 27 +++- src/conf/schemas/domaincommon.rng | 25 +++ src/qemu/qemu_capabilities.c | 12 ++ src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_command.c | 15 ++ src/qemu/qemu_validate.c | 20 +++ .../caps_10.0.0_aarch64.replies | 79 ++++++---- .../caps_10.0.0_aarch64.xml | 1 + .../caps_10.2.0_aarch64.replies | 89 +++++++---- .../caps_10.2.0_aarch64.xml | 2 + .../caps_11.0.0_aarch64.replies | 132 ++++++++++++---- .../caps_11.0.0_aarch64.xml | 3 + .../caps_11.1.0_aarch64.replies | 143 ++++++++++++++---- .../caps_11.1.0_aarch64.xml | 3 + .../caps_8.2.0_aarch64.replies | 79 ++++++---- .../caps_8.2.0_aarch64.xml | 1 + .../caps_8.2.0_armv7l.replies | 79 ++++++---- .../caps_8.2.0_armv7l.xml | 1 + .../caps_9.2.0_aarch64+hvf.replies | 75 ++++++--- .../caps_9.2.0_aarch64+hvf.xml | 1 + ...uv3-pci-bus-accel-auto.aarch64-latest.args | 38 +++++ ...muv3-pci-bus-accel-auto.aarch64-latest.xml | 63 ++++++++ .../iommu-smmuv3-pci-bus-accel-auto.xml | 53 +++++++ ...u-smmuv3-pci-bus-accel.aarch64-latest.args | 38 +++++ ...mu-smmuv3-pci-bus-accel.aarch64-latest.xml | 63 ++++++++ .../iommu-smmuv3-pci-bus-accel.xml | 53 +++++++ tests/qemuxmlconftest.c | 2 + 30 files changed, 1038 insertions(+), 188 deletions(-) create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.xml -- 2.43.0

2 12

[PATCH] bhyve: lock domain object while handling monitor events
by Roman Bogorodskiy 07 Aug '26

07 Aug '26

virBhyveProcessStop() calls virBhyveDomainObjStopWorker(), which expects the domain object to be locked. It temporarily releases the lock while stopping the event thread and acquires it again before returning. bhyveMonitorIO() called the process stop and restart paths without holding the domain lock. As a result, the lock acquired by virBhyveDomainObjStopWorker() was never released, causing subsequent domain API calls to hang after the guest exited. Lock the domain object while processing the bhyve process exit event and release it after the stop or restart operation completes. Fixes: 0041788857dafa46e047c09c90039209a642cb85 ("bhyve: clean up event thread") Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve_monitor.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/bhyve/bhyve_monitor.c b/src/bhyve/bhyve_monitor.c index a24696cad5..a7d7588ee5 100644 --- a/src/bhyve/bhyve_monitor.c +++ b/src/bhyve/bhyve_monitor.c @@ -140,11 +140,13 @@ bhyveMonitorIO(int watch, int kq, int events G_GNUC_UNUSED, void *opaque) } if (kev.filter == EVFILT_PROC && (kev.fflags & NOTE_EXIT) != 0) { + virObjectLock(vm); + if ((pid_t)kev.ident != vm->pid) { virReportError(VIR_ERR_INTERNAL_ERROR, _("event from unexpected proc %1$ju!=%2$ju"), (uintmax_t)vm->pid, (uintmax_t)kev.ident); - return; + goto cleanup; } name = vm->def->name; @@ -169,6 +171,9 @@ bhyveMonitorIO(int watch, int kq, int events G_GNUC_UNUSED, void *opaque) virBhyveProcessStop(driver, vm, VIR_DOMAIN_SHUTOFF_UNKNOWN, false); } } + + cleanup: + virObjectUnlock(vm); } } -- 2.52.0

2 4

[PATCH v10 0/6] qemu: Support HW-accelerated vSMMUs
by Nathan Chen 06 Aug '26

06 Aug '26

Hi, This is a follow up to the v9 patchset [0] for supporting multiple hardware-accelerated vSMMU instances. For instance, specifying hostdevs associated with multiple accelerated SMMUs, configured to be routed to pcie-expander-bus controllers in a way where VFIO device to SMMUv3 associations are matched with the host: <devices> ... <controller type='pci' index='1' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='252'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </controller> <controller type='pci' index='2' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='248'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </controller> ... <controller type='pci' index='21' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='21' port='0x0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </controller> <controller type='pci' index='22' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='22' port='0xa8'/> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </controller> ... <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> <iommu model='smmuv3'> <driver pciBus='1' accel='on' ats='on' ril='off' ssidsize='20' oas='44'/> </iommu> <iommu model='smmuv3'> <driver pciBus='2' accel='on' ats='on' ril='off' ssidsize='20' oas='44'/> </iommu> </devices> This would get translated to a qemu command line with the arguments below: -device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ -device '{"driver":"pxb-pcie","bus_nr":248,"id":"pci.2","bus":"pcie.0","addr":"0x2"}' \ -device '{"driver":"pcie-root-port","port":0,"chassis":21,"id":"pci.21","bus":"pci.1","addr":"0x0"}' \ -device '{"driver":"pcie-root-port","port":168,"chassis":22,"id":"pci.22","bus":"pci.2","addr":"0x0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"iommu0","accel":true,"ats":"on","ril":"off","ssidsize":"20","oas":"44"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.2","id":"iommu1","accel":true,"ats":"on","ril":"off","ssidsize":"20","oas":"44"}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","bus":"pci.22","addr":"0x0"}' \ Two QEMU series implementing auto support for accel SMMUv3 properties are now present in the upstream master branch [1][2]. This Libvirt series leverages the auto support: users can omit SMMUv3 properties ATS, RIL, OAS, and SSIDSIZE on the domain XML, and they will also be omitted on the QEMU command line as a result. With these new QEMU series applied, the feature property values will default to 'auto' to be resolved based on what the host SMMU supports. This series also adds documentation fixes for docs/formatdomain.rst and implements support for QEMU capability checks on device-pluggable accel smmuv3. This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/smmuv3-accel-v10/ Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/W6HJ… [1] https://lore.kernel.org/all/20260323182454.1416110-1-nathanc@nvidia.com/ [2] https://lore.kernel.org/all/20260608174900.2227340-1-nathanc@nvidia.com/ Changes from v9: - Rename ssidSize to ssidsize - Update docs/formatdomain.rst to mention `since 12.6.0` for accel smmuv3 properties and these properties' hypervisor defaults being used if not specified. - Separate out virDomainIOMMUDefEquals() check for pci_bus into a new fix commit - Include fix commit for `since 11.10.0` for pciBus attribute in docs/formatdomain.rst - Use T:accel to propagate accel=off - Use qemuOnOffAuto() for ats and ril - Add QEMU capabilities checks for device-pluggable smmuv3 and accel smmuv3 Changes from v8: - Changed smmuv3 attribute QEMU CLI values to strings to match QEMU 11.0 Changes from v7: - Remove support for x-vpasid-cap-offset based on feedback pointing out the QEMU feature prefixed with x- is experimental and not to be supported in Libvirt - Implement support for auto SMMUv3 properties. Omitting these properties in the XML omits them on the QEMU command line as well, which results in default auto values being chosen for ATS, RIL, SSIDSIZE, and OAS - Add validation check that only allows enabling accel SMMUv3 features when accel is enabled - Add tests for accel=on but omitting accel SMMUv3 feature properties Changes from v6: - Remove smmuv3 'pasid' attribute - Add smmuv3 'ssidsize' attribute - Add support for 'vpasidCapOffset' element - Modify logic for building accel smmuv3 qemu command line to omit ATS, RIL, accel flags when not needed (enabled/disabled by default in QEMU SMMUv3) Nathan Chen (6): conf: Include check for pci_bus in virDomainIOMMUDefEquals() docs: formatdomain: Include Libvirt version for IOMMU pciBus attribute qemu: Add support for HW-accelerated nested SMMUv3 qemu: introduce QEMU_CAPS_ARM_SMMUV3 qemu: introduce QEMU_CAPS_ARM_SMMUV3_ACCEL tests: qemuxmlconfdata: provide HW-accel smmuv3 sample XML and CLI args docs/formatdomain.rst | 41 ++++- src/conf/domain_conf.c | 80 ++++++++++ src/conf/domain_conf.h | 5 + src/conf/domain_validate.c | 27 +++- src/conf/schemas/domaincommon.rng | 25 +++ src/qemu/qemu_capabilities.c | 14 ++ src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_command.c | 15 ++ src/qemu/qemu_validate.c | 21 ++- .../caps_10.0.0_aarch64.replies | 79 ++++++---- .../caps_10.2.0_aarch64.replies | 89 +++++++---- .../caps_10.2.0_aarch64.xml | 1 + .../caps_11.0.0_aarch64.replies | 132 ++++++++++++---- .../caps_11.0.0_aarch64.xml | 2 + .../caps_11.1.0_aarch64.replies | 143 ++++++++++++++---- .../caps_11.1.0_aarch64.xml | 2 + .../caps_8.2.0_aarch64.replies | 79 ++++++---- .../caps_8.2.0_armv7l.replies | 79 ++++++---- .../caps_9.2.0_aarch64+hvf.replies | 75 ++++++--- ...uv3-pci-bus-accel-auto.aarch64-latest.args | 38 +++++ ...muv3-pci-bus-accel-auto.aarch64-latest.xml | 63 ++++++++ .../iommu-smmuv3-pci-bus-accel-auto.xml | 53 +++++++ ...u-smmuv3-pci-bus-accel.aarch64-latest.args | 38 +++++ ...mu-smmuv3-pci-bus-accel.aarch64-latest.xml | 63 ++++++++ .../iommu-smmuv3-pci-bus-accel.xml | 53 +++++++ tests/qemuxmlconftest.c | 2 + 26 files changed, 1032 insertions(+), 189 deletions(-) create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-auto.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.xml -- 2.43.0

2 13

[RFC PATCH v2 0/5] Arm CPU features with supported values
by sandesh.patel＠nutanix.com 05 Aug '26

05 Aug '26

From: Sandesh Patel <sandesh.patel(a)nutanix.com> Hi, This RFC series adds libvirt support for ARM CPU features that are exposed by QEMU as multi-valued properties, rather than the on/off booleans we are used to from x86. Background ========== On ARM, several CPU properties can take one of a small set of values (e.g. "0.0", "1.0", "1.1_base", "off"), and the set of values supported by each property is host-specific. This cannot be expressed using libvirt's existing boolean feature model. This series depends on a pending QEMU RFC [1] that introduces non-boolean feature handling for ARM CPUs. That series also adds a new QMP command, query-arm-cpu-props-info, which reports the values the host accelerator supports for each ARM CPU property. Example reply fragment: { "name": "hw_prop_WRPs", "supported-values": ["0-3"], "type": "number" } On top of that QEMU work, this libvirt RFC wires up the end-to-end flow: probing the host, caching the probed information, exposing the values in the guest CPU XML, and passing them through to the QEMU -cpu command line. I am posting this as an RFC primarily to get maintainer feedback on the overall approach before investing in the missing pieces (in particular, value validation, which is intentionally not yet implemented). See "Open questions" below. Overview of the series ====================== 1. Add a QMP wrapper for query-arm-cpu-props-info, a new QEMU_CAPS_QUERY_ARM_CPU_PROPS_INFO capability bit, and the qemuMonitorCPUPropsInfoList data structure. The command is issued on ARM + KVM hosts and the reply is stored in the per-accelerator capabilities. 2. Persist the probed list into the on-disk QEMU capabilities cache as <cpuPropertyInfo>, so that subsequent libvirtd restarts do not need to re-issue the QMP query. 3. Extend the guest CPU XML with an optional 'value' attribute on <feature>: <cpu mode='host-passthrough'> <feature policy='require' name='feat_RAS' value='1.0'/> <feature policy='require' name='hw_prop_API' value='off'/> <feature policy='require' name='hw_prop_WRPs' value='2'/> </cpu> When a feature carries a non-NULL 'value', libvirt emits '<name>=<value>' on the QEMU -cpu command line; in that case the policy must be 'require' or 'force'. The existing policy-driven '=on' / '=off' path is used only for features without an explicit value. All ARM property names returned by query-arm-cpu-props-info are registered in src/cpu_map/arm_features.xml so that the guest XML parser and validator accept them. With this change, the generated QEMU command line can look like: -cpu host-passthrough,hw_prop_API=off,hw_prop_WRPs=2 Changes since v1: ================ - Split the single "query" patch so the new capability bit is added in its own patch, separate from the code that uses it. - The capability dump is now captured from a real QEMU (built with the pending ARM series and probed with qemucapsprobe on a KVM host) instead of being edited by hand. It is added as a separate "+armcpuprops" variant Open questions ============== - Value validation: should libvirt validate the requested value against the host's supported-values list at define time, at start time, or defer entirely to QEMU? - Policy vs. value conflicts: is requiring policy='require' / 'force' whenever 'value' is set the right rule? - Caching location: is the per-accelerator QEMU capabilities cache the right place to store the probed property list, or should this live alongside the CPU model data in cpu_map? Sandesh Patel (5): Add QEMU_CAPS_QUERY_ARM_CPU_PROPS_INFO Add support to query ARM CPU property values Cache and load ARM CPU property information Add '+armcpuprops' capability variant for query-arm-cpu-props-info QMP Support 'value' attribute on CPU features src/conf/cpu_conf.c | 21 +- src/conf/cpu_conf.h | 1 + src/conf/schemas/cputypes.rng | 5 + src/cpu_map/arm_features.xml | 171 + src/qemu/qemu_capabilities.c | 130 +- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 13 + src/qemu/qemu_monitor.c | 52 + src/qemu/qemu_monitor.h | 26 + src/qemu/qemu_monitor_json.c | 66 + src/qemu/qemu_monitor_json.h | 5 + .../qemu_11.1.0-virt.aarch64+armcpuprops.xml | 357 + .../qemu_11.1.0.aarch64+armcpuprops.xml | 357 + .../caps_11.1.0_aarch64+armcpuprops.replies | 40506 ++++++++++++++++ .../caps_11.1.0_aarch64+armcpuprops.xml | 1436 + .../caps.aarch64+armcpuprops.xml | 28 + tests/qemumonitorjsontest.c | 91 + ...res-values.aarch64-latest+armcpuprops.args | 34 + ...ures-values.aarch64-latest+armcpuprops.xml | 46 + .../aarch64-cpu-features-values.xml | 30 + tests/qemuxmlconftest.c | 2 + tests/testutilshostcpus.h | 74 +- 22 files changed, 43411 insertions(+), 41 deletions(-) create mode 100644 tests/domaincapsdata/qemu_11.1.0-virt.aarch64+armcpuprops.xml create mode 100644 tests/domaincapsdata/qemu_11.1.0.aarch64+armcpuprops.xml create mode 100644 tests/qemucapabilitiesdata/caps_11.1.0_aarch64+armcpuprops.replies create mode 100644 tests/qemucapabilitiesdata/caps_11.1.0_aarch64+armcpuprops.xml create mode 100644 tests/qemucaps2xmloutdata/caps.aarch64+armcpuprops.xml create mode 100644 tests/qemuxmlconfdata/aarch64-cpu-features-values.aarch64-latest+armcpuprops.args create mode 100644 tests/qemuxmlconfdata/aarch64-cpu-features-values.aarch64-latest+armcpuprops.xml create mode 100644 tests/qemuxmlconfdata/aarch64-cpu-features-values.xml -- 2.43.7

2 7

[PATCH] Commit 9899c91515 introduced the potential for a NULL pointer dereference crash when the 'ctl' parameter to vshPrintStderr() is NULL. Below is an example backtrace of the crash when attempting to detach a non-existent disk with 'virsh detach-disk test vdz'
by Jim Fehlig 05 Aug '26

05 Aug '26

From: Jim Fehlig <jfehlig(a)suse.com> #0 vshPrintStderr (ctl=0x0, level=4, format=<optimized out>, ap=<optimized out>) at ../tools/vsh.c:2148 #1 0x00005555555e6b2c in vshError (ctl=ctl@entry=0x0, format=<optimized out>) at ../tools/vsh.c:2170 #2 0x00005555555afec7 in virshFindDisk (doc=doc@entry=0x555555696ee0 "<domain type='kvm' id='1'>\n <name>test</name>\n <uuid>9b27a21e-dfa2-4c1e-9d11-2de275aefb03</uuid>\n <metadata>\n <libosinfo:libosinfo xmlns:libosinfo=\"http://libosinfo.org/xmlns/libvirt/domain/1."..., path=0x555555651240 "vdz", type=type@entry=0) at ../tools/virsh-domain.c:13055 #3 0x00005555555b0151 in cmdDetachDisk (ctl=0x7fffffffdac0, cmd=0x5555556914c0) at ../tools/virsh-domain.c:13231 #4 0x00005555555e6ddb in vshCommandRun (ctl=ctl@entry=0x7fffffffdac0, cmd=0x5555556914c0) at ../tools/vsh.c:1383 #5 0x000055555559347a in main (argc=<optimized out>, argv=0x7fffffffdeb8) at ../tools/virsh.c:908 Ensure 'ctl' is valid before dereferencing it. Fixes: 9899c91515d79595d19800ccc895df18eb7bb3f7 Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- tools/vsh.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/vsh.c b/tools/vsh.c index ccf2f21d64..667cc1a0d2 100644 --- a/tools/vsh.c +++ b/tools/vsh.c @@ -2145,7 +2145,7 @@ vshPrintStderr(vshControl *ctl, if (ctl) vshOutputLogFile(ctl, level, str); - if (ctl->stderr_closed) + if (ctl && ctl->stderr_closed) return; /* Most output is to stdout, but if someone ran virsh 2>&1, then -- 2.51.0

2 3

[PATCH 0/2] conf: Fix schema for capabilities XML
by Peter Krempa 04 Aug '26

04 Aug '26

Peter Krempa (2): conf: schemas: Allow '.' in schema for CPU flag name tests: capabilityschemadata: Add a real test example src/conf/schemas/cputypes.rng | 2 +- .../caps-qemu-real-full.xml | 1033 +++++++++++++++++ 2 files changed, 1034 insertions(+), 1 deletion(-) create mode 100644 tests/capabilityschemadata/caps-qemu-real-full.xml -- 2.55.0

2 3

[PATCH] spec: Fix typo in libvirt-daemon Obsoletes macro expansion
by Jim Fehlig 04 Aug '26

04 Aug '26

From: Jim Fehlig <jfehlig(a)suse.com> Fixes: 07b220964f968284533e589a2ac28cc465fd26ae Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- libvirt.spec.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 72fc08f9e7..2411fd94c4 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -309,7 +309,7 @@ Source: https://download.libvirt.org/%{?mainturl}libvirt-%{version}.tar.xz %if %{with_libvirtd} Requires: libvirt-daemon = %{version}-%{release} %else -Obsoletes: libvirt-daemon < %(version)-%(release) +Obsoletes: libvirt-daemon < %{version}-%{release} %endif Requires: libvirt-daemon-config-network = %{version}-%{release} Requires: libvirt-daemon-config-nwfilter = %{version}-%{release} -- 2.51.0

2 1

[PATCH 0/2] Properly handle tri-state for KVM options
by Chris Riches 03 Aug '26

03 Aug '26

Two of the qemu kvm_features (kvm-poll-control and kvm-pv-ipi) were only emitted when on or when off respectively, rather than handling the full tri-state for each (on, off, absent). This meant that config like <poll-control state='off'/> was a no-op, equivalent to not specifying poll-control at all, which fails to prevent QEMU from enabling it based on its own internal defaults. In particular, this meant that having both <cpu mode='host-passthrough'> and <poll-control state='off'/> would cause the latter to be ignored, since libvirt would emit no explicit kvm-poll-control arg, and QEMU defaults to enabling most KVM features when CPU passthrough is enabled. Fix these two cases such that explicit on/off are both respected. The `hidden` and `hint-dedicated` options are left as-is, since these really do only make sense in the `on` direction; QEMU will never automatically enable them. Chris Riches (2): qemu: Emit explicit kvm-poll-control=off when disabled qemu: Emit explicit kvm-pv-ipi=on when enabled src/qemu/qemu_command.c | 14 ++++++++++---- .../kvm-features-off.x86_64-latest.args | 2 +- .../kvm-features.x86_64-latest.args | 2 +- 3 files changed, 12 insertions(+), 6 deletions(-) -- 2.43.0

2 7

[PATCH v2] docs: switch to GitLab issue tracker for security disclosures
by Daniel P. Berrangé 03 Aug '26

03 Aug '26

From: Daniel P. Berrangé <berrange(a)redhat.com> Use of email for security disclosures is not a sustainable approach in the new world with countless LLM assisted security researchers. The old security approach has been to keep disclosures visible to a very small number of hand-picked maintainers, on the assumption that information has to be highly classified. This view is no longer valid with LLMs assisted research, as multiple people can report the same flaw within a short window of time. It is assumed that anyone with access to LLMs will be capable of re-discovering issues at any time. As such there is less compelling benefit to limiting the visibility of disclosures originating with LLMs. Rather than try to distinguish which disclosures come purely from humans vs those assisted by LLMs, just assume LLMs will be involved as that is the common case. Thus make disclosures visible to all maintainers immediately. By the same rational of repeated re-discovery there is also less benefit to applying embargoes to issues once a fix is available. Thus this proposal intends to make CVEs public as soon as a fix is proposed for merge. With this new open approach to disclosures, there is then no reason to have a separate process for disclosing regular bugs vs security issues. By using the regular bug tracker for security disclosures, the process can be simplified and gain access to better tools for tracking & triage than email offers. Thus the new security disclosure process is simply with bug tracking process with two add-ons: * The initial disclosure has the "confidential" flag set * The use of "CVE::Required" and "CVE::Assigned" labels to handle CVE allocation. This is essentially identical to the process adopted by QEMU last month which has been successful at scaling the triage process. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- docs/securityprocess.rst | 96 +++++++++++++++++++--------------------- 1 file changed, 45 insertions(+), 51 deletions(-) diff --git a/docs/securityprocess.rst b/docs/securityprocess.rst index b7695ddc59..61261c82b0 100644 --- a/docs/securityprocess.rst +++ b/docs/securityprocess.rst @@ -4,30 +4,30 @@ Security Process .. contents:: -The libvirt project believes in responsible disclosure of security problems, to -allow vendors time to prepare and distribute patches for problems ahead of their -publication. This page describes how the process works and how to report -potential security issues. +The libvirt project handles security disclosures with a lightweight process +whose aim is to minimize the overhead of triage and prioritize publication +of a patch that addresses the issue. Reporting security issues ------------------------- -In the event that a bug in libvirt is found which is believed to have -(potential) security implications there is a dedicated contact to which a bug -report / notification should be directed. Send an email with as many details of -the problem as possible (ideally with steps to reproduce) to the following email -address: +Security concerns should be reported as confidential issues in the +`libvirt project on GitLab <https://gitlab.com/libvirt/libvirt/-/work_items>`__, or one of the other related projects under the +`libvirt namespace <https://gitlab.com/libvirt/>`__ if the issue does not +apply to the core project. -:: +Ensure that the "**turn on confidentiality**" checkbox is selected prior to +submitting the issue, to restrict visibility to project maintainers only. - security(a)lists.libvirt.org +Maintainer(s) will analyse the reported disclosure and decide whether it +is to be classed as a security flaw or not. If not a security flaw, the +``confidential`` tag will be removed immediately. If a security flaw, +the maintainers will work to develop and test a patch. When a suitable +patch is considered ready to post to the mailing list or a merge request, +the ``confidential`` tag will be removed. Generally a CVE should be assignd +to a security issue before a patch is ready to be posted (see below). -NB. while this email address is backed by a mailing list, it is invitation only -and moderated for non-members. As such you will receive an auto-reply indicating -the report is held for moderation. Postings by non-members will be approved by a -moderator and the reporter copied on any replies. - -Refer to the `bug reporting <bugs.html#use-of-automated-tools-ai-agents>`__ +Note: Refer to the `bug reporting <bugs.html#use-of-automated-tools-ai-agents>`__ page for the *expectations around the use of automated tools and AI agents*, **prior** to filing any security report. @@ -42,48 +42,42 @@ formats. Security notices are published on the `libvirt-announce mailing list <contact.html#mailing-lists>`__ when any embargo is lifted, or as soon as triaged if already public knowledge. -Security team -------------- +Publication embargo policy +-------------------------- -The libvirt security team is made up of a subset of the libvirt core development -team which covers the various distro maintainers of libvirt, along with -nominated security engineers representing the various vendors who distribute -libvirt. The team is responsible for analysing incoming reports from users to -identify whether a security problem exists and its severity. It then works to -produce a fix for all official stable branches of libvirt and coordinate embargo -dates between vendors to allow simultaneous release of the fix by all affected -parties. +The libvirt project policy is to limit the time that a disclosure has the +"*confidential*" marker applied strictly to the minimum required to develop +and publish a suitable patch and allocate a CVE. -If you are a security representative of a vendor distributing libvirt and would -like to join the security team, send an email to the afore-mentioned security -address. Typically an existing member of the security team will have to vouch -for your credentials before membership is approved. All members of the security -team are **required to respect the embargo policy** described below. +Given the widespread use of AI/LLM based agents for security auditing, +as well as ongoing use of traditional fuzzing and static analysis +tools, the libvirt maintainers consider that any disclosure originating +from automated tools is highly likely to be independently re-discovered, +potentially many times over in a very short timeframe. -Publication embargo policy --------------------------- +Thus the libvirt maintainers will generally reject requests for arbitrary +embargoes unless high severity, extenuating circumstances can be +demonstrated. -The libvirt security team operates a policy of `responsible -disclosure <https://en.wikipedia.org/wiki/Responsible_disclosure>`__. As such -any security issue reported, that is not already publicly disclosed elsewhere, -will have an embargo date assigned. Members of the security team agree not to -publicly disclose any details of the security issue until the embargo date -expires. - -The general aim of the team is to have embargo dates which are two weeks or less -in duration. If a problem is identified with a proposed patch for a security -issue, requiring further investigation and bug fixing, the embargo clock may be -restarted. In exceptional circumstances longer initial embargoes may be -negotiated by mutual agreement between members of the security team and other -relevant parties to the problem. Any such extended embargoes will aim to be at -most one month in duration. +If a patch for a confirmed security issue cannot be developed by a +maintainer in a reasonable time, the maintainers may choose to make +a disclosure public without having a patch available. This approach +should only be taken for issues judged to have low severity. CVE allocation -------------- -The libvirt security team will associate each security issue with a CVE number. -The CVE numbers will usually be allocated by one of the vendor security -engineers on the security team. +If a reported disclosure is confirmed to be a security flaw, the +``CVE::Required`` label will be added. + +When a CVE has been allocated, this label will be removd and replaced +by ``CVE::Assigned``. + +The allocated CVE identifier will be included in the patch(es) that +are required to fix the issue. If multiple patches are involved, the +CVE must be included in the final patch in the series that closes the +last hole, but should also be included in any prior patches it the +series that are directly related. Branch fixing policy -------------------- -- 2.55.0

2 1

[PATCH] docs: switch to GitLab issue tracker for security disclosures
by Daniel P. Berrangé 03 Aug '26

03 Aug '26

From: Daniel P. Berrangé <berrange(a)redhat.com> Use of email for security disclosures is not a sustainable approach in the new world with countless LLM assisted security researchers. The old security approach has been to keep disclosures visible to a very small number of hand-picked maintainers, on the assumption that information has to be highly classified. This view is no longer valid with LLMs assisted research, as multiple people can report the same flaw within a short window of time. It is assumed that anyone with access to LLMs will be capable of re-discovering issues at any time. As such there is less compelling benefit to limiting the visibility of disclosures originating with LLMs. Rather than try to distinguish which disclosures come purely from humans vs those assisted by LLMs, just assume LLMs will be involved as that is the common case. Thus make disclosures visible to all maintainers immediately. By the same rational of repeated re-discovery there is also less benefit to applying embargoes to issues once a fix is available. Thus this proposal intends to make CVEs public as soon as a fix is proposed for merge. With this new open approach to disclosures, there is then no reason to have a separate process for disclosing regular bugs vs security issues. By using the regular bug tracker for security disclosures, the process can be simplified and gain access to better tools for tracking & triage than email offers. Thus the new security disclosure process is simply with bug tracking process with two add-ons: * The initial disclosure has the "confidential" flag set * The use of "CVE::Required" and "CVE::Assigned" labels to handle CVE allocation. This is essentially identical to the process adopted by QEMU last month which has been successful at scaling the triage process. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- docs/securityprocess.rst | 94 ++++++++++++++++++---------------------- 1 file changed, 43 insertions(+), 51 deletions(-) diff --git a/docs/securityprocess.rst b/docs/securityprocess.rst index b7695ddc59..0cc1349b9e 100644 --- a/docs/securityprocess.rst +++ b/docs/securityprocess.rst @@ -4,30 +4,28 @@ Security Process .. contents:: -The libvirt project believes in responsible disclosure of security problems, to -allow vendors time to prepare and distribute patches for problems ahead of their -publication. This page describes how the process works and how to report -potential security issues. +The libvirt project handles security disclosures with a lightweight process +whose aim is to minimize the overhead of triage and prioritize publication +of a patch that addresses the issue. Reporting security issues ------------------------- -In the event that a bug in libvirt is found which is believed to have -(potential) security implications there is a dedicated contact to which a bug -report / notification should be directed. Send an email with as many details of -the problem as possible (ideally with steps to reproduce) to the following email -address: +Security concerns in libvirt should be reported as confidential issues in +the appropriate `project on GitLab. <https://gitlab.com/libvirt>`__. -:: +Ensure that the "**turn on confidentiality**" checkbox is selected prior to +submitting the issue, to restrict visibility to project maintainers only. - security(a)lists.libvirt.org +Maintainer(s) will analyse the reported disclosure and decide whether it +is to be classed as a security flaw or not. If not a security flaw, the +``confidential`` tag will be removed immediately. If a security flaw, +the maintainers will work to develop and test a patch. When a suitable +patch is considered ready to post to the mailing list or a merge request, +the ``confidential`` tag will be removed. Generally a CVE should be assignd +to a security issue before a patch is ready to be posted (see below). -NB. while this email address is backed by a mailing list, it is invitation only -and moderated for non-members. As such you will receive an auto-reply indicating -the report is held for moderation. Postings by non-members will be approved by a -moderator and the reporter copied on any replies. - -Refer to the `bug reporting <bugs.html#use-of-automated-tools-ai-agents>`__ +Note: Refer to the `bug reporting <bugs.html#use-of-automated-tools-ai-agents>`__ page for the *expectations around the use of automated tools and AI agents*, **prior** to filing any security report. @@ -42,48 +40,42 @@ formats. Security notices are published on the `libvirt-announce mailing list <contact.html#mailing-lists>`__ when any embargo is lifted, or as soon as triaged if already public knowledge. -Security team -------------- +Publication embargo policy +-------------------------- -The libvirt security team is made up of a subset of the libvirt core development -team which covers the various distro maintainers of libvirt, along with -nominated security engineers representing the various vendors who distribute -libvirt. The team is responsible for analysing incoming reports from users to -identify whether a security problem exists and its severity. It then works to -produce a fix for all official stable branches of libvirt and coordinate embargo -dates between vendors to allow simultaneous release of the fix by all affected -parties. +The libvirt project policy is to limit the time that a disclosure has the +"*confidential*" marker applied strictly to the minimum required to develop +and publish a suitable patch and allocate a CVE. -If you are a security representative of a vendor distributing libvirt and would -like to join the security team, send an email to the afore-mentioned security -address. Typically an existing member of the security team will have to vouch -for your credentials before membership is approved. All members of the security -team are **required to respect the embargo policy** described below. +Given the widespread use of AI/LLM based agents for security auditing, +as well as ongoing use of traditional fuzzing and static analysis +tools, the QEMU maintainers consider that any disclosure originating +from automated tools is highly likely to be independently re-discovered, +potentially many times over in a very short timeframe. -Publication embargo policy --------------------------- +Thus the QEMU maintainers will generally reject requests for arbitrary +embargoes unless high severity, extenuating circumstances can be +demonstrated. -The libvirt security team operates a policy of `responsible -disclosure <https://en.wikipedia.org/wiki/Responsible_disclosure>`__. As such -any security issue reported, that is not already publicly disclosed elsewhere, -will have an embargo date assigned. Members of the security team agree not to -publicly disclose any details of the security issue until the embargo date -expires. - -The general aim of the team is to have embargo dates which are two weeks or less -in duration. If a problem is identified with a proposed patch for a security -issue, requiring further investigation and bug fixing, the embargo clock may be -restarted. In exceptional circumstances longer initial embargoes may be -negotiated by mutual agreement between members of the security team and other -relevant parties to the problem. Any such extended embargoes will aim to be at -most one month in duration. +If a patch for a confirmed security issue cannot be developed by a +maintainer in a reasonable time, the maintainers may choose to make +a disclosure public without having a patch available. This approach +should only be taken for issues judged to have low severity. CVE allocation -------------- -The libvirt security team will associate each security issue with a CVE number. -The CVE numbers will usually be allocated by one of the vendor security -engineers on the security team. +If a reported disclosure is confirmed to be a security flaw, the +``CVE::Required`` label will be added. + +When a CVE has been allocated, this label will be removd and replaced +by ``CVE::Assigned``. + +The allocated CVE identifier will be included in the patch(es) that +are required to fix the issue. If multiple patches are involved, the +CVE must be included in the final patch in the series that closes the +last hole, but should also be included in any prior patches it the +series that are directly related. Branch fixing policy -------------------- -- 2.55.0

2 2

Release of libvirt-12.6.0
by Jiri Denemark 03 Aug '26

03 Aug '26

The 12.6.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * New features * bhyve: implement ``virDomainRename()`` The bhyve driver now implements the ``virDomainRename()`` API for renaming of a domain (``virsh domrename``). * build: Add option to control building libvirtd Meson option ``libvirtd`` has been added to control building the monolithic libvirtd, independent from the stateful, daemon-based drivers. * sanlock: Add option to check ownership of disk leases The sanlock lock driver plugin now supports the ``check_disk_lease_owner`` setting in sanlock.conf. When enabled, the sanlock plugin will check that leases are owned by the domain attempting to acquire them. * Improvements * qemu: Add ``preserve-running`` action for ``<on_crash>`` Allow qemu VMs to be kept running after they notify that they've crashed. This is useful for guests that can take their own crash dump and reboot. Enjoy. Jirka

1 0

[PATCH] bhyve: capabilities: use full path for emulator
by Roman Bogorodskiy 03 Aug '26

03 Aug '26

Currently, when the bhyve driver builds capabilities, it uses just "bhyve" as emulator path. That leads to issues, e.g. virt-manager uses this value to fill domain's emulator field, which has to be an absolute path. So that results in a domain XML that fails validation. Fix by trying to find "bhyve" in PATH and falling back to "/usr/sbin/bhyve". Closes: https://gitlab.com/libvirt/libvirt/-/work_items/899 Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve_capabilities.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/bhyve/bhyve_capabilities.c b/src/bhyve/bhyve_capabilities.c index 1fe0a3ad77..85988a2ce8 100644 --- a/src/bhyve/bhyve_capabilities.c +++ b/src/bhyve/bhyve_capabilities.c @@ -48,13 +48,14 @@ virBhyveCapsBuild(void) virCaps *caps; virCapsGuest *guest; virArch hostarch = virArchFromHost(); + g_autofree char *binary = virFindFileInPath("bhyve"); if ((caps = virCapabilitiesNew(hostarch, false, false)) == NULL) return NULL; guest = virCapabilitiesAddGuest(caps, VIR_DOMAIN_OSTYPE_HVM, - hostarch, "bhyve", + hostarch, binary ? binary : "/usr/sbin/bhyve", NULL, 0, NULL); virCapabilitiesAddGuestDomain(guest, VIR_DOMAIN_VIRT_BHYVE, -- 2.52.0

3 3

[PATCH] NEWS: Mention the 'preserve-running' action for '<on_crash>'
by Peter Krempa 03 Aug '26

03 Aug '26

From: Peter Krempa <pkrempa(a)redhat.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- NEWS.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 50b086b789..a4bd015c15 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -35,6 +35,11 @@ v12.6.0 (unreleased) * **Improvements** + * qemu: Add ``preserve-running`` action for ``<on_crash>`` + + Allow qemu VMs to be kept running after they notify that they've crashed. + This is useful for guests that can take their own crash dump and reboot. + * **Bug fixes** -- 2.55.0

2 1

[PATCH 0/2] Fix double free of stream error reply aborting libvirtd
by Ross Golder 02 Aug '26

02 Aug '26

libvirtd aborts with "free(): invalid pointer" whenever a stream write fails, and then crash-loops until systemd's start limit is reached, leaving the host with no management plane. Running guests are unaffected but become unmanageable. The cause is an ambiguous return contract. daemonStreamHandleWriteData() reports a failed stream write through virNetServerProgramSendReplyError(), which takes ownership of the message and queues it on client->tx, and then returns that function's result - 0 on success. Its caller reads 0 as "no reply was sent" and, for VIR_NET_CONTINUE, clears the message and queues it a second time. Since the message is by then the sole element of client->tx, virNetMessageQueuePush() walks to the tail - itself - and links it to itself. virNetMessageQueueServe() then hands out the same pointer twice and virNetServerClientDispatchWrite() frees it twice. Patch 1 is the fix: give the handlers a distinct return value meaning "already queued, do not touch msg again". daemonStreamHandleHole() had the same defect and is fixed alongside. Note the requeue test has to change from "ret > 0" to "ret == 1", otherwise the new value would requeue a message which is already on client->tx. Patch 2 is independent hardening: make virNetMessageQueuePush() refuse a push that would corrupt the list, so a caller bug of this shape surfaces as a log message rather than as heap corruption. It includes a regression test that reproduces the self-cycle deterministically. Note that virNetMessageClear() memsets the whole message including ->next, so a queued message can appear unlinked. That is why patch 2 walks the queue rather than testing msg->next, and why this class of bug is easy to miss by inspection. There is no ABI change; src/libvirt_remote.syms is untouched. Evidence -------- - valgrind memcheck: "Invalid free()" with the previous free at the *same* call site, plus 13 invalid reads and 6 invalid writes as the "while (client->tx)" loop re-reads the freed block. Exactly one invalid free per occurrence, as a self-cycle predicts. - A production core dump whose crash IP is the return address of the same call to virNetMessageFree(), resolving to virnetserverclient.c:1374. - Instrumented builds logging both push sites: virNetServerProgramSendError:168 followed by daemonStreamHandleWrite:797. Two cautions for anyone reproducing this: Under valgrind the daemon does *not* abort - memcheck replaces the allocator, so glibc's malloc_printerr never runs. It logs and continues, and the fault is easy to mistake for "works fine". Freed virNetMessage blocks are promptly reused by malloc, so the same address legitimately reappears as a new message moments after being freed. In RPC debug logs that closely resembles a use-after-free and is not one. Testing ------- Reproduced and fixed on three production hypervisors running 12.5.0 with these patches backported. One host had logged 5197 aborts beforehand; across all three there have been zero aborts and zero hardening warnings since. The hardening warning firing before the patch 1 fix and never firing after it is the direct evidence that the root cause, and not just the symptom, is addressed. Full test suite passes on master (306 ok, 1 expected fail, 0 failures). CI on a personal fork is green: 22 jobs passed, 0 failed, covering Fedora 43/44/rawhide, CentOS Stream 9/10, Ubuntu 24.04/26.04 (including clang), openSUSE Tumbleweed/Leap 16, Debian 13, armv7l and mingw32/64, plus check-dco and codestyle. Reported as https://gitlab.com/libvirt/libvirt/-/issues/902 Ross Golder (2): remote: don't queue the stream error reply twice rpc: refuse to queue a message that is already queued src/remote/remote_daemon_stream.c | 51 +++++++++++++----- src/rpc/virnetmessage.c | 43 +++++++++++++++ tests/virnetmessagetest.c | 87 +++++++++++++++++++++++++++++++ 3 files changed, 169 insertions(+), 12 deletions(-) -- 2.53.0

1 2