August 2026 - Devel - libvirt List Archives

[PATCH v3 0/7] Add TLS-PSK support for migration
by Abhisek Panda 20 Aug '26

20 Aug '26

QEMU provides the capability to encrypt the migration data stream using two transport layer security (TLS) authentication schemes: X.509 certificates and pre-shared keys (PSK). Currently, Libvirt only supports the X.509-based TLS authentication scheme. In TLS X.509 certificates, a set of live migrations utilize a fixed set of static certificates for encrypted migration. In this authentication scheme, users require to deploy a certificate authority and monitor the certificate expiration window. In case certificates are compromised all the future live migrations are vulnerable. To resolve this, this patch series introduce the support for pre-shared key-based authentication scheme. This mechanism relies on symmetric pre-shared keys (a secret key that is known to both sender and receiver prior to secure communication) for providing secure transfer of data. Libvirt solely manages the lifecycle of the ephemeral pre-shared keys, including, generation, persistent storage, and cleanup. Libvirt generates the key on the source machine, then transfers it to the destination machine using the migration cookie. To allow users to configure the size of the key, Libvirt provides the migrate_tls_psk_length configuration parameter in qemu.conf. To avoid introduction of an additional VIR_MIGRATE_* flag, we rely on existing the VIR_MIGRATE_TLS flag. If the VIR_MIGRATE_TLS flag is set but the necessary X.509 credential files are missing on the destination, then we fallback to using PSK-based authentication scheme during migration. v3: 1. Destination host decides which TLS authentication scheme to use. 2. The directory of the key file is set to <tls_psk_state_dir>/$ID-$VMNAME. 3. Use the same alias for both tls-creds-x509 and tls-creds-psk objects. 4. Validate the length of the pre-shared key. 5. Unit test to validate the pre-shared key in the migration cookie. v2: 1. Libvirt manages the lifecycle of pre-shared keys. 2. Transfer of keys to the destination via the migration cookie 3. Remove the VIR_MIGRATE_TLS_PSK flag instead rely on VIR_MIGRATE_TLS and availability of ca-cert.pem on source. 4. Drop VIR_MIGRATE_PARAM_TLS_PSK_DIRECTORY, Libvirt solely manages the pre-shared keys. Abhisek Panda (7): conf: Add a configuration param for TLS-PSK qemu: Manage a pre-shared key's lifecycle qemu: Add support to build the tls-creds-psk object qemu: rename tls-creds-x509 obj related functions qemu: Manage tls-creds-psk object lifecycle qemu: Set up the migrate TLS-PSK objects tests: Add testing of pre-shared key lifecycle include/libvirt/libvirt-domain.h | 11 +- src/qemu/libvirtd_qemu.aug | 1 + src/qemu/qemu.conf.in | 8 ++ src/qemu/qemu_command.c | 26 ++++ src/qemu/qemu_command.h | 7 + src/qemu/qemu_conf.c | 22 ++++ src/qemu/qemu_conf.h | 2 + src/qemu/qemu_domain.c | 1 + src/qemu/qemu_domain.h | 1 + src/qemu/qemu_driver.c | 6 + src/qemu/qemu_hotplug.c | 40 +++--- src/qemu/qemu_hotplug.h | 24 ++-- src/qemu/qemu_migration.c | 202 +++++++++++++++++++++++++---- src/qemu/qemu_migration_cookie.c | 94 +++++++++++++- src/qemu/qemu_migration_cookie.h | 5 + src/qemu/qemu_migration_params.c | 98 +++++++++++--- src/qemu/qemu_migration_params.h | 22 +++- src/qemu/test_libvirtd_qemu.aug.in | 1 + tests/qemumigrationcookiexmltest.c | 141 +++++++++++++++++++- tests/testutilsqemu.c | 12 ++ 20 files changed, 631 insertions(+), 93 deletions(-) -- 2.43.7

2 17

[PATCH] qemu: tpm: Avoid following symlinks when chown'ing log file
by Jim Fehlig 19 Aug '26

19 Aug '26

From: Jim Fehlig <jfehlig(a)suse.com> libvirt chown()s the swtpm log file to the swtpm user:group when starting a VM. The swtpm log directory is writable by swtmp user, who could replace the logfile with a symlink to a root-owned path. At next VM start, libvirt will chown() that path to the swtpm user:group, which breaks the intended separation between the confined swtpm account and root-owned files. Use fchown() on an fd opened with O_NOFOLLOW to avoid the potential symlink attack. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- src/qemu/qemu_tpm.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index 660410bcba..34e11cc02f 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -1030,6 +1030,8 @@ qemuTPMEmulatorPrepareHost(virDomainTPMDef *tpm, uid_t qemu_user, const char *shortName) { + VIR_AUTOCLOSE logfd = -1; + /* create log dir ... allow 'tss' user to cd into it */ if (g_mkdir_with_parents(logDir, 0711) < 0) return -1; @@ -1039,13 +1041,20 @@ qemuTPMEmulatorPrepareHost(virDomainTPMDef *tpm, VIR_DIR_CREATE_ALLOW_EXIST) < 0) return -1; - if (!virFileExists(tpm->data.emulator.logfile) && - virFileTouch(tpm->data.emulator.logfile, 0644) < 0) { + /* Open (creating if necessary) the logfile without following a + * symlink. The log directory is writable by swtpm_user, so we want + * to avoid chown'ing a symlink to an arbitrary path. + */ + if ((logfd = open(tpm->data.emulator.logfile, + O_WRONLY | O_CREAT | O_NOFOLLOW | O_CLOEXEC, 0644)) < 0) { + virReportSystemError(errno, + _("Could not open swtpm logfile %1$s"), + tpm->data.emulator.logfile); return -1; } /* ... and make sure it can be accessed by swtpm_user */ - if (chown(tpm->data.emulator.logfile, swtpm_user, swtpm_group) < 0) { + if (fchown(logfd, swtpm_user, swtpm_group) < 0) { virReportSystemError(errno, _("Could not chown on swtpm logfile %1$s"), tpm->data.emulator.logfile); -- 2.51.0

2 2

[PATCH v21 03/16] net/tap: deprecate "no" as special value for script/downscript
by Vladimir Sementsov-Ogievskiy 19 Aug '26

19 Aug '26

The interface is ambiguous, as "no" is valid file name. So, using "no" as a special value to disable script is deprecated. Use an empty string ("script=" / "downscript=") instead. In a future version, "no" will be treated as a plain file name, just like any other non-empty value. Document the deprecation in docs/about/deprecated.rst, qapi/net.json, and qemu-options.hx. Update other docs to use empty string instead of "no". Add a warning. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> Reviewed-by: Ben Chaney <bchaney(a)akamai.com> Reviewed-by: Markus Armbruster <armbru(a)redhat.com> --- docs/about/deprecated.rst | 18 ++++++++++++++++++ docs/system/i386/microvm.rst | 4 ++-- docs/system/i386/xenpvh.rst | 2 +- docs/system/ppc/ppce500.rst | 4 ++-- docs/system/riscv/microchip-icicle-kit.rst | 2 +- docs/system/riscv/sifive_u.rst | 2 +- net/tap.c | 17 +++++++++++------ qapi/net.json | 14 ++++++++++---- qemu-options.hx | 8 ++++++-- 9 files changed, 52 insertions(+), 19 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 0c656a968fc..c4929317e3a 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -71,6 +71,15 @@ flexible enough. The monitor objects have been converted to QOM, so ``-mon mode=control`` is replaced by ``-object monitor-qmp``. The short convenience options are not deprecated, only ``-mon``. +``script=no`` and ``downscript=no`` for ``-netdev tap`` (since 11.2) +''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +The special value ``"no"`` for the ``script`` and ``downscript`` +parameters of ``-netdev tap`` disables script execution. This special +treatment of ``"no"`` is deprecated. Use an empty string (``script=`` +or ``downscript=``) to disable script execution instead. In a future +version, ``"no"`` will be treated as a plain file name. + QEMU Machine Protocol (QMP) commands ------------------------------------ @@ -164,6 +173,15 @@ Use ``job-finalize`` instead. Use ``query-accelerators`` instead. +``"no"`` as value of ``script``/``downscript`` for tap in ``netdev_add`` (since 11.2) +''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +The special value ``"no"`` for the ``script`` and ``downscript`` +parameters of ``netdev_add`` with ``type=tap`` disables script +execution. This special treatment of ``"no"`` is deprecated. Use an +empty string instead. In a future version, ``"no"`` will be treated as +a plain file name. + Human Machine Protocol (HMP) commands ------------------------------------- diff --git a/docs/system/i386/microvm.rst b/docs/system/i386/microvm.rst index 1675e37d3e7..077ea15751e 100644 --- a/docs/system/i386/microvm.rst +++ b/docs/system/i386/microvm.rst @@ -79,7 +79,7 @@ legacy ``ISA serial`` device as console:: -serial stdio \ -drive id=test,file=test.img,format=raw,if=none \ -device virtio-blk-device,drive=test \ - -netdev tap,id=tap0,script=no,downscript=no \ + -netdev tap,id=tap0,script=,downscript= \ -device virtio-net-device,netdev=tap0 While the example above works, you might be interested in reducing the @@ -103,7 +103,7 @@ disabled:: -device virtconsole,chardev=virtiocon0 \ -drive id=test,file=test.img,format=raw,if=none \ -device virtio-blk-device,drive=test \ - -netdev tap,id=tap0,script=no,downscript=no \ + -netdev tap,id=tap0,script=,downscript= \ -device virtio-net-device,netdev=tap0 diff --git a/docs/system/i386/xenpvh.rst b/docs/system/i386/xenpvh.rst index 904778e3f5c..862f38830b1 100644 --- a/docs/system/i386/xenpvh.rst +++ b/docs/system/i386/xenpvh.rst @@ -42,7 +42,7 @@ case you need to construct one manually: -vnc none \ -display none \ -device virtio-net-pci,id=nic0,netdev=net0,mac=00:16:3e:5c:81:78 \ - -netdev type=tap,id=net0,ifname=vif3.0-emu,br=xenbr0,script=no,downscript=no \ + -netdev type=tap,id=net0,ifname=vif3.0-emu,br=xenbr0,script=,downscript= \ -smp 4,maxcpus=4 \ -nographic \ -machine xenpvh,ram-low-base=0,ram-low-size=2147483648,ram-high-base=4294967296,ram-high-size=2147483648,pci-ecam-base=824633720832,pci-ecam-size=268435456,pci-mmio-base=4026531840,pci-mmio-size=33554432,pci-mmio-high-base=824902156288,pci-mmio-high-size=68719476736 \ diff --git a/docs/system/ppc/ppce500.rst b/docs/system/ppc/ppce500.rst index c9fe0915dc5..ec5aaf14fd9 100644 --- a/docs/system/ppc/ppce500.rst +++ b/docs/system/ppc/ppce500.rst @@ -158,14 +158,14 @@ interface at PCI address 0.1.0, but we can switch that to an e1000 NIC by: $ qemu-system-ppc64 -M ppce500 -smp 4 -m 2G \ -display none -serial stdio \ -bios u-boot \ - -nic tap,ifname=tap0,script=no,downscript=no,model=e1000 + -nic tap,ifname=tap0,script=,downscript=,model=e1000 The QEMU ``ppce500`` machine can also dynamically instantiate an eTSEC device if “-device eTSEC” is given to QEMU: .. code-block:: bash - -netdev tap,ifname=tap0,script=no,downscript=no,id=net0 -device eTSEC,netdev=net0 + -netdev tap,ifname=tap0,script=,downscript=,id=net0 -device eTSEC,netdev=net0 Root file system on flash drive ------------------------------- diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst index 9809e94b84b..7fdb96601ad 100644 --- a/docs/system/riscv/microchip-icicle-kit.rst +++ b/docs/system/riscv/microchip-icicle-kit.rst @@ -84,7 +84,7 @@ Then we can boot the machine by: $ qemu-system-riscv64 -M microchip-icicle-kit -smp 5 -m 2G \ -sd path/to/sdcard.img \ -nic user,model=cadence_gem \ - -nic tap,ifname=tap,model=cadence_gem,script=no \ + -nic tap,ifname=tap,model=cadence_gem,script= \ -display none -serial stdio \ -kernel path/to/u-boot/build/dir/u-boot.bin \ -dtb path/to/u-boot/build/dir/u-boot.dtb diff --git a/docs/system/riscv/sifive_u.rst b/docs/system/riscv/sifive_u.rst index 8f55ae8e313..0e4dcf3e70c 100644 --- a/docs/system/riscv/sifive_u.rst +++ b/docs/system/riscv/sifive_u.rst @@ -199,7 +199,7 @@ To boot the VxWorks kernel in QEMU with the ``sifive_u`` machine, use: $ qemu-system-riscv64 -M sifive_u -smp 5 -m 2G \ -display none -serial stdio \ - -nic tap,ifname=tap0,script=no,downscript=no \ + -nic tap,ifname=tap0,script=,downscript= \ -kernel /path/to/vxWorks \ -append "gem(0,0)host:vxWorks h=192.168.200.1 e=192.168.200.2:ffffff00 u=target pw=vxTarget f=0x01" diff --git a/net/tap.c b/net/tap.c index 2076f5b7802..f4051e8d4b1 100644 --- a/net/tap.c +++ b/net/tap.c @@ -92,7 +92,8 @@ static void launch_script(const char *setup_script, const char *ifname, static void tap_send(void *opaque); static void tap_writable(void *opaque); -static bool tap_is_explicit_no_script(const char *script_arg_value) +static bool tap_is_explicit_no_script(const char *script_arg_name, + const char *script_arg_value) { if (!script_arg_value) { return false; @@ -103,16 +104,19 @@ static bool tap_is_explicit_no_script(const char *script_arg_value) } if (strcmp(script_arg_value, "no") == 0) { + warn_report("'%s=no' is deprecated; use '%s=' instead", + script_arg_name, script_arg_name); return true; } return false; } -static char *tap_parse_script(const char *script_arg_value, +static char *tap_parse_script(const char *script_arg_name, + const char *script_arg_value, const char *default_path) { - if (tap_is_explicit_no_script(script_arg_value)) { + if (tap_is_explicit_no_script(script_arg_name, script_arg_value)) { return NULL; } @@ -741,7 +745,7 @@ static bool net_init_tap_one(const NetdevTapOptions *tap, NetClientState *peer, qemu_set_info_str(&s->nc, "helper=%s", tap->helper); } else { qemu_set_info_str(&s->nc, "ifname=%s,script=%s,downscript=%s", ifname, - script ?: "no", downscript ?: "no"); + script ?: "", downscript ?: ""); if (downscript) { snprintf(s->down_script, sizeof(s->down_script), "%s", downscript); @@ -947,9 +951,10 @@ int net_init_tap(const Netdev *netdev, const char *name, } } else { g_autofree char *script = - tap_parse_script(tap->script, DEFAULT_NETWORK_SCRIPT); + tap_parse_script("script", tap->script, DEFAULT_NETWORK_SCRIPT); g_autofree char *downscript = - tap_parse_script(tap->downscript, DEFAULT_NETWORK_DOWN_SCRIPT); + tap_parse_script("downscript", tap->downscript, + DEFAULT_NETWORK_DOWN_SCRIPT); if (tap->ifname) { pstrcpy(ifname, sizeof ifname, tap->ifname); diff --git a/qapi/net.json b/qapi/net.json index 8f0915c4d86..acb8594c952 100644 --- a/qapi/net.json +++ b/qapi/net.json @@ -399,15 +399,21 @@ # @fds: multiple file descriptors of already opened multiqueue capable # tap # -# @script: script to initialize the interface. An empty string or -# "no" disables script execution. Defaults to +# @script: script to initialize the interface. An empty string +# disables script execution. Defaults to # ``<sysconfdir>/qemu-ifup``, where ``<sysconfdir>`` is the # system configuration directory at build time (typically /etc). +# Using "no" to disable script execution is deprecated (since +# 11.2); use an empty string instead. In a future version, "no" +# will be treated as a plain file name. # -# @downscript: script to shut down the interface. An empty string or -# "no" disables script execution. Defaults to +# @downscript: script to shut down the interface. An empty string +# disables script execution. Defaults to # ``<sysconfdir>/qemu-ifdown``, where ``<sysconfdir>`` is the # system configuration directory at build time (typically /etc). +# Using "no" to disable script execution is deprecated (since +# 11.2); use an empty string instead. In a future version, "no" +# will be treated as a plain file name. # # @br: bridge name (since 2.8) # diff --git a/qemu-options.hx b/qemu-options.hx index 200949655ea..1efdb8e9860 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -3014,7 +3014,8 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " use network scripts 'file' (default=" DEFAULT_NETWORK_SCRIPT ")\n" " to configure it and 'dfile' (default=" DEFAULT_NETWORK_DOWN_SCRIPT ")\n" " to deconfigure it\n" - " use '[down]script=no' or '[down]script=' to disable script execution\n" + " use '[down]script=' to disable script execution\n" + " ('[down]script=no' is deprecated and will be treated as a file name in future)\n" " use network helper 'helper' (default=" DEFAULT_BRIDGE_HELPER ") to\n" " configure it\n" " use 'fd=h' to connect to an already opened TAP interface\n" @@ -3553,7 +3554,10 @@ SRST ``<sysconfdir>/qemu-ifup`` and the default network deconfigure script is ``<sysconfdir>/qemu-ifdown``, where ``<sysconfdir>`` is the system configuration directory at build time (typically ``/etc``). - Use ``[down]script=no`` or ``[down]script=`` to disable script execution. + Use ``[down]script=`` to disable script execution. + Using ``[down]script=no`` is deprecated; it disables script + execution now, but in a future version it will be treated as a + plain file name. If running QEMU as an unprivileged user, use the network helper to configure the TAP interface and attach it to the bridge. -- 2.43.0

1 0

[PATCH v4 0/3] qemu: Support vCMDQ
by Nathan Chen 19 Aug '26

19 Aug '26

Hi, This is a follow up to the previous patchset [0] for supporting Tegra241 vCMDQ. This patchset is tested with Shameer's qemu series for vCMDQ support. The accelerated SMMUv3 series for qemu and Libvirt are pre-requisites for vCMDQ support, as accelerated SMMUv3 must be enabled alongside vCMDQ. A new 'cmdqv' <iommu> driver attribute is introduced to toggle enabling vCMDQ support. For instance, specifying hostdevs associated with multiple accelerated SMMUs + CMDQV enabled, configured to be routed to pcie-expander-bus controllers in a way where VFIO device to SMMUv3 associations are matched with the host: <devices> ... <controller type='pci' index='1' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='252'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </controller> <controller type='pci' index='2' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='248'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </controller> ... <controller type='pci' index='21' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='21' port='0x0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </controller> <controller type='pci' index='22' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='22' port='0xa8'/> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </controller> ... <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> <iommu model='smmuv3'> <driver pciBus='1' accel='on' ats='on' ril='on' ssidsize='20' oas='44' cmdqv='on'/> </iommu> <iommu model='smmuv3'> <driver pciBus='2' accel='on' ats='on' ril='on' ssidsize='20' oas='44' cmdqv='on'/> </iommu> </devices> This would get translated to a qemu command line with the arguments below: -device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ -device '{"driver":"pxb-pcie","bus_nr":248,"id":"pci.2","bus":"pcie.0","addr":"0x2"}' \ -device '{"driver":"pcie-root-port","port":0,"chassis":21,"id":"pci.21","bus":"pci.1","addr":"0x0"}' \ -device '{"driver":"pcie-root-port","port":168,"chassis":22,"id":"pci.22","bus":"pci.2","addr":"0x0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"iommu0","accel":true,"ats":true,"cmdqv":"on","ril":true,"pasid":true,"oas":44}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.2","id":"iommu1","accel":true,"ats":true,"cmdqv":"on","ril":true,"pasid":true,"oas":44}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","bus":"pci.22","addr":"0x0"}' \ This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/cmdqv-v4/ Thanks, Nathan Changes from v3: - Move qemuValidateDomainDeviceDefIOMMU() check from patch 1 to 2 - Mention default hypervisor value will be used in formatdomain.rst if cmdqv is omitted - Make cmdqv virDomainIOMMUDefValidate() check aligned with order of all cmdqv checks in the function - Include cmdqv for accel validation error message in domain_validate.c Changes from v2: - Add QEMU capabilities support for cmdqv - Change QEMU command line parameter to expect OnOffAuto string Changes from v1: - Remove 'identifier' attribute for SMMUv3 - Change QEMU command line property from 'tegra241-cmdqv' to 'cmdqv' - Support QEMU OnOffAuto CMDQV property instead of expecting a bool [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/NGSB… Nathan Chen (3): qemu: introduce QEMU_CAPS_ARM_SMMUV3_CMDQV qemu: add IOMMU attribute "cmdqv" for smmuv3 tests: qemuxmlconfdata: provide cmdqv sample XML and CLI args docs/formatdomain.rst | 8 +++ src/conf/domain_conf.c | 15 +++++ src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 6 +- src/conf/schemas/domaincommon.rng | 5 ++ src/qemu/qemu_capabilities.c | 4 ++ src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_command.c | 1 + src/qemu/qemu_validate.c | 8 +++ .../caps_11.1.0_aarch64.xml | 1 + ...v3-pci-bus-accel-cmdqv.aarch64-latest.args | 40 +++++++++++++ ...uv3-pci-bus-accel-cmdqv.aarch64-latest.xml | 59 +++++++++++++++++++ .../iommu-smmuv3-pci-bus-accel-cmdqv.xml | 49 +++++++++++++++ tests/qemuxmlconftest.c | 1 + 14 files changed, 200 insertions(+), 1 deletion(-) create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-cmdqv.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-cmdqv.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-cmdqv.xml -- 2.43.0

2 4

[PATCH 0/6] resctrl: support whole-process allocations and monitoring
by Jedrzej Wasiukiewicz 19 Aug '26

19 Aug '26

Resctrl support in libvirt currently requires allocations and monitors to be associated with a set of vCPUs. This does not accurately model QEMU resource consumption, as IOThreads, worker threads and emulator threads also consume cache, memory bandwidth and energy. This series introduces a whole-process resctrl scope, allowing ``cachetune``, ``memorytune``, ``energytune`` and ``monitor`` elements to omit the ``vcpus`` attribute and apply to the entire QEMU emulator process. By placing the emulator process into the resctrl group before thread creation, all subsequently created threads inherit the same resctrl configuration. Major design choices: * A resctrl allocation or monitor without a ``vcpus`` attribute is treated as a whole-process group. * Whole-process allocations and per-vCPU allocations are mutually exclusive within a domain to avoid ambiguous resource assignment. * Whole-process monitors require a whole-process allocation of the same resource type and are unique per resource. * Monitors without ``vcpus`` inherit the scope of their parent allocation. Under a whole-process allocation they monitor the whole process; under a per-vCPU allocation they monitor the allocation's vCPU set. This reflects the dependency between resctrl monitoring and allocation groups. * Whole-process resctrl groups are created by placing the QEMU process into the target group before thread creation, allowing all subsequently created threads to inherit the same resctrl configuration. The series also updates XML validation, fixes resctrl monitor statistics reporting, and cleans up monitor domstats output. Jedrzej Wasiukiewicz (6): conf: allow omitting vcpus in cachetune/memorytune/energytune conf: implement whole-process resctrl scope qemu: assign whole-process resctrl groups at domain start qemu: fix resctrl monitor stats reporting the wrong group name qemu: clean up resctrl monitor domstats NEWS: Document whole-process resctrl support NEWS.rst | 11 + docs/formatdomain.rst | 57 +++-- src/conf/domain_conf.c | 231 ++++++++++++------ src/conf/domain_conf.h | 2 + src/conf/schemas/domaincommon.rng | 48 ++-- src/libvirt_private.syms | 1 + src/qemu/qemu_driver.c | 29 ++- src/qemu/qemu_process.c | 40 ++- src/util/virresctrl.c | 20 +- src/util/virresctrl.h | 3 + .../cachetune-monitor-empty-vcpus.xml | 30 +++ .../cachetune-monitor-inherit-alloc.xml | 30 +++ .../cachetune-wholeprocess-duplicate.xml | 32 +++ ...chetune-wholeprocess-monitor-duplicate.xml | 31 +++ .../cachetune-wholeprocess-monitors.xml | 31 +++ .../energytune-colliding-monitor.xml | 30 +++ .../energytune-wholeprocess.xml | 29 +++ .../memorytune-wholeprocess.xml | 29 +++ .../resctrl-wholeprocess-alloc-monitor.xml | 32 +++ .../resctrl-wholeprocess-layering.xml | 32 +++ .../resctrl-wholeprocess-monitors.xml | 33 +++ .../cachetune-monitor-inherit-alloc.xml | 30 +++ tests/genericxml2xmltest.c | 11 + 23 files changed, 694 insertions(+), 128 deletions(-) create mode 100644 tests/genericxml2xmlindata/cachetune-monitor-empty-vcpus.xml create mode 100644 tests/genericxml2xmlindata/cachetune-monitor-inherit-alloc.xml create mode 100644 tests/genericxml2xmlindata/cachetune-wholeprocess-duplicate.xml create mode 100644 tests/genericxml2xmlindata/cachetune-wholeprocess-monitor-duplicate.xml create mode 100644 tests/genericxml2xmlindata/cachetune-wholeprocess-monitors.xml create mode 100644 tests/genericxml2xmlindata/energytune-colliding-monitor.xml create mode 100644 tests/genericxml2xmlindata/energytune-wholeprocess.xml create mode 100644 tests/genericxml2xmlindata/memorytune-wholeprocess.xml create mode 100644 tests/genericxml2xmlindata/resctrl-wholeprocess-alloc-monitor.xml create mode 100644 tests/genericxml2xmlindata/resctrl-wholeprocess-layering.xml create mode 100644 tests/genericxml2xmlindata/resctrl-wholeprocess-monitors.xml create mode 100644 tests/genericxml2xmloutdata/cachetune-monitor-inherit-alloc.xml -- 2.43.0 --------------------------------------------------------------------- Intel Technology Poland sp. z o.o. ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN. Spolka oswiadcza, ze posiada status duzego przedsiebiorcy w rozumieniu ustawy z dnia 8 marca 2013 r. o przeciwdzialaniu nadmiernym opoznieniom w transakcjach handlowych. Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek przegladanie lub rozpowszechnianie jest zabronione. This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by others is strictly prohibited.

1 7

[PATCH v3 0/3] qemu: Support vCMDQ
by Nathan Chen 18 Aug '26

18 Aug '26

Hi, This is a follow up to the previous RFC patchset [0] for supporting Tegra241 vCMDQ. This patchset is tested with Shameer's qemu series for vCMDQ support. The accelerated SMMUv3 series for qemu and Libvirt are pre-requisites for vCMDQ support, as accelerated SMMUv3 must be enabled alongside vCMDQ. A new 'cmdqv' <iommu> driver attribute is introduced to toggle enabling vCMDQ support. For instance, specifying hostdevs associated with multiple accelerated SMMUs + CMDQV enabled, configured to be routed to pcie-expander-bus controllers in a way where VFIO device to SMMUv3 associations are matched with the host: <devices> ... <controller type='pci' index='1' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='252'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </controller> <controller type='pci' index='2' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='248'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </controller> ... <controller type='pci' index='21' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='21' port='0x0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </controller> <controller type='pci' index='22' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='22' port='0xa8'/> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </controller> ... <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> <iommu model='smmuv3'> <driver pciBus='1' accel='on' ats='on' ril='on' ssidsize='20' oas='44' cmdqv='on'/> </iommu> <iommu model='smmuv3'> <driver pciBus='2' accel='on' ats='on' ril='on' ssidsize='20' oas='44' cmdqv='on'/> </iommu> </devices> This would get translated to a qemu command line with the arguments below: -device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ -device '{"driver":"pxb-pcie","bus_nr":248,"id":"pci.2","bus":"pcie.0","addr":"0x2"}' \ -device '{"driver":"pcie-root-port","port":0,"chassis":21,"id":"pci.21","bus":"pci.1","addr":"0x0"}' \ -device '{"driver":"pcie-root-port","port":168,"chassis":22,"id":"pci.22","bus":"pci.2","addr":"0x0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"iommu0","accel":true,"ats":true,"cmdqv":"on","ril":true,"pasid":true,"oas":44}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.2","id":"iommu1","accel":true,"ats":true,"cmdqv":"on","ril":true,"pasid":true,"oas":44}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","bus":"pci.22","addr":"0x0"}' \ This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/cmdqv-v3/ Thanks, Nathan Changes from v2: - Add QEMU capabilities support for cmdqv - Change QEMU command line parameter to expect OnOffAuto string Changes from v1: - Remove 'identifier' attribute for SMMUv3 - Change QEMU command line property from 'tegra241-cmdqv' to 'cmdqv' - Support QEMU OnOffAuto CMDQV property instead of expecting a bool [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/CE6U… Nathan Chen (3): qemu: introduce QEMU_CAPS_ARM_SMMUV3_CMDQV qemu: add IOMMU attribute "cmdqv" for smmuv3 tests: qemuxmlconfdata: provide cmdqv sample XML and CLI args docs/formatdomain.rst | 6 ++ src/conf/domain_conf.c | 15 +++++ src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 6 +- src/conf/schemas/domaincommon.rng | 5 ++ src/qemu/qemu_capabilities.c | 4 ++ src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_command.c | 1 + src/qemu/qemu_validate.c | 8 +++ .../caps_11.1.0_aarch64.xml | 1 + ...v3-pci-bus-accel-cmdqv.aarch64-latest.args | 40 +++++++++++++ ...uv3-pci-bus-accel-cmdqv.aarch64-latest.xml | 59 +++++++++++++++++++ .../iommu-smmuv3-pci-bus-accel-cmdqv.xml | 49 +++++++++++++++ tests/qemuxmlconftest.c | 1 + 14 files changed, 198 insertions(+), 1 deletion(-) create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-cmdqv.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-cmdqv.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-cmdqv.xml -- 2.43.0

3 8

[PATCH] qemuDomainRestoreInternal: Preserve error on cleanup path
by Peter Krempa 18 Aug '26

18 Aug '26

From: Peter Krempa <pkrempa(a)redhat.com> Preserve the error on cleanup path as cleanup of the 'libivrt_iohelper' process may overwrite it with an unactionable error, such as when attempting to restore a save image while the VM is already running: $ virsh list Id Name State -------------------------- 9 cd running $ virsh restore /tmp/cd.save error: Failed to restore domain from /tmp/cd.save error: internal error: Child process (LIBVIRT_LOG_OUTPUTS=1:stderr /home/pipo/build/libvirt/gcc/src/libvirt_iohelper /tmp/cd.save 0) unexpected fatal signal 13 After this patch the original error is reported: $ virsh restore /tmp/cd.save error: Failed to restore domain from /tmp/cd.save error: Requested operation is not valid: domain 'cd' is already active Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_driver.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 61d95bfbbf..25ba6695bb 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5985,6 +5985,7 @@ qemuDomainRestoreInternal(virQEMUDriver *driver, bool sparse = false; bool bypass_cache = (flags & VIR_DOMAIN_SAVE_BYPASS_CACHE) != 0; g_autoptr(qemuMigrationParams) restoreParams = NULL; + virErrorPtr save_err = NULL; virCheckFlags(QEMU_DOMAIN_RESTORE_FLAGS, -1); @@ -6109,6 +6110,7 @@ qemuDomainRestoreInternal(virQEMUDriver *driver, qemuProcessEndJob(vmNew); cleanup: + virErrorPreserveLast(&save_err); VIR_FORCE_CLOSE(fd); if (virFileWrapperFdClose(wrapperFd) < 0) ret = -1; @@ -6117,6 +6119,7 @@ qemuDomainRestoreInternal(virQEMUDriver *driver, if (vmNew && ret < 0) qemuDomainRemoveInactive(vmNew, 0, false); virDomainObjEndAPI(&vmNew); + virErrorRestore(&save_err); return ret; } -- 2.55.0

3 2

Plans for 12.7.0 release (freeze on 2026-08-24)
by Jiri Denemark 18 Aug '26

18 Aug '26

We are getting close to 12.7.0 release of libvirt. To aim for the release on Tuesday 01 Sep I suggest entering the freeze on Monday 24 Aug and tagging RC2 on Thursday 27 Aug. I hope this works for everyone. Jirka

1 0

[PATCH] esx: Don't crash when parsing unmounted datastore
by Michal Privoznik 18 Aug '26

18 Aug '26

From: Michal Privoznik <mprivozn(a)redhat.com> When parsing disk source in ESX driver (esxParseVMXFileName()) the datastore is traversed through trying to find matching prefix. But not every datastore has to be mounted. In that case, esxVI_LookupDatastoreHostMount() returns success and the returned struct has mountInfo->path set to NULL. This can be deducted from the following backtrace (which shows that strlen() hidden in STRSKIP() macro was given NULL pointer). Thread 1 "virsh" received signal SIGSEGV, Segmentation fault. __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76 76 VPCMPEQ (%rdi), %ymm0, %ymm1 (gdb) bt full #0 __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76 No locals. #1 0x00007ffff7c292d7 in esxParseVMXFileName (fileName=0x5555557341d0 "/vmfs/volumes/5f64209f-c0af0aa8-70c4-e4434ba73190/msafra-RHEL9-shared-1/msafra-RHEL9-shared-1_1.vmdk", opaque=0x7fffffffcf80, out=0x7fffffffc738, allow_missing=false) at ../src/esx/esx_driver.c:172 data = 0x7fffffffcf80 propertyNameList = 0x555555738b50 datastoreList = 0x55555573cf40 datastore = <optimized out> hostMount = 0x555555733640 datastoreName = 0x55555573e590 "mnecas-nfs-test" tmp = <optimized out> saveptr = 0x5555556a5b50 "" strippedFileName = 0x0 copyOfFileName = 0x0 directoryAndFileName = <optimized out> ret = -1 __FUNCTION__ = "esxParseVMXFileName" #2 0x00007ffff7bd47f4 in virVMXParseDisk (ctx=ctx@entry=0x7fffffffcfb0, xmlopt=xmlopt@entry=0x555555738d80, conf=conf@entry=0x5555556a5b50, device=device@entry=0, busType=<optimized out>, busType@entry=3, controllerOrBus=controllerOrBus@entry=1, unit=<optimized out>, def=0x7fffffffc960, vmdef=0x5555557375a0) at ../src/vmx/vmx.c:2553 tmp = 0x0 result = -1 prefix = 0x5555557384d0 "scsi1:0" present_name = "scsi1:0.present", '\000' <repeats 16 times> present = true startConnected_name = "scsi1:0.startConnected\000\000\000\000\000\000\000\000\000" startConnected = true deviceType_name = "scsi1:0.deviceType", '\000' <repeats 13 times> deviceType = 0x555555737f60 "scsi-hardDisk" clientDevice_name = "scsi1:0.clientDevice", '\000' <repeats 11 times> clientDevice = false fileType_name = "scsi1:0.fileType", '\000' <repeats 15 times> fileType = 0x0 fileName_name = "scsi1:0.fileName", '\000' <repeats 15 times> fileName = 0x5555557341d0 "/vmfs/volumes/5f64209f-c0af0aa8-70c4-e4434ba73190/msafra-RHEL9-shared-1/msafra-RHEL9-shared-1_1.vmdk" writeThrough_name = "scsi1:0.writeThrough", '\000' <repeats 11 times> writeThrough = false mode_name = "scsi1:0.mode", '\000' <repeats 19 times> mode = 0x0 cleanup = <optimized out> __FUNCTION__ = "virVMXParseDisk" #3 0x00007ffff7bd5f01 in virVMXParseConfig (ctx=0x7fffffffcfb0, xmlopt=0x555555738d80, caps=<optimized out>, vmx=<optimized out>) at ../src/vmx/vmx.c:1749 #4 0x00007ffff7c35319 in esxDomainGetXMLDesc (domain=<optimized out>, flags=0) at ../src/esx/esx_driver.c:2595 #5 0x00007ffff7cc4fd3 in virDomainGetXMLDesc (domain=domain@entry=0x5555557367f0, flags=flags@entry=0) at ../src/libvirt-domain.c:2898 #6 0x0000555555586cca in cmdDumpXML (ctl=0x7fffffffd1d0, cmd=0x5555556a5450) at ../tools/virsh-domain.c:10787 #7 0x00005555555bc7cb in vshCommandRun (ctl=0x7fffffffd1d0, cmd=0x5555556a5450) at ../tools/vsh.c:1383 #8 0x0000555555562fbc in main (argc=<optimized out>, argv=0x7fffffffd5c8) at ../tools/virsh.c:900 The backtrace was trimmed. To fix this, just check whether mount path is not NULL before passing it to STRSKIP(). Resolves: https://redhat.atlassian.net/browse/RHEL-213506 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- BTW: this crasher is easily reproducible with our test suite too. Just comment line 49 in tests/vmx2xmlmock.c file and run vmx2xmltest. src/esx/esx_driver.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c index c5b3fa47b6..75bbd07750 100644 --- a/src/esx/esx_driver.c +++ b/src/esx/esx_driver.c @@ -169,6 +169,9 @@ esxParseVMXFileName(const char *fileName, goto cleanup; } + if (!hostMount->mountInfo->path) + continue; + tmp = (char *)STRSKIP(fileName, hostMount->mountInfo->path); if (!tmp) -- 2.54.0

2 1

[PATCH v2 0/5] qemu: auto-select win-dmp for Windows guest crash dumps
by Denis V. Lunev 18 Aug '26

18 Aug '26

Auto-triggered dumps (on_crash, watchdog) always use QEMU's elf default, which is not WinDbg-loadable for a Windows guest and cannot be reliably converted after the fact. This was proposed before as a per-domain XML knob (https://www.mail-archive.com/devel@lists.libvirt.org/msg09638.html) Daniel P. Berrange objected: QEMU's query-dump-guest-memory-capability reported win-dmp as available on any x86-64 guest regardless of whether it had actually published a Windows dump header, so trusting it was not safe. QEMU's win_dump_available() has since been fixed to check the guest's vmcoreinfo note (https://lore.kernel.org/qemu-devel/20260619101834.228432-1-den@openvz.org/, commit b4bdad7dce). Validated against real guests: a Windows Server 2022 guest crashed via Sysinternals NotMyFault produces a PAGEDU64 (win-dmp) dump; an AlmaLinux 9 guest crashed via sysrq produces an ELF one. A 1GiB quota across two Linux crashes pruned the older dump and kept the newer, over-quota one. syntax-check and virstringtest pass. Changes since v1: * detect the 'allowed-by-guest' feature QEMU 11.1 puts on the win-dmp member of DumpGuestMemoryFormat (thanks Daniel for idea) * skip the probe unless that capability is present, so QEMU that offers win-dmp to every x86 guest keeps the elf default (Daniel). * fix the sort position of both new symbols in libvirt_private.syms, which v1 got wrong; picked up Daniel's Reviewed-by. * update virtlogd.aug and test_virtlogd.aug.in for the quoted form (Daniel). * update libvirtd_qemu.aug and test_libvirtd_qemu.aug.in for the new setting, and VIR_INFO -> VIR_DEBUG (both Daniel); count and remove only the dumps libvirt itself wrote, and skip pruning after a failed dump. * renamed test helpers for virStrToBytes * NEWS.rst entries added. Denis V. Lunev (5): qemu: add capability for guest-aware win-dmp availability qemu: auto-select win-dmp for crash- and watchdog-triggered dumps util: add virStrToBytes() and virConfGetValueBytes() for scaled sizes logging: accept a unit suffix in virtlogd's max_size qemu: cap total size of auto-triggered dumps under auto_dump_path NEWS.rst | 19 ++ src/libvirt_private.syms | 2 + src/logging/log_daemon_config.c | 2 +- src/logging/log_daemon_config.h | 2 +- src/logging/test_virtlogd.aug.in | 2 +- src/logging/virtlogd.aug | 5 +- src/logging/virtlogd.conf | 7 +- src/qemu/libvirtd_qemu.aug | 4 + src/qemu/qemu.conf.in | 17 ++ src/qemu/qemu_capabilities.c | 4 + src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_conf.c | 2 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_driver.c | 163 +++++++++++++++++- src/qemu/test_libvirtd_qemu.aug.in | 1 + src/util/virconf.c | 47 +++++ src/util/virconf.h | 3 + src/util/virutil.c | 23 +++ src/util/virutil.h | 5 + .../caps_11.1.0_aarch64.replies | 5 +- .../caps_11.1.0_aarch64.xml | 1 + .../caps_11.1.0_x86_64.replies | 5 +- .../caps_11.1.0_x86_64.xml | 1 + tests/qemumonitorjsontest.c | 3 + tests/virstringtest.c | 76 ++++++++ 25 files changed, 394 insertions(+), 9 deletions(-) -- 2.53.0

2 6