August 2026 - Devel - libvirt List Archives

[PATCH v2 0/8] various fixes for 11.2 (gitlab, tests, char-fe, fdc, mailmap, deprecations) pre-PR
by Alex Bennée 04 Sep '26

04 Sep '26

This is a rather random selection of fixes that didn't quite make it to 11.1 although we have some qemu-stable material in here. The CFLAGS tweak allow another target to be built and tested on MacOS. There are also riscv64 compilers which could be enabled via brew but I don't have time to look at those. The CFLAGS changes are also subsumed into Pierrick's check-tcg meson updates which might hit first. The char-fe clean-up removes a code smell of device models reaching into qemu_chr_fe_get_driver which is poor practice. The fdc fix resolves one of the many security reports for those that still care about floppy controllers in VMs. In my brief excursion into our confidential bugs I did look at fixing virtio-crypto but found it needs some serious love. Therefor I'm taking the other option of deprecating the module. Finally I'm experimenting with using b4's patch series handling so forgive any finger trouble on this series. I'll roll the PR on Wednesday. Alex. Signed-off-by: Alex Bennée <alex.bennee(a)linaro.org> --- Changes in v2: - added mailmap patch - added fcd test case at review request (AI-used-for trailer) - tweaked virtio-crypto deprecation and commit message - Link to v1: https://lore.kernel.org/qemu-devel/20260819-fixes-for-11-2-v1-0-b7981c2cc37… To: qemu-devel(a)nongnu.org Cc: Philippe Mathieu-Daudé <philmd(a)mailo.com> Cc: Alex Bennée <alex.bennee(a)linaro.org> Cc: Pierrick Bouvier <pierrick.bouvier(a)oss.qualcomm.com> Cc: Peter Maydell <peter.maydell(a)linaro.org> Cc: qemu-arm(a)nongnu.org Cc: "Michael S. Tsirkin" <mst(a)redhat.com> Cc: Stefano Garzarella <sgarzare(a)redhat.com> Cc: "Gonglei (Arei)" <arei.gonglei(a)huawei.com> Cc: zhenwei pi <zhenwei.pi(a)linux.dev> Cc: Laurent Vivier <lvivier(a)redhat.com> Cc: Amit Shah <amit(a)kernel.org> Cc: Marc-André Lureau <marcandre.lureau(a)redhat.com> Cc: Paolo Bonzini <pbonzini(a)redhat.com> Cc: John Snow <jsnow(a)redhat.com> Cc: Kevin Wolf <kwolf(a)redhat.com> Cc: Hanna Reitz <hreitz(a)redhat.com> Cc: qemu-block(a)nongnu.org Cc: Fabiano Rosas <farosas(a)suse.de> Cc: devel(a)lists.libvirt.org --- Alex Bennée (7): gitlab: use .base_meson_job_template for macOS jobs tests/arm: add explicit CFLAGS for system build gitlab: add arm-softmmu tests to the macOS build char-fe: implement qemu_chr_fe_backend_name hw/block: validate the fdc sector position fits within bounds tests/qtest: add test case for fdc sector overflow docs: deprecate virtio-crypto Denis V. Lunev (1): mailmap: map the last From-munged author back to a real identity docs/about/deprecated.rst | 18 +++ hw/block/fdc-internal.h | 1 + include/chardev/char-fe.h | 13 +- backends/cryptodev-vhost-user.c | 8 +- backends/rng-egd.c | 8 +- backends/vhost-user.c | 8 +- hw/block/fdc.c | 30 ++++- hw/char/imx_serial.c | 4 +- tests/qtest/fdc-test.c | 246 +++++++++++++++++++++++++++++++++- .gitlab-ci.d/macos.yml | 7 +- .mailmap | 1 + tests/tcg/arm/Makefile.softmmu-target | 2 +- 12 files changed, 307 insertions(+), 39 deletions(-) --- base-commit: 3375621e78660838b862d411c43f90e905d0b985 change-id: 20260819-fixes-for-11-2-f98744b82c12 Best regards, -- Alex Bennée <alex.bennee(a)linaro.org>

4 13

[PATCH v9 0/4] nwfilter: add nwfilter nftables driver
by Dion Bosschieter 03 Sep '26

03 Sep '26

This series aims to implement nftables as a backend driver for the nwfilter feature. The idea is that it will replace the ebiptables driver and provide an easy way for users to switch from one driver to another. The 1st patch introduces the new nwfilter driver. After which nwfilter allows users to choose it in the 2nd patch. The third patch introduces unit testing of the new nftables driver. Finally the last patch introduces a new element to the nwfilterbinding XML which is used to detect and run a cleanup on the old firewall rules defined via the previous used nwfilter firewall backend. - Implemented very basic nwfilter.conf reading, choosing a nwfilter driver based on the name of the drivers (nftables/ebiptables). Defaults to the nftables driver, based on the firewall_backend_priority meson option, following the bridge driver logic. - Implemented nft tracing and counters usable via nwfilter.conf options "enable_trace" and "enable_counters" - Resolves issue https://gitlab.com/libvirt/libvirt/-/issues/603, benchmarks showed that the amount of iifname jumps for each interface in the root chains is the cause for this. Switched the nftables driver towards a vmap (verdict map) so we can have 1 rule that jumps to the correct root input/output chain per interface. Which improves throughput as when the number of interface check and jump rules increases the throughput decreases. The issue describes the interface matching works using the interface name and the majority of the effort is the strncpy, this patch also switches nftables to an interface_index compare instead. However, just using the interface_index is not enough, the amount of oif and iif jump rules causes quite the performance degradation, the vmap instead solves this. - Split rules into separate tables: "libvirt_nwfilter_ethernet" and "libvirt_nwfilter_inet" to preserve existing firewall behavior. - Reworked chain logic for clarity with root -input/-output chains per interface. input in the VM interface is filtered in the -input chain(s), output out of the VM interface is filtered in the -output chain(s). - Stuck with prerouting and postrouting as hooks for input / output on the _ethernet and _inet table. This makes it easier to merge the tables in the future. Saving management of two tables and decreasing the amount of tables a packet sees. Currently ebtables filtering happens via PREROUTING and POSTROUTING hooks, while ip/ip6tables filtering happens in the output/forward hooks. - Stuck with 2 tables for compatibility reasons with eb iptables, unifying into 1 table will break users firewall definitions, which depend on being able to do accepts on ethernet rules (which currently get defined via ebtables) and additional filtering via the ip rules (which currently get defined via ip(6)tables). The nwfilter_nftables_driver keeps splitting the ethernet and inet rules in separate tables "libvirt_nwfilter_ethernet" and "libvirt_nwfilter_inet". - Rewrote chain logic, so it is easier to understand, input in the VM interface is filtered in the -input chain(s), output out of the VM interface is filtered in the -output chain(s). - Ethernet table has support for subchains where the inet table puts everything in one chain. This is for compatibility reasons with how nwfilter ebiptables behaved, so that users may switch to nftables and expect the same firewalling behavior. - Simplified conntrack handling: rules with accept+conntrack are duplicated to the opposite chain for symmetric behavior, to support the existing ebiptables logic. - Firewall updates continue use tmp names for atomic replacement. Unsupported nwfilter features (for now): - IPSets (potential future support via nft sets) - Reject due to filtering in pre/postrouting, using drop instead of reject, copying logic from existing ebiptables ebtables actions Future improvements: - Use `nft -f` for atomic rule application. - Optional single-table mode via nwfilter.conf. - Optimize boot phase with chain hash comparison. --- Changes in v9: - Fix regression introduced in v8 where we recreate an already created firewall rule in the root sub chain and lower priority firewall rules on the root chain. Changes in v8: - Fix incompatibility issue with ebiptables driver for inet rules Inet rules in nftables are now placed on the root chains following iptables logic inside the ebiptables driver. Introducing subchains for inet caused sorting problems, subchains can accept or drop a packet which on the ebiptables driver inet rules would have been filtered out by rules that were sorted differently. Changes in v7: - Add backend XML element to virnwfilterbinding, to support switching from nwfilter firewall backend Changes in v6: - Add STP support - Add GARP support - Remove comment "priority=%" leftover from debugging Changes in v5: - Fix rarp support via nft raw payload expression Changes in v4: - Fix rarp nft commands "arp saddr ether" "arp daddr ether" - Filter chain creation, don't create unnecessary chains - Apply danpb's suggestion to separate arguments - Fix table not existing errors in drop all rules - Fix table not existing errors in apply basic rules Changes in v3: - Renamed -other to -inet - Renamed - to _ in table names - Updated rule / chain sorting on ethernet table to to copy ebtables logic - Fix possible broken revert path - Fix remove rules not working in some cases, EBUSY - Shared functions camel case commit - Rename config option - Add extra config params, enable_trace, enable_counters This required passing the config struct to the ebip/nft nwfilter drivers - Add extra augeas files Changes in v2: - Rename {ebip,nf}tables specific test files in 1 directory instead of separating them in different directories. - Added default nwfilter.conf file in git, documented including augeas files - Replaced hardcoding of default driver based on existing firewall_backend_priority meson option. - Added nwfilter_driver_conf.{h,c} for configuration handling, to match the common pattern used in other drivers. Dion Bosschieter (4): nwfilter: add nwfilter nftables driver nwfilter: allow use of nftables nwfilter driver via nwfilter.conf nwfilter: add unit tests and test data for nwfilter nftables driver nwfilter: add used firewall backend to nwfilterbinding libvirt.spec.in | 7 + po/POTFILES | 2 + src/conf/schemas/nwfilterbinding.rng | 7 + src/conf/virnwfilterbindingdef.c | 17 +- src/conf/virnwfilterbindingdef.h | 1 + src/conf/virnwfilterobj.h | 20 - src/nwfilter/libvirtd_nwfilter.aug | 45 + src/nwfilter/meson.build | 38 + src/nwfilter/nwfilter.conf.in | 50 + src/nwfilter/nwfilter_driver.c | 67 +- src/nwfilter/nwfilter_driver_conf.c | 214 + src/nwfilter/nwfilter_driver_conf.h | 69 + src/nwfilter/nwfilter_ebiptables_driver.c | 4 +- src/nwfilter/nwfilter_ebiptables_driver.h | 2 +- src/nwfilter/nwfilter_gentech_driver.c | 144 +- src/nwfilter/nwfilter_gentech_driver.h | 5 +- src/nwfilter/nwfilter_nftables_driver.c | 2877 ++++++++++++++ src/nwfilter/nwfilter_nftables_driver.h | 28 + src/nwfilter/nwfilter_tech_driver.h | 3 +- src/nwfilter/test_libvirtd_nwfilter.aug.in | 7 + tests/meson.build | 2 + tests/nwfilternftablestest.c | 426 ++ .../ah-ipv6-linux.nftables.args | 298 ++ .../ah-linux.nftables.args | 292 ++ .../all-ipv6-linux.nftables.args | 280 ++ .../all-linux.nftables.args | 274 ++ .../arp-linux.nftables.args | 285 ++ .../comment-linux.nftables.args | 502 +++ .../conntrack-linux.nftables.args | 190 + .../esp-ipv6-linux.nftables.args | 298 ++ .../esp-linux.nftables.args | 292 ++ .../example-1-linux.nftables.args | 252 ++ .../example-2-linux.nftables.args | 352 ++ .../hex-data-linux.nftables.args | 368 ++ .../icmp-direction-linux.nftables.args | 226 ++ .../icmp-direction2-linux.nftables.args | 226 ++ .../icmp-direction3-linux.nftables.args | 176 + .../icmp-linux.nftables.args | 248 ++ .../icmpv6-linux.nftables.args | 316 ++ .../igmp-linux.nftables.args | 292 ++ .../ip-linux.nftables.args | 199 + .../ipt-no-macspoof-linux.nftables.args | 166 + .../ipv6-linux.nftables.args | 481 +++ .../iter1-linux.nftables.args | 292 ++ .../iter2-linux.nftables.args | 3532 +++++++++++++++++ .../iter3-linux.nftables.args | 410 ++ .../mac-linux.nftables.args | 176 + .../rarp-linux.nftables.args | 207 + .../sctp-ipv6-linux.nftables.args | 316 ++ .../sctp-linux.nftables.args | 316 ++ .../stp-linux.nftables.args | 233 ++ .../target-linux.nftables.args | 454 +++ .../target2-linux.nftables.args | 302 ++ .../tcp-ipv6-linux.nftables.args | 316 ++ .../tcp-linux.nftables.args | 452 +++ .../udp-ipv6-linux.nftables.args | 316 ++ .../udp-linux.nftables.args | 316 ++ .../udplite-ipv6-linux.nftables.args | 298 ++ .../udplite-linux.nftables.args | 292 ++ .../vlan-linux.nftables.args | 257 ++ tests/nwfilterxml2nftfirewalltest.c | 432 ++ .../filter-vars.xml | 1 + .../simple-backend.xml | 10 + tests/virnwfilterbindingxml2xmltest.c | 1 + 64 files changed, 18858 insertions(+), 119 deletions(-) create mode 100644 src/nwfilter/libvirtd_nwfilter.aug create mode 100644 src/nwfilter/nwfilter.conf.in create mode 100644 src/nwfilter/nwfilter_driver_conf.c create mode 100644 src/nwfilter/nwfilter_driver_conf.h create mode 100644 src/nwfilter/nwfilter_nftables_driver.c create mode 100644 src/nwfilter/nwfilter_nftables_driver.h create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in create mode 100644 tests/nwfilternftablestest.c create mode 100755 tests/nwfilterxml2firewalldata/ah-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ah-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/arp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/comment-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/conntrack-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/hex-data-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmpv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/igmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ip-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/mac-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/rarp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-linux.nftables.args create mode 100644 tests/nwfilterxml2firewalldata/stp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/vlan-linux.nftables.args create mode 100644 tests/nwfilterxml2nftfirewalltest.c create mode 100644 tests/virnwfilterbindingxml2xmldata/simple-backend.xml -- 2.53.0

2 7

[PATCH v2 0/5] qemu: auto-select win-dmp for Windows guest crash dumps
by Denis V. Lunev 01 Sep '26

01 Sep '26

Auto-triggered dumps (on_crash, watchdog) always use QEMU's elf default, which is not WinDbg-loadable for a Windows guest and cannot be reliably converted after the fact. This was proposed before as a per-domain XML knob (https://www.mail-archive.com/devel@lists.libvirt.org/msg09638.html) Daniel P. Berrange objected: QEMU's query-dump-guest-memory-capability reported win-dmp as available on any x86-64 guest regardless of whether it had actually published a Windows dump header, so trusting it was not safe. QEMU's win_dump_available() has since been fixed to check the guest's vmcoreinfo note (https://lore.kernel.org/qemu-devel/20260619101834.228432-1-den@openvz.org/, commit b4bdad7dce). Validated against real guests: a Windows Server 2022 guest crashed via Sysinternals NotMyFault produces a PAGEDU64 (win-dmp) dump; an AlmaLinux 9 guest crashed via sysrq produces an ELF one. A 1GiB quota across two Linux crashes pruned the older dump and kept the newer, over-quota one. syntax-check and virstringtest pass. Changes since v1: * detect the 'allowed-by-guest' feature QEMU 11.1 puts on the win-dmp member of DumpGuestMemoryFormat (thanks Daniel for idea) * skip the probe unless that capability is present, so QEMU that offers win-dmp to every x86 guest keeps the elf default (Daniel). * fix the sort position of both new symbols in libvirt_private.syms, which v1 got wrong; picked up Daniel's Reviewed-by. * update virtlogd.aug and test_virtlogd.aug.in for the quoted form (Daniel). * update libvirtd_qemu.aug and test_libvirtd_qemu.aug.in for the new setting, and VIR_INFO -> VIR_DEBUG (both Daniel); count and remove only the dumps libvirt itself wrote, and skip pruning after a failed dump. * renamed test helpers for virStrToBytes * NEWS.rst entries added. Denis V. Lunev (5): qemu: add capability for guest-aware win-dmp availability qemu: auto-select win-dmp for crash- and watchdog-triggered dumps util: add virStrToBytes() and virConfGetValueBytes() for scaled sizes logging: accept a unit suffix in virtlogd's max_size qemu: cap total size of auto-triggered dumps under auto_dump_path NEWS.rst | 19 ++ src/libvirt_private.syms | 2 + src/logging/log_daemon_config.c | 2 +- src/logging/log_daemon_config.h | 2 +- src/logging/test_virtlogd.aug.in | 2 +- src/logging/virtlogd.aug | 5 +- src/logging/virtlogd.conf | 7 +- src/qemu/libvirtd_qemu.aug | 4 + src/qemu/qemu.conf.in | 17 ++ src/qemu/qemu_capabilities.c | 4 + src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_conf.c | 2 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_driver.c | 163 +++++++++++++++++- src/qemu/test_libvirtd_qemu.aug.in | 1 + src/util/virconf.c | 47 +++++ src/util/virconf.h | 3 + src/util/virutil.c | 23 +++ src/util/virutil.h | 5 + .../caps_11.1.0_aarch64.replies | 5 +- .../caps_11.1.0_aarch64.xml | 1 + .../caps_11.1.0_x86_64.replies | 5 +- .../caps_11.1.0_x86_64.xml | 1 + tests/qemumonitorjsontest.c | 3 + tests/virstringtest.c | 76 ++++++++ 25 files changed, 394 insertions(+), 9 deletions(-) -- 2.53.0

3 12

[libvirt PATCH v2] storage: logical: don't write past buffer bounds
by Ján Tomko 01 Sep '26

01 Sep '26

From: Ján Tomko <jtomko(a)redhat.com> If parsed number of extents is 0, the calculated buffer size won't hold the first regex_unit. Closes: https://gitlab.com/libvirt/libvirt/-/work_items/913 Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/storage/storage_backend_logical.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/src/storage/storage_backend_logical.c b/src/storage/storage_backend_logical.c index 51e9337820..6138c6fb81 100644 --- a/src/storage/storage_backend_logical.c +++ b/src/storage/storage_backend_logical.c @@ -127,6 +127,7 @@ virStorageBackendLogicalParseVolExtents(virStorageVolDef *vol, unsigned long long offset; unsigned long long size; unsigned long long length; + g_auto(GStrv) regex_array = NULL; g_autofree char *regex = NULL; /* Assume 1 extent (the regex for 'devices' is "(\\S+)") and only @@ -160,13 +161,10 @@ virStorageBackendLogicalParseVolExtents(virStorageVolDef *vol, } /* Allocate space for 'nextents' regex_unit strings plus a comma for each */ - regex = g_new0(char, nextents * (strlen(regex_unit) + 1) + 1); - strcat(regex, regex_unit); - for (i = 1; i < nextents; i++) { - /* "," is the separator of "devices" field */ - strcat(regex, ","); - strcat(regex, regex_unit); - } + regex_array = g_new0(char *, nextents + 1); + for (i = 0; i < nextents; i++) + regex_array[i] = g_strdup(regex_unit); + regex = g_strjoinv(",", regex_array); re = g_regex_new(regex, 0, 0, &err); if (!re) { -- 2.55.0

2 1

[PATCH 0/6] resctrl: support whole-process allocations and monitoring
by Jedrzej Wasiukiewicz 01 Sep '26

01 Sep '26

Resctrl support in libvirt currently requires allocations and monitors to be associated with a set of vCPUs. This does not accurately model QEMU resource consumption, as IOThreads, worker threads and emulator threads also consume cache, memory bandwidth and energy. This series introduces a whole-process resctrl scope, allowing ``cachetune``, ``memorytune``, ``energytune`` and ``monitor`` elements to omit the ``vcpus`` attribute and apply to the entire QEMU emulator process. By placing the emulator process into the resctrl group before thread creation, all subsequently created threads inherit the same resctrl configuration. Major design choices: * A resctrl allocation or monitor without a ``vcpus`` attribute is treated as a whole-process group. * Whole-process allocations and per-vCPU allocations are mutually exclusive within a domain to avoid ambiguous resource assignment. * Whole-process monitors require a whole-process allocation of the same resource type and are unique per resource. * Monitors without ``vcpus`` inherit the scope of their parent allocation. Under a whole-process allocation they monitor the whole process; under a per-vCPU allocation they monitor the allocation's vCPU set. This reflects the dependency between resctrl monitoring and allocation groups. * Whole-process resctrl groups are created by placing the QEMU process into the target group before thread creation, allowing all subsequently created threads to inherit the same resctrl configuration. The series also updates XML validation, fixes resctrl monitor statistics reporting, and cleans up monitor domstats output. Jedrzej Wasiukiewicz (6): conf: allow omitting vcpus in cachetune/memorytune/energytune conf: implement whole-process resctrl scope qemu: assign whole-process resctrl groups at domain start qemu: fix resctrl monitor stats reporting the wrong group name qemu: clean up resctrl monitor domstats NEWS: Document whole-process resctrl support NEWS.rst | 11 + docs/formatdomain.rst | 57 +++-- src/conf/domain_conf.c | 231 ++++++++++++------ src/conf/domain_conf.h | 2 + src/conf/schemas/domaincommon.rng | 48 ++-- src/libvirt_private.syms | 1 + src/qemu/qemu_driver.c | 29 ++- src/qemu/qemu_process.c | 40 ++- src/util/virresctrl.c | 20 +- src/util/virresctrl.h | 3 + .../cachetune-monitor-empty-vcpus.xml | 30 +++ .../cachetune-monitor-inherit-alloc.xml | 30 +++ .../cachetune-wholeprocess-duplicate.xml | 32 +++ ...chetune-wholeprocess-monitor-duplicate.xml | 31 +++ .../cachetune-wholeprocess-monitors.xml | 31 +++ .../energytune-colliding-monitor.xml | 30 +++ .../energytune-wholeprocess.xml | 29 +++ .../memorytune-wholeprocess.xml | 29 +++ .../resctrl-wholeprocess-alloc-monitor.xml | 32 +++ .../resctrl-wholeprocess-layering.xml | 32 +++ .../resctrl-wholeprocess-monitors.xml | 33 +++ .../cachetune-monitor-inherit-alloc.xml | 30 +++ tests/genericxml2xmltest.c | 11 + 23 files changed, 694 insertions(+), 128 deletions(-) create mode 100644 tests/genericxml2xmlindata/cachetune-monitor-empty-vcpus.xml create mode 100644 tests/genericxml2xmlindata/cachetune-monitor-inherit-alloc.xml create mode 100644 tests/genericxml2xmlindata/cachetune-wholeprocess-duplicate.xml create mode 100644 tests/genericxml2xmlindata/cachetune-wholeprocess-monitor-duplicate.xml create mode 100644 tests/genericxml2xmlindata/cachetune-wholeprocess-monitors.xml create mode 100644 tests/genericxml2xmlindata/energytune-colliding-monitor.xml create mode 100644 tests/genericxml2xmlindata/energytune-wholeprocess.xml create mode 100644 tests/genericxml2xmlindata/memorytune-wholeprocess.xml create mode 100644 tests/genericxml2xmlindata/resctrl-wholeprocess-alloc-monitor.xml create mode 100644 tests/genericxml2xmlindata/resctrl-wholeprocess-layering.xml create mode 100644 tests/genericxml2xmlindata/resctrl-wholeprocess-monitors.xml create mode 100644 tests/genericxml2xmloutdata/cachetune-monitor-inherit-alloc.xml -- 2.43.0 --------------------------------------------------------------------- Intel Technology Poland sp. z o.o. ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN. Spolka oswiadcza, ze posiada status duzego przedsiebiorcy w rozumieniu ustawy z dnia 8 marca 2013 r. o przeciwdzialaniu nadmiernym opoznieniom w transakcjach handlowych. Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek przegladanie lub rozpowszechnianie jest zabronione. This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by others is strictly prohibited.

1 8

[PATCH 0/2] ch: support NUMA and cpu topology configuration
by Thomas Prescher 31 Aug '26

31 Aug '26

This patch set adds NUMA cell configuration and cpu topology support to the cloud-hyervisor driver. The first patch adds NUMA awareness so users can map guest NUMA nodes to host NUMA nodes. The second patch allows the user to define a concrete vCPU topology that is presented to the guest. Stefan Kober (2): ch: support for numa awareness ch: support CPU topology configuration src/ch/ch_monitor.c | 163 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 161 insertions(+), 2 deletions(-) -- 2.53.0

2 4

[PATCH] NEWS: Document CVEs and a virsh crash fixed in this release
by Peter Krempa 31 Aug '26

31 Aug '26

From: Peter Krempa <pkrempa(a)redhat.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- NEWS.rst | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 829d6eca63..3a847c0107 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -13,6 +13,35 @@ v12.7.0 (unreleased) * **Security** + * CVE-2026-18917: Integer overflow in RPC handler for ``virNodeGetFreePages`` + + The RPC handler for ``virNodeGetFreePages`` didn't properly check for + overflows in multiplication of integers when calculating the amount of + returned data for validation and allocation of the return buffer. + + Specific values could thus pass validation and cause an undersized buffer + to be allocated. The hypervisor driver would then fill the undersized buffer + based on the values prior to multiplication and thus cause a write beyond + the end of the allocated buffer. + + This bug can be triggered via a read-only connection. + + * CVE-2026-77158: Double free of disks array in ``qemuAgentGetDisks`` + + The qemu hypervisor driver would double-free the array of parsed disks, on + error code paths leading to crash of the daemon. The error code path could + be reached when the qemu guest agent provided malformed data as response to + the ``guest-get-disks`` command. + + * CVE-2026-77159: ``chown()`` of swtpm log file follows symlinks + + When starting up a VM with a ``swtpm`` device configured, libvirt + ``chown()``-s the log file of swtpm to the (unprivileged) user/group + running the swtpm process. The problem is that the directory containing the + log files is also owned by the same user/group, thus users with access + to that directory could install a symlink to a privileged file that the + libvirt daemon would follow and chown the file pointed to. + * **Removed features** * **New features** @@ -77,6 +106,12 @@ v12.7.0 (unreleased) all datastores to find which one stores disks for the domain. But if a datastore wasn't mounted, then a crash would occur. This is now fixed. + * virsh: Don't crash when certain error messages are printed + + A bug in the error printing function could cause ``virsh`` to crash when + certain errors (e.g. disk not found in ``virsh detach-disk``) were being + reported. + v12.6.0 (2026-08-03) ==================== -- 2.55.0

2 1

[PULL 5/6] docs: deprecate virtio-crypto
by Alex Bennée 28 Aug '26

28 Aug '26

We have outstanding guest exploitable bugs in the code which is fairly complex and needs some serious love to clean it up. As off-CPU cryptography acceleration seems to be waning in popularity lets just the deprecate the sub-system with a view to removing it in a couple of cycles. We can also remove the backend code at that point as well. Link: https://gitlab.com/qemu-project/qemu/-/work_items/3625 Reviewed-by: Mohamed Mediouni <mohamed(a)unpredictable.fr> Reviewed-by: Thomas Huth <thuth(a)redhat.com> Message-ID: <20260824-fixes-for-11-2-v2-7-352c6b890402(a)linaro.org> Signed-off-by: Alex Bennée <alex.bennee(a)linaro.org> diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 0c656a968fc..05e4ce8cf16 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -276,6 +276,24 @@ future release. Where no 'dh-params.pem' file is provided, the DH parameters will be automatically negotiated in accordance with RFC7919. +Devices +------- + +``virtio-crypto`` and cryptodev backends (since 11.2) +''''''''''''''''''''''''''''''''''''''''''''''''''''' + +The ``virtio-crypto`` device emulation is quite complex code with a +number of known flaws. It has never been migratable, so it is +unlikely to be used in any serious virtualization setting. Modern +ISAs provide on-CPU cryptography instructions (e.g. AES-NI/VAES, +armv8 crypto extensions), and the Linux kernel deprecated AF_ALG +and dropped its off-CPU accelerator support in Linux 7.2, removing +the primary userspace path for off-CPU crypto acceleration. The +time for this sort of off-load has passed. + +As this is the only device that uses the cryptodev backends these will +be removed at the same time the ``virtio-crypto`` device is. + Device options -------------- -- 2.47.3

1 0

[libvirt PATCH] storage: logical: don't write past buffer bounds
by Ján Tomko 27 Aug '26

27 Aug '26

From: Ján Tomko <jtomko(a)redhat.com> If parsed number of extents is 0, the calculated buffer size won't hold the first regex_unit. Closes: https://gitlab.com/libvirt/libvirt/-/work_items/913 Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/storage/storage_backend_logical.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/storage/storage_backend_logical.c b/src/storage/storage_backend_logical.c index 51e9337820..81f9d62d8b 100644 --- a/src/storage/storage_backend_logical.c +++ b/src/storage/storage_backend_logical.c @@ -161,12 +161,12 @@ virStorageBackendLogicalParseVolExtents(virStorageVolDef *vol, /* Allocate space for 'nextents' regex_unit strings plus a comma for each */ regex = g_new0(char, nextents * (strlen(regex_unit) + 1) + 1); - strcat(regex, regex_unit); - for (i = 1; i < nextents; i++) { + for (i = 0; i < nextents; i++) { /* "," is the separator of "devices" field */ - strcat(regex, ","); strcat(regex, regex_unit); + strcat(regex, ","); } + regex[strlen(regex) - 1] = '\0'; re = g_regex_new(regex, 0, 0, &err); if (!re) { -- 2.55.0

3 3

[PATCH 0/7] vmx: Add more controllers and parse PCI addresses
by Michal Privoznik 27 Aug '26

27 Aug '26

This is a prerequisite of the following issue: https://redhat.atlassian.net/browse/RHEL-147630 It's not fixing the issue per-se, so you'll not find any reference to the issue in commit messages. But my gut feeling says let's expose more controllers and their PCI addresses in the domain XML. Michal Prívozník (7): vmx: Add SCSI controllers vmx: Parse PCI address for SCSI controllers vmx: Add SATA controllers vmx: Parse PCI address for SATA controllers vmx: Add NVMe controllers vmx: Parse PCI address for NVMe controllers vmx: Parse PCI address for ethernet devices src/vmx/vmx.c | 173 ++++++++++++++------- tests/vmx2xmldata/esx-in-the-wild-10.xml | 5 +- tests/vmx2xmldata/esx-in-the-wild-11.xml | 5 +- tests/vmx2xmldata/esx-in-the-wild-12.xml | 9 +- tests/vmx2xmldata/esx-in-the-wild-13.xml | 5 +- tests/vmx2xmldata/esx-in-the-wild-14.xml | 5 +- tests/vmx2xmldata/esx-in-the-wild-15.xml | 5 +- tests/vmx2xmldata/esx-in-the-wild-16.xml | 11 +- tests/vmx2xmldata/esx-in-the-wild-17.xml | 9 +- tests/vmx2xmldata/esx-in-the-wild-5.xml | 5 +- tests/vmx2xmldata/esx-in-the-wild-6.xml | 5 +- tests/vmx2xmldata/esx-in-the-wild-7.xml | 5 +- tests/vmx2xmldata/esx-in-the-wild-8.xml | 18 ++- tests/vmx2xmldata/esx-in-the-wild-9.xml | 8 +- tests/vmx2xmldata/fusion-in-the-wild-1.xml | 6 +- tests/vmx2xmldata/gsx-in-the-wild-1.xml | 1 + tests/vmx2xmldata/gsx-in-the-wild-2.xml | 1 + tests/vmx2xmldata/gsx-in-the-wild-3.xml | 1 + tests/vmx2xmldata/gsx-in-the-wild-4.xml | 1 + 19 files changed, 206 insertions(+), 72 deletions(-) -- 2.54.0

2 9