September 2026 - Devel - libvirt List Archives

[PATCH] qemu: fix missing audit record and lifecycle event on delayed shutdown
by Jim Fehlig 14 Sep '26

14 Sep '26

From: Jim Fehlig <jfehlig(a)suse.com> When a guest shuts down gracefully but its QEMU process takes a long time to cleanup and exit, virProcessKillPainfullyDelay() (used by qemuProcessKill()) times out and returns failure. This causes qemuProcessBeginStopJob() to fail in processMonitorEOFEvent(), which returns early without ever calling qemuProcessStop(), virDomainAuditStop() or queuing the VIR_DOMAIN_EVENT_STOPPED lifecycle event. In this case, qemuProcessKill() falls back to asynchronously monitoring the QEMU process via a pidfd. Once the process is finally confirmed to have exited, QEMU_PROCESS_EVENT_SHUTDOWN_COMPLETED is submitted and handled by processShutdownCompletedEvent(). That function does complete the stop by calling qemuProcessStop() and qemuDomainRemoveInactive(), but it never generates the audit record or the lifecycle event, since that logic lived only in processMonitorEOFEvent(). Management apps relying on the VIR_DOMAIN_EVENT_STOPPED event, or on the audit log, never learn that the domain actually stopped. Fix this by factoring the reason-detection, qemuProcessStop(), audit and lifecycle event logic out of processMonitorEOFEvent() into a new helper, qemuProcessFinishStop(), and call it from both processMonitorEOFEvent() and processShutdownCompletedEvent(). This ensures the audit record and lifecycle event are always generated once the QEMU process has exited, regardless of which path detected it. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- src/qemu/qemu_driver.c | 61 +++++++++++++++++++++++++----------------- 1 file changed, 36 insertions(+), 25 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 8498568623..8bb037966b 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -4166,9 +4166,9 @@ processJobStatusChangeEvent(virDomainObj *vm, static void -processMonitorEOFEvent(virQEMUDriver *driver, - virDomainObj *vm, - int domid) +qemuProcessFinishStop(virQEMUDriver *driver, + virDomainObj *vm, + bool migration) { qemuDomainObjPrivate *priv = vm->privateData; int eventReason = VIR_DOMAIN_EVENT_STOPPED_SHUTDOWN; @@ -4176,27 +4176,9 @@ processMonitorEOFEvent(virQEMUDriver *driver, const char *auditReason = "shutdown"; unsigned int stopFlags = 0; virObjectEvent *event = NULL; - bool migration; - - if (vm->def->id != domid) { - VIR_DEBUG("Domain %s was restarted, ignoring EOF", - vm->def->name); - return; - } - - if (qemuProcessBeginStopJob(vm, VIR_JOB_DESTROY, true) < 0) - return; - - migration = vm->job->asyncJob == VIR_ASYNC_JOB_MIGRATION_IN; - - if (!virDomainObjIsActive(vm)) { - VIR_DEBUG("Domain %p '%s' is not active, ignoring EOF", - vm, vm->def->name); - goto endjob; - } if (virDomainObjGetState(vm, NULL) != VIR_DOMAIN_SHUTDOWN) { - VIR_DEBUG("Monitor connection to '%s' closed without SHUTDOWN event; " + VIR_DEBUG("qemu process for '%s' disappeared without SHUTDOWN event; " "assuming the domain crashed", vm->def->name); eventReason = VIR_DOMAIN_EVENT_STOPPED_FAILED; stopReason = VIR_DOMAIN_SHUTOFF_CRASHED; @@ -4214,6 +4196,34 @@ processMonitorEOFEvent(virQEMUDriver *driver, qemuProcessStop(vm, stopReason, VIR_ASYNC_JOB_NONE, stopFlags); virDomainAuditStop(vm, auditReason); virObjectEventStateQueue(driver->domainEventState, event); +} + + +static void +processMonitorEOFEvent(virQEMUDriver *driver, + virDomainObj *vm, + int domid) +{ + bool migration; + + if (vm->def->id != domid) { + VIR_DEBUG("Domain %s was restarted, ignoring EOF", + vm->def->name); + return; + } + + if (qemuProcessBeginStopJob(vm, VIR_JOB_DESTROY, true) < 0) + return; + + migration = vm->job->asyncJob == VIR_ASYNC_JOB_MIGRATION_IN; + + if (!virDomainObjIsActive(vm)) { + VIR_DEBUG("Domain %p '%s' is not active, ignoring EOF", + vm, vm->def->name); + goto endjob; + } + + qemuProcessFinishStop(driver, vm, migration); endjob: qemuDomainRemoveInactive(vm, 0, migration); @@ -4370,13 +4380,14 @@ processNbdkitExitedEvent(virDomainObj *vm, static void -processShutdownCompletedEvent(virDomainObj *vm) +processShutdownCompletedEvent(virQEMUDriver *driver, + virDomainObj *vm) { if (qemuProcessBeginStopJob(vm, VIR_JOB_DESTROY, true) < 0) return; if (virDomainObjIsActive(vm)) { - qemuProcessStop(vm, VIR_DOMAIN_SHUTOFF_UNKNOWN, VIR_ASYNC_JOB_NONE, 0); + qemuProcessFinishStop(driver, vm, false); qemuDomainRemoveInactive(vm, 0, false); } @@ -4449,7 +4460,7 @@ qemuProcessEventHandler(void *data, processNbdkitExitedEvent(vm, processEvent->data); break; case QEMU_PROCESS_EVENT_SHUTDOWN_COMPLETED: - processShutdownCompletedEvent(vm); + processShutdownCompletedEvent(driver, vm); break; case QEMU_PROCESS_EVENT_LAST: break; -- 2.51.0

2 1

[PULL v2 11/75] net/tap: deprecate "no" as special value for script/downscript
by Michael S. Tsirkin 11 Sep '26

11 Sep '26

From: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> The interface is ambiguous, as "no" is valid file name. So, using "no" as a special value to disable script is deprecated. Use an empty string ("script=" / "downscript=") instead. In a future version, "no" will be treated as a plain file name, just like any other non-empty value. Document the deprecation in docs/about/deprecated.rst, qapi/net.json, and qemu-options.hx. Update other docs to use empty string instead of "no". Add a warning. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> Reviewed-by: Ben Chaney <bchaney(a)akamai.com> Reviewed-by: Markus Armbruster <armbru(a)redhat.com> Reviewed-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Message-ID: <20260819180201.1970193-4-vsementsov(a)yandex-team.ru> --- docs/about/deprecated.rst | 18 ++++++++++++++++++ docs/system/i386/microvm.rst | 4 ++-- docs/system/i386/xenpvh.rst | 2 +- docs/system/ppc/ppce500.rst | 4 ++-- docs/system/riscv/microchip-icicle-kit.rst | 2 +- docs/system/riscv/sifive_u.rst | 2 +- qapi/net.json | 14 ++++++++++---- net/tap.c | 17 +++++++++++------ qemu-options.hx | 8 ++++++-- 9 files changed, 52 insertions(+), 19 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 98c32991c9..61e775373d 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -71,6 +71,15 @@ flexible enough. The monitor objects have been converted to QOM, so ``-mon mode=control`` is replaced by ``-object monitor-qmp``. The short convenience options are not deprecated, only ``-mon``. +``script=no`` and ``downscript=no`` for ``-netdev tap`` (since 11.2) +''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +The special value ``"no"`` for the ``script`` and ``downscript`` +parameters of ``-netdev tap`` disables script execution. This special +treatment of ``"no"`` is deprecated. Use an empty string (``script=`` +or ``downscript=``) to disable script execution instead. In a future +version, ``"no"`` will be treated as a plain file name. + QEMU Machine Protocol (QMP) commands ------------------------------------ @@ -164,6 +173,15 @@ Use ``job-finalize`` instead. Use ``query-accelerators`` instead. +``"no"`` as value of ``script``/``downscript`` for tap in ``netdev_add`` (since 11.2) +''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +The special value ``"no"`` for the ``script`` and ``downscript`` +parameters of ``netdev_add`` with ``type=tap`` disables script +execution. This special treatment of ``"no"`` is deprecated. Use an +empty string instead. In a future version, ``"no"`` will be treated as +a plain file name. + Human Machine Protocol (HMP) commands ------------------------------------- diff --git a/docs/system/i386/microvm.rst b/docs/system/i386/microvm.rst index 1675e37d3e..077ea15751 100644 --- a/docs/system/i386/microvm.rst +++ b/docs/system/i386/microvm.rst @@ -79,7 +79,7 @@ legacy ``ISA serial`` device as console:: -serial stdio \ -drive id=test,file=test.img,format=raw,if=none \ -device virtio-blk-device,drive=test \ - -netdev tap,id=tap0,script=no,downscript=no \ + -netdev tap,id=tap0,script=,downscript= \ -device virtio-net-device,netdev=tap0 While the example above works, you might be interested in reducing the @@ -103,7 +103,7 @@ disabled:: -device virtconsole,chardev=virtiocon0 \ -drive id=test,file=test.img,format=raw,if=none \ -device virtio-blk-device,drive=test \ - -netdev tap,id=tap0,script=no,downscript=no \ + -netdev tap,id=tap0,script=,downscript= \ -device virtio-net-device,netdev=tap0 diff --git a/docs/system/i386/xenpvh.rst b/docs/system/i386/xenpvh.rst index 904778e3f5..862f38830b 100644 --- a/docs/system/i386/xenpvh.rst +++ b/docs/system/i386/xenpvh.rst @@ -42,7 +42,7 @@ case you need to construct one manually: -vnc none \ -display none \ -device virtio-net-pci,id=nic0,netdev=net0,mac=00:16:3e:5c:81:78 \ - -netdev type=tap,id=net0,ifname=vif3.0-emu,br=xenbr0,script=no,downscript=no \ + -netdev type=tap,id=net0,ifname=vif3.0-emu,br=xenbr0,script=,downscript= \ -smp 4,maxcpus=4 \ -nographic \ -machine xenpvh,ram-low-base=0,ram-low-size=2147483648,ram-high-base=4294967296,ram-high-size=2147483648,pci-ecam-base=824633720832,pci-ecam-size=268435456,pci-mmio-base=4026531840,pci-mmio-size=33554432,pci-mmio-high-base=824902156288,pci-mmio-high-size=68719476736 \ diff --git a/docs/system/ppc/ppce500.rst b/docs/system/ppc/ppce500.rst index c9fe0915dc..ec5aaf14fd 100644 --- a/docs/system/ppc/ppce500.rst +++ b/docs/system/ppc/ppce500.rst @@ -158,14 +158,14 @@ interface at PCI address 0.1.0, but we can switch that to an e1000 NIC by: $ qemu-system-ppc64 -M ppce500 -smp 4 -m 2G \ -display none -serial stdio \ -bios u-boot \ - -nic tap,ifname=tap0,script=no,downscript=no,model=e1000 + -nic tap,ifname=tap0,script=,downscript=,model=e1000 The QEMU ``ppce500`` machine can also dynamically instantiate an eTSEC device if “-device eTSEC” is given to QEMU: .. code-block:: bash - -netdev tap,ifname=tap0,script=no,downscript=no,id=net0 -device eTSEC,netdev=net0 + -netdev tap,ifname=tap0,script=,downscript=,id=net0 -device eTSEC,netdev=net0 Root file system on flash drive ------------------------------- diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst index 9809e94b84..7fdb96601a 100644 --- a/docs/system/riscv/microchip-icicle-kit.rst +++ b/docs/system/riscv/microchip-icicle-kit.rst @@ -84,7 +84,7 @@ Then we can boot the machine by: $ qemu-system-riscv64 -M microchip-icicle-kit -smp 5 -m 2G \ -sd path/to/sdcard.img \ -nic user,model=cadence_gem \ - -nic tap,ifname=tap,model=cadence_gem,script=no \ + -nic tap,ifname=tap,model=cadence_gem,script= \ -display none -serial stdio \ -kernel path/to/u-boot/build/dir/u-boot.bin \ -dtb path/to/u-boot/build/dir/u-boot.dtb diff --git a/docs/system/riscv/sifive_u.rst b/docs/system/riscv/sifive_u.rst index 8f55ae8e31..0e4dcf3e70 100644 --- a/docs/system/riscv/sifive_u.rst +++ b/docs/system/riscv/sifive_u.rst @@ -199,7 +199,7 @@ To boot the VxWorks kernel in QEMU with the ``sifive_u`` machine, use: $ qemu-system-riscv64 -M sifive_u -smp 5 -m 2G \ -display none -serial stdio \ - -nic tap,ifname=tap0,script=no,downscript=no \ + -nic tap,ifname=tap0,script=,downscript= \ -kernel /path/to/vxWorks \ -append "gem(0,0)host:vxWorks h=192.168.200.1 e=192.168.200.2:ffffff00 u=target pw=vxTarget f=0x01" diff --git a/qapi/net.json b/qapi/net.json index ab8ed9c086..dccf95bbbc 100644 --- a/qapi/net.json +++ b/qapi/net.json @@ -399,15 +399,21 @@ # @fds: multiple file descriptors of already opened multiqueue capable # tap # -# @script: script to initialize the interface. An empty string or -# "no" disables script execution. Defaults to +# @script: script to initialize the interface. An empty string +# disables script execution. Defaults to # ``<sysconfdir>/qemu-ifup``, where ``<sysconfdir>`` is the # system configuration directory at build time (typically /etc). +# Using "no" to disable script execution is deprecated (since +# 11.2); use an empty string instead. In a future version, "no" +# will be treated as a plain file name. # -# @downscript: script to shut down the interface. An empty string or -# "no" disables script execution. Defaults to +# @downscript: script to shut down the interface. An empty string +# disables script execution. Defaults to # ``<sysconfdir>/qemu-ifdown``, where ``<sysconfdir>`` is the # system configuration directory at build time (typically /etc). +# Using "no" to disable script execution is deprecated (since +# 11.2); use an empty string instead. In a future version, "no" +# will be treated as a plain file name. # # @br: bridge name (since 2.8) # diff --git a/net/tap.c b/net/tap.c index 2076f5b780..f4051e8d4b 100644 --- a/net/tap.c +++ b/net/tap.c @@ -92,7 +92,8 @@ static void launch_script(const char *setup_script, const char *ifname, static void tap_send(void *opaque); static void tap_writable(void *opaque); -static bool tap_is_explicit_no_script(const char *script_arg_value) +static bool tap_is_explicit_no_script(const char *script_arg_name, + const char *script_arg_value) { if (!script_arg_value) { return false; @@ -103,16 +104,19 @@ static bool tap_is_explicit_no_script(const char *script_arg_value) } if (strcmp(script_arg_value, "no") == 0) { + warn_report("'%s=no' is deprecated; use '%s=' instead", + script_arg_name, script_arg_name); return true; } return false; } -static char *tap_parse_script(const char *script_arg_value, +static char *tap_parse_script(const char *script_arg_name, + const char *script_arg_value, const char *default_path) { - if (tap_is_explicit_no_script(script_arg_value)) { + if (tap_is_explicit_no_script(script_arg_name, script_arg_value)) { return NULL; } @@ -741,7 +745,7 @@ static bool net_init_tap_one(const NetdevTapOptions *tap, NetClientState *peer, qemu_set_info_str(&s->nc, "helper=%s", tap->helper); } else { qemu_set_info_str(&s->nc, "ifname=%s,script=%s,downscript=%s", ifname, - script ?: "no", downscript ?: "no"); + script ?: "", downscript ?: ""); if (downscript) { snprintf(s->down_script, sizeof(s->down_script), "%s", downscript); @@ -947,9 +951,10 @@ int net_init_tap(const Netdev *netdev, const char *name, } } else { g_autofree char *script = - tap_parse_script(tap->script, DEFAULT_NETWORK_SCRIPT); + tap_parse_script("script", tap->script, DEFAULT_NETWORK_SCRIPT); g_autofree char *downscript = - tap_parse_script(tap->downscript, DEFAULT_NETWORK_DOWN_SCRIPT); + tap_parse_script("downscript", tap->downscript, + DEFAULT_NETWORK_DOWN_SCRIPT); if (tap->ifname) { pstrcpy(ifname, sizeof ifname, tap->ifname); diff --git a/qemu-options.hx b/qemu-options.hx index 16ef7d5455..2f6863180b 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -3022,7 +3022,8 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " use network scripts 'file' (default=" DEFAULT_NETWORK_SCRIPT ")\n" " to configure it and 'dfile' (default=" DEFAULT_NETWORK_DOWN_SCRIPT ")\n" " to deconfigure it\n" - " use '[down]script=no' or '[down]script=' to disable script execution\n" + " use '[down]script=' to disable script execution\n" + " ('[down]script=no' is deprecated and will be treated as a file name in future)\n" " use network helper 'helper' (default=" DEFAULT_BRIDGE_HELPER ") to\n" " configure it\n" " use 'fd=h' to connect to an already opened TAP interface\n" @@ -3561,7 +3562,10 @@ SRST ``<sysconfdir>/qemu-ifup`` and the default network deconfigure script is ``<sysconfdir>/qemu-ifdown``, where ``<sysconfdir>`` is the system configuration directory at build time (typically ``/etc``). - Use ``[down]script=no`` or ``[down]script=`` to disable script execution. + Use ``[down]script=`` to disable script execution. + Using ``[down]script=no`` is deprecated; it disables script + execution now, but in a future version it will be treated as a + plain file name. If running QEMU as an unprivileged user, use the network helper to configure the TAP interface and attach it to the bridge. -- MST

1 0

[PULL 21/90] net/tap: deprecate "no" as special value for script/downscript
by Michael S. Tsirkin 10 Sep '26

10 Sep '26

From: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> The interface is ambiguous, as "no" is valid file name. So, using "no" as a special value to disable script is deprecated. Use an empty string ("script=" / "downscript=") instead. In a future version, "no" will be treated as a plain file name, just like any other non-empty value. Document the deprecation in docs/about/deprecated.rst, qapi/net.json, and qemu-options.hx. Update other docs to use empty string instead of "no". Add a warning. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> Reviewed-by: Ben Chaney <bchaney(a)akamai.com> Reviewed-by: Markus Armbruster <armbru(a)redhat.com> Reviewed-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Message-ID: <20260819180201.1970193-4-vsementsov(a)yandex-team.ru> --- docs/about/deprecated.rst | 18 ++++++++++++++++++ docs/system/i386/microvm.rst | 4 ++-- docs/system/i386/xenpvh.rst | 2 +- docs/system/ppc/ppce500.rst | 4 ++-- docs/system/riscv/microchip-icicle-kit.rst | 2 +- docs/system/riscv/sifive_u.rst | 2 +- qapi/net.json | 14 ++++++++++---- net/tap.c | 17 +++++++++++------ qemu-options.hx | 8 ++++++-- 9 files changed, 52 insertions(+), 19 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 98c32991c9..61e775373d 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -71,6 +71,15 @@ flexible enough. The monitor objects have been converted to QOM, so ``-mon mode=control`` is replaced by ``-object monitor-qmp``. The short convenience options are not deprecated, only ``-mon``. +``script=no`` and ``downscript=no`` for ``-netdev tap`` (since 11.2) +''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +The special value ``"no"`` for the ``script`` and ``downscript`` +parameters of ``-netdev tap`` disables script execution. This special +treatment of ``"no"`` is deprecated. Use an empty string (``script=`` +or ``downscript=``) to disable script execution instead. In a future +version, ``"no"`` will be treated as a plain file name. + QEMU Machine Protocol (QMP) commands ------------------------------------ @@ -164,6 +173,15 @@ Use ``job-finalize`` instead. Use ``query-accelerators`` instead. +``"no"`` as value of ``script``/``downscript`` for tap in ``netdev_add`` (since 11.2) +''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +The special value ``"no"`` for the ``script`` and ``downscript`` +parameters of ``netdev_add`` with ``type=tap`` disables script +execution. This special treatment of ``"no"`` is deprecated. Use an +empty string instead. In a future version, ``"no"`` will be treated as +a plain file name. + Human Machine Protocol (HMP) commands ------------------------------------- diff --git a/docs/system/i386/microvm.rst b/docs/system/i386/microvm.rst index 1675e37d3e..077ea15751 100644 --- a/docs/system/i386/microvm.rst +++ b/docs/system/i386/microvm.rst @@ -79,7 +79,7 @@ legacy ``ISA serial`` device as console:: -serial stdio \ -drive id=test,file=test.img,format=raw,if=none \ -device virtio-blk-device,drive=test \ - -netdev tap,id=tap0,script=no,downscript=no \ + -netdev tap,id=tap0,script=,downscript= \ -device virtio-net-device,netdev=tap0 While the example above works, you might be interested in reducing the @@ -103,7 +103,7 @@ disabled:: -device virtconsole,chardev=virtiocon0 \ -drive id=test,file=test.img,format=raw,if=none \ -device virtio-blk-device,drive=test \ - -netdev tap,id=tap0,script=no,downscript=no \ + -netdev tap,id=tap0,script=,downscript= \ -device virtio-net-device,netdev=tap0 diff --git a/docs/system/i386/xenpvh.rst b/docs/system/i386/xenpvh.rst index 904778e3f5..862f38830b 100644 --- a/docs/system/i386/xenpvh.rst +++ b/docs/system/i386/xenpvh.rst @@ -42,7 +42,7 @@ case you need to construct one manually: -vnc none \ -display none \ -device virtio-net-pci,id=nic0,netdev=net0,mac=00:16:3e:5c:81:78 \ - -netdev type=tap,id=net0,ifname=vif3.0-emu,br=xenbr0,script=no,downscript=no \ + -netdev type=tap,id=net0,ifname=vif3.0-emu,br=xenbr0,script=,downscript= \ -smp 4,maxcpus=4 \ -nographic \ -machine xenpvh,ram-low-base=0,ram-low-size=2147483648,ram-high-base=4294967296,ram-high-size=2147483648,pci-ecam-base=824633720832,pci-ecam-size=268435456,pci-mmio-base=4026531840,pci-mmio-size=33554432,pci-mmio-high-base=824902156288,pci-mmio-high-size=68719476736 \ diff --git a/docs/system/ppc/ppce500.rst b/docs/system/ppc/ppce500.rst index c9fe0915dc..ec5aaf14fd 100644 --- a/docs/system/ppc/ppce500.rst +++ b/docs/system/ppc/ppce500.rst @@ -158,14 +158,14 @@ interface at PCI address 0.1.0, but we can switch that to an e1000 NIC by: $ qemu-system-ppc64 -M ppce500 -smp 4 -m 2G \ -display none -serial stdio \ -bios u-boot \ - -nic tap,ifname=tap0,script=no,downscript=no,model=e1000 + -nic tap,ifname=tap0,script=,downscript=,model=e1000 The QEMU ``ppce500`` machine can also dynamically instantiate an eTSEC device if “-device eTSEC” is given to QEMU: .. code-block:: bash - -netdev tap,ifname=tap0,script=no,downscript=no,id=net0 -device eTSEC,netdev=net0 + -netdev tap,ifname=tap0,script=,downscript=,id=net0 -device eTSEC,netdev=net0 Root file system on flash drive ------------------------------- diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst index 9809e94b84..7fdb96601a 100644 --- a/docs/system/riscv/microchip-icicle-kit.rst +++ b/docs/system/riscv/microchip-icicle-kit.rst @@ -84,7 +84,7 @@ Then we can boot the machine by: $ qemu-system-riscv64 -M microchip-icicle-kit -smp 5 -m 2G \ -sd path/to/sdcard.img \ -nic user,model=cadence_gem \ - -nic tap,ifname=tap,model=cadence_gem,script=no \ + -nic tap,ifname=tap,model=cadence_gem,script= \ -display none -serial stdio \ -kernel path/to/u-boot/build/dir/u-boot.bin \ -dtb path/to/u-boot/build/dir/u-boot.dtb diff --git a/docs/system/riscv/sifive_u.rst b/docs/system/riscv/sifive_u.rst index 8f55ae8e31..0e4dcf3e70 100644 --- a/docs/system/riscv/sifive_u.rst +++ b/docs/system/riscv/sifive_u.rst @@ -199,7 +199,7 @@ To boot the VxWorks kernel in QEMU with the ``sifive_u`` machine, use: $ qemu-system-riscv64 -M sifive_u -smp 5 -m 2G \ -display none -serial stdio \ - -nic tap,ifname=tap0,script=no,downscript=no \ + -nic tap,ifname=tap0,script=,downscript= \ -kernel /path/to/vxWorks \ -append "gem(0,0)host:vxWorks h=192.168.200.1 e=192.168.200.2:ffffff00 u=target pw=vxTarget f=0x01" diff --git a/qapi/net.json b/qapi/net.json index ab8ed9c086..dccf95bbbc 100644 --- a/qapi/net.json +++ b/qapi/net.json @@ -399,15 +399,21 @@ # @fds: multiple file descriptors of already opened multiqueue capable # tap # -# @script: script to initialize the interface. An empty string or -# "no" disables script execution. Defaults to +# @script: script to initialize the interface. An empty string +# disables script execution. Defaults to # ``<sysconfdir>/qemu-ifup``, where ``<sysconfdir>`` is the # system configuration directory at build time (typically /etc). +# Using "no" to disable script execution is deprecated (since +# 11.2); use an empty string instead. In a future version, "no" +# will be treated as a plain file name. # -# @downscript: script to shut down the interface. An empty string or -# "no" disables script execution. Defaults to +# @downscript: script to shut down the interface. An empty string +# disables script execution. Defaults to # ``<sysconfdir>/qemu-ifdown``, where ``<sysconfdir>`` is the # system configuration directory at build time (typically /etc). +# Using "no" to disable script execution is deprecated (since +# 11.2); use an empty string instead. In a future version, "no" +# will be treated as a plain file name. # # @br: bridge name (since 2.8) # diff --git a/net/tap.c b/net/tap.c index 2076f5b780..f4051e8d4b 100644 --- a/net/tap.c +++ b/net/tap.c @@ -92,7 +92,8 @@ static void launch_script(const char *setup_script, const char *ifname, static void tap_send(void *opaque); static void tap_writable(void *opaque); -static bool tap_is_explicit_no_script(const char *script_arg_value) +static bool tap_is_explicit_no_script(const char *script_arg_name, + const char *script_arg_value) { if (!script_arg_value) { return false; @@ -103,16 +104,19 @@ static bool tap_is_explicit_no_script(const char *script_arg_value) } if (strcmp(script_arg_value, "no") == 0) { + warn_report("'%s=no' is deprecated; use '%s=' instead", + script_arg_name, script_arg_name); return true; } return false; } -static char *tap_parse_script(const char *script_arg_value, +static char *tap_parse_script(const char *script_arg_name, + const char *script_arg_value, const char *default_path) { - if (tap_is_explicit_no_script(script_arg_value)) { + if (tap_is_explicit_no_script(script_arg_name, script_arg_value)) { return NULL; } @@ -741,7 +745,7 @@ static bool net_init_tap_one(const NetdevTapOptions *tap, NetClientState *peer, qemu_set_info_str(&s->nc, "helper=%s", tap->helper); } else { qemu_set_info_str(&s->nc, "ifname=%s,script=%s,downscript=%s", ifname, - script ?: "no", downscript ?: "no"); + script ?: "", downscript ?: ""); if (downscript) { snprintf(s->down_script, sizeof(s->down_script), "%s", downscript); @@ -947,9 +951,10 @@ int net_init_tap(const Netdev *netdev, const char *name, } } else { g_autofree char *script = - tap_parse_script(tap->script, DEFAULT_NETWORK_SCRIPT); + tap_parse_script("script", tap->script, DEFAULT_NETWORK_SCRIPT); g_autofree char *downscript = - tap_parse_script(tap->downscript, DEFAULT_NETWORK_DOWN_SCRIPT); + tap_parse_script("downscript", tap->downscript, + DEFAULT_NETWORK_DOWN_SCRIPT); if (tap->ifname) { pstrcpy(ifname, sizeof ifname, tap->ifname); diff --git a/qemu-options.hx b/qemu-options.hx index 16ef7d5455..2f6863180b 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -3022,7 +3022,8 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " use network scripts 'file' (default=" DEFAULT_NETWORK_SCRIPT ")\n" " to configure it and 'dfile' (default=" DEFAULT_NETWORK_DOWN_SCRIPT ")\n" " to deconfigure it\n" - " use '[down]script=no' or '[down]script=' to disable script execution\n" + " use '[down]script=' to disable script execution\n" + " ('[down]script=no' is deprecated and will be treated as a file name in future)\n" " use network helper 'helper' (default=" DEFAULT_BRIDGE_HELPER ") to\n" " configure it\n" " use 'fd=h' to connect to an already opened TAP interface\n" @@ -3561,7 +3562,10 @@ SRST ``<sysconfdir>/qemu-ifup`` and the default network deconfigure script is ``<sysconfdir>/qemu-ifdown``, where ``<sysconfdir>`` is the system configuration directory at build time (typically ``/etc``). - Use ``[down]script=no`` or ``[down]script=`` to disable script execution. + Use ``[down]script=`` to disable script execution. + Using ``[down]script=no`` is deprecated; it disables script + execution now, but in a future version it will be treated as a + plain file name. If running QEMU as an unprivileged user, use the network helper to configure the TAP interface and attach it to the bridge. -- MST

1 0

Entering freeze for libvirt-12.7.0
by Jiri Denemark 10 Sep '26

10 Sep '26

I have just tagged v12.7.0-rc1 in the repository and pushed signed tarballs to https://download.libvirt.org/ Please give the release candidate some testing and in case you find a serious issue which should have a fix in the upcoming release, feel free to reply to this thread to make sure the issue is more visible. If you have not done so yet, please update NEWS.rst to document any significant change you made since the last release. Jirka

1 1

Release of libvirt-12.2.0
by Jiri Denemark 10 Sep '26

10 Sep '26

The 12.2.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * Removed features * qemu: Stop advertising support for ``handle`` backend of 9p filesystems QEMU removed the feature in the 4.0 release, but our capability XML still reported it. * New features * qemu: Add support to configure IOMMUFD backend for whole VM In addition to setting IOMMUFD backend for each device it is possible to use the new ``<iommufd>`` element to enable IOMMUFD backend for all host devices. Users can still change it per device. * qemu: Add support to pass FD for IOMMUFD when starting VM Management applications running unprivileged libvirt can open /dev/iommu and pass FD to libvirt in order to change locked memory accounting. This is done via new ``<iommufd>`` element. * qemu: Add support for declaring that storage was zeroed for storage copy APIs The qemu driver now can skip zeroing of the storage during ``virDomainBlockCopy`` or migration with non-shared storage with the appropriate flags. This can be used for storage technologies which lack efficient zeroing support. * hyperv: Add basic snapshot functionality The hyperv driver now implements the following libvirt APIs: ``virDomainDefineXMLFlags()``, ``virDomainSnapshotLookupByName()``, ``virDomainListAllSnapshots()``, ``virDomainSnapshotNum()``, ``virDomainSnapshotGetXMLDesc()``, ``virDomainSnapshotCurrent()``, ``virDomainHasCurrentSnapshot()``, ``virDomainSnapshotGetParent()``. * Improvements * conf: support more than 255 vCPUs with amd-iommu With 256 or more vCPUs libvirt previously required EIM enabled for all models of IOMMU. This is not valid for AMD model and validation was changed so that XTSup is required there. Additionally, it is automatically enabled if needed. * Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES flag This new flag for virConnectGetDomainCapabilities can be used to request the host-model CPU definition to include all supported features (normally only extra features relative to the selected CPU model are listed). * qemu: Add statistics for ``<dataStore>`` storage The bulk statistics (``virsh domstats --block --backing``) now report also information about the ``<dataStore>`` if given disk uses this feature. * hyperv: Hyper-V guests now report TPM device status in their domain xml definition. * Bug fixes * qemu: Fix crash when attaching network inteface with hostdev network Introduced in v12.1.0 by implementing IOMMUFD backend support for host devices. Enjoy. Jirka

1 0

[PATCH v2 00/12] conf, qemu: Add scalable_mode, fsts, pasid_bits, and svm support for intel-iommu
by Zhenzhong Duan 10 Sep '26

10 Sep '26

Hi, This series adds support for configuring Intel vIOMMU (VT-d) in domain XML and formatting them onto the QEMU command line: * scalable_mode: Configures scalable mode support ('on'/'off'). * fsts: Enables First-Stage Translation support ('on'/'off'). * pasid_bits: Sets the number of supported PASID bits. * svm: Enables Shared Virtual Memory (SVM) / PRQ support ('on'/'off'). With these attributes, users can configure advanced vIOMMU features for both emulated devices and assigned host devices (e.g., vSVA / nested translation via iommufd and first-stage translation). Example domain XML configuration: <iommu model='intel'> <driver caching_mode='on' iotlb='on' scalable_mode='on' fsts='on' pasid_bits='6' svm='on'/> </iommu> Which formats the following QEMU command line options: -device {"driver":"intel-iommu","id":"iommu0","caching-mode":true,"device-iotlb":true,"scalable-mode":true,"fsts":true,"pasid-bits":6,"svm":true} Testing: - Validated with libvirt test suite (ninja test). - Tested DSA card passthrough and SVM/vSVA with iommufd backend. Changelog: v1: - Added support for 'pasid_bits' and 'svm' attributes. - rebased to master branch newest Thanks, Zhenzhong Zhenzhong Duan (12): qemu_capabilities: Introduce QEMU_CAPS_INTEL_IOMMU_SCALABLE_MODE conf: Add scalable_mode attribute to iommu qemu: format scalable-mode on intel-iommu command line qemu_capabilities: Introduce QEMU_CAPS_INTEL_IOMMU_FSTS conf: Add fsts attribute to iommu qemu: format fsts on intel-iommu command line qemu_capabilities: Introduce QEMU_CAPS_INTEL_IOMMU_PASID_BITS conf: add pasid_bits attribute to iommu qemu: format pasid-bits on intel-iommu command line qemu_capabilities: Introduce QEMU_CAPS_INTEL_IOMMU_SVM conf: add svm attribute to iommu qemu: format svm on intel-iommu command line docs/formatdomain.rst | 19 ++++++ src/conf/domain_conf.c | 64 +++++++++++++++++++ src/conf/domain_conf.h | 4 ++ src/conf/domain_validate.c | 12 ++++ src/conf/schemas/domaincommon.rng | 20 ++++++ src/qemu/qemu_capabilities.c | 10 +++ src/qemu/qemu_capabilities.h | 6 ++ src/qemu/qemu_command.c | 4 ++ src/qemu/qemu_validate.c | 31 ++++++++- .../caps_11.0.0_x86_64+sgx.xml | 1 + .../caps_11.0.0_x86_64.xml | 1 + .../caps_11.1.0_x86_64.xml | 4 ++ .../intel-iommu-fsts.x86_64-latest.args | 34 ++++++++++ .../intel-iommu-fsts.x86_64-latest.xml | 37 +++++++++++ tests/qemuxmlconfdata/intel-iommu-fsts.xml | 37 +++++++++++ .../intel-iommu-pasid-bits.x86_64-latest.args | 34 ++++++++++ .../intel-iommu-pasid-bits.x86_64-latest.xml | 37 +++++++++++ .../intel-iommu-pasid-bits.xml | 37 +++++++++++ ...tel-iommu-scalable-mode.x86_64-latest.args | 34 ++++++++++ ...ntel-iommu-scalable-mode.x86_64-latest.xml | 37 +++++++++++ .../intel-iommu-scalable-mode.xml | 37 +++++++++++ .../intel-iommu-svm.x86_64-latest.args | 34 ++++++++++ .../intel-iommu-svm.x86_64-latest.xml | 37 +++++++++++ tests/qemuxmlconfdata/intel-iommu-svm.xml | 37 +++++++++++ tests/qemuxmlconftest.c | 4 ++ 25 files changed, 611 insertions(+), 1 deletion(-) create mode 100644 tests/qemuxmlconfdata/intel-iommu-fsts.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/intel-iommu-fsts.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-fsts.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-pasid-bits.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/intel-iommu-pasid-bits.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-pasid-bits.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-scalable-mode.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/intel-iommu-scalable-mode.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-scalable-mode.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-svm.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/intel-iommu-svm.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/intel-iommu-svm.xml -- 2.52.0

3 23

[PATCH v3 0/7] Add TLS-PSK support for migration
by Abhisek Panda 10 Sep '26

10 Sep '26

QEMU provides the capability to encrypt the migration data stream using two transport layer security (TLS) authentication schemes: X.509 certificates and pre-shared keys (PSK). Currently, Libvirt only supports the X.509-based TLS authentication scheme. In TLS X.509 certificates, a set of live migrations utilize a fixed set of static certificates for encrypted migration. In this authentication scheme, users require to deploy a certificate authority and monitor the certificate expiration window. In case certificates are compromised all the future live migrations are vulnerable. To resolve this, this patch series introduce the support for pre-shared key-based authentication scheme. This mechanism relies on symmetric pre-shared keys (a secret key that is known to both sender and receiver prior to secure communication) for providing secure transfer of data. Libvirt solely manages the lifecycle of the ephemeral pre-shared keys, including, generation, persistent storage, and cleanup. Libvirt generates the key on the source machine, then transfers it to the destination machine using the migration cookie. To allow users to configure the size of the key, Libvirt provides the migrate_tls_psk_length configuration parameter in qemu.conf. To avoid introduction of an additional VIR_MIGRATE_* flag, we rely on existing the VIR_MIGRATE_TLS flag. If the VIR_MIGRATE_TLS flag is set but the necessary X.509 credential files are missing on the destination, then we fallback to using PSK-based authentication scheme during migration. v3: 1. Destination host decides which TLS authentication scheme to use. 2. The directory of the key file is set to <tls_psk_state_dir>/$ID-$VMNAME. 3. Use the same alias for both tls-creds-x509 and tls-creds-psk objects. 4. Validate the length of the pre-shared key. 5. Unit test to validate the pre-shared key in the migration cookie. v2: 1. Libvirt manages the lifecycle of pre-shared keys. 2. Transfer of keys to the destination via the migration cookie 3. Remove the VIR_MIGRATE_TLS_PSK flag instead rely on VIR_MIGRATE_TLS and availability of ca-cert.pem on source. 4. Drop VIR_MIGRATE_PARAM_TLS_PSK_DIRECTORY, Libvirt solely manages the pre-shared keys. Abhisek Panda (7): conf: Add a configuration param for TLS-PSK qemu: Manage a pre-shared key's lifecycle qemu: Add support to build the tls-creds-psk object qemu: rename tls-creds-x509 obj related functions qemu: Manage tls-creds-psk object lifecycle qemu: Set up the migrate TLS-PSK objects tests: Add testing of pre-shared key lifecycle include/libvirt/libvirt-domain.h | 11 +- src/qemu/libvirtd_qemu.aug | 1 + src/qemu/qemu.conf.in | 8 ++ src/qemu/qemu_command.c | 26 ++++ src/qemu/qemu_command.h | 7 + src/qemu/qemu_conf.c | 22 ++++ src/qemu/qemu_conf.h | 2 + src/qemu/qemu_domain.c | 1 + src/qemu/qemu_domain.h | 1 + src/qemu/qemu_driver.c | 6 + src/qemu/qemu_hotplug.c | 40 +++--- src/qemu/qemu_hotplug.h | 24 ++-- src/qemu/qemu_migration.c | 202 +++++++++++++++++++++++++---- src/qemu/qemu_migration_cookie.c | 94 +++++++++++++- src/qemu/qemu_migration_cookie.h | 5 + src/qemu/qemu_migration_params.c | 98 +++++++++++--- src/qemu/qemu_migration_params.h | 22 +++- src/qemu/test_libvirtd_qemu.aug.in | 1 + tests/qemumigrationcookiexmltest.c | 141 +++++++++++++++++++- tests/testutilsqemu.c | 12 ++ 20 files changed, 631 insertions(+), 93 deletions(-) -- 2.43.7

2 20

[PATCH 0/2] virnetdevtap: fix tap device leaks on FreeBSD
by Roman Bogorodskiy 10 Sep '26

10 Sep '26

Roman Bogorodskiy (2): virnetdevtap: fix tap device leak on rename virnetdevtap: fix tap device leak in virNetDevTapCreateInBridgePort() src/util/virnetdevtap.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) -- 2.55.0

2 3

[PATCH 0/4] qemu: Support backup and fsync optional attributes in SWTPM
by Arun Menon 09 Sep '26

09 Sep '26

In the upcoming release of swtpm, 2 new options, backup and fsync will be added to the directory backend [1] and [2]. This allows the user to backup and fsync the state file and its parent directory. It lowers the probability of TPM state file corruption in case of a power loss. Although this has not been added to the stable swtpm release yet, Libvirt will require some changes to incorporate these options in the XML config. Following is the sample xml configuration snip to enable backup and fsync: <tpm model='tpm-crb'> <backend type='emulator' version='2.0' backup='yes' fsync='yes'/> </tpm> Tested with swtpm commit #8ecf2c1 and libtpms commit #18e42c8d: $ ps aux | grep swtpm arun 33881 0.0 0.0 24080 10188 ? S 00:09 0:00 /usr/local/bin/swtpm socket --ctrl type=unixio,path=/run/user/1000/libvirt/qemu/run/swtpm/5-guest-vm-swtpm.sock,mode=0600 --tpmstate dir=/home/arun/.config/libvirt/qemu/swtpm/0a64239e-6311-4e53-8903-d1d49608a751/tpm2,mode=0600,lock,backup,fsync --log file=/home/arun/.cache/libvirt/qemu/log/guest-vm-swtpm.log --terminate --tpm2 $ ls -lrt $HOME/.config/libvirt/qemu/swtpm/0a64239e-6311-4e53-8903-d1d49608a751/tpm2 total 16 -rw-------. 1 arun arun 6807 Sep 7 00:14 tpm2-00.permall.bak -rw-------. 1 arun arun 6807 Sep 7 01:02 tpm2-00.permall [1] https://github.com/stefanberger/swtpm/commit/186f72a3a995fc68957ffc0b1438bb… [2] https://github.com/stefanberger/swtpm/commit/795c1973c913da59925fa6c2d688c5… Arun Menon (4): conf: Add backup and fsync optional swtpm attributes to RNG schema conf: Parse and read the xml attributes for swtpm backup and fsync qemu: tpm: Add backup and fsync options to the swtpm command qemuxmlconftest: Add example for backup and fsync tpmstate options docs/formatdomain.rst | 16 ++++++++++ src/conf/domain_conf.c | 31 +++++++++++++++++++ src/conf/domain_conf.h | 2 ++ src/conf/schemas/domaincommon.rng | 10 ++++++ src/qemu/qemu_tpm.c | 17 ++++++++-- src/util/virtpm.c | 2 ++ src/util/virtpm.h | 2 ++ .../tpm-emulator-tpm2-pstate.xml | 2 +- 8 files changed, 79 insertions(+), 3 deletions(-) -- 2.54.0

3 11

[PATCH v2] qemu: Fix crash in qemuProcessStop due to NULL eventThread
by Pritam Srichandan Sahoo 09 Sep '26

09 Sep '26

When a VM shuts down, the monitor EOF event is queued to the worker thread pool. If another thread enters qemuProcessStop() first and frees priv->eventThread via g_steal_pointer(), the second call from the EOF event worker thread hits a NULL dereference when calling virEventThreadStop(priv->eventThread). The existing 'if (priv->eventThread)' guard is insufficient because the VM object is unlocked between the check and the call to virEventThreadStop(), allowing a concurrent thread to clear the pointer in the meantime. Fix this by taking a GObject reference to eventThread before unlocking the VM. This ensures the pointer remains valid for virEventThreadStop() even if another thread clears priv->eventThread concurrently. Crash backtrace: #0 virEventThreadStop (evt=0x0) #1 qemuProcessStop (reason=VIR_DOMAIN_SHUTOFF_SHUTDOWN, asyncJob=VIR_ASYNC_JOB_NONE) #2 processMonitorEOFEvent (driver=..., vm=...) #3 qemuProcessEventHandler (data=..., opaque=...) #4 virThreadPoolWorker (opaque=...) Signed-off-by: Pritam Srichandan Sahoo <PritamSrichandan.Sahoo(a)windriver.com> --- v2: Resend as an inline plain-text patch. The v1 posting was delivered as an email attachment which is harder to review; no code changes from v1. src/qemu/qemu_process.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 0d9b8bcb93..642e18eeb1 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -8850,13 +8850,15 @@ void qemuProcessStop(virQEMUDriver *driver, * the global domain object list code depends on it (and it can't actually * check 'priv->beingDestroyed as that's private). */ if (priv->eventThread) { + virEventThread *eventThread = g_object_ref(priv->eventThread); /* Explicitly set priv->beingDestroyed. While it's done in * qemuProcessBeginStopJob(), qemuProcessStop() is called from places * where stop job is not acquired. */ priv->beingDestroyed = true; virObjectUnlock(vm); - virEventThreadStop(priv->eventThread); + virEventThreadStop(eventThread); virObjectLock(vm); + g_object_unref(eventThread); } if (priv->agent) { -- 2.53.0

1 0