- Devel - libvirt List Archives

[PATCH v4 00/23] LIBVIRT: X86: TDX support
by Zhenzhong Duan 07 Jan '26

07 Jan '26

Hi, This series brings libvirt the x86 TDX support. * What's TDX? TDX stands for Trust Domain Extensions which isolates VMs from the virtual-machine manager (VMM)/hypervisor and any other software on the platform. This patchset extends libvirt to support TDX, with which one can start a TDX guest from high level rather than running qemu directly. * Misc As QEMU use a software emulated way to reset guest which isn't supported by TDX guest for security reason. We simulate reboot for TDX guest by kill and create a new one in FakeReboot framework. Complete code can be found at [1]. * Test Tested with upstream qemu v10.0.0-1724-gf9a3def17b shutdown/reboot/reset with virsh shutdown/reboot trigger in guest shutdown with on_poweroff=destroy/restart reboot with on_reboot=destroy/restart GUEST_PANICKED event processing auto firmware matching * Patch organization - patch 1-4: Some preparing work - patch 5-6: Support query of TDX capabilities - patch 7-15: Add TDX type to launchsecurity framework - patch 16-21: Add reboot/reset support to TDX guest - patch 22: Add conf test dump/cases for '+inteltdx' variant - patch 23: Add docs TODO: - add reconnect logic in virsh command [1] https://github.com/intel/libvirt-tdx/commits/tdx_for_upstream_v4 Thanks Zhenzhong Changelog: v4: - add QGS config to qemuxmlconftest (Daniel) - use 0x10000000 policy value in test as debug isn't supported yet (Daniel) - s/mrowner/mrOwner/ s/mrownerconfig/mrOwnerConfig/ (Daniel) - s/quoteGenerationSocket/quoteGenerationService/ (Daniel) - handle "GUEST_PANICKED" event of type tdx (Daniel) - add automatic firmware matching (Daniel) v3: - fix a hiden failure in qemuBuildTDXQGSCommandLine() (Peter Krempa) - avoid the use of the ternary operator (Peter Krempa) - add capability test dump before capability introduced (Peter Krempa) - change tests version number from 11.0.0 to 10.1.0 (Peter Krempa) v2: - add capability and xmlconf test (Peter Krempa) v1: - s/virQEMUCapsKVMSupportsSecureGuestINTEL/virQEMUCapsKVMSupportsSecureGuestTDX (Daniel) - make policy element optional and expose to QEMU directly (Daniel) - s/qemuProcessSecFakeReboot/qemuProcessFakeRebootViaRecreate (Daniel) - simplify QGS element schema by supporting only UNIX socket (Daniel) - add new events VIR_DOMAIN_EVENT_[STOPPED|STARTED] for control plane (Daniel) - s/quoteGenerationService/quoteGenerationSocket as QEMU - add virsh reset support rfcv4: - add a check to tools/virt-host-validate-qemu.c (Daniel) - remove check of q35 (Daniel) - model 'SocktetAddress' QAPI in xml schema (Daniel) - s/Quote-Generation-Service/quoteGenerationService/ (Daniel) - define bits in tdx->policy and add validating logic (Daniel) - presume QEMU choose split kernel irqchip for TDX guest by default (Daniel) - utilize existing FakeReboot framework to do reboot for TDX guest (Daniel) - drop patch11 'conf: Add support to keep same domid for hard reboot' (Daniel) - add test in tests/ to validate parsing and formatting logic (Daniel) - add doc in docs/formatdomain.rst (Daniel) - add R-B rfcv3: - Change to generate qemu cmdline with -bios - drop firmware auto match as -bios is used - add a hard reboot method to reboot TDX guest rfcv3: https://www.mail-archive.com/devel@lists.libvirt.org/msg00385.html rfcv2: - give up using qmp cmd and check TDX directly on host for TDX capabilities. - use launchsecurity framework to support TDX - use <os>.<loader> for general loader - add auto firmware match feature for TDX A example TDVF fimware description file 70-edk2-x86_64-tdx.json: { "description": "UEFI firmware for x86_64, supporting Intel TDX", "interface-types": [ "uefi" ], "mapping": { "device": "generic", "filename": "/usr/share/OVMF/OVMF_CODE-tdx.fd" }, "targets": [ { "architecture": "x86_64", "machines": [ "pc-q35-*" ] } ], "features": [ "intel-tdx", "verbose-dynamic" ], "tags": [ ] } rfcv2: https://www.mail-archive.com/libvir-list@redhat.com/msg219378.html Zhenzhong Duan (23): tools: Secure guest check for Intel in virt-host-validate qemu: Check if INTEL Trust Domain Extention support is enabled qemucapabilitiesdata: Document '+inteltdx' variant qemucapabilitiestest: Add data for the qemu-10.1.0 dev cycle on x86_64 for the '+inteltdx' variant qemu: Add QEMU_CAPS_TDX_GUEST capability conf: Expose TDX feature in domain capabilities conf: Add tdx as launch security type conf: Validate TDX launchSecurity element mrConfigId/mrOwner/mrOwnerConfig qemu: Add command line and validation for TDX type conf: Expose TDX type in domain launch security capability qemu: Force special parameters enabled for TDX guest qemu: log the crash information for TDX qemu_firmware: Pick the right firmware for TDX guests conf: Add Intel TDX Quote Generation Service(QGS) support qemu: Add command line for TDX Quote Generation Service(QGS) qemu: Add FakeReboot support for TDX guest qemu: Support reboot command in guest qemu: Avoid duplicate FakeReboot for secure guest qemu: Send event VIR_DOMAIN_EVENT_[STOPPED|STARTED] during recreation qemu: Bypass sending VIR_DOMAIN_EVENT_RESUMED event when TD VM reboot qemu: Support domain reset command for TDX guest qemuxmlconftest: Add latest version of 'launch-security-tdx*' test data docs: domain: Add documentation for Intel TDX guest docs/formatdomain.rst | 63 + docs/formatdomaincaps.rst | 1 + examples/c/misc/event-test.c | 6 + include/libvirt/libvirt-domain.h | 2 + src/conf/domain_capabilities.c | 1 + src/conf/domain_capabilities.h | 1 + src/conf/domain_conf.c | 82 + src/conf/domain_conf.h | 21 + src/conf/domain_validate.c | 11 + src/conf/schemas/domaincaps.rng | 9 + src/conf/schemas/domaincommon.rng | 41 + src/conf/virconftypes.h | 2 + src/qemu/qemu_capabilities.c | 38 +- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_cgroup.c | 1 + src/qemu/qemu_command.c | 43 + src/qemu/qemu_domain.h | 1 + src/qemu/qemu_driver.c | 11 +- src/qemu/qemu_firmware.c | 20 + src/qemu/qemu_monitor.c | 50 +- src/qemu/qemu_monitor.h | 13 +- src/qemu/qemu_monitor_json.c | 38 +- src/qemu/qemu_namespace.c | 1 + src/qemu/qemu_process.c | 104 +- src/qemu/qemu_process.h | 2 + src/qemu/qemu_validate.c | 45 + src/security/security_dac.c | 2 + .../qemu_10.1.0-q35.x86_64+inteltdx.xml | 783 + .../domaincapsdata/qemu_10.1.0-q35.x86_64.xml | 7 +- .../qemu_10.1.0-tcg.x86_64+inteltdx.xml | 1830 + .../domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 6 +- .../qemu_10.1.0.x86_64+inteltdx.xml | 783 + tests/domaincapsdata/qemu_10.1.0.x86_64.xml | 7 +- tests/domaincapsmock.c | 3 +- tests/qemucapabilitiesdata/README.rst | 5 + .../caps_10.1.0_x86_64+inteltdx.replies | 44552 ++++++++++++++++ .../caps_10.1.0_x86_64+inteltdx.xml | 3585 ++ .../caps_10.1.0_x86_64.xml | 1 + .../caps.x86_64+inteltdx.xml | 29 + .../firmware/60-edk2-ovmf-x64-inteltdx.json | 1 + ...h-security-tdx.x86_64-latest+inteltdx.args | 44 + ...ch-security-tdx.x86_64-latest+inteltdx.xml | 75 + tests/qemuxmlconfdata/launch-security-tdx.xml | 28 + tests/qemuxmlconftest.c | 3 + tools/virsh-domain-event.c | 6 +- tools/virt-host-validate-common.c | 31 +- tools/virt-host-validate-common.h | 1 + 47 files changed, 52372 insertions(+), 18 deletions(-) create mode 100644 tests/domaincapsdata/qemu_10.1.0-q35.x86_64+inteltdx.xml create mode 100644 tests/domaincapsdata/qemu_10.1.0-tcg.x86_64+inteltdx.xml create mode 100644 tests/domaincapsdata/qemu_10.1.0.x86_64+inteltdx.xml create mode 100644 tests/qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.replies create mode 100644 tests/qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.xml create mode 100644 tests/qemucaps2xmloutdata/caps.x86_64+inteltdx.xml create mode 100644 tests/qemuxmlconfdata/launch-security-tdx.x86_64-latest+inteltdx.args create mode 100644 tests/qemuxmlconfdata/launch-security-tdx.x86_64-latest+inteltdx.xml create mode 100644 tests/qemuxmlconfdata/launch-security-tdx.xml -- 2.47.1

4 39

[RFC PATCH v6 0/4] qemu: Support accelerated vSMMUs and vCMDQ
by Nathan Chen 06 Jan '26

06 Jan '26

Hi, This is a follow up to the fifth RFC patchset [0] for supporting multiple accelerated vSMMU instances. Support for multiple non-accel vSMMUs has been merged [1], while the iommufd patches have been separated into a separated series [2]. This patchset implements support for specifying multiple accelerated vSMMU instances, and is tested with Shameer's v6 qemu series [3] for accelerated SMMUs. Moreover, this patchset implements support for Tegra241 CMDQV for accelerated SMMUs, and is tested with Shameer's v1 qemu RFC [4] for accelerated SMMU Tegra241 CMDQV support. For instance, specifying hostdevs associated with multiple accelerated SMMUs + CMDQV enabled, configured to be routed to pcie-expander-bus controllers in a way where VFIO device to SMMUv3 associations are matched with the host: <devices> ... <controller type='pci' index='1' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='252'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </controller> <controller type='pci' index='2' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='248'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </controller> ... <controller type='pci' index='21' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='21' port='0x0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </controller> <controller type='pci' index='22' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='22' port='0xa8'/> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </controller> ... <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> <iommu model='smmuv3Dev'> <driver parentIdx='1' accel='on' cmdqv='on' ats='on' ril='on' pasid='on' oas='44'/> </iommu> <iommu model='smmuv3Dev'> <driver parentIdx='2' accel='on' cmdqv='on' ats='on' ril='on' pasid='on' oas='44'/> </iommu> </devices> This would get translated to a qemu command line with the arguments below: -device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ -device '{"driver":"pxb-pcie","bus_nr":248,"id":"pci.2","bus":"pcie.0","addr":"0x2"}' \ -device '{"driver":"pcie-root-port","port":0,"chassis":21,"id":"pci.21","bus":"pci.1","addr":"0x0"}' \ -device '{"driver":"pcie-root-port","port":168,"chassis":22,"id":"pci.22","bus":"pci.2","addr":"0x0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"iommu0","accel":true,"tegra241-cmdqv":true,"ats":true,"ril":true,"pasid":true,"oas":44}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.2","id":"iommu1","accel":true,"tegra241-cmdqv":true,"ats":true,"ril":true,"pasid":true,"oas":44}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","bus":"pci.22","addr":"0x0"}' \ This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/smmuv3-accel-cmdqv-01-26/ Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/F4XI… [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/WOJK… [2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/WIBZ… [3] https://lore.kernel.org/all/20251120132213.56581-1-skolothumtho@nvidia.com/… [4] https://lore.kernel.org/all/20251210133737.78257-1-skolothumtho@nvidia.com/ Nathan Chen (4): qemu: Add support for HW-accelerated nested SMMUv3 tests: qemuxmlconfdata: provide HW-accel smmuv3 sample XML and CLI args qemu: add IOMMU attribute "cmdqv" for smmuv3 tests: qemuxmlconfdata: provide cmdqv sample XML and CLI args docs/formatdomain.rst | 32 +++++++ src/conf/domain_conf.c | 93 ++++++++++++++++++- src/conf/domain_conf.h | 6 ++ src/conf/domain_validate.c | 24 ++++- src/conf/schemas/domaincommon.rng | 30 ++++++ src/qemu/qemu_command.c | 12 +++ ...v3-pci-bus-accel-cmdqv.aarch64-latest.args | 41 ++++++++ ...uv3-pci-bus-accel-cmdqv.aarch64-latest.xml | 62 +++++++++++++ .../iommu-smmuv3-pci-bus-accel-cmdqv.xml | 49 ++++++++++ ...u-smmuv3-pci-bus-accel.aarch64-latest.args | 41 ++++++++ ...mu-smmuv3-pci-bus-accel.aarch64-latest.xml | 62 +++++++++++++ .../iommu-smmuv3-pci-bus-accel.xml | 49 ++++++++++ ...-smmuv3-pci-bus-single.aarch64-latest.args | 2 +- .../iommu-smmuv3-pci-bus.aarch64-latest.args | 4 +- tests/qemuxmlconftest.c | 2 + 15 files changed, 502 insertions(+), 7 deletions(-) create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-cmdqv.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-cmdqv.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel-cmdqv.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.xml -- 2.43.0

1 4

[PATCH] qemu: Add stop hook support for domain shutdown
by Mitchel Humpherys 06 Jan '26

06 Jan '26

Introduce a new QEMU hook operation "stop" that is called before a domain is terminated (via virsh shutdown or virsh destroy). This allows external scripts to perform cleanup or veto the stop process by returning a non-zero exit code. The hook is called as: /etc/libvirt/hooks/qemu <guest_name> stop begin - The full domain XML is provided on stdin. Example qemu hook that protects domains from being stopped (to be dropped in /etc/libfirt/hooks/qemu.d/10-vm-protection or similar): ```bash #!/bin/bash # Protection hook - vetos domain stops for domains listed in # /etc/libvirt/protected-domains set -euo pipefail readonly PROTECT_DIR="/etc/libvirt" readonly DOMAIN_NAME="${1:-}" readonly OPERATION="${2:-}" # Only act on stop operation if [[ "$OPERATION" != "stop" ]]; then exit 0 fi readonly PROTECT_LIST="${PROTECT_DIR}/protected-domains" if [[ -f "$PROTECT_LIST" ]]; then # Read file, strip comments and empty lines, check for exact domain match if grep -Fxq -- "$DOMAIN_NAME" <(sed -e 's/#.*$//' -e '/^[[:space:]]*$/d' "$PROTECT_LIST"); then logger -t libvirt-hook-test "20-protection: BLOCKING stop for protected domain '$DOMAIN_NAME'" echo "$(date '+%Y-%m-%d %H:%M:%S'): BLOCKED stop for '$DOMAIN_NAME'" \ >> /tmp/libvirt-test-logs/protection.log printf 'vm-protection: stop blocked for %s\n' "$DOMAIN_NAME" >&2 exit 1 fi fi exit 0 ``` With a list of domains to protect in /etc/libvirt/protected-domains. With the above hook in place, attempting to destroy a domain listed in /etc/libvirt/protected-domains will fail: ``` > virsh list --all Id Name State ------------------------------- 2 protected-vm running - test-vm shut off > virsh destroy protected-vm error: Failed to destroy domain 'protected-vm' error: Hook script execution failed: internal error: Child process (LC_ALL=C LD_LIBRARY_PATH=/opt/libvirt-test/lib/x86_64-linux-gnu:/opt/libvirt-test/lib PATH=/usr/local/sbin:/usr/local/bin:/usr/bin HOME=/root USER=root LOGNAME=root /opt/libvirt-test/etc/libvirt/hooks/qemu.d/20-protection protected-vm stop begin -) unexpected exit status 1: vm-protection: stop blocked for protected-vm > virsh list --all Id Name State ------------------------------- 2 protected-vm running - test-vm shut off ``` Signed-off-by: Mitchel Humpherys <mitch.special(a)gmail.com> --- docs/hooks.rst | 14 +++++++++++--- src/qemu/qemu_process.c | 17 +++++++++++++++++ src/util/virhook.c | 1 + src/util/virhook.h | 1 + 4 files changed, 30 insertions(+), 3 deletions(-) diff --git a/docs/hooks.rst b/docs/hooks.rst index e1745b8cc7..5ae03a36cd 100644 --- a/docs/hooks.rst +++ b/docs/hooks.rst @@ -202,9 +202,17 @@ operation. There is no specific operation to indicate a "restart" is occurring. /etc/libvirt/hooks/qemu guest_name started begin - -- When a QEMU guest is stopped, the qemu hook script is called in two - locations, to match the startup. First, :since:`since 0.8.0`, the hook is - called before libvirt restores any labels: +- When a QEMU guest is stopped, the qemu hook script is called in three + locations, to match the startup. The first location, :since:`since 11.10.0`, + is called before the domain is stopped. This allows the hook to perform + cleanup tasks or veto the stop operation by returning a non-zero exit code: + + :: + + /etc/libvirt/hooks/qemu guest_name stop begin - + + The second location, :since:`since 0.8.0`, is called after the QEMU process + has terminated but before libvirt restores any labels: :: diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 0e50cd1ccc..fa2b691d99 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -9015,6 +9015,23 @@ qemuProcessBeginStopJob(virDomainObj *vm, qemuDomainObjPrivate *priv = vm->privateData; unsigned int killFlags = forceKill ? VIR_QEMU_PROCESS_KILL_FORCE : 0; + /* call stop hook if present */ + if (virHookPresent(VIR_HOOK_DRIVER_QEMU)) { + virQEMUDriver *driver = priv->driver; + g_autofree char *xml = qemuDomainDefFormatXML(driver, NULL, vm->def, 0); + int hookret; + + if (!xml) + return -1; + + hookret = virHookCall(VIR_HOOK_DRIVER_QEMU, vm->def->name, + VIR_HOOK_QEMU_OP_STOP, VIR_HOOK_SUBOP_BEGIN, + NULL, xml, NULL); + + if (hookret < 0) + return -1; + } + /* We need to prevent monitor EOF callback from doing our work (and * sending misleading events) while the vm is unlocked inside * BeginJob/ProcessKill API or any other code path before 'vm->def->id' is diff --git a/src/util/virhook.c b/src/util/virhook.c index d012bb1825..01ba17e406 100644 --- a/src/util/virhook.c +++ b/src/util/virhook.c @@ -76,6 +76,7 @@ VIR_ENUM_IMPL(virHookSubop, VIR_ENUM_IMPL(virHookQemuOp, VIR_HOOK_QEMU_OP_LAST, "start", + "stop", "stopped", "prepare", "release", diff --git a/src/util/virhook.h b/src/util/virhook.h index d8237c837e..ea8c540c3f 100644 --- a/src/util/virhook.h +++ b/src/util/virhook.h @@ -52,6 +52,7 @@ typedef enum { typedef enum { VIR_HOOK_QEMU_OP_START, /* domain is about to start */ + VIR_HOOK_QEMU_OP_STOP, /* domain is about to stop */ VIR_HOOK_QEMU_OP_STOPPED, /* domain has stopped */ VIR_HOOK_QEMU_OP_PREPARE, /* domain startup initiated */ VIR_HOOK_QEMU_OP_RELEASE, /* domain destruction is over */ -- 2.52.0

2 2

[PATCH v2 0/2] qemu: Relax hyperv features validation
by Michal Privoznik 06 Jan '26

06 Jan '26

v2 of: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/5FLY… diff to v1: - Patch 1/3 from original series is dropped, as I misunderstood QEMU's code and though Q35 is not affected. It is. - Patch 2/3 from original series is reworked to drop the check entirely, again, I blame my code misunderstanding. Michal Prívozník (2): qemu_validate: Drop VIR_DOMAIN_HYPERV_SYNIC dependency on VIR_DOMAIN_HYPERV_VPINDEX qemu_validate: Drop VIR_DOMAIN_HYPERV_STIMER dependency on VIR_DOMAIN_HYPERV_VPINDEX src/qemu/qemu_validate.c | 3 --- 1 file changed, 3 deletions(-) -- 2.52.0

2 3

[PATCH 0/3] qemu: Relax hyperv features validation
by Michal Privoznik 06 Jan '26

06 Jan '26

*** BLURB HERE *** Michal Prívozník (3): qemuxmlconfdata: Switch some hyperv tests from i440fx to q35 qemu: Skip validation of VIR_DOMAIN_HYPERV_SYNIC on i440fx qemu_validate: Drop VIR_DOMAIN_HYPERV_STIMER dependency on VIR_DOMAIN_HYPERV_VPINDEX src/qemu/qemu_validate.c | 9 +++++-- .../hyperv-host-model.x86_64-latest.args | 9 +++++-- .../hyperv-host-model.x86_64-latest.xml | 24 ++++++++++++++++--- tests/qemuxmlconfdata/hyperv-host-model.xml | 4 ++-- .../qemuxmlconfdata/hyperv.x86_64-latest.args | 9 +++++-- .../qemuxmlconfdata/hyperv.x86_64-latest.xml | 24 ++++++++++++++++--- tests/qemuxmlconfdata/hyperv.xml | 4 ++-- 7 files changed, 67 insertions(+), 16 deletions(-) -- 2.52.0

3 7

[PATCH 00/10] qemu: Snapshot and saveimage related refactors (background snapshot saga part 2)
by Peter Krempa 06 Jan '26

06 Jan '26

This series fixes up some code (mostly removes unneeded) 'driver' argument and fixes control flow in some snapshot and save image related functions. This series also contains 2 patches necromanced from the original attempt to add background snapshot from Nikolay. Nikolay Shirokovskiy (2): qemu: snapshot: Don't overwrite 'ret' in qemuSnapshotCreateActiveExternal qemu: snapshot: Check earlier if memory snapshot is possible Peter Krempa (8): qemuHotplugAttachDBusVMState: Remove 'driver' argument qemuMigrationSrcToLegacyFile: Remove 'driver' argument qemuDomainEventEmitJobCompleted: Remove 'driver' argument qemuMigrationSrcToSparseFile: Remove 'driver' argument qemuMigrationSrcToFile: Remove 'driver' argument qemuSaveImageCreateFd: Remove 'driver' argument qemuSaveImageCreate: Remove 'driver' argument virQEMUSaveDataNew: Refactor cleanup src/qemu/qemu_backup.c | 2 +- src/qemu/qemu_domainjob.c | 6 +++--- src/qemu/qemu_domainjob.h | 3 +-- src/qemu/qemu_driver.c | 4 ++-- src/qemu/qemu_hotplug.c | 6 ++---- src/qemu/qemu_hotplug.h | 3 +-- src/qemu/qemu_migration.c | 36 ++++++++++++++++++------------------ src/qemu/qemu_migration.h | 5 ++--- src/qemu/qemu_saveimage.c | 27 ++++++++++++--------------- src/qemu/qemu_saveimage.h | 3 +-- src/qemu/qemu_snapshot.c | 22 ++++++++++++---------- 11 files changed, 55 insertions(+), 62 deletions(-) -- 2.52.0

3 13

[PATCH 0/2] qemu: capabilities: Update '10.2' capabilities on x86_64 after release
by Peter Krempa 06 Jan '26

06 Jan '26

Peter Krempa (2): qemucapabilitiesdata: Re-generate 'caps_10.2.0_x86_64' qemu: capabilities: Update '10.2' capabilities on x86_64 after release .../domaincapsdata/qemu_10.2.0-q35.x86_64.xml | 170 +++++++++++-- tests/domaincapsdata/qemu_10.2.0.x86_64.xml | 170 +++++++++++-- .../caps_10.2.0_x86_64.replies | 230 +++++++++++++----- .../caps_10.2.0_x86_64.xml | 157 ++++++++++-- ...host-model-fallback-kvm.x86_64-latest.args | 2 +- ...cpu-host-model-features.x86_64-latest.args | 2 +- .../cpu-host-model-kvm.x86_64-latest.args | 2 +- ...st-model-nofallback-kvm.x86_64-latest.args | 2 +- 8 files changed, 618 insertions(+), 117 deletions(-) -- 2.52.0

2 3

[PATCH v4 0/9] Enable mshv support for Qemu domains
by Praveen K Paladugu 06 Jan '26

06 Jan '26

This patch set introduces changes within libvirt to lauch Qemu guests with Microsoft Hypervisor(mshv). Qemu exposes this capability as 'mshv' accelerator type. Below is an excerpt of domain XML with mshv accelerator.: ``` <domain type='hyperv'> <name>qemu_mshv_test</name> <os> <type machine='q35'>hvm</type> </os> ... ``` 'mshv' accelerator within Qemu translates to 'hyperv' domains in Libvirt. Changs in v4: - Adopted `query-accelerators` API to get mshv capabilities. - Fixed virtytpe parsing in schemas. Chages in v3: - Addressed review comments on v2. - fixed qemucapabilitiestest case - Added a case to qemuxmlconftest Changes in v2: - Addressed review comments on v1. - Added a test to verify mshv capabilities. Eugene Fedorenko (1): qemu: Append mshv to hwaccel list. Praveen K Paladugu (8): qemu: Introduce mshv capabilities qemu: Query and use mshv capabilities qemu: use mshv accel for hyperv domains qemu: conditionally add /dev/mshv to acl conf: Fix virttype handling in schemas tests: Add domaincaps case for mshv tests: qemucapabilities: Introduce MSHV capability tests:qemuxmlconftest: Add case for hyperv domains src/conf/schemas/basictypes.rng | 22 + src/conf/schemas/capability.rng | 14 +- src/conf/schemas/domaincommon.rng | 23 +- src/qemu/qemu_capabilities.c | 39 +- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_cgroup.c | 6 + src/qemu/qemu_command.c | 4 +- src/qemu/qemu_namespace.c | 2 + src/qemu/qemu_process.c | 2 +- .../qemu_10.2.0-q35.x86_64+mshv.xml | 222 + .../qemu_10.2.0-tcg.x86_64+mshv.xml | 2334 + .../qemu_10.2.0.x86_64+mshv.xml | 222 + .../caps_10.2.0_x86_64+mshv.replies | 45176 ++++++++++++++++ .../caps_10.2.0_x86_64+mshv.xml | 3212 ++ .../qemucaps2xmloutdata/caps.x86_64+mshv.xml | 29 + ...86_64-q35-headless.x86_64-latest+mshv.args | 48 + ...x86_64-q35-headless.x86_64-latest+mshv.xml | 87 + ...mshv-x86_64-q35-headless.x86_64-latest.err | 1 + .../mshv-x86_64-q35-headless.xml | 35 + tests/qemuxmlconftest.c | 5 + 20 files changed, 51446 insertions(+), 38 deletions(-) create mode 100644 tests/domaincapsdata/qemu_10.2.0-q35.x86_64+mshv.xml create mode 100644 tests/domaincapsdata/qemu_10.2.0-tcg.x86_64+mshv.xml create mode 100644 tests/domaincapsdata/qemu_10.2.0.x86_64+mshv.xml create mode 100644 tests/qemucapabilitiesdata/caps_10.2.0_x86_64+mshv.replies create mode 100644 tests/qemucapabilitiesdata/caps_10.2.0_x86_64+mshv.xml create mode 100644 tests/qemucaps2xmloutdata/caps.x86_64+mshv.xml create mode 100644 tests/qemuxmlconfdata/mshv-x86_64-q35-headless.x86_64-latest+mshv.args create mode 100644 tests/qemuxmlconfdata/mshv-x86_64-q35-headless.x86_64-latest+mshv.xml create mode 100644 tests/qemuxmlconfdata/mshv-x86_64-q35-headless.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/mshv-x86_64-q35-headless.xml -- 2.51.0

4 24

[PATCH] libvirt-guests.service: use Type=exec
by Antonio Terceiro 06 Jan '26

06 Jan '26

Type=oneshot means that the service is only considered started after the main process exits. In setups where libvirt-guests is configured to be used and imposes a delay on the startup of guests, this will cause systemd to report a quite high boot time as it will wait until all guests have booted, plus all the delay between them. High boot times are often reported as issues in monitoring systems, and require operator attention, while in this case there is not really an issue with the system, it's just doing what it was configured to do. With Type=exec, the service is considered started right after the main process is *started*, but the boot process will not wait for it. Having other units depend on libvirt-guests.service finishing was already not reliable because one cannot know how long the OS inside each guest takes to boot, and libvirt-guests already does not wait for them to be in any particular state. Signed-off-by: Antonio Terceiro <terceiro(a)debian.org> --- tools/libvirt-guests.service.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/libvirt-guests.service.in b/tools/libvirt-guests.service.in index b044444298..c8e4d3d749 100644 --- a/tools/libvirt-guests.service.in +++ b/tools/libvirt-guests.service.in @@ -19,7 +19,7 @@ EnvironmentFile=-@initconfdir@/libvirt-guests # out the code ExecStart=@libexecdir@/libvirt-guests.sh start ExecStop=@libexecdir@/libvirt-guests.sh stop -Type=oneshot +Type=exec RemainAfterExit=yes StandardOutput=journal+console TimeoutStopSec=0 -- 2.51.0

3 4

[PATCH] docs: fix broken UUID example
by Daniel P. Berrangé 06 Jan '26

06 Jan '26

From: Daniel P. Berrangé <berrange(a)redhat.com> The UUID had only 11 characters in the last component, instead of the required 12. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- docs/formatsecret.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/formatsecret.rst b/docs/formatsecret.rst index d4e0cb9ddb..bbf2fc22ea 100644 --- a/docs/formatsecret.rst +++ b/docs/formatsecret.rst @@ -73,7 +73,7 @@ passphrase to decrypt the volume, :since:`since 2.1.0`. An example follows: # cat luks-secret.xml <secret ephemeral='no' private='yes'> <description>LUKS Sample Secret</description> - <uuid>f52a81b2-424e-490c-823d-6bd4235bc57</uuid> + <uuid>f52a81b2-424e-490c-823d-6bd4235bc507</uuid> <usage type='volume'> <volume>/var/lib/libvirt/images/luks-sample.img</volume> </usage> @@ -91,7 +91,7 @@ The volume type secret can be supplied in domain XML for a luks storage volume :: <encryption format='luks'> - <secret type='passphrase' uuid='f52a81b2-424e-490c-823d-6bd4235bc57'/> + <secret type='passphrase' uuid='f52a81b2-424e-490c-823d-6bd4235bc507'/> </encryption> Usage type "ceph" -- 2.52.0

2 2