- Devel - libvirt List Archives

[PATCH v8 0/4] nwfilter: add nwfilter nftables driver
by Dion Bosschieter 01 Jun '26

01 Jun '26

This series aims to implement nftables as a backend driver for the nwfilter feature. The idea is that it will replace the ebiptables driver and provide an easy way for users to switch from one driver to another. The 1st patch introduces the new nwfilter driver. After which nwfilter allows users to choose it in the 2nd patch. The third patch introduces unit testing of the new nftables driver. Finally the last patch introduces a new element to the nwfilterbinding XML which is used to detect and run a cleanup on the old firewall rules defined via the previous used nwfilter firewall backend. - Implemented very basic nwfilter.conf reading, choosing a nwfilter driver based on the name of the drivers (nftables/ebiptables). Defaults to the nftables driver, based on the firewall_backend_priority meson option, following the bridge driver logic. - Implemented nft tracing and counters usable via nwfilter.conf options "enable_trace" and "enable_counters" - Resolves issue https://gitlab.com/libvirt/libvirt/-/issues/603, benchmarks showed that the amount of iifname jumps for each interface in the root chains is the cause for this. Switched the nftables driver towards a vmap (verdict map) so we can have 1 rule that jumps to the correct root input/output chain per interface. Which improves throughput as when the number of interface check and jump rules increases the throughput decreases. The issue describes the interface matching works using the interface name and the majority of the effort is the strncpy, this patch also switches nftables to an interface_index compare instead. However, just using the interface_index is not enough, the amount of oif and iif jump rules causes quite the performance degradation, the vmap instead solves this. - Split rules into separate tables: "libvirt_nwfilter_ethernet" and "libvirt_nwfilter_inet" to preserve existing firewall behavior. - Reworked chain logic for clarity with root -input/-output chains per interface. input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). - Stuck with prerouting and postrouting as hooks for input / output on the _ethernet and _inet table. This makes it easier to merge the tables in the future. Saving management of two tables and decreasing the amount of tables a packet sees. Currently ebtables filtering happens via PREROUTING and POSTROUTING hooks, while ip/ip6tables filtering happens in the output/forward hooks. - Stuck with 2 tables for compatibility reasons with eb iptables, unifying into 1 table will break users firewall definitions, which depend on being able to do accepts on ethernet rules (which currently get defined via ebtables) and additional filtering via the ip rules (which currently get defined via ip(6)tables). The nwfilter_nftables_driver keeps splitting the ethernet and inet rules in seperate tables "libvirt_nwfilter_ethernet" and "libvirt_nwfilter_inet". - Rewrote chain logic, so it is easier to understand, input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). _ethernet and _inet table follow the same style and hook in the same way. - Simplified conntrack handling: rules with accept+conntrack are duplicated to the opposite chain for symmetric behavior, to support the existing ebiptables logic. - Firewall updates continue use tmp names for atomic replacement. Unsupported nwfilter features (for now): - IPSets (potential future support via nft sets) - Reject due to filtering in pre/postrouting, using drop instead of reject, copying logic from existing ebiptables ebtables actions Future improvements: - Use `nft -f` for atomic rule application. - Optional single-table mode via nwfilter.conf. - Optimize boot phase with chain hash comparison. --- Changes in v8: - Fix incompatibility issue with ebiptables driver for inet rules Inet rules in nftables are now placed on the root chains following iptables logic inside the ebiptables driver. Introducing subchains for inet caused sorting problems, subchains can accept or drop a packet which on the ebiptables driver inet rules would have been filtered out by rules that were sorted differently. Changes in v7: - Add backend XML element to virnwfilterbinding, to support switching from nwfilter firewall backend Changes in v6: - Add STP support - Add GARP support - Remove comment "priority=%" leftover from debugging Changes in v5: - Fix rarp support via nft raw payload expression Changes in v4: - Fix rarp nft commands "arp saddr ether" "arp daddr ether" - Filter chain creation, don't create unnecessary chains - Apply danpb seperate argument suggestion - Fix table not existing errors in drop all rules - Fix table not existing errors in apply basic rules Changes in v3: - Renamed -other to -inet - Renamed - to _ in table names - Updated rule / chain sorting on ethernet table to to copy ebtables logic - Fix possible broken revert path - Fix remove rules not working in some cases, EBUSY - Shared functions camel case commit - Rename config option - Add extra config params, enable_trace, enable_counters This required passing the config struct to the ebip/nft nwfilter drivers - Add extra augeaus files Changes in v2: - Rename {ebip,nf}tables specific test files in 1 directory instead of seperating them in different directories. - Added default nwfilter.conf file in git, documented including augeas files - Replaced hardcoding of default driver based on existing firewall_backend_priority meson option. - Added nwfilter_driver_conf.{h,c} for configuration handling, to match the common pattern used in other drivers. Dion Bosschieter (4): nwfilter: add nwfilter nftables driver nwfilter: allow use of nftables nwfilter driver via nwfilter.conf nwfilter: add unit tests and test data for nwfilter nftables driver nwfilter: add used firewall backend to nwfilterbinding libvirt.spec.in | 7 + po/POTFILES | 2 + src/conf/schemas/nwfilterbinding.rng | 7 + src/conf/virnwfilterbindingdef.c | 17 +- src/conf/virnwfilterbindingdef.h | 1 + src/conf/virnwfilterobj.h | 20 - src/nwfilter/libvirtd_nwfilter.aug | 45 + src/nwfilter/meson.build | 38 + src/nwfilter/nwfilter.conf.in | 50 + src/nwfilter/nwfilter_driver.c | 67 +- src/nwfilter/nwfilter_driver_conf.c | 214 + src/nwfilter/nwfilter_driver_conf.h | 69 + src/nwfilter/nwfilter_ebiptables_driver.c | 4 +- src/nwfilter/nwfilter_ebiptables_driver.h | 2 +- src/nwfilter/nwfilter_gentech_driver.c | 144 +- src/nwfilter/nwfilter_gentech_driver.h | 5 +- src/nwfilter/nwfilter_nftables_driver.c | 2864 +++++++++++++ src/nwfilter/nwfilter_nftables_driver.h | 28 + src/nwfilter/nwfilter_tech_driver.h | 3 +- src/nwfilter/test_libvirtd_nwfilter.aug.in | 7 + tests/meson.build | 2 + tests/nwfilternftablestest.c | 426 ++ .../ah-ipv6-linux.nftables.args | 298 ++ .../ah-linux.nftables.args | 292 ++ .../all-ipv6-linux.nftables.args | 280 ++ .../all-linux.nftables.args | 274 ++ .../arp-linux.nftables.args | 285 ++ .../comment-linux.nftables.args | 502 +++ .../conntrack-linux.nftables.args | 190 + .../esp-ipv6-linux.nftables.args | 298 ++ .../esp-linux.nftables.args | 292 ++ .../example-1-linux.nftables.args | 252 ++ .../example-2-linux.nftables.args | 352 ++ .../hex-data-linux.nftables.args | 368 ++ .../icmp-direction-linux.nftables.args | 226 ++ .../icmp-direction2-linux.nftables.args | 226 ++ .../icmp-direction3-linux.nftables.args | 176 + .../icmp-linux.nftables.args | 248 ++ .../icmpv6-linux.nftables.args | 316 ++ .../igmp-linux.nftables.args | 292 ++ .../ip-linux.nftables.args | 199 + .../ipt-no-macspoof-linux.nftables.args | 166 + .../ipv6-linux.nftables.args | 481 +++ .../iter1-linux.nftables.args | 292 ++ .../iter2-linux.nftables.args | 3532 +++++++++++++++++ .../iter3-linux.nftables.args | 410 ++ .../mac-linux.nftables.args | 176 + .../rarp-linux.nftables.args | 207 + .../sctp-ipv6-linux.nftables.args | 316 ++ .../sctp-linux.nftables.args | 316 ++ .../stp-linux.nftables.args | 233 ++ .../target-linux.nftables.args | 454 +++ .../target2-linux.nftables.args | 302 ++ .../tcp-ipv6-linux.nftables.args | 316 ++ .../tcp-linux.nftables.args | 452 +++ .../udp-ipv6-linux.nftables.args | 316 ++ .../udp-linux.nftables.args | 316 ++ .../udplite-ipv6-linux.nftables.args | 298 ++ .../udplite-linux.nftables.args | 292 ++ .../vlan-linux.nftables.args | 257 ++ tests/nwfilterxml2nftfirewalltest.c | 432 ++ .../filter-vars.xml | 1 + .../simple-backend.xml | 10 + tests/virnwfilterbindingxml2xmltest.c | 1 + 64 files changed, 18845 insertions(+), 119 deletions(-) create mode 100644 src/nwfilter/libvirtd_nwfilter.aug create mode 100644 src/nwfilter/nwfilter.conf.in create mode 100644 src/nwfilter/nwfilter_driver_conf.c create mode 100644 src/nwfilter/nwfilter_driver_conf.h create mode 100644 src/nwfilter/nwfilter_nftables_driver.c create mode 100644 src/nwfilter/nwfilter_nftables_driver.h create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in create mode 100644 tests/nwfilternftablestest.c create mode 100755 tests/nwfilterxml2firewalldata/ah-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ah-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/arp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/comment-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/conntrack-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/hex-data-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmpv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/igmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ip-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/mac-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/rarp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-linux.nftables.args create mode 100644 tests/nwfilterxml2firewalldata/stp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/vlan-linux.nftables.args create mode 100644 tests/nwfilterxml2nftfirewalltest.c create mode 100644 tests/virnwfilterbindingxml2xmldata/simple-backend.xml -- 2.43.0

1 4

[RFC patch 00/17] qemu: Unlock VM object while accessing storage (in certain cases)
by Peter Krempa 29 May '26

29 May '26

If a thread is blocked while holding the VM lock, other operations become impossible. This is due to the fact that both listing domains of a daemon requires locking the objects (for accessing the name/uuid/id, but also for filtering). Similarly even if a user has a virDomainPtr instace already looked up invoking an API results into trying to fetch a locked VM object instance which will simply block. This patchset is a path for being able to identify stuff which colud block and similarly to how monitor is accessed unlocking @vm while doing such operation. To show how it's used, we use it when probing disk size data. The patchset obviously needed to refactor stuff first for this to happen. Peter Krempa (17): storage_source: Don't modify @src in 'virStorageSourceUpdatePhysicalSize' virStorageSourceGetSize: Return also 'allocation' value if needed virStorageFileProbeFormatFromBuf: Allow NULL 'path' argument virStorageFileProbeGetMetadata: Allow NULL 'meta->path' virStorageSourceGetMetadataFromBuf: Refactor cleanup virStorageSourceUpdateCapacity: Factor out size probing to 'virStorageSourceProbeCapacityFromBuf' qemu: domain: Introduce 'qemuDomainStorageSourceProbeSize' qemuDomainGetBlockInfo: Rewrite to 'qemuDomainStorageSourceProbeSize' qemuDomainGetStatsOneBlock: Rewrite to 'qemuDomainStorageSourceProbeSize' qemuMigrationDstPrepareStorage: Rewrite to 'qemuDomainStorageSourceProbeSize' qemuDomainBlockResize: Rewrite to 'qemuDomainStorageSourceProbeSize' qemu: domain: Remove 'qemuDomainStorageUpdatePhysical' qemuDomainGetStatsOneBlockFallback: Rewrite using 'qemuDomainStorageSourceProbeSize' qemuDomainGetBlockInfo: Rewrite using 'qemuDomainStorageSourceProbeSize' qemu: domain: Fix coding style of domain object locking helpers qemu: domain: Introduce APIs for unlocking domain object during potentially long running operations qemuDomainStorageSourceProbeSize: Yield domain object while accessing storage src/libvirt_private.syms | 3 +- src/qemu/qemu_domain.c | 140 ++++++++++++++++++++++--- src/qemu/qemu_domain.h | 19 +++- src/qemu/qemu_driver.c | 143 +++++++------------------- src/qemu/qemu_migration.c | 5 +- src/storage_file/storage_file_probe.c | 20 +++- src/storage_file/storage_source.c | 98 +++++++++++++----- src/storage_file/storage_source.h | 16 ++- 8 files changed, 279 insertions(+), 165 deletions(-) -- 2.54.0

1 17

KVM Forum 2026: Call For Presentations
by Peter Maydell 29 May '26

29 May '26

#################### KVM Forum 2026 November 12-13, 2026 Vancouver, Canada #################### On behalf of the program committee for the KVM Forum, I am pleased to announce the KVM Forum 2026 Call for Presentations. CALL FOR PRESENTATIONS ====================== We encourage you to submit presentations via Pretalx at https://kvm-forum.qemu.org/2026/cfp/ All presentation slots will be 25 minutes + 5 minutes for questions. Suggested topics: - Scalability and Optimization - Hardening and security - Confidential computing KVM and the Linux Kernel - New Features and Architecture Ports - Device Passthrough: VFIO, mdev, vDPA - Network Virtualization - Virtio and vhost Virtual Machine Monitors and Management - VMM Implementation: APIs, Live Migration, Performance Tuning, etc. - Multi-process VMMs: vhost-user, vfio-user, QEMU Storage Daemon - QEMU without KVM: Hypervisor.framework, Hyper-V, etc. - Managing KVM: Libvirt, KubeVirt, Kata Containers Emulation - New Devices, Boards and Architectures - CPU Emulation and Binary Translation Developer-focused content - Tooling improvements - Enabling Rust - Testing frameworks and strategies Speakers are expected to attend in person. IMPORTANT DATES =============== The deadline for submitting presentations is: 2026-08-01 00:00 (Canada/Pacific) Accepted speakers will be notified on August 21, 2026. ATTENDING KVM FORUM =================== The cost of admission to KVM Forum 2026 is $75. You can get your ticket at https://kvm-forum.qemu.org/2026/register/ Admission is free for accepted speakers. The conference will be held at Coast Coal Harbour Hotel Vancouver by APA in Vancouver, Canada. More details about the location, and about the reduced price rooms available for attendees at the conference hotel, can be found at: https://kvm-forum.qemu.org/location/ If you need a visa invitation letter in order to attend, please reach out to the organizers at kvm-forum-pc(a)redhat.com. We are committed to fostering an open and welcoming environment at our conference. Participants are expected to abide by our code of conduct and media policy: https://kvm-forum.qemu.org/coc/ https://kvm-forum.qemu.org/media-policy/ CONTACTS ======== Reach out to us should you have any questions. The program committee may be contacted as a group via email: kvm-forum-pc(a)redhat.com. -- Peter Maydell

1 0

[PATCH] examples: Improved shell output of showDomains
by Daniel Hora 29 May '26

29 May '26

From: Daniel Hora <dhora(a)redhat.com> Improved formatting of the shell output of the function showDomains based on length of the longest domain. Signed-off-by: Daniel Hora <dhora(a)redhat.com> --- examples/c/misc/hellolibvirt.c | 31 +++++++++++++++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-) diff --git a/examples/c/misc/hellolibvirt.c b/examples/c/misc/hellolibvirt.c index 39cefe934c..77098d7be3 100644 --- a/examples/c/misc/hellolibvirt.c +++ b/examples/c/misc/hellolibvirt.c @@ -4,6 +4,7 @@ #include <stdio.h> #include <stdlib.h> +#include <string.h> #include <libvirt/libvirt.h> #include <libvirt/virterror.h> @@ -44,11 +45,34 @@ showHypervisorInfo(virConnectPtr conn) return 0; } +static int +longestDomain(virDomainPtr *nameList, int numNames) +{ + int longestDomainLength; + size_t i; + + longestDomainLength = 0; + + for (i = 0; i < numNames; i++) { + const char *currentDomain = virDomainGetName(nameList[i]); + + if (currentDomain != NULL) { + int currentDomainLength = strlen(currentDomain); + + if (currentDomainLength > longestDomainLength) { + longestDomainLength = currentDomainLength; + } + } + } + + return longestDomainLength; + +} static int showDomains(virConnectPtr conn) { - int numNames, numInactiveDomains, numActiveDomains; + int numNames, numInactiveDomains, numActiveDomains, longestDomainLength; ssize_t i; int flags = VIR_CONNECT_LIST_DOMAINS_ACTIVE | VIR_CONNECT_LIST_DOMAINS_INACTIVE; @@ -88,9 +112,12 @@ showDomains(virConnectPtr conn) return 1; } + longestDomainLength = longestDomain(nameList, numNames); + for (i = 0; i < numNames; i++) { int active = virDomainIsActive(nameList[i]); - printf(" %8s (%s)\n", + printf(" %-*s (%s)\n", + longestDomainLength, virDomainGetName(nameList[i]), (active == 1 ? "active" : "non-active")); /* must free the returned named per the API documentation */ -- 2.54.0

2 1

Entering freeze for libvirt-12.4.0
by Jiri Denemark 28 May '26

28 May '26

I have just tagged v12.4.0-rc1 in the repository and pushed signed tarballs to https://download.libvirt.org/ Please give the release candidate some testing and in case you find a serious issue which should have a fix in the upcoming release, feel free to reply to this thread to make sure the issue is more visible. If you have not done so yet, please update NEWS.rst to document any significant change you made since the last release. Jirka

1 1

[PATCH 00/10] qemu: Fix CPU feature reporting on AMD CPUs
by Jiri Denemark 28 May '26

28 May '26

See the last patch for detailed description. Jiri Denemark (10): qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel qemu_capabilities: Cache expanded CPU util: Publish and mock virHostCPUGetMSRFromKVM cpu_x86: Introduce virCPUx86DataAddMSR cpu: Introduce virCPUUpdateFeatures Clarify documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES qemu_capabilities: Fix domain capabilities on AMD CPUs docs/manpages/virsh.rst | 4 +- include/libvirt/libvirt-domain.h | 2 +- src/cpu/cpu.c | 33 +++++ src/cpu/cpu.h | 12 ++ src/cpu/cpu_x86.c | 54 ++++++-- src/cpu/cpu_x86.h | 4 + src/libvirt-domain.c | 7 +- src/libvirt_private.syms | 3 + src/qemu/qemu_capabilities.c | 223 ++++++++++++++++++++++--------- src/qemu/qemu_capabilities.h | 7 +- src/qemu/qemu_conf.c | 6 +- src/qemu/qemu_conf.h | 3 +- src/qemu/qemu_driver.c | 15 +-- src/util/virhostcpu.c | 16 ++- src/util/virhostcpu.h | 3 + tests/domaincapstest.c | 2 +- tests/qemucpumock.c | 22 +++ tools/virsh-host.c | 2 +- 18 files changed, 319 insertions(+), 99 deletions(-) -- 2.54.0

3 12

[PATCH] qemu_nbdkit: Fix format when printing time_t values
by Michal Privoznik 28 May '26

28 May '26

From: Michal Privoznik <mprivozn(a)redhat.com> The time_t type can be 32bit or 64bit signed integer. There are systems where it's defined as long, or long long (32bit systems usually). Therefore, using just 'l' length modifier is not good enough. Also, using 'u' conversion specifier is also wrong (though, values stored in qemuNbdkitCaps struct reflect mtime of some files, so there won't be a negative value). Anyway, do what we already do for virQEMUCaps - use '%lld' printf format and typecast to long long. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Spotted this on the following pipeline: https://gitlab.com/MichalPrivoznik/libvirt/-/jobs/14580340190 in which I was testing moving our CI from Debian 12 to 13. Apparently, in Debian they decided to -D_TIME_BITS=64 for everything [1] and only when compiling on a 32bit arch it's when time_t expands to 'long long'. 1: https://wiki.debian.org/ReleaseGoals/64bit-time src/qemu/qemu_nbdkit.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/src/qemu/qemu_nbdkit.c b/src/qemu/qemu_nbdkit.c index 542a6b1f44..6918fc6631 100644 --- a/src/qemu/qemu_nbdkit.c +++ b/src/qemu/qemu_nbdkit.c @@ -544,18 +544,18 @@ qemuNbdkitCapsFormatCache(qemuNbdkitCaps *nbdkitCaps) virBufferEscapeString(&buf, "<path>%s</path>\n", nbdkitCaps->path); - virBufferAsprintf(&buf, "<nbdkitctime>%lu</nbdkitctime>\n", - nbdkitCaps->ctime); + virBufferAsprintf(&buf, "<nbdkitctime>%lld</nbdkitctime>\n", + (long long)nbdkitCaps->ctime); virBufferEscapeString(&buf, "<plugindir>%s</plugindir>\n", nbdkitCaps->pluginDir); - virBufferAsprintf(&buf, "<plugindirmtime>%lu</plugindirmtime>\n", - nbdkitCaps->pluginDirMtime); + virBufferAsprintf(&buf, "<plugindirmtime>%lld</plugindirmtime>\n", + (long long)nbdkitCaps->pluginDirMtime); virBufferEscapeString(&buf, "<filterdir>%s</filterdir>\n", nbdkitCaps->filterDir); - virBufferAsprintf(&buf, "<filterdirmtime>%lu</filterdirmtime>\n", - nbdkitCaps->filterDirMtime); - virBufferAsprintf(&buf, "<selfctime>%lu</selfctime>\n", - nbdkitCaps->libvirtCtime); + virBufferAsprintf(&buf, "<filterdirmtime>%lld</filterdirmtime>\n", + (long long)nbdkitCaps->filterDirMtime); + virBufferAsprintf(&buf, "<selfctime>%lld</selfctime>\n", + (long long)nbdkitCaps->libvirtCtime); virBufferAsprintf(&buf, "<selfvers>%u</selfvers>\n", nbdkitCaps->libvirtVersion); @@ -593,10 +593,10 @@ virNbdkitCapsSaveFile(void *data, return -1; } - VIR_DEBUG("Saved caps '%s' for '%s' with (%lu, %lu)", + VIR_DEBUG("Saved caps '%s' for '%s' with (%lld, %lld)", filename, nbdkitCaps->path, - nbdkitCaps->ctime, - nbdkitCaps->libvirtCtime); + (long long)nbdkitCaps->ctime, + (long long)nbdkitCaps->libvirtCtime); return 0; } -- 2.53.0

2 1

Re: something wrong with the git log in libvirt recently
by Peter Krempa 28 May '26

28 May '26

(you've posted this to the old list address; I've added it to CC. Fix your contact list to point to devel(a)lists.libvirt.org) On Wed, May 20, 2026 at 15:24:52 +0200, Denis V. Lunev wrote: > Hi! > Hi, it's an artifact of people with mail domains with DMARC posting to the list. New mailman can't keep it's fingers from messing with the message, which breaks signatures, thus the sender needs to be rewritten. It's from people not setting git properly: https://www.libvirt.org/submitting-patches.html With the setting git will format an extra From which fixes the header messed up by mailman. Reviewers should notify senders, but stuff slips through. > Statistics will be rotten. I don't think this matters too much. > > I think mailmap need to be involved. I don't think mailmap can fix it. > > Den > > commit 19e1dcf860fab060e19ab97005a4f58faf016093 > Author: Akash Kulhalli via Devel <devel(a)lists.libvirt.org> > Date: Wed Apr 29 17:43:29 2026 +0530 > > API/qemu: add async unplug flag to virDomainSetVcpu > > Add VIR_DOMAIN_SETVCPU_ASYNC_UNPLUG for virDomainSetVcpu(). > > Define a dedicated virDomainSetVcpuBehaviour flag type and wire the > new flag through the QEMU driver. As with setvcpus async unplug, > success indicates request acceptance while final completion is > reported by the vcpu-removed event. > > Update the API documentation and add virsh support for the async path to > the setvcpu subcommand. > > Signed-off-by: Akash Kulhalli <akash.kulhalli(a)oracle.com> > Reviewed-by: Peter Krempa <pkrempa(a)redhat.com> I'm sorry I didn't notice this one.

5 8

[PATCH] docs: drvbhyve: reorganize sections about resource limits
by Roman Bogorodskiy 28 May '26

28 May '26

Sections about resource limits are currently placed across the file in between various device examples. To make it easier to follow, group them into a single section. This also allows to give an introduction on the rctl(8) framework once instead of repeating it for every resource type. Also, document the memory limitation support added in libvirt 12.4.0. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- docs/drvbhyve.rst | 75 +++++++++++++++++++++++++++++++---------------- 1 file changed, 50 insertions(+), 25 deletions(-) diff --git a/docs/drvbhyve.rst b/docs/drvbhyve.rst index 79418537df..2e5e361115 100644 --- a/docs/drvbhyve.rst +++ b/docs/drvbhyve.rst @@ -773,26 +773,6 @@ Example: Please refer to ``cam(4)``, ``ctl(4)``, and ``ctld(8)`` manual pages for more details on CAM and CTL. -vCPU pinning -~~~~~~~~~~~~ - -:since:`Since 12.1.0`, it is possible to pin domain vCPUs -to the specific host CPUs. - -Example: - -:: - - <domain type='bhyve'> - ... - <vcpu>2</vcpu> - <cputune> - <vcpupin vcpu="0" cpuset="1-4,^2"/> - <vcpupin vcpu="1" cpuset="0,4"/> - </cputune> - ... - </domain> - NUMA domains configuration ~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -835,13 +815,43 @@ Example:: Bhyve supports up to 16 ports per console. -Block I/O Tuning -~~~~~~~~~~~~~~~~ -:since:`Since 12.3.0`, it is possible to tune domain I/O. -This works on top of the +Resource tuning and limiting +---------------------------- +The libvirt bhyve driver supports tuning and limiting resources such as +CPU, memory, and I/O. + +For managing the memory and I/O limits, the bhyve driver uses the `rctl(4) <https://man.freebsd.org/cgi/man.cgi?query=rctl&sektion=4>`__ framework. -Sample configuration:: + +As of `FreeBSD 15.0-RELEASE`, rctl is not enabled by default. +Please refer to the manual page above and the +`FreeBSD Handbook <https://docs.freebsd.org/en/books/handbook/book/#security-rctl>`__ +on how to enable it. + +CPU tuning does not require any additional configuration. + +vCPU pinning +~~~~~~~~~~~~ +Pinning domain vCPUs to the specific host CPUs is supported :since:`since 12.1.0`. + +Example: + +:: + + <domain type='bhyve'> + ... + <vcpu>2</vcpu> + <cputune> + <vcpupin vcpu="0" cpuset="1-4,^2"/> + <vcpupin vcpu="1" cpuset="0,4"/> + </cputune> + ... + </domain> + +Block I/O tuning +~~~~~~~~~~~~~~~~ +Block I/O tuning is supported :since:`since 12.3.0`. Sample configuration:: <blkiotune> <device> @@ -857,6 +867,21 @@ The ``*`` path here means that the limits are applied to the domain as a whole. Currently, it is not possible to apply limits to the individual devices of the domain. +Memory limitation +~~~~~~~~~~~~~~~~~ +Setting a memory hard limit for a domain is supported :since:`since 12.4.0`. +Example:: + + <memtune> + <hard_limit unit='M'>512</hard_limit> + </memtune> + +Please refer to the `format domain <formatdomain.html#memory-tuning>`__ page +for considerations on setting ``hard_limit``. + +Currently, other memory tuning options (``soft_limit``, ``swap_hard_limit``, +and ``min_guarantee``) are not supported. + Guest-specific considerations ----------------------------- -- 2.52.0

2 1

[PATCH] NEWS: document bhyve changes for 12.4.0
by Roman Bogorodskiy 28 May '26

28 May '26

Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- NEWS.rst | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 8d1b927c41..4d9e62f9f5 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -23,6 +23,38 @@ v12.4.0 (unreleased) This allows to monitor per-VM energy consumption on supported platforms. Implemented via ``energytune`` element in ``cputune`` . + * bhyve: Add memory tuning support + + The bhyve driver now allows setting a domain's memory hard limit using the + following syntax:: + + <memtune> + <hard_limit unit='G'>1</hard_limit> + </memtune> + + It also implements the ``virDomainGetMemoryParameters()`` and + ``virDomainSetMemoryParameters()`` APIs for controlling + the memory hard limit of a running domain. + + * bhyve: Add virtio-console device support + + Domain XML can now use ``virtio-console`` devices. Among other things, + these devices can be used to configure a QEMU Guest Agent:: + + <devices> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent'/> + <target type='virtio' name='org.qemu.guest_agent.0'/> + <address type='virtio-serial' controller='0' bus='0' port='1'/> + </channel> + </devices> + + Additionally, the ``virDomainQemuAgentCommand()`` API which allows + running arbitrary guest agent commands is now supported. + + The ``virDomainGetHostname()`` API, used to query the hostname of a guest, + now supports using the guest agent as a source of information. + * **Improvements** * **Bug fixes** -- 2.52.0

2 1