- Devel - libvirt List Archives

[libvirt PATCH 0/3] qemu: IOMMUFD security label fix
by Pavel Hrdina 03 Mar '26

03 Mar '26

Pavel Hrdina (3): security_apparmor: Use g_auto* in AppArmorSetSecurityHostdevLabel security: Cleanup hostdev label error logic qemu: Fix IOMMUFD and VFIO security labels src/qemu/qemu_hotplug.c | 2 +- src/qemu/qemu_process.c | 16 +++-- src/qemu/qemu_process.h | 3 +- src/security/security_apparmor.c | 76 +++++++++-------------- src/security/security_dac.c | 102 ++++++++++++++----------------- src/security/security_selinux.c | 90 ++++++++++++--------------- 6 files changed, 130 insertions(+), 159 deletions(-) -- 2.53.0

3 7

[RFC 0/2] Fix build with libvirtd disabled
by Jim Fehlig 03 Mar '26

03 Mar '26

I'm considering dropping the monolithic libvirtd in future versions of SUSE distros, which got me to checking the usability of -Ddriver_libvirtd=disabled. I found it's not very usable :-). This series if an RFC attempt to rectify the situation. I'm not sure if we should build the various "common" components unconditionally as this change does, or only if the monolithic libvirtd and/or one or more modular daemons are also being built. Thanks for any comments! Jim Fehlig (2): build: Fix build with libvirtd disabled spec: Add option to enable/disable libvirtd docs/manpages/meson.build | 10 +- libvirt.spec.in | 25 +++- meson.build | 209 +++++++++++++--------------- meson_options.txt | 14 +- src/access/meson.build | 3 - src/locking/meson.build | 281 +++++++++++++++++++------------------- src/logging/meson.build | 104 +++++++------- src/meson.build | 200 +++++++++++++-------------- src/remote/meson.build | 174 +++++++++++------------ src/security/meson.build | 2 +- src/util/meson.build | 24 ++-- tools/meson.build | 26 ++-- 12 files changed, 526 insertions(+), 546 deletions(-) -- 2.51.0

3 5

[PATCH] secret: install service file only if init_script is 'systemd'
by Roman Bogorodskiy 03 Mar '26

03 Mar '26

Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/secret/meson.build | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/src/secret/meson.build b/src/secret/meson.build index cfcc861f4f..32105dad9f 100644 --- a/src/secret/meson.build +++ b/src/secret/meson.build @@ -54,13 +54,15 @@ if conf.has('WITH_SECRETS') virt_secret_init_encryption_conf.set('localstatedir', localstatedir) - configure_file( - input: 'virt-secret-init-encryption.service.in', - output: '@0@.service'.format('virt-secret-init-encryption'), - configuration: virt_secret_init_encryption_conf, - install: true, - install_dir: unitdir, - ) + if init_script == 'systemd' + configure_file( + input: 'virt-secret-init-encryption.service.in', + output: '@0@.service'.format('virt-secret-init-encryption'), + configuration: virt_secret_init_encryption_conf, + install: true, + install_dir: unitdir, + ) + endif virt_daemon_units += { 'service': 'virtsecretd', -- 2.52.0

2 1

Release of libvirt-12.1.0
by Jiri Denemark 02 Mar '26

02 Mar '26

The 12.1.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * New features * qemu: Advertise firmware features in domain capabilities XML The contents of the ``<firmwareFeatures/>`` element can be used to determine ahead of time whether a firmware matching certain characteristics, for example Secure Boot support, is available for the selected architecture and machine type. * qemu: Add support for uefi-vars device and firmware builds using it This is particularly noteworthy for people running aarch64 VMs with the 'virt' machine type, as it makes it finally possible to use Secure Boot with that combination. In most cases, no special steps are needed to take advantage of this: assuming that you have installed a recent version of QEMU, as well as a build of edk2 that includes the necessary binaries, you can just `enable Secure Boot <kbase/secureboot.html>`__ as you normally would. To explicitly request that the uefi-vars device is used even for scenarios where that would normally not be the case, it's enough to add an empty ``<varstore/>`` element in the domain XML. More details are available in the `guest firmware configuration <formatdomain.html#guest-firmware>`__ section of the documentation. * hyperv: improve API coverage for the hyperv driver The `virDomainInterfaceAddresses()` and `virDomainGetBlockInfo()` APIs are now supported by the hyperv driver. In addition, the domain xml for hyperv domains will indicate via firmware features whether secure boot is enabled. It also honors these firmware features when creating new domains. * bhyve: Add support for vCPU pinning configuration Bhyve guests can now have vCPU pinning configured:: <cputune> <vcpupin vcpu="0" cpuset="1,2,3"/> </cputune> Additionally, the ``domainGetVcpuPinInfo`` API is implemented for querying vCPU pinning information. * qemu: Support block operation latency histograms Libvirt now allows configuring qemu's block latency histogram collection as well as returns them via the bulk stats API. * Improvements * Introduce granule attribute for virtio-iommu In case when guest page size doesn't match the host page size (typically aarch64) the ``virtio-iommu`` needs to know the guest page size so it can allocate memory aligned to guest page size. * Parse hyperv features even for host-model Two releases ago, in v11.9.0 new ``host-model`` mode for Hyper-V enlightenments was introduced. Starting with this release, users can additionally override the defaults that are picked when domain is started and features are expanded. * bhyve: Improve loader configuration for arm64 guests If loader is not explicitly configured, use the loader from the ``sysutils/u-boot-bhyve-arm64`` port/package for the arm64 guests. * Bug fixes * Fix build with remote driver disabled Some parts of code were wrongly annotated as depended on remote driver. But they were used even from client side drivers. This is now fixed and libvirt builds properly even with remote driver disabled. * Various fixes to libvirt-guests.sh Firstly, the exit code of various commands was ignored (which may lead the script to wrongly determine persistent/transient domain state, for instance). Secondly, due to logical error, the script might have incorrectly asses state a domain is in. * AppArmor: Ask for no deny rule for readonly disk elements For read only disks, libvirt created an AppArmor profile which disallowed any future write rules. But when doing a blockcommit, libvirt needs to allow hypervisor to write to even readonly disks. The rule in the profile was changed so that future write rules can be added, temporarily. * esx: Allow connecting to IPv6 server Due to a bug in our code, if an IPv6 address was provided in connection URI, libvirt would fail to connect to VMWare server. This is now fixed. * qemu: Use device alias if interface has no name The ``virDomainInterfaceAddresses()`` API (or ``virsh domifaddr``) returns an array interfaces among with their addresses. But some interface names might be unknown, for instance if the API is told to parse host's ARP table then PCI assigned NICs or slirp/passt lack interface name. If that's the case, let the API return domain's ``<interface/>`` alias. * bhyve: hyperv: Various memory leak fixes * qemu: Fix failures when restoring save/managed-save images with upcoming qemu versions Current git version of qemu would return an error when attempting to load an existing (managed) save image as we relied on deprecated features that were now removed. Enjoy. Jirka

1 0

[PATCH] news: Mention latency histogram support and (managed) save fixes
by Peter Krempa 02 Mar '26

02 Mar '26

From: Peter Krempa <pkrempa(a)redhat.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- NEWS.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 8597febe28..800c4acb59 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -59,6 +59,11 @@ v12.1.0 (unreleased) Additionally, the ``domainGetVcpuPinInfo`` API is implemented for querying vCPU pinning information. + * qemu: Support block operation latency histograms + + Libvirt now allows configuring qemu's block latency histogram collection + as well as returns them via the bulk stats API. + * **Improvements** * Introduce granule attribute for virtio-iommu @@ -117,6 +122,12 @@ v12.1.0 (unreleased) * bhyve: hyperv: Various memory leak fixes + * qemu: Fix failures when restoring save/managed-save images with upcoming qemu versions + + Current git version of qemu would return an error when attempting to load + an existing (managed) save image as we relied on deprecated features that + were now removed. + v12.0.0 (2026-01-15) ==================== -- 2.53.0

2 1

[PULL 02/18] deprecation: don't enable TCG plugins by default with TCI
by Alex Bennée 28 Feb '26

28 Feb '26

The softmmu memory instrumentation test sees so many more accesses than a normal translated host and its really not worth fixing up. Lets deprecate this odd configuration and save on the CI cycles. Reviewed-by: Pierrick Bouvier <pierrick.bouvier(a)linaro.org> Signed-off-by: Alex Bennée <alex.bennee(a)linaro.org> Message-Id: <20240916085400.1046925-3-alex.bennee(a)linaro.org> diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 809b2b9b81..c0aa52def5 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -196,6 +196,14 @@ benefits from having plenty of host memory it seems reasonable to encourage users to use 64 bit builds of QEMU for analysis work whatever targets they are instrumenting. +TCG Plugin support not enabled by default with TCI (since 9.2) +'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +While the TCG interpreter can interpret the TCG ops used by plugins it +is going to be so much slower it wouldn't make sense for any serious +instrumentation. Due to implementation differences there will also be +anomalies in things like memory instrumentation. + System emulator CPUs -------------------- diff --git a/configure b/configure index cc8e1ed5b8..aa7aae70fa 100755 --- a/configure +++ b/configure @@ -629,6 +629,9 @@ meson_option_parse() { exit 1 fi } +has_meson_option() { + test "${meson_options#*"$1"}" != "$meson_options" +} meson_add_machine_file() { if test "$cross_compile" = "yes"; then @@ -1048,8 +1051,12 @@ if test "$static" = "yes" ; then plugins="no" fi if test "$plugins" != "no" && test $host_bits -eq 64; then - plugins=yes - subdirs="$subdirs contrib/plugins" + if has_meson_option "-Dtcg_interpreter=true"; then + plugins="no" + else + plugins=yes + subdirs="$subdirs contrib/plugins" + fi fi cat > $TMPC << EOF -- 2.39.5

2 1

Entering freeze for libvirt-12.1.0
by Jiri Denemark 27 Feb '26

27 Feb '26

I have just tagged v12.1.0-rc1 in the repository and pushed signed tarballs to https://download.libvirt.org/ Please give the release candidate some testing and in case you find a serious issue which should have a fix in the upcoming release, feel free to reply to this thread to make sure the issue is more visible. If you have not done so yet, please update NEWS.rst to document any significant change you made since the last release. Jirka

3 3

[PATCH] NEWS: Document features/improvements/bug fixes I've participated in
by Michal Privoznik 27 Feb '26

27 Feb '26

From: Michal Privoznik <mprivozn(a)redhat.com> There are some features/improvements/bug fixes I've either contributed or reviewed/merged. Document them for upcoming release. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- NEWS.rst | 53 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 71f1f21472..11d0ebf28b 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -43,8 +43,61 @@ v12.1.0 (unreleased) * **Improvements** + * Introduce granule attribute for virtio-iommu + + In case when guest page size doesn't match the host page size (typically + aarch64) the ``virtio-iommu`` needs to know the guest page size so it can + allocate memory aligned to guest page size. + + * hyperv: Implement virDomainInterfaceAddresses() + + Libvirt can now report IP address of domains running under Hyper-V + hypervisor. + + * Parse hyperv features even for host-model + + Two releases ago, in v11.9.0 new ``host-model`` mode for Hyper-V + enlightenments was introduced. Starting with this release, users can + additionally override the defaults that are picked when domain is started + and features are expanded. + * **Bug fixes** + * Fix build with remote driver disabled + + Some parts of code were wrongly annotated as depended on remote driver. + But they were used even from client side drivers. This is now fixed and + libvirt builds properly even with remote driver disabled. + + * Various fixes to libvirt-guests.sh + + Firstly, the exit code of various commands was ignored (which may lead the + script to wrongly determine persistent/transient domain state, for + instance). Secondly, due to logical error, the script might have + incorrectly asses state a domain is in. + + * AppArmor: Ask for no deny rule for readonly disk elements + + For read only disks, libvirt created an AppArmor profile which disallowed + any future write rules. But when doing a blockcommit, libvirt needs to + allow hypervisor to write to even readonly disks. The rule in the profile + was changed so that future write rules can be added, temporarily. + + * esx: Allow connecting to IPv6 server + + Due to a bug in our code, if an IPv6 address was provided in connection + URI, libvirt would fail to connect to VMWare server. This is now fixed. + + * qemu: Use device alias if interface has no name + + The ``virDomainInterfaceAddresses()`` API (or ``virsh domifaddr``) returns + an array interfaces among with their addresses. But some interface names + might be unknown, for instance if the API is told to parse host's ARP table + then PCI assigned NICs or slirp/passt lack interface name. If that's the + case, let the API return domain's ``<interface/>`` alias. + + * bhyve: hyperv: Various memory leak fixes + v12.0.0 (2026-01-15) ==================== -- 2.52.0

3 2

[PATCH] news: document bhyve changes for 12.1.0
by Roman Bogorodskiy 27 Feb '26

27 Feb '26

Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- NEWS.rst | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 71f1f21472..92f6d07e04 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -41,8 +41,25 @@ v12.1.0 (unreleased) the `guest firmware configuration <formatdomain.html#guest-firmware>`__ section of the documentation. + * bhyve: Add support for vCPU pinning configuration + + Bhyve guests can now have vCPU pinning configured:: + + <cputune> + <vcpupin vcpu="0" cpuset="1,2,3"/> + </cputune> + + Additionally, the ``domainGetVcpuPinInfo`` API is implemented for + querying vCPU pinning information. + * **Improvements** + * bhyve: improve loader configuration for arm64 guests + + If loader is not explicitly configured, use the loader + from the ``sysutils/u-boot-bhyve-arm64`` port/package for the + arm64 guests. + * **Bug fixes** -- 2.52.0

2 1

[PATCH] news: document new hyperv features
by Jonathon Jongsma 27 Feb '26

27 Feb '26

Signed-off-by: Jonathon Jongsma <jjongsma(a)redhat.com> --- NEWS.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 71f1f21472..a581d2e840 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -41,6 +41,13 @@ v12.1.0 (unreleased) the `guest firmware configuration <formatdomain.html#guest-firmware>`__ section of the documentation. + * hyperv: improve API coverage for the hyperv driver + + The `virDomainInterfaceAddresses()` and `virDomainGetBlockInfo()` APIs are + now supported by the hyperv driver. In addition, the domain xml for hyperv + domains will indicate via firmware features whether secure boot is enabled. + It also honors these firmware features when creating new domains. + * **Improvements** * **Bug fixes** -- 2.53.0

2 1