- Devel - libvirt List Archives

[PATCH 0/2] fdstream: attempt to fix EOF handling (again)
by Daniel P. Berrangé 27 Feb '26

27 Feb '26

Daniel P. Berrangé (2): fdstream: don't set return value if looping to read more data fdstream: fix EOF handling when reading data src/util/virfdstream.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) -- 2.53.0

4 8

[libvirt PATCH] qemu_hotplug: enter monitor in order to rollback passed FD
by Pavel Hrdina 26 Feb '26

26 Feb '26

From: Pavel Hrdina <phrdina(a)redhat.com> Reported-by: Peter Krempa <pkrempa(a)redhat.com> Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/qemu/qemu_hotplug.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index bede4e3ccd..93cbaf1d91 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1680,8 +1680,10 @@ qemuDomainAttachHostPCIDevice(virQEMUDriver *driver, qemuDomainObjExitMonitor(vm); } + qemuDomainObjEnterMonitor(vm); qemuFDPassDirectTransferMonitorRollback(hostdevPriv->vfioDeviceFd, priv->mon); qemuFDPassDirectTransferMonitorRollback(priv->iommufd, priv->mon); + qemuDomainObjExitMonitor(vm); if (releaseaddr) qemuDomainReleaseDeviceAddress(vm, info); -- 2.53.0

3 2

[PATCH v6 00/27] util: sync error_report & qemu_log output more closely
by Daniel P. Berrangé 26 Feb '26

26 Feb '26

This series is a tangent that came out of discussion in https://lists.nongnu.org/archive/html/qemu-devel/2025-08/msg00903.html In thinking about adding thread info to error_report, I came to realize we should likely make qemu_log behave consistently with error_report & friends. We already honour '-msg timestamp=on', but don't honour 'guest-name=on' and also don't include the binary name. As an example of the current state, consider mixing error and log output today: - Default context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x55ac6d97f700 dir=fish qcrypto_tls_creds_get_path TLS creds path creds=0x55ac6d97f700 filename=ca-cert.pem path=<none> qemu-system-x86_64: Unable to access credentials fish/ca-cert.pem: No such file or directory - Full context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' \ -msg guest-name=on,timestamp=on \ -name "fish food" 2025-08-19T20:14:16.791413Z qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x55e9a3458d10 dir=fish 2025-08-19T20:14:16.791429Z qcrypto_tls_creds_get_path TLS creds path creds=0x55e9a3458d10 filename=ca-cert.pem path=<none> 2025-08-19T20:14:16.791433Z fish food qemu-system-x86_64: Unable to access credentials fish/ca-cert.pem: No such file or directory And after this series is complete: - Default context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' qemu-system-x86_64(1184284:main): qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x55a24ad5cb30 dir=fish qemu-system-x86_64(1184284:main): qcrypto_tls_creds_get_path TLS creds path creds=0x55a24ad5cb30 filename=ca-cert.pem path=<none> qemu-system-x86_64(1184284:main): Unable to access credentials fish/ca-cert.pem: No such file or directory - Full context: # qemu-system-x86_64 -object tls-creds-x509,id=t0,dir=fish \ -d 'trace:qcrypto*' \ -msg guest-name=on,timestamp=on \ -name "fish food" 2025-08-19T20:12:50.211823Z [fish food] qemu-system-x86_64(1168876:main): qcrypto_tls_creds_x509_load TLS creds x509 load creds=0x5582183d8760 dir=fish 2025-08-19T20:12:50.211842Z [fish food] qemu-system-x86_64(1168876:main): qcrypto_tls_creds_get_path TLS creds path creds=0x5582183d8760 filename=ca-cert.pem +path=<none> 2025-08-19T20:12:50.211846Z [fish food] qemu-system-x86_64(1168876:main): Unable to access credentials fish/ca-cert.pem: No such file or directory The main things to note: * error_report/warn_report/qemu_log share the same output format and -msg applies to both * -msg debug-threads=on is now unconditionally enabled and thus the param is deprecated & ignored * Thread ID and name are unconditionally enabled * Guest name is surrounded in [...] brackets * The default output lines are typically 15 chars wider given that we always include the thread ID + name now * This takes the liberty of assigning the new file to the existing error-report.c maintainer (Markus) Since splitting it off into message.c instead of putting it all in error-report.c felt slightly nicer. One thing I didn't tackle is making the location info get reported for qemu_log. This is used to give context for error messages when parsing some CLI args, and could be interesting for log messages associated with those same CLI args. Changes in v6: - Don't use pthread API to set main thread name, as this affects visibility in 'top' and 'ps' - Split off Win32 thread naming race fix intoseparate patch - Tweaks to wording in API docs for logging - Improve VNC auth error messages - Don't relpace monitor_cur_is_qmp with monitor_cur_is_hmp, change code approach instead Changes in v5: - Use g_strlcpy instead of strlcpy - Remove redundant !! around a value that was already bool - Improve the qemu_lock_trylock() API docs to encourage use of fprintf() instead of further qemu_log() calls - Add a qemu_log_trylock_context() counterpart for qemu_log_trylock that includes the message context - Don't scan for \n to determine whether we can output a message context prefix or not. Instead track call depth on qemu_log_trylock() and only output it when the depth was initially zero. This fixes linux-user -strace output formatting which was mangled by v4 - Use fprintf(stderr) instead of error_printf_mon in cases where mon would be NULL - Use fputs/fputc in simple cases where we don't need the full power of fprintf - Use qemu_f{un}lockfile instead of f{un}lockfile - Add -msg thread-info=on|off,program-name=on|off args to allow default message prefixes to be optionally disabled Changes in v4: - Re-architected the way error_vprintf() operates to simplify monitor dependency - Fixed the move of error_vprintf from monitor.c to error-report.c so that unit tests can still get a stub to capture messages to g_test_message - Simplify changes to vreport() to avoid passing around function pointers - Add locking of stderr to vreport() to serialize incremental output - Fix thread naming logic changes on Windows - Change deprecation warning messages Changes in v3: - Stop formatting a string in qmessage_context, instead output directly to a "FILE *" stream - Fix pre-existing bug interleaving qemu_log and vreport when the trace 'log' backend has mutex probes enabled Changes in v2: - Re-use existing qemu_get_thread_id rather than re-inventing it as qemu_thread_get_id. - Expose qemu_thread_set_name and use it from all locations needing to set thread names - Fix qemu_log() to skip context prefix when emitting a log message in fragments across multiple calls - Skip allocating memory for empty context messages - Fix leak in win32 impl of qemu_thread_get_name - Use g_strlcpy where possible Daniel P. Berrangé (27): meson: don't access 'cxx' object without checking cpp lang qemu-options: remove extraneous [] around arg values include: define constant for early constructor priority monitor: initialize global data from a constructor system: unconditionally enable thread naming util: fix race setting thread name on Win32 util: expose qemu_thread_set_name audio: make jackaudio use qemu_thread_set_name util: set the name for the 'main' thread on Windows util: add API to fetch the current thread name util: introduce some API docs for logging APIs util: avoid repeated prefix on incremental qemu_log calls util/log: add missing error reporting in qemu_log_trylock_with_err ui: add proper error reporting for password changes ui: remove redundant use of error_printf_unless_qmp() monitor: remove redundant error_[v]printf_unless_qmp monitor: refactor error_vprintf() monitor: move error_vprintf back to error-report.c util: fix interleaving of error & trace output util: don't skip error prefixes when QMP is active util: fix interleaving of error prefixes util: introduce common helper for error-report & log code util: convert error-report & log to message API for timestamp util: add support for formatting a workload name in messages util: add support for formatting a program name in messages util: add support for formatting thread info in messages util: add brackets around guest name in message context MAINTAINERS | 2 + audio/jackaudio.c | 30 +++++-- docs/about/deprecated.rst | 7 ++ include/monitor/monitor.h | 3 - include/qemu/compiler.h | 8 ++ include/qemu/error-report.h | 4 - include/qemu/log-for-trace.h | 17 +++- include/qemu/log.h | 39 +++++++++ include/qemu/message.h | 40 +++++++++ include/qemu/thread.h | 3 +- include/ui/console.h | 2 +- include/ui/qemu-spice-module.h | 3 +- meson.build | 23 ++++- monitor/monitor.c | 51 ++--------- qemu-options.hx | 121 ++++++++++++++------------- rust/util/src/log.rs | 6 ++ storage-daemon/qemu-storage-daemon.c | 6 ++ stubs/error-printf.c | 23 ----- stubs/meson.build | 1 - stubs/monitor-core.c | 19 ++++- system/vl.c | 49 +++++++++-- tests/functional/generic/test_vnc.py | 4 +- tests/qemu-iotests/041 | 2 +- tests/qemu-iotests/common.filter | 2 +- tests/unit/test-error-report.c | 6 +- tests/unit/test-util-sockets.c | 1 + ui/spice-core.c | 25 ++++-- ui/spice-module.c | 7 +- ui/ui-qmp-cmds.c | 19 ++--- ui/vnc-stubs.c | 6 +- ui/vnc.c | 16 ++-- util/error-report.c | 103 +++++++++++++++-------- util/log.c | 48 ++++++----- util/meson.build | 1 + util/message.c | 51 +++++++++++ util/qemu-thread-posix.c | 89 ++++++++++++++------ util/qemu-thread-win32.c | 87 +++++++++++++------ 37 files changed, 628 insertions(+), 296 deletions(-) create mode 100644 include/qemu/message.h delete mode 100644 stubs/error-printf.c create mode 100644 util/message.c -- 2.53.0

3 57

[libvirt PATCH for 12.1.0] domain_conf: initialize network hostdev private data
by Pavel Hrdina 26 Feb '26

26 Feb '26

From: Pavel Hrdina <phrdina(a)redhat.com> Currently virDomainNetDef and virDomainActualNetDef use virDomainHostdevDef directly as structure and the code doesn't call virDomainHostdevDefNew() that would initialize private data. This is hackish quick fix to solve a crash that happens in two scenarios: 1. attaching any interface with hostdev backend 0x0000fffbfc0e2a90 in qemuDomainAttachHostPCIDevice (driver=0xfffbb4006750, vm=0xfffbf001f790, hostdev=0xfffbf400b150) at ../src/qemu/qemu_hotplug.c:1652 1652 if ((ret = qemuFDPassDirectTransferMonitor(hostdevPriv->vfioDeviceFd, priv->mon)) < 0) 2. starting VM with interface with hostdev backend using iommufd 0x00007f6638d5b9ca in qemuProcessOpenVfioDeviceFd (hostdev=hostdev@entry=0x7f6634425ee0) at ../src/qemu/qemu_process.c:7719 7719 hostdevPriv->vfioDeviceFd = qemuFDPassDirectNew(name, &vfioDeviceFd); Proper fix for this issue is to refactor network code to use pointer and to use virDomainHostdevDefNew(). Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/conf/domain_conf.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 3528b90742..8090becdcf 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -3517,6 +3517,20 @@ void virDomainVideoDefFree(virDomainVideoDef *def) } +static int +virDomainHostdevDefPrivateDataNew(virDomainHostdevDef *def, + virDomainXMLOption *xmlopt) +{ + if (!xmlopt || !xmlopt->privateData.hostdevNew) + return 0; + + if (!(def->privateData = xmlopt->privateData.hostdevNew())) + return -1; + + return 0; +} + + virDomainHostdevDef * virDomainHostdevDefNew(virDomainXMLOption *xmlopt) { @@ -3526,8 +3540,7 @@ virDomainHostdevDefNew(virDomainXMLOption *xmlopt) def->info = g_new0(virDomainDeviceInfo, 1); - if (xmlopt && xmlopt->privateData.hostdevNew && - !(def->privateData = xmlopt->privateData.hostdevNew())) { + if (virDomainHostdevDefPrivateDataNew(def, xmlopt) < 0) { VIR_FREE(def->info); VIR_FREE(def); return NULL; @@ -9739,6 +9752,9 @@ virDomainActualNetDefParseXML(xmlNodePtr node, virDomainHostdevDef *hostdev = &actual->data.hostdev.def; int type; + if (virDomainHostdevDefPrivateDataNew(hostdev, xmlopt) < 0) + goto error; + hostdev->parentnet = parent; hostdev->info = &parent->info; /* The helper function expects type to already be found and @@ -10432,6 +10448,9 @@ virDomainNetDefParseXML(virDomainXMLOption *xmlopt, g_autofree char *addrtype = virXPathString("string(./source/address/@type)", ctxt); int type; + if (virDomainHostdevDefPrivateDataNew(&def->data.hostdev.def, xmlopt) < 0) + return NULL; + def->data.hostdev.def.parentnet = def; def->data.hostdev.def.info = &def->info; def->data.hostdev.def.mode = VIR_DOMAIN_HOSTDEV_MODE_SUBSYS; -- 2.53.0

2 1

[PATCH v2] util: fix use-after-free in virIdentityGetSystem
by Stefan Kober 26 Feb '26

26 Feb '26

We have a g_autoptr ret in the virIdentityGetSystem function. In the happy path it is properly returned by doing: return g_steal_pointer(&ret); There are 2 early return paths, were we do the following: "return ret;" This leads to the g_autoptr being cleaned up after we leave the function, as we do not properly "steal" it. When later using the return value we have a use-after-free, which has led to segfaults in some cases. As this is a regression introduced in 1280a631ef488aeaab905eb30a55899ef8ba97be, we change the behavior to properly return NULL in those cases. On-behalf-of: SAP stefan.kober(a)sap.com Signed-off-by: Stefan Kober <stefan.kober(a)cyberus-technology.de> --- src/util/viridentity.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util/viridentity.c b/src/util/viridentity.c index b7b88056ac..8e59179a20 100644 --- a/src/util/viridentity.c +++ b/src/util/viridentity.c @@ -328,14 +328,14 @@ virIdentity *virIdentityGetSystem(void) return NULL; if (!(username = virGetUserName(geteuid()))) - return ret; + return NULL; if (virIdentitySetUserName(ret, username) < 0) return NULL; if (virIdentitySetUNIXUserID(ret, getuid()) < 0) return NULL; if (!(groupname = virGetGroupName(getegid()))) - return ret; + return NULL; if (virIdentitySetGroupName(ret, groupname) < 0) return NULL; if (virIdentitySetUNIXGroupID(ret, getgid()) < 0) -- 2.53.0

3 2

[PATCH 0/4] Remove deprecated qemu-system-microblazeel from the build
by Thomas Huth 25 Feb '26

25 Feb '26

The qemu-system-microblazeel binary has been marked as deprecated since two releases, and there were no complaints (as far as I know), so it should be fine to remove this now. Users can use the qemu-system-microblaze binary (without the -el suffix) instead that can handle both endiannesses. Thomas Huth (4): tests/functional: Remove the microblazeel test tests/qtest: Remove the microblazeel target from the qtests gitlab-ci: Remove the microblazeel target from the CI jobs Remove the qemu-system-microblazeel target from the build MAINTAINERS | 4 +-- docs/about/deprecated.rst | 13 ---------- docs/about/removed-features.rst | 14 ++++++++++ .../devices/microblazeel-softmmu/default.mak | 6 ----- configs/targets/microblazeel-softmmu.mak | 6 ----- qapi/machine.json | 2 +- tests/qtest/boot-serial-test.c | 2 +- tests/qtest/machine-none-test.c | 1 - tests/tcg/plugins/syscall.c | 1 - .gitlab-ci.d/buildtest.yml | 6 ++--- .gitlab-ci.d/cirrus.yml | 4 +-- .gitlab-ci.d/crossbuilds.yml | 2 +- tests/functional/meson.build | 1 - .../functional/microblaze/test_s3adsp1800.py | 23 +++------------- tests/functional/microblazeel/meson.build | 5 ---- .../microblazeel/test_s3adsp1800.py | 26 ------------------- tests/qtest/meson.build | 2 -- 17 files changed, 27 insertions(+), 91 deletions(-) delete mode 100644 configs/devices/microblazeel-softmmu/default.mak delete mode 100644 configs/targets/microblazeel-softmmu.mak delete mode 100644 tests/functional/microblazeel/meson.build delete mode 100755 tests/functional/microblazeel/test_s3adsp1800.py -- 2.53.0

3 7

[PATCH] hyperv: report whether guests have TPM enabled
by Jonathon Jongsma 25 Feb '26

25 Feb '26

Signed-off-by: Jonathon Jongsma <jjongsma(a)redhat.com> --- src/hyperv/hyperv_driver.c | 32 +++++++++++++++++++++++++++ src/hyperv/hyperv_wmi.c | 26 ++++++++++++++++++++++ src/hyperv/hyperv_wmi.h | 4 ++++ src/hyperv/hyperv_wmi_generator.input | 9 ++++++++ 4 files changed, 71 insertions(+) diff --git a/src/hyperv/hyperv_driver.c b/src/hyperv/hyperv_driver.c index b01b4919fe..7cc67129cd 100644 --- a/src/hyperv/hyperv_driver.c +++ b/src/hyperv/hyperv_driver.c @@ -200,6 +200,22 @@ hypervGetOperatingSystem(hypervPrivate *priv, Win32_OperatingSystem **operatingS } +static int +hypervDomainGetTPMEnabled(hypervPrivate *priv, + const char *id, + bool *enabled) +{ + g_autoptr(Msvm_SecuritySettingData) securitySD = NULL; + + if (hypervGetSecuritySD(priv, id, &securitySD) < 0) + return -1; + + VIR_DEBUG("Getting TPM state for '%s': %u", id, securitySD->data->TpmEnabled); + *enabled = securitySD->data->TpmEnabled; + return 0; +} + + static int hypervRequestStateChange(virDomainPtr domain, int state) { @@ -2651,6 +2667,7 @@ hypervDomainGetXMLDesc(virDomainPtr domain, unsigned int flags) g_autoptr(Msvm_SerialPortSettingData) spsd = NULL; Msvm_ResourceAllocationSettingData *serialDevices = NULL; g_autoptr(Msvm_EthernetPortAllocationSettingData) nets = NULL; + bool tpmEnabled = false; virCheckFlags(VIR_DOMAIN_XML_COMMON_FLAGS, NULL); @@ -2791,6 +2808,21 @@ hypervDomainGetXMLDesc(virDomainPtr domain, unsigned int flags) if (hypervDomainDefParseEthernet(domain, def, nets) < 0) return NULL; + if (hypervDomainGetTPMEnabled(priv, virtualSystemSettingData->data->InstanceID, &tpmEnabled) == 0 + && tpmEnabled) { + virDomainTPMDef* tpm = NULL; + + if (!def->tpms) { + def->tpms = g_new0(virDomainTPMDef *, 1); + } + + tpm = g_new0(virDomainTPMDef, 1); + tpm->model = VIR_DOMAIN_TPM_MODEL_DEFAULT; + tpm->type = VIR_DOMAIN_TPM_TYPE_EMULATOR; + + def->tpms[def->ntpms++] = tpm; + } + /* XXX xmlopts must be non-NULL */ return virDomainDefFormat(def, NULL, virDomainDefFormatConvertXMLFlags(flags)); } diff --git a/src/hyperv/hyperv_wmi.c b/src/hyperv/hyperv_wmi.c index 7ae3afc40a..1cf442dad3 100644 --- a/src/hyperv/hyperv_wmi.c +++ b/src/hyperv/hyperv_wmi.c @@ -1625,3 +1625,29 @@ hypervMsvmVSMSModifyResourceSettings(hypervPrivate *priv, return 0; } + + +int +hypervGetSecuritySD(hypervPrivate *priv, + const char *vssd_instanceid, + Msvm_SecuritySettingData **data) +{ + g_auto(virBuffer) query = VIR_BUFFER_INITIALIZER; + + virBufferEscapeSQL(&query, + "ASSOCIATORS OF {Msvm_VirtualSystemSettingData.InstanceID='%s'} " + "WHERE ResultClass = Msvm_SecuritySettingData", + vssd_instanceid); + + if (hypervGetWmiClass(Msvm_SecuritySettingData, data) < 0) + return -1; + + if (!*data) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Could not look up security setting data with virtual system instance ID '%1$s'"), + vssd_instanceid); + return -1; + } + + return 0; +} diff --git a/src/hyperv/hyperv_wmi.h b/src/hyperv/hyperv_wmi.h index 65b1211b89..0f8cfb30bc 100644 --- a/src/hyperv/hyperv_wmi.h +++ b/src/hyperv/hyperv_wmi.h @@ -269,6 +269,10 @@ int hypervImageManagementServiceGetVHDSD(hypervPrivate *priv, const char *vhdPath, WsXmlDocH *settingDataDoc); +int hypervGetSecuritySD(hypervPrivate *priv, + const char *vssd_instanceid, + Msvm_SecuritySettingData **data); + /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Msvm_VirtualSystemManagementService */ diff --git a/src/hyperv/hyperv_wmi_generator.input b/src/hyperv/hyperv_wmi_generator.input index 017b7a0fa5..b3cd9d19fb 100644 --- a/src/hyperv/hyperv_wmi_generator.input +++ b/src/hyperv/hyperv_wmi_generator.input @@ -1252,3 +1252,12 @@ class Win32_DiskDrive uint64 TotalTracks uint32 TracksPerCylinder end + +class Msvm_SecuritySettingData + boolean TpmEnabled + boolean KsdEnabled + boolean ShieldingRequested + boolean DataProtectionRequested + boolean EncryptStateAndVmMigrationTraffic + boolean VirtualizationBasedSecurityOptOut +end -- 2.53.0

2 1

[PATCH] util: fix use-after-free in virIdentityGetSystem
by Stefan Kober 25 Feb '26

25 Feb '26

We have a g_autoptr ret in the virIdentityGetSystem function. In the happy path it is properly returned by doing: return g_steal_pointer(&ret); There are 2 early return paths, were we do the following: "return ret;" This leads to the g_autoptr being cleaned up after we leave the function, as we do not properly "steal" it. When later using the return value we have a use-after-free, which has led to segfaults in our case. We fix the early returns by doing the same as in the happy path. On-behalf-of: SAP stefan.kober(a)sap.com Signed-off-by: Stefan Kober <stefan.kober(a)cyberus-technology.de> --- src/util/viridentity.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/util/viridentity.c b/src/util/viridentity.c index b7b88056ac..10935fba60 100644 --- a/src/util/viridentity.c +++ b/src/util/viridentity.c @@ -327,15 +327,19 @@ virIdentity *virIdentityGetSystem(void) virIdentitySetProcessTime(ret, startTime) < 0) return NULL; - if (!(username = virGetUserName(geteuid()))) - return ret; + if (!(username = virGetUserName(geteuid()))) { + VIR_WARN("virGetUserName failed, returning partial identity"); + return g_steal_pointer(&ret); + } if (virIdentitySetUserName(ret, username) < 0) return NULL; if (virIdentitySetUNIXUserID(ret, getuid()) < 0) return NULL; - if (!(groupname = virGetGroupName(getegid()))) - return ret; + if (!(groupname = virGetGroupName(getegid()))) { + VIR_WARN("virGetGroupName failed, returning partial identity"); + return g_steal_pointer(&ret); + } if (virIdentitySetGroupName(ret, groupname) < 0) return NULL; if (virIdentitySetUNIXGroupID(ret, getgid()) < 0) -- 2.53.0

2 2

[PATCH] qemu: Fix job handling when domain dies in post-copy migration
by Jiri Denemark 25 Feb '26

25 Feb '26

From: Jiri Denemark <jdenemar(a)redhat.com> When a domain is in post-copy migration phase, we need to keep the job active if something fails to protect the domain from changes. Unfortunately, there is a race between migration code and qemuProcessStop that can cause the job to stay active even when the domain is gone and thus preventing the domain from being started again (until virtqemud is restarted). The race is caused by unlocking the vm object when calling virConnectUnregisterCloseCallback. While the domain is unlocked qemuProcessStop can finish its work and the domain may no longer be active when we get the lock back. The post-copy path does not properly check if a domain is still active. Instead of adding the virDomainObjIsActive check in all places where this could happen, we can add it in virDomainObjIsPostcopy and virDomainObjIsFailedPostcopy and let the code take the pre-copy cleanup path. Clearly an inactive domain can never be in (failed) post-copy migration. https://issues.redhat.com/browse/RHEL-145179 Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- src/conf/domain_conf.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 998b333c74..3528b90742 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -30723,6 +30723,9 @@ bool virDomainObjIsFailedPostcopy(virDomainObj *dom, virDomainJobObj *job) { + if (!virDomainObjIsActive(dom)) + return false; + if (job && job->asyncPaused && (job->asyncJob == VIR_ASYNC_JOB_MIGRATION_IN || job->asyncJob == VIR_ASYNC_JOB_MIGRATION_OUT)) @@ -30739,6 +30742,9 @@ bool virDomainObjIsPostcopy(virDomainObj *dom, virDomainJobObj *job) { + if (!virDomainObjIsActive(dom)) + return false; + if (virDomainObjIsFailedPostcopy(dom, job)) return true; -- 2.53.0

2 1

[PATCH] util: Fix secondary bus reset check for multi-root PCI systems
by ehanoc 25 Feb '26

25 Feb '26

The virPCIDeviceReset() function was using a hardcoded check for bus != 0 to determine if a device is on a root bus before attempting a secondary bus reset. This breaks on multi-root systems like Intel Arrow Lake where devices can be on non-zero root buses (e.g., Bus 0x80 for the PCH root complex). Update the logic to use virPCIDeviceIsOnRootBus() which detects root bus attachment via sysfs topology, making it work correctly on any PCI-compliant system regardless of bus numbers. This ensures secondary bus reset is never attempted on ANY root bus (0x00, 0x80, etc.), only on devices behind PCI bridges where it's safe. Signed-off-by: Bruno Martins <ehanoc(a)protonmail.com> --- src/util/virpci.c | 106 +++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 99 insertions(+), 7 deletions(-) diff --git a/src/util/virpci.c b/src/util/virpci.c index 2348a98003..f2ce24e6aa 100644 --- a/src/util/virpci.c +++ b/src/util/virpci.c @@ -1081,6 +1081,81 @@ virPCIDeviceInit(virPCIDevice *dev, int cfgfd) return 0; } +/* + * Check if a PCI device is directly attached to a root bus (no parent bridge). + * + * Modern systems like Intel Arrow Lake (Core Ultra 200) can have multiple + * root buses (e.g., bus 0x00 for CPU devices and bus 0x80 for PCH devices). + * We detect root bus attachment by examining the sysfs topology: a device + * is on a root bus if its sysfs path is a direct child of a pciXXXX:YY + * directory (e.g., /sys/devices/pci0000:80/0000:80:14.0). + * + * Returns 1 if on root bus, 0 if not, -1 on error. + */ +static int +virPCIDeviceIsOnRootBus(virPCIDevice *dev) +{ + unsigned int domain, bus; + g_autofree char *devPath = NULL; + g_autofree char *realPath = NULL; + g_autofree char *parentDir = NULL; + const char *parentName; + + /* Get the sysfs symlink path for this device */ + devPath = g_strdup_printf(PCI_SYSFS "devices/%s", dev->name); + + /* Resolve the symlink to get the real path in /sys/devices/... */ + if (virFileResolveLink(devPath, &realPath) < 0) { + VIR_DEBUG("%s %s: failed to resolve sysfs path %s", + dev->id, dev->name, devPath); + return -1; + } + + parentDir = g_path_get_dirname(realPath); + if (!parentDir) + return -1; + + parentName = strrchr(parentDir, '/'); + if (!parentName) + return -1; + parentName++; // skip the '/' + + /* + * Detect root bus by parsing the parent directory name using sscanf. + * + * PCI root buses in sysfs follow the naming convention: + * pci<domain>:<bus> + * + * - <domain>: number (0000-ffff, hex) + * - <bus>: number within the domain (00-ff, hex) + * + * This format is defined in: + * https://www.kernel.org/doc/html/latest/PCI/sysfs-pci.html + * + * Examples from Intel Arrow Lake systems: + * - pci0000:00 (CPU root bus) + * - pci0000:80 (PCH root bus - the problematic case on Arrow Lake) + * + * sscanf pattern "pci%x:%x" matches: + * - "pci" : literal prefix + * - "%x" : hex domain (stops at ':') + * - ":" : literal separator + * - "%x" : hex bus (must reach end of string) + * + * Returns 2 if both domain and bus were successfully parsed, + * confirming the device is a direct child of a root bus. + */ + if (sscanf(parentName, "pci%x:%x", &domain, &bus) == 2) { + VIR_DEBUG("%s %s: device is on root bus (parent=%s)", + dev->id, dev->name, parentName); + return 1; + } + + VIR_DEBUG("%s %s: device is not on root bus (parent=%s)", + dev->id, dev->name, parentName); + return 0; +} + int virPCIDeviceReset(virPCIDevice *dev, virPCIDeviceList *activeDevs, @@ -1146,9 +1221,17 @@ virPCIDeviceReset(virPCIDevice *dev, if (dev->has_pm_reset) ret = virPCIDeviceTryPowerManagementReset(dev, fd); - /* Bus reset is not an option with the root bus */ - if (ret < 0 && dev->address.bus != 0) - ret = virPCIDeviceTrySecondaryBusReset(dev, fd, inactiveDevs); + /* Bus reset is not an option with the root bus. On multi-root + * systems like Intel Arrow Lake, root buses can be non-zero (e.g., 0x80), + * so we use sysfs topology detection instead of checking bus == 0. + */ + if (ret < 0) { + int onRootBus = virPCIDeviceIsOnRootBus(dev); + if (onRootBus < 0) + goto cleanup; + if (!onRootBus) + ret = virPCIDeviceTrySecondaryBusReset(dev, fd, inactiveDevs); + } if (ret < 0) { virErrorPtr err = virGetLastError(); @@ -2531,15 +2614,24 @@ static int virPCIDeviceIsBehindSwitchLackingACS(virPCIDevice *dev) { g_autoptr(virPCIDevice) parent = NULL; + int onRootBus; if (virPCIDeviceGetParent(dev, &parent) < 0) return -1; if (!parent) { - /* if we have no parent, and this is the root bus, ACS doesn't come - * into play since devices on the root bus can't P2P without going - * through the root IOMMU. + /* If we have no parent bridge, check if the device is directly + * attached to a root bus. Systems like Intel Arrow Lake can have + * multiple root buses (e.g., 0x00 and 0x80), so we can't just + * check for bus == 0. Instead, use sysfs topology to detect + * root bus attachment. + * + * ACS doesn't come into play for devices on root buses since + * they can't P2P without going through the root IOMMU. */ - if (dev->address.bus == 0) { + onRootBus = virPCIDeviceIsOnRootBus(dev); + if (onRootBus < 0) + return -1; + if (onRootBus) { return 0; } else { virReportError(VIR_ERR_INTERNAL_ERROR, -- 2.47.3

1 0