- Devel - libvirt List Archives

[PATCH 0/5] tools: improve virt-host-validate output
by Daniel P. Berrangé 20 Nov '25

20 Nov '25

It now gives some details for certain checks: QEMU: Checking for hardware virtualization : PASS (VMX) QEMU: Checking if device '/dev/kvm' exists : PASS QEMU: Checking if device '/dev/kvm' is accessible : PASS QEMU: Checking if device '/dev/vhost-net' exists : PASS QEMU: Checking if device '/dev/net/tun' exists : PASS QEMU: Checking for cgroup 'cpu' controller support : PASS QEMU: Checking for cgroup 'cpuacct' controller support : PASS QEMU: Checking for cgroup 'cpuset' controller support : PASS QEMU: Checking for cgroup 'memory' controller support : PASS QEMU: Checking for cgroup 'devices' controller support : PASS QEMU: Checking for cgroup 'blkio' controller support : PASS QEMU: Checking for device assignment IOMMU support : PASS (DMAR) QEMU: Checking if IOMMU is enabled by kernel : PASS QEMU: Checking for secure guest support : PASS (TDX) Daniel P. Berrangé (5): tools: allow passing details for passed validation tests tools: inform user which IOMMU was found during validation tools: inform user which CVM is found during validation tools: be explicit about failure to find x86 secure virt tools: inform user which hardware virt was found during validation tools/virt-host-validate-common.c | 60 ++++++++++++------------------- tools/virt-host-validate-qemu.c | 16 ++++++--- tools/virt-validate-common.c | 12 ++++++- tools/virt-validate-common.h | 1 + 4 files changed, 47 insertions(+), 42 deletions(-) -- 2.51.1

2 12

[libvirt PATCH] qemu: make qemuBuildDeviceAddressPCIGetBus more generic
by Ján Tomko 20 Nov '25

20 Nov '25

From: Ján Tomko <jtomko(a)redhat.com> Operate on a virPCIDeviceAddress, not virDomainDeviceInfo so that this can be reused to look for buses that are not stored in the device info. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- A prerequisite for the SMMUv3 series src/qemu/qemu_command.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index c56c321a6e..d5a4201e12 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -332,7 +332,7 @@ qemuBuildMasterKeyCommandLine(virCommand *cmd, static char * qemuBuildDeviceAddressPCIGetBus(const virDomainDef *domainDef, - const virDomainDeviceInfo *info) + const virPCIDeviceAddress *pci) { g_autofree char *devStr = NULL; const char *contAlias = NULL; @@ -340,14 +340,14 @@ qemuBuildDeviceAddressPCIGetBus(const virDomainDef *domainDef, int contTargetIndex = 0; size_t i; - if (!(devStr = virPCIDeviceAddressAsString(&info->addr.pci))) + if (!(devStr = virPCIDeviceAddressAsString(pci))) return NULL; for (i = 0; i < domainDef->ncontrollers; i++) { virDomainControllerDef *cont = domainDef->controllers[i]; if (cont->type == VIR_DOMAIN_CONTROLLER_TYPE_PCI && - cont->idx == info->addr.pci.bus) { + cont->idx == pci->bus) { contAlias = cont->info.alias; contIsPHB = virDomainControllerIsPSeriesPHB(cont); contTargetIndex = cont->opts.pciopts.targetIndex; @@ -355,7 +355,7 @@ qemuBuildDeviceAddressPCIGetBus(const virDomainDef *domainDef, if (!contAlias) { virReportError(VIR_ERR_INTERNAL_ERROR, _("Device alias was not set for PCI controller with index '%1$u' required for device at address '%2$s'"), - info->addr.pci.bus, devStr); + pci->bus, devStr); return NULL; } @@ -397,7 +397,7 @@ qemuBuildDeviceAddressPCIGetBus(const virDomainDef *domainDef, if (!contAlias) { virReportError(VIR_ERR_INTERNAL_ERROR, _("Could not find PCI controller with index '%1$u' required for device at address '%2$s'"), - info->addr.pci.bus, devStr); + pci->bus, devStr); return NULL; } @@ -584,7 +584,7 @@ qemuBuildDeviceAddressProps(virJSONValue *props, switch (info->type) { case VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI: { g_autofree char *pciaddr = NULL; - g_autofree char *bus = qemuBuildDeviceAddressPCIGetBus(domainDef, info); + g_autofree char *bus = qemuBuildDeviceAddressPCIGetBus(domainDef, &info->addr.pci); if (!bus) return -1; -- 2.51.1

2 1

[PATCH 0/2] qemu: fix capabilities reporting for TDX
by Daniel P. Berrangé 20 Nov '25

20 Nov '25

The capabilities reporting merged for TDX was flawed because it would always report TDX as supported simply if QEMU was new enough to have 'tdx-guest'. IOW, all x86 hosts currently report 'tdx' as fully supported which is a regression for AMD hosts, as we're now reporting incorrect data there which can confuse mgmt apps. Unfortunately the 'query-tdx-capabilities' QMP command that was in early postings: https://mail.gnu.org/archive/html/qemu-devel/2021-07/msg01689.html went missing and I'm not seeing an alternative way to query QEMU to see if TDX is actually launchable. So in these patches I open /dev/kvm and directly ask of the 'TDX' VM type is supported by KVM, which IIUC is equivalent to waht the original 'query-tdx-capabilities' patch was doing. Daniel P. Berrangé (2): qemu: correctly detect working TDX support qemu: always report TDX feature caps on x86 src/qemu/qemu_capabilities.c | 71 +++++++++++++++++-- src/qemu/qemu_capabilities.h | 3 + .../qemu_10.0.0-q35.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_10.0.0-q35.x86_64.xml | 1 + .../qemu_10.0.0-tcg.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_10.0.0-tcg.x86_64.xml | 1 + .../qemu_10.0.0.x86_64+amdsev.xml | 1 + tests/domaincapsdata/qemu_10.0.0.x86_64.xml | 1 + .../qemu_10.1.0-tcg.x86_64+inteltdx.xml | 1 + .../domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 1 + .../domaincapsdata/qemu_10.2.0-tcg.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 1 + .../qemu_7.2.0-hvf.x86_64+hvf.xml | 1 + .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 1 + .../qemu_7.2.0-tcg.x86_64+hvf.xml | 1 + .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 1 + .../qemu_9.2.0-q35.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 1 + .../qemu_9.2.0-tcg.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 1 + .../qemu_9.2.0.x86_64+amdsev.xml | 1 + tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 1 + tests/domaincapsmock.c | 6 ++ 47 files changed, 120 insertions(+), 4 deletions(-) -- 2.51.1

3 10

[libvirt PATCH 0/3] build: drop userfaultfd_sysctl option
by Ján Tomko 20 Nov '25

20 Nov '25

Ján Tomko (3): qemu: drop postcopy-migration.sysctl spec: drop with_userfaultfd_sysctl build: drop userfaultfd_sysctl option libvirt.spec.in | 18 ------------------ meson.build | 7 ------- meson_options.txt | 2 -- src/qemu/meson.build | 8 -------- src/qemu/postcopy-migration.sysctl | 6 ------ 5 files changed, 41 deletions(-) delete mode 100644 src/qemu/postcopy-migration.sysctl -- 2.51.1

2 4

[PATCH v3 0/3] qemu: Implement support for multiple device-pluggable SMMUv3s
by Nathan Chen 20 Nov '25

20 Nov '25

Hi, This is a follow up to the second patchset [0] for supporting multiple device-pluggable vSMMU instances. (re-sending this series for review) This patchset implements support for specifying multiple <iommu> devices within the VM definition when smmuv3 IOMMU model is specified with a pciBus driver attribute, and is tested with Shameer's recently accepted qemu series for user-creatable vSMMU devices [1] For instance, specifying the associated emulated device in a VM definition with multiple IOMMUs, configured to be routed to pcie-expander-bus or pcie-root controllers: <devices> <controller type='pci' index='0' model='pcie-root'/> <controller type='pci' index='1' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='252'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </controller> <controller type='pci' index='2' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='2' port='0x0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </controller> ... <rng model='virtio'> <backend model='random'>/dev/urandom</backend> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </rng> <rng model='virtio'> <backend model='random'>/dev/urandom</backend> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> </rng> <iommu model='smmuv3'> <driver pciBus='0'/> </iommu> <iommu model='smmuv3'> <driver pciBus='1'/> </iommu> </devices> This would get translated to a qemu command line with the arguments below. -device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ -device '{"driver":"pcie-root-port","port":0,"chassis":2,"id":"pci.2","bus":"pci.1","addr":"0x0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pcie.0","id":"smmuv3.0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"smmuv3.1"}' \ ... -object '{"qom-type":"rng-random","id":"objrng0","filename":"/dev/urandom"}' \ -device '{"driver":"virtio-rng-pci","rng":"objrng0","id":"rng0","bus":"pci.2","addr":"0x0"}' \ -object '{"qom-type":"rng-random","id":"objrng1","filename":"/dev/urandom"}' \ -device '{"driver":"virtio-rng-pci","rng":"objrng1","id":"rng1","bus":"pcie.0","addr":"0x4"}' \ Changes from v2: - Make multi-iommu adoption the first commit - Consolidate smmuv3Dev into smmuv3 model - Change 'parentIdx' attribute name to 'pciBus' - Change naming of virDomainDef 'iommu' attribute to 'iommus' - Move multi-iommu check to validation code - Move qemu dev props function to device-pluggable smmuv3 commit - Fix conditional statements per feedback Changes from v1: - Moved parentIdx attribute under <driver> - Revised qemuxmlconfdata test cases to attach emulated devices This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/nestedsmmuv3-no-accel-10-2… Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/IF6O… [1] https://lore.kernel.org/qemu-devel/20250829082543.7680-1-skolothumtho@nvidi… Nathan Chen (3): conf: Support multiple device-pluggable smmuv3 IOMMUs qemu: Implement pluggable-device smmuv3 tests: qemuxmlconfdata: provide device-pluggable smmuv3 sample XML and CLI args docs/formatdomain.rst | 4 + src/conf/domain_conf.c | 100 +++++++-- src/conf/domain_conf.h | 10 +- src/conf/domain_validate.c | 61 ++++-- src/conf/schemas/domaincommon.rng | 9 +- src/libvirt_private.syms | 2 + src/qemu/qemu_alias.c | 15 +- src/qemu/qemu_command.c | 197 ++++++++++++------ src/qemu/qemu_domain.c | 2 +- src/qemu/qemu_domain_address.c | 5 +- src/qemu/qemu_driver.c | 8 +- src/qemu/qemu_postparse.c | 11 +- src/qemu/qemu_validate.c | 2 +- .../iommu-smmuv3-pci-bus.aarch64-latest.args | 41 ++++ .../iommu-smmuv3-pci-bus.aarch64-latest.xml | 62 ++++++ .../qemuxmlconfdata/iommu-smmuv3-pci-bus.xml | 49 +++++ tests/qemuxmlconftest.c | 1 + 17 files changed, 455 insertions(+), 124 deletions(-) create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus.xml -- 2.43.0

2 7

RFC Gitlab #692
by Wesley Hershberger 19 Nov '25

19 Nov '25

Hi all, I'm working on Gitlab #692 [1] and would appreciate a quick discussion/review/sanity check of the direction I'm planning to take before I invest many days in a solution that misses some major consideration. I'll provide a summary of the issue here and then lay out the two approaches I'm considering. The AppArmor sVirt driver creates & loads a dynamic AppArmor profile by passing a domain's XML description to a separate program `virt-aa-helper` (see [2] for more details). When a device is hotplugged to a domain, the `virt-aa-helper` is called with a flag (`-F`) which appends a rule for that device's backing resource to the profile. The profile is reloaded from the XML description whenever a device is hotunplugged. However, the XML description for some devices does not contain enough information to create the corresponding AppArmor rule. When a profile containing a dynamic rule is reloaded, the dynamic rule is lost, and the device fails (this has been observed with macvtap devices). A similar situation occurs when temporary write access to snapshot layers is needed during block-commit; the `virt-aa-helper` is called with `-F` to add the temporary access and the profile is reloaded at the end of the operation to remove it again. However, this can have the unintended side-effect of wiping out other temporary accesses (for concurrent blockcommits) or removing access for devices added with `-F` (macvtap). A solution must: - Be persistent across libvirtd restarts - Correctly synchronize concurrent profile modifications We've conceived of two broad approaches to this issue: 1. Add fields to the domain XML schema (and persist them) so that the profile can be correctly generated using only the domain's XML description. 2. Create a separate XML file `/etc/apparmor.d/libvirt/libvirt-UUID-dynamic.xml` with only the information needed to produce the dynamic rules; access would be synchronized by a lock in libvirtd. `virt-aa-helper` would consume this file every time it runs; the file would be removed on Domain shutdown. Option 1 (Add fields to Domain schema) Concerns: ================================================ - User-visible schema changes - Do additional fields make sense in the domain schema? e.g. - a macvtap device path `/dev/tapX` - permissions info in `backingStore` elements - It may be non-trivial to chase down every device that could be affected by this issue and plumb through the additional fields (i.e. a complete solution may not be possible) Option 2 (Separate AppArmor XML) Concerns: ========================================== - User-visible additional file - Not generalizable for (future) sVirt drivers that depend on synchronizing a global resource - May require adding remove/restore hooks for the following sVirt interfaces: - virSecurityDomainSetImageFDLabel domainSetSecurityImageFDLabel; - virSecurityDomainSetTapFDLabel domainSetSecurityTapFDLabel; I'd appreciate any input you'd be able to provide regarding the above trade-offs; specifically looking for guidance on what you would consider merging (in contrast to previous approaches [3]). Thanks very much for taking the time to review this, ~Wesley Hershberger Canonical Support [1] https://gitlab.com/libvirt/libvirt/-/issues/692 [2] https://gitlab.com/apparmor/apparmor/-/wikis/Libvirt [3] https://www.mail-archive.com/devel@lists.libvirt.org/msg07703.html

2 1

[PATCH 0/8] qemu: Add option to preserve shutdown VM during backup job and job/reconnection fixes
by Peter Krempa 19 Nov '25

19 Nov '25

This series first fixes few job handling, reconnection and backup job bugs and then implements an option to keep the VM process around when the guest OS shuts down during backup, so that the backup doesn't need to be restarted. Peter Krempa (8): virDomainNestedJobAllowed: Allow VIR_JOB_MODIFY_MIGRATION_SAFE if VIR_JOB_MODIFY is allowed qemuProcessReconnect: Continue reconnection if VM untergoes fake-reboot qemu: backup: Don't attempt to stop the NBD server twice qemuBlockJobProcessEventConcludedBackup: Notify the backup job later lib: Introduce VIR_DOMAIN_EVENT_SUSPENDED_GUEST_SHUTDOWN event reason lib: Introduce VIR_DOMAIN_BACKUP_BEGIN_PRESERVE_SHUTDOWN_DOMAIN flag qemu: backup: Add support for VIR_DOMAIN_BACKUP_BEGIN_PRESERVE_SHUTDOWN_DOMAIN kbase: Add note about preserving VM on shutdown to backup article docs/kbase/live_full_disk_backup.rst | 18 +++++ docs/manpages/virsh.rst | 6 ++ examples/c/misc/event-test.c | 3 + include/libvirt/libvirt-domain.h | 7 +- src/conf/backup_conf.h | 4 ++ src/conf/virdomainjob.c | 1 + src/libvirt-domain.c | 5 ++ src/qemu/qemu_backup.c | 61 +++++++++++++--- src/qemu/qemu_backup.h | 4 ++ src/qemu/qemu_blockjob.c | 7 +- src/qemu/qemu_driver.c | 2 +- src/qemu/qemu_process.c | 101 +++++++++++++++++++++++++-- src/qemu/qemu_process.h | 3 +- tools/virsh-backup.c | 7 ++ tools/virsh-domain-event.c | 3 +- 15 files changed, 210 insertions(+), 22 deletions(-) -- 2.51.1

2 11

[PATCH] docs: domain: add watchdog notification support
by Massimiliano Minella via B4 Relay 19 Nov '25

19 Nov '25

From: Massimiliano Minella <massimiliano.minella(a)se.com> Since v0.8.0 a watchdog notification is available under event ID VIR_DOMAIN_EVENT_ID_WATCHDOG, update the documentation to remove the previous limitation. Signed-off-by: Massimiliano Minella <massimiliano.minella(a)se.com> --- Remove limitation on notification support for watchdog. --- docs/formatdomain.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git docs/formatdomain.rst docs/formatdomain.rst index f50dce477f..d70022a239 100644 --- docs/formatdomain.rst +++ docs/formatdomain.rst @@ -8350,8 +8350,8 @@ The watchdog device requires an additional driver and management daemon in the guest. Just enabling the watchdog in the libvirt configuration does not do anything useful on its own. -Currently libvirt does not support notification when the watchdog fires. This -feature is planned for a future version of libvirt. +:since:`Since 0.8.0`, a notification is available when the watchdog fires, using +the event ID ``VIR_DOMAIN_EVENT_ID_WATCHDOG``. Having multiple watchdogs is usually not something very common, but be aware that this might happen, for example, when an implicit watchdog device is added --- base-commit: eb99bbaf2e5b1e91f4999c7a1ccc90d67dfbe471 change-id: 20251003-update_wd_doc-5aa9b43be09a Best regards, -- Massimiliano Minella <massimiliano.minella(a)se.com>

2 1

RE: [PATCH] docs: domain: add watchdog notification support
by Massimiliano MINELLA 19 Nov '25

19 Nov '25

Hello, do you have any feedback on this patch? Best regards, Massimiliano General -----Original Message----- From: Massimiliano Minella via B4 Relay <devnull+massimiliano.minella.se.com(a)kernel.org> Sent: vendredi 3 octobre 2025 10:45 To: devel(a)lists.libvirt.org Cc: Massimiliano MINELLA <massimiliano.minella(a)se.com> Subject: [PATCH] docs: domain: add watchdog notification support [External email: Use caution with links and attachments] ________________________________ From: Massimiliano Minella <massimiliano.minella(a)se.com> Since v0.8.0 a watchdog notification is available under event ID VIR_DOMAIN_EVENT_ID_WATCHDOG, update the documentation to remove the previous limitation. Signed-off-by: Massimiliano Minella <massimiliano.minella(a)se.com> --- Remove limitation on notification support for watchdog. --- docs/formatdomain.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git docs/formatdomain.rst docs/formatdomain.rst index f50dce477f..c99560a3bd 100644 --- docs/formatdomain.rst +++ docs/formatdomain.rst @@ -8350,8 +8350,8 @@ The watchdog device requires an additional driver and management daemon in the guest. Just enabling the watchdog in the libvirt configuration does not do anything useful on its own. -Currently libvirt does not support notification when the watchdog fires. This -feature is planned for a future version of libvirt. +:since:`Since 0.8.0` a notification when the watchdog fires is +available using the event ID ``VIR_DOMAIN_EVENT_ID_WATCHDOG``. Having multiple watchdogs is usually not something very common, but be aware that this might happen, for example, when an implicit watchdog device is added --- base-commit: eb99bbaf2e5b1e91f4999c7a1ccc90d67dfbe471 change-id: 20251003-update_wd_doc-5aa9b43be09a Best regards, -- Massimiliano Minella <massimiliano.minella(a)se.com>

1 0

[PATCH 0/2] Fix detect_zeroes setup in qemu and improve tests
by Peter Krempa 19 Nov '25

19 Nov '25

See 2/2 for explanation. Peter Krempa (2): qemuxmlconftest: Improve coverage of 'disk-detect-zeroes' test case qemuDomainPrepareDiskSourceData: Setup 'detect_zeroes' for all layers src/qemu/qemu_domain.c | 6 +--- .../xml2json/file-backing_basic-detect.json | 3 ++ .../file-backing_basic-unmap-detect.json | 3 ++ .../file-backing_basic-unmap-ignore.json | 3 ++ .../disk-detect-zeroes.x86_64-latest.args | 20 +++++++++--- tests/qemuxmlconfdata/disk-detect-zeroes.xml | 31 +++++++++++++++++-- 6 files changed, 55 insertions(+), 11 deletions(-) -- 2.51.1

3 4