- Devel - libvirt List Archives

[PATCH] qemu: don't warn about missing SMM for CVM firmware
by Daniel P. Berrangé 12 Aug '25

12 Aug '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Neither Intel TDX / AMD SEV(SNP) allow use of SMM, but the EDK2 firmware none the less supports secureboot. Libvirt currently issues bogus warnings about Fedora firmware warning : qemuFirmwareSanityCheck:1575 : Firmware description '/usr/share/qemu/firmware/60-edk2-ovmf-x64-inteltdx.json' has invalid set of features: requires-smm = 0, secure-boot = 1, enrolled-keys = 1 This removes the warning if the firmware descriptor indicates use of any confidential VM technology. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/qemu/qemu_firmware.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_firmware.c b/src/qemu/qemu_firmware.c index f10137144e..dbec068738 100644 --- a/src/qemu/qemu_firmware.c +++ b/src/qemu/qemu_firmware.c @@ -1540,6 +1540,7 @@ qemuFirmwareSanityCheck(const qemuFirmware *fw, bool requiresSMM = false; bool supportsSecureBoot = false; bool hasEnrolledKeys = false; + bool cvm = false; for (i = 0; i < fw->nfeatures; i++) { switch (fw->features[i]) { @@ -1552,13 +1553,15 @@ qemuFirmwareSanityCheck(const qemuFirmware *fw, case QEMU_FIRMWARE_FEATURE_ENROLLED_KEYS: hasEnrolledKeys = true; break; - case QEMU_FIRMWARE_FEATURE_NONE: - case QEMU_FIRMWARE_FEATURE_ACPI_S3: - case QEMU_FIRMWARE_FEATURE_ACPI_S4: case QEMU_FIRMWARE_FEATURE_AMD_SEV: case QEMU_FIRMWARE_FEATURE_AMD_SEV_ES: case QEMU_FIRMWARE_FEATURE_AMD_SEV_SNP: case QEMU_FIRMWARE_FEATURE_INTEL_TDX: + cvm = true; + break; + case QEMU_FIRMWARE_FEATURE_NONE: + case QEMU_FIRMWARE_FEATURE_ACPI_S3: + case QEMU_FIRMWARE_FEATURE_ACPI_S4: case QEMU_FIRMWARE_FEATURE_VERBOSE_DYNAMIC: case QEMU_FIRMWARE_FEATURE_VERBOSE_STATIC: case QEMU_FIRMWARE_FEATURE_LAST: @@ -1566,7 +1569,8 @@ qemuFirmwareSanityCheck(const qemuFirmware *fw, } } - if ((supportsSecureBoot != requiresSMM) || + if ((!cvm && + (supportsSecureBoot != requiresSMM)) || (hasEnrolledKeys && !supportsSecureBoot)) { VIR_WARN("Firmware description '%s' has invalid set of features: " "%s = %d, %s = %d, %s = %d", -- 2.50.1

3 4

[PATCH] Storage: ZFS: implement `resizeVol` method to support native resize
by George Melikov 12 Aug '25

12 Aug '25

From: George Melikov <mail(a)gmelikov.ru> ZFS doesn't have thick allocations, every allocation is thin-provisioned, so resize operation is essentially a zvol size limit change (`zfs set volsize=X pool/zvol_name`). Shrink is allowed too (which leads to data destruction), but shrink restriction is already implemented in libvirt, so this function doesn't need to check anything. This patch is posted via PR too and has green test runs https://gitlab.com/libvirt/libvirt/-/merge_requests/495 Signed-off-by: George Melikov <mail(a)gmelikov.ru> --- src/storage/storage_backend_zfs.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/src/storage/storage_backend_zfs.c b/src/storage/storage_backend_zfs.c index 178b505e92..33434d0cac 100644 --- a/src/storage/storage_backend_zfs.c +++ b/src/storage/storage_backend_zfs.c @@ -439,6 +439,25 @@ virStorageBackendZFSDeletePool(virStoragePoolObj *pool, return virCommandRun(cmd, NULL); } +static int +virStorageBackendZFSResizeVol(virStoragePoolObj *pool, + virStorageVolDef *vol, + unsigned long long capacity, + unsigned int flags) +{ + virStoragePoolDef *def = virStoragePoolObjGetDef(pool); + g_autoptr(virCommand) resize_cmd = NULL; + + virCheckFlags(0, -1); + + resize_cmd = virCommandNewArgList(ZFS, "set", NULL); + virCommandAddArgFormat(resize_cmd, "volsize=%llu", capacity); + virCommandAddArgFormat(resize_cmd, "%s/%s", + def->source.name, vol->name); + + return virCommandRun(resize_cmd, NULL); +} + virStorageBackend virStorageBackendZFS = { .type = VIR_STORAGE_POOL_ZFS, @@ -450,6 +469,7 @@ virStorageBackend virStorageBackendZFS = { .deletePool = virStorageBackendZFSDeletePool, .uploadVol = virStorageBackendVolUploadLocal, .downloadVol = virStorageBackendVolDownloadLocal, + .resizeVol = virStorageBackendZFSResizeVol, }; -- 2.47.2

2 1

[PATCH 0/5] Cleanup of callers of virDomainDefGetVcpu
by Peter Krempa 12 Aug '25

12 Aug '25

Fix few issues with how virDomainDefGetVcpu is called and in related code. Peter Krempa (5): Unexport virCHProcessSetupVcpu virDomainVcpuDefPostParse: Remove impossible check qemu: domain: Remove unused qemuDomainGetVcpuHalted virCHDomainRefreshThreadInfo: Don't trust vcpu ID returned by hypervisor virCHDomainRefreshThreadInfo: Remove illusion that caller cares about return value src/ch/ch_domain.c | 17 ++++++++++------- src/ch/ch_domain.h | 2 +- src/ch/ch_process.c | 2 +- src/ch/ch_process.h | 3 --- src/conf/domain_postparse.c | 4 ---- src/qemu/qemu_domain.c | 15 --------------- src/qemu/qemu_domain.h | 1 - 7 files changed, 12 insertions(+), 32 deletions(-) -- 2.50.1

2 7

[PATCH v2 0/2] conf: add support for 'edid' attribute to video model
by Mark Cave-Ayland 12 Aug '25

12 Aug '25

This series adds support for a new 'edid' attribute to the video model to control whether the EDID is visible to the guest. If the 'edid' attribute is unspecified then it is not generated in the domain XML, so the underlying virtualisation platform will continue to use its default. The 'edid' attribute is only valid for the vga, boch and virtio display models and is currently only implemented for the QEMU driver. Signed-off-by: Mark Cave-Ayland <mark.caveayland(a)nutanix.com> v2 - Rebase onto master - Remove 2nd sentence from v1 patch 1 commit message - Remove unnecessary video->type check in qemu_command.c - Add patch 2 containing qemuxmlconftest test cases Mark Cave-Ayland (2): conf: add support for 'edid' attribute to video model tests/qemuxmlconfdata: add tests for video model 'edid' attribute docs/formatdomain.rst | 8 ++++ src/conf/domain_conf.c | 5 ++ src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 11 +++++ src/conf/schemas/domaincommon.rng | 5 ++ src/qemu/qemu_command.c | 3 ++ .../video-bochs-edid-none.x86_64-latest.args | 37 +++++++++++++++ .../video-bochs-edid-none.x86_64-latest.xml | 47 +++++++++++++++++++ .../qemuxmlconfdata/video-bochs-edid-none.xml | 36 ++++++++++++++ .../video-bochs-edid-off.x86_64-latest.args | 37 +++++++++++++++ .../video-bochs-edid-off.x86_64-latest.xml | 47 +++++++++++++++++++ .../qemuxmlconfdata/video-bochs-edid-off.xml | 36 ++++++++++++++ .../video-bochs-edid-on.x86_64-latest.args | 37 +++++++++++++++ .../video-bochs-edid-on.x86_64-latest.xml | 47 +++++++++++++++++++ tests/qemuxmlconfdata/video-bochs-edid-on.xml | 36 ++++++++++++++ .../video-qxl-edid-off-fail.x86_64-latest.err | 1 + .../video-qxl-edid-off-fail.xml | 29 ++++++++++++ .../video-qxl-edid-on-fail.x86_64-latest.err | 1 + .../video-qxl-edid-on-fail.xml | 29 ++++++++++++ .../video-vga-edid-none.x86_64-latest.args | 37 +++++++++++++++ .../video-vga-edid-none.x86_64-latest.xml | 47 +++++++++++++++++++ tests/qemuxmlconfdata/video-vga-edid-none.xml | 36 ++++++++++++++ .../video-vga-edid-off.x86_64-latest.args | 37 +++++++++++++++ .../video-vga-edid-off.x86_64-latest.xml | 47 +++++++++++++++++++ tests/qemuxmlconfdata/video-vga-edid-off.xml | 36 ++++++++++++++ .../video-vga-edid-on.x86_64-latest.args | 37 +++++++++++++++ .../video-vga-edid-on.x86_64-latest.xml | 47 +++++++++++++++++++ tests/qemuxmlconfdata/video-vga-edid-on.xml | 36 ++++++++++++++ .../video-virtio-edid-none.x86_64-latest.args | 37 +++++++++++++++ .../video-virtio-edid-none.x86_64-latest.xml | 47 +++++++++++++++++++ .../video-virtio-edid-none.xml | 36 ++++++++++++++ .../video-virtio-edid-off.x86_64-latest.args | 37 +++++++++++++++ .../video-virtio-edid-off.x86_64-latest.xml | 47 +++++++++++++++++++ .../qemuxmlconfdata/video-virtio-edid-off.xml | 36 ++++++++++++++ .../video-virtio-edid-on.x86_64-latest.args | 37 +++++++++++++++ .../video-virtio-edid-on.x86_64-latest.xml | 47 +++++++++++++++++++ .../qemuxmlconfdata/video-virtio-edid-on.xml | 36 ++++++++++++++ tests/qemuxmlconftest.c | 12 +++++ 38 files changed, 1185 insertions(+) create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-none.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-none.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-none.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-off.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-off.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-off.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-on.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-on.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-bochs-edid-on.xml create mode 100644 tests/qemuxmlconfdata/video-qxl-edid-off-fail.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/video-qxl-edid-off-fail.xml create mode 100644 tests/qemuxmlconfdata/video-qxl-edid-on-fail.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/video-qxl-edid-on-fail.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-none.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-vga-edid-none.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-none.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-off.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-vga-edid-off.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-off.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-on.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-vga-edid-on.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-vga-edid-on.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-none.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-none.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-none.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-off.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-off.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-off.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-on.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-on.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/video-virtio-edid-on.xml -- 2.43.0

2 6

[RFC] x86 Host CPU features detection by MSRs
by Hector Cao 12 Aug '25

12 Aug '25

Hello, This mail is a Request for Comment. On recent Intel CPUs, some of the CPU features (mostly vmx-* subfeatures) are listed and controlled via the MSRs (Model Specific Registers) instead of the traditional CPUID instruction method. Right now, libvirt reads the MSR's values via /dev/cpu/*/cpu populated by the msr kernel module. src/cpu/cpu_x86.c: ... /* This is best effort since there might be no way to read the MSR * when we are not running as root. */ for (i = 0; i < nmsrs; i++) { if (virHostCPUGetMSR(msrs[i], &msr) == 0) { virCPUx86DataItem item = { .type = VIR_CPU_X86_DATA_MSR, .data.msr = { ... There are 2 potential issues: 1) As stated in the source code comment above, MSR values read might fail when libvirt is not run as root. 2) MSR values read might fail if the MSR kernel module is not loaded, this is still the case in some of the Linux distros. The issue 2) has been brought up in Ubuntu/Debian : https://salsa.debian.org/libvirt-team/libvirt/-/merge_requests/271 but the feedback was to try to fix the issue in the libvirt source code itself. Indeed, libvirt already loads some kernel modules it depends on. For example the NBD kernel module in src/util/virtfile.c ... static bool virFileNBDLoadDriver(void) { if (virKModIsProhibited(NBD_DRIVER)) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Failed to load nbd module: administratively prohibited")); return false; } else { g_autofree char *errbuf = NULL; if ((errbuf = virKModLoad(NBD_DRIVER))) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Failed to load nbd module")); ... Andrea Bolognani's proposal of an approach that could work: 1. try using the unprivileged KVM API is available (or maybe the necessary information is exposed via QMP too?) like how QEMU does; 2. if that fails, try using the privileged /dev API; 3. if that fails too, load the msr module and try again; I would like to have some feedback from the libvirt community about if that is worth tackling these issues and the right way to do that. If we can end up with an agreement in this mail thread, I can work on the solution implementation and send it in a separate submission. Best regards, Hector

3 15

[PATCH v2 0/2] Remove libnl checks specific to Linux
by Akihiko Odaki 12 Aug '25

12 Aug '25

Supersedes: <20250308-require-v1-1-fe6850bf3f30(a)daynix.com> ("[PATCH] util: Require libnl for Linux") Based on previous discussions, this implements yet another approach to fix builds without libnl for Linux. Signed-off-by: Akihiko Odaki <odaki(a)rsg.ci.i.u-tokyo.ac.jp> --- Changes in v2: - Rebased. - Link to v1: https://lore.kernel.org/r/20250312-linux-v1-0-e5531bbe9708@daynix.com --- Akihiko Odaki (2): Remove libnl checks specific to Linux virnetlink: Remove stub functions src/libvirt_libnl.syms | 23 +++++ src/libvirt_private.syms | 19 ---- src/meson.build | 6 ++ src/remote/remote_daemon.c | 10 ++- src/util/meson.build | 5 +- src/util/virarptable.c | 2 +- src/util/virnetdev.c | 44 +-------- src/util/virnetdevbridge.c | 29 +----- src/util/virnetlink.c | 216 +++------------------------------------------ src/util/virnetlink.h | 11 +-- tests/virnetdevtest.c | 10 +-- 11 files changed, 64 insertions(+), 311 deletions(-) --- base-commit: 5085c7fd030ed4322608de1128811fc3bf61e201 change-id: 20250312-linux-30e6e1af51a5 Best regards, -- Akihiko Odaki <odaki(a)rsg.ci.i.u-tokyo.ac.jp>

1 2

[PATCH 0/2] qemu: Match firmware with fully resolved and canonicalized paths
by Michal Privoznik 12 Aug '25

12 Aug '25

As promised, this is a resend of previous patches: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/XVHI… Diff to v1: - new patch 1/2 which fixes the mocking. James Le Cuirot (1): qemu: Match firmware with fully resolved and canonicalized paths Michal Prívozník (1): qemuxml2argvmock: Pretend FW blobs are always present src/qemu/qemu_firmware.c | 11 ++++++----- tests/qemuxml2argvmock.c | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 5 deletions(-) -- 2.49.1

2 3

[PATCH] ci: regenerate with 'lcitool manifest'
by Daniel P. Berrangé 04 Aug '25

04 Aug '25

From: Daniel P. Berrangé <berrange(a)redhat.com> This pulls in the fix for libxen which has been removed from armv7 in Debian sid. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- Pending: https://gitlab.com/libvirt/libvirt-ci/-/merge_requests/537 ci/buildenv/debian-sid-cross-armv7l.sh | 1 - ci/containers/debian-sid-cross-armv7l.Dockerfile | 1 - 2 files changed, 2 deletions(-) diff --git a/ci/buildenv/debian-sid-cross-armv7l.sh b/ci/buildenv/debian-sid-cross-armv7l.sh index e014b3dd0f..3d662d73ed 100644 --- a/ci/buildenv/debian-sid-cross-armv7l.sh +++ b/ci/buildenv/debian-sid-cross-armv7l.sh @@ -77,7 +77,6 @@ function install_buildenv() { libssh2-1-dev:armhf \ libtirpc-dev:armhf \ libudev-dev:armhf \ - libxen-dev:armhf \ libxml2-dev:armhf \ systemtap-sdt-dev:armhf mkdir -p /usr/local/share/meson/cross diff --git a/ci/containers/debian-sid-cross-armv7l.Dockerfile b/ci/containers/debian-sid-cross-armv7l.Dockerfile index e6118a0d9b..5aaf29d22a 100644 --- a/ci/containers/debian-sid-cross-armv7l.Dockerfile +++ b/ci/containers/debian-sid-cross-armv7l.Dockerfile @@ -88,7 +88,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ libssh2-1-dev:armhf \ libtirpc-dev:armhf \ libudev-dev:armhf \ - libxen-dev:armhf \ libxml2-dev:armhf \ systemtap-sdt-dev:armhf && \ eatmydata apt-get autoremove -y && \ -- 2.50.1

2 1

[PATCH v2 0/2] Introduce hardware UUID (hwuuid) element
by Mark Cave-Ayland 04 Aug '25

04 Aug '25

Following on from the discussions at [1] and more recently [2], this series introduces a new hardware UUID (hwuuid) element that allows an external UUID to be provided to the guest, as opposed to the libvirt domain UUID. The use case for this feature is to allow a domain to cloned and then restarted without changing its guest-visible UUID e.g. via dmidecode. Patch 1 introduces the new hardware UUID (hwuuid) element along with an implementation for the QEMU driver, whilst patch 2 adds additional tests to ensure the hwuuid functionality is working as expected. Note that from reading the source it doesn't appear as if all virtualisation platforms will support this feature: I've included the relevant changes for the QEMU driver since that is what we use here at Nutanix. Signed-off-by: Mark Cave-Ayland <mark.caveayland(a)nutanix.com> [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/YXN2… [2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/HGFT… v2: - Rebase onto master - Rework if() logic in virSysinfoSystemParseXML() in patch 1 as suggested by Daniel - Add R-B tag from Daniel to patch 2 Mark Cave-Ayland (2): conf: introduce hardware UUID (hwuuid) element qemuxmlconftest: add tests for new hardware UUID (hwuuid) element docs/formatdomain.rst | 7 +++ src/conf/domain_conf.c | 43 ++++++++++++++++--- src/conf/domain_conf.h | 1 + src/conf/schemas/domaincommon.rng | 5 +++ src/qemu/qemu_command.c | 6 ++- ...hwuuid-smbios-uuid-match.x86_64-latest.err | 1 + .../hwuuid-smbios-uuid-match.xml | 36 ++++++++++++++++ .../qemuxmlconfdata/hwuuid.x86_64-latest.args | 35 +++++++++++++++ .../qemuxmlconfdata/hwuuid.x86_64-latest.xml | 41 ++++++++++++++++++ tests/qemuxmlconfdata/hwuuid.xml | 30 +++++++++++++ tests/qemuxmlconftest.c | 3 ++ 11 files changed, 202 insertions(+), 6 deletions(-) create mode 100644 tests/qemuxmlconfdata/hwuuid-smbios-uuid-match.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/hwuuid-smbios-uuid-match.xml create mode 100644 tests/qemuxmlconfdata/hwuuid.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/hwuuid.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/hwuuid.xml -- 2.43.0

2 5

Release of libvirt-11.6.0
by Jiri Denemark 01 Aug '25

01 Aug '25

The 11.6.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * New features * Introduce VIR_CONNECT_BASELINE_CPU_IGNORE_HOST flag This new flag for virConnectBaselineHypervisorCPU can be used for computing a baseline CPU on any host. Without the VIR_CONNECT_BASELINE_CPU_IGNORE_HOST flag the baseline API would return reasonable output only when run on one of the hosts that the input CPU definitions were collected from. * Allow control over QEMU TLS priority strings The qemu.conf file now has multiple settings allowing control over the QEMU TLS priority strings, for the different subsystems in QEMU that can support TLS. This can be used to workaround a current bug in GNUTLS that is liable to cause crashes of the source QEMU when performing long running live migration operations with TLS enabled. * Add support for disabling deprecated CPU model features by default for s390 domains Starting an s390 domain with host-model will now default to setting the ``deprecated_features`` attribute to ``off``, ensuring the domain starts with a migration-compatible CPU model to newer systems. This behavior can be modified by setting the ``default_cpu_deprecated_features`` option in the qemu.conf file. * bhyve: Add TCP console support TCP serial devices can now be configured with ``<serial type='tcp'>``:: <serial type='tcp'> <source mode='bind' host='127.0.0.1' service='12345'/> <target type='serial' port='0'/> </serial> Additionally, number of supported consoles increased to 4. * qemu: Add support for RBD namespaces Allow specifying the 'namespace' within a RBD image pool. * Improvements * qemu: Change default SCSI controller model to ``virtio-scsi`` for ARM and RISC-V The previous default of ``lsilogic`` is unsupported by modern operating systems. ``virtio-scsi`` is a more suitable default for ARM and RISC-V ``virt`` machine types. * Clarify documentation of virConnectBaselineHypervisorCPU The documentation makes it clear virConnectBaselineHypervisorCPU is supposed to be called on one of the hosts represented in the input CPU definitions. Otherwise the API will give unexpected results. * Allow specifying zero discard granularity for block devices This can be used to tell some guest operating systems (notably Windows) to not trim the disk. * bhyve: Add timeout handling for bhyveload It is now possible to run ``bhyveload`` with the ``timeout`` tool, which can send ``SIGTERM`` and ``SIGKILL`` signals when timeout is reached. Timeout values are set using the ``bhyveload_timeout`` and ``bhyveload_timeout_kill`` configuration options in ``bhyve.conf``. * nss: Improve debugging Debugging messages from NSS modules can be now enabled by setting the ``LIBVIRT_NSS_DEBUG`` environment variable. So far, there is no special meaning to its value. * rpc: Removed requirement for TLS certificates to support 'key encipherment' With TLS 1.3, key encipherment is not required even for RSA keys. Other key types didn't even support it so they were wrongly refused even in cases when they would work with libvirt. The TLS certificate validation now no longer requires 'key encipherment' to be enabled. * Bug fixes * bhyve: Fix resetting of the autostart flag of the domain on destroy. * The nwfilter driver no longer recreates the base iptable/ip6tables chains The nwfilter driver had a impl mistake causing it to recreate the base chains for iptables/ip6tables every time a VM was started. This allowed a small window where traffic might not be fully filtered. It now handles iptables/ip6tables the same way as ebtables, creating the base chains only if they did not already exist. * Fix systemd unit ordering for auto-shutdown of domains via the daemon The ordering of systemd units created by libvirt for individual machines needed to be adapted when the shutdown of VMs on host shutdown is done via the virt daemon itself (rather than ``libvirt-guests.service``) to ensure that the VMs are not terminated before the virt daemon can deal with them. Enjoy. Jirka

1 0