- Devel - libvirt List Archives

[libvirt PATCH 00/11] Introduce support to pass iommu FD to libvirt
by Pavel Hrdina 20 Mar '26

20 Mar '26

Pavel Hrdina (11): conf: Move and rename virStorageSourceFDTuple object conf: Refactor virHostdevIsPCIDevice hypervisor: Fix virHostdevNeedsVFIO detection qemu: Expand call to qemuDomainNeedsVFIO qemu: Update qemuDomainNeedsVFIO to ignore PCI hostdev with IOMMUFD src: Use virHostdevIsPCIDeviceWith* to check for IOMMUFD conf: Introduce domain iommufd element qemu: Implement iommufd conf: Add iommufd fdgroup support qemu: Implement iommufd fdgroup tests: Add iommufd fdgroup test docs/formatdomain.rst | 27 +++++ src/conf/domain_conf.c | 114 +++++++++++++++++- src/conf/domain_conf.h | 9 ++ src/conf/domain_validate.c | 16 +++ src/conf/meson.build | 1 + src/conf/schemas/domaincommon.rng | 15 +++ src/conf/storage_source_conf.c | 42 ------- src/conf/storage_source_conf.h | 24 +--- src/conf/virdomainfd.c | 52 ++++++++ src/conf/virdomainfd.h | 27 +++++ src/hypervisor/virhostdev.c | 2 +- src/libvirt_private.syms | 7 +- src/qemu/qemu_backup.c | 2 +- src/qemu/qemu_cgroup.c | 2 +- src/qemu/qemu_command.c | 6 +- src/qemu/qemu_domain.c | 21 +++- src/qemu/qemu_domain.h | 3 +- src/qemu/qemu_driver.c | 6 +- src/qemu/qemu_hotplug.c | 6 +- src/qemu/qemu_namespace.c | 2 +- src/qemu/qemu_process.c | 55 ++++++++- src/qemu/qemu_processpriv.h | 2 + src/qemu/qemu_validate.c | 2 +- src/security/security_apparmor.c | 2 +- src/security/security_dac.c | 4 +- src/security/security_selinux.c | 4 +- src/security/virt-aa-helper.c | 2 +- tests/genericxml2xmlindata/iommufd.xml | 18 +++ tests/genericxml2xmltest.c | 2 + .../iommufd-q35-fd.x86_64-latest.args | 41 +++++++ .../iommufd-q35-fd.x86_64-latest.xml | 60 +++++++++ tests/qemuxmlconfdata/iommufd-q35-fd.xml | 38 ++++++ tests/qemuxmlconftest.c | 9 +- tests/testutilsqemu.c | 2 +- 34 files changed, 522 insertions(+), 103 deletions(-) create mode 100644 src/conf/virdomainfd.c create mode 100644 src/conf/virdomainfd.h create mode 100644 tests/genericxml2xmlindata/iommufd.xml create mode 100644 tests/qemuxmlconfdata/iommufd-q35-fd.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-q35-fd.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-q35-fd.xml -- 2.53.0

2 23

Re: [PATCH RFC 02/12] migration/qapi: Rename MigrationStats to MigrationRAMStats
by Markus Armbruster 20 Mar '26

20 Mar '26

Cc: correct libvirt list address Peter Xu <peterx(a)redhat.com> writes: > This stats is only about RAM, so make it accurate. This paves way for > statistics for all devices. > > Note that even if this is part of qapi/, this should not be part of ABI of docs/devel/qapi-code-gen.rst section "Compatibility considerations": Since type names are not visible in the Client JSON Protocol, types may be freely renamed. Even certain refactorings are invisible, such as splitting members from one type into a common base type. So, s/should not be/is not/. > at least query-migrate, because the structure is not changed, and this > stats is always reported only under the "ram" section. Why "at least query-migrate"? Do you have other interfaces in mind, or are you just hedging? > Cc: Daniel P. Berrangé <berrange(a)redhat.com> > Cc: Markus Armbruster <armbru(a)redhat.com> > Cc: Libvirt Mailing List <libvir-list(a)redhat.com> > Signed-off-by: Peter Xu <peterx(a)redhat.com> > --- > docs/about/removed-features.rst | 2 +- > qapi/migration.json | 8 ++++---- > migration/migration-stats.h | 2 +- > 3 files changed, 6 insertions(+), 6 deletions(-) > > diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst > index 6f4447993c..7c4f4325f7 100644 > --- a/docs/about/removed-features.rst > +++ b/docs/about/removed-features.rst > @@ -699,7 +699,7 @@ was superseded by ``sections``. > ``query-migrate`` return value member ``skipped`` (removed in 9.1) > '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' > > -Member ``skipped`` of the ``MigrationStats`` struct hasn't been used > +Member ``skipped`` of the ``MigrationRAMStats`` struct hasn't been used > for more than 10 years. Removed with no replacement. Could simply use "of the return value". But this is fine, too. > > ``migrate`` command option ``inc`` (removed in 9.1) > diff --git a/qapi/migration.json b/qapi/migration.json > index 7134d4ce47..cfc6ccee26 100644 > --- a/qapi/migration.json > +++ b/qapi/migration.json > @@ -12,7 +12,7 @@ > { 'include': 'sockets.json' } > > ## > -# @MigrationStats: > +# @MigrationRAMStats: > # > # Detailed migration status. > # > @@ -64,7 +64,7 @@ > # > # Since: 0.14 > ## > -{ 'struct': 'MigrationStats', > +{ 'struct': 'MigrationRAMStats', > 'data': {'transferred': 'int', 'remaining': 'int', 'total': 'int' , > 'duplicate': 'int', > 'normal': 'int', > @@ -209,7 +209,7 @@ > # If this field is not returned, no migration process has been > # initiated > # > -# @ram: `MigrationStats` containing detailed migration status, only > +# @ram: `MigrationRAMStats` containing detailed migration status, only > # returned if status is 'active' or 'completed'(since 1.2) This gets rendered like * ram (MigrationStats, *optional*) -- MigrationStats containing detailed migration status, only returned if status is 'active' or 'completed'(since 1.2) Recommend to rephrase to avoid the repetition. Maybe # @ram: Detailed migration RAM status, only returned if status is # 'active' or 'completed' (since 1.2) Also consider replacing "status" by "statistics". > # > # @xbzrle-cache: `XBZRLECacheStats` containing detailed XBZRLE > @@ -309,7 +309,7 @@ > # Since: 0.14 > ## > { 'struct': 'MigrationInfo', > - 'data': {'*status': 'MigrationStatus', '*ram': 'MigrationStats', > + 'data': {'*status': 'MigrationStatus', '*ram': 'MigrationRAMStats', > '*vfio': 'VfioStats', > '*xbzrle-cache': 'XBZRLECacheStats', > '*total-time': 'int', > diff --git a/migration/migration-stats.h b/migration/migration-stats.h > index c0f50144c9..1153520f7a 100644 > --- a/migration/migration-stats.h > +++ b/migration/migration-stats.h > @@ -27,7 +27,7 @@ > > /* > * These are the ram migration statistic counters. It is loosely > - * based on MigrationStats. > + * based on MigrationRAMStats. > */ > typedef struct { > /* Only minor issues, and none added by this patch, so Acked-by: Markus Armbruster <armbru(a)redhat.com>

1 0

Re: [PATCH RFC 02/12] migration/qapi: Rename MigrationStats to MigrationRAMStats
by Peter Xu 20 Mar '26

20 Mar '26

On Thu, Mar 19, 2026 at 07:12:52PM -0400, Peter Xu wrote: > This stats is only about RAM, so make it accurate. This paves way for > statistics for all devices. > > Note that even if this is part of qapi/, this should not be part of ABI of > at least query-migrate, because the structure is not changed, and this > stats is always reported only under the "ram" section. > > Cc: Daniel P. Berrangé <berrange(a)redhat.com> > Cc: Markus Armbruster <armbru(a)redhat.com> > Cc: Libvirt Mailing List <libvir-list(a)redhat.com> I got the address wrong.. Will update when I repost. Copying the correct one. > Signed-off-by: Peter Xu <peterx(a)redhat.com> > --- > docs/about/removed-features.rst | 2 +- > qapi/migration.json | 8 ++++---- > migration/migration-stats.h | 2 +- > 3 files changed, 6 insertions(+), 6 deletions(-) > > diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst > index 6f4447993c..7c4f4325f7 100644 > --- a/docs/about/removed-features.rst > +++ b/docs/about/removed-features.rst > @@ -699,7 +699,7 @@ was superseded by ``sections``. > ``query-migrate`` return value member ``skipped`` (removed in 9.1) > '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' > > -Member ``skipped`` of the ``MigrationStats`` struct hasn't been used > +Member ``skipped`` of the ``MigrationRAMStats`` struct hasn't been used > for more than 10 years. Removed with no replacement. > > ``migrate`` command option ``inc`` (removed in 9.1) > diff --git a/qapi/migration.json b/qapi/migration.json > index 7134d4ce47..cfc6ccee26 100644 > --- a/qapi/migration.json > +++ b/qapi/migration.json > @@ -12,7 +12,7 @@ > { 'include': 'sockets.json' } > > ## > -# @MigrationStats: > +# @MigrationRAMStats: > # > # Detailed migration status. > # > @@ -64,7 +64,7 @@ > # > # Since: 0.14 > ## > -{ 'struct': 'MigrationStats', > +{ 'struct': 'MigrationRAMStats', > 'data': {'transferred': 'int', 'remaining': 'int', 'total': 'int' , > 'duplicate': 'int', > 'normal': 'int', > @@ -209,7 +209,7 @@ > # If this field is not returned, no migration process has been > # initiated > # > -# @ram: `MigrationStats` containing detailed migration status, only > +# @ram: `MigrationRAMStats` containing detailed migration status, only > # returned if status is 'active' or 'completed'(since 1.2) > # > # @xbzrle-cache: `XBZRLECacheStats` containing detailed XBZRLE > @@ -309,7 +309,7 @@ > # Since: 0.14 > ## > { 'struct': 'MigrationInfo', > - 'data': {'*status': 'MigrationStatus', '*ram': 'MigrationStats', > + 'data': {'*status': 'MigrationStatus', '*ram': 'MigrationRAMStats', > '*vfio': 'VfioStats', > '*xbzrle-cache': 'XBZRLECacheStats', > '*total-time': 'int', > diff --git a/migration/migration-stats.h b/migration/migration-stats.h > index c0f50144c9..1153520f7a 100644 > --- a/migration/migration-stats.h > +++ b/migration/migration-stats.h > @@ -27,7 +27,7 @@ > > /* > * These are the ram migration statistic counters. It is loosely > - * based on MigrationStats. > + * based on MigrationRAMStats. > */ > typedef struct { > /* > -- > 2.50.1 > -- Peter Xu

1 0

Re: [PATCH v3 07/11] ui/dbus: run without Audio interface when audio is disabled
by Markus Armbruster 19 Mar '26

19 Mar '26

Sergei Heifetz <heifetz(a)yandex-team.com> writes: > D-Bus display can be used even when QEMU is configured with > `--disable-audio`. In that case, audio interface will not be available > on `/org/qemu/Display1/Audio`. > > (The current handling of the situation when audio is enabled but > no D-Bus-compatible audio backend is available is different and > hasn’t been changed.) > > Signed-off-by: Sergei Heifetz <heifetz(a)yandex-team.com> > --- > qapi/ui.json | 2 +- > qemu-options.hx | 4 ++++ > ui/dbus.c | 8 ++++++++ > 3 files changed, 13 insertions(+), 1 deletion(-) > > diff --git a/qapi/ui.json b/qapi/ui.json > index e3da77632a8..62eb05c6091 100644 > --- a/qapi/ui.json > +++ b/qapi/ui.json > @@ -1385,7 +1385,7 @@ > 'data' : { '*rendernode' : 'str', > '*addr': 'str', > '*p2p': 'bool', > - '*audiodev': 'str' } } > + '*audiodev': { 'type': 'str', 'if': 'CONFIG_AUDIO' } } } Is this a compatibility break? DisplayDBus is only used in DisplayOptions, which is only used as return type of query-display-options in the QAPI schema. However, vl.c also uses it to parse -display. Removing parameter @audiodev from -display is technically a compatibility break. However, we're removing an optional paramater that would always be rejected when present: it has no valid value, because there are no audiodevs. Removal from query-display-options is similar: it could not be present. Removal affects introspection, which could conceivably confuse client. I don't expect such trouble here, because @audiodev always existed, i.e. there's no real reason to look for it in introspection. I think we're okay. I'm cc'ing the libvirt list just in case. Do we need a release note? Do we need an entry in docs/about/removed-features.rst? Feels a bit odd; we're not removing a feature, we're adding one, namely "can compile out audio". > > ## > # @DisplayGLMode: > diff --git a/qemu-options.hx b/qemu-options.hx > index 29dc865820a..20d15c0004f 100644 > --- a/qemu-options.hx > +++ b/qemu-options.hx > @@ -2232,6 +2232,10 @@ SRST > If no audio backend is specified and the dbus display backend is > specified, the dbus audio backend is used by default. > > + (If audio is disabled at compile time via the ``--disable-audio`` option, > + no audio backend is used, and none of the audio-related D-Bus interfaces > + are exported.) > + Well, audio is either compiled in or it isn't. If it's compiled in, then why tell the user how things behave when it's not? If it's not compiled in, then why document stuff that doesn't work? How much of -audiodev still works then? -audiodev none? Anything else? > The connection is registered with the "org.qemu" name (and queued when > already owned). > [...]

1 0

[PATCH] qemuMigrationSrcBeginPhase: Don't call 'qemuBlockNodesEnsureActive' with offline VM
by Peter Krempa 18 Mar '26

18 Mar '26

From: Peter Krempa <pkrempa(a)redhat.com> Commits 7b5566ce67b18a and f879d5f40385358 ( v11.8.0-92-gf879d5f403 ) moved around code for re-activating block backends after migration. While previously it was done when migration failed now we do it when we need qemu to do some block operations. Commit 7b5566ce67b18a introduced a bug where 'qemuBlockNodesEnsureActive' is called also when the VM is offline (for migration with 'VIR_MIGRATE_OFFLINE'). That doesn't work though as attempting to enter the monitor of an inactive VM returns failure. Address it by calling 'qemuBlockNodesEnsureActive' only on active VMs during migration. Fixes: 7b5566ce67b18a2bebe68fdb07e046f25185f8d3 Resolves: https://redhat.atlassian.net/browse/RHEL-156800 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_migration.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index fec808ccfb..3141018a78 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -2870,7 +2870,8 @@ qemuMigrationSrcBeginPhase(virQEMUDriver *driver, vm->newDef && !qemuDomainVcpuHotplugIsInOrder(vm->newDef))) cookieFlags |= QEMU_MIGRATION_COOKIE_CPU_HOTPLUG; - if (qemuBlockNodesEnsureActive(vm, vm->job->asyncJob) < 0) + if (virDomainObjIsActive(vm) && + qemuBlockNodesEnsureActive(vm, vm->job->asyncJob) < 0) return NULL; return qemuMigrationSrcBeginXML(vm, xmlin, -- 2.53.0

2 1

Plans for 12.2.0 release (freeze on 2026-03-26)
by Jiri Denemark 18 Mar '26

18 Mar '26

We are getting close to 12.2.0 release of libvirt. To aim for the release on Wednesday 01 Apr I suggest entering the freeze on Thursday 26 Mar and tagging RC2 on Monday 30 Mar. I hope this works for everyone. Jirka

1 0

[PATCH] virt-aa-helper : grant access to unix socket for qgsd
by Hector Cao 18 Mar '26

18 Mar '26

For quote generation and remote attestation, Intel TDX VM communicates with the QGSD (Quote Generation Service) on the host via unix socket. The unix socket can be specified via: <launchSecurity type='tdx'> ... <quoteGenerationService path='/var/run/tdx-qgs/qgs.socket'/> </launchSecurity> in case the path field is omitted, a default path is used. This commit generates the needed rule in the dynamic AA profile for the VM. Signed-off-by: Hector Cao <hector.cao(a)canonical.com> --- src/security/virt-aa-helper.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index e932e79dab..53059ad5fa 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1397,6 +1397,19 @@ get_files(vahControl * ctl) break; case VIR_DOMAIN_LAUNCH_SECURITY_PV: case VIR_DOMAIN_LAUNCH_SECURITY_TDX: + /* To communicate with the QGSD daemon running on the host, if we use the unix socket, + * allow the VM to access to the unix socket. + */ + if (ctl->def->sec->data.tdx.haveQGS) { + const char *qgsd_sock_file = QGS_UNIX_SOCKET_FILE; + if (ctl->def->sec->data.tdx.qgs_unix_path) { + qgsd_sock_file = ctl->def->sec->data.tdx.qgs_unix_path; + } + if (vah_add_file(&buf, qgsd_sock_file, "rw") != 0) { + return -1; + } + } + break; case VIR_DOMAIN_LAUNCH_SECURITY_NONE: case VIR_DOMAIN_LAUNCH_SECURITY_LAST: break; -- 2.43.0

3 3

[PATCH v3 0/1] virt-aa-helper : grant access to unix socket for qgsd
by Hector Cao 18 Mar '26

18 Mar '26

Thanks Daniel for the review, I fixed the indent in the previous mail but realized afterwards that I need to add an other improvement to the patch, even though functionally, the previous patch works. The change is about moving the VIR_DOMAIN_LAUNCH_SECURITY_PV case after VIR_DOMAIN_LAUNCH_SECURITY_TDX block. Hector Cao (1): virt-aa-helper : grant access to unix socket for qgsd src/security/virt-aa-helper.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) -- 2.43.0

1 1

[PATCH 0/5] qemuhotplug: Introduce interface-network-hostdev
by Michal Privoznik 17 Mar '26

17 Mar '26

*** BLURB HERE *** Michal Prívozník (5): tests: Drop WITH_QEMU from qemu specific tests binaries/libraries qemuxmlconftest: Separate fake drivers into a separate file virnetworkportxml2xmldata: Use different PCI address in plug-hostdev-pci.xml qemuhotplugtest: Use fake drivers qemuhotplug: Introduce interface-network-hostdev tests/meson.build | 5 +- tests/qemudomaincheckpointxml2xmltest.c | 31 +- tests/qemudomainsnapshotxml2xmltest.c | 29 +- tests/qemufakedrivers.c | 368 +++++++++++++++ tests/qemufakedrivers.h | 19 + tests/qemuhotplugtest.c | 20 + .../qemuhotplug-interface-network-hostdev.xml | 4 + ...ug-base-live+interface-network-hostdev.xml | 63 +++ tests/qemumemlocktest.c | 25 +- ...-virtio-teaming-network.x86_64-latest.args | 2 +- tests/qemuxmlconftest.c | 443 +++--------------- tests/testutilsqemu.c | 43 +- tests/testutilsqemu.h | 23 +- .../plug-hostdev-pci.xml | 2 +- 14 files changed, 588 insertions(+), 489 deletions(-) create mode 100644 tests/qemufakedrivers.c create mode 100644 tests/qemufakedrivers.h create mode 100644 tests/qemuhotplugtestdevices/qemuhotplug-interface-network-hostdev.xml create mode 100644 tests/qemuhotplugtestdomains/qemuhotplug-base-live+interface-network-hostdev.xml -- 2.52.0

2 7

[PATCH] network: Don't enable ip_forward for VIR_NETWORK_FORWARD_OPEN
by Michal Privoznik 17 Mar '26

17 Mar '26

From: Michal Privoznik <mprivozn(a)redhat.com> For a network that's <forward mode="open"/> there are no firewall rules added. We should not assume that users will configure NAT, and if they do it should be their responsibility to enable IP forwarding too. Resolves: https://gitlab.com/libvirt/libvirt/-/work_items/863 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/network/bridge_driver.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index d50d42c98c..ecfce5d9a4 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -2080,8 +2080,9 @@ networkStartNetworkVirtual(virNetworkDriverState *driver, } } - /* If forward.type != NONE, turn on global IP forwarding */ - if (def->forward.type != VIR_NETWORK_FORWARD_NONE) { + /* If forward.type != NONE and != OPEN, turn on global IP forwarding */ + if (def->forward.type != VIR_NETWORK_FORWARD_NONE && + def->forward.type != VIR_NETWORK_FORWARD_OPEN) { if (v6present && !virNetDevIPCheckIPv6Forwarding()) goto error; /* Precise error message already provided */ -- 2.52.0

2 1