- Devel - libvirt List Archives

[PATCH] rpm: change from fuse-devel to fuse3-devel
by Daniel P. Berrangé 03 Nov '25

03 Nov '25

From: Daniel P. Berrangé <berrange(a)redhat.com> The meson.build already supports both fuse2 and fuse3, and fuse3 is in all Fedora versions we need, so switch to the newer version unconditionally. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index aff2707705..5fd5f6cd94 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -404,7 +404,7 @@ BuildRequires: numactl-devel %endif BuildRequires: libcap-ng-devel >= 0.5.0 %if %{with_fuse} -BuildRequires: fuse-devel >= 2.8.6 +BuildRequires: fuse3-devel %endif %if %{with_libssh2} BuildRequires: libssh2-devel >= 1.3.0 -- 2.51.1

2 1

[PULL 00/32] Next pr patches
by Daniel P. Berrangé 03 Nov '25

03 Nov '25

The following changes since commit 53b41bb78950912ba2d9809eef6b45e4df30c647: Merge tag 'pull-target-arm-20251031' of https://gitlab.com/pm215/qemu into staging (2025-11-01 10:52:48 +0100) are available in the Git repository at: https://gitlab.com/berrange/qemu tags/next-pr-pull-request for you to fetch changes up to 2aaca8c6d22b18786ceff51189704113d0639590: docs: creation of x509 certs compliant with post-quantum crypto (2025-11-03 10:45:55 +0000) ---------------------------------------------------------------- Merge crypto and other misc fixes / features * Increase minimum gnutls to 3.7.5 * Increase minimum libgcrypt to 1.9.4 * Increase minimum nettle to 3.7.3 * Drop obsolete in-tree XTS impl * Fix memory leak when loading certificates * Remove/reduce duplication when loading certifcates * Fix possible crash when certificates are unloaded while an active TLS connection is using when in a TLS handshake operation * Deprecate use of dh-params.pem file * Document how to create certificates with Post-Quantum Cryptography compliant algorithms. * Support loading multiple certificate identities to allow support for Post-Quantum crypto in parallel with traditional RSA/ECC * Add "-run-with exit-with-parent=on" parameter * Flush pending errors when seeing ENOBUFS with a zero-copy send attempt * Fix data buffer parameters in hash & IO channel APIs to use 'void *' ---------------------------------------------------------------- Daniel P. Berrangé (26): crypto: bump min gnutls to 3.7.5 crypto: unconditionally enable gnutls XTS support crypto: bump min libgcrypt to 1.9.4 crypto: bump min nettle to 3.7.3 crypto: drop in-tree XTS cipher mode impl crypto: remove redundant parameter checking CA certs crypto: add missing free of certs array crypto: replace stat() with access() for credential checks crypto: remove redundant access() checks before loading certs crypto: move check for TLS creds 'dir' property crypto: use g_autofree when loading x509 credentials crypto: remove needless indirection via parent_obj field crypto: move release of DH parameters into TLS creds parent crypto: shorten the endpoint == server check in TLS creds crypto: remove duplication loading x509 CA cert crypto: reduce duplication in handling TLS priority strings crypto: introduce method for reloading TLS creds crypto: introduce a wrapper around gnutls credentials crypto: fix lifecycle handling of gnutls credentials objects crypto: make TLS credentials structs private crypto: deprecate use of external dh-params.pem file crypto: avoid loading the CA certs twice crypto: avoid loading the identity certs twice crypto: expand logic to cope with multiple certificate identities crypto: support upto 5 parallel certificate identities docs: creation of x509 certs compliant with post-quantum crypto Manish Mishra (1): io: flush zerocopy socket error queue on sendmsg failure due to ENOBUF Philippe Mathieu-Daudé (2): crypto/hash: Have hashing functions take void * buffer argument io/channel: Have read/write functions take void * buffer argument Richard W.M. Jones (2): Implement -run-with exit-with-parent=on tests/qtest: Use exit-with-parent=on in qtest invocations Tejus GK (1): io: add a "blocking" field to QIOChannelSocket crypto/cipher-gnutls.c.inc | 8 - crypto/cipher-nettle.c.inc | 44 -- crypto/cipher.c | 2 +- crypto/hash.c | 16 +- crypto/hmac.c | 8 +- crypto/meson.build | 10 +- crypto/tlscreds.c | 79 ++-- crypto/tlscredsanon.c | 64 +-- crypto/tlscredsbox.c | 101 +++++ crypto/tlscredsbox.h | 50 +++ crypto/tlscredspriv.h | 36 +- crypto/tlscredspsk.c | 64 ++- crypto/tlscredsx509.c | 593 +++++++++++++++++--------- crypto/tlssession.c | 139 ++---- crypto/trace-events | 1 + crypto/xts.c | 250 ----------- docs/about/deprecated.rst | 9 + docs/system/tls.rst | 134 +++++- include/crypto/hash.h | 8 +- include/crypto/hmac.h | 4 +- include/crypto/tlscreds.h | 26 ++ include/crypto/tlscredsx509.h | 6 + include/crypto/tlssession.h | 4 +- include/crypto/xts.h | 82 ---- include/io/channel-socket.h | 6 + include/io/channel.h | 14 +- include/qemu/exit-with-parent.h | 57 +++ io/channel-socket.c | 86 +++- io/channel-tls.c | 4 +- io/channel.c | 14 +- meson.build | 69 +-- qemu-options.hx | 13 +- system/exit-with-parent.c | 140 ++++++ system/meson.build | 1 + system/vl.c | 13 + tests/qtest/libqtest.c | 22 +- tests/unit/meson.build | 3 - tests/unit/test-crypto-block.c | 3 +- tests/unit/test-crypto-tlscredsx509.c | 8 +- tests/unit/test-crypto-tlssession.c | 4 +- tests/unit/test-crypto-xts.c | 529 ----------------------- ui/vnc.c | 9 +- 42 files changed, 1208 insertions(+), 1525 deletions(-) create mode 100644 crypto/tlscredsbox.c create mode 100644 crypto/tlscredsbox.h delete mode 100644 crypto/xts.c delete mode 100644 include/crypto/xts.h create mode 100644 include/qemu/exit-with-parent.h create mode 100644 system/exit-with-parent.c delete mode 100644 tests/unit/test-crypto-xts.c -- 2.51.1

1 32

Release of libvirt-11.9.0
by Jiri Denemark 03 Nov '25

03 Nov '25

The 11.9.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * New features * Introduce Hyper-V ``host-model`` mode Similarly to CPUs, ``host-model`` mode expands available Hyper-V enlightenments at domain startup into the live XML so that's obvious which enlightenments are enabled. * Add support for Hyper-V ``spinlocks`` "never notify" mechanism The ``retries`` attribute - which defines after how many failed acquisition attempts to notify the hypervisor - can now hold the special value of 4294967295 which means to never notify the hypervisor. If the ``retries`` attribute is omitted this value is used. * ch: Network hotplug Support Users can now attach and detach network interfaces of Cloud Hypervisor domains at runtime. * bhyve: NVMe device support Domain XMLs now can use NVMe devices:: <disk type='file'> <driver name='file' type='raw'/> <source file='/path/to/disk.img'/> <target dev='nvme0n1' bus='nvme'/> </disk> * Improvements * qemu: Improvements to USB controller model selection Virtualization-friendly USB3 controllers are now used in more situations, Intel-specific USB controllers are relegated to x86 guests, and model selection overall behaves more consistently across architectures. * qemu: Validate Hyper-V enlightenment dependencies Some Hyper-V enlightenments may require some other enlightenments to be turned on. Libvirt now validates these for new domains. * qemu: Introduce virtio options for virtio memory models Both virtio-mem and virtio-pmem memory models are virtio devices and as such now support setting various virtio knobs (iommu, ats, packed, page_per_vq) common to other virtio devices. * wireshark: Adapt to wireshark-4.6.0 Libvirt's wireshark dissector plugin adapted to changes made to wireshark dissector API in its 4.6.0 release. * qemu: 'manual' disk snapshot mode improvements The 'manual' snapshot mode now ensures that also metadata of the images is written out to disk so that user can take snapshots of e.g. qcow2 image safely. * Bug fixes * ch: Load ``ch.conf`` from ``SYSCONFDIR`` Previously, the ``ch.conf`` file for ``ch:///system`` URI was mistakenly loaded from a path under ``LOCALSTATEDIR`` (``/var/...``). This is now fixed and the configuration file is loaded from the ``SYSCONFDIR`` (``/etc/...``) location where it's also installed. Enjoy. Jirka

1 0

[PATCH 00/21] crypto: support multiple parallel certificate identities
by Daniel P. Berrangé 02 Nov '25

02 Nov '25

This series aims to improve the support for post-quantum cryptography in TLS connections by allowing multiple sets of certificates to be loaded. The idea is that during a transition period servers will have a traditional RSA based certificate in parallel with an MLDSA based certificate for PQC, and the right one will be dynamically determined during the TLS handshake. The first 12 patches are trivial cleanups. The next 3 patches fix a potential use-after-free problem The last patches introduce support for multiple certificates. NB, in terms of testing this will require either CentOS Stream 10, or Fedora 43. Most other distros will not support PQC out of the box at this time even if they have new enough gnutls, since they don't make use of the crypto-policies package which is needed to enable PQC by default. Daniel P. Berrangé (21): crypto: remove redundant parameter checking CA certs crypto: add missing free of certs array crypto: replace stat() with access() for credential checks crypto: remove redundant access() checks before loading certs crypto: move check for TLS creds 'dir' property crypto: use g_autofree when loading x509 credentials crypto: remove needless indirection via parent_obj field crypto: move release of DH parameters into TLS creds parent crypto: shorten the endpoint == server check in TLS creds crypto: remove duplication loading x509 CA cert crypto: reduce duplication in handling TLS priority strings crypto: introduce method for reloading TLS creds crypto: introduce a wrapper around gnutls credentials crypto: fix lifecycle handling of gnutls credentials objects crypto: make TLS credentials structs private crypto: deprecate use of external dh-params.pem file crypto: avoid loading the CA certs twice crypto: avoid loading the identity certs twice crypto: expand logic to cope with multiple certificate identities crypto: support upto 5 parallel certificate identities docs: creation of x509 certs compliant with post-quantum crypto crypto/meson.build | 5 +- crypto/tlscreds.c | 77 ++-- crypto/tlscredsanon.c | 62 +-- crypto/tlscredsbox.c | 101 +++++ crypto/tlscredsbox.h | 46 ++ crypto/tlscredspriv.h | 36 +- crypto/tlscredspsk.c | 64 ++- crypto/tlscredsx509.c | 592 +++++++++++++++++--------- crypto/tlssession.c | 139 ++---- crypto/trace-events | 1 + docs/about/deprecated.rst | 9 + docs/system/tls.rst | 134 +++++- include/crypto/tlscreds.h | 26 ++ include/crypto/tlscredsx509.h | 6 + tests/unit/test-crypto-tlscredsx509.c | 8 +- ui/vnc.c | 9 +- 16 files changed, 849 insertions(+), 466 deletions(-) create mode 100644 crypto/tlscredsbox.c create mode 100644 crypto/tlscredsbox.h -- 2.51.1

3 43

[PATCH] bhyve: process: improve domain startup error handling
by Roman Bogorodskiy 01 Nov '25

01 Nov '25

After executing the bhyve binary, it might happen that it fails very early due to configuration issues (missing/inaccessible files, incorrect custom args), bugs, etc. In this case it'll look like the domain has started normally, but quickly turned off. Improve that by waiting for the domain's vmm entity to appear in /dev/vmm. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- Ideally, I'd also like to display the errors that the bhyve binary logs in this case. But as I'm doing: virCommandSetErrorFD(cmd, &logfd); I'm not sure if I should read that again from logfd, or are there more optimal ways to do that? src/bhyve/bhyve_process.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/src/bhyve/bhyve_process.c b/src/bhyve/bhyve_process.c index 4fb7e642e1..591c2d1ded 100644 --- a/src/bhyve/bhyve_process.c +++ b/src/bhyve/bhyve_process.c @@ -143,7 +143,12 @@ virBhyveProcessStartImpl(struct _bhyveConn *driver, g_autoptr(virCommand) cmd = NULL; g_autoptr(virCommand) load_cmd = NULL; bhyveDomainObjPrivate *priv = vm->privateData; + g_auto(virBuffer) domain_vmm_path_buf = VIR_BUFFER_INITIALIZER; + g_autofree char *domain_vmm_path = NULL; int ret = -1, rc; + size_t i = 0; + int timeout = 3; + bool vmm_appeared = false; logfile = g_strdup_printf("%s/%s.log", BHYVE_LOG_DIR, vm->def->name); if ((logfd = open(logfile, O_WRONLY | O_APPEND | O_CREAT, @@ -228,6 +233,25 @@ virBhyveProcessStartImpl(struct _bhyveConn *driver, goto cleanup; } + virBufferAsprintf(&domain_vmm_path_buf, "/dev/vmm/%s", vm->def->name); + domain_vmm_path = virBufferContentAndReset(&domain_vmm_path_buf); + + do { + if (virFileExists(domain_vmm_path)) { + vmm_appeared = true; + break; + } + + g_usleep(500000); + } while (!vmm_appeared && ++i < timeout); + + if (!vmm_appeared) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Domain %1$s didn't show up in /dev/vmm"), + vm->def->name); + goto cleanup; + } + vm->def->id = vm->pid; virDomainObjSetState(vm, VIR_DOMAIN_RUNNING, reason); priv->mon = bhyveMonitorOpen(vm, driver); -- 2.51.0

2 2

[PATCH 00/21] crypto: support multiple parallel certificate identities
by Daniel P. Berrangé 31 Oct '25

31 Oct '25

This series aims to improve the support for post-quantum cryptography in TLS connections by allowing multiple sets of certificates to be loaded. The idea is that during a transition period servers will have a traditional RSA based certificate in parallel with an MLDSA based certificate for PQC, and the right one will be dynamically determined during the TLS handshake. The first 12 patches are trivial cleanups. The next 3 patches fix a potential use-after-free problem The last patches introduce support for multiple certificates. NB, in terms of testing this will require either CentOS Stream 10, or Fedora 43. Most other distros will not support PQC out of the box at this time even if they have new enough gnutls, since they don't make use of the crypto-policies package which is needed to enable PQC by default. Daniel P. Berrangé (21): crypto: remove redundant parameter checking CA certs crypto: add missing free of certs array crypto: replace stat() with access() for credential checks crypto: remove redundant access() checks before loading certs crypto: move check for TLS creds 'dir' property crypto: use g_autofree when loading x509 credentials crypto: remove needless indirection via parent_obj field crypto: move release of DH parameters into TLS creds parent crypto: shorten the endpoint == server check in TLS creds crypto: remove duplication loading x509 CA cert crypto: reduce duplication in handling TLS priority strings crypto: introduce method for reloading TLS creds crypto: introduce a wrapper around gnutls credentials crypto: fix lifecycle handling of gnutls credentials objects crypto: make TLS credentials structs private crypto: deprecate use of external dh-params.pem file crypto: avoid loading the CA certs twice crypto: avoid loading the identity certs twice crypto: expand logic to cope with multiple certificate identities crypto: support upto 5 parallel certificate identities docs: creation of x509 certs compliant with post-quantum crypto crypto/meson.build | 5 +- crypto/tlscreds.c | 77 ++-- crypto/tlscredsanon.c | 62 +-- crypto/tlscredsbox.c | 101 +++++ crypto/tlscredsbox.h | 46 ++ crypto/tlscredspriv.h | 36 +- crypto/tlscredspsk.c | 64 ++- crypto/tlscredsx509.c | 592 +++++++++++++++++--------- crypto/tlssession.c | 139 ++---- crypto/trace-events | 1 + docs/about/deprecated.rst | 9 + docs/system/tls.rst | 134 +++++- include/crypto/tlscreds.h | 26 ++ include/crypto/tlscredsx509.h | 6 + tests/unit/test-crypto-tlscredsx509.c | 8 +- ui/vnc.c | 9 +- 16 files changed, 849 insertions(+), 466 deletions(-) create mode 100644 crypto/tlscredsbox.c create mode 100644 crypto/tlscredsbox.h -- 2.51.1

2 14

[PATCH v4 1/3] qemu: support riscv-aia feature for RISC-V KVM
by BillXiang 31 Oct '25

31 Oct '25

From: xiangwencheng <xiangwencheng(a)lanxincomputing.com> riscv-aia feature was introduced in qemu-8.2 to specify the KVM AIA mode. The "riscv-aia" parameter is passed along with -accel in QEMU command-line. 1) "riscv-aia=emul": IMSIC is emulated by hypervisor 2) "riscv-aia=hwaccel": use hardware guest IMSIC 3) "riscv-aia=auto": use the hardware guest IMSICs whenever available otherwise we fallback to software emulation. This patch add the corresponding feature named 'riscv-aia'. Signed-off-by: BillXiang <xiangwencheng(a)lanxincomputing.com> --- v3[1] -> v4: - Add XML tests. - Fix broken indentations. - Remove optional mark of 'mode' in XML schema. [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/CGZI… --- docs/formatdomain.rst | 7 +++++++ src/conf/domain_conf.c | 28 +++++++++++++++++++++++++++- src/conf/domain_conf.h | 11 +++++++++++ src/conf/schemas/domaincommon.rng | 10 ++++++++++ src/libvirt_private.syms | 2 ++ src/qemu/qemu_command.c | 13 ++++++++++--- 6 files changed, 67 insertions(+), 4 deletions(-) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index f50dce477f..3ac8c315db 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -2085,6 +2085,7 @@ Hypervisors may allow certain CPU / machine features to be toggled on/off. <poll-control state='on'/> <pv-ipi state='off'/> <dirty-ring state='on' size='4096'/> + <riscv-aia state='on' mode='auto'/> </kvm> <xen> <e820_host state='on'/> @@ -2206,6 +2207,12 @@ are: poll-control Decrease IO completion latency by introducing a grace period of busy waiting on, off :since:`6.10.0 (QEMU 4.2)` pv-ipi Paravirtualized send IPIs on, off :since:`7.10.0 (QEMU 3.1)` dirty-ring Enable dirty ring feature on, off; size - must be power of 2, range [1024,65536] :since:`8.0.0 (QEMU 6.1)` + riscv-aia Set riscv KVM AIA mode. Defaults to 'auto'. on, off; mode - must be emul, hwaccel or auto :since:`11.8.0 (QEMU 8.2)` + The "riscv-aia" parameter is passed along with --accel in QEMU command-line. + 1) "riscv-aia=emul": IMSIC is emulated by hypervisor + 2) "riscv-aia=hwaccel": use hardware guest IMSIC + 3) "riscv-aia=auto": use the hardware guest IMSICs whenever available + otherwise we fallback to software emulation. ============== ============================================================================ ====================================================== ============================ ``xen`` diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 281846dfbe..bd52429881 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -224,6 +224,14 @@ VIR_ENUM_IMPL(virDomainKVM, "poll-control", "pv-ipi", "dirty-ring", + "riscv-aia", +); + +VIR_ENUM_IMPL(virDomainKVMRiscvAIAMode, + VIR_DOMAIN_KVM_RISCV_AIA_MODE_LAST, + "auto", + "emul", + "hwaccel", ); VIR_ENUM_IMPL(virDomainXen, @@ -17213,6 +17221,15 @@ virDomainFeaturesKVMDefParse(virDomainDef *def, return -1; } } + + if (feature == VIR_DOMAIN_KVM_RISCV_AIA && + value == VIR_TRISTATE_SWITCH_ON) { + if (virXMLPropEnum(feat, "mode", + virDomainKVMRiscvAIAModeTypeFromString, + VIR_XML_PROP_REQUIRED, + &def->kvm_features->kvm_riscv_aia_mode) < 0) + return -1; + } } def->features[VIR_DOMAIN_FEATURE_KVM] = VIR_TRISTATE_SWITCH_ON; @@ -21729,6 +21746,7 @@ virDomainDefFeaturesCheckABIStability(virDomainDef *src, case VIR_DOMAIN_KVM_POLLCONTROL: case VIR_DOMAIN_KVM_PVIPI: case VIR_DOMAIN_KVM_DIRTY_RING: + case VIR_DOMAIN_KVM_RISCV_AIA: if (src->kvm_features->features[i] != dst->kvm_features->features[i]) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("State of KVM feature '%1$s' differs: source: '%2$s', destination: '%3$s'"), @@ -28786,7 +28804,15 @@ virDomainDefFormatFeatures(virBuffer *buf, } } break; - + case VIR_DOMAIN_KVM_RISCV_AIA: + if (def->kvm_features->features[j] != VIR_TRISTATE_SWITCH_ABSENT) { + virBufferAsprintf(&childBuf, "<%s state='%s'", + virDomainKVMTypeToString(j), + virTristateSwitchTypeToString(def->kvm_features->features[j])); + virBufferAsprintf(&childBuf, " mode='%s'/>\n", + virDomainKVMRiscvAIAModeTypeToString(def->kvm_features->kvm_riscv_aia_mode)); + } + break; case VIR_DOMAIN_KVM_LAST: break; } diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 39807b5fe3..457dcce039 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -2272,10 +2272,20 @@ typedef enum { VIR_DOMAIN_KVM_POLLCONTROL, VIR_DOMAIN_KVM_PVIPI, VIR_DOMAIN_KVM_DIRTY_RING, + VIR_DOMAIN_KVM_RISCV_AIA, VIR_DOMAIN_KVM_LAST } virDomainKVM; +typedef enum { + VIR_DOMAIN_KVM_RISCV_AIA_MODE_AUTO = 0, + VIR_DOMAIN_KVM_RISCV_AIA_MODE_EMUL, + VIR_DOMAIN_KVM_RISCV_AIA_MODE_HWACCEL, + + VIR_DOMAIN_KVM_RISCV_AIA_MODE_LAST +} virDomainKVMRiscvAIAMode; +VIR_ENUM_DECL(virDomainKVMRiscvAIAMode); + typedef enum { VIR_DOMAIN_MSRS_UNKNOWN = 0, @@ -2478,6 +2488,7 @@ struct _virDomainFeatureKVM { int features[VIR_DOMAIN_KVM_LAST]; unsigned int dirty_ring_size; /* size of dirty ring for each vCPU, no units */ + virDomainKVMRiscvAIAMode kvm_riscv_aia_mode; }; typedef struct _virDomainFeatureTCG virDomainFeatureTCG; diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng index b9230a35b4..888477acc9 100644 --- a/src/conf/schemas/domaincommon.rng +++ b/src/conf/schemas/domaincommon.rng @@ -8207,6 +8207,16 @@ </optional> </element> </optional> + <optional> + <element name="riscv-aia"> + <ref name="featurestate"/> + <attribute name="mode"> + <data type="string"> + <param name="pattern">(auto|emul|hwaccel)</param> + </data> + </attribute> + </element> + </optional> </interleave> </element> </define> diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index fe72402527..dfa54c2d68 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -501,6 +501,8 @@ virDomainIOThreadIDDel; virDomainIOThreadIDFind; virDomainKeyWrapCipherNameTypeFromString; virDomainKeyWrapCipherNameTypeToString; +virDomainKVMRiscvAIAModeTypeFromString; +virDomainKVMRiscvAIAModeTypeToString; virDomainLaunchSecurityTypeFromString; virDomainLaunchSecurityTypeToString; virDomainLeaseDefFree; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 031f09b7a5..ff07c1d95f 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -6720,6 +6720,9 @@ qemuBuildCpuCommandLine(virCommand *cmd, case VIR_DOMAIN_KVM_DIRTY_RING: break; + + case VIR_DOMAIN_KVM_RISCV_AIA: + break; case VIR_DOMAIN_KVM_LAST: break; @@ -7355,9 +7358,13 @@ qemuBuildAccelCommandLine(virCommand *cmd, * not that either kvm or tcg can be specified by libvirt * so do not worry about the conflict of specifying both * */ - if (def->features[VIR_DOMAIN_FEATURE_KVM] == VIR_TRISTATE_SWITCH_ON && - def->kvm_features->features[VIR_DOMAIN_KVM_DIRTY_RING] == VIR_TRISTATE_SWITCH_ON) { - virBufferAsprintf(&buf, ",dirty-ring-size=%d", def->kvm_features->dirty_ring_size); + if (def->features[VIR_DOMAIN_FEATURE_KVM] == VIR_TRISTATE_SWITCH_ON) { + if (def->kvm_features->features[VIR_DOMAIN_KVM_DIRTY_RING] == VIR_TRISTATE_SWITCH_ON) { + virBufferAsprintf(&buf, ",dirty-ring-size=%d", def->kvm_features->dirty_ring_size); + } + if (def->kvm_features->features[VIR_DOMAIN_KVM_RISCV_AIA] == VIR_TRISTATE_SWITCH_ON) { + virBufferAsprintf(&buf, ",riscv-aia=%s", virDomainKVMRiscvAIAModeTypeToString(def->kvm_features->kvm_riscv_aia_mode)); + } } break; -- 2.34.1

4 7

[PATCH] NEWS: mention 'manual' snapshot mode improvement
by Peter Krempa 31 Oct '25

31 Oct '25

From: Peter Krempa <pkrempa(a)redhat.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- NEWS.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 38443f913a..e65376ef09 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -66,6 +66,12 @@ v11.9.0 (unreleased) such now support setting various virtio knobs (iommu, ats, packed, page_per_vq) common to other virtio devices. + * qemu: 'manual' disk snapshot mode improvements + + The 'manual' snapshot mode now ensures that also metadata of the images is + written out to disk so that user can take snapshots of e.g. qcow2 image + safely. + * **Bug fixes** -- 2.51.0

2 1

Entering freeze for libvirt-11.9.0
by Jiri Denemark 31 Oct '25

31 Oct '25

I have just tagged v11.9.0-rc1 in the repository and pushed signed tarballs to https://download.libvirt.org/ Please give the release candidate some testing and in case you find a serious issue which should have a fix in the upcoming release, feel free to reply to this thread to make sure the issue is more visible. If you have not done so yet, please update NEWS.rst to document any significant change you made since the last release. Jirka

1 1

[PATCH 1/2] NEWS: document bhyve changes for 11.9.0
by Roman Bogorodskiy 31 Oct '25

31 Oct '25

Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- NEWS.rst | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index ee11435e0e..38443f913a 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -37,6 +37,16 @@ v11.9.0 (unreleased) Users can now attach and detach network interfaces of Cloud Hypervisor domains at runtime. + * bhyve: NVMe device support + + Domain XMLs now can use NVMe devices:: + + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/path/to/disk.img'/> + <target dev='nvme0n1' bus='nvme'/> + </disk> + * **Improvements** * qemu: Improvements to USB controller model selection -- 2.51.0

2 2