- Devel - libvirt List Archives

[PATCH] conf: never reject <disk> <seclabel relabel='no'> overrides
by Peter Krempa 28 Oct '25

28 Oct '25

From: Cole Robinson <crobinso(a)redhat.com> Trying to disable <seclabel> for the whole <domain> and _also_ disable <seclabel> at the <disk> level will fail with: error: unsupported configuration: label overrides require relabeling to be enabled at the domain level which seems wrong. Instead skip the validation when disk seclabel has relabel='no', that config should always be valid. Reviewed-by: Michal Privoznik <mprivozn(a)redhat.com> Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- src/conf/domain_validate.c | 5 +++ ...l-selinux-none-override.x86_64-latest.args | 35 +++++++++++++++ ...el-selinux-none-override.x86_64-latest.xml | 43 +++++++++++++++++++ .../seclabel-selinux-none-override.xml | 30 +++++++++++++ tests/qemuxmlconftest.c | 1 + 5 files changed, 114 insertions(+) create mode 100644 tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/seclabel-selinux-none-override.xml diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c index 93a2bc9b01..eea9b38b21 100644 --- a/src/conf/domain_validate.c +++ b/src/conf/domain_validate.c @@ -303,6 +303,11 @@ virSecurityDeviceLabelDefValidate(virSecurityDeviceLabelDef **seclabels, for (i = 0; i < nseclabels; i++) { seclabel = seclabels[i]; + /* relabel='no' is always valid to request, regardless of + * domain level <seclabel> config */ + if (!seclabel->relabel) + continue; + /* find the security label that it's being overridden */ for (j = 0; j < nvmSeclabels; j++) { if (STRNEQ_NULLABLE(vmSeclabels[j]->model, seclabel->model)) diff --git a/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.args b/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.args new file mode 100644 index 0000000000..23beb54806 --- /dev/null +++ b/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.args @@ -0,0 +1,35 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1 \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ +/usr/bin/qemu-system-x86_64 \ +-name guest=QEMUGuest1,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ +-machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ +-accel tcg \ +-cpu qemu64 \ +-m size=219136k \ +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \ +-blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","read-only":false}' \ +-device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-storage","id":"ide0-0-0","bootindex":1}' \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.xml b/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.xml new file mode 100644 index 0000000000..15049a8a32 --- /dev/null +++ b/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.xml @@ -0,0 +1,43 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static' cpuset='1-4,8-20,525'>1</vcpu> + <os> + <type arch='x86_64' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'> + <seclabel model='selinux' relabel='no'/> + </source> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0' model='piix3-uhci'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <controller type='ide' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/> + </controller> + <controller type='pci' index='0' model='pci-root'/> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </memballoon> + </devices> + <seclabel type='none' model='selinux'/> +</domain> diff --git a/tests/qemuxmlconfdata/seclabel-selinux-none-override.xml b/tests/qemuxmlconfdata/seclabel-selinux-none-override.xml new file mode 100644 index 0000000000..2a174e8495 --- /dev/null +++ b/tests/qemuxmlconfdata/seclabel-selinux-none-override.xml @@ -0,0 +1,30 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static' cpuset='1-4,8-20,525'>1</vcpu> + <os> + <type arch='x86_64' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <disk type='block' device='disk'> + <source dev='/dev/HostVG/QEMUGuest1'> + <seclabel model='selinux' relabel='no'/> + </source> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0'/> + <controller type='ide' index='0'/> + <controller type='pci' index='0' model='pci-root'/> + <memballoon model='virtio'/> + </devices> + <seclabel type='none' model='selinux'/> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index aa6e1ad167..dd55c1ef28 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -2611,6 +2611,7 @@ mymain(void) DO_TEST_CAPS_LATEST("seclabel-static-labelskip"); DO_TEST_CAPS_LATEST("seclabel-none"); DO_TEST_CAPS_LATEST("seclabel-dac-none"); + DO_TEST_CAPS_LATEST("seclabel-selinux-none-override"); DO_TEST_CAPS_LATEST_PARSE_ERROR("seclabel-multiple"); DO_TEST_CAPS_LATEST_PARSE_ERROR("seclabel-device-duplicates"); DO_TEST_CAPS_LATEST_PARSE_ERROR("seclabel-device-relabel-invalid"); -- 2.51.0

1 1

[PATCH] apparmor: Allow AMD-SEV device access for AMD-SEV VM
by Hector Cao 28 Oct '25

28 Oct '25

AMD-SEV virtual machines interact with the underlying AMD-SEV technology through the character device /dev/sev. Currently, the AppArmor profile does not include the rule required to allow this access. There are two main approaches to address this limitation: 1) Add the required rule to the libvirt-qemu abstraction. 2) Dynamically add the rule only when the VM is an AMD-SEV guest. Since AMD-SEV guests represent a niche use case, it is more appropriate to apply the rule dynamically rather than granting access to all VMs through a global abstraction change. This commit implements option (2) by modifying the virt-aa-helper binary to insert the necessary rule into the AppArmor dynamic profile when the VM is identified as an AMD-SEV guest. The added entry in the generated libvirt-<uuid>.files file will look like: ... "/dev/sev" rw, ... Signed-off-by: Hector Cao <hector.cao(a)canonical.com> --- src/security/virt-aa-helper.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 8a297d4b54..de0a826063 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1370,6 +1370,21 @@ get_files(vahControl * ctl) virBufferAddLit(&buf, " deny \"/var/lib/libvirt/.cache/\" w,\n"); } + /* AMD-SEV VM needs to read/write the character device /dev/sev */ + if (ctl->def->sec) { + switch (ctl->def->sec->sectype) { + case VIR_DOMAIN_LAUNCH_SECURITY_SEV: + case VIR_DOMAIN_LAUNCH_SECURITY_SEV_SNP: + virBufferAddLit(&buf, " \"/dev/sev\" rw,\n"); + break; + case VIR_DOMAIN_LAUNCH_SECURITY_PV: + case VIR_DOMAIN_LAUNCH_SECURITY_TDX: + case VIR_DOMAIN_LAUNCH_SECURITY_NONE: + case VIR_DOMAIN_LAUNCH_SECURITY_LAST: + break; + } + } + if (ctl->newfile && vah_add_file(&buf, ctl->newfile, "rwk") != 0) { return -1; -- 2.45.2

2 1

[PATCH] conf: never reject <disk> <seclabel relabel='no'> overrides
by Cole Robinson 28 Oct '25

28 Oct '25

Trying to disable <seclabel> for the whole <domain> and _also_ disable <seclabel> at the <disk> level will fail with: error: unsupported configuration: label overrides require relabeling to be enabled at the domain level which seems wrong. Instead skip the validation when disk seclabel has relabel='no', that config should always be valid. Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- src/conf/domain_validate.c | 5 +++ ...l-selinux-none-override.x86_64-latest.args | 35 +++++++++++++++ ...el-selinux-none-override.x86_64-latest.xml | 43 +++++++++++++++++++ .../seclabel-selinux-none-override.xml | 30 +++++++++++++ tests/qemuxmlconftest.c | 1 + 5 files changed, 114 insertions(+) create mode 100644 tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/seclabel-selinux-none-override.xml diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c index 93a2bc9b01..eea9b38b21 100644 --- a/src/conf/domain_validate.c +++ b/src/conf/domain_validate.c @@ -303,6 +303,11 @@ virSecurityDeviceLabelDefValidate(virSecurityDeviceLabelDef **seclabels, for (i = 0; i < nseclabels; i++) { seclabel = seclabels[i]; + /* relabel='no' is always valid to request, regardless of + * domain level <seclabel> config */ + if (!seclabel->relabel) + continue; + /* find the security label that it's being overridden */ for (j = 0; j < nvmSeclabels; j++) { if (STRNEQ_NULLABLE(vmSeclabels[j]->model, seclabel->model)) diff --git a/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.args b/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.args new file mode 100644 index 0000000000..23beb54806 --- /dev/null +++ b/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.args @@ -0,0 +1,35 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1 \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ +/usr/bin/qemu-system-x86_64 \ +-name guest=QEMUGuest1,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ +-machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \ +-accel tcg \ +-cpu qemu64 \ +-m size=219136k \ +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \ +-blockdev '{"driver":"host_device","filename":"/dev/HostVG/QEMUGuest1","node-name":"libvirt-1-storage","read-only":false}' \ +-device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-storage","id":"ide0-0-0","bootindex":1}' \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.xml b/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.xml new file mode 100644 index 0000000000..15049a8a32 --- /dev/null +++ b/tests/qemuxmlconfdata/seclabel-selinux-none-override.x86_64-latest.xml @@ -0,0 +1,43 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static' cpuset='1-4,8-20,525'>1</vcpu> + <os> + <type arch='x86_64' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'> + <seclabel model='selinux' relabel='no'/> + </source> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0' model='piix3-uhci'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> + </controller> + <controller type='ide' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/> + </controller> + <controller type='pci' index='0' model='pci-root'/> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <memballoon model='virtio'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </memballoon> + </devices> + <seclabel type='none' model='selinux'/> +</domain> diff --git a/tests/qemuxmlconfdata/seclabel-selinux-none-override.xml b/tests/qemuxmlconfdata/seclabel-selinux-none-override.xml new file mode 100644 index 0000000000..2a174e8495 --- /dev/null +++ b/tests/qemuxmlconfdata/seclabel-selinux-none-override.xml @@ -0,0 +1,30 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static' cpuset='1-4,8-20,525'>1</vcpu> + <os> + <type arch='x86_64' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <disk type='block' device='disk'> + <source dev='/dev/HostVG/QEMUGuest1'> + <seclabel model='selinux' relabel='no'/> + </source> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0'/> + <controller type='ide' index='0'/> + <controller type='pci' index='0' model='pci-root'/> + <memballoon model='virtio'/> + </devices> + <seclabel type='none' model='selinux'/> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 55c622176a..cdcab3fa5d 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -2609,6 +2609,7 @@ mymain(void) DO_TEST_CAPS_LATEST("seclabel-static-labelskip"); DO_TEST_CAPS_LATEST("seclabel-none"); DO_TEST_CAPS_LATEST("seclabel-dac-none"); + DO_TEST_CAPS_LATEST("seclabel-selinux-none-override"); DO_TEST_CAPS_LATEST_PARSE_ERROR("seclabel-multiple"); DO_TEST_CAPS_LATEST_PARSE_ERROR("seclabel-device-duplicates"); DO_TEST_CAPS_LATEST_PARSE_ERROR("seclabel-device-relabel-invalid"); -- 2.51.0

2 1

[PATCH] esx: cast dynamicProperty->val->int32 to unsigned long to avoid overflow
by gerben＠altlinux.org 28 Oct '25

28 Oct '25

From: Denis Rastyogin <gerben(a)altlinux.org> dynamicProperty->val->int32 is now explicitly cast to unsigned long before multiplying by 1024. This prevents potential overflow from 32-bit arithmetic when handling large VM memory values and ensures correct scaling from megabytes to kilobytes. Found by Linux Verification Center (linuxtesting.org) with SVACE. Reported-by: Dmitriy Fedin <d.fedin(a)fobos-nt.ru> Signed-off-by: Denis Rastyogin <gerben(a)altlinux.org> --- src/esx/esx_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c index 554fb3e18f..41ca2a9bc1 100644 --- a/src/esx/esx_driver.c +++ b/src/esx/esx_driver.c @@ -2052,7 +2052,7 @@ esxDomainGetInfo(virDomainPtr domain, virDomainInfoPtr info) goto cleanup; } - info->maxMem = dynamicProperty->val->int32 * 1024; /* Scale from megabyte to kilobyte */ + info->maxMem = (unsigned long) dynamicProperty->val->int32 * 1024; /* Scale from megabyte to kilobyte */ } else if (STREQ(dynamicProperty->name, "config.hardware.numCPU")) { if (esxVI_AnyType_ExpectType(dynamicProperty->val, esxVI_Type_Int) < 0) { -- 2.42.2

1 0

[PATCH v3] qemu: Drop /dev/kvm from default device ACL
by Praveen K Paladugu 28 Oct '25

28 Oct '25

From: Praveen K Paladugu <prapal(a)linux.microsoft.com> A domain that runs with TCG emulation does not need kvm device, so drop it from default device ACL. Dynamically grant access to /dev/kvm based on domain type. Signed-off-by: Praveen K Paladugu <prapal(a)linux.microsoft.com> --- src/qemu/qemu.conf.in | 3 +-- src/qemu/qemu_cgroup.c | 10 ++++++++-- src/qemu/qemu_domain.h | 1 + src/qemu/qemu_namespace.c | 9 +++++++-- src/qemu/test_libvirtd_qemu.aug.in | 3 +-- 5 files changed, 18 insertions(+), 8 deletions(-) diff --git a/src/qemu/qemu.conf.in b/src/qemu/qemu.conf.in index fc91ba8f08..0a8abd9544 100644 --- a/src/qemu/qemu.conf.in +++ b/src/qemu/qemu.conf.in @@ -618,8 +618,7 @@ #cgroup_device_acl = [ # "/dev/null", "/dev/full", "/dev/zero", # "/dev/random", "/dev/urandom", -# "/dev/ptmx", "/dev/kvm", -# "/dev/userfaultfd" +# "/dev/ptmx", "/dev/userfaultfd" #] # # RDMA migration requires the following extra files to be added to the list: diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c index f10976c2b0..46a7dc1d8b 100644 --- a/src/qemu/qemu_cgroup.c +++ b/src/qemu/qemu_cgroup.c @@ -41,8 +41,7 @@ VIR_LOG_INIT("qemu.qemu_cgroup"); const char *const defaultDeviceACL[] = { "/dev/null", "/dev/full", "/dev/zero", "/dev/random", "/dev/urandom", - "/dev/ptmx", "/dev/kvm", - "/dev/userfaultfd", + "/dev/ptmx", "/dev/userfaultfd", NULL, }; #define DEVICE_PTY_MAJOR 136 @@ -783,6 +782,13 @@ qemuSetupDevicesCgroup(virDomainObj *vm) if (qemuCgroupAllowDevicesPaths(vm, deviceACL, VIR_CGROUP_DEVICE_RW, false) < 0) return -1; + if (vm->def->virtType == VIR_DOMAIN_VIRT_KVM) { + /* KVM requires access to /dev/kvm */ + if (qemuCgroupAllowDevicePath(vm, QEMU_DEV_KVM, VIR_CGROUP_DEVICE_RW, + false) < 0) + return -1; + } + if (qemuSetupFirmwareCgroup(vm) < 0) return -1; diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h index f4945f598a..fe4ba4fa15 100644 --- a/src/qemu/qemu_domain.h +++ b/src/qemu/qemu_domain.h @@ -89,6 +89,7 @@ struct _qemuDomainUnpluggingDevice { #define QEMU_DEV_SGX_PROVISION "/dev/sgx_provision" #define QEMU_DEVICE_MAPPER_CONTROL_PATH "/dev/mapper/control" #define QEMU_DEV_UDMABUF "/dev/udmabuf" +#define QEMU_DEV_KVM "/dev/kvm" #define QEMU_DOMAIN_AES_IV_LEN 16 /* 16 bytes for 128 bit random */ diff --git a/src/qemu/qemu_namespace.c b/src/qemu/qemu_namespace.c index f72da83929..ca12fcf587 100644 --- a/src/qemu/qemu_namespace.c +++ b/src/qemu/qemu_namespace.c @@ -210,13 +210,18 @@ qemuDomainGetPreservedMounts(virQEMUDriverConfig *cfg, static int qemuDomainPopulateDevices(virQEMUDriverConfig *cfg, + virDomainObj *vm, GSList **paths) { const char *const *devices = (const char *const *) cfg->cgroupDeviceACL; size_t i; - if (!devices) + if (!devices) { devices = defaultDeviceACL; + if (vm->def->virtType == VIR_DOMAIN_VIRT_KVM) { + *paths = g_slist_prepend(*paths, g_strdup(QEMU_DEV_KVM)); + } + } for (i = 0; devices[i]; i++) { *paths = g_slist_prepend(*paths, g_strdup(devices[i])); @@ -694,7 +699,7 @@ qemuDomainBuildNamespace(virQEMUDriverConfig *cfg, return 0; } - if (qemuDomainPopulateDevices(cfg, &paths) < 0) + if (qemuDomainPopulateDevices(cfg, vm, &paths) < 0) return -1; if (qemuDomainSetupAllDisks(vm, &paths) < 0) diff --git a/src/qemu/test_libvirtd_qemu.aug.in b/src/qemu/test_libvirtd_qemu.aug.in index 90012b3f52..82cfec3b4b 100644 --- a/src/qemu/test_libvirtd_qemu.aug.in +++ b/src/qemu/test_libvirtd_qemu.aug.in @@ -76,8 +76,7 @@ module Test_libvirtd_qemu = { "4" = "/dev/random" } { "5" = "/dev/urandom" } { "6" = "/dev/ptmx" } - { "7" = "/dev/kvm" } - { "8" = "/dev/userfaultfd" } + { "7" = "/dev/userfaultfd" } } { "save_image_format" = "raw" } { "dump_image_format" = "raw" } -- 2.51.0

2 1

[PATCH 0/5] CH: Add network interface hotplug support
by Stefan Kober 28 Oct '25

28 Oct '25

This patch set adds support for attaching and detaching network interfaces to Cloud Hypervisor domains at runtime. Stefan Kober (5): ch: pass virCHDriver to chDomainAttachDeviceLice ch: add net device alias assignment ch: implement network device hot attach ch: implement network device hot detach NEWS: ch: announce network hotplug feature NEWS.rst | 5 ++ src/ch/ch_alias.c | 47 +++++++++++++ src/ch/ch_alias.h | 3 + src/ch/ch_hotplug.c | 83 ++++++++++++++++++++-- src/ch/ch_monitor.c | 5 +- src/ch/ch_monitor.h | 1 - src/ch/ch_process.c | 163 +++++++++++++++++++++++++------------------- src/ch/ch_process.h | 8 +++ 8 files changed, 234 insertions(+), 81 deletions(-) -- 2.51.0

3 10

[PATCH v3] audio: deprecate HMP audio commands
by marcandre.lureau＠redhat.com 28 Oct '25

28 Oct '25

From: Marc-André Lureau <marcandre.lureau(a)redhat.com> The command is niche and better served by the host audio system. There is no QMP equivalent, fortunately. You can capture the audio stream via remote desktop protocols too (dbus, vnc, spice). Signed-off-by: Marc-André Lureau <marcandre.lureau(a)redhat.com> Acked-by: Dr. David Alan Gilbert <dave(a)treblig.org> --- docs/about/deprecated.rst | 20 ++++++++++++++++++++ audio/audio-hmp-cmds.c | 7 +++++++ audio/meson.build | 5 +++-- hmp-commands-info.hx | 6 ++++-- hmp-commands.hx | 9 +++++++-- 5 files changed, 41 insertions(+), 6 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index dacf2882e4..31445dfc61 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -169,6 +169,26 @@ Use ``job-finalize`` instead. This argument has always been ignored. +Human Machine Protocol (HMP) commands +------------------------------------- + +``wavcapture`` (since 10.2) +'''''''''''''''''''''''''''' + +The ``wavcapture`` command is deprecated and will be removed in a future release. + +Use ``-audiodev wav`` or your host audio system to capture audio. + +``stopcapture`` (since 10.2) +'''''''''''''''''''''''''''' + +The ``stopcapture`` command is deprecated and will be removed in a future release. + +``info`` argument ``capture`` (since 10.2) +'''''''''''''''''''''''''''''''''''''''''' + +The ``info capture`` command is deprecated and will be removed in a future release. + Host Architectures ------------------ diff --git a/audio/audio-hmp-cmds.c b/audio/audio-hmp-cmds.c index 8774c09f18..9129a02331 100644 --- a/audio/audio-hmp-cmds.c +++ b/audio/audio-hmp-cmds.c @@ -28,6 +28,7 @@ #include "monitor/monitor.h" #include "qapi/error.h" #include "qobject/qdict.h" +#include "qemu/error-report.h" static QLIST_HEAD (capture_list_head, CaptureState) capture_head; @@ -36,6 +37,8 @@ void hmp_info_capture(Monitor *mon, const QDict *qdict) int i; CaptureState *s; + warn_report_once("'info capture' is deprecated since v10.2, to be removed"); + for (s = capture_head.lh_first, i = 0; s; s = s->entries.le_next, ++i) { monitor_printf(mon, "[%d]: ", i); s->ops.info (s->opaque); @@ -48,6 +51,8 @@ void hmp_stopcapture(Monitor *mon, const QDict *qdict) int n = qdict_get_int(qdict, "n"); CaptureState *s; + warn_report_once("'stopcapture' is deprecated since v10.2, to be removed"); + for (s = capture_head.lh_first, i = 0; s; s = s->entries.le_next, ++i) { if (i == n) { s->ops.destroy (s->opaque); @@ -69,6 +74,8 @@ void hmp_wavcapture(Monitor *mon, const QDict *qdict) Error *local_err = NULL; AudioState *as = audio_state_by_name(audiodev, &local_err); + warn_report_once("'wavcapture' is deprecated since v10.2, to be removed"); + if (!as) { error_report_err(local_err); return; diff --git a/audio/meson.build b/audio/meson.build index 59f0a431d5..f0c97e5223 100644 --- a/audio/meson.build +++ b/audio/meson.build @@ -1,12 +1,13 @@ system_ss.add([spice_headers, files('audio.c')]) system_ss.add(files( - 'audio-hmp-cmds.c', 'mixeng.c', 'noaudio.c', 'wavaudio.c', - 'wavcapture.c', )) +# deprecated since v10.2, to be removed +system_ss.add(files('audio-hmp-cmds.c', 'wavcapture.c')) + system_ss.add(when: coreaudio, if_true: files('coreaudio.m')) system_ss.add(when: dsound, if_true: files('dsoundaudio.c', 'audio_win_int.c')) diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx index 25b4aed51f..8d3d180637 100644 --- a/hmp-commands-info.hx +++ b/hmp-commands-info.hx @@ -363,18 +363,20 @@ SRST Show host USB devices. ERST +/* BEGIN deprecated */ { .name = "capture", .args_type = "", .params = "", - .help = "show capture information", + .help = "show capture information (deprecated)", .cmd = hmp_info_capture, }, SRST ``info capture`` - Show capture information. + Show capture information (deprecated). ERST +/* END deprecated */ { .name = "snapshots", diff --git a/hmp-commands.hx b/hmp-commands.hx index 15f6082596..5cc4788f12 100644 --- a/hmp-commands.hx +++ b/hmp-commands.hx @@ -764,11 +764,12 @@ SRST ERST +/* BEGIN deprecated */ { .name = "wavcapture", .args_type = "path:F,audiodev:s,freq:i?,bits:i?,nchannels:i?", .params = "path audiodev [frequency [bits [channels]]]", - .help = "capture audio to a wave file (default frequency=44100 bits=16 channels=2)", + .help = "capture audio to a wave file (deprecated, default frequency=44100 bits=16 channels=2)", .cmd = hmp_wavcapture, }, SRST @@ -782,13 +783,15 @@ SRST - Sample rate = 44100 Hz - CD quality - Bits = 16 - Number of channels = 2 - Stereo + + Deprecated. ERST { .name = "stopcapture", .args_type = "n:i", .params = "capture index", - .help = "stop capture", + .help = "stop capture (deprecated)", .cmd = hmp_stopcapture, }, SRST @@ -797,7 +800,9 @@ SRST info capture + Deprecated. ERST +/* END deprecated */ { .name = "memsave", -- 2.51.0

2 1

[FOSDEM] Call for participation: Virtualization and Cloud infrastructure Room at FOSDEM 2026
by Piotr Kliczewski 28 Oct '25

28 Oct '25

We are excited to announce that the call for proposals is now open for the Virtualization and Cloud infrastructure devroom at the upcoming FOSDEM 2026, to be hosted on 31st of January. This devroom is a collaborative effort, and is organized by dedicated folks from projects such as OpenStack, Xen Project, KubeVirt, QEMU, KVM, and Foreman. We invite everyone involved in these fields to submit your proposals by 5th December 2025. About the Devroom The Virtualization & IaaS devroom will feature session topics such as open source hypervisors or virtual machine managers such as Xen Project, KVM, bhyve and VirtualBox as well as Infrastructure-as-a-Service projects such as KubeVirt, Apache CloudStack, OpenStack, QEMU and OpenNebula. This devroom will host presentations that focus on topics of shared interest, such as KVM, libvirt, shared storage, virtualized networking, cloud security, clustering and high availability, interfacing with multiple hypervisors, hyperconverged deployments and scaling across hundreds or thousands of servers. Presentations in this devroom will be aimed at developers working on these platforms who are looking to collaborate and improve shared infrastructure or solve common problems. We seek topics that encourage dialog between projects and continued work post-FOSDEM. Important Dates Submission deadline: 5th December 2025 Acceptance notifications: 10th December 2025 Final schedule announcement: 15th of December 2025 Devroom: 31st of January Submit Your Proposal During submission [1] please make sure to select Virtualization and Cloud infrastructure from the Track list. Please provide a meaningful abstract and description of your proposed session. Submission Guidelines We expect more proposals than we can possibly accept, so it is vitally important that you submit your proposal on or before the deadline. Late submissions are unlikely to be considered. All presentation slots are 30 minutes, with 20 minutes planned for presentations, and 10 minutes for Q&A. All presentations will be recorded and made available under Creative Commons licenses. In the Submission notes field, please indicate that you agree that your presentation will be licensed under the CC-By-SA-4.0 or CC-By-4.0 license and that you agree to have your presentation recorded. For example: "If my presentation is accepted for FOSDEM, I hereby agree to license all recordings, slides, and other associated materials under the Creative Commons Attribution Share-Alike 4.0 International License. Sincerely, Piotr Kliczewski and Tal Nisan In the Submission notes field, please also confirm that if your talk is accepted, you will be able to attend FOSDEM and deliver your presentation. We will not consider proposals from prospective speakers who are unsure whether they will be able to secure funds for travel and lodging to attend FOSDEM. (Sadly, we are not able to offer travel funding for prospective speakers.) Code of Conduct Following the release of the updated code of conduct for FOSDEM[2], we'd like to remind all speakers and attendees that all of the presentations and discussions in our devroom are held under the guidelines set in the CoC and we expect attendees, speakers, and volunteers to follow the CoC at all times. If you submit a proposal and it is accepted, you will be required to confirm that you accept the FOSDEM CoC. If you have any questions about the CoC or wish to have one of the devroom organizers review your presentation slides or any other content for CoC compliance, please email us and we will do our best to assist you. Questions? If you have any questions about this devroom, please send your questions to our devroom mailing list. You can also subscribe to the list to receive updates about important dates, session announcements, and to connect with other attendees. See you all at FOSDEM! [1] https://fosdem.org/submit [2] https://fosdem.org/2026/practical/conduct/

1 0

[PATCH v4 3/3] NEWS: ch: announce riscv-aia feature for RISC-V KVM
by BillXiang 27 Oct '25

27 Oct '25

From: xiangwencheng <xiangwencheng(a)lanxincomputing.com> Signed-off-by: xiangwencheng <xiangwencheng(a)lanxincomputing.com> --- NEWS.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 1b8e188f5e..db98d9e7c2 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -32,6 +32,13 @@ v11.8.0 (unreleased) On the XML side, the existing <acpi> element has been extended with a "nodeset" attribute to specify the NUMA node affinity of a PCI device. + * qemu: Add ``riscv-aia`` attribute for RISC-V KVM + + This attribute was introduced in qemu-8.2 to specify the KVM AIA mode. + 1) "riscv-aia=emul": IMSIC is emulated by hypervisor + 2) "riscv-aia=hwaccel": use hardware guest IMSIC + 3) "riscv-aia=auto": use the hardware guest IMSICs whenever available otherwise we fallback to software emulation. + * **Improvements** * **Bug fixes** -- 2.34.1

2 1

[PATCH v4 2/3] qemu: Add XML tests for kvm riscv-aia feature
by BillXiang 27 Oct '25

27 Oct '25

From: xiangwencheng <xiangwencheng(a)lanxincomputing.com> Signed-off-by: BillXiang <xiangwencheng(a)lanxincomputing.com> --- .../caps_9.1.0_riscv64.replies | 4 +++ .../caps_9.1.0_riscv64.xml | 3 ++ ...atures-aia-aplic-imsic.riscv64-latest.args | 31 +++++++++++++++++++ ...eatures-aia-aplic-imsic.riscv64-latest.xml | 1 + .../riscv64-virt-features-aia-aplic-imsic.xml | 30 ++++++++++++++++++ tests/qemuxmlconftest.c | 1 + 6 files changed, 70 insertions(+) create mode 100644 tests/qemuxmlconfdata/riscv64-virt-features-aia-aplic-imsic.riscv64-latest.args create mode 120000 tests/qemuxmlconfdata/riscv64-virt-features-aia-aplic-imsic.riscv64-latest.xml create mode 100644 tests/qemuxmlconfdata/riscv64-virt-features-aia-aplic-imsic.xml diff --git a/tests/qemucapabilitiesdata/caps_9.1.0_riscv64.replies b/tests/qemucapabilitiesdata/caps_9.1.0_riscv64.replies index 51896936cc..b394d68d00 100644 --- a/tests/qemucapabilitiesdata/caps_9.1.0_riscv64.replies +++ b/tests/qemucapabilitiesdata/caps_9.1.0_riscv64.replies @@ -24238,6 +24238,10 @@ "name": "tcg-accel", "parent": "accel" }, + { + "name": "kvm-accel", + "parent": "accel" + }, { "name": "ES1370", "parent": "pci-device" diff --git a/tests/qemucapabilitiesdata/caps_9.1.0_riscv64.xml b/tests/qemucapabilitiesdata/caps_9.1.0_riscv64.xml index 9ceefed89f..6fbe05aa8d 100644 --- a/tests/qemucapabilitiesdata/caps_9.1.0_riscv64.xml +++ b/tests/qemucapabilitiesdata/caps_9.1.0_riscv64.xml @@ -3,6 +3,7 @@ <qemuctime>0</qemuctime> <selfctime>0</selfctime> <selfvers>0</selfvers> + <flag name='kvm'/> <flag name='sdl'/> <flag name='spice'/> <flag name='hda-duplex'/> @@ -180,10 +181,12 @@ <cpu type='tcg' name='thead-c906' typename='thead-c906-riscv-cpu'/> <cpu type='tcg' name='sifive-u54' typename='sifive-u54-riscv-cpu'/> <cpu type='tcg' name='veyron-v1' typename='veyron-v1-riscv-cpu'/> + <cpu type='kvm' name='rv64' typename='rv64-riscv-cpu'/> <machine type='tcg' name='virt' maxCpus='512' defaultCPU='rv64-riscv-cpu' numaMemSupported='yes' defaultRAMid='riscv_virt_board.ram' acpi='yes'/> <machine type='tcg' name='spike' maxCpus='8' default='yes' defaultCPU='rv64-riscv-cpu' numaMemSupported='yes' defaultRAMid='riscv.spike.ram' acpi='no'/> <machine type='tcg' name='microchip-icicle-kit' maxCpus='5' defaultRAMid='microchip.icicle.kit.ram' acpi='no'/> <machine type='tcg' name='sifive_u' maxCpus='5' defaultCPU='sifive-u54-riscv-cpu' defaultRAMid='riscv.sifive.u.ram' acpi='no'/> <machine type='tcg' name='shakti_c' maxCpus='1' defaultCPU='shakti-c-riscv-cpu' defaultRAMid='riscv.shakti.c.ram' acpi='no'/> <machine type='tcg' name='sifive_e' maxCpus='1' defaultCPU='sifive-e51-riscv-cpu' defaultRAMid='riscv.sifive.e.ram' acpi='no'/> + <machine type='kvm' name='virt' maxCpus='512' defaultCPU='rv64-riscv-cpu' numaMemSupported='yes' defaultRAMid='riscv_virt_board.ram' acpi='yes'/> </qemuCaps> diff --git a/tests/qemuxmlconfdata/riscv64-virt-features-aia-aplic-imsic.riscv64-latest.args b/tests/qemuxmlconfdata/riscv64-virt-features-aia-aplic-imsic.riscv64-latest.args new file mode 100644 index 0000000000..3dadcdcd7c --- /dev/null +++ b/tests/qemuxmlconfdata/riscv64-virt-features-aia-aplic-imsic.riscv64-latest.args @@ -0,0 +1,31 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-riscv64 \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-machine virt,usb=off,aia=aplic-imsic,dump-guest-core=off,memory-backend=riscv_virt_board.ram,acpi=off \ +-accel kvm,riscv-aia=auto \ +-cpu rv64 \ +-m size=4194304k \ +-object '{"qom-type":"memory-backend-ram","id":"riscv_virt_board.ram","size":4294967296}' \ +-overcommit mem-lock=off \ +-smp 4,sockets=4,cores=1,threads=1 \ +-uuid 1ccfd97d-5eb4-478a-bbe6-88d254c16db7 \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/riscv64-virt-features-aia-aplic-imsic.riscv64-latest.xml b/tests/qemuxmlconfdata/riscv64-virt-features-aia-aplic-imsic.riscv64-latest.xml new file mode 120000 index 0000000000..73a864a8c2 --- /dev/null +++ b/tests/qemuxmlconfdata/riscv64-virt-features-aia-aplic-imsic.riscv64-latest.xml @@ -0,0 +1 @@ +riscv64-virt-features-aia-aplic-imsic.xml \ No newline at end of file diff --git a/tests/qemuxmlconfdata/riscv64-virt-features-aia-aplic-imsic.xml b/tests/qemuxmlconfdata/riscv64-virt-features-aia-aplic-imsic.xml new file mode 100644 index 0000000000..31d4f30401 --- /dev/null +++ b/tests/qemuxmlconfdata/riscv64-virt-features-aia-aplic-imsic.xml @@ -0,0 +1,30 @@ +<domain type='kvm'> + <name>guest</name> + <uuid>1ccfd97d-5eb4-478a-bbe6-88d254c16db7</uuid> + <memory unit='KiB'>4194304</memory> + <currentMemory unit='KiB'>4194304</currentMemory> + <vcpu placement='static'>4</vcpu> + <os> + <type arch='riscv64' machine='virt'>hvm</type> + <boot dev='hd'/> + </os> + <features> + <kvm> + <riscv-aia state='on' mode='auto'/> + </kvm> + <aia value='aplic-imsic'/> + </features> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>rv64</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-riscv64</emulator> + <controller type='pci' index='0' model='pcie-root'/> + <audio id='1' type='none'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 171a6f1c78..5a2a14f7a6 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -2999,6 +2999,7 @@ mymain(void) DO_TEST_CAPS_ARCH_LATEST("x86_64-default-cpu-tcg-features", "x86_64"); DO_TEST_CAPS_ARCH_LATEST("riscv64-virt-features-aia", "riscv64"); + DO_TEST_CAPS_ARCH_LATEST("riscv64-virt-features-aia-aplic-imsic", "riscv64"); DO_TEST_CAPS_LATEST("virtio-9p-multidevs"); DO_TEST_CAPS_LATEST("virtio-9p-createmode"); -- 2.34.1

2 1