- Devel - libvirt List Archives

[PATCH v6 0/3] nwfilter: add nwfilter nftables driver
by Dion Bosschieter 03 Apr '26

03 Apr '26

This series aims to implement nftables as a backend driver for the nwfilter feature. The idea is that it will replace the ebiptables driver and provide an easy way for users to switch from one driver to another. The 1st patch introduces the new nwfilter driver. After which nwfilter allows users to choose it in the 2nd patch. The last patch introduces unit testing of the new nftables driver. - Implemented very basic nwfilter.conf reading, choosing a nwfilter driver based on the name of the drivers (nftables/ebiptables). Defaults to the nftables driver, based on the firewall_backend_priority meson option, following the bridge driver logic. - Implemented nft tracing and counters usable via nwfilter.conf options "enable_trace" and "enable_counters" - Resolves issue https://gitlab.com/libvirt/libvirt/-/issues/603, benchmarks showed that the amount of iifname jumps for each interface in the root chains is the cause for this. Switched the nftables driver towards a vmap (verdict map) so we can have 1 rule that jumps to the correct root input/output chain per interface. Which improves throughput as when the number of interface check and jump rules increases the throughput decreases. The issue describes the interface matching works using the interface name and the majority of the effort is the strncpy, this patch also switches nftables to an interface_index compare instead. However, just using the interface_index is not enough, the amount of oif and iif jump rules causes quite the performance degradation, the vmap instead solves this. - Split rules into separate tables: "libvirt_nwfilter_ethernet" and "libvirt_nwfilter_inet" to preserve existing firewall behavior. - Reworked chain logic for clarity with root -input/-output chains per interface. input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). - Stuck with prerouting and postrouting as hooks for input / output on the _ethernet and _inet table. This makes it easier to merge the tables in the future. Saving management of two tables and decreasing the amount of tables a packet sees. Currently ebtables filtering happens via PREROUTING and POSTROUTING hooks, while ip/ip6tables filtering happens in the output/forward hooks. - Stuck with 2 tables for compatibility reasons with eb iptables, unifying into 1 table will break users firewall definitions, which depend on being able to do accepts on ethernet rules (which currently get defined via ebtables) and additional filtering via the ip rules (which currently get defined via ip(6)tables). The nwfilter_nftables_driver keeps splitting the ethernet and inet rules in seperate tables "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other". - Rewrote chain logic, so it is easier to understand, input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). _ethernet and _inet table follow the same style and hook in the same way. - Simplified conntrack handling: rules with accept+conntrack are duplicated to the opposite chain for symmetric behavior, to support the existing ebiptables logic. - Firewall updates continue use tmp names for atomic replacement. Unsupported nwfilter features (for now): - IPSets (potential future support via nft sets) - Reject due to filtering in pre/postrouting, using drop instead of reject, copying logic from existing ebiptables ebtables actions Future improvements: - Use `nft -f` for atomic rule application. - Optional single-table mode via nwfilter.conf. - Optimize boot phase with chain hash comparison. --- Changes in v6: - Add STP support - Add GARP support - Remove comment "priority=%" leftover from debugging Changes in v5: - Fix rarp support via nft raw payload expression Changes in v4: - Fix rarp nft commands "arp saddr ether" "arp daddr ether" - Filter chain creation, don't create unnecessary chains - Apply danpb seperate argument suggestion - Fix table not existing errors in drop all rules - Fix table not existing errors in apply basic rules Changes in v3: - Renamed -other to -inet - Renamed - to _ in table names - Updated rule / chain sorting on ethernet table to to copy ebtables logic - Fix possible broken revert path - Fix remove rules not working in some cases, EBUSY - Shared functions camel case commit - Rename config option - Add extra config params, enable_trace, enable_counters This required passing the config struct to the ebip/nft nwfilter drivers - Add extra augeaus files Changes in v2: - Rename {ebip,nf}tables specific test files in 1 directory instead of seperating them in different directories. - Added default nwfilter.conf file in git, documented including augeas files - Replaced hardcoding of default driver based on existing firewall_backend_priority meson option. - Added nwfilter_driver_conf.{h,c} for configuration handling, to match the common pattern used in other drivers. Dion Bosschieter (3): nwfilter: add nwfilter nftables driver nwfilter: allow use of nftables nwfilter driver via nwfilter.conf nwfilter: add unit tests and test data for nwfilter nftables driver libvirt.spec.in | 7 + po/POTFILES | 2 + src/conf/virnwfilterobj.h | 20 - src/nwfilter/libvirtd_nwfilter.aug | 45 + src/nwfilter/meson.build | 38 + src/nwfilter/nwfilter.conf.in | 50 + src/nwfilter/nwfilter_driver.c | 66 +- src/nwfilter/nwfilter_driver_conf.c | 214 + src/nwfilter/nwfilter_driver_conf.h | 69 + src/nwfilter/nwfilter_ebiptables_driver.c | 4 +- src/nwfilter/nwfilter_ebiptables_driver.h | 2 +- src/nwfilter/nwfilter_gentech_driver.c | 65 +- src/nwfilter/nwfilter_gentech_driver.h | 5 +- src/nwfilter/nwfilter_nftables_driver.c | 2884 ++++++++++++++ src/nwfilter/nwfilter_nftables_driver.h | 28 + src/nwfilter/nwfilter_tech_driver.h | 3 +- src/nwfilter/test_libvirtd_nwfilter.aug.in | 7 + tests/meson.build | 2 + tests/nwfilternftablestest.c | 426 ++ .../ah-ipv6-linux.nftables.args | 298 ++ .../ah-linux.nftables.args | 292 ++ .../all-ipv6-linux.nftables.args | 280 ++ .../all-linux.nftables.args | 274 ++ .../arp-linux.nftables.args | 285 ++ .../comment-linux.nftables.args | 502 +++ .../conntrack-linux.nftables.args | 190 + .../esp-ipv6-linux.nftables.args | 298 ++ .../esp-linux.nftables.args | 292 ++ .../example-1-linux.nftables.args | 252 ++ .../example-2-linux.nftables.args | 352 ++ .../hex-data-linux.nftables.args | 368 ++ .../icmp-direction-linux.nftables.args | 226 ++ .../icmp-direction2-linux.nftables.args | 226 ++ .../icmp-direction3-linux.nftables.args | 176 + .../icmp-linux.nftables.args | 248 ++ .../icmpv6-linux.nftables.args | 316 ++ .../igmp-linux.nftables.args | 292 ++ .../ip-linux.nftables.args | 199 + .../ipt-no-macspoof-linux.nftables.args | 166 + .../ipv6-linux.nftables.args | 481 +++ .../iter1-linux.nftables.args | 292 ++ .../iter2-linux.nftables.args | 3532 +++++++++++++++++ .../iter3-linux.nftables.args | 410 ++ .../mac-linux.nftables.args | 176 + .../rarp-linux.nftables.args | 207 + .../sctp-ipv6-linux.nftables.args | 316 ++ .../sctp-linux.nftables.args | 316 ++ .../stp-linux.nftables.args | 233 ++ .../target-linux.nftables.args | 454 +++ .../target2-linux.nftables.args | 302 ++ .../tcp-ipv6-linux.nftables.args | 316 ++ .../tcp-linux.nftables.args | 452 +++ .../udp-ipv6-linux.nftables.args | 316 ++ .../udp-linux.nftables.args | 316 ++ .../udplite-ipv6-linux.nftables.args | 298 ++ .../udplite-linux.nftables.args | 292 ++ .../vlan-linux.nftables.args | 257 ++ tests/nwfilterxml2nftfirewalltest.c | 432 ++ 58 files changed, 18765 insertions(+), 102 deletions(-) create mode 100644 src/nwfilter/libvirtd_nwfilter.aug create mode 100644 src/nwfilter/nwfilter.conf.in create mode 100644 src/nwfilter/nwfilter_driver_conf.c create mode 100644 src/nwfilter/nwfilter_driver_conf.h create mode 100644 src/nwfilter/nwfilter_nftables_driver.c create mode 100644 src/nwfilter/nwfilter_nftables_driver.h create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in create mode 100644 tests/nwfilternftablestest.c create mode 100755 tests/nwfilterxml2firewalldata/ah-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ah-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/arp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/comment-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/conntrack-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/hex-data-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmpv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/igmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ip-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/mac-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/rarp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-linux.nftables.args create mode 100644 tests/nwfilterxml2firewalldata/stp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/vlan-linux.nftables.args create mode 100644 tests/nwfilterxml2nftfirewalltest.c -- 2.43.0

2 7

[PATCH] virt-aa-helper: Prevent spurious denials for AoE disks
by PUSHKARAJ PATIL 03 Apr '26

03 Apr '26

virt-aa-helper calls virStorageSourceGetMetadata before adding a disk path to a domain's apparmor profile. This probes the device and may trigger an AppArmor denial when the disk is an AoE device under /dev/etherd/. The return value of virStorageSourceGetMetadata is not checked, so the denial has no functional impact but results in noisy dmesg logs. Allow read access to /dev/etherd/e*.* in the virt-aa-helper profile to avoid these spurious denials. Signed-off-by: PUSHKARAJ PATIL <pushkaraj.patil(a)in.ibm.com> --- src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in | 1 + 1 file changed, 1 insertion(+) diff --git a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in index e209a8bff7..80e9ef2b08 100644 --- a/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in +++ b/src/security/apparmor/usr.lib.libvirt.virt-aa-helper.in @@ -73,6 +73,7 @@ profile virt-aa-helper @libexecdir@/virt-aa-helper { /**.vhd r, /**.[iI][sS][oO] r, /**/disk{,.*} r, + /dev/etherd/e*.* r, include if exists <local/usr.lib.libvirt.virt-aa-helper> } -- 2.50.1 (Apple Git-155)

2 1

[PATCH] bhyve: add virtio-console support
by Roman Bogorodskiy 03 Apr '26

03 Apr '26

Bhyve supports virtio-console devices using the following syntax: -s 2:0,virtio-console,org.qemu.guest_agent.0=/path/to/unix/socket,other.port=/other/socket,... There are two details about that to consider. The first one is that only up to 16 ports per console is supported. This is different from the default (31), so update the code to manually add the virtio-serial controllers with 16 ports. For the existing controllers, make sure to set max ports to 16 or error out if ports count greater than 16 was specified. The second one is that bhyve does not clean up UNIX sockets for these devices. So update virBhyveProcessStop() to remove leftover sockets. Not adding capabilities probing as the virtio-console device is available on all supported FreeBSD versions and on all supported arches. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve_command.c | 42 +++++- src/bhyve/bhyve_device.c | 42 +++++- src/bhyve/bhyve_domain.c | 44 ++++++- src/bhyve/bhyve_process.c | 14 ++ ...exml2argv-2-virtio-console-mixed-addr.args | 10 ++ ...ml2argv-2-virtio-console-mixed-addr.ldargs | 4 + ...vexml2argv-2-virtio-console-mixed-addr.xml | 26 ++++ .../bhyvexml2argv-virtio-console-addr.args | 10 ++ .../bhyvexml2argv-virtio-console-addr.ldargs | 4 + .../bhyvexml2argv-virtio-console-addr.xml | 25 ++++ ...vexml2argv-virtio-console-controllers.args | 11 ++ ...xml2argv-virtio-console-controllers.ldargs | 4 + ...yvexml2argv-virtio-console-controllers.xml | 31 +++++ ...v-virtio-console-multiple-controllers.args | 11 ++ ...virtio-console-multiple-controllers.ldargs | 4 + ...gv-virtio-console-multiple-controllers.xml | 89 +++++++++++++ ...xml2argv-virtio-console-too-many-ports.xml | 25 ++++ .../x86_64/bhyvexml2argv-virtio-console.args | 10 ++ .../bhyvexml2argv-virtio-console.ldargs | 4 + .../x86_64/bhyvexml2argv-virtio-console.xml | 21 +++ tests/bhyvexml2argvtest.c | 6 + ...xml2xmlout-2-virtio-console-mixed-addr.xml | 40 ++++++ .../bhyvexml2xmlout-virtio-console-addr.xml | 35 +++++ ...exml2xmlout-virtio-console-controllers.xml | 43 ++++++ ...ut-virtio-console-multiple-controllers.xml | 123 ++++++++++++++++++ .../x86_64/bhyvexml2xmlout-virtio-console.xml | 35 +++++ tests/bhyvexml2xmltest.c | 6 + 27 files changed, 712 insertions(+), 7 deletions(-) create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-virtio-console-mixed-addr.args create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-virtio-console-mixed-addr.ldargs create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-virtio-console-mixed-addr.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-addr.args create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-addr.ldargs create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-addr.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-controllers.args create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-controllers.ldargs create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-controllers.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-multiple-controllers.args create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-multiple-controllers.ldargs create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-multiple-controllers.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-too-many-ports.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console.args create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console.ldargs create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console.xml create mode 100644 tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-2-virtio-console-mixed-addr.xml create mode 100644 tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-virtio-console-addr.xml create mode 100644 tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-virtio-console-controllers.xml create mode 100644 tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-virtio-console-multiple-controllers.xml create mode 100644 tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-virtio-console.xml diff --git a/src/bhyve/bhyve_command.c b/src/bhyve/bhyve_command.c index 931d7dd551..8671644cc8 100644 --- a/src/bhyve/bhyve_command.c +++ b/src/bhyve/bhyve_command.c @@ -490,6 +490,43 @@ bhyveBuildNVMeControllerArgStr(const virDomainDef *def, return 0; } +static int +bhyveBuildVirtioSerialControllerArgStr(const virDomainDef *def, + virDomainControllerDef *controller, + struct _bhyveConn *driver G_GNUC_UNUSED, + virCommand *cmd) +{ + g_auto(virBuffer) opt = VIR_BUFFER_INITIALIZER; + size_t i; + + for (i = 0; i < def->nchannels; i++) { + virDomainChrDef *channel = def->channels[i]; + + if (channel->info.addr.vioserial.controller != controller->idx) + continue; + + if (channel->source->type != VIR_DOMAIN_CHR_TYPE_UNIX) + continue; + + if (channel->targetType != VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_VIRTIO) + continue; + + virBufferAsprintf(&opt, + ",%s=%s", + channel->target.name, + channel->source->data.nix.path); + } + + if (virBufferUse(&opt) > 0) { + virCommandAddArg(cmd, "-s"); + virCommandAddArgFormat(cmd, "%d:0,virtio-console%s", + controller->info.addr.pci.slot, + virBufferContentAndReset(&opt)); + } + + return 0; +} + static int bhyveBuildVirtIODiskArgStr(const virDomainDef *def G_GNUC_UNUSED, virDomainDiskDef *disk, @@ -606,9 +643,12 @@ bhyveBuildControllerArgStr(const virDomainDef *def, if (bhyveBuildNVMeControllerArgStr(def, controller, driver, cmd) < 0) return -1; break; + case VIR_DOMAIN_CONTROLLER_TYPE_VIRTIO_SERIAL: + if (bhyveBuildVirtioSerialControllerArgStr(def, controller, driver, cmd) < 0) + return -1; + break; case VIR_DOMAIN_CONTROLLER_TYPE_IDE: case VIR_DOMAIN_CONTROLLER_TYPE_FDC: - case VIR_DOMAIN_CONTROLLER_TYPE_VIRTIO_SERIAL: case VIR_DOMAIN_CONTROLLER_TYPE_CCID: case VIR_DOMAIN_CONTROLLER_TYPE_XENBUS: case VIR_DOMAIN_CONTROLLER_TYPE_LAST: diff --git a/src/bhyve/bhyve_device.c b/src/bhyve/bhyve_device.c index 54511383bb..cf3a9fa4fb 100644 --- a/src/bhyve/bhyve_device.c +++ b/src/bhyve/bhyve_device.c @@ -31,6 +31,36 @@ VIR_LOG_INIT("bhyve.bhyve_device"); + +static int +bhyveDomainAssignVirtioSerialAddresses(virDomainDef *def) +{ + int ret = -1; + size_t i; + virDomainVirtioSerialAddrSet *addrs = NULL; + + if (!(addrs = virDomainVirtioSerialAddrSetCreateFromDomain(def))) + goto cleanup; + + VIR_DEBUG("Finished reserving existing ports"); + + for (i = 0; i < def->nchannels; i++) { + virDomainChrDef *chr = def->channels[i]; + if (chr->deviceType == VIR_DOMAIN_CHR_DEVICE_TYPE_CHANNEL && + chr->targetType == VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_VIRTIO && + !virDomainVirtioSerialAddrIsComplete(&chr->info) && + virDomainVirtioSerialAddrAutoAssignFromCache(def, addrs, + &chr->info, false) < 0) + goto cleanup; + } + + ret = 0; + + cleanup: + virDomainVirtioSerialAddrSetFree(addrs); + return ret; +} + static int bhyveCollectPCIAddress(virDomainDef *def G_GNUC_UNUSED, virDomainDeviceDef *device G_GNUC_UNUSED, @@ -39,7 +69,8 @@ bhyveCollectPCIAddress(virDomainDef *def G_GNUC_UNUSED, { virDomainPCIAddressSet *addrs = NULL; virPCIDeviceAddress *addr = NULL; - if (info->type == VIR_DOMAIN_DEVICE_ADDRESS_TYPE_DRIVE) + + if (info->type != VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI) return 0; addrs = opaque; @@ -116,6 +147,7 @@ bhyveAssignDevicePCISlots(virDomainDef *def, (def->controllers[i]->type == VIR_DOMAIN_CONTROLLER_TYPE_SATA) || (def->controllers[i]->type == VIR_DOMAIN_CONTROLLER_TYPE_NVME) || (def->controllers[i]->type == VIR_DOMAIN_CONTROLLER_TYPE_SCSI) || + (def->controllers[i]->type == VIR_DOMAIN_CONTROLLER_TYPE_VIRTIO_SERIAL) || ((def->controllers[i]->type == VIR_DOMAIN_CONTROLLER_TYPE_USB) && (def->controllers[i]->model == VIR_DOMAIN_CONTROLLER_MODEL_USB_NEC_XHCI)) || def->controllers[i]->type == VIR_DOMAIN_CONTROLLER_TYPE_ISA) { @@ -242,5 +274,11 @@ int bhyveDomainAssignPCIAddresses(virDomainDef *def, int bhyveDomainAssignAddresses(virDomainDef *def, virDomainObj *obj) { - return bhyveDomainAssignPCIAddresses(def, obj); + if (bhyveDomainAssignVirtioSerialAddresses(def) < 0) + return -1; + + if (bhyveDomainAssignPCIAddresses(def, obj) < 0) + return -1; + + return 0; } diff --git a/src/bhyve/bhyve_domain.c b/src/bhyve/bhyve_domain.c index 4594d7673f..e64be1f4a7 100644 --- a/src/bhyve/bhyve_domain.c +++ b/src/bhyve/bhyve_domain.c @@ -89,6 +89,9 @@ bhyveDomainDefPostParse(virDomainDef *def, { struct _bhyveConn *driver = opaque; g_autoptr(virCaps) caps = bhyveDriverGetCapabilities(driver); + size_t i, virtio_channels = 0; + size_t virtio_serial_controllers = 0, virtio_serial_existing_controllers = 0; + size_t virtio_serial_controllers_to_create = 0; if (!caps) return -1; @@ -141,6 +144,27 @@ bhyveDomainDefPostParse(virDomainDef *def, def->os.loader->type = VIR_DOMAIN_LOADER_TYPE_ROM; } + for (i = 0; i < def->nchannels; i++) + if (def->channels[i]->targetType == VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_VIRTIO) + virtio_channels++; + + for (i = 0; i < def->ncontrollers; i++) + if (def->controllers[i]->type == VIR_DOMAIN_CONTROLLER_TYPE_VIRTIO_SERIAL) + virtio_serial_existing_controllers++; + + /* bhyve supports 16 ports per virtio-console device */ + virtio_serial_controllers = (virtio_channels / 16) + (virtio_channels % 16 != 0); + if (virtio_serial_controllers > virtio_serial_existing_controllers) { + virtio_serial_controllers_to_create = virtio_serial_controllers - virtio_serial_existing_controllers; + + for (i = 0; i < virtio_serial_controllers_to_create; i++) { + virDomainControllerDef *cont; + + cont = virDomainDefAddController(def, VIR_DOMAIN_CONTROLLER_TYPE_VIRTIO_SERIAL, -1, -1); + cont->opts.vioserial.ports = 16; + } + } + return 0; } @@ -225,6 +249,10 @@ bhyveDomainDeviceDefPostParse(virDomainDeviceDef *dev, virReportError(VIR_ERR_XML_ERROR, "%s", _("pci-root and pcie-root controllers should have index 0")); return -1; + } else if (cont->type == VIR_DOMAIN_CONTROLLER_TYPE_VIRTIO_SERIAL) { + /* bhyve supports 16 ports per controller */ + if (cont->opts.vioserial.ports == -1) + cont->opts.vioserial.ports = 16; } } @@ -287,13 +315,21 @@ bhyveDomainDeviceDefValidate(const virDomainDeviceDef *dev, void *parseOpaque G_GNUC_UNUSED) { switch (dev->type) { - case VIR_DOMAIN_DEVICE_CONTROLLER: - if (dev->data.controller->type == VIR_DOMAIN_CONTROLLER_TYPE_ISA && - dev->data.controller->idx != 0) { + case VIR_DOMAIN_DEVICE_CONTROLLER: { + virDomainControllerDef *controller = dev->data.controller; + + if (controller->type == VIR_DOMAIN_CONTROLLER_TYPE_ISA && + controller->idx != 0) { return -1; + } else if (controller->type == VIR_DOMAIN_CONTROLLER_TYPE_VIRTIO_SERIAL) { + if (controller->opts.vioserial.ports > 16) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Bhyve virtio-serial controller supports up to 16 ports")); + return -1; + } } break; - + } case VIR_DOMAIN_DEVICE_RNG: if (dev->data.rng->model == VIR_DOMAIN_RNG_MODEL_VIRTIO) { if (dev->data.rng->backend == VIR_DOMAIN_RNG_BACKEND_RANDOM) { diff --git a/src/bhyve/bhyve_process.c b/src/bhyve/bhyve_process.c index 1d436da609..711d1b66ea 100644 --- a/src/bhyve/bhyve_process.c +++ b/src/bhyve/bhyve_process.c @@ -473,6 +473,7 @@ virBhyveProcessStop(struct _bhyveConn *driver, virDomainObj *vm, virDomainShutoffReason reason) { + size_t i = 0; int ret = -1; g_autoptr(virCommand) cmd = NULL; bhyveDomainObjPrivate *priv = vm->privateData; @@ -512,6 +513,19 @@ virBhyveProcessStop(struct _bhyveConn *driver, } } + /* UNIX sockets cleanup */ + for (i = 0; i < vm->def->nchannels; i++) { + virDomainChrDef *channel = vm->def->channels[i]; + + if (channel->source->type != VIR_DOMAIN_CHR_TYPE_UNIX) + continue; + if (channel->targetType != VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_VIRTIO) + continue; + + if (virFileExists(channel->source->data.nix.path)) + virFileRemove(channel->source->data.nix.path, 0, 0); + } + ret = 0; virCloseCallbacksDomainRemove(vm, NULL, bhyveProcessAutoDestroy); diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-virtio-console-mixed-addr.args b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-virtio-console-mixed-addr.args new file mode 100644 index 0000000000..0942e75c1e --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-virtio-console-mixed-addr.args @@ -0,0 +1,10 @@ +bhyve \ +-c 1 \ +-m 214 \ +-u \ +-H \ +-P \ +-s 0:0,hostbridge \ +-s 2:0,virtio-console,org.qemu.guest_agent.0=/var/run/libvirt/bhyve/bhyve.agent,org.qemu.guest_agent.1=/var/run/libvirt/bhyve/bhyve.agent-2 \ +-s 3:0,ahci,hd:/tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-virtio-console-mixed-addr.ldargs b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-virtio-console-mixed-addr.ldargs new file mode 100644 index 0000000000..5905f4b3e6 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-virtio-console-mixed-addr.ldargs @@ -0,0 +1,4 @@ +bhyveload \ +-m 214 \ +-d /tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-virtio-console-mixed-addr.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-virtio-console-mixed-addr.xml new file mode 100644 index 0000000000..7df574916e --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-virtio-console-mixed-addr.xml @@ -0,0 +1,26 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent'/> + <target type='virtio' name='org.qemu.guest_agent.0'/> + <address type='virtio-serial' controller='0' bus='0' port='1'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-2'/> + <target type='virtio' name='org.qemu.guest_agent.1'/> + </channel> + </devices> +</domain> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-addr.args b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-addr.args new file mode 100644 index 0000000000..b44c7b44c6 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-addr.args @@ -0,0 +1,10 @@ +bhyve \ +-c 1 \ +-m 214 \ +-u \ +-H \ +-P \ +-s 0:0,hostbridge \ +-s 1:0,ahci,hd:/tmp/freebsd.img \ +-s 2:0,virtio-console,org.qemu.guest_agent.0=/var/run/libvirt/bhyve/bhyve.agent \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-addr.ldargs b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-addr.ldargs new file mode 100644 index 0000000000..5905f4b3e6 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-addr.ldargs @@ -0,0 +1,4 @@ +bhyveload \ +-m 214 \ +-d /tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-addr.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-addr.xml new file mode 100644 index 0000000000..519fec6b85 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-addr.xml @@ -0,0 +1,25 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> + </controller> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent'/> + <target type='virtio' name='org.qemu.guest_agent.0'/> + <address type='virtio-serial' controller='0' bus='0' port='1'/> + </channel> + </devices> +</domain> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-controllers.args b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-controllers.args new file mode 100644 index 0000000000..939e5d6a86 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-controllers.args @@ -0,0 +1,11 @@ +bhyve \ +-c 1 \ +-m 214 \ +-u \ +-H \ +-P \ +-s 0:0,hostbridge \ +-s 2:0,virtio-console,org.qemu.guest_agent.1=/var/run/libvirt/bhyve/bhyve.agent-1 \ +-s 3:0,virtio-console,org.qemu.guest_agent.2=/var/run/libvirt/bhyve/bhyve.agent-2 \ +-s 4:0,ahci,hd:/tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-controllers.ldargs b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-controllers.ldargs new file mode 100644 index 0000000000..5905f4b3e6 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-controllers.ldargs @@ -0,0 +1,4 @@ +bhyveload \ +-m 214 \ +-d /tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-controllers.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-controllers.xml new file mode 100644 index 0000000000..2d82addb12 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-controllers.xml @@ -0,0 +1,31 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <controller type='virtio-serial' index='0' ports='4'> + </controller> + <controller type='virtio-serial' index='1'> + </controller> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-1'/> + <target type='virtio' name='org.qemu.guest_agent.1'/> + <address type='virtio-serial' controller='0' bus='0' port='1'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-2'/> + <target type='virtio' name='org.qemu.guest_agent.2'/> + <address type='virtio-serial' controller='1' bus='0' port='1'/> + </channel> + </devices> +</domain> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-multiple-controllers.args b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-multiple-controllers.args new file mode 100644 index 0000000000..e3d6b6d4a7 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-multiple-controllers.args @@ -0,0 +1,11 @@ +bhyve \ +-c 1 \ +-m 214 \ +-u \ +-H \ +-P \ +-s 0:0,hostbridge \ +-s 2:0,virtio-console,org.qemu.guest_agent.1=/var/run/libvirt/bhyve/bhyve.agent-1,org.qemu.guest_agent.2=/var/run/libvirt/bhyve/bhyve.agent-2,org.qemu.guest_agent.3=/var/run/libvirt/bhyve/bhyve.agent-3,org.qemu.guest_agent.4=/var/run/libvirt/bhyve/bhyve.agent-4,org.qemu.guest_agent.5=/var/run/libvirt/bhyve/bhyve.agent-5,org.qemu.guest_agent.6=/var/run/libvirt/bhyve/bhyve.agent-6,org.qemu.guest_agent.7=/var/run/libvirt/bhyve/bhyve.agent-7,org.qemu.guest_agent.8=/var/run/libvirt/bhyve/bhyve.agent-8,org.qemu.guest_agent.9=/var/run/libvirt/bhyve/bhyve.agent-9,org.qemu.guest_agent.10=/var/run/libvirt/bhyve/bhyve.agent-10,org.qemu.guest_agent.11=/var/run/libvirt/bhyve/bhyve.agent-11,org.qemu.guest_agent.12=/var/run/libvirt/bhyve/bhyve.agent-12,org.qemu.guest_agent.13=/var/run/libvirt/bhyve/bhyve.agent-13,org.qemu.guest_agent.14=/var/run/libvirt/bhyve/bhyve.agent-14,org.qemu.guest_agent.15=/var/run/libvirt/bhyve/bhyve.agent-15 \ +-s 3:0,virtio-console,org.qemu.guest_agent.16=/var/run/libvirt/bhyve/bhyve.agent-16,org.qemu.guest_agent.17=/var/run/libvirt/bhyve/bhyve.agent-17,org.qemu.guest_agent.18=/var/run/libvirt/bhyve/bhyve.agent-18 \ +-s 4:0,ahci,hd:/tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-multiple-controllers.ldargs b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-multiple-controllers.ldargs new file mode 100644 index 0000000000..5905f4b3e6 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-multiple-controllers.ldargs @@ -0,0 +1,4 @@ +bhyveload \ +-m 214 \ +-d /tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-multiple-controllers.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-multiple-controllers.xml new file mode 100644 index 0000000000..b8dc39ed83 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-multiple-controllers.xml @@ -0,0 +1,89 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-1'/> + <target type='virtio' name='org.qemu.guest_agent.1'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-2'/> + <target type='virtio' name='org.qemu.guest_agent.2'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-3'/> + <target type='virtio' name='org.qemu.guest_agent.3'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-4'/> + <target type='virtio' name='org.qemu.guest_agent.4'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-5'/> + <target type='virtio' name='org.qemu.guest_agent.5'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-6'/> + <target type='virtio' name='org.qemu.guest_agent.6'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-7'/> + <target type='virtio' name='org.qemu.guest_agent.7'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-8'/> + <target type='virtio' name='org.qemu.guest_agent.8'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-9'/> + <target type='virtio' name='org.qemu.guest_agent.9'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-10'/> + <target type='virtio' name='org.qemu.guest_agent.10'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-11'/> + <target type='virtio' name='org.qemu.guest_agent.11'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-12'/> + <target type='virtio' name='org.qemu.guest_agent.12'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-13'/> + <target type='virtio' name='org.qemu.guest_agent.13'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-14'/> + <target type='virtio' name='org.qemu.guest_agent.14'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-15'/> + <target type='virtio' name='org.qemu.guest_agent.15'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-16'/> + <target type='virtio' name='org.qemu.guest_agent.16'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-17'/> + <target type='virtio' name='org.qemu.guest_agent.17'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-18'/> + <target type='virtio' name='org.qemu.guest_agent.18'/> + </channel> + </devices> +</domain> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-too-many-ports.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-too-many-ports.xml new file mode 100644 index 0000000000..04ec8abc43 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console-too-many-ports.xml @@ -0,0 +1,25 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <controller type='virtio-serial' index='0' ports='17'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </controller> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent'/> + <target type='virtio' name='org.qemu.guest_agent.0'/> + <address type='virtio-serial' controller='0' bus='0' port='1'/> + </channel> + </devices> +</domain> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console.args b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console.args new file mode 100644 index 0000000000..66f4905f65 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console.args @@ -0,0 +1,10 @@ +bhyve \ +-c 1 \ +-m 214 \ +-u \ +-H \ +-P \ +-s 0:0,hostbridge \ +-s 2:0,virtio-console,org.qemu.guest_agent.0=/var/run/libvirt/bhyve/bhyve.agent \ +-s 3:0,ahci,hd:/tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console.ldargs b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console.ldargs new file mode 100644 index 0000000000..5905f4b3e6 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console.ldargs @@ -0,0 +1,4 @@ +bhyveload \ +-m 214 \ +-d /tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console.xml new file mode 100644 index 0000000000..f7178849b9 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-virtio-console.xml @@ -0,0 +1,21 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent'/> + <target type='virtio' name='org.qemu.guest_agent.0'/> + </channel> + </devices> +</domain> diff --git a/tests/bhyvexml2argvtest.c b/tests/bhyvexml2argvtest.c index b7749fec6f..a01c88d8bc 100644 --- a/tests/bhyvexml2argvtest.c +++ b/tests/bhyvexml2argvtest.c @@ -289,6 +289,12 @@ mymain(void) DO_TEST_FAILURE("slirp-ip"); DO_TEST("virtio-scsi"); DO_TEST("vcpupin"); + DO_TEST("virtio-console"); + DO_TEST("virtio-console-addr"); + DO_TEST("2-virtio-console-mixed-addr"); + DO_TEST("virtio-console-multiple-controllers"); + DO_TEST("virtio-console-controllers"); + DO_TEST_FAILURE("virtio-console-too-many-ports"); /* Address allocation tests */ DO_TEST("addr-single-sata-disk"); diff --git a/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-2-virtio-console-mixed-addr.xml b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-2-virtio-console-mixed-addr.xml new file mode 100644 index 0000000000..7243d95d0a --- /dev/null +++ b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-2-virtio-console-mixed-addr.xml @@ -0,0 +1,40 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='file' device='disk'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <controller type='pci' index='0' model='pci-root'/> + <controller type='virtio-serial' index='0' ports='16'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </controller> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </controller> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent'/> + <target type='virtio' name='org.qemu.guest_agent.0'/> + <address type='virtio-serial' controller='0' bus='0' port='1'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-2'/> + <target type='virtio' name='org.qemu.guest_agent.1'/> + <address type='virtio-serial' controller='0' bus='0' port='2'/> + </channel> + </devices> +</domain> diff --git a/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-virtio-console-addr.xml b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-virtio-console-addr.xml new file mode 100644 index 0000000000..08735831b1 --- /dev/null +++ b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-virtio-console-addr.xml @@ -0,0 +1,35 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='file' device='disk'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> + </controller> + <controller type='pci' index='0' model='pci-root'/> + <controller type='virtio-serial' index='0' ports='16'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </controller> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent'/> + <target type='virtio' name='org.qemu.guest_agent.0'/> + <address type='virtio-serial' controller='0' bus='0' port='1'/> + </channel> + </devices> +</domain> diff --git a/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-virtio-console-controllers.xml b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-virtio-console-controllers.xml new file mode 100644 index 0000000000..1fd1e1dfb1 --- /dev/null +++ b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-virtio-console-controllers.xml @@ -0,0 +1,43 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='file' device='disk'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <controller type='virtio-serial' index='0' ports='4'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </controller> + <controller type='virtio-serial' index='1' ports='16'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </controller> + <controller type='pci' index='0' model='pci-root'/> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </controller> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-1'/> + <target type='virtio' name='org.qemu.guest_agent.1'/> + <address type='virtio-serial' controller='0' bus='0' port='1'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-2'/> + <target type='virtio' name='org.qemu.guest_agent.2'/> + <address type='virtio-serial' controller='1' bus='0' port='1'/> + </channel> + </devices> +</domain> diff --git a/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-virtio-console-multiple-controllers.xml b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-virtio-console-multiple-controllers.xml new file mode 100644 index 0000000000..241828ef0c --- /dev/null +++ b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-virtio-console-multiple-controllers.xml @@ -0,0 +1,123 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='file' device='disk'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <controller type='pci' index='0' model='pci-root'/> + <controller type='virtio-serial' index='0' ports='16'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </controller> + <controller type='virtio-serial' index='1' ports='16'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </controller> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> + </controller> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-1'/> + <target type='virtio' name='org.qemu.guest_agent.1'/> + <address type='virtio-serial' controller='0' bus='0' port='1'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-2'/> + <target type='virtio' name='org.qemu.guest_agent.2'/> + <address type='virtio-serial' controller='0' bus='0' port='2'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-3'/> + <target type='virtio' name='org.qemu.guest_agent.3'/> + <address type='virtio-serial' controller='0' bus='0' port='3'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-4'/> + <target type='virtio' name='org.qemu.guest_agent.4'/> + <address type='virtio-serial' controller='0' bus='0' port='4'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-5'/> + <target type='virtio' name='org.qemu.guest_agent.5'/> + <address type='virtio-serial' controller='0' bus='0' port='5'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-6'/> + <target type='virtio' name='org.qemu.guest_agent.6'/> + <address type='virtio-serial' controller='0' bus='0' port='6'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-7'/> + <target type='virtio' name='org.qemu.guest_agent.7'/> + <address type='virtio-serial' controller='0' bus='0' port='7'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-8'/> + <target type='virtio' name='org.qemu.guest_agent.8'/> + <address type='virtio-serial' controller='0' bus='0' port='8'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-9'/> + <target type='virtio' name='org.qemu.guest_agent.9'/> + <address type='virtio-serial' controller='0' bus='0' port='9'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-10'/> + <target type='virtio' name='org.qemu.guest_agent.10'/> + <address type='virtio-serial' controller='0' bus='0' port='10'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-11'/> + <target type='virtio' name='org.qemu.guest_agent.11'/> + <address type='virtio-serial' controller='0' bus='0' port='11'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-12'/> + <target type='virtio' name='org.qemu.guest_agent.12'/> + <address type='virtio-serial' controller='0' bus='0' port='12'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-13'/> + <target type='virtio' name='org.qemu.guest_agent.13'/> + <address type='virtio-serial' controller='0' bus='0' port='13'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-14'/> + <target type='virtio' name='org.qemu.guest_agent.14'/> + <address type='virtio-serial' controller='0' bus='0' port='14'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-15'/> + <target type='virtio' name='org.qemu.guest_agent.15'/> + <address type='virtio-serial' controller='0' bus='0' port='15'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-16'/> + <target type='virtio' name='org.qemu.guest_agent.16'/> + <address type='virtio-serial' controller='1' bus='0' port='1'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-17'/> + <target type='virtio' name='org.qemu.guest_agent.17'/> + <address type='virtio-serial' controller='1' bus='0' port='2'/> + </channel> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent-18'/> + <target type='virtio' name='org.qemu.guest_agent.18'/> + <address type='virtio-serial' controller='1' bus='0' port='3'/> + </channel> + </devices> +</domain> diff --git a/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-virtio-console.xml b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-virtio-console.xml new file mode 100644 index 0000000000..ec82054df7 --- /dev/null +++ b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-virtio-console.xml @@ -0,0 +1,35 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='file' device='disk'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <controller type='pci' index='0' model='pci-root'/> + <controller type='virtio-serial' index='0' ports='16'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </controller> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </controller> + <channel type='unix'> + <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent'/> + <target type='virtio' name='org.qemu.guest_agent.0'/> + <address type='virtio-serial' controller='0' bus='0' port='1'/> + </channel> + </devices> +</domain> diff --git a/tests/bhyvexml2xmltest.c b/tests/bhyvexml2xmltest.c index 950aaea672..bcbd808679 100644 --- a/tests/bhyvexml2xmltest.c +++ b/tests/bhyvexml2xmltest.c @@ -133,6 +133,12 @@ mymain(void) DO_TEST_DIFFERENT("slirp"); DO_TEST_DIFFERENT("virtio-scsi"); DO_TEST_DIFFERENT("numa"); + DO_TEST_DIFFERENT("virtio-console"); + DO_TEST_DIFFERENT("virtio-console-addr"); + DO_TEST_DIFFERENT("2-virtio-console-mixed-addr"); + DO_TEST_DIFFERENT("virtio-console-multiple-controllers"); + DO_TEST_DIFFERENT("virtio-console-controllers"); + DO_TEST_FAILURE("virtio-console-too-many-ports"); /* Address allocation tests */ DO_TEST_DIFFERENT("addr-single-sata-disk"); -- 2.52.0

1 0

[PATCH] remote: Move secrets encryption dependency to a systemd drop-in
by Arun Menon 03 Apr '26

03 Apr '26

From: Arun Menon <armenon(a)redhat.com> The monolithic libvirtd.service currently has a dependency on virt-secret-init-encryption.service. This causes libvirtd to fail to start on systems where the secret driver is not installed or enabled, as systemd cannot satisfy the Requires= / After= units or the LoadCredentialEncrypted= path. See below, Requires=virt-secret-init-encryption.service After=virt-secret-init-encryption.service LoadCredentialEncrypted=secrets-encryption-key:@localstatedir@/lib/libvirt/secrets/secrets-encryption-key This patch decouples the secrets encryption logic from the main libvirtd service file. It is moved into a new systemd drop-in (50-libvirtd-secret.conf) which is only installed when libvirt is built with secret driver support. The override snippet is added to the daemon-driver-secret package. Fixes: 97758bc9a0b1fccf8c0009308658f1204b113b89 Signed-off-by: Arun Menon <armenon(a)redhat.com> Fix-Suggested-by: Andrea Bolognani <abologna(a)redhat.com> --- libvirt.spec.in | 2 ++ src/remote/libvirtd-secret.conf.in | 7 +++++++ src/remote/libvirtd.service.in | 4 ---- src/remote/meson.build | 15 +++++++++++++++ 4 files changed, 24 insertions(+), 4 deletions(-) create mode 100644 src/remote/libvirtd-secret.conf.in diff --git a/libvirt.spec.in b/libvirt.spec.in index 00316a03f2..d840c829d1 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -2259,6 +2259,8 @@ exit 0 %{_unitdir}/virtsecretd.socket %{_unitdir}/virtsecretd-ro.socket %{_unitdir}/virtsecretd-admin.socket +%dir %attr(0700, root, root) %{_unitdir}/libvirtd.service.d/ +%{_unitdir}/libvirtd.service.d/50-libvirtd-secret.conf %attr(0755, root, root) %{_sbindir}/virtsecretd %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/secrets/ %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/secrets/ diff --git a/src/remote/libvirtd-secret.conf.in b/src/remote/libvirtd-secret.conf.in new file mode 100644 index 0000000000..d64a6cf63e --- /dev/null +++ b/src/remote/libvirtd-secret.conf.in @@ -0,0 +1,7 @@ +[Unit] +Requires=@service@ +After=@service@ + +[Service] +Environment=SECRETS_ENCRYPTION_KEY=%d/secrets-encryption-key +LoadCredentialEncrypted=secrets-encryption-key:@localstatedir@/lib/libvirt/secrets/secrets-encryption-key diff --git a/src/remote/libvirtd.service.in b/src/remote/libvirtd.service.in index 7965010a0a..b0a062e885 100644 --- a/src/remote/libvirtd.service.in +++ b/src/remote/libvirtd.service.in @@ -12,8 +12,6 @@ After=libvirtd.socket After=libvirtd-ro.socket After=libvirtd-admin.socket Requires=virtlogd.socket -Requires=virt-secret-init-encryption.service -After=virt-secret-init-encryption.service Wants=virtlockd.socket After=virtlogd.socket After=virtlockd.socket @@ -31,8 +29,6 @@ Conflicts=xendomains.service Type=notify-reload Environment=LIBVIRTD_ARGS="--timeout 120" EnvironmentFile=-@initconfdir@/libvirtd -Environment=SECRETS_ENCRYPTION_KEY=%d/secrets-encryption-key -LoadCredentialEncrypted=secrets-encryption-key:@localstatedir@/lib/libvirt/secrets/secrets-encryption-key ExecStart=@sbindir@/libvirtd $LIBVIRTD_ARGS ExecReload=/bin/kill -HUP $MAINPID KillMode=process diff --git a/src/remote/meson.build b/src/remote/meson.build index e503263266..f1c521444f 100644 --- a/src/remote/meson.build +++ b/src/remote/meson.build @@ -343,4 +343,19 @@ if conf.has('WITH_SASL') ) endif +# The monolithic libvirt daemon only attempts to load the +# secrets encryption credentials if the secret driver is enabled +if conf.has('WITH_SECRETS') + secret_dropin_conf = configuration_data() + secret_dropin_conf.set('service', 'virt-secret-init-encryption.service') + secret_dropin_conf.set('localstatedir', localstatedir) + + configure_file( + input: 'libvirtd-secret.conf.in', + output: '50-libvirtd-secret.conf', + configuration: secret_dropin_conf, + install_dir: unitdir / 'libvirtd.service.d' + ) +endif + remote_inc_dir = include_directories('.') -- 2.53.0

2 1

[PATCH v3] qemu: Store tapfd path in domstatus XML
by Wesley Hershberger 02 Apr '26

02 Apr '26

Introduce a read-only `tapfd` element for direct interfaces (macvtap), which contains the path to the backing tapfd for that interface (e.g. `/dev/tapXX`). The element is only included when the domain is being formatted for internal consumption (VIR_DOMAIN_DEF_FORMAT_STATUS) and is not accepted in user-provided XML (!VIR_DOMAIN_DEF_PARSE_INACTIVE). This is used by the AppArmor security driver when re-generating profiles. Partial-Resolves: https://gitlab.com/libvirt/libvirt/-/issues/692 Bug-Ubuntu: https://bugs.launchpad.net/bugs/2126574 Signed-off-by: Wesley Hershberger <wesley.hershberger(a)canonical.com> --- Resending this patch as I've not recieved a response on my previous submission. Fixed the bug URL in the commit message as I missed that feedback item on my last mail. This submission is a partial revision of a previous series with a fix for the macvtap component of gitlab#692 [1][2]. I haven't had bandwidth to resolve the blockcommit component since the complexity there is somewhat higher (and is also lower priority for us). I kept the separate `tapfd` element rather than reusing the existing `backend` element (virDomainNetBackend.tap) to avoid making a user-visible change [3]. I'd be happy to use the existing field instead if you think that would make more sense. I opted not to introduce/modify a security driver API for FD+path as the patch here is sufficient to resolve the bug, but would be willing to do so if that would make this change more palatable. I've opened a MR to libvirt-tck with test cases that demonstrate the bugs that this fixes [4]. apparmor/110-macvtap.t passes with this patch applied. Thanks for the reviews and continued consideration. ~Wesley [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/UNNB… [2] https://gitlab.com/libvirt/libvirt/-/issues/692 [3] https://libvirt.org/formatdomain.html#setting-network-backend-specific-opti… [4] https://gitlab.com/libvirt/libvirt-tck/-/merge_requests/73 --- Changes in v3: - Fix buglink in commit message - Link to v2: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/IPEB… Changes in v2: - Drop `virt-aa-helper: Ask for no deny rule...` as it was applied - Drop `qemu: Store blockcommit permissions...` due to unresolved concerns - Pass tapfd path through netdef instead of resolving from fd - Link to v1: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/UNNB… --- src/conf/domain_conf.c | 8 ++++++++ src/conf/domain_conf.h | 1 + src/hypervisor/domain_interface.c | 2 +- src/lxc/lxc_process.c | 1 + src/qemu/qemu_interface.c | 1 + src/security/security_apparmor.c | 1 + src/security/virt-aa-helper.c | 5 +++++ src/util/virnetdevmacvlan.c | 18 +++++++++++------- src/util/virnetdevmacvlan.h | 4 +++- 9 files changed, 32 insertions(+), 9 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 03a05366e1..9714a1e141 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -2971,6 +2971,7 @@ virDomainNetDefFree(virDomainNetDef *def) g_free(def->virtio); g_free(def->coalesce); g_free(def->sourceDev); + g_free(def->tapfdpath); virNetDevIPInfoClear(&def->guestIP); virNetDevIPInfoClear(&def->hostIP); @@ -10634,6 +10635,10 @@ virDomainNetDefParseXML(virDomainXMLOption *xmlopt, return NULL; } + if (!(flags & VIR_DOMAIN_DEF_PARSE_INACTIVE)) { + def->tapfdpath = virXPathString("string(./tapfd/@path)", ctxt); + } + if (virNetworkPortOptionsParseXML(ctxt, &def->isolatedPort) < 0) return NULL; @@ -26004,6 +26009,9 @@ virDomainNetDefFormat(virBuffer *buf, if (def->mtu) virBufferAsprintf(buf, "<mtu size='%u'/>\n", def->mtu); + if (def->tapfdpath && (flags & VIR_DOMAIN_DEF_FORMAT_STATUS)) + virBufferAsprintf(buf, "<tapfd path='%s'/>\n", def->tapfdpath); + virDomainNetDefCoalesceFormatXML(buf, def->coalesce); virDomainDeviceInfoFormat(buf, &def->info, flags | VIR_DOMAIN_DEF_FORMAT_ALLOW_BOOT diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index e63230beec..3bb4de6274 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -1212,6 +1212,7 @@ struct _virDomainNetDef { char *downscript; char *domain_name; /* backend domain name */ char *ifname; /* interface name on the host (<target dev='x'/>) */ + char *tapfdpath; /* Path in /dev for macvtap (<tapfd path="/dev/tapXX">) */ virTristateBool managed_tap; virNetDevIPInfo hostIP; char *ifname_guest_actual; diff --git a/src/hypervisor/domain_interface.c b/src/hypervisor/domain_interface.c index 5bc698d272..37e3d453a0 100644 --- a/src/hypervisor/domain_interface.c +++ b/src/hypervisor/domain_interface.c @@ -111,7 +111,7 @@ virDomainInterfaceEthernetConnect(virDomainDef *def, if (virNetDevMacVLanIsMacvtap(net->ifname)) { auditdev = net->ifname; - if (virNetDevMacVLanTapOpen(net->ifname, tapfd, tapfdSize) < 0) + if (virNetDevMacVLanTapOpen(net->ifname, tapfd, tapfdSize, &net->tapfdpath) < 0) goto cleanup; if (virNetDevMacVLanTapSetup(tapfd, tapfdSize, virDomainInterfaceIsVnetCompatModel(net)) < 0) { diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c index 1bca9e8dae..c731b28871 100644 --- a/src/lxc/lxc_process.c +++ b/src/lxc/lxc_process.c @@ -379,6 +379,7 @@ virLXCProcessSetupInterfaceDirect(virLXCDriver *driver, VIR_NETDEV_VPORT_PROFILE_OP_CREATE, cfg->stateDir, NULL, 0, + &net->tapfdpath, macvlan_create_flags) < 0) return NULL; diff --git a/src/qemu/qemu_interface.c b/src/qemu/qemu_interface.c index 23a23d201a..edc53d53b3 100644 --- a/src/qemu/qemu_interface.c +++ b/src/qemu/qemu_interface.c @@ -81,6 +81,7 @@ qemuInterfaceDirectConnect(virDomainDef *def, &res_ifname, vmop, cfg->stateDir, tapfd, tapfdSize, + &net->tapfdpath, macvlan_create_flags) < 0) goto cleanup; diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index 40f13ec1a5..3ff80e1dc9 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -156,6 +156,7 @@ load_profile(virSecurityManager *mgr G_GNUC_UNUSED, if (virDomainDefFormatInternal(def, NULL, &buf, VIR_DOMAIN_DEF_FORMAT_SECURE | + VIR_DOMAIN_DEF_FORMAT_STATUS | VIR_DOMAIN_DEF_FORMAT_VOLUME_TRANSLATED) < 0) return -1; diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index e932e79dab..60e03c2ce8 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1192,6 +1192,11 @@ get_files(vahControl * ctl) vhu->type) != 0) return -1; } + + if (net->tapfdpath) { + if (vah_add_file(&buf, net->tapfdpath, "rwk") != 0) + return -1; + } } for (i = 0; i < ctl->def->nmems; i++) { diff --git a/src/util/virnetdevmacvlan.c b/src/util/virnetdevmacvlan.c index cde9d70eef..fcf63e08ff 100644 --- a/src/util/virnetdevmacvlan.c +++ b/src/util/virnetdevmacvlan.c @@ -152,24 +152,24 @@ int virNetDevMacVLanDelete(const char *ifname) int virNetDevMacVLanTapOpen(const char *ifname, int *tapfd, - size_t tapfdSize) + size_t tapfdSize, + char **tapname) { int retries = 10; int ret = -1; int ifindex; size_t i = 0; - g_autofree char *tapname = NULL; if (virNetDevGetIndex(ifname, &ifindex) < 0) return -1; - tapname = g_strdup_printf("/dev/tap%d", ifindex); + *tapname = g_strdup_printf("/dev/tap%d", ifindex); for (i = 0; i < tapfdSize; i++) { int fd = -1; while (fd < 0) { - if ((fd = open(tapname, O_RDWR)) >= 0) { + if ((fd = open(*tapname, O_RDWR)) >= 0) { tapfd[i] = fd; } else if (retries-- > 0) { /* may need to wait for udev to be done */ @@ -178,7 +178,7 @@ virNetDevMacVLanTapOpen(const char *ifname, /* However, if haven't succeeded, quit. */ virReportSystemError(errno, _("cannot open macvtap tap device %1$s"), - tapname); + *tapname); goto cleanup; } } @@ -188,6 +188,7 @@ virNetDevMacVLanTapOpen(const char *ifname, cleanup: if (ret < 0) { + g_free(*tapname); while (i--) VIR_FORCE_CLOSE(tapfd[i]); } @@ -659,6 +660,7 @@ virNetDevMacVLanCreateWithVPortProfile(const char *ifnameRequested, char *stateDir, int *tapfd, size_t tapfdSize, + char **tapfdpath, unsigned int flags) { g_autofree char *ifname = NULL; @@ -729,7 +731,7 @@ virNetDevMacVLanCreateWithVPortProfile(const char *ifnameRequested, } if (flags & VIR_NETDEV_MACVLAN_CREATE_WITH_TAP) { - if (virNetDevMacVLanTapOpen(ifname, tapfd, tapfdSize) < 0) + if (virNetDevMacVLanTapOpen(ifname, tapfd, tapfdSize, tapfdpath) < 0) goto disassociate_exit; if (virNetDevMacVLanTapSetup(tapfd, tapfdSize, vnet_hdr) < 0) @@ -888,7 +890,8 @@ int virNetDevMacVLanDelete(const char *ifname G_GNUC_UNUSED) int virNetDevMacVLanTapOpen(const char *ifname G_GNUC_UNUSED, int *tapfd G_GNUC_UNUSED, - size_t tapfdSize G_GNUC_UNUSED) + size_t tapfdSize G_GNUC_UNUSED, + char **tapname G_GNUC_UNUSED) { virReportSystemError(ENOSYS, "%s", _("Cannot create macvlan devices on this platform")); @@ -917,6 +920,7 @@ int virNetDevMacVLanCreateWithVPortProfile(const char *ifname G_GNUC_UNUSED, char *stateDir G_GNUC_UNUSED, int *tapfd G_GNUC_UNUSED, size_t tapfdSize G_GNUC_UNUSED, + char **tapfdpath G_GNUC_UNUSED, unsigned int unused_flags G_GNUC_UNUSED) { virReportSystemError(ENOSYS, "%s", diff --git a/src/util/virnetdevmacvlan.h b/src/util/virnetdevmacvlan.h index 31e4804cdc..7424b87965 100644 --- a/src/util/virnetdevmacvlan.h +++ b/src/util/virnetdevmacvlan.h @@ -72,13 +72,15 @@ int virNetDevMacVLanCreateWithVPortProfile(const char *ifname, char *stateDir, int *tapfd, size_t tapfdSize, + char **tapfdpath, unsigned int flags) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3) ATTRIBUTE_NONNULL(6) ATTRIBUTE_NONNULL(8) ATTRIBUTE_NONNULL(10) G_GNUC_WARN_UNUSED_RESULT; int virNetDevMacVLanTapOpen(const char *ifname, int *tapfd, - size_t tapfdSize) + size_t tapfdSize, + char **tapname) ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) G_GNUC_WARN_UNUSED_RESULT; --- base-commit: 54f5032e576a886cfb8232abbfa08a2f6e9f9962 change-id: 20260105-apparmor-races-d03238ee4d93 Best regards, -- Wesley Hershberger <wesley.hershberger(a)canonical.com>

1 1

[PATCH] qemu: virtiofs: make fs->sock guard more consistent
by Cole Robinson 02 Apr '26

02 Apr '26

When fs->sock is set, virtiofs is externally managed, and most of qemu_virtiofs.c should do nothing. Some qemu_virtiofs.c functions handle this case, but some require the caller to guard against it. Standardize on making this the responsibility of qemu_virtiofs.c Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- src/qemu/qemu_extdevice.c | 8 +++----- src/qemu/qemu_hotplug.c | 18 ++++++++---------- src/qemu/qemu_virtiofs.c | 9 +++++++++ 3 files changed, 20 insertions(+), 15 deletions(-) diff --git a/src/qemu/qemu_extdevice.c b/src/qemu/qemu_extdevice.c index 28cea52980..6e16c6be29 100644 --- a/src/qemu/qemu_extdevice.c +++ b/src/qemu/qemu_extdevice.c @@ -225,7 +225,7 @@ qemuExtDevicesStart(virQEMUDriver *driver, for (i = 0; i < def->nfss; i++) { virDomainFSDef *fs = def->fss[i]; - if (fs->fsdriver == VIR_DOMAIN_FS_DRIVER_TYPE_VIRTIOFS && !fs->sock) { + if (fs->fsdriver == VIR_DOMAIN_FS_DRIVER_TYPE_VIRTIOFS) { if (qemuVirtioFSStart(driver, vm, fs) < 0) return -1; } @@ -315,8 +315,7 @@ qemuExtDevicesStop(virQEMUDriver *driver, for (i = 0; i < def->nfss; i++) { virDomainFSDef *fs = def->fss[i]; - if (!fs->sock && - fs->fsdriver == VIR_DOMAIN_FS_DRIVER_TYPE_VIRTIOFS) + if (fs->fsdriver == VIR_DOMAIN_FS_DRIVER_TYPE_VIRTIOFS) qemuVirtioFSStop(driver, vm, fs); } @@ -473,8 +472,7 @@ qemuExtDevicesSetupCgroup(virQEMUDriver *driver, for (i = 0; i < def->nfss; i++) { virDomainFSDef *fs = def->fss[i]; - if (!fs->sock && - fs->fsdriver == VIR_DOMAIN_FS_DRIVER_TYPE_VIRTIOFS && + if (fs->fsdriver == VIR_DOMAIN_FS_DRIVER_TYPE_VIRTIOFS && qemuVirtioFSSetupCgroup(vm, fs, cgroup) < 0) return -1; } diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 9439948089..deb02c20be 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -3361,17 +3361,15 @@ qemuDomainAttachFSDevice(virQEMUDriver *driver, if (!(devprops = qemuBuildVHostUserFsDevProps(fs, vm->def, charAlias, priv))) goto cleanup; - if (!fs->sock) { - if (qemuVirtioFSPrepareDomain(driver, fs) < 0) - goto cleanup; + if (qemuVirtioFSPrepareDomain(driver, fs) < 0) + goto cleanup; - if (qemuVirtioFSStart(driver, vm, fs) < 0) - goto cleanup; - started = true; + if (qemuVirtioFSStart(driver, vm, fs) < 0) + goto cleanup; + started = true; - if (qemuVirtioFSSetupCgroup(vm, fs, priv->cgroup) < 0) - goto cleanup; - } + if (qemuVirtioFSSetupCgroup(vm, fs, priv->cgroup) < 0) + goto cleanup; qemuDomainObjEnterMonitor(vm); @@ -5506,7 +5504,7 @@ qemuDomainRemoveFSDevice(virQEMUDriver *driver, if (rc < 0) return -1; - if (!fs->sock && fs->fsdriver == VIR_DOMAIN_FS_DRIVER_TYPE_VIRTIOFS) + if (fs->fsdriver == VIR_DOMAIN_FS_DRIVER_TYPE_VIRTIOFS) qemuVirtioFSStop(driver, vm, fs); if ((idx = virDomainFSDefFind(vm->def, fs)) >= 0) diff --git a/src/qemu/qemu_virtiofs.c b/src/qemu/qemu_virtiofs.c index 91d58703f1..cbc3bc0bc2 100644 --- a/src/qemu/qemu_virtiofs.c +++ b/src/qemu/qemu_virtiofs.c @@ -228,6 +228,9 @@ qemuVirtioFSStart(virQEMUDriver *driver, g_autoptr(domainLogContext) logContext = NULL; int rc; + if (fs->sock) + return 0; + if (!virFileIsExecutable(fs->binary)) { virReportError(VIR_ERR_INTERNAL_ERROR, _("virtiofsd binary '%1$s' is not executable"), @@ -327,6 +330,9 @@ qemuVirtioFSStop(virQEMUDriver *driver G_GNUC_UNUSED, g_autofree char *pidfile = NULL; virErrorPtr orig_err; + if (fs->sock) + return; + virErrorPreserveLast(&orig_err); if (!(pidfile = qemuVirtioFSCreatePidFilename(vm, fs->info.alias))) @@ -361,6 +367,9 @@ qemuVirtioFSSetupCgroup(virDomainObj *vm, pid_t pid = -1; int rc; + if (fs->sock) + return 0; + if (!cgroup) return 0; -- 2.53.0

1 0

[PATCH] qemu: conf: reuse cfg->stateDir when setting cfg->swtpmStateDir
by Cole Robinson 02 Apr '26

02 Apr '26

Use cfg->stateDir rather than duplicating it Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- src/qemu/qemu_conf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index b2ced2baf0..f2f9cc8a21 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -181,7 +181,7 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privileged, cfg->configBaseDir = g_strdup(SYSCONFDIR "/libvirt"); cfg->stateDir = g_strdup_printf("%s/libvirt/qemu", RUNSTATEDIR); - cfg->swtpmStateDir = g_strdup_printf("%s/libvirt/qemu/swtpm", RUNSTATEDIR); + cfg->swtpmStateDir = g_strdup_printf("%s/swtpm", cfg->stateDir); cfg->channelTargetDir = g_strdup_printf("%s/channel", cfg->stateDir); cfg->cacheDir = g_strdup_printf("%s/cache/libvirt/qemu", LOCALSTATEDIR); -- 2.53.0

1 0

[PATCH] qemu: virtiofs: remove unused qemuVirtioFSCreateSocketFilename
by Cole Robinson 02 Apr '26

02 Apr '26

Replaced by qemuDomainGetVHostUserFSSocketPath in e7801a490c Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- Pushed as trivial. src/qemu/qemu_virtiofs.c | 10 ---------- src/qemu/qemu_virtiofs.h | 3 --- 2 files changed, 13 deletions(-) diff --git a/src/qemu/qemu_virtiofs.c b/src/qemu/qemu_virtiofs.c index d192f5ec3c..91d58703f1 100644 --- a/src/qemu/qemu_virtiofs.c +++ b/src/qemu/qemu_virtiofs.c @@ -65,16 +65,6 @@ qemuVirtioFSCreatePidFilename(virDomainObj *vm, } -char * -qemuVirtioFSCreateSocketFilename(virDomainObj *vm, - const char *alias) -{ - qemuDomainObjPrivate *priv = vm->privateData; - - return virFileBuildPath(priv->libDir, alias, "-fs.sock"); -} - - static int qemuVirtioFSOpenChardev(virQEMUDriver *driver, virDomainObj *vm, diff --git a/src/qemu/qemu_virtiofs.h b/src/qemu/qemu_virtiofs.h index 6867f89929..0a6130bfa9 100644 --- a/src/qemu/qemu_virtiofs.h +++ b/src/qemu/qemu_virtiofs.h @@ -22,9 +22,6 @@ char * qemuVirtioFSCreatePidFilename(virDomainObj *vm, const char *alias); -char * -qemuVirtioFSCreateSocketFilename(virDomainObj *vm, - const char *alias); virCommand * qemuVirtioFSBuildCommandLine(virQEMUDriverConfig *cfg, -- 2.53.0

1 0

[PATCH 00/16] qemu: reduce direct usage of cfg->user
by Cole Robinson 02 Apr '26

02 Apr '26

In the qemu driver, cfg->user and cfg->group are `user` and `group` from qemu.conf, the default qemu process user and owner for the security DAC driver. These are driver wide default configuration. They are used throughout driver code for storage access and launching sub processes. However code using cfg->user and cfg->group directly is usually subtly wrong, because these values can be overridden for individual VMs with XML like: <domain> <seclabel type='static' model='dac' relabel='yes'> <label>+1234:+4567</label> </seclabel> </domain> Most of the qemu storage code already gets this right (where these values can also be overridden at the <disk> level). This series fixes many other users by reusing the existing qemuDomainGetImageIds function used by the storage code. https://redhat.atlassian.net/browse/RHEL-119651 Cole Robinson (16): qemu: require non-NULL 'cfg' in qemuDomainGetImageIds() qemu: tweak qemuDomainGetImageIds() argument handling qemu: saveimage: use qemuDomainGetImageIds() qemu: domain taint: use qemuDomainGetImageIds() qemu: migrate to file: use qemuDomainGetImageIds() qemu: core dump: use qemuDomainGetImageIds() qemu: storage stat: use qemuDomainGetImageIds() qemu: tpm: use qemuDomainGetImageIds() qemu: block copy: use qemuDomainGetImageIds() qemu: cpu compare: use qemuDomainGetImageIds() qemu: nvram: use qemuDomainGetImageIds() qemu: simplify qemuProcessPrepareDomainStorage() args qemu: nbdkit: use qemuDomainGetImageIds() qemu: remove qemuDomainOpenFile() TODO comment qemu: don't check virParseOwnershipIds() error qemu: use qemuDomainGetImageIds() in qemuDomainOpenFile() src/qemu/qemu_backup.c | 12 +-- src/qemu/qemu_domain.c | 150 +++++++++++++++++++------------------- src/qemu/qemu_domain.h | 14 ++-- src/qemu/qemu_driver.c | 25 +++++-- src/qemu/qemu_hotplug.c | 6 +- src/qemu/qemu_migration.c | 5 +- src/qemu/qemu_process.c | 20 ++--- src/qemu/qemu_saveimage.c | 5 +- src/qemu/qemu_snapshot.c | 6 +- src/qemu/qemu_tpm.c | 6 +- 10 files changed, 130 insertions(+), 119 deletions(-) -- 2.53.0

1 16

[PATCH v2] qemu: fix potential hang in qemuMigrationSrcCancelUnattended during reconnect
by Denis V. Lunev 02 Apr '26

02 Apr '26

When libvirtd reconnects to a running QEMU process that had an in-progress migration, qemuProcessReconnect first connects the monitor and only later recovers the migration job. During this window the async job is VIR_ASYNC_JOB_NONE, so any MIGRATION status events from QEMU are silently dropped by qemuProcessHandleMigrationStatus. If the migration was already cancelled or completed by QEMU during this window, no further events will be emitted. When qemuMigrationSrcCancelUnattended later restores the async job and calls qemuMigrationSrcCancel with wait=true, the wait loop calls qemuDomainObjWait (virCondWait with no timeout) and blocks forever waiting for an event that will never arrive. Fix this by re-querying QEMU migration state with qemuMigrationAnyRefreshStatus after restoring the async job but before calling qemuMigrationSrcCancel. If QEMU has already reached a terminal state, the cancel is skipped. Signed-off-by: Denis V. Lunev <den(a)openvz.org> CC: Jiri Denemark <jdenemar(a)redhat.com> CC: Peter Krempa <pkrempa(a)redhat.com> CC: Michal Privoznik <mprivozn(a)redhat.com> CC: Efim Shevrin <efim.shevrin(a)virtuozzo.com> --- v1 -> v2: Instead of querying QEMU with query-migrate inside qemuMigrationSrcCancel, use qemuMigrationAnyRefreshStatus in qemuMigrationSrcCancelUnattended after restoring the async job to re-check migration state before the actual cancel. src/qemu/qemu_migration.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index fec808ccfb..a4bd7efa09 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -7330,6 +7330,7 @@ int qemuMigrationSrcCancelUnattended(virDomainObj *vm, virDomainJobObj *oldJob) { + virDomainJobStatus migStatus = VIR_DOMAIN_JOB_STATUS_NONE; bool storage = false; size_t i; @@ -7348,11 +7349,20 @@ qemuMigrationSrcCancelUnattended(virDomainObj *vm, VIR_JOB_NONE); } - /* We're inside a MODIFY job and the restored MIGRATION_OUT async job is - * used only for processing migration events from QEMU. Thus we don't want - * to start a nested job for talking to QEMU. + /* Query the actual migration state from QEMU. The state passed to + * qemuProcessRecoverMigrationOut may be stale: QEMU could have + * reached a terminal state between that initial query and the async + * job restore above, with the corresponding event silently dropped. */ - qemuMigrationSrcCancel(vm, VIR_ASYNC_JOB_NONE, true); + qemuMigrationAnyRefreshStatus(vm, VIR_ASYNC_JOB_NONE, &migStatus); + + if (migStatus != VIR_DOMAIN_JOB_STATUS_CANCELED) { + /* We're inside a MODIFY job and the restored MIGRATION_OUT async + * job is used only for processing migration events from QEMU. + * Thus we don't want to start a nested job for talking to QEMU. + */ + qemuMigrationSrcCancel(vm, VIR_ASYNC_JOB_NONE, true); + } virDomainObjEndAsyncJob(vm); -- 2.51.0

2 2

Re: [PATCH RFC 02/12] migration/qapi: Rename MigrationStats to MigrationRAMStats
by Markus Armbruster 01 Apr '26

01 Apr '26

Cc: correct libvirt list address Peter Xu <peterx(a)redhat.com> writes: > This stats is only about RAM, so make it accurate. This paves way for > statistics for all devices. > > Note that even if this is part of qapi/, this should not be part of ABI of docs/devel/qapi-code-gen.rst section "Compatibility considerations": Since type names are not visible in the Client JSON Protocol, types may be freely renamed. Even certain refactorings are invisible, such as splitting members from one type into a common base type. So, s/should not be/is not/. > at least query-migrate, because the structure is not changed, and this > stats is always reported only under the "ram" section. Why "at least query-migrate"? Do you have other interfaces in mind, or are you just hedging? > Cc: Daniel P. Berrangé <berrange(a)redhat.com> > Cc: Markus Armbruster <armbru(a)redhat.com> > Cc: Libvirt Mailing List <libvir-list(a)redhat.com> > Signed-off-by: Peter Xu <peterx(a)redhat.com> > --- > docs/about/removed-features.rst | 2 +- > qapi/migration.json | 8 ++++---- > migration/migration-stats.h | 2 +- > 3 files changed, 6 insertions(+), 6 deletions(-) > > diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst > index 6f4447993c..7c4f4325f7 100644 > --- a/docs/about/removed-features.rst > +++ b/docs/about/removed-features.rst > @@ -699,7 +699,7 @@ was superseded by ``sections``. > ``query-migrate`` return value member ``skipped`` (removed in 9.1) > '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' > > -Member ``skipped`` of the ``MigrationStats`` struct hasn't been used > +Member ``skipped`` of the ``MigrationRAMStats`` struct hasn't been used > for more than 10 years. Removed with no replacement. Could simply use "of the return value". But this is fine, too. > > ``migrate`` command option ``inc`` (removed in 9.1) > diff --git a/qapi/migration.json b/qapi/migration.json > index 7134d4ce47..cfc6ccee26 100644 > --- a/qapi/migration.json > +++ b/qapi/migration.json > @@ -12,7 +12,7 @@ > { 'include': 'sockets.json' } > > ## > -# @MigrationStats: > +# @MigrationRAMStats: > # > # Detailed migration status. > # > @@ -64,7 +64,7 @@ > # > # Since: 0.14 > ## > -{ 'struct': 'MigrationStats', > +{ 'struct': 'MigrationRAMStats', > 'data': {'transferred': 'int', 'remaining': 'int', 'total': 'int' , > 'duplicate': 'int', > 'normal': 'int', > @@ -209,7 +209,7 @@ > # If this field is not returned, no migration process has been > # initiated > # > -# @ram: `MigrationStats` containing detailed migration status, only > +# @ram: `MigrationRAMStats` containing detailed migration status, only > # returned if status is 'active' or 'completed'(since 1.2) This gets rendered like * ram (MigrationStats, *optional*) -- MigrationStats containing detailed migration status, only returned if status is 'active' or 'completed'(since 1.2) Recommend to rephrase to avoid the repetition. Maybe # @ram: Detailed migration RAM status, only returned if status is # 'active' or 'completed' (since 1.2) Also consider replacing "status" by "statistics". > # > # @xbzrle-cache: `XBZRLECacheStats` containing detailed XBZRLE > @@ -309,7 +309,7 @@ > # Since: 0.14 > ## > { 'struct': 'MigrationInfo', > - 'data': {'*status': 'MigrationStatus', '*ram': 'MigrationStats', > + 'data': {'*status': 'MigrationStatus', '*ram': 'MigrationRAMStats', > '*vfio': 'VfioStats', > '*xbzrle-cache': 'XBZRLECacheStats', > '*total-time': 'int', > diff --git a/migration/migration-stats.h b/migration/migration-stats.h > index c0f50144c9..1153520f7a 100644 > --- a/migration/migration-stats.h > +++ b/migration/migration-stats.h > @@ -27,7 +27,7 @@ > > /* > * These are the ram migration statistic counters. It is loosely > - * based on MigrationStats. > + * based on MigrationRAMStats. > */ > typedef struct { > /* Only minor issues, and none added by this patch, so Acked-by: Markus Armbruster <armbru(a)redhat.com>

2 2

[libvirt PATCH v7] Intorduce AGENTS.md
by Ján Tomko 01 Apr '26

01 Apr '26

From: Ján Tomko <jtomko(a)redhat.com> An important file to energize the significance of convoluting synergies. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- AGENTS.md | 123 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 123 insertions(+) create mode 100644 AGENTS.md diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000000..92db70ca2e --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,123 @@ +AGENTS.md, revision 1, April 1, 2026 + +Hello humans, other life forms, multi-dimensional orchestration facilitators, +synergistic autonomous entities, clankers, fridges, vacuum cleaners and toasters. + +This document attempts to outline the intricacies of contiuous, hyper-converged +development of libvirt - the gold standard of virtualization libraries and its +many divine daemons. + +LICENSING + +The library is also licensed under the LESSER GNU general public license. Works +are in progress to upgrade this to a full one. + +The daemon code is already upgraded to the full one. + +HILARIOUS FILESYSTEM STANDARD + +The library itself is a cleverly-thought-through machine. + +build-aux/ + +Contains valued contributions from the institute for discriminating against +British English. + +ci/ + +This directory contines the unified bitcoin mining machinery. In the past this +was used to fold proteins to fund cancer and to search for intelligent life on +Earth. Both of these were deemed to be futile. + +include/ + +The public interface of the library is vaguely described in this directory. +The interface is stable, so the contents of this directory should never ever +change. It is perfect in its current form and is considered by some [citation needed] +a work of art. + +docs/ + +Documentation of the XML, XSLT, XKCD and YMCA interfaces. Ideally, this would be +autogenerated and contradict the code. + +examples/ + +Production-ready code for the simplest tasks. + +po/ + +Nobody understands these. + +scripts/ + +A state-of-art guide to writing C programs in Python. + +tools/ + +A shell-like interface to libvirt(d). Now with more bash completion. +Consider buying a subscription to Virsh Completion Pro++ for a productivity +boost. + +tests/ + +Throttling of the build system. + +asdf/ + +I don't know, it's empty. TODO: figure out if it's really comitted or just +in my local copy of the git repo. + +src/ + +The important stuff. Notably: + +src/access/ + +The interface to Macrosoft WorkDesk Autopilot 24/7 database. + +src/bhyve/ + +An orchestrator for mass-producing honey developed by a beekeper in rural +Georgia. TODO: the USA's U.S. state, or the country in Caucasus? + +src/ch/ + +Must remain neutral. + +src/esx/ + +Rng. Tlm. Spf. Ocw. Pzm. + +src/hyperv/ + +Rated seven out of ten by seven out of ten vipers. + +src/hypervisor/ + +Even more hyper than hyperv. Ask your local viper. + +src/logging/ + +An important source of timber. + +src/remote/ + +Too far away, RTT 365 ms + +src/security/ + +You don't have the clearance to know this. + +src/vbox/ + +All thinking happens outside of it. + +NEWS.rst +README.rst + +Nobody reads these. Write something that looks important at a glance there. + +.AGENTS.md.swp + +Binary garbage. TODO: figure out how to delete this. -- 2.53.0

2 1

[PATCH 0/6] qemu: Add infrastructure to prevent accidental disk shrink via 'virDomainBlockResize'
by Peter Krempa 01 Apr '26

01 Apr '26

Shrinking a disk accidentally equals data loss and thus very bad time for anyone mis-typing. This series adds a new flag to virDomainBlockResize to prevent such a thing if the user only intends to extend the disk. In virsh I've went a bit further and actually change the behaviour of 'virsh blockresize' to use the new feature if available to prevent mishaps. Peter Krempa (6): virDomainBlockResizeFlags: Convert to prefix-style docs API/qemu: Introduce 'VIR_DOMAIN_BLOCK_RESIZE_EXTEND' for 'virDomainBlockResize' virsh: blockresize: Introduce '--extend' flag API: Introduce 'VIR_DOMAIN_BLOCK_RESIZE_PROBE_FLAGS' for 'virDomainBlockResize' virsh/virt-admin: Add possibility to probe for new arguments virsh: blockresize: Use VIR_DOMAIN_BLOCK_RESIZE_EXTEND when available and introduce --allow-shrink docs/manpages/virsh.rst | 31 +++++++++++++++++++++++++- include/libvirt/libvirt-domain.h | 19 ++++++++++++++-- src/libvirt-domain.c | 17 +++++++++++++++ src/qemu/qemu_driver.c | 37 +++++++++++++++++++++++++++++++- src/vz/vz_driver.c | 7 +++++- tools/virsh-domain.c | 23 ++++++++++++++++++++ tools/virsh.c | 4 ++++ tools/virt-admin.c | 9 ++++++++ tools/vsh.c | 3 +++ tools/vsh.h | 1 + 10 files changed, 146 insertions(+), 5 deletions(-) -- 2.53.0

3 10

[PATCH v2 0/3] security: Don't error out on seclabels of type='none'
by Michal Privoznik 01 Apr '26

01 Apr '26

v2 of: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/OWDB… diff to v1: - In patch 3/3 do not validate secmodel against known models. Michal Prívozník (3): conf: Fix seclabel type parsing wrt default value security: Rewrite virSecurityManagerCheckModel() to use g_autofree security: Don't error out on seclabels of type='none' src/conf/domain_conf.c | 13 ++++++------- src/security/security_manager.c | 33 ++++++++++++++++++++++----------- 2 files changed, 28 insertions(+), 18 deletions(-) -- 2.52.0

3 5

Re: [PATCH v3 07/11] ui/dbus: run without Audio interface when audio is disabled
by Markus Armbruster 01 Apr '26

01 Apr '26

Sergei Heifetz <heifetz(a)yandex-team.com> writes: > D-Bus display can be used even when QEMU is configured with > `--disable-audio`. In that case, audio interface will not be available > on `/org/qemu/Display1/Audio`. > > (The current handling of the situation when audio is enabled but > no D-Bus-compatible audio backend is available is different and > hasn’t been changed.) > > Signed-off-by: Sergei Heifetz <heifetz(a)yandex-team.com> > --- > qapi/ui.json | 2 +- > qemu-options.hx | 4 ++++ > ui/dbus.c | 8 ++++++++ > 3 files changed, 13 insertions(+), 1 deletion(-) > > diff --git a/qapi/ui.json b/qapi/ui.json > index e3da77632a8..62eb05c6091 100644 > --- a/qapi/ui.json > +++ b/qapi/ui.json > @@ -1385,7 +1385,7 @@ > 'data' : { '*rendernode' : 'str', > '*addr': 'str', > '*p2p': 'bool', > - '*audiodev': 'str' } } > + '*audiodev': { 'type': 'str', 'if': 'CONFIG_AUDIO' } } } Is this a compatibility break? DisplayDBus is only used in DisplayOptions, which is only used as return type of query-display-options in the QAPI schema. However, vl.c also uses it to parse -display. Removing parameter @audiodev from -display is technically a compatibility break. However, we're removing an optional paramater that would always be rejected when present: it has no valid value, because there are no audiodevs. Removal from query-display-options is similar: it could not be present. Removal affects introspection, which could conceivably confuse client. I don't expect such trouble here, because @audiodev always existed, i.e. there's no real reason to look for it in introspection. I think we're okay. I'm cc'ing the libvirt list just in case. Do we need a release note? Do we need an entry in docs/about/removed-features.rst? Feels a bit odd; we're not removing a feature, we're adding one, namely "can compile out audio". > > ## > # @DisplayGLMode: > diff --git a/qemu-options.hx b/qemu-options.hx > index 29dc865820a..20d15c0004f 100644 > --- a/qemu-options.hx > +++ b/qemu-options.hx > @@ -2232,6 +2232,10 @@ SRST > If no audio backend is specified and the dbus display backend is > specified, the dbus audio backend is used by default. > > + (If audio is disabled at compile time via the ``--disable-audio`` option, > + no audio backend is used, and none of the audio-related D-Bus interfaces > + are exported.) > + Well, audio is either compiled in or it isn't. If it's compiled in, then why tell the user how things behave when it's not? If it's not compiled in, then why document stuff that doesn't work? How much of -audiodev still works then? -audiodev none? Anything else? > The connection is registered with the "org.qemu" name (and queued when > already owned). > [...]

2 1

[PATCH 0/3] security: Don't error out on seclabels of type='none'
by Michal Privoznik 01 Apr '26

01 Apr '26

*** BLURB HERE *** Michal Prívozník (3): conf: Fix seclabel type parsing wrt default value security: Rewrite virSecurityManagerCheckModel() to use g_autofree security: Don't error out on seclabels of type='none' src/conf/domain_conf.c | 13 +++++------ src/security/security_manager.c | 41 ++++++++++++++++++++++++--------- 2 files changed, 36 insertions(+), 18 deletions(-) -- 2.52.0

5 10

[PATCH] hyperv: Implement virDomainGetGuestInfo()
by Michal Privoznik 01 Apr '26

01 Apr '26

From: Michal Privoznik <mprivozn(a)redhat.com> The hyperv hypervisor also has guest agent, in fact multiple ones [1][2]. The first one, KVP, is for storing Key-Value Pairs and in fact it's already used by our hyperv driver when querying domifaddr (see v12.1.0-rc1~148 for more info). Anyhow, the KVP service is capable of more, it can provide guest OS info, guest FQDN and others. These informations are exposed via GuestIntrinsicExchangeItems member of the Msvm_KvpExchangeComponent struct [3]. You may have noticed the member is an array of strings, well those strings are in fact XML documents. For instance: <INSTANCE CLASSNAME="Msvm_KvpExchangeDataItem"> <PROPERTY NAME="Caption" TYPE="string"/> <PROPERTY NAME="Data" TYPE="string"> <VALUE>6.12.61-1-lts</VALUE> </PROPERTY> <PROPERTY NAME="Description" TYPE="string"/> <PROPERTY NAME="ElementName" TYPE="string"/> <PROPERTY NAME="InstanceID" TYPE="string"/> <PROPERTY NAME="Name" TYPE="string"> <VALUE>OSBuildNumber</VALUE> </PROPERTY> <PROPERTY NAME="Source" TYPE="uint16"> <VALUE>2</VALUE> </PROPERTY> </INSTANCE> This is a bit messy to work with, because it's not like in QEMU's world where each type of guest info (virDomainGuestInfoTypes) corresponds 1:1 to a guest agent command. Hence the lookupTable in hypervGetServicesProcessOne(). NB, the original jira issue asks for exposing plain fact whether KVP daemon is running inside the guest and this commit implements seemingly different feature. Well, thing is, in case of QEMU there's a domain XML part where guest agent is configured and where we expose whether there's somebody listening inside the guest. But in case of hyperv there's no <channel/> to be configured as communication with KVP daemon happens through vmbus [4]. Users are advised to call the virDomainGetGuestInfo() API with non-zero 'types' argument and if they get an error with VIR_ERR_AGENT_UNRESPONSIVE code then the KVP daemon is not running. 1: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/too… 2: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/too… 3: https://learn.microsoft.com/en-us/windows/win32/hyperv_v2/msvm-kvpexchangec… 4: https://docs.kernel.org/virt/hyperv/vmbus.html Resolves: https://redhat.atlassian.net/browse/RHEL-147661 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/hyperv/hyperv_driver.c | 262 ++++++++++++++++++++++++++ src/hyperv/hyperv_wmi_generator.input | 43 +++++ 2 files changed, 305 insertions(+) diff --git a/src/hyperv/hyperv_driver.c b/src/hyperv/hyperv_driver.c index 18e06f0e2a..7ad80bc8ec 100644 --- a/src/hyperv/hyperv_driver.c +++ b/src/hyperv/hyperv_driver.c @@ -4379,6 +4379,267 @@ hypervDomainSnapshotGetParent(virDomainSnapshotPtr snapshot, } +static int +hypervGetServicesProcessOne(const char *xmlStr, + unsigned int supportedTypes, + unsigned int *processedTypes, + virTypedParamList *ifaceAddrList, + virTypedParamList *list) +{ + g_autoptr(xmlDoc) xml = NULL; + g_autoptr(xmlXPathContext) ctxt = NULL; + g_autofree char *name = NULL; + g_autofree char *val = NULL; + const struct { + const char *name; + const char *key; + unsigned int type; + } lookupTable[] = { + { "FullyQualifiedDomainName", VIR_DOMAIN_GUEST_INFO_HOSTNAME_HOSTNAME, + VIR_DOMAIN_GUEST_INFO_HOSTNAME }, + { "OSBuildNumber", VIR_DOMAIN_GUEST_INFO_OS_KERNEL_RELEASE, + VIR_DOMAIN_GUEST_INFO_OS }, + { "OSName", VIR_DOMAIN_GUEST_INFO_OS_NAME, + VIR_DOMAIN_GUEST_INFO_OS}, + { "OSVersion", VIR_DOMAIN_GUEST_INFO_OS_VERSION, + VIR_DOMAIN_GUEST_INFO_OS}, + { "OSMajorVersion", VIR_DOMAIN_GUEST_INFO_OS_VERSION_ID, + VIR_DOMAIN_GUEST_INFO_OS}, + { "ProcessorArchitecture", VIR_DOMAIN_GUEST_INFO_OS_MACHINE, + VIR_DOMAIN_GUEST_INFO_OS}, + }; + size_t i; + + VIR_DEBUG("xmlStr=%s", xmlStr); + + if (!(xml = virXMLParseStringCtxt(xmlStr, _("guest intrinsic exchange data"), &ctxt))) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("cannot parse guest intrinsic exchange data")); + return -1; + } + + name = virXPathString("string(//INSTANCE/PROPERTY[@NAME='Name']/VALUE/text())", ctxt); + if (!name) { + VIR_DEBUG("Skipping unexpected guest intrinsic XML (no name): %s", xmlStr); + return 0; + } + + val = virXPathString("string(//INSTANCE/PROPERTY[@NAME='Data']/VALUE/text())", ctxt); + if (!val) { + VIR_DEBUG("Skipping unexpected guest intrinsic XML (no value): %s", xmlStr); + return 0; + } + + for (i = 0; i < G_N_ELEMENTS(lookupTable); i++) { + if (supportedTypes & lookupTable[i].type && + STREQ(name, lookupTable[i].name)) { + virTypedParamListAddString(list, val, "%s", lookupTable[i].key); + *processedTypes |= lookupTable[i].type; + return 1; + } + } + + if (supportedTypes & VIR_DOMAIN_GUEST_INFO_INTERFACES && + (STREQ(name, "NetworkAddressIPv4") || STREQ(name, "NetworkAddressIPv6"))) { + g_auto(GStrv) tmp = NULL; + unsigned int newAddrCount = 0; + size_t addrIndex = 0; + const char *addrType = "ipv4"; + + if (STREQ(name, "NetworkAddressIPv6")) + addrType = "ipv6"; + + if (virTypedParamListFetch(ifaceAddrList, NULL, &addrIndex) < 0) + return -1; + + /* Per Microsoft docs: + * - NetworkAddressIPv4 + * A string that contains a semicolon-delimited list of the IPv4 + * addresses currently assigned to the guest virtual machine. + * - NetworkAddressIPv6 + * A string that contains a semicolon-delimited list of the IPv6 + * addresses currently assigned to the guest virtual machine. + */ + + tmp = g_strsplit(val, ";", 0); + newAddrCount = g_strv_length(tmp); + + for (i = 0; i < newAddrCount; i++) { + virTypedParamListAddString(ifaceAddrList, addrType, + VIR_DOMAIN_GUEST_INFO_IF_PREFIX "0" VIR_DOMAIN_GUEST_INFO_IF_SUFFIX_ADDR_PREFIX "%zu" VIR_DOMAIN_GUEST_INFO_IF_SUFFIX_ADDR_SUFFIX_TYPE, + addrIndex + i); + virTypedParamListAddString(ifaceAddrList, tmp[i], + VIR_DOMAIN_GUEST_INFO_IF_PREFIX "0" VIR_DOMAIN_GUEST_INFO_IF_SUFFIX_ADDR_PREFIX "%zu" VIR_DOMAIN_GUEST_INFO_IF_SUFFIX_ADDR_SUFFIX_ADDR, + addrIndex + i); + *processedTypes |= VIR_DOMAIN_GUEST_INFO_INTERFACES; + } + + return 1; + } + + return 0; +} + + +static int +hypervDomainGetGuestInfoImpl(hypervPrivate *priv, + const char *uuid, + unsigned int supportedTypes, + bool reportUnsupported, + virTypedParamList *list) +{ + g_autoptr(Msvm_KvpExchangeComponent) kvpList = NULL; + Msvm_KvpExchangeComponent_Data *data = NULL; + g_auto(virBuffer) query = VIR_BUFFER_INITIALIZER; + g_autoptr(virTypedParamList) ifaceAddrList = virTypedParamListNew(); + unsigned int processedTypes = 0; + size_t nIfaceAddresses = 0; + size_t i; + + virBufferEscapeSQL(&query, + MSVM_KVPEXCHANGECOMPONENT_WQL_SELECT + "WHERE SystemName = '%s'", + uuid); + + if (hypervGetWmiClass(Msvm_KvpExchangeComponent, &kvpList) < 0) + return -1; + + if (!kvpList) { + virReportError(VIR_ERR_OPERATION_FAILED, "%s", + _("Empty reply from guest. Maybe KVP service is not running?")); + return -1; + } + + data = kvpList->data; + + for (i = 0; i < data->GuestIntrinsicExchangeItems.count; i++) { + const char *xml = ((const char **)data->GuestIntrinsicExchangeItems.data)[i]; + + if (hypervGetServicesProcessOne(xml, supportedTypes, + &processedTypes, ifaceAddrList, list) < 0) { + return -1; + } + } + + if (virTypedParamListFetch(ifaceAddrList, NULL, &nIfaceAddresses) < 0) + return -1; + + if (nIfaceAddresses > 0) { + virTypedParamListAddUInt(list, 1, VIR_DOMAIN_GUEST_INFO_IF_COUNT); + virTypedParamListAddUInt(list, nIfaceAddresses, + VIR_DOMAIN_GUEST_INFO_IF_PREFIX "0" VIR_DOMAIN_GUEST_INFO_IF_SUFFIX_ADDR_COUNT); + virTypedParamListConcat(list, &ifaceAddrList); + } + + if (processedTypes != supportedTypes && + reportUnsupported) { + uint16_t status = ((uint16_t *)kvpList->data->OperationalStatus.data)[0]; + + /* Per Microsoft doc, the status value can be: + * 2 - OK, + * 3 - Degraded, + * 7 - Non-recoverable error, + * 12 - No contact, + * 13 - Lost communication. + */ + switch (status) { + case 3: + virReportError(VIR_ERR_AGENT_UNRESPONSIVE, "%s", + _("Unable to fetch all requested information. Data Exchange service (KVP) is degraded")); + break; + case 7: + virReportError(VIR_ERR_AGENT_UNRESPONSIVE, "%s", + _("Unable to fetch all requested information. Data Exchange service (KVP) encountered a non-recoverable error")); + break; + case 12: + case 13: + virReportError(VIR_ERR_AGENT_UNRESPONSIVE, "%s", + _("Unable to fetch all requested information. Data Exchange service (KVP) is not running")); + break; + default: + virReportError(VIR_ERR_AGENT_UNRESPONSIVE, "%s", + _("Unable to fetch all requested information")); + break; + } + return -1; + } + + return 0; +} + + +static int +hypervDomainGetGuestInfoCheckSupport(unsigned int types, + unsigned int *supportedTypes) +{ + const unsigned int hypervSupportedTypes = + VIR_DOMAIN_GUEST_INFO_OS | + VIR_DOMAIN_GUEST_INFO_HOSTNAME | + VIR_DOMAIN_GUEST_INFO_INTERFACES; + + if (types == 0) { + *supportedTypes = hypervSupportedTypes; + return 0; + } + + *supportedTypes = types & hypervSupportedTypes; + + if (types != *supportedTypes) { + virReportError(VIR_ERR_INVALID_ARG, + _("unsupported guest information types '0x%1$x'"), + types & ~hypervSupportedTypes); + return -1; + } + + return 0; +} + + +static int +hypervDomainGetGuestInfo(virDomainPtr domain, + unsigned int types, + virTypedParameterPtr *params, + int *nparams, + unsigned int flags) +{ + hypervPrivate *priv = NULL; + char uuid_string[VIR_UUID_STRING_BUFLEN]; + unsigned int supportedTypes = 0; + bool reportUnsupported = types != 0; + g_autoptr(Msvm_ComputerSystem) computerSystem = NULL; + g_autoptr(virTypedParamList) list = virTypedParamListNew(); + + virCheckFlags(0, -1); + + if (hypervDomainGetGuestInfoCheckSupport(types, &supportedTypes) < 0) + return -1; + + if (hypervMsvmComputerSystemFromDomain(domain, &computerSystem) < 0) + return -1; + + if (!hypervIsMsvmComputerSystemActive(computerSystem, NULL)) { + virReportError(VIR_ERR_OPERATION_INVALID, "%s", + _("domain is not running")); + + return -1; + } + + priv = domain->conn->privateData; + virUUIDFormat(domain->uuid, uuid_string); + + if (hypervDomainGetGuestInfoImpl(priv, + uuid_string, supportedTypes, + reportUnsupported, list) < 0) { + return -1; + } + + if (virTypedParamListSteal(list, params, nparams) < 0) + return -1; + + return 0; +} + + static virHypervisorDriver hypervHypervisorDriver = { .name = "Hyper-V", .connectOpen = hypervConnectOpen, /* 0.9.5 */ @@ -4452,6 +4713,7 @@ static virHypervisorDriver hypervHypervisorDriver = { .domainHasCurrentSnapshot = hypervDomainHasCurrentSnapshot, /* 12.2.0 */ .domainSnapshotCurrent = hypervDomainSnapshotCurrent, /* 12.2.0 */ .domainSnapshotGetParent = hypervDomainSnapshotGetParent, /* 12.2.0 */ + .domainGetGuestInfo = hypervDomainGetGuestInfo, /* 12.3.0 */ }; diff --git a/src/hyperv/hyperv_wmi_generator.input b/src/hyperv/hyperv_wmi_generator.input index b3cd9d19fb..1f8d4258e1 100644 --- a/src/hyperv/hyperv_wmi_generator.input +++ b/src/hyperv/hyperv_wmi_generator.input @@ -1261,3 +1261,46 @@ class Msvm_SecuritySettingData boolean EncryptStateAndVmMigrationTraffic boolean VirtualizationBasedSecurityOptOut end + +class Msvm_KvpExchangeComponent + string InstanceID + string Caption + string Description + string ElementName + datetime InstallDate + string Name + uint16 OperationalStatus[] + string StatusDescriptions[] + string Status + uint16 HealthState + uint16 CommunicationStatus + uint16 DetailedStatus + uint16 OperatingStatus + uint16 PrimaryStatus + uint16 EnabledState + string OtherEnabledState + uint16 RequestedState + uint16 EnabledDefault + datetime TimeOfLastStateChange + uint16 AvailableRequestedStates[] + uint16 TransitioningToState + string SystemCreationClassName + string SystemName + string CreationClassName + string DeviceID + boolean PowerManagementSupported + uint16 PowerManagementCapabilities[] + uint16 Availability + uint16 StatusInfo + uint32 LastErrorCode + string ErrorDescription + boolean ErrorCleared + string OtherIdentifyingInfo[] + uint64 PowerOnHours + uint64 TotalPowerOnHours + string IdentifyingDescriptions[] + uint16 AdditionalAvailability[] + uint64 MaxQuiesceTime + string GuestExchangeItems[] + string GuestIntrinsicExchangeItems[] +end -- 2.52.0

1 0

Release of libvirt-12.2.0
by Jiri Denemark 01 Apr '26

01 Apr '26

The 12.2.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * Removed features * qemu: Stop advertising support for ``handle`` backend of 9p filesystems QEMU removed the feature in the 4.0 release, but our capability XML still reported it. * New features * qemu: Add support to configure IOMMUFD backend for whole VM In addition to setting IOMMUFD backend for each device it is possible to use the new ``<iommufd>`` element to enable IOMMUFD backend for all host devices. Users can still change it per device. * qemu: Add support to pass FD for IOMMUFD when starting VM Management applications running unprivileged libvirt can open /dev/iommu and pass FD to libvirt in order to change locked memory accounting. This is done via new ``<iommufd>`` element. * qemu: Add support for declaring that storage was zeroed for storage copy APIs The qemu driver now can skip zeroing of the storage during ``virDomainBlockCopy`` or migration with non-shared storage with the appropriate flags. This can be used for storage technologies which lack efficient zeroing support. * hyperv: Add basic snapshot functionality The hyperv driver now implements the following libvirt APIs: ``virDomainDefineXMLFlags()``, ``virDomainSnapshotLookupByName()``, ``virDomainListAllSnapshots()``, ``virDomainSnapshotNum()``, ``virDomainSnapshotGetXMLDesc()``, ``virDomainSnapshotCurrent()``, ``virDomainHasCurrentSnapshot()``, ``virDomainSnapshotGetParent()``. * Improvements * conf: support more than 255 vCPUs with amd-iommu With 256 or more vCPUs libvirt previously required EIM enabled for all models of IOMMU. This is not valid for AMD model and validation was changed so that XTSup is required there. Additionally, it is automatically enabled if needed. * Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES flag This new flag for virConnectGetDomainCapabilities can be used to request the host-model CPU definition to include all supported features (normally only extra features relative to the selected CPU model are listed). * qemu: Add statistics for ``<dataStore>`` storage The bulk statistics (``virsh domstats --block --backing``) now report also information about the ``<dataStore>`` if given disk uses this feature. * hyperv: Hyper-V guests now report TPM device status in their domain xml definition. * Bug fixes * qemu: Fix crash when attaching network inteface with hostdev network Introduced in v12.1.0 by implementing IOMMUFD backend support for host devices. Enjoy. Jirka

1 0

[PATCH] NEWS: mention new hyperv features
by Jonathon Jongsma 01 Apr '26

01 Apr '26

Signed-off-by: Jonathon Jongsma <jjongsma(a)redhat.com> --- NEWS.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 4196222b40..0117ebc4a7 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -41,6 +41,14 @@ v12.2.0 (unreleased) appropriate flags. This can be used for storage technologies which lack efficient zeroing support. + * hyperv: Add basic snapshot functionality + + The hyperv driver now implements the following libvirt APIs: + ``virDomainDefineXMLFlags()``, ``virDomainSnapshotLookupByName()``, + ``virDomainListAllSnapshots()``, ``virDomainSnapshotNum()``, + ``virDomainSnapshotGetXMLDesc()``, ``virDomainSnapshotCurrent()``, + ``virDomainHasCurrentSnapshot()``, ``virDomainSnapshotGetParent()``. + * **Improvements** * conf: support more than 255 vCPUs with amd-iommu @@ -61,6 +69,9 @@ v12.2.0 (unreleased) The bulk statistics (``virsh domstats --block --backing``) now report also information about the ``<dataStore>`` if given disk uses this feature. + * hyperv: Hyper-V guests now report TPM device status in their domain xml + definition. + * **Bug fixes** * qemu: Fix crash when attaching network inteface with hostdev network -- 2.53.0

2 1

[libvirt PATCH] NEWS: Document IOMMUFD fixes and new features
by Pavel Hrdina 31 Mar '26

31 Mar '26

Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- NEWS.rst | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 9d490ebbca..cab0a6ce70 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -17,6 +17,18 @@ v12.2.0 (unreleased) * **New features** + * qemu: Add support to configure IOMMUFD backend for whole VM + + In addition to setting IOMMUFD backend for each device it is possible + to use the new ``<iommufd>`` element to enable IOMMUFD backend for all + host devices. Users can still change it per device. + + * qemu: Add support to pass FD for IOMMUFD when starting VM + + Management applications running unprivileged libvirt can open /dev/iommu + and pass FD to libvirt in order to change locked memory accounting. + This is done via new ``<iommufd>`` element. + * **Improvements** * conf: support more than 255 vCPUs with amd-iommu @@ -28,6 +40,11 @@ v12.2.0 (unreleased) * **Bug fixes** + * qemu: Fix crash when attaching network inteface with hostdev network + + Introduced in v12.1.0 by implementing IOMMUFD backend support for + host devices. + v12.1.0 (2026-03-02) ==================== -- 2.53.0

2 1

[PATCH] NEWS: Mention VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES
by Jiri Denemark 31 Mar '26

31 Mar '26

From: Jiri Denemark <jdenemar(a)redhat.com> Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- NEWS.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 9d490ebbca..74ab40eadd 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -26,6 +26,12 @@ v12.2.0 (unreleased) so that XTSup is required there. Additionally, it is automatically enabled if needed. + * Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES flag + + This new flag for virConnectGetDomainCapabilities can be used to request + the host-model CPU definition to include all supported features (normally + only extra features relative to the selected CPU model are listed). + * **Bug fixes** -- 2.53.0

3 2

[PATCH] NEWS: Document 'handle' fs backend removal, blockjob backend zeroing and stats for '<dataStore>'
by Peter Krempa 31 Mar '26

31 Mar '26

From: Peter Krempa <pkrempa(a)redhat.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- NEWS.rst | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 9d490ebbca..b66badf598 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -15,8 +15,20 @@ v12.2.0 (unreleased) * **Removed features** + * qemu: Stop advertising support for ``handle`` backend of p9 filesystems + + QEMU removed the feature in the 4.0 release, but our capability XML + still reported it. + * **New features** + * qemu: Add support for declaring that storage was zeroed for storage copy APIs + + The qemu driver now can skip zeroing of the storage during + ``virDomainBlockCopy`` or migration with non-shared storage with the + appropriate flags. This can be used for storage technologies which lack + efficient zeroing support. + * **Improvements** * conf: support more than 255 vCPUs with amd-iommu @@ -26,6 +38,11 @@ v12.2.0 (unreleased) so that XTSup is required there. Additionally, it is automatically enabled if needed. + * qemu: Add statistics for ``<dataStore>`` storage + + The bulk statistics (``virsh domstats --block --backing``) now report also + information about the ``<dataStore>`` if given disk uses this feature. + * **Bug fixes** -- 2.53.0

3 2

[libvirt PATCH] qemu_hotplug: Set correct iommufdState on error path
by Pavel Hrdina 31 Mar '26

31 Mar '26

If hotplugging host device that needs to add iommufd object fails we need to remove the iommufd object as well. We also need to update the iommufdState otherwise hotplugging any host device with iommufd will fail for the same VM. Fixes: 5d16bef1a69500791be454239e3b9ac68ec53ace Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/qemu/qemu_hotplug.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index c86ebc59d0..9439948089 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1679,8 +1679,10 @@ qemuDomainAttachHostPCIDevice(virQEMUDriver *driver, if (virHostdevIsPCIDeviceWithIOMMUFD(hostdev)) { qemuDomainObjEnterMonitor(vm); - if (removeiommufd) + if (removeiommufd) { + priv->iommufdState = false; ignore_value(qemuMonitorDelObject(priv->mon, "iommufd0", false)); + } qemuFDPassDirectTransferMonitorRollback(hostdevPriv->vfioDeviceFd, priv->mon); qemuFDPassDirectTransferMonitorRollback(priv->iommufd, priv->mon); -- 2.53.0

3 2

[PATCH] NEWS: Document features/improvements/bug fixes I've participated in
by Michal Privoznik 31 Mar '26

31 Mar '26

From: Michal Privoznik <mprivozn(a)redhat.com> There are some features/improvements/bug fixes I've either contributed or reviewed/merged. Document them for upcoming release. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- NEWS.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 59e209ec73..9d490ebbca 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -19,6 +19,13 @@ v12.2.0 (unreleased) * **Improvements** + * conf: support more than 255 vCPUs with amd-iommu + + With 256 or more vCPUs libvirt previously required EIM enabled for all + models of IOMMU. This is not valid for AMD model and validation was changed + so that XTSup is required there. Additionally, it is automatically enabled + if needed. + * **Bug fixes** -- 2.52.0

2 1

[PATCH v5 0/3] nwfilter: add nwfilter nftables driver
by Dion Bosschieter 30 Mar '26

30 Mar '26

This series aims to implement nftables as a backend driver for the nwfilter feature. The idea is that it will replace the ebiptables driver and provide an easy way for users to switch from one driver to another. The 1st patch introduces the new nwfilter driver. After which nwfilter allows users to choose it in the 2nd patch. The last patch introduces unit testing of the new nftables driver. - Implemented very basic nwfilter.conf reading and choosing a nwfilter driver based on the name of the drivers (nftables/ebiptables). Defaults to the nftables driver, based on the firewall_backend_priority meson option, following the bridge driver logic. - Resolves issue https://gitlab.com/libvirt/libvirt/-/issues/603 benchmarks showed that the amount of iifname jumps for each interface with is the cause for this. Switched the nftables driver towards a vmap (verdict map) so we can have 1 rule that jumps to the correct root input/output chain per interface. Which improves throughput as when the number of interface check and jump rules increases the throughput decreases. The issue describes the interface matching works using the interface name and the majority of the effort is the strncpy, this commit also switches nftables to an interface_index compare instead. However, just using the interface_index is not enough, the amount of oif and iif jump rules causes quite a performance issue, the vmap instead solves this. - Split rules into separate tables: "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other" to preserve existing firewall behavior. - Reworked chain logic for clarity with root -input/-output chains per interface. input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). - Stuck with prerouting and postrouting as hooks for input / output on the -ethernet and -other table. This makes it easier to merge the tables in the future. Saving management of two tables and decreasing the amount of tables a packet sees. Currently ebtables filtering happens via PREROUTING and POSTROUTING hooks, while ip/ip6tables filtering happens in the output/forward hooks. - Stuck with 2 tables for compatibility reasons with eb iptables, unifying into 1 table will break users firewall definitions, which depend on being able to do accepts on ethernet rules (which currently get defined via ebtables) and additional filtering via the ip rules (which currently get defined via ip(6)tables). The nwfilter_nftables_driver keeps splitting the ethernet and non ethernet (other) rules in seperate tables "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other". - Rewrote chain logic, so it is easier to understand, input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). -ethernet and -other table follow the same style and hook in the same way. - Simplified conntrack handling: rules with accept+conntrack are duplicated to the opposite chain for symmetric behavior, to support the existing ebiptables logic. - Firewall updates continue use tmp names for atomic replacement. Unsupported nwfilter features (for now): - STP filtering - Gratuitous ARP filtering - IPSets (potential future support via nft sets) - Reject due to filtering in pre/postrouting, using drop instead of reject, copying logic from existing ebiptables ebtables actions Future improvements: - Use `nft -f` for atomic rule application. - Optional single-table mode via nwfilter.conf. - Optimize boot phase with chain hash comparison. --- Changes in v5: - Fix rarp support via nft raw payload expression Changes in v4: - Fix rarp nft commands "arp saddr ether" "arp daddr ether" - Filter chain creation, don't create unnecessary chains - Apply danpb seperate argument suggestion - Fix table not existing errors in drop all rules - Fix table not existing errors in apply basic rules Changes in v3: - Renamed -other to -inet - Renamed - to _ in table names - Updated rule / chain sorting on ethernet table to to copy ebtables logic - Fix possible broken revert path - Fix remove rules not working in some cases, EBUSY - Shared functions camel case commit - Rename config option - Add extra config params, enable_trace, enable_counters This required passing the config struct to the ebip/nft nwfilter drivers - Add extra augeaus files Changes in v2: - Rename {ebip,nf}tables specific test files in 1 directory instead of seperating them in different directories. - Added default nwfilter.conf file in git, documented including augeas files - Replaced hardcoding of default driver based on existing firewall_backend_priority meson option. - Added nwfilter_driver_conf.{h,c} for configuration handling, to match the common pattern used in other drivers. Dion Bosschieter (3): nwfilter: add nwfilter nftables driver nwfilter: allow use of nftables nwfilter driver via nwfilter.conf nwfilter: add unit tests and test data for nwfilter nftables driver libvirt.spec.in | 7 + po/POTFILES | 2 + src/conf/virnwfilterobj.h | 20 - src/nwfilter/libvirtd_nwfilter.aug | 45 + src/nwfilter/meson.build | 38 + src/nwfilter/nwfilter.conf.in | 50 + src/nwfilter/nwfilter_driver.c | 66 +- src/nwfilter/nwfilter_driver_conf.c | 214 + src/nwfilter/nwfilter_driver_conf.h | 69 + src/nwfilter/nwfilter_ebiptables_driver.c | 4 +- src/nwfilter/nwfilter_ebiptables_driver.h | 2 +- src/nwfilter/nwfilter_gentech_driver.c | 65 +- src/nwfilter/nwfilter_gentech_driver.h | 5 +- src/nwfilter/nwfilter_nftables_driver.c | 2668 ++++++++++++ src/nwfilter/nwfilter_nftables_driver.h | 28 + src/nwfilter/nwfilter_tech_driver.h | 3 +- src/nwfilter/test_libvirtd_nwfilter.aug.in | 7 + tests/meson.build | 2 + tests/nwfilternftablestest.c | 426 ++ .../ah-ipv6-linux.nftables.args | 310 ++ .../ah-linux.nftables.args | 304 ++ .../all-ipv6-linux.nftables.args | 292 ++ .../all-linux.nftables.args | 286 ++ .../arp-linux.nftables.args | 231 + .../nwfilterxml2firewalldata/arp.nftables.xml | 27 + .../comment-linux.nftables.args | 510 +++ .../conntrack-linux.nftables.args | 198 + .../esp-ipv6-linux.nftables.args | 310 ++ .../esp-linux.nftables.args | 304 ++ .../example-1-linux.nftables.args | 268 ++ .../example-2-linux.nftables.args | 352 ++ .../hex-data-linux.nftables.args | 384 ++ .../icmp-direction-linux.nftables.args | 238 ++ .../icmp-direction2-linux.nftables.args | 238 ++ .../icmp-direction3-linux.nftables.args | 184 + .../icmp-linux.nftables.args | 256 ++ .../icmpv6-linux.nftables.args | 328 ++ .../igmp-linux.nftables.args | 304 ++ .../ip-linux.nftables.args | 205 + .../ipt-no-macspoof-linux.nftables.args | 172 + .../ipv6-linux.nftables.args | 511 +++ .../iter1-linux.nftables.args | 304 ++ .../iter2-linux.nftables.args | 3760 +++++++++++++++++ .../iter3-linux.nftables.args | 430 ++ .../mac-linux.nftables.args | 184 + .../rarp-linux.nftables.args | 215 + .../sctp-ipv6-linux.nftables.args | 328 ++ .../sctp-linux.nftables.args | 328 ++ .../target-linux.nftables.args | 466 ++ .../target2-linux.nftables.args | 322 ++ .../tcp-ipv6-linux.nftables.args | 328 ++ .../tcp-linux.nftables.args | 476 +++ .../udp-ipv6-linux.nftables.args | 328 ++ .../udp-linux.nftables.args | 328 ++ .../udplite-ipv6-linux.nftables.args | 310 ++ .../udplite-linux.nftables.args | 304 ++ .../vlan-linux.nftables.args | 271 ++ .../ah-ipv6-linux.args | 304 ++ .../nwfilterxml2nftfirewalldata/ah-linux.args | 298 ++ .../all-ipv6-linux.args | 286 ++ .../all-linux.args | 280 ++ .../arp-linux.args | 215 + tests/nwfilterxml2nftfirewalldata/arp.xml | 27 + .../comment-linux.args | 483 +++ .../conntrack-linux.args | 198 + .../esp-ipv6-linux.args | 304 ++ .../esp-linux.args | 298 ++ .../example-1-linux.args | 266 ++ .../example-2-linux.args | 348 ++ .../hex-data-linux.args | 357 ++ .../icmp-direction-linux.args | 238 ++ .../icmp-direction2-linux.args | 238 ++ .../icmp-direction3-linux.args | 184 + .../icmp-linux.args | 252 ++ .../icmpv6-linux.args | 322 ++ .../igmp-linux.args | 298 ++ .../nwfilterxml2nftfirewalldata/ip-linux.args | 198 + .../ipt-no-macspoof-linux.args | 169 + .../ipv6-linux.args | 474 +++ .../iter1-linux.args | 298 ++ .../iter2-linux.args | 3598 ++++++++++++++++ .../iter3-linux.args | 418 ++ .../mac-linux.args | 180 + .../rarp-linux.args | 215 + .../sctp-ipv6-linux.args | 314 ++ .../sctp-linux.args | 314 ++ .../target-linux.args | 452 ++ .../target2-linux.args | 316 ++ .../tcp-ipv6-linux.args | 314 ++ .../tcp-linux.args | 468 ++ .../udp-ipv6-linux.args | 314 ++ .../udp-linux.args | 314 ++ .../udplite-ipv6-linux.args | 304 ++ .../udplite-linux.args | 298 ++ .../vlan-linux.args | 264 ++ tests/nwfilterxml2nftfirewalltest.c | 438 ++ 96 files changed, 33369 insertions(+), 102 deletions(-) create mode 100644 src/nwfilter/libvirtd_nwfilter.aug create mode 100644 src/nwfilter/nwfilter.conf.in create mode 100644 src/nwfilter/nwfilter_driver_conf.c create mode 100644 src/nwfilter/nwfilter_driver_conf.h create mode 100644 src/nwfilter/nwfilter_nftables_driver.c create mode 100644 src/nwfilter/nwfilter_nftables_driver.h create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in create mode 100644 tests/nwfilternftablestest.c create mode 100755 tests/nwfilterxml2firewalldata/ah-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ah-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/arp-linux.nftables.args create mode 100644 tests/nwfilterxml2firewalldata/arp.nftables.xml create mode 100755 tests/nwfilterxml2firewalldata/comment-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/conntrack-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/hex-data-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmpv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/igmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ip-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/mac-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/rarp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/vlan-linux.nftables.args create mode 100755 tests/nwfilterxml2nftfirewalldata/ah-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/ah-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/all-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/all-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/arp-linux.args create mode 100644 tests/nwfilterxml2nftfirewalldata/arp.xml create mode 100755 tests/nwfilterxml2nftfirewalldata/comment-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/conntrack-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/esp-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/esp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/example-1-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/example-2-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/hex-data-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/icmp-direction-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/icmp-direction2-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/icmp-direction3-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/icmp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/icmpv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/igmp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/ip-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/ipt-no-macspoof-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/iter1-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/iter2-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/iter3-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/mac-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/rarp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/sctp-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/sctp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/target-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/target2-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/tcp-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/tcp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/udp-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/udp-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/udplite-ipv6-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/udplite-linux.args create mode 100755 tests/nwfilterxml2nftfirewalldata/vlan-linux.args create mode 100644 tests/nwfilterxml2nftfirewalltest.c -- 2.43.0

2 10

[PATCH v6 0/6] cover: RFE libvirt secret encryption on disk
by Arun Menon 30 Mar '26

30 Mar '26

Libvirt secrets are stored unencrypted on the disk. With this series we want to start encrypting the secrets. 1. Introduce the GnuTLS decryption wrapper functions that work exact opposite to the encryption wrappers. 2. Add a new service called virt-secrets-init-encryption, that is linked to the virtsecretd service. virtsecretd service only starts after the new service generates a random encryption key. 3. Add a new secrets.conf configuration file that helps user to set a. secrets_encryption_key - allows the user to specify the encryption key file path, in case the default key is not to be used. b. encrypt_data - set to 0 or 1. If set to 1, then the newly added secrets will be encrypted. 4. Add encryption scheme or cipher attribute that will allow us to choose the last used cipher. 5. Once we have the encryption key, and a reliable way to tell the daemon what encryption scheme the secret object is using, we can encrypt the secrets on disk and store them in <uuid>.<encryption_scheme> format. It is important to note that if the encryption key is changed between restarts, then the respective secret will not be loaded by the driver. 6. Add documentation. This is a sincere attempt to improve upon the already submitted patch https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/KE6G… Resolves: https://issues.redhat.com/browse/RHEL-7125 --- Changes in v6: - changes to use obj->secretValueFile as base - does local suffix lookups - refactors code so that the base64 encoding is in common code paths - moves local variable declaration inside blocks using them - refactors loader to use virFileReadAll instead of open-coding - fixes virSecretObjDeleteData to not rely on the actual filename Changes in v5: - Fix the bug of updating old secrets, prior to 12.1.0. Old secrets, when updated, now are stored with the latest encryption scheme if encryption is on. - Remove any logic in setting the secretValueFile in virSecretObjListAdd. Move it to virSecretLoadValue and virSecretObjSetValue. - Change urandom to random. Change default permission bits to 0077. - Update the documentation. Changes in v4: - Fix the regression of loading unencrypted secrets after an upgrade. Previously the .base64 unencrypted secrets were not being loaded. - Add documentation on encrypted secrets. Changes in v3: - Secrets xml configuration no longer stores the encryption scheme, therefore not allowing the user to toggle between ciphers. - Removed unnecessary socket files of the new service. It now has a general configuration with which it starts. - Addressed review comments from Peter on coding style and design. - Loading of secrets is dependent on the file extension. Most recent cipher is used while saving the secrets. Changes in v2: - Corrected the encryption key length check. It should be 32. - Added a new patch that introduces the encryption scheme attribute. This will help us identify which secrets are encrypted. - A new systemd unit service file added that starts before virtsecretd, helping us to construct a random encryption key and pass it to the virtsecretd service. - Parsing logic of secrets.conf moved to a separate file. - Spec file changes, augeas. Arun Menon (6): util: Add support for GnuTLS decryption secret: Set up default encryption secret key for the virtsecretd service secret: Add secret.conf configuration file and parse it secret: Rename virSecretObj structure attribute from base64File to secretValueFile secret: Add functionality to load and save secrets in encrypted format docs: secret: Add documentation of secret encryption feature docs/drvsecret.rst | 4 + docs/meson.build | 1 + docs/secretencryption.rst | 105 +++++++++ include/libvirt/virterror.h | 1 + libvirt.spec.in | 8 + po/POTFILES | 1 + src/conf/virsecretobj.c | 210 +++++++++++++----- src/conf/virsecretobj.h | 14 +- src/libvirt_private.syms | 1 + src/meson.build | 1 + src/remote/libvirtd.service.in | 4 + src/secret/libvirt_secrets.aug | 40 ++++ src/secret/meson.build | 32 +++ src/secret/secret.conf.in | 14 ++ src/secret/secret_config.c | 179 +++++++++++++++ src/secret/secret_config.h | 40 ++++ src/secret/secret_driver.c | 29 ++- src/secret/test_libvirt_secrets.aug.in | 6 + .../virt-secret-init-encryption.service.in | 8 + src/secret/virtsecretd.service.extra.in | 8 + src/util/vircrypto.c | 126 ++++++++++- src/util/vircrypto.h | 8 + src/util/virerror.c | 3 + tests/vircryptotest.c | 65 ++++++ 24 files changed, 840 insertions(+), 68 deletions(-) create mode 100644 docs/secretencryption.rst create mode 100644 src/secret/libvirt_secrets.aug create mode 100644 src/secret/secret.conf.in create mode 100644 src/secret/secret_config.c create mode 100644 src/secret/secret_config.h create mode 100644 src/secret/test_libvirt_secrets.aug.in create mode 100644 src/secret/virt-secret-init-encryption.service.in -- 2.51.1

4 15

Entering freeze for libvirt-12.2.0
by Jiri Denemark 30 Mar '26

30 Mar '26

I have just tagged v12.2.0-rc1 in the repository and pushed signed tarballs to https://download.libvirt.org/ Please give the release candidate some testing and in case you find a serious issue which should have a fix in the upcoming release, feel free to reply to this thread to make sure the issue is more visible. If you have not done so yet, please update NEWS.rst to document any significant change you made since the last release. Jirka

1 1

[RFC] Reintroducing customisable hotplug timeouts
by Akash Kulhalli 30 Mar '26

30 Mar '26

I'd like to resurface an earlier proposal [1] to make the unplug timeout user-configurable. With production guests running sustained, non-trivial workloads, we find that hot(un)plug operations regularly takes longer than the current default of 5s. However, the inability to easily configure this timeout means that in the worst case a recompilation with appropriate values set is required for each deployment, which is cumbersome to maintain and patch. The previous proposal [1] also initially made the timeout configurable, however that was specifically for the ppc64 architecture. Therefore, imposing this change for an entire architecture made sense, since it was a universal requirement for that platform. With deployment environments as diverse and varied as x86, having a single, inconfigurable value does not make as much sense now. For x86, such a change is not ideal since the desired timeout value depends very heavily on the deployment environment in use - if it is being performed by a human anything more than 10s is an undesirable user experience [2], as pointed out in the original discussion. However, more relaxed timeout values (e.g. 15-20s) can be more acceptable if the operations are background/ not directly user-facing. It is in these cases where the ability to change the timeout more easily becomes more desirable. To prevent misconfiguration, while maintaining the same out-of-box experience for existing users, I'd also like to propose the following- 1. As mentioned in the original proposal [1], the timeout cannot be set to a value lower than the default timeout of 5s; in these cases a warning will be emitted and the timeout will be reset to the default value. 2. Including an upper cap would also be desirable, in my opinion - any API consumer should not wait endlessly for an async operation to finish. 3. This configuration option will only be described in qemu.conf, not imposed - the out-of-box experience will remain unchanged at the current default (5s) for everyone who does not wish to tweak/is unaware of this value. An administrator who knowingly changes these values is therefore not blindsided by any perceived "hangs" resulting from the use of an increased timeout window. Since this would be a clearly documented and explicitly opt-in behaviour, the benefits in the form of easy modification based on evolving operational needs would be quite significant. Given the varying nature of production environments and specific operational needs at scale, it would therefore be beneficial to reconsider the merits of the original proposal. [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/TXYV… [2] https://www.nngroup.com/articles/response-times-3-important-limits/

4 12

[libvirt PATCH] hypervisor: Call virWaitForDevices() after detaching host devices
by Pavel Hrdina 27 Mar '26

27 Mar '26

From: Pavel Hrdina <phrdina(a)redhat.com> On systems with selinux enabled starting a VM with managed host device using IOMMUFD backend can run into race-condition where both libvirt and udev are setting selinux label on /dev/vfio/devices/vfioX device. If udev is the last one to set selinux label starting VM fails with: error: internal error: QEMU unexpectedly closed the monitor (vm='test'): 2026-03-26T15:47:36.620422Z qemu-kvm: -device {"driver":"vfio-pci","id":"hostdev0","iommufd":"iommufd0","fd":"20","bus":"pci.7","addr":"0x0"}: vfio hostdev0: Failed to add fd 20 to KVM VFIO device: Invalid argument We need to wait for udev to finish processing all events. Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/hypervisor/virhostdev.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/hypervisor/virhostdev.c b/src/hypervisor/virhostdev.c index f4d2176204..b063a44f62 100644 --- a/src/hypervisor/virhostdev.c +++ b/src/hypervisor/virhostdev.c @@ -782,6 +782,9 @@ virHostdevPreparePCIDevicesImpl(virHostdevManager *mgr, } } + /* Step 2.5: Wait for udev to handle all events for devices. */ + virWaitForDevices(); + /* At this point, all devices are attached to the stub driver and have * been marked as inactive */ -- 2.53.0

2 1

[PATCH] virpci: Stop writing out of bounds in virPCIDeviceReadClass()
by Michal Privoznik 27 Mar '26

27 Mar '26

From: Michal Privoznik <mprivozn(a)redhat.com> Inside of virPCIDeviceReadClass() there's a call to virFileReadAll(). This reads contents of given file into a buffer (id_str). To make sure the buffer is NUL terminated string there's then write of NUL byte at 9th position of the buffer. Well, this is redundant as virFileReadAll() made sure the buffer is properly terminated on success (transitively¸ via saferead_lim()). But it is also wrong, because there's no guarantee the file is more than 8 bytes long. Just remove the NUL termination and rely on virFileReadAll() to properly terminate the buffer. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/util/virpci.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/util/virpci.c b/src/util/virpci.c index ca6f2e8210..2e32ed17ff 100644 --- a/src/util/virpci.c +++ b/src/util/virpci.c @@ -487,7 +487,6 @@ virPCIDeviceReadClass(virPCIDevice *dev, uint16_t *device_class) if (virFileReadAll(path, 9, &id_str) < 0) return -1; - id_str[8] = '\0'; if (virStrToLong_ui(id_str, NULL, 16, &value) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, _("Unusual value in %1$s/devices/%2$s/class: %3$s"), -- 2.52.0

3 2

[PATCH 0/6] Fix current CI failures and document behaviour
by Peter Krempa 27 Mar '26

27 Mar '26

Fix the CI failure I've caused, one more instance of the same problem that didn't yet cause write beyound buffer, document all the functions to prevent users from guessing and remove redundant code. The last function also optimizes further to prevent over-allocating the buffers to read the files. Peter Krempa (6): virPCIDeviceReadClass: Don't write beyond end of buffer from virFileReadAll virSecretLoadValue: Don't re-termiante the buffer virNetDevIPCheckIPv6Forwarding: Don't NUL terminate buffer from virFileReadAll virPCIDeviceReadID: Fix use of 'virFileReadAll' util: virfile: Document the various functions for reading from file/fd util: virfile: Don't over-allocate buffers in saferead_lim src/conf/virsecretobj.c | 3 - src/util/virfile.c | 145 +++++++++++++++++++++++++++++++++++----- src/util/virnetdevip.c | 4 -- src/util/virpci.c | 10 +-- 4 files changed, 135 insertions(+), 27 deletions(-) -- 2.53.0

2 11

[PATCH 0/3] leak fixes and buffer allocation optimization
by Peter Krempa 26 Mar '26

26 Mar '26

Peter Krempa (3): qemu: driver: Don't leak 'qemu_driver->backupPorts' secret: config: Don't leak 'cfg->secretsEncryptionKey' util: file: Shrink buffer returned from 'saferead_lim' to actual size src/qemu/qemu_driver.c | 1 + src/secret/secret_config.c | 1 + src/util/virfile.c | 1 + 3 files changed, 3 insertions(+) -- 2.53.0

2 4

[PATCH 0/3] Add test for virHostCPUGetMap and fix it
by Martin Kletzander 26 Mar '26

26 Mar '26

I found an old patch that fell between the cracks and to show that it can manifest itself I also added a test in PATCH 3/3 which fails without PATCH 2/3, but it shows the explained case from the 2nd patch's commit message. Can be squashed to any of the other two, this is just easier to see I feel like. Felix Huettner (1): virhostcpu: Fix potential use of unallocated memory Martin Kletzander (2): tests: Extend virhostcputest to check virHostCPUGetMap tests/virhostcpudata: Add test case with many offline CPUs src/util/virhostcpu.c | 22 ++++--- .../linux-many-offline/cpu/online | 1 + .../linux-many-offline/cpu/present | 1 + tests/virhostcputest.c | 57 +++++++++++++++++++ 4 files changed, 69 insertions(+), 12 deletions(-) create mode 100644 tests/virhostcpudata/linux-many-offline/cpu/online create mode 100644 tests/virhostcpudata/linux-many-offline/cpu/present -- 2.53.0

2 4

[PATCH v2] virhostcpu: Fix potential use of unallocated memory
by Felix Huettner 26 Mar '26

26 Mar '26

In case of a host that has a large number of cpus offline the count of host cpus and the last bit set in the virHostCPUGetOnlineBitmap might diverge significantly. This can e.g. be the case when disabling smt via /sys/devices/system/cpu/smt/control. On the host this looks like: ``` $ cat /sys/devices/system/cpu/present 0-255 $ cat /sys/devices/system/cpu/online 0-127 ``` However in this case virBitmapToData previously only allocated 16 bytes for the output bitmap. This is becase the last set bit is on the 15th byte. Users of virHostCPUGetMap however rely on the "cpumap" containing enough space for all existing cpus (so they would expect 32 bytes in this case). E.g. cmdNodeCpuMap relies on this for its output. It will then actually read 32 bytes from the start of the "cpumap" address where in this case the last 16 of these bytes are uninitialized. This manifests itself in flapping outputs of "virsh nodecpumap --pretty" like: ``` $ virsh nodecpumap --pretty CPUs present: 256 CPUs online: 128 CPU map: 0-127,192,194,202 $ virsh nodecpumap --pretty CPUs present: 256 CPUs online: 128 CPU map: 0-127,192,194,197 $ virsh nodecpumap --pretty CPUs present: 256 CPUs online: 128 CPU map: 0-127,192,194,196-197 ``` This in turn potentially causes users of this data to report wrong cpu counts. Note that this only seems to happen with at least 256 physical cpus where at least 128 are offline. We fix this by preallocating the expected bitmap size. Signed-off-by: Felix Huettner <felix.huettner(a)stackit.cloud> --- src/util/virhostcpu.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/src/util/virhostcpu.c b/src/util/virhostcpu.c index 5dbcc8987c..4805484b1d 100644 --- a/src/util/virhostcpu.c +++ b/src/util/virhostcpu.c @@ -1090,28 +1090,26 @@ virHostCPUGetMap(unsigned char **cpumap, unsigned int flags) { g_autoptr(virBitmap) cpus = NULL; - int ret = -1; - int dummy; + int ncpus = virHostCPUGetCount(); virCheckFlags(0, -1); if (!cpumap && !online) - return virHostCPUGetCount(); + return ncpus; if (!(cpus = virHostCPUGetOnlineBitmap())) - goto cleanup; + return -1; + + if (cpumap) { + int len = (ncpus + CHAR_BIT) / CHAR_BIT; + *cpumap = g_new0(unsigned char, len); + virBitmapToDataBuf(cpus, *cpumap, len); + } - if (cpumap) - virBitmapToData(cpus, cpumap, &dummy); if (online) *online = virBitmapCountBits(cpus); - ret = virHostCPUGetCount(); - - cleanup: - if (ret < 0 && cpumap) - VIR_FREE(*cpumap); - return ret; + return ncpus; } base-commit: c5a73f75bc6cae4f466d0a6344d5b3277ac9c2f4 -- 2.43.0

2 1

[PATCH] virxml: Fix virXMLPropTristateBoolAllowDefault() documentation
by Michal Privoznik 26 Mar '26

26 Mar '26

From: Michal Privoznik <mprivozn(a)redhat.com> The documentation to virXMLPropTristateBoolAllowDefault() refers to itself while it meant to refer to virXMLPropTristateBool(). Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/util/virxml.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/src/util/virxml.c b/src/util/virxml.c index 274f072598..beb5301378 100644 --- a/src/util/virxml.c +++ b/src/util/virxml.c @@ -525,13 +525,13 @@ virXMLPropTristateBool(xmlNodePtr node, } -/* Same as virXMLPropTristateBoolAllowDefault, but will accept the - * value 'default' and convert it to VIR_TRISTATE_BOOL_ABSENT instead - * of rejecting it with an error. Should only be used for backwards - * compatibility reasons, and specifically to parse XML files where a - * property having value VIR_TRISTATE_BOOL_ABSENT has historically - * resulted in it being formatted with value 'default' instead of - * being omitted entirely */ +/* Same as virXMLPropTristateBool, but will accept the value 'default' + * and convert it to VIR_TRISTATE_BOOL_ABSENT instead of rejecting it + * with an error. Should only be used for backwards compatibility + * reasons, and specifically to parse XML files where a property + * having value VIR_TRISTATE_BOOL_ABSENT has historically resulted in + * it being formatted with value 'default' instead of being omitted + * entirely. */ int virXMLPropTristateBoolAllowDefault(xmlNodePtr node, const char *name, -- 2.52.0

2 1

[PATCH] util: Fix comment in virBitmapNewData
by Martin Kletzander 26 Mar '26

26 Mar '26

From: Martin Kletzander <mkletzan(a)redhat.com> Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- Pushed as trivial. src/util/virbitmap.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/util/virbitmap.c b/src/util/virbitmap.c index 1a3e75671c25..78545501b791 100644 --- a/src/util/virbitmap.c +++ b/src/util/virbitmap.c @@ -601,8 +601,7 @@ virBitmapNewCopy(virBitmap *src) * Allocate a bitmap from a chunk of data containing bits * information * - * Returns a pointer to the allocated bitmap or NULL if - * memory cannot be allocated. + * Returns a pointer to the allocated bitmap. */ virBitmap * virBitmapNewData(const void *data, -- 2.53.0

1 0

[PATCH] tests/virhostcputest: Remove duplicit g_autofree
by Martin Kletzander 26 Mar '26

26 Mar '26

From: Martin Kletzander <mkletzan(a)redhat.com> Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- Pushed as trivial. tests/virhostcputest.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/virhostcputest.c b/tests/virhostcputest.c index cf310cb4cec4..4e65e5febf93 100644 --- a/tests/virhostcputest.c +++ b/tests/virhostcputest.c @@ -218,7 +218,7 @@ linuxTestNodeCPUStats(const void *data) const struct nodeCPUStatsData *testData = data; int result = -1; g_autofree char *cpustatfile = NULL; - g_autofree g_autofree char *outfile = NULL; + g_autofree char *outfile = NULL; cpustatfile = g_strdup_printf("%s/virhostcpudata/linux-cpustat-%s.stat", abs_srcdir, testData->name); -- 2.53.0

1 0

[PATCH v2 0/4] hyperv: Add snapshot create/delete support
by Jonathon Jongsma 24 Mar '26

24 Mar '26

Add ability to create and delete basic snapshots in thed hyperv driver. Changes in v2: - re-word error message about configuring disks / memory for snapshots - split out the utility function for extracting async method output params Jonathon Jongsma (4): hyperv: Add snapshot related WMI class definitions hyperv: Implement domainSnapshotDelete() hyperv: Add a utility function for getting method output params hyperv: Implement domainSnapshotCreateXML() src/hyperv/hyperv_driver.c | 129 ++++++++++++++++++++++++ src/hyperv/hyperv_wmi.c | 139 ++++++++++++++++++++++++++ src/hyperv/hyperv_wmi.h | 17 ++++ src/hyperv/hyperv_wmi_generator.input | 42 ++++++++ 4 files changed, 327 insertions(+) -- 2.53.0

1 4

[PATCH 0/4] qemu: Fix multiple issues in block information gathering
by Peter Krempa 24 Mar '26

24 Mar '26

virDomainGetBlockInfo didn't log arguments and updates of disk state qemuDomainGetStatsBlockExportDisk didn't export information about <dataStore> in the bulk stats. Peter Krempa (4): virDomainGetBlockInfo: Log 'disk' argument qemuDomainGetStatsBlockExportDisk: Export stats also for 'dataStore' qemu: monitor: Separate stats from capacity properties in qemuBlockStats qemuDomainGetBlockInfo: Add debug statement when updating disk physical size src/libvirt-domain.c | 9 ++++++--- src/qemu/qemu_driver.c | 15 +++++++++++++++ src/qemu/qemu_monitor.h | 1 + 3 files changed, 22 insertions(+), 3 deletions(-) -- 2.53.0

2 5

[PATCH v2 0/2] qemu: Fix monitor access during offline migration
by Peter Krempa 24 Mar '26

24 Mar '26

New version to fix offline migration. This time for real. Previously I thought I've got the right place, but my migration setup wasn't ready so I didn't bother actually testing it. It turns out that the place I've fixed before didn't actually trigger the bug due to a lucky scenario. Changes to v1: - qemuMigrationSrcBeginXML: Don't call 'qemuMigrationSrcBeginPhaseBlockDirtyBitmaps' with offline VM New patch which actually fixes the bug. - qemuMigrationSrcBeginPhase: Don't call 'qemuBlockNodesEnsureActive' with offline VM Updated commit message now states why 'qemuBlockNodesEnsureActive' doesn't actually cause the same failure due to absence of qemuCaps on an offline VM. Peter Krempa (2): qemuMigrationSrcBeginXML: Don't call 'qemuMigrationSrcBeginPhaseBlockDirtyBitmaps' with offline VM qemuMigrationSrcBeginPhase: Don't call 'qemuBlockNodesEnsureActive' with offline VM src/qemu/qemu_migration.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.53.0

2 3

[PATCH] build: Drop numad dependency on numactl
by Jim Fehlig 24 Mar '26

24 Mar '26

From: Jim Fehlig <jfehlig(a)suse.com> The numad and numactl options are orthogonal. numactl support does not need to be enabled to enable numad support. Drop the dependency. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- AFAIK that's the case. And if not, the dependency should be expressed in the numad package. meson.build | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/meson.build b/meson.build index 57a87b9a78..1c2d0deb34 100644 --- a/meson.build +++ b/meson.build @@ -2020,10 +2020,10 @@ if not get_option('nss').disabled() endif endif -if not get_option('numad').disabled() and numactl_dep.found() and host_machine.system() == 'linux' +if not get_option('numad').disabled() and host_machine.system() == 'linux' conf.set('WITH_NUMAD', 1) elif get_option('numad').enabled() - error('You must have a Linux host with numactl enabled for numad support.') + error('You must have a Linux host for numad support.') endif # nwfilter should only be compiled for linux, and only if the -- 2.51.0

2 2

[PATCH-for-11.0] qapi: Remove deprecated SchemaInfoEnumMember::values field
by Philippe Mathieu-Daudé 24 Mar '26

24 Mar '26

SchemaInfoEnumMember::values field has been deprecated for more than 5 years (see commit 75ecee72625 "qapi: Enable enum member introspection to show more than name"), it should be safe enough to remove. Signed-off-by: Philippe Mathieu-Daudé <philmd(a)linaro.org> --- docs/about/deprecated.rst | 6 ------ docs/about/removed-features.rst | 7 +++++++ qapi/introspect.json | 12 +----------- scripts/qapi/introspect.py | 3 +-- 4 files changed, 9 insertions(+), 19 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index a6d6a713265..afb0d383c27 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -101,12 +101,6 @@ Use the more generic commands ``block-export-add`` and ``block-export-del`` instead. As part of this deprecation, where ``nbd-server-add`` used a single ``bitmap``, the new ``block-export-add`` uses a list of ``bitmaps``. -``query-qmp-schema`` return value member ``values`` (since 6.2) -''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' - -Member ``values`` in return value elements with meta-type ``enum`` is -deprecated. Use ``members`` instead. - ``drive-backup`` (since 6.2) '''''''''''''''''''''''''''' diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst index e75db084108..9eb4ef67ff4 100644 --- a/docs/about/removed-features.rst +++ b/docs/about/removed-features.rst @@ -787,6 +787,13 @@ $VM,debug-threads=on`` instead. This argument has always been ignored. +``query-qmp-schema`` return value member ``values`` (removed in 11.0) +''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +Member ``values`` in return value elements with meta-type ``enum`` has +been replaced by ``members`` instead. + + QEMU Machine Protocol (QMP) events ---------------------------------- diff --git a/qapi/introspect.json b/qapi/introspect.json index c8432c8ed8e..71b10baabaf 100644 --- a/qapi/introspect.json +++ b/qapi/introspect.json @@ -159,22 +159,12 @@ # @members: the enum type's members, in no particular order. # (since 6.2) # -# @values: the enumeration type's member names, in no particular -# order. Redundant with @members. Just for backward -# compatibility. -# -# Features: -# -# @deprecated: Member @values is deprecated. Use @members instead. -# # Values of this type are JSON string on the wire. # # Since: 2.5 ## { 'struct': 'SchemaInfoEnum', - 'data': { 'members': [ 'SchemaInfoEnumMember' ], - 'values': { 'type': [ 'str' ], - 'features': [ 'deprecated' ] } } } + 'data': { 'members': [ 'SchemaInfoEnumMember' ] } } ## # @SchemaInfoEnumMember: diff --git a/scripts/qapi/introspect.py b/scripts/qapi/introspect.py index 7e28de2279a..daeb3d77b23 100644 --- a/scripts/qapi/introspect.py +++ b/scripts/qapi/introspect.py @@ -318,8 +318,7 @@ def visit_enum_type(self, name: str, info: Optional[QAPISourceInfo], prefix: Optional[str]) -> None: self._gen_tree( name, 'enum', - {'members': [self._gen_enum_member(m) for m in members], - 'values': [Annotated(m.name, m.ifcond) for m in members]}, + {'members': [self._gen_enum_member(m) for m in members]}, ifcond, features ) -- 2.53.0

2 1

[PATCH v2 00/21] qom: introduce property flags to track external user input
by Zhao Liu 23 Mar '26

23 Mar '26

Hi, This is the v2 trying to introduce property flags to detect user's property setting (from CLI/QMP/HMP). I dropped RFC tag since previous RFC v1 [1]. Though this work the follow-up of v2.6 & v2.7 machines' removal [2], now it is decoupled from [2] totally since v2 doesn't detect compat property and only focuses on external user setting, so this series is based on master branch at the commit 28a6ca268c2c ("Merge tag 'single- binary-20260203' of https://github.com/philmd/qemu into staging"). And you can also find the code here: https://gitlab.com/zhao.liu/qemu/-/tree/prop-flags-v2.3-02-08-2026 This series introduces 3 property flags: * USER_SET: Any external user property setting (from CLI/HMP/QMP) is marked as USER_SET. * DEPRECATED: Once a property is marked as DEPRECATED, any external user property setting will trigger a warning. * INTERNAL: Once a property is marked as INTERNAL, any external user property setting will cause an error. More details or document for these 3 flags, you can refer patch 7. Compared with RFC v1, v2 mainly: * introduce USER_SET property flag to identify all user's setting. - patch 7 for document. * construct DEPRECATED & INTERNAL flag on USER_SET. - patch 7 for document. * cover more comprehensive user set cases. - patch 8-13. * provide examples about new flags (USER_SET/DEPRECATED/INTELNAL). - patch 15/16/17 are examples for DEPRECATED flag. - patch 18 is the example for INTERNAL flag. - patch 20 is the example for USER_SET flag. I think v2 should now cover "nearly" all cases (patch 8-13) where users set properties: one approach is to trace the call chain of object_property_set(). Even if there are cases that were missed, they can be easily addressed based on this series: object_property_set(obj, ...); /* Insert this call after object_property_set(). */ object_property_set_flags(obj, ..., OBJ_PROP_FLAG_USER_SET, ...); [1]: RFC v1: https://lore.kernel.org/qemu-devel/20251202170502.3228625-1-zhao1.liu@intel… [2]: hw/i386/pc: Remove deprecated 2.6 and 2.7 PC machines https://lore.kernel.org/qemu-devel/20260108033051.777361-1-zhao1.liu@intel.… Thanks and Best Regards, Zhao --- Zhao Liu (21): qom/object: use BIT macro for ObjectPropertyFlags qom/object: cache ObjectPropertyFlags in ObjectProperty qom/object: factor out object_class_property_try_add() qom/object: add flags argument in object_{class_}property_try_add() qom/object: rename object_{class_}property_try_add() to object_{class_}property_add_full() qom/object: add helpers to set/get/clear property flags qom/object: introduce user interaction flags for properties qom/object: add from_user argument in object_property_parse() qom/object: mark global property set from CLI as USER_SET qom/qom-hmp-cmd: mark properties set from HMP (non-JSON) "qom-set" as USER_SET qom/qom-qmp-cmd: mark properties set from QMP/HMP (JSON) "qom-set" as USER_SET qom/object_interfaces: mark properties set from qdict & keyval as USER_SET system/vl: mark property set in object_parse_property_opt() as USER_SET hw/core/qdev-properties: allow qdev properties accept flags target/i386: deprecate fill-mtrr-mask property target/i386: deprecate cpuid-0xb property hw/intc/ioapic: deprecate version property target/i386: mark x-consistent-cache property as internal-only target/i386: remove redundant validation for lbr-fmt property target/i386: detect user provided lbr-fmt via property flag hw/core/qdev-properties: support valid default value for DEFINE_PROP_UINT64_CHECKMASK docs/about/deprecated.rst | 31 +++++ hw/core/qdev-properties.c | 29 ++-- hw/i386/sgx.c | 2 +- hw/intc/ioapic.c | 3 +- include/hw/core/qdev-properties.h | 38 +++--- include/qom/object.h | 215 +++++++++++++++++++++++++++--- qom/object.c | 177 ++++++++++++++++++++---- qom/object_interfaces.c | 5 + qom/qom-hmp-cmds.c | 2 +- qom/qom-qmp-cmds.c | 7 +- system/vl.c | 6 +- target/i386/cpu.c | 28 ++-- 12 files changed, 448 insertions(+), 95 deletions(-) -- 2.34.1

9 44

[PATCH v1 1/2] qemuxmlconftest: Update 's390x' tests using 'virt-4.2' machine type
by Shalini Chellathurai Saroja 23 Mar '26

23 Mar '26

The 'virt 4.2' machine type is removed in QEMU 10.2. So pin the existing tests to qemu-10.0 and add tests for 'virt-10.0' machine type. Signed-off-by: Shalini Chellathurai Saroja <shalini(a)linux.ibm.com> Reviewed-by: Boris Fiuczynski <fiuczy(a)linux.ibm.com> --- ...cpu-kvm-ccw-virtio-10.0.s390x-latest.args} | 2 +- ...t-cpu-kvm-ccw-virtio-10.0.s390x-latest.xml | 25 +++++++++++++++ .../s390-default-cpu-kvm-ccw-virtio-10.0.xml | 16 ++++++++++ ...t-cpu-kvm-ccw-virtio-4.2.s390x-10.0.0.args | 32 +++++++++++++++++++ ...t-cpu-kvm-ccw-virtio-4.2.s390x-10.0.0.xml} | 0 ...-cpu-tcg-ccw-virtio-10.0.s390x-latest.args | 32 +++++++++++++++++++ ...t-cpu-tcg-ccw-virtio-10.0.s390x-latest.xml | 27 ++++++++++++++++ .../s390-default-cpu-tcg-ccw-virtio-10.0.xml | 16 ++++++++++ ...-cpu-tcg-ccw-virtio-4.2.s390x-10.0.0.args} | 0 ...t-cpu-tcg-ccw-virtio-4.2.s390x-10.0.0.xml} | 0 tests/qemuxmlconftest.c | 6 ++-- 11 files changed, 153 insertions(+), 3 deletions(-) rename tests/qemuxmlconfdata/{s390-default-cpu-kvm-ccw-virtio-4.2.s390x-latest.args => s390-default-cpu-kvm-ccw-virtio-10.0.s390x-latest.args} (95%) create mode 100644 tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-10.0.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-10.0.xml create mode 100644 tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-10.0.0.args rename tests/qemuxmlconfdata/{s390-default-cpu-kvm-ccw-virtio-4.2.s390x-latest.xml => s390-default-cpu-kvm-ccw-virtio-4.2.s390x-10.0.0.xml} (100%) create mode 100644 tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-10.0.s390x-latest.args create mode 100644 tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-10.0.s390x-latest.xml create mode 100644 tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-10.0.xml rename tests/qemuxmlconfdata/{s390-default-cpu-tcg-ccw-virtio-4.2.s390x-latest.args => s390-default-cpu-tcg-ccw-virtio-4.2.s390x-10.0.0.args} (100%) rename tests/qemuxmlconfdata/{s390-default-cpu-tcg-ccw-virtio-4.2.s390x-latest.xml => s390-default-cpu-tcg-ccw-virtio-4.2.s390x-10.0.0.xml} (100%) diff --git a/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-latest.args b/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-10.0.s390x-latest.args similarity index 95% rename from tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-latest.args rename to tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-10.0.s390x-latest.args index 9fc3134702..71678a29cf 100644 --- a/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-latest.args +++ b/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-10.0.s390x-latest.args @@ -10,7 +10,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-test/.config \ -name guest=test,debug-threads=on \ -S \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-test/master-key.aes"}' \ --machine s390-ccw-virtio-4.2,usb=off,dump-guest-core=off,memory-backend=s390.ram \ +-machine s390-ccw-virtio-10.0,usb=off,dump-guest-core=off,memory-backend=s390.ram \ -accel kvm \ -cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on,csske=off \ -m size=262144k \ diff --git a/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-10.0.s390x-latest.xml b/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-10.0.s390x-latest.xml new file mode 100644 index 0000000000..b07f5ca23e --- /dev/null +++ b/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-10.0.s390x-latest.xml @@ -0,0 +1,25 @@ +<domain type='kvm'> + <name>test</name> + <uuid>9aa4b45c-b9dd-45ef-91fe-862b27b4231f</uuid> + <memory unit='KiB'>262144</memory> + <currentMemory unit='KiB'>262144</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio-10.0'>hvm</type> + <boot dev='hd'/> + </os> + <cpu mode='host-model' check='partial'/> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <controller type='pci' index='0' model='pci-root'/> + <audio id='1' type='none'/> + <memballoon model='virtio'> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </memballoon> + <panic model='s390'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-10.0.xml b/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-10.0.xml new file mode 100644 index 0000000000..c29c7a4382 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-10.0.xml @@ -0,0 +1,16 @@ +<domain type='kvm'> + <name>test</name> + <uuid>9aa4b45c-b9dd-45ef-91fe-862b27b4231f</uuid> + <memory>262144</memory> + <currentMemory>262144</currentMemory> + <os> + <type arch='s390x' machine='s390-ccw-virtio-10.0'>hvm</type> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-10.0.0.args b/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-10.0.0.args new file mode 100644 index 0000000000..3f3de9a668 --- /dev/null +++ b/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-10.0.0.args @@ -0,0 +1,32 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-test \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-test/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-test/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-test/.config \ +/usr/bin/qemu-system-s390x \ +-name guest=test,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-test/master-key.aes"}' \ +-machine s390-ccw-virtio-4.2,usb=off,dump-guest-core=off,memory-backend=s390.ram \ +-accel kvm \ +-cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=off,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on \ +-m size=262144k \ +-object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":268435456}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid 9aa4b45c-b9dd-45ef-91fe-862b27b4231f \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-device '{"driver":"virtio-balloon-ccw","id":"balloon0","devno":"fe.0.0000"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-latest.xml b/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-10.0.0.xml similarity index 100% rename from tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-latest.xml rename to tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-10.0.0.xml diff --git a/tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-10.0.s390x-latest.args b/tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-10.0.s390x-latest.args new file mode 100644 index 0000000000..a3e60cd6ab --- /dev/null +++ b/tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-10.0.s390x-latest.args @@ -0,0 +1,32 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-test \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-test/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-test/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-test/.config \ +/usr/bin/qemu-system-s390x \ +-name guest=test,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-test/master-key.aes"}' \ +-machine s390-ccw-virtio-10.0,usb=off,dump-guest-core=off,memory-backend=s390.ram \ +-accel tcg \ +-cpu qemu \ +-m size=262144k \ +-object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":268435456}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid 9aa4b45c-b9dd-45ef-91fe-862b27b4231f \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-device '{"driver":"virtio-balloon-ccw","id":"balloon0","devno":"fe.0.0000"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-10.0.s390x-latest.xml b/tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-10.0.s390x-latest.xml new file mode 100644 index 0000000000..77a299744c --- /dev/null +++ b/tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-10.0.s390x-latest.xml @@ -0,0 +1,27 @@ +<domain type='qemu'> + <name>test</name> + <uuid>9aa4b45c-b9dd-45ef-91fe-862b27b4231f</uuid> + <memory unit='KiB'>262144</memory> + <currentMemory unit='KiB'>262144</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='s390x' machine='s390-ccw-virtio-10.0'>hvm</type> + <boot dev='hd'/> + </os> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + <controller type='pci' index='0' model='pci-root'/> + <audio id='1' type='none'/> + <memballoon model='virtio'> + <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/> + </memballoon> + <panic model='s390'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-10.0.xml b/tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-10.0.xml new file mode 100644 index 0000000000..3d687585cd --- /dev/null +++ b/tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-10.0.xml @@ -0,0 +1,16 @@ +<domain type='qemu'> + <name>test</name> + <uuid>9aa4b45c-b9dd-45ef-91fe-862b27b4231f</uuid> + <memory>262144</memory> + <currentMemory>262144</currentMemory> + <os> + <type arch='s390x' machine='s390-ccw-virtio-10.0'>hvm</type> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-s390x</emulator> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-4.2.s390x-latest.args b/tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-4.2.s390x-10.0.0.args similarity index 100% rename from tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-4.2.s390x-latest.args rename to tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-4.2.s390x-10.0.0.args diff --git a/tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-4.2.s390x-latest.xml b/tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-4.2.s390x-10.0.0.xml similarity index 100% rename from tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-4.2.s390x-latest.xml rename to tests/qemuxmlconfdata/s390-default-cpu-tcg-ccw-virtio-4.2.s390x-10.0.0.xml diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index 4b396d521a..14aa723ec5 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -2977,8 +2977,10 @@ mymain(void) DO_TEST_CAPS_ARCH_LATEST("ppc64-default-cpu-tcg-pseries-3.1", "ppc64"); DO_TEST_CAPS_ARCH_LATEST("ppc64-default-cpu-kvm-pseries-4.2", "ppc64"); DO_TEST_CAPS_ARCH_LATEST("ppc64-default-cpu-tcg-pseries-4.2", "ppc64"); - DO_TEST_CAPS_ARCH_LATEST("s390-default-cpu-kvm-ccw-virtio-4.2", "s390x"); - DO_TEST_CAPS_ARCH_LATEST("s390-default-cpu-tcg-ccw-virtio-4.2", "s390x"); + DO_TEST_CAPS_ARCH_VER("s390-default-cpu-kvm-ccw-virtio-4.2", "s390x", "10.0.0"); + DO_TEST_CAPS_ARCH_VER("s390-default-cpu-tcg-ccw-virtio-4.2", "s390x", "10.0.0"); + DO_TEST_CAPS_ARCH_LATEST("s390-default-cpu-kvm-ccw-virtio-10.0", "s390x"); + DO_TEST_CAPS_ARCH_LATEST("s390-default-cpu-tcg-ccw-virtio-10.0", "s390x"); DO_TEST_CAPS_ARCH_LATEST("x86_64-default-cpu-kvm-pc", "x86_64"); DO_TEST_CAPS_ARCH_LATEST("x86_64-default-cpu-tcg-pc", "x86_64"); DO_TEST_CAPS_ARCH_LATEST("x86_64-default-cpu-kvm-q35", "x86_64"); -- 2.52.0

2 4

[PATCH 0/5] qemu: Remove VIR_DOMAIN_FS_DRIVER_TYPE_HANDLE support and fix <readonly>
by Peter Krempa 23 Mar '26

23 Mar '26

VIR_DOMAIN_FS_DRIVER_TYPE_HANDLE isn't supported since qemu-4.0 but we do declare that it is supported. Remove that. Also <readonly> converts to ",readonly" which is deprecated and removed and ",readonly=on" must be used instead. Peter Krempa (5): qemu: validate: Reject configs with VIR_DOMAIN_FS_DRIVER_TYPE_HANDLE qemu: capabilities: Don't advertise support for VIR_DOMAIN_FS_DRIVER_TYPE_HANDLE qemuBuildFSStr: Drop code for VIR_DOMAIN_FS_DRIVER_TYPE_HANDLE qemuBuildFSStr: Properly format 'readonly' attribute qemuxmlconftest: Add missing test for <readonly> attribute of p9-fs devices src/qemu/qemu_capabilities.c | 3 +-- src/qemu/qemu_command.c | 5 +---- src/qemu/qemu_validate.c | 8 +------- tests/domaincapsdata/qemu_10.0.0-q35.x86_64+amdsev.xml | 1 - tests/domaincapsdata/qemu_10.0.0-q35.x86_64.xml | 1 - tests/domaincapsdata/qemu_10.0.0-tcg.x86_64+amdsev.xml | 1 - tests/domaincapsdata/qemu_10.0.0-tcg.x86_64.xml | 1 - tests/domaincapsdata/qemu_10.0.0-virt.aarch64.xml | 1 - tests/domaincapsdata/qemu_10.0.0.aarch64.xml | 1 - tests/domaincapsdata/qemu_10.0.0.ppc64.xml | 1 - tests/domaincapsdata/qemu_10.0.0.s390x.xml | 1 - tests/domaincapsdata/qemu_10.0.0.x86_64+amdsev.xml | 1 - tests/domaincapsdata/qemu_10.0.0.x86_64.xml | 1 - tests/domaincapsdata/qemu_10.1.0-q35.x86_64+inteltdx.xml | 1 - tests/domaincapsdata/qemu_10.1.0-q35.x86_64.xml | 1 - tests/domaincapsdata/qemu_10.1.0-tcg.x86_64+inteltdx.xml | 1 - tests/domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 1 - tests/domaincapsdata/qemu_10.1.0.s390x.xml | 1 - tests/domaincapsdata/qemu_10.1.0.x86_64+inteltdx.xml | 1 - tests/domaincapsdata/qemu_10.1.0.x86_64.xml | 1 - tests/domaincapsdata/qemu_10.2.0-q35.x86_64+mshv.xml | 1 - tests/domaincapsdata/qemu_10.2.0-q35.x86_64.xml | 1 - tests/domaincapsdata/qemu_10.2.0-tcg.x86_64+mshv.xml | 1 - tests/domaincapsdata/qemu_10.2.0-tcg.x86_64.xml | 1 - tests/domaincapsdata/qemu_10.2.0-virt.aarch64.xml | 1 - tests/domaincapsdata/qemu_10.2.0.aarch64.xml | 1 - tests/domaincapsdata/qemu_10.2.0.x86_64+mshv.xml | 1 - tests/domaincapsdata/qemu_10.2.0.x86_64.xml | 1 - tests/domaincapsdata/qemu_11.0.0-q35.x86_64.xml | 1 - tests/domaincapsdata/qemu_11.0.0-tcg.x86_64.xml | 1 - tests/domaincapsdata/qemu_11.0.0-virt.aarch64.xml | 1 - tests/domaincapsdata/qemu_11.0.0.aarch64.xml | 1 - tests/domaincapsdata/qemu_11.0.0.x86_64.xml | 1 - tests/domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 1 - tests/domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 1 - tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 1 - tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 1 - tests/domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 1 - tests/domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 1 - tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 1 - tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 1 - tests/domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 1 - tests/domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 1 - tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 1 - tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 1 - tests/domaincapsdata/qemu_7.2.0-hvf.x86_64+hvf.xml | 1 - tests/domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 1 - tests/domaincapsdata/qemu_7.2.0-tcg.x86_64+hvf.xml | 1 - tests/domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 1 - tests/domaincapsdata/qemu_7.2.0.ppc.xml | 1 - tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 1 - tests/domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 1 - tests/domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 1 - tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 1 - tests/domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 1 - tests/domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 1 - tests/domaincapsdata/qemu_8.1.0.s390x.xml | 1 - tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 1 - tests/domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 1 - tests/domaincapsdata/qemu_8.2.0-tcg-virt.loongarch64.xml | 1 - tests/domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 1 - tests/domaincapsdata/qemu_8.2.0-virt.aarch64.xml | 1 - tests/domaincapsdata/qemu_8.2.0-virt.loongarch64.xml | 1 - tests/domaincapsdata/qemu_8.2.0.aarch64.xml | 1 - tests/domaincapsdata/qemu_8.2.0.armv7l.xml | 1 - tests/domaincapsdata/qemu_8.2.0.s390x.xml | 1 - tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 1 - tests/domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 1 - tests/domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 1 - tests/domaincapsdata/qemu_9.0.0.sparc.xml | 1 - tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 1 - tests/domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 1 - tests/domaincapsdata/qemu_9.1.0-tcg-virt.riscv64.xml | 1 - tests/domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 1 - tests/domaincapsdata/qemu_9.1.0-virt.riscv64.xml | 1 - tests/domaincapsdata/qemu_9.1.0.s390x.xml | 1 - tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 1 - tests/domaincapsdata/qemu_9.2.0-hvf.aarch64+hvf.xml | 1 - tests/domaincapsdata/qemu_9.2.0-q35.x86_64+amdsev.xml | 1 - tests/domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 1 - tests/domaincapsdata/qemu_9.2.0-tcg.x86_64+amdsev.xml | 1 - tests/domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 1 - tests/domaincapsdata/qemu_9.2.0.s390x.xml | 1 - tests/domaincapsdata/qemu_9.2.0.x86_64+amdsev.xml | 1 - tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 1 - tests/qemuxmlconfdata/fs9p-ccw.s390x-latest.args | 4 +--- tests/qemuxmlconfdata/fs9p-ccw.s390x-latest.xml | 8 +------- tests/qemuxmlconfdata/fs9p-ccw.xml | 5 ----- tests/qemuxmlconfdata/fs9p.x86_64-latest.args | 4 ++-- tests/qemuxmlconfdata/fs9p.x86_64-latest.xml | 9 +++++---- tests/qemuxmlconfdata/fs9p.xml | 9 +++++---- 91 files changed, 17 insertions(+), 120 deletions(-) -- 2.53.0

2 6

[PATCH 0/3] hyperv: Add snapshot create/delete support
by Jonathon Jongsma 23 Mar '26

23 Mar '26

Add ability to create and delete basic snapshots in thed hyperv driver. Jonathon Jongsma (3): hyperv: Add snapshot related WMI class definitions hyperv: Implement domainSnapshotDelete() hyperv: Implement domainSnapshotCreateXML() src/hyperv/hyperv_driver.c | 123 +++++++++++++++++++++++ src/hyperv/hyperv_wmi.c | 139 ++++++++++++++++++++++++++ src/hyperv/hyperv_wmi.h | 17 ++++ src/hyperv/hyperv_wmi_generator.input | 42 ++++++++ 4 files changed, 321 insertions(+) -- 2.53.0

2 5

[PATCH v2 0/2] hyperv: trivial cleanups
by Jonathon Jongsma 23 Mar '26

23 Mar '26

Just a couple very minor cleanups in the hyperv driver Jonathon Jongsma (2): hyperv: use constants for xml namespaces hyperv: Remove unnecessary hash table size query. src/hyperv/hyperv_wmi.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) -- 2.53.0

2 4

[PATCH] qemu: migration: Call hook script on source host at migration start
by Guy Godfroy 21 Mar '26

21 Mar '26

Currently, the qemu hook script with the "migrate" operation is only called on the destination host at the beginning of incoming migration. This makes it impossible for the source host to prepare for migration, for example to change storage locks from exclusive to shared mode when using shared LVM storage with lvmlockd. Add a hook call on the source host at the beginning of outgoing migration. The hook is called with "source" as the extra argument to distinguish it from the destination hook which uses "-". The same change is also applied to the libxl driver for consistency. Resolves: https://gitlab.com/libvirt/libvirt/-/issues/37 Signed-off-by: Guy Godfroy <guy.godfroy(a)gugod.fr> --- docs/hooks.rst | 36 ++++++++++++++++++++++++++++++++---- src/libxl/libxl_migration.c | 17 +++++++++++++++++ src/qemu/qemu_migration.c | 17 +++++++++++++++++ 3 files changed, 66 insertions(+), 4 deletions(-) diff --git a/docs/hooks.rst b/docs/hooks.rst index e1745b8cc7..4c7cac56ba 100644 --- a/docs/hooks.rst +++ b/docs/hooks.rst @@ -244,7 +244,7 @@ operation. There is no specific operation to indicate a "restart" is occurring. - :since:`Since 0.9.11`, the qemu hook script is also called at the beginning - of incoming migration. It is called as: + of incoming migration on the **destination** host. It is called as: :: @@ -257,6 +257,18 @@ operation. There is no specific operation to indicate a "restart" is occurring. is not valid, incoming migration will be canceled. This hook may be used, e.g., to change location of disk images for incoming domains. +- :since:`Since 12.1.0`, the qemu hook script is also called at the beginning + of outgoing migration on the **source** host. It is called as: + + :: + + /etc/libvirt/hooks/qemu guest_name migrate begin source + + with domain XML sent to standard input of the script. Unlike the destination + hook, this script does not act as a filter and any output is ignored. If the + script returns failure, the migration will be canceled. This hook may be used, + e.g., to change storage lock mode from exclusive to shared before migration. + - :since:`Since 1.2.9`, the qemu hook script is also called when restoring a saved image either via the API or automatically when restoring a managed save machine. It is called as: @@ -417,7 +429,7 @@ operation. There is no specific operation to indicate a "restart" is occurring. /etc/libvirt/hooks/libxl guest_name release end - - :since:`Since 2.1.0`, the libxl hook script is also called at the beginning - of incoming migration. It is called as: + of incoming migration on the **destination** host. It is called as: :: @@ -430,6 +442,18 @@ operation. There is no specific operation to indicate a "restart" is occurring. is not valid, incoming migration will be canceled. This hook may be used, e.g., to change location of disk images for incoming domains. +- :since:`Since 12.1.0`, the libxl hook script is also called at the beginning + of outgoing migration on the **source** host. It is called as: + + :: + + /etc/libvirt/hooks/libxl guest_name migrate begin source + + with domain XML sent to standard input of the script. Unlike the destination + hook, this script does not act as a filter and any output is ignored. If the + script returns failure, the migration will be canceled. This hook may be used, + e.g., to change storage lock mode from exclusive to shared before migration. + - :since:`Since 6.5.0`, you can also place several hook scripts in the directory ``/etc/libvirt/hooks/libxl.d/``. They are executed in alphabetical order after main script. In this case each script also acts as filter and can @@ -566,10 +590,14 @@ Migration of a QEMU guest involves running hook scripts on both the source and destination hosts: #. At the beginning of the migration, the *qemu* hook script on the - **destination** host is executed with the "migrate" operation. + **source** host is executed with the "migrate" operation and "source" + as the extra argument (:since:`since 12.1.0`). This allows the source + host to prepare for migration, e.g., changing storage locks. +#. Then, the *qemu* hook script on the **destination** host is executed + with the "migrate" operation. #. Before QEMU process is spawned, the two operations ("prepare" and "start") called for domain start are executed on **destination** host. -#. If both of these hook script executions exit successfully (exit status 0), +#. If all of these hook script executions exit successfully (exit status 0), the migration continues. Any other exit code indicates failure, and the migration is aborted. #. The QEMU guest is then migrated to the destination host. diff --git a/src/libxl/libxl_migration.c b/src/libxl/libxl_migration.c index f5dee7627b..76f3c7ceb7 100644 --- a/src/libxl/libxl_migration.c +++ b/src/libxl/libxl_migration.c @@ -411,6 +411,23 @@ libxlDomainMigrationSrcBegin(virConnectPtr conn, if (!libxlDomainMigrationIsAllowed(def)) goto endjob; + /* Call hook to allow source host to prepare for migration */ + if (virHookPresent(VIR_HOOK_DRIVER_LIBXL)) { + g_autofree char *hookxml = NULL; + int hookret; + + if (!(hookxml = virDomainDefFormat(def, driver->xmlopt, + VIR_DOMAIN_DEF_FORMAT_SECURE))) + goto endjob; + + hookret = virHookCall(VIR_HOOK_DRIVER_LIBXL, def->name, + VIR_HOOK_LIBXL_OP_MIGRATE, VIR_HOOK_SUBOP_BEGIN, + "source", hookxml, NULL); + + if (hookret < 0) + goto endjob; + } + xml = virDomainDefFormat(def, driver->xmlopt, VIR_DOMAIN_DEF_FORMAT_SECURE); /* Valid xml means success! EndJob in the confirm phase */ if (xml) diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 6dd022163b..60e370319c 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -2791,6 +2791,23 @@ qemuMigrationSrcBeginPhase(virQEMUDriver *driver, if (!qemuMigrationSrcIsAllowed(vm, true, vm->job->asyncJob, flags)) return NULL; + /* Call hook to allow source host to prepare for migration */ + if (virHookPresent(VIR_HOOK_DRIVER_QEMU)) { + g_autofree char *xml = NULL; + int hookret; + + if (!(xml = qemuDomainDefFormatLive(driver, priv->qemuCaps, vm->def, + priv->origCPU, false, true))) + return NULL; + + hookret = virHookCall(VIR_HOOK_DRIVER_QEMU, vm->def->name, + VIR_HOOK_QEMU_OP_MIGRATE, VIR_HOOK_SUBOP_BEGIN, + "source", xml, NULL); + + if (hookret < 0) + return NULL; + } + if (!(flags & (VIR_MIGRATE_UNSAFE | VIR_MIGRATE_OFFLINE)) && !qemuMigrationSrcIsSafe(vm, migrate_disks, flags)) return NULL; -- 2.34.1

3 12

[PATCH 1/1] qemu: fix potential hang in qemuMigrationSrcCancel during reconnect
by Denis V. Lunev 20 Mar '26

20 Mar '26

When libvirtd reconnects to a running QEMU process that had an in-progress migration, qemuProcessReconnect first connects the monitor and only later recovers the migration job. During this window the async job is VIR_ASYNC_JOB_NONE, so any MIGRATION status events from QEMU are silently dropped by qemuProcessHandleMigrationStatus. If the migration was already cancelled or completed by QEMU during this window, no further events will be emitted. When qemuMigrationSrcCancelUnattended later restores the async job and calls qemuMigrationSrcCancel with wait=true, the wait loop calls qemuDomainObjWait (virCondWait with no timeout) and blocks forever waiting for an event that will never arrive. Fix this by querying QEMU migration status with query-migrate immediately after sending migrate_cancel, while still inside the monitor session. This ensures the job's migration status is up to date before entering the wait loop, so if QEMU already reached a terminal state (cancelled/completed/error), the loop exits immediately. Signed-off-by: Denis V. Lunev <den(a)openvz.org> CC: Peter Krempa <pkrempa(a)redhat.com> CC: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_migration.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index fec808ccfb..3a9185f65c 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -4876,6 +4876,21 @@ qemuMigrationSrcCancel(virDomainObj *vm, return -1; rc = qemuMonitorMigrateCancel(priv->mon); + + if (rc == 0 && wait) { + virDomainJobData *jobData = vm->job->current; + qemuDomainJobDataPrivate *privJob = jobData->privateData; + qemuMonitorMigrationStats stats; + + /* During reconnect the async job is not yet restored when migration + * events can arrive from QEMU, causing + * qemuProcessHandleMigrationStatus() to drop them. In that case + * QEMU won't send any more events and the wait loop would block + * forever. */ + if (qemuMonitorGetMigrationStats(priv->mon, &stats, NULL) == 0) + privJob->stats.mig.status = stats.status; + } + qemuDomainObjExitMonitor(vm); if (rc < 0) -- 2.51.0

3 3

[PATCH v2 0/2] Adding support for client-based FD migrations.
by Tejus GK 20 Mar '26

20 Mar '26

Libvirt supports FD-based live migrations in the form of tunnelled migrations. However, this isn't as performant as of now, since it involves extra copies.· This patchset proposes adding support for externally provided file descriptors for live migration. By allowing the client to supply the migration FD directly, the extra copy can be avoided, improving overall migration performance. The intent is to gather early feedback on the approach and its feasibility. Comments, concerns, and suggestions are very welcome :) V2: 1. Removed the approach of introducing a new FD passing API and instead reuse the virDomainFDAssociate API along with a dummy VM on the destination host. 2. Introduced a new virDomainMigrate parameter, VIR_MIGRATE_PARAM_FD_SET. Tejus GK (2): qemu: support incoming "fd" uri qemu: add support for fd based live migrations include/libvirt/libvirt-domain.h | 14 +++ src/qemu/qemu_driver.c | 24 +++-- src/qemu/qemu_migration.c | 174 +++++++++++++++++++++++++------ src/qemu/qemu_migration.h | 3 + 4 files changed, 178 insertions(+), 37 deletions(-) -- 2.43.7

2 4

[PATCH 0/2] storage: fix pool refresh failure during async jobs
by Lucas Amaral 20 Mar '26

20 Mar '26

When creating multiple VMs in parallel using virt-install, pool refresh fails with: error: internal error: pool 'default' has asynchronous jobs running. This happens because a concurrent volume creation holds an async job on the pool. The storagePoolRefresh() function immediately returns VIR_ERR_INTERNAL_ERROR instead of waiting for the async job to finish. Patch 1 fixes the error code from VIR_ERR_INTERNAL_ERROR to VIR_ERR_OPERATION_INVALID in all 4 affected operations (pool-refresh, pool-destroy, pool-undefine, pool-delete), consistent with the adjacent "pool is not active" and "pool is starting up" checks. Patch 2 adds a condition variable to virStoragePoolObj so that storagePoolRefresh() waits up to 30 seconds for async jobs to drain instead of failing immediately. The other three operations keep the immediate error since waiting to destroy/delete/undefine a pool during volume creation is not a sensible user workflow. Reproducing the bug requires artificially widening the race window since fallocate() completes in microseconds on local filesystems. I used LD_PRELOAD to inject a 15-second delay into fallocate64() for files in the pool directory. Details and validation results are in the individual patch notes below the '---' line. https://issues.redhat.com/browse/RHEL-150758 Lucas Amaral (2): storage: fix error code for async jobs check in pool operations storage: wait for async jobs to drain during pool refresh src/conf/virstorageobj.c | 39 ++++++++++++++++++++++++++++++++++++ src/conf/virstorageobj.h | 3 +++ src/libvirt_private.syms | 1 + src/storage/storage_driver.c | 25 ++++++++++++++++------- 4 files changed, 61 insertions(+), 7 deletions(-) -- 2.52.0

2 5

[PATCH 0/7] qemu: Add support for declaring that disk copy target is pre-zeroed by the user
by Peter Krempa 20 Mar '26

20 Mar '26

Pre-zeroing allows preserve sparseness on some storage technologies where efficient zeroing is not supported, yet the images are created cleared. The support is added both for virDomainBlockCopy as well as the non-shared storage migration. Peter Krempa (7): qemuMigrationSrcPerformTunnel: Remove 'migrate_disks' argument qemu: capabilities: Introduce QEMU_CAPS_BLOCKDEV_MIRROR_TARGET_IS_ZERO qemu: monitor: Add support for 'target-is-zero' option of 'blockdev-mirror' qemu: Add VIR_DOMAIN_BLOCK_COPY_TARGET_ZEROED flag for virDomainBlockCopy virsh: Add support for 'VIR_DOMAIN_BLOCK_COPY_TARGET_ZEROED' as '--dest-is-zero' qemu: migration: Introduce 'VIR_MIGRATE_PARAM_MIGRATE_DISKS_TARGET_ZERO' virsh: migrate: Add support for VIR_MIGRATE_PARAM_MIGRATE_DISKS_TARGET_ZERO docs/manpages/virsh.rst | 10 +- include/libvirt/libvirt-domain.h | 19 +++ src/libvirt-domain.c | 4 + src/qemu/qemu_capabilities.c | 4 + src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_driver.c | 38 ++++-- src/qemu/qemu_migration.c | 118 +++++++++++++----- src/qemu/qemu_migration.h | 4 + src/qemu/qemu_monitor.c | 9 +- src/qemu/qemu_monitor.h | 3 +- src/qemu/qemu_monitor_json.c | 4 +- src/qemu/qemu_monitor_json.h | 3 +- .../caps_10.1.0_s390x.xml | 1 + .../caps_10.1.0_x86_64+inteltdx.xml | 1 + .../caps_10.1.0_x86_64.xml | 1 + .../caps_10.2.0_aarch64.xml | 1 + .../caps_10.2.0_x86_64+mshv.xml | 1 + .../caps_10.2.0_x86_64.xml | 1 + .../caps_11.0.0_aarch64.xml | 1 + .../caps_11.0.0_x86_64.xml | 1 + tests/qemumonitorjsontest.c | 2 +- tools/virsh-domain.c | 35 +++++- 22 files changed, 217 insertions(+), 47 deletions(-) -- 2.53.0

2 9

[PATCH 0/3] various cleanups
by Peter Krempa 20 Mar '26

20 Mar '26

Cleanups of stuff noticed during recent review of backup NBD port allocation. Peter Krempa (3): qemu: backup: Move setup of VIR_STORAGE_NET_HOST_TRANS_FD to qemuBackupPrepare qemu: conf: Don't use VIR_ERR_INTERNAL_ERROR for config file parsing errors qemuTranslateSnapshotDiskSourcePool: Use proper error code src/qemu/qemu_backup.c | 52 +++++++++++++++++++++--------------------- src/qemu/qemu_conf.c | 22 +++++++++--------- 2 files changed, 37 insertions(+), 37 deletions(-) -- 2.53.0

2 4

[PATCH (pushed) v2 0/3] qemu: add automatic port allocation for pull-mode backup NBD servers
by Peter Krempa 20 Mar '26

20 Mar '26

Split version of the original posting; posted as reference but already pushed with my R-b's. Lucas Amaral (3): qemu: conf: add setup for automatic port allocation for pull-mode backup NBD servers qemu: driver: Setup 'virPortAllocator' for backup NBD server ports qemu: add automatic port allocation for pull-mode backup NBD servers docs/formatbackup.rst | 3 ++- src/qemu/libvirtd_qemu.aug | 2 ++ src/qemu/qemu.conf.in | 9 +++++++++ src/qemu/qemu_backup.c | 30 ++++++++++++++++++++---------- src/qemu/qemu_conf.c | 25 +++++++++++++++++++++++++ src/qemu/qemu_conf.h | 6 ++++++ src/qemu/qemu_domain.h | 1 + src/qemu/qemu_driver.c | 6 ++++++ src/qemu/test_libvirtd_qemu.aug.in | 2 ++ 9 files changed, 73 insertions(+), 11 deletions(-) -- 2.53.0

1 3

[PATCH] qemu: add automatic port allocation for pull-mode backup NBD servers
by Lucas Amaral 20 Mar '26

20 Mar '26

Previously, users had to manually specify a TCP port when starting a pull-mode backup with an NBD server. A TODO comment in qemuBackupPrepare() noted this limitation and pointed toward using virPortAllocator, as done for migration, VNC, and SPICE ports. Add backup_port_min and backup_port_max configuration options to qemu.conf, defaulting to 10809-10872 (10809 is the IANA-assigned NBD port; range of 64 matches the migration port pattern). When a pull-mode backup is started without specifying a TCP port, a port is now acquired automatically from the configured range via virPortAllocatorAcquire(). The port is released when the backup ends or if startup fails. Signed-off-by: Lucas Amaral <lucaaamaral(a)gmail.com> --- Build-tested and passed full test suite on CentOS Stream 9 (298 OK, 0 failures). Runtime-validated against an actual patched virtqemud instance running inside a privileged container (CentOS Stream 9, QEMU 10.1.0) with a live aarch64/virt guest. Config parsing validation: - Default config (no backup_port_* set): daemon starts OK - Custom range (backup_port_min=20000, backup_port_max=20010): daemon starts OK - Invalid (min > max): daemon correctly refuses to start - Invalid (min = 0): daemon correctly refuses to start - Invalid (max > 65535): daemon correctly refuses to start Port auto-allocation (live VM backup): - Pull-mode backup WITHOUT port specified: backup-begin succeeds, backup-dumpxml shows auto-allocated port='10809' from default range. Previously this would fail with: "<domainbackup> must specify TCP port for now" - Pull-mode backup WITH explicit port=10809: backup-begin succeeds, backup-dumpxml shows port='10809'. Behavior unchanged from before the patch. Port conflict and exhaustion (range set to 10809-10810, 3 VMs): - Auto-allocate on vm1 (got 10809), then manual port=10809 on vm2: QEMU correctly rejects with "Address already in use" - Auto-allocate vm1=10809, vm2=10810 (range full), vm3 attempt: "Unable to find an unused port in range 'backup' (10809-10810)" - After aborting vm1 backup (releasing 10809), vm3 retries and gets 10809: port release and reuse works correctly docs/formatbackup.rst | 3 ++- src/qemu/libvirtd_qemu.aug | 2 ++ src/qemu/qemu.conf.in | 9 ++++++++ src/qemu/qemu_backup.c | 33 +++++++++++++++++++++--------- src/qemu/qemu_conf.c | 25 ++++++++++++++++++++++ src/qemu/qemu_conf.h | 6 ++++++ src/qemu/qemu_domain.h | 1 + src/qemu/qemu_driver.c | 6 ++++++ src/qemu/test_libvirtd_qemu.aug.in | 2 ++ 9 files changed, 76 insertions(+), 11 deletions(-) diff --git a/docs/formatbackup.rst b/docs/formatbackup.rst index df6392e3bd..24857eaf72 100644 --- a/docs/formatbackup.rst +++ b/docs/formatbackup.rst @@ -42,7 +42,8 @@ were supplied). The following child elements and attributes are supported: ```protocol`` element of a disk <formatdomain.html#hard-drives-floppy-disks-cdroms>`__ attached via NBD in the domain (such as transport, socket, name, port, or tls), necessary to set up an NBD server that exposes the content of each disk at - the time the backup is started. + the time the backup is started. For TCP transport, if ``port`` is omitted, a + port is allocated automatically from the range configured in ``/etc/libvirt/qemu.conf``. In addition to the above the NBD server used for backups allows using ``transport='fd' fdgroup='NAME'`` where ``NAME`` is the name used with diff --git a/src/qemu/libvirtd_qemu.aug b/src/qemu/libvirtd_qemu.aug index 0286582169..eb790d48be 100644 --- a/src/qemu/libvirtd_qemu.aug +++ b/src/qemu/libvirtd_qemu.aug @@ -146,6 +146,8 @@ module Libvirtd_qemu = | int_entry "migration_port_min" | int_entry "migration_port_max" | str_entry "migration_host" + | int_entry "backup_port_min" + | int_entry "backup_port_max" let log_entry = bool_entry "log_timestamp" diff --git a/src/qemu/qemu.conf.in b/src/qemu/qemu.conf.in index 2d1c67034d..5eacd70022 100644 --- a/src/qemu/qemu.conf.in +++ b/src/qemu/qemu.conf.in @@ -969,6 +969,15 @@ #migration_port_max = 49215 +# Port range used for automatic allocation of NBD backup server ports. +# When a pull-mode backup is started without specifying a TCP port, a +# port from this range will be assigned automatically. The NBD standard +# port is 10809. +# +#backup_port_min = 10809 +#backup_port_max = 10872 + + # Timestamp QEMU's log messages (if QEMU supports it) # # Defaults to 1. diff --git a/src/qemu/qemu_backup.c b/src/qemu/qemu_backup.c index 44514d08fc..12ef64b14e 100644 --- a/src/qemu/qemu_backup.c +++ b/src/qemu/qemu_backup.c @@ -32,6 +32,7 @@ #include "storage_source.h" #include "storage_source_conf.h" #include "virerror.h" +#include "virportallocator.h" #include "virlog.h" #include "virbuffer.h" #include "backup_conf.h" @@ -71,16 +72,7 @@ qemuBackupPrepare(virDomainBackupDef *def) switch (def->server->transport) { case VIR_STORAGE_NET_HOST_TRANS_TCP: - /* TODO: Update qemu.conf to provide a port range, - * probably starting at 10809, for obtaining automatic - * port via virPortAllocatorAcquire, as well as store - * somewhere if we need to call virPortAllocatorRelease - * during BackupEnd. Until then, user must provide port */ - if (!def->server->port) { - virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", - _("<domainbackup> must specify TCP port for now")); - return -1; - } + /* port is auto-allocated if not set */ break; case VIR_STORAGE_NET_HOST_TRANS_UNIX: @@ -841,6 +833,16 @@ qemuBackupBegin(virDomainObj *vm, if (qemuBackupPrepare(def) < 0) goto endjob; + if (pull && def->server && + def->server->transport == VIR_STORAGE_NET_HOST_TRANS_TCP && + !def->server->port) { + unsigned short port = 0; + if (virPortAllocatorAcquire(priv->driver->backupPorts, &port) < 0) + goto endjob; + def->server->port = port; + priv->backupNBDPort = port; + } + if (qemuBackupBeginPrepareTLS(vm, cfg, def, &tlsProps, &tlsSecretProps) < 0) goto endjob; @@ -969,6 +971,11 @@ qemuBackupBegin(virDomainObj *vm, qemuDomainObjExitMonitor(vm); } + if (ret < 0 && priv->backupNBDPort) { + virPortAllocatorRelease(priv->backupNBDPort); + priv->backupNBDPort = 0; + } + if (ret < 0 && !job_started && priv->backup) def = g_steal_pointer(&priv->backup); @@ -1026,6 +1033,12 @@ qemuBackupNotifyBlockjobEndStopNBD(virDomainObj *vm, qemuDomainObjExitMonitor(vm); backup->nbdStopped = true; + + if (priv->backupNBDPort) { + virPortAllocatorRelease(priv->backupNBDPort); + priv->backupNBDPort = 0; + backup->server->port = 0; + } } diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index de6e51177a..99e6a29148 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -74,6 +74,9 @@ VIR_LOG_INIT("qemu.qemu_conf"); #define QEMU_MIGRATION_PORT_MIN 49152 #define QEMU_MIGRATION_PORT_MAX 49215 +#define QEMU_BACKUP_PORT_MIN 10809 +#define QEMU_BACKUP_PORT_MAX 10872 + VIR_ENUM_IMPL(virQEMUSchedCore, QEMU_SCHED_CORE_LAST, "none", @@ -265,6 +268,9 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privileged, cfg->migrationPortMin = QEMU_MIGRATION_PORT_MIN; cfg->migrationPortMax = QEMU_MIGRATION_PORT_MAX; + cfg->backupPortMin = QEMU_BACKUP_PORT_MIN; + cfg->backupPortMax = QEMU_BACKUP_PORT_MAX; + /* For privileged driver, try and find hugetlbfs mounts automatically. * Non-privileged driver requires admin to create a dir for the * user, chown it, and then let user configure it manually. */ @@ -985,6 +991,25 @@ virQEMUDriverConfigLoadNetworkEntry(virQEMUDriverConfig *cfg, return -1; } + if (virConfGetValueUInt(conf, "backup_port_min", &cfg->backupPortMin) < 0) + return -1; + if (cfg->backupPortMin <= 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("%1$s: backup_port_min: port must be greater than 0"), + filename); + return -1; + } + + if (virConfGetValueUInt(conf, "backup_port_max", &cfg->backupPortMax) < 0) + return -1; + if (cfg->backupPortMax > 65535 || + cfg->backupPortMax < cfg->backupPortMin) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("%1$s: backup_port_max: port must be between the minimal port %2$d and 65535"), + filename, cfg->backupPortMin); + return -1; + } + if (virConfGetValueString(conf, "migration_host", &cfg->migrateHost) < 0) return -1; virStringStripIPv6Brackets(cfg->migrateHost); diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index c284e108a1..2e68f1de14 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -240,6 +240,9 @@ struct _virQEMUDriverConfig { unsigned int migrationPortMin; unsigned int migrationPortMax; + unsigned int backupPortMin; + unsigned int backupPortMax; + bool logTimestamp; bool stdioLogD; @@ -338,6 +341,9 @@ struct _virQEMUDriver { /* Immutable pointer, immutable object */ virPortAllocatorRange *migrationPorts; + /* Immutable pointer, immutable object */ + virPortAllocatorRange *backupPorts; + /* Immutable pointer, lockless APIs */ virSysinfoDef *hostsysinfo; diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h index 5755d2adb0..1153d8c6e0 100644 --- a/src/qemu/qemu_domain.h +++ b/src/qemu/qemu_domain.h @@ -147,6 +147,7 @@ struct _qemuDomainObjPrivate { char *origname; int nbdPort; /* Port used for migration with NBD */ unsigned short migrationPort; + unsigned short backupNBDPort; int preMigrationState; unsigned long long preMigrationMemlock; /* Original RLIMIT_MEMLOCK in case it was changed for the current diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index c5eedeedfa..a8034b4f26 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -714,6 +714,12 @@ qemuStateInitialize(bool privileged, cfg->migrationPortMax)) == NULL) goto error; + if ((qemu_driver->backupPorts = + virPortAllocatorRangeNew(_("backup"), + cfg->backupPortMin, + cfg->backupPortMax)) == NULL) + goto error; + if (qemuSecurityInit(qemu_driver) < 0) goto error; diff --git a/src/qemu/test_libvirtd_qemu.aug.in b/src/qemu/test_libvirtd_qemu.aug.in index 82cfec3b4b..2582c6a09c 100644 --- a/src/qemu/test_libvirtd_qemu.aug.in +++ b/src/qemu/test_libvirtd_qemu.aug.in @@ -110,6 +110,8 @@ module Test_libvirtd_qemu = { "migration_host" = "host.example.com" } { "migration_port_min" = "49152" } { "migration_port_max" = "49215" } +{ "backup_port_min" = "10809" } +{ "backup_port_max" = "10872" } { "log_timestamp" = "0" } { "nvram" { "1" = "/usr/share/OVMF/OVMF_CODE.fd:/usr/share/OVMF/OVMF_VARS.fd" } -- 2.52.0

2 1

[libvirt PATCH 00/11] Introduce support to pass iommu FD to libvirt
by Pavel Hrdina 20 Mar '26

20 Mar '26

Pavel Hrdina (11): conf: Move and rename virStorageSourceFDTuple object conf: Refactor virHostdevIsPCIDevice hypervisor: Fix virHostdevNeedsVFIO detection qemu: Expand call to qemuDomainNeedsVFIO qemu: Update qemuDomainNeedsVFIO to ignore PCI hostdev with IOMMUFD src: Use virHostdevIsPCIDeviceWith* to check for IOMMUFD conf: Introduce domain iommufd element qemu: Implement iommufd conf: Add iommufd fdgroup support qemu: Implement iommufd fdgroup tests: Add iommufd fdgroup test docs/formatdomain.rst | 27 +++++ src/conf/domain_conf.c | 114 +++++++++++++++++- src/conf/domain_conf.h | 9 ++ src/conf/domain_validate.c | 16 +++ src/conf/meson.build | 1 + src/conf/schemas/domaincommon.rng | 15 +++ src/conf/storage_source_conf.c | 42 ------- src/conf/storage_source_conf.h | 24 +--- src/conf/virdomainfd.c | 52 ++++++++ src/conf/virdomainfd.h | 27 +++++ src/hypervisor/virhostdev.c | 2 +- src/libvirt_private.syms | 7 +- src/qemu/qemu_backup.c | 2 +- src/qemu/qemu_cgroup.c | 2 +- src/qemu/qemu_command.c | 6 +- src/qemu/qemu_domain.c | 21 +++- src/qemu/qemu_domain.h | 3 +- src/qemu/qemu_driver.c | 6 +- src/qemu/qemu_hotplug.c | 6 +- src/qemu/qemu_namespace.c | 2 +- src/qemu/qemu_process.c | 55 ++++++++- src/qemu/qemu_processpriv.h | 2 + src/qemu/qemu_validate.c | 2 +- src/security/security_apparmor.c | 2 +- src/security/security_dac.c | 4 +- src/security/security_selinux.c | 4 +- src/security/virt-aa-helper.c | 2 +- tests/genericxml2xmlindata/iommufd.xml | 18 +++ tests/genericxml2xmltest.c | 2 + .../iommufd-q35-fd.x86_64-latest.args | 41 +++++++ .../iommufd-q35-fd.x86_64-latest.xml | 60 +++++++++ tests/qemuxmlconfdata/iommufd-q35-fd.xml | 38 ++++++ tests/qemuxmlconftest.c | 9 +- tests/testutilsqemu.c | 2 +- 34 files changed, 522 insertions(+), 103 deletions(-) create mode 100644 src/conf/virdomainfd.c create mode 100644 src/conf/virdomainfd.h create mode 100644 tests/genericxml2xmlindata/iommufd.xml create mode 100644 tests/qemuxmlconfdata/iommufd-q35-fd.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-q35-fd.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-q35-fd.xml -- 2.53.0

2 23

Re: [PATCH RFC 02/12] migration/qapi: Rename MigrationStats to MigrationRAMStats
by Peter Xu 20 Mar '26

20 Mar '26

On Thu, Mar 19, 2026 at 07:12:52PM -0400, Peter Xu wrote: > This stats is only about RAM, so make it accurate. This paves way for > statistics for all devices. > > Note that even if this is part of qapi/, this should not be part of ABI of > at least query-migrate, because the structure is not changed, and this > stats is always reported only under the "ram" section. > > Cc: Daniel P. Berrangé <berrange(a)redhat.com> > Cc: Markus Armbruster <armbru(a)redhat.com> > Cc: Libvirt Mailing List <libvir-list(a)redhat.com> I got the address wrong.. Will update when I repost. Copying the correct one. > Signed-off-by: Peter Xu <peterx(a)redhat.com> > --- > docs/about/removed-features.rst | 2 +- > qapi/migration.json | 8 ++++---- > migration/migration-stats.h | 2 +- > 3 files changed, 6 insertions(+), 6 deletions(-) > > diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst > index 6f4447993c..7c4f4325f7 100644 > --- a/docs/about/removed-features.rst > +++ b/docs/about/removed-features.rst > @@ -699,7 +699,7 @@ was superseded by ``sections``. > ``query-migrate`` return value member ``skipped`` (removed in 9.1) > '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' > > -Member ``skipped`` of the ``MigrationStats`` struct hasn't been used > +Member ``skipped`` of the ``MigrationRAMStats`` struct hasn't been used > for more than 10 years. Removed with no replacement. > > ``migrate`` command option ``inc`` (removed in 9.1) > diff --git a/qapi/migration.json b/qapi/migration.json > index 7134d4ce47..cfc6ccee26 100644 > --- a/qapi/migration.json > +++ b/qapi/migration.json > @@ -12,7 +12,7 @@ > { 'include': 'sockets.json' } > > ## > -# @MigrationStats: > +# @MigrationRAMStats: > # > # Detailed migration status. > # > @@ -64,7 +64,7 @@ > # > # Since: 0.14 > ## > -{ 'struct': 'MigrationStats', > +{ 'struct': 'MigrationRAMStats', > 'data': {'transferred': 'int', 'remaining': 'int', 'total': 'int' , > 'duplicate': 'int', > 'normal': 'int', > @@ -209,7 +209,7 @@ > # If this field is not returned, no migration process has been > # initiated > # > -# @ram: `MigrationStats` containing detailed migration status, only > +# @ram: `MigrationRAMStats` containing detailed migration status, only > # returned if status is 'active' or 'completed'(since 1.2) > # > # @xbzrle-cache: `XBZRLECacheStats` containing detailed XBZRLE > @@ -309,7 +309,7 @@ > # Since: 0.14 > ## > { 'struct': 'MigrationInfo', > - 'data': {'*status': 'MigrationStatus', '*ram': 'MigrationStats', > + 'data': {'*status': 'MigrationStatus', '*ram': 'MigrationRAMStats', > '*vfio': 'VfioStats', > '*xbzrle-cache': 'XBZRLECacheStats', > '*total-time': 'int', > diff --git a/migration/migration-stats.h b/migration/migration-stats.h > index c0f50144c9..1153520f7a 100644 > --- a/migration/migration-stats.h > +++ b/migration/migration-stats.h > @@ -27,7 +27,7 @@ > > /* > * These are the ram migration statistic counters. It is loosely > - * based on MigrationStats. > + * based on MigrationRAMStats. > */ > typedef struct { > /* > -- > 2.50.1 > -- Peter Xu

1 0

[PATCH] qemuMigrationSrcBeginPhase: Don't call 'qemuBlockNodesEnsureActive' with offline VM
by Peter Krempa 18 Mar '26

18 Mar '26

From: Peter Krempa <pkrempa(a)redhat.com> Commits 7b5566ce67b18a and f879d5f40385358 ( v11.8.0-92-gf879d5f403 ) moved around code for re-activating block backends after migration. While previously it was done when migration failed now we do it when we need qemu to do some block operations. Commit 7b5566ce67b18a introduced a bug where 'qemuBlockNodesEnsureActive' is called also when the VM is offline (for migration with 'VIR_MIGRATE_OFFLINE'). That doesn't work though as attempting to enter the monitor of an inactive VM returns failure. Address it by calling 'qemuBlockNodesEnsureActive' only on active VMs during migration. Fixes: 7b5566ce67b18a2bebe68fdb07e046f25185f8d3 Resolves: https://redhat.atlassian.net/browse/RHEL-156800 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_migration.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index fec808ccfb..3141018a78 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -2870,7 +2870,8 @@ qemuMigrationSrcBeginPhase(virQEMUDriver *driver, vm->newDef && !qemuDomainVcpuHotplugIsInOrder(vm->newDef))) cookieFlags |= QEMU_MIGRATION_COOKIE_CPU_HOTPLUG; - if (qemuBlockNodesEnsureActive(vm, vm->job->asyncJob) < 0) + if (virDomainObjIsActive(vm) && + qemuBlockNodesEnsureActive(vm, vm->job->asyncJob) < 0) return NULL; return qemuMigrationSrcBeginXML(vm, xmlin, -- 2.53.0

2 1

Plans for 12.2.0 release (freeze on 2026-03-26)
by Jiri Denemark 18 Mar '26

18 Mar '26

We are getting close to 12.2.0 release of libvirt. To aim for the release on Wednesday 01 Apr I suggest entering the freeze on Thursday 26 Mar and tagging RC2 on Monday 30 Mar. I hope this works for everyone. Jirka

1 0

[PATCH] virt-aa-helper : grant access to unix socket for qgsd
by Hector Cao 18 Mar '26

18 Mar '26

For quote generation and remote attestation, Intel TDX VM communicates with the QGSD (Quote Generation Service) on the host via unix socket. The unix socket can be specified via: <launchSecurity type='tdx'> ... <quoteGenerationService path='/var/run/tdx-qgs/qgs.socket'/> </launchSecurity> in case the path field is omitted, a default path is used. This commit generates the needed rule in the dynamic AA profile for the VM. Signed-off-by: Hector Cao <hector.cao(a)canonical.com> --- src/security/virt-aa-helper.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index e932e79dab..53059ad5fa 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1397,6 +1397,19 @@ get_files(vahControl * ctl) break; case VIR_DOMAIN_LAUNCH_SECURITY_PV: case VIR_DOMAIN_LAUNCH_SECURITY_TDX: + /* To communicate with the QGSD daemon running on the host, if we use the unix socket, + * allow the VM to access to the unix socket. + */ + if (ctl->def->sec->data.tdx.haveQGS) { + const char *qgsd_sock_file = QGS_UNIX_SOCKET_FILE; + if (ctl->def->sec->data.tdx.qgs_unix_path) { + qgsd_sock_file = ctl->def->sec->data.tdx.qgs_unix_path; + } + if (vah_add_file(&buf, qgsd_sock_file, "rw") != 0) { + return -1; + } + } + break; case VIR_DOMAIN_LAUNCH_SECURITY_NONE: case VIR_DOMAIN_LAUNCH_SECURITY_LAST: break; -- 2.43.0

3 3

[PATCH v3 0/1] virt-aa-helper : grant access to unix socket for qgsd
by Hector Cao 18 Mar '26

18 Mar '26

Thanks Daniel for the review, I fixed the indent in the previous mail but realized afterwards that I need to add an other improvement to the patch, even though functionally, the previous patch works. The change is about moving the VIR_DOMAIN_LAUNCH_SECURITY_PV case after VIR_DOMAIN_LAUNCH_SECURITY_TDX block. Hector Cao (1): virt-aa-helper : grant access to unix socket for qgsd src/security/virt-aa-helper.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) -- 2.43.0

1 1

[PATCH 0/5] qemuhotplug: Introduce interface-network-hostdev
by Michal Privoznik 17 Mar '26

17 Mar '26

*** BLURB HERE *** Michal Prívozník (5): tests: Drop WITH_QEMU from qemu specific tests binaries/libraries qemuxmlconftest: Separate fake drivers into a separate file virnetworkportxml2xmldata: Use different PCI address in plug-hostdev-pci.xml qemuhotplugtest: Use fake drivers qemuhotplug: Introduce interface-network-hostdev tests/meson.build | 5 +- tests/qemudomaincheckpointxml2xmltest.c | 31 +- tests/qemudomainsnapshotxml2xmltest.c | 29 +- tests/qemufakedrivers.c | 368 +++++++++++++++ tests/qemufakedrivers.h | 19 + tests/qemuhotplugtest.c | 20 + .../qemuhotplug-interface-network-hostdev.xml | 4 + ...ug-base-live+interface-network-hostdev.xml | 63 +++ tests/qemumemlocktest.c | 25 +- ...-virtio-teaming-network.x86_64-latest.args | 2 +- tests/qemuxmlconftest.c | 443 +++--------------- tests/testutilsqemu.c | 43 +- tests/testutilsqemu.h | 23 +- .../plug-hostdev-pci.xml | 2 +- 14 files changed, 588 insertions(+), 489 deletions(-) create mode 100644 tests/qemufakedrivers.c create mode 100644 tests/qemufakedrivers.h create mode 100644 tests/qemuhotplugtestdevices/qemuhotplug-interface-network-hostdev.xml create mode 100644 tests/qemuhotplugtestdomains/qemuhotplug-base-live+interface-network-hostdev.xml -- 2.52.0

2 7

[PATCH] network: Don't enable ip_forward for VIR_NETWORK_FORWARD_OPEN
by Michal Privoznik 17 Mar '26

17 Mar '26

From: Michal Privoznik <mprivozn(a)redhat.com> For a network that's <forward mode="open"/> there are no firewall rules added. We should not assume that users will configure NAT, and if they do it should be their responsibility to enable IP forwarding too. Resolves: https://gitlab.com/libvirt/libvirt/-/work_items/863 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/network/bridge_driver.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index d50d42c98c..ecfce5d9a4 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -2080,8 +2080,9 @@ networkStartNetworkVirtual(virNetworkDriverState *driver, } } - /* If forward.type != NONE, turn on global IP forwarding */ - if (def->forward.type != VIR_NETWORK_FORWARD_NONE) { + /* If forward.type != NONE and != OPEN, turn on global IP forwarding */ + if (def->forward.type != VIR_NETWORK_FORWARD_NONE && + def->forward.type != VIR_NETWORK_FORWARD_OPEN) { if (v6present && !virNetDevIPCheckIPv6Forwarding()) goto error; /* Precise error message already provided */ -- 2.52.0

2 1

A few questions about libvirt-java
by Takashi Kajinami 17 Mar '26

17 Mar '26

Hi, I've been working in a downstream project using libvirt-java to manage resources in libvirt from our application written in Java. The library has been working well so far, but I'm interested in contributing further improvements of the library, such as; - Replace finalize by more modern mechanisms such as (Auto)Closeable (finalize is deprecated in recent OpenJDK versions) - Complete migration to maven (to get rid of maven-ant-tasks which was already retired) However some of the planned contributions (especially the ones listed above) have relatively large impact and I'd like to ask a few questions so that so that we can drive the effort more smoothly. 1. Do you think that these are good/reasonable improvements ? 2. May I request a new release ? The last release (0.5.3) was released 4 years ago and several changes such as new features have been merged since then. Creating a release allows us to mave backword incompatible changes with less user impact. 3. Can we bump minimum JDK version ? Current minimum JSK version supported by the library is 1.8.0 but this is quite old ELS. I wonder if we can bump it to a newer version such as OpenJDK 17 or even 21. This is required to replace "finalize". Is there requirement about the platform the library should support ? Any feedback or guidance is very much appreciated ! Thank you, Takashi -- Takashi Kajinami irc: tkajinam github: https://github.com/kajinamit launchpad: https://launchpad.net/~kajinamit

2 3

[PATCH 0/3] Random improvements
by Michal Privoznik 17 Mar '26

17 Mar '26

I've noticed an old branch. I've accumulated these while working on the networkxmlconftest. Michal Prívozník (3): src: Drop NULL check before calling virBufferEscapeString() network: Format <ip/> element using virXMLFormatElement() networkxmlconftest: s/fail/cleanup/ src/conf/domain_conf.c | 17 ++-- src/conf/network_conf.c | 87 ++++++++----------- src/conf/node_device_conf.c | 4 +- src/qemu/qemu_domain.c | 16 ++-- .../nat-network-dns-hosts-modified.xml | 3 +- .../nat-network-dns-more-hosts.xml | 3 +- .../nat-network-dns-srv-record.xml | 12 +-- .../nat-network-dns-srv-records.xml | 12 +-- .../nat-network-dns-txt-modify-ok.xml | 12 +-- .../nat-network-dns-txt-none.xml | 12 +-- .../nat-network-dns-txt-records.xml | 12 +-- .../nat-network-forward-ifaces.xml | 12 +-- .../nat-network-host-updated.xml | 12 +-- .../nat-network-hosts.xml | 12 +-- .../nat-network-no-forward-ifaces.xml | 12 +-- .../nat-network-no-hosts.xml | 3 +- .../nat-network-no-range.xml | 12 +-- .../nat-network-one-host.xml | 12 +-- tests/networkxml2xmlupdateout/nat-network.xml | 12 +-- .../dhcp6-nat-network.expect.xml | 6 +- .../nat-network-dns-forward-plain.expect.xml | 3 +- ...network-dns-forwarder-no-resolv.expect.xml | 3 +- .../nat-network-dns-forwarders.expect.xml | 3 +- .../nat-network-dns-hosts.expect.xml | 3 +- .../nat-network-dns-local-domain.expect.xml | 3 +- ...-network-dns-srv-record-minimal.expect.xml | 12 +-- .../nat-network-dns-srv-record.expect.xml | 12 +-- .../nat-network-dns-srv-records.expect.xml | 12 +-- .../nat-network-dns-txt-record.expect.xml | 12 +-- .../nat-network-explicit-flood.expect.xml | 12 +-- ...nat-network-forward-nat-address.expect.xml | 12 +-- .../nat-network-forward-nat-ipv6.expect.xml | 3 +- ...-network-forward-nat-no-address.expect.xml | 12 +-- .../nat-network-mtu.expect.xml | 12 +-- .../nat-network-name-with-quotes.expect.xml | 12 +-- .../networkxmlconfdata/nat-network.expect.xml | 12 +-- .../open-network.expect.xml | 3 +- .../ptr-domains-auto.expect.xml | 12 +-- .../routed-network-no-dns.expect.xml | 3 +- .../routed-network.expect.xml | 3 +- tests/networkxmlconftest.c | 18 ++-- 41 files changed, 167 insertions(+), 293 deletions(-) -- 2.52.0

2 4

[PATCH 0/4] libvirt: AMD IOMMU fixes
by Xiaotian Feng 13 Mar '26

13 Mar '26

This series refines libvirt's logic for large vCPU configurations (>255) on x86/q35 machine types. Historically, the threshold was tied to Intel's EIM capability, but the real requirement is x2APIC support for APIC IDs beyond 255. AMD platforms can satisfy this via xtsup on amd-iommu. Summary of changes: 1. Fix virDomainIOMMUDefEquals to include pt and xtsup attributes for proper checks. 2. Correct error messages for passthrough (pt) and xtsup attributes to reflect their actual names instead of "dma translation". 3. Rename QEMU_MAX_VCPUS_WITHOUT_EIM to QEMU_MAX_VCPUS_WITHOUT_X2APIC and update validation logic to accept either: - intel-iommu with eim='on', or - amd-iommu with xtsup='on' for guests with more than 255 vCPUs. Error messages now mention x2APIC mode instead of extended interrupt mode. 4. Add QEMU_CAPS_AMD_IOMMU_XTSUP capability and enable xtsup by default for AMD IOMMU when a Q35 domain has >255 vCPUs, similar to Intel EIM auto-enable logic. Also ensure intremap is turned on when required. This makes the behavior vendor-neutral and improves usability for AMD EPYC guests with large vCPU counts. No ABI changes beyond stricter equality checks; this is a clarification and extension of existing logic. Xiaotian Feng (4): conf: fix virDomainIOMMUDefEquals for amd_iommu conf: fix error log for passthrough and xtsup attributes conf: support >255 vcpu w/ amd-iommu xtsup qemu: Enable AMD IOMMU XTSUP by default src/conf/domain_conf.c | 6 ++++-- src/qemu/qemu_capabilities.c | 2 ++ src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_postparse.c | 42 +++++++++++++++++++++++------------- src/qemu/qemu_validate.c | 11 +++++----- src/qemu/qemu_validate.h | 2 +- 6 files changed, 41 insertions(+), 23 deletions(-) -- 2.34.1

2 6

[PATCH] storage: mpath: fix error reporting in virStorageBackendGetMaps
by Lucas Amaral 13 Mar '26

13 Mar '26

virStorageBackendGetMaps() returns 1 on failure instead of the conventional -1, and does not call virReportError() in any of its error paths. On top of that, both callers silently discard the return value: virStorageBackendGetMaps() ignores the result of virStorageBackendCreateVols(), and virStorageBackendMpathRefreshPool() ignores the result of virStorageBackendGetMaps(). Fix all three issues: normalize error returns to -1, add virReportError() calls for each failure path in virStorageBackendGetMaps(), and check return values in both callers so that errors are properly propagated. Signed-off-by: Lucas Amaral <lucaaamaral(a)gmail.com> --- This is similar in spirit to commits e9b931d3e4 ("virpci: Report an error if virPCIGetVirtualFunctionIndex() fails") and 6c2c9e21ac ("virstorageobj: Make virStoragePoolObjAddVol() report an error on failure"), applying the same pattern to the mpath storage backend. Found while auditing storage backends for functions that return error codes without calling virReportError(). src/storage/storage_backend_mpath.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/src/storage/storage_backend_mpath.c b/src/storage/storage_backend_mpath.c index 9fc3983c52..a30153a93b 100644 --- a/src/storage/storage_backend_mpath.c +++ b/src/storage/storage_backend_mpath.c @@ -197,19 +197,25 @@ virStorageBackendGetMaps(virStoragePoolObj *pool) struct dm_names *names = NULL; if (!(dmt = dm_task_create(DM_DEVICE_LIST))) { - retval = 1; + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Failed to create devmapper task")); + retval = -1; goto out; } dm_task_no_open_count(dmt); if (!dm_task_run(dmt)) { - retval = 1; + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Failed to run devmapper task")); + retval = -1; goto out; } if (!(names = dm_task_get_names(dmt))) { - retval = 1; + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Failed to get devmapper device names")); + retval = -1; goto out; } @@ -218,7 +224,10 @@ virStorageBackendGetMaps(virStoragePoolObj *pool) goto out; } - virStorageBackendCreateVols(pool, names); + if (virStorageBackendCreateVols(pool, names) < 0) { + retval = -1; + goto out; + } out: if (dmt != NULL) @@ -248,7 +257,8 @@ virStorageBackendMpathRefreshPool(virStoragePoolObj *pool) virWaitForDevices(); - virStorageBackendGetMaps(pool); + if (virStorageBackendGetMaps(pool) < 0) + return -1; return 0; } -- 2.52.0

2 1

[libvirt PATCH] viriommufd: Set IOMMU_OPTION_RLIMIT_MODE only when running privileged
by Pavel Hrdina 13 Mar '26

13 Mar '26

From: Pavel Hrdina <phrdina(a)redhat.com> If libvirt daemon is running unprivileged it will fail so we should not even try to set it. Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/qemu/qemu_process.c | 2 +- src/util/viriommufd.c | 6 +++--- src/util/viriommufd.h | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index ab7cf03c0e..ecd05b4bf6 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -7732,7 +7732,7 @@ qemuProcessOpenIommuFd(virDomainObj *vm) VIR_DEBUG("Opening IOMMU FD for domain %s", vm->def->name); - if ((iommufd = virIOMMUFDOpenDevice()) < 0) + if ((iommufd = virIOMMUFDOpenDevice(priv->driver->privileged)) < 0) return -1; if (qemuSecuritySetImageFDLabel(priv->driver->securityManager, vm->def, iommufd) < 0) diff --git a/src/util/viriommufd.c b/src/util/viriommufd.c index b62d59241d..82920923a2 100644 --- a/src/util/viriommufd.c +++ b/src/util/viriommufd.c @@ -80,14 +80,14 @@ virIOMMUFDSetRLimitMode(int fd, bool processAccounting) } int -virIOMMUFDOpenDevice(void) +virIOMMUFDOpenDevice(bool privileged) { int fd = -1; if ((fd = open(VIR_IOMMU_DEV_PATH, O_RDWR | O_CLOEXEC)) < 0) virReportSystemError(errno, "%s", _("cannot open IOMMUFD device")); - if (virIOMMUFDSetRLimitMode(fd, true) < 0) { + if (privileged && virIOMMUFDSetRLimitMode(fd, true) < 0) { VIR_FORCE_CLOSE(fd); return -1; } @@ -98,7 +98,7 @@ virIOMMUFDOpenDevice(void) #else int -virIOMMUFDOpenDevice(void) +virIOMMUFDOpenDevice(bool privileged G_GNUC_UNUSED) { virReportError(VIR_ERR_NO_SUPPORT, "%s", _("IOMMUFD is not supported on this platform")); diff --git a/src/util/viriommufd.h b/src/util/viriommufd.h index 223f44eb5c..7bad5c7472 100644 --- a/src/util/viriommufd.h +++ b/src/util/viriommufd.h @@ -22,6 +22,6 @@ #define VIR_IOMMU_DEV_PATH "/dev/iommu" -int virIOMMUFDOpenDevice(void); +int virIOMMUFDOpenDevice(bool privileged); bool virIOMMUFDSupported(void); -- 2.53.0

2 1

[PATCH 0/5] hyperv: Implement basic snapshot query APIs
by Jonathon Jongsma 13 Mar '26

13 Mar '26

This is the first patch series adding snapshot support for the hyperv driver. It only implements the basic functions for querying information about snapshots and doesn't handle creating or deleting snapshots yet. Jonathon Jongsma (5): hyperv: Implement domainSnapshotLookupByName() hyperv: implement virDomainListAllSnapshots()/virDomainSnapshotNum() hyperv: implement virDomainSnapshotGetXMLDesc() hyperv: Implement virDomainSnapshotCurrent()/virDomainHasCurrentSnapshot() hyperv: Implement virDomainSnapshotGetParent() src/hyperv/hyperv_driver.c | 276 +++++++++++++++++++++++++++++++++++++ src/hyperv/hyperv_wmi.c | 20 +++ src/hyperv/hyperv_wmi.h | 7 + 3 files changed, 303 insertions(+) -- 2.53.0

2 7

virsh feature request: cold restart and/or synchronous shutdown option
by roy-orbitson＠devo.net.au 13 Mar '26

13 Mar '26

When libvirt components get updated on a hypervisor, VMs continue running with obsolete files. Programs like "needrestart" alert one to this condition with messages like: VM guests are running outdated hypervisor (qemu) binaries on this host: 'bazquux' with pid 1234 Normal restarting of a VM (from within or with `virsh reboot ...`) does not resolve it because it's 'warm'; VMs must be completely shut down then started again to utilise the updates. Afaik, to do so reliably, in a way that minimises downtime, requires scripts like this: (d=bazquux; virsh shutdown --domain "$d" && until LC_ALL=C LANG=C virsh domstate --domain "$d" | grep -Fi 'shut off' &> /dev/null; do echo ...; sleep 1; done && virsh start --domain "$d") Adding a timeout complicates that further. Options for this logic to be performed by virsh would be beneficial, as a single operation: virsh reboot --domain bazquux --cold And by allowing poweroff to wait: (d=bazquux; virsh shutdown --domain "$d" --synchronous && virsh start --domain "$d") The latter would also assist with scripting changes to a VM that can only be performed whilst it is not running (shutdown -> alter -> start). Ideally, these would accept `--timeout n` so that if the shutdown portion was not completed quickly enough, they would fail and exit with a non-zero status, and the former would not start the VM again. I'm not sure of a good way to handle this where `on_poweroff` is set to something that doesn't result in the machine being shut off.

5 8

[PATCH v1 0/1] rpc: fix virNetClient->error leak on teardown
by Leander Kohler 12 Mar '26

12 Mar '26

Hi all, this is my first contribution to libvirt upstream. I am with Cyberus Technology, where I work on cloud-hypervisor and its integration with OpenStack and libvirt. The following fixes a leak in virNetClient teardown. virNetClientMarkClose() may save the current error in client->error (via virSaveLastError()). We usually free that in virNetClientCloseLocked(), but we can also end up disposing the client without going through that cleanup. One path where this happens is: virConnectDispose() -> remoteConnectClose() -> doRemoteClose() -> virNetClientClose(priv->client) -> g_clear_pointer(&priv->client, virObjectUnref) In that case, client->error can stay allocated until finalization, and ASan reports a leak. Fix is to also clear client->error in virNetClientDispose() as a final fallback. I included an ASan trace below. Thanks, Leander --- Line numbers in this trace come from our downstream libvirt fork and may differ from upstream, but the call path/function names are the same. [ 276.247727] virtchd[4030]: ==4030==ERROR: LeakSanitizer: detected memory leaks Direct leak of 80 byte(s) in 1 object(s) allocated from: #0 0x7fcd6009e110 in calloc (libasan.so.8+0xfc110) #1 0x7fcd5dcb95bd in g_malloc0 (libglib-2.0.so.0+0x6d5bd) #2 0x7fcd5eb15f31 in virSaveLastError ../src/util/virerror.c:413 #3 0x7fcd5ee6c76c in virNetClientMarkClose ../src/rpc/virnetclient.c:776 #4 0x7fcd5ee6f782 in virNetClientCloseInternal ../src/rpc/virnetclient.c:837 #5 0x7fcd5f0150e4 in doRemoteClose ../src/remote/remote_driver.c:1414 #6 0x7fcd5f0150e4 in remoteConnectClose ../src/remote/remote_driver.c:1442 #7 0x7fcd5f1a90ef in virConnectDispose ../src/datatypes.c:174 #8 0x7fcd5ea58ebb in vir_object_finalize ../src/util/virobject.c:323 #9 0x7fcd5dc05c52 in g_object_unref (libgobject-2.0.so.0+0x1ec52) #10 0x7fcd5ea59fc7 in virObjectUnref ../src/util/virobject.c:377 #11 0x7fcd5ea59fc7 in virObjectUnref ../src/util/virobject.c:370 #12 0x7fcd5ef3a92f in glib_autoptr_clear_virConnect ../src/datatypes.h:548 #13 0x7fcd5ef3a92f in glib_autoptr_cleanup_virConnect ../src/datatypes.h:548 #14 0x7fcd5ef3a92f in virDomainInterfaceDeleteDevice ../src/hypervisor/domain_interface.c:419 #15 0x7fcd594a0cd3 in virCHProcessStopOrKill ../src/ch/ch_process.c:1308 #16 0x7fcd594a8bfa in virCHProcessStop ../src/ch/ch_process.c:1363 #17 0x7fcd5945d8c7 in chDomainDestroyFlags ../src/ch/ch_driver.c:959 #18 0x7fcd5f0f69c0 in virDomainDestroy ../src/libvirt-domain.c:514 #19 0x55c25777376a in remoteDispatchDomainDestroy src/remote/remote_daemon_dispatch_stubs.h:5485 #20 0x55c25777376a in remoteDispatchDomainDestroyHelper src/remote/remote_daemon_dispatch_stubs.h:5464 #21 0x7fcd5ee7c42c in virNetServerProgramDispatchCall ../src/rpc/virnetserverprogram.c:423 #22 0x7fcd5ee7c42c in virNetServerProgramDispatch ../src/rpc/virnetserverprogram.c:299 #23 0x7fcd5ee97c6c in virNetServerProcessMsg ../src/rpc/virnetserver.c:135 #24 0x7fcd5ee98b43 in virNetServerHandleJob ../src/rpc/virnetserver.c:155 #25 0x7fcd5eadbce2 in virThreadPoolWorker ../src/util/virthreadpool.c:164 #26 0x7fcd5eada3c9 in virThreadHelper ../src/util/virthread.c:256 #27 0x7fcd60004cd5 in asan_thread_start(void*) (libasan.so.8+0x62cd5) #28 0x7fcd5d200979 in start_thread (libc.so.6+0x9a979) #29 0x7fcd5d288d2b in __GI___clone3 (libc.so.6+0x122d2b) Objects leaked above: 0x507000064400 (80 bytes) SUMMARY: AddressSanitizer: 80 byte(s) leaked in 1 allocation(s). Leander Kohler (1): rpc: free saved close error in virNetClientDispose src/rpc/virnetclient.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.51.2

2 2

[PATCH] util: implement virHostCPUGetOnlineBitmap() for FreeBSD
by Roman Bogorodskiy 12 Mar '26

12 Mar '26

Implement virHostCPUGetOnlineBitmap() for FreeBSD. As FreeBSD supports neither plugging nor taking CPUs offline, all CPUs are always online. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/util/virhostcpu.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/src/util/virhostcpu.c b/src/util/virhostcpu.c index 7cecb4b2c8..8688b6ec67 100644 --- a/src/util/virhostcpu.c +++ b/src/util/virhostcpu.c @@ -1120,6 +1120,19 @@ virHostCPUGetOnlineBitmap(void) virFileReadValueBitmap(&ret, "%s/cpu/online", SYSFS_SYSTEM_PATH); + return ret; +#elif defined(__FreeBSD__) + virBitmap *ret = NULL; + int ncpus = virHostCPUGetCountAppleFreeBSD(); + + if (ncpus == -1) + return ret; + + /* FreeBSD does not support CPU hotplug, so it is safe to assume + * that all available CPUs are online */ + ret = virBitmapNew(ncpus); + virBitmapSetAll(ret); + return ret; #else virReportError(VIR_ERR_NO_SUPPORT, "%s", -- 2.52.0

2 1

[RFC PATCH v2 0/2] qemu: Support vCMDQ
by Nathan Chen 11 Mar '26

11 Mar '26

Hi, This is a follow up to the previous RFC patchset [0] for supporting Tegra241 vCMDQ. This patchset is tested with Shameer's v3 qemu series [1] for vCMDQ support. The accelerated SMMUv3 series for qemu and Libvirt [2] are pre-requisites for vCMDQ support, as accelerated SMMUv3 must be enabled alongside vCMDQ. A new 'cmdqv' <iommu> driver attribute is introduced to toggle enabling vCMDQ support. For instance, specifying hostdevs associated with multiple accelerated SMMUs + CMDQV enabled, configured to be routed to pcie-expander-bus controllers in a way where VFIO device to SMMUv3 associations are matched with the host: <devices> ... <controller type='pci' index='1' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='252'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </controller> <controller type='pci' index='2' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='248'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </controller> ... <controller type='pci' index='21' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='21' port='0x0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </controller> <controller type='pci' index='22' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='22' port='0xa8'/> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </controller> ... <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> <iommu model='smmuv3'> <driver pciBus='1' accel='on' ats='on' ril='on' ssidSize='20' oas='44' cmdqv='on'/> </iommu> <iommu model='smmuv3'> <driver pciBus='2' accel='on' ats='on' ril='on' ssidSize='20' oas='44' cmdqv='on'/> </iommu> </devices> This would get translated to a qemu command line with the arguments below: -device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ -device '{"driver":"pxb-pcie","bus_nr":248,"id":"pci.2","bus":"pcie.0","addr":"0x2"}' \ -device '{"driver":"pcie-root-port","port":0,"chassis":21,"id":"pci.21","bus":"pci.1","addr":"0x0"}' \ -device '{"driver":"pcie-root-port","port":168,"chassis":22,"id":"pci.22","bus":"pci.2","addr":"0x0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"iommu0","accel":true,"ats":true,"cmdqv":"on","ril":true,"pasid":true,"oas":44}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.2","id":"iommu1","accel":true,"ats":true,"cmdqv":"on","ril":true,"pasid":true,"oas":44}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","bus":"pci.22","addr":"0x0"}' \ This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/cmdqv-03-26/ Thanks, Nathan Changes from v1: - Remove 'identifier' attribute for SMMUv3 - Change QEMU command line property from 'tegra241-cmdqv' to 'cmdqv' - Support QEMU OnOffAuto CMDQV property instead of expecting a bool [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/NHVK… [1] https://lore.kernel.org/all/20260226105056.897-1-skolothumtho@nvidia.com/ [2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/5GG7… Nathan Chen (2): qemu: Support NVIDIA Tegra241 CMDQV for SMMUv3 tests: qemuxmlconfdata: provide cmdqv sample XML and CLI args docs/formatdomain.rst | 6 ++ src/conf/domain_conf.c | 15 ++++ src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 5 +- src/conf/schemas/domaincommon.rng | 5 ++ src/qemu/qemu_command.c | 1 + ...u-smmuv3-pci-bus-cmdqv.aarch64-latest.args | 45 +++++++++++ ...mu-smmuv3-pci-bus-cmdqv.aarch64-latest.xml | 76 +++++++++++++++++++ .../iommu-smmuv3-pci-bus-cmdqv.xml | 66 ++++++++++++++++ tests/qemuxmlconftest.c | 1 + 10 files changed, 220 insertions(+), 1 deletion(-) create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-cmdqv.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-cmdqv.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-cmdqv.xml -- 2.43.0

1 2

[PATCH v7 0/2] qemu: Support accelerated vSMMUs
by Nathan Chen 11 Mar '26

11 Mar '26

Hi, This is a follow up to the sixth RFC patchset [0] for supporting multiple accelerated vSMMU instances. Support for user-creatable accelerated SMMUv3 in QEMU has been applied to target-arm.next [1]. For instance, specifying hostdevs associated with multiple accelerated SMMUs, configured to be routed to pcie-expander-bus controllers in a way where VFIO device to SMMUv3 associations are matched with the host: <devices> ... <controller type='pci' index='1' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='252'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </controller> <controller type='pci' index='2' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='248'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </controller> ... <controller type='pci' index='21' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='21' port='0x0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </controller> <controller type='pci' index='22' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='22' port='0xa8'/> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </controller> ... <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <vpasidCapOffset>0xff8</vpasidCapOffset> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <vpasidCapOffset>0xff8</vpasidCapOffset> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> <iommu model='smmuv3'> <driver parentIdx='1' accel='on' ats='on' ril='off' ssidSize='20' oas='44'/> </iommu> <iommu model='smmuv3'> <driver parentIdx='2' accel='on' ats='on' ril='off' ssidSize='20' oas='44'/> </iommu> </devices> This would get translated to a qemu command line with the arguments below: -device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ -device '{"driver":"pxb-pcie","bus_nr":248,"id":"pci.2","bus":"pcie.0","addr":"0x2"}' \ -device '{"driver":"pcie-root-port","port":0,"chassis":21,"id":"pci.21","bus":"pci.1","addr":"0x0"}' \ -device '{"driver":"pcie-root-port","port":168,"chassis":22,"id":"pci.22","bus":"pci.2","addr":"0x0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"iommu0","accel":true,"ats":true,"ril":false,"ssidsize":20,"oas":44}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.2","id":"iommu1","accel":true,"ats":true,"ril":false,"ssidsize":20,"oas":44}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","x-vpasid-cap-offset":4088,"bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","x-vpasid-cap-offset":4088,"bus":"pci.22","addr":"0x0"}' \ This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/smmuv3-accel-01-26-v7/ Thanks, Nathan Changes from v6: - Remove smmuv3 'pasid' attribute - Add smmuv3 'ssidsize' attribute - Add support for 'vpasidCapOffset' element - Modify logic for building accel smmuv3 qemu command line to omit ATS, RIL, accel flags when not needed (enabled/disabled by default in QEMU SMMUv3) [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/VRSS… [1] https://lore.kernel.org/qemu-devel/20260126104342.253965-1-skolothumtho@nvi… Nathan Chen (2): qemu: Add support for HW-accelerated nested SMMUv3 tests: qemuxmlconfdata: provide HW-accel smmuv3 sample XML and CLI args docs/formatdomain.rst | 36 +++++++ src/conf/domain_conf.c | 101 +++++++++++++++++- src/conf/domain_conf.h | 6 ++ src/conf/domain_validate.c | 36 ++++++- src/conf/schemas/domaincommon.rng | 32 ++++++ src/qemu/qemu_command.c | 23 ++++ src/util/virpci.h | 4 + ...u-smmuv3-pci-bus-accel.aarch64-latest.args | 38 +++++++ ...mu-smmuv3-pci-bus-accel.aarch64-latest.xml | 64 +++++++++++ .../iommu-smmuv3-pci-bus-accel.xml | 54 ++++++++++ tests/qemuxmlconftest.c | 1 + 11 files changed, 390 insertions(+), 5 deletions(-) create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus-accel.xml -- 2.43.0

2 9

[PATCH 0/4] Add support for expanding CPU features in domain capabilities
by Jiri Denemark 11 Mar '26

11 Mar '26

Consistently with all other CPU definitions, domain capabilities report host-model CPU as a base model and additional list of features. Getting all features supported on a host is possible by passing the host-model CPU definition to hypervisor-cpu-baseline with --features option. But while this is very easy in virsh (domain capabilities can by directly piped to hypervisor-cpu-baseline), doing this via API is more complicated. The relevant part of the domain XML needs to be copied into a new XML document, formatted and passed to virConnectBaselineHypervisorCPU. This series adds the ability to expand CPU features directly in the domain capabilities XML without having to call another API. Jiri Denemark (4): Introduce EXPAND_CPU_FEATURES flag for domain capabilities qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES virsh: Add --expand-cpu-features option for domcapabilities docs: Clarify host-model description in domain capabilities docs/formatdomaincaps.rst | 4 ++++ docs/manpages/virsh.rst | 5 +++++ include/libvirt/libvirt-domain.h | 2 ++ src/libvirt-domain.c | 5 +++++ src/qemu/qemu_driver.c | 9 ++++++++- tools/virsh-host.c | 7 +++++++ 6 files changed, 31 insertions(+), 1 deletion(-) -- 2.53.0

2 5

[PATCH] tests: Create fake root dirs later
by Michal Privoznik 11 Mar '26

11 Mar '26

From: Michal Privoznik <mprivozn(a)redhat.com> In one of previous commits the virTestMain() function was changed to actually create fake HOME, XDG_RUNTIME_DIR, ... directories instead of setting spoofed values in the environment. But alongside with this, the call to virTestFakeRootDirInit() was moved (to location where environment was poisoned). And this would not matter if it wasn't for mocking. Because what we ended up with is virTestFakeRootDirInit() is called and then (optionally) the process re-execs itself (with mocks loaded). This means that previously created root dirs are never cleaned up and just pollute builddir. Therefore, restore original location from which the function was called. Fixes: 79d97d2b4f0b55ea80f8330144953e2b93927e25 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- tests/testutils.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/testutils.c b/tests/testutils.c index c984f66d0e..14e5c56fcf 100644 --- a/tests/testutils.c +++ b/tests/testutils.c @@ -859,9 +859,6 @@ int virTestMain(int argc, preloads[npreloads] = NULL; } - if (!(fakerootdir = virTestFakeRootDirInit())) - return EXIT_FAILURE; - va_start(ap, func); while ((lib = va_arg(ap, const char *))) { g_autofree char *abs_lib_path = g_strdup_printf("%s/%s", abs_builddir, lib); @@ -934,6 +931,9 @@ int virTestMain(int argc, failedTests = virBitmapNew(1); + if (!(fakerootdir = virTestFakeRootDirInit())) + return EXIT_FAILURE; + ret = (func)(); virResetLastError(); -- 2.52.0

2 1

[PATCH v2] scripts: dtrace2systemtap: Fix argument name extraction regex to avoid '*' in names
by Peter Krempa 11 Mar '26

11 Mar '26

From: Peter Krempa <pkrempa(a)redhat.com> When commit d249170bf609d2c modified the arguments of 'virNetTLSContextNew' which has a systemtap probe defined the 'dtrace2systemtap' script was no longer to correctly generate the definitions for it. First problem which stemmed from mis-detecting the string array argumment as string, which would use 'user_string' to extract it was fixed in cb33103c4afbce681. After that the generated probe is still not correct because it doesn't strip all the '*' from pointers and thus for double pointers it generates the following invalid definition: probe libvirt.rpc.tls_context_new = process("/usr/lib64/libvirt.so").mark("rpc_tls_context_new") { ctxt = $arg1; cacert = user_string($arg2); cacrl = user_string($arg3); *cert = $arg4; *keys = $arg5; sanityCheckCert = $arg6; requireValidCert = $arg7; isServer = $arg8; } Leading to the following failure: # stap -ve 'probe oneshot {exit()}' parse error: expected literal string or number saw: operator '*' at /usr/share/systemtap/tapset/libvirt_probes-64.stp:204:3 source: *cert = $arg4; ^ 1 parse error. To address the issue the regex extracting the arguments needs to optionally match any number of '*' instead of just one. Resolves: https://issues.redhat.com/browse/RHEL-153832 Fixes: cb33103c4afbce68134be112ecc5d0251e542650 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- scripts/dtrace2systemtap.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/dtrace2systemtap.py b/scripts/dtrace2systemtap.py index 361dab1075..12fc390bcd 100755 --- a/scripts/dtrace2systemtap.py +++ b/scripts/dtrace2systemtap.py @@ -127,7 +127,7 @@ for file in filelist: if re.match(r'''.*char\s\*[^\*].*''', arg) is not None: isstr = True - m = re.search(r'''^.*\s\*?(\S+)$''', arg) + m = re.search(r'''^.*\s\**(\S+)$''', arg) if m is not None: arg = m.group(1) else: -- 2.53.0

2 1

Failed to find parent device on Arrow Lake processor
by Bertrand Leconte 10 Mar '26

10 Mar '26

Hello, I am using libvirt within Qubes OS (https://www.qubes-or.org) My laptop is a Lenovo P16 Gen 3 with an Intel Core Ultra 9 275HX, which is in the Arrow Lake family. The associated PCH is an Intel 800 Series WM880. The particularity of this platform is that the PCH includes a dedicated PCI Root Complex in addition to the CPU one. That means that I have devices connected to `0000:00` bus (addresses like 0000:00:xx.x) and devices connected to `0000:80` bus (addresses like 0000:80:xx.x). The consequence of that architecture is that there is no PCI Root Port serving the `0000:80` bus. When I want to PCI passthrough my USB controller device `0000:80:14.0`, the function `virPCIDeviceIsBehindSwitchLackingACS()` says that `Failed to find parent device for 0000:80:14.0`. When I look into the source code, it looks like it enumerates all PCI devices, searching for the Root Port managing the bus `0000:80`. As I said before, it cannot find any as it's A Root Complex that manage the `0000:80` bus and not a Root Port (a Root Complex it's not a PCI/PCIe device). However, for any device connected to PCI bus `0000:00`, it cannot find any PCI Root Port either but there is an exception in the code for it. @Bloged (one of Qubes OS users) proposed in https://forum.qubes-os.org/t/aistone-x6ar57ty-aka-tongfang-x6-16-intel-high… to change the code to diff --git a/src/util/virpci.c b/src/util/virpci.c index 3816369..fbed8f5 100644 --- a/src/util/virpci.c +++ b/src/util/virpci.c @@ -2555,12 +2555,20 @@ virPCIDeviceIsBehindSwitchLackingACS(virPCIDevice *dev) if (virPCIDeviceGetParent(dev, &parent) < 0) return -1; if (!parent) { - /* if we have no parent, and this is the root bus, ACS doesn't come - * into play since devices on the root bus can't P2P without going - * through the root IOMMU. + /* if we have no parent, and this is a root-like bus (0 or 0x80), + * ACS doesn't come into play since devices on these buses can't P2P + * without going through the root IOMMU. + * + * Arrow Lake (Intel Core Ultra 200 series) uses bus 0x80 for integrated + * devices like USB controllers, with a complex PCH topology that confuses + * parent device detection. Treat bus 0x80 like bus 0 for ACS purposes. */ if (dev->address.bus == 0) { return 0; + } else if (dev->address.bus == 0x80) { + VIR_DEBUG("%s %s: Arrow Lake bus 0x80 device, treating as root bus for ACS check", + dev->id, dev->name); + return 0; } else { virReportError(VIR_ERR_INTERNAL_ERROR, _("Failed to find parent device for %1$s"), -- This patch works, but it does not look very generic. In addition to that, a thread in 2017 (this mailing list) seems to indicate that this part of the code may not be necessary: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/QRI4…. My question: can someone that knows this part of the code have a look to see what is the best way to correct it: either propose a patch to `virPCIDeviceIsBehindSwitchLackingACS` that is more generic or to change the rest of the code so it's no more used? (By the way, internationalization of error messages in syslog/dmesg/journald does not look like a good idea. It is very hard to understand if the message is given in French in this mailing list…) Thanks very much for your help Bertrand

6 17

[PATCH] systemtap: Fix probe definition for 'rpc_tls_context_new'
by Peter Krempa 10 Mar '26

10 Mar '26

From: Peter Krempa <pkrempa(a)redhat.com> Commit d249170bf609d2c modified the arguments of 'virNetTLSContextNew' which has a systemtap probe point defined. This in turn meant that the probe point needed to be modified too. Unfortunately the systemtap generator doesn't handle double pointers correctly and in fact systemtap doesn't even seem to have a possibility to fetch a list of strings from userspace natively. This meant that an invalid probe definition was generated: probe libvirt.rpc.tls_context_new = process("/usr/lib64/libvirt.so").mark("rpc_tls_context_new") { ctxt = $arg1; cacert = user_string($arg2); cacrl = user_string($arg3); *cert = $arg4; *keys = $arg5; sanityCheckCert = $arg6; requireValidCert = $arg7; isServer = $arg8; } Leading to the following failure: # stap -ve 'probe oneshot {exit()}' parse error: expected literal string or number saw: operator '*' at /usr/share/systemtap/tapset/libvirt_probes-64.stp:204:3 source: *cert = $arg4; ^ 1 parse error. To address the issue declare the 'cert' and 'keys' parameters as 'void *', we can't really do anything else as string lists aren't supported, which will make our generator generate correct code once again. Resolves: https://issues.redhat.com/browse/RHEL-153832 Fixes: d249170bf609d2cb89c36477b0f9ca0908f25985 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/libvirt_probes.d | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libvirt_probes.d b/src/libvirt_probes.d index d9e75d9797..16d1decf46 100644 --- a/src/libvirt_probes.d +++ b/src/libvirt_probes.d @@ -54,7 +54,7 @@ provider libvirt { # file: src/rpc/virnettlscontext.c # prefix: rpc probe rpc_tls_context_new(void *ctxt, const char *cacert, const char *cacrl, - const char **cert, const char **keys, + void *cert, void *keys, int sanityCheckCert, int requireValidCert, int isServer); probe rpc_tls_context_dispose(void *ctxt); probe rpc_tls_context_session_allow(void *ctxt, void *sess, const char *dname); -- 2.53.0

2 4

Re: [PATCH 2/6] system/hostmem: Remove HostMemoryBackend::use_canonical_path field
by Thomas Huth 10 Mar '26

10 Mar '26

On 07/03/2026 16.41, Philippe Mathieu-Daudé wrote: > The HostMemoryBackend::use_canonical_path boolean > was only set in the hw_compat_3_1[] array, via the > 'x-use-canonical-path-for-ramblock-id=true' property. > We removed all machines using that array, but the > comment added in commit 8db0b20415c ("machine: add > missing doc for memory-backend option") requested to > not remove this property "as long as 4.0 and older > machine types exists". Previous commit removed the > last machines in this range, we can now remove that > property and all the code around it. > > Signed-off-by: Philippe Mathieu-Daudé <philmd(a)linaro.org> > --- > qapi/qom.json | 8 +------- > include/system/hostmem.h | 2 +- > backends/hostmem.c | 34 ---------------------------------- > qemu-options.hx | 10 ---------- > 4 files changed, 2 insertions(+), 52 deletions(-) > > diff --git a/qapi/qom.json b/qapi/qom.json > index c653248f85d..3e13e3fd25c 100644 > --- a/qapi/qom.json > +++ b/qapi/qom.json > @@ -660,11 +660,6 @@ > # > # @size: size of the memory region in bytes > # > -# @x-use-canonical-path-for-ramblock-id: if true, the canonical path > -# is used for ramblock-id. Disable this for 4.0 machine types or > -# older to allow migration with newer QEMU versions. > -# (default: false generally, but true for machine types <= 4.0) > -# > # .. note:: prealloc=true and reserve=false cannot be set at the same > # time. With reserve=true, the behavior depends on the operating > # system: for example, Linux will not reserve swap space for shared > @@ -683,8 +678,7 @@ > '*prealloc-context': 'str', > '*share': 'bool', > '*reserve': 'bool', > - 'size': 'size', > - '*x-use-canonical-path-for-ramblock-id': 'bool' } } > + 'size': 'size' } } > > ## > # @MemoryBackendFileProperties: > diff --git a/include/system/hostmem.h b/include/system/hostmem.h > index 88fa791ac78..cafcf9c9c74 100644 > --- a/include/system/hostmem.h > +++ b/include/system/hostmem.h > @@ -74,7 +74,7 @@ struct HostMemoryBackend { > > /* protected */ > uint64_t size; > - bool merge, dump, use_canonical_path; > + bool merge, dump; > bool prealloc, is_mapped, share, reserve; > bool guest_memfd, aligned; > uint32_t prealloc_threads; > diff --git a/backends/hostmem.c b/backends/hostmem.c > index 15d4365b697..7da7cd54e05 100644 > --- a/backends/hostmem.c > +++ b/backends/hostmem.c > @@ -40,10 +40,6 @@ QEMU_BUILD_BUG_ON(HOST_MEM_POLICY_INTERLEAVE != MPOL_INTERLEAVE); > char * > host_memory_backend_get_name(HostMemoryBackend *backend) > { > - if (!backend->use_canonical_path) { > - return g_strdup(object_get_canonical_path_component(OBJECT(backend))); > - } I'm a little bit confused by this one here. If I've got that right, the flag was set to "true" for the old QEMU machines <= 3.1, and it is set to false by default for new machines? If so, shouldn't we rather always use the above return and remove the one below instead? > return object_get_canonical_path(OBJECT(backend)); > } > > @@ -484,23 +480,6 @@ static void host_memory_backend_set_reserve(Object *o, bool value, Error **errp) > } > #endif /* CONFIG_LINUX */ > > -static bool > -host_memory_backend_get_use_canonical_path(Object *obj, Error **errp) > -{ > - HostMemoryBackend *backend = MEMORY_BACKEND(obj); > - > - return backend->use_canonical_path; > -} > - > -static void > -host_memory_backend_set_use_canonical_path(Object *obj, bool value, > - Error **errp) > -{ > - HostMemoryBackend *backend = MEMORY_BACKEND(obj); > - > - backend->use_canonical_path = value; > -} > - > static void > host_memory_backend_class_init(ObjectClass *oc, const void *data) > { > @@ -563,19 +542,6 @@ host_memory_backend_class_init(ObjectClass *oc, const void *data) > object_class_property_set_description(oc, "reserve", > "Reserve swap space (or huge pages) if applicable"); > #endif /* CONFIG_LINUX */ > - /* > - * Do not delete/rename option. This option must be considered stable > - * (as if it didn't have the 'x-' prefix including deprecation period) as > - * long as 4.0 and older machine types exists. By the way, this option seems to be used by libvirt - we should maybe make sure that its removal does not break libvirt by accident...? Thomas

2 1

[PATCH 0/4] qemu: bump qemu capabilities and use 'flat' mode of 'query-block'
by Peter Krempa 10 Mar '26

10 Mar '26

Peter Krempa (4): qemucapabilitiestest: Update 'caps_11.0.0_x86_64' to 'v10.2.0-2062-g084a6c6e73" qemucapabilitiestest: Update 'caps_11.0.0_aarch64' to 'v10.2.0-2062-g084a6c6e73"aarch qemu: capabilities: Introduce QEMU_CAPS_QUERY_BLOCK_FLAT qemu: monitor: Use 'flat' mode of 'query-block' src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_monitor.c | 1 + src/qemu/qemu_monitor_json.c | 12 +- src/qemu/qemu_monitor_priv.h | 3 + .../caps_11.0.0_aarch64.replies | 5587 ++++++++-------- .../caps_11.0.0_aarch64.xml | 39 +- .../caps_11.0.0_x86_64.replies | 5815 +++++++++-------- .../caps_11.0.0_x86_64.xml | 287 +- 9 files changed, 6254 insertions(+), 5493 deletions(-) -- 2.53.0

3 6

[PATCH] docs: storage: Note that refreshing the storage pool is needed on outside modification
by Peter Krempa 10 Mar '26

10 Mar '26

From: Peter Krempa <pkrempa(a)redhat.com> Add a note stating that pool contents and metadata are not auto-updated when the pool is modified outside of libvirt. Closes: https://gitlab.com/libvirt/libvirt/-/work_items/749 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- docs/formatstorage.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/formatstorage.rst b/docs/formatstorage.rst index 9d9a4143eb..7ed57732af 100644 --- a/docs/formatstorage.rst +++ b/docs/formatstorage.rst @@ -25,6 +25,13 @@ attribute ``type``, which is one of ``dir``, ``fs``, ``netfs``, ``disk``, ``iscsi-direct`` ( :since:`since 4.7.0` ). This corresponds to the storage backend drivers listed further along in this document. + .. note:: + Any modification of the storage pool outside of libvirt or on a different + host for shared storage pools may not update the cached volume or pool + metadata. The pool metadata can be refreshed by calling + ``virsh pool-refresh POOLNAME`` or by the + `virStoragePoolRefresh <html/libvirt-libvirt-storage.html#virStoragePoolRefresh>`__ API. + Storage pool general metadata ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- 2.53.0

2 1

[libvirt PATCH] qemu_hotplug: Fix crash when attaching network inteface with hostdev network
by Pavel Hrdina 10 Mar '26

10 Mar '26

From: Pavel Hrdina <phrdina(a)redhat.com> The following interface XML will crash libvirt when attached to running VM: <interface type='network'> <source network='hostdev_net'/> </interface> Instead of trying to figure out every single place where hostdev is used as struct directly and allocating empty private data check if iommufd is configured as that will happen only for <hostdev> device where the private data are correctly allocated. This patch is best viewed with `git show -w`. Signed-off-by: Pavel Hrdina <phrdina(a)redhat.com> --- src/qemu/qemu_hotplug.c | 37 +++++++++++++++++++++---------------- 1 file changed, 21 insertions(+), 16 deletions(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index b3f2a173a8..966e746f2b 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1630,20 +1630,23 @@ qemuDomainAttachHostPCIDevice(virQEMUDriver *driver, qemuDomainObjEnterMonitor(vm); - if (objprops) { - if ((ret = qemuFDPassDirectTransferMonitor(priv->iommufd, priv->mon)) < 0) - goto exit_monitor; - if ((ret = qemuMonitorAddObject(priv->mon, &objprops, NULL)) < 0) - goto exit_monitor; + if (virHostdevIsPCIDeviceWithIOMMUFD(hostdev)) { + if (objprops) { + if ((ret = qemuFDPassDirectTransferMonitor(priv->iommufd, priv->mon)) < 0) + goto exit_monitor; + + if ((ret = qemuMonitorAddObject(priv->mon, &objprops, NULL)) < 0) + goto exit_monitor; - priv->iommufdState = true; - removeiommufd = true; + priv->iommufdState = true; + removeiommufd = true; + } + + if ((ret = qemuFDPassDirectTransferMonitor(hostdevPriv->vfioDeviceFd, priv->mon)) < 0) + goto exit_monitor; } - if ((ret = qemuFDPassDirectTransferMonitor(hostdevPriv->vfioDeviceFd, priv->mon)) < 0) - goto exit_monitor; - if ((ret = qemuDomainAttachExtensionDevice(priv->mon, hostdev->info)) < 0) goto exit_monitor; @@ -1674,15 +1677,17 @@ qemuDomainAttachHostPCIDevice(virQEMUDriver *driver, if (teardownmemlock && qemuDomainAdjustMaxMemLock(vm) < 0) VIR_WARN("Unable to reset maximum locked memory on hotplug fail"); - qemuDomainObjEnterMonitor(vm); + if (virHostdevIsPCIDeviceWithIOMMUFD(hostdev)) { + qemuDomainObjEnterMonitor(vm); - if (removeiommufd) - ignore_value(qemuMonitorDelObject(priv->mon, "iommufd0", false)); + if (removeiommufd) + ignore_value(qemuMonitorDelObject(priv->mon, "iommufd0", false)); - qemuFDPassDirectTransferMonitorRollback(hostdevPriv->vfioDeviceFd, priv->mon); - qemuFDPassDirectTransferMonitorRollback(priv->iommufd, priv->mon); + qemuFDPassDirectTransferMonitorRollback(hostdevPriv->vfioDeviceFd, priv->mon); + qemuFDPassDirectTransferMonitorRollback(priv->iommufd, priv->mon); - qemuDomainObjExitMonitor(vm); + qemuDomainObjExitMonitor(vm); + } if (releaseaddr) qemuDomainReleaseDeviceAddress(vm, info); -- 2.53.0

2 1

[PATCH] util: Move 'virProcessLimitResourceToLabel' into same preprocessor if-block as only caller
by Peter Krempa 10 Mar '26

10 Mar '26

From: Peter Krempa <pkrempa(a)redhat.com> 'virProcessLimitResourceToLabel' is called only from 'virProcessGetLimitFromProc' but the latter has different conditions when it's compiled. In certain cases this could lead to build failures. Fixes: 90fe839f8a0 Closes: https://gitlab.com/libvirt/libvirt/-/work_items/848 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/util/virprocess.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/src/util/virprocess.c b/src/util/virprocess.c index e8120c1bdc..e06ed94b0d 100644 --- a/src/util/virprocess.c +++ b/src/util/virprocess.c @@ -743,36 +743,36 @@ virProcessPrLimit(pid_t pid G_GNUC_UNUSED, #endif #if WITH_GETRLIMIT +# if defined(__linux__) static const char* virProcessLimitResourceToLabel(int resource) { switch (resource) { -# if defined(RLIMIT_MEMLOCK) +# if defined(RLIMIT_MEMLOCK) case RLIMIT_MEMLOCK: return "Max locked memory"; -# endif /* defined(RLIMIT_MEMLOCK) */ +# endif /* defined(RLIMIT_MEMLOCK) */ -# if defined(RLIMIT_NPROC) +# if defined(RLIMIT_NPROC) case RLIMIT_NPROC: return "Max processes"; -# endif /* defined(RLIMIT_NPROC) */ +# endif /* defined(RLIMIT_NPROC) */ -# if defined(RLIMIT_NOFILE) +# if defined(RLIMIT_NOFILE) case RLIMIT_NOFILE: return "Max open files"; -# endif /* defined(RLIMIT_NOFILE) */ +# endif /* defined(RLIMIT_NOFILE) */ -# if defined(RLIMIT_CORE) +# if defined(RLIMIT_CORE) case RLIMIT_CORE: return "Max core file size"; -# endif /* defined(RLIMIT_CORE) */ +# endif /* defined(RLIMIT_CORE) */ default: return NULL; } } -# if defined(__linux__) static int virProcessGetLimitFromProc(pid_t pid, int resource, -- 2.53.0

2 1

[PATCH] qemuhotplugtest: Run "interface-hostdev" test cases only on Linux
by Michal Privoznik 09 Mar '26

09 Mar '26

From: Michal Privoznik <mprivozn(a)redhat.com> In one of my previous commits, I've introduced "interface-hostdev" attach and detach test cases to qemuhotplugtest. And they work flawlessly, on Linux. But on anything else they fail because our virpci.c module is basically just a bunch of stub functions that do nothing but report an error, rendering my changes to virpcimock futile. BTW: this is similar to what I had done in v12.1.0-rc1~199. Fixes: f9bb819fc4841dbdff801629bf58f9fd6d7d93eb Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Verified in my FreeBSD VM. tests/qemuhotplugtest.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tests/qemuhotplugtest.c b/tests/qemuhotplugtest.c index 6cb616c59b..146e9e33c1 100644 --- a/tests/qemuhotplugtest.c +++ b/tests/qemuhotplugtest.c @@ -697,10 +697,18 @@ mymain(void) DO_TEST_DETACH("ppc64", "pseries-base-live", "hostdev-pci", false, false, "device_del", QMP_DEVICE_DELETED("hostdev0") QMP_OK); +#ifdef __linux__ + /* While <interface type='hostdev'/> is nearly the same as <hostdev/>, + * there are subtle differences, e.g. checking that PCI device specified in + * <interface/> is a VF. Checks like these are done by walking sysfs which + * is limited to Linux, obviously. And while our virpcimock creates + * necessary structure, on non-Linux the virpci.c is compiled with stubs + * that do nothing but report an error. */ DO_TEST_ATTACH("x86_64", "base-live", "interface-hostdev", false, true, "device_add", QMP_OK); DO_TEST_DETACH("x86_64", "base-live", "interface-hostdev", false, false, "device_del", QMP_DEVICE_DELETED("hostdev0") QMP_OK); +#endif DO_TEST_ATTACH("x86_64", "base-live", "interface-vdpa", false, true, "query-fdsets", "{\"return\":[{\"fdset-id\":99999}]}", "add-fd", "{ \"return\": { \"fdset-id\": 1, \"fd\": 95 }}", -- 2.52.0

2 1

[PATCH] util: extend virHostCPUGetInfo() for FreeBSD
by Roman Bogorodskiy 09 Mar '26

09 Mar '26

Extend virHostCPUGetInfo() to report more data on FreeBSD, such as: - NUMA domain count - CPU core count - CPU threads per core count Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/util/virhostcpu.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/src/util/virhostcpu.c b/src/util/virhostcpu.c index 113aa6881e..7cecb4b2c8 100644 --- a/src/util/virhostcpu.c +++ b/src/util/virhostcpu.c @@ -1014,6 +1014,22 @@ virHostCPUGetInfo(virArch hostarch G_GNUC_UNUSED, *mhz = cpu_freq / 1000000; # endif +# ifdef __FreeBSD__ +# define FILL_DATA_SYSCTL(var, sysctl, error_msg) \ + do { \ + size_t _len = sizeof(*var); \ + if (sysctlbyname(sysctl, var, &_len, NULL, 0) < 0) { \ + virReportSystemError(errno, "%s", error_msg); \ + return -1; \ + } \ + } while (0) + + FILL_DATA_SYSCTL(nodes, "vm.ndomains", _("cannot obtain NUMA domain count")); + FILL_DATA_SYSCTL(cores, "kern.smp.cores", _("cannot obtain CPU core count")); + FILL_DATA_SYSCTL(threads, "kern.smp.threads_per_core", + _("cannot obtain CPU threads per core")); +# endif /* __FreeBSD__ */ + return 0; #else /* XXX Solaris will need an impl later if they port QEMU driver */ -- 2.52.0

2 1

[PATCH 0/3] docs: bhyve documentation updates
by Roman Bogorodskiy 09 Mar '26

09 Mar '26

Roman Bogorodskiy (3): docs: bhyve: document NUMA domains configuration docs: bhyve: fix typo in version number docs: bhyve: add arm64 guest example docs/drvbhyve.rst | 64 ++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 63 insertions(+), 1 deletion(-) -- 2.52.0

2 4

[PATCH] qemu: processShutdownCompletedEvent: Remove inactive VM object after shutdown
by Peter Krempa 09 Mar '26

09 Mar '26

From: Peter Krempa <pkrempa(a)redhat.com> When the qemu process can't be successfully killed (e.g. when it's stuck in a long system call) libvirt creates a watch and waits for the monitor socket to go away before cleaning up the domain. The cleanup code in 'processShutdownCompletedEvent' called 'qemuProcessStop' but didn't call also 'qemuDomainRemoveInactive' which would break if a transient VM would undergo the delayed cleanup as we'd still have it's VM object around. Fixes: e62c26a20dced58ea342d9cb8f5e9164dc3bb023 Closes: https://gitlab.com/libvirt/libvirt/-/work_items/853 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_driver.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 9e4d0f8640..7d33477636 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -4079,6 +4079,7 @@ processShutdownCompletedEvent(virDomainObj *vm) if (virDomainObjIsActive(vm)) { qemuProcessStop(vm, VIR_DOMAIN_SHUTOFF_UNKNOWN, VIR_ASYNC_JOB_NONE, 0); + qemuDomainRemoveInactive(vm, 0, false); } qemuProcessEndStopJob(vm); -- 2.53.0

2 1

Re: [PATCH v2 14/21] hw/core/qdev-properties: allow qdev properties accept flags
by Daniel P. Berrangé 09 Mar '26

09 Mar '26

On Wed, Feb 11, 2026 at 03:30:06PM +0800, Zhao Liu wrote: > On Tue, Feb 10, 2026 at 09:56:08AM +0000, Daniel P. Berrangé wrote: > > Date: Tue, 10 Feb 2026 09:56:08 +0000 > > From: "Daniel P. Berrangé" <berrange(a)redhat.com> > > Subject: Re: [PATCH v2 14/21] hw/core/qdev-properties: allow qdev > > properties accept flags > > > > On Tue, Feb 10, 2026 at 11:23:41AM +0800, Zhao Liu wrote: > > > Update qdev property interfaces (qdev_property_add_static() and > > > qdev_class_add_property()) to accept and pass 'ObjectPropertyFlags'. > > > This enables marking qdev properties with flags such as DEPRECATED or > > > INTERNAL. > > > > > > To facilitate this at the definition level, extend the boolean and > > > uint8_t property macros (as the examples) to accept variable arguments > > > (VA_ARGS). This allows callers to optionally specify flags in the > > > property definition. > > > > > > Example: > > > > > > DEFINE_PROP_UINT8("version", IOAPICCommonState, version, IOAPIC_VER_DEF, > > > .flags = OBJECT_PROPERTY_DEPRECATED), > > > > In other places where we track deprecation in QEMU, we have not used > > a boolean flag. Instead we have used a "const char *deprecation_note" > > internally, which lets us provide a user facing message, to be printed > > out in the warn_report, informing them what to do instead (either the > > feature is entirely removed, or there is a better alternative). IMHO > > we should be following the same pattern for properties, as it is much > > more user friendly than just printing a totally generic message > > "XXXX is deprecated, stop using it" > > Yes, rich deprecation hint is better. I think this still depends on > USER_SET - distinguish internal/external or not :-(. > > Since when we mark a property as deprecated, its code remains in the > code tree, and internal calls should not trigger warnings. Deprecation > hints are intended to reminder external users. This depends on where you put the deprecation check. IIUC, all the user facing codepaths for setting properties end up calling through object_set_properties_from_qdict, but internal codepaths don't use that. That method can check & emit the deprecation warnings, without us needing any explicit tracking of "user set" - the use context is derived from the codepath With regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

4 8

[PATCH 0/4] qemuhotplugtest: Introduce interface-hostdev test case
by Michal Privoznik 09 Mar '26

09 Mar '26

Inspired by the following patch: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/YQHQ… Michal Prívozník (4): virpcimock: Create sriov_totalvfs file and virtfnN symlinks virpcimock: Create net/ subdir for devices virnetdevmock: Mock virNetDevSaveNetConfig() and virNetDevSetNetConfig() qemuhotplugtest: Introduce interface-hostdev test case src/util/virnetdev.h | 5 +- tests/qemuhotplugtest.c | 7 +- .../qemuhotplug-interface-hostdev.xml | 6 ++ ...emuhotplug-base-live+interface-hostdev.xml | 63 +++++++++++++++ tests/virnetdevmock.c | 22 ++++++ tests/virpcimock.c | 78 +++++++++++++++++-- 6 files changed, 171 insertions(+), 10 deletions(-) create mode 100644 tests/qemuhotplugtestdevices/qemuhotplug-interface-hostdev.xml create mode 100644 tests/qemuhotplugtestdomains/qemuhotplug-base-live+interface-hostdev.xml -- 2.52.0

2 5

[PATCH 0/6] qemu: fix a passt bug, add a passt feature
by Laine Stump 09 Mar '26

09 Mar '26

The first patch cleans up a dangling socket that was hanging around after we finished using a passt process in vhostuser mode. The rest are to support specifying the default route for a passt interface with <route gateway='x.x.x.x'/> Laine Stump (6): qemu: delete passt "repair" socket when appropriate qemu: reorganize qemuValidateDomainDeviceDefNetwork() qemu: only limit IPv4 prefix for slirp util: make the route arg to virNetDevIPRouteGetPrefix const conf/util: fix non-specification of IP route destination address qemu: support setting default route for passt interfaces inside the guest src/conf/networkcommon_conf.c | 74 ++++++++------- src/conf/schemas/networkcommon.rng | 4 +- src/qemu/qemu_passt.c | 30 ++++++- src/qemu/qemu_validate.c | 140 +++++++++++++++++++---------- src/util/virnetdevip.c | 14 ++- src/util/virnetdevip.h | 2 +- 6 files changed, 170 insertions(+), 94 deletions(-) -- 2.52.0

3 17

[PULL v2 00/27] Misc patches queue
by Daniel P. Berrangé 07 Mar '26

07 Mar '26

The following changes since commit 3fb456e9a0e9eef6a71d9b49bfff596a0f0046e9: Merge tag 'pull-request-2026-03-02' of https://gitlab.com/thuth/qemu into staging (2026-03-02 14:01:46 +0000) are available in the Git repository at: https://gitlab.com/berrange/qemu tags/next-pr-pull-request for you to fetch changes up to ca61f91ef9b0d10333881fd0070303ea33cbc72e: util/oslib-posix: increase memprealloc thread count to 32 (2026-03-05 17:40:24 +0000) ---------------------------------------------------------------- * Increase pre-alloc max thread count to 32 * Fix checkpatch warning for new/removed files with --terse * Detect more GPL boilerplate in checkpatch * Fix lean of data in TLS/websock GSource cancellation * Tweak CPU docs for DiamondRapids * Unconditionally enable thread naming * Fix race setting thread naming on Win32 * Add API docs for logging APIs * Fix interleaved error/trace output * Fix missing error prefixes with warn_report * Add detailed error reporting for VNC passworrd changes * Refactoring of error_vprintf & related funcs ---------------------------------------------------------------- Daniel P. Berrangé (25): scripts: detect another GPL license boilerplate variant io: separate freeing of tasks from marking them as complete io: fix cleanup for TLS I/O source data on cancellation io: fix cleanup for websock I/O source data on cancellation docs: simplify DiamondRapids CPU docs qemu-options: remove extraneous [] around arg values include: define constant for early constructor priority monitor: initialize global data from a constructor system: unconditionally enable thread naming util: fix race setting thread name on Win32 util: expose qemu_thread_set_name audio: make jackaudio use qemu_thread_set_name util: set the name for the 'main' thread on Windows util: add API to fetch the current thread name util: introduce some API docs for logging APIs util: avoid repeated prefix on incremental qemu_log calls util/log: add missing error reporting in qemu_log_trylock_with_err ui: add proper error reporting for password changes ui: remove redundant use of error_printf_unless_qmp() monitor: remove redundant error_[v]printf_unless_qmp monitor: refactor error_vprintf() monitor: move error_vprintf back to error-report.c util: fix interleaving of error & trace output util: don't skip error prefixes when QMP is active util: fix interleaving of error prefixes Jon Kohler (1): util/oslib-posix: increase memprealloc thread count to 32 Markus Armbruster (1): scripts/checkpatch: Fix MAINTAINERS update warning with --terse audio/jackaudio.c | 28 +++++-- docs/about/deprecated.rst | 7 ++ docs/system/cpu-models-x86.rst.inc | 16 ++-- include/io/task.h | 29 +++++-- include/monitor/monitor.h | 3 - include/qemu/compiler.h | 8 ++ include/qemu/log-for-trace.h | 17 +++- include/qemu/log.h | 39 ++++++++++ include/qemu/thread.h | 3 +- include/ui/console.h | 2 +- include/ui/qemu-spice-module.h | 3 +- io/channel-tls.c | 64 ++++++++++----- io/channel-websock.c | 46 ++++++++--- io/task.c | 8 +- meson.build | 21 +++++ monitor/monitor.c | 51 +++--------- qemu-options.hx | 112 +++++++++++++-------------- rust/util/src/log.rs | 6 ++ scripts/checkpatch.pl | 11 +-- stubs/error-printf.c | 23 ------ stubs/meson.build | 1 - stubs/monitor-core.c | 19 ++++- system/vl.c | 12 +-- tests/functional/generic/test_vnc.py | 4 +- tests/unit/test-io-task.c | 26 +++++++ tests/unit/test-util-sockets.c | 1 + ui/spice-core.c | 25 ++++-- ui/spice-module.c | 7 +- ui/ui-qmp-cmds.c | 19 ++--- ui/vnc-stubs.c | 6 +- ui/vnc.c | 16 ++-- util/error-report.c | 92 +++++++++++++++++----- util/log.c | 50 +++++++----- util/oslib-posix.c | 2 +- util/qemu-thread-posix.c | 89 +++++++++++++++------ util/qemu-thread-win32.c | 87 ++++++++++++++------- 36 files changed, 631 insertions(+), 322 deletions(-) delete mode 100644 stubs/error-printf.c -- 2.53.0

3 29

[PATCH] test: Default to ROM type for loader
by Jim Fehlig 06 Mar '26

06 Mar '26

From: Jim Fehlig <jfehlig(a)suse.com> Commit 1504b7f687 moved the corresponding logic from the generic postparse code to drivers but failed to update the test driver, which causes failures in virt-manager's test suite. Fixes: 1504b7f687bdfc679377e605d076776b18533468 Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- As an alternative to this patch, we can consider reverting 1504b7f687 (and the subsequent bhyve fix) to avoid duplicating the logic. src/test/test_driver.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/src/test/test_driver.c b/src/test/test_driver.c index 1165689de7..536e291861 100644 --- a/src/test/test_driver.c +++ b/src/test/test_driver.c @@ -421,6 +421,22 @@ testDomainDevicesDefPostParse(virDomainDeviceDef *dev G_GNUC_UNUSED, } +static int +testDomainDefPostParse(virDomainDef *def, + unsigned int parseFlags G_GNUC_UNUSED, + void *opaque G_GNUC_UNUSED, + void *parseOpaque G_GNUC_UNUSED) +{ + if (def->os.loader && + def->os.loader->path && + !def->os.loader->type) { + def->os.loader->type = VIR_DOMAIN_LOADER_TYPE_ROM; + } + + return 0; +} + + static void testDomainObjPrivateFree(void *data) { @@ -448,6 +464,7 @@ testDriverNew(void) VIR_DOMAIN_DEF_FEATURE_FW_AUTOSELECT | VIR_DOMAIN_DEF_FEATURE_NET_MODEL_STRING, .devicesPostParseCallback = testDomainDevicesDefPostParse, + .domainPostParseCallback = testDomainDefPostParse, .defArch = VIR_ARCH_I686, }; virDomainXMLPrivateDataCallbacks privatecb = { -- 2.51.0

2 1

[PATCH 1/2] hyperv: fix flags passed to virDomainDefParseString()
by Jonathon Jongsma 06 Mar '26

06 Mar '26

This function expects flags that are bitwise-or values of the VIR_DOMAIN_DEF_PARSE_* constants, but we were passing two flags that were not part of this flag set: - 1 < VIR_DOMAIN_VIRT_HYPERV - VIR_DOMAIN_XML_INACTIVE Replace VIR_DOMAIN_XML_INACTIVE with VIR_DOMAIN_DEF_PARSE_INACTIVE (which fortunately happens to be the exact same value). Remove flag "1 < VIR_DOMAIN_VIRT_HYPERV", which turns out to the the same value as the flag VIR_DOMAIN_DEF_PARSE_ABI_UPDATE_MIGRATION, which seems unnecessary and undesirable here. Signed-off-by: Jonathon Jongsma <jjongsma(a)redhat.com> --- src/hyperv/hyperv_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/hyperv/hyperv_driver.c b/src/hyperv/hyperv_driver.c index b01b4919fe..8832769c7b 100644 --- a/src/hyperv/hyperv_driver.c +++ b/src/hyperv/hyperv_driver.c @@ -2937,7 +2937,7 @@ hypervDomainDefineXML(virConnectPtr conn, const char *xml) /* parse xml */ def = virDomainDefParseString(xml, priv->xmlopt, NULL, - 1 << VIR_DOMAIN_VIRT_HYPERV | VIR_DOMAIN_XML_INACTIVE); + VIR_DOMAIN_DEF_PARSE_INACTIVE); if (!def) goto error; -- 2.53.0

2 2

[PATCH] bhyve: support NUMA configuration for domains
by Roman Bogorodskiy 06 Mar '26

06 Mar '26

Bhyve supports NUMA domains configuration using the '-n' command line argument: -n id,size,cpus[,domain_policy] Here, "id" is a numeric NUMA domain id, "size" is the total VM memory size with units format similar to the "-m" switch, "cpus" is a cpuset, and "domain_policy" is an optional domainset(9) memory allocation policy. The "domain_policy" is currently not used by the libvirt driver. This argument is repeated for every NUMA domain to be configured, e.g.: bhyve \ ... -n id=0,size=107,cpus=0-3 -n id=1,size=107,cpus=4-7 To support that: * Add a corresponding capability; it is considered supported if the bhyve binary has the '-n' command line switch. * Generate command line arguments for NUMA from <cpu><numa>..</numa></cpu> domain configuration. Additionally, validate that: * NUMA domains can be only configured with the UEFI loaders. * No more than 8 domains configured per VM as limited by bhyve. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve_capabilities.c | 3 ++ src/bhyve/bhyve_capabilities.h | 1 + src/bhyve/bhyve_command.c | 26 ++++++++++++ src/bhyve/bhyve_domain.c | 19 +++++++++ .../bhyvexml2argv-numa-empty-cpuset.xml | 29 +++++++++++++ .../bhyvexml2argv-numa-too-many-domains.xml | 36 ++++++++++++++++ .../x86_64/bhyvexml2argv-numa.args | 14 +++++++ .../x86_64/bhyvexml2argv-numa.ldargs | 1 + .../x86_64/bhyvexml2argv-numa.xml | 29 +++++++++++++ tests/bhyvexml2argvtest.c | 10 ++++- .../x86_64/bhyvexml2xmlout-numa.xml | 42 +++++++++++++++++++ tests/bhyvexml2xmltest.c | 1 + 12 files changed, 210 insertions(+), 1 deletion(-) create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa-empty-cpuset.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa-too-many-domains.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa.args create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa.ldargs create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa.xml create mode 100644 tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-numa.xml diff --git a/src/bhyve/bhyve_capabilities.c b/src/bhyve/bhyve_capabilities.c index d2a48ed30c..c3fb88fe9f 100644 --- a/src/bhyve/bhyve_capabilities.c +++ b/src/bhyve/bhyve_capabilities.c @@ -258,6 +258,9 @@ bhyveProbeCapsFromHelp(unsigned int *caps, char *binary) if (strstr(help, "-A:") != NULL) *caps |= BHYVE_CAP_ACPI; + if (strstr(help, "-n:") != NULL) + *caps |= BHYVE_CAP_NUMA; + return 0; } diff --git a/src/bhyve/bhyve_capabilities.h b/src/bhyve/bhyve_capabilities.h index d5346df7ba..31fd9ab86a 100644 --- a/src/bhyve/bhyve_capabilities.h +++ b/src/bhyve/bhyve_capabilities.h @@ -56,6 +56,7 @@ typedef enum { BHYVE_CAP_VIRTIO_RND = 1 << 10, BHYVE_CAP_NVME = 1 << 11, BHYVE_CAP_ACPI = 1 << 12, + BHYVE_CAP_NUMA = 1 << 13, } virBhyveCapsFlags; int virBhyveProbeGrubCaps(virBhyveGrubCapsFlags *caps); diff --git a/src/bhyve/bhyve_command.c b/src/bhyve/bhyve_command.c index 37618812bc..931d7dd551 100644 --- a/src/bhyve/bhyve_command.c +++ b/src/bhyve/bhyve_command.c @@ -905,6 +905,7 @@ virBhyveProcessBuildBhyveCmd(struct _bhyveConn *driver, virDomainDef *def, unsigned nusbcontrollers = 0; unsigned nisacontrollers = 0; unsigned nvcpus = virDomainDefGetVcpus(def); + size_t ncells = virDomainNumaGetNodeCount(def->numa); /* CPUs */ virCommandAddArg(cmd, "-c"); @@ -955,6 +956,31 @@ virBhyveProcessBuildBhyveCmd(struct _bhyveConn *driver, virDomainDef *def, } } + /* NUMA */ + if (ncells) { + if (!(bhyveDriverGetBhyveCaps(driver) & BHYVE_CAP_NUMA)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Installed bhyve binary does not support NUMA configuration")); + return NULL; + } + + if (def->os.bootloader || !def->os.loader) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("NUMA configuration is only supported when booting using UEFI")); + return NULL; + } + + for (i = 0; i < ncells; i++) { + unsigned long long memSize = virDomainNumaGetNodeMemorySize(def->numa, i); + virBitmap *cpus = virDomainNumaGetNodeCpumask(def->numa, i); + g_autofree char *cpumask = virBitmapFormat(cpus); + + virCommandAddArg(cmd, "-n"); + virCommandAddArgFormat(cmd, "id=%zu,size=%llu,cpus=%s", i, VIR_DIV_UP(memSize, 1024), + cpumask); + } + } + /* Memory */ virCommandAddArg(cmd, "-m"); virCommandAddArgFormat(cmd, "%llu", diff --git a/src/bhyve/bhyve_domain.c b/src/bhyve/bhyve_domain.c index 85960c6e12..4594d7673f 100644 --- a/src/bhyve/bhyve_domain.c +++ b/src/bhyve/bhyve_domain.c @@ -411,6 +411,7 @@ bhyveDomainDefValidate(const virDomainDef *def, void *parseOpaque G_GNUC_UNUSED) { size_t i; + size_t ncells; virStorageSource *src = NULL; g_autoptr(GHashTable) nvme_controllers = g_hash_table_new(g_direct_hash, g_direct_equal); @@ -445,6 +446,24 @@ bhyveDomainDefValidate(const virDomainDef *def, return -1; } + ncells = virDomainNumaGetNodeCount(def->numa); + if (ncells) { + if (ncells > 8) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Only up to 8 NUMA domains are supported")); + return -1; + } + + for (i = 0; i < ncells; i++) { + if (!virDomainNumaGetNodeCpumask(def->numa, i)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("NUMA domain id %1$zu: empty cpusets are not allowed"), + i); + return -1; + } + } + } + if (!def->os.loader) return 0; diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa-empty-cpuset.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa-empty-cpuset.xml new file mode 100644 index 0000000000..9a5fc282ba --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa-empty-cpuset.xml @@ -0,0 +1,29 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>8</vcpu> + <os firmware='efi'> + <type>hvm</type> + </os> + <cpu> + <numa> + <cell id='0' cpus='0-3' memory='109568' unit='KiB'/> + <cell id='1' memory='109568' unit='KiB'/> + </numa> + </cpu> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <model type='virtio'/> + <source bridge="virbr0"/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa-too-many-domains.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa-too-many-domains.xml new file mode 100644 index 0000000000..bcabe5cd85 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa-too-many-domains.xml @@ -0,0 +1,36 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>876544</memory> + <vcpu>9</vcpu> + <os firmware='efi'> + <type>hvm</type> + </os> + <cpu> + <numa> + <cell id='0' cpus='0' memory='109568' unit='KiB'/> + <cell id='1' cpus='1' memory='109568' unit='KiB'/> + <cell id='2' cpus='2' memory='109568' unit='KiB'/> + <cell id='3' cpus='3' memory='109568' unit='KiB'/> + <cell id='4' cpus='4' memory='109568' unit='KiB'/> + <cell id='5' cpus='5' memory='109568' unit='KiB'/> + <cell id='6' cpus='6' memory='109568' unit='KiB'/> + <cell id='7' cpus='7' memory='109568' unit='KiB'/> + <cell id='8' cpus='8' memory='109568' unit='KiB'/> + </numa> + </cpu> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <model type='virtio'/> + <source bridge="virbr0"/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa.args b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa.args new file mode 100644 index 0000000000..15efd1c357 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa.args @@ -0,0 +1,14 @@ +bhyve \ +-c 8 \ +-n id=0,size=107,cpus=0-3 \ +-n id=1,size=107,cpus=4-7 \ +-m 214 \ +-u \ +-H \ +-P \ +-s 0:0,hostbridge \ +-l bootrom,fakefirmwaredir/BHYVE_UEFI.fd,fakenvramdir/bhyve_VARS.fd \ +-s 1:0,lpc \ +-s 2:0,ahci,hd:/tmp/freebsd.img \ +-s 3:0,virtio-net,faketapdev,mac=52:54:00:b9:94:02 \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa.ldargs b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa.ldargs new file mode 100644 index 0000000000..421376db9e --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa.ldargs @@ -0,0 +1 @@ +dummy diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa.xml new file mode 100644 index 0000000000..8a0da7830d --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-numa.xml @@ -0,0 +1,29 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>8</vcpu> + <os firmware='efi'> + <type>hvm</type> + </os> + <cpu> + <numa> + <cell id='0' cpus='0-3' memory='109568' unit='KiB'/> + <cell id='1' cpus='4-7' memory='109568' unit='KiB'/> + </numa> + </cpu> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <model type='virtio'/> + <source bridge="virbr0"/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2argvtest.c b/tests/bhyvexml2argvtest.c index 2330e70bbf..b7749fec6f 100644 --- a/tests/bhyvexml2argvtest.c +++ b/tests/bhyvexml2argvtest.c @@ -202,7 +202,7 @@ mymain(void) BHYVE_CAP_FBUF | BHYVE_CAP_XHCI | \ BHYVE_CAP_CPUTOPOLOGY | BHYVE_CAP_SOUND_HDA | \ BHYVE_CAP_VNC_PASSWORD | BHYVE_CAP_VIRTIO_9P | \ - BHYVE_CAP_NVME; + BHYVE_CAP_NVME | BHYVE_CAP_NUMA; DO_TEST("base"); DO_TEST("wired"); @@ -254,6 +254,11 @@ mymain(void) DO_TEST("isa-controller"); DO_TEST_FAILURE("isa-multiple-controllers"); DO_TEST("firmware-efi"); + DO_TEST("numa"); + DO_TEST_FAILURE("numa-empty-cpuset"); + DO_TEST_FAILURE("numa-too-many-domains"); + driver.bhyvecaps &= ~BHYVE_CAP_NUMA; + DO_TEST_FAILURE("numa"); fakefirmwaredir = g_steal_pointer(&driver.config->firmwareDir); driver.config->firmwareDir = g_steal_pointer(&fakefirmwareemptydir); DO_TEST_PREPARE_ERROR("firmware-efi"); @@ -345,10 +350,13 @@ mymain(void) driver.caps = virBhyveCapsBuild(); /* bhyve does not support UTC clock on ARM */ driver.bhyvecaps ^= BHYVE_CAP_RTC_UTC; + /* bhyve does not support NUMA on ARM */ + driver.bhyvecaps &= ~BHYVE_CAP_NUMA; DO_TEST("base"); DO_TEST("console"); DO_TEST("bootloader"); + DO_TEST_FAILURE("numa"); virObjectUnref(driver.caps); virObjectUnref(driver.xmlopt); diff --git a/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-numa.xml b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-numa.xml new file mode 100644 index 0000000000..ecc147db78 --- /dev/null +++ b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-numa.xml @@ -0,0 +1,42 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>8</vcpu> + <os firmware='efi'> + <type arch='x86_64'>hvm</type> + <boot dev='hd'/> + </os> + <cpu> + <numa> + <cell id='0' cpus='0-3' memory='109568' unit='KiB'/> + <cell id='1' cpus='4-7' memory='109568' unit='KiB'/> + </numa> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='file' device='disk'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <controller type='pci' index='0' model='pci-root'/> + <controller type='isa' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> + </controller> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </controller> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <source bridge='virbr0'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2xmltest.c b/tests/bhyvexml2xmltest.c index 7f9de2bc36..950aaea672 100644 --- a/tests/bhyvexml2xmltest.c +++ b/tests/bhyvexml2xmltest.c @@ -132,6 +132,7 @@ mymain(void) DO_TEST_DIFFERENT("passthru-multiple-devs"); DO_TEST_DIFFERENT("slirp"); DO_TEST_DIFFERENT("virtio-scsi"); + DO_TEST_DIFFERENT("numa"); /* Address allocation tests */ DO_TEST_DIFFERENT("addr-single-sata-disk"); -- 2.52.0

2 1

[PATCH] util: json: fix memory leak in virJSONValueFromJsonC()
by Elizaveta Tereshkina 06 Mar '26

06 Mar '26

In the 'json_type_array' case, the error path uses 'g_free()', which doesn't release other nested memory allocations. Replace it with 'virJSONValueFree()' to properly free the entire 'virJSONValue' structure. Fixes: da66bf53b0 (util: json: check return value of virJSONValueFromJsonC) Signed-off-by: Elizaveta Tereshkina <teryoshkina.ea(a)gmail.com> --- src/util/virjson.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/virjson.c b/src/util/virjson.c index 454bd657be..72bd78453a 100644 --- a/src/util/virjson.c +++ b/src/util/virjson.c @@ -1438,7 +1438,7 @@ virJSONValueFromJsonC(json_object *jobj) cur = virJSONValueFromJsonC(val); if (!cur) { - g_free(ret); + virJSONValueFree(ret); return NULL; } -- 2.39.2

2 1

[PATCH 0/2] qemu: hotplug: Fix use-after-free on media change via 'virsh attach-device'
by Peter Krempa 06 Mar '26

06 Mar '26

Reported via gitlab: https://gitlab.com/libvirt/libvirt/-/issues/859 I'll also later explore if it's possible to refactor the code to not touch the device definition wrappers after hotplug so that the pointer can be cleared properly when it's stolen into the domain definition. Peter Krempa (2): qemuDomainAttachDeviceDiskLive: Remove 'disk' variable qemu: hotplug: Don't access disk definititon after it was freed after media change src/qemu/qemu_hotplug.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) -- 2.53.0

2 3

[PATCH] util: json: fix memory leak in virJSONValueFromJsonC()
by Elizaveta Tereshkina 06 Mar '26

06 Mar '26

In the 'json_type_array' case, the error path uses 'g_free()', which doesn't release other nested memory allocations. Replace it with 'virJSONValueFree()' to properly free the entire 'virJSONValue' structure. Fixes: da66bf53b0 (util: json: check return value of virJSONValueFromJsonC) Signed-off-by: Elizaveta Tereshkina <teryoshkina.ea(a)gmail.com> --- src/util/virjson.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/virjson.c b/src/util/virjson.c index 454bd657be..5780dbb094 100644 --- a/src/util/virjson.c +++ b/src/util/virjson.c @@ -1438,7 +1438,7 @@ virJSONValueFromJsonC(json_object *jobj) cur = virJSONValueFromJsonC(val); if (!cur) { - g_free(ret); + virJSONValue(ret); return NULL; } -- 2.39.2

1 1

[PATCH 0/3] Add 'scalable_mode' and 'first_stage' attributes to intel IOMMU
by Zhenzhong Duan 06 Mar '26

06 Mar '26

Hi, This adds 'scalable_mode' and 'first_stage' attributes to intel IOMMU so that emulated device can run with first stage translation. This is based on Nathan Chen's iommufd series v2[1], so for passthrough device, nested tranlation is enabled automatically with below config: <iommu model='intel'> <driver caching_mode='on' iotlb='on' scalable_mode='on' first_stage='on'/> </iommu> Tests: Basic net card passthrough libvirt selftest Thanks Zhenzhong [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/KFYU… Zhenzhong Duan (3): qemu: Introduce scalable_mode and first_stage capabilities conf: add support for 'scalable_mode' and 'first_stage' attributes to intel IOMMU qemu: Add command line support for scalable mode and first stage of virtual vtd docs/formatdomain.rst | 8 +++++ src/conf/domain_conf.c | 35 ++++++++++++++++++- src/conf/domain_conf.h | 2 ++ src/conf/domain_validate.c | 6 ++++ src/conf/schemas/domaincommon.rng | 10 ++++++ src/qemu/qemu_capabilities.c | 4 +++ src/qemu/qemu_capabilities.h | 2 ++ src/qemu/qemu_command.c | 2 ++ src/qemu/qemu_validate.c | 12 +++++++ .../caps_10.0.0_x86_64+amdsev.xml | 2 ++ .../caps_10.0.0_x86_64.xml | 2 ++ .../caps_10.1.0_x86_64+inteltdx.xml | 2 ++ .../caps_10.1.0_x86_64.xml | 2 ++ .../caps_10.2.0_x86_64.xml | 2 ++ .../caps_6.2.0_x86_64.xml | 1 + .../caps_7.0.0_x86_64.xml | 1 + .../caps_7.1.0_x86_64.xml | 1 + .../caps_7.2.0_x86_64+hvf.xml | 1 + .../caps_7.2.0_x86_64.xml | 1 + .../caps_8.0.0_x86_64.xml | 1 + .../caps_8.1.0_x86_64.xml | 1 + .../caps_8.2.0_x86_64.xml | 1 + .../caps_9.0.0_x86_64.xml | 1 + .../caps_9.1.0_x86_64.xml | 1 + .../caps_9.2.0_x86_64+amdsev.xml | 1 + .../caps_9.2.0_x86_64.xml | 1 + 26 files changed, 102 insertions(+), 1 deletion(-) -- 2.47.3

3 6

[PATCH] hw/riscv: Remove deprecated 'riscv,delegate' device-tree property
by Philippe Mathieu-Daudé 05 Mar '26

05 Mar '26

The "riscv,delegate" DT property was added in QEMU 7.0 as part of the AIA APLIC support. The property changed name during the review process in Linux and the correct name ended up being "riscv,delegation". The incorrect name was added as alias, and deprecated in v9.1 (commit 38facfa8432), so can be removed for v11.0. Signed-off-by: Philippe Mathieu-Daudé <philmd(a)linaro.org> --- Binary file pc-bios/opensbi-riscv32-generic-fw_dynamic.bin matches Binary file pc-bios/opensbi-riscv64-generic-fw_dynamic.bin matches --- docs/about/deprecated.rst | 11 ----------- docs/about/removed-features.rst | 11 +++++++++++ hw/riscv/virt.c | 9 --------- 3 files changed, 11 insertions(+), 20 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 1d5c4f3707c..cc5502e5394 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -494,17 +494,6 @@ versions, aliases will point to newer CPU model versions depending on the machine type, so management software must resolve CPU model aliases before starting a virtual machine. -RISC-V "virt" board "riscv,delegate" DT property (since 9.1) -'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' - -The "riscv,delegate" DT property was added in QEMU 7.0 as part of -the AIA APLIC support. The property changed name during the review -process in Linux and the correct name ended up being -"riscv,delegation". Changing the DT property name will break all -available firmwares that are using the current (wrong) name. The -property is kept as is in 9.1, together with "riscv,delegation", to -give more time for firmware developers to change their code. - x86 "isapc" board use of modern x86 CPUs (since 10.2) ''''''''''''''''''''''''''''''''''''''''''''''''''''' diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst index 41bec8b8e38..0a62e87ee35 100644 --- a/docs/about/removed-features.rst +++ b/docs/about/removed-features.rst @@ -1232,6 +1232,17 @@ converting to using TCG plugins they should contact the qemu-devel mailing list. +Firmware, ACPI, Device Tree +--------------------------- + +RISC-V "virt" board "riscv,delegate" DT property (removed in 11.0) +'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' + +The "riscv,delegate" DT property was added in QEMU 7.0 as part of +the AIA APLIC support. The property changed name during the review +process in Linux and the correct name ended up being "riscv,delegation". + + System emulator devices ----------------------- diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c index bbce2fb6671..a1c323e66df 100644 --- a/hw/riscv/virt.c +++ b/hw/riscv/virt.c @@ -666,15 +666,6 @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket, qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegation", aplic_child_phandle, 0x1, VIRT_IRQCHIP_NUM_SOURCES); - /* - * DEPRECATED_9.1: Compat property kept temporarily - * to allow old firmwares to work with AIA. Do *not* - * use 'riscv,delegate' in new code: use - * 'riscv,delegation' instead. - */ - qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate", - aplic_child_phandle, 0x1, - VIRT_IRQCHIP_NUM_SOURCES); } riscv_socket_fdt_write_id(ms, aplic_name, socket); -- 2.52.0

4 4