- Devel - libvirt List Archives

[PATCH v2 0/2] qemu_dbus: Escape path to dbus-daemon socket if needed
by Michal Privoznik 18 Dec '25

18 Dec '25

v2 of: $(you know which patch, the list archive is down) diff to v1: - New function to escape a string according to DBus rules is introduced (virStringEscapeDBus()) and used. Michal Prívozník (2): util: Introduce virStringEscapeDBus() qemu_dbus: Escape path to dbus-daemon socket if needed src/libvirt_private.syms | 1 + src/qemu/qemu_dbus.c | 4 ++- src/util/virstring.c | 64 ++++++++++++++++++++++++++++++++++++++++ src/util/virstring.h | 1 + tests/virstringtest.c | 43 +++++++++++++++++++++++++++ 5 files changed, 112 insertions(+), 1 deletion(-) -- 2.51.2

1 2

[PATCH] qemu_dbus: Escape path to dbus-daemon socket if needed
by Michal Privoznik 18 Dec '25

18 Dec '25

From: Michal Privoznik <mprivozn(a)redhat.com> According to [1] there are only few characters allowed in the path to the daemon socket (alphanum and some punctuation; notably, space is missing on the list). The rest must be escaped by '%NN' notation. Fortunately, g_uri_escape_string() with some carefully selected input values is able to escape the path. Almost - it considers tilde valid but DBus doesn't. Well, let's hope nobody has tilde in domain name. 1: https://gitlab.freedesktop.org/dbus/dbus/-/blob/2dee5236088bcf690ba92b743a5… Closes: https://gitlab.com/libvirt/libvirt/-/issues/834 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_dbus.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_dbus.c b/src/qemu/qemu_dbus.c index 625884ad46..db0757b71d 100644 --- a/src/qemu/qemu_dbus.c +++ b/src/qemu/qemu_dbus.c @@ -119,6 +119,12 @@ static int qemuDBusWriteConfig(const char *filename, const char *path, bool privileged) { g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER; + /* Escape @path pointing to socket where the dbus-daemon is going to listen + * to. Valid characters are alphanumeric, '-', '_', '/', '\\', '*' and '.'. + * The rest must be URI escaped. g_uri_escape_string() treads alphanumeric, + * '-', '.', '_' and '~' as valid. + */ + g_autofree char *escapedPath = g_uri_escape_string(path, "/\\*", false); g_autofree char *config = NULL; virBufferAddLit(&buf, "<!DOCTYPE busconfig PUBLIC \"-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN\"\n"); @@ -127,7 +133,7 @@ qemuDBusWriteConfig(const char *filename, const char *path, bool privileged) virBufferAdjustIndent(&buf, 2); virBufferAddLit(&buf, "<type>org.libvirt.qemu</type>\n"); - virBufferAsprintf(&buf, "<listen>unix:path=%s</listen>\n", path); + virBufferAsprintf(&buf, "<listen>unix:path=%s</listen>\n", escapedPath); virBufferAddLit(&buf, "<auth>EXTERNAL</auth>\n"); virBufferAddLit(&buf, "<policy context='default'>\n"); -- 2.51.2

4 4

[PATCH v2 0/5] qemu: Implement support for iommufd
by Nathan Chen 18 Dec '25

18 Dec '25

Hi, This is a follow up to the first patch series [0] for using iommufd to propagate DMA mappings to the kernel for VM-assigned host devices in a qemu VM. We add a new 'iommufd' attribute for hostdev devices to be associated with the iommufd object. For instance, specifying the iommufd object and associated hostdev in a VM definition: <devices> ... <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> ... </devices> This would get translated to a qemu command line with the arguments below. Note that libvirt will open the /dev/iommu and VFIO cdev, passing the associated fd number to qemu: -object '{"qom-type":"iommufd","id":"iommufd0","fd":"24"}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","iommufd":"iommufd0","fd":"22","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","iommufd":"iommufd0","fd":"25","bus":"pci.22","addr":"0x0"}' \ Note that when Libvirt launches the qemu process as an unprivileged user, i.e. libvirt-qemu, it is bound by the RLIMIT_MEMLOCK limit calculated based on how much RAM is assigned to the VM. IOMMUFD's unified memory accounting causes ENOMEM errors for large device BARs that exceed the process memlock limit. VFIO without IOMMUFD does not check device memory against the limit and therefore does not show this behavior. To work around the issue, we can specify CAP_IPC_LOCK=ep capability for the qemu binary to bypass the RLIMIT_MEMLOCK limit. I am working on a long-term fix in the kernel to mark device memory regions so they do not count against the RLIMIT_MEMLOCK limit for how much memory can be locked/pinned, as I/O device BARs do not consume host RAM. This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/iommufd-11-25 Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/MYPM… Signed-off-by: Nathan Chen <nathanc(a)nvidia.com> Nathan Chen (5): qemu: Implement support for associating iommufd to hostdev qemu: open VFIO FDs from libvirt backend qemu: open iommufd FD from libvirt backend qemu: Update Cgroup, namespace, and seclabel for iommufd tests: qemuxmlconfdata: provide iommufd sample XML and CLI args docs/formatdomain.rst | 8 + src/conf/device_conf.c | 12 ++ src/conf/device_conf.h | 1 + src/conf/domain_conf.h | 2 + src/conf/schemas/basictypes.rng | 5 + src/libvirt_private.syms | 1 + src/qemu/qemu_cgroup.c | 26 +-- src/qemu/qemu_command.c | 53 ++++- src/qemu/qemu_domain.c | 40 ++++ src/qemu/qemu_domain.h | 19 ++ src/qemu/qemu_namespace.c | 16 +- src/qemu/qemu_process.c | 186 ++++++++++++++++++ src/security/security_apparmor.c | 18 +- src/security/security_dac.c | 28 ++- src/security/security_selinux.c | 28 ++- src/security/virt-aa-helper.c | 11 +- src/util/virpci.c | 69 +++++++ src/util/virpci.h | 2 + .../iommufd-q35.x86_64-latest.args | 41 ++++ .../iommufd-q35.x86_64-latest.xml | 60 ++++++ tests/qemuxmlconfdata/iommufd-q35.xml | 38 ++++ .../iommufd-virt.aarch64-latest.args | 33 ++++ .../iommufd-virt.aarch64-latest.xml | 34 ++++ tests/qemuxmlconfdata/iommufd-virt.xml | 22 +++ .../iommufd.x86_64-latest.args | 35 ++++ .../qemuxmlconfdata/iommufd.x86_64-latest.xml | 38 ++++ tests/qemuxmlconfdata/iommufd.xml | 30 +++ tests/qemuxmlconftest.c | 33 ++++ 28 files changed, 839 insertions(+), 50 deletions(-) create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-q35.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.xml create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd.xml -- 2.43.0

2 15

[PATCH] rpm: disable -Werror on ELN builds
by Daniel P. Berrangé 18 Dec '25

18 Dec '25

From: Daniel P. Berrangé <berrange(a)redhat.com> The ELN build root performs rebuilds of Fedora rawhide packages with %{rhel} set instead of %{fedora}. The vast majority of the time this will "do the right thing", but when we control -Dwerror we chose to enable -Werror on RHEL on the basis that the GCC toolchain is stable and thus we don't expect new warnings to appear. That does not hold true for ELN which tracks rawhide GCC. Thus we have the rare situation where we should explicitly check %{eln} not just %{rhel}. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index ccfe75135b..22c9975d9f 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -263,8 +263,9 @@ # RHEL releases provide stable tool chains and so it is safe to turn # compiler warning into errors without being worried about frequent -# changes in reported warnings -%if 0%{?rhel} +# changes in reported warnings. ELN is a rebuild of Rawhide so should +# be treated as unstable for this flag +%if 0%{?rhel} && !0%{?eln} %define enable_werror -Dwerror=true %else %define enable_werror -Dwerror=false -Dgit_werror=disabled -- 2.52.0

2 1

[PATCH v2 0/2] bhyve: implement SLIRP networking
by Roman Bogorodskiy 17 Dec '25

17 Dec '25

Was going to push it right away, but there were a little more changes than I expected, so sending v2. Changes from v1: - Patch 1/3 (implementation) updated to pass "mac=" MAC address configuration for the slirp interface, - Patch 2/3 updated to remove error if MAC address is specified and squashed into 1/3 as there was only a single code chunk left. Roman Bogorodskiy (2): bhyve: implement SLIRP networking docs: drvbhyve: document SLIRP networking docs/drvbhyve.rst | 24 ++++++++++++++ src/bhyve/bhyve_command.c | 10 ++++-- src/bhyve/bhyve_domain.c | 12 ++++++- .../bhyvexml2argv-slirp-ip.xml | 22 +++++++++++++ .../bhyvexml2argv-slirp-mac-addr.args | 10 ++++++ .../bhyvexml2argv-slirp-mac-addr.ldargs | 4 +++ .../bhyvexml2argv-slirp-mac-addr.xml | 22 +++++++++++++ .../bhyvexml2argv-slirp.args | 10 ++++++ .../bhyvexml2argv-slirp.ldargs | 4 +++ .../bhyvexml2argvdata/bhyvexml2argv-slirp.xml | 21 ++++++++++++ tests/bhyvexml2argvtest.c | 3 ++ .../bhyvexml2xmlout-slirp.xml | 32 +++++++++++++++++++ tests/bhyvexml2xmltest.c | 1 + 13 files changed, 172 insertions(+), 3 deletions(-) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp-ip.xml create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp-mac-addr.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp-mac-addr.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp-mac-addr.xml create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp.xml create mode 100644 tests/bhyvexml2xmloutdata/bhyvexml2xmlout-slirp.xml -- 2.51.2

2 5

[PATCH] hw/arm: Deprecate legacy VirtIO devices on big-endian guests
by Philippe Mathieu-Daudé 17 Dec '25

17 Dec '25

We couldn't find a way (guest OS with VirtIO drivers) to test a legacy VirtIO device on a ARM vCPU running in big-endian. Deprecate for the v11.0 release, giving 1 year to users who really care to contribute functional tests. Suggested-by: Alex Bennée <alex.bennee(a)linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd(a)linaro.org> --- docs/about/deprecated.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index ac31a2bce42..3a69facb0f1 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -515,6 +515,17 @@ It was implemented as a no-op instruction in TCG up to QEMU 9.0, but only with ``-cpu max`` (which does not guarantee migration compatibility across versions). +VirtIO devices +'''''''''''''' + +Legacy VirtIO devices on Big-Endian ARM architecture (since 11.0) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +There are no functional tests for legacy virtio devices used by ARM +machines running in big-endian order, which makes harder to maintain +the code path while the code base evolve. + + Backwards compatibility ----------------------- -- 2.52.0

4 4

[PATCH v3 21/51] qapi/migration: Deprecate capabilities commands
by Fabiano Rosas 15 Dec '25

15 Dec '25

The concept of capabilities is being merged into the concept of parameters. From now on, the commands that handle capabilities are deprecated in favor of the commands that handle parameters. Affected commands: - migrate-set-capabilities - query-migrate-capabilities Reviewed-by: Markus Armbruster <armbru(a)redhat.com> Reviewed-by: Peter Xu <peterx(a)redhat.com> Signed-off-by: Fabiano Rosas <farosas(a)suse.de> --- docs/about/deprecated.rst | 10 ++++++++++ migration/migration-hmp-cmds.c | 6 ++++++ qapi/migration.json | 16 ++++++++++++++-- 3 files changed, 30 insertions(+), 2 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index ac31a2bce4..1949508efa 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -588,3 +588,13 @@ command documentation for details on the ``fdset`` usage. The ``zero-blocks`` capability was part of the block migration which doesn't exist anymore since it was removed in QEMU v9.1. + +``migrate-set-capabilities`` command (since 10.2) +''''''''''''''''''''''''''''''''''''''''''''''''' + +Use ``migrate-set-parameters`` instead. + +``query-migrate-capabilities`` command (since 10.2) +''''''''''''''''''''''''''''''''''''''''''''''''''' + +Use ``query-migrate-parameters`` instead. diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c index 28b48c34bf..7e5ac57da5 100644 --- a/migration/migration-hmp-cmds.c +++ b/migration/migration-hmp-cmds.c @@ -298,6 +298,9 @@ void hmp_info_migrate_capabilities(Monitor *mon, const QDict *qdict) { MigrationCapabilityStatusList *caps, *cap; + warn_report("info migrate_capabilities is deprecated;" + " use info migrate_parameters instead"); + caps = qmp_query_migrate_capabilities(NULL); if (caps) { @@ -705,6 +708,9 @@ void hmp_migrate_set_capability(Monitor *mon, const QDict *qdict) MigrationCapabilityStatus *value; int val; + warn_report("migrate_set_capability is deprecated;" + " use migrate_set_parameter instead"); + val = qapi_enum_parse(&MigrationCapability_lookup, cap, -1, &err); if (val < 0) { goto end; diff --git a/qapi/migration.json b/qapi/migration.json index fcbb699a47..76a1e03f2f 100644 --- a/qapi/migration.json +++ b/qapi/migration.json @@ -570,6 +570,11 @@ # # @capabilities: json array of capability modifications to make # +# Features: +# +# @deprecated: This command is deprecated. Use migrate-set-parameters +# instead. +# # Since: 1.2 # # .. qmp-example:: @@ -579,13 +584,19 @@ # <- { "return": {} } ## { 'command': 'migrate-set-capabilities', - 'data': { 'capabilities': ['MigrationCapabilityStatus'] } } + 'data': { 'capabilities': ['MigrationCapabilityStatus'] }, + 'features': ['deprecated'] } ## # @query-migrate-capabilities: # # Return information about the current migration capabilities status # +# Features: +# +# @deprecated: This command is deprecated. Use +# query-migrate-parameters instead. +# # Since: 1.2 # # .. qmp-example:: @@ -601,7 +612,8 @@ # {"state": false, "capability": "x-colo"} # ]} ## -{ 'command': 'query-migrate-capabilities', 'returns': ['MigrationCapabilityStatus']} +{ 'command': 'query-migrate-capabilities', 'returns': ['MigrationCapabilityStatus'], + 'features': ['deprecated'] } ## # @MultiFDCompression: -- 2.51.0

1 0

[PATCH 1/3] bhyve: implement SLIRP networking
by Roman Bogorodskiy 15 Dec '25

15 Dec '25

Bhyve supports SLIRP networking using the following syntax: -s 12:0,e1000,slirp,open Where "e1000" is a NIC model, "slirp" is the SLIRP backend and "open" specifies open mode where external network is available to the guest. The "open" mode is a recent addition in FreeBSD -CURRENT. Unfortunately, bhyve does not provide a way to probe whether the open mode is supported, so users will have to make sure it's supported on their own. For the reference, without the "open" mode, the guest will have no outside network connectivity. To make this mode useful, it is possible to configure forwarding from the host to the guest, but it is not covered by this patch. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- src/bhyve/bhyve_command.c | 6 +++- .../bhyvexml2argv-slirp.args | 10 ++++++ .../bhyvexml2argv-slirp.ldargs | 4 +++ .../bhyvexml2argvdata/bhyvexml2argv-slirp.xml | 21 ++++++++++++ tests/bhyvexml2argvtest.c | 1 + .../bhyvexml2xmlout-slirp.xml | 32 +++++++++++++++++++ tests/bhyvexml2xmltest.c | 1 + 7 files changed, 74 insertions(+), 1 deletion(-) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-slirp.xml create mode 100644 tests/bhyvexml2xmloutdata/bhyvexml2xmlout-slirp.xml diff --git a/src/bhyve/bhyve_command.c b/src/bhyve/bhyve_command.c index e42e7b1ecc..b7e47084e6 100644 --- a/src/bhyve/bhyve_command.c +++ b/src/bhyve/bhyve_command.c @@ -93,9 +93,13 @@ bhyveBuildNetArgStr(const virDomainDef *def, goto cleanup; } break; + case VIR_DOMAIN_NET_TYPE_USER: + virCommandAddArg(cmd, "-s"); + virCommandAddArgFormat(cmd, "%d:0,%s,slirp,open", + net->info.addr.pci.slot, nic_model); + return 0; case VIR_DOMAIN_NET_TYPE_ETHERNET: case VIR_DOMAIN_NET_TYPE_DIRECT: - case VIR_DOMAIN_NET_TYPE_USER: case VIR_DOMAIN_NET_TYPE_VHOSTUSER: case VIR_DOMAIN_NET_TYPE_SERVER: case VIR_DOMAIN_NET_TYPE_CLIENT: diff --git a/tests/bhyvexml2argvdata/bhyvexml2argv-slirp.args b/tests/bhyvexml2argvdata/bhyvexml2argv-slirp.args new file mode 100644 index 0000000000..ff9a90ebc9 --- /dev/null +++ b/tests/bhyvexml2argvdata/bhyvexml2argv-slirp.args @@ -0,0 +1,10 @@ +bhyve \ +-c 1 \ +-m 214 \ +-u \ +-H \ +-P \ +-s 0:0,hostbridge \ +-s 2:0,ahci,hd:/tmp/freebsd.img \ +-s 3:0,e1000,slirp,open \ +bhyve diff --git a/tests/bhyvexml2argvdata/bhyvexml2argv-slirp.ldargs b/tests/bhyvexml2argvdata/bhyvexml2argv-slirp.ldargs new file mode 100644 index 0000000000..5905f4b3e6 --- /dev/null +++ b/tests/bhyvexml2argvdata/bhyvexml2argv-slirp.ldargs @@ -0,0 +1,4 @@ +bhyveload \ +-m 214 \ +-d /tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/bhyvexml2argv-slirp.xml b/tests/bhyvexml2argvdata/bhyvexml2argv-slirp.xml new file mode 100644 index 0000000000..5cf13d2a20 --- /dev/null +++ b/tests/bhyvexml2argvdata/bhyvexml2argv-slirp.xml @@ -0,0 +1,21 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='user'> + <model type='e1000'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2argvtest.c b/tests/bhyvexml2argvtest.c index 650313c2da..ee3d677947 100644 --- a/tests/bhyvexml2argvtest.c +++ b/tests/bhyvexml2argvtest.c @@ -270,6 +270,7 @@ mymain(void) DO_TEST("sata-rotation-rate"); DO_TEST_FAILURE("disk-virtio-rotation-rate"); DO_TEST_FAILURE("disk-virtio-queue-opts"); + DO_TEST("slirp"); /* Address allocation tests */ DO_TEST("addr-single-sata-disk"); diff --git a/tests/bhyvexml2xmloutdata/bhyvexml2xmlout-slirp.xml b/tests/bhyvexml2xmloutdata/bhyvexml2xmlout-slirp.xml new file mode 100644 index 0000000000..44d2616f6c --- /dev/null +++ b/tests/bhyvexml2xmloutdata/bhyvexml2xmlout-slirp.xml @@ -0,0 +1,32 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='file' device='disk'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <controller type='pci' index='0' model='pci-root'/> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </controller> + <interface type='user'> + <mac address='52:54:00:00:00:00'/> + <model type='e1000'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + </devices> +</domain> diff --git a/tests/bhyvexml2xmltest.c b/tests/bhyvexml2xmltest.c index c2458b9fc4..0abc50b0de 100644 --- a/tests/bhyvexml2xmltest.c +++ b/tests/bhyvexml2xmltest.c @@ -122,6 +122,7 @@ mymain(void) DO_TEST_DIFFERENT("nvme"); DO_TEST_DIFFERENT("2-nvme-2-controllers"); DO_TEST_DIFFERENT("passthru-multiple-devs"); + DO_TEST_DIFFERENT("slirp"); /* Address allocation tests */ DO_TEST_DIFFERENT("addr-single-sata-disk"); -- 2.51.2

3 9

Question about error conditions for ACPI usage on aarch64
by Kazuhiro Abe (Fujitsu) 15 Dec '25

15 Dec '25

Hi all, We are currently working on CCA support. Due to CCA specifications, we are unable to use pflash with QEMU. Therefore, we intend to enable ACPI by specifying the UEFI firmware using the QEMU -bios option as follows: -machine virt,acpi=on -bios /usr/share/qemu-efi-aarch64/QEMU_EFI.fd Using the above QEMU option, we can successfully boot VM. My understanding is that the above QEMU option could be translated by the following libvirt XML: <os> <type arch='aarch64' machine='virt-4.0'>hvm</type> <loader type="rom">/usr/share/qemu-efi-aarch64/QEMU_EFI.fd</loader> </os> <features> <acpi/> </features> However, this XML configuration results in a validation error. Specifically, the error occurs because def->os.firmware is VIR_DOMAIN_OS_DEF_FIRMWARE_NONE during the following check: src/qemu/qemu_validate.c: qemuValidateDomainDef() /* On aarch64, ACPI requires UEFI */ if (def->features[VIR_DOMAIN_FEATURE_ACPI] == VIR_TRISTATE_SWITCH_ON && def->os.arch == VIR_ARCH_AARCH64 && (def->os.firmware != VIR_DOMAIN_OS_DEF_FIRMWARE_EFI && !virDomainDefHasOldStyleUEFI(def))) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("ACPI requires UEFI on this architecture")); return -1; } It appears that a configuration that successfully boots QEMU directly is being rejected by libvirt. Could you please explain if there's a specific reason for this strict validation? We are particularly interested in why VIR_DOMAIN_OS_DEF_FIRMWARE_NONE also becomes a condition for this error. Best Regards, Kazuhiro Abe

3 9

[PATCH] util: json: Increase JSON nesting limit when parsing to 300
by Peter Krempa 12 Dec '25

12 Dec '25

From: Peter Krempa <pkrempa(a)redhat.com> The default in json-c is 32 which is too low to accomodate the 200 snapshot layers we supported historically in the qemu driver (200 is picked based on the 256 layer limit in libxml). The response to 'query-block' is otherwise too low and we fail to start the VM when there's around 26 images in a backing chain. 'json_tokener_new_ex' is supported since json-c 0.11 and we require at least 0.14. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- I've also figured out that we don't actually care about the backing image information so I've proposed a 'flat' mode for 'query-block' in qemu similarly to what we do for 'query-named-block-nodes': https://mail.gnu.org/archive/html/qemu-block/2025-12/msg00104.html src/util/virjson.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/util/virjson.c b/src/util/virjson.c index a799707c16..454bd657be 100644 --- a/src/util/virjson.c +++ b/src/util/virjson.c @@ -1466,7 +1466,15 @@ virJSONValueFromString(const char *jsonstring) VIR_DEBUG("string=%s", jsonstring); - tok = json_tokener_new(); + /* When creating the tokener we need to specify the limit of the nesting + * depth of JSON objects. The default in json-c is 32. Since we need to + * support at least 200 layers of snapshots (the limit is based on a + * conservative take on the 256 layer nesting limit for XML in libxml), for + * which we have internal checks, we also need to set the JSON limit to + * be able to parse qemu responses for such a deeply nested snapshot list. + * '300' is picked a sa conservative buffer on top of the 200 layers plus + * some of the extra wrappers that qemu adds*/ + tok = json_tokener_new_ex(300); if (!tok) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("failed to create JSON tokener")); -- 2.52.0

2 2

Re: [RFC PATCH 2/9] MAINTAINERS: fix libvirt entry
by Philippe Mathieu-Daudé 12 Dec '25

12 Dec '25

On 11/12/25 19:01, Alex Bennée wrote: > We have a particular tag for lists so lets use it. > > Signed-off-by: Alex Bennée <alex.bennee(a)linaro.org> > --- > MAINTAINERS | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/MAINTAINERS b/MAINTAINERS > index 05b644cfc9b..a3fdc4ca911 100644 > --- a/MAINTAINERS > +++ b/MAINTAINERS > @@ -4466,7 +4466,7 @@ F: gitdm.config > F: contrib/gitdm/* > > Incompatible changes > -R: devel(a)lists.libvirt.org > +L: devel(a)lists.libvirt.org Maybe keep both? See: commit b02c9bc35a03c099600693d6909f4566078880b8 Author: Markus Armbruster <armbru(a)redhat.com> Date: Mon Jul 16 09:32:26 2018 +0200 MAINTAINERS: New section "Incompatible changes", copy libvir-list Libvirt developers would like to be copied on patches to qemu-doc appendix "Deprecated features". Do them the favor. Signed-off-by: Markus Armbruster <armbru(a)redhat.com> Message-Id: <20180716073226.21127-3-armbru(a)redhat.com> Reviewed-by: Thomas Huth <thuth(a)redhat.com> Reviewed-by: Cornelia Huck <cohuck(a)redhat.com> Reviewed-by: Daniel P. Berrangé <berrange(a)redhat.com> diff --git a/MAINTAINERS b/MAINTAINERS index 20eef3cb61c..666e9368126 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -2194,6 +2194,10 @@ M: Daniel P. Berrange <berrange(a)redhat.com> S: Odd Fixes F: docs/devel/build-system.txt +Incompatible changes +R: libvir-list(a)redhat.com +F: qemu-deprecated.texi

3 2

[PATCH 0/5] cover: RFE libvirt secret encryption on disk
by Arun Menon 12 Dec '25

12 Dec '25

Libvirt secrets are stored unencrypted on the disk. With this series we want to start encrypting the secrets. 1. Introduce the GnuTLS decryption wrapper functions that work exact opposite to the encryption wrappers. The new test added works fine because during test execution, we use the mock implementation of virRandomBytes while generating the iv and the key. 2. Add a new service called virt-secrets-init-encryption, that is linked to the virtsecretd service. virtsecretd service only starts after the new service generates a random encryption key. 3. Add a new secret.conf configuration file that helps user to set a. secrets_encryption_key - allows the user to specify the encryption key file path, in case the default key is not to be used. b. encrypt_data - set to 0 or 1. If set to 1, then the newly added secrets will be encrypted. 4. Add encryption scheme or cipher attribute that will allow us to choose the last used cipher. New modes can be added to the enum. 5. Once we have the encryption key, and a reliable way to tell the daemon what encryption scheme the secret object must use, we can encrypt the secrets on disk and store them in <uuid>.<encryption_scheme> format. It is important to note that if the encryption key is changed between restarts, then the respective secret will not be loaded by the driver. This is a sincere attempt to improve upon the already submitted patch https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/KE6G… Resolves: https://issues.redhat.com/browse/RHEL-7125 RFC: https://patchew.org/Libvirt/20251127072232.38426-1-armenon@redhat.com/ --- Changes in v1: - Previously, encrypt_data was set to 1 regardless of what is present in the secrets config file. This is now changed. encrypt_data is first read from the config file, and it is set to 1 only if secrets_encryption_key is not NULL or if systemd credential named "secrets-encryption-key" exists. - Rename from secrets.conf to secret.conf. Move secrets_config.c from src/conf to src/secret/ - Add a special error code 'VIR_ERR_INVALID_ENCR_KEY_SECRET' for when the secret key length is invalid. - Add the 2 directives to load credential into libvirtd service as well. Rename unit file name from secret-init-encryption.in to virt-secret-init-encryption.service.in. - Remove unnecessary configuration settings and make it inline. Arun Menon (5): util: Add support for GnuTLS decryption secret: Set up default encryption secret key for the virtsecretd service secret: Add secret.conf configuration file and parse it secret: Add encryptionSchemeType attribute to store ciphers secret: Add functionality to load and save secrets in encrypted format include/libvirt/virterror.h | 1 + libvirt.spec.in | 7 + po/POTFILES | 1 + src/conf/secret_conf.c | 6 + src/conf/secret_conf.h | 9 + src/conf/virsecretobj.c | 184 ++++++++++++++---- src/conf/virsecretobj.h | 18 +- src/libvirt_private.syms | 1 + src/meson.build | 1 + src/remote/libvirtd.service.in | 2 + src/secret/libvirt_secrets.aug | 40 ++++ src/secret/meson.build | 34 ++++ src/secret/secret.conf.in | 14 ++ src/secret/secret_config.c | 171 ++++++++++++++++ src/secret/secret_config.h | 40 ++++ src/secret/secret_driver.c | 34 +++- src/secret/test_libvirt_secrets.aug.in | 6 + .../virt-secret-init-encryption.service.in | 7 + src/secret/virtsecretd.service.extra.in | 8 + src/util/vircrypto.c | 126 +++++++++++- src/util/vircrypto.h | 8 + src/util/virerror.c | 3 + tests/vircryptotest.c | 65 +++++++ 23 files changed, 736 insertions(+), 50 deletions(-) create mode 100644 src/secret/libvirt_secrets.aug create mode 100644 src/secret/secret.conf.in create mode 100644 src/secret/secret_config.c create mode 100644 src/secret/secret_config.h create mode 100644 src/secret/test_libvirt_secrets.aug.in create mode 100644 src/secret/virt-secret-init-encryption.service.in -- 2.51.1

2 9

[PATCH v1] tests: add capabilities for QEMU v10.1.0 on s390x
by Shalini Chellathurai Saroja 12 Dec '25

12 Dec '25

Let us introduce the capabilities for QEMU v10.1.0 on s390x. Signed-off-by: Shalini Chellathurai Saroja <shalini(a)linux.ibm.com> Reviewed-by: Boris Fiuczynski <fiuczy(a)linux.ibm.com> The replies and xml files are removed from this patch and are available in https://gitlab.com/shalinichellathurai/libvirt/-/commit/e2c1c82c6701c87b4f6… --- tests/domaincapsdata/qemu_10.1.0.s390x.xml | 444 + .../caps_10.1.0_s390x.replies | 39228 ++++++++++++++++ .../caps_10.1.0_s390x.xml | 4244 ++ ...deprecated-features-none.s390x-latest.args | 2 +- ...-deprecated-features-off.s390x-latest.args | 2 +- ...l-deprecated-features-on.s390x-latest.args | 2 +- ...default-video-type-s390x.s390x-latest.args | 2 +- ...vfio-zpci-ccw-memballoon.s390x-latest.args | 2 +- .../launch-security-s390-pv.s390x-latest.args | 2 +- ...t-cpu-kvm-ccw-virtio-4.2.s390x-latest.args | 2 +- .../s390-defaultconsole.s390x-latest.args | 2 +- .../s390-panic.s390x-latest.args | 2 +- 12 files changed, 43925 insertions(+), 9 deletions(-) create mode 100644 tests/domaincapsdata/qemu_10.1.0.s390x.xml create mode 100644 tests/qemucapabilitiesdata/caps_10.1.0_s390x.replies create mode 100644 tests/qemucapabilitiesdata/caps_10.1.0_s390x.xml diff --git a/tests/domaincapsdata/qemu_10.1.0.s390x.xml b/tests/domaincapsdata/qemu_10.1.0.s390x.xml new file mode 100644 index 0000000000..9d773385c4 --- /dev/null +++ b/tests/domaincapsdata/qemu_10.1.0.s390x.xml @@ -0,0 +1,444 @@ +<domainCapabilities> + <path>/usr/bin/qemu-system-s390x</path> + <domain>kvm</domain> + <machine>s390-ccw-virtio-10.1</machine> + <arch>s390x</arch> + <vcpu max='248'/> + <iothreads supported='yes'/> + <os supported='yes'> + <enum name='firmware'/> + <loader supported='yes'> + <value>/obviously/fake/firmware1.fd</value> + <value>/obviously/fake/firmware2.fd</value> + <enum name='type'> + <value>rom</value> + <value>pflash</value> + </enum> + <enum name='readonly'> + <value>yes</value> + <value>no</value> + </enum> + <enum name='secure'> + <value>no</value> + </enum> + </loader> + </os> + <cpu> + <mode name='host-passthrough' supported='yes'> + <enum name='hostPassthroughMigratable'> + <value>off</value> + </enum> + </mode> + <mode name='maximum' supported='yes'> + <enum name='maximumMigratable'> + <value>on</value> + <value>off</value> + </enum> + </mode> + <mode name='host-model' supported='yes'> + <model fallback='forbid'>gen17a-base</model> + <feature policy='require' name='nnpa'/> + <feature policy='require' name='aen'/> + <feature policy='require' name='gen17ptff'/> + <feature policy='require' name='ccf'/> + <feature policy='require' name='cmmnt'/> + <feature policy='require' name='vxpdeh'/> + <feature policy='require' name='aefsi'/> + <feature policy='require' name='diag318'/> + <feature policy='require' name='mepoch'/> + <feature policy='require' name='msa9'/> + <feature policy='require' name='msa8'/> + <feature policy='require' name='msa7'/> + <feature policy='require' name='msa6'/> + <feature policy='require' name='msa5'/> + <feature policy='require' name='msa4'/> + <feature policy='require' name='msa3'/> + <feature policy='require' name='msa2'/> + <feature policy='require' name='msa1'/> + <feature policy='require' name='msa13_pckmo'/> + <feature policy='require' name='msa11_pckmo'/> + <feature policy='require' name='msa10_pckmo'/> + <feature policy='require' name='sthyi'/> + <feature policy='require' name='edat'/> + <feature policy='require' name='ri'/> + <feature policy='require' name='deflate'/> + <feature policy='require' name='msa13'/> + <feature policy='require' name='msa11'/> + <feature policy='require' name='msa10'/> + <feature policy='require' name='edat2'/> + <feature policy='require' name='vxpdeh3'/> + <feature policy='require' name='etoken'/> + <feature policy='require' name='vx'/> + <feature policy='require' name='ipter'/> + <feature policy='require' name='pai'/> + <feature policy='require' name='paie'/> + <feature policy='require' name='mepochptff'/> + <feature policy='require' name='ap'/> + <feature policy='require' name='vxeh'/> + <feature policy='require' name='vxpd'/> + <feature policy='require' name='esop'/> + <feature policy='require' name='msa9_pckmo'/> + <feature policy='require' name='vxeh3'/> + <feature policy='require' name='vxeh2'/> + <feature policy='require' name='esort'/> + <feature policy='require' name='appv'/> + <feature policy='require' name='apqi'/> + <feature policy='require' name='apft'/> + <feature policy='require' name='els'/> + <feature policy='require' name='iep'/> + <feature policy='require' name='appvi'/> + <feature policy='require' name='ineff_nc_tx'/> + <feature policy='require' name='apqci'/> + <feature policy='require' name='cte'/> + <feature policy='require' name='ais'/> + <feature policy='require' name='bpb'/> + <feature policy='require' name='ctop'/> + <feature policy='require' name='gs'/> + <feature policy='require' name='ppa15'/> + <feature policy='require' name='zpci'/> + <feature policy='require' name='rdp'/> + <feature policy='require' name='sea_esop2'/> + <feature policy='require' name='beareh'/> + <feature policy='require' name='te'/> + <feature policy='require' name='cmm'/> + <feature policy='require' name='vxpdeh2'/> + </mode> + <mode name='custom' supported='yes'> + <model usable='yes' vendor='IBM'>gen15a</model> + <model usable='yes' vendor='IBM'>gen15a-base</model> + <model usable='yes' vendor='IBM'>gen15b</model> + <model usable='yes' vendor='IBM'>gen15b-base</model> + <model usable='yes' vendor='IBM'>gen16a</model> + <model usable='yes' vendor='IBM'>gen16a-base</model> + <model usable='yes' vendor='IBM'>gen16b</model> + <model usable='yes' vendor='IBM'>gen16b-base</model> + <model usable='yes' vendor='IBM'>gen17a</model> + <model usable='yes' vendor='IBM'>gen17a-base</model> + <model usable='yes' vendor='IBM'>gen17b</model> + <model usable='yes' vendor='IBM'>gen17b-base</model> + <model usable='yes' vendor='unknown'>max</model> + <model usable='yes' vendor='unknown'>qemu</model> + <model usable='no' vendor='IBM'>z10BC</model> + <blockers model='z10BC'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z10BC-base</model> + <blockers model='z10BC-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z10BC.2</model> + <blockers model='z10BC.2'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z10BC.2-base</model> + <blockers model='z10BC.2-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z10EC</model> + <blockers model='z10EC'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z10EC-base</model> + <blockers model='z10EC-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z10EC.2</model> + <blockers model='z10EC.2'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z10EC.2-base</model> + <blockers model='z10EC.2-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z10EC.3</model> + <blockers model='z10EC.3'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z10EC.3-base</model> + <blockers model='z10EC.3-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z114</model> + <blockers model='z114'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z114-base</model> + <blockers model='z114-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z13</model> + <blockers model='z13'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z13-base</model> + <blockers model='z13-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z13.2</model> + <blockers model='z13.2'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z13.2-base</model> + <blockers model='z13.2-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z13s</model> + <blockers model='z13s'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z13s-base</model> + <blockers model='z13s-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z14</model> + <blockers model='z14'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z14-base</model> + <blockers model='z14-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z14.2</model> + <blockers model='z14.2'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z14.2-base</model> + <blockers model='z14.2-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z14ZR1</model> + <blockers model='z14ZR1'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z14ZR1-base</model> + <blockers model='z14ZR1-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z196</model> + <blockers model='z196'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z196-base</model> + <blockers model='z196-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z196.2</model> + <blockers model='z196.2'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>z196.2-base</model> + <blockers model='z196.2-base'> + <feature name='csske'/> + </blockers> + <model usable='yes' vendor='IBM'>z800</model> + <model usable='yes' vendor='IBM'>z800-base</model> + <model usable='yes' vendor='IBM'>z890</model> + <model usable='yes' vendor='IBM'>z890-base</model> + <model usable='yes' vendor='IBM'>z890.2</model> + <model usable='yes' vendor='IBM'>z890.2-base</model> + <model usable='yes' vendor='IBM'>z890.3</model> + <model usable='yes' vendor='IBM'>z890.3-base</model> + <model usable='yes' vendor='IBM'>z900</model> + <model usable='yes' vendor='IBM'>z900-base</model> + <model usable='yes' vendor='IBM'>z900.2</model> + <model usable='yes' vendor='IBM'>z900.2-base</model> + <model usable='yes' vendor='IBM'>z900.3</model> + <model usable='yes' vendor='IBM'>z900.3-base</model> + <model usable='yes' vendor='IBM'>z990</model> + <model usable='yes' vendor='IBM'>z990-base</model> + <model usable='yes' vendor='IBM'>z990.2</model> + <model usable='yes' vendor='IBM'>z990.2-base</model> + <model usable='yes' vendor='IBM'>z990.3</model> + <model usable='yes' vendor='IBM'>z990.3-base</model> + <model usable='yes' vendor='IBM'>z990.4</model> + <model usable='yes' vendor='IBM'>z990.4-base</model> + <model usable='yes' vendor='IBM'>z990.5</model> + <model usable='yes' vendor='IBM'>z990.5-base</model> + <model usable='yes' vendor='IBM'>z9BC</model> + <model usable='yes' vendor='IBM'>z9BC-base</model> + <model usable='yes' vendor='IBM'>z9BC.2</model> + <model usable='yes' vendor='IBM'>z9BC.2-base</model> + <model usable='yes' vendor='IBM'>z9EC</model> + <model usable='yes' vendor='IBM'>z9EC-base</model> + <model usable='yes' vendor='IBM'>z9EC.2</model> + <model usable='yes' vendor='IBM'>z9EC.2-base</model> + <model usable='yes' vendor='IBM'>z9EC.3</model> + <model usable='yes' vendor='IBM'>z9EC.3-base</model> + <model usable='no' vendor='IBM'>zBC12</model> + <blockers model='zBC12'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>zBC12-base</model> + <blockers model='zBC12-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>zEC12</model> + <blockers model='zEC12'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>zEC12-base</model> + <blockers model='zEC12-base'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>zEC12.2</model> + <blockers model='zEC12.2'> + <feature name='csske'/> + </blockers> + <model usable='no' vendor='IBM'>zEC12.2-base</model> + <blockers model='zEC12.2-base'> + <feature name='csske'/> + </blockers> + </mode> + </cpu> + <memoryBacking supported='yes'> + <enum name='sourceType'> + <value>file</value> + <value>anonymous</value> + <value>memfd</value> + </enum> + </memoryBacking> + <devices> + <disk supported='yes'> + <enum name='diskDevice'> + <value>disk</value> + <value>cdrom</value> + <value>lun</value> + </enum> + <enum name='bus'> + <value>scsi</value> + <value>virtio</value> + <value>usb</value> + <value>nvme</value> + </enum> + <enum name='model'> + <value>virtio</value> + <value>virtio-transitional</value> + <value>virtio-non-transitional</value> + </enum> + </disk> + <graphics supported='yes'> + <enum name='type'> + <value>sdl</value> + <value>vnc</value> + <value>rdp</value> + <value>egl-headless</value> + <value>dbus</value> + </enum> + </graphics> + <video supported='yes'> + <enum name='modelType'> + <value>virtio</value> + <value>none</value> + </enum> + </video> + <hostdev supported='yes'> + <enum name='mode'> + <value>subsystem</value> + </enum> + <enum name='startupPolicy'> + <value>default</value> + <value>mandatory</value> + <value>requisite</value> + <value>optional</value> + </enum> + <enum name='subsysType'> + <value>usb</value> + <value>pci</value> + <value>scsi</value> + </enum> + <enum name='capsType'/> + <enum name='pciBackend'> + <value>default</value> + <value>vfio</value> + </enum> + </hostdev> + <rng supported='yes'> + <enum name='model'> + <value>virtio</value> + <value>virtio-transitional</value> + <value>virtio-non-transitional</value> + </enum> + <enum name='backendModel'> + <value>random</value> + <value>egd</value> + <value>builtin</value> + </enum> + </rng> + <filesystem supported='yes'> + <enum name='driverType'> + <value>path</value> + <value>handle</value> + <value>virtiofs</value> + </enum> + </filesystem> + <tpm supported='no'/> + <redirdev supported='yes'> + <enum name='bus'> + <value>usb</value> + </enum> + </redirdev> + <channel supported='yes'> + <enum name='type'> + <value>pty</value> + <value>unix</value> + </enum> + </channel> + <crypto supported='yes'> + <enum name='model'> + <value>virtio</value> + </enum> + <enum name='type'> + <value>qemu</value> + </enum> + <enum name='backendModel'> + <value>builtin</value> + <value>lkcf</value> + </enum> + </crypto> + <interface supported='yes'> + <enum name='backendType'> + <value>default</value> + <value>passt</value> + </enum> + </interface> + <panic supported='yes'> + <enum name='model'> + <value>s390</value> + </enum> + </panic> + <console supported='yes'> + <enum name='type'> + <value>null</value> + <value>vc</value> + <value>pty</value> + <value>dev</value> + <value>file</value> + <value>pipe</value> + <value>stdio</value> + <value>udp</value> + <value>tcp</value> + <value>unix</value> + <value>qemu-vdagent</value> + <value>dbus</value> + </enum> + </console> + </devices> + <features> + <gic supported='no'/> + <vmcoreinfo supported='no'/> + <genid supported='no'/> + <backingStoreInput supported='yes'/> + <backup supported='yes'/> + <async-teardown supported='yes'/> + <s390-pv supported='yes'/> + <ps2 supported='no'/> + <tdx supported='no'/> + <sev supported='no'/> + <sgx supported='no'/> + <launchSecurity supported='yes'> + <enum name='sectype'> + <value>s390-pv</value> + </enum> + </launchSecurity> + </features> +</domainCapabilities> diff --git a/tests/qemucapabilitiesdata/caps_10.1.0_s390x.replies b/tests/qemucapabilitiesdata/caps_10.1.0_s390x.replies new file mode 100644 index 0000000000..f693bca7b1 --- /dev/null +++ b/tests/qemucapabilitiesdata/caps_10.1.0_s390x.replies @@ -0,0 +1,39228 @@ [...snipped...] diff --git a/tests/qemucapabilitiesdata/caps_10.1.0_s390x.xml b/tests/qemucapabilitiesdata/caps_10.1.0_s390x.xml new file mode 100644 index 0000000000..8d59566cc0 --- /dev/null +++ b/tests/qemucapabilitiesdata/caps_10.1.0_s390x.xml @@ -0,0 +1,4244 @@ [...snipped...] diff --git a/tests/qemuxmlconfdata/cpu-model-deprecated-features-none.s390x-latest.args b/tests/qemuxmlconfdata/cpu-model-deprecated-features-none.s390x-latest.args index ba6e7c5304..2305f6b194 100644 --- a/tests/qemuxmlconfdata/cpu-model-deprecated-features-none.s390x-latest.args +++ b/tests/qemuxmlconfdata/cpu-model-deprecated-features-none.s390x-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ -machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram \ -accel kvm \ --cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=off,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on \ +-cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on,csske=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-latest.args b/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-latest.args index ba6e7c5304..2305f6b194 100644 --- a/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-latest.args +++ b/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ -machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram \ -accel kvm \ --cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=off,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on \ +-cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on,csske=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/cpu-model-deprecated-features-on.s390x-latest.args b/tests/qemuxmlconfdata/cpu-model-deprecated-features-on.s390x-latest.args index 8cdb2a2ac2..e0d433e77e 100644 --- a/tests/qemuxmlconfdata/cpu-model-deprecated-features-on.s390x-latest.args +++ b/tests/qemuxmlconfdata/cpu-model-deprecated-features-on.s390x-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ -machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram \ -accel kvm \ --cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=on,ais=on,bpb=on,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=on,cmm=on,vxpdeh2=on \ +-cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=on,ais=on,bpb=on,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=on,cmm=on,vxpdeh2=on \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/default-video-type-s390x.s390x-latest.args b/tests/qemuxmlconfdata/default-video-type-s390x.s390x-latest.args index ff71f5b872..f8b4538815 100644 --- a/tests/qemuxmlconfdata/default-video-type-s390x.s390x-latest.args +++ b/tests/qemuxmlconfdata/default-video-type-s390x.s390x-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-default-video-type-s/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-default-video-type-s/master-key.aes"}' \ -machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram \ -accel kvm \ --cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=off,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on \ +-cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on,csske=off \ -m size=1048576k \ -object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":1073741824}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/hostdev-vfio-zpci-ccw-memballoon.s390x-latest.args b/tests/qemuxmlconfdata/hostdev-vfio-zpci-ccw-memballoon.s390x-latest.args index 25c0ed2c9c..e8a95ec89e 100644 --- a/tests/qemuxmlconfdata/hostdev-vfio-zpci-ccw-memballoon.s390x-latest.args +++ b/tests/qemuxmlconfdata/hostdev-vfio-zpci-ccw-memballoon.s390x-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-KVMGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-KVMGuest1/master-key.aes"}' \ -machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram \ -accel kvm \ --cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=off,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on \ +-cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on,csske=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/launch-security-s390-pv.s390x-latest.args b/tests/qemuxmlconfdata/launch-security-s390-pv.s390x-latest.args index 4c80d0bf39..9786e0a574 100644 --- a/tests/qemuxmlconfdata/launch-security-s390-pv.s390x-latest.args +++ b/tests/qemuxmlconfdata/launch-security-s390-pv.s390x-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \ -machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram,confidential-guest-support=lsec0 \ -accel kvm \ --cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=off,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on \ +-cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on,csske=off \ -m size=219136k \ -object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":224395264}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-latest.args b/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-latest.args index 3f3de9a668..9fc3134702 100644 --- a/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-latest.args +++ b/tests/qemuxmlconfdata/s390-default-cpu-kvm-ccw-virtio-4.2.s390x-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-test/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-test/master-key.aes"}' \ -machine s390-ccw-virtio-4.2,usb=off,dump-guest-core=off,memory-backend=s390.ram \ -accel kvm \ --cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=off,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on \ +-cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on,csske=off \ -m size=262144k \ -object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":268435456}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/s390-defaultconsole.s390x-latest.args b/tests/qemuxmlconfdata/s390-defaultconsole.s390x-latest.args index 3efa883d8c..1dceeb59d4 100644 --- a/tests/qemuxmlconfdata/s390-defaultconsole.s390x-latest.args +++ b/tests/qemuxmlconfdata/s390-defaultconsole.s390x-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-test/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-test/master-key.aes"}' \ -machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram \ -accel kvm \ --cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=off,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on \ +-cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on,csske=off \ -m size=262144k \ -object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":268435456}' \ -overcommit mem-lock=off \ diff --git a/tests/qemuxmlconfdata/s390-panic.s390x-latest.args b/tests/qemuxmlconfdata/s390-panic.s390x-latest.args index 8afd5de0f6..bd79ab1ee3 100644 --- a/tests/qemuxmlconfdata/s390-panic.s390x-latest.args +++ b/tests/qemuxmlconfdata/s390-panic.s390x-latest.args @@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-test/.config \ -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-test/master-key.aes"}' \ -machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram \ -accel kvm \ --cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=off,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on \ +-cpu gen17a-base,nnpa=on,aen=on,gen17ptff=on,ccf=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,msa13_pckmo=on,msa11_pckmo=on,msa10_pckmo=on,sthyi=on,edat=on,ri=on,deflate=on,msa13=on,msa11=on,msa10=on,edat2=on,vxpdeh3=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh3=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,ineff_nc_tx=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on,csske=off \ -m size=262144k \ -object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":268435456}' \ -overcommit mem-lock=off \ -- 2.51.0

2 1

[PATCH] qemu_domain: Allow the builtin IDE to be used on r2d
by socksinspace 12 Dec '25

12 Dec '25

The r2d machine uses IDE for storage (a CF Card on the real hardware) Signed-off-by: socksinspace <socksinspace(a)mailbox.org> --- Tested to build, pass tests and run as expected when applied on top of 11.10.0 as packaged in Alpine Linux src/qemu/qemu_domain.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index ac56fc7cb4..f6d4e4c3ec 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -7696,7 +7696,8 @@ qemuDomainMachineHasBuiltinIDE(const char *machine, return qemuDomainMachineIsI440FX(machine, arch) || STREQ(machine, "malta") || STREQ(machine, "sun4u") || - STREQ(machine, "g3beige"); + STREQ(machine, "g3beige") || + STREQ(machine, "r2d"); } -- 2.52.0

1 0

[PATCH] virfiletest: Fix build on non-Linux
by Jiri Denemark 10 Dec '25

10 Dec '25

From: Jiri Denemark <jdenemar(a)redhat.com> Fixes: 121d179e068b584f62ea2c029d89a44e67c909c0 Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- tests/virfiletest.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/virfiletest.c b/tests/virfiletest.c index ccd76a3fac..3f179a3f74 100644 --- a/tests/virfiletest.c +++ b/tests/virfiletest.c @@ -329,6 +329,7 @@ testFileIsSharedFSType(const void *opaque G_GNUC_UNUSED) } +#ifdef __linux__ static const char *shared_filesystems[] = { "/run/user/501/gvfs", "/nfs", @@ -338,6 +339,7 @@ static const char *shared_filesystems[] = { "/quobyte", NULL, }; +#endif static int testFileIsSharedFSOverride(const void *opaque G_GNUC_UNUSED) -- 2.52.0

1 0

[PATCH 0/4] util: Fix race when checking whether a path is on a shared FS
by Jiri Denemark 10 Dec '25

10 Dec '25

See 2/4 for details. Jiri Denemark (4): tests: Test virFileIsSharedFSOverride util: Fix race condition in virFileIsSharedFSType util: Fix race condition in virFileIsSharedFSOverride util: Rework virFileIsSharedFSOverride using virFileCheckParents src/util/virfile.c | 133 +++++++++++++++++++++++++++++--------------- tests/virfiletest.c | 69 +++++++++++++++++++++++ 2 files changed, 156 insertions(+), 46 deletions(-) -- 2.52.0

3 6

[PATCH 0/9] qemu: Fix few bugs in snapshot/save code (background snapshot saga part 1)
by Peter Krempa 09 Dec '25

09 Dec '25

While looking trhough the snapshot code I've noticed a few bugs: - memleak in cleanup code of migration to file (1/9) - wrong place where 'manual' external disk snapshot is taken (2/9) - bad interaction between 'manual' snapshot and the _QUIESCE flag (3/9) - constants for save image types not exposed (6/9) - use of wrong 'flags' in migration to file code (8/9) The series contains also few cleanups and improvements: - bash completion for save image type (7/9) - use of proper types for save image type (4,5/9) - avoid problems with 'flags' in qemuMigrationParamsForSave (9/9) Part 2 will focus on some code cleanups. Peter Krempa (9): qemuMigrationSrcToFile: Don't leak 'qemuFDPass' in cleanup path qemu: snapshot: Setup disks for manual snapshot only when the VM is actually paused qemuSnapshotPrepare: Prohibit 'manual' disk snapshot mode with VIR_DOMAIN_SNAPSHOT_CREATE_QUIESCE flag qemu: Use 'virQEMUSaveFormat' type everywhere except qemu_conf qemu: conf: Use proper type for (save|dump|snapshot)ImageFormat include: Create constants for save image format values virsh: Add completer for '--image-format' option of 'save' command qemuMigrationSrcToFile: Don't cross-contaminate 'flags' variable qemuMigrationParamsForSave: Don't take opaque 'flags' include/libvirt/libvirt-domain.h | 87 ++++++++++++++++++++++++++++++-- src/qemu/qemu_conf.c | 48 ++++++++++++------ src/qemu/qemu_conf.h | 7 +-- src/qemu/qemu_driver.c | 29 +++++++---- src/qemu/qemu_migration.c | 14 ++--- src/qemu/qemu_migration.h | 2 +- src/qemu/qemu_migration_params.c | 4 +- src/qemu/qemu_migration_params.h | 2 +- src/qemu/qemu_saveimage.c | 22 ++++---- src/qemu/qemu_saveimage.h | 24 ++------- src/qemu/qemu_saveimage_format.h | 25 +++++++++ src/qemu/qemu_snapshot.c | 14 +++-- tools/virsh-domain.c | 21 ++++++++ 13 files changed, 224 insertions(+), 75 deletions(-) create mode 100644 src/qemu/qemu_saveimage_format.h -- 2.52.0

2 10

[PATCH 0/2] qemu: Treat memory device source nodemask as strict NUMA policy
by Michal Privoznik 08 Dec '25

08 Dec '25

*** BLURB HERE *** Michal Prívozník (2): qemuxmlconftest: Introduce memory-hotplug-numa-preferred test case qemu: Treat memory device source nodemask as strict NUMA policy src/qemu/qemu_command.c | 6 ++ ...-hotplug-numa-preferred.x86_64-latest.args | 44 ++++++++++++ ...y-hotplug-numa-preferred.x86_64-latest.xml | 1 + .../memory-hotplug-numa-preferred.xml | 68 +++++++++++++++++++ tests/qemuxmlconftest.c | 1 + 5 files changed, 120 insertions(+) create mode 100644 tests/qemuxmlconfdata/memory-hotplug-numa-preferred.x86_64-latest.args create mode 120000 tests/qemuxmlconfdata/memory-hotplug-numa-preferred.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/memory-hotplug-numa-preferred.xml -- 2.51.2

2 3

[PATCH] qemu: tpm: Account for possible migration without actually sharing storage
by Peter Krempa 08 Dec '25

08 Dec '25

From: Peter Krempa <pkrempa(a)redhat.com> The current logic in 'qemuTPMEmulatorBuildCommand' skips all setup if the *location* of the data is on what we'd consider shared storage. This means that if the location is not actually shared (e.g. it's shared betweeh some other hosts than the two doing the migration) and the path wasn't ever used (e.g. by migrating out) from the host where we're migrating into the complete setup of the location would be skipped even when it doesn't exist. Fix the logic by skipping only some of the setup steps so that 'qemuTPMEmulatorCreateStorage' can still create the storage if it doesn't exist. The rest of the code then needs to take the 'created' flag returned from 'qemuTPMEmulatorCreateStorage' into account. Fixes: 68103e9daf633b789428fedef56f816c92f6ee75 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_tpm.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index 4c9445d72c..1ce6390fd5 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -158,6 +158,7 @@ qemuTPMEmulatorGetPid(const char *swtpmStateDir, /** * qemuTPMEmulatorCreateStorage: * @tpm: TPM definition for an emulator type + * @sharedStorageMigration: VM is being migrated with possibly shared storage * @created: a pointer to a bool that will be set to true if the * storage was created because it did not exist yet * @swtpm_user: The uid that needs to be able to access the directory @@ -169,6 +170,7 @@ qemuTPMEmulatorGetPid(const char *swtpmStateDir, */ static int qemuTPMEmulatorCreateStorage(virDomainTPMDef *tpm, + bool sharedStorageMigration, bool *created, uid_t swtpm_user, gid_t swtpm_group) @@ -187,8 +189,14 @@ qemuTPMEmulatorCreateStorage(virDomainTPMDef *tpm, *created = false; if (!virFileExists(source_path) || - virDirIsEmpty(source_path, true) > 0) + virDirIsEmpty(source_path, true) > 0) { *created = true; + } else { + /* If the location exists and is shared, we don't need to create it + * during migration */ + if (sharedStorageMigration) + return 0; + } if (virDirCreate(source_path, 0700, swtpm_user, swtpm_group, VIR_DIR_CREATE_ALLOW_EXIST) < 0) { @@ -809,16 +817,13 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm, run_setup = true; } - /* Do not create storage and run swtpm_setup on incoming migration over - * shared storage - */ on_shared_storage = virFileIsSharedFS(tpm->data.emulator.source_path, cfg->sharedFilesystems) == 1; - if (incomingMigration && on_shared_storage) - create_storage = false; if (create_storage) { - if (qemuTPMEmulatorCreateStorage(tpm, &created, + if (qemuTPMEmulatorCreateStorage(tpm, + incomingMigration && on_shared_storage, + &created, cfg->swtpm_user, cfg->swtpm_group) < 0) return NULL; run_setup = created; @@ -885,6 +890,9 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm, /* If swtpm supports it and the TPM state is stored on shared storage, * start swtpm with --migration release-lock-outgoing so it can migrate * across shared storage if needed. + * + * Note that if 'created' is true, the location didn't exist so the storage + * is not actually shared. */ QEMU_DOMAIN_TPM_PRIVATE(tpm)->swtpm.can_migrate_shared_storage = false; if (on_shared_storage && @@ -892,13 +900,13 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm, virCommandAddArg(cmd, "--migration"); virCommandAddArgFormat(cmd, "release-lock-outgoing%s", - incomingMigration ? ",incoming": ""); + incomingMigration && !created ? ",incoming": ""); QEMU_DOMAIN_TPM_PRIVATE(tpm)->swtpm.can_migrate_shared_storage = true; } else { /* Report an error if there's an incoming migration across shared * storage and swtpm does not support the --migration option. */ - if (incomingMigration && on_shared_storage) { + if (incomingMigration && on_shared_storage && !created) { virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, _("%1$s (on destination side) does not support the --migration option needed for migration with shared storage"), swtpm); -- 2.52.0

2 3

[PATCH v2] NEWS: Mention the passt hostname and fqdn attributes
by Han Han 08 Dec '25

08 Dec '25

Signed-off-by: Han Han <hhan(a)redhat.com> --- V1: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/NT3X… NEWS.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 01efe82c97..28641ec1a1 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -217,6 +217,11 @@ v11.8.0 (2025-10-01) On the XML side, the existing ``<acpi>`` element has been extended with a ``nodeset`` attribute to specify the NUMA node affinity of a PCI device. + * qemu: Add support for hostname and FQDN configration of passt backend + + The attributes ``hostname`` and ``fqdn`` for passt backend configure + the guest interface with hostname and FQDN. + * **Improvements** * ch: Events emitting -- 2.52.0

2 1

[PATCH 0/1] qemu: Use pci_bus to identify multi-smmuv3 model
by Nathan Chen 05 Dec '25

05 Dec '25

The previous qemu virt-machine smmuv3 model and the new arm-smmuv3 model cannot both be specified at the same time. When launching a Libvirt VM with a single arm-smmuv3 model denoted by the <pciBus> attribute, qemuBuildMachineCommandLine() still appends the iommu=smmuv3 -machine parameter in addition to the arm-smmuv3 model passed to -device, preventing the VM from booting. Use the presence of a non-negative pci_bus to identify the multi-smmuv3 IOMMU model, instead of the niommus attribute. This allows for specifying a single arm-smmuv3 on the qemu command line, instead of both the virt-machine smmuv3 and arm-smmuv3 being specified at the same time. This patch is available on Github [0]. [0] https://github.com/NathanChenNVIDIA/libvirt/commits/single-smmuv3-12-25/ Signed-off-by: Nathan Chen <nathanc(a)nvidia.com> Nathan Chen (1): qemu: Use pci_bus to identify multi-smmuv3 model src/qemu/qemu_command.c | 2 +- src/qemu/qemu_postparse.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) -- 2.43.0

2 5

[PULL 14/14] aspeed: Deprecate the fby35 machine
by Alex Bennée 05 Dec '25

05 Dec '25

From: Cédric Le Goater <clg(a)redhat.com> There are no functional tests for the 'fby35' machine which makes harder to determine when something becomes deprecated or unused. The 'fby35' machine was originally added as an example of a multi-SoC system, with the expectation the models would evolve over time in an heterogeneous system. This hasn't happened and no public firmware is available to boot it. It can be replaced by the 'ast2700fc', another multi-SoC machine based on the newer AST2700 SoCs which are excepted to receive better support in the future. Cc: Peter Delevoryas <peter(a)pjd.dev> Signed-off-by: Cédric Le Goater <clg(a)redhat.com> Message-ID: <20251126102424.927527-1-clg(a)redhat.com> Signed-off-by: Alex Bennée <alex.bennee(a)linaro.org> diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 9386cffba26..ac31a2bce42 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -308,13 +308,24 @@ I2C devices connected to the board can be defined via the QEMU command line. Arm ``fp5280g2-bmc`` machine (since 10.2) -''''''''''''''''''''''''''''''''''''''''''' +''''''''''''''''''''''''''''''''''''''''' The ``fp5280g2-bmc`` machine does not rely on any specific device models, it can be replaced by the ``ast2500-evb`` machine using the ``fmc-model`` option to specify the flash type. The I2C devices connected to the board can be defined via the QEMU command line. +Arm ``fby35`` machine (since 10.2) +'''''''''''''''''''''''''''''''''' + +The ``fby35`` machine was originally added as an example of a +multi-SoC system, with the expectation the models would evolve over +time in an heterogeneous system. This hasn't happened and no public +firmware is available to boot it. It can be replaced by the +``ast2700fc``, another multi-SoC machine based on the newer AST2700 +SoCs which are excepted to receive better support in the future. + + RISC-V default machine option (since 10.0) '''''''''''''''''''''''''''''''''''''''''' diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c index 70d3a99d79e..e61a6438fef 100644 --- a/hw/arm/fby35.c +++ b/hw/arm/fby35.c @@ -175,6 +175,7 @@ static void fby35_class_init(ObjectClass *oc, const void *data) MachineClass *mc = MACHINE_CLASS(oc); mc->desc = "Meta Platforms fby35"; + mc->deprecation_reason = "For a multi-soc machine, use 'ast2700fc' instead"; mc->init = fby35_init; mc->no_floppy = 1; mc->no_cdrom = 1; -- 2.47.3

1 0

[PATCH] ci: refresh with 'lcitool manifest'
by Michal Privoznik 03 Dec '25

03 Dec '25

From: Michal Privoznik <mprivozn(a)redhat.com> Update FreeBSD to their new minor versions. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Green pipeline (although it doesn't show cirrus jobs): https://gitlab.com/MichalPrivoznik/libvirt/-/pipelines/2194225996 There is also FreeBSD 15.0 which was released yesterday. But there are some issues with its availability in cirrus [1] so I'm not updating the majo version, for now. 1: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291354 ci/gitlab/builds.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ci/gitlab/builds.yml b/ci/gitlab/builds.yml index a98b0d9c46..fe1468ff81 100644 --- a/ci/gitlab/builds.yml +++ b/ci/gitlab/builds.yml @@ -515,7 +515,7 @@ x86_64-freebsd-13: allow_failure: exit_codes: 3 variables: - CIRRUS_VM_IMAGE_NAME: freebsd-13-4 + CIRRUS_VM_IMAGE_NAME: freebsd-13-5 CIRRUS_VM_IMAGE_SELECTOR: image_family CIRRUS_VM_INSTANCE_TYPE: freebsd_instance INSTALL_COMMAND: pkg install -y @@ -530,7 +530,7 @@ x86_64-freebsd-14: allow_failure: exit_codes: 3 variables: - CIRRUS_VM_IMAGE_NAME: freebsd-14-2 + CIRRUS_VM_IMAGE_NAME: freebsd-14-3 CIRRUS_VM_IMAGE_SELECTOR: image_family CIRRUS_VM_INSTANCE_TYPE: freebsd_instance INSTALL_COMMAND: pkg install -y -- 2.51.2

2 1

[PATCH] NEWS: Mention the passt hostname and fqdn attributes
by Han Han 03 Dec '25

03 Dec '25

Signed-off-by: Han Han <hhan(a)redhat.com> --- NEWS.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 91ed53ba7e..1b2b8778b1 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -205,6 +205,12 @@ v11.8.0 (2025-10-01) On the XML side, the existing ``<acpi>`` element has been extended with a ``nodeset`` attribute to specify the NUMA node affinity of a PCI device. + * qemu: Add support for hostname and FQDN configration of passt backend + + Implement passt ``--hostname`` and ``--hostname`` options to libvirt via the + interface attributes ``hostname`` and ``fqdn`` of passt backend. They configure + the guest interface with hostname and FQDN. + * **Improvements** * ch: Events emitting -- 2.52.0

2 2

[RFC v3 0/5] cover: RFE libvirt secret encryption on disk
by Arun Menon 02 Dec '25

02 Dec '25

Libvirt secrets are stored unencrypted on the disk. With this series we want to start encrypting the secrets. 1. Introduce the GnuTLS decryption wrapper functions that work exact opposite to the encryption wrappers. 2. Add a new service called virt-secrets-init-encryption, that is linked to the virtsecretd service. virtsecretd service only starts after the new service generates a random encryption key. 3. Add a new secrets.conf configuration file that helps user to set a. secrets_encryption_key - allows the user to specify the encryption key file path, in case the default key is not to be used. b. encrypt_data - set to 0 or 1. If set to 1, then the newly added secrets will be encrypted. 4. Add encryption scheme or cipher attribute that will allow us to choose the last used cipher. 5. Once we have the encryption key, and a reliable way to tell the daemon what encryption scheme the secret object is using, we can encrypt the secrets on disk and store them in <uuid>.<encryption_scheme> format. It is important to note that if the encryption key is changed between restarts, then the respective secret will not be loaded by the driver. This is a sincere attempt to improve upon the already submitted patch https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/KE6G… Resolves: https://issues.redhat.com/browse/RHEL-7125 --- Changes in v3: - Secrets xml configuration no longer stores the encryption scheme, therefore not allowing the user to toggle between ciphers. - Removed unnecessary socket files of the new service. It now has a general configuration with which it starts. - Addressed review comments from Peter on coding style and design. - Loading of secrets is dependent on the file extension. Most recent cipher is used while saving the secrets. Changes in v2: - Corrected the encryption key length check. It should be 32. - Added a new patch that introduces the encryption scheme attribute. This will help us identify which secrets are encrypted. - A new systemd unit service file added that starts before virtsecretd, helping us to construct a random encryption key and pass it to the virtsecretd service. - Parsing logic of secrets.conf moved to a separate file. - Spec file changes, augeas. Arun Menon (5): util: Add support for GnuTLS decryption secret: Set up default encryption secret key for the virtsecretd service secret: Add secrets.conf configuration file and parse it secret: Add encryptionSchemeType attribute to store ciphers secret: Add functionality to load and save secrets in encrypted format include/libvirt/libvirt-secret.h | 20 +++ libvirt.spec.in | 7 + po/POTFILES | 1 + src/conf/meson.build | 1 + src/conf/secret_conf.h | 1 + src/conf/secret_config.c | 177 ++++++++++++++++++++++++ src/conf/secret_config.h | 38 +++++ src/conf/virsecretobj.c | 177 ++++++++++++++++++------ src/conf/virsecretobj.h | 13 +- src/libvirt_private.syms | 3 + src/meson.build | 1 + src/secret/libvirt_secrets.aug | 40 ++++++ src/secret/meson.build | 42 ++++++ src/secret/secret-init-encryption.in | 10 ++ src/secret/secret_driver.c | 27 +++- src/secret/secrets.conf.in | 12 ++ src/secret/test_libvirt_secrets.aug.in | 6 + src/secret/virtsecretd.service.extra.in | 8 ++ src/util/vircrypto.c | 126 ++++++++++++++++- src/util/vircrypto.h | 8 ++ src/util/virsecret.c | 4 + src/util/virsecret.h | 1 + tests/vircryptotest.c | 65 +++++++++ 23 files changed, 735 insertions(+), 53 deletions(-) create mode 100644 src/conf/secret_config.c create mode 100644 src/conf/secret_config.h create mode 100644 src/secret/libvirt_secrets.aug create mode 100644 src/secret/secret-init-encryption.in create mode 100644 src/secret/secrets.conf.in create mode 100644 src/secret/test_libvirt_secrets.aug.in -- 2.51.1

3 21

[PATCH 0/8] Avoid changing const string via strchr() and friends
by Michal Privoznik 02 Dec '25

02 Dec '25

This stems from the discussion here: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/HVMC… Green pipeline here: https://gitlab.com/MichalPrivoznik/libvirt/-/pipelines/2183169334 Michal Prívozník (8): vircommand: Update documentation to virCommandSetDryRun() virstringtest: Introduce a test for virSkipSpacesBackwards() virfirewalltest: Introduce testIPtablesSetupPrivateChains() virSkipSpacesBackwards: Turn @endp into const iptablesPrivateChainCreate: Rename @tmp variable iptablesPrivateChainCreate: Switch to STRSKIP() iptablesPrivateChainCreate: Avoid modifying const string lib: Avoid changing const strings via strchr() and friends src/interface/interface_backend_udev.c | 2 +- src/libxl/xen_common.c | 10 +- src/libxl/xen_xm.c | 10 +- src/network/meson.build | 1 + src/network/network_iptables.c | 33 ++++--- src/node_device/node_device_udev.c | 2 +- src/nwfilter/nwfilter_ebiptables_driver.c | 4 +- src/qemu/qemu_monitor_json.c | 2 +- src/qemu/qemu_nbdkit.c | 2 +- src/rpc/virnetsshsession.c | 5 +- src/storage/storage_util.c | 2 +- src/storage_file/storage_source.c | 4 +- src/util/vircgroup.c | 2 +- src/util/vircommand.c | 10 +- src/util/virfile.c | 2 +- src/util/virstoragefile.c | 4 +- src/util/virstring.c | 20 ++-- src/util/virstring.h | 2 +- src/util/virsysinfo.c | 22 ++--- src/util/virxml.c | 3 +- src/vmware/vmware_conf.c | 2 +- tests/meson.build | 9 +- tests/virfirewalltest.c | 111 ++++++++++++++++++++++ tests/virstringtest.c | 48 ++++++++++ tools/vsh.c | 6 +- 25 files changed, 252 insertions(+), 66 deletions(-) -- 2.51.2

3 11

[RFC PATCH v3 0/4] qemu: Implement support for EGM
by Nathan Chen 01 Dec '25

01 Dec '25

The Grace SOC introduces Extended GPU Memory (EGM) [3], a feature that enables GPUs to efficiently access system memory within and across nodes. This patch series adds support for virtualizing EGM (vEGM) in libvirt, allowing VMs to utilize dedicated EGM memory regions through ACPI. This patch series is a follow-up RFC to the second EGM RFC series [0], to gather feedback from the libvirt community on the overall approach and implementation details. While kernel EGM driver support and QEMU acpi-egm-memory device support are not yet upstream, reference implementations are available [1][2] to enable testing and validation of the libvirt integration. Any community feedback is appreciated. Background and Use Cases ========================= EGM allows host memory to be partitioned into two regions: 1. Standard memory for Host OS usage 2. EGM region assigned to VMs as their system memory This technology enables various high-performance computing scenarios [3]: - Large memory pools for AI/ML workloads - High-performance computing applications - Memory extension for systems with limited main memory - GPU-accelerated workloads requiring large addressable memory Implementation Overview ======================= This series adds a new memory device model VIR_DOMAIN_MEMORY_MODEL_EGM with 'path' source attribute and 'pciDev' target attribute to denote host EGM device backing path and PCI device alias to associate the vEGM with, respectively. For instance, given the XML stanzas below: <memory model='egm' access='shared'> <source> <path>/dev/egm4</path> </source> <target> <size unit='KiB'>8388608</size> <node>0</node> <pciDev>ua-hostdev0</pciDev> </target> </memory> <memory model='egm' access='shared'> <source> <path>/dev/egm5</path> </source> <target> <size unit='KiB'>8388608</size> <node>1</node> <pciDev>ua-hostdev1</pciDev> </target> </memory> The corresponding qemu command line will include the following arguments: -object '{"qom-type":"memory-backend-file","id":"memegm0","mem-path":"/dev/egm4","share":true,"prealloc":true,"size":8589934592}' \ -object acpi-egm-memory,id=egm0,pci-dev=ua-hostdev0,node=0 \ -object '{"qom-type":"memory-backend-file","id":"memegm1","mem-path":"/dev/egm5","share":true,"prealloc":true,"size":8589934592}' \ -object acpi-egm-memory,id=egm1,pci-dev=ua-hostdev1,node=1 \ -numa node,nodeid=0,cpus=0-1,memdev=memegm4 \ -numa node,nodeid=1,cpus=2-3,memdev=memegm5 \ For a system where multiple GPUs are associated with a single host socket/NUMA node/EGM chardev, we consolidate the memory backing into a single memory-backend-file object per host EGM chardev. For instance, given the XML stanzas below: <memory model='egm' access='shared'> <source> <path>/dev/egm4</path> </source> <target> <size unit='KiB'>8388608</size> <node>0</node> <pciDev>ua-hostdev0</pciDev> </target> </memory> <memory model='egm' access='shared'> <source> <path>/dev/egm4</path> </source> <target> <size unit='KiB'>8388608</size> <node>0</node> <pciDev>ua-hostdev1</pciDev> </target> </memory> The corresponding qemu command line will include the following arguments: -object '{"qom-type":"memory-backend-file","id":"memegm0","mem-path":"/dev/egm4","share":true,"prealloc":true,"size":17179869184}' \ -object acpi-egm-memory,id=egm0,pci-dev=ua-hostdev0,node=0 \ -object acpi-egm-memory,id=egm1,pci-dev=ua-hostdev1,node=0 \ -numa node,nodeid=0,cpus=0-4,memdev=memegm0 \ Changes from RFCv2: - Decouple host EGM chardev name from guest EGM ID - Consolidate all acpi-egm-memory objects' memory into a single memory-backend-file per EGM chardev specified. Changes from RFCv1: - Use existing memory device infrastructure to represent EGM configuration - Added support for multiple EGM devices This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/egm-11-24-25 Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/6RU7… [1] https://github.com/ianm-nv/qemu/tree/6.8_ghvirt_egm_may2025 [2] https://github.com/NVIDIA/QEMU/commit/32db1b74fb99c0571724c7e69485e89098c14… [3] https://developer.nvidia.com/blog/nvidia-grace-hopper-superchip-architectur… Ian May (1): tests: Add qemuxmlconftest for ACPI EGM memory device Nathan Chen (3): conf: Support EGM memory device model qemu: Add cgroup, namespace, and seclabel setup for EGM memory device model qemu: Add qemu CLI support for EGM docs/formatdomain.rst | 18 +- src/conf/domain_conf.c | 34 +++- src/conf/domain_conf.h | 7 + src/conf/domain_postparse.c | 6 +- src/conf/domain_validate.c | 15 ++ src/conf/schemas/domaincommon.rng | 6 + src/qemu/qemu_alias.c | 7 +- src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_cgroup.c | 10 ++ src/qemu/qemu_command.c | 158 ++++++++++++++++-- src/qemu/qemu_domain.c | 15 +- src/qemu/qemu_domain_address.c | 3 + src/qemu/qemu_driver.c | 1 + src/qemu/qemu_hotplug.c | 1 + src/qemu/qemu_monitor_json.c | 1 + src/qemu/qemu_namespace.c | 3 + src/qemu/qemu_postparse.c | 1 + src/qemu/qemu_process.c | 2 + src/qemu/qemu_validate.c | 6 + src/security/apparmor/usr.sbin.libvirtd.in | 3 + src/security/security_apparmor.c | 2 + src/security/security_dac.c | 8 + src/security/security_selinux.c | 6 + src/security/virt-aa-helper.c | 4 + src/util/virfile.h | 2 +- tests/meson.build | 1 + tests/qemuegmmock.c | 67 ++++++++ .../acpi-egm-memory.aarch64-latest.args | 47 ++++++ .../acpi-egm-memory.aarch64-latest.xml | 124 ++++++++++++++ tests/qemuxmlconfdata/acpi-egm-memory.xml | 124 ++++++++++++++ tests/qemuxmlconftest.c | 8 +- 32 files changed, 672 insertions(+), 21 deletions(-) create mode 100644 tests/qemuegmmock.c create mode 100644 tests/qemuxmlconfdata/acpi-egm-memory.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/acpi-egm-memory.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/acpi-egm-memory.xml -- 2.43.0

2 8

[PATCH 0/3] Fix VMX-* feature detection from MSR
by Hector Cao 01 Dec '25

01 Dec '25

Currently, libvirt is unable to detect the CPU model of recent Intel CPUs (like Granite Rapids) with VMX-* features specified in the MSRs (Model Specific Registers). This is due to the wrong parsing of these VMX-* features from the MSR values. This series of 3 commits allow to fix the MSR VMX-* feature detection. This has been tested successfully on a platform equipped with Intel Granite Rapids CPU. Hector Cao (3): cpu_map: fix sync script to extract correctly vmx-* features cpu_map: update vmx-* features cputest : fix test failures due to VMX-* feature update src/cpu_map/sync_qemu_features_i386.py | 19 +++ src/cpu_map/x86_features.xml | 136 +++++++++--------- .../x86_64-cpuid-Atom-P5362-2-enabled.xml | 10 +- .../x86_64-cpuid-Atom-P5362-enabled.xml | 10 +- .../x86_64-cpuid-Cooperlake-enabled.xml | 10 +- .../x86_64-cpuid-Core-i7-1270P-enabled.xml | 10 +- .../x86_64-cpuid-Core-i7-1365U-enabled.xml | 10 +- .../x86_64-cpuid-Core-i7-8550U-enabled.xml | 10 +- .../x86_64-cpuid-Xeon-6731E-enabled.xml | 10 +- .../x86_64-cpuid-Xeon-6788P-disabled.xml | 1 + .../x86_64-cpuid-Xeon-6788P-enabled.xml | 10 +- .../x86_64-cpuid-Xeon-6788P-guest.xml | 17 ++- .../x86_64-cpuid-Xeon-6788P-host.xml | 17 ++- ...x86_64-cpuid-Xeon-Bronze-3408U-enabled.xml | 10 +- .../x86_64-cpuid-Xeon-E3-1270-v5-enabled.xml | 10 +- .../x86_64-cpuid-Xeon-Gold-6152-enabled.xml | 10 +- .../x86_64-cpuid-Xeon-Gold-6530-enabled.xml | 10 +- ...86_64-cpuid-Xeon-Platinum-9242-enabled.xml | 10 +- ...x86_64-cpuid-Xeon-Silver-4214R-enabled.xml | 10 +- .../x86_64-cpuid-Xeon-w7-3465X-enabled.xml | 10 +- 20 files changed, 181 insertions(+), 159 deletions(-) -- 2.45.2

3 8

[PATCH] spec: Fix RPM build when %{fedora} is undefined
by Jiri Denemark 01 Dec '25

01 Dec '25

From: Jiri Denemark <jdenemar(a)redhat.com> Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- Pushed as trivial build breaker. libvirt.spec.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 8b3bc9884f..ccfe75135b 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -41,7 +41,7 @@ %define with_qemu 0%{!?_without_qemu:1} %else # QEMU drops 32-bit in Fedora 44 - %if %{?fedora} > 43 + %if 0%{?fedora} > 43 %define with_qemu 0 %else %define with_qemu 0%{!?_without_qemu:1} -- 2.51.1

1 0

Release of libvirt-11.10.0
by Jiri Denemark 01 Dec '25

01 Dec '25

The 11.10.0 release of both libvirt and libvirt-python is tagged and signed tarballs are available at https://download.libvirt.org/ https://download.libvirt.org/python/ Thanks everybody who helped with this release by sending patches, reviewing, testing, or providing feedback. Your work is greatly appreciated. * Security * CVE-2025-12748: Denial of service by some ACL-limited accounts Parsing of user provided XMLs in APIs which needed the identification information from those XML definitions was done in full before ACL checks were performed. Some valid, but useless, definitions could cause allocation of too much memory, leading to denial of service. APIs which do equate to full root access (such as ``domain:write``), and were parsing XML definitions in full before performing ACL checks could, potentially, be exploited in a way that would allow users (which were about to be denied the API call) to cause aforementioned overallocation even before the ACL checks were performed. A change was made so that parsing before ACL checks are done only for the identification parts of the XML definition (which is needed to perform the checks) and full parsing is done only after checking all ACLs. * CVE-2025-13193: Incorrect permissions on images after external snapshot of an inactive VM The overlay ``qcow2`` images which are created as part of creation of an external snapshot of an inactive VM had world-readable (644) permissions which would allow unauthorized users to see contents of blocks written by the VM after snapshot was taken. Libvirt now sets proper umask so that the images are created with 600 mode. * New features * Hyper-V virttype support for Qemu domains Libvirt now supports Hyper-V virttype while lauching QEMU domains. This feature requires Qemu version 10.2.0 or later and is available on Linux hosts where the /dev/mshv is present. * Add more statistics for block devices on QEMU domains The block devices now report optimal access request sizes as well as statistics such as the queue depth. * Improvements * bhyve: VNC ``wait`` attribute support Bhyve guests can now be configured to wait for a VNC connection before booting. * remote: multiple certificate support The remote daemon and client can be configured to load multiple x509 certificate identities. This facilitates a transition to certificates supporting Post-Quantum Crytographic algorithms. * tools: improved virt-host-validate output The virt-host-validate tool will now report extra details when certain checks pass. * qemu: Allow backup jobs to continue if guest OS shuts down When starting a backup job users can now use a flag which prevents the VM to be completely cleaned up if the guest OS shuts down while the backup is running so that the backup can be finalized. * Bug fixes * ch: Use correct domain definition in chDomainGetXMLDesc() Cloud-Hypervisor driver claims to support ``VIR_DOMAIN_XML_INACTIVE`` but in fact it never formatted the inactive XML. This is now fixed. * esx: Allow disk images in subdirectories If a domain has a disk image that's not in a datastore path but in a subdirectory, the ESX driver would have failed to parse that and an error was reported when obtaining domain XML. This is now fixed. * qemu: Fix incoming migration to QEMU 10.0.0 and newer Due to a change in the way QEMU 10.0.0 reports the state of "ht" CPU feature, incoming migration of a domain with multiple CPU threads would fail with "guest CPU doesn't match specification: extra features: ht" error. * qemu: fix incorrect reporting of the TDX launch security type The TDX launch security type was incorrectly reported on all platforms if the QEMU binary had it built-in. It is now limited to only platforms with the TDX kernel feature available for use. * qemu: set ``detect_zeroes`` for all backing chain layers Some block jobs (snapshots, block commit) could modify the backing chain in a way where ``detect_zeroes`` would no longer be honoured. We now set it for all images in the backing chain, so that it will behave correctly even after those operations. Enjoy. Jirka

1 0

[PATCH] NEWS: Mention CVE-2025-13193 and improvements for block stats/config and backups
by Peter Krempa 28 Nov '25

28 Nov '25

From: Peter Krempa <pkrempa(a)redhat.com> Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- NEWS.rst | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 879e9e8448..91ed53ba7e 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -29,6 +29,14 @@ v11.10.0 (unreleased) identification parts of the XML definition (which is needed to perform the checks) and full parsing is done only after checking all ACLs. + * CVE-2025-13193: Incorrect permissions on images after external snapshot of an inactive VM + + The overlay ``qcow2`` images which are created as part of creation of an + external snapshot of an inactive VM had world-readable (644) permissions + which would allow unauthorized users to see contents of blocks written by + the VM after snapshot was taken. Libvirt now sets proper umask so that + the images are created with 600 mode. + * **Removed features** * **New features** @@ -39,6 +47,11 @@ v11.10.0 (unreleased) feature requires Qemu version 10.2.0 or later and is available on Linux hosts where the /dev/mshv is present. + * Add more statistics for block devices on QEMU domains + + The block devices now report optimal access request sizes as well as + statistics such as the queue depth. + * **Improvements** * bhyve: VNC ``wait`` attribute support @@ -57,6 +70,12 @@ v11.10.0 (unreleased) The virt-host-validate tool will now report extra details when certain checks pass. + * qemu: Allow backup jobs to continue if guest OS shuts down + + When starting a backup job users can now use a flag which prevents the VM + to be completely cleaned up if the guest OS shuts down while the backup is + running so that the backup can be finalized. + * **Bug fixes** * ch: Use correct domain definition in chDomainGetXMLDesc() @@ -83,6 +102,13 @@ v11.10.0 (unreleased) if the QEMU binary had it built-in. It is now limited to only platforms with the TDX kernel feature available for use. + * qemu: set ``detect_zeroes`` for all backing chain layers + + Some block jobs (snapshots, block commit) could modify the backing chain in + a way where ``detect_zeroes`` would no longer be honoured. We now set + it for all images in the backing chain, so that it will behave correctly + even after those operations. + v11.9.0 (2025-11-03) ==================== -- 2.52.0

2 1

[PATCH] formatdomaincaps: Fix typo in Hyper-V Enlightenments section
by Jiri Denemark 28 Nov '25

28 Nov '25

From: Jiri Denemark <jdenemar(a)redhat.com> Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- docs/formatdomaincaps.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/formatdomaincaps.rst b/docs/formatdomaincaps.rst index 32dc09d41e..8b4f0ecff3 100644 --- a/docs/formatdomaincaps.rst +++ b/docs/formatdomaincaps.rst @@ -871,7 +871,7 @@ are supported. The ``features`` enum corresponds to the ``<hyperv/>`` element (well, its children) as documented in `Hypervisor features <formatdomain.html#hypervisor-features>`__. The ``defaults`` element then contains child elements describing default values as reported by hypervisor, -e.h. whether direct or extended TLB flushes are available. :since:`(since +e.g. whether direct or extended TLB flushes are available. :since:`(since 11.9.0)` Launch security -- 2.51.1

2 1

[PATCH] NEWS: Fix incoming migration to QEMU 10.0.0
by Jiri Denemark 28 Nov '25

28 Nov '25

From: Jiri Denemark <jdenemar(a)redhat.com> Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- NEWS.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index c742954091..d5028d230d 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -43,6 +43,13 @@ v11.10.0 (unreleased) subdirectory, the ESX driver would have failed to parse that and an error was reported when obtaining domain XML. This is now fixed. + * qemu: Fix incoming migration to QEMU 10.0.0 and newer + + Due to a change in the way QEMU 10.0.0 reports the state of "ht" CPU + feature, incoming migration of a domain with multiple CPU threads would + fail with "guest CPU doesn't match specification: extra features: ht" + error. + v11.9.0 (2025-11-03) ==================== -- 2.51.1

2 1

[PATCH] NEWS: Add CVE-2025-12748
by Martin Kletzander 28 Nov '25

28 Nov '25

From: Martin Kletzander <mkletzan(a)redhat.com> Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- NEWS.rst | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index c742954091df..8cc6e698ca25 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -13,6 +13,22 @@ v11.10.0 (unreleased) * **Security** + * CVE-2025-12748: Denial of service by some ACL-limited accounts + + Parsing of user provided XMLs in APIs which needed the identification + information from those XML definitions was done in full before ACL checks + were performed. Some valid, but useless, definitions could cause allocation + of too much memory, leading to denial of service. APIs which do equate to + full root access (such as ``domain:write``), and were parsing XML + definitions in full before performing ACL checks could, potentially, be + exploited in a way that would allow users (which were about to be denied the + API call) to cause aforementioned overallocation even before the ACL checks + were performed. + + A change was made so that parsing before ACL checks are done only for the + identification parts of the XML definition (which is needed to perform the + checks) and full parsing is done only after checking all ACLs. + * **Removed features** * **New features** -- 2.52.0

2 2

[PATCH] news: document improved certs, host validate details & TDX fix
by Daniel P. Berrangé 28 Nov '25

28 Nov '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- NEWS.rst | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 7c3a6c01e7..a41f53e00d 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -30,8 +30,25 @@ v11.10.0 (unreleased) Bhyve guests can now be configured to wait for a VNC connection before booting. + * remote: multiple certificate support + + The remote daemon and client can be configured to load multiple x509 + certificate identities. This facilitates a transition to certificates + supporting Post-Quantum Crytographic algorithms. + + * tools: improved virt-host-validate output + + The virt-host-validate tool will now report extra details when certain + checks pass. + * **Bug fixes** + * qemu: fix incorrect reporting of the TDX launch security type + + The TDX launch security type was incorrectly reported on all platforms + if the QEMU binary had it built-in. It is now limited to only platforms + with the TDX kernel feature available for use. + v11.9.0 (2025-11-03) ==================== -- 2.51.1

2 1

[PATCH] rpm: disable QEMU driver on non-64-bit arches for Fedora >= 44
by Daniel P. Berrangé 27 Nov '25

27 Nov '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 62af7fb517..8b3bc9884f 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -32,12 +32,22 @@ %define arches_ch x86_64 aarch64 # The hypervisor drivers that run in libvirtd -%define with_qemu 0%{!?_without_qemu:1} %define with_lxc 0%{!?_without_lxc:1} %define with_libxl 0%{!?_without_libxl:1} %define with_vbox 0%{!?_without_vbox:1} %define with_ch 0%{!?_without_ch:1} +%ifarch %{arches_64bit} + %define with_qemu 0%{!?_without_qemu:1} +%else + # QEMU drops 32-bit in Fedora 44 + %if %{?fedora} > 43 + %define with_qemu 0 + %else + %define with_qemu 0%{!?_without_qemu:1} + %endif +%endif + %ifarch %{arches_qemu_kvm} %define with_qemu_kvm %{with_qemu} %else -- 2.51.1

2 1

[PATCH] rpm: disable QEMU driver on non-64-bit arches for Fedora >= 44
by Daniel P. Berrangé 27 Nov '25

27 Nov '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt.spec.in | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 62af7fb517..8b3bc9884f 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -32,12 +32,22 @@ %define arches_ch x86_64 aarch64 # The hypervisor drivers that run in libvirtd -%define with_qemu 0%{!?_without_qemu:1} %define with_lxc 0%{!?_without_lxc:1} %define with_libxl 0%{!?_without_libxl:1} %define with_vbox 0%{!?_without_vbox:1} %define with_ch 0%{!?_without_ch:1} +%ifarch %{arches_64bit} + %define with_qemu 0%{!?_without_qemu:1} +%else + # QEMU drops 32-bit in Fedora 44 + %if %{?fedora} > 43 + %define with_qemu 0 + %else + %define with_qemu 0%{!?_without_qemu:1} + %endif +%endif + %ifarch %{arches_qemu_kvm} %define with_qemu_kvm %{with_qemu} %else -- 2.51.1

1 0

[PATCH] NEWS: Document features/improvements/bug fixes I've participated in
by Michal Privoznik 27 Nov '25

27 Nov '25

From: Michal Privoznik <mprivozn(a)redhat.com> There are some features/improvements/bug fixes I've either contributed or reviewed/merged. Document them for upcoming release. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- NEWS.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 7c3a6c01e7..4d9b98f93c 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -32,6 +32,17 @@ v11.10.0 (unreleased) * **Bug fixes** + * ch: Use correct domain definition in chDomainGetXMLDesc() + + Cloud-Hyper driver claims to support ``VIR_DOMAIN_XML_INACTIVE`` but in + fact it never formatted the inactive XML. This is now fixed. + + * esx: Allow disk images in subdirectories + + If a domain has a disk image that's not in a datastore path but in a + subdirectory, the ESX driver would have failed to parse that and an error + was reported when obtaining domain XML. This is now fixed. + v11.9.0 (2025-11-03) ==================== -- 2.51.2

2 1

Entering freeze for libvirt-11.10.0
by Jiri Denemark 27 Nov '25

27 Nov '25

I have just tagged v11.10.0-rc1 in the repository and pushed signed tarballs to https://download.libvirt.org/ Please give the release candidate some testing and in case you find a serious issue which should have a fix in the upcoming release, feel free to reply to this thread to make sure the issue is more visible. If you have not done so yet, please update NEWS.rst to document any significant change you made since the last release. Jirka

1 1

[PATCH] virCgroupSetValueRaw: Use 'const' temporary variable
by Peter Krempa 26 Nov '25

26 Nov '25

From: Peter Krempa <pkrempa(a)redhat.com> 'char *tmp' is assigned from calling 'strrchr' on a 'const char *'. New clang in fedora doesn't like it. Make 'tmp' const. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- https://gitlab.com/MichalPrivoznik/libvirt/-/jobs/12208300313 src/util/vircgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c index 532a7e5690..3d66d3acb2 100644 --- a/src/util/vircgroup.c +++ b/src/util/vircgroup.c @@ -517,7 +517,7 @@ int virCgroupSetValueRaw(const char *path, const char *value) { - char *tmp; + const char *tmp; VIR_DEBUG("Set path '%s' to value '%s'", path, value); if (virFileWriteStr(path, value, 0) < 0) { -- 2.52.0

4 10

[PATCH] docs/deprecated: Remove undeprecated SMP description
by Zhao Liu 25 Nov '25

25 Nov '25

"Unsupported 'parameter=1' SMP configuration" was proposed to be deprecated in the commit 54c4ea8f3ae6 ("hw/core/machine-smp: Deprecate unsupported "parameter=1" SMP configurations"). But the related code was reverted later in the commit 9d7950edb0cd ("hw/core: allow parameter=1 for SMP topology on any machine"). Thus, this SMP behavior is still valid and is not actually deprecated. Remove outdated document descriptions. Reported-by: Markus Armbruster <armbru(a)redhat.com> Signed-off-by: Zhao Liu <zhao1.liu(a)intel.com> --- docs/about/deprecated.rst | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 03e29915f0aa..bbfcce4a1ab3 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -54,20 +54,6 @@ as short-form boolean values, and passed to plugins as ``arg_name=on``. However, short-form booleans are deprecated and full explicit ``arg_name=on`` form is preferred. -``-smp`` (Unsupported "parameter=1" SMP configurations) (since 9.0) -''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' - -Specified CPU topology parameters must be supported by the machine. - -In the SMP configuration, users should provide the CPU topology parameters that -are supported by the target machine. - -However, historically it was allowed for users to specify the unsupported -topology parameter as "1", which is meaningless. So support for this kind of -configurations (e.g. -smp drawers=1,books=1,clusters=1 for x86 PC machine) is -marked deprecated since 9.0, users have to ensure that all the topology members -described with -smp are supported by the target machine. - QEMU Machine Protocol (QMP) commands ------------------------------------ -- 2.34.1

3 2

git tags for CVEs
by Peter Krempa 25 Nov '25

25 Nov '25

We've recently tagged a few patches fixing CVEs with signed git tags. We also in the past tagged patches fixing CVEs. I've identified a list of CVEs (including commit hashes) that weren't tagged yet. The list below was first compiled using this "simple one liner": git log | grep -o 'CVE-[0-9]\+-[0-9]\+\|^commit [0-9a-z]\+' | grep -B 1 'CVE-' | grep -v '^--' | tr "\n" " " | sed 's/commit/\ncommit/g' | grep -v "$(git tag ' | sed -e 's/|$//' -e 's/|/\\|/g')" > cves (Basically looking for 'CVE-' strings in the commit log and cross-referencing it with the list of tags (badly for that matter I halfway realized that I pasted in the sub-command supposed to find CVEs wrong but was too far in to re-try)) And then manually going trhough the list. I've identified the following commits: (single commits) commit 8dfb12cb77996519901b8d52c754ab564ebd10e8 CVE-2024-8235 commit 8074d64dc2eca846d6a61efe1a9b7428a0ce1dd1 CVE-2024-4418 commit 8a3f8d957507c1f8223fdcf25a3ff885b15557f2 CVE-2024-2494 commit c664015fe3a7bf59db26686e9ed69af011c6ebb8 CVE-2024-1441 commit 9a47442366fcf8a7b6d7422016d7bbb6764a1098 CVE-2023-3750 commit a4947e8f63c3e6b7b067b444f3d6cf674c0d7f36 CVE-2022-0897 commit 15073504dbb624d3f6c911e85557019d3620fdb2 CVE-2021-3631 commit 22494556542c676d1b9e7f1c1f2ea13ac17e1e3e CVE-2020-14339 commit bf6c2830b6c338b1f5699b095df36f374777b291 CVE-2019-10168 commit 8afa68bac0cf99d1f8aaa6566685c43c22622f26 CVE-2019-10167 commit db0b78457f183e4c7ac45bc94de86044a1e2056a CVE-2019-10166 commit aed6a032cead4386472afb24b16196579e239580 CVE-2019-10161 commit fbf31e1a4cd19d6f6e33e0937a009775cd7d9513 CVE-2018-1064 commit bc251ea91bcfddd2622fce6bce701a438b2e7276 CVE-2018-5748 commit 57023c0a3af4af1c547189c1f6712ed5edeb0c0b CVE-2014-8131 commit c567853089a2764c964002dd752e09e318524a38 CVE-2010-2242 commit 53611889ff93c442028828c70472151a7cf1bf4d CVE-2008-5086 (patchsets, where multiple patches bear CVE number, histrically we've tagged all of them with numbered tags) commit a63b48c5ecef077bf0f909a85f453a605600cf05 CVE-2020-25637 commit e4116eaa44cb366b59f7fe98f4b88d04c04970ad CVE-2020-25637 commit 50864dcda191eb35732dbd80fb6ca251a6bba923 CVE-2020-25637 commit 955029bd0ad7ef96000f529ac38204a8f4a96401 CVE-2020-25637 commit e37bd65f9948c1185456b2cdaa3bd6e875af680f CVE-2019-10132 commit f111e09468693909b1f067aa575efdafd9a262a1 CVE-2019-10132 commit 96f41cd765c9e525fe28ee5abbfbf4a79b3720c7 CVE-2019-10132 commit ae076bb40e0e150aef41361b64001138d04d6c60 CVE-2019-3886 commit 2a07c990bd9143d7a0fe8d1b6b7c763c52185240 CVE-2019-3886 commit c2dc6698c88fb591639e542c8ecb0076c54f3dfb CVE-2018-6764 commit 759b4d1b0fe5f4d84d98b99153dfa7ac289dd167 CVE-2018-6764 commit b347c0c2a321ec5c20aae214927949832a288c5a CVE-2015-0236 commit 03c3c0c874c84dfa51ef17556062b095c6e1c0a3 CVE-2015-0236 commit 5fc590ad9f4071350a8df4d567ba88baacc8334d CVE-2013-6456 commit 1cadeafcaa422844a27ef622e2a7041d0235bcb3 CVE-2013-6456 commit 1754c7f0ab1407dcf7c89636a35711dd9b1febe1 CVE-2013-6456 commit 7fba01c15c1f886b4235825692b4c13e88dd9f7b CVE-2013-6456 commit 4dd3a7d5bc44980135a1b11810ba9aeab42a4a59 CVE-2013-6456 commit aebbcdd33c8c18891f0bdbbf8924599a28152c9c CVE-2013-6456 And finally few manually synthetized entries based on CVE references. commit 447f69dec47e1b0bd15ecd7cd49a9fd3b050fb87 CVE-2021-3667 commit 68719c4bddb85fbcc931a5b7d99ac7c8a0af09b0 CVE-2010-2238 Thus if we want to keep tagging CVEs the above list ought to be tagged. I've also got a few work in progress patches/branches which will e.g. add a CI job to do (a more robust) cross-check of the CVE numbers with the commitlog and NEWS file, etc. In addition our commit log also references non-libvirt cves: CVE-2022-24765 - git permission issue when repo is shared between users CVE-2020-15708 - bug in Ubuntu's packaging of libvirt CVE-2013-0242 - memory corruption in gnulib's regex() CVE-2012-3386 - bug in automake's distcheck rules giving world-writable perms CVE-2011-4127 - qemu allowing SCSI/SG_IO command passthrough CPU vulnerabllities: CVE-2019-11135 - TSX Asynchronous Abort condition on some CPUs CVE-2018-12127, CVE-2018-12130, CVE-2019-11091 - Microarchitectural Store Buffer Data Sampling (MSBDS) cpu vulnerabilities CVE-2018-3639 - Speculative Store Bypass (SSB), Variant 4. CVE-2017-5715 - speculative execution by utilizing branch target injection

1 1

[PATCH v3] ci: refresh with 'lcitool manifest'
by Michal Privoznik 25 Nov '25

25 Nov '25

From: Michal Privoznik <mprivozn(a)redhat.com> - Add AlmaLinux 10 - Add CentOS Stream 10 - Add Fedora 43 - Remove EOL Fedora 41 - Switch mingw from Fedora 42 to Fedora 43 - Switch integration tests from Fedora 41 to Fedora 43 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- v3 of: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/XBR… diff to v2: - Keep rpms for centos 9 ci/buildenv/almalinux-10.sh | 93 ++++++++++++++++++ ci/buildenv/centos-stream-10.sh | 92 ++++++++++++++++++ ...-mingw32.sh => fedora-43-cross-mingw32.sh} | 0 ...-mingw64.sh => fedora-43-cross-mingw64.sh} | 0 ci/buildenv/{fedora-41.sh => fedora-43.sh} | 0 ci/containers/almalinux-10.Dockerfile | 96 +++++++++++++++++++ ci/containers/centos-stream-10.Dockerfile | 95 ++++++++++++++++++ ...ile => fedora-43-cross-mingw32.Dockerfile} | 2 +- ...ile => fedora-43-cross-mingw64.Dockerfile} | 2 +- ...ora-41.Dockerfile => fedora-43.Dockerfile} | 2 +- ci/gitlab/builds.yml | 87 ++++++++++++----- ci/gitlab/containers.yml | 36 ++++--- ci/integration.yml | 20 ++-- ci/manifest.yml | 37 +++++-- 14 files changed, 507 insertions(+), 55 deletions(-) create mode 100644 ci/buildenv/almalinux-10.sh create mode 100644 ci/buildenv/centos-stream-10.sh rename ci/buildenv/{fedora-42-cross-mingw32.sh => fedora-43-cross-mingw32.sh} (100%) rename ci/buildenv/{fedora-42-cross-mingw64.sh => fedora-43-cross-mingw64.sh} (100%) rename ci/buildenv/{fedora-41.sh => fedora-43.sh} (100%) create mode 100644 ci/containers/almalinux-10.Dockerfile create mode 100644 ci/containers/centos-stream-10.Dockerfile rename ci/containers/{fedora-42-cross-mingw32.Dockerfile => fedora-43-cross-mingw32.Dockerfile} (98%) rename ci/containers/{fedora-42-cross-mingw64.Dockerfile => fedora-43-cross-mingw64.Dockerfile} (98%) rename ci/containers/{fedora-41.Dockerfile => fedora-43.Dockerfile} (98%) diff --git a/ci/buildenv/almalinux-10.sh b/ci/buildenv/almalinux-10.sh new file mode 100644 index 0000000000..d69d0c4267 --- /dev/null +++ b/ci/buildenv/almalinux-10.sh @@ -0,0 +1,93 @@ +# THIS FILE WAS AUTO-GENERATED +# +# $ lcitool manifest ci/manifest.yml +# +# https://gitlab.com/libvirt/libvirt-ci + +function install_buildenv() { + dnf update -y + dnf install 'dnf-command(config-manager)' -y + dnf config-manager --set-enabled -y crb + dnf install -y epel-release + dnf install -y \ + audit-libs-devel \ + augeas \ + bash-completion \ + ca-certificates \ + ccache \ + clang \ + compiler-rt \ + cpp \ + cyrus-sasl-devel \ + device-mapper-devel \ + diffutils \ + dwarves \ + ebtables \ + firewalld-filesystem \ + fuse3-devel \ + gcc \ + gettext \ + git \ + glib2-devel \ + glibc-devel \ + glibc-langpack-en \ + gnutls-devel \ + grep \ + json-c-devel \ + libacl-devel \ + libattr-devel \ + libblkid-devel \ + libcap-ng-devel \ + libcurl-devel \ + libnbd-devel \ + libnl3-devel \ + libpcap-devel \ + libpciaccess-devel \ + librbd-devel \ + libselinux-devel \ + libssh-devel \ + libssh2-devel \ + libtirpc-devel \ + libwsman-devel \ + libxml2 \ + libxml2-devel \ + libxslt \ + make \ + meson \ + ninja-build \ + numactl-devel \ + parted-devel \ + perl-base \ + pkgconfig \ + python3 \ + python3-docutils \ + python3-pip \ + python3-pytest \ + python3-setuptools \ + python3-wheel \ + qemu-img \ + readline-devel \ + rpm-build \ + sanlock-devel \ + sed \ + systemd-devel \ + systemd-rpm-macros \ + systemtap-sdt-devel \ + systemtap-sdt-dtrace \ + wireshark-devel + rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED + rpm -qa | sort > /packages.txt + mkdir -p /usr/libexec/ccache-wrappers + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc + /usr/bin/pip3 install \ + black \ + flake8 +} + +export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers" +export LANG="en_US.UTF-8" +export MAKE="/usr/bin/make" +export NINJA="/usr/bin/ninja" +export PYTHON="/usr/bin/python3" diff --git a/ci/buildenv/centos-stream-10.sh b/ci/buildenv/centos-stream-10.sh new file mode 100644 index 0000000000..2747adfb38 --- /dev/null +++ b/ci/buildenv/centos-stream-10.sh @@ -0,0 +1,92 @@ +# THIS FILE WAS AUTO-GENERATED +# +# $ lcitool manifest ci/manifest.yml +# +# https://gitlab.com/libvirt/libvirt-ci + +function install_buildenv() { + dnf distro-sync -y + dnf install 'dnf-command(config-manager)' -y + dnf config-manager --set-enabled -y crb + dnf install -y epel-release + dnf install -y \ + audit-libs-devel \ + augeas \ + bash-completion \ + ca-certificates \ + ccache \ + clang \ + compiler-rt \ + cpp \ + cyrus-sasl-devel \ + device-mapper-devel \ + diffutils \ + dwarves \ + ebtables \ + firewalld-filesystem \ + fuse3-devel \ + gcc \ + gettext \ + git \ + glib2-devel \ + glibc-devel \ + glibc-langpack-en \ + gnutls-devel \ + grep \ + json-c-devel \ + libacl-devel \ + libattr-devel \ + libblkid-devel \ + libcap-ng-devel \ + libcurl-devel \ + libnbd-devel \ + libnl3-devel \ + libpcap-devel \ + libpciaccess-devel \ + librbd-devel \ + libselinux-devel \ + libssh-devel \ + libssh2-devel \ + libtirpc-devel \ + libwsman-devel \ + libxml2 \ + libxml2-devel \ + libxslt \ + make \ + meson \ + ninja-build \ + numactl-devel \ + parted-devel \ + perl-base \ + pkgconfig \ + python3 \ + python3-docutils \ + python3-pip \ + python3-pytest \ + python3-setuptools \ + python3-wheel \ + qemu-img \ + readline-devel \ + rpm-build \ + sanlock-devel \ + sed \ + systemd-devel \ + systemd-rpm-macros \ + systemtap-sdt-devel \ + wireshark-devel + rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED + rpm -qa | sort > /packages.txt + mkdir -p /usr/libexec/ccache-wrappers + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc + /usr/bin/pip3 install \ + black \ + flake8 +} + +export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers" +export LANG="en_US.UTF-8" +export MAKE="/usr/bin/make" +export NINJA="/usr/bin/ninja" +export PYTHON="/usr/bin/python3" diff --git a/ci/buildenv/fedora-42-cross-mingw32.sh b/ci/buildenv/fedora-43-cross-mingw32.sh similarity index 100% rename from ci/buildenv/fedora-42-cross-mingw32.sh rename to ci/buildenv/fedora-43-cross-mingw32.sh diff --git a/ci/buildenv/fedora-42-cross-mingw64.sh b/ci/buildenv/fedora-43-cross-mingw64.sh similarity index 100% rename from ci/buildenv/fedora-42-cross-mingw64.sh rename to ci/buildenv/fedora-43-cross-mingw64.sh diff --git a/ci/buildenv/fedora-41.sh b/ci/buildenv/fedora-43.sh similarity index 100% rename from ci/buildenv/fedora-41.sh rename to ci/buildenv/fedora-43.sh diff --git a/ci/containers/almalinux-10.Dockerfile b/ci/containers/almalinux-10.Dockerfile new file mode 100644 index 0000000000..815b4c0e68 --- /dev/null +++ b/ci/containers/almalinux-10.Dockerfile @@ -0,0 +1,96 @@ +# THIS FILE WAS AUTO-GENERATED +# +# $ lcitool manifest ci/manifest.yml +# +# https://gitlab.com/libvirt/libvirt-ci + +FROM docker.io/library/almalinux:10 + +RUN dnf update -y && \ + dnf install 'dnf-command(config-manager)' -y && \ + dnf config-manager --set-enabled -y crb && \ + dnf install -y epel-release && \ + dnf install -y \ + audit-libs-devel \ + augeas \ + bash-completion \ + ca-certificates \ + ccache \ + clang \ + compiler-rt \ + cpp \ + cyrus-sasl-devel \ + device-mapper-devel \ + diffutils \ + dwarves \ + ebtables \ + firewalld-filesystem \ + fuse3-devel \ + gcc \ + gettext \ + git \ + glib2-devel \ + glibc-devel \ + glibc-langpack-en \ + gnutls-devel \ + grep \ + json-c-devel \ + libacl-devel \ + libattr-devel \ + libblkid-devel \ + libcap-ng-devel \ + libcurl-devel \ + libnbd-devel \ + libnl3-devel \ + libpcap-devel \ + libpciaccess-devel \ + librbd-devel \ + libselinux-devel \ + libssh-devel \ + libssh2-devel \ + libtirpc-devel \ + libwsman-devel \ + libxml2 \ + libxml2-devel \ + libxslt \ + make \ + meson \ + ninja-build \ + numactl-devel \ + parted-devel \ + perl-base \ + pkgconfig \ + python3 \ + python3-docutils \ + python3-pip \ + python3-pytest \ + python3-setuptools \ + python3-wheel \ + qemu-img \ + readline-devel \ + rpm-build \ + sanlock-devel \ + sed \ + systemd-devel \ + systemd-rpm-macros \ + systemtap-sdt-devel \ + systemtap-sdt-dtrace \ + wireshark-devel && \ + dnf autoremove -y && \ + dnf clean all -y && \ + rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED && \ + rpm -qa | sort > /packages.txt && \ + mkdir -p /usr/libexec/ccache-wrappers && \ + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \ + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang && \ + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc + +RUN /usr/bin/pip3 install \ + black \ + flake8 + +ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers" +ENV LANG="en_US.UTF-8" +ENV MAKE="/usr/bin/make" +ENV NINJA="/usr/bin/ninja" +ENV PYTHON="/usr/bin/python3" diff --git a/ci/containers/centos-stream-10.Dockerfile b/ci/containers/centos-stream-10.Dockerfile new file mode 100644 index 0000000000..5b34b8273a --- /dev/null +++ b/ci/containers/centos-stream-10.Dockerfile @@ -0,0 +1,95 @@ +# THIS FILE WAS AUTO-GENERATED +# +# $ lcitool manifest ci/manifest.yml +# +# https://gitlab.com/libvirt/libvirt-ci + +FROM quay.io/centos/centos:stream10 + +RUN dnf distro-sync -y && \ + dnf install 'dnf-command(config-manager)' -y && \ + dnf config-manager --set-enabled -y crb && \ + dnf install -y epel-release && \ + dnf install -y \ + audit-libs-devel \ + augeas \ + bash-completion \ + ca-certificates \ + ccache \ + clang \ + compiler-rt \ + cpp \ + cyrus-sasl-devel \ + device-mapper-devel \ + diffutils \ + dwarves \ + ebtables \ + firewalld-filesystem \ + fuse3-devel \ + gcc \ + gettext \ + git \ + glib2-devel \ + glibc-devel \ + glibc-langpack-en \ + gnutls-devel \ + grep \ + json-c-devel \ + libacl-devel \ + libattr-devel \ + libblkid-devel \ + libcap-ng-devel \ + libcurl-devel \ + libnbd-devel \ + libnl3-devel \ + libpcap-devel \ + libpciaccess-devel \ + librbd-devel \ + libselinux-devel \ + libssh-devel \ + libssh2-devel \ + libtirpc-devel \ + libwsman-devel \ + libxml2 \ + libxml2-devel \ + libxslt \ + make \ + meson \ + ninja-build \ + numactl-devel \ + parted-devel \ + perl-base \ + pkgconfig \ + python3 \ + python3-docutils \ + python3-pip \ + python3-pytest \ + python3-setuptools \ + python3-wheel \ + qemu-img \ + readline-devel \ + rpm-build \ + sanlock-devel \ + sed \ + systemd-devel \ + systemd-rpm-macros \ + systemtap-sdt-devel \ + wireshark-devel && \ + dnf autoremove -y && \ + dnf clean all -y && \ + rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED && \ + rpm -qa | sort > /packages.txt && \ + mkdir -p /usr/libexec/ccache-wrappers && \ + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \ + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang && \ + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc + +RUN /usr/bin/pip3 install \ + black \ + flake8 + +ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers" +ENV LANG="en_US.UTF-8" +ENV MAKE="/usr/bin/make" +ENV NINJA="/usr/bin/ninja" +ENV PYTHON="/usr/bin/python3" diff --git a/ci/containers/fedora-42-cross-mingw32.Dockerfile b/ci/containers/fedora-43-cross-mingw32.Dockerfile similarity index 98% rename from ci/containers/fedora-42-cross-mingw32.Dockerfile rename to ci/containers/fedora-43-cross-mingw32.Dockerfile index 94d9378850..de7bee20e1 100644 --- a/ci/containers/fedora-42-cross-mingw32.Dockerfile +++ b/ci/containers/fedora-43-cross-mingw32.Dockerfile @@ -4,7 +4,7 @@ # # https://gitlab.com/libvirt/libvirt-ci -FROM registry.fedoraproject.org/fedora:42 +FROM registry.fedoraproject.org/fedora:43 RUN dnf install -y nosync && \ printf '#!/bin/sh\n\ diff --git a/ci/containers/fedora-42-cross-mingw64.Dockerfile b/ci/containers/fedora-43-cross-mingw64.Dockerfile similarity index 98% rename from ci/containers/fedora-42-cross-mingw64.Dockerfile rename to ci/containers/fedora-43-cross-mingw64.Dockerfile index 9d59a70975..ff6c3f8aa9 100644 --- a/ci/containers/fedora-42-cross-mingw64.Dockerfile +++ b/ci/containers/fedora-43-cross-mingw64.Dockerfile @@ -4,7 +4,7 @@ # # https://gitlab.com/libvirt/libvirt-ci -FROM registry.fedoraproject.org/fedora:42 +FROM registry.fedoraproject.org/fedora:43 RUN dnf install -y nosync && \ printf '#!/bin/sh\n\ diff --git a/ci/containers/fedora-41.Dockerfile b/ci/containers/fedora-43.Dockerfile similarity index 98% rename from ci/containers/fedora-41.Dockerfile rename to ci/containers/fedora-43.Dockerfile index 89732dd529..55f68a5839 100644 --- a/ci/containers/fedora-41.Dockerfile +++ b/ci/containers/fedora-43.Dockerfile @@ -4,7 +4,7 @@ # # https://gitlab.com/libvirt/libvirt-ci -FROM registry.fedoraproject.org/fedora:41 +FROM registry.fedoraproject.org/fedora:43 RUN dnf install -y nosync && \ printf '#!/bin/sh\n\ diff --git a/ci/gitlab/builds.yml b/ci/gitlab/builds.yml index ae691862c2..a98b0d9c46 100644 --- a/ci/gitlab/builds.yml +++ b/ci/gitlab/builds.yml @@ -33,6 +33,32 @@ x86_64-almalinux-9-clang: TARGET_BASE_IMAGE: docker.io/library/almalinux:9 +x86_64-almalinux-10: + extends: .native_build_job + needs: + - job: x86_64-almalinux-10-container + optional: true + allow_failure: false + variables: + JOB_OPTIONAL: 1 + NAME: almalinux-10 + RPM: skip + TARGET_BASE_IMAGE: docker.io/library/almalinux:10 + + +x86_64-almalinux-10-clang: + extends: .native_build_job + needs: + - job: x86_64-almalinux-10-container + optional: true + allow_failure: false + variables: + CC: clang + NAME: almalinux-10 + RPM: skip + TARGET_BASE_IMAGE: docker.io/library/almalinux:10 + + x86_64-alpine-322: extends: .native_build_job needs: @@ -70,6 +96,21 @@ x86_64-centos-stream-9: - libvirt-rpms +x86_64-centos-stream-10: + extends: .native_build_job + needs: + - job: x86_64-centos-stream-10-container + optional: true + allow_failure: false + variables: + NAME: centos-stream-10 + TARGET_BASE_IMAGE: quay.io/centos/centos:stream10 + artifacts: + expire_in: 1 day + paths: + - libvirt-rpms + + x86_64-debian-12: extends: .native_build_job needs: @@ -103,21 +144,6 @@ x86_64-debian-sid: TARGET_BASE_IMAGE: docker.io/library/debian:sid-slim -x86_64-fedora-41: - extends: .native_build_job - needs: - - job: x86_64-fedora-41-container - optional: true - allow_failure: false - variables: - NAME: fedora-41 - TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:41 - artifacts: - expire_in: 1 day - paths: - - libvirt-rpms - - x86_64-fedora-42: extends: .native_build_job needs: @@ -133,6 +159,21 @@ x86_64-fedora-42: - libvirt-rpms +x86_64-fedora-43: + extends: .native_build_job + needs: + - job: x86_64-fedora-43-container + optional: true + allow_failure: false + variables: + NAME: fedora-43 + TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:43 + artifacts: + expire_in: 1 day + paths: + - libvirt-rpms + + x86_64-fedora-rawhide: extends: .native_build_job needs: @@ -416,29 +457,29 @@ s390x-debian-sid: TARGET_BASE_IMAGE: docker.io/library/debian:sid-slim -mingw32-fedora-42: +mingw32-fedora-43: extends: .cross_build_job needs: - - job: mingw32-fedora-42-container + - job: mingw32-fedora-43-container optional: true allow_failure: false variables: CROSS: mingw32 JOB_OPTIONAL: 1 - NAME: fedora-42 - TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:42 + NAME: fedora-43 + TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:43 -mingw64-fedora-42: +mingw64-fedora-43: extends: .cross_build_job needs: - - job: mingw64-fedora-42-container + - job: mingw64-fedora-43-container optional: true allow_failure: false variables: CROSS: mingw64 - NAME: fedora-42 - TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:42 + NAME: fedora-43 + TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:43 mingw32-fedora-rawhide: diff --git a/ci/gitlab/containers.yml b/ci/gitlab/containers.yml index 0650e4781c..56b974f2a1 100644 --- a/ci/gitlab/containers.yml +++ b/ci/gitlab/containers.yml @@ -14,6 +14,13 @@ x86_64-almalinux-9-container: NAME: almalinux-9 +x86_64-almalinux-10-container: + extends: .container_job + allow_failure: false + variables: + NAME: almalinux-10 + + x86_64-alpine-322-container: extends: .container_job allow_failure: false @@ -35,6 +42,13 @@ x86_64-centos-stream-9-container: NAME: centos-stream-9 +x86_64-centos-stream-10-container: + extends: .container_job + allow_failure: false + variables: + NAME: centos-stream-10 + + x86_64-debian-12-container: extends: .container_job allow_failure: false @@ -49,13 +63,6 @@ x86_64-debian-sid-container: NAME: debian-sid -x86_64-fedora-41-container: - extends: .container_job - allow_failure: false - variables: - NAME: fedora-41 - - x86_64-fedora-42-container: extends: .container_job allow_failure: false @@ -63,6 +70,13 @@ x86_64-fedora-42-container: NAME: fedora-42 +x86_64-fedora-43-container: + extends: .container_job + allow_failure: false + variables: + NAME: fedora-43 + + x86_64-fedora-rawhide-container: extends: .container_job allow_failure: true @@ -220,19 +234,19 @@ s390x-debian-sid-container: NAME: debian-sid-cross-s390x -mingw32-fedora-42-container: +mingw32-fedora-43-container: extends: .container_job allow_failure: false variables: JOB_OPTIONAL: 1 - NAME: fedora-42-cross-mingw32 + NAME: fedora-43-cross-mingw32 -mingw64-fedora-42-container: +mingw64-fedora-43-container: extends: .container_job allow_failure: false variables: - NAME: fedora-42-cross-mingw64 + NAME: fedora-43-cross-mingw64 mingw32-fedora-rawhide-container: diff --git a/ci/integration.yml b/ci/integration.yml index 2c5e5a65bc..b7e301b4c0 100644 --- a/ci/integration.yml +++ b/ci/integration.yml @@ -29,23 +29,23 @@ centos-stream-9-tests: # and libvirt-python CI jobs, so the new target needs to be introduced # there before it can be used here. The VM template for the target # also needs to be created on the runner host. -fedora-41-tests: +fedora-43-tests: extends: .integration_tests variables: # needed by libvirt-gitlab-executor - DISTRO: fedora-41 + DISTRO: fedora-43 # can be overridden in forks to set a different runner tag LIBVIRT_CI_INTEGRATION_RUNNER_TAG: redhat-vm-host tags: - $LIBVIRT_CI_INTEGRATION_RUNNER_TAG needs: - - x86_64-fedora-41 + - x86_64-fedora-43 - project: libvirt/libvirt-perl - job: x86_64-fedora-41 + job: x86_64-fedora-43 ref: master artifacts: true - project: libvirt/libvirt-python - job: x86_64-fedora-41 + job: x86_64-fedora-43 ref: master artifacts: true @@ -53,22 +53,22 @@ fedora-41-tests: # and libvirt-python CI jobs, so the new target needs to be introduced # there before it can be used here. The VM template for the target # also needs to be created on the runner host. -.fedora-41-upstream-qemu-tests: +.fedora-43-upstream-qemu-tests: extends: .integration_tests variables: # needed by libvirt-gitlab-executor - DISTRO: fedora-41 + DISTRO: fedora-43 # can be overridden in forks to set a different runner tag LIBVIRT_CI_INTEGRATION_RUNNER_TAG: redhat-vm-host tags: - $LIBVIRT_CI_INTEGRATION_RUNNER_TAG needs: - - x86_64-fedora-41 + - x86_64-fedora-43 - project: libvirt/libvirt-perl - job: x86_64-fedora-41 + job: x86_64-fedora-43 ref: master artifacts: true - project: libvirt/libvirt-python - job: x86_64-fedora-41 + job: x86_64-fedora-43 ref: master artifacts: true diff --git a/ci/manifest.yml b/ci/manifest.yml index 21d570cb00..2fdb764142 100644 --- a/ci/manifest.yml +++ b/ci/manifest.yml @@ -19,6 +19,19 @@ targets: RPM: skip CC: clang + almalinux-10: + jobs: + - arch: x86_64 + builds: false + variables: + RPM: skip + + - arch: x86_64 + suffix: -clang + variables: + RPM: skip + CC: clang + alpine-322: x86_64 alpine-edge: @@ -34,6 +47,14 @@ targets: paths: - libvirt-rpms + centos-stream-10: + jobs: + - arch: x86_64 + artifacts: + expire_in: 1 day + paths: + - libvirt-rpms + debian-12: jobs: - arch: x86_64 @@ -104,14 +125,6 @@ targets: containers: false builds: false - fedora-41: - jobs: - - arch: x86_64 - artifacts: - expire_in: 1 day - paths: - - libvirt-rpms - fedora-42: jobs: - arch: x86_64 @@ -120,6 +133,14 @@ targets: paths: - libvirt-rpms + fedora-43: + jobs: + - arch: x86_64 + artifacts: + expire_in: 1 day + paths: + - libvirt-rpms + - arch: mingw32 builds: false -- 2.51.2

2 1

[PATCH] NEWS: Document Hyper-V virttype for Qemu Domains
by Praveen K Paladugu 25 Nov '25

25 Nov '25

Signed-off-by: Praveen K Paladugu <prapal(a)linux.microsoft.com> --- NEWS.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index e2d382d5f8..277ca41493 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -17,6 +17,12 @@ v11.10.0 (unreleased) * **New features** + * Introduce Hyper-V virttype support for Qemu domains + + Libvirt now supports Hyper-V virttype while lauching QEMU domains. This + feature requires Qemu version 10.2.0 or later and is available on Linux + hosts where the /dev/mshv is present. + * **Improvements** * bhyve: VNC ``wait`` attribute support -- 2.51.0

2 1

[PATCH v2] ci: refresh with 'lcitool manifest'
by Michal Privoznik 25 Nov '25

25 Nov '25

From: Michal Privoznik <mprivozn(a)redhat.com> - Add AlmaLinux 10 - Add CentOS Stream 10 - Add Fedora 43 - Remove EOL Fedora 41 - Switch mingw from Fedora 42 to Fedora 43 - Switch integration tests from Fedora 41 to Fedora 43 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- v2 of: https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/XSPN… diff to v1: - Added AlmaLinux 10 and CentOS Stream 10 Greenish pipeline: https://gitlab.com/MichalPrivoznik/libvirt/-/pipelines/2178025436 ci/buildenv/almalinux-10.sh | 93 ++++++++++++++++++ ci/buildenv/centos-stream-10.sh | 92 ++++++++++++++++++ ...-mingw32.sh => fedora-43-cross-mingw32.sh} | 0 ...-mingw64.sh => fedora-43-cross-mingw64.sh} | 0 ci/buildenv/{fedora-41.sh => fedora-43.sh} | 0 ci/containers/almalinux-10.Dockerfile | 96 +++++++++++++++++++ ci/containers/centos-stream-10.Dockerfile | 95 ++++++++++++++++++ ...ile => fedora-43-cross-mingw32.Dockerfile} | 2 +- ...ile => fedora-43-cross-mingw64.Dockerfile} | 2 +- ...ora-41.Dockerfile => fedora-43.Dockerfile} | 2 +- ci/gitlab/builds.yml | 83 +++++++++++----- ci/gitlab/containers.yml | 36 ++++--- ci/integration.yml | 20 ++-- ci/manifest.yml | 33 +++++-- 14 files changed, 499 insertions(+), 55 deletions(-) create mode 100644 ci/buildenv/almalinux-10.sh create mode 100644 ci/buildenv/centos-stream-10.sh rename ci/buildenv/{fedora-42-cross-mingw32.sh => fedora-43-cross-mingw32.sh} (100%) rename ci/buildenv/{fedora-42-cross-mingw64.sh => fedora-43-cross-mingw64.sh} (100%) rename ci/buildenv/{fedora-41.sh => fedora-43.sh} (100%) create mode 100644 ci/containers/almalinux-10.Dockerfile create mode 100644 ci/containers/centos-stream-10.Dockerfile rename ci/containers/{fedora-42-cross-mingw32.Dockerfile => fedora-43-cross-mingw32.Dockerfile} (98%) rename ci/containers/{fedora-42-cross-mingw64.Dockerfile => fedora-43-cross-mingw64.Dockerfile} (98%) rename ci/containers/{fedora-41.Dockerfile => fedora-43.Dockerfile} (98%) diff --git a/ci/buildenv/almalinux-10.sh b/ci/buildenv/almalinux-10.sh new file mode 100644 index 0000000000..d69d0c4267 --- /dev/null +++ b/ci/buildenv/almalinux-10.sh @@ -0,0 +1,93 @@ +# THIS FILE WAS AUTO-GENERATED +# +# $ lcitool manifest ci/manifest.yml +# +# https://gitlab.com/libvirt/libvirt-ci + +function install_buildenv() { + dnf update -y + dnf install 'dnf-command(config-manager)' -y + dnf config-manager --set-enabled -y crb + dnf install -y epel-release + dnf install -y \ + audit-libs-devel \ + augeas \ + bash-completion \ + ca-certificates \ + ccache \ + clang \ + compiler-rt \ + cpp \ + cyrus-sasl-devel \ + device-mapper-devel \ + diffutils \ + dwarves \ + ebtables \ + firewalld-filesystem \ + fuse3-devel \ + gcc \ + gettext \ + git \ + glib2-devel \ + glibc-devel \ + glibc-langpack-en \ + gnutls-devel \ + grep \ + json-c-devel \ + libacl-devel \ + libattr-devel \ + libblkid-devel \ + libcap-ng-devel \ + libcurl-devel \ + libnbd-devel \ + libnl3-devel \ + libpcap-devel \ + libpciaccess-devel \ + librbd-devel \ + libselinux-devel \ + libssh-devel \ + libssh2-devel \ + libtirpc-devel \ + libwsman-devel \ + libxml2 \ + libxml2-devel \ + libxslt \ + make \ + meson \ + ninja-build \ + numactl-devel \ + parted-devel \ + perl-base \ + pkgconfig \ + python3 \ + python3-docutils \ + python3-pip \ + python3-pytest \ + python3-setuptools \ + python3-wheel \ + qemu-img \ + readline-devel \ + rpm-build \ + sanlock-devel \ + sed \ + systemd-devel \ + systemd-rpm-macros \ + systemtap-sdt-devel \ + systemtap-sdt-dtrace \ + wireshark-devel + rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED + rpm -qa | sort > /packages.txt + mkdir -p /usr/libexec/ccache-wrappers + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc + /usr/bin/pip3 install \ + black \ + flake8 +} + +export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers" +export LANG="en_US.UTF-8" +export MAKE="/usr/bin/make" +export NINJA="/usr/bin/ninja" +export PYTHON="/usr/bin/python3" diff --git a/ci/buildenv/centos-stream-10.sh b/ci/buildenv/centos-stream-10.sh new file mode 100644 index 0000000000..2747adfb38 --- /dev/null +++ b/ci/buildenv/centos-stream-10.sh @@ -0,0 +1,92 @@ +# THIS FILE WAS AUTO-GENERATED +# +# $ lcitool manifest ci/manifest.yml +# +# https://gitlab.com/libvirt/libvirt-ci + +function install_buildenv() { + dnf distro-sync -y + dnf install 'dnf-command(config-manager)' -y + dnf config-manager --set-enabled -y crb + dnf install -y epel-release + dnf install -y \ + audit-libs-devel \ + augeas \ + bash-completion \ + ca-certificates \ + ccache \ + clang \ + compiler-rt \ + cpp \ + cyrus-sasl-devel \ + device-mapper-devel \ + diffutils \ + dwarves \ + ebtables \ + firewalld-filesystem \ + fuse3-devel \ + gcc \ + gettext \ + git \ + glib2-devel \ + glibc-devel \ + glibc-langpack-en \ + gnutls-devel \ + grep \ + json-c-devel \ + libacl-devel \ + libattr-devel \ + libblkid-devel \ + libcap-ng-devel \ + libcurl-devel \ + libnbd-devel \ + libnl3-devel \ + libpcap-devel \ + libpciaccess-devel \ + librbd-devel \ + libselinux-devel \ + libssh-devel \ + libssh2-devel \ + libtirpc-devel \ + libwsman-devel \ + libxml2 \ + libxml2-devel \ + libxslt \ + make \ + meson \ + ninja-build \ + numactl-devel \ + parted-devel \ + perl-base \ + pkgconfig \ + python3 \ + python3-docutils \ + python3-pip \ + python3-pytest \ + python3-setuptools \ + python3-wheel \ + qemu-img \ + readline-devel \ + rpm-build \ + sanlock-devel \ + sed \ + systemd-devel \ + systemd-rpm-macros \ + systemtap-sdt-devel \ + wireshark-devel + rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED + rpm -qa | sort > /packages.txt + mkdir -p /usr/libexec/ccache-wrappers + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc + /usr/bin/pip3 install \ + black \ + flake8 +} + +export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers" +export LANG="en_US.UTF-8" +export MAKE="/usr/bin/make" +export NINJA="/usr/bin/ninja" +export PYTHON="/usr/bin/python3" diff --git a/ci/buildenv/fedora-42-cross-mingw32.sh b/ci/buildenv/fedora-43-cross-mingw32.sh similarity index 100% rename from ci/buildenv/fedora-42-cross-mingw32.sh rename to ci/buildenv/fedora-43-cross-mingw32.sh diff --git a/ci/buildenv/fedora-42-cross-mingw64.sh b/ci/buildenv/fedora-43-cross-mingw64.sh similarity index 100% rename from ci/buildenv/fedora-42-cross-mingw64.sh rename to ci/buildenv/fedora-43-cross-mingw64.sh diff --git a/ci/buildenv/fedora-41.sh b/ci/buildenv/fedora-43.sh similarity index 100% rename from ci/buildenv/fedora-41.sh rename to ci/buildenv/fedora-43.sh diff --git a/ci/containers/almalinux-10.Dockerfile b/ci/containers/almalinux-10.Dockerfile new file mode 100644 index 0000000000..815b4c0e68 --- /dev/null +++ b/ci/containers/almalinux-10.Dockerfile @@ -0,0 +1,96 @@ +# THIS FILE WAS AUTO-GENERATED +# +# $ lcitool manifest ci/manifest.yml +# +# https://gitlab.com/libvirt/libvirt-ci + +FROM docker.io/library/almalinux:10 + +RUN dnf update -y && \ + dnf install 'dnf-command(config-manager)' -y && \ + dnf config-manager --set-enabled -y crb && \ + dnf install -y epel-release && \ + dnf install -y \ + audit-libs-devel \ + augeas \ + bash-completion \ + ca-certificates \ + ccache \ + clang \ + compiler-rt \ + cpp \ + cyrus-sasl-devel \ + device-mapper-devel \ + diffutils \ + dwarves \ + ebtables \ + firewalld-filesystem \ + fuse3-devel \ + gcc \ + gettext \ + git \ + glib2-devel \ + glibc-devel \ + glibc-langpack-en \ + gnutls-devel \ + grep \ + json-c-devel \ + libacl-devel \ + libattr-devel \ + libblkid-devel \ + libcap-ng-devel \ + libcurl-devel \ + libnbd-devel \ + libnl3-devel \ + libpcap-devel \ + libpciaccess-devel \ + librbd-devel \ + libselinux-devel \ + libssh-devel \ + libssh2-devel \ + libtirpc-devel \ + libwsman-devel \ + libxml2 \ + libxml2-devel \ + libxslt \ + make \ + meson \ + ninja-build \ + numactl-devel \ + parted-devel \ + perl-base \ + pkgconfig \ + python3 \ + python3-docutils \ + python3-pip \ + python3-pytest \ + python3-setuptools \ + python3-wheel \ + qemu-img \ + readline-devel \ + rpm-build \ + sanlock-devel \ + sed \ + systemd-devel \ + systemd-rpm-macros \ + systemtap-sdt-devel \ + systemtap-sdt-dtrace \ + wireshark-devel && \ + dnf autoremove -y && \ + dnf clean all -y && \ + rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED && \ + rpm -qa | sort > /packages.txt && \ + mkdir -p /usr/libexec/ccache-wrappers && \ + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \ + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang && \ + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc + +RUN /usr/bin/pip3 install \ + black \ + flake8 + +ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers" +ENV LANG="en_US.UTF-8" +ENV MAKE="/usr/bin/make" +ENV NINJA="/usr/bin/ninja" +ENV PYTHON="/usr/bin/python3" diff --git a/ci/containers/centos-stream-10.Dockerfile b/ci/containers/centos-stream-10.Dockerfile new file mode 100644 index 0000000000..5b34b8273a --- /dev/null +++ b/ci/containers/centos-stream-10.Dockerfile @@ -0,0 +1,95 @@ +# THIS FILE WAS AUTO-GENERATED +# +# $ lcitool manifest ci/manifest.yml +# +# https://gitlab.com/libvirt/libvirt-ci + +FROM quay.io/centos/centos:stream10 + +RUN dnf distro-sync -y && \ + dnf install 'dnf-command(config-manager)' -y && \ + dnf config-manager --set-enabled -y crb && \ + dnf install -y epel-release && \ + dnf install -y \ + audit-libs-devel \ + augeas \ + bash-completion \ + ca-certificates \ + ccache \ + clang \ + compiler-rt \ + cpp \ + cyrus-sasl-devel \ + device-mapper-devel \ + diffutils \ + dwarves \ + ebtables \ + firewalld-filesystem \ + fuse3-devel \ + gcc \ + gettext \ + git \ + glib2-devel \ + glibc-devel \ + glibc-langpack-en \ + gnutls-devel \ + grep \ + json-c-devel \ + libacl-devel \ + libattr-devel \ + libblkid-devel \ + libcap-ng-devel \ + libcurl-devel \ + libnbd-devel \ + libnl3-devel \ + libpcap-devel \ + libpciaccess-devel \ + librbd-devel \ + libselinux-devel \ + libssh-devel \ + libssh2-devel \ + libtirpc-devel \ + libwsman-devel \ + libxml2 \ + libxml2-devel \ + libxslt \ + make \ + meson \ + ninja-build \ + numactl-devel \ + parted-devel \ + perl-base \ + pkgconfig \ + python3 \ + python3-docutils \ + python3-pip \ + python3-pytest \ + python3-setuptools \ + python3-wheel \ + qemu-img \ + readline-devel \ + rpm-build \ + sanlock-devel \ + sed \ + systemd-devel \ + systemd-rpm-macros \ + systemtap-sdt-devel \ + wireshark-devel && \ + dnf autoremove -y && \ + dnf clean all -y && \ + rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED && \ + rpm -qa | sort > /packages.txt && \ + mkdir -p /usr/libexec/ccache-wrappers && \ + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \ + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang && \ + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc + +RUN /usr/bin/pip3 install \ + black \ + flake8 + +ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers" +ENV LANG="en_US.UTF-8" +ENV MAKE="/usr/bin/make" +ENV NINJA="/usr/bin/ninja" +ENV PYTHON="/usr/bin/python3" diff --git a/ci/containers/fedora-42-cross-mingw32.Dockerfile b/ci/containers/fedora-43-cross-mingw32.Dockerfile similarity index 98% rename from ci/containers/fedora-42-cross-mingw32.Dockerfile rename to ci/containers/fedora-43-cross-mingw32.Dockerfile index 94d9378850..de7bee20e1 100644 --- a/ci/containers/fedora-42-cross-mingw32.Dockerfile +++ b/ci/containers/fedora-43-cross-mingw32.Dockerfile @@ -4,7 +4,7 @@ # # https://gitlab.com/libvirt/libvirt-ci -FROM registry.fedoraproject.org/fedora:42 +FROM registry.fedoraproject.org/fedora:43 RUN dnf install -y nosync && \ printf '#!/bin/sh\n\ diff --git a/ci/containers/fedora-42-cross-mingw64.Dockerfile b/ci/containers/fedora-43-cross-mingw64.Dockerfile similarity index 98% rename from ci/containers/fedora-42-cross-mingw64.Dockerfile rename to ci/containers/fedora-43-cross-mingw64.Dockerfile index 9d59a70975..ff6c3f8aa9 100644 --- a/ci/containers/fedora-42-cross-mingw64.Dockerfile +++ b/ci/containers/fedora-43-cross-mingw64.Dockerfile @@ -4,7 +4,7 @@ # # https://gitlab.com/libvirt/libvirt-ci -FROM registry.fedoraproject.org/fedora:42 +FROM registry.fedoraproject.org/fedora:43 RUN dnf install -y nosync && \ printf '#!/bin/sh\n\ diff --git a/ci/containers/fedora-41.Dockerfile b/ci/containers/fedora-43.Dockerfile similarity index 98% rename from ci/containers/fedora-41.Dockerfile rename to ci/containers/fedora-43.Dockerfile index 89732dd529..55f68a5839 100644 --- a/ci/containers/fedora-41.Dockerfile +++ b/ci/containers/fedora-43.Dockerfile @@ -4,7 +4,7 @@ # # https://gitlab.com/libvirt/libvirt-ci -FROM registry.fedoraproject.org/fedora:41 +FROM registry.fedoraproject.org/fedora:43 RUN dnf install -y nosync && \ printf '#!/bin/sh\n\ diff --git a/ci/gitlab/builds.yml b/ci/gitlab/builds.yml index ae691862c2..42ecccdbcc 100644 --- a/ci/gitlab/builds.yml +++ b/ci/gitlab/builds.yml @@ -33,6 +33,32 @@ x86_64-almalinux-9-clang: TARGET_BASE_IMAGE: docker.io/library/almalinux:9 +x86_64-almalinux-10: + extends: .native_build_job + needs: + - job: x86_64-almalinux-10-container + optional: true + allow_failure: false + variables: + JOB_OPTIONAL: 1 + NAME: almalinux-10 + RPM: skip + TARGET_BASE_IMAGE: docker.io/library/almalinux:10 + + +x86_64-almalinux-10-clang: + extends: .native_build_job + needs: + - job: x86_64-almalinux-10-container + optional: true + allow_failure: false + variables: + CC: clang + NAME: almalinux-10 + RPM: skip + TARGET_BASE_IMAGE: docker.io/library/almalinux:10 + + x86_64-alpine-322: extends: .native_build_job needs: @@ -64,6 +90,17 @@ x86_64-centos-stream-9: variables: NAME: centos-stream-9 TARGET_BASE_IMAGE: quay.io/centos/centos:stream9 + + +x86_64-centos-stream-10: + extends: .native_build_job + needs: + - job: x86_64-centos-stream-10-container + optional: true + allow_failure: false + variables: + NAME: centos-stream-10 + TARGET_BASE_IMAGE: quay.io/centos/centos:stream10 artifacts: expire_in: 1 day paths: @@ -103,21 +140,6 @@ x86_64-debian-sid: TARGET_BASE_IMAGE: docker.io/library/debian:sid-slim -x86_64-fedora-41: - extends: .native_build_job - needs: - - job: x86_64-fedora-41-container - optional: true - allow_failure: false - variables: - NAME: fedora-41 - TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:41 - artifacts: - expire_in: 1 day - paths: - - libvirt-rpms - - x86_64-fedora-42: extends: .native_build_job needs: @@ -133,6 +155,21 @@ x86_64-fedora-42: - libvirt-rpms +x86_64-fedora-43: + extends: .native_build_job + needs: + - job: x86_64-fedora-43-container + optional: true + allow_failure: false + variables: + NAME: fedora-43 + TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:43 + artifacts: + expire_in: 1 day + paths: + - libvirt-rpms + + x86_64-fedora-rawhide: extends: .native_build_job needs: @@ -416,29 +453,29 @@ s390x-debian-sid: TARGET_BASE_IMAGE: docker.io/library/debian:sid-slim -mingw32-fedora-42: +mingw32-fedora-43: extends: .cross_build_job needs: - - job: mingw32-fedora-42-container + - job: mingw32-fedora-43-container optional: true allow_failure: false variables: CROSS: mingw32 JOB_OPTIONAL: 1 - NAME: fedora-42 - TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:42 + NAME: fedora-43 + TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:43 -mingw64-fedora-42: +mingw64-fedora-43: extends: .cross_build_job needs: - - job: mingw64-fedora-42-container + - job: mingw64-fedora-43-container optional: true allow_failure: false variables: CROSS: mingw64 - NAME: fedora-42 - TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:42 + NAME: fedora-43 + TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:43 mingw32-fedora-rawhide: diff --git a/ci/gitlab/containers.yml b/ci/gitlab/containers.yml index 0650e4781c..56b974f2a1 100644 --- a/ci/gitlab/containers.yml +++ b/ci/gitlab/containers.yml @@ -14,6 +14,13 @@ x86_64-almalinux-9-container: NAME: almalinux-9 +x86_64-almalinux-10-container: + extends: .container_job + allow_failure: false + variables: + NAME: almalinux-10 + + x86_64-alpine-322-container: extends: .container_job allow_failure: false @@ -35,6 +42,13 @@ x86_64-centos-stream-9-container: NAME: centos-stream-9 +x86_64-centos-stream-10-container: + extends: .container_job + allow_failure: false + variables: + NAME: centos-stream-10 + + x86_64-debian-12-container: extends: .container_job allow_failure: false @@ -49,13 +63,6 @@ x86_64-debian-sid-container: NAME: debian-sid -x86_64-fedora-41-container: - extends: .container_job - allow_failure: false - variables: - NAME: fedora-41 - - x86_64-fedora-42-container: extends: .container_job allow_failure: false @@ -63,6 +70,13 @@ x86_64-fedora-42-container: NAME: fedora-42 +x86_64-fedora-43-container: + extends: .container_job + allow_failure: false + variables: + NAME: fedora-43 + + x86_64-fedora-rawhide-container: extends: .container_job allow_failure: true @@ -220,19 +234,19 @@ s390x-debian-sid-container: NAME: debian-sid-cross-s390x -mingw32-fedora-42-container: +mingw32-fedora-43-container: extends: .container_job allow_failure: false variables: JOB_OPTIONAL: 1 - NAME: fedora-42-cross-mingw32 + NAME: fedora-43-cross-mingw32 -mingw64-fedora-42-container: +mingw64-fedora-43-container: extends: .container_job allow_failure: false variables: - NAME: fedora-42-cross-mingw64 + NAME: fedora-43-cross-mingw64 mingw32-fedora-rawhide-container: diff --git a/ci/integration.yml b/ci/integration.yml index 2c5e5a65bc..b7e301b4c0 100644 --- a/ci/integration.yml +++ b/ci/integration.yml @@ -29,23 +29,23 @@ centos-stream-9-tests: # and libvirt-python CI jobs, so the new target needs to be introduced # there before it can be used here. The VM template for the target # also needs to be created on the runner host. -fedora-41-tests: +fedora-43-tests: extends: .integration_tests variables: # needed by libvirt-gitlab-executor - DISTRO: fedora-41 + DISTRO: fedora-43 # can be overridden in forks to set a different runner tag LIBVIRT_CI_INTEGRATION_RUNNER_TAG: redhat-vm-host tags: - $LIBVIRT_CI_INTEGRATION_RUNNER_TAG needs: - - x86_64-fedora-41 + - x86_64-fedora-43 - project: libvirt/libvirt-perl - job: x86_64-fedora-41 + job: x86_64-fedora-43 ref: master artifacts: true - project: libvirt/libvirt-python - job: x86_64-fedora-41 + job: x86_64-fedora-43 ref: master artifacts: true @@ -53,22 +53,22 @@ fedora-41-tests: # and libvirt-python CI jobs, so the new target needs to be introduced # there before it can be used here. The VM template for the target # also needs to be created on the runner host. -.fedora-41-upstream-qemu-tests: +.fedora-43-upstream-qemu-tests: extends: .integration_tests variables: # needed by libvirt-gitlab-executor - DISTRO: fedora-41 + DISTRO: fedora-43 # can be overridden in forks to set a different runner tag LIBVIRT_CI_INTEGRATION_RUNNER_TAG: redhat-vm-host tags: - $LIBVIRT_CI_INTEGRATION_RUNNER_TAG needs: - - x86_64-fedora-41 + - x86_64-fedora-43 - project: libvirt/libvirt-perl - job: x86_64-fedora-41 + job: x86_64-fedora-43 ref: master artifacts: true - project: libvirt/libvirt-python - job: x86_64-fedora-41 + job: x86_64-fedora-43 ref: master artifacts: true diff --git a/ci/manifest.yml b/ci/manifest.yml index 21d570cb00..dad7e4ba3a 100644 --- a/ci/manifest.yml +++ b/ci/manifest.yml @@ -19,6 +19,19 @@ targets: RPM: skip CC: clang + almalinux-10: + jobs: + - arch: x86_64 + builds: false + variables: + RPM: skip + + - arch: x86_64 + suffix: -clang + variables: + RPM: skip + CC: clang + alpine-322: x86_64 alpine-edge: @@ -27,6 +40,10 @@ targets: allow-failure: true centos-stream-9: + jobs: + - arch: x86_64 + + centos-stream-10: jobs: - arch: x86_64 artifacts: @@ -104,14 +121,6 @@ targets: containers: false builds: false - fedora-41: - jobs: - - arch: x86_64 - artifacts: - expire_in: 1 day - paths: - - libvirt-rpms - fedora-42: jobs: - arch: x86_64 @@ -120,6 +129,14 @@ targets: paths: - libvirt-rpms + fedora-43: + jobs: + - arch: x86_64 + artifacts: + expire_in: 1 day + paths: + - libvirt-rpms + - arch: mingw32 builds: false -- 2.51.2

2 1

[PATCH v2 00/22] conf: qemu: Use automatic memory management
by Kirill Shchetiniuk 25 Nov '25

25 Nov '25

Refactored the code to use GLib automatic memory management capabilities. Added macros to enable the g_autoptr capability for some structures. Removed prevosly defined cleanup stages, as now it is not required. Moved some variables to closer scope, to enbale auto memory management capability for it. Changes: v2: Split the commits to individual functions Kirill Shchetiniuk (22): virQEMUCapsKVMSupportsNesting: Use automatic memory management qemuDomainSetVcpusAgent: Use automatic memory management qemuDomainGetHostnameLease: Use automatic memory management qemuProcessRefreshChannelVirtioState: Use automatic memory management qemuMigrationSrcPerformPeer2Peer2: Use automatic memory management qemuDomainMasterKeyReadFile: Use automatic memory management qemuDomainObjPrivateXMLParse: Use automatic memory management qemuDomainGetGuestVcpus: Use automatic memory management qemuDomainSetGuestVcpus: Use automatic memory management qemuMonitorInitBalloonObjectPath: Use automatic memory management qemuMonitorMigrateToHost: Use automatic memory management qemuMigrationAnyParseURI: Use automatic memory management qemuMigrationAnyPrepareDef: Use automatic memory management qemuMigrationSrcIOFunc: Use automatic memory management qemuMigrationSrcStartTunnel: Use automatic memory management qemuMigrationSrcToLegacyFile: Use automatic memory management virDomainGraphicsDefNew: Use automatic memory management virDomainTPMDefNew: Use automatic memory management virDomainVideoDefNew: Use automatic memory management virDomainIdmapDefParseXML: Use automatic memory management virDomainNetAppendIPAddress: Use automatic memory management virDomainChrDefNew: Use automatic memory management src/conf/domain_conf.c | 35 ++++++++++++------------------ src/conf/domain_conf.h | 2 ++ src/datatypes.h | 1 + src/qemu/qemu_capabilities.c | 6 +++--- src/qemu/qemu_domain.c | 15 ++++++------- src/qemu/qemu_driver.c | 33 +++++++++++------------------ src/qemu/qemu_migration.c | 41 +++++++++++++----------------------- src/qemu/qemu_monitor.c | 6 ++---- src/qemu/qemu_process.c | 7 +++--- 9 files changed, 58 insertions(+), 88 deletions(-) -- 2.49.0

1 22

[PATCH 0/7] conf: qemu: Use automatic memory management
by Kirill Shchetiniuk 25 Nov '25

25 Nov '25

Refactored the code to use GLib automatic memory management capabilities. Added macros to enable the g_autoptr capability for some structures. Removed prevosly defined cleanup stages, as now it is not required. Moved some variables to closer scope, to enbale auto memory management capability for some variables. Kirill Shchetiniuk (7): conf: Use automatic memory management qemu: Use automatic memory management virQEMUCapsKVMSupportsNesting: Use automatic memory management qemuDomainSetVcpusAgent: Use automatic memory management qemuDomainGetHostnameLease: Use automatic memory management qemuProcessRefreshChannelVirtioState: Use automatic memory management qemuMigrationSrcPerformPeer2Peer2: Use automatic memory management src/conf/domain_conf.c | 35 +++++++++++++------------------- src/conf/domain_conf.h | 2 ++ src/datatypes.h | 1 + src/qemu/qemu_capabilities.c | 6 +++--- src/qemu/qemu_domain.c | 15 ++++++-------- src/qemu/qemu_driver.c | 33 +++++++++++------------------- src/qemu/qemu_migration.c | 39 +++++++++++++----------------------- src/qemu/qemu_monitor.c | 6 ++---- src/qemu/qemu_process.c | 7 +++---- 9 files changed, 57 insertions(+), 87 deletions(-) -- 2.49.0

2 9

[PATCH 0/4] qemucapabilitiestest: Update x86_64 caps, prepare
by Peter Krempa 25 Nov '25

25 Nov '25

Patch 1 updates the x86_64 dump to last state. Patches 2,3 get rid of explicit use of virt-4.0 and 4.2 machines on aarch64 which will be dropped. Patch 4 adds a dev-cycle dump for aarch64 collected on a raspberry pi. Normally I wouldn't add one so close to the release but Jano asked me for some of his patches. Treat patch 4 as RFC. Additionally if anyone wants to contribute dump from a better machine please do so. Peter Krempa (4): qemucapabilitiestest: qemucapabilitiestest: Update 'caps_10.2.0_x86_64' to 'v10.2.0-rc1-38-gfb241d0a1f' qemuxmlconftest: Update 'aarch64' tests using 'virt-4.0' machine type qemuxmlconftest: Update 'aarch64' tests using 'virt-4.2' machine type qemucapabilitiestest: Add data for the qemu-10.2 dev cycle for 'aarch64' .../qemu_10.2.0-virt.aarch64.xml | 249 + tests/domaincapsdata/qemu_10.2.0.aarch64.xml | 249 + .../caps_10.2.0_aarch64.replies | 39126 ++++++++++++++++ .../caps_10.2.0_aarch64.xml | 530 + .../caps_10.2.0_x86_64.replies | 24 +- .../caps_10.2.0_x86_64.xml | 4 +- ...arch64-cpu-passthrough.aarch64-latest.args | 2 +- ...aarch64-cpu-passthrough.aarch64-latest.xml | 2 +- ...ault-cpu-kvm-virt-10.0.aarch64-latest.args | 35 + ...fault-cpu-kvm-virt-10.0.aarch64-latest.xml | 39 + .../aarch64-default-cpu-kvm-virt-10.0.xml | 20 + ...ault-cpu-kvm-virt-4.2.aarch64-10.0.0.args} | 0 ...fault-cpu-kvm-virt-4.2.aarch64-10.0.0.xml} | 0 ...ault-cpu-tcg-virt-10.0.aarch64-latest.args | 35 + ...fault-cpu-tcg-virt-10.0.aarch64-latest.xml | 39 + .../aarch64-default-cpu-tcg-virt-10.0.xml | 20 + ...ault-cpu-tcg-virt-4.2.aarch64-10.0.0.args} | 0 ...fault-cpu-tcg-virt-4.2.aarch64-10.0.0.xml} | 0 ...aarch64-features-pauth.aarch64-latest.args | 2 +- .../aarch64-features-pauth.aarch64-latest.xml | 2 +- .../aarch64-features-sve.aarch64-latest.args | 2 +- .../aarch64-features-sve.aarch64-latest.xml | 2 +- .../aarch64-features-wrong.aarch64-latest.xml | 2 +- .../aarch64-gic-default.aarch64-latest.args | 2 +- .../aarch64-gic-default.aarch64-latest.xml | 2 +- .../aarch64-gic-none.aarch64-latest.args | 2 +- .../aarch64-gic-none.aarch64-latest.xml | 2 +- .../aarch64-kvm-32-on-64.aarch64-latest.args | 2 +- .../aarch64-kvm-32-on-64.aarch64-latest.xml | 2 +- .../aarch64-pci-serial.aarch64-latest.args | 1 - .../aarch64-pci-serial.aarch64-latest.xml | 3 - ...arch64-traditional-pci.aarch64-latest.args | 1 - ...aarch64-traditional-pci.aarch64-latest.xml | 3 - ...aarch64-usb-controller.aarch64-latest.args | 1 - .../aarch64-usb-controller.aarch64-latest.xml | 3 - ...ault-models.aarch64-latest.abi-update.args | 1 - ...fault-models.aarch64-latest.abi-update.xml | 3 - ...64-virt-default-models.aarch64-latest.args | 1 - ...h64-virt-default-models.aarch64-latest.xml | 3 - .../aarch64-virt-graphics.aarch64-latest.args | 3 +- .../aarch64-virt-graphics.aarch64-latest.xml | 5 +- .../qemuxmlconfdata/aarch64-virt-graphics.xml | 2 +- ...h64-virt-headless-mmio.aarch64-latest.args | 3 +- ...ch64-virt-headless-mmio.aarch64-latest.xml | 5 +- .../aarch64-virt-headless-mmio.xml | 2 +- .../aarch64-virt-headless.aarch64-latest.args | 3 +- .../aarch64-virt-headless.aarch64-latest.xml | 5 +- .../qemuxmlconfdata/aarch64-virt-headless.xml | 2 +- ...irt-minimal.aarch64-latest.abi-update.args | 1 - ...virt-minimal.aarch64-latest.abi-update.xml | 3 - .../aarch64-virt-minimal.aarch64-latest.args | 1 - .../aarch64-virt-minimal.aarch64-latest.xml | 3 - .../arm-vexpressa9-basic.aarch64-latest.args | 1 + .../arm-vexpressa9-basic.aarch64-latest.xml | 3 + .../arm-vexpressa9-nodevs.aarch64-latest.args | 1 + .../arm-vexpressa9-nodevs.aarch64-latest.xml | 3 + .../arm-vexpressa9-virtio.aarch64-latest.args | 1 + .../arm-vexpressa9-virtio.aarch64-latest.xml | 3 + .../cpu-topology5.aarch64-latest.args | 1 - .../cpu-topology5.aarch64-latest.xml | 3 +- ...ult-video-type-aarch64.aarch64-latest.args | 2 +- ...ault-video-type-aarch64.aarch64-latest.xml | 2 +- .../disk-arm-virtio-sd.aarch64-latest.args | 1 + .../disk-arm-virtio-sd.aarch64-latest.xml | 3 + ...efi-aarch64.aarch64-latest.abi-update.args | 3 +- ...-efi-aarch64.aarch64-latest.abi-update.xml | 5 +- ...mware-auto-efi-aarch64.aarch64-latest.args | 3 +- ...rmware-auto-efi-aarch64.aarch64-latest.xml | 5 +- .../firmware-auto-efi-aarch64.xml | 2 +- ...-loader-raw.aarch64-latest.abi-update.args | 3 +- ...t-loader-raw.aarch64-latest.abi-update.xml | 5 +- ...-efi-format-loader-raw.aarch64-latest.args | 3 +- ...o-efi-format-loader-raw.aarch64-latest.xml | 5 +- .../firmware-auto-efi-format-loader-raw.xml | 2 +- ...i-aarch64-legacy-paths.aarch64-latest.args | 3 +- ...fi-aarch64-legacy-paths.aarch64-latest.xml | 5 +- ...rmware-manual-efi-aarch64-legacy-paths.xml | 2 +- ...anual-efi-acpi-aarch64.aarch64-latest.args | 3 +- ...manual-efi-acpi-aarch64.aarch64-latest.xml | 5 +- .../firmware-manual-efi-acpi-aarch64.xml | 2 +- ...ual-efi-noacpi-aarch64.aarch64-latest.args | 3 +- ...nual-efi-noacpi-aarch64.aarch64-latest.xml | 5 +- .../firmware-manual-efi-noacpi-aarch64.xml | 2 +- .../firmware-manual-noefi-acpi-aarch64.xml | 2 +- ...l-noefi-noacpi-aarch64.aarch64-latest.args | 3 +- ...al-noefi-noacpi-aarch64.aarch64-latest.xml | 5 +- .../firmware-manual-noefi-noacpi-aarch64.xml | 2 +- .../iommu-smmuv3-pci-bus.aarch64-latest.args | 1 - .../iommu-smmuv3-pci-bus.aarch64-latest.xml | 3 - .../iommu-smmuv3.aarch64-latest.args | 1 - .../iommu-smmuv3.aarch64-latest.xml | 3 - ...ch-virt-console-native.aarch64-latest.args | 1 - ...ach-virt-console-native.aarch64-latest.xml | 3 - ...ch-virt-console-virtio.aarch64-latest.args | 1 - ...ach-virt-console-virtio.aarch64-latest.xml | 3 - ...-serial+console-native.aarch64-latest.args | 1 - ...t-serial+console-native.aarch64-latest.xml | 3 - ...ach-virt-serial-compat.aarch64-latest.args | 1 - ...mach-virt-serial-compat.aarch64-latest.xml | 3 - ...ach-virt-serial-native.aarch64-latest.args | 1 - ...mach-virt-serial-native.aarch64-latest.xml | 3 - .../mach-virt-serial-pci.aarch64-latest.args | 1 - .../mach-virt-serial-pci.aarch64-latest.xml | 3 - .../mach-virt-serial-usb.aarch64-latest.args | 1 - .../mach-virt-serial-usb.aarch64-latest.xml | 3 - ...e-expander-bus-aarch64.aarch64-latest.args | 1 - ...ie-expander-bus-aarch64.aarch64-latest.xml | 3 - .../pcihole64-virt.aarch64-latest.args | 1 - .../pcihole64-virt.aarch64-latest.xml | 3 - .../pvpanic-pci-aarch64.aarch64-latest.args | 1 - .../pvpanic-pci-aarch64.aarch64-latest.xml | 3 - ...pci-no-address-aarch64.aarch64-latest.args | 1 - ...-pci-no-address-aarch64.aarch64-latest.xml | 3 - ...automatic-virt-aarch64.aarch64-latest.args | 1 - ...-automatic-virt-aarch64.aarch64-latest.xml | 3 - ...-fallback-virt-aarch64.aarch64-latest.args | 1 - ...t-fallback-virt-aarch64.aarch64-latest.xml | 3 - ...r-default-virt-aarch64.aarch64-latest.args | 1 - ...er-default-virt-aarch64.aarch64-latest.xml | 3 - .../virtio-iommu-aarch64.aarch64-latest.args | 1 - .../virtio-iommu-aarch64.aarch64-latest.xml | 3 - tests/qemuxmlconftest.c | 6 +- 122 files changed, 40428 insertions(+), 202 deletions(-) create mode 100644 tests/domaincapsdata/qemu_10.2.0-virt.aarch64.xml create mode 100644 tests/domaincapsdata/qemu_10.2.0.aarch64.xml create mode 100644 tests/qemucapabilitiesdata/caps_10.2.0_aarch64.replies create mode 100644 tests/qemucapabilitiesdata/caps_10.2.0_aarch64.xml create mode 100644 tests/qemuxmlconfdata/aarch64-default-cpu-kvm-virt-10.0.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/aarch64-default-cpu-kvm-virt-10.0.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/aarch64-default-cpu-kvm-virt-10.0.xml rename tests/qemuxmlconfdata/{aarch64-default-cpu-kvm-virt-4.2.aarch64-latest.args => aarch64-default-cpu-kvm-virt-4.2.aarch64-10.0.0.args} (100%) rename tests/qemuxmlconfdata/{aarch64-default-cpu-kvm-virt-4.2.aarch64-latest.xml => aarch64-default-cpu-kvm-virt-4.2.aarch64-10.0.0.xml} (100%) create mode 100644 tests/qemuxmlconfdata/aarch64-default-cpu-tcg-virt-10.0.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/aarch64-default-cpu-tcg-virt-10.0.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/aarch64-default-cpu-tcg-virt-10.0.xml rename tests/qemuxmlconfdata/{aarch64-default-cpu-tcg-virt-4.2.aarch64-latest.args => aarch64-default-cpu-tcg-virt-4.2.aarch64-10.0.0.args} (100%) rename tests/qemuxmlconfdata/{aarch64-default-cpu-tcg-virt-4.2.aarch64-latest.xml => aarch64-default-cpu-tcg-virt-4.2.aarch64-10.0.0.xml} (100%) -- 2.51.1

3 11

[PATCH v3] spec: Fix 'libvirt-daemon-driver-storage-zfs' on Fedora 43 and newer
by Peter Krempa 25 Nov '25

25 Nov '25

From: Peter Krempa <pkrempa(a)redhat.com> On Fedora 43 and newer the 'fuse-zfs' package was removed. Commit bd30147e740 added an 'Obsoletes' directive so that the storage driver core package will update properly but hardcoded the obsoleted version as 11.4 (when the change was comitted) similarly to the old sheepdog/rbd packages and disabled the build. Now it is still possible to obtain ZFS support from other means and it may be useful for users to have libvirt's ZFS backend. This patch thus: - re-enables build of 'libvirt-daemon-driver-storage-zfs' on Fedora - removes 'libvirt-daemon-driver-storage-zfs' as 'Requires dependency from 'daemon-driver-storage' meta-package on Fedora 43 and newer - removes dependancy on '/sbin/zpool' and '/sbin/zfs' on Fedora 43 and newer With this the package still is built and installable but will require users to get their ZFS support installed somehow. Fixes: bd30147e740d49fdb5844160e480ca34611f75e5 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- libvirt.spec.in | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) Remove the dependency on the programs too. diff --git a/libvirt.spec.in b/libvirt.spec.in index 8314fbeb34..62af7fb517 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -76,8 +76,10 @@ %define with_storage_gluster 0 %endif -# Fedora had zfs-fuse until F43 -%if 0%{?fedora} && 0%{?fedora} < 43 +# On Fedora 43, the 'zfs-fuse' package was removed, but is obtainable via +# other means. Build the backend, but it's no longer considered to be part +# of 'daemon-driver-storage'. +%if 0%{?fedora} %define with_storage_zfs 0%{!?_without_storage_zfs:1} %else %define with_storage_zfs 0 @@ -667,9 +669,6 @@ Requires: /usr/bin/qemu-img Obsoletes: libvirt-daemon-driver-storage-rbd < 5.2.0 %endif Obsoletes: libvirt-daemon-driver-storage-sheepdog < 8.8.0 - %if !%{with_storage_zfs} -Obsoletes: libvirt-daemon-driver-storage-zfs < 11.4.0 - %endif %description daemon-driver-storage-core The storage driver plugin for the libvirtd daemon, providing @@ -770,9 +769,13 @@ volumes using the ceph protocol. Summary: Storage driver plugin for ZFS Requires: libvirt-daemon-driver-storage-core = %{version}-%{release} Requires: libvirt-libs = %{version}-%{release} -# Support any conforming implementation of zfs +# Starting with Fedora 43 the 'zfs-fuse' is no longer shipped but obtainable +# externally. The package builds fine without these. Users will have to provide +# their own implementation. + %if 0%{?fedora} && 0%{?fedora} < 43 Requires: /sbin/zfs Requires: /sbin/zpool + %endif %description daemon-driver-storage-zfs The storage driver backend adding implementation of the storage APIs for @@ -796,7 +799,10 @@ Requires: libvirt-daemon-driver-storage-gluster = %{version}-%{release} %if %{with_storage_rbd} Requires: libvirt-daemon-driver-storage-rbd = %{version}-%{release} %endif - %if %{with_storage_zfs} +# Starting with Fedora 43 the 'zfs-fuse' is no longer shipped but obtainable +# externally. We do not want to install this as part of 'daemon-driver-storage' +# any more. + %if %{with_storage_zfs} && 0%{?fedora} && 0%{?fedora} < 43 Requires: libvirt-daemon-driver-storage-zfs = %{version}-%{release} %endif -- 2.51.1

3 4

[PATCH] src: fix incorrect build conditional for KVM MSR code
by Daniel P. Berrangé 25 Nov '25

25 Nov '25

From: Daniel P. Berrangé <berrange(a)redhat.com> The condition WITH_LINUX_KVM_H && (defined(__linux__) || defined(__FreeBSD__)) is redundant. If the meson check for linux/kvm.h succeeded, we must be on a Linux host and cannot be on a FreeBSD host. Remove these redundant OS conditions from the MSR code. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/util/virhostcpu.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/src/util/virhostcpu.c b/src/util/virhostcpu.c index c3b4f87de1..09395ddb04 100644 --- a/src/util/virhostcpu.c +++ b/src/util/virhostcpu.c @@ -1328,8 +1328,7 @@ virHostCPUGetMicrocodeVersion(virArch hostArch G_GNUC_UNUSED) #if WITH_LINUX_KVM_H && defined(KVM_GET_MSRS) && \ - (defined(__i386__) || defined(__x86_64__)) && \ - (defined(__linux__) || defined(__FreeBSD__)) + (defined(__i386__) || defined(__x86_64__)) static int virHostCPUGetMSRFromKVM(unsigned long index, uint64_t *result) @@ -1585,8 +1584,7 @@ virHostCPUGetTscInfo(void) } #endif /* WITH_LINUX_KVM_H && defined(KVM_GET_MSRS) && \ - (defined(__i386__) || defined(__x86_64__)) && \ - (defined(__linux__) || defined(__FreeBSD__)) */ + (defined(__i386__) || defined(__x86_64__)) */ int virHostCPUReadSignature(virArch arch, -- 2.51.1

2 2

[PATCH 0/2] Validate 'removable' and support 'dpofua' properties of SCSI disks
by Peter Krempa 24 Nov '25

24 Nov '25

Patch 1 adds a missing ABI stability check for 'removable' and patch 2 implements 'dpofua' for SCSI disks. Peter Krempa (2): virDomainDiskDefCheckABIStability: Add missing check for 'removable' property Add support for 'dpofua' setting for SCSI disks docs/formatdomain.rst | 5 ++++ src/conf/domain_conf.c | 23 +++++++++++++++++++ src/conf/domain_conf.h | 1 + src/conf/domain_validate.c | 7 ++++++ src/conf/schemas/domaincommon.rng | 5 ++++ src/qemu/qemu_command.c | 1 + .../disk-scsi.x86_64-latest.args | 4 ++-- .../disk-scsi.x86_64-latest.xml | 4 ++-- tests/qemuxmlconfdata/disk-scsi.xml | 4 ++-- 9 files changed, 48 insertions(+), 6 deletions(-) -- 2.51.1

2 3

[PATCH v2] spec: Fix 'libvirt-daemon-driver-storage-zfs' on Fedora 43 and newer
by Peter Krempa 24 Nov '25

24 Nov '25

From: Peter Krempa <pkrempa(a)redhat.com> On Fedora 43 and newer the 'fuse-zfs' package was removed. Commit bd30147e740 added an 'Obsoletes' directive so that the storage driver core package will update properly but hardcoded the obsoleted version as 11.4 (when the change was comitted) similarly to the old sheepdog/rbd packages and disabled the build. Now it is still possible to obtain ZFS support from other means and it may be useful for users to have libvirt's ZFS backend. This patch thus: - re-enables build of 'libvirt-daemon-driver-storage-zfs' on Fedora - removes 'libvirt-daemon-driver-storage-zfs' as 'Requires dependency from 'daemon-driver-storage' meta-package on Fedora 43 and newer With this the package still is built and installable but will require users to get their ZFS support installed somehow. Fixes: bd30147e740d49fdb5844160e480ca34611f75e5 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- libvirt.spec.in | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) I originally thought that the 'Requires' dependancy requiring /sbin/zpool and /sbin/zfs would need to be dropped but even without 'zfs-fuse' on F43 it builds fine. diff --git a/libvirt.spec.in b/libvirt.spec.in index 8314fbeb34..1bfe7d715b 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -76,8 +76,10 @@ %define with_storage_gluster 0 %endif -# Fedora had zfs-fuse until F43 -%if 0%{?fedora} && 0%{?fedora} < 43 +# On Fedora 43, the 'zfs-fuse' package was removed, but is obtainable via +# other means. Build the backend, but it's no longer considered to be part +# of 'daemon-driver-storage'. +%if 0%{?fedora} %define with_storage_zfs 0%{!?_without_storage_zfs:1} %else %define with_storage_zfs 0 @@ -667,9 +669,6 @@ Requires: /usr/bin/qemu-img Obsoletes: libvirt-daemon-driver-storage-rbd < 5.2.0 %endif Obsoletes: libvirt-daemon-driver-storage-sheepdog < 8.8.0 - %if !%{with_storage_zfs} -Obsoletes: libvirt-daemon-driver-storage-zfs < 11.4.0 - %endif %description daemon-driver-storage-core The storage driver plugin for the libvirtd daemon, providing @@ -796,7 +795,10 @@ Requires: libvirt-daemon-driver-storage-gluster = %{version}-%{release} %if %{with_storage_rbd} Requires: libvirt-daemon-driver-storage-rbd = %{version}-%{release} %endif - %if %{with_storage_zfs} +# Starting with Fedora 43 the 'zfs-fuse' is no longer shipped but obtainable +# externally. We do not want to install this as part of 'daemon-driver-storage' +# any more. + %if %{with_storage_zfs} && 0%{?fedora} && 0%{?fedora} < 43 Requires: libvirt-daemon-driver-storage-zfs = %{version}-%{release} %endif -- 2.51.1

2 1

[RFC PATCH v7 0/3] Fix virtio console port assignment issue
by Aaron M. Brown 24 Nov '25

24 Nov '25

Changelog: --- v7: - Removed some unnecessary definitions from test xml - Moved edge case reservation logic to virDomainVirtioSerialAddrAssign --- v6: - Fixed issue with console auto port index starting from 1 instead of 0 --- v5: - Added xml tests to tests/qemuxmlconfdata - Fixed virito -> virtio typo in commit message --- v4: - Update commit messages --- v3: - Added Reviewed-By - Included CI Results Link --- v2: - Split patch into two commits - Added fixes tag --- This libvirt patch series does the following: 1. fixes an issue with virtio console device port auto assignment on virtio-serial buses 2. updates console port reservation comment and changes the allowZero variable to allowPortZero for clarity 3. Adds tests for virtio console on the vioserial bus Currently in libvirt, a virtio console device cannot be auto assigned a port number greater than zero on a virtio-serial bus. This leads to port collision errors when adding more than 1 virtio console device on a single virtio-serial bus. After applying this patch, one can add multiple console ports under a single virtio-serial bus. Here is a link to CI results for this series: https://gitlab.com/aaronbmalik/libvirt/-/pipelines/2047914492 Aaron M. Brown (3): tests: Add console-virtio-serial-autoassign-address tests domain_addr.c: Fix virtio console port autoassign on virtio-serial bus domain_addr.c: update virtconsole port reservation comment and allowZero var src/conf/domain_addr.c | 51 +++++++++++++----- ...rial-autoassign-address.x86_64-latest.args | 42 +++++++++++++++ ...erial-autoassign-address.x86_64-latest.xml | 54 +++++++++++++++++++ ...nsole-virtio-serial-autoassign-address.xml | 40 ++++++++++++++ tests/qemuxmlconftest.c | 1 + 5 files changed, 175 insertions(+), 13 deletions(-) create mode 100644 tests/qemuxmlconfdata/console-virtio-serial-autoassign-address.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/console-virtio-serial-autoassign-address.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/console-virtio-serial-autoassign-address.xml -- 2.39.5 (Apple Git-154)

4 10

[PATCH v2 0/3] qemu: fix capabilities reporting for TDX
by Daniel P. Berrangé 24 Nov '25

24 Nov '25

The capabilities reporting merged for TDX was flawed because it would always report TDX as supported simply if QEMU was new enough to have 'tdx-guest'. Unfortunately the 'query-tdx-capabilities' QMP command that was in early postings: https://mail.gnu.org/archive/html/qemu-devel/2021-07/msg01689.html went missing and I'm not seeing an alternative way to query QEMU to see if TDX is actually launchable. So in these patches I open /dev/kvm and directly ask of the 'TDX' VM type is supported by KVM, which IIUC is equivalent to waht the original 'query-tdx-capabilities' patch was doing. In v2: * Unconditionally report TDX on all arches * Also unconditionally report s390 prot-virt on all arches * Use VIR_AUTOCLOSE * Sanity check ioctl return status < 0 * Remove dead error reporting paths * Add missing ioctl.h header include Daniel P. Berrangé (3): qemu: correctly detect working TDX support qemu: always report TDX feature caps on x86 qemu: always report s390 prot-virt feature in domain caps src/qemu/qemu_capabilities.c | 70 ++++++++++++++++--- src/qemu/qemu_capabilities.h | 3 + .../qemu_10.0.0-q35.x86_64+amdsev.xml | 2 + .../domaincapsdata/qemu_10.0.0-q35.x86_64.xml | 2 + .../qemu_10.0.0-tcg.x86_64+amdsev.xml | 2 + .../domaincapsdata/qemu_10.0.0-tcg.x86_64.xml | 2 + .../qemu_10.0.0-virt.aarch64.xml | 2 + tests/domaincapsdata/qemu_10.0.0.aarch64.xml | 2 + tests/domaincapsdata/qemu_10.0.0.ppc64.xml | 2 + tests/domaincapsdata/qemu_10.0.0.s390x.xml | 1 + .../qemu_10.0.0.x86_64+amdsev.xml | 2 + tests/domaincapsdata/qemu_10.0.0.x86_64.xml | 2 + .../qemu_10.1.0-q35.x86_64+inteltdx.xml | 1 + .../domaincapsdata/qemu_10.1.0-q35.x86_64.xml | 1 + .../qemu_10.1.0-tcg.x86_64+inteltdx.xml | 2 + .../domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 2 + .../qemu_10.1.0.x86_64+inteltdx.xml | 1 + tests/domaincapsdata/qemu_10.1.0.x86_64.xml | 1 + .../qemu_10.2.0-q35.x86_64+mshv.xml | 1 + .../domaincapsdata/qemu_10.2.0-q35.x86_64.xml | 1 + .../qemu_10.2.0-tcg.x86_64+mshv.xml | 2 + .../domaincapsdata/qemu_10.2.0-tcg.x86_64.xml | 2 + .../qemu_10.2.0.x86_64+mshv.xml | 1 + tests/domaincapsdata/qemu_10.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 2 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 2 + tests/domaincapsdata/qemu_6.2.0.ppc64.xml | 2 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 2 + .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 2 + .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 2 + tests/domaincapsdata/qemu_7.0.0.ppc64.xml | 2 + tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 2 + .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 2 + .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 2 + tests/domaincapsdata/qemu_7.1.0.ppc64.xml | 2 + tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 2 + .../qemu_7.2.0-hvf.x86_64+hvf.xml | 2 + .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 2 + .../qemu_7.2.0-tcg.x86_64+hvf.xml | 2 + .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 2 + tests/domaincapsdata/qemu_7.2.0.ppc.xml | 2 + tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 2 + .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 2 + .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 2 + tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 2 + .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 2 + .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 2 + tests/domaincapsdata/qemu_8.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 2 + .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 2 + .../qemu_8.2.0-tcg-virt.loongarch64.xml | 2 + .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 2 + .../qemu_8.2.0-virt.aarch64.xml | 2 + .../qemu_8.2.0-virt.loongarch64.xml | 2 + tests/domaincapsdata/qemu_8.2.0.aarch64.xml | 2 + tests/domaincapsdata/qemu_8.2.0.armv7l.xml | 2 + tests/domaincapsdata/qemu_8.2.0.s390x.xml | 1 + tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 2 + .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 2 + .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 2 + tests/domaincapsdata/qemu_9.0.0.sparc.xml | 2 + tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 2 + .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 2 + .../qemu_9.1.0-tcg-virt.riscv64.xml | 2 + .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 2 + .../qemu_9.1.0-virt.riscv64.xml | 2 + tests/domaincapsdata/qemu_9.1.0.s390x.xml | 1 + tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 2 + .../qemu_9.2.0-hvf.aarch64+hvf.xml | 2 + .../qemu_9.2.0-q35.x86_64+amdsev.xml | 2 + .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 2 + .../qemu_9.2.0-tcg.x86_64+amdsev.xml | 2 + .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 2 + tests/domaincapsdata/qemu_9.2.0.s390x.xml | 1 + .../qemu_9.2.0.x86_64+amdsev.xml | 2 + tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 2 + tests/domaincapsmock.c | 6 ++ 77 files changed, 205 insertions(+), 9 deletions(-) -- 2.51.1

2 7

[PATCH v1 0/4] s390x CPU Models: Fix deprecated_features='on'
by Collin Walling 24 Nov '25

24 Nov '25

Currently, when setting the deprecated_features attribute to 'on', all known deprecated features will be enabled for the CPU model, including ones that are *not* supported by the model. These patches query an additional set of deprecated features by performing a CPU model expansion on host-model with type "static". The list of deprecated features reported from this command will reflect features that may be enabled on the model without error. Now, when a user specifies deprecated_features='on' in the domain XML, only the features that are still supported by the model are requested to be turned on for the guest. This can be helpful for e.g. tests that may wish to check CPU model compatability in certain environments. Collin Walling (4): qemu: rename modelinfo's deprecated_props to full_dep_props qemu: refactor load/format of deprecated features qemu: query and cache static/host deprecated features qemu: only allow enabling deprecated features that are supported src/qemu/qemu_capabilities.c | 106 ++++++++++++------ src/qemu/qemu_monitor.c | 6 +- src/qemu/qemu_monitor.h | 3 +- src/qemu/qemu_monitor_json.c | 17 ++- .../caps_10.0.0_s390x.xml | 6 + .../qemucapabilitiesdata/caps_9.1.0_s390x.xml | 6 + .../qemucapabilitiesdata/caps_9.2.0_s390x.xml | 6 + 7 files changed, 112 insertions(+), 38 deletions(-) -- 2.51.1

3 9

[PATCH] spec: Fix 'obsoletes' for 'libvirt-daemon-driver-storage-zfs'
by Peter Krempa 24 Nov '25

24 Nov '25

From: Peter Krempa <pkrempa(a)redhat.com> On Fedora 43 and newer the 'fuse-zfs' package was removed. Commit bd30147e740 added an 'Obsoletes' directive so that the storage driver core package will update properly but hardcoded the obsoleted version as 11.4 (when the change was comitted) similarly to the old sheepdog/rbd packages. Unfortunately that doesn't work if the sub-package removal happened based on an external dependancy, rather than complete removal of said module in libvirt. If users have e.g. virt-preview repos enabled they'll get libvirt-11.9 currently installed, but the obsoleted version is just 11.4, thus upgrades to Fedora 43 with virt-preview are broken. Fix this by obsoleting everything up to the current build. Fixes: bd30147e740d49fdb5844160e480ca34611f75e5 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- libvirt.spec.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 8314fbeb34..f1bfd5e652 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -668,7 +668,7 @@ Obsoletes: libvirt-daemon-driver-storage-rbd < 5.2.0 %endif Obsoletes: libvirt-daemon-driver-storage-sheepdog < 8.8.0 %if !%{with_storage_zfs} -Obsoletes: libvirt-daemon-driver-storage-zfs < 11.4.0 +Obsoletes: libvirt-daemon-driver-storage-zfs <= %{version}-%{release} %endif %description daemon-driver-storage-core -- 2.51.1

3 7

[PATCH] src: cap the data size in stream I/O functions
by Daniel P. Berrangé 24 Nov '25

24 Nov '25

From: Daniel P. Berrangé <berrange(a)redhat.com> The main stream I/O functions have a design flaw in that they accept 'size_t' as the input data length, while intending to return the amount actually processed in an 'int'. Fortunately all functions explicitly document that less data may be processed than requested, and with the remote driver data cap we will never get anywhere near exceeding an 'int' even on 32-bit. For sanity, however, lets explicitly cap the data size in the public API to fix the design flaw. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/libvirt-stream.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/src/libvirt-stream.c b/src/libvirt-stream.c index ca4d90140e..61c700c19e 100644 --- a/src/libvirt-stream.c +++ b/src/libvirt-stream.c @@ -182,6 +182,15 @@ virStreamSend(virStreamPtr stream, virCheckStreamReturn(stream, -1); virCheckNonNullArgGoto(data, error); + /* + * We accept size_t which could be 2^64-1, but we need to return + * bytes processed in a signed int, so must cap the request to + * fit in a 'signed int' on a 32-bit platform. + */ + if (nbytes > G_MAXINT32) { + nbytes = G_MAXINT32; + } + if (stream->driver && stream->driver->streamSend) { int ret; @@ -279,6 +288,15 @@ virStreamRecv(virStreamPtr stream, virCheckStreamReturn(stream, -1); virCheckNonNullArgGoto(data, error); + /* + * We accept size_t which could be 2^64-1, but we need to return + * bytes processed in a signed int, so must cap the request to + * fit in a 'signed int' on a 32-bit platform. + */ + if (nbytes > G_MAXINT32) { + nbytes = G_MAXINT32; + } + if (stream->driver && stream->driver->streamRecv) { int ret; @@ -370,6 +388,15 @@ virStreamRecvFlags(virStreamPtr stream, virCheckStreamReturn(stream, -1); virCheckNonNullArgGoto(data, error); + /* + * We accept size_t which could be 2^64-1, but we need to return + * bytes processed in a signed int, so must cap the request to + * fit in a 'signed int' on a 32-bit platform. + */ + if (nbytes > G_MAXINT32) { + nbytes = G_MAXINT32; + } + if (stream->driver && stream->driver->streamRecvFlags) { int ret; -- 2.51.1

2 1

[PATCH] include: fix version for recent block stats constants
by Daniel P. Berrangé 24 Nov '25

24 Nov '25

From: Daniel P. Berrangé <berrange(a)redhat.com> The recent commit: commit 166be0d48cedb8def6085bd10ede4b1875eb2ceb Author: Peter Krempa <pkrempa(a)redhat.com> AuthorDate: Fri Sep 12 13:32:36 2025 +0200 Commit: Peter Krempa <pkrempa(a)redhat.com> CommitDate: Wed Nov 5 14:27:57 2025 +0100 Expose qemu timed block statistics via bulk stats API had a bit of delay between authoring and merging, such that the merged version number was outdated. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- include/libvirt/libvirt-domain.h | 60 ++++++++++++++++---------------- 1 file changed, 30 insertions(+), 30 deletions(-) diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-domain.h index 56bd085ef5..e16c1925cd 100644 --- a/include/libvirt/libvirt-domain.h +++ b/include/libvirt/libvirt-domain.h @@ -3497,7 +3497,7 @@ struct _virDomainStatsRecord { * Alignment requirement, in bytes, for offset/length of I/O requests, as * unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LIMITS_REQUEST_ALIGNMENT ".limits.request_alignment" @@ -3509,7 +3509,7 @@ struct _virDomainStatsRecord { * * Maximum number of bytes that can be discarded at once, as unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LIMITS_DISCARD_MAX ".limits.discard_max" @@ -3521,7 +3521,7 @@ struct _virDomainStatsRecord { * * Optimal alignment for discard requests in bytes, as unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LIMITS_DISCARD_ALIGNMENT ".limits.discard_alignment" @@ -3533,7 +3533,7 @@ struct _virDomainStatsRecord { * * Maximum number of bytes that can be zeroed out at once, as unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LIMITS_WRITE_ZEROES_MAX ".limits.write_zeroes_max" @@ -3545,7 +3545,7 @@ struct _virDomainStatsRecord { * * Optimal alignment for write_zeroes requests in bytes, as unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LIMITS_WRITE_ZEROES_ALIGNMENT ".limits.write_zeroes_alignment" @@ -3557,7 +3557,7 @@ struct _virDomainStatsRecord { * * Optimal transfer length in bytes, as unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LIMITS_TRANSFER_OPTIMAL ".limits.transfer_optimal" @@ -3569,7 +3569,7 @@ struct _virDomainStatsRecord { * * Maximal transfer length in bytes, as unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LIMITS_TRANSFER_MAX ".limits.transfer_max" @@ -3582,7 +3582,7 @@ struct _virDomainStatsRecord { * Maximal hardware transfer length of requests bypassing kernel IO scheduler * in bytes, as unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LIMITS_TRANSFER_HW_MAX ".limits.transfer_hw_max" @@ -3594,7 +3594,7 @@ struct _virDomainStatsRecord { * * Maximum number of scatter/gather elements, as unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LIMITS_IOV_MAX ".limits.iov_max" @@ -3607,7 +3607,7 @@ struct _virDomainStatsRecord { * Maximal number of scatter/gather elements of requests bypassing kernel IO * scheduler, as unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LIMITS_IOV_HW_MAX ".limits.iov_hw_max" @@ -3620,7 +3620,7 @@ struct _virDomainStatsRecord { * memory alignment in bytes so that no bounce buffer is needed, as * unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LIMITS_MEMORY_ALIGNMENT_MINIMAL ".limits.memory_alignment_minimal" @@ -3633,7 +3633,7 @@ struct _virDomainStatsRecord { * memory alignment in bytes that is used for bounce buffers, as * unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_LIMITS_MEMORY_ALIGNMENT_OPTIMAL ".limits.memory_alignment_optimal" @@ -3643,7 +3643,7 @@ struct _virDomainStatsRecord { * Number of groups of statistics accounted in a configured time intervals as * unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_COUNT ".timed_group.count" @@ -3654,7 +3654,7 @@ struct _virDomainStatsRecord { * prefix, the entry number formatted as an unsigned integer and one of the * timed group suffix parameters to form a complete paramter name. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_PREFIX ".timed_group." @@ -3664,7 +3664,7 @@ struct _virDomainStatsRecord { * The time interval in seconds as unsigned long long for which the statistics * in this group were collected. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_SUFFIX_INTERVAL ".interval" @@ -3674,7 +3674,7 @@ struct _virDomainStatsRecord { * Minimum latency of read operations in the defined interval, in nanoseconds as * unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_SUFFIX_RD_LATENCY_MIN ".rd_latency_min" @@ -3684,7 +3684,7 @@ struct _virDomainStatsRecord { * Maximum latency of read operations in the defined interval, in nanoseconds as * unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_SUFFIX_RD_LATENCY_MAX ".rd_latency_max" @@ -3694,7 +3694,7 @@ struct _virDomainStatsRecord { * Average latency of read operations in the defined interval, in nanoseconds as * unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_SUFFIX_RD_LATENCY_AVG ".rd_latency_avg" @@ -3704,7 +3704,7 @@ struct _virDomainStatsRecord { * Minimum latency of write operations in the defined interval, in nanoseconds * as unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_SUFFIX_WR_LATENCY_MIN ".wr_latency_min" @@ -3714,7 +3714,7 @@ struct _virDomainStatsRecord { * Maximum latency of write operations in the defined interval, in nanoseconds * as unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_SUFFIX_WR_LATENCY_MAX ".wr_latency_max" @@ -3724,7 +3724,7 @@ struct _virDomainStatsRecord { * Average latency of write operations in the defined interval, in nanoseconds * as unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_SUFFIX_WR_LATENCY_AVG ".wr_latency_avg" @@ -3733,7 +3733,7 @@ struct _virDomainStatsRecord { * Minimum latency of zone append operations in the defined interval, in * nanoseconds as unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_SUFFIX_ZONE_APPEND_LATENCY_MIN ".zone_append_latency_min" @@ -3743,7 +3743,7 @@ struct _virDomainStatsRecord { * Maximum latency of zone append operations in the defined interval, in * nanoseconds as unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_SUFFIX_ZONE_APPEND_LATENCY_MAX ".zone_append_latency_max" @@ -3753,7 +3753,7 @@ struct _virDomainStatsRecord { * Average latency of zone append operations in the defined interval, in * nanoseconds as unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_SUFFIX_ZONE_APPEND_LATENCY_AVG ".zone_append_latency_avg" @@ -3763,7 +3763,7 @@ struct _virDomainStatsRecord { * Minimum latency of flush operations in the defined interval, in nanoseconds * as unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_SUFFIX_FLUSH_LATENCY_MIN ".flush_latency_min" @@ -3773,7 +3773,7 @@ struct _virDomainStatsRecord { * Maximum latency of flush operations in the defined interval, in nanoseconds * as unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_SUFFIX_FLUSH_LATENCY_MAX ".flush_latency_max" @@ -3783,7 +3783,7 @@ struct _virDomainStatsRecord { * Average latency of flush operations in the defined interval, in nanoseconds * as unsigned long long. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_SUFFIX_FLUSH_LATENCY_AVG ".flush_latency_avg" @@ -3792,7 +3792,7 @@ struct _virDomainStatsRecord { * * Average number of pending read operations in the defined interval as double. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_SUFFIX_RD_QUEUE_DEPTH_AVG ".rd_queue_depth_avg" @@ -3801,7 +3801,7 @@ struct _virDomainStatsRecord { * * Average number of pending write operations in the defined interval as double. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_SUFFIX_WR_QUEUE_DEPTH_AVG ".wr_queue_depth_avg" @@ -3811,7 +3811,7 @@ struct _virDomainStatsRecord { * Average number of pending zone append operations in the defined interval as * double. * - * Since: 11.9.0 + * Since: 11.10.0 */ # define VIR_DOMAIN_STATS_BLOCK_SUFFIX_TIMED_GROUP_SUFFIX_ZONE_APPEND_QUEUE_DEPTH_AVG ".zone_append_queue_depth_avg" -- 2.51.1

2 1

[PATCH 0/4] Add link to security notices to main page and improve reuse of assets in sub-projects
by Peter Krempa 24 Nov '25

24 Nov '25

Build version browsable at: https://pipo.sk.gitlab.io/-/libvirt/-/jobs/12191476209/artifacts/website/in… Peter Krempa (4): docs: index: Link to security notices from home page docs: css: Split out any main-page CSS to local.css docs: site.xsl: Use separate 'asset_href_base' and 'link_href_base' docs: page.xsl: Convert repository edit URI into a parameter docs/css/local.css | 3 +++ docs/css/main.css | 4 +--- docs/css/meson.build | 1 + docs/go/meson.build | 4 +++- docs/html/meson.build | 4 +++- docs/index.rst | 4 ++-- docs/kbase/internals/meson.build | 4 +++- docs/kbase/meson.build | 4 +++- docs/logos/meson.build | 4 +++- docs/manpages/meson.build | 4 +++- docs/meson.build | 4 +++- docs/page.xsl | 5 +++-- docs/site.xsl | 5 +++-- 13 files changed, 34 insertions(+), 16 deletions(-) create mode 100644 docs/css/local.css -- 2.51.1

2 6

[RFC v2 0/5] cover: RFE libvirt secret encryption on disk
by Arun Menon 24 Nov '25

24 Nov '25

Libvirt secrets are stored unencrypted on the disk. With this series we want to start encrypting the secrets. 1. Introduce the GnuTLS decryption wrapper functions that work exact opposite to the encryption wrappers. 2. Add a new service called virt-secrets-init-encryption, that is linked to the virtsecretd service. virtsecretd service only starts after the new service generates a random encryption key. 3. Add a new secrets.conf configuration file that helps user to set a. secrets_encryption_key - allows the user to specify the encryption key file path, in case the default key is not to be used. b. encrypt_data - set to 0 or 1. If set to 1, then the newly added secrets will be encrypted. 4. Add functionality to store the encryption scheme (none, aes256cbc, etc.) to the disk. This will be helpful during service restarts or migrating from an older version. Depending on the scheme, the secrets will be reloaded to the daemon. If no scheme is present in the xml configuration, then the secrets will be stored/loaded in the default base64 encoded format. 5. Once we have the encryption key, and a reliable way to tell the daemon what encryption scheme the secret object is using, we can encrypt the secrets on disk and store them in <uuid>.<encryption_scheme> format. It is important to note that if the encryption key is changed between restarts, then the respective secret will not be loaded by the driver. This is a sincere attempt to improve upon the already submitted patch https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/KE6G… Resolves: https://issues.redhat.com/browse/RHEL-7125 --- Changes in v2: - Corrected the encryption key length check. It should be 32. - Added a new patch that introduces the encryption scheme attribute. This will help us identify which secrets are encrypted. - A new systemd unit service file added that starts before virtsecretd, helping us to construct a random encryption key and pass it to the virtsecretd service. - Parsing logic of secrets.conf moved to a separate file. - Spec file changes, augeas. Arun Menon (5): util: Add support for GnuTLS decryption secret: Set up default encrypted secret key for the virtsecretd service secret: Add secrets.conf configuration file and parse it secret: Add encryptionScheme attribute to the secrets xml configuration secret: Add functionality to load and save secrets in encrypted format include/libvirt/libvirt-secret.h | 20 ++ libvirt.spec.in | 10 + po/POTFILES | 1 + src/conf/meson.build | 1 + src/conf/schemas/secret.rng | 5 + src/conf/secret_conf.c | 21 +++ src/conf/secret_conf.h | 1 + src/conf/secret_config.c | 207 +++++++++++++++++++++ src/conf/secret_config.h | 48 +++++ src/conf/virsecretobj.c | 165 ++++++++++++---- src/conf/virsecretobj.h | 10 +- src/libvirt_private.syms | 3 + src/secret/libvirt_secrets.aug | 40 ++++ src/secret/meson.build | 26 +++ src/secret/secret-init-encryption.in | 11 ++ src/secret/secret_driver.c | 23 ++- src/secret/secrets.conf.in | 12 ++ src/secret/test_libvirt_secrets.aug.in | 6 + src/secret/virtsecretd.service.extra.in | 8 + src/util/vircrypto.c | 128 ++++++++++++- src/util/vircrypto.h | 8 + src/util/virsecret.c | 4 + src/util/virsecret.h | 1 + tests/secretxml2xmlin/usage-ceph-space.xml | 1 + tests/secretxml2xmlin/usage-ceph.xml | 1 + tests/secretxml2xmlin/usage-iscsi.xml | 1 + tests/secretxml2xmlin/usage-tls.xml | 1 + tests/secretxml2xmlin/usage-volume.xml | 1 + tests/secretxml2xmlin/usage-vtpm.xml | 1 + tests/vircryptotest.c | 65 +++++++ 30 files changed, 788 insertions(+), 42 deletions(-) create mode 100644 src/conf/secret_config.c create mode 100644 src/conf/secret_config.h create mode 100644 src/secret/libvirt_secrets.aug create mode 100644 src/secret/secret-init-encryption.in create mode 100644 src/secret/secrets.conf.in create mode 100644 src/secret/test_libvirt_secrets.aug.in -- 2.51.1

3 17

[PATCH v2 1/2] docs: bhyve: document VNC's wait attribute
by Roman Bogorodskiy 24 Nov '25

24 Nov '25

Document the new VNC's 'wait' attribute in formatdomain.rst and drvbhyve.rst. Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- docs/drvbhyve.rst | 10 ++++++++++ docs/formatdomain.rst | 4 ++++ 2 files changed, 14 insertions(+) diff --git a/docs/drvbhyve.rst b/docs/drvbhyve.rst index 73372ff7cf..c0f4cd8a1f 100644 --- a/docs/drvbhyve.rst +++ b/docs/drvbhyve.rst @@ -429,6 +429,16 @@ Note: VNC password authentication is known to be cryptographically weak. Additionally, the password is passed as a command line argument in clear text. Make sure you understand the risks associated with this feature before using it. +:since:`Since 11.10.0`, the guest can be configured to wait for an incoming +VNC connection before booting: + +:: + + <graphics type='vnc' port='5904' wait='yes'> + <listen type='address' address='127.0.0.1'/> + </graphics> + + Clock configuration ~~~~~~~~~~~~~~~~~~~ diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index c6d0b183d0..3d3a6b5a6e 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -6902,6 +6902,10 @@ interaction with the admin. ID is specified, then the default audio backend will be used. :since:`Since 7.2.0, qemu`. + The optional ``wait`` attribute, when set to ``yes``, causes the guest + to wait for an incoming VNC connection before booting. + :since:`Since 11.10.0, bhyve`. + ``spice`` :since:`Since 0.8.6` Starts a SPICE server. The ``port`` attribute specifies the TCP port number (with -1 as legacy syntax indicating that it should be -- 2.51.2

2 3

[PATCH] ci: refresh with 'lcitool manifest'
by Michal Privoznik 24 Nov '25

24 Nov '25

From: Michal Privoznik <mprivozn(a)redhat.com> - Add Fedora 43 - Remove EOL Fedora 41 - Switch mingw from Fedora 42 to Fedora 43 - Switch integration tests from Fedora 41 to Fedora 43 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Depends on the following MRs: https://gitlab.com/libvirt/libvirt-python/-/merge_requests/181 https://gitlab.com/libvirt/libvirt-perl/-/merge_requests/141 Green pipeline: https://gitlab.com/MichalPrivoznik/libvirt/-/pipelines/2172379522 ...-mingw32.sh => fedora-43-cross-mingw32.sh} | 0 ...-mingw64.sh => fedora-43-cross-mingw64.sh} | 0 ci/buildenv/{fedora-41.sh => fedora-43.sh} | 0 ...ile => fedora-43-cross-mingw32.Dockerfile} | 2 +- ...ile => fedora-43-cross-mingw64.Dockerfile} | 2 +- ...ora-41.Dockerfile => fedora-43.Dockerfile} | 2 +- ci/gitlab/builds.yml | 46 +++++++++---------- ci/gitlab/containers.yml | 22 ++++----- ci/integration.yml | 20 ++++---- ci/manifest.yml | 16 +++---- 10 files changed, 55 insertions(+), 55 deletions(-) rename ci/buildenv/{fedora-42-cross-mingw32.sh => fedora-43-cross-mingw32.sh} (100%) rename ci/buildenv/{fedora-42-cross-mingw64.sh => fedora-43-cross-mingw64.sh} (100%) rename ci/buildenv/{fedora-41.sh => fedora-43.sh} (100%) rename ci/containers/{fedora-42-cross-mingw32.Dockerfile => fedora-43-cross-mingw32.Dockerfile} (98%) rename ci/containers/{fedora-42-cross-mingw64.Dockerfile => fedora-43-cross-mingw64.Dockerfile} (98%) rename ci/containers/{fedora-41.Dockerfile => fedora-43.Dockerfile} (98%) diff --git a/ci/buildenv/fedora-42-cross-mingw32.sh b/ci/buildenv/fedora-43-cross-mingw32.sh similarity index 100% rename from ci/buildenv/fedora-42-cross-mingw32.sh rename to ci/buildenv/fedora-43-cross-mingw32.sh diff --git a/ci/buildenv/fedora-42-cross-mingw64.sh b/ci/buildenv/fedora-43-cross-mingw64.sh similarity index 100% rename from ci/buildenv/fedora-42-cross-mingw64.sh rename to ci/buildenv/fedora-43-cross-mingw64.sh diff --git a/ci/buildenv/fedora-41.sh b/ci/buildenv/fedora-43.sh similarity index 100% rename from ci/buildenv/fedora-41.sh rename to ci/buildenv/fedora-43.sh diff --git a/ci/containers/fedora-42-cross-mingw32.Dockerfile b/ci/containers/fedora-43-cross-mingw32.Dockerfile similarity index 98% rename from ci/containers/fedora-42-cross-mingw32.Dockerfile rename to ci/containers/fedora-43-cross-mingw32.Dockerfile index 94d9378850..de7bee20e1 100644 --- a/ci/containers/fedora-42-cross-mingw32.Dockerfile +++ b/ci/containers/fedora-43-cross-mingw32.Dockerfile @@ -4,7 +4,7 @@ # # https://gitlab.com/libvirt/libvirt-ci -FROM registry.fedoraproject.org/fedora:42 +FROM registry.fedoraproject.org/fedora:43 RUN dnf install -y nosync && \ printf '#!/bin/sh\n\ diff --git a/ci/containers/fedora-42-cross-mingw64.Dockerfile b/ci/containers/fedora-43-cross-mingw64.Dockerfile similarity index 98% rename from ci/containers/fedora-42-cross-mingw64.Dockerfile rename to ci/containers/fedora-43-cross-mingw64.Dockerfile index 9d59a70975..ff6c3f8aa9 100644 --- a/ci/containers/fedora-42-cross-mingw64.Dockerfile +++ b/ci/containers/fedora-43-cross-mingw64.Dockerfile @@ -4,7 +4,7 @@ # # https://gitlab.com/libvirt/libvirt-ci -FROM registry.fedoraproject.org/fedora:42 +FROM registry.fedoraproject.org/fedora:43 RUN dnf install -y nosync && \ printf '#!/bin/sh\n\ diff --git a/ci/containers/fedora-41.Dockerfile b/ci/containers/fedora-43.Dockerfile similarity index 98% rename from ci/containers/fedora-41.Dockerfile rename to ci/containers/fedora-43.Dockerfile index 89732dd529..55f68a5839 100644 --- a/ci/containers/fedora-41.Dockerfile +++ b/ci/containers/fedora-43.Dockerfile @@ -4,7 +4,7 @@ # # https://gitlab.com/libvirt/libvirt-ci -FROM registry.fedoraproject.org/fedora:41 +FROM registry.fedoraproject.org/fedora:43 RUN dnf install -y nosync && \ printf '#!/bin/sh\n\ diff --git a/ci/gitlab/builds.yml b/ci/gitlab/builds.yml index ae691862c2..950b7b9282 100644 --- a/ci/gitlab/builds.yml +++ b/ci/gitlab/builds.yml @@ -103,21 +103,6 @@ x86_64-debian-sid: TARGET_BASE_IMAGE: docker.io/library/debian:sid-slim -x86_64-fedora-41: - extends: .native_build_job - needs: - - job: x86_64-fedora-41-container - optional: true - allow_failure: false - variables: - NAME: fedora-41 - TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:41 - artifacts: - expire_in: 1 day - paths: - - libvirt-rpms - - x86_64-fedora-42: extends: .native_build_job needs: @@ -133,6 +118,21 @@ x86_64-fedora-42: - libvirt-rpms +x86_64-fedora-43: + extends: .native_build_job + needs: + - job: x86_64-fedora-43-container + optional: true + allow_failure: false + variables: + NAME: fedora-43 + TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:43 + artifacts: + expire_in: 1 day + paths: + - libvirt-rpms + + x86_64-fedora-rawhide: extends: .native_build_job needs: @@ -416,29 +416,29 @@ s390x-debian-sid: TARGET_BASE_IMAGE: docker.io/library/debian:sid-slim -mingw32-fedora-42: +mingw32-fedora-43: extends: .cross_build_job needs: - - job: mingw32-fedora-42-container + - job: mingw32-fedora-43-container optional: true allow_failure: false variables: CROSS: mingw32 JOB_OPTIONAL: 1 - NAME: fedora-42 - TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:42 + NAME: fedora-43 + TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:43 -mingw64-fedora-42: +mingw64-fedora-43: extends: .cross_build_job needs: - - job: mingw64-fedora-42-container + - job: mingw64-fedora-43-container optional: true allow_failure: false variables: CROSS: mingw64 - NAME: fedora-42 - TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:42 + NAME: fedora-43 + TARGET_BASE_IMAGE: registry.fedoraproject.org/fedora:43 mingw32-fedora-rawhide: diff --git a/ci/gitlab/containers.yml b/ci/gitlab/containers.yml index 0650e4781c..cd2262e273 100644 --- a/ci/gitlab/containers.yml +++ b/ci/gitlab/containers.yml @@ -49,13 +49,6 @@ x86_64-debian-sid-container: NAME: debian-sid -x86_64-fedora-41-container: - extends: .container_job - allow_failure: false - variables: - NAME: fedora-41 - - x86_64-fedora-42-container: extends: .container_job allow_failure: false @@ -63,6 +56,13 @@ x86_64-fedora-42-container: NAME: fedora-42 +x86_64-fedora-43-container: + extends: .container_job + allow_failure: false + variables: + NAME: fedora-43 + + x86_64-fedora-rawhide-container: extends: .container_job allow_failure: true @@ -220,19 +220,19 @@ s390x-debian-sid-container: NAME: debian-sid-cross-s390x -mingw32-fedora-42-container: +mingw32-fedora-43-container: extends: .container_job allow_failure: false variables: JOB_OPTIONAL: 1 - NAME: fedora-42-cross-mingw32 + NAME: fedora-43-cross-mingw32 -mingw64-fedora-42-container: +mingw64-fedora-43-container: extends: .container_job allow_failure: false variables: - NAME: fedora-42-cross-mingw64 + NAME: fedora-43-cross-mingw64 mingw32-fedora-rawhide-container: diff --git a/ci/integration.yml b/ci/integration.yml index 2c5e5a65bc..b7e301b4c0 100644 --- a/ci/integration.yml +++ b/ci/integration.yml @@ -29,23 +29,23 @@ centos-stream-9-tests: # and libvirt-python CI jobs, so the new target needs to be introduced # there before it can be used here. The VM template for the target # also needs to be created on the runner host. -fedora-41-tests: +fedora-43-tests: extends: .integration_tests variables: # needed by libvirt-gitlab-executor - DISTRO: fedora-41 + DISTRO: fedora-43 # can be overridden in forks to set a different runner tag LIBVIRT_CI_INTEGRATION_RUNNER_TAG: redhat-vm-host tags: - $LIBVIRT_CI_INTEGRATION_RUNNER_TAG needs: - - x86_64-fedora-41 + - x86_64-fedora-43 - project: libvirt/libvirt-perl - job: x86_64-fedora-41 + job: x86_64-fedora-43 ref: master artifacts: true - project: libvirt/libvirt-python - job: x86_64-fedora-41 + job: x86_64-fedora-43 ref: master artifacts: true @@ -53,22 +53,22 @@ fedora-41-tests: # and libvirt-python CI jobs, so the new target needs to be introduced # there before it can be used here. The VM template for the target # also needs to be created on the runner host. -.fedora-41-upstream-qemu-tests: +.fedora-43-upstream-qemu-tests: extends: .integration_tests variables: # needed by libvirt-gitlab-executor - DISTRO: fedora-41 + DISTRO: fedora-43 # can be overridden in forks to set a different runner tag LIBVIRT_CI_INTEGRATION_RUNNER_TAG: redhat-vm-host tags: - $LIBVIRT_CI_INTEGRATION_RUNNER_TAG needs: - - x86_64-fedora-41 + - x86_64-fedora-43 - project: libvirt/libvirt-perl - job: x86_64-fedora-41 + job: x86_64-fedora-43 ref: master artifacts: true - project: libvirt/libvirt-python - job: x86_64-fedora-41 + job: x86_64-fedora-43 ref: master artifacts: true diff --git a/ci/manifest.yml b/ci/manifest.yml index 21d570cb00..e41cbfaf62 100644 --- a/ci/manifest.yml +++ b/ci/manifest.yml @@ -104,14 +104,6 @@ targets: containers: false builds: false - fedora-41: - jobs: - - arch: x86_64 - artifacts: - expire_in: 1 day - paths: - - libvirt-rpms - fedora-42: jobs: - arch: x86_64 @@ -120,6 +112,14 @@ targets: paths: - libvirt-rpms + fedora-43: + jobs: + - arch: x86_64 + artifacts: + expire_in: 1 day + paths: + - libvirt-rpms + - arch: mingw32 builds: false -- 2.51.0

3 2

[PATCH 0/4] cover letter: qemu: Implement support for iommufd
by Nathan Chen 22 Nov '25

22 Nov '25

Hi, This series implements support for using iommufd to propagate DMA mappings to the kernel for VM-assigned host devices in a qemu VM. We add a new 'iommufd' attribute for hostdev devices to be associated with the iommufd object. For instance, specifying the iommufd object and associated hostdev in a VM definition: <devices> ... <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0009' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x15' slot='0x00' function='0x0'/> </hostdev> <hostdev mode='subsystem' type='pci' managed='no'> <driver iommufd='yes'/> <source> <address domain='0x0019' bus='0x01' slot='0x00' function='0x0'/> </source> <address type='pci' domain='0x0000' bus='0x16' slot='0x00' function='0x0'/> </hostdev> ... </devices> This would get translated to a qemu command line with the arguments below. Note that libvirt will open the /dev/iommu and VFIO cdev, passing the associated fd number to qemu: -object '{"qom-type":"iommufd","id":"iommufd0","fd":"24"}' \ -device '{"driver":"vfio-pci","host":"0009:01:00.0","id":"hostdev0","iommufd":"iommufd0","fd":"22","bus":"pci.21","addr":"0x0"}' \ -device '{"driver":"vfio-pci","host":"0019:01:00.0","id":"hostdev1","iommufd":"iommufd0","fd":"25","bus":"pci.22","addr":"0x0"}' \ This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/iommufd-10-23-25 Thanks, Nathan Signed-off-by: Nathan Chen <nathanc(a)nvidia.com> Nathan Chen (4): qemu: Implement support for associating iommufd to hostdev qemu: open iommufd FDs from libvirt backend qemu: Update Cgroup, namespace, and seclabel for qemu to access iommufd paths tests: qemuxmlconfdata: provide iommufd sample XML and CLI args docs/formatdomain.rst | 8 + src/conf/device_conf.c | 9 + src/conf/device_conf.h | 1 + src/conf/schemas/basictypes.rng | 5 + src/qemu/qemu_cgroup.c | 61 +++++ src/qemu/qemu_cgroup.h | 1 + src/qemu/qemu_command.c | 62 ++++- src/qemu/qemu_command.h | 3 +- src/qemu/qemu_domain.c | 8 + src/qemu/qemu_domain.h | 7 + src/qemu/qemu_hotplug.c | 2 +- src/qemu/qemu_namespace.c | 44 ++++ src/qemu/qemu_process.c | 232 ++++++++++++++++++ src/security/security_apparmor.c | 15 ++ src/security/security_dac.c | 34 +++ src/security/security_selinux.c | 34 +++ src/security/virt-aa-helper.c | 11 +- src/util/virpci.c | 68 +++++ src/util/virpci.h | 1 + .../iommufd-q35.x86_64-latest.args | 41 ++++ .../iommufd-q35.x86_64-latest.xml | 60 +++++ tests/qemuxmlconfdata/iommufd-q35.xml | 38 +++ .../iommufd-virt.aarch64-latest.args | 33 +++ .../iommufd-virt.aarch64-latest.xml | 34 +++ tests/qemuxmlconfdata/iommufd-virt.xml | 22 ++ .../iommufd.x86_64-latest.args | 35 +++ .../qemuxmlconfdata/iommufd.x86_64-latest.xml | 38 +++ tests/qemuxmlconfdata/iommufd.xml | 30 +++ tests/qemuxmlconftest.c | 4 + 29 files changed, 934 insertions(+), 7 deletions(-) create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-q35.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-q35.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd-virt.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd-virt.xml create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iommufd.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommufd.xml -- 2.43.0

4 20

[PATCH] docs: bhyve: document VNC's wait attribute
by Roman Bogorodskiy 21 Nov '25

21 Nov '25

Document the new VNC's 'wait' attribute in: - drvbhyve.rst - formatdomain.rst - NEWS.rst Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- NEWS.rst | 5 +++++ docs/drvbhyve.rst | 10 ++++++++++ docs/formatdomain.rst | 4 ++++ 3 files changed, 19 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 3c3a88ba5b..e2d382d5f8 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -19,6 +19,11 @@ v11.10.0 (unreleased) * **Improvements** + * bhyve: VNC ``wait`` attribute support + + Bhyve guests can now be configured to wait for a VNC connection before + booting. + * **Bug fixes** diff --git a/docs/drvbhyve.rst b/docs/drvbhyve.rst index 73372ff7cf..c0f4cd8a1f 100644 --- a/docs/drvbhyve.rst +++ b/docs/drvbhyve.rst @@ -429,6 +429,16 @@ Note: VNC password authentication is known to be cryptographically weak. Additionally, the password is passed as a command line argument in clear text. Make sure you understand the risks associated with this feature before using it. +:since:`Since 11.10.0`, the guest can be configured to wait for an incoming +VNC connection before booting: + +:: + + <graphics type='vnc' port='5904' wait='yes'> + <listen type='address' address='127.0.0.1'/> + </graphics> + + Clock configuration ~~~~~~~~~~~~~~~~~~~ diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index c6d0b183d0..3d3a6b5a6e 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -6902,6 +6902,10 @@ interaction with the admin. ID is specified, then the default audio backend will be used. :since:`Since 7.2.0, qemu`. + The optional ``wait`` attribute, when set to ``yes``, causes the guest + to wait for an incoming VNC connection before booting. + :since:`Since 11.10.0, bhyve`. + ``spice`` :since:`Since 0.8.6` Starts a SPICE server. The ``port`` attribute specifies the TCP port number (with -1 as legacy syntax indicating that it should be -- 2.51.2

2 1

[PATCH] tests: Don't link vmx2xmltest with esx_lib
by Michal Privoznik 21 Nov '25

21 Nov '25

From: Michal Privoznik <mprivozn(a)redhat.com> When reworking the vmx2xmltest to call esxParseVMXFileName() from the ESX driver I also made the test link with the driver statically. But the function then calls some other functions which are mocked in vmx2xmlmock. Now, on many systems this works just fine as the dynamic linker finds the mocked functions first. But on Fedora 41 and Fedora 42 the dynamic linker resolves the symbols to those from statically linked library rendering our mock ineffective. Just don't link in the esx_lib. Fixes: f82d30307da8bea396a32dcab2ba9be5c3236b7c Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Green pipeline: https://gitlab.com/MichalPrivoznik/libvirt/-/pipelines/2172179136 tests/meson.build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/meson.build b/tests/meson.build index 1f25f674f4..bb6ee6b4ee 100644 --- a/tests/meson.build +++ b/tests/meson.build @@ -550,7 +550,7 @@ endif if conf.has('WITH_VMX') and conf.has('WITH_ESX') tests += [ - { 'name': 'vmx2xmltest', 'include': [ esx_inc_dir ], 'link_with': [ esx_lib ] }, + { 'name': 'vmx2xmltest', 'include': [ esx_inc_dir ] }, { 'name': 'xml2vmxtest' }, ] mock_libs += [ -- 2.51.0

2 1

[PATCH RESEND] qemu: Remove redundant kvm group config in sysusers.d
by Achill Gilgenast 21 Nov '25

21 Nov '25

It's already defined by default in systemd: https://github.com/systemd/systemd/blob/v257.6/sysusers.d/basic.conf.in#L32 Adding it again here in libvirt-qemu.sysusers.conf causes the following warning by validating it with sd-sysuers: /usr/lib/sysusers.d/libvirt-qemu.conf:1: Conflict with earlier configuration for group 'kvm' in /usr/lib/sysusers.d/basic.conf:32, ignoring line. I don't know if the GID is important, but from simple grepping around it doesn't seem that way. Signed-off-by: Achill Gilgenast <achill(a)achill.org> --- src/qemu/libvirt-qemu.sysusers.conf | 1 - 1 file changed, 1 deletion(-) diff --git a/src/qemu/libvirt-qemu.sysusers.conf b/src/qemu/libvirt-qemu.sysusers.conf index 3189191e738a..05c35f94d814 100644 --- a/src/qemu/libvirt-qemu.sysusers.conf +++ b/src/qemu/libvirt-qemu.sysusers.conf @@ -1,4 +1,3 @@ -g kvm 36 g qemu 107 u qemu 107:qemu "qemu user" - - m qemu kvm -- 2.51.2

2 1

[PATCH 0/2] bhyve: support VNC 'wait' attribute
by Roman Bogorodskiy 21 Nov '25

21 Nov '25

Roman Bogorodskiy (2): conf: introduce 'wait' attribute for VNC bhyve: support VNC 'wait' attribute src/bhyve/bhyve_command.c | 3 ++ src/conf/domain_conf.c | 11 +++++ src/conf/domain_conf.h | 1 + src/conf/schemas/domaincommon.rng | 5 +++ .../bhyvexml2argv-vnc-wait-no.args | 13 ++++++ .../bhyvexml2argv-vnc-wait-no.ldargs | 1 + .../bhyvexml2argv-vnc-wait-no.xml | 26 +++++++++++ .../bhyvexml2argv-vnc-wait.args | 13 ++++++ .../bhyvexml2argv-vnc-wait.ldargs | 1 + .../bhyvexml2argv-vnc-wait.xml | 26 +++++++++++ tests/bhyvexml2argvtest.c | 2 + .../bhyvexml2xmlout-vnc-wait-no.xml | 44 +++++++++++++++++++ .../bhyvexml2xmlout-vnc-wait.xml | 44 +++++++++++++++++++ tests/bhyvexml2xmltest.c | 2 + 14 files changed, 192 insertions(+) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-vnc-wait-no.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-vnc-wait-no.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-vnc-wait-no.xml create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-vnc-wait.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-vnc-wait.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-vnc-wait.xml create mode 100644 tests/bhyvexml2xmloutdata/bhyvexml2xmlout-vnc-wait-no.xml create mode 100644 tests/bhyvexml2xmloutdata/bhyvexml2xmlout-vnc-wait.xml -- 2.51.2

3 8

[PATCH] cputest: Skip test for Intel(R) Xeon(R) 6788P CPU when QEMU driver is disabled
by Jaroslav Suchanek 21 Nov '25

21 Nov '25

From: Jaroslav Suchanek <jsuchane(a)redhat.com> Commit 034f02d25cd8de8c7875d7b12e762df4809a8418 added new test for the Intel(R) Xeon(R) 6788P cpu model. The test depends on QEMU driver. If the driver is not available, then skip it. Similarly as in commit c22b73411732b9a135923c19b7784c7c48729042. Signed-off-by: Jaroslav Suchanek <jsuchane(a)redhat.com> --- tests/cputest.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cputest.c b/tests/cputest.c index 16bbae7ba5..a7d6ea8736 100644 --- a/tests/cputest.c +++ b/tests/cputest.c @@ -1226,7 +1226,7 @@ mymain(void) DO_TEST_CPUID(VIR_ARCH_X86_64, "Ryzen-9-9950X-16-Core", JSON_MODELS); DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-5110", JSON_NONE); DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-6731E", JSON_MODELS); - DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-6788P", JSON_MODELS); + DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-6788P", JSON_MODELS_REQUIRED); DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-Bronze-3408U", JSON_MODELS_REQUIRED); DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E3-1225-v5", JSON_MODELS); DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E3-1245-v5", JSON_MODELS); -- 2.50.1 (Apple Git-155)

2 1

[PATCH] tests: skip vmx tests when ESX is disabled
by Daniel P. Berrangé 21 Nov '25

21 Nov '25

From: Daniel P. Berrangé <berrange(a)redhat.com> Since the recent change: commit f82d30307da8bea396a32dcab2ba9be5c3236b7c Author: Michal Prívozník <mprivozn(a)redhat.com> Date: Fri Nov 14 10:35:14 2025 +0100 vmx2xmltest: Drop custom file name parse function The VMX parsing uses the esxParseVMXFileName() function in the ESX library. This is unavailable when the ESX driver is disabled, so the tests must be skipped too. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- tests/meson.build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/meson.build b/tests/meson.build index cd53e48aa4..1f25f674f4 100644 --- a/tests/meson.build +++ b/tests/meson.build @@ -548,7 +548,7 @@ if conf.has('WITH_VMWARE') ] endif -if conf.has('WITH_VMX') +if conf.has('WITH_VMX') and conf.has('WITH_ESX') tests += [ { 'name': 'vmx2xmltest', 'include': [ esx_inc_dir ], 'link_with': [ esx_lib ] }, { 'name': 'xml2vmxtest' }, -- 2.51.1

2 1

[PATCH] Allow passt to create user namespaces
by Daniel P. Berrangé 21 Nov '25

21 Nov '25

From: BlueC0re <bluecore90(a)googlemail.com> Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- This comes from https://gitlab.com/libvirt/libvirt/-/merge_requests/493 I'm willing to add my own SoB since it is trivial, but I would like a sanity-check from someone more familiar with AppArmor so re-posting here before pushing. src/security/apparmor/libvirt-qemu | 1 + 1 file changed, 1 insertion(+) diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu index e4aceacd70..f736b37fe5 100644 --- a/src/security/apparmor/libvirt-qemu +++ b/src/security/apparmor/libvirt-qemu @@ -194,6 +194,7 @@ /usr/bin/passt Cx -> passt, profile passt { + userns, /usr/bin/passt r, signal (receive) set=("term") peer=/usr/sbin/libvirtd, -- 2.51.1

1 0

[PATCH 0/9] esx: Allow disk images in subdirectories
by Michal Privoznik 21 Nov '25

21 Nov '25

*** BLURB HERE *** Michal Prívozník (9): libvirt_esx.syms: Put proper header file name into comment esx: Expose esxParseVMXFileName() for tests esx: Make esxVI_LookupDatastoreList() mockable esx: Make esxVI_LookupDatastoreHostMount() mockable esx: Make esxVI_LookupDatastoreByName() mockable tests: Introduce vmx2xmlmock vmx2xmltest: Drop custom file name parse function esx: Allow disk images in subdirectories vmx2xmltest: Add a test case for disks in subfolder src/esx/esx_driver.c | 24 +++-- src/esx/esx_driverpriv.h | 27 ++++++ src/esx/esx_vi.h | 6 +- src/libvirt_esx.syms | 23 +++++ tests/meson.build | 5 +- tests/vmx2xmldata/esx-in-the-wild-17.vmx | 106 +++++++++++++++++++++++ tests/vmx2xmldata/esx-in-the-wild-17.xml | 46 ++++++++++ tests/vmx2xmlmock.c | 79 +++++++++++++++++ tests/vmx2xmltest.c | 62 +++---------- 9 files changed, 308 insertions(+), 70 deletions(-) create mode 100644 src/esx/esx_driverpriv.h create mode 100644 tests/vmx2xmldata/esx-in-the-wild-17.vmx create mode 100644 tests/vmx2xmldata/esx-in-the-wild-17.xml create mode 100644 tests/vmx2xmlmock.c -- 2.51.0

3 14

[RFC PATCH] qemu_validate: Fix aarch64 ACPI firmware type check
by Kazuhiro Abe 21 Nov '25

21 Nov '25

Although QEMU allows ACPI with UEFI firmware via the '-bios' option on aarch64, libvirt rejected such configurations through its validation. Therefore, the conditional statement was changed to allow the following settings: <os> <type arch='aarch64' machine='virt-4.0'>hvm</type> <loader type="rom">/usr/share/qemu-efi-aarch64/QEMU_EFI.fd</loader> </os> <features> <acpi/> </features> Specifying <os firmware='bios'> still results in error, as before. Signed-off-by: Kazuhiro Abe <fj1078ii(a)aa.jp.fujitsu.com> --- src/qemu/qemu_validate.c | 2 +- ...auto-bios-acpi-aarch64.aarch64-latest.err} | 0 .../firmware-auto-bios-acpi-aarch64.xml | 17 ++++++++++ ...ual-noefi-acpi-aarch64.aarch64-latest.args | 31 +++++++++++++++++++ ...nual-noefi-acpi-aarch64.aarch64-latest.xml | 29 +++++++++++++++++ tests/qemuxmlconftest.c | 3 +- 6 files changed, 80 insertions(+), 2 deletions(-) rename tests/qemuxmlconfdata/{firmware-manual-noefi-acpi-aarch64.aarch64-latest.err => firmware-auto-bios-acpi-aarch64.aarch64-latest.err} (100%) create mode 100644 tests/qemuxmlconfdata/firmware-auto-bios-acpi-aarch64.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-noefi-acpi-aarch64.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/firmware-manual-noefi-acpi-aarch64.aarch64-latest.xml diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c index 3b0f2b50a5..263aaa25a2 100644 --- a/src/qemu/qemu_validate.c +++ b/src/qemu/qemu_validate.c @@ -1341,7 +1341,7 @@ qemuValidateDomainDef(const virDomainDef *def, /* On aarch64, ACPI requires UEFI */ if (def->features[VIR_DOMAIN_FEATURE_ACPI] == VIR_TRISTATE_SWITCH_ON && def->os.arch == VIR_ARCH_AARCH64 && - (def->os.firmware != VIR_DOMAIN_OS_DEF_FIRMWARE_EFI && + (def->os.firmware == VIR_DOMAIN_OS_DEF_FIRMWARE_BIOS && !virDomainDefHasOldStyleUEFI(def))) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("ACPI requires UEFI on this architecture")); diff --git a/tests/qemuxmlconfdata/firmware-manual-noefi-acpi-aarch64.aarch64-latest.err b/tests/qemuxmlconfdata/firmware-auto-bios-acpi-aarch64.aarch64-latest.err similarity index 100% rename from tests/qemuxmlconfdata/firmware-manual-noefi-acpi-aarch64.aarch64-latest.err rename to tests/qemuxmlconfdata/firmware-auto-bios-acpi-aarch64.aarch64-latest.err diff --git a/tests/qemuxmlconfdata/firmware-auto-bios-acpi-aarch64.xml b/tests/qemuxmlconfdata/firmware-auto-bios-acpi-aarch64.xml new file mode 100644 index 0000000000..37c4efdb80 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-auto-bios-acpi-aarch64.xml @@ -0,0 +1,17 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <vcpu placement='static'>1</vcpu> + <os firmware='bios'> + <type arch='aarch64' machine='virt-4.0'>hvm</type> + </os> + <features> + <acpi/> + </features> + <devices> + <emulator>/usr/bin/qemu-system-aarch64</emulator> + <controller type='usb' model='none'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/firmware-manual-noefi-acpi-aarch64.aarch64-latest.args b/tests/qemuxmlconfdata/firmware-manual-noefi-acpi-aarch64.aarch64-latest.args new file mode 100644 index 0000000000..fe79a7e746 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-manual-noefi-acpi-aarch64.aarch64-latest.args @@ -0,0 +1,31 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-aarch64 \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-machine virt-4.0,usb=off,gic-version=2,dump-guest-core=off,memory-backend=mach-virt.ram,acpi=on \ +-accel tcg \ +-cpu cortex-a15 \ +-m size=1048576k \ +-object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":1073741824}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \ +-mon chardev=charmonitor,id=monitor,mode=control \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/firmware-manual-noefi-acpi-aarch64.aarch64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-noefi-acpi-aarch64.aarch64-latest.xml new file mode 100644 index 0000000000..b713a65714 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-manual-noefi-acpi-aarch64.aarch64-latest.xml @@ -0,0 +1,29 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <currentMemory unit='KiB'>1048576</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='aarch64' machine='virt-4.0'>hvm</type> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <gic version='2'/> + </features> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>cortex-a15</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-aarch64</emulator> + <controller type='usb' index='0' model='none'/> + <controller type='pci' index='0' model='pcie-root'/> + <audio id='1' type='none'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index dd55c1ef28..122e644caf 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -1554,10 +1554,11 @@ mymain(void) DO_TEST_CAPS_LATEST("firmware-manual-efi-acpi-q35"); DO_TEST_CAPS_ARCH_LATEST("firmware-manual-efi-noacpi-aarch64", "aarch64"); DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-manual-efi-noacpi-q35"); - DO_TEST_CAPS_ARCH_LATEST_PARSE_ERROR("firmware-manual-noefi-acpi-aarch64", "aarch64"); + DO_TEST_CAPS_ARCH_LATEST("firmware-manual-noefi-acpi-aarch64", "aarch64"); DO_TEST_CAPS_LATEST("firmware-manual-noefi-acpi-q35"); DO_TEST_CAPS_ARCH_LATEST("firmware-manual-noefi-noacpi-aarch64", "aarch64"); DO_TEST_CAPS_LATEST("firmware-manual-noefi-noacpi-q35"); + DO_TEST_CAPS_ARCH_LATEST_PARSE_ERROR("firmware-auto-bios-acpi-aarch64", "aarch64"); /* Ensure that legacy firmware paths keep working */ DO_TEST_CAPS_LATEST("firmware-manual-efi-secboot-legacy-paths"); -- 2.43.0

3 2

[PATCH v4 0/4] cover letter: qemu: Implement support for multiple device-pluggable SMMUv3s
by Nathan Chen 20 Nov '25

20 Nov '25

Hi, This is a follow up to the third patchset [0] for supporting multiple device-pluggable vSMMU instances. This patchset implements support for specifying multiple <iommu> devices within the VM definition when smmuv3 IOMMU model is specified with a pciBus driver attribute, and is tested with Shameer's recently accepted qemu series for user-creatable vSMMU devices [1] For instance, specifying the associated emulated device in a VM definition with multiple IOMMUs, configured to be routed to pcie-expander-bus or pcie-root controllers: <devices> <controller type='pci' index='0' model='pcie-root'/> <controller type='pci' index='1' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='252'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </controller> <controller type='pci' index='2' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='2' port='0x0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </controller> ... <rng model='virtio'> <backend model='random'>/dev/urandom</backend> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </rng> <rng model='virtio'> <backend model='random'>/dev/urandom</backend> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> </rng> <iommu model='smmuv3'> <driver pciBus='0'/> </iommu> <iommu model='smmuv3'> <driver pciBus='1'/> </iommu> </devices> This would get translated to a qemu command line with the arguments below. -device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ -device '{"driver":"pcie-root-port","port":0,"chassis":2,"id":"pci.2","bus":"pci.1","addr":"0x0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pcie.0","id":"smmuv3.0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"smmuv3.1"}' \ ... -object '{"qom-type":"rng-random","id":"objrng0","filename":"/dev/urandom"}' \ -device '{"driver":"virtio-rng-pci","rng":"objrng0","id":"rng0","bus":"pci.2","addr":"0x0"}' \ -object '{"qom-type":"rng-random","id":"objrng1","filename":"/dev/urandom"}' \ -device '{"driver":"virtio-rng-pci","rng":"objrng1","id":"rng1","bus":"pcie.0","addr":"0x4"}' \ Changes from v3: - Fixed formatting and removed unnecessary logic - Break instead of returning in switch statement for qemuBuildIOMMUCommandLine - Create a separate commit for formatting IOMMU devices after controllers in qemu command - Included Reviewed-by tag on qemuxmlconftest commit Changes from v2: - Make multi-iommu adoption the first commit - Consolidate smmuv3Dev into smmuv3 model - Change 'parentIdx' attribute name to 'pciBus' - Change naming of virDomainDef 'iommu' attribute to 'iommus' - Move multi-iommu check to validation code - Move qemu dev props function to device-pluggable smmuv3 commit - Fix conditional statements per feedback Changes from v1: - Moved parentIdx attribute under <driver> - Revised qemuxmlconfdata test cases to attach emulated devices This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/nestedsmmuv3-no-accel-11-1… Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/5MHA… [1] https://lore.kernel.org/qemu-devel/20250829082543.7680-1-skolothumtho@nvidi… Signed-off-by: Nathan Chen <nathanc(a)nvidia.com> Nathan Chen (4): conf: Support multiple device-pluggable smmuv3 IOMMUs qemu: Implement pluggable-device smmuv3 qemu: Format IOMMU devices after controllers tests: qemuxmlconfdata: provide device-pluggable smmuv3 sample XML and CLI args docs/formatdomain.rst | 4 + src/conf/domain_conf.c | 100 ++++++++-- src/conf/domain_conf.h | 10 +- src/conf/domain_validate.c | 61 ++++-- src/conf/schemas/domaincommon.rng | 9 +- src/libvirt_private.syms | 2 + src/qemu/qemu_alias.c | 15 +- src/qemu/qemu_command.c | 184 +++++++++++------- src/qemu/qemu_domain.c | 2 +- src/qemu/qemu_domain_address.c | 5 +- src/qemu/qemu_driver.c | 8 +- src/qemu/qemu_postparse.c | 9 +- src/qemu/qemu_validate.c | 2 +- .../iommu-smmuv3-pci-bus.aarch64-latest.args | 41 ++++ .../iommu-smmuv3-pci-bus.aarch64-latest.xml | 62 ++++++ .../qemuxmlconfdata/iommu-smmuv3-pci-bus.xml | 49 +++++ tests/qemuxmlconftest.c | 1 + 17 files changed, 440 insertions(+), 124 deletions(-) create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus.xml -- 2.43.0

2 10

[PATCH 0/5] tools: improve virt-host-validate output
by Daniel P. Berrangé 20 Nov '25

20 Nov '25

It now gives some details for certain checks: QEMU: Checking for hardware virtualization : PASS (VMX) QEMU: Checking if device '/dev/kvm' exists : PASS QEMU: Checking if device '/dev/kvm' is accessible : PASS QEMU: Checking if device '/dev/vhost-net' exists : PASS QEMU: Checking if device '/dev/net/tun' exists : PASS QEMU: Checking for cgroup 'cpu' controller support : PASS QEMU: Checking for cgroup 'cpuacct' controller support : PASS QEMU: Checking for cgroup 'cpuset' controller support : PASS QEMU: Checking for cgroup 'memory' controller support : PASS QEMU: Checking for cgroup 'devices' controller support : PASS QEMU: Checking for cgroup 'blkio' controller support : PASS QEMU: Checking for device assignment IOMMU support : PASS (DMAR) QEMU: Checking if IOMMU is enabled by kernel : PASS QEMU: Checking for secure guest support : PASS (TDX) Daniel P. Berrangé (5): tools: allow passing details for passed validation tests tools: inform user which IOMMU was found during validation tools: inform user which CVM is found during validation tools: be explicit about failure to find x86 secure virt tools: inform user which hardware virt was found during validation tools/virt-host-validate-common.c | 60 ++++++++++++------------------- tools/virt-host-validate-qemu.c | 16 ++++++--- tools/virt-validate-common.c | 12 ++++++- tools/virt-validate-common.h | 1 + 4 files changed, 47 insertions(+), 42 deletions(-) -- 2.51.1

2 12

[libvirt PATCH] qemu: make qemuBuildDeviceAddressPCIGetBus more generic
by Ján Tomko 20 Nov '25

20 Nov '25

From: Ján Tomko <jtomko(a)redhat.com> Operate on a virPCIDeviceAddress, not virDomainDeviceInfo so that this can be reused to look for buses that are not stored in the device info. Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- A prerequisite for the SMMUv3 series src/qemu/qemu_command.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index c56c321a6e..d5a4201e12 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -332,7 +332,7 @@ qemuBuildMasterKeyCommandLine(virCommand *cmd, static char * qemuBuildDeviceAddressPCIGetBus(const virDomainDef *domainDef, - const virDomainDeviceInfo *info) + const virPCIDeviceAddress *pci) { g_autofree char *devStr = NULL; const char *contAlias = NULL; @@ -340,14 +340,14 @@ qemuBuildDeviceAddressPCIGetBus(const virDomainDef *domainDef, int contTargetIndex = 0; size_t i; - if (!(devStr = virPCIDeviceAddressAsString(&info->addr.pci))) + if (!(devStr = virPCIDeviceAddressAsString(pci))) return NULL; for (i = 0; i < domainDef->ncontrollers; i++) { virDomainControllerDef *cont = domainDef->controllers[i]; if (cont->type == VIR_DOMAIN_CONTROLLER_TYPE_PCI && - cont->idx == info->addr.pci.bus) { + cont->idx == pci->bus) { contAlias = cont->info.alias; contIsPHB = virDomainControllerIsPSeriesPHB(cont); contTargetIndex = cont->opts.pciopts.targetIndex; @@ -355,7 +355,7 @@ qemuBuildDeviceAddressPCIGetBus(const virDomainDef *domainDef, if (!contAlias) { virReportError(VIR_ERR_INTERNAL_ERROR, _("Device alias was not set for PCI controller with index '%1$u' required for device at address '%2$s'"), - info->addr.pci.bus, devStr); + pci->bus, devStr); return NULL; } @@ -397,7 +397,7 @@ qemuBuildDeviceAddressPCIGetBus(const virDomainDef *domainDef, if (!contAlias) { virReportError(VIR_ERR_INTERNAL_ERROR, _("Could not find PCI controller with index '%1$u' required for device at address '%2$s'"), - info->addr.pci.bus, devStr); + pci->bus, devStr); return NULL; } @@ -584,7 +584,7 @@ qemuBuildDeviceAddressProps(virJSONValue *props, switch (info->type) { case VIR_DOMAIN_DEVICE_ADDRESS_TYPE_PCI: { g_autofree char *pciaddr = NULL; - g_autofree char *bus = qemuBuildDeviceAddressPCIGetBus(domainDef, info); + g_autofree char *bus = qemuBuildDeviceAddressPCIGetBus(domainDef, &info->addr.pci); if (!bus) return -1; -- 2.51.1

2 1

[PATCH 0/2] qemu: fix capabilities reporting for TDX
by Daniel P. Berrangé 20 Nov '25

20 Nov '25

The capabilities reporting merged for TDX was flawed because it would always report TDX as supported simply if QEMU was new enough to have 'tdx-guest'. IOW, all x86 hosts currently report 'tdx' as fully supported which is a regression for AMD hosts, as we're now reporting incorrect data there which can confuse mgmt apps. Unfortunately the 'query-tdx-capabilities' QMP command that was in early postings: https://mail.gnu.org/archive/html/qemu-devel/2021-07/msg01689.html went missing and I'm not seeing an alternative way to query QEMU to see if TDX is actually launchable. So in these patches I open /dev/kvm and directly ask of the 'TDX' VM type is supported by KVM, which IIUC is equivalent to waht the original 'query-tdx-capabilities' patch was doing. Daniel P. Berrangé (2): qemu: correctly detect working TDX support qemu: always report TDX feature caps on x86 src/qemu/qemu_capabilities.c | 71 +++++++++++++++++-- src/qemu/qemu_capabilities.h | 3 + .../qemu_10.0.0-q35.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_10.0.0-q35.x86_64.xml | 1 + .../qemu_10.0.0-tcg.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_10.0.0-tcg.x86_64.xml | 1 + .../qemu_10.0.0.x86_64+amdsev.xml | 1 + tests/domaincapsdata/qemu_10.0.0.x86_64.xml | 1 + .../qemu_10.1.0-tcg.x86_64+inteltdx.xml | 1 + .../domaincapsdata/qemu_10.1.0-tcg.x86_64.xml | 1 + .../domaincapsdata/qemu_10.2.0-tcg.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_6.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_6.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_7.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.1.0.x86_64.xml | 1 + .../qemu_7.2.0-hvf.x86_64+hvf.xml | 1 + .../domaincapsdata/qemu_7.2.0-q35.x86_64.xml | 1 + .../qemu_7.2.0-tcg.x86_64+hvf.xml | 1 + .../domaincapsdata/qemu_7.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_7.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.1.0.x86_64.xml | 1 + .../domaincapsdata/qemu_8.2.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_8.2.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_8.2.0.x86_64.xml | 1 + .../domaincapsdata/qemu_9.0.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_9.0.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_9.0.0.x86_64.xml | 1 + .../domaincapsdata/qemu_9.1.0-q35.x86_64.xml | 1 + .../domaincapsdata/qemu_9.1.0-tcg.x86_64.xml | 1 + tests/domaincapsdata/qemu_9.1.0.x86_64.xml | 1 + .../qemu_9.2.0-q35.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_9.2.0-q35.x86_64.xml | 1 + .../qemu_9.2.0-tcg.x86_64+amdsev.xml | 1 + .../domaincapsdata/qemu_9.2.0-tcg.x86_64.xml | 1 + .../qemu_9.2.0.x86_64+amdsev.xml | 1 + tests/domaincapsdata/qemu_9.2.0.x86_64.xml | 1 + tests/domaincapsmock.c | 6 ++ 47 files changed, 120 insertions(+), 4 deletions(-) -- 2.51.1

3 10

[libvirt PATCH 0/3] build: drop userfaultfd_sysctl option
by Ján Tomko 20 Nov '25

20 Nov '25

Ján Tomko (3): qemu: drop postcopy-migration.sysctl spec: drop with_userfaultfd_sysctl build: drop userfaultfd_sysctl option libvirt.spec.in | 18 ------------------ meson.build | 7 ------- meson_options.txt | 2 -- src/qemu/meson.build | 8 -------- src/qemu/postcopy-migration.sysctl | 6 ------ 5 files changed, 41 deletions(-) delete mode 100644 src/qemu/postcopy-migration.sysctl -- 2.51.1

2 4

[PATCH v3 0/3] qemu: Implement support for multiple device-pluggable SMMUv3s
by Nathan Chen 20 Nov '25

20 Nov '25

Hi, This is a follow up to the second patchset [0] for supporting multiple device-pluggable vSMMU instances. (re-sending this series for review) This patchset implements support for specifying multiple <iommu> devices within the VM definition when smmuv3 IOMMU model is specified with a pciBus driver attribute, and is tested with Shameer's recently accepted qemu series for user-creatable vSMMU devices [1] For instance, specifying the associated emulated device in a VM definition with multiple IOMMUs, configured to be routed to pcie-expander-bus or pcie-root controllers: <devices> <controller type='pci' index='0' model='pcie-root'/> <controller type='pci' index='1' model='pcie-expander-bus'> <model name='pxb-pcie'/> <target busNr='252'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </controller> <controller type='pci' index='2' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='2' port='0x0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </controller> ... <rng model='virtio'> <backend model='random'>/dev/urandom</backend> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </rng> <rng model='virtio'> <backend model='random'>/dev/urandom</backend> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> </rng> <iommu model='smmuv3'> <driver pciBus='0'/> </iommu> <iommu model='smmuv3'> <driver pciBus='1'/> </iommu> </devices> This would get translated to a qemu command line with the arguments below. -device '{"driver":"pxb-pcie","bus_nr":252,"id":"pci.1","bus":"pcie.0","addr":"0x1"}' \ -device '{"driver":"pcie-root-port","port":0,"chassis":2,"id":"pci.2","bus":"pci.1","addr":"0x0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pcie.0","id":"smmuv3.0"}' \ -device '{"driver":"arm-smmuv3","primary-bus":"pci.1","id":"smmuv3.1"}' \ ... -object '{"qom-type":"rng-random","id":"objrng0","filename":"/dev/urandom"}' \ -device '{"driver":"virtio-rng-pci","rng":"objrng0","id":"rng0","bus":"pci.2","addr":"0x0"}' \ -object '{"qom-type":"rng-random","id":"objrng1","filename":"/dev/urandom"}' \ -device '{"driver":"virtio-rng-pci","rng":"objrng1","id":"rng1","bus":"pcie.0","addr":"0x4"}' \ Changes from v2: - Make multi-iommu adoption the first commit - Consolidate smmuv3Dev into smmuv3 model - Change 'parentIdx' attribute name to 'pciBus' - Change naming of virDomainDef 'iommu' attribute to 'iommus' - Move multi-iommu check to validation code - Move qemu dev props function to device-pluggable smmuv3 commit - Fix conditional statements per feedback Changes from v1: - Moved parentIdx attribute under <driver> - Revised qemuxmlconfdata test cases to attach emulated devices This series is on Github: https://github.com/NathanChenNVIDIA/libvirt/tree/nestedsmmuv3-no-accel-10-2… Thanks, Nathan [0] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/IF6O… [1] https://lore.kernel.org/qemu-devel/20250829082543.7680-1-skolothumtho@nvidi… Nathan Chen (3): conf: Support multiple device-pluggable smmuv3 IOMMUs qemu: Implement pluggable-device smmuv3 tests: qemuxmlconfdata: provide device-pluggable smmuv3 sample XML and CLI args docs/formatdomain.rst | 4 + src/conf/domain_conf.c | 100 +++++++-- src/conf/domain_conf.h | 10 +- src/conf/domain_validate.c | 61 ++++-- src/conf/schemas/domaincommon.rng | 9 +- src/libvirt_private.syms | 2 + src/qemu/qemu_alias.c | 15 +- src/qemu/qemu_command.c | 197 ++++++++++++------ src/qemu/qemu_domain.c | 2 +- src/qemu/qemu_domain_address.c | 5 +- src/qemu/qemu_driver.c | 8 +- src/qemu/qemu_postparse.c | 11 +- src/qemu/qemu_validate.c | 2 +- .../iommu-smmuv3-pci-bus.aarch64-latest.args | 41 ++++ .../iommu-smmuv3-pci-bus.aarch64-latest.xml | 62 ++++++ .../qemuxmlconfdata/iommu-smmuv3-pci-bus.xml | 49 +++++ tests/qemuxmlconftest.c | 1 + 17 files changed, 455 insertions(+), 124 deletions(-) create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus.aarch64-latest.args create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus.aarch64-latest.xml create mode 100644 tests/qemuxmlconfdata/iommu-smmuv3-pci-bus.xml -- 2.43.0

2 7

RFC Gitlab #692
by Wesley Hershberger 19 Nov '25

19 Nov '25

Hi all, I'm working on Gitlab #692 [1] and would appreciate a quick discussion/review/sanity check of the direction I'm planning to take before I invest many days in a solution that misses some major consideration. I'll provide a summary of the issue here and then lay out the two approaches I'm considering. The AppArmor sVirt driver creates & loads a dynamic AppArmor profile by passing a domain's XML description to a separate program `virt-aa-helper` (see [2] for more details). When a device is hotplugged to a domain, the `virt-aa-helper` is called with a flag (`-F`) which appends a rule for that device's backing resource to the profile. The profile is reloaded from the XML description whenever a device is hotunplugged. However, the XML description for some devices does not contain enough information to create the corresponding AppArmor rule. When a profile containing a dynamic rule is reloaded, the dynamic rule is lost, and the device fails (this has been observed with macvtap devices). A similar situation occurs when temporary write access to snapshot layers is needed during block-commit; the `virt-aa-helper` is called with `-F` to add the temporary access and the profile is reloaded at the end of the operation to remove it again. However, this can have the unintended side-effect of wiping out other temporary accesses (for concurrent blockcommits) or removing access for devices added with `-F` (macvtap). A solution must: - Be persistent across libvirtd restarts - Correctly synchronize concurrent profile modifications We've conceived of two broad approaches to this issue: 1. Add fields to the domain XML schema (and persist them) so that the profile can be correctly generated using only the domain's XML description. 2. Create a separate XML file `/etc/apparmor.d/libvirt/libvirt-UUID-dynamic.xml` with only the information needed to produce the dynamic rules; access would be synchronized by a lock in libvirtd. `virt-aa-helper` would consume this file every time it runs; the file would be removed on Domain shutdown. Option 1 (Add fields to Domain schema) Concerns: ================================================ - User-visible schema changes - Do additional fields make sense in the domain schema? e.g. - a macvtap device path `/dev/tapX` - permissions info in `backingStore` elements - It may be non-trivial to chase down every device that could be affected by this issue and plumb through the additional fields (i.e. a complete solution may not be possible) Option 2 (Separate AppArmor XML) Concerns: ========================================== - User-visible additional file - Not generalizable for (future) sVirt drivers that depend on synchronizing a global resource - May require adding remove/restore hooks for the following sVirt interfaces: - virSecurityDomainSetImageFDLabel domainSetSecurityImageFDLabel; - virSecurityDomainSetTapFDLabel domainSetSecurityTapFDLabel; I'd appreciate any input you'd be able to provide regarding the above trade-offs; specifically looking for guidance on what you would consider merging (in contrast to previous approaches [3]). Thanks very much for taking the time to review this, ~Wesley Hershberger Canonical Support [1] https://gitlab.com/libvirt/libvirt/-/issues/692 [2] https://gitlab.com/apparmor/apparmor/-/wikis/Libvirt [3] https://www.mail-archive.com/devel@lists.libvirt.org/msg07703.html

2 1

[PATCH 0/8] qemu: Add option to preserve shutdown VM during backup job and job/reconnection fixes
by Peter Krempa 19 Nov '25

19 Nov '25

This series first fixes few job handling, reconnection and backup job bugs and then implements an option to keep the VM process around when the guest OS shuts down during backup, so that the backup doesn't need to be restarted. Peter Krempa (8): virDomainNestedJobAllowed: Allow VIR_JOB_MODIFY_MIGRATION_SAFE if VIR_JOB_MODIFY is allowed qemuProcessReconnect: Continue reconnection if VM untergoes fake-reboot qemu: backup: Don't attempt to stop the NBD server twice qemuBlockJobProcessEventConcludedBackup: Notify the backup job later lib: Introduce VIR_DOMAIN_EVENT_SUSPENDED_GUEST_SHUTDOWN event reason lib: Introduce VIR_DOMAIN_BACKUP_BEGIN_PRESERVE_SHUTDOWN_DOMAIN flag qemu: backup: Add support for VIR_DOMAIN_BACKUP_BEGIN_PRESERVE_SHUTDOWN_DOMAIN kbase: Add note about preserving VM on shutdown to backup article docs/kbase/live_full_disk_backup.rst | 18 +++++ docs/manpages/virsh.rst | 6 ++ examples/c/misc/event-test.c | 3 + include/libvirt/libvirt-domain.h | 7 +- src/conf/backup_conf.h | 4 ++ src/conf/virdomainjob.c | 1 + src/libvirt-domain.c | 5 ++ src/qemu/qemu_backup.c | 61 +++++++++++++--- src/qemu/qemu_backup.h | 4 ++ src/qemu/qemu_blockjob.c | 7 +- src/qemu/qemu_driver.c | 2 +- src/qemu/qemu_process.c | 101 +++++++++++++++++++++++++-- src/qemu/qemu_process.h | 3 +- tools/virsh-backup.c | 7 ++ tools/virsh-domain-event.c | 3 +- 15 files changed, 210 insertions(+), 22 deletions(-) -- 2.51.1

2 11

[PATCH] docs: domain: add watchdog notification support
by Massimiliano Minella via B4 Relay 19 Nov '25

19 Nov '25

From: Massimiliano Minella <massimiliano.minella(a)se.com> Since v0.8.0 a watchdog notification is available under event ID VIR_DOMAIN_EVENT_ID_WATCHDOG, update the documentation to remove the previous limitation. Signed-off-by: Massimiliano Minella <massimiliano.minella(a)se.com> --- Remove limitation on notification support for watchdog. --- docs/formatdomain.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git docs/formatdomain.rst docs/formatdomain.rst index f50dce477f..d70022a239 100644 --- docs/formatdomain.rst +++ docs/formatdomain.rst @@ -8350,8 +8350,8 @@ The watchdog device requires an additional driver and management daemon in the guest. Just enabling the watchdog in the libvirt configuration does not do anything useful on its own. -Currently libvirt does not support notification when the watchdog fires. This -feature is planned for a future version of libvirt. +:since:`Since 0.8.0`, a notification is available when the watchdog fires, using +the event ID ``VIR_DOMAIN_EVENT_ID_WATCHDOG``. Having multiple watchdogs is usually not something very common, but be aware that this might happen, for example, when an implicit watchdog device is added --- base-commit: eb99bbaf2e5b1e91f4999c7a1ccc90d67dfbe471 change-id: 20251003-update_wd_doc-5aa9b43be09a Best regards, -- Massimiliano Minella <massimiliano.minella(a)se.com>

2 1

RE: [PATCH] docs: domain: add watchdog notification support
by Massimiliano MINELLA 19 Nov '25

19 Nov '25

Hello, do you have any feedback on this patch? Best regards, Massimiliano General -----Original Message----- From: Massimiliano Minella via B4 Relay <devnull+massimiliano.minella.se.com(a)kernel.org> Sent: vendredi 3 octobre 2025 10:45 To: devel(a)lists.libvirt.org Cc: Massimiliano MINELLA <massimiliano.minella(a)se.com> Subject: [PATCH] docs: domain: add watchdog notification support [External email: Use caution with links and attachments] ________________________________ From: Massimiliano Minella <massimiliano.minella(a)se.com> Since v0.8.0 a watchdog notification is available under event ID VIR_DOMAIN_EVENT_ID_WATCHDOG, update the documentation to remove the previous limitation. Signed-off-by: Massimiliano Minella <massimiliano.minella(a)se.com> --- Remove limitation on notification support for watchdog. --- docs/formatdomain.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git docs/formatdomain.rst docs/formatdomain.rst index f50dce477f..c99560a3bd 100644 --- docs/formatdomain.rst +++ docs/formatdomain.rst @@ -8350,8 +8350,8 @@ The watchdog device requires an additional driver and management daemon in the guest. Just enabling the watchdog in the libvirt configuration does not do anything useful on its own. -Currently libvirt does not support notification when the watchdog fires. This -feature is planned for a future version of libvirt. +:since:`Since 0.8.0` a notification when the watchdog fires is +available using the event ID ``VIR_DOMAIN_EVENT_ID_WATCHDOG``. Having multiple watchdogs is usually not something very common, but be aware that this might happen, for example, when an implicit watchdog device is added --- base-commit: eb99bbaf2e5b1e91f4999c7a1ccc90d67dfbe471 change-id: 20251003-update_wd_doc-5aa9b43be09a Best regards, -- Massimiliano Minella <massimiliano.minella(a)se.com>

1 0

[PATCH 0/2] Fix detect_zeroes setup in qemu and improve tests
by Peter Krempa 19 Nov '25

19 Nov '25

See 2/2 for explanation. Peter Krempa (2): qemuxmlconftest: Improve coverage of 'disk-detect-zeroes' test case qemuDomainPrepareDiskSourceData: Setup 'detect_zeroes' for all layers src/qemu/qemu_domain.c | 6 +--- .../xml2json/file-backing_basic-detect.json | 3 ++ .../file-backing_basic-unmap-detect.json | 3 ++ .../file-backing_basic-unmap-ignore.json | 3 ++ .../disk-detect-zeroes.x86_64-latest.args | 20 +++++++++--- tests/qemuxmlconfdata/disk-detect-zeroes.xml | 31 +++++++++++++++++-- 6 files changed, 55 insertions(+), 11 deletions(-) -- 2.51.1

3 4

Plans for 11.10.0 release (freeze on 2025-11-25)
by Jiri Denemark 18 Nov '25

18 Nov '25

We are getting close to 11.10.0 release of libvirt. To aim for the release on Monday 01 Dec I suggest entering the freeze on Tuesday 25 Nov and tagging RC2 on Thursday 27 Nov. I hope this works for everyone. Jirka

1 0

[PATCH-for-10.2 v3 0/2] docs: Update around MIPS/PPC host removal
by Philippe Mathieu-Daudé 18 Nov '25

18 Nov '25

Since v2: - Generic 32-bit host removal message (danpb) Since v1: - 11.0 -> 10.2 v0 Cover: - Clarify MIPS host removal - Mention PPC host was removed Philippe Mathieu-Daudé (2): docs: Correct release of MIPS deprecations / removals docs: Mention 32-bit PPC host as removed docs/about/deprecated.rst | 2 +- docs/about/removed-features.rst | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) -- 2.51.0

4 6

libvirt serial console on non-x86 platforms
by Leigh Brown 17 Nov '25

17 Nov '25

Hi Daniel, On a whim, I tried installing libvirt on a Raspberry Pi 5. I was pleasantly surprised to find that it all worked, apart from one small wrinkle. I typically use virt-install and set up a serial console, but this failed with the error: ERROR unsupported configuration: BIOS serial console only supported on x86 architectures I created the VM with a graphical console then manually adjusted the config afterwards to use a serial console and it all worked fine. After a bit of digging I saw an email[1] from yourself talking about how graphics=off has semantic effects beyond just controlling whether the firmware prints to the serial or not. After a bit more digging, I found out that Qemu 8.0[2] removed the sga device due to SeaBIOS 1.11.0 and newer supporting this feature natively when QEMU is started with the option -M graphics=off. I made the following small patch against the Debian package: --- libvirt-11.3.0.orig/src/qemu/qemu_validate.c +++ libvirt-11.3.0/src/qemu/qemu_validate.c @@ -1304,15 +1304,7 @@ qemuValidateDomainDef(const virDomainDef /* On x86 -machine graphics=off toggles the use of the * serial console in SeaBIOS (and theoretically other * firmwares). - * On non-x86, it has also sorts of other effects - * on QEMU device models created and so we don't - * want to allow its use. */ - if (!ARCH_IS_X86(def->os.arch)) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("BIOS serial console only supported on x86 architectures")); - return -1; - } if (!def->nserials) { virReportError(VIR_ERR_XML_ERROR, "%s", _("need at least one serial port to use BIOS serial output")); With that change, I can now create VMs with a serial console through virt-install on the Raspberry PI 5. Have I got this right? If so, I'm happy to submit the patch. Regards, Leigh. -- [1] https://mail.gnu.org/archive/html/qemu-devel/2021-09/msg02417.html [2] https://wiki.qemu.org/ChangeLog/8.0

2 4

[PATCH-for-10.2 v2 0/2] docs: Update around MIPS/PPC host removal
by Philippe Mathieu-Daudé 17 Nov '25

17 Nov '25

- Clarify MIPS host removal - Mention PPC host was removed Philippe Mathieu-Daudé (2): docs: Correct release of MIPS deprecations / removals docs: Mention 32-bit PPC host as removed docs/about/deprecated.rst | 2 +- docs/about/removed-features.rst | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-) -- 2.51.0

1 2

[RFC 0/4] cover: RFE libvirt secret encryption on disk
by Arun Menon 17 Nov '25

17 Nov '25

Libvirt secrets are stored unencrypted on the disk. With this series we want to start encrypting the secrets. First we introduce a secrets.conf file that has 2 configuration settings. 1. encrypt_data - This can be set to 0 or 1. If it is set to 1 then we encrypt the secrets. We recommend to keep this as the default setting. 2. master_encryption_key - This allows the user to set the path of the encryption file. The secrets.conf file is parsed during secrets driver initialization and accordingly the secrets are stored on the disk. By default the secrets driver will look into the CREDENTIALS_DIRECTORY environment variable in systemd. The systemd unit file is configured with a pre configured key using the SetCredentialEncrypted directive. This encrypted secret key is provided to the virtsecretd on service activation. If this file is not available, then the virtsecretd driver will check the master_encryption_key configuration in secrets.conf file, provided it is made available by the user. A boolean flag called value_encrypted is added to the secrets object, to indicate whether it is encrypted or not. This is not stored on the disk yet. It is important to add this functionality so that the secrets service behaves properly across restarts. This is a sincere attempt to improve upon the already submitted patch https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/KE6G… Resolves: https://issues.redhat.com/browse/RHEL-7125 Arun Menon (4): util: Add support for GnuTLS decryption secret: Set up default encrypted master key for the virtsecretd service secret: Add secrets.conf configuration file and parse it secret: Add functionality to load and save secrets in encrypted format libvirt.spec.in | 1 + src/conf/virsecretobj.c | 13 ++ src/conf/virsecretobj.h | 7 + src/libvirt_private.syms | 3 + src/secret/meson.build | 7 + src/secret/secret_driver.c | 168 +++++++++++++++++++++++- src/secret/secrets.conf.in | 14 ++ src/secret/virtsecretd.service.extra.in | 8 ++ src/util/vircrypto.c | 130 +++++++++++++++++- src/util/vircrypto.h | 8 ++ tests/vircryptotest.c | 65 +++++++++ 11 files changed, 420 insertions(+), 4 deletions(-) create mode 100644 src/secret/secrets.conf.in -- 2.51.1

3 15

[PATCH 0/4] selinux: skip fallback label restore for shared media
by Cole Robinson 13 Nov '25

13 Nov '25

https://issues.redhat.com/browse/RHEL-126945 selinux label set/restore has race conditions on qemu:///session, where the xattr label remembering path is not used. See the above issue for a more detailed description of the problem. This series dodges the issue by skipping the fallback label restore for readonly resources like kernel and initrd, basically anything that would get the virt_content_t label. Note, disks already skip _all_ attempts to remember or restore selinux labels if the disk is marked readonly or shareable, and has done so for a long time. Maybe we should extend that out for anything that is inherently readonly or shareable, like kernel + initrd. But for now I stuck with the more conservative approach. And finally, this doesn't actually fix the race condition. If label remembering is working, the refcounting covers us. But if you disable label remembering at the qemu.conf level, there's likely similar issues in the DAC driver even for qemu:///system. I did not look into fixing the race but I suspect it involves keeping the security driver locked until the VM fully boots up. First two patches are not strictly related, but I noticed them while I was in the area Patch 3 adds the plumbing but no behavior change Patch 4 changes behavior Cole Robinson (4): selinux: Match remember/recall arguments for SavedStateLabel selinux: Don't remember labels for shareable SCSI devices selinux: Add is_shared plumbing to RestoreFileLabel selinux: Mark anything using content_context as shared src/security/security_selinux.c | 107 +++++++++++++++++++------------- 1 file changed, 63 insertions(+), 44 deletions(-) -- 2.51.1

2 5

[PATCH] qemu: snapshot: Set umask for 'qemu-img' when creating external inactive snapshots
by Peter Krempa 13 Nov '25

13 Nov '25

From: Peter Krempa <pkrempa(a)redhat.com> External inactive snapshots are created by invoking 'qemu-img' which creates the file. Currently qemu-img creates image with mode 644 based on default umask as libvirt doesn't set any. Having a world-readable image is obviously wrong so set the umask to 0066 to have the file readable only by the owner. Resolves: https://bugs.debian.org/1120119 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/qemu/qemu_snapshot.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c index d4994dd54e..6868910d9a 100644 --- a/src/qemu/qemu_snapshot.c +++ b/src/qemu/qemu_snapshot.c @@ -228,6 +228,9 @@ qemuSnapshotCreateQcow2Files(virDomainDef *def, NULL))) return -1; + /* ensure that new files are only readable by the user */ + virCommandSetUmask(cmd, 0066); + /* adds cmd line arg: backing_fmt=format,backing_file=/path/to/backing/file */ virBufferAsprintf(&buf, "backing_fmt=%s,backing_file=", virStorageFileFormatTypeToString(defdisk->src->format)); -- 2.51.1

2 2

[PATCH] bhyve: s/provconn/privcon/
by Michal Privoznik 13 Nov '25

13 Nov '25

From: Michal Privoznik <mprivozn(a)redhat.com> Due to a typo, the bhyve driver doesn't compile. Fix it. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Merged as trivial. src/bhyve/bhyve_driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/bhyve/bhyve_driver.c b/src/bhyve/bhyve_driver.c index 3a4e83d3d2..4b1ca80fc6 100644 --- a/src/bhyve/bhyve_driver.c +++ b/src/bhyve/bhyve_driver.c @@ -487,7 +487,7 @@ bhyveDomainDefineXMLFlags(virConnectPtr conn, const char *xml, unsigned int flag return NULL; /* Avoid parsing the whole domain definition for ACL checks */ - if (!(def = virDomainDefIDsParseString(xml, provconn->xmlopt, parse_flags))) + if (!(def = virDomainDefIDsParseString(xml, privconn->xmlopt, parse_flags))) return NULL; if (virDomainDefineXMLFlagsEnsureACL(conn, def) < 0) @@ -896,7 +896,7 @@ bhyveDomainCreateXML(virConnectPtr conn, start_flags |= VIR_BHYVE_PROCESS_START_AUTODESTROY; /* Avoid parsing the whole domain definition for ACL checks */ - if (!(def = virDomainDefIDsParseString(xml, provconn->xmlopt, parse_flags))) + if (!(def = virDomainDefIDsParseString(xml, privconn->xmlopt, parse_flags))) return NULL; if (virDomainCreateXMLEnsureACL(conn, def) < 0) -- 2.51.0

1 0

[PATCH v5] qapi: net: deprecate vhostforce option
by Vladimir Sementsov-Ogievskiy 13 Nov '25

13 Nov '25

This option for tap and vhost-user netdevs doesn't make sense since long ago (10 years!), starting from commits: 1e7398a140f7a6 ("vhost: enable vhost without without MSI-X") 24f938a682d934 ("vhost user:support vhost user nic for non msi guests") Prior these commits, to enable kernel vhost-net, or vhost-user-net for some specific kind of guests (that don't have MSI-X support), you should have set vhostforce=on. Now guest type doesn't matter, all guests are equal for these options logic. For tap the current logic is: vhost=on / vhost=off : vhostforce ignored, doesn't make sense vhost unset : vhostforce counts, enabling vhost So you may enable vhost for tap several ways: - vhost=on - vhostforce=on - vhost=on + vhostforce=on - and even vhost=on + vhostforce=off - they are all equal. For vhost-user we simply ignore the vhostforce option at all in the code. Let's finally deprecate the extra options. Also, fix @vhostforce documentation everywhere to show the real picture, and update vhost-user test to not use deprecated option. While updating command line options, drop "experimental" word from "experimental in kernel accelerator". vhost-net is in production for years. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov(a)yandex-team.ru> --- v5: update wording and commit message docs/about/deprecated.rst | 11 +++++++++++ qapi/net.json | 18 ++++++++++++++---- qemu-options.hx | 13 +++++-------- tests/qtest/vhost-user-test.c | 2 +- 4 files changed, 31 insertions(+), 13 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index dacf2882e4..a781600a2f 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -484,6 +484,17 @@ Stream ``reconnect`` (since 9.2) The ``reconnect`` option only allows specifying second granularity timeouts, which is not enough for all types of use cases, use ``reconnect-ms`` instead. +TAP ``vhostforce`` (since 10.2) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The ``vhostforce`` option is redundant with the ``vhost`` option. +If they conflict, ``vhost`` takes precedence. Just use ``vhost``. + +Vhost-user ``vhostforce`` (since 10.2) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The ``vhostforce`` option is a no-op. Do not use it. + CPU device properties ''''''''''''''''''''' diff --git a/qapi/net.json b/qapi/net.json index 60d196afe5..e8ccc8afc2 100644 --- a/qapi/net.json +++ b/qapi/net.json @@ -346,13 +346,18 @@ # @vhostfds: file descriptors of multiple already opened vhost net # devices # -# @vhostforce: vhost on for non-MSIX virtio guests +# @vhostforce: enable vhost-net network accelerator. Ignored when +# @vhost is set. # # @queues: number of queues to be created for multiqueue capable tap # # @poll-us: maximum number of microseconds that could be spent on busy # polling for tap (since 2.7) # +# Features: +# +# @deprecated: Member @vhostforce is deprecated. Use @vhost instead. +# # Since: 1.2 ## { 'struct': 'NetdevTapOptions', @@ -369,7 +374,7 @@ '*vhost': 'bool', '*vhostfd': 'str', '*vhostfds': 'str', - '*vhostforce': 'bool', + '*vhostforce': { 'type': 'bool', 'features': [ 'deprecated' ] }, '*queues': 'uint32', '*poll-us': 'uint32'} } @@ -606,17 +611,22 @@ # # @chardev: name of a unix socket chardev # -# @vhostforce: vhost on for non-MSIX virtio guests (default: false). +# @vhostforce: silently ignored, exists just for backward +# compatibility. # # @queues: number of queues to be created for multiqueue vhost-user # (default: 1) (Since 2.5) # +# Features: +# +# @deprecated: Member @vhostforce is deprecated. +# # Since: 2.1 ## { 'struct': 'NetdevVhostUserOptions', 'data': { 'chardev': 'str', - '*vhostforce': 'bool', + '*vhostforce': { 'type': 'bool', 'features': [ 'deprecated' ] }, '*queues': 'int' } } ## diff --git a/qemu-options.hx b/qemu-options.hx index 0223ceffeb..35a70096e8 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -2882,7 +2882,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, #else "-netdev tap,id=str[,fd=h][,fds=x:y:...:z][,ifname=name][,script=file][,downscript=dfile]\n" " [,br=bridge][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off]\n" - " [,vhostfd=h][,vhostfds=x:y:...:z][,vhostforce=on|off][,queues=n]\n" + " [,vhostfd=h][,vhostfds=x:y:...:z][,queues=n]\n" " [,poll-us=n]\n" " configure a host TAP network backend with ID 'str'\n" " connected to a bridge (default=" DEFAULT_BRIDGE_INTERFACE ")\n" @@ -2898,9 +2898,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')\n" " use vnet_hdr=off to avoid enabling the IFF_VNET_HDR tap flag\n" " use vnet_hdr=on to make the lack of IFF_VNET_HDR support an error condition\n" - " use vhost=on to enable experimental in kernel accelerator\n" - " (only has effect for virtio guests which use MSIX)\n" - " use vhostforce=on to force vhost on for non-MSIX virtio guests\n" + " use vhost=on to enable in kernel accelerator\n" " use 'vhostfd=h' to connect to an already opened vhost net device\n" " use 'vhostfds=x:y:...:z to connect to multiple already opened vhost net devices\n" " use 'queues=n' to specify the number of queues to be created for multiqueue TAP\n" @@ -2991,7 +2989,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, " use 'start-queue=m' to specify the first queue that should be used\n" #endif #ifdef CONFIG_POSIX - "-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]\n" + "-netdev vhost-user,id=str,chardev=dev\n" " configure a vhost-user network, backed by a chardev 'dev'\n" #endif #ifdef __linux__ @@ -3882,12 +3880,11 @@ SRST for insertion into the socket map. The combination of 'map-path' and 'sock-fds' together is not supported. -``-netdev vhost-user,chardev=id[,vhostforce=on|off][,queues=n]`` +``-netdev vhost-user,chardev=id[,queues=n]`` Establish a vhost-user netdev, backed by a chardev id. The chardev should be a unix domain socket backed one. The vhost-user uses a specifically defined protocol to pass vhost ioctl replacement - messages to an application on the other end of the socket. On - non-MSIX guests, the feature can be forced with vhostforce. Use + messages to an application on the other end of the socket. Use 'queues=n' to specify the number of queues to be created for multiqueue vhost-user. diff --git a/tests/qtest/vhost-user-test.c b/tests/qtest/vhost-user-test.c index 609ff24059..a4862d7087 100644 --- a/tests/qtest/vhost-user-test.c +++ b/tests/qtest/vhost-user-test.c @@ -46,7 +46,7 @@ #define QEMU_CMD_SHM " -m %d -object memory-backend-shm,id=mem,size=%dM," \ " -numa node,memdev=mem" #define QEMU_CMD_CHR " -chardev socket,id=%s,path=%s%s" -#define QEMU_CMD_NETDEV " -netdev vhost-user,id=hs0,chardev=%s,vhostforce=on" +#define QEMU_CMD_NETDEV " -netdev vhost-user,id=hs0,chardev=%s" #define HUGETLBFS_MAGIC 0x958458f6 -- 2.48.1

3 3

[PATCH 0/1] cpu_map: fix vmx-* features wrong bitmaps
by Hector Cao 12 Nov '25

12 Nov '25

Hello, I'm unable to make virsh capabilities to detect the right CPU model on an Intel Granite Rapids platform. I would expect the get the CPU model defined in one of the src/cpu_map/x86_GraniteRapids*.xml files. The cause of the wrong detection is the fact that some vmx-* are not correctly detected and considered missing on this platform. When I take a look at the src/cpu_map/x86_features.xml file, I think that some of the vmx-* are wrongly defined. Taking as an example the vmx-apicv-xapic feature, it is defined as the first bit in the EAX register when we read the MSR 0x0000048b . But in Intel specification, this feature is represented as the first bit in the EDX register (32 higher bits). You can find in this submission the patch that fixes this issue, and this for all the affected MSRs. I tested this fix on my Granite Rapids platform and the CPU model is now correctly detected. Hector Cao (1): cpu_map: fix vmx-* features wrong bitmaps src/cpu_map/x86_features.xml | 136 +++++++++++++++++------------------ 1 file changed, 68 insertions(+), 68 deletions(-) -- 2.45.2

4 10

[PATCH 0/2] Remove use of deprecated 'xmlIndentTreeOutput' variable from libxml2
by Peter Krempa 11 Nov '25

11 Nov '25

The default from libxml2 is '1' which we wanted. Thus all use in separate processes is okay, and for the few exceptions (see 2/2) the resulting XML is mis-indented but valid for any app which would override it. Peter Krempa (2): virVBoxSnapshotConfSaveVboxFile: Don't modify deprecated 'xmlIndentTreeOutput' virXMLFormatMetadata: Don't modify deprecated 'xmlIndentTreeOutput' src/util/virxml.c | 10 ---------- src/vbox/vbox_snapshot_conf.c | 5 ----- 2 files changed, 15 deletions(-) -- 2.51.1

3 6

[PATCH 0/4] bhyve: support queue configuration for NVMe disks
by Roman Bogorodskiy 11 Nov '25

11 Nov '25

Roman Bogorodskiy (4): conf: domain_validate: make disk queue configuration driver specific bhyve: support queue configuration for NVMe disks bhyve: domain: refactor bhyveDomainDeviceDefValidate() bhyve: domain: improve disks validation src/bhyve/bhyve_command.c | 16 ++- src/bhyve/bhyve_domain.c | 110 +++++++++++++----- src/conf/domain_validate.c | 12 -- src/qemu/qemu_driver.c | 15 +++ src/qemu/qemu_validate.c | 14 +++ .../bhyvexml2argv-disk-virtio-queue-opts.xml | 23 ++++ .../bhyvexml2argvdata/bhyvexml2argv-nvme.args | 2 +- .../bhyvexml2argvdata/bhyvexml2argv-nvme.xml | 2 +- tests/bhyvexml2argvtest.c | 1 + .../bhyvexml2xmlout-nvme.xml | 2 +- 10 files changed, 148 insertions(+), 49 deletions(-) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-disk-virtio-queue-opts.xml -- 2.51.0

3 7

[PATCH 0/7] Fixes for CVE-2025-12748
by Martin Kletzander 11 Nov '25

11 Nov '25

ACL checks were performed after parsing a user provided XML in its entirety which could be written in a way that would make libvirt allocate too much memory and crash. Instead parse just the identifiers out of which only name and UUID are needed for ACL checks, perform those and then parse the whole definition. In order not to pass bogus UUID to the ACL functions, rewrite any generated UUID in the first step with a nil UUID since the ACLs cannot be written to expect a particular generated UUID as that would not make sense. If squashing the patches is preferred, let me know. Fixes: CVE-2025-12748 Reported-by: Святослав Терешин <s.tereshin(a)fobos-nt.ru> Martin Kletzander (7): conf: Add virDomainDefIDsParseString bhyve: Check ACLs before parsing the whole domain XML libxl: Check ACLs before parsing the whole domain XML lxc: Check ACLs before parsing the whole domain XML vz: Check ACLs before parsing the whole domain XML ch: Check ACLs before parsing the whole domain XML qemu: Check ACLs before parsing the whole domain XML src/bhyve/bhyve_driver.c | 24 ++++++++--- src/ch/ch_driver.c | 76 +++++++++++++++++++++++---------- src/conf/domain_conf.c | 29 +++++++++++++ src/conf/domain_conf.h | 3 ++ src/libvirt_private.syms | 1 + src/libxl/libxl_driver.c | 20 ++++++--- src/lxc/lxc_driver.c | 22 +++++++--- src/qemu/qemu_driver.c | 90 ++++++++++++++++++++------------------- src/qemu/qemu_migration.c | 21 ++++++++- src/qemu/qemu_migration.h | 4 +- src/qemu/qemu_saveimage.c | 25 +++++++++-- src/qemu/qemu_saveimage.h | 4 +- src/qemu/qemu_snapshot.c | 4 +- src/vz/vz_driver.c | 18 +++++--- 14 files changed, 243 insertions(+), 98 deletions(-) -- 2.51.2

3 14

Does our interface compatibility promise cover defaults?
by Markus Armbruster 11 Nov '25

11 Nov '25

From about/deprecated.rst: In general features are intended to be supported indefinitely once introduced into QEMU. In the event that a feature needs to be removed, it will be listed in this section. The feature will remain functional for the release in which it was deprecated and one further release. After these two releases, the feature is liable to be removed. Deprecated features may also generate warnings on the console when QEMU starts up, or if activated via a monitor command, however, this is not a mandatory requirement. This obviously applies to syntax and semantics of our external interface. Does it apply to default values there? If no: does this mean we can change defaults without notice? If yes: does this mean any change of defaults needs notice in about/deprecated.rst and the grace period? Note that changing a default is a silent change, like changing semantics / behavior, unlike changing syntax.

3 2

[PATCH] meson: default to system crypto policies where available
by Daniel P. Berrangé 10 Nov '25

10 Nov '25

From: Daniel P. Berrangé <berrange(a)redhat.com> In RHEL and Fedora, the built-in GNUTLS default priority is changed from "NORMAL" to "@SYSTEM", but because libvirt sets an explicit policy with gnutls we don't honour that. Instead we force "NORMAL" unless the 'tls_priority' meson option is changed. In RPM builds, meanwhile, we ask for "@LIBVIRT,SYSTEM" to make it look for a libvirt specific profile first, falling back to "@SYSTEM" This changes the meson option to default to "@LIBVIRT,SYSTEM" if the crypto-policies config is present on the local machine and the meson option -Dsystem=true is given. This gives developers more appropriate default behaviour, matching that seen in package builds. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- meson.build | 13 ++++++++++++- meson_options.txt | 2 +- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/meson.build b/meson.build index d68b37d0ba..c1871de64c 100644 --- a/meson.build +++ b/meson.build @@ -2035,7 +2035,18 @@ elif get_option('userfaultfd_sysctl').enabled() error('userfaultfd_sysctl option requires sysctl_config to be enabled') endif -conf.set_quoted('TLS_PRIORITY', get_option('tls_priority')) +prio = get_option('tls_priority') +if prio == 'auto' + # If local OS has 'crypto-policies' then default to that + policy = '/etc/crypto-policies/config' + if get_option('system') and \ + run_command('test', '-f', policy, check: false).returncode() == 0 + prio = '@LIBVIRT,SYSTEM' + else + prio = 'NORMAL' + endif +endif +conf.set_quoted('TLS_PRIORITY', prio) # test options diff --git a/meson_options.txt b/meson_options.txt index 3dc3e8667b..8b6b26dfc6 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -134,4 +134,4 @@ option('ssh_proxy', type: 'feature', value: 'auto', description: 'Build ssh-prox option('sysctl_config', type: 'feature', value: 'auto', description: 'Whether to install sysctl configs') # dep:sysctl_config option('userfaultfd_sysctl', type: 'feature', value: 'auto', description: 'Whether to install sysctl config for enabling unprivileged userfaultfd') -option('tls_priority', type: 'string', value: 'NORMAL', description: 'set the default TLS session priority string') +option('tls_priority', type: 'string', value: 'auto', description: 'set the default TLS session priority string') -- 2.51.1

2 1

[PATCH 0/3] docs: drvbhyve: documentation updates
by Roman Bogorodskiy 10 Nov '25

10 Nov '25

*** BLURB HERE *** Roman Bogorodskiy (3): docs: drvbhyve: document device passthrough docs: drvbhyve: improve the manpage link docs: drvbhyve: add guest-specific nodes section docs/drvbhyve.rst | 42 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-) -- 2.51.0

2 4

Downloading/uploading a VM from/to ESXi
by Konstantin Kharlamov 10 Nov '25

10 Nov '25

Hi, I'm in need of functional of downloading and uploading a VM from esxi. libvirt seems to lack it. From what I studied, at least downloading should be implemented by ExportVM SOAP function, and then by getting a list of URLs from its returned lease, while pinging the lease to make sure it doesn't timeout. I'm wondering is there any interest in libvirt in accepting such functional?

1 0